@aws-blocks/core 0.1.18 → 0.3.0

package/src/pipeline/index.ts

@@ -1,16 +1,69 @@
 // Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
-export {
-  Pipeline,
-  DeployStage,
-  __PIPELINE_STAGE_SCOPE__,
+import { __PIPELINE_STAGE_SCOPE__, DeployStage, Pipeline as LeafPipeline } from '@aws-blocks/pipeline';
+import type {
+	BranchConfig,
+	DeployStageProps,
+	PipelineProps,
+	PipelineSourceConfig,
+	PipelineStageConfig,
+	PipelineSynthConfig,
 } from '@aws-blocks/pipeline';
+import type { Construct } from 'constructs';
+import { blocksStoreConfig } from '../secret-naming.js';
+
+export { __PIPELINE_STAGE_SCOPE__, DeployStage };
 export type {
-  DeployStageProps,
-  BranchConfig,
-  PipelineProps,
-  PipelineSourceConfig,
-  PipelineSynthConfig,
-  PipelineStageConfig,
-} from '@aws-blocks/pipeline';
+	BranchConfig,
+	DeployStageProps,
+	PipelineProps,
+	PipelineSourceConfig,
+	PipelineStageConfig,
+	PipelineSynthConfig,
+};
+
+/**
+ * Merge the Blocks `/blocks/*` namespace as the DEFAULT store config, so a
+ * Blocks pipeline resolves `connectionArn` / `buildSecrets` from the same place
+ * the Blocks CLI (`npm run secret` / `npm run config`) writes. Per-kind and
+ * shallow: any field the caller sets (a custom `prefix`, a `stage`, a
+ * `cacheTtlSeconds`) wins over the Blocks default.
+ */
+function withBlocksDefaults<TConfig>(props: PipelineProps<TConfig>): PipelineProps<TConfig> {
+	const blocks = blocksStoreConfig();
+	return {
+		...props,
+		secretStore: { ...blocks.secretStore, ...props.secretStore },
+		configStore: { ...blocks.configStore, ...props.configStore },
+	};
+}
+
+/**
+ * Blocks `Pipeline` — the framework-neutral `@aws-blocks/pipeline` construct with
+ * the Blocks value namespace pinned. It defaults `secretStore` / `configStore` to
+ * `/blocks/secrets` and `/blocks/config` (the prefixes the Blocks `secret` /
+ * `config` CLIs write), mirroring how the Blocks `Hosting` block pins the same
+ * namespace — so a value set with `npm run secret`/`config` is the value the
+ * pipeline reads. Pass `secretStore` / `configStore` to override.
+ *
+ * @see {@link https://github.com/aws-devtools-labs/aws-blocks/blob/main/packages/pipeline/README.md}
+ */
+export class Pipeline<TConfig = Record<string, unknown>> extends LeafPipeline<TConfig> {
+	constructor(scope: Construct, id: string, props: PipelineProps<TConfig>) {
+		super(scope, id, withBlocksDefaults(props));
+	}
+
+	/**
+	 * Async constructor — required when `source.connectionArn` is a `config()`
+	 * marker (resolved at synth time). Pins the Blocks namespace, then delegates to
+	 * the leaf {@link LeafPipeline.create}.
+	 */
+	static async create<TConfig = Record<string, unknown>>(
+		scope: Construct,
+		id: string,
+		props: PipelineProps<TConfig>,
+	): Promise<LeafPipeline<TConfig>> {
+		return LeafPipeline.create(scope, id, withBlocksDefaults(props));
+	}
+}

package/src/pipeline.test.ts

@@ -0,0 +1,55 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import assert from 'node:assert';
+import { afterEach, describe, it } from 'node:test';
+import { _setSynthSecretFetcher } from '@aws-blocks/hosting/constructs';
+import { config } from '@aws-blocks/hosting';
+import type * as cdk from 'aws-cdk-lib';
+import { App, Stack } from 'aws-cdk-lib';
+import { Pipeline } from './pipeline/index.js';
+import type { PipelineStageConfig } from './pipeline/index.js';
+
+const MOCK_CONNECTION_ARN = 'arn:aws:codeconnections:us-east-1:123456789012:connection/test-connection-id';
+
+function minimalStageFactory(scope: cdk.Stage, stageConfig: PipelineStageConfig): void {
+	new Stack(scope, 'AppStack', { env: stageConfig.env });
+}
+
+// B2: the core Pipeline wrapper must resolve values from the SAME namespace the
+// Blocks CLI writes (`/blocks/*`), not the leaf-neutral `/hosting/*` — otherwise
+// `npm run config -- set CONNECTION_ARN` writes one name and the deploy reads
+// another. The leaf default is `/hosting/config`; the wrapper must pin `/blocks/config`.
+void describe('core Pipeline pins the Blocks namespace', () => {
+	afterEach(() => _setSynthSecretFetcher(null));
+
+	void it('resolves a config() connectionArn under /blocks/config by default', async () => {
+		const seen: string[] = [];
+		_setSynthSecretFetcher(async (locator: string) => {
+			seen.push(locator);
+			return MOCK_CONNECTION_ARN;
+		});
+		await Pipeline.create(new App(), 'BlocksPipeline', {
+			source: { repo: 'my-org/my-app', connectionArn: config('CONNECTION_ARN') },
+			branches: [{ branch: 'main', stages: [{ name: 'prod' }] }],
+			stageFactory: minimalStageFactory,
+		});
+		// The Blocks CLI writes /blocks/config/CONNECTION_ARN; the wrapper must read it there.
+		assert.deepStrictEqual(seen, ['/blocks/config/CONNECTION_ARN']);
+	});
+
+	void it('lets the caller override the pinned prefix', async () => {
+		const seen: string[] = [];
+		_setSynthSecretFetcher(async (locator: string) => {
+			seen.push(locator);
+			return MOCK_CONNECTION_ARN;
+		});
+		await Pipeline.create(new App(), 'OverridePipeline', {
+			source: { repo: 'my-org/my-app', connectionArn: config('CONNECTION_ARN') },
+			branches: [{ branch: 'main', stages: [{ name: 'prod' }] }],
+			stageFactory: minimalStageFactory,
+			configStore: { prefix: '/myapp/config' },
+		});
+		assert.deepStrictEqual(seen, ['/myapp/config/CONNECTION_ARN']);
+	});
+});

package/src/rpc.test.ts

@@ -3,7 +3,7 @@
 
 import { describe, it } from 'node:test';
 import assert from 'node:assert';
-import { decodeRpcResponse, errorResponseFromCatch, parseRpcRequest, RpcErrorCode } from './rpc.js';
+import { decodeRpcResponse, errorResponseFromCatch, parseRpcRequest, RpcErrorCode, MAX_RPC_BODY_BYTES } from './rpc.js';
 import { ApiError, isBlocksError } from './errors.js';
 
 describe('-32600 Invalid Request error shape', () => {
@@ -97,6 +97,28 @@ describe('params decoding', () => {
   });
 });
 
+describe('-32602 Invalid Params validation', () => {
+  for (const params of ['abc', 42, true, false, null]) {
+    it(`rejects ${JSON.stringify(params)} params`, () => {
+      const result = parseRpcRequest(JSON.stringify({
+        jsonrpc: '2.0',
+        method: 'api.echo',
+        params,
+        id: 'request-1',
+      }));
+
+      assert.strictEqual(result.ok, false);
+      if (!result.ok) {
+        const response = JSON.parse(result.response);
+        assert.strictEqual(response.error.code, RpcErrorCode.InvalidParams);
+        assert.strictEqual(response.error.data.name, 'InvalidParams');
+        assert.ok(response.error.message.includes('expected an array or object'));
+        assert.strictEqual(response.id, 'request-1');
+      }
+    });
+  }
+});
+
 describe('batch requests (top-level JSON array body)', () => {
   it('rejects an array body as Invalid Request with a null id', () => {
     const result = parseRpcRequest(JSON.stringify([
@@ -166,3 +188,46 @@ describe('ApiError status ↔ JSON-RPC error code', () => {
     );
   });
 });
+
+describe('request body size limit', () => {
+  it('accepts a normal-sized body', () => {
+    const result = parseRpcRequest(JSON.stringify({ jsonrpc: '2.0', method: 'ns.method', params: [], id: 1 }));
+    assert.strictEqual(result.ok, true);
+  });
+
+  it('rejects a body larger than MAX_RPC_BODY_BYTES with a PayloadTooLarge error', () => {
+    // A JSON string just over the limit (a single huge param value).
+    const huge = 'x'.repeat(MAX_RPC_BODY_BYTES + 1);
+    const body = JSON.stringify({ jsonrpc: '2.0', method: 'ns.method', params: [huge], id: 1 });
+    assert.ok(Buffer.byteLength(body, 'utf8') > MAX_RPC_BODY_BYTES);
+
+    const result = parseRpcRequest(body);
+    assert.strictEqual(result.ok, false);
+    if (result.ok) return; // narrow
+    const parsed = JSON.parse(result.response);
+    // Positive HTTP status (413), not a reserved -32xxx — so decodeRpcResponse
+    // surfaces it to the client as ApiError.status === 413.
+    assert.strictEqual(parsed.error.code, 413);
+    assert.strictEqual(parsed.error.data?.name, 'PayloadTooLarge');
+    assert.match(parsed.error.message, /exceeds/);
+    assert.match(parsed.error.message, /10 MiB/); // human-readable size crosses the wire
+
+    // Client round-trip: decodeRpcResponse surfaces it as ApiError.status 413
+    // (not 500), so consumer `e.status === 413` handling works.
+    assert.throws(
+      () => decodeRpcResponse(parsed),
+      (e: unknown) => e instanceof ApiError && e.status === 413 && isBlocksError(e, 'PayloadTooLarge'),
+    );
+  });
+
+  it('rejects an oversized body before attempting to parse it (invalid JSON still 413s, not a ParseError)', () => {
+    // Oversized AND not valid JSON — the size guard must win, proving the body
+    // is rejected before the (expensive) parse + before any handler/DB touch.
+    const oversizedGarbage = 'x'.repeat(MAX_RPC_BODY_BYTES + 1);
+    const result = parseRpcRequest(oversizedGarbage);
+    assert.strictEqual(result.ok, false);
+    if (result.ok) return;
+    const parsed = JSON.parse(result.response);
+    assert.strictEqual(parsed.error.data?.name, 'PayloadTooLarge');
+  });
+});

package/src/rpc.ts

@@ -32,6 +32,28 @@ export type RpcParseResult =
 
 const VERSION = '2.0' as const;
 
+/**
+ * Maximum accepted request-body size, in bytes (10 MiB).
+ *
+ * Matches the payload limit API Gateway enforces in production (~10 MB for a
+ * REST API). In prod an oversized body is rejected by API Gateway at the edge —
+ * before the Lambda is invoked — so this guard's rejection path effectively
+ * runs on the dev/mock server, where there is no edge to stop it: an oversized
+ * body would otherwise buffer and wedge the local database (e.g. PGlite). By
+ * enforcing the *same* limit locally, the dev server rejects the same oversized
+ * body prod would 413 at the edge, instead of failing only in one environment.
+ * Enforced in `parseRpcRequest`, the single choke point both the Lambda handler
+ * and the dev server route through.
+ *
+ * Note: this value is the Lambda + API Gateway limit. It lives here (in the
+ * compute-agnostic parser) because Lambda is the only compute path today. When
+ * a non-API-Gateway compute (e.g. container/ALB) is introduced, this should
+ * become compute-aware — sourced from / overridden by the compute layer (via
+ * the Compute `setEnv` config hook) rather than a fixed constant in `core` —
+ * since an ALB has a different payload limit. Tracked with the multi-compute work.
+ */
+export const MAX_RPC_BODY_BYTES = 10 * 1024 * 1024;
+
 /** Reserved JSON-RPC error codes. */
 export const RpcErrorCode = {
   ParseError:     -32700,
@@ -89,6 +111,25 @@ export function decodeRpcResponse(body: unknown): unknown {
  * anything about the JSON-RPC spec.
  */
 export function parseRpcRequest(bodyText: string): RpcParseResult {
+  // Reject oversized bodies before parsing or dispatch. See MAX_RPC_BODY_BYTES
+  // for the limit and its rationale.
+  if (Buffer.byteLength(bodyText, 'utf8') > MAX_RPC_BODY_BYTES) {
+    // Emit the real HTTP status (413) as the error code, not a reserved -32xxx:
+    // `decodeRpcResponse` maps a positive code straight to `ApiError.status`
+    // (reserved codes collapse to 500), mirroring the 504 handler-timeout path,
+    // so a caller's `e.status === 413` works. `name` (which crosses the wire,
+    // not the code) lets callers match with `isBlocksError(e, 'PayloadTooLarge')`.
+    return {
+      ok: false,
+      response: errorResponse(
+        413,
+        `Request body exceeds the ${MAX_RPC_BODY_BYTES} byte (${MAX_RPC_BODY_BYTES / (1024 * 1024)} MiB) limit`,
+        null,
+        { name: 'PayloadTooLarge' },
+      ),
+    };
+  }
+
   let parsed: any;
   try {
     parsed = JSON.parse(bodyText || '{}');
@@ -118,15 +159,31 @@ export function parseRpcRequest(bodyText: string): RpcParseResult {
     };
   }
 
+  const hasParams = Object.hasOwn(parsed, 'params');
+  if (hasParams && (parsed.params === null || typeof parsed.params !== 'object')) {
+    return {
+      ok: false,
+      response: errorResponse(
+        RpcErrorCode.InvalidParams,
+        'Invalid params: expected an array or object',
+        id,
+        { name: 'InvalidParams' },
+      ),
+    };
+  }
+
+  let args: unknown[] = [];
+  if (hasParams) {
+    args = Array.isArray(parsed.params) ? parsed.params : Object.values(parsed.params);
+  }
+
   return {
     ok: true,
     request: {
       apiNamespace: parsed.method.substring(0, dotIndex),
       method: parsed.method.substring(dotIndex + 1),
       // JSON-RPC 2.0 §4.2: params may be an array (positional) or object (named).
-      args: Array.isArray(parsed.params)
-        ? parsed.params
-        : Object.values(parsed.params ?? {}),
+      args,
       id,
     },
   };

package/src/scripts/config.ts

@@ -0,0 +1,35 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+/**
+ * `blocks config` — manage a Blocks app's non-sensitive **config** values (SSM
+ * Parameter Store), pinned to the Blocks `/blocks/<stackId>/config` namespace
+ * (scoped to the app's stable `stackId` from `.blocks/config.json`). Thin wrapper
+ * over the shared `@aws-blocks/hosting` CLI with the kind fixed to `config`. The
+ * `secret` counterpart is `./secret.ts`.
+ *
+ * @module
+ */
+
+import { listValues, removeValue, runValueCli, setValue } from '@aws-blocks/hosting/scripts';
+import { blocksConfigPrefix } from '../secret-naming.js';
+
+/** Set (create or overwrite) a Blocks config value. */
+export function setConfig(key: string, value: string, opts: { stage?: string } = {}): Promise<void> {
+	return setValue('config', key, value, { prefix: blocksConfigPrefix(), ...opts });
+}
+
+/** List Blocks config keys (names only). */
+export function listConfig(opts: { stage?: string } = {}): Promise<string[]> {
+	return listValues('config', { prefix: blocksConfigPrefix(), ...opts });
+}
+
+/** Remove a Blocks config value. */
+export function removeConfig(key: string, opts: { stage?: string } = {}): Promise<boolean> {
+	return removeValue('config', key, { prefix: blocksConfigPrefix(), ...opts });
+}
+
+/** CLI dispatcher for `blocks config <set|list|remove> …`. */
+export function runConfigCli(argv: string[]): Promise<void> {
+	return runValueCli(argv, { kind: 'config', prefix: blocksConfigPrefix(), label: 'blocks config' });
+}

package/src/scripts/deploy.ts

@@ -6,6 +6,7 @@ import { readFileSync, writeFileSync, mkdirSync } from 'node:fs';
 import { join, resolve, dirname } from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { ensureSecrets, loadProductionEnv } from './ensure-secrets.js';
+import { assertAwsCredentials } from './preflight-credentials.js';
 import { applyExternalMigrations } from './external-migrations-step.js';
 import { trackCommand } from '../telemetry/trackCommand.js';
 import { getCdkTelemetryEnv } from './cdk-telemetry-env.js';
@@ -25,6 +26,10 @@ export async function deploy(options: DeployOptions) {
 
     process.env.BLOCKS_STAGE = 'production';
 
+    // Fail fast if AWS credentials are missing/expired, before generating the
+    // client and spending time in synth only to hit an opaque CDK credential error.
+    await assertAwsCredentials('deploy');
+
     // Provision secrets for production. projectRoot must match the root cdk
     // synth uses (passed as --context below) so the written parameter name
     // equals the one the app resolves at synth.

package/src/scripts/dev-server.ts

@@ -105,6 +105,39 @@ export interface DevServerOptions {
   frontendCommand?: string;
   /** Port the frontend dev server listens on. Default: 3100. */
   frontendPort?: number;
+  /**
+   * Watch `secret()` / `config()` calls and regenerate the type-safe key
+   * augmentation (so `getSecret`/`getConfig` autocomplete and reject typos) as you
+   * edit — all under this one `npm run dev`, no second command. Auto-detected: a
+   * no-op unless the app actually declares a `secret()`/`config()`, and never fatal
+   * (a failure only logs a warning). Set `false` to disable. Default: enabled.
+   */
+  typegen?: boolean;
+}
+
+/**
+ * Bootstrap the type-safe `getSecret`/`getConfig` key generation for the dev
+ * session. Auto-detected and non-fatal: scans the app for `secret()`/`config()`
+ * calls and, only if it finds any, generates the augmentation `.d.ts` and starts a
+ * watcher that regenerates on save — so a single `npm run dev` gives type-safe keys
+ * with no second command. Returns a `stop()` (or `undefined` when the app declares
+ * no secrets, typegen is unavailable, or it is disabled). The watcher is `unref`'d
+ * so it can never block the dev server's shutdown.
+ */
+async function startTypegenWatch(): Promise<(() => void) | undefined> {
+  try {
+    const { scanValueKeys, watchHostingValues } = await import('@aws-blocks/hosting/scripts');
+    const scan = await scanValueKeys();
+    if (scan.secretKeys.length === 0 && scan.configKeys.length === 0) {
+      return undefined; // app doesn't use secret()/config() → nothing to type, skip silently
+    }
+    console.log('🔑 Type-safe secret()/config() keys — watching for changes...');
+    return await watchHostingValues({ unref: true });
+  } catch (error) {
+    // Never break the dev server over typegen (e.g. `typescript` not installed).
+    console.warn(`⚠️  hosting-typegen skipped: ${error instanceof Error ? error.message : String(error)}`);
+    return undefined;
+  }
 }
 
 /**
@@ -953,6 +986,12 @@ export async function startDevServer(options: DevServerOptions) {
     await writeClientCode(resolvedPath, clientPath);
   }
 
+  // Type-safe getSecret/getConfig: generate + watch the key augmentation so the
+  // getters autocomplete and reject typos, regenerating on save — all under this
+  // one `npm run dev`. Auto-detected (no-op unless the app uses secret()/config())
+  // and non-fatal.
+  const stopTypegen = options.typegen === false ? undefined : await startTypegenWatch();
+
   // ── Startup reclaim ──────────────────────────────────────────────────────
   // Free any port left bound by a crashed / SIGKILL'd predecessor before we bind
   // the front door or spawn the `--strictPort` frontend. tsx-watch only gives the
@@ -1039,6 +1078,7 @@ export async function startDevServer(options: DevServerOptions) {
     console.log('\nShutting down...');
 
     if (respawnTimer) { clearTimeout(respawnTimer); respawnTimer = null; }
+    stopTypegen?.(); // tear down the typegen watcher (unref'd, but close it cleanly)
     // Detach our own listeners so repeated signals can't pile up handlers.
     for (const sig of signals) process.removeListener(sig, cleanup);
 

package/src/scripts/generate-client.test.ts

@@ -1,12 +1,12 @@
 // Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
-import { describe, it, beforeEach, afterEach } from 'node:test';
 import assert from 'node:assert';
+import { afterEach, beforeEach, describe, it } from 'node:test';
+import { mkdirSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
 import { generateClientCode } from './generate-client.js';
-import { writeFileSync, mkdirSync, rmSync } from 'fs';
-import { join } from 'path';
-import { tmpdir } from 'os';
 
 /**
  * Regression test: generateClientCode collects middleware from whatever
@@ -35,9 +35,12 @@ describe('generateClientCode — middleware collection', () => {
 	it('includes middleware specifiers registered by the backend', async () => {
 		// Create a minimal backend that registers a middleware specifier
 		const backendPath = join(tmpDir, 'backend.mjs');
-		writeFileSync(backendPath, `
+		writeFileSync(
+			backendPath,
+			`
 			globalThis.__BLOCKS_CLIENT_MIDDLEWARE__?.push('@aws-blocks/bb-realtime/aws-middleware');
-		`);
+		`,
+		);
 
 		const code = await generateClientCode(backendPath);
 		assert.ok(
@@ -52,9 +55,12 @@ describe('generateClientCode — middleware collection', () => {
 
 	it('includes mock-middleware when backend registers it (local dev mode)', async () => {
 		const backendPath = join(tmpDir, 'backend.mjs');
-		writeFileSync(backendPath, `
+		writeFileSync(
+			backendPath,
+			`
 			globalThis.__BLOCKS_CLIENT_MIDDLEWARE__?.push('@aws-blocks/bb-realtime/mock-middleware');
-		`);
+		`,
+		);
 
 		const code = await generateClientCode(backendPath);
 		assert.ok(
@@ -66,4 +72,33 @@ describe('generateClientCode — middleware collection', () => {
 			'Generated client must NOT include aws-middleware in local dev mode',
 		);
 	});
+
+	it('skips secret()/config() markers — they are values, not API namespaces', async () => {
+		// A secret()/config() marker is branded with Symbol.for('@aws-blocks/hosting.ManagedValue');
+		// build one inline so the fixture needs no imports. A real export still gets a proxy.
+		const backendPath = join(tmpDir, 'backend.mjs');
+		writeFileSync(
+			backendPath,
+			`
+				const BRAND = Symbol.for('@aws-blocks/hosting.ManagedValue');
+				export const stripeKey = { [BRAND]: true, key: 'STRIPE_KEY', kind: 'secret' };
+				export const featureFlags = { [BRAND]: true, key: 'FEATURE_FLAGS', kind: 'config' };
+				export function realApi() {}
+			`,
+		);
+
+		const code = await generateClientCode(backendPath);
+		assert.ok(
+			!code.includes("__BLOCKS_ApiNamespaceClient__('stripeKey')"),
+			'a secret() marker must not become an HTTP namespace',
+		);
+		assert.ok(
+			!code.includes("__BLOCKS_ApiNamespaceClient__('featureFlags')"),
+			'a config() marker must not become an HTTP namespace',
+		);
+		assert.ok(
+			code.includes("export const realApi = __BLOCKS_ApiNamespaceClient__('realApi')"),
+			'a real (non-marker) export still becomes a namespace',
+		);
+	});
 });

package/src/scripts/generate-client.ts

@@ -1,9 +1,10 @@
 // Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
-import { readFileSync, writeFileSync, mkdirSync } from 'fs';
-import { dirname } from 'path';
-import { pathToFileURL } from 'url';
+import { isManagedValue } from '@aws-blocks/hosting';
+import { mkdirSync, writeFileSync } from 'node:fs';
+import { dirname } from 'node:path';
+import { pathToFileURL } from 'node:url';
 import { API_NAMESPACE_MARKER } from '../api.js';
 
 /**
@@ -15,72 +16,76 @@ import { API_NAMESPACE_MARKER } from '../api.js';
  * import statements + ApiNamespace proxy exports.
  */
 export async function generateClientCode(foundationPath: string): Promise<string> {
-  // Set up global collector if not already present (dev server may have already done this)
-  const collectorAlreadyActive = Array.isArray((globalThis as any).__BLOCKS_CLIENT_MIDDLEWARE__);
-  if (!collectorAlreadyActive) {
-    (globalThis as any).__BLOCKS_CLIENT_MIDDLEWARE__ = [];
-  }
-
-  const backend = await import(pathToFileURL(foundationPath).href);
-
-  // Read collected middleware and clean up
-  const middleware: string[] = (globalThis as any).__BLOCKS_CLIENT_MIDDLEWARE__;
-  delete (globalThis as any).__BLOCKS_CLIENT_MIDDLEWARE__;
-
-  const imports = new Set<string>();
-  const lines: string[] = [];
-  const namespaceNames: string[] = [];
-
-  imports.add(`import { ApiNamespaceClient as __BLOCKS_ApiNamespaceClient__ } from '@aws-blocks/blocks/client';`);
-
-  for (const specifier of middleware) {
-    imports.add(`import '${specifier}';`);
-  }
-
-  // Emit ApiNamespace proxy exports
-  for (const [name, value] of Object.entries(backend)) {
-    if (name.startsWith('_')) continue;
-
-    const isApiNamespace = typeof (value as any)?.[API_NAMESPACE_MARKER] === 'string';
-    if (isApiNamespace) {
-      lines.push(`export const ${name} = __BLOCKS_ApiNamespaceClient__('${name}');`);
-      namespaceNames.push(name);
-      continue;
-    }
-
-    // Fallback: any exported function/object that isn't a Scope gets a proxy.
-    const isScope = typeof (value as any)?.id === 'string' && typeof (value as any)?.fullId === 'string';
-    if (isScope) continue;
-
-    // Fallback: any exported function/object gets an ApiNamespace proxy.
-    if ((typeof value === 'function' || typeof value === 'object') && value !== null) {
-      lines.push(`export const ${name} = __BLOCKS_ApiNamespaceClient__('${name}');`);
-      namespaceNames.push(name);
-    }
-  }
-
-  // Emit generateClient — creates new ApiNamespaceClient instances with the given url
-  const nsEntries = namespaceNames.map(n => `    ${n}: __BLOCKS_ApiNamespaceClient__('${n}', config),`).join('\n');
-  lines.push('');
-  lines.push(`export const generateClient = (config) => ({\n${nsEntries}\n});`);
-
-  const header = [
-    '// ============================================================',
-    '// AUTO-GENERATED FILE — DO NOT EDIT',
-    '//',
-    '// This file is generated by the Blocks dev server / build process.',
-    '// Any manual changes will be overwritten on the next build.',
-    '// ============================================================',
-  ];
-
-  return [...header, '', ...imports, '', ...lines].join('\n');
+	// Set up global collector if not already present (dev server may have already done this)
+	const collectorAlreadyActive = Array.isArray((globalThis as any).__BLOCKS_CLIENT_MIDDLEWARE__);
+	if (!collectorAlreadyActive) {
+		(globalThis as any).__BLOCKS_CLIENT_MIDDLEWARE__ = [];
+	}
+
+	const backend = await import(pathToFileURL(foundationPath).href);
+
+	// Read collected middleware and clean up
+	const middleware: string[] = (globalThis as any).__BLOCKS_CLIENT_MIDDLEWARE__;
+	delete (globalThis as any).__BLOCKS_CLIENT_MIDDLEWARE__;
+
+	const imports = new Set<string>();
+	const lines: string[] = [];
+	const namespaceNames: string[] = [];
+
+	imports.add(`import { ApiNamespaceClient as __BLOCKS_ApiNamespaceClient__ } from '@aws-blocks/blocks/client';`);
+
+	for (const specifier of middleware) {
+		imports.add(`import '${specifier}';`);
+	}
+
+	// Emit ApiNamespace proxy exports
+	for (const [name, value] of Object.entries(backend)) {
+		if (name.startsWith('_')) continue;
+
+		const isApiNamespace = typeof (value as any)?.[API_NAMESPACE_MARKER] === 'string';
+		if (isApiNamespace) {
+			lines.push(`export const ${name} = __BLOCKS_ApiNamespaceClient__('${name}');`);
+			namespaceNames.push(name);
+			continue;
+		}
+
+		// Fallback: any exported function/object that isn't a Scope gets a proxy.
+		const isScope = typeof (value as any)?.id === 'string' && typeof (value as any)?.fullId === 'string';
+		if (isScope) continue;
+
+		// A secret()/config() marker is a deferred value, not an API — skip it, or
+		// `export const k = secret('K')` in index.ts would become a bogus HTTP namespace.
+		if (isManagedValue(value)) continue;
+
+		// Fallback: any exported function/object gets an ApiNamespace proxy.
+		if ((typeof value === 'function' || typeof value === 'object') && value !== null) {
+			lines.push(`export const ${name} = __BLOCKS_ApiNamespaceClient__('${name}');`);
+			namespaceNames.push(name);
+		}
+	}
+
+	// Emit generateClient — creates new ApiNamespaceClient instances with the given url
+	const nsEntries = namespaceNames.map((n) => `    ${n}: __BLOCKS_ApiNamespaceClient__('${n}', config),`).join('\n');
+	lines.push('');
+	lines.push(`export const generateClient = (config) => ({\n${nsEntries}\n});`);
+
+	const header = [
+		'// ============================================================',
+		'// AUTO-GENERATED FILE — DO NOT EDIT',
+		'//',
+		'// This file is generated by the Blocks dev server / build process.',
+		'// Any manual changes will be overwritten on the next build.',
+		'// ============================================================',
+	];
+
+	return [...header, '', ...imports, '', ...lines].join('\n');
 }
 
 /**
  * Generate client code and write it to the aws-blocks subpackage.
  */
 export async function writeClientCode(foundationPath: string, outputPath: string): Promise<void> {
-  const code = await generateClientCode(foundationPath);
-  mkdirSync(dirname(outputPath), { recursive: true });
-  writeFileSync(outputPath, code);
+	const code = await generateClientCode(foundationPath);
+	mkdirSync(dirname(outputPath), { recursive: true });
+	writeFileSync(outputPath, code);
 }