Cloud SQL IAM auth on Cloud Run with Postgres.js (without the connector package in your app)

After a week that reminded everyone how much trust sits in every extra layer, here's the production pattern we use to keep Cloud Run + Cloud SQL auth simpler — and the 1-hour IAM token trap most examples miss. This week was a good reminder that infrastructure is never just infrastructure. Vercel disclosed a security incident that it said originated from a compromised third-party AI tool and ultimately exposed access to some internal environments and a limited subset of customer-related data. At