@marimo-team/islands 0.23.16-dev2 → 0.23.16-dev21

package/dist/{tooltip-B-qh7UPB.js → tooltip-f-qR0iUx.js}

@@ -1,10 +1,10 @@
 import { s as __toESM } from "./chunk-BNovOVIE.js";
-import { d as createSlottable, h as cn, p as useComposedRefs } from "./button-BcSml68y.js";
+import { d as createSlottable, h as cn, p as useComposedRefs } from "./button-BSm8IXRU.js";
 import { t as require_react } from "./react-DA-nE2FX.js";
 import { t as require_compiler_runtime } from "./compiler-runtime-CEbnTgxf.js";
-import { a as createPopperScope, i as Root2, n as Arrow, r as Content, s as Root, t as Anchor } from "./dist-B96tMAst.js";
+import { a as createPopperScope, i as Root2, n as Arrow, r as Content, s as Root, t as Anchor } from "./dist-DIlxLFXG.js";
 import { t as require_jsx_runtime } from "./jsx-runtime-DebpN0FN.js";
-import { Q as withSmartCollisionBoundary, Z as withFullScreenAsRoot, _t as createContextScope, at as Portal, ct as DismissableLayer, dt as useId, et as StyleNamespace, ft as Presence, ht as composeEventHandlers, pt as useControllableState, vt as Primitive } from "./zod-D0yOqoGe.js";
+import { Q as withSmartCollisionBoundary, Z as withFullScreenAsRoot, _t as createContextScope, at as Portal, ct as DismissableLayer, dt as useId, et as StyleNamespace, ft as Presence, ht as composeEventHandlers, pt as useControllableState, vt as Primitive } from "./zod-BUcyXSdR.js";
 var import_react = /* @__PURE__ */ __toESM(require_react(), 1), import_jsx_runtime = /* @__PURE__ */ __toESM(require_jsx_runtime(), 1), [createTooltipContext, createTooltipScope] = createContextScope("Tooltip", [createPopperScope]), usePopperScope = createPopperScope(), PROVIDER_NAME = "TooltipProvider", DEFAULT_DELAY_DURATION = 700, TOOLTIP_OPEN = "tooltip.open", [TooltipProviderContextProvider, useTooltipProviderContext] = createTooltipContext(PROVIDER_NAME), TooltipProvider$1 = (n) => {
   let { __scopeTooltip: j, delayDuration: M = DEFAULT_DELAY_DURATION, skipDelayDuration: N = 300, disableHoverableContent: P = false, children: F } = n, I = import_react.useRef(true), L = import_react.useRef(false), R = import_react.useRef(0);
   return import_react.useEffect(() => {

package/dist/{types-DQl7jVYK.js → types-DicH9Oi0.js}

@@ -1,4 +1,4 @@
-import { u as createLucideIcon } from "./dist-B96tMAst.js";
+import { u as createLucideIcon } from "./dist-DIlxLFXG.js";
 var Pencil = createLucideIcon("pencil", [["path", {
   d: "M21.174 6.812a1 1 0 0 0-3.986-3.987L3.842 16.174a2 2 0 0 0-.5.83l-1.321 4.352a.5.5 0 0 0 .623.622l4.353-1.32a2 2 0 0 0 .83-.497z",
   key: "1a8usu"

package/dist/{useAsyncData-CvO8WUy3.js → useAsyncData-CYOQb1EW.js}

@@ -1,7 +1,7 @@
 import { s as __toESM } from "./chunk-BNovOVIE.js";
 import { t as require_react } from "./react-DA-nE2FX.js";
 import { t as require_compiler_runtime } from "./compiler-runtime-CEbnTgxf.js";
-import { A as useEvent_default } from "./useTheme-XMq9mNf_.js";
+import { A as useEvent_default } from "./useTheme-DYfby65G.js";
 import { t as invariant } from "./invariant-wRzNXIsJ.js";
 var import_compiler_runtime = require_compiler_runtime(), import_react = /* @__PURE__ */ __toESM(require_react(), 1), Result = {
   error(e, s) {

package/dist/{useDateFormatter-BSoGim-G.js → useDateFormatter-Bt2qr_XS.js}

@@ -1,7 +1,7 @@
 import { s as __toESM } from "./chunk-BNovOVIE.js";
 import { t as require_react } from "./react-DA-nE2FX.js";
-import { u as createLucideIcon } from "./dist-B96tMAst.js";
-import { E as $18f2051aff69b9bf$export$43bb16f9c6d9e3f7 } from "./strings-BYAhZnQi.js";
+import { u as createLucideIcon } from "./dist-DIlxLFXG.js";
+import { E as $18f2051aff69b9bf$export$43bb16f9c6d9e3f7 } from "./strings-DIy9NAmg.js";
 var ChartPie = createLucideIcon("chart-pie", [["path", {
   d: "M21 12c.552 0 1.005-.449.95-.998a10 10 0 0 0-8.953-8.951c-.55-.055-.998.398-.998.95v8a1 1 0 0 0 1 1z",
   key: "pzmjnu"

package/dist/{useDeepCompareMemoize-J3MKRdA4.js → useDeepCompareMemoize-CSHQeQEI.js}

@@ -1,6 +1,6 @@
 import { s as __toESM } from "./chunk-BNovOVIE.js";
 import { t as require_react } from "./react-DA-nE2FX.js";
-import { k as dequal } from "./useTheme-XMq9mNf_.js";
+import { k as dequal } from "./useTheme-DYfby65G.js";
 var import_react = /* @__PURE__ */ __toESM(require_react(), 1);
 function useDeepCompareMemoize(e) {
   let i = import_react.useRef(e);

package/dist/{useIframeCapabilities-POcFXHbw.js → useIframeCapabilities-kA09ykNq.js}

@@ -1,7 +1,7 @@
 import { s as __toESM } from "./chunk-BNovOVIE.js";
 import { t as require_react } from "./react-DA-nE2FX.js";
 import { t as require_compiler_runtime } from "./compiler-runtime-CEbnTgxf.js";
-import { t as getIframeCapabilities } from "./capabilities-BYLFYTYv.js";
+import { t as getIframeCapabilities } from "./capabilities-C6OQ5YBO.js";
 var import_compiler_runtime = require_compiler_runtime();
 require_react();
 function useIframeCapabilities() {

package/dist/{useLifecycle-DqPxHgAN.js → useLifecycle-CMJGqBaY.js}

@@ -1,10 +1,10 @@
 import { s as __toESM } from "./chunk-BNovOVIE.js";
-import { g as Logger, h as cn, r as cva } from "./button-BcSml68y.js";
+import { g as Logger, h as cn, r as cva } from "./button-BSm8IXRU.js";
 import { t as require_react } from "./react-DA-nE2FX.js";
 import { t as require_compiler_runtime } from "./compiler-runtime-CEbnTgxf.js";
-import { u as createLucideIcon } from "./dist-B96tMAst.js";
+import { u as createLucideIcon } from "./dist-DIlxLFXG.js";
 import { t as require_jsx_runtime } from "./jsx-runtime-DebpN0FN.js";
-import { C as useSetAtom, T as atom } from "./useTheme-XMq9mNf_.js";
+import { C as useSetAtom, T as atom } from "./useTheme-DYfby65G.js";
 var Calendar = createLucideIcon("calendar", [
   ["path", {
     d: "M8 2v4",

package/dist/{useTheme-XMq9mNf_.js → useTheme-DYfby65G.js}

@@ -1,8 +1,8 @@
 import { s as __toESM } from "./chunk-BNovOVIE.js";
-import { a as OverridingHotkeyProvider, g as Logger, s as resolvePlatform } from "./button-BcSml68y.js";
+import { a as OverridingHotkeyProvider, g as Logger, s as resolvePlatform } from "./button-BSm8IXRU.js";
 import { t as require_react } from "./react-DA-nE2FX.js";
 import { t as require_compiler_runtime } from "./compiler-runtime-CEbnTgxf.js";
-import { A as looseObject, B as union, I as record, N as number, P as object, R as string, T as boolean, b as _enum, w as array } from "./zod-D0yOqoGe.js";
+import { A as looseObject, B as union, I as record, N as number, P as object, R as string, T as boolean, b as _enum, w as array } from "./zod-BUcyXSdR.js";
 import { t as merge_default } from "./merge-Be1CqGnU.js";
 var import_react = /* @__PURE__ */ __toESM(require_react()), useInsertionEffect = typeof window < "u" ? import_react.useInsertionEffect || import_react.useLayoutEffect : () => {
 };

package/dist/{vega-component-CrFoZT1S.js → vega-component-C7nO5zcf.js}

@@ -1,25 +1,25 @@
 import { s as __toESM } from "./chunk-BNovOVIE.js";
-import { g as Logger, h as cn, m as Events } from "./button-BcSml68y.js";
+import { g as Logger, h as cn, m as Events } from "./button-BSm8IXRU.js";
 import { t as require_react } from "./react-DA-nE2FX.js";
 import { t as require_compiler_runtime } from "./compiler-runtime-CEbnTgxf.js";
-import { c as asRemoteURL, v as CircleQuestionMark } from "./toDate-B3IRfHhw.js";
+import { c as asRemoteURL, w as CircleQuestionMark } from "./toDate-CqhBWjvO.js";
 import "./react-dom-BTJzcVJ9.js";
 import { t as require_jsx_runtime } from "./jsx-runtime-DebpN0FN.js";
-import "./zod-D0yOqoGe.js";
-import { n as ErrorBanner } from "./error-banner-DR7o3CbX.js";
-import { t as Tooltip } from "./tooltip-B-qh7UPB.js";
+import "./zod-BUcyXSdR.js";
+import { n as ErrorBanner } from "./error-banner-B_GQfxxD.js";
+import { t as Tooltip } from "./tooltip-f-qR0iUx.js";
 import { t as debounce_default } from "./debounce-BOD3DbfP.js";
-import { A as useEvent_default, n as useTheme } from "./useTheme-XMq9mNf_.js";
+import { A as useEvent_default, n as useTheme } from "./useTheme-DYfby65G.js";
 import { s as uniq } from "./arrays-sEtDRoG4.js";
 import { t as Objects } from "./objects-De59twF-.js";
-import { a as isValid, i as AlertTitle, n as Alert, t as arrow } from "./formats-BFhkZJwd.js";
+import { a as isValid, i as AlertTitle, n as Alert, t as arrow } from "./formats-Dwq1THhr.js";
 import { V as getContainerWidth, n as formats } from "./vega-loader.browser-DmpxCJqx.js";
-import { a as tooltipHandler, n as vegaLoadData } from "./loader-CTHCI-qe.js";
+import { a as tooltipHandler, n as vegaLoadData } from "./loader-DX-IDS7n.js";
 import { t as j } from "./react-vega-BazDALhI.js";
 import "./defaultLocale-BpsHxBd7.js";
 import "./defaultLocale-DoeErsX2.js";
-import { t as useAsyncData } from "./useAsyncData-CvO8WUy3.js";
-import { t as useDeepCompareMemoize } from "./useDeepCompareMemoize-J3MKRdA4.js";
+import { t as useAsyncData } from "./useAsyncData-CYOQb1EW.js";
+import { t as useDeepCompareMemoize } from "./useDeepCompareMemoize-CSHQeQEI.js";
 import { t as Semaphore } from "./semaphore-C8rmHdhj.js";
 import { t as useVegaContainerRemeasure } from "./use-vega-container-remeasure-DGNrIQSk.js";
 var import_compiler_runtime = require_compiler_runtime(), import_react = /* @__PURE__ */ __toESM(require_react(), 1);

package/dist/{zod-D0yOqoGe.js → zod-BUcyXSdR.js}

@@ -1,5 +1,5 @@
 import { r as __export, s as __toESM } from "./chunk-BNovOVIE.js";
-import { c as useEventListener, p as useComposedRefs, u as createSlot } from "./button-BcSml68y.js";
+import { c as useEventListener, p as useComposedRefs, u as createSlot } from "./button-BSm8IXRU.js";
 import { t as require_react } from "./react-DA-nE2FX.js";
 import { t as require_compiler_runtime } from "./compiler-runtime-CEbnTgxf.js";
 import { t as require_react_dom } from "./react-dom-BTJzcVJ9.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@marimo-team/islands",
-  "version": "0.23.16-dev2",
+  "version": "0.23.16-dev21",
   "main": "dist/main.js",
   "types": "dist/index.d.ts",
   "type": "module",
@@ -57,7 +57,7 @@
     "@marimo-team/codemirror-ai": "^0.3.7",
     "@marimo-team/codemirror-languageserver": "^1.16.12",
     "@marimo-team/codemirror-mcp": "^0.1.7",
-    "@marimo-team/codemirror-sql": "^0.2.8",
+    "@marimo-team/codemirror-sql": "^0.3.0",
     "@marimo-team/llm-info": "workspace:*",
     "@marimo-team/marimo-api": "workspace:*",
     "@marimo-team/react-slotz": "^0.2.0",

package/src/components/data-table/column-formatting/feature.ts

@@ -9,6 +9,7 @@ import {
   type TableFeature,
   type Updater,
 } from "@tanstack/react-table";
+import { browserLocale } from "@/core/i18n/locale";
 import type { DataType } from "@/core/kernel/messages";
 import { logNever } from "@/utils/assertNever";
 import {
@@ -40,7 +41,7 @@ export const ColumnFormattingFeature: TableFeature = {
     return {
       enableColumnFormatting: true,
       onColumnFormattingChange: makeStateUpdater("columnFormatting", table),
-      locale: navigator.language,
+      locale: browserLocale(),
     } as ColumnFormattingOptions;
   },
 

package/src/components/editor/connections/storage/__tests__/__snapshots__/as-code.test.ts.snap

@@ -51,6 +51,21 @@ store = S3Store("operator-bucket",
 )"
 `;
 
+exports[`generateStorageCode > CoreWeave > with container credentials 1`] = `
+"from obstore.store import S3Store
+import os
+
+_container_credentials_full_uri = os.environ.get("AWS_CONTAINER_CREDENTIALS_FULL_URI")
+_container_authorization_token_file = os.environ.get("AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE")
+store = S3Store("operator-bucket",
+    region="US-EAST-04A",
+    container_credentials_full_uri=_container_credentials_full_uri,
+    container_authorization_token_file=_container_authorization_token_file,
+    endpoint="https://operator-bucket.cwobject.com",
+    virtual_hosted_style_request=True,
+)"
+`;
+
 exports[`generateStorageCode > CoreWeave > with secrets 1`] = `
 "from obstore.store import S3Store
 import os
@@ -119,6 +134,29 @@ exports[`generateStorageCode > S3 > minimal connection (bucket only) 1`] = `
 store = S3Store("my-bucket",)"
 `;
 
+exports[`generateStorageCode > S3 > with container credentials 1`] = `
+"from obstore.store import S3Store
+
+store = S3Store("my-bucket",
+    region="us-east-1",
+    container_credentials_full_uri="http://169.254.170.23/v1/credentials",
+    container_authorization_token_file="/var/run/secrets/token",
+)"
+`;
+
+exports[`generateStorageCode > S3 > with container credentials from secrets 1`] = `
+"from obstore.store import S3Store
+import os
+
+_container_credentials_full_uri = os.environ.get("AWS_CONTAINER_CREDENTIALS_FULL_URI")
+_container_authorization_token_file = os.environ.get("AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE")
+store = S3Store("my-bucket",
+    region="us-east-1",
+    container_credentials_full_uri=_container_credentials_full_uri,
+    container_authorization_token_file=_container_authorization_token_file,
+)"
+`;
+
 exports[`generateStorageCode > S3 > with custom endpoint 1`] = `
 "from obstore.store import S3Store
 
@@ -130,6 +168,18 @@ store = S3Store("my-bucket",
 )"
 `;
 
+exports[`generateStorageCode > S3 > with plain-http endpoint 1`] = `
+"from obstore.store import S3Store
+
+store = S3Store("my-bucket",
+    region="us-east-1",
+    access_key_id="AKIAIOSFODNN7EXAMPLE",
+    secret_access_key="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
+    endpoint_url="http://cwlota.com",
+    allow_http=True,
+)"
+`;
+
 exports[`generateStorageCode > S3 > with secrets 1`] = `
 "from obstore.store import S3Store
 import os

package/src/components/editor/connections/storage/__tests__/as-code.test.ts

@@ -9,9 +9,13 @@ describe("generateStorageCode", () => {
     type: "s3",
     bucket: "my-bucket",
     region: "us-east-1",
-    access_key_id: "AKIAIOSFODNN7EXAMPLE",
-    secret_access_key: "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
     endpoint_url: undefined,
+    allow_http: false,
+    auth: {
+      type: "Access keys",
+      access_key_id: "AKIAIOSFODNN7EXAMPLE",
+      secret_access_key: "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
+    },
   };
 
   const baseGCS: StorageConnection = {
@@ -31,8 +35,11 @@ describe("generateStorageCode", () => {
     type: "coreweave",
     bucket: "operator-bucket",
     region: "US-EAST-04A",
-    access_key_id: "AKIAIOSFODNN7EXAMPLE",
-    secret_access_key: "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
+    auth: {
+      type: "Access keys",
+      access_key_id: "AKIAIOSFODNN7EXAMPLE",
+      secret_access_key: "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
+    },
   };
 
   const baseGDrive: StorageConnection = {
@@ -52,6 +59,8 @@ describe("generateStorageCode", () => {
       const conn: StorageConnection = {
         type: "s3",
         bucket: "my-bucket",
+        allow_http: false,
+        auth: { type: "Access keys" },
       };
       expect(
         generateStorageCode(conn, { library: "obstore" }),
@@ -68,13 +77,61 @@ describe("generateStorageCode", () => {
       ).toMatchSnapshot();
     });
 
+    it("with plain-http endpoint", () => {
+      const conn: StorageConnection = {
+        ...baseS3,
+        endpoint_url: "http://cwlota.com",
+        allow_http: true,
+      };
+      expect(
+        generateStorageCode(conn, { library: "obstore" }),
+      ).toMatchSnapshot();
+    });
+
+    it("with container credentials", () => {
+      const conn: StorageConnection = {
+        ...baseS3,
+        auth: {
+          type: "Container credentials",
+          container_credentials_full_uri:
+            "http://169.254.170.23/v1/credentials",
+          container_authorization_token_file: "/var/run/secrets/token",
+        },
+      };
+      expect(
+        generateStorageCode(conn, { library: "obstore" }),
+      ).toMatchSnapshot();
+    });
+
+    it("with container credentials from secrets", () => {
+      const conn: StorageConnection = {
+        ...baseS3,
+        auth: {
+          type: "Container credentials",
+          container_credentials_full_uri: prefixSecret(
+            "AWS_CONTAINER_CREDENTIALS_FULL_URI",
+          ),
+          container_authorization_token_file: prefixSecret(
+            "AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE",
+          ),
+        },
+      };
+      expect(
+        generateStorageCode(conn, { library: "obstore" }),
+      ).toMatchSnapshot();
+    });
+
     it("with secrets", () => {
       const conn: StorageConnection = {
         type: "s3",
         bucket: "my-bucket",
         region: "us-east-1",
-        access_key_id: prefixSecret("AWS_ACCESS_KEY_ID"),
-        secret_access_key: prefixSecret("AWS_SECRET_ACCESS_KEY"),
+        allow_http: false,
+        auth: {
+          type: "Access keys",
+          access_key_id: prefixSecret("AWS_ACCESS_KEY_ID"),
+          secret_access_key: prefixSecret("AWS_SECRET_ACCESS_KEY"),
+        },
       };
       expect(
         generateStorageCode(conn, { library: "obstore" }),
@@ -143,6 +200,25 @@ describe("generateStorageCode", () => {
         type: "coreweave",
         bucket: "operator-bucket",
         region: "US-EAST-04A",
+        auth: { type: "Access keys" },
+      };
+      expect(
+        generateStorageCode(conn, { library: "obstore" }),
+      ).toMatchSnapshot();
+    });
+
+    it("with container credentials", () => {
+      const conn: StorageConnection = {
+        ...baseCoreWeave,
+        auth: {
+          type: "Container credentials",
+          container_credentials_full_uri: prefixSecret(
+            "AWS_CONTAINER_CREDENTIALS_FULL_URI",
+          ),
+          container_authorization_token_file: prefixSecret(
+            "AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE",
+          ),
+        },
       };
       expect(
         generateStorageCode(conn, { library: "obstore" }),
@@ -154,8 +230,11 @@ describe("generateStorageCode", () => {
         type: "coreweave",
         bucket: "operator-bucket",
         region: "US-EAST-04A",
-        access_key_id: prefixSecret("COREWEAVE_OBJECT_STORAGE_KEY"),
-        secret_access_key: prefixSecret("COREWEAVE_OBJECT_STORAGE_SECRET"),
+        auth: {
+          type: "Access keys",
+          access_key_id: prefixSecret("COREWEAVE_OBJECT_STORAGE_KEY"),
+          secret_access_key: prefixSecret("COREWEAVE_OBJECT_STORAGE_SECRET"),
+        },
       };
       expect(
         generateStorageCode(conn, { library: "obstore" }),

package/src/components/editor/connections/storage/as-code.ts

@@ -3,7 +3,11 @@
 import dedent from "string-dedent";
 import { assertNever } from "@/utils/assertNever";
 import { isSecret, unprefixSecret } from "../secrets";
-import { type StorageConnection, StorageConnectionSchema } from "./schemas";
+import {
+  type S3Auth,
+  type StorageConnection,
+  StorageConnectionSchema,
+} from "./schemas";
 
 export type StorageLibrary = "obstore" | "fsspec";
 
@@ -50,6 +54,36 @@ class SecretContainer {
   }
 }
 
+/**
+ * Credential kwargs shared by every S3-compatible store.
+ */
+function s3AuthParams(
+  auth: S3Auth | undefined,
+  secrets: SecretContainer,
+): string[] {
+  // obstore polls the credential endpoint with the token read from the file,
+  // refreshing credentials for the lifetime of the store.
+  if (auth?.type === "Container credentials") {
+    return [
+      `    container_credentials_full_uri=${secrets.print("container_credentials_full_uri", auth.container_credentials_full_uri)},`,
+      `    container_authorization_token_file=${secrets.print("container_authorization_token_file", auth.container_authorization_token_file)},`,
+    ];
+  }
+
+  const params: string[] = [];
+  if (auth?.access_key_id) {
+    params.push(
+      `    access_key_id=${secrets.print("access_key_id", auth.access_key_id)},`,
+    );
+  }
+  if (auth?.secret_access_key) {
+    params.push(
+      `    secret_access_key=${secrets.print("secret_access_key", auth.secret_access_key)},`,
+    );
+  }
+  return params;
+}
+
 function generateS3Code(
   connection: Extract<StorageConnection, { type: "s3" }>,
   secrets: SecretContainer,
@@ -61,21 +95,15 @@ function generateS3Code(
   if (connection.region) {
     params.push(`    region=${secrets.print("region", connection.region)},`);
   }
-  if (connection.access_key_id) {
-    params.push(
-      `    access_key_id=${secrets.print("access_key_id", connection.access_key_id)},`,
-    );
-  }
-  if (connection.secret_access_key) {
-    params.push(
-      `    secret_access_key=${secrets.print("secret_access_key", connection.secret_access_key)},`,
-    );
-  }
+  params.push(...s3AuthParams(connection.auth, secrets));
   if (connection.endpoint_url) {
     params.push(
       `    endpoint_url=${secrets.print("endpoint_url", connection.endpoint_url)},`,
     );
   }
+  if (connection.allow_http) {
+    params.push("    allow_http=True,");
+  }
 
   const paramsStr = params.length > 0 ? `\n${params.join("\n")}\n` : "";
 
@@ -140,16 +168,7 @@ function generateCoreWeaveCode(
     `    region=${secrets.print("region", connection.region)},`,
   ];
 
-  if (connection.access_key_id) {
-    params.push(
-      `    access_key_id=${secrets.print("access_key_id", connection.access_key_id)},`,
-    );
-  }
-  if (connection.secret_access_key) {
-    params.push(
-      `    secret_access_key=${secrets.print("secret_access_key", connection.secret_access_key)},`,
-    );
-  }
+  params.push(...s3AuthParams(connection.auth, secrets));
 
   params.push(
     `    endpoint="https://${connection.bucket}.cwobject.com",`,

package/src/components/editor/connections/storage/schemas.ts

@@ -2,6 +2,83 @@
 import { z } from "zod";
 import { FieldOptions } from "@/components/forms/options";
 
+/**
+ * Credentials shared by every S3-compatible store (Amazon S3, CoreWeave, ...).
+ *
+ * Rendered as tabs: either long-lived access keys, or a credential-vending
+ * endpoint (ECS/EKS task roles, CoreWeave sandboxes, ...) that obstore polls
+ * with a bearer token read from disk.
+ */
+const s3AuthField = () =>
+  z
+    .discriminatedUnion("type", [
+      z.object({
+        type: z.literal("Access keys"),
+        access_key_id: z
+          .string()
+          .optional()
+          .describe(
+            FieldOptions.of({
+              label: "Access Key ID",
+              description: "Leave empty to use the default credential chain",
+              inputType: "password",
+              optionRegex:
+                "(access.?key.?id|object.?storage.?key|aws.?access.?key)",
+            }),
+          ),
+        secret_access_key: z
+          .string()
+          .optional()
+          .describe(
+            FieldOptions.of({
+              label: "Secret Access Key",
+              inputType: "password",
+              optionRegex:
+                "(secret.?access.?key|object.?storage.?secret|aws.?secret)",
+            }),
+          ),
+      }),
+      z.object({
+        type: z.literal("Container credentials"),
+        container_credentials_full_uri: z
+          .string()
+          .nonempty()
+          .describe(
+            FieldOptions.of({
+              label: "Credentials URI",
+              description: "Endpoint that vends credentials to the container",
+              placeholder: "http://169.254.170.23/v1/credentials",
+              optionRegex: "container.?credentials",
+            }),
+          ),
+        container_authorization_token_file: z
+          .string()
+          .nonempty()
+          .describe(
+            FieldOptions.of({
+              label: "Authorization Token File",
+              description: "File holding the token sent to the credentials URI",
+              placeholder: "/var/run/secrets/token",
+              optionRegex:
+                "(container.?authorization.?token.?file|container.?auth.?token)",
+            }),
+          ),
+      }),
+    ])
+    .default({ type: "Access keys" })
+    .describe(FieldOptions.of({ label: "Credentials", special: "tabs" }));
+
+const allowHttpField = () =>
+  z
+    .boolean()
+    .default(false)
+    .describe(
+      FieldOptions.of({
+        label: "Allow HTTP",
+        description: "Required for plain-http (non-TLS) endpoints",
+      }),
+    );
+
 export const S3StorageSchema = z
   .object({
     type: z.literal("s3"),
@@ -25,36 +102,20 @@ export const S3StorageSchema = z
           optionRegex: "(region|aws.?region)",
         }),
       ),
-    access_key_id: z
-      .string()
-      .optional()
-      .describe(
-        FieldOptions.of({
-          label: "Access Key ID",
-          inputType: "password",
-          optionRegex: "(access.?key.?id|aws.?access.?key)",
-        }),
-      ),
-    secret_access_key: z
-      .string()
-      .optional()
-      .describe(
-        FieldOptions.of({
-          label: "Secret Access Key",
-          inputType: "password",
-          optionRegex: "(secret.?access.?key|aws.?secret)",
-        }),
-      ),
     endpoint_url: z
       .string()
       .optional()
       .describe(
         FieldOptions.of({
           label: "Endpoint URL",
+          description:
+            "Ignored if the AWS_ENDPOINT_URL_S3 environment variable is set",
           placeholder: "https://s3.amazonaws.com",
           optionRegex: "(endpoint|s3.?url|s3.?endpoint)",
         }),
       ),
+    allow_http: allowHttpField(),
+    auth: s3AuthField(),
   })
   .describe(FieldOptions.of({ direction: "two-columns" }));
 
@@ -139,28 +200,7 @@ export const CoreWeaveStorageSchema = z
           placeholder: "US-EAST-04A",
         }),
       ),
-    access_key_id: z
-      .string()
-      .optional()
-      .describe(
-        FieldOptions.of({
-          label: "Access Key ID",
-          inputType: "password",
-          optionRegex:
-            "(access.?key.?id|object.?storage.?key|aws.?access.?key)",
-        }),
-      ),
-    secret_access_key: z
-      .string()
-      .optional()
-      .describe(
-        FieldOptions.of({
-          label: "Secret Access Key",
-          inputType: "password",
-          optionRegex:
-            "(secret.?access.?key|object.?storage.?secret|aws.?secret)",
-        }),
-      ),
+    auth: s3AuthField(),
   })
   .describe(FieldOptions.of({ direction: "two-columns" }));
 
@@ -189,3 +229,4 @@ export const StorageConnectionSchema = z.discriminatedUnion("type", [
 ]);
 
 export type StorageConnection = z.infer<typeof StorageConnectionSchema>;
+export type S3Auth = Extract<StorageConnection, { type: "s3" }>["auth"];

package/src/components/editor/file-tree/__tests__/file-render-mode.test.ts

@@ -0,0 +1,27 @@
+/* Copyright 2026 Marimo. All rights reserved. */
+
+import { describe, expect, it } from "vitest";
+import { getFileRenderMode } from "../file-render-mode";
+
+describe("getFileRenderMode", () => {
+  it.each([
+    ["text/plain", false, "text"],
+    ["text/x-rust", false, "text"],
+    ["application/json", false, "text"],
+    ["application/xml", false, "text"],
+    ["text/csv", false, "csv"],
+    ["image/png", true, "media"],
+    ["video/mp4", true, "media"],
+    ["application/pdf", true, "media"],
+    ["application/x-apple-diskimage", true, "unsupported"],
+    ["application/zip", true, "unsupported"],
+    ["application/octet-stream", false, "unsupported"],
+    [null, false, "text"],
+    [null, true, "unsupported"],
+  ] as const)(
+    "maps %s with isBase64=%s to %s",
+    (mimeType, isBase64, expected) => {
+      expect(getFileRenderMode(mimeType, isBase64)).toBe(expected);
+    },
+  );
+});