@aws-blocks/bb-distributed-data 0.1.0

package/dist/engines/dsql-mock-engine.d.ts

@@ -0,0 +1,28 @@
+import type { DatabaseEngine, TransactionHandle } from '@aws-blocks/data-common';
+export declare class DsqlMockEngine implements DatabaseEngine {
+    private db;
+    private closed;
+    private shouldConflict;
+    private _allowDdl;
+    constructor(dataDir: string);
+    /** Test helper: simulate OCC conflict on next commit. */
+    simulateConflict(): void;
+    /**
+     * Temporarily allow DDL statements (used by the migration runner).
+     * In normal app usage, DDL is rejected to match production behavior.
+     */
+    withDdl<T>(fn: () => Promise<T>): Promise<T>;
+    query<T>(sql: string, params?: unknown[]): Promise<T[]>;
+    execute(sql: string, params?: unknown[]): Promise<{
+        rowCount: number;
+    }>;
+    beginTransaction(): Promise<TransactionHandle>;
+    commitTransaction(handle: TransactionHandle): Promise<void>;
+    rollbackTransaction(handle: TransactionHandle): Promise<void>;
+    queryInTransaction<T>(handle: TransactionHandle, sql: string, params?: unknown[]): Promise<T[]>;
+    executeInTransaction(handle: TransactionHandle, sql: string, params?: unknown[]): Promise<{
+        rowCount: number;
+    }>;
+    destroy(): Promise<void>;
+}
+//# sourceMappingURL=dsql-mock-engine.d.ts.map

package/dist/engines/dsql-mock-engine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dsql-mock-engine.d.ts","sourceRoot":"","sources":["../../src/engines/dsql-mock-engine.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAoCjF,qBAAa,cAAe,YAAW,cAAc;IACnD,OAAO,CAAC,EAAE,CAAS;IACnB,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,cAAc,CAAS;IAC/B,OAAO,CAAC,SAAS,CAAS;gBAEd,OAAO,EAAE,MAAM;IAM3B,yDAAyD;IACzD,gBAAgB,IAAI,IAAI;IAExB;;;OAGG;IACG,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAK5C,KAAK,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC;IAMvD,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAMvE,gBAAgB,IAAI,OAAO,CAAC,iBAAiB,CAAC;IAK9C,iBAAiB,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAc3D,mBAAmB,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAK7D,kBAAkB,CAAC,CAAC,EAAE,MAAM,EAAE,iBAAiB,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC;IAO/F,oBAAoB,CAAC,MAAM,EAAE,iBAAiB,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAW/G,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAK/B"}

package/dist/engines/dsql-mock-engine.js

@@ -0,0 +1,132 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * PGlite engine wrapped with DSQL validation layer for local development.
+ */
+import { PGlite } from '@electric-sql/pglite';
+import { existsSync, unlinkSync, mkdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { DistributedDatabaseErrors, PG_SERIALIZATION_FAILURE, translateDsqlError } from '../errors.js';
+import { validateStatement, classifyStatement, TransactionTracker } from '../validation.js';
+function cleanStaleLock(dataDir) {
+    const pidFile = join(dataDir, 'postmaster.pid');
+    if (existsSync(pidFile)) {
+        try {
+            unlinkSync(pidFile);
+        }
+        catch { }
+    }
+}
+/**
+ * Preprocess a SQL statement for execution on the DSQL mock (PGlite).
+ *
+ * 1. Validates the statement against DSQL compatibility rules (throws on
+ *    unsupported features like FK, TRUNCATE, SERIAL, etc.).
+ * 2. Rejects DDL statements — in production the app Lambda only has
+ *    dsql:DbConnect (DML-only). DDL must go in migration files.
+ * 3. Normalizes DSQL-only syntax that PGlite doesn't understand — currently
+ *    just `CREATE [UNIQUE] INDEX ASYNC` (stripped to a synchronous CREATE INDEX).
+ *
+ * Returns the normalized SQL ready for PGlite execution.
+ */
+function preprocessSqlForDsqlMock(sql, { allowDdl = false } = {}) {
+    validateStatement(sql);
+    if (!allowDdl && classifyStatement(sql) === 'ddl') {
+        const err = new Error('DDL statements (CREATE, ALTER, DROP) are not allowed in the app runtime. ' +
+            'Use migration files instead — the migration Lambda has dsql:DbConnectAdmin for DDL.');
+        err.name = 'DsqlPermissionError';
+        throw err;
+    }
+    return sql.replace(/\b(CREATE\s+(?:UNIQUE\s+)?INDEX)\s+ASYNC\b/gi, '$1');
+}
+export class DsqlMockEngine {
+    db;
+    closed = false;
+    shouldConflict = false;
+    _allowDdl = false;
+    constructor(dataDir) {
+        cleanStaleLock(dataDir);
+        mkdirSync(dataDir, { recursive: true });
+        this.db = new PGlite(dataDir);
+    }
+    /** Test helper: simulate OCC conflict on next commit. */
+    simulateConflict() { this.shouldConflict = true; }
+    /**
+     * Temporarily allow DDL statements (used by the migration runner).
+     * In normal app usage, DDL is rejected to match production behavior.
+     */
+    async withDdl(fn) {
+        this._allowDdl = true;
+        try {
+            return await fn();
+        }
+        finally {
+            this._allowDdl = false;
+        }
+    }
+    async query(sql, params) {
+        const normalized = preprocessSqlForDsqlMock(sql, { allowDdl: this._allowDdl });
+        try {
+            return (await this.db.query(normalized, params)).rows;
+        }
+        catch (e) {
+            translateDsqlError(e);
+        }
+    }
+    async execute(sql, params) {
+        const normalized = preprocessSqlForDsqlMock(sql, { allowDdl: this._allowDdl });
+        try {
+            return { rowCount: (await this.db.query(normalized, params)).affectedRows ?? 0 };
+        }
+        catch (e) {
+            translateDsqlError(e);
+        }
+    }
+    async beginTransaction() {
+        await this.db.query('BEGIN');
+        return { active: true, tracker: new TransactionTracker() };
+    }
+    async commitTransaction(handle) {
+        if (this.shouldConflict) {
+            this.shouldConflict = false;
+            await this.db.query('ROLLBACK');
+            const err = Object.assign(new Error('SerializationFailureException: OCC conflict — transaction not committed.'), { code: PG_SERIALIZATION_FAILURE, name: DistributedDatabaseErrors.SerializationFailure });
+            throw err;
+        }
+        await this.db.query('COMMIT');
+        handle.tracker.reset();
+    }
+    async rollbackTransaction(handle) {
+        await this.db.query('ROLLBACK');
+        handle.tracker.reset();
+    }
+    async queryInTransaction(handle, sql, params) {
+        const normalized = preprocessSqlForDsqlMock(sql, { allowDdl: this._allowDdl });
+        handle.tracker.recordStatement(sql);
+        try {
+            return (await this.db.query(normalized, params)).rows;
+        }
+        catch (e) {
+            translateDsqlError(e);
+        }
+    }
+    async executeInTransaction(handle, sql, params) {
+        const normalized = preprocessSqlForDsqlMock(sql, { allowDdl: this._allowDdl });
+        const h = handle;
+        h.tracker.recordStatement(sql);
+        try {
+            const rowCount = (await this.db.query(normalized, params)).affectedRows ?? 0;
+            h.tracker.recordRowCount(rowCount);
+            return { rowCount };
+        }
+        catch (e) {
+            translateDsqlError(e);
+        }
+    }
+    async destroy() {
+        if (this.closed)
+            return;
+        this.closed = true;
+        await this.db.close();
+    }
+}

package/dist/errors.d.ts

@@ -0,0 +1,29 @@
+/**
+ * DSQL-specific error constants.
+ */
+export declare const DistributedDatabaseErrors: {
+    readonly QueryFailed: "QueryFailedException";
+    readonly ConnectionFailed: "ConnectionFailedException";
+    readonly TransactionFailed: "TransactionFailedException";
+    readonly UniqueConstraintViolation: "UniqueConstraintViolationException";
+    readonly SerializationFailure: "SerializationFailureException";
+    readonly TransactionRowLimitExceeded: "TransactionRowLimitExceededException";
+};
+/**
+ * PostgreSQL error codes used for DSQL error translation.
+ * @see https://www.postgresql.org/docs/current/errcodes-appendix.html
+ */
+/** Serialization failure — OCC conflict in DSQL. Class 40 (Transaction Rollback). */
+export declare const PG_SERIALIZATION_FAILURE = "40001";
+/** Unique constraint violation. Class 23 (Integrity Constraint Violation). */
+export declare const PG_UNIQUE_VIOLATION = "23505";
+/** Connection exception class prefix. Class 08 (Connection Exception). */
+export declare const PG_CONNECTION_EXCEPTION_CLASS = "08";
+/**
+ * Maximum rows mutated per DSQL transaction.
+ * @see https://docs.aws.amazon.com/aurora-dsql/latest/userguide/working-with-transactions.html
+ */
+export declare const TRANSACTION_ROW_LIMIT = 3000;
+/** Translate a pg error code to a DistributedDatabaseErrors name. */
+export declare function translateDsqlError(e: Error): never;
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAGA;;GAEG;AACH,eAAO,MAAM,yBAAyB;;;;;;;CAO5B,CAAC;AAEX;;;GAGG;AAEH,qFAAqF;AACrF,eAAO,MAAM,wBAAwB,UAAU,CAAC;AAChD,8EAA8E;AAC9E,eAAO,MAAM,mBAAmB,UAAU,CAAC;AAC3C,0EAA0E;AAC1E,eAAO,MAAM,6BAA6B,OAAO,CAAC;AAElD;;;GAGG;AACH,eAAO,MAAM,qBAAqB,OAAO,CAAC;AAE1C,qEAAqE;AACrE,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,KAAK,GAAG,KAAK,CAYlD"}

package/dist/errors.js

@@ -0,0 +1,45 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * DSQL-specific error constants.
+ */
+export const DistributedDatabaseErrors = {
+    QueryFailed: 'QueryFailedException',
+    ConnectionFailed: 'ConnectionFailedException',
+    TransactionFailed: 'TransactionFailedException',
+    UniqueConstraintViolation: 'UniqueConstraintViolationException',
+    SerializationFailure: 'SerializationFailureException',
+    TransactionRowLimitExceeded: 'TransactionRowLimitExceededException',
+};
+/**
+ * PostgreSQL error codes used for DSQL error translation.
+ * @see https://www.postgresql.org/docs/current/errcodes-appendix.html
+ */
+/** Serialization failure — OCC conflict in DSQL. Class 40 (Transaction Rollback). */
+export const PG_SERIALIZATION_FAILURE = '40001';
+/** Unique constraint violation. Class 23 (Integrity Constraint Violation). */
+export const PG_UNIQUE_VIOLATION = '23505';
+/** Connection exception class prefix. Class 08 (Connection Exception). */
+export const PG_CONNECTION_EXCEPTION_CLASS = '08';
+/**
+ * Maximum rows mutated per DSQL transaction.
+ * @see https://docs.aws.amazon.com/aurora-dsql/latest/userguide/working-with-transactions.html
+ */
+export const TRANSACTION_ROW_LIMIT = 3000;
+/** Translate a pg error code to a DistributedDatabaseErrors name. */
+export function translateDsqlError(e) {
+    const code = e.code;
+    if (code === PG_SERIALIZATION_FAILURE) {
+        e.name = DistributedDatabaseErrors.SerializationFailure;
+    }
+    else if (code === PG_UNIQUE_VIOLATION) {
+        e.name = DistributedDatabaseErrors.UniqueConstraintViolation;
+    }
+    else if (code && code.startsWith(PG_CONNECTION_EXCEPTION_CLASS)) {
+        e.name = DistributedDatabaseErrors.ConnectionFailed;
+    }
+    else {
+        e.name = DistributedDatabaseErrors.QueryFailed;
+    }
+    throw e;
+}

package/dist/errors.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=errors.test.d.ts.map

package/dist/errors.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.test.d.ts","sourceRoot":"","sources":["../src/errors.test.ts"],"names":[],"mappings":""}

package/dist/errors.test.js

@@ -0,0 +1,55 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Unit tests for DSQL error translation.
+ */
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { translateDsqlError, DistributedDatabaseErrors, PG_SERIALIZATION_FAILURE, PG_UNIQUE_VIOLATION, } from './errors.js';
+test('translateDsqlError: serialization failure (40001) → SerializationFailure', () => {
+    const err = Object.assign(new Error('conflict'), { code: PG_SERIALIZATION_FAILURE });
+    assert.throws(() => translateDsqlError(err), (e) => {
+        assert.equal(e.name, DistributedDatabaseErrors.SerializationFailure);
+        assert.equal(e.message, 'conflict');
+        return true;
+    });
+});
+test('translateDsqlError: unique violation (23505) → UniqueConstraintViolation', () => {
+    const err = Object.assign(new Error('duplicate key'), { code: PG_UNIQUE_VIOLATION });
+    assert.throws(() => translateDsqlError(err), (e) => {
+        assert.equal(e.name, DistributedDatabaseErrors.UniqueConstraintViolation);
+        return true;
+    });
+});
+test('translateDsqlError: connection error (08006) → ConnectionFailed', () => {
+    const err = Object.assign(new Error('connection refused'), { code: '08006' });
+    assert.throws(() => translateDsqlError(err), (e) => {
+        assert.equal(e.name, DistributedDatabaseErrors.ConnectionFailed);
+        return true;
+    });
+});
+test('translateDsqlError: connection error (08001) → ConnectionFailed', () => {
+    const err = Object.assign(new Error('unable to connect'), { code: '08001' });
+    assert.throws(() => translateDsqlError(err), (e) => {
+        assert.equal(e.name, DistributedDatabaseErrors.ConnectionFailed);
+        return true;
+    });
+});
+test('translateDsqlError: unknown pg error code → QueryFailed', () => {
+    const err = Object.assign(new Error('syntax error'), { code: '42601' });
+    assert.throws(() => translateDsqlError(err), (e) => {
+        assert.equal(e.name, DistributedDatabaseErrors.QueryFailed);
+        return true;
+    });
+});
+test('translateDsqlError: Error without code → QueryFailed', () => {
+    const err = new Error('something broke');
+    assert.throws(() => translateDsqlError(err), (e) => {
+        assert.equal(e.name, DistributedDatabaseErrors.QueryFailed);
+        assert.equal(e.message, 'something broke');
+        return true;
+    });
+});
+test('translateDsqlError: always throws (never returns)', () => {
+    assert.throws(() => translateDsqlError(new Error('test')));
+});

package/dist/index.aws.d.ts

@@ -0,0 +1,35 @@
+/**
+ * DistributedDatabase — AWS Lambda runtime entry point.
+ * pg driver + IAM token authentication.
+ */
+import { Scope } from '@aws-blocks/core';
+import type { ScopeParent } from '@aws-blocks/core';
+import { type SqlQuery, type Transaction } from '@aws-blocks/data-common';
+import type { DistributedDatabaseOptions, TransactionOptions } from './types.js';
+import type { ChildLogger } from '@aws-blocks/bb-logger';
+export declare class DistributedDatabase extends Scope {
+    private _base;
+    /** @internal Logger for internal operations. Defaults to error-level when not provided. */
+    protected log: ChildLogger;
+    constructor(scope: ScopeParent, id: string, _options?: DistributedDatabaseOptions);
+    private get base();
+    query<T>(query: SqlQuery): Promise<T[]>;
+    queryOne<T>(query: SqlQuery): Promise<T | null>;
+    execute(query: SqlQuery): Promise<{
+        rowCount: number;
+    }>;
+    /**
+     * Execute a function within a transaction with optional OCC retry.
+     *
+     * DSQL uses Optimistic Concurrency Control. Commit may fail with
+     * SerializationFailureException if another transaction modified the same rows.
+     */
+    transaction<T>(fn: (tx: Transaction) => Promise<T>, options?: TransactionOptions): Promise<T>;
+    /** @internal */
+    getEngine(): import("@aws-blocks/data-common").DatabaseEngine;
+}
+export { sql, createKyselyAdapter } from '@aws-blocks/data-common';
+export type { SqlQuery, Transaction } from '@aws-blocks/data-common';
+export { DistributedDatabaseErrors } from './errors.js';
+export type { DistributedDatabaseOptions, TransactionOptions } from './types.js';
+//# sourceMappingURL=index.aws.d.ts.map

package/dist/index.aws.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.aws.d.ts","sourceRoot":"","sources":["../src/index.aws.ts"],"names":[],"mappings":"AAGA;;;GAGG;AAEH,OAAO,EAAE,KAAK,EAA0B,MAAM,kBAAkB,CAAC;AACjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAgB,KAAK,QAAQ,EAAE,KAAK,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAIxF,OAAO,KAAK,EAAE,0BAA0B,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAGjF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAEzD,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,OAAO,CAAC,KAAK,CAA6B;IAE1C,2FAA2F;IAC3F,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC;gBAEf,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,0BAA0B;IAQjF,OAAO,KAAK,IAAI,GAiBf;IAED,KAAK,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC;IACvC,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;IAC/C,OAAO,CAAC,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAEvD;;;;;OAKG;IACG,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,CAAC,CAAC;IAInG,gBAAgB;IAChB,SAAS;CACV;AAED,OAAO,EAAE,GAAG,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AACnE,YAAY,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AACxD,YAAY,EAAE,0BAA0B,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC"}

package/dist/index.aws.js

@@ -0,0 +1,59 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * DistributedDatabase — AWS Lambda runtime entry point.
+ * pg driver + IAM token authentication.
+ */
+import { Scope, registerSdkIdentifiers } from '@aws-blocks/core';
+import { DatabaseBase } from '@aws-blocks/data-common';
+import { DsqlSigner } from '@aws-sdk/dsql-signer';
+import { DsqlEngine } from './engines/dsql-engine.js';
+import { transactionWithRetry } from './transaction.js';
+import { ENV_SANITIZE, sanitizeDbRoleName } from './constants.js';
+import { Logger } from '@aws-blocks/bb-logger';
+export class DistributedDatabase extends Scope {
+    _base = null;
+    /** @internal Logger for internal operations. Defaults to error-level when not provided. */
+    log;
+    constructor(scope, id, _options) {
+        super(id, { parent: scope });
+        this.log = _options?.logger ?? new Logger(this, 'logger', { level: 'error' });
+        const envName = this.fullId.replace(ENV_SANITIZE, '_');
+        const clusterEndpoint = process.env[`BLOCKS_${envName}_ENDPOINT`] ?? '';
+        registerSdkIdentifiers(this.fullId, { clusterEndpoint });
+    }
+    get base() {
+        if (!this._base) {
+            const envName = this.fullId.replace(ENV_SANITIZE, '_');
+            const endpoint = process.env[`BLOCKS_${envName}_ENDPOINT`];
+            const region = process.env[`BLOCKS_${envName}_REGION`];
+            if (!endpoint || !region) {
+                throw new Error(`Missing env: BLOCKS_${envName}_ENDPOINT / BLOCKS_${envName}_REGION`);
+            }
+            const dbRole = sanitizeDbRoleName(this.fullId);
+            const signer = new DsqlSigner({ hostname: endpoint, region });
+            this._base = new DatabaseBase(new DsqlEngine({
+                endpoint, region,
+                role: dbRole,
+                getAuthToken: () => signer.getDbConnectAuthToken(),
+            }));
+        }
+        return this._base;
+    }
+    query(query) { return this.base.query(query); }
+    queryOne(query) { return this.base.queryOne(query); }
+    execute(query) { return this.base.execute(query); }
+    /**
+     * Execute a function within a transaction with optional OCC retry.
+     *
+     * DSQL uses Optimistic Concurrency Control. Commit may fail with
+     * SerializationFailureException if another transaction modified the same rows.
+     */
+    async transaction(fn, options) {
+        return transactionWithRetry(this.base, fn, options);
+    }
+    /** @internal */
+    getEngine() { return this.base.getEngine(); }
+}
+export { sql, createKyselyAdapter } from '@aws-blocks/data-common';
+export { DistributedDatabaseErrors } from './errors.js';

package/dist/index.browser.d.ts

@@ -0,0 +1,5 @@
+export declare class DistributedDatabase {
+    constructor(..._args: any[]);
+}
+export { DistributedDatabaseErrors } from './errors.js';
+//# sourceMappingURL=index.browser.d.ts.map

package/dist/index.browser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.browser.d.ts","sourceRoot":"","sources":["../src/index.browser.ts"],"names":[],"mappings":"AAIA,qBAAa,mBAAmB;gBAClB,GAAG,KAAK,EAAE,GAAG,EAAE;CAC5B;AAED,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC"}

package/dist/index.browser.js

@@ -0,0 +1,7 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+// Browser stub — DistributedDatabase runs server-side only
+export class DistributedDatabase {
+    constructor(..._args) { }
+}
+export { DistributedDatabaseErrors } from './errors.js';

package/dist/index.cdk.d.ts

@@ -0,0 +1,16 @@
+/**
+ * DistributedDatabase — CDK infrastructure entry point.
+ * Provisions Aurora DSQL cluster via CloudFormation.
+ * Optionally runs migrations via a CustomResource Lambda.
+ */
+import { Scope } from '@aws-blocks/core/cdk';
+import type { ScopeParent } from '@aws-blocks/core';
+import type { DistributedDatabaseOptions } from './types.js';
+export declare class DistributedDatabase extends Scope {
+    constructor(scope: ScopeParent, id: string, options?: DistributedDatabaseOptions);
+}
+export { sql, createKyselyAdapter } from '@aws-blocks/data-common';
+export type { SqlQuery, Transaction } from '@aws-blocks/data-common';
+export { DistributedDatabaseErrors } from './errors.js';
+export type { DistributedDatabaseOptions } from './types.js';
+//# sourceMappingURL=index.cdk.d.ts.map

package/dist/index.cdk.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.cdk.d.ts","sourceRoot":"","sources":["../src/index.cdk.ts"],"names":[],"mappings":"AAGA;;;;GAIG;AAEH,OAAO,EAAE,KAAK,EAAwB,MAAM,sBAAsB,CAAC;AACnE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAQpD,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAG7D,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,0BAA0B;CAwFjF;AAaD,OAAO,EAAE,GAAG,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AACnE,YAAY,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AACxD,YAAY,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC"}

package/dist/index.cdk.js

@@ -0,0 +1,103 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * DistributedDatabase — CDK infrastructure entry point.
+ * Provisions Aurora DSQL cluster via CloudFormation.
+ * Optionally runs migrations via a CustomResource Lambda.
+ */
+import { Scope, DEFAULT_NODE_RUNTIME } from '@aws-blocks/core/cdk';
+import * as cdk from 'aws-cdk-lib';
+import * as iam from 'aws-cdk-lib/aws-iam';
+import * as lambda from 'aws-cdk-lib/aws-lambda-nodejs';
+import * as cr from 'aws-cdk-lib/custom-resources';
+import { createHash } from 'node:crypto';
+import { readdirSync, readFileSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { LAMBDA_MIGRATIONS_DIR, MIGRATION_LAMBDA_TIMEOUT_MINUTES, ENV_SANITIZE, sanitizeDbRoleName } from './constants.js';
+export class DistributedDatabase extends Scope {
+    constructor(scope, id, options) {
+        super(id, { parent: scope });
+        const stack = cdk.Stack.of(this);
+        const isSandbox = stack.node.tryGetContext('sandboxMode') === 'true';
+        const envName = this.fullId.replace(ENV_SANITIZE, '_');
+        const region = stack.region;
+        const dbRole = sanitizeDbRoleName(this.fullId);
+        // DSQL Cluster — respect explicit removalPolicy; default to DESTROY in sandbox, RETAIN otherwise.
+        const shouldDestroy = options?.removalPolicy === 'destroy' || (!options?.removalPolicy && isSandbox);
+        const removalPolicy = shouldDestroy ? cdk.RemovalPolicy.DESTROY : cdk.RemovalPolicy.RETAIN;
+        const cluster = new cdk.CfnResource(stack, `${this.fullId}DsqlCluster`, {
+            type: 'AWS::DSQL::Cluster',
+            properties: {
+                DeletionProtectionEnabled: removalPolicy !== cdk.RemovalPolicy.DESTROY,
+            },
+        });
+        cluster.applyRemovalPolicy(removalPolicy);
+        const endpoint = cluster.getAtt('Endpoint').toString();
+        // Env vars for runtime
+        this.handler.addEnvironment(`BLOCKS_${envName}_ENDPOINT`, endpoint);
+        this.handler.addEnvironment(`BLOCKS_${envName}_REGION`, region);
+        // IAM grant — app Lambda gets DML-only access via custom DB role (least privilege)
+        this.handler.addToRolePolicy(new iam.PolicyStatement({
+            actions: ['dsql:DbConnect'],
+            resources: [`arn:aws:dsql:${region}:${stack.account}:cluster/${cluster.ref}`],
+        }));
+        new cdk.CfnOutput(stack, `${this.fullId}DsqlEndpoint`, { value: endpoint });
+        // The app Lambda's IAM role ARN is needed to map the custom DB role.
+        const appRoleArn = this.handler.role.roleArn;
+        // Resolve migrations path if provided
+        const resolvedMigrationsPath = options?.migrationsPath ? resolve(options.migrationsPath) : undefined;
+        const migrationsHash = resolvedMigrationsPath ? hashMigrationsDir(resolvedMigrationsPath) : 'no-migrations';
+        // Migration/provisioning Lambda — always created to provision the app DB role.
+        // Also runs .sql migrations when migrationsPath is provided.
+        const migrationFn = new lambda.NodejsFunction(stack, `${this.fullId}DsqlMigrationFn`, {
+            // Points at the compiled migration-lambda.js in dist/ (same directory as this file at runtime).
+            // Must NOT use ../src/migration-lambda.ts — src/ is excluded from the published package.
+            entry: join(import.meta.dirname ?? new URL('.', import.meta.url).pathname, 'migration-lambda.js'),
+            handler: 'handler',
+            runtime: DEFAULT_NODE_RUNTIME,
+            timeout: cdk.Duration.minutes(MIGRATION_LAMBDA_TIMEOUT_MINUTES),
+            environment: {
+                DSQL_ENDPOINT: endpoint,
+                DSQL_REGION: region,
+                MIGRATIONS_DIR: LAMBDA_MIGRATIONS_DIR,
+                APP_ROLE_ARN: appRoleArn,
+                DB_ROLE_NAME: dbRole,
+            },
+            bundling: {
+                commandHooks: {
+                    beforeBundling: () => [],
+                    beforeInstall: () => [],
+                    afterBundling: (_inputDir, outputDir) => resolvedMigrationsPath
+                        ? [`cp -r ${resolvedMigrationsPath} ${outputDir}${LAMBDA_MIGRATIONS_DIR.replace('/var/task', '')}`]
+                        : [],
+                },
+            },
+        });
+        // Migration Lambda needs Admin access (DDL + role management)
+        migrationFn.addToRolePolicy(new iam.PolicyStatement({
+            actions: ['dsql:DbConnectAdmin'],
+            resources: [`arn:aws:dsql:${region}:${stack.account}:cluster/${cluster.ref}`],
+        }));
+        const provider = new cr.Provider(stack, `${this.fullId}DsqlMigrationProvider`, {
+            onEventHandler: migrationFn,
+        });
+        const migrationCR = new cdk.CustomResource(stack, `${this.fullId}DsqlMigrationCR`, {
+            serviceToken: provider.serviceToken,
+            properties: { migrationsHash, dbRole },
+        });
+        // Ensure migrations run after cluster is created
+        migrationCR.node.addDependency(cluster);
+    }
+}
+/** Hash all .sql files in a directory to detect changes. */
+function hashMigrationsDir(dir) {
+    const hash = createHash('sha256');
+    const files = readdirSync(dir).filter(f => f.endsWith('.sql')).sort();
+    for (const file of files) {
+        hash.update(file);
+        hash.update(readFileSync(join(dir, file), 'utf-8'));
+    }
+    return hash.digest('hex').slice(0, 16);
+}
+export { sql, createKyselyAdapter } from '@aws-blocks/data-common';
+export { DistributedDatabaseErrors } from './errors.js';

package/dist/index.cdk.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=index.cdk.test.d.ts.map

package/dist/index.cdk.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.cdk.test.d.ts","sourceRoot":"","sources":["../src/index.cdk.test.ts"],"names":[],"mappings":""}