@aws-blocks/core 0.1.18 → 0.3.0

package/dist/rpc.js

@@ -11,6 +11,27 @@
 import { ApiError } from './errors.js';
 // ── Constants ───────────────────────────────────────────────────────────────
 const VERSION = '2.0';
+/**
+ * Maximum accepted request-body size, in bytes (10 MiB).
+ *
+ * Matches the payload limit API Gateway enforces in production (~10 MB for a
+ * REST API). In prod an oversized body is rejected by API Gateway at the edge —
+ * before the Lambda is invoked — so this guard's rejection path effectively
+ * runs on the dev/mock server, where there is no edge to stop it: an oversized
+ * body would otherwise buffer and wedge the local database (e.g. PGlite). By
+ * enforcing the *same* limit locally, the dev server rejects the same oversized
+ * body prod would 413 at the edge, instead of failing only in one environment.
+ * Enforced in `parseRpcRequest`, the single choke point both the Lambda handler
+ * and the dev server route through.
+ *
+ * Note: this value is the Lambda + API Gateway limit. It lives here (in the
+ * compute-agnostic parser) because Lambda is the only compute path today. When
+ * a non-API-Gateway compute (e.g. container/ALB) is introduced, this should
+ * become compute-aware — sourced from / overridden by the compute layer (via
+ * the Compute `setEnv` config hook) rather than a fixed constant in `core` —
+ * since an ALB has a different payload limit. Tracked with the multi-compute work.
+ */
+export const MAX_RPC_BODY_BYTES = 10 * 1024 * 1024;
 /** Reserved JSON-RPC error codes. */
 export const RpcErrorCode = {
     ParseError: -32700,
@@ -58,6 +79,19 @@ export function decodeRpcResponse(body) {
  * anything about the JSON-RPC spec.
  */
 export function parseRpcRequest(bodyText) {
+    // Reject oversized bodies before parsing or dispatch. See MAX_RPC_BODY_BYTES
+    // for the limit and its rationale.
+    if (Buffer.byteLength(bodyText, 'utf8') > MAX_RPC_BODY_BYTES) {
+        // Emit the real HTTP status (413) as the error code, not a reserved -32xxx:
+        // `decodeRpcResponse` maps a positive code straight to `ApiError.status`
+        // (reserved codes collapse to 500), mirroring the 504 handler-timeout path,
+        // so a caller's `e.status === 413` works. `name` (which crosses the wire,
+        // not the code) lets callers match with `isBlocksError(e, 'PayloadTooLarge')`.
+        return {
+            ok: false,
+            response: errorResponse(413, `Request body exceeds the ${MAX_RPC_BODY_BYTES} byte (${MAX_RPC_BODY_BYTES / (1024 * 1024)} MiB) limit`, null, { name: 'PayloadTooLarge' }),
+        };
+    }
     let parsed;
     try {
         parsed = JSON.parse(bodyText || '{}');
@@ -79,15 +113,24 @@ export function parseRpcRequest(bodyText) {
             response: errorResponse(RpcErrorCode.InvalidRequest, 'Invalid Request: method must be "namespace.method"', id, { name: 'InvalidRequest' }),
         };
     }
+    const hasParams = Object.hasOwn(parsed, 'params');
+    if (hasParams && (parsed.params === null || typeof parsed.params !== 'object')) {
+        return {
+            ok: false,
+            response: errorResponse(RpcErrorCode.InvalidParams, 'Invalid params: expected an array or object', id, { name: 'InvalidParams' }),
+        };
+    }
+    let args = [];
+    if (hasParams) {
+        args = Array.isArray(parsed.params) ? parsed.params : Object.values(parsed.params);
+    }
     return {
         ok: true,
         request: {
             apiNamespace: parsed.method.substring(0, dotIndex),
             method: parsed.method.substring(dotIndex + 1),
             // JSON-RPC 2.0 §4.2: params may be an array (positional) or object (named).
-            args: Array.isArray(parsed.params)
-                ? parsed.params
-                : Object.values(parsed.params ?? {}),
+            args,
             id,
         },
     };

package/dist/rpc.test.js

@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: Apache-2.0
 import { describe, it } from 'node:test';
 import assert from 'node:assert';
-import { decodeRpcResponse, errorResponseFromCatch, parseRpcRequest, RpcErrorCode } from './rpc.js';
+import { decodeRpcResponse, errorResponseFromCatch, parseRpcRequest, RpcErrorCode, MAX_RPC_BODY_BYTES } from './rpc.js';
 import { ApiError, isBlocksError } from './errors.js';
 describe('-32600 Invalid Request error shape', () => {
     it('returns proper JSON-RPC 2.0 envelope with error code', () => {
@@ -82,6 +82,26 @@ describe('params decoding', () => {
             assert.deepStrictEqual(result.request.args, []);
     });
 });
+describe('-32602 Invalid Params validation', () => {
+    for (const params of ['abc', 42, true, false, null]) {
+        it(`rejects ${JSON.stringify(params)} params`, () => {
+            const result = parseRpcRequest(JSON.stringify({
+                jsonrpc: '2.0',
+                method: 'api.echo',
+                params,
+                id: 'request-1',
+            }));
+            assert.strictEqual(result.ok, false);
+            if (!result.ok) {
+                const response = JSON.parse(result.response);
+                assert.strictEqual(response.error.code, RpcErrorCode.InvalidParams);
+                assert.strictEqual(response.error.data.name, 'InvalidParams');
+                assert.ok(response.error.message.includes('expected an array or object'));
+                assert.strictEqual(response.id, 'request-1');
+            }
+        });
+    }
+});
 describe('batch requests (top-level JSON array body)', () => {
     it('rejects an array body as Invalid Request with a null id', () => {
         const result = parseRpcRequest(JSON.stringify([
@@ -134,3 +154,40 @@ describe('ApiError status ↔ JSON-RPC error code', () => {
         assert.throws(() => decodeRpcResponse({ jsonrpc: '2.0', error: { code: RpcErrorCode.InvalidRequest, message: 'Invalid Request' }, id: null }), (e) => e instanceof ApiError && e.status === 500);
     });
 });
+describe('request body size limit', () => {
+    it('accepts a normal-sized body', () => {
+        const result = parseRpcRequest(JSON.stringify({ jsonrpc: '2.0', method: 'ns.method', params: [], id: 1 }));
+        assert.strictEqual(result.ok, true);
+    });
+    it('rejects a body larger than MAX_RPC_BODY_BYTES with a PayloadTooLarge error', () => {
+        // A JSON string just over the limit (a single huge param value).
+        const huge = 'x'.repeat(MAX_RPC_BODY_BYTES + 1);
+        const body = JSON.stringify({ jsonrpc: '2.0', method: 'ns.method', params: [huge], id: 1 });
+        assert.ok(Buffer.byteLength(body, 'utf8') > MAX_RPC_BODY_BYTES);
+        const result = parseRpcRequest(body);
+        assert.strictEqual(result.ok, false);
+        if (result.ok)
+            return; // narrow
+        const parsed = JSON.parse(result.response);
+        // Positive HTTP status (413), not a reserved -32xxx — so decodeRpcResponse
+        // surfaces it to the client as ApiError.status === 413.
+        assert.strictEqual(parsed.error.code, 413);
+        assert.strictEqual(parsed.error.data?.name, 'PayloadTooLarge');
+        assert.match(parsed.error.message, /exceeds/);
+        assert.match(parsed.error.message, /10 MiB/); // human-readable size crosses the wire
+        // Client round-trip: decodeRpcResponse surfaces it as ApiError.status 413
+        // (not 500), so consumer `e.status === 413` handling works.
+        assert.throws(() => decodeRpcResponse(parsed), (e) => e instanceof ApiError && e.status === 413 && isBlocksError(e, 'PayloadTooLarge'));
+    });
+    it('rejects an oversized body before attempting to parse it (invalid JSON still 413s, not a ParseError)', () => {
+        // Oversized AND not valid JSON — the size guard must win, proving the body
+        // is rejected before the (expensive) parse + before any handler/DB touch.
+        const oversizedGarbage = 'x'.repeat(MAX_RPC_BODY_BYTES + 1);
+        const result = parseRpcRequest(oversizedGarbage);
+        assert.strictEqual(result.ok, false);
+        if (result.ok)
+            return;
+        const parsed = JSON.parse(result.response);
+        assert.strictEqual(parsed.error.data?.name, 'PayloadTooLarge');
+    });
+});

package/dist/scripts/config.d.ts

@@ -0,0 +1,15 @@
+/** Set (create or overwrite) a Blocks config value. */
+export declare function setConfig(key: string, value: string, opts?: {
+    stage?: string;
+}): Promise<void>;
+/** List Blocks config keys (names only). */
+export declare function listConfig(opts?: {
+    stage?: string;
+}): Promise<string[]>;
+/** Remove a Blocks config value. */
+export declare function removeConfig(key: string, opts?: {
+    stage?: string;
+}): Promise<boolean>;
+/** CLI dispatcher for `blocks config <set|list|remove> …`. */
+export declare function runConfigCli(argv: string[]): Promise<void>;
+//# sourceMappingURL=config.d.ts.map

package/dist/scripts/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/scripts/config.ts"],"names":[],"mappings":"AAgBA,uDAAuD;AACvD,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAElG;AAED,4CAA4C;AAC5C,wBAAgB,UAAU,CAAC,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAE3E;AAED,oCAAoC;AACpC,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAEzF;AAED,8DAA8D;AAC9D,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAE1D"}

package/dist/scripts/config.js

@@ -0,0 +1,29 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * `blocks config` — manage a Blocks app's non-sensitive **config** values (SSM
+ * Parameter Store), pinned to the Blocks `/blocks/<stackId>/config` namespace
+ * (scoped to the app's stable `stackId` from `.blocks/config.json`). Thin wrapper
+ * over the shared `@aws-blocks/hosting` CLI with the kind fixed to `config`. The
+ * `secret` counterpart is `./secret.ts`.
+ *
+ * @module
+ */
+import { listValues, removeValue, runValueCli, setValue } from '@aws-blocks/hosting/scripts';
+import { blocksConfigPrefix } from '../secret-naming.js';
+/** Set (create or overwrite) a Blocks config value. */
+export function setConfig(key, value, opts = {}) {
+    return setValue('config', key, value, { prefix: blocksConfigPrefix(), ...opts });
+}
+/** List Blocks config keys (names only). */
+export function listConfig(opts = {}) {
+    return listValues('config', { prefix: blocksConfigPrefix(), ...opts });
+}
+/** Remove a Blocks config value. */
+export function removeConfig(key, opts = {}) {
+    return removeValue('config', key, { prefix: blocksConfigPrefix(), ...opts });
+}
+/** CLI dispatcher for `blocks config <set|list|remove> …`. */
+export function runConfigCli(argv) {
+    return runValueCli(argv, { kind: 'config', prefix: blocksConfigPrefix(), label: 'blocks config' });
+}

package/dist/scripts/deploy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/scripts/deploy.ts"],"names":[],"mappings":"AAaA,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,wBAAsB,MAAM,CAAC,OAAO,EAAE,aAAa,iBAiGlD"}
+{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/scripts/deploy.ts"],"names":[],"mappings":"AAcA,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,wBAAsB,MAAM,CAAC,OAAO,EAAE,aAAa,iBAqGlD"}

package/dist/scripts/deploy.js

@@ -5,6 +5,7 @@ import { readFileSync, writeFileSync, mkdirSync } from 'node:fs';
 import { join, resolve, dirname } from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { ensureSecrets, loadProductionEnv } from './ensure-secrets.js';
+import { assertAwsCredentials } from './preflight-credentials.js';
 import { applyExternalMigrations } from './external-migrations-step.js';
 import { trackCommand } from '../telemetry/trackCommand.js';
 import { getCdkTelemetryEnv } from './cdk-telemetry-env.js';
@@ -15,6 +16,9 @@ export async function deploy(options) {
         // Load production environment (from .env.production or CI env vars)
         loadProductionEnv();
         process.env.BLOCKS_STAGE = 'production';
+        // Fail fast if AWS credentials are missing/expired, before generating the
+        // client and spending time in synth only to hit an opaque CDK credential error.
+        await assertAwsCredentials('deploy');
         // Provision secrets for production. projectRoot must match the root cdk
         // synth uses (passed as --context below) so the written parameter name
         // equals the one the app resolves at synth.

package/dist/scripts/dev-server.d.ts

@@ -43,6 +43,14 @@ export interface DevServerOptions {
     frontendCommand?: string;
     /** Port the frontend dev server listens on. Default: 3100. */
     frontendPort?: number;
+    /**
+     * Watch `secret()` / `config()` calls and regenerate the type-safe key
+     * augmentation (so `getSecret`/`getConfig` autocomplete and reject typos) as you
+     * edit — all under this one `npm run dev`, no second command. Auto-detected: a
+     * no-op unless the app actually declares a `secret()`/`config()`, and never fatal
+     * (a failure only logs a warning). Set `false` to disable. Default: enabled.
+     */
+    typegen?: boolean;
 }
 /**
  * Single-shot TCP probe: resolves `true` iff a connection to `port` succeeds

package/dist/scripts/dev-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dev-server.d.ts","sourceRoot":"","sources":["../../src/scripts/dev-server.ts"],"names":[],"mappings":"AAsCA,eAAO,MAAM,iBAAiB,QAAiD,CAAC;AAEhF;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CASjF;AAED,sFAAsF;AACtF,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,OAAO,GAAG,SAAS,CAAC;CAClC;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,mBAAmB,CAKvF;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE/E;AAED,MAAM,WAAW,gBAAgB;IAC/B,2CAA2C;IAC3C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oCAAoC;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,8DAA8D;IAC9D,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAiBD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,SAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAa/F;AAYD,+DAA+D;AAC/D,MAAM,WAAW,qBAAqB;IACpC,oFAAoF;IACpF,WAAW,EAAE,MAAM,CAAC;IACpB,2DAA2D;IAC3D,QAAQ,EAAE,MAAM,CAAC;IACjB,yEAAyE;IACzE,SAAS,EAAE,MAAM,CAAC;IAClB,oDAAoD;IACpD,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,uFAAuF;AACvF,eAAO,MAAM,+BAA+B,EAAE,qBAK7C,CAAC;AAEF,kDAAkD;AAClD,MAAM,WAAW,eAAe;IAC9B,oDAAoD;IACpD,OAAO,EAAE,OAAO,CAAC;IACjB,mEAAmE;IACnE,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,uBAAuB,CACrC,cAAc,EAAE,MAAM,EAAE,EACxB,GAAG,EAAE,MAAM,EACX,MAAM,GAAE,qBAAuD,GAC9D,eAAe,CAOjB;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,SAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAOnF;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE;IAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,EAC5E,OAAO,EAAE,OAAO,GACf,OAAO,CAOT;AAID,sCAAsC;AACtC,MAAM,WAAW,aAAa;IAC5B,uDAAuD;IACvD,OAAO,EAAE,OAAO,CAAC;IACjB,oFAAoF;IACpF,SAAS,EAAE,OAAO,CAAC;IACnB,yGAAyG;IACzG,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,kFAAkF;AAClF,MAAM,WAAW,eAAe;IAC9B,4CAA4C;IAC5C,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1C,gDAAgD;IAChD,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;IACrC,6EAA6E;IAC7E,QAAQ,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC;IACxD,kDAAkD;IAClD,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/D;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,OAAO,CAAC,eAAe,CAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAwB3G;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAW3F;AAED,gFAAgF;AAChF,MAAM,WAAW,mBAAmB;IAClC,sEAAsE;IACtE,WAAW,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,oFAAoF;AACpF,eAAO,MAAM,8BAA8B,EAAE,mBAG5C,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,EACf,MAAM,GAAE,mBAAoD,GAC3D;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAGrC;AAED,4GAA4G;AAC5G,MAAM,WAAW,aAAa;IAC5B,0EAA0E;IAC1E,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IAClD,wEAAwE;IACxE,QAAQ,EAAE,MAAM,IAAI,CAAC;IACrB,wEAAwE;IACxE,aAAa,EAAE,CAAC,EAAE,EAAE,MAAM,IAAI,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACzD,+EAA+E;IAC/E,WAAW,EAAE,MAAM,IAAI,CAAC;IACxB,oDAAoD;IACpD,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,aAAa,EACnB,MAAM,GAAE,mBAAoD,GAC3D,MAAM,IAAI,CAwBZ;AAID,8EAA8E;AAC9E,MAAM,WAAW,kBAAkB;IACjC,wCAAwC;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ,mFAAmF;IACnF,IAAI,EAAE,MAAM,CAAC;IACb,8CAA8C;IAC9C,IAAI,EAAE,MAAM,CAAC;CACd;AAED,mGAAmG;AACnG,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI,CAUtE;AAED,wGAAwG;AACxG,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,IAAmC,GAAG,OAAO,CAQ3H;AAED,8GAA8G;AAC9G,MAAM,MAAM,iBAAiB,GAAG;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3F;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,kBAAkB,GAAG,IAAI,EACnC,IAAI,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EACnC,SAAS,EAAE,OAAO,EAClB,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,GAChC,iBAAiB,CASnB;AAED,wBAAsB,cAAc,CAAC,OAAO,EAAE,gBAAgB,iBAmiB7D"}
+{"version":3,"file":"dev-server.d.ts","sourceRoot":"","sources":["../../src/scripts/dev-server.ts"],"names":[],"mappings":"AAsCA,eAAO,MAAM,iBAAiB,QAAiD,CAAC;AAEhF;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CASjF;AAED,sFAAsF;AACtF,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,OAAO,GAAG,SAAS,CAAC;CAClC;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,mBAAmB,CAKvF;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE/E;AAED,MAAM,WAAW,gBAAgB;IAC/B,2CAA2C;IAC3C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oCAAoC;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,8DAA8D;IAC9D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AA0CD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,SAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAa/F;AAYD,+DAA+D;AAC/D,MAAM,WAAW,qBAAqB;IACpC,oFAAoF;IACpF,WAAW,EAAE,MAAM,CAAC;IACpB,2DAA2D;IAC3D,QAAQ,EAAE,MAAM,CAAC;IACjB,yEAAyE;IACzE,SAAS,EAAE,MAAM,CAAC;IAClB,oDAAoD;IACpD,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,uFAAuF;AACvF,eAAO,MAAM,+BAA+B,EAAE,qBAK7C,CAAC;AAEF,kDAAkD;AAClD,MAAM,WAAW,eAAe;IAC9B,oDAAoD;IACpD,OAAO,EAAE,OAAO,CAAC;IACjB,mEAAmE;IACnE,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,uBAAuB,CACrC,cAAc,EAAE,MAAM,EAAE,EACxB,GAAG,EAAE,MAAM,EACX,MAAM,GAAE,qBAAuD,GAC9D,eAAe,CAOjB;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,SAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAOnF;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE;IAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,EAC5E,OAAO,EAAE,OAAO,GACf,OAAO,CAOT;AAID,sCAAsC;AACtC,MAAM,WAAW,aAAa;IAC5B,uDAAuD;IACvD,OAAO,EAAE,OAAO,CAAC;IACjB,oFAAoF;IACpF,SAAS,EAAE,OAAO,CAAC;IACnB,yGAAyG;IACzG,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,kFAAkF;AAClF,MAAM,WAAW,eAAe;IAC9B,4CAA4C;IAC5C,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1C,gDAAgD;IAChD,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;IACrC,6EAA6E;IAC7E,QAAQ,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC;IACxD,kDAAkD;IAClD,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/D;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,OAAO,CAAC,eAAe,CAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAwB3G;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAW3F;AAED,gFAAgF;AAChF,MAAM,WAAW,mBAAmB;IAClC,sEAAsE;IACtE,WAAW,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,oFAAoF;AACpF,eAAO,MAAM,8BAA8B,EAAE,mBAG5C,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,EACf,MAAM,GAAE,mBAAoD,GAC3D;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAGrC;AAED,4GAA4G;AAC5G,MAAM,WAAW,aAAa;IAC5B,0EAA0E;IAC1E,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IAClD,wEAAwE;IACxE,QAAQ,EAAE,MAAM,IAAI,CAAC;IACrB,wEAAwE;IACxE,aAAa,EAAE,CAAC,EAAE,EAAE,MAAM,IAAI,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACzD,+EAA+E;IAC/E,WAAW,EAAE,MAAM,IAAI,CAAC;IACxB,oDAAoD;IACpD,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,aAAa,EACnB,MAAM,GAAE,mBAAoD,GAC3D,MAAM,IAAI,CAwBZ;AAID,8EAA8E;AAC9E,MAAM,WAAW,kBAAkB;IACjC,wCAAwC;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ,mFAAmF;IACnF,IAAI,EAAE,MAAM,CAAC;IACb,8CAA8C;IAC9C,IAAI,EAAE,MAAM,CAAC;CACd;AAED,mGAAmG;AACnG,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI,CAUtE;AAED,wGAAwG;AACxG,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,IAAmC,GAAG,OAAO,CAQ3H;AAED,8GAA8G;AAC9G,MAAM,MAAM,iBAAiB,GAAG;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3F;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,kBAAkB,GAAG,IAAI,EACnC,IAAI,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EACnC,SAAS,EAAE,OAAO,EAClB,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,GAChC,iBAAiB,CASnB;AAED,wBAAsB,cAAc,CAAC,OAAO,EAAE,gBAAgB,iBA0iB7D"}

package/dist/scripts/dev-server.js

@@ -75,6 +75,31 @@ export function buildBlocksConfig(port, isSandbox) {
 export function isBlocksConfigRequest(method, pathname) {
     return method === 'GET' && pathname === `${BLOCKS_SANDBOX_PREFIX}/config.json`;
 }
+/**
+ * Bootstrap the type-safe `getSecret`/`getConfig` key generation for the dev
+ * session. Auto-detected and non-fatal: scans the app for `secret()`/`config()`
+ * calls and, only if it finds any, generates the augmentation `.d.ts` and starts a
+ * watcher that regenerates on save — so a single `npm run dev` gives type-safe keys
+ * with no second command. Returns a `stop()` (or `undefined` when the app declares
+ * no secrets, typegen is unavailable, or it is disabled). The watcher is `unref`'d
+ * so it can never block the dev server's shutdown.
+ */
+async function startTypegenWatch() {
+    try {
+        const { scanValueKeys, watchHostingValues } = await import('@aws-blocks/hosting/scripts');
+        const scan = await scanValueKeys();
+        if (scan.secretKeys.length === 0 && scan.configKeys.length === 0) {
+            return undefined; // app doesn't use secret()/config() → nothing to type, skip silently
+        }
+        console.log('🔑 Type-safe secret()/config() keys — watching for changes...');
+        return await watchHostingValues({ unref: true });
+    }
+    catch (error) {
+        // Never break the dev server over typegen (e.g. `typescript` not installed).
+        console.warn(`⚠️  hosting-typegen skipped: ${error instanceof Error ? error.message : String(error)}`);
+        return undefined;
+    }
+}
 /**
  * Initialize all building blocks that have an initialize() method.
  * This is the "local deploy" phase - mirrors CDK deploy.
@@ -790,6 +815,11 @@ export async function startDevServer(options) {
         console.log('📝 Generating client code...');
         await writeClientCode(resolvedPath, clientPath);
     }
+    // Type-safe getSecret/getConfig: generate + watch the key augmentation so the
+    // getters autocomplete and reject typos, regenerating on save — all under this
+    // one `npm run dev`. Auto-detected (no-op unless the app uses secret()/config())
+    // and non-fatal.
+    const stopTypegen = options.typegen === false ? undefined : await startTypegenWatch();
     // ── Startup reclaim ──────────────────────────────────────────────────────
     // Free any port left bound by a crashed / SIGKILL'd predecessor before we bind
     // the front door or spawn the `--strictPort` frontend. tsx-watch only gives the
@@ -875,6 +905,7 @@ export async function startDevServer(options) {
             clearTimeout(respawnTimer);
             respawnTimer = null;
         }
+        stopTypegen?.(); // tear down the typegen watcher (unref'd, but close it cleanly)
         // Detach our own listeners so repeated signals can't pile up handlers.
         for (const sig of signals)
             process.removeListener(sig, cleanup);

package/dist/scripts/generate-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate-client.d.ts","sourceRoot":"","sources":["../../src/scripts/generate-client.ts"],"names":[],"mappings":"AAQA;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA4DhF;AAED;;GAEG;AACH,wBAAsB,eAAe,CAAC,cAAc,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAI/F"}
+{"version":3,"file":"generate-client.d.ts","sourceRoot":"","sources":["../../src/scripts/generate-client.ts"],"names":[],"mappings":"AASA;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAgEhF;AAED;;GAEG;AACH,wBAAsB,eAAe,CAAC,cAAc,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAI/F"}

package/dist/scripts/generate-client.js

@@ -1,8 +1,9 @@
 // Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
-import { writeFileSync, mkdirSync } from 'fs';
-import { dirname } from 'path';
-import { pathToFileURL } from 'url';
+import { isManagedValue } from '@aws-blocks/hosting';
+import { mkdirSync, writeFileSync } from 'node:fs';
+import { dirname } from 'node:path';
+import { pathToFileURL } from 'node:url';
 import { API_NAMESPACE_MARKER } from '../api.js';
 /**
  * Generate browser-safe client code from backend exports.
@@ -43,6 +44,10 @@ export async function generateClientCode(foundationPath) {
         const isScope = typeof value?.id === 'string' && typeof value?.fullId === 'string';
         if (isScope)
             continue;
+        // A secret()/config() marker is a deferred value, not an API — skip it, or
+        // `export const k = secret('K')` in index.ts would become a bogus HTTP namespace.
+        if (isManagedValue(value))
+            continue;
         // Fallback: any exported function/object gets an ApiNamespace proxy.
         if ((typeof value === 'function' || typeof value === 'object') && value !== null) {
             lines.push(`export const ${name} = __BLOCKS_ApiNamespaceClient__('${name}');`);
@@ -50,7 +55,7 @@ export async function generateClientCode(foundationPath) {
         }
     }
     // Emit generateClient — creates new ApiNamespaceClient instances with the given url
-    const nsEntries = namespaceNames.map(n => `    ${n}: __BLOCKS_ApiNamespaceClient__('${n}', config),`).join('\n');
+    const nsEntries = namespaceNames.map((n) => `    ${n}: __BLOCKS_ApiNamespaceClient__('${n}', config),`).join('\n');
     lines.push('');
     lines.push(`export const generateClient = (config) => ({\n${nsEntries}\n});`);
     const header = [

package/dist/scripts/generate-client.test.js

@@ -1,11 +1,11 @@
 // Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
-import { describe, it, beforeEach, afterEach } from 'node:test';
 import assert from 'node:assert';
+import { afterEach, beforeEach, describe, it } from 'node:test';
+import { mkdirSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
 import { generateClientCode } from './generate-client.js';
-import { writeFileSync, mkdirSync, rmSync } from 'fs';
-import { join } from 'path';
-import { tmpdir } from 'os';
 /**
  * Regression test: generateClientCode collects middleware from whatever
  * the backend registers via registerClientMiddleware(). In sandbox mode,
@@ -45,4 +45,19 @@ describe('generateClientCode — middleware collection', () => {
         assert.ok(code.includes("import '@aws-blocks/bb-realtime/mock-middleware'"), 'Generated client must include mock-middleware in local dev mode');
         assert.ok(!code.includes('aws-middleware'), 'Generated client must NOT include aws-middleware in local dev mode');
     });
+    it('skips secret()/config() markers — they are values, not API namespaces', async () => {
+        // A secret()/config() marker is branded with Symbol.for('@aws-blocks/hosting.ManagedValue');
+        // build one inline so the fixture needs no imports. A real export still gets a proxy.
+        const backendPath = join(tmpDir, 'backend.mjs');
+        writeFileSync(backendPath, `
+				const BRAND = Symbol.for('@aws-blocks/hosting.ManagedValue');
+				export const stripeKey = { [BRAND]: true, key: 'STRIPE_KEY', kind: 'secret' };
+				export const featureFlags = { [BRAND]: true, key: 'FEATURE_FLAGS', kind: 'config' };
+				export function realApi() {}
+			`);
+        const code = await generateClientCode(backendPath);
+        assert.ok(!code.includes("__BLOCKS_ApiNamespaceClient__('stripeKey')"), 'a secret() marker must not become an HTTP namespace');
+        assert.ok(!code.includes("__BLOCKS_ApiNamespaceClient__('featureFlags')"), 'a config() marker must not become an HTTP namespace');
+        assert.ok(code.includes("export const realApi = __BLOCKS_ApiNamespaceClient__('realApi')"), 'a real (non-marker) export still becomes a namespace');
+    });
 });

package/dist/scripts/index.d.ts

@@ -1,13 +1,16 @@
-export { startDevServer, type DevServerOptions } from './dev-server.js';
-export { startSandbox, destroySandbox, type SandboxOptions } from './sandbox.js';
+export { type BuildAndSendEventOptions, buildAndSendEvent, type CommandName, type CommandState, classifyError, trackCommand, } from '../telemetry/index.js';
+export { listConfig, removeConfig, runConfigCli, setConfig } from './config.js';
+export { type ConsoleOptions, openConsole } from './console.js';
+export { type DeployOptions, deploy } from './deploy.js';
+export { type DestroyOptions, destroy } from './destroy.js';
+export { type DevServerOptions, startDevServer } from './dev-server.js';
+export { ensureSecrets, loadEnvFile, loadProductionEnv } from './ensure-secrets.js';
 export { generateClientCode, writeClientCode } from './generate-client.js';
 export { generateSpec, writeSpec } from './generate-spec.js';
-export { validateSpec, type SpecValidationError } from './validate-spec.js';
-export { deploy, type DeployOptions } from './deploy.js';
-export { destroy, type DestroyOptions } from './destroy.js';
-export { openConsole, type ConsoleOptions } from './console.js';
-export { ensureSecrets, loadProductionEnv, loadEnvFile } from './ensure-secrets.js';
-export { trackCommand, buildAndSendEvent, classifyError, type CommandName, type CommandState, type BuildAndSendEventOptions, } from '../telemetry/index.js';
-export { telemetry, type TelemetryOptions } from './telemetry.js';
-export { getStackId, getSandboxId, getStackName } from './stack-id.js';
+export { destroySandbox, type SandboxOptions, startSandbox } from './sandbox.js';
+export { listSecrets, removeSecret, runSecretCli, setSecret } from './secret.js';
+export { getSandboxId, getStackId, getStackName } from './stack-id.js';
+export { type TelemetryOptions, telemetry } from './telemetry.js';
+export { runTypegenCli } from './typegen.js';
+export { type SpecValidationError, validateSpec } from './validate-spec.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/scripts/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/scripts/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,cAAc,EAAE,KAAK,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AACjF,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,KAAK,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EAAE,MAAM,EAAE,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EAAE,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACpF,OAAO,EACL,YAAY,EACZ,iBAAiB,EACjB,aAAa,EACb,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,wBAAwB,GAC9B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,SAAS,EAAE,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/scripts/index.ts"],"names":[],"mappings":"AAGA,OAAO,EACN,KAAK,wBAAwB,EAC7B,iBAAiB,EACjB,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,aAAa,EACb,YAAY,GACZ,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAChF,OAAO,EAAE,KAAK,cAAc,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EAAE,KAAK,cAAc,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAE,KAAK,gBAAgB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACpF,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,KAAK,cAAc,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjF,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EAAE,KAAK,gBAAgB,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,KAAK,mBAAmB,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/scripts/index.js

@@ -1,14 +1,17 @@
 // Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
+export { buildAndSendEvent, classifyError, trackCommand, } from '../telemetry/index.js';
+export { listConfig, removeConfig, runConfigCli, setConfig } from './config.js';
+export { openConsole } from './console.js';
+export { deploy } from './deploy.js';
+export { destroy } from './destroy.js';
 export { startDevServer } from './dev-server.js';
-export { startSandbox, destroySandbox } from './sandbox.js';
+export { ensureSecrets, loadEnvFile, loadProductionEnv } from './ensure-secrets.js';
 export { generateClientCode, writeClientCode } from './generate-client.js';
 export { generateSpec, writeSpec } from './generate-spec.js';
-export { validateSpec } from './validate-spec.js';
-export { deploy } from './deploy.js';
-export { destroy } from './destroy.js';
-export { openConsole } from './console.js';
-export { ensureSecrets, loadProductionEnv, loadEnvFile } from './ensure-secrets.js';
-export { trackCommand, buildAndSendEvent, classifyError, } from '../telemetry/index.js';
+export { destroySandbox, startSandbox } from './sandbox.js';
+export { listSecrets, removeSecret, runSecretCli, setSecret } from './secret.js';
+export { getSandboxId, getStackId, getStackName } from './stack-id.js';
 export { telemetry } from './telemetry.js';
-export { getStackId, getSandboxId, getStackName } from './stack-id.js';
+export { runTypegenCli } from './typegen.js';
+export { validateSpec } from './validate-spec.js';

package/dist/scripts/preflight-credentials.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Resolve the region for the STS probe from the environment. Returns `null`
+ * when neither `AWS_REGION` nor `AWS_DEFAULT_REGION` is set — the caller then
+ * skips the probe rather than guessing a region, because a hardcoded guess
+ * (e.g. `us-east-1`) belongs to a different **partition** than GovCloud
+ * (`us-gov-*`) or China (`cn-*`) and would fail against a partition the user
+ * isn't even deploying to.
+ */
+export declare function resolveProbeRegion(env?: NodeJS.ProcessEnv): string | null;
+/**
+ * Probe that resolves when valid AWS credentials are available for `region` and
+ * rejects otherwise. Injectable so the guard can be unit-tested without network
+ * or real credentials; production callers use the default {@link stsProbe}.
+ */
+export type CredentialProbe = (region: string) => Promise<void>;
+/**
+ * Verify AWS credentials before a deploy command spends time synthesizing, and
+ * fail fast with actionable guidance when they're missing, expired, or invalid.
+ *
+ * Skips silently (with a warning) when no region can be resolved from the
+ * environment, and treats network/service errors as non-fatal — see the module
+ * doc for the rationale.
+ *
+ * @param command - The npm script name, used in the messages (e.g. `sandbox`, `deploy`).
+ * @param probe - Credential probe; defaults to STS GetCallerIdentity. Override in tests.
+ * @param env - Environment to resolve the region from. Defaults to `process.env`.
+ * @throws {Error} With actionable guidance when the probe reports a credential error.
+ */
+export declare function assertAwsCredentials(command: string, probe?: CredentialProbe, env?: NodeJS.ProcessEnv): Promise<void>;
+//# sourceMappingURL=preflight-credentials.d.ts.map

package/dist/scripts/preflight-credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"preflight-credentials.d.ts","sourceRoot":"","sources":["../../src/scripts/preflight-credentials.ts"],"names":[],"mappings":"AAmCA;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,GAAG,IAAI,CAEtF;AAED;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAyBhE;;;;;;;;;;;;GAYG;AACH,wBAAsB,oBAAoB,CACzC,OAAO,EAAE,MAAM,EACf,KAAK,GAAE,eAA0B,EACjC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAClC,OAAO,CAAC,IAAI,CAAC,CAoCf"}

package/dist/scripts/preflight-credentials.js

@@ -0,0 +1,108 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Pre-deploy AWS credential check.
+ *
+ * `cdk deploy` spends ~10 seconds synthesizing the app before it makes its
+ * first AWS call, so a missing or expired credential surfaces only *after* that
+ * wasted synth — as an opaque CDK/CloudFormation error that doesn't name the
+ * real cause. Calling STS GetCallerIdentity up front turns that into an
+ * immediate, actionable message the moment a deploy command starts.
+ *
+ * The check is intentionally conservative: it fails fast **only** on a real
+ * credential problem (missing/expired/invalid). A network or service error
+ * (STS unreachable, throttled, disabled in a region) is not treated as a
+ * credential failure — it warns and lets the deploy proceed, since blocking on
+ * an unverifiable probe would reject a deploy that might have worked.
+ */
+/**
+ * Error `name`s that mean the credentials themselves are missing, expired, or
+ * invalid — the cases where the "configure your credentials" remediation is
+ * correct. Anything else (network, throttling, an explicit `AccessDenied` — which
+ * actually proves the identity resolved) is surfaced as itself instead.
+ */
+const CREDENTIAL_ERROR_NAMES = new Set([
+    'CredentialsProviderError',
+    'ExpiredToken',
+    'ExpiredTokenException',
+    'InvalidClientTokenId',
+    'UnrecognizedClientException',
+    'SignatureDoesNotMatch',
+    'TokenRefreshRequired',
+]);
+/**
+ * Resolve the region for the STS probe from the environment. Returns `null`
+ * when neither `AWS_REGION` nor `AWS_DEFAULT_REGION` is set — the caller then
+ * skips the probe rather than guessing a region, because a hardcoded guess
+ * (e.g. `us-east-1`) belongs to a different **partition** than GovCloud
+ * (`us-gov-*`) or China (`cn-*`) and would fail against a partition the user
+ * isn't even deploying to.
+ */
+export function resolveProbeRegion(env = process.env) {
+    return env.AWS_REGION || env.AWS_DEFAULT_REGION || null;
+}
+/**
+ * Default probe: STS GetCallerIdentity via the SDK's standard credential chain
+ * (env vars, shared config/credentials, SSO, container/instance roles).
+ *
+ * Dynamically imported so the STS client is only loaded when a deploy actually
+ * runs — never during dev-server startup or a mock unit test. Bounded with a
+ * short request timeout and a single attempt (matching `common/config.ts`) so a
+ * bad network can't make this hang *longer* than the synth it's replacing.
+ */
+const stsProbe = async (region) => {
+    const { STSClient, GetCallerIdentityCommand } = await import('@aws-sdk/client-sts');
+    const client = new STSClient({
+        region,
+        maxAttempts: 1,
+        requestHandler: { connectionTimeout: 2000, requestTimeout: 3000 },
+    });
+    try {
+        await client.send(new GetCallerIdentityCommand({}));
+    }
+    finally {
+        client.destroy();
+    }
+};
+/**
+ * Verify AWS credentials before a deploy command spends time synthesizing, and
+ * fail fast with actionable guidance when they're missing, expired, or invalid.
+ *
+ * Skips silently (with a warning) when no region can be resolved from the
+ * environment, and treats network/service errors as non-fatal — see the module
+ * doc for the rationale.
+ *
+ * @param command - The npm script name, used in the messages (e.g. `sandbox`, `deploy`).
+ * @param probe - Credential probe; defaults to STS GetCallerIdentity. Override in tests.
+ * @param env - Environment to resolve the region from. Defaults to `process.env`.
+ * @throws {Error} With actionable guidance when the probe reports a credential error.
+ */
+export async function assertAwsCredentials(command, probe = stsProbe, env = process.env) {
+    const region = resolveProbeRegion(env);
+    if (!region) {
+        console.warn(`⚠️  Skipping the AWS credential pre-check for \`npm run ${command}\`: ` +
+            'no region set in AWS_REGION / AWS_DEFAULT_REGION. The deploy will surface any credential error itself.');
+        return;
+    }
+    try {
+        await probe(region);
+    }
+    catch (error) {
+        // Use the error *name* only — never the raw message, which for an STS
+        // authorization failure embeds the caller ARN and account id (and this
+        // Error propagates through telemetry).
+        const name = error instanceof Error && error.name ? error.name : 'UnknownError';
+        if (CREDENTIAL_ERROR_NAMES.has(name)) {
+            throw new Error(`AWS credentials could not be verified for \`npm run ${command}\` (${name}).\n` +
+                'Configure AWS credentials — for example:\n' +
+                '  • run `aws configure` (or `aws sso login`), or\n' +
+                '  • set AWS_PROFILE to a configured profile, or\n' +
+                '  • export AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY (and AWS_SESSION_TOKEN for temporary credentials).\n' +
+                `Then re-run \`npm run ${command}\`.`);
+        }
+        // Not a credential problem (network, throttling, STS disabled in-region, …).
+        // Don't block a deploy that might still work — warn and continue.
+        console.warn(`⚠️  Could not verify AWS credentials for \`npm run ${command}\` (${name}); ` +
+            'continuing — the deploy will report any real error.');
+    }
+}

package/dist/scripts/preflight-credentials.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=preflight-credentials.test.d.ts.map

package/dist/scripts/preflight-credentials.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"preflight-credentials.test.d.ts","sourceRoot":"","sources":["../../src/scripts/preflight-credentials.test.ts"],"names":[],"mappings":""}