hecks 3.12.0 → 3.14.0

data/lib/hecks/hecks/tooling.bluebook

@@ -10,19 +10,19 @@ Hecks.bluebook "Hecks" do
     identified_by :domain
 
     value_object "DomainPath" do
-      attribute :value, String, pattern: '[^\t\n\r]'
+      attribute :value, String, matches: :not_empty
 
       invariant("a domain is named by its path") { !value.to_s.empty? }
     end
 
     value_object "ChapterName" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
 
       invariant("a chapter is named") { !value.to_s.empty? }
     end
 
     value_object "AggregateName" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
 
       invariant("an aggregate is named") { !value.to_s.empty? }
     end
@@ -128,13 +128,13 @@ Hecks.bluebook "Hecks" do
     identified_by :run
 
     value_object "RunKey" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
 
       invariant("a run is named") { !value.to_s.empty? }
     end
 
     value_object "DomainList" do
-      attribute :value, String, pattern: '[^\t\n\r]'
+      attribute :value, String, matches: :not_empty
     end
 
     value_object "ProfileName" do
@@ -254,7 +254,7 @@ Hecks.bluebook "Hecks" do
 
     # A directory: the source repository (`from`), or the project the files land in (`root`).
     value_object "Location" do
-      attribute :value, String, pattern: '[^\t\n\r]'
+      attribute :value, String, matches: :not_empty
     end
 
     value_object "Report" do
@@ -383,18 +383,18 @@ Hecks.bluebook "Hecks" do
     identified_by :run
 
     value_object "RegistryKey" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
 
       invariant("a release is named") { !value.to_s.empty? }
     end
 
     value_object "PackageName" do
-      attribute :value, String, pattern: '^[a-z][a-z0-9_]*$'
+      attribute :value, String, matches: :snake_name
     end
 
     # The registry repository: the current directory when absent.
     value_object "Location" do
-      attribute :value, String, pattern: '[^\t\n\r]'
+      attribute :value, String, matches: :not_empty
     end
 
     value_object "Report" do
@@ -520,14 +520,14 @@ Hecks.bluebook "Hecks" do
     identified_by :run
 
     value_object "LaunchKey" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
 
       invariant("a launch is named") { !value.to_s.empty? }
     end
 
     # Domain directories under the project, comma separated.
     value_object "DomainList" do
-      attribute :value, String, pattern: '[^\t\n\r]'
+      attribute :value, String, matches: :not_empty
     end
 
     value_object "Switch" do
@@ -546,12 +546,12 @@ Hecks.bluebook "Hecks" do
 
     # Where the new domain goes; the domain's snake-cased name under the current directory when absent.
     value_object "TargetDir" do
-      attribute :value, String, pattern: '[^\t\n\r]'
+      attribute :value, String, matches: :not_empty
     end
 
     # Who is interviewed; asked for at the terminal when absent.
     value_object "ExpertName" do
-      attribute :value, String, pattern: '[^\t\n\r]'
+      attribute :value, String, matches: :not_empty
     end
 
     value_object "Note" do
@@ -724,7 +724,7 @@ Hecks.bluebook "Hecks" do
     identified_by :run
 
     value_object "BuildKey" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
 
       invariant("a build is named") { !value.to_s.empty? }
     end
@@ -737,18 +737,18 @@ Hecks.bluebook "Hecks" do
 
     # A generated module: the directory name a domain was built as.
     value_object "ModuleName" do
-      attribute :value, String, pattern: '^[a-z][a-z0-9_]*$'
+      attribute :value, String, matches: :snake_name
     end
 
     # A JSON file of steps for a domain to replay.
     value_object "ScriptPath" do
-      attribute :value, String, pattern: '[^\t\n\r]'
+      attribute :value, String, matches: :not_empty
     end
 
     # What a build is replayed through: `native`, `build` (the domain's own feature), a `.wasm`
     # module, or a binary.
     value_object "Artifact" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
     end
 
     # A Rust target triple: `<arch>-<vendor>-<os>` with an optional `-<env>`. The toolchain
@@ -759,7 +759,7 @@ Hecks.bluebook "Hecks" do
 
     # The directory a host build stages its files in.
     value_object "StagePath" do
-      attribute :value, String, pattern: '[^\t\n\r]'
+      attribute :value, String, matches: :not_empty
     end
 
     value_object "Count" do
@@ -1014,14 +1014,14 @@ Hecks.bluebook "Hecks" do
     identified_by :run
 
     value_object "FuzzKey" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
 
       invariant("a sweep is named") { !value.to_s.empty? }
     end
 
     # A domain directory; a sweep with none covers every domain of a hecks checkout.
     value_object "DomainPath" do
-      attribute :value, String, pattern: '[^\t\n\r]'
+      attribute :value, String, matches: :not_empty
 
       invariant("a domain is named by its path") { !value.to_s.empty? }
     end
@@ -1054,7 +1054,7 @@ Hecks.bluebook "Hecks" do
     end
 
     value_object "BinaryPath" do
-      attribute :value, String, pattern: '[^\t\n\r]'
+      attribute :value, String, matches: :not_empty
     end
 
     value_object "Format" do
@@ -1062,7 +1062,7 @@ Hecks.bluebook "Hecks" do
     end
 
     value_object "OutputPath" do
-      attribute :value, String, pattern: '[^\t\n\r]'
+      attribute :value, String, matches: :not_empty
     end
 
     value_object "Report" do

data/lib/hecks/language/bluebook/aggregate.bluebook

@@ -440,6 +440,7 @@ Hecks.bluebook "Bluebook" do
       member keyword: "attribute",       context: "Aggregate", at: "",  named: "default",  kind: "literal",  required: "false", fills: "default"
       member keyword: "attribute",       context: "Aggregate", at: "",  named: "optional", kind: "flag",     required: "false", fills: "optional"
       member keyword: "attribute",       context: "Aggregate", at: "",  named: "pattern",  kind: "text",     required: "false", fills: "pattern"
+      member keyword: "attribute",       context: "Aggregate", at: "",  named: "matches",  kind: "symbol",   required: "false", fills: "matches"
       member keyword: "attribute",       context: "Aggregate", at: "",  named: "admits",   kind: "text",     required: "false", fills: "admits"
       member keyword: "attribute",       context: "Aggregate", at: "",  named: "one_of",   kind: "list",     required: "false", fills: "one_of"
       member keyword: "invariant",       context: "Aggregate", at: "1", named: "",         kind: "text",     required: "true",  fills: "description"

data/lib/hecks/language/bluebook/command.bluebook

@@ -368,6 +368,7 @@ Hecks.bluebook "Bluebook" do
       member keyword: "attribute",       context: "Command", at: "",  named: "default",   kind: "literal",  required: "false", fills: "default"
       member keyword: "attribute",       context: "Command", at: "",  named: "optional",  kind: "flag",     required: "false", fills: "optional"
       member keyword: "attribute",       context: "Command", at: "",  named: "pattern",   kind: "text",     required: "false", fills: "pattern"
+      member keyword: "attribute",       context: "Command", at: "",  named: "matches",  kind: "symbol",   required: "false", fills: "matches"
       member keyword: "attribute",       context: "Command", at: "",  named: "admits",    kind: "text",     required: "false", fills: "admits"
       member keyword: "attribute",       context: "Command", at: "",  named: "one_of",    kind: "list",     required: "false", fills: "one_of"
       # `reason` is required in practice; CommandBuilder#corrects_impl refuses its absence.

data/lib/hecks/language/bluebook/entity.bluebook

@@ -319,6 +319,7 @@ Hecks.bluebook "Bluebook" do
       member keyword: "attribute",       context: "Entity", at: "",  named: "default",  kind: "literal",  required: "false", fills: "default"
       member keyword: "attribute",       context: "Entity", at: "",  named: "optional", kind: "flag",     required: "false", fills: "optional"
       member keyword: "attribute",       context: "Entity", at: "",  named: "pattern",  kind: "text",     required: "false", fills: "pattern"
+      member keyword: "attribute",       context: "Entity", at: "",  named: "matches",  kind: "symbol",   required: "false", fills: "matches"
       member keyword: "attribute",       context: "Entity", at: "",  named: "admits",   kind: "text",     required: "false", fills: "admits"
       member keyword: "attribute",       context: "Entity", at: "",  named: "one_of",   kind: "list",     required: "false", fills: "one_of"
       member keyword: "reference_to",    context: "Entity", at: "1", named: "",         kind: "constant", required: "true",  fills: "type"

data/lib/hecks/language/bluebook/query.bluebook

@@ -229,6 +229,7 @@ Hecks.bluebook "Bluebook" do
       member keyword: "attribute",       context: "Query", at: "",  named: "default",  kind: "literal",  required: "false", fills: "default"
       member keyword: "attribute",       context: "Query", at: "",  named: "optional", kind: "flag",     required: "false", fills: "optional"
       member keyword: "attribute",       context: "Query", at: "",  named: "pattern",  kind: "text",     required: "false", fills: "pattern"
+      member keyword: "attribute",       context: "Query", at: "",  named: "matches",  kind: "symbol",   required: "false", fills: "matches"
       member keyword: "attribute",       context: "Query", at: "",  named: "admits",   kind: "text",     required: "false", fills: "admits"
       member keyword: "attribute",       context: "Query", at: "",  named: "one_of",   kind: "list",     required: "false", fills: "one_of"
       member keyword: "reference_to",    context: "Query", at: "1", named: "",         kind: "constant", required: "true",  fills: "type"

data/lib/hecks/language/bluebook/shape.bluebook

@@ -19,14 +19,14 @@ Hecks.bluebook "Bluebook" do
     end
 
     value_object "ValueObjectName" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
       invariant("a value object is named") { !value.to_s.empty? }
     end
 
     value_object "ShapeField" do
-      attribute :name,    String, pattern: '[^ \t\n\r]'
-      attribute :type,    String, pattern: '[^ \t\n\r]'
-      attribute :list,    String, pattern: '[^ \t\n\r]'
+      attribute :name,    String, matches: :present
+      attribute :type,    String, matches: :present
+      attribute :list,    String, matches: :present
       attribute :optional, String, optional: true
       attribute :pattern,  String, optional: true
       # optional: a declaration with no default has none
@@ -40,8 +40,8 @@ Hecks.bluebook "Bluebook" do
     end
 
     value_object "Assertion" do
-      attribute :description, String, pattern: '[^ \t\n\r]'
-      attribute :canonical,   String, pattern: '[^ \t\n\r]'
+      attribute :description, String, matches: :present
+      attribute :canonical,   String, matches: :present
       invariant("an assertion description is present") { !description.to_s.empty? }
       invariant("an assertion canonical form is present") { !canonical.to_s.empty? }
     end
@@ -59,7 +59,7 @@ Hecks.bluebook "Bluebook" do
     end
 
     value_object "Pair" do
-      attribute :key,   String, pattern: '[^ \t\n\r]'
+      attribute :key,   String, matches: :present
       attribute :value, String
       # Keys must be named; values may be empty or numeric.
       invariant("a pair key is present") { !key.to_s.empty? }
@@ -230,6 +230,7 @@ Hecks.bluebook "Bluebook" do
       member keyword: "attribute",       context: "ValueObject", at: "",  named: "default",  kind: "literal",  required: "false", fills: "default"
       member keyword: "attribute",       context: "ValueObject", at: "",  named: "optional", kind: "flag",     required: "false", fills: "optional"
       member keyword: "attribute",       context: "ValueObject", at: "",  named: "pattern",  kind: "text",     required: "false", fills: "pattern"
+      member keyword: "attribute",       context: "ValueObject", at: "",  named: "matches",  kind: "symbol",   required: "false", fills: "matches"
       member keyword: "attribute",       context: "ValueObject", at: "",  named: "admits",   kind: "text",     required: "false", fills: "admits"
       member keyword: "attribute",       context: "ValueObject", at: "",  named: "one_of",   kind: "list",     required: "false", fills: "one_of"
       member keyword: "invariant",       context: "ValueObject", at: "1", named: "",         kind: "text",     required: "true",  fills: "description"

data/lib/hecks/language/hecksagon/port_operation.bluebook

@@ -80,6 +80,7 @@ Hecks.bluebook "Hecksagon" do
       member keyword: "attribute",       context: "PortOperation", at: "",  named: "default",  kind: "literal",  required: "false", fills: "default"
       member keyword: "attribute",       context: "PortOperation", at: "",  named: "optional", kind: "flag",     required: "false", fills: "optional"
       member keyword: "attribute",       context: "PortOperation", at: "",  named: "pattern",  kind: "text",     required: "false", fills: "pattern"
+      member keyword: "attribute",       context: "PortOperation", at: "",  named: "matches",  kind: "symbol",   required: "false", fills: "matches"
       member keyword: "attribute",       context: "PortOperation", at: "",  named: "admits",   kind: "text",     required: "false", fills: "admits"
       member keyword: "attribute",       context: "PortOperation", at: "",  named: "one_of",   kind: "list",     required: "false", fills: "one_of"
       member keyword: "emits",           context: "PortOperation", at: "1", named: "", kind: "text", required: "true", fills: "emits"

data/lib/hecks/projections/deploy/fargate/cdn/lines.rb

@@ -13,7 +13,8 @@ module Hecks
             #   (`:origin`,
             #   `:path` for an item, `:viewer_protocol`, `:methods`, `:compress`, `:cache_policy`,
             #   `:origin_request_policy`), and optionally `:response_headers_policy`, each policy as
-            #   `[id_or_intrinsic, comment_or_nil]`
+            #   `[id_or_intrinsic, comment_or_nil]`, and `:edge_function`, the logical id of a
+            #   viewer-request function
             # @param base [String] the indentation of `key`, or of the list item's dash
             # @return [Array<String>] the lines
             def behavior_lines(key, entry, base)
@@ -91,6 +92,16 @@ module Hecks
               lines << "#{pad}Compress: #{entry[:compress]}" if entry.key?(:compress)
               lines << policy_line(pad, "CachePolicyId", entry[:cache_policy])
               lines.concat(optional_policy_lines(entry, pad))
+              lines.concat(function_lines(entry, pad))
+            end
+
+            # The viewer-request function a behaviour names (`:edge_function`, the logical id of an
+            # `AWS::CloudFront::Function` in the same template), if any.
+            def function_lines(entry, pad)
+              return [] unless entry[:edge_function]
+
+              ["#{pad}FunctionAssociations:", "#{pad}  - EventType: viewer-request",
+               "#{pad}    FunctionARN: !GetAtt #{entry[:edge_function]}.FunctionARN"]
             end
 
             def optional_policy_lines(entry, pad)

data/lib/hecks/projections/site/admin_cms/templates/membership.rb

@@ -15,10 +15,12 @@ module Hecks
               // Signing in (endpoints/sso.ts) proved the person was admitted then; this asks again, so that
               // disabling or removing someone locks them out on their next request, not when their session runs out.
               //
-              // The question is the host's own account route, which answers only for a person who holds a role
-              // and is not disabled, asked with a short account token signed by the secret the host checks (the
-              // content system's AUTH_SECRET is the host's SESSION_SECRET). The answer is remembered for a minute
-              // per email so every admin request does not cost a round trip.
+              // The question is the host's members list, which the host answers (403) only to a person holding
+              // one of the admin roles, and the list's own row for the caller must hold such a role and not be
+              // disabled. It is asked with a short account token signed by the secret the host checks (the content
+              // system's AUTH_SECRET is the host's SESSION_SECRET). The answer is remembered for a minute per
+              // email so every admin request does not cost a round trip. Being admitted to the site is not enough:
+              // a member with no admin role is refused here, as the site's own admin gate refuses them.
               import { accountToken, resolveAccountCookieName } from "@hecks/client";
 
               const DEFAULT_URL = __HOST_DEFAULT__;
@@ -38,7 +40,7 @@ module Hecks
 
               export interface MembershipOptions {
                 url?: string;
-                /** The host route asked: the account route (any admitted person) by default, the members list for admin roles only. */
+                /** The host route asked: the account route (any admitted person) by default; `adminCheck` asks the members list, for admin roles only. */
                 path?: string;
                 /** Decides from the host's answer; the default is any 2xx. */
                 accept?: (res: Response, email: string) => Promise<boolean>;
@@ -83,8 +85,6 @@ module Hecks
                 };
               }
 
-              export const membership = membershipCheck();
-
               /** The roles the host's own admin gate passes. */
               export const ADMIN_ROLES = __ROLES__;
 
@@ -106,6 +106,9 @@ module Hecks
                   path: __MEMBERS_PATH__,
                   accept: async (res, email) => holdsAdminRole(await res.json().catch(() => null), email),
                 });
+
+              /** The check the sign-in endpoint and the session strategy use: admin roles only, never a plain member. */
+              export const membership = adminCheck();
             TS
           end
         end

data/lib/hecks/projections/site/edge/behaviours.rb

@@ -10,7 +10,8 @@ module Hecks
         # compression give it. A route needs none of its own when the behaviour that would match its
         # path anyway (the nearest broader route's, else the default one) is the same. The rest keep
         # the order the table declares, which is the order CloudFront matches in, and a route that
-        # a broader, different one before it would shadow is refused.
+        # a broader, different one before it would shadow is refused. The edge function a route
+        # names is part of its behaviour, so a route is folded only into one that names the same.
         class Behaviours
           # The default behaviour's path: the row that holds the settings of everything else.
           DEFAULT_PATH = "/*"
@@ -58,11 +59,14 @@ module Hecks
             policy = @edge.policy(row.cache, row.origin)
             {
               path: pattern, origin: @edge.upstream(row.origin).id, methods: methods([row]),
-              viewer_protocol: protocol(row), compress: row.compress,
-              cache_policy: Checks.resolve(policy.cache),
-              origin_request_policy: reference(policy.origin_request),
-              response_headers_policy: reference(policy.response_headers)
-            }
+              viewer_protocol: protocol(row), compress: row.compress
+            }.merge(policies(policy)).merge(row.edge ? { edge_function: row.edge } : {})
+          end
+
+          def policies(policy)
+            { cache_policy:            Checks.resolve(policy.cache),
+              origin_request_policy:   reference(policy.origin_request),
+              response_headers_policy: reference(policy.response_headers) }
           end
 
           def reference(text) = text.nil? || text == "none" ? nil : Checks.resolve(text)

data/lib/hecks/projections/site/edge/checks.rb

@@ -2,6 +2,7 @@
 
 require_relative "findings"
 require_relative "route_checks"
+require_relative "function_checks"
 
 module Hecks
   module Projections
@@ -47,6 +48,7 @@ module Hecks
             check_policies
             check_upstreams
             RouteChecks.new(@edge, @rows, @vocabulary, @problems).call
+            FunctionChecks.new(@edge, @rows, @vocabulary, @problems).call
           end
 
           private

data/lib/hecks/projections/site/edge/function_checks.rb

@@ -0,0 +1,104 @@
+# frozen_string_literal: true
+
+require_relative "findings"
+require_relative "function_code"
+
+module Hecks
+  module Projections
+    module Site
+      class Edge
+        # The part of the edge checks that reads the `EdgeFunction` rows and the routes that name
+        # them: each row is well formed and safe to write into a function, each route names a row
+        # that exists, and no row is left that nothing names.
+        class FunctionChecks
+          include Findings
+
+          # The longest logical id a function takes; the name it is given in the account adds the
+          # stack name, and CloudFront allows 64 characters in all.
+          NAME_LIMIT = 40
+
+          # @param edge [Edge] the edge being read, its rows set
+          # @param rows [Array<Table::Row>] the route table's rows
+          # @param vocabulary [Hash{Symbol => Array<String>}] the Site chapter's closed sets
+          # @param problems [Array<String>] collects each problem found, one line each
+          def initialize(edge, rows, vocabulary, problems)
+            @edge = edge
+            @rows = rows
+            @vocabulary = vocabulary
+            @problems = problems
+          end
+
+          # @return [void]
+          def call
+            @edge.functions.each { |function| check_function(function) }
+            repeated(@edge.functions.map(&:name), "EdgeFunction", &:itself)
+            check_derived_names
+            check_routes
+            check_unused
+          end
+
+          private
+
+          def check_function(function)
+            label = "EdgeFunction #{function.name}"
+            check_name(label, function)
+            member_of(label, "kind", function.kind, :edge_function_kind)
+            check_host(label, "host", function.host)
+            function.alias_list.each { |host| check_alias(label, function, host) }
+            check_paths(label, function)
+          end
+
+          # Two logical ids that differ only in case would be given one function name.
+          def check_derived_names
+            names = @edge.functions.map { |function| function.name.to_s }.uniq
+            names.group_by { |name| FunctionCode.kebab(name) }.each do |kebab, together|
+              problem("EdgeFunction", "#{together.join(" and ")} would both be named #{kebab}") if together.size > 1
+            end
+          end
+
+          def check_name(label, function)
+            name = function.name.to_s
+            problem(label, "is not a logical id") unless Checks::LOGICAL_ID.match?(name)
+            problem(label, "is longer than #{NAME_LIMIT} characters") if name.size > NAME_LIMIT
+          end
+
+          def check_host(label, field, host)
+            return if FunctionCode.host?(host)
+
+            problem(label, "has #{field} #{host.inspect}; #{field == "alias" ? "an" : "a"} #{field} is a lowercase hostname " \
+                           "such as app.example.test")
+          end
+
+          def check_alias(label, function, host)
+            check_host(label, "alias", host)
+            problem(label, "has alias #{host}, which is its host; an alias is another host") if host == function.host
+          end
+
+          def check_paths(label, function)
+            problem(label, "needs at least one path to watch") if function.path_list.empty?
+            function.path_list.each do |path|
+              next if FunctionCode.path?(path)
+
+              problem(label, "has path #{path.inspect}; a path is exact, starts with / and holds letters, digits and . _ ~ - /")
+            end
+          end
+
+          # Every `edge:` names a row, and a route the CDN never sees has no edge to run it.
+          def check_routes
+            @rows.select(&:edge).each do |row|
+              problem(row.path, "names edge #{row.edge}, which no EdgeFunction declares") unless @edge.function(row.edge)
+              problem(row.path, "names edge #{row.edge} and has cdn false; the edge never sees it") unless row.cdn
+            end
+          end
+
+          def check_unused
+            named = @rows.select(&:edge).map(&:edge)
+            @edge.functions.reject { |function| named.include?(function.name) }.each do |function|
+              problem("EdgeFunction #{function.name}", "is named by no route; remove the row or add edge: to a route")
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/hecks/projections/site/edge/function_code.rb

@@ -0,0 +1,86 @@
+# frozen_string_literal: true
+
+require "json"
+
+module Hecks
+  module Projections
+    module Site
+      class Edge
+        # The CloudFront function resource of a `redirect_host` row, and the JavaScript in it.
+        #
+        # The code is a fixed template (`redirect_host.js.tmpl`) with three values filled in: the
+        # canonical host, the alias hosts and the watched paths. A value is never escaped. One
+        # outside the strict shape of a lowercase hostname, or of a path made of unreserved
+        # characters, is refused, so no value can end a JavaScript string, a YAML block or a
+        # CloudFormation expression. The checks refuse such a row when it is read, and `code`
+        # refuses again, since it is the last step before the text is written.
+        module FunctionCode
+          # A lowercase hostname of at least two labels, as the host header is compared after
+          # lowercasing.
+          HOST = /\A([a-z0-9]([a-z0-9-]*[a-z0-9])?\.)+[a-z]{2,}\z/
+
+          # A path of unreserved characters and slashes; no query, no percent escape, no quote.
+          PATH = %r{\A/[A-Za-z0-9._~/-]*\z}
+
+          # The longest hostname and path a function takes.
+          HOST_LIMIT = 253
+          PATH_LIMIT = 200
+
+          TEMPLATE = File.join(__dir__, "redirect_host.js.tmpl")
+          PLACEHOLDER = /__(CANONICAL|ALIASES|WATCHED)__/
+
+          module_function
+
+          # @param text [String] a candidate hostname
+          # @return [Boolean] whether it may be written into a function
+          def host?(text) = text.is_a?(String) && text.size <= HOST_LIMIT && HOST.match?(text)
+
+          # @param text [String] a candidate path
+          # @return [Boolean] whether it may be written into a function
+          def path?(text) = text.is_a?(String) && text.size <= PATH_LIMIT && PATH.match?(text)
+
+          # @param function [Edge::Function] a `redirect_host` row
+          # @return [String] the function's JavaScript, ending in a newline
+          # @raise [ArgumentError] when a host or path is outside the strict shapes
+          def code(function)
+            ensure_safe(function)
+            values = { "CANONICAL" => function.host, "ALIASES" => function.alias_list, "WATCHED" => function.path_list }
+            File.read(TEMPLATE).gsub(PLACEHOLDER) { JSON.generate(values.fetch(Regexp.last_match(1))) }
+          end
+
+          # @param name [String] a function's logical id
+          # @return [String] the hyphenated name the function carries, such as `host-redirect`
+          def kebab(name) = name.gsub(/([a-z0-9])([A-Z])/, '\1-\2').downcase
+
+          # @param function [Edge::Function] a `redirect_host` row
+          # @return [String] the resource, from the left margin, ending in a newline
+          def resource(function)
+            [
+              "#{function.name}:", "  Type: AWS::CloudFront::Function", "  Properties:",
+              "    Name: !Sub \"${AWS::StackName}-#{kebab(function.name)}\"", "    AutoPublish: true",
+              "    FunctionConfig:", "      Comment: Redirect the watched paths from an alias to the canonical host",
+              "      Runtime: cloudfront-js-2.0", "    FunctionCode: |",
+              *code(function).each_line.map { |line| line.strip.empty? ? "" : "      #{line.chomp}" }
+            ].join("\n") << "\n"
+          end
+
+          def ensure_safe(function)
+            raise ArgumentError, "EdgeFunction #{function.name} has no path to watch" if function.path_list.empty?
+
+            bad = unsafe_values(function)
+            return if bad.empty?
+
+            raise ArgumentError, "EdgeFunction #{function.name} has values outside the hostname and path shapes: " \
+                                 "#{bad.map(&:inspect).join(", ")}"
+          end
+
+          def unsafe_values(function)
+            [function.host, *function.alias_list].reject { |host| host?(host) } +
+              function.path_list.reject { |path| path?(path) }
+          end
+          private_class_method :ensure_safe, :unsafe_values
+        end
+      end
+    end
+  end
+end

data/lib/hecks/projections/site/edge/redirect_host.js.tmpl

@@ -0,0 +1,65 @@
+function handler(event) {
+  var request = event.request;
+  var canonical = __CANONICAL__;
+  var aliases = __ALIASES__;
+  var watched = __WATCHED__;
+  var header = request.headers.host;
+  var host = header && header.value ? header.value.toLowerCase().replace(/:\d+$/, "") : "";
+  var reads = request.method === "GET" || request.method === "HEAD";
+  if (!reads || watched.indexOf(request.uri) < 0) { return request; }
+  if (host === canonical || aliases.indexOf(host) < 0) { return request; }
+  var parts = [];
+  Object.keys(request.querystring).forEach(function (key) {
+    var entry = request.querystring[key];
+    var values = entry.multiValue ? entry.multiValue.map(function (item) { return item.value; }) : [entry.value];
+    values.forEach(function (value) {
+      var name = encode(key);
+      parts.push(value === "" || value === undefined ? name : name + "=" + encode(value));
+    });
+  });
+  var query = parts.length ? "?" + parts.join("&") : "";
+  return {
+    statusCode: 302,
+    statusDescription: "Found",
+    headers: {
+      location: { value: "https://" + canonical + request.uri + query },
+      "cache-control": { value: "no-store" }
+    }
+  };
+}
+
+// Percent-encodes what cannot stand in a query string and keeps what is already encoded, so the
+// location header carries no space, control character, "&" or "#" whether the runtime hands over
+// the raw text or the decoded one. It walks the text one UTF-16 unit at a time and pairs the
+// surrogates itself (a lone one becomes U+FFFD), because CloudFront's regex engine refuses a
+// pattern that names a surrogate code point and fails the whole function at compile time.
+var SAFE = /[A-Za-z0-9\-._~!$'()*,;:@\/?+]/;
+var HEX = /^[0-9A-Fa-f]{2}$/;
+var REPLACEMENT = "%EF%BF%BD";
+
+function encode(text) {
+  var input = String(text);
+  var output = "";
+  var index = 0;
+  while (index < input.length) {
+    var unit = input.charAt(index);
+    var code = input.charCodeAt(index);
+    index += 1;
+    if (code >= 55296 && code <= 56319) {
+      var next = index < input.length ? input.charCodeAt(index) : 0;
+      if (next >= 56320 && next <= 57343) {
+        output += encodeURIComponent(unit + input.charAt(index));
+        index += 1;
+      } else {
+        output += REPLACEMENT;
+      }
+    } else if (code >= 56320 && code <= 57343) {
+      output += REPLACEMENT;
+    } else if (unit === "%") {
+      output += HEX.test(input.substr(index, 2)) ? unit : "%25";
+    } else {
+      output += SAFE.test(unit) ? unit : encodeURIComponent(unit);
+    }
+  }
+  return output;
+}