floe-python 0.6.3__tar.gz → 0.6.4__tar.gz

{floe_python-0.6.3 → floe_python-0.6.4}/Cargo.lock

@@ -8,12 +8,6 @@ version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
 
-[[package]]
-name = "adler32"
-version = "1.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aae1277d39aeec15cb388266ecc24b11c80469deae6067e17a1a7aa9e5c1f234"
-
 [[package]]
 name = "aes"
 version = "0.8.4"
@@ -145,29 +139,6 @@ version = "1.0.100"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a23eb6b1614318a8071c9b2521f36b424b2c83db5eb3a0fead4a6c0809af6e61"
 
-[[package]]
-name = "apache-avro"
-version = "0.16.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ceb7c683b2f8f40970b70e39ff8be514c95b96fcb9c4af87e1ed2cb2e10801a0"
-dependencies = [
- "digest",
- "lazy_static",
- "libflate",
- "log",
- "num-bigint",
- "quad-rand",
- "rand 0.8.5",
- "regex-lite",
- "serde",
- "serde_json",
- "strum 0.25.0",
- "strum_macros 0.25.3",
- "thiserror 1.0.69",
- "typed-builder 0.16.2",
- "uuid",
-]
-
 [[package]]
 name = "apache-avro"
 version = "0.21.0"
@@ -186,8 +157,8 @@ dependencies = [
  "serde",
  "serde_bytes",
  "serde_json",
- "strum 0.27.2",
- "strum_macros 0.27.2",
+ "strum",
+ "strum_macros",
  "thiserror 2.0.18",
  "uuid",
  "zstd",
@@ -1635,7 +1606,7 @@ version = "4.5.49"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2a0b5487afeab2deb2ff4e03a807ad1a03ac532ff5a2cee5d86884440c7f7671"
 dependencies = [
- "heck 0.5.0",
+ "heck",
  "proc-macro2",
  "quote",
  "syn 2.0.117",
@@ -1792,15 +1763,6 @@ version = "0.8.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
 
-[[package]]
-name = "core2"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b49ba7ef1ad6107f8824dbe97de947cbaac53c44e7f9756a1fba0d37c1eec505"
-dependencies = [
- "memchr",
-]
-
 [[package]]
 name = "cpufeatures"
 version = "0.2.17"
@@ -2075,12 +2037,6 @@ dependencies = [
  "syn 2.0.117",
 ]
 
-[[package]]
-name = "dary_heap"
-version = "0.3.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "06d2e3287df1c007e74221c49ca10a95d557349e54b3a75dc2fb14712c751f04"
-
 [[package]]
 name = "dashmap"
 version = "6.1.0"
@@ -2809,7 +2765,7 @@ dependencies = [
  "rustc_version",
  "serde",
  "serde_json",
- "strum 0.27.2",
+ "strum",
  "thiserror 2.0.18",
  "tokio",
  "tracing",
@@ -2929,7 +2885,7 @@ dependencies = [
  "serde",
  "serde_json",
  "sqlparser 0.59.0",
- "strum 0.27.2",
+ "strum",
  "thiserror 2.0.18",
  "tokio",
  "tracing",
@@ -3158,7 +3114,7 @@ dependencies = [
  "num",
  "num-integer",
  "rust_decimal",
- "strum 0.27.2",
+ "strum",
 ]
 
 [[package]]
@@ -3384,7 +3340,7 @@ dependencies = [
 
 [[package]]
 name = "floe-cli"
-version = "0.6.3"
+version = "0.6.4"
 dependencies = [
  "assert_cmd",
  "clap",
@@ -3397,9 +3353,9 @@ dependencies = [
 
 [[package]]
 name = "floe-core"
-version = "0.6.3"
+version = "0.6.4"
 dependencies = [
- "apache-avro 0.16.0",
+ "apache-avro",
  "arrow",
  "async-trait",
  "aws-config",
@@ -3422,6 +3378,7 @@ dependencies = [
  "iceberg-catalog-rest",
  "iceberg-storage-opendal",
  "mockito",
+ "opendal",
  "orc-rust",
  "polars",
  "rayon",
@@ -3442,7 +3399,7 @@ dependencies = [
 
 [[package]]
 name = "floe-python"
-version = "0.6.3"
+version = "0.6.4"
 dependencies = [
  "floe-core",
  "pyo3",
@@ -3873,12 +3830,6 @@ dependencies = [
  "hashbrown 0.16.1",
 ]
 
-[[package]]
-name = "heck"
-version = "0.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "95505c38b4572b2d910cecb0281560f54b440a19336cbbcb27bf6ce6adc6f5a8"
-
 [[package]]
 name = "heck"
 version = "0.5.0"
@@ -4141,7 +4092,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4d9c3fc1f55c84ff64645c0d2ee35159f5574d33f729fc0860783bc247c8b8c5"
 dependencies = [
  "anyhow",
- "apache-avro 0.21.0",
+ "apache-avro",
  "array-init",
  "arrow-arith",
  "arrow-array",
@@ -4179,7 +4130,7 @@ dependencies = [
  "serde_json",
  "serde_repr",
  "serde_with",
- "strum 0.27.2",
+ "strum",
  "tokio",
  "typed-builder 0.20.1",
  "typetag",
@@ -4679,30 +4630,6 @@ dependencies = [
  "zip 6.0.0",
 ]
 
-[[package]]
-name = "libflate"
-version = "2.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e3248b8d211bd23a104a42d81b4fa8bb8ac4a3b75e7a43d85d2c9ccb6179cd74"
-dependencies = [
- "adler32",
- "core2",
- "crc32fast",
- "dary_heap",
- "libflate_lz77",
-]
-
-[[package]]
-name = "libflate_lz77"
-version = "2.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a599cb10a9cd92b1300debcef28da8f70b935ec937f44fcd1b70a7c986a11c5c"
-dependencies = [
- "core2",
- "hashbrown 0.16.1",
- "rle-decode-fast",
-]
-
 [[package]]
 name = "libm"
 version = "0.2.15"
@@ -5584,7 +5511,7 @@ dependencies = [
  "serde",
  "simdutf8",
  "streaming-iterator",
- "strum_macros 0.27.2",
+ "strum_macros",
  "version_check",
  "zstd",
 ]
@@ -5620,7 +5547,7 @@ dependencies = [
  "ryu",
  "serde",
  "strength_reduce",
- "strum_macros 0.27.2",
+ "strum_macros",
  "version_check",
 ]
 
@@ -5654,7 +5581,7 @@ dependencies = [
  "regex",
  "serde",
  "serde_json",
- "strum_macros 0.27.2",
+ "strum_macros",
  "uuid",
  "version_check",
  "xxhash-rust",
@@ -5853,7 +5780,7 @@ dependencies = [
  "rayon",
  "regex",
  "regex-syntax",
- "strum_macros 0.27.2",
+ "strum_macros",
  "unicode-normalization",
  "unicode-reverse",
  "version_check",
@@ -5928,7 +5855,7 @@ dependencies = [
  "regex",
  "sha2",
  "slotmap",
- "strum_macros 0.27.2",
+ "strum_macros",
  "version_check",
 ]
 
@@ -6041,7 +5968,7 @@ dependencies = [
  "polars-utils",
  "rayon",
  "regex",
- "strum_macros 0.27.2",
+ "strum_macros",
 ]
 
 [[package]]
@@ -6323,7 +6250,7 @@ version = "0.29.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4ca3a1557399783172dc5bf39cfca835157732532cba56b71d2292161e53b362"
 dependencies = [
- "heck 0.5.0",
+ "heck",
  "proc-macro2",
  "quote",
  "syn 2.0.117",
@@ -6880,12 +6807,6 @@ dependencies = [
  "syn 1.0.109",
 ]
 
-[[package]]
-name = "rle-decode-fast"
-version = "1.0.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3582f63211428f83597b51b2ddb88e2a91a9d52d12831f9d08f5e624e8977422"
-
 [[package]]
 name = "rmp"
 version = "0.8.15"
@@ -7580,7 +7501,7 @@ version = "0.8.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c1c97747dbf44bb1ca44a561ece23508e99cb592e862f22222dcf42f51d1e451"
 dependencies = [
- "heck 0.5.0",
+ "heck",
  "proc-macro2",
  "quote",
  "syn 2.0.117",
@@ -7727,32 +7648,13 @@ version = "0.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
 
-[[package]]
-name = "strum"
-version = "0.25.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "290d54ea6f91c969195bdbcd7442c8c2a2ba87da8bf60a7ee86a235d4bc1e125"
-
 [[package]]
 name = "strum"
 version = "0.27.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "af23d6f6c1a224baef9d3f61e287d2761385a5b88fdab4eb4c6f11aeb54c4bcf"
 dependencies = [
- "strum_macros 0.27.2",
-]
-
-[[package]]
-name = "strum_macros"
-version = "0.25.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23dc1fa9ac9c169a78ba62f0b841814b7abae11bdd047b9c58f893439e309ea0"
-dependencies = [
- "heck 0.4.1",
- "proc-macro2",
- "quote",
- "rustversion",
- "syn 2.0.117",
+ "strum_macros",
 ]
 
 [[package]]
@@ -7761,7 +7663,7 @@ version = "0.27.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7695ce3845ea4b33927c055a39dc438a45b059f7c1b3d91d38d10355fb8cbca7"
 dependencies = [
- "heck 0.5.0",
+ "heck",
  "proc-macro2",
  "quote",
  "syn 2.0.117",
@@ -8204,15 +8106,6 @@ version = "2.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9ea3136b675547379c4bd395ca6b938e5ad3c3d20fad76e7fe85f9e0d011419c"
 
-[[package]]
-name = "typed-builder"
-version = "0.16.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "34085c17941e36627a879208083e25d357243812c30e7d7387c3b954f30ade16"
-dependencies = [
- "typed-builder-macro 0.16.2",
-]
-
 [[package]]
 name = "typed-builder"
 version = "0.20.1"
@@ -8231,17 +8124,6 @@ dependencies = [
  "typed-builder-macro 0.23.0",
 ]
 
-[[package]]
-name = "typed-builder-macro"
-version = "0.16.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f03ca4cb38206e2bef0700092660bb74d696f808514dae47fa1467cbfe26e96e"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.117",
-]
-
 [[package]]
 name = "typed-builder-macro"
 version = "0.20.1"
@@ -9035,7 +8917,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ea61de684c3ea68cb082b7a88508a8b27fcc8b797d738bfc99a82facf1d752dc"
 dependencies = [
  "anyhow",
- "heck 0.5.0",
+ "heck",
  "wit-parser",
 ]
 
@@ -9046,7 +8928,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b7c566e0f4b284dd6561c786d9cb0142da491f46a9fbed79ea69cdad5db17f21"
 dependencies = [
  "anyhow",
- "heck 0.5.0",
+ "heck",
  "indexmap 2.13.0",
  "prettyplease",
  "syn 2.0.117",

{floe_python-0.6.3 → floe_python-0.6.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: floe-python
-Version: 0.6.3
+Version: 0.6.4
 Classifier: Development Status :: 4 - Beta
 Classifier: Intended Audience :: Developers
 Classifier: Intended Audience :: Science/Research

{floe_python-0.6.3 → floe_python-0.6.4}/crates/floe-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "floe-core"
-version = "0.6.3"
+version = "0.6.4"
 edition = "2021"
 description = "Core library for Floe, a YAML-driven technical ingestion tool."
 license = "MIT"
@@ -31,7 +31,7 @@ aws-sdk-s3 = "1"
 aws-credential-types = "1"
 # Only used by the Iceberg Glue catalog path; gated under the `iceberg` feature.
 aws-sdk-glue = { version = "1", optional = true }
-apache-avro = "0.16"
+apache-avro = "0.21"
 google-cloud-storage = { package = "gcloud-storage", version = "1.2.0" }
 tempfile = "3"
 tokio = { version = "1", features = ["rt", "rt-multi-thread", "fs", "io-util"] }
@@ -46,7 +46,8 @@ uuid = "1"
 arrow = "57"
 iceberg = { version = "0.9.0", optional = true }
 iceberg-catalog-rest = { version = "0.9.0", optional = true }
-iceberg-storage-opendal = { version = "0.9.1", features = ["opendal-s3", "opendal-gcs"], optional = true }
+iceberg-storage-opendal = { version = "0.9.1", features = ["opendal-s3", "opendal-gcs", "opendal-azdls"], optional = true }
+opendal = { version = "0.55", features = ["services-azdls"], optional = true }
 df-interchange = { version = "0.3.2", features = ["arrow_57", "polars_0_52"] }
 orc-rust = "0.7.1"
 # Pinned exactly: 1.10500.0 bundles DuckDB 1.5.0 (native MERGE INTO) and depends on
@@ -77,6 +78,6 @@ mockito = "1"
 # enables both the writer and its tests.
 default = ["delta", "iceberg"]
 delta = ["dep:deltalake"]
-iceberg = ["dep:iceberg", "dep:iceberg-catalog-rest", "dep:iceberg-storage-opendal", "dep:aws-sdk-glue"]
+iceberg = ["dep:iceberg", "dep:iceberg-catalog-rest", "dep:iceberg-storage-opendal", "dep:aws-sdk-glue", "dep:opendal"]
 duckdb = ["dep:duckdb"]
 vendored-openssl = []

{floe_python-0.6.3 → floe_python-0.6.4}/crates/floe-core/src/config/parse.rs

@@ -1,4 +1,5 @@
 use crate::errors::FloeError;
+use crate::secret::Secret;
 use std::collections::HashMap;
 use std::path::Path;
 
@@ -707,7 +708,7 @@ fn parse_sink_duckdb_options(value: &Yaml, ctx: &str) -> FloeResult<DuckDbSinkTa
         table: get_string(hash, "table", ctx)?,
         schema: opt_string(hash, "schema", ctx)?,
         connection: blank_to_none(opt_string(hash, "connection", ctx)?),
-        token: blank_to_none(opt_string(hash, "token", ctx)?),
+        token: blank_to_none(opt_string(hash, "token", ctx)?).map(Secret::from),
     })
 }
 
@@ -852,7 +853,7 @@ fn parse_catalog_type_config(
         }),
         "rest" => Ok(CatalogTypeConfig::Rest {
             uri: get_string(hash, "uri", context)?,
-            credential: opt_string(hash, "credential", context)?,
+            credential: opt_string(hash, "credential", context)?.map(Secret::from),
             warehouse: opt_string(hash, "warehouse", context)?,
             oauth2_server_uri: opt_string(hash, "oauth2_server_uri", context)?,
             scope: opt_string(hash, "scope", context)?,
@@ -861,7 +862,7 @@ fn parse_catalog_type_config(
             host: get_string(hash, "host", context)?,
             catalog: get_string(hash, "catalog", context)?,
             schema: get_string(hash, "schema", context)?,
-            token: get_string(hash, "token", context)?,
+            token: Secret::from(get_string(hash, "token", context)?),
             create_schema_if_missing: opt_bool(hash, "create_schema_if_missing", context)?
                 .unwrap_or(false),
         }),

{floe_python-0.6.3 → floe_python-0.6.4}/crates/floe-core/src/config/types.rs

@@ -1,4 +1,5 @@
 use crate::errors::FloeError;
+use crate::secret::Secret;
 use std::collections::HashMap;
 use std::path::Path;
 
@@ -375,8 +376,9 @@ pub struct DuckDbSinkTargetConfig {
     /// MotherDuck instead of a local file and `SinkTarget.path` is ignored.
     pub connection: Option<String>,
     /// MotherDuck access token. Supports `${ENV}` substitution. Required for MotherDuck unless
-    /// the `motherduck_token` environment variable is set in the process.
-    pub token: Option<String>,
+    /// the `motherduck_token` environment variable is set in the process. Redacted in
+    /// `Debug`/`Display`; the manifest builder additionally drops literal tokens.
+    pub token: Option<Secret>,
 }
 
 /// True if `connection` is a MotherDuck connection string (`md:` scheme).
@@ -431,7 +433,8 @@ pub enum CatalogTypeConfig {
         /// REST catalog endpoint URI (e.g. `https://<host>/api/catalog`).
         uri: String,
         /// Credential string: `"token:<token>"` or `"client_credentials:<id>:<secret>"`.
-        credential: Option<String>,
+        /// Redacted in `Debug`/`Display`.
+        credential: Option<Secret>,
         /// Warehouse / catalog identifier (e.g. `"my_catalog"` or `"my_catalog.my_schema"`).
         warehouse: Option<String>,
         /// OAuth2 token endpoint URI (required for Snowflake Polaris).
@@ -448,8 +451,9 @@ pub enum CatalogTypeConfig {
         catalog: String,
         /// Unity schema (database) name (e.g. "my_schema").
         schema: String,
-        /// Personal Access Token or value from env-var substitution.
-        token: String,
+        /// Personal Access Token or value from env-var substitution. Redacted in
+        /// `Debug`/`Display`.
+        token: Secret,
         /// Create the Unity schema if it does not already exist (default: false).
         create_schema_if_missing: bool,
     },

{floe_python-0.6.3 → floe_python-0.6.4}/crates/floe-core/src/io/storage/object_store.rs

@@ -4,7 +4,8 @@ use std::collections::HashMap;
 
 #[cfg(feature = "iceberg")]
 use iceberg::io::{
-    CLIENT_REGION, S3_ACCESS_KEY_ID, S3_REGION, S3_SECRET_ACCESS_KEY, S3_SESSION_TOKEN,
+    ADLS_ACCOUNT_KEY, ADLS_ACCOUNT_NAME, ADLS_SAS_TOKEN, CLIENT_REGION, S3_ACCESS_KEY_ID,
+    S3_REGION, S3_SECRET_ACCESS_KEY, S3_SESSION_TOKEN,
 };
 #[cfg(feature = "delta")]
 use url::Url;
@@ -113,7 +114,7 @@ pub fn delta_store_config(
 pub fn iceberg_store_config(
     target: &Target,
     resolver: &config::StorageResolver,
-    entity: &config::EntityConfig,
+    _entity: &config::EntityConfig,
 ) -> FloeResult<IcebergStoreConfig> {
     match target {
         Target::Local { base_path, .. } => Ok(IcebergStoreConfig {
@@ -144,11 +145,24 @@ pub fn iceberg_store_config(
             warehouse_location: uri.to_string(),
             file_io_props: HashMap::new(),
         }),
-        Target::Adls { .. } => Err(FloeError::config(format!(
-            "entity.name={} iceberg sink is only supported on local, s3, or gcs storage for now",
-            entity.name
-        ))
-        .into()),
+        Target::Adls { uri, account, .. } => {
+            let mut file_io_props = HashMap::new();
+            let warehouse_location = uri
+                .strip_prefix("abfs://")
+                .map(|rest| format!("abfss://{rest}"))
+                .unwrap_or_else(|| uri.to_string());
+            file_io_props.insert(ADLS_ACCOUNT_NAME.to_string(), account.to_string());
+            if let Ok(key) = std::env::var("AZURE_STORAGE_ACCOUNT_KEY") {
+                file_io_props.insert(ADLS_ACCOUNT_KEY.to_string(), key);
+            }
+            if let Ok(sas) = std::env::var("AZURE_STORAGE_SAS_TOKEN") {
+                file_io_props.insert(ADLS_SAS_TOKEN.to_string(), sas);
+            }
+            Ok(IcebergStoreConfig {
+                warehouse_location,
+                file_io_props,
+            })
+        }
     }
 }
 

{floe_python-0.6.3 → floe_python-0.6.4}/crates/floe-core/src/io/write/delta/unity.rs

@@ -1,4 +1,5 @@
 use crate::errors::FloeError;
+use crate::secret::Secret;
 use std::time::Duration;
 
 use serde::{Deserialize, Serialize};
@@ -24,8 +25,8 @@ pub(crate) struct UnityCatalogConfig {
     pub(crate) schema: String,
     /// Table name.
     pub(crate) table: String,
-    /// Personal Access Token.
-    pub(crate) token: String,
+    /// Personal Access Token (redacted in `Debug`/`Display`).
+    pub(crate) token: Secret,
     /// Create the schema if it does not exist.
     pub(crate) create_schema_if_missing: bool,
 }
@@ -45,7 +46,7 @@ impl UnityCatalogConfig {
                 unity_catalog: catalog.clone(),
                 schema: resolved.schema.clone(),
                 table: resolved.table.clone(),
-                token: expand_env_token(token, &resolved.catalog_name)?,
+                token: Secret::new(expand_env_token(token.expose(), &resolved.catalog_name)?),
                 create_schema_if_missing: *create_schema_if_missing,
             }),
             // The resolved target is guaranteed to be Unity by validate_delta_catalog_binding.
@@ -147,7 +148,7 @@ pub(crate) async fn register_unity_table(
             "{}/api/2.1/unity-catalog/tables/{}",
             cfg.host, full_name
         ))
-        .bearer_auth(&cfg.token)
+        .bearer_auth(cfg.token.expose())
         .send()
         .await
         .map_err(|err| {
@@ -200,7 +201,7 @@ pub(crate) async fn register_unity_table(
     // 3. Create the table.
     let create_resp = client
         .post(format!("{}/api/2.1/unity-catalog/tables", cfg.host))
-        .bearer_auth(&cfg.token)
+        .bearer_auth(cfg.token.expose())
         .json(&CreateTableRequest {
             name: &cfg.table,
             catalog_name: &cfg.unity_catalog,
@@ -251,7 +252,7 @@ async fn ensure_schema(cfg: &UnityCatalogConfig, client: &reqwest::Client) -> Fl
             "{}/api/2.1/unity-catalog/schemas/{}",
             cfg.host, schema_full
         ))
-        .bearer_auth(&cfg.token)
+        .bearer_auth(cfg.token.expose())
         .send()
         .await
         .map_err(|err| {
@@ -266,7 +267,7 @@ async fn ensure_schema(cfg: &UnityCatalogConfig, client: &reqwest::Client) -> Fl
 
     let create_resp = client
         .post(format!("{}/api/2.1/unity-catalog/schemas", cfg.host))
-        .bearer_auth(&cfg.token)
+        .bearer_auth(cfg.token.expose())
         .json(&CreateSchemaRequest {
             name: &cfg.schema,
             catalog_name: &cfg.unity_catalog,

{floe_python-0.6.3 → floe_python-0.6.4}/crates/floe-core/src/io/write/delta/unity_tests.rs

@@ -79,7 +79,7 @@ fn test_cfg(server_url: &str) -> UnityCatalogConfig {
         unity_catalog: "main".to_string(),
         schema: "bronze".to_string(),
         table: "orders".to_string(),
-        token: "test-token".to_string(),
+        token: crate::secret::Secret::from("test-token"),
         create_schema_if_missing: false,
     }
 }

{floe_python-0.6.3 → floe_python-0.6.4}/crates/floe-core/src/io/write/duckdb/conn.rs

@@ -15,6 +15,7 @@ use ::duckdb::{Config, Connection};
 
 use crate::config::DuckDbSinkTargetConfig;
 use crate::io::storage::Target;
+use crate::secret::Secret;
 use crate::FloeResult;
 
 /// MotherDuck connection strings are identified by the `md:` scheme prefix.
@@ -35,9 +36,10 @@ pub(crate) enum DuckDbTarget {
     MotherDuck {
         /// The full `md:<db>` connection string.
         connection: String,
-        /// Already `${ENV}`-expanded token (never logged), or `None` to rely on
-        /// the ambient `motherduck_token` environment variable.
-        token: Option<String>,
+        /// Already `${ENV}`-expanded token (redacted in `Debug`/`Display`, never
+        /// logged), or `None` to rely on the ambient `motherduck_token`
+        /// environment variable.
+        token: Option<Secret>,
         cache_key: String,
     },
 }
@@ -91,8 +93,8 @@ pub(crate) fn resolve_target(
     if let Some(connection) = cfg.connection.as_deref() {
         let connection = connection.trim();
         if is_motherduck_connection(connection) {
-            let token = match cfg.token.as_deref() {
-                Some(raw) => Some(expand_env_token(raw, entity_name)?),
+            let token = match cfg.token.as_ref() {
+                Some(raw) => Some(expand_env_token(raw.expose(), entity_name)?),
                 None => None,
             };
             // The cache key must distinguish the same `md:` database opened with
@@ -113,7 +115,7 @@ pub(crate) fn resolve_target(
             let cache_key = motherduck_cache_key(connection, fingerprint_token.as_deref());
             return Ok(DuckDbTarget::MotherDuck {
                 connection: connection.to_string(),
-                token,
+                token: token.map(Secret::new),
                 cache_key,
             });
         }
@@ -263,7 +265,7 @@ fn open_connection(target: &DuckDbTarget) -> FloeResult<Connection> {
                 // Pass the token via the connection Config rather than a `SET`
                 // statement so it never appears in any SQL string we build.
                 let config = Config::default()
-                    .with("motherduck_token", token)
+                    .with("motherduck_token", token.expose())
                     .map_err(|err| {
                         FloeError::run(format!(
                             "duckdb motherduck token configuration failed: {err}"
@@ -471,7 +473,7 @@ mod tests {
             table: "t".to_string(),
             schema: None,
             connection: Some(connection.to_string()),
-            token: token.map(str::to_string),
+            token: token.map(Secret::from),
         }
     }