feat(construct): opt-in slim (unbundled) build to cut ~225MB install cost [DRAFT/RFC]

[osama-rizk]

Draft / RFC — not for merge as-is. Opening this to start a discussion and offer a concrete, measurable starting point. It is deliberately additive and changes no default behavior.

Problem

@aws-amplify/data-construct and @aws-amplify/graphql-api-construct ship their non-jsii dependency closure via bundledDependencies (derived from each package's nonJsiiDependencies.json, enforced by scripts/verify-construct-dependencies.ts). That closure is large — each construct unpacks to roughly 225 MB / ~480 nested files.

For pure-npm / TypeScript consumers (e.g. aws-amplify/amplify-backend), this dominates npm install time, and is ~2x worse on Windows CI where antivirus scans every extracted file on close. Because the deps are physically inside the published tarball, consumers cannot opt out via overrides/resolutions — see #3464.

Key observation: every bundled dependency is also declared as a normal dependencies entry (I verified: 144 bundled, 0 that aren't also regular deps). So for a pure-npm consumer an unbundled tarball resolves the exact same packages+versions from the registry (npm hoists/dedupes normally) — a smaller, faster install with identical resolved code, and one consumers can patch via overrides.

What this PR adds

A single additive, opt-in script — scripts/pack-slim-construct.ts (root: yarn pack-slim-construct <constructPackageDir>):

1. Copies the already-built construct package dir to a temp location (never mutating the source or the default build artifact).
2. Removes bundledDependencies from the copy's package.json (leaving dependencies intact) and annotates it (amplifySlimBuild: true).
3. npm packs the copy to emit a slim .tgz.

The default bundledDependencies build — what every existing customer and every jsii/multi-language target consumes — is untouched.

Explicitly out of scope (maintainer decisions)

• How to publish the slim artifact so existing customers see no change: a separate @aws-amplify/*-slim package name, or an opt-in slim dist-tag.
• Which jsii language targets (if any) must retain bundling. Note both packages currently build with jsii but declare "targets": {} (JS/TS only).
• Wiring the slim pack into the release pipeline + a size/regression check.

Compatibility

• Default publish path, CI, and verify-construct-dependencies are unchanged.
• The slim variant is identical in resolved dependency versions for a pure-npm consumer (same dependencies), differing only in delivery (registry-resolved vs. tarball-embedded).

Related

• [Security] Vulnerable bundledDependencies in @aws-amplify/data-construct@1.17.1 #3464 — consumers can't fix bundled deps via overrides/resolutions.
• fix: add missing transitive bundled dependencies to construct packages #3473 — confirms the bundling list is deliberate and hand-maintained.

Testing done

Verified the transform against packages/amplify-data-construct/package.json: 144 bundledDependencies removed, 0 of them lost (all present in the 145 regular dependencies), resulting package.json has no bundledDependencies. Script typechecks under tsc --module nodenext.

Filed from a consumer perspective (amplify-backend e2e install-time investigation). Happy to iterate on the publish mechanism you'd prefer.