feat(go): add PGAdapter for PostgreSQL wire protocol proxy to DSQL

[amaksimo]

Summary

Adds a PostgreSQL wire protocol proxy (PGAdapter) that allows unmodified PostgreSQL clients like OpenFGA to connect to Aurora DSQL with automatic IAM authentication.

Problem: OpenFGA and other PostgreSQL clients use pgxpool.ParseConfig() which only recognizes postgres:// and postgresql:// schemes. When given a dsql:// URL, pgx falls back to Unix socket connections which fail.

Solution: A lightweight TCP proxy that:

• Accepts standard PostgreSQL connections on localhost
• Handles client authentication locally (no password required)
• Connects to DSQL with IAM token authentication
• Proxies all PostgreSQL wire protocol messages bidirectionally

This follows the same pattern as Google Spanner's PGAdapter.

Changes

• dsql/token.go: Export ResolveCredentialsProvider for reuse by pgadapter
• pgadapter/: New package implementing the PostgreSQL wire protocol proxy
  • config.go - Configuration types
  • adapter.go - Core adapter with ListenAndServe()
  • proxy.go - PostgreSQL protocol handling
  • adapter_test.go - Unit tests
• cmd/dsql-pgadapter/: CLI command
• example/test/pgadapter/: E2E integration test against real DSQL cluster
• .github/workflows/go-pgx-integ-tests.yml: Updated CI to run pgadapter tests

Usage

# Build
go build -o bin/dsql-pgadapter ./cmd/dsql-pgadapter

# Start adapter
./bin/dsql-pgadapter --endpoint xxx.dsql.us-east-1.on.aws

# Connect with any PostgreSQL client (unchanged)
psql -h 127.0.0.1 -p 5432 -U admin -d postgres

# Or run OpenFGA (unchanged)
openfga run --datastore-uri "postgres://[email protected]:5432/postgres?sslmode=disable"

Test plan

• Unit tests pass locally (go test ./pgadapter/...)
• Unit tests pass locally (go test ./dsql/...)
• E2E integration test passes against real DSQL cluster (CI will verify)
• Manual test with OpenFGA (pending CI success)