dbctl 0.7.0__tar.gz → 0.7.2__tar.gz

{dbctl-0.7.0 → dbctl-0.7.2}/CHANGELOG.md

@@ -5,6 +5,44 @@ All notable changes to this project will be documented here.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/)
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.7.2] — 2026-08-04
+
+### Added
+
+- **`{{ssm:...}}` connection references** — any string field on a
+  connection (`password`, `username`, `database`, `driver`, `url`, or a
+  nested tunnel field like `ssm.remote_host` / `direct.host`) can now be
+  a placeholder — `{{ssm:<parameter-name>[;property:<json-key>][;profile:<aws-profile>]}}`
+  — resolved against AWS SSM Parameter Store instead of a literal value.
+  `SecureString` parameters are fetched with decryption; `property`
+  extracts one key from a JSON-object parameter value (so several
+  credentials can share one parameter). Resolution is lazy — it runs via
+  `dbctl.refs.resolve_connection` right before a connection is actually
+  used to open a tunnel or build an engine, never at `connections.yaml`
+  load time and never from `dbctl connections list` / `show` — so
+  browsing the registry never makes an AWS call or risks echoing a
+  decrypted secret, and one unreachable profile can't break unrelated
+  connections. See `docs/connections.md` for the full reference.
+
+## [0.7.1] — 2026-08-03
+
+### Fixed
+
+- **SSM tunnel SSO token check always reported "missing/expired" for
+  `sso_session`-based profiles** — `_sso_cache_path` hashed the *profile
+  name* with SHA-256, but the AWS CLI actually names SSO token-cache
+  files `sha1(<key>).json`, where `<key>` is the `sso_session` name (for
+  profiles using the now-recommended `sso_session = <name>` config
+  style — what `aws configure sso` generates by default) or the
+  profile's own `sso_start_url` (legacy inline-SSO profiles). Since
+  neither the hash algorithm nor the hashed value matched what the AWS
+  CLI actually wrote, `dbctl` reported every such profile as logged out
+  immediately after a successful `aws sso login`, and the automatic
+  re-login path (`disable_automatic_sso_login: false`, the default) hit
+  the same broken check right after re-authenticating. Fixed by
+  resolving the real cache key from `~/.aws/config` (or
+  `$AWS_CONFIG_FILE`) and hashing it with SHA-1.
+
 ## [0.7.0] — 2026-08-03
 
 ### Added

{dbctl-0.7.0 → dbctl-0.7.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dbctl
-Version: 0.7.0
+Version: 0.7.2
 Summary: Generic CLI to monitor, control, and administer multiple databases via SSM, SSH, or direct connection.
 Author: dbctl contributors
 License: MIT
@@ -339,6 +339,12 @@ DB password sources are mutually exclusive — pick **one** per connection:
 | `windows_sso: true` | mssql+pyodbc only: Windows Integrated Security (`Trusted_Connection=yes`). No username/password needed. |
 | `url: "…"`          | full SQLAlchemy URL (overrides all the above). Use for Azure AD, ODBC-specific kwargs, or any non-standard connection string. |
 
+Any of these — plus `username`, `database`, `driver`, or a tunnel field like
+`direct.host` — can instead be a `{{ssm:/param/path;property:key;profile:name}}`
+placeholder resolved against AWS SSM Parameter Store at connection time. See
+[`docs/connections.md`](docs/connections.md#ssm-references) for the full
+reference.
+
 Secret-typed **operation** parameters (`type: secret`) are redacted in the
 audit log regardless of which DB password source the connection uses.
 

{dbctl-0.7.0 → dbctl-0.7.2}/README.md

@@ -305,6 +305,12 @@ DB password sources are mutually exclusive — pick **one** per connection:
 | `windows_sso: true` | mssql+pyodbc only: Windows Integrated Security (`Trusted_Connection=yes`). No username/password needed. |
 | `url: "…"`          | full SQLAlchemy URL (overrides all the above). Use for Azure AD, ODBC-specific kwargs, or any non-standard connection string. |
 
+Any of these — plus `username`, `database`, `driver`, or a tunnel field like
+`direct.host` — can instead be a `{{ssm:/param/path;property:key;profile:name}}`
+placeholder resolved against AWS SSM Parameter Store at connection time. See
+[`docs/connections.md`](docs/connections.md#ssm-references) for the full
+reference.
+
 Secret-typed **operation** parameters (`type: secret`) are redacted in the
 audit log regardless of which DB password source the connection uses.
 

{dbctl-0.7.0 → dbctl-0.7.2}/dbctl/db.py

@@ -102,7 +102,15 @@ def build_engine(conn: Connection, tunnel: Tunnel, *, echo: bool = False) -> Eng
     password injected — the URL is just ``driver:///path/to/file``. The
     tunnel's local bind is irrelevant for file-based DBs (the file is
     local), and injecting `host:port` makes SQLAlchemy reject the URL.
+
+    Resolves any ``{{ssm:...}}`` placeholders on ``conn`` first (see
+    ``dbctl.refs``) — this is the point a connection is actually used, so
+    it's the right place for that lazy resolution to happen.
     """
+    from dbctl.refs import resolve_connection
+
+    conn = resolve_connection(conn)
+
     driver = _driver_name(conn)
     _check_driver_available(driver)
 

dbctl-0.7.2/dbctl/refs.py

@@ -0,0 +1,173 @@
+"""Resolve ``{{ssm:...}}`` placeholders in connection values against AWS SSM
+Parameter Store, so secrets never need to live in plaintext in
+``connections.yaml``.
+
+Reference format::
+
+    {{ssm:<parameter-name>[;property:<json-key>][;profile:<aws-profile>]}}
+
+Resolution shells out to the ``aws`` CLI — the same convention already used
+by :mod:`dbctl.tunnels.ssm` for bastion/session lookups — so no extra AWS SDK
+dependency is required.
+
+Resolution is deliberately **lazy**: nothing in this module runs at
+``connections.yaml`` load time. It only runs when :func:`resolve_connection`
+is called, which happens right before a connection is actually used (see
+``build_tunnel`` / ``build_engine``). A connection nobody is using — or one
+just being displayed via ``dbctl connections show`` — never triggers an AWS
+call, so one unreachable profile can't break unrelated connections.
+"""
+
+from __future__ import annotations
+
+import json
+import re
+import subprocess
+from typing import TYPE_CHECKING, Any
+
+if TYPE_CHECKING:
+    from dbctl.config import Connection
+
+_REF_RE = re.compile(r"\{\{ssm:([^}]+)\}\}")
+
+
+class RefResolutionError(RuntimeError):
+    """Raised when a ``{{ssm:...}}`` reference cannot be resolved.
+
+    Messages here must only ever name the *reference* (parameter name,
+    property, profile) — never the resolved value — so this exception is
+    always safe to print to logs/stderr/console.
+    """
+
+
+def _parse_ref(spec: str) -> tuple[str, str | None, str | None]:
+    """Split ``<name>[;property:<key>][;profile:<profile>]`` into its parts."""
+    parts = spec.split(";")
+    name = parts[0].strip()
+    if not name:
+        raise RefResolutionError(f"ssm reference {{{{ssm:{spec}}}}} is missing a parameter name")
+
+    property_: str | None = None
+    profile: str | None = None
+    for raw_part in parts[1:]:
+        part = raw_part.strip()
+        if not part:
+            continue
+        key, sep, value = part.partition(":")
+        if not sep:
+            raise RefResolutionError(
+                f"ssm reference {{{{ssm:{spec}}}}}: malformed option {part!r} (expected key:value)"
+            )
+        key = key.strip()
+        value = value.strip()
+        if key == "property":
+            property_ = value
+        elif key == "profile":
+            profile = value
+        else:
+            raise RefResolutionError(f"ssm reference {{{{ssm:{spec}}}}}: unknown option {key!r}")
+    return name, property_, profile
+
+
+def _fetch_parameter(name: str, profile: str | None) -> str:
+    """Fetch a parameter's raw value via ``aws ssm get-parameter``.
+
+    Always passes ``--with-decryption`` — a no-op for plain ``String``
+    parameters, required for ``SecureString`` ones.
+    """
+    cmd = ["aws", "ssm", "get-parameter", "--name", name, "--with-decryption", "--output", "json"]
+    if profile:
+        cmd[1:1] = ["--profile", profile]
+
+    try:
+        result = subprocess.run(cmd, check=True, capture_output=True, text=True, timeout=15)
+    except FileNotFoundError as e:
+        raise RefResolutionError(
+            "the `aws` CLI was not found on PATH — install it before resolving ssm: references"
+        ) from e
+    except subprocess.CalledProcessError as e:
+        stderr = (e.stderr or "").strip()
+        raise RefResolutionError(
+            f"failed to resolve ssm parameter {name!r}: {stderr[:300] or 'unknown error'}"
+        ) from e
+    except subprocess.TimeoutExpired as e:
+        raise RefResolutionError(f"aws ssm get-parameter timed out resolving {name!r}") from e
+
+    try:
+        payload: Any = json.loads(result.stdout)
+        value = payload["Parameter"]["Value"]
+    except (json.JSONDecodeError, KeyError, TypeError) as e:
+        raise RefResolutionError(f"unexpected response resolving ssm parameter {name!r}") from e
+    if not isinstance(value, str):
+        raise RefResolutionError(f"unexpected response resolving ssm parameter {name!r}")
+    return value
+
+
+def _extract_property(raw_value: str, property_name: str, param_name: str) -> str:
+    try:
+        parsed = json.loads(raw_value)
+    except json.JSONDecodeError as e:
+        raise RefResolutionError(
+            f"ssm parameter {param_name!r} is not valid JSON; cannot extract property {property_name!r}"
+        ) from e
+    if not isinstance(parsed, dict) or property_name not in parsed:
+        raise RefResolutionError(f"ssm parameter {param_name!r} has no property {property_name!r}")
+    return str(parsed[property_name])
+
+
+def resolve_ssm_ref(spec: str, *, cache: dict[str, str]) -> str:
+    """Resolve one ``<name>[;property:...][;profile:...]`` reference body
+    (the part inside ``{{ssm: }}``), consulting/populating ``cache`` so the
+    same reference is never fetched twice within one resolution pass."""
+    if spec in cache:
+        return cache[spec]
+    name, property_, profile = _parse_ref(spec)
+    raw = _fetch_parameter(name, profile)
+    value = _extract_property(raw, property_, name) if property_ else raw
+    cache[spec] = value
+    return value
+
+
+def resolve_string(value: str, *, cache: dict[str, str]) -> str:
+    """Replace every ``{{ssm:...}}`` occurrence in ``value`` with its
+    resolved value. Strings with no reference are returned unchanged
+    (and never trigger an AWS call)."""
+    if "{{ssm:" not in value:
+        return value
+    return _REF_RE.sub(lambda m: resolve_ssm_ref(m.group(1), cache=cache), value)
+
+
+def resolve_value(value: Any, *, cache: dict[str, str]) -> Any:
+    """Recursively resolve ``{{ssm:...}}`` references nested in dicts/lists."""
+    if isinstance(value, str):
+        return resolve_string(value, cache=cache)
+    if isinstance(value, dict):
+        return {k: resolve_value(v, cache=cache) for k, v in value.items()}
+    if isinstance(value, list):
+        return [resolve_value(v, cache=cache) for v in value]
+    return value
+
+
+def resolve_connection(conn: Connection) -> Connection:
+    """Return a copy of ``conn`` with every ``{{ssm:...}}`` placeholder in
+    its string fields (including nested tunnel blocks) resolved.
+
+    Call this right before a connection is actually used (opening a tunnel,
+    building an engine) — never at ``connections.yaml`` load time or from a
+    listing/display command, so browsing the registry never makes an AWS
+    call or risks echoing a decrypted secret to the screen.
+    """
+    from dbctl.config import Connection
+
+    raw = conn.model_dump()
+    resolved = resolve_value(raw, cache={})
+    return Connection.model_validate(resolved)
+
+
+__all__ = [
+    "RefResolutionError",
+    "resolve_connection",
+    "resolve_ssm_ref",
+    "resolve_string",
+    "resolve_value",
+]

{dbctl-0.7.0 → dbctl-0.7.2}/dbctl/tunnels/base.py

@@ -56,12 +56,19 @@ def build_tunnel(conn: Connection, *, override_port: int | None = None) -> Tunne
     the local bind port even when the config says ``local_port: 0`` (auto).
     For ``direct`` tunnels the override replaces the upstream port (useful
     for pointing at a different port than the config declares).
+
+    Resolves any ``{{ssm:...}}`` placeholders on ``conn`` first (see
+    ``dbctl.refs``) — this is the point a connection is actually used, so
+    it's the right place for that lazy resolution to happen.
     """
+    from dbctl.refs import resolve_connection
     from dbctl.tunnels.direct import DirectTunnel as _Direct
     from dbctl.tunnels.k8s import K8sTunnel as _K8k
     from dbctl.tunnels.ssh import SshTunnel as _Ssh
     from dbctl.tunnels.ssm import SsmTunnel as _Ssm
 
+    conn = resolve_connection(conn)
+
     match conn.type.value:
         case "ssm":
             assert conn.ssm

{dbctl-0.7.0 → dbctl-0.7.2}/dbctl/tunnels/ssm.py

@@ -3,8 +3,10 @@
 from __future__ import annotations
 
 import atexit
+import configparser
 import hashlib
 import json
+import os
 import subprocess
 from datetime import UTC, datetime
 from pathlib import Path
@@ -17,28 +19,77 @@ from dbctl.tunnels.base import _terminate, find_free_port, wait_local_open
 _console = Console(stderr=True)
 
 
-def _sso_cache_path(profile: str) -> Path:
-    """Return the AWS SSO token cache file for the given profile.
+def _aws_config_path() -> Path:
+    """Return the AWS CLI config file path, honoring ``AWS_CONFIG_FILE``
+    exactly like the ``aws`` CLI itself does."""
+    override = os.environ.get("AWS_CONFIG_FILE")
+    return Path(override) if override else Path.home() / ".aws" / "config"
 
-    AWS caches SSO tokens at ``~/.aws/sso/cache/<sha256(profile)>.json``
-    (the hash is SHA-256 of the profile name, hex-encoded). Each file
-    contains ``accessToken`` + ``expiresAt`` (ISO 8601 UTC).
+
+def _sso_cache_key(profile: str) -> str | None:
+    """Resolve the AWS CLI SSO token-cache *key* for ``profile`` by reading
+    ``~/.aws/config`` (or ``$AWS_CONFIG_FILE``).
+
+    The AWS CLI caches SSO tokens under a filename derived from a specific
+    string, which depends on the profile's config style:
+
+    * **`sso_session`-based** (the config ``aws configure sso`` now
+      generates, and what a separate ``[sso-session <name>]`` block
+      implies) — the cache key is the **session name** itself, e.g.
+      ``sso_session = my-session`` → key is ``"my-session"``. Note this is
+      *not* the session's ``sso_start_url``.
+    * **legacy inline SSO** (no ``sso_session``, `sso_start_url` set
+      directly on the profile) — the cache key is that ``sso_start_url``.
+
+    Returns ``None`` if the profile (or `default`) isn't found in the
+    config file, or has neither ``sso_session`` nor ``sso_start_url`` (e.g.
+    a plain access-key profile — not an SSO profile at all).
+    """
+    config_path = _aws_config_path()
+    if not config_path.exists():
+        return None
+    parser = configparser.ConfigParser()
+    try:
+        parser.read(config_path)
+    except configparser.Error:
+        return None
+    section_name = "default" if profile == "default" else f"profile {profile}"
+    if section_name not in parser:
+        return None
+    section = parser[section_name]
+    session_name = section.get("sso_session")
+    if session_name:
+        return session_name
+    return section.get("sso_start_url")
+
+
+def _sso_cache_path(profile: str) -> Path | None:
+    """Return the AWS SSO token cache file for the given profile, or
+    ``None`` when the profile isn't an SSO profile (or isn't found) — see
+    ``_sso_cache_key``.
+
+    AWS caches SSO tokens at ``~/.aws/sso/cache/<sha1(key)>.json`` (SHA-1,
+    hex-encoded, of the cache key resolved by ``_sso_cache_key`` — *not* a
+    hash of the profile name). Each file contains ``accessToken`` +
+    ``expiresAt`` (ISO 8601 UTC).
     """
-    key = hashlib.sha256(profile.encode()).hexdigest()
-    return Path.home() / ".aws" / "sso" / "cache" / f"{key}.json"
+    key = _sso_cache_key(profile)
+    if key is None:
+        return None
+    hashed = hashlib.sha1(key.encode()).hexdigest()  # AWS CLI's own cache-key scheme
+    return Path.home() / ".aws" / "sso" / "cache" / f"{hashed}.json"
 
 
 def _sso_token_is_valid(profile: str) -> bool:
     """Check whether the SSO token for ``profile`` exists and hasn't expired.
 
-    Returns ``True`` when the token is valid (or when the profile has no
-    SSO token cached but we determine it's not an SSO profile — e.g. a
-    plain access-key profile). Returns ``False`` only when a token file
-    exists but is past its ``expiresAt`` timestamp, or when no token file
-    exists at all (which means the user needs to log in).
+    Returns ``True`` when the token is valid. Returns ``False`` when the
+    profile can't be resolved to an SSO cache key, when a token file exists
+    but is past its ``expiresAt`` timestamp, or when no token file exists at
+    all (which means the user needs to log in).
     """
     cache_file = _sso_cache_path(profile)
-    if not cache_file.exists():
+    if cache_file is None or not cache_file.exists():
         return False
     try:
         data = json.loads(cache_file.read_text())

{dbctl-0.7.0 → dbctl-0.7.2}/docs/connections.md

@@ -97,6 +97,61 @@ connections.yaml: 1 invalid connection skipped:
 The offending connection is simply absent from `dbctl connections list` until
 you fix it — the CLI never refuses to start because of one bad entry.
 
+## `{{ssm:...}}` references
+
+Any string field on a connection — `password`, `username`, `database`,
+`driver`, `url`, or a nested tunnel field like `ssm.remote_host` or
+`direct.host` — can be a placeholder that resolves against AWS SSM
+Parameter Store instead of a literal value:
+
+```
+{{ssm:<parameter-name>[;property:<json-key>][;profile:<aws-profile>]}}
+```
+
+| part | required | meaning |
+|------|----------|---------|
+| `<parameter-name>` | yes | full SSM parameter name/path, e.g. `/prod/db/password`. |
+| `property` | no | if the parameter value is a JSON object, extract only this key. Omit to use the whole raw value. |
+| `profile` | no | AWS CLI profile for the lookup. Omit to use the default credential chain (env vars, default profile, instance role). |
+
+```yaml
+connections:
+  prod-pg:
+    type: direct
+    driver: postgresql+psycopg
+    database: app
+    username: app_admin
+    password: "{{ssm:/prod/db/credentials;property:password;profile:prod-admin}}"
+    direct:
+      host: "{{ssm:/prod/db/credentials;property:host;profile:prod-admin}}"
+```
+
+Given an SSM parameter `/prod/db/credentials` holding
+`{"username": "app_admin", "password": "s3cret", "host": "prod.rds.internal"}`,
+`{{ssm:/prod/db/credentials;property:password}}` resolves to `s3cret`.
+
+**When resolution happens.** References are resolved lazily, right before a
+connection is actually used to open a tunnel or build an engine (`dbctl
+<conn> health`, `dbctl tunnel open`, an operation, …) — never at load time.
+`dbctl connections list` / `dbctl connections show` never touch AWS and
+never print a resolved secret; they show the raw `{{ssm:...}}` placeholder
+as written in the YAML. Because resolution is per-connection and on-demand,
+an unreachable profile on one connection never breaks loading or using any
+other connection.
+
+**Resolution details:**
+- Parameters are always fetched `--with-decryption`, so `SecureString`
+  parameters work transparently; plain `String` parameters are unaffected.
+- If `property` is set but the parameter's value isn't valid JSON, or the
+  key is missing, resolution fails with an error naming the parameter and
+  property — never the (partial) value.
+- If the parameter doesn't exist or access is denied, the error names the
+  parameter but never attempts to print a value.
+- Resolution shells out to the `aws` CLI (same mechanism `ssm` tunnels
+  already use for bastion lookups), so no extra AWS SDK dependency is
+  required — just a working `aws` CLI on `PATH` and credentials for the
+  chosen profile.
+
 ## `ssm` block
 
 AWS SSM port-forwarding to a remote host (typically RDS) through an EC2

{dbctl-0.7.0 → dbctl-0.7.2}/docs/operations.md

@@ -282,7 +282,7 @@ cross-engine migration needs, without writing a custom script:
 
   `rstrip` exists specifically for the SQL Server → PostgreSQL case: SQL
   Server's default collation treats `'abc'` and `'abc '` as equal, so a
-  column like `model_clean` can accumulate trailing padding that never
+  column like `notes` can accumulate trailing padding that never
   breaks a lookup on the source — until it's copied byte-exact into a
   target whose collation *is* whitespace-sensitive, at which point every
   padded row silently stops matching.
@@ -290,17 +290,17 @@ cross-engine migration needs, without writing a custom script:
 ```yaml
 operations:
   copy-lookup-tables:
-    description: "Migrate DE-test lookup tables (SQL Server) → India Postgres"
+    description: "Migrate legacy lookup tables (SQL Server) -> Postgres"
     scope: multi
     mode: copy
     roles: [src, trg]
     copy_spec:
       batch_size: 10000
-      tables: [ce_repair_cost_lookup_data, replacement_lookup_data]
+      tables: [orders, order_items]
       exclude_columns: [Id]              # source IDENTITY column; trg generates its own
       transforms:
-        model_clean: rstrip              # trailing-space padding from src collation
-        Manufacturer: rstrip
+        notes: rstrip              # trailing-space padding from src collation
+        category: rstrip
 ```
 
 ```bash
@@ -329,12 +329,12 @@ dbctl copy-lookup-tables mssql pg --validate-data
 
 ```text
 pre-flight: scanning src rows against trg's column constraints; nothing will be written yet
-┏━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━┳━━━━━━━━━━┳━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓
-┃ table                          ┃ column      ┃ kind     ┃ row ┃ detail                      ┃
-┡━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━╇━━━━━━━━━━╇━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┩
-│ replacement_lookup_data        │ Search_Manu │ not_null │ 482 │ NULL value for a NOT NULL   │
-│                                │             │          │     │ column                      │
-└────────────────────────────────┴─────────────┴──────────┴─────┴─────────────────────────────┘
+┏━━━━━━━━━━━━━┳━━━━━━━━┳━━━━━━━━━━┳━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓
+┃ table       ┃ column ┃ kind     ┃ row ┃ detail                      ┃
+┡━━━━━━━━━━━━━╇━━━━━━━━╇━━━━━━━━━━╇━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┩
+│ order_items │ region │ not_null │ 482 │ NULL value for a NOT NULL   │
+│             │        │          │     │ column                      │
+└─────────────┴────────┴──────────┴─────┴─────────────────────────────┘
 1 violation(s) found — copy aborted, nothing was written
 ```
 
@@ -354,8 +354,8 @@ row range that reproduces the failure, and reports the driver's
 root-cause error instead of the full wrapped SQLAlchemy exception:
 
 ```text
-Error: table 'ce_repair_cost_lookup_data': insert failed at row 2847 of this batch:
-duplicate key value violates unique constraint "ce_repair_cost_lookup_data_pkey"
+Error: table 'orders': insert failed at row 2847 of this batch:
+duplicate key value violates unique constraint "orders_pkey"
 ```
 
 Disable it with `--no-diagnose-failures` (or `diagnose_failures: false` in

{dbctl-0.7.0 → dbctl-0.7.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "dbctl"
-version = "0.7.0"
+version = "0.7.2"
 description = "Generic CLI to monitor, control, and administer multiple databases via SSM, SSH, or direct connection."
 readme = "README.md"
 requires-python = ">=3.12"

{dbctl-0.7.0 → dbctl-0.7.2}/tests/test_copy_features.py

@@ -237,12 +237,12 @@ def test_copy_spec_accepts_exclude_columns_and_transforms():
             "copy_spec": {
                 "tables": ["t"],
                 "exclude_columns": ["Id"],
-                "transforms": {"model_clean": "rstrip"},
+                "transforms": {"notes": "rstrip"},
             },
         }
     )
     assert op.copy_spec.exclude_columns == ["Id"]
-    assert op.copy_spec.transforms == {"model_clean": ColumnTransform.rstrip_}
+    assert op.copy_spec.transforms == {"notes": ColumnTransform.rstrip_}
     assert op.copy_spec.diagnose_failures is True  # default on