Attach a customer database

Resolve the provider from stored config, prove the credential works, then introspect the schema after they connect.

A SaaS host typically stores a provider id and encrypted credentials per customer. When a request arrives, resolve the provider, prove the credential works, then discover the schema — not from a file you wrote.

customer.ts

123456789const db = await connect({
  provider: registry.resolve(
    customer.provider,
    customer.credentials,
  ),
});

await db.test();
return db.introspect();

Why test before you save

test() is the cheap proof that the credential works. Introspect after that so the UI — or a model — can see namespaces, tables or collections, and field names without shipping a schema file.

DB SDK never stores credentials. Encrypt them in the host, decrypt only on the server, and prefer a read-only database role from the customer.

Keep going

Pattern

Resolve a provider at runtime

Customer connections are a stored provider id plus credentials. A registry should open the handle without a compile-time switch.

Guide

Core idea

Connect, describe, and read a database whose schema you don't control at compile time — without turning every driver into SQL.

Reference

Read-only role checklist

What the host, the customer, and the SDK each own. Prefer a dedicated SELECT-only user or read-only IAM principal.