Module conn 

Connection descriptors with credentials handled out of band.

A Connection is a serializable descriptor (persisted by callers, e.g. as datoms on the model). It NEVER stores a password. For Postgres it stores a DSN without the password plus the NAME of an environment variable holding the secret (default PGPASSWORD). open resolves the secret from the environment at connect time and injects it, and never logs the assembled string. A serde round-trip of a Connection therefore contains no secret.

Structs

Connection

A saved connection. Serializable and secret-free by construction.

Enums

ConnKind

The backend + its non-secret locator. Secrets live in the environment.

Functions

assert_no_inline_secret

duckdb

Convenience: a DuckDB descriptor.

open

Assemble a live Backend from a descriptor, pulling any secret from the environment. The secret is never logged and never written back to the descriptor.

postgres

Convenience: a Postgres descriptor naming an env var for its secret.

sqlite

Convenience: a SQLite descriptor.