@aws-blocks/core 0.1.7 → 0.1.11

package/dist/scripts/process-tree.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"process-tree.d.ts","sourceRoot":"","sources":["../../src/scripts/process-tree.ts"],"names":[],"mappings":"AAaA,+EAA+E;AAC/E,MAAM,WAAW,eAAe;IAC9B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC;CACjD;AAED,6GAA6G;AAC7G,UAAU,cAAc;IACtB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,CAAC,EAAE,KAAK,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,eAAe,CAC7B,GAAG,EAAE,MAAM,EACX,MAAM,GAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,KAAK,cACwB,GAC7E,OAAO,CAaT;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,eAAe,EACtB,MAAM,GAAE,MAAM,CAAC,OAAmB,EAClC,QAAQ,GAAE,MAAM,CAAC,QAA2B,EAC5C,MAAM,GAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,KAAK,IAAmC,EACpF,WAAW,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAyB,GACtD,IAAI,CAqBN;AAED,iGAAiG;AACjG,MAAM,WAAW,cAAe,SAAQ,eAAe;IACrD,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IAClC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC;CACpD;AAOD;;;;;;;;GAQG;AACH,eAAO,MAAM,aAAa,MAAM,CAAC;AAEjC;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,MAAM,EACX,QAAQ,GAAE,MAAM,CAAC,QAA2B,EAC5C,IAAI,GAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,IAAmC,GACzE,OAAO,CAQT;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,cAAc,EACrB,OAAO,SAAO,EACd,QAAQ,GAAE,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,KAAK,IAAuB,EACjF,KAAK,GAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAgB,EACnD,YAAY,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAA6B,GAC3D,OAAO,CAAC,OAAO,CAAC,CAkClB"}
+{"version":3,"file":"process-tree.d.ts","sourceRoot":"","sources":["../../src/scripts/process-tree.ts"],"names":[],"mappings":"AAaA,+EAA+E;AAC/E,MAAM,WAAW,eAAe;IAC9B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC;CACjD;AAED,6GAA6G;AAC7G,UAAU,cAAc;IACtB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,CAAC,EAAE,KAAK,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,eAAe,CAC7B,GAAG,EAAE,MAAM,EACX,MAAM,GAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,KAAK,cACuC,GAC5F,OAAO,CAaT;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,eAAe,EACtB,MAAM,GAAE,MAAM,CAAC,OAAmB,EAClC,QAAQ,GAAE,MAAM,CAAC,QAA2B,EAC5C,MAAM,GAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,KAAK,IAAmC,EACpF,WAAW,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAyB,GACtD,IAAI,CAqBN;AAED,6EAA6E;AAC7E,UAAU,aAAa;IACrB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,KAAK,CAAC,EAAE,KAAK,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,KAAK,aACyC,EAC/F,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,MAAM,EAAE,CA2BV;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,MAAM,EACX,MAAM,GAAE,MAAM,CAAC,OAAmB,EAClC,QAAQ,GAAE,MAAM,CAAC,QAA2B,EAC5C,MAAM,GAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,KAAK,IAAmC,EACpF,WAAW,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAyB,GACtD,IAAI,CAkBN;AAED,iGAAiG;AACjG,MAAM,WAAW,cAAe,SAAQ,eAAe;IACrD,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IAClC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC;CACpD;AAOD;;;;;;;;GAQG;AACH,eAAO,MAAM,aAAa,MAAM,CAAC;AAEjC;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,MAAM,EACX,QAAQ,GAAE,MAAM,CAAC,QAA2B,EAC5C,IAAI,GAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,IAAmC,GACzE,OAAO,CAQT;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,cAAc,EACrB,OAAO,SAAO,EACd,QAAQ,GAAE,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,KAAK,IAAuB,EACjF,KAAK,GAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAgB,EACnD,YAAY,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAA6B,GAC3D,OAAO,CAAC,OAAO,CAAC,CAkClB"}

package/dist/scripts/process-tree.js

@@ -19,10 +19,11 @@ import { spawnSync } from 'node:child_process';
  * denied): such a run did NOT reap the tree, so the caller must fall back to a
  * direct `child.kill` rather than treat the leak as handled. (`child.kill`
  * cannot reap the orphaned grandchild either, but the fallback is cheap and
- * strictly correct — we never silently swallow a failed tree-kill.) Never
- * throws.
+ * strictly correct — we never silently swallow a failed tree-kill.) Runs with a
+ * 3s `timeout` so a wedged `taskkill` can't stall teardown; a timed-out run
+ * surfaces as `{error}` and degrades to the fallback. Never throws.
  */
-export function windowsTreeKill(pid, runner = (command, args) => spawnSync(command, args, { stdio: 'ignore', windowsHide: true })) {
+export function windowsTreeKill(pid, runner = (command, args) => spawnSync(command, args, { stdio: 'ignore', windowsHide: true, timeout: 3000 })) {
     try {
         const { status, error } = runner('taskkill', ['/T', '/F', '/PID', String(pid)]);
         // Couldn't even spawn taskkill (e.g. not on PATH) → not handled; fall back.
@@ -84,6 +85,85 @@ export function killFrontendTree(child, signal = 'SIGTERM', platform = process.p
         // Process already exited; nothing to do.
     }
 }
+/**
+ * Find the PIDs of processes holding a TCP *listener* on `port`, so a fresh dev
+ * server can reclaim a port left bound by a crashed / SIGKILL'd predecessor (its
+ * orphaned backend, or a detached Vite grandchild) instead of colliding on it.
+ * This mirrors the `lsof -ti:<port>` discovery the `cleanup` script already uses
+ * — it does NOT introduce a new port-to-PID mechanism.
+ *
+ * - **POSIX**: `lsof -ti tcp:<port> -sTCP:LISTEN` — `-t` prints bare PIDs and the
+ *   `-sTCP:LISTEN` state filter restricts the match to the *listener*, so a
+ *   transient client socket on the same port is never targeted.
+ * - **Windows**: `netstat -ano -p tcp`, keeping the trailing PID column of
+ *   `LISTENING` rows whose local address ends in `:<port>`.
+ *
+ * Best-effort and never throws: a missing tool, a non-zero exit ("nothing is
+ * listening"), or unparseable output all yield `[]`. The `spawnSync` runs with a
+ * 3s `timeout` so a hung `lsof`/`netstat` (e.g. an unresponsive NFS mount) can't
+ * block the event loop during startup — a timed-out probe returns `{error}`,
+ * which the `catch` degrades to `[]`. PIDs `<= 1` are dropped
+ * defensively (never target init / the whole current group). `runner`/`platform`
+ * are injected for tests.
+ */
+export function findListenerPids(port, runner = (command, args) => spawnSync(command, args, { encoding: 'utf-8', windowsHide: true, timeout: 3000 }), platform = process.platform) {
+    try {
+        const pids = new Set();
+        if (platform === 'win32') {
+            const { stdout } = runner('netstat', ['-ano', '-p', 'tcp']);
+            if (!stdout)
+                return [];
+            for (const line of stdout.split(/\r?\n/)) {
+                if (!/LISTENING/i.test(line))
+                    continue;
+                // Columns: Proto  Local-Address  Foreign-Address  State  PID
+                const cols = line.trim().split(/\s+/);
+                const local = cols[1] ?? '';
+                if (!local.endsWith(`:${port}`))
+                    continue;
+                const pid = Number(cols[cols.length - 1]);
+                if (Number.isInteger(pid) && pid > 1)
+                    pids.add(pid);
+            }
+            return [...pids];
+        }
+        const { stdout } = runner('lsof', ['-ti', `tcp:${port}`, '-sTCP:LISTEN']);
+        if (!stdout)
+            return [];
+        for (const token of stdout.split(/\s+/)) {
+            const pid = Number(token.trim());
+            if (Number.isInteger(pid) && pid > 1)
+                pids.add(pid);
+        }
+        return [...pids];
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Force-terminate whatever process (and, on POSIX, its process group) currently
+ * holds a port — used by the dev server's startup / EADDRINUSE *reclaim* path on
+ * a PID discovered via {@link findListenerPids}, i.e. a process this dev server
+ * did NOT spawn. Reuses {@link killFrontendTree} (POSIX `-pid` group kill /
+ * Windows `taskkill /T`, with a direct-`kill` fallback) so reclaim reaps exactly
+ * like our own frontend teardown — no bespoke kill mechanism. Best-effort; never
+ * throws (a since-exited PID just yields ESRCH, swallowed by killFrontendTree).
+ */
+export function killListenerTree(pid, signal = 'SIGTERM', platform = process.platform, killFn = (p, s) => process.kill(p, s), winTreeKill = windowsTreeKill) {
+    killFrontendTree({
+        pid,
+        kill: (s) => {
+            try {
+                process.kill(pid, s ?? signal);
+                return true;
+            }
+            catch {
+                return false;
+            }
+        },
+    }, signal, platform, killFn, winTreeKill);
+}
 const defaultSleep = (ms) => new Promise((res) => {
     setTimeout(res, ms).unref?.();
 });

package/dist/scripts/sandbox.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../../src/scripts/sandbox.ts"],"names":[],"mappings":"AA+BA,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,yFAAyF;IACzF,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wBAAsB,YAAY,CAAC,OAAO,EAAE,cAAc,+BAyLzD;AAED,wBAAsB,cAAc,CAAC,WAAW,EAAE,MAAM,iBAwCvD"}
+{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../../src/scripts/sandbox.ts"],"names":[],"mappings":"AA+BA,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,yFAAyF;IACzF,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wBAAsB,YAAY,CAAC,OAAO,EAAE,cAAc,+BAkMzD;AAED,wBAAsB,cAAc,CAAC,WAAW,EAAE,MAAM,iBAwCvD"}

package/dist/scripts/sandbox.js

@@ -41,7 +41,9 @@ export async function startSandbox(options) {
     process.env.BLOCKS_STAGE = 'sandbox';
     // Provision connection string to SSM SecureString.
     // On first deploy, creates the parameter. On subsequent deploys, updates if changed.
-    const secrets = await ensureSecrets('sandbox');
+    // projectRoot is process.cwd() — the same value passed to cdk as --context
+    // projectRoot below — so the written name matches the name resolved at synth.
+    const secrets = await ensureSecrets('sandbox', process.cwd());
     if (secrets.created.length > 0) {
         console.log(`🔐 Created secrets: ${secrets.created.join(', ')}`);
     }
@@ -59,6 +61,13 @@ export async function startSandbox(options) {
     try {
         runSync("npm", [
             "exec", "cdk", "--", "deploy",
+            // `--all`: an app that uses Lambda@Edge (e.g. a Next.js route with
+            // `export const runtime = 'edge'`) synthesizes a SECOND stack
+            // (`edge-lambda-stack-*`, region us-east-1) in addition to the main
+            // hosting stack. Without `--all`, CDK refuses with "specify which
+            // stacks to use". Deploying every stack in a sandbox app is the
+            // intended behavior, so select them all.
+            "--all",
             "--require-approval", "never",
             "--outputs-file", `${outDir}/outputs.json`,
             "--context", `projectRoot=${process.cwd()}`,

package/dist/scripts/stack-id.d.ts

@@ -7,6 +7,31 @@ export declare function getStackId(projectRoot?: string): string;
  * Get or create a per-machine sandbox identifier.
  * Stored in `.blocks-sandbox/sandbox-id.txt` (gitignored).
  * Format: `<username(8)>-<random(6)>` — identifies the developer's sandbox.
+ *
+ * Get-or-create (lazy init): returns the existing id, or generates and persists
+ * one on first call. The file is the shared sync point — once written, every
+ * later caller and every process reads the same id, so the secret writer
+ * (`ensureSecrets`) and synth derive identical names.
  */
 export declare function getSandboxId(projectRoot?: string): string;
+/**
+ * The full CloudFormation stack name for a deployment.
+ *
+ * Single source of truth for the stack-name scheme (D-012): production is
+ * `<stackId>-prod`; a sandbox is `<stackId>-<sandboxId>`. The CDK templates name
+ * the stack with this function, and the external-DB connection-string parameter
+ * name (`dbConnectionParameterName`) is derived from it — so a deployed stack and
+ * the parameter holding its database credentials can never use divergent names.
+ *
+ * This function reads committed config (`.blocks/config.json`, throws if absent
+ * — D-012) and resolves the sandbox id via {@link getSandboxId} (get-or-create):
+ * the first caller materializes `.blocks-sandbox/sandbox-id.txt`, every later
+ * caller reads the same value. Because that file persists and is shared across
+ * processes, the secret writer (`ensureSecrets`) and synth resolve identical
+ * names. Production does not use the sandbox id.
+ */
+export declare function getStackName(opts: {
+    sandbox: boolean;
+    projectRoot?: string;
+}): string;
 //# sourceMappingURL=stack-id.d.ts.map

package/dist/scripts/stack-id.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stack-id.d.ts","sourceRoot":"","sources":["../../src/scripts/stack-id.ts"],"names":[],"mappings":"AAiBA;;;GAGG;AACH,wBAAgB,UAAU,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CAavD;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CAWzD"}
+{"version":3,"file":"stack-id.d.ts","sourceRoot":"","sources":["../../src/scripts/stack-id.ts"],"names":[],"mappings":"AAiBA;;;GAGG;AACH,wBAAgB,UAAU,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CAavD;AAED;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CAWzD;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAGrF"}

package/dist/scripts/stack-id.js

@@ -29,6 +29,11 @@ export function getStackId(projectRoot) {
  * Get or create a per-machine sandbox identifier.
  * Stored in `.blocks-sandbox/sandbox-id.txt` (gitignored).
  * Format: `<username(8)>-<random(6)>` — identifies the developer's sandbox.
+ *
+ * Get-or-create (lazy init): returns the existing id, or generates and persists
+ * one on first call. The file is the shared sync point — once written, every
+ * later caller and every process reads the same id, so the secret writer
+ * (`ensureSecrets`) and synth derive identical names.
  */
 export function getSandboxId(projectRoot) {
     const root = projectRoot || process.cwd();
@@ -44,6 +49,26 @@ export function getSandboxId(projectRoot) {
     writeFileSync(filePath, id);
     return id;
 }
+/**
+ * The full CloudFormation stack name for a deployment.
+ *
+ * Single source of truth for the stack-name scheme (D-012): production is
+ * `<stackId>-prod`; a sandbox is `<stackId>-<sandboxId>`. The CDK templates name
+ * the stack with this function, and the external-DB connection-string parameter
+ * name (`dbConnectionParameterName`) is derived from it — so a deployed stack and
+ * the parameter holding its database credentials can never use divergent names.
+ *
+ * This function reads committed config (`.blocks/config.json`, throws if absent
+ * — D-012) and resolves the sandbox id via {@link getSandboxId} (get-or-create):
+ * the first caller materializes `.blocks-sandbox/sandbox-id.txt`, every later
+ * caller reads the same value. Because that file persists and is shared across
+ * processes, the secret writer (`ensureSecrets`) and synth resolve identical
+ * names. Production does not use the sandbox id.
+ */
+export function getStackName(opts) {
+    const base = getStackId(opts.projectRoot);
+    return opts.sandbox ? `${base}-${getSandboxId(opts.projectRoot)}` : `${base}-prod`;
+}
 function getUsername() {
     try {
         return execSync('git config user.name', { encoding: 'utf-8' }).trim();

package/dist/scripts/stack-id.test.js

@@ -5,7 +5,7 @@ import assert from 'node:assert';
 import { mkdirSync, writeFileSync, rmSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { tmpdir } from 'node:os';
-import { getStackId, getSandboxId } from './stack-id.js';
+import { getStackId, getSandboxId, getStackName } from './stack-id.js';
 describe('getStackId', () => {
     let tmpDir;
     afterEach(() => {
@@ -52,3 +52,53 @@ describe('getSandboxId', () => {
         assert.strictEqual(getSandboxId(tmpDir), 'alice-abc123');
     });
 });
+describe('getStackName', () => {
+    let tmpDir;
+    afterEach(() => {
+        if (tmpDir)
+            rmSync(tmpDir, { recursive: true, force: true });
+    });
+    it('production is <stackId>-prod', () => {
+        tmpDir = join(tmpdir(), `stack-name-prod-${Date.now()}`);
+        mkdirSync(join(tmpDir, '.blocks'), { recursive: true });
+        writeFileSync(join(tmpDir, '.blocks', 'config.json'), JSON.stringify({ stackId: 'my-app-k7x2mf' }));
+        assert.strictEqual(getStackName({ sandbox: false, projectRoot: tmpDir }), 'my-app-k7x2mf-prod');
+    });
+    it('sandbox is <stackId>-<sandboxId>', () => {
+        tmpDir = join(tmpdir(), `stack-name-sbx-${Date.now()}`);
+        mkdirSync(join(tmpDir, '.blocks'), { recursive: true });
+        writeFileSync(join(tmpDir, '.blocks', 'config.json'), JSON.stringify({ stackId: 'my-app-k7x2mf' }));
+        mkdirSync(join(tmpDir, '.blocks-sandbox'), { recursive: true });
+        writeFileSync(join(tmpDir, '.blocks-sandbox', 'sandbox-id.txt'), 'alice-0d7e1c');
+        assert.strictEqual(getStackName({ sandbox: true, projectRoot: tmpDir }), 'my-app-k7x2mf-alice-0d7e1c');
+    });
+    it('throws actionable error when config is missing (fail fast, no silent fallback)', () => {
+        tmpDir = join(tmpdir(), `stack-name-missing-${Date.now()}`);
+        mkdirSync(tmpDir, { recursive: true });
+        assert.throws(() => getStackName({ sandbox: false, projectRoot: tmpDir }), /\.blocks\/config\.json not found/);
+    });
+});
+describe('getStackName sandbox id (get-or-create)', () => {
+    let tmpDir;
+    afterEach(() => {
+        if (tmpDir)
+            rmSync(tmpDir, { recursive: true, force: true });
+    });
+    it('creates and persists sandbox-id.txt on first call when missing', () => {
+        tmpDir = join(tmpdir(), `stack-name-getorcreate-${Date.now()}`);
+        mkdirSync(join(tmpDir, '.blocks'), { recursive: true });
+        writeFileSync(join(tmpDir, '.blocks', 'config.json'), JSON.stringify({ stackId: 'test-app' }));
+        // No .blocks-sandbox dir yet — getStackName creates the id rather than throwing.
+        const name = getStackName({ sandbox: true, projectRoot: tmpDir });
+        assert.match(name, /^test-app-[a-z0-9]+-[a-f0-9]{6}$/);
+        // Persisted so later callers/processes resolve the identical name.
+        const stored = readFileSync(join(tmpDir, '.blocks-sandbox', 'sandbox-id.txt'), 'utf-8').trim();
+        assert.strictEqual(name, `test-app-${stored}`);
+    });
+    it('reuses the same id across calls', () => {
+        tmpDir = join(tmpdir(), `stack-name-getorcreate-idem-${Date.now()}`);
+        mkdirSync(join(tmpDir, '.blocks'), { recursive: true });
+        writeFileSync(join(tmpDir, '.blocks', 'config.json'), JSON.stringify({ stackId: 'test-app' }));
+        assert.strictEqual(getStackName({ sandbox: true, projectRoot: tmpDir }), getStackName({ sandbox: true, projectRoot: tmpDir }));
+    });
+});

package/dist/telemetry/client.d.ts

@@ -52,7 +52,9 @@ export declare function buildAndSendEvent(opts: BuildAndSendEventOptions): void;
 /**
  * Send a pre-built telemetry event to the collection endpoint.
  *
- * Fire-and-forget: no retry, 500ms timeout, all errors silently swallowed.
+ * Spawns a detached subprocess that performs the HTTPS POST independently of
+ * the parent CLI process. This ensures the request completes even when the
+ * parent exits on failure paths before an in-process request would flush.
  * Debug output available via `NODE_DEBUG=blocks-telemetry`.
  */
 export declare function sendEvent(event: BlocksTelemetryEvent): void;

package/dist/telemetry/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/telemetry/client.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAajF;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,GAAG,SAAS,CAWzD;AAwBD;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,wBAAwB,GAAG,oBAAoB,CAwD/E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,wBAAwB,GAAG,IAAI,CAatE;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,oBAAoB,GAAG,IAAI,CAyC3D"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/telemetry/client.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAYjF;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,GAAG,SAAS,CAWzD;AAwBD;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,wBAAwB,GAAG,oBAAoB,CAwD/E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,wBAAwB,GAAG,IAAI,CAatE;AAED;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,oBAAoB,GAAG,IAAI,CAgC3D"}

package/dist/telemetry/client.js

@@ -1,7 +1,7 @@
-import { request as httpsRequest } from 'node:https';
-import { request as httpRequest } from 'node:http';
 import { existsSync, readFileSync, mkdirSync, openSync, writeSync, closeSync, writeFileSync, constants } from 'node:fs';
+import { spawn } from 'node:child_process';
 import path from 'node:path';
+import { fileURLToPath } from 'node:url';
 import { debuglog } from 'node:util';
 import { CORE_VERSION } from '../version.js';
 import { Scope } from '../common/index.js';
@@ -11,7 +11,6 @@ import { getInstallationId, getProjectId, generateEventId } from './identifiers.
 // Debug log: writes to stderr via NODE_DEBUG=blocks-telemetry (developer-facing, for troubleshooting)
 const debug = debuglog('blocks-telemetry');
 const DEFAULT_ENDPOINT = 'https://blocks-telemetry.us-east-1.api.aws/metrics';
-const TIMEOUT_MS = 500;
 const TELEMETRY_VERSION = '1.0.0';
 function getEndpoint() {
     return process.env.BLOCKS_TELEMETRY_ENDPOINT || DEFAULT_ENDPOINT;
@@ -172,7 +171,9 @@ export function buildAndSendEvent(opts) {
 /**
  * Send a pre-built telemetry event to the collection endpoint.
  *
- * Fire-and-forget: no retry, 500ms timeout, all errors silently swallowed.
+ * Spawns a detached subprocess that performs the HTTPS POST independently of
+ * the parent CLI process. This ensures the request completes even when the
+ * parent exits on failure paths before an in-process request would flush.
  * Debug output available via `NODE_DEBUG=blocks-telemetry`.
  */
 export function sendEvent(event) {
@@ -187,27 +188,22 @@ export function sendEvent(event) {
             catch { }
         }
         debug('sending event to %s (%d bytes)', endpoint, Buffer.byteLength(payload));
-        const url = new URL(endpoint);
-        const isHttps = url.protocol === 'https:';
-        const requestFn = isHttps ? httpsRequest : httpRequest;
-        const req = requestFn({
-            hostname: url.hostname,
-            port: url.port || (isHttps ? '443' : '80'),
-            path: url.pathname + url.search,
-            method: 'POST',
-            headers: {
-                'Content-Type': 'application/json',
-                'Content-Length': Buffer.byteLength(payload),
-            },
-            timeout: TIMEOUT_MS,
-        }, (res) => {
-            debug('event sent (status=%d)', res.statusCode);
-            res.resume();
+        const dir = path.dirname(fileURLToPath(import.meta.url));
+        const workerPath = path.join(dir, 'telemetry-send-worker.js');
+        const child = spawn(process.execPath, [workerPath, endpoint], {
+            detached: true,
+            stdio: ['pipe', 'ignore', 'ignore'],
+            // Clear NODE_OPTIONS so inherited flags (e.g. --conditions=cdk) don't interfere
+            env: { ...process.env, NODE_OPTIONS: '' },
         });
-        req.on('error', (err) => { debug('send failed: %s', err.message); });
-        req.on('timeout', () => { debug('send timed out'); req.destroy(); });
-        req.write(payload);
-        req.end();
+        child.stdin.on('error', (err) => { debug('stdin write failed: %s', err.message); });
+        // Payload is small (<1KB JSON) so it fits in the kernel pipe buffer (~64KB)
+        // and survives the parent closing its fd on exit.
+        child.stdin.write(payload);
+        child.stdin.end();
+        child.on('error', (err) => { debug('spawn failed: %s', err.message); });
+        child.unref();
+        debug('spawned telemetry subprocess (pid=%d)', child.pid);
     }
     catch {
         // Telemetry must never throw or affect the user's command

package/dist/telemetry/telemetry-send-worker.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=telemetry-send-worker.d.ts.map

package/dist/telemetry/telemetry-send-worker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"telemetry-send-worker.d.ts","sourceRoot":"","sources":["../../src/telemetry/telemetry-send-worker.ts"],"names":[],"mappings":""}

package/dist/telemetry/telemetry-send-worker.js

@@ -0,0 +1,58 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Telemetry send worker — spawned as a detached subprocess.
+ * Reads JSON payload from stdin, POSTs it to the endpoint (argv[2]).
+ *
+ * Uses only Node built-ins — no project imports — so the compiled .js
+ * runs with bare `node` (no tsx needed).
+ */
+import { request as httpsRequest } from 'node:https';
+import { request as httpRequest } from 'node:http';
+const TIMEOUT_MS = 500;
+const debug = (process.env.NODE_DEBUG || '').includes('blocks-telemetry');
+const endpoint = process.argv[2];
+if (!endpoint)
+    process.exit(1);
+let payload = '';
+process.stdin.setEncoding('utf-8');
+process.stdin.on('data', (chunk) => { payload += chunk; });
+process.stdin.on('end', () => {
+    try {
+        const url = new URL(endpoint);
+        const isHttps = url.protocol === 'https:';
+        const requestFn = isHttps ? httpsRequest : httpRequest;
+        const req = requestFn({
+            hostname: url.hostname,
+            port: url.port || (isHttps ? '443' : '80'),
+            path: url.pathname + url.search,
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                'Content-Length': Buffer.byteLength(payload),
+            },
+            timeout: TIMEOUT_MS,
+        }, (res) => {
+            res.resume();
+            if (debug)
+                process.stderr.write(`BLOCKS-TELEMETRY: sent (status=${res.statusCode})\n`);
+            process.exit(0);
+        });
+        req.on('error', (e) => {
+            if (debug)
+                process.stderr.write(`BLOCKS-TELEMETRY: error: ${e.message}\n`);
+            process.exit(1);
+        });
+        req.on('timeout', () => {
+            if (debug)
+                process.stderr.write(`BLOCKS-TELEMETRY: timed out\n`);
+            req.destroy();
+            process.exit(1);
+        });
+        req.write(payload);
+        req.end();
+    }
+    catch {
+        process.exit(1);
+    }
+});

package/dist/telemetry/telemetry.test.js

@@ -10,7 +10,7 @@ import { isCI, detectOS, detectNodeVersion, detectPackageManager, detectAgent, c
 import { trackCommand, classifyError } from './trackCommand.js';
 import { buildAndSendEvent, buildEvent, sendEvent, getTelemetryFilePath } from './client.js';
 import { getInstallationId, getProjectId, generateEventId } from './identifiers.js';
-import { spawnSync } from 'node:child_process';
+import { spawnSync, spawn as spawnChild } from 'node:child_process';
 import { Scope } from '../common/index.js';
 const __dirname = dirname(fileURLToPath(import.meta.url));
 describe('telemetry/consent', () => {
@@ -453,6 +453,82 @@ describe('telemetry/client', () => {
         process.env = { ...originalEnv };
     });
 });
+describe('telemetry/send-worker', () => {
+    it('worker POSTs payload from stdin to endpoint', async () => {
+        const received = [];
+        const server = await new Promise((resolve) => {
+            const s = createServer((req, res) => {
+                let body = '';
+                req.on('data', (chunk) => { body += chunk; });
+                req.on('end', () => {
+                    received.push(body);
+                    res.writeHead(200);
+                    res.end();
+                });
+            });
+            s.listen(0, '127.0.0.1', () => resolve(s));
+        });
+        const addr = server.address();
+        const endpoint = `http://127.0.0.1:${addr.port}/collect`;
+        const payload = JSON.stringify({ test: true, command: 'dev' });
+        const workerPath = join(__dirname, 'telemetry-send-worker.js');
+        const exitCode = await new Promise((resolve) => {
+            const proc = spawnChild(process.execPath, [workerPath, endpoint], {
+                stdio: ['pipe', 'ignore', 'ignore'],
+                env: { ...process.env, NODE_OPTIONS: '' },
+            });
+            proc.stdin.write(payload);
+            proc.stdin.end();
+            proc.on('close', (code) => resolve(code));
+        });
+        assert.strictEqual(exitCode, 0);
+        assert.strictEqual(received.length, 1);
+        assert.deepStrictEqual(JSON.parse(received[0]), { test: true, command: 'dev' });
+        server.close();
+    });
+    it('worker exits with 1 on unreachable endpoint', async () => {
+        const payload = JSON.stringify({ test: true });
+        const workerPath = join(__dirname, 'telemetry-send-worker.js');
+        const exitCode = await new Promise((resolve) => {
+            const proc = spawnChild(process.execPath, [workerPath, 'http://127.0.0.1:1/unreachable'], {
+                stdio: ['pipe', 'ignore', 'ignore'],
+                env: { ...process.env, NODE_OPTIONS: '' },
+            });
+            proc.stdin.write(payload);
+            proc.stdin.end();
+            proc.on('close', (code) => resolve(code));
+        });
+        assert.strictEqual(exitCode, 1);
+    });
+    it('worker writes debug output to stderr when NODE_DEBUG is set', async () => {
+        const server = await new Promise((resolve) => {
+            const s = createServer((req, res) => {
+                let body = '';
+                req.on('data', (chunk) => { body += chunk; });
+                req.on('end', () => { res.writeHead(200); res.end(); });
+            });
+            s.listen(0, '127.0.0.1', () => resolve(s));
+        });
+        const addr = server.address();
+        const endpoint = `http://127.0.0.1:${addr.port}/collect`;
+        const payload = JSON.stringify({ test: true });
+        const workerPath = join(__dirname, 'telemetry-send-worker.js');
+        const result = await new Promise((resolve) => {
+            const proc = spawnChild(process.execPath, [workerPath, endpoint], {
+                stdio: ['pipe', 'ignore', 'pipe'],
+                env: { ...process.env, NODE_OPTIONS: '', NODE_DEBUG: 'blocks-telemetry' },
+            });
+            let stderr = '';
+            proc.stderr.on('data', (chunk) => { stderr += chunk.toString(); });
+            proc.stdin.write(payload);
+            proc.stdin.end();
+            proc.on('close', (code) => resolve({ code, stderr }));
+        });
+        assert.strictEqual(result.code, 0);
+        assert.ok(result.stderr.includes('BLOCKS-TELEMETRY: sent (status=200)'), `Expected debug output, got: ${result.stderr}`);
+        server.close();
+    });
+});
 describe('telemetry/trackCommand integration', () => {
     const originalEnv = { ...process.env };
     afterEach(() => {

package/dist/telemetry/trackCommand.d.ts

@@ -12,7 +12,7 @@ export declare function classifyError(error: unknown): {
  *
  * Measures wall-clock duration, classifies errors, and sends a single telemetry event
  * after the command completes (success or failure). The telemetry send is fire-and-forget
- * and bounded by a 5s timeout — it will never delay the command or affect its exit code.
+ * and bounded by a 500ms timeout — it will never delay the command or affect its exit code.
  *
  * If telemetry is disabled (via env var or config), the function is executed directly
  * with zero overhead.

package/dist/telemetry/trackCommand.js

@@ -20,10 +20,10 @@ export function classifyError(error) {
     if (msg.includes('cdk synth') || msg.includes('synthesis')) {
         return { code: 'CDK_SYNTH_FAILED', phase: 'synth' };
     }
-    if (msg.includes('cdk deploy') || msg.includes('deployment failed')) {
+    if (msg.includes('cdk deploy') || msg.includes('deployment failed') || (msg.includes('cdk') && msg.includes('deploy') && msg.includes('exited with code'))) {
         return { code: 'CDK_DEPLOY_FAILED', phase: 'deploy' };
     }
-    if (msg.includes('cdk destroy') || msg.includes('destroy failed')) {
+    if (msg.includes('cdk destroy') || msg.includes('destroy failed') || (msg.includes('cdk') && msg.includes('destroy') && msg.includes('exited with code'))) {
         return { code: 'CDK_DESTROY_FAILED', phase: 'destroy' };
     }
     if (msg.includes('npm install') || msg.includes('npm err')) {
@@ -48,7 +48,7 @@ export function classifyError(error) {
  *
  * Measures wall-clock duration, classifies errors, and sends a single telemetry event
  * after the command completes (success or failure). The telemetry send is fire-and-forget
- * and bounded by a 5s timeout — it will never delay the command or affect its exit code.
+ * and bounded by a 500ms timeout — it will never delay the command or affect its exit code.
  *
  * If telemetry is disabled (via env var or config), the function is executed directly
  * with zero overhead.

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const CORE_VERSION = "0.1.7";
+export declare const CORE_VERSION = "0.1.11";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"version.d.ts","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AACA,eAAO,MAAM,YAAY,UAAU,CAAC"}
+{"version":3,"file":"version.d.ts","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AACA,eAAO,MAAM,YAAY,WAAW,CAAC"}

package/dist/version.js

@@ -1,2 +1,2 @@
 // Auto-generated by scripts/generate-version.mjs — do not edit manually
-export const CORE_VERSION = '0.1.7';
+export const CORE_VERSION = '0.1.11';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws-blocks/core",
-  "version": "0.1.7",
+  "version": "0.1.11",
   "author": "Amazon Web Services",
   "license": "Apache-2.0",
   "type": "module",