@aws-blocks/core 0.2.0 → 0.3.0

package/dist/hosting.d.ts

@@ -1,8 +1,9 @@
+import type { FrameworkType, KindStoreOptions } from '@aws-blocks/hosting/constructs';
+import { type FrameworkAdapterFn } from '@aws-blocks/hosting/adapters';
+import { type HostingDomainConfig, type HostingWafConfig, type SkewProtectionConfig } from '@aws-blocks/hosting/constructs';
 import * as cdk from 'aws-cdk-lib';
 import { Construct } from 'constructs';
-import { type HostingDomainConfig, type HostingWafConfig, type SkewProtectionConfig } from '@aws-blocks/hosting/constructs';
-import { type FrameworkAdapterFn } from '@aws-blocks/hosting/adapters';
-import type { FrameworkType } from '@aws-blocks/hosting';
+import { type DomainNameInput, type EnvValue } from './hosting-secrets.js';
 /**
  * Lambda compute configuration for SSR frameworks.
  *
@@ -62,6 +63,18 @@ export type ComputeConfig = {
     logRetention?: cdk.aws_logs.RetentionDays;
 };
 export type { FrameworkType, HostingDomainConfig, HostingWafConfig, SkewProtectionConfig };
+/**
+ * Custom-domain config for the Blocks {@link Hosting} block — the leaf
+ * {@link HostingDomainConfig} with `domainName` widened to also accept a
+ * `config()` marker (resolved to a literal at synth). Only `config()` or a plain
+ * string is accepted here, never `secret()` (a synth-inlined value would leak into
+ * the template). All other fields (`hostedZone`, `certificate`, `wwwRedirect`, …)
+ * are inherited unchanged from {@link HostingDomainConfig}.
+ */
+export interface HostingDomain extends Omit<HostingDomainConfig, 'domainName'> {
+    /** Domain name(s): a plain string / string[] and/or a `config()` marker resolved at synth. */
+    domainName: DomainNameInput;
+}
 /**
  * Structural interface for the Blocks backend stack.
  *
@@ -146,8 +159,52 @@ export interface HostingProps {
     backendConfig?: Record<string, unknown>;
     /** Lambda compute configuration for SSR frameworks. */
     compute?: ComputeConfig;
-    /** Custom domain configuration. */
-    domain?: HostingDomainConfig;
+    /**
+     * Custom environment variables injected into all compute Lambda functions.
+     *
+     * Values are either plain strings or {@link secret} references:
+     *
+     * ```ts
+     * environment: {
+     *   FEATURE_FLAG: 'on',                 // plaintext (in CFN template + Lambda config)
+     *   STRIPE_KEY: secret('STRIPE_KEY'),   // encrypted; read at runtime via getSecret()
+     * }
+     * ```
+     *
+     * A plain string is injected verbatim (visible in the CloudFormation
+     * template — safe for non-sensitive literals). A `secret('K')` value (AWS
+     * Secrets Manager) or `config('K')` value (SSM Parameter Store) injects only
+     * the store LOCATOR — never the value — and grants the compute role scoped
+     * read + decrypt; fetch it at runtime with `await getSecret('K')` /
+     * `await getConfig('K')`. A bring-your-own CDK `ISecret` / `IParameter` handle
+     * is accepted too and resolves identically.
+     *
+     * The env-var name must equal the key: `STRIPE_KEY: secret('STRIPE_KEY')`.
+     */
+    environment?: Record<string, EnvValue>;
+    /**
+     * Custom domain configuration. `domainName` accepts plain strings and/or
+     * {@link config} references (e.g. `domain: { domainName: config('DOMAIN_PROD') }`).
+     * A domain is resolved at synth time and inlined as a literal into the template,
+     * so only `config()` (non-sensitive → SSM) is allowed here, never `secret()`
+     * (which would leak into the template). Any domain marker requires constructing
+     * via the async {@link Hosting.create}.
+     */
+    domain?: HostingDomain;
+    /**
+     * Namespace/cache config for `secret()` values (AWS Secrets Manager). Defaults
+     * to the Blocks `/blocks/secrets` prefix; set `prefix` to namespace per app,
+     * `stage` for per-stage values with a shared fallback, or `cacheTtlSeconds` to
+     * refresh a rotated value on a warm compute without a cold start. Any field the
+     * app sets overrides the Blocks default.
+     */
+    secretStore?: KindStoreOptions;
+    /**
+     * Namespace/cache config for `config()` values (SSM Parameter Store). Defaults
+     * to the Blocks `/blocks/config` prefix; same override semantics as
+     * {@link HostingProps.secretStore}.
+     */
+    configStore?: KindStoreOptions;
     /** WAF protection configuration. */
     waf?: HostingWafConfig;
     /** Retain the S3 bucket when the stack is deleted. Default: false. */
@@ -322,7 +379,32 @@ export declare class Hosting extends Construct {
     readonly buildCacheBucket?: cdk.aws_s3.Bucket;
     /** SNS topic for hosting CloudWatch alarms (present when `monitoring.enabled` is true). */
     readonly monitoringTopic?: cdk.aws_sns.ITopic;
-    constructor(scope: Construct, id: string, props: HostingProps);
+    /**
+     * Async constructor. Required when a `secret()` / `config()` value resolves at
+     * **synth time** — i.e. a `domain.domainName` marker — because that value is
+     * fetched from its store (Secrets Manager / SSM) during synthesis. Returns a
+     * fully-constructed {@link Hosting}.
+     *
+     * For runtime `environment` markers (read via `getSecret`/`getConfig`) and
+     * plain literals, `new Hosting(...)` works directly; `create()` is also safe
+     * to use uniformly.
+     *
+     * @example
+     * ```ts
+     * await Hosting.create(stack, 'Web', {
+     *   root: '.', framework: 'nextjs', api: blocksStack,
+     *   domain: { domainName: config('DOMAIN_PROD') },
+     * });
+     * ```
+     */
+    static create(scope: Construct, id: string, props: HostingProps): Promise<Hosting>;
+    /**
+     * @param resolvedSecrets - Synth-time-resolved secret values, keyed by secret
+     *   key. Populated by {@link Hosting.create}; empty for the direct
+     *   `new Hosting()` path (which then rejects any synth-time secret with a
+     *   clear "use Hosting.create()" error).
+     */
+    constructor(scope: Construct, id: string, props: HostingProps, resolvedSecrets?: Map<string, string>);
     /**
      * Build the config.json payload from props.
      *

package/dist/hosting.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hosting.d.ts","sourceRoot":"","sources":["../src/hosting.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,GAAG,MAAM,aAAa,CAAC;AASnC,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAKvC,OAAO,EAIL,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EAC1B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAIL,KAAK,kBAAkB,EACxB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAGV,aAAa,EACd,MAAM,qBAAqB,CAAC;AAQ7B;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,8CAA8C;IAC9C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,EAAE,GAAG,CAAC,QAAQ,GAAG,MAAM,CAAC;IAChC,8FAA8F;IAC9F,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;;;;;;;;;;;OAgBG;IACH,iBAAiB,CAAC,EAAE;QAClB,2EAA2E;QAC3E,mBAAmB,CAAC,EAAE,MAAM,CAAC;KAC9B,CAAC;IACF,uEAAuE;IACvE,YAAY,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC;CAC3C,CAAC;AAEF,YAAY,EAAE,aAAa,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,CAAC;AAE3F;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,mHAAmH;IACnH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,YAAY;IAE3B,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAC;IAEb;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;;OAGG;IACH,SAAS,CAAC,EAAE,aAAa,CAAC;IAE1B;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,mEAAmE;IACnE,aAAa,CAAC,EAAE,kBAAkB,CAAC;IAEnC;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAGlB;;;;;;;;OAQG;IACH,GAAG,CAAC,EAAE,cAAc,CAAC;IAErB;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAGxC,uDAAuD;IACvD,OAAO,CAAC,EAAE,aAAa,CAAC;IAExB,mCAAmC;IACnC,MAAM,CAAC,EAAE,mBAAmB,CAAC;IAE7B,oCAAoC;IACpC,GAAG,CAAC,EAAE,gBAAgB,CAAC;IAEvB,sEAAsE;IACtE,cAAc,CAAC,EAAE,OAAO,CAAC;IAEzB,mDAAmD;IACnD,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAE/B,wDAAwD;IACxD,UAAU,CAAC,EAAE,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC;IAE3C;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE;QACf,IAAI,EAAE,WAAW,GAAG,WAAW,CAAC;QAChC,SAAS,EAAE,MAAM,EAAE,CAAC;KACrB,CAAC;IAEF;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,MAAM,CAAC,EAAE;QACP,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB;;;;;;;;WAQG;QACH,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;IAEF;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE;QACX,OAAO,EAAE,OAAO,CAAC;QACjB,0EAA0E;QAC1E,MAAM,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC;KAC7B,CAAC;IAEF;;;;;;;;;;;;;OAaG;IACH,UAAU,CAAC,EAAE;QACX,iEAAiE;QACjE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,iEAAiE;QACjE,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IAEF;;;OAGG;IACH,OAAO,CAAC,EAAE;QACR,wCAAwC;QACxC,OAAO,EAAE,OAAO,CAAC;QACjB,+CAA+C;QAC/C,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;IAEF;;;;;;OAMG;IACH,UAAU,CAAC,EAAE;QACX,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,6DAA6D;QAC7D,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IAEF;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,oBAAoB,CAAC;CACvC;AAaD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,qBAAa,OAAQ,SAAQ,SAAS;IACpC,2CAA2C;IAC3C,SAAgB,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC;IAC1C,mCAAmC;IACnC,SAAgB,YAAY,EAAE,GAAG,CAAC,cAAc,CAAC,YAAY,CAAC;IAC9D,yDAAyD;IACzD,SAAgB,GAAG,EAAE,MAAM,CAAC;IAC5B,gFAAgF;IAChF,SAAgB,WAAW,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC;IACtD,wFAAwF;IACxF,SAAgB,gBAAgB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC;IACrD,2FAA2F;IAC3F,SAAgB,eAAe,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;gBAEzC,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY;IA8S7D;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IAOvB;;OAEG;IACH,OAAO,CAAC,eAAe;CAwDxB"}
+{"version":3,"file":"hosting.d.ts","sourceRoot":"","sources":["../src/hosting.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAkB,aAAa,EAAE,gBAAgB,EAAiB,MAAM,gCAAgC,CAAC;AACrH,OAAO,EAAmB,KAAK,kBAAkB,EAAiC,MAAM,8BAA8B,CAAC;AACvH,OAAO,EAIL,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EAC1B,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,GAAG,MAAM,aAAa,CAAC;AAInC,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAIvC,OAAO,EAGL,KAAK,eAAe,EACpB,KAAK,QAAQ,EAMd,MAAM,sBAAsB,CAAC;AAK9B;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,8CAA8C;IAC9C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,EAAE,GAAG,CAAC,QAAQ,GAAG,MAAM,CAAC;IAChC,8FAA8F;IAC9F,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;;;;;;;;;;;OAgBG;IACH,iBAAiB,CAAC,EAAE;QAClB,2EAA2E;QAC3E,mBAAmB,CAAC,EAAE,MAAM,CAAC;KAC9B,CAAC;IACF,uEAAuE;IACvE,YAAY,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC;CAC3C,CAAC;AAEF,YAAY,EAAE,aAAa,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,CAAC;AAE3F;;;;;;;GAOG;AACH,MAAM,WAAW,aAAc,SAAQ,IAAI,CAAC,mBAAmB,EAAE,YAAY,CAAC;IAC5E,8FAA8F;IAC9F,UAAU,EAAE,eAAe,CAAC;CAC7B;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,mHAAmH;IACnH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,YAAY;IAE3B,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAC;IAEb;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;;OAGG;IACH,SAAS,CAAC,EAAE,aAAa,CAAC;IAE1B;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,mEAAmE;IACnE,aAAa,CAAC,EAAE,kBAAkB,CAAC;IAEnC;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAGlB;;;;;;;;OAQG;IACH,GAAG,CAAC,EAAE,cAAc,CAAC;IAErB;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAGxC,uDAAuD;IACvD,OAAO,CAAC,EAAE,aAAa,CAAC;IAExB;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAEvC;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,aAAa,CAAC;IAEvB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAE/B;;;;OAIG;IACH,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAE/B,oCAAoC;IACpC,GAAG,CAAC,EAAE,gBAAgB,CAAC;IAEvB,sEAAsE;IACtE,cAAc,CAAC,EAAE,OAAO,CAAC;IAEzB,mDAAmD;IACnD,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAE/B,wDAAwD;IACxD,UAAU,CAAC,EAAE,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC;IAE3C;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE;QACf,IAAI,EAAE,WAAW,GAAG,WAAW,CAAC;QAChC,SAAS,EAAE,MAAM,EAAE,CAAC;KACrB,CAAC;IAEF;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,MAAM,CAAC,EAAE;QACP,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB;;;;;;;;WAQG;QACH,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;IAEF;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE;QACX,OAAO,EAAE,OAAO,CAAC;QACjB,0EAA0E;QAC1E,MAAM,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC;KAC7B,CAAC;IAEF;;;;;;;;;;;;;OAaG;IACH,UAAU,CAAC,EAAE;QACX,iEAAiE;QACjE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,iEAAiE;QACjE,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IAEF;;;OAGG;IACH,OAAO,CAAC,EAAE;QACR,wCAAwC;QACxC,OAAO,EAAE,OAAO,CAAC;QACjB,+CAA+C;QAC/C,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;IAEF;;;;;;OAMG;IACH,UAAU,CAAC,EAAE;QACX,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,6DAA6D;QAC7D,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IAEF;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,oBAAoB,CAAC;CACvC;AAaD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,qBAAa,OAAQ,SAAQ,SAAS;IACpC,2CAA2C;IAC3C,SAAgB,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC;IAC1C,mCAAmC;IACnC,SAAgB,YAAY,EAAE,GAAG,CAAC,cAAc,CAAC,YAAY,CAAC;IAC9D,yDAAyD;IACzD,SAAgB,GAAG,EAAE,MAAM,CAAC;IAC5B,gFAAgF;IAChF,SAAgB,WAAW,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC;IACtD,wFAAwF;IACxF,SAAgB,gBAAgB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC;IACrD,2FAA2F;IAC3F,SAAgB,eAAe,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;IAErD;;;;;;;;;;;;;;;;;OAiBG;WACU,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC;IAaxF;;;;;OAKG;gBACS,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,eAAe,GAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAa;IAiU/G;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IAOvB;;OAEG;IACH,OAAO,CAAC,eAAe;CAwDxB"}

package/dist/hosting.js

@@ -1,18 +1,19 @@
 // Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
+import { execSync } from 'node:child_process';
+import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { detectFramework, getAdapter, normalizeBasePath } from '@aws-blocks/hosting/adapters';
+import { generateBuildId, HostingConstruct, } from '@aws-blocks/hosting/constructs';
 import * as cdk from 'aws-cdk-lib';
-import { AllowedMethods, CachePolicy, OriginRequestPolicy, ViewerProtocolPolicy, } from 'aws-cdk-lib/aws-cloudfront';
+import { AllowedMethods, CachePolicy, OriginRequestPolicy, ViewerProtocolPolicy } from 'aws-cdk-lib/aws-cloudfront';
 import { HttpOrigin } from 'aws-cdk-lib/aws-cloudfront-origins';
 import * as s3deploy from 'aws-cdk-lib/aws-s3-deployment';
 import { Construct } from 'constructs';
-import { execSync } from 'node:child_process';
-import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
-import { join, resolve } from 'node:path';
-import { HostingConstruct, generateBuildId, } from '@aws-blocks/hosting/constructs';
-import { detectFramework, getAdapter, normalizeBasePath, } from '@aws-blocks/hosting/adapters';
-import { BLOCKS_RPC_PREFIX, BLOCKS_AUTH_PREFIX } from './constants.js';
-import { BLOCKS_SANDBOX_DIR } from './common/constants.js';
 import { registerConfig } from './cdk/config-registry.js';
+import { BLOCKS_SANDBOX_DIR } from './common/constants.js';
+import { BLOCKS_AUTH_PREFIX, BLOCKS_RPC_PREFIX } from './constants.js';
+import { assertMarkersExistAtSynth, collectSynthMarkers, partitionEnvironment, resolveDomainNames, resolveSecretsAtSynth, wireByo, wireManagedValue, } from './hosting-secrets.js';
 import { getRegisteredRoutes } from './raw-route.js';
 // ─── Default build output directories per framework ──────────────
 const DEFAULT_BUILD_DIRS = {
@@ -71,7 +72,43 @@ export class Hosting extends Construct {
     buildCacheBucket;
     /** SNS topic for hosting CloudWatch alarms (present when `monitoring.enabled` is true). */
     monitoringTopic;
-    constructor(scope, id, props) {
+    /**
+     * Async constructor. Required when a `secret()` / `config()` value resolves at
+     * **synth time** — i.e. a `domain.domainName` marker — because that value is
+     * fetched from its store (Secrets Manager / SSM) during synthesis. Returns a
+     * fully-constructed {@link Hosting}.
+     *
+     * For runtime `environment` markers (read via `getSecret`/`getConfig`) and
+     * plain literals, `new Hosting(...)` works directly; `create()` is also safe
+     * to use uniformly.
+     *
+     * @example
+     * ```ts
+     * await Hosting.create(stack, 'Web', {
+     *   root: '.', framework: 'nextjs', api: blocksStack,
+     *   domain: { domainName: config('DOMAIN_PROD') },
+     * });
+     * ```
+     */
+    static async create(scope, id, props) {
+        const storeConfig = { secretStore: props.secretStore, configStore: props.configStore };
+        const synthMarkers = collectSynthMarkers(props.domain?.domainName);
+        const resolved = synthMarkers.length
+            ? await resolveSecretsAtSynth(synthMarkers, undefined, storeConfig)
+            : new Map();
+        // Fail the deploy early if a declared `environment` secret/config has no value
+        // set — existence only, never fetching the value. (Domain markers above already
+        // fail this way; this extends it to runtime markers.)
+        await assertMarkersExistAtSynth(partitionEnvironment(props.environment).managed, storeConfig);
+        return new Hosting(scope, id, props, resolved);
+    }
+    /**
+     * @param resolvedSecrets - Synth-time-resolved secret values, keyed by secret
+     *   key. Populated by {@link Hosting.create}; empty for the direct
+     *   `new Hosting()` path (which then rejects any synth-time secret with a
+     *   clear "use Hosting.create()" error).
+     */
+    constructor(scope, id, props, resolvedSecrets = new Map()) {
         super(scope, id);
         const root = resolve(props.root);
         // ── 1. Detect framework ──────────────────────────────────────
@@ -84,7 +121,7 @@ export class Hosting extends Construct {
             // from breaking frontend builds (e.g., Next.js webpack module resolution).
             const nodeOptions = (process.env.NODE_OPTIONS || '')
                 .split(/\s+/)
-                .filter(opt => opt !== '--conditions=cdk')
+                .filter((opt) => opt !== '--conditions=cdk')
                 .join(' ');
             const buildEnv = { ...process.env, NODE_OPTIONS: nodeOptions };
             try {
@@ -154,8 +191,7 @@ export class Hosting extends Construct {
         //    errorPages will drive the CloudFront configuration correctly,
         //    and the HTML files are already in the static assets directory
         //    (copied by the adapter).
-        const manifestHasErrorPages = manifest.errorPages !== undefined &&
-            Object.keys(manifest.errorPages).length > 0;
+        const manifestHasErrorPages = manifest.errorPages !== undefined && Object.keys(manifest.errorPages).length > 0;
         const skipPropsErrorPages = !!(props.errorPages && manifestHasErrorPages);
         // ── 5. Write placeholder config.json into static assets ─────────
         //    A placeholder is needed so the L3 construct sees
@@ -208,15 +244,31 @@ export class Hosting extends Construct {
                     : props.compute.timeout,
             }
             : undefined;
+        // ── 6b. Resolve secret() markers ─────────────────────────────
+        //    Env values split into plain / runtime-secret / deploy-time buckets;
+        //    domain names may contain markers resolved at synth time. See
+        //    ./hosting-secrets.ts for the two-strategy rationale.
+        const { plain: plainEnv, managed, byo } = partitionEnvironment(props.environment);
+        // Resolved domain (markers → literals); falls back to the raw config when
+        // no domain is set. resolveDomainNames throws a "use Hosting.create()"
+        // error if a domain marker reached the sync path unresolved.
+        const resolvedDomain = props.domain
+            ? {
+                ...props.domain,
+                domainName: resolveDomainNames(props.domain.domainName, resolvedSecrets),
+            }
+            : undefined;
         const hostingProps = {
             manifest,
             compute: normalizedCompute,
-            domain: props.domain,
+            // Plain env + deploy-time literals go straight to the L3 (which stays
+            // secret-agnostic: it only ever sees plain strings). Runtime secrets are
+            // wired separately below so we can attach IAM grants per function.
+            environment: Object.keys(plainEnv).length ? plainEnv : undefined,
+            domain: resolvedDomain,
             waf: props.waf,
-            storage: props.retainOnDelete != null
-                ? { retainOnDelete: props.retainOnDelete }
-                : undefined,
-            cdn: (props.contentSecurityPolicy || props.priceClass || props.geoRestriction || props.quotas)
+            storage: props.retainOnDelete != null ? { retainOnDelete: props.retainOnDelete } : undefined,
+            cdn: props.contentSecurityPolicy || props.priceClass || props.geoRestriction || props.quotas
                 ? {
                     contentSecurityPolicy: props.contentSecurityPolicy,
                     priceClass: props.priceClass,
@@ -251,14 +303,24 @@ export class Hosting extends Construct {
             if (props.backendConfig) {
                 fn.addEnvironment('BLOCKS_CONFIG', JSON.stringify(props.backendConfig));
             }
+            // Runtime managed markers (secret|config): inject the store locator
+            // (never the value) + grant read/decrypt; read via getSecret()/getConfig().
+            // The app's secretStore/configStore (prefix, stage, cacheTtlSeconds) layer
+            // over the Blocks defaults.
+            const storeConfig = { secretStore: props.secretStore, configStore: props.configStore };
+            for (const marker of managed) {
+                wireManagedValue(fn, marker, storeConfig);
+            }
+            // BYO handles (ISecret|IParameter): grant via the handle + inject its locator.
+            for (const binding of byo) {
+                wireByo(fn, binding, storeConfig);
+            }
         }
         // ── 8. Deploy config.json with resolved CDK tokens ───────────
         const buildId = manifest.buildId;
         if (buildId) {
             const configDeployment = new s3deploy.BucketDeployment(this, 'BlocksConfigDeployment', {
-                sources: [
-                    s3deploy.Source.jsonData('config.json', this.buildConfigJson(props)),
-                ],
+                sources: [s3deploy.Source.jsonData('config.json', this.buildConfigJson(props))],
                 destinationBucket: hosting.bucket,
                 destinationKeyPrefix: `builds/${buildId}/.blocks-sandbox`,
                 prune: false,
@@ -271,10 +333,7 @@ export class Hosting extends Construct {
                 // primary guard against staleness is step 5a's no-cache placeholder;
                 // this is defense-in-depth so a post-deploy invalidation actually
                 // clears any edge entry at its real key.)
-                distributionPaths: [
-                    `/builds/${buildId}/.blocks-sandbox/*`,
-                    '/.blocks-sandbox/*',
-                ],
+                distributionPaths: [`/builds/${buildId}/.blocks-sandbox/*`, '/.blocks-sandbox/*'],
                 cacheControl: [s3deploy.CacheControl.fromString('public, max-age=60, must-revalidate')],
             });
             // Ensure the config deployment runs AFTER the hosting construct's

package/dist/hosting.test.js

@@ -1,13 +1,15 @@
 // Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
-import { describe, it, beforeEach, afterEach } from 'node:test';
 import assert from 'node:assert';
 import * as fs from 'node:fs';
-import * as path from 'node:path';
 import * as os from 'node:os';
+import * as path from 'node:path';
+import { afterEach, beforeEach, describe, it } from 'node:test';
+import { config, secret } from '@aws-blocks/hosting';
+import { _setSynthExistsChecker } from '@aws-blocks/hosting/constructs';
 import * as cdk from 'aws-cdk-lib';
 import { App, Duration, Stack } from 'aws-cdk-lib';
-import { Template, Match } from 'aws-cdk-lib/assertions';
+import { Match, Template } from 'aws-cdk-lib/assertions';
 import { BLOCKS_RPC_PREFIX } from './constants.js';
 import { Hosting } from './hosting.js';
 import { clearRouteRegistry, registerRoute } from './raw-route.js';
@@ -84,6 +86,31 @@ describe('Hosting', () => {
         fs.rmSync(tmpDir, { recursive: true, force: true });
         clearRouteRegistry();
     });
+    // ── Deploy-time existence check (key change 4) ───────────────
+    describe('environment marker existence check (Hosting.create)', () => {
+        it('rejects at deploy when a declared environment secret has no value', async () => {
+            createSpaBuildOutput(tmpDir);
+            const app = new App();
+            const stack = new Stack(app, 'MissingEnvSecretStack');
+            // Stub the synth existence probe to report "not set" — rejects before any
+            // CDK construction, so this needs no assets and no AWS.
+            _setSynthExistsChecker(async () => {
+                const e = new Error('missing');
+                e.name = 'ResourceNotFoundException';
+                throw e;
+            });
+            try {
+                await assert.rejects(Hosting.create(stack, 'Hosting', {
+                    root: tmpDir,
+                    api: MOCK_API,
+                    environment: { MISSING_SECRET: secret('MISSING_SECRET') },
+                }), /MISSING_SECRET.*not set/s);
+            }
+            finally {
+                _setSynthExistsChecker(null);
+            }
+        });
+    });
     // ── SPA tests ────────────────────────────────────────────────
     describe('SPA mode', () => {
         it('creates S3 bucket and CloudFront distribution', () => {
@@ -1092,8 +1119,7 @@ describe('Hosting', () => {
                 ...(basePath !== undefined ? { basePath } : {}),
             });
             const tpl = Template.fromStack(stack).toJSON();
-            const kvKeys = Object.entries(tpl.Resources).find(([id, r]) => r.Type === 'AWS::CloudFormation::CustomResource' &&
-                /RouteStoreKeys/.test(id));
+            const kvKeys = Object.entries(tpl.Resources).find(([id, r]) => r.Type === 'AWS::CloudFormation::CustomResource' && /RouteStoreKeys/.test(id));
             assert.ok(kvKeys, 'expected a RouteStoreKeys custom resource');
             const entries = JSON.parse(kvKeys[1].Properties.Entries);
             const meta = JSON.parse(entries.meta);
@@ -1134,6 +1160,131 @@ describe('Hosting', () => {
                 `found DependsOn=${JSON.stringify(dependsOn)}`);
         });
     });
+    // ── value() integration ─────────────────────────────────────────
+    //
+    // Runtime values: the store LOCATOR (never the value) is injected as a Lambda
+    // env var, and the role is granted read + kms:Decrypt. The store is derived from
+    // the marker's type — secret → Secrets Manager, config → SSM Parameter Store.
+    // Domain markers resolve at synth time via Hosting.create().
+    describe('secret() / config() integration', () => {
+        it('secret() → Secrets Manager: injects the locator (not the value) + grants read+decrypt', () => {
+            createNextjsBuildOutput(tmpDir);
+            const app = new App();
+            const stack = new Stack(app, 'SecretEnvStack');
+            new Hosting(stack, 'Hosting', {
+                root: tmpDir,
+                customAdapter: createNextjsFixtureAdapter(tmpDir),
+                api: MOCK_API,
+                environment: { STRIPE_KEY: secret('STRIPE_KEY') },
+            });
+            const template = Template.fromStack(stack);
+            // secret → Secrets Manager: slash-free locator under the Blocks /blocks/secrets namespace.
+            template.hasResourceProperties('AWS::Lambda::Function', {
+                Environment: {
+                    Variables: Match.objectLike({ HOSTING_SECRET_PARAM_STRIPE_KEY: 'blocks/secrets/STRIPE_KEY' }),
+                },
+            });
+            // The plaintext value must NOT appear anywhere in the template.
+            const json = JSON.stringify(template.toJSON());
+            assert.ok(!json.includes('STRIPE_KEY_VALUE'), 'no value should be in the template');
+            // The role has secretsmanager:GetSecretValue scoped to the secret + kms:Decrypt.
+            template.hasResourceProperties('AWS::IAM::Policy', {
+                PolicyDocument: {
+                    Statement: Match.arrayWith([
+                        Match.objectLike({ Action: 'secretsmanager:GetSecretValue' }),
+                        Match.objectLike({
+                            Action: 'kms:Decrypt',
+                            Condition: { StringEquals: Match.objectLike({ 'kms:ViaService': Match.anyValue() }) },
+                        }),
+                    ]),
+                },
+            });
+        });
+        it('threads secretStore { prefix, stage, cacheTtlSeconds } from core HostingProps to the wiring (B3)', () => {
+            createNextjsBuildOutput(tmpDir);
+            const app = new App();
+            const stack = new Stack(app, 'SecretStoreOverrideStack');
+            new Hosting(stack, 'Hosting', {
+                root: tmpDir,
+                customAdapter: createNextjsFixtureAdapter(tmpDir),
+                api: MOCK_API,
+                environment: { STRIPE_KEY: secret('STRIPE_KEY') },
+                // Custom prefix + stage + warm-cache TTL must all reach the leaf wiring.
+                secretStore: { prefix: '/myapp/secrets', stage: 'prod', cacheTtlSeconds: 30 },
+            });
+            const template = Template.fromStack(stack);
+            template.hasResourceProperties('AWS::Lambda::Function', {
+                Environment: {
+                    Variables: Match.objectLike({
+                        // custom prefix + stage (Secrets Manager → slash-free)
+                        HOSTING_SECRET_PARAM_STRIPE_KEY: 'myapp/secrets/prod/STRIPE_KEY',
+                        // shared fallback (no stage)
+                        HOSTING_SECRET_PARAM_STRIPE_KEY_FALLBACK: 'myapp/secrets/STRIPE_KEY',
+                        // warm-cache TTL for rotation without a cold start
+                        HOSTING_SECRET_CACHE_TTL: '30',
+                    }),
+                },
+            });
+        });
+        it('config() → SSM: HOSTING_CONFIG_PARAM_* (leading-slash) + ssm:GetParameter', () => {
+            createNextjsBuildOutput(tmpDir);
+            const app = new App();
+            const stack = new Stack(app, 'ConfigEnvStack');
+            new Hosting(stack, 'Hosting', {
+                root: tmpDir,
+                customAdapter: createNextjsFixtureAdapter(tmpDir),
+                api: MOCK_API,
+                environment: { FEATURE_FLAGS: config('FEATURE_FLAGS') },
+            });
+            const template = Template.fromStack(stack);
+            template.hasResourceProperties('AWS::Lambda::Function', {
+                Environment: {
+                    Variables: Match.objectLike({ HOSTING_CONFIG_PARAM_FEATURE_FLAGS: '/blocks/config/FEATURE_FLAGS' }),
+                },
+            });
+            template.hasResourceProperties('AWS::IAM::Policy', {
+                PolicyDocument: { Statement: Match.arrayWith([Match.objectLike({ Action: 'ssm:GetParameter' })]) },
+            });
+        });
+        it('does not inject a plaintext env var for a runtime value', () => {
+            createNextjsBuildOutput(tmpDir);
+            const app = new App();
+            const stack = new Stack(app, 'SecretNoPlaintextStack');
+            new Hosting(stack, 'Hosting', {
+                root: tmpDir,
+                customAdapter: createNextjsFixtureAdapter(tmpDir),
+                api: MOCK_API,
+                environment: { FLAG: 'on', STRIPE_KEY: secret('STRIPE_KEY') },
+            });
+            const template = Template.fromStack(stack);
+            const fns = template.findResources('AWS::Lambda::Function');
+            for (const fn of Object.values(fns)) {
+                const vars = (fn.Properties?.Environment?.Variables ?? {});
+                assert.strictEqual(vars.STRIPE_KEY, undefined, 'value key must not be a plaintext env var');
+            }
+        });
+        it('rejects a runtime value whose key mismatches the env var name', () => {
+            createNextjsBuildOutput(tmpDir);
+            const app = new App();
+            const stack = new Stack(app, 'SecretMismatchStack');
+            assert.throws(() => new Hosting(stack, 'Hosting', {
+                root: tmpDir,
+                customAdapter: createNextjsFixtureAdapter(tmpDir),
+                api: MOCK_API,
+                environment: { STRIPE_KEY: secret('OTHER') },
+            }), /must match the environment variable name/);
+        });
+        it('throws if a domain marker is used with the sync constructor', () => {
+            createSpaBuildOutput(tmpDir);
+            const app = new App();
+            const stack = new Stack(app, 'SecretDomainSyncStack');
+            assert.throws(() => new Hosting(stack, 'Hosting', {
+                root: tmpDir,
+                api: MOCK_API,
+                domain: { domainName: config('DOMAIN_PROD') },
+            }), /requires async resolution/);
+        });
+    });
     describe('config.json stale-placeholder guard (#173)', () => {
         // Helper: pull every BucketDeployment custom resource's Properties.
         const bucketDeployments = (stack) => {
@@ -1169,8 +1320,7 @@ describe('Hosting', () => {
                     directive.includes('s-maxage=31536000') &&
                     !excludes(p).includes('.blocks-sandbox/config.json'));
             });
-            assert.strictEqual(leaks.length, 0, 'no mutable-tier deployment may apply s-maxage=31536000 to ' +
-                '.blocks-sandbox/config.json');
+            assert.strictEqual(leaks.length, 0, 'no mutable-tier deployment may apply s-maxage=31536000 to ' + '.blocks-sandbox/config.json');
         });
         it('registers the placeholder as a no-cache path even for a static-only site (no api)', () => {
             // The placeholder is always written (step 5), so its no-cache
@@ -1201,9 +1351,7 @@ describe('Hosting', () => {
             // Assert via Template + Match so a CDK property rename fails loudly here
             // rather than silently skipping a structural-heuristic lookup.
             Template.fromStack(stack).hasResourceProperties('Custom::CDKBucketDeployment', Match.objectLike({
-                DistributionPaths: Match.arrayWith([
-                    Match.stringLikeRegexp('^/builds/.+/\\.blocks-sandbox/\\*$'),
-                ]),
+                DistributionPaths: Match.arrayWith([Match.stringLikeRegexp('^/builds/.+/\\.blocks-sandbox/\\*$')]),
             }));
         });
     });

package/dist/index.cdk.d.ts

@@ -1,14 +1,15 @@
-export { ApiNamespace, type BlocksContext, type ApiHandler } from './api.js';
-export { BLOCKS_RPC_PREFIX, BLOCKS_AUTH_PREFIX } from './constants.js';
-export { ApiError, isBlocksError, hasAuthError, DEFAULT_API_ERROR_NAME } from './errors.js';
-export { EventSourceMapping } from './lambda-handler.js';
+export { type ConfigValue, config, DEFAULT_CONFIG_PARAMETER_PREFIX, DEFAULT_SECRET_PARAMETER_PREFIX, isConfig, isManagedValue, isSecret, type ManagedValue, type SecretValue, secret, type ValueKind, } from '@aws-blocks/hosting';
+export { type ApiHandler, ApiNamespace, type BlocksContext } from './api.js';
+export { BlocksBackend, type BlocksBackendProps, type BlocksDefaults, BlocksPresets, BlocksStack, blocksNodejsBundling, type CoreBlocksBackendProps, type CoreBlocksStackProps, DEFAULT_NODE_RUNTIME, finalizeConfigRegistry, registerConfig, SandboxDisableDeletionProtection, Scope, SHARED_HANDLER_TIMEOUT_SECONDS, synthGuard, } from './cdk/index.js';
+export { _resetConfigCache, getConfig, getConfigSync, loadConfigToProcessEnv, preloadConfig } from './common/config.js';
 export { BlocksStackProps } from './common/index.js';
-export { registerSdkIdentifiers, getSdkIdentifiers, getAllSdkIdentifiers, _resetSdkRegistry } from './common/sdk-registry.js';
-export { getConfig, getConfigSync, preloadConfig, loadConfigToProcessEnv, _resetConfigCache } from './common/config.js';
-export { BlocksStack, Scope, SandboxDisableDeletionProtection, BlocksBackend, registerConfig, finalizeConfigRegistry, synthGuard, DEFAULT_NODE_RUNTIME, blocksNodejsBundling, type BlocksBackendProps } from './cdk/index.js';
-export { type BlocksDefaults, BlocksPresets, } from './cdk/index.js';
-export { Hosting, type HostingProps, type BlocksStackApi, type FrameworkType, type ComputeConfig, type HostingDomainConfig, type HostingWafConfig, } from './hosting.js';
-export { RawRoute, RawRouteErrors, type RawRouteOptions, type HttpMethod, } from './raw-route.cdk.js';
-export { registerRoute, matchRoute, getRegisteredRoutes, clearRouteRegistry, lockRouteRegistry, unlockRouteRegistry, type RegisteredRoute, } from './raw-route.js';
-export { Pipeline, DeployStage, __PIPELINE_STAGE_SCOPE__, type DeployStageProps, type BranchConfig, type PipelineProps, type PipelineSourceConfig, type PipelineSynthConfig, type PipelineStageConfig, } from './pipeline/index.js';
+export { _resetSdkRegistry, getAllSdkIdentifiers, getSdkIdentifiers, registerSdkIdentifiers, } from './common/sdk-registry.js';
+export { BLOCKS_AUTH_PREFIX, BLOCKS_RPC_PREFIX } from './constants.js';
+export { ApiError, DEFAULT_API_ERROR_NAME, hasAuthError, isBlocksError } from './errors.js';
+export { type BlocksStackApi, type ComputeConfig, type FrameworkType, Hosting, type HostingDomainConfig, type HostingProps, type HostingWafConfig, } from './hosting.js';
+export { EventSourceMapping } from './lambda-handler.js';
+export { __PIPELINE_STAGE_SCOPE__, type BranchConfig, DeployStage, type DeployStageProps, Pipeline, type PipelineProps, type PipelineSourceConfig, type PipelineStageConfig, type PipelineSynthConfig, } from './pipeline/index.js';
+export { type HttpMethod, RawRoute, RawRouteErrors, type RawRouteOptions, } from './raw-route.cdk.js';
+export { clearRouteRegistry, getRegisteredRoutes, lockRouteRegistry, matchRoute, type RegisteredRoute, registerRoute, unlockRouteRegistry, } from './raw-route.js';
+export { BLOCKS_CONFIG_PARAMETER_PREFIX, BLOCKS_SECRET_PARAMETER_PREFIX, blocksConfigParameterName, blocksSecretParameterName, } from './secret-naming.js';
 //# sourceMappingURL=index.cdk.d.ts.map

package/dist/index.cdk.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.cdk.d.ts","sourceRoot":"","sources":["../src/index.cdk.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,YAAY,EAAE,KAAK,aAAa,EAAE,KAAK,UAAU,EAAE,MAAM,UAAU,CAAC;AAC7E,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACvE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,YAAY,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAC5F,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC9H,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,aAAa,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACxH,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,gCAAgC,EAAE,aAAa,EAAE,cAAc,EAAE,sBAAsB,EAAE,UAAU,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,KAAK,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAC9N,OAAO,EACL,KAAK,cAAc,EACnB,aAAa,GACd,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,OAAO,EACP,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,GACtB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,QAAQ,EACR,cAAc,EACd,KAAK,eAAe,EACpB,KAAK,UAAU,GAChB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,aAAa,EACb,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,EACjB,mBAAmB,EACnB,KAAK,eAAe,GACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,QAAQ,EACR,WAAW,EACX,wBAAwB,EACxB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,GACzB,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.cdk.d.ts","sourceRoot":"","sources":["../src/index.cdk.ts"],"names":[],"mappings":"AAMA,OAAO,EACN,KAAK,WAAW,EAChB,MAAM,EACN,+BAA+B,EAC/B,+BAA+B,EAC/B,QAAQ,EACR,cAAc,EACd,QAAQ,EACR,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,MAAM,EACN,KAAK,SAAS,GACd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,KAAK,UAAU,EAAE,YAAY,EAAE,KAAK,aAAa,EAAE,MAAM,UAAU,CAAC;AAC7E,OAAO,EACN,aAAa,EACb,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,aAAa,EACb,WAAW,EACX,oBAAoB,EACpB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,oBAAoB,EACpB,sBAAsB,EACtB,cAAc,EACd,gCAAgC,EAChC,KAAK,EACL,8BAA8B,EAC9B,UAAU,GACV,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,aAAa,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxH,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EACN,iBAAiB,EACjB,oBAAoB,EACpB,iBAAiB,EACjB,sBAAsB,GACtB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACvE,OAAO,EAAE,QAAQ,EAAE,sBAAsB,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5F,OAAO,EACN,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,OAAO,EACP,KAAK,mBAAmB,EACxB,KAAK,YAAY,EACjB,KAAK,gBAAgB,GACrB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EACN,wBAAwB,EACxB,KAAK,YAAY,EACjB,WAAW,EACX,KAAK,gBAAgB,EACrB,QAAQ,EACR,KAAK,aAAa,EAClB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,GACxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACN,KAAK,UAAU,EACf,QAAQ,EACR,cAAc,EACd,KAAK,eAAe,GACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACN,kBAAkB,EAClB,mBAAmB,EACnB,iBAAiB,EACjB,UAAU,EACV,KAAK,eAAe,EACpB,aAAa,EACb,mBAAmB,GACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACN,8BAA8B,EAC9B,8BAA8B,EAC9B,yBAAyB,EACzB,yBAAyB,GACzB,MAAM,oBAAoB,CAAC"}

package/dist/index.cdk.js

@@ -1,14 +1,18 @@
 // Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
+// Declare functions for infra (secret/config). The runtime getters
+// (getSecret/getConfig) are imported from '@aws-blocks/hosting' — core's own
+// getConfig (backend config loader, above) owns that name here.
+export { config, DEFAULT_CONFIG_PARAMETER_PREFIX, DEFAULT_SECRET_PARAMETER_PREFIX, isConfig, isManagedValue, isSecret, secret, } from '@aws-blocks/hosting';
 export { ApiNamespace } from './api.js';
-export { BLOCKS_RPC_PREFIX, BLOCKS_AUTH_PREFIX } from './constants.js';
-export { ApiError, isBlocksError, hasAuthError, DEFAULT_API_ERROR_NAME } from './errors.js';
-export { EventSourceMapping } from './lambda-handler.js';
-export { registerSdkIdentifiers, getSdkIdentifiers, getAllSdkIdentifiers, _resetSdkRegistry } from './common/sdk-registry.js';
-export { getConfig, getConfigSync, preloadConfig, loadConfigToProcessEnv, _resetConfigCache } from './common/config.js';
-export { BlocksStack, Scope, SandboxDisableDeletionProtection, BlocksBackend, registerConfig, finalizeConfigRegistry, synthGuard, DEFAULT_NODE_RUNTIME, blocksNodejsBundling } from './cdk/index.js';
-export { BlocksPresets, } from './cdk/index.js';
+export { BlocksBackend, BlocksPresets, BlocksStack, blocksNodejsBundling, DEFAULT_NODE_RUNTIME, finalizeConfigRegistry, registerConfig, SandboxDisableDeletionProtection, Scope, SHARED_HANDLER_TIMEOUT_SECONDS, synthGuard, } from './cdk/index.js';
+export { _resetConfigCache, getConfig, getConfigSync, loadConfigToProcessEnv, preloadConfig } from './common/config.js';
+export { _resetSdkRegistry, getAllSdkIdentifiers, getSdkIdentifiers, registerSdkIdentifiers, } from './common/sdk-registry.js';
+export { BLOCKS_AUTH_PREFIX, BLOCKS_RPC_PREFIX } from './constants.js';
+export { ApiError, DEFAULT_API_ERROR_NAME, hasAuthError, isBlocksError } from './errors.js';
 export { Hosting, } from './hosting.js';
+export { EventSourceMapping } from './lambda-handler.js';
+export { __PIPELINE_STAGE_SCOPE__, DeployStage, Pipeline, } from './pipeline/index.js';
 export { RawRoute, RawRouteErrors, } from './raw-route.cdk.js';
-export { registerRoute, matchRoute, getRegisteredRoutes, clearRouteRegistry, lockRouteRegistry, unlockRouteRegistry, } from './raw-route.js';
-export { Pipeline, DeployStage, __PIPELINE_STAGE_SCOPE__, } from './pipeline/index.js';
+export { clearRouteRegistry, getRegisteredRoutes, lockRouteRegistry, matchRoute, registerRoute, unlockRouteRegistry, } from './raw-route.js';
+export { BLOCKS_CONFIG_PARAMETER_PREFIX, BLOCKS_SECRET_PARAMETER_PREFIX, blocksConfigParameterName, blocksSecretParameterName, } from './secret-naming.js';

package/dist/index.d.ts

@@ -1,9 +1,10 @@
-export { ApiNamespace, type BlocksContext, type ApiHandler } from './api.js';
-export { BLOCKS_RPC_PREFIX, BLOCKS_AUTH_PREFIX } from './constants.js';
-export { ApiError, isBlocksError, hasAuthError, DEFAULT_API_ERROR_NAME } from './errors.js';
-export { Scope, type ScopeOptions, type ScopeParent, type BuildingBlockMeta } from './common/index.js';
-export { registerSdkIdentifiers, getSdkIdentifiers, getAllSdkIdentifiers, _resetSdkRegistry } from './common/sdk-registry.js';
-export { getConfig, getConfigSync, preloadConfig, loadConfigToProcessEnv, _resetConfigCache } from './common/config.js';
-export { registerRoute, matchRoute, getRegisteredRoutes, clearRouteRegistry, lockRouteRegistry, unlockRouteRegistry, RawRouteErrors, type RawRouteOptions, type HttpMethod, type RegisteredRoute, } from './raw-route.js';
+export { type ConfigValue, config, isConfig, isManagedValue, isSecret, type ManagedValue, type SecretValue, secret, type ValueKind, } from '@aws-blocks/hosting';
+export { type ApiHandler, ApiNamespace, type BlocksContext } from './api.js';
+export { _resetConfigCache, getConfig, getConfigSync, loadConfigToProcessEnv, preloadConfig } from './common/config.js';
+export { type BuildingBlockMeta, Scope, type ScopeOptions, type ScopeParent } from './common/index.js';
+export { _resetSdkRegistry, getAllSdkIdentifiers, getSdkIdentifiers, registerSdkIdentifiers, } from './common/sdk-registry.js';
+export { BLOCKS_AUTH_PREFIX, BLOCKS_RPC_PREFIX } from './constants.js';
+export { ApiError, DEFAULT_API_ERROR_NAME, hasAuthError, isBlocksError } from './errors.js';
+export { clearRouteRegistry, getRegisteredRoutes, type HttpMethod, lockRouteRegistry, matchRoute, RawRouteErrors, type RawRouteOptions, type RegisteredRoute, registerRoute, unlockRouteRegistry, } from './raw-route.js';
 export { RawRoute } from './raw-route.mock.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,YAAY,EAAE,KAAK,aAAa,EAAE,KAAK,UAAU,EAAE,MAAM,UAAU,CAAC;AAC7E,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACvE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,YAAY,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAC5F,OAAO,EAAE,KAAK,EAAE,KAAK,YAAY,EAAE,KAAK,WAAW,EAAE,KAAK,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACvG,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC9H,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,aAAa,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACxH,OAAO,EACL,aAAa,EACb,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,EACjB,mBAAmB,EACnB,cAAc,EACd,KAAK,eAAe,EACpB,KAAK,UAAU,EACf,KAAK,eAAe,GACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAMA,OAAO,EACN,KAAK,WAAW,EAChB,MAAM,EACN,QAAQ,EACR,cAAc,EACd,QAAQ,EACR,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,MAAM,EACN,KAAK,SAAS,GACd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,KAAK,UAAU,EAAE,YAAY,EAAE,KAAK,aAAa,EAAE,MAAM,UAAU,CAAC;AAC7E,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,aAAa,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxH,OAAO,EAAE,KAAK,iBAAiB,EAAE,KAAK,EAAE,KAAK,YAAY,EAAE,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACvG,OAAO,EACN,iBAAiB,EACjB,oBAAoB,EACpB,iBAAiB,EACjB,sBAAsB,GACtB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACvE,OAAO,EAAE,QAAQ,EAAE,sBAAsB,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5F,OAAO,EACN,kBAAkB,EAClB,mBAAmB,EACnB,KAAK,UAAU,EACf,iBAAiB,EACjB,UAAU,EACV,cAAc,EACd,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,aAAa,EACb,mBAAmB,GACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC"}