@aws-blocks/core 0.1.18 → 0.2.0

package/dist/index.cdk.d.ts

@@ -5,7 +5,8 @@ export { EventSourceMapping } from './lambda-handler.js';
 export { BlocksStackProps } from './common/index.js';
 export { registerSdkIdentifiers, getSdkIdentifiers, getAllSdkIdentifiers, _resetSdkRegistry } from './common/sdk-registry.js';
 export { getConfig, getConfigSync, preloadConfig, loadConfigToProcessEnv, _resetConfigCache } from './common/config.js';
-export { BlocksStack, Scope, SandboxDisableDeletionProtection, BlocksBackend, registerConfig, finalizeConfigRegistry, synthGuard, DEFAULT_NODE_RUNTIME, type BlocksBackendProps } from './cdk/index.js';
+export { BlocksStack, Scope, SandboxDisableDeletionProtection, BlocksBackend, registerConfig, finalizeConfigRegistry, synthGuard, DEFAULT_NODE_RUNTIME, blocksNodejsBundling, type BlocksBackendProps } from './cdk/index.js';
+export { type BlocksDefaults, BlocksPresets, } from './cdk/index.js';
 export { Hosting, type HostingProps, type BlocksStackApi, type FrameworkType, type ComputeConfig, type HostingDomainConfig, type HostingWafConfig, } from './hosting.js';
 export { RawRoute, RawRouteErrors, type RawRouteOptions, type HttpMethod, } from './raw-route.cdk.js';
 export { registerRoute, matchRoute, getRegisteredRoutes, clearRouteRegistry, lockRouteRegistry, unlockRouteRegistry, type RegisteredRoute, } from './raw-route.js';

package/dist/index.cdk.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.cdk.d.ts","sourceRoot":"","sources":["../src/index.cdk.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,YAAY,EAAE,KAAK,aAAa,EAAE,KAAK,UAAU,EAAE,MAAM,UAAU,CAAC;AAC7E,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACvE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,YAAY,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAC5F,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC9H,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,aAAa,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACxH,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,gCAAgC,EAAE,aAAa,EAAE,cAAc,EAAE,sBAAsB,EAAE,UAAU,EAAE,oBAAoB,EAAE,KAAK,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACxM,OAAO,EACL,OAAO,EACP,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,GACtB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,QAAQ,EACR,cAAc,EACd,KAAK,eAAe,EACpB,KAAK,UAAU,GAChB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,aAAa,EACb,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,EACjB,mBAAmB,EACnB,KAAK,eAAe,GACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,QAAQ,EACR,WAAW,EACX,wBAAwB,EACxB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,GACzB,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.cdk.d.ts","sourceRoot":"","sources":["../src/index.cdk.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,YAAY,EAAE,KAAK,aAAa,EAAE,KAAK,UAAU,EAAE,MAAM,UAAU,CAAC;AAC7E,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACvE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,YAAY,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAC5F,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC9H,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,aAAa,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACxH,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,gCAAgC,EAAE,aAAa,EAAE,cAAc,EAAE,sBAAsB,EAAE,UAAU,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,KAAK,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAC9N,OAAO,EACL,KAAK,cAAc,EACnB,aAAa,GACd,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,OAAO,EACP,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,GACtB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,QAAQ,EACR,cAAc,EACd,KAAK,eAAe,EACpB,KAAK,UAAU,GAChB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,aAAa,EACb,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,EACjB,mBAAmB,EACnB,KAAK,eAAe,GACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,QAAQ,EACR,WAAW,EACX,wBAAwB,EACxB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,GACzB,MAAM,qBAAqB,CAAC"}

package/dist/index.cdk.js

@@ -6,7 +6,8 @@ export { ApiError, isBlocksError, hasAuthError, DEFAULT_API_ERROR_NAME } from '.
 export { EventSourceMapping } from './lambda-handler.js';
 export { registerSdkIdentifiers, getSdkIdentifiers, getAllSdkIdentifiers, _resetSdkRegistry } from './common/sdk-registry.js';
 export { getConfig, getConfigSync, preloadConfig, loadConfigToProcessEnv, _resetConfigCache } from './common/config.js';
-export { BlocksStack, Scope, SandboxDisableDeletionProtection, BlocksBackend, registerConfig, finalizeConfigRegistry, synthGuard, DEFAULT_NODE_RUNTIME } from './cdk/index.js';
+export { BlocksStack, Scope, SandboxDisableDeletionProtection, BlocksBackend, registerConfig, finalizeConfigRegistry, synthGuard, DEFAULT_NODE_RUNTIME, blocksNodejsBundling } from './cdk/index.js';
+export { BlocksPresets, } from './cdk/index.js';
 export { Hosting, } from './hosting.js';
 export { RawRoute, RawRouteErrors, } from './raw-route.cdk.js';
 export { registerRoute, matchRoute, getRegisteredRoutes, clearRouteRegistry, lockRouteRegistry, unlockRouteRegistry, } from './raw-route.js';

package/dist/rpc.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rpc.d.ts","sourceRoot":"","sources":["../src/rpc.ts"],"names":[],"mappings":"AAgBA,0EAA0E;AAC1E,MAAM,WAAW,gBAAgB;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,wFAAwF;IACxF,IAAI,EAAE,OAAO,EAAE,CAAC;IAChB,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,yDAAyD;AACzD,MAAM,MAAM,cAAc,GACtB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,gBAAgB,CAAA;CAAE,GACvC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAMpC,qCAAqC;AACrC,eAAO,MAAM,YAAY;;;;;;CAMf,CAAC;AAMX,8DAA8D;AAC9D,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,CAO9F;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAiBxD;AAID;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,cAAc,CA0ChE;AAED,oEAAoE;AACpE,wBAAgB,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,MAAM,CAEnF;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,MAAM,CAOzF;AAED,yCAAyC;AACzC,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,MAAM,CAEzF;AAID,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,EAC1B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,MAAM,CAMR"}
+{"version":3,"file":"rpc.d.ts","sourceRoot":"","sources":["../src/rpc.ts"],"names":[],"mappings":"AAgBA,0EAA0E;AAC1E,MAAM,WAAW,gBAAgB;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,wFAAwF;IACxF,IAAI,EAAE,OAAO,EAAE,CAAC;IAChB,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,yDAAyD;AACzD,MAAM,MAAM,cAAc,GACtB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,gBAAgB,CAAA;CAAE,GACvC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAMpC,qCAAqC;AACrC,eAAO,MAAM,YAAY;;;;;;CAMf,CAAC;AAMX,8DAA8D;AAC9D,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,CAO9F;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAiBxD;AAID;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,cAAc,CA0DhE;AAED,oEAAoE;AACpE,wBAAgB,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,MAAM,CAEnF;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,MAAM,CAOzF;AAED,yCAAyC;AACzC,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,MAAM,CAEzF;AAID,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,EAC1B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,MAAM,CAMR"}

package/dist/rpc.js

@@ -79,15 +79,24 @@ export function parseRpcRequest(bodyText) {
             response: errorResponse(RpcErrorCode.InvalidRequest, 'Invalid Request: method must be "namespace.method"', id, { name: 'InvalidRequest' }),
         };
     }
+    const hasParams = Object.hasOwn(parsed, 'params');
+    if (hasParams && (parsed.params === null || typeof parsed.params !== 'object')) {
+        return {
+            ok: false,
+            response: errorResponse(RpcErrorCode.InvalidParams, 'Invalid params: expected an array or object', id, { name: 'InvalidParams' }),
+        };
+    }
+    let args = [];
+    if (hasParams) {
+        args = Array.isArray(parsed.params) ? parsed.params : Object.values(parsed.params);
+    }
     return {
         ok: true,
         request: {
             apiNamespace: parsed.method.substring(0, dotIndex),
             method: parsed.method.substring(dotIndex + 1),
             // JSON-RPC 2.0 §4.2: params may be an array (positional) or object (named).
-            args: Array.isArray(parsed.params)
-                ? parsed.params
-                : Object.values(parsed.params ?? {}),
+            args,
             id,
         },
     };

package/dist/rpc.test.js

@@ -82,6 +82,26 @@ describe('params decoding', () => {
             assert.deepStrictEqual(result.request.args, []);
     });
 });
+describe('-32602 Invalid Params validation', () => {
+    for (const params of ['abc', 42, true, false, null]) {
+        it(`rejects ${JSON.stringify(params)} params`, () => {
+            const result = parseRpcRequest(JSON.stringify({
+                jsonrpc: '2.0',
+                method: 'api.echo',
+                params,
+                id: 'request-1',
+            }));
+            assert.strictEqual(result.ok, false);
+            if (!result.ok) {
+                const response = JSON.parse(result.response);
+                assert.strictEqual(response.error.code, RpcErrorCode.InvalidParams);
+                assert.strictEqual(response.error.data.name, 'InvalidParams');
+                assert.ok(response.error.message.includes('expected an array or object'));
+                assert.strictEqual(response.id, 'request-1');
+            }
+        });
+    }
+});
 describe('batch requests (top-level JSON array body)', () => {
     it('rejects an array body as Invalid Request with a null id', () => {
         const result = parseRpcRequest(JSON.stringify([

package/dist/scripts/telemetry.test.js

@@ -23,6 +23,8 @@ const NO_CI_ENV = {
     TF_BUILD: '',
     BITBUCKET_BUILD_NUMBER: '',
     BUILDKITE: '',
+    RENDER: '',
+    TASKCLUSTER_ROOT_URL: '',
     AWS_BLOCKS_DISABLE_TELEMETRY: '',
 };
 function createTmpDir() {

package/dist/telemetry/environment.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"environment.d.ts","sourceRoot":"","sources":["../../src/telemetry/environment.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,wBAAgB,QAAQ,IAAI,OAAO,GAAG,QAAQ,GAAG,OAAO,CAEvD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED;;GAEG;AACH,wBAAgB,IAAI,IAAI,OAAO,CAc9B;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,GAAG,SAAS,CAEzD;AAED;;;GAGG;AACH,wBAAgB,WAAW,IAAI,MAAM,GAAG,SAAS,CAiBhD;AAED;;GAEG;AACH,wBAAgB,kBAAkB,IAAI;IACpC,EAAE,EAAE,OAAO,GAAG,QAAQ,GAAG,OAAO,CAAC;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,EAAE,EAAE,OAAO,CAAC;IACZ,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAwBA"}
+{"version":3,"file":"environment.d.ts","sourceRoot":"","sources":["../../src/telemetry/environment.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,wBAAgB,QAAQ,IAAI,OAAO,GAAG,QAAQ,GAAG,OAAO,CAEvD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED;;GAEG;AACH,wBAAgB,IAAI,IAAI,OAAO,CAgB9B;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,GAAG,SAAS,CAEzD;AAED;;;GAGG;AACH,wBAAgB,WAAW,IAAI,MAAM,GAAG,SAAS,CAiBhD;AAED;;GAEG;AACH,wBAAgB,kBAAkB,IAAI;IACpC,EAAE,EAAE,OAAO,GAAG,QAAQ,GAAG,OAAO,CAAC;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,EAAE,EAAE,OAAO,CAAC;IACZ,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAwBA"}

package/dist/telemetry/environment.js

@@ -25,7 +25,9 @@ export function isCI() {
         process.env.JENKINS_URL ||
         process.env.TF_BUILD ||
         process.env.BITBUCKET_BUILD_NUMBER ||
-        process.env.BUILDKITE);
+        process.env.BUILDKITE ||
+        process.env.RENDER ||
+        process.env.TASKCLUSTER_ROOT_URL);
 }
 /**
  * Detect the package manager from npm_config_user_agent.

package/dist/telemetry/telemetry.test.js

@@ -117,6 +117,8 @@ describe('telemetry/environment', () => {
             delete process.env.TF_BUILD;
             delete process.env.BITBUCKET_BUILD_NUMBER;
             delete process.env.BUILDKITE;
+            delete process.env.RENDER;
+            delete process.env.TASKCLUSTER_ROOT_URL;
         });
         it('returns false when no CI env vars set', () => {
             assert.strictEqual(isCI(), false);
@@ -133,6 +135,14 @@ describe('telemetry/environment', () => {
             process.env.CODEBUILD_BUILD_ID = 'build-123';
             assert.strictEqual(isCI(), true);
         });
+        it('returns true when RENDER is set', () => {
+            process.env.RENDER = 'true';
+            assert.strictEqual(isCI(), true);
+        });
+        it('returns true when TASKCLUSTER_ROOT_URL is set', () => {
+            process.env.TASKCLUSTER_ROOT_URL = 'https://tc.example.com';
+            assert.strictEqual(isCI(), true);
+        });
     });
     it('detectOS returns a valid platform', () => {
         const os = detectOS();

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const CORE_VERSION = "0.1.18";
+export declare const CORE_VERSION = "0.2.0";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"version.d.ts","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AACA,eAAO,MAAM,YAAY,WAAW,CAAC"}
+{"version":3,"file":"version.d.ts","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AACA,eAAO,MAAM,YAAY,UAAU,CAAC"}

package/dist/version.js

@@ -1,2 +1,2 @@
 // Auto-generated by scripts/generate-version.mjs — do not edit manually
-export const CORE_VERSION = '0.1.18';
+export const CORE_VERSION = '0.2.0';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws-blocks/core",
-  "version": "0.1.18",
+  "version": "0.2.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/aws-devtools-labs/aws-blocks.git",
@@ -32,6 +32,10 @@
       "types": "./dist/index.cdk.js",
       "default": "./dist/index.cdk.js"
     },
+    "./cdk/internal": {
+      "types": "./dist/cdk/internal.d.ts",
+      "default": "./dist/cdk/internal.js"
+    },
     "./client": "./dist/client/index.js",
     "./lambda-handler": "./dist/lambda-handler.js",
     "./bb-utils": {
@@ -67,6 +71,7 @@
     "@types/cross-spawn": "^6.0.6",
     "@types/http-proxy": "^1.17.16",
     "@types/node": "^20.0.0",
+    "esbuild": "^0.27.0",
     "typescript": "^5.3.0",
     "unctx": "^2.0.0"
   },

package/src/cdk/__fixtures__/import-meta-handler.ts

@@ -0,0 +1,16 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+// Repro fixture for the "handler bundles to CJS but uses import.meta.url" bug.
+//
+// The handler is bundled to CJS by NodejsFunction. In a CJS bundle `import.meta`
+// is empty, so this top-level `fileURLToPath(import.meta.url)` would become
+// `fileURLToPath(undefined)` and throw at Lambda load. blocksNodejsBundling shims
+// `import.meta.url` to a CommonJS equivalent, so the bundle loads and resolves a
+// real path instead of crashing — see bundling.test.ts.
+import { fileURLToPath } from 'node:url';
+
+export const moduleDir = fileURLToPath(import.meta.url);
+
+// Reference moduleDir so esbuild can't tree-shake the import.meta.url usage away.
+export const handler = async () => ({ statusCode: 200, body: JSON.stringify({ moduleDir }) });

package/src/cdk/blocks-backend.test.ts

@@ -9,6 +9,7 @@ import * as cdk from 'aws-cdk-lib';
 import { Template, Match } from 'aws-cdk-lib/assertions';
 import { PolicyStatement } from 'aws-cdk-lib/aws-iam';
 import { BlocksBackend } from './blocks-backend.js';
+import { BlocksPresets } from './blocks-defaults.js';
 import { Scope } from './index.js';
 
 // Simulate the CDK condition being active (tests import CDK files directly)
@@ -22,6 +23,7 @@ const sideEffectBackendPath = join(__dirname, '__fixtures__', 'side-effect-backe
 const factoryBackendPath = join(__dirname, '__fixtures__', 'factory-backend.js');
 const fullIdConstructBackendPath = join(__dirname, '__fixtures__', 'fullid-construct-backend.js');
 const EXECUTION_ROLE_MARKER_ACTION = 'blocks-test:MarkerAction';
+const importMetaHandlerPath = join(__dirname, '__fixtures__', 'import-meta-handler.js');
 
 describe('ESM cache-busting (multi-stage)', () => {
   test('BlocksBackend.create() with same backendCDKPath but different IDs produces constructs in each', async () => {
@@ -31,11 +33,13 @@ describe('ESM cache-busting (multi-stage)', () => {
     const backend1 = await BlocksBackend.create(stack, 'Stage1', {
       backendHandlerPath: handlerPath,
       backendCDKPath: sideEffectBackendPath,
+      defaults: BlocksPresets.production,
     });
 
     const backend2 = await BlocksBackend.create(stack, 'Stage2', {
       backendHandlerPath: handlerPath,
       backendCDKPath: sideEffectBackendPath,
+      defaults: BlocksPresets.production,
     });
 
     const findMarker = (scope: cdk.aws_lambda_nodejs.NodejsFunction | any) =>
@@ -60,6 +64,7 @@ describe('synth shape (drop into existing stack)', () => {
     const backend = await BlocksBackend.create(parent, 'Blocks', {
       backendHandlerPath: handlerPath,
       backendCDKPath: sideEffectBackendPath,
+      defaults: BlocksPresets.production,
     });
 
     // Public surface mirrors BlocksStack.
@@ -81,10 +86,12 @@ describe('synth shape (drop into existing stack)', () => {
     await BlocksBackend.create(parent, 'BackendA', {
       backendHandlerPath: handlerPath,
       backendCDKPath: sideEffectBackendPath,
+      defaults: BlocksPresets.production,
     });
     await BlocksBackend.create(parent, 'BackendB', {
       backendHandlerPath: handlerPath,
       backendCDKPath: sideEffectBackendPath,
+      defaults: BlocksPresets.production,
     });
 
     const template = Template.fromStack(parent);
@@ -100,6 +107,7 @@ describe('shared execution role', () => {
     const backend = await BlocksBackend.create(parent, 'Blocks', {
       backendHandlerPath: handlerPath,
       backendCDKPath: sideEffectBackendPath,
+      defaults: BlocksPresets.production,
     });
 
     assert.ok(backend.executionRole, 'BlocksBackend should expose .executionRole');
@@ -112,6 +120,7 @@ describe('shared execution role', () => {
     await BlocksBackend.create(parent, 'Blocks', {
       backendHandlerPath: handlerPath,
       backendCDKPath: sideEffectBackendPath,
+      defaults: BlocksPresets.production,
     });
 
     const template = Template.fromStack(parent);
@@ -148,6 +157,7 @@ describe('shared execution role', () => {
     const backend = await BlocksBackend.create(parent, 'Blocks', {
       backendHandlerPath: handlerPath,
       backendCDKPath: sideEffectBackendPath,
+      defaults: BlocksPresets.production,
     });
 
     // Build nested Scopes under the backend (outer → inner), the same shape a
@@ -178,6 +188,27 @@ describe('shared execution role', () => {
   });
 });
 
+describe('CJS bundle: import.meta.url in the handler is shimmed (no Lambda-load crash)', () => {
+  test('a handler that uses import.meta.url bundles successfully instead of throwing at load', async () => {
+    // The handler is bundled to CJS, where `import.meta` is empty. Left unshimmed,
+    // `fileURLToPath(import.meta.url)` compiles to `fileURLToPath(undefined)` and
+    // throws at Lambda load (esbuild only warns, so the broken bundle would deploy).
+    // blocksNodejsBundling shims import.meta.* to CommonJS equivalents, so bundling
+    // (which runs synchronously during construction) succeeds. The runtime behaviour
+    // of the emitted shim is verified directly in bundling.test.ts.
+    const app = new cdk.App();
+    const stack = new cdk.Stack(app, 'ImportMetaStack');
+
+    await assert.doesNotReject(() =>
+      BlocksBackend.create(stack, 'blocks', {
+        backendHandlerPath: importMetaHandlerPath,
+        backendCDKPath: sideEffectBackendPath,
+        defaults: BlocksPresets.production,
+      }),
+    );
+  });
+});
+
 describe('factory function support', () => {
   test('BlocksBackend.create() calls default export function with the backend instance', async () => {
     const app = new cdk.App();
@@ -186,6 +217,7 @@ describe('factory function support', () => {
     const backend = await BlocksBackend.create(stack, 'FactoryStage', {
       backendHandlerPath: handlerPath,
       backendCDKPath: factoryBackendPath,
+      defaults: BlocksPresets.production,
     });
 
     const marker = backend.node.tryFindChild('FactoryMarker');
@@ -201,6 +233,7 @@ describe('fullId is token-free (construct IDs / env-var keys)', () => {
     const backend = await BlocksBackend.create(stack, 'blocks', {
       backendHandlerPath: handlerPath,
       backendCDKPath: sideEffectBackendPath,
+      defaults: BlocksPresets.production,
     });
 
     assert.strictEqual(backend.fullId, 'TopLevelStack-blocks');
@@ -225,6 +258,7 @@ describe('fullId is token-free (construct IDs / env-var keys)', () => {
     const backend = await BlocksBackend.create(nested, 'blocks', {
       backendHandlerPath: handlerPath,
       backendCDKPath: sideEffectBackendPath,
+      defaults: BlocksPresets.production,
     });
 
     assert.ok(
@@ -245,6 +279,7 @@ describe('fullId is token-free (construct IDs / env-var keys)', () => {
     const backend = await BlocksBackend.create(nested, 'blocks', {
       backendHandlerPath: handlerPath,
       backendCDKPath: fullIdConstructBackendPath,
+      defaults: BlocksPresets.production,
     });
 
     // The construct ID is `${scope.fullId}Marker` → `ParentStack-blocks-blocks-dbMarker`.
@@ -272,6 +307,7 @@ describe('fullId is token-free (construct IDs / env-var keys)', () => {
     const backend = await BlocksBackend.create(nested, 'blocks', {
       backendHandlerPath: handlerPath,
       backendCDKPath: sideEffectBackendPath,
+      defaults: BlocksPresets.production,
     });
 
     const template = Template.fromStack(nested);
@@ -294,3 +330,43 @@ describe('fullId is token-free (construct IDs / env-var keys)', () => {
     }
   });
 });
+
+describe('infrastructure defaults (backend-anchored)', () => {
+  test('each backend exposes its own defaults', async () => {
+    const app = new cdk.App();
+    const stack = new cdk.Stack(app, 'TwoBackendsStack');
+
+    const a = await BlocksBackend.create(stack, 'A', {
+      backendHandlerPath: handlerPath,
+      backendCDKPath: sideEffectBackendPath,
+      defaults: BlocksPresets.production,
+    });
+    const b = await BlocksBackend.create(stack, 'B', {
+      backendHandlerPath: handlerPath,
+      backendCDKPath: sideEffectBackendPath,
+      defaults: BlocksPresets.sandbox,
+    });
+
+    // Two backends in one stack must NOT clobber each other — defaults are
+    // anchored on the backend, not the shared stack.
+    assert.strictEqual(a.defaults, BlocksPresets.production);
+    assert.strictEqual(b.defaults, BlocksPresets.sandbox);
+  });
+
+  test('a nested block resolves its owning backend defaults via the tree-walk', async () => {
+    const app = new cdk.App();
+    const stack = new cdk.Stack(app, 'ResolveDefaultsStack');
+
+    const backend = await BlocksBackend.create(stack, 'Blocks', {
+      backendHandlerPath: handlerPath,
+      backendCDKPath: sideEffectBackendPath,
+      defaults: BlocksPresets.sandbox,
+    });
+
+    // A Scope under the backend resolves scope.defaults by walking up to it.
+    const outer = new Scope('outer');
+    const inner = new Scope('inner', { parent: outer });
+    assert.strictEqual(inner.defaults, backend.defaults);
+    assert.strictEqual(inner.defaults, BlocksPresets.sandbox);
+  });
+});

package/src/cdk/blocks-backend.ts

@@ -9,8 +9,10 @@ import { CfnGroup } from 'aws-cdk-lib/aws-resourcegroups';
 import { Construct } from 'constructs';
 import { pathToFileURL } from 'node:url';
 import { DEFAULT_NODE_RUNTIME } from './node-version.js';
+import { blocksNodejsBundling } from './bundling.js';
 import { addBlocksStackMetadata } from './stack-metadata.js';
 import { finalizeConfigRegistry, registerConfig } from './config-registry.js';
+import type { BlocksDefaults } from './blocks-defaults.js';
 import { BLOCKS_NAMESPACE, BLOCKS_RPC_PREFIX } from '../constants.js';
 import { registerBuiltinRoutes } from '../builtin-routes.js';
 
@@ -45,18 +47,35 @@ export function assertCdkConditionActive(): void {
 export interface BlocksBackendProps {
   backendHandlerPath: string;
   backendCDKPath: string;
+  /**
+   * Stack-wide infrastructure defaults applied to every Building Block (removal
+   * policy, deletion protection, …). See {@link BlocksDefaults}. Start from
+   * `BlocksPresets.sandbox` or `BlocksPresets.production` and override
+   * individual fields as needed. A per-block option always wins over the
+   * corresponding stack default.
+   */
+  defaults: BlocksDefaults;
 }
 
 /** Shared infra setup — creates Lambda + API Gateway on the given scope. */
 export function setupBlocksInfra(scope: Construct, props: BlocksBackendProps, id?: string) {
+  // Fail fast with an actionable message at the create() call site if `defaults`
+  // is missing (e.g. a plain-JS caller, `as any`, or a dynamically-built props
+  // object) — otherwise the first Building Block to read `scope.defaults` throws
+  // a cryptic `Cannot read properties of undefined (reading 'removalPolicy')`.
+  if (!props.defaults) {
+    throw new Error(
+      'BlocksStack/BlocksBackend requires a `defaults` field. Pass a posture from ' +
+      '`@aws-blocks/core/cdk` — typically `defaults: sandboxMode ? BlocksPresets.sandbox : BlocksPresets.production`.',
+    );
+  }
+
   // ── Shared execution role ──────────────────────────────────────────────
   // A single IAM role that every Building Block grants to. Provisioned here so
   // it exists before the backend module is imported (Building Blocks reach it
   // via `scope.executionRole`). Block grants sit on the role's default (inline)
-  // policy, exactly as they did on the auto-generated NodejsFunction role.
-  //
-  // AWSLambdaBasicExecutionRole is attached explicitly because the auto-role
-  // included it by default — omitting it would silently break CloudWatch Logs.
+  // policy. AWSLambdaBasicExecutionRole is attached so the handler retains
+  // CloudWatch Logs permissions.
   const executionRole = new iam.Role(scope, 'BlocksRole', {
     // CompositePrincipal (rather than a bare ServicePrincipal) so additional
     // compute types can assume this same shared role as they are introduced
@@ -87,10 +106,13 @@ export function setupBlocksInfra(scope: Construct, props: BlocksBackendProps, id
        */
       BLOCKS_STACK_NAME: id ?? cdk.Stack.of(scope).stackName,
     },
-    bundling: {
+    // blocksNodejsBundling shims import.meta.* to CommonJS equivalents so a
+    // CJS-bundled `fileURLToPath(import.meta.url)` resolves instead of throwing at
+    // Lambda load. See ./bundling.ts.
+    bundling: blocksNodejsBundling({
       minify: true,
       esbuildArgs: { '--conditions': 'aws-runtime' },
-    },
+    }),
   });
 
   // In sandbox mode, allow localhost origins so the local dev frontend can
@@ -199,6 +221,8 @@ export class BlocksBackend extends Construct {
   public readonly backendHandlerPath: string;
   /** Shared IAM role assumed by all Blocks compute. Building Blocks grant to this role. */
   public readonly executionRole: iam.IRole;
+  /** Infrastructure defaults for Building Blocks created under this backend. */
+  public readonly defaults: BlocksDefaults;
 
   /**
    * The fullId used by child Scopes to compute their env var names,
@@ -239,6 +263,11 @@ export class BlocksBackend extends Construct {
     // Expose self to Building Blocks at CDK time
     (globalThis as any).CURRENT_BLOCKS_STACK = this;
 
+    // Store defaults on the backend (not the stack) so several BlocksBackends
+    // in one stack each keep their own posture; Building Blocks resolve them by
+    // walking up to their owning backend (see Scope.defaults).
+    this.defaults = props.defaults;
+
     const infra = setupBlocksInfra(this, props, id);
     this.handler = infra.handler;
     this.gateway = infra.gateway;

package/src/cdk/blocks-defaults.test.ts

@@ -0,0 +1,25 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+/**
+ * BlocksPresets carry the expected posture. Resolution/anchoring (a block
+ * reading its owning backend's defaults, and two backends in one stack keeping
+ * separate postures) is covered in blocks-backend.test.ts, which has the
+ * fixtures to construct real backends.
+ */
+import { test, describe } from 'node:test';
+import assert from 'node:assert';
+import { RemovalPolicy } from 'aws-cdk-lib';
+import { BlocksPresets } from './blocks-defaults.js';
+
+describe('BlocksPresets', () => {
+	test('sandbox is disposable: DESTROY + deletion protection off', () => {
+		assert.strictEqual(BlocksPresets.sandbox.removalPolicy, RemovalPolicy.DESTROY);
+		assert.strictEqual(BlocksPresets.sandbox.deletionProtection, false);
+	});
+
+	test('production is durable: RETAIN + deletion protection on', () => {
+		assert.strictEqual(BlocksPresets.production.removalPolicy, RemovalPolicy.RETAIN);
+		assert.strictEqual(BlocksPresets.production.deletionProtection, true);
+	});
+});

package/src/cdk/blocks-defaults.ts

@@ -0,0 +1,49 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import { RemovalPolicy } from 'aws-cdk-lib';
+
+/**
+ * Default values for every Amazon-authored Building Block created within a
+ * `BlocksStack` or `BlocksBackend`. A per-block option always overrides the
+ * corresponding default (`option ?? scope.defaults.field`).
+ *
+ * Start from {@link BlocksPresets} and override individual fields as needed.
+ */
+export interface BlocksDefaults {
+	/**
+	 * What happens to a stateful resource (table, bucket, user pool) when the
+	 * stack is deleted, via CDK/CloudFormation: `RETAIN` keeps the resource (and
+	 * its data) behind; `DESTROY` tears it down. Applies only to CDK/CloudFormation
+	 * deletions.
+	 */
+	removalPolicy: RemovalPolicy;
+
+	/**
+	 * Whether to block deletion of a stateful resource. Unlike `removalPolicy`,
+	 * this guards against deletion through **any** path — CDK/CloudFormation as
+	 * well as the CLI, API, and AWS console — until it is turned off.
+	 */
+	deletionProtection: boolean;
+}
+
+/**
+ * Prepared starting points for {@link BlocksDefaults}. Pick one and override
+ * individual fields with a spread:
+ *
+ * ```ts
+ * defaults: { ...BlocksPresets.production, deletionProtection: false }
+ * ```
+ */
+export const BlocksPresets = {
+	/** Disposable development stacks: tear down cleanly, no delete guard. */
+	sandbox: {
+		removalPolicy: RemovalPolicy.DESTROY,
+		deletionProtection: false,
+	},
+	/** Durable, protected posture for permanent deployments. */
+	production: {
+		removalPolicy: RemovalPolicy.RETAIN,
+		deletionProtection: true,
+	},
+} satisfies Record<string, BlocksDefaults>;

package/src/cdk/blocks-stack.test.ts

@@ -7,7 +7,7 @@ import { fileURLToPath } from 'node:url';
 import { dirname, join } from 'node:path';
 import * as cdk from 'aws-cdk-lib';
 import { BlocksBackend } from './blocks-backend.js';
-import { BlocksStack, Scope } from './index.js';
+import { BlocksStack, BlocksPresets, Scope } from './index.js';
 
 // Simulate the CDK condition being active (tests import CDK files directly)
 before(() => {
@@ -26,11 +26,13 @@ describe('ESM cache-busting (multi-stage)', () => {
     const stack1 = await BlocksStack.create(app, 'PipelineStage1', {
       backendHandlerPath: handlerPath,
       backendCDKPath: sideEffectBackendPath,
+      defaults: BlocksPresets.production,
     });
 
     const stack2 = await BlocksStack.create(app, 'PipelineStage2', {
       backendHandlerPath: handlerPath,
       backendCDKPath: sideEffectBackendPath,
+      defaults: BlocksPresets.production,
     });
 
     const findMarker = (scope: any) => scope.node.tryFindChild('SideEffectMarker');
@@ -53,6 +55,7 @@ describe('factory function support', () => {
     const stack = await BlocksStack.create(app, 'FactoryBlocksStack', {
       backendHandlerPath: handlerPath,
       backendCDKPath: factoryBackendPath,
+      defaults: BlocksPresets.production,
     });
 
     const marker = stack.node.tryFindChild('FactoryMarker');
@@ -68,6 +71,7 @@ describe('legacy side-effect mode (no default export)', () => {
     const backend = await BlocksBackend.create(stack, 'LegacyStage', {
       backendHandlerPath: handlerPath,
       backendCDKPath: sideEffectBackendPath,
+      defaults: BlocksPresets.production,
     });
 
     const marker = backend.node.tryFindChild('SideEffectMarker');
@@ -88,6 +92,7 @@ describe('shared execution role (BlocksStack)', () => {
     const stack = await BlocksStack.create(app, 'StackRoleStack', {
       backendHandlerPath: handlerPath,
       backendCDKPath: sideEffectBackendPath,
+      defaults: BlocksPresets.production,
     });
 
     assert.ok(stack.executionRole, 'BlocksStack should expose a populated .executionRole');
@@ -100,6 +105,7 @@ describe('executionRole globalThis fallback', () => {
     const stack = await BlocksStack.create(app, 'FallbackStack', {
       backendHandlerPath: handlerPath,
       backendCDKPath: sideEffectBackendPath,
+      defaults: BlocksPresets.production,
     });
 
     // A Scope whose construct-tree ancestry has no BlocksStack/BlocksBackend
@@ -132,6 +138,7 @@ describe('assertCdkConditionActive', () => {
         BlocksStack.create(app, 'MissingConditionStack', {
           backendHandlerPath: handlerPath,
           backendCDKPath: sideEffectBackendPath,
+          defaults: BlocksPresets.production,
         }),
         (err: Error) => {
           assert.ok(err.message.includes('Missing --conditions=cdk'), `Expected condition error, got: ${err.message}`);