detectkit 0.64.0__tar.gz → 0.66.0__tar.gz

{detectkit-0.64.0/detectkit.egg-info → detectkit-0.66.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: detectkit
-Version: 0.64.0
+Version: 0.66.0
 Summary: Metric monitoring with automatic anomaly detection
 Author: detectkit team
 License: MIT
@@ -42,12 +42,15 @@ Provides-Extra: duckdb
 Requires-Dist: duckdb>=1.1; extra == "duckdb"
 Provides-Extra: snowflake
 Requires-Dist: snowflake-connector-python>=3.12; extra == "snowflake"
+Provides-Extra: bigquery
+Requires-Dist: google-cloud-bigquery>=3.15; extra == "bigquery"
 Provides-Extra: all-db
 Requires-Dist: clickhouse-driver>=0.2.0; extra == "all-db"
 Requires-Dist: psycopg2-binary>=2.9.0; extra == "all-db"
 Requires-Dist: pymysql>=1.0.0; extra == "all-db"
 Requires-Dist: duckdb>=1.1; extra == "all-db"
 Requires-Dist: snowflake-connector-python>=3.12; extra == "all-db"
+Requires-Dist: google-cloud-bigquery>=3.15; extra == "all-db"
 Provides-Extra: prophet
 Requires-Dist: prophet>=1.1.0; extra == "prophet"
 Provides-Extra: timesfm
@@ -65,6 +68,7 @@ Requires-Dist: psycopg2-binary>=2.9.0; extra == "all"
 Requires-Dist: pymysql>=1.0.0; extra == "all"
 Requires-Dist: duckdb>=1.1; extra == "all"
 Requires-Dist: snowflake-connector-python>=3.12; extra == "all"
+Requires-Dist: google-cloud-bigquery>=3.15; extra == "all"
 Requires-Dist: prophet>=1.1.0; extra == "all"
 Requires-Dist: timesfm>=0.1.0; extra == "all"
 Requires-Dist: sqlglot>=20.0; extra == "all"
@@ -110,7 +114,7 @@ Dynamic: license-file
 - **@mentions** — tag users/groups in alerts, each channel formats natively
 - **Alert lifecycle** — consecutive anomalies, fraction-of-window rule (`anomaly_window` + `min_anomaly_share`), cooldown, recovery notifications, no-data alerts
 - **Project-level error alerts** — catch DB outages and pipeline crashes once per run
-- **Database agnostic** — ClickHouse, PostgreSQL, MySQL/MariaDB, DuckDB (no server needed); Snowflake as a hybrid-mode source
+- **Database agnostic** — ClickHouse, PostgreSQL, MySQL/MariaDB, DuckDB (no server needed, incl. MotherDuck cloud paths); Snowflake and BigQuery as hybrid-mode sources
 - **Hybrid mode** — read metric SQL from a billed-per-query warehouse while all pipeline state lives in a cheap local database
 - **Idempotent** — resume from interruptions, no duplicate processing
 - **CLI** — `dtk init`, `dtk run --select`, `dtk unlock`, `dtk clean`, tag-based selectors
@@ -126,8 +130,9 @@ With database drivers:
 
 ```bash
 pip install detectkit[clickhouse]   # ClickHouse
-pip install detectkit[duckdb]       # DuckDB - single file, no server
+pip install detectkit[duckdb]       # DuckDB - single file, no server (also MotherDuck md: paths)
 pip install detectkit[snowflake]    # Snowflake - source-only (hybrid mode)
+pip install detectkit[bigquery]     # BigQuery - source-only (hybrid mode)
 pip install detectkit[all-db]       # All databases
 ```
 

{detectkit-0.64.0 → detectkit-0.66.0}/README.md

@@ -24,7 +24,7 @@
 - **@mentions** — tag users/groups in alerts, each channel formats natively
 - **Alert lifecycle** — consecutive anomalies, fraction-of-window rule (`anomaly_window` + `min_anomaly_share`), cooldown, recovery notifications, no-data alerts
 - **Project-level error alerts** — catch DB outages and pipeline crashes once per run
-- **Database agnostic** — ClickHouse, PostgreSQL, MySQL/MariaDB, DuckDB (no server needed); Snowflake as a hybrid-mode source
+- **Database agnostic** — ClickHouse, PostgreSQL, MySQL/MariaDB, DuckDB (no server needed, incl. MotherDuck cloud paths); Snowflake and BigQuery as hybrid-mode sources
 - **Hybrid mode** — read metric SQL from a billed-per-query warehouse while all pipeline state lives in a cheap local database
 - **Idempotent** — resume from interruptions, no duplicate processing
 - **CLI** — `dtk init`, `dtk run --select`, `dtk unlock`, `dtk clean`, tag-based selectors
@@ -40,8 +40,9 @@ With database drivers:
 
 ```bash
 pip install detectkit[clickhouse]   # ClickHouse
-pip install detectkit[duckdb]       # DuckDB - single file, no server
+pip install detectkit[duckdb]       # DuckDB - single file, no server (also MotherDuck md: paths)
 pip install detectkit[snowflake]    # Snowflake - source-only (hybrid mode)
+pip install detectkit[bigquery]     # BigQuery - source-only (hybrid mode)
 pip install detectkit[all-db]       # All databases
 ```
 

{detectkit-0.64.0 → detectkit-0.66.0}/detectkit/__init__.py

@@ -4,7 +4,7 @@ detectk - Anomaly Detection for Time-Series Metrics
 A Python library for data analysts and engineers to monitor metrics with automatic anomaly detection.
 """
 
-__version__ = "0.64.0"
+__version__ = "0.66.0"
 
 from detectkit.core.interval import Interval
 from detectkit.core.models import ColumnDefinition, TableModel

{detectkit-0.64.0 → detectkit-0.66.0}/detectkit/cli/assets/claude/CLAUDE.section.md

@@ -14,7 +14,7 @@ conventions.
 **Database access for _you_ (recommended, not required).** detectkit itself
 connects to the database directly via its drivers — it **never** needs an MCP to
 run. But you assist far better with **read access to the same database** (e.g. a
-database MCP for the project's ClickHouse / PostgreSQL / MySQL / MariaDB / DuckDB / Snowflake (source-only, hybrid mode)): you can inspect
+database MCP for the project's ClickHouse / PostgreSQL / MySQL / MariaDB / DuckDB (incl. MotherDuck `md:` paths) / Snowflake / BigQuery (the last two source-only, hybrid mode)): you can inspect
 a metric's series, find real incidents to label for `dtk autotune`, sanity-check
 a metric query before running it, and confirm detections — instead of asking the
 user to run every query by hand. Without it, fall back to marking incidents

{detectkit-0.64.0 → detectkit-0.66.0}/detectkit/cli/assets/claude/rules/metrics.md

@@ -80,8 +80,8 @@ metric's **load** step ever connects to it — detect/alert and every other
 command don't — though every `dtk run` fail-fast validates the resolved name
 up front regardless of `--steps` (a typo exits 1 before any pipeline work).
 The `source_profile` may point at a **source-only** warehouse profile such as
-`snowflake` (usable *only* as a source, never for `_dtk_*` state — see
-`project.md`), which is exactly the case hybrid mode is built for.
+`snowflake` or `bigquery` (usable *only* as a source, never for `_dtk_*` state
+— see `project.md`), which is exactly the case hybrid mode is built for.
 See the [Hybrid Mode guide](https://dtk.pipelab.dev/guides/hybrid-mode/).
 
 `ai_context` is **OSI-compatible grounding** you can add to any metric with **no

{detectkit-0.64.0 → detectkit-0.66.0}/detectkit/cli/assets/claude/rules/overview.md

@@ -6,9 +6,11 @@ metrics with automatic anomaly detection and multi-channel alerting. It is
 them with one command. Core logic is pure numpy (no pandas). **ClickHouse,
 PostgreSQL, MySQL/MariaDB and DuckDB are all fully supported** — only the
 connection and the SQL dialect of your metric queries differ between them
-(DuckDB additionally needs no server at all — just a local file); **Snowflake**
-is supported as a **source-only** backend (hybrid mode — it runs a metric's
-load SQL, but `_dtk_*` state must live in one of the full backends).
+(DuckDB additionally needs no server at all — just a local file, or a
+`md:<database>` path to run fully on **MotherDuck**, DuckDB's cloud);
+**Snowflake** and **BigQuery** are supported as **source-only** backends
+(hybrid mode — they run a metric's load SQL, but `_dtk_*` state must live in one
+of the full backends).
 
 ## The pipeline: load → detect → alert
 

{detectkit-0.64.0 → detectkit-0.66.0}/detectkit/cli/assets/claude/rules/project.md

@@ -58,8 +58,8 @@ profile whose database runs metric SQL, while *every* `_dtk_*` table
 else. A per-metric `source_profile` overrides it (`metrics.md`); resolves
 **metric → project → unset**, same precedence as `loading_delay`. Unset on
 both = today's behavior (one profile does everything). The source profile can
-be a full backend **or** a **source-only** type like `snowflake` (valid only
-here, never as the state profile). Only the LOAD step's
+be a full backend **or** a **source-only** type (`snowflake`, `bigquery`) —
+valid only here, never as the state profile. Only the LOAD step's
 metric-SQL query is affected — detect/alert and every other command
 (`dtk autotune`/`tune`/`ui`/`clean`/`unlock`) only ever touch the state
 profile. A source-side failure raises `SourceDatabaseError` (message leads
@@ -140,14 +140,14 @@ alert_channels:
 ### Database profiles
 
 > ClickHouse, PostgreSQL, MySQL, MariaDB and DuckDB are all supported as
-> **state** backends (they hold the `_dtk_*` tables); **Snowflake** is
-> **source-only** — see its block below.
+> **state** backends (they hold the `_dtk_*` tables); **Snowflake** and
+> **BigQuery** are **source-only** — see their blocks below.
 > ClickHouse/MySQL/MariaDB use two *databases*; PostgreSQL connects to one
 > `database` and uses two *schemas*; DuckDB is a single *file* (or `:memory:`
 > for tests) holding two *schemas*.
 > `dtk init --db-type {clickhouse,postgres,mysql,mariadb}` scaffolds the right
-> shape — DuckDB and Snowflake profiles are written by hand (not yet a
-> `--db-type` choice).
+> shape — DuckDB, Snowflake and BigQuery profiles are written by hand (not yet
+> a `--db-type` choice).
 
 **ClickHouse**:
 ```yaml
@@ -201,23 +201,32 @@ auto-detected at connect (`SELECT VERSION()`), so MariaDB gets its own
 `VALUES()`-form upsert instead of MySQL 8.0.19's row-alias form.
 `pip install 'detectkit[mariadb]'`.
 
-**DuckDB** (embedded, single file; two schemas like PostgreSQL):
+**DuckDB** (embedded, single file; two schemas like PostgreSQL — or
+**MotherDuck**, DuckDB's cloud, via a `md:` path):
 ```yaml
 profiles:
   prod:
     type: duckdb
-    path: /var/lib/detectkit/warehouse.duckdb   # required — file path, or ":memory:"
+    path: /var/lib/detectkit/warehouse.duckdb   # required — file path, ":memory:",
+    #                                             # or "md:<database>" for MotherDuck
     internal_schema: detectkit     # optional — _dtk_* tables (default: "detectkit")
     data_schema: main              # optional — data queries (default: "main")
-    read_only: false               # optional (default: false)
+    read_only: false               # optional (default: false; local files only)
+    motherduck_token: "{{ env_var('MOTHERDUCK_TOKEN') }}"  # optional — only for "md:" paths
     settings: {}                   # optional — extra duckdb.connect() config options
 ```
-> Single-writer: DuckDB allows only **one** read-write connection to the file
-> at a time — a `dtk ui`/`dtk tune` session left open will clash with a
-> separately spawned `dtk run` against the same file. Point a read-only
-> consumer at it with `read_only: true`.
+> Single-writer (**local files only**): a local DuckDB file allows only **one**
+> read-write connection at a time — a `dtk ui`/`dtk tune` session left open will
+> clash with a separately spawned `dtk run` against the same file. Point a
+> read-only consumer at it with `read_only: true`. A `md:<database>` MotherDuck
+> path is a **served** database with no single-writer rule — `dtk ui` and a
+> spawned `dtk run` coexist, and `read_only` doesn't apply.
 > `path: ":memory:"` has no on-disk state, so resume/idempotency breaks across
 > process restarts — use it for tests/scratch only, never a real project.
+> `motherduck_token` (env-interpolated) authenticates `md:` paths; unset, the
+> `motherduck` extension falls back to a `motherduck_token` environment
+> variable (lowercase — the extension's own lookup name). MotherDuck is a full
+> state backend — `_dtk_*` tables can live there — and needs no extra beyond
 > `pip install 'detectkit[duckdb]'`.
 
 **Snowflake** (**source-only** — hybrid mode; runs a metric's load SQL, never
@@ -250,6 +259,38 @@ profiles:
 > hybrid mode (load from Snowflake, keep cheap local state) is the point.
 > `pip install 'detectkit[snowflake]'`.
 
+**BigQuery** (**source-only** — hybrid mode; runs a metric's load SQL, never
+holds `_dtk_*` state):
+```yaml
+profiles:
+  warehouse:
+    type: bigquery
+    project: my-analytics-project    # required — GCP project id billed for the queries
+    credentials_json_path: /etc/detectkit/bq-sa.json   # optional — service-account JSON key file
+    #                                # (unset -> Application Default Credentials)
+    location: EU                     # optional — job location (e.g. EU / US)
+    dataset: analytics               # optional — default dataset so unqualified table names resolve
+    api_endpoint: null               # optional — endpoint override; plain-http (the emulator) -> anonymous
+    #                                # auth when no key file; https endpoints authenticate normally
+    settings:                        # optional — extra QueryJobConfig attributes applied to every query
+      maximum_bytes_billed: 1000000000
+```
+> **Source-only**: a `bigquery` profile is valid **only** as a metric's or the
+> project's `source_profile` (hybrid mode) — `dtk run` refuses it as a state
+> profile (`--profile`/`default_profile`), so pair it with a full backend
+> (DuckDB/Postgres/ClickHouse) that holds the `_dtk_*` tables. See `metrics.md`
+> and the [Hybrid Mode guide](https://dtk.pipelab.dev/guides/hybrid-mode/).
+> Auth: `credentials_json_path` (a service-account key file) when set, else
+> **Application Default Credentials** (gcloud ADC / an attached service account
+> / Workload Identity); host/port/user/password are unused. Timestamps: a
+> BigQuery `TIMESTAMP` column comes back tz-aware UTC (handled by the loader),
+> `DATETIME` comes back naive — prefer `TIMESTAMP` (or a cast) for the metric's
+> timestamp column. Billing note: on-demand queries bill a **10 MiB minimum**
+> of bytes processed per query per referenced table, so frequent small
+> monitoring queries are disproportionately expensive — load from BigQuery,
+> keep cheap local state; `settings: {maximum_bytes_billed: ...}` caps what a
+> single query may scan. `pip install 'detectkit[bigquery]'`.
+
 ### Alert channels
 
 Defined once in `profiles.yml`, referenced by name in each metric's

{detectkit-0.64.0 → detectkit-0.66.0}/detectkit/cli/commands/init.py

@@ -127,11 +127,14 @@ _COMMENTED_EXAMPLES = {
     "duckdb": """  # Example DuckDB profile (in-process, single-file; no host/port/user/password)
   # duckdb_dev:
   #   type: duckdb
-  #   path: ./detectkit.duckdb   # or ':memory:' for a transient, tests-only DB
+  #   path: ./detectkit.duckdb   # or ':memory:' (transient, tests-only), or
+  #   #                          # 'md:<database>' for MotherDuck (cloud; add
+  #   #                          # motherduck_token: "{{ env_var('MOTHERDUCK_TOKEN') }}")
   #   internal_schema: detectkit
   #   data_schema: main
-  #   # Only ONE read-write connection at a time — don't point a scheduled
-  #   # `dtk run` and a long-lived `dtk ui` at the same file simultaneously.
+  #   # Only ONE read-write connection at a time (local files; md: paths are
+  #   # served and don't have this limit) — don't point a scheduled `dtk run`
+  #   # and a long-lived `dtk ui` at the same local file simultaneously.
 """,
 }
 

{detectkit-0.64.0 → detectkit-0.66.0}/detectkit/config/profile.py

@@ -29,27 +29,31 @@ class ProfileConfig(BaseModel):
       duckdb) can hold detectkit state (the ``_dtk_*`` tables) — and, since
       state managers also expose ``execute_query``, double as hybrid-mode
       sources.
-    - **Source-only backends** (``SOURCE_ONLY_TYPES``: snowflake) implement
-      only connect + read query. They are valid **only** as a metric/project
-      ``source_profile``; :meth:`create_manager` refuses them as a state
-      profile with a clear error.
+    - **Source-only backends** (``SOURCE_ONLY_TYPES``: snowflake, bigquery)
+      implement only connect + read query. They are valid **only** as a
+      metric/project ``source_profile``; :meth:`create_manager` refuses them
+      as a state profile with a clear error.
 
     Attributes:
         type: Database type ("clickhouse", "postgres", "mysql", "mariadb",
-            "duckdb"; source-only: "snowflake")
+            "duckdb"; source-only: "snowflake", "bigquery")
         host: Database host (unused for DuckDB — it is an in-process, file-backed
-            database with no network endpoint — and for Snowflake, which
-            connects by `account`)
-        port: Database port (unused for DuckDB/Snowflake; required for every
-            other backend)
-        user: Database user (unused for DuckDB; required explicitly for Snowflake)
-        password: Database password (unused for DuckDB; for Snowflake either
-            `password` or `private_key_path` must be set)
+            database with no network endpoint — and for Snowflake/BigQuery,
+            which connect by `account` / `project`)
+        port: Database port (unused for DuckDB/Snowflake/BigQuery; required
+            for every other backend)
+        user: Database user (unused for DuckDB/BigQuery; required explicitly
+            for Snowflake)
+        password: Database password (unused for DuckDB/BigQuery; for Snowflake
+            either `password` or `private_key_path` must be set)
         database: Connection-target database (PostgreSQL/MySQL/MariaDB; the
             session default database for Snowflake; unused for DuckDB — use
             `path` instead)
-        path: Path to the DuckDB database file, or ":memory:" for a transient
-            in-process database (DuckDB only)
+        path: Path to the DuckDB database file, ":memory:" for a transient
+            in-process database, or "md:<database>" for a MotherDuck cloud
+            database (DuckDB only)
+        motherduck_token: MotherDuck service token for "md:" paths (DuckDB
+            only; unset -> the extension reads the motherduck_token env var)
         account: Snowflake account identifier (e.g. "myorg-myaccount")
         warehouse: Snowflake virtual warehouse to run load queries on
         role: Snowflake role for the session
@@ -57,6 +61,15 @@ class ProfileConfig(BaseModel):
         private_key_path: Path to a PEM private key for Snowflake key-pair
             auth (recommended for service accounts)
         private_key_passphrase: Passphrase of the private key, if encrypted
+        project: GCP project id billed for the queries (BigQuery only)
+        credentials_json_path: Path to a service-account JSON key file
+            (BigQuery only; unset -> Application Default Credentials)
+        location: Job location, e.g. "EU" (BigQuery only; unset -> inferred
+            from the referenced datasets)
+        dataset: Default dataset for unqualified table names in load queries
+            (BigQuery only)
+        api_endpoint: API endpoint override — the BigQuery emulator or a
+            private endpoint (BigQuery only)
         internal_database: Database/schema for internal tables
         internal_schema: Schema for internal tables (PostgreSQL/DuckDB only)
         data_database: Database for user data tables
@@ -76,10 +89,10 @@ class ProfileConfig(BaseModel):
     )
     # Source-only backends: connect + execute_query only (no DDL/upserts/
     # locks); valid ONLY as a metric/project `source_profile` (hybrid mode).
-    SOURCE_ONLY_TYPES: ClassVar[frozenset[str]] = frozenset({"snowflake"})
-    # Backends with no network port to validate (in-process file DB; an
-    # account-resolved cloud driver).
-    _PORTLESS_TYPES: ClassVar[frozenset[str]] = frozenset({"duckdb", "snowflake"})
+    SOURCE_ONLY_TYPES: ClassVar[frozenset[str]] = frozenset({"snowflake", "bigquery"})
+    # Backends with no network port to validate (in-process file DB;
+    # account/project-resolved cloud drivers).
+    _PORTLESS_TYPES: ClassVar[frozenset[str]] = frozenset({"duckdb", "snowflake", "bigquery"})
 
     type: str = Field(..., description="Database type")
     host: str = Field(default="localhost", description="Database host (unused for DuckDB)")
@@ -96,20 +109,29 @@ class ProfileConfig(BaseModel):
         default=None, description="Database to connect to (PostgreSQL/MySQL/MariaDB)"
     )
 
-    # DuckDB-only: the database file path (or ":memory:"). host/port/user/
-    # password/database above are simply ignored for this backend rather than
-    # rejected, since e.g. `host` always carries its "localhost" default.
+    # DuckDB-only: the database file path (or ":memory:", or "md:<database>"
+    # for MotherDuck). host/port/user/password/database above are simply
+    # ignored for this backend rather than rejected, since e.g. `host` always
+    # carries its "localhost" default.
     path: str | None = Field(
         default=None,
-        description="Database file path, or ':memory:' for a transient in-process database (DuckDB only)",
+        description="Database file path, ':memory:' for a transient in-process "
+        "database, or 'md:<database>' for a MotherDuck cloud database (DuckDB only)",
     )
     read_only: bool = Field(
         default=False,
         description=(
-            "Open the database read-only (DuckDB only) — lets a reader profile "
-            "coexist with the one process holding the file read-write"
+            "Open the database read-only (DuckDB local files only — MotherDuck "
+            "has no read-only attach) — lets a reader profile coexist with the "
+            "one process holding the file read-write"
         ),
     )
+    motherduck_token: str | None = Field(
+        default=None,
+        description="MotherDuck service token for 'md:' paths (DuckDB only; "
+        "env-interpolated — unset falls back to the motherduck_token "
+        "environment variable read by the extension itself)",
+    )
 
     # Snowflake-only (source-only backend). host/port are meaningless for it:
     # the driver resolves the endpoint from `account`.
@@ -141,6 +163,34 @@ class ProfileConfig(BaseModel):
         description="Passphrase of the private key, when it is encrypted (Snowflake only)",
     )
 
+    # BigQuery-only (source-only backend). host/port/user/password are
+    # meaningless for it: the client resolves the endpoint from `project` and
+    # authenticates via a service-account key file or ADC.
+    project: str | None = Field(
+        default=None,
+        description="GCP project id billed for the queries, e.g. 'my-project' (BigQuery only)",
+    )
+    credentials_json_path: str | None = Field(
+        default=None,
+        description="Path to a service-account JSON key file (BigQuery only; "
+        "unset -> Application Default Credentials)",
+    )
+    location: str | None = Field(
+        default=None,
+        description="Job location, e.g. 'EU' (BigQuery only; unset -> inferred "
+        "from the referenced datasets)",
+    )
+    dataset: str | None = Field(
+        default=None,
+        description="Default dataset for unqualified table names in load queries (BigQuery only)",
+    )
+    api_endpoint: str | None = Field(
+        default=None,
+        description="API endpoint override (BigQuery only) — a plain-http endpoint "
+        "(the BigQuery emulator) uses anonymous credentials when no key file is "
+        "set; https endpoints (regional/private) authenticate normally",
+    )
+
     # Internal location for _dtk_* tables
     internal_database: str | None = Field(
         default=None, description="Database for internal tables (ClickHouse/MySQL/MariaDB)"
@@ -215,6 +265,23 @@ class ProfileConfig(BaseModel):
             )
         return self
 
+    @model_validator(mode="after")
+    def _validate_bigquery_fields(self) -> "ProfileConfig":
+        """BigQuery profiles need an explicit GCP project id.
+
+        Auth needs nothing further: `credentials_json_path` when set, else
+        Application Default Credentials (gcloud ADC / attached service
+        account / Workload Identity).
+        """
+        if self.type != "bigquery":
+            return self
+        if not self.project:
+            raise ValueError(
+                "bigquery profiles must set 'project' (the GCP project id billed "
+                "for the queries, e.g. 'my-project')"
+            )
+        return self
+
     def get_internal_location(self) -> str:
         """
         Get internal location (database or schema).
@@ -364,14 +431,15 @@ class ProfileConfig(BaseModel):
             if not self.path:
                 raise ValueError(
                     "DuckDB profiles must set 'path' (the database file path, "
-                    "or ':memory:' for a transient, tests/preview-only "
-                    "in-process database)"
+                    "':memory:' for a transient, tests/preview-only in-process "
+                    "database, or 'md:<database>' for MotherDuck)"
                 )
             return DuckDBDatabaseManager(
                 path=self.path,
                 internal_schema=self.get_internal_location(),
                 data_schema=self.get_data_location(),
                 read_only=self.read_only,
+                motherduck_token=self.motherduck_token,
                 settings=self.settings,
                 ensure_locations=ensure_locations,
             )
@@ -410,6 +478,19 @@ class ProfileConfig(BaseModel):
                 role=self.role,
                 settings=self.settings,
             )
+        if self.type == "bigquery":
+            from detectkit.database.bigquery_manager import BigQuerySourceManager
+
+            # Guaranteed by `_validate_bigquery_fields` at construction time.
+            assert self.project is not None
+            return BigQuerySourceManager(
+                project=self.project,
+                credentials_json_path=self.credentials_json_path,
+                location=self.location,
+                dataset=self.dataset,
+                api_endpoint=self.api_endpoint,
+                settings=self.settings,
+            )
         return self.create_manager()