From 977618a96e2bff7ae12913028971a6c85032e240 Mon Sep 17 00:00:00 2001
From: Chris Campo <ccampo133@users.noreply.github.com>
Date: Wed, 27 Mar 2024 12:13:57 -0400
Subject: [PATCH 01/14] Initial discovery and classification CLI implementation

---
 Dockerfile                                    |  20 +
 classification/classification.go              | 153 ++++++
 .../classification_fakeclassifier_test.go     | 213 ++++++++
 classification/examples/example_policy.rego   |  70 +++
 .../examples/example_policy_simple.rego       |  22 +
 classification/label.go                       |  43 ++
 classification/publisher/publisher.go         |  21 +
 classification/publisher/stdout.go            |  39 ++
 classification/rego/README.md                 |   8 +
 classification/rego/address.rego              |  34 ++
 classification/rego/address_test.rego         |  61 +++
 classification/rego/age.rego                  |  15 +
 classification/rego/age_test.rego             |  37 ++
 classification/rego/ccn.rego                  |  17 +
 classification/rego/ccn_test.rego             |  26 +
 classification/rego/cvv.rego                  |  58 +++
 classification/rego/cvv_test.rego             |  29 ++
 classification/rego/dob.rego                  |  45 ++
 classification/rego/dob_test.rego             | 110 +++++
 classification/rego/email.rego                |  17 +
 classification/rego/email_test.rego           |  13 +
 classification/rego/first_name.rego           |  20 +
 classification/rego/first_name_test.rego      |  49 ++
 classification/rego/full_name.rego            |  15 +
 classification/rego/full_name_test.rego       |  25 +
 classification/rego/ip_address.rego           |  28 ++
 classification/rego/ip_address_test.rego      |  25 +
 classification/rego/labels.yaml               |  77 +++
 classification/rego/last_name.rego            |  20 +
 classification/rego/last_name_test.rego       |  49 ++
 classification/rego/passport.rego             |  22 +
 classification/rego/passport_test.rego        |  65 +++
 classification/rego/phone_number.rego         |  17 +
 classification/rego/phone_number_test.rego    |  13 +
 classification/rego/ssn.rego                  |  24 +
 classification/rego/ssn_test.rego             |  73 +++
 classification/rego_classifier.go             | 126 +++++
 classification/rego_classifier_test.go        | 457 ++++++++++++++++++
 cmd/main.go                                   |  75 +++
 cmd/repo_scan.go                              |  18 +
 discovery/config/config.go                    |  59 +++
 discovery/config/util.go                      | 138 ++++++
 discovery/config/util_test.go                 | 178 +++++++
 discovery/repository/denodo/denodo.go         | 114 +++++
 discovery/repository/doc.go                   |  15 +
 discovery/repository/gen.go                   |   5 +
 discovery/repository/genericsql/genericsql.go | 303 ++++++++++++
 .../repository/genericsql/genericsql_test.go  | 301 ++++++++++++
 discovery/repository/genericsql/util.go       |  35 ++
 discovery/repository/metadata.go              |  81 ++++
 discovery/repository/metadata_test.go         |  71 +++
 discovery/repository/mock_repository.go       | 342 +++++++++++++
 discovery/repository/mysql/mysql.go           |  97 ++++
 discovery/repository/mysql/mysql_test.go      |  31 ++
 discovery/repository/oracle/config.go         |  27 ++
 discovery/repository/oracle/oracle.go         | 125 +++++
 discovery/repository/oracle/oracle_test.go    |  86 ++++
 discovery/repository/postgresql/config.go     |  22 +
 discovery/repository/postgresql/postgresql.go | 103 ++++
 .../repository/postgresql/postgresql_test.go  |  31 ++
 discovery/repository/redshift/redshift.go     |  94 ++++
 .../repository/redshift/redshift_test.go      |  32 ++
 discovery/repository/repository.go            | 237 +++++++++
 discovery/repository/repository_test.go       | 134 +++++
 .../repository/sample_all_databases_test.go   | 228 +++++++++
 .../repository/sample_repository_test.go      | 181 +++++++
 discovery/repository/sampling.go              |  56 +++
 discovery/repository/sampling_test.go         |  77 +++
 discovery/repository/snowflake/config.go      |  36 ++
 discovery/repository/snowflake/snowflake.go   | 100 ++++
 .../repository/snowflake/snowflake_test.go    |  31 ++
 discovery/repository/sqlserver/sqlserver.go   | 104 ++++
 .../repository/sqlserver/sqlserver_test.go    |  31 ++
 discovery/scanner.go                          | 161 ++++++
 go.mod                                        |  76 ++-
 go.sum                                        | 269 ++++++++++-
 scan/scanner.go                               |   3 +-
 77 files changed, 6257 insertions(+), 6 deletions(-)
 create mode 100644 Dockerfile
 create mode 100644 classification/classification.go
 create mode 100644 classification/classification_fakeclassifier_test.go
 create mode 100644 classification/examples/example_policy.rego
 create mode 100644 classification/examples/example_policy_simple.rego
 create mode 100644 classification/label.go
 create mode 100644 classification/publisher/publisher.go
 create mode 100644 classification/publisher/stdout.go
 create mode 100644 classification/rego/README.md
 create mode 100644 classification/rego/address.rego
 create mode 100644 classification/rego/address_test.rego
 create mode 100644 classification/rego/age.rego
 create mode 100644 classification/rego/age_test.rego
 create mode 100644 classification/rego/ccn.rego
 create mode 100644 classification/rego/ccn_test.rego
 create mode 100644 classification/rego/cvv.rego
 create mode 100644 classification/rego/cvv_test.rego
 create mode 100644 classification/rego/dob.rego
 create mode 100644 classification/rego/dob_test.rego
 create mode 100644 classification/rego/email.rego
 create mode 100644 classification/rego/email_test.rego
 create mode 100644 classification/rego/first_name.rego
 create mode 100644 classification/rego/first_name_test.rego
 create mode 100644 classification/rego/full_name.rego
 create mode 100644 classification/rego/full_name_test.rego
 create mode 100644 classification/rego/ip_address.rego
 create mode 100644 classification/rego/ip_address_test.rego
 create mode 100644 classification/rego/labels.yaml
 create mode 100644 classification/rego/last_name.rego
 create mode 100644 classification/rego/last_name_test.rego
 create mode 100644 classification/rego/passport.rego
 create mode 100644 classification/rego/passport_test.rego
 create mode 100644 classification/rego/phone_number.rego
 create mode 100644 classification/rego/phone_number_test.rego
 create mode 100644 classification/rego/ssn.rego
 create mode 100644 classification/rego/ssn_test.rego
 create mode 100644 classification/rego_classifier.go
 create mode 100644 classification/rego_classifier_test.go
 create mode 100644 cmd/main.go
 create mode 100644 cmd/repo_scan.go
 create mode 100644 discovery/config/config.go
 create mode 100644 discovery/config/util.go
 create mode 100644 discovery/config/util_test.go
 create mode 100644 discovery/repository/denodo/denodo.go
 create mode 100644 discovery/repository/doc.go
 create mode 100644 discovery/repository/gen.go
 create mode 100644 discovery/repository/genericsql/genericsql.go
 create mode 100644 discovery/repository/genericsql/genericsql_test.go
 create mode 100644 discovery/repository/genericsql/util.go
 create mode 100644 discovery/repository/metadata.go
 create mode 100644 discovery/repository/metadata_test.go
 create mode 100644 discovery/repository/mock_repository.go
 create mode 100644 discovery/repository/mysql/mysql.go
 create mode 100644 discovery/repository/mysql/mysql_test.go
 create mode 100644 discovery/repository/oracle/config.go
 create mode 100644 discovery/repository/oracle/oracle.go
 create mode 100644 discovery/repository/oracle/oracle_test.go
 create mode 100644 discovery/repository/postgresql/config.go
 create mode 100644 discovery/repository/postgresql/postgresql.go
 create mode 100644 discovery/repository/postgresql/postgresql_test.go
 create mode 100644 discovery/repository/redshift/redshift.go
 create mode 100644 discovery/repository/redshift/redshift_test.go
 create mode 100644 discovery/repository/repository.go
 create mode 100644 discovery/repository/repository_test.go
 create mode 100644 discovery/repository/sample_all_databases_test.go
 create mode 100644 discovery/repository/sample_repository_test.go
 create mode 100644 discovery/repository/sampling.go
 create mode 100644 discovery/repository/sampling_test.go
 create mode 100644 discovery/repository/snowflake/config.go
 create mode 100644 discovery/repository/snowflake/snowflake.go
 create mode 100644 discovery/repository/snowflake/snowflake_test.go
 create mode 100644 discovery/repository/sqlserver/sqlserver.go
 create mode 100644 discovery/repository/sqlserver/sqlserver_test.go
 create mode 100644 discovery/scanner.go

diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..a35bd86
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,20 @@
+FROM golang:1.22 as build
+
+# Set destination for COPY.
+WORKDIR /app
+
+# Download dependencies.
+COPY go.mod go.sum ./
+RUN go mod download
+
+# Copy the source code.
+COPY . .
+
+# Build.
+RUN CGO_ENABLED=0 go build -o dmap cmd/*.go
+
+FROM gcr.io/distroless/static-debian12:nonroot
+
+COPY --from=build /app/dmap /dmap
+
+ENTRYPOINT ["/dmap"]
diff --git a/classification/classification.go b/classification/classification.go
new file mode 100644
index 0000000..43682eb
--- /dev/null
+++ b/classification/classification.go
@@ -0,0 +1,153 @@
+// Package classification provides various types and functions to facilitate
+// data classification. The type Classifier provides an interface which takes
+// sampled data as input and returns a classified version of that sample as
+// output. The package contains at least one implementation which uses Rego and
+// OPA to perform the actual classification logic (see LabelClassifier), however
+// other implementations may be added in the future.
+package classification
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/cyralinc/dmap/discovery/repository"
+)
+
+// TODO: godoc -ccampo 2024-03-27
+type ClassifiedTable struct {
+	Repo    string `json:"repo"`
+	Catalog string `json:"catalog"`
+	Schema  string `json:"schema"`
+	Table   string `json:"table"`
+}
+
+// Result represents the classification of a data attribute.
+type Result struct {
+	Table           *ClassifiedTable `json:"table"`
+	AttributeName   string           `json:"attributeName"`
+	Classifications []*Label         `json:"classifications"`
+}
+
+// Classifier implementations know how to turn a row of data into a sequence of
+// classification results.
+type Classifier interface {
+	// Classify takes as input what amounts to a "row of data": complete
+	// information about where the table comes from as well as a list of columns
+	// and attributeValues. While the values might be any data type, by the time
+	// we reach here, we expect the values to be represented as strings.
+	//
+	// For a given attribute, if it is classified as belonging to a particular
+	// classification group, we will add an instance for it in the Result.
+	// If however, there is no assigned classification, we will skip it in the
+	// results. A zero length return value is normal if none of the attributes
+	// matched the classification requirements.
+	Classify(
+		ctx context.Context,
+		table *ClassifiedTable,
+		attrs map[string]any,
+	) ([]Result, error)
+}
+
+// ClassifySamples uses the provided Classifier to classify the sample data
+// passed via the "samples" parameter. It is mostly a helper function which
+// loops through each repository.Sample, retrieves the attribute names and
+// values of that sample, passes them to Classifier.Classify, and then
+// aggregates the results. Please see the documentation for Classifier and its
+// Classify method for more details. The returned slice represents all the
+// unique classification results for a given sample set.
+func ClassifySamples(
+	ctx context.Context,
+	classifier Classifier,
+	samples []repository.Sample,
+) ([]Result, error) {
+	var classifications []Result
+	for _, sample := range samples {
+		table := ClassifiedTable{
+			Repo:    sample.Metadata.Repo,
+			Catalog: sample.Metadata.Database,
+			Schema:  sample.Metadata.Schema,
+			Table:   sample.Metadata.Table,
+		}
+		// Classify each sampled row
+		for _, sampleResult := range sample.Results {
+			res, err := classifier.Classify(ctx, &table, sampleResult)
+			if err != nil {
+				return nil, fmt.Errorf("error classifying sample: %w", err)
+			}
+			classifications = append(classifications, res...)
+		}
+	}
+	return combineAndDedupe(classifications), nil
+}
+
+// AggregateClassifySamples classifies the given samples with every classifier,
+// and returns the aggregate result slice. For details on how each
+// classification is executed, see ClassifySamples.
+func AggregateClassifySamples(
+	ctx context.Context,
+	classifiers map[string]Classifier,
+	samples []repository.Sample,
+) ([]Result, error) {
+	classifications := make([]Result, 0)
+	for _, classifier := range classifiers {
+		classified, err := ClassifySamples(ctx, classifier, samples)
+		if err != nil {
+			return nil, err
+		}
+		classifications = append(classifications, classified...)
+	}
+	return classifications, nil
+}
+
+// combineAndDedupe takes a slice of Result and combines the individual elements
+// when they have the same schema/table/attribute, but different labels, into a
+// Result element with combined labels. Additionally, only distinct results by
+// schema, table, and attribute are present in the return slice.
+func combineAndDedupe(results []Result) []Result {
+	set := make(map[tableAttrLabel]bool)
+	distinctLabels := make(map[tableAttr][]*Label)
+	for _, result := range results {
+		for _, lbl := range result.Classifications {
+			key := tableAttrLabel{
+				ta: tableAttr{
+					table: *result.Table,
+					attr:  result.AttributeName,
+				},
+				label: lbl.Name,
+			}
+
+			if !set[key] {
+				set[key] = true
+				distinctLabels[key.ta] = append(distinctLabels[key.ta], lbl)
+			}
+		}
+	}
+
+	distinctResults := make([]Result, 0, len(distinctLabels))
+	for ta, labels := range distinctLabels {
+		result := Result{
+			Table: &ClassifiedTable{
+				Repo:    ta.table.Repo,
+				Catalog: ta.table.Catalog,
+				Schema:  ta.table.Schema,
+				Table:   ta.table.Table,
+			},
+			AttributeName:   ta.attr,
+			Classifications: labels,
+		}
+		distinctResults = append(distinctResults, result)
+	}
+
+	return distinctResults
+}
+
+// Both tableAttr and tableAttrLabel are only used as map keys
+type tableAttr struct {
+	table ClassifiedTable
+	attr  string
+}
+
+type tableAttrLabel struct {
+	ta    tableAttr
+	label string
+}
diff --git a/classification/classification_fakeclassifier_test.go b/classification/classification_fakeclassifier_test.go
new file mode 100644
index 0000000..5e41169
--- /dev/null
+++ b/classification/classification_fakeclassifier_test.go
@@ -0,0 +1,213 @@
+package classification
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/cyralinc/dmap/discovery/repository"
+)
+
+type classifyFunc func(table *ClassifiedTable, attrs map[string]any) ([]Result, error)
+
+type fakeClassifier struct {
+	classify classifyFunc
+}
+
+var _ Classifier = (*fakeClassifier)(nil)
+
+func (f fakeClassifier) Classify(
+	_ context.Context,
+	table *ClassifiedTable,
+	attrs map[string]any,
+) ([]Result, error) {
+	return f.classify(table, attrs)
+}
+
+func Test_Classify_FakeClassifier_SingleSample(t *testing.T) {
+	sample := repository.Sample{
+		Metadata: repository.SampleMetadata{
+			Repo:     repoName,
+			Database: catalogName,
+			Schema:   schemaName,
+			Table:    tableName,
+		},
+		Results: []repository.SampleResult{
+			{
+				"age":             "52",
+				"social_sec_num":  "512-23-4256",
+				"credit_card_num": "4111111111111111",
+			},
+			{
+				"age":             "53",
+				"social_sec_num":  "512-23-4258",
+				"credit_card_num": "4111111111111111",
+			},
+		},
+	}
+
+	table := ClassifiedTable{
+		Repo:    repoName,
+		Catalog: catalogName,
+		Schema:  schemaName,
+		Table:   tableName,
+	}
+
+	expected := []Result{
+		{
+			Table:           &table,
+			AttributeName:   "age",
+			Classifications: []*Label{{Name: "PII"}},
+		},
+		{
+			Table:           &table,
+			AttributeName:   "social_sec_num",
+			Classifications: []*Label{{Name: "PII"}, {Name: "PRIVATE"}},
+		},
+		{
+			Table:           &table,
+			AttributeName:   "credit_card_num",
+			Classifications: []*Label{{Name: "PII"}, {Name: "CCN"}, {Name: "PCI"}},
+		},
+	}
+
+	classifier := fakeClassifier{
+		classify: func(
+			table *ClassifiedTable,
+			attrs map[string]any,
+		) ([]Result, error) {
+			return expected, nil
+		},
+	}
+
+	actual, err := ClassifySamples(context.Background(), classifier, []repository.Sample{sample})
+	assert.NoError(t, err)
+	assert.ElementsMatch(t, expected, actual)
+}
+
+func Test_AggregateClassify_FakeClassifier_MultipleSamples(t *testing.T) {
+	tableName1 := tableName + "1"
+	tableName2 := tableName + "2"
+	ageAttr := "age"
+	ssnAttr := "social_sec_num"
+	ccnAttr := "credit_card_num"
+	samples := []repository.Sample{
+		{
+			Metadata: repository.SampleMetadata{
+				Repo:     repoName,
+				Database: catalogName,
+				Schema:   schemaName,
+				Table:    tableName1,
+			},
+			Results: []repository.SampleResult{
+				{
+					ageAttr: "52",
+					ssnAttr: "512-23-4256",
+					ccnAttr: "4111111111111111",
+				},
+				{
+					ageAttr: "53",
+					ssnAttr: "512-23-4258",
+					ccnAttr: "4111111111111111",
+				},
+			},
+		},
+		{
+			Metadata: repository.SampleMetadata{
+				Repo:     repoName,
+				Database: catalogName,
+				Schema:   schemaName,
+				Table:    tableName2,
+			},
+			Results: []repository.SampleResult{
+				{
+					ageAttr: "21",
+					ssnAttr: "123-45-6789",
+					ccnAttr: "0123456789012345",
+				},
+				{
+					ageAttr: "22",
+					ssnAttr: "987-65-4321",
+					ccnAttr: "0123456789012345",
+				},
+			},
+		},
+	}
+
+	table1 := ClassifiedTable{
+		Repo:    repoName,
+		Catalog: catalogName,
+		Schema:  schemaName,
+		Table:   tableName1,
+	}
+	table2 := ClassifiedTable{
+		Repo:    repoName,
+		Catalog: catalogName,
+		Schema:  schemaName,
+		Table:   tableName2,
+	}
+
+	expectedFromClassifier1 := []Result{
+		{
+			Table:           &table1,
+			AttributeName:   ageAttr,
+			Classifications: []*Label{{Name: "PII"}},
+		},
+		{
+			Table:           &table1,
+			AttributeName:   ssnAttr,
+			Classifications: []*Label{{Name: "PII"}, {Name: "PRIVATE"}},
+		},
+		{
+			Table:           &table1,
+			AttributeName:   ccnAttr,
+			Classifications: []*Label{{Name: "PII"}, {Name: "CCN"}, {Name: "PCI"}},
+		},
+	}
+	expectedFromClassifier2 := []Result{
+		{
+			Table:           &table2,
+			AttributeName:   ageAttr,
+			Classifications: []*Label{{Name: "PII"}},
+		},
+		{
+			Table:           &table2,
+			AttributeName:   ssnAttr,
+			Classifications: []*Label{{Name: "PII"}, {Name: "PRIVATE"}},
+		},
+		{
+			Table:           &table2,
+			AttributeName:   ccnAttr,
+			Classifications: []*Label{{Name: "PII"}, {Name: "CCN"}, {Name: "PCI"}},
+		},
+	}
+	expected := append(expectedFromClassifier1, expectedFromClassifier2...)
+
+	classifiers := map[string]Classifier{
+		"classifier1": Classifier(
+			fakeClassifier{
+				classify: func(
+					table *ClassifiedTable,
+					attrs map[string]any,
+				) ([]Result, error) {
+					return expectedFromClassifier1, nil
+				},
+			},
+		),
+		"classifier2": Classifier(
+			fakeClassifier{
+				classify: func(
+					table *ClassifiedTable,
+					attrs map[string]any,
+				) ([]Result, error) {
+					return expectedFromClassifier2, nil
+				},
+			},
+		),
+	}
+
+	actual, err := AggregateClassifySamples(context.Background(), classifiers, samples)
+	assert.NoError(t, err)
+	assert.ElementsMatch(t, expected, actual)
+}
diff --git a/classification/examples/example_policy.rego b/classification/examples/example_policy.rego
new file mode 100644
index 0000000..f872855
--- /dev/null
+++ b/classification/examples/example_policy.rego
@@ -0,0 +1,70 @@
+package classifier
+
+import rego.v1
+
+output[k] := v if {
+	some k in object.keys(input)
+	v := classify(k, input[k])
+}
+
+default classify(_, _) := "UNLABELED"
+
+classify(_, val) := "EMAIL" if {
+	regex.match(
+		`\A[A-Za-z0-9][A-Za-z0-9._%+-]*@[A-Za-z0-9]((\.[A-Za-z0-9])|(-[A-Za-z0-9])|[A-Za-z0-9])*\.[A-Za-z]{2,}\z`,
+		val
+	)
+}
+
+classify(_, val) := "PHONE" if {
+	regex.match(
+		`\A((1(-| )?((\([2-9]\d{2}\))|([2-9]\d{2})))|([2-9]\d{2})|(\([2-9]\d{2}\)))(-| )?[2-9]((1[02-9])|([02-9]\d))(-| )?\d{4}\z`,
+		val
+	)
+}
+
+classify(_, val) := "SSN" if {
+	regex.match(
+		`\A((((66[0-57-9])|(6[0-57-7]\d)|(00[1-9])|(0[1-9]\d)|([1-578]\d{2}))-((0[1-9])|([1-9]\d))-((000[1-9])|(00[1-9]\d)|(0[1-9]\d{2})|([1-9]\d{3})))|(((66[0-57-9])|(6[0-57-7]\d)|(00[1-9])|(0[1-9]\d)|([1-578]\d{2}))+((0[1-9])|([1-9]\d))+((000[1-9])|(00[1-9]\d)|(0[1-9]\d{2})|([1-9]\d{3})))|(((66[0-57-9])|(6[0-57-7]\d)|(00[1-9])|(0[1-9]\d)|([1-578]\d{2}))\.((0[1-9])|([1-9]\d))\.((000[1-9])|(00[1-9]\d)|(0[1-9]\d{2})|([1-9]\d{3})))|(((66[0-57-9])|(6[0-57-7]\d)|(00[1-9])|(0[1-9]\d)|([1-578]\d{2}))((0[1-9])|([1-9]\d))((000[1-9])|(00[1-9]\d)|(0[1-9]\d{2})|([1-9]\d{3}))))\z`,
+		val
+	)
+}
+
+classify(_, val) := "CCN" if {
+	regex.match(
+		`\A(4[0-9]{3}[0-9]{4}[0-9]{4}[0-9](?:[0-9]{3})?|[0-9]{4}[-][0-9]{4}[-][0-9]{4}[-][0-9]{4}|5[1-5][0-9]{2}[0-9]{4}[0-9]{4}[0-9]{4}|3[47][0-9]{13}|3(?:0[0-5]|[68][0-9])[0-9]{11}|6(?:011|5[0-9]{2})[0-9]{12}|(?:2131|1800|35\d{3})\d{11})\z`,
+		val
+	)
+}
+
+classify(_, val) := "IP_ADDRESS" if {
+	regex.match(
+		`\A(?:(?:[0-9A-Fa-f]{1,4}:){6}(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|::(?:[0-9A-Fa-f]{1,4}:){5}(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|(?:[0-9A-Fa-f]{1,4})?::(?:[0-9A-Fa-f]{1,4}:){4}(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4})?::(?:[0-9A-Fa-f]{1,4}:){3}(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|(?:(?:[0-9A-Fa-f]{1,4}:){,2}[0-9A-Fa-f]{1,4})?::(?:[0-9A-Fa-f]{1,4}:){2}(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|(?:(?:[0-9A-Fa-f]{1,4}:){,3}[0-9A-Fa-f]{1,4})?::[0-9A-Fa-f]{1,4}:(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|(?:(?:[0-9A-Fa-f]{1,4}:){,4}[0-9A-Fa-f]{1,4})?::(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|(?:(?:[0-9A-Fa-f]{1,4}:){,5}[0-9A-Fa-f]{1,4})?::[0-9A-Fa-f]{1,4}|(?:(?:[0-9A-Fa-f]{1,4}:){,6}[0-9A-Fa-f]{1,4})?::)\z`,
+		val
+	)
+}
+
+classify(key, val) := "AGE" if {
+	lower(key) == "age"
+	regex.match(`\A((\d{1,2})|1[0-1]\d)\z`, val)
+}
+
+classify(key, _) := "ADDRESS" if {
+	regex.match(`\A.*address.*\z`, lower(key))
+}
+
+classify(key, _) := "ADDRESS" if {
+	regex.match(`\Astreet.*\z`, lower(key))
+}
+
+classify(key, _) := "ADDRESS" if {
+	lower(key) == "state"
+}
+
+classify(key, _) := "ADDRESS" if {
+	lower(key) == "zip"
+}
+
+classify(key, _) := "ADDRESS" if {
+	lower(key) == "zipcode"
+}
diff --git a/classification/examples/example_policy_simple.rego b/classification/examples/example_policy_simple.rego
new file mode 100644
index 0000000..9a2c312
--- /dev/null
+++ b/classification/examples/example_policy_simple.rego
@@ -0,0 +1,22 @@
+package classifier
+
+import rego.v1
+
+output[k] := v if {
+	some k in object.keys(input)
+	v := classify(k, input[k])
+}
+
+default classify(_, _) := "UNLABELED"
+
+classify(_, val) := "CCN" if {
+	regex.match(
+		`\A(4[0-9]{3}[0-9]{4}[0-9]{4}[0-9](?:[0-9]{3})?|[0-9]{4}[-][0-9]{4}[-][0-9]{4}[-][0-9]{4}|5[1-5][0-9]{2}[0-9]{4}[0-9]{4}[0-9]{4}|3[47][0-9]{13}|3(?:0[0-5]|[68][0-9])[0-9]{11}|6(?:011|5[0-9]{2})[0-9]{12}|(?:2131|1800|35\d{3})\d{11})\z`,
+		val
+	)
+}
+
+classify(key, val) := "AGE" if {
+	contains(lower(key), "age")
+	regex.match(`\A((\d{1,2})|1[0-1]\d)\z`, val)
+}
diff --git a/classification/label.go b/classification/label.go
new file mode 100644
index 0000000..42709fb
--- /dev/null
+++ b/classification/label.go
@@ -0,0 +1,43 @@
+package classification
+
+import (
+	"embed"
+	"fmt"
+	"strings"
+
+	"gopkg.in/yaml.v3"
+)
+
+// Label represents a data classification label.
+type Label struct {
+	Name               string   `json:"name"`
+	Description        string   `json:"description"`
+	Tags               []string `json:"tags"`
+	ClassificationRule string   `json:"-"`
+}
+
+//go:embed rego/*.rego
+var regoFs embed.FS
+
+//go:embed rego/labels.yaml
+var labelsYaml string
+
+// GetLabels returns a slice of all known labels defined in the labels.yaml
+// file.
+func GetLabels() ([]*Label, error) {
+	lbls := struct {
+		Labels []*Label `yaml:"labels"`
+	}{}
+	if err := yaml.Unmarshal([]byte(labelsYaml), &lbls); err != nil {
+		return nil, fmt.Errorf("error unmarshalling labels.yaml: %w", err)
+	}
+	for _, lbl := range lbls.Labels {
+		fname := "rego/" + strings.ReplaceAll(strings.ToLower(lbl.Name), " ", "_") + ".rego"
+		b, err := regoFs.ReadFile(fname)
+		if err != nil {
+			return nil, fmt.Errorf("error reading rego file %s: %w", fname, err)
+		}
+		lbl.ClassificationRule = string(b)
+	}
+	return lbls.Labels, nil
+}
diff --git a/classification/publisher/publisher.go b/classification/publisher/publisher.go
new file mode 100644
index 0000000..97a33b7
--- /dev/null
+++ b/classification/publisher/publisher.go
@@ -0,0 +1,21 @@
+// Package publisher provides types for publishing data classifications results
+// to an external source (Publisher), such as to stdout (StdOutPublisher).
+package publisher
+
+import (
+	"context"
+
+	"github.com/cyralinc/dmap/classification"
+)
+
+// Publisher publishes classification and discovery results to some destination,
+// which is left up to the implementer.
+type Publisher interface {
+	// PublishClassifications publishes a list of classification.Result to
+	// some destination. Any error(s) during publication should be returned.
+	PublishClassifications(
+		ctx context.Context,
+		repoId string,
+		results []classification.Result,
+	) error
+}
diff --git a/classification/publisher/stdout.go b/classification/publisher/stdout.go
new file mode 100644
index 0000000..30b65b7
--- /dev/null
+++ b/classification/publisher/stdout.go
@@ -0,0 +1,39 @@
+package publisher
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+
+	"github.com/cyralinc/dmap/classification"
+)
+
+// StdOutPublisher "publishes" classification results to stdout in JSON format.
+type StdOutPublisher struct{}
+
+// StdOutPublisher implements Publisher
+var _ Publisher = (*StdOutPublisher)(nil)
+
+func NewStdOutPublisher() *StdOutPublisher {
+	return &StdOutPublisher{}
+}
+
+func (c *StdOutPublisher) PublishClassifications(
+	_ context.Context,
+	repoId string,
+	results []classification.Result,
+) error {
+	classifications := struct {
+		Repo            string                  `json:"repo"`
+		Classifications []classification.Result `json:"classifications"`
+	}{
+		Repo:            repoId,
+		Classifications: results,
+	}
+	b, err := json.MarshalIndent(classifications, "", "    ")
+	if err != nil {
+		return fmt.Errorf("failed to marshal classifications: %w", err)
+	}
+	fmt.Println(string(b))
+	return nil
+}
diff --git a/classification/rego/README.md b/classification/rego/README.md
new file mode 100644
index 0000000..c664cbe
--- /dev/null
+++ b/classification/rego/README.md
@@ -0,0 +1,8 @@
+This directory contains all the data label definitions used for classification.
+The label metadata is specified in the [`labels.yaml`](labels.yaml) file. Please
+see that file's doc comment for more details.
+
+Additionally, the classification rule Rego code must be specified as a
+`<label>.rego` file, where `<label>` is the name of the label in lowercase. For
+example, if the label `ADDRESS` is defined in `labels.yaml`, it should have an
+`address.rego` file defined as well.
diff --git a/classification/rego/address.rego b/classification/rego/address.rego
new file mode 100644
index 0000000..e61d882
--- /dev/null
+++ b/classification/rego/address.rego
@@ -0,0 +1,34 @@
+package classifier_address
+
+import rego.v1
+
+output[k] := v if {
+	some k in object.keys(input)
+	v := classify(k, input[k])
+}
+
+default classify(_, _) := "UNLABELED"
+
+classify(key, _) := "ADDRESS" if {
+	lower(key) == "state"
+}
+
+classify(key, _) := "ADDRESS" if {
+	lower(key) == "zip"
+}
+
+classify(key, _) := "ADDRESS" if {
+	lower(key) == "zipcode"
+}
+
+classify(key, _) := "ADDRESS" if {
+	lower(key) == "zipcode"
+}
+
+classify(key, _) := "ADDRESS" if {
+	regex.match(`\A.*address.*\z`, lower(key))
+}
+
+classify(key, _) := "ADDRESS" if {
+	regex.match(`\Astreet.*\z`, lower(key))
+}
diff --git a/classification/rego/address_test.rego b/classification/rego/address_test.rego
new file mode 100644
index 0000000..e97150e
--- /dev/null
+++ b/classification/rego/address_test.rego
@@ -0,0 +1,61 @@
+package classifier_address
+
+test_no_label {
+    output.column == "UNLABELED" with input as {"column":"invalid"}
+}
+
+test_column_name_state {
+    output.state == "ADDRESS" with input as {"state":"AZ"}
+}
+
+test_insensitive_column_name_state {
+    output.STATE == "ADDRESS" with input as {"STATE":"AZ"}
+}
+
+test_column_name_address {
+    output.address == "ADDRESS" with input as {"address":"123 some street"}
+}
+
+test_insensitive_column_name_address {
+    output.ADDRESS == "ADDRESS" with input as {"ADDRESS":"123 some street"}
+}
+
+test_column_name_contains_address {
+    output.some_address_here == "ADDRESS" with input as {"some_address_here":"123 some street"}
+}
+
+test_insensitive_column_name_contains_address {
+    output.some_ADDRESS_Here == "ADDRESS" with input as {"some_ADDRESS_Here":"123 some street"}
+}
+
+test_column_name_street {
+    output.street == "ADDRESS" with input as {"street":"123 some street"}
+}
+
+test_insensitive_column_name_street {
+    output.STREET == "ADDRESS" with input as {"STREET":"123 some street"}
+}
+
+test_column_name_starts_with_street {
+    output.street_name == "ADDRESS" with input as {"street_name":"123 some street"}
+}
+
+test_insensitive_column_name_starts_with_street {
+    output.STREET_Name == "ADDRESS" with input as {"STREET_Name":"123 some street"}
+}
+
+test_column_name_zip {
+    output.zip == "ADDRESS" with input as {"zip":"11111"}
+}
+
+test_insensitive_column_name_zip {
+    output.ZIP == "ADDRESS" with input as {"ZIP":"11111"}
+}
+
+test_column_name_zipcode {
+    output.zipcode == "ADDRESS" with input as {"zipcode":"11111"}
+}
+
+test_insensitive_column_name_zipcode {
+    output.ZIPCODE == "ADDRESS" with input as {"ZIPCODE":"11111"}
+}
diff --git a/classification/rego/age.rego b/classification/rego/age.rego
new file mode 100644
index 0000000..6797bd1
--- /dev/null
+++ b/classification/rego/age.rego
@@ -0,0 +1,15 @@
+package classifier_age
+
+import rego.v1
+
+output[k] := v if {
+	some k in object.keys(input)
+	v := classify(k, input[k])
+}
+
+default classify(_, _) := "UNLABELED"
+
+classify(key, val) := "AGE" if {
+	lower(key) == "age"
+	regex.match(`\A((\d{1,2})|1[0-1]\d)\z`, val)
+}
diff --git a/classification/rego/age_test.rego b/classification/rego/age_test.rego
new file mode 100644
index 0000000..edc3ef5
--- /dev/null
+++ b/classification/rego/age_test.rego
@@ -0,0 +1,37 @@
+package classifier_age
+
+test_no_label {
+    output.column == "UNLABELED" with input as {"column":"invalid"}
+}
+
+test_column_name_age_invalid_age {
+    output.age == "UNLABELED" with input as {"age":"120"}
+}
+
+test_insensitive_column_name_age_invalid {
+    output.AGE == "UNLABELED" with input as {"AGE":"120"}
+}
+
+test_column_name_age_single_digit {
+    output.age == "AGE" with input as {"age":"1"}
+}
+
+test_insensitive_column_name_age_single_digit {
+    output.AGE == "AGE" with input as {"AGE":"1"}
+}
+
+test_column_name_age_double_digit {
+    output.age == "AGE" with input as {"age":"10"}
+}
+
+test_insensitive_column_name_age_double_digit {
+    output.AGE == "AGE" with input as {"AGE":"10"}
+}
+
+test_column_name_age_triple_digit {
+    output.age == "AGE" with input as {"age":"100"}
+}
+
+test_insensitive_column_name_age_triple_digit {
+    output.AGE == "AGE" with input as {"AGE":"100"}
+}
diff --git a/classification/rego/ccn.rego b/classification/rego/ccn.rego
new file mode 100644
index 0000000..5c8d343
--- /dev/null
+++ b/classification/rego/ccn.rego
@@ -0,0 +1,17 @@
+package classifier_ccn
+
+import rego.v1
+
+output[k] := v if {
+	some k in object.keys(input)
+	v := classify(k, input[k])
+}
+
+default classify(_, _) := "UNLABELED"
+
+classify(_, val) := "CCN" if {
+	regex.match(
+		`\A(?:4[0-9]{12}(?:[0-9]{3})?|[25][1-7][0-9]{14}|6(?:011|5[0-9][0-9])[0-9]{12}|3[47][0-9]{13}|3(?:0[0-5]|[68][0-9])[0-9]{11}|(?:2131|1800|35\d{3})\d{11})\z`,
+		val
+    )
+}
diff --git a/classification/rego/ccn_test.rego b/classification/rego/ccn_test.rego
new file mode 100644
index 0000000..31d2e40
--- /dev/null
+++ b/classification/rego/ccn_test.rego
@@ -0,0 +1,26 @@
+package classifier_ccn
+
+test_no_label {
+    output.column == "UNLABELED" with input as {"column":"invalid"}
+}
+
+test_valid_amex_ccn {
+    output.message == "CCN" with input as {"message":"370136066365291"}
+}
+
+test_valid_visa_ccn {
+    output.message == "CCN" with input as {"message":"4613688275707134"}
+}
+
+test_valid_mastercard_ccn {
+    output.message == "CCN" with input as {"message":"5423909386888564"}
+}
+
+# TODO : Fix pattern to match
+test_valid_mastercard_ccn {
+    output.message == "CCN" with input as {"message":"2701306282695666"}
+}
+
+test_valid_discover_ccn {
+    output.message == "CCN" with input as {"message":"6536673682309236"}
+}
diff --git a/classification/rego/cvv.rego b/classification/rego/cvv.rego
new file mode 100644
index 0000000..075b705
--- /dev/null
+++ b/classification/rego/cvv.rego
@@ -0,0 +1,58 @@
+package classifier_cvv
+
+import rego.v1
+
+output[k] := v if {
+	some k in object.keys(input)
+	v := classify(k, input[k])
+}
+
+default classify(_, _) := "UNLABELED"
+
+classify(key, _) := "CVV" if {
+	lower(key) == "cvv"
+}
+
+classify(key, _) := "CVV" if {
+	lower(key) == "csc"
+}
+
+classify(key, _) := "CVV" if {
+	lower(key) == "3csc"
+}
+
+classify(key, _) := "CVV" if {
+	lower(key) == "cvc"
+}
+
+classify(key, _) := "CVV" if {
+	lower(key) == "cav"
+}
+
+classify(key, _) := "CVV" if {
+	lower(key) == "cid"
+}
+
+classify(key, _) := "CVV" if {
+	lower(key) == "cvd"
+}
+
+classify(key, _) := "CVV" if {
+	lower(key) == "cve"
+}
+
+classify(key, _) := "CVV" if {
+	lower(key) == "cvn"
+}
+
+classify(key, _) := "CVV" if {
+	lower(key) == "spc"
+}
+
+classify(key, _) := "CVV" if {
+	lower(key) == "pvv"
+}
+
+classify(_, val) := "CVV" if {
+	regex.match(`^\d{3,4}$`, val)
+}
diff --git a/classification/rego/cvv_test.rego b/classification/rego/cvv_test.rego
new file mode 100644
index 0000000..233ec72
--- /dev/null
+++ b/classification/rego/cvv_test.rego
@@ -0,0 +1,29 @@
+package classifier_cvv
+
+test_cvv_key {
+	output.CVV == "CVV" with input as {"CVV":"test"}
+}
+
+test_cvv_key {
+	output.cvv == "CVV" with input as {"cvv":"test"}
+}
+
+test_cvv_key {
+	output.CvV == "CVV" with input as {"CvV":"test"}
+}
+
+test_cvv_pattern {
+	output.message == "CVV" with input as {"message":"451"}
+}
+
+test_cvv_pattern {
+	output.message == "CVV" with input as {"message":"5061"}
+}
+
+test_cvv_pattern {
+	output.message == "CVV" with input as {"message":"123"}
+}
+
+test_cvv_pattern {
+	output.message == "UNLABELED" with input as {"message":"12345"}
+}
diff --git a/classification/rego/dob.rego b/classification/rego/dob.rego
new file mode 100644
index 0000000..424e079
--- /dev/null
+++ b/classification/rego/dob.rego
@@ -0,0 +1,45 @@
+package classifier_dob
+
+import rego.v1
+
+output[k] := v if {
+	some k in object.keys(input)
+	v := classify(k, input[k])
+}
+
+default classify(_, _) := "UNLABELED"
+
+classify(key, _) := "DOB" if {
+	lower(key) == "dob"
+}
+
+classify(key, _) := "DOB" if {
+	lower(key) == "dateofbirth"
+}
+
+classify(key, _) := "DOB" if {
+	lower(key) == "date_of_birth"
+}
+
+classify(key, _) := "DOB" if {
+	lower(key) == "birthdate"
+}
+
+classify(key, _) := "DOB" if {
+	lower(key) == "birth_date"
+}
+
+classify(_, val) := "DOB" if {
+	# mm/dd/yyyy mm-dd-yyyy mm.dd.yyyy
+	regex.match(`^(0?[1-9]|1[0-2])[\/\.-](0?[1-9]|[12]\d|3[01])[\/\.-](19|20)\d{2}$`, val)
+}
+
+classify(_, val) := "DOB" if {
+	# dd/mm/yyyy
+	regex.match(`^(0?[1-9]|[12]\d|3[01])[\/\.-](0?[1-9]|1[0-2])[\/\.-](19|20)\d{2}$`, val)
+}
+
+classify(_, val) := "DOB" if {
+	# yyyy/mm/dd
+	regex.match(`^(19|20)\d{2}[\/\.-](0?[1-9]|1[0-2])[\/\.-](0?[1-9]|[12]\d|3[01])$`, val)
+}
diff --git a/classification/rego/dob_test.rego b/classification/rego/dob_test.rego
new file mode 100644
index 0000000..bd25728
--- /dev/null
+++ b/classification/rego/dob_test.rego
@@ -0,0 +1,110 @@
+package classifier_dob
+
+test_dob_key {
+	output.dob == "DOB" with input as {"dob":"test"}
+}
+
+test_dob_key {
+	output.DOB == "DOB" with input as {"DOB":"test"}
+}
+
+test_dob_key {
+	output.DoB == "DOB" with input as {"DoB":"test"}
+}
+
+test_dob_key {
+	output.birthdate == "DOB" with input as {"birthdate":"test"}
+}
+
+test_dob_key {
+	output.BirthDate == "DOB" with input as {"BirthDate":"test"}
+}
+
+test_dob_key {
+	output.dateofbirth == "DOB" with input as {"dateofbirth":"test"}
+}
+
+test_dob_key {
+	output.DateOfBirth == "DOB" with input as {"DateOfBirth":"test"}
+}
+
+test_dob_key {
+	output.birthdate == "DOB" with input as {"birthdate":"test"}
+}
+
+test_dob_key {
+	output.birth_date == "DOB" with input as {"birth_date":"test"}
+}
+
+# mm/dd/yyyy
+
+test_dob_pattern {
+	output.message == "DOB" with input as {"message":"01/01/1900"}
+}
+
+test_dob_pattern {
+	output.message == "DOB" with input as {"message":"1-1-1900"}
+}
+
+test_dob_pattern {
+	output.message == "DOB" with input as {"message":"10.01.1971"}
+}
+
+test_dob_pattern {
+	output.message == "DOB" with input as {"message":"11/30/2023"}
+}
+
+# dd/mm/yyyy
+
+test_dob_pattern {
+	output.message == "DOB" with input as {"message":"01/01/1900"}
+}
+
+test_dob_pattern {
+	output.message == "DOB" with input as {"message":"1/1/1900"}
+}
+
+test_dob_pattern {
+	output.message == "DOB" with input as {"message":"10/01/1971"}
+}
+
+test_dob_pattern {
+	output.message == "DOB" with input as {"message":"30/11/2023"}
+}
+
+
+# yyyy/mm/dd
+
+test_dob_pattern {
+	output.message == "DOB" with input as {"message":"1900/01/10"}
+}
+
+test_dob_pattern {
+	output.message == "DOB" with input as {"message":"1900/1/1"}
+}
+
+test_dob_pattern {
+	output.message == "DOB" with input as {"message":"1971/10/01"}
+}
+
+test_dob_pattern {
+	output.message == "DOB" with input as {"message":"2023/12/31"}
+}
+
+# yyyy-mm-dd
+
+test_dob_pattern {
+	output.message == "DOB" with input as {"message":"1900-01-10"}
+}
+
+test_dob_pattern {
+	output.message == "DOB" with input as {"message":"1900-1-1"}
+}
+
+test_dob_pattern {
+	output.message == "DOB" with input as {"message":"1971-10-01"}
+}
+
+test_dob_pattern {
+	output.message == "DOB" with input as {"message":"2023-12-31"}
+}
diff --git a/classification/rego/email.rego b/classification/rego/email.rego
new file mode 100644
index 0000000..821cfd8
--- /dev/null
+++ b/classification/rego/email.rego
@@ -0,0 +1,17 @@
+package classifier_email
+
+import rego.v1
+
+output[k] := v if {
+	some k in object.keys(input)
+	v := classify(k, input[k])
+}
+
+default classify(_, _) := "UNLABELED"
+
+classify(_, val) := "EMAIL" if {
+	regex.match(
+		`\A[A-Za-z0-9][A-Za-z0-9._%+-]*@[A-Za-z0-9]((\.[A-Za-z0-9])|(-[A-Za-z0-9])|[A-Za-z0-9])*\.[A-Za-z]{2,}\z`,
+		val
+	)
+}
diff --git a/classification/rego/email_test.rego b/classification/rego/email_test.rego
new file mode 100644
index 0000000..3a5b007
--- /dev/null
+++ b/classification/rego/email_test.rego
@@ -0,0 +1,13 @@
+package classifier_email
+
+test_no_label {
+    output.column == "UNLABELED" with input as {"column":"invalid"}
+}
+
+test_valid_email_com {
+    output.message == "EMAIL" with input as {"message":"me@me.com"}
+}
+
+test_valid_email_us {
+    output.message == "EMAIL" with input as {"message":"me@state.pa.us"}
+}
diff --git a/classification/rego/first_name.rego b/classification/rego/first_name.rego
new file mode 100644
index 0000000..0052607
--- /dev/null
+++ b/classification/rego/first_name.rego
@@ -0,0 +1,20 @@
+package classifier_first_name
+
+import rego.v1
+
+output[k] := v if {
+	some k in object.keys(input)
+	v := classify(k, input[k])
+}
+
+default classify(_, _) := "UNLABELED"
+
+classify(key, _) := "FIRST_NAME" if {
+	contains(lower(key), "first")
+	contains(lower(key), "name")
+}
+
+classify(key, _) := "FIRST_NAME" if {
+	contains(lower(key), "given")
+	contains(lower(key), "name")
+}
diff --git a/classification/rego/first_name_test.rego b/classification/rego/first_name_test.rego
new file mode 100644
index 0000000..6c16add
--- /dev/null
+++ b/classification/rego/first_name_test.rego
@@ -0,0 +1,49 @@
+package classifier_first_name
+
+test_fn_pattern {
+	output.first_name == "FIRST_NAME" with input as {"first_name":"John"}
+}
+
+test_fn_pattern {
+	output.first_name == "FIRST_NAME" with input as {"first_name":"Robert"}
+}
+
+test_fn_pattern {
+	output.firstname == "FIRST_NAME" with input as {"firstname":"Robert"}
+}
+
+test_fn_pattern {
+	output.firstName == "FIRST_NAME" with input as {"firstName":"Robert"}
+}
+
+test_fn_pattern {
+	output.First_Name == "FIRST_NAME" with input as {"First_Name":"Robert"}
+}
+
+test_fn_pattern {
+	output.FirstName == "FIRST_NAME" with input as {"FirstName":"Robert"}
+}
+
+test_gn_pattern {
+	output.given_name == "FIRST_NAME" with input as {"given_name":"John"}
+}
+
+test_gn_pattern {
+	output.given_name == "FIRST_NAME" with input as {"given_name":"Robert"}
+}
+
+test_gn_pattern {
+	output.givenname == "FIRST_NAME" with input as {"givenname":"Robert"}
+}
+
+test_gn_pattern {
+	output.givenName == "FIRST_NAME" with input as {"givenName":"Robert"}
+}
+
+test_gn_pattern {
+	output.Given_Name == "FIRST_NAME" with input as {"Given_Name":"Robert"}
+}
+
+test_gn_pattern {
+	output.GivenName == "FIRST_NAME" with input as {"GivenName":"Robert"}
+}
diff --git a/classification/rego/full_name.rego b/classification/rego/full_name.rego
new file mode 100644
index 0000000..c5f8102
--- /dev/null
+++ b/classification/rego/full_name.rego
@@ -0,0 +1,15 @@
+package classifier_full_name
+
+import rego.v1
+
+output[k] := v if {
+	some k in object.keys(input)
+	v := classify(k, input[k])
+}
+
+default classify(_, _) := "UNLABELED"
+
+classify(key, _) := "FULL_NAME" if {
+	contains(lower(key), "full")
+	contains(lower(key), "name")
+}
diff --git a/classification/rego/full_name_test.rego b/classification/rego/full_name_test.rego
new file mode 100644
index 0000000..78b39c5
--- /dev/null
+++ b/classification/rego/full_name_test.rego
@@ -0,0 +1,25 @@
+package classifier_full_name
+
+test_fn_pattern {
+	output.full_name == "FULL_NAME" with input as {"full_name":"John"}
+}
+
+test_fn_pattern {
+	output.full_name == "FULL_NAME" with input as {"full_name":"Robert"}
+}
+
+test_fn_pattern {
+	output.fullname == "FULL_NAME" with input as {"fullname":"Robert"}
+}
+
+test_fn_pattern {
+	output.fullName == "FULL_NAME" with input as {"fullName":"Robert"}
+}
+
+test_fn_pattern {
+	output.Full_Name == "FULL_NAME" with input as {"Full_Name":"Robert"}
+}
+
+test_fn_pattern {
+	output.FullName == "FULL_NAME" with input as {"FullName":"Robert"}
+}
diff --git a/classification/rego/ip_address.rego b/classification/rego/ip_address.rego
new file mode 100644
index 0000000..c14b33e
--- /dev/null
+++ b/classification/rego/ip_address.rego
@@ -0,0 +1,28 @@
+package classifier_ip_address
+
+import rego.v1
+
+output[k] := v if {
+	some k in object.keys(input)
+	v := classify(k, input[k])
+}
+
+default classify(_, _) := "UNLABELED"
+
+classify(key, val) := "IP_ADDRESS" if {
+	regex.match(`\d+\.\d+\.\d+\.\d+`, val)
+}
+
+classify(key, val) := "IP_ADDRESS" if {
+	regex.match(
+	    `\A(?:(?:[0-9A-Fa-f]{1,4}:){6}(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|::(?:[0-9A-Fa-f]{1,4}:){5}(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|(?:[0-9A-Fa-f]{1,4})?::(?:[0-9A-Fa-f]{1,4}:){4}(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4})?::(?:[0-9A-Fa-f]{1,4}:){3}(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|(?:(?:[0-9A-Fa-f]{1,4}:){,2}[0-9A-Fa-f]{1,4})?::(?:[0-9A-Fa-f]{1,4}:){2}(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|(?:(?:[0-9A-Fa-f]{1,4}:){,3}[0-9A-Fa-f]{1,4})?::[0-9A-Fa-f]{1,4}:(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|(?:(?:[0-9A-Fa-f]{1,4}:){,4}[0-9A-Fa-f]{1,4})?::(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|(?:(?:[0-9A-Fa-f]{1,4}:){,5}[0-9A-Fa-f]{1,4})?::[0-9A-Fa-f]{1,4}|(?:(?:[0-9A-Fa-f]{1,4}:){,6}[0-9A-Fa-f]{1,4})?::)\z`,
+	    val
+	)
+}
+
+classify(key, val) := "IP_ADDRESS" if {
+	regex.match(
+		`\A(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))\z`,
+		val
+	)
+}
diff --git a/classification/rego/ip_address_test.rego b/classification/rego/ip_address_test.rego
new file mode 100644
index 0000000..3ab915d
--- /dev/null
+++ b/classification/rego/ip_address_test.rego
@@ -0,0 +1,25 @@
+package classifier_ip_address
+
+test_no_label {
+    output.column == "UNLABELED" with input as {"column":"invalid"}
+}
+
+test_ipv4_google {
+    output.column == "IP_ADDRESS" with input as {"column":"8.8.8.8"}
+}
+
+test_ipv4_localhost {
+    output.column == "IP_ADDRESS" with input as {"column":"127.0.0.1"}
+}
+
+test_ipv4_internal {
+    output.column == "IP_ADDRESS" with input as {"column":"10.1.1.1"}
+}
+
+test_ipv6 {
+    output.column == "IP_ADDRESS" with input as {"column":"2001:db8:3333:4444:5555:6666:7777:8888"}
+}
+
+test_ipv6_google {
+    output.column == "IP_ADDRESS" with input as {"column":"2001:4860:4860::8888"}
+}
diff --git a/classification/rego/labels.yaml b/classification/rego/labels.yaml
new file mode 100644
index 0000000..462dbf8
--- /dev/null
+++ b/classification/rego/labels.yaml
@@ -0,0 +1,77 @@
+# Contains all the predefined data labels by Cyral. To add a new predefined
+# label, define it in this file along with its classification rule Rego code in
+# a '<label>.rego' file.
+#
+# YAML structure:
+#
+# labels:               # The list of labels
+#   - name: foo         # The label name
+#     description: bar  # The label description
+#     tags:             # The label tags (list)
+#       - tag1
+#       - tag2
+labels:
+  - name: Address
+    description: Address
+    tags:
+      - PII
+
+  - name: Age
+    description: Age
+    tags:
+      - PII
+
+  - name: CCN
+    description: Credit card number
+    tags:
+      - PCI
+
+  - name: CVV
+    description: Credit card verification value (CVV)
+    tags:
+      - PCI
+
+  - name: DOB
+    description: Date of birth
+    tags:
+      - PII
+
+  - name: Email
+    description: Email address
+    tags:
+      - PII
+
+  - name: First Name
+    description: First name
+    tags:
+      - PII
+
+  - name: Full Name
+    description: Full name
+    tags:
+      - PII
+
+  - name: IP Address
+    description: IP address
+    tags:
+      - PII
+
+  - name: Last Name
+    description: Last name
+    tags:
+      - PII
+
+  - name: Passport
+    description: Passport number
+    tags:
+      - PII
+
+  - name: Phone Number
+    description: Phone number
+    tags:
+      - PII
+
+  - name: SSN
+    description: Social security number
+    tags:
+      - PII
diff --git a/classification/rego/last_name.rego b/classification/rego/last_name.rego
new file mode 100644
index 0000000..977807f
--- /dev/null
+++ b/classification/rego/last_name.rego
@@ -0,0 +1,20 @@
+package classifier_last_name
+
+import rego.v1
+
+output[k] := v if {
+	some k in object.keys(input)
+	v := classify(k, input[k])
+}
+
+default classify(_, _) := "UNLABELED"
+
+classify(key, _) := "LAST_NAME" if {
+	contains(lower(key), "last")
+	contains(lower(key), "name")
+}
+
+classify(key, _) := "LAST_NAME" if {
+	contains(lower(key), "sur")
+	contains(lower(key), "name")
+}
diff --git a/classification/rego/last_name_test.rego b/classification/rego/last_name_test.rego
new file mode 100644
index 0000000..6e9edaa
--- /dev/null
+++ b/classification/rego/last_name_test.rego
@@ -0,0 +1,49 @@
+package classifier_last_name
+
+test_ln_pattern {
+	output.last_name == "LAST_NAME" with input as {"last_name":"John"}
+}
+
+test_ln_pattern {
+	output.last_name == "LAST_NAME" with input as {"last_name":"Robert"}
+}
+
+test_ln_pattern {
+	output.lastname == "LAST_NAME" with input as {"lastname":"Robert"}
+}
+
+test_ln_pattern {
+	output.lastName == "LAST_NAME" with input as {"lastName":"Robert"}
+}
+
+test_ln_pattern {
+	output.Last_Name == "LAST_NAME" with input as {"Last_Name":"Robert"}
+}
+
+test_ln_pattern {
+	output.LastName == "LAST_NAME" with input as {"LastName":"Robert"}
+}
+
+test_sn_pattern {
+	output.sur_name == "LAST_NAME" with input as {"sur_name":"John"}
+}
+
+test_sn_pattern {
+	output.sur_name == "LAST_NAME" with input as {"sur_name":"Robert"}
+}
+
+test_sn_pattern {
+	output.surname == "LAST_NAME" with input as {"surname":"Robert"}
+}
+
+test_sn_pattern {
+	output.surName == "LAST_NAME" with input as {"surName":"Robert"}
+}
+
+test_sn_pattern {
+	output.Sur_Name == "LAST_NAME" with input as {"Sur_Name":"Robert"}
+}
+
+test_sn_pattern {
+	output.SurName == "LAST_NAME" with input as {"SurName":"Robert"}
+}
diff --git a/classification/rego/passport.rego b/classification/rego/passport.rego
new file mode 100644
index 0000000..c9df3cb
--- /dev/null
+++ b/classification/rego/passport.rego
@@ -0,0 +1,22 @@
+package classifier_passport
+
+import rego.v1
+
+output[k] := v if {
+	some k in object.keys(input)
+	v := classify(k, input[k])
+}
+
+default classify(_, _) := "UNLABELED"
+
+classify(key, _) := "PASSPORT" if {
+	contains(lower(key), "passport")
+}
+
+classify(_, val) := "PASSPORT" if {
+	regex.match(`^[A-PR-WYZ]{1,2}[1-9]\d\s?\d{4,6}[1-9]$`, val)
+}
+
+classify(_, val) := "PASSPORT" if {
+	regex.match(`^[1-9]\d\s?\d{4,6}[1-9][A-PR-WY]{1,2}$`, val)
+}
diff --git a/classification/rego/passport_test.rego b/classification/rego/passport_test.rego
new file mode 100644
index 0000000..44fc4b3
--- /dev/null
+++ b/classification/rego/passport_test.rego
@@ -0,0 +1,65 @@
+package classifier_passport
+
+test_passport_key {
+	output.passport == "PASSPORT" with input as {"passport":"not-a-passport-number"}
+}
+
+# United States
+test_passport_pattern {
+	output.message == "PASSPORT" with input as {"message":"A12345678"}
+}
+
+# Canada
+test_passport_pattern {
+	output.message == "PASSPORT" with input as {"message":"G12345678"}
+}
+
+# United Kingdom
+test_passport_pattern {
+	output.message == "PASSPORT" with input as {"message":"GH1234567"}
+}
+
+# Australia
+test_passport_pattern {
+	output.message == "PASSPORT" with input as {"message":"P12345678"}
+}
+
+# India
+test_passport_pattern {
+	output.message == "PASSPORT" with input as {"message":"P1234567"}
+}
+
+# Germany
+test_passport_pattern {
+	output.message == "PASSPORT" with input as {"message":"E12345678"}
+}
+
+# China
+test_passport_pattern {
+	output.message == "PASSPORT" with input as {"message":"E123456789"}
+}
+
+# Japan
+test_passport_pattern {
+	output.message == "PASSPORT" with input as {"message":"P1234567"}
+}
+
+# South Korea
+test_passport_pattern {
+	output.message == "PASSPORT" with input as {"message":"M12345678"}
+}
+
+# Brazil
+test_passport_pattern {
+	output.message == "PASSPORT" with input as {"message":"G12345678"}
+}
+
+# Mexico
+test_passport_pattern {
+	output.message == "PASSPORT" with input as {"message":"E12345678"}
+}
+
+# South Africa (diplomat, standard covered by other countries)
+test_passport_sa_pattern {
+	output.message == "PASSPORT" with input as {"message":"D123456789"}
+}
diff --git a/classification/rego/phone_number.rego b/classification/rego/phone_number.rego
new file mode 100644
index 0000000..fd29c8a
--- /dev/null
+++ b/classification/rego/phone_number.rego
@@ -0,0 +1,17 @@
+package classifier_phone_number
+
+import rego.v1
+
+output[k] := v if {
+	some k in object.keys(input)
+	v := classify(k, input[k])
+}
+
+default classify(_, _) := "UNLABELED"
+
+classify(key, val) := "PHONE" if {
+	regex.match(
+		`\A((1(-| )?((\([2-9]\d{2}\))|([2-9]\d{2})))|([2-9]\d{2})|(\([2-9]\d{2}\)))(-| )?[2-9]((1[02-9])|([02-9]\d))(-| )?\d{4}\z`,
+		val
+	)
+}
diff --git a/classification/rego/phone_number_test.rego b/classification/rego/phone_number_test.rego
new file mode 100644
index 0000000..73295ea
--- /dev/null
+++ b/classification/rego/phone_number_test.rego
@@ -0,0 +1,13 @@
+package classifier_phone_number
+
+test_no_label {
+    output.column == "UNLABELED" with input as {"column":"invalid"}
+}
+
+test_valid_us_phone {
+    output.message == "PHONE" with input as {"message":"7175551212"}
+}
+
+test_valid_us_phone {
+    output.message == "PHONE" with input as {"message":"17175551212"}
+}
diff --git a/classification/rego/ssn.rego b/classification/rego/ssn.rego
new file mode 100644
index 0000000..eb0ca9a
--- /dev/null
+++ b/classification/rego/ssn.rego
@@ -0,0 +1,24 @@
+package classifier_ssn
+
+import rego.v1
+
+output[k] := v if {
+	some k in object.keys(input)
+	v := classify(k, input[k])
+}
+
+default classify(_, _) := "UNLABELED"
+
+classify(key, val) := "SSN" if {
+	pattern := regex.find_n(`\b(\d{9}|\d{3}\-\d{2}\-\d{4})\b`, val, 1)
+	count(pattern) == 1
+	t_val := replace(pattern[0], "-", "")
+	f_check := substring(t_val, 0, 3)
+	f_check != "000"
+	f_check != "666"
+	to_number(f_check) < 900
+	m_check := substring(t_val, 3, 2)
+	m_check != "00"
+	e_check := substring(t_val, 5, 4)
+	e_check != "0000"
+}
diff --git a/classification/rego/ssn_test.rego b/classification/rego/ssn_test.rego
new file mode 100644
index 0000000..7f6a8d5
--- /dev/null
+++ b/classification/rego/ssn_test.rego
@@ -0,0 +1,73 @@
+package classifier_ssn
+
+test_no_label {
+    output.column == "UNLABELED" with input as {"column":"invalid"}
+}
+
+test_invalid_first_000 {
+    output.column == "UNLABELED" with input as {"column":"000123456"}
+}
+
+test_invalid_first_666 {
+    output.column == "UNLABELED" with input as {"column":"666123456"}
+}
+
+test_invalid_first_900s {
+    output.column == "UNLABELED" with input as {"column":"905123456"}
+}
+
+test_invalid_middle {
+    output.column == "UNLABELED" with input as {"column":"123006789"}
+}
+
+test_invalid_end {
+    output.column == "UNLABELED" with input as {"column":"123450000"}
+}
+
+test_ssn_on_valid_amex_ccn {
+    output.message == "UNLABELED" with input as {"message":"370136066365291"}
+}
+
+test_ssn_on_valid_amex_ccn {
+    output.message == "UNLABELED" with input as {"message":"370136066365291"}
+}
+
+test_ssn_on_valid_visa_ccn {
+    output.message == "UNLABELED" with input as {"message":"4613688275707134"}
+}
+
+test_ssn_on_valid_mastercard_format_1_ccn {
+    output.message == "UNLABELED" with input as {"message":"5423909386888564"}
+}
+
+test_ssn_on_valid_mastercard_format_2_ccn {
+    output.message == "UNLABELED" with input as {"message":"2701306282695666"}
+}
+
+test_ssn_on_valid_discover_ccn {
+    output.message == "UNLABELED" with input as {"message":"6536673682309236"}
+}
+
+test_valid_ssn_dashes {
+    output.message == "SSN" with input as {"message":"111-11-1111"}
+}
+
+test_valid_ssn_dashes_sequential {
+    output.message == "SSN" with input as {"message":"123-45-6789"}
+}
+
+test_valid_ssn_dashes_in_value {
+    output.message == "SSN" with input as {"message":"this has a ssn 111-11-1111 that is valid"}
+}
+
+test_valid_ssn_no_dashes {
+    output.message == "SSN" with input as {"message":"111111111"}
+}
+
+test_valid_ssn_no_dashes_sequential {
+    output.message == "SSN" with input as {"message":"123456789"}
+}
+
+test_valid_ssn_no_dashes_in_value {
+    output.message == "SSN" with input as {"message":"this has a ssn 111111111 that is valid"}
+}
diff --git a/classification/rego_classifier.go b/classification/rego_classifier.go
new file mode 100644
index 0000000..a215b33
--- /dev/null
+++ b/classification/rego_classifier.go
@@ -0,0 +1,126 @@
+package classification
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/open-policy-agent/opa/ast"
+	"github.com/open-policy-agent/opa/rego"
+
+	log "github.com/sirupsen/logrus"
+)
+
+const (
+	unlabeledLabel = "UNLABELED"
+)
+
+// TODO: godoc -ccampo 2024-03-26
+type LabelClassifier struct {
+	lbl           *Label
+	preparedQuery rego.PreparedEvalQuery
+}
+
+// *LabelClassifier implements Classifier
+var _ Classifier = (*LabelClassifier)(nil)
+
+// TODO: godoc -ccampo 2024-03-26
+func NewLabelClassifier(lbl *Label) (*LabelClassifier, error) {
+	if lbl == nil {
+		return nil, fmt.Errorf("label cannot be nil")
+	}
+	q, err := prepareClassifierCode(lbl.ClassificationRule)
+	if err != nil {
+		return nil, err
+	}
+	return &LabelClassifier{lbl: lbl, preparedQuery: q}, nil
+}
+
+// TODO: godoc -ccampo 2024-03-26
+func (c *LabelClassifier) Classify(
+	_ context.Context,
+	table *ClassifiedTable,
+	attrs map[string]any,
+) ([]Result, error) {
+	if c == nil || len(attrs) == 0 {
+		return nil, fmt.Errorf("invalid arguments")
+	}
+
+	results, err := c.preparedQuery.Eval(context.Background(), rego.EvalInput(attrs))
+	if err != nil {
+		return nil, fmt.Errorf(
+			"[classifier %s] error evaluating query for inputs %s; %w", c.lbl.Name, attrs, err,
+		)
+	}
+
+	log.Debugf("[classifier %s] results: '%s'", c.lbl.Name, results)
+	if len(results) != 1 || len(results[0].Expressions) != 1 {
+		return nil, fmt.Errorf(
+			"[classifier %s] received malformed result in classification eval - expected 1 result with 1 expression result, but found: '%s'",
+			c.lbl.Name,
+			results,
+		)
+	}
+
+	exprValue := results[0].Expressions[0]
+	if exprValue == nil {
+		return nil, fmt.Errorf("[classifier %s] did not expect nil value in expression value", c.lbl.Name)
+	}
+
+	mapVal := results[0].Expressions[0].Value
+	resolvedMap, ok := mapVal.(map[string]any)
+	if !ok {
+		return nil, fmt.Errorf(
+			"[classifier %s] expected type to be map[string]any, but found: %T", c.lbl.Name, mapVal,
+		)
+	}
+
+	// Count the number of classifications, ignoring unlabeled classifications.
+	resultLength := 0
+	for _, v := range resolvedMap {
+		if v != unlabeledLabel {
+			resultLength++
+		}
+	}
+
+	// If there are no classifications, return nil.
+	if resultLength == 0 {
+		return nil, nil
+	}
+
+	classifications := make([]Result, resultLength)
+	resultIndex := 0
+	for attrName, v := range resolvedMap {
+		valueAsString, ok := v.(string)
+		if !ok {
+			log.Errorf("value type expected to be string, was: %T", v)
+			continue
+		}
+		if valueAsString != unlabeledLabel {
+			classifications[resultIndex] = Result{
+				Table:           table,
+				AttributeName:   attrName,
+				Classifications: []*Label{c.lbl},
+			}
+			resultIndex++
+		}
+	}
+	return classifications, nil
+}
+
+func prepareClassifierCode(classifierCode string) (rego.PreparedEvalQuery, error) {
+	log.Tracef("classifier module code: '%s'", classifierCode)
+	moduleName := "classifier"
+	compiledRego, err := ast.CompileModules(map[string]string{moduleName: classifierCode})
+	if err != nil {
+		return rego.PreparedEvalQuery{}, fmt.Errorf("error compiling rego code: %w", err)
+	}
+	regoQuery := compiledRego.Modules[moduleName].Package.Path.String() + ".output"
+	retVal, err := rego.New(
+		rego.Query(regoQuery),
+		rego.Compiler(compiledRego),
+	).PrepareForEval(context.Background())
+	if err != nil {
+		return rego.PreparedEvalQuery{}, fmt.Errorf("error preparing rego code for evaluation: %w", err)
+	}
+	return retVal, nil
+}
diff --git a/classification/rego_classifier_test.go b/classification/rego_classifier_test.go
new file mode 100644
index 0000000..076fce5
--- /dev/null
+++ b/classification/rego_classifier_test.go
@@ -0,0 +1,457 @@
+package classification
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/cyralinc/dmap/discovery/repository"
+)
+
+const (
+	isDigitsRegex = "\\A\\d+\\z"
+	digitsLabel   = "DIGITS"
+	isARegex      = "\\A[Aa]\\z"
+	isALabel      = "ISA"
+	allCRegex     = "\\A[Cc]+\\z"
+	allCLabel     = "ALLC"
+)
+
+var fooTable = ClassifiedTable{
+	Repo:    "some_repo",
+	Catalog: "testdb",
+	Schema:  "testSchema",
+	Table:   "Foo",
+}
+
+var noCatalogFooTable = ClassifiedTable{
+	Repo:   "some_repo",
+	Schema: "testSchema",
+	Table:  "Foo",
+}
+
+func regexToClassifyCode(regex, label string) string {
+	return fmt.Sprintf(
+		"package classifier\noutput := \n"+
+			"{k: v |\n  v := classify(k, input[k])\n}\n"+
+			"classify(key, val) = \"%s\" {\n  re_match(`%s`, val)\n} "+
+			"else = \"UNLABELED\" {\n  true\n}",
+		label, regex,
+	)
+}
+
+func multiRegexClassify(regexes, labels []string) string {
+	return multiRegexClassifyWithPackage("classifier", regexes, labels)
+}
+
+func multiRegexClassifyWithPackage(pkg string, regexes, labels []string) string {
+	prefix := "package " + pkg + "\noutput := \n" +
+		"{k: v |\n v := classify(k, input[k])\n}\n" +
+		"classify(key, val) = "
+	middle := ""
+	for i, r := range regexes {
+		middle = fmt.Sprintf(
+			"%s\"%s\" {\n re_match(`%s`, val)\n} else = ",
+			middle, labels[i], r,
+		)
+	}
+	return fmt.Sprintf("%s%s \"UNLABELED\" {\n true\n}", prefix, middle)
+}
+
+type regoClassifyTestCase struct {
+	code            string
+	table           *ClassifiedTable
+	attributeNames  []string
+	attributeValues []string
+	expected        []Result
+}
+
+func TestRegoClassify(t *testing.T) {
+	tests := []struct {
+		name     string
+		code     string
+		table    *ClassifiedTable
+		attrs    map[string]any
+		expected []Result
+	}{
+		{
+			name: "multi regex classify",
+			code: multiRegexClassify(
+				[]string{isDigitsRegex, isARegex, allCRegex},
+				[]string{digitsLabel, isALabel, allCLabel},
+			),
+			table: &fooTable,
+			attrs: map[string]any{
+				"a": "fred",
+				"b": "A",
+				"c": "123",
+				"d": "bob",
+				"e": "0",
+				"f": "cCc",
+			},
+			expected: []Result{
+				{
+					Table:           &fooTable,
+					AttributeName:   "b",
+					Classifications: []*Label{{Name: isALabel}},
+				},
+				{
+					Table:           &fooTable,
+					AttributeName:   "c",
+					Classifications: []*Label{{Name: digitsLabel}},
+				},
+				{
+					Table:           &fooTable,
+					AttributeName:   "e",
+					Classifications: []*Label{{Name: digitsLabel}},
+				},
+				{
+					Table:           &fooTable,
+					AttributeName:   "f",
+					Classifications: []*Label{{Name: allCLabel}},
+				},
+			},
+		},
+		{
+			name: "multi regex classify with custom package",
+			code: multiRegexClassifyWithPackage(
+				"foo_bar",
+				[]string{isDigitsRegex, isARegex, allCRegex},
+				[]string{digitsLabel, isALabel, allCLabel},
+			),
+			table: &fooTable,
+			attrs: map[string]any{
+				"a": "fred",
+				"b": "A",
+				"c": "123",
+				"d": "bob",
+				"e": "0",
+				"f": "cCc",
+			},
+			expected: []Result{
+				{
+					Table:           &fooTable,
+					AttributeName:   "b",
+					Classifications: []*Label{{Name: isALabel}},
+				},
+				{
+					Table:           &fooTable,
+					AttributeName:   "c",
+					Classifications: []*Label{{Name: digitsLabel}},
+				},
+				{
+					Table:           &fooTable,
+					AttributeName:   "e",
+					Classifications: []*Label{{Name: digitsLabel}},
+				},
+				{
+					Table:           &fooTable,
+					AttributeName:   "f",
+					Classifications: []*Label{{Name: allCLabel}},
+				},
+			},
+		},
+		{
+			name:  "regex classifier",
+			code:  regexToClassifyCode(isDigitsRegex, digitsLabel),
+			table: &fooTable,
+			attrs: map[string]any{
+				"a": "123",
+				"b": "0",
+				"c": "fred",
+				"d": "a",
+				"e": "A",
+			},
+			expected: []Result{
+				{
+					Table:           &fooTable,
+					AttributeName:   "a",
+					Classifications: []*Label{{Name: digitsLabel}},
+				},
+				{
+					Table:           &fooTable,
+					AttributeName:   "b",
+					Classifications: []*Label{{Name: digitsLabel}},
+				},
+			},
+		},
+		{
+			name:  "regex classify - no catalog",
+			code:  regexToClassifyCode(isDigitsRegex, digitsLabel),
+			table: &noCatalogFooTable,
+			attrs: map[string]any{
+				"a": "123",
+				"b": "0",
+				"c": "fred",
+				"d": "a",
+				"e": "A",
+			},
+			expected: []Result{
+				{
+					Table:           &noCatalogFooTable,
+					AttributeName:   "a",
+					Classifications: []*Label{{Name: digitsLabel}},
+				},
+				{
+					Table:           &noCatalogFooTable,
+					AttributeName:   "b",
+					Classifications: []*Label{{Name: digitsLabel}},
+				},
+			},
+		},
+		{
+			name:  "regex classify - different attributes",
+			code:  regexToClassifyCode(isARegex, isALabel),
+			table: &fooTable,
+			attrs: map[string]any{
+				"a": "123",
+				"b": "0",
+				"c": "fred",
+				"d": "a",
+				"e": "A",
+			},
+			expected: []Result{
+				{
+					Table:           &fooTable,
+					AttributeName:   "d",
+					Classifications: []*Label{{Name: digitsLabel}},
+				},
+				{
+					Table:           &fooTable,
+					AttributeName:   "e",
+					Classifications: []*Label{{Name: digitsLabel}},
+				},
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(
+			tt.name, func(t *testing.T) {
+				classifier, err := NewLabelClassifier(&Label{Name: "dummy", ClassificationRule: tt.code})
+				if err != nil {
+					t.Errorf("Error creating classifier: %s", err.Error())
+				}
+				results, err := classifier.Classify(
+					context.Background(),
+					tt.table,
+					tt.attrs,
+				)
+				assert.NoError(t, err)
+				if len(results) != len(tt.expected) {
+					t.Errorf(
+						"Expected %d classification results, but found %d",
+						len(tt.expected), len(results),
+					)
+				}
+				for i, r := range results {
+					if tt.expected[i].Table.Repo != r.Table.Repo ||
+						tt.expected[i].Table.Catalog != r.Table.Catalog ||
+						tt.expected[i].Table.Schema != r.Table.Schema ||
+						tt.expected[i].Table.Table != r.Table.Table {
+						t.Errorf(
+							"Expected classification results[%d] tables to match. "+
+								"Found: '%+v', Expected: '%+v'",
+							i, *r.Table, *tt.expected[i].Table,
+						)
+					}
+					if tt.expected[i].AttributeName != r.AttributeName {
+						t.Errorf(
+							"Expected attribute names on classifiers[%d] to match. "+
+								"Found: %s, Expected: %s",
+							i, r.AttributeName, tt.expected[i].AttributeName,
+						)
+					}
+					if len(tt.expected[i].Classifications) != len(r.Classifications) {
+						t.Errorf(
+							"Expected length of classifications[%d] to match. "+
+								"Found: %d, Expected: %d",
+							i, len(tt.expected[i].Classifications), len(r.Classifications),
+						)
+					}
+					for j, cl := range r.Classifications {
+						if cl.Name != tt.expected[i].Classifications[j].Name {
+							t.Errorf(
+								"Expected classification[%d][%d] == '%s'; "+
+									"found: '%s'.",
+								i, j, tt.expected[i].Classifications[j].Name, cl.Name,
+							)
+						}
+					}
+				}
+			},
+		)
+	}
+}
+
+const (
+	repoName    = "repoName"
+	catalogName = "catalogName"
+	schemaName  = "schema"
+	tableName   = "table"
+)
+
+func Test_Classify_Rego_SingleSample(t *testing.T) {
+	sample := repository.Sample{
+		Metadata: repository.SampleMetadata{
+			Repo:     repoName,
+			Database: catalogName,
+			Schema:   schemaName,
+			Table:    tableName,
+		},
+		Results: []repository.SampleResult{
+			{
+				"age":             "52",
+				"social_sec_num":  "512-23-4256",
+				"credit_card_num": "4111111111111111",
+			},
+			{
+				"age":             "4111111111111111",
+				"social_sec_num":  "512-23-4258",
+				"credit_card_num": "4111111111111111",
+			},
+		},
+	}
+
+	classifier := testRegoClassifier(t)
+
+	actual, err := ClassifySamples(context.Background(), classifier, []repository.Sample{sample})
+	require.NoError(t, err)
+
+	table := &ClassifiedTable{
+		Repo:    repoName,
+		Catalog: catalogName,
+		Schema:  schemaName,
+		Table:   tableName,
+	}
+
+	expected := []Result{
+		{
+			Table:           table,
+			AttributeName:   "age",
+			Classifications: []*Label{{Name: "AGE"}, {Name: "CCN"}},
+		},
+		{
+			Table:           table,
+			AttributeName:   "credit_card_num",
+			Classifications: []*Label{{Name: "CCN"}},
+		},
+	}
+
+	assert.ElementsMatch(t, expected, actual)
+}
+
+func Test_Classify_Rego_MultipleSamples(t *testing.T) {
+	metadata1 := repository.SampleMetadata{
+		Repo:     repoName,
+		Database: catalogName,
+		Schema:   schemaName,
+		Table:    tableName,
+	}
+
+	metadata2 := repository.SampleMetadata{
+		Repo:     repoName,
+		Database: catalogName,
+		Schema:   schemaName + "2",
+		Table:    tableName + "2",
+	}
+
+	samples := []repository.Sample{
+		{
+			Metadata: metadata1,
+			Results: []repository.SampleResult{
+				{
+					"age":             "52",
+					"social_sec_num":  "512-23-4256",
+					"credit_card_num": "4111111111111111",
+				},
+			},
+		},
+		{
+			Metadata: metadata1,
+			Results: []repository.SampleResult{
+				{
+					"age":             "52",
+					"social_sec_num":  "512-23-4256",
+					"credit_card_num": "4111111111111112",
+				},
+			},
+		},
+		{
+			Metadata: metadata2,
+			Results: []repository.SampleResult{
+				{
+					"age":             "52",
+					"name":            "Joe Smith",
+					"social_sec_num":  "512-23-4256",
+					"credit_card_num": "4111111111111112",
+				},
+				{
+					"age":             "4111111111111113",
+					"name":            "Joe Smith",
+					"social_sec_num":  "512-23-4256",
+					"credit_card_num": "4111111111111112",
+				},
+			},
+		},
+	}
+
+	classifier := testRegoClassifier(t)
+
+	actual, err := ClassifySamples(context.Background(), classifier, samples)
+	require.NoError(t, err)
+
+	table1 := &ClassifiedTable{
+		Repo:    metadata1.Repo,
+		Catalog: metadata1.Database,
+		Schema:  metadata1.Schema,
+		Table:   metadata1.Table,
+	}
+
+	table2 := &ClassifiedTable{
+		Repo:    metadata2.Repo,
+		Catalog: metadata2.Database,
+		Schema:  metadata2.Schema,
+		Table:   metadata2.Table,
+	}
+
+	expected := []Result{
+		{
+			Table:           table1,
+			AttributeName:   "age",
+			Classifications: []*Label{{Name: "AGE"}},
+		},
+		{
+			Table:           table1,
+			AttributeName:   "credit_card_num",
+			Classifications: []*Label{{Name: "CCN"}},
+		},
+		{
+			Table:           table2,
+			AttributeName:   "age",
+			Classifications: []*Label{{Name: "AGE"}, {Name: "CCN"}},
+		},
+		{
+			Table:           table2,
+			AttributeName:   "credit_card_num",
+			Classifications: []*Label{{Name: "CCN"}},
+		},
+	}
+
+	assert.ElementsMatch(t, expected, actual)
+}
+
+func testRegoClassifier(t *testing.T) Classifier {
+	fin, err := os.ReadFile("./examples/example_policy_simple.rego")
+	require.NoError(t, err)
+
+	classifierCode := string(fin)
+
+	classifier, err := NewLabelClassifier(&Label{Name: "dummy", ClassificationRule: classifierCode})
+	require.NoError(t, err)
+
+	return classifier
+}
diff --git a/cmd/main.go b/cmd/main.go
new file mode 100644
index 0000000..f0444ef
--- /dev/null
+++ b/cmd/main.go
@@ -0,0 +1,75 @@
+package main
+
+import (
+	"fmt"
+
+	"github.com/alecthomas/kong"
+	log "github.com/sirupsen/logrus"
+)
+
+type Globals struct {
+	// TODO: add config file as global -ccampo 2024-03-22
+	LogLevel  logLevelFlag     `help:"Set the logging level (trace|debug|info|warn|error|fatal)" enum:"trace,debug,info,warn,error,fatal" default:"info"`
+	LogFormat logFormatFlag    `help:"Set the logging format (text|json)" enum:"text,json" default:"text"`
+	Version   kong.VersionFlag `name:"version" help:"Print version information and quit"`
+}
+
+type logLevelFlag string
+
+func (l logLevelFlag) AfterApply() error {
+	lvl, err := log.ParseLevel(string(l))
+	if err != nil {
+		return err
+	}
+	log.SetLevel(lvl)
+	return nil
+}
+
+type logFormatFlag string
+
+func (l logFormatFlag) AfterApply() error {
+	switch l {
+	case "json":
+		log.SetFormatter(&log.JSONFormatter{})
+		return nil
+	case "text":
+		log.SetFormatter(
+			&log.TextFormatter{
+				FullTimestamp:          true,
+				DisableLevelTruncation: true,
+				PadLevelText:           true,
+			},
+		)
+		return nil
+	default:
+		return fmt.Errorf("unsupported log format: %s", string(l))
+	}
+}
+
+type CLI struct {
+	Globals
+	RepoScan RepoScanCmd `cmd:"" help:"Perform data discovery and classification on a data repository."`
+}
+
+func main() {
+	cli := CLI{
+		Globals: Globals{},
+	}
+	ctx := kong.Parse(
+		&cli,
+		kong.Name("dmap"),
+		kong.Description("Assess your data security posture in AWS."),
+		kong.UsageOnError(),
+		kong.ConfigureHelp(
+			kong.HelpOptions{
+				Compact: true,
+			},
+		),
+		kong.Vars{
+			// TODO: get version from file -ccampo 2024-03-27
+			"version": "0.0.1",
+		},
+	)
+	err := ctx.Run(&cli.Globals)
+	ctx.FatalIfErrorf(err)
+}
diff --git a/cmd/repo_scan.go b/cmd/repo_scan.go
new file mode 100644
index 0000000..cbd88fe
--- /dev/null
+++ b/cmd/repo_scan.go
@@ -0,0 +1,18 @@
+package main
+
+import (
+	"context"
+
+	"github.com/cyralinc/dmap/discovery"
+	"github.com/cyralinc/dmap/discovery/config"
+)
+
+type RepoScanCmd struct {
+	config.Config
+}
+
+func (cmd *RepoScanCmd) Run(_ *Globals) error {
+	craw := discovery.NewScanner(&cmd.Config)
+	defer craw.Cleanup()
+	return craw.InitAndRun(context.Background())
+}
diff --git a/discovery/config/config.go b/discovery/config/config.go
new file mode 100644
index 0000000..7b1a052
--- /dev/null
+++ b/discovery/config/config.go
@@ -0,0 +1,59 @@
+package config
+
+import (
+	"fmt"
+	"reflect"
+	"strings"
+
+	"github.com/alecthomas/kong"
+	"github.com/gobwas/glob"
+)
+
+// TODO: godoc -ccampo 2024-03-27
+type Config struct {
+	Repo RepoConfig `embed:""`
+	Dmap DmapConfig `embed:""`
+}
+
+// TODO: godoc -ccampo 2024-03-27
+type RepoConfig struct {
+	Type         string         `help:"Type of repository to connect to (postgres|mysql|oracle|sqlserver|snowflake|redshift|denodo)." enum:"postgres,mysql,oracle,sqlserver,snowflake,redshift,denodo" required:""`
+	Host         string         `help:"Hostname of the repository." required:""`
+	Port         uint16         `help:"Port of the repository." required:""`
+	User         string         `help:"Username to connect to the repository." required:""`
+	Password     string         `help:"Password to connect to the repository." required:""`
+	Advanced     map[string]any `help:"Advanced configuration for the repository."`
+	Database     string         `help:"Name of the database to connect to. If not specified, the default database is used."`
+	MaxOpenConns uint           `help:"Maximum number of open connections to the repository." default:"10"`
+	SampleSize   uint           `help:"Number of rows to sample from the repository (per table)." default:"5"`
+	IncludePaths GlobFlag       `help:"List of glob patterns to include when querying the database(s), as a comma separated list." default:"*"`
+	ExcludePaths GlobFlag       `help:"List of glob patterns to exclude when querying the database(s), as a comma separated list." default:""`
+}
+
+// GlobFlag is a kong.MapperValue implementation that represents a glob pattern.
+type GlobFlag []glob.Glob
+
+// TODO: godoc -ccampo 2024-03-27
+func (g GlobFlag) Decode(ctx *kong.DecodeContext) error {
+	var patterns string
+	if err := ctx.Scan.PopValueInto("string", &patterns); err != nil {
+		return err
+	}
+	var parsedPatterns []glob.Glob
+	for _, pattern := range strings.Split(patterns, ",") {
+		parsedPattern, err := glob.Compile(pattern)
+		if err != nil {
+			return fmt.Errorf("cannot compile %s pattern: %w", pattern, err)
+		}
+		parsedPatterns = append(parsedPatterns, parsedPattern)
+	}
+	ctx.Value.Target.Set(reflect.ValueOf(GlobFlag(parsedPatterns)))
+	return nil
+}
+
+// TODO: godoc -ccampo 2024-03-27
+type DmapConfig struct {
+	ApiBaseUrl   string `help:"Base URL of the Dmap API." default:"https://api.dmap.cyral.io"`
+	ClientID     string `help:"API client ID to access the Dmap API."`
+	ClientSecret string `help:"API client secret to access the Dmap API."` //#nosec G101 -- false positive
+}
diff --git a/discovery/config/util.go b/discovery/config/util.go
new file mode 100644
index 0000000..9ce32bd
--- /dev/null
+++ b/discovery/config/util.go
@@ -0,0 +1,138 @@
+package config
+
+import (
+	"fmt"
+	"strings"
+)
+
+const (
+	configConnOpts = "connection-string-args"
+)
+
+// BuildConnOptsStr parses the repo config to produce a string in the format
+// "?option=value&option2=value2". Example:
+//
+//	BuildConnOptsStr(config.RepoConfig{
+//	    Advanced: map[string]any{
+//	        "connection-string-args": []any{"sslmode=disable"},
+//	    },
+//	})
+//
+// returns ("?sslmode=disable", nil).
+func BuildConnOptsStr(cfg RepoConfig) (string, error) {
+	connOptsMap, err := MapFromConnOpts(cfg)
+	if err != nil {
+		return "", fmt.Errorf("connection options: %w", err)
+	}
+
+	connOptsStr := ""
+	for key, val := range connOptsMap {
+		// Don't add if the value is empty, since that would make the
+		// string malformed.
+		if val != "" {
+			if connOptsStr == "" {
+				connOptsStr += fmt.Sprintf("%s=%s", key, val)
+			} else {
+				// Need & for subsequent options
+				connOptsStr += fmt.Sprintf("&%s=%s", key, val)
+			}
+		}
+	}
+	// Only add ? if connection string is not empty
+	if connOptsStr != "" {
+		connOptsStr = "?" + connOptsStr
+	}
+
+	return connOptsStr, nil
+}
+
+// MapFromConnOpts builds a map from the list of connection options given in the
+// config. Each option has the format 'option=value'. Err only if the config is
+// malformed, to inform user.
+func MapFromConnOpts(cfg RepoConfig) (map[string]string, error) {
+	m := make(map[string]string)
+	connOptsInterface, ok := cfg.Advanced[configConnOpts]
+	if !ok {
+		return nil, nil
+	}
+	connOpts, ok := connOptsInterface.([]any)
+	if !ok {
+		return nil, fmt.Errorf("'%s' is not a list", configConnOpts)
+	}
+	for _, optInterface := range connOpts {
+		opt, ok := optInterface.(string)
+		if !ok {
+			return nil, fmt.Errorf("'%v' is not a string", optInterface)
+		}
+		splitOpt := strings.Split(opt, "=")
+		if len(splitOpt) != 2 {
+			return nil, fmt.Errorf(
+				"malformed '%s'. "+
+					"Please follow the format 'option=value'", configConnOpts,
+			)
+		}
+		key := splitOpt[0]
+		val := splitOpt[1]
+		m[key] = val
+	}
+	return m, nil
+}
+
+// FetchAdvancedConfigString fetches a map in the repo advanced configuration,
+// for a given repo and set of parameters. Example:
+//
+// repo-advanced:
+//
+//	snowflake:
+//	  account: exampleAccount
+//	  role: exampleRole
+//	  warehouse: exampleWarehouse
+//
+// Calling FetchAdvancedMapConfig(<the repo config above>, "snowflake",
+// []string{"account", "role", "warehouse"}) returns the map
+//
+// {"account": "exampleAccount", "role": "exampleRole", "warehouse":
+// "exampleWarehouse"}
+//
+// The suffix 'String' means that the values of the map are strings. This gives
+// room to have FetchAdvancedConfigList or FetchAdvancedConfigMap, for example,
+// without name conflicts.
+func FetchAdvancedConfigString(
+	cfg RepoConfig,
+	repo string,
+	parameters []string,
+) (map[string]string, error) {
+	advancedCfg, err := getAdvancedConfig(cfg, repo)
+	if err != nil {
+		return nil, err
+	}
+	repoSpecificMap := make(map[string]string)
+	for _, key := range parameters {
+		var valInterface any
+		var val string
+		var ok bool
+		if valInterface, ok = advancedCfg[key]; !ok {
+			return nil, fmt.Errorf("unable to find '%s' in %s advanced config", key, repo)
+		}
+		if val, ok = valInterface.(string); !ok {
+			return nil, fmt.Errorf("'%s' in %s config must be a string", key, repo)
+		}
+		repoSpecificMap[key] = val
+	}
+	return repoSpecificMap, nil
+}
+
+// getAdvancedConfig gets the Advanced field in a repo config and converts it to
+// a map[string]any. In every step, it checks for error and generates
+// nice messages.
+func getAdvancedConfig(cfg RepoConfig, repo string) (map[string]any, error) {
+	advancedCfgInterface, ok := cfg.Advanced[repo]
+	if !ok {
+		return nil, fmt.Errorf("unable to find '%s' in advanced config", repo)
+	}
+	advancedCfg, ok := advancedCfgInterface.(map[string]any)
+	if !ok {
+		return nil, fmt.Errorf("'%s' in advanced config is not a map", repo)
+	}
+	return advancedCfg, nil
+}
diff --git a/discovery/config/util_test.go b/discovery/config/util_test.go
new file mode 100644
index 0000000..743c785
--- /dev/null
+++ b/discovery/config/util_test.go
@@ -0,0 +1,178 @@
+package config
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestUtil(t *testing.T) {
+	for scenario, fn := range map[string]func(
+		t *testing.T,
+	){
+		"build connection string succeeds":                            testBuildConnOptionsSucc,
+		"build connection string fails":                               testBuildConnOptionsFail,
+		"build map from correct connection options succeeds":          testMapConnOptionsSucc,
+		"build map from missing connection options does not err":      testMapConnOptionsMissing,
+		"build map from non-list connection options fails":            testMapConnOptionsMalformedMap,
+		"build map from malformed (non-'=') connection options fails": testMapConnOptionsMalformedColon,
+		"fetch correct advanced config succeeds":                      testAdvancedConfigSucc,
+		"fetch advanced config with missing parameter errs":           testAdvancedConfigMissing,
+		"fetch advanced config with malformed parameters errs":        testAdvancedConfigMalformed,
+	} {
+		t.Run(
+			scenario, func(t *testing.T) {
+				teardown := setupTest(t)
+				defer teardown()
+				fn(t)
+			},
+		)
+	}
+}
+
+func setupTest(t *testing.T) func() {
+	return func() {}
+}
+
+// Returns a correct repo config
+func getSampleRepoConfig() RepoConfig {
+	return RepoConfig{
+		Advanced: map[string]any{
+			configConnOpts: []any{"sslmode=disable"},
+		},
+	}
+}
+
+func testBuildConnOptionsSucc(t *testing.T) {
+	sampleRepoCfg := getSampleRepoConfig()
+	connOptsStr, err := BuildConnOptsStr(sampleRepoCfg)
+	require.NoError(t, err)
+	require.Equal(t, connOptsStr, "?sslmode=disable")
+}
+
+func testBuildConnOptionsFail(t *testing.T) {
+	invalidRepoCfg := RepoConfig{
+		Advanced: map[string]any{
+			// Invalid: map instead of string
+			configConnOpts: []any{
+				map[string]string{"sslmode": "disable"},
+			},
+		},
+	}
+	connOptsStr, err := BuildConnOptsStr(invalidRepoCfg)
+	require.Error(t, err)
+	require.Empty(t, connOptsStr)
+}
+
+func testMapConnOptionsSucc(t *testing.T) {
+	sampleRepoCfg := getSampleRepoConfig()
+	connOptsMap, err := MapFromConnOpts(sampleRepoCfg)
+	require.NoError(t, err)
+	require.EqualValues(
+		t, connOptsMap, map[string]string{
+			"sslmode": "disable",
+		},
+	)
+}
+
+// The mapping should only fail if the config is malformed, not if it is missing
+func testMapConnOptionsMissing(t *testing.T) {
+	sampleCfg := RepoConfig{}
+	optsMap, err := MapFromConnOpts(sampleCfg)
+	require.NoError(t, err)
+	require.Empty(t, optsMap)
+}
+
+func testMapConnOptionsMalformedMap(t *testing.T) {
+	sampleCfg := RepoConfig{
+		Advanced: map[string]any{
+			// Let's put a map instead of the required list
+			configConnOpts: map[string]any{
+				"testKey": "testValue",
+			},
+		},
+	}
+	_, err := MapFromConnOpts(sampleCfg)
+	require.Error(t, err)
+}
+
+func testMapConnOptionsMalformedColon(t *testing.T) {
+	sampleCfg := RepoConfig{
+		Advanced: map[string]any{
+			// Let's use a colon instead of '=' to divide options
+			configConnOpts: []string{"sslmode:disable"},
+		},
+	}
+	_, err := MapFromConnOpts(sampleCfg)
+	require.Error(t, err)
+}
+
+func testAdvancedConfigSucc(t *testing.T) {
+	sampleCfg := RepoConfig{
+		Advanced: map[string]any{
+			"snowflake": map[string]any{
+				"account":   "exampleAccount",
+				"role":      "exampleRole",
+				"warehouse": "exampleWarehouse",
+			},
+		},
+	}
+	repoSpecificMap, err := FetchAdvancedConfigString(
+		sampleCfg,
+		"snowflake", []string{"account", "role", "warehouse"},
+	)
+	require.NoError(t, err)
+	require.EqualValues(
+		t, repoSpecificMap, map[string]string{
+			"account":   "exampleAccount",
+			"role":      "exampleRole",
+			"warehouse": "exampleWarehouse",
+		},
+	)
+}
+
+func testAdvancedConfigMissing(t *testing.T) {
+	// Without the snowflake config at all
+	sampleCfg := RepoConfig{
+		Advanced: map[string]any{},
+	}
+	_, err := FetchAdvancedConfigString(
+		sampleCfg,
+		"snowflake", []string{"account", "role", "warehouse"},
+	)
+	require.Error(t, err)
+
+	sampleCfg = RepoConfig{
+		Advanced: map[string]any{
+			"snowflake": map[string]any{
+				// Missing account
+
+				"role":      "exampleRole",
+				"warehouse": "exampleWarehouse",
+			},
+		},
+	}
+	_, err = FetchAdvancedConfigString(
+		sampleCfg,
+		"snowflake", []string{"account", "role", "warehouse"},
+	)
+	require.Error(t, err)
+}
+
+func testAdvancedConfigMalformed(t *testing.T) {
+	sampleCfg := RepoConfig{
+		Advanced: map[string]any{
+			"snowflake": map[string]any{
+				// Let's give a _list_ of things
+				"account":   []string{"account1", "account2"},
+				"role":      []string{"role1", "role2"},
+				"warehouse": []string{"warehouse1", "warehouse2"},
+			},
+		},
+	}
+	_, err := FetchAdvancedConfigString(
+		sampleCfg,
+		"snowflake", []string{"account", "role", "warehouse"},
+	)
+	require.Error(t, err)
+}
diff --git a/discovery/repository/denodo/denodo.go b/discovery/repository/denodo/denodo.go
new file mode 100644
index 0000000..38ef30c
--- /dev/null
+++ b/discovery/repository/denodo/denodo.go
@@ -0,0 +1,114 @@
+package denodo
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"github.com/cyralinc/dmap/discovery/repository"
+	"github.com/cyralinc/dmap/discovery/repository/genericsql"
+	"github.com/cyralinc/dmap/discovery/repository/postgresql"
+
+	"github.com/cyralinc/dmap/discovery/config"
+
+	// Use PostgreSQL driver for Denodo
+	_ "github.com/lib/pq"
+)
+
+const (
+	RepoTypeDenodo = "denodo"
+
+	// IntrospectQuery is the SQL query used to introspect the database. For
+	// Denodo, the object hierarchy is (database > views). When querying
+	// Denodo, the database corresponds to a schema, and the view corresponds
+	// to a table (see SampleTable).
+	IntrospectQuery = "SELECT " +
+		"database_name AS table_schema, " +
+		"view_name AS table_name, " +
+		"column_name, " +
+		"column_type_name AS data_type " +
+		"FROM " +
+		"CATALOG_VDP_METADATA_VIEWS()"
+)
+
+type denodoRepository struct {
+	// The majority of the repository.Repository functionality is delegated to
+	// a generic SQL repository instance (genericSqlRepo).
+	genericSqlRepo *genericsql.GenericSqlRepository
+}
+
+// *denodoRepository implements repository.Repository
+var _ repository.Repository = (*denodoRepository)(nil)
+
+func NewDenodoRepository(_ context.Context, repoCfg config.RepoConfig) (repository.Repository, error) {
+	pgCfg, err := postgresql.ParseConfig(repoCfg)
+	if err != nil {
+		return nil, fmt.Errorf("unable to parse postgres config: %w", err)
+	}
+	if repoCfg.Database == "" {
+		return nil, errors.New("database name is mandatory for Denodo repositories")
+	}
+
+	connStr := fmt.Sprintf(
+		"postgresql://%s:%s@%s:%d/%s%s",
+		repoCfg.User,
+		repoCfg.Password,
+		repoCfg.Host,
+		repoCfg.Port,
+		repoCfg.Database,
+		pgCfg.ConnOptsStr,
+	)
+
+	sqlRepo, err := genericsql.NewGenericSqlRepository(
+		repoCfg.Host,
+		postgresql.RepoTypePostgres,
+		repoCfg.Database,
+		connStr,
+		repoCfg.MaxOpenConns,
+		repoCfg.IncludePaths,
+		repoCfg.ExcludePaths,
+	)
+	if err != nil {
+		return nil, fmt.Errorf("could not instantiate generic sql repository: %w", err)
+	}
+
+	return &denodoRepository{genericSqlRepo: sqlRepo}, nil
+}
+
+func (repo *denodoRepository) ListDatabases(_ context.Context) ([]string, error) {
+	return nil, errors.New("ListDatabases is not implemented for Denodo repositories")
+}
+
+func (repo *denodoRepository) Introspect(ctx context.Context) (*repository.Metadata, error) {
+	return repo.genericSqlRepo.IntrospectWithQuery(ctx, IntrospectQuery)
+}
+
+func (repo *denodoRepository) SampleTable(
+	ctx context.Context,
+	meta *repository.TableMetadata,
+	params repository.SampleParameters,
+) (repository.Sample, error) {
+	// Denodo uses double-quotes to quote identifiers
+	attrStr := meta.QuotedAttributeNamesString("\"")
+	// The postgres driver is currently unable to properly send the
+	// parameters of a prepared statement to Denodo. Therefore, instead of
+	// building a prepared statement, we populate the query string before
+	// sending it to the driver.
+	query := fmt.Sprintf(
+		"SELECT %s FROM %s.%s OFFSET %d ROWS LIMIT %d",
+		attrStr, meta.Schema, meta.Name, params.Offset, params.SampleSize,
+	)
+	return repo.genericSqlRepo.SampleTableWithQuery(ctx, meta, query)
+}
+
+func (repo *denodoRepository) Ping(ctx context.Context) error {
+	return repo.genericSqlRepo.Ping(ctx)
+}
+
+func (repo *denodoRepository) Close() error {
+	return repo.genericSqlRepo.Close()
+}
+
+func init() {
+	repository.Register(RepoTypeDenodo, NewDenodoRepository)
+}
diff --git a/discovery/repository/doc.go b/discovery/repository/doc.go
new file mode 100644
index 0000000..0b6a30b
--- /dev/null
+++ b/discovery/repository/doc.go
@@ -0,0 +1,15 @@
+// Package repository encapsulates the concept of a Dmap data repository, and
+// provides functionality to register multiple implementations of such
+// repositories. All supported repositories are represented as sub-packages of
+// the repository name, e.g. mysql, postgresql, etc.
+//
+// The key interface is Repository, which provides encapsulates functionality to
+// introspect and sample the underlying database it represents.
+//
+// Repository implementations should reside in their own sub-package of the
+// repository package. Each implementation should provide a constructor that
+// matches the signature of the RepoConstructor type, and pass it to Register
+// function as part of the repository package's init function. This will make
+// the repository implementation available to the NewRepository factory
+// function.
+package repository
diff --git a/discovery/repository/gen.go b/discovery/repository/gen.go
new file mode 100644
index 0000000..05ac883
--- /dev/null
+++ b/discovery/repository/gen.go
@@ -0,0 +1,5 @@
+package repository
+
+// Mock generation - see https://vektra.github.io/mockery/
+
+//go:generate mockery --inpackage --with-expecter --name=Repository --filename=mock_repository.go
diff --git a/discovery/repository/genericsql/genericsql.go b/discovery/repository/genericsql/genericsql.go
new file mode 100644
index 0000000..667f1cd
--- /dev/null
+++ b/discovery/repository/genericsql/genericsql.go
@@ -0,0 +1,303 @@
+// Package genericsql provides a generic implementation of SQL functionalities
+// that works for a subset of ANSI SQL compatible databases. Many
+// repository.Repository implementations may partially or fully delegate to this
+// implementation. In that respect, it acts somewhat as a base implementation
+// which can be used by SQL-compatible repositories.
+package genericsql
+
+import (
+	"context"
+	"database/sql"
+	"fmt"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/cyralinc/dmap/discovery/repository"
+
+	"github.com/gobwas/glob"
+)
+
+const (
+	IntrospectQuery = "SELECT " +
+		"table_schema, " +
+		"table_name, " +
+		"column_name, " +
+		"data_type " +
+		"FROM " +
+		"information_schema.columns " +
+		"WHERE " +
+		"table_schema NOT IN " +
+		"(" +
+		"'INFORMATION_SCHEMA', " +
+		"'information_schema', " +
+		"'mysql', " +
+		"'sys', " +
+		"'performance_schema', " +
+		"'pg_catalog'" +
+		")"
+	PingQuery           = "SELECT 1"
+	SampleQueryTemplate = "SELECT %s FROM %s.%s LIMIT ? OFFSET ?"
+)
+
+// GenericSqlRepository implements generic SQL functionalities that
+// works for a subset of ANSI SQL compatible databases and may be
+// useful for some repository.Repository implementations.
+type GenericSqlRepository struct {
+	repoName     string
+	repoType     string
+	database     string
+	db           *sql.DB
+	includePaths []glob.Glob
+	excludePaths []glob.Glob
+}
+
+// NewGenericSqlRepository is a constructor for the GenericSqlRepository type.
+// It establishes a database connection for a given repoType and returns a
+// pointer to a GenericSqlRepository instance.
+func NewGenericSqlRepository(
+	repoName, repoType, database, connStr string, maxOpenConns uint,
+	repoIncludePaths, repoExcludePaths []glob.Glob,
+) (
+	*GenericSqlRepository,
+	error,
+) {
+	db, err := getDbHandle(repoType, connStr, maxOpenConns)
+	if err != nil {
+		return nil, fmt.Errorf("error retrieving DB handle for repo type %s: %w", repoType, err)
+	}
+	return &GenericSqlRepository{
+		repoName:     repoName,
+		repoType:     repoType,
+		database:     database,
+		db:           db,
+		includePaths: repoIncludePaths,
+		excludePaths: repoExcludePaths,
+	}, nil
+}
+
+// NewGenericSqlRepositoryFromDB instantiate a new *GenericSqlRepository based
+// on a given db connection. This can be used by tests to mock the database.
+func NewGenericSqlRepositoryFromDB(
+	repoName, repoType, database string,
+	db *sql.DB,
+) *GenericSqlRepository {
+	return &GenericSqlRepository{
+		repoName: repoName,
+		repoType: repoType,
+		database: database,
+		db:       db,
+	}
+}
+
+// ListDatabasesWithQuery returns a list of the names of all databases on the
+// server, as determined by the given query. The query is expected to return
+// a row set containing a single column corresponding to the database name. If
+// the query returns more than one column, an error will be returned.
+func (repo *GenericSqlRepository) ListDatabasesWithQuery(
+	ctx context.Context,
+	query string,
+	params ...any,
+) ([]string, error) {
+	log.Tracef("Query: %s", query)
+	rows, err := repo.db.QueryContext(ctx, query, params...)
+	if err != nil {
+		return nil, fmt.Errorf("error querying databases: %w", err)
+	}
+	defer func() { _ = rows.Close() }()
+	var dbs []string
+	for rows.Next() {
+		var dbName string
+		if err := rows.Scan(&dbName); err != nil {
+			return nil, fmt.Errorf("error scanning database query result row: %w", err)
+		}
+		dbs = append(dbs, dbName)
+	}
+	// Something broke while iterating the row set
+	if err := rows.Err(); err != nil {
+		return nil, fmt.Errorf("error iterating database query rows: %w", err)
+	}
+	return dbs, nil
+}
+
+// Introspect calls IntrospectWithQuery with a default query string
+func (repo *GenericSqlRepository) Introspect(ctx context.Context) (*repository.Metadata, error) {
+	return repo.IntrospectWithQuery(ctx, IntrospectQuery)
+}
+
+/*
+IntrospectWithQuery executes a query against the information_schema table in the
+database which returns a four-column (all varchar) row set (of N rows, depending
+on the number of tables in the database) in the form:
+
+table_schema, table_name, column_name, data_type
+
+This row set represents all the columns of all the tables in the repository.
+The row set is then parsed into an instance of repository.Metadata and
+returned. Additionally, any errors which occur during the query execution or
+parsing process will be returned.
+*/
+func (repo *GenericSqlRepository) IntrospectWithQuery(
+	ctx context.Context,
+	query string,
+) (*repository.Metadata, error) {
+	log.Tracef("Query: %s", query)
+	rows, err := repo.db.QueryContext(ctx, query)
+	if err != nil {
+		return nil, err
+	}
+	defer func() { _ = rows.Close() }()
+
+	repoMeta, err := newMetadataFromQueryResult(
+		repo.repoType, repo.repoName,
+		repo.database, repo.includePaths, repo.excludePaths, rows,
+	)
+	if err != nil {
+		return nil, err
+	}
+	return repoMeta, nil
+}
+
+func (repo *GenericSqlRepository) SampleTable(
+	ctx context.Context,
+	meta *repository.TableMetadata,
+	params repository.SampleParameters,
+) (repository.Sample, error) {
+	// ANSI SQL uses double-quotes to quote identifiers
+	attrStr := meta.QuotedAttributeNamesString("\"")
+	query := fmt.Sprintf(SampleQueryTemplate, attrStr, meta.Schema, meta.Name)
+	return repo.SampleTableWithQuery(ctx, meta, query, params.SampleSize, params.Offset)
+}
+
+// SampleTableWithQuery calls SampleTable with a custom SQL query. Any
+// placeholder parameters in the query should be passed via params.
+func (repo *GenericSqlRepository) SampleTableWithQuery(
+	ctx context.Context,
+	meta *repository.TableMetadata,
+	query string,
+	params ...any,
+) (repository.Sample, error) {
+	log.Tracef("Query: %s", query)
+	rows, err := repo.db.QueryContext(ctx, query, params...)
+	if err != nil {
+		return repository.Sample{},
+			fmt.Errorf("error sampling %s.%s.%s: %w", repo.database, meta.Schema, meta.Name, err)
+	}
+	defer func() { _ = rows.Close() }()
+
+	sample := repository.Sample{
+		Metadata: repository.SampleMetadata{
+			Repo:     repo.repoName,
+			Database: repo.database,
+			Schema:   meta.Schema,
+			Table:    meta.Name,
+		},
+	}
+
+	for rows.Next() {
+		data, err := GetCurrentRowAsMap(rows)
+		if err != nil {
+			return repository.Sample{}, err
+		}
+		sample.Results = append(sample.Results, data)
+	}
+
+	// Something broke while iterating the row set
+	err = rows.Err()
+	if err != nil {
+		return repository.Sample{}, fmt.Errorf("error iterating sample data row set: %w", err)
+	}
+
+	return sample, nil
+}
+
+func (repo *GenericSqlRepository) Ping(ctx context.Context) error {
+	log.Tracef("Query: %s", PingQuery)
+	rows, err := repo.db.QueryContext(ctx, PingQuery)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = rows.Close() }()
+	return nil
+}
+
+// GetDb is a getter for the repository's sql.DB handle.
+func (repo *GenericSqlRepository) GetDb() *sql.DB {
+	return repo.db
+}
+
+func (repo *GenericSqlRepository) Close() error {
+	return repo.db.Close()
+}
+
+func getDbHandle(repoType, connStr string, maxOpenConns uint) (*sql.DB, error) {
+	db, err := sql.Open(repoType, connStr)
+	if err != nil {
+		return nil, err
+	}
+	db.SetMaxOpenConns(int(maxOpenConns))
+	return db, nil
+}
+
+// newMetadataFromQueryResult builds the repository metadata from the results
+// of a query to the INFORMATION_SCHEMA columns view.
+func newMetadataFromQueryResult(
+	repoType, repoName, db string,
+	includePaths, excludePaths []glob.Glob, rows *sql.Rows,
+) (
+	*repository.Metadata,
+	error,
+) {
+	repo := repository.NewMetadata(repoType, repoName, db)
+
+	for rows.Next() {
+		var attr repository.AttributeMetadata
+		err := rows.Scan(&attr.Schema, &attr.Table, &attr.Name, &attr.DataType)
+		if err != nil {
+			return nil, err
+		}
+
+		// skip tables that match excludePaths or does not match includePaths
+		log.Tracef("checking if %s.%s.%s matches excludePaths %s\n", db, attr.Schema, attr.Table, excludePaths)
+		if matchPathPatterns(db, attr.Schema, attr.Table, excludePaths) {
+			continue
+		}
+		log.Tracef("checking if %s.%s.%s matches includePaths: %s\n", db, attr.Schema, attr.Table, includePaths)
+		if !matchPathPatterns(db, attr.Schema, attr.Table, includePaths) {
+			continue
+		}
+
+		// SchemaMetadata exists - add a table if necessary
+		if schema, ok := repo.Schemas[attr.Schema]; ok {
+			// TableMetadata exists - just append the attribute
+			if table, ok := schema.Tables[attr.Table]; ok {
+				table.Attributes = append(table.Attributes, &attr)
+			} else { // First time seeing this table
+				table := repository.NewTableMetadata(attr.Schema, attr.Table)
+				table.Attributes = append(table.Attributes, &attr)
+				schema.Tables[attr.Table] = table
+			}
+		} else { // SchemaMetadata doesn't exist - create it
+			table := repository.NewTableMetadata(attr.Schema, attr.Table)
+			table.Attributes = append(table.Attributes, &attr)
+			schema := repository.NewSchemaMetadata(attr.Schema)
+			schema.Tables[attr.Table] = table
+			repo.Schemas[attr.Schema] = schema
+		}
+	}
+
+	// Something broke while iterating the row set
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+
+	return repo, nil
+}
+
+func matchPathPatterns(database, schema, table string, patterns []glob.Glob) bool {
+	for _, pattern := range patterns {
+		if pattern.Match(fmt.Sprintf("%s.%s.%s", database, schema, table)) {
+			return true
+		}
+	}
+	return false
+}
diff --git a/discovery/repository/genericsql/genericsql_test.go b/discovery/repository/genericsql/genericsql_test.go
new file mode 100644
index 0000000..0dd0219
--- /dev/null
+++ b/discovery/repository/genericsql/genericsql_test.go
@@ -0,0 +1,301 @@
+package genericsql
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	"github.com/DATA-DOG/go-sqlmock"
+	"github.com/gobwas/glob"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/cyralinc/dmap/discovery/repository"
+)
+
+func Test_Introspect_IsSuccessful(t *testing.T) {
+	db, mock, err := sqlmock.New()
+	require.NoError(t, err)
+	defer func() { _ = db.Close() }()
+
+	repoName := "testRepo"
+	repoType := "genericSql"
+	database := "exampleDb"
+
+	repo := GenericSqlRepository{
+		repoName:     repoName,
+		repoType:     repoType,
+		database:     database,
+		db:           db,
+		includePaths: []glob.Glob{glob.MustCompile("exampleDb.*")},
+	}
+
+	cols := []string{
+		"table_schema",
+		"table_name",
+		"column_name",
+		"data_type",
+	}
+
+	rows := sqlmock.NewRows(cols).
+		AddRow("schema1", "table1", "column1", "varchar").
+		AddRow("schema1", "table1", "column2", "decimal").
+		AddRow("schema1", "table2", "column1", "integer").
+		AddRow("schema2", "table1", "column1", "date")
+
+	mock.ExpectQuery("SELECT (.+) FROM information_schema.columns WHERE (.+)").
+		WillReturnRows(rows)
+
+	ctx := context.Background()
+
+	meta, err := repo.Introspect(ctx)
+
+	expectedMetadata := repository.Metadata{
+		Name:     repoName,
+		RepoType: repoType,
+		Database: database,
+		Schemas: map[string]*repository.SchemaMetadata{
+			"schema1": {
+				Name: "schema1",
+				Tables: map[string]*repository.TableMetadata{
+					"table1": {
+						Schema: "schema1",
+						Name:   "table1",
+						Attributes: []*repository.AttributeMetadata{
+							{
+								Schema:   "schema1",
+								Table:    "table1",
+								Name:     "column1",
+								DataType: "varchar",
+							},
+							{
+								Schema:   "schema1",
+								Table:    "table1",
+								Name:     "column2",
+								DataType: "decimal",
+							},
+						},
+					},
+					"table2": {
+						Schema: "schema1",
+						Name:   "table2",
+						Attributes: []*repository.AttributeMetadata{
+							{
+								Schema:   "schema1",
+								Table:    "table2",
+								Name:     "column1",
+								DataType: "integer",
+							},
+						},
+					},
+				},
+			},
+			"schema2": {
+				Name: "schema2",
+				Tables: map[string]*repository.TableMetadata{
+					"table1": {
+						Schema: "schema2",
+						Name:   "table1",
+						Attributes: []*repository.AttributeMetadata{
+							{
+								Schema:   "schema2",
+								Table:    "table1",
+								Name:     "column1",
+								DataType: "date",
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+
+	assert.NoError(t, err)
+	assert.EqualValues(t, &expectedMetadata, meta)
+}
+
+func Test_Introspect_QueryError(t *testing.T) {
+	db, mock, err := sqlmock.New()
+	require.NoError(t, err)
+	defer func() { _ = db.Close() }()
+
+	repoName := "testRepo"
+	repoType := "genericSql"
+	database := "exampleDb"
+
+	repo := GenericSqlRepository{
+		repoName: repoName,
+		repoType: repoType,
+		database: database,
+		db:       db,
+	}
+
+	expectedErr := errors.New("dummy error")
+
+	mock.ExpectQuery("SELECT (.+) FROM information_schema.columns WHERE (.+)").
+		WillReturnError(expectedErr)
+
+	ctx := context.Background()
+
+	meta, err := repo.Introspect(ctx)
+
+	assert.Nil(t, meta)
+	assert.EqualError(t, err, expectedErr.Error())
+}
+
+func Test_Introspect_RowError(t *testing.T) {
+	db, mock, err := sqlmock.New()
+	require.NoError(t, err)
+	defer func() { _ = db.Close() }()
+
+	repoName := "testRepo"
+	repoType := "genericSql"
+	database := "exampleDb"
+
+	repo := GenericSqlRepository{
+		repoName: repoName,
+		repoType: repoType,
+		database: database,
+		db:       db,
+	}
+
+	cols := []string{
+		"table_schema",
+		"table_name",
+		"column_name",
+		"data_type",
+	}
+
+	expectedErr := errors.New("dummy error")
+
+	rows := sqlmock.NewRows(cols).
+		AddRow("schema1", "table1", "column1", "varchar").
+		RowError(0, errors.New("dummy error"))
+
+	mock.ExpectQuery("SELECT (.+) FROM information_schema.columns WHERE (.+)").
+		WillReturnRows(rows)
+
+	ctx := context.Background()
+
+	meta, err := repo.Introspect(ctx)
+
+	assert.Nil(t, meta)
+	assert.EqualError(t, err, expectedErr.Error())
+}
+
+func Test_Introspect_Filtered(t *testing.T) {
+	db, mock, err := sqlmock.New()
+	require.NoError(t, err)
+	defer func() { _ = db.Close() }()
+
+	repoName := "testRepo"
+	repoType := "genericSql"
+	database := "exampleDb"
+
+	repo := GenericSqlRepository{
+		repoName: repoName,
+		repoType: repoType,
+		database: database,
+		db:       db,
+		includePaths: []glob.Glob{
+			glob.MustCompile("exampleDb.schema1.*"),
+			glob.MustCompile("exampleDb.*.table1"),
+		},
+		excludePaths: []glob.Glob{
+			glob.MustCompile("exampleDb.schema3.*"),
+		},
+	}
+
+	cols := []string{
+		"table_schema",
+		"table_name",
+		"column_name",
+		"data_type",
+	}
+
+	rows := sqlmock.NewRows(cols).
+		AddRow("schema1", "table1", "column1", "varchar").
+		AddRow("schema1", "table1", "column2", "decimal").
+		AddRow("schema1", "table2", "column1", "integer").
+		AddRow("schema2", "table1", "column1", "date").
+		AddRow("schema2", "table1", "column2", "decimal").
+		AddRow("schema2", "table2", "column1", "varchar").
+		AddRow("schema3", "table1", "column2", "decimal").
+		AddRow("schema3", "table2", "column1", "integer")
+
+	mock.ExpectQuery("SELECT (.+) FROM information_schema.columns WHERE (.+)").
+		WillReturnRows(rows)
+
+	ctx := context.Background()
+
+	meta, err := repo.Introspect(ctx)
+
+	expectedMetadata := repository.Metadata{
+		Name:     repoName,
+		RepoType: repoType,
+		Database: database,
+		Schemas: map[string]*repository.SchemaMetadata{
+			"schema1": {
+				Name: "schema1",
+				Tables: map[string]*repository.TableMetadata{
+					"table1": {
+						Schema: "schema1",
+						Name:   "table1",
+						Attributes: []*repository.AttributeMetadata{
+							{
+								Schema:   "schema1",
+								Table:    "table1",
+								Name:     "column1",
+								DataType: "varchar",
+							},
+							{
+								Schema:   "schema1",
+								Table:    "table1",
+								Name:     "column2",
+								DataType: "decimal",
+							},
+						},
+					},
+					"table2": {
+						Schema: "schema1",
+						Name:   "table2",
+						Attributes: []*repository.AttributeMetadata{
+							{
+								Schema:   "schema1",
+								Table:    "table2",
+								Name:     "column1",
+								DataType: "integer",
+							},
+						},
+					},
+				},
+			},
+			"schema2": {
+				Name: "schema2",
+				Tables: map[string]*repository.TableMetadata{
+					"table1": {
+						Schema: "schema2",
+						Name:   "table1",
+						Attributes: []*repository.AttributeMetadata{
+							{
+								Schema:   "schema2",
+								Table:    "table1",
+								Name:     "column1",
+								DataType: "date",
+							},
+							{
+								Schema:   "schema2",
+								Table:    "table1",
+								Name:     "column2",
+								DataType: "decimal",
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+
+	assert.NoError(t, err)
+	assert.EqualValues(t, &expectedMetadata, meta)
+}
diff --git a/discovery/repository/genericsql/util.go b/discovery/repository/genericsql/util.go
new file mode 100644
index 0000000..eac797e
--- /dev/null
+++ b/discovery/repository/genericsql/util.go
@@ -0,0 +1,35 @@
+package genericsql
+
+import (
+	"database/sql"
+)
+
+// GetCurrentRowAsMap transforms the current row referenced by a sql.Rows row
+// set into a map where the key is the column name and the value is the column
+// value. It is effectively an alternative to the sql.Rows.Scan method, where it
+// copies the value of the current row into a string/interface map. Note: just
+// like Scan, because this only operates on the current row pointed to by the
+// row set, this function does not iterate the row set forward. Therefore,
+// sql.Rows.Next must be called first to iterate the row set forward, and the
+// same error checking applies. The map returned represents the single,
+// current-most row pointed to by the row set iterator.
+func GetCurrentRowAsMap(rows *sql.Rows) (map[string]any, error) {
+	colNames, err := rows.Columns()
+	if err != nil {
+		return nil, err
+	}
+	row := make(map[string]any, len(colNames))
+	colValues := make([]any, len(colNames))
+	colValPointers := make([]any, len(colNames))
+	for i := range colValues {
+		colValPointers[i] = &colValues[i]
+	}
+	// Scans the row into the set of column-value pointers
+	if err := rows.Scan(colValPointers...); err != nil {
+		return nil, err
+	}
+	for i, colName := range colNames {
+		row[colName] = colValues[i]
+	}
+	return row, nil
+}
diff --git a/discovery/repository/metadata.go b/discovery/repository/metadata.go
new file mode 100644
index 0000000..87d783a
--- /dev/null
+++ b/discovery/repository/metadata.go
@@ -0,0 +1,81 @@
+package repository
+
+import (
+	"strings"
+)
+
+// Metadata represents the structure of a database repository catalog. The
+// traditional hierarchy is: Server (cluster) > Database > Schema (namespace) >
+// Table. Some database systems do not have the concept of a "database" (e.g.
+// MySQL). In those cases, the 'Database' field is expected to be an empty
+// string. See: https://stackoverflow.com/a/17943883
+type Metadata struct {
+	Name     string
+	RepoType string
+	Database string
+	Schemas  map[string]*SchemaMetadata
+}
+
+// TODO: godoc -ccampo 2024-03-27
+type SchemaMetadata struct {
+	Name   string
+	Tables map[string]*TableMetadata
+}
+
+// TODO: godoc -ccampo 2024-03-27
+type TableMetadata struct {
+	Schema     string
+	Name       string
+	Attributes []*AttributeMetadata
+}
+
+// TODO: godoc -ccampo 2024-03-27
+func (t *TableMetadata) AttributeNames() []string {
+	attrNames := make([]string, 0, len(t.Attributes))
+	for _, attr := range t.Attributes {
+		attrNames = append(attrNames, attr.Name)
+	}
+	return attrNames
+}
+
+// TODO: godoc -ccampo 2024-03-27
+func (t *TableMetadata) QuotedAttributeNamesString(quoteChar string) string {
+	sep := quoteChar + "," + quoteChar
+	commaSeparatedNames := strings.Join(t.AttributeNames(), sep)
+	return quoteChar + commaSeparatedNames + quoteChar
+}
+
+// TODO: godoc -ccampo 2024-03-27
+type AttributeMetadata struct {
+	Schema   string `field:"table_schema"`
+	Table    string `field:"table_name"`
+	Name     string `field:"column_name"`
+	DataType string `field:"data_type"`
+}
+
+// TODO: godoc -ccampo 2024-03-27
+func NewMetadata(repoType, repoName, database string) *Metadata {
+	return &Metadata{
+		Name:     repoName,
+		RepoType: repoType,
+		Database: database,
+		Schemas:  make(map[string]*SchemaMetadata),
+	}
+}
+
+// TODO: godoc -ccampo 2024-03-27
+func NewSchemaMetadata(schemaName string) *SchemaMetadata {
+	return &SchemaMetadata{
+		Name:   schemaName,
+		Tables: make(map[string]*TableMetadata),
+	}
+}
+
+// TODO: godoc -ccampo 2024-03-27
+func NewTableMetadata(schemaName, tableName string) *TableMetadata {
+	return &TableMetadata{
+		Schema:     schemaName,
+		Name:       tableName,
+		Attributes: []*AttributeMetadata{},
+	}
+}
diff --git a/discovery/repository/metadata_test.go b/discovery/repository/metadata_test.go
new file mode 100644
index 0000000..0bc011f
--- /dev/null
+++ b/discovery/repository/metadata_test.go
@@ -0,0 +1,71 @@
+package repository
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestAttributeNames(t *testing.T) {
+	table := TableMetadata{
+		Schema: "schema",
+		Name:   "table",
+		Attributes: []*AttributeMetadata{
+			{
+				Schema:   "schema",
+				Table:    "table",
+				Name:     "name1",
+				DataType: "varchar",
+			},
+			{
+				Schema:   "schema",
+				Table:    "table",
+				Name:     "name2",
+				DataType: "varchar",
+			},
+			{
+				Schema:   "schema",
+				Table:    "table",
+				Name:     "name3",
+				DataType: "varchar",
+			},
+		},
+	}
+
+	names := []string{"name1", "name2", "name3"}
+
+	assert.ElementsMatch(t, table.AttributeNames(), names)
+}
+
+func TestQuotedAttributeNamesString(t *testing.T) {
+	table := TableMetadata{
+		Schema: "schema",
+		Name:   "table",
+		Attributes: []*AttributeMetadata{
+			{
+				Schema:   "schema",
+				Table:    "table",
+				Name:     "name1",
+				DataType: "varchar",
+			},
+			{
+				Schema:   "schema",
+				Table:    "table",
+				Name:     "name2",
+				DataType: "varchar",
+			},
+			{
+				Schema:   "schema",
+				Table:    "table",
+				Name:     "name3",
+				DataType: "varchar",
+			},
+		},
+	}
+
+	quoteChar := "`"
+	expected := "`name1`,`name2`,`name3`"
+	namesStr := table.QuotedAttributeNamesString(quoteChar)
+
+	assert.Equal(t, expected, namesStr)
+}
diff --git a/discovery/repository/mock_repository.go b/discovery/repository/mock_repository.go
new file mode 100644
index 0000000..976daca
--- /dev/null
+++ b/discovery/repository/mock_repository.go
@@ -0,0 +1,342 @@
+// Code generated by mockery v2.40.1. DO NOT EDIT.
+
+package repository
+
+import (
+	context "context"
+
+	mock "github.com/stretchr/testify/mock"
+)
+
+// MockRepository is an autogenerated mock type for the Repository type
+type MockRepository struct {
+	mock.Mock
+}
+
+type MockRepository_Expecter struct {
+	mock *mock.Mock
+}
+
+func (_m *MockRepository) EXPECT() *MockRepository_Expecter {
+	return &MockRepository_Expecter{mock: &_m.Mock}
+}
+
+// Close provides a mock function with given fields:
+func (_m *MockRepository) Close() error {
+	ret := _m.Called()
+
+	if len(ret) == 0 {
+		panic("no return value specified for Close")
+	}
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func() error); ok {
+		r0 = rf()
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
+// MockRepository_Close_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Close'
+type MockRepository_Close_Call struct {
+	*mock.Call
+}
+
+// Close is a helper method to define mock.On call
+func (_e *MockRepository_Expecter) Close() *MockRepository_Close_Call {
+	return &MockRepository_Close_Call{Call: _e.mock.On("Close")}
+}
+
+func (_c *MockRepository_Close_Call) Run(run func()) *MockRepository_Close_Call {
+	_c.Call.Run(
+		func(args mock.Arguments) {
+			run()
+		},
+	)
+	return _c
+}
+
+func (_c *MockRepository_Close_Call) Return(_a0 error) *MockRepository_Close_Call {
+	_c.Call.Return(_a0)
+	return _c
+}
+
+func (_c *MockRepository_Close_Call) RunAndReturn(run func() error) *MockRepository_Close_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// Introspect provides a mock function with given fields: ctx
+func (_m *MockRepository) Introspect(ctx context.Context) (*Metadata, error) {
+	ret := _m.Called(ctx)
+
+	if len(ret) == 0 {
+		panic("no return value specified for Introspect")
+	}
+
+	var r0 *Metadata
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context) (*Metadata, error)); ok {
+		return rf(ctx)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context) *Metadata); ok {
+		r0 = rf(ctx)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*Metadata)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context) error); ok {
+		r1 = rf(ctx)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// MockRepository_Introspect_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Introspect'
+type MockRepository_Introspect_Call struct {
+	*mock.Call
+}
+
+// Introspect is a helper method to define mock.On call
+//   - ctx context.Context
+func (_e *MockRepository_Expecter) Introspect(ctx interface{}) *MockRepository_Introspect_Call {
+	return &MockRepository_Introspect_Call{Call: _e.mock.On("Introspect", ctx)}
+}
+
+func (_c *MockRepository_Introspect_Call) Run(run func(ctx context.Context)) *MockRepository_Introspect_Call {
+	_c.Call.Run(
+		func(args mock.Arguments) {
+			run(args[0].(context.Context))
+		},
+	)
+	return _c
+}
+
+func (_c *MockRepository_Introspect_Call) Return(_a0 *Metadata, _a1 error) *MockRepository_Introspect_Call {
+	_c.Call.Return(_a0, _a1)
+	return _c
+}
+
+func (_c *MockRepository_Introspect_Call) RunAndReturn(
+	run func(context.Context) (
+		*Metadata,
+		error,
+	),
+) *MockRepository_Introspect_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// ListDatabases provides a mock function with given fields: ctx
+func (_m *MockRepository) ListDatabases(ctx context.Context) ([]string, error) {
+	ret := _m.Called(ctx)
+
+	if len(ret) == 0 {
+		panic("no return value specified for ListDatabases")
+	}
+
+	var r0 []string
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context) ([]string, error)); ok {
+		return rf(ctx)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context) []string); ok {
+		r0 = rf(ctx)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).([]string)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context) error); ok {
+		r1 = rf(ctx)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// MockRepository_ListDatabases_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'ListDatabases'
+type MockRepository_ListDatabases_Call struct {
+	*mock.Call
+}
+
+// ListDatabases is a helper method to define mock.On call
+//   - ctx context.Context
+func (_e *MockRepository_Expecter) ListDatabases(ctx interface{}) *MockRepository_ListDatabases_Call {
+	return &MockRepository_ListDatabases_Call{Call: _e.mock.On("ListDatabases", ctx)}
+}
+
+func (_c *MockRepository_ListDatabases_Call) Run(run func(ctx context.Context)) *MockRepository_ListDatabases_Call {
+	_c.Call.Run(
+		func(args mock.Arguments) {
+			run(args[0].(context.Context))
+		},
+	)
+	return _c
+}
+
+func (_c *MockRepository_ListDatabases_Call) Return(_a0 []string, _a1 error) *MockRepository_ListDatabases_Call {
+	_c.Call.Return(_a0, _a1)
+	return _c
+}
+
+func (_c *MockRepository_ListDatabases_Call) RunAndReturn(
+	run func(context.Context) (
+		[]string,
+		error,
+	),
+) *MockRepository_ListDatabases_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// Ping provides a mock function with given fields: ctx
+func (_m *MockRepository) Ping(ctx context.Context) error {
+	ret := _m.Called(ctx)
+
+	if len(ret) == 0 {
+		panic("no return value specified for Ping")
+	}
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func(context.Context) error); ok {
+		r0 = rf(ctx)
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
+// MockRepository_Ping_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Ping'
+type MockRepository_Ping_Call struct {
+	*mock.Call
+}
+
+// Ping is a helper method to define mock.On call
+//   - ctx context.Context
+func (_e *MockRepository_Expecter) Ping(ctx interface{}) *MockRepository_Ping_Call {
+	return &MockRepository_Ping_Call{Call: _e.mock.On("Ping", ctx)}
+}
+
+func (_c *MockRepository_Ping_Call) Run(run func(ctx context.Context)) *MockRepository_Ping_Call {
+	_c.Call.Run(
+		func(args mock.Arguments) {
+			run(args[0].(context.Context))
+		},
+	)
+	return _c
+}
+
+func (_c *MockRepository_Ping_Call) Return(_a0 error) *MockRepository_Ping_Call {
+	_c.Call.Return(_a0)
+	return _c
+}
+
+func (_c *MockRepository_Ping_Call) RunAndReturn(run func(context.Context) error) *MockRepository_Ping_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// SampleTable provides a mock function with given fields: ctx, meta, params
+func (_m *MockRepository) SampleTable(ctx context.Context, meta *TableMetadata, params SampleParameters) (
+	Sample,
+	error,
+) {
+	ret := _m.Called(ctx, meta, params)
+
+	if len(ret) == 0 {
+		panic("no return value specified for SampleTable")
+	}
+
+	var r0 Sample
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, *TableMetadata, SampleParameters) (Sample, error)); ok {
+		return rf(ctx, meta, params)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, *TableMetadata, SampleParameters) Sample); ok {
+		r0 = rf(ctx, meta, params)
+	} else {
+		r0 = ret.Get(0).(Sample)
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, *TableMetadata, SampleParameters) error); ok {
+		r1 = rf(ctx, meta, params)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// MockRepository_SampleTable_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'SampleTable'
+type MockRepository_SampleTable_Call struct {
+	*mock.Call
+}
+
+// SampleTable is a helper method to define mock.On call
+//   - ctx context.Context
+//   - meta *TableMetadata
+//   - params SampleParameters
+func (_e *MockRepository_Expecter) SampleTable(
+	ctx interface{},
+	meta interface{},
+	params interface{},
+) *MockRepository_SampleTable_Call {
+	return &MockRepository_SampleTable_Call{Call: _e.mock.On("SampleTable", ctx, meta, params)}
+}
+
+func (_c *MockRepository_SampleTable_Call) Run(
+	run func(
+		ctx context.Context,
+		meta *TableMetadata,
+		params SampleParameters,
+	),
+) *MockRepository_SampleTable_Call {
+	_c.Call.Run(
+		func(args mock.Arguments) {
+			run(args[0].(context.Context), args[1].(*TableMetadata), args[2].(SampleParameters))
+		},
+	)
+	return _c
+}
+
+func (_c *MockRepository_SampleTable_Call) Return(_a0 Sample, _a1 error) *MockRepository_SampleTable_Call {
+	_c.Call.Return(_a0, _a1)
+	return _c
+}
+
+func (_c *MockRepository_SampleTable_Call) RunAndReturn(
+	run func(
+		context.Context,
+		*TableMetadata,
+		SampleParameters,
+	) (Sample, error),
+) *MockRepository_SampleTable_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// NewMockRepository creates a new instance of MockRepository. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
+// The first argument is typically a *testing.T value.
+func NewMockRepository(
+	t interface {
+		mock.TestingT
+		Cleanup(func())
+	},
+) *MockRepository {
+	mock := &MockRepository{}
+	mock.Mock.Test(t)
+
+	t.Cleanup(func() { mock.AssertExpectations(t) })
+
+	return mock
+}
diff --git a/discovery/repository/mysql/mysql.go b/discovery/repository/mysql/mysql.go
new file mode 100644
index 0000000..154217c
--- /dev/null
+++ b/discovery/repository/mysql/mysql.go
@@ -0,0 +1,97 @@
+package mysql
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/cyralinc/dmap/discovery/repository"
+	"github.com/cyralinc/dmap/discovery/repository/genericsql"
+
+	"github.com/cyralinc/dmap/discovery/config"
+
+	// MySQL DB driver
+	_ "github.com/go-sql-driver/mysql"
+)
+
+const (
+	RepoTypeMysql = "mysql"
+	DatabaseQuery = `
+SELECT 
+    schema_name
+FROM 
+    information_schema.schemata
+WHERE
+    schema_name <> 'information_schema'
+    AND schema_name <> 'performance_schema'
+    AND schema_name <> 'sys'
+`
+)
+
+type mySqlRepository struct {
+	// The majority of the repository.Repository functionality is delegated to
+	// a generic SQL repository instance (genericSqlRepo).
+	genericSqlRepo *genericsql.GenericSqlRepository
+}
+
+// *mySqlRepository implements repository.Repository
+var _ repository.Repository = (*mySqlRepository)(nil)
+
+func NewMySQLRepository(_ context.Context, cfg config.RepoConfig) (repository.Repository, error) {
+	connStr := fmt.Sprintf(
+		"%s:%s@tcp(%s:%d)/%s",
+		cfg.User,
+		cfg.Password,
+		cfg.Host,
+		cfg.Port,
+		// This can be an empty string. See:
+		// https://github.com/go-sql-driver/mysql#dsn-data-source-name
+		cfg.Database,
+	)
+
+	sqlRepo, err := genericsql.NewGenericSqlRepository(
+		cfg.Host,
+		RepoTypeMysql,
+		cfg.Database,
+		connStr,
+		cfg.MaxOpenConns,
+		cfg.IncludePaths,
+		cfg.ExcludePaths,
+	)
+	if err != nil {
+		return nil, fmt.Errorf("could not instantiate generic sql repository: %w", err)
+	}
+
+	return &mySqlRepository{genericSqlRepo: sqlRepo}, nil
+}
+
+func (repo *mySqlRepository) ListDatabases(ctx context.Context) ([]string, error) {
+	return repo.genericSqlRepo.ListDatabasesWithQuery(ctx, DatabaseQuery)
+}
+
+func (repo *mySqlRepository) Introspect(ctx context.Context) (*repository.Metadata, error) {
+	return repo.genericSqlRepo.Introspect(ctx)
+}
+
+func (repo *mySqlRepository) SampleTable(
+	ctx context.Context,
+	meta *repository.TableMetadata,
+	params repository.SampleParameters,
+) (repository.Sample, error) {
+	// MySQL uses backticks to quote identifiers
+	attrStr := meta.QuotedAttributeNamesString("`")
+	// The generic select/limit/offset query and ? placeholders work fine with MySQL
+	query := fmt.Sprintf(genericsql.SampleQueryTemplate, attrStr, meta.Schema, meta.Name)
+	return repo.genericSqlRepo.SampleTableWithQuery(ctx, meta, query, params.SampleSize, params.Offset)
+}
+
+func (repo *mySqlRepository) Ping(ctx context.Context) error {
+	return repo.genericSqlRepo.Ping(ctx)
+}
+
+func (repo *mySqlRepository) Close() error {
+	return repo.genericSqlRepo.Close()
+}
+
+func init() {
+	repository.Register(RepoTypeMysql, NewMySQLRepository)
+}
diff --git a/discovery/repository/mysql/mysql_test.go b/discovery/repository/mysql/mysql_test.go
new file mode 100644
index 0000000..1a1936a
--- /dev/null
+++ b/discovery/repository/mysql/mysql_test.go
@@ -0,0 +1,31 @@
+package mysql
+
+import (
+	"context"
+	"database/sql"
+	"testing"
+
+	"github.com/DATA-DOG/go-sqlmock"
+	"github.com/stretchr/testify/require"
+
+	"github.com/cyralinc/dmap/discovery/repository/genericsql"
+)
+
+func TestListDatabases(t *testing.T) {
+	ctx, db, mock, r := initRepoTest(t)
+	defer db.Close()
+	dbRows := sqlmock.NewRows([]string{"name"}).AddRow("db1").AddRow("db2")
+	mock.ExpectQuery(DatabaseQuery).WillReturnRows(dbRows)
+	dbs, err := r.ListDatabases(ctx)
+	require.NoError(t, err)
+	require.ElementsMatch(t, []string{"db1", "db2"}, dbs)
+}
+
+func initRepoTest(t *testing.T) (context.Context, *sql.DB, sqlmock.Sqlmock, *mySqlRepository) {
+	ctx := context.Background()
+	db, mock, err := sqlmock.New()
+	require.NoError(t, err)
+	return ctx, db, mock, &mySqlRepository{
+		genericSqlRepo: genericsql.NewGenericSqlRepositoryFromDB("repoName", RepoTypeMysql, "dbName", db),
+	}
+}
diff --git a/discovery/repository/oracle/config.go b/discovery/repository/oracle/config.go
new file mode 100644
index 0000000..d47839c
--- /dev/null
+++ b/discovery/repository/oracle/config.go
@@ -0,0 +1,27 @@
+package oracle
+
+import (
+	"github.com/cyralinc/dmap/discovery/config"
+)
+
+const (
+	configServiceName = "service-name"
+)
+
+type Config struct {
+	ServiceName string
+}
+
+func ParseConfig(cfg config.RepoConfig) (*Config, error) {
+	oracleCfg, err := config.FetchAdvancedConfigString(
+		cfg,
+		RepoTypeOracle,
+		[]string{configServiceName},
+	)
+	if err != nil {
+		return nil, err
+	}
+	return &Config{
+		ServiceName: oracleCfg[configServiceName],
+	}, nil
+}
diff --git a/discovery/repository/oracle/oracle.go b/discovery/repository/oracle/oracle.go
new file mode 100644
index 0000000..9e3044c
--- /dev/null
+++ b/discovery/repository/oracle/oracle.go
@@ -0,0 +1,125 @@
+package oracle
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"github.com/cyralinc/dmap/discovery/repository"
+	"github.com/cyralinc/dmap/discovery/repository/genericsql"
+
+	"github.com/cyralinc/dmap/discovery/config"
+
+	// Oracle DB driver
+	_ "github.com/sijms/go-ora/v2"
+)
+
+const (
+	RepoTypeOracle  = "oracle"
+	introspectQuery = `
+WITH users AS (
+  SELECT
+    username
+  FROM
+    sys.all_users
+  WHERE
+    oracle_maintained = 'N' AND
+    username <> 'RDSADMIN'
+)
+SELECT
+  owner AS table_schema,
+  table_name,
+  column_name,
+  data_type
+FROM
+  sys.all_tab_columns
+INNER JOIN
+  users
+ON
+  owner = users.username
+`
+)
+
+type oracleRepository struct {
+	// The majority of the repository.Repository functionality is delegated to
+	// a generic SQL repository instance (genericSqlRepo).
+	genericSqlRepo *genericsql.GenericSqlRepository
+}
+
+// *oracleRepository implements repository.Repository
+var _ repository.Repository = (*oracleRepository)(nil)
+
+func NewOracleRepository(_ context.Context, cfg config.RepoConfig) (repository.Repository, error) {
+	oracleCfg, err := ParseConfig(cfg)
+	if err != nil {
+		return nil, fmt.Errorf("unable to parse oracle config: %w", err)
+	}
+
+	connStr := fmt.Sprintf(
+		`oracle://%s:%s@%s:%d/%s`,
+		cfg.User,
+		cfg.Password,
+		cfg.Host,
+		cfg.Port,
+		oracleCfg.ServiceName,
+	)
+
+	sqlRepo, err := genericsql.NewGenericSqlRepository(
+		cfg.Host,
+		RepoTypeOracle,
+		cfg.Database,
+		connStr,
+		cfg.MaxOpenConns,
+		cfg.IncludePaths,
+		cfg.ExcludePaths,
+	)
+	if err != nil {
+		return nil, fmt.Errorf("could not instantiate generic sql repository: %w", err)
+	}
+
+	return &oracleRepository{genericSqlRepo: sqlRepo}, nil
+}
+
+// ListDatabases is left unimplemented for Oracle, because Oracle doesn't have
+// the traditional concept of "databases". Note that Introspect already
+// identifies all the accessible objects on the server.
+func (repo *oracleRepository) ListDatabases(_ context.Context) ([]string, error) {
+	return nil, errors.New("ListDatabases is not implemented for Oracle repos")
+}
+
+func (repo *oracleRepository) Introspect(ctx context.Context) (*repository.Metadata, error) {
+	return repo.genericSqlRepo.IntrospectWithQuery(ctx, introspectQuery)
+}
+
+func (repo *oracleRepository) SampleTable(
+	ctx context.Context,
+	meta *repository.TableMetadata,
+	params repository.SampleParameters,
+) (repository.Sample, error) {
+	// Oracle uses double-quotes to quote identifiers
+	attrStr := meta.QuotedAttributeNamesString("\"")
+	// Oracle uses :x for placeholders
+	query := fmt.Sprintf(
+		"SELECT %s FROM %s.%s OFFSET :1 ROWS FETCH NEXT :2 ROWS ONLY",
+		attrStr, meta.Schema, meta.Name,
+	)
+	return repo.genericSqlRepo.SampleTableWithQuery(ctx, meta, query, params.Offset, params.SampleSize)
+}
+
+// Ping verifies the connection to Oracle database used by this Repository.
+// Normally we would just delegate to the Ping method implemented by
+// genericsql.GenericSqlRepository. However, that implementation executes a
+// 'SELECT 1' query to test for connectivity, and Oracle being Oracle, does not
+// like this. So instead, we defer to the native Ping method implemented by the
+// Oracle sql.DB driver.
+func (repo *oracleRepository) Ping(ctx context.Context) error {
+	return repo.genericSqlRepo.GetDb().PingContext(ctx)
+}
+
+func (repo *oracleRepository) Close() error {
+	return repo.genericSqlRepo.Close()
+}
+
+func init() {
+	repository.Register(RepoTypeOracle, NewOracleRepository)
+}
diff --git a/discovery/repository/oracle/oracle_test.go b/discovery/repository/oracle/oracle_test.go
new file mode 100644
index 0000000..aaba6a4
--- /dev/null
+++ b/discovery/repository/oracle/oracle_test.go
@@ -0,0 +1,86 @@
+package oracle
+
+import (
+	"testing"
+
+	"github.com/DATA-DOG/go-sqlmock"
+	"github.com/stretchr/testify/require"
+	"github.com/stretchr/testify/suite"
+
+	"github.com/cyralinc/dmap/discovery/repository/genericsql"
+)
+
+// Query Alias
+const (
+	usernameAlias         = "USERNAME"
+	oracleMaintainedAlias = "ORACLE_MAINTAINED"
+	statusAlias           = "ACCOUNT_STATUS"
+	createdAtAlias        = "CREATED_AT"
+	lastUsedAtAlias       = "LAST_USED_AT"
+	roleAlias             = "ROLE"
+	isPredefinedAlias     = "IS_PREDEFINED"
+)
+
+type OracleTestSuite struct {
+	suite.Suite
+	repo                              oracleRepository
+	mock                              sqlmock.Sqlmock
+	databaseUserQuery                 string
+	databaseRolesForUserQueryTemplate string
+}
+
+func TestOracle(t *testing.T) {
+	s := new(OracleTestSuite)
+	suite.Run(t, s)
+}
+
+func (s *OracleTestSuite) SetupSuite() {
+	s.databaseUserQuery = `
+	SELECT 
+		users.username AS ` + usernameAlias + `,
+		users.oracle_maintained AS ` + oracleMaintainedAlias + `,
+		users.account_status AS ` + statusAlias + `,
+		users.created AS ` + createdAtAlias + `,
+		users.last_login AS ` + lastUsedAtAlias + `
+	FROM 
+		dba_users users
+	ORDER BY
+		users.username
+	ASC
+		`
+	s.databaseRolesForUserQueryTemplate = `
+	SELECT 
+		privs.granted_role AS ` + roleAlias + `,
+		roles.oracle_maintained AS ` + isPredefinedAlias + `
+	FROM 
+		dba_role_privs privs
+	LEFT JOIN
+		dba_roles roles
+	ON
+		privs.granted_role = roles.role
+	WHERE 
+		privs.grantee = '%s'
+	ORDER BY
+		privs.granted_role
+	ASC
+		`
+}
+
+func (s *OracleTestSuite) BeforeTest(suiteName, testName string) {
+	db, mock, err := sqlmock.New()
+	require.NoError(s.T(), err)
+
+	s.mock = mock
+	s.repo = oracleRepository{
+		genericSqlRepo: genericsql.NewGenericSqlRepositoryFromDB(
+			"oracle-repo",
+			"oracle-driver",
+			"oracle-db",
+			db,
+		),
+	}
+}
+
+func (s *OracleTestSuite) TearDownTest() {
+	s.repo.genericSqlRepo.GetDb().Close()
+}
diff --git a/discovery/repository/postgresql/config.go b/discovery/repository/postgresql/config.go
new file mode 100644
index 0000000..100be9a
--- /dev/null
+++ b/discovery/repository/postgresql/config.go
@@ -0,0 +1,22 @@
+package postgresql
+
+import (
+	"github.com/cyralinc/dmap/discovery/config"
+)
+
+type Config struct {
+	ConnOptsStr string
+}
+
+// ParseConfig produces a config structure with PostgreSQL-specific parameters
+// found in the repo config.
+func ParseConfig(cfg config.RepoConfig) (*Config, error) {
+	connOptsStr, err := config.BuildConnOptsStr(cfg)
+	if err != nil {
+		return nil, err
+	}
+
+	return &Config{
+		ConnOptsStr: connOptsStr,
+	}, nil
+}
diff --git a/discovery/repository/postgresql/postgresql.go b/discovery/repository/postgresql/postgresql.go
new file mode 100644
index 0000000..2477d73
--- /dev/null
+++ b/discovery/repository/postgresql/postgresql.go
@@ -0,0 +1,103 @@
+package postgresql
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/cyralinc/dmap/discovery/repository"
+	"github.com/cyralinc/dmap/discovery/repository/genericsql"
+
+	"github.com/cyralinc/dmap/discovery/config"
+	// Postgresql DB driver
+	_ "github.com/lib/pq"
+)
+
+const (
+	RepoTypePostgres = "postgres"
+
+	DatabaseQuery = `
+SELECT 
+	datname 
+FROM
+	pg_database
+WHERE
+	datistemplate = false
+	AND datallowconn = true
+	AND datname <> 'rdsadmin'
+`
+)
+
+type postgresqlRepository struct {
+	// The majority of the repository.Repository functionality is delegated to
+	// a generic SQL repository instance (genericSqlRepo).
+	genericSqlRepo *genericsql.GenericSqlRepository
+}
+
+// *postgresqlRepository implements repository.Repository
+var _ repository.Repository = (*postgresqlRepository)(nil)
+
+func NewPostgresqlRepository(_ context.Context, repoCfg config.RepoConfig) (repository.Repository, error) {
+	pgCfg, err := ParseConfig(repoCfg)
+	if err != nil {
+		return nil, fmt.Errorf("unable to parse postgresql config: %w", err)
+	}
+	database := repoCfg.Database
+	// Connect to the default database, if unspecified.
+	if database == "" {
+		database = "postgres"
+	}
+	connStr := fmt.Sprintf(
+		"postgresql://%s:%s@%s:%d/%s%s",
+		repoCfg.User,
+		repoCfg.Password,
+		repoCfg.Host,
+		repoCfg.Port,
+		database,
+		pgCfg.ConnOptsStr,
+	)
+	sqlRepo, err := genericsql.NewGenericSqlRepository(
+		repoCfg.Host,
+		RepoTypePostgres,
+		repoCfg.Database,
+		connStr,
+		repoCfg.MaxOpenConns,
+		repoCfg.IncludePaths,
+		repoCfg.ExcludePaths,
+	)
+	if err != nil {
+		return nil, fmt.Errorf("could not instantiate generic sql repository: %w", err)
+	}
+	return &postgresqlRepository{genericSqlRepo: sqlRepo}, nil
+}
+
+func (repo *postgresqlRepository) ListDatabases(ctx context.Context) ([]string, error) {
+	return repo.genericSqlRepo.ListDatabasesWithQuery(ctx, DatabaseQuery)
+}
+
+func (repo *postgresqlRepository) Introspect(ctx context.Context) (*repository.Metadata, error) {
+	return repo.genericSqlRepo.Introspect(ctx)
+}
+
+func (repo *postgresqlRepository) SampleTable(
+	ctx context.Context,
+	meta *repository.TableMetadata,
+	params repository.SampleParameters,
+) (repository.Sample, error) {
+	// PostgreSQL uses double-quotes to quote identifiers
+	attrStr := meta.QuotedAttributeNamesString("\"")
+	// PostgreSQL uses $x for placeholders
+	query := fmt.Sprintf("SELECT %s FROM %s.%s LIMIT $1 OFFSET $2", attrStr, meta.Schema, meta.Name)
+	return repo.genericSqlRepo.SampleTableWithQuery(ctx, meta, query, params.SampleSize, params.Offset)
+}
+
+func (repo *postgresqlRepository) Ping(ctx context.Context) error {
+	return repo.genericSqlRepo.Ping(ctx)
+}
+
+func (repo *postgresqlRepository) Close() error {
+	return repo.genericSqlRepo.Close()
+}
+
+func init() {
+	repository.Register(RepoTypePostgres, NewPostgresqlRepository)
+}
diff --git a/discovery/repository/postgresql/postgresql_test.go b/discovery/repository/postgresql/postgresql_test.go
new file mode 100644
index 0000000..dc568a8
--- /dev/null
+++ b/discovery/repository/postgresql/postgresql_test.go
@@ -0,0 +1,31 @@
+package postgresql
+
+import (
+	"context"
+	"database/sql"
+	"testing"
+
+	"github.com/DATA-DOG/go-sqlmock"
+	"github.com/stretchr/testify/require"
+
+	"github.com/cyralinc/dmap/discovery/repository/genericsql"
+)
+
+func TestListDatabases(t *testing.T) {
+	ctx, db, mock, r := initRepoTest(t)
+	defer db.Close()
+	dbRows := sqlmock.NewRows([]string{"name"}).AddRow("db1").AddRow("db2")
+	mock.ExpectQuery(DatabaseQuery).WillReturnRows(dbRows)
+	dbs, err := r.ListDatabases(ctx)
+	require.NoError(t, err)
+	require.ElementsMatch(t, []string{"db1", "db2"}, dbs)
+}
+
+func initRepoTest(t *testing.T) (context.Context, *sql.DB, sqlmock.Sqlmock, *postgresqlRepository) {
+	ctx := context.Background()
+	db, mock, err := sqlmock.New()
+	require.NoError(t, err)
+	return ctx, db, mock, &postgresqlRepository{
+		genericSqlRepo: genericsql.NewGenericSqlRepositoryFromDB("repoName", RepoTypePostgres, "dbName", db),
+	}
+}
diff --git a/discovery/repository/redshift/redshift.go b/discovery/repository/redshift/redshift.go
new file mode 100644
index 0000000..d43b3a5
--- /dev/null
+++ b/discovery/repository/redshift/redshift.go
@@ -0,0 +1,94 @@
+package redshift
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/cyralinc/dmap/discovery/config"
+	"github.com/cyralinc/dmap/discovery/repository"
+	"github.com/cyralinc/dmap/discovery/repository/genericsql"
+	"github.com/cyralinc/dmap/discovery/repository/postgresql"
+
+	// Use PostgreSQL DB driver for Redshift
+	_ "github.com/lib/pq"
+)
+
+const (
+	RepoTypeRedshift = "redshift"
+)
+
+type redshiftRepository struct {
+	// The majority of the repository.Repository functionality is delegated to
+	// a generic SQL repository instance (genericSqlRepo).
+	genericSqlRepo *genericsql.GenericSqlRepository
+}
+
+// *redshiftRepository implements repository.Repository
+var _ repository.Repository = (*redshiftRepository)(nil)
+
+func NewRedshiftRepository(_ context.Context, repoCfg config.RepoConfig) (repository.Repository, error) {
+	pgCfg, err := postgresql.ParseConfig(repoCfg)
+	if err != nil {
+		return nil, fmt.Errorf("unable to parse postgres config: %w", err)
+	}
+	database := repoCfg.Database
+	// Connect to the default database, if unspecified.
+	if database == "" {
+		database = "dev"
+	}
+	connStr := fmt.Sprintf(
+		"postgresql://%s:%s@%s:%d/%s%s",
+		repoCfg.User,
+		repoCfg.Password,
+		repoCfg.Host,
+		repoCfg.Port,
+		database,
+		pgCfg.ConnOptsStr,
+	)
+	sqlRepo, err := genericsql.NewGenericSqlRepository(
+		repoCfg.Host,
+		postgresql.RepoTypePostgres,
+		repoCfg.Database,
+		connStr,
+		repoCfg.MaxOpenConns,
+		repoCfg.IncludePaths,
+		repoCfg.ExcludePaths,
+	)
+	if err != nil {
+		return nil, fmt.Errorf("could not instantiate generic sql repository: %w", err)
+	}
+	return &redshiftRepository{genericSqlRepo: sqlRepo}, nil
+}
+
+func (repo *redshiftRepository) ListDatabases(ctx context.Context) ([]string, error) {
+	// Redshift and Postgres use the same query to list the server databases.
+	return repo.genericSqlRepo.ListDatabasesWithQuery(ctx, postgresql.DatabaseQuery)
+}
+
+func (repo *redshiftRepository) Introspect(ctx context.Context) (*repository.Metadata, error) {
+	return repo.genericSqlRepo.Introspect(ctx)
+}
+
+func (repo *redshiftRepository) SampleTable(
+	ctx context.Context,
+	meta *repository.TableMetadata,
+	params repository.SampleParameters,
+) (repository.Sample, error) {
+	// Redshift uses double-quotes to quote identifiers
+	attrStr := meta.QuotedAttributeNamesString("\"")
+	// Redshift uses $x for placeholders
+	query := fmt.Sprintf("SELECT %s FROM %s.%s LIMIT $1 OFFSET $2", attrStr, meta.Schema, meta.Name)
+	return repo.genericSqlRepo.SampleTableWithQuery(ctx, meta, query, params.SampleSize, params.Offset)
+}
+
+func (repo *redshiftRepository) Ping(ctx context.Context) error {
+	return repo.genericSqlRepo.Ping(ctx)
+}
+
+func (repo *redshiftRepository) Close() error {
+	return repo.genericSqlRepo.Close()
+}
+
+func init() {
+	repository.Register(RepoTypeRedshift, NewRedshiftRepository)
+}
diff --git a/discovery/repository/redshift/redshift_test.go b/discovery/repository/redshift/redshift_test.go
new file mode 100644
index 0000000..b768aa8
--- /dev/null
+++ b/discovery/repository/redshift/redshift_test.go
@@ -0,0 +1,32 @@
+package redshift
+
+import (
+	"context"
+	"database/sql"
+	"testing"
+
+	"github.com/DATA-DOG/go-sqlmock"
+	"github.com/stretchr/testify/require"
+
+	"github.com/cyralinc/dmap/discovery/repository/genericsql"
+	"github.com/cyralinc/dmap/discovery/repository/postgresql"
+)
+
+func TestListDatabases(t *testing.T) {
+	ctx, db, mock, r := initRepoTest(t)
+	defer db.Close()
+	dbRows := sqlmock.NewRows([]string{"name"}).AddRow("db1").AddRow("db2")
+	mock.ExpectQuery(postgresql.DatabaseQuery).WillReturnRows(dbRows)
+	dbs, err := r.ListDatabases(ctx)
+	require.NoError(t, err)
+	require.ElementsMatch(t, []string{"db1", "db2"}, dbs)
+}
+
+func initRepoTest(t *testing.T) (context.Context, *sql.DB, sqlmock.Sqlmock, *redshiftRepository) {
+	ctx := context.Background()
+	db, mock, err := sqlmock.New()
+	require.NoError(t, err)
+	return ctx, db, mock, &redshiftRepository{
+		genericSqlRepo: genericsql.NewGenericSqlRepositoryFromDB("repoName", RepoTypeRedshift, "dbName", db),
+	}
+}
diff --git a/discovery/repository/repository.go b/discovery/repository/repository.go
new file mode 100644
index 0000000..1a0bbfd
--- /dev/null
+++ b/discovery/repository/repository.go
@@ -0,0 +1,237 @@
+package repository
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"sync"
+
+	"github.com/hashicorp/go-multierror"
+	"golang.org/x/sync/semaphore"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/cyralinc/dmap/discovery/config"
+)
+
+// Repository represents a Dmap data repository, and provides functionality to
+// introspect its corresponding schema.
+type Repository interface {
+	// ListDatabases returns a list of the names of all databases on the server.
+	ListDatabases(ctx context.Context) ([]string, error)
+
+	// Introspect will read and analyze the basic properties of the repository
+	// and return as a Metadata instance. This includes all the repository's
+	// databases, schemas, tables, columns, and attributes.
+	Introspect(ctx context.Context) (*Metadata, error)
+
+	// SampleTable samples the table referenced by the TableMetadata meta
+	// parameter and returns the sample as a slice of Sample. The parameters for
+	// the sample, such as sample size, are passed via the params parameter (see
+	// SampleParameters for more details). The returned sample result set
+	// contains one Sample for each table row sampled. The length of the results
+	// will be less than or equal to the sample size. If there are fewer results
+	// than the specified sample size, it is because the table in question had a
+	// row count less than the sample size. Prefer small sample sizes to limit
+	// impact on the database.
+	SampleTable(ctx context.Context, meta *TableMetadata, params SampleParameters) (Sample, error)
+
+	// Ping is meant to be used as a general purpose connectivity test. It
+	// should be invoked e.g. in the dry-run mode.
+	Ping(ctx context.Context) error
+
+	// Close is meant to be used as a general purpose cleanup. It should be
+	// invoked when the Repository is no longer used.
+	Close() error
+}
+
+// RepoConstructor represents the function signature that all repository
+// implementations should use for their constructor functions.
+type RepoConstructor func(ctx context.Context, cfg config.RepoConfig) (Repository, error)
+
+var registry = make(map[string]RepoConstructor)
+
+// Register makes a repository available by the provided repository type (repoType).
+// If Register is called twice with the same repoType, or if constructor is nil, it
+// panics. Note that Register is not thread-safe. It is expected to be called from
+// either a package's init function, or from the program's main function.
+func Register(repoType string, constructor RepoConstructor) {
+	if constructor == nil {
+		panic("attempt to register nil constructor for repoType " + repoType)
+	}
+
+	if _, dup := registry[repoType]; dup {
+		panic("register called twice for repoType " + repoType)
+	}
+
+	registry[repoType] = constructor
+}
+
+// NewRepository is a factory function to return a concrete Repository implementation
+// based on the specified type, e.g. MySQL, PostgreSQL, MSSQL, etc.
+func NewRepository(ctx context.Context, cfg config.RepoConfig) (Repository, error) {
+	constructor, ok := registry[cfg.Type]
+	if !ok {
+		return nil, errors.New("unsupported repo type " + cfg.Type)
+	}
+
+	repo, err := constructor(ctx, cfg)
+	if err != nil {
+		return nil, fmt.Errorf("error creating repository, %w", err)
+	}
+
+	return repo, nil
+}
+
+// sampleAndErr is a "pair" type intended to be passed to a channel (see
+// SampleRepository)
+type sampleAndErr struct {
+	sample Sample
+	err    error
+}
+
+// samplesAndErr is a "pair" type intended to be passed to a channel (see
+// SampleAllDatabases)
+type samplesAndErr struct {
+	samples []Sample
+	err     error
+}
+
+// SampleRepository is a helper function which will sample every table in a
+// given repository and return them as a collection of Sample. First the
+// repository is introspected by calling Repository.Introspect to return the
+// repository metadata (Metadata). Then, for each schema and table in the
+// metadata, it calls Repository.SampleTable in a new goroutine. Once all the
+// sampling goroutines are finished, their results are collected and returned
+// as a slice of Sample.
+func SampleRepository(ctx context.Context, repo Repository, params SampleParameters) (
+	[]Sample,
+	error,
+) {
+	meta, err := repo.Introspect(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("error introspecting repository: %w", err)
+	}
+
+	// Fan out sample executions
+	out := make(chan sampleAndErr)
+	numTables := 0
+	for _, schemaMeta := range meta.Schemas {
+		for _, tableMeta := range schemaMeta.Tables {
+			numTables++
+			go func(meta *TableMetadata, params SampleParameters) {
+				sample, err := repo.SampleTable(ctx, meta, params)
+				out <- sampleAndErr{sample: sample, err: err}
+			}(tableMeta, params)
+		}
+	}
+
+	var samples []Sample
+	var errs error
+	for i := 0; i < numTables; i++ {
+		res := <-out
+		if res.err != nil {
+			errs = multierror.Append(errs, res.err)
+		} else {
+			samples = append(samples, res.sample)
+		}
+	}
+	close(out)
+
+	if errs != nil {
+		return samples, fmt.Errorf("error(s) while sampling repository: %w", errs)
+	}
+
+	return samples, nil
+}
+
+// SampleAllDatabases uses the given repository to list all the databases on the
+// server, and samples each one in parallel by calling SampleRepository for each
+// database. The repository is intended to be configured to connect to the
+// default database on the server, or at least some database which can be used
+// to enumerate the full set of databases on the server. An error will be
+// returned if the set of databases cannot be listed. If there is an error
+// connecting to or sampling a database, the error will be logged and no samples
+// will be returned for that database. Therefore, the returned slice of samples
+// contains samples for only the databases which could be discovered and
+// successfully sampled, and could potentially be empty if no databases were
+// sampled.
+func SampleAllDatabases(
+	ctx context.Context,
+	repo Repository,
+	repoCfg config.RepoConfig,
+	sampleParams SampleParameters,
+) (
+	[]Sample,
+	error,
+) {
+	// We assume that this repository will be connected to the default database
+	// (or at least some database that can discover all the other databases),
+	// and we use that to discover all other databases.
+	dbs, err := repo.ListDatabases(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("error listing databases: %w", err)
+	}
+
+	// Sample each database on a separate goroutine, and send the samples
+	// to the 'out' channel. Each slice of samples will be aggregated below
+	// on the main goroutine and returned.
+	var wg sync.WaitGroup
+	out := make(chan samplesAndErr)
+	wg.Add(len(dbs))
+	// Ensures that we avoid opening more than the specified number of
+	// connections.
+	var sema *semaphore.Weighted
+	if repoCfg.MaxOpenConns > 0 {
+		sema = semaphore.NewWeighted(int64(repoCfg.MaxOpenConns))
+	}
+	for _, db := range dbs {
+		go func(db string, cfg config.RepoConfig) {
+			defer wg.Done()
+			if sema != nil {
+				_ = sema.Acquire(ctx, 1)
+				defer sema.Release(1)
+			}
+			cfg.Database = db
+			// Create a repository instance for this database. It will be used
+			// to connect and sample the database.
+			repo, err := NewRepository(ctx, cfg)
+			if err != nil {
+				log.Errorf("error creating repository instance for database %s: %v", db, err)
+				return
+			}
+			// Close this repository and free up unused resources since we don't
+			// need it any longer.
+			defer func() { _ = repo.Close() }()
+			s, err := SampleRepository(ctx, repo, sampleParams)
+			if err != nil && len(s) == 0 {
+				log.Errorf("error gathering repository data samples for database %s: %v", db, err)
+				return
+			}
+			// Send the samples for this database to the 'out' channel. The
+			// samples for each database will be aggregated into a single slice
+			// on the main goroutine and returned.
+			out <- samplesAndErr{samples: s, err: err}
+		}(db, repoCfg)
+	}
+
+	// Start a goroutine to close the 'out' channel once all the goroutines
+	// we launched above are done. This will allow the aggregation range loop
+	// below to terminate properly. Note that this must start after the wg.Add
+	// call. See https://go.dev/blog/pipelines ("Fan-out, fan-in" section).
+	go func() {
+		wg.Wait()
+		close(out)
+	}()
+
+	// Aggregate and return the results.
+	var ret []Sample
+	var errs error
+	for res := range out {
+		ret = append(ret, res.samples...)
+		if res.err != nil {
+			errs = multierror.Append(errs, res.err)
+		}
+	}
+	return ret, errs
+}
diff --git a/discovery/repository/repository_test.go b/discovery/repository/repository_test.go
new file mode 100644
index 0000000..4b25138
--- /dev/null
+++ b/discovery/repository/repository_test.go
@@ -0,0 +1,134 @@
+package repository
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/cyralinc/dmap/discovery/config"
+)
+
+func TestRegister_Successful(t *testing.T) {
+	require.Empty(t, registry)
+
+	repoType := "repoType"
+	constructor := func(context.Context, config.RepoConfig) (Repository, error) {
+		return nil, nil
+	}
+
+	Register(repoType, constructor)
+	assert.Contains(t, registry, repoType)
+
+	t.Cleanup(func() { delete(registry, repoType) })
+}
+
+func TestRegister_NilConstructor(t *testing.T) {
+	require.Empty(t, registry)
+	assert.Panics(t, func() { Register("repoType", nil) })
+	assert.Empty(t, registry)
+}
+
+func TestRegister_TwoCalls_Panics(t *testing.T) {
+	require.Empty(t, registry)
+
+	repoType := "repoType"
+	constructor := func(context.Context, config.RepoConfig) (Repository, error) {
+		return nil, nil
+	}
+
+	Register(repoType, constructor)
+	assert.Contains(t, registry, repoType)
+
+	assert.Panics(t, func() { Register(repoType, constructor) })
+
+	t.Cleanup(func() { delete(registry, repoType) })
+}
+
+func TestNewRepository_IsSuccessful(t *testing.T) {
+	require.Empty(t, registry)
+
+	repoType := "repoType"
+
+	called := false
+	expectedRepo := dummyRepo{}
+	constructor := func(context.Context, config.RepoConfig) (Repository, error) {
+		called = true
+		return expectedRepo, nil
+	}
+
+	Register(repoType, constructor)
+	assert.Contains(t, registry, repoType)
+
+	cfg := config.RepoConfig{Type: repoType}
+	repo, err := NewRepository(context.Background(), cfg)
+	assert.NoError(t, err)
+	assert.Equal(t, expectedRepo, repo)
+	assert.True(t, called, "Constructor was not called")
+
+	t.Cleanup(func() { delete(registry, repoType) })
+}
+
+func TestNewRepository_ConstructorError(t *testing.T) {
+	require.Empty(t, registry)
+
+	repoType := "repoType"
+
+	called := false
+	expectedErr := errors.New("dummy error")
+	constructor := func(context.Context, config.RepoConfig) (Repository, error) {
+		called = true
+		return nil, expectedErr
+	}
+
+	Register(repoType, constructor)
+	assert.Contains(t, registry, repoType)
+
+	cfg := config.RepoConfig{Type: repoType}
+	repo, err := NewRepository(context.Background(), cfg)
+	assert.ErrorIs(t, err, expectedErr)
+	assert.Nil(t, repo)
+	assert.True(t, called, "Constructor was not called")
+
+	t.Cleanup(func() { delete(registry, repoType) })
+}
+
+func TestNewRepository_UnsupportedRepoType(t *testing.T) {
+	require.Empty(t, registry)
+
+	repoType := "repoType"
+
+	cfg := config.RepoConfig{Type: repoType}
+	repo, err := NewRepository(context.Background(), cfg)
+	assert.Error(t, err)
+	assert.Nil(t, repo)
+
+	t.Cleanup(func() { delete(registry, repoType) })
+}
+
+type dummyRepo struct{}
+
+func (d dummyRepo) SampleTable(context.Context, *TableMetadata, SampleParameters) (
+	Sample,
+	error,
+) {
+	panic("not implemented")
+}
+
+func (d dummyRepo) ListDatabases(context.Context) ([]string, error) {
+	panic("not implemented")
+}
+
+func (d dummyRepo) Introspect(context.Context) (*Metadata, error) {
+	panic("not implemented")
+}
+
+func (d dummyRepo) Ping(context.Context) error {
+	panic("not implemented")
+}
+
+func (d dummyRepo) Close() error {
+	panic("not implemented")
+}
diff --git a/discovery/repository/sample_all_databases_test.go b/discovery/repository/sample_all_databases_test.go
new file mode 100644
index 0000000..2dc6b56
--- /dev/null
+++ b/discovery/repository/sample_all_databases_test.go
@@ -0,0 +1,228 @@
+package repository
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	"github.com/stretchr/testify/mock"
+	"github.com/stretchr/testify/require"
+
+	"github.com/cyralinc/dmap/discovery/config"
+)
+
+const mockRepoType = "mockRepo"
+
+func setup() *MockRepository {
+	repo := new(MockRepository)
+	Register(
+		mockRepoType,
+		func(ctx context.Context, cfg config.RepoConfig) (Repository, error) {
+			return repo, nil
+		},
+	)
+	return repo
+}
+
+func cleanup() {
+	delete(registry, mockRepoType)
+}
+
+func TestSampleAllDatabases_Error(t *testing.T) {
+	repo := setup()
+	t.Cleanup(cleanup)
+
+	ctx := context.Background()
+	listDbErr := errors.New("error listing databases")
+	repo.On("ListDatabases", ctx).Return(nil, listDbErr)
+	cfg := config.RepoConfig{Type: mockRepoType}
+	sampleParams := SampleParameters{SampleSize: 5}
+	samples, err := SampleAllDatabases(ctx, repo, cfg, sampleParams)
+	require.Nil(t, samples)
+	require.ErrorIs(t, err, listDbErr)
+}
+
+func TestSampleAllDatabases_Successful_TwoDatabases(t *testing.T) {
+	repo := setup()
+	t.Cleanup(cleanup)
+
+	ctx := context.Background()
+	dbs := []string{"db1", "db2"}
+	repo.On("ListDatabases", ctx).Return(dbs, nil)
+	// Dummy metadata returned for each Introspect call
+	meta := Metadata{
+		Name:     "test",
+		RepoType: mockRepoType,
+		Database: "db",
+		Schemas: map[string]*SchemaMetadata{
+			"schema": {
+				Name: "schema",
+				Tables: map[string]*TableMetadata{
+					"table": {
+						Schema: "schema",
+						Name:   "table",
+						Attributes: []*AttributeMetadata{
+							{
+								Schema:   "schema",
+								Table:    "table",
+								Name:     "attr",
+								DataType: "string",
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+	repo.On("Introspect", mock.Anything).Return(&meta, nil)
+	sample := Sample{
+		Metadata: SampleMetadata{
+			Repo:     "repo",
+			Database: "db",
+			Schema:   "schema",
+			Table:    "table",
+		},
+		Results: []SampleResult{
+			{
+				"attr": "foo",
+			},
+		},
+	}
+	repo.On("SampleTable", mock.Anything, mock.Anything, mock.Anything).
+		Return(sample, nil)
+	repo.On("Close").Return(nil)
+
+	cfg := config.RepoConfig{Type: mockRepoType}
+	sampleParams := SampleParameters{SampleSize: 5}
+	samples, err := SampleAllDatabases(ctx, repo, cfg, sampleParams)
+	require.NoError(t, err)
+	// Two databases should be sampled, and our mock will return the sample for
+	// each sample call. This really just asserts that we've sampled the correct
+	// number of times.
+	require.ElementsMatch(t, samples, []Sample{sample, sample})
+}
+
+func TestSampleAllDatabases_IntrospectError(t *testing.T) {
+	repo := setup()
+	t.Cleanup(cleanup)
+
+	ctx := context.Background()
+	dbs := []string{"db1", "db2"}
+	repo.On("ListDatabases", ctx).Return(dbs, nil)
+	introspectErr := errors.New("introspect error")
+	repo.On("Introspect", mock.Anything).Return(nil, introspectErr)
+	repo.On("Close").Return(nil)
+
+	cfg := config.RepoConfig{Type: mockRepoType}
+	sampleParams := SampleParameters{SampleSize: 5}
+	samples, err := SampleAllDatabases(ctx, repo, cfg, sampleParams)
+	require.Empty(t, samples)
+	require.NoError(t, err)
+}
+
+func TestSampleAllDatabases_SampleError(t *testing.T) {
+	repo := setup()
+	t.Cleanup(cleanup)
+
+	ctx := context.Background()
+	dbs := []string{"db1", "db2"}
+	repo.On("ListDatabases", ctx).Return(dbs, nil)
+	// Dummy metadata returned for each Introspect call
+	meta := Metadata{
+		Name:     "test",
+		RepoType: mockRepoType,
+		Database: "db",
+		Schemas: map[string]*SchemaMetadata{
+			"schema": {
+				Name: "schema",
+				Tables: map[string]*TableMetadata{
+					"table": {
+						Schema: "schema",
+						Name:   "table",
+						Attributes: []*AttributeMetadata{
+							{
+								Schema:   "schema",
+								Table:    "table",
+								Name:     "attr",
+								DataType: "string",
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+	repo.On("Introspect", mock.Anything).Return(&meta, nil)
+	sampleErr := errors.New("sample error")
+	repo.On("SampleTable", mock.Anything, mock.Anything, mock.Anything).
+		Return(Sample{}, sampleErr)
+	repo.On("Close").Return(nil)
+
+	cfg := config.RepoConfig{Type: mockRepoType}
+	sampleParams := SampleParameters{SampleSize: 5}
+	samples, err := SampleAllDatabases(ctx, repo, cfg, sampleParams)
+	require.NoError(t, err)
+	require.Empty(t, samples)
+}
+
+func TestSampleAllDatabases_TwoDatabases_OneSampleError(t *testing.T) {
+	repo := setup()
+	t.Cleanup(cleanup)
+
+	ctx := context.Background()
+	dbs := []string{"db1", "db2"}
+	repo.On("ListDatabases", ctx).Return(dbs, nil)
+	// Dummy metadata returned for each Introspect call
+	meta := Metadata{
+		Name:     "test",
+		RepoType: mockRepoType,
+		Database: "db",
+		Schemas: map[string]*SchemaMetadata{
+			"schema": {
+				Name: "schema",
+				Tables: map[string]*TableMetadata{
+					"table": {
+						Schema: "schema",
+						Name:   "table",
+						Attributes: []*AttributeMetadata{
+							{
+								Schema:   "schema",
+								Table:    "table",
+								Name:     "attr",
+								DataType: "string",
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+	repo.On("Introspect", mock.Anything).Return(&meta, nil)
+	sample := Sample{
+		Metadata: SampleMetadata{
+			Repo:     "repo",
+			Database: "db",
+			Schema:   "schema",
+			Table:    "table",
+		},
+		Results: []SampleResult{
+			{
+				"attr": "foo",
+			},
+		},
+	}
+	repo.On("SampleTable", mock.Anything, mock.Anything, mock.Anything).
+		Return(sample, nil).Once()
+	sampleErr := errors.New("sample error")
+	repo.On("SampleTable", mock.Anything, mock.Anything, mock.Anything).
+		Return(Sample{}, sampleErr).Once()
+	repo.On("Close").Return(nil)
+
+	cfg := config.RepoConfig{Type: mockRepoType}
+	sampleParams := SampleParameters{SampleSize: 5}
+	samples, err := SampleAllDatabases(ctx, repo, cfg, sampleParams)
+	require.NoError(t, err)
+	// Because of a single sample error, we expect only one database was
+	// sampled.
+	require.ElementsMatch(t, samples, []Sample{sample})
+}
diff --git a/discovery/repository/sample_repository_test.go b/discovery/repository/sample_repository_test.go
new file mode 100644
index 0000000..fde10fb
--- /dev/null
+++ b/discovery/repository/sample_repository_test.go
@@ -0,0 +1,181 @@
+package repository
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestSampleRepository(t *testing.T) {
+	ctx := context.Background()
+	repo := fakeRepo{}
+	params := SampleParameters{SampleSize: 2}
+	samples, err := SampleRepository(ctx, repo, params)
+	require.NoError(t, err)
+
+	// Order is not important and is actually non-deterministic due to concurrency
+	assert.ElementsMatch(t, samples, []Sample{table1Sample, table2Sample})
+}
+
+func TestSampleRepository_PartialError(t *testing.T) {
+	ctx := context.Background()
+	repo := fakeRepo{includeForbiddenTables: true}
+	params := SampleParameters{SampleSize: 2}
+	samples, err := SampleRepository(ctx, repo, params)
+	require.ErrorContains(t, err, "forbidden table")
+
+	// Order is not important and is actually non-deterministic due to concurrency
+	assert.ElementsMatch(t, samples, []Sample{table1Sample, table2Sample})
+}
+
+var repoMeta = Metadata{
+	Name:     "name",
+	RepoType: "repoType",
+	Database: "database",
+	Schemas: map[string]*SchemaMetadata{
+		"schema1": {
+			Name: "",
+			Tables: map[string]*TableMetadata{
+				"table1": {
+					Schema: "schema1",
+					Name:   "table1",
+					Attributes: []*AttributeMetadata{
+						{
+							Schema:   "schema1",
+							Table:    "table1",
+							Name:     "name1",
+							DataType: "varchar",
+						},
+						{
+							Schema:   "schema1",
+							Table:    "table1",
+							Name:     "name2",
+							DataType: "decimal",
+						},
+					},
+				},
+			},
+		},
+		"schema2": {
+			Name: "",
+			Tables: map[string]*TableMetadata{
+				"table2": {
+					Schema: "schema2",
+					Name:   "table2",
+					Attributes: []*AttributeMetadata{
+						{
+							Schema:   "schema2",
+							Table:    "table2",
+							Name:     "name3",
+							DataType: "int",
+						},
+						{
+							Schema:   "schema2",
+							Table:    "table2",
+							Name:     "name4",
+							DataType: "timestamp",
+						},
+					},
+				},
+			},
+		},
+	},
+}
+
+var schema1ForbiddenTable = TableMetadata{
+	Schema: "schema1",
+	Name:   "forbidden",
+	Attributes: []*AttributeMetadata{
+		{
+			Schema:   "schema1",
+			Table:    "forbidden",
+			Name:     "name1",
+			DataType: "varchar",
+		},
+		{
+			Schema:   "schema1",
+			Table:    "forbidden",
+			Name:     "name2",
+			DataType: "decimal",
+		},
+	},
+}
+
+var table1Sample = Sample{
+	Metadata: SampleMetadata{
+		Repo:     "name",
+		Database: "database",
+		Schema:   "schema1",
+		Table:    "table1",
+	},
+	Results: []SampleResult{
+		{
+			"name1": "foo",
+			"name2": "bar",
+		},
+		{
+			"name1": "baz",
+			"name2": "qux",
+		},
+	},
+}
+
+var table2Sample = Sample{
+	Metadata: SampleMetadata{
+		Repo:     "name",
+		Database: "database",
+		Schema:   "schema2",
+		Table:    "table2",
+	},
+	Results: []SampleResult{
+		{
+			"name3": "foo1",
+			"name4": "bar1",
+		},
+		{
+			"name3": "baz1",
+			"name4": "qux1",
+		},
+	},
+}
+
+type fakeRepo struct {
+	includeForbiddenTables bool
+}
+
+func (f fakeRepo) Introspect(context.Context) (*Metadata, error) {
+	if f.includeForbiddenTables {
+		repoMeta.Schemas["schema1"].Tables["forbidden"] = &schema1ForbiddenTable
+	}
+	return &repoMeta, nil
+}
+
+func (f fakeRepo) SampleTable(_ context.Context, meta *TableMetadata, _ SampleParameters) (
+	Sample,
+	error,
+) {
+	if meta.Name == "table1" {
+		return table1Sample, nil
+	} else if meta.Name == "table2" {
+		return table2Sample, nil
+	} else if meta.Name == "forbidden" {
+		return Sample{}, errors.New("forbidden table")
+	} else {
+		return Sample{}, errors.New("unrecognized table")
+	}
+}
+
+func (f fakeRepo) ListDatabases(context.Context) ([]string, error) {
+	panic("not implemented")
+}
+
+func (f fakeRepo) Ping(context.Context) error {
+	panic("not implemented")
+}
+
+func (f fakeRepo) Close() error {
+	panic("not implemented")
+}
diff --git a/discovery/repository/sampling.go b/discovery/repository/sampling.go
new file mode 100644
index 0000000..07b84d3
--- /dev/null
+++ b/discovery/repository/sampling.go
@@ -0,0 +1,56 @@
+package repository
+
+import (
+	"fmt"
+)
+
+// SampleParameters contains all parameters necessary to sample a table.
+type SampleParameters struct {
+	SampleSize uint
+	Offset     uint
+}
+
+// Sample represents a sample of a database table. The Metadata field contains
+// metadata about the sample itself. The actual results of the sample, which
+// are  represented by a set of database rows, are contained in the Results
+// field.
+type Sample struct {
+	Metadata SampleMetadata
+	Results  []SampleResult
+}
+
+// SampleMetadata contains the metadata associated with a given sample, such as
+// repo name, database name, table, schema, and query (if applicable). This can
+// be used for diagnostic and informational purposes when analyzing a
+// particular sample.
+type SampleMetadata struct {
+	Repo     string
+	Database string
+	Schema   string
+	Table    string
+}
+
+// SampleResult stores the results from a single database sample. It is
+// equivalent to a database row, where the map key is the column name and the
+// map value is the column value.
+type SampleResult map[string]any
+
+// GetAttributeNamesAndValues splits a SampleResult map into two slices and
+// returns them. The first slice contains all the keys of SampleResult,
+// representing the table's attribute names, and the second slice is the map's
+// corresponding values.
+func (result SampleResult) GetAttributeNamesAndValues() ([]string, []string) {
+	names := make([]string, 0, len(result))
+	vals := make([]string, 0, len(result))
+	for name, val := range result {
+		names = append(names, name)
+		var v string
+		if b, ok := val.([]byte); ok {
+			v = string(b)
+		} else {
+			v = fmt.Sprint(val)
+		}
+		vals = append(vals, v)
+	}
+	return names, vals
+}
diff --git a/discovery/repository/sampling_test.go b/discovery/repository/sampling_test.go
new file mode 100644
index 0000000..1bbdfe7
--- /dev/null
+++ b/discovery/repository/sampling_test.go
@@ -0,0 +1,77 @@
+package repository
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestSampleResult_GetAttributeNamesAndValues(t *testing.T) {
+	tests := []struct {
+		name                string
+		result              SampleResult
+		wantNames, wantVals []string
+	}{
+		{
+			name: "string",
+			result: SampleResult{
+				"foo": "fooVal",
+			},
+			wantNames: []string{"foo"},
+			wantVals:  []string{"fooVal"},
+		},
+		{
+			name: "int",
+			result: SampleResult{
+				"foo": 123,
+			},
+			wantNames: []string{"foo"},
+			wantVals:  []string{"123"},
+		},
+		{
+			name: "float",
+			result: SampleResult{
+				"foo": 12.3,
+			},
+			wantNames: []string{"foo"},
+			wantVals:  []string{"12.3"},
+		},
+		{
+			name: "bytes",
+			result: SampleResult{
+				"foo": []byte("fooVal"),
+			},
+			wantNames: []string{"foo"},
+			wantVals:  []string{"fooVal"},
+		},
+		{
+			name: "bool",
+			result: SampleResult{
+				"foo": false,
+			},
+			wantNames: []string{"foo"},
+			wantVals:  []string{"false"},
+		},
+		{
+			name: "varied types",
+			result: SampleResult{
+				"foo":  "fooVal",
+				"bar":  123,
+				"baz":  12.3,
+				"qux":  []byte("quxVal"),
+				"quxx": true,
+			},
+			wantNames: []string{"foo", "bar", "baz", "qux", "quxx"},
+			wantVals:  []string{"fooVal", "123", "12.3", "quxVal", "true"},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(
+			tt.name, func(t *testing.T) {
+				gotNames, gotVals := tt.result.GetAttributeNamesAndValues()
+				require.ElementsMatch(t, tt.wantNames, gotNames)
+				require.ElementsMatch(t, tt.wantVals, gotVals)
+			},
+		)
+	}
+}
diff --git a/discovery/repository/snowflake/config.go b/discovery/repository/snowflake/config.go
new file mode 100644
index 0000000..57f3e0a
--- /dev/null
+++ b/discovery/repository/snowflake/config.go
@@ -0,0 +1,36 @@
+package snowflake
+
+import (
+	"github.com/cyralinc/dmap/discovery/config"
+)
+
+const (
+	configAccount   = "account"
+	configRole      = "role"
+	configWarehouse = "warehouse"
+)
+
+type Config struct {
+	Account   string
+	Role      string
+	Warehouse string
+}
+
+// ParseConfig produces a config structure with Snowflake-specific parameters
+// found in the repo config.
+func ParseConfig(cfg config.RepoConfig) (*Config, error) {
+	snowflakeCfg, err := config.FetchAdvancedConfigString(
+		cfg,
+		RepoTypeSnowflake,
+		[]string{configAccount, configRole, configWarehouse},
+	)
+	if err != nil {
+		return nil, err
+	}
+	return &Config{
+		Account:   snowflakeCfg[configAccount],
+		Role:      snowflakeCfg[configRole],
+		Warehouse: snowflakeCfg[configWarehouse],
+	}, nil
+
+}
diff --git a/discovery/repository/snowflake/snowflake.go b/discovery/repository/snowflake/snowflake.go
new file mode 100644
index 0000000..9dfa583
--- /dev/null
+++ b/discovery/repository/snowflake/snowflake.go
@@ -0,0 +1,100 @@
+package snowflake
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/cyralinc/dmap/discovery/repository"
+	"github.com/cyralinc/dmap/discovery/repository/genericsql"
+
+	"github.com/cyralinc/dmap/discovery/config"
+
+	// Snowflake DB driver
+	_ "github.com/snowflakedb/gosnowflake"
+)
+
+const (
+	RepoTypeSnowflake = "snowflake"
+
+	DatabaseQuery = `
+SELECT 
+    DATABASE_NAME 
+FROM 
+    INFORMATION_SCHEMA.DATABASES 
+WHERE 
+    IS_TRANSIENT = 'NO'
+`
+)
+
+type snowflakeRepository struct {
+	// The majority of the repository.Repository functionality is delegated to
+	// a generic SQL repository instance (genericSqlRepo).
+	genericSqlRepo *genericsql.GenericSqlRepository
+}
+
+// *snowflakeRepository implements repository.Repository
+var _ repository.Repository = (*snowflakeRepository)(nil)
+
+func NewSnowflakeRepository(_ context.Context, repoCfg config.RepoConfig) (repository.Repository, error) {
+	snowflakeCfg, err := ParseConfig(repoCfg)
+	if err != nil {
+		return nil, fmt.Errorf("error when parsing snowflake config: %w", err)
+	}
+	database := repoCfg.Database
+	// Connect to the default database, if unspecified.
+	if database == "" {
+		database = "SNOWFLAKE"
+	}
+	connStr := fmt.Sprintf(
+		"%s:%s@%s/%s?role=%s&warehouse=%s",
+		repoCfg.User,
+		repoCfg.Password,
+		snowflakeCfg.Account,
+		repoCfg.Database,
+		snowflakeCfg.Role,
+		snowflakeCfg.Warehouse,
+	)
+
+	sqlRepo, err := genericsql.NewGenericSqlRepository(
+		repoCfg.Host,
+		RepoTypeSnowflake,
+		repoCfg.Database,
+		connStr,
+		repoCfg.MaxOpenConns,
+		repoCfg.IncludePaths,
+		repoCfg.ExcludePaths,
+	)
+	if err != nil {
+		return nil, fmt.Errorf("could not instantiate generic sql repository: %w", err)
+	}
+
+	return &snowflakeRepository{genericSqlRepo: sqlRepo}, nil
+}
+
+func (repo *snowflakeRepository) ListDatabases(ctx context.Context) ([]string, error) {
+	return repo.genericSqlRepo.ListDatabasesWithQuery(ctx, DatabaseQuery)
+}
+
+func (repo *snowflakeRepository) Introspect(ctx context.Context) (*repository.Metadata, error) {
+	return repo.genericSqlRepo.Introspect(ctx)
+}
+
+func (repo *snowflakeRepository) SampleTable(
+	ctx context.Context,
+	meta *repository.TableMetadata,
+	params repository.SampleParameters,
+) (repository.Sample, error) {
+	return repo.genericSqlRepo.SampleTable(ctx, meta, params)
+}
+
+func (repo *snowflakeRepository) Ping(ctx context.Context) error {
+	return repo.genericSqlRepo.Ping(ctx)
+}
+
+func (repo *snowflakeRepository) Close() error {
+	return repo.genericSqlRepo.Close()
+}
+
+func init() {
+	repository.Register(RepoTypeSnowflake, NewSnowflakeRepository)
+}
diff --git a/discovery/repository/snowflake/snowflake_test.go b/discovery/repository/snowflake/snowflake_test.go
new file mode 100644
index 0000000..05fe358
--- /dev/null
+++ b/discovery/repository/snowflake/snowflake_test.go
@@ -0,0 +1,31 @@
+package snowflake
+
+import (
+	"context"
+	"database/sql"
+	"testing"
+
+	"github.com/DATA-DOG/go-sqlmock"
+	"github.com/stretchr/testify/require"
+
+	"github.com/cyralinc/dmap/discovery/repository/genericsql"
+)
+
+func TestListDatabases(t *testing.T) {
+	ctx, db, mock, r := initRepoTest(t)
+	defer db.Close()
+	dbRows := sqlmock.NewRows([]string{"name"}).AddRow("db1").AddRow("db2")
+	mock.ExpectQuery(DatabaseQuery).WillReturnRows(dbRows)
+	dbs, err := r.ListDatabases(ctx)
+	require.NoError(t, err)
+	require.ElementsMatch(t, []string{"db1", "db2"}, dbs)
+}
+
+func initRepoTest(t *testing.T) (context.Context, *sql.DB, sqlmock.Sqlmock, *snowflakeRepository) {
+	ctx := context.Background()
+	db, mock, err := sqlmock.New()
+	require.NoError(t, err)
+	return ctx, db, mock, &snowflakeRepository{
+		genericSqlRepo: genericsql.NewGenericSqlRepositoryFromDB("repoName", RepoTypeSnowflake, "dbName", db),
+	}
+}
diff --git a/discovery/repository/sqlserver/sqlserver.go b/discovery/repository/sqlserver/sqlserver.go
new file mode 100644
index 0000000..a77bf5c
--- /dev/null
+++ b/discovery/repository/sqlserver/sqlserver.go
@@ -0,0 +1,104 @@
+package sqlserver
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/cyralinc/dmap/discovery/repository"
+	"github.com/cyralinc/dmap/discovery/repository/genericsql"
+
+	"github.com/cyralinc/dmap/discovery/config"
+
+	// SQL Server DB driver
+	_ "github.com/denisenkom/go-mssqldb"
+)
+
+const (
+	RepoTypeSqlServer = "sqlserver"
+
+	// SampleQueryTemplate is the string template for the SQL query used to
+	// sample a SQL Server database. SQL Server doesn't support limit/offset, so
+	// we use top. It also uses the @ symbol for statement parameter
+	// placeholders. It is intended to be templated by the database name to
+	// query.
+	SampleQueryTemplate = `SELECT TOP (@p1) %s FROM "%s"."%s"`
+
+	// DatabaseQuery is the query to list all the databases on the server, minus
+	// the system default databases 'model' and 'tempdb'.
+	DatabaseQuery = "SELECT name FROM sys.databases WHERE name != 'model' AND name != 'tempdb'"
+)
+
+type SqlServerRepository struct {
+	// The majority of the repository.Repository functionality is delegated to
+	// a generic SQL repository instance (genericSqlRepo).
+	genericSqlRepo *genericsql.GenericSqlRepository
+}
+
+// *SqlServerRepository implements repository.Repository
+var _ repository.Repository = (*SqlServerRepository)(nil)
+
+func NewSqlServerRepository(_ context.Context, cfg config.RepoConfig) (*SqlServerRepository, error) {
+	connStr := fmt.Sprintf(
+		"sqlserver://%s:%s@%s:%d",
+		cfg.User,
+		cfg.Password,
+		cfg.Host,
+		cfg.Port,
+	)
+
+	// The database name is optional for MS SQL Server.
+	if cfg.Database != "" {
+		connStr = fmt.Sprintf(connStr+"?database=%s", cfg.Database)
+	}
+
+	genericSqlRepo, err := genericsql.NewGenericSqlRepository(
+		cfg.Host,
+		RepoTypeSqlServer,
+		cfg.Database,
+		connStr,
+		cfg.MaxOpenConns,
+		cfg.IncludePaths,
+		cfg.IncludePaths,
+	)
+	if err != nil {
+		return nil, fmt.Errorf("could not instantiate generic sql repository: %w", err)
+	}
+
+	return &SqlServerRepository{genericSqlRepo: genericSqlRepo}, nil
+}
+
+func (repo *SqlServerRepository) ListDatabases(ctx context.Context) ([]string, error) {
+	return repo.genericSqlRepo.ListDatabasesWithQuery(ctx, DatabaseQuery)
+}
+
+func (repo *SqlServerRepository) Introspect(ctx context.Context) (*repository.Metadata, error) {
+	return repo.genericSqlRepo.Introspect(ctx)
+}
+
+func (repo *SqlServerRepository) SampleTable(
+	ctx context.Context,
+	meta *repository.TableMetadata,
+	params repository.SampleParameters,
+) (repository.Sample, error) {
+	// Sqlserver uses double-quotes to quote identifiers
+	attrStr := meta.QuotedAttributeNamesString("\"")
+	query := fmt.Sprintf(SampleQueryTemplate, attrStr, meta.Schema, meta.Name)
+	return repo.genericSqlRepo.SampleTableWithQuery(ctx, meta, query, params.SampleSize)
+}
+
+func (repo *SqlServerRepository) Ping(ctx context.Context) error {
+	return repo.genericSqlRepo.Ping(ctx)
+}
+
+func (repo *SqlServerRepository) Close() error {
+	return repo.genericSqlRepo.Close()
+}
+
+func init() {
+	repository.Register(
+		RepoTypeSqlServer,
+		func(ctx context.Context, cfg config.RepoConfig) (repository.Repository, error) {
+			return NewSqlServerRepository(ctx, cfg)
+		},
+	)
+}
diff --git a/discovery/repository/sqlserver/sqlserver_test.go b/discovery/repository/sqlserver/sqlserver_test.go
new file mode 100644
index 0000000..f1b3f87
--- /dev/null
+++ b/discovery/repository/sqlserver/sqlserver_test.go
@@ -0,0 +1,31 @@
+package sqlserver
+
+import (
+	"context"
+	"database/sql"
+	"testing"
+
+	"github.com/DATA-DOG/go-sqlmock"
+	"github.com/stretchr/testify/require"
+
+	"github.com/cyralinc/dmap/discovery/repository/genericsql"
+)
+
+func initRepoTest(t *testing.T) (context.Context, *sql.DB, sqlmock.Sqlmock, *SqlServerRepository) {
+	ctx := context.Background()
+	db, mock, err := sqlmock.New()
+	require.NoError(t, err)
+	return ctx, db, mock, &SqlServerRepository{
+		genericSqlRepo: genericsql.NewGenericSqlRepositoryFromDB("repoName", RepoTypeSqlServer, "dbName", db),
+	}
+}
+
+func TestListDatabases(t *testing.T) {
+	ctx, db, mock, r := initRepoTest(t)
+	defer db.Close()
+	dbRows := sqlmock.NewRows([]string{"name"}).AddRow("db1").AddRow("db2")
+	mock.ExpectQuery(DatabaseQuery).WillReturnRows(dbRows)
+	dbs, err := r.ListDatabases(ctx)
+	require.NoError(t, err)
+	require.ElementsMatch(t, []string{"db1", "db2"}, dbs)
+}
diff --git a/discovery/scanner.go b/discovery/scanner.go
new file mode 100644
index 0000000..09b3f02
--- /dev/null
+++ b/discovery/scanner.go
@@ -0,0 +1,161 @@
+package discovery
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/cyralinc/dmap/classification"
+	"github.com/cyralinc/dmap/classification/publisher"
+	"github.com/cyralinc/dmap/discovery/config"
+	"github.com/cyralinc/dmap/discovery/repository"
+	"github.com/cyralinc/dmap/discovery/repository/oracle"
+
+	// Registers repo types for use via 'init' side effects
+	_ "github.com/cyralinc/dmap/discovery/repository/denodo"
+	_ "github.com/cyralinc/dmap/discovery/repository/mysql"
+	_ "github.com/cyralinc/dmap/discovery/repository/oracle"
+	_ "github.com/cyralinc/dmap/discovery/repository/postgresql"
+	_ "github.com/cyralinc/dmap/discovery/repository/redshift"
+	_ "github.com/cyralinc/dmap/discovery/repository/snowflake"
+	_ "github.com/cyralinc/dmap/discovery/repository/sqlserver"
+)
+
+// TODO: godoc -ccampo 2024-03-27
+type Scanner struct {
+	config      *config.Config
+	repository  repository.Repository
+	classifiers map[string]classification.Classifier
+	publisher   publisher.Publisher
+}
+
+// TODO: godoc -ccampo 2024-03-27
+func NewScanner(config *config.Config) Scanner {
+	return Scanner{config: config}
+}
+
+// TODO: godoc -ccampo 2024-03-27
+func (s *Scanner) Init(ctx context.Context) error {
+	if s.config == nil {
+		return errors.New("unable to start crawler: config not found")
+	}
+	// Note: order is important here because we don't have nil checks in these
+	// init methods.
+	s.initPublisher()
+
+	if err := s.initClassifiers(); err != nil {
+		return err
+	}
+	if err := s.initRepository(ctx); err != nil {
+		return err
+	}
+	return nil
+}
+
+func (s *Scanner) InitAndRun(ctx context.Context) error {
+	if err := s.Init(ctx); err != nil {
+		return err
+	}
+	return s.Run(ctx)
+}
+
+func (s *Scanner) Run(ctx context.Context) error {
+	sampleParams := repository.SampleParameters{SampleSize: s.config.Repo.SampleSize}
+	var samples []repository.Sample
+	// The name of the database to connect to has been left unspecified by
+	// the user, so we try to connect and sample all databases instead. Note
+	// that Oracle doesn't really have the concept of "databases", and thus
+	// the Scanner always scans the entire database, so only the single
+	// (default) repository instance is required in that case.
+	if s.config.Repo.Database == "" && s.config.Repo.Type != oracle.RepoTypeOracle {
+		var err error
+		samples, err = repository.SampleAllDatabases(
+			ctx,
+			s.repository,
+			s.config.Repo,
+			sampleParams,
+		)
+		if err != nil {
+			err = fmt.Errorf("error sampling databases: %w", err)
+			// If we didn't get any samples, just return the error.
+			if len(samples) == 0 {
+				return err
+			}
+			// There were error(s) during sampling, but we still got some
+			// samples. Just warn and continue.
+			log.WithError(err).Warn("error sampling databases")
+		}
+	} else {
+		// User specified a database (or this is an Oracle DB), therefore
+		// we already have a repository instance for it. Just use it to
+		// sample that database only.
+		var err error
+		samples, err = repository.SampleRepository(ctx, s.repository, sampleParams)
+		if err != nil {
+			err = fmt.Errorf("error gathering repository data samples: %w", err)
+			// If we didn't get any samples, just return the error.
+			if len(samples) == 0 {
+				return err
+			}
+			// There were error(s) during sampling, but we still got some
+			// samples. Just warn and continue.
+			log.WithError(err).Warn("error gathering repository data samples")
+		}
+	}
+
+	// Classify sampled data
+	classifications, err := classification.AggregateClassifySamples(ctx, s.classifiers, samples)
+	if err != nil {
+		return fmt.Errorf("error classifying samples: %w", err)
+	}
+
+	// Publish classifications if necessary
+	if len(classifications) == 0 {
+		log.Info("No discovered classifications")
+	} else if err := s.publisher.PublishClassifications(ctx, s.config.Repo.Host, classifications); err != nil {
+		return fmt.Errorf("error publishing classifications: %w", err)
+	}
+
+	// Done!
+	return nil
+}
+
+func (s *Scanner) Cleanup() {
+	// Nil checks are prevent panics if deps are not yet initialized.
+	if s.repository != nil {
+		_ = s.repository.Close()
+	}
+}
+
+func (s *Scanner) initClassifiers() error {
+	lbls, err := classification.GetLabels()
+	if err != nil {
+		return fmt.Errorf("error getting labels: %w", err)
+	}
+	s.classifiers = make(map[string]classification.Classifier, len(lbls))
+	for _, lbl := range lbls {
+		classifier, err := classification.NewLabelClassifier(lbl)
+		if err != nil {
+			return fmt.Errorf("unable to initialize rego classifier for label %s: %w", lbl.Name, err)
+		}
+		s.classifiers[lbl.Name] = classifier
+	}
+	return nil
+}
+
+func (s *Scanner) initPublisher() {
+	// TODO: eventually this should chose between publishing to the api and a local file -ccampo 2024-03-14
+	s.publisher = publisher.NewStdOutPublisher()
+}
+
+func (s *Scanner) initRepository(ctx context.Context) error {
+	// Connect to database
+	repo, err := repository.NewRepository(ctx, s.config.Repo)
+	if err != nil {
+		return fmt.Errorf("error connecting to database: %w", err)
+	}
+	s.repository = repo
+	return nil
+}
diff --git a/go.mod b/go.mod
index 334e256..e7fae8e 100644
--- a/go.mod
+++ b/go.mod
@@ -3,6 +3,8 @@ module github.com/cyralinc/dmap
 go 1.21
 
 require (
+	github.com/DATA-DOG/go-sqlmock v1.5.2
+	github.com/alecthomas/kong v0.9.0
 	github.com/aws/aws-sdk-go-v2 v1.26.0
 	github.com/aws/aws-sdk-go-v2/config v1.27.9
 	github.com/aws/aws-sdk-go-v2/credentials v1.17.9
@@ -11,12 +13,34 @@ require (
 	github.com/aws/aws-sdk-go-v2/service/redshift v1.43.4
 	github.com/aws/aws-sdk-go-v2/service/s3 v1.53.0
 	github.com/aws/aws-sdk-go-v2/service/sts v1.28.5
+	github.com/denisenkom/go-mssqldb v0.12.3
+	github.com/go-sql-driver/mysql v1.8.1
+	github.com/gobwas/glob v0.2.3
+	github.com/hashicorp/go-multierror v1.1.1
+	github.com/lib/pq v1.10.9
+	github.com/open-policy-agent/opa v0.62.1
+	github.com/sijms/go-ora/v2 v2.8.10
+	github.com/sirupsen/logrus v1.9.3
+	github.com/snowflakedb/gosnowflake v1.8.0
 	github.com/stretchr/testify v1.9.0
+	golang.org/x/sync v0.6.0
+	gopkg.in/yaml.v3 v3.0.1
 )
 
 require (
+	filippo.io/edwards25519 v1.1.0 // indirect
+	github.com/99designs/go-keychain v0.0.0-20191008050251-8e49817e8af4 // indirect
+	github.com/99designs/keyring v1.2.2 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.10.0 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/internal v1.5.2 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.3.1 // indirect
+	github.com/JohnCGriffin/overflow v0.0.0-20211019200055-46fa312c352c // indirect
+	github.com/OneOfOne/xxhash v1.2.8 // indirect
+	github.com/agnivade/levenshtein v1.1.1 // indirect
+	github.com/apache/arrow/go/v14 v14.0.2 // indirect
 	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.1 // indirect
 	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.0 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.16.13 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.4 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.4 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.0 // indirect
@@ -29,9 +53,57 @@ require (
 	github.com/aws/aws-sdk-go-v2/service/sso v1.20.3 // indirect
 	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.23.3 // indirect
 	github.com/aws/smithy-go v1.20.1 // indirect
-	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/beorn7/perks v1.0.1 // indirect
+	github.com/cespare/xxhash/v2 v2.2.0 // indirect
+	github.com/danieljoos/wincred v1.2.1 // indirect
+	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
+	github.com/dvsekhvalnov/jose2go v1.6.0 // indirect
+	github.com/form3tech-oss/jwt-go v3.2.5+incompatible // indirect
+	github.com/gabriel-vasile/mimetype v1.4.3 // indirect
+	github.com/go-ini/ini v1.67.0 // indirect
+	github.com/go-logr/logr v1.4.1 // indirect
+	github.com/go-logr/stdr v1.2.2 // indirect
+	github.com/goccy/go-json v0.10.2 // indirect
+	github.com/godbus/dbus v0.0.0-20190726142602-4481cbc300e2 // indirect
+	github.com/golang-sql/civil v0.0.0-20220223132316-b832511892a9 // indirect
+	github.com/golang-sql/sqlexp v0.1.0 // indirect
+	github.com/google/flatbuffers v24.3.25+incompatible // indirect
+	github.com/google/uuid v1.6.0 // indirect
+	github.com/gorilla/mux v1.8.1 // indirect
+	github.com/gsterjov/go-libsecret v0.0.0-20161001094733-a6f4afe4910c // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/jmespath/go-jmespath v0.4.0 // indirect
+	github.com/klauspost/compress v1.17.7 // indirect
+	github.com/klauspost/cpuid/v2 v2.2.7 // indirect
+	github.com/mtibben/percent v0.2.1 // indirect
+	github.com/pierrec/lz4/v4 v4.1.21 // indirect
+	github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
+	github.com/prometheus/client_golang v1.19.0 // indirect
+	github.com/prometheus/client_model v0.6.0 // indirect
+	github.com/prometheus/common v0.51.1 // indirect
+	github.com/prometheus/procfs v0.13.0 // indirect
+	github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475 // indirect
+	github.com/stretchr/objx v0.5.2 // indirect
+	github.com/tchap/go-patricia/v2 v2.3.1 // indirect
+	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
+	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
+	github.com/yashtewari/glob-intersection v0.2.0 // indirect
+	github.com/zeebo/xxh3 v1.0.2 // indirect
+	go.opentelemetry.io/otel v1.24.0 // indirect
+	go.opentelemetry.io/otel/metric v1.24.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.24.0 // indirect
+	go.opentelemetry.io/otel/trace v1.24.0 // indirect
+	golang.org/x/crypto v0.21.0 // indirect
+	golang.org/x/exp v0.0.0-20240325151524-a685a6edb6d8 // indirect
+	golang.org/x/mod v0.16.0 // indirect
+	golang.org/x/net v0.22.0 // indirect
+	golang.org/x/sys v0.18.0 // indirect
+	golang.org/x/term v0.18.0 // indirect
+	golang.org/x/text v0.14.0 // indirect
+	golang.org/x/tools v0.19.0 // indirect
+	golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 // indirect
+	google.golang.org/protobuf v1.33.0 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
-	gopkg.in/yaml.v3 v3.0.1 // indirect
+	sigs.k8s.io/yaml v1.4.0 // indirect
 )
diff --git a/go.sum b/go.sum
index e12f641..e5cc87c 100644
--- a/go.sum
+++ b/go.sum
@@ -1,3 +1,42 @@
+filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
+filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
+github.com/99designs/go-keychain v0.0.0-20191008050251-8e49817e8af4 h1:/vQbFIOMbk2FiG/kXiLl8BRyzTWDw7gX/Hz7Dd5eDMs=
+github.com/99designs/go-keychain v0.0.0-20191008050251-8e49817e8af4/go.mod h1:hN7oaIRCjzsZ2dE+yG5k+rsdt3qcwykqK6HVGcKwsw4=
+github.com/99designs/keyring v1.2.2 h1:pZd3neh/EmUzWONb35LxQfvuY7kiSXAq3HQd97+XBn0=
+github.com/99designs/keyring v1.2.2/go.mod h1:wes/FrByc8j7lFOAGLGSNEg8f/PaI3cgTBqhFkHUrPk=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v0.19.0/go.mod h1:h6H6c8enJmmocHUbLiiGY6sx7f9i+X3m1CHdd5c6Rdw=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v1.10.0 h1:n1DH8TPV4qqPTje2RcUBYwtrTWlabVp4n46+74X2pn4=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v1.10.0/go.mod h1:HDcZnuGbiyppErN6lB+idp4CKhjbc8gwjto6OPpyggM=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity v0.11.0/go.mod h1:HcM1YX14R7CJcghJGOYCgdezslRSVzqwLf/q+4Y2r/0=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.5.1 h1:sO0/P7g68FrryJzljemN+6GTssUXdANk6aJ7T1ZxnsQ=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.5.1/go.mod h1:h8hyGFDsU5HMivxiS2iYFZsgDbU9OnnJ163x5UGVKYo=
+github.com/Azure/azure-sdk-for-go/sdk/internal v0.7.0/go.mod h1:yqy467j36fJxcRV2TzfVZ1pCb5vxm4BtZPUdYWe/Xo8=
+github.com/Azure/azure-sdk-for-go/sdk/internal v1.5.2 h1:LqbJ/WzJUwBf8UiaSzgX7aMclParm9/5Vgp+TY51uBQ=
+github.com/Azure/azure-sdk-for-go/sdk/internal v1.5.2/go.mod h1:yInRyqWXAuaPrgI7p70+lDDgh3mlBohis29jGMISnmc=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/storage/armstorage v1.5.0 h1:AifHbc4mg0x9zW52WOpKbsHaDKuRhlI7TVl47thgQ70=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/storage/armstorage v1.5.0/go.mod h1:T5RfihdXtBDxt1Ch2wobif3TvzTdumDy29kahv6AV9A=
+github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.3.1 h1:fXPMAmuh0gDuRDey0atC8cXBuKIlqCzCkL8sm1n9Ov0=
+github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.3.1/go.mod h1:SUZc9YRRHfx2+FAQKNDGrssXehqLpxmwRv2mC/5ntj4=
+github.com/AzureAD/microsoft-authentication-library-for-go v1.2.1 h1:DzHpqpoJVaCgOUdVHxE8QB52S6NiVdDQvGlny1qvPqA=
+github.com/AzureAD/microsoft-authentication-library-for-go v1.2.1/go.mod h1:wP83P5OoQ5p6ip3ScPr0BAq0BvuPAvacpEuSzyouqAI=
+github.com/DATA-DOG/go-sqlmock v1.5.2 h1:OcvFkGmslmlZibjAjaHm3L//6LiuBgolP7OputlJIzU=
+github.com/DATA-DOG/go-sqlmock v1.5.2/go.mod h1:88MAG/4G7SMwSE3CeA0ZKzrT5CiOU3OJ+JlNzwDqpNU=
+github.com/JohnCGriffin/overflow v0.0.0-20211019200055-46fa312c352c h1:RGWPOewvKIROun94nF7v2cua9qP+thov/7M50KEoeSU=
+github.com/JohnCGriffin/overflow v0.0.0-20211019200055-46fa312c352c/go.mod h1:X0CRv0ky0k6m906ixxpzmDRLvX58TFUKS2eePweuyxk=
+github.com/OneOfOne/xxhash v1.2.8 h1:31czK/TI9sNkxIKfaUfGlU47BAxQ0ztGgd9vPyqimf8=
+github.com/OneOfOne/xxhash v1.2.8/go.mod h1:eZbhyaAYD41SGSSsnmcpxVoRiQ/MPUTjUdIIOT9Um7Q=
+github.com/agnivade/levenshtein v1.1.1 h1:QY8M92nrzkmr798gCo3kmMyqXFzdQVpxLlGPRBij0P8=
+github.com/agnivade/levenshtein v1.1.1/go.mod h1:veldBMzWxcCG2ZvUTKD2kJNRdCk5hVbJomOvKkmgYbo=
+github.com/alecthomas/assert/v2 v2.6.0 h1:o3WJwILtexrEUk3cUVal3oiQY2tfgr/FHWiz/v2n4FU=
+github.com/alecthomas/assert/v2 v2.6.0/go.mod h1:Bze95FyfUr7x34QZrjL+XP+0qgp/zg8yS+TtBj1WA3k=
+github.com/alecthomas/kong v0.9.0 h1:G5diXxc85KvoV2f0ZRVuMsi45IrBgx9zDNGNj165aPA=
+github.com/alecthomas/kong v0.9.0/go.mod h1:Y47y5gKfHp1hDc7CH7OeXgLIpp+Q2m1Ni0L5s3bI8Os=
+github.com/alecthomas/repr v0.4.0 h1:GhI2A8MACjfegCPVq9f1FLvIBS+DrQ2KQBFZP1iFzXc=
+github.com/alecthomas/repr v0.4.0/go.mod h1:Fr0507jx4eOXV7AlPV6AVZLYrLIuIeSOWtW57eE/O/4=
+github.com/apache/arrow/go/v14 v14.0.2 h1:N8OkaJEOfI3mEZt07BIkvo4sC6XDbL+48MBPWO5IONw=
+github.com/apache/arrow/go/v14 v14.0.2/go.mod h1:u3fgh3EdgN/YQ8cVQRguVW3R+seMybFg8QBQ5LU+eBY=
+github.com/arbovm/levenshtein v0.0.0-20160628152529-48b4e1c0c4d0 h1:jfIu9sQUG6Ig+0+Ap1h4unLjW6YQJpKZVmUzxsD4E/Q=
+github.com/arbovm/levenshtein v0.0.0-20160628152529-48b4e1c0c4d0/go.mod h1:t2tdKJDJF9BV14lnkjHmOQgcvEKgtqs5a1N3LNdJhGE=
 github.com/aws/aws-sdk-go-v2 v1.26.0 h1:/Ce4OCiM3EkpW7Y+xUnfAFpchU78K7/Ug01sZni9PgA=
 github.com/aws/aws-sdk-go-v2 v1.26.0/go.mod h1:35hUlJVYd+M++iLI3ALmVwMOyRYMmRqUXpTtRGW+K9I=
 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.1 h1:gTK2uhtAPtFcdRRJilZPx8uJLL2J85xK11nKtWL0wfU=
@@ -8,6 +47,8 @@ github.com/aws/aws-sdk-go-v2/credentials v1.17.9 h1:N8s0/7yW+h8qR8WaRlPQeJ6czVMN
 github.com/aws/aws-sdk-go-v2/credentials v1.17.9/go.mod h1:446YhIdmSV0Jf/SLafGZalQo+xr2iw7/fzXGDPTU1yQ=
 github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.0 h1:af5YzcLf80tv4Em4jWVD75lpnOHSBkPUZxZfGkrI3HI=
 github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.0/go.mod h1:nQ3how7DMnFMWiU1SpECohgC82fpn4cKZ875NDMmwtA=
+github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.16.13 h1:F+PUZee9mlfpEJVZdgyewRumKekS9O3fftj8fEMt0rQ=
+github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.16.13/go.mod h1:Rl7i2dEWGHGsBIJCpUxlRt7VwK/HyXxICxdvIRssQHE=
 github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.4 h1:0ScVK/4qZ8CIW0k8jOeFVsyS/sAiXpYxRBLolMkuLQM=
 github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.4/go.mod h1:84KyjNZdHC6QZW08nfHI6yZgPd+qRgaWcYsyLUo3QY8=
 github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.4 h1:sHmMWWX5E7guWEFQ9SVo6A3S4xpPrWnd77a6y4WM6PU=
@@ -42,22 +83,246 @@ github.com/aws/aws-sdk-go-v2/service/sts v1.28.5 h1:J/PpTf/hllOjx8Xu9DMflff3Fajf
 github.com/aws/aws-sdk-go-v2/service/sts v1.28.5/go.mod h1:0ih0Z83YDH/QeQ6Ori2yGE2XvWYv/Xm+cZc01LC6oK0=
 github.com/aws/smithy-go v1.20.1 h1:4SZlSlMr36UEqC7XOyRVb27XMeZubNcBNN+9IgEPIQw=
 github.com/aws/smithy-go v1.20.1/go.mod h1:krry+ya/rV9RDcV/Q16kpu6ypI4K2czasz0NC3qS14E=
+github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
+github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
+github.com/bytecodealliance/wasmtime-go/v3 v3.0.2 h1:3uZCA/BLTIu+DqCfguByNMJa2HVHpXvjfy0Dy7g6fuA=
+github.com/bytecodealliance/wasmtime-go/v3 v3.0.2/go.mod h1:RnUjnIXxEJcL6BgCvNyzCCRzZcxCgsZCi+RNlvYor5Q=
+github.com/cenkalti/backoff/v4 v4.2.1 h1:y4OZtCnogmCPw98Zjyt5a6+QwPLGkiQsYW5oUqylYbM=
+github.com/cenkalti/backoff/v4 v4.2.1/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
+github.com/cespare/xxhash v1.1.0 h1:a6HrQnmkObjyL+Gs60czilIUGqrzKutQD6XZog3p+ko=
+github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
+github.com/cespare/xxhash/v2 v2.2.0 h1:DC2CZ1Ep5Y4k3ZQ899DldepgrayRUGE6BBZ/cd9Cj44=
+github.com/cespare/xxhash/v2 v2.2.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/danieljoos/wincred v1.2.1 h1:dl9cBrupW8+r5250DYkYxocLeZ1Y4vB1kxgtjxw8GQs=
+github.com/danieljoos/wincred v1.2.1/go.mod h1:uGaFL9fDn3OLTvzCGulzE+SzjEe5NGlh5FdCcyfPwps=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/denisenkom/go-mssqldb v0.12.3 h1:pBSGx9Tq67pBOTLmxNuirNTeB8Vjmf886Kx+8Y+8shw=
+github.com/denisenkom/go-mssqldb v0.12.3/go.mod h1:k0mtMFOnU+AihqFxPMiF05rtiDrorD1Vrm1KEz5hxDo=
+github.com/dgraph-io/badger/v3 v3.2103.5 h1:ylPa6qzbjYRQMU6jokoj4wzcaweHylt//CH0AKt0akg=
+github.com/dgraph-io/badger/v3 v3.2103.5/go.mod h1:4MPiseMeDQ3FNCYwRbbcBOGJLf5jsE0PPFzRiKjtcdw=
+github.com/dgraph-io/ristretto v0.1.1 h1:6CWw5tJNgpegArSHpNHJKldNeq03FQCwYvfMVWajOK8=
+github.com/dgraph-io/ristretto v0.1.1/go.mod h1:S1GPSBCYCIhmVNfcth17y2zZtQT6wzkzgwUve0VDWWA=
+github.com/dgryski/trifles v0.0.0-20200323201526-dd97f9abfb48 h1:fRzb/w+pyskVMQ+UbP35JkH8yB7MYb4q/qhBarqZE6g=
+github.com/dgryski/trifles v0.0.0-20200323201526-dd97f9abfb48/go.mod h1:if7Fbed8SFyPtHLHbg49SI7NAdJiC5WIA09pe59rfAA=
+github.com/dnaeon/go-vcr v1.2.0 h1:zHCHvJYTMh1N7xnV7zf1m1GPBF9Ad0Jk/whtQ1663qI=
+github.com/dnaeon/go-vcr v1.2.0/go.mod h1:R4UdLID7HZT3taECzJs4YgbbH6PIGXB6W/sc5OLb6RQ=
+github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
+github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
+github.com/dvsekhvalnov/jose2go v1.6.0 h1:Y9gnSnP4qEI0+/uQkHvFXeD2PLPJeXEL+ySMEA2EjTY=
+github.com/dvsekhvalnov/jose2go v1.6.0/go.mod h1:QsHjhyTlD/lAVqn/NSbVZmSCGeDehTB/mPZadG+mhXU=
+github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
+github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
+github.com/form3tech-oss/jwt-go v3.2.5+incompatible h1:/l4kBbb4/vGSsdtB5nUe8L7B9mImVMaBPw9L/0TBHU8=
+github.com/form3tech-oss/jwt-go v3.2.5+incompatible/go.mod h1:pbq4aXjuKjdthFRnoDwaVPLA+WlJuPGy+QneDUgJi2k=
+github.com/fortytw2/leaktest v1.3.0 h1:u8491cBMTQ8ft8aeV+adlcytMZylmA5nnwwkRZjI8vw=
+github.com/fortytw2/leaktest v1.3.0/go.mod h1:jDsjWgpAGjm2CA7WthBh/CdZYEPF31XHquHwclZch5g=
+github.com/foxcpp/go-mockdns v1.1.0 h1:jI0rD8M0wuYAxL7r/ynTrCQQq0BVqfB99Vgk7DlmewI=
+github.com/foxcpp/go-mockdns v1.1.0/go.mod h1:IhLeSFGed3mJIAXPH2aiRQB+kqz7oqu8ld2qVbOu7Wk=
+github.com/gabriel-vasile/mimetype v1.4.3 h1:in2uUcidCuFcDKtdcBxlR0rJ1+fsokWf+uqxgUFjbI0=
+github.com/gabriel-vasile/mimetype v1.4.3/go.mod h1:d8uq/6HKRL6CGdk+aubisF/M5GcPfT7nKyLpA0lbSSk=
+github.com/go-ini/ini v1.67.0 h1:z6ZrTEZqSWOTyH2FlglNbNgARyHG8oLW9gMELqKr06A=
+github.com/go-ini/ini v1.67.0/go.mod h1:ByCAeIL28uOIIG0E3PJtZPDL8WnHpFKFOtgjp+3Ies8=
+github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
+github.com/go-logr/logr v1.4.1 h1:pKouT5E8xu9zeFC39JXRDukb6JFQPXM5p5I91188VAQ=
+github.com/go-logr/logr v1.4.1/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
+github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
+github.com/go-sql-driver/mysql v1.8.1 h1:LedoTUt/eveggdHS9qUFC1EFSa8bU2+1pZjSRpvNJ1Y=
+github.com/go-sql-driver/mysql v1.8.1/go.mod h1:wEBSXgmK//2ZFJyE+qWnIsVGmvmEKlqwuVSjsCm7DZg=
+github.com/gobwas/glob v0.2.3 h1:A4xDbljILXROh+kObIiy5kIaPYD8e96x1tgBhUI5J+Y=
+github.com/gobwas/glob v0.2.3/go.mod h1:d3Ez4x06l9bZtSvzIay5+Yzi0fmZzPgnTbPcKjJAkT8=
+github.com/goccy/go-json v0.10.2 h1:CrxCmQqYDkv1z7lO7Wbh2HN93uovUHgrECaO5ZrCXAU=
+github.com/goccy/go-json v0.10.2/go.mod h1:6MelG93GURQebXPDq3khkgXZkazVtN9CRI+MGFi0w8I=
+github.com/godbus/dbus v0.0.0-20190726142602-4481cbc300e2 h1:ZpnhV/YsD2/4cESfV5+Hoeu/iUR3ruzNvZ+yQfO03a0=
+github.com/godbus/dbus v0.0.0-20190726142602-4481cbc300e2/go.mod h1:bBOAhwG1umN6/6ZUMtDFBMQR8jRg9O75tm9K00oMsK4=
+github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
+github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
+github.com/golang-jwt/jwt/v5 v5.2.0 h1:d/ix8ftRUorsN+5eMIlF4T6J8CAt9rch3My2winC1Jw=
+github.com/golang-jwt/jwt/v5 v5.2.0/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
+github.com/golang-sql/civil v0.0.0-20190719163853-cb61b32ac6fe/go.mod h1:8vg3r2VgvsThLBIFL93Qb5yWzgyZWhEmBwUJWevAkK0=
+github.com/golang-sql/civil v0.0.0-20220223132316-b832511892a9 h1:au07oEsX2xN0ktxqI+Sida1w446QrXBRJ0nee3SNZlA=
+github.com/golang-sql/civil v0.0.0-20220223132316-b832511892a9/go.mod h1:8vg3r2VgvsThLBIFL93Qb5yWzgyZWhEmBwUJWevAkK0=
+github.com/golang-sql/sqlexp v0.1.0 h1:ZCD6MBpcuOVfGVqsEmY5/4FtYiKz6tSyUv9LPEDei6A=
+github.com/golang-sql/sqlexp v0.1.0/go.mod h1:J4ad9Vo8ZCWQ2GMrC4UCQy1JpCbwU9m3EOqtpKwwwHI=
+github.com/golang/glog v1.2.0 h1:uCdmnmatrKCgMBlM4rMuJZWOkPDqdbZPnrMXDY4gI68=
+github.com/golang/glog v1.2.0/go.mod h1:6AhwSGph0fcJtXVM/PEHPqZlFeoLxhs7/t5UDAwmO+w=
+github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l8iNU+DwB5epxmsaqB+rhGL0m5jtYqE=
+github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
+github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
+github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
+github.com/golang/snappy v0.0.4 h1:yAGX7huGHXlcLOEtBnF4w7FQwA26wojNCwOYAEhLjQM=
+github.com/golang/snappy v0.0.4/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
+github.com/google/flatbuffers v24.3.25+incompatible h1:CX395cjN9Kke9mmalRoL3d81AtFUxJM+yDthflgJGkI=
+github.com/google/flatbuffers v24.3.25+incompatible/go.mod h1:1AeVuKshWv4vARoZatz6mlQ0JxURH0Kv5+zNeJKJCa8=
+github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=
+github.com/gorilla/mux v1.8.1/go.mod h1:AKf9I4AEqPTmMytcMc0KkNouC66V3BtZ4qD5fmWSiMQ=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.16.0 h1:YBftPWNWd4WwGqtY2yeZL2ef8rHAxPBD8KFhJpmcqms=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.16.0/go.mod h1:YN5jB8ie0yfIUg6VvR9Kz84aCaG7AsGZnLjhHbUqwPg=
+github.com/gsterjov/go-libsecret v0.0.0-20161001094733-a6f4afe4910c h1:6rhixN/i8ZofjG1Y75iExal34USq5p+wiN1tpie8IrU=
+github.com/gsterjov/go-libsecret v0.0.0-20161001094733-a6f4afe4910c/go.mod h1:NMPJylDgVpX0MLRlPy15sqSwOFv/U1GZ2m21JhFfek0=
+github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
+github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
+github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
+github.com/hexops/gotextdiff v1.0.3 h1:gitA9+qJrrTCsiCl7+kh75nPqQt1cx4ZkudSTLoUqJM=
+github.com/hexops/gotextdiff v1.0.3/go.mod h1:pSWU5MAI3yDq+fZBTazCSJysOMbxWL1BSow5/V2vxeg=
 github.com/jmespath/go-jmespath v0.4.0 h1:BEgLn5cpjn8UN1mAw4NjwDrS35OdebyEtFe+9YPoQUg=
 github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo=
 github.com/jmespath/go-jmespath/internal/testify v1.5.1 h1:shLQSRRSCCPj3f2gpwzGwWFoC7ycTf1rcQZHOlsJ6N8=
 github.com/jmespath/go-jmespath/internal/testify v1.5.1/go.mod h1:L3OGu8Wl2/fWfCI6z80xFu9LTZmf1ZRjMHUOPmWr69U=
+github.com/kisielk/sqlstruct v0.0.0-20201105191214-5f3e10d3ab46/go.mod h1:yyMNCyc/Ib3bDTKd379tNMpB/7/H5TjM2Y9QJ5THLbE=
+github.com/klauspost/compress v1.17.7 h1:ehO88t2UGzQK66LMdE8tibEd1ErmzZjNEqWkjLAKQQg=
+github.com/klauspost/compress v1.17.7/go.mod h1:Di0epgTjJY877eYKx5yC51cX2A2Vl2ibi7bDH9ttBbw=
+github.com/klauspost/cpuid/v2 v2.2.7 h1:ZWSB3igEs+d0qvnxR/ZBzXVmxkgt8DdzP6m9pfuVLDM=
+github.com/klauspost/cpuid/v2 v2.2.7/go.mod h1:Lcz8mBdAVJIBVzewtcLocK12l3Y+JytZYpaMropDUws=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
+github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
+github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
+github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
+github.com/lib/pq v1.10.9 h1:YXG7RB+JIjhP29X+OtkiDnYaXQwpS4JEWq7dtCCRUEw=
+github.com/lib/pq v1.10.9/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
+github.com/miekg/dns v1.1.57 h1:Jzi7ApEIzwEPLHWRcafCN9LZSBbqQpxjt/wpgvg7wcM=
+github.com/miekg/dns v1.1.57/go.mod h1:uqRjCRUuEAA6qsOiJvDd+CFo/vW+y5WR6SNmHE55hZk=
+github.com/modocache/gover v0.0.0-20171022184752-b58185e213c5/go.mod h1:caMODM3PzxT8aQXRPkAt8xlV/e7d7w8GM5g0fa5F0D8=
+github.com/mtibben/percent v0.2.1 h1:5gssi8Nqo8QU/r2pynCm+hBQHpkB/uNK7BJCFogWdzs=
+github.com/mtibben/percent v0.2.1/go.mod h1:KG9uO+SZkUp+VkRHsCdYQV3XSZrrSpR3O9ibNBTZrns=
+github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
+github.com/open-policy-agent/opa v0.62.1 h1:UcxBQ0fe6NEjkYc775j4PWoUFFhx4f6yXKIKSTAuTVk=
+github.com/open-policy-agent/opa v0.62.1/go.mod h1:YqiSIIuvKwyomtnnXkJvy0E3KtVKbavjPJ/hNMuOmeM=
+github.com/pierrec/lz4/v4 v4.1.21 h1:yOVMLb6qSIDP67pl/5F7RepeKYu/VmTyEXvuMI5d9mQ=
+github.com/pierrec/lz4/v4 v4.1.21/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
+github.com/pkg/browser v0.0.0-20180916011732-0a3d74bf9ce4/go.mod h1:4OwLy04Bl9Ef3GJJCoec+30X3LQs/0/m4HFRt/2LUSA=
+github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c h1:+mdjkGKdHQG3305AYmdv1U2eRNDiU2ErMBj1gwrq8eQ=
+github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c/go.mod h1:7rwL4CYBLnjLxUqIJNnCWiEdr3bn6IUYi15bNlnbCCU=
+github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
+github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/prometheus/client_golang v1.19.0 h1:ygXvpU1AoN1MhdzckN+PyD9QJOSD4x7kmXYlnfbA6JU=
+github.com/prometheus/client_golang v1.19.0/go.mod h1:ZRM9uEAypZakd+q/x7+gmsvXdURP+DABIEIjnmDdp+k=
+github.com/prometheus/client_model v0.6.0 h1:k1v3CzpSRUTrKMppY35TLwPvxHqBu0bYgxZzqGIgaos=
+github.com/prometheus/client_model v0.6.0/go.mod h1:NTQHnmxFpouOD0DpvP4XujX3CdOAGQPoaGhyTchlyt8=
+github.com/prometheus/common v0.51.1 h1:eIjN50Bwglz6a/c3hAgSMcofL3nD+nFQkV6Dd4DsQCw=
+github.com/prometheus/common v0.51.1/go.mod h1:lrWtQx+iDfn2mbH5GUzlH9TSHyfZpHkSiG1W7y3sF2Q=
+github.com/prometheus/procfs v0.13.0 h1:GqzLlQyfsPbaEHaQkO7tbDlriv/4o5Hudv6OXHGKX7o=
+github.com/prometheus/procfs v0.13.0/go.mod h1:cd4PFCR54QLnGKPaKGA6l+cfuNXtht43ZKY6tow0Y1g=
+github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475 h1:N/ElC8H3+5XpJzTSTfLsJV/mx9Q9g7kxmchpfZyxgzM=
+github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475/go.mod h1:bCqnVzQkZxMG4s8nGwiZ5l3QUCyqpo9Y+/ZMZ9VjZe4=
+github.com/rogpeppe/go-internal v1.10.0 h1:TMyTOH3F/DB16zRVcYyreMH6GnZZrwQVAoYjRBZyWFQ=
+github.com/rogpeppe/go-internal v1.10.0/go.mod h1:UQnix2H7Ngw/k4C5ijL5+65zddjncjaFoBhdsK/akog=
+github.com/sijms/go-ora/v2 v2.8.10 h1:Ekhx0I+A9qVBy1eOLa2eIhHWWYwVTa0MM78KS6h+5fg=
+github.com/sijms/go-ora/v2 v2.8.10/go.mod h1:EHxlY6x7y9HAsdfumurRfTd+v8NrEOTR3Xl4FWlH6xk=
+github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
+github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
+github.com/snowflakedb/gosnowflake v1.8.0 h1:4bQj8eAYGMkou/nICiIEb9jSbBLDDp5cB6JaKx9WwiA=
+github.com/snowflakedb/gosnowflake v1.8.0/go.mod h1:7yyY2MxtDti2eXgtvlZ8QxzCN6KV2B4qb1HuygMI+0U=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
+github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
+github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
 github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
+github.com/tchap/go-patricia/v2 v2.3.1 h1:6rQp39lgIYZ+MHmdEq4xzuk1t7OdC35z/xm0BGhTkes=
+github.com/tchap/go-patricia/v2 v2.3.1/go.mod h1:VZRHKAb53DLaG+nA9EaYYiaEx6YztwDlLElMsnSHD4k=
+github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb h1:zGWFAtiMcyryUHoUjUJX0/lt1H2+i2Ka2n+D3DImSNo=
+github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
+github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 h1:EzJWgHovont7NscjpAxXsDA8S8BMYve8Y5+7cuRE7R0=
+github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415/go.mod h1:GwrjFmJcFw6At/Gs6z4yjiIwzuJ1/+UwLxMQDVQXShQ=
+github.com/yashtewari/glob-intersection v0.2.0 h1:8iuHdN88yYuCzCdjt0gDe+6bAhUwBeEWqThExu54RFg=
+github.com/yashtewari/glob-intersection v0.2.0/go.mod h1:LK7pIC3piUjovexikBbJ26Yml7g8xa5bsjfx2v1fwok=
+github.com/zeebo/assert v1.3.0 h1:g7C04CbJuIDKNPFHmsk4hwZDO5O+kntRxzaUoNXj+IQ=
+github.com/zeebo/assert v1.3.0/go.mod h1:Pq9JiuJQpG8JLJdtkwrJESF0Foym2/D9XMU5ciN/wJ0=
+github.com/zeebo/xxh3 v1.0.2 h1:xZmwmqxHZA8AI603jOQ0tMqmBr9lPeFwGg6d+xy9DC0=
+github.com/zeebo/xxh3 v1.0.2/go.mod h1:5NWz9Sef7zIDm2JHfFlcQvNekmcEl9ekUZQQKCYaDcA=
+go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
+go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.46.1 h1:aFJWCqJMNjENlcleuuOkGAPH82y0yULBScfXcIEdS24=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.46.1/go.mod h1:sEGXWArGqc3tVa+ekntsN65DmVbVeW+7lTKTjZF3/Fo=
+go.opentelemetry.io/otel v1.24.0 h1:0LAOdjNmQeSTzGBzduGe/rU4tZhMwL5rWgtp9Ku5Jfo=
+go.opentelemetry.io/otel v1.24.0/go.mod h1:W7b9Ozg4nkF5tWI5zsXkaKKDjdVjpD4oAt9Qi/MArHo=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.21.0 h1:cl5P5/GIfFh4t6xyruOgJP5QiA1pw4fYYdv6nc6CBWw=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.21.0/go.mod h1:zgBdWWAu7oEEMC06MMKc5NLbA/1YDXV1sMpSqEeLQLg=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.21.0 h1:tIqheXEFWAZ7O8A7m+J0aPTmpJN3YQ7qetUAdkkkKpk=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.21.0/go.mod h1:nUeKExfxAQVbiVFn32YXpXZZHZ61Cc3s3Rn1pDBGAb0=
+go.opentelemetry.io/otel/metric v1.24.0 h1:6EhoGWWK28x1fbpA4tYTOWBkPefTDQnb8WSGXlc88kI=
+go.opentelemetry.io/otel/metric v1.24.0/go.mod h1:VYhLe1rFfxuTXLgj4CBiyz+9WYBA8pNGJgDcSFRKBco=
+go.opentelemetry.io/otel/sdk v1.24.0 h1:YMPPDNymmQN3ZgczicBY3B6sf9n62Dlj9pWD3ucgoDw=
+go.opentelemetry.io/otel/sdk v1.24.0/go.mod h1:KVrIYw6tEubO9E96HQpcmpTKDVn9gdv35HoYiQWGDFg=
+go.opentelemetry.io/otel/trace v1.24.0 h1:CsKnnL4dUAr/0llH9FKuc698G04IrpWV0MQA/Y1YELI=
+go.opentelemetry.io/otel/trace v1.24.0/go.mod h1:HPc3Xr/cOApsBI154IU0OI0HJexz+aw5uPdbs3UCjNU=
+go.opentelemetry.io/proto/otlp v1.0.0 h1:T0TX0tmXU8a3CbNXzEKGeU5mIVOdf0oykP+u2lIVU/I=
+go.opentelemetry.io/proto/otlp v1.0.0/go.mod h1:Sy6pihPLfYHkr3NkUbEhGHFhINUSI/v80hjKIs5JXpM=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20201016220609-9e8e0b390897/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
+golang.org/x/crypto v0.21.0 h1:X31++rzVUdKhX5sWmSOFZxx8UW/ldWx55cbf08iNAMA=
+golang.org/x/crypto v0.21.0/go.mod h1:0BP7YvVV9gBbVKyeTG0Gyn+gZm94bibOW5BjDEYAOMs=
+golang.org/x/exp v0.0.0-20240325151524-a685a6edb6d8 h1:aAcj0Da7eBAtrTp03QXWvm88pSyOt+UgdZw2BFZ+lEw=
+golang.org/x/exp v0.0.0-20240325151524-a685a6edb6d8/go.mod h1:CQ1k9gNrJ50XIzaKCRR2hssIjF07kZFEiieALBM/ARQ=
+golang.org/x/mod v0.16.0 h1:QX4fJ0Rr5cPQCF7O9lh9Se4pmwfwskqZfq5moyldzic=
+golang.org/x/mod v0.16.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
+golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20210610132358-84b48f89b13b/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+golang.org/x/net v0.22.0 h1:9sGLhx7iRIHEiX0oAJ3MRZMUCElJgy7Br1nO+AMN3Tc=
+golang.org/x/net v0.22.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg=
+golang.org/x/sync v0.6.0 h1:5BMeUDZ7vkXGfEr1x9B4bRcTH4lpkTkpdh0T/J+qjbQ=
+golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.18.0 h1:DBdB3niSjOA/O0blCZBqDefyWNYveAYMNF1Wum0DYQ4=
+golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
+golang.org/x/term v0.18.0 h1:FcHjZXDMxI8mM3nwhX9HlKop4C0YQvCVCdwYl2wOtE8=
+golang.org/x/term v0.18.0/go.mod h1:ILwASektA3OnRv7amZ1xhE/KTR+u50pbXfZ03+6Nx58=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
+golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
+golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.19.0 h1:tfGCXNR1OsFG+sVdLAitlpjAvD/I6dHDKnYrpEZUHkw=
+golang.org/x/tools v0.19.0/go.mod h1:qoJWxmGSIBmAeriMx19ogtrEPrGtDbPK634QFIcLAhc=
+golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 h1:+cNy6SZtPcJQH3LJVLOSmiC7MMxXNOb3PU/VUEz+EhU=
+golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028/go.mod h1:NDW/Ps6MPRej6fsCIbMTohpP40sJ/P/vI1MoTEGwX90=
+gonum.org/v1/gonum v0.12.0 h1:xKuo6hzt+gMav00meVPUlXwSdoEJP46BR+wdxQEFK2o=
+gonum.org/v1/gonum v0.12.0/go.mod h1:73TDxJfAAHeA8Mk9mf8NlIppyhQNo5GLTcYeqgo2lvY=
+google.golang.org/genproto/googleapis/api v0.0.0-20240123012728-ef4313101c80 h1:Lj5rbfG876hIAYFjqiJnPHfhXbv+nzTWfm04Fg/XSVU=
+google.golang.org/genproto/googleapis/api v0.0.0-20240123012728-ef4313101c80/go.mod h1:4jWUdICTdgc3Ibxmr8nAJiiLHwQBY0UI0XZcEMaFKaA=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240123012728-ef4313101c80 h1:AjyfHzEPEFp/NpvfN5g+KDla3EMojjhRVZc1i7cj+oM=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240123012728-ef4313101c80/go.mod h1:PAREbraiVEVGVdTZsVWjSbbTtSyGbAgIIvni8a8CD5s=
+google.golang.org/grpc v1.62.0 h1:HQKZ/fa1bXkX1oFOvSjmZEUL8wLSaZTjCcLAlmZRtdk=
+google.golang.org/grpc v1.62.0/go.mod h1:IWTG0VlJLCh1SkC58F7np9ka9mx/WNkjl4PGJaiq+QE=
+google.golang.org/protobuf v1.33.0 h1:uNO2rsAINq/JlFpSdYEKIZ0uKD/R9cpdv0T+yoGwGmI=
+google.golang.org/protobuf v1.33.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20200902074654-038fdea0a05b/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+sigs.k8s.io/yaml v1.4.0 h1:Mk1wCc2gy/F0THH0TAp1QYyJNzRm2KCLy3o5ASXVI5E=
+sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY=
diff --git a/scan/scanner.go b/scan/scanner.go
index 7391d04..95ce39e 100644
--- a/scan/scanner.go
+++ b/scan/scanner.go
@@ -7,7 +7,7 @@ import (
 )
 
 // Scanner is an interface that should be implemented for a specific cloud
-// provider (e.g. AWS, GCP, etc). It defines the Scan method responsible for
+// provider (e.g. AWS, GCP, etc.). It defines the Scan method responsible for
 // scanning the existing data repositories of the corresponding cloud provider
 // environment.
 type Scanner interface {
@@ -19,7 +19,6 @@ type Scanner interface {
 type RepoType string
 
 const (
-	// Repo types
 	RepoTypeRDS        RepoType = "TYPE_RDS"
 	RepoTypeRedshift   RepoType = "TYPE_REDSHIFT"
 	RepoTypeDynamoDB   RepoType = "TYPE_DYNAMODB"

From b5051e89cac1d5b7d39e835169b853131dac6434 Mon Sep 17 00:00:00 2001
From: Chris Campo <ccampo133@users.noreply.github.com>
Date: Wed, 27 Mar 2024 16:06:18 -0400
Subject: [PATCH 02/14] Simplfy classification

---
 classification/classification.go              |  87 +---
 .../classification_fakeclassifier_test.go     | 213 --------
 classification/classification_test.go         | 315 ++++++++++++
 classification/examples/example_policy.rego   |  70 ---
 .../examples/example_policy_simple.rego       |  22 -
 classification/label.go                       | 116 ++++-
 classification/rego/address.rego              |  20 +-
 classification/rego/age.rego                  |   4 +-
 classification/rego/ccn.rego                  |   4 +-
 classification/rego/cvv.rego                  |  26 +-
 classification/rego/dob.rego                  |  18 +-
 classification/rego/email.rego                |   4 +-
 classification/rego/first_name.rego           |   6 +-
 classification/rego/full_name.rego            |   4 +-
 classification/rego/ip_address.rego           |   8 +-
 classification/rego/labels.yaml               |  18 +-
 classification/rego/last_name.rego            |   6 +-
 classification/rego/passport.rego             |   8 +-
 .../rego/{phone_number.rego => phone.rego}    |   4 +-
 ...phone_number_test.rego => phone_test.rego} |   0
 classification/rego/ssn.rego                  |   4 +-
 classification/rego_classifier.go             | 126 -----
 classification/rego_classifier_test.go        | 457 ------------------
 discovery/scanner.go                          |  22 +-
 24 files changed, 512 insertions(+), 1050 deletions(-)
 delete mode 100644 classification/classification_fakeclassifier_test.go
 create mode 100644 classification/classification_test.go
 delete mode 100644 classification/examples/example_policy.rego
 delete mode 100644 classification/examples/example_policy_simple.rego
 rename classification/rego/{phone_number.rego => phone.rego} (79%)
 rename classification/rego/{phone_number_test.rego => phone_test.rego} (100%)
 delete mode 100644 classification/rego_classifier.go
 delete mode 100644 classification/rego_classifier_test.go

diff --git a/classification/classification.go b/classification/classification.go
index 43682eb..4918e68 100644
--- a/classification/classification.go
+++ b/classification/classification.go
@@ -48,7 +48,7 @@ type Classifier interface {
 	) ([]Result, error)
 }
 
-// ClassifySamples uses the provided Classifier to classify the sample data
+// ClassifySamples uses the provided classifiers to classify the sample data
 // passed via the "samples" parameter. It is mostly a helper function which
 // loops through each repository.Sample, retrieves the attribute names and
 // values of that sample, passes them to Classifier.Classify, and then
@@ -57,8 +57,8 @@ type Classifier interface {
 // unique classification results for a given sample set.
 func ClassifySamples(
 	ctx context.Context,
-	classifier Classifier,
 	samples []repository.Sample,
+	classifiers ...Classifier,
 ) ([]Result, error) {
 	var classifications []Result
 	for _, sample := range samples {
@@ -70,84 +70,15 @@ func ClassifySamples(
 		}
 		// Classify each sampled row
 		for _, sampleResult := range sample.Results {
-			res, err := classifier.Classify(ctx, &table, sampleResult)
-			if err != nil {
-				return nil, fmt.Errorf("error classifying sample: %w", err)
+			for _, classifier := range classifiers {
+				res, err := classifier.Classify(ctx, &table, sampleResult)
+				if err != nil {
+					return nil, fmt.Errorf("error classifying sample: %w", err)
+				}
+				classifications = append(classifications, res...)
 			}
-			classifications = append(classifications, res...)
 		}
 	}
-	return combineAndDedupe(classifications), nil
-}
-
-// AggregateClassifySamples classifies the given samples with every classifier,
-// and returns the aggregate result slice. For details on how each
-// classification is executed, see ClassifySamples.
-func AggregateClassifySamples(
-	ctx context.Context,
-	classifiers map[string]Classifier,
-	samples []repository.Sample,
-) ([]Result, error) {
-	classifications := make([]Result, 0)
-	for _, classifier := range classifiers {
-		classified, err := ClassifySamples(ctx, classifier, samples)
-		if err != nil {
-			return nil, err
-		}
-		classifications = append(classifications, classified...)
-	}
+	// TODO: combine and dedupe -ccampo 2024-03-27
 	return classifications, nil
 }
-
-// combineAndDedupe takes a slice of Result and combines the individual elements
-// when they have the same schema/table/attribute, but different labels, into a
-// Result element with combined labels. Additionally, only distinct results by
-// schema, table, and attribute are present in the return slice.
-func combineAndDedupe(results []Result) []Result {
-	set := make(map[tableAttrLabel]bool)
-	distinctLabels := make(map[tableAttr][]*Label)
-	for _, result := range results {
-		for _, lbl := range result.Classifications {
-			key := tableAttrLabel{
-				ta: tableAttr{
-					table: *result.Table,
-					attr:  result.AttributeName,
-				},
-				label: lbl.Name,
-			}
-
-			if !set[key] {
-				set[key] = true
-				distinctLabels[key.ta] = append(distinctLabels[key.ta], lbl)
-			}
-		}
-	}
-
-	distinctResults := make([]Result, 0, len(distinctLabels))
-	for ta, labels := range distinctLabels {
-		result := Result{
-			Table: &ClassifiedTable{
-				Repo:    ta.table.Repo,
-				Catalog: ta.table.Catalog,
-				Schema:  ta.table.Schema,
-				Table:   ta.table.Table,
-			},
-			AttributeName:   ta.attr,
-			Classifications: labels,
-		}
-		distinctResults = append(distinctResults, result)
-	}
-
-	return distinctResults
-}
-
-// Both tableAttr and tableAttrLabel are only used as map keys
-type tableAttr struct {
-	table ClassifiedTable
-	attr  string
-}
-
-type tableAttrLabel struct {
-	ta    tableAttr
-	label string
-}
diff --git a/classification/classification_fakeclassifier_test.go b/classification/classification_fakeclassifier_test.go
deleted file mode 100644
index 5e41169..0000000
--- a/classification/classification_fakeclassifier_test.go
+++ /dev/null
@@ -1,213 +0,0 @@
-package classification
-
-import (
-	"context"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-
-	"github.com/cyralinc/dmap/discovery/repository"
-)
-
-type classifyFunc func(table *ClassifiedTable, attrs map[string]any) ([]Result, error)
-
-type fakeClassifier struct {
-	classify classifyFunc
-}
-
-var _ Classifier = (*fakeClassifier)(nil)
-
-func (f fakeClassifier) Classify(
-	_ context.Context,
-	table *ClassifiedTable,
-	attrs map[string]any,
-) ([]Result, error) {
-	return f.classify(table, attrs)
-}
-
-func Test_Classify_FakeClassifier_SingleSample(t *testing.T) {
-	sample := repository.Sample{
-		Metadata: repository.SampleMetadata{
-			Repo:     repoName,
-			Database: catalogName,
-			Schema:   schemaName,
-			Table:    tableName,
-		},
-		Results: []repository.SampleResult{
-			{
-				"age":             "52",
-				"social_sec_num":  "512-23-4256",
-				"credit_card_num": "4111111111111111",
-			},
-			{
-				"age":             "53",
-				"social_sec_num":  "512-23-4258",
-				"credit_card_num": "4111111111111111",
-			},
-		},
-	}
-
-	table := ClassifiedTable{
-		Repo:    repoName,
-		Catalog: catalogName,
-		Schema:  schemaName,
-		Table:   tableName,
-	}
-
-	expected := []Result{
-		{
-			Table:           &table,
-			AttributeName:   "age",
-			Classifications: []*Label{{Name: "PII"}},
-		},
-		{
-			Table:           &table,
-			AttributeName:   "social_sec_num",
-			Classifications: []*Label{{Name: "PII"}, {Name: "PRIVATE"}},
-		},
-		{
-			Table:           &table,
-			AttributeName:   "credit_card_num",
-			Classifications: []*Label{{Name: "PII"}, {Name: "CCN"}, {Name: "PCI"}},
-		},
-	}
-
-	classifier := fakeClassifier{
-		classify: func(
-			table *ClassifiedTable,
-			attrs map[string]any,
-		) ([]Result, error) {
-			return expected, nil
-		},
-	}
-
-	actual, err := ClassifySamples(context.Background(), classifier, []repository.Sample{sample})
-	assert.NoError(t, err)
-	assert.ElementsMatch(t, expected, actual)
-}
-
-func Test_AggregateClassify_FakeClassifier_MultipleSamples(t *testing.T) {
-	tableName1 := tableName + "1"
-	tableName2 := tableName + "2"
-	ageAttr := "age"
-	ssnAttr := "social_sec_num"
-	ccnAttr := "credit_card_num"
-	samples := []repository.Sample{
-		{
-			Metadata: repository.SampleMetadata{
-				Repo:     repoName,
-				Database: catalogName,
-				Schema:   schemaName,
-				Table:    tableName1,
-			},
-			Results: []repository.SampleResult{
-				{
-					ageAttr: "52",
-					ssnAttr: "512-23-4256",
-					ccnAttr: "4111111111111111",
-				},
-				{
-					ageAttr: "53",
-					ssnAttr: "512-23-4258",
-					ccnAttr: "4111111111111111",
-				},
-			},
-		},
-		{
-			Metadata: repository.SampleMetadata{
-				Repo:     repoName,
-				Database: catalogName,
-				Schema:   schemaName,
-				Table:    tableName2,
-			},
-			Results: []repository.SampleResult{
-				{
-					ageAttr: "21",
-					ssnAttr: "123-45-6789",
-					ccnAttr: "0123456789012345",
-				},
-				{
-					ageAttr: "22",
-					ssnAttr: "987-65-4321",
-					ccnAttr: "0123456789012345",
-				},
-			},
-		},
-	}
-
-	table1 := ClassifiedTable{
-		Repo:    repoName,
-		Catalog: catalogName,
-		Schema:  schemaName,
-		Table:   tableName1,
-	}
-	table2 := ClassifiedTable{
-		Repo:    repoName,
-		Catalog: catalogName,
-		Schema:  schemaName,
-		Table:   tableName2,
-	}
-
-	expectedFromClassifier1 := []Result{
-		{
-			Table:           &table1,
-			AttributeName:   ageAttr,
-			Classifications: []*Label{{Name: "PII"}},
-		},
-		{
-			Table:           &table1,
-			AttributeName:   ssnAttr,
-			Classifications: []*Label{{Name: "PII"}, {Name: "PRIVATE"}},
-		},
-		{
-			Table:           &table1,
-			AttributeName:   ccnAttr,
-			Classifications: []*Label{{Name: "PII"}, {Name: "CCN"}, {Name: "PCI"}},
-		},
-	}
-	expectedFromClassifier2 := []Result{
-		{
-			Table:           &table2,
-			AttributeName:   ageAttr,
-			Classifications: []*Label{{Name: "PII"}},
-		},
-		{
-			Table:           &table2,
-			AttributeName:   ssnAttr,
-			Classifications: []*Label{{Name: "PII"}, {Name: "PRIVATE"}},
-		},
-		{
-			Table:           &table2,
-			AttributeName:   ccnAttr,
-			Classifications: []*Label{{Name: "PII"}, {Name: "CCN"}, {Name: "PCI"}},
-		},
-	}
-	expected := append(expectedFromClassifier1, expectedFromClassifier2...)
-
-	classifiers := map[string]Classifier{
-		"classifier1": Classifier(
-			fakeClassifier{
-				classify: func(
-					table *ClassifiedTable,
-					attrs map[string]any,
-				) ([]Result, error) {
-					return expectedFromClassifier1, nil
-				},
-			},
-		),
-		"classifier2": Classifier(
-			fakeClassifier{
-				classify: func(
-					table *ClassifiedTable,
-					attrs map[string]any,
-				) ([]Result, error) {
-					return expectedFromClassifier2, nil
-				},
-			},
-		),
-	}
-
-	actual, err := AggregateClassifySamples(context.Background(), classifiers, samples)
-	assert.NoError(t, err)
-	assert.ElementsMatch(t, expected, actual)
-}
diff --git a/classification/classification_test.go b/classification/classification_test.go
new file mode 100644
index 0000000..52704d5
--- /dev/null
+++ b/classification/classification_test.go
@@ -0,0 +1,315 @@
+package classification
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/cyralinc/dmap/discovery/repository"
+)
+
+func TestClassifySamples_SingleSample(t *testing.T) {
+	repoName := "repoName"
+	catalogName := "catalogName"
+	schemaName := "schema"
+	tableName := "table"
+
+	sample := repository.Sample{
+		Metadata: repository.SampleMetadata{
+			Repo:     repoName,
+			Database: catalogName,
+			Schema:   schemaName,
+			Table:    tableName,
+		},
+		Results: []repository.SampleResult{
+			{
+				"age":             "52",
+				"social_sec_num":  "512-23-4256",
+				"credit_card_num": "4111111111111111",
+			},
+			{
+				"age":             "4111111111111111",
+				"social_sec_num":  "512-23-4258",
+				"credit_card_num": "4111111111111111",
+			},
+		},
+	}
+
+	classifiers := []Classifier{
+		newTestLabelClassifier(t, "AGE"),
+		newTestLabelClassifier(t, "CCN"),
+	}
+
+	actual, err := ClassifySamples(
+		context.Background(),
+		[]repository.Sample{sample},
+		classifiers...,
+	)
+	require.NoError(t, err)
+
+	table := &ClassifiedTable{
+		Repo:    repoName,
+		Catalog: catalogName,
+		Schema:  schemaName,
+		Table:   tableName,
+	}
+
+	expected := []Result{
+		{
+			Table:           table,
+			AttributeName:   "age",
+			Classifications: []*Label{{Name: "AGE"}},
+		},
+		{
+			Table:           table,
+			AttributeName:   "credit_card_num",
+			Classifications: []*Label{{Name: "CCN"}},
+		},
+		{
+			Table:           table,
+			AttributeName:   "age",
+			Classifications: []*Label{{Name: "CCN"}},
+		},
+	}
+
+	require.Len(t, actual, len(expected))
+
+	for i, got := range actual {
+		want := expected[i]
+		require.Equal(t, want.Table, got.Table)
+		require.Equal(t, want.AttributeName, got.AttributeName)
+		require.Len(t, got.Classifications, len(want.Classifications))
+		for j, cl := range got.Classifications {
+			wantCl := want.Classifications[j]
+			require.Equal(t, wantCl.Name, cl.Name)
+		}
+	}
+}
+
+func TestClassifySamples_MultipleSamples(t *testing.T) {
+	repoName := "repoName"
+	catalogName := "catalogName"
+	schemaName := "schema"
+	tableName := "table"
+
+	metadata1 := repository.SampleMetadata{
+		Repo:     repoName,
+		Database: catalogName,
+		Schema:   schemaName,
+		Table:    tableName,
+	}
+
+	metadata2 := repository.SampleMetadata{
+		Repo:     repoName,
+		Database: catalogName,
+		Schema:   schemaName + "2",
+		Table:    tableName + "2",
+	}
+
+	samples := []repository.Sample{
+		{
+			Metadata: metadata1,
+			Results: []repository.SampleResult{
+				{
+					"age":             "52",
+					"social_sec_num":  "512-23-4256",
+					"credit_card_num": "4111111111111111",
+				},
+			},
+		},
+		{
+			Metadata: metadata1,
+			Results: []repository.SampleResult{
+				{
+					"age":             "52",
+					"social_sec_num":  "512-23-4256",
+					"credit_card_num": "4111111111111112",
+				},
+			},
+		},
+		{
+			Metadata: metadata2,
+			Results: []repository.SampleResult{
+				{
+					"age":             "52",
+					"name":            "Joe Smith",
+					"social_sec_num":  "512-23-4256",
+					"credit_card_num": "4111111111111112",
+				},
+				{
+					"age":             "4111111111111113",
+					"name":            "Joe Smith",
+					"social_sec_num":  "512-23-4256",
+					"credit_card_num": "4111111111111112",
+				},
+			},
+		},
+	}
+
+	classifiers := []Classifier{
+		newTestLabelClassifier(t, "AGE"),
+		newTestLabelClassifier(t, "CCN"),
+	}
+
+	actual, err := ClassifySamples(context.Background(), samples, classifiers...)
+	require.NoError(t, err)
+
+	table1 := &ClassifiedTable{
+		Repo:    metadata1.Repo,
+		Catalog: metadata1.Database,
+		Schema:  metadata1.Schema,
+		Table:   metadata1.Table,
+	}
+
+	table2 := &ClassifiedTable{
+		Repo:    metadata2.Repo,
+		Catalog: metadata2.Database,
+		Schema:  metadata2.Schema,
+		Table:   metadata2.Table,
+	}
+
+	expected := []Result{
+		{
+			Table:           table1,
+			AttributeName:   "age",
+			Classifications: []*Label{{Name: "AGE"}},
+		},
+		{
+			Table:           table2,
+			AttributeName:   "age",
+			Classifications: []*Label{{Name: "AGE"}},
+		},
+		{
+			Table:           table1,
+			AttributeName:   "credit_card_num",
+			Classifications: []*Label{{Name: "CCN"}},
+		},
+		{
+			Table:           table2,
+			AttributeName:   "credit_card_num",
+			Classifications: []*Label{{Name: "CCN"}},
+		},
+		{
+			Table:           table2,
+			AttributeName:   "age",
+			Classifications: []*Label{{Name: "CCN"}},
+		},
+	}
+	require.Len(t, actual, len(expected))
+
+	for i, got := range actual {
+		want := expected[i]
+		require.Equal(t, want.Table, got.Table)
+		require.Equal(t, want.AttributeName, got.AttributeName)
+		require.Len(t, got.Classifications, len(want.Classifications))
+		for j, cl := range got.Classifications {
+			wantCl := want.Classifications[j]
+			require.Equal(t, wantCl.Name, cl.Name)
+		}
+	}
+}
+
+type classifyFunc func(table *ClassifiedTable, attrs map[string]any) ([]Result, error)
+
+type fakeClassifier struct {
+	classify classifyFunc
+}
+
+var _ Classifier = (*fakeClassifier)(nil)
+
+func (f fakeClassifier) Classify(
+	_ context.Context,
+	table *ClassifiedTable,
+	attrs map[string]any,
+) ([]Result, error) {
+	return f.classify(table, attrs)
+}
+
+func TestClassifySamples_FakeClassifier_SingleSample(t *testing.T) {
+	repoName := "repoName"
+	catalogName := "catalogName"
+	schemaName := "schema"
+	tableName := "table"
+
+	sample := repository.Sample{
+		Metadata: repository.SampleMetadata{
+			Repo:     repoName,
+			Database: catalogName,
+			Schema:   schemaName,
+			Table:    tableName,
+		},
+		Results: []repository.SampleResult{
+			{
+				"age":             "52",
+				"social_sec_num":  "512-23-4256",
+				"credit_card_num": "4111111111111111",
+			},
+			{
+				"age":             "53",
+				"social_sec_num":  "512-23-4258",
+				"credit_card_num": "4111111111111111",
+			},
+		},
+	}
+
+	table := ClassifiedTable{
+		Repo:    repoName,
+		Catalog: catalogName,
+		Schema:  schemaName,
+		Table:   tableName,
+	}
+
+	expected := []Result{
+		{
+			Table:           &table,
+			AttributeName:   "age",
+			Classifications: []*Label{{Name: "PII"}},
+		},
+		{
+			Table:           &table,
+			AttributeName:   "social_sec_num",
+			Classifications: []*Label{{Name: "PII"}, {Name: "PRIVATE"}},
+		},
+		{
+			Table:           &table,
+			AttributeName:   "credit_card_num",
+			Classifications: []*Label{{Name: "PII"}, {Name: "CCN"}, {Name: "PCI"}},
+		},
+	}
+
+	classifier := fakeClassifier{
+		classify: func(
+			table *ClassifiedTable,
+			attrs map[string]any,
+		) ([]Result, error) {
+			return expected, nil
+		},
+	}
+
+	actual, err := ClassifySamples(
+		context.Background(),
+		[]repository.Sample{sample},
+		classifier,
+	)
+	assert.NoError(t, err)
+	assert.ElementsMatch(t, expected, actual)
+}
+
+func newTestLabelClassifier(t *testing.T, lblName string) Classifier {
+	fname := fmt.Sprintf("./rego/%s.rego", strings.ToLower(lblName))
+	fin, err := os.ReadFile(fname)
+	require.NoError(t, err)
+	classifierCode := string(fin)
+	lbl := Label{
+		Name:               lblName,
+		ClassificationRule: classifierCode,
+	}
+	classifier, err := NewLabelClassifier(&lbl)
+	require.NoError(t, err)
+	return classifier
+}
diff --git a/classification/examples/example_policy.rego b/classification/examples/example_policy.rego
deleted file mode 100644
index f872855..0000000
--- a/classification/examples/example_policy.rego
+++ /dev/null
@@ -1,70 +0,0 @@
-package classifier
-
-import rego.v1
-
-output[k] := v if {
-	some k in object.keys(input)
-	v := classify(k, input[k])
-}
-
-default classify(_, _) := "UNLABELED"
-
-classify(_, val) := "EMAIL" if {
-	regex.match(
-		`\A[A-Za-z0-9][A-Za-z0-9._%+-]*@[A-Za-z0-9]((\.[A-Za-z0-9])|(-[A-Za-z0-9])|[A-Za-z0-9])*\.[A-Za-z]{2,}\z`,
-		val
-	)
-}
-
-classify(_, val) := "PHONE" if {
-	regex.match(
-		`\A((1(-| )?((\([2-9]\d{2}\))|([2-9]\d{2})))|([2-9]\d{2})|(\([2-9]\d{2}\)))(-| )?[2-9]((1[02-9])|([02-9]\d))(-| )?\d{4}\z`,
-		val
-	)
-}
-
-classify(_, val) := "SSN" if {
-	regex.match(
-		`\A((((66[0-57-9])|(6[0-57-7]\d)|(00[1-9])|(0[1-9]\d)|([1-578]\d{2}))-((0[1-9])|([1-9]\d))-((000[1-9])|(00[1-9]\d)|(0[1-9]\d{2})|([1-9]\d{3})))|(((66[0-57-9])|(6[0-57-7]\d)|(00[1-9])|(0[1-9]\d)|([1-578]\d{2}))+((0[1-9])|([1-9]\d))+((000[1-9])|(00[1-9]\d)|(0[1-9]\d{2})|([1-9]\d{3})))|(((66[0-57-9])|(6[0-57-7]\d)|(00[1-9])|(0[1-9]\d)|([1-578]\d{2}))\.((0[1-9])|([1-9]\d))\.((000[1-9])|(00[1-9]\d)|(0[1-9]\d{2})|([1-9]\d{3})))|(((66[0-57-9])|(6[0-57-7]\d)|(00[1-9])|(0[1-9]\d)|([1-578]\d{2}))((0[1-9])|([1-9]\d))((000[1-9])|(00[1-9]\d)|(0[1-9]\d{2})|([1-9]\d{3}))))\z`,
-		val
-	)
-}
-
-classify(_, val) := "CCN" if {
-	regex.match(
-		`\A(4[0-9]{3}[0-9]{4}[0-9]{4}[0-9](?:[0-9]{3})?|[0-9]{4}[-][0-9]{4}[-][0-9]{4}[-][0-9]{4}|5[1-5][0-9]{2}[0-9]{4}[0-9]{4}[0-9]{4}|3[47][0-9]{13}|3(?:0[0-5]|[68][0-9])[0-9]{11}|6(?:011|5[0-9]{2})[0-9]{12}|(?:2131|1800|35\d{3})\d{11})\z`,
-		val
-	)
-}
-
-classify(_, val) := "IP_ADDRESS" if {
-	regex.match(
-		`\A(?:(?:[0-9A-Fa-f]{1,4}:){6}(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|::(?:[0-9A-Fa-f]{1,4}:){5}(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|(?:[0-9A-Fa-f]{1,4})?::(?:[0-9A-Fa-f]{1,4}:){4}(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4})?::(?:[0-9A-Fa-f]{1,4}:){3}(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|(?:(?:[0-9A-Fa-f]{1,4}:){,2}[0-9A-Fa-f]{1,4})?::(?:[0-9A-Fa-f]{1,4}:){2}(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|(?:(?:[0-9A-Fa-f]{1,4}:){,3}[0-9A-Fa-f]{1,4})?::[0-9A-Fa-f]{1,4}:(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|(?:(?:[0-9A-Fa-f]{1,4}:){,4}[0-9A-Fa-f]{1,4})?::(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|(?:(?:[0-9A-Fa-f]{1,4}:){,5}[0-9A-Fa-f]{1,4})?::[0-9A-Fa-f]{1,4}|(?:(?:[0-9A-Fa-f]{1,4}:){,6}[0-9A-Fa-f]{1,4})?::)\z`,
-		val
-	)
-}
-
-classify(key, val) := "AGE" if {
-	lower(key) == "age"
-	regex.match(`\A((\d{1,2})|1[0-1]\d)\z`, val)
-}
-
-classify(key, _) := "ADDRESS" if {
-	regex.match(`\A.*address.*\z`, lower(key))
-}
-
-classify(key, _) := "ADDRESS" if {
-	regex.match(`\Astreet.*\z`, lower(key))
-}
-
-classify(key, _) := "ADDRESS" if {
-	lower(key) == "state"
-}
-
-classify(key, _) := "ADDRESS" if {
-	lower(key) == "zip"
-}
-
-classify(key, _) := "ADDRESS" if {
-	lower(key) == "zipcode"
-}
diff --git a/classification/examples/example_policy_simple.rego b/classification/examples/example_policy_simple.rego
deleted file mode 100644
index 9a2c312..0000000
--- a/classification/examples/example_policy_simple.rego
+++ /dev/null
@@ -1,22 +0,0 @@
-package classifier
-
-import rego.v1
-
-output[k] := v if {
-	some k in object.keys(input)
-	v := classify(k, input[k])
-}
-
-default classify(_, _) := "UNLABELED"
-
-classify(_, val) := "CCN" if {
-	regex.match(
-		`\A(4[0-9]{3}[0-9]{4}[0-9]{4}[0-9](?:[0-9]{3})?|[0-9]{4}[-][0-9]{4}[-][0-9]{4}[-][0-9]{4}|5[1-5][0-9]{2}[0-9]{4}[0-9]{4}[0-9]{4}|3[47][0-9]{13}|3(?:0[0-5]|[68][0-9])[0-9]{11}|6(?:011|5[0-9]{2})[0-9]{12}|(?:2131|1800|35\d{3})\d{11})\z`,
-		val
-	)
-}
-
-classify(key, val) := "AGE" if {
-	contains(lower(key), "age")
-	regex.match(`\A((\d{1,2})|1[0-1]\d)\z`, val)
-}
diff --git a/classification/label.go b/classification/label.go
index 42709fb..499f0f8 100644
--- a/classification/label.go
+++ b/classification/label.go
@@ -5,6 +5,11 @@ import (
 	"fmt"
 	"strings"
 
+	"context"
+
+	"github.com/open-policy-agent/opa/ast"
+	"github.com/open-policy-agent/opa/rego"
+	log "github.com/sirupsen/logrus"
 	"gopkg.in/yaml.v3"
 )
 
@@ -22,22 +27,123 @@ var regoFs embed.FS
 //go:embed rego/labels.yaml
 var labelsYaml string
 
-// GetLabels returns a slice of all known labels defined in the labels.yaml
-// file.
-func GetLabels() ([]*Label, error) {
+// TODO: godoc -ccampo 2024-03-27
+func GetEmbeddedLabelClassifiers() ([]*LabelClassifier, error) {
 	lbls := struct {
 		Labels []*Label `yaml:"labels"`
 	}{}
 	if err := yaml.Unmarshal([]byte(labelsYaml), &lbls); err != nil {
 		return nil, fmt.Errorf("error unmarshalling labels.yaml: %w", err)
 	}
-	for _, lbl := range lbls.Labels {
+	classifiers := make([]*LabelClassifier, len(lbls.Labels))
+	for i, lbl := range lbls.Labels {
 		fname := "rego/" + strings.ReplaceAll(strings.ToLower(lbl.Name), " ", "_") + ".rego"
 		b, err := regoFs.ReadFile(fname)
 		if err != nil {
 			return nil, fmt.Errorf("error reading rego file %s: %w", fname, err)
 		}
 		lbl.ClassificationRule = string(b)
+		classifier, err := NewLabelClassifier(lbl)
+		if err != nil {
+			return nil, fmt.Errorf("unable to initialize classifier for label %s: %w", lbl.Name, err)
+		}
+		classifiers[i] = classifier
+	}
+	return classifiers, nil
+}
+
+// TODO: godoc -ccampo 2024-03-26
+type LabelClassifier struct {
+	lbl           *Label
+	preparedQuery rego.PreparedEvalQuery
+}
+
+// *LabelClassifier implements Classifier
+var _ Classifier = (*LabelClassifier)(nil)
+
+// TODO: godoc -ccampo 2024-03-26
+func NewLabelClassifier(lbl *Label) (*LabelClassifier, error) {
+	if lbl == nil {
+		return nil, fmt.Errorf("label cannot be nil")
+	}
+	q, err := prepareClassifierCode(lbl.ClassificationRule)
+	if err != nil {
+		return nil, err
+	}
+	return &LabelClassifier{lbl: lbl, preparedQuery: q}, nil
+}
+
+// TODO: godoc -ccampo 2024-03-26
+func (c *LabelClassifier) Classify(
+	_ context.Context,
+	table *ClassifiedTable,
+	attrs map[string]any,
+) ([]Result, error) {
+	if c == nil || len(attrs) == 0 {
+		return nil, fmt.Errorf("invalid arguments; classifier or attributes are nil/empty")
+	}
+
+	res, err := c.preparedQuery.Eval(context.Background(), rego.EvalInput(attrs))
+	if err != nil {
+		return nil, fmt.Errorf(
+			"[classifier %s] error evaluating query for inputs %s; %w", c.lbl.Name, attrs, err,
+		)
+	}
+
+	if len(res) != 1 || len(res[0].Expressions) != 1 {
+		return nil, fmt.Errorf(
+			"[classifier %s] received malformed result in classification eval - expected 1 result with 1 expression result, but found: '%s'",
+			c.lbl.Name,
+			res,
+		)
+	}
+	log.Debugf("[classifier %s] results: '%s'", c.lbl.Name, res)
+
+	exprValue := res[0].Expressions[0]
+	if exprValue == nil {
+		return nil, fmt.Errorf("[classifier %s] expression value is nil", c.lbl.Name)
+	}
+
+	output, ok := res[0].Expressions[0].Value.(map[string]any)
+	if !ok {
+		return nil, fmt.Errorf(
+			"[classifier %s] expected output type to be map[string]any, but found: %T",
+			c.lbl.Name,
+			res[0].Expressions[0].Value,
+		)
+	}
+
+	// TODO: comment explaining this -ccampo 2024-03-27
+	classifications := make([]Result, 0, len(output))
+	i := 0
+	for attrName, v := range output {
+		if v, ok := v.(bool); v && ok {
+			classifications[i] = Result{
+				Table:           table,
+				AttributeName:   attrName,
+				Classifications: []*Label{c.lbl},
+			}
+			i++
+		}
+	}
+
+	return classifications, nil
+}
+
+func prepareClassifierCode(classifierCode string) (rego.PreparedEvalQuery, error) {
+	log.Tracef("classifier module code: '%s'", classifierCode)
+	moduleName := "classifier"
+	compiledRego, err := ast.CompileModules(map[string]string{moduleName: classifierCode})
+	if err != nil {
+		return rego.PreparedEvalQuery{}, fmt.Errorf("error compiling rego code: %w", err)
+	}
+	regoQuery := compiledRego.Modules[moduleName].Package.Path.String() + ".output"
+	retVal, err := rego.New(
+		rego.Query(regoQuery),
+		rego.Compiler(compiledRego),
+	).PrepareForEval(context.Background())
+	if err != nil {
+		return rego.PreparedEvalQuery{}, fmt.Errorf("error preparing rego code for evaluation: %w", err)
 	}
-	return lbls.Labels, nil
+	return retVal, nil
 }
diff --git a/classification/rego/address.rego b/classification/rego/address.rego
index e61d882..41c766e 100644
--- a/classification/rego/address.rego
+++ b/classification/rego/address.rego
@@ -7,28 +7,30 @@ output[k] := v if {
 	v := classify(k, input[k])
 }
 
-default classify(_, _) := "UNLABELED"
+default classify(_, _) := false
 
-classify(key, _) := "ADDRESS" if {
+classify(key, _) if {
 	lower(key) == "state"
 }
 
-classify(key, _) := "ADDRESS" if {
+classify(key, _) if {
 	lower(key) == "zip"
 }
 
-classify(key, _) := "ADDRESS" if {
-	lower(key) == "zipcode"
+classify(key, _) if {
+	contains(lower(key), "zip")
+	contains(lower(key), "code")
 }
 
-classify(key, _) := "ADDRESS" if {
-	lower(key) == "zipcode"
+classify(key, _) if {
+	contains(lower(key), "postal")
+	contains(lower(key), "code")
 }
 
-classify(key, _) := "ADDRESS" if {
+classify(key, _) if {
 	regex.match(`\A.*address.*\z`, lower(key))
 }
 
-classify(key, _) := "ADDRESS" if {
+classify(key, _) if {
 	regex.match(`\Astreet.*\z`, lower(key))
 }
diff --git a/classification/rego/age.rego b/classification/rego/age.rego
index 6797bd1..f6239ac 100644
--- a/classification/rego/age.rego
+++ b/classification/rego/age.rego
@@ -7,9 +7,9 @@ output[k] := v if {
 	v := classify(k, input[k])
 }
 
-default classify(_, _) := "UNLABELED"
+default classify(_, _) := false
 
-classify(key, val) := "AGE" if {
+classify(key, val) if {
 	lower(key) == "age"
 	regex.match(`\A((\d{1,2})|1[0-1]\d)\z`, val)
 }
diff --git a/classification/rego/ccn.rego b/classification/rego/ccn.rego
index 5c8d343..9833777 100644
--- a/classification/rego/ccn.rego
+++ b/classification/rego/ccn.rego
@@ -7,9 +7,9 @@ output[k] := v if {
 	v := classify(k, input[k])
 }
 
-default classify(_, _) := "UNLABELED"
+default classify(_, _) := false
 
-classify(_, val) := "CCN" if {
+classify(_, val) if {
 	regex.match(
 		`\A(?:4[0-9]{12}(?:[0-9]{3})?|[25][1-7][0-9]{14}|6(?:011|5[0-9][0-9])[0-9]{12}|3[47][0-9]{13}|3(?:0[0-5]|[68][0-9])[0-9]{11}|(?:2131|1800|35\d{3})\d{11})\z`,
 		val
diff --git a/classification/rego/cvv.rego b/classification/rego/cvv.rego
index 075b705..b1c670d 100644
--- a/classification/rego/cvv.rego
+++ b/classification/rego/cvv.rego
@@ -7,52 +7,52 @@ output[k] := v if {
 	v := classify(k, input[k])
 }
 
-default classify(_, _) := "UNLABELED"
+default classify(_, _) := false
 
-classify(key, _) := "CVV" if {
+classify(key, _) if {
 	lower(key) == "cvv"
 }
 
-classify(key, _) := "CVV" if {
+classify(key, _) if {
 	lower(key) == "csc"
 }
 
-classify(key, _) := "CVV" if {
+classify(key, _) if {
 	lower(key) == "3csc"
 }
 
-classify(key, _) := "CVV" if {
+classify(key, _) if {
 	lower(key) == "cvc"
 }
 
-classify(key, _) := "CVV" if {
+classify(key, _) if {
 	lower(key) == "cav"
 }
 
-classify(key, _) := "CVV" if {
+classify(key, _) if {
 	lower(key) == "cid"
 }
 
-classify(key, _) := "CVV" if {
+classify(key, _) if {
 	lower(key) == "cvd"
 }
 
-classify(key, _) := "CVV" if {
+classify(key, _) if {
 	lower(key) == "cve"
 }
 
-classify(key, _) := "CVV" if {
+classify(key, _) if {
 	lower(key) == "cvn"
 }
 
-classify(key, _) := "CVV" if {
+classify(key, _) if {
 	lower(key) == "spc"
 }
 
-classify(key, _) := "CVV" if {
+classify(key, _) if {
 	lower(key) == "pvv"
 }
 
-classify(_, val) := "CVV" if {
+classify(_, val) if {
 	regex.match(`^\d{3,4}$`, val)
 }
diff --git a/classification/rego/dob.rego b/classification/rego/dob.rego
index 424e079..ec7e123 100644
--- a/classification/rego/dob.rego
+++ b/classification/rego/dob.rego
@@ -7,39 +7,39 @@ output[k] := v if {
 	v := classify(k, input[k])
 }
 
-default classify(_, _) := "UNLABELED"
+default classify(_, _) := false
 
-classify(key, _) := "DOB" if {
+classify(key, _) if {
 	lower(key) == "dob"
 }
 
-classify(key, _) := "DOB" if {
+classify(key, _) if {
 	lower(key) == "dateofbirth"
 }
 
-classify(key, _) := "DOB" if {
+classify(key, _) if {
 	lower(key) == "date_of_birth"
 }
 
-classify(key, _) := "DOB" if {
+classify(key, _) if {
 	lower(key) == "birthdate"
 }
 
-classify(key, _) := "DOB" if {
+classify(key, _) if {
 	lower(key) == "birth_date"
 }
 
-classify(_, val) := "DOB" if {
+classify(_, val) if {
 	# mm/dd/yyyy mm-dd-yyyy mm.dd.yyyy
 	regex.match(`^(0?[1-9]|1[0-2])[\/\.-](0?[1-9]|[12]\d|3[01])[\/\.-](19|20)\d{2}$`, val)
 }
 
-classify(_, val) := "DOB" if {
+classify(_, val) if {
 	# dd/mm/yyyy
 	regex.match(`^(0?[1-9]|[12]\d|3[01])[\/\.-](0?[1-9]|1[0-2])[\/\.-](19|20)\d{2}$`, val)
 }
 
-classify(_, val) := "DOB" if {
+classify(_, val) if {
 	# yyyy/mm/dd
 	regex.match(`^(19|20)\d{2}[\/\.-](0?[1-9]|1[0-2])[\/\.-](0?[1-9]|[12]\d|3[01])$`, val)
 }
diff --git a/classification/rego/email.rego b/classification/rego/email.rego
index 821cfd8..c62946f 100644
--- a/classification/rego/email.rego
+++ b/classification/rego/email.rego
@@ -7,9 +7,9 @@ output[k] := v if {
 	v := classify(k, input[k])
 }
 
-default classify(_, _) := "UNLABELED"
+default classify(_, _) := false
 
-classify(_, val) := "EMAIL" if {
+classify(_, val) if {
 	regex.match(
 		`\A[A-Za-z0-9][A-Za-z0-9._%+-]*@[A-Za-z0-9]((\.[A-Za-z0-9])|(-[A-Za-z0-9])|[A-Za-z0-9])*\.[A-Za-z]{2,}\z`,
 		val
diff --git a/classification/rego/first_name.rego b/classification/rego/first_name.rego
index 0052607..58ac065 100644
--- a/classification/rego/first_name.rego
+++ b/classification/rego/first_name.rego
@@ -7,14 +7,14 @@ output[k] := v if {
 	v := classify(k, input[k])
 }
 
-default classify(_, _) := "UNLABELED"
+default classify(_, _) := false
 
-classify(key, _) := "FIRST_NAME" if {
+classify(key, _) if {
 	contains(lower(key), "first")
 	contains(lower(key), "name")
 }
 
-classify(key, _) := "FIRST_NAME" if {
+classify(key, _) if {
 	contains(lower(key), "given")
 	contains(lower(key), "name")
 }
diff --git a/classification/rego/full_name.rego b/classification/rego/full_name.rego
index c5f8102..569e1f1 100644
--- a/classification/rego/full_name.rego
+++ b/classification/rego/full_name.rego
@@ -7,9 +7,9 @@ output[k] := v if {
 	v := classify(k, input[k])
 }
 
-default classify(_, _) := "UNLABELED"
+default classify(_, _) := false
 
-classify(key, _) := "FULL_NAME" if {
+classify(key, _) if {
 	contains(lower(key), "full")
 	contains(lower(key), "name")
 }
diff --git a/classification/rego/ip_address.rego b/classification/rego/ip_address.rego
index c14b33e..8c59316 100644
--- a/classification/rego/ip_address.rego
+++ b/classification/rego/ip_address.rego
@@ -7,20 +7,20 @@ output[k] := v if {
 	v := classify(k, input[k])
 }
 
-default classify(_, _) := "UNLABELED"
+default classify(_, _) := false
 
-classify(key, val) := "IP_ADDRESS" if {
+classify(key, val) if {
 	regex.match(`\d+\.\d+\.\d+\.\d+`, val)
 }
 
-classify(key, val) := "IP_ADDRESS" if {
+classify(key, val) if {
 	regex.match(
 	    `\A(?:(?:[0-9A-Fa-f]{1,4}:){6}(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|::(?:[0-9A-Fa-f]{1,4}:){5}(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|(?:[0-9A-Fa-f]{1,4})?::(?:[0-9A-Fa-f]{1,4}:){4}(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4})?::(?:[0-9A-Fa-f]{1,4}:){3}(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|(?:(?:[0-9A-Fa-f]{1,4}:){,2}[0-9A-Fa-f]{1,4})?::(?:[0-9A-Fa-f]{1,4}:){2}(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|(?:(?:[0-9A-Fa-f]{1,4}:){,3}[0-9A-Fa-f]{1,4})?::[0-9A-Fa-f]{1,4}:(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|(?:(?:[0-9A-Fa-f]{1,4}:){,4}[0-9A-Fa-f]{1,4})?::(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|(?:(?:[0-9A-Fa-f]{1,4}:){,5}[0-9A-Fa-f]{1,4})?::[0-9A-Fa-f]{1,4}|(?:(?:[0-9A-Fa-f]{1,4}:){,6}[0-9A-Fa-f]{1,4})?::)\z`,
 	    val
 	)
 }
 
-classify(key, val) := "IP_ADDRESS" if {
+classify(key, val) if {
 	regex.match(
 		`\A(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))\z`,
 		val
diff --git a/classification/rego/labels.yaml b/classification/rego/labels.yaml
index 462dbf8..0565e07 100644
--- a/classification/rego/labels.yaml
+++ b/classification/rego/labels.yaml
@@ -11,12 +11,12 @@
 #       - tag1
 #       - tag2
 labels:
-  - name: Address
+  - name: ADDRESS
     description: Address
     tags:
       - PII
 
-  - name: Age
+  - name: AGE
     description: Age
     tags:
       - PII
@@ -36,37 +36,37 @@ labels:
     tags:
       - PII
 
-  - name: Email
+  - name: EMAIL
     description: Email address
     tags:
       - PII
 
-  - name: First Name
+  - name: FIRST_NAME
     description: First name
     tags:
       - PII
 
-  - name: Full Name
+  - name: FULL_NAME
     description: Full name
     tags:
       - PII
 
-  - name: IP Address
+  - name: IP_ADDRESS
     description: IP address
     tags:
       - PII
 
-  - name: Last Name
+  - name: LAST_NAME
     description: Last name
     tags:
       - PII
 
-  - name: Passport
+  - name: PASSPORT
     description: Passport number
     tags:
       - PII
 
-  - name: Phone Number
+  - name: PHONE
     description: Phone number
     tags:
       - PII
diff --git a/classification/rego/last_name.rego b/classification/rego/last_name.rego
index 977807f..903d429 100644
--- a/classification/rego/last_name.rego
+++ b/classification/rego/last_name.rego
@@ -7,14 +7,14 @@ output[k] := v if {
 	v := classify(k, input[k])
 }
 
-default classify(_, _) := "UNLABELED"
+default classify(_, _) := false
 
-classify(key, _) := "LAST_NAME" if {
+classify(key, _) if {
 	contains(lower(key), "last")
 	contains(lower(key), "name")
 }
 
-classify(key, _) := "LAST_NAME" if {
+classify(key, _) if {
 	contains(lower(key), "sur")
 	contains(lower(key), "name")
 }
diff --git a/classification/rego/passport.rego b/classification/rego/passport.rego
index c9df3cb..e52d4be 100644
--- a/classification/rego/passport.rego
+++ b/classification/rego/passport.rego
@@ -7,16 +7,16 @@ output[k] := v if {
 	v := classify(k, input[k])
 }
 
-default classify(_, _) := "UNLABELED"
+default classify(_, _) := false
 
-classify(key, _) := "PASSPORT" if {
+classify(key, _) if {
 	contains(lower(key), "passport")
 }
 
-classify(_, val) := "PASSPORT" if {
+classify(_, val) if {
 	regex.match(`^[A-PR-WYZ]{1,2}[1-9]\d\s?\d{4,6}[1-9]$`, val)
 }
 
-classify(_, val) := "PASSPORT" if {
+classify(_, val) if {
 	regex.match(`^[1-9]\d\s?\d{4,6}[1-9][A-PR-WY]{1,2}$`, val)
 }
diff --git a/classification/rego/phone_number.rego b/classification/rego/phone.rego
similarity index 79%
rename from classification/rego/phone_number.rego
rename to classification/rego/phone.rego
index fd29c8a..cb4a9eb 100644
--- a/classification/rego/phone_number.rego
+++ b/classification/rego/phone.rego
@@ -7,9 +7,9 @@ output[k] := v if {
 	v := classify(k, input[k])
 }
 
-default classify(_, _) := "UNLABELED"
+default classify(_, _) := false
 
-classify(key, val) := "PHONE" if {
+classify(key, val) if {
 	regex.match(
 		`\A((1(-| )?((\([2-9]\d{2}\))|([2-9]\d{2})))|([2-9]\d{2})|(\([2-9]\d{2}\)))(-| )?[2-9]((1[02-9])|([02-9]\d))(-| )?\d{4}\z`,
 		val
diff --git a/classification/rego/phone_number_test.rego b/classification/rego/phone_test.rego
similarity index 100%
rename from classification/rego/phone_number_test.rego
rename to classification/rego/phone_test.rego
diff --git a/classification/rego/ssn.rego b/classification/rego/ssn.rego
index eb0ca9a..5721ca5 100644
--- a/classification/rego/ssn.rego
+++ b/classification/rego/ssn.rego
@@ -7,9 +7,9 @@ output[k] := v if {
 	v := classify(k, input[k])
 }
 
-default classify(_, _) := "UNLABELED"
+default classify(_, _) := false
 
-classify(key, val) := "SSN" if {
+classify(key, val) if {
 	pattern := regex.find_n(`\b(\d{9}|\d{3}\-\d{2}\-\d{4})\b`, val, 1)
 	count(pattern) == 1
 	t_val := replace(pattern[0], "-", "")
diff --git a/classification/rego_classifier.go b/classification/rego_classifier.go
deleted file mode 100644
index a215b33..0000000
--- a/classification/rego_classifier.go
+++ /dev/null
@@ -1,126 +0,0 @@
-package classification
-
-import (
-	"context"
-	"fmt"
-
-	"github.com/open-policy-agent/opa/ast"
-	"github.com/open-policy-agent/opa/rego"
-
-	log "github.com/sirupsen/logrus"
-)
-
-const (
-	unlabeledLabel = "UNLABELED"
-)
-
-// TODO: godoc -ccampo 2024-03-26
-type LabelClassifier struct {
-	lbl           *Label
-	preparedQuery rego.PreparedEvalQuery
-}
-
-// *LabelClassifier implements Classifier
-var _ Classifier = (*LabelClassifier)(nil)
-
-// TODO: godoc -ccampo 2024-03-26
-func NewLabelClassifier(lbl *Label) (*LabelClassifier, error) {
-	if lbl == nil {
-		return nil, fmt.Errorf("label cannot be nil")
-	}
-	q, err := prepareClassifierCode(lbl.ClassificationRule)
-	if err != nil {
-		return nil, err
-	}
-	return &LabelClassifier{lbl: lbl, preparedQuery: q}, nil
-}
-
-// TODO: godoc -ccampo 2024-03-26
-func (c *LabelClassifier) Classify(
-	_ context.Context,
-	table *ClassifiedTable,
-	attrs map[string]any,
-) ([]Result, error) {
-	if c == nil || len(attrs) == 0 {
-		return nil, fmt.Errorf("invalid arguments")
-	}
-
-	results, err := c.preparedQuery.Eval(context.Background(), rego.EvalInput(attrs))
-	if err != nil {
-		return nil, fmt.Errorf(
-			"[classifier %s] error evaluating query for inputs %s; %w", c.lbl.Name, attrs, err,
-		)
-	}
-
-	log.Debugf("[classifier %s] results: '%s'", c.lbl.Name, results)
-	if len(results) != 1 || len(results[0].Expressions) != 1 {
-		return nil, fmt.Errorf(
-			"[classifier %s] received malformed result in classification eval - expected 1 result with 1 expression result, but found: '%s'",
-			c.lbl.Name,
-			results,
-		)
-	}
-
-	exprValue := results[0].Expressions[0]
-	if exprValue == nil {
-		return nil, fmt.Errorf("[classifier %s] did not expect nil value in expression value", c.lbl.Name)
-	}
-
-	mapVal := results[0].Expressions[0].Value
-	resolvedMap, ok := mapVal.(map[string]any)
-	if !ok {
-		return nil, fmt.Errorf(
-			"[classifier %s] expected type to be map[string]any, but found: %T", c.lbl.Name, mapVal,
-		)
-	}
-
-	// Count the number of classifications, ignoring unlabeled classifications.
-	resultLength := 0
-	for _, v := range resolvedMap {
-		if v != unlabeledLabel {
-			resultLength++
-		}
-	}
-
-	// If there are no classifications, return nil.
-	if resultLength == 0 {
-		return nil, nil
-	}
-
-	classifications := make([]Result, resultLength)
-	resultIndex := 0
-	for attrName, v := range resolvedMap {
-		valueAsString, ok := v.(string)
-		if !ok {
-			log.Errorf("value type expected to be string, was: %T", v)
-			continue
-		}
-		if valueAsString != unlabeledLabel {
-			classifications[resultIndex] = Result{
-				Table:           table,
-				AttributeName:   attrName,
-				Classifications: []*Label{c.lbl},
-			}
-			resultIndex++
-		}
-	}
-	return classifications, nil
-}
-
-func prepareClassifierCode(classifierCode string) (rego.PreparedEvalQuery, error) {
-	log.Tracef("classifier module code: '%s'", classifierCode)
-	moduleName := "classifier"
-	compiledRego, err := ast.CompileModules(map[string]string{moduleName: classifierCode})
-	if err != nil {
-		return rego.PreparedEvalQuery{}, fmt.Errorf("error compiling rego code: %w", err)
-	}
-	regoQuery := compiledRego.Modules[moduleName].Package.Path.String() + ".output"
-	retVal, err := rego.New(
-		rego.Query(regoQuery),
-		rego.Compiler(compiledRego),
-	).PrepareForEval(context.Background())
-	if err != nil {
-		return rego.PreparedEvalQuery{}, fmt.Errorf("error preparing rego code for evaluation: %w", err)
-	}
-	return retVal, nil
-}
diff --git a/classification/rego_classifier_test.go b/classification/rego_classifier_test.go
deleted file mode 100644
index 076fce5..0000000
--- a/classification/rego_classifier_test.go
+++ /dev/null
@@ -1,457 +0,0 @@
-package classification
-
-import (
-	"context"
-	"fmt"
-	"os"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/cyralinc/dmap/discovery/repository"
-)
-
-const (
-	isDigitsRegex = "\\A\\d+\\z"
-	digitsLabel   = "DIGITS"
-	isARegex      = "\\A[Aa]\\z"
-	isALabel      = "ISA"
-	allCRegex     = "\\A[Cc]+\\z"
-	allCLabel     = "ALLC"
-)
-
-var fooTable = ClassifiedTable{
-	Repo:    "some_repo",
-	Catalog: "testdb",
-	Schema:  "testSchema",
-	Table:   "Foo",
-}
-
-var noCatalogFooTable = ClassifiedTable{
-	Repo:   "some_repo",
-	Schema: "testSchema",
-	Table:  "Foo",
-}
-
-func regexToClassifyCode(regex, label string) string {
-	return fmt.Sprintf(
-		"package classifier\noutput := \n"+
-			"{k: v |\n  v := classify(k, input[k])\n}\n"+
-			"classify(key, val) = \"%s\" {\n  re_match(`%s`, val)\n} "+
-			"else = \"UNLABELED\" {\n  true\n}",
-		label, regex,
-	)
-}
-
-func multiRegexClassify(regexes, labels []string) string {
-	return multiRegexClassifyWithPackage("classifier", regexes, labels)
-}
-
-func multiRegexClassifyWithPackage(pkg string, regexes, labels []string) string {
-	prefix := "package " + pkg + "\noutput := \n" +
-		"{k: v |\n v := classify(k, input[k])\n}\n" +
-		"classify(key, val) = "
-	middle := ""
-	for i, r := range regexes {
-		middle = fmt.Sprintf(
-			"%s\"%s\" {\n re_match(`%s`, val)\n} else = ",
-			middle, labels[i], r,
-		)
-	}
-	return fmt.Sprintf("%s%s \"UNLABELED\" {\n true\n}", prefix, middle)
-}
-
-type regoClassifyTestCase struct {
-	code            string
-	table           *ClassifiedTable
-	attributeNames  []string
-	attributeValues []string
-	expected        []Result
-}
-
-func TestRegoClassify(t *testing.T) {
-	tests := []struct {
-		name     string
-		code     string
-		table    *ClassifiedTable
-		attrs    map[string]any
-		expected []Result
-	}{
-		{
-			name: "multi regex classify",
-			code: multiRegexClassify(
-				[]string{isDigitsRegex, isARegex, allCRegex},
-				[]string{digitsLabel, isALabel, allCLabel},
-			),
-			table: &fooTable,
-			attrs: map[string]any{
-				"a": "fred",
-				"b": "A",
-				"c": "123",
-				"d": "bob",
-				"e": "0",
-				"f": "cCc",
-			},
-			expected: []Result{
-				{
-					Table:           &fooTable,
-					AttributeName:   "b",
-					Classifications: []*Label{{Name: isALabel}},
-				},
-				{
-					Table:           &fooTable,
-					AttributeName:   "c",
-					Classifications: []*Label{{Name: digitsLabel}},
-				},
-				{
-					Table:           &fooTable,
-					AttributeName:   "e",
-					Classifications: []*Label{{Name: digitsLabel}},
-				},
-				{
-					Table:           &fooTable,
-					AttributeName:   "f",
-					Classifications: []*Label{{Name: allCLabel}},
-				},
-			},
-		},
-		{
-			name: "multi regex classify with custom package",
-			code: multiRegexClassifyWithPackage(
-				"foo_bar",
-				[]string{isDigitsRegex, isARegex, allCRegex},
-				[]string{digitsLabel, isALabel, allCLabel},
-			),
-			table: &fooTable,
-			attrs: map[string]any{
-				"a": "fred",
-				"b": "A",
-				"c": "123",
-				"d": "bob",
-				"e": "0",
-				"f": "cCc",
-			},
-			expected: []Result{
-				{
-					Table:           &fooTable,
-					AttributeName:   "b",
-					Classifications: []*Label{{Name: isALabel}},
-				},
-				{
-					Table:           &fooTable,
-					AttributeName:   "c",
-					Classifications: []*Label{{Name: digitsLabel}},
-				},
-				{
-					Table:           &fooTable,
-					AttributeName:   "e",
-					Classifications: []*Label{{Name: digitsLabel}},
-				},
-				{
-					Table:           &fooTable,
-					AttributeName:   "f",
-					Classifications: []*Label{{Name: allCLabel}},
-				},
-			},
-		},
-		{
-			name:  "regex classifier",
-			code:  regexToClassifyCode(isDigitsRegex, digitsLabel),
-			table: &fooTable,
-			attrs: map[string]any{
-				"a": "123",
-				"b": "0",
-				"c": "fred",
-				"d": "a",
-				"e": "A",
-			},
-			expected: []Result{
-				{
-					Table:           &fooTable,
-					AttributeName:   "a",
-					Classifications: []*Label{{Name: digitsLabel}},
-				},
-				{
-					Table:           &fooTable,
-					AttributeName:   "b",
-					Classifications: []*Label{{Name: digitsLabel}},
-				},
-			},
-		},
-		{
-			name:  "regex classify - no catalog",
-			code:  regexToClassifyCode(isDigitsRegex, digitsLabel),
-			table: &noCatalogFooTable,
-			attrs: map[string]any{
-				"a": "123",
-				"b": "0",
-				"c": "fred",
-				"d": "a",
-				"e": "A",
-			},
-			expected: []Result{
-				{
-					Table:           &noCatalogFooTable,
-					AttributeName:   "a",
-					Classifications: []*Label{{Name: digitsLabel}},
-				},
-				{
-					Table:           &noCatalogFooTable,
-					AttributeName:   "b",
-					Classifications: []*Label{{Name: digitsLabel}},
-				},
-			},
-		},
-		{
-			name:  "regex classify - different attributes",
-			code:  regexToClassifyCode(isARegex, isALabel),
-			table: &fooTable,
-			attrs: map[string]any{
-				"a": "123",
-				"b": "0",
-				"c": "fred",
-				"d": "a",
-				"e": "A",
-			},
-			expected: []Result{
-				{
-					Table:           &fooTable,
-					AttributeName:   "d",
-					Classifications: []*Label{{Name: digitsLabel}},
-				},
-				{
-					Table:           &fooTable,
-					AttributeName:   "e",
-					Classifications: []*Label{{Name: digitsLabel}},
-				},
-			},
-		},
-	}
-	for _, tt := range tests {
-		t.Run(
-			tt.name, func(t *testing.T) {
-				classifier, err := NewLabelClassifier(&Label{Name: "dummy", ClassificationRule: tt.code})
-				if err != nil {
-					t.Errorf("Error creating classifier: %s", err.Error())
-				}
-				results, err := classifier.Classify(
-					context.Background(),
-					tt.table,
-					tt.attrs,
-				)
-				assert.NoError(t, err)
-				if len(results) != len(tt.expected) {
-					t.Errorf(
-						"Expected %d classification results, but found %d",
-						len(tt.expected), len(results),
-					)
-				}
-				for i, r := range results {
-					if tt.expected[i].Table.Repo != r.Table.Repo ||
-						tt.expected[i].Table.Catalog != r.Table.Catalog ||
-						tt.expected[i].Table.Schema != r.Table.Schema ||
-						tt.expected[i].Table.Table != r.Table.Table {
-						t.Errorf(
-							"Expected classification results[%d] tables to match. "+
-								"Found: '%+v', Expected: '%+v'",
-							i, *r.Table, *tt.expected[i].Table,
-						)
-					}
-					if tt.expected[i].AttributeName != r.AttributeName {
-						t.Errorf(
-							"Expected attribute names on classifiers[%d] to match. "+
-								"Found: %s, Expected: %s",
-							i, r.AttributeName, tt.expected[i].AttributeName,
-						)
-					}
-					if len(tt.expected[i].Classifications) != len(r.Classifications) {
-						t.Errorf(
-							"Expected length of classifications[%d] to match. "+
-								"Found: %d, Expected: %d",
-							i, len(tt.expected[i].Classifications), len(r.Classifications),
-						)
-					}
-					for j, cl := range r.Classifications {
-						if cl.Name != tt.expected[i].Classifications[j].Name {
-							t.Errorf(
-								"Expected classification[%d][%d] == '%s'; "+
-									"found: '%s'.",
-								i, j, tt.expected[i].Classifications[j].Name, cl.Name,
-							)
-						}
-					}
-				}
-			},
-		)
-	}
-}
-
-const (
-	repoName    = "repoName"
-	catalogName = "catalogName"
-	schemaName  = "schema"
-	tableName   = "table"
-)
-
-func Test_Classify_Rego_SingleSample(t *testing.T) {
-	sample := repository.Sample{
-		Metadata: repository.SampleMetadata{
-			Repo:     repoName,
-			Database: catalogName,
-			Schema:   schemaName,
-			Table:    tableName,
-		},
-		Results: []repository.SampleResult{
-			{
-				"age":             "52",
-				"social_sec_num":  "512-23-4256",
-				"credit_card_num": "4111111111111111",
-			},
-			{
-				"age":             "4111111111111111",
-				"social_sec_num":  "512-23-4258",
-				"credit_card_num": "4111111111111111",
-			},
-		},
-	}
-
-	classifier := testRegoClassifier(t)
-
-	actual, err := ClassifySamples(context.Background(), classifier, []repository.Sample{sample})
-	require.NoError(t, err)
-
-	table := &ClassifiedTable{
-		Repo:    repoName,
-		Catalog: catalogName,
-		Schema:  schemaName,
-		Table:   tableName,
-	}
-
-	expected := []Result{
-		{
-			Table:           table,
-			AttributeName:   "age",
-			Classifications: []*Label{{Name: "AGE"}, {Name: "CCN"}},
-		},
-		{
-			Table:           table,
-			AttributeName:   "credit_card_num",
-			Classifications: []*Label{{Name: "CCN"}},
-		},
-	}
-
-	assert.ElementsMatch(t, expected, actual)
-}
-
-func Test_Classify_Rego_MultipleSamples(t *testing.T) {
-	metadata1 := repository.SampleMetadata{
-		Repo:     repoName,
-		Database: catalogName,
-		Schema:   schemaName,
-		Table:    tableName,
-	}
-
-	metadata2 := repository.SampleMetadata{
-		Repo:     repoName,
-		Database: catalogName,
-		Schema:   schemaName + "2",
-		Table:    tableName + "2",
-	}
-
-	samples := []repository.Sample{
-		{
-			Metadata: metadata1,
-			Results: []repository.SampleResult{
-				{
-					"age":             "52",
-					"social_sec_num":  "512-23-4256",
-					"credit_card_num": "4111111111111111",
-				},
-			},
-		},
-		{
-			Metadata: metadata1,
-			Results: []repository.SampleResult{
-				{
-					"age":             "52",
-					"social_sec_num":  "512-23-4256",
-					"credit_card_num": "4111111111111112",
-				},
-			},
-		},
-		{
-			Metadata: metadata2,
-			Results: []repository.SampleResult{
-				{
-					"age":             "52",
-					"name":            "Joe Smith",
-					"social_sec_num":  "512-23-4256",
-					"credit_card_num": "4111111111111112",
-				},
-				{
-					"age":             "4111111111111113",
-					"name":            "Joe Smith",
-					"social_sec_num":  "512-23-4256",
-					"credit_card_num": "4111111111111112",
-				},
-			},
-		},
-	}
-
-	classifier := testRegoClassifier(t)
-
-	actual, err := ClassifySamples(context.Background(), classifier, samples)
-	require.NoError(t, err)
-
-	table1 := &ClassifiedTable{
-		Repo:    metadata1.Repo,
-		Catalog: metadata1.Database,
-		Schema:  metadata1.Schema,
-		Table:   metadata1.Table,
-	}
-
-	table2 := &ClassifiedTable{
-		Repo:    metadata2.Repo,
-		Catalog: metadata2.Database,
-		Schema:  metadata2.Schema,
-		Table:   metadata2.Table,
-	}
-
-	expected := []Result{
-		{
-			Table:           table1,
-			AttributeName:   "age",
-			Classifications: []*Label{{Name: "AGE"}},
-		},
-		{
-			Table:           table1,
-			AttributeName:   "credit_card_num",
-			Classifications: []*Label{{Name: "CCN"}},
-		},
-		{
-			Table:           table2,
-			AttributeName:   "age",
-			Classifications: []*Label{{Name: "AGE"}, {Name: "CCN"}},
-		},
-		{
-			Table:           table2,
-			AttributeName:   "credit_card_num",
-			Classifications: []*Label{{Name: "CCN"}},
-		},
-	}
-
-	assert.ElementsMatch(t, expected, actual)
-}
-
-func testRegoClassifier(t *testing.T) Classifier {
-	fin, err := os.ReadFile("./examples/example_policy_simple.rego")
-	require.NoError(t, err)
-
-	classifierCode := string(fin)
-
-	classifier, err := NewLabelClassifier(&Label{Name: "dummy", ClassificationRule: classifierCode})
-	require.NoError(t, err)
-
-	return classifier
-}
diff --git a/discovery/scanner.go b/discovery/scanner.go
index 09b3f02..4964952 100644
--- a/discovery/scanner.go
+++ b/discovery/scanner.go
@@ -27,7 +27,7 @@ import (
 type Scanner struct {
 	config      *config.Config
 	repository  repository.Repository
-	classifiers map[string]classification.Classifier
+	classifiers []classification.Classifier
 	publisher   publisher.Publisher
 }
 
@@ -45,7 +45,7 @@ func (s *Scanner) Init(ctx context.Context) error {
 	// init methods.
 	s.initPublisher()
 
-	if err := s.initClassifiers(); err != nil {
+	if err := s.initEmbeddedClassifiers(); err != nil {
 		return err
 	}
 	if err := s.initRepository(ctx); err != nil {
@@ -106,7 +106,7 @@ func (s *Scanner) Run(ctx context.Context) error {
 	}
 
 	// Classify sampled data
-	classifications, err := classification.AggregateClassifySamples(ctx, s.classifiers, samples)
+	classifications, err := classification.ClassifySamples(ctx, samples, s.classifiers...)
 	if err != nil {
 		return fmt.Errorf("error classifying samples: %w", err)
 	}
@@ -129,18 +129,14 @@ func (s *Scanner) Cleanup() {
 	}
 }
 
-func (s *Scanner) initClassifiers() error {
-	lbls, err := classification.GetLabels()
+func (s *Scanner) initEmbeddedClassifiers() error {
+	classifiers, err := classification.GetEmbeddedLabelClassifiers()
 	if err != nil {
-		return fmt.Errorf("error getting labels: %w", err)
+		return fmt.Errorf("error getting embedded label classifiers: %w", err)
 	}
-	s.classifiers = make(map[string]classification.Classifier, len(lbls))
-	for _, lbl := range lbls {
-		classifier, err := classification.NewLabelClassifier(lbl)
-		if err != nil {
-			return fmt.Errorf("unable to initialize rego classifier for label %s: %w", lbl.Name, err)
-		}
-		s.classifiers[lbl.Name] = classifier
+	s.classifiers = make([]classification.Classifier, len(classifiers))
+	for i, classifier := range classifiers {
+		s.classifiers[i] = classifier
 	}
 	return nil
 }

From 69c1731e0b5703b02c75e9ca29f928db17dd06d7 Mon Sep 17 00:00:00 2001
From: Chris Campo <ccampo133@users.noreply.github.com>
Date: Wed, 27 Mar 2024 17:46:50 -0400
Subject: [PATCH 03/14] Refactor

Refactor
---
 .gitignore                                    |   3 +
 Dockerfile                                    |   2 +-
 classification/classification.go              | 114 +++--
 classification/classification_test.go         | 454 ++++++++----------
 classification/gen.go                         |   5 +
 classification/label.go                       | 172 +++----
 classification/label_classifier.go            | 108 +++++
 classification/label_classifier_test.go       | 155 ++++++
 classification/label_test.go                  |  13 +
 classification/mock_classifier_test.go        |  95 ++++
 classification/publisher/publisher.go         |  11 +-
 classification/publisher/stdout.go            |  16 +-
 classification/rego/labels.yaml               |  28 +-
 cmd/main.go                                   |   8 +-
 discovery/config/config.go                    |  23 +-
 discovery/repository/gen.go                   |   2 +-
 discovery/repository/metadata.go              |  24 +-
 ..._repository.go => mock_repository_test.go} |  93 +---
 .../repository/sample_all_databases_test.go   |  14 +-
 discovery/repository/sampling.go              |   2 +-
 discovery/scanner.go                          |  70 ++-
 21 files changed, 850 insertions(+), 562 deletions(-)
 create mode 100644 classification/gen.go
 create mode 100644 classification/label_classifier.go
 create mode 100644 classification/label_classifier_test.go
 create mode 100644 classification/label_test.go
 create mode 100644 classification/mock_classifier_test.go
 rename discovery/repository/{mock_repository.go => mock_repository_test.go} (82%)

diff --git a/.gitignore b/.gitignore
index f3bd2ab..3bd66f6 100644
--- a/.gitignore
+++ b/.gitignore
@@ -253,3 +253,6 @@ __debug_bin
 
 # Backup files
 *~
+
+# Other
+/.run/
diff --git a/Dockerfile b/Dockerfile
index a35bd86..20b4bb0 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -11,7 +11,7 @@ RUN go mod download
 COPY . .
 
 # Build.
-RUN CGO_ENABLED=0 go build -o dmap cmd/*.go
+RUN CGO_ENABLED=0 go build -ldflags="-X main.version=$(git rev-parse HEAD)" -o dmap cmd/*.go
 
 FROM gcr.io/distroless/static-debian12:nonroot
 
diff --git a/classification/classification.go b/classification/classification.go
index 4918e68..5b7bc31 100644
--- a/classification/classification.go
+++ b/classification/classification.go
@@ -1,51 +1,61 @@
 // Package classification provides various types and functions to facilitate
 // data classification. The type Classifier provides an interface which takes
-// sampled data as input and returns a classified version of that sample as
-// output. The package contains at least one implementation which uses Rego and
-// OPA to perform the actual classification logic (see LabelClassifier), however
-// other implementations may be added in the future.
+// arbitrary data as input and returns a classified version of that data as
+// output. The package contains at least one implementation which uses OPA and
+// Rego to perform the actual classification logic (see LabelClassifier),
+// however other implementations may be added in the future.
 package classification
 
 import (
 	"context"
 	"fmt"
+	"maps"
 
 	"github.com/cyralinc/dmap/discovery/repository"
 )
 
-// TODO: godoc -ccampo 2024-03-27
-type ClassifiedTable struct {
-	Repo    string `json:"repo"`
-	Catalog string `json:"catalog"`
-	Schema  string `json:"schema"`
-	Table   string `json:"table"`
+// Classifier is an interface that represents a data classifier. A classifier
+// takes a set of data attributes and classifies them into a set of labels.
+type Classifier interface {
+	// Classify takes the given input, which amounts to essentially a "row of
+	// data", and returns the data classifications for that input. The input is
+	// a map of attribute names (i.e. columns) to their values. The returned
+	// Result is a map of attribute names to the set of labels that attributes
+	// were classified as.
+	Classify(ctx context.Context, input map[string]any) (Result, error)
 }
 
-// Result represents the classification of a data attribute.
-type Result struct {
-	Table           *ClassifiedTable `json:"table"`
-	AttributeName   string           `json:"attributeName"`
-	Classifications []*Label         `json:"classifications"`
+// ClassifiedTable represents a database table that has been classified. The
+// classifications are stored in the Classifications field, which is a map of
+// attribute names (i.e. columns) to the set of labels that attributes were
+// classified as.
+type ClassifiedTable struct {
+	Repo            string `json:"repo"`
+	Database        string `json:"database"`
+	Schema          string `json:"schema"`
+	Table           string `json:"table"`
+	Classifications Result `json:"classifications"`
 }
 
-// Classifier implementations know how to turn a row of data into a sequence of
-// classification results.
-type Classifier interface {
-	// Classify takes as input what amounts to a "row of data": complete
-	// information about where the table comes from as well as a list of columns
-	// and attributeValues. While the values might be any data type, by the time
-	// we reach here, we expect the values to be represented as strings.
-	//
-	// For a given attribute, if it is classified as belonging to a particular
-	// classification group, we will add an instance for it in the Result.
-	// If however, there is no assigned classification, we will skip it in the
-	// results. A zero length return value is normal if none of the attributes
-	// matched the classification requirements.
-	Classify(
-		ctx context.Context,
-		table *ClassifiedTable,
-		attrs map[string]any,
-	) ([]Result, error)
+// Result represents the classifications for a set of data attributes. The key
+// is the attribute (i.e. column) name and the value is the set of labels
+// that attribute was classified as.
+type Result map[string]LabelSet
+
+// Merge combines the given other Result into this Result (the receiver). If
+// an attribute from other is already present in this Result, the existing
+// labels for that attribute are merged with the labels from other, otherwise
+// labels from other for the attribute are simply added to this Result.
+func (c Result) Merge(other Result) {
+	if c == nil {
+		return
+	}
+	for attr, labelSet := range other {
+		if _, ok := c[attr]; !ok {
+			c[attr] = make(LabelSet)
+		}
+		maps.Copy(c[attr], labelSet)
+	}
 }
 
 // ClassifySamples uses the provided classifiers to classify the sample data
@@ -58,27 +68,29 @@ type Classifier interface {
 func ClassifySamples(
 	ctx context.Context,
 	samples []repository.Sample,
-	classifiers ...Classifier,
-) ([]Result, error) {
-	var classifications []Result
+	classifier Classifier,
+) ([]ClassifiedTable, error) {
+	tables := make([]ClassifiedTable, 0, len(samples))
 	for _, sample := range samples {
-		table := ClassifiedTable{
-			Repo:    sample.Metadata.Repo,
-			Catalog: sample.Metadata.Database,
-			Schema:  sample.Metadata.Schema,
-			Table:   sample.Metadata.Table,
-		}
-		// Classify each sampled row
+		// Classify each sampled row and combine the results.
+		result := make(Result)
 		for _, sampleResult := range sample.Results {
-			for _, classifier := range classifiers {
-				res, err := classifier.Classify(ctx, &table, sampleResult)
-				if err != nil {
-					return nil, fmt.Errorf("error classifying sample: %w", err)
-				}
-				classifications = append(classifications, res...)
+			res, err := classifier.Classify(ctx, sampleResult)
+			if err != nil {
+				return nil, fmt.Errorf("error classifying sample: %w", err)
+			}
+			result.Merge(res)
+		}
+		if len(result) > 0 {
+			table := ClassifiedTable{
+				Repo:            sample.Metadata.Repo,
+				Database:        sample.Metadata.Database,
+				Schema:          sample.Metadata.Schema,
+				Table:           sample.Metadata.Table,
+				Classifications: result,
 			}
+			tables = append(tables, table)
 		}
 	}
-	// TODO: combine and dedupe -ccampo 2024-03-27
-	return classifications, nil
+	return tables, nil
 }
diff --git a/classification/classification_test.go b/classification/classification_test.go
index 52704d5..69ca3c1 100644
--- a/classification/classification_test.go
+++ b/classification/classification_test.go
@@ -2,314 +2,278 @@ package classification
 
 import (
 	"context"
-	"fmt"
-	"os"
-	"strings"
 	"testing"
 
-	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
 	"github.com/cyralinc/dmap/discovery/repository"
 )
 
-func TestClassifySamples_SingleSample(t *testing.T) {
-	repoName := "repoName"
-	catalogName := "catalogName"
-	schemaName := "schema"
-	tableName := "table"
+func TestMerge_WhenCalledOnNilReceiver_ShouldNotPanic(t *testing.T) {
+	var result Result
+	require.NotPanics(
+		t, func() {
+			result.Merge(Result{"age": {"AGE": {Name: "AGE"}}})
+		},
+	)
+}
+
+func TestMerge_WhenCalledWithNonExistingAttributes_ShouldAddThem(t *testing.T) {
+	result := Result{
+		"age": {"AGE": {Name: "AGE"}},
+	}
+	other := Result{
+		"social_sec_num": {"SSN": {Name: "SSN"}},
+	}
+	expected := Result{
+		"age":            {"AGE": {Name: "AGE"}},
+		"social_sec_num": {"SSN": {Name: "SSN"}},
+	}
+	result.Merge(other)
+	require.Equal(t, expected, result)
+}
+
+func TestMerge_WhenCalledWithExistingAttributes_ShouldMergeLabelSets(t *testing.T) {
+	result := Result{
+		"age": {"AGE": {Name: "AGE"}},
+	}
+	other := Result{
+		"age": {"CVV": {Name: "CVV"}},
+	}
+	expected := Result{
+		"age": {"AGE": {Name: "AGE"}, "CVV": {Name: "CVV"}},
+	}
+	result.Merge(other)
+	require.Equal(t, expected, result)
+}
+
+func TestMerge_WhenCalledWithExistingAttributes_ShouldOverwrite(t *testing.T) {
+	result := Result{
+		"age": {"AGE": {Name: "AGE", Description: "Foo"}},
+	}
+	other := Result{
+		"age": {"AGE": {Name: "AGE", Description: "Bar"}},
+	}
+	expected := Result{
+		"age": {"AGE": {Name: "AGE", Description: "Bar"}},
+	}
+	result.Merge(other)
+	require.Equal(t, expected, result)
+}
+
+func TestClassifySamples_SingleTable(t *testing.T) {
+	ctx := context.Background()
+	meta := repository.SampleMetadata{
+		Repo:     "repo",
+		Database: "db",
+		Schema:   "schema",
+		Table:    "table",
+	}
 
 	sample := repository.Sample{
-		Metadata: repository.SampleMetadata{
-			Repo:     repoName,
-			Database: catalogName,
-			Schema:   schemaName,
-			Table:    tableName,
-		},
+		Metadata: meta,
 		Results: []repository.SampleResult{
 			{
 				"age":             "52",
-				"social_sec_num":  "512-23-4256",
+				"social_sec_num":  "512-23-4258",
 				"credit_card_num": "4111111111111111",
 			},
 			{
-				"age":             "4111111111111111",
-				"social_sec_num":  "512-23-4258",
+				"age":             "101",
+				"social_sec_num":  "foobarbaz",
 				"credit_card_num": "4111111111111111",
 			},
 		},
 	}
 
-	classifiers := []Classifier{
-		newTestLabelClassifier(t, "AGE"),
-		newTestLabelClassifier(t, "CCN"),
-	}
-
-	actual, err := ClassifySamples(
-		context.Background(),
-		[]repository.Sample{sample},
-		classifiers...,
-	)
-	require.NoError(t, err)
-
-	table := &ClassifiedTable{
-		Repo:    repoName,
-		Catalog: catalogName,
-		Schema:  schemaName,
-		Table:   tableName,
-	}
-
-	expected := []Result{
-		{
-			Table:           table,
-			AttributeName:   "age",
-			Classifications: []*Label{{Name: "AGE"}},
+	classifier := NewMockClassifier(t)
+	// Need to explicitly convert it to a map because Mockery isn't smart enough
+	// to infer the type.
+	classifier.EXPECT().Classify(ctx, map[string]any(sample.Results[0])).Return(
+		Result{
+			"age": {
+				"AGE": {Name: "AGE"},
+			},
+			"social_sec_num": {
+				"SSN": {Name: "SSN"},
+			},
+			"credit_card_num": {
+				"CCN": {Name: "CCN"},
+			},
 		},
-		{
-			Table:           table,
-			AttributeName:   "credit_card_num",
-			Classifications: []*Label{{Name: "CCN"}},
+		nil,
+	)
+	classifier.EXPECT().Classify(ctx, map[string]any(sample.Results[1])).Return(
+		Result{
+			"age": {
+				"AGE": {Name: "AGE"},
+				"CVV": {Name: "CVV"},
+			},
+			"credit_card_num": {
+				"CCN": {Name: "CCN"},
+			},
 		},
+		nil,
+	)
+
+	expected := []ClassifiedTable{
 		{
-			Table:           table,
-			AttributeName:   "age",
-			Classifications: []*Label{{Name: "CCN"}},
+			Repo:     meta.Repo,
+			Database: meta.Database,
+			Schema:   meta.Schema,
+			Table:    meta.Table,
+			Classifications: Result{
+				"age": {
+					"AGE": {Name: "AGE"},
+					"CVV": {Name: "CVV"},
+				},
+				"social_sec_num": {
+					"SSN": {Name: "SSN"},
+				},
+				"credit_card_num": {
+					"CCN": {Name: "CCN"},
+				},
+			},
 		},
 	}
-
+	actual, err := ClassifySamples(ctx, []repository.Sample{sample}, classifier)
+	require.NoError(t, err)
 	require.Len(t, actual, len(expected))
-
-	for i, got := range actual {
-		want := expected[i]
-		require.Equal(t, want.Table, got.Table)
-		require.Equal(t, want.AttributeName, got.AttributeName)
-		require.Len(t, got.Classifications, len(want.Classifications))
-		for j, cl := range got.Classifications {
-			wantCl := want.Classifications[j]
-			require.Equal(t, wantCl.Name, cl.Name)
-		}
+	for i := range actual {
+		requireClassifiedTableEqual(t, expected[i], actual[i])
 	}
 }
 
-func TestClassifySamples_MultipleSamples(t *testing.T) {
-	repoName := "repoName"
-	catalogName := "catalogName"
-	schemaName := "schema"
-	tableName := "table"
-
-	metadata1 := repository.SampleMetadata{
-		Repo:     repoName,
-		Database: catalogName,
-		Schema:   schemaName,
-		Table:    tableName,
+func TestClassifySamples_MultipleTables(t *testing.T) {
+	ctx := context.Background()
+	meta1 := repository.SampleMetadata{
+		Repo:     "repo1",
+		Database: "db1",
+		Schema:   "schema1",
+		Table:    "table1",
 	}
-
-	metadata2 := repository.SampleMetadata{
-		Repo:     repoName,
-		Database: catalogName,
-		Schema:   schemaName + "2",
-		Table:    tableName + "2",
+	meta2 := repository.SampleMetadata{
+		Repo:     "repo2",
+		Database: "db2",
+		Schema:   "schema2",
+		Table:    "table2",
 	}
 
 	samples := []repository.Sample{
 		{
-			Metadata: metadata1,
+			Metadata: meta1,
 			Results: []repository.SampleResult{
 				{
 					"age":             "52",
-					"social_sec_num":  "512-23-4256",
+					"social_sec_num":  "512-23-4258",
 					"credit_card_num": "4111111111111111",
 				},
-			},
-		},
-		{
-			Metadata: metadata1,
-			Results: []repository.SampleResult{
 				{
-					"age":             "52",
-					"social_sec_num":  "512-23-4256",
-					"credit_card_num": "4111111111111112",
+					"age":             "101",
+					"social_sec_num":  "foobarbaz",
+					"credit_card_num": "4111111111111111",
 				},
 			},
 		},
 		{
-			Metadata: metadata2,
+			Metadata: meta2,
 			Results: []repository.SampleResult{
 				{
-					"age":             "52",
-					"name":            "Joe Smith",
-					"social_sec_num":  "512-23-4256",
-					"credit_card_num": "4111111111111112",
-				},
-				{
-					"age":             "4111111111111113",
-					"name":            "Joe Smith",
-					"social_sec_num":  "512-23-4256",
-					"credit_card_num": "4111111111111112",
+					"fullname": "John Doe",
+					"dob":      "2000-01-01",
+					"random":   "foobarbaz",
 				},
 			},
 		},
 	}
 
-	classifiers := []Classifier{
-		newTestLabelClassifier(t, "AGE"),
-		newTestLabelClassifier(t, "CCN"),
-	}
-
-	actual, err := ClassifySamples(context.Background(), samples, classifiers...)
-	require.NoError(t, err)
-
-	table1 := &ClassifiedTable{
-		Repo:    metadata1.Repo,
-		Catalog: metadata1.Database,
-		Schema:  metadata1.Schema,
-		Table:   metadata1.Table,
-	}
-
-	table2 := &ClassifiedTable{
-		Repo:    metadata2.Repo,
-		Catalog: metadata2.Database,
-		Schema:  metadata2.Schema,
-		Table:   metadata2.Table,
-	}
-
-	expected := []Result{
-		{
-			Table:           table1,
-			AttributeName:   "age",
-			Classifications: []*Label{{Name: "AGE"}},
-		},
-		{
-			Table:           table2,
-			AttributeName:   "age",
-			Classifications: []*Label{{Name: "AGE"}},
-		},
-		{
-			Table:           table1,
-			AttributeName:   "credit_card_num",
-			Classifications: []*Label{{Name: "CCN"}},
-		},
-		{
-			Table:           table2,
-			AttributeName:   "credit_card_num",
-			Classifications: []*Label{{Name: "CCN"}},
-		},
-		{
-			Table:           table2,
-			AttributeName:   "age",
-			Classifications: []*Label{{Name: "CCN"}},
+	classifier := NewMockClassifier(t)
+	// Need to explicitly convert it to a map because Mockery isn't smart enough
+	// to infer the type.
+	classifier.EXPECT().Classify(ctx, map[string]any(samples[0].Results[0])).Return(
+		Result{
+			"age": {
+				"AGE": {Name: "AGE"},
+			},
+			"social_sec_num": {
+				"SSN": {Name: "SSN"},
+			},
+			"credit_card_num": {
+				"CCN": {Name: "CCN"},
+			},
 		},
-	}
-	require.Len(t, actual, len(expected))
-
-	for i, got := range actual {
-		want := expected[i]
-		require.Equal(t, want.Table, got.Table)
-		require.Equal(t, want.AttributeName, got.AttributeName)
-		require.Len(t, got.Classifications, len(want.Classifications))
-		for j, cl := range got.Classifications {
-			wantCl := want.Classifications[j]
-			require.Equal(t, wantCl.Name, cl.Name)
-		}
-	}
-}
-
-type classifyFunc func(table *ClassifiedTable, attrs map[string]any) ([]Result, error)
-
-type fakeClassifier struct {
-	classify classifyFunc
-}
-
-var _ Classifier = (*fakeClassifier)(nil)
-
-func (f fakeClassifier) Classify(
-	_ context.Context,
-	table *ClassifiedTable,
-	attrs map[string]any,
-) ([]Result, error) {
-	return f.classify(table, attrs)
-}
-
-func TestClassifySamples_FakeClassifier_SingleSample(t *testing.T) {
-	repoName := "repoName"
-	catalogName := "catalogName"
-	schemaName := "schema"
-	tableName := "table"
-
-	sample := repository.Sample{
-		Metadata: repository.SampleMetadata{
-			Repo:     repoName,
-			Database: catalogName,
-			Schema:   schemaName,
-			Table:    tableName,
+		nil,
+	)
+	classifier.EXPECT().Classify(ctx, map[string]any(samples[0].Results[1])).Return(
+		Result{
+			"age": {
+				"AGE": {Name: "AGE"},
+				"CVV": {Name: "CVV"},
+			},
+			"credit_card_num": {
+				"CCN": {Name: "CCN"},
+			},
 		},
-		Results: []repository.SampleResult{
-			{
-				"age":             "52",
-				"social_sec_num":  "512-23-4256",
-				"credit_card_num": "4111111111111111",
+		nil,
+	)
+	classifier.EXPECT().Classify(ctx, map[string]any(samples[1].Results[0])).Return(
+		Result{
+			"fullname": {
+				"FULL_NAME": {Name: "FULL_NAME"},
 			},
-			{
-				"age":             "53",
-				"social_sec_num":  "512-23-4258",
-				"credit_card_num": "4111111111111111",
+			"dob": {
+				"DOB": {Name: "DOB"},
 			},
 		},
-	}
-
-	table := ClassifiedTable{
-		Repo:    repoName,
-		Catalog: catalogName,
-		Schema:  schemaName,
-		Table:   tableName,
-	}
+		nil,
+	)
 
-	expected := []Result{
-		{
-			Table:           &table,
-			AttributeName:   "age",
-			Classifications: []*Label{{Name: "PII"}},
-		},
+	expected := []ClassifiedTable{
 		{
-			Table:           &table,
-			AttributeName:   "social_sec_num",
-			Classifications: []*Label{{Name: "PII"}, {Name: "PRIVATE"}},
+			Repo:     meta1.Repo,
+			Database: meta1.Database,
+			Schema:   meta1.Schema,
+			Table:    meta1.Table,
+			Classifications: Result{
+				"age": {
+					"AGE": {Name: "AGE"},
+					"CVV": {Name: "CVV"},
+				},
+				"social_sec_num": {
+					"SSN": {Name: "SSN"},
+				},
+				"credit_card_num": {
+					"CCN": {Name: "CCN"},
+				},
+			},
 		},
 		{
-			Table:           &table,
-			AttributeName:   "credit_card_num",
-			Classifications: []*Label{{Name: "PII"}, {Name: "CCN"}, {Name: "PCI"}},
+			Repo:     meta2.Repo,
+			Database: meta2.Database,
+			Schema:   meta2.Schema,
+			Table:    meta2.Table,
+			Classifications: Result{
+				"fullname": {
+					"FULL_NAME": {Name: "FULL_NAME"},
+				},
+				"dob": {
+					"DOB": {Name: "DOB"},
+				},
+			},
 		},
 	}
-
-	classifier := fakeClassifier{
-		classify: func(
-			table *ClassifiedTable,
-			attrs map[string]any,
-		) ([]Result, error) {
-			return expected, nil
-		},
+	actual, err := ClassifySamples(ctx, samples, classifier)
+	require.NoError(t, err)
+	require.Len(t, actual, len(expected))
+	for i := range actual {
+		requireClassifiedTableEqual(t, expected[i], actual[i])
 	}
-
-	actual, err := ClassifySamples(
-		context.Background(),
-		[]repository.Sample{sample},
-		classifier,
-	)
-	assert.NoError(t, err)
-	assert.ElementsMatch(t, expected, actual)
 }
 
-func newTestLabelClassifier(t *testing.T, lblName string) Classifier {
-	fname := fmt.Sprintf("./rego/%s.rego", strings.ToLower(lblName))
-	fin, err := os.ReadFile(fname)
-	require.NoError(t, err)
-	classifierCode := string(fin)
-	lbl := Label{
-		Name:               lblName,
-		ClassificationRule: classifierCode,
-	}
-	classifier, err := NewLabelClassifier(&lbl)
-	require.NoError(t, err)
-	return classifier
+func requireClassifiedTableEqual(t *testing.T, expected, actual ClassifiedTable) {
+	require.Equal(t, expected.Repo, actual.Repo)
+	require.Equal(t, expected.Database, actual.Database)
+	require.Equal(t, expected.Schema, actual.Schema)
+	require.Equal(t, expected.Table, actual.Table)
+	requireResultEqual(t, expected.Classifications, actual.Classifications)
 }
diff --git a/classification/gen.go b/classification/gen.go
new file mode 100644
index 0000000..0d86176
--- /dev/null
+++ b/classification/gen.go
@@ -0,0 +1,5 @@
+package classification
+
+// Mock generation - see https://vektra.github.io/mockery/
+
+//go:generate mockery --testonly --inpackage --with-expecter --name=Classifier --filename=mock_classifier_test.go
diff --git a/classification/label.go b/classification/label.go
index 499f0f8..f2cdfdf 100644
--- a/classification/label.go
+++ b/classification/label.go
@@ -5,145 +5,91 @@ import (
 	"fmt"
 	"strings"
 
-	"context"
-
 	"github.com/open-policy-agent/opa/ast"
 	"github.com/open-policy-agent/opa/rego"
 	log "github.com/sirupsen/logrus"
 	"gopkg.in/yaml.v3"
 )
 
+var (
+	//go:embed rego/*.rego
+	regoFs embed.FS
+	//go:embed rego/labels.yaml
+	labelsYaml string
+)
+
 // Label represents a data classification label.
 type Label struct {
-	Name               string   `json:"name"`
-	Description        string   `json:"description"`
-	Tags               []string `json:"tags"`
-	ClassificationRule string   `json:"-"`
+	Name               string     `yaml:"name" json:"name"`
+	Description        string     `yaml:"description" json:"description"`
+	Tags               []string   `yaml:"tags" json:"tags"`
+	ClassificationRule *rego.Rego `yaml:"-" json:"-"`
 }
 
-//go:embed rego/*.rego
-var regoFs embed.FS
+// NewLabel creates a new Label with the given name, description, classification
+// rule, and tags. The classification rule is expected to be the raw Rego code
+// that will be used to classify data. If the classification rule is invalid, an
+// error is returned.
+func NewLabel(name, description, classificationRule string, tags []string) (Label, error) {
+	rule, err := ruleRego(classificationRule)
+	if err != nil {
+		return Label{}, fmt.Errorf("error preparing classification rule for label %s: %w", name, err)
+	}
+	return Label{
+		Name:               name,
+		Description:        description,
+		Tags:               tags,
+		ClassificationRule: rule,
+	}, nil
+}
+
+// LabelSet is a set of unique labels. The key is the label name and the value
+// is the label itself.
+type LabelSet map[string]Label
 
-//go:embed rego/labels.yaml
-var labelsYaml string
+// ToSlice returns the labels in the set as a slice.
+func (s LabelSet) ToSlice() []Label {
+	var labels []Label
+	for _, label := range s {
+		labels = append(labels, label)
+	}
+	return labels
+}
 
-// TODO: godoc -ccampo 2024-03-27
-func GetEmbeddedLabelClassifiers() ([]*LabelClassifier, error) {
-	lbls := struct {
-		Labels []*Label `yaml:"labels"`
+// GetEmbeddedLabels returns the predefined embedded labels and their
+// classification rules. The labels are read from the embedded labels.yaml file
+// and the classification rules are read from the embedded Rego files.
+func GetEmbeddedLabels() (LabelSet, error) {
+	labels := struct {
+		Labels LabelSet `yaml:"labels"`
 	}{}
-	if err := yaml.Unmarshal([]byte(labelsYaml), &lbls); err != nil {
+	if err := yaml.Unmarshal([]byte(labelsYaml), &labels); err != nil {
 		return nil, fmt.Errorf("error unmarshalling labels.yaml: %w", err)
 	}
-	classifiers := make([]*LabelClassifier, len(lbls.Labels))
-	for i, lbl := range lbls.Labels {
-		fname := "rego/" + strings.ReplaceAll(strings.ToLower(lbl.Name), " ", "_") + ".rego"
+	for name, lbl := range labels.Labels {
+		fname := "rego/" + strings.ReplaceAll(strings.ToLower(name), " ", "_") + ".rego"
 		b, err := regoFs.ReadFile(fname)
 		if err != nil {
 			return nil, fmt.Errorf("error reading rego file %s: %w", fname, err)
 		}
-		lbl.ClassificationRule = string(b)
-		classifier, err := NewLabelClassifier(lbl)
+		rule, err := ruleRego(string(b))
 		if err != nil {
-			return nil, fmt.Errorf("unable to initialize classifier for label %s: %w", lbl.Name, err)
+			return nil, fmt.Errorf("error preparing classification rule for label %s: %w", lbl.Name, err)
 		}
-		classifiers[i] = classifier
+		lbl.Name = name
+		lbl.ClassificationRule = rule
+		labels.Labels[name] = lbl
 	}
-	return classifiers, nil
+	return labels.Labels, nil
 }
 
-// TODO: godoc -ccampo 2024-03-26
-type LabelClassifier struct {
-	lbl           *Label
-	preparedQuery rego.PreparedEvalQuery
-}
-
-// *LabelClassifier implements Classifier
-var _ Classifier = (*LabelClassifier)(nil)
-
-// TODO: godoc -ccampo 2024-03-26
-func NewLabelClassifier(lbl *Label) (*LabelClassifier, error) {
-	if lbl == nil {
-		return nil, fmt.Errorf("label cannot be nil")
-	}
-	q, err := prepareClassifierCode(lbl.ClassificationRule)
-	if err != nil {
-		return nil, err
-	}
-	return &LabelClassifier{lbl: lbl, preparedQuery: q}, nil
-}
-
-// TODO: godoc -ccampo 2024-03-26
-func (c *LabelClassifier) Classify(
-	_ context.Context,
-	table *ClassifiedTable,
-	attrs map[string]any,
-) ([]Result, error) {
-	if c == nil || len(attrs) == 0 {
-		return nil, fmt.Errorf("invalid arguments; classifier or attributes are nil/empty")
-	}
-
-	res, err := c.preparedQuery.Eval(context.Background(), rego.EvalInput(attrs))
-	if err != nil {
-		return nil, fmt.Errorf(
-			"[classifier %s] error evaluating query for inputs %s; %w", c.lbl.Name, attrs, err,
-		)
-	}
-
-	if len(res) != 1 || len(res[0].Expressions) != 1 {
-		return nil, fmt.Errorf(
-			"[classifier %s] received malformed result in classification eval - expected 1 result with 1 expression result, but found: '%s'",
-			c.lbl.Name,
-			res,
-		)
-	}
-	log.Debugf("[classifier %s] results: '%s'", c.lbl.Name, res)
-
-	exprValue := res[0].Expressions[0]
-	if exprValue == nil {
-		return nil, fmt.Errorf("[classifier %s] expression value is nil", c.lbl.Name)
-	}
-
-	output, ok := res[0].Expressions[0].Value.(map[string]any)
-	if !ok {
-		return nil, fmt.Errorf(
-			"[classifier %s] expected output type to be map[string]any, but found: %T",
-			c.lbl.Name,
-			res[0].Expressions[0].Value,
-		)
-	}
-
-	// TODO: comment explaining this -ccampo 2024-03-27
-	classifications := make([]Result, 0, len(output))
-	i := 0
-	for attrName, v := range output {
-		if v, ok := v.(bool); v && ok {
-			classifications[i] = Result{
-				Table:           table,
-				AttributeName:   attrName,
-				Classifications: []*Label{c.lbl},
-			}
-			i++
-		}
-	}
-
-	return classifications, nil
-}
-
-func prepareClassifierCode(classifierCode string) (rego.PreparedEvalQuery, error) {
-	log.Tracef("classifier module code: '%s'", classifierCode)
+func ruleRego(code string) (*rego.Rego, error) {
+	log.Tracef("classifier module code: '%s'", code)
 	moduleName := "classifier"
-	compiledRego, err := ast.CompileModules(map[string]string{moduleName: classifierCode})
+	compiledRego, err := ast.CompileModules(map[string]string{moduleName: code})
 	if err != nil {
-		return rego.PreparedEvalQuery{}, fmt.Errorf("error compiling rego code: %w", err)
+		return nil, fmt.Errorf("error compiling rego code: %w", err)
 	}
 	regoQuery := compiledRego.Modules[moduleName].Package.Path.String() + ".output"
-	retVal, err := rego.New(
-		rego.Query(regoQuery),
-		rego.Compiler(compiledRego),
-	).PrepareForEval(context.Background())
-	if err != nil {
-		return rego.PreparedEvalQuery{}, fmt.Errorf("error preparing rego code for evaluation: %w", err)
-	}
-	return retVal, nil
+	return rego.New(rego.Query(regoQuery), rego.Compiler(compiledRego)), nil
 }
diff --git a/classification/label_classifier.go b/classification/label_classifier.go
new file mode 100644
index 0000000..37fcc29
--- /dev/null
+++ b/classification/label_classifier.go
@@ -0,0 +1,108 @@
+package classification
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/open-policy-agent/opa/rego"
+	log "github.com/sirupsen/logrus"
+)
+
+// LabelClassifier is a Classifier implementation that uses a set of labels and
+// their classification rules to classify data.
+type LabelClassifier struct {
+	labels LabelSet
+}
+
+// LabelClassifier implements Classifier
+var _ Classifier = (*LabelClassifier)(nil)
+
+// NewLabelClassifier creates a new LabelClassifier with the provided labels and
+// classification rules.
+func NewLabelClassifier(labels ...Label) (*LabelClassifier, error) {
+	if len(labels) == 0 {
+		return nil, fmt.Errorf("labels cannot be empty")
+	}
+	l := make(LabelSet, len(labels))
+	for _, lbl := range labels {
+		l[lbl.Name] = lbl
+	}
+	return &LabelClassifier{labels: l}, nil
+}
+
+// Classify performs the classification of the provided attributes using the
+// classifier's labels and classification rules. It returns a Result, which is
+// a map of attribute names to the set of labels that the attribute was
+// classified as.
+func (c *LabelClassifier) Classify(ctx context.Context, input map[string]any) (Result, error) {
+	result := make(Result, len(c.labels))
+	for _, lbl := range c.labels {
+		output, err := evalQuery(ctx, lbl.ClassificationRule, input)
+		if err != nil {
+			return nil, fmt.Errorf("error evaluating query for label %s: %w", lbl.Name, err)
+		}
+		log.Debugf("classification results for label %s: %v", lbl.Name, output)
+		for attrName, classified := range output {
+			if classified {
+				attrLabels, ok := result[attrName]
+				if !ok {
+					attrLabels = make(LabelSet)
+					result[attrName] = attrLabels
+				}
+				attrLabels[lbl.Name] = lbl
+			}
+		}
+	}
+	return result, nil
+}
+
+// evalQuery evaluates the provided prepared Rego query with the given
+// attributes as input, and returns the classification results. The output is a
+// map of attribute names to boolean values, where the boolean indicates whether
+// the attribute is classified as belonging to the label.
+func evalQuery(ctx context.Context, rule *rego.Rego, input map[string]any) (map[string]bool, error) {
+	q, err := rule.PrepareForEval(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("error preparing rule for evaluation: %w", err)
+	}
+	// Evaluate the prepared Rego query. This performs the actual classification
+	// logic.
+	res, err := q.Eval(ctx, rego.EvalInput(input))
+	if err != nil {
+		return nil, fmt.Errorf(
+			"error evaluating query for input %s; %w", input, err,
+		)
+	}
+	// Ensure the result is well-formed.
+	if len(res) != 1 {
+		return nil, fmt.Errorf("expected 1 result but found: %d", len(res))
+	}
+	if len(res[0].Expressions) != 1 {
+		return nil, fmt.Errorf("expected 1 expression but found: %d", len(res[0].Expressions))
+	}
+	if res[0].Expressions[0] == nil {
+		return nil, fmt.Errorf("expression is nil")
+	}
+	if res[0].Expressions[0].Value == nil {
+		return nil, fmt.Errorf("expression value is nil")
+	}
+	// Unpack the results. The output is expected to be a map[string]bool, where
+	// the key is the attribute name and the value is a boolean indicating
+	// whether the attribute is classified as belonging to the label.
+	val, ok := res[0].Expressions[0].Value.(map[string]any)
+	if !ok {
+		return nil, fmt.Errorf(
+			"expected output type to be map[string]any, but found: %T",
+			res[0].Expressions[0].Value,
+		)
+	}
+	output := make(map[string]bool, len(val))
+	for k, v := range val {
+		if b, ok := v.(bool); ok {
+			output[k] = b
+		} else {
+			return nil, fmt.Errorf("expected value to be bool but found: %T", v)
+		}
+	}
+	return output, nil
+}
diff --git a/classification/label_classifier_test.go b/classification/label_classifier_test.go
new file mode 100644
index 0000000..698035c
--- /dev/null
+++ b/classification/label_classifier_test.go
@@ -0,0 +1,155 @@
+package classification
+
+import (
+	"context"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestNewLabelClassifier_Success(t *testing.T) {
+	classifier, err := NewLabelClassifier(Label{Name: "foo"})
+	require.NoError(t, err)
+	require.NotNil(t, classifier)
+}
+
+func TestLabelClassifier_Classify(t *testing.T) {
+	tests := []struct {
+		name       string
+		classifier *LabelClassifier
+		input      map[string]any
+		want       Result
+		wantError  require.ErrorAssertionFunc
+	}{
+		{
+			name:       "nil input",
+			classifier: &LabelClassifier{},
+			input:      nil,
+			want:       make(Result),
+		},
+		{
+			name:       "empty input",
+			classifier: &LabelClassifier{},
+			input:      map[string]any{},
+			want:       make(Result),
+		},
+		{
+			name:       "success: single label, single attribute",
+			classifier: newTestLabelClassifier(t, "AGE"),
+			input:      map[string]any{"age": "42"},
+			want: Result{
+				"age": {
+					"AGE": Label{Name: "AGE"},
+				},
+			},
+		},
+		{
+			name:       "success: single label, multiple attributes",
+			classifier: newTestLabelClassifier(t, "AGE"),
+			input: map[string]any{
+				"age": "42",
+				"ccn": "4111111111111111",
+			},
+			want: Result{
+				"age": {
+					"AGE": Label{Name: "AGE"},
+				},
+			},
+		},
+		{
+			name:       "success: multiple labels, single attribute",
+			classifier: newTestLabelClassifier(t, "AGE", "CCN"),
+			input:      map[string]any{"age": "42"},
+			want: Result{
+				"age": {
+					"AGE": Label{Name: "AGE"},
+				},
+			},
+		},
+		{
+			name:       "success: multiple labels, multiple attributes",
+			classifier: newTestLabelClassifier(t, "AGE", "CCN"),
+			input: map[string]any{
+				"age": "42",
+				"ccn": "4111111111111111",
+			},
+			want: Result{
+				"age": {
+					"AGE": Label{Name: "AGE"},
+				},
+				"ccn": {
+					"CCN": Label{Name: "CCN"},
+				},
+			},
+		},
+		{
+			name:       "success: multiple labels, multiple attributes, false positive",
+			classifier: newTestLabelClassifier(t, "AGE", "CVV"),
+			input: map[string]any{
+				"age": "101",
+				"cvv": "234",
+			},
+			want: Result{
+				"age": {
+					"AGE": Label{Name: "AGE"},
+					"CVV": Label{Name: "CVV"},
+				},
+				"cvv": {
+					"CVV": Label{Name: "CVV"},
+				},
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(
+			tt.name, func(t *testing.T) {
+				got, err := tt.classifier.Classify(context.Background(), tt.input)
+				if tt.wantError == nil {
+					tt.wantError = require.NoError
+				}
+				tt.wantError(t, err)
+				requireResultEqual(t, tt.want, got)
+			},
+		)
+	}
+}
+
+func requireResultEqual(t *testing.T, want, got Result) {
+	require.Len(t, got, len(want))
+	for k, v := range want {
+		gotSet, ok := got[k]
+		require.Truef(t, ok, "missing attribute %s", k)
+		requireLabelSetEqual(t, v, gotSet)
+	}
+}
+
+func requireLabelSetEqual(t *testing.T, want, got LabelSet) {
+	require.Len(t, got, len(want))
+	for k, v := range want {
+		gotLbl, ok := got[k]
+		require.Truef(t, ok, "missing label %s", k)
+		require.Equal(t, v.Name, gotLbl.Name)
+	}
+}
+
+func newTestLabelClassifier(t *testing.T, lblNames ...string) *LabelClassifier {
+	lbls := make([]Label, len(lblNames))
+	for i, lblName := range lblNames {
+		lbls[i] = newTestLabel(t, lblName)
+	}
+	classifier, err := NewLabelClassifier(lbls...)
+	require.NoError(t, err)
+	return classifier
+}
+
+func newTestLabel(t *testing.T, lblName string) Label {
+	fname := "rego/" + strings.ReplaceAll(strings.ToLower(lblName), " ", "_") + ".rego"
+	fin, err := regoFs.ReadFile(fname)
+	require.NoError(t, err)
+	classifierCode := string(fin)
+	lbl, err := NewLabel(lblName, "test label", classifierCode, nil)
+	require.NoError(t, err)
+	return lbl
+}
diff --git a/classification/label_test.go b/classification/label_test.go
new file mode 100644
index 0000000..8b718f2
--- /dev/null
+++ b/classification/label_test.go
@@ -0,0 +1,13 @@
+package classification
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestGetEmbeddedLabels(t *testing.T) {
+	got, err := GetEmbeddedLabels()
+	require.NoError(t, err)
+	require.NotEmpty(t, got)
+}
diff --git a/classification/mock_classifier_test.go b/classification/mock_classifier_test.go
new file mode 100644
index 0000000..82ad1a7
--- /dev/null
+++ b/classification/mock_classifier_test.go
@@ -0,0 +1,95 @@
+// Code generated by mockery v2.42.1. DO NOT EDIT.
+
+package classification
+
+import (
+	context "context"
+
+	mock "github.com/stretchr/testify/mock"
+)
+
+// MockClassifier is an autogenerated mock type for the Classifier type
+type MockClassifier struct {
+	mock.Mock
+}
+
+type MockClassifier_Expecter struct {
+	mock *mock.Mock
+}
+
+func (_m *MockClassifier) EXPECT() *MockClassifier_Expecter {
+	return &MockClassifier_Expecter{mock: &_m.Mock}
+}
+
+// Classify provides a mock function with given fields: ctx, input
+func (_m *MockClassifier) Classify(ctx context.Context, input map[string]interface{}) (Result, error) {
+	ret := _m.Called(ctx, input)
+
+	if len(ret) == 0 {
+		panic("no return value specified for Classify")
+	}
+
+	var r0 Result
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, map[string]interface{}) (Result, error)); ok {
+		return rf(ctx, input)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, map[string]interface{}) Result); ok {
+		r0 = rf(ctx, input)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(Result)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, map[string]interface{}) error); ok {
+		r1 = rf(ctx, input)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// MockClassifier_Classify_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Classify'
+type MockClassifier_Classify_Call struct {
+	*mock.Call
+}
+
+// Classify is a helper method to define mock.On call
+//   - ctx context.Context
+//   - input map[string]interface{}
+func (_e *MockClassifier_Expecter) Classify(ctx interface{}, input interface{}) *MockClassifier_Classify_Call {
+	return &MockClassifier_Classify_Call{Call: _e.mock.On("Classify", ctx, input)}
+}
+
+func (_c *MockClassifier_Classify_Call) Run(run func(ctx context.Context, input map[string]interface{})) *MockClassifier_Classify_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run(args[0].(context.Context), args[1].(map[string]interface{}))
+	})
+	return _c
+}
+
+func (_c *MockClassifier_Classify_Call) Return(_a0 Result, _a1 error) *MockClassifier_Classify_Call {
+	_c.Call.Return(_a0, _a1)
+	return _c
+}
+
+func (_c *MockClassifier_Classify_Call) RunAndReturn(run func(context.Context, map[string]interface{}) (Result, error)) *MockClassifier_Classify_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// NewMockClassifier creates a new instance of MockClassifier. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
+// The first argument is typically a *testing.T value.
+func NewMockClassifier(t interface {
+	mock.TestingT
+	Cleanup(func())
+}) *MockClassifier {
+	mock := &MockClassifier{}
+	mock.Mock.Test(t)
+
+	t.Cleanup(func() { mock.AssertExpectations(t) })
+
+	return mock
+}
diff --git a/classification/publisher/publisher.go b/classification/publisher/publisher.go
index 97a33b7..3c3f02f 100644
--- a/classification/publisher/publisher.go
+++ b/classification/publisher/publisher.go
@@ -11,11 +11,8 @@ import (
 // Publisher publishes classification and discovery results to some destination,
 // which is left up to the implementer.
 type Publisher interface {
-	// PublishClassifications publishes a list of classification.Result to
-	// some destination. Any error(s) during publication should be returned.
-	PublishClassifications(
-		ctx context.Context,
-		repoId string,
-		results []classification.Result,
-	) error
+	// PublishClassifications publishes a slice of
+	// classification.ClassifiedTable to some destination. Any error(s) during
+	// publication should be returned.
+	PublishClassifications(ctx context.Context, repoId string, results []classification.ClassifiedTable) error
 }
diff --git a/classification/publisher/stdout.go b/classification/publisher/stdout.go
index 30b65b7..3e0fd17 100644
--- a/classification/publisher/stdout.go
+++ b/classification/publisher/stdout.go
@@ -20,19 +20,17 @@ func NewStdOutPublisher() *StdOutPublisher {
 
 func (c *StdOutPublisher) PublishClassifications(
 	_ context.Context,
-	repoId string,
-	results []classification.Result,
+	_ string,
+	tables []classification.ClassifiedTable,
 ) error {
-	classifications := struct {
-		Repo            string                  `json:"repo"`
-		Classifications []classification.Result `json:"classifications"`
+	results := struct {
+		Results []classification.ClassifiedTable `json:"results"`
 	}{
-		Repo:            repoId,
-		Classifications: results,
+		Results: tables,
 	}
-	b, err := json.MarshalIndent(classifications, "", "    ")
+	b, err := json.MarshalIndent(results, "", "    ")
 	if err != nil {
-		return fmt.Errorf("failed to marshal classifications: %w", err)
+		return fmt.Errorf("failed to marshal results: %w", err)
 	}
 	fmt.Println(string(b))
 	return nil
diff --git a/classification/rego/labels.yaml b/classification/rego/labels.yaml
index 0565e07..a72e978 100644
--- a/classification/rego/labels.yaml
+++ b/classification/rego/labels.yaml
@@ -5,73 +5,73 @@
 # YAML structure:
 #
 # labels:               # The list of labels
-#   - name: foo         # The label name
+#   FOO:                # The label name
 #     description: bar  # The label description
 #     tags:             # The label tags (list)
 #       - tag1
 #       - tag2
 labels:
-  - name: ADDRESS
+  ADDRESS:
     description: Address
     tags:
       - PII
 
-  - name: AGE
+  AGE:
     description: Age
     tags:
       - PII
 
-  - name: CCN
+  CCN:
     description: Credit card number
     tags:
       - PCI
 
-  - name: CVV
+  CVV:
     description: Credit card verification value (CVV)
     tags:
       - PCI
 
-  - name: DOB
+  DOB:
     description: Date of birth
     tags:
       - PII
 
-  - name: EMAIL
+  EMAIL:
     description: Email address
     tags:
       - PII
 
-  - name: FIRST_NAME
+  FIRST_NAME:
     description: First name
     tags:
       - PII
 
-  - name: FULL_NAME
+  FULL_NAME:
     description: Full name
     tags:
       - PII
 
-  - name: IP_ADDRESS
+  IP_ADDRESS:
     description: IP address
     tags:
       - PII
 
-  - name: LAST_NAME
+  LAST_NAME:
     description: Last name
     tags:
       - PII
 
-  - name: PASSPORT
+  PASSPORT:
     description: Passport number
     tags:
       - PII
 
-  - name: PHONE
+  PHONE:
     description: Phone number
     tags:
       - PII
 
-  - name: SSN
+  SSN:
     description: Social security number
     tags:
       - PII
diff --git a/cmd/main.go b/cmd/main.go
index f0444ef..632b9c3 100644
--- a/cmd/main.go
+++ b/cmd/main.go
@@ -8,7 +8,6 @@ import (
 )
 
 type Globals struct {
-	// TODO: add config file as global -ccampo 2024-03-22
 	LogLevel  logLevelFlag     `help:"Set the logging level (trace|debug|info|warn|error|fatal)" enum:"trace,debug,info,warn,error,fatal" default:"info"`
 	LogFormat logFormatFlag    `help:"Set the logging format (text|json)" enum:"text,json" default:"text"`
 	Version   kong.VersionFlag `name:"version" help:"Print version information and quit"`
@@ -51,6 +50,10 @@ type CLI struct {
 	RepoScan RepoScanCmd `cmd:"" help:"Perform data discovery and classification on a data repository."`
 }
 
+// version is the application version. It is intended to be set at compile time
+// via the linker (e.g. -ldflags="-X main.version=...").
+var version string
+
 func main() {
 	cli := CLI{
 		Globals: Globals{},
@@ -66,8 +69,7 @@ func main() {
 			},
 		),
 		kong.Vars{
-			// TODO: get version from file -ccampo 2024-03-27
-			"version": "0.0.1",
+			"version": version,
 		},
 	)
 	err := ctx.Run(&cli.Globals)
diff --git a/discovery/config/config.go b/discovery/config/config.go
index 7b1a052..5bdd28a 100644
--- a/discovery/config/config.go
+++ b/discovery/config/config.go
@@ -9,13 +9,20 @@ import (
 	"github.com/gobwas/glob"
 )
 
-// TODO: godoc -ccampo 2024-03-27
+// Config is the configuration for the application.
 type Config struct {
-	Repo RepoConfig `embed:""`
 	Dmap DmapConfig `embed:""`
+	Repo RepoConfig `embed:""`
+}
+
+// DmapConfig is the necessary configuration to connect to the Dmap API.
+type DmapConfig struct {
+	ApiBaseUrl   string `help:"Base URL of the Dmap API." default:"https://api.dmap.cyral.io"`
+	ClientID     string `help:"API client ID to access the Dmap API."`
+	ClientSecret string `help:"API client secret to access the Dmap API."` //#nosec G101 -- false positive
 }
 
-// TODO: godoc -ccampo 2024-03-27
+// RepoConfig is the necessary configuration to connect to a data repository.
 type RepoConfig struct {
 	Type         string         `help:"Type of repository to connect to (postgres|mysql|oracle|sqlserver|snowflake|redshift|denodo)." enum:"postgres,mysql,oracle,sqlserver,snowflake,redshift,denodo" required:""`
 	Host         string         `help:"Hostname of the repository." required:""`
@@ -33,7 +40,8 @@ type RepoConfig struct {
 // GlobFlag is a kong.MapperValue implementation that represents a glob pattern.
 type GlobFlag []glob.Glob
 
-// TODO: godoc -ccampo 2024-03-27
+// Decode parses the glob patterns and compiles them into glob.Glob objects. It
+// is an implementation of kong.MapperValue's Decode method.
 func (g GlobFlag) Decode(ctx *kong.DecodeContext) error {
 	var patterns string
 	if err := ctx.Scan.PopValueInto("string", &patterns); err != nil {
@@ -50,10 +58,3 @@ func (g GlobFlag) Decode(ctx *kong.DecodeContext) error {
 	ctx.Value.Target.Set(reflect.ValueOf(GlobFlag(parsedPatterns)))
 	return nil
 }
-
-// TODO: godoc -ccampo 2024-03-27
-type DmapConfig struct {
-	ApiBaseUrl   string `help:"Base URL of the Dmap API." default:"https://api.dmap.cyral.io"`
-	ClientID     string `help:"API client ID to access the Dmap API."`
-	ClientSecret string `help:"API client secret to access the Dmap API."` //#nosec G101 -- false positive
-}
diff --git a/discovery/repository/gen.go b/discovery/repository/gen.go
index 05ac883..ac2dbd4 100644
--- a/discovery/repository/gen.go
+++ b/discovery/repository/gen.go
@@ -2,4 +2,4 @@ package repository
 
 // Mock generation - see https://vektra.github.io/mockery/
 
-//go:generate mockery --inpackage --with-expecter --name=Repository --filename=mock_repository.go
+//go:generate mockery --testonly --inpackage --with-expecter --name=Repository --filename=mock_repository_test.go
diff --git a/discovery/repository/metadata.go b/discovery/repository/metadata.go
index 87d783a..ee29a03 100644
--- a/discovery/repository/metadata.go
+++ b/discovery/repository/metadata.go
@@ -16,20 +16,23 @@ type Metadata struct {
 	Schemas  map[string]*SchemaMetadata
 }
 
-// TODO: godoc -ccampo 2024-03-27
+// SchemaMetadata represents the structure of a database schema. It contains a
+// map of tables that belong to the schema. The key is the table name and the
+// value is the table metadata for that table.
 type SchemaMetadata struct {
 	Name   string
 	Tables map[string]*TableMetadata
 }
 
-// TODO: godoc -ccampo 2024-03-27
+// TableMetadata represents the structure of a database table. It contains a
+// slice of attributes (i.e. columns) that belong to the table.
 type TableMetadata struct {
 	Schema     string
 	Name       string
 	Attributes []*AttributeMetadata
 }
 
-// TODO: godoc -ccampo 2024-03-27
+// AttributeNames returns a slice of attribute names for the table.
 func (t *TableMetadata) AttributeNames() []string {
 	attrNames := make([]string, 0, len(t.Attributes))
 	for _, attr := range t.Attributes {
@@ -38,14 +41,16 @@ func (t *TableMetadata) AttributeNames() []string {
 	return attrNames
 }
 
-// TODO: godoc -ccampo 2024-03-27
+// QuotedAttributeNamesString returns a string of comma-separated attribute
+// names for the table, with each name quoted using the given quote character.
 func (t *TableMetadata) QuotedAttributeNamesString(quoteChar string) string {
 	sep := quoteChar + "," + quoteChar
 	commaSeparatedNames := strings.Join(t.AttributeNames(), sep)
 	return quoteChar + commaSeparatedNames + quoteChar
 }
 
-// TODO: godoc -ccampo 2024-03-27
+// AttributeMetadata represents the structure of a database attribute (i.e.
+// column). It contains the schema, table, name, and data type of the attribute.
 type AttributeMetadata struct {
 	Schema   string `field:"table_schema"`
 	Table    string `field:"table_name"`
@@ -53,7 +58,8 @@ type AttributeMetadata struct {
 	DataType string `field:"data_type"`
 }
 
-// TODO: godoc -ccampo 2024-03-27
+// NewMetadata creates a new Metadata object with the given repository type,
+// repository name, and database name, with an empty map of schemas.
 func NewMetadata(repoType, repoName, database string) *Metadata {
 	return &Metadata{
 		Name:     repoName,
@@ -63,7 +69,8 @@ func NewMetadata(repoType, repoName, database string) *Metadata {
 	}
 }
 
-// TODO: godoc -ccampo 2024-03-27
+// NewSchemaMetadata creates a new SchemaMetadata object with the given schema
+// name and an empty map of tables.
 func NewSchemaMetadata(schemaName string) *SchemaMetadata {
 	return &SchemaMetadata{
 		Name:   schemaName,
@@ -71,7 +78,8 @@ func NewSchemaMetadata(schemaName string) *SchemaMetadata {
 	}
 }
 
-// TODO: godoc -ccampo 2024-03-27
+// NewTableMetadata creates a new TableMetadata object with the given schema and
+// table name, and an empty slice of attributes.
 func NewTableMetadata(schemaName, tableName string) *TableMetadata {
 	return &TableMetadata{
 		Schema:     schemaName,
diff --git a/discovery/repository/mock_repository.go b/discovery/repository/mock_repository_test.go
similarity index 82%
rename from discovery/repository/mock_repository.go
rename to discovery/repository/mock_repository_test.go
index 976daca..2ee9187 100644
--- a/discovery/repository/mock_repository.go
+++ b/discovery/repository/mock_repository_test.go
@@ -1,4 +1,4 @@
-// Code generated by mockery v2.40.1. DO NOT EDIT.
+// Code generated by mockery v2.42.1. DO NOT EDIT.
 
 package repository
 
@@ -50,11 +50,9 @@ func (_e *MockRepository_Expecter) Close() *MockRepository_Close_Call {
 }
 
 func (_c *MockRepository_Close_Call) Run(run func()) *MockRepository_Close_Call {
-	_c.Call.Run(
-		func(args mock.Arguments) {
-			run()
-		},
-	)
+	_c.Call.Run(func(args mock.Arguments) {
+		run()
+	})
 	return _c
 }
 
@@ -110,11 +108,9 @@ func (_e *MockRepository_Expecter) Introspect(ctx interface{}) *MockRepository_I
 }
 
 func (_c *MockRepository_Introspect_Call) Run(run func(ctx context.Context)) *MockRepository_Introspect_Call {
-	_c.Call.Run(
-		func(args mock.Arguments) {
-			run(args[0].(context.Context))
-		},
-	)
+	_c.Call.Run(func(args mock.Arguments) {
+		run(args[0].(context.Context))
+	})
 	return _c
 }
 
@@ -123,12 +119,7 @@ func (_c *MockRepository_Introspect_Call) Return(_a0 *Metadata, _a1 error) *Mock
 	return _c
 }
 
-func (_c *MockRepository_Introspect_Call) RunAndReturn(
-	run func(context.Context) (
-		*Metadata,
-		error,
-	),
-) *MockRepository_Introspect_Call {
+func (_c *MockRepository_Introspect_Call) RunAndReturn(run func(context.Context) (*Metadata, error)) *MockRepository_Introspect_Call {
 	_c.Call.Return(run)
 	return _c
 }
@@ -175,11 +166,9 @@ func (_e *MockRepository_Expecter) ListDatabases(ctx interface{}) *MockRepositor
 }
 
 func (_c *MockRepository_ListDatabases_Call) Run(run func(ctx context.Context)) *MockRepository_ListDatabases_Call {
-	_c.Call.Run(
-		func(args mock.Arguments) {
-			run(args[0].(context.Context))
-		},
-	)
+	_c.Call.Run(func(args mock.Arguments) {
+		run(args[0].(context.Context))
+	})
 	return _c
 }
 
@@ -188,12 +177,7 @@ func (_c *MockRepository_ListDatabases_Call) Return(_a0 []string, _a1 error) *Mo
 	return _c
 }
 
-func (_c *MockRepository_ListDatabases_Call) RunAndReturn(
-	run func(context.Context) (
-		[]string,
-		error,
-	),
-) *MockRepository_ListDatabases_Call {
+func (_c *MockRepository_ListDatabases_Call) RunAndReturn(run func(context.Context) ([]string, error)) *MockRepository_ListDatabases_Call {
 	_c.Call.Return(run)
 	return _c
 }
@@ -228,11 +212,9 @@ func (_e *MockRepository_Expecter) Ping(ctx interface{}) *MockRepository_Ping_Ca
 }
 
 func (_c *MockRepository_Ping_Call) Run(run func(ctx context.Context)) *MockRepository_Ping_Call {
-	_c.Call.Run(
-		func(args mock.Arguments) {
-			run(args[0].(context.Context))
-		},
-	)
+	_c.Call.Run(func(args mock.Arguments) {
+		run(args[0].(context.Context))
+	})
 	return _c
 }
 
@@ -247,10 +229,7 @@ func (_c *MockRepository_Ping_Call) RunAndReturn(run func(context.Context) error
 }
 
 // SampleTable provides a mock function with given fields: ctx, meta, params
-func (_m *MockRepository) SampleTable(ctx context.Context, meta *TableMetadata, params SampleParameters) (
-	Sample,
-	error,
-) {
+func (_m *MockRepository) SampleTable(ctx context.Context, meta *TableMetadata, params SampleParameters) (Sample, error) {
 	ret := _m.Called(ctx, meta, params)
 
 	if len(ret) == 0 {
@@ -286,26 +265,14 @@ type MockRepository_SampleTable_Call struct {
 //   - ctx context.Context
 //   - meta *TableMetadata
 //   - params SampleParameters
-func (_e *MockRepository_Expecter) SampleTable(
-	ctx interface{},
-	meta interface{},
-	params interface{},
-) *MockRepository_SampleTable_Call {
+func (_e *MockRepository_Expecter) SampleTable(ctx interface{}, meta interface{}, params interface{}) *MockRepository_SampleTable_Call {
 	return &MockRepository_SampleTable_Call{Call: _e.mock.On("SampleTable", ctx, meta, params)}
 }
 
-func (_c *MockRepository_SampleTable_Call) Run(
-	run func(
-		ctx context.Context,
-		meta *TableMetadata,
-		params SampleParameters,
-	),
-) *MockRepository_SampleTable_Call {
-	_c.Call.Run(
-		func(args mock.Arguments) {
-			run(args[0].(context.Context), args[1].(*TableMetadata), args[2].(SampleParameters))
-		},
-	)
+func (_c *MockRepository_SampleTable_Call) Run(run func(ctx context.Context, meta *TableMetadata, params SampleParameters)) *MockRepository_SampleTable_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run(args[0].(context.Context), args[1].(*TableMetadata), args[2].(SampleParameters))
+	})
 	return _c
 }
 
@@ -314,25 +281,17 @@ func (_c *MockRepository_SampleTable_Call) Return(_a0 Sample, _a1 error) *MockRe
 	return _c
 }
 
-func (_c *MockRepository_SampleTable_Call) RunAndReturn(
-	run func(
-		context.Context,
-		*TableMetadata,
-		SampleParameters,
-	) (Sample, error),
-) *MockRepository_SampleTable_Call {
+func (_c *MockRepository_SampleTable_Call) RunAndReturn(run func(context.Context, *TableMetadata, SampleParameters) (Sample, error)) *MockRepository_SampleTable_Call {
 	_c.Call.Return(run)
 	return _c
 }
 
 // NewMockRepository creates a new instance of MockRepository. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
 // The first argument is typically a *testing.T value.
-func NewMockRepository(
-	t interface {
-		mock.TestingT
-		Cleanup(func())
-	},
-) *MockRepository {
+func NewMockRepository(t interface {
+	mock.TestingT
+	Cleanup(func())
+}) *MockRepository {
 	mock := &MockRepository{}
 	mock.Mock.Test(t)
 
diff --git a/discovery/repository/sample_all_databases_test.go b/discovery/repository/sample_all_databases_test.go
index 2dc6b56..3afe44f 100644
--- a/discovery/repository/sample_all_databases_test.go
+++ b/discovery/repository/sample_all_databases_test.go
@@ -13,8 +13,8 @@ import (
 
 const mockRepoType = "mockRepo"
 
-func setup() *MockRepository {
-	repo := new(MockRepository)
+func setup(t *testing.T) *MockRepository {
+	repo := NewMockRepository(t)
 	Register(
 		mockRepoType,
 		func(ctx context.Context, cfg config.RepoConfig) (Repository, error) {
@@ -29,7 +29,7 @@ func cleanup() {
 }
 
 func TestSampleAllDatabases_Error(t *testing.T) {
-	repo := setup()
+	repo := setup(t)
 	t.Cleanup(cleanup)
 
 	ctx := context.Background()
@@ -43,7 +43,7 @@ func TestSampleAllDatabases_Error(t *testing.T) {
 }
 
 func TestSampleAllDatabases_Successful_TwoDatabases(t *testing.T) {
-	repo := setup()
+	repo := setup(t)
 	t.Cleanup(cleanup)
 
 	ctx := context.Background()
@@ -103,7 +103,7 @@ func TestSampleAllDatabases_Successful_TwoDatabases(t *testing.T) {
 }
 
 func TestSampleAllDatabases_IntrospectError(t *testing.T) {
-	repo := setup()
+	repo := setup(t)
 	t.Cleanup(cleanup)
 
 	ctx := context.Background()
@@ -121,7 +121,7 @@ func TestSampleAllDatabases_IntrospectError(t *testing.T) {
 }
 
 func TestSampleAllDatabases_SampleError(t *testing.T) {
-	repo := setup()
+	repo := setup(t)
 	t.Cleanup(cleanup)
 
 	ctx := context.Background()
@@ -166,7 +166,7 @@ func TestSampleAllDatabases_SampleError(t *testing.T) {
 }
 
 func TestSampleAllDatabases_TwoDatabases_OneSampleError(t *testing.T) {
-	repo := setup()
+	repo := setup(t)
 	t.Cleanup(cleanup)
 
 	ctx := context.Background()
diff --git a/discovery/repository/sampling.go b/discovery/repository/sampling.go
index 07b84d3..3b622c6 100644
--- a/discovery/repository/sampling.go
+++ b/discovery/repository/sampling.go
@@ -12,7 +12,7 @@ type SampleParameters struct {
 
 // Sample represents a sample of a database table. The Metadata field contains
 // metadata about the sample itself. The actual results of the sample, which
-// are  represented by a set of database rows, are contained in the Results
+// are represented by a set of database rows, are contained in the Results
 // field.
 type Sample struct {
 	Metadata SampleMetadata
diff --git a/discovery/scanner.go b/discovery/scanner.go
index 4964952..1cd178e 100644
--- a/discovery/scanner.go
+++ b/discovery/scanner.go
@@ -23,20 +23,25 @@ import (
 	_ "github.com/cyralinc/dmap/discovery/repository/sqlserver"
 )
 
-// TODO: godoc -ccampo 2024-03-27
+// Scanner is a data discovery scanner that scans a data repository for
+// sensitive data. It also classifies the data and publishes the results to
+// the configured external sources.
 type Scanner struct {
-	config      *config.Config
-	repository  repository.Repository
-	classifiers []classification.Classifier
-	publisher   publisher.Publisher
+	config         *config.Config
+	repository     repository.Repository
+	embeddedLabels []classification.Label
+	customLabels   []classification.Label
+	classifier     *classification.LabelClassifier
+	publisher      publisher.Publisher
+	initialized    bool
 }
 
-// TODO: godoc -ccampo 2024-03-27
+// NewScanner creates a new Scanner instance with the given configuration.
 func NewScanner(config *config.Config) Scanner {
 	return Scanner{config: config}
 }
 
-// TODO: godoc -ccampo 2024-03-27
+// Init initializes the Scanner instance. It must be called before calling Run.
 func (s *Scanner) Init(ctx context.Context) error {
 	if s.config == nil {
 		return errors.New("unable to start crawler: config not found")
@@ -44,24 +49,26 @@ func (s *Scanner) Init(ctx context.Context) error {
 	// Note: order is important here because we don't have nil checks in these
 	// init methods.
 	s.initPublisher()
-
-	if err := s.initEmbeddedClassifiers(); err != nil {
+	if err := s.initEmbeddedLabels(); err != nil {
 		return err
 	}
-	if err := s.initRepository(ctx); err != nil {
+	if err := s.initLabelClassifier(); err != nil {
 		return err
 	}
-	return nil
-}
-
-func (s *Scanner) InitAndRun(ctx context.Context) error {
-	if err := s.Init(ctx); err != nil {
+	if err := s.initRepository(ctx); err != nil {
 		return err
 	}
-	return s.Run(ctx)
+	// Done!
+	s.initialized = true
+	return nil
 }
 
+// Run runs the data repository scan. It samples the data repository, classifies
+// the data, and publishes the results to the configured external sources.
 func (s *Scanner) Run(ctx context.Context) error {
+	if !s.initialized {
+		return errors.New("scanner not initialized")
+	}
 	sampleParams := repository.SampleParameters{SampleSize: s.config.Repo.SampleSize}
 	var samples []repository.Sample
 	// The name of the database to connect to has been left unspecified by
@@ -106,7 +113,7 @@ func (s *Scanner) Run(ctx context.Context) error {
 	}
 
 	// Classify sampled data
-	classifications, err := classification.ClassifySamples(ctx, samples, s.classifiers...)
+	classifications, err := classification.ClassifySamples(ctx, samples, s.classifier)
 	if err != nil {
 		return fmt.Errorf("error classifying samples: %w", err)
 	}
@@ -122,6 +129,15 @@ func (s *Scanner) Run(ctx context.Context) error {
 	return nil
 }
 
+// InitAndRun initializes the Scanner instance and runs the scan. It is a
+// convenience method that calls Init followed by Run.
+func (s *Scanner) InitAndRun(ctx context.Context) error {
+	if err := s.Init(ctx); err != nil {
+		return err
+	}
+	return s.Run(ctx)
+}
+
 func (s *Scanner) Cleanup() {
 	// Nil checks are prevent panics if deps are not yet initialized.
 	if s.repository != nil {
@@ -129,20 +145,26 @@ func (s *Scanner) Cleanup() {
 	}
 }
 
-func (s *Scanner) initEmbeddedClassifiers() error {
-	classifiers, err := classification.GetEmbeddedLabelClassifiers()
+func (s *Scanner) initEmbeddedLabels() error {
+	lbls, err := classification.GetEmbeddedLabels()
 	if err != nil {
-		return fmt.Errorf("error getting embedded label classifiers: %w", err)
+		return fmt.Errorf("error getting embedded labels: %w", err)
 	}
-	s.classifiers = make([]classification.Classifier, len(classifiers))
-	for i, classifier := range classifiers {
-		s.classifiers[i] = classifier
+	s.embeddedLabels = lbls.ToSlice()
+	return nil
+}
+
+func (s *Scanner) initLabelClassifier() error {
+	lbls := append(s.embeddedLabels, s.customLabels...)
+	c, err := classification.NewLabelClassifier(lbls...)
+	if err != nil {
+		return fmt.Errorf("error creating label classifier: %w", err)
 	}
+	s.classifier = c
 	return nil
 }
 
 func (s *Scanner) initPublisher() {
-	// TODO: eventually this should chose between publishing to the api and a local file -ccampo 2024-03-14
 	s.publisher = publisher.NewStdOutPublisher()
 }
 

From b6f658d59b9b910c14a4a9fe3a28d0b5bd8ce38d Mon Sep 17 00:00:00 2001
From: Chris Campo <ccampo133@users.noreply.github.com>
Date: Fri, 29 Mar 2024 13:24:07 -0400
Subject: [PATCH 04/14] Fix OPA tests

---
 .github/workflows/docker.yaml               |  16 +++
 .github/workflows/opa.yaml                  |  22 +++++
 classification/rego/address_test.rego       |  62 ++++++------
 classification/rego/age_test.rego           |  38 ++++----
 classification/rego/ccn_test.rego           |  26 ++---
 classification/rego/cvv_test.rego           |  30 +++---
 classification/rego/dob_test.rego           | 102 ++++++++++----------
 classification/rego/email_test.rego         |  14 +--
 classification/rego/first_name_test.rego    |  50 +++++-----
 classification/rego/full_name_test.rego     |  26 ++---
 classification/rego/ip_address_test.rego    |  26 ++---
 classification/rego/last_name_test.rego     |  50 +++++-----
 classification/rego/passport_test.rego      |  54 ++++++-----
 classification/rego/phone_test.rego         |  14 +--
 classification/rego/ssn_test.rego           |  74 +++++++-------
 discovery/repository/snowflake/snowflake.go |   2 +-
 16 files changed, 335 insertions(+), 271 deletions(-)
 create mode 100644 .github/workflows/docker.yaml
 create mode 100644 .github/workflows/opa.yaml

diff --git a/.github/workflows/docker.yaml b/.github/workflows/docker.yaml
new file mode 100644
index 0000000..9269204
--- /dev/null
+++ b/.github/workflows/docker.yaml
@@ -0,0 +1,16 @@
+name: Build CLI Docker Image
+
+on:
+  push:
+    branches: [ "main" ]
+  pull_request:
+    branches: [ "main" ]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Build Docker image
+        run: docker build . --file Dockerfile
diff --git a/.github/workflows/opa.yaml b/.github/workflows/opa.yaml
new file mode 100644
index 0000000..778f7b6
--- /dev/null
+++ b/.github/workflows/opa.yaml
@@ -0,0 +1,22 @@
+name: Run OPA Tests
+
+on:
+  push:
+    branches: [ "main" ]
+  pull_request:
+    branches: [ "main" ]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository code
+        uses: actions/checkout@v3
+
+      - name: Setup OPA
+        uses: open-policy-agent/setup-opa@v2
+        with:
+          version: latest
+
+      - name: Run OPA Tests
+        run: opa test classification/rego/*.rego -v
diff --git a/classification/rego/address_test.rego b/classification/rego/address_test.rego
index e97150e..98b1b67 100644
--- a/classification/rego/address_test.rego
+++ b/classification/rego/address_test.rego
@@ -1,61 +1,63 @@
 package classifier_address
 
-test_no_label {
-    output.column == "UNLABELED" with input as {"column":"invalid"}
+import rego.v1
+
+test_no_label if {
+    output.column == false with input as {"column":"invalid"}
 }
 
-test_column_name_state {
-    output.state == "ADDRESS" with input as {"state":"AZ"}
+test_column_name_state if {
+    output.state == true with input as {"state":"AZ"}
 }
 
-test_insensitive_column_name_state {
-    output.STATE == "ADDRESS" with input as {"STATE":"AZ"}
+test_insensitive_column_name_state if {
+    output.STATE == true with input as {"STATE":"AZ"}
 }
 
-test_column_name_address {
-    output.address == "ADDRESS" with input as {"address":"123 some street"}
+test_column_name_address if {
+    output.address == true with input as {"address":"123 some street"}
 }
 
-test_insensitive_column_name_address {
-    output.ADDRESS == "ADDRESS" with input as {"ADDRESS":"123 some street"}
+test_insensitive_column_name_address if {
+    output.ADDRESS == true with input as {"ADDRESS":"123 some street"}
 }
 
-test_column_name_contains_address {
-    output.some_address_here == "ADDRESS" with input as {"some_address_here":"123 some street"}
+test_column_name_contains_address if {
+    output.some_address_here == true with input as {"some_address_here":"123 some street"}
 }
 
-test_insensitive_column_name_contains_address {
-    output.some_ADDRESS_Here == "ADDRESS" with input as {"some_ADDRESS_Here":"123 some street"}
+test_insensitive_column_name_contains_address if {
+    output.some_ADDRESS_Here == true with input as {"some_ADDRESS_Here":"123 some street"}
 }
 
-test_column_name_street {
-    output.street == "ADDRESS" with input as {"street":"123 some street"}
+test_column_name_street if {
+    output.street == true with input as {"street":"123 some street"}
 }
 
-test_insensitive_column_name_street {
-    output.STREET == "ADDRESS" with input as {"STREET":"123 some street"}
+test_insensitive_column_name_street if {
+    output.STREET == true with input as {"STREET":"123 some street"}
 }
 
-test_column_name_starts_with_street {
-    output.street_name == "ADDRESS" with input as {"street_name":"123 some street"}
+test_column_name_starts_with_street if {
+    output.street_name == true with input as {"street_name":"123 some street"}
 }
 
-test_insensitive_column_name_starts_with_street {
-    output.STREET_Name == "ADDRESS" with input as {"STREET_Name":"123 some street"}
+test_insensitive_column_name_starts_with_street if {
+    output.STREET_Name == true with input as {"STREET_Name":"123 some street"}
 }
 
-test_column_name_zip {
-    output.zip == "ADDRESS" with input as {"zip":"11111"}
+test_column_name_zip if {
+    output.zip == true with input as {"zip":"11111"}
 }
 
-test_insensitive_column_name_zip {
-    output.ZIP == "ADDRESS" with input as {"ZIP":"11111"}
+test_insensitive_column_name_zip if {
+    output.ZIP == true with input as {"ZIP":"11111"}
 }
 
-test_column_name_zipcode {
-    output.zipcode == "ADDRESS" with input as {"zipcode":"11111"}
+test_column_name_zipcode if {
+    output.zipcode == true with input as {"zipcode":"11111"}
 }
 
-test_insensitive_column_name_zipcode {
-    output.ZIPCODE == "ADDRESS" with input as {"ZIPCODE":"11111"}
+test_insensitive_column_name_zipcode if {
+    output.ZIPCODE == true with input as {"ZIPCODE":"11111"}
 }
diff --git a/classification/rego/age_test.rego b/classification/rego/age_test.rego
index edc3ef5..3f6810a 100644
--- a/classification/rego/age_test.rego
+++ b/classification/rego/age_test.rego
@@ -1,37 +1,39 @@
 package classifier_age
 
-test_no_label {
-    output.column == "UNLABELED" with input as {"column":"invalid"}
+import rego.v1
+
+test_no_label if {
+    output.column == false with input as {"column":"invalid"}
 }
 
-test_column_name_age_invalid_age {
-    output.age == "UNLABELED" with input as {"age":"120"}
+test_column_name_age_invalid_age if {
+    output.age == false with input as {"age":"120"}
 }
 
-test_insensitive_column_name_age_invalid {
-    output.AGE == "UNLABELED" with input as {"AGE":"120"}
+test_insensitive_column_name_age_invalid if {
+    output.AGE == false with input as {"AGE":"120"}
 }
 
-test_column_name_age_single_digit {
-    output.age == "AGE" with input as {"age":"1"}
+test_column_name_age_single_digit if {
+    output.age == true with input as {"age":"1"}
 }
 
-test_insensitive_column_name_age_single_digit {
-    output.AGE == "AGE" with input as {"AGE":"1"}
+test_insensitive_column_name_age_single_digit if {
+    output.AGE == true with input as {"AGE":"1"}
 }
 
-test_column_name_age_double_digit {
-    output.age == "AGE" with input as {"age":"10"}
+test_column_name_age_double_digit if {
+    output.age == true with input as {"age":"10"}
 }
 
-test_insensitive_column_name_age_double_digit {
-    output.AGE == "AGE" with input as {"AGE":"10"}
+test_insensitive_column_name_age_double_digit if {
+    output.AGE == true with input as {"AGE":"10"}
 }
 
-test_column_name_age_triple_digit {
-    output.age == "AGE" with input as {"age":"100"}
+test_column_name_age_triple_digit if {
+    output.age == true with input as {"age":"100"}
 }
 
-test_insensitive_column_name_age_triple_digit {
-    output.AGE == "AGE" with input as {"AGE":"100"}
+test_insensitive_column_name_age_triple_digit if {
+    output.AGE == true with input as {"AGE":"100"}
 }
diff --git a/classification/rego/ccn_test.rego b/classification/rego/ccn_test.rego
index 31d2e40..b41dfb9 100644
--- a/classification/rego/ccn_test.rego
+++ b/classification/rego/ccn_test.rego
@@ -1,26 +1,28 @@
 package classifier_ccn
 
-test_no_label {
-    output.column == "UNLABELED" with input as {"column":"invalid"}
+import rego.v1
+
+test_no_label if {
+    output.column == false with input as {"column":"invalid"}
 }
 
-test_valid_amex_ccn {
-    output.message == "CCN" with input as {"message":"370136066365291"}
+test_valid_amex_ccn if {
+    output.message == true with input as {"message":"370136066365291"}
 }
 
-test_valid_visa_ccn {
-    output.message == "CCN" with input as {"message":"4613688275707134"}
+test_valid_visa_ccn if {
+    output.message == true with input as {"message":"4613688275707134"}
 }
 
-test_valid_mastercard_ccn {
-    output.message == "CCN" with input as {"message":"5423909386888564"}
+test_valid_mastercard_ccn if {
+    output.message == true with input as {"message":"5423909386888564"}
 }
 
 # TODO : Fix pattern to match
-test_valid_mastercard_ccn {
-    output.message == "CCN" with input as {"message":"2701306282695666"}
+test_valid_mastercard_ccn if {
+    output.message == true with input as {"message":"2701306282695666"}
 }
 
-test_valid_discover_ccn {
-    output.message == "CCN" with input as {"message":"6536673682309236"}
+test_valid_discover_ccn if {
+    output.message == true with input as {"message":"6536673682309236"}
 }
diff --git a/classification/rego/cvv_test.rego b/classification/rego/cvv_test.rego
index 233ec72..a947863 100644
--- a/classification/rego/cvv_test.rego
+++ b/classification/rego/cvv_test.rego
@@ -1,29 +1,31 @@
 package classifier_cvv
 
-test_cvv_key {
-	output.CVV == "CVV" with input as {"CVV":"test"}
+import rego.v1
+
+test_cvv_key if {
+	output.CVV == true with input as {"CVV":"test"}
 }
 
-test_cvv_key {
-	output.cvv == "CVV" with input as {"cvv":"test"}
+test_cvv_key if {
+	output.cvv == true with input as {"cvv":"test"}
 }
 
-test_cvv_key {
-	output.CvV == "CVV" with input as {"CvV":"test"}
+test_cvv_key if {
+	output.CvV == true with input as {"CvV":"test"}
 }
 
-test_cvv_pattern {
-	output.message == "CVV" with input as {"message":"451"}
+test_cvv_pattern if {
+	output.message == true with input as {"message":"451"}
 }
 
-test_cvv_pattern {
-	output.message == "CVV" with input as {"message":"5061"}
+test_cvv_pattern if {
+	output.message == true with input as {"message":"5061"}
 }
 
-test_cvv_pattern {
-	output.message == "CVV" with input as {"message":"123"}
+test_cvv_pattern if {
+	output.message == true with input as {"message":"123"}
 }
 
-test_cvv_pattern {
-	output.message == "UNLABELED" with input as {"message":"12345"}
+test_cvv_pattern if {
+	output.message == false with input as {"message":"12345"}
 }
diff --git a/classification/rego/dob_test.rego b/classification/rego/dob_test.rego
index bd25728..dfaab5a 100644
--- a/classification/rego/dob_test.rego
+++ b/classification/rego/dob_test.rego
@@ -1,110 +1,112 @@
 package classifier_dob
 
-test_dob_key {
-	output.dob == "DOB" with input as {"dob":"test"}
+import rego.v1
+
+test_dob_key if {
+	output.dob == true with input as {"dob":"test"}
 }
 
-test_dob_key {
-	output.DOB == "DOB" with input as {"DOB":"test"}
+test_dob_key if {
+	output.DOB == true with input as {"DOB":"test"}
 }
 
-test_dob_key {
-	output.DoB == "DOB" with input as {"DoB":"test"}
+test_dob_key if {
+	output.DoB == true with input as {"DoB":"test"}
 }
 
-test_dob_key {
-	output.birthdate == "DOB" with input as {"birthdate":"test"}
+test_dob_key if {
+	output.birthdate == true with input as {"birthdate":"test"}
 }
 
-test_dob_key {
-	output.BirthDate == "DOB" with input as {"BirthDate":"test"}
+test_dob_key if {
+	output.BirthDate == true with input as {"BirthDate":"test"}
 }
 
-test_dob_key {
-	output.dateofbirth == "DOB" with input as {"dateofbirth":"test"}
+test_dob_key if {
+	output.dateofbirth == true with input as {"dateofbirth":"test"}
 }
 
-test_dob_key {
-	output.DateOfBirth == "DOB" with input as {"DateOfBirth":"test"}
+test_dob_key if {
+	output.DateOfBirth == true with input as {"DateOfBirth":"test"}
 }
 
-test_dob_key {
-	output.birthdate == "DOB" with input as {"birthdate":"test"}
+test_dob_key if {
+	output.birthdate == true with input as {"birthdate":"test"}
 }
 
-test_dob_key {
-	output.birth_date == "DOB" with input as {"birth_date":"test"}
+test_dob_key if {
+	output.birth_date == true with input as {"birth_date":"test"}
 }
 
 # mm/dd/yyyy
 
-test_dob_pattern {
-	output.message == "DOB" with input as {"message":"01/01/1900"}
+test_dob_pattern if {
+	output.message == true with input as {"message":"01/01/1900"}
 }
 
-test_dob_pattern {
-	output.message == "DOB" with input as {"message":"1-1-1900"}
+test_dob_pattern if {
+	output.message == true with input as {"message":"1-1-1900"}
 }
 
-test_dob_pattern {
-	output.message == "DOB" with input as {"message":"10.01.1971"}
+test_dob_pattern if {
+	output.message == true with input as {"message":"10.01.1971"}
 }
 
-test_dob_pattern {
-	output.message == "DOB" with input as {"message":"11/30/2023"}
+test_dob_pattern if {
+	output.message == true with input as {"message":"11/30/2023"}
 }
 
 # dd/mm/yyyy
 
-test_dob_pattern {
-	output.message == "DOB" with input as {"message":"01/01/1900"}
+test_dob_pattern if {
+	output.message == true with input as {"message":"01/01/1900"}
 }
 
-test_dob_pattern {
-	output.message == "DOB" with input as {"message":"1/1/1900"}
+test_dob_pattern if {
+	output.message == true with input as {"message":"1/1/1900"}
 }
 
-test_dob_pattern {
-	output.message == "DOB" with input as {"message":"10/01/1971"}
+test_dob_pattern if {
+	output.message == true with input as {"message":"10/01/1971"}
 }
 
-test_dob_pattern {
-	output.message == "DOB" with input as {"message":"30/11/2023"}
+test_dob_pattern if {
+	output.message == true with input as {"message":"30/11/2023"}
 }
 
 
 # yyyy/mm/dd
 
-test_dob_pattern {
-	output.message == "DOB" with input as {"message":"1900/01/10"}
+test_dob_pattern if {
+	output.message == true with input as {"message":"1900/01/10"}
 }
 
-test_dob_pattern {
-	output.message == "DOB" with input as {"message":"1900/1/1"}
+test_dob_pattern if {
+	output.message == true with input as {"message":"1900/1/1"}
 }
 
-test_dob_pattern {
-	output.message == "DOB" with input as {"message":"1971/10/01"}
+test_dob_pattern if {
+	output.message == true with input as {"message":"1971/10/01"}
 }
 
-test_dob_pattern {
-	output.message == "DOB" with input as {"message":"2023/12/31"}
+test_dob_pattern if {
+	output.message == true with input as {"message":"2023/12/31"}
 }
 
 # yyyy-mm-dd
 
-test_dob_pattern {
-	output.message == "DOB" with input as {"message":"1900-01-10"}
+test_dob_pattern if {
+	output.message == true with input as {"message":"1900-01-10"}
 }
 
-test_dob_pattern {
-	output.message == "DOB" with input as {"message":"1900-1-1"}
+test_dob_pattern if {
+	output.message == true with input as {"message":"1900-1-1"}
 }
 
-test_dob_pattern {
-	output.message == "DOB" with input as {"message":"1971-10-01"}
+test_dob_pattern if {
+	output.message == true with input as {"message":"1971-10-01"}
 }
 
-test_dob_pattern {
-	output.message == "DOB" with input as {"message":"2023-12-31"}
+test_dob_pattern if {
+	output.message == true with input as {"message":"2023-12-31"}
 }
diff --git a/classification/rego/email_test.rego b/classification/rego/email_test.rego
index 3a5b007..62d389e 100644
--- a/classification/rego/email_test.rego
+++ b/classification/rego/email_test.rego
@@ -1,13 +1,15 @@
 package classifier_email
 
-test_no_label {
-    output.column == "UNLABELED" with input as {"column":"invalid"}
+import rego.v1
+
+test_no_label if {
+    output.column == false with input as {"column":"invalid"}
 }
 
-test_valid_email_com {
-    output.message == "EMAIL" with input as {"message":"me@me.com"}
+test_valid_email_com if {
+    output.message == true with input as {"message":"me@me.com"}
 }
 
-test_valid_email_us {
-    output.message == "EMAIL" with input as {"message":"me@state.pa.us"}
+test_valid_email_us if {
+    output.message == true with input as {"message":"me@state.pa.us"}
 }
diff --git a/classification/rego/first_name_test.rego b/classification/rego/first_name_test.rego
index 6c16add..b8d4b9d 100644
--- a/classification/rego/first_name_test.rego
+++ b/classification/rego/first_name_test.rego
@@ -1,49 +1,51 @@
 package classifier_first_name
 
-test_fn_pattern {
-	output.first_name == "FIRST_NAME" with input as {"first_name":"John"}
+import rego.v1
+
+test_fn_pattern if {
+	output.first_name == true with input as {"first_name":"John"}
 }
 
-test_fn_pattern {
-	output.first_name == "FIRST_NAME" with input as {"first_name":"Robert"}
+test_fn_pattern if {
+	output.first_name == true with input as {"first_name":"Robert"}
 }
 
-test_fn_pattern {
-	output.firstname == "FIRST_NAME" with input as {"firstname":"Robert"}
+test_fn_pattern if {
+	output.firstname == true with input as {"firstname":"Robert"}
 }
 
-test_fn_pattern {
-	output.firstName == "FIRST_NAME" with input as {"firstName":"Robert"}
+test_fn_pattern if {
+	output.firstName == true with input as {"firstName":"Robert"}
 }
 
-test_fn_pattern {
-	output.First_Name == "FIRST_NAME" with input as {"First_Name":"Robert"}
+test_fn_pattern if {
+	output.First_Name == true with input as {"First_Name":"Robert"}
 }
 
-test_fn_pattern {
-	output.FirstName == "FIRST_NAME" with input as {"FirstName":"Robert"}
+test_fn_pattern if {
+	output.FirstName == true with input as {"FirstName":"Robert"}
 }
 
-test_gn_pattern {
-	output.given_name == "FIRST_NAME" with input as {"given_name":"John"}
+test_gn_pattern if {
+	output.given_name == true with input as {"given_name":"John"}
 }
 
-test_gn_pattern {
-	output.given_name == "FIRST_NAME" with input as {"given_name":"Robert"}
+test_gn_pattern if {
+	output.given_name == true with input as {"given_name":"Robert"}
 }
 
-test_gn_pattern {
-	output.givenname == "FIRST_NAME" with input as {"givenname":"Robert"}
+test_gn_pattern if {
+	output.givenname == true with input as {"givenname":"Robert"}
 }
 
-test_gn_pattern {
-	output.givenName == "FIRST_NAME" with input as {"givenName":"Robert"}
+test_gn_pattern if {
+	output.givenName == true with input as {"givenName":"Robert"}
 }
 
-test_gn_pattern {
-	output.Given_Name == "FIRST_NAME" with input as {"Given_Name":"Robert"}
+test_gn_pattern if {
+	output.Given_Name == true with input as {"Given_Name":"Robert"}
 }
 
-test_gn_pattern {
-	output.GivenName == "FIRST_NAME" with input as {"GivenName":"Robert"}
+test_gn_pattern if {
+	output.GivenName == true with input as {"GivenName":"Robert"}
 }
diff --git a/classification/rego/full_name_test.rego b/classification/rego/full_name_test.rego
index 78b39c5..7c779db 100644
--- a/classification/rego/full_name_test.rego
+++ b/classification/rego/full_name_test.rego
@@ -1,25 +1,27 @@
 package classifier_full_name
 
-test_fn_pattern {
-	output.full_name == "FULL_NAME" with input as {"full_name":"John"}
+import rego.v1
+
+test_fn_pattern if {
+	output.full_name == true with input as {"full_name":"John"}
 }
 
-test_fn_pattern {
-	output.full_name == "FULL_NAME" with input as {"full_name":"Robert"}
+test_fn_pattern if {
+	output.full_name == true with input as {"full_name":"Robert"}
 }
 
-test_fn_pattern {
-	output.fullname == "FULL_NAME" with input as {"fullname":"Robert"}
+test_fn_pattern if {
+	output.fullname == true with input as {"fullname":"Robert"}
 }
 
-test_fn_pattern {
-	output.fullName == "FULL_NAME" with input as {"fullName":"Robert"}
+test_fn_pattern if {
+	output.fullName == true with input as {"fullName":"Robert"}
 }
 
-test_fn_pattern {
-	output.Full_Name == "FULL_NAME" with input as {"Full_Name":"Robert"}
+test_fn_pattern if {
+	output.Full_Name == true with input as {"Full_Name":"Robert"}
 }
 
-test_fn_pattern {
-	output.FullName == "FULL_NAME" with input as {"FullName":"Robert"}
+test_fn_pattern if {
+	output.FullName == true with input as {"FullName":"Robert"}
 }
diff --git a/classification/rego/ip_address_test.rego b/classification/rego/ip_address_test.rego
index 3ab915d..6c68bf1 100644
--- a/classification/rego/ip_address_test.rego
+++ b/classification/rego/ip_address_test.rego
@@ -1,25 +1,27 @@
 package classifier_ip_address
 
-test_no_label {
-    output.column == "UNLABELED" with input as {"column":"invalid"}
+import rego.v1
+
+test_no_label if {
+    output.column == false with input as {"column":"invalid"}
 }
 
-test_ipv4_google {
-    output.column == "IP_ADDRESS" with input as {"column":"8.8.8.8"}
+test_ipv4_google if {
+    output.column == true with input as {"column":"8.8.8.8"}
 }
 
-test_ipv4_localhost {
-    output.column == "IP_ADDRESS" with input as {"column":"127.0.0.1"}
+test_ipv4_localhost if {
+    output.column == true with input as {"column":"127.0.0.1"}
 }
 
-test_ipv4_internal {
-    output.column == "IP_ADDRESS" with input as {"column":"10.1.1.1"}
+test_ipv4_internal if {
+    output.column == true with input as {"column":"10.1.1.1"}
 }
 
-test_ipv6 {
-    output.column == "IP_ADDRESS" with input as {"column":"2001:db8:3333:4444:5555:6666:7777:8888"}
+test_ipv6 if {
+    output.column == true with input as {"column":"2001:db8:3333:4444:5555:6666:7777:8888"}
 }
 
-test_ipv6_google {
-    output.column == "IP_ADDRESS" with input as {"column":"2001:4860:4860::8888"}
+test_ipv6_google if {
+    output.column == true with input as {"column":"2001:4860:4860::8888"}
 }
diff --git a/classification/rego/last_name_test.rego b/classification/rego/last_name_test.rego
index 6e9edaa..77962d9 100644
--- a/classification/rego/last_name_test.rego
+++ b/classification/rego/last_name_test.rego
@@ -1,49 +1,51 @@
 package classifier_last_name
 
-test_ln_pattern {
-	output.last_name == "LAST_NAME" with input as {"last_name":"John"}
+import rego.v1
+
+test_ln_pattern if {
+	output.last_name == true with input as {"last_name":"John"}
 }
 
-test_ln_pattern {
-	output.last_name == "LAST_NAME" with input as {"last_name":"Robert"}
+test_ln_pattern if {
+	output.last_name == true with input as {"last_name":"Robert"}
 }
 
-test_ln_pattern {
-	output.lastname == "LAST_NAME" with input as {"lastname":"Robert"}
+test_ln_pattern if {
+	output.lastname == true with input as {"lastname":"Robert"}
 }
 
-test_ln_pattern {
-	output.lastName == "LAST_NAME" with input as {"lastName":"Robert"}
+test_ln_pattern if {
+	output.lastName == true with input as {"lastName":"Robert"}
 }
 
-test_ln_pattern {
-	output.Last_Name == "LAST_NAME" with input as {"Last_Name":"Robert"}
+test_ln_pattern if {
+	output.Last_Name == true with input as {"Last_Name":"Robert"}
 }
 
-test_ln_pattern {
-	output.LastName == "LAST_NAME" with input as {"LastName":"Robert"}
+test_ln_pattern if {
+	output.LastName == true with input as {"LastName":"Robert"}
 }
 
-test_sn_pattern {
-	output.sur_name == "LAST_NAME" with input as {"sur_name":"John"}
+test_sn_pattern if {
+	output.sur_name == true with input as {"sur_name":"John"}
 }
 
-test_sn_pattern {
-	output.sur_name == "LAST_NAME" with input as {"sur_name":"Robert"}
+test_sn_pattern if {
+	output.sur_name == true with input as {"sur_name":"Robert"}
 }
 
-test_sn_pattern {
-	output.surname == "LAST_NAME" with input as {"surname":"Robert"}
+test_sn_pattern if {
+	output.surname == true with input as {"surname":"Robert"}
 }
 
-test_sn_pattern {
-	output.surName == "LAST_NAME" with input as {"surName":"Robert"}
+test_sn_pattern if {
+	output.surName == true with input as {"surName":"Robert"}
 }
 
-test_sn_pattern {
-	output.Sur_Name == "LAST_NAME" with input as {"Sur_Name":"Robert"}
+test_sn_pattern if {
+	output.Sur_Name == true with input as {"Sur_Name":"Robert"}
 }
 
-test_sn_pattern {
-	output.SurName == "LAST_NAME" with input as {"SurName":"Robert"}
+test_sn_pattern if {
+	output.SurName == true with input as {"SurName":"Robert"}
 }
diff --git a/classification/rego/passport_test.rego b/classification/rego/passport_test.rego
index 44fc4b3..d8f3ba4 100644
--- a/classification/rego/passport_test.rego
+++ b/classification/rego/passport_test.rego
@@ -1,65 +1,67 @@
 package classifier_passport
 
-test_passport_key {
-	output.passport == "PASSPORT" with input as {"passport":"not-a-passport-number"}
+import rego.v1
+
+test_passport_key if {
+	output.passport == true with input as {"passport":"not-a-passport-number"}
 }
 
 # United States
-test_passport_pattern {
-	output.message == "PASSPORT" with input as {"message":"A12345678"}
+test_passport_pattern if {
+	output.message == true with input as {"message":"A12345678"}
 }
 
 # Canada
-test_passport_pattern {
-	output.message == "PASSPORT" with input as {"message":"G12345678"}
+test_passport_pattern if {
+	output.message == true with input as {"message":"G12345678"}
 }
 
 # United Kingdom
-test_passport_pattern {
-	output.message == "PASSPORT" with input as {"message":"GH1234567"}
+test_passport_pattern if {
+	output.message == true with input as {"message":"GH1234567"}
 }
 
 # Australia
-test_passport_pattern {
-	output.message == "PASSPORT" with input as {"message":"P12345678"}
+test_passport_pattern if {
+	output.message == true with input as {"message":"P12345678"}
 }
 
 # India
-test_passport_pattern {
-	output.message == "PASSPORT" with input as {"message":"P1234567"}
+test_passport_pattern if {
+	output.message == true with input as {"message":"P1234567"}
 }
 
 # Germany
-test_passport_pattern {
-	output.message == "PASSPORT" with input as {"message":"E12345678"}
+test_passport_pattern if {
+	output.message == true with input as {"message":"E12345678"}
 }
 
 # China
-test_passport_pattern {
-	output.message == "PASSPORT" with input as {"message":"E123456789"}
+test_passport_pattern if {
+	output.message == true with input as {"message":"E123456789"}
 }
 
 # Japan
-test_passport_pattern {
-	output.message == "PASSPORT" with input as {"message":"P1234567"}
+test_passport_pattern if {
+	output.message == true with input as {"message":"P1234567"}
 }
 
 # South Korea
-test_passport_pattern {
-	output.message == "PASSPORT" with input as {"message":"M12345678"}
+test_passport_pattern if {
+	output.message == true with input as {"message":"M12345678"}
 }
 
 # Brazil
-test_passport_pattern {
-	output.message == "PASSPORT" with input as {"message":"G12345678"}
+test_passport_pattern if {
+	output.message == true with input as {"message":"G12345678"}
 }
 
 # Mexico
-test_passport_pattern {
-	output.message == "PASSPORT" with input as {"message":"E12345678"}
+test_passport_pattern if {
+	output.message == true with input as {"message":"E12345678"}
 }
 
 # South Africa (diplomat, standard covered by other countries)
-test_passport_sa_pattern {
-	output.message == "PASSPORT" with input as {"message":"D123456789"}
+test_passport_sa_pattern if {
+	output.message == true with input as {"message":"D123456789"}
 }
diff --git a/classification/rego/phone_test.rego b/classification/rego/phone_test.rego
index 73295ea..8aa04ea 100644
--- a/classification/rego/phone_test.rego
+++ b/classification/rego/phone_test.rego
@@ -1,13 +1,15 @@
 package classifier_phone_number
 
-test_no_label {
-    output.column == "UNLABELED" with input as {"column":"invalid"}
+import rego.v1
+
+test_no_label if {
+    output.column == false with input as {"column":"invalid"}
 }
 
-test_valid_us_phone {
-    output.message == "PHONE" with input as {"message":"7175551212"}
+test_valid_us_phone if {
+    output.message == true with input as {"message":"7175551212"}
 }
 
-test_valid_us_phone {
-    output.message == "PHONE" with input as {"message":"17175551212"}
+test_valid_us_phone if {
+    output.message == true with input as {"message":"17175551212"}
 }
diff --git a/classification/rego/ssn_test.rego b/classification/rego/ssn_test.rego
index 7f6a8d5..ba776c2 100644
--- a/classification/rego/ssn_test.rego
+++ b/classification/rego/ssn_test.rego
@@ -1,73 +1,75 @@
 package classifier_ssn
 
-test_no_label {
-    output.column == "UNLABELED" with input as {"column":"invalid"}
+import rego.v1
+
+test_no_label if {
+    output.column == false with input as {"column":"invalid"}
 }
 
-test_invalid_first_000 {
-    output.column == "UNLABELED" with input as {"column":"000123456"}
+test_invalid_first_000 if {
+    output.column == false with input as {"column":"000123456"}
 }
 
-test_invalid_first_666 {
-    output.column == "UNLABELED" with input as {"column":"666123456"}
+test_invalid_first_666 if {
+    output.column == false with input as {"column":"666123456"}
 }
 
-test_invalid_first_900s {
-    output.column == "UNLABELED" with input as {"column":"905123456"}
+test_invalid_first_900s if {
+    output.column == false with input as {"column":"905123456"}
 }
 
-test_invalid_middle {
-    output.column == "UNLABELED" with input as {"column":"123006789"}
+test_invalid_middle if {
+    output.column == false with input as {"column":"123006789"}
 }
 
-test_invalid_end {
-    output.column == "UNLABELED" with input as {"column":"123450000"}
+test_invalid_end if {
+    output.column == false with input as {"column":"123450000"}
 }
 
-test_ssn_on_valid_amex_ccn {
-    output.message == "UNLABELED" with input as {"message":"370136066365291"}
+test_ssn_on_valid_amex_ccn if {
+    output.message == false with input as {"message":"370136066365291"}
 }
 
-test_ssn_on_valid_amex_ccn {
-    output.message == "UNLABELED" with input as {"message":"370136066365291"}
+test_ssn_on_valid_amex_ccn if {
+    output.message == false with input as {"message":"370136066365291"}
 }
 
-test_ssn_on_valid_visa_ccn {
-    output.message == "UNLABELED" with input as {"message":"4613688275707134"}
+test_ssn_on_valid_visa_ccn if {
+    output.message == false with input as {"message":"4613688275707134"}
 }
 
-test_ssn_on_valid_mastercard_format_1_ccn {
-    output.message == "UNLABELED" with input as {"message":"5423909386888564"}
+test_ssn_on_valid_mastercard_format_1_ccn if {
+    output.message == false with input as {"message":"5423909386888564"}
 }
 
-test_ssn_on_valid_mastercard_format_2_ccn {
-    output.message == "UNLABELED" with input as {"message":"2701306282695666"}
+test_ssn_on_valid_mastercard_format_2_ccn if {
+    output.message == false with input as {"message":"2701306282695666"}
 }
 
-test_ssn_on_valid_discover_ccn {
-    output.message == "UNLABELED" with input as {"message":"6536673682309236"}
+test_ssn_on_valid_discover_ccn if {
+    output.message == false with input as {"message":"6536673682309236"}
 }
 
-test_valid_ssn_dashes {
-    output.message == "SSN" with input as {"message":"111-11-1111"}
+test_valid_ssn_dashes if {
+    output.message == true with input as {"message":"111-11-1111"}
 }
 
-test_valid_ssn_dashes_sequential {
-    output.message == "SSN" with input as {"message":"123-45-6789"}
+test_valid_ssn_dashes_sequential if {
+    output.message == true with input as {"message":"123-45-6789"}
 }
 
-test_valid_ssn_dashes_in_value {
-    output.message == "SSN" with input as {"message":"this has a ssn 111-11-1111 that is valid"}
+test_valid_ssn_dashes_in_value if {
+    output.message == true with input as {"message":"this has a ssn 111-11-1111 that is valid"}
 }
 
-test_valid_ssn_no_dashes {
-    output.message == "SSN" with input as {"message":"111111111"}
+test_valid_ssn_no_dashes if {
+    output.message == true with input as {"message":"111111111"}
 }
 
-test_valid_ssn_no_dashes_sequential {
-    output.message == "SSN" with input as {"message":"123456789"}
+test_valid_ssn_no_dashes_sequential if {
+    output.message == true with input as {"message":"123456789"}
 }
 
-test_valid_ssn_no_dashes_in_value {
-    output.message == "SSN" with input as {"message":"this has a ssn 111111111 that is valid"}
+test_valid_ssn_no_dashes_in_value if {
+    output.message == true with input as {"message":"this has a ssn 111111111 that is valid"}
 }
diff --git a/discovery/repository/snowflake/snowflake.go b/discovery/repository/snowflake/snowflake.go
index 9dfa583..2221f9c 100644
--- a/discovery/repository/snowflake/snowflake.go
+++ b/discovery/repository/snowflake/snowflake.go
@@ -58,7 +58,7 @@ func NewSnowflakeRepository(_ context.Context, repoCfg config.RepoConfig) (repos
 	sqlRepo, err := genericsql.NewGenericSqlRepository(
 		repoCfg.Host,
 		RepoTypeSnowflake,
-		repoCfg.Database,
+		database,
 		connStr,
 		repoCfg.MaxOpenConns,
 		repoCfg.IncludePaths,

From d44ab9bd9e5a195af81a099a2a2b7ab1b301fbc6 Mon Sep 17 00:00:00 2001
From: Chris Campo <ccampo133@users.noreply.github.com>
Date: Fri, 29 Mar 2024 14:53:58 -0400
Subject: [PATCH 05/14] Cleanup

---
 discovery/repository/denodo/denodo.go         |  33 ++--
 discovery/repository/doc.go                   |   8 +-
 discovery/repository/genericsql/genericsql.go |  70 +++----
 .../repository/genericsql/genericsql_test.go  |   8 +-
 discovery/repository/mysql/mysql.go           |  33 ++--
 discovery/repository/mysql/mysql_test.go      |   8 +-
 discovery/repository/oracle/oracle.go         |  35 ++--
 discovery/repository/oracle/oracle_test.go    |   8 +-
 discovery/repository/postgresql/postgresql.go |  33 ++--
 .../repository/postgresql/postgresql_test.go  |   8 +-
 discovery/repository/redshift/redshift.go     |  33 ++--
 .../repository/redshift/redshift_test.go      |   8 +-
 discovery/repository/repository.go            | 173 +-----------------
 discovery/repository/sampling.go              | 161 ++++++++++++++++
 discovery/repository/snowflake/snowflake.go   |  51 +++---
 .../repository/snowflake/snowflake_test.go    |   8 +-
 discovery/repository/sqlserver/sqlserver.go   |  31 ++--
 .../repository/sqlserver/sqlserver_test.go    |   8 +-
 18 files changed, 384 insertions(+), 333 deletions(-)

diff --git a/discovery/repository/denodo/denodo.go b/discovery/repository/denodo/denodo.go
index 38ef30c..907ccdf 100644
--- a/discovery/repository/denodo/denodo.go
+++ b/discovery/repository/denodo/denodo.go
@@ -31,16 +31,18 @@ const (
 		"CATALOG_VDP_METADATA_VIEWS()"
 )
 
-type denodoRepository struct {
+// Repository is a repository.Repository implementation for Denodo.
+type Repository struct {
 	// The majority of the repository.Repository functionality is delegated to
 	// a generic SQL repository instance (genericSqlRepo).
-	genericSqlRepo *genericsql.GenericSqlRepository
+	genericSqlRepo *genericsql.Repository
 }
 
-// *denodoRepository implements repository.Repository
-var _ repository.Repository = (*denodoRepository)(nil)
+// Repository implements repository.Repository
+var _ repository.Repository = (*Repository)(nil)
 
-func NewDenodoRepository(_ context.Context, repoCfg config.RepoConfig) (repository.Repository, error) {
+// NewRepository is the constructor for Repository.
+func NewRepository(repoCfg config.RepoConfig) (*Repository, error) {
 	pgCfg, err := postgresql.ParseConfig(repoCfg)
 	if err != nil {
 		return nil, fmt.Errorf("unable to parse postgres config: %w", err)
@@ -59,7 +61,7 @@ func NewDenodoRepository(_ context.Context, repoCfg config.RepoConfig) (reposito
 		pgCfg.ConnOptsStr,
 	)
 
-	sqlRepo, err := genericsql.NewGenericSqlRepository(
+	sqlRepo, err := genericsql.NewRepository(
 		repoCfg.Host,
 		postgresql.RepoTypePostgres,
 		repoCfg.Database,
@@ -72,18 +74,18 @@ func NewDenodoRepository(_ context.Context, repoCfg config.RepoConfig) (reposito
 		return nil, fmt.Errorf("could not instantiate generic sql repository: %w", err)
 	}
 
-	return &denodoRepository{genericSqlRepo: sqlRepo}, nil
+	return &Repository{genericSqlRepo: sqlRepo}, nil
 }
 
-func (repo *denodoRepository) ListDatabases(_ context.Context) ([]string, error) {
+func (repo *Repository) ListDatabases(_ context.Context) ([]string, error) {
 	return nil, errors.New("ListDatabases is not implemented for Denodo repositories")
 }
 
-func (repo *denodoRepository) Introspect(ctx context.Context) (*repository.Metadata, error) {
+func (repo *Repository) Introspect(ctx context.Context) (*repository.Metadata, error) {
 	return repo.genericSqlRepo.IntrospectWithQuery(ctx, IntrospectQuery)
 }
 
-func (repo *denodoRepository) SampleTable(
+func (repo *Repository) SampleTable(
 	ctx context.Context,
 	meta *repository.TableMetadata,
 	params repository.SampleParameters,
@@ -101,14 +103,19 @@ func (repo *denodoRepository) SampleTable(
 	return repo.genericSqlRepo.SampleTableWithQuery(ctx, meta, query)
 }
 
-func (repo *denodoRepository) Ping(ctx context.Context) error {
+func (repo *Repository) Ping(ctx context.Context) error {
 	return repo.genericSqlRepo.Ping(ctx)
 }
 
-func (repo *denodoRepository) Close() error {
+func (repo *Repository) Close() error {
 	return repo.genericSqlRepo.Close()
 }
 
 func init() {
-	repository.Register(RepoTypeDenodo, NewDenodoRepository)
+	repository.Register(
+		RepoTypeDenodo,
+		func(_ context.Context, cfg config.RepoConfig) (repository.Repository, error) {
+			return NewRepository(cfg)
+		},
+	)
 }
diff --git a/discovery/repository/doc.go b/discovery/repository/doc.go
index 0b6a30b..9a7ff37 100644
--- a/discovery/repository/doc.go
+++ b/discovery/repository/doc.go
@@ -7,9 +7,9 @@
 // introspect and sample the underlying database it represents.
 //
 // Repository implementations should reside in their own sub-package of the
-// repository package. Each implementation should provide a constructor that
-// matches the signature of the RepoConstructor type, and pass it to Register
-// function as part of the repository package's init function. This will make
+// repository package. Each implementation register itself with the repository
+// registry by calling the Register function with a RepoConstructor function
+// that returns a new instance of the repository implementation. This will make
 // the repository implementation available to the NewRepository factory
-// function.
+// function. Registration is typically done in the sub-package's init function.
 package repository
diff --git a/discovery/repository/genericsql/genericsql.go b/discovery/repository/genericsql/genericsql.go
index 667f1cd..d7bcaeb 100644
--- a/discovery/repository/genericsql/genericsql.go
+++ b/discovery/repository/genericsql/genericsql.go
@@ -39,10 +39,10 @@ const (
 	SampleQueryTemplate = "SELECT %s FROM %s.%s LIMIT ? OFFSET ?"
 )
 
-// GenericSqlRepository implements generic SQL functionalities that
-// works for a subset of ANSI SQL compatible databases and may be
-// useful for some repository.Repository implementations.
-type GenericSqlRepository struct {
+// Repository implements generic SQL functionalities that works for a subset of
+// ANSI SQL compatible databases, and may be useful for some
+// repository.Repository implementations.
+type Repository struct {
 	repoName     string
 	repoType     string
 	database     string
@@ -51,21 +51,25 @@ type GenericSqlRepository struct {
 	excludePaths []glob.Glob
 }
 
-// NewGenericSqlRepository is a constructor for the GenericSqlRepository type.
-// It establishes a database connection for a given repoType and returns a
-// pointer to a GenericSqlRepository instance.
-func NewGenericSqlRepository(
+// NewRepository is a constructor for the Repository type. It opens a database
+// handle for a given repoType and returns a pointer to a Repository instance. A
+// connection may or may not be established depending on the underlying database
+// type, as determined by the repoType parameter. The maxOpenConns parameter
+// specifies the maximum number of open connections to the database. The
+// repoIncludePaths and repoExcludePaths parameters are used to filter the
+// tables and columns that are introspected by the repository.
+func NewRepository(
 	repoName, repoType, database, connStr string, maxOpenConns uint,
 	repoIncludePaths, repoExcludePaths []glob.Glob,
 ) (
-	*GenericSqlRepository,
+	*Repository,
 	error,
 ) {
 	db, err := getDbHandle(repoType, connStr, maxOpenConns)
 	if err != nil {
 		return nil, fmt.Errorf("error retrieving DB handle for repo type %s: %w", repoType, err)
 	}
-	return &GenericSqlRepository{
+	return &Repository{
 		repoName:     repoName,
 		repoType:     repoType,
 		database:     database,
@@ -75,13 +79,13 @@ func NewGenericSqlRepository(
 	}, nil
 }
 
-// NewGenericSqlRepositoryFromDB instantiate a new *GenericSqlRepository based
+// NewRepositoryFromDB instantiate a new *Repository based
 // on a given db connection. This can be used by tests to mock the database.
-func NewGenericSqlRepositoryFromDB(
+func NewRepositoryFromDB(
 	repoName, repoType, database string,
 	db *sql.DB,
-) *GenericSqlRepository {
-	return &GenericSqlRepository{
+) *Repository {
+	return &Repository{
 		repoName: repoName,
 		repoType: repoType,
 		database: database,
@@ -93,7 +97,7 @@ func NewGenericSqlRepositoryFromDB(
 // server, as determined by the given query. The query is expected to return
 // a row set containing a single column corresponding to the database name. If
 // the query returns more than one column, an error will be returned.
-func (repo *GenericSqlRepository) ListDatabasesWithQuery(
+func (repo *Repository) ListDatabasesWithQuery(
 	ctx context.Context,
 	query string,
 	params ...any,
@@ -120,23 +124,21 @@ func (repo *GenericSqlRepository) ListDatabasesWithQuery(
 }
 
 // Introspect calls IntrospectWithQuery with a default query string
-func (repo *GenericSqlRepository) Introspect(ctx context.Context) (*repository.Metadata, error) {
+func (repo *Repository) Introspect(ctx context.Context) (*repository.Metadata, error) {
 	return repo.IntrospectWithQuery(ctx, IntrospectQuery)
 }
 
-/*
-IntrospectWithQuery executes a query against the information_schema table in the
-database which returns a four-column (all varchar) row set (of N rows, depending
-on the number of tables in the database) in the form:
-
-table_schema, table_name, column_name, data_type
-
-This row set represents all the columns of all the tables in the repository.
-The row set is then parsed into an instance of repository.Metadata and
-returned. Additionally, any errors which occur during the query execution or
-parsing process will be returned.
-*/
-func (repo *GenericSqlRepository) IntrospectWithQuery(
+// IntrospectWithQuery executes a query against the information_schema table in
+// the database which returns a four-column (all varchar) row set (of N rows,
+// depending on the number of tables in the database) in the form:
+//
+// table_schema, table_name, column_name, data_type
+//
+// This row set represents all the columns of all the tables in the repository.
+// The row set is then parsed into an instance of repository.Metadata and
+// returned. Additionally, any errors which occur during the query execution or
+// parsing process will be returned.
+func (repo *Repository) IntrospectWithQuery(
 	ctx context.Context,
 	query string,
 ) (*repository.Metadata, error) {
@@ -157,7 +159,7 @@ func (repo *GenericSqlRepository) IntrospectWithQuery(
 	return repoMeta, nil
 }
 
-func (repo *GenericSqlRepository) SampleTable(
+func (repo *Repository) SampleTable(
 	ctx context.Context,
 	meta *repository.TableMetadata,
 	params repository.SampleParameters,
@@ -170,7 +172,7 @@ func (repo *GenericSqlRepository) SampleTable(
 
 // SampleTableWithQuery calls SampleTable with a custom SQL query. Any
 // placeholder parameters in the query should be passed via params.
-func (repo *GenericSqlRepository) SampleTableWithQuery(
+func (repo *Repository) SampleTableWithQuery(
 	ctx context.Context,
 	meta *repository.TableMetadata,
 	query string,
@@ -210,7 +212,7 @@ func (repo *GenericSqlRepository) SampleTableWithQuery(
 	return sample, nil
 }
 
-func (repo *GenericSqlRepository) Ping(ctx context.Context) error {
+func (repo *Repository) Ping(ctx context.Context) error {
 	log.Tracef("Query: %s", PingQuery)
 	rows, err := repo.db.QueryContext(ctx, PingQuery)
 	if err != nil {
@@ -221,11 +223,11 @@ func (repo *GenericSqlRepository) Ping(ctx context.Context) error {
 }
 
 // GetDb is a getter for the repository's sql.DB handle.
-func (repo *GenericSqlRepository) GetDb() *sql.DB {
+func (repo *Repository) GetDb() *sql.DB {
 	return repo.db
 }
 
-func (repo *GenericSqlRepository) Close() error {
+func (repo *Repository) Close() error {
 	return repo.db.Close()
 }
 
diff --git a/discovery/repository/genericsql/genericsql_test.go b/discovery/repository/genericsql/genericsql_test.go
index 0dd0219..7b22624 100644
--- a/discovery/repository/genericsql/genericsql_test.go
+++ b/discovery/repository/genericsql/genericsql_test.go
@@ -22,7 +22,7 @@ func Test_Introspect_IsSuccessful(t *testing.T) {
 	repoType := "genericSql"
 	database := "exampleDb"
 
-	repo := GenericSqlRepository{
+	repo := Repository{
 		repoName:     repoName,
 		repoType:     repoType,
 		database:     database,
@@ -123,7 +123,7 @@ func Test_Introspect_QueryError(t *testing.T) {
 	repoType := "genericSql"
 	database := "exampleDb"
 
-	repo := GenericSqlRepository{
+	repo := Repository{
 		repoName: repoName,
 		repoType: repoType,
 		database: database,
@@ -152,7 +152,7 @@ func Test_Introspect_RowError(t *testing.T) {
 	repoType := "genericSql"
 	database := "exampleDb"
 
-	repo := GenericSqlRepository{
+	repo := Repository{
 		repoName: repoName,
 		repoType: repoType,
 		database: database,
@@ -192,7 +192,7 @@ func Test_Introspect_Filtered(t *testing.T) {
 	repoType := "genericSql"
 	database := "exampleDb"
 
-	repo := GenericSqlRepository{
+	repo := Repository{
 		repoName: repoName,
 		repoType: repoType,
 		database: database,
diff --git a/discovery/repository/mysql/mysql.go b/discovery/repository/mysql/mysql.go
index 154217c..193d488 100644
--- a/discovery/repository/mysql/mysql.go
+++ b/discovery/repository/mysql/mysql.go
@@ -27,16 +27,18 @@ WHERE
 `
 )
 
-type mySqlRepository struct {
+// Repository is a repository.Repository implementation for MySQL databases.
+type Repository struct {
 	// The majority of the repository.Repository functionality is delegated to
 	// a generic SQL repository instance (genericSqlRepo).
-	genericSqlRepo *genericsql.GenericSqlRepository
+	genericSqlRepo *genericsql.Repository
 }
 
-// *mySqlRepository implements repository.Repository
-var _ repository.Repository = (*mySqlRepository)(nil)
+// Repository implements repository.Repository
+var _ repository.Repository = (*Repository)(nil)
 
-func NewMySQLRepository(_ context.Context, cfg config.RepoConfig) (repository.Repository, error) {
+// NewRepository creates a new MySQL repository.
+func NewRepository(cfg config.RepoConfig) (*Repository, error) {
 	connStr := fmt.Sprintf(
 		"%s:%s@tcp(%s:%d)/%s",
 		cfg.User,
@@ -48,7 +50,7 @@ func NewMySQLRepository(_ context.Context, cfg config.RepoConfig) (repository.Re
 		cfg.Database,
 	)
 
-	sqlRepo, err := genericsql.NewGenericSqlRepository(
+	sqlRepo, err := genericsql.NewRepository(
 		cfg.Host,
 		RepoTypeMysql,
 		cfg.Database,
@@ -61,18 +63,18 @@ func NewMySQLRepository(_ context.Context, cfg config.RepoConfig) (repository.Re
 		return nil, fmt.Errorf("could not instantiate generic sql repository: %w", err)
 	}
 
-	return &mySqlRepository{genericSqlRepo: sqlRepo}, nil
+	return &Repository{genericSqlRepo: sqlRepo}, nil
 }
 
-func (repo *mySqlRepository) ListDatabases(ctx context.Context) ([]string, error) {
+func (repo *Repository) ListDatabases(ctx context.Context) ([]string, error) {
 	return repo.genericSqlRepo.ListDatabasesWithQuery(ctx, DatabaseQuery)
 }
 
-func (repo *mySqlRepository) Introspect(ctx context.Context) (*repository.Metadata, error) {
+func (repo *Repository) Introspect(ctx context.Context) (*repository.Metadata, error) {
 	return repo.genericSqlRepo.Introspect(ctx)
 }
 
-func (repo *mySqlRepository) SampleTable(
+func (repo *Repository) SampleTable(
 	ctx context.Context,
 	meta *repository.TableMetadata,
 	params repository.SampleParameters,
@@ -84,14 +86,19 @@ func (repo *mySqlRepository) SampleTable(
 	return repo.genericSqlRepo.SampleTableWithQuery(ctx, meta, query, params.SampleSize, params.Offset)
 }
 
-func (repo *mySqlRepository) Ping(ctx context.Context) error {
+func (repo *Repository) Ping(ctx context.Context) error {
 	return repo.genericSqlRepo.Ping(ctx)
 }
 
-func (repo *mySqlRepository) Close() error {
+func (repo *Repository) Close() error {
 	return repo.genericSqlRepo.Close()
 }
 
 func init() {
-	repository.Register(RepoTypeMysql, NewMySQLRepository)
+	repository.Register(
+		RepoTypeMysql,
+		func(_ context.Context, cfg config.RepoConfig) (repository.Repository, error) {
+			return NewRepository(cfg)
+		},
+	)
 }
diff --git a/discovery/repository/mysql/mysql_test.go b/discovery/repository/mysql/mysql_test.go
index 1a1936a..8135b60 100644
--- a/discovery/repository/mysql/mysql_test.go
+++ b/discovery/repository/mysql/mysql_test.go
@@ -13,7 +13,7 @@ import (
 
 func TestListDatabases(t *testing.T) {
 	ctx, db, mock, r := initRepoTest(t)
-	defer db.Close()
+	defer func() { _ = db.Close() }()
 	dbRows := sqlmock.NewRows([]string{"name"}).AddRow("db1").AddRow("db2")
 	mock.ExpectQuery(DatabaseQuery).WillReturnRows(dbRows)
 	dbs, err := r.ListDatabases(ctx)
@@ -21,11 +21,11 @@ func TestListDatabases(t *testing.T) {
 	require.ElementsMatch(t, []string{"db1", "db2"}, dbs)
 }
 
-func initRepoTest(t *testing.T) (context.Context, *sql.DB, sqlmock.Sqlmock, *mySqlRepository) {
+func initRepoTest(t *testing.T) (context.Context, *sql.DB, sqlmock.Sqlmock, *Repository) {
 	ctx := context.Background()
 	db, mock, err := sqlmock.New()
 	require.NoError(t, err)
-	return ctx, db, mock, &mySqlRepository{
-		genericSqlRepo: genericsql.NewGenericSqlRepositoryFromDB("repoName", RepoTypeMysql, "dbName", db),
+	return ctx, db, mock, &Repository{
+		genericSqlRepo: genericsql.NewRepositoryFromDB("repoName", RepoTypeMysql, "dbName", db),
 	}
 }
diff --git a/discovery/repository/oracle/oracle.go b/discovery/repository/oracle/oracle.go
index 9e3044c..ac9fb4b 100644
--- a/discovery/repository/oracle/oracle.go
+++ b/discovery/repository/oracle/oracle.go
@@ -40,16 +40,18 @@ ON
 `
 )
 
-type oracleRepository struct {
+// Repository is a repository.Repository implementation for Oracle databases.
+type Repository struct {
 	// The majority of the repository.Repository functionality is delegated to
 	// a generic SQL repository instance (genericSqlRepo).
-	genericSqlRepo *genericsql.GenericSqlRepository
+	genericSqlRepo *genericsql.Repository
 }
 
-// *oracleRepository implements repository.Repository
-var _ repository.Repository = (*oracleRepository)(nil)
+// Repository implements repository.Repository
+var _ repository.Repository = (*Repository)(nil)
 
-func NewOracleRepository(_ context.Context, cfg config.RepoConfig) (repository.Repository, error) {
+// NewRepository creates a new Oracle repository.
+func NewRepository(cfg config.RepoConfig) (*Repository, error) {
 	oracleCfg, err := ParseConfig(cfg)
 	if err != nil {
 		return nil, fmt.Errorf("unable to parse oracle config: %w", err)
@@ -64,7 +66,7 @@ func NewOracleRepository(_ context.Context, cfg config.RepoConfig) (repository.R
 		oracleCfg.ServiceName,
 	)
 
-	sqlRepo, err := genericsql.NewGenericSqlRepository(
+	sqlRepo, err := genericsql.NewRepository(
 		cfg.Host,
 		RepoTypeOracle,
 		cfg.Database,
@@ -77,21 +79,21 @@ func NewOracleRepository(_ context.Context, cfg config.RepoConfig) (repository.R
 		return nil, fmt.Errorf("could not instantiate generic sql repository: %w", err)
 	}
 
-	return &oracleRepository{genericSqlRepo: sqlRepo}, nil
+	return &Repository{genericSqlRepo: sqlRepo}, nil
 }
 
 // ListDatabases is left unimplemented for Oracle, because Oracle doesn't have
 // the traditional concept of "databases". Note that Introspect already
 // identifies all the accessible objects on the server.
-func (repo *oracleRepository) ListDatabases(_ context.Context) ([]string, error) {
+func (repo *Repository) ListDatabases(_ context.Context) ([]string, error) {
 	return nil, errors.New("ListDatabases is not implemented for Oracle repos")
 }
 
-func (repo *oracleRepository) Introspect(ctx context.Context) (*repository.Metadata, error) {
+func (repo *Repository) Introspect(ctx context.Context) (*repository.Metadata, error) {
 	return repo.genericSqlRepo.IntrospectWithQuery(ctx, introspectQuery)
 }
 
-func (repo *oracleRepository) SampleTable(
+func (repo *Repository) SampleTable(
 	ctx context.Context,
 	meta *repository.TableMetadata,
 	params repository.SampleParameters,
@@ -108,18 +110,23 @@ func (repo *oracleRepository) SampleTable(
 
 // Ping verifies the connection to Oracle database used by this Repository.
 // Normally we would just delegate to the Ping method implemented by
-// genericsql.GenericSqlRepository. However, that implementation executes a
+// genericsql.Repository. However, that implementation executes a
 // 'SELECT 1' query to test for connectivity, and Oracle being Oracle, does not
 // like this. So instead, we defer to the native Ping method implemented by the
 // Oracle sql.DB driver.
-func (repo *oracleRepository) Ping(ctx context.Context) error {
+func (repo *Repository) Ping(ctx context.Context) error {
 	return repo.genericSqlRepo.GetDb().PingContext(ctx)
 }
 
-func (repo *oracleRepository) Close() error {
+func (repo *Repository) Close() error {
 	return repo.genericSqlRepo.Close()
 }
 
 func init() {
-	repository.Register(RepoTypeOracle, NewOracleRepository)
+	repository.Register(
+		RepoTypeOracle,
+		func(_ context.Context, cfg config.RepoConfig) (repository.Repository, error) {
+			return NewRepository(cfg)
+		},
+	)
 }
diff --git a/discovery/repository/oracle/oracle_test.go b/discovery/repository/oracle/oracle_test.go
index aaba6a4..7b70647 100644
--- a/discovery/repository/oracle/oracle_test.go
+++ b/discovery/repository/oracle/oracle_test.go
@@ -23,8 +23,8 @@ const (
 
 type OracleTestSuite struct {
 	suite.Suite
-	repo                              oracleRepository
-	mock                              sqlmock.Sqlmock
+	repo Repository
+	mock sqlmock.Sqlmock
 	databaseUserQuery                 string
 	databaseRolesForUserQueryTemplate string
 }
@@ -71,8 +71,8 @@ func (s *OracleTestSuite) BeforeTest(suiteName, testName string) {
 	require.NoError(s.T(), err)
 
 	s.mock = mock
-	s.repo = oracleRepository{
-		genericSqlRepo: genericsql.NewGenericSqlRepositoryFromDB(
+	s.repo = Repository{
+		genericSqlRepo: genericsql.NewRepositoryFromDB(
 			"oracle-repo",
 			"oracle-driver",
 			"oracle-db",
diff --git a/discovery/repository/postgresql/postgresql.go b/discovery/repository/postgresql/postgresql.go
index 2477d73..b02f822 100644
--- a/discovery/repository/postgresql/postgresql.go
+++ b/discovery/repository/postgresql/postgresql.go
@@ -27,16 +27,18 @@ WHERE
 `
 )
 
-type postgresqlRepository struct {
+// Repository is a PostgreSQL-specific repository.Repository implementation.
+type Repository struct {
 	// The majority of the repository.Repository functionality is delegated to
 	// a generic SQL repository instance (genericSqlRepo).
-	genericSqlRepo *genericsql.GenericSqlRepository
+	genericSqlRepo *genericsql.Repository
 }
 
-// *postgresqlRepository implements repository.Repository
-var _ repository.Repository = (*postgresqlRepository)(nil)
+// Repository implements repository.Repository
+var _ repository.Repository = (*Repository)(nil)
 
-func NewPostgresqlRepository(_ context.Context, repoCfg config.RepoConfig) (repository.Repository, error) {
+// NewRepository creates a new PostgreSQL repository.
+func NewRepository(repoCfg config.RepoConfig) (*Repository, error) {
 	pgCfg, err := ParseConfig(repoCfg)
 	if err != nil {
 		return nil, fmt.Errorf("unable to parse postgresql config: %w", err)
@@ -55,7 +57,7 @@ func NewPostgresqlRepository(_ context.Context, repoCfg config.RepoConfig) (repo
 		database,
 		pgCfg.ConnOptsStr,
 	)
-	sqlRepo, err := genericsql.NewGenericSqlRepository(
+	sqlRepo, err := genericsql.NewRepository(
 		repoCfg.Host,
 		RepoTypePostgres,
 		repoCfg.Database,
@@ -67,18 +69,18 @@ func NewPostgresqlRepository(_ context.Context, repoCfg config.RepoConfig) (repo
 	if err != nil {
 		return nil, fmt.Errorf("could not instantiate generic sql repository: %w", err)
 	}
-	return &postgresqlRepository{genericSqlRepo: sqlRepo}, nil
+	return &Repository{genericSqlRepo: sqlRepo}, nil
 }
 
-func (repo *postgresqlRepository) ListDatabases(ctx context.Context) ([]string, error) {
+func (repo *Repository) ListDatabases(ctx context.Context) ([]string, error) {
 	return repo.genericSqlRepo.ListDatabasesWithQuery(ctx, DatabaseQuery)
 }
 
-func (repo *postgresqlRepository) Introspect(ctx context.Context) (*repository.Metadata, error) {
+func (repo *Repository) Introspect(ctx context.Context) (*repository.Metadata, error) {
 	return repo.genericSqlRepo.Introspect(ctx)
 }
 
-func (repo *postgresqlRepository) SampleTable(
+func (repo *Repository) SampleTable(
 	ctx context.Context,
 	meta *repository.TableMetadata,
 	params repository.SampleParameters,
@@ -90,14 +92,19 @@ func (repo *postgresqlRepository) SampleTable(
 	return repo.genericSqlRepo.SampleTableWithQuery(ctx, meta, query, params.SampleSize, params.Offset)
 }
 
-func (repo *postgresqlRepository) Ping(ctx context.Context) error {
+func (repo *Repository) Ping(ctx context.Context) error {
 	return repo.genericSqlRepo.Ping(ctx)
 }
 
-func (repo *postgresqlRepository) Close() error {
+func (repo *Repository) Close() error {
 	return repo.genericSqlRepo.Close()
 }
 
 func init() {
-	repository.Register(RepoTypePostgres, NewPostgresqlRepository)
+	repository.Register(
+		RepoTypePostgres,
+		func(_ context.Context, cfg config.RepoConfig) (repository.Repository, error) {
+			return NewRepository(cfg)
+		},
+	)
 }
diff --git a/discovery/repository/postgresql/postgresql_test.go b/discovery/repository/postgresql/postgresql_test.go
index dc568a8..7b90716 100644
--- a/discovery/repository/postgresql/postgresql_test.go
+++ b/discovery/repository/postgresql/postgresql_test.go
@@ -13,7 +13,7 @@ import (
 
 func TestListDatabases(t *testing.T) {
 	ctx, db, mock, r := initRepoTest(t)
-	defer db.Close()
+	defer func() { _ = db.Close() }()
 	dbRows := sqlmock.NewRows([]string{"name"}).AddRow("db1").AddRow("db2")
 	mock.ExpectQuery(DatabaseQuery).WillReturnRows(dbRows)
 	dbs, err := r.ListDatabases(ctx)
@@ -21,11 +21,11 @@ func TestListDatabases(t *testing.T) {
 	require.ElementsMatch(t, []string{"db1", "db2"}, dbs)
 }
 
-func initRepoTest(t *testing.T) (context.Context, *sql.DB, sqlmock.Sqlmock, *postgresqlRepository) {
+func initRepoTest(t *testing.T) (context.Context, *sql.DB, sqlmock.Sqlmock, *Repository) {
 	ctx := context.Background()
 	db, mock, err := sqlmock.New()
 	require.NoError(t, err)
-	return ctx, db, mock, &postgresqlRepository{
-		genericSqlRepo: genericsql.NewGenericSqlRepositoryFromDB("repoName", RepoTypePostgres, "dbName", db),
+	return ctx, db, mock, &Repository{
+		genericSqlRepo: genericsql.NewRepositoryFromDB("repoName", RepoTypePostgres, "dbName", db),
 	}
 }
diff --git a/discovery/repository/redshift/redshift.go b/discovery/repository/redshift/redshift.go
index d43b3a5..fbe8033 100644
--- a/discovery/repository/redshift/redshift.go
+++ b/discovery/repository/redshift/redshift.go
@@ -17,16 +17,18 @@ const (
 	RepoTypeRedshift = "redshift"
 )
 
-type redshiftRepository struct {
+// Repository is a Redshift-specific repository.Repository implementation.
+type Repository struct {
 	// The majority of the repository.Repository functionality is delegated to
 	// a generic SQL repository instance (genericSqlRepo).
-	genericSqlRepo *genericsql.GenericSqlRepository
+	genericSqlRepo *genericsql.Repository
 }
 
-// *redshiftRepository implements repository.Repository
-var _ repository.Repository = (*redshiftRepository)(nil)
+// Repository implements repository.Repository
+var _ repository.Repository = (*Repository)(nil)
 
-func NewRedshiftRepository(_ context.Context, repoCfg config.RepoConfig) (repository.Repository, error) {
+// NewRepository creates a new Redshift repository.
+func NewRepository(repoCfg config.RepoConfig) (*Repository, error) {
 	pgCfg, err := postgresql.ParseConfig(repoCfg)
 	if err != nil {
 		return nil, fmt.Errorf("unable to parse postgres config: %w", err)
@@ -45,7 +47,7 @@ func NewRedshiftRepository(_ context.Context, repoCfg config.RepoConfig) (reposi
 		database,
 		pgCfg.ConnOptsStr,
 	)
-	sqlRepo, err := genericsql.NewGenericSqlRepository(
+	sqlRepo, err := genericsql.NewRepository(
 		repoCfg.Host,
 		postgresql.RepoTypePostgres,
 		repoCfg.Database,
@@ -57,19 +59,19 @@ func NewRedshiftRepository(_ context.Context, repoCfg config.RepoConfig) (reposi
 	if err != nil {
 		return nil, fmt.Errorf("could not instantiate generic sql repository: %w", err)
 	}
-	return &redshiftRepository{genericSqlRepo: sqlRepo}, nil
+	return &Repository{genericSqlRepo: sqlRepo}, nil
 }
 
-func (repo *redshiftRepository) ListDatabases(ctx context.Context) ([]string, error) {
+func (repo *Repository) ListDatabases(ctx context.Context) ([]string, error) {
 	// Redshift and Postgres use the same query to list the server databases.
 	return repo.genericSqlRepo.ListDatabasesWithQuery(ctx, postgresql.DatabaseQuery)
 }
 
-func (repo *redshiftRepository) Introspect(ctx context.Context) (*repository.Metadata, error) {
+func (repo *Repository) Introspect(ctx context.Context) (*repository.Metadata, error) {
 	return repo.genericSqlRepo.Introspect(ctx)
 }
 
-func (repo *redshiftRepository) SampleTable(
+func (repo *Repository) SampleTable(
 	ctx context.Context,
 	meta *repository.TableMetadata,
 	params repository.SampleParameters,
@@ -81,14 +83,19 @@ func (repo *redshiftRepository) SampleTable(
 	return repo.genericSqlRepo.SampleTableWithQuery(ctx, meta, query, params.SampleSize, params.Offset)
 }
 
-func (repo *redshiftRepository) Ping(ctx context.Context) error {
+func (repo *Repository) Ping(ctx context.Context) error {
 	return repo.genericSqlRepo.Ping(ctx)
 }
 
-func (repo *redshiftRepository) Close() error {
+func (repo *Repository) Close() error {
 	return repo.genericSqlRepo.Close()
 }
 
 func init() {
-	repository.Register(RepoTypeRedshift, NewRedshiftRepository)
+	repository.Register(
+		RepoTypeRedshift,
+		func(_ context.Context, cfg config.RepoConfig) (repository.Repository, error) {
+			return NewRepository(cfg)
+		},
+	)
 }
diff --git a/discovery/repository/redshift/redshift_test.go b/discovery/repository/redshift/redshift_test.go
index b768aa8..48d9c75 100644
--- a/discovery/repository/redshift/redshift_test.go
+++ b/discovery/repository/redshift/redshift_test.go
@@ -14,7 +14,7 @@ import (
 
 func TestListDatabases(t *testing.T) {
 	ctx, db, mock, r := initRepoTest(t)
-	defer db.Close()
+	defer func() { _ = db.Close() }()
 	dbRows := sqlmock.NewRows([]string{"name"}).AddRow("db1").AddRow("db2")
 	mock.ExpectQuery(postgresql.DatabaseQuery).WillReturnRows(dbRows)
 	dbs, err := r.ListDatabases(ctx)
@@ -22,11 +22,11 @@ func TestListDatabases(t *testing.T) {
 	require.ElementsMatch(t, []string{"db1", "db2"}, dbs)
 }
 
-func initRepoTest(t *testing.T) (context.Context, *sql.DB, sqlmock.Sqlmock, *redshiftRepository) {
+func initRepoTest(t *testing.T) (context.Context, *sql.DB, sqlmock.Sqlmock, *Repository) {
 	ctx := context.Background()
 	db, mock, err := sqlmock.New()
 	require.NoError(t, err)
-	return ctx, db, mock, &redshiftRepository{
-		genericSqlRepo: genericsql.NewGenericSqlRepositoryFromDB("repoName", RepoTypeRedshift, "dbName", db),
+	return ctx, db, mock, &Repository{
+		genericSqlRepo: genericsql.NewRepositoryFromDB("repoName", RepoTypeRedshift, "dbName", db),
 	}
 }
diff --git a/discovery/repository/repository.go b/discovery/repository/repository.go
index 1a0bbfd..27d6774 100644
--- a/discovery/repository/repository.go
+++ b/discovery/repository/repository.go
@@ -4,12 +4,6 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"sync"
-
-	"github.com/hashicorp/go-multierror"
-	"golang.org/x/sync/semaphore"
-
-	log "github.com/sirupsen/logrus"
 
 	"github.com/cyralinc/dmap/discovery/config"
 )
@@ -51,10 +45,11 @@ type RepoConstructor func(ctx context.Context, cfg config.RepoConfig) (Repositor
 
 var registry = make(map[string]RepoConstructor)
 
-// Register makes a repository available by the provided repository type (repoType).
-// If Register is called twice with the same repoType, or if constructor is nil, it
-// panics. Note that Register is not thread-safe. It is expected to be called from
-// either a package's init function, or from the program's main function.
+// Register makes a repository available by the provided repository type
+// (repoType). If Register is called twice with the same repoType, or if
+// constructor is nil, it panics. Note that Register is not thread-safe. It is
+// expected to be called from either a package's init function, or from the
+// program's main function.
 func Register(repoType string, constructor RepoConstructor) {
 	if constructor == nil {
 		panic("attempt to register nil constructor for repoType " + repoType)
@@ -67,8 +62,9 @@ func Register(repoType string, constructor RepoConstructor) {
 	registry[repoType] = constructor
 }
 
-// NewRepository is a factory function to return a concrete Repository implementation
-// based on the specified type, e.g. MySQL, PostgreSQL, MSSQL, etc.
+// NewRepository is a factory function to return a concrete Repository
+// implementation based on the specified type, e.g. MySQL, PostgreSQL, MSSQL,
+// etc.
 func NewRepository(ctx context.Context, cfg config.RepoConfig) (Repository, error) {
 	constructor, ok := registry[cfg.Type]
 	if !ok {
@@ -82,156 +78,3 @@ func NewRepository(ctx context.Context, cfg config.RepoConfig) (Repository, erro
 
 	return repo, nil
 }
-
-// sampleAndErr is a "pair" type intended to be passed to a channel (see
-// SampleRepository)
-type sampleAndErr struct {
-	sample Sample
-	err    error
-}
-
-// samplesAndErr is a "pair" type intended to be passed to a channel (see
-// SampleAllDatabases)
-type samplesAndErr struct {
-	samples []Sample
-	err     error
-}
-
-// SampleRepository is a helper function which will sample every table in a
-// given repository and return them as a collection of Sample. First the
-// repository is introspected by calling Repository.Introspect to return the
-// repository metadata (Metadata). Then, for each schema and table in the
-// metadata, it calls Repository.SampleTable in a new goroutine. Once all the
-// sampling goroutines are finished, their results are collected and returned
-// as a slice of Sample.
-func SampleRepository(ctx context.Context, repo Repository, params SampleParameters) (
-	[]Sample,
-	error,
-) {
-	meta, err := repo.Introspect(ctx)
-	if err != nil {
-		return nil, fmt.Errorf("error introspecting repository: %w", err)
-	}
-
-	// Fan out sample executions
-	out := make(chan sampleAndErr)
-	numTables := 0
-	for _, schemaMeta := range meta.Schemas {
-		for _, tableMeta := range schemaMeta.Tables {
-			numTables++
-			go func(meta *TableMetadata, params SampleParameters) {
-				sample, err := repo.SampleTable(ctx, meta, params)
-				out <- sampleAndErr{sample: sample, err: err}
-			}(tableMeta, params)
-		}
-	}
-
-	var samples []Sample
-	var errs error
-	for i := 0; i < numTables; i++ {
-		res := <-out
-		if res.err != nil {
-			errs = multierror.Append(errs, res.err)
-		} else {
-			samples = append(samples, res.sample)
-		}
-	}
-	close(out)
-
-	if errs != nil {
-		return samples, fmt.Errorf("error(s) while sampling repository: %w", errs)
-	}
-
-	return samples, nil
-}
-
-// SampleAllDatabases uses the given repository to list all the databases on the
-// server, and samples each one in parallel by calling SampleRepository for each
-// database. The repository is intended to be configured to connect to the
-// default database on the server, or at least some database which can be used
-// to enumerate the full set of databases on the server. An error will be
-// returned if the set of databases cannot be listed. If there is an error
-// connecting to or sampling a database, the error will be logged and no samples
-// will be returned for that database. Therefore, the returned slice of samples
-// contains samples for only the databases which could be discovered and
-// successfully sampled, and could potentially be empty if no databases were
-// sampled.
-func SampleAllDatabases(
-	ctx context.Context,
-	repo Repository,
-	repoCfg config.RepoConfig,
-	sampleParams SampleParameters,
-) (
-	[]Sample,
-	error,
-) {
-	// We assume that this repository will be connected to the default database
-	// (or at least some database that can discover all the other databases),
-	// and we use that to discover all other databases.
-	dbs, err := repo.ListDatabases(ctx)
-	if err != nil {
-		return nil, fmt.Errorf("error listing databases: %w", err)
-	}
-
-	// Sample each database on a separate goroutine, and send the samples
-	// to the 'out' channel. Each slice of samples will be aggregated below
-	// on the main goroutine and returned.
-	var wg sync.WaitGroup
-	out := make(chan samplesAndErr)
-	wg.Add(len(dbs))
-	// Ensures that we avoid opening more than the specified number of
-	// connections.
-	var sema *semaphore.Weighted
-	if repoCfg.MaxOpenConns > 0 {
-		sema = semaphore.NewWeighted(int64(repoCfg.MaxOpenConns))
-	}
-	for _, db := range dbs {
-		go func(db string, cfg config.RepoConfig) {
-			defer wg.Done()
-			if sema != nil {
-				_ = sema.Acquire(ctx, 1)
-				defer sema.Release(1)
-			}
-			cfg.Database = db
-			// Create a repository instance for this database. It will be used
-			// to connect and sample the database.
-			repo, err := NewRepository(ctx, cfg)
-			if err != nil {
-				log.Errorf("error creating repository instance for database %s: %v", db, err)
-				return
-			}
-			// Close this repository and free up unused resources since we don't
-			// need it any longer.
-			defer func() { _ = repo.Close() }()
-			s, err := SampleRepository(ctx, repo, sampleParams)
-			if err != nil && len(s) == 0 {
-				log.Errorf("error gathering repository data samples for database %s: %v", db, err)
-				return
-			}
-			// Send the samples for this database to the 'out' channel. The
-			// samples for each database will be aggregated into a single slice
-			// on the main goroutine and returned.
-			out <- samplesAndErr{samples: s, err: err}
-		}(db, repoCfg)
-	}
-
-	// Start a goroutine to close the 'out' channel once all the goroutines
-	// we launched above are done. This will allow the aggregation range loop
-	// below to terminate properly. Note that this must start after the wg.Add
-	// call. See https://go.dev/blog/pipelines ("Fan-out, fan-in" section).
-	go func() {
-		wg.Wait()
-		close(out)
-	}()
-
-	// Aggregate and return the results.
-	var ret []Sample
-	var errs error
-	for res := range out {
-		ret = append(ret, res.samples...)
-		if res.err != nil {
-			errs = multierror.Append(errs, res.err)
-		}
-	}
-	return ret, errs
-}
diff --git a/discovery/repository/sampling.go b/discovery/repository/sampling.go
index 3b622c6..b7f34a7 100644
--- a/discovery/repository/sampling.go
+++ b/discovery/repository/sampling.go
@@ -1,7 +1,15 @@
 package repository
 
 import (
+	"context"
 	"fmt"
+	"sync"
+
+	"github.com/hashicorp/go-multierror"
+	log "github.com/sirupsen/logrus"
+	"golang.org/x/sync/semaphore"
+
+	"github.com/cyralinc/dmap/discovery/config"
 )
 
 // SampleParameters contains all parameters necessary to sample a table.
@@ -35,6 +43,20 @@ type SampleMetadata struct {
 // map value is the column value.
 type SampleResult map[string]any
 
+// sampleAndErr is a "pair" type intended to be passed to a channel (see
+// SampleRepository)
+type sampleAndErr struct {
+	sample Sample
+	err    error
+}
+
+// samplesAndErr is a "pair" type intended to be passed to a channel (see
+// SampleAllDatabases)
+type samplesAndErr struct {
+	samples []Sample
+	err     error
+}
+
 // GetAttributeNamesAndValues splits a SampleResult map into two slices and
 // returns them. The first slice contains all the keys of SampleResult,
 // representing the table's attribute names, and the second slice is the map's
@@ -54,3 +76,142 @@ func (result SampleResult) GetAttributeNamesAndValues() ([]string, []string) {
 	}
 	return names, vals
 }
+
+// SampleRepository is a helper function which will sample every table in a
+// given repository and return them as a collection of Sample. First the
+// repository is introspected by calling Repository.Introspect to return the
+// repository metadata (Metadata). Then, for each schema and table in the
+// metadata, it calls Repository.SampleTable in a new goroutine. Once all the
+// sampling goroutines are finished, their results are collected and returned
+// as a slice of Sample.
+func SampleRepository(ctx context.Context, repo Repository, params SampleParameters) (
+	[]Sample,
+	error,
+) {
+	meta, err := repo.Introspect(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("error introspecting repository: %w", err)
+	}
+
+	// Fan out sample executions
+	out := make(chan sampleAndErr)
+	numTables := 0
+	for _, schemaMeta := range meta.Schemas {
+		for _, tableMeta := range schemaMeta.Tables {
+			numTables++
+			go func(meta *TableMetadata, params SampleParameters) {
+				sample, err := repo.SampleTable(ctx, meta, params)
+				out <- sampleAndErr{sample: sample, err: err}
+			}(tableMeta, params)
+		}
+	}
+
+	var samples []Sample
+	var errs error
+	for i := 0; i < numTables; i++ {
+		res := <-out
+		if res.err != nil {
+			errs = multierror.Append(errs, res.err)
+		} else {
+			samples = append(samples, res.sample)
+		}
+	}
+	close(out)
+
+	if errs != nil {
+		return samples, fmt.Errorf("error(s) while sampling repository: %w", errs)
+	}
+
+	return samples, nil
+}
+
+// SampleAllDatabases uses the given repository to list all the databases on the
+// server, and samples each one in parallel by calling SampleRepository for each
+// database. The repository is intended to be configured to connect to the
+// default database on the server, or at least some database which can be used
+// to enumerate the full set of databases on the server. An error will be
+// returned if the set of databases cannot be listed. If there is an error
+// connecting to or sampling a database, the error will be logged and no samples
+// will be returned for that database. Therefore, the returned slice of samples
+// contains samples for only the databases which could be discovered and
+// successfully sampled, and could potentially be empty if no databases were
+// sampled.
+func SampleAllDatabases(
+	ctx context.Context,
+	repo Repository,
+	repoCfg config.RepoConfig,
+	sampleParams SampleParameters,
+) (
+	[]Sample,
+	error,
+) {
+	// We assume that this repository will be connected to the default database
+	// (or at least some database that can discover all the other databases),
+	// and we use that to discover all other databases.
+	dbs, err := repo.ListDatabases(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("error listing databases: %w", err)
+	}
+
+	// Sample each database on a separate goroutine, and send the samples
+	// to the 'out' channel. Each slice of samples will be aggregated below
+	// on the main goroutine and returned.
+	var wg sync.WaitGroup
+	out := make(chan samplesAndErr)
+	wg.Add(len(dbs))
+	// Ensures that we avoid opening more than the specified number of
+	// connections.
+	var sema *semaphore.Weighted
+	if repoCfg.MaxOpenConns > 0 {
+		sema = semaphore.NewWeighted(int64(repoCfg.MaxOpenConns))
+	}
+	for _, db := range dbs {
+		go func(db string, cfg config.RepoConfig) {
+			defer wg.Done()
+			if sema != nil {
+				_ = sema.Acquire(ctx, 1)
+				defer sema.Release(1)
+			}
+			cfg.Database = db
+			// Create a repository instance for this database. It will be used
+			// to connect and sample the database.
+			repo, err := NewRepository(ctx, cfg)
+			if err != nil {
+				log.WithError(err).Errorf("error creating repository instance for database %s", db)
+				return
+			}
+			// Close this repository and free up unused resources since we don't
+			// need it any longer.
+			defer func() { _ = repo.Close() }()
+			s, err := SampleRepository(ctx, repo, sampleParams)
+			if err != nil && len(s) == 0 {
+				log.WithError(err).Errorf("error gathering repository data samples for database %s", db)
+				return
+			}
+			// Send the samples for this database to the 'out' channel. The
+			// samples for each database will be aggregated into a single slice
+			// on the main goroutine and returned.
+			out <- samplesAndErr{samples: s, err: err}
+		}(db, repoCfg)
+	}
+
+	// Start a goroutine to close the 'out' channel once all the goroutines
+	// we launched above are done. This will allow the aggregation range loop
+	// below to terminate properly. Note that this must start after the wg.Add
+	// call. See https://go.dev/blog/pipelines ("Fan-out, fan-in" section).
+	go func() {
+		wg.Wait()
+		close(out)
+	}()
+
+	// Aggregate and return the results.
+	var ret []Sample
+	var errs error
+	for res := range out {
+		ret = append(ret, res.samples...)
+		if res.err != nil {
+			errs = multierror.Append(errs, res.err)
+		}
+	}
+	return ret, errs
+}
diff --git a/discovery/repository/snowflake/snowflake.go b/discovery/repository/snowflake/snowflake.go
index 2221f9c..ff59cf4 100644
--- a/discovery/repository/snowflake/snowflake.go
+++ b/discovery/repository/snowflake/snowflake.go
@@ -26,60 +26,62 @@ WHERE
 `
 )
 
-type snowflakeRepository struct {
+// Repository is a repository.Repository implementation for Snowflake databases.
+type Repository struct {
 	// The majority of the repository.Repository functionality is delegated to
 	// a generic SQL repository instance (genericSqlRepo).
-	genericSqlRepo *genericsql.GenericSqlRepository
+	genericSqlRepo *genericsql.Repository
 }
 
-// *snowflakeRepository implements repository.Repository
-var _ repository.Repository = (*snowflakeRepository)(nil)
+// Repository implements repository.Repository
+var _ repository.Repository = (*Repository)(nil)
 
-func NewSnowflakeRepository(_ context.Context, repoCfg config.RepoConfig) (repository.Repository, error) {
-	snowflakeCfg, err := ParseConfig(repoCfg)
+// NewRepository creates a new Snowflake repository.
+func NewRepository(cfg config.RepoConfig) (*Repository, error) {
+	snowflakeCfg, err := ParseConfig(cfg)
 	if err != nil {
 		return nil, fmt.Errorf("error when parsing snowflake config: %w", err)
 	}
-	database := repoCfg.Database
+	database := cfg.Database
 	// Connect to the default database, if unspecified.
 	if database == "" {
 		database = "SNOWFLAKE"
 	}
 	connStr := fmt.Sprintf(
 		"%s:%s@%s/%s?role=%s&warehouse=%s",
-		repoCfg.User,
-		repoCfg.Password,
+		cfg.User,
+		cfg.Password,
 		snowflakeCfg.Account,
-		repoCfg.Database,
+		cfg.Database,
 		snowflakeCfg.Role,
 		snowflakeCfg.Warehouse,
 	)
 
-	sqlRepo, err := genericsql.NewGenericSqlRepository(
-		repoCfg.Host,
+	sqlRepo, err := genericsql.NewRepository(
+		cfg.Host,
 		RepoTypeSnowflake,
 		database,
 		connStr,
-		repoCfg.MaxOpenConns,
-		repoCfg.IncludePaths,
-		repoCfg.ExcludePaths,
+		cfg.MaxOpenConns,
+		cfg.IncludePaths,
+		cfg.ExcludePaths,
 	)
 	if err != nil {
 		return nil, fmt.Errorf("could not instantiate generic sql repository: %w", err)
 	}
 
-	return &snowflakeRepository{genericSqlRepo: sqlRepo}, nil
+	return &Repository{genericSqlRepo: sqlRepo}, nil
 }
 
-func (repo *snowflakeRepository) ListDatabases(ctx context.Context) ([]string, error) {
+func (repo *Repository) ListDatabases(ctx context.Context) ([]string, error) {
 	return repo.genericSqlRepo.ListDatabasesWithQuery(ctx, DatabaseQuery)
 }
 
-func (repo *snowflakeRepository) Introspect(ctx context.Context) (*repository.Metadata, error) {
+func (repo *Repository) Introspect(ctx context.Context) (*repository.Metadata, error) {
 	return repo.genericSqlRepo.Introspect(ctx)
 }
 
-func (repo *snowflakeRepository) SampleTable(
+func (repo *Repository) SampleTable(
 	ctx context.Context,
 	meta *repository.TableMetadata,
 	params repository.SampleParameters,
@@ -87,14 +89,19 @@ func (repo *snowflakeRepository) SampleTable(
 	return repo.genericSqlRepo.SampleTable(ctx, meta, params)
 }
 
-func (repo *snowflakeRepository) Ping(ctx context.Context) error {
+func (repo *Repository) Ping(ctx context.Context) error {
 	return repo.genericSqlRepo.Ping(ctx)
 }
 
-func (repo *snowflakeRepository) Close() error {
+func (repo *Repository) Close() error {
 	return repo.genericSqlRepo.Close()
 }
 
 func init() {
-	repository.Register(RepoTypeSnowflake, NewSnowflakeRepository)
+	repository.Register(
+		RepoTypeSnowflake,
+		func(ctx context.Context, cfg config.RepoConfig) (repository.Repository, error) {
+			return NewRepository(cfg)
+		},
+	)
 }
diff --git a/discovery/repository/snowflake/snowflake_test.go b/discovery/repository/snowflake/snowflake_test.go
index 05fe358..82dd71b 100644
--- a/discovery/repository/snowflake/snowflake_test.go
+++ b/discovery/repository/snowflake/snowflake_test.go
@@ -13,7 +13,7 @@ import (
 
 func TestListDatabases(t *testing.T) {
 	ctx, db, mock, r := initRepoTest(t)
-	defer db.Close()
+	defer func() { _ = db.Close() }()
 	dbRows := sqlmock.NewRows([]string{"name"}).AddRow("db1").AddRow("db2")
 	mock.ExpectQuery(DatabaseQuery).WillReturnRows(dbRows)
 	dbs, err := r.ListDatabases(ctx)
@@ -21,11 +21,11 @@ func TestListDatabases(t *testing.T) {
 	require.ElementsMatch(t, []string{"db1", "db2"}, dbs)
 }
 
-func initRepoTest(t *testing.T) (context.Context, *sql.DB, sqlmock.Sqlmock, *snowflakeRepository) {
+func initRepoTest(t *testing.T) (context.Context, *sql.DB, sqlmock.Sqlmock, *Repository) {
 	ctx := context.Background()
 	db, mock, err := sqlmock.New()
 	require.NoError(t, err)
-	return ctx, db, mock, &snowflakeRepository{
-		genericSqlRepo: genericsql.NewGenericSqlRepositoryFromDB("repoName", RepoTypeSnowflake, "dbName", db),
+	return ctx, db, mock, &Repository{
+		genericSqlRepo: genericsql.NewRepositoryFromDB("repoName", RepoTypeSnowflake, "dbName", db),
 	}
 }
diff --git a/discovery/repository/sqlserver/sqlserver.go b/discovery/repository/sqlserver/sqlserver.go
index a77bf5c..cf2b8b4 100644
--- a/discovery/repository/sqlserver/sqlserver.go
+++ b/discovery/repository/sqlserver/sqlserver.go
@@ -28,16 +28,19 @@ const (
 	DatabaseQuery = "SELECT name FROM sys.databases WHERE name != 'model' AND name != 'tempdb'"
 )
 
-type SqlServerRepository struct {
+// Repository is a repository.Repository implementation for MS SQL Server
+// databases.
+type Repository struct {
 	// The majority of the repository.Repository functionality is delegated to
 	// a generic SQL repository instance (genericSqlRepo).
-	genericSqlRepo *genericsql.GenericSqlRepository
+	genericSqlRepo *genericsql.Repository
 }
 
-// *SqlServerRepository implements repository.Repository
-var _ repository.Repository = (*SqlServerRepository)(nil)
+// Repository implements repository.Repository
+var _ repository.Repository = (*Repository)(nil)
 
-func NewSqlServerRepository(_ context.Context, cfg config.RepoConfig) (*SqlServerRepository, error) {
+// NewRepository creates a new MS SQL Server repository.
+func NewRepository(cfg config.RepoConfig) (*Repository, error) {
 	connStr := fmt.Sprintf(
 		"sqlserver://%s:%s@%s:%d",
 		cfg.User,
@@ -51,7 +54,7 @@ func NewSqlServerRepository(_ context.Context, cfg config.RepoConfig) (*SqlServe
 		connStr = fmt.Sprintf(connStr+"?database=%s", cfg.Database)
 	}
 
-	genericSqlRepo, err := genericsql.NewGenericSqlRepository(
+	genericSqlRepo, err := genericsql.NewRepository(
 		cfg.Host,
 		RepoTypeSqlServer,
 		cfg.Database,
@@ -64,18 +67,18 @@ func NewSqlServerRepository(_ context.Context, cfg config.RepoConfig) (*SqlServe
 		return nil, fmt.Errorf("could not instantiate generic sql repository: %w", err)
 	}
 
-	return &SqlServerRepository{genericSqlRepo: genericSqlRepo}, nil
+	return &Repository{genericSqlRepo: genericSqlRepo}, nil
 }
 
-func (repo *SqlServerRepository) ListDatabases(ctx context.Context) ([]string, error) {
+func (repo *Repository) ListDatabases(ctx context.Context) ([]string, error) {
 	return repo.genericSqlRepo.ListDatabasesWithQuery(ctx, DatabaseQuery)
 }
 
-func (repo *SqlServerRepository) Introspect(ctx context.Context) (*repository.Metadata, error) {
+func (repo *Repository) Introspect(ctx context.Context) (*repository.Metadata, error) {
 	return repo.genericSqlRepo.Introspect(ctx)
 }
 
-func (repo *SqlServerRepository) SampleTable(
+func (repo *Repository) SampleTable(
 	ctx context.Context,
 	meta *repository.TableMetadata,
 	params repository.SampleParameters,
@@ -86,19 +89,19 @@ func (repo *SqlServerRepository) SampleTable(
 	return repo.genericSqlRepo.SampleTableWithQuery(ctx, meta, query, params.SampleSize)
 }
 
-func (repo *SqlServerRepository) Ping(ctx context.Context) error {
+func (repo *Repository) Ping(ctx context.Context) error {
 	return repo.genericSqlRepo.Ping(ctx)
 }
 
-func (repo *SqlServerRepository) Close() error {
+func (repo *Repository) Close() error {
 	return repo.genericSqlRepo.Close()
 }
 
 func init() {
 	repository.Register(
 		RepoTypeSqlServer,
-		func(ctx context.Context, cfg config.RepoConfig) (repository.Repository, error) {
-			return NewSqlServerRepository(ctx, cfg)
+		func(_ context.Context, cfg config.RepoConfig) (repository.Repository, error) {
+			return NewRepository(cfg)
 		},
 	)
 }
diff --git a/discovery/repository/sqlserver/sqlserver_test.go b/discovery/repository/sqlserver/sqlserver_test.go
index f1b3f87..1c15a4b 100644
--- a/discovery/repository/sqlserver/sqlserver_test.go
+++ b/discovery/repository/sqlserver/sqlserver_test.go
@@ -11,18 +11,18 @@ import (
 	"github.com/cyralinc/dmap/discovery/repository/genericsql"
 )
 
-func initRepoTest(t *testing.T) (context.Context, *sql.DB, sqlmock.Sqlmock, *SqlServerRepository) {
+func initRepoTest(t *testing.T) (context.Context, *sql.DB, sqlmock.Sqlmock, *Repository) {
 	ctx := context.Background()
 	db, mock, err := sqlmock.New()
 	require.NoError(t, err)
-	return ctx, db, mock, &SqlServerRepository{
-		genericSqlRepo: genericsql.NewGenericSqlRepositoryFromDB("repoName", RepoTypeSqlServer, "dbName", db),
+	return ctx, db, mock, &Repository{
+		genericSqlRepo: genericsql.NewRepositoryFromDB("repoName", RepoTypeSqlServer, "dbName", db),
 	}
 }
 
 func TestListDatabases(t *testing.T) {
 	ctx, db, mock, r := initRepoTest(t)
-	defer db.Close()
+	defer func() { _ = db.Close() }()
 	dbRows := sqlmock.NewRows([]string{"name"}).AddRow("db1").AddRow("db2")
 	mock.ExpectQuery(DatabaseQuery).WillReturnRows(dbRows)
 	dbs, err := r.ListDatabases(ctx)

From ef635fd9f3afa67af3e4ff8c54ba86d4bc7c40ab Mon Sep 17 00:00:00 2001
From: Chris Campo <ccampo133@users.noreply.github.com>
Date: Mon, 1 Apr 2024 12:15:36 -0400
Subject: [PATCH 06/14] OPA fmt + lint

---
 .github/workflows/opa.yaml                    |  22 ---
 .github/workflows/rego.yaml                   |  33 +++++
 Dockerfile                                    |   2 +-
 classification/label.go                       |   4 +-
 classification/labels/README.md               |   8 +
 classification/{rego => labels}/address.rego  |   2 +
 classification/labels/address_test.rego       |  64 ++++++++
 classification/{rego => labels}/age.rego      |   2 +
 classification/labels/age_test.rego           |  40 +++++
 classification/{rego => labels}/ccn.rego      |   6 +-
 classification/labels/ccn_test.rego           |  25 ++++
 classification/{rego => labels}/cvv.rego      |   2 +
 classification/labels/cvv_test.rego           |  17 +++
 classification/{rego => labels}/dob.rego      |   2 +
 classification/labels/dob_test.rego           |  38 +++++
 classification/{rego => labels}/email.rego    |   4 +-
 classification/labels/email_test.rego         |  16 ++
 .../{rego => labels}/first_name.rego          |   2 +
 classification/labels/first_name_test.rego    |  22 +++
 .../{rego => labels}/full_name.rego           |   2 +
 classification/labels/full_name_test.rego     |  13 ++
 classification/labels/ip_address.rego         |  30 ++++
 classification/labels/ip_address_test.rego    |  28 ++++
 classification/{rego => labels}/labels.yaml   |  12 +-
 .../{rego => labels}/last_name.rego           |   2 +
 classification/labels/last_name_test.rego     |  22 +++
 classification/{rego => labels}/passport.rego |   2 +
 classification/labels/passport_test.rego      |  68 +++++++++
 classification/{rego => labels}/phone.rego    |   8 +-
 classification/labels/phone_test.rego         |  16 ++
 classification/{rego => labels}/ssn.rego      |   2 +
 classification/labels/ssn_test.rego           |  73 +++++++++
 classification/rego/README.md                 |   8 -
 classification/rego/address_test.rego         |  63 --------
 classification/rego/age_test.rego             |  39 -----
 classification/rego/ccn_test.rego             |  28 ----
 classification/rego/cvv_test.rego             |  31 ----
 classification/rego/dob_test.rego             | 112 --------------
 classification/rego/email_test.rego           |  15 --
 classification/rego/first_name_test.rego      |  51 -------
 classification/rego/full_name_test.rego       |  27 ----
 classification/rego/ip_address.rego           |  28 ----
 classification/rego/ip_address_test.rego      |  27 ----
 classification/rego/last_name_test.rego       |  51 -------
 classification/rego/passport_test.rego        |  67 ---------
 classification/rego/phone_test.rego           |  15 --
 classification/rego/ssn_test.rego             |  75 ----------
 cmd/repo_scan.go                              |   6 +-
 discovery/config/config.go                    | 130 +++++++++++++++++
 .../config/{util_test.go => config_test.go}   |  54 ++-----
 discovery/config/util.go                      | 138 ------------------
 51 files changed, 699 insertions(+), 855 deletions(-)
 delete mode 100644 .github/workflows/opa.yaml
 create mode 100644 .github/workflows/rego.yaml
 create mode 100644 classification/labels/README.md
 rename classification/{rego => labels}/address.rego (94%)
 create mode 100644 classification/labels/address_test.rego
 rename classification/{rego => labels}/age.rego (89%)
 create mode 100644 classification/labels/age_test.rego
 rename classification/{rego => labels}/ccn.rego (89%)
 create mode 100644 classification/labels/ccn_test.rego
 rename classification/{rego => labels}/cvv.rego (95%)
 create mode 100644 classification/labels/cvv_test.rego
 rename classification/{rego => labels}/dob.rego (96%)
 create mode 100644 classification/labels/dob_test.rego
 rename classification/{rego => labels}/email.rego (89%)
 create mode 100644 classification/labels/email_test.rego
 rename classification/{rego => labels}/first_name.rego (91%)
 create mode 100644 classification/labels/first_name_test.rego
 rename classification/{rego => labels}/full_name.rego (89%)
 create mode 100644 classification/labels/full_name_test.rego
 create mode 100644 classification/labels/ip_address.rego
 create mode 100644 classification/labels/ip_address_test.rego
 rename classification/{rego => labels}/labels.yaml (71%)
 rename classification/{rego => labels}/last_name.rego (91%)
 create mode 100644 classification/labels/last_name_test.rego
 rename classification/{rego => labels}/passport.rego (92%)
 create mode 100644 classification/labels/passport_test.rego
 rename classification/{rego => labels}/phone.rego (76%)
 create mode 100644 classification/labels/phone_test.rego
 rename classification/{rego => labels}/ssn.rego (94%)
 create mode 100644 classification/labels/ssn_test.rego
 delete mode 100644 classification/rego/README.md
 delete mode 100644 classification/rego/address_test.rego
 delete mode 100644 classification/rego/age_test.rego
 delete mode 100644 classification/rego/ccn_test.rego
 delete mode 100644 classification/rego/cvv_test.rego
 delete mode 100644 classification/rego/dob_test.rego
 delete mode 100644 classification/rego/email_test.rego
 delete mode 100644 classification/rego/first_name_test.rego
 delete mode 100644 classification/rego/full_name_test.rego
 delete mode 100644 classification/rego/ip_address.rego
 delete mode 100644 classification/rego/ip_address_test.rego
 delete mode 100644 classification/rego/last_name_test.rego
 delete mode 100644 classification/rego/passport_test.rego
 delete mode 100644 classification/rego/phone_test.rego
 delete mode 100644 classification/rego/ssn_test.rego
 rename discovery/config/{util_test.go => config_test.go} (63%)
 delete mode 100644 discovery/config/util.go

diff --git a/.github/workflows/opa.yaml b/.github/workflows/opa.yaml
deleted file mode 100644
index 778f7b6..0000000
--- a/.github/workflows/opa.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-name: Run OPA Tests
-
-on:
-  push:
-    branches: [ "main" ]
-  pull_request:
-    branches: [ "main" ]
-
-jobs:
-  test:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check out repository code
-        uses: actions/checkout@v3
-
-      - name: Setup OPA
-        uses: open-policy-agent/setup-opa@v2
-        with:
-          version: latest
-
-      - name: Run OPA Tests
-        run: opa test classification/rego/*.rego -v
diff --git a/.github/workflows/rego.yaml b/.github/workflows/rego.yaml
new file mode 100644
index 0000000..9129e39
--- /dev/null
+++ b/.github/workflows/rego.yaml
@@ -0,0 +1,33 @@
+name: Run Rego Linter and Tests
+
+on:
+  push:
+    branches: [ "main" ]
+  pull_request:
+    branches: [ "main" ]
+
+jobs:
+  lint-and-test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository code
+        uses: actions/checkout@v4
+
+      - name: Setup Regal
+        uses: StyraInc/setup-regal@v1
+        with:
+          # For production workflows, use a specific version, like v0.16.0
+          version: latest
+
+      - name: Lint
+        # Disable the line-length check for now, as it's too strict: it flags
+        # the long regexes in various classification policies.
+        run: regal lint --format=github --disable=line-length ./classification/labels/
+
+      - name: Setup OPA
+        uses: open-policy-agent/setup-opa@v2
+        with:
+          version: 1.0.0
+
+      - name: Run OPA Tests
+        run: opa test classification/labels/*.rego -v
diff --git a/Dockerfile b/Dockerfile
index 20b4bb0..896ce51 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -11,7 +11,7 @@ RUN go mod download
 COPY . .
 
 # Build.
-RUN CGO_ENABLED=0 go build -ldflags="-X main.version=$(git rev-parse HEAD)" -o dmap cmd/*.go
+RUN CGO_ENABLED=0 go build -ldflags="-X main.version=$(git describe --tags --always)" -o dmap cmd/*.go
 
 FROM gcr.io/distroless/static-debian12:nonroot
 
diff --git a/classification/label.go b/classification/label.go
index f2cdfdf..8d6bd0f 100644
--- a/classification/label.go
+++ b/classification/label.go
@@ -12,9 +12,9 @@ import (
 )
 
 var (
-	//go:embed rego/*.rego
+	//go:embed labels/*.rego
 	regoFs embed.FS
-	//go:embed rego/labels.yaml
+	//go:embed labels/labels.yaml
 	labelsYaml string
 )
 
diff --git a/classification/labels/README.md b/classification/labels/README.md
new file mode 100644
index 0000000..274333c
--- /dev/null
+++ b/classification/labels/README.md
@@ -0,0 +1,8 @@
+This directory contains all the data label definitions used for classification.
+The label metadata is specified in the [`labels.yaml`](labels.yaml) file. Please
+see that file's doc comment for more details.
+
+Additionally, the classification rule Rego code for each label must be specified
+as a `<label>.rego` file, where `<label>` is the name of the label in lowercase.
+For example, if the label `ADDRESS` is defined in `labels.yaml`, it should have
+an `address.rego` file defined as well.
diff --git a/classification/rego/address.rego b/classification/labels/address.rego
similarity index 94%
rename from classification/rego/address.rego
rename to classification/labels/address.rego
index 41c766e..abc2ce8 100644
--- a/classification/rego/address.rego
+++ b/classification/labels/address.rego
@@ -2,6 +2,8 @@ package classifier_address
 
 import rego.v1
 
+# METADATA
+# entrypoint: true
 output[k] := v if {
 	some k in object.keys(input)
 	v := classify(k, input[k])
diff --git a/classification/labels/address_test.rego b/classification/labels/address_test.rego
new file mode 100644
index 0000000..5d9bd83
--- /dev/null
+++ b/classification/labels/address_test.rego
@@ -0,0 +1,64 @@
+package classifier_address_test
+
+import data.classifier_address
+import rego.v1
+
+test_no_label if {
+	classifier_address.output.column == false with input as {"column": "invalid"}
+}
+
+test_column_name_state if {
+	classifier_address.output.state == true with input as {"state": "AZ"}
+}
+
+test_insensitive_column_name_state if {
+	classifier_address.output.STATE == true with input as {"STATE": "AZ"}
+}
+
+test_column_name_address if {
+	classifier_address.output.address == true with input as {"address": "123 some street"}
+}
+
+test_insensitive_column_name_address if {
+	classifier_address.output.ADDRESS == true with input as {"ADDRESS": "123 some street"}
+}
+
+test_column_name_contains_address if {
+	classifier_address.output.some_address_here == true with input as {"some_address_here": "123 some street"}
+}
+
+test_insensitive_column_name_contains_address if {
+	classifier_address.output.some_ADDRESS_Here == true with input as {"some_ADDRESS_Here": "123 some street"}
+}
+
+test_column_name_street if {
+	classifier_address.output.street == true with input as {"street": "123 some street"}
+}
+
+test_insensitive_column_name_street if {
+	classifier_address.output.STREET == true with input as {"STREET": "123 some street"}
+}
+
+test_column_name_starts_with_street if {
+	classifier_address.output.street_name == true with input as {"street_name": "123 some street"}
+}
+
+test_insensitive_column_name_starts_with_street if {
+	classifier_address.output.STREET_Name == true with input as {"STREET_Name": "123 some street"}
+}
+
+test_column_name_zip if {
+	classifier_address.output.zip == true with input as {"zip": "11111"}
+}
+
+test_insensitive_column_name_zip if {
+	classifier_address.output.ZIP == true with input as {"ZIP": "11111"}
+}
+
+test_column_name_zipcode if {
+	classifier_address.output.zipcode == true with input as {"zipcode": "11111"}
+}
+
+test_insensitive_column_name_zipcode if {
+	classifier_address.output.ZIPCODE == true with input as {"ZIPCODE": "11111"}
+}
diff --git a/classification/rego/age.rego b/classification/labels/age.rego
similarity index 89%
rename from classification/rego/age.rego
rename to classification/labels/age.rego
index f6239ac..4eeb19b 100644
--- a/classification/rego/age.rego
+++ b/classification/labels/age.rego
@@ -2,6 +2,8 @@ package classifier_age
 
 import rego.v1
 
+# METADATA
+# entrypoint: true
 output[k] := v if {
 	some k in object.keys(input)
 	v := classify(k, input[k])
diff --git a/classification/labels/age_test.rego b/classification/labels/age_test.rego
new file mode 100644
index 0000000..60e1c99
--- /dev/null
+++ b/classification/labels/age_test.rego
@@ -0,0 +1,40 @@
+package classifier_age_test
+
+import data.classifier_age
+import rego.v1
+
+test_no_label if {
+	classifier_age.output.column == false with input as {"column": "invalid"}
+}
+
+test_column_name_age_invalid_age if {
+	classifier_age.output.age == false with input as {"age": "120"}
+}
+
+test_insensitive_column_name_age_invalid if {
+	classifier_age.output.AGE == false with input as {"AGE": "120"}
+}
+
+test_column_name_age_single_digit if {
+	classifier_age.output.age == true with input as {"age": "1"}
+}
+
+test_insensitive_column_name_age_single_digit if {
+	classifier_age.output.AGE == true with input as {"AGE": "1"}
+}
+
+test_column_name_age_double_digit if {
+	classifier_age.output.age == true with input as {"age": "10"}
+}
+
+test_insensitive_column_name_age_double_digit if {
+	classifier_age.output.AGE == true with input as {"AGE": "10"}
+}
+
+test_column_name_age_triple_digit if {
+	classifier_age.output.age == true with input as {"age": "100"}
+}
+
+test_insensitive_column_name_age_triple_digit if {
+	classifier_age.output.AGE == true with input as {"AGE": "100"}
+}
diff --git a/classification/rego/ccn.rego b/classification/labels/ccn.rego
similarity index 89%
rename from classification/rego/ccn.rego
rename to classification/labels/ccn.rego
index 9833777..c0b54b6 100644
--- a/classification/rego/ccn.rego
+++ b/classification/labels/ccn.rego
@@ -2,6 +2,8 @@ package classifier_ccn
 
 import rego.v1
 
+# METADATA
+# entrypoint: true
 output[k] := v if {
 	some k in object.keys(input)
 	v := classify(k, input[k])
@@ -12,6 +14,6 @@ default classify(_, _) := false
 classify(_, val) if {
 	regex.match(
 		`\A(?:4[0-9]{12}(?:[0-9]{3})?|[25][1-7][0-9]{14}|6(?:011|5[0-9][0-9])[0-9]{12}|3[47][0-9]{13}|3(?:0[0-5]|[68][0-9])[0-9]{11}|(?:2131|1800|35\d{3})\d{11})\z`,
-		val
-    )
+		val,
+	)
 }
diff --git a/classification/labels/ccn_test.rego b/classification/labels/ccn_test.rego
new file mode 100644
index 0000000..7421b72
--- /dev/null
+++ b/classification/labels/ccn_test.rego
@@ -0,0 +1,25 @@
+package classifier_ccn_test
+
+import data.classifier_ccn
+import rego.v1
+
+test_no_label if {
+	classifier_ccn.output.column == false with input as {"column": "invalid"}
+}
+
+test_valid_amex_ccn if {
+	classifier_ccn.output.message == true with input as {"message": "370136066365291"}
+}
+
+test_valid_visa_ccn if {
+	classifier_ccn.output.message == true with input as {"message": "4613688275707134"}
+}
+
+test_valid_mastercard_ccn if {
+	classifier_ccn.output.message == true with input as {"message": "5423909386888564"}
+	classifier_ccn.output.message == true with input as {"message": "2701306282695666"}
+}
+
+test_valid_discover_ccn if {
+	classifier_ccn.output.message == true with input as {"message": "6536673682309236"}
+}
diff --git a/classification/rego/cvv.rego b/classification/labels/cvv.rego
similarity index 95%
rename from classification/rego/cvv.rego
rename to classification/labels/cvv.rego
index b1c670d..2cce1dd 100644
--- a/classification/rego/cvv.rego
+++ b/classification/labels/cvv.rego
@@ -2,6 +2,8 @@ package classifier_cvv
 
 import rego.v1
 
+# METADATA
+# entrypoint: true
 output[k] := v if {
 	some k in object.keys(input)
 	v := classify(k, input[k])
diff --git a/classification/labels/cvv_test.rego b/classification/labels/cvv_test.rego
new file mode 100644
index 0000000..e5fbfbf
--- /dev/null
+++ b/classification/labels/cvv_test.rego
@@ -0,0 +1,17 @@
+package classifier_cvv_test
+
+import data.classifier_cvv
+import rego.v1
+
+test_cvv_key if {
+	classifier_cvv.output.CVV == true with input as {"CVV": "test"}
+	classifier_cvv.output.cvv == true with input as {"cvv": "test"}
+	classifier_cvv.output.CvV == true with input as {"CvV": "test"}
+}
+
+test_cvv_pattern if {
+	classifier_cvv.output.message == true with input as {"message": "451"}
+	classifier_cvv.output.message == true with input as {"message": "5061"}
+	classifier_cvv.output.message == true with input as {"message": "123"}
+	classifier_cvv.output.message == false with input as {"message": "12345"}
+}
diff --git a/classification/rego/dob.rego b/classification/labels/dob.rego
similarity index 96%
rename from classification/rego/dob.rego
rename to classification/labels/dob.rego
index ec7e123..caa8626 100644
--- a/classification/rego/dob.rego
+++ b/classification/labels/dob.rego
@@ -2,6 +2,8 @@ package classifier_dob
 
 import rego.v1
 
+# METADATA
+# entrypoint: true
 output[k] := v if {
 	some k in object.keys(input)
 	v := classify(k, input[k])
diff --git a/classification/labels/dob_test.rego b/classification/labels/dob_test.rego
new file mode 100644
index 0000000..3a8fd99
--- /dev/null
+++ b/classification/labels/dob_test.rego
@@ -0,0 +1,38 @@
+package classifier_dob_test
+
+import data.classifier_dob
+import rego.v1
+
+test_dob_key if {
+	classifier_dob.output.dob == true with input as {"dob": "test"}
+	classifier_dob.output.DOB == true with input as {"DOB": "test"}
+	classifier_dob.output.DoB == true with input as {"DoB": "test"}
+	classifier_dob.output.birthdate == true with input as {"birthdate": "test"}
+	classifier_dob.output.BirthDate == true with input as {"BirthDate": "test"}
+	classifier_dob.output.dateofbirth == true with input as {"dateofbirth": "test"}
+	classifier_dob.output.DateOfBirth == true with input as {"DateOfBirth": "test"}
+	classifier_dob.output.birthdate == true with input as {"birthdate": "test"}
+	classifier_dob.output.birth_date == true with input as {"birth_date": "test"}
+}
+
+test_dob_pattern_month_day_year if {
+	classifier_dob.output.message == true with input as {"message": "01/01/1900"}
+	classifier_dob.output.message == true with input as {"message": "1-1-1900"}
+	classifier_dob.output.message == true with input as {"message": "10.01.1971"}
+	classifier_dob.output.message == true with input as {"message": "11/30/2023"}
+	classifier_dob.output.message == true with input as {"message": "01/01/1900"}
+	classifier_dob.output.message == true with input as {"message": "1/1/1900"}
+	classifier_dob.output.message == true with input as {"message": "10/01/1971"}
+	classifier_dob.output.message == true with input as {"message": "30/11/2023"}
+}
+
+test_dob_pattern_year_month_day if {
+	classifier_dob.output.message == true with input as {"message": "1900/01/10"}
+	classifier_dob.output.message == true with input as {"message": "1900/1/1"}
+	classifier_dob.output.message == true with input as {"message": "1971/10/01"}
+	classifier_dob.output.message == true with input as {"message": "2023/12/31"}
+	classifier_dob.output.message == true with input as {"message": "1900-01-10"}
+	classifier_dob.output.message == true with input as {"message": "1900-1-1"}
+	classifier_dob.output.message == true with input as {"message": "1971-10-01"}
+	classifier_dob.output.message == true with input as {"message": "2023-12-31"}
+}
diff --git a/classification/rego/email.rego b/classification/labels/email.rego
similarity index 89%
rename from classification/rego/email.rego
rename to classification/labels/email.rego
index c62946f..36b4d0f 100644
--- a/classification/rego/email.rego
+++ b/classification/labels/email.rego
@@ -2,6 +2,8 @@ package classifier_email
 
 import rego.v1
 
+# METADATA
+# entrypoint: true
 output[k] := v if {
 	some k in object.keys(input)
 	v := classify(k, input[k])
@@ -12,6 +14,6 @@ default classify(_, _) := false
 classify(_, val) if {
 	regex.match(
 		`\A[A-Za-z0-9][A-Za-z0-9._%+-]*@[A-Za-z0-9]((\.[A-Za-z0-9])|(-[A-Za-z0-9])|[A-Za-z0-9])*\.[A-Za-z]{2,}\z`,
-		val
+		val,
 	)
 }
diff --git a/classification/labels/email_test.rego b/classification/labels/email_test.rego
new file mode 100644
index 0000000..3e5b161
--- /dev/null
+++ b/classification/labels/email_test.rego
@@ -0,0 +1,16 @@
+package classifier_email_test
+
+import data.classifier_email
+import rego.v1
+
+test_no_label if {
+	classifier_email.output.column == false with input as {"column": "invalid"}
+}
+
+test_valid_email_com if {
+	classifier_email.output.message == true with input as {"message": "me@me.com"}
+}
+
+test_valid_email_us if {
+	classifier_email.output.message == true with input as {"message": "me@state.pa.us"}
+}
diff --git a/classification/rego/first_name.rego b/classification/labels/first_name.rego
similarity index 91%
rename from classification/rego/first_name.rego
rename to classification/labels/first_name.rego
index 58ac065..8c14d2b 100644
--- a/classification/rego/first_name.rego
+++ b/classification/labels/first_name.rego
@@ -2,6 +2,8 @@ package classifier_first_name
 
 import rego.v1
 
+# METADATA
+# entrypoint: true
 output[k] := v if {
 	some k in object.keys(input)
 	v := classify(k, input[k])
diff --git a/classification/labels/first_name_test.rego b/classification/labels/first_name_test.rego
new file mode 100644
index 0000000..d70c8cb
--- /dev/null
+++ b/classification/labels/first_name_test.rego
@@ -0,0 +1,22 @@
+package classifier_first_name_test
+
+import data.classifier_first_name
+import rego.v1
+
+test_fn_pattern if {
+	classifier_first_name.output.first_name == true with input as {"first_name": "John"}
+	classifier_first_name.output.first_name == true with input as {"first_name": "Robert"}
+	classifier_first_name.output.firstname == true with input as {"firstname": "Robert"}
+	classifier_first_name.output.firstName == true with input as {"firstName": "Robert"}
+	classifier_first_name.output.First_Name == true with input as {"First_Name": "Robert"}
+	classifier_first_name.output.FirstName == true with input as {"FirstName": "Robert"}
+}
+
+test_gn_pattern if {
+	classifier_first_name.output.given_name == true with input as {"given_name": "John"}
+	classifier_first_name.output.given_name == true with input as {"given_name": "Robert"}
+	classifier_first_name.output.givenname == true with input as {"givenname": "Robert"}
+	classifier_first_name.output.givenName == true with input as {"givenName": "Robert"}
+	classifier_first_name.output.Given_Name == true with input as {"Given_Name": "Robert"}
+	classifier_first_name.output.GivenName == true with input as {"GivenName": "Robert"}
+}
diff --git a/classification/rego/full_name.rego b/classification/labels/full_name.rego
similarity index 89%
rename from classification/rego/full_name.rego
rename to classification/labels/full_name.rego
index 569e1f1..1effc5f 100644
--- a/classification/rego/full_name.rego
+++ b/classification/labels/full_name.rego
@@ -2,6 +2,8 @@ package classifier_full_name
 
 import rego.v1
 
+# METADATA
+# entrypoint: true
 output[k] := v if {
 	some k in object.keys(input)
 	v := classify(k, input[k])
diff --git a/classification/labels/full_name_test.rego b/classification/labels/full_name_test.rego
new file mode 100644
index 0000000..0b48e70
--- /dev/null
+++ b/classification/labels/full_name_test.rego
@@ -0,0 +1,13 @@
+package classifier_full_name_test
+
+import data.classifier_full_name
+import rego.v1
+
+test_fn_pattern if {
+	classifier_full_name.output.full_name == true with input as {"full_name": "John"}
+	classifier_full_name.output.full_name == true with input as {"full_name": "Robert"}
+	classifier_full_name.output.fullname == true with input as {"fullname": "Robert"}
+	classifier_full_name.output.fullName == true with input as {"fullName": "Robert"}
+	classifier_full_name.output.Full_Name == true with input as {"Full_Name": "Robert"}
+	classifier_full_name.output.FullName == true with input as {"FullName": "Robert"}
+}
diff --git a/classification/labels/ip_address.rego b/classification/labels/ip_address.rego
new file mode 100644
index 0000000..dee2793
--- /dev/null
+++ b/classification/labels/ip_address.rego
@@ -0,0 +1,30 @@
+package classifier_ip_address
+
+import rego.v1
+
+# METADATA
+# entrypoint: true
+output[k] := v if {
+	some k in object.keys(input)
+	v := classify(k, input[k])
+}
+
+default classify(_, _) := false
+
+classify(_, val) if {
+	regex.match(`\d+\.\d+\.\d+\.\d+`, val)
+}
+
+classify(_, val) if {
+	regex.match(
+		`\A(?:(?:[0-9A-Fa-f]{1,4}:){6}(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|::(?:[0-9A-Fa-f]{1,4}:){5}(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|(?:[0-9A-Fa-f]{1,4})?::(?:[0-9A-Fa-f]{1,4}:){4}(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4})?::(?:[0-9A-Fa-f]{1,4}:){3}(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|(?:(?:[0-9A-Fa-f]{1,4}:){,2}[0-9A-Fa-f]{1,4})?::(?:[0-9A-Fa-f]{1,4}:){2}(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|(?:(?:[0-9A-Fa-f]{1,4}:){,3}[0-9A-Fa-f]{1,4})?::[0-9A-Fa-f]{1,4}:(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|(?:(?:[0-9A-Fa-f]{1,4}:){,4}[0-9A-Fa-f]{1,4})?::(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|(?:(?:[0-9A-Fa-f]{1,4}:){,5}[0-9A-Fa-f]{1,4})?::[0-9A-Fa-f]{1,4}|(?:(?:[0-9A-Fa-f]{1,4}:){,6}[0-9A-Fa-f]{1,4})?::)\z`,
+		val,
+	)
+}
+
+classify(_, val) if {
+	regex.match(
+		`\A(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))\z`,
+		val,
+	)
+}
diff --git a/classification/labels/ip_address_test.rego b/classification/labels/ip_address_test.rego
new file mode 100644
index 0000000..e3aded9
--- /dev/null
+++ b/classification/labels/ip_address_test.rego
@@ -0,0 +1,28 @@
+package classifier_ip_address_test
+
+import data.classifier_ip_address
+import rego.v1
+
+test_no_label if {
+	classifier_ip_address.output.column == false with input as {"column": "invalid"}
+}
+
+test_ipv4_google if {
+	classifier_ip_address.output.column == true with input as {"column": "8.8.8.8"}
+}
+
+test_ipv4_localhost if {
+	classifier_ip_address.output.column == true with input as {"column": "127.0.0.1"}
+}
+
+test_ipv4_internal if {
+	classifier_ip_address.output.column == true with input as {"column": "10.1.1.1"}
+}
+
+test_ipv6 if {
+	classifier_ip_address.output.column == true with input as {"column": "2001:db8:3333:4444:5555:6666:7777:8888"}
+}
+
+test_ipv6_google if {
+	classifier_ip_address.output.column == true with input as {"column": "2001:4860:4860::8888"}
+}
diff --git a/classification/rego/labels.yaml b/classification/labels/labels.yaml
similarity index 71%
rename from classification/rego/labels.yaml
rename to classification/labels/labels.yaml
index a72e978..ed9f211 100644
--- a/classification/rego/labels.yaml
+++ b/classification/labels/labels.yaml
@@ -1,13 +1,15 @@
 # Contains all the predefined data labels by Cyral. To add a new predefined
 # label, define it in this file along with its classification rule Rego code in
-# a '<label>.rego' file.
+# a '<label>.rego' file. The Rego file name should match the lowercase label
+# name, with spaces replaced by underscores. For example, the Rego file for the
+# 'ADDRESS' label should be named 'address.rego'.
 #
 # YAML structure:
 #
-# labels:               # The list of labels
-#   FOO:                # The label name
-#     description: bar  # The label description
-#     tags:             # The label tags (list)
+# labels:               # The list of labels.
+#   FOO:                # The label name.
+#     description: bar  # The label description.
+#     tags:             # The label tags (list), e.g., PII, PCI, etc.
 #       - tag1
 #       - tag2
 labels:
diff --git a/classification/rego/last_name.rego b/classification/labels/last_name.rego
similarity index 91%
rename from classification/rego/last_name.rego
rename to classification/labels/last_name.rego
index 903d429..ef1e4db 100644
--- a/classification/rego/last_name.rego
+++ b/classification/labels/last_name.rego
@@ -2,6 +2,8 @@ package classifier_last_name
 
 import rego.v1
 
+# METADATA
+# entrypoint: true
 output[k] := v if {
 	some k in object.keys(input)
 	v := classify(k, input[k])
diff --git a/classification/labels/last_name_test.rego b/classification/labels/last_name_test.rego
new file mode 100644
index 0000000..665ad3e
--- /dev/null
+++ b/classification/labels/last_name_test.rego
@@ -0,0 +1,22 @@
+package classifier_last_name_test
+
+import data.classifier_last_name
+import rego.v1
+
+test_ln_pattern if {
+	classifier_last_name.output.last_name == true with input as {"last_name": "John"}
+	classifier_last_name.output.last_name == true with input as {"last_name": "Robert"}
+	classifier_last_name.output.lastname == true with input as {"lastname": "Robert"}
+	classifier_last_name.output.lastName == true with input as {"lastName": "Robert"}
+	classifier_last_name.output.Last_Name == true with input as {"Last_Name": "Robert"}
+	classifier_last_name.output.LastName == true with input as {"LastName": "Robert"}
+}
+
+test_sn_pattern if {
+	classifier_last_name.output.sur_name == true with input as {"sur_name": "John"}
+	classifier_last_name.output.sur_name == true with input as {"sur_name": "Robert"}
+	classifier_last_name.output.surname == true with input as {"surname": "Robert"}
+	classifier_last_name.output.surName == true with input as {"surName": "Robert"}
+	classifier_last_name.output.Sur_Name == true with input as {"Sur_Name": "Robert"}
+	classifier_last_name.output.SurName == true with input as {"SurName": "Robert"}
+}
diff --git a/classification/rego/passport.rego b/classification/labels/passport.rego
similarity index 92%
rename from classification/rego/passport.rego
rename to classification/labels/passport.rego
index e52d4be..0eb8159 100644
--- a/classification/rego/passport.rego
+++ b/classification/labels/passport.rego
@@ -2,6 +2,8 @@ package classifier_passport
 
 import rego.v1
 
+# METADATA
+# entrypoint: true
 output[k] := v if {
 	some k in object.keys(input)
 	v := classify(k, input[k])
diff --git a/classification/labels/passport_test.rego b/classification/labels/passport_test.rego
new file mode 100644
index 0000000..38142c4
--- /dev/null
+++ b/classification/labels/passport_test.rego
@@ -0,0 +1,68 @@
+package classifier_passport_test
+
+import data.classifier_passport
+import rego.v1
+
+test_passport_key if {
+	classifier_passport.output.passport == true with input as {"passport": "not-a-passport-number"}
+}
+
+# United States
+test_passport_pattern_us if {
+	classifier_passport.output.message == true with input as {"message": "A12345678"}
+}
+
+# Canada
+test_passport_pattern_canada if {
+	classifier_passport.output.message == true with input as {"message": "G12345678"}
+}
+
+# United Kingdom
+test_passport_pattern_uk if {
+	classifier_passport.output.message == true with input as {"message": "GH1234567"}
+}
+
+# Australia
+test_passport_pattern_aus if {
+	classifier_passport.output.message == true with input as {"message": "P12345678"}
+}
+
+# India
+test_passport_pattern_india if {
+	classifier_passport.output.message == true with input as {"message": "P1234567"}
+}
+
+# Germany
+test_passport_pattern_germany if {
+	classifier_passport.output.message == true with input as {"message": "E12345678"}
+}
+
+# China
+test_passport_pattern_china if {
+	classifier_passport.output.message == true with input as {"message": "E123456789"}
+}
+
+# Japan
+test_passport_pattern_japan if {
+	classifier_passport.output.message == true with input as {"message": "P1234567"}
+}
+
+# South Korea
+test_passport_pattern_south_korea if {
+	classifier_passport.output.message == true with input as {"message": "M12345678"}
+}
+
+# Brazil
+test_passport_pattern_brazil if {
+	classifier_passport.output.message == true with input as {"message": "G12345678"}
+}
+
+# Mexico
+test_passport_pattern_mexico if {
+	classifier_passport.output.message == true with input as {"message": "E12345678"}
+}
+
+# South Africa (diplomat, standard covered by other countries)
+test_passport_pattern_sa if {
+	classifier_passport.output.message == true with input as {"message": "D123456789"}
+}
diff --git a/classification/rego/phone.rego b/classification/labels/phone.rego
similarity index 76%
rename from classification/rego/phone.rego
rename to classification/labels/phone.rego
index cb4a9eb..d0aec9f 100644
--- a/classification/rego/phone.rego
+++ b/classification/labels/phone.rego
@@ -1,7 +1,9 @@
-package classifier_phone_number
+package classifier_phone
 
 import rego.v1
 
+# METADATA
+# entrypoint: true
 output[k] := v if {
 	some k in object.keys(input)
 	v := classify(k, input[k])
@@ -9,9 +11,9 @@ output[k] := v if {
 
 default classify(_, _) := false
 
-classify(key, val) if {
+classify(_, val) if {
 	regex.match(
 		`\A((1(-| )?((\([2-9]\d{2}\))|([2-9]\d{2})))|([2-9]\d{2})|(\([2-9]\d{2}\)))(-| )?[2-9]((1[02-9])|([02-9]\d))(-| )?\d{4}\z`,
-		val
+		val,
 	)
 }
diff --git a/classification/labels/phone_test.rego b/classification/labels/phone_test.rego
new file mode 100644
index 0000000..2b5b9a2
--- /dev/null
+++ b/classification/labels/phone_test.rego
@@ -0,0 +1,16 @@
+package classifier_phone_test
+
+import data.classifier_phone
+import rego.v1
+
+test_no_label if {
+	classifier_phone.output.column == false with input as {"column": "invalid"}
+}
+
+test_valid_phone if {
+	classifier_phone.output.message == true with input as {"message": "7175551212"}
+}
+
+test_valid_us_phone if {
+	classifier_phone.output.message == true with input as {"message": "17175551212"}
+}
diff --git a/classification/rego/ssn.rego b/classification/labels/ssn.rego
similarity index 94%
rename from classification/rego/ssn.rego
rename to classification/labels/ssn.rego
index 5721ca5..befd622 100644
--- a/classification/rego/ssn.rego
+++ b/classification/labels/ssn.rego
@@ -2,6 +2,8 @@ package classifier_ssn
 
 import rego.v1
 
+# METADATA
+# entrypoint: true
 output[k] := v if {
 	some k in object.keys(input)
 	v := classify(k, input[k])
diff --git a/classification/labels/ssn_test.rego b/classification/labels/ssn_test.rego
new file mode 100644
index 0000000..0c31866
--- /dev/null
+++ b/classification/labels/ssn_test.rego
@@ -0,0 +1,73 @@
+package classifier_ssn_test
+
+import data.classifier_ssn
+import rego.v1
+
+test_no_label if {
+	classifier_ssn.output.column == false with input as {"column": "invalid"}
+}
+
+test_invalid_first_000 if {
+	classifier_ssn.output.column == false with input as {"column": "000123456"}
+}
+
+test_invalid_first_666 if {
+	classifier_ssn.output.column == false with input as {"column": "666123456"}
+}
+
+test_invalid_first_900s if {
+	classifier_ssn.output.column == false with input as {"column": "905123456"}
+}
+
+test_invalid_middle if {
+	classifier_ssn.output.column == false with input as {"column": "123006789"}
+}
+
+test_invalid_end if {
+	classifier_ssn.output.column == false with input as {"column": "123450000"}
+}
+
+test_ssn_on_valid_amex_ccn if {
+	classifier_ssn.output.message == false with input as {"message": "370136066365291"}
+	classifier_ssn.output.message == false with input as {"message": "370136066365291"}
+}
+
+test_ssn_on_valid_visa_ccn if {
+	classifier_ssn.output.message == false with input as {"message": "4613688275707134"}
+}
+
+test_ssn_on_valid_mastercard_format_1_ccn if {
+	classifier_ssn.output.message == false with input as {"message": "5423909386888564"}
+}
+
+test_ssn_on_valid_mastercard_format_2_ccn if {
+	classifier_ssn.output.message == false with input as {"message": "2701306282695666"}
+}
+
+test_ssn_on_valid_discover_ccn if {
+	classifier_ssn.output.message == false with input as {"message": "6536673682309236"}
+}
+
+test_valid_ssn_dashes if {
+	classifier_ssn.output.message == true with input as {"message": "111-11-1111"}
+}
+
+test_valid_ssn_dashes_sequential if {
+	classifier_ssn.output.message == true with input as {"message": "123-45-6789"}
+}
+
+test_valid_ssn_dashes_in_value if {
+	classifier_ssn.output.message == true with input as {"message": "this has a ssn 111-11-1111 that is valid"}
+}
+
+test_valid_ssn_no_dashes if {
+	classifier_ssn.output.message == true with input as {"message": "111111111"}
+}
+
+test_valid_ssn_no_dashes_sequential if {
+	classifier_ssn.output.message == true with input as {"message": "123456789"}
+}
+
+test_valid_ssn_no_dashes_in_value if {
+	classifier_ssn.output.message == true with input as {"message": "this has a ssn 111111111 that is valid"}
+}
diff --git a/classification/rego/README.md b/classification/rego/README.md
deleted file mode 100644
index c664cbe..0000000
--- a/classification/rego/README.md
+++ /dev/null
@@ -1,8 +0,0 @@
-This directory contains all the data label definitions used for classification.
-The label metadata is specified in the [`labels.yaml`](labels.yaml) file. Please
-see that file's doc comment for more details.
-
-Additionally, the classification rule Rego code must be specified as a
-`<label>.rego` file, where `<label>` is the name of the label in lowercase. For
-example, if the label `ADDRESS` is defined in `labels.yaml`, it should have an
-`address.rego` file defined as well.
diff --git a/classification/rego/address_test.rego b/classification/rego/address_test.rego
deleted file mode 100644
index 98b1b67..0000000
--- a/classification/rego/address_test.rego
+++ /dev/null
@@ -1,63 +0,0 @@
-package classifier_address
-
-import rego.v1
-
-test_no_label if {
-    output.column == false with input as {"column":"invalid"}
-}
-
-test_column_name_state if {
-    output.state == true with input as {"state":"AZ"}
-}
-
-test_insensitive_column_name_state if {
-    output.STATE == true with input as {"STATE":"AZ"}
-}
-
-test_column_name_address if {
-    output.address == true with input as {"address":"123 some street"}
-}
-
-test_insensitive_column_name_address if {
-    output.ADDRESS == true with input as {"ADDRESS":"123 some street"}
-}
-
-test_column_name_contains_address if {
-    output.some_address_here == true with input as {"some_address_here":"123 some street"}
-}
-
-test_insensitive_column_name_contains_address if {
-    output.some_ADDRESS_Here == true with input as {"some_ADDRESS_Here":"123 some street"}
-}
-
-test_column_name_street if {
-    output.street == true with input as {"street":"123 some street"}
-}
-
-test_insensitive_column_name_street if {
-    output.STREET == true with input as {"STREET":"123 some street"}
-}
-
-test_column_name_starts_with_street if {
-    output.street_name == true with input as {"street_name":"123 some street"}
-}
-
-test_insensitive_column_name_starts_with_street if {
-    output.STREET_Name == true with input as {"STREET_Name":"123 some street"}
-}
-
-test_column_name_zip if {
-    output.zip == true with input as {"zip":"11111"}
-}
-
-test_insensitive_column_name_zip if {
-    output.ZIP == true with input as {"ZIP":"11111"}
-}
-
-test_column_name_zipcode if {
-    output.zipcode == true with input as {"zipcode":"11111"}
-}
-
-test_insensitive_column_name_zipcode if {
-    output.ZIPCODE == true with input as {"ZIPCODE":"11111"}
-}
diff --git a/classification/rego/age_test.rego b/classification/rego/age_test.rego
deleted file mode 100644
index 3f6810a..0000000
--- a/classification/rego/age_test.rego
+++ /dev/null
@@ -1,39 +0,0 @@
-package classifier_age
-
-import rego.v1
-
-test_no_label if {
-    output.column == false with input as {"column":"invalid"}
-}
-
-test_column_name_age_invalid_age if {
-    output.age == false with input as {"age":"120"}
-}
-
-test_insensitive_column_name_age_invalid if {
-    output.AGE == false with input as {"AGE":"120"}
-}
-
-test_column_name_age_single_digit if {
-    output.age == true with input as {"age":"1"}
-}
-
-test_insensitive_column_name_age_single_digit if {
-    output.AGE == true with input as {"AGE":"1"}
-}
-
-test_column_name_age_double_digit if {
-    output.age == true with input as {"age":"10"}
-}
-
-test_insensitive_column_name_age_double_digit if {
-    output.AGE == true with input as {"AGE":"10"}
-}
-
-test_column_name_age_triple_digit if {
-    output.age == true with input as {"age":"100"}
-}
-
-test_insensitive_column_name_age_triple_digit if {
-    output.AGE == true with input as {"AGE":"100"}
-}
diff --git a/classification/rego/ccn_test.rego b/classification/rego/ccn_test.rego
deleted file mode 100644
index b41dfb9..0000000
--- a/classification/rego/ccn_test.rego
+++ /dev/null
@@ -1,28 +0,0 @@
-package classifier_ccn
-
-import rego.v1
-
-test_no_label if {
-    output.column == false with input as {"column":"invalid"}
-}
-
-test_valid_amex_ccn if {
-    output.message == true with input as {"message":"370136066365291"}
-}
-
-test_valid_visa_ccn if {
-    output.message == true with input as {"message":"4613688275707134"}
-}
-
-test_valid_mastercard_ccn if {
-    output.message == true with input as {"message":"5423909386888564"}
-}
-
-# TODO : Fix pattern to match
-test_valid_mastercard_ccn if {
-    output.message == true with input as {"message":"2701306282695666"}
-}
-
-test_valid_discover_ccn if {
-    output.message == true with input as {"message":"6536673682309236"}
-}
diff --git a/classification/rego/cvv_test.rego b/classification/rego/cvv_test.rego
deleted file mode 100644
index a947863..0000000
--- a/classification/rego/cvv_test.rego
+++ /dev/null
@@ -1,31 +0,0 @@
-package classifier_cvv
-
-import rego.v1
-
-test_cvv_key if {
-	output.CVV == true with input as {"CVV":"test"}
-}
-
-test_cvv_key if {
-	output.cvv == true with input as {"cvv":"test"}
-}
-
-test_cvv_key if {
-	output.CvV == true with input as {"CvV":"test"}
-}
-
-test_cvv_pattern if {
-	output.message == true with input as {"message":"451"}
-}
-
-test_cvv_pattern if {
-	output.message == true with input as {"message":"5061"}
-}
-
-test_cvv_pattern if {
-	output.message == true with input as {"message":"123"}
-}
-
-test_cvv_pattern if {
-	output.message == false with input as {"message":"12345"}
-}
diff --git a/classification/rego/dob_test.rego b/classification/rego/dob_test.rego
deleted file mode 100644
index dfaab5a..0000000
--- a/classification/rego/dob_test.rego
+++ /dev/null
@@ -1,112 +0,0 @@
-package classifier_dob
-
-import rego.v1
-
-test_dob_key if {
-	output.dob == true with input as {"dob":"test"}
-}
-
-test_dob_key if {
-	output.DOB == true with input as {"DOB":"test"}
-}
-
-test_dob_key if {
-	output.DoB == true with input as {"DoB":"test"}
-}
-
-test_dob_key if {
-	output.birthdate == true with input as {"birthdate":"test"}
-}
-
-test_dob_key if {
-	output.BirthDate == true with input as {"BirthDate":"test"}
-}
-
-test_dob_key if {
-	output.dateofbirth == true with input as {"dateofbirth":"test"}
-}
-
-test_dob_key if {
-	output.DateOfBirth == true with input as {"DateOfBirth":"test"}
-}
-
-test_dob_key if {
-	output.birthdate == true with input as {"birthdate":"test"}
-}
-
-test_dob_key if {
-	output.birth_date == true with input as {"birth_date":"test"}
-}
-
-# mm/dd/yyyy
-
-test_dob_pattern if {
-	output.message == true with input as {"message":"01/01/1900"}
-}
-
-test_dob_pattern if {
-	output.message == true with input as {"message":"1-1-1900"}
-}
-
-test_dob_pattern if {
-	output.message == true with input as {"message":"10.01.1971"}
-}
-
-test_dob_pattern if {
-	output.message == true with input as {"message":"11/30/2023"}
-}
-
-# dd/mm/yyyy
-
-test_dob_pattern if {
-	output.message == true with input as {"message":"01/01/1900"}
-}
-
-test_dob_pattern if {
-	output.message == true with input as {"message":"1/1/1900"}
-}
-
-test_dob_pattern if {
-	output.message == true with input as {"message":"10/01/1971"}
-}
-
-test_dob_pattern if {
-	output.message == true with input as {"message":"30/11/2023"}
-}
-
-
-# yyyy/mm/dd
-
-test_dob_pattern if {
-	output.message == true with input as {"message":"1900/01/10"}
-}
-
-test_dob_pattern if {
-	output.message == true with input as {"message":"1900/1/1"}
-}
-
-test_dob_pattern if {
-	output.message == true with input as {"message":"1971/10/01"}
-}
-
-test_dob_pattern if {
-	output.message == true with input as {"message":"2023/12/31"}
-}
-
-# yyyy-mm-dd
-
-test_dob_pattern if {
-	output.message == true with input as {"message":"1900-01-10"}
-}
-
-test_dob_pattern if {
-	output.message == true with input as {"message":"1900-1-1"}
-}
-
-test_dob_pattern if {
-	output.message == true with input as {"message":"1971-10-01"}
-}
-
-test_dob_pattern if {
-	output.message == true with input as {"message":"2023-12-31"}
-}
diff --git a/classification/rego/email_test.rego b/classification/rego/email_test.rego
deleted file mode 100644
index 62d389e..0000000
--- a/classification/rego/email_test.rego
+++ /dev/null
@@ -1,15 +0,0 @@
-package classifier_email
-
-import rego.v1
-
-test_no_label if {
-    output.column == false with input as {"column":"invalid"}
-}
-
-test_valid_email_com if {
-    output.message == true with input as {"message":"me@me.com"}
-}
-
-test_valid_email_us if {
-    output.message == true with input as {"message":"me@state.pa.us"}
-}
diff --git a/classification/rego/first_name_test.rego b/classification/rego/first_name_test.rego
deleted file mode 100644
index b8d4b9d..0000000
--- a/classification/rego/first_name_test.rego
+++ /dev/null
@@ -1,51 +0,0 @@
-package classifier_first_name
-
-import rego.v1
-
-test_fn_pattern if {
-	output.first_name == true with input as {"first_name":"John"}
-}
-
-test_fn_pattern if {
-	output.first_name == true with input as {"first_name":"Robert"}
-}
-
-test_fn_pattern if {
-	output.firstname == true with input as {"firstname":"Robert"}
-}
-
-test_fn_pattern if {
-	output.firstName == true with input as {"firstName":"Robert"}
-}
-
-test_fn_pattern if {
-	output.First_Name == true with input as {"First_Name":"Robert"}
-}
-
-test_fn_pattern if {
-	output.FirstName == true with input as {"FirstName":"Robert"}
-}
-
-test_gn_pattern if {
-	output.given_name == true with input as {"given_name":"John"}
-}
-
-test_gn_pattern if {
-	output.given_name == true with input as {"given_name":"Robert"}
-}
-
-test_gn_pattern if {
-	output.givenname == true with input as {"givenname":"Robert"}
-}
-
-test_gn_pattern if {
-	output.givenName == true with input as {"givenName":"Robert"}
-}
-
-test_gn_pattern if {
-	output.Given_Name == true with input as {"Given_Name":"Robert"}
-}
-
-test_gn_pattern if {
-	output.GivenName == true with input as {"GivenName":"Robert"}
-}
diff --git a/classification/rego/full_name_test.rego b/classification/rego/full_name_test.rego
deleted file mode 100644
index 7c779db..0000000
--- a/classification/rego/full_name_test.rego
+++ /dev/null
@@ -1,27 +0,0 @@
-package classifier_full_name
-
-import rego.v1
-
-test_fn_pattern if {
-	output.full_name == true with input as {"full_name":"John"}
-}
-
-test_fn_pattern if {
-	output.full_name == true with input as {"full_name":"Robert"}
-}
-
-test_fn_pattern if {
-	output.fullname == true with input as {"fullname":"Robert"}
-}
-
-test_fn_pattern if {
-	output.fullName == true with input as {"fullName":"Robert"}
-}
-
-test_fn_pattern if {
-	output.Full_Name == true with input as {"Full_Name":"Robert"}
-}
-
-test_fn_pattern if {
-	output.FullName == true with input as {"FullName":"Robert"}
-}
diff --git a/classification/rego/ip_address.rego b/classification/rego/ip_address.rego
deleted file mode 100644
index 8c59316..0000000
--- a/classification/rego/ip_address.rego
+++ /dev/null
@@ -1,28 +0,0 @@
-package classifier_ip_address
-
-import rego.v1
-
-output[k] := v if {
-	some k in object.keys(input)
-	v := classify(k, input[k])
-}
-
-default classify(_, _) := false
-
-classify(key, val) if {
-	regex.match(`\d+\.\d+\.\d+\.\d+`, val)
-}
-
-classify(key, val) if {
-	regex.match(
-	    `\A(?:(?:[0-9A-Fa-f]{1,4}:){6}(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|::(?:[0-9A-Fa-f]{1,4}:){5}(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|(?:[0-9A-Fa-f]{1,4})?::(?:[0-9A-Fa-f]{1,4}:){4}(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4})?::(?:[0-9A-Fa-f]{1,4}:){3}(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|(?:(?:[0-9A-Fa-f]{1,4}:){,2}[0-9A-Fa-f]{1,4})?::(?:[0-9A-Fa-f]{1,4}:){2}(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|(?:(?:[0-9A-Fa-f]{1,4}:){,3}[0-9A-Fa-f]{1,4})?::[0-9A-Fa-f]{1,4}:(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|(?:(?:[0-9A-Fa-f]{1,4}:){,4}[0-9A-Fa-f]{1,4})?::(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|(?:(?:[0-9A-Fa-f]{1,4}:){,5}[0-9A-Fa-f]{1,4})?::[0-9A-Fa-f]{1,4}|(?:(?:[0-9A-Fa-f]{1,4}:){,6}[0-9A-Fa-f]{1,4})?::)\z`,
-	    val
-	)
-}
-
-classify(key, val) if {
-	regex.match(
-		`\A(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))\z`,
-		val
-	)
-}
diff --git a/classification/rego/ip_address_test.rego b/classification/rego/ip_address_test.rego
deleted file mode 100644
index 6c68bf1..0000000
--- a/classification/rego/ip_address_test.rego
+++ /dev/null
@@ -1,27 +0,0 @@
-package classifier_ip_address
-
-import rego.v1
-
-test_no_label if {
-    output.column == false with input as {"column":"invalid"}
-}
-
-test_ipv4_google if {
-    output.column == true with input as {"column":"8.8.8.8"}
-}
-
-test_ipv4_localhost if {
-    output.column == true with input as {"column":"127.0.0.1"}
-}
-
-test_ipv4_internal if {
-    output.column == true with input as {"column":"10.1.1.1"}
-}
-
-test_ipv6 if {
-    output.column == true with input as {"column":"2001:db8:3333:4444:5555:6666:7777:8888"}
-}
-
-test_ipv6_google if {
-    output.column == true with input as {"column":"2001:4860:4860::8888"}
-}
diff --git a/classification/rego/last_name_test.rego b/classification/rego/last_name_test.rego
deleted file mode 100644
index 77962d9..0000000
--- a/classification/rego/last_name_test.rego
+++ /dev/null
@@ -1,51 +0,0 @@
-package classifier_last_name
-
-import rego.v1
-
-test_ln_pattern if {
-	output.last_name == true with input as {"last_name":"John"}
-}
-
-test_ln_pattern if {
-	output.last_name == true with input as {"last_name":"Robert"}
-}
-
-test_ln_pattern if {
-	output.lastname == true with input as {"lastname":"Robert"}
-}
-
-test_ln_pattern if {
-	output.lastName == true with input as {"lastName":"Robert"}
-}
-
-test_ln_pattern if {
-	output.Last_Name == true with input as {"Last_Name":"Robert"}
-}
-
-test_ln_pattern if {
-	output.LastName == true with input as {"LastName":"Robert"}
-}
-
-test_sn_pattern if {
-	output.sur_name == true with input as {"sur_name":"John"}
-}
-
-test_sn_pattern if {
-	output.sur_name == true with input as {"sur_name":"Robert"}
-}
-
-test_sn_pattern if {
-	output.surname == true with input as {"surname":"Robert"}
-}
-
-test_sn_pattern if {
-	output.surName == true with input as {"surName":"Robert"}
-}
-
-test_sn_pattern if {
-	output.Sur_Name == true with input as {"Sur_Name":"Robert"}
-}
-
-test_sn_pattern if {
-	output.SurName == true with input as {"SurName":"Robert"}
-}
diff --git a/classification/rego/passport_test.rego b/classification/rego/passport_test.rego
deleted file mode 100644
index d8f3ba4..0000000
--- a/classification/rego/passport_test.rego
+++ /dev/null
@@ -1,67 +0,0 @@
-package classifier_passport
-
-import rego.v1
-
-test_passport_key if {
-	output.passport == true with input as {"passport":"not-a-passport-number"}
-}
-
-# United States
-test_passport_pattern if {
-	output.message == true with input as {"message":"A12345678"}
-}
-
-# Canada
-test_passport_pattern if {
-	output.message == true with input as {"message":"G12345678"}
-}
-
-# United Kingdom
-test_passport_pattern if {
-	output.message == true with input as {"message":"GH1234567"}
-}
-
-# Australia
-test_passport_pattern if {
-	output.message == true with input as {"message":"P12345678"}
-}
-
-# India
-test_passport_pattern if {
-	output.message == true with input as {"message":"P1234567"}
-}
-
-# Germany
-test_passport_pattern if {
-	output.message == true with input as {"message":"E12345678"}
-}
-
-# China
-test_passport_pattern if {
-	output.message == true with input as {"message":"E123456789"}
-}
-
-# Japan
-test_passport_pattern if {
-	output.message == true with input as {"message":"P1234567"}
-}
-
-# South Korea
-test_passport_pattern if {
-	output.message == true with input as {"message":"M12345678"}
-}
-
-# Brazil
-test_passport_pattern if {
-	output.message == true with input as {"message":"G12345678"}
-}
-
-# Mexico
-test_passport_pattern if {
-	output.message == true with input as {"message":"E12345678"}
-}
-
-# South Africa (diplomat, standard covered by other countries)
-test_passport_sa_pattern if {
-	output.message == true with input as {"message":"D123456789"}
-}
diff --git a/classification/rego/phone_test.rego b/classification/rego/phone_test.rego
deleted file mode 100644
index 8aa04ea..0000000
--- a/classification/rego/phone_test.rego
+++ /dev/null
@@ -1,15 +0,0 @@
-package classifier_phone_number
-
-import rego.v1
-
-test_no_label if {
-    output.column == false with input as {"column":"invalid"}
-}
-
-test_valid_us_phone if {
-    output.message == true with input as {"message":"7175551212"}
-}
-
-test_valid_us_phone if {
-    output.message == true with input as {"message":"17175551212"}
-}
diff --git a/classification/rego/ssn_test.rego b/classification/rego/ssn_test.rego
deleted file mode 100644
index ba776c2..0000000
--- a/classification/rego/ssn_test.rego
+++ /dev/null
@@ -1,75 +0,0 @@
-package classifier_ssn
-
-import rego.v1
-
-test_no_label if {
-    output.column == false with input as {"column":"invalid"}
-}
-
-test_invalid_first_000 if {
-    output.column == false with input as {"column":"000123456"}
-}
-
-test_invalid_first_666 if {
-    output.column == false with input as {"column":"666123456"}
-}
-
-test_invalid_first_900s if {
-    output.column == false with input as {"column":"905123456"}
-}
-
-test_invalid_middle if {
-    output.column == false with input as {"column":"123006789"}
-}
-
-test_invalid_end if {
-    output.column == false with input as {"column":"123450000"}
-}
-
-test_ssn_on_valid_amex_ccn if {
-    output.message == false with input as {"message":"370136066365291"}
-}
-
-test_ssn_on_valid_amex_ccn if {
-    output.message == false with input as {"message":"370136066365291"}
-}
-
-test_ssn_on_valid_visa_ccn if {
-    output.message == false with input as {"message":"4613688275707134"}
-}
-
-test_ssn_on_valid_mastercard_format_1_ccn if {
-    output.message == false with input as {"message":"5423909386888564"}
-}
-
-test_ssn_on_valid_mastercard_format_2_ccn if {
-    output.message == false with input as {"message":"2701306282695666"}
-}
-
-test_ssn_on_valid_discover_ccn if {
-    output.message == false with input as {"message":"6536673682309236"}
-}
-
-test_valid_ssn_dashes if {
-    output.message == true with input as {"message":"111-11-1111"}
-}
-
-test_valid_ssn_dashes_sequential if {
-    output.message == true with input as {"message":"123-45-6789"}
-}
-
-test_valid_ssn_dashes_in_value if {
-    output.message == true with input as {"message":"this has a ssn 111-11-1111 that is valid"}
-}
-
-test_valid_ssn_no_dashes if {
-    output.message == true with input as {"message":"111111111"}
-}
-
-test_valid_ssn_no_dashes_sequential if {
-    output.message == true with input as {"message":"123456789"}
-}
-
-test_valid_ssn_no_dashes_in_value if {
-    output.message == true with input as {"message":"this has a ssn 111111111 that is valid"}
-}
diff --git a/cmd/repo_scan.go b/cmd/repo_scan.go
index cbd88fe..13567ce 100644
--- a/cmd/repo_scan.go
+++ b/cmd/repo_scan.go
@@ -12,7 +12,7 @@ type RepoScanCmd struct {
 }
 
 func (cmd *RepoScanCmd) Run(_ *Globals) error {
-	craw := discovery.NewScanner(&cmd.Config)
-	defer craw.Cleanup()
-	return craw.InitAndRun(context.Background())
+	scanner := discovery.NewScanner(&cmd.Config)
+	defer scanner.Cleanup()
+	return scanner.InitAndRun(context.Background())
 }
diff --git a/discovery/config/config.go b/discovery/config/config.go
index 5bdd28a..6ffa7aa 100644
--- a/discovery/config/config.go
+++ b/discovery/config/config.go
@@ -9,6 +9,8 @@ import (
 	"github.com/gobwas/glob"
 )
 
+const configConnOpts = "connection-string-args"
+
 // Config is the configuration for the application.
 type Config struct {
 	Dmap DmapConfig `embed:""`
@@ -58,3 +60,131 @@ func (g GlobFlag) Decode(ctx *kong.DecodeContext) error {
 	ctx.Value.Target.Set(reflect.ValueOf(GlobFlag(parsedPatterns)))
 	return nil
 }
+
+// BuildConnOptsStr parses the repo config to produce a string in the format
+// "?option=value&option2=value2". Example:
+//
+//	BuildConnOptsStr(config.RepoConfig{
+//	    Advanced: map[string]any{
+//	        "connection-string-args": []any{"sslmode=disable"},
+//	    },
+//	})
+//
+// returns ("?sslmode=disable", nil).
+func BuildConnOptsStr(cfg RepoConfig) (string, error) {
+	connOptsMap, err := mapFromConnOpts(cfg)
+	if err != nil {
+		return "", fmt.Errorf("connection options: %w", err)
+	}
+
+	connOptsStr := ""
+	for key, val := range connOptsMap {
+		// Don't add if the value is empty, since that would make the
+		// string malformed.
+		if val != "" {
+			if connOptsStr == "" {
+				connOptsStr += fmt.Sprintf("%s=%s", key, val)
+			} else {
+				// Need & for subsequent options
+				connOptsStr += fmt.Sprintf("&%s=%s", key, val)
+			}
+		}
+	}
+	// Only add ? if connection string is not empty
+	if connOptsStr != "" {
+		connOptsStr = "?" + connOptsStr
+	}
+
+	return connOptsStr, nil
+}
+
+// FetchAdvancedConfigString fetches a map in the repo advanced configuration,
+// for a given repo and set of parameters. Example:
+//
+// repo-advanced:
+//
+//	snowflake:
+//	  account: exampleAccount
+//	  role: exampleRole
+//	  warehouse: exampleWarehouse
+//
+// Calling FetchAdvancedMapConfig(<the repo config above>, "snowflake",
+// []string{"account", "role", "warehouse"}) returns the map
+//
+// {"account": "exampleAccount", "role": "exampleRole", "warehouse":
+// "exampleWarehouse"}
+//
+// The suffix 'String' means that the values of the map are strings. This gives
+// room to have FetchAdvancedConfigList or FetchAdvancedConfigMap, for example,
+// without name conflicts.
+func FetchAdvancedConfigString(
+	cfg RepoConfig,
+	repo string,
+	parameters []string,
+) (map[string]string, error) {
+	advancedCfg, err := getAdvancedConfig(cfg, repo)
+	if err != nil {
+		return nil, err
+	}
+	repoSpecificMap := make(map[string]string)
+	for _, key := range parameters {
+		var valInterface any
+		var val string
+		var ok bool
+		if valInterface, ok = advancedCfg[key]; !ok {
+			return nil, fmt.Errorf("unable to find '%s' in %s advanced config", key, repo)
+		}
+		if val, ok = valInterface.(string); !ok {
+			return nil, fmt.Errorf("'%s' in %s config must be a string", key, repo)
+		}
+		repoSpecificMap[key] = val
+	}
+	return repoSpecificMap, nil
+}
+
+// mapFromConnOpts builds a map from the list of connection options given in the
+// config. Each option has the format 'option=value'. Err only if the config is
+// malformed, to inform user.
+func mapFromConnOpts(cfg RepoConfig) (map[string]string, error) {
+	m := make(map[string]string)
+	connOptsInterface, ok := cfg.Advanced[configConnOpts]
+	if !ok {
+		return nil, nil
+	}
+	connOpts, ok := connOptsInterface.([]any)
+	if !ok {
+		return nil, fmt.Errorf("'%s' is not a list", configConnOpts)
+	}
+	for _, optInterface := range connOpts {
+		opt, ok := optInterface.(string)
+		if !ok {
+			return nil, fmt.Errorf("'%v' is not a string", optInterface)
+		}
+		splitOpt := strings.Split(opt, "=")
+		if len(splitOpt) != 2 {
+			return nil, fmt.Errorf(
+				"malformed '%s'. "+
+					"Please follow the format 'option=value'", configConnOpts,
+			)
+		}
+		key := splitOpt[0]
+		val := splitOpt[1]
+		m[key] = val
+	}
+	return m, nil
+}
+
+// getAdvancedConfig gets the Advanced field in a repo config and converts it to
+// a map[string]any. In every step, it checks for error and generates
+// nice messages.
+func getAdvancedConfig(cfg RepoConfig, repo string) (map[string]any, error) {
+	advancedCfgInterface, ok := cfg.Advanced[repo]
+	if !ok {
+		return nil, fmt.Errorf("unable to find '%s' in advanced config", repo)
+	}
+	advancedCfg, ok := advancedCfgInterface.(map[string]any)
+	if !ok {
+		return nil, fmt.Errorf("'%s' in advanced config is not a map", repo)
+	}
+	return advancedCfg, nil
+}
diff --git a/discovery/config/util_test.go b/discovery/config/config_test.go
similarity index 63%
rename from discovery/config/util_test.go
rename to discovery/config/config_test.go
index 743c785..63a5007 100644
--- a/discovery/config/util_test.go
+++ b/discovery/config/config_test.go
@@ -6,34 +6,6 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-func TestUtil(t *testing.T) {
-	for scenario, fn := range map[string]func(
-		t *testing.T,
-	){
-		"build connection string succeeds":                            testBuildConnOptionsSucc,
-		"build connection string fails":                               testBuildConnOptionsFail,
-		"build map from correct connection options succeeds":          testMapConnOptionsSucc,
-		"build map from missing connection options does not err":      testMapConnOptionsMissing,
-		"build map from non-list connection options fails":            testMapConnOptionsMalformedMap,
-		"build map from malformed (non-'=') connection options fails": testMapConnOptionsMalformedColon,
-		"fetch correct advanced config succeeds":                      testAdvancedConfigSucc,
-		"fetch advanced config with missing parameter errs":           testAdvancedConfigMissing,
-		"fetch advanced config with malformed parameters errs":        testAdvancedConfigMalformed,
-	} {
-		t.Run(
-			scenario, func(t *testing.T) {
-				teardown := setupTest(t)
-				defer teardown()
-				fn(t)
-			},
-		)
-	}
-}
-
-func setupTest(t *testing.T) func() {
-	return func() {}
-}
-
 // Returns a correct repo config
 func getSampleRepoConfig() RepoConfig {
 	return RepoConfig{
@@ -43,14 +15,14 @@ func getSampleRepoConfig() RepoConfig {
 	}
 }
 
-func testBuildConnOptionsSucc(t *testing.T) {
+func TestBuildConnOptionsSucc(t *testing.T) {
 	sampleRepoCfg := getSampleRepoConfig()
 	connOptsStr, err := BuildConnOptsStr(sampleRepoCfg)
 	require.NoError(t, err)
 	require.Equal(t, connOptsStr, "?sslmode=disable")
 }
 
-func testBuildConnOptionsFail(t *testing.T) {
+func TestBuildConnOptionsFail(t *testing.T) {
 	invalidRepoCfg := RepoConfig{
 		Advanced: map[string]any{
 			// Invalid: map instead of string
@@ -64,9 +36,9 @@ func testBuildConnOptionsFail(t *testing.T) {
 	require.Empty(t, connOptsStr)
 }
 
-func testMapConnOptionsSucc(t *testing.T) {
+func TestMapConnOptionsSucc(t *testing.T) {
 	sampleRepoCfg := getSampleRepoConfig()
-	connOptsMap, err := MapFromConnOpts(sampleRepoCfg)
+	connOptsMap, err := mapFromConnOpts(sampleRepoCfg)
 	require.NoError(t, err)
 	require.EqualValues(
 		t, connOptsMap, map[string]string{
@@ -76,14 +48,14 @@ func testMapConnOptionsSucc(t *testing.T) {
 }
 
 // The mapping should only fail if the config is malformed, not if it is missing
-func testMapConnOptionsMissing(t *testing.T) {
+func TestMapConnOptionsMissing(t *testing.T) {
 	sampleCfg := RepoConfig{}
-	optsMap, err := MapFromConnOpts(sampleCfg)
+	optsMap, err := mapFromConnOpts(sampleCfg)
 	require.NoError(t, err)
 	require.Empty(t, optsMap)
 }
 
-func testMapConnOptionsMalformedMap(t *testing.T) {
+func TestMapConnOptionsMalformedMap(t *testing.T) {
 	sampleCfg := RepoConfig{
 		Advanced: map[string]any{
 			// Let's put a map instead of the required list
@@ -92,22 +64,22 @@ func testMapConnOptionsMalformedMap(t *testing.T) {
 			},
 		},
 	}
-	_, err := MapFromConnOpts(sampleCfg)
+	_, err := mapFromConnOpts(sampleCfg)
 	require.Error(t, err)
 }
 
-func testMapConnOptionsMalformedColon(t *testing.T) {
+func TestMapConnOptionsMalformedColon(t *testing.T) {
 	sampleCfg := RepoConfig{
 		Advanced: map[string]any{
 			// Let's use a colon instead of '=' to divide options
 			configConnOpts: []string{"sslmode:disable"},
 		},
 	}
-	_, err := MapFromConnOpts(sampleCfg)
+	_, err := mapFromConnOpts(sampleCfg)
 	require.Error(t, err)
 }
 
-func testAdvancedConfigSucc(t *testing.T) {
+func TestAdvancedConfigSucc(t *testing.T) {
 	sampleCfg := RepoConfig{
 		Advanced: map[string]any{
 			"snowflake": map[string]any{
@@ -131,7 +103,7 @@ func testAdvancedConfigSucc(t *testing.T) {
 	)
 }
 
-func testAdvancedConfigMissing(t *testing.T) {
+func TestAdvancedConfigMissing(t *testing.T) {
 	// Without the snowflake config at all
 	sampleCfg := RepoConfig{
 		Advanced: map[string]any{},
@@ -159,7 +131,7 @@ func testAdvancedConfigMissing(t *testing.T) {
 	require.Error(t, err)
 }
 
-func testAdvancedConfigMalformed(t *testing.T) {
+func TestAdvancedConfigMalformed(t *testing.T) {
 	sampleCfg := RepoConfig{
 		Advanced: map[string]any{
 			"snowflake": map[string]any{
diff --git a/discovery/config/util.go b/discovery/config/util.go
deleted file mode 100644
index 9ce32bd..0000000
--- a/discovery/config/util.go
+++ /dev/null
@@ -1,138 +0,0 @@
-package config
-
-import (
-	"fmt"
-	"strings"
-)
-
-const (
-	configConnOpts = "connection-string-args"
-)
-
-// BuildConnOptsStr parses the repo config to produce a string in the format
-// "?option=value&option2=value2". Example:
-//
-//	BuildConnOptsStr(config.RepoConfig{
-//	    Advanced: map[string]any{
-//	        "connection-string-args": []any{"sslmode=disable"},
-//	    },
-//	})
-//
-// returns ("?sslmode=disable", nil).
-func BuildConnOptsStr(cfg RepoConfig) (string, error) {
-	connOptsMap, err := MapFromConnOpts(cfg)
-	if err != nil {
-		return "", fmt.Errorf("connection options: %w", err)
-	}
-
-	connOptsStr := ""
-	for key, val := range connOptsMap {
-		// Don't add if the value is empty, since that would make the
-		// string malformed.
-		if val != "" {
-			if connOptsStr == "" {
-				connOptsStr += fmt.Sprintf("%s=%s", key, val)
-			} else {
-				// Need & for subsequent options
-				connOptsStr += fmt.Sprintf("&%s=%s", key, val)
-			}
-		}
-	}
-	// Only add ? if connection string is not empty
-	if connOptsStr != "" {
-		connOptsStr = "?" + connOptsStr
-	}
-
-	return connOptsStr, nil
-}
-
-// MapFromConnOpts builds a map from the list of connection options given in the
-// config. Each option has the format 'option=value'. Err only if the config is
-// malformed, to inform user.
-func MapFromConnOpts(cfg RepoConfig) (map[string]string, error) {
-	m := make(map[string]string)
-	connOptsInterface, ok := cfg.Advanced[configConnOpts]
-	if !ok {
-		return nil, nil
-	}
-	connOpts, ok := connOptsInterface.([]any)
-	if !ok {
-		return nil, fmt.Errorf("'%s' is not a list", configConnOpts)
-	}
-	for _, optInterface := range connOpts {
-		opt, ok := optInterface.(string)
-		if !ok {
-			return nil, fmt.Errorf("'%v' is not a string", optInterface)
-		}
-		splitOpt := strings.Split(opt, "=")
-		if len(splitOpt) != 2 {
-			return nil, fmt.Errorf(
-				"malformed '%s'. "+
-					"Please follow the format 'option=value'", configConnOpts,
-			)
-		}
-		key := splitOpt[0]
-		val := splitOpt[1]
-		m[key] = val
-	}
-	return m, nil
-}
-
-// FetchAdvancedConfigString fetches a map in the repo advanced configuration,
-// for a given repo and set of parameters. Example:
-//
-// repo-advanced:
-//
-//	snowflake:
-//	  account: exampleAccount
-//	  role: exampleRole
-//	  warehouse: exampleWarehouse
-//
-// Calling FetchAdvancedMapConfig(<the repo config above>, "snowflake",
-// []string{"account", "role", "warehouse"}) returns the map
-//
-// {"account": "exampleAccount", "role": "exampleRole", "warehouse":
-// "exampleWarehouse"}
-//
-// The suffix 'String' means that the values of the map are strings. This gives
-// room to have FetchAdvancedConfigList or FetchAdvancedConfigMap, for example,
-// without name conflicts.
-func FetchAdvancedConfigString(
-	cfg RepoConfig,
-	repo string,
-	parameters []string,
-) (map[string]string, error) {
-	advancedCfg, err := getAdvancedConfig(cfg, repo)
-	if err != nil {
-		return nil, err
-	}
-	repoSpecificMap := make(map[string]string)
-	for _, key := range parameters {
-		var valInterface any
-		var val string
-		var ok bool
-		if valInterface, ok = advancedCfg[key]; !ok {
-			return nil, fmt.Errorf("unable to find '%s' in %s advanced config", key, repo)
-		}
-		if val, ok = valInterface.(string); !ok {
-			return nil, fmt.Errorf("'%s' in %s config must be a string", key, repo)
-		}
-		repoSpecificMap[key] = val
-	}
-	return repoSpecificMap, nil
-}
-
-// getAdvancedConfig gets the Advanced field in a repo config and converts it to
-// a map[string]any. In every step, it checks for error and generates
-// nice messages.
-func getAdvancedConfig(cfg RepoConfig, repo string) (map[string]any, error) {
-	advancedCfgInterface, ok := cfg.Advanced[repo]
-	if !ok {
-		return nil, fmt.Errorf("unable to find '%s' in advanced config", repo)
-	}
-	advancedCfg, ok := advancedCfgInterface.(map[string]any)
-	if !ok {
-		return nil, fmt.Errorf("'%s' in advanced config is not a map", repo)
-	}
-	return advancedCfg, nil
-}

From 11a1d59f63b4349d2e2818220b22dcde59c5e5d3 Mon Sep 17 00:00:00 2001
From: Chris Campo <ccampo133@users.noreply.github.com>
Date: Tue, 2 Apr 2024 09:44:41 -0400
Subject: [PATCH 07/14] Repository refactoring

---
 classification/classification.go              |   2 +-
 classification/classification_test.go         |  18 +-
 cmd/repo_scan.go                              |   9 +-
 discovery/config/config.go                    |  14 +-
 discovery/repository/denodo/denodo.go         | 121 ------------
 discovery/repository/doc.go                   |  15 --
 discovery/repository/genericsql/util.go       |  35 ----
 discovery/repository/mysql/mysql.go           | 104 ----------
 discovery/repository/oracle/config.go         |  27 ---
 discovery/repository/oracle/oracle.go         | 132 -------------
 discovery/repository/oracle/oracle_test.go    |  86 --------
 discovery/repository/postgresql/config.go     |  22 ---
 discovery/repository/postgresql/postgresql.go | 110 -----------
 discovery/repository/redshift/redshift.go     | 101 ----------
 .../repository/redshift/redshift_test.go      |  32 ---
 discovery/repository/repository.go            |  80 --------
 discovery/repository/snowflake/config.go      |  36 ----
 discovery/repository/snowflake/snowflake.go   | 107 ----------
 discovery/repository/sqlserver/sqlserver.go   | 107 ----------
 discovery/scanner.go                          | 156 +++++++--------
 discovery/sql/denodo.go                       | 109 +++++++++++
 discovery/sql/doc.go                          |  15 ++
 discovery/{repository => sql}/gen.go          |   2 +-
 .../genericsql.go => sql/generic.go}          | 185 +++++++++++-------
 .../generic_test.go}                          |  40 ++--
 discovery/{repository => sql}/metadata.go     |  12 +-
 .../{repository => sql}/metadata_test.go      |   2 +-
 .../mock_repository_test.go                   |   4 +-
 discovery/sql/mysql.go                        |  95 +++++++++
 .../{repository/mysql => sql}/mysql_test.go   |  16 +-
 discovery/sql/oracle.go                       | 139 +++++++++++++
 discovery/sql/postgres.go                     | 122 ++++++++++++
 .../postgres_test.go}                         |  16 +-
 discovery/sql/redshift.go                     |  94 +++++++++
 discovery/sql/redshift_test.go                |  29 +++
 discovery/sql/registry.go                     | 133 +++++++++++++
 discovery/sql/repository.go                   |  36 ++++
 .../{repository => sql}/repository_test.go    |   2 +-
 .../sample_all_databases_test.go              |   2 +-
 .../sample_repository_test.go                 |   2 +-
 discovery/{repository => sql}/sampling.go     |   6 +-
 .../{repository => sql}/sampling_test.go      |   2 +-
 discovery/sql/snowflake.go                    | 125 ++++++++++++
 .../snowflake => sql}/snowflake_test.go       |  16 +-
 discovery/sql/sqlserver.go                    |  95 +++++++++
 .../sqlserver => sql}/sqlserver_test.go       |  28 ++-
 46 files changed, 1261 insertions(+), 1380 deletions(-)
 delete mode 100644 discovery/repository/denodo/denodo.go
 delete mode 100644 discovery/repository/doc.go
 delete mode 100644 discovery/repository/genericsql/util.go
 delete mode 100644 discovery/repository/mysql/mysql.go
 delete mode 100644 discovery/repository/oracle/config.go
 delete mode 100644 discovery/repository/oracle/oracle.go
 delete mode 100644 discovery/repository/oracle/oracle_test.go
 delete mode 100644 discovery/repository/postgresql/config.go
 delete mode 100644 discovery/repository/postgresql/postgresql.go
 delete mode 100644 discovery/repository/redshift/redshift.go
 delete mode 100644 discovery/repository/redshift/redshift_test.go
 delete mode 100644 discovery/repository/repository.go
 delete mode 100644 discovery/repository/snowflake/config.go
 delete mode 100644 discovery/repository/snowflake/snowflake.go
 delete mode 100644 discovery/repository/sqlserver/sqlserver.go
 create mode 100644 discovery/sql/denodo.go
 create mode 100644 discovery/sql/doc.go
 rename discovery/{repository => sql}/gen.go (90%)
 rename discovery/{repository/genericsql/genericsql.go => sql/generic.go} (53%)
 rename discovery/{repository/genericsql/genericsql_test.go => sql/generic_test.go} (87%)
 rename discovery/{repository => sql}/metadata.go (87%)
 rename discovery/{repository => sql}/metadata_test.go (98%)
 rename discovery/{repository => sql}/mock_repository_test.go (97%)
 create mode 100644 discovery/sql/mysql.go
 rename discovery/{repository/mysql => sql}/mysql_test.go (50%)
 create mode 100644 discovery/sql/oracle.go
 create mode 100644 discovery/sql/postgres.go
 rename discovery/{repository/postgresql/postgresql_test.go => sql/postgres_test.go} (50%)
 create mode 100644 discovery/sql/redshift.go
 create mode 100644 discovery/sql/redshift_test.go
 create mode 100644 discovery/sql/registry.go
 create mode 100644 discovery/sql/repository.go
 rename discovery/{repository => sql}/repository_test.go (99%)
 rename discovery/{repository => sql}/sample_all_databases_test.go (99%)
 rename discovery/{repository => sql}/sample_repository_test.go (99%)
 rename discovery/{repository => sql}/sampling.go (97%)
 rename discovery/{repository => sql}/sampling_test.go (98%)
 create mode 100644 discovery/sql/snowflake.go
 rename discovery/{repository/snowflake => sql}/snowflake_test.go (50%)
 create mode 100644 discovery/sql/sqlserver.go
 rename discovery/{repository/sqlserver => sql}/sqlserver_test.go (50%)

diff --git a/classification/classification.go b/classification/classification.go
index 5b7bc31..1e481dd 100644
--- a/classification/classification.go
+++ b/classification/classification.go
@@ -67,7 +67,7 @@ func (c Result) Merge(other Result) {
 // unique classification results for a given sample set.
 func ClassifySamples(
 	ctx context.Context,
-	samples []repository.Sample,
+	samples []sql.Sample,
 	classifier Classifier,
 ) ([]ClassifiedTable, error) {
 	tables := make([]ClassifiedTable, 0, len(samples))
diff --git a/classification/classification_test.go b/classification/classification_test.go
index 69ca3c1..f709be7 100644
--- a/classification/classification_test.go
+++ b/classification/classification_test.go
@@ -63,16 +63,16 @@ func TestMerge_WhenCalledWithExistingAttributes_ShouldOverwrite(t *testing.T) {
 
 func TestClassifySamples_SingleTable(t *testing.T) {
 	ctx := context.Background()
-	meta := repository.SampleMetadata{
+	meta := sql.SampleMetadata{
 		Repo:     "repo",
 		Database: "db",
 		Schema:   "schema",
 		Table:    "table",
 	}
 
-	sample := repository.Sample{
+	sample := sql.Sample{
 		Metadata: meta,
-		Results: []repository.SampleResult{
+		Results: []sql.SampleResult{
 			{
 				"age":             "52",
 				"social_sec_num":  "512-23-4258",
@@ -136,7 +136,7 @@ func TestClassifySamples_SingleTable(t *testing.T) {
 			},
 		},
 	}
-	actual, err := ClassifySamples(ctx, []repository.Sample{sample}, classifier)
+	actual, err := ClassifySamples(ctx, []sql.Sample{sample}, classifier)
 	require.NoError(t, err)
 	require.Len(t, actual, len(expected))
 	for i := range actual {
@@ -146,23 +146,23 @@ func TestClassifySamples_SingleTable(t *testing.T) {
 
 func TestClassifySamples_MultipleTables(t *testing.T) {
 	ctx := context.Background()
-	meta1 := repository.SampleMetadata{
+	meta1 := sql.SampleMetadata{
 		Repo:     "repo1",
 		Database: "db1",
 		Schema:   "schema1",
 		Table:    "table1",
 	}
-	meta2 := repository.SampleMetadata{
+	meta2 := sql.SampleMetadata{
 		Repo:     "repo2",
 		Database: "db2",
 		Schema:   "schema2",
 		Table:    "table2",
 	}
 
-	samples := []repository.Sample{
+	samples := []sql.Sample{
 		{
 			Metadata: meta1,
-			Results: []repository.SampleResult{
+			Results: []sql.SampleResult{
 				{
 					"age":             "52",
 					"social_sec_num":  "512-23-4258",
@@ -177,7 +177,7 @@ func TestClassifySamples_MultipleTables(t *testing.T) {
 		},
 		{
 			Metadata: meta2,
-			Results: []repository.SampleResult{
+			Results: []sql.SampleResult{
 				{
 					"fullname": "John Doe",
 					"dob":      "2000-01-01",
diff --git a/cmd/repo_scan.go b/cmd/repo_scan.go
index 13567ce..a4e97a8 100644
--- a/cmd/repo_scan.go
+++ b/cmd/repo_scan.go
@@ -2,6 +2,7 @@ package main
 
 import (
 	"context"
+	"fmt"
 
 	"github.com/cyralinc/dmap/discovery"
 	"github.com/cyralinc/dmap/discovery/config"
@@ -12,7 +13,11 @@ type RepoScanCmd struct {
 }
 
 func (cmd *RepoScanCmd) Run(_ *Globals) error {
-	scanner := discovery.NewScanner(&cmd.Config)
+	ctx := context.Background()
+	scanner, err := discovery.NewScanner(ctx, &cmd.Config)
+	if err != nil {
+		return fmt.Errorf("error creating new scanner: %w", err)
+	}
 	defer scanner.Cleanup()
-	return scanner.InitAndRun(context.Background())
+	return scanner.Scan(ctx)
 }
diff --git a/discovery/config/config.go b/discovery/config/config.go
index 6ffa7aa..d974b2f 100644
--- a/discovery/config/config.go
+++ b/discovery/config/config.go
@@ -24,16 +24,16 @@ type DmapConfig struct {
 	ClientSecret string `help:"API client secret to access the Dmap API."` //#nosec G101 -- false positive
 }
 
-// RepoConfig is the necessary configuration to connect to a data repository.
+// RepoConfig is the necessary configuration to connect to a data sql.
 type RepoConfig struct {
 	Type         string         `help:"Type of repository to connect to (postgres|mysql|oracle|sqlserver|snowflake|redshift|denodo)." enum:"postgres,mysql,oracle,sqlserver,snowflake,redshift,denodo" required:""`
-	Host         string         `help:"Hostname of the repository." required:""`
-	Port         uint16         `help:"Port of the repository." required:""`
-	User         string         `help:"Username to connect to the repository." required:""`
-	Password     string         `help:"Password to connect to the repository." required:""`
-	Advanced     map[string]any `help:"Advanced configuration for the repository."`
+	Host         string         `help:"Hostname of the sql." required:""`
+	Port         uint16         `help:"Port of the sql." required:""`
+	User         string         `help:"Username to connect to the sql." required:""`
+	Password     string         `help:"Password to connect to the sql." required:""`
+	Advanced     map[string]any `help:"Advanced configuration for the sql."`
 	Database     string         `help:"Name of the database to connect to. If not specified, the default database is used."`
-	MaxOpenConns uint           `help:"Maximum number of open connections to the repository." default:"10"`
+	MaxOpenConns uint           `help:"Maximum number of open connections to the sql." default:"10"`
 	SampleSize   uint           `help:"Number of rows to sample from the repository (per table)." default:"5"`
 	IncludePaths GlobFlag       `help:"List of glob patterns to include when querying the database(s), as a comma separated list." default:"*"`
 	ExcludePaths GlobFlag       `help:"List of glob patterns to exclude when querying the database(s), as a comma separated list." default:""`
diff --git a/discovery/repository/denodo/denodo.go b/discovery/repository/denodo/denodo.go
deleted file mode 100644
index 907ccdf..0000000
--- a/discovery/repository/denodo/denodo.go
+++ /dev/null
@@ -1,121 +0,0 @@
-package denodo
-
-import (
-	"context"
-	"errors"
-	"fmt"
-
-	"github.com/cyralinc/dmap/discovery/repository"
-	"github.com/cyralinc/dmap/discovery/repository/genericsql"
-	"github.com/cyralinc/dmap/discovery/repository/postgresql"
-
-	"github.com/cyralinc/dmap/discovery/config"
-
-	// Use PostgreSQL driver for Denodo
-	_ "github.com/lib/pq"
-)
-
-const (
-	RepoTypeDenodo = "denodo"
-
-	// IntrospectQuery is the SQL query used to introspect the database. For
-	// Denodo, the object hierarchy is (database > views). When querying
-	// Denodo, the database corresponds to a schema, and the view corresponds
-	// to a table (see SampleTable).
-	IntrospectQuery = "SELECT " +
-		"database_name AS table_schema, " +
-		"view_name AS table_name, " +
-		"column_name, " +
-		"column_type_name AS data_type " +
-		"FROM " +
-		"CATALOG_VDP_METADATA_VIEWS()"
-)
-
-// Repository is a repository.Repository implementation for Denodo.
-type Repository struct {
-	// The majority of the repository.Repository functionality is delegated to
-	// a generic SQL repository instance (genericSqlRepo).
-	genericSqlRepo *genericsql.Repository
-}
-
-// Repository implements repository.Repository
-var _ repository.Repository = (*Repository)(nil)
-
-// NewRepository is the constructor for Repository.
-func NewRepository(repoCfg config.RepoConfig) (*Repository, error) {
-	pgCfg, err := postgresql.ParseConfig(repoCfg)
-	if err != nil {
-		return nil, fmt.Errorf("unable to parse postgres config: %w", err)
-	}
-	if repoCfg.Database == "" {
-		return nil, errors.New("database name is mandatory for Denodo repositories")
-	}
-
-	connStr := fmt.Sprintf(
-		"postgresql://%s:%s@%s:%d/%s%s",
-		repoCfg.User,
-		repoCfg.Password,
-		repoCfg.Host,
-		repoCfg.Port,
-		repoCfg.Database,
-		pgCfg.ConnOptsStr,
-	)
-
-	sqlRepo, err := genericsql.NewRepository(
-		repoCfg.Host,
-		postgresql.RepoTypePostgres,
-		repoCfg.Database,
-		connStr,
-		repoCfg.MaxOpenConns,
-		repoCfg.IncludePaths,
-		repoCfg.ExcludePaths,
-	)
-	if err != nil {
-		return nil, fmt.Errorf("could not instantiate generic sql repository: %w", err)
-	}
-
-	return &Repository{genericSqlRepo: sqlRepo}, nil
-}
-
-func (repo *Repository) ListDatabases(_ context.Context) ([]string, error) {
-	return nil, errors.New("ListDatabases is not implemented for Denodo repositories")
-}
-
-func (repo *Repository) Introspect(ctx context.Context) (*repository.Metadata, error) {
-	return repo.genericSqlRepo.IntrospectWithQuery(ctx, IntrospectQuery)
-}
-
-func (repo *Repository) SampleTable(
-	ctx context.Context,
-	meta *repository.TableMetadata,
-	params repository.SampleParameters,
-) (repository.Sample, error) {
-	// Denodo uses double-quotes to quote identifiers
-	attrStr := meta.QuotedAttributeNamesString("\"")
-	// The postgres driver is currently unable to properly send the
-	// parameters of a prepared statement to Denodo. Therefore, instead of
-	// building a prepared statement, we populate the query string before
-	// sending it to the driver.
-	query := fmt.Sprintf(
-		"SELECT %s FROM %s.%s OFFSET %d ROWS LIMIT %d",
-		attrStr, meta.Schema, meta.Name, params.Offset, params.SampleSize,
-	)
-	return repo.genericSqlRepo.SampleTableWithQuery(ctx, meta, query)
-}
-
-func (repo *Repository) Ping(ctx context.Context) error {
-	return repo.genericSqlRepo.Ping(ctx)
-}
-
-func (repo *Repository) Close() error {
-	return repo.genericSqlRepo.Close()
-}
-
-func init() {
-	repository.Register(
-		RepoTypeDenodo,
-		func(_ context.Context, cfg config.RepoConfig) (repository.Repository, error) {
-			return NewRepository(cfg)
-		},
-	)
-}
diff --git a/discovery/repository/doc.go b/discovery/repository/doc.go
deleted file mode 100644
index 9a7ff37..0000000
--- a/discovery/repository/doc.go
+++ /dev/null
@@ -1,15 +0,0 @@
-// Package repository encapsulates the concept of a Dmap data repository, and
-// provides functionality to register multiple implementations of such
-// repositories. All supported repositories are represented as sub-packages of
-// the repository name, e.g. mysql, postgresql, etc.
-//
-// The key interface is Repository, which provides encapsulates functionality to
-// introspect and sample the underlying database it represents.
-//
-// Repository implementations should reside in their own sub-package of the
-// repository package. Each implementation register itself with the repository
-// registry by calling the Register function with a RepoConstructor function
-// that returns a new instance of the repository implementation. This will make
-// the repository implementation available to the NewRepository factory
-// function. Registration is typically done in the sub-package's init function.
-package repository
diff --git a/discovery/repository/genericsql/util.go b/discovery/repository/genericsql/util.go
deleted file mode 100644
index eac797e..0000000
--- a/discovery/repository/genericsql/util.go
+++ /dev/null
@@ -1,35 +0,0 @@
-package genericsql
-
-import (
-	"database/sql"
-)
-
-// GetCurrentRowAsMap transforms the current row referenced by a sql.Rows row
-// set into a map where the key is the column name and the value is the column
-// value. It is effectively an alternative to the sql.Rows.Scan method, where it
-// copies the value of the current row into a string/interface map. Note: just
-// like Scan, because this only operates on the current row pointed to by the
-// row set, this function does not iterate the row set forward. Therefore,
-// sql.Rows.Next must be called first to iterate the row set forward, and the
-// same error checking applies. The map returned represents the single,
-// current-most row pointed to by the row set iterator.
-func GetCurrentRowAsMap(rows *sql.Rows) (map[string]any, error) {
-	colNames, err := rows.Columns()
-	if err != nil {
-		return nil, err
-	}
-	row := make(map[string]any, len(colNames))
-	colValues := make([]any, len(colNames))
-	colValPointers := make([]any, len(colNames))
-	for i := range colValues {
-		colValPointers[i] = &colValues[i]
-	}
-	// Scans the row into the set of column-value pointers
-	if err := rows.Scan(colValPointers...); err != nil {
-		return nil, err
-	}
-	for i, colName := range colNames {
-		row[colName] = colValues[i]
-	}
-	return row, nil
-}
diff --git a/discovery/repository/mysql/mysql.go b/discovery/repository/mysql/mysql.go
deleted file mode 100644
index 193d488..0000000
--- a/discovery/repository/mysql/mysql.go
+++ /dev/null
@@ -1,104 +0,0 @@
-package mysql
-
-import (
-	"context"
-	"fmt"
-
-	"github.com/cyralinc/dmap/discovery/repository"
-	"github.com/cyralinc/dmap/discovery/repository/genericsql"
-
-	"github.com/cyralinc/dmap/discovery/config"
-
-	// MySQL DB driver
-	_ "github.com/go-sql-driver/mysql"
-)
-
-const (
-	RepoTypeMysql = "mysql"
-	DatabaseQuery = `
-SELECT 
-    schema_name
-FROM 
-    information_schema.schemata
-WHERE
-    schema_name <> 'information_schema'
-    AND schema_name <> 'performance_schema'
-    AND schema_name <> 'sys'
-`
-)
-
-// Repository is a repository.Repository implementation for MySQL databases.
-type Repository struct {
-	// The majority of the repository.Repository functionality is delegated to
-	// a generic SQL repository instance (genericSqlRepo).
-	genericSqlRepo *genericsql.Repository
-}
-
-// Repository implements repository.Repository
-var _ repository.Repository = (*Repository)(nil)
-
-// NewRepository creates a new MySQL repository.
-func NewRepository(cfg config.RepoConfig) (*Repository, error) {
-	connStr := fmt.Sprintf(
-		"%s:%s@tcp(%s:%d)/%s",
-		cfg.User,
-		cfg.Password,
-		cfg.Host,
-		cfg.Port,
-		// This can be an empty string. See:
-		// https://github.com/go-sql-driver/mysql#dsn-data-source-name
-		cfg.Database,
-	)
-
-	sqlRepo, err := genericsql.NewRepository(
-		cfg.Host,
-		RepoTypeMysql,
-		cfg.Database,
-		connStr,
-		cfg.MaxOpenConns,
-		cfg.IncludePaths,
-		cfg.ExcludePaths,
-	)
-	if err != nil {
-		return nil, fmt.Errorf("could not instantiate generic sql repository: %w", err)
-	}
-
-	return &Repository{genericSqlRepo: sqlRepo}, nil
-}
-
-func (repo *Repository) ListDatabases(ctx context.Context) ([]string, error) {
-	return repo.genericSqlRepo.ListDatabasesWithQuery(ctx, DatabaseQuery)
-}
-
-func (repo *Repository) Introspect(ctx context.Context) (*repository.Metadata, error) {
-	return repo.genericSqlRepo.Introspect(ctx)
-}
-
-func (repo *Repository) SampleTable(
-	ctx context.Context,
-	meta *repository.TableMetadata,
-	params repository.SampleParameters,
-) (repository.Sample, error) {
-	// MySQL uses backticks to quote identifiers
-	attrStr := meta.QuotedAttributeNamesString("`")
-	// The generic select/limit/offset query and ? placeholders work fine with MySQL
-	query := fmt.Sprintf(genericsql.SampleQueryTemplate, attrStr, meta.Schema, meta.Name)
-	return repo.genericSqlRepo.SampleTableWithQuery(ctx, meta, query, params.SampleSize, params.Offset)
-}
-
-func (repo *Repository) Ping(ctx context.Context) error {
-	return repo.genericSqlRepo.Ping(ctx)
-}
-
-func (repo *Repository) Close() error {
-	return repo.genericSqlRepo.Close()
-}
-
-func init() {
-	repository.Register(
-		RepoTypeMysql,
-		func(_ context.Context, cfg config.RepoConfig) (repository.Repository, error) {
-			return NewRepository(cfg)
-		},
-	)
-}
diff --git a/discovery/repository/oracle/config.go b/discovery/repository/oracle/config.go
deleted file mode 100644
index d47839c..0000000
--- a/discovery/repository/oracle/config.go
+++ /dev/null
@@ -1,27 +0,0 @@
-package oracle
-
-import (
-	"github.com/cyralinc/dmap/discovery/config"
-)
-
-const (
-	configServiceName = "service-name"
-)
-
-type Config struct {
-	ServiceName string
-}
-
-func ParseConfig(cfg config.RepoConfig) (*Config, error) {
-	oracleCfg, err := config.FetchAdvancedConfigString(
-		cfg,
-		RepoTypeOracle,
-		[]string{configServiceName},
-	)
-	if err != nil {
-		return nil, err
-	}
-	return &Config{
-		ServiceName: oracleCfg[configServiceName],
-	}, nil
-}
diff --git a/discovery/repository/oracle/oracle.go b/discovery/repository/oracle/oracle.go
deleted file mode 100644
index ac9fb4b..0000000
--- a/discovery/repository/oracle/oracle.go
+++ /dev/null
@@ -1,132 +0,0 @@
-package oracle
-
-import (
-	"context"
-	"errors"
-	"fmt"
-
-	"github.com/cyralinc/dmap/discovery/repository"
-	"github.com/cyralinc/dmap/discovery/repository/genericsql"
-
-	"github.com/cyralinc/dmap/discovery/config"
-
-	// Oracle DB driver
-	_ "github.com/sijms/go-ora/v2"
-)
-
-const (
-	RepoTypeOracle  = "oracle"
-	introspectQuery = `
-WITH users AS (
-  SELECT
-    username
-  FROM
-    sys.all_users
-  WHERE
-    oracle_maintained = 'N' AND
-    username <> 'RDSADMIN'
-)
-SELECT
-  owner AS table_schema,
-  table_name,
-  column_name,
-  data_type
-FROM
-  sys.all_tab_columns
-INNER JOIN
-  users
-ON
-  owner = users.username
-`
-)
-
-// Repository is a repository.Repository implementation for Oracle databases.
-type Repository struct {
-	// The majority of the repository.Repository functionality is delegated to
-	// a generic SQL repository instance (genericSqlRepo).
-	genericSqlRepo *genericsql.Repository
-}
-
-// Repository implements repository.Repository
-var _ repository.Repository = (*Repository)(nil)
-
-// NewRepository creates a new Oracle repository.
-func NewRepository(cfg config.RepoConfig) (*Repository, error) {
-	oracleCfg, err := ParseConfig(cfg)
-	if err != nil {
-		return nil, fmt.Errorf("unable to parse oracle config: %w", err)
-	}
-
-	connStr := fmt.Sprintf(
-		`oracle://%s:%s@%s:%d/%s`,
-		cfg.User,
-		cfg.Password,
-		cfg.Host,
-		cfg.Port,
-		oracleCfg.ServiceName,
-	)
-
-	sqlRepo, err := genericsql.NewRepository(
-		cfg.Host,
-		RepoTypeOracle,
-		cfg.Database,
-		connStr,
-		cfg.MaxOpenConns,
-		cfg.IncludePaths,
-		cfg.ExcludePaths,
-	)
-	if err != nil {
-		return nil, fmt.Errorf("could not instantiate generic sql repository: %w", err)
-	}
-
-	return &Repository{genericSqlRepo: sqlRepo}, nil
-}
-
-// ListDatabases is left unimplemented for Oracle, because Oracle doesn't have
-// the traditional concept of "databases". Note that Introspect already
-// identifies all the accessible objects on the server.
-func (repo *Repository) ListDatabases(_ context.Context) ([]string, error) {
-	return nil, errors.New("ListDatabases is not implemented for Oracle repos")
-}
-
-func (repo *Repository) Introspect(ctx context.Context) (*repository.Metadata, error) {
-	return repo.genericSqlRepo.IntrospectWithQuery(ctx, introspectQuery)
-}
-
-func (repo *Repository) SampleTable(
-	ctx context.Context,
-	meta *repository.TableMetadata,
-	params repository.SampleParameters,
-) (repository.Sample, error) {
-	// Oracle uses double-quotes to quote identifiers
-	attrStr := meta.QuotedAttributeNamesString("\"")
-	// Oracle uses :x for placeholders
-	query := fmt.Sprintf(
-		"SELECT %s FROM %s.%s OFFSET :1 ROWS FETCH NEXT :2 ROWS ONLY",
-		attrStr, meta.Schema, meta.Name,
-	)
-	return repo.genericSqlRepo.SampleTableWithQuery(ctx, meta, query, params.Offset, params.SampleSize)
-}
-
-// Ping verifies the connection to Oracle database used by this Repository.
-// Normally we would just delegate to the Ping method implemented by
-// genericsql.Repository. However, that implementation executes a
-// 'SELECT 1' query to test for connectivity, and Oracle being Oracle, does not
-// like this. So instead, we defer to the native Ping method implemented by the
-// Oracle sql.DB driver.
-func (repo *Repository) Ping(ctx context.Context) error {
-	return repo.genericSqlRepo.GetDb().PingContext(ctx)
-}
-
-func (repo *Repository) Close() error {
-	return repo.genericSqlRepo.Close()
-}
-
-func init() {
-	repository.Register(
-		RepoTypeOracle,
-		func(_ context.Context, cfg config.RepoConfig) (repository.Repository, error) {
-			return NewRepository(cfg)
-		},
-	)
-}
diff --git a/discovery/repository/oracle/oracle_test.go b/discovery/repository/oracle/oracle_test.go
deleted file mode 100644
index 7b70647..0000000
--- a/discovery/repository/oracle/oracle_test.go
+++ /dev/null
@@ -1,86 +0,0 @@
-package oracle
-
-import (
-	"testing"
-
-	"github.com/DATA-DOG/go-sqlmock"
-	"github.com/stretchr/testify/require"
-	"github.com/stretchr/testify/suite"
-
-	"github.com/cyralinc/dmap/discovery/repository/genericsql"
-)
-
-// Query Alias
-const (
-	usernameAlias         = "USERNAME"
-	oracleMaintainedAlias = "ORACLE_MAINTAINED"
-	statusAlias           = "ACCOUNT_STATUS"
-	createdAtAlias        = "CREATED_AT"
-	lastUsedAtAlias       = "LAST_USED_AT"
-	roleAlias             = "ROLE"
-	isPredefinedAlias     = "IS_PREDEFINED"
-)
-
-type OracleTestSuite struct {
-	suite.Suite
-	repo Repository
-	mock sqlmock.Sqlmock
-	databaseUserQuery                 string
-	databaseRolesForUserQueryTemplate string
-}
-
-func TestOracle(t *testing.T) {
-	s := new(OracleTestSuite)
-	suite.Run(t, s)
-}
-
-func (s *OracleTestSuite) SetupSuite() {
-	s.databaseUserQuery = `
-	SELECT 
-		users.username AS ` + usernameAlias + `,
-		users.oracle_maintained AS ` + oracleMaintainedAlias + `,
-		users.account_status AS ` + statusAlias + `,
-		users.created AS ` + createdAtAlias + `,
-		users.last_login AS ` + lastUsedAtAlias + `
-	FROM 
-		dba_users users
-	ORDER BY
-		users.username
-	ASC
-		`
-	s.databaseRolesForUserQueryTemplate = `
-	SELECT 
-		privs.granted_role AS ` + roleAlias + `,
-		roles.oracle_maintained AS ` + isPredefinedAlias + `
-	FROM 
-		dba_role_privs privs
-	LEFT JOIN
-		dba_roles roles
-	ON
-		privs.granted_role = roles.role
-	WHERE 
-		privs.grantee = '%s'
-	ORDER BY
-		privs.granted_role
-	ASC
-		`
-}
-
-func (s *OracleTestSuite) BeforeTest(suiteName, testName string) {
-	db, mock, err := sqlmock.New()
-	require.NoError(s.T(), err)
-
-	s.mock = mock
-	s.repo = Repository{
-		genericSqlRepo: genericsql.NewRepositoryFromDB(
-			"oracle-repo",
-			"oracle-driver",
-			"oracle-db",
-			db,
-		),
-	}
-}
-
-func (s *OracleTestSuite) TearDownTest() {
-	s.repo.genericSqlRepo.GetDb().Close()
-}
diff --git a/discovery/repository/postgresql/config.go b/discovery/repository/postgresql/config.go
deleted file mode 100644
index 100be9a..0000000
--- a/discovery/repository/postgresql/config.go
+++ /dev/null
@@ -1,22 +0,0 @@
-package postgresql
-
-import (
-	"github.com/cyralinc/dmap/discovery/config"
-)
-
-type Config struct {
-	ConnOptsStr string
-}
-
-// ParseConfig produces a config structure with PostgreSQL-specific parameters
-// found in the repo config.
-func ParseConfig(cfg config.RepoConfig) (*Config, error) {
-	connOptsStr, err := config.BuildConnOptsStr(cfg)
-	if err != nil {
-		return nil, err
-	}
-
-	return &Config{
-		ConnOptsStr: connOptsStr,
-	}, nil
-}
diff --git a/discovery/repository/postgresql/postgresql.go b/discovery/repository/postgresql/postgresql.go
deleted file mode 100644
index b02f822..0000000
--- a/discovery/repository/postgresql/postgresql.go
+++ /dev/null
@@ -1,110 +0,0 @@
-package postgresql
-
-import (
-	"context"
-	"fmt"
-
-	"github.com/cyralinc/dmap/discovery/repository"
-	"github.com/cyralinc/dmap/discovery/repository/genericsql"
-
-	"github.com/cyralinc/dmap/discovery/config"
-	// Postgresql DB driver
-	_ "github.com/lib/pq"
-)
-
-const (
-	RepoTypePostgres = "postgres"
-
-	DatabaseQuery = `
-SELECT 
-	datname 
-FROM
-	pg_database
-WHERE
-	datistemplate = false
-	AND datallowconn = true
-	AND datname <> 'rdsadmin'
-`
-)
-
-// Repository is a PostgreSQL-specific repository.Repository implementation.
-type Repository struct {
-	// The majority of the repository.Repository functionality is delegated to
-	// a generic SQL repository instance (genericSqlRepo).
-	genericSqlRepo *genericsql.Repository
-}
-
-// Repository implements repository.Repository
-var _ repository.Repository = (*Repository)(nil)
-
-// NewRepository creates a new PostgreSQL repository.
-func NewRepository(repoCfg config.RepoConfig) (*Repository, error) {
-	pgCfg, err := ParseConfig(repoCfg)
-	if err != nil {
-		return nil, fmt.Errorf("unable to parse postgresql config: %w", err)
-	}
-	database := repoCfg.Database
-	// Connect to the default database, if unspecified.
-	if database == "" {
-		database = "postgres"
-	}
-	connStr := fmt.Sprintf(
-		"postgresql://%s:%s@%s:%d/%s%s",
-		repoCfg.User,
-		repoCfg.Password,
-		repoCfg.Host,
-		repoCfg.Port,
-		database,
-		pgCfg.ConnOptsStr,
-	)
-	sqlRepo, err := genericsql.NewRepository(
-		repoCfg.Host,
-		RepoTypePostgres,
-		repoCfg.Database,
-		connStr,
-		repoCfg.MaxOpenConns,
-		repoCfg.IncludePaths,
-		repoCfg.ExcludePaths,
-	)
-	if err != nil {
-		return nil, fmt.Errorf("could not instantiate generic sql repository: %w", err)
-	}
-	return &Repository{genericSqlRepo: sqlRepo}, nil
-}
-
-func (repo *Repository) ListDatabases(ctx context.Context) ([]string, error) {
-	return repo.genericSqlRepo.ListDatabasesWithQuery(ctx, DatabaseQuery)
-}
-
-func (repo *Repository) Introspect(ctx context.Context) (*repository.Metadata, error) {
-	return repo.genericSqlRepo.Introspect(ctx)
-}
-
-func (repo *Repository) SampleTable(
-	ctx context.Context,
-	meta *repository.TableMetadata,
-	params repository.SampleParameters,
-) (repository.Sample, error) {
-	// PostgreSQL uses double-quotes to quote identifiers
-	attrStr := meta.QuotedAttributeNamesString("\"")
-	// PostgreSQL uses $x for placeholders
-	query := fmt.Sprintf("SELECT %s FROM %s.%s LIMIT $1 OFFSET $2", attrStr, meta.Schema, meta.Name)
-	return repo.genericSqlRepo.SampleTableWithQuery(ctx, meta, query, params.SampleSize, params.Offset)
-}
-
-func (repo *Repository) Ping(ctx context.Context) error {
-	return repo.genericSqlRepo.Ping(ctx)
-}
-
-func (repo *Repository) Close() error {
-	return repo.genericSqlRepo.Close()
-}
-
-func init() {
-	repository.Register(
-		RepoTypePostgres,
-		func(_ context.Context, cfg config.RepoConfig) (repository.Repository, error) {
-			return NewRepository(cfg)
-		},
-	)
-}
diff --git a/discovery/repository/redshift/redshift.go b/discovery/repository/redshift/redshift.go
deleted file mode 100644
index fbe8033..0000000
--- a/discovery/repository/redshift/redshift.go
+++ /dev/null
@@ -1,101 +0,0 @@
-package redshift
-
-import (
-	"context"
-	"fmt"
-
-	"github.com/cyralinc/dmap/discovery/config"
-	"github.com/cyralinc/dmap/discovery/repository"
-	"github.com/cyralinc/dmap/discovery/repository/genericsql"
-	"github.com/cyralinc/dmap/discovery/repository/postgresql"
-
-	// Use PostgreSQL DB driver for Redshift
-	_ "github.com/lib/pq"
-)
-
-const (
-	RepoTypeRedshift = "redshift"
-)
-
-// Repository is a Redshift-specific repository.Repository implementation.
-type Repository struct {
-	// The majority of the repository.Repository functionality is delegated to
-	// a generic SQL repository instance (genericSqlRepo).
-	genericSqlRepo *genericsql.Repository
-}
-
-// Repository implements repository.Repository
-var _ repository.Repository = (*Repository)(nil)
-
-// NewRepository creates a new Redshift repository.
-func NewRepository(repoCfg config.RepoConfig) (*Repository, error) {
-	pgCfg, err := postgresql.ParseConfig(repoCfg)
-	if err != nil {
-		return nil, fmt.Errorf("unable to parse postgres config: %w", err)
-	}
-	database := repoCfg.Database
-	// Connect to the default database, if unspecified.
-	if database == "" {
-		database = "dev"
-	}
-	connStr := fmt.Sprintf(
-		"postgresql://%s:%s@%s:%d/%s%s",
-		repoCfg.User,
-		repoCfg.Password,
-		repoCfg.Host,
-		repoCfg.Port,
-		database,
-		pgCfg.ConnOptsStr,
-	)
-	sqlRepo, err := genericsql.NewRepository(
-		repoCfg.Host,
-		postgresql.RepoTypePostgres,
-		repoCfg.Database,
-		connStr,
-		repoCfg.MaxOpenConns,
-		repoCfg.IncludePaths,
-		repoCfg.ExcludePaths,
-	)
-	if err != nil {
-		return nil, fmt.Errorf("could not instantiate generic sql repository: %w", err)
-	}
-	return &Repository{genericSqlRepo: sqlRepo}, nil
-}
-
-func (repo *Repository) ListDatabases(ctx context.Context) ([]string, error) {
-	// Redshift and Postgres use the same query to list the server databases.
-	return repo.genericSqlRepo.ListDatabasesWithQuery(ctx, postgresql.DatabaseQuery)
-}
-
-func (repo *Repository) Introspect(ctx context.Context) (*repository.Metadata, error) {
-	return repo.genericSqlRepo.Introspect(ctx)
-}
-
-func (repo *Repository) SampleTable(
-	ctx context.Context,
-	meta *repository.TableMetadata,
-	params repository.SampleParameters,
-) (repository.Sample, error) {
-	// Redshift uses double-quotes to quote identifiers
-	attrStr := meta.QuotedAttributeNamesString("\"")
-	// Redshift uses $x for placeholders
-	query := fmt.Sprintf("SELECT %s FROM %s.%s LIMIT $1 OFFSET $2", attrStr, meta.Schema, meta.Name)
-	return repo.genericSqlRepo.SampleTableWithQuery(ctx, meta, query, params.SampleSize, params.Offset)
-}
-
-func (repo *Repository) Ping(ctx context.Context) error {
-	return repo.genericSqlRepo.Ping(ctx)
-}
-
-func (repo *Repository) Close() error {
-	return repo.genericSqlRepo.Close()
-}
-
-func init() {
-	repository.Register(
-		RepoTypeRedshift,
-		func(_ context.Context, cfg config.RepoConfig) (repository.Repository, error) {
-			return NewRepository(cfg)
-		},
-	)
-}
diff --git a/discovery/repository/redshift/redshift_test.go b/discovery/repository/redshift/redshift_test.go
deleted file mode 100644
index 48d9c75..0000000
--- a/discovery/repository/redshift/redshift_test.go
+++ /dev/null
@@ -1,32 +0,0 @@
-package redshift
-
-import (
-	"context"
-	"database/sql"
-	"testing"
-
-	"github.com/DATA-DOG/go-sqlmock"
-	"github.com/stretchr/testify/require"
-
-	"github.com/cyralinc/dmap/discovery/repository/genericsql"
-	"github.com/cyralinc/dmap/discovery/repository/postgresql"
-)
-
-func TestListDatabases(t *testing.T) {
-	ctx, db, mock, r := initRepoTest(t)
-	defer func() { _ = db.Close() }()
-	dbRows := sqlmock.NewRows([]string{"name"}).AddRow("db1").AddRow("db2")
-	mock.ExpectQuery(postgresql.DatabaseQuery).WillReturnRows(dbRows)
-	dbs, err := r.ListDatabases(ctx)
-	require.NoError(t, err)
-	require.ElementsMatch(t, []string{"db1", "db2"}, dbs)
-}
-
-func initRepoTest(t *testing.T) (context.Context, *sql.DB, sqlmock.Sqlmock, *Repository) {
-	ctx := context.Background()
-	db, mock, err := sqlmock.New()
-	require.NoError(t, err)
-	return ctx, db, mock, &Repository{
-		genericSqlRepo: genericsql.NewRepositoryFromDB("repoName", RepoTypeRedshift, "dbName", db),
-	}
-}
diff --git a/discovery/repository/repository.go b/discovery/repository/repository.go
deleted file mode 100644
index 27d6774..0000000
--- a/discovery/repository/repository.go
+++ /dev/null
@@ -1,80 +0,0 @@
-package repository
-
-import (
-	"context"
-	"errors"
-	"fmt"
-
-	"github.com/cyralinc/dmap/discovery/config"
-)
-
-// Repository represents a Dmap data repository, and provides functionality to
-// introspect its corresponding schema.
-type Repository interface {
-	// ListDatabases returns a list of the names of all databases on the server.
-	ListDatabases(ctx context.Context) ([]string, error)
-
-	// Introspect will read and analyze the basic properties of the repository
-	// and return as a Metadata instance. This includes all the repository's
-	// databases, schemas, tables, columns, and attributes.
-	Introspect(ctx context.Context) (*Metadata, error)
-
-	// SampleTable samples the table referenced by the TableMetadata meta
-	// parameter and returns the sample as a slice of Sample. The parameters for
-	// the sample, such as sample size, are passed via the params parameter (see
-	// SampleParameters for more details). The returned sample result set
-	// contains one Sample for each table row sampled. The length of the results
-	// will be less than or equal to the sample size. If there are fewer results
-	// than the specified sample size, it is because the table in question had a
-	// row count less than the sample size. Prefer small sample sizes to limit
-	// impact on the database.
-	SampleTable(ctx context.Context, meta *TableMetadata, params SampleParameters) (Sample, error)
-
-	// Ping is meant to be used as a general purpose connectivity test. It
-	// should be invoked e.g. in the dry-run mode.
-	Ping(ctx context.Context) error
-
-	// Close is meant to be used as a general purpose cleanup. It should be
-	// invoked when the Repository is no longer used.
-	Close() error
-}
-
-// RepoConstructor represents the function signature that all repository
-// implementations should use for their constructor functions.
-type RepoConstructor func(ctx context.Context, cfg config.RepoConfig) (Repository, error)
-
-var registry = make(map[string]RepoConstructor)
-
-// Register makes a repository available by the provided repository type
-// (repoType). If Register is called twice with the same repoType, or if
-// constructor is nil, it panics. Note that Register is not thread-safe. It is
-// expected to be called from either a package's init function, or from the
-// program's main function.
-func Register(repoType string, constructor RepoConstructor) {
-	if constructor == nil {
-		panic("attempt to register nil constructor for repoType " + repoType)
-	}
-
-	if _, dup := registry[repoType]; dup {
-		panic("register called twice for repoType " + repoType)
-	}
-
-	registry[repoType] = constructor
-}
-
-// NewRepository is a factory function to return a concrete Repository
-// implementation based on the specified type, e.g. MySQL, PostgreSQL, MSSQL,
-// etc.
-func NewRepository(ctx context.Context, cfg config.RepoConfig) (Repository, error) {
-	constructor, ok := registry[cfg.Type]
-	if !ok {
-		return nil, errors.New("unsupported repo type " + cfg.Type)
-	}
-
-	repo, err := constructor(ctx, cfg)
-	if err != nil {
-		return nil, fmt.Errorf("error creating repository, %w", err)
-	}
-
-	return repo, nil
-}
diff --git a/discovery/repository/snowflake/config.go b/discovery/repository/snowflake/config.go
deleted file mode 100644
index 57f3e0a..0000000
--- a/discovery/repository/snowflake/config.go
+++ /dev/null
@@ -1,36 +0,0 @@
-package snowflake
-
-import (
-	"github.com/cyralinc/dmap/discovery/config"
-)
-
-const (
-	configAccount   = "account"
-	configRole      = "role"
-	configWarehouse = "warehouse"
-)
-
-type Config struct {
-	Account   string
-	Role      string
-	Warehouse string
-}
-
-// ParseConfig produces a config structure with Snowflake-specific parameters
-// found in the repo config.
-func ParseConfig(cfg config.RepoConfig) (*Config, error) {
-	snowflakeCfg, err := config.FetchAdvancedConfigString(
-		cfg,
-		RepoTypeSnowflake,
-		[]string{configAccount, configRole, configWarehouse},
-	)
-	if err != nil {
-		return nil, err
-	}
-	return &Config{
-		Account:   snowflakeCfg[configAccount],
-		Role:      snowflakeCfg[configRole],
-		Warehouse: snowflakeCfg[configWarehouse],
-	}, nil
-
-}
diff --git a/discovery/repository/snowflake/snowflake.go b/discovery/repository/snowflake/snowflake.go
deleted file mode 100644
index ff59cf4..0000000
--- a/discovery/repository/snowflake/snowflake.go
+++ /dev/null
@@ -1,107 +0,0 @@
-package snowflake
-
-import (
-	"context"
-	"fmt"
-
-	"github.com/cyralinc/dmap/discovery/repository"
-	"github.com/cyralinc/dmap/discovery/repository/genericsql"
-
-	"github.com/cyralinc/dmap/discovery/config"
-
-	// Snowflake DB driver
-	_ "github.com/snowflakedb/gosnowflake"
-)
-
-const (
-	RepoTypeSnowflake = "snowflake"
-
-	DatabaseQuery = `
-SELECT 
-    DATABASE_NAME 
-FROM 
-    INFORMATION_SCHEMA.DATABASES 
-WHERE 
-    IS_TRANSIENT = 'NO'
-`
-)
-
-// Repository is a repository.Repository implementation for Snowflake databases.
-type Repository struct {
-	// The majority of the repository.Repository functionality is delegated to
-	// a generic SQL repository instance (genericSqlRepo).
-	genericSqlRepo *genericsql.Repository
-}
-
-// Repository implements repository.Repository
-var _ repository.Repository = (*Repository)(nil)
-
-// NewRepository creates a new Snowflake repository.
-func NewRepository(cfg config.RepoConfig) (*Repository, error) {
-	snowflakeCfg, err := ParseConfig(cfg)
-	if err != nil {
-		return nil, fmt.Errorf("error when parsing snowflake config: %w", err)
-	}
-	database := cfg.Database
-	// Connect to the default database, if unspecified.
-	if database == "" {
-		database = "SNOWFLAKE"
-	}
-	connStr := fmt.Sprintf(
-		"%s:%s@%s/%s?role=%s&warehouse=%s",
-		cfg.User,
-		cfg.Password,
-		snowflakeCfg.Account,
-		cfg.Database,
-		snowflakeCfg.Role,
-		snowflakeCfg.Warehouse,
-	)
-
-	sqlRepo, err := genericsql.NewRepository(
-		cfg.Host,
-		RepoTypeSnowflake,
-		database,
-		connStr,
-		cfg.MaxOpenConns,
-		cfg.IncludePaths,
-		cfg.ExcludePaths,
-	)
-	if err != nil {
-		return nil, fmt.Errorf("could not instantiate generic sql repository: %w", err)
-	}
-
-	return &Repository{genericSqlRepo: sqlRepo}, nil
-}
-
-func (repo *Repository) ListDatabases(ctx context.Context) ([]string, error) {
-	return repo.genericSqlRepo.ListDatabasesWithQuery(ctx, DatabaseQuery)
-}
-
-func (repo *Repository) Introspect(ctx context.Context) (*repository.Metadata, error) {
-	return repo.genericSqlRepo.Introspect(ctx)
-}
-
-func (repo *Repository) SampleTable(
-	ctx context.Context,
-	meta *repository.TableMetadata,
-	params repository.SampleParameters,
-) (repository.Sample, error) {
-	return repo.genericSqlRepo.SampleTable(ctx, meta, params)
-}
-
-func (repo *Repository) Ping(ctx context.Context) error {
-	return repo.genericSqlRepo.Ping(ctx)
-}
-
-func (repo *Repository) Close() error {
-	return repo.genericSqlRepo.Close()
-}
-
-func init() {
-	repository.Register(
-		RepoTypeSnowflake,
-		func(ctx context.Context, cfg config.RepoConfig) (repository.Repository, error) {
-			return NewRepository(cfg)
-		},
-	)
-}
diff --git a/discovery/repository/sqlserver/sqlserver.go b/discovery/repository/sqlserver/sqlserver.go
deleted file mode 100644
index cf2b8b4..0000000
--- a/discovery/repository/sqlserver/sqlserver.go
+++ /dev/null
@@ -1,107 +0,0 @@
-package sqlserver
-
-import (
-	"context"
-	"fmt"
-
-	"github.com/cyralinc/dmap/discovery/repository"
-	"github.com/cyralinc/dmap/discovery/repository/genericsql"
-
-	"github.com/cyralinc/dmap/discovery/config"
-
-	// SQL Server DB driver
-	_ "github.com/denisenkom/go-mssqldb"
-)
-
-const (
-	RepoTypeSqlServer = "sqlserver"
-
-	// SampleQueryTemplate is the string template for the SQL query used to
-	// sample a SQL Server database. SQL Server doesn't support limit/offset, so
-	// we use top. It also uses the @ symbol for statement parameter
-	// placeholders. It is intended to be templated by the database name to
-	// query.
-	SampleQueryTemplate = `SELECT TOP (@p1) %s FROM "%s"."%s"`
-
-	// DatabaseQuery is the query to list all the databases on the server, minus
-	// the system default databases 'model' and 'tempdb'.
-	DatabaseQuery = "SELECT name FROM sys.databases WHERE name != 'model' AND name != 'tempdb'"
-)
-
-// Repository is a repository.Repository implementation for MS SQL Server
-// databases.
-type Repository struct {
-	// The majority of the repository.Repository functionality is delegated to
-	// a generic SQL repository instance (genericSqlRepo).
-	genericSqlRepo *genericsql.Repository
-}
-
-// Repository implements repository.Repository
-var _ repository.Repository = (*Repository)(nil)
-
-// NewRepository creates a new MS SQL Server repository.
-func NewRepository(cfg config.RepoConfig) (*Repository, error) {
-	connStr := fmt.Sprintf(
-		"sqlserver://%s:%s@%s:%d",
-		cfg.User,
-		cfg.Password,
-		cfg.Host,
-		cfg.Port,
-	)
-
-	// The database name is optional for MS SQL Server.
-	if cfg.Database != "" {
-		connStr = fmt.Sprintf(connStr+"?database=%s", cfg.Database)
-	}
-
-	genericSqlRepo, err := genericsql.NewRepository(
-		cfg.Host,
-		RepoTypeSqlServer,
-		cfg.Database,
-		connStr,
-		cfg.MaxOpenConns,
-		cfg.IncludePaths,
-		cfg.IncludePaths,
-	)
-	if err != nil {
-		return nil, fmt.Errorf("could not instantiate generic sql repository: %w", err)
-	}
-
-	return &Repository{genericSqlRepo: genericSqlRepo}, nil
-}
-
-func (repo *Repository) ListDatabases(ctx context.Context) ([]string, error) {
-	return repo.genericSqlRepo.ListDatabasesWithQuery(ctx, DatabaseQuery)
-}
-
-func (repo *Repository) Introspect(ctx context.Context) (*repository.Metadata, error) {
-	return repo.genericSqlRepo.Introspect(ctx)
-}
-
-func (repo *Repository) SampleTable(
-	ctx context.Context,
-	meta *repository.TableMetadata,
-	params repository.SampleParameters,
-) (repository.Sample, error) {
-	// Sqlserver uses double-quotes to quote identifiers
-	attrStr := meta.QuotedAttributeNamesString("\"")
-	query := fmt.Sprintf(SampleQueryTemplate, attrStr, meta.Schema, meta.Name)
-	return repo.genericSqlRepo.SampleTableWithQuery(ctx, meta, query, params.SampleSize)
-}
-
-func (repo *Repository) Ping(ctx context.Context) error {
-	return repo.genericSqlRepo.Ping(ctx)
-}
-
-func (repo *Repository) Close() error {
-	return repo.genericSqlRepo.Close()
-}
-
-func init() {
-	repository.Register(
-		RepoTypeSqlServer,
-		func(_ context.Context, cfg config.RepoConfig) (repository.Repository, error) {
-			return NewRepository(cfg)
-		},
-	)
-}
diff --git a/discovery/scanner.go b/discovery/scanner.go
index 1cd178e..c1b78f8 100644
--- a/discovery/scanner.go
+++ b/discovery/scanner.go
@@ -10,75 +10,92 @@ import (
 	"github.com/cyralinc/dmap/classification"
 	"github.com/cyralinc/dmap/classification/publisher"
 	"github.com/cyralinc/dmap/discovery/config"
-	"github.com/cyralinc/dmap/discovery/repository"
-	"github.com/cyralinc/dmap/discovery/repository/oracle"
-
-	// Registers repo types for use via 'init' side effects
-	_ "github.com/cyralinc/dmap/discovery/repository/denodo"
-	_ "github.com/cyralinc/dmap/discovery/repository/mysql"
-	_ "github.com/cyralinc/dmap/discovery/repository/oracle"
-	_ "github.com/cyralinc/dmap/discovery/repository/postgresql"
-	_ "github.com/cyralinc/dmap/discovery/repository/redshift"
-	_ "github.com/cyralinc/dmap/discovery/repository/snowflake"
-	_ "github.com/cyralinc/dmap/discovery/repository/sqlserver"
+	"github.com/cyralinc/dmap/discovery/sql"
 )
 
 // Scanner is a data discovery scanner that scans a data repository for
 // sensitive data. It also classifies the data and publishes the results to
 // the configured external sources.
 type Scanner struct {
-	config         *config.Config
-	repository     repository.Repository
-	embeddedLabels []classification.Label
-	customLabels   []classification.Label
-	classifier     *classification.LabelClassifier
-	publisher      publisher.Publisher
-	initialized    bool
+	config     *config.Config
+	repository sql.Repository
+	classifier classification.Classifier
+	publisher  publisher.Publisher
 }
 
-// NewScanner creates a new Scanner instance with the given configuration.
-func NewScanner(config *config.Config) Scanner {
-	return Scanner{config: config}
+// ScannerOption is a functional option type for the Scanner type.
+type ScannerOption func(*Scanner)
+
+// Repository is a functional option that sets the repository for the Scanner.
+func Repository(r sql.Repository) ScannerOption {
+	return func(s *Scanner) { s.repository = r }
 }
 
-// Init initializes the Scanner instance. It must be called before calling Run.
-func (s *Scanner) Init(ctx context.Context) error {
-	if s.config == nil {
-		return errors.New("unable to start crawler: config not found")
+// Classifier is a functional option that sets the classifier for the Scanner.
+func Classifier(c classification.Classifier) ScannerOption {
+	return func(s *Scanner) { s.classifier = c }
+}
+
+// Publisher is a functional option that sets the publisher for the Scanner.
+func Publisher(p publisher.Publisher) ScannerOption {
+	return func(s *Scanner) { s.publisher = p }
+}
+
+// NewScanner creates a new Scanner instance with the provided configuration.
+func NewScanner(
+	ctx context.Context,
+	config *config.Config,
+	opts ...ScannerOption,
+) (*Scanner, error) {
+	if config == nil {
+		return nil, errors.New("config can't be nil")
+	}
+	s := &Scanner{config: config}
+	// Apply options.
+	for _, opt := range opts {
+		opt(s)
 	}
-	// Note: order is important here because we don't have nil checks in these
-	// init methods.
-	s.initPublisher()
-	if err := s.initEmbeddedLabels(); err != nil {
-		return err
+	if s.publisher == nil {
+		// Default to stdout publisher.
+		s.publisher = publisher.NewStdOutPublisher()
 	}
-	if err := s.initLabelClassifier(); err != nil {
-		return err
+	if s.classifier == nil {
+		// Create a new label classifier with the embedded labels.
+		lbls, err := classification.GetEmbeddedLabels()
+		if err != nil {
+			return nil, fmt.Errorf("error getting embedded labels: %w", err)
+		}
+		c, err := classification.NewLabelClassifier(lbls.ToSlice()...)
+		if err != nil {
+			return nil, fmt.Errorf("error creating new label classifier: %w", err)
+		}
+		s.classifier = c
 	}
-	if err := s.initRepository(ctx); err != nil {
-		return err
+	if s.repository == nil {
+		// Get a repository instance from the default registry.
+		repo, err := sql.NewRepository(ctx, s.config.Repo)
+		if err != nil {
+			return nil, fmt.Errorf("error connecting to database: %w", err)
+		}
+		s.repository = repo
 	}
-	// Done!
-	s.initialized = true
-	return nil
+	return s, nil
 }
 
-// Run runs the data repository scan. It samples the data repository, classifies
-// the data, and publishes the results to the configured external sources.
-func (s *Scanner) Run(ctx context.Context) error {
-	if !s.initialized {
-		return errors.New("scanner not initialized")
-	}
-	sampleParams := repository.SampleParameters{SampleSize: s.config.Repo.SampleSize}
-	var samples []repository.Sample
+// Scan performs the data repository scan. It introspects and samples the
+// repository, classifies the sampled data, and publishes the results to the
+// configured publisher.
+func (s *Scanner) Scan(ctx context.Context) error {
+	sampleParams := sql.SampleParameters{SampleSize: s.config.Repo.SampleSize}
+	var samples []sql.Sample
 	// The name of the database to connect to has been left unspecified by
 	// the user, so we try to connect and sample all databases instead. Note
 	// that Oracle doesn't really have the concept of "databases", and thus
 	// the Scanner always scans the entire database, so only the single
 	// (default) repository instance is required in that case.
-	if s.config.Repo.Database == "" && s.config.Repo.Type != oracle.RepoTypeOracle {
+	if s.config.Repo.Database == "" && s.config.Repo.Type != sql.RepoTypeOracle {
 		var err error
-		samples, err = repository.SampleAllDatabases(
+		samples, err = sql.SampleAllDatabases(
 			ctx,
 			s.repository,
 			s.config.Repo,
@@ -99,7 +116,7 @@ func (s *Scanner) Run(ctx context.Context) error {
 		// we already have a repository instance for it. Just use it to
 		// sample that database only.
 		var err error
-		samples, err = repository.SampleRepository(ctx, s.repository, sampleParams)
+		samples, err = sql.SampleRepository(ctx, s.repository, sampleParams)
 		if err != nil {
 			err = fmt.Errorf("error gathering repository data samples: %w", err)
 			// If we didn't get any samples, just return the error.
@@ -129,51 +146,10 @@ func (s *Scanner) Run(ctx context.Context) error {
 	return nil
 }
 
-// InitAndRun initializes the Scanner instance and runs the scan. It is a
-// convenience method that calls Init followed by Run.
-func (s *Scanner) InitAndRun(ctx context.Context) error {
-	if err := s.Init(ctx); err != nil {
-		return err
-	}
-	return s.Run(ctx)
-}
-
+// Cleanup performs cleanup operations for the Scanner.
 func (s *Scanner) Cleanup() {
 	// Nil checks are prevent panics if deps are not yet initialized.
 	if s.repository != nil {
 		_ = s.repository.Close()
 	}
 }
-
-func (s *Scanner) initEmbeddedLabels() error {
-	lbls, err := classification.GetEmbeddedLabels()
-	if err != nil {
-		return fmt.Errorf("error getting embedded labels: %w", err)
-	}
-	s.embeddedLabels = lbls.ToSlice()
-	return nil
-}
-
-func (s *Scanner) initLabelClassifier() error {
-	lbls := append(s.embeddedLabels, s.customLabels...)
-	c, err := classification.NewLabelClassifier(lbls...)
-	if err != nil {
-		return fmt.Errorf("error creating label classifier: %w", err)
-	}
-	s.classifier = c
-	return nil
-}
-
-func (s *Scanner) initPublisher() {
-	s.publisher = publisher.NewStdOutPublisher()
-}
-
-func (s *Scanner) initRepository(ctx context.Context) error {
-	// Connect to database
-	repo, err := repository.NewRepository(ctx, s.config.Repo)
-	if err != nil {
-		return fmt.Errorf("error connecting to database: %w", err)
-	}
-	s.repository = repo
-	return nil
-}
diff --git a/discovery/sql/denodo.go b/discovery/sql/denodo.go
new file mode 100644
index 0000000..ab82cbc
--- /dev/null
+++ b/discovery/sql/denodo.go
@@ -0,0 +1,109 @@
+package sql
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"github.com/cyralinc/dmap/discovery/config"
+
+	// Use PostgreSQL driver for Denodo
+	_ "github.com/lib/pq"
+)
+
+const (
+	RepoTypeDenodo = "denodo"
+	// DenodoIntrospectQuery is the SQL query used to introspect the database. For
+	// Denodo, the object hierarchy is (database > views). When querying
+	// Denodo, the database corresponds to a schema, and the view corresponds
+	// to a table (see SampleTable).
+	DenodoIntrospectQuery = "SELECT " +
+		"database_name AS table_schema, " +
+		"view_name AS table_name, " +
+		"column_name, " +
+		"column_type_name AS data_type " +
+		"FROM " +
+		"CATALOG_VDP_METADATA_VIEWS()"
+)
+
+// DenodoRepository is a sql.Repository implementation for Denodo.
+type DenodoRepository struct {
+	// The majority of the sql.Repository functionality is delegated to
+	// a generic SQL repository instance.
+	genericSqlRepo *GenericRepository
+}
+
+// DenodoRepository implements sql.Repository
+var _ Repository = (*DenodoRepository)(nil)
+
+// NewDenodoRepository is the constructor for sql.
+func NewDenodoRepository(cfg config.RepoConfig) (*DenodoRepository, error) {
+	pgCfg, err := ParsePostgresConfig(cfg)
+	if err != nil {
+		return nil, fmt.Errorf("unable to parse postgres config: %w", err)
+	}
+	if cfg.Database == "" {
+		return nil, errors.New("database name is mandatory for Denodo repositories")
+	}
+	connStr := fmt.Sprintf(
+		"postgresql://%s:%s@%s:%d/%s%s",
+		cfg.User,
+		cfg.Password,
+		cfg.Host,
+		cfg.Port,
+		cfg.Database,
+		pgCfg.ConnOptsStr,
+	)
+	sqlRepo, err := NewGenericRepository(
+		cfg.Host,
+		RepoTypePostgres,
+		cfg.Database,
+		connStr,
+		cfg.MaxOpenConns,
+		cfg.IncludePaths,
+		cfg.ExcludePaths,
+	)
+	if err != nil {
+		return nil, fmt.Errorf("could not instantiate generic sql repository: %w", err)
+	}
+	return &DenodoRepository{genericSqlRepo: sqlRepo}, nil
+}
+
+// TODO: godoc -ccampo 2024-04-02
+func (r *DenodoRepository) ListDatabases(_ context.Context) ([]string, error) {
+	return nil, errors.New("ListDatabases is not implemented for Denodo repositories")
+}
+
+// TODO: godoc -ccampo 2024-04-02
+func (r *DenodoRepository) Introspect(ctx context.Context) (*Metadata, error) {
+	return r.genericSqlRepo.IntrospectWithQuery(ctx, DenodoIntrospectQuery)
+}
+
+// TODO: godoc -ccampo 2024-04-02
+func (r *DenodoRepository) SampleTable(
+	ctx context.Context,
+	meta *TableMetadata,
+	params SampleParameters,
+) (Sample, error) {
+	// Denodo uses double-quotes to quote identifiers
+	attrStr := meta.QuotedAttributeNamesString("\"")
+	// The postgres driver is currently unable to properly send the
+	// parameters of a prepared statement to Denodo. Therefore, instead of
+	// building a prepared statement, we populate the query string before
+	// sending it to the driver.
+	query := fmt.Sprintf(
+		"SELECT %s FROM %s.%s OFFSET %d ROWS LIMIT %d",
+		attrStr, meta.Schema, meta.Name, params.Offset, params.SampleSize,
+	)
+	return r.genericSqlRepo.SampleTableWithQuery(ctx, meta, query)
+}
+
+// TODO: godoc -ccampo 2024-04-02
+func (r *DenodoRepository) Ping(ctx context.Context) error {
+	return r.genericSqlRepo.Ping(ctx)
+}
+
+// TODO: godoc -ccampo 2024-04-02
+func (r *DenodoRepository) Close() error {
+	return r.genericSqlRepo.Close()
+}
diff --git a/discovery/sql/doc.go b/discovery/sql/doc.go
new file mode 100644
index 0000000..51ae315
--- /dev/null
+++ b/discovery/sql/doc.go
@@ -0,0 +1,15 @@
+// Package sql provides an API for performing data discovery on SQL databases.
+// The Repository type encapsulates the concept of a Dmap data SQL repository.
+// The package provides a registry for all supported repository implementations
+// and a factory function to create new instances of a repository
+// from the registry. All supported repositories are represented as sub-packages
+// of the repository name, e.g. mysql, postgresql, etc.
+//
+// Repository implementations should reside in their own sub-package of the
+// repository package. Each implementation register itself with the repository
+// registry by calling the Register function with a RepoConstructor function
+// that returns a new instance of the repository implementation. This will make
+// the repository implementation available to the NewRepository factory
+// function. Registration is typically done in the sub-package's init function.
+// TODO: fix this doc -ccampo 2024-04-02
+package sql
diff --git a/discovery/repository/gen.go b/discovery/sql/gen.go
similarity index 90%
rename from discovery/repository/gen.go
rename to discovery/sql/gen.go
index ac2dbd4..fd4cde9 100644
--- a/discovery/repository/gen.go
+++ b/discovery/sql/gen.go
@@ -1,4 +1,4 @@
-package repository
+package sql
 
 // Mock generation - see https://vektra.github.io/mockery/
 
diff --git a/discovery/repository/genericsql/genericsql.go b/discovery/sql/generic.go
similarity index 53%
rename from discovery/repository/genericsql/genericsql.go
rename to discovery/sql/generic.go
index d7bcaeb..4941c9f 100644
--- a/discovery/repository/genericsql/genericsql.go
+++ b/discovery/sql/generic.go
@@ -1,9 +1,4 @@
-// Package genericsql provides a generic implementation of SQL functionalities
-// that works for a subset of ANSI SQL compatible databases. Many
-// repository.Repository implementations may partially or fully delegate to this
-// implementation. In that respect, it acts somewhat as a base implementation
-// which can be used by SQL-compatible repositories.
-package genericsql
+package sql
 
 import (
 	"context"
@@ -12,13 +7,11 @@ import (
 
 	log "github.com/sirupsen/logrus"
 
-	"github.com/cyralinc/dmap/discovery/repository"
-
 	"github.com/gobwas/glob"
 )
 
 const (
-	IntrospectQuery = "SELECT " +
+	GenericIntrospectQuery = "SELECT " +
 		"table_schema, " +
 		"table_name, " +
 		"column_name, " +
@@ -35,14 +28,18 @@ const (
 		"'performance_schema', " +
 		"'pg_catalog'" +
 		")"
-	PingQuery           = "SELECT 1"
-	SampleQueryTemplate = "SELECT %s FROM %s.%s LIMIT ? OFFSET ?"
+	GenericPingQuery           = "SELECT 1"
+	GenericSampleQueryTemplate = "SELECT %s FROM %s.%s LIMIT ? OFFSET ?"
 )
 
-// Repository implements generic SQL functionalities that works for a subset of
-// ANSI SQL compatible databases, and may be useful for some
-// repository.Repository implementations.
-type Repository struct {
+// GenericRepository implements generic SQL functionalities that work for a
+// subset of ANSI SQL compatible databases. Many Repository implementations may
+// partially or fully delegate to this implementation. In that respect, it acts
+// somewhat as a base implementation which can be used by SQL-compatible
+// repositories. Note however that GenericRepository is not an implementation of
+// the Repository interface, and is meant to be used as a building block for
+// other Repository implementations.
+type GenericRepository struct {
 	repoName     string
 	repoType     string
 	database     string
@@ -51,25 +48,31 @@ type Repository struct {
 	excludePaths []glob.Glob
 }
 
-// NewRepository is a constructor for the Repository type. It opens a database
-// handle for a given repoType and returns a pointer to a Repository instance. A
-// connection may or may not be established depending on the underlying database
-// type, as determined by the repoType parameter. The maxOpenConns parameter
-// specifies the maximum number of open connections to the database. The
-// repoIncludePaths and repoExcludePaths parameters are used to filter the
-// tables and columns that are introspected by the repository.
-func NewRepository(
-	repoName, repoType, database, connStr string, maxOpenConns uint,
-	repoIncludePaths, repoExcludePaths []glob.Glob,
+// NewGenericRepository is a constructor for the GenericRepository type. It
+// opens a database handle for a given repoType and returns a pointer to a new
+// GenericRepository instance. A connection may or may not be established
+// depending on the underlying database type, as determined by the repoType
+// parameter. The maxOpenConns parameter specifies the maximum number of open
+// connections to the database. The repoIncludePaths and repoExcludePaths
+// parameters are used to filter the tables and columns that are introspected by
+// the repository.
+func NewGenericRepository(
+	repoName,
+	repoType,
+	database,
+	connStr string,
+	maxOpenConns uint,
+	repoIncludePaths,
+	repoExcludePaths []glob.Glob,
 ) (
-	*Repository,
+	*GenericRepository,
 	error,
 ) {
 	db, err := getDbHandle(repoType, connStr, maxOpenConns)
 	if err != nil {
 		return nil, fmt.Errorf("error retrieving DB handle for repo type %s: %w", repoType, err)
 	}
-	return &Repository{
+	return &GenericRepository{
 		repoName:     repoName,
 		repoType:     repoType,
 		database:     database,
@@ -79,13 +82,10 @@ func NewRepository(
 	}, nil
 }
 
-// NewRepositoryFromDB instantiate a new *Repository based
-// on a given db connection. This can be used by tests to mock the database.
-func NewRepositoryFromDB(
-	repoName, repoType, database string,
-	db *sql.DB,
-) *Repository {
-	return &Repository{
+// NewGenericRepositoryFromDB instantiate a new GenericRepository based on a
+// given sql.DB handle.
+func NewGenericRepositoryFromDB(repoName, repoType, database string, db *sql.DB) *GenericRepository {
+	return &GenericRepository{
 		repoName: repoName,
 		repoType: repoType,
 		database: database,
@@ -97,13 +97,13 @@ func NewRepositoryFromDB(
 // server, as determined by the given query. The query is expected to return
 // a row set containing a single column corresponding to the database name. If
 // the query returns more than one column, an error will be returned.
-func (repo *Repository) ListDatabasesWithQuery(
+func (r *GenericRepository) ListDatabasesWithQuery(
 	ctx context.Context,
 	query string,
 	params ...any,
 ) ([]string, error) {
 	log.Tracef("Query: %s", query)
-	rows, err := repo.db.QueryContext(ctx, query, params...)
+	rows, err := r.db.QueryContext(ctx, query, params...)
 	if err != nil {
 		return nil, fmt.Errorf("error querying databases: %w", err)
 	}
@@ -124,8 +124,8 @@ func (repo *Repository) ListDatabasesWithQuery(
 }
 
 // Introspect calls IntrospectWithQuery with a default query string
-func (repo *Repository) Introspect(ctx context.Context) (*repository.Metadata, error) {
-	return repo.IntrospectWithQuery(ctx, IntrospectQuery)
+func (r *GenericRepository) Introspect(ctx context.Context) (*Metadata, error) {
+	return r.IntrospectWithQuery(ctx, GenericIntrospectQuery)
 }
 
 // IntrospectWithQuery executes a query against the information_schema table in
@@ -135,23 +135,23 @@ func (repo *Repository) Introspect(ctx context.Context) (*repository.Metadata, e
 // table_schema, table_name, column_name, data_type
 //
 // This row set represents all the columns of all the tables in the repository.
-// The row set is then parsed into an instance of repository.Metadata and
+// The row set is then parsed into an instance of Metadata and
 // returned. Additionally, any errors which occur during the query execution or
 // parsing process will be returned.
-func (repo *Repository) IntrospectWithQuery(
+func (r *GenericRepository) IntrospectWithQuery(
 	ctx context.Context,
 	query string,
-) (*repository.Metadata, error) {
+) (*Metadata, error) {
 	log.Tracef("Query: %s", query)
-	rows, err := repo.db.QueryContext(ctx, query)
+	rows, err := r.db.QueryContext(ctx, query)
 	if err != nil {
 		return nil, err
 	}
 	defer func() { _ = rows.Close() }()
 
 	repoMeta, err := newMetadataFromQueryResult(
-		repo.repoType, repo.repoName,
-		repo.database, repo.includePaths, repo.excludePaths, rows,
+		r.repoType, r.repoName,
+		r.database, r.includePaths, r.excludePaths, rows,
 	)
 	if err != nil {
 		return nil, err
@@ -159,46 +159,47 @@ func (repo *Repository) IntrospectWithQuery(
 	return repoMeta, nil
 }
 
-func (repo *Repository) SampleTable(
+// TODO: godoc -ccampo 2024-04-02
+func (r *GenericRepository) SampleTable(
 	ctx context.Context,
-	meta *repository.TableMetadata,
-	params repository.SampleParameters,
-) (repository.Sample, error) {
+	meta *TableMetadata,
+	params SampleParameters,
+) (Sample, error) {
 	// ANSI SQL uses double-quotes to quote identifiers
 	attrStr := meta.QuotedAttributeNamesString("\"")
-	query := fmt.Sprintf(SampleQueryTemplate, attrStr, meta.Schema, meta.Name)
-	return repo.SampleTableWithQuery(ctx, meta, query, params.SampleSize, params.Offset)
+	query := fmt.Sprintf(GenericSampleQueryTemplate, attrStr, meta.Schema, meta.Name)
+	return r.SampleTableWithQuery(ctx, meta, query, params.SampleSize, params.Offset)
 }
 
 // SampleTableWithQuery calls SampleTable with a custom SQL query. Any
 // placeholder parameters in the query should be passed via params.
-func (repo *Repository) SampleTableWithQuery(
+func (r *GenericRepository) SampleTableWithQuery(
 	ctx context.Context,
-	meta *repository.TableMetadata,
+	meta *TableMetadata,
 	query string,
 	params ...any,
-) (repository.Sample, error) {
+) (Sample, error) {
 	log.Tracef("Query: %s", query)
-	rows, err := repo.db.QueryContext(ctx, query, params...)
+	rows, err := r.db.QueryContext(ctx, query, params...)
 	if err != nil {
-		return repository.Sample{},
-			fmt.Errorf("error sampling %s.%s.%s: %w", repo.database, meta.Schema, meta.Name, err)
+		return Sample{},
+			fmt.Errorf("error sampling %s.%s.%s: %w", r.database, meta.Schema, meta.Name, err)
 	}
 	defer func() { _ = rows.Close() }()
 
-	sample := repository.Sample{
-		Metadata: repository.SampleMetadata{
-			Repo:     repo.repoName,
-			Database: repo.database,
+	sample := Sample{
+		Metadata: SampleMetadata{
+			Repo:     r.repoName,
+			Database: r.database,
 			Schema:   meta.Schema,
 			Table:    meta.Name,
 		},
 	}
 
 	for rows.Next() {
-		data, err := GetCurrentRowAsMap(rows)
+		data, err := getCurrentRowAsMap(rows)
 		if err != nil {
-			return repository.Sample{}, err
+			return Sample{}, err
 		}
 		sample.Results = append(sample.Results, data)
 	}
@@ -206,15 +207,16 @@ func (repo *Repository) SampleTableWithQuery(
 	// Something broke while iterating the row set
 	err = rows.Err()
 	if err != nil {
-		return repository.Sample{}, fmt.Errorf("error iterating sample data row set: %w", err)
+		return Sample{}, fmt.Errorf("error iterating sample data row set: %w", err)
 	}
 
 	return sample, nil
 }
 
-func (repo *Repository) Ping(ctx context.Context) error {
-	log.Tracef("Query: %s", PingQuery)
-	rows, err := repo.db.QueryContext(ctx, PingQuery)
+// TODO: godoc -ccampo 2024-04-02
+func (r *GenericRepository) Ping(ctx context.Context) error {
+	log.Tracef("Query: %s", GenericPingQuery)
+	rows, err := r.db.QueryContext(ctx, GenericPingQuery)
 	if err != nil {
 		return err
 	}
@@ -223,12 +225,13 @@ func (repo *Repository) Ping(ctx context.Context) error {
 }
 
 // GetDb is a getter for the repository's sql.DB handle.
-func (repo *Repository) GetDb() *sql.DB {
-	return repo.db
+func (r *GenericRepository) GetDb() *sql.DB {
+	return r.db
 }
 
-func (repo *Repository) Close() error {
-	return repo.db.Close()
+// TODO: godoc -ccampo 2024-04-02
+func (r *GenericRepository) Close() error {
+	return r.db.Close()
 }
 
 func getDbHandle(repoType, connStr string, maxOpenConns uint) (*sql.DB, error) {
@@ -246,13 +249,13 @@ func newMetadataFromQueryResult(
 	repoType, repoName, db string,
 	includePaths, excludePaths []glob.Glob, rows *sql.Rows,
 ) (
-	*repository.Metadata,
+	*Metadata,
 	error,
 ) {
-	repo := repository.NewMetadata(repoType, repoName, db)
+	repo := NewMetadata(repoType, repoName, db)
 
 	for rows.Next() {
-		var attr repository.AttributeMetadata
+		var attr AttributeMetadata
 		err := rows.Scan(&attr.Schema, &attr.Table, &attr.Name, &attr.DataType)
 		if err != nil {
 			return nil, err
@@ -274,14 +277,14 @@ func newMetadataFromQueryResult(
 			if table, ok := schema.Tables[attr.Table]; ok {
 				table.Attributes = append(table.Attributes, &attr)
 			} else { // First time seeing this table
-				table := repository.NewTableMetadata(attr.Schema, attr.Table)
+				table := NewTableMetadata(attr.Schema, attr.Table)
 				table.Attributes = append(table.Attributes, &attr)
 				schema.Tables[attr.Table] = table
 			}
 		} else { // SchemaMetadata doesn't exist - create it
-			table := repository.NewTableMetadata(attr.Schema, attr.Table)
+			table := NewTableMetadata(attr.Schema, attr.Table)
 			table.Attributes = append(table.Attributes, &attr)
-			schema := repository.NewSchemaMetadata(attr.Schema)
+			schema := NewSchemaMetadata(attr.Schema)
 			schema.Tables[attr.Table] = table
 			repo.Schemas[attr.Schema] = schema
 		}
@@ -295,6 +298,36 @@ func newMetadataFromQueryResult(
 	return repo, nil
 }
 
+// getCurrentRowAsMap transforms the current row referenced by a sql.Rows row
+// set into a map where the key is the column name and the value is the column
+// value. It is effectively an alternative to the sql.Rows.Scan method, where it
+// copies the value of the current row into a string/interface map. Note: just
+// like Scan, because this only operates on the current row pointed to by the
+// row set, this function does not iterate the row set forward. Therefore,
+// sql.Rows.Next must be called first to iterate the row set forward, and the
+// same error checking applies. The map returned represents the single,
+// current-most row pointed to by the row set iterator.
+func getCurrentRowAsMap(rows *sql.Rows) (map[string]any, error) {
+	colNames, err := rows.Columns()
+	if err != nil {
+		return nil, err
+	}
+	row := make(map[string]any, len(colNames))
+	colValues := make([]any, len(colNames))
+	colValPointers := make([]any, len(colNames))
+	for i := range colValues {
+		colValPointers[i] = &colValues[i]
+	}
+	// Scans the row into the set of column-value pointers
+	if err := rows.Scan(colValPointers...); err != nil {
+		return nil, err
+	}
+	for i, colName := range colNames {
+		row[colName] = colValues[i]
+	}
+	return row, nil
+}
+
 func matchPathPatterns(database, schema, table string, patterns []glob.Glob) bool {
 	for _, pattern := range patterns {
 		if pattern.Match(fmt.Sprintf("%s.%s.%s", database, schema, table)) {
diff --git a/discovery/repository/genericsql/genericsql_test.go b/discovery/sql/generic_test.go
similarity index 87%
rename from discovery/repository/genericsql/genericsql_test.go
rename to discovery/sql/generic_test.go
index 7b22624..a947dee 100644
--- a/discovery/repository/genericsql/genericsql_test.go
+++ b/discovery/sql/generic_test.go
@@ -1,4 +1,4 @@
-package genericsql
+package sql
 
 import (
 	"context"
@@ -9,8 +9,6 @@ import (
 	"github.com/gobwas/glob"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-
-	"github.com/cyralinc/dmap/discovery/repository"
 )
 
 func Test_Introspect_IsSuccessful(t *testing.T) {
@@ -22,7 +20,7 @@ func Test_Introspect_IsSuccessful(t *testing.T) {
 	repoType := "genericSql"
 	database := "exampleDb"
 
-	repo := Repository{
+	repo := GenericRepository{
 		repoName:     repoName,
 		repoType:     repoType,
 		database:     database,
@@ -50,18 +48,18 @@ func Test_Introspect_IsSuccessful(t *testing.T) {
 
 	meta, err := repo.Introspect(ctx)
 
-	expectedMetadata := repository.Metadata{
+	expectedMetadata := Metadata{
 		Name:     repoName,
 		RepoType: repoType,
 		Database: database,
-		Schemas: map[string]*repository.SchemaMetadata{
+		Schemas: map[string]*SchemaMetadata{
 			"schema1": {
 				Name: "schema1",
-				Tables: map[string]*repository.TableMetadata{
+				Tables: map[string]*TableMetadata{
 					"table1": {
 						Schema: "schema1",
 						Name:   "table1",
-						Attributes: []*repository.AttributeMetadata{
+						Attributes: []*AttributeMetadata{
 							{
 								Schema:   "schema1",
 								Table:    "table1",
@@ -79,7 +77,7 @@ func Test_Introspect_IsSuccessful(t *testing.T) {
 					"table2": {
 						Schema: "schema1",
 						Name:   "table2",
-						Attributes: []*repository.AttributeMetadata{
+						Attributes: []*AttributeMetadata{
 							{
 								Schema:   "schema1",
 								Table:    "table2",
@@ -92,11 +90,11 @@ func Test_Introspect_IsSuccessful(t *testing.T) {
 			},
 			"schema2": {
 				Name: "schema2",
-				Tables: map[string]*repository.TableMetadata{
+				Tables: map[string]*TableMetadata{
 					"table1": {
 						Schema: "schema2",
 						Name:   "table1",
-						Attributes: []*repository.AttributeMetadata{
+						Attributes: []*AttributeMetadata{
 							{
 								Schema:   "schema2",
 								Table:    "table1",
@@ -123,7 +121,7 @@ func Test_Introspect_QueryError(t *testing.T) {
 	repoType := "genericSql"
 	database := "exampleDb"
 
-	repo := Repository{
+	repo := GenericRepository{
 		repoName: repoName,
 		repoType: repoType,
 		database: database,
@@ -152,7 +150,7 @@ func Test_Introspect_RowError(t *testing.T) {
 	repoType := "genericSql"
 	database := "exampleDb"
 
-	repo := Repository{
+	repo := GenericRepository{
 		repoName: repoName,
 		repoType: repoType,
 		database: database,
@@ -192,7 +190,7 @@ func Test_Introspect_Filtered(t *testing.T) {
 	repoType := "genericSql"
 	database := "exampleDb"
 
-	repo := Repository{
+	repo := GenericRepository{
 		repoName: repoName,
 		repoType: repoType,
 		database: database,
@@ -230,18 +228,18 @@ func Test_Introspect_Filtered(t *testing.T) {
 
 	meta, err := repo.Introspect(ctx)
 
-	expectedMetadata := repository.Metadata{
+	expectedMetadata := Metadata{
 		Name:     repoName,
 		RepoType: repoType,
 		Database: database,
-		Schemas: map[string]*repository.SchemaMetadata{
+		Schemas: map[string]*SchemaMetadata{
 			"schema1": {
 				Name: "schema1",
-				Tables: map[string]*repository.TableMetadata{
+				Tables: map[string]*TableMetadata{
 					"table1": {
 						Schema: "schema1",
 						Name:   "table1",
-						Attributes: []*repository.AttributeMetadata{
+						Attributes: []*AttributeMetadata{
 							{
 								Schema:   "schema1",
 								Table:    "table1",
@@ -259,7 +257,7 @@ func Test_Introspect_Filtered(t *testing.T) {
 					"table2": {
 						Schema: "schema1",
 						Name:   "table2",
-						Attributes: []*repository.AttributeMetadata{
+						Attributes: []*AttributeMetadata{
 							{
 								Schema:   "schema1",
 								Table:    "table2",
@@ -272,11 +270,11 @@ func Test_Introspect_Filtered(t *testing.T) {
 			},
 			"schema2": {
 				Name: "schema2",
-				Tables: map[string]*repository.TableMetadata{
+				Tables: map[string]*TableMetadata{
 					"table1": {
 						Schema: "schema2",
 						Name:   "table1",
-						Attributes: []*repository.AttributeMetadata{
+						Attributes: []*AttributeMetadata{
 							{
 								Schema:   "schema2",
 								Table:    "table1",
diff --git a/discovery/repository/metadata.go b/discovery/sql/metadata.go
similarity index 87%
rename from discovery/repository/metadata.go
rename to discovery/sql/metadata.go
index ee29a03..dfd3c3c 100644
--- a/discovery/repository/metadata.go
+++ b/discovery/sql/metadata.go
@@ -1,14 +1,14 @@
-package repository
+package sql
 
 import (
 	"strings"
 )
 
-// Metadata represents the structure of a database repository catalog. The
-// traditional hierarchy is: Server (cluster) > Database > Schema (namespace) >
-// Table. Some database systems do not have the concept of a "database" (e.g.
-// MySQL). In those cases, the 'Database' field is expected to be an empty
-// string. See: https://stackoverflow.com/a/17943883
+// Metadata represents the structure of a SQL database. The traditional
+// hierarchy is: Server (cluster) > Database > Schema (namespace) > Table. Some
+// database systems do not have the concept of a "database" (e.g. MySQL). In
+// those cases, the 'Database' field is expected to be an empty string. See:
+// https://stackoverflow.com/a/17943883
 type Metadata struct {
 	Name     string
 	RepoType string
diff --git a/discovery/repository/metadata_test.go b/discovery/sql/metadata_test.go
similarity index 98%
rename from discovery/repository/metadata_test.go
rename to discovery/sql/metadata_test.go
index 0bc011f..f26b33c 100644
--- a/discovery/repository/metadata_test.go
+++ b/discovery/sql/metadata_test.go
@@ -1,4 +1,4 @@
-package repository
+package sql
 
 import (
 	"testing"
diff --git a/discovery/repository/mock_repository_test.go b/discovery/sql/mock_repository_test.go
similarity index 97%
rename from discovery/repository/mock_repository_test.go
rename to discovery/sql/mock_repository_test.go
index 2ee9187..a9bdf12 100644
--- a/discovery/repository/mock_repository_test.go
+++ b/discovery/sql/mock_repository_test.go
@@ -1,6 +1,6 @@
 // Code generated by mockery v2.42.1. DO NOT EDIT.
 
-package repository
+package sql
 
 import (
 	context "context"
@@ -286,7 +286,7 @@ func (_c *MockRepository_SampleTable_Call) RunAndReturn(run func(context.Context
 	return _c
 }
 
-// NewMockRepository creates a new instance of MockRepository. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
+// NewMockRepository creates a new instance of Mocksql. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
 // The first argument is typically a *testing.T value.
 func NewMockRepository(t interface {
 	mock.TestingT
diff --git a/discovery/sql/mysql.go b/discovery/sql/mysql.go
new file mode 100644
index 0000000..d98badf
--- /dev/null
+++ b/discovery/sql/mysql.go
@@ -0,0 +1,95 @@
+package sql
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/cyralinc/dmap/discovery/config"
+
+	// MySQL DB driver
+	_ "github.com/go-sql-driver/mysql"
+)
+
+const (
+	RepoTypeMysql      = "mysql"
+	MySqlDatabaseQuery = `
+SELECT 
+    schema_name
+FROM 
+    information_schema.schemata
+WHERE
+    schema_name <> 'information_schema'
+    AND schema_name <> 'performance_schema'
+    AND schema_name <> 'sys'
+`
+)
+
+// MySqlRepository is a Repository implementation for MySQL databases.
+type MySqlRepository struct {
+	// The majority of the Repository functionality is delegated to
+	// a generic SQL repository instance (genericSqlRepo).
+	genericSqlRepo *GenericRepository
+}
+
+// MySqlRepository implements Repository
+var _ Repository = (*MySqlRepository)(nil)
+
+// NewMySqlRepository creates a new MySQL sql.
+func NewMySqlRepository(cfg config.RepoConfig) (*MySqlRepository, error) {
+	connStr := fmt.Sprintf(
+		"%s:%s@tcp(%s:%d)/%s",
+		cfg.User,
+		cfg.Password,
+		cfg.Host,
+		cfg.Port,
+		// This can be an empty string. See:
+		// https://github.com/go-sql-driver/mysql#dsn-data-source-name
+		cfg.Database,
+	)
+	sqlRepo, err := NewGenericRepository(
+		cfg.Host,
+		RepoTypeMysql,
+		cfg.Database,
+		connStr,
+		cfg.MaxOpenConns,
+		cfg.IncludePaths,
+		cfg.ExcludePaths,
+	)
+	if err != nil {
+		return nil, fmt.Errorf("could not instantiate generic sql repository: %w", err)
+	}
+	return &MySqlRepository{genericSqlRepo: sqlRepo}, nil
+}
+
+// TODO: godoc -ccampo 2024-04-02
+func (r *MySqlRepository) ListDatabases(ctx context.Context) ([]string, error) {
+	return r.genericSqlRepo.ListDatabasesWithQuery(ctx, MySqlDatabaseQuery)
+}
+
+// TODO: godoc -ccampo 2024-04-02
+func (r *MySqlRepository) Introspect(ctx context.Context) (*Metadata, error) {
+	return r.genericSqlRepo.Introspect(ctx)
+}
+
+// TODO: godoc -ccampo 2024-04-02
+func (r *MySqlRepository) SampleTable(
+	ctx context.Context,
+	meta *TableMetadata,
+	params SampleParameters,
+) (Sample, error) {
+	// MySQL uses backticks to quote identifiers
+	attrStr := meta.QuotedAttributeNamesString("`")
+	// The generic select/limit/offset query and ? placeholders work fine with MySQL
+	query := fmt.Sprintf(GenericSampleQueryTemplate, attrStr, meta.Schema, meta.Name)
+	return r.genericSqlRepo.SampleTableWithQuery(ctx, meta, query, params.SampleSize, params.Offset)
+}
+
+// TODO: godoc -ccampo 2024-04-02
+func (r *MySqlRepository) Ping(ctx context.Context) error {
+	return r.genericSqlRepo.Ping(ctx)
+}
+
+// TODO: godoc -ccampo 2024-04-02
+func (r *MySqlRepository) Close() error {
+	return r.genericSqlRepo.Close()
+}
diff --git a/discovery/repository/mysql/mysql_test.go b/discovery/sql/mysql_test.go
similarity index 50%
rename from discovery/repository/mysql/mysql_test.go
rename to discovery/sql/mysql_test.go
index 8135b60..1ee978c 100644
--- a/discovery/repository/mysql/mysql_test.go
+++ b/discovery/sql/mysql_test.go
@@ -1,4 +1,4 @@
-package mysql
+package sql
 
 import (
 	"context"
@@ -7,25 +7,23 @@ import (
 
 	"github.com/DATA-DOG/go-sqlmock"
 	"github.com/stretchr/testify/require"
-
-	"github.com/cyralinc/dmap/discovery/repository/genericsql"
 )
 
-func TestListDatabases(t *testing.T) {
-	ctx, db, mock, r := initRepoTest(t)
+func TestMySqlRepository_ListDatabases(t *testing.T) {
+	ctx, db, mock, r := initMySqlRepoTest(t)
 	defer func() { _ = db.Close() }()
 	dbRows := sqlmock.NewRows([]string{"name"}).AddRow("db1").AddRow("db2")
-	mock.ExpectQuery(DatabaseQuery).WillReturnRows(dbRows)
+	mock.ExpectQuery(MySqlDatabaseQuery).WillReturnRows(dbRows)
 	dbs, err := r.ListDatabases(ctx)
 	require.NoError(t, err)
 	require.ElementsMatch(t, []string{"db1", "db2"}, dbs)
 }
 
-func initRepoTest(t *testing.T) (context.Context, *sql.DB, sqlmock.Sqlmock, *Repository) {
+func initMySqlRepoTest(t *testing.T) (context.Context, *sql.DB, sqlmock.Sqlmock, *MySqlRepository) {
 	ctx := context.Background()
 	db, mock, err := sqlmock.New()
 	require.NoError(t, err)
-	return ctx, db, mock, &Repository{
-		genericSqlRepo: genericsql.NewRepositoryFromDB("repoName", RepoTypeMysql, "dbName", db),
+	return ctx, db, mock, &MySqlRepository{
+		genericSqlRepo: NewGenericRepositoryFromDB("repoName", RepoTypeMysql, "dbName", db),
 	}
 }
diff --git a/discovery/sql/oracle.go b/discovery/sql/oracle.go
new file mode 100644
index 0000000..45837ed
--- /dev/null
+++ b/discovery/sql/oracle.go
@@ -0,0 +1,139 @@
+package sql
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"github.com/cyralinc/dmap/discovery/config"
+
+	// Oracle DB driver
+	_ "github.com/sijms/go-ora/v2"
+)
+
+const (
+	RepoTypeOracle        = "oracle"
+	OracleIntrospectQuery = `
+WITH users AS (
+  SELECT
+    username
+  FROM
+    sys.all_users
+  WHERE
+    oracle_maintained = 'N' AND
+    username <> 'RDSADMIN'
+)
+SELECT
+  owner AS table_schema,
+  table_name,
+  column_name,
+  data_type
+FROM
+  sys.all_tab_columns
+INNER JOIN
+  users
+ON
+  owner = users.username
+`
+	configServiceName = "service-name"
+)
+
+// OracleRepository is a Repository implementation for Oracle databases.
+type OracleRepository struct {
+	// The majority of the OracleRepository functionality is delegated to
+	// a generic SQL repository instance (genericSqlRepo).
+	genericSqlRepo *GenericRepository
+}
+
+// OracleRepository implements Repository
+var _ Repository = (*OracleRepository)(nil)
+
+// NewOracleRepository creates a new Oracle repository.
+func NewOracleRepository(cfg config.RepoConfig) (*OracleRepository, error) {
+	oracleCfg, err := ParseOracleConfig(cfg)
+	if err != nil {
+		return nil, fmt.Errorf("unable to parse oracle config: %w", err)
+	}
+	connStr := fmt.Sprintf(
+		`oracle://%s:%s@%s:%d/%s`,
+		cfg.User,
+		cfg.Password,
+		cfg.Host,
+		cfg.Port,
+		oracleCfg.ServiceName,
+	)
+	sqlRepo, err := NewGenericRepository(
+		cfg.Host,
+		RepoTypeOracle,
+		cfg.Database,
+		connStr,
+		cfg.MaxOpenConns,
+		cfg.IncludePaths,
+		cfg.ExcludePaths,
+	)
+	if err != nil {
+		return nil, fmt.Errorf("could not instantiate generic sql repository: %w", err)
+	}
+	return &OracleRepository{genericSqlRepo: sqlRepo}, nil
+}
+
+// ListDatabases is left unimplemented for Oracle, because Oracle doesn't have
+// the traditional concept of "databases". Note that Introspect already
+// identifies all the accessible objects on the server.
+func (r *OracleRepository) ListDatabases(_ context.Context) ([]string, error) {
+	return nil, errors.New("ListDatabases is not implemented for Oracle repos")
+}
+
+// TODO: godoc -ccampo 2024-04-02
+func (r *OracleRepository) Introspect(ctx context.Context) (*Metadata, error) {
+	return r.genericSqlRepo.IntrospectWithQuery(ctx, OracleIntrospectQuery)
+}
+
+// TODO: godoc -ccampo 2024-04-02
+func (r *OracleRepository) SampleTable(
+	ctx context.Context,
+	meta *TableMetadata,
+	params SampleParameters,
+) (Sample, error) {
+	// Oracle uses double-quotes to quote identifiers
+	attrStr := meta.QuotedAttributeNamesString("\"")
+	// Oracle uses :x for placeholders
+	query := fmt.Sprintf(
+		"SELECT %s FROM %s.%s OFFSET :1 ROWS FETCH NEXT :2 ROWS ONLY",
+		attrStr, meta.Schema, meta.Name,
+	)
+	return r.genericSqlRepo.SampleTableWithQuery(ctx, meta, query, params.Offset, params.SampleSize)
+}
+
+// Ping verifies the connection to Oracle database used by this Oracle
+// Normally we would just delegate to the Ping method implemented by
+// genericOracle However, that implementation executes a
+// 'SELECT 1' query to test for connectivity, and Oracle being Oracle, does not
+// like this. So instead, we defer to the native Ping method implemented by the
+// Oracle DB driver.
+func (r *OracleRepository) Ping(ctx context.Context) error {
+	return r.genericSqlRepo.GetDb().PingContext(ctx)
+}
+
+// TODO: godoc -ccampo 2024-04-02
+func (r *OracleRepository) Close() error {
+	return r.genericSqlRepo.Close()
+}
+
+// TODO: godoc -ccampo 2024-04-02
+type OracleConfig struct {
+	ServiceName string
+}
+
+// TODO: godoc -ccampo 2024-04-02
+func ParseOracleConfig(cfg config.RepoConfig) (*OracleConfig, error) {
+	oracleCfg, err := config.FetchAdvancedConfigString(
+		cfg,
+		RepoTypeOracle,
+		[]string{configServiceName},
+	)
+	if err != nil {
+		return nil, fmt.Errorf("error fetching advanced oracle config: %w", err)
+	}
+	return &OracleConfig{ServiceName: oracleCfg[configServiceName]}, nil
+}
diff --git a/discovery/sql/postgres.go b/discovery/sql/postgres.go
new file mode 100644
index 0000000..9ec2322
--- /dev/null
+++ b/discovery/sql/postgres.go
@@ -0,0 +1,122 @@
+package sql
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/cyralinc/dmap/discovery/config"
+
+	// Postgresql DB driver
+	_ "github.com/lib/pq"
+)
+
+const (
+	RepoTypePostgres = "postgres"
+
+	PostgresDatabaseQuery = `
+SELECT 
+	datname 
+FROM
+	pg_database
+WHERE
+	datistemplate = false
+	AND datallowconn = true
+	AND datname <> 'rdsadmin'
+`
+)
+
+// PostgresRepository is a Repository implementation for Postgres databases.
+type PostgresRepository struct {
+	// The majority of the Repository functionality is delegated to
+	// a generic SQL repository instance (genericSqlRepo).
+	genericSqlRepo *GenericRepository
+}
+
+// PostgresRepository implements Repository
+var _ Repository = (*PostgresRepository)(nil)
+
+// NewPostgresRepository creates a new PostgresRepository.
+func NewPostgresRepository(cfg config.RepoConfig) (*PostgresRepository, error) {
+	pgCfg, err := ParsePostgresConfig(cfg)
+	if err != nil {
+		return nil, fmt.Errorf("error parsing postgres config: %w", err)
+	}
+	database := cfg.Database
+	// Connect to the default database, if unspecified.
+	if database == "" {
+		database = "postgres"
+	}
+	connStr := fmt.Sprintf(
+		"postgresql://%s:%s@%s:%d/%s%s",
+		cfg.User,
+		cfg.Password,
+		cfg.Host,
+		cfg.Port,
+		database,
+		pgCfg.ConnOptsStr,
+	)
+	sqlRepo, err := NewGenericRepository(
+		cfg.Host,
+		RepoTypePostgres,
+		cfg.Database,
+		connStr,
+		cfg.MaxOpenConns,
+		cfg.IncludePaths,
+		cfg.ExcludePaths,
+	)
+	if err != nil {
+		return nil, fmt.Errorf("could not instantiate generic sql repository: %w", err)
+	}
+	return &PostgresRepository{genericSqlRepo: sqlRepo}, nil
+}
+
+// TODO: godoc -ccampo 2024-04-02
+func (r *PostgresRepository) ListDatabases(ctx context.Context) ([]string, error) {
+	return r.genericSqlRepo.ListDatabasesWithQuery(ctx, PostgresDatabaseQuery)
+}
+
+// TODO: godoc -ccampo 2024-04-02
+func (r *PostgresRepository) Introspect(ctx context.Context) (*Metadata, error) {
+	return r.genericSqlRepo.Introspect(ctx)
+}
+
+// TODO: godoc -ccampo 2024-04-02
+func (r *PostgresRepository) SampleTable(
+	ctx context.Context,
+	meta *TableMetadata,
+	params SampleParameters,
+) (Sample, error) {
+	// Postgres uses double-quotes to quote identifiers
+	attrStr := meta.QuotedAttributeNamesString("\"")
+	// Postgres uses $x for placeholders
+	query := fmt.Sprintf("SELECT %s FROM %s.%s LIMIT $1 OFFSET $2", attrStr, meta.Schema, meta.Name)
+	return r.genericSqlRepo.SampleTableWithQuery(ctx, meta, query, params.SampleSize, params.Offset)
+}
+
+// TODO: godoc -ccampo 2024-04-02
+func (r *PostgresRepository) Ping(ctx context.Context) error {
+	return r.genericSqlRepo.Ping(ctx)
+}
+
+// TODO: godoc -ccampo 2024-04-02
+func (r *PostgresRepository) Close() error {
+	return r.genericSqlRepo.Close()
+}
+
+// TODO: godoc -ccampo 2024-04-02
+type PostgresConfig struct {
+	ConnOptsStr string
+}
+
+// ParsePostgresConfig produces a config structure with Postgres-specific
+// parameters found in the repo config.
+func ParsePostgresConfig(cfg config.RepoConfig) (*PostgresConfig, error) {
+	connOptsStr, err := config.BuildConnOptsStr(cfg)
+	if err != nil {
+		return nil, err
+	}
+
+	return &PostgresConfig{
+		ConnOptsStr: connOptsStr,
+	}, nil
+}
diff --git a/discovery/repository/postgresql/postgresql_test.go b/discovery/sql/postgres_test.go
similarity index 50%
rename from discovery/repository/postgresql/postgresql_test.go
rename to discovery/sql/postgres_test.go
index 7b90716..b586a63 100644
--- a/discovery/repository/postgresql/postgresql_test.go
+++ b/discovery/sql/postgres_test.go
@@ -1,4 +1,4 @@
-package postgresql
+package sql
 
 import (
 	"context"
@@ -7,25 +7,23 @@ import (
 
 	"github.com/DATA-DOG/go-sqlmock"
 	"github.com/stretchr/testify/require"
-
-	"github.com/cyralinc/dmap/discovery/repository/genericsql"
 )
 
-func TestListDatabases(t *testing.T) {
-	ctx, db, mock, r := initRepoTest(t)
+func TestPostgresRepository_ListDatabases(t *testing.T) {
+	ctx, db, mock, r := initPostgresRepoTest(t)
 	defer func() { _ = db.Close() }()
 	dbRows := sqlmock.NewRows([]string{"name"}).AddRow("db1").AddRow("db2")
-	mock.ExpectQuery(DatabaseQuery).WillReturnRows(dbRows)
+	mock.ExpectQuery(PostgresDatabaseQuery).WillReturnRows(dbRows)
 	dbs, err := r.ListDatabases(ctx)
 	require.NoError(t, err)
 	require.ElementsMatch(t, []string{"db1", "db2"}, dbs)
 }
 
-func initRepoTest(t *testing.T) (context.Context, *sql.DB, sqlmock.Sqlmock, *Repository) {
+func initPostgresRepoTest(t *testing.T) (context.Context, *sql.DB, sqlmock.Sqlmock, *PostgresRepository) {
 	ctx := context.Background()
 	db, mock, err := sqlmock.New()
 	require.NoError(t, err)
-	return ctx, db, mock, &Repository{
-		genericSqlRepo: genericsql.NewRepositoryFromDB("repoName", RepoTypePostgres, "dbName", db),
+	return ctx, db, mock, &PostgresRepository{
+		genericSqlRepo: NewGenericRepositoryFromDB("repoName", RepoTypePostgres, "dbName", db),
 	}
 }
diff --git a/discovery/sql/redshift.go b/discovery/sql/redshift.go
new file mode 100644
index 0000000..c7165fb
--- /dev/null
+++ b/discovery/sql/redshift.go
@@ -0,0 +1,94 @@
+package sql
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/cyralinc/dmap/discovery/config"
+
+	// Use PostgreSQL DB driver for Redshift
+	_ "github.com/lib/pq"
+)
+
+const (
+	RepoTypeRedshift = "redshift"
+)
+
+// RedshiftRepository is a Repository implementation for Redshift databases.
+type RedshiftRepository struct {
+	// The majority of the RedshiftRepository functionality is delegated to
+	// a generic SQL repository instance (genericSqlRepo).
+	genericSqlRepo *GenericRepository
+}
+
+// RedshiftRepository implements Repository
+var _ Repository = (*RedshiftRepository)(nil)
+
+// NewRedshiftRepository creates a new RedshiftRepository.
+func NewRedshiftRepository(cfg config.RepoConfig) (*RedshiftRepository, error) {
+	pgCfg, err := ParsePostgresConfig(cfg)
+	if err != nil {
+		return nil, fmt.Errorf("unable to parse postgres config: %w", err)
+	}
+	database := cfg.Database
+	// Connect to the default database, if unspecified.
+	if database == "" {
+		database = "dev"
+	}
+	connStr := fmt.Sprintf(
+		"postgresql://%s:%s@%s:%d/%s%s",
+		cfg.User,
+		cfg.Password,
+		cfg.Host,
+		cfg.Port,
+		database,
+		pgCfg.ConnOptsStr,
+	)
+	sqlRepo, err := NewGenericRepository(
+		cfg.Host,
+		RepoTypePostgres,
+		cfg.Database,
+		connStr,
+		cfg.MaxOpenConns,
+		cfg.IncludePaths,
+		cfg.ExcludePaths,
+	)
+	if err != nil {
+		return nil, fmt.Errorf("could not instantiate generic sql repository: %w", err)
+	}
+	return &RedshiftRepository{genericSqlRepo: sqlRepo}, nil
+}
+
+// TODO: godoc -ccampo 2024-04-02
+func (r *RedshiftRepository) ListDatabases(ctx context.Context) ([]string, error) {
+	// Redshift and Postgres use the same query to list the server databases.
+	return r.genericSqlRepo.ListDatabasesWithQuery(ctx, PostgresDatabaseQuery)
+}
+
+// TODO: godoc -ccampo 2024-04-02
+func (r *RedshiftRepository) Introspect(ctx context.Context) (*Metadata, error) {
+	return r.genericSqlRepo.Introspect(ctx)
+}
+
+// TODO: godoc -ccampo 2024-04-02
+func (r *RedshiftRepository) SampleTable(
+	ctx context.Context,
+	meta *TableMetadata,
+	params SampleParameters,
+) (Sample, error) {
+	// Redshift uses double-quotes to quote identifiers
+	attrStr := meta.QuotedAttributeNamesString("\"")
+	// Redshift uses $x for placeholders
+	query := fmt.Sprintf("SELECT %s FROM %s.%s LIMIT $1 OFFSET $2", attrStr, meta.Schema, meta.Name)
+	return r.genericSqlRepo.SampleTableWithQuery(ctx, meta, query, params.SampleSize, params.Offset)
+}
+
+// TODO: godoc -ccampo 2024-04-02
+func (r *RedshiftRepository) Ping(ctx context.Context) error {
+	return r.genericSqlRepo.Ping(ctx)
+}
+
+// TODO: godoc -ccampo 2024-04-02
+func (r *RedshiftRepository) Close() error {
+	return r.genericSqlRepo.Close()
+}
diff --git a/discovery/sql/redshift_test.go b/discovery/sql/redshift_test.go
new file mode 100644
index 0000000..5b28bfd
--- /dev/null
+++ b/discovery/sql/redshift_test.go
@@ -0,0 +1,29 @@
+package sql
+
+import (
+	"context"
+	"database/sql"
+	"testing"
+
+	"github.com/DATA-DOG/go-sqlmock"
+	"github.com/stretchr/testify/require"
+)
+
+func TestRedshiftRepository_ListDatabases(t *testing.T) {
+	ctx, db, mock, r := initRedshiftRepoTest(t)
+	defer func() { _ = db.Close() }()
+	dbRows := sqlmock.NewRows([]string{"name"}).AddRow("db1").AddRow("db2")
+	mock.ExpectQuery(PostgresDatabaseQuery).WillReturnRows(dbRows)
+	dbs, err := r.ListDatabases(ctx)
+	require.NoError(t, err)
+	require.ElementsMatch(t, []string{"db1", "db2"}, dbs)
+}
+
+func initRedshiftRepoTest(t *testing.T) (context.Context, *sql.DB, sqlmock.Sqlmock, *RedshiftRepository) {
+	ctx := context.Background()
+	db, mock, err := sqlmock.New()
+	require.NoError(t, err)
+	return ctx, db, mock, &RedshiftRepository{
+		genericSqlRepo: NewGenericRepositoryFromDB("repoName", RepoTypeRedshift, "dbName", db),
+	}
+}
diff --git a/discovery/sql/registry.go b/discovery/sql/registry.go
new file mode 100644
index 0000000..2915a15
--- /dev/null
+++ b/discovery/sql/registry.go
@@ -0,0 +1,133 @@
+package sql
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"github.com/cyralinc/dmap/discovery/config"
+)
+
+var (
+	// TODO: godoc -ccampo 2024-04-02
+	DefaultRegistry = NewRegistry()
+)
+
+// TODO: godoc -ccampo 2024-04-02
+type Registry struct {
+	constructors map[string]RepoConstructor
+}
+
+// RepoConstructor represents the function signature that all repository
+// implementations should use for their constructor functions.
+type RepoConstructor func(ctx context.Context, cfg config.RepoConfig) (Repository, error)
+
+// TODO: godoc -ccampo 2024-04-02
+func NewRegistry() *Registry {
+	return &Registry{constructors: make(map[string]RepoConstructor)}
+}
+
+// Register makes a repository available by the provided repository type. If
+// Register is called twice with the same repoType, or if constructor is nil, it
+// returns an error. Note that Register is not thread-safe. It is
+// expected to be called from either a package's init function, or from the
+// program's main function.
+func (r *Registry) Register(repoType string, constructor RepoConstructor) error {
+	if constructor == nil {
+		return fmt.Errorf("attempt to register nil constructor for repoType %s", repoType)
+	}
+	if r.constructors == nil {
+		r.constructors = make(map[string]RepoConstructor)
+	}
+	if _, dup := r.constructors[repoType]; dup {
+		return fmt.Errorf("register called twice for repoType %s", repoType)
+	}
+	r.constructors[repoType] = constructor
+	return nil
+}
+
+// MustRegister is the same as Registry.Register, but panics if an error occurs.
+func (r *Registry) MustRegister(repoType string, constructor RepoConstructor) {
+	if err := r.Register(repoType, constructor); err != nil {
+		panic(err)
+	}
+}
+
+// NewRepository is a factory method to return a concrete Repository
+// implementation based on the specified type, e.g. MySQL, PostgreSQL, MSSQL,
+// etc.
+func (r *Registry) NewRepository(ctx context.Context, cfg config.RepoConfig) (Repository, error) {
+	constructor, ok := r.constructors[cfg.Type]
+	if !ok {
+		return nil, errors.New("unsupported repo type " + cfg.Type)
+	}
+	repo, err := constructor(ctx, cfg)
+	if err != nil {
+		return nil, fmt.Errorf("error creating repository, %w", err)
+	}
+	return repo, nil
+}
+
+// Register is a convenience function that delegates to DefaultRegistry. See
+// Registry.Register for more details.
+func Register(repoType string, constructor RepoConstructor) error {
+	return DefaultRegistry.Register(repoType, constructor)
+}
+
+// MustRegister is a convenience function that delegates to DefaultRegistry. See
+// Registry.MustRegister for more details.
+func MustRegister(repoType string, constructor RepoConstructor) {
+	DefaultRegistry.MustRegister(repoType, constructor)
+}
+
+// NewRepository is a convenience function that delegates to DefaultRegistry.
+// See Registry.NewRepository for more details.
+func NewRepository(ctx context.Context, cfg config.RepoConfig) (Repository, error) {
+	return DefaultRegistry.NewRepository(ctx, cfg)
+}
+
+// TODO: godoc -ccampo 2024-04-02
+func init() {
+	MustRegister(
+		RepoTypeDenodo,
+		func(_ context.Context, cfg config.RepoConfig) (Repository, error) {
+			return NewDenodoRepository(cfg)
+		},
+	)
+	MustRegister(
+		RepoTypeMysql,
+		func(_ context.Context, cfg config.RepoConfig) (Repository, error) {
+			return NewMySqlRepository(cfg)
+		},
+	)
+	MustRegister(
+		RepoTypeOracle,
+		func(_ context.Context, cfg config.RepoConfig) (Repository, error) {
+			return NewOracleRepository(cfg)
+		},
+	)
+	MustRegister(
+		RepoTypePostgres,
+		func(_ context.Context, cfg config.RepoConfig) (Repository, error) {
+			return NewPostgresRepository(cfg)
+		},
+	)
+	MustRegister(
+		RepoTypeRedshift,
+		func(_ context.Context, cfg config.RepoConfig) (Repository, error) {
+			return NewRedshiftRepository(cfg)
+		},
+	)
+	MustRegister(
+		RepoTypeSnowflake,
+		func(ctx context.Context, cfg config.RepoConfig) (Repository, error) {
+			return NewSnowflakeRepository(cfg)
+		},
+	)
+	MustRegister(
+		RepoTypeSqlServer,
+		func(_ context.Context, cfg config.RepoConfig) (Repository, error) {
+			return NewSqlServerRepository(cfg)
+		},
+	)
+}
diff --git a/discovery/sql/repository.go b/discovery/sql/repository.go
new file mode 100644
index 0000000..b2fa873
--- /dev/null
+++ b/discovery/sql/repository.go
@@ -0,0 +1,36 @@
+package sql
+
+import (
+	"context"
+)
+
+// Repository represents a Dmap data SQL repository, and provides functionality
+// to introspect its corresponding schema.
+type Repository interface {
+	// ListDatabases returns a list of the names of all databases on the server.
+	ListDatabases(ctx context.Context) ([]string, error)
+
+	// Introspect will read and analyze the basic properties of the repository
+	// and return as a Metadata instance. This includes all the repository's
+	// databases, schemas, tables, columns, and attributes.
+	Introspect(ctx context.Context) (*Metadata, error)
+
+	// SampleTable samples the table referenced by the TableMetadata meta
+	// parameter and returns the sample as a slice of Sample. The parameters for
+	// the sample, such as sample size, are passed via the params parameter (see
+	// SampleParameters for more details). The returned sample result set
+	// contains one Sample for each table row sampled. The length of the results
+	// will be less than or equal to the sample size. If there are fewer results
+	// than the specified sample size, it is because the table in question had a
+	// row count less than the sample size. Prefer small sample sizes to limit
+	// impact on the database.
+	SampleTable(ctx context.Context, meta *TableMetadata, params SampleParameters) (Sample, error)
+
+	// Ping is meant to be used as a general purpose connectivity test. It
+	// should be invoked e.g. in the dry-run mode.
+	Ping(ctx context.Context) error
+
+	// Close is meant to be used as a general purpose cleanup. It should be
+	// invoked when the Repository is no longer used.
+	Close() error
+}
diff --git a/discovery/repository/repository_test.go b/discovery/sql/repository_test.go
similarity index 99%
rename from discovery/repository/repository_test.go
rename to discovery/sql/repository_test.go
index 4b25138..049440f 100644
--- a/discovery/repository/repository_test.go
+++ b/discovery/sql/repository_test.go
@@ -1,4 +1,4 @@
-package repository
+package sql
 
 import (
 	"context"
diff --git a/discovery/repository/sample_all_databases_test.go b/discovery/sql/sample_all_databases_test.go
similarity index 99%
rename from discovery/repository/sample_all_databases_test.go
rename to discovery/sql/sample_all_databases_test.go
index 3afe44f..fad87eb 100644
--- a/discovery/repository/sample_all_databases_test.go
+++ b/discovery/sql/sample_all_databases_test.go
@@ -1,4 +1,4 @@
-package repository
+package sql
 
 import (
 	"context"
diff --git a/discovery/repository/sample_repository_test.go b/discovery/sql/sample_repository_test.go
similarity index 99%
rename from discovery/repository/sample_repository_test.go
rename to discovery/sql/sample_repository_test.go
index fde10fb..ecc2449 100644
--- a/discovery/repository/sample_repository_test.go
+++ b/discovery/sql/sample_repository_test.go
@@ -1,4 +1,4 @@
-package repository
+package sql
 
 import (
 	"context"
diff --git a/discovery/repository/sampling.go b/discovery/sql/sampling.go
similarity index 97%
rename from discovery/repository/sampling.go
rename to discovery/sql/sampling.go
index b7f34a7..ec4d5dc 100644
--- a/discovery/repository/sampling.go
+++ b/discovery/sql/sampling.go
@@ -1,4 +1,4 @@
-package repository
+package sql
 
 import (
 	"context"
@@ -79,9 +79,9 @@ func (result SampleResult) GetAttributeNamesAndValues() ([]string, []string) {
 
 // SampleRepository is a helper function which will sample every table in a
 // given repository and return them as a collection of Sample. First the
-// repository is introspected by calling Repository.Introspect to return the
+// repository is introspected by calling sql.Introspect to return the
 // repository metadata (Metadata). Then, for each schema and table in the
-// metadata, it calls Repository.SampleTable in a new goroutine. Once all the
+// metadata, it calls sql.SampleTable in a new goroutine. Once all the
 // sampling goroutines are finished, their results are collected and returned
 // as a slice of Sample.
 func SampleRepository(ctx context.Context, repo Repository, params SampleParameters) (
diff --git a/discovery/repository/sampling_test.go b/discovery/sql/sampling_test.go
similarity index 98%
rename from discovery/repository/sampling_test.go
rename to discovery/sql/sampling_test.go
index 1bbdfe7..8bdceb7 100644
--- a/discovery/repository/sampling_test.go
+++ b/discovery/sql/sampling_test.go
@@ -1,4 +1,4 @@
-package repository
+package sql
 
 import (
 	"testing"
diff --git a/discovery/sql/snowflake.go b/discovery/sql/snowflake.go
new file mode 100644
index 0000000..de00ad2
--- /dev/null
+++ b/discovery/sql/snowflake.go
@@ -0,0 +1,125 @@
+package sql
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/cyralinc/dmap/discovery/config"
+
+	// Snowflake DB driver
+	_ "github.com/snowflakedb/gosnowflake"
+)
+
+const (
+	RepoTypeSnowflake      = "snowflake"
+	SnowflakeDatabaseQuery = `
+SELECT 
+    DATABASE_NAME 
+FROM 
+    INFORMATION_SCHEMA.DATABASES 
+WHERE 
+    IS_TRANSIENT = 'NO'
+`
+	configAccount   = "account"
+	configRole      = "role"
+	configWarehouse = "warehouse"
+)
+
+// SnowflakeRepository is a Repository implementation for Snowflake databases.
+type SnowflakeRepository struct {
+	// The majority of the Repository functionality is delegated to
+	// a generic SQL repository instance (genericSqlRepo).
+	genericSqlRepo *GenericRepository
+}
+
+// SnowflakeRepository implements Repository
+var _ Repository = (*SnowflakeRepository)(nil)
+
+// NewSnowflakeRepository creates a new SnowflakeRepository.
+func NewSnowflakeRepository(cfg config.RepoConfig) (*SnowflakeRepository, error) {
+	snowflakeCfg, err := ParseSnowflakeConfig(cfg)
+	if err != nil {
+		return nil, fmt.Errorf("error parsing snowflake config: %w", err)
+	}
+	database := cfg.Database
+	// Connect to the default database, if unspecified.
+	if database == "" {
+		database = "SNOWFLAKE"
+	}
+	connStr := fmt.Sprintf(
+		"%s:%s@%s/%s?role=%s&warehouse=%s",
+		cfg.User,
+		cfg.Password,
+		snowflakeCfg.Account,
+		cfg.Database,
+		snowflakeCfg.Role,
+		snowflakeCfg.Warehouse,
+	)
+	sqlRepo, err := NewGenericRepository(
+		cfg.Host,
+		RepoTypeSnowflake,
+		database,
+		connStr,
+		cfg.MaxOpenConns,
+		cfg.IncludePaths,
+		cfg.ExcludePaths,
+	)
+	if err != nil {
+		return nil, fmt.Errorf("could not instantiate generic sql repository: %w", err)
+	}
+	return &SnowflakeRepository{genericSqlRepo: sqlRepo}, nil
+}
+
+// TODO: godoc -ccampo 2024-04-02
+func (r *SnowflakeRepository) ListDatabases(ctx context.Context) ([]string, error) {
+	return r.genericSqlRepo.ListDatabasesWithQuery(ctx, SnowflakeDatabaseQuery)
+}
+
+// TODO: godoc -ccampo 2024-04-02
+func (r *SnowflakeRepository) Introspect(ctx context.Context) (*Metadata, error) {
+	return r.genericSqlRepo.Introspect(ctx)
+}
+
+// TODO: godoc -ccampo 2024-04-02
+func (r *SnowflakeRepository) SampleTable(
+	ctx context.Context,
+	meta *TableMetadata,
+	params SampleParameters,
+) (Sample, error) {
+	return r.genericSqlRepo.SampleTable(ctx, meta, params)
+}
+
+// TODO: godoc -ccampo 2024-04-02
+func (r *SnowflakeRepository) Ping(ctx context.Context) error {
+	return r.genericSqlRepo.Ping(ctx)
+}
+
+// TODO: godoc -ccampo 2024-04-02
+func (r *SnowflakeRepository) Close() error {
+	return r.genericSqlRepo.Close()
+}
+
+// TODO: godoc -ccampo 2024-04-02
+type SnowflakeConfig struct {
+	Account   string
+	Role      string
+	Warehouse string
+}
+
+// ParseSnowflakeConfig produces a config structure with Snowflake-specific
+// parameters found in the repo config.
+func ParseSnowflakeConfig(cfg config.RepoConfig) (*SnowflakeConfig, error) {
+	snowflakeCfg, err := config.FetchAdvancedConfigString(
+		cfg,
+		RepoTypeSnowflake,
+		[]string{configAccount, configRole, configWarehouse},
+	)
+	if err != nil {
+		return nil, fmt.Errorf("error fetching advanced config string: %w", err)
+	}
+	return &SnowflakeConfig{
+		Account:   snowflakeCfg[configAccount],
+		Role:      snowflakeCfg[configRole],
+		Warehouse: snowflakeCfg[configWarehouse],
+	}, nil
+}
diff --git a/discovery/repository/snowflake/snowflake_test.go b/discovery/sql/snowflake_test.go
similarity index 50%
rename from discovery/repository/snowflake/snowflake_test.go
rename to discovery/sql/snowflake_test.go
index 82dd71b..ebb7988 100644
--- a/discovery/repository/snowflake/snowflake_test.go
+++ b/discovery/sql/snowflake_test.go
@@ -1,4 +1,4 @@
-package snowflake
+package sql
 
 import (
 	"context"
@@ -7,25 +7,23 @@ import (
 
 	"github.com/DATA-DOG/go-sqlmock"
 	"github.com/stretchr/testify/require"
-
-	"github.com/cyralinc/dmap/discovery/repository/genericsql"
 )
 
-func TestListDatabases(t *testing.T) {
-	ctx, db, mock, r := initRepoTest(t)
+func TestSnowflakeRepository_ListDatabases(t *testing.T) {
+	ctx, db, mock, r := initSnowflakeRepoTest(t)
 	defer func() { _ = db.Close() }()
 	dbRows := sqlmock.NewRows([]string{"name"}).AddRow("db1").AddRow("db2")
-	mock.ExpectQuery(DatabaseQuery).WillReturnRows(dbRows)
+	mock.ExpectQuery(SnowflakeDatabaseQuery).WillReturnRows(dbRows)
 	dbs, err := r.ListDatabases(ctx)
 	require.NoError(t, err)
 	require.ElementsMatch(t, []string{"db1", "db2"}, dbs)
 }
 
-func initRepoTest(t *testing.T) (context.Context, *sql.DB, sqlmock.Sqlmock, *Repository) {
+func initSnowflakeRepoTest(t *testing.T) (context.Context, *sql.DB, sqlmock.Sqlmock, *SnowflakeRepository) {
 	ctx := context.Background()
 	db, mock, err := sqlmock.New()
 	require.NoError(t, err)
-	return ctx, db, mock, &Repository{
-		genericSqlRepo: genericsql.NewRepositoryFromDB("repoName", RepoTypeSnowflake, "dbName", db),
+	return ctx, db, mock, &SnowflakeRepository{
+		genericSqlRepo: NewGenericRepositoryFromDB("repoName", RepoTypeSnowflake, "dbName", db),
 	}
 }
diff --git a/discovery/sql/sqlserver.go b/discovery/sql/sqlserver.go
new file mode 100644
index 0000000..77b4ccc
--- /dev/null
+++ b/discovery/sql/sqlserver.go
@@ -0,0 +1,95 @@
+package sql
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/cyralinc/dmap/discovery/config"
+
+	// SQL Server DB driver
+	_ "github.com/denisenkom/go-mssqldb"
+)
+
+const (
+	RepoTypeSqlServer = "sqlserver"
+	// SqlServerSampleQueryTemplate is the string template for the SQL query used to
+	// sample a SQL Server database. SQL Server doesn't support limit/offset, so
+	// we use top. It also uses the @ symbol for statement parameter
+	// placeholders. It is intended to be templated by the database name to
+	// query.
+	SqlServerSampleQueryTemplate = `SELECT TOP (@p1) %s FROM "%s"."%s"`
+	// SqlServerDatabaseQuery is the query to list all the databases on the server, minus
+	// the system default databases 'model' and 'tempdb'.
+	SqlServerDatabaseQuery = "SELECT name FROM sys.databases WHERE name != 'model' AND name != 'tempdb'"
+)
+
+// SqlServerRepository is a Repository implementation for MS SQL Server
+// databases.
+type SqlServerRepository struct {
+	// The majority of the Repository functionality is delegated to a generic
+	// SQL repository instance (genericSqlRepo).
+	genericSqlRepo *GenericRepository
+}
+
+// SqlServerRepository implements Repository
+var _ Repository = (*SqlServerRepository)(nil)
+
+// NewSqlServerRepository creates a new MS SQL Server sql.
+func NewSqlServerRepository(cfg config.RepoConfig) (*SqlServerRepository, error) {
+	connStr := fmt.Sprintf(
+		"sqlserver://%s:%s@%s:%d",
+		cfg.User,
+		cfg.Password,
+		cfg.Host,
+		cfg.Port,
+	)
+	// The database name is optional for MS SQL Server.
+	if cfg.Database != "" {
+		connStr = fmt.Sprintf(connStr+"?database=%s", cfg.Database)
+	}
+	genericSqlRepo, err := NewGenericRepository(
+		cfg.Host,
+		RepoTypeSqlServer,
+		cfg.Database,
+		connStr,
+		cfg.MaxOpenConns,
+		cfg.IncludePaths,
+		cfg.IncludePaths,
+	)
+	if err != nil {
+		return nil, fmt.Errorf("could not instantiate generic sql repository: %w", err)
+	}
+	return &SqlServerRepository{genericSqlRepo: genericSqlRepo}, nil
+}
+
+// TODO: godoc -ccampo 2024-04-02
+func (r *SqlServerRepository) ListDatabases(ctx context.Context) ([]string, error) {
+	return r.genericSqlRepo.ListDatabasesWithQuery(ctx, SqlServerDatabaseQuery)
+}
+
+// TODO: godoc -ccampo 2024-04-02
+func (r *SqlServerRepository) Introspect(ctx context.Context) (*Metadata, error) {
+	return r.genericSqlRepo.Introspect(ctx)
+}
+
+// TODO: godoc -ccampo 2024-04-02
+func (r *SqlServerRepository) SampleTable(
+	ctx context.Context,
+	meta *TableMetadata,
+	params SampleParameters,
+) (Sample, error) {
+	// Sqlserver uses double-quotes to quote identifiers
+	attrStr := meta.QuotedAttributeNamesString("\"")
+	query := fmt.Sprintf(SqlServerSampleQueryTemplate, attrStr, meta.Schema, meta.Name)
+	return r.genericSqlRepo.SampleTableWithQuery(ctx, meta, query, params.SampleSize)
+}
+
+// TODO: godoc -ccampo 2024-04-02
+func (r *SqlServerRepository) Ping(ctx context.Context) error {
+	return r.genericSqlRepo.Ping(ctx)
+}
+
+// TODO: godoc -ccampo 2024-04-02
+func (r *SqlServerRepository) Close() error {
+	return r.genericSqlRepo.Close()
+}
diff --git a/discovery/repository/sqlserver/sqlserver_test.go b/discovery/sql/sqlserver_test.go
similarity index 50%
rename from discovery/repository/sqlserver/sqlserver_test.go
rename to discovery/sql/sqlserver_test.go
index 1c15a4b..e45c75a 100644
--- a/discovery/repository/sqlserver/sqlserver_test.go
+++ b/discovery/sql/sqlserver_test.go
@@ -1,4 +1,4 @@
-package sqlserver
+package sql
 
 import (
 	"context"
@@ -7,25 +7,23 @@ import (
 
 	"github.com/DATA-DOG/go-sqlmock"
 	"github.com/stretchr/testify/require"
-
-	"github.com/cyralinc/dmap/discovery/repository/genericsql"
 )
 
-func initRepoTest(t *testing.T) (context.Context, *sql.DB, sqlmock.Sqlmock, *Repository) {
-	ctx := context.Background()
-	db, mock, err := sqlmock.New()
-	require.NoError(t, err)
-	return ctx, db, mock, &Repository{
-		genericSqlRepo: genericsql.NewRepositoryFromDB("repoName", RepoTypeSqlServer, "dbName", db),
-	}
-}
-
-func TestListDatabases(t *testing.T) {
-	ctx, db, mock, r := initRepoTest(t)
+func TestSqlServerRepository_ListDatabases(t *testing.T) {
+	ctx, db, mock, r := initSqlServerRepoTest(t)
 	defer func() { _ = db.Close() }()
 	dbRows := sqlmock.NewRows([]string{"name"}).AddRow("db1").AddRow("db2")
-	mock.ExpectQuery(DatabaseQuery).WillReturnRows(dbRows)
+	mock.ExpectQuery(SqlServerDatabaseQuery).WillReturnRows(dbRows)
 	dbs, err := r.ListDatabases(ctx)
 	require.NoError(t, err)
 	require.ElementsMatch(t, []string{"db1", "db2"}, dbs)
 }
+
+func initSqlServerRepoTest(t *testing.T) (context.Context, *sql.DB, sqlmock.Sqlmock, *SqlServerRepository) {
+	ctx := context.Background()
+	db, mock, err := sqlmock.New()
+	require.NoError(t, err)
+	return ctx, db, mock, &SqlServerRepository{
+		genericSqlRepo: NewGenericRepositoryFromDB("repoName", RepoTypeSqlServer, "dbName", db),
+	}
+}

From 05827ac0f896dd2d9f60d04f9615885861164bcd Mon Sep 17 00:00:00 2001
From: Chris Campo <ccampo133@users.noreply.github.com>
Date: Tue, 2 Apr 2024 10:31:22 -0400
Subject: [PATCH 08/14] Documentation

---
 discovery/doc.go            |  9 ++++++++
 discovery/scanner.go        |  3 ++-
 discovery/sql/denodo.go     | 17 ++++++++++-----
 discovery/sql/doc.go        | 21 +++++++------------
 discovery/sql/generic.go    | 41 +++++++++++++++++++++++++++++--------
 discovery/sql/mysql.go      | 23 ++++++++++++++-------
 discovery/sql/oracle.go     | 31 +++++++++++++++++-----------
 discovery/sql/postgres.go   | 33 +++++++++++++++++------------
 discovery/sql/redshift.go   | 18 +++++++++++-----
 discovery/sql/registry.go   | 27 ++++++++++++++++--------
 discovery/sql/repository.go |  4 ----
 discovery/sql/snowflake.go  | 29 ++++++++++++++++++--------
 discovery/sql/sqlserver.go  | 18 +++++++++++-----
 scan/scanner.go             |  2 ++
 14 files changed, 184 insertions(+), 92 deletions(-)
 create mode 100644 discovery/doc.go

diff --git a/discovery/doc.go b/discovery/doc.go
new file mode 100644
index 0000000..03bebfd
--- /dev/null
+++ b/discovery/doc.go
@@ -0,0 +1,9 @@
+// Package discovery provides mechanisms to perform database introspection and
+// data discovery on various data repositories. It provides a Scanner type that
+// can be used to scan a data repository for sensitive data, classify the data,
+// and publish the results to external sources. Additionally, the sql subpackage
+// provides various SQL repository implementations that can be used to
+// introspect and sample SQL-based data repositories. Support for additional
+// data repository types, such as NoSQL-based repos, is intended to be added in
+// the future.
+package discovery
diff --git a/discovery/scanner.go b/discovery/scanner.go
index c1b78f8..f01a776 100644
--- a/discovery/scanner.go
+++ b/discovery/scanner.go
@@ -15,7 +15,8 @@ import (
 
 // Scanner is a data discovery scanner that scans a data repository for
 // sensitive data. It also classifies the data and publishes the results to
-// the configured external sources.
+// the configured external sources. It currently only supports SQL-based
+// repositories.
 type Scanner struct {
 	config     *config.Config
 	repository sql.Repository
diff --git a/discovery/sql/denodo.go b/discovery/sql/denodo.go
index ab82cbc..0706d34 100644
--- a/discovery/sql/denodo.go
+++ b/discovery/sql/denodo.go
@@ -69,17 +69,22 @@ func NewDenodoRepository(cfg config.RepoConfig) (*DenodoRepository, error) {
 	return &DenodoRepository{genericSqlRepo: sqlRepo}, nil
 }
 
-// TODO: godoc -ccampo 2024-04-02
+// ListDatabases is left unimplemented for Denodo, because Denodo doesn't have
+// the concept of databases.
 func (r *DenodoRepository) ListDatabases(_ context.Context) ([]string, error) {
 	return nil, errors.New("ListDatabases is not implemented for Denodo repositories")
 }
 
-// TODO: godoc -ccampo 2024-04-02
+// Introspect delegates introspection to GenericRepository. See
+// Repository.Introspect and GenericRepository.IntrospectWithQuery for more
+// details.
 func (r *DenodoRepository) Introspect(ctx context.Context) (*Metadata, error) {
 	return r.genericSqlRepo.IntrospectWithQuery(ctx, DenodoIntrospectQuery)
 }
 
-// TODO: godoc -ccampo 2024-04-02
+// SampleTable delegates sampling to GenericRepository, using a Denodo-specific
+// table sample query. See Repository.SampleTable and
+// GenericRepository.SampleTableWithQuery for more details.
 func (r *DenodoRepository) SampleTable(
 	ctx context.Context,
 	meta *TableMetadata,
@@ -98,12 +103,14 @@ func (r *DenodoRepository) SampleTable(
 	return r.genericSqlRepo.SampleTableWithQuery(ctx, meta, query)
 }
 
-// TODO: godoc -ccampo 2024-04-02
+// Ping delegates the ping to GenericRepository. See Repository.Ping and
+// GenericRepository.Ping for more details.
 func (r *DenodoRepository) Ping(ctx context.Context) error {
 	return r.genericSqlRepo.Ping(ctx)
 }
 
-// TODO: godoc -ccampo 2024-04-02
+// Close delegates the close to GenericRepository. See Repository.Close and
+// GenericRepository.Close for more details.
 func (r *DenodoRepository) Close() error {
 	return r.genericSqlRepo.Close()
 }
diff --git a/discovery/sql/doc.go b/discovery/sql/doc.go
index 51ae315..1aeffed 100644
--- a/discovery/sql/doc.go
+++ b/discovery/sql/doc.go
@@ -1,15 +1,8 @@
-// Package sql provides an API for performing data discovery on SQL databases.
-// The Repository type encapsulates the concept of a Dmap data SQL repository.
-// The package provides a registry for all supported repository implementations
-// and a factory function to create new instances of a repository
-// from the registry. All supported repositories are represented as sub-packages
-// of the repository name, e.g. mysql, postgresql, etc.
-//
-// Repository implementations should reside in their own sub-package of the
-// repository package. Each implementation register itself with the repository
-// registry by calling the Register function with a RepoConstructor function
-// that returns a new instance of the repository implementation. This will make
-// the repository implementation available to the NewRepository factory
-// function. Registration is typically done in the sub-package's init function.
-// TODO: fix this doc -ccampo 2024-04-02
+// Package sql provides an API for performing database introspection and data
+// discovery on SQL databases. The Repository type encapsulates the concept of a
+// Dmap data SQL repository. The package provides a Registry for all supported
+// repository implementations and a factory function to create new instances of
+// a repository from the registry. All out-of-the-box Repository implementations
+// are included in their own files named after the repository type, e.g.
+// mysql.go, postgres.go, etc.
 package sql
diff --git a/discovery/sql/generic.go b/discovery/sql/generic.go
index 4941c9f..2d22d7f 100644
--- a/discovery/sql/generic.go
+++ b/discovery/sql/generic.go
@@ -3,6 +3,7 @@ package sql
 import (
 	"context"
 	"database/sql"
+	"errors"
 	"fmt"
 
 	log "github.com/sirupsen/logrus"
@@ -36,9 +37,14 @@ const (
 // subset of ANSI SQL compatible databases. Many Repository implementations may
 // partially or fully delegate to this implementation. In that respect, it acts
 // somewhat as a base implementation which can be used by SQL-compatible
-// repositories. Note however that GenericRepository is not an implementation of
-// the Repository interface, and is meant to be used as a building block for
-// other Repository implementations.
+// repositories. Note that while GenericRepository is an implementation of
+// the Repository interface, GenericRepository is meant to be used as a building
+// block for other Repository implementations, rather than as a standalone
+// implementation. Specifically, the Repository.ListDatabases method is left
+// un-implemented, since there is no standard way to list databases across
+// different SQL database platforms. It does however provide the
+// ListDatabasesWithQuery method, which dependent implementations can use to
+// provide a custom query to list databases.
 type GenericRepository struct {
 	repoName     string
 	repoType     string
@@ -48,6 +54,8 @@ type GenericRepository struct {
 	excludePaths []glob.Glob
 }
 
+var _ Repository = (*GenericRepository)(nil)
+
 // NewGenericRepository is a constructor for the GenericRepository type. It
 // opens a database handle for a given repoType and returns a pointer to a new
 // GenericRepository instance. A connection may or may not be established
@@ -68,7 +76,7 @@ func NewGenericRepository(
 	*GenericRepository,
 	error,
 ) {
-	db, err := getDbHandle(repoType, connStr, maxOpenConns)
+	db, err := newDbHandle(repoType, connStr, maxOpenConns)
 	if err != nil {
 		return nil, fmt.Errorf("error retrieving DB handle for repo type %s: %w", repoType, err)
 	}
@@ -93,6 +101,13 @@ func NewGenericRepositoryFromDB(repoName, repoType, database string, db *sql.DB)
 	}
 }
 
+// ListDatabases is left unimplemented for GenericRepository, because there is
+// no standard way to list databases across different SQL database platforms.
+// See ListDatabasesWithQuery for a way to list databases using a custom query.
+func (r *GenericRepository) ListDatabases(_ context.Context) ([]string, error) {
+	return nil, errors.New("ListDatabases is not implemented")
+}
+
 // ListDatabasesWithQuery returns a list of the names of all databases on the
 // server, as determined by the given query. The query is expected to return
 // a row set containing a single column corresponding to the database name. If
@@ -159,7 +174,10 @@ func (r *GenericRepository) IntrospectWithQuery(
 	return repoMeta, nil
 }
 
-// TODO: godoc -ccampo 2024-04-02
+// SampleTable samples the table referenced by the TableMetadata meta parameter
+// by issuing a standard, ANSI-compatible SELECT query to the database. All
+// attributes of the table are selected, and are quoted using double quotes. See
+// Repository.SampleTable for more details.
 func (r *GenericRepository) SampleTable(
 	ctx context.Context,
 	meta *TableMetadata,
@@ -213,7 +231,8 @@ func (r *GenericRepository) SampleTableWithQuery(
 	return sample, nil
 }
 
-// TODO: godoc -ccampo 2024-04-02
+// Ping verifies the connection to the database used by this repository by
+// executing a simple query. If the query fails, an error is returned.
 func (r *GenericRepository) Ping(ctx context.Context) error {
 	log.Tracef("Query: %s", GenericPingQuery)
 	rows, err := r.db.QueryContext(ctx, GenericPingQuery)
@@ -229,12 +248,15 @@ func (r *GenericRepository) GetDb() *sql.DB {
 	return r.db
 }
 
-// TODO: godoc -ccampo 2024-04-02
+// Close closes the database connection used by the repository.
 func (r *GenericRepository) Close() error {
 	return r.db.Close()
 }
 
-func getDbHandle(repoType, connStr string, maxOpenConns uint) (*sql.DB, error) {
+// newDbHandle opens a new database sql.DB handle for the given repoType and
+// connection string. The maxOpenConns parameter specifies the maximum number of
+// open connections to the database.
+func newDbHandle(repoType, connStr string, maxOpenConns uint) (*sql.DB, error) {
 	db, err := sql.Open(repoType, connStr)
 	if err != nil {
 		return nil, err
@@ -328,6 +350,9 @@ func getCurrentRowAsMap(rows *sql.Rows) (map[string]any, error) {
 	return row, nil
 }
 
+// matchPathPatterns checks if the given database, schema, and table match any
+// of the given glob patterns. It returns true if the database, schema, and
+// table match any of the patterns, and false otherwise.
 func matchPathPatterns(database, schema, table string, patterns []glob.Glob) bool {
 	for _, pattern := range patterns {
 		if pattern.Match(fmt.Sprintf("%s.%s.%s", database, schema, table)) {
diff --git a/discovery/sql/mysql.go b/discovery/sql/mysql.go
index d98badf..f3e9421 100644
--- a/discovery/sql/mysql.go
+++ b/discovery/sql/mysql.go
@@ -61,35 +61,44 @@ func NewMySqlRepository(cfg config.RepoConfig) (*MySqlRepository, error) {
 	return &MySqlRepository{genericSqlRepo: sqlRepo}, nil
 }
 
-// TODO: godoc -ccampo 2024-04-02
+// ListDatabases returns a list of the names of all databases on the server by
+// using a MySQL-specific database query. It delegates the actual work to
+// GenericRepository.ListDatabasesWithQuery - see that method for more details.
 func (r *MySqlRepository) ListDatabases(ctx context.Context) ([]string, error) {
 	return r.genericSqlRepo.ListDatabasesWithQuery(ctx, MySqlDatabaseQuery)
 }
 
-// TODO: godoc -ccampo 2024-04-02
+// Introspect delegates introspection to GenericRepository. See
+// Repository.Introspect and GenericRepository.IntrospectWithQuery for more
+// details.
 func (r *MySqlRepository) Introspect(ctx context.Context) (*Metadata, error) {
 	return r.genericSqlRepo.Introspect(ctx)
 }
 
-// TODO: godoc -ccampo 2024-04-02
+// SampleTable delegates sampling to GenericRepository, using a MySQL-specific
+// table sample query. See Repository.SampleTable and
+// GenericRepository.SampleTableWithQuery for more details.
 func (r *MySqlRepository) SampleTable(
 	ctx context.Context,
 	meta *TableMetadata,
 	params SampleParameters,
 ) (Sample, error) {
-	// MySQL uses backticks to quote identifiers
+	// MySQL uses backticks to quote identifiers.
 	attrStr := meta.QuotedAttributeNamesString("`")
-	// The generic select/limit/offset query and ? placeholders work fine with MySQL
+	// The generic select/limit/offset query and ? placeholders work fine with
+	// MySQL.
 	query := fmt.Sprintf(GenericSampleQueryTemplate, attrStr, meta.Schema, meta.Name)
 	return r.genericSqlRepo.SampleTableWithQuery(ctx, meta, query, params.SampleSize, params.Offset)
 }
 
-// TODO: godoc -ccampo 2024-04-02
+// Ping delegates the ping to GenericRepository. See Repository.Ping and
+// GenericRepository.Ping for more details.
 func (r *MySqlRepository) Ping(ctx context.Context) error {
 	return r.genericSqlRepo.Ping(ctx)
 }
 
-// TODO: godoc -ccampo 2024-04-02
+// Close delegates the close to GenericRepository. See Repository.Close and
+// GenericRepository.Close for more details.
 func (r *MySqlRepository) Close() error {
 	return r.genericSqlRepo.Close()
 }
diff --git a/discovery/sql/oracle.go b/discovery/sql/oracle.go
index 45837ed..5547ef2 100644
--- a/discovery/sql/oracle.go
+++ b/discovery/sql/oracle.go
@@ -84,20 +84,24 @@ func (r *OracleRepository) ListDatabases(_ context.Context) ([]string, error) {
 	return nil, errors.New("ListDatabases is not implemented for Oracle repos")
 }
 
-// TODO: godoc -ccampo 2024-04-02
+// Introspect delegates introspection to GenericRepository, using an
+// Oracle-specific introspection query. See Repository.Introspect and
+// GenericRepository.IntrospectWithQuery for more details.
 func (r *OracleRepository) Introspect(ctx context.Context) (*Metadata, error) {
 	return r.genericSqlRepo.IntrospectWithQuery(ctx, OracleIntrospectQuery)
 }
 
-// TODO: godoc -ccampo 2024-04-02
+// SampleTable delegates sampling to GenericRepository, using an Oracle-specific
+// table sample query. See Repository.SampleTable and
+// GenericRepository.SampleTableWithQuery for more details.
 func (r *OracleRepository) SampleTable(
 	ctx context.Context,
 	meta *TableMetadata,
 	params SampleParameters,
 ) (Sample, error) {
-	// Oracle uses double-quotes to quote identifiers
+	// Oracle uses double-quotes to quote identifiers.
 	attrStr := meta.QuotedAttributeNamesString("\"")
-	// Oracle uses :x for placeholders
+	// Oracle uses :x for placeholders.
 	query := fmt.Sprintf(
 		"SELECT %s FROM %s.%s OFFSET :1 ROWS FETCH NEXT :2 ROWS ONLY",
 		attrStr, meta.Schema, meta.Name,
@@ -106,26 +110,29 @@ func (r *OracleRepository) SampleTable(
 }
 
 // Ping verifies the connection to Oracle database used by this Oracle
-// Normally we would just delegate to the Ping method implemented by
-// genericOracle However, that implementation executes a
-// 'SELECT 1' query to test for connectivity, and Oracle being Oracle, does not
-// like this. So instead, we defer to the native Ping method implemented by the
-// Oracle DB driver.
+// Normally we would just delegate to GenericRepository.Ping, however, that
+// implementation executes a 'SELECT 1' query to test for connectivity, and
+// Oracle being Oracle does not like this. Instead, we defer to the native
+// Ping method implemented by the Oracle DB driver.
 func (r *OracleRepository) Ping(ctx context.Context) error {
 	return r.genericSqlRepo.GetDb().PingContext(ctx)
 }
 
-// TODO: godoc -ccampo 2024-04-02
+// Close delegates the close to GenericRepository. See Repository.Close and
+// GenericRepository.Close for more details.
 func (r *OracleRepository) Close() error {
 	return r.genericSqlRepo.Close()
 }
 
-// TODO: godoc -ccampo 2024-04-02
+// OracleConfig is a struct to hold Oracle-specific configuration.
 type OracleConfig struct {
+	// ServiceName is the Oracle service name.
 	ServiceName string
 }
 
-// TODO: godoc -ccampo 2024-04-02
+// ParseOracleConfig parses the Oracle-specific configuration from the
+// given config. The Oracle configuration is expected to be in the
+// config's "advanced config" property.
 func ParseOracleConfig(cfg config.RepoConfig) (*OracleConfig, error) {
 	oracleCfg, err := config.FetchAdvancedConfigString(
 		cfg,
diff --git a/discovery/sql/postgres.go b/discovery/sql/postgres.go
index 9ec2322..04c5732 100644
--- a/discovery/sql/postgres.go
+++ b/discovery/sql/postgres.go
@@ -70,17 +70,23 @@ func NewPostgresRepository(cfg config.RepoConfig) (*PostgresRepository, error) {
 	return &PostgresRepository{genericSqlRepo: sqlRepo}, nil
 }
 
-// TODO: godoc -ccampo 2024-04-02
+// ListDatabases returns a list of the names of all databases on the server by
+// using a Postgres-specific database query. It delegates the actual work to
+// GenericRepository.ListDatabasesWithQuery - see that method for more details.
 func (r *PostgresRepository) ListDatabases(ctx context.Context) ([]string, error) {
 	return r.genericSqlRepo.ListDatabasesWithQuery(ctx, PostgresDatabaseQuery)
 }
 
-// TODO: godoc -ccampo 2024-04-02
+// Introspect delegates introspection to GenericRepository. See
+// Repository.Introspect and GenericRepository.IntrospectWithQuery for more
+// details.
 func (r *PostgresRepository) Introspect(ctx context.Context) (*Metadata, error) {
 	return r.genericSqlRepo.Introspect(ctx)
 }
 
-// TODO: godoc -ccampo 2024-04-02
+// SampleTable delegates sampling to GenericRepository, using a
+// Postgres-specific table sample query. See Repository.SampleTable and
+// GenericRepository.SampleTableWithQuery for more details.
 func (r *PostgresRepository) SampleTable(
 	ctx context.Context,
 	meta *TableMetadata,
@@ -93,30 +99,31 @@ func (r *PostgresRepository) SampleTable(
 	return r.genericSqlRepo.SampleTableWithQuery(ctx, meta, query, params.SampleSize, params.Offset)
 }
 
-// TODO: godoc -ccampo 2024-04-02
+// Ping delegates the ping to GenericRepository. See Repository.Ping and
+// GenericRepository.Ping for more details.
 func (r *PostgresRepository) Ping(ctx context.Context) error {
 	return r.genericSqlRepo.Ping(ctx)
 }
 
-// TODO: godoc -ccampo 2024-04-02
+// Close delegates the close to GenericRepository. See Repository.Close and
+// GenericRepository.Close for more details.
 func (r *PostgresRepository) Close() error {
 	return r.genericSqlRepo.Close()
 }
 
-// TODO: godoc -ccampo 2024-04-02
+// PostgresConfig contains Postgres-specific configuration parameters.
 type PostgresConfig struct {
+	// ConnOptsStr is a string containing Postgres-specific connection options.
 	ConnOptsStr string
 }
 
-// ParsePostgresConfig produces a config structure with Postgres-specific
-// parameters found in the repo config.
+// ParsePostgresConfig parses the Postgres-specific configuration parameters
+// from the given config. The Postgres connection options are built from the
+// config and stored in the ConnOptsStr field of the returned PostgresConfig.
 func ParsePostgresConfig(cfg config.RepoConfig) (*PostgresConfig, error) {
 	connOptsStr, err := config.BuildConnOptsStr(cfg)
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("error building connection options string: %w", err)
 	}
-
-	return &PostgresConfig{
-		ConnOptsStr: connOptsStr,
-	}, nil
+	return &PostgresConfig{ConnOptsStr: connOptsStr}, nil
 }
diff --git a/discovery/sql/redshift.go b/discovery/sql/redshift.go
index c7165fb..11dc5a2 100644
--- a/discovery/sql/redshift.go
+++ b/discovery/sql/redshift.go
@@ -59,18 +59,24 @@ func NewRedshiftRepository(cfg config.RepoConfig) (*RedshiftRepository, error) {
 	return &RedshiftRepository{genericSqlRepo: sqlRepo}, nil
 }
 
-// TODO: godoc -ccampo 2024-04-02
+// ListDatabases returns a list of the names of all databases on the server by
+// using a Redshift-specific database query. It delegates the actual work to
+// GenericRepository.ListDatabasesWithQuery - see that method for more details.
 func (r *RedshiftRepository) ListDatabases(ctx context.Context) ([]string, error) {
 	// Redshift and Postgres use the same query to list the server databases.
 	return r.genericSqlRepo.ListDatabasesWithQuery(ctx, PostgresDatabaseQuery)
 }
 
-// TODO: godoc -ccampo 2024-04-02
+// Introspect delegates introspection to GenericRepository. See
+// Repository.Introspect and GenericRepository.IntrospectWithQuery for more
+// details.
 func (r *RedshiftRepository) Introspect(ctx context.Context) (*Metadata, error) {
 	return r.genericSqlRepo.Introspect(ctx)
 }
 
-// TODO: godoc -ccampo 2024-04-02
+// SampleTable delegates sampling to GenericRepository, using a
+// Redshift-specific table sample query. See Repository.SampleTable and
+// GenericRepository.SampleTableWithQuery for more details.
 func (r *RedshiftRepository) SampleTable(
 	ctx context.Context,
 	meta *TableMetadata,
@@ -83,12 +89,14 @@ func (r *RedshiftRepository) SampleTable(
 	return r.genericSqlRepo.SampleTableWithQuery(ctx, meta, query, params.SampleSize, params.Offset)
 }
 
-// TODO: godoc -ccampo 2024-04-02
+// Ping delegates the ping to GenericRepository. See Repository.Ping and
+// GenericRepository.Ping for more details.
 func (r *RedshiftRepository) Ping(ctx context.Context) error {
 	return r.genericSqlRepo.Ping(ctx)
 }
 
-// TODO: godoc -ccampo 2024-04-02
+// Close delegates the close to GenericRepository. See Repository.Close and
+// GenericRepository.Close for more details.
 func (r *RedshiftRepository) Close() error {
 	return r.genericSqlRepo.Close()
 }
diff --git a/discovery/sql/registry.go b/discovery/sql/registry.go
index 2915a15..f9c2e4e 100644
--- a/discovery/sql/registry.go
+++ b/discovery/sql/registry.go
@@ -9,11 +9,19 @@ import (
 )
 
 var (
-	// TODO: godoc -ccampo 2024-04-02
+	// DefaultRegistry is the default, global repository registry used by the
+	// package of which a number of convenience functions in this package act
+	// on. All currently out-of-the-box repository types are registered to this
+	// registry by this package's init function. Users who want to use custom
+	// Repository implementations, or just avoid global state altogether, should
+	// use their own instance of Registry, instead of using DefaultRegistry and
+	// the corresponding convenience functions.
 	DefaultRegistry = NewRegistry()
 )
 
-// TODO: godoc -ccampo 2024-04-02
+// Registry is a repository registry that maps repository types to their
+// respective constructor functions. It is used to create new repository
+// instances based on the repository type.
 type Registry struct {
 	constructors map[string]RepoConstructor
 }
@@ -22,16 +30,14 @@ type Registry struct {
 // implementations should use for their constructor functions.
 type RepoConstructor func(ctx context.Context, cfg config.RepoConfig) (Repository, error)
 
-// TODO: godoc -ccampo 2024-04-02
+// NewRegistry creates a new Registry instance.
 func NewRegistry() *Registry {
 	return &Registry{constructors: make(map[string]RepoConstructor)}
 }
 
 // Register makes a repository available by the provided repository type. If
 // Register is called twice with the same repoType, or if constructor is nil, it
-// returns an error. Note that Register is not thread-safe. It is
-// expected to be called from either a package's init function, or from the
-// program's main function.
+// returns an error. Note that Register is not thread-safe.
 func (r *Registry) Register(repoType string, constructor RepoConstructor) error {
 	if constructor == nil {
 		return fmt.Errorf("attempt to register nil constructor for repoType %s", repoType)
@@ -54,8 +60,10 @@ func (r *Registry) MustRegister(repoType string, constructor RepoConstructor) {
 }
 
 // NewRepository is a factory method to return a concrete Repository
-// implementation based on the specified type, e.g. MySQL, PostgreSQL, MSSQL,
-// etc.
+// implementation based on the specified type, e.g. MySQL, Postgres, SQL Server,
+// etc., which must be registered with the registry. If the repository type is
+// not registered, an error is returned. A new instance of the repository is
+// returned each time this method is called.
 func (r *Registry) NewRepository(ctx context.Context, cfg config.RepoConfig) (Repository, error) {
 	constructor, ok := r.constructors[cfg.Type]
 	if !ok {
@@ -86,7 +94,8 @@ func NewRepository(ctx context.Context, cfg config.RepoConfig) (Repository, erro
 	return DefaultRegistry.NewRepository(ctx, cfg)
 }
 
-// TODO: godoc -ccampo 2024-04-02
+// init registers all out-of-the-box repository types and their respective
+// constructors with the DefaultRegistry.
 func init() {
 	MustRegister(
 		RepoTypeDenodo,
diff --git a/discovery/sql/repository.go b/discovery/sql/repository.go
index b2fa873..174053c 100644
--- a/discovery/sql/repository.go
+++ b/discovery/sql/repository.go
@@ -9,12 +9,10 @@ import (
 type Repository interface {
 	// ListDatabases returns a list of the names of all databases on the server.
 	ListDatabases(ctx context.Context) ([]string, error)
-
 	// Introspect will read and analyze the basic properties of the repository
 	// and return as a Metadata instance. This includes all the repository's
 	// databases, schemas, tables, columns, and attributes.
 	Introspect(ctx context.Context) (*Metadata, error)
-
 	// SampleTable samples the table referenced by the TableMetadata meta
 	// parameter and returns the sample as a slice of Sample. The parameters for
 	// the sample, such as sample size, are passed via the params parameter (see
@@ -25,11 +23,9 @@ type Repository interface {
 	// row count less than the sample size. Prefer small sample sizes to limit
 	// impact on the database.
 	SampleTable(ctx context.Context, meta *TableMetadata, params SampleParameters) (Sample, error)
-
 	// Ping is meant to be used as a general purpose connectivity test. It
 	// should be invoked e.g. in the dry-run mode.
 	Ping(ctx context.Context) error
-
 	// Close is meant to be used as a general purpose cleanup. It should be
 	// invoked when the Repository is no longer used.
 	Close() error
diff --git a/discovery/sql/snowflake.go b/discovery/sql/snowflake.go
index de00ad2..6e97ba8 100644
--- a/discovery/sql/snowflake.go
+++ b/discovery/sql/snowflake.go
@@ -70,17 +70,22 @@ func NewSnowflakeRepository(cfg config.RepoConfig) (*SnowflakeRepository, error)
 	return &SnowflakeRepository{genericSqlRepo: sqlRepo}, nil
 }
 
-// TODO: godoc -ccampo 2024-04-02
+// ListDatabases returns a list of the names of all databases on the server by
+// using a Snowflake-specific database query. It delegates the actual work to
+// GenericRepository.ListDatabasesWithQuery - see that method for more details.
 func (r *SnowflakeRepository) ListDatabases(ctx context.Context) ([]string, error) {
 	return r.genericSqlRepo.ListDatabasesWithQuery(ctx, SnowflakeDatabaseQuery)
 }
 
-// TODO: godoc -ccampo 2024-04-02
+// Introspect delegates introspection to GenericRepository. See
+// Repository.Introspect and GenericRepository.IntrospectWithQuery for more
+// details.
 func (r *SnowflakeRepository) Introspect(ctx context.Context) (*Metadata, error) {
 	return r.genericSqlRepo.Introspect(ctx)
 }
 
-// TODO: godoc -ccampo 2024-04-02
+// SampleTable delegates sampling to GenericRepository. See
+// Repository.SampleTable and GenericRepository.SampleTable for more details.
 func (r *SnowflakeRepository) SampleTable(
 	ctx context.Context,
 	meta *TableMetadata,
@@ -89,25 +94,31 @@ func (r *SnowflakeRepository) SampleTable(
 	return r.genericSqlRepo.SampleTable(ctx, meta, params)
 }
 
-// TODO: godoc -ccampo 2024-04-02
+// Ping delegates the ping to GenericRepository. See Repository.Ping and
+// GenericRepository.Ping for more details.
 func (r *SnowflakeRepository) Ping(ctx context.Context) error {
 	return r.genericSqlRepo.Ping(ctx)
 }
 
-// TODO: godoc -ccampo 2024-04-02
+// Close delegates the close to GenericRepository. See Repository.Close and
+// GenericRepository.Close for more details.
 func (r *SnowflakeRepository) Close() error {
 	return r.genericSqlRepo.Close()
 }
 
-// TODO: godoc -ccampo 2024-04-02
+// SnowflakeConfig holds Snowflake-specific configuration parameters.
 type SnowflakeConfig struct {
-	Account   string
-	Role      string
+	// Account is the Snowflake account name.
+	Account string
+	// Role is the Snowflake role name.
+	Role string
+	// Warehouse is the Snowflake warehouse name.
 	Warehouse string
 }
 
 // ParseSnowflakeConfig produces a config structure with Snowflake-specific
-// parameters found in the repo config.
+// parameters found in the repo config. The Snowflake account, role, and
+// warehouse are required in the advanced config.
 func ParseSnowflakeConfig(cfg config.RepoConfig) (*SnowflakeConfig, error) {
 	snowflakeCfg, err := config.FetchAdvancedConfigString(
 		cfg,
diff --git a/discovery/sql/sqlserver.go b/discovery/sql/sqlserver.go
index 77b4ccc..65acebf 100644
--- a/discovery/sql/sqlserver.go
+++ b/discovery/sql/sqlserver.go
@@ -62,17 +62,23 @@ func NewSqlServerRepository(cfg config.RepoConfig) (*SqlServerRepository, error)
 	return &SqlServerRepository{genericSqlRepo: genericSqlRepo}, nil
 }
 
-// TODO: godoc -ccampo 2024-04-02
+// ListDatabases returns a list of the names of all databases on the server by
+// using a SQL Server-specific database query. It delegates the actual work to
+// GenericRepository.ListDatabasesWithQuery - see that method for more details.
 func (r *SqlServerRepository) ListDatabases(ctx context.Context) ([]string, error) {
 	return r.genericSqlRepo.ListDatabasesWithQuery(ctx, SqlServerDatabaseQuery)
 }
 
-// TODO: godoc -ccampo 2024-04-02
+// Introspect delegates introspection to GenericRepository. See
+// Repository.Introspect and GenericRepository.IntrospectWithQuery for more
+// details.
 func (r *SqlServerRepository) Introspect(ctx context.Context) (*Metadata, error) {
 	return r.genericSqlRepo.Introspect(ctx)
 }
 
-// TODO: godoc -ccampo 2024-04-02
+// SampleTable delegates sampling to GenericRepository, using a
+// SQL Server-specific table sample query. See Repository.SampleTable and
+// GenericRepository.SampleTableWithQuery for more details.
 func (r *SqlServerRepository) SampleTable(
 	ctx context.Context,
 	meta *TableMetadata,
@@ -84,12 +90,14 @@ func (r *SqlServerRepository) SampleTable(
 	return r.genericSqlRepo.SampleTableWithQuery(ctx, meta, query, params.SampleSize)
 }
 
-// TODO: godoc -ccampo 2024-04-02
+// Ping delegates the ping to GenericRepository. See Repository.Ping and
+// GenericRepository.Ping for more details.
 func (r *SqlServerRepository) Ping(ctx context.Context) error {
 	return r.genericSqlRepo.Ping(ctx)
 }
 
-// TODO: godoc -ccampo 2024-04-02
+// Close delegates the close to GenericRepository. See Repository.Close and
+// GenericRepository.Close for more details.
 func (r *SqlServerRepository) Close() error {
 	return r.genericSqlRepo.Close()
 }
diff --git a/scan/scanner.go b/scan/scanner.go
index 95ce39e..ddece19 100644
--- a/scan/scanner.go
+++ b/scan/scanner.go
@@ -1,3 +1,5 @@
+// Package scan provides a Scanner interface which can be used for scanning
+// cloud environments and performing data repository discovery.
 package scan
 
 import (

From b5409e73ebf26f9acdebbbcdb8969d3e93f5dd0c Mon Sep 17 00:00:00 2001
From: Chris Campo <ccampo133@users.noreply.github.com>
Date: Tue, 2 Apr 2024 11:58:37 -0400
Subject: [PATCH 09/14] More refactoring

---
 aws/scanner.go                                |  16 +-
 aws/scanner_test.go                           |  20 +-
 classification/classification.go              |  40 ---
 classification/classification_test.go         | 220 ----------------
 classification/gen.go                         |   5 -
 classification/label.go                       |   2 +-
 classification/label_classifier_test.go       |   2 +-
 classification/mock_classifier_test.go        |  95 -------
 classification/publisher.go                   |  15 ++
 classification/publisher/publisher.go         |  18 --
 classification/{publisher => }/stdout.go      |  14 +-
 cmd/repo_scan.go                              |   7 +-
 discovery/{config => }/config.go              |  19 +-
 discovery/{config => }/config_test.go         |   2 +-
 discovery/{sql => }/denodo.go                 |  22 +-
 discovery/doc.go                              |  19 +-
 discovery/{sql => }/gen.go                    |   2 +-
 discovery/{sql => }/generic.go                |  14 +-
 discovery/{sql => }/generic_test.go           |   2 +-
 discovery/{sql => }/metadata.go               |   2 +-
 discovery/{sql => }/metadata_test.go          |   2 +-
 discovery/{sql => }/mock_repository_test.go   |  95 +++++--
 discovery/{sql => }/mysql.go                  |  22 +-
 discovery/{sql => }/mysql_test.go             |   2 +-
 discovery/{sql => }/oracle.go                 |  24 +-
 discovery/{sql => }/postgres.go               |  30 +--
 discovery/{sql => }/postgres_test.go          |   2 +-
 discovery/{sql => }/redshift.go               |  20 +-
 discovery/{sql => }/redshift_test.go          |   2 +-
 discovery/{sql => }/registry.go               |  28 +-
 discovery/registry_test.go                    | 113 ++++++++
 .../{sql => }/sample_all_databases_test.go    |  20 +-
 discovery/{sql => }/sample_repository_test.go |   2 +-
 discovery/{sql => }/sampling.go               |  13 +-
 discovery/{sql => }/sampling_test.go          |   2 +-
 discovery/scanner.go                          | 156 -----------
 discovery/{sql => }/snowflake.go              |  30 +--
 discovery/{sql => }/snowflake_test.go         |   2 +-
 discovery/sql/doc.go                          |   8 -
 discovery/sql/repository_test.go              | 134 ----------
 .../{sql/repository.go => sqlrepository.go}   |   8 +-
 discovery/{sql => }/sqlserver.go              |  22 +-
 discovery/{sql => }/sqlserver_test.go         |   2 +-
 go.mod                                        |  58 ++--
 go.sum                                        | 158 +++++------
 scan/doc.go                                   |   4 +
 scan/env_scanner.go                           |  66 +++++
 scan/gen.go                                   |   5 +
 scan/mocks/mock_classifier.go                 |  97 +++++++
 scan/repo_scanner.go                          | 198 ++++++++++++++
 scan/repo_scanner_test.go                     | 247 ++++++++++++++++++
 scan/scanner.go                               |  66 -----
 testutil/mock/aws.go                          |  60 ++---
 testutil/mock/scanner.go                      |  18 --
 54 files changed, 1116 insertions(+), 1136 deletions(-)
 delete mode 100644 classification/gen.go
 delete mode 100644 classification/mock_classifier_test.go
 create mode 100644 classification/publisher.go
 delete mode 100644 classification/publisher/publisher.go
 rename classification/{publisher => }/stdout.go (67%)
 rename discovery/{config => }/config.go (90%)
 rename discovery/{config => }/config_test.go (99%)
 rename discovery/{sql => }/denodo.go (82%)
 rename discovery/{sql => }/gen.go (90%)
 rename discovery/{sql => }/generic.go (96%)
 rename discovery/{sql => }/generic_test.go (99%)
 rename discovery/{sql => }/metadata.go (99%)
 rename discovery/{sql => }/metadata_test.go (98%)
 rename discovery/{sql => }/mock_repository_test.go (82%)
 rename discovery/{sql => }/mysql.go (80%)
 rename discovery/{sql => }/mysql_test.go (97%)
 rename discovery/{sql => }/oracle.go (84%)
 rename discovery/{sql => }/postgres.go (78%)
 rename discovery/{sql => }/postgres_test.go (97%)
 rename discovery/{sql => }/redshift.go (81%)
 rename discovery/{sql => }/redshift_test.go (97%)
 rename discovery/{sql => }/registry.go (79%)
 create mode 100644 discovery/registry_test.go
 rename discovery/{sql => }/sample_all_databases_test.go (93%)
 rename discovery/{sql => }/sample_repository_test.go (99%)
 rename discovery/{sql => }/sampling.go (96%)
 rename discovery/{sql => }/sampling_test.go (98%)
 delete mode 100644 discovery/scanner.go
 rename discovery/{sql => }/snowflake.go (77%)
 rename discovery/{sql => }/snowflake_test.go (97%)
 delete mode 100644 discovery/sql/doc.go
 delete mode 100644 discovery/sql/repository_test.go
 rename discovery/{sql/repository.go => sqlrepository.go} (88%)
 rename discovery/{sql => }/sqlserver.go (81%)
 rename discovery/{sql => }/sqlserver_test.go (97%)
 create mode 100644 scan/doc.go
 create mode 100644 scan/env_scanner.go
 create mode 100644 scan/gen.go
 create mode 100644 scan/mocks/mock_classifier.go
 create mode 100644 scan/repo_scanner.go
 create mode 100644 scan/repo_scanner_test.go
 delete mode 100644 scan/scanner.go
 delete mode 100644 testutil/mock/scanner.go

diff --git a/aws/scanner.go b/aws/scanner.go
index 15c1343..2e9eccf 100644
--- a/aws/scanner.go
+++ b/aws/scanner.go
@@ -14,7 +14,7 @@ import (
 	"github.com/cyralinc/dmap/scan"
 )
 
-// AWSScanner is an implementation of the Scanner interface for the AWS cloud
+// AWSScanner is an implementation of the EnvironmentScanner interface for the AWS cloud
 // provider. It supports scanning data repositories from multiple AWS regions,
 // including RDS clusters and instances, Redshift clusters and DynamoDB tables.
 type AWSScanner struct {
@@ -23,8 +23,8 @@ type AWSScanner struct {
 	awsClientConstructor awsClientConstructor
 }
 
-// AWSScanner implements scan.Scanner
-var _ scan.Scanner = (*AWSScanner)(nil)
+// AWSScanner implements scan.EnvironmentScanner
+var _ scan.EnvironmentScanner = (*AWSScanner)(nil)
 
 // NewAWSScanner creates a new instance of AWSScanner based on the ScannerConfig.
 // If AssumeRoleConfig is specified, the AWSScanner will assume this IAM Role
@@ -57,7 +57,7 @@ func NewAWSScanner(
 // Scan performs a scan across all the AWS regions configured and return a scan
 // results, containing a list of data repositories that includes: RDS clusters
 // and instances, Redshift clusters and DynamoDB tables.
-func (s *AWSScanner) Scan(ctx context.Context) (*scan.ScanResults, error) {
+func (s *AWSScanner) Scan(ctx context.Context) (*scan.EnvironmentScanResults, error) {
 	responseChan := make(chan scanResponse)
 	var wg sync.WaitGroup
 	wg.Add(len(s.scannerConfig.Regions))
@@ -100,18 +100,18 @@ func (s *AWSScanner) Scan(ctx context.Context) (*scan.ScanResults, error) {
 		select {
 		case <-ctx.Done():
 			scanErrors = append(scanErrors, ctx.Err())
-			return &scan.ScanResults{
+			return &scan.EnvironmentScanResults{
 				Repositories: repositories,
-			}, &scan.ScanError{Errs: scanErrors}
+			}, &scan.EnvironmentScanError{Errs: scanErrors}
 
 		case response, ok := <-responseChan:
 			if !ok {
 				// Channel closed, all scans finished.
 				var scanErr error
 				if len(scanErrors) > 0 {
-					scanErr = &scan.ScanError{Errs: scanErrors}
+					scanErr = &scan.EnvironmentScanError{Errs: scanErrors}
 				}
-				return &scan.ScanResults{
+				return &scan.EnvironmentScanResults{
 					Repositories: repositories,
 				}, scanErr
 
diff --git a/aws/scanner_test.go b/aws/scanner_test.go
index af77ff0..07d4aa3 100644
--- a/aws/scanner_test.go
+++ b/aws/scanner_test.go
@@ -159,19 +159,19 @@ func (s *AWSScannerTestSuite) TestScan() {
 		awsClientConstructor: func(awsConfig aws.Config) *awsClient {
 			return &awsClient{
 				config: awsConfig,
-				rds: &mock.MockRDSClient{
+				rds: &mock.RDSClient{
 					DBClusters:  s.dummyRDSClusters,
 					DBInstances: s.dummyRDSInstances,
 				},
-				redshift: &mock.MockRedshiftClient{
+				redshift: &mock.RedshiftClient{
 					Clusters: s.dummyRedshiftClusters,
 				},
-				dynamodb: &mock.MockDynamoDBClient{
+				dynamodb: &mock.DynamoDBClient{
 					TableNames: s.dummyDynamoDBTableNames,
 					Table:      s.dummyDynamoDBTable,
 					Tags:       s.dummyDynamoDBTags,
 				},
-				s3: &mock.MockS3Client{
+				s3: &mock.S3Client{
 					Buckets: s.dummyS3Buckets,
 					Tags:    s.dummyS3Tags,
 				},
@@ -181,7 +181,7 @@ func (s *AWSScannerTestSuite) TestScan() {
 	ctx := context.Background()
 	results, err := awsScanner.Scan(ctx)
 
-	expectedResults := &scan.ScanResults{
+	expectedResults := &scan.EnvironmentScanResults{
 		Repositories: map[string]scan.Repository{
 			*s.dummyRDSClusters[0].DBClusterArn: {
 				Id:         *s.dummyRDSClusters[0].DBClusterArn,
@@ -330,23 +330,23 @@ func (s *AWSScannerTestSuite) TestScan_WithErrors() {
 		awsClientConstructor: func(awsConfig aws.Config) *awsClient {
 			return &awsClient{
 				config: awsConfig,
-				rds: &mock.MockRDSClient{
+				rds: &mock.RDSClient{
 					Errors: map[string]error{
 						"DescribeDBClusters":  dummyError,
 						"DescribeDBInstances": dummyError,
 					},
 				},
-				redshift: &mock.MockRedshiftClient{
+				redshift: &mock.RedshiftClient{
 					Errors: map[string]error{
 						"DescribeClusters": dummyError,
 					},
 				},
-				dynamodb: &mock.MockDynamoDBClient{
+				dynamodb: &mock.DynamoDBClient{
 					Errors: map[string]error{
 						"ListTables": dummyError,
 					},
 				},
-				s3: &mock.MockS3Client{
+				s3: &mock.S3Client{
 					Errors: map[string]error{
 						"ListBuckets":      dummyError,
 						"GetBucketTagging": dummyError,
@@ -359,7 +359,7 @@ func (s *AWSScannerTestSuite) TestScan_WithErrors() {
 	ctx := context.Background()
 	results, err := awsScanner.Scan(ctx)
 
-	expectedResults := &scan.ScanResults{
+	expectedResults := &scan.EnvironmentScanResults{
 		Repositories: nil,
 	}
 
diff --git a/classification/classification.go b/classification/classification.go
index 1e481dd..53d8fe8 100644
--- a/classification/classification.go
+++ b/classification/classification.go
@@ -8,10 +8,7 @@ package classification
 
 import (
 	"context"
-	"fmt"
 	"maps"
-
-	"github.com/cyralinc/dmap/discovery/repository"
 )
 
 // Classifier is an interface that represents a data classifier. A classifier
@@ -57,40 +54,3 @@ func (c Result) Merge(other Result) {
 		maps.Copy(c[attr], labelSet)
 	}
 }
-
-// ClassifySamples uses the provided classifiers to classify the sample data
-// passed via the "samples" parameter. It is mostly a helper function which
-// loops through each repository.Sample, retrieves the attribute names and
-// values of that sample, passes them to Classifier.Classify, and then
-// aggregates the results. Please see the documentation for Classifier and its
-// Classify method for more details. The returned slice represents all the
-// unique classification results for a given sample set.
-func ClassifySamples(
-	ctx context.Context,
-	samples []sql.Sample,
-	classifier Classifier,
-) ([]ClassifiedTable, error) {
-	tables := make([]ClassifiedTable, 0, len(samples))
-	for _, sample := range samples {
-		// Classify each sampled row and combine the results.
-		result := make(Result)
-		for _, sampleResult := range sample.Results {
-			res, err := classifier.Classify(ctx, sampleResult)
-			if err != nil {
-				return nil, fmt.Errorf("error classifying sample: %w", err)
-			}
-			result.Merge(res)
-		}
-		if len(result) > 0 {
-			table := ClassifiedTable{
-				Repo:            sample.Metadata.Repo,
-				Database:        sample.Metadata.Database,
-				Schema:          sample.Metadata.Schema,
-				Table:           sample.Metadata.Table,
-				Classifications: result,
-			}
-			tables = append(tables, table)
-		}
-	}
-	return tables, nil
-}
diff --git a/classification/classification_test.go b/classification/classification_test.go
index f709be7..d6dde27 100644
--- a/classification/classification_test.go
+++ b/classification/classification_test.go
@@ -1,12 +1,9 @@
 package classification
 
 import (
-	"context"
 	"testing"
 
 	"github.com/stretchr/testify/require"
-
-	"github.com/cyralinc/dmap/discovery/repository"
 )
 
 func TestMerge_WhenCalledOnNilReceiver_ShouldNotPanic(t *testing.T) {
@@ -60,220 +57,3 @@ func TestMerge_WhenCalledWithExistingAttributes_ShouldOverwrite(t *testing.T) {
 	result.Merge(other)
 	require.Equal(t, expected, result)
 }
-
-func TestClassifySamples_SingleTable(t *testing.T) {
-	ctx := context.Background()
-	meta := sql.SampleMetadata{
-		Repo:     "repo",
-		Database: "db",
-		Schema:   "schema",
-		Table:    "table",
-	}
-
-	sample := sql.Sample{
-		Metadata: meta,
-		Results: []sql.SampleResult{
-			{
-				"age":             "52",
-				"social_sec_num":  "512-23-4258",
-				"credit_card_num": "4111111111111111",
-			},
-			{
-				"age":             "101",
-				"social_sec_num":  "foobarbaz",
-				"credit_card_num": "4111111111111111",
-			},
-		},
-	}
-
-	classifier := NewMockClassifier(t)
-	// Need to explicitly convert it to a map because Mockery isn't smart enough
-	// to infer the type.
-	classifier.EXPECT().Classify(ctx, map[string]any(sample.Results[0])).Return(
-		Result{
-			"age": {
-				"AGE": {Name: "AGE"},
-			},
-			"social_sec_num": {
-				"SSN": {Name: "SSN"},
-			},
-			"credit_card_num": {
-				"CCN": {Name: "CCN"},
-			},
-		},
-		nil,
-	)
-	classifier.EXPECT().Classify(ctx, map[string]any(sample.Results[1])).Return(
-		Result{
-			"age": {
-				"AGE": {Name: "AGE"},
-				"CVV": {Name: "CVV"},
-			},
-			"credit_card_num": {
-				"CCN": {Name: "CCN"},
-			},
-		},
-		nil,
-	)
-
-	expected := []ClassifiedTable{
-		{
-			Repo:     meta.Repo,
-			Database: meta.Database,
-			Schema:   meta.Schema,
-			Table:    meta.Table,
-			Classifications: Result{
-				"age": {
-					"AGE": {Name: "AGE"},
-					"CVV": {Name: "CVV"},
-				},
-				"social_sec_num": {
-					"SSN": {Name: "SSN"},
-				},
-				"credit_card_num": {
-					"CCN": {Name: "CCN"},
-				},
-			},
-		},
-	}
-	actual, err := ClassifySamples(ctx, []sql.Sample{sample}, classifier)
-	require.NoError(t, err)
-	require.Len(t, actual, len(expected))
-	for i := range actual {
-		requireClassifiedTableEqual(t, expected[i], actual[i])
-	}
-}
-
-func TestClassifySamples_MultipleTables(t *testing.T) {
-	ctx := context.Background()
-	meta1 := sql.SampleMetadata{
-		Repo:     "repo1",
-		Database: "db1",
-		Schema:   "schema1",
-		Table:    "table1",
-	}
-	meta2 := sql.SampleMetadata{
-		Repo:     "repo2",
-		Database: "db2",
-		Schema:   "schema2",
-		Table:    "table2",
-	}
-
-	samples := []sql.Sample{
-		{
-			Metadata: meta1,
-			Results: []sql.SampleResult{
-				{
-					"age":             "52",
-					"social_sec_num":  "512-23-4258",
-					"credit_card_num": "4111111111111111",
-				},
-				{
-					"age":             "101",
-					"social_sec_num":  "foobarbaz",
-					"credit_card_num": "4111111111111111",
-				},
-			},
-		},
-		{
-			Metadata: meta2,
-			Results: []sql.SampleResult{
-				{
-					"fullname": "John Doe",
-					"dob":      "2000-01-01",
-					"random":   "foobarbaz",
-				},
-			},
-		},
-	}
-
-	classifier := NewMockClassifier(t)
-	// Need to explicitly convert it to a map because Mockery isn't smart enough
-	// to infer the type.
-	classifier.EXPECT().Classify(ctx, map[string]any(samples[0].Results[0])).Return(
-		Result{
-			"age": {
-				"AGE": {Name: "AGE"},
-			},
-			"social_sec_num": {
-				"SSN": {Name: "SSN"},
-			},
-			"credit_card_num": {
-				"CCN": {Name: "CCN"},
-			},
-		},
-		nil,
-	)
-	classifier.EXPECT().Classify(ctx, map[string]any(samples[0].Results[1])).Return(
-		Result{
-			"age": {
-				"AGE": {Name: "AGE"},
-				"CVV": {Name: "CVV"},
-			},
-			"credit_card_num": {
-				"CCN": {Name: "CCN"},
-			},
-		},
-		nil,
-	)
-	classifier.EXPECT().Classify(ctx, map[string]any(samples[1].Results[0])).Return(
-		Result{
-			"fullname": {
-				"FULL_NAME": {Name: "FULL_NAME"},
-			},
-			"dob": {
-				"DOB": {Name: "DOB"},
-			},
-		},
-		nil,
-	)
-
-	expected := []ClassifiedTable{
-		{
-			Repo:     meta1.Repo,
-			Database: meta1.Database,
-			Schema:   meta1.Schema,
-			Table:    meta1.Table,
-			Classifications: Result{
-				"age": {
-					"AGE": {Name: "AGE"},
-					"CVV": {Name: "CVV"},
-				},
-				"social_sec_num": {
-					"SSN": {Name: "SSN"},
-				},
-				"credit_card_num": {
-					"CCN": {Name: "CCN"},
-				},
-			},
-		},
-		{
-			Repo:     meta2.Repo,
-			Database: meta2.Database,
-			Schema:   meta2.Schema,
-			Table:    meta2.Table,
-			Classifications: Result{
-				"fullname": {
-					"FULL_NAME": {Name: "FULL_NAME"},
-				},
-				"dob": {
-					"DOB": {Name: "DOB"},
-				},
-			},
-		},
-	}
-	actual, err := ClassifySamples(ctx, samples, classifier)
-	require.NoError(t, err)
-	require.Len(t, actual, len(expected))
-	for i := range actual {
-		requireClassifiedTableEqual(t, expected[i], actual[i])
-	}
-}
-
-func requireClassifiedTableEqual(t *testing.T, expected, actual ClassifiedTable) {
-	require.Equal(t, expected.Repo, actual.Repo)
-	require.Equal(t, expected.Database, actual.Database)
-	require.Equal(t, expected.Schema, actual.Schema)
-	require.Equal(t, expected.Table, actual.Table)
-	requireResultEqual(t, expected.Classifications, actual.Classifications)
-}
diff --git a/classification/gen.go b/classification/gen.go
deleted file mode 100644
index 0d86176..0000000
--- a/classification/gen.go
+++ /dev/null
@@ -1,5 +0,0 @@
-package classification
-
-// Mock generation - see https://vektra.github.io/mockery/
-
-//go:generate mockery --testonly --inpackage --with-expecter --name=Classifier --filename=mock_classifier_test.go
diff --git a/classification/label.go b/classification/label.go
index 8d6bd0f..88702e6 100644
--- a/classification/label.go
+++ b/classification/label.go
@@ -67,7 +67,7 @@ func GetEmbeddedLabels() (LabelSet, error) {
 		return nil, fmt.Errorf("error unmarshalling labels.yaml: %w", err)
 	}
 	for name, lbl := range labels.Labels {
-		fname := "rego/" + strings.ReplaceAll(strings.ToLower(name), " ", "_") + ".rego"
+		fname := "labels/" + strings.ReplaceAll(strings.ToLower(name), " ", "_") + ".rego"
 		b, err := regoFs.ReadFile(fname)
 		if err != nil {
 			return nil, fmt.Errorf("error reading rego file %s: %w", fname, err)
diff --git a/classification/label_classifier_test.go b/classification/label_classifier_test.go
index 698035c..abea713 100644
--- a/classification/label_classifier_test.go
+++ b/classification/label_classifier_test.go
@@ -145,7 +145,7 @@ func newTestLabelClassifier(t *testing.T, lblNames ...string) *LabelClassifier {
 }
 
 func newTestLabel(t *testing.T, lblName string) Label {
-	fname := "rego/" + strings.ReplaceAll(strings.ToLower(lblName), " ", "_") + ".rego"
+	fname := "labels/" + strings.ReplaceAll(strings.ToLower(lblName), " ", "_") + ".rego"
 	fin, err := regoFs.ReadFile(fname)
 	require.NoError(t, err)
 	classifierCode := string(fin)
diff --git a/classification/mock_classifier_test.go b/classification/mock_classifier_test.go
deleted file mode 100644
index 82ad1a7..0000000
--- a/classification/mock_classifier_test.go
+++ /dev/null
@@ -1,95 +0,0 @@
-// Code generated by mockery v2.42.1. DO NOT EDIT.
-
-package classification
-
-import (
-	context "context"
-
-	mock "github.com/stretchr/testify/mock"
-)
-
-// MockClassifier is an autogenerated mock type for the Classifier type
-type MockClassifier struct {
-	mock.Mock
-}
-
-type MockClassifier_Expecter struct {
-	mock *mock.Mock
-}
-
-func (_m *MockClassifier) EXPECT() *MockClassifier_Expecter {
-	return &MockClassifier_Expecter{mock: &_m.Mock}
-}
-
-// Classify provides a mock function with given fields: ctx, input
-func (_m *MockClassifier) Classify(ctx context.Context, input map[string]interface{}) (Result, error) {
-	ret := _m.Called(ctx, input)
-
-	if len(ret) == 0 {
-		panic("no return value specified for Classify")
-	}
-
-	var r0 Result
-	var r1 error
-	if rf, ok := ret.Get(0).(func(context.Context, map[string]interface{}) (Result, error)); ok {
-		return rf(ctx, input)
-	}
-	if rf, ok := ret.Get(0).(func(context.Context, map[string]interface{}) Result); ok {
-		r0 = rf(ctx, input)
-	} else {
-		if ret.Get(0) != nil {
-			r0 = ret.Get(0).(Result)
-		}
-	}
-
-	if rf, ok := ret.Get(1).(func(context.Context, map[string]interface{}) error); ok {
-		r1 = rf(ctx, input)
-	} else {
-		r1 = ret.Error(1)
-	}
-
-	return r0, r1
-}
-
-// MockClassifier_Classify_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Classify'
-type MockClassifier_Classify_Call struct {
-	*mock.Call
-}
-
-// Classify is a helper method to define mock.On call
-//   - ctx context.Context
-//   - input map[string]interface{}
-func (_e *MockClassifier_Expecter) Classify(ctx interface{}, input interface{}) *MockClassifier_Classify_Call {
-	return &MockClassifier_Classify_Call{Call: _e.mock.On("Classify", ctx, input)}
-}
-
-func (_c *MockClassifier_Classify_Call) Run(run func(ctx context.Context, input map[string]interface{})) *MockClassifier_Classify_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		run(args[0].(context.Context), args[1].(map[string]interface{}))
-	})
-	return _c
-}
-
-func (_c *MockClassifier_Classify_Call) Return(_a0 Result, _a1 error) *MockClassifier_Classify_Call {
-	_c.Call.Return(_a0, _a1)
-	return _c
-}
-
-func (_c *MockClassifier_Classify_Call) RunAndReturn(run func(context.Context, map[string]interface{}) (Result, error)) *MockClassifier_Classify_Call {
-	_c.Call.Return(run)
-	return _c
-}
-
-// NewMockClassifier creates a new instance of MockClassifier. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
-// The first argument is typically a *testing.T value.
-func NewMockClassifier(t interface {
-	mock.TestingT
-	Cleanup(func())
-}) *MockClassifier {
-	mock := &MockClassifier{}
-	mock.Mock.Test(t)
-
-	t.Cleanup(func() { mock.AssertExpectations(t) })
-
-	return mock
-}
diff --git a/classification/publisher.go b/classification/publisher.go
new file mode 100644
index 0000000..aed92f4
--- /dev/null
+++ b/classification/publisher.go
@@ -0,0 +1,15 @@
+package classification
+
+import (
+	"context"
+)
+
+// Publisher publishes classification and discovery results to some destination,
+// which is left up to the implementer.
+// TODO: add doc about labels -ccampo 2024-04-02
+type Publisher interface {
+	// PublishClassifications publishes a slice of ClassifiedTable to some
+	// destination. Any error(s) during publication should be returned.
+	// TODO: add labels -ccampo 2024-04-02
+	PublishClassifications(ctx context.Context, repoId string, results []ClassifiedTable) error
+}
diff --git a/classification/publisher/publisher.go b/classification/publisher/publisher.go
deleted file mode 100644
index 3c3f02f..0000000
--- a/classification/publisher/publisher.go
+++ /dev/null
@@ -1,18 +0,0 @@
-// Package publisher provides types for publishing data classifications results
-// to an external source (Publisher), such as to stdout (StdOutPublisher).
-package publisher
-
-import (
-	"context"
-
-	"github.com/cyralinc/dmap/classification"
-)
-
-// Publisher publishes classification and discovery results to some destination,
-// which is left up to the implementer.
-type Publisher interface {
-	// PublishClassifications publishes a slice of
-	// classification.ClassifiedTable to some destination. Any error(s) during
-	// publication should be returned.
-	PublishClassifications(ctx context.Context, repoId string, results []classification.ClassifiedTable) error
-}
diff --git a/classification/publisher/stdout.go b/classification/stdout.go
similarity index 67%
rename from classification/publisher/stdout.go
rename to classification/stdout.go
index 3e0fd17..883dc7e 100644
--- a/classification/publisher/stdout.go
+++ b/classification/stdout.go
@@ -1,11 +1,9 @@
-package publisher
+package classification
 
 import (
 	"context"
 	"encoding/json"
 	"fmt"
-
-	"github.com/cyralinc/dmap/classification"
 )
 
 // StdOutPublisher "publishes" classification results to stdout in JSON format.
@@ -14,17 +12,15 @@ type StdOutPublisher struct{}
 // StdOutPublisher implements Publisher
 var _ Publisher = (*StdOutPublisher)(nil)
 
+// TODO: godoc -ccampo 2024-04-02
 func NewStdOutPublisher() *StdOutPublisher {
 	return &StdOutPublisher{}
 }
 
-func (c *StdOutPublisher) PublishClassifications(
-	_ context.Context,
-	_ string,
-	tables []classification.ClassifiedTable,
-) error {
+// TODO: godoc -ccampo 2024-04-02
+func (c *StdOutPublisher) PublishClassifications(_ context.Context, _ string, tables []ClassifiedTable) error {
 	results := struct {
-		Results []classification.ClassifiedTable `json:"results"`
+		Results []ClassifiedTable `json:"results"`
 	}{
 		Results: tables,
 	}
diff --git a/cmd/repo_scan.go b/cmd/repo_scan.go
index a4e97a8..b5830d9 100644
--- a/cmd/repo_scan.go
+++ b/cmd/repo_scan.go
@@ -4,17 +4,16 @@ import (
 	"context"
 	"fmt"
 
-	"github.com/cyralinc/dmap/discovery"
-	"github.com/cyralinc/dmap/discovery/config"
+	"github.com/cyralinc/dmap/scan"
 )
 
 type RepoScanCmd struct {
-	config.Config
+	scan.RepoScannerConfig
 }
 
 func (cmd *RepoScanCmd) Run(_ *Globals) error {
 	ctx := context.Background()
-	scanner, err := discovery.NewScanner(ctx, &cmd.Config)
+	scanner, err := scan.NewRepoScanner(ctx, cmd.RepoScannerConfig)
 	if err != nil {
 		return fmt.Errorf("error creating new scanner: %w", err)
 	}
diff --git a/discovery/config/config.go b/discovery/config.go
similarity index 90%
rename from discovery/config/config.go
rename to discovery/config.go
index d974b2f..925c31b 100644
--- a/discovery/config/config.go
+++ b/discovery/config.go
@@ -1,4 +1,4 @@
-package config
+package discovery
 
 import (
 	"fmt"
@@ -11,19 +11,6 @@ import (
 
 const configConnOpts = "connection-string-args"
 
-// Config is the configuration for the application.
-type Config struct {
-	Dmap DmapConfig `embed:""`
-	Repo RepoConfig `embed:""`
-}
-
-// DmapConfig is the necessary configuration to connect to the Dmap API.
-type DmapConfig struct {
-	ApiBaseUrl   string `help:"Base URL of the Dmap API." default:"https://api.dmap.cyral.io"`
-	ClientID     string `help:"API client ID to access the Dmap API."`
-	ClientSecret string `help:"API client secret to access the Dmap API."` //#nosec G101 -- false positive
-}
-
 // RepoConfig is the necessary configuration to connect to a data sql.
 type RepoConfig struct {
 	Type         string         `help:"Type of repository to connect to (postgres|mysql|oracle|sqlserver|snowflake|redshift|denodo)." enum:"postgres,mysql,oracle,sqlserver,snowflake,redshift,denodo" required:""`
@@ -64,7 +51,7 @@ func (g GlobFlag) Decode(ctx *kong.DecodeContext) error {
 // BuildConnOptsStr parses the repo config to produce a string in the format
 // "?option=value&option2=value2". Example:
 //
-//	BuildConnOptsStr(config.RepoConfig{
+//	BuildConnOptsStr(RepoConfig{
 //	    Advanced: map[string]any{
 //	        "connection-string-args": []any{"sslmode=disable"},
 //	    },
@@ -143,7 +130,7 @@ func FetchAdvancedConfigString(
 }
 
 // mapFromConnOpts builds a map from the list of connection options given in the
-// config. Each option has the format 'option=value'. Err only if the config is
+//  Each option has the format 'option=value'. Err only if the config is
 // malformed, to inform user.
 func mapFromConnOpts(cfg RepoConfig) (map[string]string, error) {
 	m := make(map[string]string)
diff --git a/discovery/config/config_test.go b/discovery/config_test.go
similarity index 99%
rename from discovery/config/config_test.go
rename to discovery/config_test.go
index 63a5007..c54ea99 100644
--- a/discovery/config/config_test.go
+++ b/discovery/config_test.go
@@ -1,4 +1,4 @@
-package config
+package discovery
 
 import (
 	"testing"
diff --git a/discovery/sql/denodo.go b/discovery/denodo.go
similarity index 82%
rename from discovery/sql/denodo.go
rename to discovery/denodo.go
index 0706d34..2075db5 100644
--- a/discovery/sql/denodo.go
+++ b/discovery/denodo.go
@@ -1,12 +1,10 @@
-package sql
+package discovery
 
 import (
 	"context"
 	"errors"
 	"fmt"
 
-	"github.com/cyralinc/dmap/discovery/config"
-
 	// Use PostgreSQL driver for Denodo
 	_ "github.com/lib/pq"
 )
@@ -26,18 +24,18 @@ const (
 		"CATALOG_VDP_METADATA_VIEWS()"
 )
 
-// DenodoRepository is a sql.Repository implementation for Denodo.
+// DenodoRepository is a sql.SQLRepository implementation for Denodo.
 type DenodoRepository struct {
-	// The majority of the sql.Repository functionality is delegated to
+	// The majority of the sql.SQLRepository functionality is delegated to
 	// a generic SQL repository instance.
 	genericSqlRepo *GenericRepository
 }
 
-// DenodoRepository implements sql.Repository
-var _ Repository = (*DenodoRepository)(nil)
+// DenodoRepository implements sql.SQLRepository
+var _ SQLRepository = (*DenodoRepository)(nil)
 
 // NewDenodoRepository is the constructor for sql.
-func NewDenodoRepository(cfg config.RepoConfig) (*DenodoRepository, error) {
+func NewDenodoRepository(cfg RepoConfig) (*DenodoRepository, error) {
 	pgCfg, err := ParsePostgresConfig(cfg)
 	if err != nil {
 		return nil, fmt.Errorf("unable to parse postgres config: %w", err)
@@ -76,14 +74,14 @@ func (r *DenodoRepository) ListDatabases(_ context.Context) ([]string, error) {
 }
 
 // Introspect delegates introspection to GenericRepository. See
-// Repository.Introspect and GenericRepository.IntrospectWithQuery for more
+// SQLRepository.Introspect and GenericRepository.IntrospectWithQuery for more
 // details.
 func (r *DenodoRepository) Introspect(ctx context.Context) (*Metadata, error) {
 	return r.genericSqlRepo.IntrospectWithQuery(ctx, DenodoIntrospectQuery)
 }
 
 // SampleTable delegates sampling to GenericRepository, using a Denodo-specific
-// table sample query. See Repository.SampleTable and
+// table sample query. See SQLRepository.SampleTable and
 // GenericRepository.SampleTableWithQuery for more details.
 func (r *DenodoRepository) SampleTable(
 	ctx context.Context,
@@ -103,13 +101,13 @@ func (r *DenodoRepository) SampleTable(
 	return r.genericSqlRepo.SampleTableWithQuery(ctx, meta, query)
 }
 
-// Ping delegates the ping to GenericRepository. See Repository.Ping and
+// Ping delegates the ping to GenericRepository. See SQLRepository.Ping and
 // GenericRepository.Ping for more details.
 func (r *DenodoRepository) Ping(ctx context.Context) error {
 	return r.genericSqlRepo.Ping(ctx)
 }
 
-// Close delegates the close to GenericRepository. See Repository.Close and
+// Close delegates the close to GenericRepository. See SQLRepository.Close and
 // GenericRepository.Close for more details.
 func (r *DenodoRepository) Close() error {
 	return r.genericSqlRepo.Close()
diff --git a/discovery/doc.go b/discovery/doc.go
index 03bebfd..999e7e2 100644
--- a/discovery/doc.go
+++ b/discovery/doc.go
@@ -1,9 +1,16 @@
 // Package discovery provides mechanisms to perform database introspection and
-// data discovery on various data repositories. It provides a Scanner type that
+// data discovery on various data repositories. It provides a RepoScanner type that
 // can be used to scan a data repository for sensitive data, classify the data,
-// and publish the results to external sources. Additionally, the sql subpackage
-// provides various SQL repository implementations that can be used to
-// introspect and sample SQL-based data repositories. Support for additional
-// data repository types, such as NoSQL-based repos, is intended to be added in
-// the future.
+// and publish the results to external sources.
+//
+// Additionally, the SQLRepository interface provides an API for performing
+// database introspection and data discovery on SQL databases. It encapsulates
+// the concept of a Dmap data SQL repository. All out-of-the-box SQLRepository
+// implementations are included in their own files named after the repository
+// type, e.g. mysql.go, postgres.go, etc.
+//
+// Registry provides an API for registering and constructing SQLRepository
+// implementations within an application. There is a global DefaultRegistry
+// which has all-out-of-the-box SQLRepository implementations registered to it
+// by default.
 package discovery
diff --git a/discovery/sql/gen.go b/discovery/gen.go
similarity index 90%
rename from discovery/sql/gen.go
rename to discovery/gen.go
index fd4cde9..b295816 100644
--- a/discovery/sql/gen.go
+++ b/discovery/gen.go
@@ -1,4 +1,4 @@
-package sql
+package discovery
 
 // Mock generation - see https://vektra.github.io/mockery/
 
diff --git a/discovery/sql/generic.go b/discovery/generic.go
similarity index 96%
rename from discovery/sql/generic.go
rename to discovery/generic.go
index 2d22d7f..92db79c 100644
--- a/discovery/sql/generic.go
+++ b/discovery/generic.go
@@ -1,4 +1,4 @@
-package sql
+package discovery
 
 import (
 	"context"
@@ -34,13 +34,13 @@ const (
 )
 
 // GenericRepository implements generic SQL functionalities that work for a
-// subset of ANSI SQL compatible databases. Many Repository implementations may
+// subset of ANSI SQL compatible databases. Many SQLRepository implementations may
 // partially or fully delegate to this implementation. In that respect, it acts
 // somewhat as a base implementation which can be used by SQL-compatible
 // repositories. Note that while GenericRepository is an implementation of
-// the Repository interface, GenericRepository is meant to be used as a building
-// block for other Repository implementations, rather than as a standalone
-// implementation. Specifically, the Repository.ListDatabases method is left
+// the SQLRepository interface, GenericRepository is meant to be used as a building
+// block for other SQLRepository implementations, rather than as a standalone
+// implementation. Specifically, the SQLRepository.ListDatabases method is left
 // un-implemented, since there is no standard way to list databases across
 // different SQL database platforms. It does however provide the
 // ListDatabasesWithQuery method, which dependent implementations can use to
@@ -54,7 +54,7 @@ type GenericRepository struct {
 	excludePaths []glob.Glob
 }
 
-var _ Repository = (*GenericRepository)(nil)
+var _ SQLRepository = (*GenericRepository)(nil)
 
 // NewGenericRepository is a constructor for the GenericRepository type. It
 // opens a database handle for a given repoType and returns a pointer to a new
@@ -177,7 +177,7 @@ func (r *GenericRepository) IntrospectWithQuery(
 // SampleTable samples the table referenced by the TableMetadata meta parameter
 // by issuing a standard, ANSI-compatible SELECT query to the database. All
 // attributes of the table are selected, and are quoted using double quotes. See
-// Repository.SampleTable for more details.
+// SQLRepository.SampleTable for more details.
 func (r *GenericRepository) SampleTable(
 	ctx context.Context,
 	meta *TableMetadata,
diff --git a/discovery/sql/generic_test.go b/discovery/generic_test.go
similarity index 99%
rename from discovery/sql/generic_test.go
rename to discovery/generic_test.go
index a947dee..ac13df5 100644
--- a/discovery/sql/generic_test.go
+++ b/discovery/generic_test.go
@@ -1,4 +1,4 @@
-package sql
+package discovery
 
 import (
 	"context"
diff --git a/discovery/sql/metadata.go b/discovery/metadata.go
similarity index 99%
rename from discovery/sql/metadata.go
rename to discovery/metadata.go
index dfd3c3c..ca71935 100644
--- a/discovery/sql/metadata.go
+++ b/discovery/metadata.go
@@ -1,4 +1,4 @@
-package sql
+package discovery
 
 import (
 	"strings"
diff --git a/discovery/sql/metadata_test.go b/discovery/metadata_test.go
similarity index 98%
rename from discovery/sql/metadata_test.go
rename to discovery/metadata_test.go
index f26b33c..c787e03 100644
--- a/discovery/sql/metadata_test.go
+++ b/discovery/metadata_test.go
@@ -1,4 +1,4 @@
-package sql
+package discovery
 
 import (
 	"testing"
diff --git a/discovery/sql/mock_repository_test.go b/discovery/mock_repository_test.go
similarity index 82%
rename from discovery/sql/mock_repository_test.go
rename to discovery/mock_repository_test.go
index a9bdf12..492bcb9 100644
--- a/discovery/sql/mock_repository_test.go
+++ b/discovery/mock_repository_test.go
@@ -1,6 +1,6 @@
 // Code generated by mockery v2.42.1. DO NOT EDIT.
 
-package sql
+package discovery
 
 import (
 	context "context"
@@ -8,7 +8,7 @@ import (
 	mock "github.com/stretchr/testify/mock"
 )
 
-// MockRepository is an autogenerated mock type for the Repository type
+// MockRepository is an autogenerated mock type for the SQLRepository type
 type MockRepository struct {
 	mock.Mock
 }
@@ -50,9 +50,11 @@ func (_e *MockRepository_Expecter) Close() *MockRepository_Close_Call {
 }
 
 func (_c *MockRepository_Close_Call) Run(run func()) *MockRepository_Close_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		run()
-	})
+	_c.Call.Run(
+		func(args mock.Arguments) {
+			run()
+		},
+	)
 	return _c
 }
 
@@ -108,9 +110,11 @@ func (_e *MockRepository_Expecter) Introspect(ctx interface{}) *MockRepository_I
 }
 
 func (_c *MockRepository_Introspect_Call) Run(run func(ctx context.Context)) *MockRepository_Introspect_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		run(args[0].(context.Context))
-	})
+	_c.Call.Run(
+		func(args mock.Arguments) {
+			run(args[0].(context.Context))
+		},
+	)
 	return _c
 }
 
@@ -119,7 +123,12 @@ func (_c *MockRepository_Introspect_Call) Return(_a0 *Metadata, _a1 error) *Mock
 	return _c
 }
 
-func (_c *MockRepository_Introspect_Call) RunAndReturn(run func(context.Context) (*Metadata, error)) *MockRepository_Introspect_Call {
+func (_c *MockRepository_Introspect_Call) RunAndReturn(
+	run func(context.Context) (
+		*Metadata,
+		error,
+	),
+) *MockRepository_Introspect_Call {
 	_c.Call.Return(run)
 	return _c
 }
@@ -166,9 +175,11 @@ func (_e *MockRepository_Expecter) ListDatabases(ctx interface{}) *MockRepositor
 }
 
 func (_c *MockRepository_ListDatabases_Call) Run(run func(ctx context.Context)) *MockRepository_ListDatabases_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		run(args[0].(context.Context))
-	})
+	_c.Call.Run(
+		func(args mock.Arguments) {
+			run(args[0].(context.Context))
+		},
+	)
 	return _c
 }
 
@@ -177,7 +188,12 @@ func (_c *MockRepository_ListDatabases_Call) Return(_a0 []string, _a1 error) *Mo
 	return _c
 }
 
-func (_c *MockRepository_ListDatabases_Call) RunAndReturn(run func(context.Context) ([]string, error)) *MockRepository_ListDatabases_Call {
+func (_c *MockRepository_ListDatabases_Call) RunAndReturn(
+	run func(context.Context) (
+		[]string,
+		error,
+	),
+) *MockRepository_ListDatabases_Call {
 	_c.Call.Return(run)
 	return _c
 }
@@ -212,9 +228,11 @@ func (_e *MockRepository_Expecter) Ping(ctx interface{}) *MockRepository_Ping_Ca
 }
 
 func (_c *MockRepository_Ping_Call) Run(run func(ctx context.Context)) *MockRepository_Ping_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		run(args[0].(context.Context))
-	})
+	_c.Call.Run(
+		func(args mock.Arguments) {
+			run(args[0].(context.Context))
+		},
+	)
 	return _c
 }
 
@@ -229,7 +247,10 @@ func (_c *MockRepository_Ping_Call) RunAndReturn(run func(context.Context) error
 }
 
 // SampleTable provides a mock function with given fields: ctx, meta, params
-func (_m *MockRepository) SampleTable(ctx context.Context, meta *TableMetadata, params SampleParameters) (Sample, error) {
+func (_m *MockRepository) SampleTable(ctx context.Context, meta *TableMetadata, params SampleParameters) (
+	Sample,
+	error,
+) {
 	ret := _m.Called(ctx, meta, params)
 
 	if len(ret) == 0 {
@@ -265,14 +286,26 @@ type MockRepository_SampleTable_Call struct {
 //   - ctx context.Context
 //   - meta *TableMetadata
 //   - params SampleParameters
-func (_e *MockRepository_Expecter) SampleTable(ctx interface{}, meta interface{}, params interface{}) *MockRepository_SampleTable_Call {
+func (_e *MockRepository_Expecter) SampleTable(
+	ctx interface{},
+	meta interface{},
+	params interface{},
+) *MockRepository_SampleTable_Call {
 	return &MockRepository_SampleTable_Call{Call: _e.mock.On("SampleTable", ctx, meta, params)}
 }
 
-func (_c *MockRepository_SampleTable_Call) Run(run func(ctx context.Context, meta *TableMetadata, params SampleParameters)) *MockRepository_SampleTable_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		run(args[0].(context.Context), args[1].(*TableMetadata), args[2].(SampleParameters))
-	})
+func (_c *MockRepository_SampleTable_Call) Run(
+	run func(
+		ctx context.Context,
+		meta *TableMetadata,
+		params SampleParameters,
+	),
+) *MockRepository_SampleTable_Call {
+	_c.Call.Run(
+		func(args mock.Arguments) {
+			run(args[0].(context.Context), args[1].(*TableMetadata), args[2].(SampleParameters))
+		},
+	)
 	return _c
 }
 
@@ -281,17 +314,25 @@ func (_c *MockRepository_SampleTable_Call) Return(_a0 Sample, _a1 error) *MockRe
 	return _c
 }
 
-func (_c *MockRepository_SampleTable_Call) RunAndReturn(run func(context.Context, *TableMetadata, SampleParameters) (Sample, error)) *MockRepository_SampleTable_Call {
+func (_c *MockRepository_SampleTable_Call) RunAndReturn(
+	run func(
+		context.Context,
+		*TableMetadata,
+		SampleParameters,
+	) (Sample, error),
+) *MockRepository_SampleTable_Call {
 	_c.Call.Return(run)
 	return _c
 }
 
 // NewMockRepository creates a new instance of Mocksql. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
 // The first argument is typically a *testing.T value.
-func NewMockRepository(t interface {
-	mock.TestingT
-	Cleanup(func())
-}) *MockRepository {
+func NewMockRepository(
+	t interface {
+		mock.TestingT
+		Cleanup(func())
+	},
+) *MockRepository {
 	mock := &MockRepository{}
 	mock.Mock.Test(t)
 
diff --git a/discovery/sql/mysql.go b/discovery/mysql.go
similarity index 80%
rename from discovery/sql/mysql.go
rename to discovery/mysql.go
index f3e9421..7a7afc8 100644
--- a/discovery/sql/mysql.go
+++ b/discovery/mysql.go
@@ -1,11 +1,9 @@
-package sql
+package discovery
 
 import (
 	"context"
 	"fmt"
 
-	"github.com/cyralinc/dmap/discovery/config"
-
 	// MySQL DB driver
 	_ "github.com/go-sql-driver/mysql"
 )
@@ -24,18 +22,18 @@ WHERE
 `
 )
 
-// MySqlRepository is a Repository implementation for MySQL databases.
+// MySqlRepository is a SQLRepository implementation for MySQL databases.
 type MySqlRepository struct {
-	// The majority of the Repository functionality is delegated to
+	// The majority of the SQLRepository functionality is delegated to
 	// a generic SQL repository instance (genericSqlRepo).
 	genericSqlRepo *GenericRepository
 }
 
-// MySqlRepository implements Repository
-var _ Repository = (*MySqlRepository)(nil)
+// MySqlRepository implements SQLRepository
+var _ SQLRepository = (*MySqlRepository)(nil)
 
 // NewMySqlRepository creates a new MySQL sql.
-func NewMySqlRepository(cfg config.RepoConfig) (*MySqlRepository, error) {
+func NewMySqlRepository(cfg RepoConfig) (*MySqlRepository, error) {
 	connStr := fmt.Sprintf(
 		"%s:%s@tcp(%s:%d)/%s",
 		cfg.User,
@@ -69,14 +67,14 @@ func (r *MySqlRepository) ListDatabases(ctx context.Context) ([]string, error) {
 }
 
 // Introspect delegates introspection to GenericRepository. See
-// Repository.Introspect and GenericRepository.IntrospectWithQuery for more
+// SQLRepository.Introspect and GenericRepository.IntrospectWithQuery for more
 // details.
 func (r *MySqlRepository) Introspect(ctx context.Context) (*Metadata, error) {
 	return r.genericSqlRepo.Introspect(ctx)
 }
 
 // SampleTable delegates sampling to GenericRepository, using a MySQL-specific
-// table sample query. See Repository.SampleTable and
+// table sample query. See SQLRepository.SampleTable and
 // GenericRepository.SampleTableWithQuery for more details.
 func (r *MySqlRepository) SampleTable(
 	ctx context.Context,
@@ -91,13 +89,13 @@ func (r *MySqlRepository) SampleTable(
 	return r.genericSqlRepo.SampleTableWithQuery(ctx, meta, query, params.SampleSize, params.Offset)
 }
 
-// Ping delegates the ping to GenericRepository. See Repository.Ping and
+// Ping delegates the ping to GenericRepository. See SQLRepository.Ping and
 // GenericRepository.Ping for more details.
 func (r *MySqlRepository) Ping(ctx context.Context) error {
 	return r.genericSqlRepo.Ping(ctx)
 }
 
-// Close delegates the close to GenericRepository. See Repository.Close and
+// Close delegates the close to GenericRepository. See SQLRepository.Close and
 // GenericRepository.Close for more details.
 func (r *MySqlRepository) Close() error {
 	return r.genericSqlRepo.Close()
diff --git a/discovery/sql/mysql_test.go b/discovery/mysql_test.go
similarity index 97%
rename from discovery/sql/mysql_test.go
rename to discovery/mysql_test.go
index 1ee978c..9361a5f 100644
--- a/discovery/sql/mysql_test.go
+++ b/discovery/mysql_test.go
@@ -1,4 +1,4 @@
-package sql
+package discovery
 
 import (
 	"context"
diff --git a/discovery/sql/oracle.go b/discovery/oracle.go
similarity index 84%
rename from discovery/sql/oracle.go
rename to discovery/oracle.go
index 5547ef2..a3dfcb1 100644
--- a/discovery/sql/oracle.go
+++ b/discovery/oracle.go
@@ -1,12 +1,10 @@
-package sql
+package discovery
 
 import (
 	"context"
 	"errors"
 	"fmt"
 
-	"github.com/cyralinc/dmap/discovery/config"
-
 	// Oracle DB driver
 	_ "github.com/sijms/go-ora/v2"
 )
@@ -38,18 +36,18 @@ ON
 	configServiceName = "service-name"
 )
 
-// OracleRepository is a Repository implementation for Oracle databases.
+// OracleRepository is a SQLRepository implementation for Oracle databases.
 type OracleRepository struct {
 	// The majority of the OracleRepository functionality is delegated to
 	// a generic SQL repository instance (genericSqlRepo).
 	genericSqlRepo *GenericRepository
 }
 
-// OracleRepository implements Repository
-var _ Repository = (*OracleRepository)(nil)
+// OracleRepository implements SQLRepository
+var _ SQLRepository = (*OracleRepository)(nil)
 
 // NewOracleRepository creates a new Oracle repository.
-func NewOracleRepository(cfg config.RepoConfig) (*OracleRepository, error) {
+func NewOracleRepository(cfg RepoConfig) (*OracleRepository, error) {
 	oracleCfg, err := ParseOracleConfig(cfg)
 	if err != nil {
 		return nil, fmt.Errorf("unable to parse oracle config: %w", err)
@@ -85,14 +83,14 @@ func (r *OracleRepository) ListDatabases(_ context.Context) ([]string, error) {
 }
 
 // Introspect delegates introspection to GenericRepository, using an
-// Oracle-specific introspection query. See Repository.Introspect and
+// Oracle-specific introspection query. See SQLRepository.Introspect and
 // GenericRepository.IntrospectWithQuery for more details.
 func (r *OracleRepository) Introspect(ctx context.Context) (*Metadata, error) {
 	return r.genericSqlRepo.IntrospectWithQuery(ctx, OracleIntrospectQuery)
 }
 
 // SampleTable delegates sampling to GenericRepository, using an Oracle-specific
-// table sample query. See Repository.SampleTable and
+// table sample query. See SQLRepository.SampleTable and
 // GenericRepository.SampleTableWithQuery for more details.
 func (r *OracleRepository) SampleTable(
 	ctx context.Context,
@@ -118,7 +116,7 @@ func (r *OracleRepository) Ping(ctx context.Context) error {
 	return r.genericSqlRepo.GetDb().PingContext(ctx)
 }
 
-// Close delegates the close to GenericRepository. See Repository.Close and
+// Close delegates the close to GenericRepository. See SQLRepository.Close and
 // GenericRepository.Close for more details.
 func (r *OracleRepository) Close() error {
 	return r.genericSqlRepo.Close()
@@ -131,10 +129,10 @@ type OracleConfig struct {
 }
 
 // ParseOracleConfig parses the Oracle-specific configuration from the
-// given config. The Oracle configuration is expected to be in the
+// given  The Oracle configuration is expected to be in the
 // config's "advanced config" property.
-func ParseOracleConfig(cfg config.RepoConfig) (*OracleConfig, error) {
-	oracleCfg, err := config.FetchAdvancedConfigString(
+func ParseOracleConfig(cfg RepoConfig) (*OracleConfig, error) {
+	oracleCfg, err := FetchAdvancedConfigString(
 		cfg,
 		RepoTypeOracle,
 		[]string{configServiceName},
diff --git a/discovery/sql/postgres.go b/discovery/postgres.go
similarity index 78%
rename from discovery/sql/postgres.go
rename to discovery/postgres.go
index 04c5732..df9603a 100644
--- a/discovery/sql/postgres.go
+++ b/discovery/postgres.go
@@ -1,11 +1,9 @@
-package sql
+package discovery
 
 import (
 	"context"
 	"fmt"
 
-	"github.com/cyralinc/dmap/discovery/config"
-
 	// Postgresql DB driver
 	_ "github.com/lib/pq"
 )
@@ -25,18 +23,18 @@ WHERE
 `
 )
 
-// PostgresRepository is a Repository implementation for Postgres databases.
+// PostgresRepository is a SQLRepository implementation for Postgres databases.
 type PostgresRepository struct {
-	// The majority of the Repository functionality is delegated to
+	// The majority of the SQLRepository functionality is delegated to
 	// a generic SQL repository instance (genericSqlRepo).
 	genericSqlRepo *GenericRepository
 }
 
-// PostgresRepository implements Repository
-var _ Repository = (*PostgresRepository)(nil)
+// PostgresRepository implements SQLRepository
+var _ SQLRepository = (*PostgresRepository)(nil)
 
 // NewPostgresRepository creates a new PostgresRepository.
-func NewPostgresRepository(cfg config.RepoConfig) (*PostgresRepository, error) {
+func NewPostgresRepository(cfg RepoConfig) (*PostgresRepository, error) {
 	pgCfg, err := ParsePostgresConfig(cfg)
 	if err != nil {
 		return nil, fmt.Errorf("error parsing postgres config: %w", err)
@@ -78,14 +76,14 @@ func (r *PostgresRepository) ListDatabases(ctx context.Context) ([]string, error
 }
 
 // Introspect delegates introspection to GenericRepository. See
-// Repository.Introspect and GenericRepository.IntrospectWithQuery for more
+// SQLRepository.Introspect and GenericRepository.IntrospectWithQuery for more
 // details.
 func (r *PostgresRepository) Introspect(ctx context.Context) (*Metadata, error) {
 	return r.genericSqlRepo.Introspect(ctx)
 }
 
 // SampleTable delegates sampling to GenericRepository, using a
-// Postgres-specific table sample query. See Repository.SampleTable and
+// Postgres-specific table sample query. See SQLRepository.SampleTable and
 // GenericRepository.SampleTableWithQuery for more details.
 func (r *PostgresRepository) SampleTable(
 	ctx context.Context,
@@ -99,13 +97,13 @@ func (r *PostgresRepository) SampleTable(
 	return r.genericSqlRepo.SampleTableWithQuery(ctx, meta, query, params.SampleSize, params.Offset)
 }
 
-// Ping delegates the ping to GenericRepository. See Repository.Ping and
+// Ping delegates the ping to GenericRepository. See SQLRepository.Ping and
 // GenericRepository.Ping for more details.
 func (r *PostgresRepository) Ping(ctx context.Context) error {
 	return r.genericSqlRepo.Ping(ctx)
 }
 
-// Close delegates the close to GenericRepository. See Repository.Close and
+// Close delegates the close to GenericRepository. See SQLRepository.Close and
 // GenericRepository.Close for more details.
 func (r *PostgresRepository) Close() error {
 	return r.genericSqlRepo.Close()
@@ -118,10 +116,10 @@ type PostgresConfig struct {
 }
 
 // ParsePostgresConfig parses the Postgres-specific configuration parameters
-// from the given config. The Postgres connection options are built from the
-// config and stored in the ConnOptsStr field of the returned PostgresConfig.
-func ParsePostgresConfig(cfg config.RepoConfig) (*PostgresConfig, error) {
-	connOptsStr, err := config.BuildConnOptsStr(cfg)
+// from the given  The Postgres connection options are built from the
+// config and stored in the ConnOptsStr field of the returned Postgres
+func ParsePostgresConfig(cfg RepoConfig) (*PostgresConfig, error) {
+	connOptsStr, err := BuildConnOptsStr(cfg)
 	if err != nil {
 		return nil, fmt.Errorf("error building connection options string: %w", err)
 	}
diff --git a/discovery/sql/postgres_test.go b/discovery/postgres_test.go
similarity index 97%
rename from discovery/sql/postgres_test.go
rename to discovery/postgres_test.go
index b586a63..1794a17 100644
--- a/discovery/sql/postgres_test.go
+++ b/discovery/postgres_test.go
@@ -1,4 +1,4 @@
-package sql
+package discovery
 
 import (
 	"context"
diff --git a/discovery/sql/redshift.go b/discovery/redshift.go
similarity index 81%
rename from discovery/sql/redshift.go
rename to discovery/redshift.go
index 11dc5a2..57027d8 100644
--- a/discovery/sql/redshift.go
+++ b/discovery/redshift.go
@@ -1,11 +1,9 @@
-package sql
+package discovery
 
 import (
 	"context"
 	"fmt"
 
-	"github.com/cyralinc/dmap/discovery/config"
-
 	// Use PostgreSQL DB driver for Redshift
 	_ "github.com/lib/pq"
 )
@@ -14,18 +12,18 @@ const (
 	RepoTypeRedshift = "redshift"
 )
 
-// RedshiftRepository is a Repository implementation for Redshift databases.
+// RedshiftRepository is a SQLRepository implementation for Redshift databases.
 type RedshiftRepository struct {
 	// The majority of the RedshiftRepository functionality is delegated to
 	// a generic SQL repository instance (genericSqlRepo).
 	genericSqlRepo *GenericRepository
 }
 
-// RedshiftRepository implements Repository
-var _ Repository = (*RedshiftRepository)(nil)
+// RedshiftRepository implements SQLRepository
+var _ SQLRepository = (*RedshiftRepository)(nil)
 
 // NewRedshiftRepository creates a new RedshiftRepository.
-func NewRedshiftRepository(cfg config.RepoConfig) (*RedshiftRepository, error) {
+func NewRedshiftRepository(cfg RepoConfig) (*RedshiftRepository, error) {
 	pgCfg, err := ParsePostgresConfig(cfg)
 	if err != nil {
 		return nil, fmt.Errorf("unable to parse postgres config: %w", err)
@@ -68,14 +66,14 @@ func (r *RedshiftRepository) ListDatabases(ctx context.Context) ([]string, error
 }
 
 // Introspect delegates introspection to GenericRepository. See
-// Repository.Introspect and GenericRepository.IntrospectWithQuery for more
+// SQLRepository.Introspect and GenericRepository.IntrospectWithQuery for more
 // details.
 func (r *RedshiftRepository) Introspect(ctx context.Context) (*Metadata, error) {
 	return r.genericSqlRepo.Introspect(ctx)
 }
 
 // SampleTable delegates sampling to GenericRepository, using a
-// Redshift-specific table sample query. See Repository.SampleTable and
+// Redshift-specific table sample query. See SQLRepository.SampleTable and
 // GenericRepository.SampleTableWithQuery for more details.
 func (r *RedshiftRepository) SampleTable(
 	ctx context.Context,
@@ -89,13 +87,13 @@ func (r *RedshiftRepository) SampleTable(
 	return r.genericSqlRepo.SampleTableWithQuery(ctx, meta, query, params.SampleSize, params.Offset)
 }
 
-// Ping delegates the ping to GenericRepository. See Repository.Ping and
+// Ping delegates the ping to GenericRepository. See SQLRepository.Ping and
 // GenericRepository.Ping for more details.
 func (r *RedshiftRepository) Ping(ctx context.Context) error {
 	return r.genericSqlRepo.Ping(ctx)
 }
 
-// Close delegates the close to GenericRepository. See Repository.Close and
+// Close delegates the close to GenericRepository. See SQLRepository.Close and
 // GenericRepository.Close for more details.
 func (r *RedshiftRepository) Close() error {
 	return r.genericSqlRepo.Close()
diff --git a/discovery/sql/redshift_test.go b/discovery/redshift_test.go
similarity index 97%
rename from discovery/sql/redshift_test.go
rename to discovery/redshift_test.go
index 5b28bfd..07df14c 100644
--- a/discovery/sql/redshift_test.go
+++ b/discovery/redshift_test.go
@@ -1,4 +1,4 @@
-package sql
+package discovery
 
 import (
 	"context"
diff --git a/discovery/sql/registry.go b/discovery/registry.go
similarity index 79%
rename from discovery/sql/registry.go
rename to discovery/registry.go
index f9c2e4e..da18fc2 100644
--- a/discovery/sql/registry.go
+++ b/discovery/registry.go
@@ -1,11 +1,9 @@
-package sql
+package discovery
 
 import (
 	"context"
 	"errors"
 	"fmt"
-
-	"github.com/cyralinc/dmap/discovery/config"
 )
 
 var (
@@ -13,7 +11,7 @@ var (
 	// package of which a number of convenience functions in this package act
 	// on. All currently out-of-the-box repository types are registered to this
 	// registry by this package's init function. Users who want to use custom
-	// Repository implementations, or just avoid global state altogether, should
+	// SQLRepository implementations, or just avoid global state altogether, should
 	// use their own instance of Registry, instead of using DefaultRegistry and
 	// the corresponding convenience functions.
 	DefaultRegistry = NewRegistry()
@@ -28,7 +26,7 @@ type Registry struct {
 
 // RepoConstructor represents the function signature that all repository
 // implementations should use for their constructor functions.
-type RepoConstructor func(ctx context.Context, cfg config.RepoConfig) (Repository, error)
+type RepoConstructor func(ctx context.Context, cfg RepoConfig) (SQLRepository, error)
 
 // NewRegistry creates a new Registry instance.
 func NewRegistry() *Registry {
@@ -59,12 +57,12 @@ func (r *Registry) MustRegister(repoType string, constructor RepoConstructor) {
 	}
 }
 
-// NewRepository is a factory method to return a concrete Repository
+// NewRepository is a factory method to return a concrete SQLRepository
 // implementation based on the specified type, e.g. MySQL, Postgres, SQL Server,
 // etc., which must be registered with the registry. If the repository type is
 // not registered, an error is returned. A new instance of the repository is
 // returned each time this method is called.
-func (r *Registry) NewRepository(ctx context.Context, cfg config.RepoConfig) (Repository, error) {
+func (r *Registry) NewRepository(ctx context.Context, cfg RepoConfig) (SQLRepository, error) {
 	constructor, ok := r.constructors[cfg.Type]
 	if !ok {
 		return nil, errors.New("unsupported repo type " + cfg.Type)
@@ -90,7 +88,7 @@ func MustRegister(repoType string, constructor RepoConstructor) {
 
 // NewRepository is a convenience function that delegates to DefaultRegistry.
 // See Registry.NewRepository for more details.
-func NewRepository(ctx context.Context, cfg config.RepoConfig) (Repository, error) {
+func NewRepository(ctx context.Context, cfg RepoConfig) (SQLRepository, error) {
 	return DefaultRegistry.NewRepository(ctx, cfg)
 }
 
@@ -99,43 +97,43 @@ func NewRepository(ctx context.Context, cfg config.RepoConfig) (Repository, erro
 func init() {
 	MustRegister(
 		RepoTypeDenodo,
-		func(_ context.Context, cfg config.RepoConfig) (Repository, error) {
+		func(_ context.Context, cfg RepoConfig) (SQLRepository, error) {
 			return NewDenodoRepository(cfg)
 		},
 	)
 	MustRegister(
 		RepoTypeMysql,
-		func(_ context.Context, cfg config.RepoConfig) (Repository, error) {
+		func(_ context.Context, cfg RepoConfig) (SQLRepository, error) {
 			return NewMySqlRepository(cfg)
 		},
 	)
 	MustRegister(
 		RepoTypeOracle,
-		func(_ context.Context, cfg config.RepoConfig) (Repository, error) {
+		func(_ context.Context, cfg RepoConfig) (SQLRepository, error) {
 			return NewOracleRepository(cfg)
 		},
 	)
 	MustRegister(
 		RepoTypePostgres,
-		func(_ context.Context, cfg config.RepoConfig) (Repository, error) {
+		func(_ context.Context, cfg RepoConfig) (SQLRepository, error) {
 			return NewPostgresRepository(cfg)
 		},
 	)
 	MustRegister(
 		RepoTypeRedshift,
-		func(_ context.Context, cfg config.RepoConfig) (Repository, error) {
+		func(_ context.Context, cfg RepoConfig) (SQLRepository, error) {
 			return NewRedshiftRepository(cfg)
 		},
 	)
 	MustRegister(
 		RepoTypeSnowflake,
-		func(ctx context.Context, cfg config.RepoConfig) (Repository, error) {
+		func(ctx context.Context, cfg RepoConfig) (SQLRepository, error) {
 			return NewSnowflakeRepository(cfg)
 		},
 	)
 	MustRegister(
 		RepoTypeSqlServer,
-		func(_ context.Context, cfg config.RepoConfig) (Repository, error) {
+		func(_ context.Context, cfg RepoConfig) (SQLRepository, error) {
 			return NewSqlServerRepository(cfg)
 		},
 	)
diff --git a/discovery/registry_test.go b/discovery/registry_test.go
new file mode 100644
index 0000000..d459e36
--- /dev/null
+++ b/discovery/registry_test.go
@@ -0,0 +1,113 @@
+package discovery
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TODO: refactor tests to use registry instance, not default registry -ccampo 2024-04-02
+
+func TestRegistry_Register_Successful(t *testing.T) {
+	repoType := "repoType"
+	constructor := func(context.Context, RepoConfig) (SQLRepository, error) {
+		return nil, nil
+	}
+	reg := NewRegistry()
+	err := reg.Register(repoType, constructor)
+	require.NoError(t, err)
+	assert.Contains(t, reg.constructors, repoType)
+}
+
+func TestRegistry_MustRegister_NilConstructor(t *testing.T) {
+	reg := NewRegistry()
+	assert.Panics(t, func() { reg.MustRegister("repoType", nil) })
+}
+
+func TestRegistry_MustRegister_TwoCalls_Panics(t *testing.T) {
+	repoType := "repoType"
+	constructor := func(context.Context, RepoConfig) (SQLRepository, error) {
+		return nil, nil
+	}
+	reg := NewRegistry()
+	reg.MustRegister(repoType, constructor)
+	assert.Contains(t, reg.constructors, repoType)
+	assert.Panics(t, func() { reg.MustRegister(repoType, constructor) })
+}
+
+func TestRegistry_NewRepository_IsSuccessful(t *testing.T) {
+	repoType := "repoType"
+	called := false
+	expectedRepo := dummyRepo{}
+	constructor := func(context.Context, RepoConfig) (SQLRepository, error) {
+		called = true
+		return expectedRepo, nil
+	}
+	reg := NewRegistry()
+	err := reg.Register(repoType, constructor)
+	require.NoError(t, err)
+	assert.Contains(t, reg.constructors, repoType)
+
+	cfg := RepoConfig{Type: repoType}
+	repo, err := reg.NewRepository(context.Background(), cfg)
+	assert.NoError(t, err)
+	assert.Equal(t, expectedRepo, repo)
+	assert.True(t, called, "Constructor was not called")
+}
+
+func TestRegistry_NewRepository_ConstructorError(t *testing.T) {
+	repoType := "repoType"
+	called := false
+	expectedErr := errors.New("dummy error")
+	constructor := func(context.Context, RepoConfig) (SQLRepository, error) {
+		called = true
+		return nil, expectedErr
+	}
+	reg := NewRegistry()
+	err := reg.Register(repoType, constructor)
+	require.NoError(t, err)
+	assert.Contains(t, reg.constructors, repoType)
+
+	cfg := RepoConfig{Type: repoType}
+	repo, err := reg.NewRepository(context.Background(), cfg)
+	assert.ErrorIs(t, err, expectedErr)
+	assert.Nil(t, repo)
+	assert.True(t, called, "Constructor was not called")
+}
+
+func TestRegistry_NewRepository_UnsupportedRepoType(t *testing.T) {
+	repoType := "repoType"
+	cfg := RepoConfig{Type: repoType}
+	reg := NewRegistry()
+	repo, err := reg.NewRepository(context.Background(), cfg)
+	assert.Error(t, err)
+	assert.Nil(t, repo)
+}
+
+type dummyRepo struct{}
+
+func (d dummyRepo) SampleTable(context.Context, *TableMetadata, SampleParameters) (
+	Sample,
+	error,
+) {
+	panic("not implemented")
+}
+
+func (d dummyRepo) ListDatabases(context.Context) ([]string, error) {
+	panic("not implemented")
+}
+
+func (d dummyRepo) Introspect(context.Context) (*Metadata, error) {
+	panic("not implemented")
+}
+
+func (d dummyRepo) Ping(context.Context) error {
+	panic("not implemented")
+}
+
+func (d dummyRepo) Close() error {
+	panic("not implemented")
+}
diff --git a/discovery/sql/sample_all_databases_test.go b/discovery/sample_all_databases_test.go
similarity index 93%
rename from discovery/sql/sample_all_databases_test.go
rename to discovery/sample_all_databases_test.go
index fad87eb..0539d05 100644
--- a/discovery/sql/sample_all_databases_test.go
+++ b/discovery/sample_all_databases_test.go
@@ -1,4 +1,4 @@
-package sql
+package discovery
 
 import (
 	"context"
@@ -7,17 +7,15 @@ import (
 
 	"github.com/stretchr/testify/mock"
 	"github.com/stretchr/testify/require"
-
-	"github.com/cyralinc/dmap/discovery/config"
 )
 
 const mockRepoType = "mockRepo"
 
 func setup(t *testing.T) *MockRepository {
 	repo := NewMockRepository(t)
-	Register(
+	MustRegister(
 		mockRepoType,
-		func(ctx context.Context, cfg config.RepoConfig) (Repository, error) {
+		func(ctx context.Context, cfg RepoConfig) (SQLRepository, error) {
 			return repo, nil
 		},
 	)
@@ -25,7 +23,7 @@ func setup(t *testing.T) *MockRepository {
 }
 
 func cleanup() {
-	delete(registry, mockRepoType)
+	delete(DefaultRegistry.constructors, mockRepoType)
 }
 
 func TestSampleAllDatabases_Error(t *testing.T) {
@@ -35,7 +33,7 @@ func TestSampleAllDatabases_Error(t *testing.T) {
 	ctx := context.Background()
 	listDbErr := errors.New("error listing databases")
 	repo.On("ListDatabases", ctx).Return(nil, listDbErr)
-	cfg := config.RepoConfig{Type: mockRepoType}
+	cfg := RepoConfig{Type: mockRepoType}
 	sampleParams := SampleParameters{SampleSize: 5}
 	samples, err := SampleAllDatabases(ctx, repo, cfg, sampleParams)
 	require.Nil(t, samples)
@@ -92,7 +90,7 @@ func TestSampleAllDatabases_Successful_TwoDatabases(t *testing.T) {
 		Return(sample, nil)
 	repo.On("Close").Return(nil)
 
-	cfg := config.RepoConfig{Type: mockRepoType}
+	cfg := RepoConfig{Type: mockRepoType}
 	sampleParams := SampleParameters{SampleSize: 5}
 	samples, err := SampleAllDatabases(ctx, repo, cfg, sampleParams)
 	require.NoError(t, err)
@@ -113,7 +111,7 @@ func TestSampleAllDatabases_IntrospectError(t *testing.T) {
 	repo.On("Introspect", mock.Anything).Return(nil, introspectErr)
 	repo.On("Close").Return(nil)
 
-	cfg := config.RepoConfig{Type: mockRepoType}
+	cfg := RepoConfig{Type: mockRepoType}
 	sampleParams := SampleParameters{SampleSize: 5}
 	samples, err := SampleAllDatabases(ctx, repo, cfg, sampleParams)
 	require.Empty(t, samples)
@@ -158,7 +156,7 @@ func TestSampleAllDatabases_SampleError(t *testing.T) {
 		Return(Sample{}, sampleErr)
 	repo.On("Close").Return(nil)
 
-	cfg := config.RepoConfig{Type: mockRepoType}
+	cfg := RepoConfig{Type: mockRepoType}
 	sampleParams := SampleParameters{SampleSize: 5}
 	samples, err := SampleAllDatabases(ctx, repo, cfg, sampleParams)
 	require.NoError(t, err)
@@ -218,7 +216,7 @@ func TestSampleAllDatabases_TwoDatabases_OneSampleError(t *testing.T) {
 		Return(Sample{}, sampleErr).Once()
 	repo.On("Close").Return(nil)
 
-	cfg := config.RepoConfig{Type: mockRepoType}
+	cfg := RepoConfig{Type: mockRepoType}
 	sampleParams := SampleParameters{SampleSize: 5}
 	samples, err := SampleAllDatabases(ctx, repo, cfg, sampleParams)
 	require.NoError(t, err)
diff --git a/discovery/sql/sample_repository_test.go b/discovery/sample_repository_test.go
similarity index 99%
rename from discovery/sql/sample_repository_test.go
rename to discovery/sample_repository_test.go
index ecc2449..e1323e3 100644
--- a/discovery/sql/sample_repository_test.go
+++ b/discovery/sample_repository_test.go
@@ -1,4 +1,4 @@
-package sql
+package discovery
 
 import (
 	"context"
diff --git a/discovery/sql/sampling.go b/discovery/sampling.go
similarity index 96%
rename from discovery/sql/sampling.go
rename to discovery/sampling.go
index ec4d5dc..24b3a14 100644
--- a/discovery/sql/sampling.go
+++ b/discovery/sampling.go
@@ -1,4 +1,4 @@
-package sql
+package discovery
 
 import (
 	"context"
@@ -8,8 +8,6 @@ import (
 	"github.com/hashicorp/go-multierror"
 	log "github.com/sirupsen/logrus"
 	"golang.org/x/sync/semaphore"
-
-	"github.com/cyralinc/dmap/discovery/config"
 )
 
 // SampleParameters contains all parameters necessary to sample a table.
@@ -84,7 +82,7 @@ func (result SampleResult) GetAttributeNamesAndValues() ([]string, []string) {
 // metadata, it calls sql.SampleTable in a new goroutine. Once all the
 // sampling goroutines are finished, their results are collected and returned
 // as a slice of Sample.
-func SampleRepository(ctx context.Context, repo Repository, params SampleParameters) (
+func SampleRepository(ctx context.Context, repo SQLRepository, params SampleParameters) (
 	[]Sample,
 	error,
 ) {
@@ -138,8 +136,8 @@ func SampleRepository(ctx context.Context, repo Repository, params SampleParamet
 // sampled.
 func SampleAllDatabases(
 	ctx context.Context,
-	repo Repository,
-	repoCfg config.RepoConfig,
+	repo SQLRepository,
+	repoCfg RepoConfig,
 	sampleParams SampleParameters,
 ) (
 	[]Sample,
@@ -166,7 +164,7 @@ func SampleAllDatabases(
 		sema = semaphore.NewWeighted(int64(repoCfg.MaxOpenConns))
 	}
 	for _, db := range dbs {
-		go func(db string, cfg config.RepoConfig) {
+		go func(db string, cfg RepoConfig) {
 			defer wg.Done()
 			if sema != nil {
 				_ = sema.Acquire(ctx, 1)
@@ -175,6 +173,7 @@ func SampleAllDatabases(
 			cfg.Database = db
 			// Create a repository instance for this database. It will be used
 			// to connect and sample the database.
+			// TODO: this is ugly - there's gotta be a better way to do this -ccampo 2024-04-02
 			repo, err := NewRepository(ctx, cfg)
 			if err != nil {
 				log.WithError(err).Errorf("error creating repository instance for database %s", db)
diff --git a/discovery/sql/sampling_test.go b/discovery/sampling_test.go
similarity index 98%
rename from discovery/sql/sampling_test.go
rename to discovery/sampling_test.go
index 8bdceb7..f964a4f 100644
--- a/discovery/sql/sampling_test.go
+++ b/discovery/sampling_test.go
@@ -1,4 +1,4 @@
-package sql
+package discovery
 
 import (
 	"testing"
diff --git a/discovery/scanner.go b/discovery/scanner.go
deleted file mode 100644
index f01a776..0000000
--- a/discovery/scanner.go
+++ /dev/null
@@ -1,156 +0,0 @@
-package discovery
-
-import (
-	"context"
-	"errors"
-	"fmt"
-
-	log "github.com/sirupsen/logrus"
-
-	"github.com/cyralinc/dmap/classification"
-	"github.com/cyralinc/dmap/classification/publisher"
-	"github.com/cyralinc/dmap/discovery/config"
-	"github.com/cyralinc/dmap/discovery/sql"
-)
-
-// Scanner is a data discovery scanner that scans a data repository for
-// sensitive data. It also classifies the data and publishes the results to
-// the configured external sources. It currently only supports SQL-based
-// repositories.
-type Scanner struct {
-	config     *config.Config
-	repository sql.Repository
-	classifier classification.Classifier
-	publisher  publisher.Publisher
-}
-
-// ScannerOption is a functional option type for the Scanner type.
-type ScannerOption func(*Scanner)
-
-// Repository is a functional option that sets the repository for the Scanner.
-func Repository(r sql.Repository) ScannerOption {
-	return func(s *Scanner) { s.repository = r }
-}
-
-// Classifier is a functional option that sets the classifier for the Scanner.
-func Classifier(c classification.Classifier) ScannerOption {
-	return func(s *Scanner) { s.classifier = c }
-}
-
-// Publisher is a functional option that sets the publisher for the Scanner.
-func Publisher(p publisher.Publisher) ScannerOption {
-	return func(s *Scanner) { s.publisher = p }
-}
-
-// NewScanner creates a new Scanner instance with the provided configuration.
-func NewScanner(
-	ctx context.Context,
-	config *config.Config,
-	opts ...ScannerOption,
-) (*Scanner, error) {
-	if config == nil {
-		return nil, errors.New("config can't be nil")
-	}
-	s := &Scanner{config: config}
-	// Apply options.
-	for _, opt := range opts {
-		opt(s)
-	}
-	if s.publisher == nil {
-		// Default to stdout publisher.
-		s.publisher = publisher.NewStdOutPublisher()
-	}
-	if s.classifier == nil {
-		// Create a new label classifier with the embedded labels.
-		lbls, err := classification.GetEmbeddedLabels()
-		if err != nil {
-			return nil, fmt.Errorf("error getting embedded labels: %w", err)
-		}
-		c, err := classification.NewLabelClassifier(lbls.ToSlice()...)
-		if err != nil {
-			return nil, fmt.Errorf("error creating new label classifier: %w", err)
-		}
-		s.classifier = c
-	}
-	if s.repository == nil {
-		// Get a repository instance from the default registry.
-		repo, err := sql.NewRepository(ctx, s.config.Repo)
-		if err != nil {
-			return nil, fmt.Errorf("error connecting to database: %w", err)
-		}
-		s.repository = repo
-	}
-	return s, nil
-}
-
-// Scan performs the data repository scan. It introspects and samples the
-// repository, classifies the sampled data, and publishes the results to the
-// configured publisher.
-func (s *Scanner) Scan(ctx context.Context) error {
-	sampleParams := sql.SampleParameters{SampleSize: s.config.Repo.SampleSize}
-	var samples []sql.Sample
-	// The name of the database to connect to has been left unspecified by
-	// the user, so we try to connect and sample all databases instead. Note
-	// that Oracle doesn't really have the concept of "databases", and thus
-	// the Scanner always scans the entire database, so only the single
-	// (default) repository instance is required in that case.
-	if s.config.Repo.Database == "" && s.config.Repo.Type != sql.RepoTypeOracle {
-		var err error
-		samples, err = sql.SampleAllDatabases(
-			ctx,
-			s.repository,
-			s.config.Repo,
-			sampleParams,
-		)
-		if err != nil {
-			err = fmt.Errorf("error sampling databases: %w", err)
-			// If we didn't get any samples, just return the error.
-			if len(samples) == 0 {
-				return err
-			}
-			// There were error(s) during sampling, but we still got some
-			// samples. Just warn and continue.
-			log.WithError(err).Warn("error sampling databases")
-		}
-	} else {
-		// User specified a database (or this is an Oracle DB), therefore
-		// we already have a repository instance for it. Just use it to
-		// sample that database only.
-		var err error
-		samples, err = sql.SampleRepository(ctx, s.repository, sampleParams)
-		if err != nil {
-			err = fmt.Errorf("error gathering repository data samples: %w", err)
-			// If we didn't get any samples, just return the error.
-			if len(samples) == 0 {
-				return err
-			}
-			// There were error(s) during sampling, but we still got some
-			// samples. Just warn and continue.
-			log.WithError(err).Warn("error gathering repository data samples")
-		}
-	}
-
-	// Classify sampled data
-	classifications, err := classification.ClassifySamples(ctx, samples, s.classifier)
-	if err != nil {
-		return fmt.Errorf("error classifying samples: %w", err)
-	}
-
-	// Publish classifications if necessary
-	if len(classifications) == 0 {
-		log.Info("No discovered classifications")
-	} else if err := s.publisher.PublishClassifications(ctx, s.config.Repo.Host, classifications); err != nil {
-		return fmt.Errorf("error publishing classifications: %w", err)
-	}
-
-	// Done!
-	return nil
-}
-
-// Cleanup performs cleanup operations for the Scanner.
-func (s *Scanner) Cleanup() {
-	// Nil checks are prevent panics if deps are not yet initialized.
-	if s.repository != nil {
-		_ = s.repository.Close()
-	}
-}
diff --git a/discovery/sql/snowflake.go b/discovery/snowflake.go
similarity index 77%
rename from discovery/sql/snowflake.go
rename to discovery/snowflake.go
index 6e97ba8..cf6d3a0 100644
--- a/discovery/sql/snowflake.go
+++ b/discovery/snowflake.go
@@ -1,11 +1,9 @@
-package sql
+package discovery
 
 import (
 	"context"
 	"fmt"
 
-	"github.com/cyralinc/dmap/discovery/config"
-
 	// Snowflake DB driver
 	_ "github.com/snowflakedb/gosnowflake"
 )
@@ -25,18 +23,18 @@ WHERE
 	configWarehouse = "warehouse"
 )
 
-// SnowflakeRepository is a Repository implementation for Snowflake databases.
+// SnowflakeRepository is a SQLRepository implementation for Snowflake databases.
 type SnowflakeRepository struct {
-	// The majority of the Repository functionality is delegated to
+	// The majority of the SQLRepository functionality is delegated to
 	// a generic SQL repository instance (genericSqlRepo).
 	genericSqlRepo *GenericRepository
 }
 
-// SnowflakeRepository implements Repository
-var _ Repository = (*SnowflakeRepository)(nil)
+// SnowflakeRepository implements SQLRepository
+var _ SQLRepository = (*SnowflakeRepository)(nil)
 
 // NewSnowflakeRepository creates a new SnowflakeRepository.
-func NewSnowflakeRepository(cfg config.RepoConfig) (*SnowflakeRepository, error) {
+func NewSnowflakeRepository(cfg RepoConfig) (*SnowflakeRepository, error) {
 	snowflakeCfg, err := ParseSnowflakeConfig(cfg)
 	if err != nil {
 		return nil, fmt.Errorf("error parsing snowflake config: %w", err)
@@ -78,14 +76,14 @@ func (r *SnowflakeRepository) ListDatabases(ctx context.Context) ([]string, erro
 }
 
 // Introspect delegates introspection to GenericRepository. See
-// Repository.Introspect and GenericRepository.IntrospectWithQuery for more
+// SQLRepository.Introspect and GenericRepository.IntrospectWithQuery for more
 // details.
 func (r *SnowflakeRepository) Introspect(ctx context.Context) (*Metadata, error) {
 	return r.genericSqlRepo.Introspect(ctx)
 }
 
 // SampleTable delegates sampling to GenericRepository. See
-// Repository.SampleTable and GenericRepository.SampleTable for more details.
+// SQLRepository.SampleTable and GenericRepository.SampleTable for more details.
 func (r *SnowflakeRepository) SampleTable(
 	ctx context.Context,
 	meta *TableMetadata,
@@ -94,13 +92,13 @@ func (r *SnowflakeRepository) SampleTable(
 	return r.genericSqlRepo.SampleTable(ctx, meta, params)
 }
 
-// Ping delegates the ping to GenericRepository. See Repository.Ping and
+// Ping delegates the ping to GenericRepository. See SQLRepository.Ping and
 // GenericRepository.Ping for more details.
 func (r *SnowflakeRepository) Ping(ctx context.Context) error {
 	return r.genericSqlRepo.Ping(ctx)
 }
 
-// Close delegates the close to GenericRepository. See Repository.Close and
+// Close delegates the close to GenericRepository. See SQLRepository.Close and
 // GenericRepository.Close for more details.
 func (r *SnowflakeRepository) Close() error {
 	return r.genericSqlRepo.Close()
@@ -117,10 +115,10 @@ type SnowflakeConfig struct {
 }
 
 // ParseSnowflakeConfig produces a config structure with Snowflake-specific
-// parameters found in the repo config. The Snowflake account, role, and
-// warehouse are required in the advanced config.
-func ParseSnowflakeConfig(cfg config.RepoConfig) (*SnowflakeConfig, error) {
-	snowflakeCfg, err := config.FetchAdvancedConfigString(
+// parameters found in the repo  The Snowflake account, role, and
+// warehouse are required in the advanced
+func ParseSnowflakeConfig(cfg RepoConfig) (*SnowflakeConfig, error) {
+	snowflakeCfg, err := FetchAdvancedConfigString(
 		cfg,
 		RepoTypeSnowflake,
 		[]string{configAccount, configRole, configWarehouse},
diff --git a/discovery/sql/snowflake_test.go b/discovery/snowflake_test.go
similarity index 97%
rename from discovery/sql/snowflake_test.go
rename to discovery/snowflake_test.go
index ebb7988..6499a11 100644
--- a/discovery/sql/snowflake_test.go
+++ b/discovery/snowflake_test.go
@@ -1,4 +1,4 @@
-package sql
+package discovery
 
 import (
 	"context"
diff --git a/discovery/sql/doc.go b/discovery/sql/doc.go
deleted file mode 100644
index 1aeffed..0000000
--- a/discovery/sql/doc.go
+++ /dev/null
@@ -1,8 +0,0 @@
-// Package sql provides an API for performing database introspection and data
-// discovery on SQL databases. The Repository type encapsulates the concept of a
-// Dmap data SQL repository. The package provides a Registry for all supported
-// repository implementations and a factory function to create new instances of
-// a repository from the registry. All out-of-the-box Repository implementations
-// are included in their own files named after the repository type, e.g.
-// mysql.go, postgres.go, etc.
-package sql
diff --git a/discovery/sql/repository_test.go b/discovery/sql/repository_test.go
deleted file mode 100644
index 049440f..0000000
--- a/discovery/sql/repository_test.go
+++ /dev/null
@@ -1,134 +0,0 @@
-package sql
-
-import (
-	"context"
-	"errors"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/cyralinc/dmap/discovery/config"
-)
-
-func TestRegister_Successful(t *testing.T) {
-	require.Empty(t, registry)
-
-	repoType := "repoType"
-	constructor := func(context.Context, config.RepoConfig) (Repository, error) {
-		return nil, nil
-	}
-
-	Register(repoType, constructor)
-	assert.Contains(t, registry, repoType)
-
-	t.Cleanup(func() { delete(registry, repoType) })
-}
-
-func TestRegister_NilConstructor(t *testing.T) {
-	require.Empty(t, registry)
-	assert.Panics(t, func() { Register("repoType", nil) })
-	assert.Empty(t, registry)
-}
-
-func TestRegister_TwoCalls_Panics(t *testing.T) {
-	require.Empty(t, registry)
-
-	repoType := "repoType"
-	constructor := func(context.Context, config.RepoConfig) (Repository, error) {
-		return nil, nil
-	}
-
-	Register(repoType, constructor)
-	assert.Contains(t, registry, repoType)
-
-	assert.Panics(t, func() { Register(repoType, constructor) })
-
-	t.Cleanup(func() { delete(registry, repoType) })
-}
-
-func TestNewRepository_IsSuccessful(t *testing.T) {
-	require.Empty(t, registry)
-
-	repoType := "repoType"
-
-	called := false
-	expectedRepo := dummyRepo{}
-	constructor := func(context.Context, config.RepoConfig) (Repository, error) {
-		called = true
-		return expectedRepo, nil
-	}
-
-	Register(repoType, constructor)
-	assert.Contains(t, registry, repoType)
-
-	cfg := config.RepoConfig{Type: repoType}
-	repo, err := NewRepository(context.Background(), cfg)
-	assert.NoError(t, err)
-	assert.Equal(t, expectedRepo, repo)
-	assert.True(t, called, "Constructor was not called")
-
-	t.Cleanup(func() { delete(registry, repoType) })
-}
-
-func TestNewRepository_ConstructorError(t *testing.T) {
-	require.Empty(t, registry)
-
-	repoType := "repoType"
-
-	called := false
-	expectedErr := errors.New("dummy error")
-	constructor := func(context.Context, config.RepoConfig) (Repository, error) {
-		called = true
-		return nil, expectedErr
-	}
-
-	Register(repoType, constructor)
-	assert.Contains(t, registry, repoType)
-
-	cfg := config.RepoConfig{Type: repoType}
-	repo, err := NewRepository(context.Background(), cfg)
-	assert.ErrorIs(t, err, expectedErr)
-	assert.Nil(t, repo)
-	assert.True(t, called, "Constructor was not called")
-
-	t.Cleanup(func() { delete(registry, repoType) })
-}
-
-func TestNewRepository_UnsupportedRepoType(t *testing.T) {
-	require.Empty(t, registry)
-
-	repoType := "repoType"
-
-	cfg := config.RepoConfig{Type: repoType}
-	repo, err := NewRepository(context.Background(), cfg)
-	assert.Error(t, err)
-	assert.Nil(t, repo)
-
-	t.Cleanup(func() { delete(registry, repoType) })
-}
-
-type dummyRepo struct{}
-
-func (d dummyRepo) SampleTable(context.Context, *TableMetadata, SampleParameters) (
-	Sample,
-	error,
-) {
-	panic("not implemented")
-}
-
-func (d dummyRepo) ListDatabases(context.Context) ([]string, error) {
-	panic("not implemented")
-}
-
-func (d dummyRepo) Introspect(context.Context) (*Metadata, error) {
-	panic("not implemented")
-}
-
-func (d dummyRepo) Ping(context.Context) error {
-	panic("not implemented")
-}
-
-func (d dummyRepo) Close() error {
-	panic("not implemented")
-}
diff --git a/discovery/sql/repository.go b/discovery/sqlrepository.go
similarity index 88%
rename from discovery/sql/repository.go
rename to discovery/sqlrepository.go
index 174053c..8f0eeb8 100644
--- a/discovery/sql/repository.go
+++ b/discovery/sqlrepository.go
@@ -1,12 +1,12 @@
-package sql
+package discovery
 
 import (
 	"context"
 )
 
-// Repository represents a Dmap data SQL repository, and provides functionality
+// SQLRepository represents a Dmap data SQL repository, and provides functionality
 // to introspect its corresponding schema.
-type Repository interface {
+type SQLRepository interface {
 	// ListDatabases returns a list of the names of all databases on the server.
 	ListDatabases(ctx context.Context) ([]string, error)
 	// Introspect will read and analyze the basic properties of the repository
@@ -27,6 +27,6 @@ type Repository interface {
 	// should be invoked e.g. in the dry-run mode.
 	Ping(ctx context.Context) error
 	// Close is meant to be used as a general purpose cleanup. It should be
-	// invoked when the Repository is no longer used.
+	// invoked when the SQLRepository is no longer used.
 	Close() error
 }
diff --git a/discovery/sql/sqlserver.go b/discovery/sqlserver.go
similarity index 81%
rename from discovery/sql/sqlserver.go
rename to discovery/sqlserver.go
index 65acebf..15320e7 100644
--- a/discovery/sql/sqlserver.go
+++ b/discovery/sqlserver.go
@@ -1,11 +1,9 @@
-package sql
+package discovery
 
 import (
 	"context"
 	"fmt"
 
-	"github.com/cyralinc/dmap/discovery/config"
-
 	// SQL Server DB driver
 	_ "github.com/denisenkom/go-mssqldb"
 )
@@ -23,19 +21,19 @@ const (
 	SqlServerDatabaseQuery = "SELECT name FROM sys.databases WHERE name != 'model' AND name != 'tempdb'"
 )
 
-// SqlServerRepository is a Repository implementation for MS SQL Server
+// SqlServerRepository is a SQLRepository implementation for MS SQL Server
 // databases.
 type SqlServerRepository struct {
-	// The majority of the Repository functionality is delegated to a generic
+	// The majority of the SQLRepository functionality is delegated to a generic
 	// SQL repository instance (genericSqlRepo).
 	genericSqlRepo *GenericRepository
 }
 
-// SqlServerRepository implements Repository
-var _ Repository = (*SqlServerRepository)(nil)
+// SqlServerRepository implements SQLRepository
+var _ SQLRepository = (*SqlServerRepository)(nil)
 
 // NewSqlServerRepository creates a new MS SQL Server sql.
-func NewSqlServerRepository(cfg config.RepoConfig) (*SqlServerRepository, error) {
+func NewSqlServerRepository(cfg RepoConfig) (*SqlServerRepository, error) {
 	connStr := fmt.Sprintf(
 		"sqlserver://%s:%s@%s:%d",
 		cfg.User,
@@ -70,14 +68,14 @@ func (r *SqlServerRepository) ListDatabases(ctx context.Context) ([]string, erro
 }
 
 // Introspect delegates introspection to GenericRepository. See
-// Repository.Introspect and GenericRepository.IntrospectWithQuery for more
+// SQLRepository.Introspect and GenericRepository.IntrospectWithQuery for more
 // details.
 func (r *SqlServerRepository) Introspect(ctx context.Context) (*Metadata, error) {
 	return r.genericSqlRepo.Introspect(ctx)
 }
 
 // SampleTable delegates sampling to GenericRepository, using a
-// SQL Server-specific table sample query. See Repository.SampleTable and
+// SQL Server-specific table sample query. See SQLRepository.SampleTable and
 // GenericRepository.SampleTableWithQuery for more details.
 func (r *SqlServerRepository) SampleTable(
 	ctx context.Context,
@@ -90,13 +88,13 @@ func (r *SqlServerRepository) SampleTable(
 	return r.genericSqlRepo.SampleTableWithQuery(ctx, meta, query, params.SampleSize)
 }
 
-// Ping delegates the ping to GenericRepository. See Repository.Ping and
+// Ping delegates the ping to GenericRepository. See SQLRepository.Ping and
 // GenericRepository.Ping for more details.
 func (r *SqlServerRepository) Ping(ctx context.Context) error {
 	return r.genericSqlRepo.Ping(ctx)
 }
 
-// Close delegates the close to GenericRepository. See Repository.Close and
+// Close delegates the close to GenericRepository. See SQLRepository.Close and
 // GenericRepository.Close for more details.
 func (r *SqlServerRepository) Close() error {
 	return r.genericSqlRepo.Close()
diff --git a/discovery/sql/sqlserver_test.go b/discovery/sqlserver_test.go
similarity index 97%
rename from discovery/sql/sqlserver_test.go
rename to discovery/sqlserver_test.go
index e45c75a..16f2ae5 100644
--- a/discovery/sql/sqlserver_test.go
+++ b/discovery/sqlserver_test.go
@@ -1,4 +1,4 @@
-package sql
+package discovery
 
 import (
 	"context"
diff --git a/go.mod b/go.mod
index 518e7ff..82a0a44 100644
--- a/go.mod
+++ b/go.mod
@@ -18,10 +18,10 @@ require (
 	github.com/gobwas/glob v0.2.3
 	github.com/hashicorp/go-multierror v1.1.1
 	github.com/lib/pq v1.10.9
-	github.com/open-policy-agent/opa v0.62.1
+	github.com/open-policy-agent/opa v0.63.0
 	github.com/sijms/go-ora/v2 v2.8.10
 	github.com/sirupsen/logrus v1.9.3
-	github.com/snowflakedb/gosnowflake v1.8.0
+	github.com/snowflakedb/gosnowflake v1.9.0
 	github.com/stretchr/testify v1.9.0
 	golang.org/x/sync v0.6.0
 	gopkg.in/yaml.v3 v3.0.1
@@ -31,16 +31,16 @@ require (
 	filippo.io/edwards25519 v1.1.0 // indirect
 	github.com/99designs/go-keychain v0.0.0-20191008050251-8e49817e8af4 // indirect
 	github.com/99designs/keyring v1.2.2 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.4.0 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/internal v1.1.2 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.0.0 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.11.0 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/internal v1.5.2 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.3.1 // indirect
 	github.com/JohnCGriffin/overflow v0.0.0-20211019200055-46fa312c352c // indirect
 	github.com/OneOfOne/xxhash v1.2.8 // indirect
 	github.com/agnivade/levenshtein v1.1.1 // indirect
-	github.com/apache/arrow/go/v14 v14.0.2 // indirect
+	github.com/apache/arrow/go/v15 v15.0.2 // indirect
 	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.2 // indirect
 	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.1 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.11.59 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.16.14 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.5 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.5 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.0 // indirect
@@ -55,55 +55,55 @@ require (
 	github.com/aws/smithy-go v1.20.2 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/cespare/xxhash/v2 v2.2.0 // indirect
-	github.com/danieljoos/wincred v1.1.2 // indirect
+	github.com/danieljoos/wincred v1.2.1 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/dvsekhvalnov/jose2go v1.6.0 // indirect
 	github.com/form3tech-oss/jwt-go v3.2.5+incompatible // indirect
-	github.com/gabriel-vasile/mimetype v1.4.2 // indirect
+	github.com/gabriel-vasile/mimetype v1.4.3 // indirect
 	github.com/go-ini/ini v1.67.0 // indirect
 	github.com/go-logr/logr v1.4.1 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/goccy/go-json v0.10.2 // indirect
 	github.com/godbus/dbus v0.0.0-20190726142602-4481cbc300e2 // indirect
-	github.com/golang-sql/civil v0.0.0-20190719163853-cb61b32ac6fe // indirect
+	github.com/golang-sql/civil v0.0.0-20220223132316-b832511892a9 // indirect
 	github.com/golang-sql/sqlexp v0.1.0 // indirect
-	github.com/google/flatbuffers v23.5.26+incompatible // indirect
+	github.com/google/flatbuffers v24.3.25+incompatible // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/gorilla/mux v1.8.1 // indirect
 	github.com/gsterjov/go-libsecret v0.0.0-20161001094733-a6f4afe4910c // indirect
-	github.com/hashicorp/errwrap v1.0.0 // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/jmespath/go-jmespath v0.4.0 // indirect
-	github.com/klauspost/compress v1.17.0 // indirect
-	github.com/klauspost/cpuid/v2 v2.2.5 // indirect
+	github.com/klauspost/compress v1.17.7 // indirect
+	github.com/klauspost/cpuid/v2 v2.2.7 // indirect
 	github.com/mtibben/percent v0.2.1 // indirect
-	github.com/pierrec/lz4/v4 v4.1.18 // indirect
-	github.com/pkg/browser v0.0.0-20210911075715-681adbf594b8 // indirect
+	github.com/pierrec/lz4/v4 v4.1.21 // indirect
+	github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/prometheus/client_golang v1.19.0 // indirect
-	github.com/prometheus/client_model v0.5.0 // indirect
-	github.com/prometheus/common v0.48.0 // indirect
-	github.com/prometheus/procfs v0.12.0 // indirect
-	github.com/rcrowley/go-metrics v0.0.0-20200313005456-10cdbea86bc0 // indirect
+	github.com/prometheus/client_model v0.6.0 // indirect
+	github.com/prometheus/common v0.51.1 // indirect
+	github.com/prometheus/procfs v0.13.0 // indirect
+	github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475 // indirect
 	github.com/stretchr/objx v0.5.2 // indirect
 	github.com/tchap/go-patricia/v2 v2.3.1 // indirect
 	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
 	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
 	github.com/yashtewari/glob-intersection v0.2.0 // indirect
 	github.com/zeebo/xxh3 v1.0.2 // indirect
-	go.opentelemetry.io/otel v1.21.0 // indirect
-	go.opentelemetry.io/otel/metric v1.21.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.21.0 // indirect
-	go.opentelemetry.io/otel/trace v1.21.0 // indirect
+	go.opentelemetry.io/otel v1.24.0 // indirect
+	go.opentelemetry.io/otel/metric v1.24.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.24.0 // indirect
+	go.opentelemetry.io/otel/trace v1.24.0 // indirect
 	golang.org/x/crypto v0.21.0 // indirect
-	golang.org/x/exp v0.0.0-20231006140011-7918f672742d // indirect
-	golang.org/x/mod v0.14.0 // indirect
+	golang.org/x/exp v0.0.0-20240325151524-a685a6edb6d8 // indirect
+	golang.org/x/mod v0.16.0 // indirect
 	golang.org/x/net v0.22.0 // indirect
 	golang.org/x/sys v0.18.0 // indirect
 	golang.org/x/term v0.18.0 // indirect
 	golang.org/x/text v0.14.0 // indirect
-	golang.org/x/tools v0.15.0 // indirect
-	golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect
-	google.golang.org/protobuf v1.32.0 // indirect
+	golang.org/x/tools v0.19.0 // indirect
+	golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 // indirect
+	google.golang.org/protobuf v1.33.0 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	sigs.k8s.io/yaml v1.4.0 // indirect
 )
diff --git a/go.sum b/go.sum
index 2571f7f..f9b98da 100644
--- a/go.sum
+++ b/go.sum
@@ -5,18 +5,20 @@ github.com/99designs/go-keychain v0.0.0-20191008050251-8e49817e8af4/go.mod h1:hN
 github.com/99designs/keyring v1.2.2 h1:pZd3neh/EmUzWONb35LxQfvuY7kiSXAq3HQd97+XBn0=
 github.com/99designs/keyring v1.2.2/go.mod h1:wes/FrByc8j7lFOAGLGSNEg8f/PaI3cgTBqhFkHUrPk=
 github.com/Azure/azure-sdk-for-go/sdk/azcore v0.19.0/go.mod h1:h6H6c8enJmmocHUbLiiGY6sx7f9i+X3m1CHdd5c6Rdw=
-github.com/Azure/azure-sdk-for-go/sdk/azcore v1.4.0 h1:rTnT/Jrcm+figWlYz4Ixzt0SJVR2cMC8lvZcimipiEY=
-github.com/Azure/azure-sdk-for-go/sdk/azcore v1.4.0/go.mod h1:ON4tFdPTwRcgWEaVDrN3584Ef+b7GgSJaXxe5fW9t4M=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v1.11.0 h1:U/kwEXj0Y+1REAkV4kV8VO1CsEp8tSaQDG/7qC5XuqQ=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v1.11.0/go.mod h1:a6xsAQUZg+VsS3TJ05SRp524Hs4pZ/AeFSr5ENf0Yjo=
 github.com/Azure/azure-sdk-for-go/sdk/azidentity v0.11.0/go.mod h1:HcM1YX14R7CJcghJGOYCgdezslRSVzqwLf/q+4Y2r/0=
-github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.1.0 h1:QkAcEIAKbNL4KoFr4SathZPhDhF4mVwpBMFlYjyAqy8=
-github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.1.0/go.mod h1:bhXu1AjYL+wutSL/kpSq6s7733q2Rb0yuot9Zgfqa/0=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.5.1 h1:sO0/P7g68FrryJzljemN+6GTssUXdANk6aJ7T1ZxnsQ=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.5.1/go.mod h1:h8hyGFDsU5HMivxiS2iYFZsgDbU9OnnJ163x5UGVKYo=
 github.com/Azure/azure-sdk-for-go/sdk/internal v0.7.0/go.mod h1:yqy467j36fJxcRV2TzfVZ1pCb5vxm4BtZPUdYWe/Xo8=
-github.com/Azure/azure-sdk-for-go/sdk/internal v1.1.2 h1:+5VZ72z0Qan5Bog5C+ZkgSqUbeVUd9wgtHOrIKuc5b8=
-github.com/Azure/azure-sdk-for-go/sdk/internal v1.1.2/go.mod h1:eWRD7oawr1Mu1sLCawqVc0CUiF43ia3qQMxLscsKQ9w=
-github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.0.0 h1:u/LLAOFgsMv7HmNL4Qufg58y+qElGOt5qv0z1mURkRY=
-github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.0.0/go.mod h1:2e8rMJtl2+2j+HXbTBwnyGpm5Nou7KhvSfxOq8JpTag=
-github.com/AzureAD/microsoft-authentication-library-for-go v0.5.1 h1:BWe8a+f/t+7KY7zH2mqygeUD0t8hNFXe08p1Pb3/jKE=
-github.com/AzureAD/microsoft-authentication-library-for-go v0.5.1/go.mod h1:Vt9sXTKwMyGcOxSmLDMnGPgqsUg7m8pe215qMLrDXw4=
+github.com/Azure/azure-sdk-for-go/sdk/internal v1.5.2 h1:LqbJ/WzJUwBf8UiaSzgX7aMclParm9/5Vgp+TY51uBQ=
+github.com/Azure/azure-sdk-for-go/sdk/internal v1.5.2/go.mod h1:yInRyqWXAuaPrgI7p70+lDDgh3mlBohis29jGMISnmc=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/storage/armstorage v1.5.0 h1:AifHbc4mg0x9zW52WOpKbsHaDKuRhlI7TVl47thgQ70=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/storage/armstorage v1.5.0/go.mod h1:T5RfihdXtBDxt1Ch2wobif3TvzTdumDy29kahv6AV9A=
+github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.3.1 h1:fXPMAmuh0gDuRDey0atC8cXBuKIlqCzCkL8sm1n9Ov0=
+github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.3.1/go.mod h1:SUZc9YRRHfx2+FAQKNDGrssXehqLpxmwRv2mC/5ntj4=
+github.com/AzureAD/microsoft-authentication-library-for-go v1.2.1 h1:DzHpqpoJVaCgOUdVHxE8QB52S6NiVdDQvGlny1qvPqA=
+github.com/AzureAD/microsoft-authentication-library-for-go v1.2.1/go.mod h1:wP83P5OoQ5p6ip3ScPr0BAq0BvuPAvacpEuSzyouqAI=
 github.com/DATA-DOG/go-sqlmock v1.5.2 h1:OcvFkGmslmlZibjAjaHm3L//6LiuBgolP7OputlJIzU=
 github.com/DATA-DOG/go-sqlmock v1.5.2/go.mod h1:88MAG/4G7SMwSE3CeA0ZKzrT5CiOU3OJ+JlNzwDqpNU=
 github.com/JohnCGriffin/overflow v0.0.0-20211019200055-46fa312c352c h1:RGWPOewvKIROun94nF7v2cua9qP+thov/7M50KEoeSU=
@@ -31,72 +33,54 @@ github.com/alecthomas/kong v0.9.0 h1:G5diXxc85KvoV2f0ZRVuMsi45IrBgx9zDNGNj165aPA
 github.com/alecthomas/kong v0.9.0/go.mod h1:Y47y5gKfHp1hDc7CH7OeXgLIpp+Q2m1Ni0L5s3bI8Os=
 github.com/alecthomas/repr v0.4.0 h1:GhI2A8MACjfegCPVq9f1FLvIBS+DrQ2KQBFZP1iFzXc=
 github.com/alecthomas/repr v0.4.0/go.mod h1:Fr0507jx4eOXV7AlPV6AVZLYrLIuIeSOWtW57eE/O/4=
-github.com/apache/arrow/go/v14 v14.0.2 h1:N8OkaJEOfI3mEZt07BIkvo4sC6XDbL+48MBPWO5IONw=
-github.com/apache/arrow/go/v14 v14.0.2/go.mod h1:u3fgh3EdgN/YQ8cVQRguVW3R+seMybFg8QBQ5LU+eBY=
+github.com/apache/arrow/go/v15 v15.0.2 h1:60IliRbiyTWCWjERBCkO1W4Qun9svcYoZrSLcyOsMLE=
+github.com/apache/arrow/go/v15 v15.0.2/go.mod h1:DGXsR3ajT524njufqf95822i+KTh+yea1jass9YXgjA=
 github.com/arbovm/levenshtein v0.0.0-20160628152529-48b4e1c0c4d0 h1:jfIu9sQUG6Ig+0+Ap1h4unLjW6YQJpKZVmUzxsD4E/Q=
 github.com/arbovm/levenshtein v0.0.0-20160628152529-48b4e1c0c4d0/go.mod h1:t2tdKJDJF9BV14lnkjHmOQgcvEKgtqs5a1N3LNdJhGE=
-github.com/aws/aws-sdk-go-v2 v1.17.7/go.mod h1:uzbQtefpm44goOPmdKyAlXSNcwlRgF3ePWVW6EtJvvw=
 github.com/aws/aws-sdk-go-v2 v1.26.1 h1:5554eUqIYVWpU0YmeeYZ0wU64H2VLBs8TlhRB2L+EkA=
 github.com/aws/aws-sdk-go-v2 v1.26.1/go.mod h1:ffIFB97e2yNsv4aTSGkqtHnppsIJzw7G7BReUZ3jCXM=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.4.10/go.mod h1:VeTZetY5KRJLuD/7fkQXMU6Mw7H5m/KP2J5Iy9osMno=
 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.2 h1:x6xsQXGSmW6frevwDA+vi/wqhp1ct18mVXYN08/93to=
 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.2/go.mod h1:lPprDr1e6cJdyYeGXnRaJoP4Md+cDBvi2eOj00BlGmg=
-github.com/aws/aws-sdk-go-v2/config v1.18.19/go.mod h1:XvTmGMY8d52ougvakOv1RpiTLPz9dlG/OQHsKU/cMmY=
 github.com/aws/aws-sdk-go-v2/config v1.27.10 h1:PS+65jThT0T/snC5WjyfHHyUgG+eBoupSDV+f838cro=
 github.com/aws/aws-sdk-go-v2/config v1.27.10/go.mod h1:BePM7Vo4OBpHreKRUMuDXX+/+JWP38FLkzl5m27/Jjs=
-github.com/aws/aws-sdk-go-v2/credentials v1.13.18/go.mod h1:vnwlwjIe+3XJPBYKu1et30ZPABG3VaXJYr8ryohpIyM=
 github.com/aws/aws-sdk-go-v2/credentials v1.17.10 h1:qDZ3EA2lv1KangvQB6y258OssCHD0xvaGiEDkG4X/10=
 github.com/aws/aws-sdk-go-v2/credentials v1.17.10/go.mod h1:6t3sucOaYDwDssHQa0ojH1RpmVmF5/jArkye1b2FKMI=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.13.1/go.mod h1:lfUx8puBRdM5lVVMQlwt2v+ofiG/X6Ms+dy0UkG/kXw=
 github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.1 h1:FVJ0r5XTHSmIHJV6KuDmdYhEpvlHpiSd38RQWhut5J4=
 github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.1/go.mod h1:zusuAeqezXzAB24LGuzuekqMAEgWkVYukBec3kr3jUg=
-github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.11.59 h1:E3Y+OfzOK1+rmRo/K2G0ml8Vs+Xqk0kOnf4nS0kUtBc=
-github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.11.59/go.mod h1:1M4PLSBUVfBI0aP+C9XI7SM6kZPCGYyI6izWz0TGprE=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.31/go.mod h1:QT0BqUvX1Bh2ABdTGnjqEjvjzrCfIniM9Sc8zn9Yndo=
+github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.16.14 h1:Nhcq+ODoD9FRQYI3lATy6iADS5maER3ZXSfE8v3FMh8=
+github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.16.14/go.mod h1:VlBbwTpgCj3rKWMVkEAYiAR3FKs7Mi3jALTMGfbfuns=
 github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.5 h1:aw39xVGeRWlWx9EzGVnhOR4yOjQDHPQ6o6NmBlscyQg=
 github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.5/go.mod h1:FSaRudD0dXiMPK2UjknVwwTYyZMRsHv3TtkabsZih5I=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.25/go.mod h1:zBHOPwhBc3FlQjQJE/D3IfPWiWaQmT06Vq9aNukDo0k=
 github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.5 h1:PG1F3OD1szkuQPzDw3CIQsRIrtTlUC3lP84taWzHlq0=
 github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.5/go.mod h1:jU1li6RFryMz+so64PpKtudI+QzbKoIEivqdf6LNpOc=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.3.32/go.mod h1:XGhIBZDEgfqmFIugclZ6FU7v75nHhBDtzuB4xB/tEi4=
 github.com/aws/aws-sdk-go-v2/internal/ini v1.8.0 h1:hT8rVHwugYE2lEfdFE0QWVo81lF7jMrYJVDWI+f+VxU=
 github.com/aws/aws-sdk-go-v2/internal/ini v1.8.0/go.mod h1:8tu/lYfQfFe6IGnaOdrpVgEL2IrrDOf6/m9RQum4NkY=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.0.23/go.mod h1:uIiFgURZbACBEQJfqTZPb/jxO7R+9LeoHUFudtIdeQI=
 github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.5 h1:81KE7vaZzrl7yHBYHVEzYB8sypz11NMOZ40YlWvPxsU=
 github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.5/go.mod h1:LIt2rg7Mcgn09Ygbdh/RdIm0rQ+3BNkbP1gyVMFtRK0=
 github.com/aws/aws-sdk-go-v2/service/dynamodb v1.31.1 h1:dZXY07Dm59TxAjJcUfNMJHLDI/gLMxTRZefn2jFAVsw=
 github.com/aws/aws-sdk-go-v2/service/dynamodb v1.31.1/go.mod h1:lVLqEtX+ezgtfalyJs7Peb0uv9dEpAQP5yuq2O26R44=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.9.11/go.mod h1:iV4q2hsqtNECrfmlXyord9u4zyuFEJX9eLgLpSPzWA8=
 github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.2 h1:Ji0DY1xUsUr3I8cHps0G+XM3WWU16lP6yG8qu1GAZAs=
 github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.2/go.mod h1:5CsjAbs3NlGQyZNFACh+zztPDI7fU6eW9QsxjfnuBKg=
-github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.1.26/go.mod h1:2UqAAwMUXKeRkAHIlDJqvMVgOWkUi/AUXPk/YIe+Dg4=
 github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.3.7 h1:ZMeFZ5yk+Ek+jNr1+uwCd2tG89t6oTS5yVWpa6yy2es=
 github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.3.7/go.mod h1:mxV05U+4JiHqIpGqqYXOHLPKUC6bDXC44bsUhNjOEwY=
 github.com/aws/aws-sdk-go-v2/service/internal/endpoint-discovery v1.9.6 h1:6tayEze2Y+hiL3kdnEUxSPsP+pJsUfwLSFspFl1ru9Q=
 github.com/aws/aws-sdk-go-v2/service/internal/endpoint-discovery v1.9.6/go.mod h1:qVNb/9IOVsLCZh0x2lnagrBwQ9fxajUpXS7OZfIsKn0=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.25/go.mod h1:/95IA+0lMnzW6XzqYJRpjjsAbKEORVeO0anQqjd2CNU=
 github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.7 h1:ogRAwT1/gxJBcSWDMZlgyFUM962F51A5CRhDLbxLdmo=
 github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.7/go.mod h1:YCsIZhXfRPLFFCl5xxY+1T9RKzOKjCut+28JSX2DnAk=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.14.0/go.mod h1:bh2E0CXKZsQN+faiKVqC40vfNMAWheoULBCnEgO9K+8=
 github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.17.5 h1:f9RyWNtS8oH7cZlbn+/JNPpjUk5+5fLd5lM9M0i49Ys=
 github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.17.5/go.mod h1:h5CoMZV2VF297/VLhRhO1WF+XYWOzXo+4HsObA4HjBQ=
 github.com/aws/aws-sdk-go-v2/service/rds v1.76.1 h1:6NeDO4UyHun2N5Lmkv2yW1sNblRLRjq3j6Azv7kUyuM=
 github.com/aws/aws-sdk-go-v2/service/rds v1.76.1/go.mod h1:Rw15qGaGWu3jO0dOz7JyvdOEjgae//YrJxVWLYGynvg=
 github.com/aws/aws-sdk-go-v2/service/redshift v1.43.5 h1:qiwrbGdDKuD0OD2hxNezyiu17AXJtC3UyLpwx0FA3Ds=
 github.com/aws/aws-sdk-go-v2/service/redshift v1.43.5/go.mod h1:8ldsMsikORLj0GZUozSvbQdctrumAPYhizmj/3AAATI=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.31.0/go.mod h1:ncltU6n4Nof5uJttDtcNQ537uNuwYqsZZQcpkd2/GUQ=
 github.com/aws/aws-sdk-go-v2/service/s3 v1.53.1 h1:6cnno47Me9bRykw9AEv9zkXE+5or7jz8TsskTTccbgc=
 github.com/aws/aws-sdk-go-v2/service/s3 v1.53.1/go.mod h1:qmdkIIAC+GCLASF7R2whgNrJADz0QZPX+Seiw/i4S3o=
-github.com/aws/aws-sdk-go-v2/service/sso v1.12.6/go.mod h1:Y1VOmit/Fn6Tz1uFAeCO6Q7M2fmfXSCLeL5INVYsLuY=
 github.com/aws/aws-sdk-go-v2/service/sso v1.20.4 h1:WzFol5Cd+yDxPAdnzTA5LmpHYSWinhmSj4rQChV0ee8=
 github.com/aws/aws-sdk-go-v2/service/sso v1.20.4/go.mod h1:qGzynb/msuZIE8I75DVRCUXw3o3ZyBmUvMwQ2t/BrGM=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.14.6/go.mod h1:Lh/bc9XUf8CfOY6Jp5aIkQtN+j1mc+nExc+KXj9jx2s=
 github.com/aws/aws-sdk-go-v2/service/ssooidc v1.23.4 h1:Jux+gDDyi1Lruk+KHF91tK2KCuY61kzoCpvtvJJBtOE=
 github.com/aws/aws-sdk-go-v2/service/ssooidc v1.23.4/go.mod h1:mUYPBhaF2lGiukDEjJX2BLRRKTmoUSitGDUgM4tRxak=
-github.com/aws/aws-sdk-go-v2/service/sts v1.18.7/go.mod h1:JuTnSoeePXmMVe9G8NcjjwgOKEfZ4cOjMuT2IBT/2eI=
 github.com/aws/aws-sdk-go-v2/service/sts v1.28.6 h1:cwIxeBttqPN3qkaAjcEcsh8NYr8n2HZPkcKgPAi1phU=
 github.com/aws/aws-sdk-go-v2/service/sts v1.28.6/go.mod h1:FZf1/nKNEkHdGGJP/cI2MoIMquumuRK6ol3QQJNDxmw=
-github.com/aws/smithy-go v1.13.5/go.mod h1:Tg+OJXh4MB2R/uN61Ko2f6hTZwB/ZYGOtib8J3gBHzA=
 github.com/aws/smithy-go v1.20.2 h1:tbp628ireGtzcHDDmLT/6ADHidqnwgF57XOXZe6tp4Q=
 github.com/aws/smithy-go v1.20.2/go.mod h1:krry+ya/rV9RDcV/Q16kpu6ypI4K2czasz0NC3qS14E=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
@@ -109,8 +93,8 @@ github.com/cespare/xxhash v1.1.0 h1:a6HrQnmkObjyL+Gs60czilIUGqrzKutQD6XZog3p+ko=
 github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
 github.com/cespare/xxhash/v2 v2.2.0 h1:DC2CZ1Ep5Y4k3ZQ899DldepgrayRUGE6BBZ/cd9Cj44=
 github.com/cespare/xxhash/v2 v2.2.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/danieljoos/wincred v1.1.2 h1:QLdCxFs1/Yl4zduvBdcHB8goaYk9RARS2SgLLRuAyr0=
-github.com/danieljoos/wincred v1.1.2/go.mod h1:GijpziifJoIBfYh+S7BbkdUTU4LfM+QnGqR5Vl2tAx0=
+github.com/danieljoos/wincred v1.2.1 h1:dl9cBrupW8+r5250DYkYxocLeZ1Y4vB1kxgtjxw8GQs=
+github.com/danieljoos/wincred v1.2.1/go.mod h1:uGaFL9fDn3OLTvzCGulzE+SzjEe5NGlh5FdCcyfPwps=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
@@ -137,8 +121,8 @@ github.com/fortytw2/leaktest v1.3.0 h1:u8491cBMTQ8ft8aeV+adlcytMZylmA5nnwwkRZjI8
 github.com/fortytw2/leaktest v1.3.0/go.mod h1:jDsjWgpAGjm2CA7WthBh/CdZYEPF31XHquHwclZch5g=
 github.com/foxcpp/go-mockdns v1.1.0 h1:jI0rD8M0wuYAxL7r/ynTrCQQq0BVqfB99Vgk7DlmewI=
 github.com/foxcpp/go-mockdns v1.1.0/go.mod h1:IhLeSFGed3mJIAXPH2aiRQB+kqz7oqu8ld2qVbOu7Wk=
-github.com/gabriel-vasile/mimetype v1.4.2 h1:w5qFW6JKBz9Y393Y4q372O9A7cUSequkh1Q7OhCmWKU=
-github.com/gabriel-vasile/mimetype v1.4.2/go.mod h1:zApsH/mKG4w07erKIaJPFiX0Tsq9BFQgN3qGY5GnNgA=
+github.com/gabriel-vasile/mimetype v1.4.3 h1:in2uUcidCuFcDKtdcBxlR0rJ1+fsokWf+uqxgUFjbI0=
+github.com/gabriel-vasile/mimetype v1.4.3/go.mod h1:d8uq/6HKRL6CGdk+aubisF/M5GcPfT7nKyLpA0lbSSk=
 github.com/go-ini/ini v1.67.0 h1:z6ZrTEZqSWOTyH2FlglNbNgARyHG8oLW9gMELqKr06A=
 github.com/go-ini/ini v1.67.0/go.mod h1:ByCAeIL28uOIIG0E3PJtZPDL8WnHpFKFOtgjp+3Ies8=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
@@ -156,23 +140,23 @@ github.com/godbus/dbus v0.0.0-20190726142602-4481cbc300e2 h1:ZpnhV/YsD2/4cESfV5+
 github.com/godbus/dbus v0.0.0-20190726142602-4481cbc300e2/go.mod h1:bBOAhwG1umN6/6ZUMtDFBMQR8jRg9O75tm9K00oMsK4=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
-github.com/golang-jwt/jwt v3.2.1+incompatible h1:73Z+4BJcrTC+KczS6WvTPvRGOp1WmfEP4Q1lOd9Z/+c=
-github.com/golang-jwt/jwt v3.2.1+incompatible/go.mod h1:8pz2t5EyA70fFQQSrl6XZXzqecmYZeUEB8OUGHkxJ+I=
-github.com/golang-sql/civil v0.0.0-20190719163853-cb61b32ac6fe h1:lXe2qZdvpiX5WZkZR4hgp4KJVfY3nMkvmwbVkpv1rVY=
+github.com/golang-jwt/jwt/v5 v5.2.0 h1:d/ix8ftRUorsN+5eMIlF4T6J8CAt9rch3My2winC1Jw=
+github.com/golang-jwt/jwt/v5 v5.2.0/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
 github.com/golang-sql/civil v0.0.0-20190719163853-cb61b32ac6fe/go.mod h1:8vg3r2VgvsThLBIFL93Qb5yWzgyZWhEmBwUJWevAkK0=
+github.com/golang-sql/civil v0.0.0-20220223132316-b832511892a9 h1:au07oEsX2xN0ktxqI+Sida1w446QrXBRJ0nee3SNZlA=
+github.com/golang-sql/civil v0.0.0-20220223132316-b832511892a9/go.mod h1:8vg3r2VgvsThLBIFL93Qb5yWzgyZWhEmBwUJWevAkK0=
 github.com/golang-sql/sqlexp v0.1.0 h1:ZCD6MBpcuOVfGVqsEmY5/4FtYiKz6tSyUv9LPEDei6A=
 github.com/golang-sql/sqlexp v0.1.0/go.mod h1:J4ad9Vo8ZCWQ2GMrC4UCQy1JpCbwU9m3EOqtpKwwwHI=
 github.com/golang/glog v1.2.0 h1:uCdmnmatrKCgMBlM4rMuJZWOkPDqdbZPnrMXDY4gI68=
 github.com/golang/glog v1.2.0/go.mod h1:6AhwSGph0fcJtXVM/PEHPqZlFeoLxhs7/t5UDAwmO+w=
 github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l8iNU+DwB5epxmsaqB+rhGL0m5jtYqE=
 github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
-github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
-github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
+github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
+github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
 github.com/golang/snappy v0.0.4 h1:yAGX7huGHXlcLOEtBnF4w7FQwA26wojNCwOYAEhLjQM=
 github.com/golang/snappy v0.0.4/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
-github.com/google/flatbuffers v23.5.26+incompatible h1:M9dgRyhJemaM4Sw8+66GHBu8ioaQmyPLg1b8VwK5WJg=
-github.com/google/flatbuffers v23.5.26+incompatible/go.mod h1:1AeVuKshWv4vARoZatz6mlQ0JxURH0Kv5+zNeJKJCa8=
-github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/flatbuffers v24.3.25+incompatible h1:CX395cjN9Kke9mmalRoL3d81AtFUxJM+yDthflgJGkI=
+github.com/google/flatbuffers v24.3.25+incompatible/go.mod h1:1AeVuKshWv4vARoZatz6mlQ0JxURH0Kv5+zNeJKJCa8=
 github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
@@ -184,8 +168,9 @@ github.com/grpc-ecosystem/grpc-gateway/v2 v2.16.0 h1:YBftPWNWd4WwGqtY2yeZL2ef8rH
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.16.0/go.mod h1:YN5jB8ie0yfIUg6VvR9Kz84aCaG7AsGZnLjhHbUqwPg=
 github.com/gsterjov/go-libsecret v0.0.0-20161001094733-a6f4afe4910c h1:6rhixN/i8ZofjG1Y75iExal34USq5p+wiN1tpie8IrU=
 github.com/gsterjov/go-libsecret v0.0.0-20161001094733-a6f4afe4910c/go.mod h1:NMPJylDgVpX0MLRlPy15sqSwOFv/U1GZ2m21JhFfek0=
-github.com/hashicorp/errwrap v1.0.0 h1:hLrqtEDnRye3+sgx6z4qVLNuviH3MR5aQ0ykNJa/UYA=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
+github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
 github.com/hexops/gotextdiff v1.0.3 h1:gitA9+qJrrTCsiCl7+kh75nPqQt1cx4ZkudSTLoUqJM=
@@ -195,10 +180,10 @@ github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHW
 github.com/jmespath/go-jmespath/internal/testify v1.5.1 h1:shLQSRRSCCPj3f2gpwzGwWFoC7ycTf1rcQZHOlsJ6N8=
 github.com/jmespath/go-jmespath/internal/testify v1.5.1/go.mod h1:L3OGu8Wl2/fWfCI6z80xFu9LTZmf1ZRjMHUOPmWr69U=
 github.com/kisielk/sqlstruct v0.0.0-20201105191214-5f3e10d3ab46/go.mod h1:yyMNCyc/Ib3bDTKd379tNMpB/7/H5TjM2Y9QJ5THLbE=
-github.com/klauspost/compress v1.17.0 h1:Rnbp4K9EjcDuVuHtd0dgA4qNuv9yKDYKK1ulpJwgrqM=
-github.com/klauspost/compress v1.17.0/go.mod h1:ntbaceVETuRiXiv4DpjP66DpAtAGkEQskQzEyD//IeE=
-github.com/klauspost/cpuid/v2 v2.2.5 h1:0E5MSMDEoAulmXNFquVs//DdoomxaoTY1kUhbc/qbZg=
-github.com/klauspost/cpuid/v2 v2.2.5/go.mod h1:Lcz8mBdAVJIBVzewtcLocK12l3Y+JytZYpaMropDUws=
+github.com/klauspost/compress v1.17.7 h1:ehO88t2UGzQK66LMdE8tibEd1ErmzZjNEqWkjLAKQQg=
+github.com/klauspost/compress v1.17.7/go.mod h1:Di0epgTjJY877eYKx5yC51cX2A2Vl2ibi7bDH9ttBbw=
+github.com/klauspost/cpuid/v2 v2.2.7 h1:ZWSB3igEs+d0qvnxR/ZBzXVmxkgt8DdzP6m9pfuVLDM=
+github.com/klauspost/cpuid/v2 v2.2.7/go.mod h1:Lcz8mBdAVJIBVzewtcLocK12l3Y+JytZYpaMropDUws=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
@@ -215,35 +200,35 @@ github.com/modocache/gover v0.0.0-20171022184752-b58185e213c5/go.mod h1:caMODM3P
 github.com/mtibben/percent v0.2.1 h1:5gssi8Nqo8QU/r2pynCm+hBQHpkB/uNK7BJCFogWdzs=
 github.com/mtibben/percent v0.2.1/go.mod h1:KG9uO+SZkUp+VkRHsCdYQV3XSZrrSpR3O9ibNBTZrns=
 github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
-github.com/open-policy-agent/opa v0.62.1 h1:UcxBQ0fe6NEjkYc775j4PWoUFFhx4f6yXKIKSTAuTVk=
-github.com/open-policy-agent/opa v0.62.1/go.mod h1:YqiSIIuvKwyomtnnXkJvy0E3KtVKbavjPJ/hNMuOmeM=
-github.com/pierrec/lz4/v4 v4.1.18 h1:xaKrnTkyoqfh1YItXl56+6KJNVYWlEEPuAQW9xsplYQ=
-github.com/pierrec/lz4/v4 v4.1.18/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
+github.com/open-policy-agent/opa v0.63.0 h1:ztNNste1v8kH0/vJMJNquE45lRvqwrM5mY9Ctr9xIXw=
+github.com/open-policy-agent/opa v0.63.0/go.mod h1:9VQPqEfoB2N//AToTxzZ1pVTVPUoF2Mhd64szzjWPpU=
+github.com/pierrec/lz4/v4 v4.1.21 h1:yOVMLb6qSIDP67pl/5F7RepeKYu/VmTyEXvuMI5d9mQ=
+github.com/pierrec/lz4/v4 v4.1.21/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
 github.com/pkg/browser v0.0.0-20180916011732-0a3d74bf9ce4/go.mod h1:4OwLy04Bl9Ef3GJJCoec+30X3LQs/0/m4HFRt/2LUSA=
-github.com/pkg/browser v0.0.0-20210911075715-681adbf594b8 h1:KoWmjvw+nsYOo29YJK9vDA65RGE3NrOnUtO7a+RF9HU=
-github.com/pkg/browser v0.0.0-20210911075715-681adbf594b8/go.mod h1:HKlIX3XHQyzLZPlr7++PzdhaXEj94dEiJgZDTsxEqUI=
+github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c h1:+mdjkGKdHQG3305AYmdv1U2eRNDiU2ErMBj1gwrq8eQ=
+github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c/go.mod h1:7rwL4CYBLnjLxUqIJNnCWiEdr3bn6IUYi15bNlnbCCU=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/prometheus/client_golang v1.19.0 h1:ygXvpU1AoN1MhdzckN+PyD9QJOSD4x7kmXYlnfbA6JU=
 github.com/prometheus/client_golang v1.19.0/go.mod h1:ZRM9uEAypZakd+q/x7+gmsvXdURP+DABIEIjnmDdp+k=
-github.com/prometheus/client_model v0.5.0 h1:VQw1hfvPvk3Uv6Qf29VrPF32JB6rtbgI6cYPYQjL0Qw=
-github.com/prometheus/client_model v0.5.0/go.mod h1:dTiFglRmd66nLR9Pv9f0mZi7B7fk5Pm3gvsjB5tr+kI=
-github.com/prometheus/common v0.48.0 h1:QO8U2CdOzSn1BBsmXJXduaaW+dY/5QLjfB8svtSzKKE=
-github.com/prometheus/common v0.48.0/go.mod h1:0/KsvlIEfPQCQ5I2iNSAWKPZziNCvRs5EC6ILDTlAPc=
-github.com/prometheus/procfs v0.12.0 h1:jluTpSng7V9hY0O2R9DzzJHYb2xULk9VTR1V1R/k6Bo=
-github.com/prometheus/procfs v0.12.0/go.mod h1:pcuDEFsWDnvcgNzo4EEweacyhjeA9Zk3cnaOZAZEfOo=
-github.com/rcrowley/go-metrics v0.0.0-20200313005456-10cdbea86bc0 h1:MkV+77GLUNo5oJ0jf870itWm3D0Sjh7+Za9gazKc5LQ=
-github.com/rcrowley/go-metrics v0.0.0-20200313005456-10cdbea86bc0/go.mod h1:bCqnVzQkZxMG4s8nGwiZ5l3QUCyqpo9Y+/ZMZ9VjZe4=
+github.com/prometheus/client_model v0.6.0 h1:k1v3CzpSRUTrKMppY35TLwPvxHqBu0bYgxZzqGIgaos=
+github.com/prometheus/client_model v0.6.0/go.mod h1:NTQHnmxFpouOD0DpvP4XujX3CdOAGQPoaGhyTchlyt8=
+github.com/prometheus/common v0.51.1 h1:eIjN50Bwglz6a/c3hAgSMcofL3nD+nFQkV6Dd4DsQCw=
+github.com/prometheus/common v0.51.1/go.mod h1:lrWtQx+iDfn2mbH5GUzlH9TSHyfZpHkSiG1W7y3sF2Q=
+github.com/prometheus/procfs v0.13.0 h1:GqzLlQyfsPbaEHaQkO7tbDlriv/4o5Hudv6OXHGKX7o=
+github.com/prometheus/procfs v0.13.0/go.mod h1:cd4PFCR54QLnGKPaKGA6l+cfuNXtht43ZKY6tow0Y1g=
+github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475 h1:N/ElC8H3+5XpJzTSTfLsJV/mx9Q9g7kxmchpfZyxgzM=
+github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475/go.mod h1:bCqnVzQkZxMG4s8nGwiZ5l3QUCyqpo9Y+/ZMZ9VjZe4=
 github.com/rogpeppe/go-internal v1.10.0 h1:TMyTOH3F/DB16zRVcYyreMH6GnZZrwQVAoYjRBZyWFQ=
 github.com/rogpeppe/go-internal v1.10.0/go.mod h1:UQnix2H7Ngw/k4C5ijL5+65zddjncjaFoBhdsK/akog=
 github.com/sijms/go-ora/v2 v2.8.10 h1:Ekhx0I+A9qVBy1eOLa2eIhHWWYwVTa0MM78KS6h+5fg=
 github.com/sijms/go-ora/v2 v2.8.10/go.mod h1:EHxlY6x7y9HAsdfumurRfTd+v8NrEOTR3Xl4FWlH6xk=
 github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
 github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
-github.com/snowflakedb/gosnowflake v1.8.0 h1:4bQj8eAYGMkou/nICiIEb9jSbBLDDp5cB6JaKx9WwiA=
-github.com/snowflakedb/gosnowflake v1.8.0/go.mod h1:7yyY2MxtDti2eXgtvlZ8QxzCN6KV2B4qb1HuygMI+0U=
+github.com/snowflakedb/gosnowflake v1.9.0 h1:s2ZdwFxFfpqwa5CqlhnzRESnLmwU3fED6zyNOJHFBQA=
+github.com/snowflakedb/gosnowflake v1.9.0/go.mod h1:4ZgHxVf2OKwecx07WjfyAMr0gn8Qj4yvwAo68Og8wsU=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
 github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
@@ -266,18 +251,18 @@ go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
 go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.46.1 h1:aFJWCqJMNjENlcleuuOkGAPH82y0yULBScfXcIEdS24=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.46.1/go.mod h1:sEGXWArGqc3tVa+ekntsN65DmVbVeW+7lTKTjZF3/Fo=
-go.opentelemetry.io/otel v1.21.0 h1:hzLeKBZEL7Okw2mGzZ0cc4k/A7Fta0uoPgaJCr8fsFc=
-go.opentelemetry.io/otel v1.21.0/go.mod h1:QZzNPQPm1zLX4gZK4cMi+71eaorMSGT3A4znnUvNNEo=
+go.opentelemetry.io/otel v1.24.0 h1:0LAOdjNmQeSTzGBzduGe/rU4tZhMwL5rWgtp9Ku5Jfo=
+go.opentelemetry.io/otel v1.24.0/go.mod h1:W7b9Ozg4nkF5tWI5zsXkaKKDjdVjpD4oAt9Qi/MArHo=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.21.0 h1:cl5P5/GIfFh4t6xyruOgJP5QiA1pw4fYYdv6nc6CBWw=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.21.0/go.mod h1:zgBdWWAu7oEEMC06MMKc5NLbA/1YDXV1sMpSqEeLQLg=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.21.0 h1:tIqheXEFWAZ7O8A7m+J0aPTmpJN3YQ7qetUAdkkkKpk=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.21.0/go.mod h1:nUeKExfxAQVbiVFn32YXpXZZHZ61Cc3s3Rn1pDBGAb0=
-go.opentelemetry.io/otel/metric v1.21.0 h1:tlYWfeo+Bocx5kLEloTjbcDwBuELRrIFxwdQ36PlJu4=
-go.opentelemetry.io/otel/metric v1.21.0/go.mod h1:o1p3CA8nNHW8j5yuQLdc1eeqEaPfzug24uvsyIEJRWM=
-go.opentelemetry.io/otel/sdk v1.21.0 h1:FTt8qirL1EysG6sTQRZ5TokkU8d0ugCj8htOgThZXQ8=
-go.opentelemetry.io/otel/sdk v1.21.0/go.mod h1:Nna6Yv7PWTdgJHVRD9hIYywQBRx7pbox6nwBnZIxl/E=
-go.opentelemetry.io/otel/trace v1.21.0 h1:WD9i5gzvoUPuXIXH24ZNBudiarZDKuekPqi/E8fpfLc=
-go.opentelemetry.io/otel/trace v1.21.0/go.mod h1:LGbsEB0f9LGjN+OZaQQ26sohbOmiMR+BaslueVtS/qQ=
+go.opentelemetry.io/otel/metric v1.24.0 h1:6EhoGWWK28x1fbpA4tYTOWBkPefTDQnb8WSGXlc88kI=
+go.opentelemetry.io/otel/metric v1.24.0/go.mod h1:VYhLe1rFfxuTXLgj4CBiyz+9WYBA8pNGJgDcSFRKBco=
+go.opentelemetry.io/otel/sdk v1.24.0 h1:YMPPDNymmQN3ZgczicBY3B6sf9n62Dlj9pWD3ucgoDw=
+go.opentelemetry.io/otel/sdk v1.24.0/go.mod h1:KVrIYw6tEubO9E96HQpcmpTKDVn9gdv35HoYiQWGDFg=
+go.opentelemetry.io/otel/trace v1.24.0 h1:CsKnnL4dUAr/0llH9FKuc698G04IrpWV0MQA/Y1YELI=
+go.opentelemetry.io/otel/trace v1.24.0/go.mod h1:HPc3Xr/cOApsBI154IU0OI0HJexz+aw5uPdbs3UCjNU=
 go.opentelemetry.io/proto/otlp v1.0.0 h1:T0TX0tmXU8a3CbNXzEKGeU5mIVOdf0oykP+u2lIVU/I=
 go.opentelemetry.io/proto/otlp v1.0.0/go.mod h1:Sy6pihPLfYHkr3NkUbEhGHFhINUSI/v80hjKIs5JXpM=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
@@ -285,10 +270,10 @@ golang.org/x/crypto v0.0.0-20201016220609-9e8e0b390897/go.mod h1:LzIPMQfyMNhhGPh
 golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.21.0 h1:X31++rzVUdKhX5sWmSOFZxx8UW/ldWx55cbf08iNAMA=
 golang.org/x/crypto v0.21.0/go.mod h1:0BP7YvVV9gBbVKyeTG0Gyn+gZm94bibOW5BjDEYAOMs=
-golang.org/x/exp v0.0.0-20231006140011-7918f672742d h1:jtJma62tbqLibJ5sFQz8bKtEM8rJBtfilJ2qTU199MI=
-golang.org/x/exp v0.0.0-20231006140011-7918f672742d/go.mod h1:ldy0pHrwJyGW56pPQzzkH36rKxoZW1tw7ZJpeKx+hdo=
-golang.org/x/mod v0.14.0 h1:dGoOF9QVLYng8IHTm7BAyWqCqSheQ5pYWGhzW00YJr0=
-golang.org/x/mod v0.14.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
+golang.org/x/exp v0.0.0-20240325151524-a685a6edb6d8 h1:aAcj0Da7eBAtrTp03QXWvm88pSyOt+UgdZw2BFZ+lEw=
+golang.org/x/exp v0.0.0-20240325151524-a685a6edb6d8/go.mod h1:CQ1k9gNrJ50XIzaKCRR2hssIjF07kZFEiieALBM/ARQ=
+golang.org/x/mod v0.16.0 h1:QX4fJ0Rr5cPQCF7O9lh9Se4pmwfwskqZfq5moyldzic=
+golang.org/x/mod v0.16.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20210610132358-84b48f89b13b/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
@@ -301,9 +286,8 @@ golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210616045830-e2b7044e8c71/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210819135213-f52c844e1c1c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.18.0 h1:DBdB3niSjOA/O0blCZBqDefyWNYveAYMNF1Wum0DYQ4=
 golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
@@ -315,20 +299,20 @@ golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.15.0 h1:zdAyfUGbYmuVokhzVmghFl2ZJh5QhcfebBgmVPFYA+8=
-golang.org/x/tools v0.15.0/go.mod h1:hpksKq4dtpQWS1uQ61JkdqWM3LscIS6Slf+VVkm+wQk=
-golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 h1:H2TDz8ibqkAF6YGhCdN3jS9O0/s90v0rJh3X/OLHEUk=
-golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2/go.mod h1:K8+ghG5WaK9qNqU5K3HdILfMLy1f3aNYFI/wnl100a8=
+golang.org/x/tools v0.19.0 h1:tfGCXNR1OsFG+sVdLAitlpjAvD/I6dHDKnYrpEZUHkw=
+golang.org/x/tools v0.19.0/go.mod h1:qoJWxmGSIBmAeriMx19ogtrEPrGtDbPK634QFIcLAhc=
+golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 h1:+cNy6SZtPcJQH3LJVLOSmiC7MMxXNOb3PU/VUEz+EhU=
+golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028/go.mod h1:NDW/Ps6MPRej6fsCIbMTohpP40sJ/P/vI1MoTEGwX90=
 gonum.org/v1/gonum v0.12.0 h1:xKuo6hzt+gMav00meVPUlXwSdoEJP46BR+wdxQEFK2o=
 gonum.org/v1/gonum v0.12.0/go.mod h1:73TDxJfAAHeA8Mk9mf8NlIppyhQNo5GLTcYeqgo2lvY=
 google.golang.org/genproto/googleapis/api v0.0.0-20240123012728-ef4313101c80 h1:Lj5rbfG876hIAYFjqiJnPHfhXbv+nzTWfm04Fg/XSVU=
 google.golang.org/genproto/googleapis/api v0.0.0-20240123012728-ef4313101c80/go.mod h1:4jWUdICTdgc3Ibxmr8nAJiiLHwQBY0UI0XZcEMaFKaA=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20240123012728-ef4313101c80 h1:AjyfHzEPEFp/NpvfN5g+KDla3EMojjhRVZc1i7cj+oM=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20240123012728-ef4313101c80/go.mod h1:PAREbraiVEVGVdTZsVWjSbbTtSyGbAgIIvni8a8CD5s=
-google.golang.org/grpc v1.62.0 h1:HQKZ/fa1bXkX1oFOvSjmZEUL8wLSaZTjCcLAlmZRtdk=
-google.golang.org/grpc v1.62.0/go.mod h1:IWTG0VlJLCh1SkC58F7np9ka9mx/WNkjl4PGJaiq+QE=
-google.golang.org/protobuf v1.32.0 h1:pPC6BG5ex8PDFnkbrGU3EixyhKcQ2aDuBS36lqK/C7I=
-google.golang.org/protobuf v1.32.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
+google.golang.org/grpc v1.62.1 h1:B4n+nfKzOICUXMgyrNd19h/I9oH0L1pizfk1d4zSgTk=
+google.golang.org/grpc v1.62.1/go.mod h1:IWTG0VlJLCh1SkC58F7np9ka9mx/WNkjl4PGJaiq+QE=
+google.golang.org/protobuf v1.33.0 h1:uNO2rsAINq/JlFpSdYEKIZ0uKD/R9cpdv0T+yoGwGmI=
+google.golang.org/protobuf v1.33.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20200902074654-038fdea0a05b/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
diff --git a/scan/doc.go b/scan/doc.go
new file mode 100644
index 0000000..f0557aa
--- /dev/null
+++ b/scan/doc.go
@@ -0,0 +1,4 @@
+// Package scan provides a EnvironmentScanner interface which can be used for scanning
+// cloud environments and performing data repository discovery.
+// TODO: fix doc -ccampo 2024-04-02
+package scan
diff --git a/scan/env_scanner.go b/scan/env_scanner.go
new file mode 100644
index 0000000..fdb90eb
--- /dev/null
+++ b/scan/env_scanner.go
@@ -0,0 +1,66 @@
+package scan
+
+import (
+	"context"
+	"errors"
+	"time"
+)
+
+// EnvironmentScanner provides an API to scan cloud environments. It should be
+// implemented for a specific cloud provider (e.g. AWS, GCP, etc.). It defines
+// the Scan method responsible for scanning the existing data repositories of
+// the corresponding cloud provider environment.
+type EnvironmentScanner interface {
+	Scan(ctx context.Context) (*EnvironmentScanResults, error)
+}
+
+// RepoType defines the AWS data repository types supported (e.g. RDS, Redshift,
+// DynamoDB, etc).
+type RepoType string
+
+const (
+	RepoTypeRDS        RepoType = "TYPE_RDS"
+	RepoTypeRedshift   RepoType = "TYPE_REDSHIFT"
+	RepoTypeDynamoDB   RepoType = "TYPE_DYNAMODB"
+	RepoTypeS3         RepoType = "TYPE_S3"
+	RepoTypeDocumentDB RepoType = "TYPE_DOCUMENTDB"
+)
+
+// Repository represents a scanned data repository.
+type Repository struct {
+	Id         string
+	Name       string
+	Type       RepoType
+	CreatedAt  time.Time
+	Tags       []string
+	Properties any
+}
+
+// EnvironmentScanResults represents the results of a repository scan, including
+// all the data repositories that were scanned. The map key is the repository ID
+// and the value is the repository itself.
+type EnvironmentScanResults struct {
+	Repositories map[string]Repository
+}
+
+// EnvironmentScanError is an error type that represents a collection of errors
+// that occurred during the scanning process.
+type EnvironmentScanError struct {
+	Errs []error
+}
+
+// Error returns a string representation of the error.
+func (e *EnvironmentScanError) Error() string {
+	if e == nil {
+		return ""
+	}
+	return errors.Join(e.Errs...).Error()
+}
+
+// Unwrap returns the list of errors that occurred during the scanning process.
+func (e *EnvironmentScanError) Unwrap() []error {
+	if e == nil {
+		return nil
+	}
+	return e.Errs
+}
diff --git a/scan/gen.go b/scan/gen.go
new file mode 100644
index 0000000..a6b6284
--- /dev/null
+++ b/scan/gen.go
@@ -0,0 +1,5 @@
+package scan
+
+// Mock generation - see https://vektra.github.io/mockery/
+
+//go:generate mockery --with-expecter --srcpkg=github.com/cyralinc/dmap/classification --name=Classifier --filename=mock_classifier.go
diff --git a/scan/mocks/mock_classifier.go b/scan/mocks/mock_classifier.go
new file mode 100644
index 0000000..7738d64
--- /dev/null
+++ b/scan/mocks/mock_classifier.go
@@ -0,0 +1,97 @@
+// Code generated by mockery v2.42.1. DO NOT EDIT.
+
+package mocks
+
+import (
+	context "context"
+
+	classification "github.com/cyralinc/dmap/classification"
+
+	mock "github.com/stretchr/testify/mock"
+)
+
+// Classifier is an autogenerated mock type for the Classifier type
+type Classifier struct {
+	mock.Mock
+}
+
+type Classifier_Expecter struct {
+	mock *mock.Mock
+}
+
+func (_m *Classifier) EXPECT() *Classifier_Expecter {
+	return &Classifier_Expecter{mock: &_m.Mock}
+}
+
+// Classify provides a mock function with given fields: ctx, input
+func (_m *Classifier) Classify(ctx context.Context, input map[string]interface{}) (classification.Result, error) {
+	ret := _m.Called(ctx, input)
+
+	if len(ret) == 0 {
+		panic("no return value specified for Classify")
+	}
+
+	var r0 classification.Result
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, map[string]interface{}) (classification.Result, error)); ok {
+		return rf(ctx, input)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, map[string]interface{}) classification.Result); ok {
+		r0 = rf(ctx, input)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(classification.Result)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, map[string]interface{}) error); ok {
+		r1 = rf(ctx, input)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// Classifier_Classify_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Classify'
+type Classifier_Classify_Call struct {
+	*mock.Call
+}
+
+// Classify is a helper method to define mock.On call
+//   - ctx context.Context
+//   - input map[string]interface{}
+func (_e *Classifier_Expecter) Classify(ctx interface{}, input interface{}) *Classifier_Classify_Call {
+	return &Classifier_Classify_Call{Call: _e.mock.On("Classify", ctx, input)}
+}
+
+func (_c *Classifier_Classify_Call) Run(run func(ctx context.Context, input map[string]interface{})) *Classifier_Classify_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run(args[0].(context.Context), args[1].(map[string]interface{}))
+	})
+	return _c
+}
+
+func (_c *Classifier_Classify_Call) Return(_a0 classification.Result, _a1 error) *Classifier_Classify_Call {
+	_c.Call.Return(_a0, _a1)
+	return _c
+}
+
+func (_c *Classifier_Classify_Call) RunAndReturn(run func(context.Context, map[string]interface{}) (classification.Result, error)) *Classifier_Classify_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// NewClassifier creates a new instance of Classifier. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
+// The first argument is typically a *testing.T value.
+func NewClassifier(t interface {
+	mock.TestingT
+	Cleanup(func())
+}) *Classifier {
+	mock := &Classifier{}
+	mock.Mock.Test(t)
+
+	t.Cleanup(func() { mock.AssertExpectations(t) })
+
+	return mock
+}
diff --git a/scan/repo_scanner.go b/scan/repo_scanner.go
new file mode 100644
index 0000000..87bcf83
--- /dev/null
+++ b/scan/repo_scanner.go
@@ -0,0 +1,198 @@
+package scan
+
+import (
+	"context"
+	"fmt"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/cyralinc/dmap/classification"
+	"github.com/cyralinc/dmap/discovery"
+)
+
+// RepoScannerConfig is the configuration for the RepoScanner.
+type RepoScannerConfig struct {
+	Dmap DmapConfig           `embed:""`
+	Repo discovery.RepoConfig `embed:""`
+}
+
+// DmapConfig is the necessary configuration to connect to the Dmap API.
+type DmapConfig struct {
+	ApiBaseUrl   string `help:"Base URL of the Dmap API." default:"https://api.dmap.cyral.io"`
+	ClientID     string `help:"API client ID to access the Dmap API."`
+	ClientSecret string `help:"API client secret to access the Dmap API."` //#nosec G101 -- false positive
+}
+
+// RepoScanner is a data discovery scanner that scans a data repository for
+// sensitive data. It also classifies the data and publishes the results to
+// the configured external sources. It currently only supports SQL-based
+// repositories.
+type RepoScanner struct {
+	config     RepoScannerConfig
+	repository discovery.SQLRepository
+	classifier classification.Classifier
+	publisher  classification.Publisher
+}
+
+// RepoScannerOption is a functional option type for the RepoScanner type.
+type RepoScannerOption func(*RepoScanner)
+
+// WithSQLRepository is a functional option that sets the SQLRepository for the
+// RepoScanner.
+func WithSQLRepository(r discovery.SQLRepository) RepoScannerOption {
+	return func(s *RepoScanner) { s.repository = r }
+}
+
+// WithClassifier is a functional option that sets the classifier for the
+// RepoScanner.
+func WithClassifier(c classification.Classifier) RepoScannerOption {
+	return func(s *RepoScanner) { s.classifier = c }
+}
+
+// WithPublisher is a functional option that sets the publisher for the RepoScanner.
+func WithPublisher(p classification.Publisher) RepoScannerOption {
+	return func(s *RepoScanner) { s.publisher = p }
+}
+
+// NewRepoScanner creates a new RepoScanner instance with the provided configuration.
+func NewRepoScanner(ctx context.Context, cfg RepoScannerConfig, opts ...RepoScannerOption) (*RepoScanner, error) {
+	s := &RepoScanner{config: cfg}
+	// Apply options.
+	for _, opt := range opts {
+		opt(s)
+	}
+	if s.publisher == nil {
+		// Default to stdout publisher.
+		s.publisher = classification.NewStdOutPublisher()
+	}
+	if s.classifier == nil {
+		// Create a new label classifier with the embedded labels.
+		lbls, err := classification.GetEmbeddedLabels()
+		if err != nil {
+			return nil, fmt.Errorf("error getting embedded labels: %w", err)
+		}
+		c, err := classification.NewLabelClassifier(lbls.ToSlice()...)
+		if err != nil {
+			return nil, fmt.Errorf("error creating new label classifier: %w", err)
+		}
+		s.classifier = c
+	}
+	if s.repository == nil {
+		// Get a repository instance from the default registry.
+		repo, err := discovery.NewRepository(ctx, s.config.Repo)
+		if err != nil {
+			return nil, fmt.Errorf("error connecting to database: %w", err)
+		}
+		s.repository = repo
+	}
+	return s, nil
+}
+
+// Scan performs the data repository scan. It introspects and samples the
+// repository, classifies the sampled data, and publishes the results to the
+// configured classification publisher.
+func (s *RepoScanner) Scan(ctx context.Context) error {
+	sampleParams := discovery.SampleParameters{SampleSize: s.config.Repo.SampleSize}
+	var samples []discovery.Sample
+	// The name of the database to connect to has been left unspecified by
+	// the user, so we try to connect and sample all databases instead. Note
+	// that Oracle doesn't really have the concept of "databases", and thus
+	// the RepoScanner always scans the entire database, so only the single
+	// (default) repository instance is required in that case.
+	if s.config.Repo.Database == "" && s.config.Repo.Type != discovery.RepoTypeOracle {
+		var err error
+		samples, err = discovery.SampleAllDatabases(
+			ctx,
+			s.repository,
+			s.config.Repo,
+			sampleParams,
+		)
+		if err != nil {
+			err = fmt.Errorf("error sampling databases: %w", err)
+			// If we didn't get any samples, just return the error.
+			if len(samples) == 0 {
+				return err
+			}
+			// There were error(s) during sampling, but we still got some
+			// samples. Just warn and continue.
+			log.WithError(err).Warn("error sampling databases")
+		}
+	} else {
+		// User specified a database (or this is an Oracle DB), therefore
+		// we already have a repository instance for it. Just use it to
+		// sample that database only.
+		var err error
+		samples, err = discovery.SampleRepository(ctx, s.repository, sampleParams)
+		if err != nil {
+			err = fmt.Errorf("error gathering repository data samples: %w", err)
+			// If we didn't get any samples, just return the error.
+			if len(samples) == 0 {
+				return err
+			}
+			// There were error(s) during sampling, but we still got some
+			// samples. Just warn and continue.
+			log.WithError(err).Warn("error gathering repository data samples")
+		}
+	}
+
+	// Classify sampled data
+	classifications, err := classifySamples(ctx, samples, s.classifier)
+	if err != nil {
+		return fmt.Errorf("error classifying samples: %w", err)
+	}
+
+	// Publish classifications if necessary
+	if len(classifications) == 0 {
+		log.Info("No discovered classifications")
+	} else if err := s.publisher.PublishClassifications(ctx, s.config.Repo.Host, classifications); err != nil {
+		return fmt.Errorf("error publishing classifications: %w", err)
+	}
+
+	// Done!
+	return nil
+}
+
+// Cleanup performs cleanup operations for the RepoScanner.
+func (s *RepoScanner) Cleanup() {
+	// Nil checks are prevent panics if deps are not yet initialized.
+	if s.repository != nil {
+		_ = s.repository.Close()
+	}
+}
+
+// classifySamples uses the provided classifiers to classify the sample data
+// passed via the "samples" parameter. It is mostly a helper function which
+// loops through each repository.Sample, retrieves the attribute names and
+// values of that sample, passes them to Classifier.Classify, and then
+// aggregates the results. Please see the documentation for Classifier and its
+// Classify method for more details. The returned slice represents all the
+// unique classification results for a given sample set.
+func classifySamples(
+	ctx context.Context,
+	samples []discovery.Sample,
+	classifier classification.Classifier,
+) ([]classification.ClassifiedTable, error) {
+	tables := make([]classification.ClassifiedTable, 0, len(samples))
+	for _, sample := range samples {
+		// Classify each sampled row and combine the results.
+		result := make(classification.Result)
+		for _, sampleResult := range sample.Results {
+			res, err := classifier.Classify(ctx, sampleResult)
+			if err != nil {
+				return nil, fmt.Errorf("error classifying sample: %w", err)
+			}
+			result.Merge(res)
+		}
+		if len(result) > 0 {
+			table := classification.ClassifiedTable{
+				Repo:            sample.Metadata.Repo,
+				Database:        sample.Metadata.Database,
+				Schema:          sample.Metadata.Schema,
+				Table:           sample.Metadata.Table,
+				Classifications: result,
+			}
+			tables = append(tables, table)
+		}
+	}
+	return tables, nil
+}
diff --git a/scan/repo_scanner_test.go b/scan/repo_scanner_test.go
new file mode 100644
index 0000000..95c4e50
--- /dev/null
+++ b/scan/repo_scanner_test.go
@@ -0,0 +1,247 @@
+package scan
+
+import (
+	"context"
+	"testing"
+
+	"github.com/cyralinc/dmap/classification"
+	"github.com/cyralinc/dmap/discovery"
+	"github.com/cyralinc/dmap/scan/mocks"
+
+	"github.com/stretchr/testify/require"
+)
+
+func Test_classifySamples_SingleTable(t *testing.T) {
+	ctx := context.Background()
+	meta := discovery.SampleMetadata{
+		Repo:     "repo",
+		Database: "db",
+		Schema:   "schema",
+		Table:    "table",
+	}
+
+	sample := discovery.Sample{
+		Metadata: meta,
+		Results: []discovery.SampleResult{
+			{
+				"age":             "52",
+				"social_sec_num":  "512-23-4258",
+				"credit_card_num": "4111111111111111",
+			},
+			{
+				"age":             "101",
+				"social_sec_num":  "foobarbaz",
+				"credit_card_num": "4111111111111111",
+			},
+		},
+	}
+
+	classifier := mocks.NewClassifier(t)
+	// Need to explicitly convert it to a map because Mockery isn't smart enough
+	// to infer the type.
+	classifier.EXPECT().Classify(ctx, map[string]any(sample.Results[0])).Return(
+		classification.Result{
+			"age": {
+				"AGE": {Name: "AGE"},
+			},
+			"social_sec_num": {
+				"SSN": {Name: "SSN"},
+			},
+			"credit_card_num": {
+				"CCN": {Name: "CCN"},
+			},
+		},
+		nil,
+	)
+	classifier.EXPECT().Classify(ctx, map[string]any(sample.Results[1])).Return(
+		classification.Result{
+			"age": {
+				"AGE": {Name: "AGE"},
+				"CVV": {Name: "CVV"},
+			},
+			"credit_card_num": {
+				"CCN": {Name: "CCN"},
+			},
+		},
+		nil,
+	)
+
+	expected := []classification.ClassifiedTable{
+		{
+			Repo:     meta.Repo,
+			Database: meta.Database,
+			Schema:   meta.Schema,
+			Table:    meta.Table,
+			Classifications: classification.Result{
+				"age": {
+					"AGE": {Name: "AGE"},
+					"CVV": {Name: "CVV"},
+				},
+				"social_sec_num": {
+					"SSN": {Name: "SSN"},
+				},
+				"credit_card_num": {
+					"CCN": {Name: "CCN"},
+				},
+			},
+		},
+	}
+	actual, err := classifySamples(ctx, []discovery.Sample{sample}, classifier)
+	require.NoError(t, err)
+	require.Len(t, actual, len(expected))
+	for i := range actual {
+		requireClassifiedTableEqual(t, expected[i], actual[i])
+	}
+}
+
+func Test_classifySamples_MultipleTables(t *testing.T) {
+	ctx := context.Background()
+	meta1 := discovery.SampleMetadata{
+		Repo:     "repo1",
+		Database: "db1",
+		Schema:   "schema1",
+		Table:    "table1",
+	}
+	meta2 := discovery.SampleMetadata{
+		Repo:     "repo2",
+		Database: "db2",
+		Schema:   "schema2",
+		Table:    "table2",
+	}
+
+	samples := []discovery.Sample{
+		{
+			Metadata: meta1,
+			Results: []discovery.SampleResult{
+				{
+					"age":             "52",
+					"social_sec_num":  "512-23-4258",
+					"credit_card_num": "4111111111111111",
+				},
+				{
+					"age":             "101",
+					"social_sec_num":  "foobarbaz",
+					"credit_card_num": "4111111111111111",
+				},
+			},
+		},
+		{
+			Metadata: meta2,
+			Results: []discovery.SampleResult{
+				{
+					"fullname": "John Doe",
+					"dob":      "2000-01-01",
+					"random":   "foobarbaz",
+				},
+			},
+		},
+	}
+
+	classifier := mocks.NewClassifier(t)
+	// Need to explicitly convert it to a map because Mockery isn't smart enough
+	// to infer the type.
+	classifier.EXPECT().Classify(ctx, map[string]any(samples[0].Results[0])).Return(
+		classification.Result{
+			"age": {
+				"AGE": {Name: "AGE"},
+			},
+			"social_sec_num": {
+				"SSN": {Name: "SSN"},
+			},
+			"credit_card_num": {
+				"CCN": {Name: "CCN"},
+			},
+		},
+		nil,
+	)
+	classifier.EXPECT().Classify(ctx, map[string]any(samples[0].Results[1])).Return(
+		classification.Result{
+			"age": {
+				"AGE": {Name: "AGE"},
+				"CVV": {Name: "CVV"},
+			},
+			"credit_card_num": {
+				"CCN": {Name: "CCN"},
+			},
+		},
+		nil,
+	)
+	classifier.EXPECT().Classify(ctx, map[string]any(samples[1].Results[0])).Return(
+		classification.Result{
+			"fullname": {
+				"FULL_NAME": {Name: "FULL_NAME"},
+			},
+			"dob": {
+				"DOB": {Name: "DOB"},
+			},
+		},
+		nil,
+	)
+
+	expected := []classification.ClassifiedTable{
+		{
+			Repo:     meta1.Repo,
+			Database: meta1.Database,
+			Schema:   meta1.Schema,
+			Table:    meta1.Table,
+			Classifications: classification.Result{
+				"age": {
+					"AGE": {Name: "AGE"},
+					"CVV": {Name: "CVV"},
+				},
+				"social_sec_num": {
+					"SSN": {Name: "SSN"},
+				},
+				"credit_card_num": {
+					"CCN": {Name: "CCN"},
+				},
+			},
+		},
+		{
+			Repo:     meta2.Repo,
+			Database: meta2.Database,
+			Schema:   meta2.Schema,
+			Table:    meta2.Table,
+			Classifications: classification.Result{
+				"fullname": {
+					"FULL_NAME": {Name: "FULL_NAME"},
+				},
+				"dob": {
+					"DOB": {Name: "DOB"},
+				},
+			},
+		},
+	}
+	actual, err := classifySamples(ctx, samples, classifier)
+	require.NoError(t, err)
+	require.Len(t, actual, len(expected))
+	for i := range actual {
+		requireClassifiedTableEqual(t, expected[i], actual[i])
+	}
+}
+
+func requireClassifiedTableEqual(t *testing.T, expected, actual classification.ClassifiedTable) {
+	require.Equal(t, expected.Repo, actual.Repo)
+	require.Equal(t, expected.Database, actual.Database)
+	require.Equal(t, expected.Schema, actual.Schema)
+	require.Equal(t, expected.Table, actual.Table)
+	requireResultEqual(t, expected.Classifications, actual.Classifications)
+}
+
+func requireResultEqual(t *testing.T, want, got classification.Result) {
+	require.Len(t, got, len(want))
+	for k, v := range want {
+		gotSet, ok := got[k]
+		require.Truef(t, ok, "missing attribute %s", k)
+		requireLabelSetEqual(t, v, gotSet)
+	}
+}
+
+func requireLabelSetEqual(t *testing.T, want, got classification.LabelSet) {
+	require.Len(t, got, len(want))
+	for k, v := range want {
+		gotLbl, ok := got[k]
+		require.Truef(t, ok, "missing label %s", k)
+		require.Equal(t, v.Name, gotLbl.Name)
+	}
+}
diff --git a/scan/scanner.go b/scan/scanner.go
deleted file mode 100644
index ddece19..0000000
--- a/scan/scanner.go
+++ /dev/null
@@ -1,66 +0,0 @@
-// Package scan provides a Scanner interface which can be used for scanning
-// cloud environments and performing data repository discovery.
-package scan
-
-import (
-	"context"
-	"errors"
-	"time"
-)
-
-// Scanner is an interface that should be implemented for a specific cloud
-// provider (e.g. AWS, GCP, etc.). It defines the Scan method responsible for
-// scanning the existing data repositories of the corresponding cloud provider
-// environment.
-type Scanner interface {
-	Scan(ctx context.Context) (*ScanResults, error)
-}
-
-// RepoType defines the AWS data repository types supported (e.g. RDS, Redshift,
-// DynamoDB, etc).
-type RepoType string
-
-const (
-	RepoTypeRDS        RepoType = "TYPE_RDS"
-	RepoTypeRedshift   RepoType = "TYPE_REDSHIFT"
-	RepoTypeDynamoDB   RepoType = "TYPE_DYNAMODB"
-	RepoTypeS3         RepoType = "TYPE_S3"
-	RepoTypeDocumentDB RepoType = "TYPE_DOCUMENTDB"
-)
-
-// Repository represents a scanned data repository.
-type Repository struct {
-	Id         string
-	Name       string
-	Type       RepoType
-	CreatedAt  time.Time
-	Tags       []string
-	Properties any
-}
-
-// ScanResults represents the results of a repository scan, including all the
-// data repositories that were scanned. The map key is the repository ID and the
-// value is the repository itself.
-type ScanResults struct {
-	Repositories map[string]Repository
-}
-
-// ScanError is an error type that represents a collection of errors that
-// occurred during the scanning process.
-type ScanError struct {
-	Errs []error
-}
-
-func (e *ScanError) Error() string {
-	if e == nil {
-		return ""
-	}
-	return errors.Join(e.Errs...).Error()
-}
-
-func (e *ScanError) Unwrap() []error {
-	if e == nil {
-		return nil
-	}
-	return e.Errs
-}
diff --git a/testutil/mock/aws.go b/testutil/mock/aws.go
index 5a434f8..1bd337a 100644
--- a/testutil/mock/aws.go
+++ b/testutil/mock/aws.go
@@ -14,16 +14,16 @@ import (
 	s3Types "github.com/aws/aws-sdk-go-v2/service/s3/types"
 )
 
-type MockRDSClient struct {
+type RDSClient struct {
 	DBClusters  []rdsTypes.DBCluster
 	DBInstances []rdsTypes.DBInstance
 	Errors      map[string]error
 }
 
-func (m *MockRDSClient) DescribeDBClusters(
-	ctx context.Context,
+func (m *RDSClient) DescribeDBClusters(
+	_ context.Context,
 	params *rds.DescribeDBClustersInput,
-	optFns ...func(*rds.Options),
+	_ ...func(*rds.Options),
 ) (*rds.DescribeDBClustersOutput, error) {
 	if m.Errors["DescribeDBClusters"] != nil {
 		return nil, m.Errors["DescribeDBClusters"]
@@ -44,10 +44,10 @@ func (m *MockRDSClient) DescribeDBClusters(
 	}, nil
 }
 
-func (m *MockRDSClient) DescribeDBInstances(
-	ctx context.Context,
+func (m *RDSClient) DescribeDBInstances(
+	_ context.Context,
 	params *rds.DescribeDBInstancesInput,
-	optFns ...func(*rds.Options),
+	_ ...func(*rds.Options),
 ) (*rds.DescribeDBInstancesOutput, error) {
 	if m.Errors["DescribeDBInstances"] != nil {
 		return nil, m.Errors["DescribeDBInstances"]
@@ -68,16 +68,16 @@ func (m *MockRDSClient) DescribeDBInstances(
 	}, nil
 }
 
-type MockS3Client struct {
+type S3Client struct {
 	Buckets []s3Types.Bucket
 	Tags    []s3Types.Tag
 	Errors  map[string]error
 }
 
-func (m *MockS3Client) ListBuckets(
-	ctx context.Context,
-	params *s3.ListBucketsInput,
-	optFns ...func(*s3.Options),
+func (m *S3Client) ListBuckets(
+	_ context.Context,
+	_ *s3.ListBucketsInput,
+	_ ...func(*s3.Options),
 ) (*s3.ListBucketsOutput, error) {
 	if m.Errors["ListBuckets"] != nil {
 		return nil, m.Errors["ListBuckets"]
@@ -88,10 +88,10 @@ func (m *MockS3Client) ListBuckets(
 	}, nil
 }
 
-func (m *MockS3Client) GetBucketTagging(
-	ctx context.Context,
-	params *s3.GetBucketTaggingInput,
-	optFns ...func(*s3.Options),
+func (m *S3Client) GetBucketTagging(
+	_ context.Context,
+	_ *s3.GetBucketTaggingInput,
+	_ ...func(*s3.Options),
 ) (*s3.GetBucketTaggingOutput, error) {
 	if m.Errors["GetBucketTagging"] != nil {
 		return nil, m.Errors["GetBucketTagging"]
@@ -102,15 +102,15 @@ func (m *MockS3Client) GetBucketTagging(
 	}, nil
 }
 
-type MockRedshiftClient struct {
+type RedshiftClient struct {
 	Clusters []redshiftTypes.Cluster
 	Errors   map[string]error
 }
 
-func (m *MockRedshiftClient) DescribeClusters(
-	ctx context.Context,
+func (m *RedshiftClient) DescribeClusters(
+	_ context.Context,
 	params *redshift.DescribeClustersInput,
-	optFns ...func(*redshift.Options),
+	_ ...func(*redshift.Options),
 ) (*redshift.DescribeClustersOutput, error) {
 	if m.Errors["DescribeClusters"] != nil {
 		return nil, m.Errors["DescribeClusters"]
@@ -131,17 +131,17 @@ func (m *MockRedshiftClient) DescribeClusters(
 	}, nil
 }
 
-type MockDynamoDBClient struct {
+type DynamoDBClient struct {
 	TableNames []string
 	Table      map[string]*dynamodbTypes.TableDescription
 	Tags       []dynamodbTypes.Tag
 	Errors     map[string]error
 }
 
-func (m *MockDynamoDBClient) ListTables(
-	ctx context.Context,
+func (m *DynamoDBClient) ListTables(
+	_ context.Context,
 	params *dynamodb.ListTablesInput,
-	optFns ...func(*dynamodb.Options),
+	_ ...func(*dynamodb.Options),
 ) (*dynamodb.ListTablesOutput, error) {
 	if m.Errors["ListTables"] != nil {
 		return nil, m.Errors["ListTables"]
@@ -162,10 +162,10 @@ func (m *MockDynamoDBClient) ListTables(
 	}, nil
 }
 
-func (m *MockDynamoDBClient) DescribeTable(
-	ctx context.Context,
+func (m *DynamoDBClient) DescribeTable(
+	_ context.Context,
 	params *dynamodb.DescribeTableInput,
-	optFns ...func(*dynamodb.Options),
+	_ ...func(*dynamodb.Options),
 ) (*dynamodb.DescribeTableOutput, error) {
 	if m.Errors["DescribeTable"] != nil {
 		return nil, m.Errors["DescribeTable"]
@@ -175,10 +175,10 @@ func (m *MockDynamoDBClient) DescribeTable(
 	}, nil
 }
 
-func (m *MockDynamoDBClient) ListTagsOfResource(
-	ctx context.Context,
+func (m *DynamoDBClient) ListTagsOfResource(
+	_ context.Context,
 	params *dynamodb.ListTagsOfResourceInput,
-	optFns ...func(*dynamodb.Options),
+	_ ...func(*dynamodb.Options),
 ) (*dynamodb.ListTagsOfResourceOutput, error) {
 	if m.Errors["ListTagsOfResource"] != nil {
 		return nil, m.Errors["ListTagsOfResource"]
diff --git a/testutil/mock/scanner.go b/testutil/mock/scanner.go
deleted file mode 100644
index bd62bbd..0000000
--- a/testutil/mock/scanner.go
+++ /dev/null
@@ -1,18 +0,0 @@
-package mock
-
-import (
-	"context"
-
-	"github.com/cyralinc/dmap/scan"
-)
-
-type MockScanner struct {
-	Repositories []scan.Repository
-	Err          error
-}
-
-func (m *MockScanner) Scan(
-	ctx context.Context,
-) ([]scan.Repository, error) {
-	return m.Repositories, m.Err
-}

From cef628ee75656cd373f04b83eed0cfdf3c8e3ee8 Mon Sep 17 00:00:00 2001
From: Chris Campo <ccampo133@users.noreply.github.com>
Date: Wed, 3 Apr 2024 13:03:05 -0400
Subject: [PATCH 10/14] More refactoring

---
 aws/scanner.go                                |  16 +-
 aws/scanner_test.go                           |   4 +-
 classification/classification.go              |  35 +--
 classification/classification_test.go         |  59 -----
 classification/label.go                       |  50 ++--
 classification/label_classifier.go            |  44 ++--
 classification/label_classifier_test.go       |  27 +-
 classification/label_test.go                  |  52 ++++
 classification/publisher.go                   |  15 --
 classification/stdout.go                      |  33 ---
 cmd/main.go                                   |   9 +-
 cmd/repo_scan.go                              |  75 +++++-
 discovery/config.go                           | 177 -------------
 discovery/doc.go                              |  16 --
 discovery/gen.go                              |   5 -
 discovery/postgres.go                         | 127 ---------
 discovery/postgres_test.go                    |  29 --
 discovery/registry_test.go                    | 113 --------
 discovery/sample_all_databases_test.go        | 226 ----------------
 discovery/sample_repository_test.go           | 181 -------------
 discovery/sampling.go                         | 216 ---------------
 discovery/sampling_test.go                    |  77 ------
 discovery/sqlrepository.go                    |  32 ---
 scan/doc.go                                   |   5 +-
 scan/env_scanner.go                           |  66 -----
 scan/gen.go                                   |   5 -
 scan/repo_scanner.go                          | 198 --------------
 scan/repo_scanner_test.go                     | 247 ------------------
 scan/scanner.go                               |  89 +++++++
 sql/classify.go                               |  61 +++++
 sql/classify_test.go                          | 158 +++++++++++
 sql/config.go                                 |  84 ++++++
 sql/config_test.go                            |  77 ++++++
 {discovery => sql}/denodo.go                  |  49 ++--
 sql/doc.go                                    |  14 +
 sql/gen.go                                    |   6 +
 {discovery => sql}/generic.go                 | 160 +++---------
 {discovery => sql}/generic_test.go            |  67 ++---
 {discovery => sql}/metadata.go                |  65 ++++-
 {discovery => sql}/metadata_test.go           |   8 +-
 .../mock_classifier_test.go                   |  36 +--
 {discovery => sql}/mock_repository_test.go    | 145 ++++------
 {discovery => sql}/mysql.go                   |  51 ++--
 {discovery => sql}/mysql_test.go              |   4 +-
 {discovery => sql}/oracle.go                  |  45 ++--
 sql/postgres.go                               | 191 ++++++++++++++
 .../config_test.go => sql/postgres_test.go    |  94 ++-----
 {discovery => sql}/redshift.go                |  51 ++--
 {discovery => sql}/redshift_test.go           |   4 +-
 {discovery => sql}/registry.go                |  44 ++--
 sql/registry_test.go                          |  82 ++++++
 sql/repository.go                             |  76 ++++++
 sql/sample.go                                 | 190 ++++++++++++++
 sql/sample_test.go                            | 205 +++++++++++++++
 sql/samplealldatabases_test.go                | 182 +++++++++++++
 sql/scanner.go                                | 121 +++++++++
 sql/scanner_test.go                           |   1 +
 {discovery => sql}/snowflake.go               |  47 ++--
 {discovery => sql}/snowflake_test.go          |   4 +-
 {discovery => sql}/sqlserver.go               |  63 ++---
 {discovery => sql}/sqlserver_test.go          |   8 +-
 61 files changed, 2135 insertions(+), 2486 deletions(-)
 delete mode 100644 classification/classification_test.go
 delete mode 100644 classification/publisher.go
 delete mode 100644 classification/stdout.go
 delete mode 100644 discovery/config.go
 delete mode 100644 discovery/doc.go
 delete mode 100644 discovery/gen.go
 delete mode 100644 discovery/postgres.go
 delete mode 100644 discovery/postgres_test.go
 delete mode 100644 discovery/registry_test.go
 delete mode 100644 discovery/sample_all_databases_test.go
 delete mode 100644 discovery/sample_repository_test.go
 delete mode 100644 discovery/sampling.go
 delete mode 100644 discovery/sampling_test.go
 delete mode 100644 discovery/sqlrepository.go
 delete mode 100644 scan/env_scanner.go
 delete mode 100644 scan/gen.go
 delete mode 100644 scan/repo_scanner.go
 delete mode 100644 scan/repo_scanner_test.go
 create mode 100644 scan/scanner.go
 create mode 100644 sql/classify.go
 create mode 100644 sql/classify_test.go
 create mode 100644 sql/config.go
 create mode 100644 sql/config_test.go
 rename {discovery => sql}/denodo.go (65%)
 create mode 100644 sql/doc.go
 create mode 100644 sql/gen.go
 rename {discovery => sql}/generic.go (68%)
 rename {discovery => sql}/generic_test.go (84%)
 rename {discovery => sql}/metadata.go (58%)
 rename {discovery => sql}/metadata_test.go (88%)
 rename scan/mocks/mock_classifier.go => sql/mock_classifier_test.go (50%)
 rename {discovery => sql}/mock_repository_test.go (67%)
 rename {discovery => sql}/mysql.go (56%)
 rename {discovery => sql}/mysql_test.go (87%)
 rename {discovery => sql}/oracle.go (73%)
 create mode 100644 sql/postgres.go
 rename discovery/config_test.go => sql/postgres_test.go (50%)
 rename {discovery => sql}/redshift.go (59%)
 rename {discovery => sql}/redshift_test.go (87%)
 rename {discovery => sql}/registry.go (72%)
 create mode 100644 sql/registry_test.go
 create mode 100644 sql/repository.go
 create mode 100644 sql/sample.go
 create mode 100644 sql/sample_test.go
 create mode 100644 sql/samplealldatabases_test.go
 create mode 100644 sql/scanner.go
 create mode 100644 sql/scanner_test.go
 rename {discovery => sql}/snowflake.go (69%)
 rename {discovery => sql}/snowflake_test.go (87%)
 rename {discovery => sql}/sqlserver.go (52%)
 rename {discovery => sql}/sqlserver_test.go (77%)

diff --git a/aws/scanner.go b/aws/scanner.go
index 2e9eccf..15c1343 100644
--- a/aws/scanner.go
+++ b/aws/scanner.go
@@ -14,7 +14,7 @@ import (
 	"github.com/cyralinc/dmap/scan"
 )
 
-// AWSScanner is an implementation of the EnvironmentScanner interface for the AWS cloud
+// AWSScanner is an implementation of the Scanner interface for the AWS cloud
 // provider. It supports scanning data repositories from multiple AWS regions,
 // including RDS clusters and instances, Redshift clusters and DynamoDB tables.
 type AWSScanner struct {
@@ -23,8 +23,8 @@ type AWSScanner struct {
 	awsClientConstructor awsClientConstructor
 }
 
-// AWSScanner implements scan.EnvironmentScanner
-var _ scan.EnvironmentScanner = (*AWSScanner)(nil)
+// AWSScanner implements scan.Scanner
+var _ scan.Scanner = (*AWSScanner)(nil)
 
 // NewAWSScanner creates a new instance of AWSScanner based on the ScannerConfig.
 // If AssumeRoleConfig is specified, the AWSScanner will assume this IAM Role
@@ -57,7 +57,7 @@ func NewAWSScanner(
 // Scan performs a scan across all the AWS regions configured and return a scan
 // results, containing a list of data repositories that includes: RDS clusters
 // and instances, Redshift clusters and DynamoDB tables.
-func (s *AWSScanner) Scan(ctx context.Context) (*scan.EnvironmentScanResults, error) {
+func (s *AWSScanner) Scan(ctx context.Context) (*scan.ScanResults, error) {
 	responseChan := make(chan scanResponse)
 	var wg sync.WaitGroup
 	wg.Add(len(s.scannerConfig.Regions))
@@ -100,18 +100,18 @@ func (s *AWSScanner) Scan(ctx context.Context) (*scan.EnvironmentScanResults, er
 		select {
 		case <-ctx.Done():
 			scanErrors = append(scanErrors, ctx.Err())
-			return &scan.EnvironmentScanResults{
+			return &scan.ScanResults{
 				Repositories: repositories,
-			}, &scan.EnvironmentScanError{Errs: scanErrors}
+			}, &scan.ScanError{Errs: scanErrors}
 
 		case response, ok := <-responseChan:
 			if !ok {
 				// Channel closed, all scans finished.
 				var scanErr error
 				if len(scanErrors) > 0 {
-					scanErr = &scan.EnvironmentScanError{Errs: scanErrors}
+					scanErr = &scan.ScanError{Errs: scanErrors}
 				}
-				return &scan.EnvironmentScanResults{
+				return &scan.ScanResults{
 					Repositories: repositories,
 				}, scanErr
 
diff --git a/aws/scanner_test.go b/aws/scanner_test.go
index 07d4aa3..37c70c8 100644
--- a/aws/scanner_test.go
+++ b/aws/scanner_test.go
@@ -181,7 +181,7 @@ func (s *AWSScannerTestSuite) TestScan() {
 	ctx := context.Background()
 	results, err := awsScanner.Scan(ctx)
 
-	expectedResults := &scan.EnvironmentScanResults{
+	expectedResults := &scan.ScanResults{
 		Repositories: map[string]scan.Repository{
 			*s.dummyRDSClusters[0].DBClusterArn: {
 				Id:         *s.dummyRDSClusters[0].DBClusterArn,
@@ -359,7 +359,7 @@ func (s *AWSScannerTestSuite) TestScan_WithErrors() {
 	ctx := context.Background()
 	results, err := awsScanner.Scan(ctx)
 
-	expectedResults := &scan.EnvironmentScanResults{
+	expectedResults := &scan.ScanResults{
 		Repositories: nil,
 	}
 
diff --git a/classification/classification.go b/classification/classification.go
index 53d8fe8..a93bb7c 100644
--- a/classification/classification.go
+++ b/classification/classification.go
@@ -8,7 +8,9 @@ package classification
 
 import (
 	"context"
-	"maps"
+	"encoding/json"
+
+	"golang.org/x/exp/maps"
 )
 
 // Classifier is an interface that represents a data classifier. A classifier
@@ -22,35 +24,14 @@ type Classifier interface {
 	Classify(ctx context.Context, input map[string]any) (Result, error)
 }
 
-// ClassifiedTable represents a database table that has been classified. The
-// classifications are stored in the Classifications field, which is a map of
-// attribute names (i.e. columns) to the set of labels that attributes were
-// classified as.
-type ClassifiedTable struct {
-	Repo            string `json:"repo"`
-	Database        string `json:"database"`
-	Schema          string `json:"schema"`
-	Table           string `json:"table"`
-	Classifications Result `json:"classifications"`
-}
-
 // Result represents the classifications for a set of data attributes. The key
 // is the attribute (i.e. column) name and the value is the set of labels
 // that attribute was classified as.
 type Result map[string]LabelSet
 
-// Merge combines the given other Result into this Result (the receiver). If
-// an attribute from other is already present in this Result, the existing
-// labels for that attribute are merged with the labels from other, otherwise
-// labels from other for the attribute are simply added to this Result.
-func (c Result) Merge(other Result) {
-	if c == nil {
-		return
-	}
-	for attr, labelSet := range other {
-		if _, ok := c[attr]; !ok {
-			c[attr] = make(LabelSet)
-		}
-		maps.Copy(c[attr], labelSet)
-	}
+// LabelSet is a set of unique labels.
+type LabelSet map[string]struct{}
+
+func (l LabelSet) MarshalJSON() ([]byte, error) {
+	return json.Marshal(maps.Keys(l))
 }
diff --git a/classification/classification_test.go b/classification/classification_test.go
deleted file mode 100644
index d6dde27..0000000
--- a/classification/classification_test.go
+++ /dev/null
@@ -1,59 +0,0 @@
-package classification
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/require"
-)
-
-func TestMerge_WhenCalledOnNilReceiver_ShouldNotPanic(t *testing.T) {
-	var result Result
-	require.NotPanics(
-		t, func() {
-			result.Merge(Result{"age": {"AGE": {Name: "AGE"}}})
-		},
-	)
-}
-
-func TestMerge_WhenCalledWithNonExistingAttributes_ShouldAddThem(t *testing.T) {
-	result := Result{
-		"age": {"AGE": {Name: "AGE"}},
-	}
-	other := Result{
-		"social_sec_num": {"SSN": {Name: "SSN"}},
-	}
-	expected := Result{
-		"age":            {"AGE": {Name: "AGE"}},
-		"social_sec_num": {"SSN": {Name: "SSN"}},
-	}
-	result.Merge(other)
-	require.Equal(t, expected, result)
-}
-
-func TestMerge_WhenCalledWithExistingAttributes_ShouldMergeLabelSets(t *testing.T) {
-	result := Result{
-		"age": {"AGE": {Name: "AGE"}},
-	}
-	other := Result{
-		"age": {"CVV": {Name: "CVV"}},
-	}
-	expected := Result{
-		"age": {"AGE": {Name: "AGE"}, "CVV": {Name: "CVV"}},
-	}
-	result.Merge(other)
-	require.Equal(t, expected, result)
-}
-
-func TestMerge_WhenCalledWithExistingAttributes_ShouldOverwrite(t *testing.T) {
-	result := Result{
-		"age": {"AGE": {Name: "AGE", Description: "Foo"}},
-	}
-	other := Result{
-		"age": {"AGE": {Name: "AGE", Description: "Bar"}},
-	}
-	expected := Result{
-		"age": {"AGE": {Name: "AGE", Description: "Bar"}},
-	}
-	result.Merge(other)
-	require.Equal(t, expected, result)
-}
diff --git a/classification/label.go b/classification/label.go
index 88702e6..7aa38b5 100644
--- a/classification/label.go
+++ b/classification/label.go
@@ -6,8 +6,8 @@ import (
 	"strings"
 
 	"github.com/open-policy-agent/opa/ast"
-	"github.com/open-policy-agent/opa/rego"
 	log "github.com/sirupsen/logrus"
+	"golang.org/x/exp/maps"
 	"gopkg.in/yaml.v3"
 )
 
@@ -20,18 +20,23 @@ var (
 
 // Label represents a data classification label.
 type Label struct {
-	Name               string     `yaml:"name" json:"name"`
-	Description        string     `yaml:"description" json:"description"`
-	Tags               []string   `yaml:"tags" json:"tags"`
-	ClassificationRule *rego.Rego `yaml:"-" json:"-"`
+	// Name is the name of the label.
+	Name string `yaml:"name" json:"name"`
+	// Description is a brief description of the label.
+	Description string `yaml:"description" json:"description"`
+	// Tags are a list of arbitrary tags associated with the label.
+	Tags []string `yaml:"tags" json:"tags"`
+	// ClassificationRule is the compiled Rego classification rule used to
+	// classify data.
+	ClassificationRule *ast.Module `yaml:"-" json:"-"`
 }
 
 // NewLabel creates a new Label with the given name, description, classification
 // rule, and tags. The classification rule is expected to be the raw Rego code
 // that will be used to classify data. If the classification rule is invalid, an
 // error is returned.
-func NewLabel(name, description, classificationRule string, tags []string) (Label, error) {
-	rule, err := ruleRego(classificationRule)
+func NewLabel(name, description, classificationRule string, tags ...string) (Label, error) {
+	rule, err := parseRego(classificationRule)
 	if err != nil {
 		return Label{}, fmt.Errorf("error preparing classification rule for label %s: %w", name, err)
 	}
@@ -43,25 +48,12 @@ func NewLabel(name, description, classificationRule string, tags []string) (Labe
 	}, nil
 }
 
-// LabelSet is a set of unique labels. The key is the label name and the value
-// is the label itself.
-type LabelSet map[string]Label
-
-// ToSlice returns the labels in the set as a slice.
-func (s LabelSet) ToSlice() []Label {
-	var labels []Label
-	for _, label := range s {
-		labels = append(labels, label)
-	}
-	return labels
-}
-
 // GetEmbeddedLabels returns the predefined embedded labels and their
 // classification rules. The labels are read from the embedded labels.yaml file
 // and the classification rules are read from the embedded Rego files.
-func GetEmbeddedLabels() (LabelSet, error) {
+func GetEmbeddedLabels() ([]Label, error) {
 	labels := struct {
-		Labels LabelSet `yaml:"labels"`
+		Labels map[string]Label `yaml:"labels"`
 	}{}
 	if err := yaml.Unmarshal([]byte(labelsYaml), &labels); err != nil {
 		return nil, fmt.Errorf("error unmarshalling labels.yaml: %w", err)
@@ -72,7 +64,7 @@ func GetEmbeddedLabels() (LabelSet, error) {
 		if err != nil {
 			return nil, fmt.Errorf("error reading rego file %s: %w", fname, err)
 		}
-		rule, err := ruleRego(string(b))
+		rule, err := parseRego(string(b))
 		if err != nil {
 			return nil, fmt.Errorf("error preparing classification rule for label %s: %w", lbl.Name, err)
 		}
@@ -80,16 +72,14 @@ func GetEmbeddedLabels() (LabelSet, error) {
 		lbl.ClassificationRule = rule
 		labels.Labels[name] = lbl
 	}
-	return labels.Labels, nil
+	return maps.Values(labels.Labels), nil
 }
 
-func ruleRego(code string) (*rego.Rego, error) {
+func parseRego(code string) (*ast.Module, error) {
 	log.Tracef("classifier module code: '%s'", code)
-	moduleName := "classifier"
-	compiledRego, err := ast.CompileModules(map[string]string{moduleName: code})
+	module, err := ast.ParseModule("classifier", code)
 	if err != nil {
-		return nil, fmt.Errorf("error compiling rego code: %w", err)
+		return nil, fmt.Errorf("error parsing rego code: %w", err)
 	}
-	regoQuery := compiledRego.Modules[moduleName].Package.Path.String() + ".output"
-	return rego.New(rego.Query(regoQuery), rego.Compiler(compiledRego)), nil
+	return module, nil
 }
diff --git a/classification/label_classifier.go b/classification/label_classifier.go
index 37fcc29..c7a23b9 100644
--- a/classification/label_classifier.go
+++ b/classification/label_classifier.go
@@ -11,37 +11,41 @@ import (
 // LabelClassifier is a Classifier implementation that uses a set of labels and
 // their classification rules to classify data.
 type LabelClassifier struct {
-	labels LabelSet
+	queries map[string]*rego.Rego
 }
 
 // LabelClassifier implements Classifier
 var _ Classifier = (*LabelClassifier)(nil)
 
-// NewLabelClassifier creates a new LabelClassifier with the provided labels and
-// classification rules.
+// NewLabelClassifier creates a new LabelClassifier with the provided labels.
+//
 func NewLabelClassifier(labels ...Label) (*LabelClassifier, error) {
 	if len(labels) == 0 {
 		return nil, fmt.Errorf("labels cannot be empty")
 	}
-	l := make(LabelSet, len(labels))
+	queries := make(map[string]*rego.Rego, len(labels))
 	for _, lbl := range labels {
-		l[lbl.Name] = lbl
+		queries[lbl.Name] = rego.New(
+			// We only care about the 'output' variable.
+			rego.Query(lbl.ClassificationRule.Package.Path.String() + ".output"),
+			rego.ParsedModule(lbl.ClassificationRule),
+		)
 	}
-	return &LabelClassifier{labels: l}, nil
+	return &LabelClassifier{queries: queries}, nil
 }
 
 // Classify performs the classification of the provided attributes using the
-// classifier's labels and classification rules. It returns a Result, which is
-// a map of attribute names to the set of labels that the attribute was
-// classified as.
+// classifier's labels and their corresponding classification rules. It returns
+// a Result, which is a map of attribute names to the set of labels that the
+// attribute was classified as.
 func (c *LabelClassifier) Classify(ctx context.Context, input map[string]any) (Result, error) {
-	result := make(Result, len(c.labels))
-	for _, lbl := range c.labels {
-		output, err := evalQuery(ctx, lbl.ClassificationRule, input)
+	result := make(Result, len(c.queries))
+	for lbl, query := range c.queries {
+		output, err := evalQuery(ctx, query, input)
 		if err != nil {
-			return nil, fmt.Errorf("error evaluating query for label %s: %w", lbl.Name, err)
+			return nil, fmt.Errorf("error evaluating query for label %s: %w", lbl, err)
 		}
-		log.Debugf("classification results for label %s: %v", lbl.Name, output)
+		log.Debugf("classification results for label %s: %v", lbl, output)
 		for attrName, classified := range output {
 			if classified {
 				attrLabels, ok := result[attrName]
@@ -49,21 +53,21 @@ func (c *LabelClassifier) Classify(ctx context.Context, input map[string]any) (R
 					attrLabels = make(LabelSet)
 					result[attrName] = attrLabels
 				}
-				attrLabels[lbl.Name] = lbl
+				// Add the label to the set of labels for the attribute.
+				attrLabels[lbl] = struct{}{}
 			}
 		}
 	}
 	return result, nil
 }
 
-// evalQuery evaluates the provided prepared Rego query with the given
-// attributes as input, and returns the classification results. The output is a
+// evalQuery evaluates the provided Rego query with the given attributes as input, and returns the classification results. The output is a
 // map of attribute names to boolean values, where the boolean indicates whether
 // the attribute is classified as belonging to the label.
-func evalQuery(ctx context.Context, rule *rego.Rego, input map[string]any) (map[string]bool, error) {
-	q, err := rule.PrepareForEval(ctx)
+func evalQuery(ctx context.Context, query *rego.Rego, input map[string]any) (map[string]bool, error) {
+	q, err := query.PrepareForEval(ctx)
 	if err != nil {
-		return nil, fmt.Errorf("error preparing rule for evaluation: %w", err)
+		return nil, fmt.Errorf("error preparing query for evaluation: %w", err)
 	}
 	// Evaluate the prepared Rego query. This performs the actual classification
 	// logic.
diff --git a/classification/label_classifier_test.go b/classification/label_classifier_test.go
index abea713..50fd1e0 100644
--- a/classification/label_classifier_test.go
+++ b/classification/label_classifier_test.go
@@ -9,7 +9,9 @@ import (
 )
 
 func TestNewLabelClassifier_Success(t *testing.T) {
-	classifier, err := NewLabelClassifier(Label{Name: "foo"})
+	lbl, err := NewLabel("foo", "test label", "package foo\noutput = true")
+	require.NoError(t, err)
+	classifier, err := NewLabelClassifier(lbl)
 	require.NoError(t, err)
 	require.NotNil(t, classifier)
 }
@@ -40,7 +42,7 @@ func TestLabelClassifier_Classify(t *testing.T) {
 			input:      map[string]any{"age": "42"},
 			want: Result{
 				"age": {
-					"AGE": Label{Name: "AGE"},
+					"AGE": {},
 				},
 			},
 		},
@@ -53,7 +55,7 @@ func TestLabelClassifier_Classify(t *testing.T) {
 			},
 			want: Result{
 				"age": {
-					"AGE": Label{Name: "AGE"},
+					"AGE": {},
 				},
 			},
 		},
@@ -63,7 +65,7 @@ func TestLabelClassifier_Classify(t *testing.T) {
 			input:      map[string]any{"age": "42"},
 			want: Result{
 				"age": {
-					"AGE": Label{Name: "AGE"},
+					"AGE": {},
 				},
 			},
 		},
@@ -76,10 +78,10 @@ func TestLabelClassifier_Classify(t *testing.T) {
 			},
 			want: Result{
 				"age": {
-					"AGE": Label{Name: "AGE"},
+					"AGE": {},
 				},
 				"ccn": {
-					"CCN": Label{Name: "CCN"},
+					"CCN": {},
 				},
 			},
 		},
@@ -92,11 +94,11 @@ func TestLabelClassifier_Classify(t *testing.T) {
 			},
 			want: Result{
 				"age": {
-					"AGE": Label{Name: "AGE"},
-					"CVV": Label{Name: "CVV"},
+					"AGE": {},
+					"CVV": {},
 				},
 				"cvv": {
-					"CVV": Label{Name: "CVV"},
+					"CVV": {},
 				},
 			},
 		},
@@ -127,10 +129,9 @@ func requireResultEqual(t *testing.T, want, got Result) {
 
 func requireLabelSetEqual(t *testing.T, want, got LabelSet) {
 	require.Len(t, got, len(want))
-	for k, v := range want {
-		gotLbl, ok := got[k]
+	for k := range want {
+		_, ok := got[k]
 		require.Truef(t, ok, "missing label %s", k)
-		require.Equal(t, v.Name, gotLbl.Name)
 	}
 }
 
@@ -149,7 +150,7 @@ func newTestLabel(t *testing.T, lblName string) Label {
 	fin, err := regoFs.ReadFile(fname)
 	require.NoError(t, err)
 	classifierCode := string(fin)
-	lbl, err := NewLabel(lblName, "test label", classifierCode, nil)
+	lbl, err := NewLabel(lblName, "test label", classifierCode)
 	require.NoError(t, err)
 	return lbl
 }
diff --git a/classification/label_test.go b/classification/label_test.go
index 8b718f2..35a0b69 100644
--- a/classification/label_test.go
+++ b/classification/label_test.go
@@ -1,8 +1,11 @@
 package classification
 
 import (
+	"context"
+	"fmt"
 	"testing"
 
+	"github.com/open-policy-agent/opa/rego"
 	"github.com/stretchr/testify/require"
 )
 
@@ -11,3 +14,52 @@ func TestGetEmbeddedLabels(t *testing.T) {
 	require.NoError(t, err)
 	require.NotEmpty(t, got)
 }
+
+func TestRego(t *testing.T) {
+
+	module := `
+package example.authz
+
+import rego.v1
+
+default allow := false
+
+allow if {
+   input.method == "GET"
+   input.path == ["salary", input.subject.user]
+}
+
+allow if is_admin
+
+is_admin if "admin" in input.subject.groups
+`
+
+	mod, err := parseRego(module)
+	require.NoError(t, err)
+	require.NotNil(t, mod)
+	path := mod.Package.Path.String()
+	fmt.Println(path)
+
+	ctx := context.TODO()
+
+	query, err := rego.New(
+		rego.Query("data.example.authz.allow"),
+		rego.Module("example.rego", module),
+	).PrepareForEval(ctx)
+	require.NoError(t, err)
+	require.NotNil(t, query)
+
+	input := map[string]interface{}{
+		"method": "GET",
+		"path": []interface{}{"salary", "bob"},
+		"subject": map[string]interface{}{
+			"user": "bob",
+			"groups": []interface{}{"sales", "marketing"},
+		},
+	}
+
+	results, err := query.Eval(ctx, rego.EvalInput(input))
+	require.NoError(t, err)
+	require.NotEmpty(t, results)
+	require.True(t, results.Allowed())
+}
diff --git a/classification/publisher.go b/classification/publisher.go
deleted file mode 100644
index aed92f4..0000000
--- a/classification/publisher.go
+++ /dev/null
@@ -1,15 +0,0 @@
-package classification
-
-import (
-	"context"
-)
-
-// Publisher publishes classification and discovery results to some destination,
-// which is left up to the implementer.
-// TODO: add doc about labels -ccampo 2024-04-02
-type Publisher interface {
-	// PublishClassifications publishes a slice of ClassifiedTable to some
-	// destination. Any error(s) during publication should be returned.
-	// TODO: add labels -ccampo 2024-04-02
-	PublishClassifications(ctx context.Context, repoId string, results []ClassifiedTable) error
-}
diff --git a/classification/stdout.go b/classification/stdout.go
deleted file mode 100644
index 883dc7e..0000000
--- a/classification/stdout.go
+++ /dev/null
@@ -1,33 +0,0 @@
-package classification
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-)
-
-// StdOutPublisher "publishes" classification results to stdout in JSON format.
-type StdOutPublisher struct{}
-
-// StdOutPublisher implements Publisher
-var _ Publisher = (*StdOutPublisher)(nil)
-
-// TODO: godoc -ccampo 2024-04-02
-func NewStdOutPublisher() *StdOutPublisher {
-	return &StdOutPublisher{}
-}
-
-// TODO: godoc -ccampo 2024-04-02
-func (c *StdOutPublisher) PublishClassifications(_ context.Context, _ string, tables []ClassifiedTable) error {
-	results := struct {
-		Results []ClassifiedTable `json:"results"`
-	}{
-		Results: tables,
-	}
-	b, err := json.MarshalIndent(results, "", "    ")
-	if err != nil {
-		return fmt.Errorf("failed to marshal results: %w", err)
-	}
-	fmt.Println(string(b))
-	return nil
-}
diff --git a/cmd/main.go b/cmd/main.go
index 632b9c3..fee5fd2 100644
--- a/cmd/main.go
+++ b/cmd/main.go
@@ -8,9 +8,12 @@ import (
 )
 
 type Globals struct {
-	LogLevel  logLevelFlag     `help:"Set the logging level (trace|debug|info|warn|error|fatal)" enum:"trace,debug,info,warn,error,fatal" default:"info"`
-	LogFormat logFormatFlag    `help:"Set the logging format (text|json)" enum:"text,json" default:"text"`
-	Version   kong.VersionFlag `name:"version" help:"Print version information and quit"`
+	LogLevel     logLevelFlag     `help:"Set the logging level (trace|debug|info|warn|error|fatal)" enum:"trace,debug,info,warn,error,fatal" default:"info"`
+	LogFormat    logFormatFlag    `help:"Set the logging format (text|json)" enum:"text,json" default:"text"`
+	Version      kong.VersionFlag `name:"version" help:"Print version information and quit"`
+	ApiBaseUrl   string           `help:"Base URL of the Dmap API." default:"https://api.dmap.cyral.io"`
+	ClientID     string           `help:"API client ID to access the Dmap API."`
+	ClientSecret string           `help:"API client secret to access the Dmap API."` //#nosec G101 -- false positive
 }
 
 type logLevelFlag string
diff --git a/cmd/repo_scan.go b/cmd/repo_scan.go
index b5830d9..ce4f327 100644
--- a/cmd/repo_scan.go
+++ b/cmd/repo_scan.go
@@ -2,21 +2,86 @@ package main
 
 import (
 	"context"
+	"encoding/json"
 	"fmt"
+	"reflect"
+	"strings"
 
-	"github.com/cyralinc/dmap/scan"
+	"github.com/alecthomas/kong"
+	"github.com/gobwas/glob"
+
+	"github.com/cyralinc/dmap/sql"
 )
 
 type RepoScanCmd struct {
-	scan.RepoScannerConfig
+	Type         string         `help:"Type of repository to connect to (postgres|mysql|oracle|sqlserver|snowflake|redshift|denodo)." enum:"postgres,mysql,oracle,sqlserver,snowflake,redshift,denodo" required:""`
+	ExternalID   string         `help:"External ID of the repository." required:""`
+	Host         string         `help:"Hostname of the repository." required:""`
+	Port         uint16         `help:"Port of the repository." required:""`
+	User         string         `help:"Username to connect to the sql." required:""`
+	Password     string         `help:"Password to connect to the sql." required:""`
+	Database     string         `help:"Name of the database to connect to. If not specified, the default database is used (if possible)."`
+	Advanced     map[string]any `help:"Advanced configuration for the sql."`
+	IncludePaths GlobFlag       `help:"List of glob patterns to include when introspecting the database(s)." default:"*"`
+	ExcludePaths GlobFlag       `help:"List of glob patterns to exclude when introspecting the database(s)." default:""`
+	MaxOpenConns uint           `help:"Maximum number of open connections to the database." default:"10"`
+	SampleSize   uint           `help:"Number of rows to sample from the repository (per table)." default:"5"`
+	Offset       uint           `help:"Offset to start sampling from." default:"0"`
+}
+
+// GlobFlag is a kong.MapperValue implementation that represents a glob pattern.
+type GlobFlag []glob.Glob
+
+// Decode parses the glob patterns and compiles them into glob.Glob objects. It
+// is an implementation of kong.MapperValue's Decode method.
+func (g GlobFlag) Decode(ctx *kong.DecodeContext) error {
+	var patterns string
+	if err := ctx.Scan.PopValueInto("string", &patterns); err != nil {
+		return err
+	}
+	var parsedPatterns []glob.Glob
+	for _, pattern := range strings.Split(patterns, ",") {
+		parsedPattern, err := glob.Compile(pattern)
+		if err != nil {
+			return fmt.Errorf("cannot compile %s pattern: %w", pattern, err)
+		}
+		parsedPatterns = append(parsedPatterns, parsedPattern)
+	}
+	ctx.Value.Target.Set(reflect.ValueOf(GlobFlag(parsedPatterns)))
+	return nil
 }
 
 func (cmd *RepoScanCmd) Run(_ *Globals) error {
 	ctx := context.Background()
-	scanner, err := scan.NewRepoScanner(ctx, cmd.RepoScannerConfig)
+	cfg := sql.ScannerConfig{
+		RepoType: cmd.Type,
+		RepoConfig: sql.RepoConfig{
+			Host:         cmd.Host,
+			Port:         cmd.Port,
+			User:         cmd.User,
+			Password:     cmd.Password,
+			Database:     cmd.Database,
+			MaxOpenConns: cmd.MaxOpenConns,
+			Advanced:     cmd.Advanced,
+		},
+		IncludePaths: cmd.IncludePaths,
+		ExcludePaths: cmd.ExcludePaths,
+		SampleSize:   cmd.SampleSize,
+		Offset:       cmd.Offset,
+	}
+	scanner, err := sql.NewScanner(cfg)
 	if err != nil {
 		return fmt.Errorf("error creating new scanner: %w", err)
 	}
-	defer scanner.Cleanup()
-	return scanner.Scan(ctx)
+	results, err := scanner.Scan(ctx)
+	if err != nil {
+		return fmt.Errorf("error scanning repository: %w", err)
+	}
+	jsonResults, err := json.MarshalIndent(results, "", "    ")
+	if err != nil {
+		return fmt.Errorf("error marshalling results: %w", err)
+	}
+	fmt.Println(string(jsonResults))
+	// TODO: publish results to API -ccampo 2024-04-03
+	return nil
 }
diff --git a/discovery/config.go b/discovery/config.go
deleted file mode 100644
index 925c31b..0000000
--- a/discovery/config.go
+++ /dev/null
@@ -1,177 +0,0 @@
-package discovery
-
-import (
-	"fmt"
-	"reflect"
-	"strings"
-
-	"github.com/alecthomas/kong"
-	"github.com/gobwas/glob"
-)
-
-const configConnOpts = "connection-string-args"
-
-// RepoConfig is the necessary configuration to connect to a data sql.
-type RepoConfig struct {
-	Type         string         `help:"Type of repository to connect to (postgres|mysql|oracle|sqlserver|snowflake|redshift|denodo)." enum:"postgres,mysql,oracle,sqlserver,snowflake,redshift,denodo" required:""`
-	Host         string         `help:"Hostname of the sql." required:""`
-	Port         uint16         `help:"Port of the sql." required:""`
-	User         string         `help:"Username to connect to the sql." required:""`
-	Password     string         `help:"Password to connect to the sql." required:""`
-	Advanced     map[string]any `help:"Advanced configuration for the sql."`
-	Database     string         `help:"Name of the database to connect to. If not specified, the default database is used."`
-	MaxOpenConns uint           `help:"Maximum number of open connections to the sql." default:"10"`
-	SampleSize   uint           `help:"Number of rows to sample from the repository (per table)." default:"5"`
-	IncludePaths GlobFlag       `help:"List of glob patterns to include when querying the database(s), as a comma separated list." default:"*"`
-	ExcludePaths GlobFlag       `help:"List of glob patterns to exclude when querying the database(s), as a comma separated list." default:""`
-}
-
-// GlobFlag is a kong.MapperValue implementation that represents a glob pattern.
-type GlobFlag []glob.Glob
-
-// Decode parses the glob patterns and compiles them into glob.Glob objects. It
-// is an implementation of kong.MapperValue's Decode method.
-func (g GlobFlag) Decode(ctx *kong.DecodeContext) error {
-	var patterns string
-	if err := ctx.Scan.PopValueInto("string", &patterns); err != nil {
-		return err
-	}
-	var parsedPatterns []glob.Glob
-	for _, pattern := range strings.Split(patterns, ",") {
-		parsedPattern, err := glob.Compile(pattern)
-		if err != nil {
-			return fmt.Errorf("cannot compile %s pattern: %w", pattern, err)
-		}
-		parsedPatterns = append(parsedPatterns, parsedPattern)
-	}
-	ctx.Value.Target.Set(reflect.ValueOf(GlobFlag(parsedPatterns)))
-	return nil
-}
-
-// BuildConnOptsStr parses the repo config to produce a string in the format
-// "?option=value&option2=value2". Example:
-//
-//	BuildConnOptsStr(RepoConfig{
-//	    Advanced: map[string]any{
-//	        "connection-string-args": []any{"sslmode=disable"},
-//	    },
-//	})
-//
-// returns ("?sslmode=disable", nil).
-func BuildConnOptsStr(cfg RepoConfig) (string, error) {
-	connOptsMap, err := mapFromConnOpts(cfg)
-	if err != nil {
-		return "", fmt.Errorf("connection options: %w", err)
-	}
-
-	connOptsStr := ""
-	for key, val := range connOptsMap {
-		// Don't add if the value is empty, since that would make the
-		// string malformed.
-		if val != "" {
-			if connOptsStr == "" {
-				connOptsStr += fmt.Sprintf("%s=%s", key, val)
-			} else {
-				// Need & for subsequent options
-				connOptsStr += fmt.Sprintf("&%s=%s", key, val)
-			}
-		}
-	}
-	// Only add ? if connection string is not empty
-	if connOptsStr != "" {
-		connOptsStr = "?" + connOptsStr
-	}
-
-	return connOptsStr, nil
-}
-
-// FetchAdvancedConfigString fetches a map in the repo advanced configuration,
-// for a given repo and set of parameters. Example:
-//
-// repo-advanced:
-//
-//	snowflake:
-//	  account: exampleAccount
-//	  role: exampleRole
-//	  warehouse: exampleWarehouse
-//
-// Calling FetchAdvancedMapConfig(<the repo config above>, "snowflake",
-// []string{"account", "role", "warehouse"}) returns the map
-//
-// {"account": "exampleAccount", "role": "exampleRole", "warehouse":
-// "exampleWarehouse"}
-//
-// The suffix 'String' means that the values of the map are strings. This gives
-// room to have FetchAdvancedConfigList or FetchAdvancedConfigMap, for example,
-// without name conflicts.
-func FetchAdvancedConfigString(
-	cfg RepoConfig,
-	repo string,
-	parameters []string,
-) (map[string]string, error) {
-	advancedCfg, err := getAdvancedConfig(cfg, repo)
-	if err != nil {
-		return nil, err
-	}
-	repoSpecificMap := make(map[string]string)
-	for _, key := range parameters {
-		var valInterface any
-		var val string
-		var ok bool
-		if valInterface, ok = advancedCfg[key]; !ok {
-			return nil, fmt.Errorf("unable to find '%s' in %s advanced config", key, repo)
-		}
-		if val, ok = valInterface.(string); !ok {
-			return nil, fmt.Errorf("'%s' in %s config must be a string", key, repo)
-		}
-		repoSpecificMap[key] = val
-	}
-	return repoSpecificMap, nil
-}
-
-// mapFromConnOpts builds a map from the list of connection options given in the
-//  Each option has the format 'option=value'. Err only if the config is
-// malformed, to inform user.
-func mapFromConnOpts(cfg RepoConfig) (map[string]string, error) {
-	m := make(map[string]string)
-	connOptsInterface, ok := cfg.Advanced[configConnOpts]
-	if !ok {
-		return nil, nil
-	}
-	connOpts, ok := connOptsInterface.([]any)
-	if !ok {
-		return nil, fmt.Errorf("'%s' is not a list", configConnOpts)
-	}
-	for _, optInterface := range connOpts {
-		opt, ok := optInterface.(string)
-		if !ok {
-			return nil, fmt.Errorf("'%v' is not a string", optInterface)
-		}
-		splitOpt := strings.Split(opt, "=")
-		if len(splitOpt) != 2 {
-			return nil, fmt.Errorf(
-				"malformed '%s'. "+
-					"Please follow the format 'option=value'", configConnOpts,
-			)
-		}
-		key := splitOpt[0]
-		val := splitOpt[1]
-		m[key] = val
-	}
-	return m, nil
-}
-
-// getAdvancedConfig gets the Advanced field in a repo config and converts it to
-// a map[string]any. In every step, it checks for error and generates
-// nice messages.
-func getAdvancedConfig(cfg RepoConfig, repo string) (map[string]any, error) {
-	advancedCfgInterface, ok := cfg.Advanced[repo]
-	if !ok {
-		return nil, fmt.Errorf("unable to find '%s' in advanced config", repo)
-	}
-	advancedCfg, ok := advancedCfgInterface.(map[string]any)
-	if !ok {
-		return nil, fmt.Errorf("'%s' in advanced config is not a map", repo)
-	}
-	return advancedCfg, nil
-}
diff --git a/discovery/doc.go b/discovery/doc.go
deleted file mode 100644
index 999e7e2..0000000
--- a/discovery/doc.go
+++ /dev/null
@@ -1,16 +0,0 @@
-// Package discovery provides mechanisms to perform database introspection and
-// data discovery on various data repositories. It provides a RepoScanner type that
-// can be used to scan a data repository for sensitive data, classify the data,
-// and publish the results to external sources.
-//
-// Additionally, the SQLRepository interface provides an API for performing
-// database introspection and data discovery on SQL databases. It encapsulates
-// the concept of a Dmap data SQL repository. All out-of-the-box SQLRepository
-// implementations are included in their own files named after the repository
-// type, e.g. mysql.go, postgres.go, etc.
-//
-// Registry provides an API for registering and constructing SQLRepository
-// implementations within an application. There is a global DefaultRegistry
-// which has all-out-of-the-box SQLRepository implementations registered to it
-// by default.
-package discovery
diff --git a/discovery/gen.go b/discovery/gen.go
deleted file mode 100644
index b295816..0000000
--- a/discovery/gen.go
+++ /dev/null
@@ -1,5 +0,0 @@
-package discovery
-
-// Mock generation - see https://vektra.github.io/mockery/
-
-//go:generate mockery --testonly --inpackage --with-expecter --name=Repository --filename=mock_repository_test.go
diff --git a/discovery/postgres.go b/discovery/postgres.go
deleted file mode 100644
index df9603a..0000000
--- a/discovery/postgres.go
+++ /dev/null
@@ -1,127 +0,0 @@
-package discovery
-
-import (
-	"context"
-	"fmt"
-
-	// Postgresql DB driver
-	_ "github.com/lib/pq"
-)
-
-const (
-	RepoTypePostgres = "postgres"
-
-	PostgresDatabaseQuery = `
-SELECT 
-	datname 
-FROM
-	pg_database
-WHERE
-	datistemplate = false
-	AND datallowconn = true
-	AND datname <> 'rdsadmin'
-`
-)
-
-// PostgresRepository is a SQLRepository implementation for Postgres databases.
-type PostgresRepository struct {
-	// The majority of the SQLRepository functionality is delegated to
-	// a generic SQL repository instance (genericSqlRepo).
-	genericSqlRepo *GenericRepository
-}
-
-// PostgresRepository implements SQLRepository
-var _ SQLRepository = (*PostgresRepository)(nil)
-
-// NewPostgresRepository creates a new PostgresRepository.
-func NewPostgresRepository(cfg RepoConfig) (*PostgresRepository, error) {
-	pgCfg, err := ParsePostgresConfig(cfg)
-	if err != nil {
-		return nil, fmt.Errorf("error parsing postgres config: %w", err)
-	}
-	database := cfg.Database
-	// Connect to the default database, if unspecified.
-	if database == "" {
-		database = "postgres"
-	}
-	connStr := fmt.Sprintf(
-		"postgresql://%s:%s@%s:%d/%s%s",
-		cfg.User,
-		cfg.Password,
-		cfg.Host,
-		cfg.Port,
-		database,
-		pgCfg.ConnOptsStr,
-	)
-	sqlRepo, err := NewGenericRepository(
-		cfg.Host,
-		RepoTypePostgres,
-		cfg.Database,
-		connStr,
-		cfg.MaxOpenConns,
-		cfg.IncludePaths,
-		cfg.ExcludePaths,
-	)
-	if err != nil {
-		return nil, fmt.Errorf("could not instantiate generic sql repository: %w", err)
-	}
-	return &PostgresRepository{genericSqlRepo: sqlRepo}, nil
-}
-
-// ListDatabases returns a list of the names of all databases on the server by
-// using a Postgres-specific database query. It delegates the actual work to
-// GenericRepository.ListDatabasesWithQuery - see that method for more details.
-func (r *PostgresRepository) ListDatabases(ctx context.Context) ([]string, error) {
-	return r.genericSqlRepo.ListDatabasesWithQuery(ctx, PostgresDatabaseQuery)
-}
-
-// Introspect delegates introspection to GenericRepository. See
-// SQLRepository.Introspect and GenericRepository.IntrospectWithQuery for more
-// details.
-func (r *PostgresRepository) Introspect(ctx context.Context) (*Metadata, error) {
-	return r.genericSqlRepo.Introspect(ctx)
-}
-
-// SampleTable delegates sampling to GenericRepository, using a
-// Postgres-specific table sample query. See SQLRepository.SampleTable and
-// GenericRepository.SampleTableWithQuery for more details.
-func (r *PostgresRepository) SampleTable(
-	ctx context.Context,
-	meta *TableMetadata,
-	params SampleParameters,
-) (Sample, error) {
-	// Postgres uses double-quotes to quote identifiers
-	attrStr := meta.QuotedAttributeNamesString("\"")
-	// Postgres uses $x for placeholders
-	query := fmt.Sprintf("SELECT %s FROM %s.%s LIMIT $1 OFFSET $2", attrStr, meta.Schema, meta.Name)
-	return r.genericSqlRepo.SampleTableWithQuery(ctx, meta, query, params.SampleSize, params.Offset)
-}
-
-// Ping delegates the ping to GenericRepository. See SQLRepository.Ping and
-// GenericRepository.Ping for more details.
-func (r *PostgresRepository) Ping(ctx context.Context) error {
-	return r.genericSqlRepo.Ping(ctx)
-}
-
-// Close delegates the close to GenericRepository. See SQLRepository.Close and
-// GenericRepository.Close for more details.
-func (r *PostgresRepository) Close() error {
-	return r.genericSqlRepo.Close()
-}
-
-// PostgresConfig contains Postgres-specific configuration parameters.
-type PostgresConfig struct {
-	// ConnOptsStr is a string containing Postgres-specific connection options.
-	ConnOptsStr string
-}
-
-// ParsePostgresConfig parses the Postgres-specific configuration parameters
-// from the given  The Postgres connection options are built from the
-// config and stored in the ConnOptsStr field of the returned Postgres
-func ParsePostgresConfig(cfg RepoConfig) (*PostgresConfig, error) {
-	connOptsStr, err := BuildConnOptsStr(cfg)
-	if err != nil {
-		return nil, fmt.Errorf("error building connection options string: %w", err)
-	}
-	return &PostgresConfig{ConnOptsStr: connOptsStr}, nil
-}
diff --git a/discovery/postgres_test.go b/discovery/postgres_test.go
deleted file mode 100644
index 1794a17..0000000
--- a/discovery/postgres_test.go
+++ /dev/null
@@ -1,29 +0,0 @@
-package discovery
-
-import (
-	"context"
-	"database/sql"
-	"testing"
-
-	"github.com/DATA-DOG/go-sqlmock"
-	"github.com/stretchr/testify/require"
-)
-
-func TestPostgresRepository_ListDatabases(t *testing.T) {
-	ctx, db, mock, r := initPostgresRepoTest(t)
-	defer func() { _ = db.Close() }()
-	dbRows := sqlmock.NewRows([]string{"name"}).AddRow("db1").AddRow("db2")
-	mock.ExpectQuery(PostgresDatabaseQuery).WillReturnRows(dbRows)
-	dbs, err := r.ListDatabases(ctx)
-	require.NoError(t, err)
-	require.ElementsMatch(t, []string{"db1", "db2"}, dbs)
-}
-
-func initPostgresRepoTest(t *testing.T) (context.Context, *sql.DB, sqlmock.Sqlmock, *PostgresRepository) {
-	ctx := context.Background()
-	db, mock, err := sqlmock.New()
-	require.NoError(t, err)
-	return ctx, db, mock, &PostgresRepository{
-		genericSqlRepo: NewGenericRepositoryFromDB("repoName", RepoTypePostgres, "dbName", db),
-	}
-}
diff --git a/discovery/registry_test.go b/discovery/registry_test.go
deleted file mode 100644
index d459e36..0000000
--- a/discovery/registry_test.go
+++ /dev/null
@@ -1,113 +0,0 @@
-package discovery
-
-import (
-	"context"
-	"errors"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// TODO: refactor tests to use registry instance, not default registry -ccampo 2024-04-02
-
-func TestRegistry_Register_Successful(t *testing.T) {
-	repoType := "repoType"
-	constructor := func(context.Context, RepoConfig) (SQLRepository, error) {
-		return nil, nil
-	}
-	reg := NewRegistry()
-	err := reg.Register(repoType, constructor)
-	require.NoError(t, err)
-	assert.Contains(t, reg.constructors, repoType)
-}
-
-func TestRegistry_MustRegister_NilConstructor(t *testing.T) {
-	reg := NewRegistry()
-	assert.Panics(t, func() { reg.MustRegister("repoType", nil) })
-}
-
-func TestRegistry_MustRegister_TwoCalls_Panics(t *testing.T) {
-	repoType := "repoType"
-	constructor := func(context.Context, RepoConfig) (SQLRepository, error) {
-		return nil, nil
-	}
-	reg := NewRegistry()
-	reg.MustRegister(repoType, constructor)
-	assert.Contains(t, reg.constructors, repoType)
-	assert.Panics(t, func() { reg.MustRegister(repoType, constructor) })
-}
-
-func TestRegistry_NewRepository_IsSuccessful(t *testing.T) {
-	repoType := "repoType"
-	called := false
-	expectedRepo := dummyRepo{}
-	constructor := func(context.Context, RepoConfig) (SQLRepository, error) {
-		called = true
-		return expectedRepo, nil
-	}
-	reg := NewRegistry()
-	err := reg.Register(repoType, constructor)
-	require.NoError(t, err)
-	assert.Contains(t, reg.constructors, repoType)
-
-	cfg := RepoConfig{Type: repoType}
-	repo, err := reg.NewRepository(context.Background(), cfg)
-	assert.NoError(t, err)
-	assert.Equal(t, expectedRepo, repo)
-	assert.True(t, called, "Constructor was not called")
-}
-
-func TestRegistry_NewRepository_ConstructorError(t *testing.T) {
-	repoType := "repoType"
-	called := false
-	expectedErr := errors.New("dummy error")
-	constructor := func(context.Context, RepoConfig) (SQLRepository, error) {
-		called = true
-		return nil, expectedErr
-	}
-	reg := NewRegistry()
-	err := reg.Register(repoType, constructor)
-	require.NoError(t, err)
-	assert.Contains(t, reg.constructors, repoType)
-
-	cfg := RepoConfig{Type: repoType}
-	repo, err := reg.NewRepository(context.Background(), cfg)
-	assert.ErrorIs(t, err, expectedErr)
-	assert.Nil(t, repo)
-	assert.True(t, called, "Constructor was not called")
-}
-
-func TestRegistry_NewRepository_UnsupportedRepoType(t *testing.T) {
-	repoType := "repoType"
-	cfg := RepoConfig{Type: repoType}
-	reg := NewRegistry()
-	repo, err := reg.NewRepository(context.Background(), cfg)
-	assert.Error(t, err)
-	assert.Nil(t, repo)
-}
-
-type dummyRepo struct{}
-
-func (d dummyRepo) SampleTable(context.Context, *TableMetadata, SampleParameters) (
-	Sample,
-	error,
-) {
-	panic("not implemented")
-}
-
-func (d dummyRepo) ListDatabases(context.Context) ([]string, error) {
-	panic("not implemented")
-}
-
-func (d dummyRepo) Introspect(context.Context) (*Metadata, error) {
-	panic("not implemented")
-}
-
-func (d dummyRepo) Ping(context.Context) error {
-	panic("not implemented")
-}
-
-func (d dummyRepo) Close() error {
-	panic("not implemented")
-}
diff --git a/discovery/sample_all_databases_test.go b/discovery/sample_all_databases_test.go
deleted file mode 100644
index 0539d05..0000000
--- a/discovery/sample_all_databases_test.go
+++ /dev/null
@@ -1,226 +0,0 @@
-package discovery
-
-import (
-	"context"
-	"errors"
-	"testing"
-
-	"github.com/stretchr/testify/mock"
-	"github.com/stretchr/testify/require"
-)
-
-const mockRepoType = "mockRepo"
-
-func setup(t *testing.T) *MockRepository {
-	repo := NewMockRepository(t)
-	MustRegister(
-		mockRepoType,
-		func(ctx context.Context, cfg RepoConfig) (SQLRepository, error) {
-			return repo, nil
-		},
-	)
-	return repo
-}
-
-func cleanup() {
-	delete(DefaultRegistry.constructors, mockRepoType)
-}
-
-func TestSampleAllDatabases_Error(t *testing.T) {
-	repo := setup(t)
-	t.Cleanup(cleanup)
-
-	ctx := context.Background()
-	listDbErr := errors.New("error listing databases")
-	repo.On("ListDatabases", ctx).Return(nil, listDbErr)
-	cfg := RepoConfig{Type: mockRepoType}
-	sampleParams := SampleParameters{SampleSize: 5}
-	samples, err := SampleAllDatabases(ctx, repo, cfg, sampleParams)
-	require.Nil(t, samples)
-	require.ErrorIs(t, err, listDbErr)
-}
-
-func TestSampleAllDatabases_Successful_TwoDatabases(t *testing.T) {
-	repo := setup(t)
-	t.Cleanup(cleanup)
-
-	ctx := context.Background()
-	dbs := []string{"db1", "db2"}
-	repo.On("ListDatabases", ctx).Return(dbs, nil)
-	// Dummy metadata returned for each Introspect call
-	meta := Metadata{
-		Name:     "test",
-		RepoType: mockRepoType,
-		Database: "db",
-		Schemas: map[string]*SchemaMetadata{
-			"schema": {
-				Name: "schema",
-				Tables: map[string]*TableMetadata{
-					"table": {
-						Schema: "schema",
-						Name:   "table",
-						Attributes: []*AttributeMetadata{
-							{
-								Schema:   "schema",
-								Table:    "table",
-								Name:     "attr",
-								DataType: "string",
-							},
-						},
-					},
-				},
-			},
-		},
-	}
-	repo.On("Introspect", mock.Anything).Return(&meta, nil)
-	sample := Sample{
-		Metadata: SampleMetadata{
-			Repo:     "repo",
-			Database: "db",
-			Schema:   "schema",
-			Table:    "table",
-		},
-		Results: []SampleResult{
-			{
-				"attr": "foo",
-			},
-		},
-	}
-	repo.On("SampleTable", mock.Anything, mock.Anything, mock.Anything).
-		Return(sample, nil)
-	repo.On("Close").Return(nil)
-
-	cfg := RepoConfig{Type: mockRepoType}
-	sampleParams := SampleParameters{SampleSize: 5}
-	samples, err := SampleAllDatabases(ctx, repo, cfg, sampleParams)
-	require.NoError(t, err)
-	// Two databases should be sampled, and our mock will return the sample for
-	// each sample call. This really just asserts that we've sampled the correct
-	// number of times.
-	require.ElementsMatch(t, samples, []Sample{sample, sample})
-}
-
-func TestSampleAllDatabases_IntrospectError(t *testing.T) {
-	repo := setup(t)
-	t.Cleanup(cleanup)
-
-	ctx := context.Background()
-	dbs := []string{"db1", "db2"}
-	repo.On("ListDatabases", ctx).Return(dbs, nil)
-	introspectErr := errors.New("introspect error")
-	repo.On("Introspect", mock.Anything).Return(nil, introspectErr)
-	repo.On("Close").Return(nil)
-
-	cfg := RepoConfig{Type: mockRepoType}
-	sampleParams := SampleParameters{SampleSize: 5}
-	samples, err := SampleAllDatabases(ctx, repo, cfg, sampleParams)
-	require.Empty(t, samples)
-	require.NoError(t, err)
-}
-
-func TestSampleAllDatabases_SampleError(t *testing.T) {
-	repo := setup(t)
-	t.Cleanup(cleanup)
-
-	ctx := context.Background()
-	dbs := []string{"db1", "db2"}
-	repo.On("ListDatabases", ctx).Return(dbs, nil)
-	// Dummy metadata returned for each Introspect call
-	meta := Metadata{
-		Name:     "test",
-		RepoType: mockRepoType,
-		Database: "db",
-		Schemas: map[string]*SchemaMetadata{
-			"schema": {
-				Name: "schema",
-				Tables: map[string]*TableMetadata{
-					"table": {
-						Schema: "schema",
-						Name:   "table",
-						Attributes: []*AttributeMetadata{
-							{
-								Schema:   "schema",
-								Table:    "table",
-								Name:     "attr",
-								DataType: "string",
-							},
-						},
-					},
-				},
-			},
-		},
-	}
-	repo.On("Introspect", mock.Anything).Return(&meta, nil)
-	sampleErr := errors.New("sample error")
-	repo.On("SampleTable", mock.Anything, mock.Anything, mock.Anything).
-		Return(Sample{}, sampleErr)
-	repo.On("Close").Return(nil)
-
-	cfg := RepoConfig{Type: mockRepoType}
-	sampleParams := SampleParameters{SampleSize: 5}
-	samples, err := SampleAllDatabases(ctx, repo, cfg, sampleParams)
-	require.NoError(t, err)
-	require.Empty(t, samples)
-}
-
-func TestSampleAllDatabases_TwoDatabases_OneSampleError(t *testing.T) {
-	repo := setup(t)
-	t.Cleanup(cleanup)
-
-	ctx := context.Background()
-	dbs := []string{"db1", "db2"}
-	repo.On("ListDatabases", ctx).Return(dbs, nil)
-	// Dummy metadata returned for each Introspect call
-	meta := Metadata{
-		Name:     "test",
-		RepoType: mockRepoType,
-		Database: "db",
-		Schemas: map[string]*SchemaMetadata{
-			"schema": {
-				Name: "schema",
-				Tables: map[string]*TableMetadata{
-					"table": {
-						Schema: "schema",
-						Name:   "table",
-						Attributes: []*AttributeMetadata{
-							{
-								Schema:   "schema",
-								Table:    "table",
-								Name:     "attr",
-								DataType: "string",
-							},
-						},
-					},
-				},
-			},
-		},
-	}
-	repo.On("Introspect", mock.Anything).Return(&meta, nil)
-	sample := Sample{
-		Metadata: SampleMetadata{
-			Repo:     "repo",
-			Database: "db",
-			Schema:   "schema",
-			Table:    "table",
-		},
-		Results: []SampleResult{
-			{
-				"attr": "foo",
-			},
-		},
-	}
-	repo.On("SampleTable", mock.Anything, mock.Anything, mock.Anything).
-		Return(sample, nil).Once()
-	sampleErr := errors.New("sample error")
-	repo.On("SampleTable", mock.Anything, mock.Anything, mock.Anything).
-		Return(Sample{}, sampleErr).Once()
-	repo.On("Close").Return(nil)
-
-	cfg := RepoConfig{Type: mockRepoType}
-	sampleParams := SampleParameters{SampleSize: 5}
-	samples, err := SampleAllDatabases(ctx, repo, cfg, sampleParams)
-	require.NoError(t, err)
-	// Because of a single sample error, we expect only one database was
-	// sampled.
-	require.ElementsMatch(t, samples, []Sample{sample})
-}
diff --git a/discovery/sample_repository_test.go b/discovery/sample_repository_test.go
deleted file mode 100644
index e1323e3..0000000
--- a/discovery/sample_repository_test.go
+++ /dev/null
@@ -1,181 +0,0 @@
-package discovery
-
-import (
-	"context"
-	"errors"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestSampleRepository(t *testing.T) {
-	ctx := context.Background()
-	repo := fakeRepo{}
-	params := SampleParameters{SampleSize: 2}
-	samples, err := SampleRepository(ctx, repo, params)
-	require.NoError(t, err)
-
-	// Order is not important and is actually non-deterministic due to concurrency
-	assert.ElementsMatch(t, samples, []Sample{table1Sample, table2Sample})
-}
-
-func TestSampleRepository_PartialError(t *testing.T) {
-	ctx := context.Background()
-	repo := fakeRepo{includeForbiddenTables: true}
-	params := SampleParameters{SampleSize: 2}
-	samples, err := SampleRepository(ctx, repo, params)
-	require.ErrorContains(t, err, "forbidden table")
-
-	// Order is not important and is actually non-deterministic due to concurrency
-	assert.ElementsMatch(t, samples, []Sample{table1Sample, table2Sample})
-}
-
-var repoMeta = Metadata{
-	Name:     "name",
-	RepoType: "repoType",
-	Database: "database",
-	Schemas: map[string]*SchemaMetadata{
-		"schema1": {
-			Name: "",
-			Tables: map[string]*TableMetadata{
-				"table1": {
-					Schema: "schema1",
-					Name:   "table1",
-					Attributes: []*AttributeMetadata{
-						{
-							Schema:   "schema1",
-							Table:    "table1",
-							Name:     "name1",
-							DataType: "varchar",
-						},
-						{
-							Schema:   "schema1",
-							Table:    "table1",
-							Name:     "name2",
-							DataType: "decimal",
-						},
-					},
-				},
-			},
-		},
-		"schema2": {
-			Name: "",
-			Tables: map[string]*TableMetadata{
-				"table2": {
-					Schema: "schema2",
-					Name:   "table2",
-					Attributes: []*AttributeMetadata{
-						{
-							Schema:   "schema2",
-							Table:    "table2",
-							Name:     "name3",
-							DataType: "int",
-						},
-						{
-							Schema:   "schema2",
-							Table:    "table2",
-							Name:     "name4",
-							DataType: "timestamp",
-						},
-					},
-				},
-			},
-		},
-	},
-}
-
-var schema1ForbiddenTable = TableMetadata{
-	Schema: "schema1",
-	Name:   "forbidden",
-	Attributes: []*AttributeMetadata{
-		{
-			Schema:   "schema1",
-			Table:    "forbidden",
-			Name:     "name1",
-			DataType: "varchar",
-		},
-		{
-			Schema:   "schema1",
-			Table:    "forbidden",
-			Name:     "name2",
-			DataType: "decimal",
-		},
-	},
-}
-
-var table1Sample = Sample{
-	Metadata: SampleMetadata{
-		Repo:     "name",
-		Database: "database",
-		Schema:   "schema1",
-		Table:    "table1",
-	},
-	Results: []SampleResult{
-		{
-			"name1": "foo",
-			"name2": "bar",
-		},
-		{
-			"name1": "baz",
-			"name2": "qux",
-		},
-	},
-}
-
-var table2Sample = Sample{
-	Metadata: SampleMetadata{
-		Repo:     "name",
-		Database: "database",
-		Schema:   "schema2",
-		Table:    "table2",
-	},
-	Results: []SampleResult{
-		{
-			"name3": "foo1",
-			"name4": "bar1",
-		},
-		{
-			"name3": "baz1",
-			"name4": "qux1",
-		},
-	},
-}
-
-type fakeRepo struct {
-	includeForbiddenTables bool
-}
-
-func (f fakeRepo) Introspect(context.Context) (*Metadata, error) {
-	if f.includeForbiddenTables {
-		repoMeta.Schemas["schema1"].Tables["forbidden"] = &schema1ForbiddenTable
-	}
-	return &repoMeta, nil
-}
-
-func (f fakeRepo) SampleTable(_ context.Context, meta *TableMetadata, _ SampleParameters) (
-	Sample,
-	error,
-) {
-	if meta.Name == "table1" {
-		return table1Sample, nil
-	} else if meta.Name == "table2" {
-		return table2Sample, nil
-	} else if meta.Name == "forbidden" {
-		return Sample{}, errors.New("forbidden table")
-	} else {
-		return Sample{}, errors.New("unrecognized table")
-	}
-}
-
-func (f fakeRepo) ListDatabases(context.Context) ([]string, error) {
-	panic("not implemented")
-}
-
-func (f fakeRepo) Ping(context.Context) error {
-	panic("not implemented")
-}
-
-func (f fakeRepo) Close() error {
-	panic("not implemented")
-}
diff --git a/discovery/sampling.go b/discovery/sampling.go
deleted file mode 100644
index 24b3a14..0000000
--- a/discovery/sampling.go
+++ /dev/null
@@ -1,216 +0,0 @@
-package discovery
-
-import (
-	"context"
-	"fmt"
-	"sync"
-
-	"github.com/hashicorp/go-multierror"
-	log "github.com/sirupsen/logrus"
-	"golang.org/x/sync/semaphore"
-)
-
-// SampleParameters contains all parameters necessary to sample a table.
-type SampleParameters struct {
-	SampleSize uint
-	Offset     uint
-}
-
-// Sample represents a sample of a database table. The Metadata field contains
-// metadata about the sample itself. The actual results of the sample, which
-// are represented by a set of database rows, are contained in the Results
-// field.
-type Sample struct {
-	Metadata SampleMetadata
-	Results  []SampleResult
-}
-
-// SampleMetadata contains the metadata associated with a given sample, such as
-// repo name, database name, table, schema, and query (if applicable). This can
-// be used for diagnostic and informational purposes when analyzing a
-// particular sample.
-type SampleMetadata struct {
-	Repo     string
-	Database string
-	Schema   string
-	Table    string
-}
-
-// SampleResult stores the results from a single database sample. It is
-// equivalent to a database row, where the map key is the column name and the
-// map value is the column value.
-type SampleResult map[string]any
-
-// sampleAndErr is a "pair" type intended to be passed to a channel (see
-// SampleRepository)
-type sampleAndErr struct {
-	sample Sample
-	err    error
-}
-
-// samplesAndErr is a "pair" type intended to be passed to a channel (see
-// SampleAllDatabases)
-type samplesAndErr struct {
-	samples []Sample
-	err     error
-}
-
-// GetAttributeNamesAndValues splits a SampleResult map into two slices and
-// returns them. The first slice contains all the keys of SampleResult,
-// representing the table's attribute names, and the second slice is the map's
-// corresponding values.
-func (result SampleResult) GetAttributeNamesAndValues() ([]string, []string) {
-	names := make([]string, 0, len(result))
-	vals := make([]string, 0, len(result))
-	for name, val := range result {
-		names = append(names, name)
-		var v string
-		if b, ok := val.([]byte); ok {
-			v = string(b)
-		} else {
-			v = fmt.Sprint(val)
-		}
-		vals = append(vals, v)
-	}
-	return names, vals
-}
-
-// SampleRepository is a helper function which will sample every table in a
-// given repository and return them as a collection of Sample. First the
-// repository is introspected by calling sql.Introspect to return the
-// repository metadata (Metadata). Then, for each schema and table in the
-// metadata, it calls sql.SampleTable in a new goroutine. Once all the
-// sampling goroutines are finished, their results are collected and returned
-// as a slice of Sample.
-func SampleRepository(ctx context.Context, repo SQLRepository, params SampleParameters) (
-	[]Sample,
-	error,
-) {
-	meta, err := repo.Introspect(ctx)
-	if err != nil {
-		return nil, fmt.Errorf("error introspecting repository: %w", err)
-	}
-
-	// Fan out sample executions
-	out := make(chan sampleAndErr)
-	numTables := 0
-	for _, schemaMeta := range meta.Schemas {
-		for _, tableMeta := range schemaMeta.Tables {
-			numTables++
-			go func(meta *TableMetadata, params SampleParameters) {
-				sample, err := repo.SampleTable(ctx, meta, params)
-				out <- sampleAndErr{sample: sample, err: err}
-			}(tableMeta, params)
-		}
-	}
-
-	var samples []Sample
-	var errs error
-	for i := 0; i < numTables; i++ {
-		res := <-out
-		if res.err != nil {
-			errs = multierror.Append(errs, res.err)
-		} else {
-			samples = append(samples, res.sample)
-		}
-	}
-	close(out)
-
-	if errs != nil {
-		return samples, fmt.Errorf("error(s) while sampling repository: %w", errs)
-	}
-
-	return samples, nil
-}
-
-// SampleAllDatabases uses the given repository to list all the databases on the
-// server, and samples each one in parallel by calling SampleRepository for each
-// database. The repository is intended to be configured to connect to the
-// default database on the server, or at least some database which can be used
-// to enumerate the full set of databases on the server. An error will be
-// returned if the set of databases cannot be listed. If there is an error
-// connecting to or sampling a database, the error will be logged and no samples
-// will be returned for that database. Therefore, the returned slice of samples
-// contains samples for only the databases which could be discovered and
-// successfully sampled, and could potentially be empty if no databases were
-// sampled.
-func SampleAllDatabases(
-	ctx context.Context,
-	repo SQLRepository,
-	repoCfg RepoConfig,
-	sampleParams SampleParameters,
-) (
-	[]Sample,
-	error,
-) {
-	// We assume that this repository will be connected to the default database
-	// (or at least some database that can discover all the other databases),
-	// and we use that to discover all other databases.
-	dbs, err := repo.ListDatabases(ctx)
-	if err != nil {
-		return nil, fmt.Errorf("error listing databases: %w", err)
-	}
-
-	// Sample each database on a separate goroutine, and send the samples
-	// to the 'out' channel. Each slice of samples will be aggregated below
-	// on the main goroutine and returned.
-	var wg sync.WaitGroup
-	out := make(chan samplesAndErr)
-	wg.Add(len(dbs))
-	// Ensures that we avoid opening more than the specified number of
-	// connections.
-	var sema *semaphore.Weighted
-	if repoCfg.MaxOpenConns > 0 {
-		sema = semaphore.NewWeighted(int64(repoCfg.MaxOpenConns))
-	}
-	for _, db := range dbs {
-		go func(db string, cfg RepoConfig) {
-			defer wg.Done()
-			if sema != nil {
-				_ = sema.Acquire(ctx, 1)
-				defer sema.Release(1)
-			}
-			cfg.Database = db
-			// Create a repository instance for this database. It will be used
-			// to connect and sample the database.
-			// TODO: this is ugly - there's gotta be a better way to do this -ccampo 2024-04-02
-			repo, err := NewRepository(ctx, cfg)
-			if err != nil {
-				log.WithError(err).Errorf("error creating repository instance for database %s", db)
-				return
-			}
-			// Close this repository and free up unused resources since we don't
-			// need it any longer.
-			defer func() { _ = repo.Close() }()
-			s, err := SampleRepository(ctx, repo, sampleParams)
-			if err != nil && len(s) == 0 {
-				log.WithError(err).Errorf("error gathering repository data samples for database %s", db)
-				return
-			}
-			// Send the samples for this database to the 'out' channel. The
-			// samples for each database will be aggregated into a single slice
-			// on the main goroutine and returned.
-			out <- samplesAndErr{samples: s, err: err}
-		}(db, repoCfg)
-	}
-
-	// Start a goroutine to close the 'out' channel once all the goroutines
-	// we launched above are done. This will allow the aggregation range loop
-	// below to terminate properly. Note that this must start after the wg.Add
-	// call. See https://go.dev/blog/pipelines ("Fan-out, fan-in" section).
-	go func() {
-		wg.Wait()
-		close(out)
-	}()
-
-	// Aggregate and return the results.
-	var ret []Sample
-	var errs error
-	for res := range out {
-		ret = append(ret, res.samples...)
-		if res.err != nil {
-			errs = multierror.Append(errs, res.err)
-		}
-	}
-	return ret, errs
-}
diff --git a/discovery/sampling_test.go b/discovery/sampling_test.go
deleted file mode 100644
index f964a4f..0000000
--- a/discovery/sampling_test.go
+++ /dev/null
@@ -1,77 +0,0 @@
-package discovery
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/require"
-)
-
-func TestSampleResult_GetAttributeNamesAndValues(t *testing.T) {
-	tests := []struct {
-		name                string
-		result              SampleResult
-		wantNames, wantVals []string
-	}{
-		{
-			name: "string",
-			result: SampleResult{
-				"foo": "fooVal",
-			},
-			wantNames: []string{"foo"},
-			wantVals:  []string{"fooVal"},
-		},
-		{
-			name: "int",
-			result: SampleResult{
-				"foo": 123,
-			},
-			wantNames: []string{"foo"},
-			wantVals:  []string{"123"},
-		},
-		{
-			name: "float",
-			result: SampleResult{
-				"foo": 12.3,
-			},
-			wantNames: []string{"foo"},
-			wantVals:  []string{"12.3"},
-		},
-		{
-			name: "bytes",
-			result: SampleResult{
-				"foo": []byte("fooVal"),
-			},
-			wantNames: []string{"foo"},
-			wantVals:  []string{"fooVal"},
-		},
-		{
-			name: "bool",
-			result: SampleResult{
-				"foo": false,
-			},
-			wantNames: []string{"foo"},
-			wantVals:  []string{"false"},
-		},
-		{
-			name: "varied types",
-			result: SampleResult{
-				"foo":  "fooVal",
-				"bar":  123,
-				"baz":  12.3,
-				"qux":  []byte("quxVal"),
-				"quxx": true,
-			},
-			wantNames: []string{"foo", "bar", "baz", "qux", "quxx"},
-			wantVals:  []string{"fooVal", "123", "12.3", "quxVal", "true"},
-		},
-	}
-	for _, tt := range tests {
-		t.Run(
-			tt.name, func(t *testing.T) {
-				gotNames, gotVals := tt.result.GetAttributeNamesAndValues()
-				require.ElementsMatch(t, tt.wantNames, gotNames)
-				require.ElementsMatch(t, tt.wantVals, gotVals)
-			},
-		)
-	}
-}
diff --git a/discovery/sqlrepository.go b/discovery/sqlrepository.go
deleted file mode 100644
index 8f0eeb8..0000000
--- a/discovery/sqlrepository.go
+++ /dev/null
@@ -1,32 +0,0 @@
-package discovery
-
-import (
-	"context"
-)
-
-// SQLRepository represents a Dmap data SQL repository, and provides functionality
-// to introspect its corresponding schema.
-type SQLRepository interface {
-	// ListDatabases returns a list of the names of all databases on the server.
-	ListDatabases(ctx context.Context) ([]string, error)
-	// Introspect will read and analyze the basic properties of the repository
-	// and return as a Metadata instance. This includes all the repository's
-	// databases, schemas, tables, columns, and attributes.
-	Introspect(ctx context.Context) (*Metadata, error)
-	// SampleTable samples the table referenced by the TableMetadata meta
-	// parameter and returns the sample as a slice of Sample. The parameters for
-	// the sample, such as sample size, are passed via the params parameter (see
-	// SampleParameters for more details). The returned sample result set
-	// contains one Sample for each table row sampled. The length of the results
-	// will be less than or equal to the sample size. If there are fewer results
-	// than the specified sample size, it is because the table in question had a
-	// row count less than the sample size. Prefer small sample sizes to limit
-	// impact on the database.
-	SampleTable(ctx context.Context, meta *TableMetadata, params SampleParameters) (Sample, error)
-	// Ping is meant to be used as a general purpose connectivity test. It
-	// should be invoked e.g. in the dry-run mode.
-	Ping(ctx context.Context) error
-	// Close is meant to be used as a general purpose cleanup. It should be
-	// invoked when the SQLRepository is no longer used.
-	Close() error
-}
diff --git a/scan/doc.go b/scan/doc.go
index f0557aa..38346fc 100644
--- a/scan/doc.go
+++ b/scan/doc.go
@@ -1,4 +1,3 @@
-// Package scan provides a EnvironmentScanner interface which can be used for scanning
-// cloud environments and performing data repository discovery.
-// TODO: fix doc -ccampo 2024-04-02
+// Package scan provides and API to scan cloud environments for data
+// repositories and an API to scan those repositories for sensitive data.
 package scan
diff --git a/scan/env_scanner.go b/scan/env_scanner.go
deleted file mode 100644
index fdb90eb..0000000
--- a/scan/env_scanner.go
+++ /dev/null
@@ -1,66 +0,0 @@
-package scan
-
-import (
-	"context"
-	"errors"
-	"time"
-)
-
-// EnvironmentScanner provides an API to scan cloud environments. It should be
-// implemented for a specific cloud provider (e.g. AWS, GCP, etc.). It defines
-// the Scan method responsible for scanning the existing data repositories of
-// the corresponding cloud provider environment.
-type EnvironmentScanner interface {
-	Scan(ctx context.Context) (*EnvironmentScanResults, error)
-}
-
-// RepoType defines the AWS data repository types supported (e.g. RDS, Redshift,
-// DynamoDB, etc).
-type RepoType string
-
-const (
-	RepoTypeRDS        RepoType = "TYPE_RDS"
-	RepoTypeRedshift   RepoType = "TYPE_REDSHIFT"
-	RepoTypeDynamoDB   RepoType = "TYPE_DYNAMODB"
-	RepoTypeS3         RepoType = "TYPE_S3"
-	RepoTypeDocumentDB RepoType = "TYPE_DOCUMENTDB"
-)
-
-// Repository represents a scanned data repository.
-type Repository struct {
-	Id         string
-	Name       string
-	Type       RepoType
-	CreatedAt  time.Time
-	Tags       []string
-	Properties any
-}
-
-// EnvironmentScanResults represents the results of a repository scan, including
-// all the data repositories that were scanned. The map key is the repository ID
-// and the value is the repository itself.
-type EnvironmentScanResults struct {
-	Repositories map[string]Repository
-}
-
-// EnvironmentScanError is an error type that represents a collection of errors
-// that occurred during the scanning process.
-type EnvironmentScanError struct {
-	Errs []error
-}
-
-// Error returns a string representation of the error.
-func (e *EnvironmentScanError) Error() string {
-	if e == nil {
-		return ""
-	}
-	return errors.Join(e.Errs...).Error()
-}
-
-// Unwrap returns the list of errors that occurred during the scanning process.
-func (e *EnvironmentScanError) Unwrap() []error {
-	if e == nil {
-		return nil
-	}
-	return e.Errs
-}
diff --git a/scan/gen.go b/scan/gen.go
deleted file mode 100644
index a6b6284..0000000
--- a/scan/gen.go
+++ /dev/null
@@ -1,5 +0,0 @@
-package scan
-
-// Mock generation - see https://vektra.github.io/mockery/
-
-//go:generate mockery --with-expecter --srcpkg=github.com/cyralinc/dmap/classification --name=Classifier --filename=mock_classifier.go
diff --git a/scan/repo_scanner.go b/scan/repo_scanner.go
deleted file mode 100644
index 87bcf83..0000000
--- a/scan/repo_scanner.go
+++ /dev/null
@@ -1,198 +0,0 @@
-package scan
-
-import (
-	"context"
-	"fmt"
-
-	log "github.com/sirupsen/logrus"
-
-	"github.com/cyralinc/dmap/classification"
-	"github.com/cyralinc/dmap/discovery"
-)
-
-// RepoScannerConfig is the configuration for the RepoScanner.
-type RepoScannerConfig struct {
-	Dmap DmapConfig           `embed:""`
-	Repo discovery.RepoConfig `embed:""`
-}
-
-// DmapConfig is the necessary configuration to connect to the Dmap API.
-type DmapConfig struct {
-	ApiBaseUrl   string `help:"Base URL of the Dmap API." default:"https://api.dmap.cyral.io"`
-	ClientID     string `help:"API client ID to access the Dmap API."`
-	ClientSecret string `help:"API client secret to access the Dmap API."` //#nosec G101 -- false positive
-}
-
-// RepoScanner is a data discovery scanner that scans a data repository for
-// sensitive data. It also classifies the data and publishes the results to
-// the configured external sources. It currently only supports SQL-based
-// repositories.
-type RepoScanner struct {
-	config     RepoScannerConfig
-	repository discovery.SQLRepository
-	classifier classification.Classifier
-	publisher  classification.Publisher
-}
-
-// RepoScannerOption is a functional option type for the RepoScanner type.
-type RepoScannerOption func(*RepoScanner)
-
-// WithSQLRepository is a functional option that sets the SQLRepository for the
-// RepoScanner.
-func WithSQLRepository(r discovery.SQLRepository) RepoScannerOption {
-	return func(s *RepoScanner) { s.repository = r }
-}
-
-// WithClassifier is a functional option that sets the classifier for the
-// RepoScanner.
-func WithClassifier(c classification.Classifier) RepoScannerOption {
-	return func(s *RepoScanner) { s.classifier = c }
-}
-
-// WithPublisher is a functional option that sets the publisher for the RepoScanner.
-func WithPublisher(p classification.Publisher) RepoScannerOption {
-	return func(s *RepoScanner) { s.publisher = p }
-}
-
-// NewRepoScanner creates a new RepoScanner instance with the provided configuration.
-func NewRepoScanner(ctx context.Context, cfg RepoScannerConfig, opts ...RepoScannerOption) (*RepoScanner, error) {
-	s := &RepoScanner{config: cfg}
-	// Apply options.
-	for _, opt := range opts {
-		opt(s)
-	}
-	if s.publisher == nil {
-		// Default to stdout publisher.
-		s.publisher = classification.NewStdOutPublisher()
-	}
-	if s.classifier == nil {
-		// Create a new label classifier with the embedded labels.
-		lbls, err := classification.GetEmbeddedLabels()
-		if err != nil {
-			return nil, fmt.Errorf("error getting embedded labels: %w", err)
-		}
-		c, err := classification.NewLabelClassifier(lbls.ToSlice()...)
-		if err != nil {
-			return nil, fmt.Errorf("error creating new label classifier: %w", err)
-		}
-		s.classifier = c
-	}
-	if s.repository == nil {
-		// Get a repository instance from the default registry.
-		repo, err := discovery.NewRepository(ctx, s.config.Repo)
-		if err != nil {
-			return nil, fmt.Errorf("error connecting to database: %w", err)
-		}
-		s.repository = repo
-	}
-	return s, nil
-}
-
-// Scan performs the data repository scan. It introspects and samples the
-// repository, classifies the sampled data, and publishes the results to the
-// configured classification publisher.
-func (s *RepoScanner) Scan(ctx context.Context) error {
-	sampleParams := discovery.SampleParameters{SampleSize: s.config.Repo.SampleSize}
-	var samples []discovery.Sample
-	// The name of the database to connect to has been left unspecified by
-	// the user, so we try to connect and sample all databases instead. Note
-	// that Oracle doesn't really have the concept of "databases", and thus
-	// the RepoScanner always scans the entire database, so only the single
-	// (default) repository instance is required in that case.
-	if s.config.Repo.Database == "" && s.config.Repo.Type != discovery.RepoTypeOracle {
-		var err error
-		samples, err = discovery.SampleAllDatabases(
-			ctx,
-			s.repository,
-			s.config.Repo,
-			sampleParams,
-		)
-		if err != nil {
-			err = fmt.Errorf("error sampling databases: %w", err)
-			// If we didn't get any samples, just return the error.
-			if len(samples) == 0 {
-				return err
-			}
-			// There were error(s) during sampling, but we still got some
-			// samples. Just warn and continue.
-			log.WithError(err).Warn("error sampling databases")
-		}
-	} else {
-		// User specified a database (or this is an Oracle DB), therefore
-		// we already have a repository instance for it. Just use it to
-		// sample that database only.
-		var err error
-		samples, err = discovery.SampleRepository(ctx, s.repository, sampleParams)
-		if err != nil {
-			err = fmt.Errorf("error gathering repository data samples: %w", err)
-			// If we didn't get any samples, just return the error.
-			if len(samples) == 0 {
-				return err
-			}
-			// There were error(s) during sampling, but we still got some
-			// samples. Just warn and continue.
-			log.WithError(err).Warn("error gathering repository data samples")
-		}
-	}
-
-	// Classify sampled data
-	classifications, err := classifySamples(ctx, samples, s.classifier)
-	if err != nil {
-		return fmt.Errorf("error classifying samples: %w", err)
-	}
-
-	// Publish classifications if necessary
-	if len(classifications) == 0 {
-		log.Info("No discovered classifications")
-	} else if err := s.publisher.PublishClassifications(ctx, s.config.Repo.Host, classifications); err != nil {
-		return fmt.Errorf("error publishing classifications: %w", err)
-	}
-
-	// Done!
-	return nil
-}
-
-// Cleanup performs cleanup operations for the RepoScanner.
-func (s *RepoScanner) Cleanup() {
-	// Nil checks are prevent panics if deps are not yet initialized.
-	if s.repository != nil {
-		_ = s.repository.Close()
-	}
-}
-
-// classifySamples uses the provided classifiers to classify the sample data
-// passed via the "samples" parameter. It is mostly a helper function which
-// loops through each repository.Sample, retrieves the attribute names and
-// values of that sample, passes them to Classifier.Classify, and then
-// aggregates the results. Please see the documentation for Classifier and its
-// Classify method for more details. The returned slice represents all the
-// unique classification results for a given sample set.
-func classifySamples(
-	ctx context.Context,
-	samples []discovery.Sample,
-	classifier classification.Classifier,
-) ([]classification.ClassifiedTable, error) {
-	tables := make([]classification.ClassifiedTable, 0, len(samples))
-	for _, sample := range samples {
-		// Classify each sampled row and combine the results.
-		result := make(classification.Result)
-		for _, sampleResult := range sample.Results {
-			res, err := classifier.Classify(ctx, sampleResult)
-			if err != nil {
-				return nil, fmt.Errorf("error classifying sample: %w", err)
-			}
-			result.Merge(res)
-		}
-		if len(result) > 0 {
-			table := classification.ClassifiedTable{
-				Repo:            sample.Metadata.Repo,
-				Database:        sample.Metadata.Database,
-				Schema:          sample.Metadata.Schema,
-				Table:           sample.Metadata.Table,
-				Classifications: result,
-			}
-			tables = append(tables, table)
-		}
-	}
-	return tables, nil
-}
diff --git a/scan/repo_scanner_test.go b/scan/repo_scanner_test.go
deleted file mode 100644
index 95c4e50..0000000
--- a/scan/repo_scanner_test.go
+++ /dev/null
@@ -1,247 +0,0 @@
-package scan
-
-import (
-	"context"
-	"testing"
-
-	"github.com/cyralinc/dmap/classification"
-	"github.com/cyralinc/dmap/discovery"
-	"github.com/cyralinc/dmap/scan/mocks"
-
-	"github.com/stretchr/testify/require"
-)
-
-func Test_classifySamples_SingleTable(t *testing.T) {
-	ctx := context.Background()
-	meta := discovery.SampleMetadata{
-		Repo:     "repo",
-		Database: "db",
-		Schema:   "schema",
-		Table:    "table",
-	}
-
-	sample := discovery.Sample{
-		Metadata: meta,
-		Results: []discovery.SampleResult{
-			{
-				"age":             "52",
-				"social_sec_num":  "512-23-4258",
-				"credit_card_num": "4111111111111111",
-			},
-			{
-				"age":             "101",
-				"social_sec_num":  "foobarbaz",
-				"credit_card_num": "4111111111111111",
-			},
-		},
-	}
-
-	classifier := mocks.NewClassifier(t)
-	// Need to explicitly convert it to a map because Mockery isn't smart enough
-	// to infer the type.
-	classifier.EXPECT().Classify(ctx, map[string]any(sample.Results[0])).Return(
-		classification.Result{
-			"age": {
-				"AGE": {Name: "AGE"},
-			},
-			"social_sec_num": {
-				"SSN": {Name: "SSN"},
-			},
-			"credit_card_num": {
-				"CCN": {Name: "CCN"},
-			},
-		},
-		nil,
-	)
-	classifier.EXPECT().Classify(ctx, map[string]any(sample.Results[1])).Return(
-		classification.Result{
-			"age": {
-				"AGE": {Name: "AGE"},
-				"CVV": {Name: "CVV"},
-			},
-			"credit_card_num": {
-				"CCN": {Name: "CCN"},
-			},
-		},
-		nil,
-	)
-
-	expected := []classification.ClassifiedTable{
-		{
-			Repo:     meta.Repo,
-			Database: meta.Database,
-			Schema:   meta.Schema,
-			Table:    meta.Table,
-			Classifications: classification.Result{
-				"age": {
-					"AGE": {Name: "AGE"},
-					"CVV": {Name: "CVV"},
-				},
-				"social_sec_num": {
-					"SSN": {Name: "SSN"},
-				},
-				"credit_card_num": {
-					"CCN": {Name: "CCN"},
-				},
-			},
-		},
-	}
-	actual, err := classifySamples(ctx, []discovery.Sample{sample}, classifier)
-	require.NoError(t, err)
-	require.Len(t, actual, len(expected))
-	for i := range actual {
-		requireClassifiedTableEqual(t, expected[i], actual[i])
-	}
-}
-
-func Test_classifySamples_MultipleTables(t *testing.T) {
-	ctx := context.Background()
-	meta1 := discovery.SampleMetadata{
-		Repo:     "repo1",
-		Database: "db1",
-		Schema:   "schema1",
-		Table:    "table1",
-	}
-	meta2 := discovery.SampleMetadata{
-		Repo:     "repo2",
-		Database: "db2",
-		Schema:   "schema2",
-		Table:    "table2",
-	}
-
-	samples := []discovery.Sample{
-		{
-			Metadata: meta1,
-			Results: []discovery.SampleResult{
-				{
-					"age":             "52",
-					"social_sec_num":  "512-23-4258",
-					"credit_card_num": "4111111111111111",
-				},
-				{
-					"age":             "101",
-					"social_sec_num":  "foobarbaz",
-					"credit_card_num": "4111111111111111",
-				},
-			},
-		},
-		{
-			Metadata: meta2,
-			Results: []discovery.SampleResult{
-				{
-					"fullname": "John Doe",
-					"dob":      "2000-01-01",
-					"random":   "foobarbaz",
-				},
-			},
-		},
-	}
-
-	classifier := mocks.NewClassifier(t)
-	// Need to explicitly convert it to a map because Mockery isn't smart enough
-	// to infer the type.
-	classifier.EXPECT().Classify(ctx, map[string]any(samples[0].Results[0])).Return(
-		classification.Result{
-			"age": {
-				"AGE": {Name: "AGE"},
-			},
-			"social_sec_num": {
-				"SSN": {Name: "SSN"},
-			},
-			"credit_card_num": {
-				"CCN": {Name: "CCN"},
-			},
-		},
-		nil,
-	)
-	classifier.EXPECT().Classify(ctx, map[string]any(samples[0].Results[1])).Return(
-		classification.Result{
-			"age": {
-				"AGE": {Name: "AGE"},
-				"CVV": {Name: "CVV"},
-			},
-			"credit_card_num": {
-				"CCN": {Name: "CCN"},
-			},
-		},
-		nil,
-	)
-	classifier.EXPECT().Classify(ctx, map[string]any(samples[1].Results[0])).Return(
-		classification.Result{
-			"fullname": {
-				"FULL_NAME": {Name: "FULL_NAME"},
-			},
-			"dob": {
-				"DOB": {Name: "DOB"},
-			},
-		},
-		nil,
-	)
-
-	expected := []classification.ClassifiedTable{
-		{
-			Repo:     meta1.Repo,
-			Database: meta1.Database,
-			Schema:   meta1.Schema,
-			Table:    meta1.Table,
-			Classifications: classification.Result{
-				"age": {
-					"AGE": {Name: "AGE"},
-					"CVV": {Name: "CVV"},
-				},
-				"social_sec_num": {
-					"SSN": {Name: "SSN"},
-				},
-				"credit_card_num": {
-					"CCN": {Name: "CCN"},
-				},
-			},
-		},
-		{
-			Repo:     meta2.Repo,
-			Database: meta2.Database,
-			Schema:   meta2.Schema,
-			Table:    meta2.Table,
-			Classifications: classification.Result{
-				"fullname": {
-					"FULL_NAME": {Name: "FULL_NAME"},
-				},
-				"dob": {
-					"DOB": {Name: "DOB"},
-				},
-			},
-		},
-	}
-	actual, err := classifySamples(ctx, samples, classifier)
-	require.NoError(t, err)
-	require.Len(t, actual, len(expected))
-	for i := range actual {
-		requireClassifiedTableEqual(t, expected[i], actual[i])
-	}
-}
-
-func requireClassifiedTableEqual(t *testing.T, expected, actual classification.ClassifiedTable) {
-	require.Equal(t, expected.Repo, actual.Repo)
-	require.Equal(t, expected.Database, actual.Database)
-	require.Equal(t, expected.Schema, actual.Schema)
-	require.Equal(t, expected.Table, actual.Table)
-	requireResultEqual(t, expected.Classifications, actual.Classifications)
-}
-
-func requireResultEqual(t *testing.T, want, got classification.Result) {
-	require.Len(t, got, len(want))
-	for k, v := range want {
-		gotSet, ok := got[k]
-		require.Truef(t, ok, "missing attribute %s", k)
-		requireLabelSetEqual(t, v, gotSet)
-	}
-}
-
-func requireLabelSetEqual(t *testing.T, want, got classification.LabelSet) {
-	require.Len(t, got, len(want))
-	for k, v := range want {
-		gotLbl, ok := got[k]
-		require.Truef(t, ok, "missing label %s", k)
-		require.Equal(t, v.Name, gotLbl.Name)
-	}
-}
diff --git a/scan/scanner.go b/scan/scanner.go
new file mode 100644
index 0000000..8a39f4f
--- /dev/null
+++ b/scan/scanner.go
@@ -0,0 +1,89 @@
+package scan
+
+import (
+	"context"
+	"errors"
+	"time"
+
+	"github.com/cyralinc/dmap/classification"
+)
+
+// Scanner provides an API to scan cloud environments. It should be
+// implemented for a specific cloud provider (e.g. AWS, GCP, etc.). It defines
+// the Scan method responsible for scanning the existing data repositories of
+// the corresponding cloud provider environment.
+type Scanner interface {
+	Scan(ctx context.Context) (*ScanResults, error)
+}
+
+// RepoScanner is a scanner that scans a data repository for sensitive data.
+type RepoScanner interface {
+	Scan(ctx context.Context) (*RepoScanResults, error)
+}
+
+// RepoScanResults is the result of a repository scan.
+type RepoScanResults struct {
+	Labels          []classification.Label `json:"labels"`
+	Classifications []Classification       `json:"classifications"`
+}
+
+// TODO: godoc -ccampo 2024-04-03
+type Classification struct {
+	// AttributePath is the full path of the data repository attribute
+	// (e.g. the column). Each element corresponds to a component, in increasing
+	// order of granularity (e.g. [database, schema, table, column]).
+	AttributePath []string `json:"attributePath"`
+	// Labels is the set of labels that the attribute was classified as.
+	Labels classification.LabelSet `json:"labels"`
+}
+
+// RepoType defines the AWS data repository types supported (e.g. RDS, Redshift,
+// DynamoDB, etc).
+type RepoType string
+
+const (
+	RepoTypeRDS        RepoType = "TYPE_RDS"
+	RepoTypeRedshift   RepoType = "TYPE_REDSHIFT"
+	RepoTypeDynamoDB   RepoType = "TYPE_DYNAMODB"
+	RepoTypeS3         RepoType = "TYPE_S3"
+	RepoTypeDocumentDB RepoType = "TYPE_DOCUMENTDB"
+)
+
+// Repository represents a scanned data repository.
+type Repository struct {
+	Id         string
+	Name       string
+	Type       RepoType
+	CreatedAt  time.Time
+	Tags       []string
+	Properties any
+}
+
+// ScanResults represents the results of a repository scan, including all the
+// data repositories that were scanned. The map key is the repository ID and the
+// value is the repository itself.
+type ScanResults struct {
+	Repositories map[string]Repository
+}
+
+// ScanError is an error type that represents a collection of errors that
+// occurred during the scanning process.
+type ScanError struct {
+	Errs []error
+}
+
+// Error returns a string representation of the error.
+func (e *ScanError) Error() string {
+	if e == nil {
+		return ""
+	}
+	return errors.Join(e.Errs...).Error()
+}
+
+// Unwrap returns the list of errors that occurred during the scanning process.
+func (e *ScanError) Unwrap() []error {
+	if e == nil {
+		return nil
+	}
+	return e.Errs
+}
diff --git a/sql/classify.go b/sql/classify.go
new file mode 100644
index 0000000..30dd914
--- /dev/null
+++ b/sql/classify.go
@@ -0,0 +1,61 @@
+package sql
+
+import (
+	"context"
+	"fmt"
+	"maps"
+	"strings"
+
+	"github.com/cyralinc/dmap/classification"
+	"github.com/cyralinc/dmap/scan"
+)
+
+// classifySamples uses the provided classifiers to classify the sample data
+// passed via the "samples" parameter. It is mostly a helper function which
+// loops through each repository.Sample, retrieves the attribute names and
+// values of that sample, passes them to Classifier.Classify, and then
+// aggregates the results. Please see the documentation for Classifier and its
+// Classify method for more details. The returned slice represents all the
+// unique classification results for a given sample set.
+func classifySamples(
+	ctx context.Context,
+	samples []Sample,
+	classifier classification.Classifier,
+) ([]scan.Classification, error) {
+	uniqueResults := make(map[string]scan.Classification)
+	for _, sample := range samples {
+		// Classify each sampled row and combine the results.
+		for _, sampleResult := range sample.Results {
+			res, err := classifier.Classify(ctx, sampleResult)
+			if err != nil {
+				return nil, fmt.Errorf("error classifying sample: %w", err)
+			}
+			for attr, labels := range res {
+				attrPath := append(sample.TablePath, attr)
+				key := pathKey(attrPath)
+				result, ok := uniqueResults[key]
+				if !ok {
+					uniqueResults[key] = scan.Classification{
+						AttributePath: attrPath,
+						Labels:        labels,
+					}
+				} else {
+					// Merge the labels from the new result into the existing result.
+					maps.Copy(result.Labels, labels)
+				}
+			}
+		}
+	}
+	// Convert the map of unique results to a slice.
+	results := make([]scan.Classification, 0, len(uniqueResults))
+	for _, result := range uniqueResults {
+		results = append(results, result)
+	}
+	return results, nil
+}
+
+func pathKey(path []string) string {
+	// U+2063 is an invisible separator. It is used here to ensure that the
+	// pathKey is unique and does not conflict with any of the path elements.
+	return strings.Join(path, "\u2063")
+}
diff --git a/sql/classify_test.go b/sql/classify_test.go
new file mode 100644
index 0000000..abce877
--- /dev/null
+++ b/sql/classify_test.go
@@ -0,0 +1,158 @@
+package sql
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/cyralinc/dmap/classification"
+	"github.com/cyralinc/dmap/scan"
+)
+
+func Test_classifySamples_SingleSample(t *testing.T) {
+	ctx := context.Background()
+	sample := Sample{
+		TablePath: []string{"db", "schema", "table"},
+		Results: []SampleResult{
+			{
+				"age":             "52",
+				"social_sec_num":  "512-23-4258",
+				"credit_card_num": "4111111111111111",
+			},
+			{
+				"age":             "101",
+				"social_sec_num":  "foobarbaz",
+				"credit_card_num": "4111111111111111",
+			},
+		},
+	}
+	classifier := NewMockClassifier(t)
+	// Need to explicitly convert it to a map because Mockery isn't smart enough
+	// to infer the type.
+	classifier.EXPECT().Classify(ctx, map[string]any(sample.Results[0])).Return(
+		classification.Result{
+			"age":             lblSet("AGE"),
+			"social_sec_num":  lblSet("SSN"),
+			"credit_card_num": lblSet("CCN"),
+		},
+		nil,
+	)
+	classifier.EXPECT().Classify(ctx, map[string]any(sample.Results[1])).Return(
+		classification.Result{
+			"age":             lblSet("AGE", "CVV"),
+			"credit_card_num": lblSet("CCN"),
+		},
+		nil,
+	)
+
+	expected := []scan.Classification{
+		{
+			AttributePath: append(sample.TablePath, "age"),
+			Labels:        lblSet("AGE", "CVV"),
+		},
+		{
+			AttributePath: append(sample.TablePath, "social_sec_num"),
+			Labels:        lblSet("SSN"),
+		},
+		{
+			AttributePath: append(sample.TablePath, "credit_card_num"),
+			Labels:        lblSet("CCN"),
+		},
+	}
+	actual, err := classifySamples(ctx, []Sample{sample}, classifier)
+	require.NoError(t, err)
+	require.ElementsMatch(t, expected, actual)
+}
+
+func Test_classifySamples_MultipleSamples(t *testing.T) {
+	ctx := context.Background()
+	samples := []Sample{
+		{
+			TablePath: []string{"db1", "schema1", "table1"},
+			Results: []SampleResult{
+				{
+					"age":             "52",
+					"social_sec_num":  "512-23-4258",
+					"credit_card_num": "4111111111111111",
+				},
+				{
+					"age":             "101",
+					"social_sec_num":  "foobarbaz",
+					"credit_card_num": "4111111111111111",
+				},
+			},
+		},
+		{
+			TablePath: []string{"db2", "schema2", "table2"},
+			Results: []SampleResult{
+				{
+					"fullname": "John Doe",
+					"dob":      "2000-01-01",
+					"random":   "foobarbaz",
+				},
+			},
+		},
+	}
+
+	classifier := NewMockClassifier(t)
+	// Need to explicitly convert it to a map because Mockery isn't smart enough
+	// to infer the type.
+	classifier.EXPECT().Classify(ctx, map[string]any(samples[0].Results[0])).Return(
+		classification.Result{
+			"age":             lblSet("AGE"),
+			"social_sec_num":  lblSet("SSN"),
+			"credit_card_num": lblSet("CCN"),
+		},
+		nil,
+	)
+	classifier.EXPECT().Classify(ctx, map[string]any(samples[0].Results[1])).Return(
+		classification.Result{
+			"age":             lblSet("AGE", "CVV"),
+			"credit_card_num": lblSet("CCN"),
+		},
+		nil,
+	)
+	classifier.EXPECT().Classify(ctx, map[string]any(samples[1].Results[0])).Return(
+		classification.Result{
+			"fullname": lblSet("FULL_NAME"),
+			"dob":      lblSet("DOB"),
+		},
+		nil,
+	)
+
+	expected := []scan.Classification{
+		{
+			AttributePath: append(samples[0].TablePath, "age"),
+			Labels:        lblSet("AGE", "CVV"),
+		},
+		{
+			AttributePath: append(samples[0].TablePath, "social_sec_num"),
+			Labels:        lblSet("SSN"),
+		},
+		{
+			AttributePath: append(samples[0].TablePath, "credit_card_num"),
+			Labels:        lblSet("CCN"),
+		},
+		{
+			AttributePath: append(samples[1].TablePath, "fullname"),
+			Labels:        lblSet("FULL_NAME"),
+		},
+		{
+			AttributePath: append(samples[1].TablePath, "dob"),
+			Labels:        lblSet("DOB"),
+		},
+	}
+	actual, err := classifySamples(ctx, samples, classifier)
+	require.NoError(t, err)
+	require.ElementsMatch(t, expected, actual)
+}
+
+func lblSet(labels ...string) classification.LabelSet {
+	set := make(classification.LabelSet)
+	for _, label := range labels {
+		set[label] = struct {
+		}{}
+	}
+	return set
+}
diff --git a/sql/config.go b/sql/config.go
new file mode 100644
index 0000000..a8785b9
--- /dev/null
+++ b/sql/config.go
@@ -0,0 +1,84 @@
+package sql
+
+import (
+	"fmt"
+)
+
+const configConnOpts = "connection-string-args"
+
+// RepoConfig is the necessary configuration to connect to a data sql.
+type RepoConfig struct {
+	// Host is the hostname of the database.
+	Host string
+	// Port is the port of the database.
+	Port uint16
+	// User is the username to connect to the database.
+	User string
+	// Password is the password to connect to the database.
+	Password string
+	// Database is the name of the database to connect to.
+	Database string
+	// MaxOpenConns is the maximum number of open connections to the database.
+	MaxOpenConns uint
+	// Advanced is a map of advanced configuration options.
+	Advanced map[string]any
+}
+
+// FetchAdvancedConfigString fetches a map in the repo advanced configuration,
+// for a given repo and set of parameters. Example:
+//
+// repo-advanced:
+//
+//	snowflake:
+//	  account: exampleAccount
+//	  role: exampleRole
+//	  warehouse: exampleWarehouse
+//
+// Calling FetchAdvancedMapConfig(<the repo config above>, "snowflake",
+// []string{"account", "role", "warehouse"}) returns the map
+//
+// {"account": "exampleAccount", "role": "exampleRole", "warehouse":
+// "exampleWarehouse"}
+//
+// The suffix 'String' means that the values of the map are strings. This gives
+// room to have FetchAdvancedConfigList or FetchAdvancedConfigMap, for example,
+// without name conflicts.
+func FetchAdvancedConfigString(
+	cfg RepoConfig,
+	repo string,
+	parameters []string,
+) (map[string]string, error) {
+	advancedCfg, err := getAdvancedConfig(cfg, repo)
+	if err != nil {
+		return nil, err
+	}
+	repoSpecificMap := make(map[string]string)
+	for _, key := range parameters {
+		var valInterface any
+		var val string
+		var ok bool
+		if valInterface, ok = advancedCfg[key]; !ok {
+			return nil, fmt.Errorf("unable to find '%s' in %s advanced config", key, repo)
+		}
+		if val, ok = valInterface.(string); !ok {
+			return nil, fmt.Errorf("'%s' in %s config must be a string", key, repo)
+		}
+		repoSpecificMap[key] = val
+	}
+	return repoSpecificMap, nil
+}
+
+// getAdvancedConfig gets the Advanced field in a repo config and converts it to
+// a map[string]any. In every step, it checks for error and generates
+// nice messages.
+func getAdvancedConfig(cfg RepoConfig, repo string) (map[string]any, error) {
+	advancedCfgInterface, ok := cfg.Advanced[repo]
+	if !ok {
+		return nil, fmt.Errorf("unable to find '%s' in advanced config", repo)
+	}
+	advancedCfg, ok := advancedCfgInterface.(map[string]any)
+	if !ok {
+		return nil, fmt.Errorf("'%s' in advanced config is not a map", repo)
+	}
+	return advancedCfg, nil
+}
diff --git a/sql/config_test.go b/sql/config_test.go
new file mode 100644
index 0000000..e92a5c8
--- /dev/null
+++ b/sql/config_test.go
@@ -0,0 +1,77 @@
+package sql
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestAdvancedConfigSucc(t *testing.T) {
+	sampleCfg := RepoConfig{
+		Advanced: map[string]any{
+			"snowflake": map[string]any{
+				"account":   "exampleAccount",
+				"role":      "exampleRole",
+				"warehouse": "exampleWarehouse",
+			},
+		},
+	}
+	repoSpecificMap, err := FetchAdvancedConfigString(
+		sampleCfg,
+		"snowflake", []string{"account", "role", "warehouse"},
+	)
+	require.NoError(t, err)
+	require.EqualValues(
+		t, repoSpecificMap, map[string]string{
+			"account":   "exampleAccount",
+			"role":      "exampleRole",
+			"warehouse": "exampleWarehouse",
+		},
+	)
+}
+
+func TestAdvancedConfigMissing(t *testing.T) {
+	// Without the snowflake config at all
+	sampleCfg := RepoConfig{
+		Advanced: map[string]any{},
+	}
+	_, err := FetchAdvancedConfigString(
+		sampleCfg,
+		"snowflake", []string{"account", "role", "warehouse"},
+	)
+	require.Error(t, err)
+
+	sampleCfg = RepoConfig{
+		Advanced: map[string]any{
+			"snowflake": map[string]any{
+				// Missing account
+
+				"role":      "exampleRole",
+				"warehouse": "exampleWarehouse",
+			},
+		},
+	}
+	_, err = FetchAdvancedConfigString(
+		sampleCfg,
+		"snowflake", []string{"account", "role", "warehouse"},
+	)
+	require.Error(t, err)
+}
+
+func TestAdvancedConfigMalformed(t *testing.T) {
+	sampleCfg := RepoConfig{
+		Advanced: map[string]any{
+			"snowflake": map[string]any{
+				// Let's give a _list_ of things
+				"account":   []string{"account1", "account2"},
+				"role":      []string{"role1", "role2"},
+				"warehouse": []string{"warehouse1", "warehouse2"},
+			},
+		},
+	}
+	_, err := FetchAdvancedConfigString(
+		sampleCfg,
+		"snowflake", []string{"account", "role", "warehouse"},
+	)
+	require.Error(t, err)
+}
diff --git a/discovery/denodo.go b/sql/denodo.go
similarity index 65%
rename from discovery/denodo.go
rename to sql/denodo.go
index 2075db5..9e7a730 100644
--- a/discovery/denodo.go
+++ b/sql/denodo.go
@@ -1,4 +1,4 @@
-package discovery
+package sql
 
 import (
 	"context"
@@ -24,19 +24,19 @@ const (
 		"CATALOG_VDP_METADATA_VIEWS()"
 )
 
-// DenodoRepository is a sql.SQLRepository implementation for Denodo.
+// DenodoRepository is a Repository implementation for Denodo.
 type DenodoRepository struct {
-	// The majority of the sql.SQLRepository functionality is delegated to
+	// The majority of the Repository functionality is delegated to
 	// a generic SQL repository instance.
-	genericSqlRepo *GenericRepository
+	generic *GenericRepository
 }
 
-// DenodoRepository implements sql.SQLRepository
-var _ SQLRepository = (*DenodoRepository)(nil)
+// DenodoRepository implements sql.Repository
+var _ Repository = (*DenodoRepository)(nil)
 
 // NewDenodoRepository is the constructor for sql.
 func NewDenodoRepository(cfg RepoConfig) (*DenodoRepository, error) {
-	pgCfg, err := ParsePostgresConfig(cfg)
+	pgCfg, err := parsePostgresConfig(cfg)
 	if err != nil {
 		return nil, fmt.Errorf("unable to parse postgres config: %w", err)
 	}
@@ -52,19 +52,11 @@ func NewDenodoRepository(cfg RepoConfig) (*DenodoRepository, error) {
 		cfg.Database,
 		pgCfg.ConnOptsStr,
 	)
-	sqlRepo, err := NewGenericRepository(
-		cfg.Host,
-		RepoTypePostgres,
-		cfg.Database,
-		connStr,
-		cfg.MaxOpenConns,
-		cfg.IncludePaths,
-		cfg.ExcludePaths,
-	)
+	generic, err := NewGenericRepository(RepoTypePostgres, cfg.Database, connStr, cfg.MaxOpenConns)
 	if err != nil {
 		return nil, fmt.Errorf("could not instantiate generic sql repository: %w", err)
 	}
-	return &DenodoRepository{genericSqlRepo: sqlRepo}, nil
+	return &DenodoRepository{generic: generic}, nil
 }
 
 // ListDatabases is left unimplemented for Denodo, because Denodo doesn't have
@@ -74,41 +66,40 @@ func (r *DenodoRepository) ListDatabases(_ context.Context) ([]string, error) {
 }
 
 // Introspect delegates introspection to GenericRepository. See
-// SQLRepository.Introspect and GenericRepository.IntrospectWithQuery for more
+// Repository.Introspect and GenericRepository.IntrospectWithQuery for more
 // details.
-func (r *DenodoRepository) Introspect(ctx context.Context) (*Metadata, error) {
-	return r.genericSqlRepo.IntrospectWithQuery(ctx, DenodoIntrospectQuery)
+func (r *DenodoRepository) Introspect(ctx context.Context, params IntrospectParameters) (*Metadata, error) {
+	return r.generic.IntrospectWithQuery(ctx, DenodoIntrospectQuery, params)
 }
 
 // SampleTable delegates sampling to GenericRepository, using a Denodo-specific
-// table sample query. See SQLRepository.SampleTable and
+// table sample query. See Repository.SampleTable and
 // GenericRepository.SampleTableWithQuery for more details.
 func (r *DenodoRepository) SampleTable(
 	ctx context.Context,
-	meta *TableMetadata,
 	params SampleParameters,
 ) (Sample, error) {
 	// Denodo uses double-quotes to quote identifiers
-	attrStr := meta.QuotedAttributeNamesString("\"")
+	attrStr := params.Metadata.QuotedAttributeNamesString("\"")
 	// The postgres driver is currently unable to properly send the
 	// parameters of a prepared statement to Denodo. Therefore, instead of
 	// building a prepared statement, we populate the query string before
 	// sending it to the driver.
 	query := fmt.Sprintf(
 		"SELECT %s FROM %s.%s OFFSET %d ROWS LIMIT %d",
-		attrStr, meta.Schema, meta.Name, params.Offset, params.SampleSize,
+		attrStr, params.Metadata.Schema, params.Metadata.Name, params.Offset, params.SampleSize,
 	)
-	return r.genericSqlRepo.SampleTableWithQuery(ctx, meta, query)
+	return r.generic.SampleTableWithQuery(ctx, query, params)
 }
 
-// Ping delegates the ping to GenericRepository. See SQLRepository.Ping and
+// Ping delegates the ping to GenericRepository. See Repository.Ping and
 // GenericRepository.Ping for more details.
 func (r *DenodoRepository) Ping(ctx context.Context) error {
-	return r.genericSqlRepo.Ping(ctx)
+	return r.generic.Ping(ctx)
 }
 
-// Close delegates the close to GenericRepository. See SQLRepository.Close and
+// Close delegates the close to GenericRepository. See Repository.Close and
 // GenericRepository.Close for more details.
 func (r *DenodoRepository) Close() error {
-	return r.genericSqlRepo.Close()
+	return r.generic.Close()
 }
diff --git a/sql/doc.go b/sql/doc.go
new file mode 100644
index 0000000..e1f8447
--- /dev/null
+++ b/sql/doc.go
@@ -0,0 +1,14 @@
+// Package sql provides mechanisms to perform database introspection and
+// data discovery on various SQL data repositories.
+//
+// Additionally, the Repository interface provides an API for performing
+// database introspection and data discovery on SQL databases. It encapsulates
+// the concept of a Dmap data SQL repository. All out-of-the-box Repository
+// implementations are included in their own files named after the repository
+// type, e.g. mysql.go, postgres.go, etc.
+//
+// Registry provides an API for registering and constructing Repository
+// implementations within an application. There is a global DefaultRegistry
+// which has all-out-of-the-box Repository implementations registered to it
+// by default.
+package sql
diff --git a/sql/gen.go b/sql/gen.go
new file mode 100644
index 0000000..0e44f2f
--- /dev/null
+++ b/sql/gen.go
@@ -0,0 +1,6 @@
+package sql
+
+// Mock generation - see https://vektra.github.io/mockery/
+
+//go:generate mockery --with-expecter --srcpkg=github.com/cyralinc/dmap/classification --name=Classifier --structname=MockClassifier --output=. --outpkg=sql --filename=mock_classifier_test.go
+//go:generate mockery --with-expecter --inpackage --name=Repository --filename=mock_repository_test.go
diff --git a/discovery/generic.go b/sql/generic.go
similarity index 68%
rename from discovery/generic.go
rename to sql/generic.go
index 92db79c..1c870fd 100644
--- a/discovery/generic.go
+++ b/sql/generic.go
@@ -1,4 +1,4 @@
-package discovery
+package sql
 
 import (
 	"context"
@@ -34,27 +34,24 @@ const (
 )
 
 // GenericRepository implements generic SQL functionalities that work for a
-// subset of ANSI SQL compatible databases. Many SQLRepository implementations may
+// subset of ANSI SQL compatible databases. Many Repository implementations may
 // partially or fully delegate to this implementation. In that respect, it acts
 // somewhat as a base implementation which can be used by SQL-compatible
 // repositories. Note that while GenericRepository is an implementation of
-// the SQLRepository interface, GenericRepository is meant to be used as a building
-// block for other SQLRepository implementations, rather than as a standalone
-// implementation. Specifically, the SQLRepository.ListDatabases method is left
+// the Repository interface, GenericRepository is meant to be used as a building
+// block for other Repository implementations, rather than as a standalone
+// implementation. Specifically, the Repository.ListDatabases method is left
 // un-implemented, since there is no standard way to list databases across
 // different SQL database platforms. It does however provide the
 // ListDatabasesWithQuery method, which dependent implementations can use to
 // provide a custom query to list databases.
 type GenericRepository struct {
-	repoName     string
-	repoType     string
-	database     string
-	db           *sql.DB
-	includePaths []glob.Glob
-	excludePaths []glob.Glob
+	repoType string
+	database string
+	db       *sql.DB
 }
 
-var _ SQLRepository = (*GenericRepository)(nil)
+var _ Repository = (*GenericRepository)(nil)
 
 // NewGenericRepository is a constructor for the GenericRepository type. It
 // opens a database handle for a given repoType and returns a pointer to a new
@@ -64,15 +61,7 @@ var _ SQLRepository = (*GenericRepository)(nil)
 // connections to the database. The repoIncludePaths and repoExcludePaths
 // parameters are used to filter the tables and columns that are introspected by
 // the repository.
-func NewGenericRepository(
-	repoName,
-	repoType,
-	database,
-	connStr string,
-	maxOpenConns uint,
-	repoIncludePaths,
-	repoExcludePaths []glob.Glob,
-) (
+func NewGenericRepository(repoType, database, connStr string, maxOpenConns uint) (
 	*GenericRepository,
 	error,
 ) {
@@ -81,20 +70,16 @@ func NewGenericRepository(
 		return nil, fmt.Errorf("error retrieving DB handle for repo type %s: %w", repoType, err)
 	}
 	return &GenericRepository{
-		repoName:     repoName,
-		repoType:     repoType,
-		database:     database,
-		db:           db,
-		includePaths: repoIncludePaths,
-		excludePaths: repoExcludePaths,
+		repoType: repoType,
+		database: database,
+		db:       db,
 	}, nil
 }
 
 // NewGenericRepositoryFromDB instantiate a new GenericRepository based on a
 // given sql.DB handle.
-func NewGenericRepositoryFromDB(repoName, repoType, database string, db *sql.DB) *GenericRepository {
+func NewGenericRepositoryFromDB(repoType, database string, db *sql.DB) *GenericRepository {
 	return &GenericRepository{
-		repoName: repoName,
 		repoType: repoType,
 		database: database,
 		db:       db,
@@ -139,8 +124,11 @@ func (r *GenericRepository) ListDatabasesWithQuery(
 }
 
 // Introspect calls IntrospectWithQuery with a default query string
-func (r *GenericRepository) Introspect(ctx context.Context) (*Metadata, error) {
-	return r.IntrospectWithQuery(ctx, GenericIntrospectQuery)
+func (r *GenericRepository) Introspect(
+	ctx context.Context,
+	params IntrospectParameters,
+) (*Metadata, error) {
+	return r.IntrospectWithQuery(ctx, GenericIntrospectQuery, params)
 }
 
 // IntrospectWithQuery executes a query against the information_schema table in
@@ -156,64 +144,55 @@ func (r *GenericRepository) Introspect(ctx context.Context) (*Metadata, error) {
 func (r *GenericRepository) IntrospectWithQuery(
 	ctx context.Context,
 	query string,
+	params IntrospectParameters,
 ) (*Metadata, error) {
 	log.Tracef("Query: %s", query)
 	rows, err := r.db.QueryContext(ctx, query)
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("error performing introspect query: %w", err)
 	}
 	defer func() { _ = rows.Close() }()
-
-	repoMeta, err := newMetadataFromQueryResult(
-		r.repoType, r.repoName,
-		r.database, r.includePaths, r.excludePaths, rows,
-	)
-	if err != nil {
-		return nil, err
-	}
-	return repoMeta, nil
+	return newMetadataFromQueryResult(r.database, params.IncludePaths, params.ExcludePaths, rows)
 }
 
 // SampleTable samples the table referenced by the TableMetadata meta parameter
 // by issuing a standard, ANSI-compatible SELECT query to the database. All
 // attributes of the table are selected, and are quoted using double quotes. See
-// SQLRepository.SampleTable for more details.
+// Repository.SampleTable for more details.
 func (r *GenericRepository) SampleTable(
 	ctx context.Context,
-	meta *TableMetadata,
 	params SampleParameters,
 ) (Sample, error) {
 	// ANSI SQL uses double-quotes to quote identifiers
-	attrStr := meta.QuotedAttributeNamesString("\"")
-	query := fmt.Sprintf(GenericSampleQueryTemplate, attrStr, meta.Schema, meta.Name)
-	return r.SampleTableWithQuery(ctx, meta, query, params.SampleSize, params.Offset)
+	attrStr := params.Metadata.QuotedAttributeNamesString("\"")
+	query := fmt.Sprintf(GenericSampleQueryTemplate, attrStr, params.Metadata.Schema, params.Metadata.Name)
+	return r.SampleTableWithQuery(ctx, query, params)
 }
 
 // SampleTableWithQuery calls SampleTable with a custom SQL query. Any
 // placeholder parameters in the query should be passed via params.
 func (r *GenericRepository) SampleTableWithQuery(
 	ctx context.Context,
-	meta *TableMetadata,
 	query string,
-	params ...any,
+	params SampleParameters,
 ) (Sample, error) {
 	log.Tracef("Query: %s", query)
-	rows, err := r.db.QueryContext(ctx, query, params...)
+	rows, err := r.db.QueryContext(ctx, query, params.SampleSize, params.Offset)
 	if err != nil {
 		return Sample{},
-			fmt.Errorf("error sampling %s.%s.%s: %w", r.database, meta.Schema, meta.Name, err)
+			fmt.Errorf(
+				"error sampling database %s, schema %s, table %s: %w",
+				r.database,
+				params.Metadata.Schema,
+				params.Metadata.Name,
+				err,
+			)
 	}
 	defer func() { _ = rows.Close() }()
-
 	sample := Sample{
-		Metadata: SampleMetadata{
-			Repo:     r.repoName,
-			Database: r.database,
-			Schema:   meta.Schema,
-			Table:    meta.Name,
-		},
+		TablePath: []string{r.database, params.Metadata.Schema, params.Metadata.Name},
 	}
-
+	// Iterate the row set and append each row to the sample results.
 	for rows.Next() {
 		data, err := getCurrentRowAsMap(rows)
 		if err != nil {
@@ -221,13 +200,13 @@ func (r *GenericRepository) SampleTableWithQuery(
 		}
 		sample.Results = append(sample.Results, data)
 	}
-
-	// Something broke while iterating the row set
-	err = rows.Err()
-	if err != nil {
+	if err := rows.Err(); err != nil {
+		// Something broke while iterating the row set.
 		return Sample{}, fmt.Errorf("error iterating sample data row set: %w", err)
 	}
-
+	if len(sample.Results) == 0 {
+		return Sample{}, nil
+	}
 	return sample, nil
 }
 
@@ -265,61 +244,6 @@ func newDbHandle(repoType, connStr string, maxOpenConns uint) (*sql.DB, error) {
 	return db, nil
 }
 
-// newMetadataFromQueryResult builds the repository metadata from the results
-// of a query to the INFORMATION_SCHEMA columns view.
-func newMetadataFromQueryResult(
-	repoType, repoName, db string,
-	includePaths, excludePaths []glob.Glob, rows *sql.Rows,
-) (
-	*Metadata,
-	error,
-) {
-	repo := NewMetadata(repoType, repoName, db)
-
-	for rows.Next() {
-		var attr AttributeMetadata
-		err := rows.Scan(&attr.Schema, &attr.Table, &attr.Name, &attr.DataType)
-		if err != nil {
-			return nil, err
-		}
-
-		// skip tables that match excludePaths or does not match includePaths
-		log.Tracef("checking if %s.%s.%s matches excludePaths %s\n", db, attr.Schema, attr.Table, excludePaths)
-		if matchPathPatterns(db, attr.Schema, attr.Table, excludePaths) {
-			continue
-		}
-		log.Tracef("checking if %s.%s.%s matches includePaths: %s\n", db, attr.Schema, attr.Table, includePaths)
-		if !matchPathPatterns(db, attr.Schema, attr.Table, includePaths) {
-			continue
-		}
-
-		// SchemaMetadata exists - add a table if necessary
-		if schema, ok := repo.Schemas[attr.Schema]; ok {
-			// TableMetadata exists - just append the attribute
-			if table, ok := schema.Tables[attr.Table]; ok {
-				table.Attributes = append(table.Attributes, &attr)
-			} else { // First time seeing this table
-				table := NewTableMetadata(attr.Schema, attr.Table)
-				table.Attributes = append(table.Attributes, &attr)
-				schema.Tables[attr.Table] = table
-			}
-		} else { // SchemaMetadata doesn't exist - create it
-			table := NewTableMetadata(attr.Schema, attr.Table)
-			table.Attributes = append(table.Attributes, &attr)
-			schema := NewSchemaMetadata(attr.Schema)
-			schema.Tables[attr.Table] = table
-			repo.Schemas[attr.Schema] = schema
-		}
-	}
-
-	// Something broke while iterating the row set
-	if err := rows.Err(); err != nil {
-		return nil, err
-	}
-
-	return repo, nil
-}
-
 // getCurrentRowAsMap transforms the current row referenced by a sql.Rows row
 // set into a map where the key is the column name and the value is the column
 // value. It is effectively an alternative to the sql.Rows.Scan method, where it
diff --git a/discovery/generic_test.go b/sql/generic_test.go
similarity index 84%
rename from discovery/generic_test.go
rename to sql/generic_test.go
index ac13df5..86bab72 100644
--- a/discovery/generic_test.go
+++ b/sql/generic_test.go
@@ -1,4 +1,4 @@
-package discovery
+package sql
 
 import (
 	"context"
@@ -7,7 +7,6 @@ import (
 
 	"github.com/DATA-DOG/go-sqlmock"
 	"github.com/gobwas/glob"
-	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
@@ -16,16 +15,13 @@ func Test_Introspect_IsSuccessful(t *testing.T) {
 	require.NoError(t, err)
 	defer func() { _ = db.Close() }()
 
-	repoName := "testRepo"
 	repoType := "genericSql"
 	database := "exampleDb"
 
 	repo := GenericRepository{
-		repoName:     repoName,
-		repoType:     repoType,
-		database:     database,
-		db:           db,
-		includePaths: []glob.Glob{glob.MustCompile("exampleDb.*")},
+		repoType: repoType,
+		database: database,
+		db:       db,
 	}
 
 	cols := []string{
@@ -46,11 +42,12 @@ func Test_Introspect_IsSuccessful(t *testing.T) {
 
 	ctx := context.Background()
 
-	meta, err := repo.Introspect(ctx)
+	params := IntrospectParameters{
+		IncludePaths: []glob.Glob{glob.MustCompile("exampleDb.*")},
+	}
+	meta, err := repo.Introspect(ctx, params)
 
 	expectedMetadata := Metadata{
-		Name:     repoName,
-		RepoType: repoType,
 		Database: database,
 		Schemas: map[string]*SchemaMetadata{
 			"schema1": {
@@ -108,8 +105,8 @@ func Test_Introspect_IsSuccessful(t *testing.T) {
 		},
 	}
 
-	assert.NoError(t, err)
-	assert.EqualValues(t, &expectedMetadata, meta)
+	require.NoError(t, err)
+	require.EqualValues(t, &expectedMetadata, meta)
 }
 
 func Test_Introspect_QueryError(t *testing.T) {
@@ -117,12 +114,10 @@ func Test_Introspect_QueryError(t *testing.T) {
 	require.NoError(t, err)
 	defer func() { _ = db.Close() }()
 
-	repoName := "testRepo"
 	repoType := "genericSql"
 	database := "exampleDb"
 
 	repo := GenericRepository{
-		repoName: repoName,
 		repoType: repoType,
 		database: database,
 		db:       db,
@@ -135,10 +130,10 @@ func Test_Introspect_QueryError(t *testing.T) {
 
 	ctx := context.Background()
 
-	meta, err := repo.Introspect(ctx)
+	meta, err := repo.Introspect(ctx, IntrospectParameters{})
 
-	assert.Nil(t, meta)
-	assert.EqualError(t, err, expectedErr.Error())
+	require.Nil(t, meta)
+	require.ErrorIs(t, err, expectedErr)
 }
 
 func Test_Introspect_RowError(t *testing.T) {
@@ -146,12 +141,10 @@ func Test_Introspect_RowError(t *testing.T) {
 	require.NoError(t, err)
 	defer func() { _ = db.Close() }()
 
-	repoName := "testRepo"
 	repoType := "genericSql"
 	database := "exampleDb"
 
 	repo := GenericRepository{
-		repoName: repoName,
 		repoType: repoType,
 		database: database,
 		db:       db,
@@ -168,17 +161,17 @@ func Test_Introspect_RowError(t *testing.T) {
 
 	rows := sqlmock.NewRows(cols).
 		AddRow("schema1", "table1", "column1", "varchar").
-		RowError(0, errors.New("dummy error"))
+		RowError(0, expectedErr)
 
 	mock.ExpectQuery("SELECT (.+) FROM information_schema.columns WHERE (.+)").
 		WillReturnRows(rows)
 
 	ctx := context.Background()
 
-	meta, err := repo.Introspect(ctx)
+	meta, err := repo.Introspect(ctx, IntrospectParameters{})
 
-	assert.Nil(t, meta)
-	assert.EqualError(t, err, expectedErr.Error())
+	require.Nil(t, meta)
+	require.ErrorIs(t, err, expectedErr)
 }
 
 func Test_Introspect_Filtered(t *testing.T) {
@@ -186,22 +179,13 @@ func Test_Introspect_Filtered(t *testing.T) {
 	require.NoError(t, err)
 	defer func() { _ = db.Close() }()
 
-	repoName := "testRepo"
 	repoType := "genericSql"
 	database := "exampleDb"
 
 	repo := GenericRepository{
-		repoName: repoName,
 		repoType: repoType,
 		database: database,
 		db:       db,
-		includePaths: []glob.Glob{
-			glob.MustCompile("exampleDb.schema1.*"),
-			glob.MustCompile("exampleDb.*.table1"),
-		},
-		excludePaths: []glob.Glob{
-			glob.MustCompile("exampleDb.schema3.*"),
-		},
 	}
 
 	cols := []string{
@@ -226,11 +210,18 @@ func Test_Introspect_Filtered(t *testing.T) {
 
 	ctx := context.Background()
 
-	meta, err := repo.Introspect(ctx)
+	params := IntrospectParameters{
+		IncludePaths: []glob.Glob{
+			glob.MustCompile("exampleDb.schema1.*"),
+			glob.MustCompile("exampleDb.*.table1"),
+		},
+		ExcludePaths: []glob.Glob{
+			glob.MustCompile("exampleDb.schema3.*"),
+		},
+	}
+	meta, err := repo.Introspect(ctx, params)
 
 	expectedMetadata := Metadata{
-		Name:     repoName,
-		RepoType: repoType,
 		Database: database,
 		Schemas: map[string]*SchemaMetadata{
 			"schema1": {
@@ -294,6 +285,6 @@ func Test_Introspect_Filtered(t *testing.T) {
 		},
 	}
 
-	assert.NoError(t, err)
-	assert.EqualValues(t, &expectedMetadata, meta)
+	require.NoError(t, err)
+	require.EqualValues(t, &expectedMetadata, meta)
 }
diff --git a/discovery/metadata.go b/sql/metadata.go
similarity index 58%
rename from discovery/metadata.go
rename to sql/metadata.go
index ca71935..622e8ef 100644
--- a/discovery/metadata.go
+++ b/sql/metadata.go
@@ -1,7 +1,12 @@
-package discovery
+package sql
 
 import (
+	"database/sql"
+	"fmt"
 	"strings"
+
+	"github.com/gobwas/glob"
+	log "github.com/sirupsen/logrus"
 )
 
 // Metadata represents the structure of a SQL database. The traditional
@@ -10,7 +15,6 @@ import (
 // those cases, the 'Database' field is expected to be an empty string. See:
 // https://stackoverflow.com/a/17943883
 type Metadata struct {
-	Name     string
 	RepoType string
 	Database string
 	Schemas  map[string]*SchemaMetadata
@@ -60,15 +64,66 @@ type AttributeMetadata struct {
 
 // NewMetadata creates a new Metadata object with the given repository type,
 // repository name, and database name, with an empty map of schemas.
-func NewMetadata(repoType, repoName, database string) *Metadata {
+func NewMetadata(database string) *Metadata {
 	return &Metadata{
-		Name:     repoName,
-		RepoType: repoType,
 		Database: database,
 		Schemas:  make(map[string]*SchemaMetadata),
 	}
 }
 
+// newMetadataFromQueryResult builds the repository metadata from the results
+// of a query to the INFORMATION_SCHEMA columns view.
+func newMetadataFromQueryResult(
+	db string,
+	includePaths, excludePaths []glob.Glob,
+	rows *sql.Rows,
+) (
+	*Metadata,
+	error,
+) {
+	repo := NewMetadata(db)
+	for rows.Next() {
+		var attr AttributeMetadata
+		if err := rows.Scan(&attr.Schema, &attr.Table, &attr.Name, &attr.DataType); err != nil {
+			return nil, fmt.Errorf("error scanning metadata query result row: %w", err)
+		}
+
+		// Skip tables that match excludePaths or does not match includePaths.
+		log.Tracef("checking if %s.%s.%s matches excludePaths %s\n", db, attr.Schema, attr.Table, excludePaths)
+		if matchPathPatterns(db, attr.Schema, attr.Table, excludePaths) {
+			continue
+		}
+		log.Tracef("checking if %s.%s.%s matches includePaths: %s\n", db, attr.Schema, attr.Table, includePaths)
+		if !matchPathPatterns(db, attr.Schema, attr.Table, includePaths) {
+			continue
+		}
+
+		// SchemaMetadata exists - add a table if necessary.
+		if schema, ok := repo.Schemas[attr.Schema]; ok {
+			// TableMetadata exists - just append the attribute.
+			if table, ok := schema.Tables[attr.Table]; ok {
+				table.Attributes = append(table.Attributes, &attr)
+			} else { // First time seeing this table.
+				table := NewTableMetadata(attr.Schema, attr.Table)
+				table.Attributes = append(table.Attributes, &attr)
+				schema.Tables[attr.Table] = table
+			}
+		} else { // SchemaMetadata doesn't exist - create it.
+			table := NewTableMetadata(attr.Schema, attr.Table)
+			table.Attributes = append(table.Attributes, &attr)
+			schema := NewSchemaMetadata(attr.Schema)
+			schema.Tables[attr.Table] = table
+			repo.Schemas[attr.Schema] = schema
+		}
+	}
+
+	// Something broke while iterating the row set.
+	if err := rows.Err(); err != nil {
+		return nil, fmt.Errorf("error iterating metadata query rows: %w", err)
+	}
+	return repo, nil
+}
+
 // NewSchemaMetadata creates a new SchemaMetadata object with the given schema
 // name and an empty map of tables.
 func NewSchemaMetadata(schemaName string) *SchemaMetadata {
diff --git a/discovery/metadata_test.go b/sql/metadata_test.go
similarity index 88%
rename from discovery/metadata_test.go
rename to sql/metadata_test.go
index c787e03..fbd5d12 100644
--- a/discovery/metadata_test.go
+++ b/sql/metadata_test.go
@@ -1,9 +1,9 @@
-package discovery
+package sql
 
 import (
 	"testing"
 
-	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 func TestAttributeNames(t *testing.T) {
@@ -34,7 +34,7 @@ func TestAttributeNames(t *testing.T) {
 
 	names := []string{"name1", "name2", "name3"}
 
-	assert.ElementsMatch(t, table.AttributeNames(), names)
+	require.ElementsMatch(t, table.AttributeNames(), names)
 }
 
 func TestQuotedAttributeNamesString(t *testing.T) {
@@ -67,5 +67,5 @@ func TestQuotedAttributeNamesString(t *testing.T) {
 	expected := "`name1`,`name2`,`name3`"
 	namesStr := table.QuotedAttributeNamesString(quoteChar)
 
-	assert.Equal(t, expected, namesStr)
+	require.Equal(t, expected, namesStr)
 }
diff --git a/scan/mocks/mock_classifier.go b/sql/mock_classifier_test.go
similarity index 50%
rename from scan/mocks/mock_classifier.go
rename to sql/mock_classifier_test.go
index 7738d64..da3f625 100644
--- a/scan/mocks/mock_classifier.go
+++ b/sql/mock_classifier_test.go
@@ -1,6 +1,6 @@
 // Code generated by mockery v2.42.1. DO NOT EDIT.
 
-package mocks
+package sql
 
 import (
 	context "context"
@@ -10,21 +10,21 @@ import (
 	mock "github.com/stretchr/testify/mock"
 )
 
-// Classifier is an autogenerated mock type for the Classifier type
-type Classifier struct {
+// MockClassifier is an autogenerated mock type for the Classifier type
+type MockClassifier struct {
 	mock.Mock
 }
 
-type Classifier_Expecter struct {
+type MockClassifier_Expecter struct {
 	mock *mock.Mock
 }
 
-func (_m *Classifier) EXPECT() *Classifier_Expecter {
-	return &Classifier_Expecter{mock: &_m.Mock}
+func (_m *MockClassifier) EXPECT() *MockClassifier_Expecter {
+	return &MockClassifier_Expecter{mock: &_m.Mock}
 }
 
 // Classify provides a mock function with given fields: ctx, input
-func (_m *Classifier) Classify(ctx context.Context, input map[string]interface{}) (classification.Result, error) {
+func (_m *MockClassifier) Classify(ctx context.Context, input map[string]interface{}) (classification.Result, error) {
 	ret := _m.Called(ctx, input)
 
 	if len(ret) == 0 {
@@ -53,42 +53,42 @@ func (_m *Classifier) Classify(ctx context.Context, input map[string]interface{}
 	return r0, r1
 }
 
-// Classifier_Classify_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Classify'
-type Classifier_Classify_Call struct {
+// MockClassifier_Classify_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Classify'
+type MockClassifier_Classify_Call struct {
 	*mock.Call
 }
 
 // Classify is a helper method to define mock.On call
 //   - ctx context.Context
 //   - input map[string]interface{}
-func (_e *Classifier_Expecter) Classify(ctx interface{}, input interface{}) *Classifier_Classify_Call {
-	return &Classifier_Classify_Call{Call: _e.mock.On("Classify", ctx, input)}
+func (_e *MockClassifier_Expecter) Classify(ctx interface{}, input interface{}) *MockClassifier_Classify_Call {
+	return &MockClassifier_Classify_Call{Call: _e.mock.On("Classify", ctx, input)}
 }
 
-func (_c *Classifier_Classify_Call) Run(run func(ctx context.Context, input map[string]interface{})) *Classifier_Classify_Call {
+func (_c *MockClassifier_Classify_Call) Run(run func(ctx context.Context, input map[string]interface{})) *MockClassifier_Classify_Call {
 	_c.Call.Run(func(args mock.Arguments) {
 		run(args[0].(context.Context), args[1].(map[string]interface{}))
 	})
 	return _c
 }
 
-func (_c *Classifier_Classify_Call) Return(_a0 classification.Result, _a1 error) *Classifier_Classify_Call {
+func (_c *MockClassifier_Classify_Call) Return(_a0 classification.Result, _a1 error) *MockClassifier_Classify_Call {
 	_c.Call.Return(_a0, _a1)
 	return _c
 }
 
-func (_c *Classifier_Classify_Call) RunAndReturn(run func(context.Context, map[string]interface{}) (classification.Result, error)) *Classifier_Classify_Call {
+func (_c *MockClassifier_Classify_Call) RunAndReturn(run func(context.Context, map[string]interface{}) (classification.Result, error)) *MockClassifier_Classify_Call {
 	_c.Call.Return(run)
 	return _c
 }
 
-// NewClassifier creates a new instance of Classifier. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
+// NewMockClassifier creates a new instance of MockClassifier. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
 // The first argument is typically a *testing.T value.
-func NewClassifier(t interface {
+func NewMockClassifier(t interface {
 	mock.TestingT
 	Cleanup(func())
-}) *Classifier {
-	mock := &Classifier{}
+}) *MockClassifier {
+	mock := &MockClassifier{}
 	mock.Mock.Test(t)
 
 	t.Cleanup(func() { mock.AssertExpectations(t) })
diff --git a/discovery/mock_repository_test.go b/sql/mock_repository_test.go
similarity index 67%
rename from discovery/mock_repository_test.go
rename to sql/mock_repository_test.go
index 492bcb9..13ff093 100644
--- a/discovery/mock_repository_test.go
+++ b/sql/mock_repository_test.go
@@ -1,6 +1,6 @@
 // Code generated by mockery v2.42.1. DO NOT EDIT.
 
-package discovery
+package sql
 
 import (
 	context "context"
@@ -8,7 +8,7 @@ import (
 	mock "github.com/stretchr/testify/mock"
 )
 
-// MockRepository is an autogenerated mock type for the SQLRepository type
+// MockRepository is an autogenerated mock type for the Repository type
 type MockRepository struct {
 	mock.Mock
 }
@@ -50,11 +50,9 @@ func (_e *MockRepository_Expecter) Close() *MockRepository_Close_Call {
 }
 
 func (_c *MockRepository_Close_Call) Run(run func()) *MockRepository_Close_Call {
-	_c.Call.Run(
-		func(args mock.Arguments) {
-			run()
-		},
-	)
+	_c.Call.Run(func(args mock.Arguments) {
+		run()
+	})
 	return _c
 }
 
@@ -68,9 +66,9 @@ func (_c *MockRepository_Close_Call) RunAndReturn(run func() error) *MockReposit
 	return _c
 }
 
-// Introspect provides a mock function with given fields: ctx
-func (_m *MockRepository) Introspect(ctx context.Context) (*Metadata, error) {
-	ret := _m.Called(ctx)
+// Introspect provides a mock function with given fields: ctx, params
+func (_m *MockRepository) Introspect(ctx context.Context, params IntrospectParameters) (*Metadata, error) {
+	ret := _m.Called(ctx, params)
 
 	if len(ret) == 0 {
 		panic("no return value specified for Introspect")
@@ -78,19 +76,19 @@ func (_m *MockRepository) Introspect(ctx context.Context) (*Metadata, error) {
 
 	var r0 *Metadata
 	var r1 error
-	if rf, ok := ret.Get(0).(func(context.Context) (*Metadata, error)); ok {
-		return rf(ctx)
+	if rf, ok := ret.Get(0).(func(context.Context, IntrospectParameters) (*Metadata, error)); ok {
+		return rf(ctx, params)
 	}
-	if rf, ok := ret.Get(0).(func(context.Context) *Metadata); ok {
-		r0 = rf(ctx)
+	if rf, ok := ret.Get(0).(func(context.Context, IntrospectParameters) *Metadata); ok {
+		r0 = rf(ctx, params)
 	} else {
 		if ret.Get(0) != nil {
 			r0 = ret.Get(0).(*Metadata)
 		}
 	}
 
-	if rf, ok := ret.Get(1).(func(context.Context) error); ok {
-		r1 = rf(ctx)
+	if rf, ok := ret.Get(1).(func(context.Context, IntrospectParameters) error); ok {
+		r1 = rf(ctx, params)
 	} else {
 		r1 = ret.Error(1)
 	}
@@ -105,16 +103,15 @@ type MockRepository_Introspect_Call struct {
 
 // Introspect is a helper method to define mock.On call
 //   - ctx context.Context
-func (_e *MockRepository_Expecter) Introspect(ctx interface{}) *MockRepository_Introspect_Call {
-	return &MockRepository_Introspect_Call{Call: _e.mock.On("Introspect", ctx)}
+//   - params IntrospectParameters
+func (_e *MockRepository_Expecter) Introspect(ctx interface{}, params interface{}) *MockRepository_Introspect_Call {
+	return &MockRepository_Introspect_Call{Call: _e.mock.On("Introspect", ctx, params)}
 }
 
-func (_c *MockRepository_Introspect_Call) Run(run func(ctx context.Context)) *MockRepository_Introspect_Call {
-	_c.Call.Run(
-		func(args mock.Arguments) {
-			run(args[0].(context.Context))
-		},
-	)
+func (_c *MockRepository_Introspect_Call) Run(run func(ctx context.Context, params IntrospectParameters)) *MockRepository_Introspect_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run(args[0].(context.Context), args[1].(IntrospectParameters))
+	})
 	return _c
 }
 
@@ -123,12 +120,7 @@ func (_c *MockRepository_Introspect_Call) Return(_a0 *Metadata, _a1 error) *Mock
 	return _c
 }
 
-func (_c *MockRepository_Introspect_Call) RunAndReturn(
-	run func(context.Context) (
-		*Metadata,
-		error,
-	),
-) *MockRepository_Introspect_Call {
+func (_c *MockRepository_Introspect_Call) RunAndReturn(run func(context.Context, IntrospectParameters) (*Metadata, error)) *MockRepository_Introspect_Call {
 	_c.Call.Return(run)
 	return _c
 }
@@ -175,11 +167,9 @@ func (_e *MockRepository_Expecter) ListDatabases(ctx interface{}) *MockRepositor
 }
 
 func (_c *MockRepository_ListDatabases_Call) Run(run func(ctx context.Context)) *MockRepository_ListDatabases_Call {
-	_c.Call.Run(
-		func(args mock.Arguments) {
-			run(args[0].(context.Context))
-		},
-	)
+	_c.Call.Run(func(args mock.Arguments) {
+		run(args[0].(context.Context))
+	})
 	return _c
 }
 
@@ -188,12 +178,7 @@ func (_c *MockRepository_ListDatabases_Call) Return(_a0 []string, _a1 error) *Mo
 	return _c
 }
 
-func (_c *MockRepository_ListDatabases_Call) RunAndReturn(
-	run func(context.Context) (
-		[]string,
-		error,
-	),
-) *MockRepository_ListDatabases_Call {
+func (_c *MockRepository_ListDatabases_Call) RunAndReturn(run func(context.Context) ([]string, error)) *MockRepository_ListDatabases_Call {
 	_c.Call.Return(run)
 	return _c
 }
@@ -228,11 +213,9 @@ func (_e *MockRepository_Expecter) Ping(ctx interface{}) *MockRepository_Ping_Ca
 }
 
 func (_c *MockRepository_Ping_Call) Run(run func(ctx context.Context)) *MockRepository_Ping_Call {
-	_c.Call.Run(
-		func(args mock.Arguments) {
-			run(args[0].(context.Context))
-		},
-	)
+	_c.Call.Run(func(args mock.Arguments) {
+		run(args[0].(context.Context))
+	})
 	return _c
 }
 
@@ -246,12 +229,9 @@ func (_c *MockRepository_Ping_Call) RunAndReturn(run func(context.Context) error
 	return _c
 }
 
-// SampleTable provides a mock function with given fields: ctx, meta, params
-func (_m *MockRepository) SampleTable(ctx context.Context, meta *TableMetadata, params SampleParameters) (
-	Sample,
-	error,
-) {
-	ret := _m.Called(ctx, meta, params)
+// SampleTable provides a mock function with given fields: ctx, params
+func (_m *MockRepository) SampleTable(ctx context.Context, params SampleParameters) (Sample, error) {
+	ret := _m.Called(ctx, params)
 
 	if len(ret) == 0 {
 		panic("no return value specified for SampleTable")
@@ -259,17 +239,17 @@ func (_m *MockRepository) SampleTable(ctx context.Context, meta *TableMetadata,
 
 	var r0 Sample
 	var r1 error
-	if rf, ok := ret.Get(0).(func(context.Context, *TableMetadata, SampleParameters) (Sample, error)); ok {
-		return rf(ctx, meta, params)
+	if rf, ok := ret.Get(0).(func(context.Context, SampleParameters) (Sample, error)); ok {
+		return rf(ctx, params)
 	}
-	if rf, ok := ret.Get(0).(func(context.Context, *TableMetadata, SampleParameters) Sample); ok {
-		r0 = rf(ctx, meta, params)
+	if rf, ok := ret.Get(0).(func(context.Context, SampleParameters) Sample); ok {
+		r0 = rf(ctx, params)
 	} else {
 		r0 = ret.Get(0).(Sample)
 	}
 
-	if rf, ok := ret.Get(1).(func(context.Context, *TableMetadata, SampleParameters) error); ok {
-		r1 = rf(ctx, meta, params)
+	if rf, ok := ret.Get(1).(func(context.Context, SampleParameters) error); ok {
+		r1 = rf(ctx, params)
 	} else {
 		r1 = ret.Error(1)
 	}
@@ -284,28 +264,15 @@ type MockRepository_SampleTable_Call struct {
 
 // SampleTable is a helper method to define mock.On call
 //   - ctx context.Context
-//   - meta *TableMetadata
 //   - params SampleParameters
-func (_e *MockRepository_Expecter) SampleTable(
-	ctx interface{},
-	meta interface{},
-	params interface{},
-) *MockRepository_SampleTable_Call {
-	return &MockRepository_SampleTable_Call{Call: _e.mock.On("SampleTable", ctx, meta, params)}
-}
-
-func (_c *MockRepository_SampleTable_Call) Run(
-	run func(
-		ctx context.Context,
-		meta *TableMetadata,
-		params SampleParameters,
-	),
-) *MockRepository_SampleTable_Call {
-	_c.Call.Run(
-		func(args mock.Arguments) {
-			run(args[0].(context.Context), args[1].(*TableMetadata), args[2].(SampleParameters))
-		},
-	)
+func (_e *MockRepository_Expecter) SampleTable(ctx interface{}, params interface{}) *MockRepository_SampleTable_Call {
+	return &MockRepository_SampleTable_Call{Call: _e.mock.On("SampleTable", ctx, params)}
+}
+
+func (_c *MockRepository_SampleTable_Call) Run(run func(ctx context.Context, params SampleParameters)) *MockRepository_SampleTable_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run(args[0].(context.Context), args[1].(SampleParameters))
+	})
 	return _c
 }
 
@@ -314,25 +281,17 @@ func (_c *MockRepository_SampleTable_Call) Return(_a0 Sample, _a1 error) *MockRe
 	return _c
 }
 
-func (_c *MockRepository_SampleTable_Call) RunAndReturn(
-	run func(
-		context.Context,
-		*TableMetadata,
-		SampleParameters,
-	) (Sample, error),
-) *MockRepository_SampleTable_Call {
+func (_c *MockRepository_SampleTable_Call) RunAndReturn(run func(context.Context, SampleParameters) (Sample, error)) *MockRepository_SampleTable_Call {
 	_c.Call.Return(run)
 	return _c
 }
 
-// NewMockRepository creates a new instance of Mocksql. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
+// NewMockRepository creates a new instance of MockRepository. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
 // The first argument is typically a *testing.T value.
-func NewMockRepository(
-	t interface {
-		mock.TestingT
-		Cleanup(func())
-	},
-) *MockRepository {
+func NewMockRepository(t interface {
+	mock.TestingT
+	Cleanup(func())
+}) *MockRepository {
 	mock := &MockRepository{}
 	mock.Mock.Test(t)
 
diff --git a/discovery/mysql.go b/sql/mysql.go
similarity index 56%
rename from discovery/mysql.go
rename to sql/mysql.go
index 7a7afc8..0973c8b 100644
--- a/discovery/mysql.go
+++ b/sql/mysql.go
@@ -1,4 +1,4 @@
-package discovery
+package sql
 
 import (
 	"context"
@@ -22,15 +22,15 @@ WHERE
 `
 )
 
-// MySqlRepository is a SQLRepository implementation for MySQL databases.
+// MySqlRepository is a Repository implementation for MySQL databases.
 type MySqlRepository struct {
-	// The majority of the SQLRepository functionality is delegated to
-	// a generic SQL repository instance (genericSqlRepo).
-	genericSqlRepo *GenericRepository
+	// The majority of the Repository functionality is delegated to
+	// a generic SQL repository instance.
+	generic *GenericRepository
 }
 
-// MySqlRepository implements SQLRepository
-var _ SQLRepository = (*MySqlRepository)(nil)
+// MySqlRepository implements Repository
+var _ Repository = (*MySqlRepository)(nil)
 
 // NewMySqlRepository creates a new MySQL sql.
 func NewMySqlRepository(cfg RepoConfig) (*MySqlRepository, error) {
@@ -44,59 +44,50 @@ func NewMySqlRepository(cfg RepoConfig) (*MySqlRepository, error) {
 		// https://github.com/go-sql-driver/mysql#dsn-data-source-name
 		cfg.Database,
 	)
-	sqlRepo, err := NewGenericRepository(
-		cfg.Host,
-		RepoTypeMysql,
-		cfg.Database,
-		connStr,
-		cfg.MaxOpenConns,
-		cfg.IncludePaths,
-		cfg.ExcludePaths,
-	)
+	generic, err := NewGenericRepository(RepoTypeMysql, cfg.Database, connStr, cfg.MaxOpenConns)
 	if err != nil {
 		return nil, fmt.Errorf("could not instantiate generic sql repository: %w", err)
 	}
-	return &MySqlRepository{genericSqlRepo: sqlRepo}, nil
+	return &MySqlRepository{generic: generic}, nil
 }
 
 // ListDatabases returns a list of the names of all databases on the server by
 // using a MySQL-specific database query. It delegates the actual work to
 // GenericRepository.ListDatabasesWithQuery - see that method for more details.
 func (r *MySqlRepository) ListDatabases(ctx context.Context) ([]string, error) {
-	return r.genericSqlRepo.ListDatabasesWithQuery(ctx, MySqlDatabaseQuery)
+	return r.generic.ListDatabasesWithQuery(ctx, MySqlDatabaseQuery)
 }
 
 // Introspect delegates introspection to GenericRepository. See
-// SQLRepository.Introspect and GenericRepository.IntrospectWithQuery for more
+// Repository.Introspect and GenericRepository.IntrospectWithQuery for more
 // details.
-func (r *MySqlRepository) Introspect(ctx context.Context) (*Metadata, error) {
-	return r.genericSqlRepo.Introspect(ctx)
+func (r *MySqlRepository) Introspect(ctx context.Context, params IntrospectParameters) (*Metadata, error) {
+	return r.generic.Introspect(ctx, params)
 }
 
 // SampleTable delegates sampling to GenericRepository, using a MySQL-specific
-// table sample query. See SQLRepository.SampleTable and
+// table sample query. See Repository.SampleTable and
 // GenericRepository.SampleTableWithQuery for more details.
 func (r *MySqlRepository) SampleTable(
 	ctx context.Context,
-	meta *TableMetadata,
 	params SampleParameters,
 ) (Sample, error) {
 	// MySQL uses backticks to quote identifiers.
-	attrStr := meta.QuotedAttributeNamesString("`")
+	attrStr := params.Metadata.QuotedAttributeNamesString("`")
 	// The generic select/limit/offset query and ? placeholders work fine with
 	// MySQL.
-	query := fmt.Sprintf(GenericSampleQueryTemplate, attrStr, meta.Schema, meta.Name)
-	return r.genericSqlRepo.SampleTableWithQuery(ctx, meta, query, params.SampleSize, params.Offset)
+	query := fmt.Sprintf(GenericSampleQueryTemplate, attrStr, params.Metadata.Schema, params.Metadata.Name)
+	return r.generic.SampleTableWithQuery(ctx, query, params)
 }
 
-// Ping delegates the ping to GenericRepository. See SQLRepository.Ping and
+// Ping delegates the ping to GenericRepository. See Repository.Ping and
 // GenericRepository.Ping for more details.
 func (r *MySqlRepository) Ping(ctx context.Context) error {
-	return r.genericSqlRepo.Ping(ctx)
+	return r.generic.Ping(ctx)
 }
 
-// Close delegates the close to GenericRepository. See SQLRepository.Close and
+// Close delegates the close to GenericRepository. See Repository.Close and
 // GenericRepository.Close for more details.
 func (r *MySqlRepository) Close() error {
-	return r.genericSqlRepo.Close()
+	return r.generic.Close()
 }
diff --git a/discovery/mysql_test.go b/sql/mysql_test.go
similarity index 87%
rename from discovery/mysql_test.go
rename to sql/mysql_test.go
index 9361a5f..346d05b 100644
--- a/discovery/mysql_test.go
+++ b/sql/mysql_test.go
@@ -1,4 +1,4 @@
-package discovery
+package sql
 
 import (
 	"context"
@@ -24,6 +24,6 @@ func initMySqlRepoTest(t *testing.T) (context.Context, *sql.DB, sqlmock.Sqlmock,
 	db, mock, err := sqlmock.New()
 	require.NoError(t, err)
 	return ctx, db, mock, &MySqlRepository{
-		genericSqlRepo: NewGenericRepositoryFromDB("repoName", RepoTypeMysql, "dbName", db),
+		generic: NewGenericRepositoryFromDB(RepoTypeMysql, "dbName", db),
 	}
 }
diff --git a/discovery/oracle.go b/sql/oracle.go
similarity index 73%
rename from discovery/oracle.go
rename to sql/oracle.go
index a3dfcb1..e4c0394 100644
--- a/discovery/oracle.go
+++ b/sql/oracle.go
@@ -1,4 +1,4 @@
-package discovery
+package sql
 
 import (
 	"context"
@@ -36,15 +36,15 @@ ON
 	configServiceName = "service-name"
 )
 
-// OracleRepository is a SQLRepository implementation for Oracle databases.
+// OracleRepository is a Repository implementation for Oracle databases.
 type OracleRepository struct {
 	// The majority of the OracleRepository functionality is delegated to
-	// a generic SQL repository instance (genericSqlRepo).
-	genericSqlRepo *GenericRepository
+	// a generic SQL repository instance.
+	generic *GenericRepository
 }
 
-// OracleRepository implements SQLRepository
-var _ SQLRepository = (*OracleRepository)(nil)
+// OracleRepository implements Repository
+var _ Repository = (*OracleRepository)(nil)
 
 // NewOracleRepository creates a new Oracle repository.
 func NewOracleRepository(cfg RepoConfig) (*OracleRepository, error) {
@@ -60,19 +60,11 @@ func NewOracleRepository(cfg RepoConfig) (*OracleRepository, error) {
 		cfg.Port,
 		oracleCfg.ServiceName,
 	)
-	sqlRepo, err := NewGenericRepository(
-		cfg.Host,
-		RepoTypeOracle,
-		cfg.Database,
-		connStr,
-		cfg.MaxOpenConns,
-		cfg.IncludePaths,
-		cfg.ExcludePaths,
-	)
+	generic, err := NewGenericRepository(RepoTypeOracle, cfg.Database, connStr, cfg.MaxOpenConns)
 	if err != nil {
 		return nil, fmt.Errorf("could not instantiate generic sql repository: %w", err)
 	}
-	return &OracleRepository{genericSqlRepo: sqlRepo}, nil
+	return &OracleRepository{generic: generic}, nil
 }
 
 // ListDatabases is left unimplemented for Oracle, because Oracle doesn't have
@@ -83,28 +75,27 @@ func (r *OracleRepository) ListDatabases(_ context.Context) ([]string, error) {
 }
 
 // Introspect delegates introspection to GenericRepository, using an
-// Oracle-specific introspection query. See SQLRepository.Introspect and
+// Oracle-specific introspection query. See Repository.Introspect and
 // GenericRepository.IntrospectWithQuery for more details.
-func (r *OracleRepository) Introspect(ctx context.Context) (*Metadata, error) {
-	return r.genericSqlRepo.IntrospectWithQuery(ctx, OracleIntrospectQuery)
+func (r *OracleRepository) Introspect(ctx context.Context, params IntrospectParameters) (*Metadata, error) {
+	return r.generic.IntrospectWithQuery(ctx, OracleIntrospectQuery, params)
 }
 
 // SampleTable delegates sampling to GenericRepository, using an Oracle-specific
-// table sample query. See SQLRepository.SampleTable and
+// table sample query. See Repository.SampleTable and
 // GenericRepository.SampleTableWithQuery for more details.
 func (r *OracleRepository) SampleTable(
 	ctx context.Context,
-	meta *TableMetadata,
 	params SampleParameters,
 ) (Sample, error) {
 	// Oracle uses double-quotes to quote identifiers.
-	attrStr := meta.QuotedAttributeNamesString("\"")
+	attrStr := params.Metadata.QuotedAttributeNamesString("\"")
 	// Oracle uses :x for placeholders.
 	query := fmt.Sprintf(
 		"SELECT %s FROM %s.%s OFFSET :1 ROWS FETCH NEXT :2 ROWS ONLY",
-		attrStr, meta.Schema, meta.Name,
+		attrStr, params.Metadata.Schema, params.Metadata.Name,
 	)
-	return r.genericSqlRepo.SampleTableWithQuery(ctx, meta, query, params.Offset, params.SampleSize)
+	return r.generic.SampleTableWithQuery(ctx, query, params)
 }
 
 // Ping verifies the connection to Oracle database used by this Oracle
@@ -113,13 +104,13 @@ func (r *OracleRepository) SampleTable(
 // Oracle being Oracle does not like this. Instead, we defer to the native
 // Ping method implemented by the Oracle DB driver.
 func (r *OracleRepository) Ping(ctx context.Context) error {
-	return r.genericSqlRepo.GetDb().PingContext(ctx)
+	return r.generic.GetDb().PingContext(ctx)
 }
 
-// Close delegates the close to GenericRepository. See SQLRepository.Close and
+// Close delegates the close to GenericRepository. See Repository.Close and
 // GenericRepository.Close for more details.
 func (r *OracleRepository) Close() error {
-	return r.genericSqlRepo.Close()
+	return r.generic.Close()
 }
 
 // OracleConfig is a struct to hold Oracle-specific configuration.
diff --git a/sql/postgres.go b/sql/postgres.go
new file mode 100644
index 0000000..e5a81ee
--- /dev/null
+++ b/sql/postgres.go
@@ -0,0 +1,191 @@
+package sql
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	// Postgresql DB driver
+	_ "github.com/lib/pq"
+)
+
+const (
+	RepoTypePostgres = "postgres"
+
+	PostgresDatabaseQuery = `
+SELECT 
+	datname 
+FROM
+	pg_database
+WHERE
+	datistemplate = false
+	AND datallowconn = true
+	AND datname <> 'rdsadmin'
+`
+)
+
+// PostgresRepository is a Repository implementation for Postgres databases.
+type PostgresRepository struct {
+	// The majority of the Repository functionality is delegated to
+	// a generic SQL repository instance.
+	generic *GenericRepository
+}
+
+// PostgresRepository implements Repository
+var _ Repository = (*PostgresRepository)(nil)
+
+// NewPostgresRepository creates a new PostgresRepository.
+func NewPostgresRepository(cfg RepoConfig) (*PostgresRepository, error) {
+	pgCfg, err := parsePostgresConfig(cfg)
+	if err != nil {
+		return nil, fmt.Errorf("error parsing postgres config: %w", err)
+	}
+	database := cfg.Database
+	// Connect to the default database, if unspecified.
+	if database == "" {
+		database = "postgres"
+	}
+	connStr := fmt.Sprintf(
+		"postgresql://%s:%s@%s:%d/%s%s",
+		cfg.User,
+		cfg.Password,
+		cfg.Host,
+		cfg.Port,
+		database,
+		pgCfg.ConnOptsStr,
+	)
+	generic, err := NewGenericRepository(RepoTypePostgres, cfg.Database, connStr, cfg.MaxOpenConns)
+	if err != nil {
+		return nil, fmt.Errorf("could not instantiate generic sql repository: %w", err)
+	}
+	return &PostgresRepository{generic: generic}, nil
+}
+
+// ListDatabases returns a list of the names of all databases on the server by
+// using a Postgres-specific database query. It delegates the actual work to
+// GenericRepository.ListDatabasesWithQuery - see that method for more details.
+func (r *PostgresRepository) ListDatabases(ctx context.Context) ([]string, error) {
+	return r.generic.ListDatabasesWithQuery(ctx, PostgresDatabaseQuery)
+}
+
+// Introspect delegates introspection to GenericRepository. See
+// Repository.Introspect and GenericRepository.IntrospectWithQuery for more
+// details.
+func (r *PostgresRepository) Introspect(ctx context.Context, params IntrospectParameters) (*Metadata, error) {
+	return r.generic.Introspect(ctx, params)
+}
+
+// SampleTable delegates sampling to GenericRepository, using a
+// Postgres-specific table sample query. See Repository.SampleTable and
+// GenericRepository.SampleTableWithQuery for more details.
+func (r *PostgresRepository) SampleTable(
+	ctx context.Context,
+	params SampleParameters,
+) (Sample, error) {
+	// Postgres uses double-quotes to quote identifiers
+	attrStr := params.Metadata.QuotedAttributeNamesString("\"")
+	// Postgres uses $x for placeholders
+	query := fmt.Sprintf(
+		"SELECT %s FROM %s.%s LIMIT $1 OFFSET $2",
+		attrStr,
+		params.Metadata.Schema,
+		params.Metadata.Name,
+	)
+	return r.generic.SampleTableWithQuery(ctx, query, params)
+}
+
+// Ping delegates the ping to GenericRepository. See Repository.Ping and
+// GenericRepository.Ping for more details.
+func (r *PostgresRepository) Ping(ctx context.Context) error {
+	return r.generic.Ping(ctx)
+}
+
+// Close delegates the close to GenericRepository. See Repository.Close and
+// GenericRepository.Close for more details.
+func (r *PostgresRepository) Close() error {
+	return r.generic.Close()
+}
+
+// PostgresConfig contains Postgres-specific configuration parameters.
+type PostgresConfig struct {
+	// ConnOptsStr is a string containing Postgres-specific connection options.
+	ConnOptsStr string
+}
+
+// parsePostgresConfig parses the Postgres-specific configuration parameters
+// from the given  The Postgres connection options are built from the
+// config and stored in the ConnOptsStr field of the returned Postgres
+func parsePostgresConfig(cfg RepoConfig) (*PostgresConfig, error) {
+	connOptsStr, err := buildConnOptsStr(cfg)
+	if err != nil {
+		return nil, fmt.Errorf("error building connection options string: %w", err)
+	}
+	return &PostgresConfig{ConnOptsStr: connOptsStr}, nil
+}
+
+// buildConnOptsStr parses the repo config to produce a string in the format
+// "?option=value&option2=value2". Example:
+//
+//	buildConnOptsStr(RepoConfig{
+//	    Advanced: map[string]any{
+//	        "connection-string-args": []any{"sslmode=disable"},
+//	    },
+//	})
+//
+// returns ("?sslmode=disable", nil).
+func buildConnOptsStr(cfg RepoConfig) (string, error) {
+	connOptsMap, err := mapFromConnOpts(cfg)
+	if err != nil {
+		return "", fmt.Errorf("connection options: %w", err)
+	}
+	connOptsStr := ""
+	for key, val := range connOptsMap {
+		// Don't add if the value is empty, since that would make the
+		// string malformed.
+		if val != "" {
+			if connOptsStr == "" {
+				connOptsStr += fmt.Sprintf("%s=%s", key, val)
+			} else {
+				// Need & for subsequent options
+				connOptsStr += fmt.Sprintf("&%s=%s", key, val)
+			}
+		}
+	}
+	// Only add ? if connection string is not empty
+	if connOptsStr != "" {
+		connOptsStr = "?" + connOptsStr
+	}
+	return connOptsStr, nil
+}
+
+// mapFromConnOpts builds a map from the list of connection options given. Each
+// option has the format 'option=value'. An error is returned if the config is
+// malformed.
+func mapFromConnOpts(cfg RepoConfig) (map[string]string, error) {
+	m := make(map[string]string)
+	connOptsInterface, ok := cfg.Advanced[configConnOpts]
+	if !ok {
+		return nil, nil
+	}
+	connOpts, ok := connOptsInterface.([]any)
+	if !ok {
+		return nil, fmt.Errorf("'%s' is not a list", configConnOpts)
+	}
+	for _, optInterface := range connOpts {
+		opt, ok := optInterface.(string)
+		if !ok {
+			return nil, fmt.Errorf("'%v' is not a string", optInterface)
+		}
+		splitOpt := strings.Split(opt, "=")
+		if len(splitOpt) != 2 {
+			return nil, fmt.Errorf(
+				"malformed '%s'. "+
+					"Please follow the format 'option=value'", configConnOpts,
+			)
+		}
+		key := splitOpt[0]
+		val := splitOpt[1]
+		m[key] = val
+	}
+	return m, nil
+}
diff --git a/discovery/config_test.go b/sql/postgres_test.go
similarity index 50%
rename from discovery/config_test.go
rename to sql/postgres_test.go
index c54ea99..84a1974 100644
--- a/discovery/config_test.go
+++ b/sql/postgres_test.go
@@ -1,23 +1,27 @@
-package discovery
+package sql
 
 import (
+	"context"
+	"database/sql"
 	"testing"
 
+	"github.com/DATA-DOG/go-sqlmock"
 	"github.com/stretchr/testify/require"
 )
 
-// Returns a correct repo config
-func getSampleRepoConfig() RepoConfig {
-	return RepoConfig{
-		Advanced: map[string]any{
-			configConnOpts: []any{"sslmode=disable"},
-		},
-	}
+func TestPostgresRepository_ListDatabases(t *testing.T) {
+	ctx, db, mock, r := initPostgresRepoTest(t)
+	defer func() { _ = db.Close() }()
+	dbRows := sqlmock.NewRows([]string{"name"}).AddRow("db1").AddRow("db2")
+	mock.ExpectQuery(PostgresDatabaseQuery).WillReturnRows(dbRows)
+	dbs, err := r.ListDatabases(ctx)
+	require.NoError(t, err)
+	require.ElementsMatch(t, []string{"db1", "db2"}, dbs)
 }
 
 func TestBuildConnOptionsSucc(t *testing.T) {
 	sampleRepoCfg := getSampleRepoConfig()
-	connOptsStr, err := BuildConnOptsStr(sampleRepoCfg)
+	connOptsStr, err := buildConnOptsStr(sampleRepoCfg)
 	require.NoError(t, err)
 	require.Equal(t, connOptsStr, "?sslmode=disable")
 }
@@ -31,7 +35,7 @@ func TestBuildConnOptionsFail(t *testing.T) {
 			},
 		},
 	}
-	connOptsStr, err := BuildConnOptsStr(invalidRepoCfg)
+	connOptsStr, err := buildConnOptsStr(invalidRepoCfg)
 	require.Error(t, err)
 	require.Empty(t, connOptsStr)
 }
@@ -79,72 +83,20 @@ func TestMapConnOptionsMalformedColon(t *testing.T) {
 	require.Error(t, err)
 }
 
-func TestAdvancedConfigSucc(t *testing.T) {
-	sampleCfg := RepoConfig{
-		Advanced: map[string]any{
-			"snowflake": map[string]any{
-				"account":   "exampleAccount",
-				"role":      "exampleRole",
-				"warehouse": "exampleWarehouse",
-			},
-		},
-	}
-	repoSpecificMap, err := FetchAdvancedConfigString(
-		sampleCfg,
-		"snowflake", []string{"account", "role", "warehouse"},
-	)
+func initPostgresRepoTest(t *testing.T) (context.Context, *sql.DB, sqlmock.Sqlmock, *PostgresRepository) {
+	ctx := context.Background()
+	db, mock, err := sqlmock.New()
 	require.NoError(t, err)
-	require.EqualValues(
-		t, repoSpecificMap, map[string]string{
-			"account":   "exampleAccount",
-			"role":      "exampleRole",
-			"warehouse": "exampleWarehouse",
-		},
-	)
-}
-
-func TestAdvancedConfigMissing(t *testing.T) {
-	// Without the snowflake config at all
-	sampleCfg := RepoConfig{
-		Advanced: map[string]any{},
-	}
-	_, err := FetchAdvancedConfigString(
-		sampleCfg,
-		"snowflake", []string{"account", "role", "warehouse"},
-	)
-	require.Error(t, err)
-
-	sampleCfg = RepoConfig{
-		Advanced: map[string]any{
-			"snowflake": map[string]any{
-				// Missing account
-
-				"role":      "exampleRole",
-				"warehouse": "exampleWarehouse",
-			},
-		},
+	return ctx, db, mock, &PostgresRepository{
+		generic: NewGenericRepositoryFromDB(RepoTypePostgres, "dbName", db),
 	}
-	_, err = FetchAdvancedConfigString(
-		sampleCfg,
-		"snowflake", []string{"account", "role", "warehouse"},
-	)
-	require.Error(t, err)
 }
 
-func TestAdvancedConfigMalformed(t *testing.T) {
-	sampleCfg := RepoConfig{
+// Returns a correct repo config
+func getSampleRepoConfig() RepoConfig {
+	return RepoConfig{
 		Advanced: map[string]any{
-			"snowflake": map[string]any{
-				// Let's give a _list_ of things
-				"account":   []string{"account1", "account2"},
-				"role":      []string{"role1", "role2"},
-				"warehouse": []string{"warehouse1", "warehouse2"},
-			},
+			configConnOpts: []any{"sslmode=disable"},
 		},
 	}
-	_, err := FetchAdvancedConfigString(
-		sampleCfg,
-		"snowflake", []string{"account", "role", "warehouse"},
-	)
-	require.Error(t, err)
 }
diff --git a/discovery/redshift.go b/sql/redshift.go
similarity index 59%
rename from discovery/redshift.go
rename to sql/redshift.go
index 57027d8..ae847e8 100644
--- a/discovery/redshift.go
+++ b/sql/redshift.go
@@ -1,4 +1,4 @@
-package discovery
+package sql
 
 import (
 	"context"
@@ -12,19 +12,19 @@ const (
 	RepoTypeRedshift = "redshift"
 )
 
-// RedshiftRepository is a SQLRepository implementation for Redshift databases.
+// RedshiftRepository is a Repository implementation for Redshift databases.
 type RedshiftRepository struct {
 	// The majority of the RedshiftRepository functionality is delegated to
-	// a generic SQL repository instance (genericSqlRepo).
-	genericSqlRepo *GenericRepository
+	// a generic SQL repository instance.
+	generic *GenericRepository
 }
 
-// RedshiftRepository implements SQLRepository
-var _ SQLRepository = (*RedshiftRepository)(nil)
+// RedshiftRepository implements Repository
+var _ Repository = (*RedshiftRepository)(nil)
 
 // NewRedshiftRepository creates a new RedshiftRepository.
 func NewRedshiftRepository(cfg RepoConfig) (*RedshiftRepository, error) {
-	pgCfg, err := ParsePostgresConfig(cfg)
+	pgCfg, err := parsePostgresConfig(cfg)
 	if err != nil {
 		return nil, fmt.Errorf("unable to parse postgres config: %w", err)
 	}
@@ -42,19 +42,11 @@ func NewRedshiftRepository(cfg RepoConfig) (*RedshiftRepository, error) {
 		database,
 		pgCfg.ConnOptsStr,
 	)
-	sqlRepo, err := NewGenericRepository(
-		cfg.Host,
-		RepoTypePostgres,
-		cfg.Database,
-		connStr,
-		cfg.MaxOpenConns,
-		cfg.IncludePaths,
-		cfg.ExcludePaths,
-	)
+	generic, err := NewGenericRepository(RepoTypePostgres, cfg.Database, connStr, cfg.MaxOpenConns)
 	if err != nil {
 		return nil, fmt.Errorf("could not instantiate generic sql repository: %w", err)
 	}
-	return &RedshiftRepository{genericSqlRepo: sqlRepo}, nil
+	return &RedshiftRepository{generic: generic}, nil
 }
 
 // ListDatabases returns a list of the names of all databases on the server by
@@ -62,39 +54,38 @@ func NewRedshiftRepository(cfg RepoConfig) (*RedshiftRepository, error) {
 // GenericRepository.ListDatabasesWithQuery - see that method for more details.
 func (r *RedshiftRepository) ListDatabases(ctx context.Context) ([]string, error) {
 	// Redshift and Postgres use the same query to list the server databases.
-	return r.genericSqlRepo.ListDatabasesWithQuery(ctx, PostgresDatabaseQuery)
+	return r.generic.ListDatabasesWithQuery(ctx, PostgresDatabaseQuery)
 }
 
 // Introspect delegates introspection to GenericRepository. See
-// SQLRepository.Introspect and GenericRepository.IntrospectWithQuery for more
+// Repository.Introspect and GenericRepository.IntrospectWithQuery for more
 // details.
-func (r *RedshiftRepository) Introspect(ctx context.Context) (*Metadata, error) {
-	return r.genericSqlRepo.Introspect(ctx)
+func (r *RedshiftRepository) Introspect(ctx context.Context, params IntrospectParameters) (*Metadata, error) {
+	return r.generic.Introspect(ctx, params)
 }
 
 // SampleTable delegates sampling to GenericRepository, using a
-// Redshift-specific table sample query. See SQLRepository.SampleTable and
+// Redshift-specific table sample query. See Repository.SampleTable and
 // GenericRepository.SampleTableWithQuery for more details.
 func (r *RedshiftRepository) SampleTable(
 	ctx context.Context,
-	meta *TableMetadata,
 	params SampleParameters,
 ) (Sample, error) {
 	// Redshift uses double-quotes to quote identifiers
-	attrStr := meta.QuotedAttributeNamesString("\"")
+	attrStr := params.Metadata.QuotedAttributeNamesString("\"")
 	// Redshift uses $x for placeholders
-	query := fmt.Sprintf("SELECT %s FROM %s.%s LIMIT $1 OFFSET $2", attrStr, meta.Schema, meta.Name)
-	return r.genericSqlRepo.SampleTableWithQuery(ctx, meta, query, params.SampleSize, params.Offset)
+	query := fmt.Sprintf("SELECT %s FROM %s.%s LIMIT $1 OFFSET $2", attrStr, params.Metadata.Schema, params.Metadata.Name)
+	return r.generic.SampleTableWithQuery(ctx, query, params)
 }
 
-// Ping delegates the ping to GenericRepository. See SQLRepository.Ping and
+// Ping delegates the ping to GenericRepository. See Repository.Ping and
 // GenericRepository.Ping for more details.
 func (r *RedshiftRepository) Ping(ctx context.Context) error {
-	return r.genericSqlRepo.Ping(ctx)
+	return r.generic.Ping(ctx)
 }
 
-// Close delegates the close to GenericRepository. See SQLRepository.Close and
+// Close delegates the close to GenericRepository. See Repository.Close and
 // GenericRepository.Close for more details.
 func (r *RedshiftRepository) Close() error {
-	return r.genericSqlRepo.Close()
+	return r.generic.Close()
 }
diff --git a/discovery/redshift_test.go b/sql/redshift_test.go
similarity index 87%
rename from discovery/redshift_test.go
rename to sql/redshift_test.go
index 07df14c..3b45d75 100644
--- a/discovery/redshift_test.go
+++ b/sql/redshift_test.go
@@ -1,4 +1,4 @@
-package discovery
+package sql
 
 import (
 	"context"
@@ -24,6 +24,6 @@ func initRedshiftRepoTest(t *testing.T) (context.Context, *sql.DB, sqlmock.Sqlmo
 	db, mock, err := sqlmock.New()
 	require.NoError(t, err)
 	return ctx, db, mock, &RedshiftRepository{
-		genericSqlRepo: NewGenericRepositoryFromDB("repoName", RepoTypeRedshift, "dbName", db),
+		generic: NewGenericRepositoryFromDB(RepoTypeRedshift, "dbName", db),
 	}
 }
diff --git a/discovery/registry.go b/sql/registry.go
similarity index 72%
rename from discovery/registry.go
rename to sql/registry.go
index da18fc2..5ea7136 100644
--- a/discovery/registry.go
+++ b/sql/registry.go
@@ -1,4 +1,4 @@
-package discovery
+package sql
 
 import (
 	"context"
@@ -11,7 +11,7 @@ var (
 	// package of which a number of convenience functions in this package act
 	// on. All currently out-of-the-box repository types are registered to this
 	// registry by this package's init function. Users who want to use custom
-	// SQLRepository implementations, or just avoid global state altogether, should
+	// Repository implementations, or just avoid global state altogether, should
 	// use their own instance of Registry, instead of using DefaultRegistry and
 	// the corresponding convenience functions.
 	DefaultRegistry = NewRegistry()
@@ -26,7 +26,7 @@ type Registry struct {
 
 // RepoConstructor represents the function signature that all repository
 // implementations should use for their constructor functions.
-type RepoConstructor func(ctx context.Context, cfg RepoConfig) (SQLRepository, error)
+type RepoConstructor func(ctx context.Context, cfg RepoConfig) (Repository, error)
 
 // NewRegistry creates a new Registry instance.
 func NewRegistry() *Registry {
@@ -57,15 +57,21 @@ func (r *Registry) MustRegister(repoType string, constructor RepoConstructor) {
 	}
 }
 
-// NewRepository is a factory method to return a concrete SQLRepository
+// Unregister removes a repository type from the registry. If the repository
+// type is not registered, this method is a no-op.
+func (r *Registry) Unregister(repoType string) {
+	delete(r.constructors, repoType)
+}
+
+// NewRepository is a factory method to return a concrete Repository
 // implementation based on the specified type, e.g. MySQL, Postgres, SQL Server,
 // etc., which must be registered with the registry. If the repository type is
 // not registered, an error is returned. A new instance of the repository is
 // returned each time this method is called.
-func (r *Registry) NewRepository(ctx context.Context, cfg RepoConfig) (SQLRepository, error) {
-	constructor, ok := r.constructors[cfg.Type]
+func (r *Registry) NewRepository(ctx context.Context, repoType string, cfg RepoConfig) (Repository, error) {
+	constructor, ok := r.constructors[repoType]
 	if !ok {
-		return nil, errors.New("unsupported repo type " + cfg.Type)
+		return nil, errors.New("unsupported repo type " + repoType)
 	}
 	repo, err := constructor(ctx, cfg)
 	if err != nil {
@@ -86,10 +92,16 @@ func MustRegister(repoType string, constructor RepoConstructor) {
 	DefaultRegistry.MustRegister(repoType, constructor)
 }
 
+// Unregister is a convenience function that delegates to DefaultRegistry. See
+// Registry.Unregister for more details.
+func Unregister(repoType string) {
+	DefaultRegistry.Unregister(repoType)
+}
+
 // NewRepository is a convenience function that delegates to DefaultRegistry.
 // See Registry.NewRepository for more details.
-func NewRepository(ctx context.Context, cfg RepoConfig) (SQLRepository, error) {
-	return DefaultRegistry.NewRepository(ctx, cfg)
+func NewRepository(ctx context.Context, repoType string, cfg RepoConfig) (Repository, error) {
+	return DefaultRegistry.NewRepository(ctx, repoType, cfg)
 }
 
 // init registers all out-of-the-box repository types and their respective
@@ -97,43 +109,43 @@ func NewRepository(ctx context.Context, cfg RepoConfig) (SQLRepository, error) {
 func init() {
 	MustRegister(
 		RepoTypeDenodo,
-		func(_ context.Context, cfg RepoConfig) (SQLRepository, error) {
+		func(_ context.Context, cfg RepoConfig) (Repository, error) {
 			return NewDenodoRepository(cfg)
 		},
 	)
 	MustRegister(
 		RepoTypeMysql,
-		func(_ context.Context, cfg RepoConfig) (SQLRepository, error) {
+		func(_ context.Context, cfg RepoConfig) (Repository, error) {
 			return NewMySqlRepository(cfg)
 		},
 	)
 	MustRegister(
 		RepoTypeOracle,
-		func(_ context.Context, cfg RepoConfig) (SQLRepository, error) {
+		func(_ context.Context, cfg RepoConfig) (Repository, error) {
 			return NewOracleRepository(cfg)
 		},
 	)
 	MustRegister(
 		RepoTypePostgres,
-		func(_ context.Context, cfg RepoConfig) (SQLRepository, error) {
+		func(_ context.Context, cfg RepoConfig) (Repository, error) {
 			return NewPostgresRepository(cfg)
 		},
 	)
 	MustRegister(
 		RepoTypeRedshift,
-		func(_ context.Context, cfg RepoConfig) (SQLRepository, error) {
+		func(_ context.Context, cfg RepoConfig) (Repository, error) {
 			return NewRedshiftRepository(cfg)
 		},
 	)
 	MustRegister(
 		RepoTypeSnowflake,
-		func(ctx context.Context, cfg RepoConfig) (SQLRepository, error) {
+		func(ctx context.Context, cfg RepoConfig) (Repository, error) {
 			return NewSnowflakeRepository(cfg)
 		},
 	)
 	MustRegister(
 		RepoTypeSqlServer,
-		func(_ context.Context, cfg RepoConfig) (SQLRepository, error) {
+		func(_ context.Context, cfg RepoConfig) (Repository, error) {
 			return NewSqlServerRepository(cfg)
 		},
 	)
diff --git a/sql/registry_test.go b/sql/registry_test.go
new file mode 100644
index 0000000..9a55d76
--- /dev/null
+++ b/sql/registry_test.go
@@ -0,0 +1,82 @@
+package sql
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestRegistry_Register_Successful(t *testing.T) {
+	repoType := "repoType"
+	constructor := func(context.Context, RepoConfig) (Repository, error) {
+		return nil, nil
+	}
+	reg := NewRegistry()
+	err := reg.Register(repoType, constructor)
+	require.NoError(t, err)
+	require.Contains(t, reg.constructors, repoType)
+}
+
+func TestRegistry_MustRegister_NilConstructor(t *testing.T) {
+	reg := NewRegistry()
+	require.Panics(t, func() { reg.MustRegister("repoType", nil) })
+}
+
+func TestRegistry_MustRegister_TwoCalls_Panics(t *testing.T) {
+	repoType := "repoType"
+	constructor := func(context.Context, RepoConfig) (Repository, error) {
+		return nil, nil
+	}
+	reg := NewRegistry()
+	reg.MustRegister(repoType, constructor)
+	require.Contains(t, reg.constructors, repoType)
+	require.Panics(t, func() { reg.MustRegister(repoType, constructor) })
+}
+
+func TestRegistry_NewRepository_IsSuccessful(t *testing.T) {
+	repoType := "repoType"
+	called := false
+	expectedRepo := (Repository)(nil)
+	constructor := func(context.Context, RepoConfig) (Repository, error) {
+		called = true
+		return expectedRepo, nil
+	}
+	reg := NewRegistry()
+	err := reg.Register(repoType, constructor)
+	require.NoError(t, err)
+	require.Contains(t, reg.constructors, repoType)
+
+	repo, err := reg.NewRepository(context.Background(), repoType, RepoConfig{})
+	require.NoError(t, err)
+	require.Equal(t, expectedRepo, repo)
+	require.True(t, called, "Constructor was not called")
+}
+
+func TestRegistry_NewRepository_ConstructorError(t *testing.T) {
+	repoType := "repoType"
+	called := false
+	expectedErr := errors.New("dummy error")
+	constructor := func(context.Context, RepoConfig) (Repository, error) {
+		called = true
+		return nil, expectedErr
+	}
+	reg := NewRegistry()
+	err := reg.Register(repoType, constructor)
+	require.NoError(t, err)
+	require.Contains(t, reg.constructors, repoType)
+
+	repo, err := reg.NewRepository(context.Background(), repoType, RepoConfig{})
+	require.ErrorIs(t, err, expectedErr)
+	require.Nil(t, repo)
+	require.True(t, called, "Constructor was not called")
+}
+
+func TestRegistry_NewRepository_UnsupportedRepoType(t *testing.T) {
+	repoType := "repoType"
+	reg := NewRegistry()
+	repo, err := reg.NewRepository(context.Background(), repoType, RepoConfig{})
+	require.Error(t, err)
+	require.Nil(t, repo)
+}
diff --git a/sql/repository.go b/sql/repository.go
new file mode 100644
index 0000000..a751c9a
--- /dev/null
+++ b/sql/repository.go
@@ -0,0 +1,76 @@
+package sql
+
+import (
+	"context"
+
+	"github.com/gobwas/glob"
+)
+
+// Repository represents a Dmap data SQL repository, and provides functionality
+// to introspect its corresponding schema.
+type Repository interface {
+	// ListDatabases returns a list of the names of all databases on the server.
+	ListDatabases(ctx context.Context) ([]string, error)
+	// Introspect will read and analyze the basic properties of the repository
+	// and return as a Metadata instance. This includes all the repository's
+	// databases, schemas, tables, columns, and attributes.
+	Introspect(ctx context.Context, params IntrospectParameters) (*Metadata, error)
+	// SampleTable samples the table referenced by the TableMetadata meta
+	// parameter and returns the sample as a slice of Sample. The parameters for
+	// the sample, such as sample size, are passed via the params parameter (see
+	// SampleParameters for more details). The returned sample result set
+	// contains one Sample for each table row sampled. The length of the results
+	// will be less than or equal to the sample size. If there are fewer results
+	// than the specified sample size, it is because the table in question had a
+	// row count less than the sample size. Prefer small sample sizes to limit
+	// impact on the database.
+	SampleTable(ctx context.Context, params SampleParameters) (Sample, error)
+	// Ping is meant to be used as a general purpose connectivity test. It
+	// should be invoked e.g. in the dry-run mode.
+	Ping(ctx context.Context) error
+	// Close is meant to be used as a general purpose cleanup. It should be
+	// invoked when the Repository is no longer used.
+	Close() error
+}
+
+// IntrospectParameters is a struct that holds the parameters for the Introspect
+// method of the Repository interface.
+type IntrospectParameters struct {
+	// IncludePaths is a list of glob patterns that will be used to filter
+	// the tables that will be introspected. If a table name matches any of
+	// the patterns in this list, it will be included in the repository
+	// metadata.
+	IncludePaths []glob.Glob
+	// ExcludePaths is a list of glob patterns that will be used to filter
+	// the tables that will be introspected. If a table name matches any of
+	// the patterns in this list, it will be excluded from the repository
+	// metadata.
+	ExcludePaths []glob.Glob
+}
+
+// Sample represents a sample of data from a database table.
+type Sample struct {
+	// TablePath is the full path of the data repository table that was sampled.
+	// Each element corresponds to a component, in increasing order of
+	// granularity (e.g. [database, schema, table]).
+	TablePath []string
+	// Results is the set of sample results. Each SampleResult is equivalent to
+	// a database row, where the map key is the column name and the map value is
+	// the column value.
+	Results []SampleResult
+}
+
+// SampleParameters contains all parameters necessary to sample a table.
+type SampleParameters struct {
+	// Metadata is the metadata for the table to be sampled.
+	Metadata *TableMetadata
+	// SampleSize is the number of rows to sample from the table.
+	SampleSize uint
+	// Offset is the number of rows to skip before starting the sample.
+	Offset uint
+}
+
+// SampleResult stores the results from a single database sample. It is
+// equivalent to a database row, where the map key is the column name and the
+// map value is the column value.
+type SampleResult map[string]any
diff --git a/sql/sample.go b/sql/sample.go
new file mode 100644
index 0000000..5497f7c
--- /dev/null
+++ b/sql/sample.go
@@ -0,0 +1,190 @@
+package sql
+
+import (
+	"context"
+	"fmt"
+	"sync"
+
+	"github.com/hashicorp/go-multierror"
+	log "github.com/sirupsen/logrus"
+	"golang.org/x/sync/semaphore"
+)
+
+// sampleAndErr is a "pair" type intended to be passed to a channel (see
+// sampleDb)
+type sampleAndErr struct {
+	sample Sample
+	err    error
+}
+
+// samplesAndErr is a "pair" type intended to be passed to a channel (see
+// sampleAllDbs)
+type samplesAndErr struct {
+	samples []Sample
+	err     error
+}
+
+// sampleAllDbs uses the given Repository to list all the
+// databases on the server, and samples each one in parallel by calling
+// sampleDb for each database. The repository is intended to be
+// configured to connect to the default database on the server, or at least some
+// database which can be used to enumerate the full set of databases on the
+// server. An error will be returned if the set of databases cannot be listed.
+// If there is an error connecting to or sampling a database, the error will be
+// logged and no samples will be returned for that database. Therefore, the
+// returned slice of samples contains samples for only the databases which could
+// be discovered and successfully sampled, and could potentially be empty if no
+// databases were sampled.
+func sampleAllDbs(
+	ctx context.Context,
+	ctor RepoConstructor,
+	cfg RepoConfig,
+	introspectParams IntrospectParameters,
+	sampleSize, offset uint,
+) (
+	[]Sample,
+	error,
+) {
+	// Create a repository instance that will be used to list all the databases
+	// on the server.
+	repo, err := ctor(ctx, cfg)
+	if err != nil {
+		return nil, fmt.Errorf("error creating repository instance: %w", err)
+	}
+	defer func() { _ = repo.Close() }()
+
+	// We assume that this repository will be connected to the default database
+	// (or at least some database that can discover all the other databases),
+	// and we use that to discover all other databases.
+	dbs, err := repo.ListDatabases(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("error listing databases: %w", err)
+	}
+
+	// Sample each database on a separate goroutine, and send the samples to
+	// the 'out' channel. Each slice of samples will be aggregated below on the
+	// main goroutine and returned.
+	var wg sync.WaitGroup
+	out := make(chan samplesAndErr)
+	wg.Add(len(dbs))
+	// Ensures that we avoid opening more than the specified number of
+	// connections.
+	var sema *semaphore.Weighted
+	if cfg.MaxOpenConns > 0 {
+		sema = semaphore.NewWeighted(int64(cfg.MaxOpenConns))
+	}
+	for _, db := range dbs {
+		go func(db string, cfg RepoConfig) {
+			defer wg.Done()
+			if sema != nil {
+				_ = sema.Acquire(ctx, 1)
+				defer sema.Release(1)
+			}
+			// Create a repository instance for this specific database. It will
+			// be used to connect to and sample the database.
+			cfg.Database = db
+			repo, err := ctor(ctx, cfg)
+			if err != nil {
+				log.WithError(err).Errorf("error creating repository instance for database %s", db)
+				return
+			}
+			defer func() { _ = repo.Close() }()
+			// Sample the database.
+			s, err := sampleDb(ctx, repo, introspectParams, sampleSize, offset)
+			if err != nil && len(s) == 0 {
+				log.WithError(err).Errorf("error gathering repository data samples for database %s", db)
+				return
+			}
+			// Send the samples for this database to the 'out' channel. The
+			// samples for each database will be aggregated into a single slice
+			// on the main goroutine and returned.
+			out <- samplesAndErr{samples: s, err: err}
+		}(db, cfg)
+	}
+
+	// Start a goroutine to close the 'out' channel once all the goroutines
+	// we launched above are done. This will allow the aggregation range loop
+	// below to terminate properly. Note that this must start after the wg.Add
+	// call. See https://go.dev/blog/pipelines ("Fan-out, fan-in" section).
+	go func() {
+		wg.Wait()
+		close(out)
+	}()
+
+	// Aggregate and return the results.
+	var ret []Sample
+	var errs error
+	for res := range out {
+		ret = append(ret, res.samples...)
+		if res.err != nil {
+			errs = multierror.Append(errs, res.err)
+		}
+	}
+	return ret, errs
+}
+
+// sampleDb is a helper function which will sample every table in a
+// given repository and return them as a collection of Sample. First the
+// repository is introspected by calling Introspect to return the
+// repository metadata (Metadata). Then, for each schema and table in the
+// metadata, it calls SampleTable in a new goroutine. Once all the
+// sampling goroutines are finished, their results are collected and returned
+// as a slice of Sample.
+func sampleDb(
+	ctx context.Context,
+	repo Repository,
+	introspectParams IntrospectParameters,
+	sampleSize, offset uint,
+) (
+	[]Sample,
+	error,
+) {
+	// Introspect the repository to get the metadata.
+	meta, err := repo.Introspect(ctx, introspectParams)
+	if err != nil {
+		return nil, fmt.Errorf("error introspecting repository: %w", err)
+	}
+
+	// Fan out sample executions.
+	out := make(chan sampleAndErr)
+	numTables := 0
+	for _, schemaMeta := range meta.Schemas {
+		for _, tableMeta := range schemaMeta.Tables {
+			numTables++
+			go func(meta *TableMetadata) {
+				params := SampleParameters{
+					Metadata:   meta,
+					SampleSize: sampleSize,
+					Offset:     offset,
+				}
+				sample, err := repo.SampleTable(ctx, params)
+				select {
+				case <-ctx.Done():
+					return
+				case out <- sampleAndErr{sample: sample, err: err}:
+				}
+			}(tableMeta)
+		}
+	}
+
+	// Aggregate and return the results.
+	var samples []Sample
+	var errs error
+	for i := 0; i < numTables; i++ {
+		select {
+		case <-ctx.Done():
+			return samples, ctx.Err()
+		case res:= <-out:
+			if res.err != nil {
+				errs = multierror.Append(errs, res.err)
+			} else {
+				samples = append(samples, res.sample)
+			}
+		}
+	}
+	close(out)
+	if errs != nil {
+		return samples, fmt.Errorf("error(s) while sampling repository: %w", errs)
+	}
+	return samples, nil
+}
diff --git a/sql/sample_test.go b/sql/sample_test.go
new file mode 100644
index 0000000..811cfa5
--- /dev/null
+++ b/sql/sample_test.go
@@ -0,0 +1,205 @@
+package sql
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	"github.com/stretchr/testify/mock"
+	"github.com/stretchr/testify/require"
+)
+
+var (
+	table1Sample = Sample{
+		TablePath: []string{"database", "schema1", "table1"},
+		Results: []SampleResult{
+			{
+				"name1": "foo",
+				"name2": "bar",
+			},
+			{
+				"name1": "baz",
+				"name2": "qux",
+			},
+		},
+	}
+
+	table2Sample = Sample{
+		TablePath: []string{"database", "schema2", "table2"},
+		Results: []SampleResult{
+			{
+				"name3": "foo1",
+				"name4": "bar1",
+			},
+			{
+				"name3": "baz1",
+				"name4": "qux1",
+			},
+		},
+	}
+)
+
+func Test_sampleDb_Success(t *testing.T) {
+	ctx := context.Background()
+	repo := NewMockRepository(t)
+	meta := Metadata{
+		Database: "database",
+		Schemas: map[string]*SchemaMetadata{
+			"schema1": {
+				Name: "",
+				Tables: map[string]*TableMetadata{
+					"table1": {
+						Schema: "schema1",
+						Name:   "table1",
+						Attributes: []*AttributeMetadata{
+							{
+								Schema:   "schema1",
+								Table:    "table1",
+								Name:     "name1",
+								DataType: "varchar",
+							},
+							{
+								Schema:   "schema1",
+								Table:    "table1",
+								Name:     "name2",
+								DataType: "decimal",
+							},
+						},
+					},
+				},
+			},
+			"schema2": {
+				Name: "",
+				Tables: map[string]*TableMetadata{
+					"table2": {
+						Schema: "schema2",
+						Name:   "table2",
+						Attributes: []*AttributeMetadata{
+							{
+								Schema:   "schema2",
+								Table:    "table2",
+								Name:     "name3",
+								DataType: "int",
+							},
+							{
+								Schema:   "schema2",
+								Table:    "table2",
+								Name:     "name4",
+								DataType: "timestamp",
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+	repo.EXPECT().Introspect(ctx, mock.Anything).Return(&meta, nil)
+	sampleParams1 := SampleParameters{
+		Metadata: meta.Schemas["schema1"].Tables["table1"],
+	}
+	sampleParams2 := SampleParameters{
+		Metadata: meta.Schemas["schema2"].Tables["table2"],
+	}
+	repo.EXPECT().SampleTable(ctx, sampleParams1).Return(table1Sample, nil)
+	repo.EXPECT().SampleTable(ctx, sampleParams2).Return(table2Sample, nil)
+	samples, err := sampleDb(ctx, repo, IntrospectParameters{}, 0, 0)
+	require.NoError(t, err)
+	// Order is not important and is actually non-deterministic due to concurrency
+	expected := []Sample{table1Sample, table2Sample}
+	require.ElementsMatch(t, expected, samples)
+}
+
+func Test_sampleDb_PartialError(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	repo := NewMockRepository(t)
+	meta := Metadata{
+		Database: "database",
+		Schemas: map[string]*SchemaMetadata{
+			"schema1": {
+				Name: "",
+				Tables: map[string]*TableMetadata{
+					"table1": {
+						Schema: "schema1",
+						Name:   "table1",
+						Attributes: []*AttributeMetadata{
+							{
+								Schema:   "schema1",
+								Table:    "table1",
+								Name:     "name1",
+								DataType: "varchar",
+							},
+							{
+								Schema:   "schema1",
+								Table:    "table1",
+								Name:     "name2",
+								DataType: "decimal",
+							},
+						},
+					},
+					"forbidden": {
+						Schema: "schema1",
+						Name:   "forbidden",
+						Attributes: []*AttributeMetadata{
+							{
+								Schema:   "schema1",
+								Table:    "forbidden",
+								Name:     "name1",
+								DataType: "varchar",
+							},
+							{
+								Schema:   "schema1",
+								Table:    "forbidden",
+								Name:     "name2",
+								DataType: "decimal",
+							},
+						},
+					},
+				},
+			},
+			"schema2": {
+				Name: "",
+				Tables: map[string]*TableMetadata{
+					"table2": {
+						Schema: "schema2",
+						Name:   "table2",
+						Attributes: []*AttributeMetadata{
+							{
+								Schema:   "schema2",
+								Table:    "table2",
+								Name:     "name3",
+								DataType: "int",
+							},
+							{
+								Schema:   "schema2",
+								Table:    "table2",
+								Name:     "name4",
+								DataType: "timestamp",
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+	repo.EXPECT().Introspect(ctx, mock.Anything).Return(&meta, nil)
+	sampleParams1 := SampleParameters{
+		Metadata: meta.Schemas["schema1"].Tables["table1"],
+	}
+	sampleParams2 := SampleParameters{
+		Metadata: meta.Schemas["schema1"].Tables["forbidden"],
+	}
+	sampleParamsForbidden := SampleParameters{
+		Metadata: meta.Schemas["schema2"].Tables["table2"],
+	}
+	repo.EXPECT().SampleTable(ctx, sampleParams1).Return(table1Sample, nil)
+	errForbidden := errors.New("forbidden table")
+	repo.EXPECT().SampleTable(ctx, sampleParamsForbidden).Return(Sample{}, errForbidden)
+	repo.EXPECT().SampleTable(ctx, sampleParams2).Return(table2Sample, nil)
+
+	samples, err := sampleDb(ctx, repo, IntrospectParameters{}, 0, 0)
+	require.ErrorIs(t, err, errForbidden)
+	// Order is not important and is actually non-deterministic due to concurrency
+	expected := []Sample{table1Sample, table2Sample}
+	require.ElementsMatch(t, expected, samples)
+}
diff --git a/sql/samplealldatabases_test.go b/sql/samplealldatabases_test.go
new file mode 100644
index 0000000..831c7df
--- /dev/null
+++ b/sql/samplealldatabases_test.go
@@ -0,0 +1,182 @@
+package sql
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	"github.com/stretchr/testify/mock"
+	"github.com/stretchr/testify/require"
+)
+
+func Test_sampleAllDbs_Error(t *testing.T) {
+	ctx := context.Background()
+	listDbErr := errors.New("error listing databases")
+	repo := NewMockRepository(t)
+	repo.EXPECT().ListDatabases(ctx).Return(nil, listDbErr)
+	repo.EXPECT().Close().Return(nil)
+	ctor := func(ctx context.Context, cfg RepoConfig) (Repository, error) {
+		return repo, nil
+	}
+	cfg := RepoConfig{}
+	samples, err := sampleAllDbs(ctx, ctor, cfg, IntrospectParameters{}, 0, 0)
+	require.Nil(t, samples)
+	require.ErrorIs(t, err, listDbErr)
+}
+
+func Test_sampleAllDbs_Successful_TwoDatabases(t *testing.T) {
+	ctx := context.Background()
+	dbs := []string{"db1", "db2"}
+	// Dummy metadata returned for each Introspect call
+	meta := Metadata{
+		Database: "db",
+		Schemas: map[string]*SchemaMetadata{
+			"schema": {
+				Name: "schema",
+				Tables: map[string]*TableMetadata{
+					"table": {
+						Schema: "schema",
+						Name:   "table",
+						Attributes: []*AttributeMetadata{
+							{
+								Schema:   "schema",
+								Table:    "table",
+								Name:     "attr",
+								DataType: "string",
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+	sample := Sample{
+		TablePath: []string{"db", "schema", "table"},
+		Results: []SampleResult{
+			{
+				"attr": "foo",
+			},
+		},
+	}
+	repo := NewMockRepository(t)
+	repo.EXPECT().ListDatabases(ctx).Return(dbs, nil)
+	repo.EXPECT().Introspect(ctx, mock.Anything).Return(&meta, nil)
+	repo.EXPECT().SampleTable(ctx, mock.Anything).Return(sample, nil)
+	repo.EXPECT().Close().Return(nil)
+	ctor := func(ctx context.Context, cfg RepoConfig) (Repository, error) {
+		return repo, nil
+	}
+	samples, err := sampleAllDbs(ctx, ctor, RepoConfig{}, IntrospectParameters{}, 0, 0)
+	require.NoError(t, err)
+	// Two databases should be sampled, and our mock will return the sample for
+	// each sample call. This really just asserts that we've sampled the correct
+	// number of times.
+	require.ElementsMatch(t, samples, []Sample{sample, sample})
+}
+
+func Test_sampleAllDbs_IntrospectError(t *testing.T) {
+	ctx := context.Background()
+	dbs := []string{"db1", "db2"}
+	introspectErr := errors.New("introspect error")
+	repo := NewMockRepository(t)
+	repo.EXPECT().ListDatabases(ctx).Return(dbs, nil)
+	repo.EXPECT().Introspect(ctx, mock.Anything).Return(nil, introspectErr)
+	repo.EXPECT().Close().Return(nil)
+	ctor := func(ctx context.Context, cfg RepoConfig) (Repository, error) {
+		return repo, nil
+	}
+	samples, err := sampleAllDbs(ctx, ctor, RepoConfig{}, IntrospectParameters{}, 0, 0)
+	require.Empty(t, samples)
+	require.NoError(t, err)
+}
+
+func Test_sampleAllDbs_SampleError(t *testing.T) {
+	ctx := context.Background()
+	dbs := []string{"db1", "db2"}
+	// Dummy metadata returned for each Introspect call
+	meta := Metadata{
+		Database: "db",
+		Schemas: map[string]*SchemaMetadata{
+			"schema": {
+				Name: "schema",
+				Tables: map[string]*TableMetadata{
+					"table": {
+						Schema: "schema",
+						Name:   "table",
+						Attributes: []*AttributeMetadata{
+							{
+								Schema:   "schema",
+								Table:    "table",
+								Name:     "attr",
+								DataType: "string",
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+	sampleErr := errors.New("sample error")
+	repo := NewMockRepository(t)
+	repo.EXPECT().ListDatabases(ctx).Return(dbs, nil)
+	repo.EXPECT().Introspect(ctx, mock.Anything).Return(&meta, nil)
+	repo.EXPECT().SampleTable(ctx, mock.Anything).Return(Sample{}, sampleErr)
+	repo.EXPECT().Close().Return(nil)
+	ctor := func(ctx context.Context, cfg RepoConfig) (Repository, error) {
+		return repo, nil
+	}
+	samples, err := sampleAllDbs(ctx, ctor, RepoConfig{}, IntrospectParameters{}, 0, 0)
+	require.NoError(t, err)
+	require.Empty(t, samples)
+}
+
+func Test_sampleAllDbs_TwoDatabases_OneSampleError(t *testing.T) {
+	ctx := context.Background()
+	dbs := []string{"db1", "db2"}
+	// Dummy metadata returned for each Introspect call
+	meta := Metadata{
+		Database: "db",
+		Schemas: map[string]*SchemaMetadata{
+			"schema": {
+				Name: "schema",
+				Tables: map[string]*TableMetadata{
+					"table": {
+						Schema: "schema",
+						Name:   "table",
+						Attributes: []*AttributeMetadata{
+							{
+								Schema:   "schema",
+								Table:    "table",
+								Name:     "attr",
+								DataType: "string",
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+	sample := Sample{
+		TablePath: []string{"db", "schema", "table"},
+		Results: []SampleResult{
+			{
+				"attr": "foo",
+			},
+		},
+	}
+	sampleErr := errors.New("sample error")
+	repo := NewMockRepository(t)
+	repo.EXPECT().ListDatabases(ctx).Return(dbs, nil)
+	repo.EXPECT().Introspect(ctx, mock.Anything).Return(&meta, nil)
+	repo.EXPECT().SampleTable(ctx, mock.Anything).Return(sample, nil).Once()
+	repo.EXPECT().SampleTable(ctx, mock.Anything).Return(Sample{}, sampleErr).Once()
+	repo.EXPECT().Close().Return(nil)
+	ctor := func(ctx context.Context, cfg RepoConfig) (Repository, error) {
+		return repo, nil
+	}
+	samples, err := sampleAllDbs(ctx, ctor, RepoConfig{}, IntrospectParameters{}, 0, 0)
+	require.NoError(t, err)
+	// Because of a single sample error, we expect only one database was
+	// sampled.
+	require.ElementsMatch(t, samples, []Sample{sample})
+}
diff --git a/sql/scanner.go b/sql/scanner.go
new file mode 100644
index 0000000..72e7710
--- /dev/null
+++ b/sql/scanner.go
@@ -0,0 +1,121 @@
+package sql
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/gobwas/glob"
+	log "github.com/sirupsen/logrus"
+
+	"github.com/cyralinc/dmap/classification"
+	"github.com/cyralinc/dmap/scan"
+)
+
+// ScannerConfig is the configuration for the Scanner.
+type ScannerConfig struct {
+	RepoType                   string
+	RepoConfig                 RepoConfig
+	Registry                   *Registry
+	IncludePaths, ExcludePaths []glob.Glob
+	SampleSize                 uint
+	Offset                     uint
+}
+
+// Scanner is a data discovery scanner that scans a data repository for
+// sensitive data. It also classifies the data and publishes the results to
+// the configured external sources. It currently only supports SQL-based
+// repositories.
+type Scanner struct {
+	Config     ScannerConfig
+	labels     []classification.Label
+	classifier classification.Classifier
+}
+
+// RepoScanner implements the scan.RepoScanner interface.
+var _ scan.RepoScanner = (*Scanner)(nil)
+
+// NewScanner creates a new Scanner instance with the provided configuration.
+func NewScanner(cfg ScannerConfig) (*Scanner, error) {
+	if cfg.RepoType == "" {
+		return nil, fmt.Errorf("repository type not specified")
+	}
+	if cfg.Registry == nil {
+		cfg.Registry = DefaultRegistry
+	}
+	// Create a new label classifier with the embedded labels.
+	lbls, err := classification.GetEmbeddedLabels()
+	if err != nil {
+		return nil, fmt.Errorf("error getting embedded labels: %w", err)
+	}
+	c, err := classification.NewLabelClassifier(lbls...)
+	if err != nil {
+		return nil, fmt.Errorf("error creating new label classifier: %w", err)
+	}
+	return &Scanner{Config: cfg, labels: lbls, classifier: c}, nil
+}
+
+// Scan performs the data repository scan. It introspects and samples the
+// repository, classifies the sampled data, and publishes the results to the
+// configured classification publisher.
+func (s *Scanner) Scan(ctx context.Context) (*scan.RepoScanResults, error) {
+	// Introspect and sample the data repository.
+	samples, err := s.sample(ctx)
+	if err != nil {
+		msg := "error sampling repository"
+		// If we didn't get any samples, just return the error.
+		if len(samples) == 0 {
+			return nil, fmt.Errorf("%s: %w", msg, err)
+		}
+		// There were error(s) during sampling, but we still got some samples.
+		// Just warn and continue.
+		log.WithError(err).Warn(msg)
+	}
+	// Classify the sampled data.
+	classifications, err := classifySamples(ctx, samples, s.classifier)
+	if err != nil {
+		return nil, fmt.Errorf("error classifying samples: %w", err)
+	}
+	return &scan.RepoScanResults{
+		Labels:          s.labels,
+		Classifications: classifications,
+	}, nil
+}
+
+func (s *Scanner) sample(ctx context.Context) ([]Sample, error) {
+	// This closure is used to create a new repository instance for each
+	// database that is sampled. When there are multiple databases to sample,
+	// it is passed to sampleAllDbs to create the necessary repository instances
+	// for each database. When there is only a single database to sample, it is
+	// used directly below to create the repository instance for that database,
+	// which is passed to sampleDb to sample the database.
+	newRepo := func(ctx context.Context, cfg RepoConfig) (Repository, error) {
+		return s.Config.Registry.NewRepository(ctx, s.Config.RepoType, cfg)
+	}
+	introspectParams := IntrospectParameters{
+		IncludePaths: s.Config.IncludePaths,
+		ExcludePaths: s.Config.ExcludePaths,
+	}
+	// Check if the user specified a single database, or told us to scan an
+	// Oracle DB. In that case, therefore we only need to sample that single
+	// database. Note that Oracle doesn't really have the concept of
+	// "databases", therefore a single repository instance will always scan the
+	// entire database.
+	if s.Config.RepoConfig.Database != "" || s.Config.RepoType == RepoTypeOracle {
+		repo, err := newRepo(ctx, s.Config.RepoConfig)
+		if err != nil {
+			return nil, fmt.Errorf("error creating repository: %w", err)
+		}
+		defer func() { _ = repo.Close() }()
+		return sampleDb(ctx, repo, introspectParams, s.Config.SampleSize, s.Config.Offset)
+	}
+	// The name of the database to connect to has been left unspecified by the
+	// user, so we try to connect and sample all databases instead.
+	return sampleAllDbs(
+		ctx,
+		newRepo,
+		s.Config.RepoConfig,
+		introspectParams,
+		s.Config.SampleSize,
+		s.Config.Offset,
+	)
+}
diff --git a/sql/scanner_test.go b/sql/scanner_test.go
new file mode 100644
index 0000000..e4b317b
--- /dev/null
+++ b/sql/scanner_test.go
@@ -0,0 +1 @@
+package sql
diff --git a/discovery/snowflake.go b/sql/snowflake.go
similarity index 69%
rename from discovery/snowflake.go
rename to sql/snowflake.go
index cf6d3a0..d788013 100644
--- a/discovery/snowflake.go
+++ b/sql/snowflake.go
@@ -1,4 +1,4 @@
-package discovery
+package sql
 
 import (
 	"context"
@@ -23,15 +23,15 @@ WHERE
 	configWarehouse = "warehouse"
 )
 
-// SnowflakeRepository is a SQLRepository implementation for Snowflake databases.
+// SnowflakeRepository is a Repository implementation for Snowflake databases.
 type SnowflakeRepository struct {
-	// The majority of the SQLRepository functionality is delegated to
-	// a generic SQL repository instance (genericSqlRepo).
-	genericSqlRepo *GenericRepository
+	// The majority of the Repository functionality is delegated to
+	// a generic SQL repository instance.
+	generic *GenericRepository
 }
 
-// SnowflakeRepository implements SQLRepository
-var _ SQLRepository = (*SnowflakeRepository)(nil)
+// SnowflakeRepository implements Repository
+var _ Repository = (*SnowflakeRepository)(nil)
 
 // NewSnowflakeRepository creates a new SnowflakeRepository.
 func NewSnowflakeRepository(cfg RepoConfig) (*SnowflakeRepository, error) {
@@ -53,55 +53,46 @@ func NewSnowflakeRepository(cfg RepoConfig) (*SnowflakeRepository, error) {
 		snowflakeCfg.Role,
 		snowflakeCfg.Warehouse,
 	)
-	sqlRepo, err := NewGenericRepository(
-		cfg.Host,
-		RepoTypeSnowflake,
-		database,
-		connStr,
-		cfg.MaxOpenConns,
-		cfg.IncludePaths,
-		cfg.ExcludePaths,
-	)
+	generic, err := NewGenericRepository(RepoTypeSnowflake, database, connStr, cfg.MaxOpenConns)
 	if err != nil {
 		return nil, fmt.Errorf("could not instantiate generic sql repository: %w", err)
 	}
-	return &SnowflakeRepository{genericSqlRepo: sqlRepo}, nil
+	return &SnowflakeRepository{generic: generic}, nil
 }
 
 // ListDatabases returns a list of the names of all databases on the server by
 // using a Snowflake-specific database query. It delegates the actual work to
 // GenericRepository.ListDatabasesWithQuery - see that method for more details.
 func (r *SnowflakeRepository) ListDatabases(ctx context.Context) ([]string, error) {
-	return r.genericSqlRepo.ListDatabasesWithQuery(ctx, SnowflakeDatabaseQuery)
+	return r.generic.ListDatabasesWithQuery(ctx, SnowflakeDatabaseQuery)
 }
 
 // Introspect delegates introspection to GenericRepository. See
-// SQLRepository.Introspect and GenericRepository.IntrospectWithQuery for more
+// Repository.Introspect and GenericRepository.IntrospectWithQuery for more
 // details.
-func (r *SnowflakeRepository) Introspect(ctx context.Context) (*Metadata, error) {
-	return r.genericSqlRepo.Introspect(ctx)
+func (r *SnowflakeRepository) Introspect(ctx context.Context, params IntrospectParameters) (*Metadata, error) {
+	return r.generic.Introspect(ctx, params)
 }
 
 // SampleTable delegates sampling to GenericRepository. See
-// SQLRepository.SampleTable and GenericRepository.SampleTable for more details.
+// Repository.SampleTable and GenericRepository.SampleTable for more details.
 func (r *SnowflakeRepository) SampleTable(
 	ctx context.Context,
-	meta *TableMetadata,
 	params SampleParameters,
 ) (Sample, error) {
-	return r.genericSqlRepo.SampleTable(ctx, meta, params)
+	return r.generic.SampleTable(ctx, params)
 }
 
-// Ping delegates the ping to GenericRepository. See SQLRepository.Ping and
+// Ping delegates the ping to GenericRepository. See Repository.Ping and
 // GenericRepository.Ping for more details.
 func (r *SnowflakeRepository) Ping(ctx context.Context) error {
-	return r.genericSqlRepo.Ping(ctx)
+	return r.generic.Ping(ctx)
 }
 
-// Close delegates the close to GenericRepository. See SQLRepository.Close and
+// Close delegates the close to GenericRepository. See Repository.Close and
 // GenericRepository.Close for more details.
 func (r *SnowflakeRepository) Close() error {
-	return r.genericSqlRepo.Close()
+	return r.generic.Close()
 }
 
 // SnowflakeConfig holds Snowflake-specific configuration parameters.
diff --git a/discovery/snowflake_test.go b/sql/snowflake_test.go
similarity index 87%
rename from discovery/snowflake_test.go
rename to sql/snowflake_test.go
index 6499a11..bfbc97d 100644
--- a/discovery/snowflake_test.go
+++ b/sql/snowflake_test.go
@@ -1,4 +1,4 @@
-package discovery
+package sql
 
 import (
 	"context"
@@ -24,6 +24,6 @@ func initSnowflakeRepoTest(t *testing.T) (context.Context, *sql.DB, sqlmock.Sqlm
 	db, mock, err := sqlmock.New()
 	require.NoError(t, err)
 	return ctx, db, mock, &SnowflakeRepository{
-		genericSqlRepo: NewGenericRepositoryFromDB("repoName", RepoTypeSnowflake, "dbName", db),
+		generic: NewGenericRepositoryFromDB(RepoTypeSnowflake, "dbName", db),
 	}
 }
diff --git a/discovery/sqlserver.go b/sql/sqlserver.go
similarity index 52%
rename from discovery/sqlserver.go
rename to sql/sqlserver.go
index 15320e7..de8d501 100644
--- a/discovery/sqlserver.go
+++ b/sql/sqlserver.go
@@ -1,4 +1,4 @@
-package discovery
+package sql
 
 import (
 	"context"
@@ -21,19 +21,19 @@ const (
 	SqlServerDatabaseQuery = "SELECT name FROM sys.databases WHERE name != 'model' AND name != 'tempdb'"
 )
 
-// SqlServerRepository is a SQLRepository implementation for MS SQL Server
+// SQLServerRepository is a Repository implementation for MS SQL Server
 // databases.
-type SqlServerRepository struct {
-	// The majority of the SQLRepository functionality is delegated to a generic
-	// SQL repository instance (genericSqlRepo).
-	genericSqlRepo *GenericRepository
+type SQLServerRepository struct {
+	// The majority of the Repository functionality is delegated to a generic
+	// SQL repository instance.
+	generic *GenericRepository
 }
 
-// SqlServerRepository implements SQLRepository
-var _ SQLRepository = (*SqlServerRepository)(nil)
+// SQLServerRepository implements Repository
+var _ Repository = (*SQLServerRepository)(nil)
 
 // NewSqlServerRepository creates a new MS SQL Server sql.
-func NewSqlServerRepository(cfg RepoConfig) (*SqlServerRepository, error) {
+func NewSqlServerRepository(cfg RepoConfig) (*SQLServerRepository, error) {
 	connStr := fmt.Sprintf(
 		"sqlserver://%s:%s@%s:%d",
 		cfg.User,
@@ -45,57 +45,48 @@ func NewSqlServerRepository(cfg RepoConfig) (*SqlServerRepository, error) {
 	if cfg.Database != "" {
 		connStr = fmt.Sprintf(connStr+"?database=%s", cfg.Database)
 	}
-	genericSqlRepo, err := NewGenericRepository(
-		cfg.Host,
-		RepoTypeSqlServer,
-		cfg.Database,
-		connStr,
-		cfg.MaxOpenConns,
-		cfg.IncludePaths,
-		cfg.IncludePaths,
-	)
+	generic, err := NewGenericRepository(RepoTypeSqlServer, cfg.Database, connStr, cfg.MaxOpenConns)
 	if err != nil {
 		return nil, fmt.Errorf("could not instantiate generic sql repository: %w", err)
 	}
-	return &SqlServerRepository{genericSqlRepo: genericSqlRepo}, nil
+	return &SQLServerRepository{generic: generic}, nil
 }
 
 // ListDatabases returns a list of the names of all databases on the server by
 // using a SQL Server-specific database query. It delegates the actual work to
 // GenericRepository.ListDatabasesWithQuery - see that method for more details.
-func (r *SqlServerRepository) ListDatabases(ctx context.Context) ([]string, error) {
-	return r.genericSqlRepo.ListDatabasesWithQuery(ctx, SqlServerDatabaseQuery)
+func (r *SQLServerRepository) ListDatabases(ctx context.Context) ([]string, error) {
+	return r.generic.ListDatabasesWithQuery(ctx, SqlServerDatabaseQuery)
 }
 
 // Introspect delegates introspection to GenericRepository. See
-// SQLRepository.Introspect and GenericRepository.IntrospectWithQuery for more
+// Repository.Introspect and GenericRepository.IntrospectWithQuery for more
 // details.
-func (r *SqlServerRepository) Introspect(ctx context.Context) (*Metadata, error) {
-	return r.genericSqlRepo.Introspect(ctx)
+func (r *SQLServerRepository) Introspect(ctx context.Context, params IntrospectParameters) (*Metadata, error) {
+	return r.generic.Introspect(ctx, params)
 }
 
 // SampleTable delegates sampling to GenericRepository, using a
-// SQL Server-specific table sample query. See SQLRepository.SampleTable and
+// SQL Server-specific table sample query. See Repository.SampleTable and
 // GenericRepository.SampleTableWithQuery for more details.
-func (r *SqlServerRepository) SampleTable(
+func (r *SQLServerRepository) SampleTable(
 	ctx context.Context,
-	meta *TableMetadata,
 	params SampleParameters,
 ) (Sample, error) {
 	// Sqlserver uses double-quotes to quote identifiers
-	attrStr := meta.QuotedAttributeNamesString("\"")
-	query := fmt.Sprintf(SqlServerSampleQueryTemplate, attrStr, meta.Schema, meta.Name)
-	return r.genericSqlRepo.SampleTableWithQuery(ctx, meta, query, params.SampleSize)
+	attrStr := params.Metadata.QuotedAttributeNamesString("\"")
+	query := fmt.Sprintf(SqlServerSampleQueryTemplate, attrStr, params.Metadata.Schema, params.Metadata.Name)
+	return r.generic.SampleTableWithQuery(ctx, query, params)
 }
 
-// Ping delegates the ping to GenericRepository. See SQLRepository.Ping and
+// Ping delegates the ping to GenericRepository. See Repository.Ping and
 // GenericRepository.Ping for more details.
-func (r *SqlServerRepository) Ping(ctx context.Context) error {
-	return r.genericSqlRepo.Ping(ctx)
+func (r *SQLServerRepository) Ping(ctx context.Context) error {
+	return r.generic.Ping(ctx)
 }
 
-// Close delegates the close to GenericRepository. See SQLRepository.Close and
+// Close delegates the close to GenericRepository. See Repository.Close and
 // GenericRepository.Close for more details.
-func (r *SqlServerRepository) Close() error {
-	return r.genericSqlRepo.Close()
+func (r *SQLServerRepository) Close() error {
+	return r.generic.Close()
 }
diff --git a/discovery/sqlserver_test.go b/sql/sqlserver_test.go
similarity index 77%
rename from discovery/sqlserver_test.go
rename to sql/sqlserver_test.go
index 16f2ae5..223dfec 100644
--- a/discovery/sqlserver_test.go
+++ b/sql/sqlserver_test.go
@@ -1,4 +1,4 @@
-package discovery
+package sql
 
 import (
 	"context"
@@ -19,11 +19,11 @@ func TestSqlServerRepository_ListDatabases(t *testing.T) {
 	require.ElementsMatch(t, []string{"db1", "db2"}, dbs)
 }
 
-func initSqlServerRepoTest(t *testing.T) (context.Context, *sql.DB, sqlmock.Sqlmock, *SqlServerRepository) {
+func initSqlServerRepoTest(t *testing.T) (context.Context, *sql.DB, sqlmock.Sqlmock, *SQLServerRepository) {
 	ctx := context.Background()
 	db, mock, err := sqlmock.New()
 	require.NoError(t, err)
-	return ctx, db, mock, &SqlServerRepository{
-		genericSqlRepo: NewGenericRepositoryFromDB("repoName", RepoTypeSqlServer, "dbName", db),
+	return ctx, db, mock, &SQLServerRepository{
+		generic: NewGenericRepositoryFromDB(RepoTypeSqlServer, "dbName", db),
 	}
 }

From f3a42ca09e4469f9342363adc0f9dd76da5af602 Mon Sep 17 00:00:00 2001
From: Chris Campo <ccampo133@users.noreply.github.com>
Date: Thu, 4 Apr 2024 12:00:11 -0400
Subject: [PATCH 11/14] Reduce public API surface

---
 .github/workflows/rego.yaml        |   2 +-
 Makefile                           |   9 +
 classification/label.go            |  11 +-
 classification/label_classifier.go |   3 +-
 cmd/main.go                        |   2 +-
 cmd/repo_scan.go                   |   5 +-
 scan/scanner.go                    |   2 +-
 sql/classify.go                    |  61 ---
 sql/classify_test.go               | 158 -------
 sql/config.go                      |  64 +--
 sql/config_test.go                 |  77 ----
 sql/denodo.go                      |  19 +-
 sql/doc.go                         |  17 +-
 sql/generic.go                     |  14 +-
 sql/metadata.go                    |   3 -
 sql/mysql.go                       |   6 +-
 sql/mysql_test.go                  |   2 +-
 sql/oracle.go                      |  24 +-
 sql/oracle_test.go                 |  44 ++
 sql/postgres.go                    |  98 +----
 sql/postgres_test.go               |  75 +---
 sql/redshift.go                    |   9 +-
 sql/redshift_test.go               |   2 +-
 sql/sample.go                      | 190 ---------
 sql/sample_test.go                 | 205 ---------
 sql/samplealldatabases_test.go     | 182 --------
 sql/scanner.go                     | 279 +++++++++++--
 sql/scanner_test.go                | 642 +++++++++++++++++++++++++++++
 sql/snowflake.go                   |  38 +-
 sql/snowflake_test.go              |  61 ++-
 sql/sqlserver.go                   |  34 +-
 sql/sqlserver_test.go              |   6 +-
 32 files changed, 1110 insertions(+), 1234 deletions(-)
 delete mode 100644 sql/classify.go
 delete mode 100644 sql/classify_test.go
 delete mode 100644 sql/config_test.go
 create mode 100644 sql/oracle_test.go
 delete mode 100644 sql/sample.go
 delete mode 100644 sql/sample_test.go
 delete mode 100644 sql/samplealldatabases_test.go

diff --git a/.github/workflows/rego.yaml b/.github/workflows/rego.yaml
index d29fe70..e553bc3 100644
--- a/.github/workflows/rego.yaml
+++ b/.github/workflows/rego.yaml
@@ -29,4 +29,4 @@ jobs:
           version: latest
 
       - name: Run OPA Tests
-        run: opa test classification/labels/*.rego -v
+        run: opa test ./classification/labels/*.rego -v
diff --git a/Makefile b/Makefile
index 569d168..0eba7a7 100644
--- a/Makefile
+++ b/Makefile
@@ -15,3 +15,12 @@ integration-test:
 
 clean:
 	go clean -i ./...
+
+opt-fmt:
+	opa fmt --write ./classification/labels
+
+opa-lint:
+	regal lint --disable=line-length ./classification/labels/
+
+opa-test:
+	opa test ./classification/labels/*.rego -v
diff --git a/classification/label.go b/classification/label.go
index 7aa38b5..8f5d566 100644
--- a/classification/label.go
+++ b/classification/label.go
@@ -50,7 +50,10 @@ func NewLabel(name, description, classificationRule string, tags ...string) (Lab
 
 // GetEmbeddedLabels returns the predefined embedded labels and their
 // classification rules. The labels are read from the embedded labels.yaml file
-// and the classification rules are read from the embedded Rego files.
+// and the classification rules are read from the embedded Rego files. If there
+// is an error unmarshalling the labels file, it is returned. If there is an
+// error reading or parsing a classification rule for a label, a warning is
+// logged and that label is skipped.
 func GetEmbeddedLabels() ([]Label, error) {
 	labels := struct {
 		Labels map[string]Label `yaml:"labels"`
@@ -62,11 +65,13 @@ func GetEmbeddedLabels() ([]Label, error) {
 		fname := "labels/" + strings.ReplaceAll(strings.ToLower(name), " ", "_") + ".rego"
 		b, err := regoFs.ReadFile(fname)
 		if err != nil {
-			return nil, fmt.Errorf("error reading rego file %s: %w", fname, err)
+			log.WithError(err).Warnf("error reading rego file %s", fname)
+			continue
 		}
 		rule, err := parseRego(string(b))
 		if err != nil {
-			return nil, fmt.Errorf("error preparing classification rule for label %s: %w", lbl.Name, err)
+			log.WithError(err).Warnf("error parsing classification rule for label %s", lbl.Name)
+			continue
 		}
 		lbl.Name = name
 		lbl.ClassificationRule = rule
diff --git a/classification/label_classifier.go b/classification/label_classifier.go
index c7a23b9..0bbdb46 100644
--- a/classification/label_classifier.go
+++ b/classification/label_classifier.go
@@ -18,7 +18,6 @@ type LabelClassifier struct {
 var _ Classifier = (*LabelClassifier)(nil)
 
 // NewLabelClassifier creates a new LabelClassifier with the provided labels.
-//
 func NewLabelClassifier(labels ...Label) (*LabelClassifier, error) {
 	if len(labels) == 0 {
 		return nil, fmt.Errorf("labels cannot be empty")
@@ -27,7 +26,7 @@ func NewLabelClassifier(labels ...Label) (*LabelClassifier, error) {
 	for _, lbl := range labels {
 		queries[lbl.Name] = rego.New(
 			// We only care about the 'output' variable.
-			rego.Query(lbl.ClassificationRule.Package.Path.String() + ".output"),
+			rego.Query(lbl.ClassificationRule.Package.Path.String()+".output"),
 			rego.ParsedModule(lbl.ClassificationRule),
 		)
 	}
diff --git a/cmd/main.go b/cmd/main.go
index fee5fd2..f2038ca 100644
--- a/cmd/main.go
+++ b/cmd/main.go
@@ -64,7 +64,7 @@ func main() {
 	ctx := kong.Parse(
 		&cli,
 		kong.Name("dmap"),
-		kong.Description("Assess your data security posture in AWS."),
+		kong.Description("Discover your data repositories and classify their sensitive data."),
 		kong.UsageOnError(),
 		kong.ConfigureHelp(
 			kong.HelpOptions{
diff --git a/cmd/repo_scan.go b/cmd/repo_scan.go
index ce4f327..a691598 100644
--- a/cmd/repo_scan.go
+++ b/cmd/repo_scan.go
@@ -53,6 +53,7 @@ func (g GlobFlag) Decode(ctx *kong.DecodeContext) error {
 
 func (cmd *RepoScanCmd) Run(_ *Globals) error {
 	ctx := context.Background()
+	// Configure and instantiate the scanner.
 	cfg := sql.ScannerConfig{
 		RepoType: cmd.Type,
 		RepoConfig: sql.RepoConfig{
@@ -73,15 +74,17 @@ func (cmd *RepoScanCmd) Run(_ *Globals) error {
 	if err != nil {
 		return fmt.Errorf("error creating new scanner: %w", err)
 	}
+	// Scan the repository.
 	results, err := scanner.Scan(ctx)
 	if err != nil {
 		return fmt.Errorf("error scanning repository: %w", err)
 	}
+	// Print the results to stdout.
 	jsonResults, err := json.MarshalIndent(results, "", "    ")
 	if err != nil {
 		return fmt.Errorf("error marshalling results: %w", err)
 	}
 	fmt.Println(string(jsonResults))
-	// TODO: publish results to API -ccampo 2024-04-03
+	// TODO: publish results to the API -ccampo 2024-04-03
 	return nil
 }
diff --git a/scan/scanner.go b/scan/scanner.go
index 8a39f4f..642ed4d 100644
--- a/scan/scanner.go
+++ b/scan/scanner.go
@@ -27,7 +27,7 @@ type RepoScanResults struct {
 	Classifications []Classification       `json:"classifications"`
 }
 
-// TODO: godoc -ccampo 2024-04-03
+// Classification represents the classification of a data repository attribute.
 type Classification struct {
 	// AttributePath is the full path of the data repository attribute
 	// (e.g. the column). Each element corresponds to a component, in increasing
diff --git a/sql/classify.go b/sql/classify.go
deleted file mode 100644
index 30dd914..0000000
--- a/sql/classify.go
+++ /dev/null
@@ -1,61 +0,0 @@
-package sql
-
-import (
-	"context"
-	"fmt"
-	"maps"
-	"strings"
-
-	"github.com/cyralinc/dmap/classification"
-	"github.com/cyralinc/dmap/scan"
-)
-
-// classifySamples uses the provided classifiers to classify the sample data
-// passed via the "samples" parameter. It is mostly a helper function which
-// loops through each repository.Sample, retrieves the attribute names and
-// values of that sample, passes them to Classifier.Classify, and then
-// aggregates the results. Please see the documentation for Classifier and its
-// Classify method for more details. The returned slice represents all the
-// unique classification results for a given sample set.
-func classifySamples(
-	ctx context.Context,
-	samples []Sample,
-	classifier classification.Classifier,
-) ([]scan.Classification, error) {
-	uniqueResults := make(map[string]scan.Classification)
-	for _, sample := range samples {
-		// Classify each sampled row and combine the results.
-		for _, sampleResult := range sample.Results {
-			res, err := classifier.Classify(ctx, sampleResult)
-			if err != nil {
-				return nil, fmt.Errorf("error classifying sample: %w", err)
-			}
-			for attr, labels := range res {
-				attrPath := append(sample.TablePath, attr)
-				key := pathKey(attrPath)
-				result, ok := uniqueResults[key]
-				if !ok {
-					uniqueResults[key] = scan.Classification{
-						AttributePath: attrPath,
-						Labels:        labels,
-					}
-				} else {
-					// Merge the labels from the new result into the existing result.
-					maps.Copy(result.Labels, labels)
-				}
-			}
-		}
-	}
-	// Convert the map of unique results to a slice.
-	results := make([]scan.Classification, 0, len(uniqueResults))
-	for _, result := range uniqueResults {
-		results = append(results, result)
-	}
-	return results, nil
-}
-
-func pathKey(path []string) string {
-	// U+2063 is an invisible separator. It is used here to ensure that the
-	// pathKey is unique and does not conflict with any of the path elements.
-	return strings.Join(path, "\u2063")
-}
diff --git a/sql/classify_test.go b/sql/classify_test.go
deleted file mode 100644
index abce877..0000000
--- a/sql/classify_test.go
+++ /dev/null
@@ -1,158 +0,0 @@
-package sql
-
-import (
-	"context"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-
-	"github.com/cyralinc/dmap/classification"
-	"github.com/cyralinc/dmap/scan"
-)
-
-func Test_classifySamples_SingleSample(t *testing.T) {
-	ctx := context.Background()
-	sample := Sample{
-		TablePath: []string{"db", "schema", "table"},
-		Results: []SampleResult{
-			{
-				"age":             "52",
-				"social_sec_num":  "512-23-4258",
-				"credit_card_num": "4111111111111111",
-			},
-			{
-				"age":             "101",
-				"social_sec_num":  "foobarbaz",
-				"credit_card_num": "4111111111111111",
-			},
-		},
-	}
-	classifier := NewMockClassifier(t)
-	// Need to explicitly convert it to a map because Mockery isn't smart enough
-	// to infer the type.
-	classifier.EXPECT().Classify(ctx, map[string]any(sample.Results[0])).Return(
-		classification.Result{
-			"age":             lblSet("AGE"),
-			"social_sec_num":  lblSet("SSN"),
-			"credit_card_num": lblSet("CCN"),
-		},
-		nil,
-	)
-	classifier.EXPECT().Classify(ctx, map[string]any(sample.Results[1])).Return(
-		classification.Result{
-			"age":             lblSet("AGE", "CVV"),
-			"credit_card_num": lblSet("CCN"),
-		},
-		nil,
-	)
-
-	expected := []scan.Classification{
-		{
-			AttributePath: append(sample.TablePath, "age"),
-			Labels:        lblSet("AGE", "CVV"),
-		},
-		{
-			AttributePath: append(sample.TablePath, "social_sec_num"),
-			Labels:        lblSet("SSN"),
-		},
-		{
-			AttributePath: append(sample.TablePath, "credit_card_num"),
-			Labels:        lblSet("CCN"),
-		},
-	}
-	actual, err := classifySamples(ctx, []Sample{sample}, classifier)
-	require.NoError(t, err)
-	require.ElementsMatch(t, expected, actual)
-}
-
-func Test_classifySamples_MultipleSamples(t *testing.T) {
-	ctx := context.Background()
-	samples := []Sample{
-		{
-			TablePath: []string{"db1", "schema1", "table1"},
-			Results: []SampleResult{
-				{
-					"age":             "52",
-					"social_sec_num":  "512-23-4258",
-					"credit_card_num": "4111111111111111",
-				},
-				{
-					"age":             "101",
-					"social_sec_num":  "foobarbaz",
-					"credit_card_num": "4111111111111111",
-				},
-			},
-		},
-		{
-			TablePath: []string{"db2", "schema2", "table2"},
-			Results: []SampleResult{
-				{
-					"fullname": "John Doe",
-					"dob":      "2000-01-01",
-					"random":   "foobarbaz",
-				},
-			},
-		},
-	}
-
-	classifier := NewMockClassifier(t)
-	// Need to explicitly convert it to a map because Mockery isn't smart enough
-	// to infer the type.
-	classifier.EXPECT().Classify(ctx, map[string]any(samples[0].Results[0])).Return(
-		classification.Result{
-			"age":             lblSet("AGE"),
-			"social_sec_num":  lblSet("SSN"),
-			"credit_card_num": lblSet("CCN"),
-		},
-		nil,
-	)
-	classifier.EXPECT().Classify(ctx, map[string]any(samples[0].Results[1])).Return(
-		classification.Result{
-			"age":             lblSet("AGE", "CVV"),
-			"credit_card_num": lblSet("CCN"),
-		},
-		nil,
-	)
-	classifier.EXPECT().Classify(ctx, map[string]any(samples[1].Results[0])).Return(
-		classification.Result{
-			"fullname": lblSet("FULL_NAME"),
-			"dob":      lblSet("DOB"),
-		},
-		nil,
-	)
-
-	expected := []scan.Classification{
-		{
-			AttributePath: append(samples[0].TablePath, "age"),
-			Labels:        lblSet("AGE", "CVV"),
-		},
-		{
-			AttributePath: append(samples[0].TablePath, "social_sec_num"),
-			Labels:        lblSet("SSN"),
-		},
-		{
-			AttributePath: append(samples[0].TablePath, "credit_card_num"),
-			Labels:        lblSet("CCN"),
-		},
-		{
-			AttributePath: append(samples[1].TablePath, "fullname"),
-			Labels:        lblSet("FULL_NAME"),
-		},
-		{
-			AttributePath: append(samples[1].TablePath, "dob"),
-			Labels:        lblSet("DOB"),
-		},
-	}
-	actual, err := classifySamples(ctx, samples, classifier)
-	require.NoError(t, err)
-	require.ElementsMatch(t, expected, actual)
-}
-
-func lblSet(labels ...string) classification.LabelSet {
-	set := make(classification.LabelSet)
-	for _, label := range labels {
-		set[label] = struct {
-		}{}
-	}
-	return set
-}
diff --git a/sql/config.go b/sql/config.go
index a8785b9..648fa4a 100644
--- a/sql/config.go
+++ b/sql/config.go
@@ -4,8 +4,6 @@ import (
 	"fmt"
 )
 
-const configConnOpts = "connection-string-args"
-
 // RepoConfig is the necessary configuration to connect to a data sql.
 type RepoConfig struct {
 	// Host is the hostname of the database.
@@ -24,61 +22,17 @@ type RepoConfig struct {
 	Advanced map[string]any
 }
 
-// FetchAdvancedConfigString fetches a map in the repo advanced configuration,
-// for a given repo and set of parameters. Example:
-//
-// repo-advanced:
-//
-//	snowflake:
-//	  account: exampleAccount
-//	  role: exampleRole
-//	  warehouse: exampleWarehouse
-//
-// Calling FetchAdvancedMapConfig(<the repo config above>, "snowflake",
-// []string{"account", "role", "warehouse"}) returns the map
-//
-// {"account": "exampleAccount", "role": "exampleRole", "warehouse":
-// "exampleWarehouse"}
-//
-// The suffix 'String' means that the values of the map are strings. This gives
-// room to have FetchAdvancedConfigList or FetchAdvancedConfigMap, for example,
-// without name conflicts.
-func FetchAdvancedConfigString(
-	cfg RepoConfig,
-	repo string,
-	parameters []string,
-) (map[string]string, error) {
-	advancedCfg, err := getAdvancedConfig(cfg, repo)
-	if err != nil {
-		return nil, err
-	}
-	repoSpecificMap := make(map[string]string)
-	for _, key := range parameters {
-		var valInterface any
-		var val string
-		var ok bool
-		if valInterface, ok = advancedCfg[key]; !ok {
-			return nil, fmt.Errorf("unable to find '%s' in %s advanced config", key, repo)
-		}
-		if val, ok = valInterface.(string); !ok {
-			return nil, fmt.Errorf("'%s' in %s config must be a string", key, repo)
-		}
-		repoSpecificMap[key] = val
-	}
-	return repoSpecificMap, nil
-}
-
-// getAdvancedConfig gets the Advanced field in a repo config and converts it to
-// a map[string]any. In every step, it checks for error and generates
-// nice messages.
-func getAdvancedConfig(cfg RepoConfig, repo string) (map[string]any, error) {
-	advancedCfgInterface, ok := cfg.Advanced[repo]
+// keyAsString returns the value of the given key as a string from the given
+// configuration map. It returns an error if the key does not exist or if the
+// value is not a string.
+func keyAsString(cfg map[string]any, key string) (string, error) {
+	val, ok := cfg[key]
 	if !ok {
-		return nil, fmt.Errorf("unable to find '%s' in advanced config", repo)
+		return "", fmt.Errorf("%s key does not exist", key)
 	}
-	advancedCfg, ok := advancedCfgInterface.(map[string]any)
+	valStr, ok := val.(string)
 	if !ok {
-		return nil, fmt.Errorf("'%s' in advanced config is not a map", repo)
+		return "", fmt.Errorf("%s key must be a string", key)
 	}
-	return advancedCfg, nil
+	return valStr, nil
 }
diff --git a/sql/config_test.go b/sql/config_test.go
deleted file mode 100644
index e92a5c8..0000000
--- a/sql/config_test.go
+++ /dev/null
@@ -1,77 +0,0 @@
-package sql
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/require"
-)
-
-func TestAdvancedConfigSucc(t *testing.T) {
-	sampleCfg := RepoConfig{
-		Advanced: map[string]any{
-			"snowflake": map[string]any{
-				"account":   "exampleAccount",
-				"role":      "exampleRole",
-				"warehouse": "exampleWarehouse",
-			},
-		},
-	}
-	repoSpecificMap, err := FetchAdvancedConfigString(
-		sampleCfg,
-		"snowflake", []string{"account", "role", "warehouse"},
-	)
-	require.NoError(t, err)
-	require.EqualValues(
-		t, repoSpecificMap, map[string]string{
-			"account":   "exampleAccount",
-			"role":      "exampleRole",
-			"warehouse": "exampleWarehouse",
-		},
-	)
-}
-
-func TestAdvancedConfigMissing(t *testing.T) {
-	// Without the snowflake config at all
-	sampleCfg := RepoConfig{
-		Advanced: map[string]any{},
-	}
-	_, err := FetchAdvancedConfigString(
-		sampleCfg,
-		"snowflake", []string{"account", "role", "warehouse"},
-	)
-	require.Error(t, err)
-
-	sampleCfg = RepoConfig{
-		Advanced: map[string]any{
-			"snowflake": map[string]any{
-				// Missing account
-
-				"role":      "exampleRole",
-				"warehouse": "exampleWarehouse",
-			},
-		},
-	}
-	_, err = FetchAdvancedConfigString(
-		sampleCfg,
-		"snowflake", []string{"account", "role", "warehouse"},
-	)
-	require.Error(t, err)
-}
-
-func TestAdvancedConfigMalformed(t *testing.T) {
-	sampleCfg := RepoConfig{
-		Advanced: map[string]any{
-			"snowflake": map[string]any{
-				// Let's give a _list_ of things
-				"account":   []string{"account1", "account2"},
-				"role":      []string{"role1", "role2"},
-				"warehouse": []string{"warehouse1", "warehouse2"},
-			},
-		},
-	}
-	_, err := FetchAdvancedConfigString(
-		sampleCfg,
-		"snowflake", []string{"account", "role", "warehouse"},
-	)
-	require.Error(t, err)
-}
diff --git a/sql/denodo.go b/sql/denodo.go
index 9e7a730..2e11248 100644
--- a/sql/denodo.go
+++ b/sql/denodo.go
@@ -11,11 +11,11 @@ import (
 
 const (
 	RepoTypeDenodo = "denodo"
-	// DenodoIntrospectQuery is the SQL query used to introspect the database. For
-	// Denodo, the object hierarchy is (database > views). When querying
-	// Denodo, the database corresponds to a schema, and the view corresponds
-	// to a table (see SampleTable).
-	DenodoIntrospectQuery = "SELECT " +
+	// denodoIntrospectQuery is the SQL query used to introspect the database.
+	// For Denodo, the object hierarchy is (database > views). When querying
+	// Denodo, the database corresponds to a schema, and the view corresponds to
+	// a table.
+	denodoIntrospectQuery = "SELECT " +
 		"database_name AS table_schema, " +
 		"view_name AS table_name, " +
 		"column_name, " +
@@ -36,21 +36,16 @@ var _ Repository = (*DenodoRepository)(nil)
 
 // NewDenodoRepository is the constructor for sql.
 func NewDenodoRepository(cfg RepoConfig) (*DenodoRepository, error) {
-	pgCfg, err := parsePostgresConfig(cfg)
-	if err != nil {
-		return nil, fmt.Errorf("unable to parse postgres config: %w", err)
-	}
 	if cfg.Database == "" {
 		return nil, errors.New("database name is mandatory for Denodo repositories")
 	}
 	connStr := fmt.Sprintf(
-		"postgresql://%s:%s@%s:%d/%s%s",
+		"postgresql://%s:%s@%s:%d/%s",
 		cfg.User,
 		cfg.Password,
 		cfg.Host,
 		cfg.Port,
 		cfg.Database,
-		pgCfg.ConnOptsStr,
 	)
 	generic, err := NewGenericRepository(RepoTypePostgres, cfg.Database, connStr, cfg.MaxOpenConns)
 	if err != nil {
@@ -69,7 +64,7 @@ func (r *DenodoRepository) ListDatabases(_ context.Context) ([]string, error) {
 // Repository.Introspect and GenericRepository.IntrospectWithQuery for more
 // details.
 func (r *DenodoRepository) Introspect(ctx context.Context, params IntrospectParameters) (*Metadata, error) {
-	return r.generic.IntrospectWithQuery(ctx, DenodoIntrospectQuery, params)
+	return r.generic.IntrospectWithQuery(ctx, denodoIntrospectQuery, params)
 }
 
 // SampleTable delegates sampling to GenericRepository, using a Denodo-specific
diff --git a/sql/doc.go b/sql/doc.go
index e1f8447..80ec5d7 100644
--- a/sql/doc.go
+++ b/sql/doc.go
@@ -1,14 +1,15 @@
-// Package sql provides mechanisms to perform database introspection and
-// data discovery on various SQL data repositories.
-//
-// Additionally, the Repository interface provides an API for performing
-// database introspection and data discovery on SQL databases. It encapsulates
-// the concept of a Dmap data SQL repository. All out-of-the-box Repository
-// implementations are included in their own files named after the repository
-// type, e.g. mysql.go, postgres.go, etc.
+// Package sql provides mechanisms to perform database introspection, sampling,
+// and classification on various SQL data repositories. The Repository interface
+// provides the API for performing database introspection and sampling. It
+// encapsulates the concept of a Dmap data SQL repository. All out-of-the-box
+// Repository implementations are included in their own files named after the
+// repository type, e.g. mysql.go, postgres.go, etc.
 //
 // Registry provides an API for registering and constructing Repository
 // implementations within an application. There is a global DefaultRegistry
 // which has all-out-of-the-box Repository implementations registered to it
 // by default.
+//
+// Scanner is a scan.RepoScanner implementation that can be used to perform
+// data discovery and classification on SQL repositories.
 package sql
diff --git a/sql/generic.go b/sql/generic.go
index 1c870fd..3d5e8f4 100644
--- a/sql/generic.go
+++ b/sql/generic.go
@@ -12,7 +12,7 @@ import (
 )
 
 const (
-	GenericIntrospectQuery = "SELECT " +
+	genericIntrospectQuery = "SELECT " +
 		"table_schema, " +
 		"table_name, " +
 		"column_name, " +
@@ -29,8 +29,8 @@ const (
 		"'performance_schema', " +
 		"'pg_catalog'" +
 		")"
-	GenericPingQuery           = "SELECT 1"
-	GenericSampleQueryTemplate = "SELECT %s FROM %s.%s LIMIT ? OFFSET ?"
+	genericPingQuery           = "SELECT 1"
+	genericSampleQueryTemplate = "SELECT %s FROM %s.%s LIMIT ? OFFSET ?"
 )
 
 // GenericRepository implements generic SQL functionalities that work for a
@@ -128,7 +128,7 @@ func (r *GenericRepository) Introspect(
 	ctx context.Context,
 	params IntrospectParameters,
 ) (*Metadata, error) {
-	return r.IntrospectWithQuery(ctx, GenericIntrospectQuery, params)
+	return r.IntrospectWithQuery(ctx, genericIntrospectQuery, params)
 }
 
 // IntrospectWithQuery executes a query against the information_schema table in
@@ -165,7 +165,7 @@ func (r *GenericRepository) SampleTable(
 ) (Sample, error) {
 	// ANSI SQL uses double-quotes to quote identifiers
 	attrStr := params.Metadata.QuotedAttributeNamesString("\"")
-	query := fmt.Sprintf(GenericSampleQueryTemplate, attrStr, params.Metadata.Schema, params.Metadata.Name)
+	query := fmt.Sprintf(genericSampleQueryTemplate, attrStr, params.Metadata.Schema, params.Metadata.Name)
 	return r.SampleTableWithQuery(ctx, query, params)
 }
 
@@ -213,8 +213,8 @@ func (r *GenericRepository) SampleTableWithQuery(
 // Ping verifies the connection to the database used by this repository by
 // executing a simple query. If the query fails, an error is returned.
 func (r *GenericRepository) Ping(ctx context.Context) error {
-	log.Tracef("Query: %s", GenericPingQuery)
-	rows, err := r.db.QueryContext(ctx, GenericPingQuery)
+	log.Tracef("Query: %s", genericPingQuery)
+	rows, err := r.db.QueryContext(ctx, genericPingQuery)
 	if err != nil {
 		return err
 	}
diff --git a/sql/metadata.go b/sql/metadata.go
index 622e8ef..5564661 100644
--- a/sql/metadata.go
+++ b/sql/metadata.go
@@ -87,7 +87,6 @@ func newMetadataFromQueryResult(
 		if err := rows.Scan(&attr.Schema, &attr.Table, &attr.Name, &attr.DataType); err != nil {
 			return nil, fmt.Errorf("error scanning metadata query result row: %w", err)
 		}
-
 		// Skip tables that match excludePaths or does not match includePaths.
 		log.Tracef("checking if %s.%s.%s matches excludePaths %s\n", db, attr.Schema, attr.Table, excludePaths)
 		if matchPathPatterns(db, attr.Schema, attr.Table, excludePaths) {
@@ -97,7 +96,6 @@ func newMetadataFromQueryResult(
 		if !matchPathPatterns(db, attr.Schema, attr.Table, includePaths) {
 			continue
 		}
-
 		// SchemaMetadata exists - add a table if necessary.
 		if schema, ok := repo.Schemas[attr.Schema]; ok {
 			// TableMetadata exists - just append the attribute.
@@ -116,7 +114,6 @@ func newMetadataFromQueryResult(
 			repo.Schemas[attr.Schema] = schema
 		}
 	}
-
 	// Something broke while iterating the row set.
 	if err := rows.Err(); err != nil {
 		return nil, fmt.Errorf("error iterating metadata query rows: %w", err)
diff --git a/sql/mysql.go b/sql/mysql.go
index 0973c8b..c53f49b 100644
--- a/sql/mysql.go
+++ b/sql/mysql.go
@@ -10,7 +10,7 @@ import (
 
 const (
 	RepoTypeMysql      = "mysql"
-	MySqlDatabaseQuery = `
+	mySqlDatabaseQuery = `
 SELECT 
     schema_name
 FROM 
@@ -55,7 +55,7 @@ func NewMySqlRepository(cfg RepoConfig) (*MySqlRepository, error) {
 // using a MySQL-specific database query. It delegates the actual work to
 // GenericRepository.ListDatabasesWithQuery - see that method for more details.
 func (r *MySqlRepository) ListDatabases(ctx context.Context) ([]string, error) {
-	return r.generic.ListDatabasesWithQuery(ctx, MySqlDatabaseQuery)
+	return r.generic.ListDatabasesWithQuery(ctx, mySqlDatabaseQuery)
 }
 
 // Introspect delegates introspection to GenericRepository. See
@@ -76,7 +76,7 @@ func (r *MySqlRepository) SampleTable(
 	attrStr := params.Metadata.QuotedAttributeNamesString("`")
 	// The generic select/limit/offset query and ? placeholders work fine with
 	// MySQL.
-	query := fmt.Sprintf(GenericSampleQueryTemplate, attrStr, params.Metadata.Schema, params.Metadata.Name)
+	query := fmt.Sprintf(genericSampleQueryTemplate, attrStr, params.Metadata.Schema, params.Metadata.Name)
 	return r.generic.SampleTableWithQuery(ctx, query, params)
 }
 
diff --git a/sql/mysql_test.go b/sql/mysql_test.go
index 346d05b..e3be384 100644
--- a/sql/mysql_test.go
+++ b/sql/mysql_test.go
@@ -13,7 +13,7 @@ func TestMySqlRepository_ListDatabases(t *testing.T) {
 	ctx, db, mock, r := initMySqlRepoTest(t)
 	defer func() { _ = db.Close() }()
 	dbRows := sqlmock.NewRows([]string{"name"}).AddRow("db1").AddRow("db2")
-	mock.ExpectQuery(MySqlDatabaseQuery).WillReturnRows(dbRows)
+	mock.ExpectQuery(mySqlDatabaseQuery).WillReturnRows(dbRows)
 	dbs, err := r.ListDatabases(ctx)
 	require.NoError(t, err)
 	require.ElementsMatch(t, []string{"db1", "db2"}, dbs)
diff --git a/sql/oracle.go b/sql/oracle.go
index e4c0394..7290298 100644
--- a/sql/oracle.go
+++ b/sql/oracle.go
@@ -11,7 +11,7 @@ import (
 
 const (
 	RepoTypeOracle        = "oracle"
-	OracleIntrospectQuery = `
+	oracleIntrospectQuery = `
 WITH users AS (
   SELECT
     username
@@ -48,7 +48,7 @@ var _ Repository = (*OracleRepository)(nil)
 
 // NewOracleRepository creates a new Oracle repository.
 func NewOracleRepository(cfg RepoConfig) (*OracleRepository, error) {
-	oracleCfg, err := ParseOracleConfig(cfg)
+	oracleCfg, err := NewOracleConfigFromMap(cfg.Advanced)
 	if err != nil {
 		return nil, fmt.Errorf("unable to parse oracle config: %w", err)
 	}
@@ -78,7 +78,7 @@ func (r *OracleRepository) ListDatabases(_ context.Context) ([]string, error) {
 // Oracle-specific introspection query. See Repository.Introspect and
 // GenericRepository.IntrospectWithQuery for more details.
 func (r *OracleRepository) Introspect(ctx context.Context, params IntrospectParameters) (*Metadata, error) {
-	return r.generic.IntrospectWithQuery(ctx, OracleIntrospectQuery, params)
+	return r.generic.IntrospectWithQuery(ctx, oracleIntrospectQuery, params)
 }
 
 // SampleTable delegates sampling to GenericRepository, using an Oracle-specific
@@ -119,17 +119,13 @@ type OracleConfig struct {
 	ServiceName string
 }
 
-// ParseOracleConfig parses the Oracle-specific configuration from the
-// given  The Oracle configuration is expected to be in the
-// config's "advanced config" property.
-func ParseOracleConfig(cfg RepoConfig) (*OracleConfig, error) {
-	oracleCfg, err := FetchAdvancedConfigString(
-		cfg,
-		RepoTypeOracle,
-		[]string{configServiceName},
-	)
+// NewOracleConfigFromMap creates a new OracleConfig from the given map. This is
+// useful for parsing the Oracle-specific configuration from the
+// RepoConfig.Advanced map, for example.
+func NewOracleConfigFromMap(cfg map[string]any) (OracleConfig, error) {
+	serviceName, err := keyAsString(cfg, configServiceName)
 	if err != nil {
-		return nil, fmt.Errorf("error fetching advanced oracle config: %w", err)
+		return OracleConfig{}, err
 	}
-	return &OracleConfig{ServiceName: oracleCfg[configServiceName]}, nil
+	return OracleConfig{ServiceName: serviceName}, nil
 }
diff --git a/sql/oracle_test.go b/sql/oracle_test.go
new file mode 100644
index 0000000..081e0b6
--- /dev/null
+++ b/sql/oracle_test.go
@@ -0,0 +1,44 @@
+package sql
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestNewOracleConfigFromMap(t *testing.T) {
+	tests := []struct {
+		name    string
+		cfg     map[string]any
+		want    OracleConfig
+		wantErr require.ErrorAssertionFunc
+	}{
+		{
+			name: "Returns config when ServiceName key is present",
+			cfg: map[string]any{
+				configServiceName: "testServiceName",
+			},
+			want: OracleConfig{
+				ServiceName: "testServiceName",
+			},
+		},
+		{
+			name:    "Returns error when ServiceName key is missing",
+			cfg:     map[string]any{},
+			wantErr: require.Error,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(
+			tt.name, func(t *testing.T) {
+				got, err := NewOracleConfigFromMap(tt.cfg)
+				if tt.wantErr == nil {
+					tt.wantErr = require.NoError
+				}
+				tt.wantErr(t, err)
+				require.Equal(t, tt.want, got)
+			},
+		)
+	}
+}
diff --git a/sql/postgres.go b/sql/postgres.go
index e5a81ee..f96632b 100644
--- a/sql/postgres.go
+++ b/sql/postgres.go
@@ -3,16 +3,13 @@ package sql
 import (
 	"context"
 	"fmt"
-	"strings"
-
 	// Postgresql DB driver
 	_ "github.com/lib/pq"
 )
 
 const (
 	RepoTypePostgres = "postgres"
-
-	PostgresDatabaseQuery = `
+	postgresDatabaseQuery = `
 SELECT 
 	datname 
 FROM
@@ -36,23 +33,18 @@ var _ Repository = (*PostgresRepository)(nil)
 
 // NewPostgresRepository creates a new PostgresRepository.
 func NewPostgresRepository(cfg RepoConfig) (*PostgresRepository, error) {
-	pgCfg, err := parsePostgresConfig(cfg)
-	if err != nil {
-		return nil, fmt.Errorf("error parsing postgres config: %w", err)
-	}
 	database := cfg.Database
 	// Connect to the default database, if unspecified.
 	if database == "" {
 		database = "postgres"
 	}
 	connStr := fmt.Sprintf(
-		"postgresql://%s:%s@%s:%d/%s%s",
+		"postgresql://%s:%s@%s:%d/%s",
 		cfg.User,
 		cfg.Password,
 		cfg.Host,
 		cfg.Port,
 		database,
-		pgCfg.ConnOptsStr,
 	)
 	generic, err := NewGenericRepository(RepoTypePostgres, cfg.Database, connStr, cfg.MaxOpenConns)
 	if err != nil {
@@ -65,7 +57,7 @@ func NewPostgresRepository(cfg RepoConfig) (*PostgresRepository, error) {
 // using a Postgres-specific database query. It delegates the actual work to
 // GenericRepository.ListDatabasesWithQuery - see that method for more details.
 func (r *PostgresRepository) ListDatabases(ctx context.Context) ([]string, error) {
-	return r.generic.ListDatabasesWithQuery(ctx, PostgresDatabaseQuery)
+	return r.generic.ListDatabasesWithQuery(ctx, postgresDatabaseQuery)
 }
 
 // Introspect delegates introspection to GenericRepository. See
@@ -105,87 +97,3 @@ func (r *PostgresRepository) Ping(ctx context.Context) error {
 func (r *PostgresRepository) Close() error {
 	return r.generic.Close()
 }
-
-// PostgresConfig contains Postgres-specific configuration parameters.
-type PostgresConfig struct {
-	// ConnOptsStr is a string containing Postgres-specific connection options.
-	ConnOptsStr string
-}
-
-// parsePostgresConfig parses the Postgres-specific configuration parameters
-// from the given  The Postgres connection options are built from the
-// config and stored in the ConnOptsStr field of the returned Postgres
-func parsePostgresConfig(cfg RepoConfig) (*PostgresConfig, error) {
-	connOptsStr, err := buildConnOptsStr(cfg)
-	if err != nil {
-		return nil, fmt.Errorf("error building connection options string: %w", err)
-	}
-	return &PostgresConfig{ConnOptsStr: connOptsStr}, nil
-}
-
-// buildConnOptsStr parses the repo config to produce a string in the format
-// "?option=value&option2=value2". Example:
-//
-//	buildConnOptsStr(RepoConfig{
-//	    Advanced: map[string]any{
-//	        "connection-string-args": []any{"sslmode=disable"},
-//	    },
-//	})
-//
-// returns ("?sslmode=disable", nil).
-func buildConnOptsStr(cfg RepoConfig) (string, error) {
-	connOptsMap, err := mapFromConnOpts(cfg)
-	if err != nil {
-		return "", fmt.Errorf("connection options: %w", err)
-	}
-	connOptsStr := ""
-	for key, val := range connOptsMap {
-		// Don't add if the value is empty, since that would make the
-		// string malformed.
-		if val != "" {
-			if connOptsStr == "" {
-				connOptsStr += fmt.Sprintf("%s=%s", key, val)
-			} else {
-				// Need & for subsequent options
-				connOptsStr += fmt.Sprintf("&%s=%s", key, val)
-			}
-		}
-	}
-	// Only add ? if connection string is not empty
-	if connOptsStr != "" {
-		connOptsStr = "?" + connOptsStr
-	}
-	return connOptsStr, nil
-}
-
-// mapFromConnOpts builds a map from the list of connection options given. Each
-// option has the format 'option=value'. An error is returned if the config is
-// malformed.
-func mapFromConnOpts(cfg RepoConfig) (map[string]string, error) {
-	m := make(map[string]string)
-	connOptsInterface, ok := cfg.Advanced[configConnOpts]
-	if !ok {
-		return nil, nil
-	}
-	connOpts, ok := connOptsInterface.([]any)
-	if !ok {
-		return nil, fmt.Errorf("'%s' is not a list", configConnOpts)
-	}
-	for _, optInterface := range connOpts {
-		opt, ok := optInterface.(string)
-		if !ok {
-			return nil, fmt.Errorf("'%v' is not a string", optInterface)
-		}
-		splitOpt := strings.Split(opt, "=")
-		if len(splitOpt) != 2 {
-			return nil, fmt.Errorf(
-				"malformed '%s'. "+
-					"Please follow the format 'option=value'", configConnOpts,
-			)
-		}
-		key := splitOpt[0]
-		val := splitOpt[1]
-		m[key] = val
-	}
-	return m, nil
-}
diff --git a/sql/postgres_test.go b/sql/postgres_test.go
index 84a1974..e46a2f4 100644
--- a/sql/postgres_test.go
+++ b/sql/postgres_test.go
@@ -13,76 +13,12 @@ func TestPostgresRepository_ListDatabases(t *testing.T) {
 	ctx, db, mock, r := initPostgresRepoTest(t)
 	defer func() { _ = db.Close() }()
 	dbRows := sqlmock.NewRows([]string{"name"}).AddRow("db1").AddRow("db2")
-	mock.ExpectQuery(PostgresDatabaseQuery).WillReturnRows(dbRows)
+	mock.ExpectQuery(postgresDatabaseQuery).WillReturnRows(dbRows)
 	dbs, err := r.ListDatabases(ctx)
 	require.NoError(t, err)
 	require.ElementsMatch(t, []string{"db1", "db2"}, dbs)
 }
 
-func TestBuildConnOptionsSucc(t *testing.T) {
-	sampleRepoCfg := getSampleRepoConfig()
-	connOptsStr, err := buildConnOptsStr(sampleRepoCfg)
-	require.NoError(t, err)
-	require.Equal(t, connOptsStr, "?sslmode=disable")
-}
-
-func TestBuildConnOptionsFail(t *testing.T) {
-	invalidRepoCfg := RepoConfig{
-		Advanced: map[string]any{
-			// Invalid: map instead of string
-			configConnOpts: []any{
-				map[string]string{"sslmode": "disable"},
-			},
-		},
-	}
-	connOptsStr, err := buildConnOptsStr(invalidRepoCfg)
-	require.Error(t, err)
-	require.Empty(t, connOptsStr)
-}
-
-func TestMapConnOptionsSucc(t *testing.T) {
-	sampleRepoCfg := getSampleRepoConfig()
-	connOptsMap, err := mapFromConnOpts(sampleRepoCfg)
-	require.NoError(t, err)
-	require.EqualValues(
-		t, connOptsMap, map[string]string{
-			"sslmode": "disable",
-		},
-	)
-}
-
-// The mapping should only fail if the config is malformed, not if it is missing
-func TestMapConnOptionsMissing(t *testing.T) {
-	sampleCfg := RepoConfig{}
-	optsMap, err := mapFromConnOpts(sampleCfg)
-	require.NoError(t, err)
-	require.Empty(t, optsMap)
-}
-
-func TestMapConnOptionsMalformedMap(t *testing.T) {
-	sampleCfg := RepoConfig{
-		Advanced: map[string]any{
-			// Let's put a map instead of the required list
-			configConnOpts: map[string]any{
-				"testKey": "testValue",
-			},
-		},
-	}
-	_, err := mapFromConnOpts(sampleCfg)
-	require.Error(t, err)
-}
-
-func TestMapConnOptionsMalformedColon(t *testing.T) {
-	sampleCfg := RepoConfig{
-		Advanced: map[string]any{
-			// Let's use a colon instead of '=' to divide options
-			configConnOpts: []string{"sslmode:disable"},
-		},
-	}
-	_, err := mapFromConnOpts(sampleCfg)
-	require.Error(t, err)
-}
-
 func initPostgresRepoTest(t *testing.T) (context.Context, *sql.DB, sqlmock.Sqlmock, *PostgresRepository) {
 	ctx := context.Background()
 	db, mock, err := sqlmock.New()
@@ -91,12 +27,3 @@ func initPostgresRepoTest(t *testing.T) (context.Context, *sql.DB, sqlmock.Sqlmo
 		generic: NewGenericRepositoryFromDB(RepoTypePostgres, "dbName", db),
 	}
 }
-
-// Returns a correct repo config
-func getSampleRepoConfig() RepoConfig {
-	return RepoConfig{
-		Advanced: map[string]any{
-			configConnOpts: []any{"sslmode=disable"},
-		},
-	}
-}
diff --git a/sql/redshift.go b/sql/redshift.go
index ae847e8..2f7cf93 100644
--- a/sql/redshift.go
+++ b/sql/redshift.go
@@ -24,23 +24,18 @@ var _ Repository = (*RedshiftRepository)(nil)
 
 // NewRedshiftRepository creates a new RedshiftRepository.
 func NewRedshiftRepository(cfg RepoConfig) (*RedshiftRepository, error) {
-	pgCfg, err := parsePostgresConfig(cfg)
-	if err != nil {
-		return nil, fmt.Errorf("unable to parse postgres config: %w", err)
-	}
 	database := cfg.Database
 	// Connect to the default database, if unspecified.
 	if database == "" {
 		database = "dev"
 	}
 	connStr := fmt.Sprintf(
-		"postgresql://%s:%s@%s:%d/%s%s",
+		"postgresql://%s:%s@%s:%d/%s",
 		cfg.User,
 		cfg.Password,
 		cfg.Host,
 		cfg.Port,
 		database,
-		pgCfg.ConnOptsStr,
 	)
 	generic, err := NewGenericRepository(RepoTypePostgres, cfg.Database, connStr, cfg.MaxOpenConns)
 	if err != nil {
@@ -54,7 +49,7 @@ func NewRedshiftRepository(cfg RepoConfig) (*RedshiftRepository, error) {
 // GenericRepository.ListDatabasesWithQuery - see that method for more details.
 func (r *RedshiftRepository) ListDatabases(ctx context.Context) ([]string, error) {
 	// Redshift and Postgres use the same query to list the server databases.
-	return r.generic.ListDatabasesWithQuery(ctx, PostgresDatabaseQuery)
+	return r.generic.ListDatabasesWithQuery(ctx, postgresDatabaseQuery)
 }
 
 // Introspect delegates introspection to GenericRepository. See
diff --git a/sql/redshift_test.go b/sql/redshift_test.go
index 3b45d75..4f1fadd 100644
--- a/sql/redshift_test.go
+++ b/sql/redshift_test.go
@@ -13,7 +13,7 @@ func TestRedshiftRepository_ListDatabases(t *testing.T) {
 	ctx, db, mock, r := initRedshiftRepoTest(t)
 	defer func() { _ = db.Close() }()
 	dbRows := sqlmock.NewRows([]string{"name"}).AddRow("db1").AddRow("db2")
-	mock.ExpectQuery(PostgresDatabaseQuery).WillReturnRows(dbRows)
+	mock.ExpectQuery(postgresDatabaseQuery).WillReturnRows(dbRows)
 	dbs, err := r.ListDatabases(ctx)
 	require.NoError(t, err)
 	require.ElementsMatch(t, []string{"db1", "db2"}, dbs)
diff --git a/sql/sample.go b/sql/sample.go
deleted file mode 100644
index 5497f7c..0000000
--- a/sql/sample.go
+++ /dev/null
@@ -1,190 +0,0 @@
-package sql
-
-import (
-	"context"
-	"fmt"
-	"sync"
-
-	"github.com/hashicorp/go-multierror"
-	log "github.com/sirupsen/logrus"
-	"golang.org/x/sync/semaphore"
-)
-
-// sampleAndErr is a "pair" type intended to be passed to a channel (see
-// sampleDb)
-type sampleAndErr struct {
-	sample Sample
-	err    error
-}
-
-// samplesAndErr is a "pair" type intended to be passed to a channel (see
-// sampleAllDbs)
-type samplesAndErr struct {
-	samples []Sample
-	err     error
-}
-
-// sampleAllDbs uses the given Repository to list all the
-// databases on the server, and samples each one in parallel by calling
-// sampleDb for each database. The repository is intended to be
-// configured to connect to the default database on the server, or at least some
-// database which can be used to enumerate the full set of databases on the
-// server. An error will be returned if the set of databases cannot be listed.
-// If there is an error connecting to or sampling a database, the error will be
-// logged and no samples will be returned for that database. Therefore, the
-// returned slice of samples contains samples for only the databases which could
-// be discovered and successfully sampled, and could potentially be empty if no
-// databases were sampled.
-func sampleAllDbs(
-	ctx context.Context,
-	ctor RepoConstructor,
-	cfg RepoConfig,
-	introspectParams IntrospectParameters,
-	sampleSize, offset uint,
-) (
-	[]Sample,
-	error,
-) {
-	// Create a repository instance that will be used to list all the databases
-	// on the server.
-	repo, err := ctor(ctx, cfg)
-	if err != nil {
-		return nil, fmt.Errorf("error creating repository instance: %w", err)
-	}
-	defer func() { _ = repo.Close() }()
-
-	// We assume that this repository will be connected to the default database
-	// (or at least some database that can discover all the other databases),
-	// and we use that to discover all other databases.
-	dbs, err := repo.ListDatabases(ctx)
-	if err != nil {
-		return nil, fmt.Errorf("error listing databases: %w", err)
-	}
-
-	// Sample each database on a separate goroutine, and send the samples to
-	// the 'out' channel. Each slice of samples will be aggregated below on the
-	// main goroutine and returned.
-	var wg sync.WaitGroup
-	out := make(chan samplesAndErr)
-	wg.Add(len(dbs))
-	// Ensures that we avoid opening more than the specified number of
-	// connections.
-	var sema *semaphore.Weighted
-	if cfg.MaxOpenConns > 0 {
-		sema = semaphore.NewWeighted(int64(cfg.MaxOpenConns))
-	}
-	for _, db := range dbs {
-		go func(db string, cfg RepoConfig) {
-			defer wg.Done()
-			if sema != nil {
-				_ = sema.Acquire(ctx, 1)
-				defer sema.Release(1)
-			}
-			// Create a repository instance for this specific database. It will
-			// be used to connect to and sample the database.
-			cfg.Database = db
-			repo, err := ctor(ctx, cfg)
-			if err != nil {
-				log.WithError(err).Errorf("error creating repository instance for database %s", db)
-				return
-			}
-			defer func() { _ = repo.Close() }()
-			// Sample the database.
-			s, err := sampleDb(ctx, repo, introspectParams, sampleSize, offset)
-			if err != nil && len(s) == 0 {
-				log.WithError(err).Errorf("error gathering repository data samples for database %s", db)
-				return
-			}
-			// Send the samples for this database to the 'out' channel. The
-			// samples for each database will be aggregated into a single slice
-			// on the main goroutine and returned.
-			out <- samplesAndErr{samples: s, err: err}
-		}(db, cfg)
-	}
-
-	// Start a goroutine to close the 'out' channel once all the goroutines
-	// we launched above are done. This will allow the aggregation range loop
-	// below to terminate properly. Note that this must start after the wg.Add
-	// call. See https://go.dev/blog/pipelines ("Fan-out, fan-in" section).
-	go func() {
-		wg.Wait()
-		close(out)
-	}()
-
-	// Aggregate and return the results.
-	var ret []Sample
-	var errs error
-	for res := range out {
-		ret = append(ret, res.samples...)
-		if res.err != nil {
-			errs = multierror.Append(errs, res.err)
-		}
-	}
-	return ret, errs
-}
-
-// sampleDb is a helper function which will sample every table in a
-// given repository and return them as a collection of Sample. First the
-// repository is introspected by calling Introspect to return the
-// repository metadata (Metadata). Then, for each schema and table in the
-// metadata, it calls SampleTable in a new goroutine. Once all the
-// sampling goroutines are finished, their results are collected and returned
-// as a slice of Sample.
-func sampleDb(
-	ctx context.Context,
-	repo Repository,
-	introspectParams IntrospectParameters,
-	sampleSize, offset uint,
-) (
-	[]Sample,
-	error,
-) {
-	// Introspect the repository to get the metadata.
-	meta, err := repo.Introspect(ctx, introspectParams)
-	if err != nil {
-		return nil, fmt.Errorf("error introspecting repository: %w", err)
-	}
-
-	// Fan out sample executions.
-	out := make(chan sampleAndErr)
-	numTables := 0
-	for _, schemaMeta := range meta.Schemas {
-		for _, tableMeta := range schemaMeta.Tables {
-			numTables++
-			go func(meta *TableMetadata) {
-				params := SampleParameters{
-					Metadata:   meta,
-					SampleSize: sampleSize,
-					Offset:     offset,
-				}
-				sample, err := repo.SampleTable(ctx, params)
-				select {
-				case <-ctx.Done():
-					return
-				case out <- sampleAndErr{sample: sample, err: err}:
-				}
-			}(tableMeta)
-		}
-	}
-
-	// Aggregate and return the results.
-	var samples []Sample
-	var errs error
-	for i := 0; i < numTables; i++ {
-		select {
-		case <-ctx.Done():
-			return samples, ctx.Err()
-		case res:= <-out:
-			if res.err != nil {
-				errs = multierror.Append(errs, res.err)
-			} else {
-				samples = append(samples, res.sample)
-			}
-		}
-	}
-	close(out)
-	if errs != nil {
-		return samples, fmt.Errorf("error(s) while sampling repository: %w", errs)
-	}
-	return samples, nil
-}
diff --git a/sql/sample_test.go b/sql/sample_test.go
deleted file mode 100644
index 811cfa5..0000000
--- a/sql/sample_test.go
+++ /dev/null
@@ -1,205 +0,0 @@
-package sql
-
-import (
-	"context"
-	"errors"
-	"testing"
-
-	"github.com/stretchr/testify/mock"
-	"github.com/stretchr/testify/require"
-)
-
-var (
-	table1Sample = Sample{
-		TablePath: []string{"database", "schema1", "table1"},
-		Results: []SampleResult{
-			{
-				"name1": "foo",
-				"name2": "bar",
-			},
-			{
-				"name1": "baz",
-				"name2": "qux",
-			},
-		},
-	}
-
-	table2Sample = Sample{
-		TablePath: []string{"database", "schema2", "table2"},
-		Results: []SampleResult{
-			{
-				"name3": "foo1",
-				"name4": "bar1",
-			},
-			{
-				"name3": "baz1",
-				"name4": "qux1",
-			},
-		},
-	}
-)
-
-func Test_sampleDb_Success(t *testing.T) {
-	ctx := context.Background()
-	repo := NewMockRepository(t)
-	meta := Metadata{
-		Database: "database",
-		Schemas: map[string]*SchemaMetadata{
-			"schema1": {
-				Name: "",
-				Tables: map[string]*TableMetadata{
-					"table1": {
-						Schema: "schema1",
-						Name:   "table1",
-						Attributes: []*AttributeMetadata{
-							{
-								Schema:   "schema1",
-								Table:    "table1",
-								Name:     "name1",
-								DataType: "varchar",
-							},
-							{
-								Schema:   "schema1",
-								Table:    "table1",
-								Name:     "name2",
-								DataType: "decimal",
-							},
-						},
-					},
-				},
-			},
-			"schema2": {
-				Name: "",
-				Tables: map[string]*TableMetadata{
-					"table2": {
-						Schema: "schema2",
-						Name:   "table2",
-						Attributes: []*AttributeMetadata{
-							{
-								Schema:   "schema2",
-								Table:    "table2",
-								Name:     "name3",
-								DataType: "int",
-							},
-							{
-								Schema:   "schema2",
-								Table:    "table2",
-								Name:     "name4",
-								DataType: "timestamp",
-							},
-						},
-					},
-				},
-			},
-		},
-	}
-	repo.EXPECT().Introspect(ctx, mock.Anything).Return(&meta, nil)
-	sampleParams1 := SampleParameters{
-		Metadata: meta.Schemas["schema1"].Tables["table1"],
-	}
-	sampleParams2 := SampleParameters{
-		Metadata: meta.Schemas["schema2"].Tables["table2"],
-	}
-	repo.EXPECT().SampleTable(ctx, sampleParams1).Return(table1Sample, nil)
-	repo.EXPECT().SampleTable(ctx, sampleParams2).Return(table2Sample, nil)
-	samples, err := sampleDb(ctx, repo, IntrospectParameters{}, 0, 0)
-	require.NoError(t, err)
-	// Order is not important and is actually non-deterministic due to concurrency
-	expected := []Sample{table1Sample, table2Sample}
-	require.ElementsMatch(t, expected, samples)
-}
-
-func Test_sampleDb_PartialError(t *testing.T) {
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-	repo := NewMockRepository(t)
-	meta := Metadata{
-		Database: "database",
-		Schemas: map[string]*SchemaMetadata{
-			"schema1": {
-				Name: "",
-				Tables: map[string]*TableMetadata{
-					"table1": {
-						Schema: "schema1",
-						Name:   "table1",
-						Attributes: []*AttributeMetadata{
-							{
-								Schema:   "schema1",
-								Table:    "table1",
-								Name:     "name1",
-								DataType: "varchar",
-							},
-							{
-								Schema:   "schema1",
-								Table:    "table1",
-								Name:     "name2",
-								DataType: "decimal",
-							},
-						},
-					},
-					"forbidden": {
-						Schema: "schema1",
-						Name:   "forbidden",
-						Attributes: []*AttributeMetadata{
-							{
-								Schema:   "schema1",
-								Table:    "forbidden",
-								Name:     "name1",
-								DataType: "varchar",
-							},
-							{
-								Schema:   "schema1",
-								Table:    "forbidden",
-								Name:     "name2",
-								DataType: "decimal",
-							},
-						},
-					},
-				},
-			},
-			"schema2": {
-				Name: "",
-				Tables: map[string]*TableMetadata{
-					"table2": {
-						Schema: "schema2",
-						Name:   "table2",
-						Attributes: []*AttributeMetadata{
-							{
-								Schema:   "schema2",
-								Table:    "table2",
-								Name:     "name3",
-								DataType: "int",
-							},
-							{
-								Schema:   "schema2",
-								Table:    "table2",
-								Name:     "name4",
-								DataType: "timestamp",
-							},
-						},
-					},
-				},
-			},
-		},
-	}
-	repo.EXPECT().Introspect(ctx, mock.Anything).Return(&meta, nil)
-	sampleParams1 := SampleParameters{
-		Metadata: meta.Schemas["schema1"].Tables["table1"],
-	}
-	sampleParams2 := SampleParameters{
-		Metadata: meta.Schemas["schema1"].Tables["forbidden"],
-	}
-	sampleParamsForbidden := SampleParameters{
-		Metadata: meta.Schemas["schema2"].Tables["table2"],
-	}
-	repo.EXPECT().SampleTable(ctx, sampleParams1).Return(table1Sample, nil)
-	errForbidden := errors.New("forbidden table")
-	repo.EXPECT().SampleTable(ctx, sampleParamsForbidden).Return(Sample{}, errForbidden)
-	repo.EXPECT().SampleTable(ctx, sampleParams2).Return(table2Sample, nil)
-
-	samples, err := sampleDb(ctx, repo, IntrospectParameters{}, 0, 0)
-	require.ErrorIs(t, err, errForbidden)
-	// Order is not important and is actually non-deterministic due to concurrency
-	expected := []Sample{table1Sample, table2Sample}
-	require.ElementsMatch(t, expected, samples)
-}
diff --git a/sql/samplealldatabases_test.go b/sql/samplealldatabases_test.go
deleted file mode 100644
index 831c7df..0000000
--- a/sql/samplealldatabases_test.go
+++ /dev/null
@@ -1,182 +0,0 @@
-package sql
-
-import (
-	"context"
-	"errors"
-	"testing"
-
-	"github.com/stretchr/testify/mock"
-	"github.com/stretchr/testify/require"
-)
-
-func Test_sampleAllDbs_Error(t *testing.T) {
-	ctx := context.Background()
-	listDbErr := errors.New("error listing databases")
-	repo := NewMockRepository(t)
-	repo.EXPECT().ListDatabases(ctx).Return(nil, listDbErr)
-	repo.EXPECT().Close().Return(nil)
-	ctor := func(ctx context.Context, cfg RepoConfig) (Repository, error) {
-		return repo, nil
-	}
-	cfg := RepoConfig{}
-	samples, err := sampleAllDbs(ctx, ctor, cfg, IntrospectParameters{}, 0, 0)
-	require.Nil(t, samples)
-	require.ErrorIs(t, err, listDbErr)
-}
-
-func Test_sampleAllDbs_Successful_TwoDatabases(t *testing.T) {
-	ctx := context.Background()
-	dbs := []string{"db1", "db2"}
-	// Dummy metadata returned for each Introspect call
-	meta := Metadata{
-		Database: "db",
-		Schemas: map[string]*SchemaMetadata{
-			"schema": {
-				Name: "schema",
-				Tables: map[string]*TableMetadata{
-					"table": {
-						Schema: "schema",
-						Name:   "table",
-						Attributes: []*AttributeMetadata{
-							{
-								Schema:   "schema",
-								Table:    "table",
-								Name:     "attr",
-								DataType: "string",
-							},
-						},
-					},
-				},
-			},
-		},
-	}
-	sample := Sample{
-		TablePath: []string{"db", "schema", "table"},
-		Results: []SampleResult{
-			{
-				"attr": "foo",
-			},
-		},
-	}
-	repo := NewMockRepository(t)
-	repo.EXPECT().ListDatabases(ctx).Return(dbs, nil)
-	repo.EXPECT().Introspect(ctx, mock.Anything).Return(&meta, nil)
-	repo.EXPECT().SampleTable(ctx, mock.Anything).Return(sample, nil)
-	repo.EXPECT().Close().Return(nil)
-	ctor := func(ctx context.Context, cfg RepoConfig) (Repository, error) {
-		return repo, nil
-	}
-	samples, err := sampleAllDbs(ctx, ctor, RepoConfig{}, IntrospectParameters{}, 0, 0)
-	require.NoError(t, err)
-	// Two databases should be sampled, and our mock will return the sample for
-	// each sample call. This really just asserts that we've sampled the correct
-	// number of times.
-	require.ElementsMatch(t, samples, []Sample{sample, sample})
-}
-
-func Test_sampleAllDbs_IntrospectError(t *testing.T) {
-	ctx := context.Background()
-	dbs := []string{"db1", "db2"}
-	introspectErr := errors.New("introspect error")
-	repo := NewMockRepository(t)
-	repo.EXPECT().ListDatabases(ctx).Return(dbs, nil)
-	repo.EXPECT().Introspect(ctx, mock.Anything).Return(nil, introspectErr)
-	repo.EXPECT().Close().Return(nil)
-	ctor := func(ctx context.Context, cfg RepoConfig) (Repository, error) {
-		return repo, nil
-	}
-	samples, err := sampleAllDbs(ctx, ctor, RepoConfig{}, IntrospectParameters{}, 0, 0)
-	require.Empty(t, samples)
-	require.NoError(t, err)
-}
-
-func Test_sampleAllDbs_SampleError(t *testing.T) {
-	ctx := context.Background()
-	dbs := []string{"db1", "db2"}
-	// Dummy metadata returned for each Introspect call
-	meta := Metadata{
-		Database: "db",
-		Schemas: map[string]*SchemaMetadata{
-			"schema": {
-				Name: "schema",
-				Tables: map[string]*TableMetadata{
-					"table": {
-						Schema: "schema",
-						Name:   "table",
-						Attributes: []*AttributeMetadata{
-							{
-								Schema:   "schema",
-								Table:    "table",
-								Name:     "attr",
-								DataType: "string",
-							},
-						},
-					},
-				},
-			},
-		},
-	}
-	sampleErr := errors.New("sample error")
-	repo := NewMockRepository(t)
-	repo.EXPECT().ListDatabases(ctx).Return(dbs, nil)
-	repo.EXPECT().Introspect(ctx, mock.Anything).Return(&meta, nil)
-	repo.EXPECT().SampleTable(ctx, mock.Anything).Return(Sample{}, sampleErr)
-	repo.EXPECT().Close().Return(nil)
-	ctor := func(ctx context.Context, cfg RepoConfig) (Repository, error) {
-		return repo, nil
-	}
-	samples, err := sampleAllDbs(ctx, ctor, RepoConfig{}, IntrospectParameters{}, 0, 0)
-	require.NoError(t, err)
-	require.Empty(t, samples)
-}
-
-func Test_sampleAllDbs_TwoDatabases_OneSampleError(t *testing.T) {
-	ctx := context.Background()
-	dbs := []string{"db1", "db2"}
-	// Dummy metadata returned for each Introspect call
-	meta := Metadata{
-		Database: "db",
-		Schemas: map[string]*SchemaMetadata{
-			"schema": {
-				Name: "schema",
-				Tables: map[string]*TableMetadata{
-					"table": {
-						Schema: "schema",
-						Name:   "table",
-						Attributes: []*AttributeMetadata{
-							{
-								Schema:   "schema",
-								Table:    "table",
-								Name:     "attr",
-								DataType: "string",
-							},
-						},
-					},
-				},
-			},
-		},
-	}
-	sample := Sample{
-		TablePath: []string{"db", "schema", "table"},
-		Results: []SampleResult{
-			{
-				"attr": "foo",
-			},
-		},
-	}
-	sampleErr := errors.New("sample error")
-	repo := NewMockRepository(t)
-	repo.EXPECT().ListDatabases(ctx).Return(dbs, nil)
-	repo.EXPECT().Introspect(ctx, mock.Anything).Return(&meta, nil)
-	repo.EXPECT().SampleTable(ctx, mock.Anything).Return(sample, nil).Once()
-	repo.EXPECT().SampleTable(ctx, mock.Anything).Return(Sample{}, sampleErr).Once()
-	repo.EXPECT().Close().Return(nil)
-	ctor := func(ctx context.Context, cfg RepoConfig) (Repository, error) {
-		return repo, nil
-	}
-	samples, err := sampleAllDbs(ctx, ctor, RepoConfig{}, IntrospectParameters{}, 0, 0)
-	require.NoError(t, err)
-	// Because of a single sample error, we expect only one database was
-	// sampled.
-	require.ElementsMatch(t, samples, []Sample{sample})
-}
diff --git a/sql/scanner.go b/sql/scanner.go
index 72e7710..e14454a 100644
--- a/sql/scanner.go
+++ b/sql/scanner.go
@@ -2,10 +2,15 @@ package sql
 
 import (
 	"context"
+	"errors"
 	"fmt"
+	"maps"
+	"strings"
+	"sync"
 
 	"github.com/gobwas/glob"
 	log "github.com/sirupsen/logrus"
+	"golang.org/x/sync/semaphore"
 
 	"github.com/cyralinc/dmap/classification"
 	"github.com/cyralinc/dmap/scan"
@@ -58,8 +63,23 @@ func NewScanner(cfg ScannerConfig) (*Scanner, error) {
 // repository, classifies the sampled data, and publishes the results to the
 // configured classification publisher.
 func (s *Scanner) Scan(ctx context.Context) (*scan.RepoScanResults, error) {
-	// Introspect and sample the data repository.
-	samples, err := s.sample(ctx)
+	// First introspect and sample the data repository.
+	var (
+		samples []Sample
+		err     error
+	)
+	// Check if the user specified a single database, or told us to scan an
+	// Oracle DB. In that case, therefore we only need to sample that single
+	// database. Note that Oracle doesn't really have the concept of
+	// "databases", therefore a single repository instance will always scan the
+	// entire database.
+	if s.Config.RepoConfig.Database != "" || s.Config.RepoType == RepoTypeOracle {
+		samples, err = s.sampleDb(ctx, s.Config.RepoConfig.Database)
+	} else {
+		// The name of the database to connect to has been left unspecified by
+		// the user, so we try to connect and sample all databases instead.
+		samples, err = s.sampleAllDbs(ctx)
+	}
 	if err != nil {
 		msg := "error sampling repository"
 		// If we didn't get any samples, just return the error.
@@ -71,7 +91,7 @@ func (s *Scanner) Scan(ctx context.Context) (*scan.RepoScanResults, error) {
 		log.WithError(err).Warn(msg)
 	}
 	// Classify the sampled data.
-	classifications, err := classifySamples(ctx, samples, s.classifier)
+	classifications, err := s.classifySamples(ctx, samples)
 	if err != nil {
 		return nil, fmt.Errorf("error classifying samples: %w", err)
 	}
@@ -81,41 +101,232 @@ func (s *Scanner) Scan(ctx context.Context) (*scan.RepoScanResults, error) {
 	}, nil
 }
 
-func (s *Scanner) sample(ctx context.Context) ([]Sample, error) {
-	// This closure is used to create a new repository instance for each
-	// database that is sampled. When there are multiple databases to sample,
-	// it is passed to sampleAllDbs to create the necessary repository instances
-	// for each database. When there is only a single database to sample, it is
-	// used directly below to create the repository instance for that database,
-	// which is passed to sampleDb to sample the database.
-	newRepo := func(ctx context.Context, cfg RepoConfig) (Repository, error) {
-		return s.Config.Registry.NewRepository(ctx, s.Config.RepoType, cfg)
+// sampleDb is samples every table in a given database and returns the samples.
+// The repository instance is created with the provided database name by
+// newRepository. The database is then introspected by calling
+// Repository.Introspect to return the repository metadata (Metadata). Then, for
+// each schema and table in the metadata, it calls Repository.SampleTable in a
+// new goroutine to sample all tables concurrently. Note however that the level
+// of concurrency should be limited by the max number of open connections
+// specified for the scanner, since the underlying repository should respect
+// this across goroutines. This of course depends on the implementation, however
+// for all the out-of-the-box Repository implementations, this applies. Once all
+// the sampling goroutines are finished, their results are collected and
+// returned as a slice of Sample.
+func (s *Scanner) sampleDb(ctx context.Context, db string) ([]Sample, error) {
+	// Create the repository instance that will be used to sample the database.
+	cfg := s.Config.RepoConfig
+	cfg.Database = db
+	repo, err := s.newRepository(ctx, cfg)
+	if err != nil {
+		return nil, fmt.Errorf("error creating repository instance: %w", err)
 	}
+	defer func() { _ = repo.Close() }()
+	// Introspect the repository to get the metadata.
 	introspectParams := IntrospectParameters{
 		IncludePaths: s.Config.IncludePaths,
 		ExcludePaths: s.Config.ExcludePaths,
 	}
-	// Check if the user specified a single database, or told us to scan an
-	// Oracle DB. In that case, therefore we only need to sample that single
-	// database. Note that Oracle doesn't really have the concept of
-	// "databases", therefore a single repository instance will always scan the
-	// entire database.
-	if s.Config.RepoConfig.Database != "" || s.Config.RepoType == RepoTypeOracle {
-		repo, err := newRepo(ctx, s.Config.RepoConfig)
-		if err != nil {
-			return nil, fmt.Errorf("error creating repository: %w", err)
+	meta, err := repo.Introspect(ctx, introspectParams)
+	if err != nil {
+		return nil, fmt.Errorf("error introspecting repository: %w", err)
+	}
+	// This is a "pair" type intended to be passed to the channel below.
+	type sampleAndErr struct {
+		sample Sample
+		err    error
+	}
+	// Fan out sample executions.
+	out := make(chan sampleAndErr)
+	numTables := 0
+	for _, schemaMeta := range meta.Schemas {
+		for _, tableMeta := range schemaMeta.Tables {
+			numTables++
+			go func(meta *TableMetadata) {
+				params := SampleParameters{
+					Metadata:   meta,
+					SampleSize: s.Config.SampleSize,
+					Offset:     s.Config.Offset,
+				}
+				sample, err := repo.SampleTable(ctx, params)
+				select {
+				case <-ctx.Done():
+					return
+				case out <- sampleAndErr{sample: sample, err: err}:
+				}
+			}(tableMeta)
 		}
-		defer func() { _ = repo.Close() }()
-		return sampleDb(ctx, repo, introspectParams, s.Config.SampleSize, s.Config.Offset)
-	}
-	// The name of the database to connect to has been left unspecified by the
-	// user, so we try to connect and sample all databases instead.
-	return sampleAllDbs(
-		ctx,
-		newRepo,
-		s.Config.RepoConfig,
-		introspectParams,
-		s.Config.SampleSize,
-		s.Config.Offset,
-	)
+	}
+
+	// Aggregate and return the results.
+	var samples []Sample
+	var errs error
+	for i := 0; i < numTables; i++ {
+		select {
+		case <-ctx.Done():
+			return samples, ctx.Err()
+		case res := <-out:
+			if res.err != nil {
+				errs = errors.Join(errs, res.err)
+			} else {
+				samples = append(samples, res.sample)
+			}
+		}
+	}
+	close(out)
+	if errs != nil {
+		return samples, fmt.Errorf("error(s) while sampling repository: %w", errs)
+	}
+	return samples, nil
+}
+
+// sampleAllDbs samples all the databases on the server. It samples each
+// database concurrently by calling sampleDb for each database on a new
+// goroutine. It first creates a new Repository instance by calling
+// newRepository. This repository is intended to be configured to connect to the
+// default database on the server, or at least some database which can be used
+// to enumerate the full set of databases on the server. An error will be
+// returned if the set of databases cannot be listed. If there is an error
+// connecting to or sampling a database, the error will be logged and no samples
+// will be returned for that database. Therefore, the returned slice of samples
+// contains samples for only the databases which could be discovered and
+// successfully sampled, and could potentially be empty if no databases were
+// sampled.
+func (s *Scanner) sampleAllDbs(ctx context.Context) ([]Sample, error) {
+	// Create a repository instance that will be used to list all the databases
+	// on the server.
+	repo, err := s.newRepository(ctx, s.Config.RepoConfig)
+	if err != nil {
+		return nil, fmt.Errorf("error creating repository instance: %w", err)
+	}
+	defer func() { _ = repo.Close() }()
+
+	// We assume that this repository will be connected to the default database
+	// (or at least some database that can discover all the other databases).
+	// Use it to discover all the other databases on the server.
+	dbs, err := repo.ListDatabases(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("error listing databases: %w", err)
+	}
+
+	// Sample each database on a separate goroutine, and send the samples to
+	// the 'out' channel. Each slice of samples will be aggregated below on this
+	// goroutine and returned.
+	var wg sync.WaitGroup
+	// This is a "pair" type intended to be passed to the channel below.
+	type samplesAndErr struct {
+		samples []Sample
+		err     error
+	}
+	out := make(chan samplesAndErr)
+	wg.Add(len(dbs))
+	// Using a semaphore here ensures that we avoid opening more than the
+	// specified total number of connections, since we end up creating multiple
+	// database handles (one per database).
+	var sema *semaphore.Weighted
+	if s.Config.RepoConfig.MaxOpenConns > 0 {
+		sema = semaphore.NewWeighted(int64(s.Config.RepoConfig.MaxOpenConns))
+	}
+	for _, db := range dbs {
+		go func(db string, cfg RepoConfig) {
+			defer wg.Done()
+			if sema != nil {
+				_ = sema.Acquire(ctx, 1)
+				defer sema.Release(1)
+			}
+			// Sample this specific database.
+			samples, err := s.sampleDb(ctx, db)
+			if err != nil && len(samples) == 0 {
+				log.WithError(err).Errorf("error gathering repository data samples for database %s", db)
+				return
+			}
+			// Send the samples for this database to the 'out' channel. The
+			// samples for each database will be aggregated into a single slice
+			// on the main goroutine and returned.
+			select {
+			case <-ctx.Done():
+				return
+			case out <- samplesAndErr{samples: samples, err: err}:
+			}
+		}(db, s.Config.RepoConfig)
+	}
+
+	// Start a goroutine to close the 'out' channel once all the goroutines we
+	// launched above are done. This will allow the aggregation range loop below
+	// to terminate properly. Note that this must start after the wg.Add call.
+	// See https://go.dev/blog/pipelines ("Fan-out, fan-in" section).
+	go func() { wg.Wait(); close(out) }()
+
+	// Aggregate and return the results.
+	var ret []Sample
+	var errs error
+	for {
+		select {
+		case <-ctx.Done():
+			return ret, errors.Join(errs, ctx.Err())
+		case res, ok := <-out:
+			if !ok {
+				// The 'out' channel has been closed, so we're done.
+				return ret, errs
+			}
+			ret = append(ret, res.samples...)
+			if res.err != nil {
+				errs = errors.Join(errs, res.err)
+			}
+		}
+	}
+}
+
+// classifySamples uses the scanner's classifier to classify the provided slice
+// of samples. Each sampled row is individually classified. The returned slice
+// of classifications represents all the UNIQUE classifications for a given
+// sample set.
+func (s *Scanner) classifySamples(ctx context.Context, samples []Sample) ([]scan.Classification, error) {
+	uniqueClassifications := make(map[string]scan.Classification)
+	for _, sample := range samples {
+		// Classify each sampled row and combine the classifications.
+		for _, sampleResult := range sample.Results {
+			res, err := s.classifier.Classify(ctx, sampleResult)
+			if err != nil {
+				return nil, fmt.Errorf("error classifying sample: %w", err)
+			}
+			for attr, labels := range res {
+				attrPath := append(sample.TablePath, attr)
+				// U+2063 is an invisible separator. It is used here to ensure
+				// that the path key is unique and does not conflict with any of
+				// the path elements.
+				key := strings.Join(attrPath, "\u2063")
+				result, ok := uniqueClassifications[key]
+				if !ok {
+					uniqueClassifications[key] = scan.Classification{
+						AttributePath: attrPath,
+						Labels:        labels,
+					}
+				} else {
+					// Merge the labels from the new result into the existing result.
+					maps.Copy(result.Labels, labels)
+				}
+			}
+		}
+	}
+	// Convert the map of unique classifications to a slice.
+	classifications := make([]scan.Classification, 0, len(uniqueClassifications))
+	for _, result := range uniqueClassifications {
+		classifications = append(classifications, result)
+	}
+	return classifications, nil
+}
+
+// newRepository creates a new Repository instance with the provided
+// configuration. It delegates the actual creation of the repository to the
+// scanner's Registry.NewRepository method, using the scanner's RepoType and
+// the provided configuration. You may wonder why we just don't use the
+// scanner's repo configuration directly (i.e. s.Config.RepoConfig) instead of
+// passing it as an argument. The reason is that we want to be able to create
+// a new repository instance with a different configuration than the one
+// specified in the scanner's configuration. This is useful when we want to
+// sample a specific database, for example, and we want to create a new
+// repository instance with the database name set to that specific database.
+func (s *Scanner) newRepository(ctx context.Context, cfg RepoConfig) (Repository, error) {
+	return s.Config.Registry.NewRepository(ctx, s.Config.RepoType, cfg)
 }
diff --git a/sql/scanner_test.go b/sql/scanner_test.go
index e4b317b..d4d86a4 100644
--- a/sql/scanner_test.go
+++ b/sql/scanner_test.go
@@ -1 +1,643 @@
 package sql
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	"github.com/stretchr/testify/mock"
+	"github.com/stretchr/testify/require"
+
+	"github.com/cyralinc/dmap/classification"
+	"github.com/cyralinc/dmap/scan"
+)
+
+func TestScanner_sampleDb_Success(t *testing.T) {
+	ctx := context.Background()
+	repo := NewMockRepository(t)
+	meta := Metadata{
+		Database: "database",
+		Schemas: map[string]*SchemaMetadata{
+			"schema1": {
+				Name: "",
+				Tables: map[string]*TableMetadata{
+					"table1": {
+						Schema: "schema1",
+						Name:   "table1",
+						Attributes: []*AttributeMetadata{
+							{
+								Schema:   "schema1",
+								Table:    "table1",
+								Name:     "name1",
+								DataType: "varchar",
+							},
+							{
+								Schema:   "schema1",
+								Table:    "table1",
+								Name:     "name2",
+								DataType: "decimal",
+							},
+						},
+					},
+				},
+			},
+			"schema2": {
+				Name: "",
+				Tables: map[string]*TableMetadata{
+					"table2": {
+						Schema: "schema2",
+						Name:   "table2",
+						Attributes: []*AttributeMetadata{
+							{
+								Schema:   "schema2",
+								Table:    "table2",
+								Name:     "name3",
+								DataType: "int",
+							},
+							{
+								Schema:   "schema2",
+								Table:    "table2",
+								Name:     "name4",
+								DataType: "timestamp",
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+	table1Sample := Sample{
+		TablePath: []string{"database", "schema1", "table1"},
+		Results: []SampleResult{
+			{
+				"name1": "foo",
+				"name2": "bar",
+			},
+			{
+				"name1": "baz",
+				"name2": "qux",
+			},
+		},
+	}
+	table2Sample := Sample{
+		TablePath: []string{"database", "schema2", "table2"},
+		Results: []SampleResult{
+			{
+				"name3": "foo1",
+				"name4": "bar1",
+			},
+			{
+				"name3": "baz1",
+				"name4": "qux1",
+			},
+		},
+	}
+
+	repo.EXPECT().Introspect(ctx, mock.Anything).Return(&meta, nil)
+	sampleParams1 := SampleParameters{
+		Metadata: meta.Schemas["schema1"].Tables["table1"],
+	}
+	sampleParams2 := SampleParameters{
+		Metadata: meta.Schemas["schema2"].Tables["table2"],
+	}
+	repo.EXPECT().SampleTable(ctx, sampleParams1).Return(table1Sample, nil)
+	repo.EXPECT().SampleTable(ctx, sampleParams2).Return(table2Sample, nil)
+	repo.EXPECT().Close().Return(nil)
+	repoType := "mock"
+	reg := NewRegistry()
+	reg.MustRegister(
+		repoType,
+		func(ctx context.Context, cfg RepoConfig) (Repository, error) {
+			return repo, nil
+		},
+	)
+	s := Scanner{
+		Config: ScannerConfig{
+			RepoType:   repoType,
+			RepoConfig: RepoConfig{},
+			Registry:   reg,
+		},
+	}
+	samples, err := s.sampleDb(ctx, meta.Database)
+	require.NoError(t, err)
+	// Order is not important and is actually non-deterministic due to concurrency
+	expected := []Sample{table1Sample, table2Sample}
+	require.ElementsMatch(t, expected, samples)
+}
+
+func TestScanner_sampleDb_PartialError(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	repo := NewMockRepository(t)
+	meta := Metadata{
+		Database: "database",
+		Schemas: map[string]*SchemaMetadata{
+			"schema1": {
+				Name: "",
+				Tables: map[string]*TableMetadata{
+					"table1": {
+						Schema: "schema1",
+						Name:   "table1",
+						Attributes: []*AttributeMetadata{
+							{
+								Schema:   "schema1",
+								Table:    "table1",
+								Name:     "name1",
+								DataType: "varchar",
+							},
+							{
+								Schema:   "schema1",
+								Table:    "table1",
+								Name:     "name2",
+								DataType: "decimal",
+							},
+						},
+					},
+					"forbidden": {
+						Schema: "schema1",
+						Name:   "forbidden",
+						Attributes: []*AttributeMetadata{
+							{
+								Schema:   "schema1",
+								Table:    "forbidden",
+								Name:     "name1",
+								DataType: "varchar",
+							},
+							{
+								Schema:   "schema1",
+								Table:    "forbidden",
+								Name:     "name2",
+								DataType: "decimal",
+							},
+						},
+					},
+				},
+			},
+			"schema2": {
+				Name: "",
+				Tables: map[string]*TableMetadata{
+					"table2": {
+						Schema: "schema2",
+						Name:   "table2",
+						Attributes: []*AttributeMetadata{
+							{
+								Schema:   "schema2",
+								Table:    "table2",
+								Name:     "name3",
+								DataType: "int",
+							},
+							{
+								Schema:   "schema2",
+								Table:    "table2",
+								Name:     "name4",
+								DataType: "timestamp",
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+	table1Sample := Sample{
+		TablePath: []string{"database", "schema1", "table1"},
+		Results: []SampleResult{
+			{
+				"name1": "foo",
+				"name2": "bar",
+			},
+			{
+				"name1": "baz",
+				"name2": "qux",
+			},
+		},
+	}
+	table2Sample := Sample{
+		TablePath: []string{"database", "schema2", "table2"},
+		Results: []SampleResult{
+			{
+				"name3": "foo1",
+				"name4": "bar1",
+			},
+			{
+				"name3": "baz1",
+				"name4": "qux1",
+			},
+		},
+	}
+
+	repo.EXPECT().Introspect(ctx, mock.Anything).Return(&meta, nil)
+	sampleParams1 := SampleParameters{
+		Metadata: meta.Schemas["schema1"].Tables["table1"],
+	}
+	sampleParams2 := SampleParameters{
+		Metadata: meta.Schemas["schema1"].Tables["forbidden"],
+	}
+	sampleParamsForbidden := SampleParameters{
+		Metadata: meta.Schemas["schema2"].Tables["table2"],
+	}
+	repo.EXPECT().SampleTable(ctx, sampleParams1).Return(table1Sample, nil)
+	errForbidden := errors.New("forbidden table")
+	repo.EXPECT().SampleTable(ctx, sampleParamsForbidden).Return(Sample{}, errForbidden)
+	repo.EXPECT().SampleTable(ctx, sampleParams2).Return(table2Sample, nil)
+	repo.EXPECT().Close().Return(nil)
+	repoType := "mock"
+	reg := NewRegistry()
+	reg.MustRegister(
+		repoType,
+		func(ctx context.Context, cfg RepoConfig) (Repository, error) {
+			return repo, nil
+		},
+	)
+	s := Scanner{
+		Config: ScannerConfig{
+			RepoType:   repoType,
+			RepoConfig: RepoConfig{},
+			Registry:   reg,
+		},
+	}
+	samples, err := s.sampleDb(ctx, meta.Database)
+	require.ErrorIs(t, err, errForbidden)
+	// Order is not important and is actually non-deterministic due to concurrency
+	expected := []Sample{table1Sample, table2Sample}
+	require.ElementsMatch(t, expected, samples)
+}
+
+func TestScanner_sampleAllDbs_Error(t *testing.T) {
+	ctx := context.Background()
+	listDbErr := errors.New("error listing databases")
+	repo := NewMockRepository(t)
+	repo.EXPECT().ListDatabases(ctx).Return(nil, listDbErr)
+	repo.EXPECT().Close().Return(nil)
+	repoType := "mock"
+	reg := NewRegistry()
+	reg.MustRegister(
+		repoType,
+		func(ctx context.Context, cfg RepoConfig) (Repository, error) {
+			return repo, nil
+		},
+	)
+	s := Scanner{
+		Config: ScannerConfig{
+			RepoType:   repoType,
+			RepoConfig: RepoConfig{},
+			Registry:   reg,
+		},
+	}
+	samples, err := s.sampleAllDbs(ctx)
+	require.Nil(t, samples)
+	require.ErrorIs(t, err, listDbErr)
+}
+
+func TestScanner_sampleAllDbs_Successful_TwoDatabases(t *testing.T) {
+	ctx := context.Background()
+	dbs := []string{"db1", "db2"}
+	// Dummy metadata returned for each Introspect call
+	meta := Metadata{
+		Database: "db",
+		Schemas: map[string]*SchemaMetadata{
+			"schema": {
+				Name: "schema",
+				Tables: map[string]*TableMetadata{
+					"table": {
+						Schema: "schema",
+						Name:   "table",
+						Attributes: []*AttributeMetadata{
+							{
+								Schema:   "schema",
+								Table:    "table",
+								Name:     "attr",
+								DataType: "string",
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+	sample := Sample{
+		TablePath: []string{"db", "schema", "table"},
+		Results: []SampleResult{
+			{
+				"attr": "foo",
+			},
+		},
+	}
+	repo := NewMockRepository(t)
+	repo.EXPECT().ListDatabases(ctx).Return(dbs, nil)
+	repo.EXPECT().Introspect(ctx, mock.Anything).Return(&meta, nil)
+	repo.EXPECT().SampleTable(ctx, mock.Anything).Return(sample, nil)
+	repo.EXPECT().Close().Return(nil)
+	repoType := "mock"
+	reg := NewRegistry()
+	reg.MustRegister(
+		repoType,
+		func(ctx context.Context, cfg RepoConfig) (Repository, error) {
+			return repo, nil
+		},
+	)
+	s := Scanner{
+		Config: ScannerConfig{
+			RepoType:   repoType,
+			RepoConfig: RepoConfig{},
+			Registry:   reg,
+		},
+	}
+	samples, err := s.sampleAllDbs(ctx)
+	require.NoError(t, err)
+	// Two databases should be sampled, and our mock will return the sample for
+	// each sample call. This really just asserts that we've sampled the correct
+	// number of times.
+	require.ElementsMatch(t, samples, []Sample{sample, sample})
+}
+
+func TestScanner_sampleAllDbs_IntrospectError(t *testing.T) {
+	ctx := context.Background()
+	dbs := []string{"db1", "db2"}
+	introspectErr := errors.New("introspect error")
+	repo := NewMockRepository(t)
+	repo.EXPECT().ListDatabases(ctx).Return(dbs, nil)
+	repo.EXPECT().Introspect(ctx, mock.Anything).Return(nil, introspectErr)
+	repo.EXPECT().Close().Return(nil)
+	repoType := "mock"
+	reg := NewRegistry()
+	reg.MustRegister(
+		repoType,
+		func(ctx context.Context, cfg RepoConfig) (Repository, error) {
+			return repo, nil
+		},
+	)
+	s := Scanner{
+		Config: ScannerConfig{
+			RepoType:   repoType,
+			RepoConfig: RepoConfig{},
+			Registry:   reg,
+		},
+	}
+	samples, err := s.sampleAllDbs(ctx)
+	require.Empty(t, samples)
+	require.NoError(t, err)
+}
+
+func TestScanner_sampleAllDbs_SampleError(t *testing.T) {
+	ctx := context.Background()
+	dbs := []string{"db1", "db2"}
+	// Dummy metadata returned for each Introspect call
+	meta := Metadata{
+		Database: "db",
+		Schemas: map[string]*SchemaMetadata{
+			"schema": {
+				Name: "schema",
+				Tables: map[string]*TableMetadata{
+					"table": {
+						Schema: "schema",
+						Name:   "table",
+						Attributes: []*AttributeMetadata{
+							{
+								Schema:   "schema",
+								Table:    "table",
+								Name:     "attr",
+								DataType: "string",
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+	sampleErr := errors.New("sample error")
+	repo := NewMockRepository(t)
+	repo.EXPECT().ListDatabases(ctx).Return(dbs, nil)
+	repo.EXPECT().Introspect(ctx, mock.Anything).Return(&meta, nil)
+	repo.EXPECT().SampleTable(ctx, mock.Anything).Return(Sample{}, sampleErr)
+	repo.EXPECT().Close().Return(nil)
+	repoType := "mock"
+	reg := NewRegistry()
+	reg.MustRegister(
+		repoType,
+		func(ctx context.Context, cfg RepoConfig) (Repository, error) {
+			return repo, nil
+		},
+	)
+	s := Scanner{
+		Config: ScannerConfig{
+			RepoType:   repoType,
+			RepoConfig: RepoConfig{},
+			Registry:   reg,
+		},
+	}
+	samples, err := s.sampleAllDbs(ctx)
+	require.NoError(t, err)
+	require.Empty(t, samples)
+}
+
+func TestScanner_sampleAllDbs_TwoDatabases_OneSampleError(t *testing.T) {
+	ctx := context.Background()
+	dbs := []string{"db1", "db2"}
+	// Dummy metadata returned for each Introspect call
+	meta := Metadata{
+		Database: "db",
+		Schemas: map[string]*SchemaMetadata{
+			"schema": {
+				Name: "schema",
+				Tables: map[string]*TableMetadata{
+					"table": {
+						Schema: "schema",
+						Name:   "table",
+						Attributes: []*AttributeMetadata{
+							{
+								Schema:   "schema",
+								Table:    "table",
+								Name:     "attr",
+								DataType: "string",
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+	sample := Sample{
+		TablePath: []string{"db", "schema", "table"},
+		Results: []SampleResult{
+			{
+				"attr": "foo",
+			},
+		},
+	}
+	sampleErr := errors.New("sample error")
+	repo := NewMockRepository(t)
+	repo.EXPECT().ListDatabases(ctx).Return(dbs, nil)
+	repo.EXPECT().Introspect(ctx, mock.Anything).Return(&meta, nil)
+	repo.EXPECT().SampleTable(ctx, mock.Anything).Return(sample, nil).Once()
+	repo.EXPECT().SampleTable(ctx, mock.Anything).Return(Sample{}, sampleErr).Once()
+	repo.EXPECT().Close().Return(nil)
+	repoType := "mock"
+	reg := NewRegistry()
+	reg.MustRegister(
+		repoType,
+		func(ctx context.Context, cfg RepoConfig) (Repository, error) {
+			return repo, nil
+		},
+	)
+	s := Scanner{
+		Config: ScannerConfig{
+			RepoType:   repoType,
+			RepoConfig: RepoConfig{},
+			Registry:   reg,
+		},
+	}
+	samples, err := s.sampleAllDbs(ctx)
+	require.NoError(t, err)
+	// Because of a single sample error, we expect only one database was
+	// sampled.
+	require.ElementsMatch(t, samples, []Sample{sample})
+}
+
+func TestScanner_classifySamples_SingleSample(t *testing.T) {
+	ctx := context.Background()
+	sample := Sample{
+		TablePath: []string{"db", "schema", "table"},
+		Results: []SampleResult{
+			{
+				"age":             "52",
+				"social_sec_num":  "512-23-4258",
+				"credit_card_num": "4111111111111111",
+			},
+			{
+				"age":             "101",
+				"social_sec_num":  "foobarbaz",
+				"credit_card_num": "4111111111111111",
+			},
+		},
+	}
+	classifier := NewMockClassifier(t)
+	// Need to explicitly convert it to a map because Mockery isn't smart enough
+	// to infer the type.
+	classifier.EXPECT().Classify(ctx, map[string]any(sample.Results[0])).Return(
+		classification.Result{
+			"age":             lblSet("AGE"),
+			"social_sec_num":  lblSet("SSN"),
+			"credit_card_num": lblSet("CCN"),
+		},
+		nil,
+	)
+	classifier.EXPECT().Classify(ctx, map[string]any(sample.Results[1])).Return(
+		classification.Result{
+			"age":             lblSet("AGE", "CVV"),
+			"credit_card_num": lblSet("CCN"),
+		},
+		nil,
+	)
+
+	expected := []scan.Classification{
+		{
+			AttributePath: append(sample.TablePath, "age"),
+			Labels:        lblSet("AGE", "CVV"),
+		},
+		{
+			AttributePath: append(sample.TablePath, "social_sec_num"),
+			Labels:        lblSet("SSN"),
+		},
+		{
+			AttributePath: append(sample.TablePath, "credit_card_num"),
+			Labels:        lblSet("CCN"),
+		},
+	}
+	s := Scanner{classifier: classifier}
+	actual, err := s.classifySamples(ctx, []Sample{sample})
+	require.NoError(t, err)
+	require.ElementsMatch(t, expected, actual)
+}
+
+func TestScanner_classifySamples_MultipleSamples(t *testing.T) {
+	ctx := context.Background()
+	samples := []Sample{
+		{
+			TablePath: []string{"db1", "schema1", "table1"},
+			Results: []SampleResult{
+				{
+					"age":             "52",
+					"social_sec_num":  "512-23-4258",
+					"credit_card_num": "4111111111111111",
+				},
+				{
+					"age":             "101",
+					"social_sec_num":  "foobarbaz",
+					"credit_card_num": "4111111111111111",
+				},
+			},
+		},
+		{
+			TablePath: []string{"db2", "schema2", "table2"},
+			Results: []SampleResult{
+				{
+					"fullname": "John Doe",
+					"dob":      "2000-01-01",
+					"random":   "foobarbaz",
+				},
+			},
+		},
+	}
+
+	classifier := NewMockClassifier(t)
+	// Need to explicitly convert it to a map because Mockery isn't smart enough
+	// to infer the type.
+	classifier.EXPECT().Classify(ctx, map[string]any(samples[0].Results[0])).Return(
+		classification.Result{
+			"age":             lblSet("AGE"),
+			"social_sec_num":  lblSet("SSN"),
+			"credit_card_num": lblSet("CCN"),
+		},
+		nil,
+	)
+	classifier.EXPECT().Classify(ctx, map[string]any(samples[0].Results[1])).Return(
+		classification.Result{
+			"age":             lblSet("AGE", "CVV"),
+			"credit_card_num": lblSet("CCN"),
+		},
+		nil,
+	)
+	classifier.EXPECT().Classify(ctx, map[string]any(samples[1].Results[0])).Return(
+		classification.Result{
+			"fullname": lblSet("FULL_NAME"),
+			"dob":      lblSet("DOB"),
+		},
+		nil,
+	)
+
+	expected := []scan.Classification{
+		{
+			AttributePath: append(samples[0].TablePath, "age"),
+			Labels:        lblSet("AGE", "CVV"),
+		},
+		{
+			AttributePath: append(samples[0].TablePath, "social_sec_num"),
+			Labels:        lblSet("SSN"),
+		},
+		{
+			AttributePath: append(samples[0].TablePath, "credit_card_num"),
+			Labels:        lblSet("CCN"),
+		},
+		{
+			AttributePath: append(samples[1].TablePath, "fullname"),
+			Labels:        lblSet("FULL_NAME"),
+		},
+		{
+			AttributePath: append(samples[1].TablePath, "dob"),
+			Labels:        lblSet("DOB"),
+		},
+	}
+	s := Scanner{classifier: classifier}
+	actual, err := s.classifySamples(ctx, samples)
+	require.NoError(t, err)
+	require.ElementsMatch(t, expected, actual)
+}
+
+func lblSet(labels ...string) classification.LabelSet {
+	set := make(classification.LabelSet)
+	for _, label := range labels {
+		set[label] = struct {
+		}{}
+	}
+	return set
+}
diff --git a/sql/snowflake.go b/sql/snowflake.go
index d788013..848f888 100644
--- a/sql/snowflake.go
+++ b/sql/snowflake.go
@@ -10,7 +10,7 @@ import (
 
 const (
 	RepoTypeSnowflake      = "snowflake"
-	SnowflakeDatabaseQuery = `
+	snowflakeDatabaseQuery = `
 SELECT 
     DATABASE_NAME 
 FROM 
@@ -35,7 +35,7 @@ var _ Repository = (*SnowflakeRepository)(nil)
 
 // NewSnowflakeRepository creates a new SnowflakeRepository.
 func NewSnowflakeRepository(cfg RepoConfig) (*SnowflakeRepository, error) {
-	snowflakeCfg, err := ParseSnowflakeConfig(cfg)
+	snowflakeCfg, err := NewSnowflakeConfigFromMap(cfg.Advanced)
 	if err != nil {
 		return nil, fmt.Errorf("error parsing snowflake config: %w", err)
 	}
@@ -64,7 +64,7 @@ func NewSnowflakeRepository(cfg RepoConfig) (*SnowflakeRepository, error) {
 // using a Snowflake-specific database query. It delegates the actual work to
 // GenericRepository.ListDatabasesWithQuery - see that method for more details.
 func (r *SnowflakeRepository) ListDatabases(ctx context.Context) ([]string, error) {
-	return r.generic.ListDatabasesWithQuery(ctx, SnowflakeDatabaseQuery)
+	return r.generic.ListDatabasesWithQuery(ctx, snowflakeDatabaseQuery)
 }
 
 // Introspect delegates introspection to GenericRepository. See
@@ -105,21 +105,25 @@ type SnowflakeConfig struct {
 	Warehouse string
 }
 
-// ParseSnowflakeConfig produces a config structure with Snowflake-specific
-// parameters found in the repo  The Snowflake account, role, and
-// warehouse are required in the advanced
-func ParseSnowflakeConfig(cfg RepoConfig) (*SnowflakeConfig, error) {
-	snowflakeCfg, err := FetchAdvancedConfigString(
-		cfg,
-		RepoTypeSnowflake,
-		[]string{configAccount, configRole, configWarehouse},
-	)
+// NewSnowflakeConfigFromMap creates a new SnowflakeConfig from the given map.
+// This is useful for parsing the Snowflake-specific configuration from the
+// RepoConfig.Advanced map, for example.
+func NewSnowflakeConfigFromMap(cfg map[string]any) (SnowflakeConfig, error) {
+	acct, err := keyAsString(cfg, configAccount)
+	if err != nil {
+		return SnowflakeConfig{}, err
+	}
+	role, err := keyAsString(cfg, configRole)
+	if err != nil {
+		return SnowflakeConfig{}, err
+	}
+	warehouse, err := keyAsString(cfg, configWarehouse)
 	if err != nil {
-		return nil, fmt.Errorf("error fetching advanced config string: %w", err)
+		return SnowflakeConfig{}, err
 	}
-	return &SnowflakeConfig{
-		Account:   snowflakeCfg[configAccount],
-		Role:      snowflakeCfg[configRole],
-		Warehouse: snowflakeCfg[configWarehouse],
+	return SnowflakeConfig{
+		Account:   acct,
+		Role:      role,
+		Warehouse: warehouse,
 	}, nil
 }
diff --git a/sql/snowflake_test.go b/sql/snowflake_test.go
index bfbc97d..f5a4f70 100644
--- a/sql/snowflake_test.go
+++ b/sql/snowflake_test.go
@@ -13,12 +13,71 @@ func TestSnowflakeRepository_ListDatabases(t *testing.T) {
 	ctx, db, mock, r := initSnowflakeRepoTest(t)
 	defer func() { _ = db.Close() }()
 	dbRows := sqlmock.NewRows([]string{"name"}).AddRow("db1").AddRow("db2")
-	mock.ExpectQuery(SnowflakeDatabaseQuery).WillReturnRows(dbRows)
+	mock.ExpectQuery(snowflakeDatabaseQuery).WillReturnRows(dbRows)
 	dbs, err := r.ListDatabases(ctx)
 	require.NoError(t, err)
 	require.ElementsMatch(t, []string{"db1", "db2"}, dbs)
 }
 
+func TestNewSnowflakeConfigFromMap(t *testing.T) {
+	tests := []struct {
+		name    string
+		cfg     map[string]any
+		want    SnowflakeConfig
+		wantErr require.ErrorAssertionFunc
+	}{
+		{
+			name: "Returns config when all keys are present",
+			cfg: map[string]any{
+				configAccount:   "testAccount",
+				configRole:      "testRole",
+				configWarehouse: "testWarehouse",
+			},
+			want: SnowflakeConfig{
+				Account:   "testAccount",
+				Role:      "testRole",
+				Warehouse: "testWarehouse",
+			},
+		},
+		{
+			name: "Returns error when account key is missing",
+			cfg: map[string]any{
+				configRole:      "testRole",
+				configWarehouse: "testWarehouse",
+			},
+			wantErr: require.Error,
+		},
+		{
+			name: "Returns error when role key is missing",
+			cfg: map[string]any{
+				configAccount:   "testAccount",
+				configWarehouse: "testWarehouse",
+			},
+			wantErr: require.Error,
+		},
+		{
+			name: "Returns error when warehouse key is missing",
+			cfg: map[string]any{
+				configAccount: "testAccount",
+				configRole:    "testRole",
+			},
+			wantErr: require.Error,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(
+			tt.name, func(t *testing.T) {
+				got, err := NewSnowflakeConfigFromMap(tt.cfg)
+				if tt.wantErr == nil {
+					tt.wantErr = require.NoError
+				}
+				tt.wantErr(t, err)
+				require.Equal(t, tt.want, got)
+			},
+		)
+	}
+}
+
 func initSnowflakeRepoTest(t *testing.T) (context.Context, *sql.DB, sqlmock.Sqlmock, *SnowflakeRepository) {
 	ctx := context.Background()
 	db, mock, err := sqlmock.New()
diff --git a/sql/sqlserver.go b/sql/sqlserver.go
index de8d501..b866689 100644
--- a/sql/sqlserver.go
+++ b/sql/sqlserver.go
@@ -10,30 +10,30 @@ import (
 
 const (
 	RepoTypeSqlServer = "sqlserver"
-	// SqlServerSampleQueryTemplate is the string template for the SQL query used to
+	// sqlServerSampleQueryTemplate is the string template for the SQL query used to
 	// sample a SQL Server database. SQL Server doesn't support limit/offset, so
 	// we use top. It also uses the @ symbol for statement parameter
 	// placeholders. It is intended to be templated by the database name to
 	// query.
-	SqlServerSampleQueryTemplate = `SELECT TOP (@p1) %s FROM "%s"."%s"`
-	// SqlServerDatabaseQuery is the query to list all the databases on the server, minus
+	sqlServerSampleQueryTemplate = `SELECT TOP (@p1) %s FROM "%s"."%s"`
+	// sqlServerDatabaseQuery is the query to list all the databases on the server, minus
 	// the system default databases 'model' and 'tempdb'.
-	SqlServerDatabaseQuery = "SELECT name FROM sys.databases WHERE name != 'model' AND name != 'tempdb'"
+	sqlServerDatabaseQuery = "SELECT name FROM sys.databases WHERE name != 'model' AND name != 'tempdb'"
 )
 
-// SQLServerRepository is a Repository implementation for MS SQL Server
+// SqlServerRepository is a Repository implementation for MS SQL Server
 // databases.
-type SQLServerRepository struct {
+type SqlServerRepository struct {
 	// The majority of the Repository functionality is delegated to a generic
 	// SQL repository instance.
 	generic *GenericRepository
 }
 
-// SQLServerRepository implements Repository
-var _ Repository = (*SQLServerRepository)(nil)
+// SqlServerRepository implements Repository
+var _ Repository = (*SqlServerRepository)(nil)
 
 // NewSqlServerRepository creates a new MS SQL Server sql.
-func NewSqlServerRepository(cfg RepoConfig) (*SQLServerRepository, error) {
+func NewSqlServerRepository(cfg RepoConfig) (*SqlServerRepository, error) {
 	connStr := fmt.Sprintf(
 		"sqlserver://%s:%s@%s:%d",
 		cfg.User,
@@ -49,44 +49,44 @@ func NewSqlServerRepository(cfg RepoConfig) (*SQLServerRepository, error) {
 	if err != nil {
 		return nil, fmt.Errorf("could not instantiate generic sql repository: %w", err)
 	}
-	return &SQLServerRepository{generic: generic}, nil
+	return &SqlServerRepository{generic: generic}, nil
 }
 
 // ListDatabases returns a list of the names of all databases on the server by
 // using a SQL Server-specific database query. It delegates the actual work to
 // GenericRepository.ListDatabasesWithQuery - see that method for more details.
-func (r *SQLServerRepository) ListDatabases(ctx context.Context) ([]string, error) {
-	return r.generic.ListDatabasesWithQuery(ctx, SqlServerDatabaseQuery)
+func (r *SqlServerRepository) ListDatabases(ctx context.Context) ([]string, error) {
+	return r.generic.ListDatabasesWithQuery(ctx, sqlServerDatabaseQuery)
 }
 
 // Introspect delegates introspection to GenericRepository. See
 // Repository.Introspect and GenericRepository.IntrospectWithQuery for more
 // details.
-func (r *SQLServerRepository) Introspect(ctx context.Context, params IntrospectParameters) (*Metadata, error) {
+func (r *SqlServerRepository) Introspect(ctx context.Context, params IntrospectParameters) (*Metadata, error) {
 	return r.generic.Introspect(ctx, params)
 }
 
 // SampleTable delegates sampling to GenericRepository, using a
 // SQL Server-specific table sample query. See Repository.SampleTable and
 // GenericRepository.SampleTableWithQuery for more details.
-func (r *SQLServerRepository) SampleTable(
+func (r *SqlServerRepository) SampleTable(
 	ctx context.Context,
 	params SampleParameters,
 ) (Sample, error) {
 	// Sqlserver uses double-quotes to quote identifiers
 	attrStr := params.Metadata.QuotedAttributeNamesString("\"")
-	query := fmt.Sprintf(SqlServerSampleQueryTemplate, attrStr, params.Metadata.Schema, params.Metadata.Name)
+	query := fmt.Sprintf(sqlServerSampleQueryTemplate, attrStr, params.Metadata.Schema, params.Metadata.Name)
 	return r.generic.SampleTableWithQuery(ctx, query, params)
 }
 
 // Ping delegates the ping to GenericRepository. See Repository.Ping and
 // GenericRepository.Ping for more details.
-func (r *SQLServerRepository) Ping(ctx context.Context) error {
+func (r *SqlServerRepository) Ping(ctx context.Context) error {
 	return r.generic.Ping(ctx)
 }
 
 // Close delegates the close to GenericRepository. See Repository.Close and
 // GenericRepository.Close for more details.
-func (r *SQLServerRepository) Close() error {
+func (r *SqlServerRepository) Close() error {
 	return r.generic.Close()
 }
diff --git a/sql/sqlserver_test.go b/sql/sqlserver_test.go
index 223dfec..7fbeb4f 100644
--- a/sql/sqlserver_test.go
+++ b/sql/sqlserver_test.go
@@ -13,17 +13,17 @@ func TestSqlServerRepository_ListDatabases(t *testing.T) {
 	ctx, db, mock, r := initSqlServerRepoTest(t)
 	defer func() { _ = db.Close() }()
 	dbRows := sqlmock.NewRows([]string{"name"}).AddRow("db1").AddRow("db2")
-	mock.ExpectQuery(SqlServerDatabaseQuery).WillReturnRows(dbRows)
+	mock.ExpectQuery(sqlServerDatabaseQuery).WillReturnRows(dbRows)
 	dbs, err := r.ListDatabases(ctx)
 	require.NoError(t, err)
 	require.ElementsMatch(t, []string{"db1", "db2"}, dbs)
 }
 
-func initSqlServerRepoTest(t *testing.T) (context.Context, *sql.DB, sqlmock.Sqlmock, *SQLServerRepository) {
+func initSqlServerRepoTest(t *testing.T) (context.Context, *sql.DB, sqlmock.Sqlmock, *SqlServerRepository) {
 	ctx := context.Background()
 	db, mock, err := sqlmock.New()
 	require.NoError(t, err)
-	return ctx, db, mock, &SQLServerRepository{
+	return ctx, db, mock, &SqlServerRepository{
 		generic: NewGenericRepositoryFromDB(RepoTypeSqlServer, "dbName", db),
 	}
 }

From db43f9b86f5b5809934971aa61d3d92d3ef30bc7 Mon Sep 17 00:00:00 2001
From: Chris Campo <ccampo133@users.noreply.github.com>
Date: Fri, 5 Apr 2024 11:30:11 -0400
Subject: [PATCH 12/14] PR comments

---
 classification/classification.go   | 10 +++++++
 classification/label_classifier.go | 44 ++++++++++++++++-------------
 cmd/repo_scan.go                   | 16 +++++------
 scan/scanner.go                    | 18 +++---------
 sql/registry.go                    |  8 ++++--
 sql/scanner.go                     | 45 ++++++++++++++++--------------
 sql/scanner_test.go                | 14 +++++-----
 7 files changed, 83 insertions(+), 72 deletions(-)

diff --git a/classification/classification.go b/classification/classification.go
index a93bb7c..8ce6b8a 100644
--- a/classification/classification.go
+++ b/classification/classification.go
@@ -35,3 +35,13 @@ type LabelSet map[string]struct{}
 func (l LabelSet) MarshalJSON() ([]byte, error) {
 	return json.Marshal(maps.Keys(l))
 }
+
+// Classification represents the classification of a data repository attribute.
+type Classification struct {
+	// AttributePath is the full path of the data repository attribute
+	// (e.g. the column). Each element corresponds to a component, in increasing
+	// order of granularity (e.g. [database, schema, table, column]).
+	AttributePath []string `json:"attributePath"`
+	// Labels is the set of labels that the attribute was classified as.
+	Labels LabelSet `json:"labels"`
+}
diff --git a/classification/label_classifier.go b/classification/label_classifier.go
index 0bbdb46..75850ba 100644
--- a/classification/label_classifier.go
+++ b/classification/label_classifier.go
@@ -11,38 +11,47 @@ import (
 // LabelClassifier is a Classifier implementation that uses a set of labels and
 // their classification rules to classify data.
 type LabelClassifier struct {
-	queries map[string]*rego.Rego
+	queries map[string]rego.PreparedEvalQuery
 }
 
 // LabelClassifier implements Classifier
 var _ Classifier = (*LabelClassifier)(nil)
 
 // NewLabelClassifier creates a new LabelClassifier with the provided labels.
-func NewLabelClassifier(labels ...Label) (*LabelClassifier, error) {
-	if len(labels) == 0 {
-		return nil, fmt.Errorf("labels cannot be empty")
-	}
-	queries := make(map[string]*rego.Rego, len(labels))
+func NewLabelClassifier(ctx context.Context, labels ...Label) (*LabelClassifier, error) {
+	queries := make(map[string]rego.PreparedEvalQuery, len(labels))
 	for _, lbl := range labels {
-		queries[lbl.Name] = rego.New(
+		query, err := rego.New(
 			// We only care about the 'output' variable.
 			rego.Query(lbl.ClassificationRule.Package.Path.String()+".output"),
 			rego.ParsedModule(lbl.ClassificationRule),
-		)
+		).PrepareForEval(ctx)
+		if err != nil {
+			log.WithError(err).Errorf(
+				"error preparing query for label %s; label will not be evaluated for classification",
+				lbl.Name,
+			)
+		} else {
+			queries[lbl.Name] = query
+		}
 	}
 	return &LabelClassifier{queries: queries}, nil
 }
 
-// Classify performs the classification of the provided attributes using the
-// classifier's labels and their corresponding classification rules. It returns
-// a Result, which is a map of attribute names to the set of labels that the
-// attribute was classified as.
+// Classify performs the classification of the provided input using the
+// classifier's labels and their corresponding classification rules. The input
+// parameter is a map of attribute names to their values, e.g. a single
+// database row. The classifier returns a Result, which is a map of attribute
+// names to the set of labels that the attribute was classified as.
 func (c *LabelClassifier) Classify(ctx context.Context, input map[string]any) (Result, error) {
 	result := make(Result, len(c.queries))
 	for lbl, query := range c.queries {
 		output, err := evalQuery(ctx, query, input)
 		if err != nil {
-			return nil, fmt.Errorf("error evaluating query for label %s: %w", lbl, err)
+			// A single error should not prevent the classification of other
+			// labels. Log the error and continue.
+			log.WithError(err).Errorf("error evaluating query for label %s", lbl)
+			continue
 		}
 		log.Debugf("classification results for label %s: %v", lbl, output)
 		for attrName, classified := range output {
@@ -50,6 +59,7 @@ func (c *LabelClassifier) Classify(ctx context.Context, input map[string]any) (R
 				attrLabels, ok := result[attrName]
 				if !ok {
 					attrLabels = make(LabelSet)
+
 					result[attrName] = attrLabels
 				}
 				// Add the label to the set of labels for the attribute.
@@ -63,14 +73,10 @@ func (c *LabelClassifier) Classify(ctx context.Context, input map[string]any) (R
 // evalQuery evaluates the provided Rego query with the given attributes as input, and returns the classification results. The output is a
 // map of attribute names to boolean values, where the boolean indicates whether
 // the attribute is classified as belonging to the label.
-func evalQuery(ctx context.Context, query *rego.Rego, input map[string]any) (map[string]bool, error) {
-	q, err := query.PrepareForEval(ctx)
-	if err != nil {
-		return nil, fmt.Errorf("error preparing query for evaluation: %w", err)
-	}
+func evalQuery(ctx context.Context, query rego.PreparedEvalQuery, input map[string]any) (map[string]bool, error) {
 	// Evaluate the prepared Rego query. This performs the actual classification
 	// logic.
-	res, err := q.Eval(ctx, rego.EvalInput(input))
+	res, err := query.Eval(ctx, rego.EvalInput(input))
 	if err != nil {
 		return nil, fmt.Errorf(
 			"error evaluating query for input %s; %w", input, err,
diff --git a/cmd/repo_scan.go b/cmd/repo_scan.go
index a691598..ce25984 100644
--- a/cmd/repo_scan.go
+++ b/cmd/repo_scan.go
@@ -18,12 +18,12 @@ type RepoScanCmd struct {
 	ExternalID   string         `help:"External ID of the repository." required:""`
 	Host         string         `help:"Hostname of the repository." required:""`
 	Port         uint16         `help:"Port of the repository." required:""`
-	User         string         `help:"Username to connect to the sql." required:""`
-	Password     string         `help:"Password to connect to the sql." required:""`
+	User         string         `help:"Username to connect to the repository." required:""`
+	Password     string         `help:"Password to connect to the repository." required:""`
 	Database     string         `help:"Name of the database to connect to. If not specified, the default database is used (if possible)."`
-	Advanced     map[string]any `help:"Advanced configuration for the sql."`
-	IncludePaths GlobFlag       `help:"List of glob patterns to include when introspecting the database(s)." default:"*"`
-	ExcludePaths GlobFlag       `help:"List of glob patterns to exclude when introspecting the database(s)." default:""`
+	Advanced     map[string]any `help:"Advanced configuration for the repository, semicolon separated (e.g. key1=value1;key2=value2). Please see the documentation for details on how to provide this argument for specific repository types."`
+	IncludePaths GlobFlag       `help:"List of glob patterns to include when introspecting the database(s), semicolon separated (e.g. foo*;bar*;*.baz)." default:"*"`
+	ExcludePaths GlobFlag       `help:"List of glob patterns to exclude when introspecting the database(s), semicolon separated (e.g. foo*;bar*;*.baz)." default:""`
 	MaxOpenConns uint           `help:"Maximum number of open connections to the database." default:"10"`
 	SampleSize   uint           `help:"Number of rows to sample from the repository (per table)." default:"5"`
 	Offset       uint           `help:"Offset to start sampling from." default:"0"`
@@ -36,11 +36,11 @@ type GlobFlag []glob.Glob
 // is an implementation of kong.MapperValue's Decode method.
 func (g GlobFlag) Decode(ctx *kong.DecodeContext) error {
 	var patterns string
-	if err := ctx.Scan.PopValueInto("string", &patterns); err != nil {
+	if err := ctx.Scan.PopValueInto("patterns", &patterns); err != nil {
 		return err
 	}
 	var parsedPatterns []glob.Glob
-	for _, pattern := range strings.Split(patterns, ",") {
+	for _, pattern := range strings.Split(patterns, ";") {
 		parsedPattern, err := glob.Compile(pattern)
 		if err != nil {
 			return fmt.Errorf("cannot compile %s pattern: %w", pattern, err)
@@ -70,7 +70,7 @@ func (cmd *RepoScanCmd) Run(_ *Globals) error {
 		SampleSize:   cmd.SampleSize,
 		Offset:       cmd.Offset,
 	}
-	scanner, err := sql.NewScanner(cfg)
+	scanner, err := sql.NewScanner(ctx, cfg)
 	if err != nil {
 		return fmt.Errorf("error creating new scanner: %w", err)
 	}
diff --git a/scan/scanner.go b/scan/scanner.go
index 642ed4d..c16c302 100644
--- a/scan/scanner.go
+++ b/scan/scanner.go
@@ -10,8 +10,8 @@ import (
 
 // Scanner provides an API to scan cloud environments. It should be
 // implemented for a specific cloud provider (e.g. AWS, GCP, etc.). It defines
-// the Scan method responsible for scanning the existing data repositories of
-// the corresponding cloud provider environment.
+// the Scan method responsible for discovering the existing data repositories in
+// a cloud environment.
 type Scanner interface {
 	Scan(ctx context.Context) (*ScanResults, error)
 }
@@ -23,18 +23,8 @@ type RepoScanner interface {
 
 // RepoScanResults is the result of a repository scan.
 type RepoScanResults struct {
-	Labels          []classification.Label `json:"labels"`
-	Classifications []Classification       `json:"classifications"`
-}
-
-// Classification represents the classification of a data repository attribute.
-type Classification struct {
-	// AttributePath is the full path of the data repository attribute
-	// (e.g. the column). Each element corresponds to a component, in increasing
-	// order of granularity (e.g. [database, schema, table, column]).
-	AttributePath []string `json:"attributePath"`
-	// Labels is the set of labels that the attribute was classified as.
-	Labels classification.LabelSet `json:"labels"`
+	Labels          []classification.Label          `json:"labels"`
+	Classifications []classification.Classification `json:"classifications"`
 }
 
 // RepoType defines the AWS data repository types supported (e.g. RDS, Redshift,
diff --git a/sql/registry.go b/sql/registry.go
index 5ea7136..7d756b2 100644
--- a/sql/registry.go
+++ b/sql/registry.go
@@ -19,7 +19,7 @@ var (
 
 // Registry is a repository registry that maps repository types to their
 // respective constructor functions. It is used to create new repository
-// instances based on the repository type.
+// instances based on the repository type. It is not thread-safe.
 type Registry struct {
 	constructors map[string]RepoConstructor
 }
@@ -58,7 +58,8 @@ func (r *Registry) MustRegister(repoType string, constructor RepoConstructor) {
 }
 
 // Unregister removes a repository type from the registry. If the repository
-// type is not registered, this method is a no-op.
+// type is not registered, this method is a no-op. Note that Unregister is not
+// thread-safe.
 func (r *Registry) Unregister(repoType string) {
 	delete(r.constructors, repoType)
 }
@@ -67,7 +68,8 @@ func (r *Registry) Unregister(repoType string) {
 // implementation based on the specified type, e.g. MySQL, Postgres, SQL Server,
 // etc., which must be registered with the registry. If the repository type is
 // not registered, an error is returned. A new instance of the repository is
-// returned each time this method is called.
+// returned each time this method is called. Note that NewRepository is not
+// thread-safe.
 func (r *Registry) NewRepository(ctx context.Context, repoType string, cfg RepoConfig) (Repository, error) {
 	constructor, ok := r.constructors[repoType]
 	if !ok {
diff --git a/sql/scanner.go b/sql/scanner.go
index e14454a..ae04af2 100644
--- a/sql/scanner.go
+++ b/sql/scanner.go
@@ -31,7 +31,7 @@ type ScannerConfig struct {
 // the configured external sources. It currently only supports SQL-based
 // repositories.
 type Scanner struct {
-	Config     ScannerConfig
+	config     ScannerConfig
 	labels     []classification.Label
 	classifier classification.Classifier
 }
@@ -40,7 +40,7 @@ type Scanner struct {
 var _ scan.RepoScanner = (*Scanner)(nil)
 
 // NewScanner creates a new Scanner instance with the provided configuration.
-func NewScanner(cfg ScannerConfig) (*Scanner, error) {
+func NewScanner(ctx context.Context, cfg ScannerConfig) (*Scanner, error) {
 	if cfg.RepoType == "" {
 		return nil, fmt.Errorf("repository type not specified")
 	}
@@ -52,11 +52,11 @@ func NewScanner(cfg ScannerConfig) (*Scanner, error) {
 	if err != nil {
 		return nil, fmt.Errorf("error getting embedded labels: %w", err)
 	}
-	c, err := classification.NewLabelClassifier(lbls...)
+	c, err := classification.NewLabelClassifier(ctx, lbls...)
 	if err != nil {
 		return nil, fmt.Errorf("error creating new label classifier: %w", err)
 	}
-	return &Scanner{Config: cfg, labels: lbls, classifier: c}, nil
+	return &Scanner{config: cfg, labels: lbls, classifier: c}, nil
 }
 
 // Scan performs the data repository scan. It introspects and samples the
@@ -73,8 +73,8 @@ func (s *Scanner) Scan(ctx context.Context) (*scan.RepoScanResults, error) {
 	// database. Note that Oracle doesn't really have the concept of
 	// "databases", therefore a single repository instance will always scan the
 	// entire database.
-	if s.Config.RepoConfig.Database != "" || s.Config.RepoType == RepoTypeOracle {
-		samples, err = s.sampleDb(ctx, s.Config.RepoConfig.Database)
+	if s.config.RepoConfig.Database != "" || s.config.RepoType == RepoTypeOracle {
+		samples, err = s.sampleDb(ctx, s.config.RepoConfig.Database)
 	} else {
 		// The name of the database to connect to has been left unspecified by
 		// the user, so we try to connect and sample all databases instead.
@@ -115,7 +115,7 @@ func (s *Scanner) Scan(ctx context.Context) (*scan.RepoScanResults, error) {
 // returned as a slice of Sample.
 func (s *Scanner) sampleDb(ctx context.Context, db string) ([]Sample, error) {
 	// Create the repository instance that will be used to sample the database.
-	cfg := s.Config.RepoConfig
+	cfg := s.config.RepoConfig
 	cfg.Database = db
 	repo, err := s.newRepository(ctx, cfg)
 	if err != nil {
@@ -124,8 +124,8 @@ func (s *Scanner) sampleDb(ctx context.Context, db string) ([]Sample, error) {
 	defer func() { _ = repo.Close() }()
 	// Introspect the repository to get the metadata.
 	introspectParams := IntrospectParameters{
-		IncludePaths: s.Config.IncludePaths,
-		ExcludePaths: s.Config.ExcludePaths,
+		IncludePaths: s.config.IncludePaths,
+		ExcludePaths: s.config.ExcludePaths,
 	}
 	meta, err := repo.Introspect(ctx, introspectParams)
 	if err != nil {
@@ -145,8 +145,8 @@ func (s *Scanner) sampleDb(ctx context.Context, db string) ([]Sample, error) {
 			go func(meta *TableMetadata) {
 				params := SampleParameters{
 					Metadata:   meta,
-					SampleSize: s.Config.SampleSize,
-					Offset:     s.Config.Offset,
+					SampleSize: s.config.SampleSize,
+					Offset:     s.config.Offset,
 				}
 				sample, err := repo.SampleTable(ctx, params)
 				select {
@@ -195,7 +195,7 @@ func (s *Scanner) sampleDb(ctx context.Context, db string) ([]Sample, error) {
 func (s *Scanner) sampleAllDbs(ctx context.Context) ([]Sample, error) {
 	// Create a repository instance that will be used to list all the databases
 	// on the server.
-	repo, err := s.newRepository(ctx, s.Config.RepoConfig)
+	repo, err := s.newRepository(ctx, s.config.RepoConfig)
 	if err != nil {
 		return nil, fmt.Errorf("error creating repository instance: %w", err)
 	}
@@ -224,8 +224,8 @@ func (s *Scanner) sampleAllDbs(ctx context.Context) ([]Sample, error) {
 	// specified total number of connections, since we end up creating multiple
 	// database handles (one per database).
 	var sema *semaphore.Weighted
-	if s.Config.RepoConfig.MaxOpenConns > 0 {
-		sema = semaphore.NewWeighted(int64(s.Config.RepoConfig.MaxOpenConns))
+	if s.config.RepoConfig.MaxOpenConns > 0 {
+		sema = semaphore.NewWeighted(int64(s.config.RepoConfig.MaxOpenConns))
 	}
 	for _, db := range dbs {
 		go func(db string, cfg RepoConfig) {
@@ -248,7 +248,7 @@ func (s *Scanner) sampleAllDbs(ctx context.Context) ([]Sample, error) {
 				return
 			case out <- samplesAndErr{samples: samples, err: err}:
 			}
-		}(db, s.Config.RepoConfig)
+		}(db, s.config.RepoConfig)
 	}
 
 	// Start a goroutine to close the 'out' channel once all the goroutines we
@@ -281,8 +281,11 @@ func (s *Scanner) sampleAllDbs(ctx context.Context) ([]Sample, error) {
 // of samples. Each sampled row is individually classified. The returned slice
 // of classifications represents all the UNIQUE classifications for a given
 // sample set.
-func (s *Scanner) classifySamples(ctx context.Context, samples []Sample) ([]scan.Classification, error) {
-	uniqueClassifications := make(map[string]scan.Classification)
+func (s *Scanner) classifySamples(
+	ctx context.Context,
+	samples []Sample,
+) ([]classification.Classification, error) {
+	uniqueClassifications := make(map[string]classification.Classification)
 	for _, sample := range samples {
 		// Classify each sampled row and combine the classifications.
 		for _, sampleResult := range sample.Results {
@@ -298,7 +301,7 @@ func (s *Scanner) classifySamples(ctx context.Context, samples []Sample) ([]scan
 				key := strings.Join(attrPath, "\u2063")
 				result, ok := uniqueClassifications[key]
 				if !ok {
-					uniqueClassifications[key] = scan.Classification{
+					uniqueClassifications[key] = classification.Classification{
 						AttributePath: attrPath,
 						Labels:        labels,
 					}
@@ -310,7 +313,7 @@ func (s *Scanner) classifySamples(ctx context.Context, samples []Sample) ([]scan
 		}
 	}
 	// Convert the map of unique classifications to a slice.
-	classifications := make([]scan.Classification, 0, len(uniqueClassifications))
+	classifications := make([]classification.Classification, 0, len(uniqueClassifications))
 	for _, result := range uniqueClassifications {
 		classifications = append(classifications, result)
 	}
@@ -321,12 +324,12 @@ func (s *Scanner) classifySamples(ctx context.Context, samples []Sample) ([]scan
 // configuration. It delegates the actual creation of the repository to the
 // scanner's Registry.NewRepository method, using the scanner's RepoType and
 // the provided configuration. You may wonder why we just don't use the
-// scanner's repo configuration directly (i.e. s.Config.RepoConfig) instead of
+// scanner's repo configuration directly (i.e. s.config.RepoConfig) instead of
 // passing it as an argument. The reason is that we want to be able to create
 // a new repository instance with a different configuration than the one
 // specified in the scanner's configuration. This is useful when we want to
 // sample a specific database, for example, and we want to create a new
 // repository instance with the database name set to that specific database.
 func (s *Scanner) newRepository(ctx context.Context, cfg RepoConfig) (Repository, error) {
-	return s.Config.Registry.NewRepository(ctx, s.Config.RepoType, cfg)
+	return s.config.Registry.NewRepository(ctx, s.config.RepoType, cfg)
 }
diff --git a/sql/scanner_test.go b/sql/scanner_test.go
index d4d86a4..edbe3f7 100644
--- a/sql/scanner_test.go
+++ b/sql/scanner_test.go
@@ -112,7 +112,7 @@ func TestScanner_sampleDb_Success(t *testing.T) {
 		},
 	)
 	s := Scanner{
-		Config: ScannerConfig{
+		config: ScannerConfig{
 			RepoType:   repoType,
 			RepoConfig: RepoConfig{},
 			Registry:   reg,
@@ -249,7 +249,7 @@ func TestScanner_sampleDb_PartialError(t *testing.T) {
 		},
 	)
 	s := Scanner{
-		Config: ScannerConfig{
+		config: ScannerConfig{
 			RepoType:   repoType,
 			RepoConfig: RepoConfig{},
 			Registry:   reg,
@@ -277,7 +277,7 @@ func TestScanner_sampleAllDbs_Error(t *testing.T) {
 		},
 	)
 	s := Scanner{
-		Config: ScannerConfig{
+		config: ScannerConfig{
 			RepoType:   repoType,
 			RepoConfig: RepoConfig{},
 			Registry:   reg,
@@ -336,7 +336,7 @@ func TestScanner_sampleAllDbs_Successful_TwoDatabases(t *testing.T) {
 		},
 	)
 	s := Scanner{
-		Config: ScannerConfig{
+		config: ScannerConfig{
 			RepoType:   repoType,
 			RepoConfig: RepoConfig{},
 			Registry:   reg,
@@ -367,7 +367,7 @@ func TestScanner_sampleAllDbs_IntrospectError(t *testing.T) {
 		},
 	)
 	s := Scanner{
-		Config: ScannerConfig{
+		config: ScannerConfig{
 			RepoType:   repoType,
 			RepoConfig: RepoConfig{},
 			Registry:   reg,
@@ -419,7 +419,7 @@ func TestScanner_sampleAllDbs_SampleError(t *testing.T) {
 		},
 	)
 	s := Scanner{
-		Config: ScannerConfig{
+		config: ScannerConfig{
 			RepoType:   repoType,
 			RepoConfig: RepoConfig{},
 			Registry:   reg,
@@ -480,7 +480,7 @@ func TestScanner_sampleAllDbs_TwoDatabases_OneSampleError(t *testing.T) {
 		},
 	)
 	s := Scanner{
-		Config: ScannerConfig{
+		config: ScannerConfig{
 			RepoType:   repoType,
 			RepoConfig: RepoConfig{},
 			Registry:   reg,

From 87db7a643de1d8def7fb84924563e4bd3be55e2b Mon Sep 17 00:00:00 2001
From: Chris Campo <ccampo133@users.noreply.github.com>
Date: Fri, 5 Apr 2024 17:20:11 -0400
Subject: [PATCH 13/14] Add custom label support

---
 classification/classification.go        |  12 +-
 classification/label.go                 | 127 +++++++++++++++-----
 classification/label_classifier.go      |   8 +-
 classification/label_classifier_test.go |   6 +-
 classification/label_test.go            |  79 +++++--------
 classification/labels/README.md         |  14 +--
 classification/labels/labels.yaml       | 148 +++++++++++++-----------
 cmd/repo_scan.go                        |  36 +++---
 sql/scanner.go                          |  37 +++++-
 sql/scanner_test.go                     |   7 +-
 10 files changed, 290 insertions(+), 184 deletions(-)

diff --git a/classification/classification.go b/classification/classification.go
index 8ce6b8a..54b1ee2 100644
--- a/classification/classification.go
+++ b/classification/classification.go
@@ -9,8 +9,6 @@ package classification
 import (
 	"context"
 	"encoding/json"
-
-	"golang.org/x/exp/maps"
 )
 
 // Classifier is an interface that represents a data classifier. A classifier
@@ -29,11 +27,17 @@ type Classifier interface {
 // that attribute was classified as.
 type Result map[string]LabelSet
 
-// LabelSet is a set of unique labels.
+// LabelSet is a set of unique label names.
 type LabelSet map[string]struct{}
 
+// MarshalJSON marshals the LabelSet into a JSON array of strings, where each
+// string is the name of a label in the set.
 func (l LabelSet) MarshalJSON() ([]byte, error) {
-	return json.Marshal(maps.Keys(l))
+	keys := make([]string, 0, len(l))
+	for k := range l {
+		keys = append(keys, k)
+	}
+	return json.Marshal(keys)
 }
 
 // Classification represents the classification of a data repository attribute.
diff --git a/classification/label.go b/classification/label.go
index 8f5d566..850cc50 100644
--- a/classification/label.go
+++ b/classification/label.go
@@ -2,22 +2,40 @@ package classification
 
 import (
 	"embed"
+	"errors"
 	"fmt"
-	"strings"
+	"io/fs"
+	"os"
+	"path/filepath"
 
 	"github.com/open-policy-agent/opa/ast"
 	log "github.com/sirupsen/logrus"
-	"golang.org/x/exp/maps"
 	"gopkg.in/yaml.v3"
 )
 
 var (
-	//go:embed labels/*.rego
-	regoFs embed.FS
-	//go:embed labels/labels.yaml
-	labelsYaml string
+	//go:embed labels/*.rego labels/labels.yaml
+	predefinedLabelsFs embed.FS
 )
 
+// InvalidLabelsError is an error type that represents an error when one or
+// more labels are invalid, e.g. they have invalid classification rules. The
+// error contains a slice of errors that caused the error, which can be
+// unwrapped to get the individual errors that caused the problems.
+type InvalidLabelsError struct {
+	errs []error
+}
+
+// Unwrap returns the errors that caused the InvalidLabelsError.
+func (e InvalidLabelsError) Unwrap() []error {
+	return e.errs
+}
+
+// Error returns a string representation of the InvalidLabelsError.
+func (e InvalidLabelsError) Error() string {
+	return errors.Join(e.errs...).Error()
+}
+
 // Label represents a data classification label.
 type Label struct {
 	// Name is the name of the label.
@@ -48,36 +66,89 @@ func NewLabel(name, description, classificationRule string, tags ...string) (Lab
 	}, nil
 }
 
-// GetEmbeddedLabels returns the predefined embedded labels and their
-// classification rules. The labels are read from the embedded labels.yaml file
-// and the classification rules are read from the embedded Rego files. If there
-// is an error unmarshalling the labels file, it is returned. If there is an
-// error reading or parsing a classification rule for a label, a warning is
-// logged and that label is skipped.
-func GetEmbeddedLabels() ([]Label, error) {
-	labels := struct {
-		Labels map[string]Label `yaml:"labels"`
-	}{}
-	if err := yaml.Unmarshal([]byte(labelsYaml), &labels); err != nil {
-		return nil, fmt.Errorf("error unmarshalling labels.yaml: %w", err)
+// GetPredefinedLabels loads and returns the predefined embedded labels and
+// their classification rules. The labels are read from the embedded labels.yaml
+// file and the classification rules are read from the embedded Rego files. If
+// there is an error reading or unmarshalling the labels file, it is returned.
+// If there are errors reading or parsing a classification rules for labels, the
+// errors are aggregated into an InvalidLabelsError and returned, along with
+// the labels that were successfully read. Note that this should not return an
+// error in reality, as the embedded labels should always be valid. If it does,
+// it indicates a problem with the embedded labels!
+func GetPredefinedLabels() ([]Label, error) {
+	return getLabels("labels/labels.yaml", predefinedLabelsFs)
+}
+
+// GetCustomLabels loads and returns the labels and their classification rules
+// defined in the given labels yaml file. The labels are read from the file
+// along with their classification rule Rego files (defined in the yaml). If
+// there is an error unmarshalling the labels file, it is returned. If there are
+// errors reading or parsing a classification rules for labels, the errors are
+// aggregated into an InvalidLabelsError and returned, along with the labels
+// that were successfully read.
+func GetCustomLabels(labelsYamlFname string) ([]Label, error) {
+	path, err := filepath.Abs(labelsYamlFname)
+	if err != nil {
+		return nil, fmt.Errorf("error getting absolute path for labels yaml file %s: %w", labelsYamlFname, err)
 	}
-	for name, lbl := range labels.Labels {
-		fname := "labels/" + strings.ReplaceAll(strings.ToLower(name), " ", "_") + ".rego"
-		b, err := regoFs.ReadFile(fname)
-		if err != nil {
-			log.WithError(err).Warnf("error reading rego file %s", fname)
-			continue
+	labelFs := os.DirFS(filepath.Dir(path))
+	return getLabels(filepath.Base(path), labelFs.(fs.ReadFileFS))
+}
+
+func getLabels(fname string, labelsFs fs.ReadFileFS) ([]Label, error) {
+	// Read and parse the labels yaml file.
+	yamlBytes, err := labelsFs.ReadFile(fname)
+	if err != nil {
+		return nil, fmt.Errorf("error reading label yaml file %s", fname)
+	}
+	type yamlLabel struct {
+		Label
+		Rule string `yaml:"rule"`
+	}
+	yamlLabels := make(map[string]yamlLabel)
+	if err := yaml.Unmarshal(yamlBytes, &yamlLabels); err != nil {
+		return nil, fmt.Errorf("error unmarshalling labels yaml: %w", err)
+	}
+	labels := make([]Label, 0, len(yamlLabels))
+	// Read each label's classification rule.
+	var errs []error
+	for name, lbl := range yamlLabels {
+		// We assume that the rule will be defined with a relative path in the
+		// labels yaml file. If the rule is absolute, we create a new fs for
+		// the rule's directory. This implies that embedded labels will not work
+		// if the rule is absolute, but that should not be a problem because
+		// they should always be relative.
+		ruleFname := filepath.Join(filepath.Dir(fname), lbl.Rule)
+		ruleFs := labelsFs
+		if filepath.IsAbs(ruleFname) {
+			ruleFs = os.DirFS(filepath.Dir(ruleFname)).(fs.ReadFileFS)
+			ruleFname = filepath.Base(ruleFname)
 		}
-		rule, err := parseRego(string(b))
+		rule, err := readLabelRule(ruleFname, ruleFs)
 		if err != nil {
-			log.WithError(err).Warnf("error parsing classification rule for label %s", lbl.Name)
+			errs = append(errs, fmt.Errorf("error reading classification rule for label %s: %w", name, err))
 			continue
 		}
 		lbl.Name = name
 		lbl.ClassificationRule = rule
-		labels.Labels[name] = lbl
+		labels = append(labels, lbl.Label)
+	}
+	if len(errs) > 0 {
+		return labels, InvalidLabelsError{errs}
+	}
+	return labels, nil
+}
+
+func readLabelRule(fname string, labelFs fs.ReadFileFS) (*ast.Module, error) {
+	b, err := labelFs.ReadFile(fname)
+	if err != nil {
+		return nil, fmt.Errorf("error reading rego file %s: %w", fname, err)
+	}
+	rule, err := parseRego(string(b))
+	if err != nil {
+		return nil, fmt.Errorf("error parsing classification rule for file %s: %w", fname, err)
 	}
-	return maps.Values(labels.Labels), nil
+	return rule, nil
 }
 
 func parseRego(code string) (*ast.Module, error) {
diff --git a/classification/label_classifier.go b/classification/label_classifier.go
index 75850ba..2375f92 100644
--- a/classification/label_classifier.go
+++ b/classification/label_classifier.go
@@ -2,6 +2,7 @@ package classification
 
 import (
 	"context"
+	"errors"
 	"fmt"
 
 	"github.com/open-policy-agent/opa/rego"
@@ -45,12 +46,13 @@ func NewLabelClassifier(ctx context.Context, labels ...Label) (*LabelClassifier,
 // names to the set of labels that the attribute was classified as.
 func (c *LabelClassifier) Classify(ctx context.Context, input map[string]any) (Result, error) {
 	result := make(Result, len(c.queries))
+	var errs error
 	for lbl, query := range c.queries {
 		output, err := evalQuery(ctx, query, input)
 		if err != nil {
 			// A single error should not prevent the classification of other
-			// labels. Log the error and continue.
-			log.WithError(err).Errorf("error evaluating query for label %s", lbl)
+			// labels. Aggregate the error and continue.
+			errs = errors.Join(errs, fmt.Errorf("error evaluating query for label %s: %w", lbl, err))
 			continue
 		}
 		log.Debugf("classification results for label %s: %v", lbl, output)
@@ -67,7 +69,7 @@ func (c *LabelClassifier) Classify(ctx context.Context, input map[string]any) (R
 			}
 		}
 	}
-	return result, nil
+	return result, errs
 }
 
 // evalQuery evaluates the provided Rego query with the given attributes as input, and returns the classification results. The output is a
diff --git a/classification/label_classifier_test.go b/classification/label_classifier_test.go
index 50fd1e0..0954909 100644
--- a/classification/label_classifier_test.go
+++ b/classification/label_classifier_test.go
@@ -11,7 +11,7 @@ import (
 func TestNewLabelClassifier_Success(t *testing.T) {
 	lbl, err := NewLabel("foo", "test label", "package foo\noutput = true")
 	require.NoError(t, err)
-	classifier, err := NewLabelClassifier(lbl)
+	classifier, err := NewLabelClassifier(context.Background(), lbl)
 	require.NoError(t, err)
 	require.NotNil(t, classifier)
 }
@@ -140,14 +140,14 @@ func newTestLabelClassifier(t *testing.T, lblNames ...string) *LabelClassifier {
 	for i, lblName := range lblNames {
 		lbls[i] = newTestLabel(t, lblName)
 	}
-	classifier, err := NewLabelClassifier(lbls...)
+	classifier, err := NewLabelClassifier(context.Background(), lbls...)
 	require.NoError(t, err)
 	return classifier
 }
 
 func newTestLabel(t *testing.T, lblName string) Label {
 	fname := "labels/" + strings.ReplaceAll(strings.ToLower(lblName), " ", "_") + ".rego"
-	fin, err := regoFs.ReadFile(fname)
+	fin, err := predefinedLabelsFs.ReadFile(fname)
 	require.NoError(t, err)
 	classifierCode := string(fin)
 	lbl, err := NewLabel(lblName, "test label", classifierCode)
diff --git a/classification/label_test.go b/classification/label_test.go
index 35a0b69..2262f98 100644
--- a/classification/label_test.go
+++ b/classification/label_test.go
@@ -2,64 +2,43 @@ package classification
 
 import (
 	"context"
-	"fmt"
 	"testing"
 
-	"github.com/open-policy-agent/opa/rego"
 	"github.com/stretchr/testify/require"
+	"gopkg.in/yaml.v3"
 )
 
-func TestGetEmbeddedLabels(t *testing.T) {
-	got, err := GetEmbeddedLabels()
+// This isn't really a test as much as it is a validation of the embedded labels
+// and their classification rules. The test will fail if the labels or their
+// classification rules are invalid for any reason. It includes parsing the
+// label Rego code, and validating that have their expected output. It serves
+// mostly as a build-time a sanity check, which should hopefully avoid us
+// releasing a build with broken embedded labels!
+func TestGetPredefinedLabels_LabelsAreValid(t *testing.T) {
+	// We want to read the labels ourselves in this test, so we can compare them
+	// against the labels returned by GetPredefinedLabels.
+	fname := "labels/labels.yaml"
+	type yamlLabel struct {
+		Label
+		Rule string `yaml:"rule"`
+	}
+	yamlBytes, err := predefinedLabelsFs.ReadFile(fname)
 	require.NoError(t, err)
-	require.NotEmpty(t, got)
-}
-
-func TestRego(t *testing.T) {
-
-	module := `
-package example.authz
-
-import rego.v1
-
-default allow := false
-
-allow if {
-   input.method == "GET"
-   input.path == ["salary", input.subject.user]
-}
-
-allow if is_admin
-
-is_admin if "admin" in input.subject.groups
-`
-
-	mod, err := parseRego(module)
+	yamlLabels := make(map[string]yamlLabel)
+	err = yaml.Unmarshal(yamlBytes, &yamlLabels)
 	require.NoError(t, err)
-	require.NotNil(t, mod)
-	path := mod.Package.Path.String()
-	fmt.Println(path)
-
-	ctx := context.TODO()
 
-	query, err := rego.New(
-		rego.Query("data.example.authz.allow"),
-		rego.Module("example.rego", module),
-	).PrepareForEval(ctx)
+	got, err := GetPredefinedLabels()
 	require.NoError(t, err)
-	require.NotNil(t, query)
-
-	input := map[string]interface{}{
-		"method": "GET",
-		"path": []interface{}{"salary", "bob"},
-		"subject": map[string]interface{}{
-			"user": "bob",
-			"groups": []interface{}{"sales", "marketing"},
-		},
-	}
-
-	results, err := query.Eval(ctx, rego.EvalInput(input))
+	require.Len(t, got, len(yamlLabels))
+
+	// Validate the classification rules for each label by doing dummy
+	// classification. We don't expect any results for an empty input - we
+	// really just want to validate that the classification rules are valid and
+	// there were no errors during the classification process.
+	ctx := context.Background()
+	classifier, err := NewLabelClassifier(ctx, got...)
+	res, err := classifier.Classify(ctx, map[string]any{})
 	require.NoError(t, err)
-	require.NotEmpty(t, results)
-	require.True(t, results.Allowed())
+	require.Empty(t, res)
 }
diff --git a/classification/labels/README.md b/classification/labels/README.md
index 274333c..9c051e4 100644
--- a/classification/labels/README.md
+++ b/classification/labels/README.md
@@ -1,8 +1,8 @@
-This directory contains all the data label definitions used for classification.
-The label metadata is specified in the [`labels.yaml`](labels.yaml) file. Please
-see that file's doc comment for more details.
+This directory contains all the predefined data label definitions used for 
+classification. The label metadata is specified in the 
+[`labels.yaml`](labels.yaml) file, and the classification rules are defined in
+individual Rego files for each label.
 
-Additionally, the classification rule Rego code for each label must be specified
-as a `<label>.rego` file, where `<label>` is the name of the label in lowercase.
-For example, if the label `ADDRESS` is defined in `labels.yaml`, it should have
-an `address.rego` file defined as well.
+To add a new predefined label, add its metadata to [`labels.yaml`](labels.yaml)
+(following the file's instructions), as well as a corresponding classification
+rule Rego file.
diff --git a/classification/labels/labels.yaml b/classification/labels/labels.yaml
index ed9f211..563bd09 100644
--- a/classification/labels/labels.yaml
+++ b/classification/labels/labels.yaml
@@ -1,79 +1,97 @@
-# Contains all the predefined data labels by Cyral. To add a new predefined
-# label, define it in this file along with its classification rule Rego code in
-# a '<label>.rego' file. The Rego file name should match the lowercase label
-# name, with spaces replaced by underscores. For example, the Rego file for the
-# 'ADDRESS' label should be named 'address.rego'.
+# This file contains all the predefined data labels by Cyral. It also serves as
+# example of the file format users can use to define their own custom labels.
+# To add a new predefined label, define it in this file along with its
+# classification rule Rego code in a '<label>.rego' file.
 #
-# YAML structure:
+# File YAML structure:
 #
-# labels:               # The list of labels.
-#   FOO:                # The label name.
-#     description: bar  # The label description.
-#     tags:             # The label tags (list), e.g., PII, PCI, etc.
-#       - tag1
-#       - tag2
-labels:
-  ADDRESS:
-    description: Address
-    tags:
-      - PII
+# LABEL_NAME:
+#   description: Some description
+#   rule: label_name.rego
+#   tags:
+#     - tag1
+#     - tag2
+#
+# The classification rule Rego file name can be a relative path (to this file,
+# e.g. label_name.rego), or an absolute path (e.g. /path/to/label_name.rego).
+# Note that for predefined labels (like the ones defined by this specific
+# file!) the classification rule filename for a label MUST be a valid RELATIVE
+# path to the Rego file for the label, otherwise it will not be read correctly.
+
+ADDRESS:
+  description: Address
+  rule: address.rego
+  tags:
+    - PII
 
-  AGE:
-    description: Age
-    tags:
-      - PII
+AGE:
+  description: Age
+  rule: age.rego
+  tags:
+    - PII
 
-  CCN:
-    description: Credit card number
-    tags:
-      - PCI
+CCN:
+  description: Credit card number
+  rule: ccn.rego
+  tags:
+    - PCI
 
-  CVV:
-    description: Credit card verification value (CVV)
-    tags:
-      - PCI
+CVV:
+  description: Credit card verification value (CVV)
+  rule: cvv.rego
+  tags:
+    - PCI
 
-  DOB:
-    description: Date of birth
-    tags:
-      - PII
+DOB:
+  description: Date of birth
+  rule: dob.rego
+  tags:
+    - PII
 
-  EMAIL:
-    description: Email address
-    tags:
-      - PII
+EMAIL:
+  description: Email address
+  rule: email.rego
+  tags:
+    - PII
 
-  FIRST_NAME:
-    description: First name
-    tags:
-      - PII
+FIRST_NAME:
+  description: First name
+  rule: first_name.rego
+  tags:
+    - PII
 
-  FULL_NAME:
-    description: Full name
-    tags:
-      - PII
+FULL_NAME:
+  description: Full name
+  rule: full_name.rego
+  tags:
+    - PII
 
-  IP_ADDRESS:
-    description: IP address
-    tags:
-      - PII
+IP_ADDRESS:
+  description: IP address
+  rule: ip_address.rego
+  tags:
+    - PII
 
-  LAST_NAME:
-    description: Last name
-    tags:
-      - PII
+LAST_NAME:
+  description: Last name
+  rule: last_name.rego
+  tags:
+    - PII
 
-  PASSPORT:
-    description: Passport number
-    tags:
-      - PII
+PASSPORT:
+  description: Passport number
+  rule: passport.rego
+  tags:
+    - PII
 
-  PHONE:
-    description: Phone number
-    tags:
-      - PII
+PHONE:
+  description: Phone number
+  rule: phone.rego
+  tags:
+    - PII
 
-  SSN:
-    description: Social security number
-    tags:
-      - PII
+SSN:
+  description: Social security number
+  rule: ssn.rego
+  tags:
+    - PII
diff --git a/cmd/repo_scan.go b/cmd/repo_scan.go
index ce25984..c47524f 100644
--- a/cmd/repo_scan.go
+++ b/cmd/repo_scan.go
@@ -14,19 +14,20 @@ import (
 )
 
 type RepoScanCmd struct {
-	Type         string         `help:"Type of repository to connect to (postgres|mysql|oracle|sqlserver|snowflake|redshift|denodo)." enum:"postgres,mysql,oracle,sqlserver,snowflake,redshift,denodo" required:""`
-	ExternalID   string         `help:"External ID of the repository." required:""`
-	Host         string         `help:"Hostname of the repository." required:""`
-	Port         uint16         `help:"Port of the repository." required:""`
-	User         string         `help:"Username to connect to the repository." required:""`
-	Password     string         `help:"Password to connect to the repository." required:""`
-	Database     string         `help:"Name of the database to connect to. If not specified, the default database is used (if possible)."`
-	Advanced     map[string]any `help:"Advanced configuration for the repository, semicolon separated (e.g. key1=value1;key2=value2). Please see the documentation for details on how to provide this argument for specific repository types."`
-	IncludePaths GlobFlag       `help:"List of glob patterns to include when introspecting the database(s), semicolon separated (e.g. foo*;bar*;*.baz)." default:"*"`
-	ExcludePaths GlobFlag       `help:"List of glob patterns to exclude when introspecting the database(s), semicolon separated (e.g. foo*;bar*;*.baz)." default:""`
-	MaxOpenConns uint           `help:"Maximum number of open connections to the database." default:"10"`
-	SampleSize   uint           `help:"Number of rows to sample from the repository (per table)." default:"5"`
-	Offset       uint           `help:"Offset to start sampling from." default:"0"`
+	Type          string         `help:"Type of repository to connect to (postgres|mysql|oracle|sqlserver|snowflake|redshift|denodo)." enum:"postgres,mysql,oracle,sqlserver,snowflake,redshift,denodo" required:""`
+	ExternalID    string         `help:"External ID of the repository." required:""`
+	Host          string         `help:"Hostname of the repository." required:""`
+	Port          uint16         `help:"Port of the repository." required:""`
+	User          string         `help:"Username to connect to the repository." required:""`
+	Password      string         `help:"Password to connect to the repository." required:""`
+	Database      string         `help:"Name of the database to connect to. If not specified, the default database is used (if possible)."`
+	Advanced      map[string]any `help:"Advanced configuration for the repository, semicolon separated (e.g. key1=value1;key2=value2). Please see the documentation for details on how to provide this argument for specific repository types."`
+	IncludePaths  GlobFlag       `help:"List of glob patterns to include when introspecting the database(s), semicolon separated (e.g. foo*;bar*;*.baz)." default:"*"`
+	ExcludePaths  GlobFlag       `help:"List of glob patterns to exclude when introspecting the database(s), semicolon separated (e.g. foo*;bar*;*.baz)."`
+	MaxOpenConns  uint           `help:"Maximum number of open connections to the database." default:"10"`
+	SampleSize    uint           `help:"Number of rows to sample from the repository (per table)." default:"5"`
+	Offset        uint           `help:"Offset to start sampling from." default:"0"`
+	LabelYamlFile string         `help:"Filename of the yaml file containing the custom set of data labels (e.g. /path/to/labels.yaml). If omitted, Dmap's predefined set of labels is used."`
 }
 
 // GlobFlag is a kong.MapperValue implementation that represents a glob pattern.
@@ -65,10 +66,11 @@ func (cmd *RepoScanCmd) Run(_ *Globals) error {
 			MaxOpenConns: cmd.MaxOpenConns,
 			Advanced:     cmd.Advanced,
 		},
-		IncludePaths: cmd.IncludePaths,
-		ExcludePaths: cmd.ExcludePaths,
-		SampleSize:   cmd.SampleSize,
-		Offset:       cmd.Offset,
+		IncludePaths:       cmd.IncludePaths,
+		ExcludePaths:       cmd.ExcludePaths,
+		SampleSize:         cmd.SampleSize,
+		Offset:             cmd.Offset,
+		LabelsYamlFilename: cmd.LabelYamlFile,
 	}
 	scanner, err := sql.NewScanner(ctx, cfg)
 	if err != nil {
diff --git a/sql/scanner.go b/sql/scanner.go
index ae04af2..7c98d45 100644
--- a/sql/scanner.go
+++ b/sql/scanner.go
@@ -24,6 +24,7 @@ type ScannerConfig struct {
 	IncludePaths, ExcludePaths []glob.Glob
 	SampleSize                 uint
 	Offset                     uint
+	LabelsYamlFilename         string
 }
 
 // Scanner is a data discovery scanner that scans a data repository for
@@ -47,11 +48,33 @@ func NewScanner(ctx context.Context, cfg ScannerConfig) (*Scanner, error) {
 	if cfg.Registry == nil {
 		cfg.Registry = DefaultRegistry
 	}
-	// Create a new label classifier with the embedded labels.
-	lbls, err := classification.GetEmbeddedLabels()
+	// Load the data labels - either from the predefined (embedded) labels or
+	// from a provided custom labels file.
+	var (
+		lbls []classification.Label
+		err  error
+	)
+	if cfg.LabelsYamlFilename == "" {
+		// Use the predefined labels if the user didn't specify a labels file.
+		lbls, err = classification.GetPredefinedLabels()
+	} else {
+		// Load the labels from the specified file.
+		lbls, err = classification.GetCustomLabels(cfg.LabelsYamlFilename)
+	}
 	if err != nil {
-		return nil, fmt.Errorf("error getting embedded labels: %w", err)
+		errMsg := fmt.Sprintf("error(s) loading data labels")
+		// This error means that some labels weren't loaded due to having
+		// invalid classification rules. We only log a warning in this case,
+		// since we still want to proceed with the labels that were
+		// successfully loaded.
+		var errs classification.InvalidLabelsError
+		if errors.As(err, &errs) {
+			log.WithError(errs).Warnf("%s: some labels were not loaded", errMsg)
+		} else {
+			return nil, fmt.Errorf("%s: %w", errMsg, err)
+		}
 	}
+	// Create a new label classifier with the embedded labels.
 	c, err := classification.NewLabelClassifier(ctx, lbls...)
 	if err != nil {
 		return nil, fmt.Errorf("error creating new label classifier: %w", err)
@@ -291,7 +314,13 @@ func (s *Scanner) classifySamples(
 		for _, sampleResult := range sample.Results {
 			res, err := s.classifier.Classify(ctx, sampleResult)
 			if err != nil {
-				return nil, fmt.Errorf("error classifying sample: %w", err)
+				// We received an error while classifying the sample. If we
+				// didn't get any results, return an error. Otherwise, log a
+				// warning and continue with the partial results.
+				if len(res) == 0 {
+					return nil, fmt.Errorf("error(s) classifying sample: %w", err)
+				}
+				log.WithError(err).Warn("error(s) classifying sample, continuing with partial results")
 			}
 			for attr, labels := range res {
 				attrPath := append(sample.TablePath, attr)
diff --git a/sql/scanner_test.go b/sql/scanner_test.go
index edbe3f7..3962396 100644
--- a/sql/scanner_test.go
+++ b/sql/scanner_test.go
@@ -9,9 +9,10 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/cyralinc/dmap/classification"
-	"github.com/cyralinc/dmap/scan"
 )
 
+// TODO: tests for Scanner.Scan -ccampo 2024-04-05
+
 func TestScanner_sampleDb_Success(t *testing.T) {
 	ctx := context.Background()
 	repo := NewMockRepository(t)
@@ -529,7 +530,7 @@ func TestScanner_classifySamples_SingleSample(t *testing.T) {
 		nil,
 	)
 
-	expected := []scan.Classification{
+	expected := []classification.Classification{
 		{
 			AttributePath: append(sample.TablePath, "age"),
 			Labels:        lblSet("AGE", "CVV"),
@@ -605,7 +606,7 @@ func TestScanner_classifySamples_MultipleSamples(t *testing.T) {
 		nil,
 	)
 
-	expected := []scan.Classification{
+	expected := []classification.Classification{
 		{
 			AttributePath: append(samples[0].TablePath, "age"),
 			Labels:        lblSet("AGE", "CVV"),

From c4628c87544b1050a2d118b702b530e683bbda89 Mon Sep 17 00:00:00 2001
From: Chris Campo <ccampo133@users.noreply.github.com>
Date: Mon, 8 Apr 2024 10:08:14 -0400
Subject: [PATCH 14/14] Fix relative path bugs.

---
 classification/label.go      |  74 ++++++++++++-----
 classification/label_test.go | 152 ++++++++++++++++++++++++++++++++++-
 sql/scanner.go               |   5 +-
 3 files changed, 210 insertions(+), 21 deletions(-)

diff --git a/classification/label.go b/classification/label.go
index 850cc50..138e37b 100644
--- a/classification/label.go
+++ b/classification/label.go
@@ -76,7 +76,7 @@ func NewLabel(name, description, classificationRule string, tags ...string) (Lab
 // error in reality, as the embedded labels should always be valid. If it does,
 // it indicates a problem with the embedded labels!
 func GetPredefinedLabels() ([]Label, error) {
-	return getLabels("labels/labels.yaml", predefinedLabelsFs)
+	return getLabels("labels/labels.yaml", true)
 }
 
 // GetCustomLabels loads and returns the labels and their classification rules
@@ -91,19 +91,36 @@ func GetCustomLabels(labelsYamlFname string) ([]Label, error) {
 	if err != nil {
 		return nil, fmt.Errorf("error getting absolute path for labels yaml file %s: %w", labelsYamlFname, err)
 	}
-	labelFs := os.DirFS(filepath.Dir(path))
-	return getLabels(filepath.Base(path), labelFs.(fs.ReadFileFS))
+	return getLabels(path, false)
 }
 
-func getLabels(fname string, labelsFs fs.ReadFileFS) ([]Label, error) {
+// getLabels reads the labels YAML file from the given path and returns the
+// labels and their classification rules. If predefined is true, the labels are
+// read from the embedded FS, otherwise they are read from the file system. If
+// there is an error reading or unmarshalling the labels file, it is returned.
+// If there are errors reading or parsing a classification rules for labels, the
+// errors are aggregated into an InvalidLabelsError and returned, along with the
+// labels that were successfully read.
+func getLabels(path string, predefined bool) ([]Label, error) {
+	var (
+		labelsFs    fs.ReadFileFS
+		labelsFname string
+	)
+	if predefined {
+		labelsFs = predefinedLabelsFs
+		labelsFname = path
+	} else {
+		labelsFs = os.DirFS(filepath.Dir(path)).(fs.ReadFileFS)
+		labelsFname = filepath.Base(path)
+	}
 	// Read and parse the labels yaml file.
-	yamlBytes, err := labelsFs.ReadFile(fname)
+	yamlBytes, err := labelsFs.ReadFile(labelsFname)
 	if err != nil {
-		return nil, fmt.Errorf("error reading label yaml file %s", fname)
+		return nil, fmt.Errorf("error reading label yaml file %s", path)
 	}
 	type yamlLabel struct {
-		Label
-		Rule string `yaml:"rule"`
+		Label `yaml:",inline"`
+		Rule  string `yaml:"rule"`
 	}
 	yamlLabels := make(map[string]yamlLabel)
 	if err := yaml.Unmarshal(yamlBytes, &yamlLabels); err != nil {
@@ -113,16 +130,37 @@ func getLabels(fname string, labelsFs fs.ReadFileFS) ([]Label, error) {
 	// Read each label's classification rule.
 	var errs []error
 	for name, lbl := range yamlLabels {
-		// We assume that the rule will be defined with a relative path in the
-		// labels yaml file. If the rule is absolute, we create a new fs for
-		// the rule's directory. This implies that embedded labels will not work
-		// if the rule is absolute, but that should not be a problem because
-		// they should always be relative.
-		ruleFname := filepath.Join(filepath.Dir(fname), lbl.Rule)
-		ruleFs := labelsFs
-		if filepath.IsAbs(ruleFname) {
-			ruleFs = os.DirFS(filepath.Dir(ruleFname)).(fs.ReadFileFS)
-			ruleFname = filepath.Base(ruleFname)
+		// The rule file for this label is either an absolute path, a relative
+		// path, or a predefined rule. We need to determine the fs to use to
+		// read the rule file.
+		var (
+			ruleFs    fs.ReadFileFS
+			ruleFname string
+		)
+		if predefined {
+			// We're dealing with the predefined labels, therefore the rule FS
+			// is same embedded FS as the labels YAML file. However, we need to
+			// use the dir of the labels yaml file as the rule file root because
+			// this is the root of the embedded fs - it's a bit of a quirk with
+			// the embedded FS API.
+			ruleFname = filepath.Join(filepath.Dir(path), lbl.Rule)
+			ruleFs = labelsFs
+		} else {
+			ruleFname = filepath.Base(lbl.Rule)
+			if filepath.IsAbs(lbl.Rule) {
+				// The rule has an absolute path, so we need to create a new fs
+				// for the rule's directory.
+				ruleFs = os.DirFS(filepath.Dir(lbl.Rule)).(fs.ReadFileFS)
+			} else {
+				// The rule has a relative path, which is relative to the labels
+				// YAML file (as opposed to the current directory).
+				ruleFs = os.DirFS(
+					filepath.Join(
+						filepath.Dir(path),
+						filepath.Dir(lbl.Rule),
+					),
+				).(fs.ReadFileFS)
+			}
 		}
 		rule, err := readLabelRule(ruleFname, ruleFs)
 		if err != nil {
diff --git a/classification/label_test.go b/classification/label_test.go
index 2262f98..430060a 100644
--- a/classification/label_test.go
+++ b/classification/label_test.go
@@ -2,6 +2,9 @@ package classification
 
 import (
 	"context"
+	"fmt"
+	"os"
+	"path/filepath"
 	"testing"
 
 	"github.com/stretchr/testify/require"
@@ -19,18 +22,31 @@ func TestGetPredefinedLabels_LabelsAreValid(t *testing.T) {
 	// against the labels returned by GetPredefinedLabels.
 	fname := "labels/labels.yaml"
 	type yamlLabel struct {
-		Label
-		Rule string `yaml:"rule"`
+		Label `yaml:",inline"`
+		Rule  string `yaml:"rule"`
 	}
 	yamlBytes, err := predefinedLabelsFs.ReadFile(fname)
 	require.NoError(t, err)
 	yamlLabels := make(map[string]yamlLabel)
 	err = yaml.Unmarshal(yamlBytes, &yamlLabels)
 	require.NoError(t, err)
+	for name, lbl := range yamlLabels {
+		lbl.Name = name
+		yamlLabels[name] = lbl
+	}
 
 	got, err := GetPredefinedLabels()
 	require.NoError(t, err)
 	require.Len(t, got, len(yamlLabels))
+	for i, lbl := range got {
+		want := yamlLabels[lbl.Name]
+		require.Equal(t, want.Name, got[i].Name)
+		require.Equal(t, want.Description, got[i].Description)
+		require.ElementsMatch(t, want.Tags, got[i].Tags)
+		// We don't care about the actual rule content here, just that it was
+		// loaded. We'll validate the content below.
+		require.NotNil(t, got[i].ClassificationRule)
+	}
 
 	// Validate the classification rules for each label by doing dummy
 	// classification. We don't expect any results for an empty input - we
@@ -38,7 +54,139 @@ func TestGetPredefinedLabels_LabelsAreValid(t *testing.T) {
 	// there were no errors during the classification process.
 	ctx := context.Background()
 	classifier, err := NewLabelClassifier(ctx, got...)
+	require.NoError(t, err)
 	res, err := classifier.Classify(ctx, map[string]any{})
 	require.NoError(t, err)
 	require.Empty(t, res)
 }
+
+func TestGetCustomLabels_RelativeRulePath_SameDir(t *testing.T) {
+	labelsDir := t.TempDir()
+
+	// Create the labels YAML file.
+	labelsYamlFile, err := os.CreateTemp(labelsDir, "labels.yaml")
+	defer func() { _ = labelsYamlFile.Close() }()
+	require.NoError(t, err)
+	labelsYaml := `ADDRESS:
+  description: Address
+  rule: address.rego
+  tags:
+    - PII`
+	err = os.WriteFile(labelsYamlFile.Name(), []byte(labelsYaml), os.FileMode(0755))
+	require.NoError(t, err)
+
+	// Create the rule rego file.
+	ruleFile, err := os.Create(filepath.Join(labelsDir, "address.rego"))
+	defer func() { _ = ruleFile.Close() }()
+	require.NoError(t, err)
+	err = os.WriteFile(ruleFile.Name(), []byte("package foo"), os.FileMode(0755))
+	require.NoError(t, err)
+
+	want := []Label{
+		{
+			Name:        "ADDRESS",
+			Description: "Address",
+			Tags:        []string{"PII"},
+		},
+	}
+	got, err := GetCustomLabels(labelsYamlFile.Name())
+	require.NoError(t, err)
+	require.Len(t, got, len(want))
+	for i := range got {
+		require.Equal(t, want[i].Name, got[i].Name)
+		require.Equal(t, want[i].Description, got[i].Description)
+		require.ElementsMatch(t, want[i].Tags, got[i].Tags)
+		// We don't care about the actual rule content, just that it was loaded.
+		require.NotNil(t, got[i].ClassificationRule)
+	}
+}
+
+func TestGetCustomLabels_RelativeRulePath_DifferentDir(t *testing.T) {
+	labelsDir := t.TempDir()
+	ruleDir := t.TempDir()
+	relRulPath, err := filepath.Rel(labelsDir, ruleDir)
+	require.NoError(t, err)
+
+	// Create the labels YAML file.
+	labelsYamlFile, err := os.CreateTemp(labelsDir, "labels.yaml")
+	defer func() { _ = labelsYamlFile.Close() }()
+	require.NoError(t, err)
+	labelsYaml := fmt.Sprintf(
+		`ADDRESS:
+  description: Address
+  rule: %s/address.rego
+  tags:
+    - PII`, relRulPath,
+	)
+	err = os.WriteFile(labelsYamlFile.Name(), []byte(labelsYaml), os.FileMode(0755))
+	require.NoError(t, err)
+
+	// Create the rule rego file.
+	ruleFile, err := os.Create(filepath.Join(ruleDir, "address.rego"))
+	defer func() { _ = ruleFile.Close() }()
+	require.NoError(t, err)
+	err = os.WriteFile(ruleFile.Name(), []byte("package foo"), os.FileMode(0755))
+	require.NoError(t, err)
+
+	want := []Label{
+		{
+			Name:        "ADDRESS",
+			Description: "Address",
+			Tags:        []string{"PII"},
+		},
+	}
+	got, err := GetCustomLabels(labelsYamlFile.Name())
+	require.NoError(t, err)
+	require.Len(t, got, len(want))
+	for i := range got {
+		require.Equal(t, want[i].Name, got[i].Name)
+		require.Equal(t, want[i].Description, got[i].Description)
+		require.ElementsMatch(t, want[i].Tags, got[i].Tags)
+		// We don't care about the actual rule content, just that it was loaded.
+		require.NotNil(t, got[i].ClassificationRule)
+	}
+}
+
+func TestGetCustomLabels_AbsoluteRulePath(t *testing.T) {
+	labelsDir := t.TempDir()
+	ruleDir := t.TempDir()
+
+	// Create the labels YAML file.
+	labelsYamlFile, err := os.CreateTemp(labelsDir, "labels.yaml")
+	defer func() { _ = labelsYamlFile.Close() }()
+	require.NoError(t, err)
+	labelsYaml := fmt.Sprintf(
+		`ADDRESS:
+  description: Address
+  rule: %s/address.rego
+  tags:
+    - PII`, ruleDir,
+	)
+	err = os.WriteFile(labelsYamlFile.Name(), []byte(labelsYaml), os.FileMode(0755))
+	require.NoError(t, err)
+
+	// Create the rule rego file.
+	ruleFile, err := os.Create(filepath.Join(ruleDir, "address.rego"))
+	defer func() { _ = ruleFile.Close() }()
+	require.NoError(t, err)
+	err = os.WriteFile(ruleFile.Name(), []byte("package foo"), os.FileMode(0755))
+	require.NoError(t, err)
+
+	want := []Label{
+		{
+			Name:        "ADDRESS",
+			Description: "Address",
+			Tags:        []string{"PII"},
+		},
+	}
+	got, err := GetCustomLabels(labelsYamlFile.Name())
+	require.NoError(t, err)
+	require.Len(t, got, len(want))
+	for i := range got {
+		require.Equal(t, want[i].Name, got[i].Name)
+		require.Equal(t, want[i].Description, got[i].Description)
+		require.ElementsMatch(t, want[i].Tags, got[i].Tags)
+		// We don't care about the actual rule content, just that it was loaded.
+		require.NotNil(t, got[i].ClassificationRule)
+	}
+}
diff --git a/sql/scanner.go b/sql/scanner.go
index 7c98d45..4201a8a 100644
--- a/sql/scanner.go
+++ b/sql/scanner.go
@@ -62,13 +62,16 @@ func NewScanner(ctx context.Context, cfg ScannerConfig) (*Scanner, error) {
 		lbls, err = classification.GetCustomLabels(cfg.LabelsYamlFilename)
 	}
 	if err != nil {
-		errMsg := fmt.Sprintf("error(s) loading data labels")
+		errMsg := "error(s) loading data labels"
 		// This error means that some labels weren't loaded due to having
 		// invalid classification rules. We only log a warning in this case,
 		// since we still want to proceed with the labels that were
 		// successfully loaded.
 		var errs classification.InvalidLabelsError
 		if errors.As(err, &errs) {
+			if len(lbls) == 0 {
+				return nil, fmt.Errorf("%s; no labels were loaded: %w", errMsg, err)
+			}
 			log.WithError(errs).Warnf("%s: some labels were not loaded", errMsg)
 		} else {
 			return nil, fmt.Errorf("%s: %w", errMsg, err)