feat: make cloud provider packages optional

[tianzhou]

Summary

• Move @aws-sdk/rds-signer and @azure/identity from dependencies to optionalDependencies
• Switch static imports to dynamic import() so packages are only loaded when AWS IAM or Azure AD auth is used
• Add both to tsup external list to prevent bundling CJS into ESM (same pattern as database drivers in Fix: externalize database drivers to prevent dynamic require error #291)

Closes #295

Test plan

• pnpm run build:backend succeeds
• pnpm test:build smoke test passes
• pnpm test:unit passes (including aws-rds-signer tests)
• Verified smoke test catches missing externals for database drivers (cloud packages are ESM-native so don't trigger CJS errors, but externalization still prevents bundling ~1MB of SDK code)

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR makes AWS/Azure cloud auth SDKs optional at runtime by moving them to optionalDependencies, switching to dynamic import() so they’re only loaded when needed, and ensuring the bundler doesn’t inline them into the ESM build.

Changes:

• Move @aws-sdk/rds-signer and @azure/identity from dependencies to optionalDependencies.
• Replace static imports with dynamic import() in the AWS RDS signer helper and SQL Server Azure AD auth path.
• Add both packages to tsup’s external list to avoid bundling them.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File	Description
tsup.config.ts	Externalizes cloud auth SDK packages in the backend bundle.
src/utils/aws-rds-signer.ts	Lazily loads @aws-sdk/rds-signer at call time.
src/connectors/sqlserver/index.ts	Lazily loads @azure/identity only when Azure AD auth is selected.
package.json	Makes cloud auth SDKs optional dependencies.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 5 comments.

Comments suppressed due to low confidence (1)

src/connectors/sqlserver/index.ts:110

• DefaultAzureCredential.getToken() can return null when no token could be acquired. Accessing token.token will then throw a non-obvious runtime error. Handle the null case explicitly and throw a clearer error (or include context about Azure credential resolution).

            }
            const credential = new DefaultAzureCredential();
            const token = await credential.getToken("https://database.windows.net/");
            config.authentication = {
              type: "azure-active-directory-access-token",
              options: {
                token: token.token,

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (1)

src/connectors/sqlserver/index.ts:120

• The missing-package error thrown in the inner catch (importError) is immediately caught by the outer catch and wrapped as Failed to get Azure AD token: .... When @azure/identity is missing this prefix is misleading (it’s not a token failure). Consider letting the actionable install error bubble up unchanged (e.g., rethrow without wrapping when it’s already an install/missing-dep error).

            } catch (importError) {
              if (isDriverNotInstalled(importError, "@azure/identity")) {
                throw new Error(
                  'Azure AD authentication requires the "@azure/identity" package. Install it with: pnpm add @azure/identity'
                );
              }
              throw importError;
            }
            const credential = new DefaultAzureCredential();
            const token = await credential.getToken("https://database.windows.net/");
            config.authentication = {
              type: "azure-active-directory-access-token",
              options: {
                token: token.token,
              },
            };
          } catch (error: unknown) {
            const errorMessage = error instanceof Error ? error.message : String(error);
            throw new Error(`Failed to get Azure AD token: ${errorMessage}`);
          }

[Copilot]

This test file imports vi and beforeEach but never uses them, and the first it(...) is marked async without awaiting anything. Clean up unused imports / remove the unnecessary async to keep the test suite lint/tsc-friendly.

Suggested change

	import { describe, it, expect, vi, beforeEach } from 'vitest';
	import { isDriverNotInstalled } from '../module-loader.js';
	describe('generateRdsAuthToken missing package', () => {
	it('should throw actionable error when @aws-sdk/rds-signer is not installed', async () => {
	import { describe, it, expect } from 'vitest';
	import { isDriverNotInstalled } from '../module-loader.js';
	describe('generateRdsAuthToken missing package', () => {
	it('should throw actionable error when @aws-sdk/rds-signer is not installed', () => {

[Copilot]

The suite name suggests it’s validating generateRdsAuthToken behavior when @aws-sdk/rds-signer is missing, but the assertions only test isDriverNotInstalled(). This leaves the new user-facing error path in generateRdsAuthToken() untested. Consider either renaming the suite to match what’s tested or adding a test that forces the dynamic import("@aws-sdk/rds-signer") to fail and asserts the thrown install message.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.