@claryai/cli 0.1.0

package/dist/dbt/targets/Bigquery/oauth.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getBigqueryCredentialsFromOauth = void 0;
+const common_1 = require("@lightdash/common");
+const google_auth_library_1 = require("google-auth-library");
+const getBigqueryCredentialsFromOauth = async () => {
+    const auth = new google_auth_library_1.GoogleAuth();
+    const credentials = await auth.getApplicationDefault();
+    if (credentials.credential instanceof google_auth_library_1.UserRefreshClient) {
+        // eslint-disable-next-line @typescript-eslint/naming-convention
+        const { _clientId, _clientSecret, _refreshToken, projectId } = credentials.credential;
+        if (_clientId && _clientSecret && _refreshToken) {
+            return {
+                client_id: _clientId,
+                client_secret: _clientSecret,
+                refresh_token: _refreshToken,
+                project_id: projectId || '',
+                type: 'authorized_user',
+            };
+        }
+        throw new common_1.ParseError(`Cannot get credentials from UserRefreshClient`);
+    }
+    else if (credentials.credential instanceof google_auth_library_1.ExternalAccountClient ||
+        credentials.credential instanceof google_auth_library_1.IdentityPoolClient) {
+        // Support ADC via workforce identity federation / external_account configuration.
+        // In this case we should rely on ADC at runtime and not pass explicit credentials.
+        return {
+            authenticationType: common_1.BigqueryAuthenticationType.ADC,
+        };
+    }
+    else if ('email' in credentials.credential &&
+        'key' in credentials.credential) {
+        // Works with service credentials
+        const { email, key, projectId } = credentials.credential;
+        return {
+            client_email: email,
+            private_key: key,
+            project_id: projectId,
+        };
+    }
+    throw new common_1.ParseError(`Cannot get credentials from oauth`);
+};
+exports.getBigqueryCredentialsFromOauth = getBigqueryCredentialsFromOauth;

package/dist/dbt/targets/Bigquery/serviceAccount.d.ts

@@ -0,0 +1,35 @@
+import { JSONSchemaType } from 'ajv';
+import { Target } from '../../types';
+export type BigqueryServiceAccountTarget = {
+    type: 'bigquery';
+    project: string;
+    dataset: string;
+    threads?: number;
+    method: 'service-account' | 'oauth';
+    keyfile: string;
+    priority?: 'interactive' | 'batch';
+    retries?: number;
+    location?: string;
+    maximum_bytes_billed?: number;
+    timeout_seconds?: number;
+    execution_project?: string;
+};
+export declare const bigqueryServiceAccountSchema: JSONSchemaType<BigqueryServiceAccountTarget>;
+export declare const getBigqueryCredentialsFromServiceAccount: (target: Target) => Promise<Record<string, string>>;
+export type BigqueryServiceAccountJsonTarget = {
+    type: 'bigquery';
+    method: 'service-account-json';
+    project: string;
+    dataset: string;
+    threads?: number;
+    keyfile_json: object;
+    priority?: 'interactive' | 'batch';
+    retries?: number;
+    location?: string;
+    maximum_bytes_billed?: number;
+    timeout_seconds?: number;
+    execution_project?: string;
+};
+export declare const bigqueryServiceAccountJsonSchema: JSONSchemaType<BigqueryServiceAccountJsonTarget>;
+export declare const getBigqueryCredentialsFromServiceAccountJson: (target: Target) => Promise<Record<string, string>>;
+//# sourceMappingURL=serviceAccount.d.ts.map

package/dist/dbt/targets/Bigquery/serviceAccount.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serviceAccount.d.ts","sourceRoot":"","sources":["../../../../src/dbt/targets/Bigquery/serviceAccount.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,KAAK,CAAC;AAGrC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC,MAAM,MAAM,4BAA4B,GAAG;IACvC,IAAI,EAAE,UAAU,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC;IACnC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC9B,CAAC;AACF,eAAO,MAAM,4BAA4B,EAAE,cAAc,CAAC,4BAA4B,CAqDjF,CAAC;AAEN,eAAO,MAAM,wCAAwC,GACjD,QAAQ,MAAM,KACf,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAwBhC,CAAC;AAEF,MAAM,MAAM,gCAAgC,GAAG;IAC3C,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE,sBAAsB,CAAC;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC;IACnC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC9B,CAAC;AACF,eAAO,MAAM,gCAAgC,EAAE,cAAc,CAAC,gCAAgC,CAqDzF,CAAC;AAEN,eAAO,MAAM,4CAA4C,GACrD,QAAQ,MAAM,KACf,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAsBhC,CAAC"}

package/dist/dbt/targets/Bigquery/serviceAccount.js

@@ -0,0 +1,149 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getBigqueryCredentialsFromServiceAccountJson = exports.bigqueryServiceAccountJsonSchema = exports.getBigqueryCredentialsFromServiceAccount = exports.bigqueryServiceAccountSchema = void 0;
+const common_1 = require("@lightdash/common");
+const fs_1 = require("fs");
+const ajv_1 = require("../../../ajv");
+exports.bigqueryServiceAccountSchema = {
+    type: 'object',
+    properties: {
+        type: {
+            type: 'string',
+            enum: ['bigquery'],
+        },
+        project: {
+            type: 'string',
+        },
+        dataset: {
+            type: 'string',
+        },
+        threads: {
+            type: 'integer',
+            minimum: 1,
+            nullable: true,
+        },
+        method: {
+            type: 'string',
+            enum: ['service-account', 'oauth'],
+        },
+        keyfile: {
+            type: 'string',
+        },
+        priority: {
+            type: 'string',
+            enum: ['interactive', 'batch'],
+            nullable: true,
+        },
+        retries: {
+            type: 'integer',
+            nullable: true,
+        },
+        location: {
+            type: 'string',
+            nullable: true,
+        },
+        maximum_bytes_billed: {
+            type: 'integer',
+            nullable: true,
+        },
+        timeout_seconds: {
+            type: 'integer',
+            nullable: true,
+        },
+        execution_project: {
+            type: 'string',
+            nullable: true,
+        },
+    },
+    required: ['type', 'project', 'dataset', 'method', 'keyfile'],
+};
+const getBigqueryCredentialsFromServiceAccount = async (target) => {
+    const validate = ajv_1.ajv.compile(exports.bigqueryServiceAccountSchema);
+    if (validate(target)) {
+        const keyfilePath = target.keyfile;
+        try {
+            return JSON.parse(await fs_1.promises.readFile(keyfilePath, 'utf8'));
+        }
+        catch (e) {
+            const msg = (0, common_1.getErrorMessage)(e);
+            throw new common_1.ParseError(`Cannot read keyfile for bigquery target expect at: ${keyfilePath}:\n  ${msg}`);
+        }
+    }
+    const lineErrorMessages = (validate.errors || [])
+        .map((err) => `Field at ${err.instancePath} ${err.message}`)
+        .join('\n');
+    throw new common_1.ParseError(`Couldn't read profiles.yml file for ${target.type}:\n  ${lineErrorMessages}`);
+};
+exports.getBigqueryCredentialsFromServiceAccount = getBigqueryCredentialsFromServiceAccount;
+exports.bigqueryServiceAccountJsonSchema = {
+    type: 'object',
+    properties: {
+        type: {
+            type: 'string',
+            enum: ['bigquery'],
+        },
+        project: {
+            type: 'string',
+        },
+        dataset: {
+            type: 'string',
+        },
+        threads: {
+            type: 'integer',
+            minimum: 1,
+            nullable: true,
+        },
+        method: {
+            type: 'string',
+            enum: ['service-account-json'],
+        },
+        keyfile_json: {
+            type: 'object',
+        },
+        priority: {
+            type: 'string',
+            enum: ['interactive', 'batch'],
+            nullable: true,
+        },
+        retries: {
+            type: 'integer',
+            nullable: true,
+        },
+        location: {
+            type: 'string',
+            nullable: true,
+        },
+        maximum_bytes_billed: {
+            type: 'integer',
+            nullable: true,
+        },
+        timeout_seconds: {
+            type: 'integer',
+            nullable: true,
+        },
+        execution_project: {
+            type: 'string',
+            nullable: true,
+        },
+    },
+    required: ['type', 'project', 'dataset', 'method', 'keyfile_json'],
+};
+const getBigqueryCredentialsFromServiceAccountJson = async (target) => {
+    const validate = ajv_1.ajv.compile(exports.bigqueryServiceAccountJsonSchema);
+    if (validate(target)) {
+        return Object.entries(target.keyfile_json).reduce((acc, [key, value]) => {
+            if (typeof value === 'string') {
+                acc[key] = value.replaceAll(/\\n/gm, '\n'); // replace escaped newlines. Prevents error: Error: error:1E08010C:DECODER routines::unsupported
+            }
+            else {
+                acc[key] = value;
+            }
+            return acc;
+        }, {});
+    }
+    const lineErrorMessages = (validate.errors || [])
+        .map((err) => `Field at ${err.instancePath} ${err.message}`)
+        .join('\n');
+    throw new common_1.ParseError(`Couldn't read profiles.yml file for ${target.type}:\n  ${lineErrorMessages}`);
+};
+exports.getBigqueryCredentialsFromServiceAccountJson = getBigqueryCredentialsFromServiceAccountJson;

package/dist/dbt/targets/Databricks/oauth.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Default OAuth client ID for Databricks U2M authentication.
+ * This matches the client ID used by dbt-databricks.
+ */
+export declare const DATABRICKS_DEFAULT_OAUTH_CLIENT_ID = "dbt-databricks";
+/**
+ * Databricks OAuth tokens result
+ */
+export interface DatabricksOAuthTokens {
+    accessToken: string;
+    refreshToken: string;
+    expiresAt: number;
+}
+/**
+ * Perform Databricks U2M OAuth flow
+ * Opens browser for user authentication and exchanges authorization code for tokens
+ * @param host Databricks workspace host
+ * @param clientId OAuth client ID (defaults to 'databricks-cli')
+ */
+export declare const performDatabricksOAuthFlow: (host: string, clientId: string, clientSecret: string | undefined) => Promise<DatabricksOAuthTokens>;
+//# sourceMappingURL=oauth.d.ts.map

package/dist/dbt/targets/Databricks/oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../../../src/dbt/targets/Databricks/oauth.ts"],"names":[],"mappings":"AAUA;;;GAGG;AACH,eAAO,MAAM,kCAAkC,mBAAmB,CAAC;AAEnE;;GAEG;AACH,MAAM,WAAW,qBAAqB;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACrB;AAED;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,GACnC,MAAM,MAAM,EACZ,UAAU,MAAM,EAChB,cAAc,MAAM,GAAG,SAAS,KACjC,OAAO,CAAC,qBAAqB,CAmO/B,CAAC"}

package/dist/dbt/targets/Databricks/oauth.js

@@ -0,0 +1,184 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.performDatabricksOAuthFlow = exports.DATABRICKS_DEFAULT_OAUTH_CLIENT_ID = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@lightdash/common");
+const http = tslib_1.__importStar(require("http"));
+const node_fetch_1 = tslib_1.__importDefault(require("node-fetch"));
+const openid_client_1 = require("openid-client");
+const ora_1 = tslib_1.__importDefault(require("ora"));
+const url_1 = require("url");
+const globalState_1 = tslib_1.__importDefault(require("../../../globalState"));
+const oauth_1 = require("../../../handlers/login/oauth");
+const styles = tslib_1.__importStar(require("../../../styles"));
+/**
+ * Default OAuth client ID for Databricks U2M authentication.
+ * This matches the client ID used by dbt-databricks.
+ */
+exports.DATABRICKS_DEFAULT_OAUTH_CLIENT_ID = 'dbt-databricks';
+/**
+ * Perform Databricks U2M OAuth flow
+ * Opens browser for user authentication and exchanges authorization code for tokens
+ * @param host Databricks workspace host
+ * @param clientId OAuth client ID (defaults to 'databricks-cli')
+ */
+const performDatabricksOAuthFlow = async (host, clientId, clientSecret) => {
+    // Create a promise that will be resolved when we get the authorization code
+    let resolveAuth;
+    let rejectAuth;
+    const authPromise = new Promise((resolve, reject) => {
+        resolveAuth = resolve;
+        rejectAuth = reject;
+    });
+    let port = 0;
+    // Generate PKCE values
+    const codeVerifier = openid_client_1.generators.codeVerifier();
+    const codeChallenge = openid_client_1.generators.codeChallenge(codeVerifier);
+    const state = openid_client_1.generators.state();
+    // Create HTTP server to handle the callback at root path
+    const server = http.createServer((req, res) => {
+        const callbackUrl = new url_1.URL(req.url || '/', `http://localhost:${port}`);
+        const code = callbackUrl.searchParams.get('code');
+        const returnedState = callbackUrl.searchParams.get('state');
+        const error = callbackUrl.searchParams.get('error');
+        res.setHeader('Content-Type', 'text/html');
+        if (error === 'access_denied') {
+            rejectAuth(new common_1.AuthorizationError(`OAuth error: access denied`));
+            res.writeHead(400);
+            res.end('<html><body><h1>Authentication Failed</h1><p>Access denied. You can close this window.</p></body></html>');
+            return;
+        }
+        if (error) {
+            rejectAuth(new common_1.AuthorizationError(`OAuth error: ${error}`));
+            res.writeHead(400);
+            res.end(`<html><body><h1>Authentication Failed</h1><p>Error: ${error}</p></body></html>`);
+            return;
+        }
+        if (!code || !returnedState) {
+            rejectAuth(new common_1.AuthorizationError('Missing authorization code or state'));
+            res.writeHead(400);
+            res.end('<html><body><h1>Authentication Failed</h1><p>Missing authorization code or state.</p></body></html>');
+            return;
+        }
+        if (returnedState !== state) {
+            rejectAuth(new common_1.AuthorizationError('Authentication session expired or invalid'));
+            res.writeHead(400);
+            res.end('<html><body><h1>Authentication Failed</h1><p>Session expired or invalid. Please close this window and try again.</p></body></html>');
+            return;
+        }
+        // Success - resolve the promise
+        resolveAuth({ code, state: returnedState });
+        res.writeHead(200);
+        res.end('<html><body><h1>Authentication Successful</h1><p>You can close this window and return to the CLI.</p></body></html>');
+    });
+    // Start the server on port 8020 (standard for Databricks CLI)
+    const preferredPort = 8020;
+    await new Promise((resolve, reject) => {
+        server.on('error', (err) => {
+            // perhaps 8020 port is busy, but we can't use a random port
+            reject(err);
+        });
+        server.listen(preferredPort, () => {
+            const address = server.address();
+            if (address === null)
+                throw new Error('Failed to get server address');
+            if (typeof address === 'object') {
+                port = address.port;
+            }
+            else {
+                port = parseInt(address.toString(), 10);
+            }
+            globalState_1.default.debug(`> OAuth callback server listening on port ${port}`);
+            resolve();
+        });
+    });
+    const redirectUri = `http://localhost:${port}`;
+    globalState_1.default.debug(`> Starting CLI callback server on URI: ${redirectUri}`);
+    try {
+        // Build Databricks authorization URL
+        const authUrl = new url_1.URL('/oidc/v1/authorize', `https://${host}`);
+        authUrl.searchParams.set('client_id', clientId);
+        authUrl.searchParams.set('redirect_uri', redirectUri);
+        authUrl.searchParams.set('response_type', 'code');
+        authUrl.searchParams.set('scope', 'all-apis offline_access');
+        authUrl.searchParams.set('code_challenge', codeChallenge);
+        authUrl.searchParams.set('code_challenge_method', 'S256');
+        authUrl.searchParams.set('state', state);
+        // Pause any active spinner while authenticating
+        const parentSpinner = globalState_1.default.getActiveSpinner();
+        const wasSpinning = parentSpinner?.isSpinning;
+        parentSpinner?.stop();
+        const divider = styles.secondary('─'.repeat(process.stdout.columns || 80));
+        console.error(`\n${divider}`);
+        console.error(`${styles.title('🔐  Databricks Authentication')}`);
+        // Try to open the browser
+        await (0, oauth_1.openBrowser)(authUrl.href);
+        // Show spinner with fallback URL — both disappear on success
+        // Use ora directly to avoid overwriting the global active spinner
+        const authSpinner = (0, ora_1.default)(`  Waiting for authentication in browser...\n` +
+            `   If it doesn't open, visit: ${styles.secondary(authUrl.href)}`).start();
+        // Wait for the authorization code
+        let code;
+        try {
+            ({ code } = await authPromise);
+            authSpinner.stop();
+        }
+        catch (e) {
+            authSpinner.fail(`  Databricks authentication failed`);
+            throw e;
+        }
+        globalState_1.default.debug(`> Got authorization code ${code.substring(0, 10)}...`);
+        // Exchange the authorization code for tokens
+        const tokenUrl = new url_1.URL('/oidc/v1/token', `https://${host}`);
+        // Build token request parameters
+        const tokenParams = {
+            grant_type: 'authorization_code',
+            code,
+            client_id: clientId,
+            redirect_uri: redirectUri,
+            code_verifier: codeVerifier,
+        };
+        // For confidential clients (custom OAuth apps), include client_secret
+        if (clientSecret) {
+            tokenParams.client_secret = clientSecret;
+        }
+        const tokenResponse = await (0, node_fetch_1.default)(tokenUrl.href, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/x-www-form-urlencoded',
+            },
+            body: new URLSearchParams(tokenParams),
+        });
+        if (!tokenResponse.ok) {
+            const errorText = await tokenResponse.text();
+            throw new common_1.AuthorizationError(`Token exchange failed: ${tokenResponse.status} ${errorText}`);
+        }
+        const tokenData = (await tokenResponse.json());
+        const accessToken = tokenData.access_token;
+        const refreshToken = tokenData.refresh_token;
+        const expiresIn = tokenData.expires_in;
+        if (!accessToken || !refreshToken) {
+            throw new common_1.AuthorizationError('No access token or refresh token received from Databricks');
+        }
+        globalState_1.default.debug(`> OAuth access token: ${accessToken.substring(0, 10)}...`);
+        globalState_1.default.debug(`> OAuth refresh token: ${refreshToken.substring(0, 10)}...`);
+        // Calculate expiration timestamp (current time + expires_in)
+        const expiresAt = Math.floor(Date.now() / 1000) + expiresIn;
+        console.error(`${styles.success('✔')}   Successfully authenticated with Databricks`);
+        console.error(`${divider}\n`);
+        // Restart the parent spinner if it was active
+        if (wasSpinning) {
+            parentSpinner?.start();
+        }
+        return {
+            accessToken,
+            refreshToken,
+            expiresAt,
+        };
+    }
+    finally {
+        // Clean up the server
+        server.close();
+    }
+};
+exports.performDatabricksOAuthFlow = performDatabricksOAuthFlow;

package/dist/dbt/targets/athena.d.ts

@@ -0,0 +1,21 @@
+import { CreateAthenaCredentials } from '@lightdash/common';
+import { JSONSchemaType } from 'ajv';
+import { Target } from '../types';
+export type AthenaTarget = {
+    type: 'athena';
+    region_name: string;
+    database: string;
+    schema: string;
+    s3_staging_dir: string;
+    s3_data_dir?: string;
+    aws_access_key_id?: string;
+    aws_secret_access_key?: string;
+    aws_assume_role_arn?: string;
+    aws_assume_role_external_id?: string;
+    work_group?: string;
+    threads?: number;
+    num_retries?: number;
+};
+export declare const athenaSchema: JSONSchemaType<AthenaTarget>;
+export declare const convertAthenaSchema: (target: Target) => CreateAthenaCredentials;
+//# sourceMappingURL=athena.d.ts.map

package/dist/dbt/targets/athena.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"athena.d.ts","sourceRoot":"","sources":["../../../src/dbt/targets/athena.ts"],"names":[],"mappings":"AAAA,OAAO,EAEH,uBAAuB,EAG1B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,cAAc,EAAE,MAAM,KAAK,CAAC;AAGrC,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAElC,MAAM,MAAM,YAAY,GAAG;IACvB,IAAI,EAAE,QAAQ,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,2BAA2B,CAAC,EAAE,MAAM,CAAC;IACrC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,eAAO,MAAM,YAAY,EAAE,cAAc,CAAC,YAAY,CAqDrD,CAAC;AAEF,eAAO,MAAM,mBAAmB,GAC5B,QAAQ,MAAM,KACf,uBAkCF,CAAC"}

package/dist/dbt/targets/athena.js

@@ -0,0 +1,91 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.convertAthenaSchema = exports.athenaSchema = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@lightdash/common");
+const better_ajv_errors_1 = tslib_1.__importDefault(require("better-ajv-errors"));
+const ajv_1 = require("../../ajv");
+exports.athenaSchema = {
+    type: 'object',
+    properties: {
+        type: {
+            type: 'string',
+            enum: ['athena'],
+        },
+        region_name: {
+            type: 'string',
+        },
+        database: {
+            type: 'string',
+        },
+        schema: {
+            type: 'string',
+        },
+        s3_staging_dir: {
+            type: 'string',
+        },
+        s3_data_dir: {
+            type: 'string',
+            nullable: true,
+        },
+        aws_access_key_id: {
+            type: 'string',
+            nullable: true,
+        },
+        aws_secret_access_key: {
+            type: 'string',
+            nullable: true,
+        },
+        aws_assume_role_arn: {
+            type: 'string',
+            nullable: true,
+        },
+        aws_assume_role_external_id: {
+            type: 'string',
+            nullable: true,
+        },
+        work_group: {
+            type: 'string',
+            nullable: true,
+        },
+        threads: {
+            type: 'number',
+            nullable: true,
+        },
+        num_retries: {
+            type: 'number',
+            nullable: true,
+        },
+    },
+    required: ['type', 'region_name', 'database', 'schema', 's3_staging_dir'],
+};
+const convertAthenaSchema = (target) => {
+    const validate = ajv_1.ajv.compile(exports.athenaSchema);
+    if (validate(target)) {
+        const hasAccessKeyCredentials = !!target.aws_access_key_id && !!target.aws_secret_access_key;
+        return {
+            type: common_1.WarehouseTypes.ATHENA,
+            region: target.region_name,
+            database: target.database,
+            schema: target.schema,
+            s3StagingDir: target.s3_staging_dir,
+            s3DataDir: target.s3_data_dir,
+            // CLI is intentionally permissive here: when keys are absent in a dbt
+            // profile, infer IAM role auth so local/CI runs can use AWS default
+            // credential resolution (for example OIDC/instance/task role).
+            authenticationType: hasAccessKeyCredentials
+                ? common_1.AthenaAuthenticationType.ACCESS_KEY
+                : common_1.AthenaAuthenticationType.IAM_ROLE,
+            accessKeyId: target.aws_access_key_id,
+            secretAccessKey: target.aws_secret_access_key,
+            assumeRoleArn: target.aws_assume_role_arn,
+            assumeRoleExternalId: target.aws_assume_role_external_id,
+            workGroup: target.work_group,
+            threads: target.threads,
+            numRetries: target.num_retries,
+        };
+    }
+    const errs = (0, better_ajv_errors_1.default)(exports.athenaSchema, target, validate.errors || []);
+    throw new common_1.ParseError(`Couldn't read profiles.yml file for ${target.type}:\n${errs}`);
+};
+exports.convertAthenaSchema = convertAthenaSchema;

package/dist/dbt/targets/athena.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=athena.test.d.ts.map

package/dist/dbt/targets/athena.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"athena.test.d.ts","sourceRoot":"","sources":["../../../src/dbt/targets/athena.test.ts"],"names":[],"mappings":""}

package/dist/dbt/targets/athena.test.js

@@ -0,0 +1,60 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const common_1 = require("@lightdash/common");
+const athena_1 = require("./athena");
+describe('convertAthenaSchema', () => {
+    test('should parse access key authentication when keys are present', () => {
+        const target = {
+            type: 'athena',
+            region_name: 'us-east-1',
+            database: 'AwsDataCatalog',
+            schema: 'default',
+            s3_staging_dir: 's3://test-results/',
+            aws_access_key_id: 'AKIATEST',
+            aws_secret_access_key: 'SECRETTEST',
+        };
+        expect((0, athena_1.convertAthenaSchema)(target)).toEqual({
+            type: common_1.WarehouseTypes.ATHENA,
+            region: 'us-east-1',
+            database: 'AwsDataCatalog',
+            schema: 'default',
+            s3StagingDir: 's3://test-results/',
+            s3DataDir: undefined,
+            authenticationType: common_1.AthenaAuthenticationType.ACCESS_KEY,
+            accessKeyId: 'AKIATEST',
+            secretAccessKey: 'SECRETTEST',
+            workGroup: undefined,
+            threads: undefined,
+            numRetries: undefined,
+        });
+    });
+    test('should parse iam role authentication when keys are missing', () => {
+        const target = {
+            type: 'athena',
+            region_name: 'us-east-1',
+            database: 'AwsDataCatalog',
+            schema: 'default',
+            s3_staging_dir: 's3://test-results/',
+        };
+        expect((0, athena_1.convertAthenaSchema)(target)).toEqual({
+            type: common_1.WarehouseTypes.ATHENA,
+            region: 'us-east-1',
+            database: 'AwsDataCatalog',
+            schema: 'default',
+            s3StagingDir: 's3://test-results/',
+            s3DataDir: undefined,
+            authenticationType: common_1.AthenaAuthenticationType.IAM_ROLE,
+            accessKeyId: undefined,
+            secretAccessKey: undefined,
+            workGroup: undefined,
+            threads: undefined,
+            numRetries: undefined,
+        });
+    });
+    test('should throw parse error for invalid Athena target', () => {
+        expect(() => (0, athena_1.convertAthenaSchema)({
+            type: 'athena',
+            region_name: 'us-east-1',
+        })).toThrow(common_1.ParseError);
+    });
+});

package/dist/dbt/targets/clickhouse.d.ts

@@ -0,0 +1,24 @@
+import { CreateClickhouseCredentials } from '@lightdash/common';
+import { JSONSchemaType } from 'ajv';
+import { Target } from '../types';
+export type ClickhouseTarget = {
+    type: 'clickhouse';
+    host: string;
+    user: string;
+    password: string;
+    port: number;
+    schema: string;
+    driver?: string;
+    cluster?: string;
+    verify?: boolean;
+    secure?: boolean;
+    retries?: number;
+    compression?: boolean;
+    connect_timeout?: number;
+    send_receive_timeout?: number;
+    cluster_mode?: boolean;
+    custom_settings?: Record<string, unknown>;
+};
+export declare const clickhouseSchema: JSONSchemaType<ClickhouseTarget>;
+export declare const convertClickhouseSchema: (target: Target) => CreateClickhouseCredentials;
+//# sourceMappingURL=clickhouse.d.ts.map

package/dist/dbt/targets/clickhouse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clickhouse.d.ts","sourceRoot":"","sources":["../../../src/dbt/targets/clickhouse.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,2BAA2B,EAG9B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,cAAc,EAAE,MAAM,KAAK,CAAC;AAGrC,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAElC,MAAM,MAAM,gBAAgB,GAAG;IAC3B,IAAI,EAAE,YAAY,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC7C,CAAC;AAEF,eAAO,MAAM,gBAAgB,EAAE,cAAc,CAAC,gBAAgB,CAgE7D,CAAC;AAEF,eAAO,MAAM,uBAAuB,GAChC,QAAQ,MAAM,KACf,2BAwBF,CAAC"}