diff --git a/.github/workflows/release-lakebase.yml b/.github/workflows/release-lakebase.yml
new file mode 100644
index 00000000..352bf990
--- /dev/null
+++ b/.github/workflows/release-lakebase.yml
@@ -0,0 +1,69 @@
+name: Release @databricks/lakebase
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - 'packages/lakebase/**'
+  workflow_dispatch:
+    inputs:
+      dry-run:
+        description: "Dry run (no actual release)"
+        required: false
+        type: boolean
+        default: false
+
+jobs:
+  release:
+    runs-on:
+      group: databricks-protected-runner-group
+      labels: linux-ubuntu-latest
+
+    environment: release
+
+    env:
+      DRY_RUN: ${{ inputs.dry-run == true }}
+
+    permissions:
+      contents: write
+      id-token: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Setup Git
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          registry-url: "https://registry.npmjs.org"
+          cache: "pnpm"
+
+      - name: Update npm
+        run: npm install -g npm@latest
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Release
+        working-directory: packages/lakebase
+        run: |
+          if [ "$DRY_RUN" == "true" ]; then
+            pnpm release:dry
+          else
+            pnpm release:ci
+          fi
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 0ff58ac8..86547abd 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -20,6 +20,9 @@ jobs:
 
     environment: release
 
+    outputs:
+      version: ${{ steps.version.outputs.version }}
+
     permissions:
       contents: write
       id-token: write
@@ -61,6 +64,18 @@ jobs:
             echo "dry_run=${{ inputs.dry-run }}" >> $GITHUB_OUTPUT
           fi
 
+      - name: Determine version
+        id: version
+        if: steps.mode.outputs.dry_run != 'true'
+        run: |
+          VERSION=$(pnpm exec release-it --release-version --ci 2>/dev/null) || true
+          if [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "version=$VERSION" >> $GITHUB_OUTPUT
+            echo "Next version: $VERSION"
+          else
+            echo "No releasable version detected"
+          fi
+
       - name: Release
         run: |
           if [ "${{ steps.mode.outputs.dry_run }}" == "true" ]; then
@@ -70,3 +85,43 @@ jobs:
           fi
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  sync-template:
+    runs-on:
+      group: databricks-protected-runner-group
+      labels: linux-ubuntu-latest
+
+    needs: release
+    # in case a dry run is performed, the version is not set so we need to check for it.
+    if: needs.release.outputs.version != ''
+
+    permissions:
+      contents: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          ref: main
+          fetch-depth: 0
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Setup Git
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: "pnpm"
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Sync template and push tag
+        run: pnpm exec tsx tools/publish-template-tag.ts ${{ needs.release.outputs.version }}
diff --git a/.release-it.json b/.release-it.json
index 980cc513..b3a56377 100644
--- a/.release-it.json
+++ b/.release-it.json
@@ -3,15 +3,19 @@
   "git": {
     "commitMessage": "chore: release v${version} [skip ci]",
     "tagName": "v${version}",
+    "tagMatch": "v*",
     "tagAnnotation": "Release v${version}",
     "requireBranch": "main",
     "requireCleanWorkingDir": true,
+    "requireCommits": true,
+    "requireCommitsFail": false,
+    "commitsPath": "packages/appkit packages/appkit-ui packages/shared",
     "push": true,
     "pushArgs": ["--follow-tags"]
   },
   "github": {
     "release": true,
-    "releaseName": "v${version}",
+    "releaseName": "AppKit v${version}",
     "autoGenerate": false,
     "draft": false,
     "preRelease": false,
@@ -35,7 +39,13 @@
         "commitsSort": ["type", "subject"]
       },
       "infile": "CHANGELOG.md",
-      "header": "# Changelog\n\nAll notable changes to this project will be documented in this file."
+      "header": "# Changelog\n\nAll notable changes to this project will be documented in this file.",
+      "gitRawCommitsOpts": {
+        "path": ["packages/appkit", "packages/appkit-ui", "packages/shared"]
+      },
+      "commitsOpts": {
+        "path": ["packages/appkit", "packages/appkit-ui", "packages/shared"]
+      }
     }
   }
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
index f8531183..b6871d6d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,26 @@
 
 All notable changes to this project will be documented in this file.
 
+## [0.7.4](https://github.com/databricks/appkit/compare/v0.7.3...v0.7.4) (2026-02-18)
+
+* typegen command ([#119](https://github.com/databricks/appkit/issues/119)) ([8c3735c](https://github.com/databricks/appkit/commit/8c3735c6b27c5e5cbacb81363ccaf4f6acbfd185))
+
+## [0.7.3](https://github.com/databricks/appkit/compare/v0.7.2...v0.7.3) (2026-02-18)
+
+* release `@databricks/lakebase` correctly, fix `appkit` dependency ([#111](https://github.com/databricks/appkit/issues/111)) ([5b6856a](https://github.com/databricks/appkit/commit/5b6856a6b42680a671cfc3e99eab3bef72803fd1))
+
+## [0.7.2](https://github.com/databricks/appkit/compare/v0.7.1...v0.7.2) (2026-02-18)
+
+* template sync ([#109](https://github.com/databricks/appkit/issues/109)) ([f250016](https://github.com/databricks/appkit/commit/f250016b28e24e3ce56d09a0a3d95088a689a943))
+
+## [0.7.1](https://github.com/databricks/appkit/compare/v0.7.0...v0.7.1) (2026-02-18)
+
+* sync template versions on release ([#105](https://github.com/databricks/appkit/issues/105)) ([4cbe826](https://github.com/databricks/appkit/commit/4cbe8266e80e4b4cfe4b4e0594c2633dcba7123a))
+
+## [0.7.0](https://github.com/databricks/appkit/compare/v0.6.0...v0.7.0) (2026-02-17)
+
+* introduce Lakebase Autoscaling driver ([#98](https://github.com/databricks/appkit/issues/98)) ([27b1848](https://github.com/databricks/appkit/commit/27b184886b2ab15c73f3d46f5ff9e9c6d8806c71))
+
 ## [0.6.0](https://github.com/databricks/appkit/compare/v0.5.4...v0.6.0) (2026-02-16)
 
 ### appkit
diff --git a/CLAUDE.md b/CLAUDE.md
index 1f380700..9a17f870 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -233,6 +233,39 @@ The AnalyticsPlugin provides SQL query execution:
 - Built-in caching with configurable TTL
 - Databricks SQL Warehouse connector for execution
 
+### Lakebase Autoscaling Connector
+
+**Location:** `packages/appkit/src/connectors/lakebase/`
+
+AppKit provides `createLakebasePool()` - a factory function that returns a standard `pg.Pool` configured with automatic OAuth token refresh for Databricks Lakebase (OLTP) databases.
+
+**Key Features:**
+- Returns standard `pg.Pool` (compatible with all ORMs)
+- Automatic OAuth token refresh (1-hour tokens, 2-minute buffer)
+- Token caching to minimize API calls
+- Battle-tested pattern (same as AWS RDS IAM authentication)
+
+**Quick Example:**
+```typescript
+import { createLakebasePool } from '@databricks/appkit';
+
+// Reads from PGHOST, PGDATABASE, LAKEBASE_ENDPOINT env vars
+const pool = createLakebasePool();
+
+// Standard pg.Pool API
+const result = await pool.query('SELECT * FROM users');
+```
+
+**ORM Integration:**
+Works with Drizzle, Prisma, TypeORM - see [Lakebase Integration Docs](docs/docs/integrations/lakebase.md) for examples.
+
+**Architecture:**
+- Connector files: `packages/appkit/src/connectors/lakebase/`
+  - `pool.ts` - Pool factory with OAuth token refresh
+  - `types.ts` - TypeScript interfaces (`LakebasePoolConfig`)
+  - `utils.ts` - Helper functions (`generateDatabaseCredential`)
+  - `auth-types.ts` - Lakebase v2 API types
+
 ### Frontend-Backend Interaction
 
 ```
diff --git a/NOTICE.md b/NOTICE.md
index f1c83b4c..55513f1d 100644
--- a/NOTICE.md
+++ b/NOTICE.md
@@ -67,7 +67,7 @@ This Software contains code from the following open source projects:
 | [lucide-react](https://www.npmjs.com/package/lucide-react) | 0.554.0 | ISC | https://lucide.dev |
 | [next-themes](https://www.npmjs.com/package/next-themes) | 0.4.6 | MIT | https://github.com/pacocoursey/next-themes#readme |
 | [obug](https://www.npmjs.com/package/obug) | 2.1.1 | MIT | https://github.com/sxzz/obug#readme |
-| [pg](https://www.npmjs.com/package/pg) | 8.16.3 | MIT | https://github.com/brianc/node-postgres |
+| [pg](https://www.npmjs.com/package/pg) | 8.18.0 | MIT | https://github.com/brianc/node-postgres |
 | [react-day-picker](https://www.npmjs.com/package/react-day-picker) | 9.12.0 | MIT | https://daypicker.dev |
 | [react-hook-form](https://www.npmjs.com/package/react-hook-form) | 7.68.0 | MIT | https://react-hook-form.com |
 | [react-resizable-panels](https://www.npmjs.com/package/react-resizable-panels) | 3.0.6 | MIT | https://github.com/bvaughn/react-resizable-panels#readme |
diff --git a/README.md b/README.md
index aed20ac6..770e7eb9 100644
--- a/README.md
+++ b/README.md
@@ -2,8 +2,9 @@
 
 Build Databricks Apps faster with our brand-new Node.js + React SDK. Built for humans and AI.
 
-> [!WARNING] PREVIEW - NOT FOR PRODUCTION USE
->
+> [!WARNING]  
+> PREVIEW - NOT FOR PRODUCTION USE
+
 > **This SDK is in preview and is subject to change without notice.**
 >
 > - ❌ **Do NOT use in production environments**
@@ -24,6 +25,23 @@ AppKit simplifies building data applications on Databricks by providing:
 - **Developer experience**: Remote hot reload, file-based queries, optimized for AI-assisted development
 - **Databricks native**: Seamless integration with SQL Warehouses, Unity Catalog, and other workspace resources
 
+## Plugins
+
+AppKit's power comes from its plugin system. Each plugin adds a focused capability to your app with minimal configuration.
+
+### Available now
+
+- **Analytics Plugin** — Query your Lakehouse data directly from your app. Define SQL queries as files, execute them against Databricks SQL Warehouses, and get automatic caching, parameterization, and on-behalf-of user execution out of the box. Perfect for building apps that surface insights from your Lakehouse.
+
+### Coming soon
+
+- **Genie Plugin** — Conversational AI interface powered by Databricks Genie
+- **Files Plugin** — Browse, upload, and manage files in Unity Catalog Volumes
+- **Lakebase Plugin** — OLTP database operations with automatic OAuth token management
+- ...and this is just the beginning.
+
+> Missing a plugin? [Open an issue](https://github.com/databricks/appkit/issues/new) and tell us what you need — community input directly shapes the roadmap.
+
 ## Getting started
 
 Follow the [Getting Started](https://databricks.github.io/appkit/docs/) guide to get started with AppKit.
diff --git a/apps/dev-playground/.env.dist b/apps/dev-playground/.env.dist
index 7a7076ff..135da823 100644
--- a/apps/dev-playground/.env.dist
+++ b/apps/dev-playground/.env.dist
@@ -6,3 +6,8 @@ NODE_ENV='development'
 OTEL_EXPORTER_OTLP_ENDPOINT='http://localhost:4318'
 OTEL_RESOURCE_ATTRIBUTES='service.sample_attribute=dev'
 OTEL_SERVICE_NAME='dev-playground'
+LAKEBASE_ENDPOINT='' # Run: databricks postgres list-endpoints projects/{project-id}/branches/{branch-id} — use the `name` field from the output
+PGHOST=
+PGUSER=
+PGDATABASE=databricks_postgres
+PGSSLMODE=require
diff --git a/apps/dev-playground/client/package-lock.json b/apps/dev-playground/client/package-lock.json
index a0cd6cd5..22b20739 100644
--- a/apps/dev-playground/client/package-lock.json
+++ b/apps/dev-playground/client/package-lock.json
@@ -113,6 +113,7 @@
       "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.28.4.tgz",
       "integrity": "sha512-2BCOP7TN8M+gVDj7/ht3hsaO/B/n5oDbiAyyvnRlNOs+u1o+JWNYTQrmpuNp1/Wq2gcFrI01JAW+paEKDMx/CA==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@babel/code-frame": "^7.27.1",
         "@babel/generator": "^7.28.3",
@@ -2615,6 +2616,7 @@
       "resolved": "https://registry.npmjs.org/@tanstack/react-router/-/react-router-1.134.9.tgz",
       "integrity": "sha512-JIxFamShs3gRIkOxpgz/3bglbSKZHMrzKASwNFg+sQPVXVPOLtN35D5PuEDAFTPPht9Wv48WWUNYE03ZytnNug==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@tanstack/history": "1.133.28",
         "@tanstack/react-store": "^0.8.0",
@@ -2722,6 +2724,7 @@
       "resolved": "https://registry.npmjs.org/@tanstack/router-core/-/router-core-1.134.9.tgz",
       "integrity": "sha512-9Vr8tYC59I70DYGVRknRf4vjQMjSfHvmc+iTM8vcpwERBh3Vgkv90f8ol85KHKqjorSsCqMeYFhFt8AM4A4CSw==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@tanstack/history": "1.133.28",
         "@tanstack/store": "^0.8.0",
@@ -3061,6 +3064,7 @@
       "integrity": "sha512-/NbVmcGTP+lj5oa4yiYxxeBjRivKQ5Ns1eSZeB99ExsEQ6rX5XYU1Zy/gGxY/ilqtD4Etx9mKyrPxZRetiahhA==",
       "devOptional": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "undici-types": "~7.14.0"
       }
@@ -3071,6 +3075,7 @@
       "integrity": "sha512-6mDvHUFSjyT2B2yeNx2nUgMxh9LtOWvkhIU3uePn2I2oyNymUAX1NIsdgviM4CH+JSrp2D2hsMvJOkxY+0wNRA==",
       "devOptional": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "csstype": "^3.0.2"
       }
@@ -3081,6 +3086,7 @@
       "integrity": "sha512-9KQPoO6mZCi7jcIStSnlOWn2nEF3mNmyr3rIAsGnAbQKYbRLyqmeSc39EVgtxXVia+LMT8j3knZLAZAh+xLmrw==",
       "devOptional": true,
       "license": "MIT",
+      "peer": true,
       "peerDependencies": {
         "@types/react": "^19.2.0"
       }
@@ -3144,6 +3150,7 @@
       "integrity": "sha512-6JSSaBZmsKvEkbRUkf7Zj7dru/8ZCrJxAqArcLaVMee5907JdtEbKGsZ7zNiIm/UAkpGUkaSMZEXShnN2D1HZA==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@typescript-eslint/scope-manager": "8.46.1",
         "@typescript-eslint/types": "8.46.1",
@@ -3402,6 +3409,7 @@
       "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.15.0.tgz",
       "integrity": "sha512-NZyJarBfL7nWwIq+FDL6Zp/yHEhePMNnnJ0y3qfieCrmNvYct8uvtiV41UvlSe6apAfk0fY1FbWx+NwfmpvtTg==",
       "license": "MIT",
+      "peer": true,
       "bin": {
         "acorn": "bin/acorn"
       },
@@ -3625,6 +3633,7 @@
         }
       ],
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "baseline-browser-mapping": "^2.8.9",
         "caniuse-lite": "^1.0.30001746",
@@ -3923,7 +3932,8 @@
       "version": "3.1.3",
       "resolved": "https://registry.npmjs.org/csstype/-/csstype-3.1.3.tgz",
       "integrity": "sha512-M1uQkMl8rQK/szD0LNhtqxIPLpimGm8sOBwU7lLnCpSbTyY3yeU1Vc7l4KT5zT4s/yOxHH5O7tIuuLOCnLADRw==",
-      "license": "MIT"
+      "license": "MIT",
+      "peer": true
     },
     "node_modules/d3-array": {
       "version": "3.2.4",
@@ -4223,6 +4233,7 @@
       "integrity": "sha512-XyLmROnACWqSxiGYArdef1fItQd47weqB7iwtfr9JHwRrqIXZdcFMvvEcL9xHCmL0SNsOvF0c42lWyM1U5dgig==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@eslint-community/eslint-utils": "^4.8.0",
         "@eslint-community/regexpp": "^4.12.1",
@@ -5590,6 +5601,7 @@
         }
       ],
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "nanoid": "^3.3.11",
         "picocolors": "^1.1.1",
@@ -5678,6 +5690,7 @@
       "resolved": "https://registry.npmjs.org/react/-/react-19.2.0.tgz",
       "integrity": "sha512-tmbWg6W31tQLeB5cdIBOicJDJRR2KzXsV7uSK9iNfLWQ5bIZfxuPEHp7M8wiHyHnn0DD1i7w3Zmin0FtkrwoCQ==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=0.10.0"
       }
@@ -5687,6 +5700,7 @@
       "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-19.2.0.tgz",
       "integrity": "sha512-UlbRu4cAiGaIewkPyiRGJk0imDN2T3JjieT6spoL2UeSf5od4n5LB/mQ4ejmxhCFT1tYe8IvaFulzynWovsEFQ==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "scheduler": "^0.27.0"
       },
@@ -5706,6 +5720,7 @@
       "resolved": "https://registry.npmjs.org/react-redux/-/react-redux-9.2.0.tgz",
       "integrity": "sha512-ROY9fvHhwOD9ySfrF0wmvu//bKCQ6AeZZq1nJNtbDC+kk5DuSuNX/n6YWYF/SYy7bSba4D4FSz8DJeKY/S/r+g==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@types/use-sync-external-store": "^0.0.6",
         "use-sync-external-store": "^1.4.0"
@@ -5874,7 +5889,8 @@
       "version": "5.0.1",
       "resolved": "https://registry.npmjs.org/redux/-/redux-5.0.1.tgz",
       "integrity": "sha512-M9/ELqF6fy8FwmkpnF0S3YKOqMyoWJ4+CS5Efg2ct3oY9daQvd/Pc71FpGZsVsbl3Cpb+IIcjBDUnnyBdQbq4w==",
-      "license": "MIT"
+      "license": "MIT",
+      "peer": true
     },
     "node_modules/redux-thunk": {
       "version": "3.1.0",
@@ -6041,6 +6057,7 @@
       "resolved": "https://registry.npmjs.org/seroval/-/seroval-1.3.2.tgz",
       "integrity": "sha512-RbcPH1n5cfwKrru7v7+zrZvjLurgHhGyso3HTyGtRivGWgYjbOmGuivCQaORNELjNONoK35nj28EoWul9sb1zQ==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=10"
       }
@@ -6193,7 +6210,8 @@
       "version": "4.1.17",
       "resolved": "https://registry.npmjs.org/tailwindcss/-/tailwindcss-4.1.17.tgz",
       "integrity": "sha512-j9Ee2YjuQqYT9bbRTfTZht9W/ytp5H+jJpZKiYdP/bpnXARAuELt9ofP0lPnmHjbga7SNQIxdTAXCmtKVYjN+Q==",
-      "license": "MIT"
+      "license": "MIT",
+      "peer": true
     },
     "node_modules/tailwindcss-animate": {
       "version": "1.0.7",
@@ -6222,7 +6240,8 @@
       "version": "1.3.3",
       "resolved": "https://registry.npmjs.org/tiny-invariant/-/tiny-invariant-1.3.3.tgz",
       "integrity": "sha512-+FbBPE1o9QAYvviau/qC5SE3caw21q3xkvWKBtja5vgqOWIHHJ3ioaq1VPfn/Szqctz2bU/oYeKd9/z5BL+PVg==",
-      "license": "MIT"
+      "license": "MIT",
+      "peer": true
     },
     "node_modules/tiny-warning": {
       "version": "1.0.3",
@@ -6268,6 +6287,7 @@
       "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.3.tgz",
       "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=12"
       },
@@ -6364,6 +6384,7 @@
       "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
       "dev": true,
       "license": "Apache-2.0",
+      "peer": true,
       "bin": {
         "tsc": "bin/tsc",
         "tsserver": "bin/tsserver"
@@ -6653,6 +6674,7 @@
       "resolved": "https://registry.npmjs.org/rolldown-vite/-/rolldown-vite-7.1.14.tgz",
       "integrity": "sha512-eSiiRJmovt8qDJkGyZuLnbxAOAdie6NCmmd0NkTC0RJI9duiSBTfr8X2mBYJOUFzxQa2USaHmL99J9uMxkjCyw==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@oxc-project/runtime": "0.92.0",
         "fdir": "^6.5.0",
@@ -6745,6 +6767,7 @@
       "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.3.tgz",
       "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=12"
       },
diff --git a/apps/dev-playground/client/src/appKitTypes.d.ts b/apps/dev-playground/client/src/appKitTypes.d.ts
index 0e0ae0b0..049fae9f 100644
--- a/apps/dev-playground/client/src/appKitTypes.d.ts
+++ b/apps/dev-playground/client/src/appKitTypes.d.ts
@@ -14,46 +14,28 @@ declare module "@databricks/appkit-ui/react" {
           endDate: SQLDateMarker;
         };
         result: Array<{
-          /** @sqlType STRING */
-          app_name: string;
-          /** @sqlType STRING */
-          day_of_week: string;
-          /** @sqlType DECIMAL(35,2) */
-          spend: number;
+          ;
         }>;
       };
     apps_list: {
         name: "apps_list";
         parameters: Record<string, never>;
         result: Array<{
-          /** @sqlType STRING */
-          id: string;
-          /** @sqlType STRING */
-          name: string;
-          /** @sqlType STRING */
-          creator: string;
-          /** @sqlType STRING */
-          tags: string;
-          /** @sqlType DECIMAL(38,6) */
-          totalSpend: number;
-          /** @sqlType DATE */
-          createdAt: string;
+          ;
         }>;
       };
     cost_recommendations: {
         name: "cost_recommendations";
         parameters: Record<string, never>;
         result: Array<{
-          /** @sqlType INT */
-          dummy: number;
+          ;
         }>;
       };
     example: {
         name: "example";
         parameters: Record<string, never>;
         result: Array<{
-          /** @sqlType BOOLEAN */
-          "(1 = 1)": boolean;
+          ;
         }>;
       };
     spend_data: {
@@ -73,12 +55,7 @@ declare module "@databricks/appkit-ui/react" {
           creator: SQLStringMarker;
         };
         result: Array<{
-          /** @sqlType STRING */
-          group_key: string;
-          /** @sqlType TIMESTAMP */
-          aggregation_period: string;
-          /** @sqlType DECIMAL(38,6) */
-          cost_usd: number;
+          ;
         }>;
       };
     spend_summary: {
@@ -92,12 +69,7 @@ declare module "@databricks/appkit-ui/react" {
           startDate: SQLDateMarker;
         };
         result: Array<{
-          /** @sqlType DECIMAL(33,0) */
-          total: number;
-          /** @sqlType DECIMAL(33,0) */
-          average: number;
-          /** @sqlType DECIMAL(33,0) */
-          forecasted: number;
+          ;
         }>;
       };
     sql_helpers_test: {
@@ -117,22 +89,7 @@ declare module "@databricks/appkit-ui/react" {
           binaryParam: SQLStringMarker;
         };
         result: Array<{
-          /** @sqlType STRING */
-          string_value: string;
-          /** @sqlType STRING */
-          number_value: string;
-          /** @sqlType STRING */
-          boolean_value: string;
-          /** @sqlType STRING */
-          date_value: string;
-          /** @sqlType STRING */
-          timestamp_value: string;
-          /** @sqlType BINARY */
-          binary_value: string;
-          /** @sqlType STRING */
-          binary_hex: string;
-          /** @sqlType INT */
-          binary_length: number;
+          ;
         }>;
       };
     top_contributors: {
@@ -146,10 +103,7 @@ declare module "@databricks/appkit-ui/react" {
           endDate: SQLDateMarker;
         };
         result: Array<{
-          /** @sqlType STRING */
-          app_name: string;
-          /** @sqlType DECIMAL(38,6) */
-          total_cost_usd: number;
+          ;
         }>;
       };
     untagged_apps: {
@@ -163,14 +117,7 @@ declare module "@databricks/appkit-ui/react" {
           endDate: SQLDateMarker;
         };
         result: Array<{
-          /** @sqlType STRING */
-          app_name: string;
-          /** @sqlType STRING */
-          creator: string;
-          /** @sqlType DECIMAL(38,6) */
-          total_cost_usd: number;
-          /** @sqlType DECIMAL(38,10) */
-          avg_period_cost_usd: number;
+          ;
         }>;
       };
   }
diff --git a/apps/dev-playground/client/src/components/lakebase/ActivityLogsPanel.tsx b/apps/dev-playground/client/src/components/lakebase/ActivityLogsPanel.tsx
new file mode 100644
index 00000000..10bb6406
--- /dev/null
+++ b/apps/dev-playground/client/src/components/lakebase/ActivityLogsPanel.tsx
@@ -0,0 +1,259 @@
+import {
+  Badge,
+  Button,
+  Card,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
+  Input,
+} from "@databricks/appkit-ui/react";
+import { Activity, Loader2 } from "lucide-react";
+import { useId, useState } from "react";
+import { useLakebaseData, useLakebasePost } from "@/hooks/use-lakebase-data";
+
+interface ActivityLog {
+  id: number;
+  userId: string;
+  action: string;
+  metadata: Record<string, unknown> | null;
+  timestamp: string;
+}
+
+interface Stats {
+  totalLogs: number;
+  uniqueUsers: number;
+  recentActivity: number;
+}
+
+export function ActivityLogsPanel() {
+  const userIdFieldId = useId();
+  const actionFieldId = useId();
+
+  const {
+    data: logs,
+    loading: logsLoading,
+    error: logsError,
+    refetch,
+  } = useLakebaseData<ActivityLog[]>("/api/lakebase-examples/drizzle/activity");
+
+  const { data: stats } = useLakebaseData<Stats>(
+    "/api/lakebase-examples/drizzle/stats",
+  );
+
+  const { post, loading: creating } = useLakebasePost<
+    Partial<ActivityLog>,
+    ActivityLog
+  >("/api/lakebase-examples/drizzle/activity");
+
+  const generateRandomActivity = () => {
+    const users = ["alice", "bob", "charlie", "diana", "eve"];
+    const actions = [
+      "login",
+      "logout",
+      "view_dashboard",
+      "create_report",
+      "export_data",
+      "update_settings",
+      "share_document",
+      "delete_item",
+    ];
+
+    return {
+      userId: users[Math.floor(Math.random() * users.length)],
+      action: actions[Math.floor(Math.random() * actions.length)],
+    };
+  };
+
+  const [formData, setFormData] = useState(generateRandomActivity());
+
+  const handleSubmit = async (e: React.FormEvent) => {
+    e.preventDefault();
+    const result = await post({
+      userId: formData.userId,
+      action: formData.action,
+      metadata: {
+        source: "web",
+        timestamp: new Date().toISOString(),
+      },
+    });
+
+    if (result) {
+      setFormData(generateRandomActivity());
+      refetch();
+    }
+  };
+
+  return (
+    <div className="space-y-4">
+      {/* Header */}
+      <Card className="border-2">
+        <CardHeader className="pb-0 gap-0">
+          <div className="flex items-center gap-3">
+            <div className="p-2 bg-purple-100 rounded-lg flex-shrink-0 self-start">
+              <Activity className="h-6 w-6 text-purple-600" />
+            </div>
+            <div className="flex-1 min-w-0">
+              <CardTitle>Drizzle ORM Example</CardTitle>
+              <CardDescription>
+                Type-safe queries with schema definitions and automatic type
+                inference
+              </CardDescription>
+            </div>
+          </div>
+        </CardHeader>
+      </Card>
+
+      {/* Statistics */}
+      {stats && (
+        <div className="grid grid-cols-1 md:grid-cols-3 gap-4">
+          <Card>
+            <CardHeader className="pb-3">
+              <CardDescription className="text-xs">Total Logs</CardDescription>
+              <CardTitle className="text-2xl">{stats.totalLogs}</CardTitle>
+            </CardHeader>
+          </Card>
+          <Card>
+            <CardHeader className="pb-3">
+              <CardDescription className="text-xs">
+                Unique Users
+              </CardDescription>
+              <CardTitle className="text-2xl">{stats.uniqueUsers}</CardTitle>
+            </CardHeader>
+          </Card>
+          <Card>
+            <CardHeader className="pb-3">
+              <CardDescription className="text-xs">
+                Last 24 Hours
+              </CardDescription>
+              <CardTitle className="text-2xl">{stats.recentActivity}</CardTitle>
+            </CardHeader>
+          </Card>
+        </div>
+      )}
+
+      {/* Create log form */}
+      <Card>
+        <CardHeader>
+          <CardTitle className="text-lg">Log Activity</CardTitle>
+        </CardHeader>
+        <CardContent>
+          <form onSubmit={handleSubmit} className="space-y-4">
+            <div className="grid grid-cols-1 md:grid-cols-2 gap-4">
+              <div>
+                <label
+                  htmlFor={userIdFieldId}
+                  className="text-sm font-medium mb-1 block"
+                >
+                  User ID
+                </label>
+                <Input
+                  id={userIdFieldId}
+                  value={formData.userId}
+                  onChange={(e) =>
+                    setFormData({ ...formData, userId: e.target.value })
+                  }
+                  placeholder="alice"
+                  required
+                />
+              </div>
+              <div>
+                <label
+                  htmlFor={actionFieldId}
+                  className="text-sm font-medium mb-1 block"
+                >
+                  Action
+                </label>
+                <Input
+                  id={actionFieldId}
+                  value={formData.action}
+                  onChange={(e) =>
+                    setFormData({ ...formData, action: e.target.value })
+                  }
+                  placeholder="view_dashboard"
+                  required
+                />
+              </div>
+            </div>
+            <Button type="submit" disabled={creating} className="w-full">
+              {creating ? (
+                <>
+                  <Loader2 className="mr-2 h-4 w-4 animate-spin" />
+                  Logging...
+                </>
+              ) : (
+                "Log Activity"
+              )}
+            </Button>
+          </form>
+        </CardContent>
+      </Card>
+
+      {/* Activity logs */}
+      <Card>
+        <CardHeader>
+          <div className="flex items-center justify-between">
+            <CardTitle className="text-lg">Activity Logs</CardTitle>
+            <Button variant="outline" size="sm" onClick={() => refetch()}>
+              Refresh
+            </Button>
+          </div>
+        </CardHeader>
+        <CardContent>
+          {logsLoading && (
+            <div className="flex items-center gap-2 text-warning py-8">
+              <div className="w-2 h-2 bg-amber-500 rounded-full animate-pulse" />
+              Loading activity logs...
+            </div>
+          )}
+
+          {logsError && (
+            <div className="text-destructive bg-destructive/10 p-3 rounded-md border border-destructive/20">
+              <span className="font-semibold">Error:</span> {logsError.message}
+            </div>
+          )}
+
+          {logs && logs.length === 0 && (
+            <div className="text-center py-12 text-muted-foreground">
+              <Activity className="h-12 w-12 mx-auto mb-3 opacity-50" />
+              <p>No activity logs yet. Log your first activity above.</p>
+            </div>
+          )}
+
+          {logs && logs.length > 0 && (
+            <div className="space-y-3 max-h-[500px] overflow-y-auto">
+              {logs.map((log) => (
+                <div
+                  key={log.id}
+                  className="p-4 bg-secondary rounded border border-border"
+                >
+                  <div className="flex items-start justify-between mb-2">
+                    <div className="flex items-center gap-2">
+                      <Badge className="bg-purple-100 text-purple-700 border-purple-200">
+                        {log.userId}
+                      </Badge>
+                      <span className="text-sm font-medium">{log.action}</span>
+                    </div>
+                    <span className="text-xs text-muted-foreground">
+                      {new Date(log.timestamp).toLocaleString()}
+                    </span>
+                  </div>
+                  {log.metadata && (
+                    <details className="text-xs text-muted-foreground">
+                      <summary className="cursor-pointer">
+                        View metadata
+                      </summary>
+                      <pre className="mt-2 p-2 bg-background rounded border overflow-x-auto">
+                        {JSON.stringify(log.metadata, null, 2)}
+                      </pre>
+                    </details>
+                  )}
+                </div>
+              ))}
+            </div>
+          )}
+        </CardContent>
+      </Card>
+    </div>
+  );
+}
diff --git a/apps/dev-playground/client/src/components/lakebase/OrdersPanel.tsx b/apps/dev-playground/client/src/components/lakebase/OrdersPanel.tsx
new file mode 100644
index 00000000..8730bb04
--- /dev/null
+++ b/apps/dev-playground/client/src/components/lakebase/OrdersPanel.tsx
@@ -0,0 +1,524 @@
+import {
+  Badge,
+  Button,
+  Card,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
+  Input,
+} from "@databricks/appkit-ui/react";
+import {
+  CheckCircle,
+  Circle,
+  Loader2,
+  Package,
+  ShoppingCart,
+  Truck,
+} from "lucide-react";
+import { useId, useState } from "react";
+import {
+  useLakebaseData,
+  useLakebasePatch,
+  useLakebasePost,
+} from "@/hooks/use-lakebase-data";
+
+interface Order {
+  id: number;
+  orderNumber: string;
+  customerName: string;
+  productName: string;
+  amount: number;
+  status: "pending" | "processing" | "shipped" | "delivered";
+  createdAt: string;
+  updatedAt: string;
+}
+
+interface OrderStats {
+  total: number;
+  pending: number;
+  processing: number;
+  shipped: number;
+  delivered: number;
+}
+
+export function OrdersPanel() {
+  const orderNumberId = useId();
+  const customerNameId = useId();
+  const productNameId = useId();
+  const amountId = useId();
+
+  const {
+    data: orders,
+    loading: ordersLoading,
+    error: ordersError,
+    refetch,
+  } = useLakebaseData<Order[]>("/api/lakebase-examples/sequelize/orders");
+
+  const { data: stats } = useLakebaseData<OrderStats>(
+    "/api/lakebase-examples/sequelize/stats",
+  );
+
+  const { post, loading: creating } = useLakebasePost<Partial<Order>, Order>(
+    "/api/lakebase-examples/sequelize/orders",
+  );
+
+  const { patch, loading: updating } = useLakebasePatch<
+    { status: string },
+    Order
+  >("/api/lakebase-examples/sequelize/orders");
+
+  const generateRandomOrder = () => {
+    const customers = [
+      "Alice Johnson",
+      "Bob Smith",
+      "Carol Williams",
+      "David Brown",
+      "Emma Davis",
+      "Frank Miller",
+      "Grace Wilson",
+      "Henry Moore",
+    ];
+    const products = [
+      "Wireless Bluetooth Headphones",
+      "USB-C Charging Cable",
+      "Laptop Stand - Ergonomic",
+      "Mechanical Keyboard - RGB",
+      "4K Webcam with Microphone",
+      "Portable SSD 1TB",
+      "Wireless Mouse - Ergonomic",
+      "Monitor Arm Mount",
+      "Noise Cancelling Earbuds",
+      "Desk Lamp - LED",
+    ];
+
+    const orderNum = `ORD-${new Date().getFullYear()}-${String(Math.floor(Math.random() * 9999) + 1).padStart(4, "0")}`;
+    const customer = customers[Math.floor(Math.random() * customers.length)];
+    const product = products[Math.floor(Math.random() * products.length)];
+    const amount = (Math.random() * 200 + 10).toFixed(2);
+
+    return {
+      orderNumber: orderNum,
+      customerName: customer,
+      productName: product,
+      amount,
+    };
+  };
+
+  const [formData, setFormData] = useState(generateRandomOrder());
+
+  const handleSubmit = async (e: React.FormEvent) => {
+    e.preventDefault();
+    const result = await post({
+      orderNumber: formData.orderNumber,
+      customerName: formData.customerName,
+      productName: formData.productName,
+      amount: Number.parseFloat(formData.amount),
+      status: "pending",
+    });
+
+    if (result) {
+      setFormData(generateRandomOrder());
+      refetch();
+    }
+  };
+
+  const handleStatusUpdate = async (id: number, status: Order["status"]) => {
+    const result = await patch(id, { status });
+    if (result) {
+      refetch();
+    }
+  };
+
+  const getStatusBadge = (status: Order["status"]) => {
+    switch (status) {
+      case "pending":
+        return (
+          <Badge className="bg-gray-100 text-gray-700 border-gray-200">
+            <Circle className="w-3 h-3 mr-1" />
+            Pending
+          </Badge>
+        );
+      case "processing":
+        return (
+          <Badge className="bg-blue-100 text-blue-700 border-blue-200">
+            <Package className="w-3 h-3 mr-1" />
+            Processing
+          </Badge>
+        );
+      case "shipped":
+        return (
+          <Badge className="bg-purple-100 text-purple-700 border-purple-200">
+            <Truck className="w-3 h-3 mr-1" />
+            Shipped
+          </Badge>
+        );
+      case "delivered":
+        return (
+          <Badge className="bg-green-100 text-green-700 border-green-200">
+            <CheckCircle className="w-3 h-3 mr-1" />
+            Delivered
+          </Badge>
+        );
+    }
+  };
+
+  const ordersByStatus = orders
+    ? {
+        pending: orders.filter((o) => o.status === "pending"),
+        processing: orders.filter((o) => o.status === "processing"),
+        shipped: orders.filter((o) => o.status === "shipped"),
+        delivered: orders.filter((o) => o.status === "delivered"),
+      }
+    : { pending: [], processing: [], shipped: [], delivered: [] };
+
+  return (
+    <div className="space-y-4">
+      {/* Header */}
+      <Card className="border-2">
+        <CardHeader className="pb-0 gap-0">
+          <div className="flex items-center gap-3">
+            <div className="p-2 bg-orange-100 rounded-lg flex-shrink-0 self-start">
+              <ShoppingCart className="h-6 w-6 text-orange-600" />
+            </div>
+            <div className="flex-1 min-w-0">
+              <CardTitle>Sequelize Example</CardTitle>
+              <CardDescription>
+                Model-based ORM with intuitive API and automatic timestamps
+              </CardDescription>
+            </div>
+          </div>
+        </CardHeader>
+      </Card>
+
+      {/* Statistics */}
+      {stats && (
+        <div className="grid grid-cols-1 md:grid-cols-5 gap-4">
+          <Card>
+            <CardHeader className="pb-3">
+              <CardDescription className="text-xs">
+                Total Orders
+              </CardDescription>
+              <CardTitle className="text-2xl">{stats.total}</CardTitle>
+            </CardHeader>
+          </Card>
+          <Card>
+            <CardHeader className="pb-3">
+              <CardDescription className="text-xs">Pending</CardDescription>
+              <CardTitle className="text-2xl">{stats.pending}</CardTitle>
+            </CardHeader>
+          </Card>
+          <Card>
+            <CardHeader className="pb-3">
+              <CardDescription className="text-xs">Processing</CardDescription>
+              <CardTitle className="text-2xl">{stats.processing}</CardTitle>
+            </CardHeader>
+          </Card>
+          <Card>
+            <CardHeader className="pb-3">
+              <CardDescription className="text-xs">Shipped</CardDescription>
+              <CardTitle className="text-2xl">{stats.shipped}</CardTitle>
+            </CardHeader>
+          </Card>
+          <Card>
+            <CardHeader className="pb-3">
+              <CardDescription className="text-xs">Delivered</CardDescription>
+              <CardTitle className="text-2xl">{stats.delivered}</CardTitle>
+            </CardHeader>
+          </Card>
+        </div>
+      )}
+
+      {/* Create order form */}
+      <Card>
+        <CardHeader>
+          <CardTitle className="text-lg">Create Order</CardTitle>
+        </CardHeader>
+        <CardContent>
+          <form onSubmit={handleSubmit} className="space-y-4">
+            <div className="grid grid-cols-1 md:grid-cols-2 gap-4">
+              <div>
+                <label
+                  htmlFor={orderNumberId}
+                  className="text-sm font-medium mb-1 block"
+                >
+                  Order Number
+                </label>
+                <Input
+                  id={orderNumberId}
+                  value={formData.orderNumber}
+                  onChange={(e) =>
+                    setFormData({ ...formData, orderNumber: e.target.value })
+                  }
+                  placeholder="ORD-2024-0001"
+                  required
+                />
+              </div>
+              <div>
+                <label
+                  htmlFor={customerNameId}
+                  className="text-sm font-medium mb-1 block"
+                >
+                  Customer Name
+                </label>
+                <Input
+                  id={customerNameId}
+                  value={formData.customerName}
+                  onChange={(e) =>
+                    setFormData({ ...formData, customerName: e.target.value })
+                  }
+                  placeholder="John Doe"
+                  required
+                />
+              </div>
+            </div>
+            <div className="grid grid-cols-1 md:grid-cols-2 gap-4">
+              <div>
+                <label
+                  htmlFor={productNameId}
+                  className="text-sm font-medium mb-1 block"
+                >
+                  Product Name
+                </label>
+                <Input
+                  id={productNameId}
+                  value={formData.productName}
+                  onChange={(e) =>
+                    setFormData({ ...formData, productName: e.target.value })
+                  }
+                  placeholder="Wireless Headphones"
+                  required
+                />
+              </div>
+              <div>
+                <label
+                  htmlFor={amountId}
+                  className="text-sm font-medium mb-1 block"
+                >
+                  Amount ($)
+                </label>
+                <Input
+                  id={amountId}
+                  type="number"
+                  step="0.01"
+                  min="0"
+                  value={formData.amount}
+                  onChange={(e) =>
+                    setFormData({ ...formData, amount: e.target.value })
+                  }
+                  placeholder="99.99"
+                  required
+                />
+              </div>
+            </div>
+            <Button type="submit" disabled={creating} className="w-full">
+              {creating ? (
+                <>
+                  <Loader2 className="mr-2 h-4 w-4 animate-spin" />
+                  Creating...
+                </>
+              ) : (
+                "Create Order"
+              )}
+            </Button>
+          </form>
+        </CardContent>
+      </Card>
+
+      {/* Order board */}
+      <Card>
+        <CardHeader>
+          <div className="flex items-center justify-between">
+            <CardTitle className="text-lg">Order Board</CardTitle>
+            <Button variant="outline" size="sm" onClick={() => refetch()}>
+              Refresh
+            </Button>
+          </div>
+        </CardHeader>
+        <CardContent>
+          {ordersLoading && (
+            <div className="flex items-center gap-2 text-warning py-8">
+              <div className="w-2 h-2 bg-amber-500 rounded-full animate-pulse" />
+              Loading orders...
+            </div>
+          )}
+
+          {ordersError && (
+            <div className="text-destructive bg-destructive/10 p-3 rounded-md border border-destructive/20">
+              <span className="font-semibold">Error:</span>{" "}
+              {ordersError.message}
+            </div>
+          )}
+
+          {orders && orders.length === 0 && (
+            <div className="text-center py-12 text-muted-foreground">
+              <ShoppingCart className="h-12 w-12 mx-auto mb-3 opacity-50" />
+              <p>No orders yet. Add an order to get started.</p>
+            </div>
+          )}
+
+          {orders && orders.length > 0 && (
+            <div className="grid grid-cols-1 md:grid-cols-4 gap-4">
+              {/* Pending column */}
+              <div className="space-y-3">
+                <div className="font-semibold text-sm text-muted-foreground uppercase tracking-wide">
+                  Pending ({ordersByStatus.pending.length})
+                </div>
+                <div className="space-y-2">
+                  {ordersByStatus.pending.map((order) => (
+                    <Card key={order.id} className="p-3">
+                      <div className="space-y-2">
+                        <div>{getStatusBadge(order.status)}</div>
+                        <h4 className="font-medium text-sm">
+                          {order.orderNumber}
+                        </h4>
+                        <p className="text-xs text-muted-foreground">
+                          {order.customerName}
+                        </p>
+                        <p className="text-xs font-medium">
+                          {order.productName}
+                        </p>
+                        <p className="text-sm font-bold text-green-600">
+                          ${Number(order.amount).toFixed(2)}
+                        </p>
+                        <Button
+                          size="sm"
+                          variant="outline"
+                          className="w-full"
+                          onClick={() =>
+                            handleStatusUpdate(order.id, "processing")
+                          }
+                          disabled={updating}
+                        >
+                          Process
+                        </Button>
+                      </div>
+                    </Card>
+                  ))}
+                </div>
+              </div>
+
+              {/* Processing column */}
+              <div className="space-y-3">
+                <div className="font-semibold text-sm text-muted-foreground uppercase tracking-wide">
+                  Processing ({ordersByStatus.processing.length})
+                </div>
+                <div className="space-y-2">
+                  {ordersByStatus.processing.map((order) => (
+                    <Card key={order.id} className="p-3">
+                      <div className="space-y-2">
+                        <div>{getStatusBadge(order.status)}</div>
+                        <h4 className="font-medium text-sm">
+                          {order.orderNumber}
+                        </h4>
+                        <p className="text-xs text-muted-foreground">
+                          {order.customerName}
+                        </p>
+                        <p className="text-xs font-medium">
+                          {order.productName}
+                        </p>
+                        <p className="text-sm font-bold text-green-600">
+                          ${Number(order.amount).toFixed(2)}
+                        </p>
+                        <div className="flex gap-2">
+                          <Button
+                            size="sm"
+                            variant="outline"
+                            className="flex-1"
+                            onClick={() =>
+                              handleStatusUpdate(order.id, "pending")
+                            }
+                            disabled={updating}
+                          >
+                            Back
+                          </Button>
+                          <Button
+                            size="sm"
+                            className="flex-1"
+                            onClick={() =>
+                              handleStatusUpdate(order.id, "shipped")
+                            }
+                            disabled={updating}
+                          >
+                            Ship
+                          </Button>
+                        </div>
+                      </div>
+                    </Card>
+                  ))}
+                </div>
+              </div>
+
+              {/* Shipped column */}
+              <div className="space-y-3">
+                <div className="font-semibold text-sm text-muted-foreground uppercase tracking-wide">
+                  Shipped ({ordersByStatus.shipped.length})
+                </div>
+                <div className="space-y-2">
+                  {ordersByStatus.shipped.map((order) => (
+                    <Card key={order.id} className="p-3">
+                      <div className="space-y-2">
+                        <div>{getStatusBadge(order.status)}</div>
+                        <h4 className="font-medium text-sm">
+                          {order.orderNumber}
+                        </h4>
+                        <p className="text-xs text-muted-foreground">
+                          {order.customerName}
+                        </p>
+                        <p className="text-xs font-medium">
+                          {order.productName}
+                        </p>
+                        <p className="text-sm font-bold text-green-600">
+                          ${Number(order.amount).toFixed(2)}
+                        </p>
+                        <Button
+                          size="sm"
+                          variant="outline"
+                          className="w-full"
+                          onClick={() =>
+                            handleStatusUpdate(order.id, "delivered")
+                          }
+                          disabled={updating}
+                        >
+                          Deliver
+                        </Button>
+                      </div>
+                    </Card>
+                  ))}
+                </div>
+              </div>
+
+              {/* Delivered column */}
+              <div className="space-y-3">
+                <div className="font-semibold text-sm text-muted-foreground uppercase tracking-wide">
+                  Delivered ({ordersByStatus.delivered.length})
+                </div>
+                <div className="space-y-2">
+                  {ordersByStatus.delivered.map((order) => (
+                    <Card key={order.id} className="p-3 opacity-75">
+                      <div className="space-y-2">
+                        <div>{getStatusBadge(order.status)}</div>
+                        <h4 className="font-medium text-sm">
+                          {order.orderNumber}
+                        </h4>
+                        <p className="text-xs text-muted-foreground">
+                          {order.customerName}
+                        </p>
+                        <p className="text-xs font-medium">
+                          {order.productName}
+                        </p>
+                        <p className="text-sm font-bold text-green-600">
+                          ${Number(order.amount).toFixed(2)}
+                        </p>
+                      </div>
+                    </Card>
+                  ))}
+                </div>
+              </div>
+            </div>
+          )}
+        </CardContent>
+      </Card>
+    </div>
+  );
+}
diff --git a/apps/dev-playground/client/src/components/lakebase/ProductsPanel.tsx b/apps/dev-playground/client/src/components/lakebase/ProductsPanel.tsx
new file mode 100644
index 00000000..d1b6c690
--- /dev/null
+++ b/apps/dev-playground/client/src/components/lakebase/ProductsPanel.tsx
@@ -0,0 +1,305 @@
+import {
+  Badge,
+  Button,
+  Card,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
+  Input,
+} from "@databricks/appkit-ui/react";
+import { Database, Loader2, Package } from "lucide-react";
+import { useId, useState } from "react";
+import { useLakebaseData, useLakebasePost } from "@/hooks/use-lakebase-data";
+
+interface Product {
+  id: number;
+  name: string;
+  category: string;
+  price: number | string; // PostgreSQL DECIMAL returns as string
+  stock: number;
+  created_by?: string;
+  created_at: string;
+}
+
+interface CreateProductRequest {
+  name: string;
+  category: string;
+  price: number;
+  stock: number;
+}
+
+interface HealthStatus {
+  status: string;
+  connected: boolean;
+  message: string;
+}
+
+export function ProductsPanel() {
+  const nameId = useId();
+  const categoryId = useId();
+  const priceId = useId();
+  const stockId = useId();
+
+  const {
+    data: products,
+    loading: productsLoading,
+    error: productsError,
+    refetch,
+  } = useLakebaseData<Product[]>("/api/lakebase-examples/raw/products");
+
+  const { data: health } = useLakebaseData<HealthStatus>(
+    "/api/lakebase-examples/raw/health",
+  );
+
+  const { post, loading: creating } = useLakebasePost<
+    CreateProductRequest,
+    Product
+  >("/api/lakebase-examples/raw/products");
+
+  const generateRandomProduct = () => {
+    const products = [
+      "Ergonomic Keyboard",
+      "Wireless Mouse",
+      "USB-C Hub",
+      "Laptop Stand",
+      "Monitor Arm",
+      "Mechanical Keyboard",
+      "Gaming Headset",
+      "Webcam HD",
+    ];
+    const categories = ["Electronics", "Accessories", "Peripherals", "Office"];
+    const price = (Math.random() * (199.99 - 29.99) + 29.99).toFixed(2);
+    const stock = Math.floor(Math.random() * (500 - 50) + 50);
+
+    return {
+      name: products[Math.floor(Math.random() * products.length)],
+      category: categories[Math.floor(Math.random() * categories.length)],
+      price,
+      stock: String(stock),
+    };
+  };
+
+  const [formData, setFormData] = useState(generateRandomProduct());
+
+  const handleSubmit = async (e: React.FormEvent) => {
+    e.preventDefault();
+    const result = await post({
+      name: formData.name,
+      category: formData.category,
+      price: Number(formData.price),
+      stock: Number(formData.stock),
+    });
+
+    if (result) {
+      setFormData(generateRandomProduct());
+      refetch();
+    }
+  };
+
+  return (
+    <div className="space-y-4">
+      {/* Header with connection status */}
+      <Card className="border-2">
+        <CardHeader className="pb-0 gap-0">
+          <div className="flex items-center justify-between">
+            <div className="flex items-center gap-3">
+              <div className="p-2 bg-blue-100 rounded-lg flex-shrink-0 self-start">
+                <Database className="h-6 w-6 text-blue-600" />
+              </div>
+              <div className="flex-1 min-w-0">
+                <CardTitle>Raw Driver Example</CardTitle>
+                <CardDescription>
+                  Direct PostgreSQL connection using pg.Pool with automatic
+                  OAuth token refresh
+                </CardDescription>
+              </div>
+            </div>
+            {health && (
+              <Badge
+                className={`${
+                  health.connected
+                    ? "bg-green-100 text-green-700 border-green-200"
+                    : "bg-red-100 text-red-700 border-red-200"
+                }`}
+              >
+                {health.connected ? "Connected" : "Disconnected"}
+              </Badge>
+            )}
+          </div>
+        </CardHeader>
+      </Card>
+
+      {/* Create product form */}
+      <Card>
+        <CardHeader>
+          <CardTitle className="text-lg">Create Product</CardTitle>
+        </CardHeader>
+        <CardContent>
+          <form onSubmit={handleSubmit} className="space-y-4">
+            <div className="grid grid-cols-1 md:grid-cols-2 gap-4">
+              <div>
+                <label
+                  htmlFor={nameId}
+                  className="text-sm font-medium mb-1 block"
+                >
+                  Product Name
+                </label>
+                <Input
+                  id={nameId}
+                  value={formData.name}
+                  onChange={(e) =>
+                    setFormData({ ...formData, name: e.target.value })
+                  }
+                  placeholder="Wireless Mouse"
+                  required
+                />
+              </div>
+              <div>
+                <label
+                  htmlFor={categoryId}
+                  className="text-sm font-medium mb-1 block"
+                >
+                  Category
+                </label>
+                <Input
+                  id={categoryId}
+                  value={formData.category}
+                  onChange={(e) =>
+                    setFormData({ ...formData, category: e.target.value })
+                  }
+                  placeholder="Electronics"
+                  required
+                />
+              </div>
+              <div>
+                <label
+                  htmlFor={priceId}
+                  className="text-sm font-medium mb-1 block"
+                >
+                  Price
+                </label>
+                <Input
+                  id={priceId}
+                  type="number"
+                  step="0.01"
+                  value={formData.price}
+                  onChange={(e) =>
+                    setFormData({ ...formData, price: e.target.value })
+                  }
+                  placeholder="29.99"
+                  required
+                />
+              </div>
+              <div>
+                <label
+                  htmlFor={stockId}
+                  className="text-sm font-medium mb-1 block"
+                >
+                  Stock
+                </label>
+                <Input
+                  id={stockId}
+                  type="number"
+                  value={formData.stock}
+                  onChange={(e) =>
+                    setFormData({ ...formData, stock: e.target.value })
+                  }
+                  placeholder="100"
+                  required
+                />
+              </div>
+            </div>
+            <Button type="submit" disabled={creating} className="w-full">
+              {creating ? (
+                <>
+                  <Loader2 className="mr-2 h-4 w-4 animate-spin" />
+                  Creating...
+                </>
+              ) : (
+                "Create Product"
+              )}
+            </Button>
+          </form>
+        </CardContent>
+      </Card>
+
+      {/* Products list */}
+      <Card>
+        <CardHeader>
+          <div className="flex items-center justify-between">
+            <CardTitle className="text-lg">Products Catalog</CardTitle>
+            <Button variant="outline" size="sm" onClick={() => refetch()}>
+              Refresh
+            </Button>
+          </div>
+        </CardHeader>
+        <CardContent>
+          {productsLoading && (
+            <div className="flex items-center gap-2 text-warning py-8">
+              <div className="w-2 h-2 bg-amber-500 rounded-full animate-pulse" />
+              Loading products...
+            </div>
+          )}
+
+          {productsError && (
+            <div className="text-destructive bg-destructive/10 p-3 rounded-md border border-destructive/20">
+              <span className="font-semibold">Error:</span>{" "}
+              {productsError.message}
+            </div>
+          )}
+
+          {products && products.length === 0 && (
+            <div className="text-center py-12 text-muted-foreground">
+              <Package className="h-12 w-12 mx-auto mb-3 opacity-50" />
+              <p>No products available. Create your first product above.</p>
+            </div>
+          )}
+
+          {products && products.length > 0 && (
+            <div className="overflow-x-auto">
+              <table className="w-full">
+                <thead>
+                  <tr className="border-b">
+                    <th className="text-left py-2 px-4 text-sm font-medium text-muted-foreground">
+                      ID
+                    </th>
+                    <th className="text-left py-2 px-4 text-sm font-medium text-muted-foreground">
+                      Name
+                    </th>
+                    <th className="text-left py-2 px-4 text-sm font-medium text-muted-foreground">
+                      Category
+                    </th>
+                    <th className="text-right py-2 px-4 text-sm font-medium text-muted-foreground">
+                      Price
+                    </th>
+                    <th className="text-right py-2 px-4 text-sm font-medium text-muted-foreground">
+                      Stock
+                    </th>
+                  </tr>
+                </thead>
+                <tbody>
+                  {products.map((product) => (
+                    <tr key={product.id} className="border-b last:border-0">
+                      <td className="py-3 px-4 text-sm">{product.id}</td>
+                      <td className="py-3 px-4 font-medium">{product.name}</td>
+                      <td className="py-3 px-4 text-sm">
+                        <Badge variant="outline">{product.category}</Badge>
+                      </td>
+                      <td className="py-3 px-4 text-sm text-right">
+                        ${Number(product.price).toFixed(2)}
+                      </td>
+                      <td className="py-3 px-4 text-sm text-right">
+                        {product.stock}
+                      </td>
+                    </tr>
+                  ))}
+                </tbody>
+              </table>
+            </div>
+          )}
+        </CardContent>
+      </Card>
+    </div>
+  );
+}
diff --git a/apps/dev-playground/client/src/components/lakebase/TasksPanel.tsx b/apps/dev-playground/client/src/components/lakebase/TasksPanel.tsx
new file mode 100644
index 00000000..fdc5c19a
--- /dev/null
+++ b/apps/dev-playground/client/src/components/lakebase/TasksPanel.tsx
@@ -0,0 +1,401 @@
+import {
+  Badge,
+  Button,
+  Card,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
+  Input,
+  Textarea,
+} from "@databricks/appkit-ui/react";
+import { CheckCircle, Circle, ListTodo, Loader2 } from "lucide-react";
+import { useId, useState } from "react";
+import {
+  useLakebaseData,
+  useLakebasePatch,
+  useLakebasePost,
+} from "@/hooks/use-lakebase-data";
+
+interface Task {
+  id: number;
+  title: string;
+  status: "pending" | "in_progress" | "completed";
+  description: string | null;
+  createdAt: string;
+}
+
+interface TaskStats {
+  total: number;
+  pending: number;
+  inProgress: number;
+  completed: number;
+}
+
+export function TasksPanel() {
+  const titleId = useId();
+  const descriptionId = useId();
+
+  const {
+    data: tasks,
+    loading: tasksLoading,
+    error: tasksError,
+    refetch,
+  } = useLakebaseData<Task[]>("/api/lakebase-examples/typeorm/tasks");
+
+  const { data: stats } = useLakebaseData<TaskStats>(
+    "/api/lakebase-examples/typeorm/stats",
+  );
+
+  const { post, loading: creating } = useLakebasePost<Partial<Task>, Task>(
+    "/api/lakebase-examples/typeorm/tasks",
+  );
+
+  const { patch, loading: updating } = useLakebasePatch<
+    { status: string },
+    Task
+  >("/api/lakebase-examples/typeorm/tasks");
+
+  const generateRandomTask = () => {
+    const tasks = [
+      {
+        title: "Implement user authentication",
+        description: "Add OAuth2 authentication flow with JWT tokens",
+      },
+      {
+        title: "Write API documentation",
+        description: "Document all REST endpoints with examples",
+      },
+      {
+        title: "Set up CI/CD pipeline",
+        description: "Configure GitHub Actions for automated testing",
+      },
+      {
+        title: "Add error monitoring",
+        description: "Integrate error tracking and alerting system",
+      },
+      {
+        title: "Optimize database queries",
+        description: "Add indexes and analyze slow queries",
+      },
+      {
+        title: "Implement data validation",
+        description: "Add schema validation for all API requests",
+      },
+      {
+        title: "Set up development environment",
+        description: "Configure local development tools and dependencies",
+      },
+      {
+        title: "Design database schema",
+        description: "Create ERD and define table relationships",
+      },
+    ];
+
+    const task = tasks[Math.floor(Math.random() * tasks.length)];
+    return {
+      title: task.title,
+      description: task.description,
+    };
+  };
+
+  const [formData, setFormData] = useState(generateRandomTask());
+
+  const handleSubmit = async (e: React.FormEvent) => {
+    e.preventDefault();
+    const result = await post({
+      title: formData.title,
+      description: formData.description || null,
+      status: "pending",
+    });
+
+    if (result) {
+      setFormData(generateRandomTask());
+      refetch();
+    }
+  };
+
+  const handleStatusUpdate = async (id: number, status: Task["status"]) => {
+    const result = await patch(id, { status });
+    if (result) {
+      refetch();
+    }
+  };
+
+  const getStatusBadge = (status: Task["status"]) => {
+    switch (status) {
+      case "pending":
+        return (
+          <Badge className="bg-gray-100 text-gray-700 border-gray-200">
+            <Circle className="w-3 h-3 mr-1" />
+            Pending
+          </Badge>
+        );
+      case "in_progress":
+        return (
+          <Badge className="bg-blue-100 text-blue-700 border-blue-200">
+            <Loader2 className="w-3 h-3 mr-1 animate-spin" />
+            In Progress
+          </Badge>
+        );
+      case "completed":
+        return (
+          <Badge className="bg-green-100 text-green-700 border-green-200">
+            <CheckCircle className="w-3 h-3 mr-1" />
+            Completed
+          </Badge>
+        );
+    }
+  };
+
+  const tasksByStatus = tasks
+    ? {
+        pending: tasks.filter((t) => t.status === "pending"),
+        in_progress: tasks.filter((t) => t.status === "in_progress"),
+        completed: tasks.filter((t) => t.status === "completed"),
+      }
+    : { pending: [], in_progress: [], completed: [] };
+
+  return (
+    <div className="space-y-4">
+      {/* Header */}
+      <Card className="border-2">
+        <CardHeader className="pb-0 gap-0">
+          <div className="flex items-center gap-3">
+            <div className="p-2 bg-green-100 rounded-lg flex-shrink-0 self-start">
+              <ListTodo className="h-6 w-6 text-green-600" />
+            </div>
+            <div className="flex-1 min-w-0">
+              <CardTitle>TypeORM Example</CardTitle>
+              <CardDescription>
+                Entity-based data access with decorators and repository pattern
+              </CardDescription>
+            </div>
+          </div>
+        </CardHeader>
+      </Card>
+
+      {/* Statistics */}
+      {stats && (
+        <div className="grid grid-cols-1 md:grid-cols-4 gap-4">
+          <Card>
+            <CardHeader className="pb-3">
+              <CardDescription className="text-xs">Total Tasks</CardDescription>
+              <CardTitle className="text-2xl">{stats.total}</CardTitle>
+            </CardHeader>
+          </Card>
+          <Card>
+            <CardHeader className="pb-3">
+              <CardDescription className="text-xs">Pending</CardDescription>
+              <CardTitle className="text-2xl">{stats.pending}</CardTitle>
+            </CardHeader>
+          </Card>
+          <Card>
+            <CardHeader className="pb-3">
+              <CardDescription className="text-xs">In Progress</CardDescription>
+              <CardTitle className="text-2xl">{stats.inProgress}</CardTitle>
+            </CardHeader>
+          </Card>
+          <Card>
+            <CardHeader className="pb-3">
+              <CardDescription className="text-xs">Completed</CardDescription>
+              <CardTitle className="text-2xl">{stats.completed}</CardTitle>
+            </CardHeader>
+          </Card>
+        </div>
+      )}
+
+      {/* Create task form */}
+      <Card>
+        <CardHeader>
+          <CardTitle className="text-lg">Create Task</CardTitle>
+        </CardHeader>
+        <CardContent>
+          <form onSubmit={handleSubmit} className="space-y-4">
+            <div>
+              <label
+                htmlFor={titleId}
+                className="text-sm font-medium mb-1 block"
+              >
+                Task Title
+              </label>
+              <Input
+                id={titleId}
+                value={formData.title}
+                onChange={(e) =>
+                  setFormData({ ...formData, title: e.target.value })
+                }
+                placeholder="Implement feature X"
+                required
+              />
+            </div>
+            <div>
+              <label
+                htmlFor={descriptionId}
+                className="text-sm font-medium mb-1 block"
+              >
+                Description (optional)
+              </label>
+              <Textarea
+                id={descriptionId}
+                value={formData.description}
+                onChange={(e) =>
+                  setFormData({ ...formData, description: e.target.value })
+                }
+                placeholder="Add detailed description..."
+                rows={3}
+              />
+            </div>
+            <Button type="submit" disabled={creating} className="w-full">
+              {creating ? (
+                <>
+                  <Loader2 className="mr-2 h-4 w-4 animate-spin" />
+                  Creating...
+                </>
+              ) : (
+                "Create Task"
+              )}
+            </Button>
+          </form>
+        </CardContent>
+      </Card>
+
+      {/* Task board */}
+      <Card>
+        <CardHeader>
+          <div className="flex items-center justify-between">
+            <CardTitle className="text-lg">Task Board</CardTitle>
+            <Button variant="outline" size="sm" onClick={() => refetch()}>
+              Refresh
+            </Button>
+          </div>
+        </CardHeader>
+        <CardContent>
+          {tasksLoading && (
+            <div className="flex items-center gap-2 text-warning py-8">
+              <div className="w-2 h-2 bg-amber-500 rounded-full animate-pulse" />
+              Loading tasks...
+            </div>
+          )}
+
+          {tasksError && (
+            <div className="text-destructive bg-destructive/10 p-3 rounded-md border border-destructive/20">
+              <span className="font-semibold">Error:</span> {tasksError.message}
+            </div>
+          )}
+
+          {tasks && tasks.length === 0 && (
+            <div className="text-center py-12 text-muted-foreground">
+              <ListTodo className="h-12 w-12 mx-auto mb-3 opacity-50" />
+              <p>No tasks yet. Add a task to get started.</p>
+            </div>
+          )}
+
+          {tasks && tasks.length > 0 && (
+            <div className="grid grid-cols-1 md:grid-cols-3 gap-4">
+              {/* Pending column */}
+              <div className="space-y-3">
+                <div className="font-semibold text-sm text-muted-foreground uppercase tracking-wide">
+                  Pending ({tasksByStatus.pending.length})
+                </div>
+                <div className="space-y-2">
+                  {tasksByStatus.pending.map((task) => (
+                    <Card key={task.id} className="p-3">
+                      <div className="space-y-2">
+                        <div>{getStatusBadge(task.status)}</div>
+                        <h4 className="font-medium text-sm">{task.title}</h4>
+                        {task.description && (
+                          <p className="text-xs text-muted-foreground line-clamp-2">
+                            {task.description}
+                          </p>
+                        )}
+                        <Button
+                          size="sm"
+                          variant="outline"
+                          className="w-full"
+                          onClick={() =>
+                            handleStatusUpdate(task.id, "in_progress")
+                          }
+                          disabled={updating}
+                        >
+                          Start
+                        </Button>
+                      </div>
+                    </Card>
+                  ))}
+                </div>
+              </div>
+
+              {/* In Progress column */}
+              <div className="space-y-3">
+                <div className="font-semibold text-sm text-muted-foreground uppercase tracking-wide">
+                  In Progress ({tasksByStatus.in_progress.length})
+                </div>
+                <div className="space-y-2">
+                  {tasksByStatus.in_progress.map((task) => (
+                    <Card key={task.id} className="p-3">
+                      <div className="space-y-2">
+                        <div>{getStatusBadge(task.status)}</div>
+                        <h4 className="font-medium text-sm">{task.title}</h4>
+                        {task.description && (
+                          <p className="text-xs text-muted-foreground line-clamp-2">
+                            {task.description}
+                          </p>
+                        )}
+                        <div className="flex gap-2">
+                          <Button
+                            size="sm"
+                            variant="outline"
+                            className="flex-1"
+                            onClick={() =>
+                              handleStatusUpdate(task.id, "pending")
+                            }
+                            disabled={updating}
+                          >
+                            Back
+                          </Button>
+                          <Button
+                            size="sm"
+                            className="flex-1"
+                            onClick={() =>
+                              handleStatusUpdate(task.id, "completed")
+                            }
+                            disabled={updating}
+                          >
+                            Complete
+                          </Button>
+                        </div>
+                      </div>
+                    </Card>
+                  ))}
+                </div>
+              </div>
+
+              {/* Completed column */}
+              <div className="space-y-3">
+                <div className="font-semibold text-sm text-muted-foreground uppercase tracking-wide">
+                  Completed ({tasksByStatus.completed.length})
+                </div>
+                <div className="space-y-2">
+                  {tasksByStatus.completed.map((task) => (
+                    <Card key={task.id} className="p-3 opacity-75">
+                      <div className="space-y-2">
+                        <div>{getStatusBadge(task.status)}</div>
+                        <h4 className="font-medium text-sm">{task.title}</h4>
+                        {task.description && (
+                          <p className="text-xs text-muted-foreground line-clamp-2">
+                            {task.description}
+                          </p>
+                        )}
+                      </div>
+                    </Card>
+                  ))}
+                </div>
+              </div>
+            </div>
+          )}
+        </CardContent>
+      </Card>
+    </div>
+  );
+}
diff --git a/apps/dev-playground/client/src/components/lakebase/index.ts b/apps/dev-playground/client/src/components/lakebase/index.ts
new file mode 100644
index 00000000..6ba528a6
--- /dev/null
+++ b/apps/dev-playground/client/src/components/lakebase/index.ts
@@ -0,0 +1,4 @@
+export { ActivityLogsPanel } from "./ActivityLogsPanel";
+export { OrdersPanel } from "./OrdersPanel";
+export { ProductsPanel } from "./ProductsPanel";
+export { TasksPanel } from "./TasksPanel";
diff --git a/apps/dev-playground/client/src/hooks/use-lakebase-data.ts b/apps/dev-playground/client/src/hooks/use-lakebase-data.ts
new file mode 100644
index 00000000..a6049dcc
--- /dev/null
+++ b/apps/dev-playground/client/src/hooks/use-lakebase-data.ts
@@ -0,0 +1,144 @@
+import { useCallback, useEffect, useState } from "react";
+
+interface UseLakebaseDataOptions {
+  autoFetch?: boolean;
+}
+
+interface UseLakebaseDataResult<T> {
+  data: T | null;
+  loading: boolean;
+  error: Error | null;
+  refetch: () => Promise<void>;
+}
+
+/**
+ * Generic hook for fetching data from Lakebase example endpoints
+ *
+ * @example
+ * const { data, loading, error, refetch } = useLakebaseData<Product[]>(
+ *   '/api/lakebase-examples/raw/products'
+ * );
+ */
+export function useLakebaseData<T = unknown>(
+  endpoint: string,
+  options: UseLakebaseDataOptions = {},
+): UseLakebaseDataResult<T> {
+  const { autoFetch = true } = options;
+  const [data, setData] = useState<T | null>(null);
+  const [loading, setLoading] = useState(autoFetch);
+  const [error, setError] = useState<Error | null>(null);
+
+  const fetchData = useCallback(async () => {
+    setLoading(true);
+    setError(null);
+
+    try {
+      const response = await fetch(endpoint);
+      if (!response.ok) {
+        throw new Error(`HTTP ${response.status}: ${response.statusText}`);
+      }
+      const json = await response.json();
+      setData(json);
+    } catch (err) {
+      setError(err instanceof Error ? err : new Error(String(err)));
+    } finally {
+      setLoading(false);
+    }
+  }, [endpoint]);
+
+  useEffect(() => {
+    if (autoFetch) {
+      fetchData();
+    }
+  }, [autoFetch, fetchData]);
+
+  return { data, loading, error, refetch: fetchData };
+}
+
+/**
+ * Hook for posting data to Lakebase example endpoints
+ */
+export function useLakebasePost<TRequest = unknown, TResponse = unknown>(
+  endpoint: string,
+) {
+  const [loading, setLoading] = useState(false);
+  const [error, setError] = useState<Error | null>(null);
+
+  const post = useCallback(
+    async (body: TRequest): Promise<TResponse | null> => {
+      setLoading(true);
+      setError(null);
+
+      try {
+        const response = await fetch(endpoint, {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify(body),
+        });
+
+        if (!response.ok) {
+          const errorData = await response.json().catch(() => ({}));
+          throw new Error(
+            errorData.message ||
+              `HTTP ${response.status}: ${response.statusText}`,
+          );
+        }
+
+        return await response.json();
+      } catch (err) {
+        const error = err instanceof Error ? err : new Error(String(err));
+        setError(error);
+        return null;
+      } finally {
+        setLoading(false);
+      }
+    },
+    [endpoint],
+  );
+
+  return { post, loading, error };
+}
+
+/**
+ * Hook for PATCH requests to Lakebase example endpoints
+ */
+export function useLakebasePatch<TRequest = unknown, TResponse = unknown>(
+  baseEndpoint: string,
+) {
+  const [loading, setLoading] = useState(false);
+  const [error, setError] = useState<Error | null>(null);
+
+  const patch = useCallback(
+    async (id: number | string, body: TRequest): Promise<TResponse | null> => {
+      setLoading(true);
+      setError(null);
+
+      try {
+        const response = await fetch(`${baseEndpoint}/${id}`, {
+          method: "PATCH",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify(body),
+        });
+
+        if (!response.ok) {
+          const errorData = await response.json().catch(() => ({}));
+          throw new Error(
+            errorData.message ||
+              `HTTP ${response.status}: ${response.statusText}`,
+          );
+        }
+
+        return await response.json();
+      } catch (err) {
+        const error = err instanceof Error ? err : new Error(String(err));
+        setError(error);
+        return null;
+      } finally {
+        setLoading(false);
+      }
+    },
+    [baseEndpoint],
+  );
+
+  return { patch, loading, error };
+}
diff --git a/apps/dev-playground/client/src/routeTree.gen.ts b/apps/dev-playground/client/src/routeTree.gen.ts
index f9b31113..3478fcc8 100644
--- a/apps/dev-playground/client/src/routeTree.gen.ts
+++ b/apps/dev-playground/client/src/routeTree.gen.ts
@@ -13,6 +13,8 @@ import { Route as TypeSafetyRouteRouteImport } from './routes/type-safety.route'
 import { Route as TelemetryRouteRouteImport } from './routes/telemetry.route'
 import { Route as SqlHelpersRouteRouteImport } from './routes/sql-helpers.route'
 import { Route as ReconnectRouteRouteImport } from './routes/reconnect.route'
+import { Route as LakebaseRouteRouteImport } from './routes/lakebase.route'
+import { Route as FilesRouteRouteImport } from './routes/files.route'
 import { Route as DataVisualizationRouteRouteImport } from './routes/data-visualization.route'
 import { Route as ArrowAnalyticsRouteRouteImport } from './routes/arrow-analytics.route'
 import { Route as AnalyticsRouteRouteImport } from './routes/analytics.route'
@@ -38,6 +40,16 @@ const ReconnectRouteRoute = ReconnectRouteRouteImport.update({
   path: '/reconnect',
   getParentRoute: () => rootRouteImport,
 } as any)
+const LakebaseRouteRoute = LakebaseRouteRouteImport.update({
+  id: '/lakebase',
+  path: '/lakebase',
+  getParentRoute: () => rootRouteImport,
+} as any)
+const FilesRouteRoute = FilesRouteRouteImport.update({
+  id: '/files',
+  path: '/files',
+  getParentRoute: () => rootRouteImport,
+} as any)
 const DataVisualizationRouteRoute = DataVisualizationRouteRouteImport.update({
   id: '/data-visualization',
   path: '/data-visualization',
@@ -64,6 +76,8 @@ export interface FileRoutesByFullPath {
   '/analytics': typeof AnalyticsRouteRoute
   '/arrow-analytics': typeof ArrowAnalyticsRouteRoute
   '/data-visualization': typeof DataVisualizationRouteRoute
+  '/files': typeof FilesRouteRoute
+  '/lakebase': typeof LakebaseRouteRoute
   '/reconnect': typeof ReconnectRouteRoute
   '/sql-helpers': typeof SqlHelpersRouteRoute
   '/telemetry': typeof TelemetryRouteRoute
@@ -74,6 +88,8 @@ export interface FileRoutesByTo {
   '/analytics': typeof AnalyticsRouteRoute
   '/arrow-analytics': typeof ArrowAnalyticsRouteRoute
   '/data-visualization': typeof DataVisualizationRouteRoute
+  '/files': typeof FilesRouteRoute
+  '/lakebase': typeof LakebaseRouteRoute
   '/reconnect': typeof ReconnectRouteRoute
   '/sql-helpers': typeof SqlHelpersRouteRoute
   '/telemetry': typeof TelemetryRouteRoute
@@ -85,6 +101,8 @@ export interface FileRoutesById {
   '/analytics': typeof AnalyticsRouteRoute
   '/arrow-analytics': typeof ArrowAnalyticsRouteRoute
   '/data-visualization': typeof DataVisualizationRouteRoute
+  '/files': typeof FilesRouteRoute
+  '/lakebase': typeof LakebaseRouteRoute
   '/reconnect': typeof ReconnectRouteRoute
   '/sql-helpers': typeof SqlHelpersRouteRoute
   '/telemetry': typeof TelemetryRouteRoute
@@ -97,6 +115,8 @@ export interface FileRouteTypes {
     | '/analytics'
     | '/arrow-analytics'
     | '/data-visualization'
+    | '/files'
+    | '/lakebase'
     | '/reconnect'
     | '/sql-helpers'
     | '/telemetry'
@@ -107,6 +127,8 @@ export interface FileRouteTypes {
     | '/analytics'
     | '/arrow-analytics'
     | '/data-visualization'
+    | '/files'
+    | '/lakebase'
     | '/reconnect'
     | '/sql-helpers'
     | '/telemetry'
@@ -117,6 +139,8 @@ export interface FileRouteTypes {
     | '/analytics'
     | '/arrow-analytics'
     | '/data-visualization'
+    | '/files'
+    | '/lakebase'
     | '/reconnect'
     | '/sql-helpers'
     | '/telemetry'
@@ -128,6 +152,8 @@ export interface RootRouteChildren {
   AnalyticsRouteRoute: typeof AnalyticsRouteRoute
   ArrowAnalyticsRouteRoute: typeof ArrowAnalyticsRouteRoute
   DataVisualizationRouteRoute: typeof DataVisualizationRouteRoute
+  FilesRouteRoute: typeof FilesRouteRoute
+  LakebaseRouteRoute: typeof LakebaseRouteRoute
   ReconnectRouteRoute: typeof ReconnectRouteRoute
   SqlHelpersRouteRoute: typeof SqlHelpersRouteRoute
   TelemetryRouteRoute: typeof TelemetryRouteRoute
@@ -164,6 +190,20 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof ReconnectRouteRouteImport
       parentRoute: typeof rootRouteImport
     }
+    '/lakebase': {
+      id: '/lakebase'
+      path: '/lakebase'
+      fullPath: '/lakebase'
+      preLoaderRoute: typeof LakebaseRouteRouteImport
+      parentRoute: typeof rootRouteImport
+    }
+    '/files': {
+      id: '/files'
+      path: '/files'
+      fullPath: '/files'
+      preLoaderRoute: typeof FilesRouteRouteImport
+      parentRoute: typeof rootRouteImport
+    }
     '/data-visualization': {
       id: '/data-visualization'
       path: '/data-visualization'
@@ -200,6 +240,8 @@ const rootRouteChildren: RootRouteChildren = {
   AnalyticsRouteRoute: AnalyticsRouteRoute,
   ArrowAnalyticsRouteRoute: ArrowAnalyticsRouteRoute,
   DataVisualizationRouteRoute: DataVisualizationRouteRoute,
+  FilesRouteRoute: FilesRouteRoute,
+  LakebaseRouteRoute: LakebaseRouteRoute,
   ReconnectRouteRoute: ReconnectRouteRoute,
   SqlHelpersRouteRoute: SqlHelpersRouteRoute,
   TelemetryRouteRoute: TelemetryRouteRoute,
diff --git a/apps/dev-playground/client/src/routes/__root.tsx b/apps/dev-playground/client/src/routes/__root.tsx
index b2faa651..ad35594f 100644
--- a/apps/dev-playground/client/src/routes/__root.tsx
+++ b/apps/dev-playground/client/src/routes/__root.tsx
@@ -48,6 +48,14 @@ function RootComponent() {
                     Arrow Analytics
                   </Button>
                 </Link>
+                <Link to="/lakebase" className="no-underline">
+                  <Button
+                    variant="ghost"
+                    className="text-foreground hover:text-secondary-foreground"
+                  >
+                    Lakebase
+                  </Button>
+                </Link>
                 <Link to="/reconnect" className="no-underline">
                   <Button
                     variant="ghost"
@@ -72,6 +80,14 @@ function RootComponent() {
                     SQL Helpers
                   </Button>
                 </Link>
+                <Link to="/files" className="no-underline">
+                  <Button
+                    variant="ghost"
+                    className="text-foreground hover:text-secondary-foreground"
+                  >
+                    Files
+                  </Button>
+                </Link>
                 <ThemeSelector />
               </div>
             </nav>
diff --git a/apps/dev-playground/client/src/routes/files.route.tsx b/apps/dev-playground/client/src/routes/files.route.tsx
new file mode 100644
index 00000000..67317eb4
--- /dev/null
+++ b/apps/dev-playground/client/src/routes/files.route.tsx
@@ -0,0 +1,617 @@
+import {
+  Breadcrumb,
+  BreadcrumbItem,
+  BreadcrumbLink,
+  BreadcrumbList,
+  BreadcrumbPage,
+  BreadcrumbSeparator,
+  Button,
+  Card,
+  Skeleton,
+} from "@databricks/appkit-ui/react";
+import { createFileRoute, retainSearchParams } from "@tanstack/react-router";
+import {
+  AlertCircle,
+  ArrowLeft,
+  ChevronRight,
+  Download,
+  FileIcon,
+  FolderIcon,
+  FolderPlus,
+  Loader2,
+  Trash2,
+  Upload,
+  X,
+} from "lucide-react";
+import { useCallback, useEffect, useRef, useState } from "react";
+import { Header } from "@/components/layout/header";
+
+export const Route = createFileRoute("/files")({
+  component: FilesRoute,
+  search: {
+    middlewares: [retainSearchParams(true)],
+  },
+});
+
+interface DirectoryEntry {
+  name?: string;
+  path?: string;
+  is_directory?: boolean;
+  file_size?: number;
+  last_modified?: string;
+}
+
+interface FilePreview {
+  contentLength: number | undefined;
+  contentType: string | undefined;
+  lastModified: string | undefined;
+  textPreview: string | null;
+  isText: boolean;
+  isImage: boolean;
+}
+
+function FilesRoute() {
+  const [volumeRoot, setVolumeRoot] = useState<string>("");
+  const [currentPath, setCurrentPath] = useState<string>("");
+  const [entries, setEntries] = useState<DirectoryEntry[]>([]);
+  const [loading, setLoading] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [selectedFile, setSelectedFile] = useState<string | null>(null);
+  const [preview, setPreview] = useState<FilePreview | null>(null);
+  const [previewLoading, setPreviewLoading] = useState(false);
+  const [uploading, setUploading] = useState(false);
+  const [deleting, setDeleting] = useState(false);
+  const [creatingDir, setCreatingDir] = useState(false);
+  const [newDirName, setNewDirName] = useState("");
+  const [showNewDirInput, setShowNewDirInput] = useState(false);
+  const fileInputRef = useRef<HTMLInputElement>(null);
+  const newDirInputRef = useRef<HTMLInputElement>(null);
+
+  const normalize = (p: string) => p.replace(/\/+$/, "");
+  const isAtRoot =
+    !currentPath || normalize(currentPath) === normalize(volumeRoot);
+
+  const loadDirectory = useCallback(async (path?: string) => {
+    setLoading(true);
+    setError(null);
+    setSelectedFile(null);
+    setPreview(null);
+
+    try {
+      const url = path
+        ? `/api/files/list?path=${encodeURIComponent(path)}`
+        : "/api/files/list";
+      const response = await fetch(url);
+
+      if (!response.ok) {
+        const data = await response.json().catch(() => ({}));
+        throw new Error(
+          data.error ?? `HTTP ${response.status}: ${response.statusText}`,
+        );
+      }
+
+      const data: DirectoryEntry[] = await response.json();
+      data.sort((a, b) => {
+        if (a.is_directory && !b.is_directory) return -1;
+        if (!a.is_directory && b.is_directory) return 1;
+        return (a.name ?? "").localeCompare(b.name ?? "");
+      });
+      setEntries(data);
+      setCurrentPath(path ?? "");
+    } catch (err) {
+      setError(err instanceof Error ? err.message : String(err));
+      setEntries([]);
+    } finally {
+      setLoading(false);
+    }
+  }, []);
+
+  const loadPreview = useCallback(async (filePath: string) => {
+    setPreviewLoading(true);
+    setPreview(null);
+
+    try {
+      const response = await fetch(
+        `/api/files/preview?path=${encodeURIComponent(filePath)}`,
+      );
+
+      if (!response.ok) {
+        const data = await response.json().catch(() => ({}));
+        throw new Error(data.error ?? `HTTP ${response.status}`);
+      }
+
+      const data = await response.json();
+      setPreview(data);
+    } catch {
+      setPreview(null);
+    } finally {
+      setPreviewLoading(false);
+    }
+  }, []);
+
+  useEffect(() => {
+    fetch("/api/files/root")
+      .then((res) => res.json())
+      .then((data) => {
+        const root = data.root ?? "";
+        setVolumeRoot(root);
+        if (root) {
+          loadDirectory(root);
+        } else {
+          loadDirectory();
+        }
+      })
+      .catch(() => loadDirectory());
+  }, [loadDirectory]);
+
+  const resolveEntryPath = (entry: DirectoryEntry) => {
+    if (entry.path?.startsWith("/")) return entry.path;
+    const name = entry.name ?? "";
+    return currentPath ? `${currentPath}/${name}` : name;
+  };
+
+  const handleEntryClick = (entry: DirectoryEntry) => {
+    const entryPath = resolveEntryPath(entry);
+    if (entry.is_directory) {
+      loadDirectory(entryPath);
+    } else {
+      setSelectedFile(entryPath);
+      loadPreview(entryPath);
+    }
+  };
+
+  const navigateToParent = () => {
+    if (isAtRoot) return;
+    const segments = currentPath.split("/").filter(Boolean);
+    segments.pop();
+    const parentPath = `/${segments.join("/")}`;
+    if (
+      volumeRoot &&
+      normalize(parentPath).length <= normalize(volumeRoot).length
+    ) {
+      loadDirectory(volumeRoot);
+      return;
+    }
+    loadDirectory(parentPath);
+  };
+
+  const navigateToBreadcrumb = (index: number) => {
+    const targetSegments = [
+      ...rootSegments,
+      ...breadcrumbSegments.slice(0, index + 1),
+    ];
+    const targetPath = `/${targetSegments.join("/")}`;
+    loadDirectory(targetPath);
+  };
+
+  const handleUpload = async (e: React.ChangeEvent<HTMLInputElement>) => {
+    const file = e.target.files?.[0];
+    if (!file) return;
+
+    setUploading(true);
+    try {
+      const uploadPath = currentPath
+        ? `${currentPath}/${file.name}`
+        : file.name;
+      const response = await fetch(
+        `/api/files/upload?path=${encodeURIComponent(uploadPath)}`,
+        { method: "POST", body: file },
+      );
+
+      if (!response.ok) {
+        const data = await response.json().catch(() => ({}));
+        throw new Error(data.error ?? `Upload failed (${response.status})`);
+      }
+
+      await loadDirectory(currentPath || undefined);
+    } catch (err) {
+      setError(err instanceof Error ? err.message : String(err));
+    } finally {
+      setUploading(false);
+      if (fileInputRef.current) {
+        fileInputRef.current.value = "";
+      }
+    }
+  };
+
+  const handleDelete = async () => {
+    if (!selectedFile) return;
+
+    const fileName = selectedFile.split("/").pop();
+    if (!window.confirm(`Delete "${fileName}"?`)) return;
+
+    setDeleting(true);
+    try {
+      const response = await fetch(
+        `/api/files/delete?path=${encodeURIComponent(selectedFile)}`,
+        { method: "POST" },
+      );
+
+      if (!response.ok) {
+        const data = await response.json().catch(() => ({}));
+        throw new Error(data.error ?? `Delete failed (${response.status})`);
+      }
+
+      setSelectedFile(null);
+      setPreview(null);
+      await loadDirectory(currentPath || undefined);
+    } catch (err) {
+      setError(err instanceof Error ? err.message : String(err));
+    } finally {
+      setDeleting(false);
+    }
+  };
+
+  const handleCreateDirectory = async () => {
+    const name = newDirName.trim();
+    if (!name) return;
+
+    setCreatingDir(true);
+    try {
+      const dirPath = currentPath ? `${currentPath}/${name}` : name;
+      const response = await fetch("/api/files/mkdir", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ path: dirPath }),
+      });
+
+      if (!response.ok) {
+        const data = await response.json().catch(() => ({}));
+        throw new Error(
+          data.error ?? `Create directory failed (${response.status})`,
+        );
+      }
+
+      setShowNewDirInput(false);
+      setNewDirName("");
+      await loadDirectory(currentPath || undefined);
+    } catch (err) {
+      setError(err instanceof Error ? err.message : String(err));
+    } finally {
+      setCreatingDir(false);
+    }
+  };
+
+  const rootSegments = normalize(volumeRoot).split("/").filter(Boolean);
+  const allSegments = normalize(currentPath).split("/").filter(Boolean);
+  const breadcrumbSegments = allSegments.slice(rootSegments.length);
+
+  const formatFileSize = (bytes: number | undefined) => {
+    if (bytes === undefined || bytes === null) return "Unknown";
+    if (bytes < 1024) return `${bytes} B`;
+    if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;
+    return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+  };
+
+  return (
+    <div className="min-h-screen bg-background">
+      <div className="max-w-7xl mx-auto px-6 py-12">
+        <Header
+          title="File Browser"
+          description="Browse and preview files in Databricks Volumes."
+          tooltip="Uses the Files plugin to interact with Databricks Volumes via the Unity Catalog Files API"
+        />
+
+        <div className="mb-6 flex items-center justify-between">
+          <Breadcrumb>
+            <BreadcrumbList>
+              <BreadcrumbItem>
+                {breadcrumbSegments.length > 0 ? (
+                  <BreadcrumbLink
+                    className="cursor-pointer"
+                    onClick={() => loadDirectory(volumeRoot || undefined)}
+                  >
+                    {rootSegments.at(-1) ?? "Root"}
+                  </BreadcrumbLink>
+                ) : (
+                  <BreadcrumbPage>
+                    {rootSegments.at(-1) ?? "Root"}
+                  </BreadcrumbPage>
+                )}
+              </BreadcrumbItem>
+              {breadcrumbSegments.map((segment, index) => (
+                <span key={segment} className="contents">
+                  <BreadcrumbSeparator />
+                  <BreadcrumbItem>
+                    {index === breadcrumbSegments.length - 1 ? (
+                      <BreadcrumbPage>{segment}</BreadcrumbPage>
+                    ) : (
+                      <BreadcrumbLink
+                        className="cursor-pointer"
+                        onClick={() => navigateToBreadcrumb(index)}
+                      >
+                        {segment}
+                      </BreadcrumbLink>
+                    )}
+                  </BreadcrumbItem>
+                </span>
+              ))}
+            </BreadcrumbList>
+          </Breadcrumb>
+
+          <div className="flex items-center gap-2">
+            <Button
+              variant="outline"
+              size="sm"
+              onClick={() => {
+                setShowNewDirInput(true);
+                setTimeout(() => newDirInputRef.current?.focus(), 0);
+              }}
+            >
+              <FolderPlus className="h-4 w-4 mr-2" />
+              New Folder
+            </Button>
+            <input
+              ref={fileInputRef}
+              type="file"
+              className="hidden"
+              onChange={handleUpload}
+            />
+            <Button
+              variant="outline"
+              size="sm"
+              disabled={uploading}
+              onClick={() => fileInputRef.current?.click()}
+            >
+              {uploading ? (
+                <Loader2 className="h-4 w-4 mr-2 animate-spin" />
+              ) : (
+                <Upload className="h-4 w-4 mr-2" />
+              )}
+              {uploading ? "Uploading..." : "Upload"}
+            </Button>
+          </div>
+        </div>
+
+        <div className="flex gap-6">
+          <div className="flex-2 min-w-0">
+            <Card className="p-0 overflow-hidden">
+              {!isAtRoot && (
+                <button
+                  type="button"
+                  onClick={navigateToParent}
+                  className="flex items-center gap-2 px-4 py-3 w-full text-left hover:bg-muted/50 border-b text-sm text-muted-foreground transition-colors"
+                >
+                  <ArrowLeft className="h-4 w-4" />
+                  Back to parent
+                </button>
+              )}
+
+              {showNewDirInput && (
+                <div className="flex items-center gap-2 px-4 py-3 border-b bg-muted/30">
+                  <FolderPlus className="h-5 w-5 text-blue-500 shrink-0" />
+                  <input
+                    ref={newDirInputRef}
+                    type="text"
+                    value={newDirName}
+                    onChange={(e) => setNewDirName(e.target.value)}
+                    onKeyDown={(e) => {
+                      if (e.key === "Enter") handleCreateDirectory();
+                      if (e.key === "Escape") {
+                        setShowNewDirInput(false);
+                        setNewDirName("");
+                      }
+                    }}
+                    placeholder="Folder name"
+                    className="flex-1 text-sm bg-background border rounded px-2 py-1 outline-none focus:ring-1 focus:ring-ring"
+                    disabled={creatingDir}
+                  />
+                  <Button
+                    variant="ghost"
+                    size="sm"
+                    disabled={creatingDir || !newDirName.trim()}
+                    onClick={handleCreateDirectory}
+                  >
+                    {creatingDir ? (
+                      <Loader2 className="h-4 w-4 animate-spin" />
+                    ) : (
+                      "Create"
+                    )}
+                  </Button>
+                  <button
+                    type="button"
+                    onClick={() => {
+                      setShowNewDirInput(false);
+                      setNewDirName("");
+                    }}
+                    className="text-muted-foreground hover:text-foreground"
+                  >
+                    <X className="h-4 w-4" />
+                  </button>
+                </div>
+              )}
+
+              {loading && (
+                <div className="p-4 space-y-3">
+                  <Skeleton className="h-10 w-full" />
+                  <Skeleton className="h-10 w-full" />
+                  <Skeleton className="h-10 w-full" />
+                </div>
+              )}
+
+              {error && (
+                <div className="p-6 text-center">
+                  <AlertCircle className="h-8 w-8 text-destructive mx-auto mb-2" />
+                  <p className="text-sm text-destructive">{error}</p>
+                  <Button
+                    variant="outline"
+                    size="sm"
+                    className="mt-3"
+                    onClick={() => loadDirectory(currentPath || undefined)}
+                  >
+                    Retry
+                  </Button>
+                </div>
+              )}
+
+              {!loading && !error && entries.length === 0 && (
+                <div className="p-6 text-center text-muted-foreground">
+                  <FileIcon className="h-8 w-8 mx-auto mb-2 opacity-50" />
+                  <p className="text-sm">
+                    {currentPath
+                      ? "This directory is empty."
+                      : "No default volume configured. Set DATABRICKS_DEFAULT_VOLUME to get started."}
+                  </p>
+                </div>
+              )}
+
+              {!loading &&
+                !error &&
+                entries.map((entry) => {
+                  const entryPath = resolveEntryPath(entry);
+                  const isSelected = selectedFile === entryPath;
+
+                  return (
+                    <button
+                      key={entryPath}
+                      type="button"
+                      onClick={() => handleEntryClick(entry)}
+                      className={`flex items-center gap-3 px-4 py-3 w-full text-left hover:bg-muted/50 border-b last:border-b-0 transition-colors ${
+                        isSelected ? "bg-muted" : ""
+                      }`}
+                    >
+                      {entry.is_directory ? (
+                        <FolderIcon className="h-5 w-5 text-blue-500 shrink-0" />
+                      ) : (
+                        <FileIcon className="h-5 w-5 text-muted-foreground shrink-0" />
+                      )}
+                      <span className="flex-1 truncate text-sm text-foreground">
+                        {entry.name ?? entryPath.split("/").pop()}
+                      </span>
+                      {entry.is_directory && (
+                        <ChevronRight className="h-4 w-4 text-muted-foreground shrink-0" />
+                      )}
+                      {!entry.is_directory && entry.file_size !== undefined && (
+                        <span className="text-xs text-muted-foreground shrink-0">
+                          {formatFileSize(entry.file_size)}
+                        </span>
+                      )}
+                    </button>
+                  );
+                })}
+            </Card>
+          </div>
+
+          {/* Preview panel */}
+          <div className="flex-1 min-w-0">
+            <Card className="p-6">
+              {!selectedFile && (
+                <div className="text-center text-muted-foreground py-8">
+                  <FileIcon className="h-10 w-10 mx-auto mb-3 opacity-40" />
+                  <p className="text-sm">Select a file to preview</p>
+                </div>
+              )}
+
+              {selectedFile && previewLoading && (
+                <div className="space-y-3">
+                  <Skeleton className="h-5 w-3/4" />
+                  <Skeleton className="h-4 w-1/2" />
+                  <Skeleton className="h-4 w-2/3" />
+                  <Skeleton className="h-32 w-full mt-4" />
+                </div>
+              )}
+
+              {selectedFile && !previewLoading && preview && (
+                <div className="space-y-4">
+                  <div>
+                    <h3 className="font-semibold text-foreground truncate mb-1">
+                      {selectedFile.split("/").pop()}
+                    </h3>
+                    <p className="text-xs text-muted-foreground truncate">
+                      {selectedFile}
+                    </p>
+                  </div>
+
+                  <div className="space-y-2 text-sm">
+                    <div className="flex justify-between">
+                      <span className="text-muted-foreground">Size</span>
+                      <span className="text-foreground">
+                        {formatFileSize(preview.contentLength)}
+                      </span>
+                    </div>
+                    <div className="flex justify-between">
+                      <span className="text-muted-foreground">Type</span>
+                      <span className="text-foreground truncate ml-2">
+                        {preview.contentType ?? "Unknown"}
+                      </span>
+                    </div>
+                    {preview.lastModified && (
+                      <div className="flex justify-between">
+                        <span className="text-muted-foreground">Modified</span>
+                        <span className="text-foreground">
+                          {preview.lastModified}
+                        </span>
+                      </div>
+                    )}
+                  </div>
+
+                  <div className="flex gap-2">
+                    <Button
+                      variant="outline"
+                      size="sm"
+                      className="flex-1"
+                      onClick={() =>
+                        window.open(
+                          `/api/files/download?path=${encodeURIComponent(selectedFile)}`,
+                          "_blank",
+                        )
+                      }
+                    >
+                      <Download className="h-4 w-4 mr-2" />
+                      Download
+                    </Button>
+                    <Button
+                      variant="destructive"
+                      size="sm"
+                      disabled={deleting}
+                      onClick={handleDelete}
+                    >
+                      {deleting ? (
+                        <Loader2 className="h-4 w-4 animate-spin" />
+                      ) : (
+                        <Trash2 className="h-4 w-4" />
+                      )}
+                    </Button>
+                  </div>
+
+                  {preview.isImage && (
+                    <div className="border rounded overflow-hidden">
+                      <img
+                        src={`/api/files/raw?path=${encodeURIComponent(selectedFile)}`}
+                        alt={selectedFile.split("/").pop() ?? "Preview"}
+                        className="w-full h-auto"
+                      />
+                    </div>
+                  )}
+
+                  {preview.isText && preview.textPreview !== null && (
+                    <div className="border rounded">
+                      <pre className="p-3 text-xs font-mono overflow-auto max-h-80 whitespace-pre-wrap text-foreground bg-muted/30">
+                        {preview.textPreview}
+                      </pre>
+                    </div>
+                  )}
+
+                  {!preview.isText && !preview.isImage && (
+                    <div className="text-center py-4 text-sm text-muted-foreground">
+                      Preview not available for this file type.
+                    </div>
+                  )}
+                </div>
+              )}
+
+              {selectedFile && !previewLoading && !preview && (
+                <div className="text-center py-8">
+                  <AlertCircle className="h-8 w-8 text-destructive mx-auto mb-2" />
+                  <p className="text-sm text-destructive">
+                    Failed to load preview
+                  </p>
+                </div>
+              )}
+            </Card>
+          </div>
+        </div>
+      </div>
+    </div>
+  );
+}
diff --git a/apps/dev-playground/client/src/routes/index.tsx b/apps/dev-playground/client/src/routes/index.tsx
index c6d5b7fc..a34ddbae 100644
--- a/apps/dev-playground/client/src/routes/index.tsx
+++ b/apps/dev-playground/client/src/routes/index.tsx
@@ -126,6 +126,24 @@ function IndexRoute() {
             </div>
           </Card>
 
+          <Card className="p-6 hover:shadow-lg transition-shadow cursor-pointer">
+            <div className="flex flex-col h-full">
+              <h3 className="text-2xl font-semibold text-foreground mb-3">
+                File Browser
+              </h3>
+              <p className="text-muted-foreground mb-6 flex-grow">
+                Browse, preview, and download files from Databricks Volumes
+                using the Files plugin and Unity Catalog Files API.
+              </p>
+              <Button
+                onClick={() => navigate({ to: "/files" })}
+                className="w-full"
+              >
+                Browse Files
+              </Button>
+            </div>
+          </Card>
+
           <Card className="p-6 hover:shadow-lg transition-shadow cursor-pointer">
             <div className="flex flex-col h-full">
               <h3 className="text-2xl font-semibold text-foreground mb-3">
@@ -162,6 +180,25 @@ function IndexRoute() {
               </Button>
             </div>
           </Card>
+
+          <Card className="p-6 hover:shadow-lg transition-shadow cursor-pointer">
+            <div className="flex flex-col h-full">
+              <h3 className="text-2xl font-semibold text-foreground mb-3">
+                Lakebase Examples
+              </h3>
+              <p className="text-muted-foreground mb-6 flex-grow">
+                Four approaches to PostgreSQL database integration with
+                Databricks Lakebase: Raw driver, Drizzle ORM, TypeORM, and
+                Sequelize with OAuth token refresh.
+              </p>
+              <Button
+                onClick={() => navigate({ to: "/lakebase" })}
+                className="w-full"
+              >
+                Explore Lakebase Integration
+              </Button>
+            </div>
+          </Card>
         </div>
 
         <div className="text-center pt-12 border-t border-border">
diff --git a/apps/dev-playground/client/src/routes/lakebase.route.tsx b/apps/dev-playground/client/src/routes/lakebase.route.tsx
new file mode 100644
index 00000000..59694e24
--- /dev/null
+++ b/apps/dev-playground/client/src/routes/lakebase.route.tsx
@@ -0,0 +1,64 @@
+import {
+  Tabs,
+  TabsContent,
+  TabsList,
+  TabsTrigger,
+} from "@databricks/appkit-ui/react";
+import { createFileRoute, retainSearchParams } from "@tanstack/react-router";
+import {
+  ActivityLogsPanel,
+  OrdersPanel,
+  ProductsPanel,
+  TasksPanel,
+} from "@/components/lakebase";
+
+export const Route = createFileRoute("/lakebase")({
+  component: LakebaseRoute,
+  search: {
+    middlewares: [retainSearchParams(true)],
+  },
+});
+
+function LakebaseRoute() {
+  return (
+    <div className="min-h-screen bg-background">
+      <div className="max-w-6xl mx-auto px-6 py-12">
+        {/* Page header */}
+        <div className="mb-8">
+          <h1 className="text-3xl font-bold mb-2">Lakebase Examples</h1>
+          <p className="text-base text-muted-foreground">
+            Four approaches to PostgreSQL database integration with Databricks
+            Lakebase. Compare raw driver, Drizzle ORM, TypeORM, and Sequelize
+            side-by-side.
+          </p>
+        </div>
+
+        {/* Tabs for different examples */}
+        <Tabs defaultValue="raw" className="space-y-6">
+          <TabsList className="grid w-full grid-cols-4">
+            <TabsTrigger value="raw">Raw Driver</TabsTrigger>
+            <TabsTrigger value="drizzle">Drizzle ORM</TabsTrigger>
+            <TabsTrigger value="typeorm">TypeORM</TabsTrigger>
+            <TabsTrigger value="sequelize">Sequelize</TabsTrigger>
+          </TabsList>
+
+          <TabsContent value="raw">
+            <ProductsPanel />
+          </TabsContent>
+
+          <TabsContent value="drizzle">
+            <ActivityLogsPanel />
+          </TabsContent>
+
+          <TabsContent value="typeorm">
+            <TasksPanel />
+          </TabsContent>
+
+          <TabsContent value="sequelize">
+            <OrdersPanel />
+          </TabsContent>
+        </Tabs>
+      </div>
+    </div>
+  );
+}
diff --git a/apps/dev-playground/package.json b/apps/dev-playground/package.json
index c5781cf2..56357404 100644
--- a/apps/dev-playground/package.json
+++ b/apps/dev-playground/package.json
@@ -25,6 +25,10 @@
   "description": "",
   "dependencies": {
     "@databricks/appkit": "workspace:*",
+    "drizzle-orm": "^0.45.1",
+    "reflect-metadata": "^0.2.0",
+    "sequelize": "^6.37.7",
+    "typeorm": "^0.3.20",
     "zod": "^4.1.13"
   },
   "devDependencies": {
diff --git a/apps/dev-playground/server/index.ts b/apps/dev-playground/server/index.ts
index a56ba4a7..3e514140 100644
--- a/apps/dev-playground/server/index.ts
+++ b/apps/dev-playground/server/index.ts
@@ -1,5 +1,7 @@
-import { analytics, createApp, server } from "@databricks/appkit";
+import "reflect-metadata";
+import { analytics, createApp, files, server } from "@databricks/appkit";
 import { WorkspaceClient } from "@databricks/sdk-experimental";
+import { lakebaseExamples } from "./lakebase-examples-plugin";
 import { reconnect } from "./reconnect-plugin";
 import { telemetryExamples } from "./telemetry-example-plugin";
 
@@ -19,6 +21,8 @@ createApp({
     reconnect(),
     telemetryExamples(),
     analytics({}),
+    lakebaseExamples(),
+    files({ defaultVolume: process.env.DATABRICKS_DEFAULT_VOLUME }),
   ],
   ...(process.env.APPKIT_E2E_TEST && { client: createMockClient() }),
 }).then((appkit) => {
diff --git a/apps/dev-playground/server/lakebase-examples-plugin.ts b/apps/dev-playground/server/lakebase-examples-plugin.ts
new file mode 100644
index 00000000..556b53c4
--- /dev/null
+++ b/apps/dev-playground/server/lakebase-examples-plugin.ts
@@ -0,0 +1,85 @@
+import { Plugin, toPlugin } from "@databricks/appkit";
+import type { IAppRouter } from "shared";
+import * as drizzleExample from "./lakebase-examples/drizzle-example";
+import * as rawExample from "./lakebase-examples/raw-driver-example";
+import * as sequelizeExample from "./lakebase-examples/sequelize-example";
+import * as typeormExample from "./lakebase-examples/typeorm-example";
+
+/**
+ * Lakebase Examples Plugin
+ *
+ * Orchestrates four different approaches to database integration:
+ * 1. Raw pg.Pool driver - Direct SQL queries
+ * 2. Drizzle ORM - Type-safe schema definitions
+ * 3. TypeORM - Entity-based data access
+ * 4. Sequelize - Model-based ORM with intuitive API
+ *
+ * Each example is self-contained and can be used as a reference for
+ * implementing Lakebase integration in your own applications.
+ */
+
+export class LakebaseExamplesPlugin extends Plugin {
+  public name = "lakebase-examples";
+  protected envVars: string[] = [];
+
+  static manifest = {
+    name: "lakebase-examples",
+    displayName: "Lakebase Examples Plugin",
+    description: "A plugin that provides lakebase examples",
+    resources: {
+      required: [],
+      optional: [],
+    },
+  };
+
+  async setup() {
+    // Check if Lakebase is configured
+    if (!process.env.PGHOST || !process.env.LAKEBASE_ENDPOINT) {
+      console.warn(
+        "Lakebase not configured (missing PGHOST or LAKEBASE_ENDPOINT), examples disabled",
+      );
+      return;
+    }
+
+    try {
+      // Initialize all four examples in parallel
+      await Promise.all([
+        rawExample.setup(),
+        drizzleExample.setup(),
+        typeormExample.setup(),
+        sequelizeExample.setup(),
+      ]);
+    } catch (error) {
+      console.error("Failed to initialize Lakebase examples:", error);
+      // Don't throw - allow app to start even if Lakebase examples fail
+    }
+  }
+
+  injectRoutes(router: IAppRouter): void {
+    // Skip route injection if Lakebase is not configured
+    if (!process.env.PGHOST || !process.env.LAKEBASE_ENDPOINT) {
+      return;
+    }
+
+    // Register routes for each example under /api/lakebase-examples/*
+    rawExample.registerRoutes(router, "/raw");
+    drizzleExample.registerRoutes(router, "/drizzle");
+    typeormExample.registerRoutes(router, "/typeorm");
+    sequelizeExample.registerRoutes(router, "/sequelize");
+  }
+
+  async close() {
+    await Promise.all([
+      rawExample.cleanup(),
+      drizzleExample.cleanup(),
+      typeormExample.cleanup(),
+      sequelizeExample.cleanup(),
+    ]);
+  }
+}
+
+export const lakebaseExamples = toPlugin<
+  typeof LakebaseExamplesPlugin,
+  Record<string, never>,
+  "lakebase-examples"
+>(LakebaseExamplesPlugin, "lakebase-examples");
diff --git a/apps/dev-playground/server/lakebase-examples/drizzle-example.ts b/apps/dev-playground/server/lakebase-examples/drizzle-example.ts
new file mode 100644
index 00000000..f0aa6c30
--- /dev/null
+++ b/apps/dev-playground/server/lakebase-examples/drizzle-example.ts
@@ -0,0 +1,192 @@
+import { createLakebasePool } from "@databricks/appkit";
+import { count, desc, sql } from "drizzle-orm";
+import { drizzle } from "drizzle-orm/node-postgres";
+import {
+  index,
+  jsonb,
+  pgSchema,
+  serial,
+  timestamp,
+  varchar,
+} from "drizzle-orm/pg-core";
+import type { Pool } from "pg";
+import type { IAppRouter } from "shared";
+
+/**
+ * Drizzle ORM example with type-safe schema definitions.
+ *
+ * This example demonstrates:
+ * - Type-safe schema definitions with drizzle-orm
+ * - Automatic type inference from schema
+ * - Query builder with TypeScript autocompletion
+ * - Aggregations and complex queries
+ * - JSON field handling
+ */
+
+// Define schema
+const drizzleExampleSchema = pgSchema("drizzle_example");
+
+export const activityLogs = drizzleExampleSchema.table(
+  "activity_logs",
+  {
+    id: serial("id").primaryKey(),
+    userId: varchar("user_id", { length: 100 }).notNull(),
+    action: varchar("action", { length: 255 }).notNull(),
+    metadata: jsonb("metadata"),
+    timestamp: timestamp("timestamp").defaultNow(),
+  },
+  (table) => ({
+    userIdIdx: index("user_id_idx").on(table.userId),
+  }),
+);
+
+type NewActivityLog = typeof activityLogs.$inferInsert;
+
+let db: ReturnType<typeof drizzle>;
+let pool: Pool;
+
+export async function setup() {
+  pool = createLakebasePool();
+  db = drizzle(pool);
+
+  // For production apps, use: npx drizzle-kit push or drizzle-kit generate + migrate
+  await pool.query(`CREATE SCHEMA IF NOT EXISTS drizzle_example`);
+
+  // Create table using raw SQL
+  await pool.query(`
+    CREATE TABLE IF NOT EXISTS drizzle_example.activity_logs (
+      id SERIAL PRIMARY KEY,
+      user_id VARCHAR(100) NOT NULL,
+      action VARCHAR(255) NOT NULL,
+      metadata JSONB,
+      timestamp TIMESTAMP DEFAULT CURRENT_TIMESTAMP
+    );
+    CREATE INDEX IF NOT EXISTS user_id_idx 
+      ON drizzle_example.activity_logs(user_id);
+  `);
+
+  // Seed if empty
+  const countResult = await db.select({ count: count() }).from(activityLogs);
+  if (Number(countResult[0].count) === 0) {
+    await seedActivityLogs(db);
+  }
+}
+
+export function registerRoutes(router: IAppRouter, basePath: string) {
+  // GET /api/lakebase-examples/drizzle/activity - List activity logs
+  router.get(`${basePath}/activity`, async (_req, res) => {
+    try {
+      const logs = await db
+        .select()
+        .from(activityLogs)
+        .orderBy(desc(activityLogs.timestamp))
+        .limit(50);
+      res.json(logs);
+    } catch (error: unknown) {
+      const err = error as Error;
+      res.status(500).json({
+        error: "Failed to fetch activity logs",
+        message: err.message,
+      });
+    }
+  });
+
+  // POST /api/lakebase-examples/drizzle/activity - Create activity log
+  router.post(`${basePath}/activity`, async (req, res) => {
+    try {
+      const { userId, action, metadata } = req.body;
+      const [log] = await db
+        .insert(activityLogs)
+        .values({
+          userId,
+          action,
+          metadata: metadata || null,
+        })
+        .returning();
+      res.json(log);
+    } catch (error: unknown) {
+      const err = error as Error;
+      res.status(500).json({
+        error: "Failed to create activity log",
+        message: err.message,
+      });
+    }
+  });
+
+  // GET /api/lakebase-examples/drizzle/stats - Aggregated statistics
+  router.get(`${basePath}/stats`, async (_req, res) => {
+    try {
+      // Total logs count
+      const totalResult = await db
+        .select({ count: count() })
+        .from(activityLogs);
+
+      // Unique users count
+      const uniqueUsersResult = await db
+        .select({
+          count: sql<number>`COUNT(DISTINCT ${activityLogs.userId})`,
+        })
+        .from(activityLogs);
+
+      // Recent activity (last 24 hours)
+      const recentResult = await db
+        .select({ count: count() })
+        .from(activityLogs)
+        .where(sql`${activityLogs.timestamp} > NOW() - INTERVAL '24 hours'`);
+
+      res.json({
+        totalLogs: Number(totalResult[0].count),
+        uniqueUsers: Number(uniqueUsersResult[0].count),
+        recentActivity: Number(recentResult[0].count),
+      });
+    } catch (error: unknown) {
+      const err = error as Error;
+      res.status(500).json({
+        error: "Failed to fetch statistics",
+        message: err.message,
+      });
+    }
+  });
+}
+
+export async function cleanup() {
+  await pool.end();
+}
+
+async function seedActivityLogs(database: ReturnType<typeof drizzle>) {
+  const users = ["alice", "bob", "charlie", "diana", "eve"];
+  const actions = [
+    "login",
+    "logout",
+    "view_dashboard",
+    "create_report",
+    "update_settings",
+    "delete_item",
+    "export_data",
+    "share_document",
+  ];
+
+  const logs: NewActivityLog[] = [];
+
+  // Generate 30 sample activity logs
+  for (let i = 0; i < 30; i++) {
+    const userId = users[Math.floor(Math.random() * users.length)];
+    const action = actions[Math.floor(Math.random() * actions.length)];
+    const metadata =
+      Math.random() > 0.5
+        ? {
+            ip: `192.168.1.${Math.floor(Math.random() * 255)}`,
+            userAgent: "Mozilla/5.0",
+            duration: Math.floor(Math.random() * 5000),
+          }
+        : null;
+
+    logs.push({
+      userId,
+      action,
+      metadata,
+    });
+  }
+
+  await database.insert(activityLogs).values(logs);
+}
diff --git a/apps/dev-playground/server/lakebase-examples/raw-driver-example.ts b/apps/dev-playground/server/lakebase-examples/raw-driver-example.ts
new file mode 100644
index 00000000..66d2ecb7
--- /dev/null
+++ b/apps/dev-playground/server/lakebase-examples/raw-driver-example.ts
@@ -0,0 +1,175 @@
+import { createLakebasePool } from "@databricks/appkit";
+import type { Pool } from "pg";
+import type { IAppRouter } from "shared";
+
+let pool: Pool;
+
+/**
+ * Raw PostgreSQL driver example using pg.Pool with automatic OAuth token refresh.
+ *
+ * This example demonstrates:
+ * - Direct pg.Pool usage without ORM abstraction
+ * - Manual SQL query writing with parameterized queries
+ * - Schema and table creation (idempotent)
+ * - Basic CRUD operations
+ * - Connection health checking
+ */
+
+interface Product {
+  id: number;
+  name: string;
+  category: string;
+  price: number;
+  stock: number;
+  created_by?: string;
+  created_at: Date;
+}
+
+export async function setup() {
+  // Create pool with automatic OAuth token refresh
+  pool = createLakebasePool();
+
+  // Create schema and table (idempotent)
+  await pool.query(`
+    CREATE SCHEMA IF NOT EXISTS raw_example;
+
+    CREATE TABLE IF NOT EXISTS raw_example.products (
+      id SERIAL PRIMARY KEY,
+      name VARCHAR(255) NOT NULL,
+      category VARCHAR(100),
+      price DECIMAL(10, 2),
+      stock INTEGER DEFAULT 0,
+      created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
+    );
+  `);
+
+  // Seed sample data if table is empty
+  const { rows } = await pool.query<{ count: string }>(
+    "SELECT COUNT(*) as count FROM raw_example.products",
+  );
+  if (Number(rows[0].count) === 0) {
+    await seedProducts(pool);
+  }
+}
+
+export function registerRoutes(router: IAppRouter, basePath: string) {
+  // GET /api/lakebase-examples/raw/products - List all products
+  router.get(`${basePath}/products`, async (_req, res) => {
+    try {
+      const result = await pool.query<Product>(
+        "SELECT * FROM raw_example.products ORDER BY id",
+      );
+      res.json(result.rows);
+    } catch (error: unknown) {
+      const err = error as Error;
+      res.status(500).json({
+        error: "Failed to fetch products",
+        message: err.message,
+      });
+    }
+  });
+
+  // POST /api/lakebase-examples/raw/products - Create new product
+  router.post(`${basePath}/products`, async (req, res) => {
+    try {
+      const { name, category, price, stock } = req.body;
+
+      const result = await pool.query<Product>(
+        `INSERT INTO raw_example.products (name, category, price, stock)
+           VALUES ($1, $2, $3, $4) RETURNING *`,
+        [name, category, Number(price), Number(stock)],
+      );
+      res.json(result.rows[0]);
+    } catch (error: unknown) {
+      const err = error as Error;
+      res.status(500).json({
+        error: "Failed to create product",
+        message: err.message,
+      });
+    }
+  });
+
+  // GET /api/lakebase-examples/raw/health - Connection health check
+  router.get(`${basePath}/health`, async (_req, res) => {
+    try {
+      await pool.query("SELECT 1");
+      res.json({
+        status: "healthy",
+        connected: true,
+        message: "Connection to Lakebase is active",
+      });
+    } catch (error: unknown) {
+      const err = error as Error;
+      res.status(503).json({
+        status: "unhealthy",
+        connected: false,
+        message: err.message,
+      });
+    }
+  });
+}
+
+export async function cleanup() {
+  await pool.end();
+}
+
+async function seedProducts(pool: Pool) {
+  const products = [
+    {
+      name: "Wireless Mouse",
+      category: "Electronics",
+      price: 29.99,
+      stock: 150,
+    },
+    {
+      name: "Mechanical Keyboard",
+      category: "Electronics",
+      price: 89.99,
+      stock: 75,
+    },
+    {
+      name: "USB-C Hub",
+      category: "Electronics",
+      price: 49.99,
+      stock: 200,
+    },
+    {
+      name: "The Pragmatic Programmer",
+      category: "Books",
+      price: 39.99,
+      stock: 50,
+    },
+    {
+      name: "Clean Code",
+      category: "Books",
+      price: 42.99,
+      stock: 60,
+    },
+    {
+      name: "Cotton T-Shirt",
+      category: "Clothing",
+      price: 19.99,
+      stock: 300,
+    },
+    {
+      name: "Denim Jeans",
+      category: "Clothing",
+      price: 59.99,
+      stock: 120,
+    },
+    {
+      name: "Running Shoes",
+      category: "Clothing",
+      price: 79.99,
+      stock: 85,
+    },
+  ];
+
+  for (const product of products) {
+    await pool.query(
+      `INSERT INTO raw_example.products (name, category, price, stock)
+       VALUES ($1, $2, $3, $4)`,
+      [product.name, product.category, product.price, product.stock],
+    );
+  }
+}
diff --git a/apps/dev-playground/server/lakebase-examples/sequelize-example.ts b/apps/dev-playground/server/lakebase-examples/sequelize-example.ts
new file mode 100644
index 00000000..f9f5b513
--- /dev/null
+++ b/apps/dev-playground/server/lakebase-examples/sequelize-example.ts
@@ -0,0 +1,273 @@
+import { getLakebaseOrmConfig } from "@databricks/appkit";
+import { DataTypes, Model, Sequelize } from "sequelize";
+import type { IAppRouter } from "shared";
+
+/**
+ * Sequelize example with model-based data access.
+ *
+ * This example demonstrates:
+ * - Model definitions with DataTypes
+ * - Standard ORM operations (CRUD)
+ * - OAuth token authentication with Sequelize
+ * - Type-safe queries with TypeScript
+ * - Automatic timestamps
+ */
+
+interface OrderAttributes {
+  id: number;
+  orderNumber: string;
+  customerName: string;
+  productName: string;
+  amount: number;
+  status: "pending" | "processing" | "shipped" | "delivered";
+  createdAt: Date;
+  updatedAt: Date;
+}
+
+interface OrderCreationAttributes
+  extends Omit<OrderAttributes, "id" | "createdAt" | "updatedAt"> {}
+
+class Order
+  extends Model<OrderAttributes, OrderCreationAttributes>
+  implements OrderAttributes
+{
+  declare id: number;
+  declare orderNumber: string;
+  declare customerName: string;
+  declare productName: string;
+  declare amount: number;
+  declare status: "pending" | "processing" | "shipped" | "delivered";
+  declare createdAt: Date;
+  declare updatedAt: Date;
+}
+
+let sequelize: Sequelize;
+
+export async function setup() {
+  // @ts-expect-error password property supports a function for Lakehouse OAuth tokens
+  sequelize = new Sequelize({
+    dialect: "postgres",
+    ...getLakebaseOrmConfig(),
+    logging: false,
+  });
+
+  // Create schema if not exists
+  await sequelize.query("CREATE SCHEMA IF NOT EXISTS sequelize_example");
+
+  // Define Order model
+  Order.init(
+    {
+      id: {
+        type: DataTypes.INTEGER,
+        primaryKey: true,
+        autoIncrement: true,
+      },
+      orderNumber: {
+        type: DataTypes.STRING(50),
+        allowNull: false,
+        field: "order_number",
+      },
+      customerName: {
+        type: DataTypes.STRING(255),
+        allowNull: false,
+        field: "customer_name",
+      },
+      productName: {
+        type: DataTypes.STRING(255),
+        allowNull: false,
+        field: "product_name",
+      },
+      amount: {
+        type: DataTypes.DECIMAL(10, 2),
+        allowNull: false,
+      },
+      status: {
+        type: DataTypes.STRING(50),
+        allowNull: false,
+        defaultValue: "pending",
+      },
+      createdAt: {
+        type: DataTypes.DATE,
+        allowNull: false,
+        field: "created_at",
+      },
+      updatedAt: {
+        type: DataTypes.DATE,
+        allowNull: false,
+        field: "updated_at",
+      },
+    },
+    {
+      sequelize,
+      schema: "sequelize_example",
+      tableName: "orders",
+      timestamps: true,
+      underscored: true,
+    },
+  );
+
+  // Sync model (create table if not exists)
+  await Order.sync();
+
+  // Seed data if table is empty
+  const count = await Order.count();
+  if (count === 0) {
+    await seedOrders();
+  }
+}
+
+export function registerRoutes(router: IAppRouter, basePath: string) {
+  // GET /api/lakebase-examples/sequelize/orders - List all orders
+  router.get(`${basePath}/orders`, async (_req, res) => {
+    try {
+      const orders = await Order.findAll({
+        order: [["createdAt", "DESC"]],
+      });
+      res.json(orders);
+    } catch (error: unknown) {
+      const err = error as Error;
+      res.status(500).json({
+        error: "Failed to fetch orders",
+        message: err.message,
+      });
+    }
+  });
+
+  // POST /api/lakebase-examples/sequelize/orders - Create new order
+  router.post(`${basePath}/orders`, async (req, res) => {
+    try {
+      const { orderNumber, customerName, productName, amount, status } =
+        req.body;
+      const order = await Order.create({
+        orderNumber,
+        customerName,
+        productName,
+        amount,
+        status: status || "pending",
+      });
+      res.json(order);
+    } catch (error: unknown) {
+      const err = error as Error;
+      res.status(500).json({
+        error: "Failed to create order",
+        message: err.message,
+      });
+    }
+  });
+
+  // PATCH /api/lakebase-examples/sequelize/orders/:id - Update order status
+  router.patch(`${basePath}/orders/:id`, async (req, res) => {
+    try {
+      const { status } = req.body;
+      const order = await Order.findByPk(req.params.id);
+
+      if (!order) {
+        res.status(404).json({
+          error: "Order not found",
+          message: `Order with id ${req.params.id} does not exist`,
+        });
+        return;
+      }
+
+      order.status = status;
+      await order.save();
+      res.json(order);
+    } catch (error: unknown) {
+      const err = error as Error;
+      res.status(500).json({
+        error: "Failed to update order",
+        message: err.message,
+      });
+    }
+  });
+
+  // GET /api/lakebase-examples/sequelize/stats - Order statistics
+  router.get(`${basePath}/stats`, async (_req, res) => {
+    try {
+      const [total, pending, processing, shipped, delivered] =
+        await Promise.all([
+          Order.count(),
+          Order.count({ where: { status: "pending" } }),
+          Order.count({ where: { status: "processing" } }),
+          Order.count({ where: { status: "shipped" } }),
+          Order.count({ where: { status: "delivered" } }),
+        ]);
+      res.json({ total, pending, processing, shipped, delivered });
+    } catch (error: unknown) {
+      const err = error as Error;
+      res.status(500).json({
+        error: "Failed to fetch statistics",
+        message: err.message,
+      });
+    }
+  });
+}
+
+export async function cleanup() {
+  if (sequelize) {
+    await sequelize.close();
+  }
+}
+
+async function seedOrders() {
+  const orders = [
+    {
+      orderNumber: "ORD-2024-001",
+      customerName: "Alice Johnson",
+      productName: "Wireless Bluetooth Headphones",
+      amount: 89.99,
+      status: "delivered" as const,
+    },
+    {
+      orderNumber: "ORD-2024-002",
+      customerName: "Bob Smith",
+      productName: "USB-C Charging Cable",
+      amount: 15.99,
+      status: "delivered" as const,
+    },
+    {
+      orderNumber: "ORD-2024-003",
+      customerName: "Carol Williams",
+      productName: "Laptop Stand - Ergonomic",
+      amount: 45.5,
+      status: "shipped" as const,
+    },
+    {
+      orderNumber: "ORD-2024-004",
+      customerName: "David Brown",
+      productName: "Mechanical Keyboard - RGB",
+      amount: 129.99,
+      status: "processing" as const,
+    },
+    {
+      orderNumber: "ORD-2024-005",
+      customerName: "Emma Davis",
+      productName: "4K Webcam with Microphone",
+      amount: 79.99,
+      status: "processing" as const,
+    },
+    {
+      orderNumber: "ORD-2024-006",
+      customerName: "Frank Miller",
+      productName: "Portable SSD 1TB",
+      amount: 149.99,
+      status: "pending" as const,
+    },
+    {
+      orderNumber: "ORD-2024-007",
+      customerName: "Grace Wilson",
+      productName: "Wireless Mouse - Ergonomic",
+      amount: 34.99,
+      status: "pending" as const,
+    },
+    {
+      orderNumber: "ORD-2024-008",
+      customerName: "Henry Moore",
+      productName: "Monitor Arm Mount",
+      amount: 59.99,
+      status: "pending" as const,
+    },
+  ];
+
+  await Order.bulkCreate(orders);
+}
diff --git a/apps/dev-playground/server/lakebase-examples/typeorm-example.ts b/apps/dev-playground/server/lakebase-examples/typeorm-example.ts
new file mode 100644
index 00000000..171da14e
--- /dev/null
+++ b/apps/dev-playground/server/lakebase-examples/typeorm-example.ts
@@ -0,0 +1,201 @@
+import { createLakebasePool, getLakebaseOrmConfig } from "@databricks/appkit";
+import type { IAppRouter } from "shared";
+import {
+  Column,
+  CreateDateColumn,
+  DataSource,
+  Entity,
+  PrimaryGeneratedColumn,
+} from "typeorm";
+
+/**
+ * TypeORM example with entity-based data access.
+ *
+ * This example demonstrates:
+ * - Entity classes with decorators
+ * - Repository pattern for data access
+ * - OAuth token authentication with TypeORM
+ * - CRUD operations with type safety
+ * - Query builder capabilities
+ */
+
+@Entity({ schema: "typeorm_example", name: "tasks" })
+class Task {
+  @PrimaryGeneratedColumn()
+  id!: number;
+
+  @Column({ type: "varchar", length: 255 })
+  title!: string;
+
+  @Column({
+    type: "varchar",
+    length: 50,
+    default: "pending",
+  })
+  status!: "pending" | "in_progress" | "completed";
+
+  @Column({ type: "text", nullable: true })
+  description?: string;
+
+  @CreateDateColumn({ name: "created_at", type: "timestamp" })
+  createdAt!: Date;
+}
+
+let dataSource: DataSource;
+
+export async function setup() {
+  // Create schema if not exists (TypeORM's synchronize doesn't create schemas)
+  // See https://github.com/typeorm/typeorm/issues/3192
+  const pool = createLakebasePool();
+  await pool.query("CREATE SCHEMA IF NOT EXISTS typeorm_example");
+  await pool.end();
+
+  dataSource = new DataSource({
+    type: "postgres",
+    ...getLakebaseOrmConfig(),
+    entities: [Task],
+    synchronize: true,
+    logging: false,
+  });
+
+  await dataSource.initialize();
+
+  const taskRepo = dataSource.getRepository(Task);
+  const count = await taskRepo.count();
+  if (count === 0) {
+    await seedTasks(taskRepo);
+  }
+}
+
+export function registerRoutes(router: IAppRouter, basePath: string) {
+  // GET /api/lakebase-examples/typeorm/tasks - List all tasks
+  router.get(`${basePath}/tasks`, async (_req, res) => {
+    try {
+      const taskRepo = dataSource.getRepository(Task);
+      const tasks = await taskRepo.find({ order: { createdAt: "DESC" } });
+      res.json(tasks);
+    } catch (error: unknown) {
+      const err = error as Error;
+      res.status(500).json({
+        error: "Failed to fetch tasks",
+        message: err.message,
+      });
+    }
+  });
+
+  // POST /api/lakebase-examples/typeorm/tasks - Create new task
+  router.post(`${basePath}/tasks`, async (req, res) => {
+    try {
+      const taskRepo = dataSource.getRepository(Task);
+      const { title, description, status } = req.body;
+      const task = taskRepo.create({
+        title,
+        description,
+        status: status || "pending",
+      });
+      await taskRepo.save(task);
+      res.json(task);
+    } catch (error: unknown) {
+      const err = error as Error;
+      res.status(500).json({
+        error: "Failed to create task",
+        message: err.message,
+      });
+    }
+  });
+
+  // PATCH /api/lakebase-examples/typeorm/tasks/:id - Update task status
+  router.patch(`${basePath}/tasks/:id`, async (req, res) => {
+    try {
+      const taskRepo = dataSource.getRepository(Task);
+      const { status } = req.body;
+      await taskRepo.update(req.params.id, { status });
+      const updated = await taskRepo.findOne({
+        where: { id: Number(req.params.id) },
+      });
+      res.json(updated);
+    } catch (error: unknown) {
+      const err = error as Error;
+      res.status(500).json({
+        error: "Failed to update task",
+        message: err.message,
+      });
+    }
+  });
+
+  // GET /api/lakebase-examples/typeorm/stats - Task statistics
+  router.get(`${basePath}/stats`, async (_req, res) => {
+    try {
+      const taskRepo = dataSource.getRepository(Task);
+      const [total, pending, inProgress, completed] = await Promise.all([
+        taskRepo.count(),
+        taskRepo.count({ where: { status: "pending" } }),
+        taskRepo.count({ where: { status: "in_progress" } }),
+        taskRepo.count({ where: { status: "completed" } }),
+      ]);
+      res.json({ total, pending, inProgress, completed });
+    } catch (error: unknown) {
+      const err = error as Error;
+      res.status(500).json({
+        error: "Failed to fetch statistics",
+        message: err.message,
+      });
+    }
+  });
+}
+
+export async function cleanup() {
+  if (dataSource.isInitialized) {
+    await dataSource.destroy();
+  }
+}
+
+async function seedTasks(repo: any) {
+  const tasks = [
+    {
+      title: "Set up development environment",
+      description: "Install Node.js, pnpm, and configure IDE",
+      status: "completed" as const,
+    },
+    {
+      title: "Implement user authentication",
+      description: "Add OAuth2 authentication flow with JWT tokens",
+      status: "in_progress" as const,
+    },
+    {
+      title: "Design database schema",
+      description: "Create ERD and define table relationships",
+      status: "completed" as const,
+    },
+    {
+      title: "Write API documentation",
+      description: "Document all REST endpoints with examples",
+      status: "pending" as const,
+    },
+    {
+      title: "Implement data validation",
+      description: "Add Zod schemas for request validation",
+      status: "in_progress" as const,
+    },
+    {
+      title: "Set up CI/CD pipeline",
+      description: "Configure GitHub Actions for automated testing",
+      status: "pending" as const,
+    },
+    {
+      title: "Add error monitoring",
+      description: "Integrate Sentry for error tracking",
+      status: "pending" as const,
+    },
+    {
+      title: "Optimize database queries",
+      description: "Add indexes and analyze slow queries",
+      status: "pending" as const,
+    },
+  ];
+
+  for (const taskData of tasks) {
+    const task = repo.create(taskData);
+    await repo.save(task);
+  }
+}
diff --git a/apps/dev-playground/tsconfig.json b/apps/dev-playground/tsconfig.json
index 1be74cd9..986d7131 100644
--- a/apps/dev-playground/tsconfig.json
+++ b/apps/dev-playground/tsconfig.json
@@ -2,7 +2,9 @@
   "extends": "../../tsconfig.json",
   "compilerOptions": {
     "baseUrl": ".",
-    "outDir": "./build"
+    "outDir": "./build",
+    "experimentalDecorators": true,
+    "emitDecoratorMetadata": true
   },
   "exclude": ["node_modules", "build"]
 }
diff --git a/docs/docs/api/appkit/Class.Plugin.md b/docs/docs/api/appkit/Class.Plugin.md
index 64de5830..5f7bae17 100644
--- a/docs/docs/api/appkit/Class.Plugin.md
+++ b/docs/docs/api/appkit/Class.Plugin.md
@@ -345,6 +345,24 @@ BasePlugin.getEndpoints
 
 ***
 
+### getSkipBodyParsingPaths()
+
+```ts
+getSkipBodyParsingPaths(): ReadonlySet<string>;
+```
+
+#### Returns
+
+`ReadonlySet`\<`string`\>
+
+#### Implementation of
+
+```ts
+BasePlugin.getSkipBodyParsingPaths
+```
+
+***
+
 ### injectRoutes()
 
 ```ts
diff --git a/docs/docs/api/appkit/Enumeration.RequestedClaimsPermissionSet.md b/docs/docs/api/appkit/Enumeration.RequestedClaimsPermissionSet.md
new file mode 100644
index 00000000..7f9431f8
--- /dev/null
+++ b/docs/docs/api/appkit/Enumeration.RequestedClaimsPermissionSet.md
@@ -0,0 +1,13 @@
+# Enumeration: RequestedClaimsPermissionSet
+
+Permission set for Unity Catalog table access
+
+## Enumeration Members
+
+### READ\_ONLY
+
+```ts
+READ_ONLY: "READ_ONLY";
+```
+
+Read-only access to specified UC tables
diff --git a/docs/docs/api/appkit/Function.contentTypeFromPath.md b/docs/docs/api/appkit/Function.contentTypeFromPath.md
new file mode 100644
index 00000000..b146b2b0
--- /dev/null
+++ b/docs/docs/api/appkit/Function.contentTypeFromPath.md
@@ -0,0 +1,29 @@
+# Function: contentTypeFromPath()
+
+```ts
+function contentTypeFromPath(
+   filePath: string, 
+   reported?: string, 
+   customTypes?: Record<string, string>): string;
+```
+
+Resolve the MIME content type for a file path.
+
+Resolution order:
+1. Custom type map (if the extension matches a key in `customTypes`).
+2. Built-in extension map (EXTENSION\_CONTENT\_TYPES).
+3. The `reported` type from the server, or `application/octet-stream` as a fallback.
+
+## Parameters
+
+| Parameter | Type | Description |
+| ------ | ------ | ------ |
+| `filePath` | `string` | File path used to extract the extension. |
+| `reported?` | `string` | Content type reported by the server (used as fallback). |
+| `customTypes?` | `Record`\<`string`, `string`\> | Optional map of extensions to MIME types that takes priority. |
+
+## Returns
+
+`string`
+
+The resolved MIME content type string.
diff --git a/docs/docs/api/appkit/Function.createLakebasePool.md b/docs/docs/api/appkit/Function.createLakebasePool.md
new file mode 100644
index 00000000..c3b5b010
--- /dev/null
+++ b/docs/docs/api/appkit/Function.createLakebasePool.md
@@ -0,0 +1,20 @@
+# Function: createLakebasePool()
+
+```ts
+function createLakebasePool(config?: Partial<LakebasePoolConfig>): Pool;
+```
+
+Create a Lakebase pool with appkit's logger integration.
+Telemetry automatically uses appkit's OpenTelemetry configuration via global registry.
+
+## Parameters
+
+| Parameter | Type | Description |
+| ------ | ------ | ------ |
+| `config?` | `Partial`\<[`LakebasePoolConfig`](Interface.LakebasePoolConfig.md)\> | Lakebase pool configuration |
+
+## Returns
+
+`Pool`
+
+PostgreSQL pool with appkit integration
diff --git a/docs/docs/api/appkit/Function.generateDatabaseCredential.md b/docs/docs/api/appkit/Function.generateDatabaseCredential.md
new file mode 100644
index 00000000..616b4e5e
--- /dev/null
+++ b/docs/docs/api/appkit/Function.generateDatabaseCredential.md
@@ -0,0 +1,56 @@
+# Function: generateDatabaseCredential()
+
+```ts
+function generateDatabaseCredential(workspaceClient: WorkspaceClient, request: GenerateDatabaseCredentialRequest): Promise<DatabaseCredential>;
+```
+
+Generate OAuth credentials for Postgres database connection using the proper Postgres API.
+
+This generates a time-limited OAuth token (expires after 1 hour) that can be used
+as a password when connecting to Lakebase Postgres databases.
+
+## Parameters
+
+| Parameter | Type | Description |
+| ------ | ------ | ------ |
+| `workspaceClient` | `WorkspaceClient` | Databricks workspace client for authentication |
+| `request` | [`GenerateDatabaseCredentialRequest`](Interface.GenerateDatabaseCredentialRequest.md) | Request parameters including endpoint path and optional UC claims |
+
+## Returns
+
+`Promise`\<[`DatabaseCredential`](Interface.DatabaseCredential.md)\>
+
+Database credentials with OAuth token and expiration time
+
+## See
+
+https://docs.databricks.com/aws/en/oltp/projects/authentication
+
+## Examples
+
+```typescript
+// Use the `name` field from the Databricks CLI output:
+// `databricks postgres list-endpoints projects/{project-id}/branches/{branch-id}`
+const credential = await generateDatabaseCredential(workspaceClient, {
+  endpoint: "projects/{project-id}/branches/{branch-id}/endpoints/{endpoint-identifier}"
+});
+
+// Use credential.token as password
+const conn = await pg.connect({
+  host: "ep-abc123.database.us-east-1.databricks.com",
+  user: "user@example.com",
+  password: credential.token
+});
+```
+
+```typescript
+// Use the `name` field from the Databricks CLI output:
+// `databricks postgres list-endpoints projects/{project-id}/branches/{branch-id}`
+const credential = await generateDatabaseCredential(workspaceClient, {
+  endpoint: "projects/{project-id}/branches/{branch-id}/endpoints/{endpoint-identifier}",
+  claims: [{
+    permission_set: RequestedClaimsPermissionSet.READ_ONLY,
+    resources: [{ table_name: "catalog.schema.users" }]
+  }]
+});
+```
diff --git a/docs/docs/api/appkit/Function.getLakebaseOrmConfig.md b/docs/docs/api/appkit/Function.getLakebaseOrmConfig.md
new file mode 100644
index 00000000..4e98e74c
--- /dev/null
+++ b/docs/docs/api/appkit/Function.getLakebaseOrmConfig.md
@@ -0,0 +1,84 @@
+# Function: getLakebaseOrmConfig()
+
+```ts
+function getLakebaseOrmConfig(config?: Partial<LakebasePoolConfig>): {
+  password: string | () => string | () => Promise<string> | undefined;
+  ssl:   | boolean
+     | {
+     rejectUnauthorized: boolean | undefined;
+   };
+  username: string | undefined;
+};
+```
+
+Get Lakebase connection configuration for ORMs that don't accept pg.Pool directly.
+
+Designed for ORMs like TypeORM and Sequelize that need connection parameters
+rather than a pre-configured pool instance.
+
+Returns connection config with field names compatible with common ORMs:
+- `username` instead of `user`
+- Simplified SSL config
+- Password callback support for OAuth token refresh
+
+## Parameters
+
+| Parameter | Type | Description |
+| ------ | ------ | ------ |
+| `config?` | `Partial`\<[`LakebasePoolConfig`](Interface.LakebasePoolConfig.md)\> | Optional configuration (reads from environment if not provided) |
+
+## Returns
+
+```ts
+{
+  password: string | () => string | () => Promise<string> | undefined;
+  ssl:   | boolean
+     | {
+     rejectUnauthorized: boolean | undefined;
+   };
+  username: string | undefined;
+}
+```
+
+ORM-compatible connection configuration
+
+### password
+
+```ts
+password: string | () => string | () => Promise<string> | undefined;
+```
+
+### ssl
+
+```ts
+ssl: 
+  | boolean
+  | {
+  rejectUnauthorized: boolean | undefined;
+};
+```
+
+### username
+
+```ts
+username: string | undefined = user;
+```
+
+## Example
+
+```typescript
+// TypeORM
+const dataSource = new DataSource({
+  type: 'postgres',
+  ...getLakebaseOrmConfig(),
+  entities: [User],
+  synchronize: true,
+});
+
+// Sequelize
+const sequelize = new Sequelize({
+  dialect: 'postgres',
+  ...getLakebaseOrmConfig(),
+  logging: false,
+});
+```
diff --git a/docs/docs/api/appkit/Function.getLakebasePgConfig.md b/docs/docs/api/appkit/Function.getLakebasePgConfig.md
new file mode 100644
index 00000000..e604f43b
--- /dev/null
+++ b/docs/docs/api/appkit/Function.getLakebasePgConfig.md
@@ -0,0 +1,31 @@
+# Function: getLakebasePgConfig()
+
+```ts
+function getLakebasePgConfig(
+   config?: Partial<LakebasePoolConfig>, 
+   telemetry?: DriverTelemetry, 
+   logger?: Logger): PoolConfig;
+```
+
+Get Lakebase connection configuration for PostgreSQL clients.
+
+Returns pg.PoolConfig with OAuth token authentication configured.
+Best used with pg.Pool directly or ORMs that accept pg.Pool instances (like Drizzle).
+
+For ORMs that need connection parameters (TypeORM, Sequelize), use getLakebaseOrmConfig() instead.
+
+Used internally by createLakebasePool().
+
+## Parameters
+
+| Parameter | Type | Description |
+| ------ | ------ | ------ |
+| `config?` | `Partial`\<[`LakebasePoolConfig`](Interface.LakebasePoolConfig.md)\> | Optional configuration (reads from environment if not provided) |
+| `telemetry?` | `DriverTelemetry` | Optional pre-initialized telemetry (created internally if not provided) |
+| `logger?` | `Logger` | Optional logger (silent if not provided) |
+
+## Returns
+
+`PoolConfig`
+
+PostgreSQL pool configuration with OAuth token refresh
diff --git a/docs/docs/api/appkit/Function.getWorkspaceClient.md b/docs/docs/api/appkit/Function.getWorkspaceClient.md
new file mode 100644
index 00000000..f8b856b2
--- /dev/null
+++ b/docs/docs/api/appkit/Function.getWorkspaceClient.md
@@ -0,0 +1,17 @@
+# Function: getWorkspaceClient()
+
+```ts
+function getWorkspaceClient(config: Partial<LakebasePoolConfig>): Promise<WorkspaceClient>;
+```
+
+Get workspace client from config or SDK default auth chain
+
+## Parameters
+
+| Parameter | Type |
+| ------ | ------ |
+| `config` | `Partial`\<[`LakebasePoolConfig`](Interface.LakebasePoolConfig.md)\> |
+
+## Returns
+
+`Promise`\<`WorkspaceClient`\>
diff --git a/docs/docs/api/appkit/Interface.DatabaseCredential.md b/docs/docs/api/appkit/Interface.DatabaseCredential.md
new file mode 100644
index 00000000..b2a0b255
--- /dev/null
+++ b/docs/docs/api/appkit/Interface.DatabaseCredential.md
@@ -0,0 +1,30 @@
+# Interface: DatabaseCredential
+
+Database credentials with OAuth token for Postgres connection
+
+## Properties
+
+### expire\_time
+
+```ts
+expire_time: string;
+```
+
+Token expiration time in UTC (ISO 8601 format)
+Tokens expire after 1 hour from generation
+
+#### Example
+
+```ts
+"2026-02-06T17:07:00Z"
+```
+
+***
+
+### token
+
+```ts
+token: string;
+```
+
+OAuth token to use as the password when connecting to Postgres
diff --git a/docs/docs/api/appkit/Interface.GenerateDatabaseCredentialRequest.md b/docs/docs/api/appkit/Interface.GenerateDatabaseCredentialRequest.md
new file mode 100644
index 00000000..259995cd
--- /dev/null
+++ b/docs/docs/api/appkit/Interface.GenerateDatabaseCredentialRequest.md
@@ -0,0 +1,45 @@
+# Interface: GenerateDatabaseCredentialRequest
+
+Request parameters for generating database OAuth credentials
+
+## Properties
+
+### claims?
+
+```ts
+optional claims: RequestedClaims[];
+```
+
+Optional claims for fine-grained UC table permissions.
+When specified, the token will only grant access to the specified tables.
+
+#### Example
+
+```typescript
+{
+  claims: [{
+    permission_set: RequestedClaimsPermissionSet.READ_ONLY,
+    resources: [{ table_name: "catalog.schema.users" }]
+  }]
+}
+```
+
+***
+
+### endpoint
+
+```ts
+endpoint: string;
+```
+
+Endpoint resource path. Retrieve using the Databricks CLI:
+```
+databricks postgres list-endpoints projects/{project-id}/branches/{branch-id}
+```
+Use the `name` field from the output.
+
+#### Example
+
+```ts
+"projects/{project-id}/branches/{branch-id}/endpoints/{endpoint-identifier}"
+```
diff --git a/docs/docs/api/appkit/Interface.LakebasePoolConfig.md b/docs/docs/api/appkit/Interface.LakebasePoolConfig.md
new file mode 100644
index 00000000..3f40f302
--- /dev/null
+++ b/docs/docs/api/appkit/Interface.LakebasePoolConfig.md
@@ -0,0 +1,116 @@
+# Interface: LakebasePoolConfig
+
+Configuration for creating a Lakebase connection pool
+
+Supports two authentication methods:
+1. OAuth token authentication - Provide workspaceClient + endpoint (automatic token rotation)
+2. Native Postgres password authentication - Provide password string or function
+
+Extends pg.PoolConfig to support all standard PostgreSQL pool options.
+
+## See
+
+https://docs.databricks.com/aws/en/oltp/projects/authentication
+
+## Extends
+
+- `PoolConfig`
+
+## Properties
+
+### endpoint?
+
+```ts
+optional endpoint: string;
+```
+
+Endpoint resource path for OAuth token generation.
+
+Retrieve the value using the Databricks CLI:
+```
+databricks postgres list-endpoints projects/{project-id}/branches/{branch-id}
+```
+Use the `name` field from the output.
+
+Required for OAuth authentication (unless password is provided)
+Can also be set via LAKEBASE_ENDPOINT environment variable
+
+#### Example
+
+```ts
+"projects/{project-id}/branches/{branch-id}/endpoints/{endpoint-identifier}"
+```
+
+***
+
+### logger?
+
+```ts
+optional logger: Logger | LoggerConfig;
+```
+
+Optional logger configuration.
+
+Supports three modes:
+1. Logger instance - Use your own logger implementation
+2. LoggerConfig - Enable/disable specific log levels (uses console)
+3. Undefined - Defaults to error logging only
+
+#### Examples
+
+```typescript
+import { createLogger } from '@databricks/appkit';
+const pool = createLakebasePool({
+  logger: createLogger('connectors:lakebase')
+});
+```
+
+```typescript
+const pool = createLakebasePool({
+  logger: { debug: true, info: true, error: true }
+});
+```
+
+***
+
+### sslMode?
+
+```ts
+optional sslMode: "require" | "disable" | "prefer";
+```
+
+SSL mode for the connection (convenience helper)
+Can also be set via PGSSLMODE environment variable
+
+#### Default
+
+```ts
+"require"
+```
+
+***
+
+### telemetry?
+
+```ts
+optional telemetry: TelemetryOptions;
+```
+
+Telemetry configuration
+
+- `true` or omitted: enable all telemetry (traces, metrics) -- no-op when OTEL is not configured
+- `false`: disable all telemetry
+- `{ traces?, metrics? }`: fine-grained control
+
+***
+
+### workspaceClient?
+
+```ts
+optional workspaceClient: WorkspaceClient;
+```
+
+Databricks workspace client for OAuth authentication
+If not provided along with endpoint, will attempt to use ServiceContext
+
+Note: If password is provided, OAuth auth is not used
diff --git a/docs/docs/api/appkit/Interface.RequestedClaims.md b/docs/docs/api/appkit/Interface.RequestedClaims.md
new file mode 100644
index 00000000..38095e7e
--- /dev/null
+++ b/docs/docs/api/appkit/Interface.RequestedClaims.md
@@ -0,0 +1,24 @@
+# Interface: RequestedClaims
+
+Optional claims for fine-grained Unity Catalog table permissions
+When specified, the returned token will be scoped to only the requested tables
+
+## Properties
+
+### permission\_set?
+
+```ts
+optional permission_set: READ_ONLY;
+```
+
+Permission level to request
+
+***
+
+### resources?
+
+```ts
+optional resources: RequestedResource[];
+```
+
+List of UC resources to request access to
diff --git a/docs/docs/api/appkit/Interface.RequestedResource.md b/docs/docs/api/appkit/Interface.RequestedResource.md
new file mode 100644
index 00000000..c91637bd
--- /dev/null
+++ b/docs/docs/api/appkit/Interface.RequestedResource.md
@@ -0,0 +1,29 @@
+# Interface: RequestedResource
+
+Resource to request permissions for in Unity Catalog
+
+## Properties
+
+### table\_name?
+
+```ts
+optional table_name: string;
+```
+
+Unity Catalog table name to request access to
+
+#### Example
+
+```ts
+"catalog.schema.table"
+```
+
+***
+
+### unspecified\_resource\_name?
+
+```ts
+optional unspecified_resource_name: string;
+```
+
+Generic resource name for non-table resources
diff --git a/docs/docs/api/appkit/index.md b/docs/docs/api/appkit/index.md
index f1a0e5f8..3c58b61c 100644
--- a/docs/docs/api/appkit/index.md
+++ b/docs/docs/api/appkit/index.md
@@ -7,6 +7,7 @@ plugin architecture, and React integration.
 
 | Enumeration | Description |
 | ------ | ------ |
+| [RequestedClaimsPermissionSet](Enumeration.RequestedClaimsPermissionSet.md) | Permission set for Unity Catalog table access |
 | [ResourceType](Enumeration.ResourceType.md) | Supported resource types that plugins can depend on. Each type has its own set of valid permissions. |
 
 ## Classes
@@ -31,8 +32,13 @@ plugin architecture, and React integration.
 | ------ | ------ |
 | [BasePluginConfig](Interface.BasePluginConfig.md) | Base configuration interface for AppKit plugins |
 | [CacheConfig](Interface.CacheConfig.md) | Configuration for caching |
+| [DatabaseCredential](Interface.DatabaseCredential.md) | Database credentials with OAuth token for Postgres connection |
+| [GenerateDatabaseCredentialRequest](Interface.GenerateDatabaseCredentialRequest.md) | Request parameters for generating database OAuth credentials |
 | [ITelemetry](Interface.ITelemetry.md) | Plugin-facing interface for OpenTelemetry instrumentation. Provides a thin abstraction over OpenTelemetry APIs for plugins. |
+| [LakebasePoolConfig](Interface.LakebasePoolConfig.md) | Configuration for creating a Lakebase connection pool |
 | [PluginManifest](Interface.PluginManifest.md) | Plugin manifest that declares metadata and resource requirements. Attached to plugin classes as a static property. |
+| [RequestedClaims](Interface.RequestedClaims.md) | Optional claims for fine-grained Unity Catalog table permissions When specified, the returned token will be scoped to only the requested tables |
+| [RequestedResource](Interface.RequestedResource.md) | Resource to request permissions for in Unity Catalog |
 | [ResourceEntry](Interface.ResourceEntry.md) | Internal representation of a resource in the registry. Extends ResourceRequirement with resolution state and plugin ownership. |
 | [ResourceFieldEntry](Interface.ResourceFieldEntry.md) | Defines a single field for a resource. Each field has its own environment variable and optional description. Single-value types use one key (e.g. id); multi-value types (database, secret) use multiple (e.g. instance_name, database_name or scope, key). |
 | [ResourceRequirement](Interface.ResourceRequirement.md) | Declares a resource requirement for a plugin. Can be defined statically in a manifest or dynamically via getResourceRequirements(). |
@@ -59,8 +65,14 @@ plugin architecture, and React integration.
 | Function | Description |
 | ------ | ------ |
 | [appKitTypesPlugin](Function.appKitTypesPlugin.md) | Vite plugin to generate types for AppKit queries. Calls generateFromEntryPoint under the hood. |
+| [contentTypeFromPath](Function.contentTypeFromPath.md) | Resolve the MIME content type for a file path. |
 | [createApp](Function.createApp.md) | Bootstraps AppKit with the provided configuration. |
+| [createLakebasePool](Function.createLakebasePool.md) | Create a Lakebase pool with appkit's logger integration. Telemetry automatically uses appkit's OpenTelemetry configuration via global registry. |
+| [generateDatabaseCredential](Function.generateDatabaseCredential.md) | Generate OAuth credentials for Postgres database connection using the proper Postgres API. |
 | [getExecutionContext](Function.getExecutionContext.md) | Get the current execution context. |
+| [getLakebaseOrmConfig](Function.getLakebaseOrmConfig.md) | Get Lakebase connection configuration for ORMs that don't accept pg.Pool directly. |
+| [getLakebasePgConfig](Function.getLakebasePgConfig.md) | Get Lakebase connection configuration for PostgreSQL clients. |
 | [getPluginManifest](Function.getPluginManifest.md) | Loads and validates the manifest from a plugin constructor. Normalizes string type/permission to strict ResourceType/ResourcePermission. |
 | [getResourceRequirements](Function.getResourceRequirements.md) | Gets the resource requirements from a plugin's manifest. |
+| [getWorkspaceClient](Function.getWorkspaceClient.md) | Get workspace client from config or SDK default auth chain |
 | [isSQLTypeMarker](Function.isSQLTypeMarker.md) | Type guard to check if a value is a SQL type marker |
diff --git a/docs/docs/api/appkit/typedoc-sidebar.ts b/docs/docs/api/appkit/typedoc-sidebar.ts
index aa114b63..63b513c2 100644
--- a/docs/docs/api/appkit/typedoc-sidebar.ts
+++ b/docs/docs/api/appkit/typedoc-sidebar.ts
@@ -5,6 +5,11 @@ const typedocSidebar: SidebarsConfig = {
       type: "category",
       label: "Enumerations",
       items: [
+        {
+          type: "doc",
+          id: "api/appkit/Enumeration.RequestedClaimsPermissionSet",
+          label: "RequestedClaimsPermissionSet"
+        },
         {
           type: "doc",
           id: "api/appkit/Enumeration.ResourceType",
@@ -87,16 +92,41 @@ const typedocSidebar: SidebarsConfig = {
           id: "api/appkit/Interface.CacheConfig",
           label: "CacheConfig"
         },
+        {
+          type: "doc",
+          id: "api/appkit/Interface.DatabaseCredential",
+          label: "DatabaseCredential"
+        },
+        {
+          type: "doc",
+          id: "api/appkit/Interface.GenerateDatabaseCredentialRequest",
+          label: "GenerateDatabaseCredentialRequest"
+        },
         {
           type: "doc",
           id: "api/appkit/Interface.ITelemetry",
           label: "ITelemetry"
         },
+        {
+          type: "doc",
+          id: "api/appkit/Interface.LakebasePoolConfig",
+          label: "LakebasePoolConfig"
+        },
         {
           type: "doc",
           id: "api/appkit/Interface.PluginManifest",
           label: "PluginManifest"
         },
+        {
+          type: "doc",
+          id: "api/appkit/Interface.RequestedClaims",
+          label: "RequestedClaims"
+        },
+        {
+          type: "doc",
+          id: "api/appkit/Interface.RequestedResource",
+          label: "RequestedResource"
+        },
         {
           type: "doc",
           id: "api/appkit/Interface.ResourceEntry",
@@ -170,16 +200,41 @@ const typedocSidebar: SidebarsConfig = {
           id: "api/appkit/Function.appKitTypesPlugin",
           label: "appKitTypesPlugin"
         },
+        {
+          type: "doc",
+          id: "api/appkit/Function.contentTypeFromPath",
+          label: "contentTypeFromPath"
+        },
         {
           type: "doc",
           id: "api/appkit/Function.createApp",
           label: "createApp"
         },
+        {
+          type: "doc",
+          id: "api/appkit/Function.createLakebasePool",
+          label: "createLakebasePool"
+        },
+        {
+          type: "doc",
+          id: "api/appkit/Function.generateDatabaseCredential",
+          label: "generateDatabaseCredential"
+        },
         {
           type: "doc",
           id: "api/appkit/Function.getExecutionContext",
           label: "getExecutionContext"
         },
+        {
+          type: "doc",
+          id: "api/appkit/Function.getLakebaseOrmConfig",
+          label: "getLakebaseOrmConfig"
+        },
+        {
+          type: "doc",
+          id: "api/appkit/Function.getLakebasePgConfig",
+          label: "getLakebasePgConfig"
+        },
         {
           type: "doc",
           id: "api/appkit/Function.getPluginManifest",
@@ -190,6 +245,11 @@ const typedocSidebar: SidebarsConfig = {
           id: "api/appkit/Function.getResourceRequirements",
           label: "getResourceRequirements"
         },
+        {
+          type: "doc",
+          id: "api/appkit/Function.getWorkspaceClient",
+          label: "getWorkspaceClient"
+        },
         {
           type: "doc",
           id: "api/appkit/Function.isSQLTypeMarker",
diff --git a/docs/docs/plugins.md b/docs/docs/plugins.md
index 3bfe1067..310f16d6 100644
--- a/docs/docs/plugins.md
+++ b/docs/docs/plugins.md
@@ -15,6 +15,7 @@ For complete API documentation, see the [`Plugin`](api/appkit/Class.Plugin.md) c
 Provides HTTP server capabilities with development and production modes.
 
 **Key features:**
+
 - Express server for REST APIs
 - Vite dev server with hot module reload
 - Static file serving for production
@@ -70,10 +71,10 @@ import { createApp, server } from "@databricks/appkit";
 await createApp({
   plugins: [
     server({
-      port: 8000,          // default: Number(process.env.DATABRICKS_APP_PORT) || 8000
-      host: "0.0.0.0",     // default: process.env.FLASK_RUN_HOST || "0.0.0.0"
-      autoStart: true,     // default: true
-      staticPath: "dist",  // optional: force a specific static directory
+      port: 8000, // default: Number(process.env.DATABRICKS_APP_PORT) || 8000
+      host: "0.0.0.0", // default: process.env.FLASK_RUN_HOST || "0.0.0.0"
+      autoStart: true, // default: true
+      staticPath: "dist", // optional: force a specific static directory
     }),
   ],
 });
@@ -84,6 +85,7 @@ await createApp({
 Enables SQL query execution against Databricks SQL Warehouses.
 
 **Key features:**
+
 - File-based SQL queries with automatic type generation
 - Parameterized queries with type-safe [SQL helpers](api/appkit/Variable.sql.md)
 - JSON and Arrow format support
@@ -119,6 +121,7 @@ LIMIT :limit
 ```
 
 **Supported `-- @param` types** (case-insensitive):
+
 - `STRING`, `NUMERIC`, `BOOLEAN`, `DATE`, `TIMESTAMP`, `BINARY`
 
 #### Server-injected parameters
@@ -143,6 +146,152 @@ The analytics plugin exposes these endpoints (mounted under `/api/analytics`):
 - `format: "JSON"` (default) returns JSON rows
 - `format: "ARROW"` returns an Arrow "statement_id" payload over SSE, then the client fetches binary Arrow from `/api/analytics/arrow-result/:jobId`
 
+### Files plugin
+
+Provides HTTP routes and a programmatic API for Databricks Unity Catalog volume file operations (list, read, download, upload, delete, preview).
+
+Routes are mounted at `/api/files/*`.
+
+#### Configuration
+
+| Option               | Type                     | Default  | Description                                                                                                                                                                              |
+| -------------------- | ------------------------ | -------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `defaultVolume`      | `string`                 | —        | Absolute volume path used to resolve relative file paths (e.g. `"/Volumes/catalog/schema/vol"`).                                                                                         |
+| `timeout`            | `number`                 | Per-tier | Operation timeout in milliseconds. Overrides the built-in per-tier defaults (30 s read, 600 s write).                                                                                    |
+| `customContentTypes` | `Record<string, string>` | —        | Map of file extensions to MIME types that takes priority over the built-in extension map. Keys should include the leading dot (e.g. `{ ".parquet": "application/vnd.apache.parquet" }`). |
+
+#### Programmatic API
+
+After registration, the plugin exposes methods on the app instance via `app.files.<method>()`:
+
+| Method            | Signature                                                                                                          | Description                                                                   |
+| ----------------- | ------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------- |
+| `list`            | `(path?: string) => Promise<DirectoryEntry[]>`                                                                     | List entries in a directory. Defaults to the configured `defaultVolume` root. |
+| `read`            | `(path: string) => Promise<string>`                                                                                | Read a file and return its contents as a UTF-8 string.                        |
+| `download`        | `(path: string) => Promise<DownloadResponse>`                                                                      | Download a file as a readable stream.                                         |
+| `exists`          | `(path: string) => Promise<boolean>`                                                                               | Check whether a file exists.                                                  |
+| `metadata`        | `(path: string) => Promise<FileMetadata>`                                                                          | Retrieve metadata (size, content type, last modified) for a file.             |
+| `upload`          | `(path: string, contents: ReadableStream \| Buffer \| string, options?: { overwrite?: boolean }) => Promise<void>` | Upload a file to a Unity Catalog volume.                                      |
+| `createDirectory` | `(path: string) => Promise<void>`                                                                                  | Create a directory in a Unity Catalog volume.                                 |
+| `delete`          | `(path: string) => Promise<void>`                                                                                  | Delete a file or directory from a Unity Catalog volume.                       |
+| `preview`         | `(path: string) => Promise<FilePreview>`                                                                           | Get a preview of a file including metadata and a text excerpt.                |
+
+#### HTTP Routes
+
+All routes are mounted under `/api/files`. File paths are passed via the `path` query parameter.
+
+| Method | Path                        | Description                                          |
+| ------ | --------------------------- | ---------------------------------------------------- |
+| `GET`  | `/api/files/root`           | Returns the configured `defaultVolume` path.         |
+| `GET`  | `/api/files/list?path=`     | List directory contents.                             |
+| `GET`  | `/api/files/read?path=`     | Read a file as plain text.                           |
+| `GET`  | `/api/files/download?path=` | Download a file as an attachment.                    |
+| `GET`  | `/api/files/raw?path=`      | Serve a file inline with its detected content type.  |
+| `GET`  | `/api/files/exists?path=`   | Check whether a file exists (`{ exists: boolean }`). |
+| `GET`  | `/api/files/metadata?path=` | Retrieve file metadata (size, type, last modified).  |
+| `GET`  | `/api/files/preview?path=`  | Get a file preview with text excerpt.                |
+| `POST` | `/api/files/upload?path=`   | Upload a file (stream the request body).             |
+| `POST` | `/api/files/mkdir`          | Create a directory (`{ path }` in body).             |
+| `POST` | `/api/files/delete`         | Delete a file or directory (`{ path }` in body).     |
+
+#### Execution defaults
+
+Operations use three tiers of execution settings:
+
+| Tier         | Cache    | Retry                   | Timeout             | Operations                            |
+| ------------ | -------- | ----------------------- | ------------------- | ------------------------------------- |
+| **Read**     | 60 s TTL | 3 attempts, 1 s backoff | 30 s                | list, read, exists, metadata, preview |
+| **Download** | Disabled | 3 attempts, 1 s backoff | 30 s (stream start) | download, raw                         |
+| **Write**    | Disabled | Disabled                | 600 s               | upload, mkdir, delete                 |
+
+#### Basic usage
+
+```ts
+import { createApp, files } from "@databricks/appkit";
+
+const app = await createApp({
+  plugins: [files({ defaultVolume: "/Volumes/catalog/schema/vol" })],
+});
+```
+
+#### List files in a directory
+
+```ts
+const entries = await app.files.list("/path/to/dir");
+for (const entry of entries) {
+  console.log(entry.name, entry.is_directory);
+}
+```
+
+#### Read a file as a string
+
+```ts
+const content = await app.files.read("data/config.json");
+const config = JSON.parse(content);
+```
+
+#### Download a file as a stream
+
+```ts
+const response = await app.files.download("reports/export.csv");
+// response.contents is a ReadableStream
+```
+
+#### Upload a file
+
+```ts
+await app.files.upload("uploads/report.pdf", fileBuffer, {
+  overwrite: true,
+});
+```
+
+#### Check if a file exists
+
+```ts
+const found = await app.files.exists("data/config.json");
+if (!found) {
+  console.log("File not found");
+}
+```
+
+#### Get file metadata
+
+```ts
+const meta = await app.files.metadata("data/report.csv");
+console.log(meta.contentLength, meta.contentType, meta.lastModified);
+```
+
+#### Preview a file
+
+```ts
+const preview = await app.files.preview("data/readme.md");
+// { contentLength, contentType, lastModified, textPreview, isText, isImage }
+```
+
+#### Custom content types
+
+```ts
+const app = await createApp({
+  plugins: [
+    files({
+      defaultVolume: "/Volumes/catalog/schema/vol",
+      customContentTypes: {
+        ".dbx": "application/x-databricks",
+        ".arrow": "application/vnd.apache.arrow.stream",
+      },
+    }),
+  ],
+});
+```
+
+#### User-scoped operations in a route handler
+
+```ts
+// Inside a custom plugin route handler:
+const userFiles = this.asUser(req);
+const entries = await userFiles.list();
+```
+
 ### Execution context and `asUser(req)`
 
 AppKit manages Databricks authentication via two contexts:
@@ -196,10 +345,7 @@ Configure plugins when creating your AppKit instance:
 import { createApp, server, analytics } from "@databricks/appkit";
 
 const AppKit = await createApp({
-  plugins: [
-    server({ port: 8000 }),
-    analytics(),
-  ],
+  plugins: [server({ port: 8000 }), analytics()],
 });
 ```
 
@@ -235,12 +381,12 @@ class MyPlugin extends Plugin {
           permission: "READ",
           fields: {
             scope: { env: "MY_SECRET_SCOPE", description: "Secret scope" },
-            key: { env: "MY_API_KEY", description: "Secret key name" }
-          }
-        }
+            key: { env: "MY_API_KEY", description: "Secret key name" },
+          },
+        },
       ],
-      optional: []
-    }
+      optional: [],
+    },
   };
 
   async setup() {
@@ -258,15 +404,16 @@ class MyPlugin extends Plugin {
   exports() {
     // an object with the methods from this plugin to expose
     return {
-      myCustomMethod: this.myCustomMethod
-    }
+      myCustomMethod: this.myCustomMethod,
+    };
   }
 }
 
-export const myPlugin = toPlugin<typeof MyPlugin, Record<string, never>, "myPlugin">(
-  MyPlugin,
-  "myPlugin",
-);
+export const myPlugin = toPlugin<
+  typeof MyPlugin,
+  Record<string, never>,
+  "myPlugin"
+>(MyPlugin, "myPlugin");
 ```
 
 ### Config-dependent resources
@@ -289,13 +436,30 @@ class MyPlugin extends Plugin<MyPluginConfig> {
     description: "A plugin with optional caching",
     resources: {
       required: [
-        { type: "sql_warehouse", alias: "warehouse", resourceKey: "sqlWarehouse", description: "Query execution", permission: "CAN_USE", fields: { id: { env: "DATABRICKS_WAREHOUSE_ID" } } }
+        {
+          type: "sql_warehouse",
+          alias: "warehouse",
+          resourceKey: "sqlWarehouse",
+          description: "Query execution",
+          permission: "CAN_USE",
+          fields: { id: { env: "DATABRICKS_WAREHOUSE_ID" } },
+        },
       ],
       optional: [
         // Listed as optional in manifest for static analysis
-        { type: "database", alias: "cache", resourceKey: "cache", description: "Query result caching (if enabled)", permission: "CAN_CONNECT_AND_CREATE", fields: { instance_name: { env: "DATABRICKS_CACHE_INSTANCE" }, database_name: { env: "DATABRICKS_CACHE_DB" } } }
-      ]
-    }
+        {
+          type: "database",
+          alias: "cache",
+          resourceKey: "cache",
+          description: "Query result caching (if enabled)",
+          permission: "CAN_CONNECT_AND_CREATE",
+          fields: {
+            instance_name: { env: "DATABRICKS_CACHE_INSTANCE" },
+            database_name: { env: "DATABRICKS_CACHE_DB" },
+          },
+        },
+      ],
+    },
   };
 
   // Runtime: Convert optional resources to required based on config
@@ -313,7 +477,7 @@ class MyPlugin extends Plugin<MyPluginConfig> {
           instance_name: { env: "DATABRICKS_CACHE_INSTANCE" },
           database_name: { env: "DATABRICKS_CACHE_DB" },
         },
-        required: true  // Mark as required at runtime
+        required: true, // Mark as required at runtime
       });
     }
     return resources;
@@ -322,6 +486,7 @@ class MyPlugin extends Plugin<MyPluginConfig> {
 ```
 
 This pattern allows:
+
 - **Static tools** (CLI, docs) to show all possible resources
 - **Runtime validation** to enforce resources based on actual configuration
 
@@ -341,11 +506,7 @@ To do that, your plugin needs to implement the `exports` method, returning an ob
 
 ```ts
 const AppKit = await createApp({
-  plugins: [
-    server({ port: 8000 }),
-    analytics(),
-    myPlugin(),
-  ],
+  plugins: [server({ port: 8000 }), analytics(), myPlugin()],
 });
 
 AppKit.myPlugin.myCustomMethod();
@@ -364,7 +525,7 @@ await createApp({
   plugins: [server(), analytics({})],
   cache: {
     enabled: true,
-    ttl: 3600,              // seconds
+    ttl: 3600, // seconds
     strictPersistence: false,
   },
 });
diff --git a/package.json b/package.json
index a08b06eb..a88ea962 100644
--- a/package.json
+++ b/package.json
@@ -57,7 +57,7 @@
     "husky": "^9.1.7",
     "jsdom": "^27.0.0",
     "lint-staged": "^15.5.1",
-    "pg": "^8.16.3",
+    "pg": "^8.18.0",
     "plop": "^4.0.4",
     "publint": "^0.3.15",
     "release-it": "^19.1.0",
diff --git a/packages/appkit-ui/package.json b/packages/appkit-ui/package.json
index 6438e987..6f3791db 100644
--- a/packages/appkit-ui/package.json
+++ b/packages/appkit-ui/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@databricks/appkit-ui",
   "type": "module",
-  "version": "0.6.0",
+  "version": "0.7.4",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/databricks/appkit.git"
@@ -38,7 +38,7 @@
     "build:watch": "tsdown --config tsdown.config.ts --watch",
     "clean:full": "rm -rf dist node_modules tmp",
     "clean": "rm -rf dist tmp",
-    "dist": "tsx ../../tools/dist.ts",
+    "dist": "tsx ../../tools/dist-appkit.ts",
     "tarball": "rm -rf tmp && pnpm dist && npm pack ./tmp --pack-destination ./tmp",
     "typecheck": "tsc --noEmit"
   },
diff --git a/packages/appkit/package.json b/packages/appkit/package.json
index 3a0a622f..ccd18231 100644
--- a/packages/appkit/package.json
+++ b/packages/appkit/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@databricks/appkit",
   "type": "module",
-  "version": "0.6.0",
+  "version": "0.7.4",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "packageManager": "pnpm@10.21.0",
@@ -37,12 +37,13 @@
     "build:watch": "tsdown --config tsdown.config.ts --watch",
     "clean:full": "rm -rf dist node_modules tmp",
     "clean": "rm -rf dist tmp",
-    "dist": "tsx ../../tools/dist.ts",
+    "dist": "tsx ../../tools/dist-appkit.ts",
     "tarball": "rm -rf tmp && pnpm dist && npm pack ./tmp --pack-destination ./tmp",
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@databricks/sdk-experimental": "^0.15.0",
+    "@databricks/lakebase": "workspace:*",
+    "@databricks/sdk-experimental": "^0.16.0",
     "@opentelemetry/api": "^1.9.0",
     "@opentelemetry/api-logs": "^0.208.0",
     "@opentelemetry/auto-instrumentations-node": "^0.67.0",
@@ -61,7 +62,7 @@
     "dotenv": "^16.6.1",
     "express": "^4.22.0",
     "obug": "^2.1.1",
-    "pg": "^8.16.3",
+    "pg": "^8.18.0",
     "semver": "^7.7.3",
     "shared": "workspace:*",
     "vite": "npm:rolldown-vite@7.1.14",
@@ -71,7 +72,7 @@
   "devDependencies": {
     "@types/express": "^4.17.25",
     "@types/json-schema": "^7.0.15",
-    "@types/pg": "^8.15.6",
+    "@types/pg": "^8.16.0",
     "@types/ws": "^8.18.1",
     "@vitejs/plugin-react": "^5.1.1"
   },
diff --git a/packages/appkit/src/cache/index.ts b/packages/appkit/src/cache/index.ts
index 952a7987..bdc6c10d 100644
--- a/packages/appkit/src/cache/index.ts
+++ b/packages/appkit/src/cache/index.ts
@@ -1,7 +1,7 @@
 import { createHash } from "node:crypto";
 import { WorkspaceClient } from "@databricks/sdk-experimental";
 import type { CacheConfig, CacheStorage } from "shared";
-import { LakebaseV1Connector } from "@/connectors";
+import { createLakebasePool } from "@/connectors/lakebase";
 import { AppKitError, ExecutionError, InitializationError } from "../errors";
 import { createLogger } from "../logging/logger";
 import type { Counter, TelemetryProvider } from "../telemetry";
@@ -147,14 +147,17 @@ export class CacheManager {
     // try to use lakebase storage
     try {
       const workspaceClient = new WorkspaceClient({});
-      const connector = new LakebaseV1Connector({ workspaceClient });
-      const isHealthy = await connector.healthCheck();
+      const pool = createLakebasePool({ workspaceClient });
+      const persistentStorage = new PersistentStorage(config, pool);
 
+      const isHealthy = await persistentStorage.healthCheck();
       if (isHealthy) {
-        const persistentStorage = new PersistentStorage(config, connector);
         await persistentStorage.initialize();
         return new CacheManager(persistentStorage, config);
       }
+
+      // Health check failed, close the pool and fallback
+      await pool.end();
     } catch {
       // lakebase unavailable, continue with in-memory storage
     }
diff --git a/packages/appkit/src/cache/storage/persistent.ts b/packages/appkit/src/cache/storage/persistent.ts
index 393385cd..d9affd73 100644
--- a/packages/appkit/src/cache/storage/persistent.ts
+++ b/packages/appkit/src/cache/storage/persistent.ts
@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
+import type pg from "pg";
 import type { CacheConfig, CacheEntry, CacheStorage } from "shared";
-import type { LakebaseV1Connector } from "../../connectors";
 import { InitializationError, ValidationError } from "../../errors";
 import { createLogger } from "../../logging/logger";
 import { lakebaseStorageDefaults } from "./defaults";
@@ -12,7 +12,8 @@ const logger = createLogger("cache:persistent");
  * to manage memory usage and ensure efficient cache operations.
  *
  * @example
- * const persistentStorage = new PersistentStorage(config, connector);
+ * const pool = createLakebasePool({ workspaceClient });
+ * const persistentStorage = new PersistentStorage(config, pool);
  * await persistentStorage.initialize();
  * await persistentStorage.get("my-key");
  * await persistentStorage.set("my-key", "my-value");
@@ -22,7 +23,7 @@ const logger = createLogger("cache:persistent");
  *
  */
 export class PersistentStorage implements CacheStorage {
-  private readonly connector: LakebaseV1Connector;
+  private readonly pool: pg.Pool;
   private readonly tableName: string;
   private readonly maxBytes: number;
   private readonly maxEntryBytes: number;
@@ -30,8 +31,8 @@ export class PersistentStorage implements CacheStorage {
   private readonly evictionCheckProbability: number;
   private initialized: boolean;
 
-  constructor(config: CacheConfig, connector: LakebaseV1Connector) {
-    this.connector = connector;
+  constructor(config: CacheConfig, pool: pg.Pool) {
+    this.pool = pool;
     this.maxBytes = config.maxBytes ?? lakebaseStorageDefaults.maxBytes;
     this.maxEntryBytes =
       config.maxEntryBytes ?? lakebaseStorageDefaults.maxEntryBytes;
@@ -66,7 +67,7 @@ export class PersistentStorage implements CacheStorage {
 
     const keyHash = this.hashKey(key);
 
-    const result = await this.connector.query<{
+    const result = await this.pool.query<{
       value: Buffer;
       expiry: string;
     }>(`SELECT value, expiry FROM ${this.tableName} WHERE key_hash = $1`, [
@@ -78,7 +79,7 @@ export class PersistentStorage implements CacheStorage {
     const entry = result.rows[0];
 
     // fire-and-forget update
-    this.connector
+    this.pool
       .query(
         `UPDATE ${this.tableName} SET last_accessed = NOW() WHERE key_hash = $1`,
         [keyHash],
@@ -123,7 +124,7 @@ export class PersistentStorage implements CacheStorage {
       }
     }
 
-    await this.connector.query(
+    await this.pool.query(
       `INSERT INTO ${this.tableName} (key_hash, key, value, byte_size, expiry, created_at, last_accessed)
       VALUES ($1, $2, $3, $4, $5, NOW(), NOW())
       ON CONFLICT (key_hash)
@@ -141,16 +142,15 @@ export class PersistentStorage implements CacheStorage {
   async delete(key: string): Promise<void> {
     await this.ensureInitialized();
     const keyHash = this.hashKey(key);
-    await this.connector.query(
-      `DELETE FROM ${this.tableName} WHERE key_hash = $1`,
-      [keyHash],
-    );
+    await this.pool.query(`DELETE FROM ${this.tableName} WHERE key_hash = $1`, [
+      keyHash,
+    ]);
   }
 
   /** Clear the persistent storage */
   async clear(): Promise<void> {
     await this.ensureInitialized();
-    await this.connector.query(`TRUNCATE TABLE ${this.tableName}`);
+    await this.pool.query(`TRUNCATE TABLE ${this.tableName}`);
   }
 
   /**
@@ -162,7 +162,7 @@ export class PersistentStorage implements CacheStorage {
     await this.ensureInitialized();
     const keyHash = this.hashKey(key);
 
-    const result = await this.connector.query<{ exists: boolean }>(
+    const result = await this.pool.query<{ exists: boolean }>(
       `SELECT EXISTS(SELECT 1 FROM ${this.tableName} WHERE key_hash = $1) as exists`,
       [keyHash],
     );
@@ -177,7 +177,7 @@ export class PersistentStorage implements CacheStorage {
   async size(): Promise<number> {
     await this.ensureInitialized();
 
-    const result = await this.connector.query<{ count: string }>(
+    const result = await this.pool.query<{ count: string }>(
       `SELECT COUNT(*) as count FROM ${this.tableName}`,
     );
     return parseInt(result.rows[0]?.count ?? "0", 10);
@@ -187,7 +187,7 @@ export class PersistentStorage implements CacheStorage {
   async totalBytes(): Promise<number> {
     await this.ensureInitialized();
 
-    const result = await this.connector.query<{ total: string }>(
+    const result = await this.pool.query<{ total: string }>(
       `SELECT COALESCE(SUM(byte_size), 0) as total FROM ${this.tableName}`,
     );
     return parseInt(result.rows[0]?.total ?? "0", 10);
@@ -207,7 +207,8 @@ export class PersistentStorage implements CacheStorage {
    */
   async healthCheck(): Promise<boolean> {
     try {
-      return await this.connector.healthCheck();
+      await this.pool.query("SELECT 1");
+      return true;
     } catch {
       return false;
     }
@@ -215,7 +216,7 @@ export class PersistentStorage implements CacheStorage {
 
   /** Close the persistent storage */
   async close(): Promise<void> {
-    await this.connector.close();
+    await this.pool.end();
   }
 
   /**
@@ -224,7 +225,7 @@ export class PersistentStorage implements CacheStorage {
    */
   async cleanupExpired(): Promise<number> {
     await this.ensureInitialized();
-    const result = await this.connector.query<{ count: string }>(
+    const result = await this.pool.query<{ count: string }>(
       `WITH deleted as (DELETE FROM ${this.tableName} WHERE expiry < $1 RETURNING *) SELECT COUNT(*) as count FROM deleted`,
       [Date.now()],
     );
@@ -241,7 +242,7 @@ export class PersistentStorage implements CacheStorage {
       }
     }
 
-    await this.connector.query(
+    await this.pool.query(
       `DELETE FROM ${this.tableName} WHERE key_hash IN
       (SELECT key_hash FROM ${this.tableName} ORDER BY last_accessed ASC LIMIT $1)`,
       [this.evictionBatchSize],
@@ -275,7 +276,7 @@ export class PersistentStorage implements CacheStorage {
   /** Run migrations for the persistent storage */
   private async runMigrations(): Promise<void> {
     try {
-      await this.connector.query(`
+      await this.pool.query(`
             CREATE TABLE IF NOT EXISTS ${this.tableName} (
                 id BIGSERIAL PRIMARY KEY,
                 key_hash BIGINT NOT NULL,
@@ -289,22 +290,22 @@ export class PersistentStorage implements CacheStorage {
             `);
 
       // unique index on key_hash for fast lookups
-      await this.connector.query(
+      await this.pool.query(
         `CREATE UNIQUE INDEX IF NOT EXISTS idx_${this.tableName}_key_hash ON ${this.tableName} (key_hash);`,
       );
 
       // index on expiry for cleanup queries
-      await this.connector.query(
+      await this.pool.query(
         `CREATE INDEX IF NOT EXISTS idx_${this.tableName}_expiry ON ${this.tableName} (expiry); `,
       );
 
       // index on last_accessed for LRU eviction
-      await this.connector.query(
+      await this.pool.query(
         `CREATE INDEX IF NOT EXISTS idx_${this.tableName}_last_accessed ON ${this.tableName} (last_accessed); `,
       );
 
       // index on byte_size for monitoring
-      await this.connector.query(
+      await this.pool.query(
         `CREATE INDEX IF NOT EXISTS idx_${this.tableName}_byte_size ON ${this.tableName} (byte_size); `,
       );
     } catch (error) {
diff --git a/packages/appkit/src/cache/tests/cache-manager.test.ts b/packages/appkit/src/cache/tests/cache-manager.test.ts
index a4e54438..8e45d679 100644
--- a/packages/appkit/src/cache/tests/cache-manager.test.ts
+++ b/packages/appkit/src/cache/tests/cache-manager.test.ts
@@ -2,18 +2,19 @@ import type { CacheStorage } from "shared";
 import { afterEach, beforeEach, describe, expect, test, vi } from "vitest";
 import { CacheManager } from "../../index";
 
-// Mock LakebaseV1Connector
-const mockLakebaseHealthCheck = vi.fn();
-vi.mock("@/connectors", () => ({
-  LakebaseV1Connector: vi.fn().mockImplementation(() => ({
-    healthCheck: mockLakebaseHealthCheck,
-    close: vi.fn().mockResolvedValue(undefined),
+// Mock createLakebasePool
+const mockPoolQuery = vi.fn();
+const mockPoolEnd = vi.fn();
+vi.mock("@/connectors/lakebase", () => ({
+  createLakebasePool: vi.fn().mockImplementation(() => ({
+    query: mockPoolQuery,
+    end: mockPoolEnd.mockResolvedValue(undefined),
   })),
 }));
 
 // Mock PersistentStorage
 vi.mock("../storage/persistent", () => ({
-  PersistentStorage: vi.fn().mockImplementation(() => {
+  PersistentStorage: vi.fn().mockImplementation((_config: any, pool: any) => {
     const cache = new Map<string, { value: unknown; expiry: number }>();
     return {
       initialize: vi.fn().mockResolvedValue(undefined),
@@ -32,8 +33,16 @@ vi.mock("../storage/persistent", () => ({
       has: vi.fn().mockImplementation(async (key: string) => cache.has(key)),
       size: vi.fn().mockImplementation(async () => cache.size),
       isPersistent: vi.fn().mockReturnValue(true),
-      healthCheck: vi.fn().mockResolvedValue(true),
-      close: vi.fn().mockResolvedValue(undefined),
+      healthCheck: vi.fn().mockImplementation(async () => {
+        // Simulate real healthCheck: calls pool.query('SELECT 1')
+        try {
+          await pool.query("SELECT 1");
+          return true;
+        } catch {
+          return false;
+        }
+      }),
+      close: vi.fn().mockImplementation(async () => pool.end()),
       cleanupExpired: vi.fn().mockResolvedValue(0),
     };
   }),
@@ -87,7 +96,7 @@ describe("CacheManager", () => {
     (CacheManager as any).instance = null;
     (CacheManager as any).initPromise = null;
     // Default: Lakebase unavailable (most tests pass explicit storage)
-    mockLakebaseHealthCheck.mockResolvedValue(false);
+    mockPoolQuery.mockRejectedValue(new Error("Connection failed"));
   });
 
   afterEach(() => {
@@ -621,8 +630,11 @@ describe("CacheManager", () => {
       (CacheManager as any).instance = null;
       (CacheManager as any).initPromise = null;
 
-      // Make Lakebase healthy
-      mockLakebaseHealthCheck.mockResolvedValue(true);
+      // Make pool.query succeed for healthCheck ('SELECT 1')
+      mockPoolQuery.mockResolvedValue({
+        rows: [{ "?column?": 1 }],
+        rowCount: 1,
+      });
 
       const cache = await CacheManager.getInstance({});
 
@@ -636,8 +648,8 @@ describe("CacheManager", () => {
       (CacheManager as any).instance = null;
       (CacheManager as any).initPromise = null;
 
-      // Lakebase unhealthy (default in beforeEach)
-      mockLakebaseHealthCheck.mockResolvedValue(false);
+      // Lakebase unhealthy (pool.query fails, default in beforeEach)
+      mockPoolQuery.mockRejectedValue(new Error("Connection failed"));
 
       const cache = await CacheManager.getInstance({});
 
@@ -656,8 +668,8 @@ describe("CacheManager", () => {
       (CacheManager as any).instance = null;
       (CacheManager as any).initPromise = null;
 
-      // Lakebase unhealthy
-      mockLakebaseHealthCheck.mockResolvedValue(false);
+      // Lakebase unhealthy (pool.query fails)
+      mockPoolQuery.mockRejectedValue(new Error("Connection failed"));
 
       const cache = await CacheManager.getInstance({
         strictPersistence: true,
@@ -677,8 +689,8 @@ describe("CacheManager", () => {
       (CacheManager as any).instance = null;
       (CacheManager as any).initPromise = null;
 
-      // Lakebase unhealthy
-      mockLakebaseHealthCheck.mockResolvedValue(false);
+      // Lakebase unhealthy - pool.query('SELECT 1') fails
+      mockPoolQuery.mockRejectedValue(new Error("Health check failed"));
 
       const cache = await CacheManager.getInstance({});
 
@@ -693,9 +705,7 @@ describe("CacheManager", () => {
       (CacheManager as any).initPromise = null;
 
       // Lakebase throws
-      mockLakebaseHealthCheck.mockRejectedValue(
-        new Error("Connection refused"),
-      );
+      mockPoolQuery.mockRejectedValue(new Error("Connection refused"));
 
       const cache = await CacheManager.getInstance({});
 
diff --git a/packages/appkit/src/cache/tests/persistent.test.ts b/packages/appkit/src/cache/tests/persistent.test.ts
index fc3ead27..82706b0d 100644
--- a/packages/appkit/src/cache/tests/persistent.test.ts
+++ b/packages/appkit/src/cache/tests/persistent.test.ts
@@ -1,26 +1,25 @@
 import { beforeEach, describe, expect, test, vi } from "vitest";
 import { PersistentStorage } from "../storage";
 
-/** Mock LakebaseV1Connector for testing */
-const createMockConnector = () => ({
+/** Mock pg.Pool for testing */
+const createMockPool = () => ({
   query: vi.fn(),
-  healthCheck: vi.fn().mockResolvedValue(true),
-  close: vi.fn().mockResolvedValue(undefined),
+  end: vi.fn().mockResolvedValue(undefined),
 });
 
 describe("PersistentStorage", () => {
   let storage: PersistentStorage;
-  let mockConnector: ReturnType<typeof createMockConnector>;
+  let mockPool: ReturnType<typeof createMockPool>;
 
   beforeEach(() => {
-    mockConnector = createMockConnector();
+    mockPool = createMockPool();
 
     // Default: migrations succeed
-    mockConnector.query.mockResolvedValue({ rows: [] });
+    mockPool.query.mockResolvedValue({ rows: [] });
 
     storage = new PersistentStorage(
       { maxBytes: 1024 * 1024 }, // 1MB
-      mockConnector as any,
+      mockPool as any,
     );
   });
 
@@ -29,12 +28,12 @@ describe("PersistentStorage", () => {
       await storage.initialize();
 
       // Should create table
-      expect(mockConnector.query).toHaveBeenCalledWith(
+      expect(mockPool.query).toHaveBeenCalledWith(
         expect.stringContaining("CREATE TABLE IF NOT EXISTS"),
       );
 
       // Should create unique index on key_hash
-      expect(mockConnector.query).toHaveBeenCalledWith(
+      expect(mockPool.query).toHaveBeenCalledWith(
         expect.stringContaining("CREATE UNIQUE INDEX IF NOT EXISTS"),
       );
     });
@@ -44,7 +43,7 @@ describe("PersistentStorage", () => {
       await storage.initialize();
 
       // CREATE TABLE should only be called once (first initialization)
-      const createTableCalls = mockConnector.query.mock.calls.filter((call) =>
+      const createTableCalls = mockPool.query.mock.calls.filter((call) =>
         call[0].includes("CREATE TABLE"),
       );
       expect(createTableCalls.length).toBe(1);
@@ -55,7 +54,7 @@ describe("PersistentStorage", () => {
         .spyOn(console, "error")
         .mockImplementation(() => {});
 
-      mockConnector.query.mockRejectedValue(new Error("migration failed"));
+      mockPool.query.mockRejectedValue(new Error("migration failed"));
 
       await expect(storage.initialize()).rejects.toThrow(
         "Error in running migrations for persistent storage",
@@ -68,7 +67,7 @@ describe("PersistentStorage", () => {
   describe("get", () => {
     beforeEach(async () => {
       await storage.initialize();
-      mockConnector.query.mockClear();
+      mockPool.query.mockClear();
     });
 
     test("should return cached entry", async () => {
@@ -78,7 +77,7 @@ describe("PersistentStorage", () => {
         "utf-8",
       );
 
-      mockConnector.query.mockResolvedValueOnce({
+      mockPool.query.mockResolvedValueOnce({
         rows: [{ value: valueBuffer, expiry: String(expiry) }],
       });
 
@@ -88,14 +87,14 @@ describe("PersistentStorage", () => {
         value: { data: "test" },
         expiry,
       });
-      expect(mockConnector.query).toHaveBeenCalledWith(
+      expect(mockPool.query).toHaveBeenCalledWith(
         expect.stringContaining("SELECT value, expiry"),
         [expect.any(BigInt)], // key_hash is bigint
       );
     });
 
     test("should return null for non-existent key", async () => {
-      mockConnector.query.mockResolvedValueOnce({ rows: [] });
+      mockPool.query.mockResolvedValueOnce({ rows: [] });
 
       const result = await storage.get("non-existent");
 
@@ -109,7 +108,7 @@ describe("PersistentStorage", () => {
         "utf-8",
       );
 
-      mockConnector.query
+      mockPool.query
         .mockResolvedValueOnce({
           rows: [{ value: valueBuffer, expiry: String(expiry) }],
         })
@@ -120,7 +119,7 @@ describe("PersistentStorage", () => {
       // Wait for fire-and-forget update
       await new Promise((resolve) => setTimeout(resolve, 10));
 
-      expect(mockConnector.query).toHaveBeenCalledWith(
+      expect(mockPool.query).toHaveBeenCalledWith(
         expect.stringContaining("UPDATE"),
         [expect.any(BigInt)], // key_hash
       );
@@ -130,7 +129,7 @@ describe("PersistentStorage", () => {
   describe("set", () => {
     beforeEach(async () => {
       await storage.initialize();
-      mockConnector.query.mockClear();
+      mockPool.query.mockClear();
     });
 
     test("should insert new entry", async () => {
@@ -138,14 +137,14 @@ describe("PersistentStorage", () => {
       const randomSpy = vi.spyOn(Math, "random").mockReturnValue(0.5);
 
       // INSERT succeeds
-      mockConnector.query.mockResolvedValueOnce({ rows: [] });
+      mockPool.query.mockResolvedValueOnce({ rows: [] });
 
       await storage.set("test-key", {
         value: { data: "test" },
         expiry: Date.now() + 10000,
       });
 
-      expect(mockConnector.query).toHaveBeenCalledWith(
+      expect(mockPool.query).toHaveBeenCalledWith(
         expect.stringContaining("INSERT INTO"),
         expect.arrayContaining([
           expect.any(BigInt), // key_hash
@@ -164,17 +163,17 @@ describe("PersistentStorage", () => {
       const randomSpy = vi.spyOn(Math, "random").mockReturnValue(0.05);
 
       // totalBytes() returns maxBytes (triggers eviction)
-      mockConnector.query.mockResolvedValueOnce({
+      mockPool.query.mockResolvedValueOnce({
         rows: [{ total: String(1024 * 1024) }], // 1MB (at limit)
       });
       // cleanupExpired returns 0
-      mockConnector.query.mockResolvedValueOnce({
+      mockPool.query.mockResolvedValueOnce({
         rows: [{ count: "0" }],
       });
       // eviction DELETE succeeds
-      mockConnector.query.mockResolvedValueOnce({ rows: [] });
+      mockPool.query.mockResolvedValueOnce({ rows: [] });
       // INSERT succeeds
-      mockConnector.query.mockResolvedValueOnce({ rows: [] });
+      mockPool.query.mockResolvedValueOnce({ rows: [] });
 
       await storage.set("new-key", {
         value: { data: "new" },
@@ -182,7 +181,7 @@ describe("PersistentStorage", () => {
       });
 
       // Should have called DELETE for LRU eviction
-      expect(mockConnector.query).toHaveBeenCalledWith(
+      expect(mockPool.query).toHaveBeenCalledWith(
         expect.stringContaining("DELETE FROM"),
         expect.any(Array),
       );
@@ -195,7 +194,7 @@ describe("PersistentStorage", () => {
       const randomSpy = vi.spyOn(Math, "random").mockReturnValue(0.5);
 
       // INSERT succeeds
-      mockConnector.query.mockResolvedValueOnce({ rows: [] });
+      mockPool.query.mockResolvedValueOnce({ rows: [] });
 
       const value = { nested: { array: [1, 2, 3] } };
       await storage.set("test-key", {
@@ -203,7 +202,7 @@ describe("PersistentStorage", () => {
         expiry: Date.now() + 10000,
       });
 
-      const insertCall = mockConnector.query.mock.calls.find((call) =>
+      const insertCall = mockPool.query.mock.calls.find((call) =>
         call[0].includes("INSERT"),
       );
 
@@ -219,15 +218,15 @@ describe("PersistentStorage", () => {
   describe("delete", () => {
     beforeEach(async () => {
       await storage.initialize();
-      mockConnector.query.mockClear();
+      mockPool.query.mockClear();
     });
 
     test("should delete entry by key_hash", async () => {
-      mockConnector.query.mockResolvedValueOnce({ rows: [] });
+      mockPool.query.mockResolvedValueOnce({ rows: [] });
 
       await storage.delete("test-key");
 
-      expect(mockConnector.query).toHaveBeenCalledWith(
+      expect(mockPool.query).toHaveBeenCalledWith(
         expect.stringContaining("DELETE FROM"),
         [expect.any(BigInt)], // key_hash
       );
@@ -237,15 +236,15 @@ describe("PersistentStorage", () => {
   describe("clear", () => {
     beforeEach(async () => {
       await storage.initialize();
-      mockConnector.query.mockClear();
+      mockPool.query.mockClear();
     });
 
     test("should truncate table", async () => {
-      mockConnector.query.mockResolvedValueOnce({ rows: [] });
+      mockPool.query.mockResolvedValueOnce({ rows: [] });
 
       await storage.clear();
 
-      expect(mockConnector.query).toHaveBeenCalledWith(
+      expect(mockPool.query).toHaveBeenCalledWith(
         expect.stringContaining("TRUNCATE TABLE"),
       );
     });
@@ -254,25 +253,25 @@ describe("PersistentStorage", () => {
   describe("has", () => {
     beforeEach(async () => {
       await storage.initialize();
-      mockConnector.query.mockClear();
+      mockPool.query.mockClear();
     });
 
     test("should return true when key exists", async () => {
-      mockConnector.query.mockResolvedValueOnce({
+      mockPool.query.mockResolvedValueOnce({
         rows: [{ exists: true }],
       });
 
       const result = await storage.has("test-key");
 
       expect(result).toBe(true);
-      expect(mockConnector.query).toHaveBeenCalledWith(
+      expect(mockPool.query).toHaveBeenCalledWith(
         expect.stringContaining("SELECT EXISTS"),
         [expect.any(BigInt)], // key_hash
       );
     });
 
     test("should return false when key does not exist", async () => {
-      mockConnector.query.mockResolvedValueOnce({
+      mockPool.query.mockResolvedValueOnce({
         rows: [{ exists: false }],
       });
 
@@ -282,7 +281,7 @@ describe("PersistentStorage", () => {
     });
 
     test("should return false when query returns no rows", async () => {
-      mockConnector.query.mockResolvedValueOnce({ rows: [] });
+      mockPool.query.mockResolvedValueOnce({ rows: [] });
 
       const result = await storage.has("test-key");
 
@@ -293,11 +292,11 @@ describe("PersistentStorage", () => {
   describe("size", () => {
     beforeEach(async () => {
       await storage.initialize();
-      mockConnector.query.mockClear();
+      mockPool.query.mockClear();
     });
 
     test("should return count of entries", async () => {
-      mockConnector.query.mockResolvedValueOnce({
+      mockPool.query.mockResolvedValueOnce({
         rows: [{ count: "42" }],
       });
 
@@ -307,7 +306,7 @@ describe("PersistentStorage", () => {
     });
 
     test("should return 0 when empty", async () => {
-      mockConnector.query.mockResolvedValueOnce({
+      mockPool.query.mockResolvedValueOnce({
         rows: [{ count: "0" }],
       });
 
@@ -317,7 +316,7 @@ describe("PersistentStorage", () => {
     });
 
     test("should return 0 when no rows", async () => {
-      mockConnector.query.mockResolvedValueOnce({ rows: [] });
+      mockPool.query.mockResolvedValueOnce({ rows: [] });
 
       const result = await storage.size();
 
@@ -328,11 +327,11 @@ describe("PersistentStorage", () => {
   describe("totalBytes", () => {
     beforeEach(async () => {
       await storage.initialize();
-      mockConnector.query.mockClear();
+      mockPool.query.mockClear();
     });
 
     test("should return sum of byte_size", async () => {
-      mockConnector.query.mockResolvedValueOnce({
+      mockPool.query.mockResolvedValueOnce({
         rows: [{ total: "1048576" }], // 1MB
       });
 
@@ -342,7 +341,7 @@ describe("PersistentStorage", () => {
     });
 
     test("should return 0 when empty", async () => {
-      mockConnector.query.mockResolvedValueOnce({
+      mockPool.query.mockResolvedValueOnce({
         rows: [{ total: "0" }],
       });
 
@@ -355,25 +354,25 @@ describe("PersistentStorage", () => {
   describe("cleanupExpired", () => {
     beforeEach(async () => {
       await storage.initialize();
-      mockConnector.query.mockClear();
+      mockPool.query.mockClear();
     });
 
     test("should delete expired entries", async () => {
-      mockConnector.query.mockResolvedValueOnce({
+      mockPool.query.mockResolvedValueOnce({
         rows: [{ count: "5" }],
       });
 
       const deleted = await storage.cleanupExpired();
 
       expect(deleted).toBe(5);
-      expect(mockConnector.query).toHaveBeenCalledWith(
+      expect(mockPool.query).toHaveBeenCalledWith(
         expect.stringContaining("DELETE FROM"),
         expect.arrayContaining([expect.any(Number)]),
       );
     });
 
     test("should return 0 when no expired entries", async () => {
-      mockConnector.query.mockResolvedValueOnce({
+      mockPool.query.mockResolvedValueOnce({
         rows: [{ count: "0" }],
       });
 
@@ -388,27 +387,27 @@ describe("PersistentStorage", () => {
       expect(storage.isPersistent()).toBe(true);
     });
 
-    test("should delegate healthCheck to connector", async () => {
-      mockConnector.healthCheck.mockResolvedValueOnce(true);
+    test("should implement healthCheck using pool query", async () => {
+      mockPool.query.mockResolvedValueOnce({ rows: [{ "?column?": 1 }] });
 
       const result = await storage.healthCheck();
 
       expect(result).toBe(true);
-      expect(mockConnector.healthCheck).toHaveBeenCalled();
+      expect(mockPool.query).toHaveBeenCalledWith("SELECT 1");
     });
 
     test("should return false on healthCheck error", async () => {
-      mockConnector.healthCheck.mockRejectedValueOnce(new Error("failed"));
+      mockPool.query.mockRejectedValueOnce(new Error("Connection failed"));
 
       const result = await storage.healthCheck();
 
       expect(result).toBe(false);
     });
 
-    test("should close connector on close", async () => {
+    test("should close pool on close", async () => {
       await storage.close();
 
-      expect(mockConnector.close).toHaveBeenCalled();
+      expect(mockPool.end).toHaveBeenCalled();
     });
   });
 
@@ -416,15 +415,15 @@ describe("PersistentStorage", () => {
     test("should auto-initialize on get if not initialized", async () => {
       const uninitializedStorage = new PersistentStorage(
         { maxBytes: 1024 * 1024 },
-        mockConnector as any,
+        mockPool as any,
       );
 
-      mockConnector.query.mockResolvedValue({ rows: [] });
+      mockPool.query.mockResolvedValue({ rows: [] });
 
       await uninitializedStorage.get("test-key");
 
       // Should have run migrations
-      expect(mockConnector.query).toHaveBeenCalledWith(
+      expect(mockPool.query).toHaveBeenCalledWith(
         expect.stringContaining("CREATE TABLE"),
       );
     });
@@ -432,10 +431,10 @@ describe("PersistentStorage", () => {
     test("should auto-initialize on set if not initialized", async () => {
       const uninitializedStorage = new PersistentStorage(
         { maxBytes: 1024 * 1024 },
-        mockConnector as any,
+        mockPool as any,
       );
 
-      mockConnector.query.mockResolvedValue({ rows: [] });
+      mockPool.query.mockResolvedValue({ rows: [] });
 
       await uninitializedStorage.set("test-key", {
         value: "test",
@@ -443,7 +442,7 @@ describe("PersistentStorage", () => {
       });
 
       // Should have run migrations
-      expect(mockConnector.query).toHaveBeenCalledWith(
+      expect(mockPool.query).toHaveBeenCalledWith(
         expect.stringContaining("CREATE TABLE"),
       );
     });
diff --git a/packages/appkit/src/connectors/files/client.ts b/packages/appkit/src/connectors/files/client.ts
new file mode 100644
index 00000000..72631e10
--- /dev/null
+++ b/packages/appkit/src/connectors/files/client.ts
@@ -0,0 +1,348 @@
+import { ApiError, type WorkspaceClient } from "@databricks/sdk-experimental";
+import type { TelemetryOptions } from "shared";
+import { createLogger } from "../../logging/logger";
+import type {
+  DirectoryEntry,
+  DownloadResponse,
+  FileMetadata,
+  FilePreview,
+} from "../../plugins/files/types";
+import type { TelemetryProvider } from "../../telemetry";
+import {
+  type Counter,
+  type Histogram,
+  type Span,
+  SpanKind,
+  SpanStatusCode,
+  TelemetryManager,
+} from "../../telemetry";
+import { contentTypeFromPath, isTextContentType } from "./defaults";
+
+const logger = createLogger("connectors:files");
+
+export interface FilesConnectorConfig {
+  defaultVolume?: string;
+  timeout?: number;
+  telemetry?: TelemetryOptions;
+  customContentTypes?: Record<string, string>;
+}
+
+export class FilesConnector {
+  private readonly name = "files";
+  private defaultVolume: string | undefined;
+  private readonly customContentTypes: Record<string, string> | undefined;
+
+  private readonly telemetry: TelemetryProvider;
+  private readonly telemetryMetrics: {
+    operationCount: Counter;
+    operationDuration: Histogram;
+  };
+
+  constructor(config: FilesConnectorConfig) {
+    this.defaultVolume = config.defaultVolume;
+    this.customContentTypes = config.customContentTypes;
+
+    this.telemetry = TelemetryManager.getProvider(this.name, config.telemetry);
+    this.telemetryMetrics = {
+      operationCount: this.telemetry
+        .getMeter()
+        .createCounter("files.operation.count", {
+          description: "Total number of file operations",
+          unit: "1",
+        }),
+      operationDuration: this.telemetry
+        .getMeter()
+        .createHistogram("files.operation.duration", {
+          description: "Duration of file operations",
+          unit: "ms",
+        }),
+    };
+  }
+
+  resolvePath(filePath: string): string {
+    if (filePath.includes("..")) {
+      throw new Error('Path traversal ("../") is not allowed.');
+    }
+    if (filePath.startsWith("/")) {
+      return filePath;
+    }
+    if (!this.defaultVolume) {
+      throw new Error(
+        "Cannot resolve relative path: no default volume set. Use an absolute path or set a default volume.",
+      );
+    }
+    return `${this.defaultVolume}/${filePath}`;
+  }
+
+  volume(volumePath: string): FilesConnector {
+    return new FilesConnector({
+      defaultVolume: volumePath,
+      telemetry: false,
+      customContentTypes: this.customContentTypes,
+    });
+  }
+
+  private async traced<T>(
+    operation: string,
+    attributes: Record<string, string>,
+    fn: (span: Span) => Promise<T>,
+  ): Promise<T> {
+    const startTime = Date.now();
+    let success = false;
+
+    return this.telemetry.startActiveSpan(
+      `files.${operation}`,
+      {
+        kind: SpanKind.CLIENT,
+        attributes: {
+          "files.operation": operation,
+          ...attributes,
+        },
+      },
+      async (span: Span) => {
+        try {
+          const result = await fn(span);
+          success = true;
+          span.setStatus({ code: SpanStatusCode.OK });
+          return result;
+        } catch (error) {
+          span.recordException(error as Error);
+          span.setStatus({
+            code: SpanStatusCode.ERROR,
+            message: error instanceof Error ? error.message : String(error),
+          });
+          throw error;
+        } finally {
+          span.end();
+          const duration = Date.now() - startTime;
+          const metricAttrs = {
+            "files.operation": operation,
+            success: String(success),
+          };
+          this.telemetryMetrics.operationCount.add(1, metricAttrs);
+          this.telemetryMetrics.operationDuration.record(duration, metricAttrs);
+        }
+      },
+      { name: this.name, includePrefix: true },
+    );
+  }
+
+  async list(
+    client: WorkspaceClient,
+    directoryPath?: string,
+  ): Promise<DirectoryEntry[]> {
+    const resolvedPath = directoryPath
+      ? this.resolvePath(directoryPath)
+      : this.defaultVolume;
+    if (!resolvedPath) {
+      throw new Error("No directory path provided and no default volume set.");
+    }
+
+    return this.traced("list", { "files.path": resolvedPath }, async () => {
+      const entries: DirectoryEntry[] = [];
+      for await (const entry of client.files.listDirectoryContents({
+        directory_path: resolvedPath,
+      })) {
+        entries.push(entry);
+      }
+      return entries;
+    });
+  }
+
+  async read(client: WorkspaceClient, filePath: string): Promise<string> {
+    return this.traced(
+      "read",
+      { "files.path": this.resolvePath(filePath) },
+      async () => {
+        const response = await this.download(client, filePath);
+        if (!response.contents) {
+          return "";
+        }
+        const reader = response.contents.getReader();
+        const decoder = new TextDecoder();
+        let result = "";
+        while (true) {
+          const { done, value } = await reader.read();
+          if (done) break;
+          result += decoder.decode(value, { stream: true });
+        }
+        result += decoder.decode();
+        return result;
+      },
+    );
+  }
+
+  async download(
+    client: WorkspaceClient,
+    filePath: string,
+  ): Promise<DownloadResponse> {
+    return this.traced(
+      "download",
+      { "files.path": this.resolvePath(filePath) },
+      async () => {
+        return client.files.download({
+          file_path: this.resolvePath(filePath),
+        });
+      },
+    );
+  }
+
+  async exists(client: WorkspaceClient, filePath: string): Promise<boolean> {
+    return this.traced(
+      "exists",
+      { "files.path": this.resolvePath(filePath) },
+      async () => {
+        try {
+          await this.metadata(client, filePath);
+          return true;
+        } catch (error) {
+          if (error instanceof ApiError && error.statusCode === 404) {
+            return false;
+          }
+          throw error;
+        }
+      },
+    );
+  }
+
+  async metadata(
+    client: WorkspaceClient,
+    filePath: string,
+  ): Promise<FileMetadata> {
+    return this.traced(
+      "metadata",
+      { "files.path": this.resolvePath(filePath) },
+      async () => {
+        const response = await client.files.getMetadata({
+          file_path: this.resolvePath(filePath),
+        });
+        return {
+          contentLength: response["content-length"],
+          contentType: contentTypeFromPath(
+            filePath,
+            response["content-type"],
+            this.customContentTypes,
+          ),
+          lastModified: response["last-modified"],
+        };
+      },
+    );
+  }
+
+  async upload(
+    client: WorkspaceClient,
+    filePath: string,
+    contents: ReadableStream | Buffer | string,
+    options?: { overwrite?: boolean },
+  ): Promise<void> {
+    const resolvedPath = this.resolvePath(filePath);
+
+    return this.traced("upload", { "files.path": resolvedPath }, async () => {
+      const body = contents;
+      const overwrite = options?.overwrite ?? true;
+
+      // Workaround: The SDK's files.upload() has two bugs:
+      // 1. It ignores the `contents` field (sets body to undefined)
+      // 2. apiClient.request() checks `instanceof` against its own ReadableStream
+      //    subclass, so standard ReadableStream instances get JSON.stringified to "{}"
+      // Bypass both by calling the REST API directly with SDK-provided auth.
+      const url = new URL(
+        `/api/2.0/fs/files${resolvedPath}`,
+        client.config.host,
+      );
+      url.searchParams.set("overwrite", String(overwrite));
+
+      const headers = new Headers({
+        "Content-Type": "application/octet-stream",
+      });
+      const fetchOptions: RequestInit = { method: "PUT", headers, body };
+
+      if (body instanceof ReadableStream) {
+        fetchOptions.duplex = "half";
+      }
+
+      await client.config.authenticate(headers);
+
+      const res = await fetch(url.toString(), fetchOptions);
+
+      if (!res.ok) {
+        const text = await res.text();
+        logger.error(`Upload failed (${res.status}): ${text}`);
+        throw new Error(`Upload failed (${res.status}): ${text}`);
+      }
+    });
+  }
+
+  async createDirectory(
+    client: WorkspaceClient,
+    directoryPath: string,
+  ): Promise<void> {
+    return this.traced(
+      "createDirectory",
+      { "files.path": this.resolvePath(directoryPath) },
+      async () => {
+        await client.files.createDirectory({
+          directory_path: this.resolvePath(directoryPath),
+        });
+      },
+    );
+  }
+
+  async delete(client: WorkspaceClient, filePath: string): Promise<void> {
+    return this.traced(
+      "delete",
+      { "files.path": this.resolvePath(filePath) },
+      async () => {
+        await client.files.delete({
+          file_path: this.resolvePath(filePath),
+        });
+      },
+    );
+  }
+
+  async preview(
+    client: WorkspaceClient,
+    filePath: string,
+    options?: { maxChars?: number },
+  ): Promise<FilePreview> {
+    return this.traced(
+      "preview",
+      { "files.path": this.resolvePath(filePath) },
+      async () => {
+        const meta = await this.metadata(client, filePath);
+        const isText = isTextContentType(meta.contentType);
+        const isImage = meta.contentType?.startsWith("image/") || false;
+
+        if (!isText) {
+          return { ...meta, textPreview: null, isText: false, isImage };
+        }
+
+        const response = await client.files.download({
+          file_path: this.resolvePath(filePath),
+        });
+        if (!response.contents) {
+          return { ...meta, textPreview: "", isText: true, isImage: false };
+        }
+
+        const reader = response.contents.getReader();
+        const decoder = new TextDecoder();
+        let preview = "";
+        const maxChars = options?.maxChars ?? 1024;
+
+        while (preview.length < maxChars) {
+          const { done, value } = await reader.read();
+          if (done) break;
+          preview += decoder.decode(value, { stream: true });
+        }
+        preview += decoder.decode();
+        await reader.cancel();
+
+        if (preview.length > maxChars) {
+          preview = preview.slice(0, maxChars);
+        }
+
+        return { ...meta, textPreview: preview, isText: true, isImage: false };
+      },
+    );
+  }
+}
diff --git a/packages/appkit/src/connectors/files/defaults.ts b/packages/appkit/src/connectors/files/defaults.ts
new file mode 100644
index 00000000..2c9e54de
--- /dev/null
+++ b/packages/appkit/src/connectors/files/defaults.ts
@@ -0,0 +1,110 @@
+export const EXTENSION_CONTENT_TYPES: Record<string, string> = Object.freeze({
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".gif": "image/gif",
+  ".webp": "image/webp",
+  ".svg": "image/svg+xml",
+  ".bmp": "image/bmp",
+  ".ico": "image/vnd.microsoft.icon",
+  ".html": "text/html",
+  ".css": "text/css",
+  ".js": "text/javascript",
+  ".ts": "text/typescript",
+  ".py": "text/x-python",
+  ".txt": "text/plain",
+  ".md": "text/markdown",
+  ".csv": "text/csv",
+  ".json": "application/json",
+  ".jsonl": "application/x-ndjson",
+  ".xml": "application/xml",
+  ".yaml": "application/x-yaml",
+  ".yml": "application/x-yaml",
+  ".sql": "application/sql",
+  ".pdf": "application/pdf",
+  ".ipynb": "application/x-ipynb+json",
+  ".parquet": "application/vnd.apache.parquet",
+  ".zip": "application/zip",
+  ".gz": "application/gzip",
+});
+
+const TEXT_KEYWORDS = ["json", "xml", "yaml", "sql", "javascript"] as const;
+
+/**
+ * Determine whether a content type represents text.
+ *
+ * Returns `true` for any `text/*` type and for known structured-text types
+ * such as JSON, XML, YAML, SQL, and JavaScript.
+ *
+ * @param contentType - MIME content type string to check.
+ * @returns `true` if the content type is text-based.
+ */
+export function isTextContentType(contentType: string | undefined): boolean {
+  if (!contentType) return false;
+  if (contentType.startsWith("text/")) return true;
+  return TEXT_KEYWORDS.some((kw) => contentType.includes(kw));
+}
+
+/**
+ * Resolve the MIME content type for a file path.
+ *
+ * Resolution order:
+ * 1. Custom type map (if the extension matches a key in `customTypes`).
+ * 2. Built-in extension map ({@link EXTENSION_CONTENT_TYPES}).
+ * 3. The `reported` type from the server, or `application/octet-stream` as a fallback.
+ *
+ * @param filePath - File path used to extract the extension.
+ * @param reported - Content type reported by the server (used as fallback).
+ * @param customTypes - Optional map of extensions to MIME types that takes priority.
+ * @returns The resolved MIME content type string.
+ */
+/**
+ * MIME types that are safe to serve inline (i.e. browsers cannot execute
+ * scripts from them). Any type **not** in this set should be forced to
+ * download via `Content-Disposition: attachment` when served by the `/raw`
+ * endpoint to prevent stored-XSS attacks.
+ */
+export const SAFE_INLINE_CONTENT_TYPES: ReadonlySet<string> = new Set([
+  "image/png",
+  "image/jpeg",
+  "image/gif",
+  "image/webp",
+  "image/bmp",
+  "image/vnd.microsoft.icon",
+  "text/plain",
+  "text/csv",
+  "text/markdown",
+  "application/json",
+  "application/pdf",
+]);
+
+/**
+ * Check whether a content type is safe to serve inline.
+ *
+ * @param contentType - MIME content type string.
+ * @returns `true` if the type is in the safe-inline allowlist.
+ */
+export function isSafeInlineContentType(contentType: string): boolean {
+  return SAFE_INLINE_CONTENT_TYPES.has(contentType);
+}
+
+export function contentTypeFromPath(
+  filePath: string,
+  reported?: string,
+  customTypes?: Record<string, string>,
+): string {
+  const ext = filePath.slice(filePath.lastIndexOf(".")).toLowerCase();
+  const fromCustom = customTypes?.[ext];
+
+  if (fromCustom) {
+    return fromCustom;
+  }
+
+  const fromExt = EXTENSION_CONTENT_TYPES[ext];
+
+  if (fromExt) {
+    return fromExt;
+  }
+
+  return reported ?? "application/octet-stream";
+}
diff --git a/packages/appkit/src/connectors/files/index.ts b/packages/appkit/src/connectors/files/index.ts
new file mode 100644
index 00000000..6f0217a1
--- /dev/null
+++ b/packages/appkit/src/connectors/files/index.ts
@@ -0,0 +1,2 @@
+export * from "./client";
+export * from "./defaults";
diff --git a/packages/appkit/src/connectors/files/tests/client.test.ts b/packages/appkit/src/connectors/files/tests/client.test.ts
new file mode 100644
index 00000000..96e4693a
--- /dev/null
+++ b/packages/appkit/src/connectors/files/tests/client.test.ts
@@ -0,0 +1,804 @@
+import type { WorkspaceClient } from "@databricks/sdk-experimental";
+import { createMockTelemetry } from "@tools/test-helpers";
+import { afterEach, beforeEach, describe, expect, test, vi } from "vitest";
+import { FilesConnector } from "../client";
+
+function streamFromString(text: string): ReadableStream<Uint8Array> {
+  const encoder = new TextEncoder();
+  return new ReadableStream({
+    start(controller) {
+      controller.enqueue(encoder.encode(text));
+      controller.close();
+    },
+  });
+}
+
+function streamFromChunks(chunks: string[]): ReadableStream<Uint8Array> {
+  const encoder = new TextEncoder();
+  return new ReadableStream({
+    start(controller) {
+      for (const chunk of chunks) {
+        controller.enqueue(encoder.encode(chunk));
+      }
+      controller.close();
+    },
+  });
+}
+
+const { mockFilesApi, mockConfig, mockClient, MockApiError } = vi.hoisted(
+  () => {
+    const mockFilesApi = {
+      listDirectoryContents: vi.fn(),
+      download: vi.fn(),
+      getMetadata: vi.fn(),
+      upload: vi.fn(),
+      createDirectory: vi.fn(),
+      delete: vi.fn(),
+    };
+
+    const mockConfig = {
+      host: "https://test.databricks.com",
+      authenticate: vi.fn(),
+    };
+
+    const mockClient = {
+      files: mockFilesApi,
+      config: mockConfig,
+    } as unknown as WorkspaceClient;
+
+    class MockApiError extends Error {
+      statusCode: number;
+      constructor(message: string, statusCode: number) {
+        super(message);
+        this.name = "ApiError";
+        this.statusCode = statusCode;
+      }
+    }
+
+    return { mockFilesApi, mockConfig, mockClient, MockApiError };
+  },
+);
+
+vi.mock("@databricks/sdk-experimental", () => ({
+  WorkspaceClient: vi.fn(() => mockClient),
+  ApiError: MockApiError,
+}));
+
+const mockTelemetry = createMockTelemetry();
+
+vi.mock("../../../telemetry", () => ({
+  TelemetryManager: {
+    getProvider: vi.fn(() => mockTelemetry),
+  },
+  SpanKind: { CLIENT: 2 },
+  SpanStatusCode: { OK: 1, ERROR: 2 },
+}));
+
+describe("FilesConnector", () => {
+  describe("Path Resolution", () => {
+    beforeEach(() => {
+      vi.clearAllMocks();
+    });
+
+    test("absolute paths are returned as-is", () => {
+      const connector = new FilesConnector({
+        defaultVolume: "/Volumes/catalog/schema/vol",
+      });
+
+      mockFilesApi.download.mockResolvedValue({ contents: null });
+      connector.download(mockClient, "/Volumes/other/path/file.txt");
+
+      expect(mockFilesApi.download).toHaveBeenCalledWith({
+        file_path: "/Volumes/other/path/file.txt",
+      });
+    });
+
+    test("relative paths prepend defaultVolume", () => {
+      const connector = new FilesConnector({
+        defaultVolume: "/Volumes/catalog/schema/vol",
+      });
+
+      mockFilesApi.download.mockResolvedValue({ contents: null });
+      connector.download(mockClient, "subdir/file.txt");
+
+      expect(mockFilesApi.download).toHaveBeenCalledWith({
+        file_path: "/Volumes/catalog/schema/vol/subdir/file.txt",
+      });
+    });
+
+    test("relative path without defaultVolume throws error", async () => {
+      const connector = new FilesConnector({});
+
+      await expect(connector.download(mockClient, "file.txt")).rejects.toThrow(
+        "Cannot resolve relative path: no default volume set.",
+      );
+    });
+
+    test("volume() creates new connector scoped to a different volume", () => {
+      const connector = new FilesConnector({
+        defaultVolume: "/Volumes/catalog/schema/vol1",
+      });
+
+      const scoped = connector.volume("/Volumes/catalog/schema/vol2");
+
+      mockFilesApi.download.mockResolvedValue({ contents: null });
+      scoped.download(mockClient, "file.txt");
+
+      expect(mockFilesApi.download).toHaveBeenCalledWith({
+        file_path: "/Volumes/catalog/schema/vol2/file.txt",
+      });
+    });
+
+    test("volume() does not affect the original connector", () => {
+      const connector = new FilesConnector({
+        defaultVolume: "/Volumes/catalog/schema/vol1",
+      });
+
+      connector.volume("/Volumes/catalog/schema/vol2");
+
+      mockFilesApi.download.mockResolvedValue({ contents: null });
+      connector.download(mockClient, "file.txt");
+
+      expect(mockFilesApi.download).toHaveBeenCalledWith({
+        file_path: "/Volumes/catalog/schema/vol1/file.txt",
+      });
+    });
+
+    test("paths containing '..' are rejected", async () => {
+      const connector = new FilesConnector({
+        defaultVolume: "/Volumes/catalog/schema/vol",
+      });
+
+      await expect(
+        connector.download(mockClient, "../../../etc/passwd"),
+      ).rejects.toThrow('Path traversal ("../") is not allowed.');
+    });
+
+    test("absolute paths containing '..' are rejected", async () => {
+      const connector = new FilesConnector({
+        defaultVolume: "/Volumes/catalog/schema/vol",
+      });
+
+      await expect(
+        connector.download(mockClient, "/Volumes/catalog/../other/file.txt"),
+      ).rejects.toThrow('Path traversal ("../") is not allowed.');
+    });
+
+    test("constructor without defaultVolume omits it", async () => {
+      const connector = new FilesConnector({});
+
+      await expect(connector.list(mockClient)).rejects.toThrow(
+        "No directory path provided and no default volume set.",
+      );
+    });
+  });
+
+  describe("list()", () => {
+    let connector: FilesConnector;
+
+    beforeEach(() => {
+      vi.clearAllMocks();
+      connector = new FilesConnector({
+        defaultVolume: "/Volumes/catalog/schema/vol",
+      });
+    });
+
+    test("collects async iterator entries", async () => {
+      const entries = [
+        {
+          name: "file1.txt",
+          path: "/Volumes/catalog/schema/vol/file1.txt",
+          is_directory: false,
+        },
+        {
+          name: "subdir",
+          path: "/Volumes/catalog/schema/vol/subdir",
+          is_directory: true,
+        },
+      ];
+
+      mockFilesApi.listDirectoryContents.mockReturnValue(
+        (async function* () {
+          for (const entry of entries) {
+            yield entry;
+          }
+        })(),
+      );
+
+      const result = await connector.list(mockClient);
+
+      expect(result).toEqual(entries);
+      expect(mockFilesApi.listDirectoryContents).toHaveBeenCalledWith({
+        directory_path: "/Volumes/catalog/schema/vol",
+      });
+    });
+
+    test("uses defaultVolume when no path provided", async () => {
+      mockFilesApi.listDirectoryContents.mockReturnValue(
+        (async function* () {})(),
+      );
+
+      await connector.list(mockClient);
+
+      expect(mockFilesApi.listDirectoryContents).toHaveBeenCalledWith({
+        directory_path: "/Volumes/catalog/schema/vol",
+      });
+    });
+
+    test("throws when no path and no defaultVolume", async () => {
+      const noVolumeConnector = new FilesConnector({});
+
+      await expect(noVolumeConnector.list(mockClient)).rejects.toThrow(
+        "No directory path provided and no default volume set.",
+      );
+    });
+
+    test("uses provided absolute path", async () => {
+      mockFilesApi.listDirectoryContents.mockReturnValue(
+        (async function* () {})(),
+      );
+
+      await connector.list(mockClient, "/Volumes/other/path");
+
+      expect(mockFilesApi.listDirectoryContents).toHaveBeenCalledWith({
+        directory_path: "/Volumes/other/path",
+      });
+    });
+
+    test("resolves relative path with defaultVolume", async () => {
+      mockFilesApi.listDirectoryContents.mockReturnValue(
+        (async function* () {})(),
+      );
+
+      await connector.list(mockClient, "subdir");
+
+      expect(mockFilesApi.listDirectoryContents).toHaveBeenCalledWith({
+        directory_path: "/Volumes/catalog/schema/vol/subdir",
+      });
+    });
+
+    test("returns empty array for empty directory", async () => {
+      mockFilesApi.listDirectoryContents.mockReturnValue(
+        (async function* () {})(),
+      );
+
+      const result = await connector.list(mockClient);
+
+      expect(result).toEqual([]);
+    });
+  });
+
+  describe("read()", () => {
+    let connector: FilesConnector;
+
+    beforeEach(() => {
+      vi.clearAllMocks();
+      connector = new FilesConnector({
+        defaultVolume: "/Volumes/catalog/schema/vol",
+      });
+    });
+
+    test("decodes ReadableStream to UTF-8 string", async () => {
+      const content = "Hello, world!";
+      mockFilesApi.download.mockResolvedValue({
+        contents: streamFromString(content),
+      });
+
+      const result = await connector.read(mockClient, "/file.txt");
+
+      expect(result).toBe(content);
+    });
+
+    test("returns empty string when contents is null", async () => {
+      mockFilesApi.download.mockResolvedValue({ contents: null });
+
+      const result = await connector.read(mockClient, "/empty.txt");
+
+      expect(result).toBe("");
+    });
+
+    test("concatenates multiple chunks correctly", async () => {
+      mockFilesApi.download.mockResolvedValue({
+        contents: streamFromChunks(["Hello, ", "world", "!"]),
+      });
+
+      const result = await connector.read(mockClient, "/chunked.txt");
+
+      expect(result).toBe("Hello, world!");
+    });
+
+    test("handles multi-byte UTF-8 characters", async () => {
+      const content = "Héllo wörld 🌍";
+      mockFilesApi.download.mockResolvedValue({
+        contents: streamFromString(content),
+      });
+
+      const result = await connector.read(mockClient, "/unicode.txt");
+
+      expect(result).toBe(content);
+    });
+  });
+
+  describe("download()", () => {
+    let connector: FilesConnector;
+
+    beforeEach(() => {
+      vi.clearAllMocks();
+      connector = new FilesConnector({
+        defaultVolume: "/Volumes/catalog/schema/vol",
+      });
+    });
+
+    test("calls client.files.download with resolved path", async () => {
+      const response = { contents: streamFromString("data") };
+      mockFilesApi.download.mockResolvedValue(response);
+
+      const result = await connector.download(mockClient, "file.txt");
+
+      expect(mockFilesApi.download).toHaveBeenCalledWith({
+        file_path: "/Volumes/catalog/schema/vol/file.txt",
+      });
+      expect(result).toBe(response);
+    });
+
+    test("passes absolute path directly", async () => {
+      const response = { contents: null };
+      mockFilesApi.download.mockResolvedValue(response);
+
+      await connector.download(mockClient, "/Volumes/other/file.txt");
+
+      expect(mockFilesApi.download).toHaveBeenCalledWith({
+        file_path: "/Volumes/other/file.txt",
+      });
+    });
+  });
+
+  describe("exists()", () => {
+    let connector: FilesConnector;
+
+    beforeEach(() => {
+      vi.clearAllMocks();
+      connector = new FilesConnector({
+        defaultVolume: "/Volumes/catalog/schema/vol",
+      });
+    });
+
+    test("returns true when metadata succeeds", async () => {
+      mockFilesApi.getMetadata.mockResolvedValue({
+        "content-length": 100,
+        "content-type": "text/plain",
+        "last-modified": "2025-01-01",
+      });
+
+      const result = await connector.exists(mockClient, "/file.txt");
+
+      expect(result).toBe(true);
+    });
+
+    test("returns false on 404 ApiError", async () => {
+      mockFilesApi.getMetadata.mockRejectedValue(
+        new MockApiError("Not found", 404),
+      );
+
+      const result = await connector.exists(mockClient, "/missing.txt");
+
+      expect(result).toBe(false);
+    });
+
+    test("rethrows non-404 ApiError", async () => {
+      mockFilesApi.getMetadata.mockRejectedValue(
+        new MockApiError("Server error", 500),
+      );
+
+      await expect(connector.exists(mockClient, "/file.txt")).rejects.toThrow(
+        "Server error",
+      );
+    });
+
+    test("rethrows generic errors", async () => {
+      mockFilesApi.getMetadata.mockRejectedValue(new Error("Network failure"));
+
+      await expect(connector.exists(mockClient, "/file.txt")).rejects.toThrow(
+        "Network failure",
+      );
+    });
+  });
+
+  describe("metadata()", () => {
+    let connector: FilesConnector;
+
+    beforeEach(() => {
+      vi.clearAllMocks();
+      connector = new FilesConnector({
+        defaultVolume: "/Volumes/catalog/schema/vol",
+      });
+    });
+
+    test("maps SDK response to FileMetadata", async () => {
+      mockFilesApi.getMetadata.mockResolvedValue({
+        "content-length": 1234,
+        "content-type": "application/json",
+        "last-modified": "2025-06-15T10:00:00Z",
+      });
+
+      const result = await connector.metadata(mockClient, "/data.json");
+
+      expect(result).toEqual({
+        contentLength: 1234,
+        contentType: "application/json",
+        lastModified: "2025-06-15T10:00:00Z",
+      });
+    });
+
+    test("uses contentTypeFromPath to resolve octet-stream", async () => {
+      mockFilesApi.getMetadata.mockResolvedValue({
+        "content-length": 500,
+        "content-type": "application/octet-stream",
+        "last-modified": "2025-01-01",
+      });
+
+      const result = await connector.metadata(mockClient, "/image.png");
+
+      expect(result.contentType).toBe("image/png");
+    });
+
+    test("handles undefined content-type from SDK", async () => {
+      mockFilesApi.getMetadata.mockResolvedValue({
+        "content-length": 100,
+        "content-type": undefined,
+        "last-modified": "2025-01-01",
+      });
+
+      const result = await connector.metadata(mockClient, "/data.csv");
+
+      expect(result.contentType).toBe("text/csv");
+    });
+
+    test("resolves relative path via defaultVolume", async () => {
+      mockFilesApi.getMetadata.mockResolvedValue({
+        "content-length": 0,
+        "content-type": "text/plain",
+        "last-modified": "2025-01-01",
+      });
+
+      await connector.metadata(mockClient, "notes.txt");
+
+      expect(mockFilesApi.getMetadata).toHaveBeenCalledWith({
+        file_path: "/Volumes/catalog/schema/vol/notes.txt",
+      });
+    });
+  });
+
+  describe("upload()", () => {
+    let connector: FilesConnector;
+    let fetchSpy: ReturnType<typeof vi.fn>;
+
+    beforeEach(() => {
+      vi.clearAllMocks();
+      connector = new FilesConnector({
+        defaultVolume: "/Volumes/catalog/schema/vol",
+      });
+      mockConfig.authenticate.mockResolvedValue(undefined);
+      fetchSpy = vi.fn().mockResolvedValue({ ok: true });
+      vi.stubGlobal("fetch", fetchSpy);
+    });
+
+    afterEach(() => {
+      vi.unstubAllGlobals();
+    });
+
+    test("handles string input", async () => {
+      await connector.upload(mockClient, "file.txt", "hello world");
+
+      expect(fetchSpy).toHaveBeenCalledWith(
+        expect.stringContaining(
+          "/api/2.0/fs/files/Volumes/catalog/schema/vol/file.txt",
+        ),
+        expect.objectContaining({
+          method: "PUT",
+          body: "hello world",
+        }),
+      );
+    });
+
+    test("handles Buffer input", async () => {
+      const buf = Buffer.from("buffer data");
+      await connector.upload(mockClient, "file.bin", buf);
+
+      expect(fetchSpy).toHaveBeenCalledWith(
+        expect.any(String),
+        expect.objectContaining({
+          method: "PUT",
+          body: buf,
+        }),
+      );
+    });
+
+    test("handles ReadableStream input (streams directly)", async () => {
+      const stream = streamFromString("stream data");
+      await connector.upload(mockClient, "file.txt", stream);
+
+      expect(fetchSpy).toHaveBeenCalledWith(
+        expect.any(String),
+        expect.objectContaining({
+          method: "PUT",
+          body: expect.any(ReadableStream),
+          duplex: "half",
+        }),
+      );
+    });
+
+    test("defaults overwrite to true", async () => {
+      await connector.upload(mockClient, "file.txt", "data");
+
+      const url = fetchSpy.mock.calls[0][0] as string;
+      expect(url).toContain("overwrite=true");
+    });
+
+    test("sets overwrite=false when specified", async () => {
+      await connector.upload(mockClient, "file.txt", "data", {
+        overwrite: false,
+      });
+
+      const url = fetchSpy.mock.calls[0][0] as string;
+      expect(url).toContain("overwrite=false");
+    });
+
+    test("calls config.authenticate on the headers", async () => {
+      await connector.upload(mockClient, "file.txt", "data");
+
+      expect(mockConfig.authenticate).toHaveBeenCalledWith(expect.any(Headers));
+    });
+
+    test("builds URL from client.config.host", async () => {
+      await connector.upload(mockClient, "file.txt", "data");
+
+      const url = fetchSpy.mock.calls[0][0] as string;
+      expect(url).toMatch(
+        /^https:\/\/test\.databricks\.com\/api\/2\.0\/fs\/files/,
+      );
+    });
+
+    test("throws on non-ok response", async () => {
+      fetchSpy.mockResolvedValue({
+        ok: false,
+        status: 403,
+        text: () => Promise.resolve("Forbidden"),
+      });
+
+      await expect(
+        connector.upload(mockClient, "file.txt", "data"),
+      ).rejects.toThrow("Upload failed (403): Forbidden");
+    });
+
+    test("resolves absolute paths directly", async () => {
+      await connector.upload(mockClient, "/Volumes/other/vol/file.txt", "data");
+
+      const url = fetchSpy.mock.calls[0][0] as string;
+      expect(url).toContain("/api/2.0/fs/files/Volumes/other/vol/file.txt");
+    });
+  });
+
+  describe("createDirectory()", () => {
+    let connector: FilesConnector;
+
+    beforeEach(() => {
+      vi.clearAllMocks();
+      connector = new FilesConnector({
+        defaultVolume: "/Volumes/catalog/schema/vol",
+      });
+    });
+
+    test("calls client.files.createDirectory with resolved path", async () => {
+      mockFilesApi.createDirectory.mockResolvedValue(undefined);
+
+      await connector.createDirectory(mockClient, "new-dir");
+
+      expect(mockFilesApi.createDirectory).toHaveBeenCalledWith({
+        directory_path: "/Volumes/catalog/schema/vol/new-dir",
+      });
+    });
+
+    test("uses absolute path when provided", async () => {
+      mockFilesApi.createDirectory.mockResolvedValue(undefined);
+
+      await connector.createDirectory(
+        mockClient,
+        "/Volumes/other/path/new-dir",
+      );
+
+      expect(mockFilesApi.createDirectory).toHaveBeenCalledWith({
+        directory_path: "/Volumes/other/path/new-dir",
+      });
+    });
+  });
+
+  describe("delete()", () => {
+    let connector: FilesConnector;
+
+    beforeEach(() => {
+      vi.clearAllMocks();
+      connector = new FilesConnector({
+        defaultVolume: "/Volumes/catalog/schema/vol",
+      });
+    });
+
+    test("calls client.files.delete with resolved path", async () => {
+      mockFilesApi.delete.mockResolvedValue(undefined);
+
+      await connector.delete(mockClient, "file.txt");
+
+      expect(mockFilesApi.delete).toHaveBeenCalledWith({
+        file_path: "/Volumes/catalog/schema/vol/file.txt",
+      });
+    });
+
+    test("uses absolute path when provided", async () => {
+      mockFilesApi.delete.mockResolvedValue(undefined);
+
+      await connector.delete(mockClient, "/Volumes/other/file.txt");
+
+      expect(mockFilesApi.delete).toHaveBeenCalledWith({
+        file_path: "/Volumes/other/file.txt",
+      });
+    });
+  });
+
+  describe("preview()", () => {
+    let connector: FilesConnector;
+
+    beforeEach(() => {
+      vi.clearAllMocks();
+      connector = new FilesConnector({
+        defaultVolume: "/Volumes/catalog/schema/vol",
+      });
+    });
+
+    test("text files return truncated preview (max 1024 chars)", async () => {
+      const longText = "A".repeat(2000);
+
+      mockFilesApi.getMetadata.mockResolvedValue({
+        "content-length": 2000,
+        "content-type": "text/plain",
+        "last-modified": "2025-01-01",
+      });
+      mockFilesApi.download.mockResolvedValue({
+        contents: streamFromString(longText),
+      });
+
+      const result = await connector.preview(mockClient, "/file.txt");
+
+      expect(result.isText).toBe(true);
+      expect(result.isImage).toBe(false);
+      expect(result.textPreview).not.toBeNull();
+      expect(result.textPreview?.length).toBeLessThanOrEqual(1024);
+    });
+
+    test("text/html files are treated as text", async () => {
+      mockFilesApi.getMetadata.mockResolvedValue({
+        "content-length": 30,
+        "content-type": "text/html",
+        "last-modified": "2025-01-01",
+      });
+      mockFilesApi.download.mockResolvedValue({
+        contents: streamFromString("<h1>Hello</h1>"),
+      });
+
+      const result = await connector.preview(mockClient, "/page.html");
+
+      expect(result.isText).toBe(true);
+      expect(result.textPreview).toBe("<h1>Hello</h1>");
+    });
+
+    test("application/json files are treated as text", async () => {
+      mockFilesApi.getMetadata.mockResolvedValue({
+        "content-length": 20,
+        "content-type": "application/json",
+        "last-modified": "2025-01-01",
+      });
+      mockFilesApi.download.mockResolvedValue({
+        contents: streamFromString('{"key":"value"}'),
+      });
+
+      const result = await connector.preview(mockClient, "/data.json");
+
+      expect(result.isText).toBe(true);
+      expect(result.textPreview).toBe('{"key":"value"}');
+    });
+
+    test("application/xml files are treated as text", async () => {
+      mockFilesApi.getMetadata.mockResolvedValue({
+        "content-length": 30,
+        "content-type": "application/xml",
+        "last-modified": "2025-01-01",
+      });
+      mockFilesApi.download.mockResolvedValue({
+        contents: streamFromString("<root/>"),
+      });
+
+      const result = await connector.preview(mockClient, "/data.xml");
+
+      expect(result.isText).toBe(true);
+      expect(result.textPreview).toBe("<root/>");
+    });
+
+    test("image files return isImage: true, textPreview: null", async () => {
+      mockFilesApi.getMetadata.mockResolvedValue({
+        "content-length": 5000,
+        "content-type": "image/png",
+        "last-modified": "2025-01-01",
+      });
+
+      const result = await connector.preview(mockClient, "/image.png");
+
+      expect(result.isImage).toBe(true);
+      expect(result.isText).toBe(false);
+      expect(result.textPreview).toBeNull();
+    });
+
+    test("other files return isText: false, isImage: false, textPreview: null", async () => {
+      mockFilesApi.getMetadata.mockResolvedValue({
+        "content-length": 1000,
+        "content-type": "application/pdf",
+        "last-modified": "2025-01-01",
+      });
+
+      const result = await connector.preview(mockClient, "/doc.pdf");
+
+      expect(result.isText).toBe(false);
+      expect(result.isImage).toBe(false);
+      expect(result.textPreview).toBeNull();
+    });
+
+    test("empty file contents return empty string preview", async () => {
+      mockFilesApi.getMetadata.mockResolvedValue({
+        "content-length": 0,
+        "content-type": "text/plain",
+        "last-modified": "2025-01-01",
+      });
+      mockFilesApi.download.mockResolvedValue({
+        contents: null,
+      });
+
+      const result = await connector.preview(mockClient, "/empty.txt");
+
+      expect(result.isText).toBe(true);
+      expect(result.isImage).toBe(false);
+      expect(result.textPreview).toBe("");
+    });
+
+    test("preview spreads metadata into result", async () => {
+      mockFilesApi.getMetadata.mockResolvedValue({
+        "content-length": 42,
+        "content-type": "text/plain",
+        "last-modified": "2025-06-15T10:00:00Z",
+      });
+      mockFilesApi.download.mockResolvedValue({
+        contents: streamFromString("hello"),
+      });
+
+      const result = await connector.preview(mockClient, "/notes.txt");
+
+      expect(result.contentLength).toBe(42);
+      expect(result.contentType).toBe("text/plain");
+      expect(result.lastModified).toBe("2025-06-15T10:00:00Z");
+      expect(result.textPreview).toBe("hello");
+    });
+
+    test("short text file returns full content", async () => {
+      const content = "Short file.";
+      mockFilesApi.getMetadata.mockResolvedValue({
+        "content-length": content.length,
+        "content-type": "text/plain",
+        "last-modified": "2025-01-01",
+      });
+      mockFilesApi.download.mockResolvedValue({
+        contents: streamFromString(content),
+      });
+
+      const result = await connector.preview(mockClient, "/short.txt");
+
+      expect(result.textPreview).toBe(content);
+    });
+  });
+});
diff --git a/packages/appkit/src/connectors/files/tests/defaults.test.ts b/packages/appkit/src/connectors/files/tests/defaults.test.ts
new file mode 100644
index 00000000..70d09dbf
--- /dev/null
+++ b/packages/appkit/src/connectors/files/tests/defaults.test.ts
@@ -0,0 +1,54 @@
+import { describe, expect, test } from "vitest";
+import {
+  isSafeInlineContentType,
+  SAFE_INLINE_CONTENT_TYPES,
+} from "../defaults";
+
+describe("isSafeInlineContentType", () => {
+  const safeTypes = [
+    "image/png",
+    "image/jpeg",
+    "image/gif",
+    "image/webp",
+    "image/bmp",
+    "image/vnd.microsoft.icon",
+    "text/plain",
+    "text/csv",
+    "text/markdown",
+    "application/json",
+    "application/pdf",
+  ];
+
+  for (const type of safeTypes) {
+    test(`returns true for safe type: ${type}`, () => {
+      expect(isSafeInlineContentType(type)).toBe(true);
+    });
+  }
+
+  const dangerousTypes = [
+    "text/html",
+    "text/javascript",
+    "image/svg+xml",
+    "text/css",
+    "application/xml",
+  ];
+
+  for (const type of dangerousTypes) {
+    test(`returns false for dangerous type: ${type}`, () => {
+      expect(isSafeInlineContentType(type)).toBe(false);
+    });
+  }
+
+  test("returns false for unknown types", () => {
+    expect(isSafeInlineContentType("application/octet-stream")).toBe(false);
+    expect(isSafeInlineContentType("application/x-yaml")).toBe(false);
+    expect(isSafeInlineContentType("video/mp4")).toBe(false);
+  });
+
+  test("SAFE_INLINE_CONTENT_TYPES is frozen (ReadonlySet)", () => {
+    expect(SAFE_INLINE_CONTENT_TYPES.size).toBe(safeTypes.length);
+    for (const type of safeTypes) {
+      expect(SAFE_INLINE_CONTENT_TYPES.has(type)).toBe(true);
+    }
+  });
+});
diff --git a/packages/appkit/src/connectors/index.ts b/packages/appkit/src/connectors/index.ts
index 01d23cf2..19181323 100644
--- a/packages/appkit/src/connectors/index.ts
+++ b/packages/appkit/src/connectors/index.ts
@@ -1,2 +1,4 @@
+export * from "./files";
+export * from "./lakebase";
 export * from "./lakebase-v1";
 export * from "./sql-warehouse";
diff --git a/packages/appkit/src/connectors/lakebase/index.ts b/packages/appkit/src/connectors/lakebase/index.ts
new file mode 100644
index 00000000..e33ac077
--- /dev/null
+++ b/packages/appkit/src/connectors/lakebase/index.ts
@@ -0,0 +1,42 @@
+import {
+  createLakebasePool as createLakebasePoolBase,
+  type LakebasePoolConfig,
+} from "@databricks/lakebase";
+import type pg from "pg";
+import { createLogger } from "@/logging/logger";
+
+/**
+ * Create a Lakebase pool with appkit's logger integration.
+ * Telemetry automatically uses appkit's OpenTelemetry configuration via global registry.
+ *
+ * @param config - Lakebase pool configuration
+ * @returns PostgreSQL pool with appkit integration
+ */
+export function createLakebasePool(
+  config?: Partial<LakebasePoolConfig>,
+): pg.Pool {
+  const logger = createLogger("connectors:lakebase");
+
+  return createLakebasePoolBase({
+    ...config,
+    logger,
+  });
+}
+
+// Re-export everything else from lakebase
+export {
+  createTokenRefreshCallback,
+  type DatabaseCredential,
+  type DriverTelemetry,
+  type GenerateDatabaseCredentialRequest,
+  generateDatabaseCredential,
+  getLakebaseOrmConfig,
+  getLakebasePgConfig,
+  getWorkspaceClient,
+  type LakebasePoolConfig,
+  type Logger,
+  type RequestedClaims,
+  RequestedClaimsPermissionSet,
+  type RequestedResource,
+  type TokenRefreshDeps,
+} from "@databricks/lakebase";
diff --git a/packages/appkit/src/index.ts b/packages/appkit/src/index.ts
index b0745592..67a93cf7 100644
--- a/packages/appkit/src/index.ts
+++ b/packages/appkit/src/index.ts
@@ -14,6 +14,22 @@ export type {
 } from "shared";
 export { isSQLTypeMarker, sql } from "shared";
 export { CacheManager } from "./cache";
+export type {
+  DatabaseCredential,
+  GenerateDatabaseCredentialRequest,
+  LakebasePoolConfig,
+  RequestedClaims,
+  RequestedResource,
+} from "./connectors/lakebase";
+// Lakebase Autoscaling connector
+export {
+  createLakebasePool,
+  generateDatabaseCredential,
+  getLakebaseOrmConfig,
+  getLakebasePgConfig,
+  getWorkspaceClient,
+  RequestedClaimsPermissionSet,
+} from "./connectors/lakebase";
 export { getExecutionContext } from "./context";
 export { createApp } from "./core";
 // Errors
@@ -30,7 +46,8 @@ export {
 } from "./errors";
 // Plugin authoring
 export { Plugin, toPlugin } from "./plugin";
-export { analytics, server } from "./plugins";
+export { analytics, files, server } from "./plugins";
+export { contentTypeFromPath } from "./plugins/files/helpers";
 // Registry types and utilities for plugin manifests
 export type {
   ConfigSchema,
@@ -57,5 +74,6 @@ export {
   SpanStatusCode,
   type TelemetryConfig,
 } from "./telemetry";
+
 // Vite plugin and type generation
 export { appKitTypesPlugin } from "./type-generator/vite-plugin";
diff --git a/packages/appkit/src/plugin/plugin.ts b/packages/appkit/src/plugin/plugin.ts
index 4f60f195..374e2f77 100644
--- a/packages/appkit/src/plugin/plugin.ts
+++ b/packages/appkit/src/plugin/plugin.ts
@@ -51,6 +51,7 @@ const EXCLUDED_FROM_PROXY = new Set([
   "shutdown",
   "injectRoutes",
   "getEndpoints",
+  "getSkipBodyParsingPaths",
   "abortActiveOperations",
   // asUser itself - prevent chaining like .asUser().asUser()
   "asUser",
@@ -157,6 +158,9 @@ export abstract class Plugin<
   /** Registered endpoints for this plugin */
   private registeredEndpoints: PluginEndpointMap = {};
 
+  /** Paths that opt out of JSON body parsing (e.g. file upload routes) */
+  private skipBodyParsingPaths: Set<string> = new Set();
+
   /**
    * Plugin initialization phase.
    * - 'core': Initialized first (e.g., config plugins)
@@ -191,6 +195,10 @@ export abstract class Plugin<
     return this.registeredEndpoints;
   }
 
+  getSkipBodyParsingPaths(): ReadonlySet<string> {
+    return this.skipBodyParsingPaths;
+  }
+
   abortActiveOperations(): void {
     this.streamManager.abortAll();
   }
@@ -372,7 +380,12 @@ export abstract class Plugin<
 
     router[method](path, handler);
 
-    this.registerEndpoint(name, `/api/${this.name}${path}`);
+    const fullPath = `/api/${this.name}${path}`;
+    this.registerEndpoint(name, fullPath);
+
+    if (config.skipBodyParsing) {
+      this.skipBodyParsingPaths.add(fullPath);
+    }
   }
 
   // build execution options by merging defaults, plugin config, and user overrides
diff --git a/packages/appkit/src/plugin/tests/plugin.test.ts b/packages/appkit/src/plugin/tests/plugin.test.ts
index 51f677a8..6c0732d8 100644
--- a/packages/appkit/src/plugin/tests/plugin.test.ts
+++ b/packages/appkit/src/plugin/tests/plugin.test.ts
@@ -552,6 +552,50 @@ describe("Plugin", () => {
     });
   });
 
+  describe("getSkipBodyParsingPaths", () => {
+    test("should return empty set by default", () => {
+      const plugin = new TestPlugin(config);
+
+      expect(plugin.getSkipBodyParsingPaths().size).toBe(0);
+    });
+
+    test("should include paths from routes with skipBodyParsing: true", () => {
+      const plugin = new TestPlugin({ ...config, name: "test" });
+      const mockRouter = {
+        post: vi.fn(),
+      } as any;
+
+      (plugin as any).route(mockRouter, {
+        name: "upload",
+        method: "post",
+        path: "/upload",
+        skipBodyParsing: true,
+        handler: vi.fn(),
+      });
+
+      const paths = plugin.getSkipBodyParsingPaths();
+      expect(paths.has("/api/test/upload")).toBe(true);
+      expect(paths.size).toBe(1);
+    });
+
+    test("should not include paths from routes without skipBodyParsing", () => {
+      const plugin = new TestPlugin({ ...config, name: "test" });
+      const mockRouter = {
+        post: vi.fn(),
+      } as any;
+
+      (plugin as any).route(mockRouter, {
+        name: "create",
+        method: "post",
+        path: "/create",
+        handler: vi.fn(),
+      });
+
+      const paths = plugin.getSkipBodyParsingPaths();
+      expect(paths.size).toBe(0);
+    });
+  });
+
   describe("static properties", () => {
     test("should have default phase of 'normal'", () => {
       expect(Plugin.phase).toBe("normal");
diff --git a/packages/appkit/src/plugins/files/README.md b/packages/appkit/src/plugins/files/README.md
new file mode 100644
index 00000000..13830d6d
--- /dev/null
+++ b/packages/appkit/src/plugins/files/README.md
@@ -0,0 +1,145 @@
+# Files Plugin
+
+The files plugin provides HTTP routes and a programmatic API for Databricks Unity Catalog volume file operations. It supports listing, reading, downloading, uploading, deleting, and previewing files with built-in caching, retry, and timeout handling via the execution interceptor pipeline.
+
+Routes are automatically registered via `injectRoutes` and mounted at `/api/files/*`.
+
+## Configuration
+
+The plugin accepts an `IFilesConfig` object:
+
+```ts
+interface IFilesConfig {
+  timeout?: number;       // Operation timeout in ms
+  defaultVolume?: string; // Absolute volume path, e.g. "/Volumes/catalog/schema/vol"
+}
+```
+
+Usage with the `files()` factory:
+
+```ts
+import { files } from "@databricks/appkit";
+
+files({ defaultVolume: "/Volumes/catalog/schema/vol" });
+```
+
+## Routes
+
+All routes (except `/root`) execute in user context via `asUser(req)`.
+
+| Method | Path        | Query/Body Params            | Response                                          | `exports()` method  |
+| ------ | ----------- | ---------------------------- | ------------------------------------------------- | ------------------- |
+| GET    | `/root`     | -                            | `{ root: string \| null }`                        | -                   |
+| GET    | `/list`     | `?path` (optional)           | `DirectoryEntry[]`                                | `list()`            |
+| GET    | `/read`     | `?path` (required)           | `text/plain` body                                 | `read()`            |
+| GET    | `/download` | `?path` (required)           | Binary stream (`Content-Disposition: attachment`) | `download()`        |
+| GET    | `/raw`      | `?path` (required)           | Binary stream (inline, no Content-Disposition)    | `download()` (inline) |
+| GET    | `/exists`   | `?path` (required)           | `{ exists: boolean }`                             | `exists()`          |
+| GET    | `/metadata` | `?path` (required)           | `FileMetadata`                                    | `metadata()`        |
+| GET    | `/preview`  | `?path` (required)           | `FilePreview`                                     | `preview()`         |
+| POST   | `/upload`   | `?path` (required), raw body | `{ success: true }`                               | `upload()`          |
+| POST   | `/mkdir`    | `body.path` (required)       | `{ success: true }`                               | `createDirectory()` |
+| POST   | `/delete`   | `?path` (required)           | `{ success: true }`                               | `delete()`          |
+
+## Execution Defaults
+
+Every operation runs through the interceptor pipeline with tier-specific defaults:
+
+| Tier       | Cache   | Retry | Timeout | Operations                               |
+| ---------- | ------- | ----- | ------- | ---------------------------------------- |
+| **Read**   | 60 s    | 3×    | 30 s    | list, read, exists, metadata, preview    |
+| **Download** | none  | 3×    | 30 s    | download, raw                            |
+| **Write**  | none    | none  | 600 s   | upload, mkdir, delete                    |
+
+Retry uses exponential backoff with a 1 s initial delay.
+
+## Cache Invalidation
+
+Write operations (`upload`, `mkdir`, `delete`) automatically invalidate the cached `list` entry for the parent directory so subsequent listings reflect the change.
+
+## Types
+
+```ts
+// Plugin configuration
+interface IFilesConfig {
+  timeout?: number;
+  defaultVolume?: string;
+}
+
+// Re-exported from @databricks/sdk-experimental
+type DirectoryEntry = files.DirectoryEntry;
+type DownloadResponse = files.DownloadResponse;
+
+// File metadata returned by /metadata
+interface FileMetadata {
+  contentLength: number | undefined;
+  contentType: string | undefined;
+  lastModified: string | undefined;
+}
+
+// File preview returned by /preview (extends FileMetadata)
+interface FilePreview extends FileMetadata {
+  textPreview: string | null; // First 1 KB of text content, or null for non-text
+  isText: boolean;
+  isImage: boolean;
+}
+```
+
+## `exports()` API
+
+The programmatic API returned by `exports()` for server-side use:
+
+| Method              | Signature                                                              | Returns                  |
+| ------------------- | ---------------------------------------------------------------------- | ------------------------ |
+| `list`              | `(directoryPath?: string)`                                             | `DirectoryEntry[]`       |
+| `read`              | `(filePath: string)`                                                   | `string`                 |
+| `download`          | `(filePath: string)`                                                   | `DownloadResponse`       |
+| `exists`            | `(filePath: string)`                                                   | `boolean`                |
+| `metadata`          | `(filePath: string)`                                                   | `FileMetadata`           |
+| `upload`            | `(filePath: string, contents: ReadableStream \| Buffer \| string, options?: { overwrite?: boolean })` | `void` |
+| `createDirectory`   | `(directoryPath: string)`                                              | `void`                   |
+| `delete`            | `(filePath: string)`                                                   | `void`                   |
+| `preview`           | `(filePath: string, options?: { maxBytes?: number })`                  | `FilePreview`            |
+
+## Path Resolution
+
+Paths can be **absolute** or **relative**:
+
+- **Absolute** — starts with `/`, used as-is (e.g. `/Volumes/catalog/schema/vol/data.csv`)
+- **Relative** — prepended with `defaultVolume` (e.g. `data.csv` → `/Volumes/catalog/schema/vol/data.csv`)
+
+If a relative path is used and no `defaultVolume` is configured, an error is thrown.
+
+The `list()` method with no arguments lists the `defaultVolume` root.
+
+## Content-Type Resolution
+
+`contentTypeFromPath(filePath, reported?)` resolves a file's content type:
+
+1. If the server reports a content type other than `application/octet-stream`, use it.
+2. Otherwise, match the file extension against a built-in map.
+3. Fall back to the reported type or `application/octet-stream`.
+
+Supported extensions: `.png`, `.jpg`, `.jpeg`, `.gif`, `.webp`, `.svg`, `.bmp`, `.ico`, `.json`, `.xml`, `.html`, `.css`, `.js`, `.txt`, `.md`, `.csv`, `.pdf`.
+
+## Error Responses
+
+All errors return JSON with the shape:
+
+```json
+{
+  "error": "Human-readable message",
+  "plugin": "files"
+}
+```
+
+## HTTP Status Codes
+
+| Status | Description                             |
+| ------ | --------------------------------------- |
+| 400    | Missing required `path` parameter       |
+| 500    | Operation failed (SDK or network error) |
+
+## User Context
+
+Routes use `this.asUser(req)` which wraps the plugin's `getFilesClient()` so that the underlying `getWorkspaceClient()` returns a client scoped to the requesting user's Databricks credentials (on-behalf-of / OBO). The `/root` route is the only exception since it only reads plugin config.
diff --git a/packages/appkit/src/plugins/files/defaults.ts b/packages/appkit/src/plugins/files/defaults.ts
new file mode 100644
index 00000000..bb26ce01
--- /dev/null
+++ b/packages/appkit/src/plugins/files/defaults.ts
@@ -0,0 +1,44 @@
+import type { PluginExecuteConfig } from "shared";
+
+/** Execution defaults for read-tier operations (list, read, exists, metadata, preview). Cache 60 s, retry 3x with 1 s backoff, 30 s timeout. */
+export const filesReadDefaults: PluginExecuteConfig = {
+  cache: {
+    enabled: true,
+    ttl: 60_000,
+  },
+  retry: {
+    enabled: true,
+    initialDelay: 1000,
+    attempts: 3,
+  },
+  timeout: 30_000,
+};
+
+/** Execution defaults for download-tier operations (download, raw). No cache, retry 3x with 1 s backoff, 30 s timeout (stream start only). */
+export const filesDownloadDefaults: PluginExecuteConfig = {
+  cache: {
+    enabled: false,
+  },
+  retry: {
+    enabled: true,
+    initialDelay: 1000,
+    attempts: 3,
+  },
+  /**
+   * @info this timeout is for the stream to start, not for the full download.
+   */
+  timeout: 30_000,
+};
+
+/** Execution defaults for write-tier operations (upload, mkdir, delete). No cache, no retry, 600 s timeout. */
+export const filesWriteDefaults: PluginExecuteConfig = {
+  cache: {
+    enabled: false,
+  },
+  retry: {
+    enabled: false,
+  },
+  timeout: 600_000,
+};
+
+export { EXTENSION_CONTENT_TYPES } from "../../connectors/files/defaults";
diff --git a/packages/appkit/src/plugins/files/helpers.ts b/packages/appkit/src/plugins/files/helpers.ts
new file mode 100644
index 00000000..599368bf
--- /dev/null
+++ b/packages/appkit/src/plugins/files/helpers.ts
@@ -0,0 +1,4 @@
+export {
+  contentTypeFromPath,
+  isTextContentType,
+} from "../../connectors/files/defaults";
diff --git a/packages/appkit/src/plugins/files/index.ts b/packages/appkit/src/plugins/files/index.ts
new file mode 100644
index 00000000..8ca86436
--- /dev/null
+++ b/packages/appkit/src/plugins/files/index.ts
@@ -0,0 +1,5 @@
+export * from "./defaults";
+export * from "./helpers";
+export * from "./manifest";
+export * from "./plugin";
+export * from "./types";
diff --git a/packages/appkit/src/plugins/files/manifest.json b/packages/appkit/src/plugins/files/manifest.json
new file mode 100644
index 00000000..2bf5a4f7
--- /dev/null
+++ b/packages/appkit/src/plugins/files/manifest.json
@@ -0,0 +1,36 @@
+{
+  "$schema": "https://databricks.github.io/appkit/schemas/plugin-manifest.schema.json",
+  "name": "files",
+  "displayName": "Files Plugin",
+  "description": "File operations against Databricks Volumes and Unity Catalog",
+  "resources": {
+    "required": [
+      {
+        "type": "volume",
+        "alias": "volume",
+        "resourceKey": "volume",
+        "description": "Unity Catalog Volume for file storage",
+        "permission": "WRITE_VOLUME",
+        "fields": {
+          "path": {
+            "env": "DATABRICKS_VOLUME_PATH",
+            "description": "Volume path (e.g. /Volumes/catalog/schema/volume_name)"
+          }
+        }
+      }
+    ],
+    "optional": []
+  },
+  "config": {
+    "schema": {
+      "type": "object",
+      "properties": {
+        "timeout": {
+          "type": "number",
+          "default": 30000,
+          "description": "File operation timeout in milliseconds"
+        }
+      }
+    }
+  }
+}
diff --git a/packages/appkit/src/plugins/files/manifest.ts b/packages/appkit/src/plugins/files/manifest.ts
new file mode 100644
index 00000000..59ce59ce
--- /dev/null
+++ b/packages/appkit/src/plugins/files/manifest.ts
@@ -0,0 +1,17 @@
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import type { PluginManifest } from "../../registry";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+
+/**
+ * Files plugin manifest.
+ *
+ * @remarks
+ * The source of truth for this manifest is `manifest.json` in the same directory.
+ * This file loads the JSON and exports it with proper TypeScript typing.
+ */
+export const filesManifest: PluginManifest = JSON.parse(
+  readFileSync(join(__dirname, "manifest.json"), "utf-8"),
+) as PluginManifest;
diff --git a/packages/appkit/src/plugins/files/plugin.ts b/packages/appkit/src/plugins/files/plugin.ts
new file mode 100644
index 00000000..01622b1b
--- /dev/null
+++ b/packages/appkit/src/plugins/files/plugin.ts
@@ -0,0 +1,656 @@
+import { Readable } from "node:stream";
+import type express from "express";
+import type { IAppRouter, PluginExecutionSettings } from "shared";
+import {
+  contentTypeFromPath,
+  FilesConnector,
+  isSafeInlineContentType,
+} from "../../connectors/files";
+import { getCurrentUserId, getWorkspaceClient } from "../../context";
+import { createLogger } from "../../logging/logger";
+import { Plugin, toPlugin } from "../../plugin";
+import {
+  filesDownloadDefaults,
+  filesReadDefaults,
+  filesWriteDefaults,
+} from "./defaults";
+import { filesManifest } from "./manifest";
+import type { DownloadResponse, IFilesConfig } from "./types";
+
+const logger = createLogger("files");
+
+export class FilesPlugin extends Plugin {
+  name = "files";
+
+  /** Plugin manifest declaring metadata and resource requirements. */
+  static manifest = filesManifest;
+  protected static description = "Files plugin for Databricks file operations";
+  protected declare config: IFilesConfig;
+
+  private filesConnector: FilesConnector;
+
+  constructor(config: IFilesConfig) {
+    super(config);
+    this.config = config;
+    this.filesConnector = new FilesConnector({
+      defaultVolume: config.defaultVolume,
+      timeout: config.timeout,
+      telemetry: config.telemetry,
+      customContentTypes: config.customContentTypes,
+    });
+  }
+
+  /**
+   * List entries in a directory.
+   *
+   * @param directoryPath - Absolute or relative path. Defaults to the configured `defaultVolume` root.
+   * @returns Array of directory entries.
+   */
+  async list(directoryPath?: string) {
+    return this.filesConnector.list(getWorkspaceClient(), directoryPath);
+  }
+
+  /**
+   * Read a file and return its contents as a string.
+   *
+   * @param filePath - Absolute or relative path to the file.
+   * @returns The file contents as a UTF-8 string.
+   */
+  async read(filePath: string) {
+    return this.filesConnector.read(getWorkspaceClient(), filePath);
+  }
+
+  /**
+   * Download a file as a readable stream.
+   *
+   * @param filePath - Absolute or relative path to the file.
+   * @returns A response containing a readable stream of the file contents.
+   */
+  async download(filePath: string): Promise<DownloadResponse> {
+    return this.filesConnector.download(getWorkspaceClient(), filePath);
+  }
+
+  /**
+   * Check whether a file exists.
+   *
+   * @param filePath - Absolute or relative path to the file.
+   * @returns `true` if the file exists, `false` otherwise.
+   */
+  async exists(filePath: string) {
+    return this.filesConnector.exists(getWorkspaceClient(), filePath);
+  }
+
+  /**
+   * Retrieve metadata (size, content type, last modified) for a file.
+   *
+   * @param filePath - Absolute or relative path to the file.
+   * @returns File metadata including content length, type, and last modified date.
+   */
+  async metadata(filePath: string) {
+    return this.filesConnector.metadata(getWorkspaceClient(), filePath);
+  }
+
+  /**
+   * Upload a file to a Unity Catalog volume.
+   *
+   * @param filePath - Absolute or relative destination path.
+   * @param contents - File body as a readable stream, Buffer, or string.
+   * @param options - Upload options.
+   * @param options.overwrite - When `true`, overwrite an existing file at the same path.
+   */
+  async upload(
+    filePath: string,
+    contents: ReadableStream | Buffer | string,
+    options?: { overwrite?: boolean },
+  ) {
+    return this.filesConnector.upload(
+      getWorkspaceClient(),
+      filePath,
+      contents,
+      options,
+    );
+  }
+
+  /**
+   * Create a directory in a Unity Catalog volume.
+   *
+   * @param directoryPath - Absolute or relative path for the new directory.
+   */
+  async createDirectory(directoryPath: string) {
+    return this.filesConnector.createDirectory(
+      getWorkspaceClient(),
+      directoryPath,
+    );
+  }
+
+  /**
+   * Delete a file or directory from a Unity Catalog volume.
+   *
+   * @param filePath - Absolute or relative path to the file or directory.
+   */
+  async delete(filePath: string) {
+    return this.filesConnector.delete(getWorkspaceClient(), filePath);
+  }
+
+  /**
+   * Get a preview of a file including metadata and a text excerpt.
+   *
+   * @param filePath - Absolute or relative path to the file.
+   * @returns Preview with metadata, text content hint, and format flags.
+   */
+  async preview(filePath: string) {
+    return this.filesConnector.preview(getWorkspaceClient(), filePath);
+  }
+
+  injectRoutes(router: IAppRouter) {
+    this.route(router, {
+      name: "root",
+      method: "get",
+      path: "/root",
+      handler: async (_req: express.Request, res: express.Response) => {
+        res.json({ root: this.config.defaultVolume ?? null });
+      },
+    });
+
+    this.route(router, {
+      name: "list",
+      method: "get",
+      path: "/list",
+      handler: async (req: express.Request, res: express.Response) => {
+        await this._handleList(req, res);
+      },
+    });
+
+    this.route(router, {
+      name: "read",
+      method: "get",
+      path: "/read",
+      handler: async (req: express.Request, res: express.Response) => {
+        await this._handleRead(req, res);
+      },
+    });
+
+    this.route(router, {
+      name: "download",
+      method: "get",
+      path: "/download",
+      handler: async (req: express.Request, res: express.Response) => {
+        await this._handleDownload(req, res);
+      },
+    });
+
+    this.route(router, {
+      name: "raw",
+      method: "get",
+      path: "/raw",
+      handler: async (req: express.Request, res: express.Response) => {
+        await this._handleRaw(req, res);
+      },
+    });
+
+    this.route(router, {
+      name: "exists",
+      method: "get",
+      path: "/exists",
+      handler: async (req: express.Request, res: express.Response) => {
+        await this._handleExists(req, res);
+      },
+    });
+
+    this.route(router, {
+      name: "metadata",
+      method: "get",
+      path: "/metadata",
+      handler: async (req: express.Request, res: express.Response) => {
+        await this._handleMetadata(req, res);
+      },
+    });
+
+    this.route(router, {
+      name: "preview",
+      method: "get",
+      path: "/preview",
+      handler: async (req: express.Request, res: express.Response) => {
+        await this._handlePreview(req, res);
+      },
+    });
+
+    this.route(router, {
+      name: "upload",
+      method: "post",
+      path: "/upload",
+      skipBodyParsing: true,
+      handler: async (req: express.Request, res: express.Response) => {
+        await this._handleUpload(req, res);
+      },
+    });
+
+    this.route(router, {
+      name: "mkdir",
+      method: "post",
+      path: "/mkdir",
+      handler: async (req: express.Request, res: express.Response) => {
+        await this._handleMkdir(req, res);
+      },
+    });
+
+    this.route(router, {
+      name: "delete",
+      method: "post",
+      path: "/delete",
+      handler: async (req: express.Request, res: express.Response) => {
+        await this._handleDelete(req, res);
+      },
+    });
+  }
+
+  private _readSettings(
+    cacheKey: (string | number | object)[],
+  ): PluginExecutionSettings {
+    return {
+      default: {
+        ...filesReadDefaults,
+        cache: { ...filesReadDefaults.cache, cacheKey },
+      },
+    };
+  }
+
+  private _resolvePath(path: string): string {
+    return this.filesConnector.resolvePath(path);
+  }
+
+  /**
+   * Invalidate cached list entries for a directory after a write operation.
+   */
+  private _invalidateListCache(directoryPath: string): void {
+    const userKey = getCurrentUserId();
+    const listKey = this.cache.generateKey(
+      ["files:list", directoryPath],
+      userKey,
+    );
+    this.cache.delete(listKey);
+  }
+
+  private async _handleList(
+    req: express.Request,
+    res: express.Response,
+  ): Promise<void> {
+    const path = req.query.path as string | undefined;
+    const executor = this.asUser(req);
+
+    const result = await executor.execute(
+      async () => executor.list(path),
+      this._readSettings([
+        "files:list",
+        path ? this._resolvePath(path) : "__root__",
+      ]),
+    );
+
+    if (result === undefined) {
+      res.status(500).json({ error: "List failed", plugin: this.name });
+      return;
+    }
+    res.json(result);
+  }
+
+  private async _handleRead(
+    req: express.Request,
+    res: express.Response,
+  ): Promise<void> {
+    const path = req.query.path as string;
+    if (!path) {
+      res.status(400).json({ error: "path is required", plugin: this.name });
+      return;
+    }
+
+    const executor = this.asUser(req);
+    const result = await executor.execute(
+      async () => executor.read(path),
+      this._readSettings(["files:read", this._resolvePath(path)]),
+    );
+
+    if (result === undefined) {
+      res.status(500).json({ error: "Read failed", plugin: this.name });
+      return;
+    }
+    res.type("text/plain").send(result);
+  }
+
+  private async _handleDownload(
+    req: express.Request,
+    res: express.Response,
+  ): Promise<void> {
+    const path = req.query.path as string;
+    if (!path) {
+      res.status(400).json({ error: "path is required", plugin: this.name });
+      return;
+    }
+
+    const executor = this.asUser(req);
+    const settings: PluginExecutionSettings = {
+      default: filesDownloadDefaults,
+    };
+    const response = await executor.execute(
+      async () => executor.download(path),
+      settings,
+    );
+
+    if (response === undefined) {
+      res.status(500).json({ error: "Download failed", plugin: this.name });
+      return;
+    }
+
+    const fileName = path.split("/").pop() ?? "download";
+    res.setHeader("Content-Disposition", `attachment; filename="${fileName}"`);
+    res.setHeader(
+      "Content-Type",
+      contentTypeFromPath(path, undefined, this.config.customContentTypes),
+    );
+    res.setHeader("X-Content-Type-Options", "nosniff");
+    if (response.contents) {
+      const nodeStream = Readable.fromWeb(
+        response.contents as import("node:stream/web").ReadableStream,
+      );
+      nodeStream.pipe(res);
+    } else {
+      res.end();
+    }
+  }
+
+  private async _handleRaw(
+    req: express.Request,
+    res: express.Response,
+  ): Promise<void> {
+    const path = req.query.path as string;
+    if (!path) {
+      res.status(400).json({ error: "path is required", plugin: this.name });
+      return;
+    }
+
+    const executor = this.asUser(req);
+    const settings: PluginExecutionSettings = {
+      default: filesDownloadDefaults,
+    };
+    const response = await executor.execute(
+      async () => executor.download(path),
+      settings,
+    );
+
+    if (response === undefined) {
+      res.status(500).json({ error: "Raw fetch failed", plugin: this.name });
+      return;
+    }
+
+    const resolvedType = contentTypeFromPath(
+      path,
+      undefined,
+      this.config.customContentTypes,
+    );
+
+    res.setHeader("Content-Type", resolvedType);
+    res.setHeader("X-Content-Type-Options", "nosniff");
+    res.setHeader("Content-Security-Policy", "sandbox");
+
+    if (!isSafeInlineContentType(resolvedType)) {
+      const fileName = path.split("/").pop() ?? "download";
+      res.setHeader(
+        "Content-Disposition",
+        `attachment; filename="${fileName}"`,
+      );
+    }
+
+    if (response.contents) {
+      const nodeStream = Readable.fromWeb(
+        response.contents as import("node:stream/web").ReadableStream,
+      );
+      nodeStream.pipe(res);
+    } else {
+      res.end();
+    }
+  }
+
+  private async _handleExists(
+    req: express.Request,
+    res: express.Response,
+  ): Promise<void> {
+    const path = req.query.path as string;
+    if (!path) {
+      res.status(400).json({ error: "path is required", plugin: this.name });
+      return;
+    }
+
+    const executor = this.asUser(req);
+    const result = await executor.execute(
+      async () => executor.exists(path),
+      this._readSettings(["files:exists", this._resolvePath(path)]),
+    );
+
+    if (result === undefined) {
+      res.status(500).json({ error: "Exists check failed", plugin: this.name });
+      return;
+    }
+    res.json({ exists: result });
+  }
+
+  private async _handleMetadata(
+    req: express.Request,
+    res: express.Response,
+  ): Promise<void> {
+    const path = req.query.path as string;
+    if (!path) {
+      res.status(400).json({ error: "path is required", plugin: this.name });
+      return;
+    }
+
+    const executor = this.asUser(req);
+    const result = await executor.execute(
+      async () => executor.metadata(path),
+      this._readSettings(["files:metadata", this._resolvePath(path)]),
+    );
+
+    if (result === undefined) {
+      res
+        .status(500)
+        .json({ error: "Metadata fetch failed", plugin: this.name });
+      return;
+    }
+    res.json(result);
+  }
+
+  private async _handlePreview(
+    req: express.Request,
+    res: express.Response,
+  ): Promise<void> {
+    const path = req.query.path as string;
+    if (!path) {
+      res.status(400).json({ error: "path is required", plugin: this.name });
+      return;
+    }
+
+    const executor = this.asUser(req);
+    const result = await executor.execute(
+      async () => executor.preview(path),
+      this._readSettings(["files:preview", this._resolvePath(path)]),
+    );
+
+    if (result === undefined) {
+      res.status(500).json({ error: "Preview failed", plugin: this.name });
+      return;
+    }
+    res.json(result);
+  }
+
+  private async _handleUpload(
+    req: express.Request,
+    res: express.Response,
+  ): Promise<void> {
+    const path = req.query.path as string;
+    if (!path) {
+      res.status(400).json({ error: "path is required", plugin: this.name });
+      return;
+    }
+
+    logger.debug(req, "Upload started: path=%s", path);
+
+    const webStream: ReadableStream<Uint8Array> = Readable.toWeb(req);
+
+    logger.debug(
+      req,
+      "Upload body received: path=%s, size=%d bytes",
+      path,
+      req.headers["content-length"]
+        ? parseInt(req.headers["content-length"], 10)
+        : 0,
+    );
+
+    const executor = this.asUser(req);
+    const settings: PluginExecutionSettings = {
+      default: filesWriteDefaults,
+    };
+    const result = await executor.execute(async () => {
+      await executor.upload(path, webStream);
+      return { success: true as const };
+    }, settings);
+
+    if (result === undefined) {
+      logger.error(
+        req,
+        "Upload failed: path=%s, size=%d bytes",
+        path,
+        req.headers["content-length"]
+          ? parseInt(req.headers["content-length"], 10)
+          : 0,
+      );
+      res.status(500).json({ error: "Upload failed", plugin: this.name });
+      return;
+    }
+
+    const parentDir = path.substring(0, path.lastIndexOf("/")) || path;
+    this._invalidateListCache(this._resolvePath(parentDir));
+
+    logger.debug(req, "Upload complete: path=%s", path);
+    res.json(result);
+  }
+
+  private async _handleMkdir(
+    req: express.Request,
+    res: express.Response,
+  ): Promise<void> {
+    const dirPath = req.body?.path as string;
+    if (!dirPath) {
+      res.status(400).json({ error: "path is required", plugin: this.name });
+      return;
+    }
+
+    const executor = this.asUser(req);
+    const settings: PluginExecutionSettings = {
+      default: filesWriteDefaults,
+    };
+    const result = await executor.execute(async () => {
+      await executor.createDirectory(dirPath);
+      return { success: true as const };
+    }, settings);
+
+    if (result === undefined) {
+      res
+        .status(500)
+        .json({ error: "Create directory failed", plugin: this.name });
+      return;
+    }
+
+    const parentDir = dirPath.substring(0, dirPath.lastIndexOf("/")) || dirPath;
+    this._invalidateListCache(this._resolvePath(parentDir));
+
+    res.json(result);
+  }
+
+  private async _handleDelete(
+    req: express.Request,
+    res: express.Response,
+  ): Promise<void> {
+    const path = req.body?.path as string;
+    if (!path) {
+      res.status(400).json({ error: "path is required", plugin: this.name });
+      return;
+    }
+
+    const executor = this.asUser(req);
+    const settings: PluginExecutionSettings = {
+      default: filesWriteDefaults,
+    };
+    const result = await executor.execute(async () => {
+      await executor.delete(path);
+      return { success: true as const };
+    }, settings);
+
+    if (result === undefined) {
+      res.status(500).json({ error: "Delete failed", plugin: this.name });
+      return;
+    }
+
+    const parentDir = path.substring(0, path.lastIndexOf("/")) || path;
+    this._invalidateListCache(this._resolvePath(parentDir));
+
+    res.json(result);
+  }
+
+  async shutdown(): Promise<void> {
+    this.streamManager.abortAll();
+  }
+
+  /**
+   * Returns the programmatic API for the Files plugin.
+   * Note: `asUser()` is automatically added by AppKit.
+   */
+  exports() {
+    return {
+      /** List entries in a directory. */
+      list: this.list,
+      /** Read a file as a string. */
+      read: this.read,
+      /** Download a file as a readable stream. */
+      download: this.download,
+      /** Check whether a file exists. */
+      exists: this.exists,
+      /** Retrieve file metadata. */
+      metadata: this.metadata,
+      /** Upload a file. */
+      upload: this.upload,
+      /** Create a directory. */
+      createDirectory: this.createDirectory,
+      /** Delete a file or directory. */
+      delete: this.delete,
+      /** Get a file preview with text excerpt. */
+      preview: this.preview,
+    };
+  }
+}
+
+/**
+ * Files plugin for Databricks Unity Catalog volume operations.
+ *
+ * Provides HTTP routes and a programmatic API for listing, reading,
+ * downloading, uploading, deleting, and previewing files with built-in
+ * caching, retry, and timeout handling via the execution interceptor pipeline.
+ *
+ * Routes are mounted at `/api/files/*`.
+ *
+ * @example
+ * ```typescript
+ * import { createApp, files } from "@databricks/appkit";
+ *
+ * const app = await createApp({
+ *   plugins: [
+ *     files({ defaultVolume: "/Volumes/catalog/schema/vol" }),
+ *   ],
+ * });
+ * ```
+ */
+
+/**
+ * @internal
+ */
+export const files = toPlugin<typeof FilesPlugin, IFilesConfig, "files">(
+  FilesPlugin,
+  "files",
+);
diff --git a/packages/appkit/src/plugins/files/tests/helpers.test.ts b/packages/appkit/src/plugins/files/tests/helpers.test.ts
new file mode 100644
index 00000000..d30154f5
--- /dev/null
+++ b/packages/appkit/src/plugins/files/tests/helpers.test.ts
@@ -0,0 +1,121 @@
+import { describe, expect, test } from "vitest";
+import { contentTypeFromPath, isTextContentType } from "../helpers";
+
+describe("contentTypeFromPath", () => {
+  test("works without reported type", () => {
+    expect(contentTypeFromPath("/data.json")).toBe("application/json");
+  });
+
+  test("returns application/octet-stream for unknown extensions with no reported type", () => {
+    expect(contentTypeFromPath("/file.xyz")).toBe("application/octet-stream");
+  });
+
+  test("handles case-insensitive extensions", () => {
+    expect(contentTypeFromPath("/image.PNG")).toBe("image/png");
+    expect(contentTypeFromPath("/data.Json")).toBe("application/json");
+  });
+
+  test("uses extension when reported is undefined", () => {
+    expect(contentTypeFromPath("/style.css", undefined)).toBe("text/css");
+  });
+
+  test("prefers extension type over reported type for known extensions", () => {
+    // Extension takes priority to prevent MIME type mismatch attacks
+    expect(contentTypeFromPath("/file.json", "text/html")).toBe(
+      "application/json",
+    );
+  });
+
+  test("falls back to reported type for unknown extensions", () => {
+    expect(contentTypeFromPath("/file.xyz", "text/plain")).toBe("text/plain");
+  });
+
+  test("handles paths with multiple dots", () => {
+    expect(contentTypeFromPath("/archive.tar.gz")).toBe("application/gzip");
+    expect(contentTypeFromPath("/data.backup.json")).toBe("application/json");
+  });
+
+  test("resolves .ico to IANA standard type", () => {
+    expect(contentTypeFromPath("/favicon.ico")).toBe(
+      "image/vnd.microsoft.icon",
+    );
+  });
+
+  test("resolves Databricks-relevant file types", () => {
+    expect(contentTypeFromPath("/config.yaml")).toBe("application/x-yaml");
+    expect(contentTypeFromPath("/config.yml")).toBe("application/x-yaml");
+    expect(contentTypeFromPath("/query.sql")).toBe("application/sql");
+    expect(contentTypeFromPath("/data.parquet")).toBe(
+      "application/vnd.apache.parquet",
+    );
+    expect(contentTypeFromPath("/events.jsonl")).toBe("application/x-ndjson");
+    expect(contentTypeFromPath("/notebook.ipynb")).toBe(
+      "application/x-ipynb+json",
+    );
+    expect(contentTypeFromPath("/script.py")).toBe("text/x-python");
+    expect(contentTypeFromPath("/archive.zip")).toBe("application/zip");
+    expect(contentTypeFromPath("/data.gz")).toBe("application/gzip");
+    expect(contentTypeFromPath("/app.ts")).toBe("text/typescript");
+  });
+
+  test("custom types override defaults", () => {
+    const custom = { ".json": "text/json", ".custom": "application/custom" };
+    expect(contentTypeFromPath("/data.json", undefined, custom)).toBe(
+      "text/json",
+    );
+    expect(contentTypeFromPath("/file.custom", undefined, custom)).toBe(
+      "application/custom",
+    );
+  });
+
+  test("falls back to defaults when custom types don't match", () => {
+    const custom = { ".custom": "application/custom" };
+    expect(contentTypeFromPath("/data.json", undefined, custom)).toBe(
+      "application/json",
+    );
+  });
+
+  test("custom types take priority over reported type", () => {
+    const custom = { ".xyz": "application/xyz" };
+    expect(contentTypeFromPath("/file.xyz", "text/plain", custom)).toBe(
+      "application/xyz",
+    );
+  });
+});
+
+describe("isTextContentType", () => {
+  test("returns false for undefined", () => {
+    expect(isTextContentType(undefined)).toBe(false);
+  });
+
+  test("returns true for text/* types", () => {
+    expect(isTextContentType("text/plain")).toBe(true);
+    expect(isTextContentType("text/html")).toBe(true);
+    expect(isTextContentType("text/markdown")).toBe(true);
+    expect(isTextContentType("text/x-python")).toBe(true);
+    expect(isTextContentType("text/typescript")).toBe(true);
+  });
+
+  test("returns true for text-based application/ types", () => {
+    expect(isTextContentType("application/json")).toBe(true);
+    expect(isTextContentType("application/xml")).toBe(true);
+    expect(isTextContentType("application/sql")).toBe(true);
+    expect(isTextContentType("application/javascript")).toBe(true);
+    expect(isTextContentType("application/x-yaml")).toBe(true);
+    expect(isTextContentType("application/x-ndjson")).toBe(true);
+    expect(isTextContentType("application/x-ipynb+json")).toBe(true);
+  });
+
+  test("returns false for binary application/ types", () => {
+    expect(isTextContentType("application/pdf")).toBe(false);
+    expect(isTextContentType("application/zip")).toBe(false);
+    expect(isTextContentType("application/gzip")).toBe(false);
+    expect(isTextContentType("application/octet-stream")).toBe(false);
+    expect(isTextContentType("application/vnd.apache.parquet")).toBe(false);
+  });
+
+  test("returns false for image types", () => {
+    expect(isTextContentType("image/png")).toBe(false);
+    expect(isTextContentType("image/jpeg")).toBe(false);
+  });
+});
diff --git a/packages/appkit/src/plugins/files/tests/plugin.integration.test.ts b/packages/appkit/src/plugins/files/tests/plugin.integration.test.ts
new file mode 100644
index 00000000..65583c8a
--- /dev/null
+++ b/packages/appkit/src/plugins/files/tests/plugin.integration.test.ts
@@ -0,0 +1,447 @@
+import type { Server } from "node:http";
+import { mockServiceContext, setupDatabricksEnv } from "@tools/test-helpers";
+import {
+  afterAll,
+  beforeAll,
+  beforeEach,
+  describe,
+  expect,
+  test,
+  vi,
+} from "vitest";
+import { ServiceContext } from "../../../context/service-context";
+import { createApp } from "../../../core";
+import { server as serverPlugin } from "../../server";
+import { files } from "../index";
+import { streamFromString } from "./utils";
+
+const { mockFilesApi, mockSdkClient, MockApiError } = vi.hoisted(() => {
+  const mockFilesApi = {
+    listDirectoryContents: vi.fn(),
+    download: vi.fn(),
+    getMetadata: vi.fn(),
+    upload: vi.fn(),
+    createDirectory: vi.fn(),
+    delete: vi.fn(),
+  };
+
+  const mockSdkClient = {
+    files: mockFilesApi,
+    config: {
+      host: "https://test.databricks.com",
+      authenticate: vi.fn(),
+    },
+    currentUser: {
+      me: vi.fn().mockResolvedValue({ id: "test-user" }),
+    },
+  };
+
+  class MockApiError extends Error {
+    statusCode: number;
+    constructor(message: string, statusCode: number) {
+      super(message);
+      this.name = "ApiError";
+      this.statusCode = statusCode;
+    }
+  }
+
+  return { mockFilesApi, mockSdkClient, MockApiError };
+});
+
+vi.mock("@databricks/sdk-experimental", async (importOriginal) => {
+  const actual =
+    await importOriginal<typeof import("@databricks/sdk-experimental")>();
+  return {
+    ...actual,
+    ApiError: MockApiError,
+  };
+});
+
+const authHeaders = {
+  "x-forwarded-access-token": "test-token",
+  "x-forwarded-user": "test-user",
+};
+
+describe("Files Plugin Integration", () => {
+  let server: Server;
+  let baseUrl: string;
+  let serviceContextMock: Awaited<ReturnType<typeof mockServiceContext>>;
+  const TEST_PORT = 9880;
+
+  beforeAll(async () => {
+    setupDatabricksEnv({
+      DATABRICKS_VOLUME_PATH: "/Volumes/catalog/schema/vol",
+    });
+    ServiceContext.reset();
+
+    serviceContextMock = await mockServiceContext({
+      serviceDatabricksClient: mockSdkClient,
+      userDatabricksClient: mockSdkClient,
+    });
+
+    const appkit = await createApp({
+      plugins: [
+        serverPlugin({
+          port: TEST_PORT,
+          host: "127.0.0.1",
+          autoStart: false,
+        }),
+        files({ defaultVolume: "/Volumes/catalog/schema/vol" }),
+      ],
+    });
+
+    await appkit.server.start();
+    server = appkit.server.getServer();
+    baseUrl = `http://127.0.0.1:${TEST_PORT}`;
+  });
+
+  afterAll(async () => {
+    delete process.env.DATABRICKS_VOLUME_PATH;
+    serviceContextMock?.restore();
+    if (server) {
+      await new Promise<void>((resolve, reject) => {
+        server.close((err) => {
+          if (err) reject(err);
+          else resolve();
+        });
+      });
+    }
+  });
+
+  beforeEach(() => {
+    mockFilesApi.listDirectoryContents.mockReset();
+    mockFilesApi.download.mockReset();
+    mockFilesApi.getMetadata.mockReset();
+    mockFilesApi.upload.mockReset();
+    mockFilesApi.createDirectory.mockReset();
+    mockFilesApi.delete.mockReset();
+  });
+
+  describe("List Directory", () => {
+    test("GET /api/files/list returns directory entries", async () => {
+      const entries = [
+        {
+          name: "file1.txt",
+          path: "/Volumes/catalog/schema/vol/file1.txt",
+          is_directory: false,
+        },
+        {
+          name: "subdir",
+          path: "/Volumes/catalog/schema/vol/subdir",
+          is_directory: true,
+        },
+      ];
+
+      mockFilesApi.listDirectoryContents.mockReturnValue(
+        (async function* () {
+          for (const entry of entries) {
+            yield entry;
+          }
+        })(),
+      );
+
+      const response = await fetch(`${baseUrl}/api/files/list`, {
+        headers: authHeaders,
+      });
+
+      expect(response.status).toBe(200);
+      const data = await response.json();
+      expect(data).toEqual(entries);
+    });
+
+    test("GET /api/files/list?path=/abs/path uses provided path", async () => {
+      mockFilesApi.listDirectoryContents.mockReturnValue(
+        (async function* () {})(),
+      );
+
+      const response = await fetch(
+        `${baseUrl}/api/files/list?path=/Volumes/other/path`,
+        { headers: authHeaders },
+      );
+
+      expect(response.status).toBe(200);
+      expect(mockFilesApi.listDirectoryContents).toHaveBeenCalledWith({
+        directory_path: "/Volumes/other/path",
+      });
+    });
+  });
+
+  describe("Read File", () => {
+    test("GET /api/files/read?path=/file.txt returns text content", async () => {
+      mockFilesApi.download.mockResolvedValue({
+        contents: streamFromString("file content here"),
+      });
+
+      const response = await fetch(
+        `${baseUrl}/api/files/read?path=/Volumes/catalog/schema/vol/file.txt`,
+        { headers: authHeaders },
+      );
+
+      expect(response.status).toBe(200);
+      const text = await response.text();
+      expect(text).toBe("file content here");
+    });
+
+    test("GET /api/files/read without path returns 400", async () => {
+      const response = await fetch(`${baseUrl}/api/files/read`, {
+        headers: authHeaders,
+      });
+
+      expect(response.status).toBe(400);
+      const data = await response.json();
+      expect(data).toEqual({ error: "path is required", plugin: "files" });
+    });
+  });
+
+  describe("Exists", () => {
+    test("GET /api/files/exists returns { exists: true }", async () => {
+      mockFilesApi.getMetadata.mockResolvedValue({
+        "content-length": 100,
+        "content-type": "text/plain",
+        "last-modified": "2025-01-01",
+      });
+
+      const response = await fetch(
+        `${baseUrl}/api/files/exists?path=/Volumes/catalog/schema/vol/file.txt`,
+        { headers: authHeaders },
+      );
+
+      expect(response.status).toBe(200);
+      const data = await response.json();
+      expect(data).toEqual({ exists: true });
+    });
+
+    test("GET /api/files/exists returns { exists: false } on 404", async () => {
+      mockFilesApi.getMetadata.mockRejectedValue(
+        new MockApiError("Not found", 404),
+      );
+
+      const response = await fetch(
+        `${baseUrl}/api/files/exists?path=/Volumes/missing.txt`,
+        { headers: authHeaders },
+      );
+
+      expect(response.status).toBe(200);
+      const data = await response.json();
+      expect(data).toEqual({ exists: false });
+    });
+  });
+
+  describe("Metadata", () => {
+    test("GET /api/files/metadata returns correct metadata", async () => {
+      mockFilesApi.getMetadata.mockResolvedValue({
+        "content-length": 256,
+        "content-type": "application/json",
+        "last-modified": "2025-06-15T10:00:00Z",
+      });
+
+      const response = await fetch(
+        `${baseUrl}/api/files/metadata?path=/Volumes/catalog/schema/vol/file.json`,
+        { headers: authHeaders },
+      );
+
+      expect(response.status).toBe(200);
+      const data = await response.json();
+      expect(data).toEqual({
+        contentLength: 256,
+        contentType: "application/json",
+        lastModified: "2025-06-15T10:00:00Z",
+      });
+    });
+  });
+
+  describe("Preview", () => {
+    test("GET /api/files/preview returns text preview", async () => {
+      mockFilesApi.getMetadata.mockResolvedValue({
+        "content-length": 20,
+        "content-type": "text/plain",
+        "last-modified": "2025-01-01",
+      });
+      mockFilesApi.download.mockResolvedValue({
+        contents: streamFromString("Hello preview!"),
+      });
+
+      const response = await fetch(
+        `${baseUrl}/api/files/preview?path=/Volumes/catalog/schema/vol/file.txt`,
+        { headers: authHeaders },
+      );
+
+      expect(response.status).toBe(200);
+      const data = (await response.json()) as {
+        isText: boolean;
+        isImage: boolean;
+        textPreview: string | null;
+      };
+      expect(data.isText).toBe(true);
+      expect(data.isImage).toBe(false);
+      expect(data.textPreview).toBe("Hello preview!");
+    });
+
+    test("GET /api/files/preview returns image metadata", async () => {
+      mockFilesApi.getMetadata.mockResolvedValue({
+        "content-length": 5000,
+        "content-type": "image/png",
+        "last-modified": "2025-01-01",
+      });
+
+      const response = await fetch(
+        `${baseUrl}/api/files/preview?path=/Volumes/catalog/schema/vol/image.png`,
+        { headers: authHeaders },
+      );
+
+      expect(response.status).toBe(200);
+      const data = (await response.json()) as {
+        isText: boolean;
+        isImage: boolean;
+        textPreview: string | null;
+      };
+      expect(data.isImage).toBe(true);
+      expect(data.isText).toBe(false);
+      expect(data.textPreview).toBeNull();
+    });
+  });
+
+  describe("Raw Endpoint Security Headers", () => {
+    test("safe type (image/png) sets security headers without Content-Disposition", async () => {
+      mockFilesApi.download.mockResolvedValue({
+        contents: streamFromString("PNG data"),
+      });
+
+      const response = await fetch(
+        `${baseUrl}/api/files/raw?path=/Volumes/catalog/schema/vol/image.png`,
+        { headers: authHeaders, redirect: "manual" },
+      );
+
+      expect(response.status).toBe(200);
+      expect(response.headers.get("content-type")).toBe("image/png");
+      expect(response.headers.get("x-content-type-options")).toBe("nosniff");
+      expect(response.headers.get("content-security-policy")).toBe("sandbox");
+      expect(response.headers.get("content-disposition")).toBeNull();
+    });
+
+    test("dangerous type (text/html) forces download via Content-Disposition", async () => {
+      mockFilesApi.download.mockResolvedValue({
+        contents: streamFromString("<script>alert('xss')</script>"),
+      });
+
+      const response = await fetch(
+        `${baseUrl}/api/files/raw?path=/Volumes/catalog/schema/vol/malicious.html`,
+        { headers: authHeaders, redirect: "manual" },
+      );
+
+      expect(response.status).toBe(200);
+      expect(response.headers.get("content-type")).toBe("text/html");
+      expect(response.headers.get("x-content-type-options")).toBe("nosniff");
+      expect(response.headers.get("content-security-policy")).toBe("sandbox");
+      expect(response.headers.get("content-disposition")).toBe(
+        'attachment; filename="malicious.html"',
+      );
+    });
+
+    test("SVG (image/svg+xml) is treated as dangerous", async () => {
+      mockFilesApi.download.mockResolvedValue({
+        contents: streamFromString("<svg onload='alert(1)'></svg>"),
+      });
+
+      const response = await fetch(
+        `${baseUrl}/api/files/raw?path=/Volumes/catalog/schema/vol/icon.svg`,
+        { headers: authHeaders, redirect: "manual" },
+      );
+
+      expect(response.status).toBe(200);
+      expect(response.headers.get("content-type")).toBe("image/svg+xml");
+      expect(response.headers.get("content-security-policy")).toBe("sandbox");
+      expect(response.headers.get("content-disposition")).toBe(
+        'attachment; filename="icon.svg"',
+      );
+    });
+
+    test("JavaScript (text/javascript) is treated as dangerous", async () => {
+      mockFilesApi.download.mockResolvedValue({
+        contents: streamFromString("alert('xss')"),
+      });
+
+      const response = await fetch(
+        `${baseUrl}/api/files/raw?path=/Volumes/catalog/schema/vol/script.js`,
+        { headers: authHeaders, redirect: "manual" },
+      );
+
+      expect(response.status).toBe(200);
+      expect(response.headers.get("content-type")).toBe("text/javascript");
+      expect(response.headers.get("content-security-policy")).toBe("sandbox");
+      expect(response.headers.get("content-disposition")).toBe(
+        'attachment; filename="script.js"',
+      );
+    });
+
+    test("safe type (application/json) is served inline", async () => {
+      mockFilesApi.download.mockResolvedValue({
+        contents: streamFromString('{"key":"value"}'),
+      });
+
+      const response = await fetch(
+        `${baseUrl}/api/files/raw?path=/Volumes/catalog/schema/vol/data.json`,
+        { headers: authHeaders, redirect: "manual" },
+      );
+
+      expect(response.status).toBe(200);
+      expect(response.headers.get("content-type")).toBe("application/json");
+      expect(response.headers.get("x-content-type-options")).toBe("nosniff");
+      expect(response.headers.get("content-security-policy")).toBe("sandbox");
+      expect(response.headers.get("content-disposition")).toBeNull();
+    });
+  });
+
+  describe("Download Endpoint Security Headers", () => {
+    test("sets X-Content-Type-Options: nosniff", async () => {
+      mockFilesApi.download.mockResolvedValue({
+        contents: streamFromString("file data"),
+      });
+
+      const response = await fetch(
+        `${baseUrl}/api/files/download?path=/Volumes/catalog/schema/vol/file.txt`,
+        { headers: authHeaders, redirect: "manual" },
+      );
+
+      expect(response.status).toBe(200);
+      expect(response.headers.get("x-content-type-options")).toBe("nosniff");
+      expect(response.headers.get("content-disposition")).toBe(
+        'attachment; filename="file.txt"',
+      );
+    });
+  });
+
+  describe("Error Handling", () => {
+    test("SDK exceptions return 500 with generic error", async () => {
+      mockFilesApi.getMetadata.mockRejectedValue(
+        new Error("SDK connection failed"),
+      );
+
+      const response = await fetch(
+        `${baseUrl}/api/files/metadata?path=/Volumes/catalog/schema/vol/file.txt`,
+        { headers: authHeaders },
+      );
+
+      expect(response.status).toBe(500);
+      const data = (await response.json()) as { error: string; plugin: string };
+      expect(data.error).toBe("Metadata fetch failed");
+      expect(data.plugin).toBe("files");
+    });
+
+    test("list errors return 500", async () => {
+      mockFilesApi.listDirectoryContents.mockRejectedValue(
+        new Error("Permission denied"),
+      );
+
+      const response = await fetch(
+        `${baseUrl}/api/files/list?path=/Volumes/uncached/path`,
+        { headers: authHeaders },
+      );
+
+      expect(response.status).toBe(500);
+      const data = (await response.json()) as { error: string; plugin: string };
+      expect(data.error).toBe("List failed");
+      expect(data.plugin).toBe("files");
+    });
+  });
+});
diff --git a/packages/appkit/src/plugins/files/tests/plugin.test.ts b/packages/appkit/src/plugins/files/tests/plugin.test.ts
new file mode 100644
index 00000000..9ea52118
--- /dev/null
+++ b/packages/appkit/src/plugins/files/tests/plugin.test.ts
@@ -0,0 +1,134 @@
+import { mockServiceContext, setupDatabricksEnv } from "@tools/test-helpers";
+import { afterEach, beforeEach, describe, expect, test, vi } from "vitest";
+import { ServiceContext } from "../../../context/service-context";
+import { FilesPlugin, files } from "../plugin";
+
+const { mockClient, MockApiError, mockCacheInstance } = vi.hoisted(() => {
+  const mockFilesApi = {
+    listDirectoryContents: vi.fn(),
+    download: vi.fn(),
+    getMetadata: vi.fn(),
+    upload: vi.fn(),
+    createDirectory: vi.fn(),
+    delete: vi.fn(),
+  };
+
+  const mockClient = {
+    files: mockFilesApi,
+    config: {
+      host: "https://test.databricks.com",
+      authenticate: vi.fn(),
+    },
+  };
+
+  class MockApiError extends Error {
+    statusCode: number;
+    constructor(message: string, statusCode: number) {
+      super(message);
+      this.name = "ApiError";
+      this.statusCode = statusCode;
+    }
+  }
+
+  const mockCacheInstance = {
+    get: vi.fn(),
+    set: vi.fn(),
+    delete: vi.fn(),
+    getOrExecute: vi.fn(async (_key: unknown[], fn: () => Promise<unknown>) =>
+      fn(),
+    ),
+    generateKey: vi.fn(),
+  };
+
+  return { mockFilesApi, mockClient, MockApiError, mockCacheInstance };
+});
+
+vi.mock("@databricks/sdk-experimental", () => ({
+  WorkspaceClient: vi.fn(() => mockClient),
+  ApiError: MockApiError,
+}));
+
+vi.mock("../../../context", () => ({
+  getWorkspaceClient: vi.fn(() => mockClient),
+}));
+
+vi.mock("../../../cache", () => ({
+  CacheManager: {
+    getInstanceSync: vi.fn(() => mockCacheInstance),
+  },
+}));
+
+describe("FilesPlugin", () => {
+  let serviceContextMock: Awaited<ReturnType<typeof mockServiceContext>>;
+
+  beforeEach(async () => {
+    vi.clearAllMocks();
+    setupDatabricksEnv();
+    ServiceContext.reset();
+    serviceContextMock = await mockServiceContext();
+  });
+
+  afterEach(() => {
+    serviceContextMock?.restore();
+  });
+
+  test('plugin name is "files"', () => {
+    const pluginData = files({ defaultVolume: "/Volumes/test" });
+    expect(pluginData.name).toBe("files");
+  });
+
+  test("plugin instance has correct name", () => {
+    const plugin = new FilesPlugin({ defaultVolume: "/Volumes/test" });
+    expect(plugin.name).toBe("files");
+  });
+
+  test("exports() returns all expected methods", () => {
+    const plugin = new FilesPlugin({ defaultVolume: "/Volumes/test" });
+    const exported = plugin.exports();
+
+    expect(exported).toHaveProperty("list");
+    expect(exported).toHaveProperty("read");
+    expect(exported).toHaveProperty("download");
+    expect(exported).toHaveProperty("exists");
+    expect(exported).toHaveProperty("metadata");
+    expect(exported).toHaveProperty("upload");
+    expect(exported).toHaveProperty("createDirectory");
+    expect(exported).toHaveProperty("delete");
+    expect(exported).toHaveProperty("preview");
+
+    for (const value of Object.values(exported)) {
+      expect(typeof value).toBe("function");
+    }
+  });
+
+  test("injectRoutes registers GET and POST routes", () => {
+    const plugin = new FilesPlugin({ defaultVolume: "/Volumes/test" });
+    const mockRouter = {
+      get: vi.fn(),
+      post: vi.fn(),
+      put: vi.fn(),
+      delete: vi.fn(),
+      patch: vi.fn(),
+    } as any;
+
+    plugin.injectRoutes(mockRouter);
+
+    // 8 GET routes
+    // root, list, read, download, raw, exists, metadata, preview
+    expect(mockRouter.get).toHaveBeenCalledTimes(8);
+    // 3 POST routes:
+    // upload, mkdir, delete
+    expect(mockRouter.post).toHaveBeenCalledTimes(3);
+    expect(mockRouter.put).not.toHaveBeenCalled();
+    expect(mockRouter.patch).not.toHaveBeenCalled();
+  });
+
+  test("shutdown() calls streamManager.abortAll()", async () => {
+    const plugin = new FilesPlugin({ defaultVolume: "/Volumes/test" });
+    const abortAllSpy = vi.spyOn((plugin as any).streamManager, "abortAll");
+
+    await plugin.shutdown();
+
+    expect(abortAllSpy).toHaveBeenCalled();
+  });
+});
diff --git a/packages/appkit/src/plugins/files/tests/utils.ts b/packages/appkit/src/plugins/files/tests/utils.ts
new file mode 100644
index 00000000..d204d8da
--- /dev/null
+++ b/packages/appkit/src/plugins/files/tests/utils.ts
@@ -0,0 +1,22 @@
+export function streamFromString(text: string): ReadableStream<Uint8Array> {
+  const encoder = new TextEncoder();
+  return new ReadableStream({
+    start(controller) {
+      controller.enqueue(encoder.encode(text));
+      controller.close();
+    },
+  });
+}
+
+// Creates a ReadableStream that yields multiple chunks
+export function streamFromChunks(chunks: string[]): ReadableStream<Uint8Array> {
+  const encoder = new TextEncoder();
+  return new ReadableStream({
+    start(controller) {
+      for (const chunk of chunks) {
+        controller.enqueue(encoder.encode(chunk));
+      }
+      controller.close();
+    },
+  });
+}
diff --git a/packages/appkit/src/plugins/files/types.ts b/packages/appkit/src/plugins/files/types.ts
new file mode 100644
index 00000000..4a0baa75
--- /dev/null
+++ b/packages/appkit/src/plugins/files/types.ts
@@ -0,0 +1,44 @@
+import type { files } from "@databricks/sdk-experimental";
+import type { BasePluginConfig } from "shared";
+
+/**
+ * Configuration for the Files plugin.
+ */
+export interface IFilesConfig extends BasePluginConfig {
+  /** Operation timeout in milliseconds. Overrides the per-tier defaults. */
+  timeout?: number;
+  /** Absolute volume path used to resolve relative file paths (e.g. `"/Volumes/catalog/schema/vol"`). */
+  defaultVolume?: string;
+  /** Map of file extensions to MIME types that takes priority over the built-in extension map. */
+  customContentTypes?: Record<string, string>;
+}
+
+/** A single entry returned when listing a directory. Re-exported from `@databricks/sdk-experimental`. */
+export type DirectoryEntry = files.DirectoryEntry;
+
+/** Response object for file downloads containing a readable stream. Re-exported from `@databricks/sdk-experimental`. */
+export type DownloadResponse = files.DownloadResponse;
+
+/**
+ * Metadata for a file stored in a Unity Catalog volume.
+ */
+export interface FileMetadata {
+  /** File size in bytes. */
+  contentLength: number | undefined;
+  /** MIME content type of the file. */
+  contentType: string | undefined;
+  /** ISO 8601 timestamp of the last modification. */
+  lastModified: string | undefined;
+}
+
+/**
+ * Preview information for a file, extending {@link FileMetadata} with content hints.
+ */
+export interface FilePreview extends FileMetadata {
+  /** First portion of text content, or `null` for non-text files. */
+  textPreview: string | null;
+  /** Whether the file is detected as a text format. */
+  isText: boolean;
+  /** Whether the file is detected as an image format. */
+  isImage: boolean;
+}
diff --git a/packages/appkit/src/plugins/index.ts b/packages/appkit/src/plugins/index.ts
index aba6f26b..ccc652ff 100644
--- a/packages/appkit/src/plugins/index.ts
+++ b/packages/appkit/src/plugins/index.ts
@@ -1,2 +1,3 @@
 export * from "./analytics";
+export * from "./files";
 export * from "./server";
diff --git a/packages/appkit/src/plugins/server/index.ts b/packages/appkit/src/plugins/server/index.ts
index 40cf01e0..a2fb3354 100644
--- a/packages/appkit/src/plugins/server/index.ts
+++ b/packages/appkit/src/plugins/server/index.ts
@@ -50,6 +50,7 @@ export class ServerPlugin extends Plugin {
   private remoteTunnelController?: RemoteTunnelController;
   protected declare config: ServerConfig;
   private serverExtensions: ((app: express.Application) => void)[] = [];
+  private rawBodyPaths: Set<string> = new Set();
   static phase: PluginPhase = "deferred";
 
   constructor(config: ServerConfig) {
@@ -92,7 +93,20 @@ export class ServerPlugin extends Plugin {
    * @returns The express application.
    */
   async start(): Promise<express.Application> {
-    this.serverApplication.use(express.json());
+    this.serverApplication.use(
+      express.json({
+        type: (req) => {
+          // Skip JSON parsing for routes that declared skipBodyParsing
+          // (e.g. file uploads where the raw body must flow through).
+          // rawBodyPaths is populated by extendRoutes() below; the type
+          // callback runs per-request so the set is already filled.
+          const urlPath = req.url?.split("?")[0];
+          if (urlPath && this.rawBodyPaths.has(urlPath)) return false;
+          const ct = req.headers["content-type"] ?? "";
+          return ct.includes("json");
+        },
+      }),
+    );
 
     const endpoints = await this.extendRoutes();
 
@@ -194,6 +208,16 @@ export class ServerPlugin extends Plugin {
 
         // Collect named endpoints from the plugin
         endpoints[plugin.name] = plugin.getEndpoints();
+
+        // Collect paths that should skip body parsing
+        if (
+          plugin.getSkipBodyParsingPaths &&
+          typeof plugin.getSkipBodyParsingPaths === "function"
+        ) {
+          for (const p of plugin.getSkipBodyParsingPaths()) {
+            this.rawBodyPaths.add(p);
+          }
+        }
       }
     }
 
diff --git a/packages/appkit/src/plugins/server/tests/server.test.ts b/packages/appkit/src/plugins/server/tests/server.test.ts
index 31305fc7..099f2b13 100644
--- a/packages/appkit/src/plugins/server/tests/server.test.ts
+++ b/packages/appkit/src/plugins/server/tests/server.test.ts
@@ -284,6 +284,52 @@ describe("ServerPlugin", () => {
       );
     });
 
+    test("should skip body parsing for paths declared by plugins", async () => {
+      process.env.NODE_ENV = "production";
+
+      const plugins: any = {
+        files: {
+          name: "files",
+          injectRoutes: vi.fn(),
+          getEndpoints: vi.fn().mockReturnValue({}),
+          getSkipBodyParsingPaths: vi
+            .fn()
+            .mockReturnValue(new Set(["/api/files/upload"])),
+        },
+      };
+
+      const plugin = new ServerPlugin({ autoStart: false, plugins });
+      await plugin.start();
+
+      // Get the type function passed to express.json
+      const jsonCall = vi.mocked(express.json).mock.calls[0][0] as any;
+      const typeFn = jsonCall.type;
+
+      // Should skip body parsing for the declared path
+      expect(typeFn({ url: "/api/files/upload", headers: {} })).toBe(false);
+
+      // Should skip body parsing for declared path with query string
+      expect(typeFn({ url: "/api/files/upload?path=foo", headers: {} })).toBe(
+        false,
+      );
+
+      // Should NOT skip body parsing for other routes (no hardcoded /upload check)
+      expect(
+        typeFn({
+          url: "/api/other/upload",
+          headers: { "content-type": "application/json" },
+        }),
+      ).toBe(true);
+
+      // Should still parse JSON for normal routes
+      expect(
+        typeFn({
+          url: "/api/analytics/query",
+          headers: { "content-type": "application/json" },
+        }),
+      ).toBe(true);
+    });
+
     test("extendRoutes registers plugin routes correctly", async () => {
       process.env.NODE_ENV = "production";
 
diff --git a/packages/appkit/src/stream/stream-manager.ts b/packages/appkit/src/stream/stream-manager.ts
index 41764772..e92f5818 100644
--- a/packages/appkit/src/stream/stream-manager.ts
+++ b/packages/appkit/src/stream/stream-manager.ts
@@ -1,6 +1,7 @@
 import { randomUUID } from "node:crypto";
 import { context } from "@opentelemetry/api";
 import type { IAppResponse, StreamConfig } from "shared";
+import { createLogger } from "../logging/logger";
 import { EventRingBuffer } from "./buffers";
 import { streamDefaults } from "./defaults";
 import { SSEWriter } from "./sse-writer";
@@ -8,6 +9,8 @@ import { StreamRegistry } from "./stream-registry";
 import { SSEErrorCode, type StreamEntry, type StreamOperation } from "./types";
 import { StreamValidator } from "./validator";
 
+const logger = createLogger("stream");
+
 // main entry point for Server-Sent events streaming
 export class StreamManager {
   private activeOperations: Set<StreamOperation>;
@@ -76,6 +79,12 @@ export class StreamManager {
     streamEntry: StreamEntry,
     options?: StreamConfig,
   ): Promise<void> {
+    logger.debug(
+      "Client reconnecting to stream: streamId=%s, clients=%d",
+      streamEntry.streamId,
+      streamEntry.clients.size,
+    );
+
     // handle reconnection - replay missed events
     const lastEventId = res.req?.headers["last-event-id"];
 
@@ -187,6 +196,8 @@ export class StreamManager {
     };
     this.streamRegistry.add(streamEntry);
 
+    logger.debug("New stream created: streamId=%s", streamId);
+
     // track operation
     const streamOperation: StreamOperation = {
       controller: abortController,
diff --git a/packages/appkit/tsconfig.json b/packages/appkit/tsconfig.json
index 8d1cbf59..5265a688 100644
--- a/packages/appkit/tsconfig.json
+++ b/packages/appkit/tsconfig.json
@@ -6,7 +6,8 @@
     "paths": {
       "@/*": ["src/*"],
       "@tools/*": ["../../tools/*"],
-      "shared": ["../../packages/shared/src"]
+      "shared": ["../../packages/shared/src"],
+      "@databricks/lakebase": ["../../packages/lakebase/src"]
     }
   },
   "include": ["src/**/*"],
diff --git a/packages/appkit/tsdown.config.ts b/packages/appkit/tsdown.config.ts
index 2472c084..dd1fad3c 100644
--- a/packages/appkit/tsdown.config.ts
+++ b/packages/appkit/tsdown.config.ts
@@ -42,6 +42,10 @@ export default defineConfig([
         from: "src/plugins/analytics/manifest.json",
         to: "dist/plugins/analytics/manifest.json",
       },
+      {
+        from: "src/plugins/files/manifest.json",
+        to: "dist/plugins/files/manifest.json",
+      },
       {
         from: "src/plugins/server/manifest.json",
         to: "dist/plugins/server/manifest.json",
diff --git a/packages/lakebase/.release-it.json b/packages/lakebase/.release-it.json
new file mode 100644
index 00000000..29f0dfaa
--- /dev/null
+++ b/packages/lakebase/.release-it.json
@@ -0,0 +1,40 @@
+{
+  "$schema": "https://unpkg.com/release-it@19/schema/release-it.json",
+  "git": {
+    "commitMessage": "chore(lakebase): release v${version} [skip ci]",
+    "tagName": "lakebase-v${version}",
+    "tagMatch": "lakebase-v*",
+    "tagAnnotation": "Release @databricks/lakebase v${version}",
+    "commitsPath": ".",
+    "requireBranch": "main",
+    "requireCleanWorkingDir": true,
+    "push": true,
+    "pushArgs": ["--follow-tags"]
+  },
+  "github": {
+    "release": true,
+    "releaseName": "@databricks/lakebase v${version}",
+    "autoGenerate": false,
+    "draft": false,
+    "preRelease": false,
+    "tokenRef": "GITHUB_TOKEN"
+  },
+  "npm": false,
+  "hooks": {
+    "after:bump": "npm version ${version} --no-git-tag-version --allow-same-version",
+    "before:release": "pnpm build:package && pnpm dist",
+    "after:release": "npm publish ./tmp --access public --provenance"
+  },
+  "plugins": {
+    "@release-it/conventional-changelog": {
+      "preset": {
+        "name": "conventionalcommits",
+        "bumpStrict": true
+      },
+      "infile": "CHANGELOG.md",
+      "header": "# Changelog\n\nAll notable changes to @databricks/lakebase will be documented in this file.",
+      "gitRawCommitsOpts": { "path": "." },
+      "commitsOpts": { "path": "." }
+    }
+  }
+}
diff --git a/packages/lakebase/CHANGELOG.md b/packages/lakebase/CHANGELOG.md
new file mode 100644
index 00000000..6c317bb6
--- /dev/null
+++ b/packages/lakebase/CHANGELOG.md
@@ -0,0 +1,18 @@
+# Changelog
+
+All notable changes to @databricks/lakebase will be documented in this file.
+
+## [0.1.2](https://github.com/databricks/appkit/compare/lakebase-v0.1.1...lakebase-v0.1.2) (2026-02-19)
+
+### Bug Fixes
+
+* **lakebase:** Update instructions for manually obtaining `LAKEBASE_ENDPOINT` ([#121](https://github.com/databricks/appkit/issues/121)) ([5d43af4](https://github.com/databricks/appkit/commit/5d43af4877483d93ef9b77982f4e2c5158e36d81))
+
+## [0.1.1](https://github.com/databricks/appkit/compare/lakebase-v0.1.0...lakebase-v0.1.1) (2026-02-18)
+
+### Bug Fixes
+
+* **lakebase:** update the after-bump hook ([#118](https://github.com/databricks/appkit/issues/118)) ([de6d0c9](https://github.com/databricks/appkit/commit/de6d0c9be4b2e8a53a6baab673cc59864cd97c35))
+* **lakebase:** update the release config ([#113](https://github.com/databricks/appkit/issues/113)) ([9725ee3](https://github.com/databricks/appkit/commit/9725ee349919cc9617a127171fab5317816571a8))
+* **lakebase:** update the release hook ([#117](https://github.com/databricks/appkit/issues/117)) ([21a1425](https://github.com/databricks/appkit/commit/21a14253ca4ad5a2a6b88071923db2f2b278ec4f))
+* release `@databricks/lakebase` correctly, fix `appkit` dependency ([#111](https://github.com/databricks/appkit/issues/111)) ([5b6856a](https://github.com/databricks/appkit/commit/5b6856a6b42680a671cfc3e99eab3bef72803fd1))
diff --git a/packages/lakebase/README.md b/packages/lakebase/README.md
new file mode 100644
index 00000000..1d1d8162
--- /dev/null
+++ b/packages/lakebase/README.md
@@ -0,0 +1,278 @@
+# @databricks/lakebase
+
+PostgreSQL driver for Databricks Lakebase Autoscaling with automatic OAuth token refresh.
+
+## Overview
+
+`@databricks/lakebase` provides a drop-in replacement for the standard `pg` connection pool that automatically handles OAuth authentication for Databricks Lakebase Autoscaling (OLTP) databases.
+
+It:
+
+- Returns a standard `pg.Pool` - works with any PostgreSQL library or ORM
+- Automatically refreshes OAuth tokens (1-hour lifetime, with 2-minute buffer)
+- Caches tokens to minimize API calls
+- Zero configuration with environment variables
+- Optional OpenTelemetry instrumentation
+
+**NOTE:** This package is NOT compatible with the Databricks Lakebase Provisioned.
+
+## Installation
+
+```bash
+npm install @databricks/lakebase
+```
+
+## Quick Start
+
+### Using Environment Variables
+
+Set the following environment variables:
+
+```bash
+export PGHOST=your-lakebase-host.databricks.com
+export PGDATABASE=your_database_name
+export LAKEBASE_ENDPOINT=projects/6bef4151-4b5d-4147-b4d0-c2f4fd5b40db/branches/br-broad-pine-y12n6gnv/endpoints/ep-summer-frost-y131l3vx
+export PGUSER=your_user # optionally, defaults to DATABRICKS_CLIENT_ID
+export PGSSLMODE=require
+```
+
+To find your `LAKEBASE_ENDPOINT`, run the Databricks CLI and use the `name` field from the output:
+
+```bash
+databricks postgres list-endpoints projects/{project-id}/branches/{branch-id}
+```
+
+You can obtain the Project ID and Branch ID from the Lakebase Autoscaling UI, like the "Branch Overview" page. (Project list -> Project dashboard -> Branch overview). When using the driver as a part of Databricks Apps, the `LAKEBASE_ENDPOINT` is automatically injected using `fromValue`:
+
+```yaml
+env:
+  - name: LAKEBASE_ENDPOINT
+    valueFrom: database # Lakebase Autoscaling database resource name
+```
+
+Then use the driver:
+
+```typescript
+import { createLakebasePool } from "@databricks/lakebase";
+
+const pool = createLakebasePool();
+const result = await pool.query("SELECT * FROM users");
+console.log(result.rows);
+```
+
+### With Explicit Configuration
+
+```typescript
+import { createLakebasePool } from "@databricks/lakebase";
+
+const pool = createLakebasePool({
+  host: "your-lakebase-host.databricks.com", // defaults to PGHOST environment variable
+  database: "your_database_name", // defaults to PGDATABASE environment variable
+  endpoint:
+    "projects/6bef4151-4b5d-4147-b4d0-c2f4fd5b40db/branches/br-broad-pine-y12n6gnv/endpoints/ep-summer-frost-y131l3vx", // defaults to LAKEBASE_ENDPOINT environment variable
+  user: "user_id", // Optional, defaults to PGUSER or DATABRICKS_CLIENT_ID
+  max: 10, // Connection pool size
+});
+```
+
+## Authentication
+
+The driver supports Databricks authentication via:
+
+1. **Default auth chain** (`.databrickscfg`, environment variables)
+2. **OAuth tokens** (via Databricks SDK)
+3. **Native Postgres password authentication**
+
+See [Databricks authentication docs](https://docs.databricks.com/en/dev-tools/auth/index.html) or [Lakebase Autoscaling authentication docs](https://docs.databricks.com/aws/en/oltp/projects/authentication#overview) for more information.
+
+## Configuration
+
+| Option                    | Environment Variable               | Description                             | Default                 |
+| ------------------------- | ---------------------------------- | --------------------------------------- | ----------------------- |
+| `host`                    | `PGHOST`                           | Lakebase host                           | _Required_              |
+| `database`                | `PGDATABASE`                       | Database name                           | _Required_              |
+| `endpoint`                | `LAKEBASE_ENDPOINT`                | Endpoint resource path                  | _Required_              |
+| `user`                    | `PGUSER` or `DATABRICKS_CLIENT_ID` | Username or service principal ID        | Auto-detected           |
+| `port`                    | `PGPORT`                           | Port number                             | `5432`                  |
+| `sslMode`                 | `PGSSLMODE`                        | SSL mode                                | `require`               |
+| `max`                     | -                                  | Max pool connections                    | `10`                    |
+| `idleTimeoutMillis`       | -                                  | Idle connection timeout                 | `30000`                 |
+| `connectionTimeoutMillis` | -                                  | Connection timeout                      | `10000`                 |
+| `logger`                  | -                                  | Logger instance or config               | `{ error: true }`       |
+
+## Logging
+
+By default, the driver logs errors only. You can configure logging in three ways:
+
+### 1. Config-Based Logger (Simple)
+
+Enable/disable specific log levels using boolean flags:
+
+```typescript
+import { createLakebasePool } from "@databricks/lakebase";
+
+// Development mode: enable debug and error logs
+const pool = createLakebasePool({
+  logger: { debug: true, error: true },
+});
+
+// Production mode: errors only (same as default)
+const pool = createLakebasePool({
+  logger: { error: true },
+});
+
+// Verbose mode: all logs enabled
+const pool = createLakebasePool({
+  logger: { debug: true, info: true, warn: true, error: true },
+});
+
+// Silent mode: all logs disabled
+const pool = createLakebasePool({
+  logger: { debug: false, info: false, warn: false, error: false },
+});
+```
+
+### 2. Custom Logger (Advanced)
+
+Inject your own logger implementation for custom formatting or integrations:
+
+```typescript
+const logger = {
+  debug: (msg: string, ...args: unknown[]) => console.debug(msg, ...args),
+  info: (msg: string, ...args: unknown[]) => console.log(msg, ...args),
+  warn: (msg: string, ...args: unknown[]) => console.warn(msg, ...args),
+  error: (msg: string, ...args: unknown[]) => console.error(msg, ...args),
+};
+
+const pool = createLakebasePool({ logger });
+```
+
+### 3. Default Behavior
+
+If no logger is provided, the driver defaults to error-only logging:
+
+```typescript
+// These are equivalent:
+const pool1 = createLakebasePool();
+const pool2 = createLakebasePool({ logger: { error: true } });
+```
+
+When used with AppKit, logging is automatically configured - see the [AppKit Integration](#appkit-integration) section.
+
+## ORM Examples
+
+### Drizzle ORM
+
+```typescript
+import { drizzle } from "drizzle-orm/node-postgres";
+import { createLakebasePool } from "@databricks/lakebase";
+
+const pool = createLakebasePool();
+const db = drizzle(pool);
+
+const users = await db.select().from(usersTable);
+```
+
+### Prisma
+
+```typescript
+import { PrismaPg } from "@prisma/adapter-pg";
+import { PrismaClient } from "@prisma/client";
+import { createLakebasePool } from "@databricks/lakebase";
+
+const pool = createLakebasePool();
+const adapter = new PrismaPg(pool);
+const prisma = new PrismaClient({ adapter });
+
+const users = await prisma.user.findMany();
+```
+
+### TypeORM
+
+```typescript
+import { DataSource } from "typeorm";
+import { createLakebasePool } from "@databricks/lakebase";
+
+const pool = createLakebasePool();
+
+const dataSource = new DataSource({
+  type: "postgres",
+  synchronize: true,
+  ...getLakebaseOrmConfig(),
+  entities: [
+    // Your entity classes
+  ],
+});
+
+await dataSource.initialize();
+```
+
+### Sequelize
+
+```typescript
+import { Sequelize } from "sequelize";
+import { getLakebaseOrmConfig } from "@databricks/lakebase";
+
+const sequelize = new Sequelize({
+  dialect: "postgres",
+  ...getLakebaseOrmConfig(),
+});
+```
+
+## OpenTelemetry Integration
+
+The driver automatically uses OpenTelemetry's global registry when available. If your application initializes OpenTelemetry providers, the driver will automatically instrument queries and metrics with no additional configuration needed.
+
+### Setup
+
+Install OpenTelemetry in your application:
+
+```bash
+npm install @opentelemetry/api @opentelemetry/sdk-node
+```
+
+Initialize OpenTelemetry in your application:
+
+```typescript
+import { NodeSDK } from "@opentelemetry/sdk-node";
+
+const sdk = new NodeSDK({
+  // Your OTEL configuration
+});
+
+sdk.start(); // Registers global providers
+
+// Now create your pool - it automatically uses the global providers
+import { createLakebasePool } from "@databricks/lakebase";
+const pool = createLakebasePool();
+```
+
+The driver calls `trace.getTracer('@databricks/lakebase')` and `metrics.getMeter('@databricks/lakebase')` internally. If no global providers are registered, operations are automatic no-ops.
+
+### Metrics Exported
+
+- `lakebase.token.refresh.duration` - OAuth token refresh duration (histogram, ms)
+- `lakebase.query.duration` - Query execution duration (histogram, ms)
+- `lakebase.pool.connections.total` - Total connections in pool (gauge)
+- `lakebase.pool.connections.idle` - Idle connections (gauge)
+- `lakebase.pool.connections.waiting` - Clients waiting for connection (gauge)
+- `lakebase.pool.errors` - Pool errors by error code (counter)
+
+## AppKit Integration
+
+This driver is also available as part of [@databricks/appkit](https://www.npmjs.com/package/@databricks/appkit):
+
+```typescript
+import { createLakebasePool } from "@databricks/appkit";
+
+const pool = createLakebasePool();
+```
+
+**Differences between standalone and AppKit:**
+
+- **Standalone** (`@databricks/lakebase`): Silent by default - no logger configured
+- **AppKit** (`@databricks/appkit`): Automatically injects AppKit's logger with scope `appkit:connectors:lakebase`.
+
+## Learn more about Lakebase Autoscaling
+
+For Lakebase Autoscaling documentation, see [docs.databricks.com/aws/en/oltp/projects](https://docs.databricks.com/aws/en/oltp/projects/).
diff --git a/packages/lakebase/package.json b/packages/lakebase/package.json
new file mode 100644
index 00000000..2a97b1e8
--- /dev/null
+++ b/packages/lakebase/package.json
@@ -0,0 +1,65 @@
+{
+  "name": "@databricks/lakebase",
+  "type": "module",
+  "version": "0.1.2",
+  "description": "PostgreSQL driver for Databricks Lakebase with automatic OAuth token refresh",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "packageManager": "pnpm@10.21.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/databricks/appkit.git",
+    "directory": "packages/lakebase"
+  },
+  "keywords": [
+    "databricks",
+    "lakebase",
+    "postgres",
+    "postgresql",
+    "driver",
+    "oauth",
+    "oltp"
+  ],
+  "license": "Apache-2.0",
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE",
+    "DCO"
+  ],
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "development": "./src/index.ts",
+      "default": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "scripts": {
+    "build:package": "tsdown --config tsdown.config.ts",
+    "build:watch": "tsdown --config tsdown.config.ts --watch",
+    "clean:full": "rm -rf dist node_modules tmp",
+    "clean": "rm -rf dist tmp",
+    "dist": "tsx ../../tools/dist-lakebase.ts",
+    "tarball": "rm -rf tmp && pnpm dist && npm pack ./tmp --pack-destination ./tmp",
+    "typecheck": "tsc --noEmit",
+    "release": "release-it",
+    "release:dry": "release-it --dry-run",
+    "release:ci": "release-it --ci"
+  },
+  "dependencies": {
+    "@databricks/sdk-experimental": "^0.16.0",
+    "pg": "^8.18.0",
+    "@opentelemetry/api": "^1.9.0"
+  },
+  "devDependencies": {
+    "@types/pg": "^8.16.0"
+  },
+  "module": "./dist/index.js",
+  "publishConfig": {
+    "exports": {
+      ".": "./dist/index.js",
+      "./package.json": "./package.json"
+    }
+  }
+}
diff --git a/packages/lakebase/src/__tests__/credentials.test.ts b/packages/lakebase/src/__tests__/credentials.test.ts
new file mode 100644
index 00000000..837163b1
--- /dev/null
+++ b/packages/lakebase/src/__tests__/credentials.test.ts
@@ -0,0 +1,187 @@
+import type { WorkspaceClient } from "@databricks/sdk-experimental";
+import { ApiClient, Config } from "@databricks/sdk-experimental";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { generateDatabaseCredential } from "../credentials";
+import {
+  type DatabaseCredential,
+  RequestedClaimsPermissionSet,
+} from "../types";
+
+// Mock the @databricks/sdk-experimental module
+vi.mock("@databricks/sdk-experimental", () => {
+  const mockRequest = vi.fn();
+
+  return {
+    Config: vi.fn(),
+    ApiClient: vi.fn().mockImplementation(() => ({
+      request: mockRequest,
+    })),
+  };
+});
+
+describe("Lakebase Authentication", () => {
+  let mockWorkspaceClient: WorkspaceClient;
+  let mockApiClient: ApiClient;
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+
+    // Get the mocked ApiClient constructor
+    const ApiClientConstructor = ApiClient as unknown as ReturnType<
+      typeof vi.fn
+    >;
+    mockApiClient = new ApiClientConstructor(
+      new Config({ host: "https://test.databricks.com" }),
+    );
+
+    // Setup mock workspace client with apiClient
+    mockWorkspaceClient = {
+      config: {
+        host: "https://test.databricks.com",
+      },
+      apiClient: mockApiClient,
+    } as WorkspaceClient;
+  });
+
+  describe("generateDatabaseCredential", () => {
+    it("should generate database credentials with proper endpoint format", async () => {
+      const mockCredential: DatabaseCredential = {
+        token: "mock-oauth-token-abc123",
+        expire_time: "2026-02-06T18:00:00Z",
+      };
+
+      // Setup mock response
+      vi.mocked(mockApiClient.request).mockResolvedValue(mockCredential);
+
+      const credential = await generateDatabaseCredential(mockWorkspaceClient, {
+        endpoint: "projects/test-project/branches/main/endpoints/primary",
+      });
+
+      // Verify API call
+      expect(mockApiClient.request).toHaveBeenCalledWith({
+        path: "/api/2.0/postgres/credentials",
+        method: "POST",
+        headers: expect.any(Headers),
+        raw: false,
+        payload: {
+          endpoint: "projects/test-project/branches/main/endpoints/primary",
+        },
+      });
+
+      // Verify response
+      expect(credential).toEqual(mockCredential);
+      expect(credential.token).toBe("mock-oauth-token-abc123");
+      expect(credential.expire_time).toBe("2026-02-06T18:00:00Z");
+    });
+
+    it("should include claims when provided", async () => {
+      const mockCredential: DatabaseCredential = {
+        token: "mock-oauth-token-with-claims",
+        expire_time: "2026-02-06T18:00:00Z",
+      };
+
+      vi.mocked(mockApiClient.request).mockResolvedValue(mockCredential);
+
+      await generateDatabaseCredential(mockWorkspaceClient, {
+        endpoint: "projects/test-project/branches/main/endpoints/primary",
+        claims: [
+          {
+            permission_set: RequestedClaimsPermissionSet.READ_ONLY,
+            resources: [
+              { table_name: "catalog.schema.users" },
+              { table_name: "catalog.schema.orders" },
+            ],
+          },
+        ],
+      });
+
+      // Verify claims are included in payload
+      expect(mockApiClient.request).toHaveBeenCalledWith({
+        path: "/api/2.0/postgres/credentials",
+        method: "POST",
+        headers: expect.any(Headers),
+        raw: false,
+        payload: {
+          endpoint: "projects/test-project/branches/main/endpoints/primary",
+          claims: [
+            {
+              permission_set: RequestedClaimsPermissionSet.READ_ONLY,
+              resources: [
+                { table_name: "catalog.schema.users" },
+                { table_name: "catalog.schema.orders" },
+              ],
+            },
+          ],
+        },
+      });
+    });
+
+    it("should handle token expiration time parsing", async () => {
+      const futureTime = new Date(Date.now() + 60 * 60 * 1000).toISOString(); // 1 hour from now
+      const mockCredential: DatabaseCredential = {
+        token: "mock-token",
+        expire_time: futureTime,
+      };
+
+      vi.mocked(mockApiClient.request).mockResolvedValue(mockCredential);
+
+      const credential = await generateDatabaseCredential(mockWorkspaceClient, {
+        endpoint: "projects/test-project/branches/main/endpoints/primary",
+      });
+
+      // Verify expiration time is in the future
+      const expiresAt = new Date(credential.expire_time).getTime();
+      expect(expiresAt).toBeGreaterThan(Date.now());
+    });
+
+    it("should handle API errors gracefully", async () => {
+      const mockError = new Error("API request failed");
+      vi.mocked(mockApiClient.request).mockRejectedValue(mockError);
+
+      await expect(
+        generateDatabaseCredential(mockWorkspaceClient, {
+          endpoint: "projects/invalid/branches/main/endpoints/primary",
+        }),
+      ).rejects.toThrow("API request failed");
+    });
+
+    it("should use correct workspace host for API calls", async () => {
+      const customHost = "https://custom-workspace.databricks.com";
+
+      // Create a new mock API client for the custom workspace
+      const ApiClientConstructor = ApiClient as unknown as ReturnType<
+        typeof vi.fn
+      >;
+      const customApiClient = new ApiClientConstructor(
+        new Config({ host: customHost }),
+      );
+
+      const customWorkspaceClient = {
+        config: { host: customHost },
+        apiClient: customApiClient,
+      } as WorkspaceClient;
+
+      const mockCredential: DatabaseCredential = {
+        token: "mock-token",
+        expire_time: "2026-02-06T18:00:00Z",
+      };
+
+      vi.mocked(customApiClient.request).mockResolvedValue(mockCredential);
+
+      await generateDatabaseCredential(customWorkspaceClient, {
+        endpoint: "projects/test/branches/main/endpoints/primary",
+      });
+
+      // Verify the request was made with the correct workspace client
+      expect(customApiClient.request).toHaveBeenCalledWith({
+        path: "/api/2.0/postgres/credentials",
+        method: "POST",
+        headers: expect.any(Headers),
+        raw: false,
+        payload: {
+          endpoint: "projects/test/branches/main/endpoints/primary",
+        },
+      });
+    });
+  });
+});
diff --git a/packages/lakebase/src/__tests__/logger.test.ts b/packages/lakebase/src/__tests__/logger.test.ts
new file mode 100644
index 00000000..0de3a208
--- /dev/null
+++ b/packages/lakebase/src/__tests__/logger.test.ts
@@ -0,0 +1,184 @@
+import { describe, expect, test, vi } from "vitest";
+import { resolveLogger } from "../logger";
+import type { Logger, LoggerConfig } from "../types";
+
+describe("resolveLogger", () => {
+  describe("Logger instance passthrough", () => {
+    test("should return Logger instance as-is", () => {
+      const mockLogger: Logger = {
+        debug: vi.fn(),
+        info: vi.fn(),
+        warn: vi.fn(),
+        error: vi.fn(),
+      };
+
+      const result = resolveLogger(mockLogger);
+
+      expect(result).toBe(mockLogger);
+    });
+  });
+
+  describe("LoggerConfig resolution", () => {
+    test("should create console logger with all levels enabled", () => {
+      const config: LoggerConfig = {
+        debug: true,
+        info: true,
+        warn: true,
+        error: true,
+      };
+
+      const logger = resolveLogger(config);
+
+      expect(typeof logger.debug).toBe("function");
+      expect(typeof logger.info).toBe("function");
+      expect(typeof logger.warn).toBe("function");
+      expect(typeof logger.error).toBe("function");
+    });
+
+    test("should create console logger with selective levels", () => {
+      const consoleDebugSpy = vi.spyOn(console, "debug");
+      const consoleInfoSpy = vi.spyOn(console, "info");
+      const consoleWarnSpy = vi.spyOn(console, "warn");
+      const consoleErrorSpy = vi.spyOn(console, "error");
+
+      const config: LoggerConfig = {
+        debug: true,
+        info: false,
+        warn: true,
+        error: false,
+      };
+
+      const logger = resolveLogger(config);
+
+      // Test enabled levels
+      logger.debug("test debug");
+      expect(consoleDebugSpy).toHaveBeenCalledWith("test debug");
+
+      logger.warn("test warn");
+      expect(consoleWarnSpy).toHaveBeenCalledWith("test warn");
+
+      // Test disabled levels (should be noop)
+      logger.info("test info");
+      expect(consoleInfoSpy).not.toHaveBeenCalled();
+
+      logger.error("test error");
+      expect(consoleErrorSpy).not.toHaveBeenCalled();
+
+      consoleDebugSpy.mockRestore();
+      consoleInfoSpy.mockRestore();
+      consoleWarnSpy.mockRestore();
+      consoleErrorSpy.mockRestore();
+    });
+
+    test("should create noop logger when all levels disabled", () => {
+      const consoleDebugSpy = vi.spyOn(console, "debug");
+      const consoleInfoSpy = vi.spyOn(console, "info");
+      const consoleWarnSpy = vi.spyOn(console, "warn");
+      const consoleErrorSpy = vi.spyOn(console, "error");
+
+      const config: LoggerConfig = {
+        debug: false,
+        info: false,
+        warn: false,
+        error: false,
+      };
+
+      const logger = resolveLogger(config);
+
+      logger.debug("test");
+      logger.info("test");
+      logger.warn("test");
+      logger.error("test");
+
+      expect(consoleDebugSpy).not.toHaveBeenCalled();
+      expect(consoleInfoSpy).not.toHaveBeenCalled();
+      expect(consoleWarnSpy).not.toHaveBeenCalled();
+      expect(consoleErrorSpy).not.toHaveBeenCalled();
+
+      consoleDebugSpy.mockRestore();
+      consoleInfoSpy.mockRestore();
+      consoleWarnSpy.mockRestore();
+      consoleErrorSpy.mockRestore();
+    });
+
+    test("should handle empty LoggerConfig", () => {
+      const consoleDebugSpy = vi.spyOn(console, "debug");
+      const consoleInfoSpy = vi.spyOn(console, "info");
+      const consoleWarnSpy = vi.spyOn(console, "warn");
+      const consoleErrorSpy = vi.spyOn(console, "error");
+
+      const config: LoggerConfig = {};
+
+      const logger = resolveLogger(config);
+
+      logger.debug("test");
+      logger.info("test");
+      logger.warn("test");
+      logger.error("test");
+
+      expect(consoleDebugSpy).not.toHaveBeenCalled();
+      expect(consoleInfoSpy).not.toHaveBeenCalled();
+      expect(consoleWarnSpy).not.toHaveBeenCalled();
+      expect(consoleErrorSpy).not.toHaveBeenCalled();
+
+      consoleDebugSpy.mockRestore();
+      consoleInfoSpy.mockRestore();
+      consoleWarnSpy.mockRestore();
+      consoleErrorSpy.mockRestore();
+    });
+
+    test("should support format strings and args", () => {
+      const consoleErrorSpy = vi.spyOn(console, "error");
+
+      const config: LoggerConfig = {
+        error: true,
+      };
+
+      const logger = resolveLogger(config);
+
+      logger.error("Error: %s %d", "test", 123);
+
+      expect(consoleErrorSpy).toHaveBeenCalledWith("Error: %s %d", "test", 123);
+
+      consoleErrorSpy.mockRestore();
+    });
+  });
+
+  describe("Default behavior", () => {
+    test("should create error-only logger when undefined", () => {
+      const consoleDebugSpy = vi.spyOn(console, "debug");
+      const consoleInfoSpy = vi.spyOn(console, "info");
+      const consoleWarnSpy = vi.spyOn(console, "warn");
+      const consoleErrorSpy = vi.spyOn(console, "error");
+
+      const logger = resolveLogger(undefined);
+
+      logger.debug("test");
+      logger.info("test");
+      logger.warn("test");
+      logger.error("test error");
+
+      expect(consoleDebugSpy).not.toHaveBeenCalled();
+      expect(consoleInfoSpy).not.toHaveBeenCalled();
+      expect(consoleWarnSpy).not.toHaveBeenCalled();
+      expect(consoleErrorSpy).toHaveBeenCalledWith("test error");
+
+      consoleDebugSpy.mockRestore();
+      consoleInfoSpy.mockRestore();
+      consoleWarnSpy.mockRestore();
+      consoleErrorSpy.mockRestore();
+    });
+
+    test("should create error-only logger when no argument provided", () => {
+      const consoleErrorSpy = vi.spyOn(console, "error");
+
+      const logger = resolveLogger();
+
+      logger.error("test error");
+
+      expect(consoleErrorSpy).toHaveBeenCalledWith("test error");
+
+      consoleErrorSpy.mockRestore();
+    });
+  });
+});
diff --git a/packages/lakebase/src/__tests__/pool.test.ts b/packages/lakebase/src/__tests__/pool.test.ts
new file mode 100644
index 00000000..5cd3db30
--- /dev/null
+++ b/packages/lakebase/src/__tests__/pool.test.ts
@@ -0,0 +1,760 @@
+import { afterEach, beforeEach, describe, expect, test, vi } from "vitest";
+import { createLakebasePool } from "../pool";
+
+// ── Mocks ────────────────────────────────────────────────────────────
+
+// Mock pg module
+vi.mock("pg", () => {
+  const mockQuery = vi.fn();
+  const mockConnect = vi.fn();
+  const mockEnd = vi.fn().mockResolvedValue(undefined);
+  const mockOn = vi.fn();
+
+  const MockPool = vi.fn((config) => ({
+    query: mockQuery,
+    connect: mockConnect,
+    end: mockEnd,
+    on: mockOn,
+    options: config, // Store config for inspection
+    totalCount: 3,
+    idleCount: 1,
+    waitingCount: 0,
+  }));
+
+  return {
+    default: { Pool: MockPool },
+    Pool: MockPool,
+    __mockQuery: mockQuery,
+    __mockConnect: mockConnect,
+    __mockEnd: mockEnd,
+    __mockOn: mockOn,
+    __MockPool: MockPool,
+  };
+});
+
+// Mock generateDatabaseCredential
+vi.mock("../credentials", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("../credentials")>();
+  return {
+    ...actual,
+    generateDatabaseCredential: vi.fn(),
+  };
+});
+
+// Mock telemetry - create spies for all metric instruments
+const mockSpanEnd = vi.fn();
+const mockSpanSetAttribute = vi.fn();
+const mockSpanSetStatus = vi.fn();
+const mockCounterAdd = vi.fn();
+const mockHistogramRecord = vi.fn();
+const mockAddCallback = vi.fn();
+
+const mockTracer = {
+  startActiveSpan: vi.fn(
+    <T>(_name: string, _opts: unknown, fn: (span: unknown) => T): T => {
+      const span = {
+        setAttribute: mockSpanSetAttribute,
+        setStatus: mockSpanSetStatus,
+        end: mockSpanEnd,
+        recordException: vi.fn(),
+      };
+      return fn(span);
+    },
+  ),
+};
+
+const mockMeter = {
+  createCounter: vi.fn(() => ({ add: mockCounterAdd })),
+  createHistogram: vi.fn(() => ({ record: mockHistogramRecord })),
+  createObservableGauge: vi.fn(() => ({
+    addCallback: mockAddCallback,
+  })),
+};
+
+vi.mock("../telemetry", () => ({
+  SpanStatusCode: { OK: 1, ERROR: 2 },
+  SpanKind: { CLIENT: 3 },
+  initTelemetry: vi.fn(() => ({
+    tracer: mockTracer,
+    meter: mockMeter,
+    tokenRefreshDuration: { record: mockHistogramRecord },
+    queryDuration: { record: mockHistogramRecord },
+    poolErrors: { add: mockCounterAdd },
+  })),
+  attachPoolMetrics: vi.fn(),
+}));
+
+// ── Test suite ───────────────────────────────────────────────────────
+
+describe("createLakebasePool", () => {
+  let mockGenerateCredential: ReturnType<typeof vi.fn>;
+
+  // Save original env vars to restore after each test
+  const originalEnv: Record<string, string | undefined> = {};
+  const envKeysUsed = [
+    "PGHOST",
+    "PGDATABASE",
+    "LAKEBASE_ENDPOINT",
+    "PGUSER",
+    "PGPORT",
+    "PGSSLMODE",
+    "DATABRICKS_CLIENT_ID",
+  ];
+
+  beforeEach(async () => {
+    vi.clearAllMocks();
+
+    // Save original env vars
+    for (const key of envKeysUsed) {
+      originalEnv[key] = process.env[key];
+    }
+
+    // Setup environment variables
+    process.env.PGHOST = "ep-test.database.us-east-1.databricks.com";
+    process.env.PGDATABASE = "databricks_postgres";
+    process.env.LAKEBASE_ENDPOINT =
+      "projects/test-project/branches/main/endpoints/primary";
+    process.env.PGUSER = "test-user@example.com";
+
+    // Setup mock for generateDatabaseCredential
+    const utils = await import("../credentials");
+    mockGenerateCredential = utils.generateDatabaseCredential as any;
+    mockGenerateCredential.mockResolvedValue({
+      token: "test-oauth-token-12345",
+      expire_time: new Date(Date.now() + 3600000).toISOString(), // 1 hour from now
+    });
+  });
+
+  afterEach(() => {
+    // Restore original env vars
+    for (const key of envKeysUsed) {
+      if (originalEnv[key] === undefined) {
+        delete process.env[key];
+      } else {
+        process.env[key] = originalEnv[key];
+      }
+    }
+  });
+
+  describe("configuration", () => {
+    test("should create pool with environment variables", () => {
+      const pool = createLakebasePool({
+        workspaceClient: {} as any,
+      });
+
+      expect(pool).toBeDefined();
+      expect(pool.options.host).toBe(
+        "ep-test.database.us-east-1.databricks.com",
+      );
+      expect(pool.options.database).toBe("databricks_postgres");
+      expect(pool.options.user).toBe("test-user@example.com");
+      expect(pool.options.port).toBe(5432);
+    });
+
+    test("should create pool with explicit configuration", () => {
+      const pool = createLakebasePool({
+        workspaceClient: {} as any,
+        endpoint: "projects/my-project/branches/dev/endpoints/test",
+        host: "ep-custom.database.us-west-2.databricks.com",
+        database: "custom_db",
+        user: "custom-user@example.com", // Explicit user overrides env
+        port: 5433,
+        max: 20,
+      });
+
+      expect(pool.options.host).toBe(
+        "ep-custom.database.us-west-2.databricks.com",
+      );
+      expect(pool.options.database).toBe("custom_db");
+      expect(pool.options.user).toBe("custom-user@example.com");
+      expect(pool.options.port).toBe(5433);
+      expect(pool.options.max).toBe(20);
+    });
+
+    test("should throw error when endpoint is missing", () => {
+      delete process.env.LAKEBASE_ENDPOINT;
+
+      expect(() =>
+        createLakebasePool({
+          workspaceClient: {} as any,
+        }),
+      ).toThrow("LAKEBASE_ENDPOINT or config.endpoint");
+    });
+
+    test("should throw error when host is missing", () => {
+      delete process.env.PGHOST;
+
+      expect(() =>
+        createLakebasePool({
+          workspaceClient: {} as any,
+        }),
+      ).toThrow("PGHOST or config.host");
+    });
+
+    test("should throw error when database is missing", () => {
+      delete process.env.PGDATABASE;
+
+      expect(() =>
+        createLakebasePool({
+          workspaceClient: {} as any,
+        }),
+      ).toThrow("PGDATABASE or config.database");
+    });
+
+    test("should throw error when user is missing", () => {
+      delete process.env.PGUSER;
+      delete process.env.DATABRICKS_CLIENT_ID;
+
+      expect(() =>
+        createLakebasePool({
+          workspaceClient: {} as any,
+        }),
+      ).toThrow("PGUSER, DATABRICKS_CLIENT_ID, or config.user");
+    });
+
+    test("should use DATABRICKS_CLIENT_ID as fallback for user", () => {
+      delete process.env.PGUSER;
+      process.env.DATABRICKS_CLIENT_ID = "service-principal-123";
+
+      const pool = createLakebasePool({
+        workspaceClient: {} as any,
+      });
+
+      expect(pool.options.user).toBe("service-principal-123");
+    });
+
+    test("should use default values for optional config", () => {
+      const pool = createLakebasePool({
+        workspaceClient: {} as any,
+      });
+
+      expect(pool.options.port).toBe(5432);
+      expect(pool.options.max).toBe(10);
+      expect(pool.options.idleTimeoutMillis).toBe(30000);
+      expect(pool.options.connectionTimeoutMillis).toBe(10000);
+    });
+
+    test("should configure SSL based on sslMode", () => {
+      const pool = createLakebasePool({
+        workspaceClient: {} as any,
+        sslMode: "require",
+      });
+
+      expect(pool.options.ssl).toEqual({ rejectUnauthorized: true });
+    });
+
+    test("should allow custom SSL configuration", () => {
+      const customSSL = { rejectUnauthorized: false, ca: "custom-ca" };
+      const pool = createLakebasePool({
+        workspaceClient: {} as any,
+        ssl: customSSL,
+      });
+
+      expect(pool.options.ssl).toEqual(customSSL);
+    });
+
+    test("should throw on invalid PGSSLMODE", () => {
+      process.env.PGSSLMODE = "verify-full";
+
+      expect(() =>
+        createLakebasePool({
+          workspaceClient: {} as any,
+        }),
+      ).toThrow("one of: require, disable, prefer");
+    });
+
+    test("should accept valid PGSSLMODE values", () => {
+      for (const mode of ["require", "disable", "prefer"]) {
+        process.env.PGSSLMODE = mode;
+
+        expect(() =>
+          createLakebasePool({
+            workspaceClient: {} as any,
+          }),
+        ).not.toThrow();
+      }
+    });
+  });
+
+  describe("password callback", () => {
+    test("should configure password as async function", () => {
+      const pool = createLakebasePool({
+        workspaceClient: {} as any,
+      });
+
+      expect(typeof pool.options.password).toBe("function");
+    });
+
+    test("should fetch OAuth token when password callback is invoked", async () => {
+      const workspaceClient = {
+        test: "client",
+        config: { host: "test" },
+      } as any;
+      const pool = createLakebasePool({
+        workspaceClient,
+        endpoint: "projects/test/branches/main/endpoints/primary",
+      });
+
+      // Invoke the password callback
+      const passwordFn = pool.options.password as () => Promise<string>;
+      const password = await passwordFn();
+
+      expect(mockGenerateCredential).toHaveBeenCalledWith(workspaceClient, {
+        endpoint: "projects/test/branches/main/endpoints/primary",
+      });
+      expect(password).toBe("test-oauth-token-12345");
+    });
+
+    test("should cache OAuth token for subsequent calls", async () => {
+      const workspaceClient = { config: { host: "test" } } as any;
+      const pool = createLakebasePool({
+        workspaceClient,
+      });
+
+      const passwordFn = pool.options.password as () => Promise<string>;
+
+      // First call - should fetch token
+      const password1 = await passwordFn();
+      expect(mockGenerateCredential).toHaveBeenCalledTimes(1);
+
+      // Second call - should use cached token
+      const password2 = await passwordFn();
+      expect(mockGenerateCredential).toHaveBeenCalledTimes(1); // Still 1
+      expect(password2).toBe(password1);
+    });
+
+    test("should refresh token when it expires", async () => {
+      const workspaceClient = { config: { host: "test" } } as any;
+
+      // First token expires in 1 minute (within buffer)
+      mockGenerateCredential.mockResolvedValueOnce({
+        token: "expiring-token",
+        expire_time: new Date(Date.now() + 60000).toISOString(),
+      });
+
+      // Second token expires in 1 hour
+      mockGenerateCredential.mockResolvedValueOnce({
+        token: "new-token",
+        expire_time: new Date(Date.now() + 3600000).toISOString(),
+      });
+
+      const pool = createLakebasePool({
+        workspaceClient,
+      });
+
+      const passwordFn = pool.options.password as () => Promise<string>;
+
+      // First call - get expiring token
+      const password1 = await passwordFn();
+      expect(password1).toBe("expiring-token");
+      expect(mockGenerateCredential).toHaveBeenCalledTimes(1);
+
+      // Second call - token is expiring, should refresh
+      const password2 = await passwordFn();
+      expect(password2).toBe("new-token");
+      expect(mockGenerateCredential).toHaveBeenCalledTimes(2);
+    });
+
+    test("should handle token fetch errors", async () => {
+      const workspaceClient = { config: { host: "test" } } as any;
+
+      mockGenerateCredential.mockRejectedValue(new Error("Token fetch failed"));
+
+      const pool = createLakebasePool({
+        workspaceClient,
+      });
+
+      const passwordFn = pool.options.password as () => Promise<string>;
+      await expect(passwordFn()).rejects.toThrow("Token fetch failed");
+    });
+
+    test("should deduplicate concurrent token refresh requests", async () => {
+      const workspaceClient = { config: { host: "test" } } as any;
+
+      // Make the credential generation slow
+      mockGenerateCredential.mockImplementation(
+        () =>
+          new Promise((resolve) =>
+            setTimeout(
+              () =>
+                resolve({
+                  token: "deduped-token",
+                  expire_time: new Date(Date.now() + 3600000).toISOString(),
+                }),
+              50,
+            ),
+          ),
+      );
+
+      const pool = createLakebasePool({
+        workspaceClient,
+      });
+
+      const passwordFn = pool.options.password as () => Promise<string>;
+
+      // Fire multiple concurrent calls
+      const [p1, p2, p3] = await Promise.all([
+        passwordFn(),
+        passwordFn(),
+        passwordFn(),
+      ]);
+
+      // Only one API call should have been made
+      expect(mockGenerateCredential).toHaveBeenCalledTimes(1);
+      expect(p1).toBe("deduped-token");
+      expect(p2).toBe("deduped-token");
+      expect(p3).toBe("deduped-token");
+    });
+  });
+
+  describe("workspace client", () => {
+    test("should use provided workspace client", () => {
+      const workspaceClient = { config: { host: "test" } } as any;
+      const pool = createLakebasePool({
+        workspaceClient,
+      });
+
+      expect(pool).toBeDefined();
+    });
+
+    test("should fallback to SDK default auth when workspace client not provided", async () => {
+      const pool = createLakebasePool({
+        // No workspace client provided - should use SDK default auth chain
+      });
+
+      // Pool should be created successfully
+      expect(pool).toBeDefined();
+      expect(pool.options.password).toBeDefined();
+      expect(typeof pool.options.password).toBe("function");
+    });
+  });
+
+  describe("pool behavior", () => {
+    test("should register error handler", () => {
+      const pool = createLakebasePool({
+        workspaceClient: {} as any,
+      });
+
+      // Pool should have on method for error handling
+      expect(pool.on).toBeDefined();
+      expect(typeof pool.on).toBe("function");
+    });
+
+    test("should return pg.Pool instance", () => {
+      const pool = createLakebasePool({
+        workspaceClient: {} as any,
+      });
+
+      // Standard pg.Pool methods should be available
+      expect(pool.query).toBeDefined();
+      expect(pool.connect).toBeDefined();
+      expect(pool.end).toBeDefined();
+      expect(typeof pool.query).toBe("function");
+      expect(typeof pool.connect).toBe("function");
+      expect(typeof pool.end).toBe("function");
+    });
+  });
+
+  describe("ORM compatibility patterns", () => {
+    test("should work with Drizzle pattern", () => {
+      const pool = createLakebasePool({
+        workspaceClient: {} as any,
+      });
+
+      // Drizzle expects { client: pool }
+      const drizzleConfig = { client: pool };
+      expect(drizzleConfig.client).toBe(pool);
+      expect(typeof drizzleConfig.client.query).toBe("function");
+    });
+
+    test("should work with Prisma adapter pattern", () => {
+      const pool = createLakebasePool({
+        workspaceClient: {} as any,
+      });
+
+      // Prisma expects PrismaPg(pool)
+      // Mock PrismaPg adapter
+      const mockPrismaPg = (pgPool: any) => ({ pool: pgPool });
+      const adapter = mockPrismaPg(pool);
+
+      expect(adapter.pool).toBe(pool);
+    });
+
+    test("should expose standard pg.Pool interface", () => {
+      const pool = createLakebasePool({
+        workspaceClient: {} as any,
+      });
+
+      // Standard pg.Pool methods
+      expect(pool.query).toBeDefined();
+      expect(pool.connect).toBeDefined();
+      expect(pool.end).toBeDefined();
+      expect(pool.on).toBeDefined();
+
+      // Options should be accessible
+      expect(pool.options).toBeDefined();
+      expect(pool.options.host).toBeDefined();
+      expect(pool.options.database).toBeDefined();
+    });
+  });
+
+  describe("native password authentication", () => {
+    test("should use static password when provided", () => {
+      const pool = createLakebasePool({
+        password: "my-static-password",
+        host: "ep-test.database.us-east-1.databricks.com",
+        database: "databricks_postgres",
+      });
+
+      expect(pool.options.password).toBe("my-static-password");
+    });
+
+    test("should prioritize password over OAuth when both provided", () => {
+      const pool = createLakebasePool({
+        password: "my-password",
+        workspaceClient: {} as any,
+        endpoint: "projects/test/branches/main/endpoints/primary",
+      });
+
+      expect(pool.options.password).toBe("my-password");
+    });
+
+    test("should support custom password callback function", async () => {
+      const customCallback = vi.fn(async () => "custom-token");
+
+      const pool = createLakebasePool({
+        password: customCallback,
+        host: "ep-test.database.us-east-1.databricks.com",
+        database: "databricks_postgres",
+      });
+
+      expect(typeof pool.options.password).toBe("function");
+      const passwordFn = pool.options.password as () => Promise<string>;
+      const result = await passwordFn();
+
+      expect(result).toBe("custom-token");
+      expect(customCallback).toHaveBeenCalled();
+    });
+
+    test("should not require endpoint when password is provided", () => {
+      delete process.env.LAKEBASE_ENDPOINT;
+
+      expect(() =>
+        createLakebasePool({
+          password: "my-password",
+          host: "ep-test.database.us-east-1.databricks.com",
+          database: "databricks_postgres",
+        }),
+      ).not.toThrow();
+    });
+
+    test("should not call OAuth token generation when password is provided", async () => {
+      const pool = createLakebasePool({
+        password: "static-password",
+        host: "ep-test.database.us-east-1.databricks.com",
+        database: "databricks_postgres",
+      });
+
+      // Simulate pg calling the password - should return the string directly
+      expect(pool.options.password).toBe("static-password");
+
+      // OAuth credential generation should not have been called
+      expect(mockGenerateCredential).not.toHaveBeenCalled();
+    });
+  });
+
+  describe("telemetry", () => {
+    test("should initialize telemetry", async () => {
+      const { initTelemetry } = await import("../telemetry");
+
+      createLakebasePool({
+        workspaceClient: {} as any,
+      });
+
+      expect(initTelemetry).toHaveBeenCalled();
+    });
+
+    test("should record token refresh duration on successful fetch", async () => {
+      const workspaceClient = { config: { host: "test" } } as any;
+      const pool = createLakebasePool({
+        workspaceClient,
+      });
+
+      const passwordFn = pool.options.password as () => Promise<string>;
+      await passwordFn();
+
+      // Token refresh duration should be recorded (histogram captures count implicitly)
+      expect(mockHistogramRecord).toHaveBeenCalledWith(expect.any(Number));
+    });
+
+    test("should set span attributes on token refresh", async () => {
+      const workspaceClient = { config: { host: "test" } } as any;
+      const pool = createLakebasePool({
+        workspaceClient,
+      });
+
+      const passwordFn = pool.options.password as () => Promise<string>;
+      await passwordFn();
+
+      // Span should have token expiration attribute
+      expect(mockSpanSetAttribute).toHaveBeenCalledWith(
+        "lakebase.token.expires_at",
+        expect.any(String),
+      );
+      expect(mockSpanSetStatus).toHaveBeenCalledWith({
+        code: 1, // SpanStatusCode.OK
+      });
+      expect(mockSpanEnd).toHaveBeenCalled();
+    });
+
+    test("should wrap pool.query to add telemetry tracking", () => {
+      const pool = createLakebasePool({
+        workspaceClient: {} as any,
+      });
+
+      // pool.query should be our wrapped function
+      expect(typeof pool.query).toBe("function");
+      expect(pool.query.name).toBe("queryWithTelemetry");
+    });
+  });
+
+  describe("logger injection", () => {
+    test("should default to error-only logging when no logger provided", () => {
+      const consoleDebugSpy = vi.spyOn(console, "debug");
+      const consoleInfoSpy = vi.spyOn(console, "info");
+      const consoleWarnSpy = vi.spyOn(console, "warn");
+      const consoleErrorSpy = vi.spyOn(console, "error");
+
+      const pool = createLakebasePool({
+        workspaceClient: {} as any,
+      });
+
+      expect(pool).toBeDefined();
+      // Default behavior: only errors are logged
+      expect(consoleDebugSpy).not.toHaveBeenCalled();
+      expect(consoleInfoSpy).not.toHaveBeenCalled();
+      expect(consoleWarnSpy).not.toHaveBeenCalled();
+      // Error logging would happen on actual errors
+
+      consoleDebugSpy.mockRestore();
+      consoleInfoSpy.mockRestore();
+      consoleWarnSpy.mockRestore();
+      consoleErrorSpy.mockRestore();
+    });
+
+    test("should use injected Logger instance", () => {
+      const mockLogger = {
+        debug: vi.fn(),
+        info: vi.fn(),
+        warn: vi.fn(),
+        error: vi.fn(),
+      };
+
+      const pool = createLakebasePool({
+        workspaceClient: {} as any,
+        logger: mockLogger,
+      });
+
+      expect(pool).toBeDefined();
+      expect(mockLogger.debug).toHaveBeenCalledWith(
+        expect.stringContaining("Created Lakebase connection pool"),
+        expect.any(String),
+        expect.any(String),
+        expect.any(String),
+      );
+    });
+
+    test("should use LoggerConfig with selective levels", () => {
+      const consoleDebugSpy = vi.spyOn(console, "debug");
+      const consoleInfoSpy = vi.spyOn(console, "info");
+      const consoleWarnSpy = vi.spyOn(console, "warn");
+      const consoleErrorSpy = vi.spyOn(console, "error");
+
+      const pool = createLakebasePool({
+        workspaceClient: {} as any,
+        logger: { debug: true, info: false, warn: false, error: true },
+      });
+
+      expect(pool).toBeDefined();
+      // Debug should be logged
+      expect(consoleDebugSpy).toHaveBeenCalledWith(
+        expect.stringContaining("Created Lakebase connection pool"),
+        expect.any(String),
+        expect.any(String),
+        expect.any(String),
+      );
+      // Info and warn should not be called
+      expect(consoleInfoSpy).not.toHaveBeenCalled();
+      expect(consoleWarnSpy).not.toHaveBeenCalled();
+
+      consoleDebugSpy.mockRestore();
+      consoleInfoSpy.mockRestore();
+      consoleWarnSpy.mockRestore();
+      consoleErrorSpy.mockRestore();
+    });
+
+    test("should use LoggerConfig with all levels enabled", () => {
+      const consoleDebugSpy = vi.spyOn(console, "debug");
+      const consoleInfoSpy = vi.spyOn(console, "info");
+      const consoleWarnSpy = vi.spyOn(console, "warn");
+      const consoleErrorSpy = vi.spyOn(console, "error");
+
+      const pool = createLakebasePool({
+        workspaceClient: {} as any,
+        logger: { debug: true, info: true, warn: true, error: true },
+      });
+
+      expect(pool).toBeDefined();
+      expect(consoleDebugSpy).toHaveBeenCalled();
+
+      consoleDebugSpy.mockRestore();
+      consoleInfoSpy.mockRestore();
+      consoleWarnSpy.mockRestore();
+      consoleErrorSpy.mockRestore();
+    });
+
+    test("should use LoggerConfig with all levels disabled", () => {
+      const consoleDebugSpy = vi.spyOn(console, "debug");
+      const consoleInfoSpy = vi.spyOn(console, "info");
+      const consoleWarnSpy = vi.spyOn(console, "warn");
+      const consoleErrorSpy = vi.spyOn(console, "error");
+
+      const pool = createLakebasePool({
+        workspaceClient: {} as any,
+        logger: { debug: false, info: false, warn: false, error: false },
+      });
+
+      expect(pool).toBeDefined();
+      expect(consoleDebugSpy).not.toHaveBeenCalled();
+      expect(consoleInfoSpy).not.toHaveBeenCalled();
+      expect(consoleWarnSpy).not.toHaveBeenCalled();
+      expect(consoleErrorSpy).not.toHaveBeenCalled();
+
+      consoleDebugSpy.mockRestore();
+      consoleInfoSpy.mockRestore();
+      consoleWarnSpy.mockRestore();
+      consoleErrorSpy.mockRestore();
+    });
+
+    test("should pass resolved logger to error handlers", async () => {
+      const { attachPoolMetrics } = await import("../telemetry");
+
+      createLakebasePool({
+        workspaceClient: {} as any,
+        logger: { debug: true, error: true },
+      });
+
+      // Verify attachPoolMetrics was called with a resolved logger
+      expect(attachPoolMetrics).toHaveBeenCalledWith(
+        expect.anything(),
+        expect.anything(),
+        expect.objectContaining({
+          debug: expect.any(Function),
+          info: expect.any(Function),
+          warn: expect.any(Function),
+          error: expect.any(Function),
+        }),
+      );
+    });
+  });
+});
diff --git a/packages/lakebase/src/config.ts b/packages/lakebase/src/config.ts
new file mode 100644
index 00000000..43a44051
--- /dev/null
+++ b/packages/lakebase/src/config.ts
@@ -0,0 +1,145 @@
+import { WorkspaceClient } from "@databricks/sdk-experimental";
+import type pg from "pg";
+import { ConfigurationError, ValidationError } from "./errors";
+import type { LakebasePoolConfig } from "./types";
+
+/** Default configuration values for the Lakebase connector */
+const defaults = {
+  port: 5432,
+  sslMode: "require" as const,
+  max: 10,
+  idleTimeoutMillis: 30_000,
+  connectionTimeoutMillis: 10_000,
+};
+
+const VALID_SSL_MODES = ["require", "disable", "prefer"] as const;
+type SslMode = (typeof VALID_SSL_MODES)[number];
+
+export interface ParsedPoolConfig {
+  endpoint?: string;
+  host: string;
+  database: string;
+  port: number;
+  sslMode: SslMode;
+  ssl?: pg.PoolConfig["ssl"];
+  max: number;
+  idleTimeoutMillis: number;
+  connectionTimeoutMillis: number;
+}
+
+/** Parse pool configuration from provided config and environment variables */
+export function parsePoolConfig(
+  userConfig?: Partial<LakebasePoolConfig>,
+): ParsedPoolConfig {
+  // Get endpoint (required only for OAuth auth)
+  const endpoint = userConfig?.endpoint ?? process.env.LAKEBASE_ENDPOINT;
+
+  // Only require endpoint if no password provided
+  if (!endpoint && !userConfig?.password) {
+    throw ConfigurationError.missingEnvVar(
+      "LAKEBASE_ENDPOINT or config.endpoint (or provide config.password for native auth)",
+    );
+  }
+
+  // Get host (required)
+  const host = userConfig?.host ?? process.env.PGHOST;
+  if (!host) {
+    throw ConfigurationError.missingEnvVar("PGHOST or config.host");
+  }
+
+  // Get database (required)
+  const database = userConfig?.database ?? process.env.PGDATABASE;
+  if (!database) {
+    throw ConfigurationError.missingEnvVar("PGDATABASE or config.database");
+  }
+
+  // Get port (optional, default from defaults)
+  const portStr = process.env.PGPORT;
+  const port =
+    userConfig?.port ??
+    (portStr ? Number.parseInt(portStr, 10) : defaults.port);
+
+  if (Number.isNaN(port)) {
+    throw ValidationError.invalidValue("port", portStr, "a number");
+  }
+
+  // Get SSL mode (optional, default from defaults)
+  const rawSslMode = userConfig?.sslMode ?? process.env.PGSSLMODE ?? undefined;
+
+  const sslMode = validateSslMode(rawSslMode) ?? defaults.sslMode;
+
+  // Pool options (with defaults)
+  const max = userConfig?.max ?? defaults.max;
+  const idleTimeoutMillis =
+    userConfig?.idleTimeoutMillis ?? defaults.idleTimeoutMillis;
+  const connectionTimeoutMillis =
+    userConfig?.connectionTimeoutMillis ?? defaults.connectionTimeoutMillis;
+
+  return {
+    endpoint,
+    host,
+    database,
+    port,
+    sslMode,
+    ssl: userConfig?.ssl,
+    max,
+    idleTimeoutMillis,
+    connectionTimeoutMillis,
+  };
+}
+
+/** Validate and return the SSL mode, or undefined when not set */
+function validateSslMode(value: string | undefined): SslMode | undefined {
+  if (value === undefined) {
+    return undefined;
+  }
+
+  if (!(VALID_SSL_MODES as readonly string[]).includes(value)) {
+    throw ValidationError.invalidValue(
+      "sslMode (PGSSLMODE)",
+      value,
+      `one of: ${VALID_SSL_MODES.join(", ")}`,
+    );
+  }
+
+  return value as SslMode;
+}
+
+/** Get workspace client from config or SDK default auth chain */
+export async function getWorkspaceClient(
+  config: Partial<LakebasePoolConfig>,
+): Promise<WorkspaceClient> {
+  // Priority 1: Explicit workspaceClient in config
+  if (config.workspaceClient) {
+    return config.workspaceClient;
+  }
+
+  // Priority 2: Create with SDK default auth chain
+  // Use empty config to let SDK use .databrickscfg, DATABRICKS_HOST, DATABRICKS_TOKEN, etc.
+  // NOTE: config.host is the PostgreSQL host (PGHOST), not the Databricks workspace host
+  return new WorkspaceClient({});
+}
+
+/** Get username synchronously from config or environment */
+export function getUsernameSync(config: Partial<LakebasePoolConfig>): string {
+  // Priority 1: Explicit user in config
+  if (config.user) {
+    return config.user;
+  }
+
+  // Priority 2: PGUSER environment variable
+  const pgUser = process.env.PGUSER;
+  if (pgUser) {
+    return pgUser;
+  }
+
+  // Priority 3: DATABRICKS_CLIENT_ID (service principal ID)
+  const clientId = process.env.DATABRICKS_CLIENT_ID;
+  if (clientId) {
+    return clientId;
+  }
+
+  throw ConfigurationError.missingEnvVar(
+    "PGUSER, DATABRICKS_CLIENT_ID, or config.user",
+  );
+}
diff --git a/packages/lakebase/src/credentials.ts b/packages/lakebase/src/credentials.ts
new file mode 100644
index 00000000..231b92a3
--- /dev/null
+++ b/packages/lakebase/src/credentials.ts
@@ -0,0 +1,95 @@
+import type { WorkspaceClient } from "@databricks/sdk-experimental";
+import { ValidationError } from "./errors";
+import type {
+  DatabaseCredential,
+  GenerateDatabaseCredentialRequest,
+} from "./types";
+
+/**
+ * Generate OAuth credentials for Postgres database connection using the proper Postgres API.
+ *
+ * This generates a time-limited OAuth token (expires after 1 hour) that can be used
+ * as a password when connecting to Lakebase Postgres databases.
+ *
+ * @param workspaceClient - Databricks workspace client for authentication
+ * @param request - Request parameters including endpoint path and optional UC claims
+ * @returns Database credentials with OAuth token and expiration time
+ *
+ * @see https://docs.databricks.com/aws/en/oltp/projects/authentication
+ *
+ * @example
+ * ```typescript
+ * // Use the `name` field from the Databricks CLI output:
+ * // `databricks postgres list-endpoints projects/{project-id}/branches/{branch-id}`
+ * const credential = await generateDatabaseCredential(workspaceClient, {
+ *   endpoint: "projects/{project-id}/branches/{branch-id}/endpoints/{endpoint-identifier}"
+ * });
+ *
+ * // Use credential.token as password
+ * const conn = await pg.connect({
+ *   host: "ep-abc123.database.us-east-1.databricks.com",
+ *   user: "user@example.com",
+ *   password: credential.token
+ * });
+ * ```
+ *
+ * @example With UC table permissions
+ * ```typescript
+ * // Use the `name` field from the Databricks CLI output:
+ * // `databricks postgres list-endpoints projects/{project-id}/branches/{branch-id}`
+ * const credential = await generateDatabaseCredential(workspaceClient, {
+ *   endpoint: "projects/{project-id}/branches/{branch-id}/endpoints/{endpoint-identifier}",
+ *   claims: [{
+ *     permission_set: RequestedClaimsPermissionSet.READ_ONLY,
+ *     resources: [{ table_name: "catalog.schema.users" }]
+ *   }]
+ * });
+ * ```
+ */
+export async function generateDatabaseCredential(
+  workspaceClient: WorkspaceClient,
+  request: GenerateDatabaseCredentialRequest,
+): Promise<DatabaseCredential> {
+  const apiPath = "/api/2.0/postgres/credentials";
+
+  const response = await workspaceClient.apiClient.request({
+    path: apiPath,
+    method: "POST",
+    headers: new Headers({
+      Accept: "application/json",
+      "Content-Type": "application/json",
+    }),
+    raw: false,
+    payload: request,
+  });
+
+  return validateCredentialResponse(response);
+}
+
+/** Validate the API response has the expected shape */
+function validateCredentialResponse(response: unknown): DatabaseCredential {
+  if (
+    typeof response !== "object" ||
+    response === null ||
+    !("token" in response) ||
+    !("expire_time" in response)
+  ) {
+    throw ValidationError.invalidValue(
+      "credential response",
+      response,
+      "an object with { token, expire_time }",
+    );
+  }
+
+  const { token, expire_time } = response as Record<string, unknown>;
+
+  if (typeof token !== "string" || typeof expire_time !== "string") {
+    throw ValidationError.invalidValue(
+      "credential response fields",
+      { tokenType: typeof token, expireTimeType: typeof expire_time },
+      "token and expire_time to be strings",
+    );
+  }
+
+  return { token, expire_time };
+}
diff --git a/packages/lakebase/src/errors.ts b/packages/lakebase/src/errors.ts
new file mode 100644
index 00000000..86c3ecc1
--- /dev/null
+++ b/packages/lakebase/src/errors.ts
@@ -0,0 +1,66 @@
+/**
+ * Base error class for Lakebase driver errors.
+ */
+export abstract class LakebaseError extends Error {
+  abstract readonly code: string;
+  readonly cause?: Error;
+  readonly context?: Record<string, unknown>;
+
+  constructor(
+    message: string,
+    options?: { cause?: Error; context?: Record<string, unknown> },
+  ) {
+    super(message);
+    this.name = this.constructor.name;
+    this.cause = options?.cause;
+    this.context = options?.context;
+
+    if (Error.captureStackTrace) {
+      Error.captureStackTrace(this, this.constructor);
+    }
+  }
+}
+
+/**
+ * Error thrown when configuration is missing or invalid.
+ */
+export class ConfigurationError extends LakebaseError {
+  readonly code = "CONFIGURATION_ERROR";
+
+  /**
+   * Create a configuration error for missing environment variable
+   */
+  static missingEnvVar(varName: string): ConfigurationError {
+    return new ConfigurationError(
+      `${varName} environment variable is required`,
+      { context: { envVar: varName } },
+    );
+  }
+}
+
+/**
+ * Error thrown when input validation fails.
+ */
+export class ValidationError extends LakebaseError {
+  readonly code = "VALIDATION_ERROR";
+
+  /**
+   * Create a validation error for an invalid field value
+   */
+  static invalidValue(
+    fieldName: string,
+    value: unknown,
+    expected?: string,
+  ): ValidationError {
+    const msg = expected
+      ? `Invalid value for ${fieldName}: expected ${expected}`
+      : `Invalid value for ${fieldName}`;
+    return new ValidationError(msg, {
+      context: {
+        field: fieldName,
+        valueType: value === null ? "null" : typeof value,
+        expected,
+      },
+    });
+  }
+}
diff --git a/packages/lakebase/src/index.ts b/packages/lakebase/src/index.ts
new file mode 100644
index 00000000..b3c5a288
--- /dev/null
+++ b/packages/lakebase/src/index.ts
@@ -0,0 +1,20 @@
+export { getWorkspaceClient } from "./config";
+export { generateDatabaseCredential } from "./credentials";
+export { createLakebasePool } from "./pool";
+export {
+  getLakebaseOrmConfig,
+  getLakebasePgConfig,
+} from "./pool-config";
+export type { DriverTelemetry } from "./telemetry";
+export type { TokenRefreshDeps } from "./token-refresh";
+export { createTokenRefreshCallback } from "./token-refresh";
+export type {
+  DatabaseCredential,
+  GenerateDatabaseCredentialRequest,
+  LakebasePoolConfig,
+  Logger,
+  LoggerConfig,
+  RequestedClaims,
+  RequestedResource,
+} from "./types";
+export { RequestedClaimsPermissionSet } from "./types";
diff --git a/packages/lakebase/src/logger.ts b/packages/lakebase/src/logger.ts
new file mode 100644
index 00000000..0e1ca271
--- /dev/null
+++ b/packages/lakebase/src/logger.ts
@@ -0,0 +1,54 @@
+import type { Logger, LoggerConfig } from "./types";
+
+const LOGGER_METHODS = ["debug", "info", "warn", "error"] as const;
+
+/**
+ * Check if the provided value is a Logger instance
+ */
+function isLogger(value: unknown): value is Logger {
+  if (typeof value !== "object" || value === null) {
+    return false;
+  }
+
+  return LOGGER_METHODS.every(
+    (method) =>
+      method in value &&
+      typeof (value as Record<string, unknown>)[method] === "function",
+  );
+}
+
+/**
+ * Create a console-based logger from configuration
+ */
+function createConsoleLogger(config: LoggerConfig): Logger {
+  const noop = () => {};
+
+  return {
+    debug: config.debug ? console.debug.bind(console) : noop,
+    info: config.info ? console.info.bind(console) : noop,
+    warn: config.warn ? console.warn.bind(console) : noop,
+    error: config.error ? console.error.bind(console) : noop,
+  };
+}
+
+/**
+ * Resolve logger configuration to a Logger instance
+ *
+ * - If Logger instance provided, return as-is
+ * - If LoggerConfig provided, create console-based logger
+ * - If undefined, create error-only logger (default)
+ */
+export function resolveLogger(loggerConfig?: Logger | LoggerConfig): Logger {
+  // Already a Logger instance - use as-is
+  if (isLogger(loggerConfig)) {
+    return loggerConfig;
+  }
+
+  // LoggerConfig provided - create console logger
+  if (loggerConfig && typeof loggerConfig === "object") {
+    return createConsoleLogger(loggerConfig);
+  }
+
+  // Default: error-only logging
+  return createConsoleLogger({ error: true });
+}
diff --git a/packages/lakebase/src/pool-config.ts b/packages/lakebase/src/pool-config.ts
new file mode 100644
index 00000000..bba4d663
--- /dev/null
+++ b/packages/lakebase/src/pool-config.ts
@@ -0,0 +1,128 @@
+import type pg from "pg";
+import { getUsernameSync, parsePoolConfig } from "./config";
+import { type DriverTelemetry, initTelemetry } from "./telemetry";
+import { createTokenRefreshCallback } from "./token-refresh";
+import type { LakebasePoolConfig, Logger } from "./types";
+
+/**
+ * Map an SSL mode string to the corresponding `pg` SSL configuration.
+ *
+ * - `"require"` -- SSL enabled with certificate verification
+ * - `"prefer"`  -- SSL enabled without certificate verification (try SSL, accept any cert)
+ * - `"disable"` -- SSL disabled
+ */
+function mapSslConfig(
+  sslMode: "require" | "prefer" | "disable",
+): pg.PoolConfig["ssl"] {
+  switch (sslMode) {
+    case "require":
+      return { rejectUnauthorized: true };
+    case "prefer":
+      return { rejectUnauthorized: false };
+    case "disable":
+      return false;
+  }
+}
+
+/**
+ * Get Lakebase connection configuration for PostgreSQL clients.
+ *
+ * Returns pg.PoolConfig with OAuth token authentication configured.
+ * Best used with pg.Pool directly or ORMs that accept pg.Pool instances (like Drizzle).
+ *
+ * For ORMs that need connection parameters (TypeORM, Sequelize), use getLakebaseOrmConfig() instead.
+ *
+ * Used internally by createLakebasePool().
+ *
+ * @param config - Optional configuration (reads from environment if not provided)
+ * @param telemetry - Optional pre-initialized telemetry (created internally if not provided)
+ * @param logger - Optional logger (silent if not provided)
+ * @returns PostgreSQL pool configuration with OAuth token refresh
+ */
+export function getLakebasePgConfig(
+  config?: Partial<LakebasePoolConfig>,
+  telemetry?: DriverTelemetry,
+  logger?: Logger,
+): pg.PoolConfig {
+  const userConfig = config ?? {};
+  const poolConfig = parsePoolConfig(userConfig);
+  const username = getUsernameSync(userConfig);
+
+  let passwordConfig: string | (() => string | Promise<string>) | undefined;
+
+  if (userConfig.password !== undefined) {
+    passwordConfig = userConfig.password;
+  } else if (poolConfig.endpoint) {
+    // endpoint is guaranteed here -- parsePoolConfig() throws if
+    // neither endpoint nor password is provided
+    passwordConfig = createTokenRefreshCallback({
+      userConfig,
+      endpoint: poolConfig.endpoint,
+      telemetry: telemetry ?? initTelemetry(),
+      logger,
+    });
+  }
+
+  return {
+    host: poolConfig.host,
+    port: poolConfig.port,
+    user: username,
+    database: poolConfig.database,
+    password: passwordConfig,
+    ssl: poolConfig.ssl ?? mapSslConfig(poolConfig.sslMode),
+    max: poolConfig.max,
+    idleTimeoutMillis: poolConfig.idleTimeoutMillis,
+    connectionTimeoutMillis: poolConfig.connectionTimeoutMillis,
+  };
+}
+
+/**
+ * Get Lakebase connection configuration for ORMs that don't accept pg.Pool directly.
+ *
+ * Designed for ORMs like TypeORM and Sequelize that need connection parameters
+ * rather than a pre-configured pool instance.
+ *
+ * Returns connection config with field names compatible with common ORMs:
+ * - `username` instead of `user`
+ * - Simplified SSL config
+ * - Password callback support for OAuth token refresh
+ *
+ * @param config - Optional configuration (reads from environment if not provided)
+ * @returns ORM-compatible connection configuration
+ *
+ * @example
+ * ```typescript
+ * // TypeORM
+ * const dataSource = new DataSource({
+ *   type: 'postgres',
+ *   ...getLakebaseOrmConfig(),
+ *   entities: [User],
+ *   synchronize: true,
+ * });
+ *
+ * // Sequelize
+ * const sequelize = new Sequelize({
+ *   dialect: 'postgres',
+ *   ...getLakebaseOrmConfig(),
+ *   logging: false,
+ * });
+ * ```
+ */
+export function getLakebaseOrmConfig(config?: Partial<LakebasePoolConfig>) {
+  const { user, password, ssl, ...pgConfig } = getLakebasePgConfig(config);
+
+  return {
+    ...pgConfig,
+    username: user,
+    password: password as
+      | string
+      | (() => string)
+      | (() => Promise<string>)
+      | undefined,
+    ssl: ssl
+      ? typeof ssl === "boolean"
+        ? ssl
+        : { rejectUnauthorized: ssl.rejectUnauthorized }
+      : false,
+  };
+}
diff --git a/packages/lakebase/src/pool.ts b/packages/lakebase/src/pool.ts
new file mode 100644
index 00000000..1ca6c254
--- /dev/null
+++ b/packages/lakebase/src/pool.ts
@@ -0,0 +1,142 @@
+import pg from "pg";
+import { resolveLogger } from "./logger";
+import { getLakebasePgConfig } from "./pool-config";
+import {
+  attachPoolMetrics,
+  initTelemetry,
+  SpanKind,
+  SpanStatusCode,
+} from "./telemetry";
+import type { LakebasePoolConfig } from "./types";
+
+/**
+ * Create a PostgreSQL connection pool with automatic OAuth token refresh for Lakebase.
+ *
+ * This function returns a standard `pg.Pool` instance configured with a password callback
+ * that automatically fetches and caches OAuth tokens from Databricks. The returned pool
+ * works with any ORM or library that accepts a `pg.Pool` (Drizzle, Prisma, TypeORM, etc.).
+ *
+ * @param config - Configuration options (optional, reads from environment if not provided)
+ * @returns Standard pg.Pool instance with OAuth token refresh
+ *
+ * @see https://docs.databricks.com/aws/en/oltp/projects/authentication
+ *
+ * @example Using environment variables
+ * ```typescript
+ * // Set: PGHOST, PGDATABASE, LAKEBASE_ENDPOINT
+ * const pool = createLakebasePool();
+ * const result = await pool.query('SELECT * FROM users');
+ * ```
+ *
+ * @example With explicit configuration
+ * ```typescript
+ * // Use the `name` field from the Databricks CLI output:
+ * // `databricks postgres list-endpoints projects/{project-id}/branches/{branch-id}`
+ * const pool = createLakebasePool({
+ *   endpoint: 'projects/{project-id}/branches/{branch-id}/endpoints/{endpoint-identifier}',
+ *   host: 'ep-abc.databricks.com',
+ *   database: 'databricks_postgres',
+ *   user: 'service-principal-id'
+ * });
+ * ```
+ *
+ * @example With Drizzle ORM
+ * ```typescript
+ * import { drizzle } from 'drizzle-orm/node-postgres';
+ * const pool = createLakebasePool();
+ * const db = drizzle({ client: pool });
+ * ```
+ *
+ * @example With Prisma
+ * ```typescript
+ * import { PrismaPg } from '@prisma/adapter-pg';
+ * const pool = createLakebasePool();
+ * const adapter = new PrismaPg(pool);
+ * const prisma = new PrismaClient({ adapter });
+ * ```
+ */
+export function createLakebasePool(
+  config?: Partial<LakebasePoolConfig>,
+): pg.Pool {
+  const userConfig = config ?? {};
+  const logger = resolveLogger(userConfig.logger);
+
+  const telemetry = initTelemetry();
+
+  const poolConfig = getLakebasePgConfig(userConfig, telemetry, logger);
+
+  const pool = new pg.Pool(poolConfig);
+
+  attachPoolMetrics(pool, telemetry, logger);
+
+  // Wrap pool.query to track query duration and create trace spans.
+  // pg.Pool.query has 15+ overloads that are difficult to type-preserve,
+  // so we use a loosely-typed wrapper and cast back.
+  const origQuery = pool.query.bind(pool);
+  const tracer = telemetry.tracer;
+  pool.query = function queryWithTelemetry(
+    ...args: unknown[]
+  ): ReturnType<typeof pool.query> {
+    const firstArg = args[0];
+    const sql =
+      typeof firstArg === "string"
+        ? firstArg
+        : (firstArg as { text?: string } | undefined)?.text;
+    const metricAttrs = {
+      "db.statement": sql ? sql.substring(0, 100) : "unknown",
+    };
+
+    return tracer.startActiveSpan(
+      "lakebase.query",
+      {
+        kind: SpanKind.CLIENT,
+        attributes: {
+          "db.system": "lakebase",
+          "db.statement": sql ? sql.substring(0, 500) : "unknown",
+        },
+      },
+      (span) => {
+        const start = Date.now();
+
+        const result = (
+          origQuery as (...a: unknown[]) => Promise<unknown> | undefined
+        )(...args);
+
+        // Promise-based query: record duration and end span on completion
+        if (result && typeof result.then === "function") {
+          return (result as Promise<{ rowCount?: number | null }>)
+            .then(
+              (res) => {
+                span.setAttribute("db.rows_affected", res?.rowCount ?? 0);
+                span.setStatus({ code: SpanStatusCode.OK });
+                return res;
+              },
+              (err: Error) => {
+                span.recordException(err);
+                span.setStatus({ code: SpanStatusCode.ERROR });
+                throw err;
+              },
+            )
+            .finally(() => {
+              telemetry.queryDuration.record(Date.now() - start, metricAttrs);
+              span.end();
+            }) as unknown as ReturnType<typeof pool.query>;
+        }
+
+        // Callback-based query (void return): duration is approximate
+        telemetry.queryDuration.record(Date.now() - start, metricAttrs);
+        span.end();
+        return result as ReturnType<typeof pool.query>;
+      },
+    ) as ReturnType<typeof pool.query>;
+  } as typeof pool.query;
+
+  logger?.debug(
+    "Created Lakebase connection pool for %s@%s/%s",
+    poolConfig.user,
+    poolConfig.host,
+    poolConfig.database,
+  );
+
+  return pool;
+}
diff --git a/packages/lakebase/src/telemetry.ts b/packages/lakebase/src/telemetry.ts
new file mode 100644
index 00000000..3a903bb0
--- /dev/null
+++ b/packages/lakebase/src/telemetry.ts
@@ -0,0 +1,96 @@
+import type { Counter, Histogram, Meter } from "@opentelemetry/api";
+import {
+  metrics,
+  SpanKind,
+  SpanStatusCode,
+  type Tracer,
+  trace,
+} from "@opentelemetry/api";
+import type pg from "pg";
+import type { Logger } from "./types";
+
+export { SpanKind, SpanStatusCode };
+export type { Tracer };
+
+/** Telemetry instruments for the driver */
+export interface DriverTelemetry {
+  tracer: Tracer;
+  meter: Meter;
+  tokenRefreshDuration: Histogram;
+  queryDuration: Histogram;
+  poolErrors: Counter;
+}
+
+/**
+ * Initialize telemetry using OpenTelemetry's global registry.
+ * If Otel providers are not initialized, operations will be no-ops automatically.
+ */
+export function initTelemetry(): DriverTelemetry {
+  const tracer = trace.getTracer("@databricks/lakebase");
+  const meter = metrics.getMeter("@databricks/lakebase");
+
+  return {
+    tracer,
+    meter,
+    tokenRefreshDuration: meter.createHistogram(
+      "lakebase.token.refresh.duration",
+      {
+        description: "Duration of OAuth token refresh operations",
+        unit: "ms",
+      },
+    ),
+    queryDuration: meter.createHistogram("lakebase.query.duration", {
+      description: "Duration of queries executed via pool.query",
+      unit: "ms",
+    }),
+    poolErrors: meter.createCounter("lakebase.pool.errors", {
+      description: "Connection pool errors by error code",
+      unit: "1",
+    }),
+  };
+}
+
+/**
+ * Attach pool-level metrics collection, error counting, and error logging.
+ *
+ * Uses observable gauges (pull model) for pool connection stats.
+ *
+ * @param pool - PostgreSQL connection pool
+ * @param telemetry - Telemetry instruments
+ * @param logger - Optional logger for error logging (silent if not provided)
+ */
+export function attachPoolMetrics(
+  pool: pg.Pool,
+  telemetry: DriverTelemetry,
+  logger?: Logger,
+): void {
+  const meter = telemetry.meter;
+
+  const poolTotal = meter.createObservableGauge(
+    "lakebase.pool.connections.total",
+    { description: "Total connections in the pool" },
+  );
+  const poolIdle = meter.createObservableGauge(
+    "lakebase.pool.connections.idle",
+    { description: "Idle connections in the pool" },
+  );
+  const poolWaiting = meter.createObservableGauge(
+    "lakebase.pool.connections.waiting",
+    { description: "Clients waiting for a connection" },
+  );
+
+  poolTotal.addCallback((result) => result.observe(pool.totalCount));
+  poolIdle.addCallback((result) => result.observe(pool.idleCount));
+  poolWaiting.addCallback((result) => result.observe(pool.waitingCount));
+
+  pool.on("error", (error: Error & { code?: string }) => {
+    logger?.error(
+      "Connection pool error: %s (code: %s)",
+      error.message,
+      error.code,
+    );
+    telemetry.poolErrors.add(1, {
+      "error.code": error.code ?? "unknown",
+    });
+  });
+}
diff --git a/packages/lakebase/src/token-refresh.ts b/packages/lakebase/src/token-refresh.ts
new file mode 100644
index 00000000..d22bc7d4
--- /dev/null
+++ b/packages/lakebase/src/token-refresh.ts
@@ -0,0 +1,115 @@
+import type { WorkspaceClient } from "@databricks/sdk-experimental";
+import { getWorkspaceClient } from "./config";
+import { generateDatabaseCredential } from "./credentials";
+import { type DriverTelemetry, SpanStatusCode } from "./telemetry";
+import type { LakebasePoolConfig, Logger } from "./types";
+
+// 2-minute buffer before token expiration to prevent race conditions
+// Lakebase tokens expire after 1 hour, so we refresh when ~58 minutes remain
+const CACHE_BUFFER_MS = 2 * 60 * 1000;
+
+export interface TokenRefreshDeps {
+  userConfig: Partial<LakebasePoolConfig>;
+  endpoint: string;
+  telemetry: DriverTelemetry;
+  logger?: Logger;
+}
+
+/** Fetch a fresh OAuth token from Databricks */
+async function refreshToken(
+  workspaceClient: WorkspaceClient,
+  endpoint: string,
+): Promise<{ token: string; expiresAt: number }> {
+  const credential = await generateDatabaseCredential(workspaceClient, {
+    endpoint,
+  });
+
+  return {
+    token: credential.token,
+    expiresAt: new Date(credential.expire_time).getTime(),
+  };
+}
+
+/**
+ * Build the password callback with token caching, deduplication, and telemetry.
+ *
+ * The returned async function is called by `pg.Pool` each time a new connection
+ * is established. It caches OAuth tokens and deduplicates concurrent refresh
+ * requests so only one API call is made even under parallel connection creation.
+ */
+export function createTokenRefreshCallback(
+  deps: TokenRefreshDeps,
+): () => Promise<string> {
+  let cachedToken: string | undefined;
+  let tokenExpiresAt = 0;
+  let workspaceClient: WorkspaceClient | null = null;
+  let refreshPromise: Promise<string> | null = null;
+
+  return async (): Promise<string> => {
+    // Lazily initialize workspace client on first password fetch
+    if (!workspaceClient) {
+      try {
+        workspaceClient = await getWorkspaceClient(deps.userConfig);
+      } catch (error) {
+        deps.logger?.error("Failed to initialize workspace client: %O", error);
+        throw error;
+      }
+    }
+
+    const now = Date.now();
+    const hasValidToken = cachedToken && now < tokenExpiresAt - CACHE_BUFFER_MS;
+    if (hasValidToken) {
+      // Return cached token if still valid (with buffer)
+      const expiresIn = Math.round((tokenExpiresAt - now) / 1000 / 60);
+      deps.logger?.debug(
+        "Using cached OAuth token (expires in %d minutes at %s)",
+        expiresIn,
+        new Date(tokenExpiresAt).toISOString(),
+      );
+      return cachedToken as string;
+    }
+
+    const client = workspaceClient;
+
+    // Deduplicate concurrent refresh requests
+    if (!refreshPromise) {
+      refreshPromise = (async () => {
+        const startTime = Date.now();
+        try {
+          const result = await deps.telemetry.tracer.startActiveSpan(
+            "lakebase.token.refresh",
+            {
+              attributes: { "lakebase.endpoint": deps.endpoint },
+            },
+            async (span) => {
+              const tokenResult = await refreshToken(client, deps.endpoint);
+              span.setAttribute(
+                "lakebase.token.expires_at",
+                new Date(tokenResult.expiresAt).toISOString(),
+              );
+              span.setStatus({ code: SpanStatusCode.OK });
+              span.end();
+              return tokenResult;
+            },
+          );
+
+          cachedToken = result.token;
+          tokenExpiresAt = result.expiresAt;
+          return cachedToken;
+        } catch (error) {
+          deps.logger?.error("Failed to fetch OAuth token: %O", {
+            error,
+            message: error instanceof Error ? error.message : String(error),
+            endpoint: deps.endpoint,
+          });
+          throw error;
+        } finally {
+          deps.telemetry.tokenRefreshDuration.record(Date.now() - startTime);
+          refreshPromise = null;
+        }
+      })();
+    }
+
+    return refreshPromise;
+  };
+}
diff --git a/packages/lakebase/src/types.ts b/packages/lakebase/src/types.ts
new file mode 100644
index 00000000..18e51e15
--- /dev/null
+++ b/packages/lakebase/src/types.ts
@@ -0,0 +1,211 @@
+import type { WorkspaceClient } from "@databricks/sdk-experimental";
+import type { PoolConfig } from "pg";
+
+/**
+ * Optional logger interface for the Lakebase driver.
+ * When not provided, the driver operates silently (no logging).
+ */
+export interface Logger {
+  debug(message: string, ...args: unknown[]): void;
+  info(message: string, ...args: unknown[]): void;
+  warn(message: string, ...args: unknown[]): void;
+  error(message: string, ...args: unknown[]): void;
+}
+
+/**
+ * Configuration for console-based logger.
+ * Specify which log levels should be enabled.
+ */
+export interface LoggerConfig {
+  /** Enable debug level logging */
+  debug?: boolean;
+  /** Enable info level logging */
+  info?: boolean;
+  /** Enable warning level logging */
+  warn?: boolean;
+  /** Enable error level logging */
+  error?: boolean;
+}
+
+/**
+ * Telemetry configuration options
+ */
+export type TelemetryOptions =
+  | boolean
+  | {
+      traces?: boolean;
+      metrics?: boolean;
+    };
+
+/**
+ * Configuration for creating a Lakebase connection pool
+ *
+ * Supports two authentication methods:
+ * 1. OAuth token authentication - Provide workspaceClient + endpoint (automatic token rotation)
+ * 2. Native Postgres password authentication - Provide password string or function
+ *
+ * Extends pg.PoolConfig to support all standard PostgreSQL pool options.
+ *
+ * @see https://docs.databricks.com/aws/en/oltp/projects/authentication
+ */
+export interface LakebasePoolConfig extends PoolConfig {
+  /**
+   * Databricks workspace client for OAuth authentication
+   * If not provided along with endpoint, will attempt to use ServiceContext
+   *
+   * Note: If password is provided, OAuth auth is not used
+   */
+  workspaceClient?: WorkspaceClient;
+
+  /**
+   * Endpoint resource path for OAuth token generation.
+   *
+   * Retrieve the value using the Databricks CLI:
+   * ```
+   * databricks postgres list-endpoints projects/{project-id}/branches/{branch-id}
+   * ```
+   * Use the `name` field from the output.
+   *
+   * Required for OAuth authentication (unless password is provided)
+   * Can also be set via LAKEBASE_ENDPOINT environment variable
+   *
+   * @example "projects/{project-id}/branches/{branch-id}/endpoints/{endpoint-identifier}"
+   */
+  endpoint?: string;
+
+  /**
+   * SSL mode for the connection (convenience helper)
+   * Can also be set via PGSSLMODE environment variable
+   *
+   * @default "require"
+   */
+  sslMode?: "require" | "disable" | "prefer";
+
+  /**
+   * Telemetry configuration
+   *
+   * - `true` or omitted: enable all telemetry (traces, metrics) -- no-op when OTEL is not configured
+   * - `false`: disable all telemetry
+   * - `{ traces?, metrics? }`: fine-grained control
+   */
+  telemetry?: TelemetryOptions;
+
+  /**
+   * Optional logger configuration.
+   *
+   * Supports three modes:
+   * 1. Logger instance - Use your own logger implementation
+   * 2. LoggerConfig - Enable/disable specific log levels (uses console)
+   * 3. Undefined - Defaults to error logging only
+   *
+   * @example Using custom logger
+   * ```typescript
+   * import { createLogger } from '@databricks/appkit';
+   * const pool = createLakebasePool({
+   *   logger: createLogger('connectors:lakebase')
+   * });
+   * ```
+   *
+   * @example Using config-based logger
+   * ```typescript
+   * const pool = createLakebasePool({
+   *   logger: { debug: true, info: true, error: true }
+   * });
+   * ```
+   */
+  logger?: Logger | LoggerConfig;
+}
+
+// ---------------------------------------------------------------------------
+// Authentication types for Lakebase Postgres OAuth token generation
+// @see https://docs.databricks.com/aws/en/oltp/projects/authentication
+// ---------------------------------------------------------------------------
+
+/**
+ * Database credentials with OAuth token for Postgres connection
+ */
+export interface DatabaseCredential {
+  /** OAuth token to use as the password when connecting to Postgres */
+  token: string;
+
+  /**
+   * Token expiration time in UTC (ISO 8601 format)
+   * Tokens expire after 1 hour from generation
+   * @example "2026-02-06T17:07:00Z"
+   */
+  expire_time: string;
+}
+
+/**
+ * Permission set for Unity Catalog table access
+ */
+export enum RequestedClaimsPermissionSet {
+  /**
+   * Read-only access to specified UC tables
+   */
+  READ_ONLY = "READ_ONLY",
+}
+
+/**
+ * Resource to request permissions for in Unity Catalog
+ */
+export interface RequestedResource {
+  /**
+   * Unity Catalog table name to request access to
+   * @example "catalog.schema.table"
+   */
+  table_name?: string;
+
+  /**
+   * Generic resource name for non-table resources
+   */
+  unspecified_resource_name?: string;
+}
+
+/**
+ * Optional claims for fine-grained Unity Catalog table permissions
+ * When specified, the returned token will be scoped to only the requested tables
+ */
+export interface RequestedClaims {
+  /**
+   * Permission level to request
+   */
+  permission_set?: RequestedClaimsPermissionSet;
+
+  /**
+   * List of UC resources to request access to
+   */
+  resources?: RequestedResource[];
+}
+
+/**
+ * Request parameters for generating database OAuth credentials
+ */
+export interface GenerateDatabaseCredentialRequest {
+  /**
+   * Endpoint resource path. Retrieve using the Databricks CLI:
+   * ```
+   * databricks postgres list-endpoints projects/{project-id}/branches/{branch-id}
+   * ```
+   * Use the `name` field from the output.
+   *
+   * @example "projects/{project-id}/branches/{branch-id}/endpoints/{endpoint-identifier}"
+   */
+  endpoint: string;
+
+  /**
+   * Optional claims for fine-grained UC table permissions.
+   * When specified, the token will only grant access to the specified tables.
+   *
+   * @example
+   * ```typescript
+   * {
+   *   claims: [{
+   *     permission_set: RequestedClaimsPermissionSet.READ_ONLY,
+   *     resources: [{ table_name: "catalog.schema.users" }]
+   *   }]
+   * }
+   * ```
+   */
+  claims?: RequestedClaims[];
+}
diff --git a/packages/lakebase/tsconfig.json b/packages/lakebase/tsconfig.json
new file mode 100644
index 00000000..4a6e68b3
--- /dev/null
+++ b/packages/lakebase/tsconfig.json
@@ -0,0 +1,12 @@
+{
+  "extends": "../../tsconfig.json",
+  "compilerOptions": {
+    "outDir": "dist",
+    "baseUrl": ".",
+    "paths": {
+      "@/*": ["src/*"]
+    }
+  },
+  "include": ["src/**/*"],
+  "exclude": ["node_modules", "dist"]
+}
diff --git a/packages/lakebase/tsdown.config.ts b/packages/lakebase/tsdown.config.ts
new file mode 100644
index 00000000..293e2fc3
--- /dev/null
+++ b/packages/lakebase/tsdown.config.ts
@@ -0,0 +1,28 @@
+import { defineConfig } from "tsdown";
+
+export default defineConfig([
+  {
+    publint: true,
+    name: "@databricks/lakebase",
+    entry: "src/index.ts",
+    outDir: "dist",
+    hash: false,
+    format: "esm",
+    platform: "node",
+    minify: false,
+    dts: {
+      resolve: true,
+    },
+    sourcemap: false,
+    clean: false,
+    unbundle: true,
+    noExternal: [],
+    external: (id) => {
+      // Bundle all internal modules
+      if (id.startsWith("@/")) return false;
+      // Externalize all npm packages
+      return /^[^./]/.test(id) || id.includes("/node_modules/");
+    },
+    tsconfig: "./tsconfig.json",
+  },
+]);
diff --git a/packages/shared/src/cli/commands/generate-types.ts b/packages/shared/src/cli/commands/generate-types.ts
index 688a3d29..06c8b016 100644
--- a/packages/shared/src/cli/commands/generate-types.ts
+++ b/packages/shared/src/cli/commands/generate-types.ts
@@ -12,6 +12,13 @@ async function runGenerateTypes(
   options?: { noCache?: boolean },
 ) {
   try {
+    const resolvedWarehouseId =
+      warehouseId || process.env.DATABRICKS_WAREHOUSE_ID;
+
+    if (!resolvedWarehouseId) {
+      process.exit(0);
+    }
+
     // Try to import the type generator from @databricks/appkit
     const { generateFromEntryPoint } = await import(
       "@databricks/appkit/type-generator"
@@ -29,15 +36,6 @@ async function runGenerateTypes(
       return;
     }
 
-    const resolvedWarehouseId =
-      warehouseId || process.env.DATABRICKS_WAREHOUSE_ID;
-    if (!resolvedWarehouseId) {
-      console.error(
-        "Error: DATABRICKS_WAREHOUSE_ID is not set. Please provide it as an argument or environment variable.",
-      );
-      process.exit(1);
-    }
-
     await generateFromEntryPoint({
       queryFolder,
       outFile: resolvedOutFile,
diff --git a/packages/shared/src/plugin.ts b/packages/shared/src/plugin.ts
index 54d8f583..6de7b06d 100644
--- a/packages/shared/src/plugin.ts
+++ b/packages/shared/src/plugin.ts
@@ -13,6 +13,8 @@ export interface BasePlugin {
 
   getEndpoints(): PluginEndpointMap;
 
+  getSkipBodyParsingPaths?(): ReadonlySet<string>;
+
   exports?(): unknown;
 }
 
@@ -203,6 +205,8 @@ export type RouteConfig = {
   method: HttpMethod;
   path: string;
   handler: (req: IAppRequest, res: IAppResponse) => Promise<void>;
+  /** When true, the server will skip JSON body parsing for this route (e.g. file uploads). */
+  skipBodyParsing?: boolean;
 };
 
 /** Map of endpoint names to their full paths for a plugin */
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 4b598b89..fe235136 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -48,8 +48,8 @@ importers:
         specifier: ^15.5.1
         version: 15.5.2
       pg:
-        specifier: ^8.16.3
-        version: 8.16.3
+        specifier: ^8.18.0
+        version: 8.18.0
       plop:
         specifier: ^4.0.4
         version: 4.0.4(@types/node@24.7.2)
@@ -132,6 +132,18 @@ importers:
       '@databricks/appkit':
         specifier: workspace:*
         version: link:../../packages/appkit
+      drizzle-orm:
+        specifier: ^0.45.1
+        version: 0.45.1(@opentelemetry/api@1.9.0)(@types/pg@8.16.0)(pg@8.18.0)
+      reflect-metadata:
+        specifier: ^0.2.0
+        version: 0.2.2
+      sequelize:
+        specifier: ^6.37.7
+        version: 6.37.7(pg@8.18.0)
+      typeorm:
+        specifier: ^0.3.20
+        version: 0.3.28(pg@8.18.0)
       zod:
         specifier: ^4.1.13
         version: 4.1.13
@@ -236,9 +248,12 @@ importers:
 
   packages/appkit:
     dependencies:
+      '@databricks/lakebase':
+        specifier: workspace:*
+        version: link:../lakebase
       '@databricks/sdk-experimental':
-        specifier: ^0.15.0
-        version: 0.15.0
+        specifier: ^0.16.0
+        version: 0.16.0
       '@opentelemetry/api':
         specifier: ^1.9.0
         version: 1.9.0
@@ -294,8 +309,8 @@ importers:
         specifier: ^2.1.1
         version: 2.1.1
       pg:
-        specifier: ^8.16.3
-        version: 8.16.3
+        specifier: ^8.18.0
+        version: 8.18.0
       semver:
         specifier: ^7.7.3
         version: 7.7.3
@@ -319,8 +334,8 @@ importers:
         specifier: ^7.0.15
         version: 7.0.15
       '@types/pg':
-        specifier: ^8.15.6
-        version: 8.15.6
+        specifier: ^8.16.0
+        version: 8.16.0
       '@types/ws':
         specifier: ^8.18.1
         version: 8.18.1
@@ -494,6 +509,22 @@ importers:
         specifier: ^1.4.0
         version: 1.4.0
 
+  packages/lakebase:
+    dependencies:
+      '@databricks/sdk-experimental':
+        specifier: ^0.16.0
+        version: 0.16.0
+      '@opentelemetry/api':
+        specifier: ^1.9.0
+        version: 1.9.0
+      pg:
+        specifier: ^8.18.0
+        version: 8.18.0
+    devDependencies:
+      '@types/pg':
+        specifier: ^8.16.0
+        version: 8.16.0
+
   packages/shared:
     dependencies:
       '@ast-grep/napi':
@@ -1761,8 +1792,8 @@ packages:
     peerDependencies:
       postcss: ^8.4
 
-  '@databricks/sdk-experimental@0.15.0':
-    resolution: {integrity: sha512-HkoMiF7dNDt6WRW0xhi7oPlBJQfxJ9suJhEZRFt08VwLMaWcw2PiF8monfHlkD4lkufEYV6CTxi5njQkciqiHA==}
+  '@databricks/sdk-experimental@0.16.0':
+    resolution: {integrity: sha512-9c2RxWYoRDFupdt4ZnBc1IPE1XaXgN+/wyV4DVcEqOnIa31ep51OnwAD/3014BImfKdyXg32nmgrB9dwvB6+lg==}
     engines: {node: '>=22.0', npm: '>=10.0.0'}
 
   '@date-fns/tz@1.4.1':
@@ -4088,6 +4119,9 @@ packages:
   '@slorber/remark-comment@1.0.0':
     resolution: {integrity: sha512-RCE24n7jsOj1M0UPvIQCHTe7fI0sFL4S2nwKVWwHyVr/wI/H8GosgsJGyhnsZoGFnD/P2hLf1mSbrrgSLN93NA==}
 
+  '@sqltools/formatter@1.2.5':
+    resolution: {integrity: sha512-Uy0+khmZqUrUGm5dmMqVlnvufZRSK0FbYzVgp0UMstm+F5+W2/jnEEQyc9vo1ZR/E5ZI/B1WjjoTqBqwJL6Krw==}
+
   '@standard-schema/spec@1.1.0':
     resolution: {integrity: sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w==}
 
@@ -4588,6 +4622,9 @@ packages:
   '@types/pg@8.15.6':
     resolution: {integrity: sha512-NoaMtzhxOrubeL/7UZuNTrejB4MPAJ0RpxZqXQf2qXuVlTPuG6Y8p4u9dKRaue4yjmC7ZhzVO2/Yyyn25znrPQ==}
 
+  '@types/pg@8.16.0':
+    resolution: {integrity: sha512-RmhMd/wD+CF8Dfo+cVIy3RR5cl8CyfXQ0tGgW6XBL8L4LM/UTEbNXYRbLwU6w+CgrKBNbrQWt4FUtTfaU5jSYQ==}
+
   '@types/picomatch@4.0.2':
     resolution: {integrity: sha512-qHHxQ+P9PysNEGbALT8f8YOSHW0KJu6l2xU8DYY0fu/EmGxXdVnuTLvFUvBgPJMSqXq29SYHveejeAha+4AYgA==}
 
@@ -4673,6 +4710,9 @@ packages:
   '@types/unist@3.0.3':
     resolution: {integrity: sha512-ko/gIFJRv177XgZsZcBwnqJN5x/Gien8qNOn0D5bQU/zAzVf9Zt3BlcUiLqhV9y4ARk0GbT3tnUiPNgnTXzc/Q==}
 
+  '@types/validator@13.15.10':
+    resolution: {integrity: sha512-T8L6i7wCuyoK8A/ZeLYt1+q0ty3Zb9+qbSSvrIVitzT3YjZqkTZ40IbRsPanlB4h1QB3JVL1SYCdR6ngtFYcuA==}
+
   '@types/ws@8.18.1':
     resolution: {integrity: sha512-ThVF6DCVhA8kUGy+aazFQ4kXQ7E1Ty7A3ypFOe0IcJV8O/M511G99AW24irKrW56Wt44yG9+ij8FaqoBGkuBXg==}
 
@@ -5006,6 +5046,10 @@ packages:
   app-module-path@2.2.0:
     resolution: {integrity: sha512-gkco+qxENJV+8vFcDiiFhuoSvRXb2a/QPqpSoWhVz829VNJfOTnELbBmPmNKFxf3xdNnw4DWCkzkDaavcX/1YQ==}
 
+  app-root-path@3.1.0:
+    resolution: {integrity: sha512-biN3PwB2gUtjaYy/isrU3aNWI5w+fAfvHkSvCKeQGxhmYpwKFUxudR3Yya+KqVRHBmEDYh+/lTozYCFbmzX4nA==}
+    engines: {node: '>= 6.0.0'}
+
   aproba@2.1.0:
     resolution: {integrity: sha512-tLIEcj5GuR2RSTnxNKdkK0dJ/GrC7P38sUkiDmDuHfsHmbagTFAxDVIBltoklXEVIQ/f14IL8IMJ5pn9Hez1Ew==}
 
@@ -5080,6 +5124,10 @@ packages:
     peerDependencies:
       postcss: ^8.1.0
 
+  available-typed-arrays@1.0.7:
+    resolution: {integrity: sha512-wvUjBtSGN7+7SjNpq/9M2Tg350UZD3q62IFZLbRAR1bSMlCo1ZaeW+BJ+D090e4hIIZLBcTDWe4Mh4jvUDajzQ==}
+    engines: {node: '>= 0.4'}
+
   babel-loader@9.2.1:
     resolution: {integrity: sha512-fqe8naHt46e0yIdkjUZYqddSXfej3AHajX+CSO5X7oy0EmPc6o5Xh+RClNoHjnieWz9AW4kZxW9yyFMhVB1QLA==}
     engines: {node: '>= 14.15.0'}
@@ -5207,6 +5255,9 @@ packages:
   buffer@5.7.1:
     resolution: {integrity: sha512-EHcyIPBQ4BSGlvjB16k5KgAJ27CIsHY/2JBmCRReo48y9rQ3MaUzWX3KVlBa4U7MyX02HdVj0K7C3WaB3ju7FQ==}
 
+  buffer@6.0.3:
+    resolution: {integrity: sha512-FTiCpNxtwiZZHEZbcbTIcZjERVICn9yq/pDFkTl95/AxzD1naBctN7YO68riM/gLSDY7sdrMby8hofADYuuqOA==}
+
   bufferutil@4.0.9:
     resolution: {integrity: sha512-WDtdLmJvAuNNPzByAYpRo2rF1Mmradw6gvWsQKf63476DDXmomT9zUiGypLcG4ibIM67vhAj8jJRdbmEws2Aqw==}
     engines: {node: '>=6.14.2'}
@@ -6026,6 +6077,14 @@ packages:
     resolution: {integrity: sha512-aW35yZM6Bb/4oJlZncMH2LCoZtJXTRxES17vE3hoRiowU2kWHaJKFkSBDnDR+cm9J+9QhXmREyIfv0pji9ejCQ==}
     engines: {node: '>=10'}
 
+  dedent@1.7.1:
+    resolution: {integrity: sha512-9JmrhGZpOlEgOLdQgSm0zxFaYoQon408V1v49aqTWuXENVlnCuY9JBZcXZiCsZQWDjTm5Qf/nIvAy77mXDAjEg==}
+    peerDependencies:
+      babel-plugin-macros: ^3.1.0
+    peerDependenciesMeta:
+      babel-plugin-macros:
+        optional: true
+
   deep-eql@5.0.2:
     resolution: {integrity: sha512-h5k/5U50IJJFpzfL6nO9jaaumfjO/f2NjK/oYB2Djzm4p9L+3T9qWpZqZ2hAbLPuuYq9wrU08WQyBTL5GbPk5Q==}
     engines: {node: '>=6'}
@@ -6261,6 +6320,101 @@ packages:
     resolution: {integrity: sha512-JVUnt+DUIzu87TABbhPmNfVdBDt18BLOWjMUFJMSi/Qqg7NTYtabbvSNJGOJ7afbRuv9D/lngizHtP7QyLQ+9w==}
     engines: {node: '>=12'}
 
+  dottie@2.0.6:
+    resolution: {integrity: sha512-iGCHkfUc5kFekGiqhe8B/mdaurD+lakO9txNnTvKtA6PISrw86LgqHvRzWYPyoE2Ph5aMIrCw9/uko6XHTKCwA==}
+
+  drizzle-orm@0.45.1:
+    resolution: {integrity: sha512-Te0FOdKIistGNPMq2jscdqngBRfBpC8uMFVwqjf6gtTVJHIQ/dosgV/CLBU2N4ZJBsXL5savCba9b0YJskKdcA==}
+    peerDependencies:
+      '@aws-sdk/client-rds-data': '>=3'
+      '@cloudflare/workers-types': '>=4'
+      '@electric-sql/pglite': '>=0.2.0'
+      '@libsql/client': '>=0.10.0'
+      '@libsql/client-wasm': '>=0.10.0'
+      '@neondatabase/serverless': '>=0.10.0'
+      '@op-engineering/op-sqlite': '>=2'
+      '@opentelemetry/api': ^1.4.1
+      '@planetscale/database': '>=1.13'
+      '@prisma/client': '*'
+      '@tidbcloud/serverless': '*'
+      '@types/better-sqlite3': '*'
+      '@types/pg': '*'
+      '@types/sql.js': '*'
+      '@upstash/redis': '>=1.34.7'
+      '@vercel/postgres': '>=0.8.0'
+      '@xata.io/client': '*'
+      better-sqlite3: '>=7'
+      bun-types: '*'
+      expo-sqlite: '>=14.0.0'
+      gel: '>=2'
+      knex: '*'
+      kysely: '*'
+      mysql2: '>=2'
+      pg: '>=8'
+      postgres: '>=3'
+      prisma: '*'
+      sql.js: '>=1'
+      sqlite3: '>=5'
+    peerDependenciesMeta:
+      '@aws-sdk/client-rds-data':
+        optional: true
+      '@cloudflare/workers-types':
+        optional: true
+      '@electric-sql/pglite':
+        optional: true
+      '@libsql/client':
+        optional: true
+      '@libsql/client-wasm':
+        optional: true
+      '@neondatabase/serverless':
+        optional: true
+      '@op-engineering/op-sqlite':
+        optional: true
+      '@opentelemetry/api':
+        optional: true
+      '@planetscale/database':
+        optional: true
+      '@prisma/client':
+        optional: true
+      '@tidbcloud/serverless':
+        optional: true
+      '@types/better-sqlite3':
+        optional: true
+      '@types/pg':
+        optional: true
+      '@types/sql.js':
+        optional: true
+      '@upstash/redis':
+        optional: true
+      '@vercel/postgres':
+        optional: true
+      '@xata.io/client':
+        optional: true
+      better-sqlite3:
+        optional: true
+      bun-types:
+        optional: true
+      expo-sqlite:
+        optional: true
+      gel:
+        optional: true
+      knex:
+        optional: true
+      kysely:
+        optional: true
+      mysql2:
+        optional: true
+      pg:
+        optional: true
+      postgres:
+        optional: true
+      prisma:
+        optional: true
+      sql.js:
+        optional: true
+      sqlite3:
+        optional: true
+
   dts-resolver@2.1.2:
     resolution: {integrity: sha512-xeXHBQkn2ISSXxbJWD828PFjtyg+/UrMDo7W4Ffcs7+YWCquxU8YjV1KoxuiL+eJ5pg3ll+bC6flVv61L3LKZg==}
     engines: {node: '>=20.18.0'}
@@ -6718,6 +6872,10 @@ packages:
       debug:
         optional: true
 
+  for-each@0.3.5:
+    resolution: {integrity: sha512-dKx12eRCVIzqCxFGplyFKJMPvLEWgmNtUrpTiJIR5u97zEhRG8ySrtboPHZXx7daLxQVrl643cTzbab2tkQjxg==}
+    engines: {node: '>= 0.4'}
+
   for-in@1.0.2:
     resolution: {integrity: sha512-7EwmXrOjyL+ChxMhmG5lnW9MPt1aIeZEwKhQzoBUdTV0N3zuwWDZYVJatDvZ2OyzPUvdIAZDsCetk3coyMfcnQ==}
     engines: {node: '>=0.10.0'}
@@ -6992,6 +7150,10 @@ packages:
     resolution: {integrity: sha512-1cDNdwJ2Jaohmb3sg4OmKaMBwuC48sYni5HUw2DvsC8LjGTLK9h+eb1X6RyuOHe4hT0ULCW68iomhjUoKUqlPQ==}
     engines: {node: '>= 0.4'}
 
+  has-tostringtag@1.0.2:
+    resolution: {integrity: sha512-NqADB8VjPFLM2V0VvHUewwwsw0ZWBaIdgo+ieHtK3hasLz4qeCRjYcqfB6AQrBggRKppKF8L52/VqdVsO47Dlw==}
+    engines: {node: '>= 0.4'}
+
   has-unicode@2.0.1:
     resolution: {integrity: sha512-8Rf9Y83NBReMnx0gFzA8JImQACstCYWUplepDa9xprwwtmgEZUF0h/i5xSA625zB/I37EtrswSST6OXxwaaIJQ==}
 
@@ -7292,6 +7454,10 @@ packages:
     resolution: {integrity: sha512-uyH0zfr1erU1OohLk0fT4Rrb94AOhguWNOcD9uGrSpRvNB+6gZXUoJX5J0NtvzBO10YZ9PgvA4NFgt+fYg8ojw==}
     engines: {node: '>=12'}
 
+  inflection@1.13.4:
+    resolution: {integrity: sha512-6I/HUDeYFfuNCVS3td055BaXBwKYuzw7K3ExVMStBowKo9oOAMJIXIHvdyR3iboTCp1b+1i5DSkIZTcwIktuDw==}
+    engines: {'0': node >= 0.4.0}
+
   inflight@1.0.6:
     resolution: {integrity: sha512-k92I/b08q4wvFscXCLvqfsHCrjrF7yiXsQuIVvVE7N82W3+aqpzuUdBbfhWcy/FZR3/4IgflMgKLOsvPDrGCJA==}
     deprecated: This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.
@@ -7386,6 +7552,10 @@ packages:
     resolution: {integrity: sha512-i2R6zNFDwgEHJyQUtJEk0XFi1i0dPFn/oqjK3/vPCcDeJvW5NQ83V8QbicfF1SupOaB0h8ntgBC2YiE7dfyctQ==}
     engines: {node: '>=4'}
 
+  is-callable@1.2.7:
+    resolution: {integrity: sha512-1BC0BVFhS/p0qtw6enp8e+8OD0UrK0oFLztSjNzhcKA3WDuJxxAPXzPuPtKkjEY9UUoEWlX/8fgKeu2S8i9JTA==}
+    engines: {node: '>= 0.4'}
+
   is-ci@3.0.1:
     resolution: {integrity: sha512-ZYvCgrefwqoQ6yTyYUbQu64HsITZ3NfKX1lzaEYdkTDcfKzzCI/wthRRYKkdjHKFVgNiXKAKm65Zo1pk2as/QQ==}
     hasBin: true
@@ -7521,6 +7691,10 @@ packages:
     resolution: {integrity: sha512-+oDTluR6WEjdXEJMnC2z6A4FRwFoYuvShVVEGsS7ewc0UTi2QtAKMDJuL4BDEVt+5T7MjFo12RP8ghOM75oKJw==}
     engines: {node: '>=8'}
 
+  is-typed-array@1.1.15:
+    resolution: {integrity: sha512-p3EcsicXjit7SaskXHs1hA91QxgTw46Fv6EFKKGS5DRFLD8yKnohjF3hxoju94b/OcMZoQukzpPpBE9uLVKzgQ==}
+    engines: {node: '>= 0.4'}
+
   is-typedarray@1.0.0:
     resolution: {integrity: sha512-cyA56iCMHAh5CdzjJIa4aohJyeO1YbwLi3Jc35MmRU6poroFjIGZzUzupGiRPOjgHg9TLu43xbpwXk523fMxKA==}
 
@@ -7565,6 +7739,9 @@ packages:
   isarray@1.0.0:
     resolution: {integrity: sha512-VLghIWNM6ELQzo7zwmcg0NmTVyWKYjvIeM83yjp0wRDTmUnrM678fQbcKBo6n2CJEF0szoG//ytg+TKla89ALQ==}
 
+  isarray@2.0.5:
+    resolution: {integrity: sha512-xHjhDr3cNBK0BzdUJSPXZntQUx/mwMS5Rw4A7lPJ90XGAO6ISP/ePDNuo0vhqOZU+UD5JoodwCAAoZQd3FeAKw==}
+
   isbinaryfile@5.0.6:
     resolution: {integrity: sha512-I+NmIfBHUl+r2wcDd6JwE9yWje/PIVY/R5/CmV8dXLZd5K+L9X2klAOwfAHNnondLXkbHyTAleQAWonpTJBTtw==}
     engines: {node: '>= 18.0.0'}
@@ -8328,6 +8505,12 @@ packages:
     engines: {node: '>=18'}
     hasBin: true
 
+  moment-timezone@0.5.48:
+    resolution: {integrity: sha512-f22b8LV1gbTO2ms2j2z13MuPogNoh5UzxL3nzNAYKGraILnbGc9NEE6dyiiiLv46DGRb8A4kg8UKWLjPthxBHw==}
+
+  moment@2.30.1:
+    resolution: {integrity: sha512-uEmtNhbDOrWPFS+hdjFCBfy9f2YoyzRpwcl+DqpC6taX21FzsTLQVbMV/W7PzNSX6x/bhC1zA3c2UQ5NzH6how==}
+
   mri@1.2.0:
     resolution: {integrity: sha512-tzzskb3bG8LvYGFF/mDTpq3jpI6Q9wc3LEmBaghu+DdCssd1FakN7Bc0hVNmEyGq1bq3RgfkCb3cmQLpNPOroA==}
     engines: {node: '>=4'}
@@ -8739,30 +8922,33 @@ packages:
   perfect-debounce@2.0.0:
     resolution: {integrity: sha512-fkEH/OBiKrqqI/yIgjR92lMfs2K8105zt/VT6+7eTjNwisrsh47CeIED9z58zI7DfKdH3uHAn25ziRZn3kgAow==}
 
-  pg-cloudflare@1.2.7:
-    resolution: {integrity: sha512-YgCtzMH0ptvZJslLM1ffsY4EuGaU0cx4XSdXLRFae8bPP4dS5xL1tNB3k2o/N64cHJpwU7dxKli/nZ2lUa5fLg==}
+  pg-cloudflare@1.3.0:
+    resolution: {integrity: sha512-6lswVVSztmHiRtD6I8hw4qP/nDm1EJbKMRhf3HCYaqud7frGysPv7FYJ5noZQdhQtN2xJnimfMtvQq21pdbzyQ==}
 
-  pg-connection-string@2.9.1:
-    resolution: {integrity: sha512-nkc6NpDcvPVpZXxrreI/FOtX3XemeLl8E0qFr6F2Lrm/I8WOnaWNhIPK2Z7OHpw7gh5XJThi6j6ppgNoaT1w4w==}
+  pg-connection-string@2.11.0:
+    resolution: {integrity: sha512-kecgoJwhOpxYU21rZjULrmrBJ698U2RxXofKVzOn5UDj61BPj/qMb7diYUR1nLScCDbrztQFl1TaQZT0t1EtzQ==}
 
   pg-int8@1.0.1:
     resolution: {integrity: sha512-WCtabS6t3c8SkpDBUlb1kjOs7l66xsGdKpIPZsg4wR+B3+u9UAum2odSsF9tnvxg80h4ZxLWMy4pRjOsFIqQpw==}
     engines: {node: '>=4.0.0'}
 
-  pg-pool@3.10.1:
-    resolution: {integrity: sha512-Tu8jMlcX+9d8+QVzKIvM/uJtp07PKr82IUOYEphaWcoBhIYkoHpLXN3qO59nAI11ripznDsEzEv8nUxBVWajGg==}
+  pg-pool@3.11.0:
+    resolution: {integrity: sha512-MJYfvHwtGp870aeusDh+hg9apvOe2zmpZJpyt+BMtzUWlVqbhFmMK6bOBXLBUPd7iRtIF9fZplDc7KrPN3PN7w==}
     peerDependencies:
       pg: '>=8.0'
 
   pg-protocol@1.10.3:
     resolution: {integrity: sha512-6DIBgBQaTKDJyxnXaLiLR8wBpQQcGWuAESkRBX/t6OwA8YsqP+iVSiond2EDy6Y/dsGk8rh/jtax3js5NeV7JQ==}
 
+  pg-protocol@1.11.0:
+    resolution: {integrity: sha512-pfsxk2M9M3BuGgDOfuy37VNRRX3jmKgMjcvAcWqNDpZSf4cUmv8HSOl5ViRQFsfARFn0KuUQTgLxVMbNq5NW3g==}
+
   pg-types@2.2.0:
     resolution: {integrity: sha512-qTAAlrEsl8s4OiEQY69wDvcMIdQN6wdz5ojQiOy6YRMuynxenON0O5oCpJI6lshc6scgAY8qvJ2On/p+CXY0GA==}
     engines: {node: '>=4'}
 
-  pg@8.16.3:
-    resolution: {integrity: sha512-enxc1h0jA/aq5oSDMvqyW3q89ra6XIIDZgCX9vkMrnz5DFTw/Ny3Li2lFQ+pt3L6MCgm/5o2o8HW9hiJji+xvw==}
+  pg@8.18.0:
+    resolution: {integrity: sha512-xqrUDL1b9MbkydY/s+VZ6v+xiMUmOUk7SS9d/1kpyQxoJ6U9AO1oIJyUWVZojbfe5Cc/oluutcgFG4L9RDP1iQ==}
     engines: {node: '>= 16.0.0'}
     peerDependencies:
       pg-native: '>=3.0.1'
@@ -8820,6 +9006,10 @@ packages:
   points-on-path@0.2.1:
     resolution: {integrity: sha512-25ClnWWuw7JbWZcgqY/gJ4FQWadKxGWk+3kR/7kD0tCaDtPPMj7oHu2ToLaVhfpnHrZzYby2w6tUA0eOIuUg8g==}
 
+  possible-typed-array-names@1.1.0:
+    resolution: {integrity: sha512-/+5VFTchJDoVj3bhoqi6UeymcD00DAwb1nJwamzPvHEszJ4FpF6SNNbUbOS8yI56qHzdV8eK0qEfOSiodkTdxg==}
+    engines: {node: '>= 0.4'}
+
   postcss-attribute-case-insensitive@7.0.1:
     resolution: {integrity: sha512-Uai+SupNSqzlschRyNx3kbCTWgY/2hcwtHEI/ej2LJWc9JJ77qKgGptd8DHwY1mXtZ7Aoh4z4yxfwMBue9eNgw==}
     engines: {node: '>=18'}
@@ -9682,6 +9872,9 @@ packages:
     resolution: {integrity: sha512-oMA2dcrw6u0YfxJQXm342bFKX/E4sG9rbTzO9ptUcR/e8A33cHuvStiYOwH7fszkZlZ1z/ta9AAoPk2F4qIOHA==}
     engines: {node: '>=18'}
 
+  retry-as-promised@7.1.1:
+    resolution: {integrity: sha512-hMD7odLOt3LkTjcif8aRZqi/hybjpLNgSk5oF5FCowfCjok6LukpN2bDX7R5wDmbgBQFn7YoBxSagmtXHaJYJw==}
+
   retry@0.13.1:
     resolution: {integrity: sha512-XQBQ3I8W1Cge0Seh+6gjj03LbmRFWuoszgK9ooCpwYIrhhoO80pfq4cUkU5DkknwfOfFteRwlZ56PYOGYyFWdg==}
     engines: {node: '>= 4'}
@@ -9880,6 +10073,43 @@ packages:
     resolution: {integrity: sha512-p4rRk4f23ynFEfcD9LA0xRYngj+IyGiEYyqqOak8kaN0TvNmuxC2dcVeBn62GpCeR2CpWqyHCNScTP91QbAVFg==}
     engines: {node: '>= 0.8.0'}
 
+  sequelize-pool@7.1.0:
+    resolution: {integrity: sha512-G9c0qlIWQSK29pR/5U2JF5dDQeqqHRragoyahj/Nx4KOOQ3CPPfzxnfqFPCSB7x5UgjOgnZ61nSxz+fjDpRlJg==}
+    engines: {node: '>= 10.0.0'}
+
+  sequelize@6.37.7:
+    resolution: {integrity: sha512-mCnh83zuz7kQxxJirtFD7q6Huy6liPanI67BSlbzSYgVNl5eXVdE2CN1FuAeZwG1SNpGsNRCV+bJAVVnykZAFA==}
+    engines: {node: '>=10.0.0'}
+    peerDependencies:
+      ibm_db: '*'
+      mariadb: '*'
+      mysql2: '*'
+      oracledb: '*'
+      pg: '*'
+      pg-hstore: '*'
+      snowflake-sdk: '*'
+      sqlite3: '*'
+      tedious: '*'
+    peerDependenciesMeta:
+      ibm_db:
+        optional: true
+      mariadb:
+        optional: true
+      mysql2:
+        optional: true
+      oracledb:
+        optional: true
+      pg:
+        optional: true
+      pg-hstore:
+        optional: true
+      snowflake-sdk:
+        optional: true
+      sqlite3:
+        optional: true
+      tedious:
+        optional: true
+
   serialize-javascript@6.0.2:
     resolution: {integrity: sha512-Saa1xPByTTq2gdeFZYLLo+RFE35NHZkAbqZeWNd3BpzppeVisAqpDjcp8dyf6uIvEqJRd46jemmyA4iFIeVk8g==}
 
@@ -9904,6 +10134,11 @@ packages:
   setprototypeof@1.2.0:
     resolution: {integrity: sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw==}
 
+  sha.js@2.4.12:
+    resolution: {integrity: sha512-8LzC5+bvI45BjpfXU8V5fdU2mfeKiQe1D1gIMn7XUlF3OTUrpdJpPPH4EMAnF0DsHHdSZqCdSss5qCmJKuiO3w==}
+    engines: {node: '>= 0.10'}
+    hasBin: true
+
   shallow-clone@3.0.1:
     resolution: {integrity: sha512-/6KqX+GVUdqPuPPd2LxDDxzX6CAbjJehAAOKlNpqqUpAqPM6HeL8f+o3a+JsyGjn2lv0WY8UsTgUJjU9Ok55NA==}
     engines: {node: '>=8'}
@@ -10059,6 +10294,10 @@ packages:
   sprintf-js@1.0.3:
     resolution: {integrity: sha512-D9cPgkvLlV3t3IzL0D0YLvGA9Ahk4PcvVwUbN0dSGr1aP0Nrt4AEnTUbuGvquEC0mA64Gqt1fzirlRs5ibXx8g==}
 
+  sql-highlight@6.1.0:
+    resolution: {integrity: sha512-ed7OK4e9ywpE7pgRMkMQmZDPKSVdm0oX5IEtZiKnFucSF0zu6c80GZBe38UqHuVhTWJ9xsKgSMjCG2bml86KvA==}
+    engines: {node: '>=14'}
+
   srcset@4.0.0:
     resolution: {integrity: sha512-wvLeHgcVHKO8Sc/H/5lkGreJQVeYMm9rlmt8PuR1xE31rIuXhuzznUUqAt8MqLhB3MqJdFzlNAfpcWnxiFUcPw==}
     engines: {node: '>=12'}
@@ -10309,6 +10548,10 @@ packages:
     resolution: {integrity: sha512-Y1KQBgDd/NUc+LfOtKS6mNsC9CCaH+m2P1RoIZy7RAPo3C3/t8X45+zgut31cRZtZ3xKPjfn3TkGTrctC2TQIQ==}
     hasBin: true
 
+  to-buffer@1.2.2:
+    resolution: {integrity: sha512-db0E3UJjcFhpDhAF4tLo03oli3pwl3dbnzXOUIlRKrp+ldk/VUxzpWYZENsw2SZiuBjHAk7DfB0VU7NKdpb6sw==}
+    engines: {node: '>= 0.4'}
+
   to-regex-range@5.0.1:
     resolution: {integrity: sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ==}
     engines: {node: '>=8.0'}
@@ -10320,6 +10563,9 @@ packages:
     resolution: {integrity: sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA==}
     engines: {node: '>=0.6'}
 
+  toposort-class@1.0.1:
+    resolution: {integrity: sha512-OsLcGGbYF3rMjPUf8oKktyvCiUxSbqMMS39m33MAjLTC1DVIH6x3WSt63/M77ihI09+Sdfk1AXvfhCEeUmC7mg==}
+
   totalist@3.0.1:
     resolution: {integrity: sha512-sf4i37nQ2LBx4m3wB74y+ubopq6W/dIzXg0FDGjsYnZHVa1Da8FH853wlL2gtUhg+xJXjfk3kUZS3BRoQeoQBQ==}
     engines: {node: '>=6'}
@@ -10471,6 +10717,10 @@ packages:
     resolution: {integrity: sha512-TkRKr9sUTxEH8MdfuCSP7VizJyzRNMjj2J2do2Jr3Kym598JVdEksuzPQCnlFPW4ky9Q+iA+ma9BGm06XQBy8g==}
     engines: {node: '>= 0.6'}
 
+  typed-array-buffer@1.0.3:
+    resolution: {integrity: sha512-nAYYwfY3qnzX30IkA6AQZjVbtK6duGontcQm1WSG1MD94YLqK0515GNApXkoxKOWMusVssAHWLh9SeaoefYFGw==}
+    engines: {node: '>= 0.4'}
+
   typedarray-to-buffer@3.1.5:
     resolution: {integrity: sha512-zdu8XMNEDepKKR+XYOXAVPtWui0ly0NtohUscw+UmaHiAWT8hrV1rr//H6V+0DvJ3OQ19S979M0laLfX8rm82Q==}
 
@@ -10495,6 +10745,61 @@ packages:
     peerDependencies:
       typescript: 5.0.x || 5.1.x || 5.2.x || 5.3.x || 5.4.x || 5.5.x || 5.6.x || 5.7.x || 5.8.x || 5.9.x
 
+  typeorm@0.3.28:
+    resolution: {integrity: sha512-6GH7wXhtfq2D33ZuRXYwIsl/qM5685WZcODZb7noOOcRMteM9KF2x2ap3H0EBjnSV0VO4gNAfJT5Ukp0PkOlvg==}
+    engines: {node: '>=16.13.0'}
+    hasBin: true
+    peerDependencies:
+      '@google-cloud/spanner': ^5.18.0 || ^6.0.0 || ^7.0.0 || ^8.0.0
+      '@sap/hana-client': ^2.14.22
+      better-sqlite3: ^8.0.0 || ^9.0.0 || ^10.0.0 || ^11.0.0 || ^12.0.0
+      ioredis: ^5.0.4
+      mongodb: ^5.8.0 || ^6.0.0
+      mssql: ^9.1.1 || ^10.0.0 || ^11.0.0 || ^12.0.0
+      mysql2: ^2.2.5 || ^3.0.1
+      oracledb: ^6.3.0
+      pg: ^8.5.1
+      pg-native: ^3.0.0
+      pg-query-stream: ^4.0.0
+      redis: ^3.1.1 || ^4.0.0 || ^5.0.14
+      sql.js: ^1.4.0
+      sqlite3: ^5.0.3
+      ts-node: ^10.7.0
+      typeorm-aurora-data-api-driver: ^2.0.0 || ^3.0.0
+    peerDependenciesMeta:
+      '@google-cloud/spanner':
+        optional: true
+      '@sap/hana-client':
+        optional: true
+      better-sqlite3:
+        optional: true
+      ioredis:
+        optional: true
+      mongodb:
+        optional: true
+      mssql:
+        optional: true
+      mysql2:
+        optional: true
+      oracledb:
+        optional: true
+      pg:
+        optional: true
+      pg-native:
+        optional: true
+      pg-query-stream:
+        optional: true
+      redis:
+        optional: true
+      sql.js:
+        optional: true
+      sqlite3:
+        optional: true
+      ts-node:
+        optional: true
+      typeorm-aurora-data-api-driver:
+        optional: true
+
   typescript-eslint@8.49.0:
     resolution: {integrity: sha512-zRSVH1WXD0uXczCXw+nsdjGPUdx4dfrs5VQoHnUWmv1U3oNlAKv4FUNdLDhVUg+gYn+a5hUESqch//Rv5wVhrg==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
@@ -10719,6 +11024,10 @@ packages:
   validate-npm-package-license@3.0.4:
     resolution: {integrity: sha512-DpKm2Ui/xN7/HQKCtpZxoRWBhZ9Z0kqtygG8XCgNQ8ZlDnxuQmWhj566j8fN4Cu3/JmbhsDo7fcAJq4s9h27Ew==}
 
+  validator@13.15.26:
+    resolution: {integrity: sha512-spH26xU080ydGggxRyR1Yhcbgx+j3y5jbNXk/8L+iRvdIEQ4uTRH2Sgf2dokud6Q4oAtsbNvJ1Ft+9xmm6IZcA==}
+    engines: {node: '>= 0.10'}
+
   value-equal@1.0.1:
     resolution: {integrity: sha512-NOJ6JZCAWr0zlxZt+xqCHNTEKOsrks2HQd4MqhP1qy4z1SkbEP467eNx6TgDKXMvUOb+OENfJCZwM+16n7fRfw==}
 
@@ -10968,6 +11277,10 @@ packages:
   whatwg-url@5.0.0:
     resolution: {integrity: sha512-saE57nupxk6v3HY35+jzBwYa0rKSy0XR8JSxZPwgLr7ys0IBzhGviA1/TUGJLmSVqs8pb9AnvICXEuOHLprYTw==}
 
+  which-typed-array@1.1.20:
+    resolution: {integrity: sha512-LYfpUkmqwl0h9A2HL09Mms427Q1RZWuOHsukfVcKRq9q95iQxdw0ix1JQrqbcDR9PH1QDwf5Qo8OZb5lksZ8Xg==}
+    engines: {node: '>= 0.4'}
+
   which@1.3.1:
     resolution: {integrity: sha512-HxJdYWq1MTIQbJ3nw0cqssHoTNU267KlrDuGZ1WYlxDStUtKUhOaJmh112/TZmHxxUfuJqPXSOm7tDyas0OSIQ==}
     hasBin: true
@@ -10999,6 +11312,9 @@ packages:
     resolution: {integrity: sha512-1lOb3qdzw6OFmOzoY0nauhLG72TpWtb5qgYPiSh/62rjc1XidBSDio2qw0pwHh17VINF217ebIkZJdFLZFn9SA==}
     engines: {node: '>=18'}
 
+  wkx@0.5.0:
+    resolution: {integrity: sha512-Xng/d4Ichh8uN4l0FToV/258EjMGU9MGcA0HV2d9B/ZpZB3lqQm7nkOdZdm5GhKtLLhAE7PiVQwN4eN+2YJJUg==}
+
   word-wrap@1.2.5:
     resolution: {integrity: sha512-BN22B5eaMMI9UMtjrGd5g5eCYPpCPDUy0FJXbYsaT5zYxjFOckS53SQDE3pWkVoWpHXVb3BrYcEN4Twa55B5cA==}
     engines: {node: '>=0.10.0'}
@@ -12654,7 +12970,7 @@ snapshots:
     dependencies:
       postcss: 8.5.6
 
-  '@databricks/sdk-experimental@0.15.0':
+  '@databricks/sdk-experimental@0.16.0':
     dependencies:
       google-auth-library: 10.5.0
       ini: 6.0.0
@@ -15702,6 +16018,8 @@ snapshots:
       micromark-util-character: 1.2.0
       micromark-util-symbol: 1.1.0
 
+  '@sqltools/formatter@1.2.5': {}
+
   '@standard-schema/spec@1.1.0': {}
 
   '@standard-schema/utils@0.3.0': {}
@@ -16249,7 +16567,7 @@ snapshots:
 
   '@types/pg-pool@2.0.6':
     dependencies:
-      '@types/pg': 8.15.6
+      '@types/pg': 8.16.0
 
   '@types/pg@8.15.6':
     dependencies:
@@ -16257,6 +16575,12 @@ snapshots:
       pg-protocol: 1.10.3
       pg-types: 2.2.0
 
+  '@types/pg@8.16.0':
+    dependencies:
+      '@types/node': 24.10.1
+      pg-protocol: 1.10.3
+      pg-types: 2.2.0
+
   '@types/picomatch@4.0.2': {}
 
   '@types/prismjs@1.26.5': {}
@@ -16359,6 +16683,8 @@ snapshots:
 
   '@types/unist@3.0.3': {}
 
+  '@types/validator@13.15.10': {}
+
   '@types/ws@8.18.1':
     dependencies:
       '@types/node': 24.10.1
@@ -16831,6 +17157,8 @@ snapshots:
 
   app-module-path@2.2.0: {}
 
+  app-root-path@3.1.0: {}
+
   aproba@2.1.0: {}
 
   arg@5.0.2: {}
@@ -16893,6 +17221,10 @@ snapshots:
       postcss: 8.5.6
       postcss-value-parser: 4.2.0
 
+  available-typed-arrays@1.0.7:
+    dependencies:
+      possible-typed-array-names: 1.1.0
+
   babel-loader@9.2.1(@babel/core@7.28.5)(webpack@5.103.0):
     dependencies:
       '@babel/core': 7.28.5
@@ -17052,6 +17384,11 @@ snapshots:
       base64-js: 1.5.1
       ieee754: 1.2.1
 
+  buffer@6.0.3:
+    dependencies:
+      base64-js: 1.5.1
+      ieee754: 1.2.1
+
   bufferutil@4.0.9:
     dependencies:
       node-gyp-build: 4.8.4
@@ -17920,6 +18257,8 @@ snapshots:
     dependencies:
       mimic-response: 3.1.0
 
+  dedent@1.7.1: {}
+
   deep-eql@5.0.2: {}
 
   deep-extend@0.6.0: {}
@@ -18170,6 +18509,14 @@ snapshots:
 
   dotenv@17.2.3: {}
 
+  dottie@2.0.6: {}
+
+  drizzle-orm@0.45.1(@opentelemetry/api@1.9.0)(@types/pg@8.16.0)(pg@8.18.0):
+    optionalDependencies:
+      '@opentelemetry/api': 1.9.0
+      '@types/pg': 8.16.0
+      pg: 8.18.0
+
   dts-resolver@2.1.2: {}
 
   dunder-proto@1.0.1:
@@ -18696,6 +19043,10 @@ snapshots:
 
   follow-redirects@1.15.11: {}
 
+  for-each@0.3.5:
+    dependencies:
+      is-callable: 1.2.7
+
   for-in@1.0.2: {}
 
   for-own@1.0.0:
@@ -19028,6 +19379,10 @@ snapshots:
 
   has-symbols@1.1.0: {}
 
+  has-tostringtag@1.0.2:
+    dependencies:
+      has-symbols: 1.1.0
+
   has-unicode@2.0.1: {}
 
   has-yarn@3.0.0: {}
@@ -19503,6 +19858,8 @@ snapshots:
 
   infima@0.2.0-alpha.45: {}
 
+  inflection@1.13.4: {}
+
   inflight@1.0.6:
     dependencies:
       once: 1.4.0
@@ -19592,6 +19949,8 @@ snapshots:
 
   is-buffer@2.0.5: {}
 
+  is-callable@1.2.7: {}
+
   is-ci@3.0.1:
     dependencies:
       ci-info: 3.9.0
@@ -19681,6 +20040,10 @@ snapshots:
     dependencies:
       text-extensions: 2.4.0
 
+  is-typed-array@1.1.15:
+    dependencies:
+      which-typed-array: 1.1.20
+
   is-typedarray@1.0.0: {}
 
   is-unc-path@1.0.0:
@@ -19711,6 +20074,8 @@ snapshots:
 
   isarray@1.0.0: {}
 
+  isarray@2.0.5: {}
+
   isbinaryfile@5.0.6: {}
 
   isexe@2.0.0: {}
@@ -20777,6 +21142,12 @@ snapshots:
       requirejs: 2.3.8
       requirejs-config-file: 4.0.0
 
+  moment-timezone@0.5.48:
+    dependencies:
+      moment: 2.30.1
+
+  moment@2.30.1: {}
+
   mri@1.2.0: {}
 
   mrmime@2.0.1: {}
@@ -21198,19 +21569,21 @@ snapshots:
 
   perfect-debounce@2.0.0: {}
 
-  pg-cloudflare@1.2.7:
+  pg-cloudflare@1.3.0:
     optional: true
 
-  pg-connection-string@2.9.1: {}
+  pg-connection-string@2.11.0: {}
 
   pg-int8@1.0.1: {}
 
-  pg-pool@3.10.1(pg@8.16.3):
+  pg-pool@3.11.0(pg@8.18.0):
     dependencies:
-      pg: 8.16.3
+      pg: 8.18.0
 
   pg-protocol@1.10.3: {}
 
+  pg-protocol@1.11.0: {}
+
   pg-types@2.2.0:
     dependencies:
       pg-int8: 1.0.1
@@ -21219,15 +21592,15 @@ snapshots:
       postgres-date: 1.0.7
       postgres-interval: 1.2.0
 
-  pg@8.16.3:
+  pg@8.18.0:
     dependencies:
-      pg-connection-string: 2.9.1
-      pg-pool: 3.10.1(pg@8.16.3)
-      pg-protocol: 1.10.3
+      pg-connection-string: 2.11.0
+      pg-pool: 3.11.0(pg@8.18.0)
+      pg-protocol: 1.11.0
       pg-types: 2.2.0
       pgpass: 1.0.5
     optionalDependencies:
-      pg-cloudflare: 1.2.7
+      pg-cloudflare: 1.3.0
 
   pgpass@1.0.5:
     dependencies:
@@ -21285,6 +21658,8 @@ snapshots:
       path-data-parser: 0.1.0
       points-on-curve: 0.2.0
 
+  possible-typed-array-names@1.1.0: {}
+
   postcss-attribute-case-insensitive@7.0.1(postcss@8.5.6):
     dependencies:
       postcss: 8.5.6
@@ -22330,6 +22705,8 @@ snapshots:
       onetime: 7.0.0
       signal-exit: 4.1.0
 
+  retry-as-promised@7.1.1: {}
+
   retry@0.13.1: {}
 
   reusify@1.1.0: {}
@@ -22592,6 +22969,31 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
+  sequelize-pool@7.1.0: {}
+
+  sequelize@6.37.7(pg@8.18.0):
+    dependencies:
+      '@types/debug': 4.1.12
+      '@types/validator': 13.15.10
+      debug: 4.4.3
+      dottie: 2.0.6
+      inflection: 1.13.4
+      lodash: 4.17.21
+      moment: 2.30.1
+      moment-timezone: 0.5.48
+      pg-connection-string: 2.11.0
+      retry-as-promised: 7.1.1
+      semver: 7.7.3
+      sequelize-pool: 7.1.0
+      toposort-class: 1.0.1
+      uuid: 8.3.2
+      validator: 13.15.26
+      wkx: 0.5.0
+    optionalDependencies:
+      pg: 8.18.0
+    transitivePeerDependencies:
+      - supports-color
+
   serialize-javascript@6.0.2:
     dependencies:
       randombytes: 2.1.0
@@ -22640,6 +23042,12 @@ snapshots:
 
   setprototypeof@1.2.0: {}
 
+  sha.js@2.4.12:
+    dependencies:
+      inherits: 2.0.4
+      safe-buffer: 5.2.1
+      to-buffer: 1.2.2
+
   shallow-clone@3.0.1:
     dependencies:
       kind-of: 6.0.3
@@ -22810,6 +23218,8 @@ snapshots:
 
   sprintf-js@1.0.3: {}
 
+  sql-highlight@6.1.0: {}
+
   srcset@4.0.0: {}
 
   stackback@0.0.2: {}
@@ -23022,6 +23432,12 @@ snapshots:
     dependencies:
       tldts-core: 7.0.17
 
+  to-buffer@1.2.2:
+    dependencies:
+      isarray: 2.0.5
+      safe-buffer: 5.2.1
+      typed-array-buffer: 1.0.3
+
   to-regex-range@5.0.1:
     dependencies:
       is-number: 7.0.0
@@ -23033,6 +23449,8 @@ snapshots:
 
   toidentifier@1.0.1: {}
 
+  toposort-class@1.0.1: {}
+
   totalist@3.0.1: {}
 
   tough-cookie@6.0.0:
@@ -23156,6 +23574,12 @@ snapshots:
       media-typer: 0.3.0
       mime-types: 2.1.35
 
+  typed-array-buffer@1.0.3:
+    dependencies:
+      call-bound: 1.0.4
+      es-errors: 1.3.0
+      is-typed-array: 1.1.15
+
   typedarray-to-buffer@3.1.5:
     dependencies:
       is-typedarray: 1.0.0
@@ -23179,6 +23603,29 @@ snapshots:
       typescript: 5.6.3
       yaml: 2.8.1
 
+  typeorm@0.3.28(pg@8.18.0):
+    dependencies:
+      '@sqltools/formatter': 1.2.5
+      ansis: 4.2.0
+      app-root-path: 3.1.0
+      buffer: 6.0.3
+      dayjs: 1.11.19
+      debug: 4.4.3
+      dedent: 1.7.1
+      dotenv: 16.6.1
+      glob: 10.5.0
+      reflect-metadata: 0.2.2
+      sha.js: 2.4.12
+      sql-highlight: 6.1.0
+      tslib: 2.8.1
+      uuid: 11.1.0
+      yargs: 17.7.2
+    optionalDependencies:
+      pg: 8.18.0
+    transitivePeerDependencies:
+      - babel-plugin-macros
+      - supports-color
+
   typescript-eslint@8.49.0(eslint@9.39.1(jiti@2.6.1))(typescript@5.9.3):
     dependencies:
       '@typescript-eslint/eslint-plugin': 8.49.0(@typescript-eslint/parser@8.49.0(eslint@9.39.1(jiti@2.6.1))(typescript@5.9.3))(eslint@9.39.1(jiti@2.6.1))(typescript@5.9.3)
@@ -23402,6 +23849,8 @@ snapshots:
       spdx-correct: 3.2.0
       spdx-expression-parse: 3.0.1
 
+  validator@13.15.26: {}
+
   value-equal@1.0.1: {}
 
   vary@1.1.2: {}
@@ -23765,6 +24214,16 @@ snapshots:
       tr46: 0.0.3
       webidl-conversions: 3.0.1
 
+  which-typed-array@1.1.20:
+    dependencies:
+      available-typed-arrays: 1.0.7
+      call-bind: 1.0.8
+      call-bound: 1.0.4
+      for-each: 0.3.5
+      get-proto: 1.0.1
+      gopd: 1.2.0
+      has-tostringtag: 1.0.2
+
   which@1.3.1:
     dependencies:
       isexe: 2.0.0
@@ -23794,6 +24253,10 @@ snapshots:
     dependencies:
       execa: 8.0.1
 
+  wkx@0.5.0:
+    dependencies:
+      '@types/node': 24.10.1
+
   word-wrap@1.2.5: {}
 
   wordwrap@1.0.0: {}
diff --git a/template/package-lock.json b/template/package-lock.json
index 6c5b2fbd..67d54f70 100644
--- a/template/package-lock.json
+++ b/template/package-lock.json
@@ -7,10 +7,11 @@
     "": {
       "name": "{{.project_name}}",
       "version": "1.0.0",
+      "hasInstallScript": true,
       "license": "Unlicensed",
       "dependencies": {
-        "@databricks/appkit": "0.5.2",
-        "@databricks/appkit-ui": "0.5.2",
+        "@databricks/appkit": "0.7.4",
+        "@databricks/appkit-ui": "0.7.4",
         "@databricks/sdk-experimental": "^0.14.2",
         "clsx": "^2.1.1",
         "embla-carousel-react": "^8.6.0",
@@ -535,13 +536,14 @@
       }
     },
     "node_modules/@databricks/appkit": {
-      "version": "0.5.2",
-      "resolved": "https://registry.npmjs.org/@databricks/appkit/-/appkit-0.5.2.tgz",
-      "integrity": "sha512-/CajSwHlmX5zIT9xbKkAMUMVHq06kY4TKCcJSy6NSikjPmjkR/n5MV5SO4PlMZ0NVZcSuKTnvomSlDU0CWqidA==",
+      "version": "0.7.4",
+      "resolved": "https://registry.npmjs.org/@databricks/appkit/-/appkit-0.7.4.tgz",
+      "integrity": "sha512-9ei61ePpY1TUXlYbn1E0YHdqwxwjZZdavl1gdsO8QdX09Wc/cWJDSBzpw72BoHPfHSKDnTP404mt3AEeC48b0A==",
       "hasInstallScript": true,
       "dependencies": {
         "@ast-grep/napi": "^0.37.0",
-        "@databricks/sdk-experimental": "^0.15.0",
+        "@databricks/lakebase": "0.1.1",
+        "@databricks/sdk-experimental": "^0.16.0",
         "@opentelemetry/api": "^1.9.0",
         "@opentelemetry/api-logs": "^0.208.0",
         "@opentelemetry/auto-instrumentations-node": "^0.67.0",
@@ -557,11 +559,13 @@
         "@opentelemetry/sdk-node": "^0.208.0",
         "@opentelemetry/semantic-conventions": "^1.38.0",
         "@types/semver": "^7.7.1",
+        "ajv": "^8.17.1",
+        "ajv-formats": "^3.0.1",
         "commander": "^12.1.0",
         "dotenv": "^16.6.1",
         "express": "^4.22.0",
         "obug": "^2.1.1",
-        "pg": "^8.16.3",
+        "pg": "^8.18.0",
         "semver": "^7.7.3",
         "vite": "npm:rolldown-vite@7.1.14",
         "ws": "^8.18.3",
@@ -572,9 +576,9 @@
       }
     },
     "node_modules/@databricks/appkit-ui": {
-      "version": "0.5.2",
-      "resolved": "https://registry.npmjs.org/@databricks/appkit-ui/-/appkit-ui-0.5.2.tgz",
-      "integrity": "sha512-8Enb4VT2Xf2DZHcbOlcu6oySY5p5rTxexj8AENl+Dwryq0bhidBwh4GjvRGhKg16dTe6HeYar/LnHrGhbWNdVQ==",
+      "version": "0.7.4",
+      "resolved": "https://registry.npmjs.org/@databricks/appkit-ui/-/appkit-ui-0.7.4.tgz",
+      "integrity": "sha512-hEPJ/BsUhQlxpTOoAdoLvOyTHFujn9oD6D6DYbwsNAVYaTnA3srh91baUi6f5tpZhsYW7DR6Hax1CA0sXJYYFg==",
       "hasInstallScript": true,
       "dependencies": {
         "@ast-grep/napi": "^0.37.0",
@@ -607,6 +611,8 @@
         "@radix-ui/react-tooltip": "^1.2.8",
         "@tanstack/react-table": "^8.21.3",
         "@tanstack/react-virtual": "^3.13.12",
+        "ajv": "^8.17.1",
+        "ajv-formats": "^3.0.1",
         "apache-arrow": "^21.1.0",
         "class-variance-authority": "^0.7.1",
         "clsx": "^2.1.1",
@@ -635,6 +641,28 @@
         "recharts": "^2.0.0 || ^3.0.0"
       }
     },
+    "node_modules/@databricks/appkit-ui/node_modules/ajv": {
+      "version": "8.18.0",
+      "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.18.0.tgz",
+      "integrity": "sha512-PlXPeEWMXMZ7sPYOHqmDyCJzcfNrUr3fGNKtezX14ykXOEIvyK81d+qydx89KY5O71FKMPaQ2vBfBFI5NHR63A==",
+      "license": "MIT",
+      "dependencies": {
+        "fast-deep-equal": "^3.1.3",
+        "fast-uri": "^3.0.1",
+        "json-schema-traverse": "^1.0.0",
+        "require-from-string": "^2.0.2"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/epoberezkin"
+      }
+    },
+    "node_modules/@databricks/appkit-ui/node_modules/json-schema-traverse": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz",
+      "integrity": "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==",
+      "license": "MIT"
+    },
     "node_modules/@databricks/appkit-ui/node_modules/lucide-react": {
       "version": "0.554.0",
       "resolved": "https://registry.npmjs.org/lucide-react/-/lucide-react-0.554.0.tgz",
@@ -645,9 +673,58 @@
       }
     },
     "node_modules/@databricks/appkit/node_modules/@databricks/sdk-experimental": {
-      "version": "0.15.0",
-      "resolved": "https://registry.npmjs.org/@databricks/sdk-experimental/-/sdk-experimental-0.15.0.tgz",
-      "integrity": "sha512-HkoMiF7dNDt6WRW0xhi7oPlBJQfxJ9suJhEZRFt08VwLMaWcw2PiF8monfHlkD4lkufEYV6CTxi5njQkciqiHA==",
+      "version": "0.16.0",
+      "resolved": "https://registry.npmjs.org/@databricks/sdk-experimental/-/sdk-experimental-0.16.0.tgz",
+      "integrity": "sha512-9c2RxWYoRDFupdt4ZnBc1IPE1XaXgN+/wyV4DVcEqOnIa31ep51OnwAD/3014BImfKdyXg32nmgrB9dwvB6+lg==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "google-auth-library": "^10.5.0",
+        "ini": "^6.0.0",
+        "reflect-metadata": "^0.2.2",
+        "semver": "^7.7.3"
+      },
+      "engines": {
+        "node": ">=22.0",
+        "npm": ">=10.0.0"
+      }
+    },
+    "node_modules/@databricks/appkit/node_modules/ajv": {
+      "version": "8.18.0",
+      "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.18.0.tgz",
+      "integrity": "sha512-PlXPeEWMXMZ7sPYOHqmDyCJzcfNrUr3fGNKtezX14ykXOEIvyK81d+qydx89KY5O71FKMPaQ2vBfBFI5NHR63A==",
+      "license": "MIT",
+      "dependencies": {
+        "fast-deep-equal": "^3.1.3",
+        "fast-uri": "^3.0.1",
+        "json-schema-traverse": "^1.0.0",
+        "require-from-string": "^2.0.2"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/epoberezkin"
+      }
+    },
+    "node_modules/@databricks/appkit/node_modules/json-schema-traverse": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz",
+      "integrity": "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==",
+      "license": "MIT"
+    },
+    "node_modules/@databricks/lakebase": {
+      "version": "0.1.1",
+      "resolved": "https://registry.npmjs.org/@databricks/lakebase/-/lakebase-0.1.1.tgz",
+      "integrity": "sha512-aWpVnkvqrnZkKgPbRmRtN3qEZByCdkybFRaQ/pExb+eHofiT/6545fb/vHV3Hudjt/K5uRG7Fkfo0zicqwRzzA==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@databricks/sdk-experimental": "^0.16.0",
+        "@opentelemetry/api": "^1.9.0",
+        "pg": "^8.18.0"
+      }
+    },
+    "node_modules/@databricks/lakebase/node_modules/@databricks/sdk-experimental": {
+      "version": "0.16.0",
+      "resolved": "https://registry.npmjs.org/@databricks/sdk-experimental/-/sdk-experimental-0.16.0.tgz",
+      "integrity": "sha512-9c2RxWYoRDFupdt4ZnBc1IPE1XaXgN+/wyV4DVcEqOnIa31ep51OnwAD/3014BImfKdyXg32nmgrB9dwvB6+lg==",
       "license": "Apache-2.0",
       "dependencies": {
         "google-auth-library": "^10.5.0",
@@ -6860,6 +6937,45 @@
         "url": "https://github.com/sponsors/epoberezkin"
       }
     },
+    "node_modules/ajv-formats": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/ajv-formats/-/ajv-formats-3.0.1.tgz",
+      "integrity": "sha512-8iUql50EUR+uUcdRQ3HDqa6EVyo3docL8g5WJ3FNcWmu62IbkGUue/pEyLBW8VGKKucTPgqeks4fIU1DA4yowQ==",
+      "license": "MIT",
+      "dependencies": {
+        "ajv": "^8.0.0"
+      },
+      "peerDependencies": {
+        "ajv": "^8.0.0"
+      },
+      "peerDependenciesMeta": {
+        "ajv": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/ajv-formats/node_modules/ajv": {
+      "version": "8.18.0",
+      "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.18.0.tgz",
+      "integrity": "sha512-PlXPeEWMXMZ7sPYOHqmDyCJzcfNrUr3fGNKtezX14ykXOEIvyK81d+qydx89KY5O71FKMPaQ2vBfBFI5NHR63A==",
+      "license": "MIT",
+      "dependencies": {
+        "fast-deep-equal": "^3.1.3",
+        "fast-uri": "^3.0.1",
+        "json-schema-traverse": "^1.0.0",
+        "require-from-string": "^2.0.2"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/epoberezkin"
+      }
+    },
+    "node_modules/ajv-formats/node_modules/json-schema-traverse": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz",
+      "integrity": "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==",
+      "license": "MIT"
+    },
     "node_modules/ansi-regex": {
       "version": "5.0.1",
       "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
@@ -8779,6 +8895,22 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/fast-uri": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.0.tgz",
+      "integrity": "sha512-iPeeDKJSWf4IEOasVVrknXpaBV0IApz/gp7S2bb7Z4Lljbl2MGJRqInZiUrQwV16cpzw/D3S5j5Julj/gT52AA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/fastify"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/fastify"
+        }
+      ],
+      "license": "BSD-3-Clause"
+    },
     "node_modules/fdir": {
       "version": "6.5.0",
       "resolved": "https://registry.npmjs.org/fdir/-/fdir-6.5.0.tgz",
@@ -11745,6 +11877,15 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/require-from-string": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/require-from-string/-/require-from-string-2.0.2.tgz",
+      "integrity": "sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
     "node_modules/require-in-the-middle": {
       "version": "8.0.1",
       "resolved": "https://registry.npmjs.org/require-in-the-middle/-/require-in-the-middle-8.0.1.tgz",
diff --git a/template/package.json b/template/package.json
index 1b39bc82..15e4ea3d 100644
--- a/template/package.json
+++ b/template/package.json
@@ -31,8 +31,8 @@
   "license": "Unlicensed",
   "description": "{{.app_description}}",
   "dependencies": {
-    "@databricks/appkit": "0.5.2",
-    "@databricks/appkit-ui": "0.5.2",
+    "@databricks/appkit": "0.7.4",
+    "@databricks/appkit-ui": "0.7.4",
     "@databricks/sdk-experimental": "^0.14.2",
     "clsx": "^2.1.1",
     "embla-carousel-react": "^8.6.0",
diff --git a/tools/dist.ts b/tools/dist-appkit.ts
similarity index 65%
rename from tools/dist.ts
rename to tools/dist-appkit.ts
index 7ff61958..4f562795 100644
--- a/tools/dist.ts
+++ b/tools/dist-appkit.ts
@@ -12,33 +12,46 @@ fs.mkdirSync("tmp", { recursive: true });
 
 const pkg = JSON.parse(fs.readFileSync("package.json", "utf-8"));
 
+// Packages that are workspace-local but published separately — replace workspace:* with real version.
+// "shared" is intentionally excluded: it is bundled directly into appkit/appkit-ui via noExternal.
+const WORKSPACE_PACKAGE_REPLACEMENTS = ["@databricks/lakebase"];
+
 delete pkg.dependencies.shared;
 
+for (const depName of WORKSPACE_PACKAGE_REPLACEMENTS) {
+  if (pkg.dependencies?.[depName] === "workspace:*") {
+    const pkgDirName = depName.split("/").pop() ?? depName;
+    const depPkgPath = path.join(
+      __dirname,
+      `../packages/${pkgDirName}/package.json`,
+    );
+    const depPkg = JSON.parse(fs.readFileSync(depPkgPath, "utf-8"));
+    pkg.dependencies[depName] = `${depPkg.version}`;
+  }
+}
+
 pkg.exports = pkg.publishConfig.exports;
 delete pkg.publishConfig.exports;
 
-const isAppKitPackage = pkg.name?.startsWith("@databricks/appkit");
 const sharedBin = path.join(__dirname, "../packages/shared/bin/appkit.js");
 const sharedPostinstall = path.join(
   __dirname,
   "../packages/shared/scripts/postinstall.js",
 );
 
-// Add appkit bin and postinstall for @databricks/appkit* packages
-if (isAppKitPackage) {
-  if (fs.existsSync(sharedBin)) {
-    pkg.bin = pkg.bin || {};
-    pkg.bin.appkit = "./bin/appkit.js";
-  }
-  if (fs.existsSync(sharedPostinstall)) {
-    pkg.scripts = pkg.scripts || {};
-    pkg.scripts.postinstall = "node scripts/postinstall.js";
-  }
-
-  // Add CLI dependencies from shared package (required for bin commands to work)
-  pkg.dependencies = pkg.dependencies || {};
-  Object.assign(pkg.dependencies, CLI_DEPENDENCIES);
+// Add appkit bin and postinstall
+if (fs.existsSync(sharedBin)) {
+  pkg.bin = pkg.bin || {};
+  pkg.bin.appkit = "./bin/appkit.js";
 }
+if (fs.existsSync(sharedPostinstall)) {
+  pkg.scripts = pkg.scripts || {};
+  pkg.scripts.postinstall = "node scripts/postinstall.js";
+}
+
+// Add CLI dependencies from shared package (required for bin commands to work)
+pkg.dependencies = pkg.dependencies || {};
+Object.assign(pkg.dependencies, CLI_DEPENDENCIES);
 
 fs.writeFileSync("tmp/package.json", JSON.stringify(pkg, null, 2));
 
@@ -49,24 +62,22 @@ if (fs.existsSync("bin")) {
 }
 
 // Copy bin and scripts from shared package
-if (isAppKitPackage) {
-  if (fs.existsSync(sharedBin)) {
-    fs.mkdirSync("tmp/bin", { recursive: true });
-    fs.copyFileSync(sharedBin, "tmp/bin/appkit.js");
-
-    // Copy CLI code from shared/dist/cli to tmp/dist/cli
-    const sharedCliDist = path.join(__dirname, "../packages/shared/dist/cli");
-    if (fs.existsSync(sharedCliDist)) {
-      const tmpCliDist = "tmp/dist/cli";
-      fs.mkdirSync(tmpCliDist, { recursive: true });
-      fs.cpSync(sharedCliDist, tmpCliDist, { recursive: true });
-    }
-  }
-  if (fs.existsSync(sharedPostinstall)) {
-    fs.mkdirSync("tmp/scripts", { recursive: true });
-    fs.copyFileSync(sharedPostinstall, "tmp/scripts/postinstall.js");
+if (fs.existsSync(sharedBin)) {
+  fs.mkdirSync("tmp/bin", { recursive: true });
+  fs.copyFileSync(sharedBin, "tmp/bin/appkit.js");
+
+  // Copy CLI code from shared/dist/cli to tmp/dist/cli
+  const sharedCliDist = path.join(__dirname, "../packages/shared/dist/cli");
+  if (fs.existsSync(sharedCliDist)) {
+    const tmpCliDist = "tmp/dist/cli";
+    fs.mkdirSync(tmpCliDist, { recursive: true });
+    fs.cpSync(sharedCliDist, tmpCliDist, { recursive: true });
   }
 }
+if (fs.existsSync(sharedPostinstall)) {
+  fs.mkdirSync("tmp/scripts", { recursive: true });
+  fs.copyFileSync(sharedPostinstall, "tmp/scripts/postinstall.js");
+}
 
 // Copy documentation from docs/build into tmp/docs/
 const docsBuildPath = path.join(__dirname, "../docs/build");
@@ -120,9 +131,7 @@ The CLI will display the documentation content directly in the terminal.
 `;
 
 llmsContent = agentGuidance + llmsContent;
-
 fs.writeFileSync("tmp/llms.txt", llmsContent);
-
 // Copy llms.txt as CLAUDE.md (npm pack doesn't support symlinks)
 fs.copyFileSync("tmp/llms.txt", "tmp/CLAUDE.md");
 
diff --git a/tools/dist-lakebase.ts b/tools/dist-lakebase.ts
new file mode 100644
index 00000000..e34a7c41
--- /dev/null
+++ b/tools/dist-lakebase.ts
@@ -0,0 +1,25 @@
+import fs from "node:fs";
+import path from "node:path";
+
+const __dirname = path.dirname(new URL(import.meta.url).pathname);
+
+fs.mkdirSync("tmp", { recursive: true });
+
+const pkg = JSON.parse(fs.readFileSync("package.json", "utf-8"));
+
+pkg.exports = pkg.publishConfig.exports;
+delete pkg.publishConfig.exports;
+
+fs.writeFileSync("tmp/package.json", JSON.stringify(pkg, null, 2));
+
+fs.cpSync("dist", "tmp/dist", { recursive: true });
+
+// Use the package's own README.md if present, otherwise fall back to the root one
+const localReadme = "README.md";
+const rootReadme = path.join(__dirname, "../README.md");
+fs.copyFileSync(
+  fs.existsSync(localReadme) ? localReadme : rootReadme,
+  "tmp/README.md",
+);
+fs.copyFileSync(path.join(__dirname, "../LICENSE"), "tmp/LICENSE");
+fs.copyFileSync(path.join(__dirname, "../DCO"), "tmp/DCO");
diff --git a/tools/license-utils.ts b/tools/license-utils.ts
index f8a7e479..43247f05 100644
--- a/tools/license-utils.ts
+++ b/tools/license-utils.ts
@@ -18,6 +18,7 @@ type PackageJson = {
 export const PUBLISHED_PACKAGES = [
   "packages/appkit",
   "packages/appkit-ui",
+  "packages/lakebase",
   "packages/shared",
 ];
 
diff --git a/tools/playground/prepared-files/root-tsconfig.json b/tools/playground/prepared-files/root-tsconfig.json
index 8ccab043..0af6d48f 100644
--- a/tools/playground/prepared-files/root-tsconfig.json
+++ b/tools/playground/prepared-files/root-tsconfig.json
@@ -1,7 +1,11 @@
 {
   "compilerOptions": {
     "baseUrl": ".",
-    "outDir": "./build"
+    "outDir": "./build",
+    "experimentalDecorators": true,
+    "emitDecoratorMetadata": true,
+    "target": "ES2022",
+    "module": "ESNext"
   },
   "exclude": ["node_modules", "build"]
 }
diff --git a/tools/publish-template-tag.ts b/tools/publish-template-tag.ts
new file mode 100644
index 00000000..316539e6
--- /dev/null
+++ b/tools/publish-template-tag.ts
@@ -0,0 +1,90 @@
+#!/usr/bin/env tsx
+/**
+ * Syncs the template to the given version (with retry), then commits, tags
+ * template-vX.X.X, and pushes. Used by the Release workflow (sync-template job
+ * in .github/workflows/release.yml) and for manual runs.
+ */
+
+import { spawnSync } from "node:child_process";
+import { readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+const ROOT = process.cwd();
+const version = process.argv[2];
+if (!version) {
+  console.error("Usage: tsx tools/publish-template-tag.ts <version>");
+  process.exit(1);
+}
+
+function run(cmd: string, args: string[], opts: { cwd?: string } = {}): number {
+  const result = spawnSync(cmd, args, {
+    cwd: opts.cwd ?? ROOT,
+    stdio: "inherit",
+    shell: true,
+  });
+  return result.status ?? 1;
+}
+
+// 1. Update template package.json
+const templatePath = join(ROOT, "template", "package.json");
+const templateJson = JSON.parse(readFileSync(templatePath, "utf-8"));
+if (templateJson.dependencies) {
+  if ("@databricks/appkit" in templateJson.dependencies) {
+    templateJson.dependencies["@databricks/appkit"] = version;
+  }
+  if ("@databricks/appkit-ui" in templateJson.dependencies) {
+    templateJson.dependencies["@databricks/appkit-ui"] = version;
+  }
+  writeFileSync(templatePath, `${JSON.stringify(templateJson, null, 2)}\n`);
+  console.log(`✓ template/package.json → ${version}`);
+}
+
+// 2. npm install in template (with retry for registry propagation)
+const MAX_ATTEMPTS = 3;
+const templateDir = join(ROOT, "template");
+
+function sleep(ms: number): Promise<void> {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+async function runNpmInstallWithRetry(): Promise<number> {
+  let lastStatus = 0;
+  for (let attempt = 1; attempt <= MAX_ATTEMPTS; attempt++) {
+    const status = run("npm", ["install"], { cwd: templateDir });
+    lastStatus = status;
+    if (status === 0) {
+      console.log("✓ template/package-lock.json updated (npm install)");
+      return 0;
+    }
+    if (attempt < MAX_ATTEMPTS) {
+      const delayMs = 2 ** attempt * 1000;
+      console.warn(
+        `npm install failed (attempt ${attempt}/${MAX_ATTEMPTS}), retrying in ${delayMs / 1000}s...`,
+      );
+      await sleep(delayMs);
+    }
+  }
+  return lastStatus;
+}
+
+const installExit = await runNpmInstallWithRetry();
+if (installExit !== 0) {
+  console.error(`npm install failed after ${MAX_ATTEMPTS} attempts`);
+  process.exit(installExit);
+}
+
+// 3. Git add, commit, tag, push
+const commands: [string, string[]][] = [
+  ["git", ["add", "template/package.json", "template/package-lock.json"]],
+  ["git", ["commit", "-m", `"chore: sync template to v${version} [skip ci]"`]],
+  ["git", ["tag", `template-v${version}`]],
+  ["git", ["push", "origin", "main", "--follow-tags"]],
+];
+
+for (const [command, args] of commands) {
+  if (run(command, args) !== 0) {
+    process.exit(1);
+  }
+}
+
+console.log(`✓ template tag template-v${version} pushed`);
diff --git a/vitest.config.ts b/vitest.config.ts
index da6ca040..8c2893b0 100644
--- a/vitest.config.ts
+++ b/vitest.config.ts
@@ -42,6 +42,14 @@ export default defineConfig({
           environment: "node",
         },
       },
+      {
+        plugins: [tsconfigPaths()],
+        test: {
+          name: "lakebase",
+          root: "./packages/lakebase",
+          environment: "node",
+        },
+      },
       {
         plugins: [tsconfigPaths()],
         test: {