@aws-blocks/core 0.1.4 → 0.1.10

package/src/hosting.test.ts

@@ -1428,4 +1428,83 @@ describe('Hosting', () => {
       template.resourceCountIs('AWS::CloudFront::Distribution', 1);
     });
   });
+
+  // ── basePath prop (caller-declared source of truth) ─────────
+  // Under KVS edge routing, basePath is no longer expressed as a per-behavior
+  // PathPattern prefix — it lives in the KVS route table's `meta.bp`, which the
+  // edge router uses for the canonical 308 + static strip. So these tests read
+  // the basePath out of the RouteStoreKeys custom resource's Entries.
+  describe('basePath prop', () => {
+    const metaBasePath = (root: string, basePath?: string): string => {
+      const app = new App();
+      const stack = new Stack(app, 'BasePathStack', {
+        env: { account: '123456789012', region: 'us-east-1' },
+      });
+      new Hosting(stack, 'Web', {
+        root,
+        framework: 'spa',
+        buildOutputDir: 'dist',
+        ...(basePath !== undefined ? { basePath } : {}),
+      });
+      const tpl = Template.fromStack(stack).toJSON() as {
+        Resources: Record<string, { Type: string; Properties?: any }>;
+      };
+      const kvKeys = Object.entries(tpl.Resources).find(
+        ([id, r]) =>
+          r.Type === 'AWS::CloudFormation::CustomResource' &&
+          /RouteStoreKeys/.test(id),
+      );
+      assert.ok(kvKeys, 'expected a RouteStoreKeys custom resource');
+      const entries = JSON.parse(kvKeys![1].Properties.Entries);
+      const meta = JSON.parse(entries.meta);
+      return meta.bp as string;
+    };
+
+    it('records basePath in the KVS route table when set (SPA, no framework base)', () => {
+      createSpaBuildOutput(tmpDir);
+      assert.strictEqual(metaBasePath(tmpDir, '/app'), '/app');
+    });
+
+    it('normalizes a trailing slash (/app/ → /app)', () => {
+      createSpaBuildOutput(tmpDir);
+      assert.strictEqual(metaBasePath(tmpDir, '/app/'), '/app');
+    });
+
+    it('treats "/" as no base path', () => {
+      createSpaBuildOutput(tmpDir);
+      assert.strictEqual(metaBasePath(tmpDir, '/'), '');
+    });
+  });
+
+  // ── P0.4: config.json ordering dependency ────────────────────
+  describe('config.json deploy ordering (P0.4)', () => {
+    it('BlocksConfigDeployment depends on the asset deployments', () => {
+      // The asset deployments upload the whole static dir — including the
+      // placeholder `.blocks-sandbox/config.json` — to the same key the
+      // resolved config writes to. Without an ordering dependency the
+      // placeholder can clobber the real config. The previous
+      // `tryFindChild('AssetDeployment')` never matched the real child ids
+      // (AssetDeploymentImmutable/Html/Mutable), so the dep was never wired.
+      createSpaBuildOutput(tmpDir);
+      const app = new App();
+      const stack = new Stack(app, 'ConfigOrderStack');
+      new Hosting(stack, 'Hosting', { root: tmpDir, api: MOCK_API });
+
+      const tpl = Template.fromStack(stack).toJSON() as {
+        Resources: Record<string, { Type: string; DependsOn?: string[] }>;
+      };
+      const configId = Object.keys(tpl.Resources).find(
+        (id) => /BlocksConfigDeployment/.test(id) && /CustomResource/.test(id),
+      );
+      assert.ok(configId, 'expected a BlocksConfigDeployment custom resource');
+
+      const dependsOn = tpl.Resources[configId].DependsOn ?? [];
+      const assetDeps = dependsOn.filter((d) => /AssetDeployment/.test(d));
+      assert.ok(
+        assetDeps.length >= 1,
+        `BlocksConfigDeployment must DependsOn the asset deployment(s); ` +
+          `found DependsOn=${JSON.stringify(dependsOn)}`,
+      );
+    });
+  });
 });

package/src/hosting.ts

@@ -26,6 +26,7 @@ import {
 import {
   detectFramework,
   getAdapter,
+  normalizeBasePath,
   type FrameworkAdapterFn,
 } from '@aws-blocks/hosting/adapters';
 import type {
@@ -71,8 +72,29 @@ export type ComputeConfig = {
    * ```
    */
   timeout?: cdk.Duration | number;
-  /** Reserved concurrent executions. Default: undefined (no reservation). */
+  /** Reserved concurrent executions for the SSR Lambda. Default: undefined (no reservation). */
   reservedConcurrency?: number;
+  /**
+   * Overrides for the image-optimization Lambda.
+   *
+   * `reservedConcurrency` defaults to undefined (no reservation). It is left
+   * unreserved so deploys succeed on fresh AWS accounts, whose default
+   * account-level unreserved-concurrency limit is 10 — reserving any
+   * concurrency there can drop the account below its required minimum and
+   * cause Lambda to reject the stack with a 400. Set this only if you have
+   * headroom and want to cap image-opt throughput.
+   *
+   * @example
+   * ```ts
+   * compute: {
+   *   imageOptimization: { reservedConcurrency: 5 },
+   * }
+   * ```
+   */
+  imageOptimization?: {
+    /** Reserved concurrent executions. Default: undefined (no reservation). */
+    reservedConcurrency?: number;
+  };
   /** CloudWatch log retention for the SSR Lambda. Default: TWO_WEEKS. */
   logRetention?: cdk.aws_logs.RetentionDays;
 };
@@ -129,6 +151,27 @@ export interface HostingProps {
   /** Supply a custom adapter when using an unsupported framework. */
   customAdapter?: FrameworkAdapterFn;
 
+  /**
+   * URL prefix the whole site is served under (Next.js `basePath`, Astro
+   * `base`, Nuxt `app.baseURL`). When set, CloudFront behaviors are prefixed
+   * with it and the bare root issues a 308 redirect to `/<basePath>/`.
+   *
+   * Declaring it here is the recommended source of truth: the value is
+   * caller-provided rather than reverse-engineered from build output, so it
+   * can't drift with framework/bundler internals. When omitted, the adapter
+   * falls back to detecting the framework's own base-path config from the
+   * build output.
+   *
+   * Format: leading slash, no trailing slash (e.g. `'/app'`). A trailing
+   * slash or bare `'/'` is normalized/ignored.
+   *
+   * @example
+   * ```ts
+   * new Hosting(stack, 'Web', { root, framework: 'nuxt', basePath: '/app' });
+   * ```
+   */
+  basePath?: string;
+
   // ── Blocks backend integration ────────────────────────────────────
   /**
    * The Blocks backend stack (or any object with `apiUrl`).
@@ -183,6 +226,36 @@ export interface HostingProps {
     countries: string[];
   };
 
+  /**
+   * Overrides for the adjustable AWS Service Quotas the CloudFront
+   * distribution draws on. Each field maps to a named AWS quota you can
+   * request an increase on:
+   *
+   *   - `cacheBehaviors` — "Cache behaviors per distribution" (default 25).
+   *     Consumed by routed paths, prerendered pages, per-pattern header
+   *     rules, assetPrefix, and the error-page behavior.
+   *   - `edgeFunctions` — Lambda@Edge associations per distribution
+   *     (default 25). Consumed by `runtime: 'edge'` routes.
+   *   - `headerPolicies` — "Response headers policies per AWS account"
+   *     (default 20, account-wide).
+   *
+   * Omitted fields use the AWS default. Set a field ONLY to match a quota
+   * increase AWS has actually granted — synth cannot verify your real quota,
+   * so an over-set value does not raise the AWS ceiling; it just moves the
+   * failure from a clear synth error to an opaque CloudFormation rollback.
+   *
+   * @example
+   * ```ts
+   * // After AWS grants "Cache behaviors per distribution" = 50:
+   * new Hosting(stack, 'Web', { root, quotas: { cacheBehaviors: 50 } });
+   * ```
+   */
+  quotas?: {
+    cacheBehaviors?: number;
+    edgeFunctions?: number;
+    headerPolicies?: number;
+  };
+
   /**
    * Build cache configuration. When enabled, provisions an S3 bucket for
    * framework build caches (e.g. Next.js .next/cache) and exports the bucket
@@ -380,6 +453,23 @@ export class Hosting extends Construct {
       manifest.buildId = generateBuildId();
     }
 
+    // ── 4b'. basePath: prop is the source of truth ───────────────
+    //    A caller-declared `basePath` overrides whatever the adapter
+    //    detected from build output. This is the robust path: the value
+    //    is provided rather than reverse-engineered from framework/bundler
+    //    internals (which drift across versions). When the prop is omitted,
+    //    the adapter's detected `manifest.basePath` (if any) stands.
+    if (props.basePath !== undefined) {
+      const normalized = normalizeBasePath(props.basePath);
+      if (normalized) {
+        manifest.basePath = normalized;
+      } else {
+        // Explicit '/' (or empty) means "no base path" — clear any value
+        // the adapter may have detected so the prop genuinely wins.
+        delete manifest.basePath;
+      }
+    }
+
     // ── 4c. Prevent duplicate error pages ────────────────────────
     //    The adapter may auto-detect error pages (e.g. SPA adapter finds
     //    404.html in build output and sets manifest.errorPages). When the
@@ -449,11 +539,12 @@ export class Hosting extends Construct {
       storage: props.retainOnDelete != null
         ? { retainOnDelete: props.retainOnDelete }
         : undefined,
-      cdn: (props.contentSecurityPolicy || props.priceClass || props.geoRestriction)
+      cdn: (props.contentSecurityPolicy || props.priceClass || props.geoRestriction || props.quotas)
         ? {
             contentSecurityPolicy: props.contentSecurityPolicy,
             priceClass: props.priceClass,
             geoRestriction: props.geoRestriction,
+            quotas: props.quotas,
           }
         : undefined,
       logging: props.logging,
@@ -471,17 +562,26 @@ export class Hosting extends Construct {
     }
 
     // ── 7a. Inject Blocks env vars into compute functions ───────────
-    const primaryFunction = hosting.computeFunctions.values().next().value as cdk.aws_lambda.Function | undefined;
+    // Lambda@Edge functions (edge-runtime routes) do NOT support environment
+    // variables — they surface in computeFunctions as EdgeFunction/IVersion
+    // without an `addEnvironment` method. Skip any function that can't take
+    // env vars instead of crashing (`fn.addEnvironment is not a function`).
+    const canAddEnv = (
+      fn: unknown,
+    ): fn is cdk.aws_lambda.Function =>
+      typeof (fn as { addEnvironment?: unknown })?.addEnvironment === 'function';
+
+    const primaryFunction = [...hosting.computeFunctions.values()].find(
+      canAddEnv,
+    );
 
     for (const [, fn] of hosting.computeFunctions) {
+      if (!canAddEnv(fn)) continue; // Lambda@Edge: no env var support
       if (props.api) {
-        (fn as cdk.aws_lambda.Function).addEnvironment('BLOCKS_API_URL', props.api.apiUrl);
+        fn.addEnvironment('BLOCKS_API_URL', props.api.apiUrl);
       }
       if (props.backendConfig) {
-        (fn as cdk.aws_lambda.Function).addEnvironment(
-          'BLOCKS_CONFIG',
-          JSON.stringify(props.backendConfig),
-        );
+        fn.addEnvironment('BLOCKS_CONFIG', JSON.stringify(props.backendConfig));
       }
     }
 
@@ -500,11 +600,25 @@ export class Hosting extends Construct {
         cacheControl: [s3deploy.CacheControl.fromString('public, max-age=60, must-revalidate')],
       });
 
-      // Ensure config deployment runs after the hosting construct's
-      // asset deployment so the resolved config.json is not overwritten.
-      const assetDeployment = hosting.node.tryFindChild('AssetDeployment') as Construct | undefined;
-      if (assetDeployment) {
-        configDeployment.node.addDependency(assetDeployment);
+      // Ensure the config deployment runs AFTER the hosting construct's
+      // asset deployments. Those deployments upload the whole static dir —
+      // which includes the *placeholder* `.blocks-sandbox/config.json`
+      // (`{_placeholder:true}`) written during synth — to the same
+      // `builds/<id>/.blocks-sandbox/config.json` key this deployment writes
+      // the resolved config to. Without an ordering dependency the
+      // placeholder can land last and clobber the real config.
+      //
+      // We depend on EVERY BucketDeployment under the hosting construct
+      // rather than a single hard-coded child id: the real children are
+      // `AssetDeploymentImmutable` / `AssetDeploymentHtml` / `...Mutable`
+      // (and vary by deploy shape), so the previous
+      // `tryFindChild('AssetDeployment')` never matched and the dependency
+      // was silently never wired.
+      const assetDeployments = hosting.node
+        .findAll()
+        .filter((c): c is s3deploy.BucketDeployment => c instanceof s3deploy.BucketDeployment);
+      for (const dep of assetDeployments) {
+        configDeployment.node.addDependency(dep);
       }
     }
 

package/src/index.cdk.ts

@@ -3,7 +3,7 @@
 
 export { ApiNamespace, type BlocksContext, type ApiHandler } from './api.js';
 export { BLOCKS_RPC_PREFIX, BLOCKS_AUTH_PREFIX } from './constants.js';
-export { ApiError, isBlocksError } from './errors.js';
+export { ApiError, isBlocksError, hasAuthError, DEFAULT_API_ERROR_NAME } from './errors.js';
 export { EventSourceMapping } from './lambda-handler.js';
 export { BlocksStackProps } from './common/index.js';
 export { registerSdkIdentifiers, getSdkIdentifiers, getAllSdkIdentifiers, _resetSdkRegistry } from './common/sdk-registry.js';

package/src/index.ts

@@ -3,7 +3,7 @@
 
 export { ApiNamespace, type BlocksContext, type ApiHandler } from './api.js';
 export { BLOCKS_RPC_PREFIX, BLOCKS_AUTH_PREFIX } from './constants.js';
-export { ApiError, isBlocksError } from './errors.js';
+export { ApiError, isBlocksError, hasAuthError, DEFAULT_API_ERROR_NAME } from './errors.js';
 export { Scope, type ScopeOptions, type ScopeParent, type BuildingBlockMeta } from './common/index.js';
 export { registerSdkIdentifiers, getSdkIdentifiers, getAllSdkIdentifiers, _resetSdkRegistry } from './common/sdk-registry.js';
 export { getConfig, getConfigSync, preloadConfig, loadConfigToProcessEnv, _resetConfigCache } from './common/config.js';

package/src/scripts/deploy.ts

@@ -25,8 +25,10 @@ export async function deploy(options: DeployOptions) {
 
     process.env.BLOCKS_STAGE = 'production';
 
-    // Provision secrets for production
-    const secrets = await ensureSecrets('production');
+    // Provision secrets for production. projectRoot must match the root cdk
+    // synth uses (passed as --context below) so the written parameter name
+    // equals the one the app resolves at synth.
+    const secrets = await ensureSecrets('production', options.projectRoot);
     if (secrets.created.length > 0 || secrets.updated.length > 0) {
       console.log(`🔐 Secrets provisioned: ${[...secrets.created, ...secrets.updated].join(', ')}`);
     }