@aws-blocks/core 0.3.0 → 0.4.0

package/README.md

@@ -313,6 +313,19 @@ new Hosting(stack, 'Web', {
 
 The `framework` option selects the frontend type: `'spa' | 'static' | 'nextjs'`. When omitted, the framework is auto-detected by reading your app's OWN `package.json` (not `node_modules`): a `next` dependency → `nextjs`; otherwise `spa`; and `static` when there is no `package.json`. Set `framework: 'spa'` explicitly to override auto-detection — e.g. when a stray `next` dependency would otherwise trigger an unwanted Next.js/OpenNext build. Full reference lives in the source JSDoc.
 
+Old builds are retained for rollback and expired by an S3 lifecycle rule after `buildRetentionDays` (default **30**). The build currently being served is never expired regardless of deploy cadence — only superseded builds are cleaned up. Only builds superseded by a normal `Update` cutover are auto-tagged (and thus auto-expired): pre-existing/orphaned builds and aborted or rolled-back deploys are never tagged and need manual cleanup (e.g. an S3 inventory / Batch Operations sweep). Raise the window with `buildRetentionDays` (it must be ≥ `skewProtection.maxAge` in days):
+
+```typescript
+new Hosting(stack, 'Web', {
+  root: join(__dirname, '..'),
+  api: blocksStack,
+  buildRetentionDays: 90,
+});
+```
+
+Core's top-level `buildRetentionDays` maps to the L3 construct's `storage.buildRetentionDays`.
+
+
 ## Building Blocks
 
 Import Building Blocks from their specific packages (or from the `@aws-blocks/blocks` umbrella):

package/dist/api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,aAAa,GAAG;IAC1B,OAAO,EAAE;QACP,OAAO,EAAE,OAAO,CAAC;QACjB,IAAI,EAAE,cAAc,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC;QACxC,IAAI,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5B;;;;;;;;;;WAUG;QACH,GAAG,EAAE,GAAG,CAAC;QACT;;;;;WAKG;QACH,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC/B;;;;;;;;;WASG;QACH,MAAM,CAAC,EAAE,WAAW,CAAC;KACtB,CAAC;IACF,QAAQ,EAAE;QACR,OAAO,EAAE,OAAO,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,CAAC,IAAI,EAAE,GAAG,KAAK,IAAI,CAAC;KAC3B,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,UAAU,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,KAAK,CAAC,CAAC;AAG1G,KAAK,QAAQ,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAC,IAAI;KAChE,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,MAAM,IAAI,KAAK,MAAM,CAAC,GACzD,CAAC,GAAG,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GACtC,KAAK;CACV,CAAC;AAEF,yEAAyE;AACzE,eAAO,MAAM,oBAAoB,eAAoC,CAAC;AAEtE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0FG;AACH,MAAM,WAAW,uBAAuB;IACtC,KAAK,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;CAChI;AAED,eAAO,MAAM,YAAY,EAAE,uBAKnB,CAAC"}
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,aAAa,GAAG;IAC1B,OAAO,EAAE;QACP,OAAO,EAAE,OAAO,CAAC;QACjB,IAAI,EAAE,cAAc,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC;QACxC,IAAI,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5B;;;;;;;;;;WAUG;QACH,GAAG,EAAE,GAAG,CAAC;QACT;;;;;WAKG;QACH,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC/B;;;;;;;;;WASG;QACH,MAAM,CAAC,EAAE,WAAW,CAAC;KACtB,CAAC;IACF,QAAQ,EAAE;QACR,OAAO,EAAE,OAAO,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,CAAC,IAAI,EAAE,GAAG,KAAK,IAAI,CAAC;KAC3B,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,UAAU,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,KAAK,CAAC,CAAC;AAG1G,KAAK,QAAQ,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAC,IAAI;KAChE,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,MAAM,IAAI,KAAK,MAAM,CAAC,GACzD,CAAC,GAAG,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GACtC,KAAK;CACV,CAAC;AAEF,yEAAyE;AACzE,eAAO,MAAM,oBAAoB,eAAoC,CAAC;AAEtE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAsCrD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0FG;AACH,MAAM,WAAW,uBAAuB;IACtC,KAAK,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;CAChI;AAED,eAAO,MAAM,YAAY,EAAE,uBAQnB,CAAC"}

package/dist/api.js

@@ -2,9 +2,41 @@
 // SPDX-License-Identifier: Apache-2.0
 /** Marker symbol to identify ApiNamespace instances during discovery. */
 export const API_NAMESPACE_MARKER = Symbol.for('blocks:ApiNamespace');
+/**
+ * Record this namespace on its resolved compute so request routing can later
+ * map a namespace to the compute that hosts it.
+ *
+ * CDK-synth concern only: in the CDK bundle `scope.compute` resolves to the
+ * namespace's compute (the stack default today), and we append the name to its
+ * `namespaces` list. In the mock/runtime bundles — or a scopeless test — the
+ * property is absent, so `scope.compute` is `undefined` and this is a silent
+ * no-op. The public `ApiNamespace` signature is unchanged; this is a purely
+ * internal side effect.
+ *
+ * No `try/catch`: `BlocksBackend.create()` initializes the default compute
+ * before it imports the backend module that constructs any `ApiNamespace`, so
+ * the `compute` getter always resolves at this call site. If it ever threw
+ * here it would signal a genuine lifecycle violation (an `ApiNamespace` built
+ * before `create()` resolved), which should surface rather than be swallowed.
+ */
+function recordNamespaceOnCompute(scope, name) {
+    // An API created without a Scope stays unrecorded and routes to the
+    // default compute.
+    if (!scope || typeof scope !== 'object')
+        return;
+    const compute = scope.compute;
+    // Guard against duplicates so `namespaces` stays a set of names: a namespace
+    // could otherwise be recorded twice (e.g. a re-imported module during synth).
+    if (compute && Array.isArray(compute.namespaces) && !compute.namespaces.includes(name)) {
+        compute.namespaces.push(name);
+    }
+}
 export const ApiNamespace = class ApiNamespace {
     constructor(scope, name, handler) {
         handler[API_NAMESPACE_MARKER] = name;
+        // Record the namespace → compute association for per-compute routing.
+        // No-op outside CDK synth. Signature and returned handler are unchanged.
+        recordNamespaceOnCompute(scope, name);
         return handler;
     }
 };

package/dist/api.test.js

@@ -17,3 +17,25 @@ test('Different ApiNamespace names should not collide', () => {
     assert.strictEqual(api1[API_NAMESPACE_MARKER], 'api1');
     assert.strictEqual(api2[API_NAMESPACE_MARKER], 'api2');
 });
+// ApiNamespace records its name on the scope's resolved compute (CDK
+// synth), while staying a silent no-op where no compute is resolvable.
+test('ApiNamespace records its name on a resolvable compute', () => {
+    const compute = { namespaces: [] };
+    new ApiNamespace({ id: 'app', compute }, 'myapi', () => ({ ping: () => 'ok' }));
+    assert.deepStrictEqual(compute.namespaces, ['myapi']);
+});
+test('ApiNamespace is a no-op recorder when the scope has no compute', () => {
+    // The common Scope (mock/runtime) has no `compute`; recording must not throw
+    // and the handler is still tagged and returned unchanged.
+    const handler = new ApiNamespace(new Scope('no-compute'), 'plainapi', () => ({ x: () => 1 }));
+    assert.strictEqual(handler[API_NAMESPACE_MARKER], 'plainapi');
+});
+test('ApiNamespace records a namespace at most once per compute', () => {
+    // `namespaces` is a set of names: recording the same name twice (e.g. a
+    // re-imported module during synth) must not append a duplicate.
+    const compute = { namespaces: [] };
+    const scopeLike = { id: 'app', compute };
+    new ApiNamespace(scopeLike, 'dup', () => ({ ping: () => 'ok' }));
+    new ApiNamespace(scopeLike, 'dup', () => ({ ping: () => 'ok' }));
+    assert.deepStrictEqual(compute.namespaces, ['dup']);
+});

package/dist/bb-utils.d.ts

@@ -8,4 +8,5 @@ export { getMockDataDir } from './common/mock-data.js';
 export { API_NAMESPACE_MARKER } from './api.js';
 export { EventSourceMapping } from './lambda-handler.js';
 export { constantTimeEquals } from './common/crypto.js';
+export { sanitizeConfigKey } from './common/config.js';
 //# sourceMappingURL=bb-utils.d.ts.map

package/dist/bb-utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bb-utils.d.ts","sourceRoot":"","sources":["../src/bb-utils.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"bb-utils.d.ts","sourceRoot":"","sources":["../src/bb-utils.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAGxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/bb-utils.js

@@ -10,3 +10,6 @@ export { getMockDataDir } from './common/mock-data.js';
 export { API_NAMESPACE_MARKER } from './api.js';
 export { EventSourceMapping } from './lambda-handler.js';
 export { constantTimeEquals } from './common/crypto.js';
+// Defined in the config module (it owns the config-key contract), re-exported
+// here so BB authors get it alongside the other BB utilities.
+export { sanitizeConfigKey } from './common/config.js';

package/dist/cdk/apigateway-account.d.ts

@@ -0,0 +1,33 @@
+import type * as cdk from 'aws-cdk-lib';
+import { CfnAccount } from 'aws-cdk-lib/aws-apigateway';
+/**
+ * Ensure the account-level API Gateway CloudWatch Logs role exists on `stack`,
+ * creating it at most once per stack.
+ *
+ * API Gateway access logging — for both REST (v1) and WebSocket (v2) stages —
+ * requires an `AWS::ApiGateway::Account` whose `cloudWatchRoleArn` points at a
+ * role trusted by `apigateway.amazonaws.com` and carrying
+ * `AmazonAPIGatewayPushToCloudWatchLogs`. Nothing else in a Blocks stack
+ * provisions it, so a clean-account first deploy of any access-logging stage
+ * otherwise fails at CreateStage with "CloudWatch Logs role ARN must be set in
+ * account settings to enable logging".
+ *
+ * Callers should add their stage's dependency on the returned account so the
+ * account setting is applied before the stage is created.
+ *
+ * ⚠️ Single-Blocks-stack-per-region assumption. `AWS::ApiGateway::Account` is an
+ * account/region-level singleton (one effective `cloudWatchRoleArn` per region),
+ * but this provisions one per Blocks stack. If two Blocks stacks in the same
+ * account+region both enable access logging:
+ *   - on deploy, the later stack's role wins (overwrites the account setting); and
+ *   - on teardown of that later stack, its role is deleted and the account
+ *     setting is left pointing at a now-deleted role — silently breaking access
+ *     logging (or blocking `CreateStage`) for the surviving stack until it
+ *     redeploys.
+ * Enabling `accessLogging` is therefore safe for one Blocks stack per region.
+ * Multi-stack support (a shared/imported account) is deferred; if you run
+ * multiple Blocks stacks per region, manage the account role out-of-band and
+ * leave `accessLogging` to a single owner.
+ */
+export declare function ensureApiGatewayAccount(stack: cdk.Stack): CfnAccount;
+//# sourceMappingURL=apigateway-account.d.ts.map

package/dist/cdk/apigateway-account.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apigateway-account.d.ts","sourceRoot":"","sources":["../../src/cdk/apigateway-account.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,KAAK,GAAG,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAaxD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,GAAG,UAAU,CAmBpE"}

package/dist/cdk/apigateway-account.js

@@ -0,0 +1,60 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+import { CfnAccount } from 'aws-cdk-lib/aws-apigateway';
+import { ManagedPolicy, Role, ServicePrincipal } from 'aws-cdk-lib/aws-iam';
+/**
+ * Global registry key for the per-stack API Gateway CloudWatch Logs account
+ * resource. Deliberately a `Symbol.for(...)` string key so the SAME symbol is
+ * shared across packages (core, hosting) — each package can carry its own copy
+ * of {@link ensureApiGatewayAccount} yet still find and reuse the one account a
+ * sibling package already created on the stack, instead of emitting a second
+ * `AWS::ApiGateway::Account` (which is account/region-level and would clash).
+ */
+const ACCOUNT_KEY = Symbol.for('BLOCKS_APIGATEWAY_ACCOUNT');
+/**
+ * Ensure the account-level API Gateway CloudWatch Logs role exists on `stack`,
+ * creating it at most once per stack.
+ *
+ * API Gateway access logging — for both REST (v1) and WebSocket (v2) stages —
+ * requires an `AWS::ApiGateway::Account` whose `cloudWatchRoleArn` points at a
+ * role trusted by `apigateway.amazonaws.com` and carrying
+ * `AmazonAPIGatewayPushToCloudWatchLogs`. Nothing else in a Blocks stack
+ * provisions it, so a clean-account first deploy of any access-logging stage
+ * otherwise fails at CreateStage with "CloudWatch Logs role ARN must be set in
+ * account settings to enable logging".
+ *
+ * Callers should add their stage's dependency on the returned account so the
+ * account setting is applied before the stage is created.
+ *
+ * ⚠️ Single-Blocks-stack-per-region assumption. `AWS::ApiGateway::Account` is an
+ * account/region-level singleton (one effective `cloudWatchRoleArn` per region),
+ * but this provisions one per Blocks stack. If two Blocks stacks in the same
+ * account+region both enable access logging:
+ *   - on deploy, the later stack's role wins (overwrites the account setting); and
+ *   - on teardown of that later stack, its role is deleted and the account
+ *     setting is left pointing at a now-deleted role — silently breaking access
+ *     logging (or blocking `CreateStage`) for the surviving stack until it
+ *     redeploys.
+ * Enabling `accessLogging` is therefore safe for one Blocks stack per region.
+ * Multi-stack support (a shared/imported account) is deferred; if you run
+ * multiple Blocks stacks per region, manage the account role out-of-band and
+ * leave `accessLogging` to a single owner.
+ */
+export function ensureApiGatewayAccount(stack) {
+    const existing = stack[ACCOUNT_KEY];
+    if (existing)
+        return existing;
+    const role = new Role(stack, 'BlocksApiGatewayCloudWatchRole', {
+        assumedBy: new ServicePrincipal('apigateway.amazonaws.com'),
+        managedPolicies: [
+            ManagedPolicy.fromAwsManagedPolicyName('service-role/AmazonAPIGatewayPushToCloudWatchLogs'),
+        ],
+    });
+    // `cloudWatchRoleArn: role.roleArn` already gives CDK an implicit dependency
+    // on the role, so no explicit node.addDependency is needed.
+    const account = new CfnAccount(stack, 'BlocksApiGatewayAccount', {
+        cloudWatchRoleArn: role.roleArn,
+    });
+    stack[ACCOUNT_KEY] = account;
+    return account;
+}

package/dist/cdk/blocks-backend.d.ts

@@ -70,6 +70,12 @@ export declare function setupBlocksInfra(scope: Construct, props: BlocksBackendP
  */
 export declare class BlocksBackend extends Construct {
     readonly backendHandlerPath: string;
+    /**
+     * Path to the app's backend module (`props.backendCDKPath`). Exposed so Building Blocks that
+     * co-bundle the backend at synth (e.g. the Agent BB's AgentCore Runtime) can discover it via
+     * `globalThis.CURRENT_BLOCKS_STACK.backendModulePath`.
+     */
+    readonly backendModulePath: string;
     /** Shared IAM role assumed by all Blocks compute. Building Blocks grant to this role. */
     readonly executionRole: iam.IRole;
     /** Infrastructure defaults for Building Blocks created under this backend. */
@@ -82,6 +88,8 @@ export declare class BlocksBackend extends Construct {
     get gateway(): apigateway.RestApi;
     /** The default compute's RPC endpoint URL. To be removed once consumers move to the multi-compute model. */
     get apiUrl(): string;
+    /** The default compute's handler CloudWatch log group. `bb-logger` reconfigures its retention. */
+    get handlerLogGroup(): cdk.aws_logs.ILogGroup;
     private requireDefaultCompute;
     /**
      * The fullId used by child Scopes to compute their env var names,

package/dist/cdk/blocks-backend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"blocks-backend.d.ts","sourceRoot":"","sources":["../../src/cdk/blocks-backend.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,GAAG,MAAM,aAAa,CAAC;AACnC,OAAO,KAAK,KAAK,UAAU,MAAM,4BAA4B,CAAC;AAC9D,OAAO,KAAK,GAAG,MAAM,qBAAqB,CAAC;AAE3C,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAIvC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,KAAK,EAAE,qBAAqB,EAAuB,MAAM,sCAAsC,CAAC;AAEvG;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,IAAI,IAAI,CAkB/C;AAED;;;;GAIG;AACH,eAAO,MAAM,8BAA8B,QAAU,CAAC;AAEtD,MAAM,WAAW,kBAAkB;IACjC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,cAAc,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,QAAQ,EAAE,cAAc,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,sBAAuB,SAAQ,kBAAkB;IAChE,8EAA8E;IAC9E,qBAAqB,EAAE,qBAAqB,CAAC;CAC9C;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,CAAC,EAAE,MAAM;;EAwFxF;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,aAAc,SAAQ,SAAS;IAC1C,SAAgB,kBAAkB,EAAE,MAAM,CAAC;IAC3C,yFAAyF;IACzF,SAAgB,aAAa,EAAE,GAAG,CAAC,KAAK,CAAC;IACzC,8EAA8E;IAC9E,SAAgB,QAAQ,EAAE,cAAc,CAAC;IACzC,iGAAiG;IACjG,eAAe,CAAC,EAAE,OAAO,CAAC;IAE1B,2GAA2G;IAC3G,IAAI,OAAO,IAAI,GAAG,CAAC,iBAAiB,CAAC,cAAc,CAElD;IACD,gHAAgH;IAChH,IAAI,OAAO,IAAI,UAAU,CAAC,OAAO,CAEhC;IACD,4GAA4G;IAC5G,IAAI,MAAM,IAAI,MAAM,CAEnB;IAED,OAAO,CAAC,qBAAqB;IAO7B;;;;;;;;;;;;;;;;;;OAkBG;IACH,IAAI,MAAM,IAAI,MAAM,CAUnB;IAED,OAAO;WAmBM,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,sBAAsB;CA6BhF"}
+{"version":3,"file":"blocks-backend.d.ts","sourceRoot":"","sources":["../../src/cdk/blocks-backend.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,GAAG,MAAM,aAAa,CAAC;AACnC,OAAO,KAAK,KAAK,UAAU,MAAM,4BAA4B,CAAC;AAC9D,OAAO,KAAK,GAAG,MAAM,qBAAqB,CAAC;AAE3C,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAIvC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAEpD,OAAO,KAAK,EAAE,qBAAqB,EAAuB,MAAM,sCAAsC,CAAC;AAEvG;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,IAAI,IAAI,CAkB/C;AAED;;;;GAIG;AACH,eAAO,MAAM,8BAA8B,QAAU,CAAC;AAEtD,MAAM,WAAW,kBAAkB;IACjC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,cAAc,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,QAAQ,EAAE,cAAc,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,sBAAuB,SAAQ,kBAAkB;IAChE,8EAA8E;IAC9E,qBAAqB,EAAE,qBAAqB,CAAC;CAC9C;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,CAAC,EAAE,MAAM;;EAyFxF;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,aAAc,SAAQ,SAAS;IAC1C,SAAgB,kBAAkB,EAAE,MAAM,CAAC;IAC3C;;;;OAIG;IACH,SAAgB,iBAAiB,EAAE,MAAM,CAAC;IAC1C,yFAAyF;IACzF,SAAgB,aAAa,EAAE,GAAG,CAAC,KAAK,CAAC;IACzC,8EAA8E;IAC9E,SAAgB,QAAQ,EAAE,cAAc,CAAC;IACzC,iGAAiG;IACjG,eAAe,CAAC,EAAE,OAAO,CAAC;IAE1B,2GAA2G;IAC3G,IAAI,OAAO,IAAI,GAAG,CAAC,iBAAiB,CAAC,cAAc,CAElD;IACD,gHAAgH;IAChH,IAAI,OAAO,IAAI,UAAU,CAAC,OAAO,CAEhC;IACD,4GAA4G;IAC5G,IAAI,MAAM,IAAI,MAAM,CAEnB;IACD,kGAAkG;IAClG,IAAI,eAAe,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,CAE5C;IAED,OAAO,CAAC,qBAAqB;IAO7B;;;;;;;;;;;;;;;;;;OAkBG;IACH,IAAI,MAAM,IAAI,MAAM,CAUnB;IAED,OAAO;WAoBM,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,sBAAsB;CA6BhF"}

package/dist/cdk/blocks-backend.js

@@ -8,6 +8,7 @@ import { pathToFileURL } from 'node:url';
 import { addBlocksStackMetadata } from './stack-metadata.js';
 import { finalizeConfigRegistry, registerConfig } from './config-registry.js';
 import { registerBuiltinRoutes } from '../builtin-routes.js';
+import { getComputes } from './compute/compute-registry.js';
 /**
  * Validate that the Node.js process was started with `--conditions=cdk`.
  *
@@ -64,9 +65,10 @@ export function setupBlocksInfra(scope, props, id) {
     // so permissions would quietly vanish. If a bring-your-own-role option is ever
     // added, it must resolve to a mutable role (`{ mutable: true }`).
     const executionRole = new iam.Role(scope, 'BlocksRole', {
-        // CompositePrincipal (rather than a bare ServicePrincipal) so additional
-        // compute types can assume this same shared role as they are introduced
-        // (e.g. ECS tasks via ecs-tasks.amazonaws.com), by adding principals here.
+        // CompositePrincipal (rather than a bare ServicePrincipal) so a Building Block
+        // whose compute runs AS this shared role can add its own trust principal here
+        // (e.g. the Agent BB adds bedrock-agentcore in its CDK construct) — core stays
+        // agnostic and only Lambda is trusted by default.
         assumedBy: new iam.CompositePrincipal(new iam.ServicePrincipal('lambda.amazonaws.com')),
         managedPolicies: [
             iam.ManagedPolicy.fromAwsManagedPolicyName('service-role/AWSLambdaBasicExecutionRole'),
@@ -140,6 +142,12 @@ export function setupBlocksInfra(scope, props, id) {
  */
 export class BlocksBackend extends Construct {
     backendHandlerPath;
+    /**
+     * Path to the app's backend module (`props.backendCDKPath`). Exposed so Building Blocks that
+     * co-bundle the backend at synth (e.g. the Agent BB's AgentCore Runtime) can discover it via
+     * `globalThis.CURRENT_BLOCKS_STACK.backendModulePath`.
+     */
+    backendModulePath;
     /** Shared IAM role assumed by all Blocks compute. Building Blocks grant to this role. */
     executionRole;
     /** Infrastructure defaults for Building Blocks created under this backend. */
@@ -158,6 +166,10 @@ export class BlocksBackend extends Construct {
     get apiUrl() {
         return this.requireDefaultCompute().apiUrl;
     }
+    /** The default compute's handler CloudWatch log group. `bb-logger` reconfigures its retention. */
+    get handlerLogGroup() {
+        return this.requireDefaultCompute().logGroup;
+    }
     requireDefaultCompute() {
         if (!this._defaultCompute) {
             throw new Error('Blocks backend not fully initialized — access .handler/.gateway/.apiUrl after BlocksBackend.create() resolves.');
@@ -197,6 +209,7 @@ export class BlocksBackend extends Construct {
     constructor(scope, id, props) {
         super(scope, id);
         this.backendHandlerPath = props.backendHandlerPath;
+        this.backendModulePath = props.backendCDKPath;
         // Expose self to Building Blocks at CDK time
         globalThis.CURRENT_BLOCKS_STACK = this;
         // Store defaults on the backend (not the stack) so several BlocksBackends
@@ -233,7 +246,7 @@ export class BlocksBackend extends Construct {
         }
         addBlocksStackMetadata(cdk.Stack.of(backend));
         // Finalize BB config → S3 (after all BBs have registered their config)
-        finalizeConfigRegistry(backend, backend.handler);
+        finalizeConfigRegistry(backend, backend.executionRole, getComputes(backend));
         return backend;
     }
 }

package/dist/cdk/blocks-backend.test.js

@@ -25,13 +25,18 @@ class StubLambdaCompute extends Compute {
     fn;
     apiGateway;
     apiUrl;
+    logGroup;
     constructor(scope, id) {
         super(id, { parent: scope });
+        this.logGroup = new cdk.aws_logs.LogGroup(this, 'HandlerLogGroup', {
+            removalPolicy: cdk.RemovalPolicy.DESTROY,
+        });
         this.fn = new lambda.NodejsFunction(this, 'Handler', {
             entry: this.backendHandlerPath,
             runtime: cdk.aws_lambda.Runtime.NODEJS_22_X,
             handler: 'handler',
             role: this.executionRole,
+            logGroup: this.logGroup,
             environment: { BLOCKS_STACK_NAME: this.backendStackName },
             bundling: { minify: true, esbuildArgs: { '--conditions': 'aws-runtime' } },
         });
@@ -123,11 +128,23 @@ describe('shared execution role', () => {
             Principal: { Service: 'lambda.amazonaws.com' },
         });
         assert.ok(JSON.stringify(blocksRole.Properties.ManagedPolicyArns ?? []).includes('AWSLambdaBasicExecutionRole'), 'BlocksRole should attach AWSLambdaBasicExecutionRole');
+        // Core is BB-agnostic: with no Building Block that runs AS the shared role, the trust policy
+        // must NOT allow any compute principal beyond Lambda (e.g. bedrock-agentcore is added by the
+        // Agent BB's own construct, not here — see packages/bb-agent).
+        assert.ok(!JSON.stringify(blocksRole.Properties.AssumeRolePolicyDocument).includes('bedrock-agentcore'), 'core must not trust bedrock-agentcore by default (no agent → no AgentCore trust)');
         // The Blocks handler references the shared role, not an auto-generated one.
         template.hasResourceProperties('AWS::Lambda::Function', {
             Role: { 'Fn::GetAtt': [blocksRoleId, 'Arn'] },
         });
     });
+    test('exposes backendModulePath (props.backendCDKPath) for co-bundling BBs', async () => {
+        const app = new cdk.App();
+        const parent = new cdk.Stack(app, 'BackendPathStack');
+        const backend = await makeBackend(parent, 'Blocks', sideEffectBackendPath);
+        // Building Blocks that co-bundle the app backend at synth time (e.g. the Agent BB's AgentCore
+        // Runtime) discover it via globalThis.CURRENT_BLOCKS_STACK.backendModulePath.
+        assert.strictEqual(backend.backendModulePath, sideEffectBackendPath);
+    });
     test('a nested block resolves executionRole via the construct-tree walk', async () => {
         const app = new cdk.App();
         const parent = new cdk.Stack(app, 'RoleResolveStack');

package/dist/cdk/blocks-defaults.d.ts

@@ -1,4 +1,17 @@
 import { RemovalPolicy } from 'aws-cdk-lib';
+import { RetentionDays } from 'aws-cdk-lib/aws-logs';
+/**
+ * Request-rate limits applied to an API Gateway stage. On a REST API these are
+ * requests/second; on a WebSocket API the unit is messages/second across the
+ * connection. `rateLimit` is the steady-state ceiling and `burstLimit` the
+ * token-bucket size for short spikes.
+ */
+export interface BlocksThrottling {
+    /** Steady-state request (or WebSocket message) rate ceiling, per second. */
+    rateLimit: number;
+    /** Token-bucket burst size for short spikes above `rateLimit`. */
+    burstLimit: number;
+}
 /**
  * Default values for every Amazon-authored Building Block created within a
  * `BlocksStack` or `BlocksBackend`. A per-block option always overrides the
@@ -42,6 +55,40 @@ export interface BlocksDefaults {
     pointInTimeRecovery: boolean | {
         retentionDays: number;
     };
+    /**
+     * How long CloudWatch Logs keeps log events written by Blocks-managed log
+     * groups (the core handler Lambda, migration/GSI Lambdas, hosting compute,
+     * `bb-logger`, and API Gateway access logs) before expiring them. Without a
+     * retention set, AWS keeps log events forever, which grows cost unbounded —
+     * every Blocks-managed log group reads this default so retention is applied
+     * consistently.
+     */
+    logRetention: RetentionDays;
+    /**
+     * Request-rate limits applied to every Blocks-managed API Gateway stage: the
+     * core REST API, the SSR/hosting REST API, and the `bb-realtime` WebSocket
+     * stage. Protects the backend from runaway clients and caps blast radius.
+     * The sandbox preset caps tighter (200/400) than production (1000/2000) so a
+     * disposable stack is well-protected without throttling real production
+     * traffic. See {@link BlocksThrottling}.
+     */
+    throttling: BlocksThrottling;
+    /**
+     * Whether to emit structured JSON access logs from every Blocks-managed API
+     * Gateway stage to a dedicated CloudWatch log group (retention follows
+     * {@link logRetention}).
+     *
+     * **Off by default in both presets** — opt in with a per-stack override
+     * (`defaults: { ...BlocksPresets.production, accessLogging: true }`). It is
+     * off by default (rather than on for production) because enabling it
+     * provisions the account-level API Gateway CloudWatch Logs role, which is an
+     * account/region-level singleton: a second Blocks stack in the same
+     * account+region that also enables access logging can repoint that role on
+     * deploy or, on teardown, leave the survivor's access logging broken.
+     * Enabling it is therefore safe for **one Blocks stack per region** — see
+     * `ensureApiGatewayAccount` for the full multi-stack teardown caveat.
+     */
+    accessLogging: boolean;
 }
 /**
  * Prepared starting points for {@link BlocksDefaults}. Pick one and override
@@ -58,13 +105,30 @@ export declare const BlocksPresets: {
         deletionProtection: false;
         allowedOrigins: string[];
         pointInTimeRecovery: false;
+        logRetention: RetentionDays.ONE_WEEK;
+        throttling: {
+            rateLimit: number;
+            burstLimit: number;
+        };
+        accessLogging: false;
     };
-    /** Durable, protected posture for permanent deployments. */
+    /**
+     * Durable, protected posture for permanent deployments. A higher throttle
+     * ceiling (1000/2000) than sandbox so the default doesn't 429 real
+     * production traffic — raise it via a per-stack `throttling` override for
+     * higher-volume APIs.
+     */
     production: {
         removalPolicy: RemovalPolicy.RETAIN;
         deletionProtection: true;
         allowedOrigins: never[];
         pointInTimeRecovery: true;
+        logRetention: RetentionDays.ONE_YEAR;
+        throttling: {
+            rateLimit: number;
+            burstLimit: number;
+        };
+        accessLogging: false;
     };
 };
 //# sourceMappingURL=blocks-defaults.d.ts.map

package/dist/cdk/blocks-defaults.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"blocks-defaults.d.ts","sourceRoot":"","sources":["../../src/cdk/blocks-defaults.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC9B;;;;;OAKG;IACH,aAAa,EAAE,aAAa,CAAC;IAE7B;;;;OAIG;IACH,kBAAkB,EAAE,OAAO,CAAC;IAE5B;;;;;OAKG;IACH,cAAc,EAAE,MAAM,EAAE,CAAC;IAEzB;;;;;;;;;;;OAWG;IACH,mBAAmB,EAAE,OAAO,GAAG;QAAE,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;CACzD;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa;IACzB,qFAAqF;;;;;;;IAOrF,4DAA4D;;;;;;;CAOnB,CAAC"}
+{"version":3,"file":"blocks-defaults.d.ts","sourceRoot":"","sources":["../../src/cdk/blocks-defaults.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAChC,4EAA4E;IAC5E,SAAS,EAAE,MAAM,CAAC;IAClB,kEAAkE;IAClE,UAAU,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC9B;;;;;OAKG;IACH,aAAa,EAAE,aAAa,CAAC;IAE7B;;;;OAIG;IACH,kBAAkB,EAAE,OAAO,CAAC;IAE5B;;;;;OAKG;IACH,cAAc,EAAE,MAAM,EAAE,CAAC;IAEzB;;;;;;;;;;;OAWG;IACH,mBAAmB,EAAE,OAAO,GAAG;QAAE,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;IAEzD;;;;;;;OAOG;IACH,YAAY,EAAE,aAAa,CAAC;IAE5B;;;;;;;OAOG;IACH,UAAU,EAAE,gBAAgB,CAAC;IAE7B;;;;;;;;;;;;;;OAcG;IACH,aAAa,EAAE,OAAO,CAAC;CACvB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa;IACzB,qFAAqF;;;;;;;;;;;;;IAUrF;;;;;OAKG;;;;;;;;;;;;;CAcsC,CAAC"}

package/dist/cdk/blocks-defaults.js

@@ -1,6 +1,7 @@
 // Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 import { RemovalPolicy } from 'aws-cdk-lib';
+import { RetentionDays } from 'aws-cdk-lib/aws-logs';
 /**
  * Prepared starting points for {@link BlocksDefaults}. Pick one and override
  * individual fields with a spread:
@@ -16,12 +17,27 @@ export const BlocksPresets = {
         deletionProtection: false,
         allowedOrigins: ['^https?://(localhost|127\\.0\\.0\\.1)(:\\d+)?$'],
         pointInTimeRecovery: false,
+        logRetention: RetentionDays.ONE_WEEK,
+        throttling: { rateLimit: 200, burstLimit: 400 },
+        accessLogging: false,
     },
-    /** Durable, protected posture for permanent deployments. */
+    /**
+     * Durable, protected posture for permanent deployments. A higher throttle
+     * ceiling (1000/2000) than sandbox so the default doesn't 429 real
+     * production traffic — raise it via a per-stack `throttling` override for
+     * higher-volume APIs.
+     */
     production: {
         removalPolicy: RemovalPolicy.RETAIN,
         deletionProtection: true,
         allowedOrigins: [],
         pointInTimeRecovery: true,
+        logRetention: RetentionDays.ONE_YEAR,
+        throttling: { rateLimit: 1000, burstLimit: 2000 },
+        // Off by default even in production: enabling access logging mutates the
+        // account/region-level API Gateway CloudWatch role (a singleton). Opt in
+        // per stack once you've confirmed a single Blocks stack owns it in the
+        // region — see the `accessLogging` field doc.
+        accessLogging: false,
     },
 };

package/dist/cdk/blocks-defaults.test.js

@@ -9,6 +9,7 @@
 import { test, describe } from 'node:test';
 import assert from 'node:assert';
 import { RemovalPolicy } from 'aws-cdk-lib';
+import { RetentionDays } from 'aws-cdk-lib/aws-logs';
 import { BlocksPresets } from './blocks-defaults.js';
 describe('BlocksPresets', () => {
     test('sandbox is disposable: DESTROY + deletion protection off + no PITR', () => {
@@ -21,4 +22,20 @@ describe('BlocksPresets', () => {
         assert.strictEqual(BlocksPresets.production.deletionProtection, true);
         assert.strictEqual(BlocksPresets.production.pointInTimeRecovery, true);
     });
+    test('sandbox keeps logs briefly', () => {
+        assert.strictEqual(BlocksPresets.sandbox.logRetention, RetentionDays.ONE_WEEK);
+    });
+    test('production keeps logs a year', () => {
+        assert.strictEqual(BlocksPresets.production.logRetention, RetentionDays.ONE_YEAR);
+    });
+    test('access logging is off by default in BOTH presets (opt-in; mutates an account singleton)', () => {
+        assert.strictEqual(BlocksPresets.sandbox.accessLogging, false);
+        assert.strictEqual(BlocksPresets.production.accessLogging, false);
+    });
+    test('sandbox caps tighter (200/400) than production (1000/2000)', () => {
+        assert.strictEqual(BlocksPresets.sandbox.throttling.rateLimit, 200);
+        assert.strictEqual(BlocksPresets.sandbox.throttling.burstLimit, 400);
+        assert.strictEqual(BlocksPresets.production.throttling.rateLimit, 1000);
+        assert.strictEqual(BlocksPresets.production.throttling.burstLimit, 2000);
+    });
 });

package/dist/cdk/blocks-stack.test.js

@@ -10,6 +10,7 @@ import * as lambda from 'aws-cdk-lib/aws-lambda-nodejs';
 import { BLOCKS_RPC_PREFIX } from '../constants.js';
 import { BlocksBackend } from './blocks-backend.js';
 import { Compute } from './compute/compute.js';
+import { getComputes } from './compute/compute-registry.js';
 import { BlocksStack, BlocksPresets, Scope } from './index.js';
 // A real app gets its default compute from @aws-blocks/bb-lambda-compute (via
 // @aws-blocks/blocks), which core's own tests can't depend on. Use an
@@ -22,13 +23,18 @@ class StubLambdaCompute extends Compute {
     fn;
     apiGateway;
     apiUrl;
+    logGroup;
     constructor(scope, id) {
         super(id, { parent: scope });
+        this.logGroup = new cdk.aws_logs.LogGroup(this, 'HandlerLogGroup', {
+            removalPolicy: cdk.RemovalPolicy.DESTROY,
+        });
         this.fn = new lambda.NodejsFunction(this, 'Handler', {
             entry: this.backendHandlerPath,
             runtime: cdk.aws_lambda.Runtime.NODEJS_22_X,
             handler: 'handler',
             role: this.executionRole,
+            logGroup: this.logGroup,
             environment: { BLOCKS_STACK_NAME: this.backendStackName },
             bundling: { minify: true, esbuildArgs: { '--conditions': 'aws-runtime' } },
         });
@@ -130,6 +136,21 @@ describe('root is bound to the owning stack (multi-stack synth)', () => {
         assert.strictEqual(blockA.backendStackName, 'RootBindingA', 'blockA derives its own stack name');
         assert.strictEqual(blockB.backendStackName, 'RootBindingB', 'blockB derives its own stack name');
     });
+    test('each stack owns an isolated compute registry (no cross-stack bleed)', async () => {
+        // Computes self-register on their owning stack (keyed per stack, not a
+        // process-global list), so a multi-stack synth keeps each stack's computes
+        // separate — finalize steps for one stack never see another's compute.
+        const app = new cdk.App();
+        const stackA = await makeStack(app, 'ComputeRegistryA', sideEffectBackendPath);
+        const stackB = await makeStack(app, 'ComputeRegistryB', sideEffectBackendPath);
+        const computesA = getComputes(stackA);
+        const computesB = getComputes(stackB);
+        assert.strictEqual(computesA.length, 1, 'stackA registered exactly its default compute');
+        assert.strictEqual(computesB.length, 1, 'stackB registered exactly its default compute');
+        assert.strictEqual(computesA[0], stackA._defaultCompute, 'stackA lists its own default');
+        assert.strictEqual(computesB[0], stackB._defaultCompute, 'stackB lists its own default');
+        assert.notStrictEqual(computesA[0], computesB[0], 'the two stacks hold distinct computes');
+    });
 });
 describe('assertCdkConditionActive', () => {
     test('BlocksStack.create() throws when --conditions=cdk is missing', async () => {

package/dist/cdk/compute/compute-registry.d.ts

@@ -0,0 +1,19 @@
+import type { Construct } from 'constructs';
+import type { Compute } from './compute.js';
+/**
+ * Register a compute on its owning stack. Called from the {@link Compute} base
+ * constructor, so every compute self-registers the moment it is constructed —
+ * the finalize steps then enumerate them without a separate discovery pass
+ * (mirrors how `registerConfig` accumulates config during the backend import).
+ *
+ * @param compute - The compute to register (used to locate its stack).
+ */
+export declare function registerCompute(compute: Compute): void;
+/**
+ * The computes registered on the stack that owns `scope`, in construction
+ * order. Returns an empty array before any compute is constructed.
+ *
+ * @param scope - Any construct in the stack (used to locate the stack).
+ */
+export declare function getComputes(scope: Construct): readonly Compute[];
+//# sourceMappingURL=compute-registry.d.ts.map

package/dist/cdk/compute/compute-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compute-registry.d.ts","sourceRoot":"","sources":["../../../src/cdk/compute/compute-registry.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAmB5C;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAEtD;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,SAAS,GAAG,SAAS,OAAO,EAAE,CAEhE"}

package/dist/cdk/compute/compute-registry.js

@@ -0,0 +1,38 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+import * as cdk from 'aws-cdk-lib';
+const REGISTRY_KEY = Symbol.for('BLOCKS_COMPUTE_REGISTRY');
+/**
+ * Get or create the compute list for a given stack. The list is stored on the
+ * stack object (keyed by a Symbol), so each stack in a multi-stack synth gets
+ * its own — a compute never leaks into another stack's list. Mirrors the config
+ * registry (`config-registry.ts`), which scopes its state the same way.
+ */
+function getRegistry(stack) {
+    let list = stack[REGISTRY_KEY];
+    if (!list) {
+        list = [];
+        stack[REGISTRY_KEY] = list;
+    }
+    return list;
+}
+/**
+ * Register a compute on its owning stack. Called from the {@link Compute} base
+ * constructor, so every compute self-registers the moment it is constructed —
+ * the finalize steps then enumerate them without a separate discovery pass
+ * (mirrors how `registerConfig` accumulates config during the backend import).
+ *
+ * @param compute - The compute to register (used to locate its stack).
+ */
+export function registerCompute(compute) {
+    getRegistry(cdk.Stack.of(compute)).push(compute);
+}
+/**
+ * The computes registered on the stack that owns `scope`, in construction
+ * order. Returns an empty array before any compute is constructed.
+ *
+ * @param scope - Any construct in the stack (used to locate the stack).
+ */
+export function getComputes(scope) {
+    return getRegistry(cdk.Stack.of(scope));
+}