@cc [owner:Yassimba] datasource.profile-envelope
Applies only to `DatasourceDocument` in `codec.py`.

The profiles field maps non-empty, exact profile names to mappings of connection fields.
A supplied defaultProfile must name an existing profile, including when profiles is absent or empty.
Invalid names, scalar or null profile entries, and unmatched defaults are Document Validation errors.

@cc [owner:Yassimba] snowflake.explicit-credentials
Applies only to `SnowflakeDatasourceType` in `snowflake.py`.

The effective authenticator is explicitly password, jwt, or external-browser; credentials never infer
the method.
Password requires a username and non-empty password and rejects private-key credentials.
JWT requires a username and exactly one private-key source; it rejects passwords and a key passphrase
without a key. External-browser requires a username and rejects passwords and private-key credentials.

@cc [owner:Yassimba] snowflake.native-cache-options
Applies only to `SnowflakeDatasourceType.adbc_connect_args` in `snowflake.py`.

Map password to auth_snowflake, jwt to auth_jwt, and external-browser to auth_ext_browser in native
ADBC options. External-browser sets adbc.snowflake.sql.client_option.store_temp_creds to the string true.
Password and JWT do not inherit browser-cache behavior.

@cc [owner:Yassimba] snowflake.native-authentication-reuse
Applies only to `SnowflakeDatasourceType` in `snowflake.py`.

The native driver owns credential storage and authentication reuse on Windows, macOS, and Linux including
WSL. With account caching permitted and native storage available, concurrent connections of one identity
in a successful cold-cache command require at most one login flow. A later command starts no browser while
its cached credential remains usable. Turbine does not read or copy cached tokens, change account caching
policy, or replace native storage with a fallback store.

@cc [owner:Yassimba] snowflake.timeout-separation
Applies only to `SnowflakeDatasourceType.adbc_connect_args` in `snowflake.py`.

Browser-login wait, network connection timeout, and query timeout retain separate meanings.
Allowing human login does not increase query timeouts or remove their existing cancellation behavior.
An unsupported native browser-wait option is reported as a limitation before introducing an adapter
workaround.
