@fabricorg/experiments-db-pool 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Fabric
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

package/README.md

@@ -0,0 +1,61 @@
+# @fabricorg/experiments-db-pool
+
+Singleton `pg.Pool` configured for serverless runtimes (Vercel, AWS Lambda, etc.).
+
+## Usage
+
+```ts
+import { getPool } from '@fabricorg/experiments-db-pool';
+
+const pool = getPool();
+const result = await pool.query('SELECT 1');
+```
+
+## Singleton guarantee
+
+`getPool()` returns the same `Pool` instance on every call within a single process:
+
+```ts
+getPool() === getPool(); // true
+```
+
+## Environment variables
+
+| Variable | Required | Default | Description |
+|----------|----------|---------|-------------|
+| `DATABASE_URL` | **yes** | — | Postgres connection string |
+| `PG_POOL_MAX` | no | `5` | Max connections in the pool |
+
+## Pool sizing rationale
+
+Serverless platforms (Vercel, AWS Lambda, Cloudflare Pages Functions) spin up many
+concurrent execution environments. Each environment that creates its own `Pool` can
+hold idle connections indefinitely, exhausting the Postgres `max_connections` limit.
+
+A **single shared singleton** eliminates duplicate pools within one process.
+
+### Default: `max: 5`
+
+- **Why 5?** Most serverless functions are I/O-bound and rarely need more than a
+  handful of concurrent queries.
+- **Why not 1?** A single connection serializes all queries; 2–5 allows modest
+  parallelism for routes that fan out (e.g. health checks + data fetches).
+
+### `idleTimeoutMillis: 30000`
+
+Recycles connections after 30s of inactivity. This is **half of Vercel's default
+serverless timeout** (60s), ensuring we don't leak idle sockets across invocations.
+
+### `connectionTimeoutMillis: 5000`
+
+Fail-fast when the database is unreachable. In a cold-start scenario, waiting the
+default 0 (infinite) can hang the function until the platform kills it.
+
+## Adjusting for your workload
+
+If you run heavy analytics queries or batch jobs inside the same process, raise
+`PG_POOL_MAX` via environment variable rather than forking the package:
+
+```bash
+PG_POOL_MAX=20 node my-script.js
+```

package/dist/index.cjs

@@ -0,0 +1,380 @@
+'use strict';
+
+var pg = require('pg');
+var events = require('events');
+
+// src/providers/neon.ts
+var NeonDatabaseProvider = class {
+  kind = "neon";
+  pool;
+  constructor(options) {
+    this.pool = new pg.Pool({
+      connectionString: options.connectionString,
+      max: options.max ?? Number.parseInt(process.env.PG_POOL_MAX ?? "5", 10),
+      idleTimeoutMillis: options.idleTimeoutMillis ?? 3e4,
+      connectionTimeoutMillis: options.connectionTimeoutMillis ?? 5e3
+    });
+  }
+  getPool() {
+    return this.pool;
+  }
+  async close() {
+    await this.pool.end();
+  }
+};
+function databricksIdentity(principal) {
+  if (principal.kind === "pat") {
+    const { token } = principal;
+    return async () => token;
+  }
+  return servicePrincipalProvider(principal);
+}
+function databricksPrincipalFromEnv(env = typeof process !== "undefined" ? process.env : {}) {
+  const token = env.DATABRICKS_TOKEN?.trim();
+  if (token) return { kind: "pat", token };
+  const clientId = env.DATABRICKS_CLIENT_ID?.trim();
+  const clientSecret = env.DATABRICKS_CLIENT_SECRET?.trim();
+  const host = env.DATABRICKS_HOST?.trim();
+  if (clientId && clientSecret) {
+    if (!host) throw new Error("Missing DATABRICKS_HOST for Databricks OAuth M2M.");
+    return {
+      kind: "service-principal",
+      host,
+      clientId,
+      clientSecret,
+      scope: env.DATABRICKS_SCOPE,
+      refreshSkewSeconds: env.DATABRICKS_REFRESH_SKEW_SECONDS ? Number.parseInt(env.DATABRICKS_REFRESH_SKEW_SECONDS, 10) : void 0
+    };
+  }
+  throw new Error(
+    "Missing Databricks credentials: DATABRICKS_TOKEN or DATABRICKS_CLIENT_ID+DATABRICKS_CLIENT_SECRET."
+  );
+}
+function servicePrincipalProvider(principal) {
+  const host = principal.host.replace(/\/$/, "");
+  const scope = principal.scope ?? "all-apis";
+  const refreshSkewMs = (principal.refreshSkewSeconds ?? 60) * 1e3;
+  let cached;
+  let refreshing;
+  const refresh = async () => {
+    const response = await fetch(`${host}/oidc/v1/token`, {
+      method: "POST",
+      headers: {
+        authorization: `Basic ${Buffer.from(`${principal.clientId}:${principal.clientSecret}`).toString("base64")}`,
+        "content-type": "application/x-www-form-urlencoded"
+      },
+      body: new URLSearchParams({ grant_type: "client_credentials", scope })
+    });
+    if (!response.ok) {
+      const text = await response.text();
+      throw new Error(
+        `Databricks OAuth token exchange failed: ${response.status} ${response.statusText}: ${text.slice(0, 500)}`
+      );
+    }
+    const value = await response.json();
+    const token = typeof value.access_token === "string" ? value.access_token : void 0;
+    if (!token) throw new Error("Databricks OAuth token exchange returned no access_token.");
+    const expiresInSeconds = typeof value.expires_in === "number" ? value.expires_in : 3600;
+    const expiresAtMs = Date.now() + expiresInSeconds * 1e3;
+    cached = { token, refreshAtMs: expiresAtMs - refreshSkewMs };
+    return token;
+  };
+  return async () => {
+    if (cached && Date.now() < cached.refreshAtMs) return cached.token;
+    refreshing ??= refresh().finally(() => {
+      refreshing = void 0;
+    });
+    return refreshing;
+  };
+}
+function lakebaseCredentialProvider(options) {
+  const workspaceHost = options.workspaceHost.replace(/\/$/, "");
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const now = options.now ?? Date.now;
+  const random = options.random ?? Math.random;
+  const refreshBeforeMs = options.refreshBeforeMs ?? 5 * 6e4;
+  const refreshJitterMs = options.refreshJitterMs ?? 3e4;
+  let cached;
+  let refreshing;
+  const refresh = async () => {
+    const workspaceToken = typeof options.token === "function" ? await options.token() : options.token;
+    const response = await fetchImpl(`${workspaceHost}/api/2.0/postgres/credentials`, {
+      method: "POST",
+      headers: {
+        authorization: `Bearer ${workspaceToken}`,
+        "content-type": "application/json"
+      },
+      body: JSON.stringify({ endpoint: options.endpoint })
+    });
+    if (!response.ok) {
+      const text = await response.text();
+      throw new Error(
+        `Lakebase credential exchange failed: ${response.status} ${response.statusText}: ${text.slice(0, 500)}`
+      );
+    }
+    const value = await response.json();
+    if (typeof value.token !== "string" || !value.token) {
+      throw new Error("Lakebase credential exchange returned no token.");
+    }
+    const expiresAt = parseExpireTime(value.expire_time);
+    if (!Number.isFinite(expiresAt)) {
+      throw new Error("Lakebase credential exchange returned an invalid expire_time.");
+    }
+    const jitter = Math.max(0, refreshJitterMs) * random();
+    cached = {
+      token: value.token,
+      refreshAt: Math.max(now(), expiresAt - Math.max(0, refreshBeforeMs) - jitter)
+    };
+    return value.token;
+  };
+  return async () => {
+    if (cached && now() < cached.refreshAt) return cached.token;
+    refreshing ??= refresh().finally(() => {
+      refreshing = void 0;
+    });
+    return refreshing;
+  };
+}
+function parseExpireTime(value) {
+  if (typeof value === "number") {
+    return value < 1e12 ? value * 1e3 : value;
+  }
+  if (typeof value === "string") return new Date(value).getTime();
+  return Number.NaN;
+}
+var DelegatingPool = class extends events.EventEmitter {
+  current;
+  initPromise;
+  closed = false;
+  attachErrorHandler(pool) {
+    pool.on("error", (error) => {
+      this.emit("error", error);
+    });
+  }
+  initialize(createPool, getPassword) {
+    this.initPromise = getPassword().then((password) => {
+      if (!this.closed) this.swap(createPool(password));
+    }).catch((error) => {
+      this.emit("error", error instanceof Error ? error : new Error(String(error)));
+      throw error;
+    });
+  }
+  swap(pool) {
+    if (this.closed) {
+      pool.end().catch(() => void 0);
+      return;
+    }
+    const previous = this.current;
+    this.current = pool;
+    this.attachErrorHandler(pool);
+    if (previous) {
+      previous.removeAllListeners();
+      previous.end().catch(() => void 0);
+    }
+  }
+  async ensureInitialized() {
+    if (this.initPromise) await this.initPromise;
+  }
+  query(...args) {
+    return this.ensureInitialized().then(() => this.current.query(...args));
+  }
+  connect(...args) {
+    return this.ensureInitialized().then(() => this.current.connect(...args));
+  }
+  end() {
+    this.closed = true;
+    this.removeAllListeners();
+    return this.current?.end() ?? Promise.resolve();
+  }
+  get totalCount() {
+    return this.current?.totalCount ?? 0;
+  }
+  get idleCount() {
+    return this.current?.idleCount ?? 0;
+  }
+  get waitingCount() {
+    return this.current?.waitingCount ?? 0;
+  }
+};
+var LakebaseDatabaseProvider = class {
+  kind = "databricks-lakebase";
+  options;
+  poolFactory;
+  getPassword;
+  delegatingPool;
+  refreshTimer;
+  constructor(options) {
+    this.options = options;
+    this.poolFactory = options.poolFactory ?? defaultPoolFactory();
+    this.delegatingPool = new DelegatingPool();
+    if (options.password !== void 0) {
+      this.getPassword = async () => options.password;
+      this.delegatingPool.swap(this.createPool(options.password));
+    } else {
+      if (!options.token || !options.workspaceHost || !options.endpoint) {
+        throw new Error(
+          "Lakebase OAuth requires token, workspaceHost, and endpoint. A workspace token cannot be used directly as the Postgres password."
+        );
+      }
+      this.getPassword = lakebaseCredentialProvider({
+        workspaceHost: options.workspaceHost,
+        endpoint: options.endpoint,
+        token: options.token,
+        fetchImpl: options.fetchImpl
+      });
+      this.delegatingPool.initialize((password) => this.createPool(password), this.getPassword);
+      const intervalMs = options.refreshIntervalMs ?? 50 * 6e4;
+      this.refreshTimer = setInterval(() => {
+        void this.refreshPool();
+      }, intervalMs);
+    }
+  }
+  createPool(password) {
+    return this.poolFactory({
+      host: this.options.host,
+      port: this.options.port ?? 5432,
+      database: this.options.database,
+      user: this.options.user,
+      password,
+      ssl: this.options.ssl ?? { rejectUnauthorized: true },
+      max: this.options.max ?? Number.parseInt(process.env.PG_POOL_MAX ?? "5", 10),
+      idleTimeoutMillis: this.options.idleTimeoutMillis ?? 3e4,
+      connectionTimeoutMillis: this.options.connectionTimeoutMillis ?? 5e3
+    });
+  }
+  async refreshPool() {
+    try {
+      const password = await this.getPassword();
+      const pool = this.createPool(password);
+      this.delegatingPool.swap(pool);
+    } catch (error) {
+      this.delegatingPool.emit("error", error instanceof Error ? error : new Error(String(error)));
+    }
+  }
+  getPool() {
+    return this.delegatingPool;
+  }
+  async close() {
+    if (this.refreshTimer) {
+      clearInterval(this.refreshTimer);
+      this.refreshTimer = void 0;
+    }
+    await this.delegatingPool.end();
+  }
+};
+function defaultPoolFactory() {
+  return (config) => new pg.Pool(config);
+}
+
+// src/index.ts
+var provider = null;
+function createProvider() {
+  const kind = process.env.DATABASE_PROVIDER ?? "neon";
+  if (kind === "databricks-lakebase") {
+    const host = process.env.DATABRICKS_LAKEBASE_HOST?.trim();
+    const database = process.env.DATABRICKS_LAKEBASE_DATABASE?.trim() ?? "databricks_postgres";
+    const user = process.env.DATABRICKS_LAKEBASE_USER?.trim();
+    const workspaceHost = process.env.DATABRICKS_HOST?.trim();
+    const endpoint = process.env.DATABRICKS_LAKEBASE_ENDPOINT?.trim();
+    const password = process.env.DATABRICKS_LAKEBASE_PASSWORD?.trim();
+    if (!host) {
+      throw new Error(
+        "DATABRICKS_LAKEBASE_HOST is required when DATABASE_PROVIDER=databricks-lakebase"
+      );
+    }
+    if (!user) {
+      throw new Error(
+        "DATABRICKS_LAKEBASE_USER is required when DATABASE_PROVIDER=databricks-lakebase"
+      );
+    }
+    if (password) {
+      return new LakebaseDatabaseProvider({ host, database, user, password });
+    }
+    if (!workspaceHost || !endpoint) {
+      throw new Error(
+        "DATABRICKS_HOST and DATABRICKS_LAKEBASE_ENDPOINT are required for Lakebase OAuth, or provide DATABRICKS_LAKEBASE_PASSWORD for native auth."
+      );
+    }
+    const principal = databricksPrincipalFromEnv(process.env);
+    return new LakebaseDatabaseProvider({
+      host,
+      database,
+      user,
+      workspaceHost,
+      endpoint,
+      token: databricksIdentity(principal)
+    });
+  }
+  const connectionString = process.env.DATABASE_URL;
+  if (!connectionString) {
+    throw new Error("DATABASE_URL is required");
+  }
+  return new NeonDatabaseProvider({ connectionString });
+}
+function getPool() {
+  if (!provider) {
+    provider = createProvider();
+  }
+  return provider.getPool();
+}
+async function closePool() {
+  await provider?.close();
+  provider = null;
+}
+function resetPoolProvider() {
+  provider = null;
+}
+function getProvider() {
+  if (!provider) {
+    provider = createProvider();
+  }
+  return provider;
+}
+function ensurePoolGauges(collector) {
+  const reg = collector.registry;
+  const existingTotal = reg.get("db_pool_connections_total");
+  if (existingTotal) {
+    return {
+      total: existingTotal,
+      idle: reg.get("db_pool_connections_idle"),
+      waiting: reg.get("db_pool_connections_waiting"),
+      active: reg.get("db_pool_connections_active")
+    };
+  }
+  return {
+    total: collector.gauge("db_pool_connections_total", "Total connections in the pool"),
+    idle: collector.gauge("db_pool_connections_idle", "Idle connections in the pool"),
+    waiting: collector.gauge("db_pool_connections_waiting", "Waiting clients in the pool"),
+    active: collector.gauge(
+      "db_pool_connections_active",
+      "Active (non-idle) connections in the pool"
+    )
+  };
+}
+function updatePoolMetrics(collector, poolInstance) {
+  const p = poolInstance ?? getPool();
+  const total = p.totalCount ?? 0;
+  const idle = p.idleCount ?? 0;
+  const waiting = p.waitingCount ?? 0;
+  const gauges = ensurePoolGauges(collector);
+  gauges.total.set({}, total);
+  gauges.idle.set({}, idle);
+  gauges.waiting.set({}, waiting);
+  gauges.active.set({}, Math.max(0, total - idle));
+}
+function registerPoolMetrics(collector, poolInstance, intervalMs = 5e3) {
+  updatePoolMetrics(collector, poolInstance);
+  const interval = setInterval(() => {
+    updatePoolMetrics(collector, poolInstance);
+  }, intervalMs);
+  return () => clearInterval(interval);
+}
+
+exports.closePool = closePool;
+exports.getPool = getPool;
+exports.getProvider = getProvider;
+exports.registerPoolMetrics = registerPoolMetrics;
+exports.resetPoolProvider = resetPoolProvider;
+exports.updatePoolMetrics = updatePoolMetrics;
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/providers/neon.ts","../src/providers/lakebase.ts","../src/index.ts"],"names":["Pool","EventEmitter"],"mappings":";;;;;;AAWO,IAAM,uBAAN,MAAuD;AAAA,EACnD,IAAA,GAAO,MAAA;AAAA,EACC,IAAA;AAAA,EAEjB,YAAY,OAAA,EAA8B;AACxC,IAAA,IAAA,CAAK,IAAA,GAAO,IAAIA,OAAA,CAAK;AAAA,MACnB,kBAAkB,OAAA,CAAQ,gBAAA;AAAA,MAC1B,GAAA,EAAK,QAAQ,GAAA,IAAO,MAAA,CAAO,SAAS,OAAA,CAAQ,GAAA,CAAI,WAAA,IAAe,GAAA,EAAK,EAAE,CAAA;AAAA,MACtE,iBAAA,EAAmB,QAAQ,iBAAA,IAAqB,GAAA;AAAA,MAChD,uBAAA,EAAyB,QAAQ,uBAAA,IAA2B;AAAA,KAC7D,CAAA;AAAA,EACH;AAAA,EAEA,OAAA,GAAgB;AACd,IAAA,OAAO,IAAA,CAAK,IAAA;AAAA,EACd;AAAA,EAEA,MAAM,KAAA,GAAuB;AAC3B,IAAA,MAAM,IAAA,CAAK,KAAK,GAAA,EAAI;AAAA,EACtB;AACF,CAAA;ACXO,SAAS,mBAAmB,SAAA,EAAyD;AAC1F,EAAA,IAAI,SAAA,CAAU,SAAS,KAAA,EAAO;AAC5B,IAAA,MAAM,EAAE,OAAM,GAAI,SAAA;AAClB,IAAA,OAAO,YAAY,KAAA;AAAA,EACrB;AACA,EAAA,OAAO,yBAAyB,SAAS,CAAA;AAC3C;AAGO,SAAS,0BAAA,CACd,MAA0C,OAAO,OAAA,KAAY,cAAc,OAAA,CAAQ,GAAA,GAAM,EAAC,EACrB;AACrE,EAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,gBAAA,EAAkB,IAAA,EAAK;AACzC,EAAA,IAAI,KAAA,EAAO,OAAO,EAAE,IAAA,EAAM,OAAO,KAAA,EAAM;AAEvC,EAAA,MAAM,QAAA,GAAW,GAAA,CAAI,oBAAA,EAAsB,IAAA,EAAK;AAChD,EAAA,MAAM,YAAA,GAAe,GAAA,CAAI,wBAAA,EAA0B,IAAA,EAAK;AACxD,EAAA,MAAM,IAAA,GAAO,GAAA,CAAI,eAAA,EAAiB,IAAA,EAAK;AACvC,EAAA,IAAI,YAAY,YAAA,EAAc;AAC5B,IAAA,IAAI,CAAC,IAAA,EAAM,MAAM,IAAI,MAAM,mDAAmD,CAAA;AAC9E,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,mBAAA;AAAA,MACN,IAAA;AAAA,MACA,QAAA;AAAA,MACA,YAAA;AAAA,MACA,OAAO,GAAA,CAAI,gBAAA;AAAA,MACX,kBAAA,EAAoB,IAAI,+BAAA,GACpB,MAAA,CAAO,SAAS,GAAA,CAAI,+BAAA,EAAiC,EAAE,CAAA,GACvD;AAAA,KACN;AAAA,EACF;AACA,EAAA,MAAM,IAAI,KAAA;AAAA,IACR;AAAA,GACF;AACF;AAOA,SAAS,yBACP,SAAA,EACyB;AACzB,EAAA,MAAM,IAAA,GAAO,SAAA,CAAU,IAAA,CAAK,OAAA,CAAQ,OAAO,EAAE,CAAA;AAC7C,EAAA,MAAM,KAAA,GAAQ,UAAU,KAAA,IAAS,UAAA;AACjC,EAAA,MAAM,aAAA,GAAA,CAAiB,SAAA,CAAU,kBAAA,IAAsB,EAAA,IAAM,GAAA;AAC7D,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI,UAAA;AAEJ,EAAA,MAAM,UAAU,YAA6B;AAC3C,IAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,CAAA,EAAG,IAAI,CAAA,cAAA,CAAA,EAAkB;AAAA,MACpD,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,aAAA,EAAe,CAAA,MAAA,EAAS,MAAA,CAAO,IAAA,CAAK,GAAG,SAAA,CAAU,QAAQ,CAAA,CAAA,EAAI,SAAA,CAAU,YAAY,CAAA,CAAE,CAAA,CAAE,QAAA,CAAS,QAAQ,CAAC,CAAA,CAAA;AAAA,QACzG,cAAA,EAAgB;AAAA,OAClB;AAAA,MACA,MAAM,IAAI,eAAA,CAAgB,EAAE,UAAA,EAAY,oBAAA,EAAsB,OAAO;AAAA,KACtE,CAAA;AACD,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAA,EAAK;AACjC,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,wCAAA,EAA2C,QAAA,CAAS,MAAM,CAAA,CAAA,EAAI,QAAA,CAAS,UAAU,CAAA,EAAA,EAAK,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,GAAG,CAAC,CAAA;AAAA,OAC1G;AAAA,IACF;AACA,IAAA,MAAM,KAAA,GAAS,MAAM,QAAA,CAAS,IAAA,EAAK;AACnC,IAAA,MAAM,QAAQ,OAAO,KAAA,CAAM,YAAA,KAAiB,QAAA,GAAW,MAAM,YAAA,GAAe,MAAA;AAC5E,IAAA,IAAI,CAAC,KAAA,EAAO,MAAM,IAAI,MAAM,2DAA2D,CAAA;AACvF,IAAA,MAAM,mBAAmB,OAAO,KAAA,CAAM,UAAA,KAAe,QAAA,GAAW,MAAM,UAAA,GAAa,IAAA;AACnF,IAAA,MAAM,WAAA,GAAc,IAAA,CAAK,GAAA,EAAI,GAAI,gBAAA,GAAmB,GAAA;AACpD,IAAA,MAAA,GAAS,EAAE,KAAA,EAAO,WAAA,EAAa,WAAA,GAAc,aAAA,EAAc;AAC3D,IAAA,OAAO,KAAA;AAAA,EACT,CAAA;AAEA,EAAA,OAAO,YAAY;AACjB,IAAA,IAAI,UAAU,IAAA,CAAK,GAAA,KAAQ,MAAA,CAAO,WAAA,SAAoB,MAAA,CAAO,KAAA;AAC7D,IAAA,UAAA,KAAe,OAAA,EAAQ,CAAE,OAAA,CAAQ,MAAM;AACrC,MAAA,UAAA,GAAa,MAAA;AAAA,IACf,CAAC,CAAA;AACD,IAAA,OAAO,UAAA;AAAA,EACT,CAAA;AACF;AAmBO,SAAS,2BACd,OAAA,EACuB;AACvB,EAAA,MAAM,aAAA,GAAgB,OAAA,CAAQ,aAAA,CAAc,OAAA,CAAQ,OAAO,EAAE,CAAA;AAC7D,EAAA,MAAM,SAAA,GAAY,QAAQ,SAAA,IAAa,KAAA;AACvC,EAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,GAAA,IAAO,IAAA,CAAK,GAAA;AAChC,EAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,MAAA,IAAU,IAAA,CAAK,MAAA;AACtC,EAAA,MAAM,eAAA,GAAkB,OAAA,CAAQ,eAAA,IAAmB,CAAA,GAAI,GAAA;AACvD,EAAA,MAAM,eAAA,GAAkB,QAAQ,eAAA,IAAmB,GAAA;AACnD,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI,UAAA;AAEJ,EAAA,MAAM,UAAU,YAA6B;AAC3C,IAAA,MAAM,cAAA,GACJ,OAAO,OAAA,CAAQ,KAAA,KAAU,aAAa,MAAM,OAAA,CAAQ,KAAA,EAAM,GAAI,OAAA,CAAQ,KAAA;AACxE,IAAA,MAAM,QAAA,GAAW,MAAM,SAAA,CAAU,CAAA,EAAG,aAAa,CAAA,6BAAA,CAAA,EAAiC;AAAA,MAChF,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,aAAA,EAAe,UAAU,cAAc,CAAA,CAAA;AAAA,QACvC,cAAA,EAAgB;AAAA,OAClB;AAAA,MACA,MAAM,IAAA,CAAK,SAAA,CAAU,EAAE,QAAA,EAAU,OAAA,CAAQ,UAAU;AAAA,KACpD,CAAA;AACD,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAA,EAAK;AACjC,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,qCAAA,EAAwC,QAAA,CAAS,MAAM,CAAA,CAAA,EAAI,QAAA,CAAS,UAAU,CAAA,EAAA,EAAK,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,GAAG,CAAC,CAAA;AAAA,OACvG;AAAA,IACF;AACA,IAAA,MAAM,KAAA,GAAS,MAAM,QAAA,CAAS,IAAA,EAAK;AACnC,IAAA,IAAI,OAAO,KAAA,CAAM,KAAA,KAAU,QAAA,IAAY,CAAC,MAAM,KAAA,EAAO;AACnD,MAAA,MAAM,IAAI,MAAM,iDAAiD,CAAA;AAAA,IACnE;AACA,IAAA,MAAM,SAAA,GAAY,eAAA,CAAgB,KAAA,CAAM,WAAW,CAAA;AACnD,IAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,SAAS,CAAA,EAAG;AAC/B,MAAA,MAAM,IAAI,MAAM,+DAA+D,CAAA;AAAA,IACjF;AACA,IAAA,MAAM,SAAS,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,eAAe,IAAI,MAAA,EAAO;AACrD,IAAA,MAAA,GAAS;AAAA,MACP,OAAO,KAAA,CAAM,KAAA;AAAA,MACb,SAAA,EAAW,IAAA,CAAK,GAAA,CAAI,GAAA,EAAI,EAAG,SAAA,GAAY,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,eAAe,CAAA,GAAI,MAAM;AAAA,KAC9E;AACA,IAAA,OAAO,KAAA,CAAM,KAAA;AAAA,EACf,CAAA;AAEA,EAAA,OAAO,YAAY;AACjB,IAAA,IAAI,UAAU,GAAA,EAAI,GAAI,MAAA,CAAO,SAAA,SAAkB,MAAA,CAAO,KAAA;AACtD,IAAA,UAAA,KAAe,OAAA,EAAQ,CAAE,OAAA,CAAQ,MAAM;AACrC,MAAA,UAAA,GAAa,MAAA;AAAA,IACf,CAAC,CAAA;AACD,IAAA,OAAO,UAAA;AAAA,EACT,CAAA;AACF;AAEA,SAAS,gBAAgB,KAAA,EAAwB;AAC/C,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,IAAA,OAAO,KAAA,GAAQ,IAAA,GAAoB,KAAA,GAAQ,GAAA,GAAQ,KAAA;AAAA,EACrD;AACA,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU,OAAO,IAAI,IAAA,CAAK,KAAK,EAAE,OAAA,EAAQ;AAC9D,EAAA,OAAO,MAAA,CAAO,GAAA;AAChB;AA4CA,IAAM,cAAA,GAAN,cAA6BC,mBAAA,CAAa;AAAA,EAChC,OAAA;AAAA,EACA,WAAA;AAAA,EACA,MAAA,GAAS,KAAA;AAAA,EAET,mBAAmB,IAAA,EAAY;AACrC,IAAA,IAAA,CAAK,EAAA,CAAG,OAAA,EAAS,CAAC,KAAA,KAAU;AAC1B,MAAA,IAAA,CAAK,IAAA,CAAK,SAAS,KAAK,CAAA;AAAA,IAC1B,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,UAAA,CAAW,YAAwC,WAAA,EAAoC;AACrF,IAAA,IAAA,CAAK,WAAA,GAAc,WAAA,EAAY,CAC5B,IAAA,CAAK,CAAC,QAAA,KAAa;AAClB,MAAA,IAAI,CAAC,IAAA,CAAK,MAAA,OAAa,IAAA,CAAK,UAAA,CAAW,QAAQ,CAAC,CAAA;AAAA,IAClD,CAAC,CAAA,CACA,KAAA,CAAM,CAAC,KAAA,KAAU;AAChB,MAAA,IAAA,CAAK,IAAA,CAAK,OAAA,EAAS,KAAA,YAAiB,KAAA,GAAQ,KAAA,GAAQ,IAAI,KAAA,CAAM,MAAA,CAAO,KAAK,CAAC,CAAC,CAAA;AAC5E,MAAA,MAAM,KAAA;AAAA,IACR,CAAC,CAAA;AAAA,EACL;AAAA,EAEA,KAAK,IAAA,EAAY;AACf,IAAA,IAAI,KAAK,MAAA,EAAQ;AACf,MAAA,IAAA,CAAK,GAAA,EAAI,CAAE,KAAA,CAAM,MAAM,MAAS,CAAA;AAChC,MAAA;AAAA,IACF;AACA,IAAA,MAAM,WAAW,IAAA,CAAK,OAAA;AACtB,IAAA,IAAA,CAAK,OAAA,GAAU,IAAA;AACf,IAAA,IAAA,CAAK,mBAAmB,IAAI,CAAA;AAC5B,IAAA,IAAI,QAAA,EAAU;AACZ,MAAA,QAAA,CAAS,kBAAA,EAAmB;AAC5B,MAAA,QAAA,CAAS,GAAA,EAAI,CAAE,KAAA,CAAM,MAAM,MAAS,CAAA;AAAA,IACtC;AAAA,EACF;AAAA,EAEA,MAAc,iBAAA,GAAmC;AAC/C,IAAA,IAAI,IAAA,CAAK,WAAA,EAAa,MAAM,IAAA,CAAK,WAAA;AAAA,EACnC;AAAA,EAEA,SAAS,IAAA,EAAmD;AAC1D,IAAA,OAAO,IAAA,CAAK,iBAAA,EAAkB,CAAE,IAAA,CAAK,MAAM,KAAK,OAAA,CAAS,KAAA,CAAM,GAAG,IAAI,CAAC,CAAA;AAAA,EACzE;AAAA,EAEA,WAAW,IAAA,EAAqD;AAC9D,IAAA,OAAO,IAAA,CAAK,iBAAA,EAAkB,CAAE,IAAA,CAAK,MAAM,KAAK,OAAA,CAAS,OAAA,CAAQ,GAAG,IAAI,CAAC,CAAA;AAAA,EAC3E;AAAA,EAEA,GAAA,GAAqB;AACnB,IAAA,IAAA,CAAK,MAAA,GAAS,IAAA;AACd,IAAA,IAAA,CAAK,kBAAA,EAAmB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,EAAS,GAAA,EAAI,IAAK,QAAQ,OAAA,EAAQ;AAAA,EAChD;AAAA,EAEA,IAAI,UAAA,GAAa;AACf,IAAA,OAAO,IAAA,CAAK,SAAS,UAAA,IAAc,CAAA;AAAA,EACrC;AAAA,EAEA,IAAI,SAAA,GAAY;AACd,IAAA,OAAO,IAAA,CAAK,SAAS,SAAA,IAAa,CAAA;AAAA,EACpC;AAAA,EAEA,IAAI,YAAA,GAAe;AACjB,IAAA,OAAO,IAAA,CAAK,SAAS,YAAA,IAAgB,CAAA;AAAA,EACvC;AACF,CAAA;AAGO,IAAM,2BAAN,MAA2D;AAAA,EACvD,IAAA,GAAO,qBAAA;AAAA,EACC,OAAA;AAAA,EACA,WAAA;AAAA,EACA,WAAA;AAAA,EACA,cAAA;AAAA,EACT,YAAA;AAAA,EAER,YAAY,OAAA,EAAkC;AAC5C,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AACf,IAAA,IAAA,CAAK,WAAA,GAAc,OAAA,CAAQ,WAAA,IAAe,kBAAA,EAAmB;AAC7D,IAAA,IAAA,CAAK,cAAA,GAAiB,IAAI,cAAA,EAAe;AACzC,IAAA,IAAI,OAAA,CAAQ,aAAa,MAAA,EAAW;AAClC,MAAA,IAAA,CAAK,WAAA,GAAc,YAAY,OAAA,CAAQ,QAAA;AACvC,MAAA,IAAA,CAAK,eAAe,IAAA,CAAK,IAAA,CAAK,UAAA,CAAW,OAAA,CAAQ,QAAQ,CAAC,CAAA;AAAA,IAC5D,CAAA,MAAO;AACL,MAAA,IAAI,CAAC,QAAQ,KAAA,IAAS,CAAC,QAAQ,aAAA,IAAiB,CAAC,QAAQ,QAAA,EAAU;AACjE,QAAA,MAAM,IAAI,KAAA;AAAA,UACR;AAAA,SACF;AAAA,MACF;AACA,MAAA,IAAA,CAAK,cAAc,0BAAA,CAA2B;AAAA,QAC5C,eAAe,OAAA,CAAQ,aAAA;AAAA,QACvB,UAAU,OAAA,CAAQ,QAAA;AAAA,QAClB,OAAO,OAAA,CAAQ,KAAA;AAAA,QACf,WAAW,OAAA,CAAQ;AAAA,OACpB,CAAA;AACD,MAAA,IAAA,CAAK,cAAA,CAAe,WAAW,CAAC,QAAA,KAAa,KAAK,UAAA,CAAW,QAAQ,CAAA,EAAG,IAAA,CAAK,WAAW,CAAA;AACxF,MAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,iBAAA,IAAqB,EAAA,GAAK,GAAA;AACrD,MAAA,IAAA,CAAK,YAAA,GAAe,YAAY,MAAM;AACpC,QAAA,KAAK,KAAK,WAAA,EAAY;AAAA,MACxB,GAAG,UAAU,CAAA;AAAA,IACf;AAAA,EACF;AAAA,EAEQ,WAAW,QAAA,EAAyB;AAC1C,IAAA,OAAO,KAAK,WAAA,CAAY;AAAA,MACtB,IAAA,EAAM,KAAK,OAAA,CAAQ,IAAA;AAAA,MACnB,IAAA,EAAM,IAAA,CAAK,OAAA,CAAQ,IAAA,IAAQ,IAAA;AAAA,MAC3B,QAAA,EAAU,KAAK,OAAA,CAAQ,QAAA;AAAA,MACvB,IAAA,EAAM,KAAK,OAAA,CAAQ,IAAA;AAAA,MACnB,QAAA;AAAA,MACA,KAAK,IAAA,CAAK,OAAA,CAAQ,GAAA,IAAO,EAAE,oBAAoB,IAAA,EAAK;AAAA,MACpD,GAAA,EAAK,IAAA,CAAK,OAAA,CAAQ,GAAA,IAAO,MAAA,CAAO,SAAS,OAAA,CAAQ,GAAA,CAAI,WAAA,IAAe,GAAA,EAAK,EAAE,CAAA;AAAA,MAC3E,iBAAA,EAAmB,IAAA,CAAK,OAAA,CAAQ,iBAAA,IAAqB,GAAA;AAAA,MACrD,uBAAA,EAAyB,IAAA,CAAK,OAAA,CAAQ,uBAAA,IAA2B;AAAA,KAClE,CAAA;AAAA,EACH;AAAA,EAEA,MAAc,WAAA,GAA6B;AACzC,IAAA,IAAI;AACF,MAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,WAAA,EAAY;AACxC,MAAA,MAAM,IAAA,GAAO,IAAA,CAAK,UAAA,CAAW,QAAQ,CAAA;AACrC,MAAA,IAAA,CAAK,cAAA,CAAe,KAAK,IAAI,CAAA;AAAA,IAC/B,SAAS,KAAA,EAAO;AACd,MAAA,IAAA,CAAK,cAAA,CAAe,IAAA,CAAK,OAAA,EAAS,KAAA,YAAiB,KAAA,GAAQ,KAAA,GAAQ,IAAI,KAAA,CAAM,MAAA,CAAO,KAAK,CAAC,CAAC,CAAA;AAAA,IAC7F;AAAA,EACF;AAAA,EAEA,OAAA,GAAgB;AACd,IAAA,OAAO,IAAA,CAAK,cAAA;AAAA,EACd;AAAA,EAEA,MAAM,KAAA,GAAuB;AAC3B,IAAA,IAAI,KAAK,YAAA,EAAc;AACrB,MAAA,aAAA,CAAc,KAAK,YAAY,CAAA;AAC/B,MAAA,IAAA,CAAK,YAAA,GAAe,MAAA;AAAA,IACtB;AACA,IAAA,MAAM,IAAA,CAAK,eAAe,GAAA,EAAI;AAAA,EAChC;AACF,CAAA;AAEA,SAAS,kBAAA,GAA0C;AACjD,EAAA,OAAO,CAAC,MAAA,KAAW,IAAID,OAAAA,CAAK,MAAM,CAAA;AACpC;;;ACpWA,IAAI,QAAA,GAAoC,IAAA;AAExC,SAAS,cAAA,GAAmC;AAC1C,EAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,GAAA,CAAI,iBAAA,IAAqB,MAAA;AAE9C,EAAA,IAAI,SAAS,qBAAA,EAAuB;AAClC,IAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,GAAA,CAAI,wBAAA,EAA0B,IAAA,EAAK;AACxD,IAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,GAAA,CAAI,4BAAA,EAA8B,MAAK,IAAK,qBAAA;AACrE,IAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,GAAA,CAAI,wBAAA,EAA0B,IAAA,EAAK;AACxD,IAAA,MAAM,aAAA,GAAgB,OAAA,CAAQ,GAAA,CAAI,eAAA,EAAiB,IAAA,EAAK;AACxD,IAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,GAAA,CAAI,4BAAA,EAA8B,IAAA,EAAK;AAChE,IAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,GAAA,CAAI,4BAAA,EAA8B,IAAA,EAAK;AAEhE,IAAA,IAAI,CAAC,IAAA,EAAM;AACT,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AACA,IAAA,IAAI,CAAC,IAAA,EAAM;AACT,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAEA,IAAA,IAAI,QAAA,EAAU;AACZ,MAAA,OAAO,IAAI,wBAAA,CAAyB,EAAE,MAAM,QAAA,EAAU,IAAA,EAAM,UAAU,CAAA;AAAA,IACxE;AAEA,IAAA,IAAI,CAAC,aAAA,IAAiB,CAAC,QAAA,EAAU;AAC/B,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAEA,IAAA,MAAM,SAAA,GAAY,0BAAA,CAA2B,OAAA,CAAQ,GAAG,CAAA;AACxD,IAAA,OAAO,IAAI,wBAAA,CAAyB;AAAA,MAClC,IAAA;AAAA,MACA,QAAA;AAAA,MACA,IAAA;AAAA,MACA,aAAA;AAAA,MACA,QAAA;AAAA,MACA,KAAA,EAAO,mBAAmB,SAAS;AAAA,KACpC,CAAA;AAAA,EACH;AAEA,EAAA,MAAM,gBAAA,GAAmB,QAAQ,GAAA,CAAI,YAAA;AACrC,EAAA,IAAI,CAAC,gBAAA,EAAkB;AACrB,IAAA,MAAM,IAAI,MAAM,0BAA0B,CAAA;AAAA,EAC5C;AACA,EAAA,OAAO,IAAI,oBAAA,CAAqB,EAAE,gBAAA,EAAkB,CAAA;AACtD;AAcO,SAAS,OAAA,GAAgB;AAC9B,EAAA,IAAI,CAAC,QAAA,EAAU;AACb,IAAA,QAAA,GAAW,cAAA,EAAe;AAAA,EAC5B;AACA,EAAA,OAAO,SAAS,OAAA,EAAQ;AAC1B;AAGA,eAAsB,SAAA,GAA2B;AAC/C,EAAA,MAAM,UAAU,KAAA,EAAM;AACtB,EAAA,QAAA,GAAW,IAAA;AACb;AAGO,SAAS,iBAAA,GAA0B;AACxC,EAAA,QAAA,GAAW,IAAA;AACb;AAGO,SAAS,WAAA,GAAgC;AAC9C,EAAA,IAAI,CAAC,QAAA,EAAU;AACb,IAAA,QAAA,GAAW,cAAA,EAAe;AAAA,EAC5B;AACA,EAAA,OAAO,QAAA;AACT;AASA,SAAS,iBAAiB,SAAA,EAAyC;AACjE,EAAA,MAAM,MAAM,SAAA,CAAU,QAAA;AACtB,EAAA,MAAM,aAAA,GAAgB,GAAA,CAAI,GAAA,CAAI,2BAA2B,CAAA;AACzD,EAAA,IAAI,aAAA,EAAe;AACjB,IAAA,OAAO;AAAA,MACL,KAAA,EAAO,aAAA;AAAA,MACP,IAAA,EAAM,GAAA,CAAI,GAAA,CAAI,0BAA0B,CAAA;AAAA,MACxC,OAAA,EAAS,GAAA,CAAI,GAAA,CAAI,6BAA6B,CAAA;AAAA,MAC9C,MAAA,EAAQ,GAAA,CAAI,GAAA,CAAI,4BAA4B;AAAA,KAC9C;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,KAAA,EAAO,SAAA,CAAU,KAAA,CAAM,2BAAA,EAA6B,+BAA+B,CAAA;AAAA,IACnF,IAAA,EAAM,SAAA,CAAU,KAAA,CAAM,0BAAA,EAA4B,8BAA8B,CAAA;AAAA,IAChF,OAAA,EAAS,SAAA,CAAU,KAAA,CAAM,6BAAA,EAA+B,6BAA6B,CAAA;AAAA,IACrF,QAAQ,SAAA,CAAU,KAAA;AAAA,MAChB,4BAAA;AAAA,MACA;AAAA;AACF,GACF;AACF;AAGO,SAAS,iBAAA,CAAkB,WAA6B,YAAA,EAA2B;AACxF,EAAA,MAAM,CAAA,GAAI,gBAAgB,OAAA,EAAQ;AAClC,EAAA,MAAM,KAAA,GAAS,EAAwC,UAAA,IAAc,CAAA;AACrE,EAAA,MAAM,IAAA,GAAO,EAAE,SAAA,IAAa,CAAA;AAC5B,EAAA,MAAM,OAAA,GAAU,EAAE,YAAA,IAAgB,CAAA;AAElC,EAAA,MAAM,MAAA,GAAS,iBAAiB,SAAS,CAAA;AACzC,EAAA,MAAA,CAAO,KAAA,CAAM,GAAA,CAAI,EAAC,EAAG,KAAK,CAAA;AAC1B,EAAA,MAAA,CAAO,IAAA,CAAK,GAAA,CAAI,EAAC,EAAG,IAAI,CAAA;AACxB,EAAA,MAAA,CAAO,OAAA,CAAQ,GAAA,CAAI,EAAC,EAAG,OAAO,CAAA;AAC9B,EAAA,MAAA,CAAO,MAAA,CAAO,IAAI,EAAC,EAAG,KAAK,GAAA,CAAI,CAAA,EAAG,KAAA,GAAQ,IAAI,CAAC,CAAA;AACjD;AAOO,SAAS,mBAAA,CACd,SAAA,EACA,YAAA,EACA,UAAA,GAAa,GAAA,EACD;AACZ,EAAA,iBAAA,CAAkB,WAAW,YAAY,CAAA;AAEzC,EAAA,MAAM,QAAA,GAAW,YAAY,MAAM;AACjC,IAAA,iBAAA,CAAkB,WAAW,YAAY,CAAA;AAAA,EAC3C,GAAG,UAAU,CAAA;AAEb,EAAA,OAAO,MAAM,cAAc,QAAQ,CAAA;AACrC","file":"index.cjs","sourcesContent":["import { Pool } from 'pg';\nimport type { DatabaseProvider } from './types.js';\n\nexport interface NeonProviderOptions {\n  connectionString: string;\n  max?: number;\n  idleTimeoutMillis?: number;\n  connectionTimeoutMillis?: number;\n}\n\n/** Standard Postgres provider using a static connection string. */\nexport class NeonDatabaseProvider implements DatabaseProvider {\n  readonly kind = 'neon' as const;\n  private readonly pool: Pool;\n\n  constructor(options: NeonProviderOptions) {\n    this.pool = new Pool({\n      connectionString: options.connectionString,\n      max: options.max ?? Number.parseInt(process.env.PG_POOL_MAX ?? '5', 10),\n      idleTimeoutMillis: options.idleTimeoutMillis ?? 30_000,\n      connectionTimeoutMillis: options.connectionTimeoutMillis ?? 5_000,\n    });\n  }\n\n  getPool(): Pool {\n    return this.pool;\n  }\n\n  async close(): Promise<void> {\n    await this.pool.end();\n  }\n}\n","import { EventEmitter } from 'node:events';\nimport { Pool } from 'pg';\nimport type { DatabaseProvider } from './types.js';\n\n/** A resolver that returns a valid Databricks workspace OAuth token. */\nexport type DatabricksTokenProvider = () => Promise<string>;\n\n/** Supported Databricks authentication shapes. */\nexport type DatabricksPrincipal =\n  | { kind: 'pat'; token: string }\n  | {\n      kind: 'service-principal';\n      host: string;\n      clientId: string;\n      clientSecret: string;\n      scope?: string;\n      refreshSkewSeconds?: number;\n    };\n\n/** Resolve a PAT or OAuth M2M principal to a cached, auto-refreshing token provider. */\nexport function databricksIdentity(principal: DatabricksPrincipal): DatabricksTokenProvider {\n  if (principal.kind === 'pat') {\n    const { token } = principal;\n    return async () => token;\n  }\n  return servicePrincipalProvider(principal);\n}\n\n/** Build a principal from environment variables. */\nexport function databricksPrincipalFromEnv(\n  env: Record<string, string | undefined> = typeof process !== 'undefined' ? process.env : {},\n): Extract<DatabricksPrincipal, { kind: 'pat' | 'service-principal' }> {\n  const token = env.DATABRICKS_TOKEN?.trim();\n  if (token) return { kind: 'pat', token };\n\n  const clientId = env.DATABRICKS_CLIENT_ID?.trim();\n  const clientSecret = env.DATABRICKS_CLIENT_SECRET?.trim();\n  const host = env.DATABRICKS_HOST?.trim();\n  if (clientId && clientSecret) {\n    if (!host) throw new Error('Missing DATABRICKS_HOST for Databricks OAuth M2M.');\n    return {\n      kind: 'service-principal',\n      host,\n      clientId,\n      clientSecret,\n      scope: env.DATABRICKS_SCOPE,\n      refreshSkewSeconds: env.DATABRICKS_REFRESH_SKEW_SECONDS\n        ? Number.parseInt(env.DATABRICKS_REFRESH_SKEW_SECONDS, 10)\n        : undefined,\n    };\n  }\n  throw new Error(\n    'Missing Databricks credentials: DATABRICKS_TOKEN or DATABRICKS_CLIENT_ID+DATABRICKS_CLIENT_SECRET.',\n  );\n}\n\ninterface CachedToken {\n  token: string;\n  refreshAtMs: number;\n}\n\nfunction servicePrincipalProvider(\n  principal: Extract<DatabricksPrincipal, { kind: 'service-principal' }>,\n): DatabricksTokenProvider {\n  const host = principal.host.replace(/\\/$/, '');\n  const scope = principal.scope ?? 'all-apis';\n  const refreshSkewMs = (principal.refreshSkewSeconds ?? 60) * 1_000;\n  let cached: CachedToken | undefined;\n  let refreshing: Promise<string> | undefined;\n\n  const refresh = async (): Promise<string> => {\n    const response = await fetch(`${host}/oidc/v1/token`, {\n      method: 'POST',\n      headers: {\n        authorization: `Basic ${Buffer.from(`${principal.clientId}:${principal.clientSecret}`).toString('base64')}`,\n        'content-type': 'application/x-www-form-urlencoded',\n      },\n      body: new URLSearchParams({ grant_type: 'client_credentials', scope }),\n    });\n    if (!response.ok) {\n      const text = await response.text();\n      throw new Error(\n        `Databricks OAuth token exchange failed: ${response.status} ${response.statusText}: ${text.slice(0, 500)}`,\n      );\n    }\n    const value = (await response.json()) as { access_token?: unknown; expires_in?: unknown };\n    const token = typeof value.access_token === 'string' ? value.access_token : undefined;\n    if (!token) throw new Error('Databricks OAuth token exchange returned no access_token.');\n    const expiresInSeconds = typeof value.expires_in === 'number' ? value.expires_in : 3_600;\n    const expiresAtMs = Date.now() + expiresInSeconds * 1_000;\n    cached = { token, refreshAtMs: expiresAtMs - refreshSkewMs };\n    return token;\n  };\n\n  return async () => {\n    if (cached && Date.now() < cached.refreshAtMs) return cached.token;\n    refreshing ??= refresh().finally(() => {\n      refreshing = undefined;\n    });\n    return refreshing;\n  };\n}\n\nexport interface LakebaseCredentialProviderOptions {\n  workspaceHost: string;\n  endpoint: string;\n  token: string | DatabricksTokenProvider;\n  fetchImpl?: typeof fetch;\n  refreshBeforeMs?: number;\n  refreshJitterMs?: number;\n  now?: () => number;\n  random?: () => number;\n}\n\ninterface LakebaseCredentialResponse {\n  token?: unknown;\n  expire_time?: unknown;\n}\n\n/** Exchange a workspace OAuth token for a Lakebase database credential. Caches, refreshes early, single-flight. */\nexport function lakebaseCredentialProvider(\n  options: LakebaseCredentialProviderOptions,\n): () => Promise<string> {\n  const workspaceHost = options.workspaceHost.replace(/\\/$/, '');\n  const fetchImpl = options.fetchImpl ?? fetch;\n  const now = options.now ?? Date.now;\n  const random = options.random ?? Math.random;\n  const refreshBeforeMs = options.refreshBeforeMs ?? 5 * 60_000;\n  const refreshJitterMs = options.refreshJitterMs ?? 30_000;\n  let cached: { token: string; refreshAt: number } | undefined;\n  let refreshing: Promise<string> | undefined;\n\n  const refresh = async (): Promise<string> => {\n    const workspaceToken =\n      typeof options.token === 'function' ? await options.token() : options.token;\n    const response = await fetchImpl(`${workspaceHost}/api/2.0/postgres/credentials`, {\n      method: 'POST',\n      headers: {\n        authorization: `Bearer ${workspaceToken}`,\n        'content-type': 'application/json',\n      },\n      body: JSON.stringify({ endpoint: options.endpoint }),\n    });\n    if (!response.ok) {\n      const text = await response.text();\n      throw new Error(\n        `Lakebase credential exchange failed: ${response.status} ${response.statusText}: ${text.slice(0, 500)}`,\n      );\n    }\n    const value = (await response.json()) as LakebaseCredentialResponse;\n    if (typeof value.token !== 'string' || !value.token) {\n      throw new Error('Lakebase credential exchange returned no token.');\n    }\n    const expiresAt = parseExpireTime(value.expire_time);\n    if (!Number.isFinite(expiresAt)) {\n      throw new Error('Lakebase credential exchange returned an invalid expire_time.');\n    }\n    const jitter = Math.max(0, refreshJitterMs) * random();\n    cached = {\n      token: value.token,\n      refreshAt: Math.max(now(), expiresAt - Math.max(0, refreshBeforeMs) - jitter),\n    };\n    return value.token;\n  };\n\n  return async () => {\n    if (cached && now() < cached.refreshAt) return cached.token;\n    refreshing ??= refresh().finally(() => {\n      refreshing = undefined;\n    });\n    return refreshing;\n  };\n}\n\nfunction parseExpireTime(value: unknown): number {\n  if (typeof value === 'number') {\n    return value < 1_000_000_000_000 ? value * 1_000 : value;\n  }\n  if (typeof value === 'string') return new Date(value).getTime();\n  return Number.NaN;\n}\n\nexport interface LakebasePoolConfig {\n  host: string;\n  port: number;\n  database: string;\n  user: string;\n  password?: string;\n  ssl?: boolean | { rejectUnauthorized?: boolean };\n  max?: number;\n  idleTimeoutMillis?: number;\n  connectionTimeoutMillis?: number;\n}\n\nexport type LakebasePoolFactory = (config: LakebasePoolConfig) => Pool;\n\nexport interface LakebaseProviderOptions {\n  /** Direct endpoint host from list-endpoints (NOT the pooled host). */\n  host: string;\n  port?: number;\n  database: string;\n  user: string;\n  /** Static database password. If omitted, OAuth exchange is required. */\n  password?: string;\n  /** Workspace URL, e.g. https://adb-....azuredatabricks.net */\n  workspaceHost?: string;\n  /** Full endpoint resource name: projects/.../branches/.../endpoints/... */\n  endpoint?: string;\n  /** Workspace OAuth token or provider. */\n  token?: string | DatabricksTokenProvider;\n  fetchImpl?: typeof fetch;\n  ssl?: boolean | { rejectUnauthorized?: boolean };\n  max?: number;\n  idleTimeoutMillis?: number;\n  connectionTimeoutMillis?: number;\n  /** How often to refresh the credential and recreate the pool. Default 50 minutes. */\n  refreshIntervalMs?: number;\n  /** Injected pool factory for tests. */\n  poolFactory?: LakebasePoolFactory;\n  /** Observe recoverable idle pooled-connection failures. */\n  onPoolError?: (error: Error) => void;\n}\n\n/** A Pool-like facade that lazily initializes and always delegates to the current underlying pool. */\nclass DelegatingPool extends EventEmitter {\n  private current: Pool | undefined;\n  private initPromise: Promise<void> | undefined;\n  private closed = false;\n\n  private attachErrorHandler(pool: Pool) {\n    pool.on('error', (error) => {\n      this.emit('error', error);\n    });\n  }\n\n  initialize(createPool: (password: string) => Pool, getPassword: () => Promise<string>) {\n    this.initPromise = getPassword()\n      .then((password) => {\n        if (!this.closed) this.swap(createPool(password));\n      })\n      .catch((error) => {\n        this.emit('error', error instanceof Error ? error : new Error(String(error)));\n        throw error;\n      });\n  }\n\n  swap(pool: Pool) {\n    if (this.closed) {\n      pool.end().catch(() => undefined);\n      return;\n    }\n    const previous = this.current;\n    this.current = pool;\n    this.attachErrorHandler(pool);\n    if (previous) {\n      previous.removeAllListeners();\n      previous.end().catch(() => undefined);\n    }\n  }\n\n  private async ensureInitialized(): Promise<void> {\n    if (this.initPromise) await this.initPromise;\n  }\n\n  query(...args: Parameters<Pool['query']>): Promise<unknown> {\n    return this.ensureInitialized().then(() => this.current!.query(...args));\n  }\n\n  connect(...args: Parameters<Pool['connect']>): Promise<unknown> {\n    return this.ensureInitialized().then(() => this.current!.connect(...args));\n  }\n\n  end(): Promise<void> {\n    this.closed = true;\n    this.removeAllListeners();\n    return this.current?.end() ?? Promise.resolve();\n  }\n\n  get totalCount() {\n    return this.current?.totalCount ?? 0;\n  }\n\n  get idleCount() {\n    return this.current?.idleCount ?? 0;\n  }\n\n  get waitingCount() {\n    return this.current?.waitingCount ?? 0;\n  }\n}\n\n/** Databricks Lakebase Postgres provider with credential refresh. */\nexport class LakebaseDatabaseProvider implements DatabaseProvider {\n  readonly kind = 'databricks-lakebase' as const;\n  private readonly options: LakebaseProviderOptions;\n  private readonly poolFactory: LakebasePoolFactory;\n  private readonly getPassword: () => Promise<string>;\n  private readonly delegatingPool: DelegatingPool;\n  private refreshTimer: NodeJS.Timeout | undefined;\n\n  constructor(options: LakebaseProviderOptions) {\n    this.options = options;\n    this.poolFactory = options.poolFactory ?? defaultPoolFactory();\n    this.delegatingPool = new DelegatingPool();\n    if (options.password !== undefined) {\n      this.getPassword = async () => options.password as string;\n      this.delegatingPool.swap(this.createPool(options.password));\n    } else {\n      if (!options.token || !options.workspaceHost || !options.endpoint) {\n        throw new Error(\n          'Lakebase OAuth requires token, workspaceHost, and endpoint. A workspace token cannot be used directly as the Postgres password.',\n        );\n      }\n      this.getPassword = lakebaseCredentialProvider({\n        workspaceHost: options.workspaceHost,\n        endpoint: options.endpoint,\n        token: options.token,\n        fetchImpl: options.fetchImpl,\n      });\n      this.delegatingPool.initialize((password) => this.createPool(password), this.getPassword);\n      const intervalMs = options.refreshIntervalMs ?? 50 * 60_000;\n      this.refreshTimer = setInterval(() => {\n        void this.refreshPool();\n      }, intervalMs);\n    }\n  }\n\n  private createPool(password?: string): Pool {\n    return this.poolFactory({\n      host: this.options.host,\n      port: this.options.port ?? 5432,\n      database: this.options.database,\n      user: this.options.user,\n      password,\n      ssl: this.options.ssl ?? { rejectUnauthorized: true },\n      max: this.options.max ?? Number.parseInt(process.env.PG_POOL_MAX ?? '5', 10),\n      idleTimeoutMillis: this.options.idleTimeoutMillis ?? 30_000,\n      connectionTimeoutMillis: this.options.connectionTimeoutMillis ?? 5_000,\n    });\n  }\n\n  private async refreshPool(): Promise<void> {\n    try {\n      const password = await this.getPassword();\n      const pool = this.createPool(password);\n      this.delegatingPool.swap(pool);\n    } catch (error) {\n      this.delegatingPool.emit('error', error instanceof Error ? error : new Error(String(error)));\n    }\n  }\n\n  getPool(): Pool {\n    return this.delegatingPool as unknown as Pool;\n  }\n\n  async close(): Promise<void> {\n    if (this.refreshTimer) {\n      clearInterval(this.refreshTimer);\n      this.refreshTimer = undefined;\n    }\n    await this.delegatingPool.end();\n  }\n}\n\nfunction defaultPoolFactory(): LakebasePoolFactory {\n  return (config) => new Pool(config);\n}\n","import type { Gauge, MetricsCollector } from '@fabricorg/experiments-metrics';\nimport type { Pool } from 'pg';\nimport {\n  type DatabaseProvider,\n  LakebaseDatabaseProvider,\n  NeonDatabaseProvider,\n  databricksIdentity,\n  databricksPrincipalFromEnv,\n} from './providers/index.js';\n\nlet provider: DatabaseProvider | null = null;\n\nfunction createProvider(): DatabaseProvider {\n  const kind = process.env.DATABASE_PROVIDER ?? 'neon';\n\n  if (kind === 'databricks-lakebase') {\n    const host = process.env.DATABRICKS_LAKEBASE_HOST?.trim();\n    const database = process.env.DATABRICKS_LAKEBASE_DATABASE?.trim() ?? 'databricks_postgres';\n    const user = process.env.DATABRICKS_LAKEBASE_USER?.trim();\n    const workspaceHost = process.env.DATABRICKS_HOST?.trim();\n    const endpoint = process.env.DATABRICKS_LAKEBASE_ENDPOINT?.trim();\n    const password = process.env.DATABRICKS_LAKEBASE_PASSWORD?.trim();\n\n    if (!host) {\n      throw new Error(\n        'DATABRICKS_LAKEBASE_HOST is required when DATABASE_PROVIDER=databricks-lakebase',\n      );\n    }\n    if (!user) {\n      throw new Error(\n        'DATABRICKS_LAKEBASE_USER is required when DATABASE_PROVIDER=databricks-lakebase',\n      );\n    }\n\n    if (password) {\n      return new LakebaseDatabaseProvider({ host, database, user, password });\n    }\n\n    if (!workspaceHost || !endpoint) {\n      throw new Error(\n        'DATABRICKS_HOST and DATABRICKS_LAKEBASE_ENDPOINT are required for Lakebase OAuth, or provide DATABRICKS_LAKEBASE_PASSWORD for native auth.',\n      );\n    }\n\n    const principal = databricksPrincipalFromEnv(process.env);\n    return new LakebaseDatabaseProvider({\n      host,\n      database,\n      user,\n      workspaceHost,\n      endpoint,\n      token: databricksIdentity(principal),\n    });\n  }\n\n  const connectionString = process.env.DATABASE_URL;\n  if (!connectionString) {\n    throw new Error('DATABASE_URL is required');\n  }\n  return new NeonDatabaseProvider({ connectionString });\n}\n\n/**\n * Return a singleton `pg.Pool` configured for the active database provider.\n *\n * Provider selection:\n * - `DATABASE_PROVIDER=neon` (default): uses `DATABASE_URL`.\n * - `DATABASE_PROVIDER=databricks-lakebase`: uses Lakebase OAuth credentials.\n *\n * On the first call, a new Pool is created with the following defaults:\n * - `max`: parseInt(process.env.PG_POOL_MAX ?? '5') — caps concurrent connections.\n * - `idleTimeoutMillis`: 30000 — recycle idle connections before Vercel's 60s timeout.\n * - `connectionTimeoutMillis`: 5000 — fail fast when the database is unreachable.\n */\nexport function getPool(): Pool {\n  if (!provider) {\n    provider = createProvider();\n  }\n  return provider.getPool();\n}\n\n/** Close the active provider and any background refresh loops. */\nexport async function closePool(): Promise<void> {\n  await provider?.close();\n  provider = null;\n}\n\n/** Reset the singleton provider. Intended for tests. */\nexport function resetPoolProvider(): void {\n  provider = null;\n}\n\n/** Return the active provider, or create it. */\nexport function getProvider(): DatabaseProvider {\n  if (!provider) {\n    provider = createProvider();\n  }\n  return provider;\n}\n\ninterface PoolGauges {\n  total: Gauge;\n  idle: Gauge;\n  waiting: Gauge;\n  active: Gauge;\n}\n\nfunction ensurePoolGauges(collector: MetricsCollector): PoolGauges {\n  const reg = collector.registry;\n  const existingTotal = reg.get('db_pool_connections_total');\n  if (existingTotal) {\n    return {\n      total: existingTotal as Gauge,\n      idle: reg.get('db_pool_connections_idle') as Gauge,\n      waiting: reg.get('db_pool_connections_waiting') as Gauge,\n      active: reg.get('db_pool_connections_active') as Gauge,\n    };\n  }\n\n  return {\n    total: collector.gauge('db_pool_connections_total', 'Total connections in the pool'),\n    idle: collector.gauge('db_pool_connections_idle', 'Idle connections in the pool'),\n    waiting: collector.gauge('db_pool_connections_waiting', 'Waiting clients in the pool'),\n    active: collector.gauge(\n      'db_pool_connections_active',\n      'Active (non-idle) connections in the pool',\n    ),\n  };\n}\n\n/** Update pool gauge values from the current pool state. */\nexport function updatePoolMetrics(collector: MetricsCollector, poolInstance?: Pool): void {\n  const p = poolInstance ?? getPool();\n  const total = (p as unknown as { totalCount: number }).totalCount ?? 0;\n  const idle = p.idleCount ?? 0;\n  const waiting = p.waitingCount ?? 0;\n\n  const gauges = ensurePoolGauges(collector);\n  gauges.total.set({}, total);\n  gauges.idle.set({}, idle);\n  gauges.waiting.set({}, waiting);\n  gauges.active.set({}, Math.max(0, total - idle));\n}\n\n/**\n * Register pool metrics with the given collector.\n *\n * Returns a cleanup function that stops the update interval.\n */\nexport function registerPoolMetrics(\n  collector: MetricsCollector,\n  poolInstance?: Pool,\n  intervalMs = 5000,\n): () => void {\n  updatePoolMetrics(collector, poolInstance);\n\n  const interval = setInterval(() => {\n    updatePoolMetrics(collector, poolInstance);\n  }, intervalMs);\n\n  return () => clearInterval(interval);\n}\n"]}

package/dist/index.d.cts

@@ -0,0 +1,41 @@
+import { MetricsCollector } from '@fabricorg/experiments-metrics';
+import { Pool } from 'pg';
+
+/** Backend selection for the control-plane database. */
+interface DatabaseProvider {
+    readonly kind: 'neon' | 'databricks-lakebase';
+    /** Return the active connection pool. Callers should not cache the returned instance. */
+    getPool(): Pool;
+    /** Close the provider and any background refresh loops. */
+    close(): Promise<void>;
+}
+
+/**
+ * Return a singleton `pg.Pool` configured for the active database provider.
+ *
+ * Provider selection:
+ * - `DATABASE_PROVIDER=neon` (default): uses `DATABASE_URL`.
+ * - `DATABASE_PROVIDER=databricks-lakebase`: uses Lakebase OAuth credentials.
+ *
+ * On the first call, a new Pool is created with the following defaults:
+ * - `max`: parseInt(process.env.PG_POOL_MAX ?? '5') — caps concurrent connections.
+ * - `idleTimeoutMillis`: 30000 — recycle idle connections before Vercel's 60s timeout.
+ * - `connectionTimeoutMillis`: 5000 — fail fast when the database is unreachable.
+ */
+declare function getPool(): Pool;
+/** Close the active provider and any background refresh loops. */
+declare function closePool(): Promise<void>;
+/** Reset the singleton provider. Intended for tests. */
+declare function resetPoolProvider(): void;
+/** Return the active provider, or create it. */
+declare function getProvider(): DatabaseProvider;
+/** Update pool gauge values from the current pool state. */
+declare function updatePoolMetrics(collector: MetricsCollector, poolInstance?: Pool): void;
+/**
+ * Register pool metrics with the given collector.
+ *
+ * Returns a cleanup function that stops the update interval.
+ */
+declare function registerPoolMetrics(collector: MetricsCollector, poolInstance?: Pool, intervalMs?: number): () => void;
+
+export { closePool, getPool, getProvider, registerPoolMetrics, resetPoolProvider, updatePoolMetrics };

package/dist/index.d.ts

@@ -0,0 +1,41 @@
+import { MetricsCollector } from '@fabricorg/experiments-metrics';
+import { Pool } from 'pg';
+
+/** Backend selection for the control-plane database. */
+interface DatabaseProvider {
+    readonly kind: 'neon' | 'databricks-lakebase';
+    /** Return the active connection pool. Callers should not cache the returned instance. */
+    getPool(): Pool;
+    /** Close the provider and any background refresh loops. */
+    close(): Promise<void>;
+}
+
+/**
+ * Return a singleton `pg.Pool` configured for the active database provider.
+ *
+ * Provider selection:
+ * - `DATABASE_PROVIDER=neon` (default): uses `DATABASE_URL`.
+ * - `DATABASE_PROVIDER=databricks-lakebase`: uses Lakebase OAuth credentials.
+ *
+ * On the first call, a new Pool is created with the following defaults:
+ * - `max`: parseInt(process.env.PG_POOL_MAX ?? '5') — caps concurrent connections.
+ * - `idleTimeoutMillis`: 30000 — recycle idle connections before Vercel's 60s timeout.
+ * - `connectionTimeoutMillis`: 5000 — fail fast when the database is unreachable.
+ */
+declare function getPool(): Pool;
+/** Close the active provider and any background refresh loops. */
+declare function closePool(): Promise<void>;
+/** Reset the singleton provider. Intended for tests. */
+declare function resetPoolProvider(): void;
+/** Return the active provider, or create it. */
+declare function getProvider(): DatabaseProvider;
+/** Update pool gauge values from the current pool state. */
+declare function updatePoolMetrics(collector: MetricsCollector, poolInstance?: Pool): void;
+/**
+ * Register pool metrics with the given collector.
+ *
+ * Returns a cleanup function that stops the update interval.
+ */
+declare function registerPoolMetrics(collector: MetricsCollector, poolInstance?: Pool, intervalMs?: number): () => void;
+
+export { closePool, getPool, getProvider, registerPoolMetrics, resetPoolProvider, updatePoolMetrics };

package/dist/index.js

@@ -0,0 +1,373 @@
+import { Pool } from 'pg';
+import { EventEmitter } from 'events';
+
+// src/providers/neon.ts
+var NeonDatabaseProvider = class {
+  kind = "neon";
+  pool;
+  constructor(options) {
+    this.pool = new Pool({
+      connectionString: options.connectionString,
+      max: options.max ?? Number.parseInt(process.env.PG_POOL_MAX ?? "5", 10),
+      idleTimeoutMillis: options.idleTimeoutMillis ?? 3e4,
+      connectionTimeoutMillis: options.connectionTimeoutMillis ?? 5e3
+    });
+  }
+  getPool() {
+    return this.pool;
+  }
+  async close() {
+    await this.pool.end();
+  }
+};
+function databricksIdentity(principal) {
+  if (principal.kind === "pat") {
+    const { token } = principal;
+    return async () => token;
+  }
+  return servicePrincipalProvider(principal);
+}
+function databricksPrincipalFromEnv(env = typeof process !== "undefined" ? process.env : {}) {
+  const token = env.DATABRICKS_TOKEN?.trim();
+  if (token) return { kind: "pat", token };
+  const clientId = env.DATABRICKS_CLIENT_ID?.trim();
+  const clientSecret = env.DATABRICKS_CLIENT_SECRET?.trim();
+  const host = env.DATABRICKS_HOST?.trim();
+  if (clientId && clientSecret) {
+    if (!host) throw new Error("Missing DATABRICKS_HOST for Databricks OAuth M2M.");
+    return {
+      kind: "service-principal",
+      host,
+      clientId,
+      clientSecret,
+      scope: env.DATABRICKS_SCOPE,
+      refreshSkewSeconds: env.DATABRICKS_REFRESH_SKEW_SECONDS ? Number.parseInt(env.DATABRICKS_REFRESH_SKEW_SECONDS, 10) : void 0
+    };
+  }
+  throw new Error(
+    "Missing Databricks credentials: DATABRICKS_TOKEN or DATABRICKS_CLIENT_ID+DATABRICKS_CLIENT_SECRET."
+  );
+}
+function servicePrincipalProvider(principal) {
+  const host = principal.host.replace(/\/$/, "");
+  const scope = principal.scope ?? "all-apis";
+  const refreshSkewMs = (principal.refreshSkewSeconds ?? 60) * 1e3;
+  let cached;
+  let refreshing;
+  const refresh = async () => {
+    const response = await fetch(`${host}/oidc/v1/token`, {
+      method: "POST",
+      headers: {
+        authorization: `Basic ${Buffer.from(`${principal.clientId}:${principal.clientSecret}`).toString("base64")}`,
+        "content-type": "application/x-www-form-urlencoded"
+      },
+      body: new URLSearchParams({ grant_type: "client_credentials", scope })
+    });
+    if (!response.ok) {
+      const text = await response.text();
+      throw new Error(
+        `Databricks OAuth token exchange failed: ${response.status} ${response.statusText}: ${text.slice(0, 500)}`
+      );
+    }
+    const value = await response.json();
+    const token = typeof value.access_token === "string" ? value.access_token : void 0;
+    if (!token) throw new Error("Databricks OAuth token exchange returned no access_token.");
+    const expiresInSeconds = typeof value.expires_in === "number" ? value.expires_in : 3600;
+    const expiresAtMs = Date.now() + expiresInSeconds * 1e3;
+    cached = { token, refreshAtMs: expiresAtMs - refreshSkewMs };
+    return token;
+  };
+  return async () => {
+    if (cached && Date.now() < cached.refreshAtMs) return cached.token;
+    refreshing ??= refresh().finally(() => {
+      refreshing = void 0;
+    });
+    return refreshing;
+  };
+}
+function lakebaseCredentialProvider(options) {
+  const workspaceHost = options.workspaceHost.replace(/\/$/, "");
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const now = options.now ?? Date.now;
+  const random = options.random ?? Math.random;
+  const refreshBeforeMs = options.refreshBeforeMs ?? 5 * 6e4;
+  const refreshJitterMs = options.refreshJitterMs ?? 3e4;
+  let cached;
+  let refreshing;
+  const refresh = async () => {
+    const workspaceToken = typeof options.token === "function" ? await options.token() : options.token;
+    const response = await fetchImpl(`${workspaceHost}/api/2.0/postgres/credentials`, {
+      method: "POST",
+      headers: {
+        authorization: `Bearer ${workspaceToken}`,
+        "content-type": "application/json"
+      },
+      body: JSON.stringify({ endpoint: options.endpoint })
+    });
+    if (!response.ok) {
+      const text = await response.text();
+      throw new Error(
+        `Lakebase credential exchange failed: ${response.status} ${response.statusText}: ${text.slice(0, 500)}`
+      );
+    }
+    const value = await response.json();
+    if (typeof value.token !== "string" || !value.token) {
+      throw new Error("Lakebase credential exchange returned no token.");
+    }
+    const expiresAt = parseExpireTime(value.expire_time);
+    if (!Number.isFinite(expiresAt)) {
+      throw new Error("Lakebase credential exchange returned an invalid expire_time.");
+    }
+    const jitter = Math.max(0, refreshJitterMs) * random();
+    cached = {
+      token: value.token,
+      refreshAt: Math.max(now(), expiresAt - Math.max(0, refreshBeforeMs) - jitter)
+    };
+    return value.token;
+  };
+  return async () => {
+    if (cached && now() < cached.refreshAt) return cached.token;
+    refreshing ??= refresh().finally(() => {
+      refreshing = void 0;
+    });
+    return refreshing;
+  };
+}
+function parseExpireTime(value) {
+  if (typeof value === "number") {
+    return value < 1e12 ? value * 1e3 : value;
+  }
+  if (typeof value === "string") return new Date(value).getTime();
+  return Number.NaN;
+}
+var DelegatingPool = class extends EventEmitter {
+  current;
+  initPromise;
+  closed = false;
+  attachErrorHandler(pool) {
+    pool.on("error", (error) => {
+      this.emit("error", error);
+    });
+  }
+  initialize(createPool, getPassword) {
+    this.initPromise = getPassword().then((password) => {
+      if (!this.closed) this.swap(createPool(password));
+    }).catch((error) => {
+      this.emit("error", error instanceof Error ? error : new Error(String(error)));
+      throw error;
+    });
+  }
+  swap(pool) {
+    if (this.closed) {
+      pool.end().catch(() => void 0);
+      return;
+    }
+    const previous = this.current;
+    this.current = pool;
+    this.attachErrorHandler(pool);
+    if (previous) {
+      previous.removeAllListeners();
+      previous.end().catch(() => void 0);
+    }
+  }
+  async ensureInitialized() {
+    if (this.initPromise) await this.initPromise;
+  }
+  query(...args) {
+    return this.ensureInitialized().then(() => this.current.query(...args));
+  }
+  connect(...args) {
+    return this.ensureInitialized().then(() => this.current.connect(...args));
+  }
+  end() {
+    this.closed = true;
+    this.removeAllListeners();
+    return this.current?.end() ?? Promise.resolve();
+  }
+  get totalCount() {
+    return this.current?.totalCount ?? 0;
+  }
+  get idleCount() {
+    return this.current?.idleCount ?? 0;
+  }
+  get waitingCount() {
+    return this.current?.waitingCount ?? 0;
+  }
+};
+var LakebaseDatabaseProvider = class {
+  kind = "databricks-lakebase";
+  options;
+  poolFactory;
+  getPassword;
+  delegatingPool;
+  refreshTimer;
+  constructor(options) {
+    this.options = options;
+    this.poolFactory = options.poolFactory ?? defaultPoolFactory();
+    this.delegatingPool = new DelegatingPool();
+    if (options.password !== void 0) {
+      this.getPassword = async () => options.password;
+      this.delegatingPool.swap(this.createPool(options.password));
+    } else {
+      if (!options.token || !options.workspaceHost || !options.endpoint) {
+        throw new Error(
+          "Lakebase OAuth requires token, workspaceHost, and endpoint. A workspace token cannot be used directly as the Postgres password."
+        );
+      }
+      this.getPassword = lakebaseCredentialProvider({
+        workspaceHost: options.workspaceHost,
+        endpoint: options.endpoint,
+        token: options.token,
+        fetchImpl: options.fetchImpl
+      });
+      this.delegatingPool.initialize((password) => this.createPool(password), this.getPassword);
+      const intervalMs = options.refreshIntervalMs ?? 50 * 6e4;
+      this.refreshTimer = setInterval(() => {
+        void this.refreshPool();
+      }, intervalMs);
+    }
+  }
+  createPool(password) {
+    return this.poolFactory({
+      host: this.options.host,
+      port: this.options.port ?? 5432,
+      database: this.options.database,
+      user: this.options.user,
+      password,
+      ssl: this.options.ssl ?? { rejectUnauthorized: true },
+      max: this.options.max ?? Number.parseInt(process.env.PG_POOL_MAX ?? "5", 10),
+      idleTimeoutMillis: this.options.idleTimeoutMillis ?? 3e4,
+      connectionTimeoutMillis: this.options.connectionTimeoutMillis ?? 5e3
+    });
+  }
+  async refreshPool() {
+    try {
+      const password = await this.getPassword();
+      const pool = this.createPool(password);
+      this.delegatingPool.swap(pool);
+    } catch (error) {
+      this.delegatingPool.emit("error", error instanceof Error ? error : new Error(String(error)));
+    }
+  }
+  getPool() {
+    return this.delegatingPool;
+  }
+  async close() {
+    if (this.refreshTimer) {
+      clearInterval(this.refreshTimer);
+      this.refreshTimer = void 0;
+    }
+    await this.delegatingPool.end();
+  }
+};
+function defaultPoolFactory() {
+  return (config) => new Pool(config);
+}
+
+// src/index.ts
+var provider = null;
+function createProvider() {
+  const kind = process.env.DATABASE_PROVIDER ?? "neon";
+  if (kind === "databricks-lakebase") {
+    const host = process.env.DATABRICKS_LAKEBASE_HOST?.trim();
+    const database = process.env.DATABRICKS_LAKEBASE_DATABASE?.trim() ?? "databricks_postgres";
+    const user = process.env.DATABRICKS_LAKEBASE_USER?.trim();
+    const workspaceHost = process.env.DATABRICKS_HOST?.trim();
+    const endpoint = process.env.DATABRICKS_LAKEBASE_ENDPOINT?.trim();
+    const password = process.env.DATABRICKS_LAKEBASE_PASSWORD?.trim();
+    if (!host) {
+      throw new Error(
+        "DATABRICKS_LAKEBASE_HOST is required when DATABASE_PROVIDER=databricks-lakebase"
+      );
+    }
+    if (!user) {
+      throw new Error(
+        "DATABRICKS_LAKEBASE_USER is required when DATABASE_PROVIDER=databricks-lakebase"
+      );
+    }
+    if (password) {
+      return new LakebaseDatabaseProvider({ host, database, user, password });
+    }
+    if (!workspaceHost || !endpoint) {
+      throw new Error(
+        "DATABRICKS_HOST and DATABRICKS_LAKEBASE_ENDPOINT are required for Lakebase OAuth, or provide DATABRICKS_LAKEBASE_PASSWORD for native auth."
+      );
+    }
+    const principal = databricksPrincipalFromEnv(process.env);
+    return new LakebaseDatabaseProvider({
+      host,
+      database,
+      user,
+      workspaceHost,
+      endpoint,
+      token: databricksIdentity(principal)
+    });
+  }
+  const connectionString = process.env.DATABASE_URL;
+  if (!connectionString) {
+    throw new Error("DATABASE_URL is required");
+  }
+  return new NeonDatabaseProvider({ connectionString });
+}
+function getPool() {
+  if (!provider) {
+    provider = createProvider();
+  }
+  return provider.getPool();
+}
+async function closePool() {
+  await provider?.close();
+  provider = null;
+}
+function resetPoolProvider() {
+  provider = null;
+}
+function getProvider() {
+  if (!provider) {
+    provider = createProvider();
+  }
+  return provider;
+}
+function ensurePoolGauges(collector) {
+  const reg = collector.registry;
+  const existingTotal = reg.get("db_pool_connections_total");
+  if (existingTotal) {
+    return {
+      total: existingTotal,
+      idle: reg.get("db_pool_connections_idle"),
+      waiting: reg.get("db_pool_connections_waiting"),
+      active: reg.get("db_pool_connections_active")
+    };
+  }
+  return {
+    total: collector.gauge("db_pool_connections_total", "Total connections in the pool"),
+    idle: collector.gauge("db_pool_connections_idle", "Idle connections in the pool"),
+    waiting: collector.gauge("db_pool_connections_waiting", "Waiting clients in the pool"),
+    active: collector.gauge(
+      "db_pool_connections_active",
+      "Active (non-idle) connections in the pool"
+    )
+  };
+}
+function updatePoolMetrics(collector, poolInstance) {
+  const p = poolInstance ?? getPool();
+  const total = p.totalCount ?? 0;
+  const idle = p.idleCount ?? 0;
+  const waiting = p.waitingCount ?? 0;
+  const gauges = ensurePoolGauges(collector);
+  gauges.total.set({}, total);
+  gauges.idle.set({}, idle);
+  gauges.waiting.set({}, waiting);
+  gauges.active.set({}, Math.max(0, total - idle));
+}
+function registerPoolMetrics(collector, poolInstance, intervalMs = 5e3) {
+  updatePoolMetrics(collector, poolInstance);
+  const interval = setInterval(() => {
+    updatePoolMetrics(collector, poolInstance);
+  }, intervalMs);
+  return () => clearInterval(interval);
+}
+
+export { closePool, getPool, getProvider, registerPoolMetrics, resetPoolProvider, updatePoolMetrics };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/providers/neon.ts","../src/providers/lakebase.ts","../src/index.ts"],"names":["Pool"],"mappings":";;;;AAWO,IAAM,uBAAN,MAAuD;AAAA,EACnD,IAAA,GAAO,MAAA;AAAA,EACC,IAAA;AAAA,EAEjB,YAAY,OAAA,EAA8B;AACxC,IAAA,IAAA,CAAK,IAAA,GAAO,IAAI,IAAA,CAAK;AAAA,MACnB,kBAAkB,OAAA,CAAQ,gBAAA;AAAA,MAC1B,GAAA,EAAK,QAAQ,GAAA,IAAO,MAAA,CAAO,SAAS,OAAA,CAAQ,GAAA,CAAI,WAAA,IAAe,GAAA,EAAK,EAAE,CAAA;AAAA,MACtE,iBAAA,EAAmB,QAAQ,iBAAA,IAAqB,GAAA;AAAA,MAChD,uBAAA,EAAyB,QAAQ,uBAAA,IAA2B;AAAA,KAC7D,CAAA;AAAA,EACH;AAAA,EAEA,OAAA,GAAgB;AACd,IAAA,OAAO,IAAA,CAAK,IAAA;AAAA,EACd;AAAA,EAEA,MAAM,KAAA,GAAuB;AAC3B,IAAA,MAAM,IAAA,CAAK,KAAK,GAAA,EAAI;AAAA,EACtB;AACF,CAAA;ACXO,SAAS,mBAAmB,SAAA,EAAyD;AAC1F,EAAA,IAAI,SAAA,CAAU,SAAS,KAAA,EAAO;AAC5B,IAAA,MAAM,EAAE,OAAM,GAAI,SAAA;AAClB,IAAA,OAAO,YAAY,KAAA;AAAA,EACrB;AACA,EAAA,OAAO,yBAAyB,SAAS,CAAA;AAC3C;AAGO,SAAS,0BAAA,CACd,MAA0C,OAAO,OAAA,KAAY,cAAc,OAAA,CAAQ,GAAA,GAAM,EAAC,EACrB;AACrE,EAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,gBAAA,EAAkB,IAAA,EAAK;AACzC,EAAA,IAAI,KAAA,EAAO,OAAO,EAAE,IAAA,EAAM,OAAO,KAAA,EAAM;AAEvC,EAAA,MAAM,QAAA,GAAW,GAAA,CAAI,oBAAA,EAAsB,IAAA,EAAK;AAChD,EAAA,MAAM,YAAA,GAAe,GAAA,CAAI,wBAAA,EAA0B,IAAA,EAAK;AACxD,EAAA,MAAM,IAAA,GAAO,GAAA,CAAI,eAAA,EAAiB,IAAA,EAAK;AACvC,EAAA,IAAI,YAAY,YAAA,EAAc;AAC5B,IAAA,IAAI,CAAC,IAAA,EAAM,MAAM,IAAI,MAAM,mDAAmD,CAAA;AAC9E,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,mBAAA;AAAA,MACN,IAAA;AAAA,MACA,QAAA;AAAA,MACA,YAAA;AAAA,MACA,OAAO,GAAA,CAAI,gBAAA;AAAA,MACX,kBAAA,EAAoB,IAAI,+BAAA,GACpB,MAAA,CAAO,SAAS,GAAA,CAAI,+BAAA,EAAiC,EAAE,CAAA,GACvD;AAAA,KACN;AAAA,EACF;AACA,EAAA,MAAM,IAAI,KAAA;AAAA,IACR;AAAA,GACF;AACF;AAOA,SAAS,yBACP,SAAA,EACyB;AACzB,EAAA,MAAM,IAAA,GAAO,SAAA,CAAU,IAAA,CAAK,OAAA,CAAQ,OAAO,EAAE,CAAA;AAC7C,EAAA,MAAM,KAAA,GAAQ,UAAU,KAAA,IAAS,UAAA;AACjC,EAAA,MAAM,aAAA,GAAA,CAAiB,SAAA,CAAU,kBAAA,IAAsB,EAAA,IAAM,GAAA;AAC7D,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI,UAAA;AAEJ,EAAA,MAAM,UAAU,YAA6B;AAC3C,IAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,CAAA,EAAG,IAAI,CAAA,cAAA,CAAA,EAAkB;AAAA,MACpD,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,aAAA,EAAe,CAAA,MAAA,EAAS,MAAA,CAAO,IAAA,CAAK,GAAG,SAAA,CAAU,QAAQ,CAAA,CAAA,EAAI,SAAA,CAAU,YAAY,CAAA,CAAE,CAAA,CAAE,QAAA,CAAS,QAAQ,CAAC,CAAA,CAAA;AAAA,QACzG,cAAA,EAAgB;AAAA,OAClB;AAAA,MACA,MAAM,IAAI,eAAA,CAAgB,EAAE,UAAA,EAAY,oBAAA,EAAsB,OAAO;AAAA,KACtE,CAAA;AACD,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAA,EAAK;AACjC,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,wCAAA,EAA2C,QAAA,CAAS,MAAM,CAAA,CAAA,EAAI,QAAA,CAAS,UAAU,CAAA,EAAA,EAAK,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,GAAG,CAAC,CAAA;AAAA,OAC1G;AAAA,IACF;AACA,IAAA,MAAM,KAAA,GAAS,MAAM,QAAA,CAAS,IAAA,EAAK;AACnC,IAAA,MAAM,QAAQ,OAAO,KAAA,CAAM,YAAA,KAAiB,QAAA,GAAW,MAAM,YAAA,GAAe,MAAA;AAC5E,IAAA,IAAI,CAAC,KAAA,EAAO,MAAM,IAAI,MAAM,2DAA2D,CAAA;AACvF,IAAA,MAAM,mBAAmB,OAAO,KAAA,CAAM,UAAA,KAAe,QAAA,GAAW,MAAM,UAAA,GAAa,IAAA;AACnF,IAAA,MAAM,WAAA,GAAc,IAAA,CAAK,GAAA,EAAI,GAAI,gBAAA,GAAmB,GAAA;AACpD,IAAA,MAAA,GAAS,EAAE,KAAA,EAAO,WAAA,EAAa,WAAA,GAAc,aAAA,EAAc;AAC3D,IAAA,OAAO,KAAA;AAAA,EACT,CAAA;AAEA,EAAA,OAAO,YAAY;AACjB,IAAA,IAAI,UAAU,IAAA,CAAK,GAAA,KAAQ,MAAA,CAAO,WAAA,SAAoB,MAAA,CAAO,KAAA;AAC7D,IAAA,UAAA,KAAe,OAAA,EAAQ,CAAE,OAAA,CAAQ,MAAM;AACrC,MAAA,UAAA,GAAa,MAAA;AAAA,IACf,CAAC,CAAA;AACD,IAAA,OAAO,UAAA;AAAA,EACT,CAAA;AACF;AAmBO,SAAS,2BACd,OAAA,EACuB;AACvB,EAAA,MAAM,aAAA,GAAgB,OAAA,CAAQ,aAAA,CAAc,OAAA,CAAQ,OAAO,EAAE,CAAA;AAC7D,EAAA,MAAM,SAAA,GAAY,QAAQ,SAAA,IAAa,KAAA;AACvC,EAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,GAAA,IAAO,IAAA,CAAK,GAAA;AAChC,EAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,MAAA,IAAU,IAAA,CAAK,MAAA;AACtC,EAAA,MAAM,eAAA,GAAkB,OAAA,CAAQ,eAAA,IAAmB,CAAA,GAAI,GAAA;AACvD,EAAA,MAAM,eAAA,GAAkB,QAAQ,eAAA,IAAmB,GAAA;AACnD,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI,UAAA;AAEJ,EAAA,MAAM,UAAU,YAA6B;AAC3C,IAAA,MAAM,cAAA,GACJ,OAAO,OAAA,CAAQ,KAAA,KAAU,aAAa,MAAM,OAAA,CAAQ,KAAA,EAAM,GAAI,OAAA,CAAQ,KAAA;AACxE,IAAA,MAAM,QAAA,GAAW,MAAM,SAAA,CAAU,CAAA,EAAG,aAAa,CAAA,6BAAA,CAAA,EAAiC;AAAA,MAChF,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,aAAA,EAAe,UAAU,cAAc,CAAA,CAAA;AAAA,QACvC,cAAA,EAAgB;AAAA,OAClB;AAAA,MACA,MAAM,IAAA,CAAK,SAAA,CAAU,EAAE,QAAA,EAAU,OAAA,CAAQ,UAAU;AAAA,KACpD,CAAA;AACD,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAA,EAAK;AACjC,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,qCAAA,EAAwC,QAAA,CAAS,MAAM,CAAA,CAAA,EAAI,QAAA,CAAS,UAAU,CAAA,EAAA,EAAK,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,GAAG,CAAC,CAAA;AAAA,OACvG;AAAA,IACF;AACA,IAAA,MAAM,KAAA,GAAS,MAAM,QAAA,CAAS,IAAA,EAAK;AACnC,IAAA,IAAI,OAAO,KAAA,CAAM,KAAA,KAAU,QAAA,IAAY,CAAC,MAAM,KAAA,EAAO;AACnD,MAAA,MAAM,IAAI,MAAM,iDAAiD,CAAA;AAAA,IACnE;AACA,IAAA,MAAM,SAAA,GAAY,eAAA,CAAgB,KAAA,CAAM,WAAW,CAAA;AACnD,IAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,SAAS,CAAA,EAAG;AAC/B,MAAA,MAAM,IAAI,MAAM,+DAA+D,CAAA;AAAA,IACjF;AACA,IAAA,MAAM,SAAS,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,eAAe,IAAI,MAAA,EAAO;AACrD,IAAA,MAAA,GAAS;AAAA,MACP,OAAO,KAAA,CAAM,KAAA;AAAA,MACb,SAAA,EAAW,IAAA,CAAK,GAAA,CAAI,GAAA,EAAI,EAAG,SAAA,GAAY,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,eAAe,CAAA,GAAI,MAAM;AAAA,KAC9E;AACA,IAAA,OAAO,KAAA,CAAM,KAAA;AAAA,EACf,CAAA;AAEA,EAAA,OAAO,YAAY;AACjB,IAAA,IAAI,UAAU,GAAA,EAAI,GAAI,MAAA,CAAO,SAAA,SAAkB,MAAA,CAAO,KAAA;AACtD,IAAA,UAAA,KAAe,OAAA,EAAQ,CAAE,OAAA,CAAQ,MAAM;AACrC,MAAA,UAAA,GAAa,MAAA;AAAA,IACf,CAAC,CAAA;AACD,IAAA,OAAO,UAAA;AAAA,EACT,CAAA;AACF;AAEA,SAAS,gBAAgB,KAAA,EAAwB;AAC/C,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,IAAA,OAAO,KAAA,GAAQ,IAAA,GAAoB,KAAA,GAAQ,GAAA,GAAQ,KAAA;AAAA,EACrD;AACA,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU,OAAO,IAAI,IAAA,CAAK,KAAK,EAAE,OAAA,EAAQ;AAC9D,EAAA,OAAO,MAAA,CAAO,GAAA;AAChB;AA4CA,IAAM,cAAA,GAAN,cAA6B,YAAA,CAAa;AAAA,EAChC,OAAA;AAAA,EACA,WAAA;AAAA,EACA,MAAA,GAAS,KAAA;AAAA,EAET,mBAAmB,IAAA,EAAY;AACrC,IAAA,IAAA,CAAK,EAAA,CAAG,OAAA,EAAS,CAAC,KAAA,KAAU;AAC1B,MAAA,IAAA,CAAK,IAAA,CAAK,SAAS,KAAK,CAAA;AAAA,IAC1B,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,UAAA,CAAW,YAAwC,WAAA,EAAoC;AACrF,IAAA,IAAA,CAAK,WAAA,GAAc,WAAA,EAAY,CAC5B,IAAA,CAAK,CAAC,QAAA,KAAa;AAClB,MAAA,IAAI,CAAC,IAAA,CAAK,MAAA,OAAa,IAAA,CAAK,UAAA,CAAW,QAAQ,CAAC,CAAA;AAAA,IAClD,CAAC,CAAA,CACA,KAAA,CAAM,CAAC,KAAA,KAAU;AAChB,MAAA,IAAA,CAAK,IAAA,CAAK,OAAA,EAAS,KAAA,YAAiB,KAAA,GAAQ,KAAA,GAAQ,IAAI,KAAA,CAAM,MAAA,CAAO,KAAK,CAAC,CAAC,CAAA;AAC5E,MAAA,MAAM,KAAA;AAAA,IACR,CAAC,CAAA;AAAA,EACL;AAAA,EAEA,KAAK,IAAA,EAAY;AACf,IAAA,IAAI,KAAK,MAAA,EAAQ;AACf,MAAA,IAAA,CAAK,GAAA,EAAI,CAAE,KAAA,CAAM,MAAM,MAAS,CAAA;AAChC,MAAA;AAAA,IACF;AACA,IAAA,MAAM,WAAW,IAAA,CAAK,OAAA;AACtB,IAAA,IAAA,CAAK,OAAA,GAAU,IAAA;AACf,IAAA,IAAA,CAAK,mBAAmB,IAAI,CAAA;AAC5B,IAAA,IAAI,QAAA,EAAU;AACZ,MAAA,QAAA,CAAS,kBAAA,EAAmB;AAC5B,MAAA,QAAA,CAAS,GAAA,EAAI,CAAE,KAAA,CAAM,MAAM,MAAS,CAAA;AAAA,IACtC;AAAA,EACF;AAAA,EAEA,MAAc,iBAAA,GAAmC;AAC/C,IAAA,IAAI,IAAA,CAAK,WAAA,EAAa,MAAM,IAAA,CAAK,WAAA;AAAA,EACnC;AAAA,EAEA,SAAS,IAAA,EAAmD;AAC1D,IAAA,OAAO,IAAA,CAAK,iBAAA,EAAkB,CAAE,IAAA,CAAK,MAAM,KAAK,OAAA,CAAS,KAAA,CAAM,GAAG,IAAI,CAAC,CAAA;AAAA,EACzE;AAAA,EAEA,WAAW,IAAA,EAAqD;AAC9D,IAAA,OAAO,IAAA,CAAK,iBAAA,EAAkB,CAAE,IAAA,CAAK,MAAM,KAAK,OAAA,CAAS,OAAA,CAAQ,GAAG,IAAI,CAAC,CAAA;AAAA,EAC3E;AAAA,EAEA,GAAA,GAAqB;AACnB,IAAA,IAAA,CAAK,MAAA,GAAS,IAAA;AACd,IAAA,IAAA,CAAK,kBAAA,EAAmB;AACxB,IAAA,OAAO,IAAA,CAAK,OAAA,EAAS,GAAA,EAAI,IAAK,QAAQ,OAAA,EAAQ;AAAA,EAChD;AAAA,EAEA,IAAI,UAAA,GAAa;AACf,IAAA,OAAO,IAAA,CAAK,SAAS,UAAA,IAAc,CAAA;AAAA,EACrC;AAAA,EAEA,IAAI,SAAA,GAAY;AACd,IAAA,OAAO,IAAA,CAAK,SAAS,SAAA,IAAa,CAAA;AAAA,EACpC;AAAA,EAEA,IAAI,YAAA,GAAe;AACjB,IAAA,OAAO,IAAA,CAAK,SAAS,YAAA,IAAgB,CAAA;AAAA,EACvC;AACF,CAAA;AAGO,IAAM,2BAAN,MAA2D;AAAA,EACvD,IAAA,GAAO,qBAAA;AAAA,EACC,OAAA;AAAA,EACA,WAAA;AAAA,EACA,WAAA;AAAA,EACA,cAAA;AAAA,EACT,YAAA;AAAA,EAER,YAAY,OAAA,EAAkC;AAC5C,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AACf,IAAA,IAAA,CAAK,WAAA,GAAc,OAAA,CAAQ,WAAA,IAAe,kBAAA,EAAmB;AAC7D,IAAA,IAAA,CAAK,cAAA,GAAiB,IAAI,cAAA,EAAe;AACzC,IAAA,IAAI,OAAA,CAAQ,aAAa,MAAA,EAAW;AAClC,MAAA,IAAA,CAAK,WAAA,GAAc,YAAY,OAAA,CAAQ,QAAA;AACvC,MAAA,IAAA,CAAK,eAAe,IAAA,CAAK,IAAA,CAAK,UAAA,CAAW,OAAA,CAAQ,QAAQ,CAAC,CAAA;AAAA,IAC5D,CAAA,MAAO;AACL,MAAA,IAAI,CAAC,QAAQ,KAAA,IAAS,CAAC,QAAQ,aAAA,IAAiB,CAAC,QAAQ,QAAA,EAAU;AACjE,QAAA,MAAM,IAAI,KAAA;AAAA,UACR;AAAA,SACF;AAAA,MACF;AACA,MAAA,IAAA,CAAK,cAAc,0BAAA,CAA2B;AAAA,QAC5C,eAAe,OAAA,CAAQ,aAAA;AAAA,QACvB,UAAU,OAAA,CAAQ,QAAA;AAAA,QAClB,OAAO,OAAA,CAAQ,KAAA;AAAA,QACf,WAAW,OAAA,CAAQ;AAAA,OACpB,CAAA;AACD,MAAA,IAAA,CAAK,cAAA,CAAe,WAAW,CAAC,QAAA,KAAa,KAAK,UAAA,CAAW,QAAQ,CAAA,EAAG,IAAA,CAAK,WAAW,CAAA;AACxF,MAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,iBAAA,IAAqB,EAAA,GAAK,GAAA;AACrD,MAAA,IAAA,CAAK,YAAA,GAAe,YAAY,MAAM;AACpC,QAAA,KAAK,KAAK,WAAA,EAAY;AAAA,MACxB,GAAG,UAAU,CAAA;AAAA,IACf;AAAA,EACF;AAAA,EAEQ,WAAW,QAAA,EAAyB;AAC1C,IAAA,OAAO,KAAK,WAAA,CAAY;AAAA,MACtB,IAAA,EAAM,KAAK,OAAA,CAAQ,IAAA;AAAA,MACnB,IAAA,EAAM,IAAA,CAAK,OAAA,CAAQ,IAAA,IAAQ,IAAA;AAAA,MAC3B,QAAA,EAAU,KAAK,OAAA,CAAQ,QAAA;AAAA,MACvB,IAAA,EAAM,KAAK,OAAA,CAAQ,IAAA;AAAA,MACnB,QAAA;AAAA,MACA,KAAK,IAAA,CAAK,OAAA,CAAQ,GAAA,IAAO,EAAE,oBAAoB,IAAA,EAAK;AAAA,MACpD,GAAA,EAAK,IAAA,CAAK,OAAA,CAAQ,GAAA,IAAO,MAAA,CAAO,SAAS,OAAA,CAAQ,GAAA,CAAI,WAAA,IAAe,GAAA,EAAK,EAAE,CAAA;AAAA,MAC3E,iBAAA,EAAmB,IAAA,CAAK,OAAA,CAAQ,iBAAA,IAAqB,GAAA;AAAA,MACrD,uBAAA,EAAyB,IAAA,CAAK,OAAA,CAAQ,uBAAA,IAA2B;AAAA,KAClE,CAAA;AAAA,EACH;AAAA,EAEA,MAAc,WAAA,GAA6B;AACzC,IAAA,IAAI;AACF,MAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,WAAA,EAAY;AACxC,MAAA,MAAM,IAAA,GAAO,IAAA,CAAK,UAAA,CAAW,QAAQ,CAAA;AACrC,MAAA,IAAA,CAAK,cAAA,CAAe,KAAK,IAAI,CAAA;AAAA,IAC/B,SAAS,KAAA,EAAO;AACd,MAAA,IAAA,CAAK,cAAA,CAAe,IAAA,CAAK,OAAA,EAAS,KAAA,YAAiB,KAAA,GAAQ,KAAA,GAAQ,IAAI,KAAA,CAAM,MAAA,CAAO,KAAK,CAAC,CAAC,CAAA;AAAA,IAC7F;AAAA,EACF;AAAA,EAEA,OAAA,GAAgB;AACd,IAAA,OAAO,IAAA,CAAK,cAAA;AAAA,EACd;AAAA,EAEA,MAAM,KAAA,GAAuB;AAC3B,IAAA,IAAI,KAAK,YAAA,EAAc;AACrB,MAAA,aAAA,CAAc,KAAK,YAAY,CAAA;AAC/B,MAAA,IAAA,CAAK,YAAA,GAAe,MAAA;AAAA,IACtB;AACA,IAAA,MAAM,IAAA,CAAK,eAAe,GAAA,EAAI;AAAA,EAChC;AACF,CAAA;AAEA,SAAS,kBAAA,GAA0C;AACjD,EAAA,OAAO,CAAC,MAAA,KAAW,IAAIA,IAAAA,CAAK,MAAM,CAAA;AACpC;;;ACpWA,IAAI,QAAA,GAAoC,IAAA;AAExC,SAAS,cAAA,GAAmC;AAC1C,EAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,GAAA,CAAI,iBAAA,IAAqB,MAAA;AAE9C,EAAA,IAAI,SAAS,qBAAA,EAAuB;AAClC,IAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,GAAA,CAAI,wBAAA,EAA0B,IAAA,EAAK;AACxD,IAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,GAAA,CAAI,4BAAA,EAA8B,MAAK,IAAK,qBAAA;AACrE,IAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,GAAA,CAAI,wBAAA,EAA0B,IAAA,EAAK;AACxD,IAAA,MAAM,aAAA,GAAgB,OAAA,CAAQ,GAAA,CAAI,eAAA,EAAiB,IAAA,EAAK;AACxD,IAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,GAAA,CAAI,4BAAA,EAA8B,IAAA,EAAK;AAChE,IAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,GAAA,CAAI,4BAAA,EAA8B,IAAA,EAAK;AAEhE,IAAA,IAAI,CAAC,IAAA,EAAM;AACT,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AACA,IAAA,IAAI,CAAC,IAAA,EAAM;AACT,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAEA,IAAA,IAAI,QAAA,EAAU;AACZ,MAAA,OAAO,IAAI,wBAAA,CAAyB,EAAE,MAAM,QAAA,EAAU,IAAA,EAAM,UAAU,CAAA;AAAA,IACxE;AAEA,IAAA,IAAI,CAAC,aAAA,IAAiB,CAAC,QAAA,EAAU;AAC/B,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAEA,IAAA,MAAM,SAAA,GAAY,0BAAA,CAA2B,OAAA,CAAQ,GAAG,CAAA;AACxD,IAAA,OAAO,IAAI,wBAAA,CAAyB;AAAA,MAClC,IAAA;AAAA,MACA,QAAA;AAAA,MACA,IAAA;AAAA,MACA,aAAA;AAAA,MACA,QAAA;AAAA,MACA,KAAA,EAAO,mBAAmB,SAAS;AAAA,KACpC,CAAA;AAAA,EACH;AAEA,EAAA,MAAM,gBAAA,GAAmB,QAAQ,GAAA,CAAI,YAAA;AACrC,EAAA,IAAI,CAAC,gBAAA,EAAkB;AACrB,IAAA,MAAM,IAAI,MAAM,0BAA0B,CAAA;AAAA,EAC5C;AACA,EAAA,OAAO,IAAI,oBAAA,CAAqB,EAAE,gBAAA,EAAkB,CAAA;AACtD;AAcO,SAAS,OAAA,GAAgB;AAC9B,EAAA,IAAI,CAAC,QAAA,EAAU;AACb,IAAA,QAAA,GAAW,cAAA,EAAe;AAAA,EAC5B;AACA,EAAA,OAAO,SAAS,OAAA,EAAQ;AAC1B;AAGA,eAAsB,SAAA,GAA2B;AAC/C,EAAA,MAAM,UAAU,KAAA,EAAM;AACtB,EAAA,QAAA,GAAW,IAAA;AACb;AAGO,SAAS,iBAAA,GAA0B;AACxC,EAAA,QAAA,GAAW,IAAA;AACb;AAGO,SAAS,WAAA,GAAgC;AAC9C,EAAA,IAAI,CAAC,QAAA,EAAU;AACb,IAAA,QAAA,GAAW,cAAA,EAAe;AAAA,EAC5B;AACA,EAAA,OAAO,QAAA;AACT;AASA,SAAS,iBAAiB,SAAA,EAAyC;AACjE,EAAA,MAAM,MAAM,SAAA,CAAU,QAAA;AACtB,EAAA,MAAM,aAAA,GAAgB,GAAA,CAAI,GAAA,CAAI,2BAA2B,CAAA;AACzD,EAAA,IAAI,aAAA,EAAe;AACjB,IAAA,OAAO;AAAA,MACL,KAAA,EAAO,aAAA;AAAA,MACP,IAAA,EAAM,GAAA,CAAI,GAAA,CAAI,0BAA0B,CAAA;AAAA,MACxC,OAAA,EAAS,GAAA,CAAI,GAAA,CAAI,6BAA6B,CAAA;AAAA,MAC9C,MAAA,EAAQ,GAAA,CAAI,GAAA,CAAI,4BAA4B;AAAA,KAC9C;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,KAAA,EAAO,SAAA,CAAU,KAAA,CAAM,2BAAA,EAA6B,+BAA+B,CAAA;AAAA,IACnF,IAAA,EAAM,SAAA,CAAU,KAAA,CAAM,0BAAA,EAA4B,8BAA8B,CAAA;AAAA,IAChF,OAAA,EAAS,SAAA,CAAU,KAAA,CAAM,6BAAA,EAA+B,6BAA6B,CAAA;AAAA,IACrF,QAAQ,SAAA,CAAU,KAAA;AAAA,MAChB,4BAAA;AAAA,MACA;AAAA;AACF,GACF;AACF;AAGO,SAAS,iBAAA,CAAkB,WAA6B,YAAA,EAA2B;AACxF,EAAA,MAAM,CAAA,GAAI,gBAAgB,OAAA,EAAQ;AAClC,EAAA,MAAM,KAAA,GAAS,EAAwC,UAAA,IAAc,CAAA;AACrE,EAAA,MAAM,IAAA,GAAO,EAAE,SAAA,IAAa,CAAA;AAC5B,EAAA,MAAM,OAAA,GAAU,EAAE,YAAA,IAAgB,CAAA;AAElC,EAAA,MAAM,MAAA,GAAS,iBAAiB,SAAS,CAAA;AACzC,EAAA,MAAA,CAAO,KAAA,CAAM,GAAA,CAAI,EAAC,EAAG,KAAK,CAAA;AAC1B,EAAA,MAAA,CAAO,IAAA,CAAK,GAAA,CAAI,EAAC,EAAG,IAAI,CAAA;AACxB,EAAA,MAAA,CAAO,OAAA,CAAQ,GAAA,CAAI,EAAC,EAAG,OAAO,CAAA;AAC9B,EAAA,MAAA,CAAO,MAAA,CAAO,IAAI,EAAC,EAAG,KAAK,GAAA,CAAI,CAAA,EAAG,KAAA,GAAQ,IAAI,CAAC,CAAA;AACjD;AAOO,SAAS,mBAAA,CACd,SAAA,EACA,YAAA,EACA,UAAA,GAAa,GAAA,EACD;AACZ,EAAA,iBAAA,CAAkB,WAAW,YAAY,CAAA;AAEzC,EAAA,MAAM,QAAA,GAAW,YAAY,MAAM;AACjC,IAAA,iBAAA,CAAkB,WAAW,YAAY,CAAA;AAAA,EAC3C,GAAG,UAAU,CAAA;AAEb,EAAA,OAAO,MAAM,cAAc,QAAQ,CAAA;AACrC","file":"index.js","sourcesContent":["import { Pool } from 'pg';\nimport type { DatabaseProvider } from './types.js';\n\nexport interface NeonProviderOptions {\n  connectionString: string;\n  max?: number;\n  idleTimeoutMillis?: number;\n  connectionTimeoutMillis?: number;\n}\n\n/** Standard Postgres provider using a static connection string. */\nexport class NeonDatabaseProvider implements DatabaseProvider {\n  readonly kind = 'neon' as const;\n  private readonly pool: Pool;\n\n  constructor(options: NeonProviderOptions) {\n    this.pool = new Pool({\n      connectionString: options.connectionString,\n      max: options.max ?? Number.parseInt(process.env.PG_POOL_MAX ?? '5', 10),\n      idleTimeoutMillis: options.idleTimeoutMillis ?? 30_000,\n      connectionTimeoutMillis: options.connectionTimeoutMillis ?? 5_000,\n    });\n  }\n\n  getPool(): Pool {\n    return this.pool;\n  }\n\n  async close(): Promise<void> {\n    await this.pool.end();\n  }\n}\n","import { EventEmitter } from 'node:events';\nimport { Pool } from 'pg';\nimport type { DatabaseProvider } from './types.js';\n\n/** A resolver that returns a valid Databricks workspace OAuth token. */\nexport type DatabricksTokenProvider = () => Promise<string>;\n\n/** Supported Databricks authentication shapes. */\nexport type DatabricksPrincipal =\n  | { kind: 'pat'; token: string }\n  | {\n      kind: 'service-principal';\n      host: string;\n      clientId: string;\n      clientSecret: string;\n      scope?: string;\n      refreshSkewSeconds?: number;\n    };\n\n/** Resolve a PAT or OAuth M2M principal to a cached, auto-refreshing token provider. */\nexport function databricksIdentity(principal: DatabricksPrincipal): DatabricksTokenProvider {\n  if (principal.kind === 'pat') {\n    const { token } = principal;\n    return async () => token;\n  }\n  return servicePrincipalProvider(principal);\n}\n\n/** Build a principal from environment variables. */\nexport function databricksPrincipalFromEnv(\n  env: Record<string, string | undefined> = typeof process !== 'undefined' ? process.env : {},\n): Extract<DatabricksPrincipal, { kind: 'pat' | 'service-principal' }> {\n  const token = env.DATABRICKS_TOKEN?.trim();\n  if (token) return { kind: 'pat', token };\n\n  const clientId = env.DATABRICKS_CLIENT_ID?.trim();\n  const clientSecret = env.DATABRICKS_CLIENT_SECRET?.trim();\n  const host = env.DATABRICKS_HOST?.trim();\n  if (clientId && clientSecret) {\n    if (!host) throw new Error('Missing DATABRICKS_HOST for Databricks OAuth M2M.');\n    return {\n      kind: 'service-principal',\n      host,\n      clientId,\n      clientSecret,\n      scope: env.DATABRICKS_SCOPE,\n      refreshSkewSeconds: env.DATABRICKS_REFRESH_SKEW_SECONDS\n        ? Number.parseInt(env.DATABRICKS_REFRESH_SKEW_SECONDS, 10)\n        : undefined,\n    };\n  }\n  throw new Error(\n    'Missing Databricks credentials: DATABRICKS_TOKEN or DATABRICKS_CLIENT_ID+DATABRICKS_CLIENT_SECRET.',\n  );\n}\n\ninterface CachedToken {\n  token: string;\n  refreshAtMs: number;\n}\n\nfunction servicePrincipalProvider(\n  principal: Extract<DatabricksPrincipal, { kind: 'service-principal' }>,\n): DatabricksTokenProvider {\n  const host = principal.host.replace(/\\/$/, '');\n  const scope = principal.scope ?? 'all-apis';\n  const refreshSkewMs = (principal.refreshSkewSeconds ?? 60) * 1_000;\n  let cached: CachedToken | undefined;\n  let refreshing: Promise<string> | undefined;\n\n  const refresh = async (): Promise<string> => {\n    const response = await fetch(`${host}/oidc/v1/token`, {\n      method: 'POST',\n      headers: {\n        authorization: `Basic ${Buffer.from(`${principal.clientId}:${principal.clientSecret}`).toString('base64')}`,\n        'content-type': 'application/x-www-form-urlencoded',\n      },\n      body: new URLSearchParams({ grant_type: 'client_credentials', scope }),\n    });\n    if (!response.ok) {\n      const text = await response.text();\n      throw new Error(\n        `Databricks OAuth token exchange failed: ${response.status} ${response.statusText}: ${text.slice(0, 500)}`,\n      );\n    }\n    const value = (await response.json()) as { access_token?: unknown; expires_in?: unknown };\n    const token = typeof value.access_token === 'string' ? value.access_token : undefined;\n    if (!token) throw new Error('Databricks OAuth token exchange returned no access_token.');\n    const expiresInSeconds = typeof value.expires_in === 'number' ? value.expires_in : 3_600;\n    const expiresAtMs = Date.now() + expiresInSeconds * 1_000;\n    cached = { token, refreshAtMs: expiresAtMs - refreshSkewMs };\n    return token;\n  };\n\n  return async () => {\n    if (cached && Date.now() < cached.refreshAtMs) return cached.token;\n    refreshing ??= refresh().finally(() => {\n      refreshing = undefined;\n    });\n    return refreshing;\n  };\n}\n\nexport interface LakebaseCredentialProviderOptions {\n  workspaceHost: string;\n  endpoint: string;\n  token: string | DatabricksTokenProvider;\n  fetchImpl?: typeof fetch;\n  refreshBeforeMs?: number;\n  refreshJitterMs?: number;\n  now?: () => number;\n  random?: () => number;\n}\n\ninterface LakebaseCredentialResponse {\n  token?: unknown;\n  expire_time?: unknown;\n}\n\n/** Exchange a workspace OAuth token for a Lakebase database credential. Caches, refreshes early, single-flight. */\nexport function lakebaseCredentialProvider(\n  options: LakebaseCredentialProviderOptions,\n): () => Promise<string> {\n  const workspaceHost = options.workspaceHost.replace(/\\/$/, '');\n  const fetchImpl = options.fetchImpl ?? fetch;\n  const now = options.now ?? Date.now;\n  const random = options.random ?? Math.random;\n  const refreshBeforeMs = options.refreshBeforeMs ?? 5 * 60_000;\n  const refreshJitterMs = options.refreshJitterMs ?? 30_000;\n  let cached: { token: string; refreshAt: number } | undefined;\n  let refreshing: Promise<string> | undefined;\n\n  const refresh = async (): Promise<string> => {\n    const workspaceToken =\n      typeof options.token === 'function' ? await options.token() : options.token;\n    const response = await fetchImpl(`${workspaceHost}/api/2.0/postgres/credentials`, {\n      method: 'POST',\n      headers: {\n        authorization: `Bearer ${workspaceToken}`,\n        'content-type': 'application/json',\n      },\n      body: JSON.stringify({ endpoint: options.endpoint }),\n    });\n    if (!response.ok) {\n      const text = await response.text();\n      throw new Error(\n        `Lakebase credential exchange failed: ${response.status} ${response.statusText}: ${text.slice(0, 500)}`,\n      );\n    }\n    const value = (await response.json()) as LakebaseCredentialResponse;\n    if (typeof value.token !== 'string' || !value.token) {\n      throw new Error('Lakebase credential exchange returned no token.');\n    }\n    const expiresAt = parseExpireTime(value.expire_time);\n    if (!Number.isFinite(expiresAt)) {\n      throw new Error('Lakebase credential exchange returned an invalid expire_time.');\n    }\n    const jitter = Math.max(0, refreshJitterMs) * random();\n    cached = {\n      token: value.token,\n      refreshAt: Math.max(now(), expiresAt - Math.max(0, refreshBeforeMs) - jitter),\n    };\n    return value.token;\n  };\n\n  return async () => {\n    if (cached && now() < cached.refreshAt) return cached.token;\n    refreshing ??= refresh().finally(() => {\n      refreshing = undefined;\n    });\n    return refreshing;\n  };\n}\n\nfunction parseExpireTime(value: unknown): number {\n  if (typeof value === 'number') {\n    return value < 1_000_000_000_000 ? value * 1_000 : value;\n  }\n  if (typeof value === 'string') return new Date(value).getTime();\n  return Number.NaN;\n}\n\nexport interface LakebasePoolConfig {\n  host: string;\n  port: number;\n  database: string;\n  user: string;\n  password?: string;\n  ssl?: boolean | { rejectUnauthorized?: boolean };\n  max?: number;\n  idleTimeoutMillis?: number;\n  connectionTimeoutMillis?: number;\n}\n\nexport type LakebasePoolFactory = (config: LakebasePoolConfig) => Pool;\n\nexport interface LakebaseProviderOptions {\n  /** Direct endpoint host from list-endpoints (NOT the pooled host). */\n  host: string;\n  port?: number;\n  database: string;\n  user: string;\n  /** Static database password. If omitted, OAuth exchange is required. */\n  password?: string;\n  /** Workspace URL, e.g. https://adb-....azuredatabricks.net */\n  workspaceHost?: string;\n  /** Full endpoint resource name: projects/.../branches/.../endpoints/... */\n  endpoint?: string;\n  /** Workspace OAuth token or provider. */\n  token?: string | DatabricksTokenProvider;\n  fetchImpl?: typeof fetch;\n  ssl?: boolean | { rejectUnauthorized?: boolean };\n  max?: number;\n  idleTimeoutMillis?: number;\n  connectionTimeoutMillis?: number;\n  /** How often to refresh the credential and recreate the pool. Default 50 minutes. */\n  refreshIntervalMs?: number;\n  /** Injected pool factory for tests. */\n  poolFactory?: LakebasePoolFactory;\n  /** Observe recoverable idle pooled-connection failures. */\n  onPoolError?: (error: Error) => void;\n}\n\n/** A Pool-like facade that lazily initializes and always delegates to the current underlying pool. */\nclass DelegatingPool extends EventEmitter {\n  private current: Pool | undefined;\n  private initPromise: Promise<void> | undefined;\n  private closed = false;\n\n  private attachErrorHandler(pool: Pool) {\n    pool.on('error', (error) => {\n      this.emit('error', error);\n    });\n  }\n\n  initialize(createPool: (password: string) => Pool, getPassword: () => Promise<string>) {\n    this.initPromise = getPassword()\n      .then((password) => {\n        if (!this.closed) this.swap(createPool(password));\n      })\n      .catch((error) => {\n        this.emit('error', error instanceof Error ? error : new Error(String(error)));\n        throw error;\n      });\n  }\n\n  swap(pool: Pool) {\n    if (this.closed) {\n      pool.end().catch(() => undefined);\n      return;\n    }\n    const previous = this.current;\n    this.current = pool;\n    this.attachErrorHandler(pool);\n    if (previous) {\n      previous.removeAllListeners();\n      previous.end().catch(() => undefined);\n    }\n  }\n\n  private async ensureInitialized(): Promise<void> {\n    if (this.initPromise) await this.initPromise;\n  }\n\n  query(...args: Parameters<Pool['query']>): Promise<unknown> {\n    return this.ensureInitialized().then(() => this.current!.query(...args));\n  }\n\n  connect(...args: Parameters<Pool['connect']>): Promise<unknown> {\n    return this.ensureInitialized().then(() => this.current!.connect(...args));\n  }\n\n  end(): Promise<void> {\n    this.closed = true;\n    this.removeAllListeners();\n    return this.current?.end() ?? Promise.resolve();\n  }\n\n  get totalCount() {\n    return this.current?.totalCount ?? 0;\n  }\n\n  get idleCount() {\n    return this.current?.idleCount ?? 0;\n  }\n\n  get waitingCount() {\n    return this.current?.waitingCount ?? 0;\n  }\n}\n\n/** Databricks Lakebase Postgres provider with credential refresh. */\nexport class LakebaseDatabaseProvider implements DatabaseProvider {\n  readonly kind = 'databricks-lakebase' as const;\n  private readonly options: LakebaseProviderOptions;\n  private readonly poolFactory: LakebasePoolFactory;\n  private readonly getPassword: () => Promise<string>;\n  private readonly delegatingPool: DelegatingPool;\n  private refreshTimer: NodeJS.Timeout | undefined;\n\n  constructor(options: LakebaseProviderOptions) {\n    this.options = options;\n    this.poolFactory = options.poolFactory ?? defaultPoolFactory();\n    this.delegatingPool = new DelegatingPool();\n    if (options.password !== undefined) {\n      this.getPassword = async () => options.password as string;\n      this.delegatingPool.swap(this.createPool(options.password));\n    } else {\n      if (!options.token || !options.workspaceHost || !options.endpoint) {\n        throw new Error(\n          'Lakebase OAuth requires token, workspaceHost, and endpoint. A workspace token cannot be used directly as the Postgres password.',\n        );\n      }\n      this.getPassword = lakebaseCredentialProvider({\n        workspaceHost: options.workspaceHost,\n        endpoint: options.endpoint,\n        token: options.token,\n        fetchImpl: options.fetchImpl,\n      });\n      this.delegatingPool.initialize((password) => this.createPool(password), this.getPassword);\n      const intervalMs = options.refreshIntervalMs ?? 50 * 60_000;\n      this.refreshTimer = setInterval(() => {\n        void this.refreshPool();\n      }, intervalMs);\n    }\n  }\n\n  private createPool(password?: string): Pool {\n    return this.poolFactory({\n      host: this.options.host,\n      port: this.options.port ?? 5432,\n      database: this.options.database,\n      user: this.options.user,\n      password,\n      ssl: this.options.ssl ?? { rejectUnauthorized: true },\n      max: this.options.max ?? Number.parseInt(process.env.PG_POOL_MAX ?? '5', 10),\n      idleTimeoutMillis: this.options.idleTimeoutMillis ?? 30_000,\n      connectionTimeoutMillis: this.options.connectionTimeoutMillis ?? 5_000,\n    });\n  }\n\n  private async refreshPool(): Promise<void> {\n    try {\n      const password = await this.getPassword();\n      const pool = this.createPool(password);\n      this.delegatingPool.swap(pool);\n    } catch (error) {\n      this.delegatingPool.emit('error', error instanceof Error ? error : new Error(String(error)));\n    }\n  }\n\n  getPool(): Pool {\n    return this.delegatingPool as unknown as Pool;\n  }\n\n  async close(): Promise<void> {\n    if (this.refreshTimer) {\n      clearInterval(this.refreshTimer);\n      this.refreshTimer = undefined;\n    }\n    await this.delegatingPool.end();\n  }\n}\n\nfunction defaultPoolFactory(): LakebasePoolFactory {\n  return (config) => new Pool(config);\n}\n","import type { Gauge, MetricsCollector } from '@fabricorg/experiments-metrics';\nimport type { Pool } from 'pg';\nimport {\n  type DatabaseProvider,\n  LakebaseDatabaseProvider,\n  NeonDatabaseProvider,\n  databricksIdentity,\n  databricksPrincipalFromEnv,\n} from './providers/index.js';\n\nlet provider: DatabaseProvider | null = null;\n\nfunction createProvider(): DatabaseProvider {\n  const kind = process.env.DATABASE_PROVIDER ?? 'neon';\n\n  if (kind === 'databricks-lakebase') {\n    const host = process.env.DATABRICKS_LAKEBASE_HOST?.trim();\n    const database = process.env.DATABRICKS_LAKEBASE_DATABASE?.trim() ?? 'databricks_postgres';\n    const user = process.env.DATABRICKS_LAKEBASE_USER?.trim();\n    const workspaceHost = process.env.DATABRICKS_HOST?.trim();\n    const endpoint = process.env.DATABRICKS_LAKEBASE_ENDPOINT?.trim();\n    const password = process.env.DATABRICKS_LAKEBASE_PASSWORD?.trim();\n\n    if (!host) {\n      throw new Error(\n        'DATABRICKS_LAKEBASE_HOST is required when DATABASE_PROVIDER=databricks-lakebase',\n      );\n    }\n    if (!user) {\n      throw new Error(\n        'DATABRICKS_LAKEBASE_USER is required when DATABASE_PROVIDER=databricks-lakebase',\n      );\n    }\n\n    if (password) {\n      return new LakebaseDatabaseProvider({ host, database, user, password });\n    }\n\n    if (!workspaceHost || !endpoint) {\n      throw new Error(\n        'DATABRICKS_HOST and DATABRICKS_LAKEBASE_ENDPOINT are required for Lakebase OAuth, or provide DATABRICKS_LAKEBASE_PASSWORD for native auth.',\n      );\n    }\n\n    const principal = databricksPrincipalFromEnv(process.env);\n    return new LakebaseDatabaseProvider({\n      host,\n      database,\n      user,\n      workspaceHost,\n      endpoint,\n      token: databricksIdentity(principal),\n    });\n  }\n\n  const connectionString = process.env.DATABASE_URL;\n  if (!connectionString) {\n    throw new Error('DATABASE_URL is required');\n  }\n  return new NeonDatabaseProvider({ connectionString });\n}\n\n/**\n * Return a singleton `pg.Pool` configured for the active database provider.\n *\n * Provider selection:\n * - `DATABASE_PROVIDER=neon` (default): uses `DATABASE_URL`.\n * - `DATABASE_PROVIDER=databricks-lakebase`: uses Lakebase OAuth credentials.\n *\n * On the first call, a new Pool is created with the following defaults:\n * - `max`: parseInt(process.env.PG_POOL_MAX ?? '5') — caps concurrent connections.\n * - `idleTimeoutMillis`: 30000 — recycle idle connections before Vercel's 60s timeout.\n * - `connectionTimeoutMillis`: 5000 — fail fast when the database is unreachable.\n */\nexport function getPool(): Pool {\n  if (!provider) {\n    provider = createProvider();\n  }\n  return provider.getPool();\n}\n\n/** Close the active provider and any background refresh loops. */\nexport async function closePool(): Promise<void> {\n  await provider?.close();\n  provider = null;\n}\n\n/** Reset the singleton provider. Intended for tests. */\nexport function resetPoolProvider(): void {\n  provider = null;\n}\n\n/** Return the active provider, or create it. */\nexport function getProvider(): DatabaseProvider {\n  if (!provider) {\n    provider = createProvider();\n  }\n  return provider;\n}\n\ninterface PoolGauges {\n  total: Gauge;\n  idle: Gauge;\n  waiting: Gauge;\n  active: Gauge;\n}\n\nfunction ensurePoolGauges(collector: MetricsCollector): PoolGauges {\n  const reg = collector.registry;\n  const existingTotal = reg.get('db_pool_connections_total');\n  if (existingTotal) {\n    return {\n      total: existingTotal as Gauge,\n      idle: reg.get('db_pool_connections_idle') as Gauge,\n      waiting: reg.get('db_pool_connections_waiting') as Gauge,\n      active: reg.get('db_pool_connections_active') as Gauge,\n    };\n  }\n\n  return {\n    total: collector.gauge('db_pool_connections_total', 'Total connections in the pool'),\n    idle: collector.gauge('db_pool_connections_idle', 'Idle connections in the pool'),\n    waiting: collector.gauge('db_pool_connections_waiting', 'Waiting clients in the pool'),\n    active: collector.gauge(\n      'db_pool_connections_active',\n      'Active (non-idle) connections in the pool',\n    ),\n  };\n}\n\n/** Update pool gauge values from the current pool state. */\nexport function updatePoolMetrics(collector: MetricsCollector, poolInstance?: Pool): void {\n  const p = poolInstance ?? getPool();\n  const total = (p as unknown as { totalCount: number }).totalCount ?? 0;\n  const idle = p.idleCount ?? 0;\n  const waiting = p.waitingCount ?? 0;\n\n  const gauges = ensurePoolGauges(collector);\n  gauges.total.set({}, total);\n  gauges.idle.set({}, idle);\n  gauges.waiting.set({}, waiting);\n  gauges.active.set({}, Math.max(0, total - idle));\n}\n\n/**\n * Register pool metrics with the given collector.\n *\n * Returns a cleanup function that stops the update interval.\n */\nexport function registerPoolMetrics(\n  collector: MetricsCollector,\n  poolInstance?: Pool,\n  intervalMs = 5000,\n): () => void {\n  updatePoolMetrics(collector, poolInstance);\n\n  const interval = setInterval(() => {\n    updatePoolMetrics(collector, poolInstance);\n  }, intervalMs);\n\n  return () => clearInterval(interval);\n}\n"]}

package/package.json

@@ -0,0 +1,43 @@
+{
+  "name": "@fabricorg/experiments-db-pool",
+  "version": "0.1.0",
+  "description": "Singleton pg.Pool for serverless runtimes.",
+  "license": "MIT",
+  "type": "module",
+  "sideEffects": false,
+  "main": "./dist/index.cjs",
+  "types": "./dist/index.d.ts",
+  "module": "./dist/index.js",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.js"
+      },
+      "require": {
+        "types": "./dist/index.d.cts",
+        "default": "./dist/index.cjs"
+      }
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "dependencies": {
+    "pg": "^8.13.0",
+    "@fabricorg/experiments-metrics": "0.0.1"
+  },
+  "devDependencies": {
+    "@types/node": "^22.15.3",
+    "@types/pg": "^8.11.10",
+    "tsup": "^8.3.5",
+    "typescript": "^5.8.3",
+    "vitest": "^2.1.8"
+  },
+  "scripts": {
+    "build": "tsup",
+    "type-check": "tsc --noEmit",
+    "test": "vitest run",
+    "clean": "rm -rf dist"
+  }
+}