@aws-blocks/core 0.2.0 → 0.3.0

package/dist/cdk/blocks-stack.test.js

@@ -1,12 +1,49 @@
 // Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
-import { test, describe, before } from 'node:test';
 import assert from 'node:assert';
-import { fileURLToPath } from 'node:url';
 import { dirname, join } from 'node:path';
+import { before, describe, test } from 'node:test';
+import { fileURLToPath } from 'node:url';
 import * as cdk from 'aws-cdk-lib';
+import * as apigateway from 'aws-cdk-lib/aws-apigateway';
+import * as lambda from 'aws-cdk-lib/aws-lambda-nodejs';
+import { BLOCKS_RPC_PREFIX } from '../constants.js';
 import { BlocksBackend } from './blocks-backend.js';
+import { Compute } from './compute/compute.js';
 import { BlocksStack, BlocksPresets, Scope } from './index.js';
+// A real app gets its default compute from @aws-blocks/bb-lambda-compute (via
+// @aws-blocks/blocks), which core's own tests can't depend on. Use an
+// equivalent inline stub: a Compute that owns a NodejsFunction + API Gateway,
+// so create() can build the default and the handler/gateway/apiUrl accessors
+// and synth-shape assertions have something real to resolve to. It is passed to
+// each create() via the internal `defaultComputeFactory` option (see makeStack /
+// makeBackend), exactly as @aws-blocks/blocks injects LambdaCompute.
+class StubLambdaCompute extends Compute {
+    fn;
+    apiGateway;
+    apiUrl;
+    constructor(scope, id) {
+        super(id, { parent: scope });
+        this.fn = new lambda.NodejsFunction(this, 'Handler', {
+            entry: this.backendHandlerPath,
+            runtime: cdk.aws_lambda.Runtime.NODEJS_22_X,
+            handler: 'handler',
+            role: this.executionRole,
+            environment: { BLOCKS_STACK_NAME: this.backendStackName },
+            bundling: { minify: true, esbuildArgs: { '--conditions': 'aws-runtime' } },
+        });
+        this.apiGateway = new apigateway.RestApi(this, 'API', { restApiName: 'Blocks API' });
+        this.apiGateway.root.addProxy({
+            defaultIntegration: new apigateway.LambdaIntegration(this.fn),
+            anyMethod: true,
+        });
+        this.apiUrl = `${this.apiGateway.url}${BLOCKS_RPC_PREFIX.slice(1)}`;
+    }
+    setEnv(key, value) {
+        this.fn.addEnvironment(key, value);
+    }
+}
+const stubComputeFactory = (root) => new StubLambdaCompute(root, 'DefaultCompute');
 // Simulate the CDK condition being active (tests import CDK files directly)
 before(() => {
     process.env.NODE_OPTIONS = (process.env.NODE_OPTIONS ?? '') + ' --conditions=cdk';
@@ -15,19 +52,15 @@ const __dirname = dirname(fileURLToPath(import.meta.url));
 const handlerPath = join(__dirname, '__fixtures__', 'handler.js');
 const sideEffectBackendPath = join(__dirname, '__fixtures__', 'side-effect-backend.js');
 const factoryBackendPath = join(__dirname, '__fixtures__', 'factory-backend.js');
+// Wrap create(), injecting the stub default-compute factory the way
+// @aws-blocks/blocks injects LambdaCompute — so tests don't repeat it.
+const makeStack = (scope, id, backendCDKPath) => BlocksStack.create(scope, id, { backendHandlerPath: handlerPath, backendCDKPath, defaults: BlocksPresets.production, defaultComputeFactory: stubComputeFactory });
+const makeBackend = (scope, id, backendCDKPath) => BlocksBackend.create(scope, id, { backendHandlerPath: handlerPath, backendCDKPath, defaults: BlocksPresets.production, defaultComputeFactory: stubComputeFactory });
 describe('ESM cache-busting (multi-stage)', () => {
     test('BlocksStack.create() with same backendCDKPath but different IDs produces constructs in each', async () => {
         const app = new cdk.App();
-        const stack1 = await BlocksStack.create(app, 'PipelineStage1', {
-            backendHandlerPath: handlerPath,
-            backendCDKPath: sideEffectBackendPath,
-            defaults: BlocksPresets.production,
-        });
-        const stack2 = await BlocksStack.create(app, 'PipelineStage2', {
-            backendHandlerPath: handlerPath,
-            backendCDKPath: sideEffectBackendPath,
-            defaults: BlocksPresets.production,
-        });
+        const stack1 = await makeStack(app, 'PipelineStage1', sideEffectBackendPath);
+        const stack2 = await makeStack(app, 'PipelineStage2', sideEffectBackendPath);
         const findMarker = (scope) => scope.node.tryFindChild('SideEffectMarker');
         assert.ok(findMarker(stack1), 'First stack should have SideEffectMarker from module side effect');
         assert.ok(findMarker(stack2), 'Second stack should have SideEffectMarker from re-executed module (cache busted)');
@@ -36,11 +69,7 @@ describe('ESM cache-busting (multi-stage)', () => {
 describe('factory function support', () => {
     test('BlocksStack.create() calls default export function with the stack instance', async () => {
         const app = new cdk.App();
-        const stack = await BlocksStack.create(app, 'FactoryBlocksStack', {
-            backendHandlerPath: handlerPath,
-            backendCDKPath: factoryBackendPath,
-            defaults: BlocksPresets.production,
-        });
+        const stack = await makeStack(app, 'FactoryBlocksStack', factoryBackendPath);
         const marker = stack.node.tryFindChild('FactoryMarker');
         assert.ok(marker, 'Factory function should have created FactoryMarker on the stack');
     });
@@ -49,11 +78,7 @@ describe('legacy side-effect mode (no default export)', () => {
     test('module with only side effects still registers constructs via globalThis', async () => {
         const app = new cdk.App();
         const stack = new cdk.Stack(app, 'LegacyTestStack');
-        const backend = await BlocksBackend.create(stack, 'LegacyStage', {
-            backendHandlerPath: handlerPath,
-            backendCDKPath: sideEffectBackendPath,
-            defaults: BlocksPresets.production,
-        });
+        const backend = await makeBackend(stack, 'LegacyStage', sideEffectBackendPath);
         const marker = backend.node.tryFindChild('SideEffectMarker');
         assert.ok(marker, 'Side-effect-only module should register construct via globalThis.CURRENT_BLOCKS_STACK');
     });
@@ -65,22 +90,14 @@ describe('shared execution role (BlocksStack)', () => {
     // executionRole — a separate code path from BlocksBackend's constructor.
     test('BlocksStack wires executionRole via its constructor', async () => {
         const app = new cdk.App();
-        const stack = await BlocksStack.create(app, 'StackRoleStack', {
-            backendHandlerPath: handlerPath,
-            backendCDKPath: sideEffectBackendPath,
-            defaults: BlocksPresets.production,
-        });
+        const stack = await makeStack(app, 'StackRoleStack', sideEffectBackendPath);
         assert.ok(stack.executionRole, 'BlocksStack should expose a populated .executionRole');
     });
 });
 describe('executionRole globalThis fallback', () => {
     test('resolves via globalThis.CURRENT_BLOCKS_STACK when no owner is in the tree', async () => {
         const app = new cdk.App();
-        const stack = await BlocksStack.create(app, 'FallbackStack', {
-            backendHandlerPath: handlerPath,
-            backendCDKPath: sideEffectBackendPath,
-            defaults: BlocksPresets.production,
-        });
+        const stack = await makeStack(app, 'FallbackStack', sideEffectBackendPath);
         // A Scope whose construct-tree ancestry has no BlocksStack/BlocksBackend
         // (parented under a plain cdk.Stack) exhausts the tree-walk and falls back
         // to globalThis.CURRENT_BLOCKS_STACK. The `as any` is test plumbing — a
@@ -91,6 +108,29 @@ describe('executionRole globalThis fallback', () => {
         assert.strictEqual(orphan.executionRole, stack.executionRole, 'fallback resolves to the ambient stack role');
     });
 });
+describe('root is bound to the owning stack (multi-stack synth)', () => {
+    test('a block under each of two stacks resolves its OWN stack, not the last globalThis', async () => {
+        // `root` is resolved once at Scope construction (not re-walked per getter),
+        // and `create()` mutates globalThis.CURRENT_BLOCKS_STACK for each stack it
+        // builds. With two stacks in one synth, a block constructed under the first
+        // must stay bound to the first even after the second stack is created and
+        // overwrites globalThis — otherwise its root-derived accessors (handler,
+        // executionRole, backendStackName) would silently point at the wrong stack.
+        const app = new cdk.App();
+        const stackA = await makeStack(app, 'RootBindingA', sideEffectBackendPath);
+        // A block explicitly parented under stackA (construct-tree walk resolves
+        // stackA regardless of the ambient globalThis).
+        const blockA = new Scope('blockA', { parent: stackA });
+        // Building the second stack overwrites globalThis.CURRENT_BLOCKS_STACK.
+        const stackB = await makeStack(app, 'RootBindingB', sideEffectBackendPath);
+        const blockB = new Scope('blockB', { parent: stackB });
+        assert.strictEqual(blockA.executionRole, stackA.executionRole, 'blockA stays bound to stackA');
+        assert.strictEqual(blockB.executionRole, stackB.executionRole, 'blockB binds to stackB');
+        assert.notStrictEqual(stackA.executionRole, stackB.executionRole, 'the two stacks have distinct roles');
+        assert.strictEqual(blockA.backendStackName, 'RootBindingA', 'blockA derives its own stack name');
+        assert.strictEqual(blockB.backendStackName, 'RootBindingB', 'blockB derives its own stack name');
+    });
+});
 describe('assertCdkConditionActive', () => {
     test('BlocksStack.create() throws when --conditions=cdk is missing', async () => {
         const origNodeOptions = process.env.NODE_OPTIONS;
@@ -99,11 +139,7 @@ describe('assertCdkConditionActive', () => {
         process.execArgv = [];
         try {
             const app = new cdk.App();
-            await assert.rejects(BlocksStack.create(app, 'MissingConditionStack', {
-                backendHandlerPath: handlerPath,
-                backendCDKPath: sideEffectBackendPath,
-                defaults: BlocksPresets.production,
-            }), (err) => {
+            await assert.rejects(makeStack(app, 'MissingConditionStack', sideEffectBackendPath), (err) => {
                 assert.ok(err.message.includes('Missing --conditions=cdk'), `Expected condition error, got: ${err.message}`);
                 return true;
             });

package/dist/cdk/compute/default-compute-factory.d.ts

@@ -0,0 +1,33 @@
+import type * as cdk from 'aws-cdk-lib';
+import type { Compute } from './compute.js';
+import type { BlocksStack } from '../index.js';
+import type { BlocksBackend } from '../blocks-backend.js';
+/**
+ * Lambda-shaped surface of the default compute that the legacy
+ * `handler` / `gateway` / `apiUrl` accessors on BlocksStack/BlocksBackend read.
+ * The default compute (`LambdaCompute` from `@aws-blocks/bb-lambda-compute`)
+ * satisfies this structurally, so core exposes those accessors without
+ * importing the concrete class. To be removed with those accessors once
+ * consumers move to the multi-compute model.
+ *
+ * @internal
+ */
+export interface LambdaShapedCompute extends Compute {
+    readonly fn: cdk.aws_lambda_nodejs.NodejsFunction;
+    readonly apiGateway: cdk.aws_apigateway.RestApi;
+    readonly apiUrl: string;
+}
+/**
+ * Builds the default {@link Compute} for a stack/backend. `create()` reads it
+ * from its props (`CoreBlocksStackProps.defaultComputeFactory`) and calls it to
+ * build the default without importing a concrete compute class — the factory is
+ * supplied by whoever owns both core and a concrete compute package (the
+ * umbrella `@aws-blocks/blocks`, which injects `LambdaCompute`). It lives on
+ * `CoreBlocksStackProps`/`CoreBlocksBackendProps`, which the umbrella derives
+ * from the customer-facing props, so it is absent from `BlocksStackProps` and
+ * customers cannot set it.
+ *
+ * @internal
+ */
+export type DefaultComputeFactory = (root: BlocksStack | BlocksBackend) => Compute;
+//# sourceMappingURL=default-compute-factory.d.ts.map

package/dist/cdk/compute/default-compute-factory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"default-compute-factory.d.ts","sourceRoot":"","sources":["../../../src/cdk/compute/default-compute-factory.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,KAAK,GAAG,MAAM,aAAa,CAAC;AACxC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAE1D;;;;;;;;;GASG;AACH,MAAM,WAAW,mBAAoB,SAAQ,OAAO;IACnD,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,iBAAiB,CAAC,cAAc,CAAC;IAClD,QAAQ,CAAC,UAAU,EAAE,GAAG,CAAC,cAAc,CAAC,OAAO,CAAC;IAChD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,IAAI,EAAE,WAAW,GAAG,aAAa,KAAK,OAAO,CAAC"}

package/dist/cdk/compute/default-compute-factory.js

@@ -0,0 +1,3 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+export {};

package/dist/cdk/index.d.ts

@@ -2,7 +2,9 @@ import * as cdk from 'aws-cdk-lib';
 import { Construct } from 'constructs';
 import { type BlocksStackProps, type BlocksStack as BaseBlocksStack, type ScopeParent, type ScopeOptions } from '../common/index.js';
 import { type BlocksDefaults } from './blocks-defaults.js';
-export { BlocksBackend, type BlocksBackendProps } from './blocks-backend.js';
+import type { Compute } from './compute/compute.js';
+import type { DefaultComputeFactory } from './compute/default-compute-factory.js';
+export { BlocksBackend, type BlocksBackendProps, type CoreBlocksBackendProps, SHARED_HANDLER_TIMEOUT_SECONDS, } from './blocks-backend.js';
 export { DEFAULT_NODE_RUNTIME } from './node-version.js';
 export { blocksNodejsBundling } from './bundling.js';
 export { SandboxDisableDeletionProtection } from './mixins.js';
@@ -11,18 +13,39 @@ export { type BlocksDefaults, BlocksPresets, } from './blocks-defaults.js';
 export { synthGuard } from './synth-guard.js';
 export type { ScopeOptions } from '../index.js';
 export { ApiError, isBlocksError, hasAuthError, DEFAULT_API_ERROR_NAME } from '../errors.js';
+/**
+ * Core's `create()` props: the public {@link BlocksStackProps} plus the required
+ * `defaultComputeFactory`. The umbrella (`@aws-blocks/blocks`) supplies the
+ * factory (which builds a `LambdaCompute`) by spreading it onto the customer's
+ * props; customers use {@link BlocksStackProps} and never set the factory.
+ *
+ * Kept separate (rather than a `create()` argument) so the factory travels with
+ * the props object and core stays free of any concrete compute class.
+ *
+ * @internal
+ */
+export interface CoreBlocksStackProps extends BlocksStackProps {
+    /** Builds the stack's default compute. Injected by `@aws-blocks/blocks`. */
+    defaultComputeFactory: DefaultComputeFactory;
+}
 export declare class BlocksStack extends cdk.Stack implements BaseBlocksStack {
     readonly id: string;
-    readonly apiUrl: string;
-    readonly gateway: cdk.aws_apigateway.RestApi;
-    readonly handler: cdk.aws_lambda_nodejs.NodejsFunction;
     readonly backendHandlerPath: string;
     /** Shared IAM role assumed by all Blocks compute. Building Blocks grant to this role. */
     readonly executionRole: cdk.aws_iam.IRole;
     /** Infrastructure defaults for Building Blocks created under this stack. */
     readonly defaults: BlocksDefaults;
+    /** The default compute (owns the Lambda function + API Gateway); set in `create()`. @internal */
+    _defaultCompute?: Compute;
+    /** The default compute's Lambda function. To be removed once consumers move to the multi-compute model. */
+    get handler(): cdk.aws_lambda_nodejs.NodejsFunction;
+    /** The default compute's API Gateway REST API. To be removed once consumers move to the multi-compute model. */
+    get gateway(): cdk.aws_apigateway.RestApi;
+    /** The default compute's RPC endpoint URL. To be removed once consumers move to the multi-compute model. */
+    get apiUrl(): string;
+    private requireDefaultCompute;
     private constructor();
-    static create(scope: Construct, id: string, props: BlocksStackProps): Promise<BlocksStack>;
+    static create(scope: Construct, id: string, props: CoreBlocksStackProps): Promise<BlocksStack>;
 }
 export declare class Scope extends Construct {
     readonly id: string;
@@ -37,6 +60,14 @@ export declare class Scope extends Construct {
      * tree walk.
      */
     private readonly root;
+    /**
+     * Compute assigned at this node. Applies to this block and is inherited by
+     * descendants (a nearer assignment wins). Covers both a handler assigned to a
+     * specific compute and a scope-level default for its subtree. Internal until
+     * the customer-facing surface exists.
+     * @internal
+     */
+    _compute?: Compute;
     constructor(id: string, options?: ScopeOptions);
     /**
      * Walk up the construct tree to the nearest owning BlocksStack/BlocksBackend;
@@ -51,6 +82,16 @@ export declare class Scope extends Construct {
      * route those grants to the role's default (inline) policy.
      */
     get executionRole(): cdk.aws_iam.IRole;
+    /**
+     * The compute this block runs on: the nearest `_compute` assigned on this
+     * block or an ancestor scope, else the owning stack/backend's default compute.
+     *
+     * For any app that doesn't assign a compute, this always resolves to the
+     * default — so reads are a no-op refactor. `_compute` is internal
+     * (test/framework) until the customer-facing surface exists; there is no
+     * public option to set it yet.
+     */
+    get compute(): Compute;
     /**
      * The backend entry file the owning BlocksStack/BlocksBackend runs — the
      * single handler entry shared across the whole app.

package/dist/cdk/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cdk/index.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,GAAG,MAAM,aAAa,CAAC;AACnC,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAGvC,OAAO,EACL,KAAK,gBAAgB,EACrB,KAAK,WAAW,IAAI,eAAe,EACnC,KAAK,WAAW,EAChB,KAAK,YAAY,EAElB,MAAM,oBAAoB,CAAC;AAI5B,OAAO,EAAE,KAAK,cAAc,EAAiB,MAAM,sBAAsB,CAAC;AAE1E,OAAO,EAAE,aAAa,EAAE,KAAK,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAC7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,gCAAgC,EAAE,MAAM,aAAa,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9E,OAAO,EACL,KAAK,cAAc,EACnB,aAAa,GACd,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,YAAY,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAE7F,qBAAa,WAAY,SAAQ,GAAG,CAAC,KAAM,YAAW,eAAe;IACnE,SAAgB,EAAE,EAAE,MAAM,CAAC;IAC3B,SAAgB,MAAM,EAAE,MAAM,CAAC;IAC/B,SAAgB,OAAO,EAAE,GAAG,CAAC,cAAc,CAAC,OAAO,CAAC;IACpD,SAAgB,OAAO,EAAE,GAAG,CAAC,iBAAiB,CAAC,cAAc,CAAC;IAC9D,SAAgB,kBAAkB,EAAE,MAAM,CAAC;IAC3C,yFAAyF;IACzF,SAAgB,aAAa,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC;IACjD,4EAA4E;IAC5E,SAAgB,QAAQ,EAAE,cAAc,CAAC;IAEzC,OAAO;WAgBM,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB;CA6B1E;AAED,qBAAa,KAAM,SAAQ,SAAS;IAClC,SAAgB,EAAE,EAAE,MAAM,CAAC;IAC3B,SAAgB,MAAM,EAAE,WAAW,CAAC;IAEpC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAE5B;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA8B;gBAEvC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY;IAQ9C;;;;OAIG;IACH,OAAO,CAAC,WAAW;IAcnB,IAAI,OAAO,yCAEV;IAED;;;;OAIG;IACH,IAAI,aAAa,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,CAErC;IAED;;;OAGG;IACH,IAAI,kBAAkB,IAAI,MAAM,CAE/B;IAED;;;;;;;OAOG;IACH,IAAI,gBAAgB,IAAI,MAAM,CAM7B;IAED,IAAI,MAAM,IAAI,MAAM,CAEnB;IAED;;;;;;;;;OASG;IACH,IAAI,QAAQ,IAAI,cAAc,CAuB7B;IAED,SAAS,CAAC,mBAAmB,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE;IAKnD,wBAAwB,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI;IACzD,qBAAqB,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI;IACtD,0BAA0B,CAAC,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,MAAM,EAAE,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI;IACrH,IAAI,gBAAgB,IAAI,SAAS,MAAM,EAAE,CAAe;IACxD,IAAI,cAAc,IAAI,SAAS,MAAM,EAAE,CAAe;CACvD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cdk/index.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,GAAG,MAAM,aAAa,CAAC;AACnC,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAGvC,OAAO,EACL,KAAK,gBAAgB,EACrB,KAAK,WAAW,IAAI,eAAe,EACnC,KAAK,WAAW,EAChB,KAAK,YAAY,EAElB,MAAM,oBAAoB,CAAC;AAI5B,OAAO,EAAE,KAAK,cAAc,EAAiB,MAAM,sBAAsB,CAAC;AAC1E,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,KAAK,EAAE,qBAAqB,EAAuB,MAAM,sCAAsC,CAAC;AAEvG,OAAO,EACN,aAAa,EACb,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,8BAA8B,GAC9B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,gCAAgC,EAAE,MAAM,aAAa,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9E,OAAO,EACL,KAAK,cAAc,EACnB,aAAa,GACd,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,YAAY,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAE7F;;;;;;;;;;GAUG;AACH,MAAM,WAAW,oBAAqB,SAAQ,gBAAgB;IAC5D,4EAA4E;IAC5E,qBAAqB,EAAE,qBAAqB,CAAC;CAC9C;AAED,qBAAa,WAAY,SAAQ,GAAG,CAAC,KAAM,YAAW,eAAe;IACnE,SAAgB,EAAE,EAAE,MAAM,CAAC;IAC3B,SAAgB,kBAAkB,EAAE,MAAM,CAAC;IAC3C,yFAAyF;IACzF,SAAgB,aAAa,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC;IACjD,4EAA4E;IAC5E,SAAgB,QAAQ,EAAE,cAAc,CAAC;IACzC,iGAAiG;IACjG,eAAe,CAAC,EAAE,OAAO,CAAC;IAE1B,2GAA2G;IAC3G,IAAI,OAAO,IAAI,GAAG,CAAC,iBAAiB,CAAC,cAAc,CAElD;IACD,gHAAgH;IAChH,IAAI,OAAO,IAAI,GAAG,CAAC,cAAc,CAAC,OAAO,CAExC;IACD,4GAA4G;IAC5G,IAAI,MAAM,IAAI,MAAM,CAEnB;IAED,OAAO,CAAC,qBAAqB;IAO7B,OAAO;WAaM,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,oBAAoB;CAoC9E;AAED,qBAAa,KAAM,SAAQ,SAAS;IAClC,SAAgB,EAAE,EAAE,MAAM,CAAC;IAC3B,SAAgB,MAAM,EAAE,WAAW,CAAC;IAEpC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAE5B;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA8B;IAEnD;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;gBAEP,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY;IAQ9C;;;;OAIG;IACH,OAAO,CAAC,WAAW;IAcnB,IAAI,OAAO,yCAEV;IAED;;;;OAIG;IACH,IAAI,aAAa,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,CAErC;IAED;;;;;;;;OAQG;IACH,IAAI,OAAO,IAAI,OAAO,CAUrB;IAED;;;OAGG;IACH,IAAI,kBAAkB,IAAI,MAAM,CAE/B;IAED;;;;;;;OAOG;IACH,IAAI,gBAAgB,IAAI,MAAM,CAM7B;IAED,IAAI,MAAM,IAAI,MAAM,CAEnB;IAED;;;;;;;;;OASG;IACH,IAAI,QAAQ,IAAI,cAAc,CAuB7B;IAED,SAAS,CAAC,mBAAmB,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE;IAKnD,wBAAwB,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI;IACzD,qBAAqB,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI;IACtD,0BAA0B,CAAC,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,MAAM,EAAE,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI;IACrH,IAAI,gBAAgB,IAAI,SAAS,MAAM,EAAE,CAAe;IACxD,IAAI,cAAc,IAAI,SAAS,MAAM,EAAE,CAAe;CACvD"}

package/dist/cdk/index.js

@@ -9,7 +9,7 @@ import { setupBlocksInfra, BlocksBackend, assertCdkConditionActive } from './blo
 import { addBlocksStackMetadata } from './stack-metadata.js';
 import { finalizeConfigRegistry } from './config-registry.js';
 import { BlocksPresets } from './blocks-defaults.js';
-export { BlocksBackend } from './blocks-backend.js';
+export { BlocksBackend, SHARED_HANDLER_TIMEOUT_SECONDS, } from './blocks-backend.js';
 export { DEFAULT_NODE_RUNTIME } from './node-version.js';
 export { blocksNodejsBundling } from './bundling.js';
 export { SandboxDisableDeletionProtection } from './mixins.js';
@@ -19,14 +19,31 @@ export { synthGuard } from './synth-guard.js';
 export { ApiError, isBlocksError, hasAuthError, DEFAULT_API_ERROR_NAME } from '../errors.js';
 export class BlocksStack extends cdk.Stack {
     id;
-    apiUrl;
-    gateway;
-    handler;
     backendHandlerPath;
     /** Shared IAM role assumed by all Blocks compute. Building Blocks grant to this role. */
     executionRole;
     /** Infrastructure defaults for Building Blocks created under this stack. */
     defaults;
+    /** The default compute (owns the Lambda function + API Gateway); set in `create()`. @internal */
+    _defaultCompute;
+    /** The default compute's Lambda function. To be removed once consumers move to the multi-compute model. */
+    get handler() {
+        return this.requireDefaultCompute().fn;
+    }
+    /** The default compute's API Gateway REST API. To be removed once consumers move to the multi-compute model. */
+    get gateway() {
+        return this.requireDefaultCompute().apiGateway;
+    }
+    /** The default compute's RPC endpoint URL. To be removed once consumers move to the multi-compute model. */
+    get apiUrl() {
+        return this.requireDefaultCompute().apiUrl;
+    }
+    requireDefaultCompute() {
+        if (!this._defaultCompute) {
+            throw new Error('Blocks stack not fully initialized — access .handler/.gateway/.apiUrl after BlocksStack.create() resolves.');
+        }
+        return this._defaultCompute;
+    }
     constructor(scope, id, props) {
         super(scope, id, props);
         this.id = id;
@@ -35,9 +52,6 @@ export class BlocksStack extends cdk.Stack {
         // Set globalThis so Building Blocks attach directly to this stack
         globalThis.CURRENT_BLOCKS_STACK = this;
         const infra = setupBlocksInfra(this, props, id);
-        this.handler = infra.handler;
-        this.gateway = infra.gateway;
-        this.apiUrl = infra.apiUrl;
         this.executionRole = infra.executionRole;
     }
     static async create(scope, id, props) {
@@ -46,6 +60,13 @@ export class BlocksStack extends cdk.Stack {
         const pipelineScope = globalThis[__PIPELINE_STAGE_SCOPE__];
         const actualScope = pipelineScope || scope;
         const stack = new BlocksStack(actualScope, id, props);
+        // Create the default compute before importing the backend: it OWNS the
+        // Lambda function + API Gateway (which back .handler/.gateway/.apiUrl), and
+        // a block reading `this.compute` in its constructor (during that import)
+        // must resolve to it. The factory is supplied by the umbrella
+        // @aws-blocks/blocks (which injects LambdaCompute) via props, so core never
+        // imports the concrete compute class.
+        stack._defaultCompute = props.defaultComputeFactory(stack);
         // file:// URL (not a raw path) so the cache-busting query works on Windows,
         // where an absolute path like `D:\...` is rejected as URL scheme `d:`.
         const backendUrl = pathToFileURL(props.backendCDKPath);
@@ -79,6 +100,14 @@ export class Scope extends Construct {
      * tree walk.
      */
     root;
+    /**
+     * Compute assigned at this node. Applies to this block and is inherited by
+     * descendants (a nearer assignment wins). Covers both a handler assigned to a
+     * specific compute and a scope-level default for its subtree. Internal until
+     * the customer-facing surface exists.
+     * @internal
+     */
+    _compute;
     constructor(id, options) {
         const parent = options?.parent || globalThis.CURRENT_BLOCKS_STACK;
         super(parent, id);
@@ -115,6 +144,27 @@ export class Scope extends Construct {
     get executionRole() {
         return this.root.executionRole;
     }
+    /**
+     * The compute this block runs on: the nearest `_compute` assigned on this
+     * block or an ancestor scope, else the owning stack/backend's default compute.
+     *
+     * For any app that doesn't assign a compute, this always resolves to the
+     * default — so reads are a no-op refactor. `_compute` is internal
+     * (test/framework) until the customer-facing surface exists; there is no
+     * public option to set it yet.
+     */
+    get compute() {
+        for (let current = this; current; current = current.parent) {
+            const assigned = current._compute;
+            if (assigned)
+                return assigned;
+        }
+        const defaultCompute = this.root._defaultCompute;
+        if (!defaultCompute) {
+            throw new Error('Default compute not initialized — BlocksStack/BlocksBackend.create() must run before resolving `compute`.');
+        }
+        return defaultCompute;
+    }
     /**
      * The backend entry file the owning BlocksStack/BlocksBackend runs — the
      * single handler entry shared across the whole app.

package/dist/cdk/internal.d.ts

@@ -20,5 +20,6 @@
  * @internal
  */
 export { Compute } from './compute/compute.js';
+export type { DefaultComputeFactory } from './compute/default-compute-factory.js';
 export { BLOCKS_NAMESPACE } from '../constants.js';
 //# sourceMappingURL=internal.d.ts.map

package/dist/cdk/internal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"internal.d.ts","sourceRoot":"","sources":["../../src/cdk/internal.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAG/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"internal.d.ts","sourceRoot":"","sources":["../../src/cdk/internal.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,YAAY,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAGlF,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/hosting-secrets.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Resolution glue between the dependency-free `secret()` / `config()` markers
+ * (defined in `@aws-blocks/hosting`) and the `Hosting` CDK block.
+ *
+ * Delegates to the shared `@aws-blocks/hosting` engine, pinning only the Blocks
+ * namespaces (`/blocks/secrets`, `/blocks/config`). The store is derived from the
+ * marker's kind (`secret` → Secrets Manager, `config` → SSM), and BYO
+ * `ISecret`/`IParameter` handles are wired identically.
+ *
+ * @module
+ */
+import type { ManagedValue } from '@aws-blocks/hosting';
+import { type ByoBinding, type DomainNameInput as LeafDomainNameInput, type EnvValue as LeafEnvValue, type SecretFetcher, type StoreConfig } from '@aws-blocks/hosting/constructs';
+import type * as cdk from 'aws-cdk-lib';
+/** A `compute.environment` value: a literal, a managed marker, or a BYO CDK handle. */
+export type EnvValue = LeafEnvValue;
+/** A custom-domain name: a literal, a managed marker, or a mix in an array. */
+export type DomainNameInput = LeafDomainNameInput;
+/** Split an environment map into plain literals, managed markers, and BYO handles. */
+export declare function partitionEnvironment(environment: Record<string, EnvValue> | undefined): {
+    plain: Record<string, string>;
+    managed: ManagedValue[];
+    byo: ByoBinding[];
+};
+/** Every managed marker requiring a synth-time fetch (domain markers only). */
+export declare function collectSynthMarkers(domainName: DomainNameInput | undefined): ManagedValue[];
+/**
+ * Resolve managed markers to plaintext at synth time under the Blocks namespaces.
+ * Throws a clear, actionable error if a referenced value was never set. An optional
+ * `storeConfig` overrides the pinned Blocks prefix/stage per kind.
+ */
+export declare function resolveSecretsAtSynth(markers: ManagedValue[], fetcher?: SecretFetcher, storeConfig?: StoreConfig): Promise<Map<string, string>>;
+/** Resolve domain markers to literals using the synth-resolved value map. */
+export declare function resolveDomainNames(domainName: DomainNameInput, resolved: Map<string, string>): string | string[];
+/**
+ * Fail synth (deploy) when a referenced `environment` marker has no value set —
+ * existence only, never fetching the value. Uses the Blocks namespaces (with an
+ * optional per-kind `storeConfig` override), matching how the values are wired.
+ */
+export declare function assertMarkersExistAtSynth(markers: ManagedValue[], storeConfig?: StoreConfig): Promise<void>;
+/**
+ * Wire a runtime managed marker under the Blocks namespace (store from kind). An
+ * optional `storeConfig` overrides the pinned prefix/stage/cacheTtlSeconds per kind.
+ */
+export declare function wireManagedValue(fn: cdk.aws_lambda.Function, marker: ManagedValue, storeConfig?: StoreConfig): void;
+/** Wire a runtime BYO handle (grant + inject locator). Honors an optional `storeConfig`. */
+export declare function wireByo(fn: cdk.aws_lambda.Function, binding: ByoBinding, storeConfig?: StoreConfig): void;
+//# sourceMappingURL=hosting-secrets.d.ts.map

package/dist/hosting-secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hosting-secrets.d.ts","sourceRoot":"","sources":["../src/hosting-secrets.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EACN,KAAK,UAAU,EACf,KAAK,eAAe,IAAI,mBAAmB,EAC3C,KAAK,QAAQ,IAAI,YAAY,EAM7B,KAAK,aAAa,EAClB,KAAK,WAAW,EAGhB,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,KAAK,GAAG,MAAM,aAAa,CAAC;AAiBxC,uFAAuF;AACvF,MAAM,MAAM,QAAQ,GAAG,YAAY,CAAC;AAEpC,+EAA+E;AAC/E,MAAM,MAAM,eAAe,GAAG,mBAAmB,CAAC;AAElD,sFAAsF;AACtF,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,SAAS,GAAG;IACxF,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,GAAG,EAAE,UAAU,EAAE,CAAC;CAClB,CAEA;AAED,+EAA+E;AAC/E,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,eAAe,GAAG,SAAS,GAAG,YAAY,EAAE,CAE3F;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CAC1C,OAAO,EAAE,YAAY,EAAE,EACvB,OAAO,CAAC,EAAE,aAAa,EACvB,WAAW,CAAC,EAAE,WAAW,GACvB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAE9B;AAED,6EAA6E;AAC7E,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,eAAe,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,GAAG,MAAM,EAAE,CAEhH;AAED;;;;GAIG;AACH,wBAAsB,yBAAyB,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,WAAW,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAEjH;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,GAAG,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,CAAC,EAAE,WAAW,GAAG,IAAI,CAEnH;AAED,4FAA4F;AAC5F,wBAAgB,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,UAAU,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,EAAE,WAAW,GAAG,IAAI,CAEzG"}

package/dist/hosting-secrets.js

@@ -0,0 +1,57 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+import { assertMarkersExistAtSynth as leafAssertMarkersExistAtSynth, collectSynthMarkers as leafCollectSynthMarkers, partitionEnvironment as leafPartitionEnvironment, resolveDomainNames as leafResolveDomainNames, resolveSecretsAtSynth as leafResolveSecretsAtSynth, wireByo as leafWireByo, wireManagedValue as leafWireManagedValue, } from '@aws-blocks/hosting/constructs';
+import { blocksStoreConfig } from './secret-naming.js';
+/**
+ * Layer a caller's per-kind store config over the pinned Blocks defaults. Shallow
+ * and per-kind: the Blocks `/blocks/*` prefix stays the default, but any field the
+ * app sets (`prefix`, `stage`, `cacheTtlSeconds`) wins.
+ */
+function mergeBlocksStoreConfig(override) {
+    const base = blocksStoreConfig();
+    if (!override)
+        return base;
+    return {
+        secretStore: { ...base.secretStore, ...override.secretStore },
+        configStore: { ...base.configStore, ...override.configStore },
+    };
+}
+/** Split an environment map into plain literals, managed markers, and BYO handles. */
+export function partitionEnvironment(environment) {
+    return leafPartitionEnvironment(environment);
+}
+/** Every managed marker requiring a synth-time fetch (domain markers only). */
+export function collectSynthMarkers(domainName) {
+    return leafCollectSynthMarkers(domainName);
+}
+/**
+ * Resolve managed markers to plaintext at synth time under the Blocks namespaces.
+ * Throws a clear, actionable error if a referenced value was never set. An optional
+ * `storeConfig` overrides the pinned Blocks prefix/stage per kind.
+ */
+export async function resolveSecretsAtSynth(markers, fetcher, storeConfig) {
+    return leafResolveSecretsAtSynth(markers, { ...mergeBlocksStoreConfig(storeConfig), fetcher });
+}
+/** Resolve domain markers to literals using the synth-resolved value map. */
+export function resolveDomainNames(domainName, resolved) {
+    return leafResolveDomainNames(domainName, resolved);
+}
+/**
+ * Fail synth (deploy) when a referenced `environment` marker has no value set —
+ * existence only, never fetching the value. Uses the Blocks namespaces (with an
+ * optional per-kind `storeConfig` override), matching how the values are wired.
+ */
+export async function assertMarkersExistAtSynth(markers, storeConfig) {
+    return leafAssertMarkersExistAtSynth(markers, mergeBlocksStoreConfig(storeConfig));
+}
+/**
+ * Wire a runtime managed marker under the Blocks namespace (store from kind). An
+ * optional `storeConfig` overrides the pinned prefix/stage/cacheTtlSeconds per kind.
+ */
+export function wireManagedValue(fn, marker, storeConfig) {
+    leafWireManagedValue(fn, marker, mergeBlocksStoreConfig(storeConfig));
+}
+/** Wire a runtime BYO handle (grant + inject locator). Honors an optional `storeConfig`. */
+export function wireByo(fn, binding, storeConfig) {
+    leafWireByo(fn, binding, mergeBlocksStoreConfig(storeConfig));
+}

package/dist/hosting-secrets.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=hosting-secrets.test.d.ts.map

package/dist/hosting-secrets.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hosting-secrets.test.d.ts","sourceRoot":"","sources":["../src/hosting-secrets.test.ts"],"names":[],"mappings":""}

package/dist/hosting-secrets.test.js

@@ -0,0 +1,81 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+import assert from 'node:assert';
+import { describe, it } from 'node:test';
+import { config, secret } from '@aws-blocks/hosting';
+import { collectSynthMarkers, partitionEnvironment, resolveDomainNames, resolveSecretsAtSynth, } from './hosting-secrets.js';
+void describe('partitionEnvironment()', () => {
+    void it('splits plain / managed (secret+config)', () => {
+        const { plain, managed } = partitionEnvironment({
+            FLAG: 'on',
+            STRIPE_KEY: secret('STRIPE_KEY'),
+            FEATURE_FLAGS: config('FEATURE_FLAGS'),
+        });
+        assert.deepStrictEqual(plain, { FLAG: 'on' });
+        assert.deepStrictEqual(managed.map((m) => `${m.key}:${m.kind}`).sort(), [
+            'FEATURE_FLAGS:config',
+            'STRIPE_KEY:secret',
+        ]);
+    });
+    void it('rejects env key / marker key mismatch', () => {
+        assert.throws(() => partitionEnvironment({ STRIPE_KEY: secret('OTHER') }), /must match the environment variable name/);
+    });
+    void it('handles undefined', () => {
+        const { plain, managed, byo } = partitionEnvironment(undefined);
+        assert.deepStrictEqual(plain, {});
+        assert.strictEqual(managed.length, 0);
+        assert.strictEqual(byo.length, 0);
+    });
+});
+void describe('collectSynthMarkers()', () => {
+    void it('gathers domain markers, deduped by key', () => {
+        const markers = collectSynthMarkers(['example.com', config('DOMAIN_PROD'), config('DOMAIN_PROD')]);
+        assert.deepStrictEqual(markers.map((m) => m.key), ['DOMAIN_PROD']);
+    });
+    void it('returns nothing when no markers', () => {
+        assert.deepStrictEqual(collectSynthMarkers('example.com'), []);
+        assert.deepStrictEqual(collectSynthMarkers(undefined), []);
+    });
+});
+void describe('resolveSecretsAtSynth() — Blocks namespaces', () => {
+    void it('config marker resolves under /blocks/config (SSM leading-slash)', async () => {
+        const seen = [];
+        const resolved = await resolveSecretsAtSynth([config('DOMAIN_PROD')], async (name) => {
+            seen.push(name);
+            return 'prod.example.com';
+        });
+        assert.deepStrictEqual(seen, ['/blocks/config/DOMAIN_PROD']);
+        assert.strictEqual(resolved.get('DOMAIN_PROD'), 'prod.example.com');
+    });
+    void it('secret marker resolves under /blocks/secrets (Secrets Manager slash-free)', async () => {
+        const seen = [];
+        await resolveSecretsAtSynth([secret('API_KEY')], async (name) => {
+            seen.push(name);
+            return 'k';
+        });
+        assert.deepStrictEqual(seen, ['blocks/secrets/API_KEY']);
+    });
+    void it('throws an actionable error when a value is not set', async () => {
+        await assert.rejects(resolveSecretsAtSynth([config('DOMAIN_PROD')], async () => {
+            const e = new Error('not found');
+            e.name = 'ParameterNotFound';
+            throw e;
+        }), /config 'DOMAIN_PROD' is referenced/);
+    });
+});
+void describe('resolveDomainNames()', () => {
+    void it('replaces markers with resolved literals, preserving shape', () => {
+        const resolved = new Map([['DOMAIN_PROD', 'prod.example.com']]);
+        assert.strictEqual(resolveDomainNames(config('DOMAIN_PROD'), resolved), 'prod.example.com');
+        assert.deepStrictEqual(resolveDomainNames(['www.example.com', config('DOMAIN_PROD')], resolved), [
+            'www.example.com',
+            'prod.example.com',
+        ]);
+    });
+    void it('throws if a marker reached the sync path unresolved', () => {
+        assert.throws(() => resolveDomainNames(config('DOMAIN_PROD'), new Map()), /requires async resolution/);
+    });
+    void it('passes literal domains through untouched', () => {
+        assert.strictEqual(resolveDomainNames('example.com', new Map()), 'example.com');
+    });
+});