@aws-blocks/core 0.1.7 → 0.1.11

package/dist/db-naming.d.ts

@@ -3,9 +3,15 @@
  * database connection string, and for the project ref derived from a Postgres
  * connection string.
  *
- * Both the deploy-time provisioner (`ensure-secrets`) and the `db pull`
- * generated code derive this name from the stage alone. Keep this the only
- * place the name is constructed.
+ * The connection-string parameter name is **stack-scoped** (embeds the
+ * deployment's stack name), so two Blocks apps in the same account + region +
+ * stage get distinct names and cannot overwrite each other's credentials.
+ *
+ * Two call sites compute the name: the pre-deploy writer (`ensure-secrets`) and
+ * the `db pull` generated wiring at synth. Both pass the result of
+ * `getStackName({ sandbox, projectRoot })` into this function, so they produce
+ * the same name by construction. The runtime Lambda does not call this function;
+ * it reads the name recorded at synth.
  */
 /**
  * Extract a stable identifier from a Postgres connection string.
@@ -16,6 +22,12 @@
  * to a sanitized hostname for non-Supabase hosts.
  */
 export declare function extractDbRef(connectionString: string): string;
-/** SSM parameter name storing the connection string for a given stage. */
-export declare function dbConnectionParameterName(stage: string): string;
+/**
+ * SSM SecureString parameter name for a deployment's external database
+ * connection string.
+ *
+ * Pure string transform: `/<stackName>-db-url`. The caller is responsible for
+ * computing the stack name via `getStackName({ sandbox, projectRoot })`.
+ */
+export declare function dbConnectionParameterName(stackName: string): string;
 //# sourceMappingURL=db-naming.d.ts.map

package/dist/db-naming.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"db-naming.d.ts","sourceRoot":"","sources":["../src/db-naming.ts"],"names":[],"mappings":"AAGA;;;;;;;;GAQG;AAEH;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,gBAAgB,EAAE,MAAM,GAAG,MAAM,CAc7D;AAED,0EAA0E;AAC1E,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE/D"}
+{"version":3,"file":"db-naming.d.ts","sourceRoot":"","sources":["../src/db-naming.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;GAcG;AAEH;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,gBAAgB,EAAE,MAAM,GAAG,MAAM,CAc7D;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEnE"}

package/dist/db-naming.js

@@ -5,9 +5,15 @@
  * database connection string, and for the project ref derived from a Postgres
  * connection string.
  *
- * Both the deploy-time provisioner (`ensure-secrets`) and the `db pull`
- * generated code derive this name from the stage alone. Keep this the only
- * place the name is constructed.
+ * The connection-string parameter name is **stack-scoped** (embeds the
+ * deployment's stack name), so two Blocks apps in the same account + region +
+ * stage get distinct names and cannot overwrite each other's credentials.
+ *
+ * Two call sites compute the name: the pre-deploy writer (`ensure-secrets`) and
+ * the `db pull` generated wiring at synth. Both pass the result of
+ * `getStackName({ sandbox, projectRoot })` into this function, so they produce
+ * the same name by construction. The runtime Lambda does not call this function;
+ * it reads the name recorded at synth.
  */
 /**
  * Extract a stable identifier from a Postgres connection string.
@@ -32,7 +38,13 @@ export function extractDbRef(connectionString) {
         return host[1].replace(/\./g, '-');
     throw new Error('Cannot extract database identifier from connection string.');
 }
-/** SSM parameter name storing the connection string for a given stage. */
-export function dbConnectionParameterName(stage) {
-    return `/blocks/${stage}/db-connection-string`;
+/**
+ * SSM SecureString parameter name for a deployment's external database
+ * connection string.
+ *
+ * Pure string transform: `/<stackName>-db-url`. The caller is responsible for
+ * computing the stack name via `getStackName({ sandbox, projectRoot })`.
+ */
+export function dbConnectionParameterName(stackName) {
+    return `/${stackName}-db-url`;
 }

package/dist/db-naming.test.js

@@ -1,8 +1,12 @@
 // Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
-import { test, describe } from 'node:test';
+import { test, describe, afterEach } from 'node:test';
 import assert from 'node:assert';
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from 'node:fs';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
 import { extractDbRef, dbConnectionParameterName } from './db-naming.js';
+import { getStackName } from './scripts/stack-id.js';
 describe('extractDbRef', () => {
     test('pooler form (postgres.{ref}@) yields ref', () => {
         assert.strictEqual(extractDbRef('postgresql://postgres.abcdef:pw@aws-0-us-east-1.pooler.supabase.com:6543/postgres'), 'abcdef');
@@ -23,7 +27,44 @@ describe('extractDbRef', () => {
     });
 });
 describe('dbConnectionParameterName', () => {
-    test('composes the stage into the SSM name', () => {
-        assert.strictEqual(dbConnectionParameterName('production'), '/blocks/production/db-connection-string');
+    test('formats stack name into parameter path', () => {
+        assert.strictEqual(dbConnectionParameterName('my-app-k7x2mf-prod'), '/my-app-k7x2mf-prod-db-url');
+    });
+    test('two distinct stack names produce distinct parameter names', () => {
+        assert.notStrictEqual(dbConnectionParameterName('app-a-111111-prod'), dbConnectionParameterName('app-b-222222-prod'));
+    });
+});
+describe('cross-site invariant: write name == read name', () => {
+    let tmpDir;
+    let originalCwd;
+    afterEach(() => {
+        if (originalCwd)
+            process.chdir(originalCwd);
+        if (tmpDir)
+            rmSync(tmpDir, { recursive: true, force: true });
+    });
+    function setupProject(stackId, sandboxId) {
+        tmpDir = mkdtempSync(join(tmpdir(), 'cross-site-'));
+        mkdirSync(join(tmpDir, '.blocks'), { recursive: true });
+        writeFileSync(join(tmpDir, '.blocks', 'config.json'), JSON.stringify({ stackId }));
+        mkdirSync(join(tmpDir, '.blocks-sandbox'), { recursive: true });
+        writeFileSync(join(tmpDir, '.blocks-sandbox', 'sandbox-id.txt'), sandboxId);
+        return tmpDir;
+    }
+    test('write-side name == read-side name (sandbox)', () => {
+        const root = setupProject('my-app-k7x2mf', 'alice-0d7e1c');
+        const writeName = dbConnectionParameterName(getStackName({ sandbox: true, projectRoot: root }));
+        originalCwd = process.cwd();
+        process.chdir(root);
+        const readName = dbConnectionParameterName(getStackName({ sandbox: true }));
+        assert.strictEqual(writeName, readName);
+    });
+    test('write-side name == read-side name (production)', () => {
+        const root = setupProject('my-app-k7x2mf', 'alice-0d7e1c');
+        const writeName = dbConnectionParameterName(getStackName({ sandbox: false, projectRoot: root }));
+        originalCwd = process.cwd();
+        process.chdir(root);
+        const readName = dbConnectionParameterName(getStackName({ sandbox: false }));
+        assert.strictEqual(writeName, readName);
     });
 });

package/dist/hosting.d.ts

@@ -105,6 +105,26 @@ export interface HostingProps {
     buildOutputDir?: string;
     /** Supply a custom adapter when using an unsupported framework. */
     customAdapter?: FrameworkAdapterFn;
+    /**
+     * URL prefix the whole site is served under (Next.js `basePath`, Astro
+     * `base`, Nuxt `app.baseURL`). When set, CloudFront behaviors are prefixed
+     * with it and the bare root issues a 308 redirect to `/<basePath>/`.
+     *
+     * Declaring it here is the recommended source of truth: the value is
+     * caller-provided rather than reverse-engineered from build output, so it
+     * can't drift with framework/bundler internals. When omitted, the adapter
+     * falls back to detecting the framework's own base-path config from the
+     * build output.
+     *
+     * Format: leading slash, no trailing slash (e.g. `'/app'`). A trailing
+     * slash or bare `'/'` is normalized/ignored.
+     *
+     * @example
+     * ```ts
+     * new Hosting(stack, 'Web', { root, framework: 'nuxt', basePath: '/app' });
+     * ```
+     */
+    basePath?: string;
     /**
      * The Blocks backend stack (or any object with `apiUrl`).
      *
@@ -148,6 +168,35 @@ export interface HostingProps {
         type: 'whitelist' | 'blacklist';
         countries: string[];
     };
+    /**
+     * Overrides for the adjustable AWS Service Quotas the CloudFront
+     * distribution draws on. Each field maps to a named AWS quota you can
+     * request an increase on:
+     *
+     *   - `cacheBehaviors` — "Cache behaviors per distribution" (default 25).
+     *     Consumed by routed paths, prerendered pages, per-pattern header
+     *     rules, assetPrefix, and the error-page behavior.
+     *   - `edgeFunctions` — Lambda@Edge associations per distribution
+     *     (default 25). Consumed by `runtime: 'edge'` routes.
+     *   - `headerPolicies` — "Response headers policies per AWS account"
+     *     (default 20, account-wide).
+     *
+     * Omitted fields use the AWS default. Set a field ONLY to match a quota
+     * increase AWS has actually granted — synth cannot verify your real quota,
+     * so an over-set value does not raise the AWS ceiling; it just moves the
+     * failure from a clear synth error to an opaque CloudFormation rollback.
+     *
+     * @example
+     * ```ts
+     * // After AWS grants "Cache behaviors per distribution" = 50:
+     * new Hosting(stack, 'Web', { root, quotas: { cacheBehaviors: 50 } });
+     * ```
+     */
+    quotas?: {
+        cacheBehaviors?: number;
+        edgeFunctions?: number;
+        headerPolicies?: number;
+    };
     /**
      * Build cache configuration. When enabled, provisions an S3 bucket for
      * framework build caches (e.g. Next.js .next/cache) and exports the bucket

package/dist/hosting.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hosting.d.ts","sourceRoot":"","sources":["../src/hosting.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,GAAG,MAAM,aAAa,CAAC;AASnC,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAKvC,OAAO,EAIL,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EAC1B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAGL,KAAK,kBAAkB,EACxB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAGV,aAAa,EACd,MAAM,qBAAqB,CAAC;AAO7B;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,8CAA8C;IAC9C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,EAAE,GAAG,CAAC,QAAQ,GAAG,MAAM,CAAC;IAChC,8FAA8F;IAC9F,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;;;;;;;;;;;OAgBG;IACH,iBAAiB,CAAC,EAAE;QAClB,2EAA2E;QAC3E,mBAAmB,CAAC,EAAE,MAAM,CAAC;KAC9B,CAAC;IACF,uEAAuE;IACvE,YAAY,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC;CAC3C,CAAC;AAEF,YAAY,EAAE,aAAa,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,CAAC;AAE3F;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,mHAAmH;IACnH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,YAAY;IAE3B,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAC;IAEb;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;;OAGG;IACH,SAAS,CAAC,EAAE,aAAa,CAAC;IAE1B;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,mEAAmE;IACnE,aAAa,CAAC,EAAE,kBAAkB,CAAC;IAGnC;;;;;;;;OAQG;IACH,GAAG,CAAC,EAAE,cAAc,CAAC;IAErB;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAGxC,uDAAuD;IACvD,OAAO,CAAC,EAAE,aAAa,CAAC;IAExB,mCAAmC;IACnC,MAAM,CAAC,EAAE,mBAAmB,CAAC;IAE7B,oCAAoC;IACpC,GAAG,CAAC,EAAE,gBAAgB,CAAC;IAEvB,sEAAsE;IACtE,cAAc,CAAC,EAAE,OAAO,CAAC;IAEzB,mDAAmD;IACnD,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAE/B,wDAAwD;IACxD,UAAU,CAAC,EAAE,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC;IAE3C;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE;QACf,IAAI,EAAE,WAAW,GAAG,WAAW,CAAC;QAChC,SAAS,EAAE,MAAM,EAAE,CAAC;KACrB,CAAC;IAEF;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE;QACX,OAAO,EAAE,OAAO,CAAC;QACjB,0EAA0E;QAC1E,MAAM,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC;KAC7B,CAAC;IAEF;;;;;;;;;;;;;OAaG;IACH,UAAU,CAAC,EAAE;QACX,iEAAiE;QACjE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,iEAAiE;QACjE,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IAEF;;;OAGG;IACH,OAAO,CAAC,EAAE;QACR,wCAAwC;QACxC,OAAO,EAAE,OAAO,CAAC;QACjB,+CAA+C;QAC/C,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;IAEF;;;;;;OAMG;IACH,UAAU,CAAC,EAAE;QACX,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,6DAA6D;QAC7D,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IAEF;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,oBAAoB,CAAC;CACvC;AAYD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,qBAAa,OAAQ,SAAQ,SAAS;IACpC,2CAA2C;IAC3C,SAAgB,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC;IAC1C,mCAAmC;IACnC,SAAgB,YAAY,EAAE,GAAG,CAAC,cAAc,CAAC,YAAY,CAAC;IAC9D,yDAAyD;IACzD,SAAgB,GAAG,EAAE,MAAM,CAAC;IAC5B,gFAAgF;IAChF,SAAgB,WAAW,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC;IACtD,wFAAwF;IACxF,SAAgB,gBAAgB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC;IACrD,2FAA2F;IAC3F,SAAgB,eAAe,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;gBAEzC,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY;IA6O7D;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IAOvB;;OAEG;IACH,OAAO,CAAC,eAAe;CAwDxB"}
+{"version":3,"file":"hosting.d.ts","sourceRoot":"","sources":["../src/hosting.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,GAAG,MAAM,aAAa,CAAC;AASnC,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAKvC,OAAO,EAIL,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EAC1B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAIL,KAAK,kBAAkB,EACxB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAGV,aAAa,EACd,MAAM,qBAAqB,CAAC;AAO7B;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,8CAA8C;IAC9C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,EAAE,GAAG,CAAC,QAAQ,GAAG,MAAM,CAAC;IAChC,8FAA8F;IAC9F,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;;;;;;;;;;;OAgBG;IACH,iBAAiB,CAAC,EAAE;QAClB,2EAA2E;QAC3E,mBAAmB,CAAC,EAAE,MAAM,CAAC;KAC9B,CAAC;IACF,uEAAuE;IACvE,YAAY,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC;CAC3C,CAAC;AAEF,YAAY,EAAE,aAAa,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,CAAC;AAE3F;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,mHAAmH;IACnH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,YAAY;IAE3B,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAC;IAEb;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;;OAGG;IACH,SAAS,CAAC,EAAE,aAAa,CAAC;IAE1B;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,mEAAmE;IACnE,aAAa,CAAC,EAAE,kBAAkB,CAAC;IAEnC;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAGlB;;;;;;;;OAQG;IACH,GAAG,CAAC,EAAE,cAAc,CAAC;IAErB;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAGxC,uDAAuD;IACvD,OAAO,CAAC,EAAE,aAAa,CAAC;IAExB,mCAAmC;IACnC,MAAM,CAAC,EAAE,mBAAmB,CAAC;IAE7B,oCAAoC;IACpC,GAAG,CAAC,EAAE,gBAAgB,CAAC;IAEvB,sEAAsE;IACtE,cAAc,CAAC,EAAE,OAAO,CAAC;IAEzB,mDAAmD;IACnD,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAE/B,wDAAwD;IACxD,UAAU,CAAC,EAAE,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC;IAE3C;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE;QACf,IAAI,EAAE,WAAW,GAAG,WAAW,CAAC;QAChC,SAAS,EAAE,MAAM,EAAE,CAAC;KACrB,CAAC;IAEF;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,MAAM,CAAC,EAAE;QACP,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;IAEF;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE;QACX,OAAO,EAAE,OAAO,CAAC;QACjB,0EAA0E;QAC1E,MAAM,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC;KAC7B,CAAC;IAEF;;;;;;;;;;;;;OAaG;IACH,UAAU,CAAC,EAAE;QACX,iEAAiE;QACjE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,iEAAiE;QACjE,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IAEF;;;OAGG;IACH,OAAO,CAAC,EAAE;QACR,wCAAwC;QACxC,OAAO,EAAE,OAAO,CAAC;QACjB,+CAA+C;QAC/C,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;IAEF;;;;;;OAMG;IACH,UAAU,CAAC,EAAE;QACX,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,6DAA6D;QAC7D,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IAEF;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,oBAAoB,CAAC;CACvC;AAYD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,qBAAa,OAAQ,SAAQ,SAAS;IACpC,2CAA2C;IAC3C,SAAgB,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC;IAC1C,mCAAmC;IACnC,SAAgB,YAAY,EAAE,GAAG,CAAC,cAAc,CAAC,YAAY,CAAC;IAC9D,yDAAyD;IACzD,SAAgB,GAAG,EAAE,MAAM,CAAC;IAC5B,gFAAgF;IAChF,SAAgB,WAAW,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC;IACtD,wFAAwF;IACxF,SAAgB,gBAAgB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC;IACrD,2FAA2F;IAC3F,SAAgB,eAAe,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;gBAEzC,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY;IAsR7D;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IAOvB;;OAEG;IACH,OAAO,CAAC,eAAe;CAwDxB"}

package/dist/hosting.js

@@ -9,7 +9,7 @@ import { execSync } from 'node:child_process';
 import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
 import { join, resolve } from 'node:path';
 import { HostingConstruct, generateBuildId, } from '@aws-blocks/hosting/constructs';
-import { detectFramework, getAdapter, } from '@aws-blocks/hosting/adapters';
+import { detectFramework, getAdapter, normalizeBasePath, } from '@aws-blocks/hosting/adapters';
 import { BLOCKS_RPC_PREFIX, BLOCKS_AUTH_PREFIX } from './constants.js';
 import { registerConfig } from './cdk/config-registry.js';
 import { getRegisteredRoutes } from './raw-route.js';
@@ -123,6 +123,23 @@ export class Hosting extends Construct {
         if (!manifest.buildId) {
             manifest.buildId = generateBuildId();
         }
+        // ── 4b'. basePath: prop is the source of truth ───────────────
+        //    A caller-declared `basePath` overrides whatever the adapter
+        //    detected from build output. This is the robust path: the value
+        //    is provided rather than reverse-engineered from framework/bundler
+        //    internals (which drift across versions). When the prop is omitted,
+        //    the adapter's detected `manifest.basePath` (if any) stands.
+        if (props.basePath !== undefined) {
+            const normalized = normalizeBasePath(props.basePath);
+            if (normalized) {
+                manifest.basePath = normalized;
+            }
+            else {
+                // Explicit '/' (or empty) means "no base path" — clear any value
+                // the adapter may have detected so the prop genuinely wins.
+                delete manifest.basePath;
+            }
+        }
         // ── 4c. Prevent duplicate error pages ────────────────────────
         //    The adapter may auto-detect error pages (e.g. SPA adapter finds
         //    404.html in build output and sets manifest.errorPages). When the
@@ -185,11 +202,12 @@ export class Hosting extends Construct {
             storage: props.retainOnDelete != null
                 ? { retainOnDelete: props.retainOnDelete }
                 : undefined,
-            cdn: (props.contentSecurityPolicy || props.priceClass || props.geoRestriction)
+            cdn: (props.contentSecurityPolicy || props.priceClass || props.geoRestriction || props.quotas)
                 ? {
                     contentSecurityPolicy: props.contentSecurityPolicy,
                     priceClass: props.priceClass,
                     geoRestriction: props.geoRestriction,
+                    quotas: props.quotas,
                 }
                 : undefined,
             logging: props.logging,
@@ -204,8 +222,15 @@ export class Hosting extends Construct {
             this.addApiBehaviors(hosting, props.api.apiUrl);
         }
         // ── 7a. Inject Blocks env vars into compute functions ───────────
-        const primaryFunction = hosting.computeFunctions.values().next().value;
+        // Lambda@Edge functions (edge-runtime routes) do NOT support environment
+        // variables — they surface in computeFunctions as EdgeFunction/IVersion
+        // without an `addEnvironment` method. Skip any function that can't take
+        // env vars instead of crashing (`fn.addEnvironment is not a function`).
+        const canAddEnv = (fn) => typeof fn?.addEnvironment === 'function';
+        const primaryFunction = [...hosting.computeFunctions.values()].find(canAddEnv);
         for (const [, fn] of hosting.computeFunctions) {
+            if (!canAddEnv(fn))
+                continue; // Lambda@Edge: no env var support
             if (props.api) {
                 fn.addEnvironment('BLOCKS_API_URL', props.api.apiUrl);
             }
@@ -227,11 +252,25 @@ export class Hosting extends Construct {
                 distributionPaths: ['/.blocks-sandbox/*'],
                 cacheControl: [s3deploy.CacheControl.fromString('public, max-age=60, must-revalidate')],
             });
-            // Ensure config deployment runs after the hosting construct's
-            // asset deployment so the resolved config.json is not overwritten.
-            const assetDeployment = hosting.node.tryFindChild('AssetDeployment');
-            if (assetDeployment) {
-                configDeployment.node.addDependency(assetDeployment);
+            // Ensure the config deployment runs AFTER the hosting construct's
+            // asset deployments. Those deployments upload the whole static dir —
+            // which includes the *placeholder* `.blocks-sandbox/config.json`
+            // (`{_placeholder:true}`) written during synth — to the same
+            // `builds/<id>/.blocks-sandbox/config.json` key this deployment writes
+            // the resolved config to. Without an ordering dependency the
+            // placeholder can land last and clobber the real config.
+            //
+            // We depend on EVERY BucketDeployment under the hosting construct
+            // rather than a single hard-coded child id: the real children are
+            // `AssetDeploymentImmutable` / `AssetDeploymentHtml` / `...Mutable`
+            // (and vary by deploy shape), so the previous
+            // `tryFindChild('AssetDeployment')` never matched and the dependency
+            // was silently never wired.
+            const assetDeployments = hosting.node
+                .findAll()
+                .filter((c) => c instanceof s3deploy.BucketDeployment);
+            for (const dep of assetDeployments) {
+                configDeployment.node.addDependency(dep);
             }
         }
         // ── 9. Register public origin + CORS hosting origin into S3 config ──

package/dist/hosting.test.js

@@ -1074,4 +1074,64 @@ describe('Hosting', () => {
             template.resourceCountIs('AWS::CloudFront::Distribution', 1);
         });
     });
+    // ── basePath prop (caller-declared source of truth) ─────────
+    // Under KVS edge routing, basePath is no longer expressed as a per-behavior
+    // PathPattern prefix — it lives in the KVS route table's `meta.bp`, which the
+    // edge router uses for the canonical 308 + static strip. So these tests read
+    // the basePath out of the RouteStoreKeys custom resource's Entries.
+    describe('basePath prop', () => {
+        const metaBasePath = (root, basePath) => {
+            const app = new App();
+            const stack = new Stack(app, 'BasePathStack', {
+                env: { account: '123456789012', region: 'us-east-1' },
+            });
+            new Hosting(stack, 'Web', {
+                root,
+                framework: 'spa',
+                buildOutputDir: 'dist',
+                ...(basePath !== undefined ? { basePath } : {}),
+            });
+            const tpl = Template.fromStack(stack).toJSON();
+            const kvKeys = Object.entries(tpl.Resources).find(([id, r]) => r.Type === 'AWS::CloudFormation::CustomResource' &&
+                /RouteStoreKeys/.test(id));
+            assert.ok(kvKeys, 'expected a RouteStoreKeys custom resource');
+            const entries = JSON.parse(kvKeys[1].Properties.Entries);
+            const meta = JSON.parse(entries.meta);
+            return meta.bp;
+        };
+        it('records basePath in the KVS route table when set (SPA, no framework base)', () => {
+            createSpaBuildOutput(tmpDir);
+            assert.strictEqual(metaBasePath(tmpDir, '/app'), '/app');
+        });
+        it('normalizes a trailing slash (/app/ → /app)', () => {
+            createSpaBuildOutput(tmpDir);
+            assert.strictEqual(metaBasePath(tmpDir, '/app/'), '/app');
+        });
+        it('treats "/" as no base path', () => {
+            createSpaBuildOutput(tmpDir);
+            assert.strictEqual(metaBasePath(tmpDir, '/'), '');
+        });
+    });
+    // ── P0.4: config.json ordering dependency ────────────────────
+    describe('config.json deploy ordering (P0.4)', () => {
+        it('BlocksConfigDeployment depends on the asset deployments', () => {
+            // The asset deployments upload the whole static dir — including the
+            // placeholder `.blocks-sandbox/config.json` — to the same key the
+            // resolved config writes to. Without an ordering dependency the
+            // placeholder can clobber the real config. The previous
+            // `tryFindChild('AssetDeployment')` never matched the real child ids
+            // (AssetDeploymentImmutable/Html/Mutable), so the dep was never wired.
+            createSpaBuildOutput(tmpDir);
+            const app = new App();
+            const stack = new Stack(app, 'ConfigOrderStack');
+            new Hosting(stack, 'Hosting', { root: tmpDir, api: MOCK_API });
+            const tpl = Template.fromStack(stack).toJSON();
+            const configId = Object.keys(tpl.Resources).find((id) => /BlocksConfigDeployment/.test(id) && /CustomResource/.test(id));
+            assert.ok(configId, 'expected a BlocksConfigDeployment custom resource');
+            const dependsOn = tpl.Resources[configId].DependsOn ?? [];
+            const assetDeps = dependsOn.filter((d) => /AssetDeployment/.test(d));
+            assert.ok(assetDeps.length >= 1, `BlocksConfigDeployment must DependsOn the asset deployment(s); ` +
+                `found DependsOn=${JSON.stringify(dependsOn)}`);
+        });
+    });
 });

package/dist/scripts/deploy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/scripts/deploy.ts"],"names":[],"mappings":"AAaA,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,wBAAsB,MAAM,CAAC,OAAO,EAAE,aAAa,iBAwFlD"}
+{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/scripts/deploy.ts"],"names":[],"mappings":"AAaA,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,wBAAsB,MAAM,CAAC,OAAO,EAAE,aAAa,iBA0FlD"}

package/dist/scripts/deploy.js

@@ -15,8 +15,10 @@ export async function deploy(options) {
         // Load production environment (from .env.production or CI env vars)
         loadProductionEnv();
         process.env.BLOCKS_STAGE = 'production';
-        // Provision secrets for production
-        const secrets = await ensureSecrets('production');
+        // Provision secrets for production. projectRoot must match the root cdk
+        // synth uses (passed as --context below) so the written parameter name
+        // equals the one the app resolves at synth.
+        const secrets = await ensureSecrets('production', options.projectRoot);
         if (secrets.created.length > 0 || secrets.updated.length > 0) {
             console.log(`🔐 Secrets provisioned: ${[...secrets.created, ...secrets.updated].join(', ')}`);
         }

package/dist/scripts/dev-server-reclaim.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=dev-server-reclaim.test.d.ts.map

package/dist/scripts/dev-server-reclaim.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dev-server-reclaim.test.d.ts","sourceRoot":"","sources":["../../src/scripts/dev-server-reclaim.test.ts"],"names":[],"mappings":""}