@aws-blocks/core 0.1.0

package/dist/scripts/dev-server.js

@@ -0,0 +1,456 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+import { createServer } from 'node:http';
+import { pathToFileURL, URL } from 'node:url';
+import { resolve, dirname, join } from 'node:path';
+import { writeFileSync, mkdirSync } from 'node:fs';
+import { spawn } from 'node:child_process';
+import { createConnection } from 'node:net';
+import httpProxy from 'http-proxy';
+import { writeClientCode } from './generate-client.js';
+import { ApiError } from '../errors.js';
+import { BLOCKS_RPC_PREFIX } from '../constants.js';
+import { matchRoute, lockRouteRegistry } from '../raw-route.js';
+import { registerBuiltinRoutes } from '../builtin-routes.js';
+import { parseRpcRequest, successResponse, errorResponseFromCatch, methodNotFoundResponse, } from '../rpc.js';
+import { redactToJson } from '../redact.js';
+import { buildAndSendEvent } from '../telemetry/client.js';
+import { applyDevMigrations } from './external-migrations-step.js';
+function toBodyStream(text) {
+    if (!text)
+        return null;
+    return new ReadableStream({
+        start(controller) {
+            controller.enqueue(new TextEncoder().encode(text));
+            controller.close();
+        },
+    });
+}
+export const LOCALHOST_PATTERN = /^https?:\/\/(localhost|127\.0\.0\.1)(:\d+)?$/;
+/**
+ * Resolve the CORS origin for the dev server.
+ * Reflects back origins matching localhost/127.0.0.1; otherwise returns the fallback.
+ */
+export function resolveDevCorsOrigin(origin) {
+    return LOCALHOST_PATTERN.test(origin) ? origin : 'http://localhost:3000';
+}
+/**
+ * Initialize all building blocks that have an initialize() method.
+ * This is the "local deploy" phase - mirrors CDK deploy.
+ */
+async function deployLocal(backend) {
+    const initPromises = [];
+    for (const [name, value] of Object.entries(backend)) {
+        if (value && typeof value.initialize === 'function') {
+            console.log(`  Initializing ${name}...`);
+            initPromises.push(value.initialize());
+        }
+    }
+    await Promise.all(initPromises);
+}
+/** Wait for a port to accept TCP connections. */
+async function waitForPort(port, maxAttempts = 60) {
+    const { setTimeout: sleep } = await import('node:timers/promises');
+    for (let i = 0; i < maxAttempts; i++) {
+        const connected = await new Promise((resolve) => {
+            const socket = createConnection({ port, host: 'localhost' }, () => {
+                socket.destroy();
+                resolve(true);
+            });
+            socket.on('error', () => { socket.destroy(); resolve(false); });
+            socket.setTimeout(300, () => { socket.destroy(); resolve(false); });
+        });
+        if (connected)
+            return;
+        await sleep(500);
+    }
+    throw new Error(`Frontend server on port ${port} did not start within ${maxAttempts * 500}ms`);
+}
+export async function startDevServer(options) {
+    const { port = 3000, backendPath, frontendCommand, frontendPort = 3100, } = options;
+    const devStartTime = Date.now();
+    // Load .env.local if present (connection strings, project refs, etc.)
+    try {
+        process.loadEnvFile('.env.local');
+    }
+    catch (e) {
+        if (e.code !== 'ENOENT')
+            throw e;
+    }
+    // Apply pending external-database migrations to the dev database so the schema
+    // change is live locally and the generated types are refreshed from it.
+    // No-op for managed/PGlite apps; refuses if .env.local points at production.
+    await applyDevMigrations();
+    // Resolve path and convert to file URL for dynamic import
+    const resolvedPath = resolve(backendPath);
+    const backendUrl = pathToFileURL(resolvedPath).href;
+    // Detect sandbox: if BLOCKS_API_URL env var is set (by sandbox.ts), proxy to it.
+    const isSandbox = !!process.env.BLOCKS_API_URL;
+    const apiTarget = isSandbox ? process.env.BLOCKS_API_URL.replace(/\/aws-blocks\/api$/, '') : null;
+    // Write config for client-side JS — always reflects the current mode.
+    // In sandbox, point the browser at the localhost front door (not the raw
+    // execute-api URL) so the data-plane RPC is same-origin with the page and the
+    // session cookie — set host-scoped to localhost during the auth callback — is
+    // sent on every request. The dev server proxies `/aws-blocks/api` to
+    // BLOCKS_API_URL server-side, so the request still reaches the deployed Lambda.
+    // This makes sandbox single-origin, matching `npm run dev` and the prod
+    // CloudFront proxy; `crossDomain` stays unnecessary.
+    mkdirSync('.blocks-sandbox', { recursive: true });
+    writeFileSync('.blocks-sandbox/config.json', JSON.stringify({
+        apiUrl: `http://localhost:${port}${BLOCKS_RPC_PREFIX}`,
+        environment: isSandbox ? 'sandbox' : 'local',
+    }, null, 2));
+    // 1. Set up global collectors for plugin discovery
+    globalThis.__BLOCKS_CLIENT_MIDDLEWARE__ = [];
+    globalThis.__BLOCKS_DEV_ATTACHMENTS__ = [];
+    // 2. Import backend (sync construction phase — BBs register plugins via globals)
+    console.log('Loading backend...');
+    const backend = await import(backendUrl);
+    // 3. Read collected dev attachments and clean up
+    const devAttachments = globalThis.__BLOCKS_DEV_ATTACHMENTS__;
+    delete globalThis.__BLOCKS_DEV_ATTACHMENTS__;
+    // 4. Deploy local (async initialization phase) — skip in sandbox mode
+    if (!isSandbox) {
+        console.log('Deploying local resources...');
+        await deployLocal(backend);
+    }
+    // 5. Collect APIs for runtime
+    const apis = new Map();
+    for (const [exportName, exportValue] of Object.entries(backend)) {
+        if (typeof exportValue === 'function' || typeof exportValue === 'object') {
+            apis.set(exportName, exportValue);
+        }
+    }
+    registerBuiltinRoutes();
+    lockRouteRegistry();
+    // ── Frontend proxy ─────────────────────────────────────────────────────
+    let frontendProcess = null;
+    const frontendProxy = frontendCommand
+        ? httpProxy.createProxyServer({ target: `http://localhost:${frontendPort}`, ws: true })
+        : null;
+    frontendProxy?.on('error', (_err, _req, res) => {
+        if (!res || typeof res.writeHead !== 'function')
+            return;
+        if (res.headersSent)
+            return;
+        res.writeHead(502);
+        res.end('Frontend server unavailable');
+    });
+    // ── API Gateway proxy (sandbox mode) ───────────────────────────────────
+    // `changeOrigin: true` rewrites the outgoing `Host` to the execute-api target
+    // (required for API Gateway's TLS SNI / host-based routing). That would make
+    // the backend compute absolute URLs (OIDC redirect_uri, stub issuer URLs)
+    // against the execute-api host instead of this localhost front door, breaking
+    // redirect-based auth in sandbox. We forward the real front-door host via
+    // `X-Forwarded-Host`; the Lambda honors it only because it is loopback (see
+    // `isLoopbackForwardedHost` in lambda-handler.ts).
+    const apiProxy = apiTarget
+        ? httpProxy.createProxyServer({
+            target: apiTarget,
+            changeOrigin: true,
+            headers: { 'X-Forwarded-Host': `localhost:${port}` },
+        })
+        : null;
+    apiProxy?.on('error', (err, _req, res) => {
+        if (res.headersSent)
+            return;
+        res.writeHead(502);
+        res.end(JSON.stringify({ error: 'API Gateway unavailable', details: err.message }));
+    });
+    // ── Request handler ────────────────────────────────────────────────────
+    function isApiRequest(method, pathname) {
+        if (pathname === BLOCKS_RPC_PREFIX || pathname.startsWith(BLOCKS_RPC_PREFIX + '/'))
+            return true;
+        if (matchRoute(method, pathname))
+            return true;
+        return false;
+    }
+    const server = createServer((req, res) => {
+        const url = new URL(req.url || '/', `http://${req.headers.host || 'localhost'}`);
+        const method = req.method || 'GET';
+        // CORS headers
+        const requestOrigin = req.headers.origin || '';
+        const allowedOrigin = resolveDevCorsOrigin(requestOrigin);
+        res.setHeader('Access-Control-Allow-Origin', allowedOrigin);
+        res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, PATCH, HEAD, OPTIONS');
+        res.setHeader('Access-Control-Allow-Headers', 'Content-Type');
+        res.setHeader('Access-Control-Allow-Credentials', 'true');
+        res.setHeader('Access-Control-Max-Age', '86400');
+        if (method === 'OPTIONS') {
+            res.writeHead(200);
+            res.end();
+            return;
+        }
+        // ── API/RawRoute requests ──────────────────────────────────────────
+        if (isApiRequest(method, url.pathname)) {
+            if (isSandbox && apiProxy) {
+                apiProxy.web(req, res);
+                return;
+            }
+            handleApiRequest(req, res, url, method, apis);
+            return;
+        }
+        // ── Frontend requests ──────────────────────────────────────────────
+        if (frontendProxy) {
+            frontendProxy.web(req, res);
+        }
+        else {
+            res.writeHead(404);
+            res.end();
+        }
+    });
+    // WebSocket upgrade — route to frontend (HMR) or dev attachments
+    server.on('upgrade', (req, socket, head) => {
+        const url = new URL(req.url || '/', `http://${req.headers.host || 'localhost'}`);
+        if (url.pathname === '/realtime')
+            return; // handled by dev attachment (noServer mode)
+        if (frontendProxy) {
+            frontendProxy.ws(req, socket, head);
+        }
+        else {
+            socket.destroy();
+        }
+    });
+    // ── Attach dev servers ─────────────────────────────────────────────────
+    for (const specifier of devAttachments) {
+        console.log(`  🔌 Attaching dev server (from ${specifier})`);
+        const mod = await import(specifier);
+        if (typeof mod.attach !== 'function') {
+            throw new Error(`Dev attachment '${specifier}' does not export an attach() function`);
+        }
+        await mod.attach(server);
+    }
+    globalThis.__BLOCKS_REALTIME_WS_URL__ = `ws://localhost:${port}/realtime`;
+    globalThis.__BLOCKS_DEV_SERVER_PORT__ = port;
+    // Config already written during startup (local mode overwrites, sandbox mode preserves).
+    // Generate client code — skip in sandbox mode because sandbox.ts already
+    // generated it with --conditions=aws-runtime (correct aws-middleware).
+    // Re-generating here without that condition would overwrite with mock-middleware.
+    if (!isSandbox) {
+        const awsBlocksDir = dirname(resolvedPath);
+        const clientPath = join(awsBlocksDir, 'client.js');
+        console.log('📝 Generating client code...');
+        await writeClientCode(resolvedPath, clientPath);
+    }
+    // ── Start listening ────────────────────────────────────────────────────
+    server.listen(port, '127.0.0.1', async () => {
+        console.log(`AWS Blocks local server running on http://localhost:${port}`);
+        buildAndSendEvent({ command: 'dev', state: 'SUCCESS', duration: Date.now() - devStartTime });
+        // Spawn frontend dev server after Blocks server is ready
+        if (frontendCommand) {
+            frontendProcess = spawn(frontendCommand, {
+                shell: true,
+                stdio: ['ignore', 'pipe', 'pipe'],
+                env: { ...process.env, NODE_OPTIONS: '' },
+            });
+            // Suppress frontend output — only show errors
+            frontendProcess.stderr?.on('data', (d) => {
+                const msg = d.toString();
+                if (!msg.includes('DeprecationWarning'))
+                    process.stderr.write(msg);
+            });
+            frontendProcess.on('exit', (code) => {
+                if (code !== 0 && code !== null) {
+                    console.error(`⚠️  Frontend process exited with code ${code}`);
+                }
+            });
+            try {
+                await waitForPort(frontendPort);
+                console.log(`\n  ➜  http://localhost:${port}/\n`);
+            }
+            catch (e) {
+                console.error(`⚠️  Frontend did not start: ${e.message}`);
+                console.log(`\n  ➜  http://localhost:${port}/  (API only — frontend unavailable)\n`);
+            }
+        }
+        else {
+            console.log(`\n  ➜  http://localhost:${port}/\n`);
+        }
+    });
+    server.on('error', (err) => {
+        const errorCode = err.code === 'EADDRINUSE' ? 'PORT_IN_USE' : 'UNKNOWN';
+        buildAndSendEvent({ command: 'dev', state: 'FAIL', duration: Date.now() - devStartTime, error: { code: errorCode, phase: 'startup' } });
+    });
+    // ── Cleanup ────────────────────────────────────────────────────────────
+    const cleanup = async () => {
+        console.log('\nShutting down...');
+        if (frontendProcess)
+            frontendProcess.kill('SIGTERM');
+        if (typeof backend.__cleanup === 'function') {
+            try {
+                await backend.__cleanup();
+            }
+            catch { }
+        }
+        frontendProxy?.close();
+        apiProxy?.close();
+        server.close(() => process.exit(0));
+        setTimeout(() => process.exit(0), 2000).unref();
+    };
+    process.on('SIGINT', cleanup);
+    process.on('SIGTERM', cleanup);
+}
+// ── Local API handler ────────────────────────────────────────────────────────
+function handleApiRequest(req, res, url, method, apis) {
+    if (method === 'POST' && url.pathname === BLOCKS_RPC_PREFIX) {
+        let body = '';
+        req.on('data', chunk => body += chunk);
+        req.on('end', async () => {
+            const rpcHeaders = { 'Content-Type': 'application/json' };
+            // Verbose request/response logging — useful when debugging cross-stack
+            // wire format mismatches (e.g. native client codegen vs server). Set
+            // BLOCKS_DEV_QUIET=1 to suppress. Sensitive fields (passwords, session
+            // tokens, OTP codes) are redacted so they never reach the log stream.
+            if (!process.env.BLOCKS_DEV_QUIET) {
+                let inLog;
+                try {
+                    inLog = redactToJson(JSON.parse(body || '{}'));
+                }
+                catch {
+                    // Body isn't valid JSON (parse error surfaced below) — fall back to
+                    // the raw text. A malformed body can't carry a structured secret,
+                    // but truncate it like before to keep logs readable.
+                    inLog = body;
+                }
+                console.log('[rpc-in]', inLog.length > 800 ? inLog.slice(0, 800) + '…' : inLog);
+            }
+            const parsed = parseRpcRequest(body);
+            if (!parsed.ok) {
+                if (!process.env.BLOCKS_DEV_QUIET)
+                    console.log('[rpc-out parse-error]', parsed.response);
+                res.writeHead(200, rpcHeaders);
+                res.end(parsed.response);
+                return;
+            }
+            const { apiNamespace, method: rpcMethod, args, id: rpcId } = parsed.request;
+            if (!process.env.BLOCKS_DEV_QUIET) {
+                // redactToJson handles circulars and serialization failures itself.
+                console.log('[rpc-call]', `${apiNamespace}.${rpcMethod}`, redactToJson(args));
+            }
+            try {
+                const headers = new Headers();
+                Object.entries(req.headers).forEach(([k, v]) => {
+                    headers.set(k, Array.isArray(v) ? v[0] : v || '');
+                });
+                let responseStatus = 200;
+                const responseHeaders = new Headers({ 'Content-Type': 'application/json' });
+                let responseBody;
+                const context = {
+                    request: {
+                        headers,
+                        body: toBodyStream(body),
+                        json: async () => JSON.parse(body),
+                        text: async () => body,
+                        url: new URL(req.url || BLOCKS_RPC_PREFIX, `http://${req.headers.host}`),
+                        params: {},
+                    },
+                    response: {
+                        headers: responseHeaders,
+                        get status() { return responseStatus; },
+                        set status(code) { responseStatus = code; },
+                        send: (b) => { responseBody = b; },
+                    },
+                };
+                const apiHandler = apis.get(apiNamespace);
+                if (!apiHandler) {
+                    res.writeHead(200, rpcHeaders);
+                    res.end(methodNotFoundResponse(`API '${apiNamespace}' not found. Available: ${Array.from(apis.keys()).join(', ')}`, rpcId));
+                    return;
+                }
+                const apiMethods = typeof apiHandler === 'function' ? apiHandler(context) : apiHandler;
+                if (!apiMethods[rpcMethod]) {
+                    res.writeHead(200, rpcHeaders);
+                    res.end(methodNotFoundResponse(`'${rpcMethod}' on API '${apiNamespace}'`, rpcId));
+                    return;
+                }
+                const result = await apiMethods[rpcMethod](...args);
+                const headerObj = {};
+                for (const [key, value] of responseHeaders.entries()) {
+                    if (key === 'set-cookie')
+                        continue;
+                    headerObj[key] = value;
+                }
+                const setCookies = responseHeaders.getSetCookie?.() ?? [];
+                if (setCookies.length > 0)
+                    headerObj['set-cookie'] = setCookies;
+                const successPayload = successResponse(responseBody ?? result, rpcId);
+                if (!process.env.BLOCKS_DEV_QUIET) {
+                    // Log a redacted copy of the response value — never the raw
+                    // payload, which can carry challenge `session` tokens, MFA shared
+                    // secrets, etc. that the client legitimately round-trips.
+                    const okLog = redactToJson(responseBody ?? result);
+                    console.log('[rpc-ok]', `${apiNamespace}.${rpcMethod}`, okLog.length > 800 ? okLog.slice(0, 800) + '…' : okLog);
+                }
+                res.writeHead(responseStatus, headerObj);
+                res.end(successPayload);
+            }
+            catch (error) {
+                const errPayload = errorResponseFromCatch(error, rpcId);
+                if (!process.env.BLOCKS_DEV_QUIET) {
+                    console.log('[rpc-err]', `${apiNamespace}.${rpcMethod}`, error?.name ?? 'Error', '-', error?.message);
+                    if (error?.stack)
+                        console.log(error.stack);
+                }
+                res.writeHead(200, { 'Content-Type': 'application/json' });
+                res.end(errPayload);
+            }
+        });
+        return;
+    }
+    // RawRoute dispatch
+    const matched = matchRoute(method, url.pathname);
+    if (matched) {
+        let body = '';
+        req.on('data', (chunk) => body += chunk);
+        req.on('end', async () => {
+            try {
+                const headers = new Headers();
+                Object.entries(req.headers).forEach(([k, v]) => {
+                    headers.set(k, Array.isArray(v) ? v[0] : v || '');
+                });
+                let responseStatus = 200;
+                const responseHeaders = new Headers({ 'Content-Type': 'application/json' });
+                let responseBody;
+                const context = {
+                    request: {
+                        headers,
+                        body: toBodyStream(body),
+                        json: async () => JSON.parse(body),
+                        text: async () => body,
+                        url,
+                        params: matched.params,
+                    },
+                    response: {
+                        headers: responseHeaders,
+                        get status() { return responseStatus; },
+                        set status(code) { responseStatus = code; },
+                        send: (b) => { responseBody = b; },
+                    },
+                };
+                await matched.route.handler(context);
+                const headerObj = {};
+                for (const [key, value] of responseHeaders.entries()) {
+                    if (key === 'set-cookie')
+                        continue;
+                    headerObj[key] = value;
+                }
+                const setCookies = responseHeaders.getSetCookie?.() ?? [];
+                if (setCookies.length > 0)
+                    headerObj['set-cookie'] = setCookies;
+                res.writeHead(responseStatus, headerObj);
+                res.end(responseBody !== undefined ? (typeof responseBody === 'string' ? responseBody : JSON.stringify(responseBody)) : '');
+            }
+            catch (error) {
+                const status = error instanceof ApiError ? error.status : 500;
+                const errBody = { error: error.message };
+                if (error.name && error.name !== 'Error')
+                    errBody.name = error.name;
+                res.writeHead(status, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify(errBody));
+            }
+        });
+        return;
+    }
+    res.writeHead(404);
+    res.end();
+}

package/dist/scripts/ensure-secrets.d.ts

@@ -0,0 +1,31 @@
+export interface EnsureSecretsResult {
+    created: string[];
+    updated: string[];
+    unchanged: string[];
+}
+export declare function findConnectionString(): {
+    name: string;
+    value: string;
+} | null;
+/**
+ * Ensure the connection string is stored in SSM for the current stage.
+ */
+export declare function ensureSecrets(stage?: 'sandbox' | 'production'): Promise<EnsureSecretsResult>;
+/**
+ * Load environment for production deployment.
+ *
+ * Loads `.env.production` into `process.env` when present, then returns.
+ * If the file is absent this is a no-op — a missing `.env.production` is
+ * valid for templates that need no production-only configuration (e.g. the
+ * default DynamoDB template, Next.js, auth-cognito).
+ *
+ * Note: this function intentionally does NOT require any specific connection
+ * string. A Building Block that connects to an external database (e.g. via
+ * `fromExisting()`) is responsible for asserting its own configuration during
+ * synth/deploy, where the requirement can be checked against the construct
+ * tree rather than guessed at by the generic deploy script.
+ */
+export declare function loadProductionEnv(): void;
+/** Load a .env file into process.env. Uses Node 21.7+ API with fallback. */
+export declare function loadEnvFile(filePath: string): void;
+//# sourceMappingURL=ensure-secrets.d.ts.map

package/dist/scripts/ensure-secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ensure-secrets.d.ts","sourceRoot":"","sources":["../../src/scripts/ensure-secrets.ts"],"names":[],"mappings":"AAkBA,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,wBAAgB,oBAAoB,IAAI;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAO7E;AAED;;GAEG;AACH,wBAAsB,aAAa,CAAC,KAAK,CAAC,EAAE,SAAS,GAAG,YAAY,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAsClG;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,IAAI,IAAI,CAIxC;AAED,4EAA4E;AAC5E,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAelD"}

package/dist/scripts/ensure-secrets.js

@@ -0,0 +1,100 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Pre-deploy secret provisioning.
+ *
+ * Writes the connection string to an SSM SecureString parameter.
+ * Parameter name includes the stage to prevent sandbox/prod collision:
+ *   /blocks/{stage}/db-connection-string
+ *
+ * On first deploy: creates the parameter.
+ * On subsequent deploys: updates if value changed, no-op otherwise.
+ */
+import { existsSync, readFileSync } from 'node:fs';
+import { dbConnectionParameterName } from '../db-naming.js';
+const CONNECTION_STRING_PATTERN = /_(DB_URL|CONNECTION_STRING)$/;
+export function findConnectionString() {
+    for (const [name, value] of Object.entries(process.env)) {
+        if (CONNECTION_STRING_PATTERN.test(name) && value) {
+            return { name, value };
+        }
+    }
+    return null;
+}
+/**
+ * Ensure the connection string is stored in SSM for the current stage.
+ */
+export async function ensureSecrets(stage) {
+    const result = { created: [], updated: [], unchanged: [] };
+    const conn = findConnectionString();
+    if (!conn)
+        return result;
+    const resolvedStage = stage ?? process.env.BLOCKS_STAGE ?? 'sandbox';
+    const { SSMClient, GetParameterCommand, PutParameterCommand } = await import('@aws-sdk/client-ssm');
+    const client = new SSMClient();
+    const parameterName = dbConnectionParameterName(resolvedStage);
+    let isNew = false;
+    try {
+        const current = await client.send(new GetParameterCommand({
+            Name: parameterName,
+            WithDecryption: true,
+        }));
+        if (current.Parameter?.Value === conn.value) {
+            result.unchanged.push(parameterName);
+            return result;
+        }
+    }
+    catch (e) {
+        if (e.name !== 'ParameterNotFound')
+            throw e;
+        isNew = true;
+    }
+    await client.send(new PutParameterCommand({
+        Name: parameterName,
+        Value: conn.value,
+        Type: 'SecureString',
+        Overwrite: true,
+    }));
+    (isNew ? result.created : result.updated).push(parameterName);
+    return result;
+}
+/**
+ * Load environment for production deployment.
+ *
+ * Loads `.env.production` into `process.env` when present, then returns.
+ * If the file is absent this is a no-op — a missing `.env.production` is
+ * valid for templates that need no production-only configuration (e.g. the
+ * default DynamoDB template, Next.js, auth-cognito).
+ *
+ * Note: this function intentionally does NOT require any specific connection
+ * string. A Building Block that connects to an external database (e.g. via
+ * `fromExisting()`) is responsible for asserting its own configuration during
+ * synth/deploy, where the requirement can be checked against the construct
+ * tree rather than guessed at by the generic deploy script.
+ */
+export function loadProductionEnv() {
+    if (existsSync('.env.production')) {
+        loadEnvFile('.env.production');
+    }
+}
+/** Load a .env file into process.env. Uses Node 21.7+ API with fallback. */
+export function loadEnvFile(filePath) {
+    if (typeof process.loadEnvFile === 'function') {
+        process.loadEnvFile(filePath);
+    }
+    else {
+        const content = readFileSync(filePath, 'utf-8');
+        for (const line of content.split('\n')) {
+            const trimmed = line.trim();
+            if (!trimmed || trimmed.startsWith('#'))
+                continue;
+            const eqIdx = trimmed.indexOf('=');
+            if (eqIdx === -1)
+                continue;
+            const key = trimmed.slice(0, eqIdx).trim();
+            const value = trimmed.slice(eqIdx + 1).trim();
+            if (!process.env[key])
+                process.env[key] = value;
+        }
+    }
+}

package/dist/scripts/ensure-secrets.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ensure-secrets.test.d.ts.map

package/dist/scripts/ensure-secrets.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ensure-secrets.test.d.ts","sourceRoot":"","sources":["../../src/scripts/ensure-secrets.test.ts"],"names":[],"mappings":""}

package/dist/scripts/ensure-secrets.test.js

@@ -0,0 +1,44 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+import { describe, it, beforeEach, afterEach } from 'node:test';
+import assert from 'node:assert';
+import { mkdtempSync, writeFileSync, rmSync } from 'node:fs';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+import { loadProductionEnv } from './ensure-secrets.js';
+describe('loadProductionEnv', () => {
+    let workDir;
+    let originalCwd;
+    beforeEach(() => {
+        originalCwd = process.cwd();
+        workDir = mkdtempSync(join(tmpdir(), 'load-prod-env-'));
+        process.chdir(workDir);
+    });
+    afterEach(() => {
+        process.chdir(originalCwd);
+        rmSync(workDir, { recursive: true, force: true });
+    });
+    // Regression for bug bash item #2: deploy of a non-Supabase template
+    // (no .env.production, no SUPABASE_DB_URL) must not throw.
+    it('does not throw when .env.production is absent and no connection string is set', () => {
+        delete process.env.SUPABASE_DB_URL;
+        assert.doesNotThrow(() => loadProductionEnv());
+    });
+    it('does not throw when .env.production is absent even without any DB env var', () => {
+        delete process.env.SUPABASE_DB_URL;
+        delete process.env.DATABASE_URL;
+        assert.doesNotThrow(() => loadProductionEnv());
+    });
+    it('loads variables from .env.production when present', () => {
+        const key = 'LOAD_PROD_ENV_TEST_VAR';
+        delete process.env[key];
+        writeFileSync(join(workDir, '.env.production'), `${key}=hello-prod\n`);
+        try {
+            loadProductionEnv();
+            assert.strictEqual(process.env[key], 'hello-prod');
+        }
+        finally {
+            delete process.env[key];
+        }
+    });
+});