@aws-blocks/core 0.4.0 → 0.5.0

package/dist/cdk/vpc.test.js

@@ -0,0 +1,285 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+import * as assert from 'node:assert/strict';
+import { describe, it } from 'node:test';
+import * as cdk from 'aws-cdk-lib';
+import { Template } from 'aws-cdk-lib/assertions';
+import * as ec2 from 'aws-cdk-lib/aws-ec2';
+import { Construct } from 'constructs';
+import { anyRequirementNeedsVpc, finalizeVpc, getOrCreateVpc, getVpcContext, initializeVpc, setVpcContext, } from './vpc.js';
+import { registerVpcRequirements } from './vpc-requirements-registry.js';
+// A minimal stand-in for a BuildingBlockScope: finalizeVpc reads requirements
+// from the central registry, and the real BuildingBlockScope base registers in
+// its constructor. This fake does the same (register on construction) so it
+// exercises the real pull-and-provision path without pulling every BB package
+// into core's test graph. A `fullId` getter mirrors the real Scope so error
+// messages that name the BB can be asserted.
+class FakeBB extends Construct {
+    constructor(scope, id, reqs) {
+        super(scope, id);
+        registerVpcRequirements(this, reqs);
+    }
+    get fullId() {
+        return this.node.id;
+    }
+}
+/**
+ * Build a stack + VPC, optionally initialize the VPC context (so the endpoint
+ * SG can scope to the Lambda SG), add fake BBs, then run finalizeVpc.
+ */
+function synthWith(bbs, opts) {
+    const app = new cdk.App();
+    const stack = new cdk.Stack(app, 'TestStack', { env: { account: '123456789012', region: 'us-east-1' } });
+    const vpc = new ec2.Vpc(stack, 'Vpc', { maxAzs: 2, natGateways: opts?.natGateways ?? 1 });
+    const options = {
+        network: vpc,
+        subnets: opts?.subnets,
+        provisionEndpoints: opts?.provisionEndpoints,
+    };
+    if (opts?.withContext !== false)
+        initializeVpc(stack, options);
+    bbs(stack);
+    finalizeVpc(stack, options);
+    return Template.fromStack(stack);
+}
+const IFACE = 'AWS::EC2::VPCEndpoint';
+/** Count interface vs gateway endpoints in a synthesized template. */
+function endpointCounts(template) {
+    const eps = template.findResources(IFACE);
+    let iface = 0;
+    let gateway = 0;
+    for (const ep of Object.values(eps)) {
+        const type = ep.Properties?.VpcEndpointType;
+        // Interface endpoints set VpcEndpointType: 'Interface'; gateway endpoints
+        // default the property (Gateway) and omit it in the synthesized template.
+        if (type === 'Interface')
+            iface += 1;
+        else
+            gateway += 1;
+    }
+    return { iface, gateway };
+}
+describe('finalizeVpc — endpoint provisioning', () => {
+    it('always provisions CloudWatch Logs (interface) and S3 (gateway), even with no BBs', () => {
+        const template = synthWith(() => { });
+        const { iface, gateway } = endpointCounts(template);
+        assert.equal(gateway, 1); // S3 gateway, always-on (free)
+        assert.equal(iface, 1); // Logs, always-on
+        template.hasResourceProperties(IFACE, {
+            VpcEndpointType: 'Interface',
+            ServiceName: 'com.amazonaws.us-east-1.logs',
+        });
+        // Exactly one gateway endpoint (S3). Its ServiceName synthesizes as a
+        // region-tokenized Fn::Join, so assert by type/count rather than a literal.
+        const gateways = template.findResources(IFACE, { Properties: { VpcEndpointType: 'Gateway' } });
+        assert.equal(Object.keys(gateways).length, 1, 'exactly one gateway endpoint (S3)');
+        // SSM is NOT always-on — it flows from BB requirements only.
+        const ssm = template.findResources(IFACE, {
+            Properties: { ServiceName: 'com.amazonaws.us-east-1.ssm' },
+        });
+        assert.equal(Object.keys(ssm).length, 0, 'no SSM endpoint without a BB that needs it');
+    });
+    it('provisions the union of BB-declared endpoints plus the always-on Logs + S3', () => {
+        const template = synthWith((scope) => {
+            new FakeBB(scope, 'Kv', { gatewayEndpoints: [ec2.GatewayVpcEndpointAwsService.DYNAMODB] });
+            new FakeBB(scope, 'Bucket', { gatewayEndpoints: [ec2.GatewayVpcEndpointAwsService.S3] });
+            new FakeBB(scope, 'Job', { interfaceEndpoints: [ec2.InterfaceVpcEndpointAwsService.SQS] });
+            new FakeBB(scope, 'Db', {
+                interfaceEndpoints: [
+                    ec2.InterfaceVpcEndpointAwsService.SECRETS_MANAGER,
+                    ec2.InterfaceVpcEndpointAwsService.RDS_DATA,
+                ],
+            });
+        });
+        const { iface, gateway } = endpointCounts(template);
+        // Gateways: DynamoDB + S3 (BB's S3 dedups with the always-on S3).
+        assert.equal(gateway, 2);
+        // Interfaces: SQS + Secrets Manager + RDS Data + always-on Logs.
+        assert.equal(iface, 4);
+    });
+    it('deduplicates endpoints requested by multiple BBs', () => {
+        const template = synthWith((scope) => {
+            new FakeBB(scope, 'Kv1', { gatewayEndpoints: [ec2.GatewayVpcEndpointAwsService.DYNAMODB] });
+            new FakeBB(scope, 'Kv2', { gatewayEndpoints: [ec2.GatewayVpcEndpointAwsService.DYNAMODB] });
+            new FakeBB(scope, 'Job1', { interfaceEndpoints: [ec2.InterfaceVpcEndpointAwsService.SQS] });
+            new FakeBB(scope, 'Job2', { interfaceEndpoints: [ec2.InterfaceVpcEndpointAwsService.SQS] });
+        });
+        const { iface, gateway } = endpointCounts(template);
+        // Two DynamoDB requests collapse to one; plus always-on S3 = 2 gateways.
+        assert.equal(gateway, 2);
+        // Two SQS requests collapse to one; plus always-on Logs = 2 interfaces.
+        assert.equal(iface, 2);
+    });
+    it('provisions SSM only when a BB declares it (and dedups multiple declarations)', () => {
+        const template = synthWith((scope) => {
+            new FakeBB(scope, 'AppSetting', { interfaceEndpoints: [ec2.InterfaceVpcEndpointAwsService.SSM] });
+            new FakeBB(scope, 'Auth', { interfaceEndpoints: [ec2.InterfaceVpcEndpointAwsService.SSM] });
+        });
+        const { iface } = endpointCounts(template);
+        // Two SSM requests collapse to one; plus always-on Logs = 2 interfaces.
+        assert.equal(iface, 2);
+        template.hasResourceProperties(IFACE, {
+            VpcEndpointType: 'Interface',
+            ServiceName: 'com.amazonaws.us-east-1.ssm',
+        });
+    });
+    it('provisions nothing when provisionEndpoints is false (but still validates requiresEgress)', () => {
+        const template = synthWith((scope) => {
+            new FakeBB(scope, 'Kv', { gatewayEndpoints: [ec2.GatewayVpcEndpointAwsService.DYNAMODB] });
+        }, { provisionEndpoints: false });
+        template.resourceCountIs(IFACE, 0);
+    });
+    it('scopes the interface-endpoint SG to 443 from the Blocks Lambda SG only', () => {
+        const template = synthWith((scope) => {
+            new FakeBB(scope, 'Job', { interfaceEndpoints: [ec2.InterfaceVpcEndpointAwsService.SQS] });
+        });
+        // A dedicated endpoint SG exists, described as Lambda-scoped, with a 443
+        // ingress rule sourced from another SG (the Lambda SG) rather than the whole
+        // VPC CIDR. We assert the rule is present (arrayWith) rather than the exact
+        // array, since CDK may add its own paired rule for the endpoint association.
+        const sgs = template.findResources('AWS::EC2::SecurityGroup', {
+            Properties: { GroupDescription: 'Blocks interface VPC endpoints — 443 from the Blocks Lambda only' },
+        });
+        assert.equal(Object.keys(sgs).length, 1, 'exactly one dedicated endpoint SG');
+        const sg = Object.values(sgs)[0];
+        const ingress = sg.Properties.SecurityGroupIngress ?? [];
+        const https = ingress.filter((r) => r.FromPort === 443 && r.ToPort === 443);
+        assert.equal(https.length, 1, 'exactly one 443 ingress rule');
+        // Must NOT be open to a CIDR (that would be the broad default we're avoiding).
+        assert.equal(https[0].CidrIp, undefined, '443 ingress is SG-sourced, not CIDR-open');
+    });
+});
+describe('finalizeVpc — requiresEgress validation', () => {
+    it('passes when the runtime placement provides egress', () => {
+        // Default placement is private-with-egress, which provides egress.
+        assert.doesNotThrow(() => synthWith((scope) => {
+            new FakeBB(scope, 'Dsql', { requiresEgress: true });
+        }));
+    });
+    it('throws an actionable, BB-named error when the placement has no egress', () => {
+        // Place the runtime in isolated subnets; a BB needing egress cannot be served.
+        assert.throws(() => synthWith((scope) => {
+            new FakeBB(scope, 'Dsql', { requiresEgress: true });
+        }, { subnets: { subnetType: ec2.SubnetType.PRIVATE_ISOLATED } }), /Dsql requires its runtime to reach the internet.*no egress/s);
+    });
+    it('does not validate a BB that does not require egress', () => {
+        // A BB with no egress need is fine in isolated subnets.
+        assert.doesNotThrow(() => synthWith((scope) => {
+            new FakeBB(scope, 'Bb', {});
+        }, { subnets: { subnetType: ec2.SubnetType.PRIVATE_ISOLATED } }));
+    });
+});
+describe('initializeVpc — Lambda placement guard', () => {
+    function init(natGateways, subnets) {
+        const app = new cdk.App();
+        const stack = new cdk.Stack(app, 'S', { env: { account: '123456789012', region: 'us-east-1' } });
+        const subnetConfiguration = natGateways === 0
+            ? [{ name: 'isolated', subnetType: ec2.SubnetType.PRIVATE_ISOLATED, cidrMask: 24 }]
+            : undefined;
+        const vpc = new ec2.Vpc(stack, 'Vpc', { maxAzs: 2, natGateways, subnetConfiguration });
+        return () => initializeVpc(stack, { network: vpc, subnets });
+    }
+    it('throws an actionable error when defaulting to private-with-egress but the VPC has none', () => {
+        assert.throws(init(0), /no private-with-egress subnets.*NAT gateway/s);
+    });
+    it('does not throw when the VPC has a private-with-egress tier', () => {
+        assert.doesNotThrow(init(1));
+    });
+    it('honors an explicit isolated placement without the private-with-egress guard', () => {
+        // Caller explicitly chose isolated; the default-path guard must not fire.
+        assert.doesNotThrow(init(0, { subnetType: ec2.SubnetType.PRIVATE_ISOLATED }));
+    });
+});
+describe('VpcContext.selectSubnets — instructive resolution', () => {
+    function contextFor(natGateways) {
+        const app = new cdk.App();
+        const stack = new cdk.Stack(app, 'S', { env: { account: '123456789012', region: 'us-east-1' } });
+        const vpc = new ec2.Vpc(stack, 'Vpc', { maxAzs: 2, natGateways });
+        // With natGateways: 0 CDK still creates the default public+private config,
+        // but the private tier becomes isolated (no NAT). Build an explicit
+        // isolated-only VPC to exercise the "no isolated" and "no egress" cases.
+        return initializeVpc(stack, { network: vpc, subnets: { subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS } });
+    }
+    it('returns the requested role when the VPC has it', () => {
+        const ctx = contextFor(1);
+        const sel = ctx.selectSubnets({ fullId: 'app/db' }, 'private-with-egress');
+        assert.equal(sel.subnetType, ec2.SubnetType.PRIVATE_WITH_EGRESS);
+    });
+    it('falls back to an explicit fallback role when the requested role is absent', () => {
+        const ctx = contextFor(1); // has public + private-with-egress, no isolated
+        const sel = ctx.selectSubnets({ fullId: 'app/db' }, 'isolated', { fallback: 'private-with-egress' });
+        assert.equal(sel.subnetType, ec2.SubnetType.PRIVATE_WITH_EGRESS);
+    });
+    it('throws a BB-named error when neither the role nor its fallback exists', () => {
+        const ctx = contextFor(1); // no isolated tier, and no public fallback requested that helps
+        assert.throws(() => ctx.selectSubnets({ fullId: 'app/db' }, 'isolated'), /app\/db needs a 'isolated' subnet.*has none/s);
+    });
+});
+// We can't fully test CDK constructs without a Stack, but we can test
+// the getVpcContext logic with mock constructs.
+describe('VPC utilities', () => {
+    it('getVpcContext returns undefined when no context set', () => {
+        const fakeScope = { node: { scope: undefined } };
+        assert.equal(getVpcContext(fakeScope), undefined);
+    });
+    it('getVpcContext walks up the scope tree', () => {
+        const vpcContext = { vpc: 'mock-vpc', computeSecurityGroup: 'mock-sg', computeSubnets: {} };
+        const parent = { node: { scope: undefined } };
+        setVpcContext(parent, vpcContext);
+        const child = { node: { scope: parent } };
+        assert.equal(getVpcContext(child), vpcContext);
+    });
+    it('setVpcContext stores context on the scope', () => {
+        const fakeScope = { node: { scope: undefined } };
+        const vpcContext = { vpc: 'mock-vpc', computeSecurityGroup: 'mock-sg', computeSubnets: {} };
+        setVpcContext(fakeScope, vpcContext);
+        assert.equal(getVpcContext(fakeScope), vpcContext);
+    });
+});
+describe('lazy VPC derivation', () => {
+    function stackWith(bbs) {
+        const app = new cdk.App();
+        const stack = new cdk.Stack(app, 'LazyStack', { env: { account: '123456789012', region: 'us-east-1' } });
+        bbs(stack);
+        return { stack, scope: stack };
+    }
+    it('anyRequirementNeedsVpc is false for BBs that only declare endpoints', () => {
+        const { scope } = stackWith((s) => {
+            new FakeBB(s, 'Kv', { gatewayEndpoints: [ec2.GatewayVpcEndpointAwsService.DYNAMODB] });
+            new FakeBB(s, 'Job', { interfaceEndpoints: [ec2.InterfaceVpcEndpointAwsService.SQS] });
+        });
+        assert.equal(anyRequirementNeedsVpc(scope), false);
+    });
+    it('anyRequirementNeedsVpc is true when a BB declares requiresVpc', () => {
+        const { scope } = stackWith((s) => {
+            new FakeBB(s, 'Kv', { gatewayEndpoints: [ec2.GatewayVpcEndpointAwsService.DYNAMODB] });
+            new FakeBB(s, 'Container', { requiresVpc: true });
+        });
+        assert.equal(anyRequirementNeedsVpc(scope), true);
+    });
+    it('getOrCreateVpc returns the same VPC on repeated calls (singleton)', () => {
+        const { scope } = stackWith(() => { });
+        const a = getOrCreateVpc(scope);
+        const b = getOrCreateVpc(scope);
+        assert.equal(a, b, 'lazy VPC is a per-stack singleton');
+    });
+    it('a derived VPC + finalizeVpc provisions endpoints for a requiresVpc app', () => {
+        const app = new cdk.App();
+        const stack = new cdk.Stack(app, 'DerivedStack', { env: { account: '123456789012', region: 'us-east-1' } });
+        new FakeBB(stack, 'Container', {
+            requiresVpc: true,
+            interfaceEndpoints: [ec2.InterfaceVpcEndpointAwsService.SQS],
+        });
+        assert.equal(anyRequirementNeedsVpc(stack), true);
+        const vpc = getOrCreateVpc(stack);
+        const options = { network: vpc };
+        initializeVpc(stack, options);
+        finalizeVpc(stack, options);
+        const template = Template.fromStack(stack);
+        // SQS (from the BB) + always-on CloudWatch Logs interface endpoints, plus
+        // the always-on S3 gateway endpoint.
+        const { iface, gateway } = endpointCounts(template);
+        assert.equal(iface, 2, 'SQS + Logs');
+        assert.equal(gateway, 1, 'S3 gateway');
+    });
+});

package/dist/errors.d.ts

@@ -44,6 +44,11 @@ export declare class ApiError extends Error {
      * when `retriable === true`; non-retriable errors (expired session,
      * tampered envelope, too-many-attempts lockouts) require restarting the
      * flow. Defaults to `false` when unspecified.
+     *
+     * This marks whether the *kind* of failure is retriable in principle, not a
+     * guarantee that a given retry will succeed — e.g. an optimistic-lock
+     * conflict against a missing row is flagged retriable, yet a blind retry
+     * fails identically.
      */
     readonly retriable: boolean;
     constructor(message: string, status: number, options?: {

package/dist/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAGA;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,aAAa,CAAC;AAEjD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,qBAAa,QAAS,SAAQ,KAAK;IAClC,wBAAwB;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;;;;;OAQG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;gBAEhB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE;CAM9G;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,aAAa,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,GAAG;IAAE,IAAI,EAAE,CAAC,CAAA;CAAE,CAE7F;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,KAAK,CAIhE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,YAAY,CAAC,CAAC,SAAS;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,EAAE,CAAC,SAAS,MAAM,EAC9E,KAAK,EAAE,CAAC,GAAG,IAAI,GAAG,SAAS,EAC3B,IAAI,EAAE,CAAC,GACL,KAAK,IAAI,CAAC,GAAG;IAAE,SAAS,EAAE,CAAC,CAAA;CAAE,CAE/B"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAGA;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,aAAa,CAAC;AAEjD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,qBAAa,QAAS,SAAQ,KAAK;IAClC,wBAAwB;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;gBAEhB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE;CAM9G;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,aAAa,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,GAAG;IAAE,IAAI,EAAE,CAAC,CAAA;CAAE,CAE7F;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,KAAK,CAIhE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,YAAY,CAAC,CAAC,SAAS;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,EAAE,CAAC,SAAS,MAAM,EAC9E,KAAK,EAAE,CAAC,GAAG,IAAI,GAAG,SAAS,EAC3B,IAAI,EAAE,CAAC,GACL,KAAK,IAAI,CAAC,GAAG;IAAE,SAAS,EAAE,CAAC,CAAA;CAAE,CAE/B"}

package/dist/errors.js

@@ -46,6 +46,11 @@ export class ApiError extends Error {
      * when `retriable === true`; non-retriable errors (expired session,
      * tampered envelope, too-many-attempts lockouts) require restarting the
      * flow. Defaults to `false` when unspecified.
+     *
+     * This marks whether the *kind* of failure is retriable in principle, not a
+     * guarantee that a given retry will succeed — e.g. an optimistic-lock
+     * conflict against a missing row is flagged retriable, yet a blind retry
+     * fails identically.
      */
     retriable;
     constructor(message, status, options) {

package/dist/hosting.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hosting.d.ts","sourceRoot":"","sources":["../src/hosting.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAkB,aAAa,EAAE,gBAAgB,EAAiB,MAAM,gCAAgC,CAAC;AACrH,OAAO,EAAmB,KAAK,kBAAkB,EAAiC,MAAM,8BAA8B,CAAC;AACvH,OAAO,EAIL,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EAC1B,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,GAAG,MAAM,aAAa,CAAC;AAInC,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAIvC,OAAO,EAGL,KAAK,eAAe,EACpB,KAAK,QAAQ,EAMd,MAAM,sBAAsB,CAAC;AAK9B;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,8CAA8C;IAC9C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,EAAE,GAAG,CAAC,QAAQ,GAAG,MAAM,CAAC;IAChC,8FAA8F;IAC9F,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;;;;;;;;;;;OAgBG;IACH,iBAAiB,CAAC,EAAE;QAClB,2EAA2E;QAC3E,mBAAmB,CAAC,EAAE,MAAM,CAAC;KAC9B,CAAC;IACF,uEAAuE;IACvE,YAAY,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC;CAC3C,CAAC;AAEF,YAAY,EAAE,aAAa,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,CAAC;AAE3F;;;;;;;GAOG;AACH,MAAM,WAAW,aAAc,SAAQ,IAAI,CAAC,mBAAmB,EAAE,YAAY,CAAC;IAC5E,8FAA8F;IAC9F,UAAU,EAAE,eAAe,CAAC;CAC7B;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,mHAAmH;IACnH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,YAAY;IAE3B,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAC;IAEb;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;;OAGG;IACH,SAAS,CAAC,EAAE,aAAa,CAAC;IAE1B;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,mEAAmE;IACnE,aAAa,CAAC,EAAE,kBAAkB,CAAC;IAEnC;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAGlB;;;;;;;;OAQG;IACH,GAAG,CAAC,EAAE,cAAc,CAAC;IAErB;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAGxC,uDAAuD;IACvD,OAAO,CAAC,EAAE,aAAa,CAAC;IAExB;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAEvC;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,aAAa,CAAC;IAEvB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAE/B;;;;OAIG;IACH,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAE/B,oCAAoC;IACpC,GAAG,CAAC,EAAE,gBAAgB,CAAC;IAEvB,sEAAsE;IACtE,cAAc,CAAC,EAAE,OAAO,CAAC;IAEzB;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAE5B,mDAAmD;IACnD,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAE/B,wDAAwD;IACxD,UAAU,CAAC,EAAE,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC;IAE3C;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE;QACf,IAAI,EAAE,WAAW,GAAG,WAAW,CAAC;QAChC,SAAS,EAAE,MAAM,EAAE,CAAC;KACrB,CAAC;IAEF;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,MAAM,CAAC,EAAE;QACP,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB;;;;;;;;WAQG;QACH,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;IAEF;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE;QACX,OAAO,EAAE,OAAO,CAAC;QACjB,0EAA0E;QAC1E,MAAM,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC;KAC7B,CAAC;IAEF;;;;;;;;;;;;;OAaG;IACH,UAAU,CAAC,EAAE;QACX,iEAAiE;QACjE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,iEAAiE;QACjE,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IAEF;;;OAGG;IACH,OAAO,CAAC,EAAE;QACR,wCAAwC;QACxC,OAAO,EAAE,OAAO,CAAC;QACjB,+CAA+C;QAC/C,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;IAEF;;;;;;OAMG;IACH,UAAU,CAAC,EAAE;QACX,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,6DAA6D;QAC7D,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IAEF;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,oBAAoB,CAAC;CACvC;AAaD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,qBAAa,OAAQ,SAAQ,SAAS;IACpC,2CAA2C;IAC3C,SAAgB,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC;IAC1C,mCAAmC;IACnC,SAAgB,YAAY,EAAE,GAAG,CAAC,cAAc,CAAC,YAAY,CAAC;IAC9D,yDAAyD;IACzD,SAAgB,GAAG,EAAE,MAAM,CAAC;IAC5B,gFAAgF;IAChF,SAAgB,WAAW,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC;IACtD,wFAAwF;IACxF,SAAgB,gBAAgB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC;IACrD,2FAA2F;IAC3F,SAAgB,eAAe,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;IAErD;;;;;;;;;;;;;;;;;OAiBG;WACU,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC;IAaxF;;;;;OAKG;gBACS,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,eAAe,GAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAa;IA2U/G;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IAOvB;;OAEG;IACH,OAAO,CAAC,eAAe;CAwDxB"}
+{"version":3,"file":"hosting.d.ts","sourceRoot":"","sources":["../src/hosting.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAkB,aAAa,EAAE,gBAAgB,EAAiB,MAAM,gCAAgC,CAAC;AACrH,OAAO,EAAmB,KAAK,kBAAkB,EAAiC,MAAM,8BAA8B,CAAC;AACvH,OAAO,EAIL,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EAC1B,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,GAAG,MAAM,aAAa,CAAC;AAInC,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAIvC,OAAO,EAGL,KAAK,eAAe,EACpB,KAAK,QAAQ,EAMd,MAAM,sBAAsB,CAAC;AAK9B;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,8CAA8C;IAC9C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,EAAE,GAAG,CAAC,QAAQ,GAAG,MAAM,CAAC;IAChC,8FAA8F;IAC9F,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;;;;;;;;;;;OAgBG;IACH,iBAAiB,CAAC,EAAE;QAClB,2EAA2E;QAC3E,mBAAmB,CAAC,EAAE,MAAM,CAAC;KAC9B,CAAC;IACF,uEAAuE;IACvE,YAAY,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC;CAC3C,CAAC;AAEF,YAAY,EAAE,aAAa,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,CAAC;AAE3F;;;;;;;GAOG;AACH,MAAM,WAAW,aAAc,SAAQ,IAAI,CAAC,mBAAmB,EAAE,YAAY,CAAC;IAC5E,8FAA8F;IAC9F,UAAU,EAAE,eAAe,CAAC;CAC7B;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,mHAAmH;IACnH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,YAAY;IAE3B,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAC;IAEb;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;;OAGG;IACH,SAAS,CAAC,EAAE,aAAa,CAAC;IAE1B;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,mEAAmE;IACnE,aAAa,CAAC,EAAE,kBAAkB,CAAC;IAEnC;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAGlB;;;;;;;;OAQG;IACH,GAAG,CAAC,EAAE,cAAc,CAAC;IAErB;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAGxC,uDAAuD;IACvD,OAAO,CAAC,EAAE,aAAa,CAAC;IAExB;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAEvC;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,aAAa,CAAC;IAEvB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAE/B;;;;OAIG;IACH,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAE/B,oCAAoC;IACpC,GAAG,CAAC,EAAE,gBAAgB,CAAC;IAEvB,sEAAsE;IACtE,cAAc,CAAC,EAAE,OAAO,CAAC;IAEzB;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAE5B,mDAAmD;IACnD,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAE/B,wDAAwD;IACxD,UAAU,CAAC,EAAE,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC;IAE3C;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE;QACf,IAAI,EAAE,WAAW,GAAG,WAAW,CAAC;QAChC,SAAS,EAAE,MAAM,EAAE,CAAC;KACrB,CAAC;IAEF;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,MAAM,CAAC,EAAE;QACP,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB;;;;;;;;WAQG;QACH,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;IAEF;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE;QACX,OAAO,EAAE,OAAO,CAAC;QACjB,0EAA0E;QAC1E,MAAM,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC;KAC7B,CAAC;IAEF;;;;;;;;;;;;;OAaG;IACH,UAAU,CAAC,EAAE;QACX,iEAAiE;QACjE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,iEAAiE;QACjE,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IAEF;;;OAGG;IACH,OAAO,CAAC,EAAE;QACR,wCAAwC;QACxC,OAAO,EAAE,OAAO,CAAC;QACjB,+CAA+C;QAC/C,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;IAEF;;;;;;OAMG;IACH,UAAU,CAAC,EAAE;QACX,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,6DAA6D;QAC7D,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IAEF;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,oBAAoB,CAAC;CACvC;AAaD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,qBAAa,OAAQ,SAAQ,SAAS;IACpC,2CAA2C;IAC3C,SAAgB,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC;IAC1C,mCAAmC;IACnC,SAAgB,YAAY,EAAE,GAAG,CAAC,cAAc,CAAC,YAAY,CAAC;IAC9D,yDAAyD;IACzD,SAAgB,GAAG,EAAE,MAAM,CAAC;IAC5B,gFAAgF;IAChF,SAAgB,WAAW,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC;IACtD,wFAAwF;IACxF,SAAgB,gBAAgB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC;IACrD,2FAA2F;IAC3F,SAAgB,eAAe,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;IAErD;;;;;;;;;;;;;;;;;OAiBG;WACU,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC;IAaxF;;;;;OAKG;gBACS,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,eAAe,GAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAa;IA8U/G;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IAOvB;;OAEG;IACH,OAAO,CAAC,eAAe;CAwDxB"}

package/dist/hosting.js

@@ -365,6 +365,8 @@ export class Hosting extends Construct {
             for (const dep of assetDeployments) {
                 configDeployment.node.addDependency(dep);
             }
+            // Delay route cutover until resolved config replaces the static placeholder.
+            hosting.addBuildAssetDependency(configDeployment);
         }
         // ── 9. Register public origin + CORS hosting origin into S3 config ──
         //    The Handler no longer depends on the BucketDeployment, so including

package/dist/hosting.test.js

@@ -12,7 +12,7 @@ import { App, Duration, Stack } from 'aws-cdk-lib';
 import { Match, Template } from 'aws-cdk-lib/assertions';
 import { BLOCKS_RPC_PREFIX } from './constants.js';
 import { Hosting } from './hosting.js';
-import { clearRouteRegistry, registerRoute } from './raw-route.js';
+import { clearRouteRegistry, compilePath, registerRoute } from './raw-route.js';
 // ================================================================
 // Hosting construct tests
 //
@@ -552,6 +552,38 @@ describe('Hosting', () => {
             assert.ok(patterns.includes('/health'), 'Should have /health behavior for RawRoute');
             assert.ok(patterns.includes('/users/*'), 'Should have /users/* behavior for parameterized RawRoute');
         });
+        it('adds a CloudFront behavior for a route another core copy registered', () => {
+            createSpaBuildOutput(tmpDir);
+            // Synth has the same split as dispatch: a bundle can hold more than one
+            // copy of @aws-blocks/core, and this loop reads whichever route table
+            // its own copy owns. Register the way a second copy would — straight
+            // into the shared state, not through this copy's registerRoute() — and
+            // the behavior must still be emitted. With a module-local registry it
+            // never is, and the route 404s at CloudFront before Lambda is reached.
+            const REGISTRY_KEY = '__AWS_BLOCKS_RAW_ROUTE_REGISTRY_V1__';
+            const state = globalThis[REGISTRY_KEY];
+            assert.ok(state, `route registry state must live on globalThis['${REGISTRY_KEY}']`);
+            const { pattern, paramNames } = compilePath('/from-other-copy');
+            state.routes.push({
+                method: 'GET',
+                path: '/from-other-copy',
+                pattern,
+                paramNames,
+                handler: async () => { },
+            });
+            const app = new App();
+            const stack = new Stack(app, 'ForeignRouteBehaviorStack');
+            new Hosting(stack, 'Hosting', {
+                root: tmpDir,
+                api: MOCK_API,
+            });
+            const template = Template.fromStack(stack);
+            const distributions = template.findResources('AWS::CloudFront::Distribution');
+            const distKeys = Object.keys(distributions);
+            const distConfig = distributions[distKeys[0]].Properties.DistributionConfig;
+            const patterns = (distConfig.CacheBehaviors ?? []).map((b) => b.PathPattern);
+            assert.ok(patterns.includes('/from-other-copy'), `synth must see routes from every core copy, got: ${JSON.stringify(patterns)}`);
+        });
         it('proxies the reserved /aws-blocks/auth subtree with a single behavior', () => {
             createSpaBuildOutput(tmpDir);
             // A route under the auth subtree (as the auth runtime would mount) must
@@ -1182,6 +1214,12 @@ describe('Hosting', () => {
             const assetDeps = dependsOn.filter((d) => /AssetDeployment/.test(d));
             assert.ok(assetDeps.length >= 1, `BlocksConfigDeployment must DependsOn the asset deployment(s); ` +
                 `found DependsOn=${JSON.stringify(dependsOn)}`);
+            const routeCutoverId = Object.entries(tpl.Resources).find(([id, resource]) => resource.Type === 'AWS::CloudFormation::CustomResource' &&
+                /RouteStoreKeys/.test(id))?.[0];
+            assert.ok(routeCutoverId, 'expected a RouteStoreKeys cutover resource');
+            const routeCutoverDeps = tpl.Resources[routeCutoverId].DependsOn ?? [];
+            assert.ok(routeCutoverDeps.includes(configId), `RouteStoreKeys must DependsOn BlocksConfigDeployment; ` +
+                `found DependsOn=${JSON.stringify(routeCutoverDeps)}`);
         });
     });
     // ── value() integration ─────────────────────────────────────────

package/dist/index.cdk.d.ts

@@ -1,6 +1,7 @@
 export { type ConfigValue, config, DEFAULT_CONFIG_PARAMETER_PREFIX, DEFAULT_SECRET_PARAMETER_PREFIX, isConfig, isManagedValue, isSecret, type ManagedValue, type SecretValue, secret, type ValueKind, } from '@aws-blocks/hosting';
 export { type ApiHandler, ApiNamespace, type BlocksContext } from './api.js';
-export { BlocksBackend, type BlocksBackendProps, type BlocksDefaults, BlocksPresets, BlocksStack, type BlocksThrottling, blocksNodejsBundling, type CoreBlocksBackendProps, type CoreBlocksStackProps, DEFAULT_NODE_RUNTIME, ensureApiGatewayAccount, finalizeConfigRegistry, getConfigLocation, registerConfig, SandboxDisableDeletionProtection, Scope, SHARED_HANDLER_TIMEOUT_SECONDS, synthGuard, } from './cdk/index.js';
+export type { BlocksVpcOptions, ScopeOptions, SubnetRole, VpcContext, VpcRequirements } from './cdk/index.js';
+export { BlocksBackend, type BlocksBackendProps, type BlocksDefaults, BlocksPresets, BlocksStack, type BlocksThrottling, BuildingBlockScope, blocksNodejsBundling, type CoreBlocksBackendProps, type CoreBlocksStackProps, DEFAULT_NODE_RUNTIME, ensureApiGatewayAccount, finalizeConfigRegistry, finalizeDashboards, finalizeTracing, getConfigLocation, getVpcContext, registerConfig, registerDashboardFinalizer, registerTracer, SandboxDisableDeletionProtection, Scope, SHARED_HANDLER_TIMEOUT_SECONDS, synthGuard, } from './cdk/index.js';
 export { _resetConfigCache, getConfig, getConfigSync, loadConfigToProcessEnv, preloadConfig } from './common/config.js';
 export { BlocksStackProps } from './common/index.js';
 export { _resetSdkRegistry, getAllSdkIdentifiers, getSdkIdentifiers, registerSdkIdentifiers, } from './common/sdk-registry.js';

package/dist/index.cdk.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.cdk.d.ts","sourceRoot":"","sources":["../src/index.cdk.ts"],"names":[],"mappings":"AAMA,OAAO,EACN,KAAK,WAAW,EAChB,MAAM,EACN,+BAA+B,EAC/B,+BAA+B,EAC/B,QAAQ,EACR,cAAc,EACd,QAAQ,EACR,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,MAAM,EACN,KAAK,SAAS,GACd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,KAAK,UAAU,EAAE,YAAY,EAAE,KAAK,aAAa,EAAE,MAAM,UAAU,CAAC;AAC7E,OAAO,EACN,aAAa,EACb,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,aAAa,EACb,WAAW,EACX,KAAK,gBAAgB,EACrB,oBAAoB,EACpB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,EACtB,iBAAiB,EACjB,cAAc,EACd,gCAAgC,EAChC,KAAK,EACL,8BAA8B,EAC9B,UAAU,GACV,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,aAAa,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxH,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EACN,iBAAiB,EACjB,oBAAoB,EACpB,iBAAiB,EACjB,sBAAsB,GACtB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACvE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,sBAAsB,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACzG,OAAO,EACN,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,OAAO,EACP,KAAK,mBAAmB,EACxB,KAAK,YAAY,EACjB,KAAK,gBAAgB,GACrB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EACN,wBAAwB,EACxB,KAAK,YAAY,EACjB,WAAW,EACX,KAAK,gBAAgB,EACrB,QAAQ,EACR,KAAK,aAAa,EAClB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,GACxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACN,KAAK,UAAU,EACf,QAAQ,EACR,cAAc,EACd,KAAK,eAAe,GACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACN,kBAAkB,EAClB,mBAAmB,EACnB,iBAAiB,EACjB,UAAU,EACV,KAAK,eAAe,EACpB,aAAa,EACb,mBAAmB,GACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACN,8BAA8B,EAC9B,8BAA8B,EAC9B,yBAAyB,EACzB,yBAAyB,GACzB,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.cdk.d.ts","sourceRoot":"","sources":["../src/index.cdk.ts"],"names":[],"mappings":"AAMA,OAAO,EACN,KAAK,WAAW,EAChB,MAAM,EACN,+BAA+B,EAC/B,+BAA+B,EAC/B,QAAQ,EACR,cAAc,EACd,QAAQ,EACR,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,MAAM,EACN,KAAK,SAAS,GACd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,KAAK,UAAU,EAAE,YAAY,EAAE,KAAK,aAAa,EAAE,MAAM,UAAU,CAAC;AAC7E,YAAY,EAAE,gBAAgB,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAC9G,OAAO,EACN,aAAa,EACb,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,aAAa,EACb,WAAW,EACX,KAAK,gBAAgB,EACrB,kBAAkB,EAClB,oBAAoB,EACpB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,EACtB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,0BAA0B,EAC1B,cAAc,EACd,gCAAgC,EAChC,KAAK,EACL,8BAA8B,EAC9B,UAAU,GACV,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,aAAa,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxH,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EACN,iBAAiB,EACjB,oBAAoB,EACpB,iBAAiB,EACjB,sBAAsB,GACtB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACvE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,sBAAsB,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACzG,OAAO,EACN,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,OAAO,EACP,KAAK,mBAAmB,EACxB,KAAK,YAAY,EACjB,KAAK,gBAAgB,GACrB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EACN,wBAAwB,EACxB,KAAK,YAAY,EACjB,WAAW,EACX,KAAK,gBAAgB,EACrB,QAAQ,EACR,KAAK,aAAa,EAClB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,GACxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACN,KAAK,UAAU,EACf,QAAQ,EACR,cAAc,EACd,KAAK,eAAe,GACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACN,kBAAkB,EAClB,mBAAmB,EACnB,iBAAiB,EACjB,UAAU,EACV,KAAK,eAAe,EACpB,aAAa,EACb,mBAAmB,GACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACN,8BAA8B,EAC9B,8BAA8B,EAC9B,yBAAyB,EACzB,yBAAyB,GACzB,MAAM,oBAAoB,CAAC"}

package/dist/index.cdk.js

@@ -5,7 +5,7 @@
 // getConfig (backend config loader, above) owns that name here.
 export { config, DEFAULT_CONFIG_PARAMETER_PREFIX, DEFAULT_SECRET_PARAMETER_PREFIX, isConfig, isManagedValue, isSecret, secret, } from '@aws-blocks/hosting';
 export { ApiNamespace } from './api.js';
-export { BlocksBackend, BlocksPresets, BlocksStack, blocksNodejsBundling, DEFAULT_NODE_RUNTIME, ensureApiGatewayAccount, finalizeConfigRegistry, getConfigLocation, registerConfig, SandboxDisableDeletionProtection, Scope, SHARED_HANDLER_TIMEOUT_SECONDS, synthGuard, } from './cdk/index.js';
+export { BlocksBackend, BlocksPresets, BlocksStack, BuildingBlockScope, blocksNodejsBundling, DEFAULT_NODE_RUNTIME, ensureApiGatewayAccount, finalizeConfigRegistry, finalizeDashboards, finalizeTracing, getConfigLocation, getVpcContext, registerConfig, registerDashboardFinalizer, registerTracer, SandboxDisableDeletionProtection, Scope, SHARED_HANDLER_TIMEOUT_SECONDS, synthGuard, } from './cdk/index.js';
 export { _resetConfigCache, getConfig, getConfigSync, loadConfigToProcessEnv, preloadConfig } from './common/config.js';
 export { _resetSdkRegistry, getAllSdkIdentifiers, getSdkIdentifiers, registerSdkIdentifiers, } from './common/sdk-registry.js';
 export { BLOCKS_AUTH_PREFIX, BLOCKS_RPC_PREFIX } from './constants.js';

package/dist/lambda-handler.js

@@ -4,7 +4,7 @@
 import { AsyncLocalStorage } from 'node:async_hooks';
 import { ApiError } from './errors.js';
 import { BLOCKS_RPC_PREFIX } from './constants.js';
-import { matchRoute, lockRouteRegistry } from './raw-route.js';
+import { matchRoute, lockRouteRegistry, getRegisteredRoutes, getLoadedCoreCopies } from './raw-route.js';
 import { registerBuiltinRoutes } from './builtin-routes.js';
 import { loadConfigToProcessEnv, isConfigResolved } from './common/config.js';
 import { parseRpcRequest, successResponse, errorResponse, errorResponseFromCatch, methodNotFoundResponse, } from './rpc.js';
@@ -469,8 +469,15 @@ function createHandler(backend) {
                 if (matched) {
                     return handleRawRoute(event, matched.route, matched.params, corsHeaders, signal);
                 }
-                // No RawRoute matched and path is not the RPC endpoint — return 404
+                // No RawRoute matched and path is not the RPC endpoint — return 404.
+                // Log it: an unmatched route used to be entirely silent, which is what
+                // made a split route registry (duplicate @aws-blocks/core copies)
+                // undiagnosable from CloudWatch alone. The path is already in the API
+                // Gateway access logs, so this adds no new category of data.
                 if (!requestPath.startsWith(BLOCKS_RPC_PREFIX)) {
+                    const copies = getLoadedCoreCopies();
+                    const copiesNote = copies > 1 ? ` — ${copies} copies of @aws-blocks/core are loaded` : '';
+                    console.error(`No RawRoute matched ${httpMethod} ${requestPath} (${getRegisteredRoutes().length} routes registered)${copiesNote}`);
                     return {
                         statusCode: 404,
                         headers: {

package/dist/lambda-handler.test.js

@@ -3,7 +3,7 @@
 import { describe, it, beforeEach } from 'node:test';
 import assert from 'node:assert';
 import { createLambdaHandler, _resetCorsPatterns, requestCookies, isApiGatewayHttpEvent, computeHttpDeadlineMs, classifyEvent, buildEventUrl, isLoopbackForwardedHost, TransientConfigError } from './lambda-handler.js';
-import { registerRoute, clearRouteRegistry } from './raw-route.js';
+import { registerRoute, clearRouteRegistry, getRegisteredRoutes } from './raw-route.js';
 import { decodeRpcResponse } from './rpc.js';
 import { _resetConfigCache, _setS3Fetcher } from './common/config.js';
 beforeEach(() => {
@@ -353,6 +353,66 @@ describe('createLambdaHandler — RawRoute body handling', () => {
     });
 });
 // ── Cookie extraction tests ─────────────────────────────────────────────────
+// ── Unmatched RawRoute diagnostics ──────────────────────────────────────────
+//
+// A request that matches no RawRoute used to return 404 without a trace in
+// CloudWatch, which is what made the duplicate-core-copy bug invisible.
+describe('createLambdaHandler — unmatched RawRoute diagnostics', () => {
+    /** Run `fn` with console.error captured; returns the collected lines. */
+    async function captureErrors(fn) {
+        const lines = [];
+        const original = console.error;
+        console.error = (...args) => {
+            lines.push(args.map((a) => String(a)).join(' '));
+        };
+        try {
+            await fn();
+        }
+        finally {
+            console.error = original;
+        }
+        return lines;
+    }
+    it('logs method, path and route count when no RawRoute matches', async () => {
+        registerRoute({ method: 'GET', path: '/known', handler: async (ctx) => ctx.response.send({ ok: true }) });
+        let result;
+        const logged = await captureErrors(async () => {
+            result = await invoke({}, makeEvent({ httpMethod: 'GET', path: '/unknown', body: null }));
+        });
+        assert.strictEqual(result.statusCode, 404);
+        // The count must match the registry the dispatcher actually consulted —
+        // a "0 routes registered" line is the fingerprint of a split registry.
+        const expectedCount = getRegisteredRoutes().length;
+        assert.ok(expectedCount > 0, 'precondition: routes are registered');
+        assert.ok(logged.some((line) => line.includes('No RawRoute matched GET /unknown') &&
+            line.includes(`${expectedCount} routes registered`)), `expected a diagnostic for the unmatched route, got: ${JSON.stringify(logged)}`);
+    });
+    it('does not log when a RawRoute matches', async () => {
+        registerRoute({ method: 'GET', path: '/known', handler: async (ctx) => ctx.response.send({ ok: true }) });
+        const logged = await captureErrors(async () => {
+            const result = await invoke({}, makeEvent({ httpMethod: 'GET', path: '/known', body: null }));
+            assert.strictEqual(result.statusCode, 200);
+        });
+        assert.deepStrictEqual(logged, []);
+    });
+    it('names duplicate core copies as the likely cause when more than one is loaded', async () => {
+        const REGISTRY_KEY = '__AWS_BLOCKS_RAW_ROUTE_REGISTRY_V1__';
+        const state = globalThis[REGISTRY_KEY];
+        assert.ok(state, `route registry state must live on globalThis['${REGISTRY_KEY}']`);
+        const originalCopies = state.copies;
+        state.copies = 2;
+        try {
+            const logged = await captureErrors(async () => {
+                const result = await invoke({}, makeEvent({ httpMethod: 'GET', path: '/unknown', body: null }));
+                assert.strictEqual(result.statusCode, 404);
+            });
+            assert.ok(logged.some((line) => line.includes('2 copies of @aws-blocks/core are loaded')), `expected the copy count in the diagnostic, got: ${JSON.stringify(logged)}`);
+        }
+        finally {
+            state.copies = originalCopies;
+        }
+    });
+});
 describe('createLambdaHandler — cookie extraction', () => {
     it('extracts cookies from lowercase "cookie" header (API Gateway v2)', async () => {
         let capturedCookies = '';

package/dist/raw-route.d.ts

@@ -72,6 +72,16 @@ export interface RegisteredRoute {
     paramNames: string[];
     handler: (context: BlocksContext) => Promise<void>;
 }
+/**
+ * Number of `@aws-blocks/core` copies taking part in the shared route registry.
+ *
+ * `1` for a healthy install. A higher number means the dependency tree carries
+ * duplicates — routes still work (the registry is shared), but it is worth
+ * reporting in diagnostics.
+ *
+ * **Internal.** Not re-exported from the package entry point.
+ */
+export declare function getLoadedCoreCopies(): number;
 /** Prevent further route registration. Call after initialization is complete. */
 export declare function lockRouteRegistry(): void;
 /** Re-allow route registration (useful in tests after lock). */
@@ -92,7 +102,11 @@ export declare function registerRoute(options: RawRouteOptions & {
 }): void;
 /** Return a read-only snapshot of all registered routes. */
 export declare function getRegisteredRoutes(): readonly RegisteredRoute[];
-/** Remove all registered routes and unlock registration (used by tests). */
+/**
+ * Remove all registered routes and unlock registration (used by tests).
+ *
+ * Leaves the copy counter alone — it tracks module copies, not routes.
+ */
 export declare function clearRouteRegistry(): void;
 /**
  * Match an incoming HTTP request against registered routes.

package/dist/raw-route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"raw-route.d.ts","sourceRoot":"","sources":["../src/raw-route.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAKrD,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC;AAE1F,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,UAAU,CAAC;IACnB;;;;;;;;;;;;OAYG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACpD;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,cAAc;;CAEjB,CAAC;AAIX;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAc1E;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,GAAG,MAAM,CAEjG;AAID,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,4EAA4E;IAC5E,IAAI,EAAE,MAAM,CAAC;IACb,0DAA0D;IAC1D,OAAO,EAAE,MAAM,CAAC;IAChB,wDAAwD;IACxD,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,OAAO,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACpD;AAOD,iFAAiF;AACjF,wBAAgB,iBAAiB,IAAI,IAAI,CAExC;AAED,gEAAgE;AAChE,wBAAgB,mBAAmB,IAAI,IAAI,CAE1C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,eAAe,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAuC/E;AAED,4DAA4D;AAC5D,wBAAgB,mBAAmB,IAAI,SAAS,eAAe,EAAE,CAEhE;AAED,4EAA4E;AAC5E,wBAAgB,kBAAkB,IAAI,IAAI,CAGzC;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CACxB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GACX;IAAE,KAAK,EAAE,eAAe,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GAAG,IAAI,CAoBnE;AA6BD;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAA;CAAE,CAgEnF"}
+{"version":3,"file":"raw-route.d.ts","sourceRoot":"","sources":["../src/raw-route.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAKrD,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC;AAE1F,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,UAAU,CAAC;IACnB;;;;;;;;;;;;OAYG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACpD;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,cAAc;;CAEjB,CAAC;AAIX;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAc1E;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,GAAG,MAAM,CAEjG;AAID,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,4EAA4E;IAC5E,IAAI,EAAE,MAAM,CAAC;IACb,0DAA0D;IAC1D,OAAO,EAAE,MAAM,CAAC;IAChB,wDAAwD;IACxD,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,OAAO,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACpD;AAmGD;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C;AAID,iFAAiF;AACjF,wBAAgB,iBAAiB,IAAI,IAAI,CAExC;AAED,gEAAgE;AAChE,wBAAgB,mBAAmB,IAAI,IAAI,CAE1C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,eAAe,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAwC/E;AAED,4DAA4D;AAC5D,wBAAgB,mBAAmB,IAAI,SAAS,eAAe,EAAE,CAEhE;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,IAAI,IAAI,CAIzC;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CACxB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GACX;IAAE,KAAK,EAAE,eAAe,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GAAG,IAAI,CAoBnE;AA6BD;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAA;CAAE,CAgEnF"}