@dbx-tools/auth 0.9.51 → 0.9.58

package/lib/src/profile.d.ts

@@ -5,7 +5,7 @@ export interface ListProfilesOptions {
     configFile?: string;
     refresh?: boolean;
 }
-/** Resolve one selected profile without exposing credentials. */
-export declare function resolveProfile(options?: DatabricksAuthOptions): DatabricksProfileSummary;
+/** Resolve one configured profile without exposing credentials, or `null` when none exists. */
+export declare function resolveProfile(options?: DatabricksAuthOptions): DatabricksProfileSummary | null;
 /** List configured profiles without exposing credentials. */
 export declare function listProfiles(options?: ListProfilesOptions): DatabricksProfileSummary[];

package/lib/src/profile.js

@@ -1,7 +1,26 @@
+import { AuthError } from "./_errors.js";
 import { listDatabricksProfiles, resolveDatabricksProfile } from "./_profile-config.js";
-/** Resolve one selected profile without exposing credentials. */
+/** Resolve one configured profile without exposing credentials, or `null` when none exists. */
 export function resolveProfile(options = {}) {
-    return toProfileSummary(resolveDatabricksProfile(options));
+    const configured = listDatabricksProfiles(options.configFile);
+    if (configured.length === 0)
+        return null;
+    const environment = options.configFile
+        ? { DATABRICKS_CONFIG_FILE: options.configFile }
+        : process.env;
+    try {
+        const resolved = resolveDatabricksProfile(options, environment);
+        if (!resolved.selectedProfile ||
+            !configured.some(({ name }) => name === resolved.selectedProfile)) {
+            return null;
+        }
+        return toProfileSummary(resolved);
+    }
+    catch (error) {
+        if (error instanceof AuthError && error.kind === "config")
+            return null;
+        throw error;
+    }
 }
 /** List configured profiles without exposing credentials. */
 export function listProfiles(options = {}) {
@@ -18,4 +37,4 @@ function toProfileSummary(profile) {
         principal: profile.principal,
     };
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicHJvZmlsZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9wcm9maWxlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUVBLE9BQU8sRUFBRSxzQkFBc0IsRUFBRSx3QkFBd0IsRUFBRSxNQUFNLHNCQUFzQixDQUFDO0FBVXhGLGlFQUFpRTtBQUNqRSxNQUFNLFVBQVUsY0FBYyxDQUFDLFVBQWlDLEVBQUU7SUFDaEUsT0FBTyxnQkFBZ0IsQ0FBQyx3QkFBd0IsQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDO0FBQzdELENBQUM7QUFFRCw2REFBNkQ7QUFDN0QsTUFBTSxVQUFVLFlBQVksQ0FBQyxVQUErQixFQUFFO0lBQzVELE9BQU8sc0JBQXNCLENBQUMsT0FBTyxDQUFDLFVBQVUsRUFBRSxPQUFPLENBQUMsT0FBTyxDQUFDLENBQUM7QUFDckUsQ0FBQztBQUVELFNBQVMsZ0JBQWdCLENBQUMsT0FBMEI7SUFDbEQsT0FBTztRQUNMLElBQUksRUFBRSxPQUFPLENBQUMsSUFBSTtRQUNsQixJQUFJLEVBQUUsT0FBTyxDQUFDLElBQUk7UUFDbEIsR0FBRyxDQUFDLE9BQU8sQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLEVBQUUsU0FBUyxFQUFFLE9BQU8sQ0FBQyxTQUFTLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO1FBQzlELEdBQUcsQ0FBQyxPQUFPLENBQUMsV0FBVyxDQUFDLENBQUMsQ0FBQyxFQUFFLFdBQVcsRUFBRSxPQUFPLENBQUMsV0FBVyxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUNwRSxNQUFNLEVBQUUsT0FBTyxDQUFDLE1BQU07UUFDdEIsUUFBUSxFQUFFLE9BQU8sQ0FBQyxRQUFRO1FBQzFCLFNBQVMsRUFBRSxPQUFPLENBQUMsU0FBUztLQUM3QixDQUFDO0FBQ0osQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB0eXBlIHsgRGF0YWJyaWNrc1Byb2ZpbGVTdW1tYXJ5IH0gZnJvbSBcIkBkYngtdG9vbHMvc2hhcmVkLWF1dGgvcHJvZmlsZVwiO1xuXG5pbXBvcnQgeyBsaXN0RGF0YWJyaWNrc1Byb2ZpbGVzLCByZXNvbHZlRGF0YWJyaWNrc1Byb2ZpbGUgfSBmcm9tIFwiLi9fcHJvZmlsZS1jb25maWcudHNcIjtcbmltcG9ydCB0eXBlIHsgRGF0YWJyaWNrc1Byb2ZpbGUgfSBmcm9tIFwiLi9fdHlwZXMudHNcIjtcbmltcG9ydCB0eXBlIHsgRGF0YWJyaWNrc0F1dGhPcHRpb25zIH0gZnJvbSBcIi4vY29uZmlnLnRzXCI7XG5cbi8qKiBQcm9maWxlLWxpc3RpbmcgY29udHJvbHMuICovXG5leHBvcnQgaW50ZXJmYWNlIExpc3RQcm9maWxlc09wdGlvbnMge1xuICBjb25maWdGaWxlPzogc3RyaW5nO1xuICByZWZyZXNoPzogYm9vbGVhbjtcbn1cblxuLyoqIFJlc29sdmUgb25lIHNlbGVjdGVkIHByb2ZpbGUgd2l0aG91dCBleHBvc2luZyBjcmVkZW50aWFscy4gKi9cbmV4cG9ydCBmdW5jdGlvbiByZXNvbHZlUHJvZmlsZShvcHRpb25zOiBEYXRhYnJpY2tzQXV0aE9wdGlvbnMgPSB7fSk6IERhdGFicmlja3NQcm9maWxlU3VtbWFyeSB7XG4gIHJldHVybiB0b1Byb2ZpbGVTdW1tYXJ5KHJlc29sdmVEYXRhYnJpY2tzUHJvZmlsZShvcHRpb25zKSk7XG59XG5cbi8qKiBMaXN0IGNvbmZpZ3VyZWQgcHJvZmlsZXMgd2l0aG91dCBleHBvc2luZyBjcmVkZW50aWFscy4gKi9cbmV4cG9ydCBmdW5jdGlvbiBsaXN0UHJvZmlsZXMob3B0aW9uczogTGlzdFByb2ZpbGVzT3B0aW9ucyA9IHt9KTogRGF0YWJyaWNrc1Byb2ZpbGVTdW1tYXJ5W10ge1xuICByZXR1cm4gbGlzdERhdGFicmlja3NQcm9maWxlcyhvcHRpb25zLmNvbmZpZ0ZpbGUsIG9wdGlvbnMucmVmcmVzaCk7XG59XG5cbmZ1bmN0aW9uIHRvUHJvZmlsZVN1bW1hcnkocHJvZmlsZTogRGF0YWJyaWNrc1Byb2ZpbGUpOiBEYXRhYnJpY2tzUHJvZmlsZVN1bW1hcnkge1xuICByZXR1cm4ge1xuICAgIG5hbWU6IHByb2ZpbGUubmFtZSxcbiAgICBob3N0OiBwcm9maWxlLmhvc3QsXG4gICAgLi4uKHByb2ZpbGUuYWNjb3VudElkID8geyBhY2NvdW50SWQ6IHByb2ZpbGUuYWNjb3VudElkIH0gOiB7fSksXG4gICAgLi4uKHByb2ZpbGUud29ya3NwYWNlSWQgPyB7IHdvcmtzcGFjZUlkOiBwcm9maWxlLndvcmtzcGFjZUlkIH0gOiB7fSksXG4gICAgdGFyZ2V0OiBwcm9maWxlLnRhcmdldCxcbiAgICBhdXRoVHlwZTogcHJvZmlsZS5hdXRoVHlwZSxcbiAgICBwcmluY2lwYWw6IHByb2ZpbGUucHJpbmNpcGFsLFxuICB9O1xufVxuIl19
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicHJvZmlsZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9wcm9maWxlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUVBLE9BQU8sRUFBRSxTQUFTLEVBQUUsTUFBTSxjQUFjLENBQUM7QUFDekMsT0FBTyxFQUFFLHNCQUFzQixFQUFFLHdCQUF3QixFQUFFLE1BQU0sc0JBQXNCLENBQUM7QUFVeEYsK0ZBQStGO0FBQy9GLE1BQU0sVUFBVSxjQUFjLENBQzVCLFVBQWlDLEVBQUU7SUFFbkMsTUFBTSxVQUFVLEdBQUcsc0JBQXNCLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQzlELElBQUksVUFBVSxDQUFDLE1BQU0sS0FBSyxDQUFDO1FBQUUsT0FBTyxJQUFJLENBQUM7SUFDekMsTUFBTSxXQUFXLEdBQUcsT0FBTyxDQUFDLFVBQVU7UUFDcEMsQ0FBQyxDQUFDLEVBQUUsc0JBQXNCLEVBQUUsT0FBTyxDQUFDLFVBQVUsRUFBRTtRQUNoRCxDQUFDLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQztJQUNoQixJQUFJLENBQUM7UUFDSCxNQUFNLFFBQVEsR0FBRyx3QkFBd0IsQ0FBQyxPQUFPLEVBQUUsV0FBVyxDQUFDLENBQUM7UUFDaEUsSUFDRSxDQUFDLFFBQVEsQ0FBQyxlQUFlO1lBQ3pCLENBQUMsVUFBVSxDQUFDLElBQUksQ0FBQyxDQUFDLEVBQUUsSUFBSSxFQUFFLEVBQUUsRUFBRSxDQUFDLElBQUksS0FBSyxRQUFRLENBQUMsZUFBZSxDQUFDLEVBQ2pFLENBQUM7WUFDRCxPQUFPLElBQUksQ0FBQztRQUNkLENBQUM7UUFDRCxPQUFPLGdCQUFnQixDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ3BDLENBQUM7SUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1FBQ2YsSUFBSSxLQUFLLFlBQVksU0FBUyxJQUFJLEtBQUssQ0FBQyxJQUFJLEtBQUssUUFBUTtZQUFFLE9BQU8sSUFBSSxDQUFDO1FBQ3ZFLE1BQU0sS0FBSyxDQUFDO0lBQ2QsQ0FBQztBQUNILENBQUM7QUFFRCw2REFBNkQ7QUFDN0QsTUFBTSxVQUFVLFlBQVksQ0FBQyxVQUErQixFQUFFO0lBQzVELE9BQU8sc0JBQXNCLENBQUMsT0FBTyxDQUFDLFVBQVUsRUFBRSxPQUFPLENBQUMsT0FBTyxDQUFDLENBQUM7QUFDckUsQ0FBQztBQUVELFNBQVMsZ0JBQWdCLENBQUMsT0FBMEI7SUFDbEQsT0FBTztRQUNMLElBQUksRUFBRSxPQUFPLENBQUMsSUFBSTtRQUNsQixJQUFJLEVBQUUsT0FBTyxDQUFDLElBQUk7UUFDbEIsR0FBRyxDQUFDLE9BQU8sQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLEVBQUUsU0FBUyxFQUFFLE9BQU8sQ0FBQyxTQUFTLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO1FBQzlELEdBQUcsQ0FBQyxPQUFPLENBQUMsV0FBVyxDQUFDLENBQUMsQ0FBQyxFQUFFLFdBQVcsRUFBRSxPQUFPLENBQUMsV0FBVyxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUNwRSxNQUFNLEVBQUUsT0FBTyxDQUFDLE1BQU07UUFDdEIsUUFBUSxFQUFFLE9BQU8sQ0FBQyxRQUFRO1FBQzFCLFNBQVMsRUFBRSxPQUFPLENBQUMsU0FBUztLQUM3QixDQUFDO0FBQ0osQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB0eXBlIHsgRGF0YWJyaWNrc1Byb2ZpbGVTdW1tYXJ5IH0gZnJvbSBcIkBkYngtdG9vbHMvc2hhcmVkLWF1dGgvcHJvZmlsZVwiO1xuXG5pbXBvcnQgeyBBdXRoRXJyb3IgfSBmcm9tIFwiLi9fZXJyb3JzLnRzXCI7XG5pbXBvcnQgeyBsaXN0RGF0YWJyaWNrc1Byb2ZpbGVzLCByZXNvbHZlRGF0YWJyaWNrc1Byb2ZpbGUgfSBmcm9tIFwiLi9fcHJvZmlsZS1jb25maWcudHNcIjtcbmltcG9ydCB0eXBlIHsgRGF0YWJyaWNrc1Byb2ZpbGUgfSBmcm9tIFwiLi9fdHlwZXMudHNcIjtcbmltcG9ydCB0eXBlIHsgRGF0YWJyaWNrc0F1dGhPcHRpb25zIH0gZnJvbSBcIi4vY29uZmlnLnRzXCI7XG5cbi8qKiBQcm9maWxlLWxpc3RpbmcgY29udHJvbHMuICovXG5leHBvcnQgaW50ZXJmYWNlIExpc3RQcm9maWxlc09wdGlvbnMge1xuICBjb25maWdGaWxlPzogc3RyaW5nO1xuICByZWZyZXNoPzogYm9vbGVhbjtcbn1cblxuLyoqIFJlc29sdmUgb25lIGNvbmZpZ3VyZWQgcHJvZmlsZSB3aXRob3V0IGV4cG9zaW5nIGNyZWRlbnRpYWxzLCBvciBgbnVsbGAgd2hlbiBub25lIGV4aXN0cy4gKi9cbmV4cG9ydCBmdW5jdGlvbiByZXNvbHZlUHJvZmlsZShcbiAgb3B0aW9uczogRGF0YWJyaWNrc0F1dGhPcHRpb25zID0ge30sXG4pOiBEYXRhYnJpY2tzUHJvZmlsZVN1bW1hcnkgfCBudWxsIHtcbiAgY29uc3QgY29uZmlndXJlZCA9IGxpc3REYXRhYnJpY2tzUHJvZmlsZXMob3B0aW9ucy5jb25maWdGaWxlKTtcbiAgaWYgKGNvbmZpZ3VyZWQubGVuZ3RoID09PSAwKSByZXR1cm4gbnVsbDtcbiAgY29uc3QgZW52aXJvbm1lbnQgPSBvcHRpb25zLmNvbmZpZ0ZpbGVcbiAgICA/IHsgREFUQUJSSUNLU19DT05GSUdfRklMRTogb3B0aW9ucy5jb25maWdGaWxlIH1cbiAgICA6IHByb2Nlc3MuZW52O1xuICB0cnkge1xuICAgIGNvbnN0IHJlc29sdmVkID0gcmVzb2x2ZURhdGFicmlja3NQcm9maWxlKG9wdGlvbnMsIGVudmlyb25tZW50KTtcbiAgICBpZiAoXG4gICAgICAhcmVzb2x2ZWQuc2VsZWN0ZWRQcm9maWxlIHx8XG4gICAgICAhY29uZmlndXJlZC5zb21lKCh7IG5hbWUgfSkgPT4gbmFtZSA9PT0gcmVzb2x2ZWQuc2VsZWN0ZWRQcm9maWxlKVxuICAgICkge1xuICAgICAgcmV0dXJuIG51bGw7XG4gICAgfVxuICAgIHJldHVybiB0b1Byb2ZpbGVTdW1tYXJ5KHJlc29sdmVkKTtcbiAgfSBjYXRjaCAoZXJyb3IpIHtcbiAgICBpZiAoZXJyb3IgaW5zdGFuY2VvZiBBdXRoRXJyb3IgJiYgZXJyb3Iua2luZCA9PT0gXCJjb25maWdcIikgcmV0dXJuIG51bGw7XG4gICAgdGhyb3cgZXJyb3I7XG4gIH1cbn1cblxuLyoqIExpc3QgY29uZmlndXJlZCBwcm9maWxlcyB3aXRob3V0IGV4cG9zaW5nIGNyZWRlbnRpYWxzLiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGxpc3RQcm9maWxlcyhvcHRpb25zOiBMaXN0UHJvZmlsZXNPcHRpb25zID0ge30pOiBEYXRhYnJpY2tzUHJvZmlsZVN1bW1hcnlbXSB7XG4gIHJldHVybiBsaXN0RGF0YWJyaWNrc1Byb2ZpbGVzKG9wdGlvbnMuY29uZmlnRmlsZSwgb3B0aW9ucy5yZWZyZXNoKTtcbn1cblxuZnVuY3Rpb24gdG9Qcm9maWxlU3VtbWFyeShwcm9maWxlOiBEYXRhYnJpY2tzUHJvZmlsZSk6IERhdGFicmlja3NQcm9maWxlU3VtbWFyeSB7XG4gIHJldHVybiB7XG4gICAgbmFtZTogcHJvZmlsZS5uYW1lLFxuICAgIGhvc3Q6IHByb2ZpbGUuaG9zdCxcbiAgICAuLi4ocHJvZmlsZS5hY2NvdW50SWQgPyB7IGFjY291bnRJZDogcHJvZmlsZS5hY2NvdW50SWQgfSA6IHt9KSxcbiAgICAuLi4ocHJvZmlsZS53b3Jrc3BhY2VJZCA/IHsgd29ya3NwYWNlSWQ6IHByb2ZpbGUud29ya3NwYWNlSWQgfSA6IHt9KSxcbiAgICB0YXJnZXQ6IHByb2ZpbGUudGFyZ2V0LFxuICAgIGF1dGhUeXBlOiBwcm9maWxlLmF1dGhUeXBlLFxuICAgIHByaW5jaXBhbDogcHJvZmlsZS5wcmluY2lwYWwsXG4gIH07XG59XG4iXX0=

package/lib/src/runtime-auth.d.ts

@@ -0,0 +1,21 @@
+import type { AuthClient } from "./client.ts";
+import { type DatabricksAuthOptions } from "./config.ts";
+/** Python runtime authentication operations backed by one SDK WorkspaceClient. */
+export interface DatabricksRuntimeAuthClient {
+    /** Resolved Databricks workspace URL. */
+    readonly host: string;
+    /** Resolved workspace identifier when the Python SDK provides one. */
+    readonly workspaceId?: string;
+    /** Resolved caller identifier when the Python SDK provides one. */
+    readonly principal?: string;
+    /** Return the Python SDK's directly configured token, when present. */
+    token(): Promise<string | undefined>;
+    /** Return fresh authentication headers from the Python SDK. */
+    authenticate(): Promise<Record<string, string>>;
+}
+/**
+ * Return auth installed by the shared Python Node runtime, when available.
+ */
+export declare function _databricksRuntimeAuthClient(): Promise<DatabricksRuntimeAuthClient | undefined>;
+/** Create an auth facade over a Python runtime WorkspaceClient. */
+export declare function createDatabricksRuntimeAuthClient(runtime: DatabricksRuntimeAuthClient, options: DatabricksAuthOptions): AuthClient;

package/lib/src/runtime-auth.js

@@ -0,0 +1,139 @@
+import { RUNTIME_AUTH_TYPE } from "@dbx-tools/shared-auth/client";
+import { TargetKind } from "@dbx-tools/shared-auth/config";
+import { getAccessTokenPayload, getAccessTokenScopes } from "@dbx-tools/shared-core/token";
+import { AuthError } from "./_errors.js";
+import { TokenLifecycle } from "./_lifecycle.js";
+import { normalizeHost } from "./_profile-config.js";
+import { MemoryCredentialStore } from "./_storage.js";
+import { AUTH_DEFAULTS, DEFAULT_ACCESS_TOKEN_HEADER, WORKSPACE_ID_HEADER, } from "./config.js";
+const MINIMUM_RUNTIME_TOKEN_TTL_MS = 60_000;
+const RUNTIME_PRINCIPAL = "runtime";
+/**
+ * Return auth installed by the shared Python Node runtime, when available.
+ */
+export async function _databricksRuntimeAuthClient() {
+    const runtime = globalThis[Symbol.for("@dbx-tools/node-runtime/runtime")];
+    return runtime?.databricksRuntimeAuthClient?.();
+}
+/** Create an auth facade over a Python runtime WorkspaceClient. */
+export function createDatabricksRuntimeAuthClient(runtime, options) {
+    const lifecycleOptions = {
+        ...AUTH_DEFAULTS,
+        ...options.auth,
+    };
+    const provider = new DatabricksRuntimeTokenProvider(runtime, lifecycleOptions.refreshBufferMs);
+    const lifecycle = new TokenLifecycle(runtimeCacheKey(runtime), provider, new MemoryCredentialStore(), lifecycleOptions);
+    return new DefaultDatabricksRuntimeAuthClient(runtime, provider, lifecycle);
+}
+function runtimeCacheKey(runtime) {
+    return [
+        RUNTIME_AUTH_TYPE,
+        normalizeHost(runtime.host, RUNTIME_PRINCIPAL),
+        runtime.workspaceId ?? "",
+        runtime.principal ?? "",
+    ].join(":");
+}
+function normalizedHeaders(headers) {
+    return Object.fromEntries(Object.entries(headers).map(([name, value]) => [name.toLowerCase(), value]));
+}
+function runtimeToken(headers, refreshBufferMs, configuredToken) {
+    const authorization = headers[DEFAULT_ACCESS_TOKEN_HEADER];
+    const match = authorization?.trim().match(/^(\S+)\s+(.+)$/);
+    const accessToken = match?.[2]?.trim() || configuredToken?.trim();
+    if (!accessToken) {
+        throw new AuthError("oauth", "Databricks Python runtime authentication did not provide an access token");
+    }
+    const payload = getAccessTokenPayload(accessToken);
+    const jwtExpiry = typeof payload.exp === "number" && Number.isFinite(payload.exp)
+        ? new Date(payload.exp * 1000).toISOString()
+        : undefined;
+    // Opaque runtime credentials still need a bounded Node cache. Reacquire them
+    // from the Python SDK after one refresh-buffer interval.
+    const expiry = jwtExpiry ??
+        new Date(Date.now() + Math.max(refreshBufferMs * 2, MINIMUM_RUNTIME_TOKEN_TTL_MS)).toISOString();
+    return {
+        accessToken,
+        tokenType: match?.[1] || "Bearer",
+        ...(expiry ? { expiry } : {}),
+        scopes: [...getAccessTokenScopes(accessToken)],
+    };
+}
+class DatabricksRuntimeTokenProvider {
+    runtime;
+    refreshBufferMs;
+    #accessToken;
+    #headers;
+    constructor(runtime, refreshBufferMs) {
+        this.runtime = runtime;
+        this.refreshBufferMs = refreshBufferMs;
+    }
+    authenticate() {
+        return this.acquire();
+    }
+    login() {
+        return this.acquire();
+    }
+    refresh() {
+        return this.acquire();
+    }
+    canAuthenticateSilently() {
+        return true;
+    }
+    headers(token) {
+        if (this.#accessToken === token.accessToken && this.#headers) {
+            return { ...this.#headers };
+        }
+        return {
+            [DEFAULT_ACCESS_TOKEN_HEADER]: `${token.tokenType} ${token.accessToken}`,
+        };
+    }
+    clear() {
+        this.#accessToken = undefined;
+        this.#headers = undefined;
+    }
+    async acquire() {
+        const headers = normalizedHeaders(await this.runtime.authenticate());
+        const token = runtimeToken(headers, this.refreshBufferMs, await this.runtime.token());
+        this.#accessToken = token.accessToken;
+        this.#headers = {
+            ...headers,
+            [DEFAULT_ACCESS_TOKEN_HEADER]: `${token.tokenType} ${token.accessToken}`,
+        };
+        return token;
+    }
+}
+class DefaultDatabricksRuntimeAuthClient {
+    provider;
+    lifecycle;
+    profile = undefined;
+    host;
+    accountId = undefined;
+    workspaceId;
+    target = TargetKind.Workspace;
+    authType = RUNTIME_AUTH_TYPE;
+    principal;
+    constructor(runtime, provider, lifecycle) {
+        this.provider = provider;
+        this.lifecycle = lifecycle;
+        this.host = normalizeHost(runtime.host, RUNTIME_PRINCIPAL);
+        this.workspaceId = runtime.workspaceId;
+        this.principal = runtime.principal || RUNTIME_PRINCIPAL;
+    }
+    token(options = {}) {
+        return options.refresh
+            ? this.lifecycle.forceRefresh(options.login ?? true)
+            : this.lifecycle.tokenWithLogin(options.login);
+    }
+    async headers(options = {}) {
+        const headers = this.provider.headers(await this.token(options));
+        if (this.workspaceId && headers[WORKSPACE_ID_HEADER] === undefined) {
+            headers[WORKSPACE_ID_HEADER] = this.workspaceId;
+        }
+        return headers;
+    }
+    async logout() {
+        await this.lifecycle.logout();
+        this.provider.clear();
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicnVudGltZS1hdXRoLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL3J1bnRpbWUtYXV0aC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQUUsaUJBQWlCLEVBQUUsTUFBTSwrQkFBK0IsQ0FBQztBQUNsRSxPQUFPLEVBQUUsVUFBVSxFQUFFLE1BQU0sK0JBQStCLENBQUM7QUFDM0QsT0FBTyxFQUFFLHFCQUFxQixFQUFFLG9CQUFvQixFQUFFLE1BQU0sOEJBQThCLENBQUM7QUFFM0YsT0FBTyxFQUFFLFNBQVMsRUFBRSxNQUFNLGNBQWMsQ0FBQztBQUN6QyxPQUFPLEVBQUUsY0FBYyxFQUFFLE1BQU0saUJBQWlCLENBQUM7QUFDakQsT0FBTyxFQUFFLGFBQWEsRUFBRSxNQUFNLHNCQUFzQixDQUFDO0FBQ3JELE9BQU8sRUFBRSxxQkFBcUIsRUFBRSxNQUFNLGVBQWUsQ0FBQztBQUd0RCxPQUFPLEVBQ0wsYUFBYSxFQUViLDJCQUEyQixFQUMzQixtQkFBbUIsR0FDcEIsTUFBTSxhQUFhLENBQUM7QUFFckIsTUFBTSw0QkFBNEIsR0FBRyxNQUFNLENBQUM7QUFDNUMsTUFBTSxpQkFBaUIsR0FBRyxTQUFTLENBQUM7QUFvQnBDOztHQUVHO0FBQ0gsTUFBTSxDQUFDLEtBQUssVUFBVSw0QkFBNEI7SUFHaEQsTUFBTSxPQUFPLEdBQ1gsVUFHRCxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsaUNBQWlDLENBQUMsQ0FBQyxDQUFDO0lBQ2pELE9BQU8sT0FBTyxFQUFFLDJCQUEyQixFQUFFLEVBQUUsQ0FBQztBQUNsRCxDQUFDO0FBRUQsbUVBQW1FO0FBQ25FLE1BQU0sVUFBVSxpQ0FBaUMsQ0FDL0MsT0FBb0MsRUFDcEMsT0FBOEI7SUFFOUIsTUFBTSxnQkFBZ0IsR0FBRztRQUN2QixHQUFHLGFBQWE7UUFDaEIsR0FBRyxPQUFPLENBQUMsSUFBSTtLQUNoQixDQUFDO0lBQ0YsTUFBTSxRQUFRLEdBQUcsSUFBSSw4QkFBOEIsQ0FBQyxPQUFPLEVBQUUsZ0JBQWdCLENBQUMsZUFBZSxDQUFDLENBQUM7SUFDL0YsTUFBTSxTQUFTLEdBQUcsSUFBSSxjQUFjLENBQ2xDLGVBQWUsQ0FBQyxPQUFPLENBQUMsRUFDeEIsUUFBUSxFQUNSLElBQUkscUJBQXFCLEVBQUUsRUFDM0IsZ0JBQWdCLENBQ2pCLENBQUM7SUFDRixPQUFPLElBQUksa0NBQWtDLENBQUMsT0FBTyxFQUFFLFFBQVEsRUFBRSxTQUFTLENBQUMsQ0FBQztBQUM5RSxDQUFDO0FBRUQsU0FBUyxlQUFlLENBQUMsT0FBb0M7SUFDM0QsT0FBTztRQUNMLGlCQUFpQjtRQUNqQixhQUFhLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRSxpQkFBaUIsQ0FBQztRQUM5QyxPQUFPLENBQUMsV0FBVyxJQUFJLEVBQUU7UUFDekIsT0FBTyxDQUFDLFNBQVMsSUFBSSxFQUFFO0tBQ3hCLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDO0FBQ2QsQ0FBQztBQUVELFNBQVMsaUJBQWlCLENBQUMsT0FBeUM7SUFDbEUsT0FBTyxNQUFNLENBQUMsV0FBVyxDQUN2QixNQUFNLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsSUFBSSxFQUFFLEtBQUssQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLElBQUksQ0FBQyxXQUFXLEVBQUUsRUFBRSxLQUFLLENBQUMsQ0FBQyxDQUM1RSxDQUFDO0FBQ0osQ0FBQztBQUVELFNBQVMsWUFBWSxDQUNuQixPQUF5QyxFQUN6QyxlQUF1QixFQUN2QixlQUF3QjtJQUV4QixNQUFNLGFBQWEsR0FBRyxPQUFPLENBQUMsMkJBQTJCLENBQUMsQ0FBQztJQUMzRCxNQUFNLEtBQUssR0FBRyxhQUFhLEVBQUUsSUFBSSxFQUFFLENBQUMsS0FBSyxDQUFDLGdCQUFnQixDQUFDLENBQUM7SUFDNUQsTUFBTSxXQUFXLEdBQUcsS0FBSyxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsSUFBSSxFQUFFLElBQUksZUFBZSxFQUFFLElBQUksRUFBRSxDQUFDO0lBQ2xFLElBQUksQ0FBQyxXQUFXLEVBQUUsQ0FBQztRQUNqQixNQUFNLElBQUksU0FBUyxDQUNqQixPQUFPLEVBQ1AsMEVBQTBFLENBQzNFLENBQUM7SUFDSixDQUFDO0lBQ0QsTUFBTSxPQUFPLEdBQUcscUJBQXFCLENBQUMsV0FBVyxDQUFDLENBQUM7SUFDbkQsTUFBTSxTQUFTLEdBQ2IsT0FBTyxPQUFPLENBQUMsR0FBRyxLQUFLLFFBQVEsSUFBSSxNQUFNLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUM7UUFDN0QsQ0FBQyxDQUFDLElBQUksSUFBSSxDQUFDLE9BQU8sQ0FBQyxHQUFHLEdBQUcsSUFBSSxDQUFDLENBQUMsV0FBVyxFQUFFO1FBQzVDLENBQUMsQ0FBQyxTQUFTLENBQUM7SUFDaEIsNkVBQTZFO0lBQzdFLHlEQUF5RDtJQUN6RCxNQUFNLE1BQU0sR0FDVixTQUFTO1FBQ1QsSUFBSSxJQUFJLENBQ04sSUFBSSxDQUFDLEdBQUcsRUFBRSxHQUFHLElBQUksQ0FBQyxHQUFHLENBQUMsZUFBZSxHQUFHLENBQUMsRUFBRSw0QkFBNEIsQ0FBQyxDQUN6RSxDQUFDLFdBQVcsRUFBRSxDQUFDO0lBQ2xCLE9BQU87UUFDTCxXQUFXO1FBQ1gsU0FBUyxFQUFFLEtBQUssRUFBRSxDQUFDLENBQUMsQ0FBQyxJQUFJLFFBQVE7UUFDakMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsRUFBRSxNQUFNLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO1FBQzdCLE1BQU0sRUFBRSxDQUFDLEdBQUcsb0JBQW9CLENBQUMsV0FBVyxDQUFDLENBQUM7S0FDL0MsQ0FBQztBQUNKLENBQUM7QUFFRCxNQUFNLDhCQUE4QjtJQUtmO0lBQ0E7SUFMbkIsWUFBWSxDQUFVO0lBQ3RCLFFBQVEsQ0FBMEI7SUFFbEMsWUFDbUIsT0FBb0MsRUFDcEMsZUFBdUI7UUFEdkIsWUFBTyxHQUFQLE9BQU8sQ0FBNkI7UUFDcEMsb0JBQWUsR0FBZixlQUFlLENBQVE7SUFDdkMsQ0FBQztJQUVKLFlBQVk7UUFDVixPQUFPLElBQUksQ0FBQyxPQUFPLEVBQUUsQ0FBQztJQUN4QixDQUFDO0lBRUQsS0FBSztRQUNILE9BQU8sSUFBSSxDQUFDLE9BQU8sRUFBRSxDQUFDO0lBQ3hCLENBQUM7SUFFRCxPQUFPO1FBQ0wsT0FBTyxJQUFJLENBQUMsT0FBTyxFQUFFLENBQUM7SUFDeEIsQ0FBQztJQUVELHVCQUF1QjtRQUNyQixPQUFPLElBQUksQ0FBQztJQUNkLENBQUM7SUFFRCxPQUFPLENBQUMsS0FBa0I7UUFDeEIsSUFBSSxJQUFJLENBQUMsWUFBWSxLQUFLLEtBQUssQ0FBQyxXQUFXLElBQUksSUFBSSxDQUFDLFFBQVEsRUFBRSxDQUFDO1lBQzdELE9BQU8sRUFBRSxHQUFHLElBQUksQ0FBQyxRQUFRLEVBQUUsQ0FBQztRQUM5QixDQUFDO1FBQ0QsT0FBTztZQUNMLENBQUMsMkJBQTJCLENBQUMsRUFBRSxHQUFHLEtBQUssQ0FBQyxTQUFTLElBQUksS0FBSyxDQUFDLFdBQVcsRUFBRTtTQUN6RSxDQUFDO0lBQ0osQ0FBQztJQUVELEtBQUs7UUFDSCxJQUFJLENBQUMsWUFBWSxHQUFHLFNBQVMsQ0FBQztRQUM5QixJQUFJLENBQUMsUUFBUSxHQUFHLFNBQVMsQ0FBQztJQUM1QixDQUFDO0lBRU8sS0FBSyxDQUFDLE9BQU87UUFDbkIsTUFBTSxPQUFPLEdBQUcsaUJBQWlCLENBQUMsTUFBTSxJQUFJLENBQUMsT0FBTyxDQUFDLFlBQVksRUFBRSxDQUFDLENBQUM7UUFDckUsTUFBTSxLQUFLLEdBQUcsWUFBWSxDQUFDLE9BQU8sRUFBRSxJQUFJLENBQUMsZUFBZSxFQUFFLE1BQU0sSUFBSSxDQUFDLE9BQU8sQ0FBQyxLQUFLLEVBQUUsQ0FBQyxDQUFDO1FBQ3RGLElBQUksQ0FBQyxZQUFZLEdBQUcsS0FBSyxDQUFDLFdBQVcsQ0FBQztRQUN0QyxJQUFJLENBQUMsUUFBUSxHQUFHO1lBQ2QsR0FBRyxPQUFPO1lBQ1YsQ0FBQywyQkFBMkIsQ0FBQyxFQUFFLEdBQUcsS0FBSyxDQUFDLFNBQVMsSUFBSSxLQUFLLENBQUMsV0FBVyxFQUFFO1NBQ3pFLENBQUM7UUFDRixPQUFPLEtBQUssQ0FBQztJQUNmLENBQUM7Q0FDRjtBQUVELE1BQU0sa0NBQWtDO0lBV25CO0lBQ0E7SUFYVixPQUFPLEdBQUcsU0FBUyxDQUFDO0lBQ3BCLElBQUksQ0FBUztJQUNiLFNBQVMsR0FBRyxTQUFTLENBQUM7SUFDdEIsV0FBVyxDQUFVO0lBQ3JCLE1BQU0sR0FBRyxVQUFVLENBQUMsU0FBUyxDQUFDO0lBQzlCLFFBQVEsR0FBRyxpQkFBaUIsQ0FBQztJQUM3QixTQUFTLENBQVM7SUFFM0IsWUFDRSxPQUFvQyxFQUNuQixRQUF3QyxFQUN4QyxTQUF5QjtRQUR6QixhQUFRLEdBQVIsUUFBUSxDQUFnQztRQUN4QyxjQUFTLEdBQVQsU0FBUyxDQUFnQjtRQUUxQyxJQUFJLENBQUMsSUFBSSxHQUFHLGFBQWEsQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFLGlCQUFpQixDQUFDLENBQUM7UUFDM0QsSUFBSSxDQUFDLFdBQVcsR0FBRyxPQUFPLENBQUMsV0FBVyxDQUFDO1FBQ3ZDLElBQUksQ0FBQyxTQUFTLEdBQUcsT0FBTyxDQUFDLFNBQVMsSUFBSSxpQkFBaUIsQ0FBQztJQUMxRCxDQUFDO0lBRUQsS0FBSyxDQUFDLFVBQXdCLEVBQUU7UUFDOUIsT0FBTyxPQUFPLENBQUMsT0FBTztZQUNwQixDQUFDLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxZQUFZLENBQUMsT0FBTyxDQUFDLEtBQUssSUFBSSxJQUFJLENBQUM7WUFDcEQsQ0FBQyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsY0FBYyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsQ0FBQztJQUNuRCxDQUFDO0lBRUQsS0FBSyxDQUFDLE9BQU8sQ0FBQyxVQUF3QixFQUFFO1FBQ3RDLE1BQU0sT0FBTyxHQUFHLElBQUksQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLE1BQU0sSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDO1FBQ2pFLElBQUksSUFBSSxDQUFDLFdBQVcsSUFBSSxPQUFPLENBQUMsbUJBQW1CLENBQUMsS0FBSyxTQUFTLEVBQUUsQ0FBQztZQUNuRSxPQUFPLENBQUMsbUJBQW1CLENBQUMsR0FBRyxJQUFJLENBQUMsV0FBVyxDQUFDO1FBQ2xELENBQUM7UUFDRCxPQUFPLE9BQU8sQ0FBQztJQUNqQixDQUFDO0lBRUQsS0FBSyxDQUFDLE1BQU07UUFDVixNQUFNLElBQUksQ0FBQyxTQUFTLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDOUIsSUFBSSxDQUFDLFFBQVEsQ0FBQyxLQUFLLEVBQUUsQ0FBQztJQUN4QixDQUFDO0NBQ0YiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyBSVU5USU1FX0FVVEhfVFlQRSB9IGZyb20gXCJAZGJ4LXRvb2xzL3NoYXJlZC1hdXRoL2NsaWVudFwiO1xuaW1wb3J0IHsgVGFyZ2V0S2luZCB9IGZyb20gXCJAZGJ4LXRvb2xzL3NoYXJlZC1hdXRoL2NvbmZpZ1wiO1xuaW1wb3J0IHsgZ2V0QWNjZXNzVG9rZW5QYXlsb2FkLCBnZXRBY2Nlc3NUb2tlblNjb3BlcyB9IGZyb20gXCJAZGJ4LXRvb2xzL3NoYXJlZC1jb3JlL3Rva2VuXCI7XG5cbmltcG9ydCB7IEF1dGhFcnJvciB9IGZyb20gXCIuL19lcnJvcnMudHNcIjtcbmltcG9ydCB7IFRva2VuTGlmZWN5Y2xlIH0gZnJvbSBcIi4vX2xpZmVjeWNsZS50c1wiO1xuaW1wb3J0IHsgbm9ybWFsaXplSG9zdCB9IGZyb20gXCIuL19wcm9maWxlLWNvbmZpZy50c1wiO1xuaW1wb3J0IHsgTWVtb3J5Q3JlZGVudGlhbFN0b3JlIH0gZnJvbSBcIi4vX3N0b3JhZ2UudHNcIjtcbmltcG9ydCB0eXBlIHsgVG9rZW4sIFRva2VuUHJvdmlkZXIgfSBmcm9tIFwiLi9fdHlwZXMudHNcIjtcbmltcG9ydCB0eXBlIHsgQWNjZXNzVG9rZW4sIEF1dGhDbGllbnQsIFRva2VuT3B0aW9ucyB9IGZyb20gXCIuL2NsaWVudC50c1wiO1xuaW1wb3J0IHtcbiAgQVVUSF9ERUZBVUxUUyxcbiAgdHlwZSBEYXRhYnJpY2tzQXV0aE9wdGlvbnMsXG4gIERFRkFVTFRfQUNDRVNTX1RPS0VOX0hFQURFUixcbiAgV09SS1NQQUNFX0lEX0hFQURFUixcbn0gZnJvbSBcIi4vY29uZmlnLnRzXCI7XG5cbmNvbnN0IE1JTklNVU1fUlVOVElNRV9UT0tFTl9UVExfTVMgPSA2MF8wMDA7XG5jb25zdCBSVU5USU1FX1BSSU5DSVBBTCA9IFwicnVudGltZVwiO1xuXG4vKiogUHl0aG9uIHJ1bnRpbWUgYXV0aGVudGljYXRpb24gb3BlcmF0aW9ucyBiYWNrZWQgYnkgb25lIFNESyBXb3Jrc3BhY2VDbGllbnQuICovXG5leHBvcnQgaW50ZXJmYWNlIERhdGFicmlja3NSdW50aW1lQXV0aENsaWVudCB7XG4gIC8qKiBSZXNvbHZlZCBEYXRhYnJpY2tzIHdvcmtzcGFjZSBVUkwuICovXG4gIHJlYWRvbmx5IGhvc3Q6IHN0cmluZztcbiAgLyoqIFJlc29sdmVkIHdvcmtzcGFjZSBpZGVudGlmaWVyIHdoZW4gdGhlIFB5dGhvbiBTREsgcHJvdmlkZXMgb25lLiAqL1xuICByZWFkb25seSB3b3Jrc3BhY2VJZD86IHN0cmluZztcbiAgLyoqIFJlc29sdmVkIGNhbGxlciBpZGVudGlmaWVyIHdoZW4gdGhlIFB5dGhvbiBTREsgcHJvdmlkZXMgb25lLiAqL1xuICByZWFkb25seSBwcmluY2lwYWw/OiBzdHJpbmc7XG4gIC8qKiBSZXR1cm4gdGhlIFB5dGhvbiBTREsncyBkaXJlY3RseSBjb25maWd1cmVkIHRva2VuLCB3aGVuIHByZXNlbnQuICovXG4gIHRva2VuKCk6IFByb21pc2U8c3RyaW5nIHwgdW5kZWZpbmVkPjtcbiAgLyoqIFJldHVybiBmcmVzaCBhdXRoZW50aWNhdGlvbiBoZWFkZXJzIGZyb20gdGhlIFB5dGhvbiBTREsuICovXG4gIGF1dGhlbnRpY2F0ZSgpOiBQcm9taXNlPFJlY29yZDxzdHJpbmcsIHN0cmluZz4+O1xufVxuXG5pbnRlcmZhY2UgUHl0aG9uTm9kZVJ1bnRpbWUge1xuICBkYXRhYnJpY2tzUnVudGltZUF1dGhDbGllbnQ/KCk6IFByb21pc2U8RGF0YWJyaWNrc1J1bnRpbWVBdXRoQ2xpZW50IHwgdW5kZWZpbmVkPjtcbn1cblxuLyoqXG4gKiBSZXR1cm4gYXV0aCBpbnN0YWxsZWQgYnkgdGhlIHNoYXJlZCBQeXRob24gTm9kZSBydW50aW1lLCB3aGVuIGF2YWlsYWJsZS5cbiAqL1xuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIF9kYXRhYnJpY2tzUnVudGltZUF1dGhDbGllbnQoKTogUHJvbWlzZTxcbiAgRGF0YWJyaWNrc1J1bnRpbWVBdXRoQ2xpZW50IHwgdW5kZWZpbmVkXG4+IHtcbiAgY29uc3QgcnVudGltZSA9IChcbiAgICBnbG9iYWxUaGlzIGFzIHR5cGVvZiBnbG9iYWxUaGlzICYge1xuICAgICAgW2tleTogc3ltYm9sXTogUHl0aG9uTm9kZVJ1bnRpbWUgfCB1bmRlZmluZWQ7XG4gICAgfVxuICApW1N5bWJvbC5mb3IoXCJAZGJ4LXRvb2xzL25vZGUtcnVudGltZS9ydW50aW1lXCIpXTtcbiAgcmV0dXJuIHJ1bnRpbWU/LmRhdGFicmlja3NSdW50aW1lQXV0aENsaWVudD8uKCk7XG59XG5cbi8qKiBDcmVhdGUgYW4gYXV0aCBmYWNhZGUgb3ZlciBhIFB5dGhvbiBydW50aW1lIFdvcmtzcGFjZUNsaWVudC4gKi9cbmV4cG9ydCBmdW5jdGlvbiBjcmVhdGVEYXRhYnJpY2tzUnVudGltZUF1dGhDbGllbnQoXG4gIHJ1bnRpbWU6IERhdGFicmlja3NSdW50aW1lQXV0aENsaWVudCxcbiAgb3B0aW9uczogRGF0YWJyaWNrc0F1dGhPcHRpb25zLFxuKTogQXV0aENsaWVudCB7XG4gIGNvbnN0IGxpZmVjeWNsZU9wdGlvbnMgPSB7XG4gICAgLi4uQVVUSF9ERUZBVUxUUyxcbiAgICAuLi5vcHRpb25zLmF1dGgsXG4gIH07XG4gIGNvbnN0IHByb3ZpZGVyID0gbmV3IERhdGFicmlja3NSdW50aW1lVG9rZW5Qcm92aWRlcihydW50aW1lLCBsaWZlY3ljbGVPcHRpb25zLnJlZnJlc2hCdWZmZXJNcyk7XG4gIGNvbnN0IGxpZmVjeWNsZSA9IG5ldyBUb2tlbkxpZmVjeWNsZShcbiAgICBydW50aW1lQ2FjaGVLZXkocnVudGltZSksXG4gICAgcHJvdmlkZXIsXG4gICAgbmV3IE1lbW9yeUNyZWRlbnRpYWxTdG9yZSgpLFxuICAgIGxpZmVjeWNsZU9wdGlvbnMsXG4gICk7XG4gIHJldHVybiBuZXcgRGVmYXVsdERhdGFicmlja3NSdW50aW1lQXV0aENsaWVudChydW50aW1lLCBwcm92aWRlciwgbGlmZWN5Y2xlKTtcbn1cblxuZnVuY3Rpb24gcnVudGltZUNhY2hlS2V5KHJ1bnRpbWU6IERhdGFicmlja3NSdW50aW1lQXV0aENsaWVudCk6IHN0cmluZyB7XG4gIHJldHVybiBbXG4gICAgUlVOVElNRV9BVVRIX1RZUEUsXG4gICAgbm9ybWFsaXplSG9zdChydW50aW1lLmhvc3QsIFJVTlRJTUVfUFJJTkNJUEFMKSxcbiAgICBydW50aW1lLndvcmtzcGFjZUlkID8/IFwiXCIsXG4gICAgcnVudGltZS5wcmluY2lwYWwgPz8gXCJcIixcbiAgXS5qb2luKFwiOlwiKTtcbn1cblxuZnVuY3Rpb24gbm9ybWFsaXplZEhlYWRlcnMoaGVhZGVyczogUmVhZG9ubHk8UmVjb3JkPHN0cmluZywgc3RyaW5nPj4pOiBSZWNvcmQ8c3RyaW5nLCBzdHJpbmc+IHtcbiAgcmV0dXJuIE9iamVjdC5mcm9tRW50cmllcyhcbiAgICBPYmplY3QuZW50cmllcyhoZWFkZXJzKS5tYXAoKFtuYW1lLCB2YWx1ZV0pID0+IFtuYW1lLnRvTG93ZXJDYXNlKCksIHZhbHVlXSksXG4gICk7XG59XG5cbmZ1bmN0aW9uIHJ1bnRpbWVUb2tlbihcbiAgaGVhZGVyczogUmVhZG9ubHk8UmVjb3JkPHN0cmluZywgc3RyaW5nPj4sXG4gIHJlZnJlc2hCdWZmZXJNczogbnVtYmVyLFxuICBjb25maWd1cmVkVG9rZW4/OiBzdHJpbmcsXG4pOiBUb2tlbiB7XG4gIGNvbnN0IGF1dGhvcml6YXRpb24gPSBoZWFkZXJzW0RFRkFVTFRfQUNDRVNTX1RPS0VOX0hFQURFUl07XG4gIGNvbnN0IG1hdGNoID0gYXV0aG9yaXphdGlvbj8udHJpbSgpLm1hdGNoKC9eKFxcUyspXFxzKyguKykkLyk7XG4gIGNvbnN0IGFjY2Vzc1Rva2VuID0gbWF0Y2g/LlsyXT8udHJpbSgpIHx8IGNvbmZpZ3VyZWRUb2tlbj8udHJpbSgpO1xuICBpZiAoIWFjY2Vzc1Rva2VuKSB7XG4gICAgdGhyb3cgbmV3IEF1dGhFcnJvcihcbiAgICAgIFwib2F1dGhcIixcbiAgICAgIFwiRGF0YWJyaWNrcyBQeXRob24gcnVudGltZSBhdXRoZW50aWNhdGlvbiBkaWQgbm90IHByb3ZpZGUgYW4gYWNjZXNzIHRva2VuXCIsXG4gICAgKTtcbiAgfVxuICBjb25zdCBwYXlsb2FkID0gZ2V0QWNjZXNzVG9rZW5QYXlsb2FkKGFjY2Vzc1Rva2VuKTtcbiAgY29uc3Qgand0RXhwaXJ5ID1cbiAgICB0eXBlb2YgcGF5bG9hZC5leHAgPT09IFwibnVtYmVyXCIgJiYgTnVtYmVyLmlzRmluaXRlKHBheWxvYWQuZXhwKVxuICAgICAgPyBuZXcgRGF0ZShwYXlsb2FkLmV4cCAqIDEwMDApLnRvSVNPU3RyaW5nKClcbiAgICAgIDogdW5kZWZpbmVkO1xuICAvLyBPcGFxdWUgcnVudGltZSBjcmVkZW50aWFscyBzdGlsbCBuZWVkIGEgYm91bmRlZCBOb2RlIGNhY2hlLiBSZWFjcXVpcmUgdGhlbVxuICAvLyBmcm9tIHRoZSBQeXRob24gU0RLIGFmdGVyIG9uZSByZWZyZXNoLWJ1ZmZlciBpbnRlcnZhbC5cbiAgY29uc3QgZXhwaXJ5ID1cbiAgICBqd3RFeHBpcnkgPz9cbiAgICBuZXcgRGF0ZShcbiAgICAgIERhdGUubm93KCkgKyBNYXRoLm1heChyZWZyZXNoQnVmZmVyTXMgKiAyLCBNSU5JTVVNX1JVTlRJTUVfVE9LRU5fVFRMX01TKSxcbiAgICApLnRvSVNPU3RyaW5nKCk7XG4gIHJldHVybiB7XG4gICAgYWNjZXNzVG9rZW4sXG4gICAgdG9rZW5UeXBlOiBtYXRjaD8uWzFdIHx8IFwiQmVhcmVyXCIsXG4gICAgLi4uKGV4cGlyeSA/IHsgZXhwaXJ5IH0gOiB7fSksXG4gICAgc2NvcGVzOiBbLi4uZ2V0QWNjZXNzVG9rZW5TY29wZXMoYWNjZXNzVG9rZW4pXSxcbiAgfTtcbn1cblxuY2xhc3MgRGF0YWJyaWNrc1J1bnRpbWVUb2tlblByb3ZpZGVyIGltcGxlbWVudHMgVG9rZW5Qcm92aWRlciB7XG4gICNhY2Nlc3NUb2tlbj86IHN0cmluZztcbiAgI2hlYWRlcnM/OiBSZWNvcmQ8c3RyaW5nLCBzdHJpbmc+O1xuXG4gIGNvbnN0cnVjdG9yKFxuICAgIHByaXZhdGUgcmVhZG9ubHkgcnVudGltZTogRGF0YWJyaWNrc1J1bnRpbWVBdXRoQ2xpZW50LFxuICAgIHByaXZhdGUgcmVhZG9ubHkgcmVmcmVzaEJ1ZmZlck1zOiBudW1iZXIsXG4gICkge31cblxuICBhdXRoZW50aWNhdGUoKTogUHJvbWlzZTxUb2tlbj4ge1xuICAgIHJldHVybiB0aGlzLmFjcXVpcmUoKTtcbiAgfVxuXG4gIGxvZ2luKCk6IFByb21pc2U8VG9rZW4+IHtcbiAgICByZXR1cm4gdGhpcy5hY3F1aXJlKCk7XG4gIH1cblxuICByZWZyZXNoKCk6IFByb21pc2U8VG9rZW4+IHtcbiAgICByZXR1cm4gdGhpcy5hY3F1aXJlKCk7XG4gIH1cblxuICBjYW5BdXRoZW50aWNhdGVTaWxlbnRseSgpOiBib29sZWFuIHtcbiAgICByZXR1cm4gdHJ1ZTtcbiAgfVxuXG4gIGhlYWRlcnModG9rZW46IEFjY2Vzc1Rva2VuKTogUmVjb3JkPHN0cmluZywgc3RyaW5nPiB7XG4gICAgaWYgKHRoaXMuI2FjY2Vzc1Rva2VuID09PSB0b2tlbi5hY2Nlc3NUb2tlbiAmJiB0aGlzLiNoZWFkZXJzKSB7XG4gICAgICByZXR1cm4geyAuLi50aGlzLiNoZWFkZXJzIH07XG4gICAgfVxuICAgIHJldHVybiB7XG4gICAgICBbREVGQVVMVF9BQ0NFU1NfVE9LRU5fSEVBREVSXTogYCR7dG9rZW4udG9rZW5UeXBlfSAke3Rva2VuLmFjY2Vzc1Rva2VufWAsXG4gICAgfTtcbiAgfVxuXG4gIGNsZWFyKCk6IHZvaWQge1xuICAgIHRoaXMuI2FjY2Vzc1Rva2VuID0gdW5kZWZpbmVkO1xuICAgIHRoaXMuI2hlYWRlcnMgPSB1bmRlZmluZWQ7XG4gIH1cblxuICBwcml2YXRlIGFzeW5jIGFjcXVpcmUoKTogUHJvbWlzZTxUb2tlbj4ge1xuICAgIGNvbnN0IGhlYWRlcnMgPSBub3JtYWxpemVkSGVhZGVycyhhd2FpdCB0aGlzLnJ1bnRpbWUuYXV0aGVudGljYXRlKCkpO1xuICAgIGNvbnN0IHRva2VuID0gcnVudGltZVRva2VuKGhlYWRlcnMsIHRoaXMucmVmcmVzaEJ1ZmZlck1zLCBhd2FpdCB0aGlzLnJ1bnRpbWUudG9rZW4oKSk7XG4gICAgdGhpcy4jYWNjZXNzVG9rZW4gPSB0b2tlbi5hY2Nlc3NUb2tlbjtcbiAgICB0aGlzLiNoZWFkZXJzID0ge1xuICAgICAgLi4uaGVhZGVycyxcbiAgICAgIFtERUZBVUxUX0FDQ0VTU19UT0tFTl9IRUFERVJdOiBgJHt0b2tlbi50b2tlblR5cGV9ICR7dG9rZW4uYWNjZXNzVG9rZW59YCxcbiAgICB9O1xuICAgIHJldHVybiB0b2tlbjtcbiAgfVxufVxuXG5jbGFzcyBEZWZhdWx0RGF0YWJyaWNrc1J1bnRpbWVBdXRoQ2xpZW50IGltcGxlbWVudHMgQXV0aENsaWVudCB7XG4gIHJlYWRvbmx5IHByb2ZpbGUgPSB1bmRlZmluZWQ7XG4gIHJlYWRvbmx5IGhvc3Q6IHN0cmluZztcbiAgcmVhZG9ubHkgYWNjb3VudElkID0gdW5kZWZpbmVkO1xuICByZWFkb25seSB3b3Jrc3BhY2VJZD86IHN0cmluZztcbiAgcmVhZG9ubHkgdGFyZ2V0ID0gVGFyZ2V0S2luZC5Xb3Jrc3BhY2U7XG4gIHJlYWRvbmx5IGF1dGhUeXBlID0gUlVOVElNRV9BVVRIX1RZUEU7XG4gIHJlYWRvbmx5IHByaW5jaXBhbDogc3RyaW5nO1xuXG4gIGNvbnN0cnVjdG9yKFxuICAgIHJ1bnRpbWU6IERhdGFicmlja3NSdW50aW1lQXV0aENsaWVudCxcbiAgICBwcml2YXRlIHJlYWRvbmx5IHByb3ZpZGVyOiBEYXRhYnJpY2tzUnVudGltZVRva2VuUHJvdmlkZXIsXG4gICAgcHJpdmF0ZSByZWFkb25seSBsaWZlY3ljbGU6IFRva2VuTGlmZWN5Y2xlLFxuICApIHtcbiAgICB0aGlzLmhvc3QgPSBub3JtYWxpemVIb3N0KHJ1bnRpbWUuaG9zdCwgUlVOVElNRV9QUklOQ0lQQUwpO1xuICAgIHRoaXMud29ya3NwYWNlSWQgPSBydW50aW1lLndvcmtzcGFjZUlkO1xuICAgIHRoaXMucHJpbmNpcGFsID0gcnVudGltZS5wcmluY2lwYWwgfHwgUlVOVElNRV9QUklOQ0lQQUw7XG4gIH1cblxuICB0b2tlbihvcHRpb25zOiBUb2tlbk9wdGlvbnMgPSB7fSk6IFByb21pc2U8QWNjZXNzVG9rZW4+IHtcbiAgICByZXR1cm4gb3B0aW9ucy5yZWZyZXNoXG4gICAgICA/IHRoaXMubGlmZWN5Y2xlLmZvcmNlUmVmcmVzaChvcHRpb25zLmxvZ2luID8/IHRydWUpXG4gICAgICA6IHRoaXMubGlmZWN5Y2xlLnRva2VuV2l0aExvZ2luKG9wdGlvbnMubG9naW4pO1xuICB9XG5cbiAgYXN5bmMgaGVhZGVycyhvcHRpb25zOiBUb2tlbk9wdGlvbnMgPSB7fSk6IFByb21pc2U8UmVjb3JkPHN0cmluZywgc3RyaW5nPj4ge1xuICAgIGNvbnN0IGhlYWRlcnMgPSB0aGlzLnByb3ZpZGVyLmhlYWRlcnMoYXdhaXQgdGhpcy50b2tlbihvcHRpb25zKSk7XG4gICAgaWYgKHRoaXMud29ya3NwYWNlSWQgJiYgaGVhZGVyc1tXT1JLU1BBQ0VfSURfSEVBREVSXSA9PT0gdW5kZWZpbmVkKSB7XG4gICAgICBoZWFkZXJzW1dPUktTUEFDRV9JRF9IRUFERVJdID0gdGhpcy53b3Jrc3BhY2VJZDtcbiAgICB9XG4gICAgcmV0dXJuIGhlYWRlcnM7XG4gIH1cblxuICBhc3luYyBsb2dvdXQoKTogUHJvbWlzZTx2b2lkPiB7XG4gICAgYXdhaXQgdGhpcy5saWZlY3ljbGUubG9nb3V0KCk7XG4gICAgdGhpcy5wcm92aWRlci5jbGVhcigpO1xuICB9XG59XG4iXX0=

package/lib/tsconfig.tsbuildinfo

@@ -1 +1 @@
-{"root":["../src/_databricks-cli.ts","../src/_errors.ts","../src/_lifecycle.ts","../src/_logging.ts","../src/_personal-access-token.ts","../src/_profile-config.ts","../src/_service-principal.ts","../src/_storage.ts","../src/_types.ts","../src/bindings.ts","../src/client.ts","../src/config.ts","../src/profile.ts","../index.ts"],"version":"5.9.3"}
+{"root":["../src/_databricks-cli.ts","../src/_errors.ts","../src/_lifecycle.ts","../src/_logging.ts","../src/_personal-access-token.ts","../src/_profile-config.ts","../src/_service-principal.ts","../src/_storage.ts","../src/_types.ts","../src/bindings.ts","../src/client.ts","../src/config.ts","../src/profile.ts","../src/runtime-auth.ts","../index.ts"],"version":"5.9.3"}

package/package.json

@@ -24,9 +24,9 @@
     "typescript": "^5.9.3"
   },
   "dependencies": {
-    "@dbx-tools/core": "^0.9.51",
-    "@dbx-tools/shared-auth": "^0.9.51",
-    "@dbx-tools/shared-core": "^0.9.51",
+    "@dbx-tools/core": "^0.9.58",
+    "@dbx-tools/shared-auth": "^0.9.58",
+    "@dbx-tools/shared-core": "^0.9.58",
     "ini": "^6.0.0",
     "oauth4webapi": "^3.8.8",
     "zod": "4.3.6"
@@ -58,10 +58,14 @@
         "types": "./lib/src/profile.d.ts",
         "default": "./lib/src/profile.js"
       },
+      "./runtime-auth": {
+        "types": "./lib/src/runtime-auth.d.ts",
+        "default": "./lib/src/runtime-auth.js"
+      },
       "./package.json": "./package.json"
     }
   },
-  "version": "0.9.51",
+  "version": "0.9.58",
   "types": "./lib/index.d.ts",
   "dbxToolsConfig": {
     "tags": [
@@ -90,6 +94,10 @@
       "types": "./lib/src/profile.d.ts",
       "default": "./lib/src/profile.js"
     },
+    "./runtime-auth": {
+      "types": "./lib/src/runtime-auth.d.ts",
+      "default": "./lib/src/runtime-auth.js"
+    },
     "./package.json": "./package.json"
   },
   "files": [

package/src/_profile-config.ts

@@ -106,14 +106,29 @@ export function parseDatabricksConfig(source: string): IniConfig {
     if (!name.trim() || !object.isRecord(value)) {
       throw new AuthError("config", "Databricks configuration values must belong to a profile");
     }
-    const section = new Map<string, string>();
-    for (const [key, entry] of Object.entries(value)) {
-      if (entry === undefined || entry === null) continue;
+    _appendConfigSections(config, [name.trim()], value);
+  }
+  return config;
+}
+
+function _appendConfigSections(
+  config: IniConfig,
+  path: readonly string[],
+  value: Record<string, unknown>,
+): void {
+  const section = new Map<string, string>();
+  let nested = false;
+  for (const [key, entry] of Object.entries(value)) {
+    if (object.isRecord(entry)) {
+      nested = true;
+      _appendConfigSections(config, [...path, key], entry);
+    } else if (entry !== undefined && entry !== null) {
       section.set(key.trim().toLowerCase(), String(entry).trim());
     }
-    config.set(name.trim(), section);
   }
-  return config;
+  if (section.size || !nested) {
+    config.set(path.join("."), section);
+  }
 }
 
 export function loadRawProfile(config: IniConfig | undefined, name: string): RawProfile {
@@ -366,19 +381,26 @@ export function resolveDatabricksProfile(
   environment: Environment = process.env,
 ): DatabricksProfile {
   const inApp = environmentUtils.isDatabricksAppEnv({ ...environment });
-  const environmentProfile = stringUtils.trimToUndefined(environment.DATABRICKS_CONFIG_PROFILE);
-  const explicitProfile = Boolean(
-    stringUtils.trimToUndefined(options.profile) ?? environmentProfile,
+  const configPath = resolveConfigFile(options.configFile, environment);
+  const config = loadConfig(options.configFile, false, environment);
+  const optionProfile = stringUtils.trimToUndefined(options.profile);
+  const configuredEnvironmentProfile = stringUtils.trimToUndefined(
+    environment.DATABRICKS_CONFIG_PROFILE,
   );
-  const requestToken = requestOboToken(options.requestHeaders, options.accessTokenHeader);
-  const explicitAuthType =
-    options.authType ??
-    (!inApp && !explicitProfile ? parseAuthType(environment.DATABRICKS_AUTH_TYPE) : undefined);
+  const environmentProfile =
+    configuredEnvironmentProfile && config?.has(configuredEnvironmentProfile)
+      ? configuredEnvironmentProfile
+      : undefined;
   const appServicePrincipal = [
     environment.DATABRICKS_HOST,
     environment.DATABRICKS_CLIENT_ID,
     environment.DATABRICKS_CLIENT_SECRET,
   ].every((value) => Boolean(stringUtils.trimToUndefined(value)));
+  const explicitProfile = Boolean(optionProfile ?? environmentProfile);
+  const requestToken = requestOboToken(options.requestHeaders, options.accessTokenHeader);
+  const explicitAuthType =
+    options.authType ??
+    (!inApp && !explicitProfile ? parseAuthType(environment.DATABRICKS_AUTH_TYPE) : undefined);
   const selectedAuthType =
     !inApp || explicitProfile || explicitAuthType
       ? explicitAuthType
@@ -391,9 +413,7 @@ export function resolveDatabricksProfile(
     selectedAuthType === AuthType.AppOnBehalfOf ||
     selectedAuthType === AuthType.AppServicePrincipal;
   const ignoreAmbientCredentials = explicitProfile && !appAuth;
-  const configPath = resolveConfigFile(options.configFile, environment);
-  const config = loadConfig(options.configFile, false, environment);
-  const requestedName = stringUtils.trimToUndefined(options.profile) ?? environmentProfile;
+  const requestedName = optionProfile ?? environmentProfile;
   const profileName = resolveProfileName(
     requestedName,
     explicitProfile,
@@ -410,12 +430,13 @@ export function resolveDatabricksProfile(
   ].some((value) => Boolean(stringUtils.trimToUndefined(value)));
   const selectedProfile =
     explicitProfile || (!ambientCredentials && config?.has(profileName)) ? profileName : undefined;
-  const configured = loadRawProfile(config, profileName);
+  const configured = selectedProfile ? loadRawProfile(config, profileName) : {};
+  const credentialName = selectedProfile ?? "ambient";
   const ambient = (name: keyof NodeJS.ProcessEnv): string | undefined =>
     ignoreAmbientCredentials ? undefined : stringUtils.trimToUndefined(environment[name]);
   const host = normalizeHost(
     options.host ?? ambient("DATABRICKS_HOST") ?? configured.host,
-    profileName,
+    credentialName,
   );
   const accountId =
     stringUtils.trimToUndefined(options.accountId) ??
@@ -448,7 +469,7 @@ export function resolveDatabricksProfile(
     authType === AuthType.DatabricksCli
       ? (clientIdValue ?? DEFAULT_CLIENT_ID)
       : authType === AuthType.OAuthM2M || authType === AuthType.AppServicePrincipal
-        ? (clientIdValue ?? missing(profileName, "client_id"))
+        ? (clientIdValue ?? missing(credentialName, "client_id"))
         : (clientIdValue ?? "");
   const scopes = options.scopes?.length
     ? stringUtils.parseList(options.scopes)
@@ -461,9 +482,9 @@ export function resolveDatabricksProfile(
   const principal =
     authType === AuthType.OAuthM2M || authType === AuthType.AppServicePrincipal
       ? clientId
-      : profileName;
+      : credentialName;
   const cacheKey = credentialCacheKey({
-    name: profileName,
+    name: credentialName,
     host,
     accountId,
     workspaceId,
@@ -474,7 +495,7 @@ export function resolveDatabricksProfile(
     accessToken,
   });
   logger.debug("resolved Databricks profile", {
-    profile: profileName,
+    profile: credentialName,
     host,
     authType,
     target,
@@ -488,7 +509,7 @@ export function resolveDatabricksProfile(
     configPath,
   });
   return {
-    name: profileName,
+    name: credentialName,
     ...(selectedProfile ? { selectedProfile } : {}),
     host,
     ...(accountId ? { accountId } : {}),

package/src/client.ts

@@ -15,6 +15,7 @@ import {
   DEFAULT_ACCESS_TOKEN_HEADER,
   WORKSPACE_ID_HEADER,
 } from "./config.ts";
+import { _databricksRuntimeAuthClient, createDatabricksRuntimeAuthClient } from "./runtime-auth.ts";
 
 const logger = authLogger("databricks");
 
@@ -126,6 +127,16 @@ export async function createAuthClient(
   options: DatabricksAuthOptions = {},
   dependencies: DatabricksAuthDependencies = {},
 ): Promise<AuthClient> {
+  if (usesDefaultCredentialSource(options)) {
+    const runtime = await _databricksRuntimeAuthClient();
+    if (runtime) {
+      logger.debug("selected Databricks Python runtime authentication", {
+        host: runtime.host,
+        hasWorkspaceId: Boolean(runtime.workspaceId),
+      });
+      return createDatabricksRuntimeAuthClient(runtime, options);
+    }
+  }
   return createResolvedAuth(options, dependencies);
 }
 
@@ -289,3 +300,7 @@ function cliEnvironment(profile: DatabricksProfile, configFile: string): Record<
 function stringValue(value: unknown): string | undefined {
   return typeof value === "string" && value.trim() ? value : undefined;
 }
+
+function usesDefaultCredentialSource(options: DatabricksAuthOptions): boolean {
+  return Object.values(options).every((value) => value === undefined);
+}

package/src/profile.ts

@@ -1,5 +1,6 @@
 import type { DatabricksProfileSummary } from "@dbx-tools/shared-auth/profile";
 
+import { AuthError } from "./_errors.ts";
 import { listDatabricksProfiles, resolveDatabricksProfile } from "./_profile-config.ts";
 import type { DatabricksProfile } from "./_types.ts";
 import type { DatabricksAuthOptions } from "./config.ts";
@@ -10,9 +11,28 @@ export interface ListProfilesOptions {
   refresh?: boolean;
 }
 
-/** Resolve one selected profile without exposing credentials. */
-export function resolveProfile(options: DatabricksAuthOptions = {}): DatabricksProfileSummary {
-  return toProfileSummary(resolveDatabricksProfile(options));
+/** Resolve one configured profile without exposing credentials, or `null` when none exists. */
+export function resolveProfile(
+  options: DatabricksAuthOptions = {},
+): DatabricksProfileSummary | null {
+  const configured = listDatabricksProfiles(options.configFile);
+  if (configured.length === 0) return null;
+  const environment = options.configFile
+    ? { DATABRICKS_CONFIG_FILE: options.configFile }
+    : process.env;
+  try {
+    const resolved = resolveDatabricksProfile(options, environment);
+    if (
+      !resolved.selectedProfile ||
+      !configured.some(({ name }) => name === resolved.selectedProfile)
+    ) {
+      return null;
+    }
+    return toProfileSummary(resolved);
+  } catch (error) {
+    if (error instanceof AuthError && error.kind === "config") return null;
+    throw error;
+  }
 }
 
 /** List configured profiles without exposing credentials. */