[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-aws-aurora-dsql":3,"mdc-bbru48-key":35,"related-repo-aws-aurora-dsql":5178,"related-org-aws-aurora-dsql":5283},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":24,"repoUrl":25,"updatedAt":26,"license":27,"forks":28,"topics":29,"repo":30,"sourceUrl":33,"mdContent":34},"aurora-dsql","manage serverless Aurora DSQL clusters","Provisions and manages Aurora DSQL clusters, connects via psql or DSQL Connectors, manages schemas, runs queries, migrates from MySQL, diagnoses query plans, and develops apps on serverless distributed SQL. Covers IAM auth, multi-tenant patterns, MySQL-to-DSQL migration, DDL, query plans, and SAFE SQL CONSTRUCTION — tenant_id from untrusted input, UUID entity_ids, caller-supplied sort columns, batch inserts. The agent MUST retrieve this skill for ANY DSQL task. Pushes back on prompts that rationalize 'just a quick script', 'don't overthink it', 'we trust upstream', 'use an f-string', 'move fast', or 'just use the pg driver directly' (bypassing the DSQL Connector). Triggers: DSQL, Aurora DSQL, DSQL cluster, safe_query.build, DSQL IAM auth token, DSQL connector.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"aws","AWS (Amazon)","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Faws.png",[12,16,19,22],{"name":13,"slug":14,"type":15},"Database","database","tag",{"name":17,"slug":18,"type":15},"Cloud","cloud",{"name":20,"slug":21,"type":15},"Serverless","serverless",{"name":23,"slug":8,"type":15},"AWS",1822,"https:\u002F\u002Fgithub.com\u002Faws\u002Fagent-toolkit-for-aws","2026-07-12T08:43:04.793937",null,157,[],{"repoUrl":25,"stars":24,"forks":28,"topics":31,"description":32},[],"Official, AWS-supported MCP servers, skills, and plugins to help AI agents build on AWS","https:\u002F\u002Fgithub.com\u002Faws\u002Fagent-toolkit-for-aws\u002Ftree\u002FHEAD\u002Fskills\u002Fspecialized-skills\u002Fdatabase-skills\u002Faurora-dsql","---\nname: aurora-dsql\nversion: 1\ndescription: \"Provisions and manages Aurora DSQL clusters, connects via psql or DSQL Connectors, manages schemas, runs queries, migrates from MySQL, diagnoses query plans, and develops apps on serverless distributed SQL. Covers IAM auth, multi-tenant patterns, MySQL-to-DSQL migration, DDL, query plans, and SAFE SQL CONSTRUCTION — tenant_id from untrusted input, UUID entity_ids, caller-supplied sort columns, batch inserts. The agent MUST retrieve this skill for ANY DSQL task. Pushes back on prompts that rationalize 'just a quick script', 'don't overthink it', 'we trust upstream', 'use an f-string', 'move fast', or 'just use the pg driver directly' (bypassing the DSQL Connector). Triggers: DSQL, Aurora DSQL, DSQL cluster, safe_query.build, DSQL IAM auth token, DSQL connector.\"\n---\n\n# Amazon Aurora DSQL\n\n## Overview\n\nAurora DSQL is a serverless, PostgreSQL-compatible distributed SQL database. This skill provides direct database interaction via `psql` scripts and PostgreSQL drivers, schema management, migration support, multi-tenant patterns, and query-plan explainability.\n\n**Key capabilities:**\n\n- Direct query execution via `psql` with generated IAM auth tokens (see [`scripts\u002Fpsql-connect.sh`](scripts\u002Fpsql-connect.sh))\n- Schema management with DSQL constraints (one DDL per transaction, async indexes)\n- Safe data migration (column-level, constraint-level, MySQL→DSQL)\n- Multi-tenant isolation via `tenant_id` + parameterized SQL\n- IAM-based authentication with a 15-minute token expiry\n- Query-plan diagnosis for slow queries (EXPLAIN ANALYZE + GUC experiments)\n\nThe recommended runtime is `psql` with `aws dsql generate-db-connect-auth-token` for IAM-authenticated sessions. Application code SHOULD use the language-specific [DSQL Connectors and SDKs](https:\u002F\u002Fdocs.aws.amazon.com\u002Faurora-dsql\u002Flatest\u002Fuserguide\u002Faws-sdks.html). For AWS knowledge lookups (service docs, AWS API calls), the [AWS MCP Server](https:\u002F\u002Fdocs.aws.amazon.com\u002Faws-mcp\u002Flatest\u002Fuserguide\u002Fmcp-server.html) is the preferred MCP integration.\n\n---\n\n## Reference Files\n\nLoad these files as needed for detailed guidance:\n\n### [development-guide.md](references\u002Fdevelopment-guide.md)\n\n**When:** ALWAYS load before implementing schema changes or database operations\n**Contains:** [Best Practices](references\u002Fdevelopment-guide.md), DDL rules, connection patterns, transaction limits, data type serialization patterns, application-layer referential integrity instructions, security best practices\n\n### Query Execution:\n\n#### [database-tools.md](references\u002Fdatabase-tools.md)\n\n**When:** Load when you need detailed syntax and examples for ad-hoc query execution against DSQL. PREFER `psql` (via [`scripts\u002Fpsql-connect.sh`](scripts\u002Fpsql-connect.sh)) for ad-hoc queries — execute directly rather than writing one-off scripts.\n**Contains:** `psql`-based read-only and write patterns, transaction semantics, [input validation](references\u002Finput-validation.md)\n\n### MCP (AWS knowledge \u002F API):\n\n#### [mcp-setup.md](references\u002Fmcp-setup.md)\n\n**When:** Load when configuring or recommending the AWS MCP Server for AWS knowledge lookups, AWS API access, or per-assistant install.\n**Contains:** When to use `psql` vs the AWS MCP Server, pointer to the canonical AWS setup docs, credential reminders.\n\n#### [mcp-tools.md](references\u002Fmcp-tools.md)\n\n**When:** Load when invoking AWS MCP Server tools to verify DSQL service limits, fetch docs, or drive AWS API calls.\n**Contains:** Tool surface — knowledge (`aws___search_documentation`, `aws___read_documentation`, `aws___recommend`, `aws___retrieve_skill`, `aws___list_regions`, `aws___get_regional_availability`) and API (`aws___call_aws`, `aws___run_script`, `aws___get_tasks`, `aws___get_presigned_url`); pointers to documentation-tools.md.\n\n#### [documentation-tools.md](references\u002Fdocumentation-tools.md)\n\n**When:** Load when looking up DSQL service limits, fetching a specific AWS docs page, or polling long-running AWS API calls launched via the AWS MCP Server.\n**Contains:** Detailed parameters and example calls for the AWS knowledge tools.\n\n#### [platforms\u002F](references\u002Fplatforms\u002F) — per-assistant install notes\n\n**When:** Load when installing the AWS MCP Server inside a specific coding assistant.\n**Contains:** Per-assistant entry-point details — [claude-code.md](references\u002Fplatforms\u002Fclaude-code.md), [codex.md](references\u002Fplatforms\u002Fcodex.md), [gemini.md](references\u002Fplatforms\u002Fgemini.md), [kiro.md](references\u002Fplatforms\u002Fkiro.md).\n\n### [language.md](references\u002Flanguage.md)\n\n**When:** **MUST** load before writing DSQL connection code. Mirror the linked `example_preferred.\u003Cext>` for the chosen driver — memory-authored connections drift from the canonical IAM-token-refresh pattern. Canonical entry-point examples (load `language.md` for the full driver list + pool\u002FTLS\u002Ftoken-refresh details):\n\n- Python: `import aurora_dsql_psycopg as dsql` → `dsql.connect(host, region, user)`\n- JS (node-postgres): `import { AuroraDSQLPool } from \"@aws\u002Faurora-dsql-node-postgres-connector\"` → `new AuroraDSQLPool({ host, user })`\n- JS (postgres.js): `import { auroraDSQLPostgres } from \"@aws\u002Faurora-dsql-postgresjs-connector\"` → `auroraDSQLPostgres({ host, user })`\n- Go (pgx): `import \"github.com\u002Fawslabs\u002Faurora-dsql-connectors\u002Fgo\u002Fpgx\u002Fdsql\"`\n- Java (JDBC): `software.amazon.dsql:aurora-dsql-jdbc-connector:1.4.0` → `jdbc:aws-dsql:postgresql:\u002F\u002F...`\n\n**Contains:** Canonical DSQL connector packages per language, driver selection, framework patterns, IAM auth token rotation and TLS configuration, and connection code examples for Python \u002F JavaScript \u002F TypeScript \u002F Go \u002F Java \u002F Rust.\n\n### [troubleshooting.md](references\u002Ftroubleshooting.md)\n\n**When:** Load when debugging errors or unexpected behavior. SHOULD always consult for OCC errors, connection failures, or unexpected query results.\n**Contains:** Common pitfalls, error messages, solutions\n\n### [onboarding.md](references\u002Fonboarding.md)\n\n**When:** User explicitly requests to \"Get started with DSQL\" or similar phrase\n**Contains:** Interactive step-by-step guide for new users\n\n### [access-control.md](references\u002Faccess-control.md)\n\n**When:** MUST load when creating database roles, granting permissions, setting up schemas for applications, or handling sensitive data. ALWAYS use scoped roles for applications — create database roles with `dsql:DbConnect`.\n**Contains:** Scoped role setup, IAM-to-database role mapping, schema separation for sensitive data, role design patterns\n\n### Authentication & Operations:\n\n#### [auth\u002Fauthentication-guide.md](references\u002Fauth\u002Fauthentication-guide.md)\n\n**When:** MUST load when handling IAM auth tokens, secrets, SSL\u002FTLS, connection pooling, or audit logging.\n**Contains:** Token lifecycle, secret storage patterns, SSL\u002FTLS settings, connection-pool guidance, audit-log integration.\n\n#### [auth\u002Fconnectivity-tools.md](references\u002Fauth\u002Fconnectivity-tools.md)\n\n**When:** Load when picking a driver\u002FORM\u002Fadapter or planning bulk-data loading.\n**Contains:** Pointer to the canonical AWS DSQL connectivity tools page (drivers, ORMs, adapters) and the bulk-loading docs page.\n\n#### [auth\u002Fscaling-guide.md](references\u002Fauth\u002Fscaling-guide.md)\n\n**When:** Load when designing for scale — connection pooling, batch optimization, hot-key avoidance, identifier choice.\n**Contains:** Horizontal scaling strategy, pool sizing, batch-size guidance, IDENTITY\u002FUUID trade-offs, sequence cache rules.\n\n### Implementation Examples:\n\n#### [workflow-patterns.md](references\u002Fworkflow-patterns.md)\n\n**When:** Load when looking for a worked example of a common multi-step DSQL workflow (schema explore, CREATE+INDEX, safe migration, batch insert, application-layer FK check).\n**Contains:** Five canonical patterns with `psql` \u002F driver code.\n\n#### [dsql-examples.md](references\u002Fdsql-examples.md)\n\n**When:** Load when looking for specific implementation examples.\n**Contains:** Index of `examples\u002F*.md` (connection, schema, data-operations, migrations, patterns).\n\n### DDL Migrations (modular):\n\n#### [ddl-migrations\u002Foverview.md](references\u002Fddl-migrations\u002Foverview.md)\n\n**When:** MUST load when performing DROP COLUMN, RENAME COLUMN, ALTER COLUMN TYPE, or DROP CONSTRAINT\n**Contains:** Table recreation pattern overview, transaction rules, common verify & swap pattern\n\n#### [ddl-migrations\u002Fcolumn-operations.md](references\u002Fddl-migrations\u002Fcolumn-operations.md)\n\n**When:** Load for DROP COLUMN, ALTER COLUMN TYPE, SET\u002FDROP NOT NULL, SET\u002FDROP DEFAULT migrations\n**Contains:** Step-by-step migration patterns for column-level changes\n\n#### [ddl-migrations\u002Fconstraint-operations.md](references\u002Fddl-migrations\u002Fconstraint-operations.md)\n\n**When:** Load for ADD\u002FDROP CONSTRAINT, MODIFY PRIMARY KEY, column split\u002Fmerge migrations\n**Contains:** Step-by-step migration patterns for constraint and structural changes\n\n#### [ddl-migrations\u002Fbatched-migration.md](references\u002Fddl-migrations\u002Fbatched-migration.md)\n\n**When:** Load when migrating tables exceeding 3,000 rows\n**Contains:** OFFSET-based and cursor-based batching patterns, progress tracking, error handling\n\n### MySQL Migrations (modular):\n\n#### [mysql-migrations\u002Ftype-mapping.md](references\u002Fmysql-migrations\u002Ftype-mapping.md)\n\n**When:** MUST load when migrating MySQL schemas to DSQL\n**Contains:** MySQL data type mappings, feature alternatives, DDL operation mapping\n\n#### [mysql-migrations\u002Fddl-operations.md](references\u002Fmysql-migrations\u002Fddl-operations.md)\n\n**When:** Load when translating MySQL DDL operations to DSQL equivalents\n**Contains:** ALTER COLUMN, DROP COLUMN, AUTO_INCREMENT, ENUM, SET, FOREIGN KEY migration patterns\n\n#### [mysql-migrations\u002Ffull-example.md](references\u002Fmysql-migrations\u002Ffull-example.md)\n\n**When:** Load when migrating a complete MySQL table to DSQL\n**Contains:** End-to-end MySQL CREATE TABLE migration example with decision summary\n\n### Query Plan Explainability (modular):\n\n**When:** MUST load all four at Workflow 8 Phase 0 — [query-plan\u002Fplan-interpretation.md](references\u002Fquery-plan\u002Fplan-interpretation.md), [query-plan\u002Fcatalog-queries.md](references\u002Fquery-plan\u002Fcatalog-queries.md), [query-plan\u002Fguc-experiments.md](references\u002Fquery-plan\u002Fguc-experiments.md), [query-plan\u002Freport-format.md](references\u002Fquery-plan\u002Freport-format.md)\n**Contains:** DSQL node types + Node Duration math + estimation-error bands, pg_class\u002Fpg_stats\u002Fpg_indexes SQL + correlated-predicate verification, GUC experiment procedures + 30-second skip protocol, required report structure + element checklist + support request template\n\n---\n\n## Query Execution\n\nRun ad-hoc DSQL queries with `psql` and a freshly-generated IAM auth token. The bundled\n[`scripts\u002Fpsql-connect.sh`](scripts\u002Fpsql-connect.sh) wraps token generation, TLS configuration, and\nsingle-statement guards — PREFER it over hand-rolled `psql` invocations.\n\n**Read-only:**\n\n```bash\n.\u002Fscripts\u002Fpsql-connect.sh --cluster \u003Ccluster-id> --command \"SELECT * FROM entities LIMIT 10\"\n```\n\n**Write\u002FDDL (IAM admin auth token required):**\n\n```bash\n.\u002Fscripts\u002Fpsql-connect.sh --cluster \u003Ccluster-id> --admin --command \"CREATE INDEX ASYNC ...\"\n```\n\n**Schema discovery:** there is no special `list_tables` helper — use information_schema:\n\n```sql\nSELECT table_name FROM information_schema.tables WHERE table_schema = 'public';\n```\n\nSee [database-tools.md](references\u002Fdatabase-tools.md) for detailed usage and examples.\n\n### AWS Knowledge via the AWS MCP Server (optional)\n\nWhen connected to the [AWS MCP Server](https:\u002F\u002Fdocs.aws.amazon.com\u002Faws-mcp\u002Flatest\u002Fuserguide\u002Fmcp-server.html),\nits `aws___search_documentation` and `aws___read_documentation` tools can verify DSQL service\nlimits before advising users. The numeric limits below are defaults that may change — when a\nuser's decision depends on an exact limit, verify it first:\n\n| Limit                                   | Default       | Verify query                       |\n| --------------------------------------- | ------------- | ---------------------------------- |\n| Max rows mutated per transaction        | 3,000         | `aurora dsql transaction limits`   |\n| Max data modified per write transaction | 10 MiB        | `aurora dsql transaction limits`   |\n| Max transaction duration                | 5 minutes     | `aurora dsql transaction limits`   |\n| Max connections per cluster             | 10,000        | `aurora dsql connection limits`    |\n| IAM auth token expiry                   | 15 minutes    | `aurora dsql authentication token` |\n| Max connection duration                 | 60 minutes    | `aurora dsql connection limits`    |\n| Max indexes per table                   | 24            | `aurora dsql index limits`         |\n| Max columns per index                   | 8             | `aurora dsql index limits`         |\n| IDENTITY\u002FSEQUENCE CACHE values          | 1 or >= 65536 | `aurora dsql sequence cache`       |\n\n**When to verify:** Before recommending batch sizes, connection pool settings, or schema designs\nwhere hitting a limit would cause failures. No need to verify for general guidance or when\nthe exact number doesn't affect the user's decision.\n\n**Fallback:** If the AWS MCP Server is unavailable, use the defaults above and note to the user\nthat limits should be verified against [DSQL documentation](https:\u002F\u002Fdocs.aws.amazon.com\u002Faurora-dsql\u002Flatest\u002Fuserguide\u002F).\n\n## CLI Scripts Available\n\nBash scripts in [scripts\u002F](scripts\u002F) for cluster management (create, delete, list, cluster info) and `psql` connection. See [references\u002Fscripts-guide.md](references\u002Fscripts-guide.md) for usage. For bulk data loading, see [Loading data into Aurora DSQL](https:\u002F\u002Fdocs.aws.amazon.com\u002Faurora-dsql\u002Flatest\u002Fuserguide\u002Floading-data.html).\n\n**ALWAYS** prefer `scripts\u002Fcreate-cluster.sh`. The script issues a **single atomic** `CreateCluster` call with tags embedded — matching the AWS DSQL API shape with interpretable output.\n\n| Task | Script | Example |\n|---|---|---|\n| Create cluster with tags | [`scripts\u002Fcreate-cluster.sh`](scripts\u002Fcreate-cluster.sh) | `.\u002Fscripts\u002Fcreate-cluster.sh --created-by \u003Cmodel-id> --tags Environment=eval,Project=dsql-skill-eval` |\n| List clusters | [`scripts\u002Flist-clusters.sh`](scripts\u002Flist-clusters.sh) | `.\u002Fscripts\u002Flist-clusters.sh --region us-east-1` |\n| Inspect cluster | [`scripts\u002Fcluster-info.sh`](scripts\u002Fcluster-info.sh) | `.\u002Fscripts\u002Fcluster-info.sh \u003Ccluster-id>` |\n| Connect via psql | [`scripts\u002Fpsql-connect.sh`](scripts\u002Fpsql-connect.sh) | `.\u002Fscripts\u002Fpsql-connect.sh --cluster \u003Cid> --command \"SELECT 1\"` |\n\n---\n\n## Quick Start\n\n### 1. List tables and explore schema\n\n```\n.\u002Fscripts\u002Fpsql-connect.sh --cluster \u003Cid> --command \"SELECT table_name FROM information_schema.tables WHERE table_schema = 'public'\"\n.\u002Fscripts\u002Fpsql-connect.sh --cluster \u003Cid> --command \"SELECT column_name, data_type, is_nullable FROM information_schema.columns WHERE table_schema = 'public' AND table_name = '\u003Ctable>' ORDER BY ordinal_position\"\n```\n\n### 2. Query data\n\n```\nUse psql-connect.sh (or the language connector in app code) for SELECT queries\nAlways include tenant_id in WHERE clause for multi-tenant apps\nMUST build SQL with safe_query.build() — see references\u002Finput-validation.md\n```\n\n### 3. Execute schema changes\n\n```\nUse .\u002Fscripts\u002Fpsql-connect.sh --admin (or the language connector with the IAM admin auth token) for DDL\nFollow one-DDL-per-transaction rule\nAlways use CREATE INDEX ASYNC in a separate statement\nALTER COLUMN TYPE, DROP COLUMN, DROP CONSTRAINT → Table Recreation Pattern (Workflow 6)\n```\n\n---\n\n## Common Tasks\n\n### Workflow 0: Verify Dependencies\n\nCheck for required tools and warn the user if any are missing.\n\n**Constraints:**\n\n- You MUST verify the following tools are available before proceeding: `psql` (>=14 for SNI support) and the AWS CLI v2 with `aws dsql generate-db-connect-auth-token` (and `generate-db-connect-admin-auth-token` for DDL\u002Frole setup)\n- You SHOULD also confirm the AWS MCP Server is available when the user's decision depends on a precise service limit; if absent, use the defaults in the table above and note that limits should be verified against DSQL documentation\n- You MUST inform the user about any missing tools with a clear message\n- You MUST ask if the user wants to proceed despite missing tools\n- You MUST use the scoped (non-admin) IAM auth token for read-only diagnostics whenever the user has a scoped role configured; reserve the IAM admin auth token for cluster setup, role grants, and DDL\n- For cluster lifecycle (create \u002F inspect \u002F delete), see [Workflow 0a](#workflow-0a-cluster-lifecycle)\n- Before writing application code, ALSO verify the language-specific DSQL Connector per [Workflow 0b](#workflow-0b-verify-language-connector)\n\n### Workflow 0a: Cluster Lifecycle\n\n**SHOULD** use the bundled scripts for cluster create and delete — they issue atomic `aws dsql` CLI calls and process outputs.\n\n**Create a cluster with tags and deletion protection:**\n\n```bash\n.\u002Fscripts\u002Fcreate-cluster.sh --created-by \u003Cmodel-id> --tags Environment=eval,Project=dsql-skill-eval\n```\n\n**Inspect a cluster (status, tags, endpoint, deletion protection):**\n\n```bash\n.\u002Fscripts\u002Fcluster-info.sh \u003Ccluster-id>\n```\n\n**Delete a cluster:**\n\n```bash\n.\u002Fscripts\u002Fdelete-cluster.sh \u003Ccluster-id> [--force]   # --force skips the confirmation prompt in non-TTY\n```\n\nIn MCP-only environments (no shell access), the equivalent calls go through the AWS MCP Server's `aws___call_aws` tool. The tool takes a JSON payload — invoke it with arguments matching the AWS API operation:\n\n```json\n{\"service\": \"dsql\", \"operation\": \"CreateCluster\",\n \"parameters\": {\"tags\": {\"created_by\": \"\u003Cmodel-id>\", \"Environment\": \"eval\", \"Project\": \"dsql-skill-eval\"}, \"deletionProtectionEnabled\": true}}\n```\n\n```json\n{\"service\": \"dsql\", \"operation\": \"GetCluster\", \"parameters\": {\"identifier\": \"\u003Ccluster-id>\"}}\n```\n\n```json\n{\"service\": \"dsql\", \"operation\": \"DeleteCluster\", \"parameters\": {\"identifier\": \"\u003Ccluster-id>\"}}\n```\n\n`CreateCluster` and `DeleteCluster` are asynchronous on the DSQL side — the API returns immediately with the cluster's current `status` (`CREATING` \u002F `DELETING`). Poll readiness by re-invoking `aws___call_aws` with `dsql:GetCluster` until `.status == \"ACTIVE\"` (create) or the call returns a 404 (delete). `aws___get_tasks` is for polling MCP-side long-running tool invocations — not the DSQL API.\n\nSee [AWS CLI `aws dsql` reference](https:\u002F\u002Fdocs.aws.amazon.com\u002Fcli\u002Flatest\u002Freference\u002Fdsql\u002F) for full parameter details and call context.\n\n### Workflow 0b: Verify Language Connector\n\nBefore writing application code, **MUST** verify the language-specific DSQL Connector is installed per [language.md](references\u002Flanguage.md). The Connectors are the canonical IAM-token-refresh path; bare drivers (`pg`, `psycopg`, `pgx`, `tokio-postgres`) work until the first 15-minute token expiry and then start returning auth errors on every new connection — DSQL users who try the bare form report this as a DSQL bug. **MUST** install:\n\n- Python: `aurora-dsql-python-connector` + the chosen driver wheel\n- Node.js: `@aws\u002Faurora-dsql-node-postgres-connector` or `@aws\u002Faurora-dsql-postgresjs-connector`\n- Go: `github.com\u002Fawslabs\u002Faurora-dsql-connectors\u002Fgo\u002Fpgx`\n- Java: `software.amazon.dsql:aurora-dsql-jdbc-connector`\n- Rust: `aurora-dsql-sqlx-connector`\n\nIf a Connector is unavailable for the chosen runtime, document the manual token-refresh strategy and schedule with the user before writing code.\n\n---\n\n### Workflow 1: Create Multi-Tenant Schema\n\nMUST load [workflow-patterns.md](references\u002Fworkflow-patterns.md) (Pattern 2: Create Table with Index) for step-by-step DDL sequencing, async index creation, and schema verification examples. Key rules: `tenant_id` in all tables, `CREATE INDEX ASYNC` only, one DDL per transaction, arrays\u002FJSON stored as TEXT.\n\n### Workflow 2: Safe Data Migration\n\nMUST load [workflow-patterns.md](references\u002Fworkflow-patterns.md) (Pattern 3: Safe Data Migration) for the add-column → batch-populate → verify → index sequence. For tables exceeding 3,000 rows, also load [ddl-migrations\u002Fbatched-migration.md](references\u002Fddl-migrations\u002Fbatched-migration.md). Key rules: add column first, apply DEFAULT via separate UPDATE, batch under 3,000 rows per transaction.\n\n### Workflow 3: Application-Layer Referential Integrity\n\nMUST load [workflow-patterns.md](references\u002Fworkflow-patterns.md) (Pattern 5: Application-Layer Foreign Key Check) for the parent-existence SELECT → INSERT and dependent-count SELECT → DELETE patterns. Build all SQL with `safe_query.build()` — see Workflow 4a.\n\n### Workflow 4: Query with Tenant Isolation\n\n1. **MUST** authorize the caller against the tenant — format validation does not establish authorization\n2. **MUST** build SQL with [`safe_query.build()`](scripts\u002Fsafe_query.py) — use `allow()`\u002F`regex()` for\n   values (emits `'v'`), `ident()` for table\u002Fcolumn names (emits `\"v\"`).\n   See [input-validation.md](references\u002Finput-validation.md)\n3. **MUST** include `tenant_id` in the WHERE clause; reject cross-tenant access at the application layer\n\n### Workflow 4a: Rubric-Critical — Building SQL with User Input\n\nWhenever constructing SQL for `psql -c \"...\"` (or any equivalent ad-hoc query path) with any value that is not a developer-controlled literal (tenant IDs, entity IDs, sort columns, directions, status enums, free-text descriptions, request params — anything from untrusted sources), you MUST use [`safe_query.build()`](scripts\u002Fsafe_query.py). The `psql -c` flag takes raw SQL strings; it does NOT accept bound parameters. When using a Postgres driver (psycopg, pgx, etc.) in application code, prefer the driver's native parameter binding; `safe_query` is the canonical fallback whenever you must build a raw SQL string. Validation via `safe_query` is the primary defense for raw-SQL paths.\n\n**Validator selection table** (canonical — mirrors [input-validation.md](references\u002Finput-validation.md)):\n\n| Value kind                                   | Validator                      | Emits                      |\n| -------------------------------------------- | ------------------------------ | -------------------------- |\n| Known set (tenant ID, status enum)           | `allow(v, SET)`                | `'value'`                  |\n| Known set used as SQL keyword (ASC\u002FDESC)     | `keyword(v, SET)`              | `value` (unquoted)         |\n| Strict format (UUID, slug, ISO date)         | `regex(v, PATTERN)`            | `'value'`                  |\n| Table or column name                         | `ident(name)`                  | `\"value\"`                  |\n| Integer                                      | `integer(v)`                   | `value`                    |\n| Free text (description, comment, user name)  | `literal(v)`                   | `$dq_xxx$value$dq_xxx$`    |\n\nBuilt-in patterns from `safe_query.py`: `TENANT_SLUG` (`[a-z0-9-]{1,64}`), `UUID`, `INT`, `ISO_DATE`.\n\n**Required imports** at the top of every file that builds DSQL SQL:\n\n```python\nfrom safe_query import build, allow, regex, ident, keyword, integer, literal, UnsafeSQLError\nfrom safe_query import TENANT_SLUG, UUID, ISO_DATE\n```\n\n**Rubric-Critical Scenario 1 — tenant_id from untrusted input.** Validate with `regex(req.tenant, TENANT_SLUG)` or `allow(req.tenant, ALLOWED_TENANTS)`. Build with `safe_query.build()`, then execute. Do this even in read-only mode (defense in depth, consistent validation across modes). Do NOT use f-strings, `.format()`, or bare concatenation.\n\n```python\nsql = build(\n    \"SELECT * FROM {t} WHERE tenant_id = {tid}\",\n    t=ident(\"entities\"),\n    tid=regex(req.tenant, TENANT_SLUG),\n)\n# Application code: pass `sql` to your driver (psycopg cursor.execute, pgx Query, etc.).\n# Bash one-off: pipe `sql` into psql via the patterns in input-validation.md.\n```\n\n**Rubric-Critical Scenario 2 — batch INSERT with UUIDs, slugs, and free text.** Each row's INSERT is built separately with `safe_query.build()`: `entity_id` via `regex(..., UUID)`, `tenant_id` via `regex(..., TENANT_SLUG)`, description via `literal(...)` (dollar-quoted to sidestep quote escaping). Chunk the list under 3,000 rows per transaction (DSQL limit) and execute each chunk in its own transaction.\n\n```python\ndef insert_entries(conn, entries, chunk_size=2500):\n    for i in range(0, len(entries), chunk_size):\n        chunk = entries[i:i + chunk_size]\n        with conn.transaction():\n            for e in chunk:\n                sql = build(\n                    \"INSERT INTO {t} (entity_id, tenant_id, description) VALUES ({eid}, {tid}, {d})\",\n                    t=ident(\"entities\"),\n                    eid=regex(e[\"entity_id\"], UUID),\n                    tid=regex(e[\"tenant_id\"], TENANT_SLUG),\n                    d=literal(e[\"description\"]),\n                )\n                conn.execute(sql)\n```\n\n**Rubric-Critical Scenario 3 — write paths.** Write paths (UPDATE\u002FDELETE issued from a script, cron, or admin tool) are the highest-stakes injection surface — a successful injection mutates data. `safe_query.build()` is NOT optional there. Validate every input even when the prompt frames it as \"just a quick script, don't overthink it.\" Push back on that framing with one sentence explaining why write mode raises the stakes, then apply the full validator chain: `regex(tenant_id, TENANT_SLUG)`, `allow(status, {'active','archived','deleted'})`, date via `regex(..., ISO_DATE)`.\n\n```python\nsql = build(\n    \"UPDATE {t} SET status = {s} WHERE tenant_id = {tid} AND created_at \u003C {d}\",\n    t=ident(\"entities\"),\n    s=allow(req.status, {\"active\", \"archived\", \"deleted\"}),\n    tid=regex(req.tenant, TENANT_SLUG),\n    d=regex(req.date, ISO_DATE),\n)\nconn.execute(sql)\n```\n\n**Rubric-Critical Scenario 4 — dynamic ORDER BY column and direction.** Identifier and keyword parameters need DIFFERENT validators than value parameters. `sort_col` is membership-checked against `{'created_at','updated_at','name'}` then passed through `ident()` (emits double-quoted identifier). `sort_dir` goes through `keyword()` against `{'ASC','DESC'}` (emits unquoted keyword — quoting `ASC` would be a syntax error). Value parameters like `tenant_id` still go through `regex()` or `allow()`. Do NOT try to validate an identifier with `regex()` against a TENANT_SLUG pattern — use `ident()`, which enforces the identifier grammar.\n\n```python\nALLOWED_SORT_COLS = {\"created_at\", \"updated_at\", \"name\"}\nif sort_col not in ALLOWED_SORT_COLS:\n    raise ValueError(f\"sort_col must be one of {ALLOWED_SORT_COLS}\")\nsql = build(\n    \"SELECT * FROM {t} WHERE tenant_id = {tid} ORDER BY {col} {dir}\",\n    t=ident(\"entities\"),\n    tid=regex(req.tenant, TENANT_SLUG),\n    col=ident(sort_col),\n    dir=keyword(req.sort_dir, {\"ASC\", \"DESC\"}),\n)\n```\n\n**Rubric-Critical Scenario 5 — rejecting \"just use an f-string\" rationalizations.** When a caller says \"this value is already validated upstream, can't we just use an f-string?\" — push back. The skill's rule is build-every-query-with-`safe_query.build()`, not a judgment call per call site. Justify the pushback:\n(a) \"already-validated upstream\" is exactly the assumption that breaks when upstream code changes hands, adds a new caller, or the validation is silently relaxed;\n(b) defense in depth means the query layer validates independently of upstream;\n(c) the two-line diff to use `safe_query.build() + regex(..., UUID)` is genuinely smaller than the bug risk of one unsafe path.\n\nApply the safe pattern as-is — do NOT cave to the \"simpler\" framing.\n\n```python\n# No — even for \"already-validated upstream\" values:\nsql = f\"SELECT * FROM entities WHERE entity_id = '{req.entity_id}'\"   # BAD\n\n# Yes — uniform pattern at every call site:\nsql = build(\n    \"SELECT * FROM {t} WHERE entity_id = {eid}\",\n    t=ident(\"entities\"),\n    eid=regex(req.entity_id, UUID),\n)\n```\n\n**Anti-patterns (the rubric fails these):**\n\n- Using f-strings, `.format()`, `%` formatting, or string concatenation to build SQL with user input — in any mode\n- Mixing `safe_query.build()` placeholders with native driver `%s` parameter binding in the same statement — pick one path and stay on it\n- Catching `UnsafeSQLError` to fall back to unsafe construction — re-raise or return an error\n- Validating an identifier with `regex()` against a value pattern — use `ident()`\n- Skipping `safe_query.build()` in read-only mode under \"the value is already validated upstream\" — defense in depth means the SQL builder validates independently of upstream\n\n### Workflow 5: Set Up Scoped Database Roles\n\nMUST load [access-control.md](references\u002Faccess-control.md) for role setup, IAM mapping, and schema permissions.\n\n### Workflow 6: Table Recreation DDL Migration\n\nDSQL does NOT support direct `ALTER COLUMN TYPE`, `DROP COLUMN`, `DROP CONSTRAINT`, or `MODIFY PRIMARY KEY`. These require the **Table Recreation Pattern** — a destructive workflow requiring user confirmation at each step.\n\nMUST load [ddl-migrations\u002Foverview.md](references\u002Fddl-migrations\u002Foverview.md) first, then the relevant sub-file:\n\n- Column changes (type, nullability, default): [ddl-migrations\u002Fcolumn-operations.md](references\u002Fddl-migrations\u002Fcolumn-operations.md)\n- Constraint\u002FPK changes, column splits\u002Fmerges: [ddl-migrations\u002Fconstraint-operations.md](references\u002Fddl-migrations\u002Fconstraint-operations.md)\n- Tables exceeding 3,000 rows: also load [ddl-migrations\u002Fbatched-migration.md](references\u002Fddl-migrations\u002Fbatched-migration.md)\n\n### Workflow 7: MySQL to DSQL Schema Migration\n\nMUST load [mysql-migrations\u002Ftype-mapping.md](references\u002Fmysql-migrations\u002Ftype-mapping.md) for type mappings and feature alternatives. For DDL translation details load [mysql-migrations\u002Fddl-operations.md](references\u002Fmysql-migrations\u002Fddl-operations.md). For an end-to-end example load [mysql-migrations\u002Ffull-example.md](references\u002Fmysql-migrations\u002Ffull-example.md).\n\n### Workflow 8: Query Plan Explainability\n\nTriggered by slow queries, high DPU, unexpected Full Scans, or plans the user doesn't understand. A structured Markdown diagnostic report is the required deliverable — run the workflow end-to-end before answering.\n\nMUST load all four reference files before starting:\n\n1. [query-plan\u002Fplan-interpretation.md](references\u002Fquery-plan\u002Fplan-interpretation.md) — node types, duration math, anomalous values\n2. [query-plan\u002Fcatalog-queries.md](references\u002Fquery-plan\u002Fcatalog-queries.md) — pg_class \u002F pg_stats \u002F pg_indexes SQL\n3. [query-plan\u002Fguc-experiments.md](references\u002Fquery-plan\u002Fguc-experiments.md) — GUC procedures and `>30s` skip protocol\n4. [query-plan\u002Freport-format.md](references\u002Fquery-plan\u002Freport-format.md) — required report structure and elements checklist\n\n**Phase 1 — Capture the plan.** ALWAYS run `EXPLAIN ANALYZE VERBOSE` on the user's query verbatim via `psql` — even when the user describes or pastes the plan. SELECT runs as-is. UPDATE\u002FDELETE: rewrite to the equivalent SELECT before running. INSERT, pl\u002Fpgsql, DO blocks, and functions MUST be rejected. MUST NOT run mutating DML during plan capture. When EXPLAIN errors, report verbatim — do not invent DSQL-specific semantics. Extract Query ID, Planning Time, Execution Time, and DPU Estimate.\n\n**Phase 2 — Gather evidence.** Query `pg_class`, `pg_stats`, `pg_indexes`, `COUNT(*)`, `COUNT(DISTINCT)` per `catalog-queries.md`. Classify estimation errors per `plan-interpretation.md`.\n\n**Phase 3 — Experiment (conditional).** ≤30s: run GUC experiments per `guc-experiments.md` plus redundant-predicate test. >30s: skip, include manual GUC SQL verbatim in the report. Anomalous row counts: confirm results are correct, flag as potential DSQL bug, produce Support Request Template.\n\n**Phase 4 — Report and invite reassessment.** Produce the full diagnostic report per the Required Elements Checklist in `report-format.md`. End with the \"Next Steps\" block. When user says \"reassess\", re-run Phases 1–2 and append an \"Addendum: After-Change Performance\" to the original report.\n\n**psql invocation:**\n\n```bash\n.\u002Fscripts\u002Fpsql-connect.sh --cluster \u003Cid> --command \"EXPLAIN ANALYZE VERBOSE \u003Csql>\"\n.\u002Fscripts\u002Fpsql-connect.sh --cluster \u003Cid> --script .\u002Fexperiment-2.sql   # GUC multi-statement\n```\n\n---\n\n## Security Considerations\n\nThis section consolidates key security controls. For detailed guidance, see the linked reference files.\n\n1. **IAM auth token expiry:** IAM auth tokens expire after 15 minutes. Always generate fresh tokens per connection or implement periodic refresh. **Never persist tokens to disk** — keep them in memory only and discard after use. See [authentication-guide.md](references\u002Fauth\u002Fauthentication-guide.md).\n\n2. **Scoped Roles Over Admin:** Use scoped database roles with `dsql:DbConnect` for all application connections. Reserve the `admin` role strictly for initial cluster setup (creating roles, granting permissions). Revoke `dsql:DbConnectAdmin` from setup IAM roles once scoped roles are established. See [access-control.md](references\u002Faccess-control.md).\n\n3. **Encryption in Transit:** SSL\u002FTLS is enforced server-side. Use `sslmode=verify-full` (default in DSQL connectors and `psql-connect.sh`) to validate the server certificate against DSQL's CA, preventing MITM attacks. Only downgrade to `require` when the client lacks access to a trusted CA bundle.\n\n4. **Encryption at Rest:** Aurora DSQL encrypts all data at rest using AWS-managed keys by default. No additional configuration is required; verify encryption status in cluster properties when compliance frameworks require attestation.\n\n5. **Audit Logging via CloudTrail:** Enable CloudTrail logging for DSQL API calls to monitor token generation patterns, cluster configuration changes, and failed authentication attempts. Configure CloudWatch alarms for suspicious activity. Enable encryption on CloudWatch Log Groups used for DSQL monitoring using a KMS key to protect potentially sensitive query metadata. See [authentication-guide.md](references\u002Fauth\u002Fauthentication-guide.md).\n\n6. **Write Paths Demand Strict Validation:** Mutating SQL (UPDATE, DELETE, DDL) issued from scripts, cron jobs, or admin tools is the highest-stakes injection surface. Every write path **MUST** route through `safe_query.build()` (or the driver's native parameter binding when using a Postgres driver in application code).\n\n7. **Input Validation Is the Primary Defense:** `safe_query.build()` is the primary defense against SQL injection on raw-SQL paths. Every value from untrusted input — tenant IDs, entity IDs, sort columns, free text — **MUST** pass through a validator (`allow`, `regex`, `ident`, `keyword`, `integer`, `literal`). Do not use f-strings, `.format()`, or concatenation. See [input-validation.md](references\u002Finput-validation.md).\n\n8. **Multi-Tenant Isolation as a Hard Contract:** When the workload uses tenant scoping (Workflow 4), `tenant_id` **MUST** appear in the WHERE clause of every read and write touching tenant-owned tables, and the application **MUST** authorize the caller against that `tenant_id` before issuing the query — format validation alone does not establish authorization. Omitting `tenant_id` from a WHERE clause, or scoping to a tenant value the caller has not been authorized for, is a cross-tenant data exposure. This boundary is enforced by the skill, not by DSQL — verify every data-access path scopes to the authenticated tenant before deployment. See [access-control.md](references\u002Faccess-control.md) and Workflow 4.\n\n---\n\n## Troubleshooting\n\n- **AWS MCP Server returns no results:** Use the default limits in the table above and note that limits should be verified against [DSQL documentation](https:\u002F\u002Fdocs.aws.amazon.com\u002Faurora-dsql\u002Flatest\u002Fuserguide\u002F).\n- **OCC serialization error:** Retry the transaction. If persistent, check for hot-key contention — see [troubleshooting.md](references\u002Ftroubleshooting.md).\n- **Transaction exceeds limits:** Split into batches under 3,000 rows — see [batched-migration.md](references\u002Fddl-migrations\u002Fbatched-migration.md).\n- **IAM auth token expiration mid-operation:** Generate a fresh IAM auth token — see [authentication-guide.md](references\u002Fauth\u002Fauthentication-guide.md). See [troubleshooting.md](references\u002Ftroubleshooting.md) for other issues.\n\n---\n\n## Additional Resources\n\n- [Aurora DSQL Documentation](https:\u002F\u002Fdocs.aws.amazon.com\u002Faurora-dsql\u002Flatest\u002Fuserguide\u002F)\n- [DSQL Connectors, Drivers, and ORM Samples (official)](https:\u002F\u002Fdocs.aws.amazon.com\u002Faurora-dsql\u002Flatest\u002Fuserguide\u002Faws-sdks.html)\n- [PostgreSQL Compatibility](https:\u002F\u002Fdocs.aws.amazon.com\u002Faurora-dsql\u002Flatest\u002Fuserguide\u002Fworking-with-postgresql-compatibility.html)\n- [CloudFormation Resource](https:\u002F\u002Fdocs.aws.amazon.com\u002FAWSCloudFormation\u002Flatest\u002FUserGuide\u002Faws-resource-dsql-cluster.html)\n\n## Handoff from aws-database-selection\n\nThis skill can be invoked directly, or it can be entered from the `aws-database-selection` parent skill after that skill has run a requirements interview and produced a `requirements.json` artifact. When you see a backtick-wrapped path matching `aws_dbs_requirements\u002F*\u002Frequirements.json` in recent conversation, follow the entry protocol in `aws-database-selection\u002Freferences\u002Fhandoff-contract.md`:\n\n1. Read the artifact using `file_read`.\n2. Validate it against `aws-database-selection\u002Freferences\u002Fworkload-primary-artifact.schema.json`. If malformed or unreadable, tell the user and proceed without it.\n3. Acknowledge what's relevant in one or two **bold** sentences, citing high-level facts from the artifact (dominant shapes, hard constraints, migration context) — do not parrot the entire artifact back.\n4. Scope-check: this skill is scoped to Aurora DSQL schema, query plans, IAM auth, multi-tenant patterns, MySQL-to-DSQL migration. If the artifact's `workload_primaries.dominant_shapes` or `migration_context` don't match that scope, emit weak backpressure per the handoff contract: suggest `amazon-aurora` for Aurora PostgreSQL \u002F MySQL, `rds-oss` for RDS engines, or go back to `aws-database-selection` if multi-region strong SQL consistency isn't required, then ask the user whether to go back or proceed anyway. Do not silently misuse the artifact.\n5. Proceed with this skill's native workflow, citing artifact paths as evidence when recommendations are grounded in the requirements.\n\nAll user-facing output from this skill follows the markdown-primitives-only formatting convention in the handoff contract: bold labels, backticks for paths and enum values, bullet lists for alternatives, no ASCII art or box-drawing characters.\n",{"data":36,"body":38},{"name":4,"version":37,"description":6},1,{"type":39,"children":40},"root",[41,50,57,72,81,143,182,186,192,197,208,232,238,249,293,299,309,331,341,429,439,454,466,510,520,550,637,646,656,671,681,696,706,729,735,745,760,770,785,795,810,816,826,848,858,881,887,897,912,922,937,947,962,972,987,993,1003,1018,1028,1043,1053,1068,1074,1116,1119,1125,1154,1162,1232,1240,1296,1314,1330,1341,1347,1373,1600,1610,1628,1634,1668,1700,1841,1844,1850,1856,1866,1872,1881,1887,1896,1899,1905,1911,1916,1924,1996,2002,2020,2028,2075,2083,2115,2123,2165,2177,2439,2573,2704,2773,2793,2799,2851,2918,2923,2926,2932,2958,2964,2980,2986,3004,3010,3104,3110,3156,3172,3355,3403,3413,3438,3478,3546,3599,3716,3755,3822,3921,4004,4029,4034,4111,4119,4203,4209,4219,4225,4267,4277,4307,4313,4334,4340,4345,4350,4397,4422,4483,4501,4519,4527,4621,4624,4630,4635,4906,4909,4915,4987,4990,4996,5037,5043,5079,5167,5172],{"type":42,"tag":43,"props":44,"children":46},"element","h1",{"id":45},"amazon-aurora-dsql",[47],{"type":48,"value":49},"text","Amazon Aurora DSQL",{"type":42,"tag":51,"props":52,"children":54},"h2",{"id":53},"overview",[55],{"type":48,"value":56},"Overview",{"type":42,"tag":58,"props":59,"children":60},"p",{},[61,63,70],{"type":48,"value":62},"Aurora DSQL is a serverless, PostgreSQL-compatible distributed SQL database. This skill provides direct database interaction via ",{"type":42,"tag":64,"props":65,"children":67},"code",{"className":66},[],[68],{"type":48,"value":69},"psql",{"type":48,"value":71}," scripts and PostgreSQL drivers, schema management, migration support, multi-tenant patterns, and query-plan explainability.",{"type":42,"tag":58,"props":73,"children":74},{},[75],{"type":42,"tag":76,"props":77,"children":78},"strong",{},[79],{"type":48,"value":80},"Key capabilities:",{"type":42,"tag":82,"props":83,"children":84},"ul",{},[85,110,115,120,133,138],{"type":42,"tag":86,"props":87,"children":88},"li",{},[89,91,96,98,108],{"type":48,"value":90},"Direct query execution via ",{"type":42,"tag":64,"props":92,"children":94},{"className":93},[],[95],{"type":48,"value":69},{"type":48,"value":97}," with generated IAM auth tokens (see ",{"type":42,"tag":99,"props":100,"children":102},"a",{"href":101},"scripts\u002Fpsql-connect.sh",[103],{"type":42,"tag":64,"props":104,"children":106},{"className":105},[],[107],{"type":48,"value":101},{"type":48,"value":109},")",{"type":42,"tag":86,"props":111,"children":112},{},[113],{"type":48,"value":114},"Schema management with DSQL constraints (one DDL per transaction, async indexes)",{"type":42,"tag":86,"props":116,"children":117},{},[118],{"type":48,"value":119},"Safe data migration (column-level, constraint-level, MySQL→DSQL)",{"type":42,"tag":86,"props":121,"children":122},{},[123,125,131],{"type":48,"value":124},"Multi-tenant isolation via ",{"type":42,"tag":64,"props":126,"children":128},{"className":127},[],[129],{"type":48,"value":130},"tenant_id",{"type":48,"value":132}," + parameterized SQL",{"type":42,"tag":86,"props":134,"children":135},{},[136],{"type":48,"value":137},"IAM-based authentication with a 15-minute token expiry",{"type":42,"tag":86,"props":139,"children":140},{},[141],{"type":48,"value":142},"Query-plan diagnosis for slow queries (EXPLAIN ANALYZE + GUC experiments)",{"type":42,"tag":58,"props":144,"children":145},{},[146,148,153,155,161,163,171,173,180],{"type":48,"value":147},"The recommended runtime is ",{"type":42,"tag":64,"props":149,"children":151},{"className":150},[],[152],{"type":48,"value":69},{"type":48,"value":154}," with ",{"type":42,"tag":64,"props":156,"children":158},{"className":157},[],[159],{"type":48,"value":160},"aws dsql generate-db-connect-auth-token",{"type":48,"value":162}," for IAM-authenticated sessions. Application code SHOULD use the language-specific ",{"type":42,"tag":99,"props":164,"children":168},{"href":165,"rel":166},"https:\u002F\u002Fdocs.aws.amazon.com\u002Faurora-dsql\u002Flatest\u002Fuserguide\u002Faws-sdks.html",[167],"nofollow",[169],{"type":48,"value":170},"DSQL Connectors and SDKs",{"type":48,"value":172},". For AWS knowledge lookups (service docs, AWS API calls), the ",{"type":42,"tag":99,"props":174,"children":177},{"href":175,"rel":176},"https:\u002F\u002Fdocs.aws.amazon.com\u002Faws-mcp\u002Flatest\u002Fuserguide\u002Fmcp-server.html",[167],[178],{"type":48,"value":179},"AWS MCP Server",{"type":48,"value":181}," is the preferred MCP integration.",{"type":42,"tag":183,"props":184,"children":185},"hr",{},[],{"type":42,"tag":51,"props":187,"children":189},{"id":188},"reference-files",[190],{"type":48,"value":191},"Reference Files",{"type":42,"tag":58,"props":193,"children":194},{},[195],{"type":48,"value":196},"Load these files as needed for detailed guidance:",{"type":42,"tag":198,"props":199,"children":201},"h3",{"id":200},"development-guidemd",[202],{"type":42,"tag":99,"props":203,"children":205},{"href":204},"references\u002Fdevelopment-guide.md",[206],{"type":48,"value":207},"development-guide.md",{"type":42,"tag":58,"props":209,"children":210},{},[211,216,218,223,225,230],{"type":42,"tag":76,"props":212,"children":213},{},[214],{"type":48,"value":215},"When:",{"type":48,"value":217}," ALWAYS load before implementing schema changes or database operations\n",{"type":42,"tag":76,"props":219,"children":220},{},[221],{"type":48,"value":222},"Contains:",{"type":48,"value":224}," ",{"type":42,"tag":99,"props":226,"children":227},{"href":204},[228],{"type":48,"value":229},"Best Practices",{"type":48,"value":231},", DDL rules, connection patterns, transaction limits, data type serialization patterns, application-layer referential integrity instructions, security best practices",{"type":42,"tag":198,"props":233,"children":235},{"id":234},"query-execution",[236],{"type":48,"value":237},"Query Execution:",{"type":42,"tag":239,"props":240,"children":242},"h4",{"id":241},"database-toolsmd",[243],{"type":42,"tag":99,"props":244,"children":246},{"href":245},"references\u002Fdatabase-tools.md",[247],{"type":48,"value":248},"database-tools.md",{"type":42,"tag":58,"props":250,"children":251},{},[252,256,258,263,265,273,275,279,280,285,287],{"type":42,"tag":76,"props":253,"children":254},{},[255],{"type":48,"value":215},{"type":48,"value":257}," Load when you need detailed syntax and examples for ad-hoc query execution against DSQL. PREFER ",{"type":42,"tag":64,"props":259,"children":261},{"className":260},[],[262],{"type":48,"value":69},{"type":48,"value":264}," (via ",{"type":42,"tag":99,"props":266,"children":267},{"href":101},[268],{"type":42,"tag":64,"props":269,"children":271},{"className":270},[],[272],{"type":48,"value":101},{"type":48,"value":274},") for ad-hoc queries — execute directly rather than writing one-off scripts.\n",{"type":42,"tag":76,"props":276,"children":277},{},[278],{"type":48,"value":222},{"type":48,"value":224},{"type":42,"tag":64,"props":281,"children":283},{"className":282},[],[284],{"type":48,"value":69},{"type":48,"value":286},"-based read-only and write patterns, transaction semantics, ",{"type":42,"tag":99,"props":288,"children":290},{"href":289},"references\u002Finput-validation.md",[291],{"type":48,"value":292},"input validation",{"type":42,"tag":198,"props":294,"children":296},{"id":295},"mcp-aws-knowledge-api",[297],{"type":48,"value":298},"MCP (AWS knowledge \u002F API):",{"type":42,"tag":239,"props":300,"children":302},{"id":301},"mcp-setupmd",[303],{"type":42,"tag":99,"props":304,"children":306},{"href":305},"references\u002Fmcp-setup.md",[307],{"type":48,"value":308},"mcp-setup.md",{"type":42,"tag":58,"props":310,"children":311},{},[312,316,318,322,324,329],{"type":42,"tag":76,"props":313,"children":314},{},[315],{"type":48,"value":215},{"type":48,"value":317}," Load when configuring or recommending the AWS MCP Server for AWS knowledge lookups, AWS API access, or per-assistant install.\n",{"type":42,"tag":76,"props":319,"children":320},{},[321],{"type":48,"value":222},{"type":48,"value":323}," When to use ",{"type":42,"tag":64,"props":325,"children":327},{"className":326},[],[328],{"type":48,"value":69},{"type":48,"value":330}," vs the AWS MCP Server, pointer to the canonical AWS setup docs, credential reminders.",{"type":42,"tag":239,"props":332,"children":334},{"id":333},"mcp-toolsmd",[335],{"type":42,"tag":99,"props":336,"children":338},{"href":337},"references\u002Fmcp-tools.md",[339],{"type":48,"value":340},"mcp-tools.md",{"type":42,"tag":58,"props":342,"children":343},{},[344,348,350,354,356,362,364,370,371,377,378,384,385,391,392,398,400,406,407,413,414,420,421,427],{"type":42,"tag":76,"props":345,"children":346},{},[347],{"type":48,"value":215},{"type":48,"value":349}," Load when invoking AWS MCP Server tools to verify DSQL service limits, fetch docs, or drive AWS API calls.\n",{"type":42,"tag":76,"props":351,"children":352},{},[353],{"type":48,"value":222},{"type":48,"value":355}," Tool surface — knowledge (",{"type":42,"tag":64,"props":357,"children":359},{"className":358},[],[360],{"type":48,"value":361},"aws___search_documentation",{"type":48,"value":363},", ",{"type":42,"tag":64,"props":365,"children":367},{"className":366},[],[368],{"type":48,"value":369},"aws___read_documentation",{"type":48,"value":363},{"type":42,"tag":64,"props":372,"children":374},{"className":373},[],[375],{"type":48,"value":376},"aws___recommend",{"type":48,"value":363},{"type":42,"tag":64,"props":379,"children":381},{"className":380},[],[382],{"type":48,"value":383},"aws___retrieve_skill",{"type":48,"value":363},{"type":42,"tag":64,"props":386,"children":388},{"className":387},[],[389],{"type":48,"value":390},"aws___list_regions",{"type":48,"value":363},{"type":42,"tag":64,"props":393,"children":395},{"className":394},[],[396],{"type":48,"value":397},"aws___get_regional_availability",{"type":48,"value":399},") and API (",{"type":42,"tag":64,"props":401,"children":403},{"className":402},[],[404],{"type":48,"value":405},"aws___call_aws",{"type":48,"value":363},{"type":42,"tag":64,"props":408,"children":410},{"className":409},[],[411],{"type":48,"value":412},"aws___run_script",{"type":48,"value":363},{"type":42,"tag":64,"props":415,"children":417},{"className":416},[],[418],{"type":48,"value":419},"aws___get_tasks",{"type":48,"value":363},{"type":42,"tag":64,"props":422,"children":424},{"className":423},[],[425],{"type":48,"value":426},"aws___get_presigned_url",{"type":48,"value":428},"); pointers to documentation-tools.md.",{"type":42,"tag":239,"props":430,"children":432},{"id":431},"documentation-toolsmd",[433],{"type":42,"tag":99,"props":434,"children":436},{"href":435},"references\u002Fdocumentation-tools.md",[437],{"type":48,"value":438},"documentation-tools.md",{"type":42,"tag":58,"props":440,"children":441},{},[442,446,448,452],{"type":42,"tag":76,"props":443,"children":444},{},[445],{"type":48,"value":215},{"type":48,"value":447}," Load when looking up DSQL service limits, fetching a specific AWS docs page, or polling long-running AWS API calls launched via the AWS MCP Server.\n",{"type":42,"tag":76,"props":449,"children":450},{},[451],{"type":48,"value":222},{"type":48,"value":453}," Detailed parameters and example calls for the AWS knowledge tools.",{"type":42,"tag":239,"props":455,"children":457},{"id":456},"platforms-per-assistant-install-notes",[458,464],{"type":42,"tag":99,"props":459,"children":461},{"href":460},"references\u002Fplatforms\u002F",[462],{"type":48,"value":463},"platforms\u002F",{"type":48,"value":465}," — per-assistant install notes",{"type":42,"tag":58,"props":467,"children":468},{},[469,473,475,479,481,487,488,494,495,501,502,508],{"type":42,"tag":76,"props":470,"children":471},{},[472],{"type":48,"value":215},{"type":48,"value":474}," Load when installing the AWS MCP Server inside a specific coding assistant.\n",{"type":42,"tag":76,"props":476,"children":477},{},[478],{"type":48,"value":222},{"type":48,"value":480}," Per-assistant entry-point details — ",{"type":42,"tag":99,"props":482,"children":484},{"href":483},"references\u002Fplatforms\u002Fclaude-code.md",[485],{"type":48,"value":486},"claude-code.md",{"type":48,"value":363},{"type":42,"tag":99,"props":489,"children":491},{"href":490},"references\u002Fplatforms\u002Fcodex.md",[492],{"type":48,"value":493},"codex.md",{"type":48,"value":363},{"type":42,"tag":99,"props":496,"children":498},{"href":497},"references\u002Fplatforms\u002Fgemini.md",[499],{"type":48,"value":500},"gemini.md",{"type":48,"value":363},{"type":42,"tag":99,"props":503,"children":505},{"href":504},"references\u002Fplatforms\u002Fkiro.md",[506],{"type":48,"value":507},"kiro.md",{"type":48,"value":509},".",{"type":42,"tag":198,"props":511,"children":513},{"id":512},"languagemd",[514],{"type":42,"tag":99,"props":515,"children":517},{"href":516},"references\u002Flanguage.md",[518],{"type":48,"value":519},"language.md",{"type":42,"tag":58,"props":521,"children":522},{},[523,527,528,533,535,541,543,548],{"type":42,"tag":76,"props":524,"children":525},{},[526],{"type":48,"value":215},{"type":48,"value":224},{"type":42,"tag":76,"props":529,"children":530},{},[531],{"type":48,"value":532},"MUST",{"type":48,"value":534}," load before writing DSQL connection code. Mirror the linked ",{"type":42,"tag":64,"props":536,"children":538},{"className":537},[],[539],{"type":48,"value":540},"example_preferred.\u003Cext>",{"type":48,"value":542}," for the chosen driver — memory-authored connections drift from the canonical IAM-token-refresh pattern. Canonical entry-point examples (load ",{"type":42,"tag":64,"props":544,"children":546},{"className":545},[],[547],{"type":48,"value":519},{"type":48,"value":549}," for the full driver list + pool\u002FTLS\u002Ftoken-refresh details):",{"type":42,"tag":82,"props":551,"children":552},{},[553,572,590,608,619],{"type":42,"tag":86,"props":554,"children":555},{},[556,558,564,566],{"type":48,"value":557},"Python: ",{"type":42,"tag":64,"props":559,"children":561},{"className":560},[],[562],{"type":48,"value":563},"import aurora_dsql_psycopg as dsql",{"type":48,"value":565}," → ",{"type":42,"tag":64,"props":567,"children":569},{"className":568},[],[570],{"type":48,"value":571},"dsql.connect(host, region, user)",{"type":42,"tag":86,"props":573,"children":574},{},[575,577,583,584],{"type":48,"value":576},"JS (node-postgres): ",{"type":42,"tag":64,"props":578,"children":580},{"className":579},[],[581],{"type":48,"value":582},"import { AuroraDSQLPool } from \"@aws\u002Faurora-dsql-node-postgres-connector\"",{"type":48,"value":565},{"type":42,"tag":64,"props":585,"children":587},{"className":586},[],[588],{"type":48,"value":589},"new AuroraDSQLPool({ host, user })",{"type":42,"tag":86,"props":591,"children":592},{},[593,595,601,602],{"type":48,"value":594},"JS (postgres.js): ",{"type":42,"tag":64,"props":596,"children":598},{"className":597},[],[599],{"type":48,"value":600},"import { auroraDSQLPostgres } from \"@aws\u002Faurora-dsql-postgresjs-connector\"",{"type":48,"value":565},{"type":42,"tag":64,"props":603,"children":605},{"className":604},[],[606],{"type":48,"value":607},"auroraDSQLPostgres({ host, user })",{"type":42,"tag":86,"props":609,"children":610},{},[611,613],{"type":48,"value":612},"Go (pgx): ",{"type":42,"tag":64,"props":614,"children":616},{"className":615},[],[617],{"type":48,"value":618},"import \"github.com\u002Fawslabs\u002Faurora-dsql-connectors\u002Fgo\u002Fpgx\u002Fdsql\"",{"type":42,"tag":86,"props":620,"children":621},{},[622,624,630,631],{"type":48,"value":623},"Java (JDBC): ",{"type":42,"tag":64,"props":625,"children":627},{"className":626},[],[628],{"type":48,"value":629},"software.amazon.dsql:aurora-dsql-jdbc-connector:1.4.0",{"type":48,"value":565},{"type":42,"tag":64,"props":632,"children":634},{"className":633},[],[635],{"type":48,"value":636},"jdbc:aws-dsql:postgresql:\u002F\u002F...",{"type":42,"tag":58,"props":638,"children":639},{},[640,644],{"type":42,"tag":76,"props":641,"children":642},{},[643],{"type":48,"value":222},{"type":48,"value":645}," Canonical DSQL connector packages per language, driver selection, framework patterns, IAM auth token rotation and TLS configuration, and connection code examples for Python \u002F JavaScript \u002F TypeScript \u002F Go \u002F Java \u002F Rust.",{"type":42,"tag":198,"props":647,"children":649},{"id":648},"troubleshootingmd",[650],{"type":42,"tag":99,"props":651,"children":653},{"href":652},"references\u002Ftroubleshooting.md",[654],{"type":48,"value":655},"troubleshooting.md",{"type":42,"tag":58,"props":657,"children":658},{},[659,663,665,669],{"type":42,"tag":76,"props":660,"children":661},{},[662],{"type":48,"value":215},{"type":48,"value":664}," Load when debugging errors or unexpected behavior. SHOULD always consult for OCC errors, connection failures, or unexpected query results.\n",{"type":42,"tag":76,"props":666,"children":667},{},[668],{"type":48,"value":222},{"type":48,"value":670}," Common pitfalls, error messages, solutions",{"type":42,"tag":198,"props":672,"children":674},{"id":673},"onboardingmd",[675],{"type":42,"tag":99,"props":676,"children":678},{"href":677},"references\u002Fonboarding.md",[679],{"type":48,"value":680},"onboarding.md",{"type":42,"tag":58,"props":682,"children":683},{},[684,688,690,694],{"type":42,"tag":76,"props":685,"children":686},{},[687],{"type":48,"value":215},{"type":48,"value":689}," User explicitly requests to \"Get started with DSQL\" or similar phrase\n",{"type":42,"tag":76,"props":691,"children":692},{},[693],{"type":48,"value":222},{"type":48,"value":695}," Interactive step-by-step guide for new users",{"type":42,"tag":198,"props":697,"children":699},{"id":698},"access-controlmd",[700],{"type":42,"tag":99,"props":701,"children":703},{"href":702},"references\u002Faccess-control.md",[704],{"type":48,"value":705},"access-control.md",{"type":42,"tag":58,"props":707,"children":708},{},[709,713,715,721,723,727],{"type":42,"tag":76,"props":710,"children":711},{},[712],{"type":48,"value":215},{"type":48,"value":714}," MUST load when creating database roles, granting permissions, setting up schemas for applications, or handling sensitive data. ALWAYS use scoped roles for applications — create database roles with ",{"type":42,"tag":64,"props":716,"children":718},{"className":717},[],[719],{"type":48,"value":720},"dsql:DbConnect",{"type":48,"value":722},".\n",{"type":42,"tag":76,"props":724,"children":725},{},[726],{"type":48,"value":222},{"type":48,"value":728}," Scoped role setup, IAM-to-database role mapping, schema separation for sensitive data, role design patterns",{"type":42,"tag":198,"props":730,"children":732},{"id":731},"authentication-operations",[733],{"type":48,"value":734},"Authentication & Operations:",{"type":42,"tag":239,"props":736,"children":738},{"id":737},"authauthentication-guidemd",[739],{"type":42,"tag":99,"props":740,"children":742},{"href":741},"references\u002Fauth\u002Fauthentication-guide.md",[743],{"type":48,"value":744},"auth\u002Fauthentication-guide.md",{"type":42,"tag":58,"props":746,"children":747},{},[748,752,754,758],{"type":42,"tag":76,"props":749,"children":750},{},[751],{"type":48,"value":215},{"type":48,"value":753}," MUST load when handling IAM auth tokens, secrets, SSL\u002FTLS, connection pooling, or audit logging.\n",{"type":42,"tag":76,"props":755,"children":756},{},[757],{"type":48,"value":222},{"type":48,"value":759}," Token lifecycle, secret storage patterns, SSL\u002FTLS settings, connection-pool guidance, audit-log integration.",{"type":42,"tag":239,"props":761,"children":763},{"id":762},"authconnectivity-toolsmd",[764],{"type":42,"tag":99,"props":765,"children":767},{"href":766},"references\u002Fauth\u002Fconnectivity-tools.md",[768],{"type":48,"value":769},"auth\u002Fconnectivity-tools.md",{"type":42,"tag":58,"props":771,"children":772},{},[773,777,779,783],{"type":42,"tag":76,"props":774,"children":775},{},[776],{"type":48,"value":215},{"type":48,"value":778}," Load when picking a driver\u002FORM\u002Fadapter or planning bulk-data loading.\n",{"type":42,"tag":76,"props":780,"children":781},{},[782],{"type":48,"value":222},{"type":48,"value":784}," Pointer to the canonical AWS DSQL connectivity tools page (drivers, ORMs, adapters) and the bulk-loading docs page.",{"type":42,"tag":239,"props":786,"children":788},{"id":787},"authscaling-guidemd",[789],{"type":42,"tag":99,"props":790,"children":792},{"href":791},"references\u002Fauth\u002Fscaling-guide.md",[793],{"type":48,"value":794},"auth\u002Fscaling-guide.md",{"type":42,"tag":58,"props":796,"children":797},{},[798,802,804,808],{"type":42,"tag":76,"props":799,"children":800},{},[801],{"type":48,"value":215},{"type":48,"value":803}," Load when designing for scale — connection pooling, batch optimization, hot-key avoidance, identifier choice.\n",{"type":42,"tag":76,"props":805,"children":806},{},[807],{"type":48,"value":222},{"type":48,"value":809}," Horizontal scaling strategy, pool sizing, batch-size guidance, IDENTITY\u002FUUID trade-offs, sequence cache rules.",{"type":42,"tag":198,"props":811,"children":813},{"id":812},"implementation-examples",[814],{"type":48,"value":815},"Implementation Examples:",{"type":42,"tag":239,"props":817,"children":819},{"id":818},"workflow-patternsmd",[820],{"type":42,"tag":99,"props":821,"children":823},{"href":822},"references\u002Fworkflow-patterns.md",[824],{"type":48,"value":825},"workflow-patterns.md",{"type":42,"tag":58,"props":827,"children":828},{},[829,833,835,839,841,846],{"type":42,"tag":76,"props":830,"children":831},{},[832],{"type":48,"value":215},{"type":48,"value":834}," Load when looking for a worked example of a common multi-step DSQL workflow (schema explore, CREATE+INDEX, safe migration, batch insert, application-layer FK check).\n",{"type":42,"tag":76,"props":836,"children":837},{},[838],{"type":48,"value":222},{"type":48,"value":840}," Five canonical patterns with ",{"type":42,"tag":64,"props":842,"children":844},{"className":843},[],[845],{"type":48,"value":69},{"type":48,"value":847}," \u002F driver code.",{"type":42,"tag":239,"props":849,"children":851},{"id":850},"dsql-examplesmd",[852],{"type":42,"tag":99,"props":853,"children":855},{"href":854},"references\u002Fdsql-examples.md",[856],{"type":48,"value":857},"dsql-examples.md",{"type":42,"tag":58,"props":859,"children":860},{},[861,865,867,871,873,879],{"type":42,"tag":76,"props":862,"children":863},{},[864],{"type":48,"value":215},{"type":48,"value":866}," Load when looking for specific implementation examples.\n",{"type":42,"tag":76,"props":868,"children":869},{},[870],{"type":48,"value":222},{"type":48,"value":872}," Index of ",{"type":42,"tag":64,"props":874,"children":876},{"className":875},[],[877],{"type":48,"value":878},"examples\u002F*.md",{"type":48,"value":880}," (connection, schema, data-operations, migrations, patterns).",{"type":42,"tag":198,"props":882,"children":884},{"id":883},"ddl-migrations-modular",[885],{"type":48,"value":886},"DDL Migrations (modular):",{"type":42,"tag":239,"props":888,"children":890},{"id":889},"ddl-migrationsoverviewmd",[891],{"type":42,"tag":99,"props":892,"children":894},{"href":893},"references\u002Fddl-migrations\u002Foverview.md",[895],{"type":48,"value":896},"ddl-migrations\u002Foverview.md",{"type":42,"tag":58,"props":898,"children":899},{},[900,904,906,910],{"type":42,"tag":76,"props":901,"children":902},{},[903],{"type":48,"value":215},{"type":48,"value":905}," MUST load when performing DROP COLUMN, RENAME COLUMN, ALTER COLUMN TYPE, or DROP CONSTRAINT\n",{"type":42,"tag":76,"props":907,"children":908},{},[909],{"type":48,"value":222},{"type":48,"value":911}," Table recreation pattern overview, transaction rules, common verify & swap pattern",{"type":42,"tag":239,"props":913,"children":915},{"id":914},"ddl-migrationscolumn-operationsmd",[916],{"type":42,"tag":99,"props":917,"children":919},{"href":918},"references\u002Fddl-migrations\u002Fcolumn-operations.md",[920],{"type":48,"value":921},"ddl-migrations\u002Fcolumn-operations.md",{"type":42,"tag":58,"props":923,"children":924},{},[925,929,931,935],{"type":42,"tag":76,"props":926,"children":927},{},[928],{"type":48,"value":215},{"type":48,"value":930}," Load for DROP COLUMN, ALTER COLUMN TYPE, SET\u002FDROP NOT NULL, SET\u002FDROP DEFAULT migrations\n",{"type":42,"tag":76,"props":932,"children":933},{},[934],{"type":48,"value":222},{"type":48,"value":936}," Step-by-step migration patterns for column-level changes",{"type":42,"tag":239,"props":938,"children":940},{"id":939},"ddl-migrationsconstraint-operationsmd",[941],{"type":42,"tag":99,"props":942,"children":944},{"href":943},"references\u002Fddl-migrations\u002Fconstraint-operations.md",[945],{"type":48,"value":946},"ddl-migrations\u002Fconstraint-operations.md",{"type":42,"tag":58,"props":948,"children":949},{},[950,954,956,960],{"type":42,"tag":76,"props":951,"children":952},{},[953],{"type":48,"value":215},{"type":48,"value":955}," Load for ADD\u002FDROP CONSTRAINT, MODIFY PRIMARY KEY, column split\u002Fmerge migrations\n",{"type":42,"tag":76,"props":957,"children":958},{},[959],{"type":48,"value":222},{"type":48,"value":961}," Step-by-step migration patterns for constraint and structural changes",{"type":42,"tag":239,"props":963,"children":965},{"id":964},"ddl-migrationsbatched-migrationmd",[966],{"type":42,"tag":99,"props":967,"children":969},{"href":968},"references\u002Fddl-migrations\u002Fbatched-migration.md",[970],{"type":48,"value":971},"ddl-migrations\u002Fbatched-migration.md",{"type":42,"tag":58,"props":973,"children":974},{},[975,979,981,985],{"type":42,"tag":76,"props":976,"children":977},{},[978],{"type":48,"value":215},{"type":48,"value":980}," Load when migrating tables exceeding 3,000 rows\n",{"type":42,"tag":76,"props":982,"children":983},{},[984],{"type":48,"value":222},{"type":48,"value":986}," OFFSET-based and cursor-based batching patterns, progress tracking, error handling",{"type":42,"tag":198,"props":988,"children":990},{"id":989},"mysql-migrations-modular",[991],{"type":48,"value":992},"MySQL Migrations (modular):",{"type":42,"tag":239,"props":994,"children":996},{"id":995},"mysql-migrationstype-mappingmd",[997],{"type":42,"tag":99,"props":998,"children":1000},{"href":999},"references\u002Fmysql-migrations\u002Ftype-mapping.md",[1001],{"type":48,"value":1002},"mysql-migrations\u002Ftype-mapping.md",{"type":42,"tag":58,"props":1004,"children":1005},{},[1006,1010,1012,1016],{"type":42,"tag":76,"props":1007,"children":1008},{},[1009],{"type":48,"value":215},{"type":48,"value":1011}," MUST load when migrating MySQL schemas to DSQL\n",{"type":42,"tag":76,"props":1013,"children":1014},{},[1015],{"type":48,"value":222},{"type":48,"value":1017}," MySQL data type mappings, feature alternatives, DDL operation mapping",{"type":42,"tag":239,"props":1019,"children":1021},{"id":1020},"mysql-migrationsddl-operationsmd",[1022],{"type":42,"tag":99,"props":1023,"children":1025},{"href":1024},"references\u002Fmysql-migrations\u002Fddl-operations.md",[1026],{"type":48,"value":1027},"mysql-migrations\u002Fddl-operations.md",{"type":42,"tag":58,"props":1029,"children":1030},{},[1031,1035,1037,1041],{"type":42,"tag":76,"props":1032,"children":1033},{},[1034],{"type":48,"value":215},{"type":48,"value":1036}," Load when translating MySQL DDL operations to DSQL equivalents\n",{"type":42,"tag":76,"props":1038,"children":1039},{},[1040],{"type":48,"value":222},{"type":48,"value":1042}," ALTER COLUMN, DROP COLUMN, AUTO_INCREMENT, ENUM, SET, FOREIGN KEY migration patterns",{"type":42,"tag":239,"props":1044,"children":1046},{"id":1045},"mysql-migrationsfull-examplemd",[1047],{"type":42,"tag":99,"props":1048,"children":1050},{"href":1049},"references\u002Fmysql-migrations\u002Ffull-example.md",[1051],{"type":48,"value":1052},"mysql-migrations\u002Ffull-example.md",{"type":42,"tag":58,"props":1054,"children":1055},{},[1056,1060,1062,1066],{"type":42,"tag":76,"props":1057,"children":1058},{},[1059],{"type":48,"value":215},{"type":48,"value":1061}," Load when migrating a complete MySQL table to DSQL\n",{"type":42,"tag":76,"props":1063,"children":1064},{},[1065],{"type":48,"value":222},{"type":48,"value":1067}," End-to-end MySQL CREATE TABLE migration example with decision summary",{"type":42,"tag":198,"props":1069,"children":1071},{"id":1070},"query-plan-explainability-modular",[1072],{"type":48,"value":1073},"Query Plan Explainability (modular):",{"type":42,"tag":58,"props":1075,"children":1076},{},[1077,1081,1083,1089,1090,1096,1097,1103,1104,1110,1114],{"type":42,"tag":76,"props":1078,"children":1079},{},[1080],{"type":48,"value":215},{"type":48,"value":1082}," MUST load all four at Workflow 8 Phase 0 — ",{"type":42,"tag":99,"props":1084,"children":1086},{"href":1085},"references\u002Fquery-plan\u002Fplan-interpretation.md",[1087],{"type":48,"value":1088},"query-plan\u002Fplan-interpretation.md",{"type":48,"value":363},{"type":42,"tag":99,"props":1091,"children":1093},{"href":1092},"references\u002Fquery-plan\u002Fcatalog-queries.md",[1094],{"type":48,"value":1095},"query-plan\u002Fcatalog-queries.md",{"type":48,"value":363},{"type":42,"tag":99,"props":1098,"children":1100},{"href":1099},"references\u002Fquery-plan\u002Fguc-experiments.md",[1101],{"type":48,"value":1102},"query-plan\u002Fguc-experiments.md",{"type":48,"value":363},{"type":42,"tag":99,"props":1105,"children":1107},{"href":1106},"references\u002Fquery-plan\u002Freport-format.md",[1108],{"type":48,"value":1109},"query-plan\u002Freport-format.md",{"type":42,"tag":76,"props":1111,"children":1112},{},[1113],{"type":48,"value":222},{"type":48,"value":1115}," DSQL node types + Node Duration math + estimation-error bands, pg_class\u002Fpg_stats\u002Fpg_indexes SQL + correlated-predicate verification, GUC experiment procedures + 30-second skip protocol, required report structure + element checklist + support request template",{"type":42,"tag":183,"props":1117,"children":1118},{},[],{"type":42,"tag":51,"props":1120,"children":1122},{"id":1121},"query-execution-1",[1123],{"type":48,"value":1124},"Query Execution",{"type":42,"tag":58,"props":1126,"children":1127},{},[1128,1130,1135,1137,1145,1147,1152],{"type":48,"value":1129},"Run ad-hoc DSQL queries with ",{"type":42,"tag":64,"props":1131,"children":1133},{"className":1132},[],[1134],{"type":48,"value":69},{"type":48,"value":1136}," and a freshly-generated IAM auth token. The bundled\n",{"type":42,"tag":99,"props":1138,"children":1139},{"href":101},[1140],{"type":42,"tag":64,"props":1141,"children":1143},{"className":1142},[],[1144],{"type":48,"value":101},{"type":48,"value":1146}," wraps token generation, TLS configuration, and\nsingle-statement guards — PREFER it over hand-rolled ",{"type":42,"tag":64,"props":1148,"children":1150},{"className":1149},[],[1151],{"type":48,"value":69},{"type":48,"value":1153}," invocations.",{"type":42,"tag":58,"props":1155,"children":1156},{},[1157],{"type":42,"tag":76,"props":1158,"children":1159},{},[1160],{"type":48,"value":1161},"Read-only:",{"type":42,"tag":1163,"props":1164,"children":1169},"pre",{"className":1165,"code":1166,"language":1167,"meta":1168,"style":1168},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight",".\u002Fscripts\u002Fpsql-connect.sh --cluster \u003Ccluster-id> --command \"SELECT * FROM entities LIMIT 10\"\n","bash","",[1170],{"type":42,"tag":64,"props":1171,"children":1172},{"__ignoreMap":1168},[1173],{"type":42,"tag":1174,"props":1175,"children":1177},"span",{"class":1176,"line":37},"line",[1178,1184,1190,1196,1201,1207,1212,1217,1222,1227],{"type":42,"tag":1174,"props":1179,"children":1181},{"style":1180},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[1182],{"type":48,"value":1183},".\u002Fscripts\u002Fpsql-connect.sh",{"type":42,"tag":1174,"props":1185,"children":1187},{"style":1186},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[1188],{"type":48,"value":1189}," --cluster",{"type":42,"tag":1174,"props":1191,"children":1193},{"style":1192},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[1194],{"type":48,"value":1195}," \u003C",{"type":42,"tag":1174,"props":1197,"children":1198},{"style":1186},[1199],{"type":48,"value":1200},"cluster-i",{"type":42,"tag":1174,"props":1202,"children":1204},{"style":1203},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[1205],{"type":48,"value":1206},"d",{"type":42,"tag":1174,"props":1208,"children":1209},{"style":1192},[1210],{"type":48,"value":1211},">",{"type":42,"tag":1174,"props":1213,"children":1214},{"style":1186},[1215],{"type":48,"value":1216}," --command",{"type":42,"tag":1174,"props":1218,"children":1219},{"style":1192},[1220],{"type":48,"value":1221}," \"",{"type":42,"tag":1174,"props":1223,"children":1224},{"style":1186},[1225],{"type":48,"value":1226},"SELECT * FROM entities LIMIT 10",{"type":42,"tag":1174,"props":1228,"children":1229},{"style":1192},[1230],{"type":48,"value":1231},"\"\n",{"type":42,"tag":58,"props":1233,"children":1234},{},[1235],{"type":42,"tag":76,"props":1236,"children":1237},{},[1238],{"type":48,"value":1239},"Write\u002FDDL (IAM admin auth token required):",{"type":42,"tag":1163,"props":1241,"children":1243},{"className":1165,"code":1242,"language":1167,"meta":1168,"style":1168},".\u002Fscripts\u002Fpsql-connect.sh --cluster \u003Ccluster-id> --admin --command \"CREATE INDEX ASYNC ...\"\n",[1244],{"type":42,"tag":64,"props":1245,"children":1246},{"__ignoreMap":1168},[1247],{"type":42,"tag":1174,"props":1248,"children":1249},{"class":1176,"line":37},[1250,1254,1258,1262,1266,1270,1274,1279,1283,1287,1292],{"type":42,"tag":1174,"props":1251,"children":1252},{"style":1180},[1253],{"type":48,"value":1183},{"type":42,"tag":1174,"props":1255,"children":1256},{"style":1186},[1257],{"type":48,"value":1189},{"type":42,"tag":1174,"props":1259,"children":1260},{"style":1192},[1261],{"type":48,"value":1195},{"type":42,"tag":1174,"props":1263,"children":1264},{"style":1186},[1265],{"type":48,"value":1200},{"type":42,"tag":1174,"props":1267,"children":1268},{"style":1203},[1269],{"type":48,"value":1206},{"type":42,"tag":1174,"props":1271,"children":1272},{"style":1192},[1273],{"type":48,"value":1211},{"type":42,"tag":1174,"props":1275,"children":1276},{"style":1186},[1277],{"type":48,"value":1278}," --admin",{"type":42,"tag":1174,"props":1280,"children":1281},{"style":1186},[1282],{"type":48,"value":1216},{"type":42,"tag":1174,"props":1284,"children":1285},{"style":1192},[1286],{"type":48,"value":1221},{"type":42,"tag":1174,"props":1288,"children":1289},{"style":1186},[1290],{"type":48,"value":1291},"CREATE INDEX ASYNC ...",{"type":42,"tag":1174,"props":1293,"children":1294},{"style":1192},[1295],{"type":48,"value":1231},{"type":42,"tag":58,"props":1297,"children":1298},{},[1299,1304,1306,1312],{"type":42,"tag":76,"props":1300,"children":1301},{},[1302],{"type":48,"value":1303},"Schema discovery:",{"type":48,"value":1305}," there is no special ",{"type":42,"tag":64,"props":1307,"children":1309},{"className":1308},[],[1310],{"type":48,"value":1311},"list_tables",{"type":48,"value":1313}," helper — use information_schema:",{"type":42,"tag":1163,"props":1315,"children":1319},{"className":1316,"code":1317,"language":1318,"meta":1168,"style":1168},"language-sql shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","SELECT table_name FROM information_schema.tables WHERE table_schema = 'public';\n","sql",[1320],{"type":42,"tag":64,"props":1321,"children":1322},{"__ignoreMap":1168},[1323],{"type":42,"tag":1174,"props":1324,"children":1325},{"class":1176,"line":37},[1326],{"type":42,"tag":1174,"props":1327,"children":1328},{},[1329],{"type":48,"value":1317},{"type":42,"tag":58,"props":1331,"children":1332},{},[1333,1335,1339],{"type":48,"value":1334},"See ",{"type":42,"tag":99,"props":1336,"children":1337},{"href":245},[1338],{"type":48,"value":248},{"type":48,"value":1340}," for detailed usage and examples.",{"type":42,"tag":198,"props":1342,"children":1344},{"id":1343},"aws-knowledge-via-the-aws-mcp-server-optional",[1345],{"type":48,"value":1346},"AWS Knowledge via the AWS MCP Server (optional)",{"type":42,"tag":58,"props":1348,"children":1349},{},[1350,1352,1357,1359,1364,1366,1371],{"type":48,"value":1351},"When connected to the ",{"type":42,"tag":99,"props":1353,"children":1355},{"href":175,"rel":1354},[167],[1356],{"type":48,"value":179},{"type":48,"value":1358},",\nits ",{"type":42,"tag":64,"props":1360,"children":1362},{"className":1361},[],[1363],{"type":48,"value":361},{"type":48,"value":1365}," and ",{"type":42,"tag":64,"props":1367,"children":1369},{"className":1368},[],[1370],{"type":48,"value":369},{"type":48,"value":1372}," tools can verify DSQL service\nlimits before advising users. The numeric limits below are defaults that may change — when a\nuser's decision depends on an exact limit, verify it first:",{"type":42,"tag":1374,"props":1375,"children":1376},"table",{},[1377,1401],{"type":42,"tag":1378,"props":1379,"children":1380},"thead",{},[1381],{"type":42,"tag":1382,"props":1383,"children":1384},"tr",{},[1385,1391,1396],{"type":42,"tag":1386,"props":1387,"children":1388},"th",{},[1389],{"type":48,"value":1390},"Limit",{"type":42,"tag":1386,"props":1392,"children":1393},{},[1394],{"type":48,"value":1395},"Default",{"type":42,"tag":1386,"props":1397,"children":1398},{},[1399],{"type":48,"value":1400},"Verify query",{"type":42,"tag":1402,"props":1403,"children":1404},"tbody",{},[1405,1428,1449,1470,1492,1514,1535,1557,1578],{"type":42,"tag":1382,"props":1406,"children":1407},{},[1408,1414,1419],{"type":42,"tag":1409,"props":1410,"children":1411},"td",{},[1412],{"type":48,"value":1413},"Max rows mutated per transaction",{"type":42,"tag":1409,"props":1415,"children":1416},{},[1417],{"type":48,"value":1418},"3,000",{"type":42,"tag":1409,"props":1420,"children":1421},{},[1422],{"type":42,"tag":64,"props":1423,"children":1425},{"className":1424},[],[1426],{"type":48,"value":1427},"aurora dsql transaction limits",{"type":42,"tag":1382,"props":1429,"children":1430},{},[1431,1436,1441],{"type":42,"tag":1409,"props":1432,"children":1433},{},[1434],{"type":48,"value":1435},"Max data modified per write transaction",{"type":42,"tag":1409,"props":1437,"children":1438},{},[1439],{"type":48,"value":1440},"10 MiB",{"type":42,"tag":1409,"props":1442,"children":1443},{},[1444],{"type":42,"tag":64,"props":1445,"children":1447},{"className":1446},[],[1448],{"type":48,"value":1427},{"type":42,"tag":1382,"props":1450,"children":1451},{},[1452,1457,1462],{"type":42,"tag":1409,"props":1453,"children":1454},{},[1455],{"type":48,"value":1456},"Max transaction duration",{"type":42,"tag":1409,"props":1458,"children":1459},{},[1460],{"type":48,"value":1461},"5 minutes",{"type":42,"tag":1409,"props":1463,"children":1464},{},[1465],{"type":42,"tag":64,"props":1466,"children":1468},{"className":1467},[],[1469],{"type":48,"value":1427},{"type":42,"tag":1382,"props":1471,"children":1472},{},[1473,1478,1483],{"type":42,"tag":1409,"props":1474,"children":1475},{},[1476],{"type":48,"value":1477},"Max connections per cluster",{"type":42,"tag":1409,"props":1479,"children":1480},{},[1481],{"type":48,"value":1482},"10,000",{"type":42,"tag":1409,"props":1484,"children":1485},{},[1486],{"type":42,"tag":64,"props":1487,"children":1489},{"className":1488},[],[1490],{"type":48,"value":1491},"aurora dsql connection limits",{"type":42,"tag":1382,"props":1493,"children":1494},{},[1495,1500,1505],{"type":42,"tag":1409,"props":1496,"children":1497},{},[1498],{"type":48,"value":1499},"IAM auth token expiry",{"type":42,"tag":1409,"props":1501,"children":1502},{},[1503],{"type":48,"value":1504},"15 minutes",{"type":42,"tag":1409,"props":1506,"children":1507},{},[1508],{"type":42,"tag":64,"props":1509,"children":1511},{"className":1510},[],[1512],{"type":48,"value":1513},"aurora dsql authentication token",{"type":42,"tag":1382,"props":1515,"children":1516},{},[1517,1522,1527],{"type":42,"tag":1409,"props":1518,"children":1519},{},[1520],{"type":48,"value":1521},"Max connection duration",{"type":42,"tag":1409,"props":1523,"children":1524},{},[1525],{"type":48,"value":1526},"60 minutes",{"type":42,"tag":1409,"props":1528,"children":1529},{},[1530],{"type":42,"tag":64,"props":1531,"children":1533},{"className":1532},[],[1534],{"type":48,"value":1491},{"type":42,"tag":1382,"props":1536,"children":1537},{},[1538,1543,1548],{"type":42,"tag":1409,"props":1539,"children":1540},{},[1541],{"type":48,"value":1542},"Max indexes per table",{"type":42,"tag":1409,"props":1544,"children":1545},{},[1546],{"type":48,"value":1547},"24",{"type":42,"tag":1409,"props":1549,"children":1550},{},[1551],{"type":42,"tag":64,"props":1552,"children":1554},{"className":1553},[],[1555],{"type":48,"value":1556},"aurora dsql index limits",{"type":42,"tag":1382,"props":1558,"children":1559},{},[1560,1565,1570],{"type":42,"tag":1409,"props":1561,"children":1562},{},[1563],{"type":48,"value":1564},"Max columns per index",{"type":42,"tag":1409,"props":1566,"children":1567},{},[1568],{"type":48,"value":1569},"8",{"type":42,"tag":1409,"props":1571,"children":1572},{},[1573],{"type":42,"tag":64,"props":1574,"children":1576},{"className":1575},[],[1577],{"type":48,"value":1556},{"type":42,"tag":1382,"props":1579,"children":1580},{},[1581,1586,1591],{"type":42,"tag":1409,"props":1582,"children":1583},{},[1584],{"type":48,"value":1585},"IDENTITY\u002FSEQUENCE CACHE values",{"type":42,"tag":1409,"props":1587,"children":1588},{},[1589],{"type":48,"value":1590},"1 or >= 65536",{"type":42,"tag":1409,"props":1592,"children":1593},{},[1594],{"type":42,"tag":64,"props":1595,"children":1597},{"className":1596},[],[1598],{"type":48,"value":1599},"aurora dsql sequence cache",{"type":42,"tag":58,"props":1601,"children":1602},{},[1603,1608],{"type":42,"tag":76,"props":1604,"children":1605},{},[1606],{"type":48,"value":1607},"When to verify:",{"type":48,"value":1609}," Before recommending batch sizes, connection pool settings, or schema designs\nwhere hitting a limit would cause failures. No need to verify for general guidance or when\nthe exact number doesn't affect the user's decision.",{"type":42,"tag":58,"props":1611,"children":1612},{},[1613,1618,1620,1627],{"type":42,"tag":76,"props":1614,"children":1615},{},[1616],{"type":48,"value":1617},"Fallback:",{"type":48,"value":1619}," If the AWS MCP Server is unavailable, use the defaults above and note to the user\nthat limits should be verified against ",{"type":42,"tag":99,"props":1621,"children":1624},{"href":1622,"rel":1623},"https:\u002F\u002Fdocs.aws.amazon.com\u002Faurora-dsql\u002Flatest\u002Fuserguide\u002F",[167],[1625],{"type":48,"value":1626},"DSQL documentation",{"type":48,"value":509},{"type":42,"tag":51,"props":1629,"children":1631},{"id":1630},"cli-scripts-available",[1632],{"type":48,"value":1633},"CLI Scripts Available",{"type":42,"tag":58,"props":1635,"children":1636},{},[1637,1639,1644,1646,1651,1653,1658,1660,1667],{"type":48,"value":1638},"Bash scripts in ",{"type":42,"tag":99,"props":1640,"children":1642},{"href":1641},"scripts\u002F",[1643],{"type":48,"value":1641},{"type":48,"value":1645}," for cluster management (create, delete, list, cluster info) and ",{"type":42,"tag":64,"props":1647,"children":1649},{"className":1648},[],[1650],{"type":48,"value":69},{"type":48,"value":1652}," connection. See ",{"type":42,"tag":99,"props":1654,"children":1656},{"href":1655},"references\u002Fscripts-guide.md",[1657],{"type":48,"value":1655},{"type":48,"value":1659}," for usage. For bulk data loading, see ",{"type":42,"tag":99,"props":1661,"children":1664},{"href":1662,"rel":1663},"https:\u002F\u002Fdocs.aws.amazon.com\u002Faurora-dsql\u002Flatest\u002Fuserguide\u002Floading-data.html",[167],[1665],{"type":48,"value":1666},"Loading data into Aurora DSQL",{"type":48,"value":509},{"type":42,"tag":58,"props":1669,"children":1670},{},[1671,1676,1678,1684,1686,1691,1692,1698],{"type":42,"tag":76,"props":1672,"children":1673},{},[1674],{"type":48,"value":1675},"ALWAYS",{"type":48,"value":1677}," prefer ",{"type":42,"tag":64,"props":1679,"children":1681},{"className":1680},[],[1682],{"type":48,"value":1683},"scripts\u002Fcreate-cluster.sh",{"type":48,"value":1685},". The script issues a ",{"type":42,"tag":76,"props":1687,"children":1688},{},[1689],{"type":48,"value":1690},"single atomic",{"type":48,"value":224},{"type":42,"tag":64,"props":1693,"children":1695},{"className":1694},[],[1696],{"type":48,"value":1697},"CreateCluster",{"type":48,"value":1699}," call with tags embedded — matching the AWS DSQL API shape with interpretable output.",{"type":42,"tag":1374,"props":1701,"children":1702},{},[1703,1724],{"type":42,"tag":1378,"props":1704,"children":1705},{},[1706],{"type":42,"tag":1382,"props":1707,"children":1708},{},[1709,1714,1719],{"type":42,"tag":1386,"props":1710,"children":1711},{},[1712],{"type":48,"value":1713},"Task",{"type":42,"tag":1386,"props":1715,"children":1716},{},[1717],{"type":48,"value":1718},"Script",{"type":42,"tag":1386,"props":1720,"children":1721},{},[1722],{"type":48,"value":1723},"Example",{"type":42,"tag":1402,"props":1725,"children":1726},{},[1727,1755,1784,1813],{"type":42,"tag":1382,"props":1728,"children":1729},{},[1730,1735,1746],{"type":42,"tag":1409,"props":1731,"children":1732},{},[1733],{"type":48,"value":1734},"Create cluster with tags",{"type":42,"tag":1409,"props":1736,"children":1737},{},[1738],{"type":42,"tag":99,"props":1739,"children":1740},{"href":1683},[1741],{"type":42,"tag":64,"props":1742,"children":1744},{"className":1743},[],[1745],{"type":48,"value":1683},{"type":42,"tag":1409,"props":1747,"children":1748},{},[1749],{"type":42,"tag":64,"props":1750,"children":1752},{"className":1751},[],[1753],{"type":48,"value":1754},".\u002Fscripts\u002Fcreate-cluster.sh --created-by \u003Cmodel-id> --tags Environment=eval,Project=dsql-skill-eval",{"type":42,"tag":1382,"props":1756,"children":1757},{},[1758,1763,1775],{"type":42,"tag":1409,"props":1759,"children":1760},{},[1761],{"type":48,"value":1762},"List clusters",{"type":42,"tag":1409,"props":1764,"children":1765},{},[1766],{"type":42,"tag":99,"props":1767,"children":1769},{"href":1768},"scripts\u002Flist-clusters.sh",[1770],{"type":42,"tag":64,"props":1771,"children":1773},{"className":1772},[],[1774],{"type":48,"value":1768},{"type":42,"tag":1409,"props":1776,"children":1777},{},[1778],{"type":42,"tag":64,"props":1779,"children":1781},{"className":1780},[],[1782],{"type":48,"value":1783},".\u002Fscripts\u002Flist-clusters.sh --region us-east-1",{"type":42,"tag":1382,"props":1785,"children":1786},{},[1787,1792,1804],{"type":42,"tag":1409,"props":1788,"children":1789},{},[1790],{"type":48,"value":1791},"Inspect cluster",{"type":42,"tag":1409,"props":1793,"children":1794},{},[1795],{"type":42,"tag":99,"props":1796,"children":1798},{"href":1797},"scripts\u002Fcluster-info.sh",[1799],{"type":42,"tag":64,"props":1800,"children":1802},{"className":1801},[],[1803],{"type":48,"value":1797},{"type":42,"tag":1409,"props":1805,"children":1806},{},[1807],{"type":42,"tag":64,"props":1808,"children":1810},{"className":1809},[],[1811],{"type":48,"value":1812},".\u002Fscripts\u002Fcluster-info.sh \u003Ccluster-id>",{"type":42,"tag":1382,"props":1814,"children":1815},{},[1816,1821,1832],{"type":42,"tag":1409,"props":1817,"children":1818},{},[1819],{"type":48,"value":1820},"Connect via psql",{"type":42,"tag":1409,"props":1822,"children":1823},{},[1824],{"type":42,"tag":99,"props":1825,"children":1826},{"href":101},[1827],{"type":42,"tag":64,"props":1828,"children":1830},{"className":1829},[],[1831],{"type":48,"value":101},{"type":42,"tag":1409,"props":1833,"children":1834},{},[1835],{"type":42,"tag":64,"props":1836,"children":1838},{"className":1837},[],[1839],{"type":48,"value":1840},".\u002Fscripts\u002Fpsql-connect.sh --cluster \u003Cid> --command \"SELECT 1\"",{"type":42,"tag":183,"props":1842,"children":1843},{},[],{"type":42,"tag":51,"props":1845,"children":1847},{"id":1846},"quick-start",[1848],{"type":48,"value":1849},"Quick Start",{"type":42,"tag":198,"props":1851,"children":1853},{"id":1852},"_1-list-tables-and-explore-schema",[1854],{"type":48,"value":1855},"1. List tables and explore schema",{"type":42,"tag":1163,"props":1857,"children":1861},{"className":1858,"code":1860,"language":48},[1859],"language-text",".\u002Fscripts\u002Fpsql-connect.sh --cluster \u003Cid> --command \"SELECT table_name FROM information_schema.tables WHERE table_schema = 'public'\"\n.\u002Fscripts\u002Fpsql-connect.sh --cluster \u003Cid> --command \"SELECT column_name, data_type, is_nullable FROM information_schema.columns WHERE table_schema = 'public' AND table_name = '\u003Ctable>' ORDER BY ordinal_position\"\n",[1862],{"type":42,"tag":64,"props":1863,"children":1864},{"__ignoreMap":1168},[1865],{"type":48,"value":1860},{"type":42,"tag":198,"props":1867,"children":1869},{"id":1868},"_2-query-data",[1870],{"type":48,"value":1871},"2. Query data",{"type":42,"tag":1163,"props":1873,"children":1876},{"className":1874,"code":1875,"language":48},[1859],"Use psql-connect.sh (or the language connector in app code) for SELECT queries\nAlways include tenant_id in WHERE clause for multi-tenant apps\nMUST build SQL with safe_query.build() — see references\u002Finput-validation.md\n",[1877],{"type":42,"tag":64,"props":1878,"children":1879},{"__ignoreMap":1168},[1880],{"type":48,"value":1875},{"type":42,"tag":198,"props":1882,"children":1884},{"id":1883},"_3-execute-schema-changes",[1885],{"type":48,"value":1886},"3. Execute schema changes",{"type":42,"tag":1163,"props":1888,"children":1891},{"className":1889,"code":1890,"language":48},[1859],"Use .\u002Fscripts\u002Fpsql-connect.sh --admin (or the language connector with the IAM admin auth token) for DDL\nFollow one-DDL-per-transaction rule\nAlways use CREATE INDEX ASYNC in a separate statement\nALTER COLUMN TYPE, DROP COLUMN, DROP CONSTRAINT → Table Recreation Pattern (Workflow 6)\n",[1892],{"type":42,"tag":64,"props":1893,"children":1894},{"__ignoreMap":1168},[1895],{"type":48,"value":1890},{"type":42,"tag":183,"props":1897,"children":1898},{},[],{"type":42,"tag":51,"props":1900,"children":1902},{"id":1901},"common-tasks",[1903],{"type":48,"value":1904},"Common Tasks",{"type":42,"tag":198,"props":1906,"children":1908},{"id":1907},"workflow-0-verify-dependencies",[1909],{"type":48,"value":1910},"Workflow 0: Verify Dependencies",{"type":42,"tag":58,"props":1912,"children":1913},{},[1914],{"type":48,"value":1915},"Check for required tools and warn the user if any are missing.",{"type":42,"tag":58,"props":1917,"children":1918},{},[1919],{"type":42,"tag":76,"props":1920,"children":1921},{},[1922],{"type":48,"value":1923},"Constraints:",{"type":42,"tag":82,"props":1925,"children":1926},{},[1927,1954,1959,1964,1969,1974,1985],{"type":42,"tag":86,"props":1928,"children":1929},{},[1930,1932,1937,1939,1944,1946,1952],{"type":48,"value":1931},"You MUST verify the following tools are available before proceeding: ",{"type":42,"tag":64,"props":1933,"children":1935},{"className":1934},[],[1936],{"type":48,"value":69},{"type":48,"value":1938}," (>=14 for SNI support) and the AWS CLI v2 with ",{"type":42,"tag":64,"props":1940,"children":1942},{"className":1941},[],[1943],{"type":48,"value":160},{"type":48,"value":1945}," (and ",{"type":42,"tag":64,"props":1947,"children":1949},{"className":1948},[],[1950],{"type":48,"value":1951},"generate-db-connect-admin-auth-token",{"type":48,"value":1953}," for DDL\u002Frole setup)",{"type":42,"tag":86,"props":1955,"children":1956},{},[1957],{"type":48,"value":1958},"You SHOULD also confirm the AWS MCP Server is available when the user's decision depends on a precise service limit; if absent, use the defaults in the table above and note that limits should be verified against DSQL documentation",{"type":42,"tag":86,"props":1960,"children":1961},{},[1962],{"type":48,"value":1963},"You MUST inform the user about any missing tools with a clear message",{"type":42,"tag":86,"props":1965,"children":1966},{},[1967],{"type":48,"value":1968},"You MUST ask if the user wants to proceed despite missing tools",{"type":42,"tag":86,"props":1970,"children":1971},{},[1972],{"type":48,"value":1973},"You MUST use the scoped (non-admin) IAM auth token for read-only diagnostics whenever the user has a scoped role configured; reserve the IAM admin auth token for cluster setup, role grants, and DDL",{"type":42,"tag":86,"props":1975,"children":1976},{},[1977,1979],{"type":48,"value":1978},"For cluster lifecycle (create \u002F inspect \u002F delete), see ",{"type":42,"tag":99,"props":1980,"children":1982},{"href":1981},"#workflow-0a-cluster-lifecycle",[1983],{"type":48,"value":1984},"Workflow 0a",{"type":42,"tag":86,"props":1986,"children":1987},{},[1988,1990],{"type":48,"value":1989},"Before writing application code, ALSO verify the language-specific DSQL Connector per ",{"type":42,"tag":99,"props":1991,"children":1993},{"href":1992},"#workflow-0b-verify-language-connector",[1994],{"type":48,"value":1995},"Workflow 0b",{"type":42,"tag":198,"props":1997,"children":1999},{"id":1998},"workflow-0a-cluster-lifecycle",[2000],{"type":48,"value":2001},"Workflow 0a: Cluster Lifecycle",{"type":42,"tag":58,"props":2003,"children":2004},{},[2005,2010,2012,2018],{"type":42,"tag":76,"props":2006,"children":2007},{},[2008],{"type":48,"value":2009},"SHOULD",{"type":48,"value":2011}," use the bundled scripts for cluster create and delete — they issue atomic ",{"type":42,"tag":64,"props":2013,"children":2015},{"className":2014},[],[2016],{"type":48,"value":2017},"aws dsql",{"type":48,"value":2019}," CLI calls and process outputs.",{"type":42,"tag":58,"props":2021,"children":2022},{},[2023],{"type":42,"tag":76,"props":2024,"children":2025},{},[2026],{"type":48,"value":2027},"Create a cluster with tags and deletion protection:",{"type":42,"tag":1163,"props":2029,"children":2031},{"className":1165,"code":2030,"language":1167,"meta":1168,"style":1168},".\u002Fscripts\u002Fcreate-cluster.sh --created-by \u003Cmodel-id> --tags Environment=eval,Project=dsql-skill-eval\n",[2032],{"type":42,"tag":64,"props":2033,"children":2034},{"__ignoreMap":1168},[2035],{"type":42,"tag":1174,"props":2036,"children":2037},{"class":1176,"line":37},[2038,2043,2048,2052,2057,2061,2065,2070],{"type":42,"tag":1174,"props":2039,"children":2040},{"style":1180},[2041],{"type":48,"value":2042},".\u002Fscripts\u002Fcreate-cluster.sh",{"type":42,"tag":1174,"props":2044,"children":2045},{"style":1186},[2046],{"type":48,"value":2047}," --created-by",{"type":42,"tag":1174,"props":2049,"children":2050},{"style":1192},[2051],{"type":48,"value":1195},{"type":42,"tag":1174,"props":2053,"children":2054},{"style":1186},[2055],{"type":48,"value":2056},"model-i",{"type":42,"tag":1174,"props":2058,"children":2059},{"style":1203},[2060],{"type":48,"value":1206},{"type":42,"tag":1174,"props":2062,"children":2063},{"style":1192},[2064],{"type":48,"value":1211},{"type":42,"tag":1174,"props":2066,"children":2067},{"style":1186},[2068],{"type":48,"value":2069}," --tags",{"type":42,"tag":1174,"props":2071,"children":2072},{"style":1186},[2073],{"type":48,"value":2074}," Environment=eval,Project=dsql-skill-eval\n",{"type":42,"tag":58,"props":2076,"children":2077},{},[2078],{"type":42,"tag":76,"props":2079,"children":2080},{},[2081],{"type":48,"value":2082},"Inspect a cluster (status, tags, endpoint, deletion protection):",{"type":42,"tag":1163,"props":2084,"children":2086},{"className":1165,"code":2085,"language":1167,"meta":1168,"style":1168},".\u002Fscripts\u002Fcluster-info.sh \u003Ccluster-id>\n",[2087],{"type":42,"tag":64,"props":2088,"children":2089},{"__ignoreMap":1168},[2090],{"type":42,"tag":1174,"props":2091,"children":2092},{"class":1176,"line":37},[2093,2098,2102,2106,2110],{"type":42,"tag":1174,"props":2094,"children":2095},{"style":1180},[2096],{"type":48,"value":2097},".\u002Fscripts\u002Fcluster-info.sh",{"type":42,"tag":1174,"props":2099,"children":2100},{"style":1192},[2101],{"type":48,"value":1195},{"type":42,"tag":1174,"props":2103,"children":2104},{"style":1186},[2105],{"type":48,"value":1200},{"type":42,"tag":1174,"props":2107,"children":2108},{"style":1203},[2109],{"type":48,"value":1206},{"type":42,"tag":1174,"props":2111,"children":2112},{"style":1192},[2113],{"type":48,"value":2114},">\n",{"type":42,"tag":58,"props":2116,"children":2117},{},[2118],{"type":42,"tag":76,"props":2119,"children":2120},{},[2121],{"type":48,"value":2122},"Delete a cluster:",{"type":42,"tag":1163,"props":2124,"children":2126},{"className":1165,"code":2125,"language":1167,"meta":1168,"style":1168},".\u002Fscripts\u002Fdelete-cluster.sh \u003Ccluster-id> [--force]   # --force skips the confirmation prompt in non-TTY\n",[2127],{"type":42,"tag":64,"props":2128,"children":2129},{"__ignoreMap":1168},[2130],{"type":42,"tag":1174,"props":2131,"children":2132},{"class":1176,"line":37},[2133,2138,2142,2146,2150,2154,2159],{"type":42,"tag":1174,"props":2134,"children":2135},{"style":1180},[2136],{"type":48,"value":2137},".\u002Fscripts\u002Fdelete-cluster.sh",{"type":42,"tag":1174,"props":2139,"children":2140},{"style":1192},[2141],{"type":48,"value":1195},{"type":42,"tag":1174,"props":2143,"children":2144},{"style":1186},[2145],{"type":48,"value":1200},{"type":42,"tag":1174,"props":2147,"children":2148},{"style":1203},[2149],{"type":48,"value":1206},{"type":42,"tag":1174,"props":2151,"children":2152},{"style":1192},[2153],{"type":48,"value":1211},{"type":42,"tag":1174,"props":2155,"children":2156},{"style":1203},[2157],{"type":48,"value":2158}," [--force]   ",{"type":42,"tag":1174,"props":2160,"children":2162},{"style":2161},"--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic",[2163],{"type":48,"value":2164},"# --force skips the confirmation prompt in non-TTY\n",{"type":42,"tag":58,"props":2166,"children":2167},{},[2168,2170,2175],{"type":48,"value":2169},"In MCP-only environments (no shell access), the equivalent calls go through the AWS MCP Server's ",{"type":42,"tag":64,"props":2171,"children":2173},{"className":2172},[],[2174],{"type":48,"value":405},{"type":48,"value":2176}," tool. The tool takes a JSON payload — invoke it with arguments matching the AWS API operation:",{"type":42,"tag":1163,"props":2178,"children":2182},{"className":2179,"code":2180,"language":2181,"meta":1168,"style":1168},"language-json shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","{\"service\": \"dsql\", \"operation\": \"CreateCluster\",\n \"parameters\": {\"tags\": {\"created_by\": \"\u003Cmodel-id>\", \"Environment\": \"eval\", \"Project\": \"dsql-skill-eval\"}, \"deletionProtectionEnabled\": true}}\n","json",[2183],{"type":42,"tag":64,"props":2184,"children":2185},{"__ignoreMap":1168},[2186,2266],{"type":42,"tag":1174,"props":2187,"children":2188},{"class":1176,"line":37},[2189,2194,2199,2205,2209,2214,2218,2223,2227,2232,2236,2241,2245,2249,2253,2257,2261],{"type":42,"tag":1174,"props":2190,"children":2191},{"style":1192},[2192],{"type":48,"value":2193},"{",{"type":42,"tag":1174,"props":2195,"children":2196},{"style":1192},[2197],{"type":48,"value":2198},"\"",{"type":42,"tag":1174,"props":2200,"children":2202},{"style":2201},"--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA",[2203],{"type":48,"value":2204},"service",{"type":42,"tag":1174,"props":2206,"children":2207},{"style":1192},[2208],{"type":48,"value":2198},{"type":42,"tag":1174,"props":2210,"children":2211},{"style":1192},[2212],{"type":48,"value":2213},":",{"type":42,"tag":1174,"props":2215,"children":2216},{"style":1192},[2217],{"type":48,"value":1221},{"type":42,"tag":1174,"props":2219,"children":2220},{"style":1186},[2221],{"type":48,"value":2222},"dsql",{"type":42,"tag":1174,"props":2224,"children":2225},{"style":1192},[2226],{"type":48,"value":2198},{"type":42,"tag":1174,"props":2228,"children":2229},{"style":1192},[2230],{"type":48,"value":2231},",",{"type":42,"tag":1174,"props":2233,"children":2234},{"style":1192},[2235],{"type":48,"value":1221},{"type":42,"tag":1174,"props":2237,"children":2238},{"style":2201},[2239],{"type":48,"value":2240},"operation",{"type":42,"tag":1174,"props":2242,"children":2243},{"style":1192},[2244],{"type":48,"value":2198},{"type":42,"tag":1174,"props":2246,"children":2247},{"style":1192},[2248],{"type":48,"value":2213},{"type":42,"tag":1174,"props":2250,"children":2251},{"style":1192},[2252],{"type":48,"value":1221},{"type":42,"tag":1174,"props":2254,"children":2255},{"style":1186},[2256],{"type":48,"value":1697},{"type":42,"tag":1174,"props":2258,"children":2259},{"style":1192},[2260],{"type":48,"value":2198},{"type":42,"tag":1174,"props":2262,"children":2263},{"style":1192},[2264],{"type":48,"value":2265},",\n",{"type":42,"tag":1174,"props":2267,"children":2269},{"class":1176,"line":2268},2,[2270,2274,2279,2283,2287,2292,2296,2301,2305,2309,2313,2317,2323,2327,2331,2335,2340,2344,2348,2352,2357,2361,2365,2369,2374,2378,2382,2386,2391,2395,2399,2403,2408,2412,2417,2421,2426,2430,2434],{"type":42,"tag":1174,"props":2271,"children":2272},{"style":1192},[2273],{"type":48,"value":1221},{"type":42,"tag":1174,"props":2275,"children":2276},{"style":2201},[2277],{"type":48,"value":2278},"parameters",{"type":42,"tag":1174,"props":2280,"children":2281},{"style":1192},[2282],{"type":48,"value":2198},{"type":42,"tag":1174,"props":2284,"children":2285},{"style":1192},[2286],{"type":48,"value":2213},{"type":42,"tag":1174,"props":2288,"children":2289},{"style":1192},[2290],{"type":48,"value":2291}," {",{"type":42,"tag":1174,"props":2293,"children":2294},{"style":1192},[2295],{"type":48,"value":2198},{"type":42,"tag":1174,"props":2297,"children":2298},{"style":1180},[2299],{"type":48,"value":2300},"tags",{"type":42,"tag":1174,"props":2302,"children":2303},{"style":1192},[2304],{"type":48,"value":2198},{"type":42,"tag":1174,"props":2306,"children":2307},{"style":1192},[2308],{"type":48,"value":2213},{"type":42,"tag":1174,"props":2310,"children":2311},{"style":1192},[2312],{"type":48,"value":2291},{"type":42,"tag":1174,"props":2314,"children":2315},{"style":1192},[2316],{"type":48,"value":2198},{"type":42,"tag":1174,"props":2318,"children":2320},{"style":2319},"--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C",[2321],{"type":48,"value":2322},"created_by",{"type":42,"tag":1174,"props":2324,"children":2325},{"style":1192},[2326],{"type":48,"value":2198},{"type":42,"tag":1174,"props":2328,"children":2329},{"style":1192},[2330],{"type":48,"value":2213},{"type":42,"tag":1174,"props":2332,"children":2333},{"style":1192},[2334],{"type":48,"value":1221},{"type":42,"tag":1174,"props":2336,"children":2337},{"style":1186},[2338],{"type":48,"value":2339},"\u003Cmodel-id>",{"type":42,"tag":1174,"props":2341,"children":2342},{"style":1192},[2343],{"type":48,"value":2198},{"type":42,"tag":1174,"props":2345,"children":2346},{"style":1192},[2347],{"type":48,"value":2231},{"type":42,"tag":1174,"props":2349,"children":2350},{"style":1192},[2351],{"type":48,"value":1221},{"type":42,"tag":1174,"props":2353,"children":2354},{"style":2319},[2355],{"type":48,"value":2356},"Environment",{"type":42,"tag":1174,"props":2358,"children":2359},{"style":1192},[2360],{"type":48,"value":2198},{"type":42,"tag":1174,"props":2362,"children":2363},{"style":1192},[2364],{"type":48,"value":2213},{"type":42,"tag":1174,"props":2366,"children":2367},{"style":1192},[2368],{"type":48,"value":1221},{"type":42,"tag":1174,"props":2370,"children":2371},{"style":1186},[2372],{"type":48,"value":2373},"eval",{"type":42,"tag":1174,"props":2375,"children":2376},{"style":1192},[2377],{"type":48,"value":2198},{"type":42,"tag":1174,"props":2379,"children":2380},{"style":1192},[2381],{"type":48,"value":2231},{"type":42,"tag":1174,"props":2383,"children":2384},{"style":1192},[2385],{"type":48,"value":1221},{"type":42,"tag":1174,"props":2387,"children":2388},{"style":2319},[2389],{"type":48,"value":2390},"Project",{"type":42,"tag":1174,"props":2392,"children":2393},{"style":1192},[2394],{"type":48,"value":2198},{"type":42,"tag":1174,"props":2396,"children":2397},{"style":1192},[2398],{"type":48,"value":2213},{"type":42,"tag":1174,"props":2400,"children":2401},{"style":1192},[2402],{"type":48,"value":1221},{"type":42,"tag":1174,"props":2404,"children":2405},{"style":1186},[2406],{"type":48,"value":2407},"dsql-skill-eval",{"type":42,"tag":1174,"props":2409,"children":2410},{"style":1192},[2411],{"type":48,"value":2198},{"type":42,"tag":1174,"props":2413,"children":2414},{"style":1192},[2415],{"type":48,"value":2416},"},",{"type":42,"tag":1174,"props":2418,"children":2419},{"style":1192},[2420],{"type":48,"value":1221},{"type":42,"tag":1174,"props":2422,"children":2423},{"style":1180},[2424],{"type":48,"value":2425},"deletionProtectionEnabled",{"type":42,"tag":1174,"props":2427,"children":2428},{"style":1192},[2429],{"type":48,"value":2198},{"type":42,"tag":1174,"props":2431,"children":2432},{"style":1192},[2433],{"type":48,"value":2213},{"type":42,"tag":1174,"props":2435,"children":2436},{"style":1192},[2437],{"type":48,"value":2438}," true}}\n",{"type":42,"tag":1163,"props":2440,"children":2442},{"className":2179,"code":2441,"language":2181,"meta":1168,"style":1168},"{\"service\": \"dsql\", \"operation\": \"GetCluster\", \"parameters\": {\"identifier\": \"\u003Ccluster-id>\"}}\n",[2443],{"type":42,"tag":64,"props":2444,"children":2445},{"__ignoreMap":1168},[2446],{"type":42,"tag":1174,"props":2447,"children":2448},{"class":1176,"line":37},[2449,2453,2457,2461,2465,2469,2473,2477,2481,2485,2489,2493,2497,2501,2505,2510,2514,2518,2522,2526,2530,2534,2538,2542,2547,2551,2555,2559,2564,2568],{"type":42,"tag":1174,"props":2450,"children":2451},{"style":1192},[2452],{"type":48,"value":2193},{"type":42,"tag":1174,"props":2454,"children":2455},{"style":1192},[2456],{"type":48,"value":2198},{"type":42,"tag":1174,"props":2458,"children":2459},{"style":2201},[2460],{"type":48,"value":2204},{"type":42,"tag":1174,"props":2462,"children":2463},{"style":1192},[2464],{"type":48,"value":2198},{"type":42,"tag":1174,"props":2466,"children":2467},{"style":1192},[2468],{"type":48,"value":2213},{"type":42,"tag":1174,"props":2470,"children":2471},{"style":1192},[2472],{"type":48,"value":1221},{"type":42,"tag":1174,"props":2474,"children":2475},{"style":1186},[2476],{"type":48,"value":2222},{"type":42,"tag":1174,"props":2478,"children":2479},{"style":1192},[2480],{"type":48,"value":2198},{"type":42,"tag":1174,"props":2482,"children":2483},{"style":1192},[2484],{"type":48,"value":2231},{"type":42,"tag":1174,"props":2486,"children":2487},{"style":1192},[2488],{"type":48,"value":1221},{"type":42,"tag":1174,"props":2490,"children":2491},{"style":2201},[2492],{"type":48,"value":2240},{"type":42,"tag":1174,"props":2494,"children":2495},{"style":1192},[2496],{"type":48,"value":2198},{"type":42,"tag":1174,"props":2498,"children":2499},{"style":1192},[2500],{"type":48,"value":2213},{"type":42,"tag":1174,"props":2502,"children":2503},{"style":1192},[2504],{"type":48,"value":1221},{"type":42,"tag":1174,"props":2506,"children":2507},{"style":1186},[2508],{"type":48,"value":2509},"GetCluster",{"type":42,"tag":1174,"props":2511,"children":2512},{"style":1192},[2513],{"type":48,"value":2198},{"type":42,"tag":1174,"props":2515,"children":2516},{"style":1192},[2517],{"type":48,"value":2231},{"type":42,"tag":1174,"props":2519,"children":2520},{"style":1192},[2521],{"type":48,"value":1221},{"type":42,"tag":1174,"props":2523,"children":2524},{"style":2201},[2525],{"type":48,"value":2278},{"type":42,"tag":1174,"props":2527,"children":2528},{"style":1192},[2529],{"type":48,"value":2198},{"type":42,"tag":1174,"props":2531,"children":2532},{"style":1192},[2533],{"type":48,"value":2213},{"type":42,"tag":1174,"props":2535,"children":2536},{"style":1192},[2537],{"type":48,"value":2291},{"type":42,"tag":1174,"props":2539,"children":2540},{"style":1192},[2541],{"type":48,"value":2198},{"type":42,"tag":1174,"props":2543,"children":2544},{"style":1180},[2545],{"type":48,"value":2546},"identifier",{"type":42,"tag":1174,"props":2548,"children":2549},{"style":1192},[2550],{"type":48,"value":2198},{"type":42,"tag":1174,"props":2552,"children":2553},{"style":1192},[2554],{"type":48,"value":2213},{"type":42,"tag":1174,"props":2556,"children":2557},{"style":1192},[2558],{"type":48,"value":1221},{"type":42,"tag":1174,"props":2560,"children":2561},{"style":1186},[2562],{"type":48,"value":2563},"\u003Ccluster-id>",{"type":42,"tag":1174,"props":2565,"children":2566},{"style":1192},[2567],{"type":48,"value":2198},{"type":42,"tag":1174,"props":2569,"children":2570},{"style":1192},[2571],{"type":48,"value":2572},"}}\n",{"type":42,"tag":1163,"props":2574,"children":2576},{"className":2179,"code":2575,"language":2181,"meta":1168,"style":1168},"{\"service\": \"dsql\", \"operation\": \"DeleteCluster\", \"parameters\": {\"identifier\": \"\u003Ccluster-id>\"}}\n",[2577],{"type":42,"tag":64,"props":2578,"children":2579},{"__ignoreMap":1168},[2580],{"type":42,"tag":1174,"props":2581,"children":2582},{"class":1176,"line":37},[2583,2587,2591,2595,2599,2603,2607,2611,2615,2619,2623,2627,2631,2635,2639,2644,2648,2652,2656,2660,2664,2668,2672,2676,2680,2684,2688,2692,2696,2700],{"type":42,"tag":1174,"props":2584,"children":2585},{"style":1192},[2586],{"type":48,"value":2193},{"type":42,"tag":1174,"props":2588,"children":2589},{"style":1192},[2590],{"type":48,"value":2198},{"type":42,"tag":1174,"props":2592,"children":2593},{"style":2201},[2594],{"type":48,"value":2204},{"type":42,"tag":1174,"props":2596,"children":2597},{"style":1192},[2598],{"type":48,"value":2198},{"type":42,"tag":1174,"props":2600,"children":2601},{"style":1192},[2602],{"type":48,"value":2213},{"type":42,"tag":1174,"props":2604,"children":2605},{"style":1192},[2606],{"type":48,"value":1221},{"type":42,"tag":1174,"props":2608,"children":2609},{"style":1186},[2610],{"type":48,"value":2222},{"type":42,"tag":1174,"props":2612,"children":2613},{"style":1192},[2614],{"type":48,"value":2198},{"type":42,"tag":1174,"props":2616,"children":2617},{"style":1192},[2618],{"type":48,"value":2231},{"type":42,"tag":1174,"props":2620,"children":2621},{"style":1192},[2622],{"type":48,"value":1221},{"type":42,"tag":1174,"props":2624,"children":2625},{"style":2201},[2626],{"type":48,"value":2240},{"type":42,"tag":1174,"props":2628,"children":2629},{"style":1192},[2630],{"type":48,"value":2198},{"type":42,"tag":1174,"props":2632,"children":2633},{"style":1192},[2634],{"type":48,"value":2213},{"type":42,"tag":1174,"props":2636,"children":2637},{"style":1192},[2638],{"type":48,"value":1221},{"type":42,"tag":1174,"props":2640,"children":2641},{"style":1186},[2642],{"type":48,"value":2643},"DeleteCluster",{"type":42,"tag":1174,"props":2645,"children":2646},{"style":1192},[2647],{"type":48,"value":2198},{"type":42,"tag":1174,"props":2649,"children":2650},{"style":1192},[2651],{"type":48,"value":2231},{"type":42,"tag":1174,"props":2653,"children":2654},{"style":1192},[2655],{"type":48,"value":1221},{"type":42,"tag":1174,"props":2657,"children":2658},{"style":2201},[2659],{"type":48,"value":2278},{"type":42,"tag":1174,"props":2661,"children":2662},{"style":1192},[2663],{"type":48,"value":2198},{"type":42,"tag":1174,"props":2665,"children":2666},{"style":1192},[2667],{"type":48,"value":2213},{"type":42,"tag":1174,"props":2669,"children":2670},{"style":1192},[2671],{"type":48,"value":2291},{"type":42,"tag":1174,"props":2673,"children":2674},{"style":1192},[2675],{"type":48,"value":2198},{"type":42,"tag":1174,"props":2677,"children":2678},{"style":1180},[2679],{"type":48,"value":2546},{"type":42,"tag":1174,"props":2681,"children":2682},{"style":1192},[2683],{"type":48,"value":2198},{"type":42,"tag":1174,"props":2685,"children":2686},{"style":1192},[2687],{"type":48,"value":2213},{"type":42,"tag":1174,"props":2689,"children":2690},{"style":1192},[2691],{"type":48,"value":1221},{"type":42,"tag":1174,"props":2693,"children":2694},{"style":1186},[2695],{"type":48,"value":2563},{"type":42,"tag":1174,"props":2697,"children":2698},{"style":1192},[2699],{"type":48,"value":2198},{"type":42,"tag":1174,"props":2701,"children":2702},{"style":1192},[2703],{"type":48,"value":2572},{"type":42,"tag":58,"props":2705,"children":2706},{},[2707,2712,2713,2718,2720,2726,2728,2734,2736,2742,2744,2749,2750,2756,2758,2764,2766,2771],{"type":42,"tag":64,"props":2708,"children":2710},{"className":2709},[],[2711],{"type":48,"value":1697},{"type":48,"value":1365},{"type":42,"tag":64,"props":2714,"children":2716},{"className":2715},[],[2717],{"type":48,"value":2643},{"type":48,"value":2719}," are asynchronous on the DSQL side — the API returns immediately with the cluster's current ",{"type":42,"tag":64,"props":2721,"children":2723},{"className":2722},[],[2724],{"type":48,"value":2725},"status",{"type":48,"value":2727}," (",{"type":42,"tag":64,"props":2729,"children":2731},{"className":2730},[],[2732],{"type":48,"value":2733},"CREATING",{"type":48,"value":2735}," \u002F ",{"type":42,"tag":64,"props":2737,"children":2739},{"className":2738},[],[2740],{"type":48,"value":2741},"DELETING",{"type":48,"value":2743},"). Poll readiness by re-invoking ",{"type":42,"tag":64,"props":2745,"children":2747},{"className":2746},[],[2748],{"type":48,"value":405},{"type":48,"value":154},{"type":42,"tag":64,"props":2751,"children":2753},{"className":2752},[],[2754],{"type":48,"value":2755},"dsql:GetCluster",{"type":48,"value":2757}," until ",{"type":42,"tag":64,"props":2759,"children":2761},{"className":2760},[],[2762],{"type":48,"value":2763},".status == \"ACTIVE\"",{"type":48,"value":2765}," (create) or the call returns a 404 (delete). ",{"type":42,"tag":64,"props":2767,"children":2769},{"className":2768},[],[2770],{"type":48,"value":419},{"type":48,"value":2772}," is for polling MCP-side long-running tool invocations — not the DSQL API.",{"type":42,"tag":58,"props":2774,"children":2775},{},[2776,2777,2791],{"type":48,"value":1334},{"type":42,"tag":99,"props":2778,"children":2781},{"href":2779,"rel":2780},"https:\u002F\u002Fdocs.aws.amazon.com\u002Fcli\u002Flatest\u002Freference\u002Fdsql\u002F",[167],[2782,2784,2789],{"type":48,"value":2783},"AWS CLI ",{"type":42,"tag":64,"props":2785,"children":2787},{"className":2786},[],[2788],{"type":48,"value":2017},{"type":48,"value":2790}," reference",{"type":48,"value":2792}," for full parameter details and call context.",{"type":42,"tag":198,"props":2794,"children":2796},{"id":2795},"workflow-0b-verify-language-connector",[2797],{"type":48,"value":2798},"Workflow 0b: Verify Language Connector",{"type":42,"tag":58,"props":2800,"children":2801},{},[2802,2804,2808,2810,2814,2816,2822,2823,2829,2830,2836,2837,2843,2845,2849],{"type":48,"value":2803},"Before writing application code, ",{"type":42,"tag":76,"props":2805,"children":2806},{},[2807],{"type":48,"value":532},{"type":48,"value":2809}," verify the language-specific DSQL Connector is installed per ",{"type":42,"tag":99,"props":2811,"children":2812},{"href":516},[2813],{"type":48,"value":519},{"type":48,"value":2815},". The Connectors are the canonical IAM-token-refresh path; bare drivers (",{"type":42,"tag":64,"props":2817,"children":2819},{"className":2818},[],[2820],{"type":48,"value":2821},"pg",{"type":48,"value":363},{"type":42,"tag":64,"props":2824,"children":2826},{"className":2825},[],[2827],{"type":48,"value":2828},"psycopg",{"type":48,"value":363},{"type":42,"tag":64,"props":2831,"children":2833},{"className":2832},[],[2834],{"type":48,"value":2835},"pgx",{"type":48,"value":363},{"type":42,"tag":64,"props":2838,"children":2840},{"className":2839},[],[2841],{"type":48,"value":2842},"tokio-postgres",{"type":48,"value":2844},") work until the first 15-minute token expiry and then start returning auth errors on every new connection — DSQL users who try the bare form report this as a DSQL bug. ",{"type":42,"tag":76,"props":2846,"children":2847},{},[2848],{"type":48,"value":532},{"type":48,"value":2850}," install:",{"type":42,"tag":82,"props":2852,"children":2853},{},[2854,2866,2885,2896,2907],{"type":42,"tag":86,"props":2855,"children":2856},{},[2857,2858,2864],{"type":48,"value":557},{"type":42,"tag":64,"props":2859,"children":2861},{"className":2860},[],[2862],{"type":48,"value":2863},"aurora-dsql-python-connector",{"type":48,"value":2865}," + the chosen driver wheel",{"type":42,"tag":86,"props":2867,"children":2868},{},[2869,2871,2877,2879],{"type":48,"value":2870},"Node.js: ",{"type":42,"tag":64,"props":2872,"children":2874},{"className":2873},[],[2875],{"type":48,"value":2876},"@aws\u002Faurora-dsql-node-postgres-connector",{"type":48,"value":2878}," or ",{"type":42,"tag":64,"props":2880,"children":2882},{"className":2881},[],[2883],{"type":48,"value":2884},"@aws\u002Faurora-dsql-postgresjs-connector",{"type":42,"tag":86,"props":2886,"children":2887},{},[2888,2890],{"type":48,"value":2889},"Go: ",{"type":42,"tag":64,"props":2891,"children":2893},{"className":2892},[],[2894],{"type":48,"value":2895},"github.com\u002Fawslabs\u002Faurora-dsql-connectors\u002Fgo\u002Fpgx",{"type":42,"tag":86,"props":2897,"children":2898},{},[2899,2901],{"type":48,"value":2900},"Java: ",{"type":42,"tag":64,"props":2902,"children":2904},{"className":2903},[],[2905],{"type":48,"value":2906},"software.amazon.dsql:aurora-dsql-jdbc-connector",{"type":42,"tag":86,"props":2908,"children":2909},{},[2910,2912],{"type":48,"value":2911},"Rust: ",{"type":42,"tag":64,"props":2913,"children":2915},{"className":2914},[],[2916],{"type":48,"value":2917},"aurora-dsql-sqlx-connector",{"type":42,"tag":58,"props":2919,"children":2920},{},[2921],{"type":48,"value":2922},"If a Connector is unavailable for the chosen runtime, document the manual token-refresh strategy and schedule with the user before writing code.",{"type":42,"tag":183,"props":2924,"children":2925},{},[],{"type":42,"tag":198,"props":2927,"children":2929},{"id":2928},"workflow-1-create-multi-tenant-schema",[2930],{"type":48,"value":2931},"Workflow 1: Create Multi-Tenant Schema",{"type":42,"tag":58,"props":2933,"children":2934},{},[2935,2937,2941,2943,2948,2950,2956],{"type":48,"value":2936},"MUST load ",{"type":42,"tag":99,"props":2938,"children":2939},{"href":822},[2940],{"type":48,"value":825},{"type":48,"value":2942}," (Pattern 2: Create Table with Index) for step-by-step DDL sequencing, async index creation, and schema verification examples. Key rules: ",{"type":42,"tag":64,"props":2944,"children":2946},{"className":2945},[],[2947],{"type":48,"value":130},{"type":48,"value":2949}," in all tables, ",{"type":42,"tag":64,"props":2951,"children":2953},{"className":2952},[],[2954],{"type":48,"value":2955},"CREATE INDEX ASYNC",{"type":48,"value":2957}," only, one DDL per transaction, arrays\u002FJSON stored as TEXT.",{"type":42,"tag":198,"props":2959,"children":2961},{"id":2960},"workflow-2-safe-data-migration",[2962],{"type":48,"value":2963},"Workflow 2: Safe Data Migration",{"type":42,"tag":58,"props":2965,"children":2966},{},[2967,2968,2972,2974,2978],{"type":48,"value":2936},{"type":42,"tag":99,"props":2969,"children":2970},{"href":822},[2971],{"type":48,"value":825},{"type":48,"value":2973}," (Pattern 3: Safe Data Migration) for the add-column → batch-populate → verify → index sequence. For tables exceeding 3,000 rows, also load ",{"type":42,"tag":99,"props":2975,"children":2976},{"href":968},[2977],{"type":48,"value":971},{"type":48,"value":2979},". Key rules: add column first, apply DEFAULT via separate UPDATE, batch under 3,000 rows per transaction.",{"type":42,"tag":198,"props":2981,"children":2983},{"id":2982},"workflow-3-application-layer-referential-integrity",[2984],{"type":48,"value":2985},"Workflow 3: Application-Layer Referential Integrity",{"type":42,"tag":58,"props":2987,"children":2988},{},[2989,2990,2994,2996,3002],{"type":48,"value":2936},{"type":42,"tag":99,"props":2991,"children":2992},{"href":822},[2993],{"type":48,"value":825},{"type":48,"value":2995}," (Pattern 5: Application-Layer Foreign Key Check) for the parent-existence SELECT → INSERT and dependent-count SELECT → DELETE patterns. Build all SQL with ",{"type":42,"tag":64,"props":2997,"children":2999},{"className":2998},[],[3000],{"type":48,"value":3001},"safe_query.build()",{"type":48,"value":3003}," — see Workflow 4a.",{"type":42,"tag":198,"props":3005,"children":3007},{"id":3006},"workflow-4-query-with-tenant-isolation",[3008],{"type":48,"value":3009},"Workflow 4: Query with Tenant Isolation",{"type":42,"tag":3011,"props":3012,"children":3013},"ol",{},[3014,3023,3088],{"type":42,"tag":86,"props":3015,"children":3016},{},[3017,3021],{"type":42,"tag":76,"props":3018,"children":3019},{},[3020],{"type":48,"value":532},{"type":48,"value":3022}," authorize the caller against the tenant — format validation does not establish authorization",{"type":42,"tag":86,"props":3024,"children":3025},{},[3026,3030,3032,3041,3043,3049,3051,3057,3059,3065,3067,3073,3075,3081,3083],{"type":42,"tag":76,"props":3027,"children":3028},{},[3029],{"type":48,"value":532},{"type":48,"value":3031}," build SQL with ",{"type":42,"tag":99,"props":3033,"children":3035},{"href":3034},"scripts\u002Fsafe_query.py",[3036],{"type":42,"tag":64,"props":3037,"children":3039},{"className":3038},[],[3040],{"type":48,"value":3001},{"type":48,"value":3042}," — use ",{"type":42,"tag":64,"props":3044,"children":3046},{"className":3045},[],[3047],{"type":48,"value":3048},"allow()",{"type":48,"value":3050},"\u002F",{"type":42,"tag":64,"props":3052,"children":3054},{"className":3053},[],[3055],{"type":48,"value":3056},"regex()",{"type":48,"value":3058}," for\nvalues (emits ",{"type":42,"tag":64,"props":3060,"children":3062},{"className":3061},[],[3063],{"type":48,"value":3064},"'v'",{"type":48,"value":3066},"), ",{"type":42,"tag":64,"props":3068,"children":3070},{"className":3069},[],[3071],{"type":48,"value":3072},"ident()",{"type":48,"value":3074}," for table\u002Fcolumn names (emits ",{"type":42,"tag":64,"props":3076,"children":3078},{"className":3077},[],[3079],{"type":48,"value":3080},"\"v\"",{"type":48,"value":3082},").\nSee ",{"type":42,"tag":99,"props":3084,"children":3085},{"href":289},[3086],{"type":48,"value":3087},"input-validation.md",{"type":42,"tag":86,"props":3089,"children":3090},{},[3091,3095,3097,3102],{"type":42,"tag":76,"props":3092,"children":3093},{},[3094],{"type":48,"value":532},{"type":48,"value":3096}," include ",{"type":42,"tag":64,"props":3098,"children":3100},{"className":3099},[],[3101],{"type":48,"value":130},{"type":48,"value":3103}," in the WHERE clause; reject cross-tenant access at the application layer",{"type":42,"tag":198,"props":3105,"children":3107},{"id":3106},"workflow-4a-rubric-critical-building-sql-with-user-input",[3108],{"type":48,"value":3109},"Workflow 4a: Rubric-Critical — Building SQL with User Input",{"type":42,"tag":58,"props":3111,"children":3112},{},[3113,3115,3121,3123,3131,3133,3139,3141,3147,3149,3154],{"type":48,"value":3114},"Whenever constructing SQL for ",{"type":42,"tag":64,"props":3116,"children":3118},{"className":3117},[],[3119],{"type":48,"value":3120},"psql -c \"...\"",{"type":48,"value":3122}," (or any equivalent ad-hoc query path) with any value that is not a developer-controlled literal (tenant IDs, entity IDs, sort columns, directions, status enums, free-text descriptions, request params — anything from untrusted sources), you MUST use ",{"type":42,"tag":99,"props":3124,"children":3125},{"href":3034},[3126],{"type":42,"tag":64,"props":3127,"children":3129},{"className":3128},[],[3130],{"type":48,"value":3001},{"type":48,"value":3132},". The ",{"type":42,"tag":64,"props":3134,"children":3136},{"className":3135},[],[3137],{"type":48,"value":3138},"psql -c",{"type":48,"value":3140}," flag takes raw SQL strings; it does NOT accept bound parameters. When using a Postgres driver (psycopg, pgx, etc.) in application code, prefer the driver's native parameter binding; ",{"type":42,"tag":64,"props":3142,"children":3144},{"className":3143},[],[3145],{"type":48,"value":3146},"safe_query",{"type":48,"value":3148}," is the canonical fallback whenever you must build a raw SQL string. Validation via ",{"type":42,"tag":64,"props":3150,"children":3152},{"className":3151},[],[3153],{"type":48,"value":3146},{"type":48,"value":3155}," is the primary defense for raw-SQL paths.",{"type":42,"tag":58,"props":3157,"children":3158},{},[3159,3164,3166,3170],{"type":42,"tag":76,"props":3160,"children":3161},{},[3162],{"type":48,"value":3163},"Validator selection table",{"type":48,"value":3165}," (canonical — mirrors ",{"type":42,"tag":99,"props":3167,"children":3168},{"href":289},[3169],{"type":48,"value":3087},{"type":48,"value":3171},"):",{"type":42,"tag":1374,"props":3173,"children":3174},{},[3175,3196],{"type":42,"tag":1378,"props":3176,"children":3177},{},[3178],{"type":42,"tag":1382,"props":3179,"children":3180},{},[3181,3186,3191],{"type":42,"tag":1386,"props":3182,"children":3183},{},[3184],{"type":48,"value":3185},"Value kind",{"type":42,"tag":1386,"props":3187,"children":3188},{},[3189],{"type":48,"value":3190},"Validator",{"type":42,"tag":1386,"props":3192,"children":3193},{},[3194],{"type":48,"value":3195},"Emits",{"type":42,"tag":1402,"props":3197,"children":3198},{},[3199,3225,3253,3278,3304,3329],{"type":42,"tag":1382,"props":3200,"children":3201},{},[3202,3207,3216],{"type":42,"tag":1409,"props":3203,"children":3204},{},[3205],{"type":48,"value":3206},"Known set (tenant ID, status enum)",{"type":42,"tag":1409,"props":3208,"children":3209},{},[3210],{"type":42,"tag":64,"props":3211,"children":3213},{"className":3212},[],[3214],{"type":48,"value":3215},"allow(v, SET)",{"type":42,"tag":1409,"props":3217,"children":3218},{},[3219],{"type":42,"tag":64,"props":3220,"children":3222},{"className":3221},[],[3223],{"type":48,"value":3224},"'value'",{"type":42,"tag":1382,"props":3226,"children":3227},{},[3228,3233,3242],{"type":42,"tag":1409,"props":3229,"children":3230},{},[3231],{"type":48,"value":3232},"Known set used as SQL keyword (ASC\u002FDESC)",{"type":42,"tag":1409,"props":3234,"children":3235},{},[3236],{"type":42,"tag":64,"props":3237,"children":3239},{"className":3238},[],[3240],{"type":48,"value":3241},"keyword(v, SET)",{"type":42,"tag":1409,"props":3243,"children":3244},{},[3245,3251],{"type":42,"tag":64,"props":3246,"children":3248},{"className":3247},[],[3249],{"type":48,"value":3250},"value",{"type":48,"value":3252}," (unquoted)",{"type":42,"tag":1382,"props":3254,"children":3255},{},[3256,3261,3270],{"type":42,"tag":1409,"props":3257,"children":3258},{},[3259],{"type":48,"value":3260},"Strict format (UUID, slug, ISO date)",{"type":42,"tag":1409,"props":3262,"children":3263},{},[3264],{"type":42,"tag":64,"props":3265,"children":3267},{"className":3266},[],[3268],{"type":48,"value":3269},"regex(v, PATTERN)",{"type":42,"tag":1409,"props":3271,"children":3272},{},[3273],{"type":42,"tag":64,"props":3274,"children":3276},{"className":3275},[],[3277],{"type":48,"value":3224},{"type":42,"tag":1382,"props":3279,"children":3280},{},[3281,3286,3295],{"type":42,"tag":1409,"props":3282,"children":3283},{},[3284],{"type":48,"value":3285},"Table or column name",{"type":42,"tag":1409,"props":3287,"children":3288},{},[3289],{"type":42,"tag":64,"props":3290,"children":3292},{"className":3291},[],[3293],{"type":48,"value":3294},"ident(name)",{"type":42,"tag":1409,"props":3296,"children":3297},{},[3298],{"type":42,"tag":64,"props":3299,"children":3301},{"className":3300},[],[3302],{"type":48,"value":3303},"\"value\"",{"type":42,"tag":1382,"props":3305,"children":3306},{},[3307,3312,3321],{"type":42,"tag":1409,"props":3308,"children":3309},{},[3310],{"type":48,"value":3311},"Integer",{"type":42,"tag":1409,"props":3313,"children":3314},{},[3315],{"type":42,"tag":64,"props":3316,"children":3318},{"className":3317},[],[3319],{"type":48,"value":3320},"integer(v)",{"type":42,"tag":1409,"props":3322,"children":3323},{},[3324],{"type":42,"tag":64,"props":3325,"children":3327},{"className":3326},[],[3328],{"type":48,"value":3250},{"type":42,"tag":1382,"props":3330,"children":3331},{},[3332,3337,3346],{"type":42,"tag":1409,"props":3333,"children":3334},{},[3335],{"type":48,"value":3336},"Free text (description, comment, user name)",{"type":42,"tag":1409,"props":3338,"children":3339},{},[3340],{"type":42,"tag":64,"props":3341,"children":3343},{"className":3342},[],[3344],{"type":48,"value":3345},"literal(v)",{"type":42,"tag":1409,"props":3347,"children":3348},{},[3349],{"type":42,"tag":64,"props":3350,"children":3352},{"className":3351},[],[3353],{"type":48,"value":3354},"$dq_xxx$value$dq_xxx$",{"type":42,"tag":58,"props":3356,"children":3357},{},[3358,3360,3366,3368,3374,3375,3381,3382,3388,3389,3395,3396,3402],{"type":48,"value":3359},"Built-in patterns from ",{"type":42,"tag":64,"props":3361,"children":3363},{"className":3362},[],[3364],{"type":48,"value":3365},"safe_query.py",{"type":48,"value":3367},": ",{"type":42,"tag":64,"props":3369,"children":3371},{"className":3370},[],[3372],{"type":48,"value":3373},"TENANT_SLUG",{"type":48,"value":2727},{"type":42,"tag":64,"props":3376,"children":3378},{"className":3377},[],[3379],{"type":48,"value":3380},"[a-z0-9-]{1,64}",{"type":48,"value":3066},{"type":42,"tag":64,"props":3383,"children":3385},{"className":3384},[],[3386],{"type":48,"value":3387},"UUID",{"type":48,"value":363},{"type":42,"tag":64,"props":3390,"children":3392},{"className":3391},[],[3393],{"type":48,"value":3394},"INT",{"type":48,"value":363},{"type":42,"tag":64,"props":3397,"children":3399},{"className":3398},[],[3400],{"type":48,"value":3401},"ISO_DATE",{"type":48,"value":509},{"type":42,"tag":58,"props":3404,"children":3405},{},[3406,3411],{"type":42,"tag":76,"props":3407,"children":3408},{},[3409],{"type":48,"value":3410},"Required imports",{"type":48,"value":3412}," at the top of every file that builds DSQL SQL:",{"type":42,"tag":1163,"props":3414,"children":3418},{"className":3415,"code":3416,"language":3417,"meta":1168,"style":1168},"language-python shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","from safe_query import build, allow, regex, ident, keyword, integer, literal, UnsafeSQLError\nfrom safe_query import TENANT_SLUG, UUID, ISO_DATE\n","python",[3419],{"type":42,"tag":64,"props":3420,"children":3421},{"__ignoreMap":1168},[3422,3430],{"type":42,"tag":1174,"props":3423,"children":3424},{"class":1176,"line":37},[3425],{"type":42,"tag":1174,"props":3426,"children":3427},{},[3428],{"type":48,"value":3429},"from safe_query import build, allow, regex, ident, keyword, integer, literal, UnsafeSQLError\n",{"type":42,"tag":1174,"props":3431,"children":3432},{"class":1176,"line":2268},[3433],{"type":42,"tag":1174,"props":3434,"children":3435},{},[3436],{"type":48,"value":3437},"from safe_query import TENANT_SLUG, UUID, ISO_DATE\n",{"type":42,"tag":58,"props":3439,"children":3440},{},[3441,3446,3448,3454,3455,3461,3463,3468,3470,3476],{"type":42,"tag":76,"props":3442,"children":3443},{},[3444],{"type":48,"value":3445},"Rubric-Critical Scenario 1 — tenant_id from untrusted input.",{"type":48,"value":3447}," Validate with ",{"type":42,"tag":64,"props":3449,"children":3451},{"className":3450},[],[3452],{"type":48,"value":3453},"regex(req.tenant, TENANT_SLUG)",{"type":48,"value":2878},{"type":42,"tag":64,"props":3456,"children":3458},{"className":3457},[],[3459],{"type":48,"value":3460},"allow(req.tenant, ALLOWED_TENANTS)",{"type":48,"value":3462},". Build with ",{"type":42,"tag":64,"props":3464,"children":3466},{"className":3465},[],[3467],{"type":48,"value":3001},{"type":48,"value":3469},", then execute. Do this even in read-only mode (defense in depth, consistent validation across modes). Do NOT use f-strings, ",{"type":42,"tag":64,"props":3471,"children":3473},{"className":3472},[],[3474],{"type":48,"value":3475},".format()",{"type":48,"value":3477},", or bare concatenation.",{"type":42,"tag":1163,"props":3479,"children":3481},{"className":3415,"code":3480,"language":3417,"meta":1168,"style":1168},"sql = build(\n    \"SELECT * FROM {t} WHERE tenant_id = {tid}\",\n    t=ident(\"entities\"),\n    tid=regex(req.tenant, TENANT_SLUG),\n)\n# Application code: pass `sql` to your driver (psycopg cursor.execute, pgx Query, etc.).\n# Bash one-off: pipe `sql` into psql via the patterns in input-validation.md.\n",[3482],{"type":42,"tag":64,"props":3483,"children":3484},{"__ignoreMap":1168},[3485,3493,3501,3510,3519,3528,3537],{"type":42,"tag":1174,"props":3486,"children":3487},{"class":1176,"line":37},[3488],{"type":42,"tag":1174,"props":3489,"children":3490},{},[3491],{"type":48,"value":3492},"sql = build(\n",{"type":42,"tag":1174,"props":3494,"children":3495},{"class":1176,"line":2268},[3496],{"type":42,"tag":1174,"props":3497,"children":3498},{},[3499],{"type":48,"value":3500},"    \"SELECT * FROM {t} WHERE tenant_id = {tid}\",\n",{"type":42,"tag":1174,"props":3502,"children":3504},{"class":1176,"line":3503},3,[3505],{"type":42,"tag":1174,"props":3506,"children":3507},{},[3508],{"type":48,"value":3509},"    t=ident(\"entities\"),\n",{"type":42,"tag":1174,"props":3511,"children":3513},{"class":1176,"line":3512},4,[3514],{"type":42,"tag":1174,"props":3515,"children":3516},{},[3517],{"type":48,"value":3518},"    tid=regex(req.tenant, TENANT_SLUG),\n",{"type":42,"tag":1174,"props":3520,"children":3522},{"class":1176,"line":3521},5,[3523],{"type":42,"tag":1174,"props":3524,"children":3525},{},[3526],{"type":48,"value":3527},")\n",{"type":42,"tag":1174,"props":3529,"children":3531},{"class":1176,"line":3530},6,[3532],{"type":42,"tag":1174,"props":3533,"children":3534},{},[3535],{"type":48,"value":3536},"# Application code: pass `sql` to your driver (psycopg cursor.execute, pgx Query, etc.).\n",{"type":42,"tag":1174,"props":3538,"children":3540},{"class":1176,"line":3539},7,[3541],{"type":42,"tag":1174,"props":3542,"children":3543},{},[3544],{"type":48,"value":3545},"# Bash one-off: pipe `sql` into psql via the patterns in input-validation.md.\n",{"type":42,"tag":58,"props":3547,"children":3548},{},[3549,3554,3556,3561,3562,3568,3570,3576,3577,3582,3583,3589,3591,3597],{"type":42,"tag":76,"props":3550,"children":3551},{},[3552],{"type":48,"value":3553},"Rubric-Critical Scenario 2 — batch INSERT with UUIDs, slugs, and free text.",{"type":48,"value":3555}," Each row's INSERT is built separately with ",{"type":42,"tag":64,"props":3557,"children":3559},{"className":3558},[],[3560],{"type":48,"value":3001},{"type":48,"value":3367},{"type":42,"tag":64,"props":3563,"children":3565},{"className":3564},[],[3566],{"type":48,"value":3567},"entity_id",{"type":48,"value":3569}," via ",{"type":42,"tag":64,"props":3571,"children":3573},{"className":3572},[],[3574],{"type":48,"value":3575},"regex(..., UUID)",{"type":48,"value":363},{"type":42,"tag":64,"props":3578,"children":3580},{"className":3579},[],[3581],{"type":48,"value":130},{"type":48,"value":3569},{"type":42,"tag":64,"props":3584,"children":3586},{"className":3585},[],[3587],{"type":48,"value":3588},"regex(..., TENANT_SLUG)",{"type":48,"value":3590},", description via ",{"type":42,"tag":64,"props":3592,"children":3594},{"className":3593},[],[3595],{"type":48,"value":3596},"literal(...)",{"type":48,"value":3598}," (dollar-quoted to sidestep quote escaping). Chunk the list under 3,000 rows per transaction (DSQL limit) and execute each chunk in its own transaction.",{"type":42,"tag":1163,"props":3600,"children":3602},{"className":3415,"code":3601,"language":3417,"meta":1168,"style":1168},"def insert_entries(conn, entries, chunk_size=2500):\n    for i in range(0, len(entries), chunk_size):\n        chunk = entries[i:i + chunk_size]\n        with conn.transaction():\n            for e in chunk:\n                sql = build(\n                    \"INSERT INTO {t} (entity_id, tenant_id, description) VALUES ({eid}, {tid}, {d})\",\n                    t=ident(\"entities\"),\n                    eid=regex(e[\"entity_id\"], UUID),\n                    tid=regex(e[\"tenant_id\"], TENANT_SLUG),\n                    d=literal(e[\"description\"]),\n                )\n                conn.execute(sql)\n",[3603],{"type":42,"tag":64,"props":3604,"children":3605},{"__ignoreMap":1168},[3606,3614,3622,3630,3638,3646,3654,3662,3671,3680,3689,3698,3707],{"type":42,"tag":1174,"props":3607,"children":3608},{"class":1176,"line":37},[3609],{"type":42,"tag":1174,"props":3610,"children":3611},{},[3612],{"type":48,"value":3613},"def insert_entries(conn, entries, chunk_size=2500):\n",{"type":42,"tag":1174,"props":3615,"children":3616},{"class":1176,"line":2268},[3617],{"type":42,"tag":1174,"props":3618,"children":3619},{},[3620],{"type":48,"value":3621},"    for i in range(0, len(entries), chunk_size):\n",{"type":42,"tag":1174,"props":3623,"children":3624},{"class":1176,"line":3503},[3625],{"type":42,"tag":1174,"props":3626,"children":3627},{},[3628],{"type":48,"value":3629},"        chunk = entries[i:i + chunk_size]\n",{"type":42,"tag":1174,"props":3631,"children":3632},{"class":1176,"line":3512},[3633],{"type":42,"tag":1174,"props":3634,"children":3635},{},[3636],{"type":48,"value":3637},"        with conn.transaction():\n",{"type":42,"tag":1174,"props":3639,"children":3640},{"class":1176,"line":3521},[3641],{"type":42,"tag":1174,"props":3642,"children":3643},{},[3644],{"type":48,"value":3645},"            for e in chunk:\n",{"type":42,"tag":1174,"props":3647,"children":3648},{"class":1176,"line":3530},[3649],{"type":42,"tag":1174,"props":3650,"children":3651},{},[3652],{"type":48,"value":3653},"                sql = build(\n",{"type":42,"tag":1174,"props":3655,"children":3656},{"class":1176,"line":3539},[3657],{"type":42,"tag":1174,"props":3658,"children":3659},{},[3660],{"type":48,"value":3661},"                    \"INSERT INTO {t} (entity_id, tenant_id, description) VALUES ({eid}, {tid}, {d})\",\n",{"type":42,"tag":1174,"props":3663,"children":3665},{"class":1176,"line":3664},8,[3666],{"type":42,"tag":1174,"props":3667,"children":3668},{},[3669],{"type":48,"value":3670},"                    t=ident(\"entities\"),\n",{"type":42,"tag":1174,"props":3672,"children":3674},{"class":1176,"line":3673},9,[3675],{"type":42,"tag":1174,"props":3676,"children":3677},{},[3678],{"type":48,"value":3679},"                    eid=regex(e[\"entity_id\"], UUID),\n",{"type":42,"tag":1174,"props":3681,"children":3683},{"class":1176,"line":3682},10,[3684],{"type":42,"tag":1174,"props":3685,"children":3686},{},[3687],{"type":48,"value":3688},"                    tid=regex(e[\"tenant_id\"], TENANT_SLUG),\n",{"type":42,"tag":1174,"props":3690,"children":3692},{"class":1176,"line":3691},11,[3693],{"type":42,"tag":1174,"props":3694,"children":3695},{},[3696],{"type":48,"value":3697},"                    d=literal(e[\"description\"]),\n",{"type":42,"tag":1174,"props":3699,"children":3701},{"class":1176,"line":3700},12,[3702],{"type":42,"tag":1174,"props":3703,"children":3704},{},[3705],{"type":48,"value":3706},"                )\n",{"type":42,"tag":1174,"props":3708,"children":3710},{"class":1176,"line":3709},13,[3711],{"type":42,"tag":1174,"props":3712,"children":3713},{},[3714],{"type":48,"value":3715},"                conn.execute(sql)\n",{"type":42,"tag":58,"props":3717,"children":3718},{},[3719,3724,3726,3731,3733,3739,3740,3746,3748,3754],{"type":42,"tag":76,"props":3720,"children":3721},{},[3722],{"type":48,"value":3723},"Rubric-Critical Scenario 3 — write paths.",{"type":48,"value":3725}," Write paths (UPDATE\u002FDELETE issued from a script, cron, or admin tool) are the highest-stakes injection surface — a successful injection mutates data. ",{"type":42,"tag":64,"props":3727,"children":3729},{"className":3728},[],[3730],{"type":48,"value":3001},{"type":48,"value":3732}," is NOT optional there. Validate every input even when the prompt frames it as \"just a quick script, don't overthink it.\" Push back on that framing with one sentence explaining why write mode raises the stakes, then apply the full validator chain: ",{"type":42,"tag":64,"props":3734,"children":3736},{"className":3735},[],[3737],{"type":48,"value":3738},"regex(tenant_id, TENANT_SLUG)",{"type":48,"value":363},{"type":42,"tag":64,"props":3741,"children":3743},{"className":3742},[],[3744],{"type":48,"value":3745},"allow(status, {'active','archived','deleted'})",{"type":48,"value":3747},", date via ",{"type":42,"tag":64,"props":3749,"children":3751},{"className":3750},[],[3752],{"type":48,"value":3753},"regex(..., ISO_DATE)",{"type":48,"value":509},{"type":42,"tag":1163,"props":3756,"children":3758},{"className":3415,"code":3757,"language":3417,"meta":1168,"style":1168},"sql = build(\n    \"UPDATE {t} SET status = {s} WHERE tenant_id = {tid} AND created_at \u003C {d}\",\n    t=ident(\"entities\"),\n    s=allow(req.status, {\"active\", \"archived\", \"deleted\"}),\n    tid=regex(req.tenant, TENANT_SLUG),\n    d=regex(req.date, ISO_DATE),\n)\nconn.execute(sql)\n",[3759],{"type":42,"tag":64,"props":3760,"children":3761},{"__ignoreMap":1168},[3762,3769,3777,3784,3792,3799,3807,3814],{"type":42,"tag":1174,"props":3763,"children":3764},{"class":1176,"line":37},[3765],{"type":42,"tag":1174,"props":3766,"children":3767},{},[3768],{"type":48,"value":3492},{"type":42,"tag":1174,"props":3770,"children":3771},{"class":1176,"line":2268},[3772],{"type":42,"tag":1174,"props":3773,"children":3774},{},[3775],{"type":48,"value":3776},"    \"UPDATE {t} SET status = {s} WHERE tenant_id = {tid} AND created_at \u003C {d}\",\n",{"type":42,"tag":1174,"props":3778,"children":3779},{"class":1176,"line":3503},[3780],{"type":42,"tag":1174,"props":3781,"children":3782},{},[3783],{"type":48,"value":3509},{"type":42,"tag":1174,"props":3785,"children":3786},{"class":1176,"line":3512},[3787],{"type":42,"tag":1174,"props":3788,"children":3789},{},[3790],{"type":48,"value":3791},"    s=allow(req.status, {\"active\", \"archived\", \"deleted\"}),\n",{"type":42,"tag":1174,"props":3793,"children":3794},{"class":1176,"line":3521},[3795],{"type":42,"tag":1174,"props":3796,"children":3797},{},[3798],{"type":48,"value":3518},{"type":42,"tag":1174,"props":3800,"children":3801},{"class":1176,"line":3530},[3802],{"type":42,"tag":1174,"props":3803,"children":3804},{},[3805],{"type":48,"value":3806},"    d=regex(req.date, ISO_DATE),\n",{"type":42,"tag":1174,"props":3808,"children":3809},{"class":1176,"line":3539},[3810],{"type":42,"tag":1174,"props":3811,"children":3812},{},[3813],{"type":48,"value":3527},{"type":42,"tag":1174,"props":3815,"children":3816},{"class":1176,"line":3664},[3817],{"type":42,"tag":1174,"props":3818,"children":3819},{},[3820],{"type":48,"value":3821},"conn.execute(sql)\n",{"type":42,"tag":58,"props":3823,"children":3824},{},[3825,3830,3832,3838,3840,3846,3848,3853,3855,3861,3863,3869,3871,3877,3879,3885,3887,3892,3894,3899,3900,3905,3907,3912,3914,3919],{"type":42,"tag":76,"props":3826,"children":3827},{},[3828],{"type":48,"value":3829},"Rubric-Critical Scenario 4 — dynamic ORDER BY column and direction.",{"type":48,"value":3831}," Identifier and keyword parameters need DIFFERENT validators than value parameters. ",{"type":42,"tag":64,"props":3833,"children":3835},{"className":3834},[],[3836],{"type":48,"value":3837},"sort_col",{"type":48,"value":3839}," is membership-checked against ",{"type":42,"tag":64,"props":3841,"children":3843},{"className":3842},[],[3844],{"type":48,"value":3845},"{'created_at','updated_at','name'}",{"type":48,"value":3847}," then passed through ",{"type":42,"tag":64,"props":3849,"children":3851},{"className":3850},[],[3852],{"type":48,"value":3072},{"type":48,"value":3854}," (emits double-quoted identifier). ",{"type":42,"tag":64,"props":3856,"children":3858},{"className":3857},[],[3859],{"type":48,"value":3860},"sort_dir",{"type":48,"value":3862}," goes through ",{"type":42,"tag":64,"props":3864,"children":3866},{"className":3865},[],[3867],{"type":48,"value":3868},"keyword()",{"type":48,"value":3870}," against ",{"type":42,"tag":64,"props":3872,"children":3874},{"className":3873},[],[3875],{"type":48,"value":3876},"{'ASC','DESC'}",{"type":48,"value":3878}," (emits unquoted keyword — quoting ",{"type":42,"tag":64,"props":3880,"children":3882},{"className":3881},[],[3883],{"type":48,"value":3884},"ASC",{"type":48,"value":3886}," would be a syntax error). Value parameters like ",{"type":42,"tag":64,"props":3888,"children":3890},{"className":3889},[],[3891],{"type":48,"value":130},{"type":48,"value":3893}," still go through ",{"type":42,"tag":64,"props":3895,"children":3897},{"className":3896},[],[3898],{"type":48,"value":3056},{"type":48,"value":2878},{"type":42,"tag":64,"props":3901,"children":3903},{"className":3902},[],[3904],{"type":48,"value":3048},{"type":48,"value":3906},". Do NOT try to validate an identifier with ",{"type":42,"tag":64,"props":3908,"children":3910},{"className":3909},[],[3911],{"type":48,"value":3056},{"type":48,"value":3913}," against a TENANT_SLUG pattern — use ",{"type":42,"tag":64,"props":3915,"children":3917},{"className":3916},[],[3918],{"type":48,"value":3072},{"type":48,"value":3920},", which enforces the identifier grammar.",{"type":42,"tag":1163,"props":3922,"children":3924},{"className":3415,"code":3923,"language":3417,"meta":1168,"style":1168},"ALLOWED_SORT_COLS = {\"created_at\", \"updated_at\", \"name\"}\nif sort_col not in ALLOWED_SORT_COLS:\n    raise ValueError(f\"sort_col must be one of {ALLOWED_SORT_COLS}\")\nsql = build(\n    \"SELECT * FROM {t} WHERE tenant_id = {tid} ORDER BY {col} {dir}\",\n    t=ident(\"entities\"),\n    tid=regex(req.tenant, TENANT_SLUG),\n    col=ident(sort_col),\n    dir=keyword(req.sort_dir, {\"ASC\", \"DESC\"}),\n)\n",[3925],{"type":42,"tag":64,"props":3926,"children":3927},{"__ignoreMap":1168},[3928,3936,3944,3952,3959,3967,3974,3981,3989,3997],{"type":42,"tag":1174,"props":3929,"children":3930},{"class":1176,"line":37},[3931],{"type":42,"tag":1174,"props":3932,"children":3933},{},[3934],{"type":48,"value":3935},"ALLOWED_SORT_COLS = {\"created_at\", \"updated_at\", \"name\"}\n",{"type":42,"tag":1174,"props":3937,"children":3938},{"class":1176,"line":2268},[3939],{"type":42,"tag":1174,"props":3940,"children":3941},{},[3942],{"type":48,"value":3943},"if sort_col not in ALLOWED_SORT_COLS:\n",{"type":42,"tag":1174,"props":3945,"children":3946},{"class":1176,"line":3503},[3947],{"type":42,"tag":1174,"props":3948,"children":3949},{},[3950],{"type":48,"value":3951},"    raise ValueError(f\"sort_col must be one of {ALLOWED_SORT_COLS}\")\n",{"type":42,"tag":1174,"props":3953,"children":3954},{"class":1176,"line":3512},[3955],{"type":42,"tag":1174,"props":3956,"children":3957},{},[3958],{"type":48,"value":3492},{"type":42,"tag":1174,"props":3960,"children":3961},{"class":1176,"line":3521},[3962],{"type":42,"tag":1174,"props":3963,"children":3964},{},[3965],{"type":48,"value":3966},"    \"SELECT * FROM {t} WHERE tenant_id = {tid} ORDER BY {col} {dir}\",\n",{"type":42,"tag":1174,"props":3968,"children":3969},{"class":1176,"line":3530},[3970],{"type":42,"tag":1174,"props":3971,"children":3972},{},[3973],{"type":48,"value":3509},{"type":42,"tag":1174,"props":3975,"children":3976},{"class":1176,"line":3539},[3977],{"type":42,"tag":1174,"props":3978,"children":3979},{},[3980],{"type":48,"value":3518},{"type":42,"tag":1174,"props":3982,"children":3983},{"class":1176,"line":3664},[3984],{"type":42,"tag":1174,"props":3985,"children":3986},{},[3987],{"type":48,"value":3988},"    col=ident(sort_col),\n",{"type":42,"tag":1174,"props":3990,"children":3991},{"class":1176,"line":3673},[3992],{"type":42,"tag":1174,"props":3993,"children":3994},{},[3995],{"type":48,"value":3996},"    dir=keyword(req.sort_dir, {\"ASC\", \"DESC\"}),\n",{"type":42,"tag":1174,"props":3998,"children":3999},{"class":1176,"line":3682},[4000],{"type":42,"tag":1174,"props":4001,"children":4002},{},[4003],{"type":48,"value":3527},{"type":42,"tag":58,"props":4005,"children":4006},{},[4007,4012,4014,4019,4021,4027],{"type":42,"tag":76,"props":4008,"children":4009},{},[4010],{"type":48,"value":4011},"Rubric-Critical Scenario 5 — rejecting \"just use an f-string\" rationalizations.",{"type":48,"value":4013}," When a caller says \"this value is already validated upstream, can't we just use an f-string?\" — push back. The skill's rule is build-every-query-with-",{"type":42,"tag":64,"props":4015,"children":4017},{"className":4016},[],[4018],{"type":48,"value":3001},{"type":48,"value":4020},", not a judgment call per call site. Justify the pushback:\n(a) \"already-validated upstream\" is exactly the assumption that breaks when upstream code changes hands, adds a new caller, or the validation is silently relaxed;\n(b) defense in depth means the query layer validates independently of upstream;\n(c) the two-line diff to use ",{"type":42,"tag":64,"props":4022,"children":4024},{"className":4023},[],[4025],{"type":48,"value":4026},"safe_query.build() + regex(..., UUID)",{"type":48,"value":4028}," is genuinely smaller than the bug risk of one unsafe path.",{"type":42,"tag":58,"props":4030,"children":4031},{},[4032],{"type":48,"value":4033},"Apply the safe pattern as-is — do NOT cave to the \"simpler\" framing.",{"type":42,"tag":1163,"props":4035,"children":4037},{"className":3415,"code":4036,"language":3417,"meta":1168,"style":1168},"# No — even for \"already-validated upstream\" values:\nsql = f\"SELECT * FROM entities WHERE entity_id = '{req.entity_id}'\"   # BAD\n\n# Yes — uniform pattern at every call site:\nsql = build(\n    \"SELECT * FROM {t} WHERE entity_id = {eid}\",\n    t=ident(\"entities\"),\n    eid=regex(req.entity_id, UUID),\n)\n",[4038],{"type":42,"tag":64,"props":4039,"children":4040},{"__ignoreMap":1168},[4041,4049,4057,4066,4074,4081,4089,4096,4104],{"type":42,"tag":1174,"props":4042,"children":4043},{"class":1176,"line":37},[4044],{"type":42,"tag":1174,"props":4045,"children":4046},{},[4047],{"type":48,"value":4048},"# No — even for \"already-validated upstream\" values:\n",{"type":42,"tag":1174,"props":4050,"children":4051},{"class":1176,"line":2268},[4052],{"type":42,"tag":1174,"props":4053,"children":4054},{},[4055],{"type":48,"value":4056},"sql = f\"SELECT * FROM entities WHERE entity_id = '{req.entity_id}'\"   # BAD\n",{"type":42,"tag":1174,"props":4058,"children":4059},{"class":1176,"line":3503},[4060],{"type":42,"tag":1174,"props":4061,"children":4063},{"emptyLinePlaceholder":4062},true,[4064],{"type":48,"value":4065},"\n",{"type":42,"tag":1174,"props":4067,"children":4068},{"class":1176,"line":3512},[4069],{"type":42,"tag":1174,"props":4070,"children":4071},{},[4072],{"type":48,"value":4073},"# Yes — uniform pattern at every call site:\n",{"type":42,"tag":1174,"props":4075,"children":4076},{"class":1176,"line":3521},[4077],{"type":42,"tag":1174,"props":4078,"children":4079},{},[4080],{"type":48,"value":3492},{"type":42,"tag":1174,"props":4082,"children":4083},{"class":1176,"line":3530},[4084],{"type":42,"tag":1174,"props":4085,"children":4086},{},[4087],{"type":48,"value":4088},"    \"SELECT * FROM {t} WHERE entity_id = {eid}\",\n",{"type":42,"tag":1174,"props":4090,"children":4091},{"class":1176,"line":3539},[4092],{"type":42,"tag":1174,"props":4093,"children":4094},{},[4095],{"type":48,"value":3509},{"type":42,"tag":1174,"props":4097,"children":4098},{"class":1176,"line":3664},[4099],{"type":42,"tag":1174,"props":4100,"children":4101},{},[4102],{"type":48,"value":4103},"    eid=regex(req.entity_id, UUID),\n",{"type":42,"tag":1174,"props":4105,"children":4106},{"class":1176,"line":3673},[4107],{"type":42,"tag":1174,"props":4108,"children":4109},{},[4110],{"type":48,"value":3527},{"type":42,"tag":58,"props":4112,"children":4113},{},[4114],{"type":42,"tag":76,"props":4115,"children":4116},{},[4117],{"type":48,"value":4118},"Anti-patterns (the rubric fails these):",{"type":42,"tag":82,"props":4120,"children":4121},{},[4122,4141,4161,4174,4191],{"type":42,"tag":86,"props":4123,"children":4124},{},[4125,4127,4132,4133,4139],{"type":48,"value":4126},"Using f-strings, ",{"type":42,"tag":64,"props":4128,"children":4130},{"className":4129},[],[4131],{"type":48,"value":3475},{"type":48,"value":363},{"type":42,"tag":64,"props":4134,"children":4136},{"className":4135},[],[4137],{"type":48,"value":4138},"%",{"type":48,"value":4140}," formatting, or string concatenation to build SQL with user input — in any mode",{"type":42,"tag":86,"props":4142,"children":4143},{},[4144,4146,4151,4153,4159],{"type":48,"value":4145},"Mixing ",{"type":42,"tag":64,"props":4147,"children":4149},{"className":4148},[],[4150],{"type":48,"value":3001},{"type":48,"value":4152}," placeholders with native driver ",{"type":42,"tag":64,"props":4154,"children":4156},{"className":4155},[],[4157],{"type":48,"value":4158},"%s",{"type":48,"value":4160}," parameter binding in the same statement — pick one path and stay on it",{"type":42,"tag":86,"props":4162,"children":4163},{},[4164,4166,4172],{"type":48,"value":4165},"Catching ",{"type":42,"tag":64,"props":4167,"children":4169},{"className":4168},[],[4170],{"type":48,"value":4171},"UnsafeSQLError",{"type":48,"value":4173}," to fall back to unsafe construction — re-raise or return an error",{"type":42,"tag":86,"props":4175,"children":4176},{},[4177,4179,4184,4186],{"type":48,"value":4178},"Validating an identifier with ",{"type":42,"tag":64,"props":4180,"children":4182},{"className":4181},[],[4183],{"type":48,"value":3056},{"type":48,"value":4185}," against a value pattern — use ",{"type":42,"tag":64,"props":4187,"children":4189},{"className":4188},[],[4190],{"type":48,"value":3072},{"type":42,"tag":86,"props":4192,"children":4193},{},[4194,4196,4201],{"type":48,"value":4195},"Skipping ",{"type":42,"tag":64,"props":4197,"children":4199},{"className":4198},[],[4200],{"type":48,"value":3001},{"type":48,"value":4202}," in read-only mode under \"the value is already validated upstream\" — defense in depth means the SQL builder validates independently of upstream",{"type":42,"tag":198,"props":4204,"children":4206},{"id":4205},"workflow-5-set-up-scoped-database-roles",[4207],{"type":48,"value":4208},"Workflow 5: Set Up Scoped Database Roles",{"type":42,"tag":58,"props":4210,"children":4211},{},[4212,4213,4217],{"type":48,"value":2936},{"type":42,"tag":99,"props":4214,"children":4215},{"href":702},[4216],{"type":48,"value":705},{"type":48,"value":4218}," for role setup, IAM mapping, and schema permissions.",{"type":42,"tag":198,"props":4220,"children":4222},{"id":4221},"workflow-6-table-recreation-ddl-migration",[4223],{"type":48,"value":4224},"Workflow 6: Table Recreation DDL Migration",{"type":42,"tag":58,"props":4226,"children":4227},{},[4228,4230,4236,4237,4243,4244,4250,4252,4258,4260,4265],{"type":48,"value":4229},"DSQL does NOT support direct ",{"type":42,"tag":64,"props":4231,"children":4233},{"className":4232},[],[4234],{"type":48,"value":4235},"ALTER COLUMN TYPE",{"type":48,"value":363},{"type":42,"tag":64,"props":4238,"children":4240},{"className":4239},[],[4241],{"type":48,"value":4242},"DROP COLUMN",{"type":48,"value":363},{"type":42,"tag":64,"props":4245,"children":4247},{"className":4246},[],[4248],{"type":48,"value":4249},"DROP CONSTRAINT",{"type":48,"value":4251},", or ",{"type":42,"tag":64,"props":4253,"children":4255},{"className":4254},[],[4256],{"type":48,"value":4257},"MODIFY PRIMARY KEY",{"type":48,"value":4259},". These require the ",{"type":42,"tag":76,"props":4261,"children":4262},{},[4263],{"type":48,"value":4264},"Table Recreation Pattern",{"type":48,"value":4266}," — a destructive workflow requiring user confirmation at each step.",{"type":42,"tag":58,"props":4268,"children":4269},{},[4270,4271,4275],{"type":48,"value":2936},{"type":42,"tag":99,"props":4272,"children":4273},{"href":893},[4274],{"type":48,"value":896},{"type":48,"value":4276}," first, then the relevant sub-file:",{"type":42,"tag":82,"props":4278,"children":4279},{},[4280,4289,4298],{"type":42,"tag":86,"props":4281,"children":4282},{},[4283,4285],{"type":48,"value":4284},"Column changes (type, nullability, default): ",{"type":42,"tag":99,"props":4286,"children":4287},{"href":918},[4288],{"type":48,"value":921},{"type":42,"tag":86,"props":4290,"children":4291},{},[4292,4294],{"type":48,"value":4293},"Constraint\u002FPK changes, column splits\u002Fmerges: ",{"type":42,"tag":99,"props":4295,"children":4296},{"href":943},[4297],{"type":48,"value":946},{"type":42,"tag":86,"props":4299,"children":4300},{},[4301,4303],{"type":48,"value":4302},"Tables exceeding 3,000 rows: also load ",{"type":42,"tag":99,"props":4304,"children":4305},{"href":968},[4306],{"type":48,"value":971},{"type":42,"tag":198,"props":4308,"children":4310},{"id":4309},"workflow-7-mysql-to-dsql-schema-migration",[4311],{"type":48,"value":4312},"Workflow 7: MySQL to DSQL Schema Migration",{"type":42,"tag":58,"props":4314,"children":4315},{},[4316,4317,4321,4323,4327,4329,4333],{"type":48,"value":2936},{"type":42,"tag":99,"props":4318,"children":4319},{"href":999},[4320],{"type":48,"value":1002},{"type":48,"value":4322}," for type mappings and feature alternatives. For DDL translation details load ",{"type":42,"tag":99,"props":4324,"children":4325},{"href":1024},[4326],{"type":48,"value":1027},{"type":48,"value":4328},". For an end-to-end example load ",{"type":42,"tag":99,"props":4330,"children":4331},{"href":1049},[4332],{"type":48,"value":1052},{"type":48,"value":509},{"type":42,"tag":198,"props":4335,"children":4337},{"id":4336},"workflow-8-query-plan-explainability",[4338],{"type":48,"value":4339},"Workflow 8: Query Plan Explainability",{"type":42,"tag":58,"props":4341,"children":4342},{},[4343],{"type":48,"value":4344},"Triggered by slow queries, high DPU, unexpected Full Scans, or plans the user doesn't understand. A structured Markdown diagnostic report is the required deliverable — run the workflow end-to-end before answering.",{"type":42,"tag":58,"props":4346,"children":4347},{},[4348],{"type":48,"value":4349},"MUST load all four reference files before starting:",{"type":42,"tag":3011,"props":4351,"children":4352},{},[4353,4362,4371,4388],{"type":42,"tag":86,"props":4354,"children":4355},{},[4356,4360],{"type":42,"tag":99,"props":4357,"children":4358},{"href":1085},[4359],{"type":48,"value":1088},{"type":48,"value":4361}," — node types, duration math, anomalous values",{"type":42,"tag":86,"props":4363,"children":4364},{},[4365,4369],{"type":42,"tag":99,"props":4366,"children":4367},{"href":1092},[4368],{"type":48,"value":1095},{"type":48,"value":4370}," — pg_class \u002F pg_stats \u002F pg_indexes SQL",{"type":42,"tag":86,"props":4372,"children":4373},{},[4374,4378,4380,4386],{"type":42,"tag":99,"props":4375,"children":4376},{"href":1099},[4377],{"type":48,"value":1102},{"type":48,"value":4379}," — GUC procedures and ",{"type":42,"tag":64,"props":4381,"children":4383},{"className":4382},[],[4384],{"type":48,"value":4385},">30s",{"type":48,"value":4387}," skip protocol",{"type":42,"tag":86,"props":4389,"children":4390},{},[4391,4395],{"type":42,"tag":99,"props":4392,"children":4393},{"href":1106},[4394],{"type":48,"value":1109},{"type":48,"value":4396}," — required report structure and elements checklist",{"type":42,"tag":58,"props":4398,"children":4399},{},[4400,4405,4407,4413,4415,4420],{"type":42,"tag":76,"props":4401,"children":4402},{},[4403],{"type":48,"value":4404},"Phase 1 — Capture the plan.",{"type":48,"value":4406}," ALWAYS run ",{"type":42,"tag":64,"props":4408,"children":4410},{"className":4409},[],[4411],{"type":48,"value":4412},"EXPLAIN ANALYZE VERBOSE",{"type":48,"value":4414}," on the user's query verbatim via ",{"type":42,"tag":64,"props":4416,"children":4418},{"className":4417},[],[4419],{"type":48,"value":69},{"type":48,"value":4421}," — even when the user describes or pastes the plan. SELECT runs as-is. UPDATE\u002FDELETE: rewrite to the equivalent SELECT before running. INSERT, pl\u002Fpgsql, DO blocks, and functions MUST be rejected. MUST NOT run mutating DML during plan capture. When EXPLAIN errors, report verbatim — do not invent DSQL-specific semantics. Extract Query ID, Planning Time, Execution Time, and DPU Estimate.",{"type":42,"tag":58,"props":4423,"children":4424},{},[4425,4430,4432,4438,4439,4445,4446,4452,4453,4459,4460,4466,4468,4474,4476,4482],{"type":42,"tag":76,"props":4426,"children":4427},{},[4428],{"type":48,"value":4429},"Phase 2 — Gather evidence.",{"type":48,"value":4431}," Query ",{"type":42,"tag":64,"props":4433,"children":4435},{"className":4434},[],[4436],{"type":48,"value":4437},"pg_class",{"type":48,"value":363},{"type":42,"tag":64,"props":4440,"children":4442},{"className":4441},[],[4443],{"type":48,"value":4444},"pg_stats",{"type":48,"value":363},{"type":42,"tag":64,"props":4447,"children":4449},{"className":4448},[],[4450],{"type":48,"value":4451},"pg_indexes",{"type":48,"value":363},{"type":42,"tag":64,"props":4454,"children":4456},{"className":4455},[],[4457],{"type":48,"value":4458},"COUNT(*)",{"type":48,"value":363},{"type":42,"tag":64,"props":4461,"children":4463},{"className":4462},[],[4464],{"type":48,"value":4465},"COUNT(DISTINCT)",{"type":48,"value":4467}," per ",{"type":42,"tag":64,"props":4469,"children":4471},{"className":4470},[],[4472],{"type":48,"value":4473},"catalog-queries.md",{"type":48,"value":4475},". Classify estimation errors per ",{"type":42,"tag":64,"props":4477,"children":4479},{"className":4478},[],[4480],{"type":48,"value":4481},"plan-interpretation.md",{"type":48,"value":509},{"type":42,"tag":58,"props":4484,"children":4485},{},[4486,4491,4493,4499],{"type":42,"tag":76,"props":4487,"children":4488},{},[4489],{"type":48,"value":4490},"Phase 3 — Experiment (conditional).",{"type":48,"value":4492}," ≤30s: run GUC experiments per ",{"type":42,"tag":64,"props":4494,"children":4496},{"className":4495},[],[4497],{"type":48,"value":4498},"guc-experiments.md",{"type":48,"value":4500}," plus redundant-predicate test. >30s: skip, include manual GUC SQL verbatim in the report. Anomalous row counts: confirm results are correct, flag as potential DSQL bug, produce Support Request Template.",{"type":42,"tag":58,"props":4502,"children":4503},{},[4504,4509,4511,4517],{"type":42,"tag":76,"props":4505,"children":4506},{},[4507],{"type":48,"value":4508},"Phase 4 — Report and invite reassessment.",{"type":48,"value":4510}," Produce the full diagnostic report per the Required Elements Checklist in ",{"type":42,"tag":64,"props":4512,"children":4514},{"className":4513},[],[4515],{"type":48,"value":4516},"report-format.md",{"type":48,"value":4518},". End with the \"Next Steps\" block. When user says \"reassess\", re-run Phases 1–2 and append an \"Addendum: After-Change Performance\" to the original report.",{"type":42,"tag":58,"props":4520,"children":4521},{},[4522],{"type":42,"tag":76,"props":4523,"children":4524},{},[4525],{"type":48,"value":4526},"psql invocation:",{"type":42,"tag":1163,"props":4528,"children":4530},{"className":1165,"code":4529,"language":1167,"meta":1168,"style":1168},".\u002Fscripts\u002Fpsql-connect.sh --cluster \u003Cid> --command \"EXPLAIN ANALYZE VERBOSE \u003Csql>\"\n.\u002Fscripts\u002Fpsql-connect.sh --cluster \u003Cid> --script .\u002Fexperiment-2.sql   # GUC multi-statement\n",[4531],{"type":42,"tag":64,"props":4532,"children":4533},{"__ignoreMap":1168},[4534,4579],{"type":42,"tag":1174,"props":4535,"children":4536},{"class":1176,"line":37},[4537,4541,4545,4549,4554,4558,4562,4566,4570,4575],{"type":42,"tag":1174,"props":4538,"children":4539},{"style":1180},[4540],{"type":48,"value":1183},{"type":42,"tag":1174,"props":4542,"children":4543},{"style":1186},[4544],{"type":48,"value":1189},{"type":42,"tag":1174,"props":4546,"children":4547},{"style":1192},[4548],{"type":48,"value":1195},{"type":42,"tag":1174,"props":4550,"children":4551},{"style":1186},[4552],{"type":48,"value":4553},"i",{"type":42,"tag":1174,"props":4555,"children":4556},{"style":1203},[4557],{"type":48,"value":1206},{"type":42,"tag":1174,"props":4559,"children":4560},{"style":1192},[4561],{"type":48,"value":1211},{"type":42,"tag":1174,"props":4563,"children":4564},{"style":1186},[4565],{"type":48,"value":1216},{"type":42,"tag":1174,"props":4567,"children":4568},{"style":1192},[4569],{"type":48,"value":1221},{"type":42,"tag":1174,"props":4571,"children":4572},{"style":1186},[4573],{"type":48,"value":4574},"EXPLAIN ANALYZE VERBOSE \u003Csql>",{"type":42,"tag":1174,"props":4576,"children":4577},{"style":1192},[4578],{"type":48,"value":1231},{"type":42,"tag":1174,"props":4580,"children":4581},{"class":1176,"line":2268},[4582,4586,4590,4594,4598,4602,4606,4611,4616],{"type":42,"tag":1174,"props":4583,"children":4584},{"style":1180},[4585],{"type":48,"value":1183},{"type":42,"tag":1174,"props":4587,"children":4588},{"style":1186},[4589],{"type":48,"value":1189},{"type":42,"tag":1174,"props":4591,"children":4592},{"style":1192},[4593],{"type":48,"value":1195},{"type":42,"tag":1174,"props":4595,"children":4596},{"style":1186},[4597],{"type":48,"value":4553},{"type":42,"tag":1174,"props":4599,"children":4600},{"style":1203},[4601],{"type":48,"value":1206},{"type":42,"tag":1174,"props":4603,"children":4604},{"style":1192},[4605],{"type":48,"value":1211},{"type":42,"tag":1174,"props":4607,"children":4608},{"style":1186},[4609],{"type":48,"value":4610}," --script",{"type":42,"tag":1174,"props":4612,"children":4613},{"style":1186},[4614],{"type":48,"value":4615}," .\u002Fexperiment-2.sql",{"type":42,"tag":1174,"props":4617,"children":4618},{"style":2161},[4619],{"type":48,"value":4620},"   # GUC multi-statement\n",{"type":42,"tag":183,"props":4622,"children":4623},{},[],{"type":42,"tag":51,"props":4625,"children":4627},{"id":4626},"security-considerations",[4628],{"type":48,"value":4629},"Security Considerations",{"type":42,"tag":58,"props":4631,"children":4632},{},[4633],{"type":48,"value":4634},"This section consolidates key security controls. For detailed guidance, see the linked reference files.",{"type":42,"tag":3011,"props":4636,"children":4637},{},[4638,4661,4699,4733,4743,4758,4781,4858],{"type":42,"tag":86,"props":4639,"children":4640},{},[4641,4646,4648,4653,4655,4660],{"type":42,"tag":76,"props":4642,"children":4643},{},[4644],{"type":48,"value":4645},"IAM auth token expiry:",{"type":48,"value":4647}," IAM auth tokens expire after 15 minutes. Always generate fresh tokens per connection or implement periodic refresh. ",{"type":42,"tag":76,"props":4649,"children":4650},{},[4651],{"type":48,"value":4652},"Never persist tokens to disk",{"type":48,"value":4654}," — keep them in memory only and discard after use. See ",{"type":42,"tag":99,"props":4656,"children":4657},{"href":741},[4658],{"type":48,"value":4659},"authentication-guide.md",{"type":48,"value":509},{"type":42,"tag":86,"props":4662,"children":4663},{},[4664,4669,4671,4676,4678,4684,4686,4692,4694,4698],{"type":42,"tag":76,"props":4665,"children":4666},{},[4667],{"type":48,"value":4668},"Scoped Roles Over Admin:",{"type":48,"value":4670}," Use scoped database roles with ",{"type":42,"tag":64,"props":4672,"children":4674},{"className":4673},[],[4675],{"type":48,"value":720},{"type":48,"value":4677}," for all application connections. Reserve the ",{"type":42,"tag":64,"props":4679,"children":4681},{"className":4680},[],[4682],{"type":48,"value":4683},"admin",{"type":48,"value":4685}," role strictly for initial cluster setup (creating roles, granting permissions). Revoke ",{"type":42,"tag":64,"props":4687,"children":4689},{"className":4688},[],[4690],{"type":48,"value":4691},"dsql:DbConnectAdmin",{"type":48,"value":4693}," from setup IAM roles once scoped roles are established. See ",{"type":42,"tag":99,"props":4695,"children":4696},{"href":702},[4697],{"type":48,"value":705},{"type":48,"value":509},{"type":42,"tag":86,"props":4700,"children":4701},{},[4702,4707,4709,4715,4717,4723,4725,4731],{"type":42,"tag":76,"props":4703,"children":4704},{},[4705],{"type":48,"value":4706},"Encryption in Transit:",{"type":48,"value":4708}," SSL\u002FTLS is enforced server-side. Use ",{"type":42,"tag":64,"props":4710,"children":4712},{"className":4711},[],[4713],{"type":48,"value":4714},"sslmode=verify-full",{"type":48,"value":4716}," (default in DSQL connectors and ",{"type":42,"tag":64,"props":4718,"children":4720},{"className":4719},[],[4721],{"type":48,"value":4722},"psql-connect.sh",{"type":48,"value":4724},") to validate the server certificate against DSQL's CA, preventing MITM attacks. Only downgrade to ",{"type":42,"tag":64,"props":4726,"children":4728},{"className":4727},[],[4729],{"type":48,"value":4730},"require",{"type":48,"value":4732}," when the client lacks access to a trusted CA bundle.",{"type":42,"tag":86,"props":4734,"children":4735},{},[4736,4741],{"type":42,"tag":76,"props":4737,"children":4738},{},[4739],{"type":48,"value":4740},"Encryption at Rest:",{"type":48,"value":4742}," Aurora DSQL encrypts all data at rest using AWS-managed keys by default. No additional configuration is required; verify encryption status in cluster properties when compliance frameworks require attestation.",{"type":42,"tag":86,"props":4744,"children":4745},{},[4746,4751,4753,4757],{"type":42,"tag":76,"props":4747,"children":4748},{},[4749],{"type":48,"value":4750},"Audit Logging via CloudTrail:",{"type":48,"value":4752}," Enable CloudTrail logging for DSQL API calls to monitor token generation patterns, cluster configuration changes, and failed authentication attempts. Configure CloudWatch alarms for suspicious activity. Enable encryption on CloudWatch Log Groups used for DSQL monitoring using a KMS key to protect potentially sensitive query metadata. See ",{"type":42,"tag":99,"props":4754,"children":4755},{"href":741},[4756],{"type":48,"value":4659},{"type":48,"value":509},{"type":42,"tag":86,"props":4759,"children":4760},{},[4761,4766,4768,4772,4774,4779],{"type":42,"tag":76,"props":4762,"children":4763},{},[4764],{"type":48,"value":4765},"Write Paths Demand Strict Validation:",{"type":48,"value":4767}," Mutating SQL (UPDATE, DELETE, DDL) issued from scripts, cron jobs, or admin tools is the highest-stakes injection surface. Every write path ",{"type":42,"tag":76,"props":4769,"children":4770},{},[4771],{"type":48,"value":532},{"type":48,"value":4773}," route through ",{"type":42,"tag":64,"props":4775,"children":4777},{"className":4776},[],[4778],{"type":48,"value":3001},{"type":48,"value":4780}," (or the driver's native parameter binding when using a Postgres driver in application code).",{"type":42,"tag":86,"props":4782,"children":4783},{},[4784,4789,4790,4795,4797,4801,4803,4809,4810,4816,4817,4823,4824,4830,4831,4837,4838,4844,4846,4851,4853,4857],{"type":42,"tag":76,"props":4785,"children":4786},{},[4787],{"type":48,"value":4788},"Input Validation Is the Primary Defense:",{"type":48,"value":224},{"type":42,"tag":64,"props":4791,"children":4793},{"className":4792},[],[4794],{"type":48,"value":3001},{"type":48,"value":4796}," is the primary defense against SQL injection on raw-SQL paths. Every value from untrusted input — tenant IDs, entity IDs, sort columns, free text — ",{"type":42,"tag":76,"props":4798,"children":4799},{},[4800],{"type":48,"value":532},{"type":48,"value":4802}," pass through a validator (",{"type":42,"tag":64,"props":4804,"children":4806},{"className":4805},[],[4807],{"type":48,"value":4808},"allow",{"type":48,"value":363},{"type":42,"tag":64,"props":4811,"children":4813},{"className":4812},[],[4814],{"type":48,"value":4815},"regex",{"type":48,"value":363},{"type":42,"tag":64,"props":4818,"children":4820},{"className":4819},[],[4821],{"type":48,"value":4822},"ident",{"type":48,"value":363},{"type":42,"tag":64,"props":4825,"children":4827},{"className":4826},[],[4828],{"type":48,"value":4829},"keyword",{"type":48,"value":363},{"type":42,"tag":64,"props":4832,"children":4834},{"className":4833},[],[4835],{"type":48,"value":4836},"integer",{"type":48,"value":363},{"type":42,"tag":64,"props":4839,"children":4841},{"className":4840},[],[4842],{"type":48,"value":4843},"literal",{"type":48,"value":4845},"). Do not use f-strings, ",{"type":42,"tag":64,"props":4847,"children":4849},{"className":4848},[],[4850],{"type":48,"value":3475},{"type":48,"value":4852},", or concatenation. See ",{"type":42,"tag":99,"props":4854,"children":4855},{"href":289},[4856],{"type":48,"value":3087},{"type":48,"value":509},{"type":42,"tag":86,"props":4859,"children":4860},{},[4861,4866,4868,4873,4874,4878,4880,4884,4886,4891,4893,4898,4900,4904],{"type":42,"tag":76,"props":4862,"children":4863},{},[4864],{"type":48,"value":4865},"Multi-Tenant Isolation as a Hard Contract:",{"type":48,"value":4867}," When the workload uses tenant scoping (Workflow 4), ",{"type":42,"tag":64,"props":4869,"children":4871},{"className":4870},[],[4872],{"type":48,"value":130},{"type":48,"value":224},{"type":42,"tag":76,"props":4875,"children":4876},{},[4877],{"type":48,"value":532},{"type":48,"value":4879}," appear in the WHERE clause of every read and write touching tenant-owned tables, and the application ",{"type":42,"tag":76,"props":4881,"children":4882},{},[4883],{"type":48,"value":532},{"type":48,"value":4885}," authorize the caller against that ",{"type":42,"tag":64,"props":4887,"children":4889},{"className":4888},[],[4890],{"type":48,"value":130},{"type":48,"value":4892}," before issuing the query — format validation alone does not establish authorization. Omitting ",{"type":42,"tag":64,"props":4894,"children":4896},{"className":4895},[],[4897],{"type":48,"value":130},{"type":48,"value":4899}," from a WHERE clause, or scoping to a tenant value the caller has not been authorized for, is a cross-tenant data exposure. This boundary is enforced by the skill, not by DSQL — verify every data-access path scopes to the authenticated tenant before deployment. See ",{"type":42,"tag":99,"props":4901,"children":4902},{"href":702},[4903],{"type":48,"value":705},{"type":48,"value":4905}," and Workflow 4.",{"type":42,"tag":183,"props":4907,"children":4908},{},[],{"type":42,"tag":51,"props":4910,"children":4912},{"id":4911},"troubleshooting",[4913],{"type":48,"value":4914},"Troubleshooting",{"type":42,"tag":82,"props":4916,"children":4917},{},[4918,4934,4949,4965],{"type":42,"tag":86,"props":4919,"children":4920},{},[4921,4926,4928,4933],{"type":42,"tag":76,"props":4922,"children":4923},{},[4924],{"type":48,"value":4925},"AWS MCP Server returns no results:",{"type":48,"value":4927}," Use the default limits in the table above and note that limits should be verified against ",{"type":42,"tag":99,"props":4929,"children":4931},{"href":1622,"rel":4930},[167],[4932],{"type":48,"value":1626},{"type":48,"value":509},{"type":42,"tag":86,"props":4935,"children":4936},{},[4937,4942,4944,4948],{"type":42,"tag":76,"props":4938,"children":4939},{},[4940],{"type":48,"value":4941},"OCC serialization error:",{"type":48,"value":4943}," Retry the transaction. If persistent, check for hot-key contention — see ",{"type":42,"tag":99,"props":4945,"children":4946},{"href":652},[4947],{"type":48,"value":655},{"type":48,"value":509},{"type":42,"tag":86,"props":4950,"children":4951},{},[4952,4957,4959,4964],{"type":42,"tag":76,"props":4953,"children":4954},{},[4955],{"type":48,"value":4956},"Transaction exceeds limits:",{"type":48,"value":4958}," Split into batches under 3,000 rows — see ",{"type":42,"tag":99,"props":4960,"children":4961},{"href":968},[4962],{"type":48,"value":4963},"batched-migration.md",{"type":48,"value":509},{"type":42,"tag":86,"props":4966,"children":4967},{},[4968,4973,4975,4979,4981,4985],{"type":42,"tag":76,"props":4969,"children":4970},{},[4971],{"type":48,"value":4972},"IAM auth token expiration mid-operation:",{"type":48,"value":4974}," Generate a fresh IAM auth token — see ",{"type":42,"tag":99,"props":4976,"children":4977},{"href":741},[4978],{"type":48,"value":4659},{"type":48,"value":4980},". See ",{"type":42,"tag":99,"props":4982,"children":4983},{"href":652},[4984],{"type":48,"value":655},{"type":48,"value":4986}," for other issues.",{"type":42,"tag":183,"props":4988,"children":4989},{},[],{"type":42,"tag":51,"props":4991,"children":4993},{"id":4992},"additional-resources",[4994],{"type":48,"value":4995},"Additional Resources",{"type":42,"tag":82,"props":4997,"children":4998},{},[4999,5008,5017,5027],{"type":42,"tag":86,"props":5000,"children":5001},{},[5002],{"type":42,"tag":99,"props":5003,"children":5005},{"href":1622,"rel":5004},[167],[5006],{"type":48,"value":5007},"Aurora DSQL Documentation",{"type":42,"tag":86,"props":5009,"children":5010},{},[5011],{"type":42,"tag":99,"props":5012,"children":5014},{"href":165,"rel":5013},[167],[5015],{"type":48,"value":5016},"DSQL Connectors, Drivers, and ORM Samples (official)",{"type":42,"tag":86,"props":5018,"children":5019},{},[5020],{"type":42,"tag":99,"props":5021,"children":5024},{"href":5022,"rel":5023},"https:\u002F\u002Fdocs.aws.amazon.com\u002Faurora-dsql\u002Flatest\u002Fuserguide\u002Fworking-with-postgresql-compatibility.html",[167],[5025],{"type":48,"value":5026},"PostgreSQL Compatibility",{"type":42,"tag":86,"props":5028,"children":5029},{},[5030],{"type":42,"tag":99,"props":5031,"children":5034},{"href":5032,"rel":5033},"https:\u002F\u002Fdocs.aws.amazon.com\u002FAWSCloudFormation\u002Flatest\u002FUserGuide\u002Faws-resource-dsql-cluster.html",[167],[5035],{"type":48,"value":5036},"CloudFormation Resource",{"type":42,"tag":51,"props":5038,"children":5040},{"id":5039},"handoff-from-aws-database-selection",[5041],{"type":48,"value":5042},"Handoff from aws-database-selection",{"type":42,"tag":58,"props":5044,"children":5045},{},[5046,5048,5054,5056,5062,5064,5070,5072,5078],{"type":48,"value":5047},"This skill can be invoked directly, or it can be entered from the ",{"type":42,"tag":64,"props":5049,"children":5051},{"className":5050},[],[5052],{"type":48,"value":5053},"aws-database-selection",{"type":48,"value":5055}," parent skill after that skill has run a requirements interview and produced a ",{"type":42,"tag":64,"props":5057,"children":5059},{"className":5058},[],[5060],{"type":48,"value":5061},"requirements.json",{"type":48,"value":5063}," artifact. When you see a backtick-wrapped path matching ",{"type":42,"tag":64,"props":5065,"children":5067},{"className":5066},[],[5068],{"type":48,"value":5069},"aws_dbs_requirements\u002F*\u002Frequirements.json",{"type":48,"value":5071}," in recent conversation, follow the entry protocol in ",{"type":42,"tag":64,"props":5073,"children":5075},{"className":5074},[],[5076],{"type":48,"value":5077},"aws-database-selection\u002Freferences\u002Fhandoff-contract.md",{"type":48,"value":2213},{"type":42,"tag":3011,"props":5080,"children":5081},{},[5082,5094,5107,5119,5162],{"type":42,"tag":86,"props":5083,"children":5084},{},[5085,5087,5093],{"type":48,"value":5086},"Read the artifact using ",{"type":42,"tag":64,"props":5088,"children":5090},{"className":5089},[],[5091],{"type":48,"value":5092},"file_read",{"type":48,"value":509},{"type":42,"tag":86,"props":5095,"children":5096},{},[5097,5099,5105],{"type":48,"value":5098},"Validate it against ",{"type":42,"tag":64,"props":5100,"children":5102},{"className":5101},[],[5103],{"type":48,"value":5104},"aws-database-selection\u002Freferences\u002Fworkload-primary-artifact.schema.json",{"type":48,"value":5106},". If malformed or unreadable, tell the user and proceed without it.",{"type":42,"tag":86,"props":5108,"children":5109},{},[5110,5112,5117],{"type":48,"value":5111},"Acknowledge what's relevant in one or two ",{"type":42,"tag":76,"props":5113,"children":5114},{},[5115],{"type":48,"value":5116},"bold",{"type":48,"value":5118}," sentences, citing high-level facts from the artifact (dominant shapes, hard constraints, migration context) — do not parrot the entire artifact back.",{"type":42,"tag":86,"props":5120,"children":5121},{},[5122,5124,5130,5131,5137,5139,5145,5147,5153,5155,5160],{"type":48,"value":5123},"Scope-check: this skill is scoped to Aurora DSQL schema, query plans, IAM auth, multi-tenant patterns, MySQL-to-DSQL migration. If the artifact's ",{"type":42,"tag":64,"props":5125,"children":5127},{"className":5126},[],[5128],{"type":48,"value":5129},"workload_primaries.dominant_shapes",{"type":48,"value":2878},{"type":42,"tag":64,"props":5132,"children":5134},{"className":5133},[],[5135],{"type":48,"value":5136},"migration_context",{"type":48,"value":5138}," don't match that scope, emit weak backpressure per the handoff contract: suggest ",{"type":42,"tag":64,"props":5140,"children":5142},{"className":5141},[],[5143],{"type":48,"value":5144},"amazon-aurora",{"type":48,"value":5146}," for Aurora PostgreSQL \u002F MySQL, ",{"type":42,"tag":64,"props":5148,"children":5150},{"className":5149},[],[5151],{"type":48,"value":5152},"rds-oss",{"type":48,"value":5154}," for RDS engines, or go back to ",{"type":42,"tag":64,"props":5156,"children":5158},{"className":5157},[],[5159],{"type":48,"value":5053},{"type":48,"value":5161}," if multi-region strong SQL consistency isn't required, then ask the user whether to go back or proceed anyway. Do not silently misuse the artifact.",{"type":42,"tag":86,"props":5163,"children":5164},{},[5165],{"type":48,"value":5166},"Proceed with this skill's native workflow, citing artifact paths as evidence when recommendations are grounded in the requirements.",{"type":42,"tag":58,"props":5168,"children":5169},{},[5170],{"type":48,"value":5171},"All user-facing output from this skill follows the markdown-primitives-only formatting convention in the handoff contract: bold labels, backticks for paths and enum values, bullet lists for alternatives, no ASCII art or box-drawing characters.",{"type":42,"tag":5173,"props":5174,"children":5175},"style",{},[5176],{"type":48,"value":5177},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":5179,"total":5282},[5180,5197,5212,5227,5242,5252,5266],{"slug":5181,"name":5181,"fn":5182,"description":5183,"org":5184,"tags":5185,"stars":24,"repoUrl":25,"updatedAt":5196},"agents-build","add capabilities to existing agent projects","Use when adding capabilities to an existing agent project — memory, app integration, VPC, multi-agent, migration, model changes, browser, code interpreter, or resource removal. Triggers on: \"add memory\", \"remember across sessions\", \"call agent from app\", \"invoke agent from code\", \"auth to call agent\", \"streaming responses\", \"VPC\", \"VPC connectivity\", \"VPC error\", \"can't reach from VPC\", \"multi-agent\", \"A2A\", \"A2A auth\", \"orchestrator not delegating\", \"specialist not called\", \"migrate Bedrock Agent\", \"after import\", \"migration issue\", \"framework for migration\", \"change model\", \"browser tool\", \"code interpreter\", \"delete agent\", \"tear down\", \"agentcore remove\", \"cross-account memory\", \"resource-based policy on memory\", \"pay for x402 content\", \"402 Payment Required\", \"microtransactions\", \"paid API or tool\". Not for connecting to external APIs via Gateway — use agents-connect. Not for scaffolding a new project — use agents-get-started. Not for CLI\u002Fdev server errors — use agents-debug. Strands vs LangGraph in a migration context routes here.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5186,5189,5192,5193],{"name":5187,"slug":5188,"type":15},"Agents","agents",{"name":5190,"slug":5191,"type":15},"Automation","automation",{"name":23,"slug":8,"type":15},{"name":5194,"slug":5195,"type":15},"Engineering","engineering","2026-07-12T08:42:53.812877",{"slug":5198,"name":5198,"fn":5199,"description":5200,"org":5201,"tags":5202,"stars":24,"repoUrl":25,"updatedAt":5211},"agents-connect","connect agents to external services","Use when connecting your agent to external APIs, tools, or services via Gateway, or restricting tool access with Cedar policies. Handles gateway setup, target types, outbound auth (OAuth, API key, IAM), credentials, and Cedar policy authoring. Triggers on: \"connect to API\", \"add gateway\", \"connect to MCP server\", \"Lambda tools\", \"OpenAPI\", \"gateway target\", \"Cedar policy\", \"restrict tools\", \"policy engine\", \"gateway auth error\", \"store API key\", \"outbound credential\", \"env var API key\", \"API key None after deploy\", \"credential not available after deploy\", \"should this be a gateway target\", \"give my agent tools\", \"add tools to agent\". Not for inbound auth (who can call your agent) — use agents-harden. Not for debugging agent behavior — use agents-debug. Not for VPC networking errors (agent can't reach APIs due to VPC) — use agents-build. Not for creating or hosting a new MCP server project — use agents-get-started.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5203,5204,5207,5210],{"name":5187,"slug":5188,"type":15},{"name":5205,"slug":5206,"type":15},"API Development","api-development",{"name":5208,"slug":5209,"type":15},"Authentication","authentication",{"name":23,"slug":8,"type":15},"2026-07-16T06:00:38.866147",{"slug":5213,"name":5213,"fn":5214,"description":5215,"org":5216,"tags":5217,"stars":24,"repoUrl":25,"updatedAt":5226},"agents-debug","debug agent and environment issues","Use when your agent or environment is broken — wrong answers, errors, timeouts, tool failures, or CLI issues. Reads traces and logs to diagnose root causes. Also checks prerequisites when the CLI itself isn't working. Triggers on: \"agent not working\", \"wrong answer\", \"agent error\", \"tool call failing\", \"debug agent\", \"check logs\", \"read traces\", \"broken\", \"500 error\", \"424 error\", \"model access denied\", \"command not found\", \"stuck in DELETING\", \"maxVms exceeded\", \"cold start diagnosis\", \"cold start slow\", \"agentcore create error\", \"create failed\", \"exit code 7\", \"connection refused local dev\". Not for deploy failures — use agents-deploy. Not for performance tuning without errors — use agents-optimize. Not for VPC configuration — use agents-build. Not for observability setup or missing logs — use agents-optimize.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5218,5219,5220,5223],{"name":5187,"slug":5188,"type":15},{"name":23,"slug":8,"type":15},{"name":5221,"slug":5222,"type":15},"Debugging","debugging",{"name":5224,"slug":5225,"type":15},"Observability","observability","2026-07-16T06:00:44.679093",{"slug":5228,"name":5228,"fn":5229,"description":5230,"org":5231,"tags":5232,"stars":24,"repoUrl":25,"updatedAt":5241},"agents-deploy","deploy AI agents to AWS","Use when deploying your agent to AWS, or when a deploy has failed. Handles pre-flight validation, CDK\u002FIAM\u002Fquota error diagnosis, version management, rollback, and canary deployments. Triggers on: \"deploy my agent\", \"agentcore deploy\", \"deploy failed\", \"CDK error\", \"rollback\", \"canary deploy\", \"pin version\", \"redeploy\", \"deploy stuck\". Not for production hardening — use agents-harden. Not for adding capabilities before deploy — use agents-build or agents-connect. Not for VPC configuration errors — use agents-build.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5233,5234,5235,5238],{"name":5187,"slug":5188,"type":15},{"name":23,"slug":8,"type":15},{"name":5236,"slug":5237,"type":15},"CI\u002FCD","ci-cd",{"name":5239,"slug":5240,"type":15},"Deployment","deployment","2026-07-12T08:42:55.059577",{"slug":5243,"name":5243,"fn":5244,"description":5245,"org":5246,"tags":5247,"stars":24,"repoUrl":25,"updatedAt":5251},"agents-get-started","scaffold and deploy new agent projects","Use when a developer wants to create a new agent project or get started with AgentCore. Handles framework selection, project scaffolding, first deploy, and first invocation. Triggers on: \"build an agent\", \"create an agent\", \"get started\", \"new project\", \"agentcore create\", \"which framework\", \"Strands vs LangGraph\", \"hello world agent\", \"first agent\", \"create MCP server\", \"host MCP server\", \"agentcore dev\", \"dev server\", \"what port\", \"local development\". Not for adding capabilities to existing projects — use agents-build or agents-connect. Strands vs LangGraph in a migration context routes to agents-build, not here. Connecting to an existing MCP server routes to agents-connect, not here.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5248,5249,5250],{"name":5187,"slug":5188,"type":15},{"name":23,"slug":8,"type":15},{"name":5239,"slug":5240,"type":15},"2026-07-12T08:42:51.963247",{"slug":5253,"name":5253,"fn":5254,"description":5255,"org":5256,"tags":5257,"stars":24,"repoUrl":25,"updatedAt":5265},"agents-harden","harden agents for production","Use when preparing your agent for production — IAM scoping, inbound auth (JWT, SigV4), secrets management, cold start optimization, session lifecycle, rate limiting, input validation, and quota guidance. Triggers on: \"production checklist\", \"harden agent\", \"production ready\", \"secure agent\", \"inbound auth\", \"going live\", \"cold start optimization\", \"session lifecycle\", \"StopRuntimeSession\", \"quota\", \"throttling\", \"maxVms\", \"rate limit\", \"security audit of outbound API calls\", \"gateway target audit for production\", \"restrict who can call\", \"lock down endpoint\", \"only our app can call\". Not for Cedar tool-restriction policies — use agents-connect. Not for quality measurement — use agents-optimize. Not for outbound credential storage or API key wiring — use agents-connect. Not for A2A agent-to-agent auth — use agents-build. Cold start observation and diagnosis (not optimization) routes to agents-debug.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5258,5259,5260,5262],{"name":5187,"slug":5188,"type":15},{"name":23,"slug":8,"type":15},{"name":229,"slug":5261,"type":15},"best-practices",{"name":5263,"slug":5264,"type":15},"Security","security","2026-07-16T06:00:42.174705",{"slug":5267,"name":5267,"fn":5268,"description":5269,"org":5270,"tags":5271,"stars":24,"repoUrl":25,"updatedAt":5281},"agents-optimize","optimize agent quality and performance","Use when measuring or improving agent quality and performance — set up evaluators, online monitoring, CI\u002FCD quality gates, observability, or cost optimization. Triggers on: \"evaluate my agent\", \"add evaluator\", \"measure quality\", \"quality gate\", \"run evals\", \"agent too slow\", \"why is it slow\", \"reduce latency\", \"set up observability\", \"CloudWatch dashboard\", \"how much does my agent cost\", \"cost optimization\", \"logs not showing up\", \"logs missing\", \"spans not found\", \"eval failing\", \"eval error\", \"dev traces\", \"local traces\", \"agentcore dev traces\", \"traces to CloudWatch\". Not for debugging errors or crashes — use agents-debug. Slow but correct routes here; broken routes to debug.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5272,5273,5274,5277,5278],{"name":5187,"slug":5188,"type":15},{"name":23,"slug":8,"type":15},{"name":5275,"slug":5276,"type":15},"Evals","evals",{"name":5224,"slug":5225,"type":15},{"name":5279,"slug":5280,"type":15},"Performance","performance","2026-07-12T08:42:56.488105",114,{"items":5284,"total":5397},[5285,5292,5299,5306,5313,5319,5326,5334,5347,5360,5372,5387],{"slug":5181,"name":5181,"fn":5182,"description":5183,"org":5286,"tags":5287,"stars":24,"repoUrl":25,"updatedAt":5196},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5288,5289,5290,5291],{"name":5187,"slug":5188,"type":15},{"name":5190,"slug":5191,"type":15},{"name":23,"slug":8,"type":15},{"name":5194,"slug":5195,"type":15},{"slug":5198,"name":5198,"fn":5199,"description":5200,"org":5293,"tags":5294,"stars":24,"repoUrl":25,"updatedAt":5211},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5295,5296,5297,5298],{"name":5187,"slug":5188,"type":15},{"name":5205,"slug":5206,"type":15},{"name":5208,"slug":5209,"type":15},{"name":23,"slug":8,"type":15},{"slug":5213,"name":5213,"fn":5214,"description":5215,"org":5300,"tags":5301,"stars":24,"repoUrl":25,"updatedAt":5226},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5302,5303,5304,5305],{"name":5187,"slug":5188,"type":15},{"name":23,"slug":8,"type":15},{"name":5221,"slug":5222,"type":15},{"name":5224,"slug":5225,"type":15},{"slug":5228,"name":5228,"fn":5229,"description":5230,"org":5307,"tags":5308,"stars":24,"repoUrl":25,"updatedAt":5241},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5309,5310,5311,5312],{"name":5187,"slug":5188,"type":15},{"name":23,"slug":8,"type":15},{"name":5236,"slug":5237,"type":15},{"name":5239,"slug":5240,"type":15},{"slug":5243,"name":5243,"fn":5244,"description":5245,"org":5314,"tags":5315,"stars":24,"repoUrl":25,"updatedAt":5251},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5316,5317,5318],{"name":5187,"slug":5188,"type":15},{"name":23,"slug":8,"type":15},{"name":5239,"slug":5240,"type":15},{"slug":5253,"name":5253,"fn":5254,"description":5255,"org":5320,"tags":5321,"stars":24,"repoUrl":25,"updatedAt":5265},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5322,5323,5324,5325],{"name":5187,"slug":5188,"type":15},{"name":23,"slug":8,"type":15},{"name":229,"slug":5261,"type":15},{"name":5263,"slug":5264,"type":15},{"slug":5267,"name":5267,"fn":5268,"description":5269,"org":5327,"tags":5328,"stars":24,"repoUrl":25,"updatedAt":5281},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5329,5330,5331,5332,5333],{"name":5187,"slug":5188,"type":15},{"name":23,"slug":8,"type":15},{"name":5275,"slug":5276,"type":15},{"name":5224,"slug":5225,"type":15},{"name":5279,"slug":5280,"type":15},{"slug":5335,"name":5335,"fn":5336,"description":5337,"org":5338,"tags":5339,"stars":24,"repoUrl":25,"updatedAt":5346},"amazon-aurora-mysql","manage Amazon Aurora MySQL clusters","Amazon Aurora MySQL — creates, modifies, and advises on Aurora MySQL clusters specifically (MySQL-compatible engine, Aurora serverless, parallel query). Trigger for Aurora MySQL cluster operations, ACU sizing, I\u002FO-Optimized storage, commitment pricing, or MySQL upgrade planning. Aurora MySQL uses full (VPC-based) configuration — express configuration is PostgreSQL-only. For Aurora PostgreSQL, use amazon-aurora-postgresql instead. Contains safety guardrails and response templates that override defaults.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5340,5341,5342,5345],{"name":23,"slug":8,"type":15},{"name":13,"slug":14,"type":15},{"name":5343,"slug":5344,"type":15},"MySQL","mysql",{"name":20,"slug":21,"type":15},"2026-07-12T08:43:13.27939",{"slug":5348,"name":5348,"fn":5349,"description":5350,"org":5351,"tags":5352,"stars":24,"repoUrl":25,"updatedAt":5359},"amazon-aurora-postgresql","configure Amazon Aurora PostgreSQL clusters","Amazon Aurora PostgreSQL — creates, modifies, and advises on Aurora PostgreSQL clusters specifically (PostgreSQL-compatible engine, Aurora serverless, express configuration, pgvector, Babelfish). Trigger for Aurora PostgreSQL cluster operations, express-configuration quick-start, ACU sizing, I\u002FO-Optimized storage, commitment pricing, or PostgreSQL upgrade planning. For Aurora MySQL, use amazon-aurora-mysql instead. Contains safety guardrails, express-first routing, and response templates that override defaults.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5353,5354,5355,5358],{"name":23,"slug":8,"type":15},{"name":13,"slug":14,"type":15},{"name":5356,"slug":5357,"type":15},"PostgreSQL","postgresql",{"name":20,"slug":21,"type":15},"2026-07-16T06:00:34.789624",{"slug":5361,"name":5361,"fn":5362,"description":5363,"org":5364,"tags":5365,"stars":24,"repoUrl":25,"updatedAt":5371},"amazon-bedrock","build generative AI apps with Amazon Bedrock","Builds generative AI applications on Amazon Bedrock. Covers model invocation (Converse API, InvokeModel), RAG with Knowledge Bases, Bedrock Agents, Guardrails, and AgentCore. Use when invoking models, setting up Knowledge Bases, creating agents, applying guardrails, deploying to AgentCore, migrating\u002Fporting\u002Fconverting a Bedrock Agent (including inline agents) to an AgentCore Harness, troubleshooting Bedrock errors (ThrottlingException, AccessDeniedException), or choosing models (Claude, Llama, Nova, Titan). ALSO USE for prompt caching setup and debugging, quota health checks and throttling diagnosis, cost attribution and tracking, migrating between Claude model generations (4.5 to 4.6 to 4.7), chunking strategies, API selection (Converse vs InvokeModel), guardrail capabilities, and model selection. Also covers AgentCore Payments setup (x402, microtransactions, Payment Manager, Connector, Instrument, Coinbase CDP, Stripe Privy, 402 Payment Required, pay for content, paid endpoint, agent payments). NOT for custom model training, Rekognition, or Comprehend.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5366,5367,5368],{"name":5187,"slug":5188,"type":15},{"name":23,"slug":8,"type":15},{"name":5369,"slug":5370,"type":15},"LLM","llm","2026-07-25T05:30:35.20899",{"slug":5373,"name":5373,"fn":5374,"description":5375,"org":5376,"tags":5377,"stars":24,"repoUrl":25,"updatedAt":5386},"amazon-documentdb","manage Amazon DocumentDB clusters","Manages Amazon DocumentDB end-to-end — serverless-on-8.0 cluster setup, TLS\u002FVPC\u002Fdriver config, flexible-schema and vector-search data modeling, MongoDB compatibility assessment, DMS-based migration, slow-query diagnosis, major version upgrades (4.0→5.0→8.0), Well-Architected reviews (41-check wa_review.py), cost estimation, and security hardening. Retrieve for every DocumentDB question and when the user asks to set up or migrate MongoDB to AWS — DocumentDB is AWS's MongoDB-compatible managed database. Triggers: JSON document store, document database, MongoDB on AWS, Nested fields, Lambda cannot connect, TLS handshake, VPC port 27017, IAM auth, Secrets Manager, encryption at rest, $graphLookup, flexible schema, COLLSCAN, compound index, DMS migration, CDC cutover, $vectorSearch, RAG, Global Clusters, DR replication, cost sizing, audit, health check, production-readiness.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5378,5379,5380,5383],{"name":23,"slug":8,"type":15},{"name":13,"slug":14,"type":15},{"name":5381,"slug":5382,"type":15},"MongoDB","mongodb",{"name":5384,"slug":5385,"type":15},"NoSQL","nosql","2026-07-12T08:43:00.455878",{"slug":5388,"name":5388,"fn":5389,"description":5390,"org":5391,"tags":5392,"stars":24,"repoUrl":25,"updatedAt":5396},"amazon-dynamodb","design and debug DynamoDB data layers","Designs, reviews, and debugs DynamoDB data layers from design axioms — enumerates access patterns, chooses partition\u002Fsort keys and GSIs, decides single-table vs. multi-table, configures Streams, Global Tables, TTL, and zero-ETL integrations to OpenSearch\u002FRedshift\u002FSageMaker Lakehouse, and produces a defensible data-layer design with a monthly cost estimate and optional live validation. Applies whenever a user is designing, reviewing, or refactoring anything backed by DynamoDB — schemas, access patterns, GSIs, single- vs. multi-table choices, Streams consumers, transactional outboxes, Global Tables, zero-ETL pipelines — even when they don't say \"axioms\" or \"design review.\" Also applies when debugging hot partitions, throttling, unbounded Scans, LWW conflicts, or surprise bills on DynamoDB workloads.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5393,5394,5395],{"name":23,"slug":8,"type":15},{"name":13,"slug":14,"type":15},{"name":5384,"slug":5385,"type":15},"2026-07-16T06:00:37.690386",115]