@aws-blocks/core 0.1.0

package/LICENSE

@@ -0,0 +1,174 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.

package/dist/api.d.ts

@@ -0,0 +1,147 @@
+export type BlocksContext = {
+    request: {
+        headers: Headers;
+        body: ReadableStream<Uint8Array> | null;
+        json: () => Promise<any>;
+        text: () => Promise<string>;
+        /**
+         * Absolute URL of the incoming request. Built from the request's `host`
+         * header plus the path + query string. Useful for RawRoute handlers
+         * that need query-string parsing or must echo the request URL back
+         * (e.g., building OIDC redirect URIs).
+         *
+         * In dev: derived from `req.url` and `req.headers.host`.
+         * In AWS: derived from `event.path`, `event.queryStringParameters`,
+         * and `event.headers.host`. May include a trusted `x-forwarded-proto`
+         * to pick http vs https.
+         */
+        url: URL;
+        /**
+         * Path parameters extracted from RawRoute patterns.
+         * Example: route `/users/{id}` with request `/users/123` → `{ id: '123' }`.
+         *
+         * Only populated for RawRoute handlers. Always `{}` for RPC API methods.
+         */
+        params: Record<string, string>;
+        /**
+         * Abort signal tied to the HTTP deadline guard.
+         *
+         * Fires when the Lambda is about to return a 504 timeout response.
+         * Pass this to `fetch()`, AWS SDK calls, or any cancellable I/O so
+         * in-flight work is cancelled rather than continuing to run (and bill)
+         * after the client has already received a timeout.
+         *
+         * `undefined` in local dev or when no deadline is configured.
+         */
+        signal?: AbortSignal;
+    };
+    response: {
+        headers: Headers;
+        status: number;
+        send: (body: any) => void;
+    };
+};
+export type ApiHandler<T extends Record<string, (...args: any[]) => any>> = (context: BlocksContext) => T;
+type AsyncAPI<T extends Record<string, (...args: any[]) => any>> = {
+    [K in keyof T]: T[K] extends (...args: infer Args) => infer R ? (...args: Args) => Promise<Awaited<R>> : never;
+};
+/** Marker symbol to identify ApiNamespace instances during discovery. */
+export declare const API_NAMESPACE_MARKER: unique symbol;
+import type { ScopeParent } from './common/index.js';
+/**
+ * Define a type-safe API namespace that works seamlessly between frontend and backend.
+ *
+ * ## Usage
+ *
+ * Define your API in the backend (`aws-blocks/index.ts`):
+ *
+ * ```typescript
+ * const scope = new Scope('my-app');
+ *
+ * export const api = new ApiNamespace(scope, 'api', (context) => ({
+ *   async greet(name: string) {
+ *     return { message: `Hello, ${name}!` };
+ *   },
+ *
+ *   async deleteAccount(id: string) {
+ *     // Gated: throws 401 if the caller has no valid session.
+ *     await auth.requireAuth(context);
+ *     return db.users.delete(id);
+ *   }
+ * }));
+ * ```
+ *
+ * Import and call from the frontend with full type safety:
+ *
+ * ```typescript
+ * import { api } from 'aws-blocks';
+ *
+ * const result = await api.greet('World'); // Fully typed
+ * ```
+ *
+ * ## Authentication — every method is a public endpoint
+ *
+ * Each method becomes a public, internet-reachable RPC endpoint with **no
+ * authentication by default**. Gating is opt-in per method by calling an auth
+ * Building Block at the top of the handler:
+ *
+ * ```typescript
+ * export const api = new ApiNamespace(scope, 'api', (context) => ({
+ *   // No requireAuth call → callable by anyone.
+ *   async listPublicPosts() {
+ *     return db.posts.findPublished();
+ *   },
+ *
+ *   async createPost(input: NewPost) {
+ *     const user = await auth.requireAuth(context);
+ *     return db.posts.create({ ...input, authorId: user.userId });
+ *   },
+ *
+ *   async deletePost(id: string) {
+ *     await auth.requireRole(context, 'admins');
+ *     return db.posts.delete(id);
+ *   },
+ * }));
+ * ```
+ *
+ * The local mock applies no auth either, so an ungated method passes every
+ * local check and still ships callable by anyone. See your auth block's README
+ * (e.g. `@aws-blocks/bb-auth-cognito`) for `requireAuth` / `requireRole`.
+ *
+ * ## Context
+ *
+ * The `context` parameter provides access to:
+ * - `context.request.headers` - Incoming request headers
+ * - `context.request.json()` - Parse request body as JSON
+ * - `context.response.headers` - Set response headers (e.g., cookies)
+ * - `context.response.status` - Set HTTP status code
+ *
+ * ## Local vs Deployed
+ *
+ * - **Local**: APIs run in-process. Calls are direct function invocations.
+ * - **Deployed**: APIs run in Lambda. Calls go through API Gateway over HTTPS.
+ *
+ * The same code works in both environments without changes.
+ *
+ * ## Scaling Characteristics (AWS)
+ *
+ * - Serverless: Auto-scales from 0 to thousands of concurrent requests
+ * - Cold starts: ~100-500ms for first request after idle period
+ * - Warm requests: Single-digit millisecond overhead
+ * - Cost: Pay per request (free tier: 1M requests/month)
+ *
+ * ## Best Practices
+ *
+ * - No auth by default — gate methods with `requireAuth`/`requireRole` (see above)
+ * - Keep API methods focused and single-purpose
+ * - Use async/await for all I/O operations
+ * - Return serializable data (JSON-compatible types)
+ * - Handle errors explicitly - they'll be sent to the client
+ * - Use Building Blocks (KVStore, DistributedTable) for state
+ */
+export interface ApiNamespaceConstructor {
+    new <T extends Record<string, (...args: any[]) => any>>(scope: ScopeParent, name: string, handler: ApiHandler<T>): AsyncAPI<T>;
+}
+export declare const ApiNamespace: ApiNamespaceConstructor;
+export {};
+//# sourceMappingURL=api.d.ts.map

package/dist/api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,aAAa,GAAG;IAC1B,OAAO,EAAE;QACP,OAAO,EAAE,OAAO,CAAC;QACjB,IAAI,EAAE,cAAc,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC;QACxC,IAAI,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5B;;;;;;;;;;WAUG;QACH,GAAG,EAAE,GAAG,CAAC;QACT;;;;;WAKG;QACH,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC/B;;;;;;;;;WASG;QACH,MAAM,CAAC,EAAE,WAAW,CAAC;KACtB,CAAC;IACF,QAAQ,EAAE;QACR,OAAO,EAAE,OAAO,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,CAAC,IAAI,EAAE,GAAG,KAAK,IAAI,CAAC;KAC3B,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,UAAU,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,KAAK,CAAC,CAAC;AAG1G,KAAK,QAAQ,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAC,IAAI;KAChE,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,MAAM,IAAI,KAAK,MAAM,CAAC,GACzD,CAAC,GAAG,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GACtC,KAAK;CACV,CAAC;AAEF,yEAAyE;AACzE,eAAO,MAAM,oBAAoB,eAAoC,CAAC;AAEtE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0FG;AACH,MAAM,WAAW,uBAAuB;IACtC,KAAK,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;CAChI;AAED,eAAO,MAAM,YAAY,EAAE,uBAKnB,CAAC"}

package/dist/api.js

@@ -0,0 +1,10 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+/** Marker symbol to identify ApiNamespace instances during discovery. */
+export const API_NAMESPACE_MARKER = Symbol.for('blocks:ApiNamespace');
+export const ApiNamespace = class ApiNamespace {
+    constructor(scope, name, handler) {
+        handler[API_NAMESPACE_MARKER] = name;
+        return handler;
+    }
+};

package/dist/api.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=api.test.d.ts.map

package/dist/api.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.test.d.ts","sourceRoot":"","sources":["../src/api.test.ts"],"names":[],"mappings":""}

package/dist/api.test.js

@@ -0,0 +1,19 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+import { test } from 'node:test';
+import assert from 'node:assert';
+import { ApiNamespace, API_NAMESPACE_MARKER } from './api.js';
+import { Scope } from './common/index.js';
+const scope = new Scope('test');
+test('ApiNamespace stores name via marker symbol', () => {
+    const api1 = new ApiNamespace(scope, 'myapi', (ctx) => ({
+        test: () => 'hello'
+    }));
+    assert.strictEqual(api1[API_NAMESPACE_MARKER], 'myapi');
+});
+test('Different ApiNamespace names should not collide', () => {
+    const api1 = new ApiNamespace(scope, 'api1', (ctx) => ({ test: () => 'a' }));
+    const api2 = new ApiNamespace(scope, 'api2', (ctx) => ({ test: () => 'b' }));
+    assert.strictEqual(api1[API_NAMESPACE_MARKER], 'api1');
+    assert.strictEqual(api2[API_NAMESPACE_MARKER], 'api2');
+});

package/dist/bb-utils.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Utilities for Building Block authors.
+ *
+ * Used by standard BBs and available to customers writing custom Building Blocks.
+ * Not part of the main '.' export — import from '@aws-blocks/core/bb-utils'.
+ */
+export { getMockDataDir } from './common/mock-data.js';
+export { API_NAMESPACE_MARKER } from './api.js';
+export { EventSourceMapping } from './lambda-handler.js';
+export { constantTimeEquals } from './common/crypto.js';
+//# sourceMappingURL=bb-utils.d.ts.map

package/dist/bb-utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bb-utils.d.ts","sourceRoot":"","sources":["../src/bb-utils.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/bb-utils.js

@@ -0,0 +1,12 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Utilities for Building Block authors.
+ *
+ * Used by standard BBs and available to customers writing custom Building Blocks.
+ * Not part of the main '.' export — import from '@aws-blocks/core/bb-utils'.
+ */
+export { getMockDataDir } from './common/mock-data.js';
+export { API_NAMESPACE_MARKER } from './api.js';
+export { EventSourceMapping } from './lambda-handler.js';
+export { constantTimeEquals } from './common/crypto.js';

package/dist/builtin-routes.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Register built-in /aws-blocks/resources and /aws-blocks/settings routes.
+ * Skips if already registered (safe to call from both CDK and dev server).
+ */
+export declare function registerBuiltinRoutes(): void;
+//# sourceMappingURL=builtin-routes.d.ts.map

package/dist/builtin-routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"builtin-routes.d.ts","sourceRoot":"","sources":["../src/builtin-routes.ts"],"names":[],"mappings":"AAcA;;;GAGG;AACH,wBAAgB,qBAAqB,IAAI,IAAI,CA2C5C"}

package/dist/builtin-routes.js

@@ -0,0 +1,57 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+import { getRegisteredRoutes, registerRoute } from './raw-route.js';
+import { exec } from 'node:child_process';
+import { join } from 'node:path';
+function openInEditor(filePath) {
+    const platform = process.platform;
+    const cmd = platform === 'darwin' ? 'open' : platform === 'win32' ? 'start ""' : 'xdg-open';
+    exec(`${cmd} "${filePath}"`);
+}
+/**
+ * Register built-in /aws-blocks/resources and /aws-blocks/settings routes.
+ * Skips if already registered (safe to call from both CDK and dev server).
+ */
+export function registerBuiltinRoutes() {
+    const routes = [
+        {
+            method: 'GET',
+            path: '/aws-blocks/resources',
+            handler: async (ctx) => {
+                const url = process.env.BB_RESOURCES_GROUP_URL;
+                if (!url) {
+                    ctx.response.status = 200;
+                    ctx.response.headers.set('Content-Type', 'text/html');
+                    ctx.response.send(`<!DOCTYPE html><html><head><title>Resources</title><style>body{font-family:system-ui,sans-serif;max-width:640px;margin:4rem auto;padding:0 1rem;color:#1a1a1a}h1{font-size:1.5rem}p{line-height:1.6}code{background:#f3f4f6;padding:2px 6px;border-radius:4px;font-size:0.9em}</style></head><body><h1>Resources</h1><p>Locally, each Building Block persists data to <code>.bb-data/</code> in your project root. Tables, buckets, queues, and other state live under <code>.bb-data/{id}/</code>.</p><p>For deployed apps, this page automatically redirects to the Resources group in the AWS console.</p></body></html>`);
+                    return;
+                }
+                ctx.response.status = 302;
+                ctx.response.headers.set('Location', url);
+                ctx.response.send('');
+            },
+        },
+        {
+            method: 'GET',
+            path: '/aws-blocks/settings',
+            handler: async (ctx) => {
+                const url = process.env.BB_SETTINGS_GROUP_URL;
+                if (!url) {
+                    const settingsPath = join(process.cwd(), '.bb-data', 'settings.json');
+                    openInEditor(settingsPath);
+                    ctx.response.status = 200;
+                    ctx.response.headers.set('Content-Type', 'text/html');
+                    ctx.response.send(`<!DOCTYPE html><html><head><title>Settings</title><style>body{font-family:system-ui,sans-serif;max-width:640px;margin:4rem auto;padding:0 1rem;color:#1a1a1a}h1{font-size:1.5rem}p{line-height:1.6}code{background:#f3f4f6;padding:2px 6px;border-radius:4px;font-size:0.9em}a{color:#0066cc}</style></head><body><h1>Settings</h1><p>Opening <code>.bb-data/settings.json</code> in your default editor.</p><p>All AppSetting values are stored as <code>{ "fullId": value }</code> entries. Edit and save -- changes take effect on the next <code>get()</code> call.</p><p>File location: <code>${settingsPath}</code></p></body></html>`);
+                    return;
+                }
+                ctx.response.status = 302;
+                ctx.response.headers.set('Location', url);
+                ctx.response.send('');
+            },
+        },
+    ];
+    for (const route of routes) {
+        if (!getRegisteredRoutes().some(r => r.method === route.method && r.path === route.path)) {
+            registerRoute(route);
+        }
+    }
+}

package/dist/cdk/__fixtures__/factory-backend.d.ts

@@ -0,0 +1,3 @@
+import { Construct } from 'constructs';
+export default function (scope: Construct): void;
+//# sourceMappingURL=factory-backend.d.ts.map

package/dist/cdk/__fixtures__/factory-backend.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"factory-backend.d.ts","sourceRoot":"","sources":["../../../src/cdk/__fixtures__/factory-backend.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvC,MAAM,CAAC,OAAO,WAAW,KAAK,EAAE,SAAS,QAExC"}

package/dist/cdk/__fixtures__/factory-backend.js

@@ -0,0 +1,6 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+import { Construct } from 'constructs';
+export default function (scope) {
+    new Construct(scope, 'FactoryMarker');
+}

package/dist/cdk/__fixtures__/fullid-construct-backend.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=fullid-construct-backend.d.ts.map

package/dist/cdk/__fixtures__/fullid-construct-backend.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fullid-construct-backend.d.ts","sourceRoot":"","sources":["../../../src/cdk/__fixtures__/fullid-construct-backend.ts"],"names":[],"mappings":""}

package/dist/cdk/__fixtures__/fullid-construct-backend.js

@@ -0,0 +1,37 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Test fixture: a child Scope that embeds its `fullId` directly into a CDK
+ * construct ID.
+ *
+ * Why this matters
+ * ----------------
+ * Building Blocks routinely use their `fullId` as part of a construct ID, e.g.
+ * a DSQL block creating its migration Lambda as
+ * `new lambda.NodejsFunction(stack, `${this.fullId}DsqlMigrationFn`, ...)`.
+ * CDK forbids unresolved tokens in construct IDs (it throws
+ * "ID components may not include unresolved tokens" at synth time).
+ *
+ * `fullId` is derived from the enclosing stack name. In a nested-stack topology
+ * (e.g. Amplify Gen2's `backend.createStack('blocks')`) that stack name is a
+ * deploy-time token, so a naive `fullId` would carry a token and break synth.
+ *
+ * This fixture reproduces that exact pattern: importing it builds a construct
+ * whose ID is `${this.fullId}Marker`. If `fullId` ever contains a token, this
+ * side-effect import throws at synth time — which is what the test asserts must
+ * NOT happen.
+ */
+import * as cdk from 'aws-cdk-lib';
+import { Scope } from '../index.js';
+class FullIdConstructBlock extends Scope {
+    constructor(scope, id) {
+        super(id, { parent: scope });
+        const stack = cdk.Stack.of(this);
+        // Use fullId as a construct ID, the same way real Building Blocks do.
+        new cdk.CfnResource(stack, `${this.fullId}Marker`, {
+            type: 'AWS::CloudFormation::WaitConditionHandle',
+        });
+    }
+}
+const parent = globalThis.CURRENT_BLOCKS_STACK;
+new FullIdConstructBlock(parent, 'db');

package/dist/cdk/__fixtures__/handler.d.ts

@@ -0,0 +1,5 @@
+export declare const handler: () => Promise<{
+    statusCode: number;
+    body: string;
+}>;
+//# sourceMappingURL=handler.d.ts.map

package/dist/cdk/__fixtures__/handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../src/cdk/__fixtures__/handler.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,OAAO;;;EAAgD,CAAC"}

package/dist/cdk/__fixtures__/handler.js

@@ -0,0 +1,3 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+export const handler = async () => ({ statusCode: 200, body: '{}' });

package/dist/cdk/__fixtures__/side-effect-backend.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=side-effect-backend.d.ts.map

package/dist/cdk/__fixtures__/side-effect-backend.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"side-effect-backend.d.ts","sourceRoot":"","sources":["../../../src/cdk/__fixtures__/side-effect-backend.ts"],"names":[],"mappings":""}

package/dist/cdk/__fixtures__/side-effect-backend.js

@@ -0,0 +1,5 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+import { Construct } from 'constructs';
+const parent = globalThis.CURRENT_BLOCKS_STACK;
+new Construct(parent, 'SideEffectMarker');

package/dist/cdk/blocks-backend.d.ts

@@ -0,0 +1,68 @@
+import * as cdk from 'aws-cdk-lib';
+import * as apigateway from 'aws-cdk-lib/aws-apigateway';
+import { Construct } from 'constructs';
+/**
+ * Validate that the Node.js process was started with `--conditions=cdk`.
+ *
+ * Without this condition, conditional exports in Building Block packages
+ * resolve to their mock/default entry points instead of the CDK entry points.
+ * This causes a silent deployment failure: CDK synth "succeeds" but produces
+ * no real infrastructure (no tables, no IAM, no Lambda configs).
+ */
+export declare function assertCdkConditionActive(): void;
+export interface BlocksBackendProps {
+    backendHandlerPath: string;
+    backendCDKPath: string;
+}
+/** Shared infra setup — creates Lambda + API Gateway on the given scope. */
+export declare function setupBlocksInfra(scope: Construct, props: BlocksBackendProps, id?: string): {
+    handler: cdk.aws_lambda_nodejs.NodejsFunction;
+    gateway: cdk.aws_apigateway.RestApi;
+    apiUrl: string;
+};
+/**
+ * Standalone CDK construct that provisions the Blocks backend: a single Lambda
+ * function fronted by API Gateway with RPC + catch-all proxy routing.
+ *
+ * Use this to embed a Blocks backend into any existing CDK stack. Building Blocks
+ * instantiated during the `backendCDKPath` import will automatically attach to
+ * this construct's Lambda handler.
+ *
+ * @example Drop into an existing stack
+ * ```ts
+ * const blocks = await BlocksBackend.create(myStack, 'Blocks', {
+ *   backendHandlerPath: join(__dirname, 'handler.ts'),
+ *   backendCDKPath: join(__dirname, 'infra.ts'),
+ * });
+ * // blocks.apiUrl, blocks.handler, blocks.gateway available
+ * ```
+ */
+export declare class BlocksBackend extends Construct {
+    readonly apiUrl: string;
+    readonly gateway: apigateway.RestApi;
+    readonly handler: cdk.aws_lambda_nodejs.NodejsFunction;
+    readonly backendHandlerPath: string;
+    /**
+     * The fullId used by child Scopes to compute their env var names,
+     * construct IDs, and physical resource names (e.g., DynamoDB table names).
+     *
+     * Includes the CDK stack name to ensure physical resources are unique
+     * per deployment. This matches what the runtime sees via BLOCKS_STACK_NAME.
+     *
+     * IMPORTANT: this value MUST be token-free. Child Scopes embed `fullId` in
+     * CDK construct IDs (e.g. `${fullId}DsqlMigrationFn`), and CDK forbids
+     * unresolved tokens in construct IDs ("ID components may not include
+     * unresolved tokens"). It is also used to build env-var keys that must match
+     * byte-for-byte between synth time and runtime.
+     *
+     * A nested stack (e.g. Amplify Gen2 `backend.createStack('blocks')`) has a
+     * tokenized `stackName` that only resolves at deploy time. We therefore walk
+     * up to the top-level stack, whose name is concrete at synth time and still
+     * unique per deployment. The `Token.isUnresolved` guard is a defensive
+     * fallback to the (token-free) construct id should no resolvable name exist.
+     */
+    get fullId(): string;
+    private constructor();
+    static create(scope: Construct, id: string, props: BlocksBackendProps): Promise<BlocksBackend>;
+}
+//# sourceMappingURL=blocks-backend.d.ts.map

package/dist/cdk/blocks-backend.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"blocks-backend.d.ts","sourceRoot":"","sources":["../../src/cdk/blocks-backend.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,GAAG,MAAM,aAAa,CAAC;AAEnC,OAAO,KAAK,UAAU,MAAM,4BAA4B,CAAC;AAEzD,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAOvC;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,IAAI,IAAI,CAkB/C;AAED,MAAM,WAAW,kBAAkB;IACjC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,4EAA4E;AAC5E,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,CAAC,EAAE,MAAM;;;;EA0GxF;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,aAAc,SAAQ,SAAS;IAC1C,SAAgB,MAAM,EAAE,MAAM,CAAC;IAC/B,SAAgB,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC;IAC5C,SAAgB,OAAO,EAAE,GAAG,CAAC,iBAAiB,CAAC,cAAc,CAAC;IAC9D,SAAgB,kBAAkB,EAAE,MAAM,CAAC;IAE3C;;;;;;;;;;;;;;;;;;OAkBG;IACH,IAAI,MAAM,IAAI,MAAM,CAUnB;IAED,OAAO;WAmBM,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB;CAmB5E"}