@aws/nx-plugin 1.0.0-rc.7 → 1.0.0-rc.71

package/src/utils/py.js

@@ -1,90 +1,115 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.addWorkspaceDependencyToPyProject = exports.uvxCommand = exports.addDependenciesToDependencyGroupInPyProjectToml = exports.addDependenciesToPyProjectToml = void 0;
 /**
  * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
- */
-const toml_1 = require("@iarna/toml");
-const devkit_1 = require("@nx/devkit");
-const pip_requirements_js_1 = require("pip-requirements-js");
-const toml_2 = require("./toml");
-const versions_1 = require("./versions");
+ */ import { parse, stringify } from "@iarna/toml";
+import { joinPathFragments } from "@nx/devkit";
+import { parsePipRequirementsLine } from "pip-requirements-js";
+import { normalizeDistributionName } from "./names.js";
+import { readToml, updateToml } from "./toml.js";
+import { PY_VERSIONS, withPyVersions } from "./versions.js";
 // Dedup key that distinguishes bare packages from the same package with
 // extras (e.g. `foo` vs `foo[bar]`), so adding a bare dep doesn't drop a
 // previously-added variant with extras.
-const depKey = (dep) => {
-    const parsed = (0, pip_requirements_js_1.parsePipRequirementsLine)(dep);
+const depKey = (dep)=>{
+    const parsed = parsePipRequirementsLine(dep);
     if (parsed?.type !== 'ProjectName') {
         return dep;
     }
-    const extras = [...(parsed.extras ?? [])].sort().join(',');
+    const extras = [
+        ...parsed.extras ?? []
+    ].sort().join(',');
     return extras ? `${parsed.name}[${extras}]` : parsed.name;
 };
-const mergeDeps = (existing, deps) => {
-    const incomingKeys = new Set(deps.map(depKey));
-    return [
-        ...(existing ?? []).filter((dep) => !incomingKeys.has(depKey(dep))),
-        ...(0, versions_1.withPyVersions)(deps),
-    ];
+const mergeDeps = (declaration, existing, deps)=>{
+    // Update deps in place by key so re-running does not reorder the list:
+    // existing deps keep their position (with their version refreshed), and only
+    // genuinely-new deps are appended.
+    const incoming = new Map(withPyVersions(declaration, deps).map((d)=>[
+            depKey(d),
+            d
+        ]));
+    const merged = (existing ?? []).map((dep)=>incoming.get(depKey(dep)) ?? dep);
+    const existingKeys = new Set((existing ?? []).map(depKey));
+    for (const [key, dep] of incoming){
+        if (!existingKeys.has(key)) {
+            merged.push(dep);
+        }
+    }
+    return merged;
 };
 /**
  * Add dependencies to a pyproject.toml file
- */
-const addDependenciesToPyProjectToml = (tree, projectRoot, deps) => {
-    const projectToml = (0, toml_1.parse)(tree.read((0, devkit_1.joinPathFragments)(projectRoot, 'pyproject.toml'), 'utf8'));
-    projectToml.project.dependencies = mergeDeps(projectToml.project?.dependencies, deps);
-    tree.write((0, devkit_1.joinPathFragments)(projectRoot, 'pyproject.toml'), (0, toml_1.stringify)(projectToml));
+ */ export const addDependenciesToPyProjectToml = (tree, projectRoot, declaration, deps)=>{
+    const projectToml = parse(tree.read(joinPathFragments(projectRoot, 'pyproject.toml'), 'utf8'));
+    projectToml.project.dependencies = mergeDeps(declaration, projectToml.project?.dependencies, deps);
+    tree.write(joinPathFragments(projectRoot, 'pyproject.toml'), stringify(projectToml));
 };
-exports.addDependenciesToPyProjectToml = addDependenciesToPyProjectToml;
-const addDependenciesToDependencyGroupInPyProjectToml = (tree, projectRoot, group, deps) => {
-    const projectToml = (0, toml_1.parse)(tree.read((0, devkit_1.joinPathFragments)(projectRoot, 'pyproject.toml'), 'utf8'));
+export const addDependenciesToDependencyGroupInPyProjectToml = (tree, projectRoot, group, declaration, deps)=>{
+    const projectToml = parse(tree.read(joinPathFragments(projectRoot, 'pyproject.toml'), 'utf8'));
     projectToml['dependency-groups'] = {
         ...projectToml['dependency-groups'],
-        [group]: mergeDeps(projectToml['dependency-groups']?.[group], deps),
+        [group]: mergeDeps(declaration, projectToml['dependency-groups']?.[group], deps)
     };
-    tree.write((0, devkit_1.joinPathFragments)(projectRoot, 'pyproject.toml'), (0, toml_1.stringify)(projectToml));
+    tree.write(joinPathFragments(projectRoot, 'pyproject.toml'), stringify(projectToml));
 };
-exports.addDependenciesToDependencyGroupInPyProjectToml = addDependenciesToDependencyGroupInPyProjectToml;
 /**
  * Render a uvx command for a given dependency
  * Pins the version to the one specified in versions.ts
  * Optionally specify withDeps to render uvx --with dep==version
- */
-const uvxCommand = (dep, args, withDeps) => {
-    return `uvx --from ${(0, versions_1.withPyVersions)([dep])[0]} ${withDeps
-        ? `${withDeps
-            .map(({ dep, version, specifier }) => `--with ${dep}${specifier ?? '=='}${version}`)
-            .join(' ')} `
-        : ''}${dep}${args ? ` ${args}` : ''}`;
+ */ export const uvxCommand = (dep, args, withDeps)=>{
+    // Pins the tool for a one-off invocation; nothing is added to a manifest, so
+    // this needs no declaration.
+    return `uvx --from ${dep}${PY_VERSIONS[dep]} ${withDeps ? `${withDeps.map(({ dep, version, specifier })=>`--with ${dep}${specifier ?? '=='}${version}`).join(' ')} ` : ''}${dep}${args ? ` ${args}` : ''}`;
+};
+/**
+ * Resolve the PEP 503 distribution name of a Python project from its
+ * `pyproject.toml` `[project].name`, falling back to normalising the supplied
+ * Nx project id when the project has no readable pyproject yet.
+ *
+ * This is the authoritative name uv writes into `uv.lock`, so it is the value
+ * that must appear in a dependent's `[project].dependencies` /
+ * `[tool.uv.sources]` for `@nxlv/python` to infer the workspace dependency
+ * edge. Always normalised so the result is a valid distribution name even if
+ * an older project still carries a dotted `[project].name`.
+ */ const getPyDistributionName = (tree, project)=>{
+    const pyprojectPath = joinPathFragments(project.root, 'pyproject.toml');
+    const projectName = tree.exists(pyprojectPath) ? readToml(tree, pyprojectPath).project?.name : undefined;
+    return normalizeDistributionName(projectName ?? project.name ?? '');
 };
-exports.uvxCommand = uvxCommand;
 /**
  * Add a workspace dependency from one Python project to another.
  * Adds the dependency to [project].dependencies and [tool.uv.sources].
- */
-const addWorkspaceDependencyToPyProject = (tree, projectRoot, dependencyPackageName) => {
-    const pyprojectPath = (0, devkit_1.joinPathFragments)(projectRoot, 'pyproject.toml');
+ *
+ * Both projects are passed as Nx project configurations (not names): the
+ * dependency's PEP 503 distribution name is derived from its own
+ * `pyproject.toml` here, so callers cannot accidentally pass the dotted Nx id
+ * (which @nxlv/python splits on `.` and drops, losing the project-graph edge).
+ * This is the single entry point all generators use to wire a Python workspace
+ * dependency.
+ */ export const addWorkspaceDependencyToPyProject = (tree, dependentProject, dependencyProject)=>{
+    const pyprojectPath = joinPathFragments(dependentProject.root, 'pyproject.toml');
     if (!tree.exists(pyprojectPath)) {
         return;
     }
-    (0, toml_2.updateToml)(tree, pyprojectPath, (toml) => {
+    const distributionName = getPyDistributionName(tree, dependencyProject);
+    updateToml(tree, pyprojectPath, (toml)=>{
         // Add to [project].dependencies if not already present
         const deps = toml.project?.dependencies ?? [];
-        if (!deps.some((d) => d === dependencyPackageName ||
-            d.startsWith(`${dependencyPackageName}>=`) ||
-            d.startsWith(`${dependencyPackageName}==`))) {
-            toml.project.dependencies = [...deps, dependencyPackageName];
+        if (!deps.some((d)=>d === distributionName || d.startsWith(`${distributionName}>=`) || d.startsWith(`${distributionName}==`))) {
+            toml.project.dependencies = [
+                ...deps,
+                distributionName
+            ];
         }
         // Add to [tool.uv.sources] with workspace = true
         toml.tool = toml.tool ?? {};
         toml.tool.uv = toml.tool.uv ?? {};
         toml.tool.uv.sources = toml.tool.uv.sources ?? {};
-        toml.tool.uv.sources[dependencyPackageName] = {
-            workspace: true,
+        toml.tool.uv.sources[distributionName] = {
+            workspace: true
         };
         return toml;
     });
 };
-exports.addWorkspaceDependencyToPyProject = addWorkspaceDependencyToPyProject;
+
 //# sourceMappingURL=py.js.map

package/src/utils/py.js.map

@@ -1 +1 @@
-{"version":3,"file":"py.js","sourceRoot":"","sources":["../../../../../packages/nx-plugin/src/utils/py.ts"],"names":[],"mappings":";;;AAAA;;;GAGG;AACH,sCAA+C;AAC/C,uCAA0D;AAC1D,6DAA+D;AAE/D,iCAAoC;AACpC,yCAAgE;AAEhE,wEAAwE;AACxE,yEAAyE;AACzE,wCAAwC;AACxC,MAAM,MAAM,GAAG,CAAC,GAAW,EAAU,EAAE;IACrC,MAAM,MAAM,GAAG,IAAA,8CAAwB,EAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,MAAM,EAAE,IAAI,KAAK,aAAa,EAAE,CAAC;QACnC,OAAO,GAAG,CAAC;IACb,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3D,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;AAC5D,CAAC,CAAC;AAEF,MAAM,SAAS,GAAG,CAChB,QAAuC,EACvC,IAAqB,EACX,EAAE;IACZ,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/C,OAAO;QACL,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACnE,GAAG,IAAA,yBAAc,EAAC,IAAI,CAAC;KACxB,CAAC;AACJ,CAAC,CAAC;AAEF;;GAEG;AACI,MAAM,8BAA8B,GAAG,CAC5C,IAAU,EACV,WAAmB,EACnB,IAAqB,EACrB,EAAE;IACF,MAAM,WAAW,GAAG,IAAA,YAAK,EACvB,IAAI,CAAC,IAAI,CAAC,IAAA,0BAAiB,EAAC,WAAW,EAAE,gBAAgB,CAAC,EAAE,MAAM,CAAC,CACjD,CAAC;IACrB,WAAW,CAAC,OAAO,CAAC,YAAY,GAAG,SAAS,CAC1C,WAAW,CAAC,OAAO,EAAE,YAAY,EACjC,IAAI,CACL,CAAC;IACF,IAAI,CAAC,KAAK,CACR,IAAA,0BAAiB,EAAC,WAAW,EAAE,gBAAgB,CAAC,EAChD,IAAA,gBAAS,EAAC,WAAW,CAAC,CACvB,CAAC;AACJ,CAAC,CAAC;AAhBW,QAAA,8BAA8B,kCAgBzC;AAEK,MAAM,+CAA+C,GAAG,CAC7D,IAAU,EACV,WAAmB,EACnB,KAAa,EACb,IAAqB,EACrB,EAAE;IACF,MAAM,WAAW,GAAG,IAAA,YAAK,EACvB,IAAI,CAAC,IAAI,CAAC,IAAA,0BAAiB,EAAC,WAAW,EAAE,gBAAgB,CAAC,EAAE,MAAM,CAAC,CACjD,CAAC;IACrB,WAAW,CAAC,mBAAmB,CAAC,GAAG;QACjC,GAAG,WAAW,CAAC,mBAAmB,CAAC;QACnC,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC,WAAW,CAAC,mBAAmB,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC;KACpE,CAAC;IACF,IAAI,CAAC,KAAK,CACR,IAAA,0BAAiB,EAAC,WAAW,EAAE,gBAAgB,CAAC,EAChD,IAAA,gBAAS,EAAC,WAAW,CAAC,CACvB,CAAC;AACJ,CAAC,CAAC;AAjBW,QAAA,+CAA+C,mDAiB1D;AAQF;;;;GAIG;AACI,MAAM,UAAU,GAAG,CACxB,GAAkB,EAClB,IAAa,EACb,QAAuB,EACf,EAAE;IACV,OAAO,cAAc,IAAA,yBAAc,EAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAC3C,QAAQ;QACN,CAAC,CAAC,GAAG,QAAQ;aACR,GAAG,CACF,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,CAC9B,UAAU,GAAG,GAAG,SAAS,IAAI,IAAI,GAAG,OAAO,EAAE,CAChD;aACA,IAAI,CAAC,GAAG,CAAC,GAAG;QACjB,CAAC,CAAC,EACN,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AACpC,CAAC,CAAC;AAfW,QAAA,UAAU,cAerB;AAEF;;;GAGG;AACI,MAAM,iCAAiC,GAAG,CAC/C,IAAU,EACV,WAAmB,EACnB,qBAA6B,EACvB,EAAE;IACR,MAAM,aAAa,GAAG,IAAA,0BAAiB,EAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;IACvE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;QAChC,OAAO;IACT,CAAC;IAED,IAAA,iBAAU,EAAC,IAAI,EAAE,aAAa,EAAE,CAAC,IAAqB,EAAE,EAAE;QACxD,uDAAuD;QACvD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,YAAY,IAAI,EAAE,CAAC;QAC9C,IACE,CAAC,IAAI,CAAC,IAAI,CACR,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,KAAK,qBAAqB;YAC3B,CAAC,CAAC,UAAU,CAAC,GAAG,qBAAqB,IAAI,CAAC;YAC1C,CAAC,CAAC,UAAU,CAAC,GAAG,qBAAqB,IAAI,CAAC,CAC7C,EACD,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,YAAY,GAAG,CAAC,GAAG,IAAI,EAAE,qBAAqB,CAAC,CAAC;QAC/D,CAAC;QAED,iDAAiD;QACjD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;QAC3B,IAAI,CAAC,IAAY,CAAC,EAAE,GAAI,IAAI,CAAC,IAAY,CAAC,EAAE,IAAI,EAAE,CAAC;QACnD,IAAI,CAAC,IAAY,CAAC,EAAE,CAAC,OAAO,GAAI,IAAI,CAAC,IAAY,CAAC,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC;QACnE,IAAI,CAAC,IAAY,CAAC,EAAE,CAAC,OAAO,CAAC,qBAAqB,CAAC,GAAG;YACrD,SAAS,EAAE,IAAI;SAChB,CAAC;QAEF,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAlCW,QAAA,iCAAiC,qCAkC5C"}
+{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/py.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport { parse, stringify } from '@iarna/toml';\nimport { joinPathFragments, type Tree } from '@nx/devkit';\nimport { parsePipRequirementsLine } from 'pip-requirements-js';\nimport type {\n  DeclaredPy,\n  DependencyDeclaration,\n} from './declared-dependencies';\nimport { normalizeDistributionName } from './names';\nimport type { UVPyprojectToml } from './nxlv-python';\nimport { readToml, updateToml } from './toml';\nimport { type IPyDepVersion, PY_VERSIONS, withPyVersions } from './versions';\n\n// Dedup key that distinguishes bare packages from the same package with\n// extras (e.g. `foo` vs `foo[bar]`), so adding a bare dep doesn't drop a\n// previously-added variant with extras.\nconst depKey = (dep: string): string => {\n  const parsed = parsePipRequirementsLine(dep);\n  if (parsed?.type !== 'ProjectName') {\n    return dep;\n  }\n  const extras = [...(parsed.extras ?? [])].sort().join(',');\n  return extras ? `${parsed.name}[${extras}]` : parsed.name;\n};\n\nconst mergeDeps = (\n  declaration: DependencyDeclaration,\n  existing: readonly string[] | undefined,\n  deps: readonly IPyDepVersion[],\n): string[] => {\n  // Update deps in place by key so re-running does not reorder the list:\n  // existing deps keep their position (with their version refreshed), and only\n  // genuinely-new deps are appended.\n  const incoming = new Map(\n    withPyVersions(declaration, deps).map((d) => [depKey(d), d]),\n  );\n  const merged = (existing ?? []).map(\n    (dep) => incoming.get(depKey(dep)) ?? dep,\n  );\n  const existingKeys = new Set((existing ?? []).map(depKey));\n  for (const [key, dep] of incoming) {\n    if (!existingKeys.has(key)) {\n      merged.push(dep);\n    }\n  }\n  return merged;\n};\n\n/**\n * Add dependencies to a pyproject.toml file\n */\nexport const addDependenciesToPyProjectToml = <\n  const D extends DependencyDeclaration,\n>(\n  tree: Tree,\n  projectRoot: string,\n  declaration: D,\n  deps: readonly DeclaredPy<D>[],\n) => {\n  const projectToml = parse(\n    tree.read(joinPathFragments(projectRoot, 'pyproject.toml'), 'utf8'),\n  ) as UVPyprojectToml;\n  projectToml.project.dependencies = mergeDeps(\n    declaration,\n    projectToml.project?.dependencies,\n    deps,\n  );\n  tree.write(\n    joinPathFragments(projectRoot, 'pyproject.toml'),\n    stringify(projectToml),\n  );\n};\n\nexport const addDependenciesToDependencyGroupInPyProjectToml = <\n  const D extends DependencyDeclaration,\n>(\n  tree: Tree,\n  projectRoot: string,\n  group: string,\n  declaration: D,\n  deps: readonly DeclaredPy<D>[],\n) => {\n  const projectToml = parse(\n    tree.read(joinPathFragments(projectRoot, 'pyproject.toml'), 'utf8'),\n  ) as UVPyprojectToml;\n  projectToml['dependency-groups'] = {\n    ...projectToml['dependency-groups'],\n    [group]: mergeDeps(\n      declaration,\n      projectToml['dependency-groups']?.[group],\n      deps,\n    ),\n  };\n  tree.write(\n    joinPathFragments(projectRoot, 'pyproject.toml'),\n    stringify(projectToml),\n  );\n};\n\nexport interface UvxWithDep {\n  dep: string;\n  version: string;\n  specifier?: string;\n}\n\n/**\n * Render a uvx command for a given dependency\n * Pins the version to the one specified in versions.ts\n * Optionally specify withDeps to render uvx --with dep==version\n */\nexport const uvxCommand = (\n  dep: IPyDepVersion,\n  args?: string,\n  withDeps?: UvxWithDep[],\n): string => {\n  // Pins the tool for a one-off invocation; nothing is added to a manifest, so\n  // this needs no declaration.\n  return `uvx --from ${dep}${PY_VERSIONS[dep]} ${\n    withDeps\n      ? `${withDeps\n          .map(\n            ({ dep, version, specifier }) =>\n              `--with ${dep}${specifier ?? '=='}${version}`,\n          )\n          .join(' ')} `\n      : ''\n  }${dep}${args ? ` ${args}` : ''}`;\n};\n\n/**\n * Resolve the PEP 503 distribution name of a Python project from its\n * `pyproject.toml` `[project].name`, falling back to normalising the supplied\n * Nx project id when the project has no readable pyproject yet.\n *\n * This is the authoritative name uv writes into `uv.lock`, so it is the value\n * that must appear in a dependent's `[project].dependencies` /\n * `[tool.uv.sources]` for `@nxlv/python` to infer the workspace dependency\n * edge. Always normalised so the result is a valid distribution name even if\n * an older project still carries a dotted `[project].name`.\n */\nconst getPyDistributionName = (\n  tree: Tree,\n  project: { name?: string; root: string },\n): string => {\n  const pyprojectPath = joinPathFragments(project.root, 'pyproject.toml');\n  const projectName = tree.exists(pyprojectPath)\n    ? (readToml(tree, pyprojectPath) as unknown as UVPyprojectToml).project\n        ?.name\n    : undefined;\n  return normalizeDistributionName(projectName ?? project.name ?? '');\n};\n\n/**\n * Add a workspace dependency from one Python project to another.\n * Adds the dependency to [project].dependencies and [tool.uv.sources].\n *\n * Both projects are passed as Nx project configurations (not names): the\n * dependency's PEP 503 distribution name is derived from its own\n * `pyproject.toml` here, so callers cannot accidentally pass the dotted Nx id\n * (which @nxlv/python splits on `.` and drops, losing the project-graph edge).\n * This is the single entry point all generators use to wire a Python workspace\n * dependency.\n */\nexport const addWorkspaceDependencyToPyProject = (\n  tree: Tree,\n  dependentProject: { name?: string; root: string },\n  dependencyProject: { name?: string; root: string },\n): void => {\n  const pyprojectPath = joinPathFragments(\n    dependentProject.root,\n    'pyproject.toml',\n  );\n  if (!tree.exists(pyprojectPath)) {\n    return;\n  }\n\n  const distributionName = getPyDistributionName(tree, dependencyProject);\n\n  updateToml(tree, pyprojectPath, (toml: UVPyprojectToml) => {\n    // Add to [project].dependencies if not already present\n    const deps = toml.project?.dependencies ?? [];\n    if (\n      !deps.some(\n        (d) =>\n          d === distributionName ||\n          d.startsWith(`${distributionName}>=`) ||\n          d.startsWith(`${distributionName}==`),\n      )\n    ) {\n      toml.project.dependencies = [...deps, distributionName];\n    }\n\n    // Add to [tool.uv.sources] with workspace = true\n    toml.tool = toml.tool ?? {};\n    (toml.tool as any).uv = (toml.tool as any).uv ?? {};\n    (toml.tool as any).uv.sources = (toml.tool as any).uv.sources ?? {};\n    (toml.tool as any).uv.sources[distributionName] = {\n      workspace: true,\n    };\n\n    return toml;\n  });\n};\n"],"names":["parse","stringify","joinPathFragments","parsePipRequirementsLine","normalizeDistributionName","readToml","updateToml","PY_VERSIONS","withPyVersions","depKey","dep","parsed","type","extras","sort","join","name","mergeDeps","declaration","existing","deps","incoming","Map","map","d","merged","get","existingKeys","Set","key","has","push","addDependenciesToPyProjectToml","tree","projectRoot","projectToml","read","project","dependencies","write","addDependenciesToDependencyGroupInPyProjectToml","group","uvxCommand","args","withDeps","version","specifier","getPyDistributionName","pyprojectPath","root","projectName","exists","undefined","addWorkspaceDependencyToPyProject","dependentProject","dependencyProject","distributionName","toml","some","startsWith","tool","uv","sources","workspace"],"mappings":"AAAA;;;CAGC,GACD,SAASA,KAAK,EAAEC,SAAS,QAAQ,cAAc;AAC/C,SAASC,iBAAiB,QAAmB,aAAa;AAC1D,SAASC,wBAAwB,QAAQ,sBAAsB;AAK/D,SAASC,yBAAyB,QAAQ,aAAU;AAEpD,SAASC,QAAQ,EAAEC,UAAU,QAAQ,YAAS;AAC9C,SAA6BC,WAAW,EAAEC,cAAc,QAAQ,gBAAa;AAE7E,wEAAwE;AACxE,yEAAyE;AACzE,wCAAwC;AACxC,MAAMC,SAAS,CAACC;IACd,MAAMC,SAASR,yBAAyBO;IACxC,IAAIC,QAAQC,SAAS,eAAe;QAClC,OAAOF;IACT;IACA,MAAMG,SAAS;WAAKF,OAAOE,MAAM,IAAI,EAAE;KAAE,CAACC,IAAI,GAAGC,IAAI,CAAC;IACtD,OAAOF,SAAS,GAAGF,OAAOK,IAAI,CAAC,CAAC,EAAEH,OAAO,CAAC,CAAC,GAAGF,OAAOK,IAAI;AAC3D;AAEA,MAAMC,YAAY,CAChBC,aACAC,UACAC;IAEA,uEAAuE;IACvE,6EAA6E;IAC7E,mCAAmC;IACnC,MAAMC,WAAW,IAAIC,IACnBd,eAAeU,aAAaE,MAAMG,GAAG,CAAC,CAACC,IAAM;YAACf,OAAOe;YAAIA;SAAE;IAE7D,MAAMC,SAAS,AAACN,CAAAA,YAAY,EAAE,AAAD,EAAGI,GAAG,CACjC,CAACb,MAAQW,SAASK,GAAG,CAACjB,OAAOC,SAASA;IAExC,MAAMiB,eAAe,IAAIC,IAAI,AAACT,CAAAA,YAAY,EAAE,AAAD,EAAGI,GAAG,CAACd;IAClD,KAAK,MAAM,CAACoB,KAAKnB,IAAI,IAAIW,SAAU;QACjC,IAAI,CAACM,aAAaG,GAAG,CAACD,MAAM;YAC1BJ,OAAOM,IAAI,CAACrB;QACd;IACF;IACA,OAAOe;AACT;AAEA;;CAEC,GACD,OAAO,MAAMO,iCAAiC,CAG5CC,MACAC,aACAhB,aACAE;IAEA,MAAMe,cAAcnC,MAClBiC,KAAKG,IAAI,CAAClC,kBAAkBgC,aAAa,mBAAmB;IAE9DC,YAAYE,OAAO,CAACC,YAAY,GAAGrB,UACjCC,aACAiB,YAAYE,OAAO,EAAEC,cACrBlB;IAEFa,KAAKM,KAAK,CACRrC,kBAAkBgC,aAAa,mBAC/BjC,UAAUkC;AAEd,EAAE;AAEF,OAAO,MAAMK,kDAAkD,CAG7DP,MACAC,aACAO,OACAvB,aACAE;IAEA,MAAMe,cAAcnC,MAClBiC,KAAKG,IAAI,CAAClC,kBAAkBgC,aAAa,mBAAmB;IAE9DC,WAAW,CAAC,oBAAoB,GAAG;QACjC,GAAGA,WAAW,CAAC,oBAAoB;QACnC,CAACM,MAAM,EAAExB,UACPC,aACAiB,WAAW,CAAC,oBAAoB,EAAE,CAACM,MAAM,EACzCrB;IAEJ;IACAa,KAAKM,KAAK,CACRrC,kBAAkBgC,aAAa,mBAC/BjC,UAAUkC;AAEd,EAAE;AAQF;;;;CAIC,GACD,OAAO,MAAMO,aAAa,CACxBhC,KACAiC,MACAC;IAEA,6EAA6E;IAC7E,6BAA6B;IAC7B,OAAO,CAAC,WAAW,EAAElC,MAAMH,WAAW,CAACG,IAAI,CAAC,CAAC,EAC3CkC,WACI,GAAGA,SACArB,GAAG,CACF,CAAC,EAAEb,GAAG,EAAEmC,OAAO,EAAEC,SAAS,EAAE,GAC1B,CAAC,OAAO,EAAEpC,MAAMoC,aAAa,OAAOD,SAAS,EAEhD9B,IAAI,CAAC,KAAK,CAAC,CAAC,GACf,KACHL,MAAMiC,OAAO,CAAC,CAAC,EAAEA,MAAM,GAAG,IAAI;AACnC,EAAE;AAEF;;;;;;;;;;CAUC,GACD,MAAMI,wBAAwB,CAC5Bd,MACAI;IAEA,MAAMW,gBAAgB9C,kBAAkBmC,QAAQY,IAAI,EAAE;IACtD,MAAMC,cAAcjB,KAAKkB,MAAM,CAACH,iBAC5B,AAAC3C,SAAS4B,MAAMe,eAA8CX,OAAO,EACjErB,OACJoC;IACJ,OAAOhD,0BAA0B8C,eAAeb,QAAQrB,IAAI,IAAI;AAClE;AAEA;;;;;;;;;;CAUC,GACD,OAAO,MAAMqC,oCAAoC,CAC/CpB,MACAqB,kBACAC;IAEA,MAAMP,gBAAgB9C,kBACpBoD,iBAAiBL,IAAI,EACrB;IAEF,IAAI,CAAChB,KAAKkB,MAAM,CAACH,gBAAgB;QAC/B;IACF;IAEA,MAAMQ,mBAAmBT,sBAAsBd,MAAMsB;IAErDjD,WAAW2B,MAAMe,eAAe,CAACS;QAC/B,uDAAuD;QACvD,MAAMrC,OAAOqC,KAAKpB,OAAO,EAAEC,gBAAgB,EAAE;QAC7C,IACE,CAAClB,KAAKsC,IAAI,CACR,CAAClC,IACCA,MAAMgC,oBACNhC,EAAEmC,UAAU,CAAC,GAAGH,iBAAiB,EAAE,CAAC,KACpChC,EAAEmC,UAAU,CAAC,GAAGH,iBAAiB,EAAE,CAAC,IAExC;YACAC,KAAKpB,OAAO,CAACC,YAAY,GAAG;mBAAIlB;gBAAMoC;aAAiB;QACzD;QAEA,iDAAiD;QACjDC,KAAKG,IAAI,GAAGH,KAAKG,IAAI,IAAI,CAAC;QACzBH,KAAKG,IAAI,CAASC,EAAE,GAAG,AAACJ,KAAKG,IAAI,CAASC,EAAE,IAAI,CAAC;QACjDJ,KAAKG,IAAI,CAASC,EAAE,CAACC,OAAO,GAAG,AAACL,KAAKG,IAAI,CAASC,EAAE,CAACC,OAAO,IAAI,CAAC;QACjEL,KAAKG,IAAI,CAASC,EAAE,CAACC,OAAO,CAACN,iBAAiB,GAAG;YAChDO,WAAW;QACb;QAEA,OAAON;IACT;AACF,EAAE"}

package/src/utils/rdb-constructs/files/cdk/app/dbs/__nameKebabCase__.ts.template

@@ -1,22 +1,50 @@
 import * as path from 'path';
 import * as url from 'url';
+import { readFileSync } from 'fs';
 import { Construct } from 'constructs';
-import { DB_PACKAGE_NAME } from '<%= databasePackageAlias %>';
+import { Platform } from 'aws-cdk-lib/aws-ecr-assets';
+import {
+<%_ if (framework !== 'sqlmodel') { _%>
+  Code,
+<%_ } _%>
+  DockerImageCode,
+  DockerImageFunction,
+  Function,
+  FunctionOptions,
+<%_ if (framework !== 'sqlmodel') { _%>
+  Runtime,
+<%_ } _%>
+} from 'aws-cdk-lib/aws-lambda';
 import {
   AuroraDatabase,
   AuroraDatabaseEngines,
   AuroraDatabaseProps,
-} from '../../core/rdb/aurora.js';
-import { findWorkspaceRoot } from '../../core/workspace.js';
+} from '../../core/rdb/aurora<% if (esm) { %>.js<% } %>';
+import { findWorkspaceRoot } from '../../core/workspace<% if (esm) { %>.js<% } %>';
+
+const { runtimeConfigKey } = JSON.parse(
+  readFileSync(
+    path.join(
+      findWorkspaceRoot(url.fileURLToPath(new URL(<% if (esm) { %>import.meta.url<% } else { %>require('url').pathToFileURL(__filename).href<% } %>))),
+      '<%= projectRoot %>/config.json',
+    ),
+    'utf-8',
+  ),
+) as { runtimeConfigKey: string };
+
+const migrationBundleDir = path.join(
+  findWorkspaceRoot(url.fileURLToPath(new URL(import.meta.url))),
+  '<%- migrationBundleDir %>',
+);
+
+const createDbUserBundleDir = path.join(
+  findWorkspaceRoot(url.fileURLToPath(new URL(import.meta.url))),
+  '<%- createDbUserBundleDir %>',
+);
 
 export type <%= nameClassName %>Props = Omit<
   AuroraDatabaseProps,
-  | 'databaseName'
-  | 'adminUser'
-  | 'createDbUserBundleDir'
-  | 'engine'
-  | 'runtimeConfigKey'
-  | 'migrationBundleDir'
+  'databaseName' | 'adminUser' | 'runtimeConfigKey' | 'engine'
 >;
 
 /**
@@ -28,16 +56,42 @@ export class <%= nameClassName %> extends AuroraDatabase {
       ...props,
       databaseName: '<%= databaseName %>',
       adminUser: '<%= adminUser %>',
-      runtimeConfigKey: DB_PACKAGE_NAME,
-      migrationBundleDir: path.join(
-        findWorkspaceRoot(url.fileURLToPath(new URL(import.meta.url))),
-        '<%- migrationBundleDir %>',
-      ),
-      createDbUserBundleDir: path.join(
-        findWorkspaceRoot(url.fileURLToPath(new URL(import.meta.url))),
-        '<%- createDbUserBundleDir %>',
-      ),
+      runtimeConfigKey,
       engine: AuroraDatabaseEngines.<%= engine %>({}),
     });
   }
+
+<%_ if (framework === 'sqlmodel') { _%>
+  protected override createDbUserHandler(baseProps: FunctionOptions): Function {
+    return new DockerImageFunction(this, 'CreateDbUserHandler', {
+      ...baseProps,
+      code: DockerImageCode.fromImageAsset(createDbUserBundleDir, {
+        platform: Platform.LINUX_ARM64,
+      }),
+    });
+  }
+<%_ } else { _%>
+  protected override createDbUserHandler(baseProps: FunctionOptions): Function {
+    return new Function(this, 'CreateDbUserHandler', {
+      ...baseProps,
+      code: Code.fromAsset(createDbUserBundleDir),
+      handler: 'index.handler',
+      runtime: Runtime.NODEJS_LATEST,
+      environment: {
+        NODE_EXTRA_CA_CERTS: '/var/runtime/ca-cert.pem',
+      },
+    });
+  }
+<%_ } _%>
+
+  protected override createMigrationHandler(
+    baseProps: FunctionOptions,
+  ): Function {
+    return new DockerImageFunction(this, 'MigrationHandler', {
+      ...baseProps,
+      code: DockerImageCode.fromImageAsset(migrationBundleDir, {
+        platform: Platform.LINUX_ARM64,
+      }),
+    });
+  }
 }

package/src/utils/rdb-constructs/files/cdk/core/rdb/aurora.ts.template

@@ -1,18 +1,14 @@
-import { CfnOutput, Duration, RemovalPolicy, Stack } from 'aws-cdk-lib';
-import { CustomResource } from 'aws-cdk-lib';
-import { IConnectable, IVpc, Port, SubnetType } from 'aws-cdk-lib/aws-ec2';
-import { IGrantable, Role, ServicePrincipal } from 'aws-cdk-lib/aws-iam';
-import { Key } from 'aws-cdk-lib/aws-kms';
-import { Platform } from 'aws-cdk-lib/aws-ecr-assets';
+import { CfnOutput, Duration, RemovalPolicy, Stack } from "aws-cdk-lib";
+import { CustomResource } from "aws-cdk-lib";
+import { IConnectable, IVpc, Port, SubnetType } from "aws-cdk-lib/aws-ec2";
+import { IGrantable, Role, ServicePrincipal } from "aws-cdk-lib/aws-iam";
+import { Key } from "aws-cdk-lib/aws-kms";
 import {
   Architecture,
-  Code,
-  DockerImageCode,
-  DockerImageFunction,
   Function,
-  Runtime,
+  FunctionOptions,
   Tracing,
-} from 'aws-cdk-lib/aws-lambda';
+} from "aws-cdk-lib/aws-lambda";
 import {
   AuroraMysqlEngineVersion,
   AuroraPostgresEngineVersion,
@@ -24,11 +20,11 @@ import {
   DatabaseProxy,
   DefaultAuthScheme,
   IClusterEngine,
-} from 'aws-cdk-lib/aws-rds';
-import { Provider } from 'aws-cdk-lib/custom-resources';
-import { Trigger } from 'aws-cdk-lib/triggers';
-import { Construct } from 'constructs';
-import { RuntimeConfig } from '../runtime-config.js';
+} from "aws-cdk-lib/aws-rds";
+import { Provider } from "aws-cdk-lib/custom-resources";
+import { Trigger } from "aws-cdk-lib/triggers";
+import { Construct } from "constructs";
+import { RuntimeConfig } from "../runtime-config<% if (esm) { %>.js<% } %>";
 
 export type AuroraDatabaseEngineVersion =
   | AuroraMysqlEngineVersion
@@ -38,7 +34,7 @@ export interface AuroraDatabaseEngine {
   /**
    * Discriminant identifying the engine type.
    */
-  readonly type: 'mysql' | 'postgres';
+  readonly type: "mysql" | "postgres";
 
   /**
    * Default Aurora engine version used when one is not explicitly provided.
@@ -58,7 +54,7 @@ export class AuroraDatabaseEngines {
     defaultVersion?: AuroraMysqlEngineVersion;
   }): AuroraDatabaseEngine {
     return {
-      type: 'mysql',
+      type: "mysql",
       defaultVersion,
       clusterEngine: (version) =>
         DatabaseClusterEngine.auroraMysql({
@@ -73,7 +69,7 @@ export class AuroraDatabaseEngines {
     defaultVersion?: AuroraPostgresEngineVersion;
   }): AuroraDatabaseEngine {
     return {
-      type: 'postgres',
+      type: "postgres",
       defaultVersion,
       clusterEngine: (version) =>
         DatabaseClusterEngine.auroraPostgres({
@@ -85,12 +81,12 @@ export class AuroraDatabaseEngines {
 
 type _AuroraDatabaseProps = Omit<
   DatabaseClusterProps,
-  | 'credentials'
-  | 'defaultDatabaseName'
-  | 'engine'
-  | 'iamAuthentication'
-  | 'instanceProps'
-  | 'writer'
+  | "credentials"
+  | "defaultDatabaseName"
+  | "engine"
+  | "iamAuthentication"
+  | "instanceProps"
+  | "writer"
 >;
 
 export interface AuroraDatabaseProps extends _AuroraDatabaseProps {
@@ -126,20 +122,10 @@ export interface AuroraDatabaseProps extends _AuroraDatabaseProps {
    */
   readonly runtimeConfigKey: string;
 
-  /**
-   * Migration bundle used to create a migration handler Lambda.
-   */
-  readonly migrationBundleDir: string;
-
-  /**
-   * Bundle used to create or reconcile the application database user.
-   */
-  readonly createDbUserBundleDir: string;
-
   /**
    * Writer instance for the Aurora cluster.
    */
-  readonly writer?: DatabaseClusterProps['writer'];
+  readonly writer?: DatabaseClusterProps["writer"];
 
   /**
    * Whether to provision an RDS Proxy in front of the Aurora cluster.
@@ -175,6 +161,25 @@ export interface AuroraDatabaseProps extends _AuroraDatabaseProps {
    * @default true
    */
   readonly enableKeyRotation?: boolean;
+
+  /**
+   * Whether to export Aurora engine logs to CloudWatch Logs.
+   * See https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/USER_LogAccess.html
+   *
+   * PostgreSQL logs DDL statements only (log_statement=ddl); MySQL enables
+   * Advanced Auditing scoped to connections and DDL (server_audit_events=CONNECT,QUERY_DDL).
+   * Neither logs statement parameter values, to avoid leaking PII into log data.
+   *
+   * @default true
+   */
+  readonly enableCloudwatchLogs?: boolean;
+
+  /**
+   * Whether to enable Performance Insights on the Aurora writer instance.
+   *
+   * @default true
+   */
+  readonly enablePerformanceInsights?: boolean;
 }
 
 /**
@@ -195,8 +200,6 @@ export abstract class AuroraDatabase extends Construct {
       adminUser,
       databaseName,
       runtimeConfigKey,
-      migrationBundleDir,
-      createDbUserBundleDir,
       vpcSubnets,
       writer,
       enableRdsProxy = true,
@@ -204,6 +207,8 @@ export abstract class AuroraDatabase extends Construct {
       deletionProtection = true,
       removalPolicy = RemovalPolicy.RETAIN,
       enableKeyRotation = true,
+      enableCloudwatchLogs = true,
+      enablePerformanceInsights = true,
       engine,
       engineVersion,
       ...clusterProps
@@ -213,18 +218,41 @@ export abstract class AuroraDatabase extends Construct {
 
     this.adminUser = adminUser;
 
-    const key = new Key(this, 'EncryptionKey', { enableKeyRotation });
-    this.cluster = new DatabaseCluster(this, 'DatabaseCluster', {
+    const key = new Key(this, "EncryptionKey", { enableKeyRotation });
+    this.cluster = new DatabaseCluster(this, "DatabaseCluster", {
       ...clusterProps,
       vpc,
       vpcSubnets,
       engine: engine.clusterEngine(engineVersion ?? engine.defaultVersion),
-      writer: writer ?? ClusterInstance.serverlessV2('writer'),
+      writer:
+        writer ??
+        ClusterInstance.serverlessV2("writer", {
+          enablePerformanceInsights,
+          performanceInsightEncryptionKey: enablePerformanceInsights
+            ? key
+            : undefined,
+        }),
       credentials: Credentials.fromGeneratedSecret(adminUser, {
         encryptionKey: key,
       }),
       iamAuthentication: true,
       monitoringInterval: Duration.seconds(5),
+      cloudwatchLogsExports: enableCloudwatchLogs
+        ? engine.type === "mysql"
+          ? ["audit", "error"]
+          : ["postgresql"]
+        : undefined,
+      parameters: enableCloudwatchLogs
+        ? engine.type === "mysql"
+          ? {
+              server_audit_logging: "1",
+              server_audit_events: "CONNECT,QUERY_DDL",
+            }
+          : // Only safe statement-at-a-time; a multi-statement batch mixing
+            // DDL with DML (e.g. one `psql -c "a;b;c"` call) logs the whole
+            // raw text verbatim, including any literal DML values.
+            { log_statement: "ddl" }
+        : undefined,
       defaultDatabaseName: databaseName,
       storageEncrypted: true,
       storageEncryptionKey: key,
@@ -242,13 +270,13 @@ export abstract class AuroraDatabase extends Construct {
     }
 
     const proxyRole = enableRdsProxy
-      ? new Role(this, 'DatabaseProxyRole', {
-          assumedBy: new ServicePrincipal('rds.amazonaws.com'),
+      ? new Role(this, "DatabaseProxyRole", {
+          assumedBy: new ServicePrincipal("rds.amazonaws.com"),
         })
       : undefined;
 
     if (enableRdsProxy) {
-      this.proxy = this.cluster.addProxy('DatabaseProxy', {
+      this.proxy = this.cluster.addProxy("DatabaseProxy", {
         vpc,
         vpcSubnets,
         defaultAuthScheme: DefaultAuthScheme.IAM_AUTH,
@@ -260,36 +288,36 @@ export abstract class AuroraDatabase extends Construct {
       this.proxy?.endpoint ?? this.cluster.clusterEndpoint.hostname;
     const databasePort = this.cluster.clusterEndpoint.port;
 
-    const createDbUserHandler = new Function(this, 'CreateDbUserHandler', {
-      code: Code.fromAsset(createDbUserBundleDir),
-      handler: 'index.handler',
-      runtime: Runtime.NODEJS_LATEST,
+    const commonProps: FunctionOptions = {
+      vpc,
       timeout: Duration.minutes(5),
       tracing: Tracing.ACTIVE,
-      vpc,
+      architecture: Architecture.ARM_64,
+    };
+
+    const createDbUserHandler = this.createDbUserHandler({
+      ...commonProps,
       vpcSubnets: {
         subnetType: SubnetType.PRIVATE_WITH_EGRESS,
       },
-      environment: {
-        DATABASE_SECRET_ARN: this.cluster.secret!.secretArn,
-        NODE_EXTRA_CA_CERTS: '/var/runtime/ca-cert.pem',
-      },
-      architecture: Architecture.ARM_64,
     });
-
+    createDbUserHandler.addEnvironment(
+      "DATABASE_SECRET_ARN",
+      this.cluster.secret!.secretArn,
+    );
     this.cluster.connections.allowDefaultPortFrom(
       createDbUserHandler,
-      'Allow the create-db-user handler to connect to the database',
+      "Allow the create-db-user handler to connect to the database",
     );
     this.grantSecretRead(createDbUserHandler);
 
-    const createDbUserProvider = new Provider(this, 'CreateDbUserProvider', {
+    const createDbUserProvider = new Provider(this, "CreateDbUserProvider", {
       onEventHandler: createDbUserHandler,
     });
 
     const createDbUserResource = new CustomResource(
       this,
-      'CreateDbUserResource',
+      "CreateDbUserResource",
       {
         serviceToken: createDbUserProvider.serviceToken,
         properties: {
@@ -298,13 +326,13 @@ export abstract class AuroraDatabase extends Construct {
       },
     );
     createDbUserResource.node.addDependency(this.cluster);
-    this.dbUser = createDbUserResource.getAttString('dbUser');
+    this.dbUser = createDbUserResource.getAttString("dbUser");
     if (this.proxy && proxyRole) {
       this.cluster.grantConnect(proxyRole, this.dbUser);
     }
 
     const rc = RuntimeConfig.ensure(this);
-    rc.set('database', runtimeConfigKey, {
+    rc.set("database", runtimeConfigKey, {
       hostname: databaseHostname,
       port: databasePort,
       database: databaseName,
@@ -313,49 +341,45 @@ export abstract class AuroraDatabase extends Construct {
       region: Stack.of(this).region,
     });
 
-    const migrationHandler = new DockerImageFunction(this, 'MigrationHandler', {
-      code: DockerImageCode.fromImageAsset(migrationBundleDir, {
-        platform: Platform.LINUX_ARM64,
-      }),
+    const migrationHandler = this.createMigrationHandler({
+      ...commonProps,
       memorySize: 1024,
-      timeout: Duration.minutes(5),
-      tracing: Tracing.ACTIVE,
-      vpc,
-      environment: engine.type === 'mysql' ? {
-        DATABASE_SECRET_ARN: this.cluster.secret!.secretArn,
-      } : {
-        HOSTNAME: databaseHostname,
-        DATABASE: databaseName,
-        PORT: databasePort.toString(),
-        DBUSER: this.dbUser,
-      },
-      architecture: Architecture.ARM_64,
     });
+    migrationHandler.addEnvironment(
+      "DATABASE_SECRET_ARN",
+      this.cluster.secret!.secretArn,
+    );
+    this.cluster.connections.allowDefaultPortFrom(migrationHandler);
+    this.grantSecretRead(migrationHandler);
 
-    if (engine.type === 'mysql') {
-      this.cluster.connections.allowDefaultPortFrom(migrationHandler);
-      this.grantSecretRead(migrationHandler);
-    } else {
-      this.allowDefaultPortFrom(migrationHandler);
-      this.grantConnect(migrationHandler);
-    }
-
-    const trigger = new Trigger(this, 'MigrationTrigger', {
+    const migrationTrigger = new Trigger(this, "MigrationTrigger", {
       handler: migrationHandler,
     });
-    trigger.node.addDependency(createDbUserResource);
+    migrationTrigger.node.addDependency(createDbUserResource);
 
-    new CfnOutput(this, 'ClusterEndpoint', {
+    new CfnOutput(this, "ClusterEndpoint", {
       value: this.cluster.clusterEndpoint.hostname,
     });
 
     if (this.proxy?.endpoint) {
-      new CfnOutput(this, 'ProxyEndpoint', {
+      new CfnOutput(this, "ProxyEndpoint", {
         value: this.proxy?.endpoint,
       });
     }
   }
 
+  /**
+   * Creates the Lambda handler used to create or reconcile the application database user.
+   */
+  protected abstract createDbUserHandler(baseProps: FunctionOptions): Function;
+
+  /**
+   * Creates the Lambda handler used to run database migrations.
+   */
+  protected abstract createMigrationHandler(
+    baseProps: FunctionOptions,
+  ): Function;
+
   public allowDefaultPortFrom(other: IConnectable, description?: string): void {
     if (this.proxy) {
       this.proxy.connections.allowFrom(