@aws-blocks/core 0.1.7 → 0.1.10

package/dist/db-naming.d.ts

@@ -3,9 +3,15 @@
  * database connection string, and for the project ref derived from a Postgres
  * connection string.
  *
- * Both the deploy-time provisioner (`ensure-secrets`) and the `db pull`
- * generated code derive this name from the stage alone. Keep this the only
- * place the name is constructed.
+ * The connection-string parameter name is **stack-scoped** (embeds the
+ * deployment's stack name), so two Blocks apps in the same account + region +
+ * stage get distinct names and cannot overwrite each other's credentials.
+ *
+ * Two call sites compute the name: the pre-deploy writer (`ensure-secrets`) and
+ * the `db pull` generated wiring at synth. Both pass the result of
+ * `getStackName({ sandbox, projectRoot })` into this function, so they produce
+ * the same name by construction. The runtime Lambda does not call this function;
+ * it reads the name recorded at synth.
  */
 /**
  * Extract a stable identifier from a Postgres connection string.
@@ -16,6 +22,12 @@
  * to a sanitized hostname for non-Supabase hosts.
  */
 export declare function extractDbRef(connectionString: string): string;
-/** SSM parameter name storing the connection string for a given stage. */
-export declare function dbConnectionParameterName(stage: string): string;
+/**
+ * SSM SecureString parameter name for a deployment's external database
+ * connection string.
+ *
+ * Pure string transform: `/<stackName>-db-url`. The caller is responsible for
+ * computing the stack name via `getStackName({ sandbox, projectRoot })`.
+ */
+export declare function dbConnectionParameterName(stackName: string): string;
 //# sourceMappingURL=db-naming.d.ts.map

package/dist/db-naming.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"db-naming.d.ts","sourceRoot":"","sources":["../src/db-naming.ts"],"names":[],"mappings":"AAGA;;;;;;;;GAQG;AAEH;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,gBAAgB,EAAE,MAAM,GAAG,MAAM,CAc7D;AAED,0EAA0E;AAC1E,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE/D"}
+{"version":3,"file":"db-naming.d.ts","sourceRoot":"","sources":["../src/db-naming.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;GAcG;AAEH;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,gBAAgB,EAAE,MAAM,GAAG,MAAM,CAc7D;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEnE"}

package/dist/db-naming.js

@@ -5,9 +5,15 @@
  * database connection string, and for the project ref derived from a Postgres
  * connection string.
  *
- * Both the deploy-time provisioner (`ensure-secrets`) and the `db pull`
- * generated code derive this name from the stage alone. Keep this the only
- * place the name is constructed.
+ * The connection-string parameter name is **stack-scoped** (embeds the
+ * deployment's stack name), so two Blocks apps in the same account + region +
+ * stage get distinct names and cannot overwrite each other's credentials.
+ *
+ * Two call sites compute the name: the pre-deploy writer (`ensure-secrets`) and
+ * the `db pull` generated wiring at synth. Both pass the result of
+ * `getStackName({ sandbox, projectRoot })` into this function, so they produce
+ * the same name by construction. The runtime Lambda does not call this function;
+ * it reads the name recorded at synth.
  */
 /**
  * Extract a stable identifier from a Postgres connection string.
@@ -32,7 +38,13 @@ export function extractDbRef(connectionString) {
         return host[1].replace(/\./g, '-');
     throw new Error('Cannot extract database identifier from connection string.');
 }
-/** SSM parameter name storing the connection string for a given stage. */
-export function dbConnectionParameterName(stage) {
-    return `/blocks/${stage}/db-connection-string`;
+/**
+ * SSM SecureString parameter name for a deployment's external database
+ * connection string.
+ *
+ * Pure string transform: `/<stackName>-db-url`. The caller is responsible for
+ * computing the stack name via `getStackName({ sandbox, projectRoot })`.
+ */
+export function dbConnectionParameterName(stackName) {
+    return `/${stackName}-db-url`;
 }

package/dist/db-naming.test.js

@@ -1,8 +1,12 @@
 // Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
-import { test, describe } from 'node:test';
+import { test, describe, afterEach } from 'node:test';
 import assert from 'node:assert';
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from 'node:fs';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
 import { extractDbRef, dbConnectionParameterName } from './db-naming.js';
+import { getStackName } from './scripts/stack-id.js';
 describe('extractDbRef', () => {
     test('pooler form (postgres.{ref}@) yields ref', () => {
         assert.strictEqual(extractDbRef('postgresql://postgres.abcdef:pw@aws-0-us-east-1.pooler.supabase.com:6543/postgres'), 'abcdef');
@@ -23,7 +27,44 @@ describe('extractDbRef', () => {
     });
 });
 describe('dbConnectionParameterName', () => {
-    test('composes the stage into the SSM name', () => {
-        assert.strictEqual(dbConnectionParameterName('production'), '/blocks/production/db-connection-string');
+    test('formats stack name into parameter path', () => {
+        assert.strictEqual(dbConnectionParameterName('my-app-k7x2mf-prod'), '/my-app-k7x2mf-prod-db-url');
+    });
+    test('two distinct stack names produce distinct parameter names', () => {
+        assert.notStrictEqual(dbConnectionParameterName('app-a-111111-prod'), dbConnectionParameterName('app-b-222222-prod'));
+    });
+});
+describe('cross-site invariant: write name == read name', () => {
+    let tmpDir;
+    let originalCwd;
+    afterEach(() => {
+        if (originalCwd)
+            process.chdir(originalCwd);
+        if (tmpDir)
+            rmSync(tmpDir, { recursive: true, force: true });
+    });
+    function setupProject(stackId, sandboxId) {
+        tmpDir = mkdtempSync(join(tmpdir(), 'cross-site-'));
+        mkdirSync(join(tmpDir, '.blocks'), { recursive: true });
+        writeFileSync(join(tmpDir, '.blocks', 'config.json'), JSON.stringify({ stackId }));
+        mkdirSync(join(tmpDir, '.blocks-sandbox'), { recursive: true });
+        writeFileSync(join(tmpDir, '.blocks-sandbox', 'sandbox-id.txt'), sandboxId);
+        return tmpDir;
+    }
+    test('write-side name == read-side name (sandbox)', () => {
+        const root = setupProject('my-app-k7x2mf', 'alice-0d7e1c');
+        const writeName = dbConnectionParameterName(getStackName({ sandbox: true, projectRoot: root }));
+        originalCwd = process.cwd();
+        process.chdir(root);
+        const readName = dbConnectionParameterName(getStackName({ sandbox: true }));
+        assert.strictEqual(writeName, readName);
+    });
+    test('write-side name == read-side name (production)', () => {
+        const root = setupProject('my-app-k7x2mf', 'alice-0d7e1c');
+        const writeName = dbConnectionParameterName(getStackName({ sandbox: false, projectRoot: root }));
+        originalCwd = process.cwd();
+        process.chdir(root);
+        const readName = dbConnectionParameterName(getStackName({ sandbox: false }));
+        assert.strictEqual(writeName, readName);
     });
 });

package/dist/hosting.d.ts

@@ -105,6 +105,26 @@ export interface HostingProps {
     buildOutputDir?: string;
     /** Supply a custom adapter when using an unsupported framework. */
     customAdapter?: FrameworkAdapterFn;
+    /**
+     * URL prefix the whole site is served under (Next.js `basePath`, Astro
+     * `base`, Nuxt `app.baseURL`). When set, CloudFront behaviors are prefixed
+     * with it and the bare root issues a 308 redirect to `/<basePath>/`.
+     *
+     * Declaring it here is the recommended source of truth: the value is
+     * caller-provided rather than reverse-engineered from build output, so it
+     * can't drift with framework/bundler internals. When omitted, the adapter
+     * falls back to detecting the framework's own base-path config from the
+     * build output.
+     *
+     * Format: leading slash, no trailing slash (e.g. `'/app'`). A trailing
+     * slash or bare `'/'` is normalized/ignored.
+     *
+     * @example
+     * ```ts
+     * new Hosting(stack, 'Web', { root, framework: 'nuxt', basePath: '/app' });
+     * ```
+     */
+    basePath?: string;
     /**
      * The Blocks backend stack (or any object with `apiUrl`).
      *
@@ -148,6 +168,35 @@ export interface HostingProps {
         type: 'whitelist' | 'blacklist';
         countries: string[];
     };
+    /**
+     * Overrides for the adjustable AWS Service Quotas the CloudFront
+     * distribution draws on. Each field maps to a named AWS quota you can
+     * request an increase on:
+     *
+     *   - `cacheBehaviors` — "Cache behaviors per distribution" (default 25).
+     *     Consumed by routed paths, prerendered pages, per-pattern header
+     *     rules, assetPrefix, and the error-page behavior.
+     *   - `edgeFunctions` — Lambda@Edge associations per distribution
+     *     (default 25). Consumed by `runtime: 'edge'` routes.
+     *   - `headerPolicies` — "Response headers policies per AWS account"
+     *     (default 20, account-wide).
+     *
+     * Omitted fields use the AWS default. Set a field ONLY to match a quota
+     * increase AWS has actually granted — synth cannot verify your real quota,
+     * so an over-set value does not raise the AWS ceiling; it just moves the
+     * failure from a clear synth error to an opaque CloudFormation rollback.
+     *
+     * @example
+     * ```ts
+     * // After AWS grants "Cache behaviors per distribution" = 50:
+     * new Hosting(stack, 'Web', { root, quotas: { cacheBehaviors: 50 } });
+     * ```
+     */
+    quotas?: {
+        cacheBehaviors?: number;
+        edgeFunctions?: number;
+        headerPolicies?: number;
+    };
     /**
      * Build cache configuration. When enabled, provisions an S3 bucket for
      * framework build caches (e.g. Next.js .next/cache) and exports the bucket

package/dist/hosting.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hosting.d.ts","sourceRoot":"","sources":["../src/hosting.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,GAAG,MAAM,aAAa,CAAC;AASnC,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAKvC,OAAO,EAIL,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EAC1B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAGL,KAAK,kBAAkB,EACxB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAGV,aAAa,EACd,MAAM,qBAAqB,CAAC;AAO7B;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,8CAA8C;IAC9C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,EAAE,GAAG,CAAC,QAAQ,GAAG,MAAM,CAAC;IAChC,8FAA8F;IAC9F,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;;;;;;;;;;;OAgBG;IACH,iBAAiB,CAAC,EAAE;QAClB,2EAA2E;QAC3E,mBAAmB,CAAC,EAAE,MAAM,CAAC;KAC9B,CAAC;IACF,uEAAuE;IACvE,YAAY,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC;CAC3C,CAAC;AAEF,YAAY,EAAE,aAAa,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,CAAC;AAE3F;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,mHAAmH;IACnH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,YAAY;IAE3B,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAC;IAEb;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;;OAGG;IACH,SAAS,CAAC,EAAE,aAAa,CAAC;IAE1B;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,mEAAmE;IACnE,aAAa,CAAC,EAAE,kBAAkB,CAAC;IAGnC;;;;;;;;OAQG;IACH,GAAG,CAAC,EAAE,cAAc,CAAC;IAErB;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAGxC,uDAAuD;IACvD,OAAO,CAAC,EAAE,aAAa,CAAC;IAExB,mCAAmC;IACnC,MAAM,CAAC,EAAE,mBAAmB,CAAC;IAE7B,oCAAoC;IACpC,GAAG,CAAC,EAAE,gBAAgB,CAAC;IAEvB,sEAAsE;IACtE,cAAc,CAAC,EAAE,OAAO,CAAC;IAEzB,mDAAmD;IACnD,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAE/B,wDAAwD;IACxD,UAAU,CAAC,EAAE,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC;IAE3C;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE;QACf,IAAI,EAAE,WAAW,GAAG,WAAW,CAAC;QAChC,SAAS,EAAE,MAAM,EAAE,CAAC;KACrB,CAAC;IAEF;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE;QACX,OAAO,EAAE,OAAO,CAAC;QACjB,0EAA0E;QAC1E,MAAM,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC;KAC7B,CAAC;IAEF;;;;;;;;;;;;;OAaG;IACH,UAAU,CAAC,EAAE;QACX,iEAAiE;QACjE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,iEAAiE;QACjE,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IAEF;;;OAGG;IACH,OAAO,CAAC,EAAE;QACR,wCAAwC;QACxC,OAAO,EAAE,OAAO,CAAC;QACjB,+CAA+C;QAC/C,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;IAEF;;;;;;OAMG;IACH,UAAU,CAAC,EAAE;QACX,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,6DAA6D;QAC7D,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IAEF;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,oBAAoB,CAAC;CACvC;AAYD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,qBAAa,OAAQ,SAAQ,SAAS;IACpC,2CAA2C;IAC3C,SAAgB,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC;IAC1C,mCAAmC;IACnC,SAAgB,YAAY,EAAE,GAAG,CAAC,cAAc,CAAC,YAAY,CAAC;IAC9D,yDAAyD;IACzD,SAAgB,GAAG,EAAE,MAAM,CAAC;IAC5B,gFAAgF;IAChF,SAAgB,WAAW,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC;IACtD,wFAAwF;IACxF,SAAgB,gBAAgB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC;IACrD,2FAA2F;IAC3F,SAAgB,eAAe,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;gBAEzC,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY;IA6O7D;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IAOvB;;OAEG;IACH,OAAO,CAAC,eAAe;CAwDxB"}
+{"version":3,"file":"hosting.d.ts","sourceRoot":"","sources":["../src/hosting.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,GAAG,MAAM,aAAa,CAAC;AASnC,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAKvC,OAAO,EAIL,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EAC1B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAIL,KAAK,kBAAkB,EACxB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAGV,aAAa,EACd,MAAM,qBAAqB,CAAC;AAO7B;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,8CAA8C;IAC9C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,EAAE,GAAG,CAAC,QAAQ,GAAG,MAAM,CAAC;IAChC,8FAA8F;IAC9F,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;;;;;;;;;;;OAgBG;IACH,iBAAiB,CAAC,EAAE;QAClB,2EAA2E;QAC3E,mBAAmB,CAAC,EAAE,MAAM,CAAC;KAC9B,CAAC;IACF,uEAAuE;IACvE,YAAY,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC;CAC3C,CAAC;AAEF,YAAY,EAAE,aAAa,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,CAAC;AAE3F;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,mHAAmH;IACnH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,YAAY;IAE3B,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAC;IAEb;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;;OAGG;IACH,SAAS,CAAC,EAAE,aAAa,CAAC;IAE1B;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,mEAAmE;IACnE,aAAa,CAAC,EAAE,kBAAkB,CAAC;IAEnC;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAGlB;;;;;;;;OAQG;IACH,GAAG,CAAC,EAAE,cAAc,CAAC;IAErB;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAGxC,uDAAuD;IACvD,OAAO,CAAC,EAAE,aAAa,CAAC;IAExB,mCAAmC;IACnC,MAAM,CAAC,EAAE,mBAAmB,CAAC;IAE7B,oCAAoC;IACpC,GAAG,CAAC,EAAE,gBAAgB,CAAC;IAEvB,sEAAsE;IACtE,cAAc,CAAC,EAAE,OAAO,CAAC;IAEzB,mDAAmD;IACnD,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAE/B,wDAAwD;IACxD,UAAU,CAAC,EAAE,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC;IAE3C;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE;QACf,IAAI,EAAE,WAAW,GAAG,WAAW,CAAC;QAChC,SAAS,EAAE,MAAM,EAAE,CAAC;KACrB,CAAC;IAEF;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,MAAM,CAAC,EAAE;QACP,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;IAEF;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE;QACX,OAAO,EAAE,OAAO,CAAC;QACjB,0EAA0E;QAC1E,MAAM,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC;KAC7B,CAAC;IAEF;;;;;;;;;;;;;OAaG;IACH,UAAU,CAAC,EAAE;QACX,iEAAiE;QACjE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,iEAAiE;QACjE,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IAEF;;;OAGG;IACH,OAAO,CAAC,EAAE;QACR,wCAAwC;QACxC,OAAO,EAAE,OAAO,CAAC;QACjB,+CAA+C;QAC/C,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;IAEF;;;;;;OAMG;IACH,UAAU,CAAC,EAAE;QACX,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,6DAA6D;QAC7D,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IAEF;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,oBAAoB,CAAC;CACvC;AAYD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,qBAAa,OAAQ,SAAQ,SAAS;IACpC,2CAA2C;IAC3C,SAAgB,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC;IAC1C,mCAAmC;IACnC,SAAgB,YAAY,EAAE,GAAG,CAAC,cAAc,CAAC,YAAY,CAAC;IAC9D,yDAAyD;IACzD,SAAgB,GAAG,EAAE,MAAM,CAAC;IAC5B,gFAAgF;IAChF,SAAgB,WAAW,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC;IACtD,wFAAwF;IACxF,SAAgB,gBAAgB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC;IACrD,2FAA2F;IAC3F,SAAgB,eAAe,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;gBAEzC,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY;IAsR7D;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IAOvB;;OAEG;IACH,OAAO,CAAC,eAAe;CAwDxB"}

package/dist/hosting.js

@@ -9,7 +9,7 @@ import { execSync } from 'node:child_process';
 import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
 import { join, resolve } from 'node:path';
 import { HostingConstruct, generateBuildId, } from '@aws-blocks/hosting/constructs';
-import { detectFramework, getAdapter, } from '@aws-blocks/hosting/adapters';
+import { detectFramework, getAdapter, normalizeBasePath, } from '@aws-blocks/hosting/adapters';
 import { BLOCKS_RPC_PREFIX, BLOCKS_AUTH_PREFIX } from './constants.js';
 import { registerConfig } from './cdk/config-registry.js';
 import { getRegisteredRoutes } from './raw-route.js';
@@ -123,6 +123,23 @@ export class Hosting extends Construct {
         if (!manifest.buildId) {
             manifest.buildId = generateBuildId();
         }
+        // ── 4b'. basePath: prop is the source of truth ───────────────
+        //    A caller-declared `basePath` overrides whatever the adapter
+        //    detected from build output. This is the robust path: the value
+        //    is provided rather than reverse-engineered from framework/bundler
+        //    internals (which drift across versions). When the prop is omitted,
+        //    the adapter's detected `manifest.basePath` (if any) stands.
+        if (props.basePath !== undefined) {
+            const normalized = normalizeBasePath(props.basePath);
+            if (normalized) {
+                manifest.basePath = normalized;
+            }
+            else {
+                // Explicit '/' (or empty) means "no base path" — clear any value
+                // the adapter may have detected so the prop genuinely wins.
+                delete manifest.basePath;
+            }
+        }
         // ── 4c. Prevent duplicate error pages ────────────────────────
         //    The adapter may auto-detect error pages (e.g. SPA adapter finds
         //    404.html in build output and sets manifest.errorPages). When the
@@ -185,11 +202,12 @@ export class Hosting extends Construct {
             storage: props.retainOnDelete != null
                 ? { retainOnDelete: props.retainOnDelete }
                 : undefined,
-            cdn: (props.contentSecurityPolicy || props.priceClass || props.geoRestriction)
+            cdn: (props.contentSecurityPolicy || props.priceClass || props.geoRestriction || props.quotas)
                 ? {
                     contentSecurityPolicy: props.contentSecurityPolicy,
                     priceClass: props.priceClass,
                     geoRestriction: props.geoRestriction,
+                    quotas: props.quotas,
                 }
                 : undefined,
             logging: props.logging,
@@ -204,8 +222,15 @@ export class Hosting extends Construct {
             this.addApiBehaviors(hosting, props.api.apiUrl);
         }
         // ── 7a. Inject Blocks env vars into compute functions ───────────
-        const primaryFunction = hosting.computeFunctions.values().next().value;
+        // Lambda@Edge functions (edge-runtime routes) do NOT support environment
+        // variables — they surface in computeFunctions as EdgeFunction/IVersion
+        // without an `addEnvironment` method. Skip any function that can't take
+        // env vars instead of crashing (`fn.addEnvironment is not a function`).
+        const canAddEnv = (fn) => typeof fn?.addEnvironment === 'function';
+        const primaryFunction = [...hosting.computeFunctions.values()].find(canAddEnv);
         for (const [, fn] of hosting.computeFunctions) {
+            if (!canAddEnv(fn))
+                continue; // Lambda@Edge: no env var support
             if (props.api) {
                 fn.addEnvironment('BLOCKS_API_URL', props.api.apiUrl);
             }
@@ -227,11 +252,25 @@ export class Hosting extends Construct {
                 distributionPaths: ['/.blocks-sandbox/*'],
                 cacheControl: [s3deploy.CacheControl.fromString('public, max-age=60, must-revalidate')],
             });
-            // Ensure config deployment runs after the hosting construct's
-            // asset deployment so the resolved config.json is not overwritten.
-            const assetDeployment = hosting.node.tryFindChild('AssetDeployment');
-            if (assetDeployment) {
-                configDeployment.node.addDependency(assetDeployment);
+            // Ensure the config deployment runs AFTER the hosting construct's
+            // asset deployments. Those deployments upload the whole static dir —
+            // which includes the *placeholder* `.blocks-sandbox/config.json`
+            // (`{_placeholder:true}`) written during synth — to the same
+            // `builds/<id>/.blocks-sandbox/config.json` key this deployment writes
+            // the resolved config to. Without an ordering dependency the
+            // placeholder can land last and clobber the real config.
+            //
+            // We depend on EVERY BucketDeployment under the hosting construct
+            // rather than a single hard-coded child id: the real children are
+            // `AssetDeploymentImmutable` / `AssetDeploymentHtml` / `...Mutable`
+            // (and vary by deploy shape), so the previous
+            // `tryFindChild('AssetDeployment')` never matched and the dependency
+            // was silently never wired.
+            const assetDeployments = hosting.node
+                .findAll()
+                .filter((c) => c instanceof s3deploy.BucketDeployment);
+            for (const dep of assetDeployments) {
+                configDeployment.node.addDependency(dep);
             }
         }
         // ── 9. Register public origin + CORS hosting origin into S3 config ──

package/dist/hosting.test.js

@@ -1074,4 +1074,64 @@ describe('Hosting', () => {
             template.resourceCountIs('AWS::CloudFront::Distribution', 1);
         });
     });
+    // ── basePath prop (caller-declared source of truth) ─────────
+    // Under KVS edge routing, basePath is no longer expressed as a per-behavior
+    // PathPattern prefix — it lives in the KVS route table's `meta.bp`, which the
+    // edge router uses for the canonical 308 + static strip. So these tests read
+    // the basePath out of the RouteStoreKeys custom resource's Entries.
+    describe('basePath prop', () => {
+        const metaBasePath = (root, basePath) => {
+            const app = new App();
+            const stack = new Stack(app, 'BasePathStack', {
+                env: { account: '123456789012', region: 'us-east-1' },
+            });
+            new Hosting(stack, 'Web', {
+                root,
+                framework: 'spa',
+                buildOutputDir: 'dist',
+                ...(basePath !== undefined ? { basePath } : {}),
+            });
+            const tpl = Template.fromStack(stack).toJSON();
+            const kvKeys = Object.entries(tpl.Resources).find(([id, r]) => r.Type === 'AWS::CloudFormation::CustomResource' &&
+                /RouteStoreKeys/.test(id));
+            assert.ok(kvKeys, 'expected a RouteStoreKeys custom resource');
+            const entries = JSON.parse(kvKeys[1].Properties.Entries);
+            const meta = JSON.parse(entries.meta);
+            return meta.bp;
+        };
+        it('records basePath in the KVS route table when set (SPA, no framework base)', () => {
+            createSpaBuildOutput(tmpDir);
+            assert.strictEqual(metaBasePath(tmpDir, '/app'), '/app');
+        });
+        it('normalizes a trailing slash (/app/ → /app)', () => {
+            createSpaBuildOutput(tmpDir);
+            assert.strictEqual(metaBasePath(tmpDir, '/app/'), '/app');
+        });
+        it('treats "/" as no base path', () => {
+            createSpaBuildOutput(tmpDir);
+            assert.strictEqual(metaBasePath(tmpDir, '/'), '');
+        });
+    });
+    // ── P0.4: config.json ordering dependency ────────────────────
+    describe('config.json deploy ordering (P0.4)', () => {
+        it('BlocksConfigDeployment depends on the asset deployments', () => {
+            // The asset deployments upload the whole static dir — including the
+            // placeholder `.blocks-sandbox/config.json` — to the same key the
+            // resolved config writes to. Without an ordering dependency the
+            // placeholder can clobber the real config. The previous
+            // `tryFindChild('AssetDeployment')` never matched the real child ids
+            // (AssetDeploymentImmutable/Html/Mutable), so the dep was never wired.
+            createSpaBuildOutput(tmpDir);
+            const app = new App();
+            const stack = new Stack(app, 'ConfigOrderStack');
+            new Hosting(stack, 'Hosting', { root: tmpDir, api: MOCK_API });
+            const tpl = Template.fromStack(stack).toJSON();
+            const configId = Object.keys(tpl.Resources).find((id) => /BlocksConfigDeployment/.test(id) && /CustomResource/.test(id));
+            assert.ok(configId, 'expected a BlocksConfigDeployment custom resource');
+            const dependsOn = tpl.Resources[configId].DependsOn ?? [];
+            const assetDeps = dependsOn.filter((d) => /AssetDeployment/.test(d));
+            assert.ok(assetDeps.length >= 1, `BlocksConfigDeployment must DependsOn the asset deployment(s); ` +
+                `found DependsOn=${JSON.stringify(dependsOn)}`);
+        });
+    });
 });

package/dist/scripts/deploy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/scripts/deploy.ts"],"names":[],"mappings":"AAaA,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,wBAAsB,MAAM,CAAC,OAAO,EAAE,aAAa,iBAwFlD"}
+{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/scripts/deploy.ts"],"names":[],"mappings":"AAaA,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,wBAAsB,MAAM,CAAC,OAAO,EAAE,aAAa,iBA0FlD"}

package/dist/scripts/deploy.js

@@ -15,8 +15,10 @@ export async function deploy(options) {
         // Load production environment (from .env.production or CI env vars)
         loadProductionEnv();
         process.env.BLOCKS_STAGE = 'production';
-        // Provision secrets for production
-        const secrets = await ensureSecrets('production');
+        // Provision secrets for production. projectRoot must match the root cdk
+        // synth uses (passed as --context below) so the written parameter name
+        // equals the one the app resolves at synth.
+        const secrets = await ensureSecrets('production', options.projectRoot);
         if (secrets.created.length > 0 || secrets.updated.length > 0) {
             console.log(`🔐 Secrets provisioned: ${[...secrets.created, ...secrets.updated].join(', ')}`);
         }

package/dist/scripts/ensure-secrets.d.ts

@@ -8,9 +8,12 @@ export declare function findConnectionString(): {
     value: string;
 } | null;
 /**
- * Ensure the connection string is stored in SSM for the current stage.
+ * Ensure the connection string is stored in SSM under this app's stack-scoped
+ * parameter name. `projectRoot` locates the committed `.blocks/config.json`
+ * that defines the stack name; it must match the root used at synth (the deploy
+ * commands pass it explicitly) so the written name equals the name the app reads.
  */
-export declare function ensureSecrets(stage?: 'sandbox' | 'production'): Promise<EnsureSecretsResult>;
+export declare function ensureSecrets(stage?: string, projectRoot?: string): Promise<EnsureSecretsResult>;
 /**
  * Load environment for production deployment.
  *

package/dist/scripts/ensure-secrets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ensure-secrets.d.ts","sourceRoot":"","sources":["../../src/scripts/ensure-secrets.ts"],"names":[],"mappings":"AAkBA,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,wBAAgB,oBAAoB,IAAI;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAO7E;AAED;;GAEG;AACH,wBAAsB,aAAa,CAAC,KAAK,CAAC,EAAE,SAAS,GAAG,YAAY,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAsClG;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,IAAI,IAAI,CAIxC;AAED,4EAA4E;AAC5E,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAelD"}
+{"version":3,"file":"ensure-secrets.d.ts","sourceRoot":"","sources":["../../src/scripts/ensure-secrets.ts"],"names":[],"mappings":"AAuBA,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,wBAAgB,oBAAoB,IAAI;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAO7E;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,KAAK,CAAC,EAAE,MAAM,EACd,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,mBAAmB,CAAC,CAsC9B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,IAAI,IAAI,CAIxC;AAED,4EAA4E;AAC5E,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAelD"}

package/dist/scripts/ensure-secrets.js

@@ -3,15 +3,20 @@
 /**
  * Pre-deploy secret provisioning.
  *
- * Writes the connection string to an SSM SecureString parameter.
- * Parameter name includes the stage to prevent sandbox/prod collision:
- *   /blocks/{stage}/db-connection-string
+ * Writes the connection string to an SSM SecureString parameter. The parameter
+ * name is stack-scoped (`/<stackName>-db-url` via `dbConnectionParameterName`),
+ * so two Blocks apps in the same account/region/stage never collide. The synth
+ * step names the parameter with the same function and the same inputs
+ * (`projectRoot` + stage), so the value written here is read back under the
+ * identical name — which is why this must be given the same `projectRoot` the
+ * deploy command passes to synth.
  *
  * On first deploy: creates the parameter.
  * On subsequent deploys: updates if value changed, no-op otherwise.
  */
 import { existsSync, readFileSync } from 'node:fs';
 import { dbConnectionParameterName } from '../db-naming.js';
+import { getStackName } from './stack-id.js';
 const CONNECTION_STRING_PATTERN = /_(DB_URL|CONNECTION_STRING)$/;
 export function findConnectionString() {
     for (const [name, value] of Object.entries(process.env)) {
@@ -22,9 +27,12 @@ export function findConnectionString() {
     return null;
 }
 /**
- * Ensure the connection string is stored in SSM for the current stage.
+ * Ensure the connection string is stored in SSM under this app's stack-scoped
+ * parameter name. `projectRoot` locates the committed `.blocks/config.json`
+ * that defines the stack name; it must match the root used at synth (the deploy
+ * commands pass it explicitly) so the written name equals the name the app reads.
  */
-export async function ensureSecrets(stage) {
+export async function ensureSecrets(stage, projectRoot) {
     const result = { created: [], updated: [], unchanged: [] };
     const conn = findConnectionString();
     if (!conn)
@@ -32,7 +40,7 @@ export async function ensureSecrets(stage) {
     const resolvedStage = stage ?? process.env.BLOCKS_STAGE ?? 'sandbox';
     const { SSMClient, GetParameterCommand, PutParameterCommand } = await import('@aws-sdk/client-ssm');
     const client = new SSMClient();
-    const parameterName = dbConnectionParameterName(resolvedStage);
+    const parameterName = dbConnectionParameterName(getStackName({ sandbox: resolvedStage !== 'production', projectRoot }));
     let isNew = false;
     try {
         const current = await client.send(new GetParameterCommand({

package/dist/scripts/external-migrations-step.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"external-migrations-step.d.ts","sourceRoot":"","sources":["../../src/scripts/external-migrations-step.ts"],"names":[],"mappings":"AAmCA;;;;;GAKG;AACH;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,kBAAkB,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAI5G;AAcD,MAAM,WAAW,8BAA8B;IAC7C,KAAK,EAAE,SAAS,GAAG,YAAY,CAAC;IAChC,gEAAgE;IAChE,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,SAAS,GAAG,YAAY,GAAG,OAAO,CAErF;AAED;;;;;;;GAOG;AACH,wBAAsB,uBAAuB,CAAC,IAAI,EAAE,8BAA8B,GAAG,OAAO,CAAC,OAAO,CAAC,CAkBpG;AAoBD,qFAAqF;AACrF,wBAAgB,iCAAiC,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAe3E;AAED,2EAA2E;AAC3E,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,OAAO,CAExF;AAuED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,CAAC,EAAE;IAAE,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CA8BnH"}
+{"version":3,"file":"external-migrations-step.d.ts","sourceRoot":"","sources":["../../src/scripts/external-migrations-step.ts"],"names":[],"mappings":"AAoCA;;;;;GAKG;AACH;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,kBAAkB,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAI5G;AAcD,MAAM,WAAW,8BAA8B;IAC7C,KAAK,EAAE,SAAS,GAAG,YAAY,CAAC;IAChC,gEAAgE;IAChE,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,SAAS,GAAG,YAAY,GAAG,OAAO,CAErF;AAED;;;;;;;GAOG;AACH,wBAAsB,uBAAuB,CAAC,IAAI,EAAE,8BAA8B,GAAG,OAAO,CAAC,OAAO,CAAC,CAkBpG;AAoBD,qFAAqF;AACrF,wBAAgB,iCAAiC,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAe3E;AAED,2EAA2E;AAC3E,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,OAAO,CAExF;AA0ED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,CAAC,EAAE;IAAE,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CA8BnH"}

package/dist/scripts/external-migrations-step.js

@@ -25,6 +25,7 @@
 import { existsSync, readdirSync, readFileSync } from 'node:fs';
 import { findConnectionString } from './ensure-secrets.js';
 import { extractDbRef, dbConnectionParameterName } from '../db-naming.js';
+import { getStackName } from './stack-id.js';
 import { runSync } from './run-command.js';
 const DEFAULT_MIGRATIONS_DIR = './migrations';
 /** Default output dir for db-pull generated files (database.types.ts / database.meta.ts). */
@@ -150,7 +151,10 @@ async function productionRefs(devRef) {
     }
     try {
         const { SSMClient, GetParameterCommand } = await import('@aws-sdk/client-ssm');
-        const res = await new SSMClient().send(new GetParameterCommand({ Name: dbConnectionParameterName('production'), WithDecryption: true }));
+        const res = await new SSMClient().send(new GetParameterCommand({
+            Name: dbConnectionParameterName(getStackName({ sandbox: false })),
+            WithDecryption: true,
+        }));
         const v = res.Parameter?.Value;
         const r = v ? safeRef(v) : null;
         if (r)

package/dist/scripts/index.d.ts

@@ -9,5 +9,5 @@ export { openConsole, type ConsoleOptions } from './console.js';
 export { ensureSecrets, loadProductionEnv, loadEnvFile } from './ensure-secrets.js';
 export { trackCommand, buildAndSendEvent, classifyError, type CommandName, type CommandState, type BuildAndSendEventOptions, } from '../telemetry/index.js';
 export { telemetry, type TelemetryOptions } from './telemetry.js';
-export { getStackId, getSandboxId } from './stack-id.js';
+export { getStackId, getSandboxId, getStackName } from './stack-id.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/scripts/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/scripts/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,cAAc,EAAE,KAAK,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AACjF,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,KAAK,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EAAE,MAAM,EAAE,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EAAE,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACpF,OAAO,EACL,YAAY,EACZ,iBAAiB,EACjB,aAAa,EACb,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,wBAAwB,GAC9B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,SAAS,EAAE,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/scripts/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,cAAc,EAAE,KAAK,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AACjF,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,KAAK,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EAAE,MAAM,EAAE,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EAAE,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACpF,OAAO,EACL,YAAY,EACZ,iBAAiB,EACjB,aAAa,EACb,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,wBAAwB,GAC9B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,SAAS,EAAE,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC"}

package/dist/scripts/index.js

@@ -11,4 +11,4 @@ export { openConsole } from './console.js';
 export { ensureSecrets, loadProductionEnv, loadEnvFile } from './ensure-secrets.js';
 export { trackCommand, buildAndSendEvent, classifyError, } from '../telemetry/index.js';
 export { telemetry } from './telemetry.js';
-export { getStackId, getSandboxId } from './stack-id.js';
+export { getStackId, getSandboxId, getStackName } from './stack-id.js';

package/dist/scripts/sandbox.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../../src/scripts/sandbox.ts"],"names":[],"mappings":"AA+BA,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,yFAAyF;IACzF,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wBAAsB,YAAY,CAAC,OAAO,EAAE,cAAc,+BAyLzD;AAED,wBAAsB,cAAc,CAAC,WAAW,EAAE,MAAM,iBAwCvD"}
+{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../../src/scripts/sandbox.ts"],"names":[],"mappings":"AA+BA,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,yFAAyF;IACzF,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wBAAsB,YAAY,CAAC,OAAO,EAAE,cAAc,+BAkMzD;AAED,wBAAsB,cAAc,CAAC,WAAW,EAAE,MAAM,iBAwCvD"}

package/dist/scripts/sandbox.js

@@ -41,7 +41,9 @@ export async function startSandbox(options) {
     process.env.BLOCKS_STAGE = 'sandbox';
     // Provision connection string to SSM SecureString.
     // On first deploy, creates the parameter. On subsequent deploys, updates if changed.
-    const secrets = await ensureSecrets('sandbox');
+    // projectRoot is process.cwd() — the same value passed to cdk as --context
+    // projectRoot below — so the written name matches the name resolved at synth.
+    const secrets = await ensureSecrets('sandbox', process.cwd());
     if (secrets.created.length > 0) {
         console.log(`🔐 Created secrets: ${secrets.created.join(', ')}`);
     }
@@ -59,6 +61,13 @@ export async function startSandbox(options) {
     try {
         runSync("npm", [
             "exec", "cdk", "--", "deploy",
+            // `--all`: an app that uses Lambda@Edge (e.g. a Next.js route with
+            // `export const runtime = 'edge'`) synthesizes a SECOND stack
+            // (`edge-lambda-stack-*`, region us-east-1) in addition to the main
+            // hosting stack. Without `--all`, CDK refuses with "specify which
+            // stacks to use". Deploying every stack in a sandbox app is the
+            // intended behavior, so select them all.
+            "--all",
             "--require-approval", "never",
             "--outputs-file", `${outDir}/outputs.json`,
             "--context", `projectRoot=${process.cwd()}`,

package/dist/scripts/stack-id.d.ts

@@ -7,6 +7,31 @@ export declare function getStackId(projectRoot?: string): string;
  * Get or create a per-machine sandbox identifier.
  * Stored in `.blocks-sandbox/sandbox-id.txt` (gitignored).
  * Format: `<username(8)>-<random(6)>` — identifies the developer's sandbox.
+ *
+ * Get-or-create (lazy init): returns the existing id, or generates and persists
+ * one on first call. The file is the shared sync point — once written, every
+ * later caller and every process reads the same id, so the secret writer
+ * (`ensureSecrets`) and synth derive identical names.
  */
 export declare function getSandboxId(projectRoot?: string): string;
+/**
+ * The full CloudFormation stack name for a deployment.
+ *
+ * Single source of truth for the stack-name scheme (D-012): production is
+ * `<stackId>-prod`; a sandbox is `<stackId>-<sandboxId>`. The CDK templates name
+ * the stack with this function, and the external-DB connection-string parameter
+ * name (`dbConnectionParameterName`) is derived from it — so a deployed stack and
+ * the parameter holding its database credentials can never use divergent names.
+ *
+ * This function reads committed config (`.blocks/config.json`, throws if absent
+ * — D-012) and resolves the sandbox id via {@link getSandboxId} (get-or-create):
+ * the first caller materializes `.blocks-sandbox/sandbox-id.txt`, every later
+ * caller reads the same value. Because that file persists and is shared across
+ * processes, the secret writer (`ensureSecrets`) and synth resolve identical
+ * names. Production does not use the sandbox id.
+ */
+export declare function getStackName(opts: {
+    sandbox: boolean;
+    projectRoot?: string;
+}): string;
 //# sourceMappingURL=stack-id.d.ts.map

package/dist/scripts/stack-id.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stack-id.d.ts","sourceRoot":"","sources":["../../src/scripts/stack-id.ts"],"names":[],"mappings":"AAiBA;;;GAGG;AACH,wBAAgB,UAAU,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CAavD;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CAWzD"}
+{"version":3,"file":"stack-id.d.ts","sourceRoot":"","sources":["../../src/scripts/stack-id.ts"],"names":[],"mappings":"AAiBA;;;GAGG;AACH,wBAAgB,UAAU,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CAavD;AAED;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CAWzD;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAGrF"}

package/dist/scripts/stack-id.js

@@ -29,6 +29,11 @@ export function getStackId(projectRoot) {
  * Get or create a per-machine sandbox identifier.
  * Stored in `.blocks-sandbox/sandbox-id.txt` (gitignored).
  * Format: `<username(8)>-<random(6)>` — identifies the developer's sandbox.
+ *
+ * Get-or-create (lazy init): returns the existing id, or generates and persists
+ * one on first call. The file is the shared sync point — once written, every
+ * later caller and every process reads the same id, so the secret writer
+ * (`ensureSecrets`) and synth derive identical names.
  */
 export function getSandboxId(projectRoot) {
     const root = projectRoot || process.cwd();
@@ -44,6 +49,26 @@ export function getSandboxId(projectRoot) {
     writeFileSync(filePath, id);
     return id;
 }
+/**
+ * The full CloudFormation stack name for a deployment.
+ *
+ * Single source of truth for the stack-name scheme (D-012): production is
+ * `<stackId>-prod`; a sandbox is `<stackId>-<sandboxId>`. The CDK templates name
+ * the stack with this function, and the external-DB connection-string parameter
+ * name (`dbConnectionParameterName`) is derived from it — so a deployed stack and
+ * the parameter holding its database credentials can never use divergent names.
+ *
+ * This function reads committed config (`.blocks/config.json`, throws if absent
+ * — D-012) and resolves the sandbox id via {@link getSandboxId} (get-or-create):
+ * the first caller materializes `.blocks-sandbox/sandbox-id.txt`, every later
+ * caller reads the same value. Because that file persists and is shared across
+ * processes, the secret writer (`ensureSecrets`) and synth resolve identical
+ * names. Production does not use the sandbox id.
+ */
+export function getStackName(opts) {
+    const base = getStackId(opts.projectRoot);
+    return opts.sandbox ? `${base}-${getSandboxId(opts.projectRoot)}` : `${base}-prod`;
+}
 function getUsername() {
     try {
         return execSync('git config user.name', { encoding: 'utf-8' }).trim();