@aws-blocks/core 0.2.0 → 0.4.0

package/dist/cdk/blocks-backend.test.js

@@ -1,15 +1,57 @@
 // Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
-import { test, describe, before } from 'node:test';
 import assert from 'node:assert';
-import { fileURLToPath } from 'node:url';
 import { dirname, join } from 'node:path';
+import { before, describe, test } from 'node:test';
+import { fileURLToPath } from 'node:url';
 import * as cdk from 'aws-cdk-lib';
-import { Template, Match } from 'aws-cdk-lib/assertions';
+import { Match, Template } from 'aws-cdk-lib/assertions';
+import * as apigateway from 'aws-cdk-lib/aws-apigateway';
 import { PolicyStatement } from 'aws-cdk-lib/aws-iam';
+import * as lambda from 'aws-cdk-lib/aws-lambda-nodejs';
+import { BLOCKS_RPC_PREFIX } from '../constants.js';
 import { BlocksBackend } from './blocks-backend.js';
 import { BlocksPresets } from './blocks-defaults.js';
+import { Compute } from './compute/compute.js';
 import { Scope } from './index.js';
+// A real app gets its default compute from @aws-blocks/bb-lambda-compute (via
+// @aws-blocks/blocks), which core's own tests can't depend on. Use an
+// equivalent inline stub: a Compute that owns a NodejsFunction + API Gateway,
+// so create() can build the default and the handler/gateway/apiUrl accessors
+// and synth-shape assertions have something real to resolve to. It is passed to
+// each create() via the internal `defaultComputeFactory` option (see
+// makeBackend), exactly as @aws-blocks/blocks injects LambdaCompute.
+class StubLambdaCompute extends Compute {
+    fn;
+    apiGateway;
+    apiUrl;
+    logGroup;
+    constructor(scope, id) {
+        super(id, { parent: scope });
+        this.logGroup = new cdk.aws_logs.LogGroup(this, 'HandlerLogGroup', {
+            removalPolicy: cdk.RemovalPolicy.DESTROY,
+        });
+        this.fn = new lambda.NodejsFunction(this, 'Handler', {
+            entry: this.backendHandlerPath,
+            runtime: cdk.aws_lambda.Runtime.NODEJS_22_X,
+            handler: 'handler',
+            role: this.executionRole,
+            logGroup: this.logGroup,
+            environment: { BLOCKS_STACK_NAME: this.backendStackName },
+            bundling: { minify: true, esbuildArgs: { '--conditions': 'aws-runtime' } },
+        });
+        this.apiGateway = new apigateway.RestApi(this, 'API', { restApiName: 'Blocks API' });
+        this.apiGateway.root.addProxy({
+            defaultIntegration: new apigateway.LambdaIntegration(this.fn),
+            anyMethod: true,
+        });
+        this.apiUrl = `${this.apiGateway.url}${BLOCKS_RPC_PREFIX.slice(1)}`;
+    }
+    setEnv(key, value) {
+        this.fn.addEnvironment(key, value);
+    }
+}
+const stubComputeFactory = (root) => new StubLambdaCompute(root, 'DefaultCompute');
 // Simulate the CDK condition being active (tests import CDK files directly)
 before(() => {
     process.env.NODE_OPTIONS = (process.env.NODE_OPTIONS ?? '') + ' --conditions=cdk';
@@ -21,20 +63,15 @@ const factoryBackendPath = join(__dirname, '__fixtures__', 'factory-backend.js')
 const fullIdConstructBackendPath = join(__dirname, '__fixtures__', 'fullid-construct-backend.js');
 const EXECUTION_ROLE_MARKER_ACTION = 'blocks-test:MarkerAction';
 const importMetaHandlerPath = join(__dirname, '__fixtures__', 'import-meta-handler.js');
+// Wraps BlocksBackend.create, injecting the stub default-compute factory the way
+// @aws-blocks/blocks injects LambdaCompute — so tests don't repeat it 15 times.
+const makeBackend = (scope, id, backendCDKPath) => BlocksBackend.create(scope, id, { backendHandlerPath: handlerPath, backendCDKPath, defaults: BlocksPresets.production, defaultComputeFactory: stubComputeFactory });
 describe('ESM cache-busting (multi-stage)', () => {
     test('BlocksBackend.create() with same backendCDKPath but different IDs produces constructs in each', async () => {
         const app = new cdk.App();
         const stack = new cdk.Stack(app, 'TestStack');
-        const backend1 = await BlocksBackend.create(stack, 'Stage1', {
-            backendHandlerPath: handlerPath,
-            backendCDKPath: sideEffectBackendPath,
-            defaults: BlocksPresets.production,
-        });
-        const backend2 = await BlocksBackend.create(stack, 'Stage2', {
-            backendHandlerPath: handlerPath,
-            backendCDKPath: sideEffectBackendPath,
-            defaults: BlocksPresets.production,
-        });
+        const backend1 = await makeBackend(stack, 'Stage1', sideEffectBackendPath);
+        const backend2 = await makeBackend(stack, 'Stage2', sideEffectBackendPath);
         const findMarker = (scope) => scope.node.tryFindChild('SideEffectMarker');
         assert.ok(findMarker(backend1), 'Stage1 backend should have SideEffectMarker construct from module side effect');
         assert.ok(findMarker(backend2), 'Stage2 backend should have SideEffectMarker construct from re-executed module');
@@ -44,11 +81,7 @@ describe('synth shape (drop into existing stack)', () => {
     test('BlocksBackend lives inside the parent stack and synthesizes Lambda + API Gateway', async () => {
         const app = new cdk.App();
         const parent = new cdk.Stack(app, 'MyExistingStack');
-        const backend = await BlocksBackend.create(parent, 'Blocks', {
-            backendHandlerPath: handlerPath,
-            backendCDKPath: sideEffectBackendPath,
-            defaults: BlocksPresets.production,
-        });
+        const backend = await makeBackend(parent, 'Blocks', sideEffectBackendPath);
         // Public surface mirrors BlocksStack.
         assert.ok(backend.handler, 'BlocksBackend should expose .handler');
         assert.ok(backend.gateway, 'BlocksBackend should expose .gateway');
@@ -62,16 +95,8 @@ describe('synth shape (drop into existing stack)', () => {
     test('multiple BlocksBackends in the same parent stack do not collide', async () => {
         const app = new cdk.App();
         const parent = new cdk.Stack(app, 'MultiBackendStack');
-        await BlocksBackend.create(parent, 'BackendA', {
-            backendHandlerPath: handlerPath,
-            backendCDKPath: sideEffectBackendPath,
-            defaults: BlocksPresets.production,
-        });
-        await BlocksBackend.create(parent, 'BackendB', {
-            backendHandlerPath: handlerPath,
-            backendCDKPath: sideEffectBackendPath,
-            defaults: BlocksPresets.production,
-        });
+        await makeBackend(parent, 'BackendA', sideEffectBackendPath);
+        await makeBackend(parent, 'BackendB', sideEffectBackendPath);
         const template = Template.fromStack(parent);
         template.resourceCountIs('AWS::ApiGateway::RestApi', 2);
     });
@@ -80,21 +105,13 @@ describe('shared execution role', () => {
     test('exposes executionRole on the backend', async () => {
         const app = new cdk.App();
         const parent = new cdk.Stack(app, 'RoleSurfaceStack');
-        const backend = await BlocksBackend.create(parent, 'Blocks', {
-            backendHandlerPath: handlerPath,
-            backendCDKPath: sideEffectBackendPath,
-            defaults: BlocksPresets.production,
-        });
+        const backend = await makeBackend(parent, 'Blocks', sideEffectBackendPath);
         assert.ok(backend.executionRole, 'BlocksBackend should expose .executionRole');
     });
     test('synth produces a Lambda-assumable role with basic execution, and the handler uses it', async () => {
         const app = new cdk.App();
         const parent = new cdk.Stack(app, 'RoleSynthStack');
-        await BlocksBackend.create(parent, 'Blocks', {
-            backendHandlerPath: handlerPath,
-            backendCDKPath: sideEffectBackendPath,
-            defaults: BlocksPresets.production,
-        });
+        await makeBackend(parent, 'Blocks', sideEffectBackendPath);
         const template = Template.fromStack(parent);
         // The shared role (logical id derived from the 'BlocksRole' construct id)
         // is assumable by Lambda and carries AWSLambdaBasicExecutionRole (so
@@ -102,7 +119,7 @@ describe('shared execution role', () => {
         // roles exist (API Gateway CloudWatch role, config BucketDeployment role),
         // so we target ours by logical id.
         const roles = template.findResources('AWS::IAM::Role');
-        const blocksRoleId = Object.keys(roles).find(k => k.includes('BlocksRole'));
+        const blocksRoleId = Object.keys(roles).find((k) => k.includes('BlocksRole'));
         assert.ok(blocksRoleId, 'expected a role from the BlocksRole construct');
         const blocksRole = roles[blocksRoleId];
         assert.deepStrictEqual(blocksRole.Properties.AssumeRolePolicyDocument.Statement[0], {
@@ -111,19 +128,27 @@ describe('shared execution role', () => {
             Principal: { Service: 'lambda.amazonaws.com' },
         });
         assert.ok(JSON.stringify(blocksRole.Properties.ManagedPolicyArns ?? []).includes('AWSLambdaBasicExecutionRole'), 'BlocksRole should attach AWSLambdaBasicExecutionRole');
+        // Core is BB-agnostic: with no Building Block that runs AS the shared role, the trust policy
+        // must NOT allow any compute principal beyond Lambda (e.g. bedrock-agentcore is added by the
+        // Agent BB's own construct, not here — see packages/bb-agent).
+        assert.ok(!JSON.stringify(blocksRole.Properties.AssumeRolePolicyDocument).includes('bedrock-agentcore'), 'core must not trust bedrock-agentcore by default (no agent → no AgentCore trust)');
         // The Blocks handler references the shared role, not an auto-generated one.
         template.hasResourceProperties('AWS::Lambda::Function', {
             Role: { 'Fn::GetAtt': [blocksRoleId, 'Arn'] },
         });
     });
+    test('exposes backendModulePath (props.backendCDKPath) for co-bundling BBs', async () => {
+        const app = new cdk.App();
+        const parent = new cdk.Stack(app, 'BackendPathStack');
+        const backend = await makeBackend(parent, 'Blocks', sideEffectBackendPath);
+        // Building Blocks that co-bundle the app backend at synth time (e.g. the Agent BB's AgentCore
+        // Runtime) discover it via globalThis.CURRENT_BLOCKS_STACK.backendModulePath.
+        assert.strictEqual(backend.backendModulePath, sideEffectBackendPath);
+    });
     test('a nested block resolves executionRole via the construct-tree walk', async () => {
         const app = new cdk.App();
         const parent = new cdk.Stack(app, 'RoleResolveStack');
-        const backend = await BlocksBackend.create(parent, 'Blocks', {
-            backendHandlerPath: handlerPath,
-            backendCDKPath: sideEffectBackendPath,
-            defaults: BlocksPresets.production,
-        });
+        const backend = await makeBackend(parent, 'Blocks', sideEffectBackendPath);
         // Build nested Scopes under the backend (outer → inner), the same shape a
         // real Building Block tree has, and grant a uniquely-named marker action to
         // `this.executionRole` from the innermost scope. If the getter's tree-walk
@@ -160,6 +185,7 @@ describe('CJS bundle: import.meta.url in the handler is shimmed (no Lambda-load
             backendHandlerPath: importMetaHandlerPath,
             backendCDKPath: sideEffectBackendPath,
             defaults: BlocksPresets.production,
+            defaultComputeFactory: stubComputeFactory,
         }));
     });
 });
@@ -167,11 +193,7 @@ describe('factory function support', () => {
     test('BlocksBackend.create() calls default export function with the backend instance', async () => {
         const app = new cdk.App();
         const stack = new cdk.Stack(app, 'FactoryTestStack');
-        const backend = await BlocksBackend.create(stack, 'FactoryStage', {
-            backendHandlerPath: handlerPath,
-            backendCDKPath: factoryBackendPath,
-            defaults: BlocksPresets.production,
-        });
+        const backend = await makeBackend(stack, 'FactoryStage', factoryBackendPath);
         const marker = backend.node.tryFindChild('FactoryMarker');
         assert.ok(marker, 'Factory function should have created FactoryMarker on the backend');
     });
@@ -180,11 +202,7 @@ describe('fullId is token-free (construct IDs / env-var keys)', () => {
     test('top-level stack: fullId is {stackName}-{id} and resolvable', async () => {
         const app = new cdk.App();
         const stack = new cdk.Stack(app, 'TopLevelStack');
-        const backend = await BlocksBackend.create(stack, 'blocks', {
-            backendHandlerPath: handlerPath,
-            backendCDKPath: sideEffectBackendPath,
-            defaults: BlocksPresets.production,
-        });
+        const backend = await makeBackend(stack, 'blocks', sideEffectBackendPath);
         assert.strictEqual(backend.fullId, 'TopLevelStack-blocks');
         assert.ok(!cdk.Token.isUnresolved(backend.fullId), 'fullId must not contain a token');
     });
@@ -198,11 +216,7 @@ describe('fullId is token-free (construct IDs / env-var keys)', () => {
         const nested = new cdk.NestedStack(parent, 'blocks');
         // Sanity: the nested stack's own name really is a token.
         assert.ok(cdk.Token.isUnresolved(nested.stackName), 'precondition: NestedStack.stackName should be an unresolved token');
-        const backend = await BlocksBackend.create(nested, 'blocks', {
-            backendHandlerPath: handlerPath,
-            backendCDKPath: sideEffectBackendPath,
-            defaults: BlocksPresets.production,
-        });
+        const backend = await makeBackend(nested, 'blocks', sideEffectBackendPath);
         assert.ok(!cdk.Token.isUnresolved(backend.fullId), `fullId must be token-free inside a nested stack, got: ${backend.fullId}`);
         // Falls back to the top-level (concrete) stack name, keeping uniqueness.
         assert.strictEqual(backend.fullId, 'ParentStack-blocks');
@@ -213,11 +227,7 @@ describe('fullId is token-free (construct IDs / env-var keys)', () => {
         const app = new cdk.App();
         const parent = new cdk.Stack(app, 'Gen2ParentStack');
         const nested = new cdk.NestedStack(parent, 'blocks');
-        const backend = await BlocksBackend.create(nested, 'blocks', {
-            backendHandlerPath: handlerPath,
-            backendCDKPath: fullIdConstructBackendPath,
-            defaults: BlocksPresets.production,
-        });
+        const backend = await makeBackend(nested, 'blocks', fullIdConstructBackendPath);
         // The construct ID is `${scope.fullId}Marker` → `ParentStack-blocks-blocks-dbMarker`.
         const expectedId = `${backend.fullId}-dbMarker`;
         assert.ok(nested.node.tryFindChild(expectedId), `expected a child construct with id "${expectedId}"`);
@@ -234,11 +244,7 @@ describe('fullId is token-free (construct IDs / env-var keys)', () => {
         const app = new cdk.App();
         const parent = new cdk.Stack(app, 'InvariantParent');
         const nested = new cdk.NestedStack(parent, 'blocks');
-        const backend = await BlocksBackend.create(nested, 'blocks', {
-            backendHandlerPath: handlerPath,
-            backendCDKPath: sideEffectBackendPath,
-            defaults: BlocksPresets.production,
-        });
+        const backend = await makeBackend(nested, 'blocks', sideEffectBackendPath);
         const template = Template.fromStack(nested);
         const fns = template.findResources('AWS::Lambda::Function');
         const envValues = Object.values(fns)
@@ -259,11 +265,13 @@ describe('infrastructure defaults (backend-anchored)', () => {
             backendHandlerPath: handlerPath,
             backendCDKPath: sideEffectBackendPath,
             defaults: BlocksPresets.production,
+            defaultComputeFactory: stubComputeFactory,
         });
         const b = await BlocksBackend.create(stack, 'B', {
             backendHandlerPath: handlerPath,
             backendCDKPath: sideEffectBackendPath,
             defaults: BlocksPresets.sandbox,
+            defaultComputeFactory: stubComputeFactory,
         });
         // Two backends in one stack must NOT clobber each other — defaults are
         // anchored on the backend, not the shared stack.
@@ -277,6 +285,7 @@ describe('infrastructure defaults (backend-anchored)', () => {
             backendHandlerPath: handlerPath,
             backendCDKPath: sideEffectBackendPath,
             defaults: BlocksPresets.sandbox,
+            defaultComputeFactory: stubComputeFactory,
         });
         // A Scope under the backend resolves scope.defaults by walking up to it.
         const outer = new Scope('outer');

package/dist/cdk/blocks-defaults.d.ts

@@ -1,4 +1,17 @@
 import { RemovalPolicy } from 'aws-cdk-lib';
+import { RetentionDays } from 'aws-cdk-lib/aws-logs';
+/**
+ * Request-rate limits applied to an API Gateway stage. On a REST API these are
+ * requests/second; on a WebSocket API the unit is messages/second across the
+ * connection. `rateLimit` is the steady-state ceiling and `burstLimit` the
+ * token-bucket size for short spikes.
+ */
+export interface BlocksThrottling {
+    /** Steady-state request (or WebSocket message) rate ceiling, per second. */
+    rateLimit: number;
+    /** Token-bucket burst size for short spikes above `rateLimit`. */
+    burstLimit: number;
+}
 /**
  * Default values for every Amazon-authored Building Block created within a
  * `BlocksStack` or `BlocksBackend`. A per-block option always overrides the
@@ -20,6 +33,62 @@ export interface BlocksDefaults {
      * well as the CLI, API, and AWS console — until it is turned off.
      */
     deletionProtection: boolean;
+    /**
+     * CORS origins the compute's API accepts, as regular-expression patterns
+     * matched against the request `Origin` header. Empty means no cross-origin
+     * requests are allowed. The `sandbox` preset allows localhost so a local dev
+     * frontend can reach a deployed API; `production` allows none by default.
+     */
+    allowedOrigins: string[];
+    /**
+     * Whether stateful resources that support continuous backups keep them on by
+     * default — e.g. DynamoDB Point-in-Time Recovery, letting you restore to any
+     * second in the retention window. On in `production`, off in `sandbox` (where
+     * throwaway data isn't worth the backup-storage cost). Blocks whose service
+     * has no equivalent simply ignore it.
+     *
+     * `true` enables backups with the service's default window; `false` disables
+     * them; `{ retentionDays: n }` enables them and pins the window (a block
+     * clamps/validates `n` to its service's supported range — DynamoDB PITR is
+     * 1–35 days). Backups only have a window when on, so the two are one field.
+     */
+    pointInTimeRecovery: boolean | {
+        retentionDays: number;
+    };
+    /**
+     * How long CloudWatch Logs keeps log events written by Blocks-managed log
+     * groups (the core handler Lambda, migration/GSI Lambdas, hosting compute,
+     * `bb-logger`, and API Gateway access logs) before expiring them. Without a
+     * retention set, AWS keeps log events forever, which grows cost unbounded —
+     * every Blocks-managed log group reads this default so retention is applied
+     * consistently.
+     */
+    logRetention: RetentionDays;
+    /**
+     * Request-rate limits applied to every Blocks-managed API Gateway stage: the
+     * core REST API, the SSR/hosting REST API, and the `bb-realtime` WebSocket
+     * stage. Protects the backend from runaway clients and caps blast radius.
+     * The sandbox preset caps tighter (200/400) than production (1000/2000) so a
+     * disposable stack is well-protected without throttling real production
+     * traffic. See {@link BlocksThrottling}.
+     */
+    throttling: BlocksThrottling;
+    /**
+     * Whether to emit structured JSON access logs from every Blocks-managed API
+     * Gateway stage to a dedicated CloudWatch log group (retention follows
+     * {@link logRetention}).
+     *
+     * **Off by default in both presets** — opt in with a per-stack override
+     * (`defaults: { ...BlocksPresets.production, accessLogging: true }`). It is
+     * off by default (rather than on for production) because enabling it
+     * provisions the account-level API Gateway CloudWatch Logs role, which is an
+     * account/region-level singleton: a second Blocks stack in the same
+     * account+region that also enables access logging can repoint that role on
+     * deploy or, on teardown, leave the survivor's access logging broken.
+     * Enabling it is therefore safe for **one Blocks stack per region** — see
+     * `ensureApiGatewayAccount` for the full multi-stack teardown caveat.
+     */
+    accessLogging: boolean;
 }
 /**
  * Prepared starting points for {@link BlocksDefaults}. Pick one and override
@@ -30,15 +99,36 @@ export interface BlocksDefaults {
  * ```
  */
 export declare const BlocksPresets: {
-    /** Disposable development stacks: tear down cleanly, no delete guard. */
+    /** Disposable development stacks: tear down cleanly, no delete guard, no backups. */
     sandbox: {
         removalPolicy: RemovalPolicy.DESTROY;
         deletionProtection: false;
+        allowedOrigins: string[];
+        pointInTimeRecovery: false;
+        logRetention: RetentionDays.ONE_WEEK;
+        throttling: {
+            rateLimit: number;
+            burstLimit: number;
+        };
+        accessLogging: false;
     };
-    /** Durable, protected posture for permanent deployments. */
+    /**
+     * Durable, protected posture for permanent deployments. A higher throttle
+     * ceiling (1000/2000) than sandbox so the default doesn't 429 real
+     * production traffic — raise it via a per-stack `throttling` override for
+     * higher-volume APIs.
+     */
     production: {
         removalPolicy: RemovalPolicy.RETAIN;
         deletionProtection: true;
+        allowedOrigins: never[];
+        pointInTimeRecovery: true;
+        logRetention: RetentionDays.ONE_YEAR;
+        throttling: {
+            rateLimit: number;
+            burstLimit: number;
+        };
+        accessLogging: false;
     };
 };
 //# sourceMappingURL=blocks-defaults.d.ts.map

package/dist/cdk/blocks-defaults.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"blocks-defaults.d.ts","sourceRoot":"","sources":["../../src/cdk/blocks-defaults.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC9B;;;;;OAKG;IACH,aAAa,EAAE,aAAa,CAAC;IAE7B;;;;OAIG;IACH,kBAAkB,EAAE,OAAO,CAAC;CAC5B;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa;IACzB,yEAAyE;;;;;IAKzE,4DAA4D;;;;;CAKnB,CAAC"}
+{"version":3,"file":"blocks-defaults.d.ts","sourceRoot":"","sources":["../../src/cdk/blocks-defaults.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAChC,4EAA4E;IAC5E,SAAS,EAAE,MAAM,CAAC;IAClB,kEAAkE;IAClE,UAAU,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC9B;;;;;OAKG;IACH,aAAa,EAAE,aAAa,CAAC;IAE7B;;;;OAIG;IACH,kBAAkB,EAAE,OAAO,CAAC;IAE5B;;;;;OAKG;IACH,cAAc,EAAE,MAAM,EAAE,CAAC;IAEzB;;;;;;;;;;;OAWG;IACH,mBAAmB,EAAE,OAAO,GAAG;QAAE,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;IAEzD;;;;;;;OAOG;IACH,YAAY,EAAE,aAAa,CAAC;IAE5B;;;;;;;OAOG;IACH,UAAU,EAAE,gBAAgB,CAAC;IAE7B;;;;;;;;;;;;;;OAcG;IACH,aAAa,EAAE,OAAO,CAAC;CACvB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa;IACzB,qFAAqF;;;;;;;;;;;;;IAUrF;;;;;OAKG;;;;;;;;;;;;;CAcsC,CAAC"}

package/dist/cdk/blocks-defaults.js

@@ -1,6 +1,7 @@
 // Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 import { RemovalPolicy } from 'aws-cdk-lib';
+import { RetentionDays } from 'aws-cdk-lib/aws-logs';
 /**
  * Prepared starting points for {@link BlocksDefaults}. Pick one and override
  * individual fields with a spread:
@@ -10,14 +11,33 @@ import { RemovalPolicy } from 'aws-cdk-lib';
  * ```
  */
 export const BlocksPresets = {
-    /** Disposable development stacks: tear down cleanly, no delete guard. */
+    /** Disposable development stacks: tear down cleanly, no delete guard, no backups. */
     sandbox: {
         removalPolicy: RemovalPolicy.DESTROY,
         deletionProtection: false,
+        allowedOrigins: ['^https?://(localhost|127\\.0\\.0\\.1)(:\\d+)?$'],
+        pointInTimeRecovery: false,
+        logRetention: RetentionDays.ONE_WEEK,
+        throttling: { rateLimit: 200, burstLimit: 400 },
+        accessLogging: false,
     },
-    /** Durable, protected posture for permanent deployments. */
+    /**
+     * Durable, protected posture for permanent deployments. A higher throttle
+     * ceiling (1000/2000) than sandbox so the default doesn't 429 real
+     * production traffic — raise it via a per-stack `throttling` override for
+     * higher-volume APIs.
+     */
     production: {
         removalPolicy: RemovalPolicy.RETAIN,
         deletionProtection: true,
+        allowedOrigins: [],
+        pointInTimeRecovery: true,
+        logRetention: RetentionDays.ONE_YEAR,
+        throttling: { rateLimit: 1000, burstLimit: 2000 },
+        // Off by default even in production: enabling access logging mutates the
+        // account/region-level API Gateway CloudWatch role (a singleton). Opt in
+        // per stack once you've confirmed a single Blocks stack owns it in the
+        // region — see the `accessLogging` field doc.
+        accessLogging: false,
     },
 };

package/dist/cdk/blocks-defaults.test.js

@@ -9,14 +9,33 @@
 import { test, describe } from 'node:test';
 import assert from 'node:assert';
 import { RemovalPolicy } from 'aws-cdk-lib';
+import { RetentionDays } from 'aws-cdk-lib/aws-logs';
 import { BlocksPresets } from './blocks-defaults.js';
 describe('BlocksPresets', () => {
-    test('sandbox is disposable: DESTROY + deletion protection off', () => {
+    test('sandbox is disposable: DESTROY + deletion protection off + no PITR', () => {
         assert.strictEqual(BlocksPresets.sandbox.removalPolicy, RemovalPolicy.DESTROY);
         assert.strictEqual(BlocksPresets.sandbox.deletionProtection, false);
+        assert.strictEqual(BlocksPresets.sandbox.pointInTimeRecovery, false);
     });
-    test('production is durable: RETAIN + deletion protection on', () => {
+    test('production is durable: RETAIN + deletion protection on + PITR on', () => {
         assert.strictEqual(BlocksPresets.production.removalPolicy, RemovalPolicy.RETAIN);
         assert.strictEqual(BlocksPresets.production.deletionProtection, true);
+        assert.strictEqual(BlocksPresets.production.pointInTimeRecovery, true);
+    });
+    test('sandbox keeps logs briefly', () => {
+        assert.strictEqual(BlocksPresets.sandbox.logRetention, RetentionDays.ONE_WEEK);
+    });
+    test('production keeps logs a year', () => {
+        assert.strictEqual(BlocksPresets.production.logRetention, RetentionDays.ONE_YEAR);
+    });
+    test('access logging is off by default in BOTH presets (opt-in; mutates an account singleton)', () => {
+        assert.strictEqual(BlocksPresets.sandbox.accessLogging, false);
+        assert.strictEqual(BlocksPresets.production.accessLogging, false);
+    });
+    test('sandbox caps tighter (200/400) than production (1000/2000)', () => {
+        assert.strictEqual(BlocksPresets.sandbox.throttling.rateLimit, 200);
+        assert.strictEqual(BlocksPresets.sandbox.throttling.burstLimit, 400);
+        assert.strictEqual(BlocksPresets.production.throttling.rateLimit, 1000);
+        assert.strictEqual(BlocksPresets.production.throttling.burstLimit, 2000);
     });
 });