@aws-blocks/core 0.2.0 → 0.3.0

package/dist/index.js

@@ -1,10 +1,14 @@
 // Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
+// secret()/config() declare markers (CDK-free subpath). The runtime getters
+// getSecret()/getConfig() are imported from '@aws-blocks/hosting' directly —
+// core already exports a backend `getConfig` (config loader) under this name.
+export { config, isConfig, isManagedValue, isSecret, secret, } from '@aws-blocks/hosting';
 export { ApiNamespace } from './api.js';
-export { BLOCKS_RPC_PREFIX, BLOCKS_AUTH_PREFIX } from './constants.js';
-export { ApiError, isBlocksError, hasAuthError, DEFAULT_API_ERROR_NAME } from './errors.js';
+export { _resetConfigCache, getConfig, getConfigSync, loadConfigToProcessEnv, preloadConfig } from './common/config.js';
 export { Scope } from './common/index.js';
-export { registerSdkIdentifiers, getSdkIdentifiers, getAllSdkIdentifiers, _resetSdkRegistry } from './common/sdk-registry.js';
-export { getConfig, getConfigSync, preloadConfig, loadConfigToProcessEnv, _resetConfigCache } from './common/config.js';
-export { registerRoute, matchRoute, getRegisteredRoutes, clearRouteRegistry, lockRouteRegistry, unlockRouteRegistry, RawRouteErrors, } from './raw-route.js';
+export { _resetSdkRegistry, getAllSdkIdentifiers, getSdkIdentifiers, registerSdkIdentifiers, } from './common/sdk-registry.js';
+export { BLOCKS_AUTH_PREFIX, BLOCKS_RPC_PREFIX } from './constants.js';
+export { ApiError, DEFAULT_API_ERROR_NAME, hasAuthError, isBlocksError } from './errors.js';
+export { clearRouteRegistry, getRegisteredRoutes, lockRouteRegistry, matchRoute, RawRouteErrors, registerRoute, unlockRouteRegistry, } from './raw-route.js';
 export { RawRoute } from './raw-route.mock.js';

package/dist/lambda-handler.test.js

@@ -890,3 +890,69 @@ describe('createLambdaHandler — sandbox forwarded-host reaches the route', ()
         assert.strictEqual(capturedHost, 'abc123.execute-api.us-east-1.amazonaws.com');
     });
 });
+// ── SQS partial batch failure tests ─────────────────────────────────────────
+/**
+ * These pin the runtime half of the bb-async-job BatchSize fix: with a batch
+ * larger than 1, failing records must be reported individually via
+ * `batchItemFailures` so SQS retries only those messages. If this response
+ * shape regresses, every successful sibling message in a partially-failing
+ * batch would be redelivered (or, worse, the failures silently dropped).
+ */
+function makeSqsBatchEvent(count) {
+    return {
+        Records: Array.from({ length: count }, (_, i) => ({
+            eventSource: 'aws:sqs',
+            eventSourceARN: 'arn:aws:sqs:us-east-1:123456789012:my-queue',
+            messageId: `msg-${i}`,
+            body: JSON.stringify({ n: i }),
+        })),
+    };
+}
+describe('handleEventSourceRecords — SQS partial batch responses', () => {
+    it('reports only the failed records of a mixed-success 10-record batch', async () => {
+        const processed = [];
+        const handlers = new Map();
+        handlers.set('aws:sqs:my-queue', async (record) => {
+            const { n } = JSON.parse(record.body);
+            if (n % 3 === 0)
+                throw new Error(`boom on ${n}`);
+            processed.push(n);
+        });
+        globalThis.__BLOCKS_LAMBDA_EVENT_HANDLERS__ = handlers;
+        try {
+            const handler = createLambdaHandler(async () => ({}));
+            const result = await handler(makeSqsBatchEvent(10));
+            assert.deepStrictEqual(result.batchItemFailures.map((f) => f.itemIdentifier).sort(), ['msg-0', 'msg-3', 'msg-6', 'msg-9']);
+            assert.deepStrictEqual(processed.sort((a, b) => a - b), [1, 2, 4, 5, 7, 8]);
+        }
+        finally {
+            delete globalThis.__BLOCKS_LAMBDA_EVENT_HANDLERS__;
+        }
+    });
+    it('returns no batchItemFailures when every record in the batch succeeds', async () => {
+        const handlers = new Map();
+        handlers.set('aws:sqs:my-queue', async () => { });
+        globalThis.__BLOCKS_LAMBDA_EVENT_HANDLERS__ = handlers;
+        try {
+            const handler = createLambdaHandler(async () => ({}));
+            const result = await handler(makeSqsBatchEvent(10));
+            assert.deepStrictEqual(result, {});
+        }
+        finally {
+            delete globalThis.__BLOCKS_LAMBDA_EVENT_HANDLERS__;
+        }
+    });
+    it('reports all records when the whole batch fails (no silent drop)', async () => {
+        const handlers = new Map();
+        handlers.set('aws:sqs:my-queue', async () => { throw new Error('always'); });
+        globalThis.__BLOCKS_LAMBDA_EVENT_HANDLERS__ = handlers;
+        try {
+            const handler = createLambdaHandler(async () => ({}));
+            const result = await handler(makeSqsBatchEvent(10));
+            assert.strictEqual(result.batchItemFailures.length, 10);
+        }
+        finally {
+            delete globalThis.__BLOCKS_LAMBDA_EVENT_HANDLERS__;
+        }
+    });
+});

package/dist/pipeline/index.d.ts

@@ -1,3 +1,25 @@
-export { Pipeline, DeployStage, __PIPELINE_STAGE_SCOPE__, } from '@aws-blocks/pipeline';
-export type { DeployStageProps, BranchConfig, PipelineProps, PipelineSourceConfig, PipelineSynthConfig, PipelineStageConfig, } from '@aws-blocks/pipeline';
+import { __PIPELINE_STAGE_SCOPE__, DeployStage, Pipeline as LeafPipeline } from '@aws-blocks/pipeline';
+import type { BranchConfig, DeployStageProps, PipelineProps, PipelineSourceConfig, PipelineStageConfig, PipelineSynthConfig } from '@aws-blocks/pipeline';
+import type { Construct } from 'constructs';
+export { __PIPELINE_STAGE_SCOPE__, DeployStage };
+export type { BranchConfig, DeployStageProps, PipelineProps, PipelineSourceConfig, PipelineStageConfig, PipelineSynthConfig, };
+/**
+ * Blocks `Pipeline` — the framework-neutral `@aws-blocks/pipeline` construct with
+ * the Blocks value namespace pinned. It defaults `secretStore` / `configStore` to
+ * `/blocks/secrets` and `/blocks/config` (the prefixes the Blocks `secret` /
+ * `config` CLIs write), mirroring how the Blocks `Hosting` block pins the same
+ * namespace — so a value set with `npm run secret`/`config` is the value the
+ * pipeline reads. Pass `secretStore` / `configStore` to override.
+ *
+ * @see {@link https://github.com/aws-devtools-labs/aws-blocks/blob/main/packages/pipeline/README.md}
+ */
+export declare class Pipeline<TConfig = Record<string, unknown>> extends LeafPipeline<TConfig> {
+    constructor(scope: Construct, id: string, props: PipelineProps<TConfig>);
+    /**
+     * Async constructor — required when `source.connectionArn` is a `config()`
+     * marker (resolved at synth time). Pins the Blocks namespace, then delegates to
+     * the leaf {@link LeafPipeline.create}.
+     */
+    static create<TConfig = Record<string, unknown>>(scope: Construct, id: string, props: PipelineProps<TConfig>): Promise<LeafPipeline<TConfig>>;
+}
 //# sourceMappingURL=index.d.ts.map

package/dist/pipeline/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/pipeline/index.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,QAAQ,EACR,WAAW,EACX,wBAAwB,GACzB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,gBAAgB,EAChB,YAAY,EACZ,aAAa,EACb,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/pipeline/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,wBAAwB,EAAE,WAAW,EAAE,QAAQ,IAAI,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACvG,OAAO,KAAK,EACX,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,EACnB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAG5C,OAAO,EAAE,wBAAwB,EAAE,WAAW,EAAE,CAAC;AACjD,YAAY,EACX,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,GACnB,CAAC;AAkBF;;;;;;;;;GASG;AACH,qBAAa,QAAQ,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAE,SAAQ,YAAY,CAAC,OAAO,CAAC;gBACzE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,CAAC,OAAO,CAAC;IAIvE;;;;OAIG;WACU,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpD,KAAK,EAAE,SAAS,EAChB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,aAAa,CAAC,OAAO,CAAC,GAC3B,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;CAGjC"}

package/dist/pipeline/index.js

@@ -1,3 +1,43 @@
 // Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
-export { Pipeline, DeployStage, __PIPELINE_STAGE_SCOPE__, } from '@aws-blocks/pipeline';
+import { __PIPELINE_STAGE_SCOPE__, DeployStage, Pipeline as LeafPipeline } from '@aws-blocks/pipeline';
+import { blocksStoreConfig } from '../secret-naming.js';
+export { __PIPELINE_STAGE_SCOPE__, DeployStage };
+/**
+ * Merge the Blocks `/blocks/*` namespace as the DEFAULT store config, so a
+ * Blocks pipeline resolves `connectionArn` / `buildSecrets` from the same place
+ * the Blocks CLI (`npm run secret` / `npm run config`) writes. Per-kind and
+ * shallow: any field the caller sets (a custom `prefix`, a `stage`, a
+ * `cacheTtlSeconds`) wins over the Blocks default.
+ */
+function withBlocksDefaults(props) {
+    const blocks = blocksStoreConfig();
+    return {
+        ...props,
+        secretStore: { ...blocks.secretStore, ...props.secretStore },
+        configStore: { ...blocks.configStore, ...props.configStore },
+    };
+}
+/**
+ * Blocks `Pipeline` — the framework-neutral `@aws-blocks/pipeline` construct with
+ * the Blocks value namespace pinned. It defaults `secretStore` / `configStore` to
+ * `/blocks/secrets` and `/blocks/config` (the prefixes the Blocks `secret` /
+ * `config` CLIs write), mirroring how the Blocks `Hosting` block pins the same
+ * namespace — so a value set with `npm run secret`/`config` is the value the
+ * pipeline reads. Pass `secretStore` / `configStore` to override.
+ *
+ * @see {@link https://github.com/aws-devtools-labs/aws-blocks/blob/main/packages/pipeline/README.md}
+ */
+export class Pipeline extends LeafPipeline {
+    constructor(scope, id, props) {
+        super(scope, id, withBlocksDefaults(props));
+    }
+    /**
+     * Async constructor — required when `source.connectionArn` is a `config()`
+     * marker (resolved at synth time). Pins the Blocks namespace, then delegates to
+     * the leaf {@link LeafPipeline.create}.
+     */
+    static async create(scope, id, props) {
+        return LeafPipeline.create(scope, id, withBlocksDefaults(props));
+    }
+}

package/dist/pipeline.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=pipeline.test.d.ts.map

package/dist/pipeline.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pipeline.test.d.ts","sourceRoot":"","sources":["../src/pipeline.test.ts"],"names":[],"mappings":""}

package/dist/pipeline.test.js

@@ -0,0 +1,47 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+import assert from 'node:assert';
+import { afterEach, describe, it } from 'node:test';
+import { _setSynthSecretFetcher } from '@aws-blocks/hosting/constructs';
+import { config } from '@aws-blocks/hosting';
+import { App, Stack } from 'aws-cdk-lib';
+import { Pipeline } from './pipeline/index.js';
+const MOCK_CONNECTION_ARN = 'arn:aws:codeconnections:us-east-1:123456789012:connection/test-connection-id';
+function minimalStageFactory(scope, stageConfig) {
+    new Stack(scope, 'AppStack', { env: stageConfig.env });
+}
+// B2: the core Pipeline wrapper must resolve values from the SAME namespace the
+// Blocks CLI writes (`/blocks/*`), not the leaf-neutral `/hosting/*` — otherwise
+// `npm run config -- set CONNECTION_ARN` writes one name and the deploy reads
+// another. The leaf default is `/hosting/config`; the wrapper must pin `/blocks/config`.
+void describe('core Pipeline pins the Blocks namespace', () => {
+    afterEach(() => _setSynthSecretFetcher(null));
+    void it('resolves a config() connectionArn under /blocks/config by default', async () => {
+        const seen = [];
+        _setSynthSecretFetcher(async (locator) => {
+            seen.push(locator);
+            return MOCK_CONNECTION_ARN;
+        });
+        await Pipeline.create(new App(), 'BlocksPipeline', {
+            source: { repo: 'my-org/my-app', connectionArn: config('CONNECTION_ARN') },
+            branches: [{ branch: 'main', stages: [{ name: 'prod' }] }],
+            stageFactory: minimalStageFactory,
+        });
+        // The Blocks CLI writes /blocks/config/CONNECTION_ARN; the wrapper must read it there.
+        assert.deepStrictEqual(seen, ['/blocks/config/CONNECTION_ARN']);
+    });
+    void it('lets the caller override the pinned prefix', async () => {
+        const seen = [];
+        _setSynthSecretFetcher(async (locator) => {
+            seen.push(locator);
+            return MOCK_CONNECTION_ARN;
+        });
+        await Pipeline.create(new App(), 'OverridePipeline', {
+            source: { repo: 'my-org/my-app', connectionArn: config('CONNECTION_ARN') },
+            branches: [{ branch: 'main', stages: [{ name: 'prod' }] }],
+            stageFactory: minimalStageFactory,
+            configStore: { prefix: '/myapp/config' },
+        });
+        assert.deepStrictEqual(seen, ['/myapp/config/CONNECTION_ARN']);
+    });
+});

package/dist/rpc.d.ts

@@ -14,6 +14,27 @@ export type RpcParseResult = {
     ok: false;
     response: string;
 };
+/**
+ * Maximum accepted request-body size, in bytes (10 MiB).
+ *
+ * Matches the payload limit API Gateway enforces in production (~10 MB for a
+ * REST API). In prod an oversized body is rejected by API Gateway at the edge —
+ * before the Lambda is invoked — so this guard's rejection path effectively
+ * runs on the dev/mock server, where there is no edge to stop it: an oversized
+ * body would otherwise buffer and wedge the local database (e.g. PGlite). By
+ * enforcing the *same* limit locally, the dev server rejects the same oversized
+ * body prod would 413 at the edge, instead of failing only in one environment.
+ * Enforced in `parseRpcRequest`, the single choke point both the Lambda handler
+ * and the dev server route through.
+ *
+ * Note: this value is the Lambda + API Gateway limit. It lives here (in the
+ * compute-agnostic parser) because Lambda is the only compute path today. When
+ * a non-API-Gateway compute (e.g. container/ALB) is introduced, this should
+ * become compute-aware — sourced from / overridden by the compute layer (via
+ * the Compute `setEnv` config hook) rather than a fixed constant in `core` —
+ * since an ALB has a different payload limit. Tracked with the multi-compute work.
+ */
+export declare const MAX_RPC_BODY_BYTES: number;
 /** Reserved JSON-RPC error codes. */
 export declare const RpcErrorCode: {
     readonly ParseError: -32700;

package/dist/rpc.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rpc.d.ts","sourceRoot":"","sources":["../src/rpc.ts"],"names":[],"mappings":"AAgBA,0EAA0E;AAC1E,MAAM,WAAW,gBAAgB;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,wFAAwF;IACxF,IAAI,EAAE,OAAO,EAAE,CAAC;IAChB,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,yDAAyD;AACzD,MAAM,MAAM,cAAc,GACtB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,gBAAgB,CAAA;CAAE,GACvC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAMpC,qCAAqC;AACrC,eAAO,MAAM,YAAY;;;;;;CAMf,CAAC;AAMX,8DAA8D;AAC9D,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,CAO9F;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAiBxD;AAID;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,cAAc,CA0DhE;AAED,oEAAoE;AACpE,wBAAgB,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,MAAM,CAEnF;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,MAAM,CAOzF;AAED,yCAAyC;AACzC,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,MAAM,CAEzF;AAID,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,EAC1B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,MAAM,CAMR"}
+{"version":3,"file":"rpc.d.ts","sourceRoot":"","sources":["../src/rpc.ts"],"names":[],"mappings":"AAgBA,0EAA0E;AAC1E,MAAM,WAAW,gBAAgB;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,wFAAwF;IACxF,IAAI,EAAE,OAAO,EAAE,CAAC;IAChB,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,yDAAyD;AACzD,MAAM,MAAM,cAAc,GACtB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,gBAAgB,CAAA;CAAE,GACvC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAMpC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,kBAAkB,QAAmB,CAAC;AAEnD,qCAAqC;AACrC,eAAO,MAAM,YAAY;;;;;;CAMf,CAAC;AAMX,8DAA8D;AAC9D,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,CAO9F;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAiBxD;AAID;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,cAAc,CA6EhE;AAED,oEAAoE;AACpE,wBAAgB,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,MAAM,CAEnF;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,MAAM,CAOzF;AAED,yCAAyC;AACzC,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,MAAM,CAEzF;AAID,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,EAC1B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,MAAM,CAMR"}

package/dist/rpc.js

@@ -11,6 +11,27 @@
 import { ApiError } from './errors.js';
 // ── Constants ───────────────────────────────────────────────────────────────
 const VERSION = '2.0';
+/**
+ * Maximum accepted request-body size, in bytes (10 MiB).
+ *
+ * Matches the payload limit API Gateway enforces in production (~10 MB for a
+ * REST API). In prod an oversized body is rejected by API Gateway at the edge —
+ * before the Lambda is invoked — so this guard's rejection path effectively
+ * runs on the dev/mock server, where there is no edge to stop it: an oversized
+ * body would otherwise buffer and wedge the local database (e.g. PGlite). By
+ * enforcing the *same* limit locally, the dev server rejects the same oversized
+ * body prod would 413 at the edge, instead of failing only in one environment.
+ * Enforced in `parseRpcRequest`, the single choke point both the Lambda handler
+ * and the dev server route through.
+ *
+ * Note: this value is the Lambda + API Gateway limit. It lives here (in the
+ * compute-agnostic parser) because Lambda is the only compute path today. When
+ * a non-API-Gateway compute (e.g. container/ALB) is introduced, this should
+ * become compute-aware — sourced from / overridden by the compute layer (via
+ * the Compute `setEnv` config hook) rather than a fixed constant in `core` —
+ * since an ALB has a different payload limit. Tracked with the multi-compute work.
+ */
+export const MAX_RPC_BODY_BYTES = 10 * 1024 * 1024;
 /** Reserved JSON-RPC error codes. */
 export const RpcErrorCode = {
     ParseError: -32700,
@@ -58,6 +79,19 @@ export function decodeRpcResponse(body) {
  * anything about the JSON-RPC spec.
  */
 export function parseRpcRequest(bodyText) {
+    // Reject oversized bodies before parsing or dispatch. See MAX_RPC_BODY_BYTES
+    // for the limit and its rationale.
+    if (Buffer.byteLength(bodyText, 'utf8') > MAX_RPC_BODY_BYTES) {
+        // Emit the real HTTP status (413) as the error code, not a reserved -32xxx:
+        // `decodeRpcResponse` maps a positive code straight to `ApiError.status`
+        // (reserved codes collapse to 500), mirroring the 504 handler-timeout path,
+        // so a caller's `e.status === 413` works. `name` (which crosses the wire,
+        // not the code) lets callers match with `isBlocksError(e, 'PayloadTooLarge')`.
+        return {
+            ok: false,
+            response: errorResponse(413, `Request body exceeds the ${MAX_RPC_BODY_BYTES} byte (${MAX_RPC_BODY_BYTES / (1024 * 1024)} MiB) limit`, null, { name: 'PayloadTooLarge' }),
+        };
+    }
     let parsed;
     try {
         parsed = JSON.parse(bodyText || '{}');

package/dist/rpc.test.js

@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: Apache-2.0
 import { describe, it } from 'node:test';
 import assert from 'node:assert';
-import { decodeRpcResponse, errorResponseFromCatch, parseRpcRequest, RpcErrorCode } from './rpc.js';
+import { decodeRpcResponse, errorResponseFromCatch, parseRpcRequest, RpcErrorCode, MAX_RPC_BODY_BYTES } from './rpc.js';
 import { ApiError, isBlocksError } from './errors.js';
 describe('-32600 Invalid Request error shape', () => {
     it('returns proper JSON-RPC 2.0 envelope with error code', () => {
@@ -154,3 +154,40 @@ describe('ApiError status ↔ JSON-RPC error code', () => {
         assert.throws(() => decodeRpcResponse({ jsonrpc: '2.0', error: { code: RpcErrorCode.InvalidRequest, message: 'Invalid Request' }, id: null }), (e) => e instanceof ApiError && e.status === 500);
     });
 });
+describe('request body size limit', () => {
+    it('accepts a normal-sized body', () => {
+        const result = parseRpcRequest(JSON.stringify({ jsonrpc: '2.0', method: 'ns.method', params: [], id: 1 }));
+        assert.strictEqual(result.ok, true);
+    });
+    it('rejects a body larger than MAX_RPC_BODY_BYTES with a PayloadTooLarge error', () => {
+        // A JSON string just over the limit (a single huge param value).
+        const huge = 'x'.repeat(MAX_RPC_BODY_BYTES + 1);
+        const body = JSON.stringify({ jsonrpc: '2.0', method: 'ns.method', params: [huge], id: 1 });
+        assert.ok(Buffer.byteLength(body, 'utf8') > MAX_RPC_BODY_BYTES);
+        const result = parseRpcRequest(body);
+        assert.strictEqual(result.ok, false);
+        if (result.ok)
+            return; // narrow
+        const parsed = JSON.parse(result.response);
+        // Positive HTTP status (413), not a reserved -32xxx — so decodeRpcResponse
+        // surfaces it to the client as ApiError.status === 413.
+        assert.strictEqual(parsed.error.code, 413);
+        assert.strictEqual(parsed.error.data?.name, 'PayloadTooLarge');
+        assert.match(parsed.error.message, /exceeds/);
+        assert.match(parsed.error.message, /10 MiB/); // human-readable size crosses the wire
+        // Client round-trip: decodeRpcResponse surfaces it as ApiError.status 413
+        // (not 500), so consumer `e.status === 413` handling works.
+        assert.throws(() => decodeRpcResponse(parsed), (e) => e instanceof ApiError && e.status === 413 && isBlocksError(e, 'PayloadTooLarge'));
+    });
+    it('rejects an oversized body before attempting to parse it (invalid JSON still 413s, not a ParseError)', () => {
+        // Oversized AND not valid JSON — the size guard must win, proving the body
+        // is rejected before the (expensive) parse + before any handler/DB touch.
+        const oversizedGarbage = 'x'.repeat(MAX_RPC_BODY_BYTES + 1);
+        const result = parseRpcRequest(oversizedGarbage);
+        assert.strictEqual(result.ok, false);
+        if (result.ok)
+            return;
+        const parsed = JSON.parse(result.response);
+        assert.strictEqual(parsed.error.data?.name, 'PayloadTooLarge');
+    });
+});

package/dist/scripts/config.d.ts

@@ -0,0 +1,15 @@
+/** Set (create or overwrite) a Blocks config value. */
+export declare function setConfig(key: string, value: string, opts?: {
+    stage?: string;
+}): Promise<void>;
+/** List Blocks config keys (names only). */
+export declare function listConfig(opts?: {
+    stage?: string;
+}): Promise<string[]>;
+/** Remove a Blocks config value. */
+export declare function removeConfig(key: string, opts?: {
+    stage?: string;
+}): Promise<boolean>;
+/** CLI dispatcher for `blocks config <set|list|remove> …`. */
+export declare function runConfigCli(argv: string[]): Promise<void>;
+//# sourceMappingURL=config.d.ts.map

package/dist/scripts/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/scripts/config.ts"],"names":[],"mappings":"AAgBA,uDAAuD;AACvD,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAElG;AAED,4CAA4C;AAC5C,wBAAgB,UAAU,CAAC,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAE3E;AAED,oCAAoC;AACpC,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAEzF;AAED,8DAA8D;AAC9D,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAE1D"}

package/dist/scripts/config.js

@@ -0,0 +1,29 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * `blocks config` — manage a Blocks app's non-sensitive **config** values (SSM
+ * Parameter Store), pinned to the Blocks `/blocks/<stackId>/config` namespace
+ * (scoped to the app's stable `stackId` from `.blocks/config.json`). Thin wrapper
+ * over the shared `@aws-blocks/hosting` CLI with the kind fixed to `config`. The
+ * `secret` counterpart is `./secret.ts`.
+ *
+ * @module
+ */
+import { listValues, removeValue, runValueCli, setValue } from '@aws-blocks/hosting/scripts';
+import { blocksConfigPrefix } from '../secret-naming.js';
+/** Set (create or overwrite) a Blocks config value. */
+export function setConfig(key, value, opts = {}) {
+    return setValue('config', key, value, { prefix: blocksConfigPrefix(), ...opts });
+}
+/** List Blocks config keys (names only). */
+export function listConfig(opts = {}) {
+    return listValues('config', { prefix: blocksConfigPrefix(), ...opts });
+}
+/** Remove a Blocks config value. */
+export function removeConfig(key, opts = {}) {
+    return removeValue('config', key, { prefix: blocksConfigPrefix(), ...opts });
+}
+/** CLI dispatcher for `blocks config <set|list|remove> …`. */
+export function runConfigCli(argv) {
+    return runValueCli(argv, { kind: 'config', prefix: blocksConfigPrefix(), label: 'blocks config' });
+}

package/dist/scripts/deploy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/scripts/deploy.ts"],"names":[],"mappings":"AAaA,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,wBAAsB,MAAM,CAAC,OAAO,EAAE,aAAa,iBAiGlD"}
+{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/scripts/deploy.ts"],"names":[],"mappings":"AAcA,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,wBAAsB,MAAM,CAAC,OAAO,EAAE,aAAa,iBAqGlD"}

package/dist/scripts/deploy.js

@@ -5,6 +5,7 @@ import { readFileSync, writeFileSync, mkdirSync } from 'node:fs';
 import { join, resolve, dirname } from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { ensureSecrets, loadProductionEnv } from './ensure-secrets.js';
+import { assertAwsCredentials } from './preflight-credentials.js';
 import { applyExternalMigrations } from './external-migrations-step.js';
 import { trackCommand } from '../telemetry/trackCommand.js';
 import { getCdkTelemetryEnv } from './cdk-telemetry-env.js';
@@ -15,6 +16,9 @@ export async function deploy(options) {
         // Load production environment (from .env.production or CI env vars)
         loadProductionEnv();
         process.env.BLOCKS_STAGE = 'production';
+        // Fail fast if AWS credentials are missing/expired, before generating the
+        // client and spending time in synth only to hit an opaque CDK credential error.
+        await assertAwsCredentials('deploy');
         // Provision secrets for production. projectRoot must match the root cdk
         // synth uses (passed as --context below) so the written parameter name
         // equals the one the app resolves at synth.

package/dist/scripts/dev-server.d.ts

@@ -43,6 +43,14 @@ export interface DevServerOptions {
     frontendCommand?: string;
     /** Port the frontend dev server listens on. Default: 3100. */
     frontendPort?: number;
+    /**
+     * Watch `secret()` / `config()` calls and regenerate the type-safe key
+     * augmentation (so `getSecret`/`getConfig` autocomplete and reject typos) as you
+     * edit — all under this one `npm run dev`, no second command. Auto-detected: a
+     * no-op unless the app actually declares a `secret()`/`config()`, and never fatal
+     * (a failure only logs a warning). Set `false` to disable. Default: enabled.
+     */
+    typegen?: boolean;
 }
 /**
  * Single-shot TCP probe: resolves `true` iff a connection to `port` succeeds

package/dist/scripts/dev-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dev-server.d.ts","sourceRoot":"","sources":["../../src/scripts/dev-server.ts"],"names":[],"mappings":"AAsCA,eAAO,MAAM,iBAAiB,QAAiD,CAAC;AAEhF;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CASjF;AAED,sFAAsF;AACtF,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,OAAO,GAAG,SAAS,CAAC;CAClC;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,mBAAmB,CAKvF;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE/E;AAED,MAAM,WAAW,gBAAgB;IAC/B,2CAA2C;IAC3C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oCAAoC;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,8DAA8D;IAC9D,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAiBD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,SAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAa/F;AAYD,+DAA+D;AAC/D,MAAM,WAAW,qBAAqB;IACpC,oFAAoF;IACpF,WAAW,EAAE,MAAM,CAAC;IACpB,2DAA2D;IAC3D,QAAQ,EAAE,MAAM,CAAC;IACjB,yEAAyE;IACzE,SAAS,EAAE,MAAM,CAAC;IAClB,oDAAoD;IACpD,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,uFAAuF;AACvF,eAAO,MAAM,+BAA+B,EAAE,qBAK7C,CAAC;AAEF,kDAAkD;AAClD,MAAM,WAAW,eAAe;IAC9B,oDAAoD;IACpD,OAAO,EAAE,OAAO,CAAC;IACjB,mEAAmE;IACnE,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,uBAAuB,CACrC,cAAc,EAAE,MAAM,EAAE,EACxB,GAAG,EAAE,MAAM,EACX,MAAM,GAAE,qBAAuD,GAC9D,eAAe,CAOjB;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,SAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAOnF;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE;IAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,EAC5E,OAAO,EAAE,OAAO,GACf,OAAO,CAOT;AAID,sCAAsC;AACtC,MAAM,WAAW,aAAa;IAC5B,uDAAuD;IACvD,OAAO,EAAE,OAAO,CAAC;IACjB,oFAAoF;IACpF,SAAS,EAAE,OAAO,CAAC;IACnB,yGAAyG;IACzG,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,kFAAkF;AAClF,MAAM,WAAW,eAAe;IAC9B,4CAA4C;IAC5C,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1C,gDAAgD;IAChD,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;IACrC,6EAA6E;IAC7E,QAAQ,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC;IACxD,kDAAkD;IAClD,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/D;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,OAAO,CAAC,eAAe,CAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAwB3G;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAW3F;AAED,gFAAgF;AAChF,MAAM,WAAW,mBAAmB;IAClC,sEAAsE;IACtE,WAAW,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,oFAAoF;AACpF,eAAO,MAAM,8BAA8B,EAAE,mBAG5C,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,EACf,MAAM,GAAE,mBAAoD,GAC3D;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAGrC;AAED,4GAA4G;AAC5G,MAAM,WAAW,aAAa;IAC5B,0EAA0E;IAC1E,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IAClD,wEAAwE;IACxE,QAAQ,EAAE,MAAM,IAAI,CAAC;IACrB,wEAAwE;IACxE,aAAa,EAAE,CAAC,EAAE,EAAE,MAAM,IAAI,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACzD,+EAA+E;IAC/E,WAAW,EAAE,MAAM,IAAI,CAAC;IACxB,oDAAoD;IACpD,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,aAAa,EACnB,MAAM,GAAE,mBAAoD,GAC3D,MAAM,IAAI,CAwBZ;AAID,8EAA8E;AAC9E,MAAM,WAAW,kBAAkB;IACjC,wCAAwC;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ,mFAAmF;IACnF,IAAI,EAAE,MAAM,CAAC;IACb,8CAA8C;IAC9C,IAAI,EAAE,MAAM,CAAC;CACd;AAED,mGAAmG;AACnG,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI,CAUtE;AAED,wGAAwG;AACxG,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,IAAmC,GAAG,OAAO,CAQ3H;AAED,8GAA8G;AAC9G,MAAM,MAAM,iBAAiB,GAAG;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3F;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,kBAAkB,GAAG,IAAI,EACnC,IAAI,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EACnC,SAAS,EAAE,OAAO,EAClB,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,GAChC,iBAAiB,CASnB;AAED,wBAAsB,cAAc,CAAC,OAAO,EAAE,gBAAgB,iBAmiB7D"}
+{"version":3,"file":"dev-server.d.ts","sourceRoot":"","sources":["../../src/scripts/dev-server.ts"],"names":[],"mappings":"AAsCA,eAAO,MAAM,iBAAiB,QAAiD,CAAC;AAEhF;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CASjF;AAED,sFAAsF;AACtF,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,OAAO,GAAG,SAAS,CAAC;CAClC;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,mBAAmB,CAKvF;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE/E;AAED,MAAM,WAAW,gBAAgB;IAC/B,2CAA2C;IAC3C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oCAAoC;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,8DAA8D;IAC9D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AA0CD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,SAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAa/F;AAYD,+DAA+D;AAC/D,MAAM,WAAW,qBAAqB;IACpC,oFAAoF;IACpF,WAAW,EAAE,MAAM,CAAC;IACpB,2DAA2D;IAC3D,QAAQ,EAAE,MAAM,CAAC;IACjB,yEAAyE;IACzE,SAAS,EAAE,MAAM,CAAC;IAClB,oDAAoD;IACpD,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,uFAAuF;AACvF,eAAO,MAAM,+BAA+B,EAAE,qBAK7C,CAAC;AAEF,kDAAkD;AAClD,MAAM,WAAW,eAAe;IAC9B,oDAAoD;IACpD,OAAO,EAAE,OAAO,CAAC;IACjB,mEAAmE;IACnE,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,uBAAuB,CACrC,cAAc,EAAE,MAAM,EAAE,EACxB,GAAG,EAAE,MAAM,EACX,MAAM,GAAE,qBAAuD,GAC9D,eAAe,CAOjB;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,SAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAOnF;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE;IAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,EAC5E,OAAO,EAAE,OAAO,GACf,OAAO,CAOT;AAID,sCAAsC;AACtC,MAAM,WAAW,aAAa;IAC5B,uDAAuD;IACvD,OAAO,EAAE,OAAO,CAAC;IACjB,oFAAoF;IACpF,SAAS,EAAE,OAAO,CAAC;IACnB,yGAAyG;IACzG,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,kFAAkF;AAClF,MAAM,WAAW,eAAe;IAC9B,4CAA4C;IAC5C,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1C,gDAAgD;IAChD,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;IACrC,6EAA6E;IAC7E,QAAQ,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC;IACxD,kDAAkD;IAClD,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/D;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,OAAO,CAAC,eAAe,CAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAwB3G;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAW3F;AAED,gFAAgF;AAChF,MAAM,WAAW,mBAAmB;IAClC,sEAAsE;IACtE,WAAW,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,oFAAoF;AACpF,eAAO,MAAM,8BAA8B,EAAE,mBAG5C,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,EACf,MAAM,GAAE,mBAAoD,GAC3D;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAGrC;AAED,4GAA4G;AAC5G,MAAM,WAAW,aAAa;IAC5B,0EAA0E;IAC1E,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IAClD,wEAAwE;IACxE,QAAQ,EAAE,MAAM,IAAI,CAAC;IACrB,wEAAwE;IACxE,aAAa,EAAE,CAAC,EAAE,EAAE,MAAM,IAAI,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACzD,+EAA+E;IAC/E,WAAW,EAAE,MAAM,IAAI,CAAC;IACxB,oDAAoD;IACpD,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,aAAa,EACnB,MAAM,GAAE,mBAAoD,GAC3D,MAAM,IAAI,CAwBZ;AAID,8EAA8E;AAC9E,MAAM,WAAW,kBAAkB;IACjC,wCAAwC;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ,mFAAmF;IACnF,IAAI,EAAE,MAAM,CAAC;IACb,8CAA8C;IAC9C,IAAI,EAAE,MAAM,CAAC;CACd;AAED,mGAAmG;AACnG,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI,CAUtE;AAED,wGAAwG;AACxG,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,IAAmC,GAAG,OAAO,CAQ3H;AAED,8GAA8G;AAC9G,MAAM,MAAM,iBAAiB,GAAG;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3F;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,kBAAkB,GAAG,IAAI,EACnC,IAAI,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EACnC,SAAS,EAAE,OAAO,EAClB,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,GAChC,iBAAiB,CASnB;AAED,wBAAsB,cAAc,CAAC,OAAO,EAAE,gBAAgB,iBA0iB7D"}

package/dist/scripts/dev-server.js

@@ -75,6 +75,31 @@ export function buildBlocksConfig(port, isSandbox) {
 export function isBlocksConfigRequest(method, pathname) {
     return method === 'GET' && pathname === `${BLOCKS_SANDBOX_PREFIX}/config.json`;
 }
+/**
+ * Bootstrap the type-safe `getSecret`/`getConfig` key generation for the dev
+ * session. Auto-detected and non-fatal: scans the app for `secret()`/`config()`
+ * calls and, only if it finds any, generates the augmentation `.d.ts` and starts a
+ * watcher that regenerates on save — so a single `npm run dev` gives type-safe keys
+ * with no second command. Returns a `stop()` (or `undefined` when the app declares
+ * no secrets, typegen is unavailable, or it is disabled). The watcher is `unref`'d
+ * so it can never block the dev server's shutdown.
+ */
+async function startTypegenWatch() {
+    try {
+        const { scanValueKeys, watchHostingValues } = await import('@aws-blocks/hosting/scripts');
+        const scan = await scanValueKeys();
+        if (scan.secretKeys.length === 0 && scan.configKeys.length === 0) {
+            return undefined; // app doesn't use secret()/config() → nothing to type, skip silently
+        }
+        console.log('🔑 Type-safe secret()/config() keys — watching for changes...');
+        return await watchHostingValues({ unref: true });
+    }
+    catch (error) {
+        // Never break the dev server over typegen (e.g. `typescript` not installed).
+        console.warn(`⚠️  hosting-typegen skipped: ${error instanceof Error ? error.message : String(error)}`);
+        return undefined;
+    }
+}
 /**
  * Initialize all building blocks that have an initialize() method.
  * This is the "local deploy" phase - mirrors CDK deploy.
@@ -790,6 +815,11 @@ export async function startDevServer(options) {
         console.log('📝 Generating client code...');
         await writeClientCode(resolvedPath, clientPath);
     }
+    // Type-safe getSecret/getConfig: generate + watch the key augmentation so the
+    // getters autocomplete and reject typos, regenerating on save — all under this
+    // one `npm run dev`. Auto-detected (no-op unless the app uses secret()/config())
+    // and non-fatal.
+    const stopTypegen = options.typegen === false ? undefined : await startTypegenWatch();
     // ── Startup reclaim ──────────────────────────────────────────────────────
     // Free any port left bound by a crashed / SIGKILL'd predecessor before we bind
     // the front door or spawn the `--strictPort` frontend. tsx-watch only gives the
@@ -875,6 +905,7 @@ export async function startDevServer(options) {
             clearTimeout(respawnTimer);
             respawnTimer = null;
         }
+        stopTypegen?.(); // tear down the typegen watcher (unref'd, but close it cleanly)
         // Detach our own listeners so repeated signals can't pile up handlers.
         for (const sig of signals)
             process.removeListener(sig, cleanup);

package/dist/scripts/generate-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate-client.d.ts","sourceRoot":"","sources":["../../src/scripts/generate-client.ts"],"names":[],"mappings":"AAQA;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA4DhF;AAED;;GAEG;AACH,wBAAsB,eAAe,CAAC,cAAc,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAI/F"}
+{"version":3,"file":"generate-client.d.ts","sourceRoot":"","sources":["../../src/scripts/generate-client.ts"],"names":[],"mappings":"AASA;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAgEhF;AAED;;GAEG;AACH,wBAAsB,eAAe,CAAC,cAAc,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAI/F"}

package/dist/scripts/generate-client.js

@@ -1,8 +1,9 @@
 // Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
-import { writeFileSync, mkdirSync } from 'fs';
-import { dirname } from 'path';
-import { pathToFileURL } from 'url';
+import { isManagedValue } from '@aws-blocks/hosting';
+import { mkdirSync, writeFileSync } from 'node:fs';
+import { dirname } from 'node:path';
+import { pathToFileURL } from 'node:url';
 import { API_NAMESPACE_MARKER } from '../api.js';
 /**
  * Generate browser-safe client code from backend exports.
@@ -43,6 +44,10 @@ export async function generateClientCode(foundationPath) {
         const isScope = typeof value?.id === 'string' && typeof value?.fullId === 'string';
         if (isScope)
             continue;
+        // A secret()/config() marker is a deferred value, not an API — skip it, or
+        // `export const k = secret('K')` in index.ts would become a bogus HTTP namespace.
+        if (isManagedValue(value))
+            continue;
         // Fallback: any exported function/object gets an ApiNamespace proxy.
         if ((typeof value === 'function' || typeof value === 'object') && value !== null) {
             lines.push(`export const ${name} = __BLOCKS_ApiNamespaceClient__('${name}');`);
@@ -50,7 +55,7 @@ export async function generateClientCode(foundationPath) {
         }
     }
     // Emit generateClient — creates new ApiNamespaceClient instances with the given url
-    const nsEntries = namespaceNames.map(n => `    ${n}: __BLOCKS_ApiNamespaceClient__('${n}', config),`).join('\n');
+    const nsEntries = namespaceNames.map((n) => `    ${n}: __BLOCKS_ApiNamespaceClient__('${n}', config),`).join('\n');
     lines.push('');
     lines.push(`export const generateClient = (config) => ({\n${nsEntries}\n});`);
     const header = [

package/dist/scripts/generate-client.test.js

@@ -1,11 +1,11 @@
 // Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
-import { describe, it, beforeEach, afterEach } from 'node:test';
 import assert from 'node:assert';
+import { afterEach, beforeEach, describe, it } from 'node:test';
+import { mkdirSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
 import { generateClientCode } from './generate-client.js';
-import { writeFileSync, mkdirSync, rmSync } from 'fs';
-import { join } from 'path';
-import { tmpdir } from 'os';
 /**
  * Regression test: generateClientCode collects middleware from whatever
  * the backend registers via registerClientMiddleware(). In sandbox mode,
@@ -45,4 +45,19 @@ describe('generateClientCode — middleware collection', () => {
         assert.ok(code.includes("import '@aws-blocks/bb-realtime/mock-middleware'"), 'Generated client must include mock-middleware in local dev mode');
         assert.ok(!code.includes('aws-middleware'), 'Generated client must NOT include aws-middleware in local dev mode');
     });
+    it('skips secret()/config() markers — they are values, not API namespaces', async () => {
+        // A secret()/config() marker is branded with Symbol.for('@aws-blocks/hosting.ManagedValue');
+        // build one inline so the fixture needs no imports. A real export still gets a proxy.
+        const backendPath = join(tmpDir, 'backend.mjs');
+        writeFileSync(backendPath, `
+				const BRAND = Symbol.for('@aws-blocks/hosting.ManagedValue');
+				export const stripeKey = { [BRAND]: true, key: 'STRIPE_KEY', kind: 'secret' };
+				export const featureFlags = { [BRAND]: true, key: 'FEATURE_FLAGS', kind: 'config' };
+				export function realApi() {}
+			`);
+        const code = await generateClientCode(backendPath);
+        assert.ok(!code.includes("__BLOCKS_ApiNamespaceClient__('stripeKey')"), 'a secret() marker must not become an HTTP namespace');
+        assert.ok(!code.includes("__BLOCKS_ApiNamespaceClient__('featureFlags')"), 'a config() marker must not become an HTTP namespace');
+        assert.ok(code.includes("export const realApi = __BLOCKS_ApiNamespaceClient__('realApi')"), 'a real (non-marker) export still becomes a namespace');
+    });
 });