@aws-blocks/core 0.2.0 → 0.4.0

package/dist/hosting.test.js

@@ -1,13 +1,15 @@
 // Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
-import { describe, it, beforeEach, afterEach } from 'node:test';
 import assert from 'node:assert';
 import * as fs from 'node:fs';
-import * as path from 'node:path';
 import * as os from 'node:os';
+import * as path from 'node:path';
+import { afterEach, beforeEach, describe, it } from 'node:test';
+import { config, secret } from '@aws-blocks/hosting';
+import { _setSynthExistsChecker } from '@aws-blocks/hosting/constructs';
 import * as cdk from 'aws-cdk-lib';
 import { App, Duration, Stack } from 'aws-cdk-lib';
-import { Template, Match } from 'aws-cdk-lib/assertions';
+import { Match, Template } from 'aws-cdk-lib/assertions';
 import { BLOCKS_RPC_PREFIX } from './constants.js';
 import { Hosting } from './hosting.js';
 import { clearRouteRegistry, registerRoute } from './raw-route.js';
@@ -84,6 +86,31 @@ describe('Hosting', () => {
         fs.rmSync(tmpDir, { recursive: true, force: true });
         clearRouteRegistry();
     });
+    // ── Deploy-time existence check (key change 4) ───────────────
+    describe('environment marker existence check (Hosting.create)', () => {
+        it('rejects at deploy when a declared environment secret has no value', async () => {
+            createSpaBuildOutput(tmpDir);
+            const app = new App();
+            const stack = new Stack(app, 'MissingEnvSecretStack');
+            // Stub the synth existence probe to report "not set" — rejects before any
+            // CDK construction, so this needs no assets and no AWS.
+            _setSynthExistsChecker(async () => {
+                const e = new Error('missing');
+                e.name = 'ResourceNotFoundException';
+                throw e;
+            });
+            try {
+                await assert.rejects(Hosting.create(stack, 'Hosting', {
+                    root: tmpDir,
+                    api: MOCK_API,
+                    environment: { MISSING_SECRET: secret('MISSING_SECRET') },
+                }), /MISSING_SECRET.*not set/s);
+            }
+            finally {
+                _setSynthExistsChecker(null);
+            }
+        });
+    });
     // ── SPA tests ────────────────────────────────────────────────
     describe('SPA mode', () => {
         it('creates S3 bucket and CloudFront distribution', () => {
@@ -345,6 +372,30 @@ describe('Hosting', () => {
             }
             assert.ok(foundRetain, 'At least one bucket should have Retain deletion policy');
         });
+        it('forwards buildRetentionDays to the hosting bucket lifecycle rule (#480)', () => {
+            createSpaBuildOutput(tmpDir);
+            const app = new App();
+            const stack = new Stack(app, 'RetentionStack');
+            new Hosting(stack, 'Hosting', {
+                root: tmpDir,
+                api: MOCK_API,
+                buildRetentionDays: 90,
+            });
+            const template = Template.fromStack(stack);
+            // Before the fix, core dropped buildRetentionDays (only retainOnDelete was
+            // forwarded), so this asserted 30. It must now reach the DeleteOldBuilds
+            // rule as 90.
+            template.hasResourceProperties('AWS::S3::Bucket', {
+                LifecycleConfiguration: Match.objectLike({
+                    Rules: Match.arrayWith([
+                        Match.objectLike({
+                            Id: 'DeleteOldBuilds',
+                            ExpirationInDays: 90,
+                        }),
+                    ]),
+                }),
+            });
+        });
     });
     // ── API integration tests ────────────────────────────────────
     describe('API integration', () => {
@@ -1092,8 +1143,7 @@ describe('Hosting', () => {
                 ...(basePath !== undefined ? { basePath } : {}),
             });
             const tpl = Template.fromStack(stack).toJSON();
-            const kvKeys = Object.entries(tpl.Resources).find(([id, r]) => r.Type === 'AWS::CloudFormation::CustomResource' &&
-                /RouteStoreKeys/.test(id));
+            const kvKeys = Object.entries(tpl.Resources).find(([id, r]) => r.Type === 'AWS::CloudFormation::CustomResource' && /RouteStoreKeys/.test(id));
             assert.ok(kvKeys, 'expected a RouteStoreKeys custom resource');
             const entries = JSON.parse(kvKeys[1].Properties.Entries);
             const meta = JSON.parse(entries.meta);
@@ -1134,6 +1184,131 @@ describe('Hosting', () => {
                 `found DependsOn=${JSON.stringify(dependsOn)}`);
         });
     });
+    // ── value() integration ─────────────────────────────────────────
+    //
+    // Runtime values: the store LOCATOR (never the value) is injected as a Lambda
+    // env var, and the role is granted read + kms:Decrypt. The store is derived from
+    // the marker's type — secret → Secrets Manager, config → SSM Parameter Store.
+    // Domain markers resolve at synth time via Hosting.create().
+    describe('secret() / config() integration', () => {
+        it('secret() → Secrets Manager: injects the locator (not the value) + grants read+decrypt', () => {
+            createNextjsBuildOutput(tmpDir);
+            const app = new App();
+            const stack = new Stack(app, 'SecretEnvStack');
+            new Hosting(stack, 'Hosting', {
+                root: tmpDir,
+                customAdapter: createNextjsFixtureAdapter(tmpDir),
+                api: MOCK_API,
+                environment: { STRIPE_KEY: secret('STRIPE_KEY') },
+            });
+            const template = Template.fromStack(stack);
+            // secret → Secrets Manager: slash-free locator under the Blocks /blocks/secrets namespace.
+            template.hasResourceProperties('AWS::Lambda::Function', {
+                Environment: {
+                    Variables: Match.objectLike({ HOSTING_SECRET_PARAM_STRIPE_KEY: 'blocks/secrets/STRIPE_KEY' }),
+                },
+            });
+            // The plaintext value must NOT appear anywhere in the template.
+            const json = JSON.stringify(template.toJSON());
+            assert.ok(!json.includes('STRIPE_KEY_VALUE'), 'no value should be in the template');
+            // The role has secretsmanager:GetSecretValue scoped to the secret + kms:Decrypt.
+            template.hasResourceProperties('AWS::IAM::Policy', {
+                PolicyDocument: {
+                    Statement: Match.arrayWith([
+                        Match.objectLike({ Action: 'secretsmanager:GetSecretValue' }),
+                        Match.objectLike({
+                            Action: 'kms:Decrypt',
+                            Condition: { StringEquals: Match.objectLike({ 'kms:ViaService': Match.anyValue() }) },
+                        }),
+                    ]),
+                },
+            });
+        });
+        it('threads secretStore { prefix, stage, cacheTtlSeconds } from core HostingProps to the wiring (B3)', () => {
+            createNextjsBuildOutput(tmpDir);
+            const app = new App();
+            const stack = new Stack(app, 'SecretStoreOverrideStack');
+            new Hosting(stack, 'Hosting', {
+                root: tmpDir,
+                customAdapter: createNextjsFixtureAdapter(tmpDir),
+                api: MOCK_API,
+                environment: { STRIPE_KEY: secret('STRIPE_KEY') },
+                // Custom prefix + stage + warm-cache TTL must all reach the leaf wiring.
+                secretStore: { prefix: '/myapp/secrets', stage: 'prod', cacheTtlSeconds: 30 },
+            });
+            const template = Template.fromStack(stack);
+            template.hasResourceProperties('AWS::Lambda::Function', {
+                Environment: {
+                    Variables: Match.objectLike({
+                        // custom prefix + stage (Secrets Manager → slash-free)
+                        HOSTING_SECRET_PARAM_STRIPE_KEY: 'myapp/secrets/prod/STRIPE_KEY',
+                        // shared fallback (no stage)
+                        HOSTING_SECRET_PARAM_STRIPE_KEY_FALLBACK: 'myapp/secrets/STRIPE_KEY',
+                        // warm-cache TTL for rotation without a cold start
+                        HOSTING_SECRET_CACHE_TTL: '30',
+                    }),
+                },
+            });
+        });
+        it('config() → SSM: HOSTING_CONFIG_PARAM_* (leading-slash) + ssm:GetParameter', () => {
+            createNextjsBuildOutput(tmpDir);
+            const app = new App();
+            const stack = new Stack(app, 'ConfigEnvStack');
+            new Hosting(stack, 'Hosting', {
+                root: tmpDir,
+                customAdapter: createNextjsFixtureAdapter(tmpDir),
+                api: MOCK_API,
+                environment: { FEATURE_FLAGS: config('FEATURE_FLAGS') },
+            });
+            const template = Template.fromStack(stack);
+            template.hasResourceProperties('AWS::Lambda::Function', {
+                Environment: {
+                    Variables: Match.objectLike({ HOSTING_CONFIG_PARAM_FEATURE_FLAGS: '/blocks/config/FEATURE_FLAGS' }),
+                },
+            });
+            template.hasResourceProperties('AWS::IAM::Policy', {
+                PolicyDocument: { Statement: Match.arrayWith([Match.objectLike({ Action: 'ssm:GetParameter' })]) },
+            });
+        });
+        it('does not inject a plaintext env var for a runtime value', () => {
+            createNextjsBuildOutput(tmpDir);
+            const app = new App();
+            const stack = new Stack(app, 'SecretNoPlaintextStack');
+            new Hosting(stack, 'Hosting', {
+                root: tmpDir,
+                customAdapter: createNextjsFixtureAdapter(tmpDir),
+                api: MOCK_API,
+                environment: { FLAG: 'on', STRIPE_KEY: secret('STRIPE_KEY') },
+            });
+            const template = Template.fromStack(stack);
+            const fns = template.findResources('AWS::Lambda::Function');
+            for (const fn of Object.values(fns)) {
+                const vars = (fn.Properties?.Environment?.Variables ?? {});
+                assert.strictEqual(vars.STRIPE_KEY, undefined, 'value key must not be a plaintext env var');
+            }
+        });
+        it('rejects a runtime value whose key mismatches the env var name', () => {
+            createNextjsBuildOutput(tmpDir);
+            const app = new App();
+            const stack = new Stack(app, 'SecretMismatchStack');
+            assert.throws(() => new Hosting(stack, 'Hosting', {
+                root: tmpDir,
+                customAdapter: createNextjsFixtureAdapter(tmpDir),
+                api: MOCK_API,
+                environment: { STRIPE_KEY: secret('OTHER') },
+            }), /must match the environment variable name/);
+        });
+        it('throws if a domain marker is used with the sync constructor', () => {
+            createSpaBuildOutput(tmpDir);
+            const app = new App();
+            const stack = new Stack(app, 'SecretDomainSyncStack');
+            assert.throws(() => new Hosting(stack, 'Hosting', {
+                root: tmpDir,
+                api: MOCK_API,
+                domain: { domainName: config('DOMAIN_PROD') },
+            }), /requires async resolution/);
+        });
+    });
     describe('config.json stale-placeholder guard (#173)', () => {
         // Helper: pull every BucketDeployment custom resource's Properties.
         const bucketDeployments = (stack) => {
@@ -1169,8 +1344,7 @@ describe('Hosting', () => {
                     directive.includes('s-maxage=31536000') &&
                     !excludes(p).includes('.blocks-sandbox/config.json'));
             });
-            assert.strictEqual(leaks.length, 0, 'no mutable-tier deployment may apply s-maxage=31536000 to ' +
-                '.blocks-sandbox/config.json');
+            assert.strictEqual(leaks.length, 0, 'no mutable-tier deployment may apply s-maxage=31536000 to ' + '.blocks-sandbox/config.json');
         });
         it('registers the placeholder as a no-cache path even for a static-only site (no api)', () => {
             // The placeholder is always written (step 5), so its no-cache
@@ -1201,9 +1375,7 @@ describe('Hosting', () => {
             // Assert via Template + Match so a CDK property rename fails loudly here
             // rather than silently skipping a structural-heuristic lookup.
             Template.fromStack(stack).hasResourceProperties('Custom::CDKBucketDeployment', Match.objectLike({
-                DistributionPaths: Match.arrayWith([
-                    Match.stringLikeRegexp('^/builds/.+/\\.blocks-sandbox/\\*$'),
-                ]),
+                DistributionPaths: Match.arrayWith([Match.stringLikeRegexp('^/builds/.+/\\.blocks-sandbox/\\*$')]),
             }));
         });
     });

package/dist/index.cdk.d.ts

@@ -1,14 +1,15 @@
-export { ApiNamespace, type BlocksContext, type ApiHandler } from './api.js';
-export { BLOCKS_RPC_PREFIX, BLOCKS_AUTH_PREFIX } from './constants.js';
-export { ApiError, isBlocksError, hasAuthError, DEFAULT_API_ERROR_NAME } from './errors.js';
-export { EventSourceMapping } from './lambda-handler.js';
+export { type ConfigValue, config, DEFAULT_CONFIG_PARAMETER_PREFIX, DEFAULT_SECRET_PARAMETER_PREFIX, isConfig, isManagedValue, isSecret, type ManagedValue, type SecretValue, secret, type ValueKind, } from '@aws-blocks/hosting';
+export { type ApiHandler, ApiNamespace, type BlocksContext } from './api.js';
+export { BlocksBackend, type BlocksBackendProps, type BlocksDefaults, BlocksPresets, BlocksStack, type BlocksThrottling, blocksNodejsBundling, type CoreBlocksBackendProps, type CoreBlocksStackProps, DEFAULT_NODE_RUNTIME, ensureApiGatewayAccount, finalizeConfigRegistry, getConfigLocation, registerConfig, SandboxDisableDeletionProtection, Scope, SHARED_HANDLER_TIMEOUT_SECONDS, synthGuard, } from './cdk/index.js';
+export { _resetConfigCache, getConfig, getConfigSync, loadConfigToProcessEnv, preloadConfig } from './common/config.js';
 export { BlocksStackProps } from './common/index.js';
-export { registerSdkIdentifiers, getSdkIdentifiers, getAllSdkIdentifiers, _resetSdkRegistry } from './common/sdk-registry.js';
-export { getConfig, getConfigSync, preloadConfig, loadConfigToProcessEnv, _resetConfigCache } from './common/config.js';
-export { BlocksStack, Scope, SandboxDisableDeletionProtection, BlocksBackend, registerConfig, finalizeConfigRegistry, synthGuard, DEFAULT_NODE_RUNTIME, blocksNodejsBundling, type BlocksBackendProps } from './cdk/index.js';
-export { type BlocksDefaults, BlocksPresets, } from './cdk/index.js';
-export { Hosting, type HostingProps, type BlocksStackApi, type FrameworkType, type ComputeConfig, type HostingDomainConfig, type HostingWafConfig, } from './hosting.js';
-export { RawRoute, RawRouteErrors, type RawRouteOptions, type HttpMethod, } from './raw-route.cdk.js';
-export { registerRoute, matchRoute, getRegisteredRoutes, clearRouteRegistry, lockRouteRegistry, unlockRouteRegistry, type RegisteredRoute, } from './raw-route.js';
-export { Pipeline, DeployStage, __PIPELINE_STAGE_SCOPE__, type DeployStageProps, type BranchConfig, type PipelineProps, type PipelineSourceConfig, type PipelineSynthConfig, type PipelineStageConfig, } from './pipeline/index.js';
+export { _resetSdkRegistry, getAllSdkIdentifiers, getSdkIdentifiers, registerSdkIdentifiers, } from './common/sdk-registry.js';
+export { BLOCKS_AUTH_PREFIX, BLOCKS_RPC_PREFIX } from './constants.js';
+export { ApiError, blocksError, DEFAULT_API_ERROR_NAME, hasAuthError, isBlocksError } from './errors.js';
+export { type BlocksStackApi, type ComputeConfig, type FrameworkType, Hosting, type HostingDomainConfig, type HostingProps, type HostingWafConfig, } from './hosting.js';
+export { EventSourceMapping } from './lambda-handler.js';
+export { __PIPELINE_STAGE_SCOPE__, type BranchConfig, DeployStage, type DeployStageProps, Pipeline, type PipelineProps, type PipelineSourceConfig, type PipelineStageConfig, type PipelineSynthConfig, } from './pipeline/index.js';
+export { type HttpMethod, RawRoute, RawRouteErrors, type RawRouteOptions, } from './raw-route.cdk.js';
+export { clearRouteRegistry, getRegisteredRoutes, lockRouteRegistry, matchRoute, type RegisteredRoute, registerRoute, unlockRouteRegistry, } from './raw-route.js';
+export { BLOCKS_CONFIG_PARAMETER_PREFIX, BLOCKS_SECRET_PARAMETER_PREFIX, blocksConfigParameterName, blocksSecretParameterName, } from './secret-naming.js';
 //# sourceMappingURL=index.cdk.d.ts.map

package/dist/index.cdk.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.cdk.d.ts","sourceRoot":"","sources":["../src/index.cdk.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,YAAY,EAAE,KAAK,aAAa,EAAE,KAAK,UAAU,EAAE,MAAM,UAAU,CAAC;AAC7E,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACvE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,YAAY,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAC5F,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC9H,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,aAAa,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACxH,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,gCAAgC,EAAE,aAAa,EAAE,cAAc,EAAE,sBAAsB,EAAE,UAAU,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,KAAK,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAC9N,OAAO,EACL,KAAK,cAAc,EACnB,aAAa,GACd,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,OAAO,EACP,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,GACtB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,QAAQ,EACR,cAAc,EACd,KAAK,eAAe,EACpB,KAAK,UAAU,GAChB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,aAAa,EACb,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,EACjB,mBAAmB,EACnB,KAAK,eAAe,GACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,QAAQ,EACR,WAAW,EACX,wBAAwB,EACxB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,GACzB,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.cdk.d.ts","sourceRoot":"","sources":["../src/index.cdk.ts"],"names":[],"mappings":"AAMA,OAAO,EACN,KAAK,WAAW,EAChB,MAAM,EACN,+BAA+B,EAC/B,+BAA+B,EAC/B,QAAQ,EACR,cAAc,EACd,QAAQ,EACR,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,MAAM,EACN,KAAK,SAAS,GACd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,KAAK,UAAU,EAAE,YAAY,EAAE,KAAK,aAAa,EAAE,MAAM,UAAU,CAAC;AAC7E,OAAO,EACN,aAAa,EACb,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,aAAa,EACb,WAAW,EACX,KAAK,gBAAgB,EACrB,oBAAoB,EACpB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,EACtB,iBAAiB,EACjB,cAAc,EACd,gCAAgC,EAChC,KAAK,EACL,8BAA8B,EAC9B,UAAU,GACV,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,aAAa,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxH,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EACN,iBAAiB,EACjB,oBAAoB,EACpB,iBAAiB,EACjB,sBAAsB,GACtB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACvE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,sBAAsB,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACzG,OAAO,EACN,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,OAAO,EACP,KAAK,mBAAmB,EACxB,KAAK,YAAY,EACjB,KAAK,gBAAgB,GACrB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EACN,wBAAwB,EACxB,KAAK,YAAY,EACjB,WAAW,EACX,KAAK,gBAAgB,EACrB,QAAQ,EACR,KAAK,aAAa,EAClB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,GACxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACN,KAAK,UAAU,EACf,QAAQ,EACR,cAAc,EACd,KAAK,eAAe,GACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACN,kBAAkB,EAClB,mBAAmB,EACnB,iBAAiB,EACjB,UAAU,EACV,KAAK,eAAe,EACpB,aAAa,EACb,mBAAmB,GACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACN,8BAA8B,EAC9B,8BAA8B,EAC9B,yBAAyB,EACzB,yBAAyB,GACzB,MAAM,oBAAoB,CAAC"}

package/dist/index.cdk.js

@@ -1,14 +1,18 @@
 // Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
+// Declare functions for infra (secret/config). The runtime getters
+// (getSecret/getConfig) are imported from '@aws-blocks/hosting' — core's own
+// getConfig (backend config loader, above) owns that name here.
+export { config, DEFAULT_CONFIG_PARAMETER_PREFIX, DEFAULT_SECRET_PARAMETER_PREFIX, isConfig, isManagedValue, isSecret, secret, } from '@aws-blocks/hosting';
 export { ApiNamespace } from './api.js';
-export { BLOCKS_RPC_PREFIX, BLOCKS_AUTH_PREFIX } from './constants.js';
-export { ApiError, isBlocksError, hasAuthError, DEFAULT_API_ERROR_NAME } from './errors.js';
-export { EventSourceMapping } from './lambda-handler.js';
-export { registerSdkIdentifiers, getSdkIdentifiers, getAllSdkIdentifiers, _resetSdkRegistry } from './common/sdk-registry.js';
-export { getConfig, getConfigSync, preloadConfig, loadConfigToProcessEnv, _resetConfigCache } from './common/config.js';
-export { BlocksStack, Scope, SandboxDisableDeletionProtection, BlocksBackend, registerConfig, finalizeConfigRegistry, synthGuard, DEFAULT_NODE_RUNTIME, blocksNodejsBundling } from './cdk/index.js';
-export { BlocksPresets, } from './cdk/index.js';
+export { BlocksBackend, BlocksPresets, BlocksStack, blocksNodejsBundling, DEFAULT_NODE_RUNTIME, ensureApiGatewayAccount, finalizeConfigRegistry, getConfigLocation, registerConfig, SandboxDisableDeletionProtection, Scope, SHARED_HANDLER_TIMEOUT_SECONDS, synthGuard, } from './cdk/index.js';
+export { _resetConfigCache, getConfig, getConfigSync, loadConfigToProcessEnv, preloadConfig } from './common/config.js';
+export { _resetSdkRegistry, getAllSdkIdentifiers, getSdkIdentifiers, registerSdkIdentifiers, } from './common/sdk-registry.js';
+export { BLOCKS_AUTH_PREFIX, BLOCKS_RPC_PREFIX } from './constants.js';
+export { ApiError, blocksError, DEFAULT_API_ERROR_NAME, hasAuthError, isBlocksError } from './errors.js';
 export { Hosting, } from './hosting.js';
+export { EventSourceMapping } from './lambda-handler.js';
+export { __PIPELINE_STAGE_SCOPE__, DeployStage, Pipeline, } from './pipeline/index.js';
 export { RawRoute, RawRouteErrors, } from './raw-route.cdk.js';
-export { registerRoute, matchRoute, getRegisteredRoutes, clearRouteRegistry, lockRouteRegistry, unlockRouteRegistry, } from './raw-route.js';
-export { Pipeline, DeployStage, __PIPELINE_STAGE_SCOPE__, } from './pipeline/index.js';
+export { clearRouteRegistry, getRegisteredRoutes, lockRouteRegistry, matchRoute, registerRoute, unlockRouteRegistry, } from './raw-route.js';
+export { BLOCKS_CONFIG_PARAMETER_PREFIX, BLOCKS_SECRET_PARAMETER_PREFIX, blocksConfigParameterName, blocksSecretParameterName, } from './secret-naming.js';

package/dist/index.d.ts

@@ -1,9 +1,10 @@
-export { ApiNamespace, type BlocksContext, type ApiHandler } from './api.js';
-export { BLOCKS_RPC_PREFIX, BLOCKS_AUTH_PREFIX } from './constants.js';
-export { ApiError, isBlocksError, hasAuthError, DEFAULT_API_ERROR_NAME } from './errors.js';
-export { Scope, type ScopeOptions, type ScopeParent, type BuildingBlockMeta } from './common/index.js';
-export { registerSdkIdentifiers, getSdkIdentifiers, getAllSdkIdentifiers, _resetSdkRegistry } from './common/sdk-registry.js';
-export { getConfig, getConfigSync, preloadConfig, loadConfigToProcessEnv, _resetConfigCache } from './common/config.js';
-export { registerRoute, matchRoute, getRegisteredRoutes, clearRouteRegistry, lockRouteRegistry, unlockRouteRegistry, RawRouteErrors, type RawRouteOptions, type HttpMethod, type RegisteredRoute, } from './raw-route.js';
+export { type ConfigValue, config, isConfig, isManagedValue, isSecret, type ManagedValue, type SecretValue, secret, type ValueKind, } from '@aws-blocks/hosting';
+export { type ApiHandler, ApiNamespace, type BlocksContext } from './api.js';
+export { _resetConfigCache, getConfig, getConfigSync, loadConfigToProcessEnv, preloadConfig } from './common/config.js';
+export { type BuildingBlockMeta, Scope, type ScopeOptions, type ScopeParent } from './common/index.js';
+export { _resetSdkRegistry, getAllSdkIdentifiers, getSdkIdentifiers, registerSdkIdentifiers, } from './common/sdk-registry.js';
+export { BLOCKS_AUTH_PREFIX, BLOCKS_RPC_PREFIX } from './constants.js';
+export { ApiError, blocksError, DEFAULT_API_ERROR_NAME, hasAuthError, isBlocksError } from './errors.js';
+export { clearRouteRegistry, getRegisteredRoutes, type HttpMethod, lockRouteRegistry, matchRoute, RawRouteErrors, type RawRouteOptions, type RegisteredRoute, registerRoute, unlockRouteRegistry, } from './raw-route.js';
 export { RawRoute } from './raw-route.mock.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,YAAY,EAAE,KAAK,aAAa,EAAE,KAAK,UAAU,EAAE,MAAM,UAAU,CAAC;AAC7E,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACvE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,YAAY,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAC5F,OAAO,EAAE,KAAK,EAAE,KAAK,YAAY,EAAE,KAAK,WAAW,EAAE,KAAK,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACvG,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC9H,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,aAAa,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACxH,OAAO,EACL,aAAa,EACb,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,EACjB,mBAAmB,EACnB,cAAc,EACd,KAAK,eAAe,EACpB,KAAK,UAAU,EACf,KAAK,eAAe,GACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAMA,OAAO,EACN,KAAK,WAAW,EAChB,MAAM,EACN,QAAQ,EACR,cAAc,EACd,QAAQ,EACR,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,MAAM,EACN,KAAK,SAAS,GACd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,KAAK,UAAU,EAAE,YAAY,EAAE,KAAK,aAAa,EAAE,MAAM,UAAU,CAAC;AAC7E,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,aAAa,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxH,OAAO,EAAE,KAAK,iBAAiB,EAAE,KAAK,EAAE,KAAK,YAAY,EAAE,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACvG,OAAO,EACN,iBAAiB,EACjB,oBAAoB,EACpB,iBAAiB,EACjB,sBAAsB,GACtB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACvE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,sBAAsB,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACzG,OAAO,EACN,kBAAkB,EAClB,mBAAmB,EACnB,KAAK,UAAU,EACf,iBAAiB,EACjB,UAAU,EACV,cAAc,EACd,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,aAAa,EACb,mBAAmB,GACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/index.js

@@ -1,10 +1,14 @@
 // Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
+// secret()/config() declare markers (CDK-free subpath). The runtime getters
+// getSecret()/getConfig() are imported from '@aws-blocks/hosting' directly —
+// core already exports a backend `getConfig` (config loader) under this name.
+export { config, isConfig, isManagedValue, isSecret, secret, } from '@aws-blocks/hosting';
 export { ApiNamespace } from './api.js';
-export { BLOCKS_RPC_PREFIX, BLOCKS_AUTH_PREFIX } from './constants.js';
-export { ApiError, isBlocksError, hasAuthError, DEFAULT_API_ERROR_NAME } from './errors.js';
+export { _resetConfigCache, getConfig, getConfigSync, loadConfigToProcessEnv, preloadConfig } from './common/config.js';
 export { Scope } from './common/index.js';
-export { registerSdkIdentifiers, getSdkIdentifiers, getAllSdkIdentifiers, _resetSdkRegistry } from './common/sdk-registry.js';
-export { getConfig, getConfigSync, preloadConfig, loadConfigToProcessEnv, _resetConfigCache } from './common/config.js';
-export { registerRoute, matchRoute, getRegisteredRoutes, clearRouteRegistry, lockRouteRegistry, unlockRouteRegistry, RawRouteErrors, } from './raw-route.js';
+export { _resetSdkRegistry, getAllSdkIdentifiers, getSdkIdentifiers, registerSdkIdentifiers, } from './common/sdk-registry.js';
+export { BLOCKS_AUTH_PREFIX, BLOCKS_RPC_PREFIX } from './constants.js';
+export { ApiError, blocksError, DEFAULT_API_ERROR_NAME, hasAuthError, isBlocksError } from './errors.js';
+export { clearRouteRegistry, getRegisteredRoutes, lockRouteRegistry, matchRoute, RawRouteErrors, registerRoute, unlockRouteRegistry, } from './raw-route.js';
 export { RawRoute } from './raw-route.mock.js';

package/dist/lambda-handler.d.ts

@@ -128,4 +128,21 @@ export interface LambdaContext {
  * @param backendFactory - Async function returning the backend module (typically `() => import('./index.js')`)
  */
 export declare function createLambdaHandler(backendFactory: () => Promise<any>): (event: any, context?: LambdaContext) => Promise<any>;
+/**
+ * Thrown by `initialize()` when the app has config coordinates
+ * (BLOCKS_CONFIG_BUCKET/KEY) but the S3 config load resolved empty because
+ * blocks-config.json wasn't readable yet — the transient window right after a
+ * deploy, before the BucketDeployment settles.
+ *
+ * It flows through the `createLambdaHandler()` init catch, which resets
+ * `initPromise` so the NEXT request re-runs `initialize()` and picks up the
+ * now-present config (config.ts does not cache a not-found result, so the retry
+ * re-fetches). A distinct type keeps the recovery path greppable and testable
+ * and separates it from real init failures, which surface with their own error.
+ *
+ * @internal Exported for testing only.
+ */
+export declare class TransientConfigError extends Error {
+    constructor();
+}
 //# sourceMappingURL=lambda-handler.d.ts.map

package/dist/lambda-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lambda-handler.d.ts","sourceRoot":"","sources":["../src/lambda-handler.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAerD,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAElE;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,2BAAkC,CAAC;AAG9D;;;GAGG;AACH,eAAO,MAAM,kBAAkB;;CAErB,CAAC;AAqCX;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAWlF;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,GAAG,GAAG,GAAG,CAwD7C;AAiBD;;;;;;;GAOG;AACH,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,WAAW,GAAG,SAAS,GAAG,QAAQ,CAAC;AAErE;;;;;;;;;;;;;GAaG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,GAAG,GAAG,UAAU,CAWpD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,GAAG,GAAG,OAAO,CAEzD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,CAAC,EAAE,aAAa,GAAG,MAAM,CAIrE;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,wBAAwB,IAAI,MAAM,CAAC;CACpC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,mBAAmB,CAAC,cAAc,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC,IA0BtD,OAAO,GAAG,EAAE,UAAU,aAAa,kBAiElD"}
+{"version":3,"file":"lambda-handler.d.ts","sourceRoot":"","sources":["../src/lambda-handler.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAerD,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAElE;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,2BAAkC,CAAC;AAG9D;;;GAGG;AACH,eAAO,MAAM,kBAAkB;;CAErB,CAAC;AAqCX;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAWlF;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,GAAG,GAAG,GAAG,CAwD7C;AAiBD;;;;;;;GAOG;AACH,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,WAAW,GAAG,SAAS,GAAG,QAAQ,CAAC;AAErE;;;;;;;;;;;;;GAaG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,GAAG,GAAG,UAAU,CAWpD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,GAAG,GAAG,OAAO,CAEzD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,CAAC,EAAE,aAAa,GAAG,MAAM,CAIrE;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,wBAAwB,IAAI,MAAM,CAAC;CACpC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,mBAAmB,CAAC,cAAc,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC,IA8CtD,OAAO,GAAG,EAAE,UAAU,aAAa,kBA4ElD;AASD;;;;;;;;;;;;;GAaG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;;CAK9C"}

package/dist/lambda-handler.js

@@ -6,7 +6,7 @@ import { ApiError } from './errors.js';
 import { BLOCKS_RPC_PREFIX } from './constants.js';
 import { matchRoute, lockRouteRegistry } from './raw-route.js';
 import { registerBuiltinRoutes } from './builtin-routes.js';
-import { loadConfigToProcessEnv } from './common/config.js';
+import { loadConfigToProcessEnv, isConfigResolved } from './common/config.js';
 import { parseRpcRequest, successResponse, errorResponse, errorResponseFromCatch, methodNotFoundResponse, } from './rpc.js';
 import { getCorsPatterns, isOriginAllowed, corsRejection, buildCorsHeaders, CORS_MAX_AGE } from './cors.js';
 export { parseCorsPatterns, _resetCorsPatterns } from './cors.js';
@@ -257,6 +257,25 @@ export function createLambdaHandler(backendFactory) {
     let initPromise = null;
     async function initialize() {
         await loadConfigToProcessEnv();
+        // If the app has config coordinates (BLOCKS_CONFIG_BUCKET/KEY set) but the
+        // load didn't actually resolve the config, we're in the transient post-deploy
+        // S3 window where blocks-config.json isn't readable yet. loadConfigFromS3()
+        // deliberately does NOT cache that empty result, so throw a typed transient
+        // error here — BEFORE importing the backend — so the createLambdaHandler()
+        // catch resets initPromise and the next request re-runs initialize(), which
+        // re-fetches from S3 and picks up the now-present config. Without this throw,
+        // initialize() would succeed with empty config, `handler` would be assigned,
+        // and the `if (!handler)` guard below would never fire again, poisoning the
+        // container for its whole life (it would import the backend against empty
+        // process.env and serve "not configured" 500s forever).
+        //
+        // A genuinely config-less app does NOT throw: the no-bucket local-dev path
+        // and a real empty `{}` config both cache their result, so isConfigResolved()
+        // is true and the retry never spins. Once the blob is readable the successful
+        // load caches, so there is no unbounded per-request S3 re-fetch either.
+        if (process.env.BLOCKS_CONFIG_BUCKET && process.env.BLOCKS_CONFIG_KEY && !isConfigResolved()) {
+            throw new TransientConfigError();
+        }
         // Merge hosting-provided CORS origins into the main env var so the lazy
         // getCorsPatterns() sees a combined value on first access.
         // loadConfigToProcessEnv() won't override CORS_ALLOWED_ORIGINS if it's
@@ -276,8 +295,18 @@ export function createLambdaHandler(backendFactory) {
     }
     return async (event, context) => {
         if (!handler) {
-            if (!initPromise)
-                initPromise = initialize();
+            // Retry init on failure instead of caching the rejection. If initialize() throws (most often
+            // because loadConfigToProcessEnv() couldn't read blocks-config.json during the brief
+            // post-deploy window before it's readable), a memoized rejected promise would poison this
+            // container for its whole lifetime — every later request re-awaits the same rejection and 500s.
+            // Resetting initPromise lets the next invocation re-run initialize() (config.ts re-fetches,
+            // since it doesn't cache failures), so the handler self-heals once config is available.
+            if (!initPromise) {
+                initPromise = initialize().catch((err) => {
+                    initPromise = null;
+                    throw err;
+                });
+            }
             await initPromise;
         }
         // Only apply the HTTP timeout guard to API Gateway requests; async event
@@ -344,6 +373,26 @@ class HandlerTimeoutError extends Error {
         this.name = 'HandlerTimeoutError';
     }
 }
+/**
+ * Thrown by `initialize()` when the app has config coordinates
+ * (BLOCKS_CONFIG_BUCKET/KEY) but the S3 config load resolved empty because
+ * blocks-config.json wasn't readable yet — the transient window right after a
+ * deploy, before the BucketDeployment settles.
+ *
+ * It flows through the `createLambdaHandler()` init catch, which resets
+ * `initPromise` so the NEXT request re-runs `initialize()` and picks up the
+ * now-present config (config.ts does not cache a not-found result, so the retry
+ * re-fetches). A distinct type keeps the recovery path greppable and testable
+ * and separates it from real init failures, which surface with their own error.
+ *
+ * @internal Exported for testing only.
+ */
+export class TransientConfigError extends Error {
+    constructor() {
+        super('[Blocks] Config not readable yet (transient post-deploy S3 window); will retry on next request');
+        this.name = 'TransientConfigError';
+    }
+}
 /**
  * Extract the request path from a Lambda event, normalizing between
  * API Gateway v1 (REST) and v2 (HTTP API) event shapes.