chore: get rid of esbuild and pg-format

[pascal-botpress]

This is a follow-up to #17.

We're already bundling the lambda with tsdown, so it makes little sense to bundle it a second time (NodejsFunction calls esbuild and re-bundles the code) and depend on esbuild when we could just get rid of it entirely.

This PR also removes pg-format, since it's abandoned.

---

This PR of the stack is optional and can be discarded if we want to keep the dependency on esbuild and pg-format

Contributes to KKN-927

[Copilot]

Pull request overview

This PR removes the esbuild and pg-format dependencies by (1) shipping the Lambda as a pre-bundled asset built by tsdown, and (2) replacing pg-format usage with pg’s escaping helpers / parameterized queries, so consumers don’t need extra bundling tooling at synth time.

Changes:

• Switch CDK provider from aws-lambda-nodejs NodejsFunction (esbuild) to aws-lambda Function using Code.fromAsset.
• Remove pg-format (and its types) and update SQL construction accordingly.
• Add an integration test that exercises the built Lambda artifact and ensure integration tests run after building.

Reviewed changes

Copilot reviewed 8 out of 9 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
pnpm-lock.yaml	Removes esbuild devDependency and pg-format (+ types) entries from the lockfile.
package.json	Removes root esbuild devDependency.
cdk-postgresql/tsdown.config.ts	Produces a dedicated CommonJS Lambda bundle under dist/lambda and forces bundling of required runtime deps.
cdk-postgresql/test/lambda.integration.test.ts	Adds an integration test that loads and runs the built Lambda bundle from dist/lambda.
cdk-postgresql/package.json	Ensures integration tests run after building so the built asset exists.
cdk-postgresql/lib/role.handler.ts	Replaces pg-format usage with pg escaping helpers and adds a Secrets Manager SecretString presence check.
cdk-postgresql/lib/provider.ts	Replaces NodejsFunction with Function + Code.fromAsset to avoid synth-time bundling.
cdk-postgresql/lib/postgres.ts	Replaces pg-format usage with pg escaping helpers for role/database creation/grants.
cdk-postgresql/lib/database.handler.ts	Replaces pg-format usage with parameterized query / pg escaping helpers.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[greptile-apps]

Greptile Summary

This PR removes the redundant esbuild and pg-format dependencies by deploying a prebuilt tsdown Lambda asset and using pg’s native SQL escaping helpers.

• Replaces NodejsFunction with a standard Lambda function backed by dist/lambda.
• Bundles the handler and its runtime dependencies through tsdown.
• Replaces pg-format calls with parameterized values and escaped identifiers/literals.
• Adds integration coverage that loads and executes the generated Lambda artifact.

Confidence Score: 5/5

The PR appears safe to merge, with no concrete changed-code failure identified.

The provider and build configuration agree on the generated handler path and export, runtime dependencies are explicitly bundled, SQL interpolation remains safely escaped or parameterized, and the built asset receives integration coverage.

Important Files Changed

Filename	Overview
cdk-postgresql/lib/provider.ts	Replaces synthesis-time NodejsFunction bundling with deployment of the prebuilt dist/lambda asset.
cdk-postgresql/tsdown.config.ts	Adds a dedicated Node.js CJS Lambda bundle and explicitly includes all declared runtime dependencies.
cdk-postgresql/lib/postgres.ts	Replaces pg-format with native identifier and literal escaping while validating the connection user before issuing grants.
cdk-postgresql/lib/database.handler.ts	Parameterizes the database-name value query and safely escapes identifiers in database DDL.
cdk-postgresql/lib/role.handler.ts	Uses native PostgreSQL escaping for role DDL and rejects absent password secret values.
cdk-postgresql/test/lambda.integration.test.ts	Adds an end-to-end check that loads the generated CommonJS artifact and creates a usable PostgreSQL role.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  A[lib/handler.ts] --> B[tsdown build]
  B --> C[dist/lambda/index.cjs]
  C --> D[Code.fromAsset]
  D --> E[AWS Lambda index.handler]
  E --> F[PostgreSQL and Secrets Manager]

Loading

_{Reviews (1): Last reviewed commit: "chore: get rid of esbuild and pg-format" | Re-trigger Greptile}

[linear-code]

KKN-927