@aws-blocks/bb-file-bucket 0.1.5 → 0.2.1

package/dist/index.cdk.test.js

@@ -10,13 +10,22 @@
 import { test } from 'node:test';
 import assert from 'node:assert';
 import * as cdk from 'aws-cdk-lib';
-import { Template } from 'aws-cdk-lib/assertions';
-import { Scope, DEFAULT_NODE_RUNTIME } from '@aws-blocks/core/cdk';
+import { Template, Match } from 'aws-cdk-lib/assertions';
+import { RetentionDays } from 'aws-cdk-lib/aws-logs';
+import { Scope, DEFAULT_NODE_RUNTIME, BlocksPresets } from '@aws-blocks/core/cdk';
 import { FileBucket } from './index.cdk.js';
+// Minimal BlocksStack-shaped parent. The production code path uses BlocksStack,
+// which exposes the shared `executionRole` (blocks grant to it) plus `handler`,
+// both living inside a `cdk.Stack`. We reproduce them here so FileBucket can
+// call grantReadWrite(this.executionRole) and still synth into a real stack. It
+// also carries `defaults` — Building Blocks resolve `scope.defaults` by walking
+// up to the owning BlocksStack/BlocksBackend, falling back to
+// `globalThis.CURRENT_BLOCKS_STACK`, which is this stub in these tests.
 class StubBlocksStack extends cdk.Stack {
     handler;
     executionRole;
     id;
+    defaults = BlocksPresets.production;
     constructor(scope, id) {
         super(scope, id);
         this.id = id;
@@ -32,11 +41,12 @@ class StubBlocksStack extends cdk.Stack {
         });
     }
 }
-function setup() {
+function setup(defaults = BlocksPresets.production) {
     const app = new cdk.App();
     // S3 bucket names must be lowercase. The default-mode FileBucket derives
     // its bucket name from the scope chain, so keep ids lowercase.
     const stack = new StubBlocksStack(app, 'teststack');
+    stack.defaults = defaults;
     const parent = new Scope('app');
     return { stack, parent };
 }
@@ -72,3 +82,251 @@ test('CDK: fromExisting skips derived-name validation even when the chain is ove
         bucket: FileBucket.fromExisting('preexisting-bucket-123'),
     }));
 });
+// ── Security hardening: secure defaults ─────────────────────────────────────
+test('CDK: default FileBucket enforces SSL (aws:SecureTransport deny)', () => {
+    const { stack, parent } = setup();
+    new FileBucket(parent, 'uploads');
+    const template = Template.fromStack(stack);
+    // enforceSSL:true makes CDK attach a bucket policy denying non-TLS requests.
+    template.hasResourceProperties('AWS::S3::BucketPolicy', Match.objectLike({
+        PolicyDocument: Match.objectLike({
+            Statement: Match.arrayWith([
+                Match.objectLike({
+                    Effect: 'Deny',
+                    Condition: { Bool: { 'aws:SecureTransport': 'false' } },
+                }),
+            ]),
+        }),
+    }));
+});
+test('CDK: default FileBucket enables versioning (new secure default)', () => {
+    const { stack, parent } = setup();
+    new FileBucket(parent, 'uploads');
+    const template = Template.fromStack(stack);
+    template.hasResourceProperties('AWS::S3::Bucket', Match.objectLike({
+        VersioningConfiguration: { Status: 'Enabled' },
+    }));
+});
+test('CDK: versioned:false opt-out disables versioning', () => {
+    const { stack, parent } = setup();
+    new FileBucket(parent, 'uploads', { versioned: false });
+    const template = Template.fromStack(stack);
+    // No VersioningConfiguration is emitted when versioning is disabled.
+    const buckets = template.findResources('AWS::S3::Bucket');
+    const props = Object.values(buckets)[0].Properties ?? {};
+    assert.strictEqual(props.VersioningConfiguration, undefined);
+});
+// ── Posture routed through BlocksDefaults (PR review comment C) ──────────────
+test('CDK: default FileBucket adopts the SANDBOX removal posture (DESTROY + autoDelete)', () => {
+    const { stack, parent } = setup(BlocksPresets.sandbox);
+    new FileBucket(parent, 'uploads');
+    const template = Template.fromStack(stack);
+    // DESTROY removal policy plus the auto-delete custom resource CDK wires in
+    // only when autoDeleteObjects is true.
+    template.hasResource('AWS::S3::Bucket', { DeletionPolicy: 'Delete' });
+    template.resourceCountIs('Custom::S3AutoDeleteObjects', 1);
+});
+test('CDK: default FileBucket adopts the PRODUCTION removal posture (RETAIN, no autoDelete)', () => {
+    const { stack, parent } = setup(BlocksPresets.production);
+    new FileBucket(parent, 'uploads');
+    const template = Template.fromStack(stack);
+    template.hasResource('AWS::S3::Bucket', { DeletionPolicy: 'Retain' });
+    template.resourceCountIs('Custom::S3AutoDeleteObjects', 0);
+});
+test('CDK: per-block removalPolicy overrides the resolved default', () => {
+    const { stack, parent } = setup(BlocksPresets.production);
+    new FileBucket(parent, 'uploads', { removalPolicy: 'destroy' });
+    const template = Template.fromStack(stack);
+    // Per-block 'destroy' wins over the production RETAIN default and enables
+    // autoDeleteObjects alongside it.
+    template.hasResource('AWS::S3::Bucket', { DeletionPolicy: 'Delete' });
+    template.resourceCountIs('Custom::S3AutoDeleteObjects', 1);
+});
+test('CDK: accessLogging provisions a locked-down log bucket with lifecycle + logging config', () => {
+    const { stack, parent } = setup();
+    new FileBucket(parent, 'uploads', { accessLogging: true });
+    const template = Template.fromStack(stack);
+    // Main bucket + dedicated access-log bucket.
+    template.resourceCountIs('AWS::S3::Bucket', 2);
+    // Both buckets are TLS-enforced: enforceSSL:true attaches a bucket policy
+    // with an aws:SecureTransport deny to EACH bucket (main + log bucket), so
+    // the log bucket is provably locked down, not just the main one.
+    template.resourceCountIs('AWS::S3::BucketPolicy', 2);
+    const policies = template.findResources('AWS::S3::BucketPolicy');
+    for (const policy of Object.values(policies)) {
+        assert.ok(policy.Properties.PolicyDocument.Statement.some((s) => s.Effect === 'Deny' &&
+            s.Condition?.Bool?.['aws:SecureTransport'] === 'false'), 'every bucket (main + log) must have an enforceSSL deny statement');
+    }
+    // Distinguish the two buckets: the main bucket carries the derived
+    // BucketName; the log bucket does not. Prove the MAIN bucket's
+    // LoggingConfiguration points at the LOG bucket specifically.
+    const buckets = template.findResources('AWS::S3::Bucket');
+    const entries = Object.entries(buckets);
+    const mainEntry = entries.find(([, r]) => r.Properties.BucketName !== undefined);
+    const logEntry = entries.find(([id]) => id !== mainEntry?.[0]);
+    assert.ok(mainEntry && logEntry, 'expected one named main bucket and one log bucket');
+    const [logLogicalId, logResource] = logEntry;
+    // Main bucket delivers its access logs to the log bucket under access-logs/.
+    assert.deepStrictEqual(mainEntry[1].Properties.LoggingConfiguration, { DestinationBucketName: { Ref: logLogicalId }, LogFilePrefix: 'access-logs/' });
+    // Log bucket expires access logs after the framework logRetention default
+    // (production preset => ONE_YEAR => 365 days).
+    assert.ok(logResource.Properties.LifecycleConfiguration.Rules.some((r) => r.ExpirationInDays === 365 && r.Status === 'Enabled'), 'log bucket must expire access logs after the production logRetention (365 days)');
+    // Log bucket blocks all public access.
+    assert.deepStrictEqual(logResource.Properties.PublicAccessBlockConfiguration, {
+        BlockPublicAcls: true,
+        BlockPublicPolicy: true,
+        IgnorePublicAcls: true,
+        RestrictPublicBuckets: true,
+    });
+});
+test('CDK: accessLogging resolves from defaults — a preset opting in creates the log bucket with no per-block option', () => {
+    const { stack, parent } = setup({ ...BlocksPresets.production, accessLogging: true });
+    new FileBucket(parent, 'uploads');
+    const template = Template.fromStack(stack);
+    // No per-block accessLogging option, yet the resolved default enables it.
+    template.resourceCountIs('AWS::S3::Bucket', 2);
+});
+test('CDK: access-log lifecycle expiration equals Duration.days(defaults.logRetention) — sandbox = 7', () => {
+    const { stack, parent } = setup({ ...BlocksPresets.sandbox, accessLogging: true });
+    new FileBucket(parent, 'uploads', { removalPolicy: 'retain' });
+    const template = Template.fromStack(stack);
+    // The per-block 'retain' override wins over the sandbox DESTROY default: the
+    // main bucket is retained on teardown.
+    template.hasResource('AWS::S3::Bucket', { DeletionPolicy: 'Retain' });
+    const buckets = template.findResources('AWS::S3::Bucket');
+    const logEntry = Object.values(buckets).find((r) => r.Properties.BucketName === undefined);
+    assert.ok(logEntry, 'expected a log bucket');
+    assert.ok(logEntry.Properties.LifecycleConfiguration.Rules.some((r) => r.ExpirationInDays === 7 && r.Status === 'Enabled'), 'log bucket must expire access logs after the sandbox logRetention (ONE_WEEK = 7 days)');
+});
+test('CDK: no access-log bucket is created when accessLogging resolves false', () => {
+    const { stack, parent } = setup();
+    new FileBucket(parent, 'uploads');
+    const template = Template.fromStack(stack);
+    template.resourceCountIs('AWS::S3::Bucket', 1);
+});
+test('CDK: logRetention INFINITE omits the access-log lifecycle rule (logs kept indefinitely)', () => {
+    const { stack, parent } = setup({
+        ...BlocksPresets.production,
+        logRetention: RetentionDays.INFINITE,
+        accessLogging: true,
+    });
+    new FileBucket(parent, 'uploads');
+    const template = Template.fromStack(stack);
+    // Main bucket + log bucket both exist.
+    template.resourceCountIs('AWS::S3::Bucket', 2);
+    // The access-LOG bucket (the one without a derived BucketName) must carry NO
+    // LifecycleConfiguration at all — INFINITE means "never expire", so the rule
+    // is omitted rather than emitted at a spurious 9999-day expiry.
+    const buckets = template.findResources('AWS::S3::Bucket');
+    const logEntry = Object.values(buckets).find((r) => r.Properties.BucketName === undefined);
+    assert.ok(logEntry, 'expected a log bucket');
+    assert.strictEqual(logEntry.Properties.LifecycleConfiguration, undefined, 'INFINITE logRetention must omit the access-log LifecycleConfiguration entirely');
+});
+test('CDK: per-block accessLogging:false overrides a defaults-enabled preset (?? treats explicit false as non-nullish)', () => {
+    const { stack, parent } = setup({ ...BlocksPresets.production, accessLogging: true });
+    new FileBucket(parent, 'uploads', { accessLogging: false });
+    const template = Template.fromStack(stack);
+    // Defaults opt logging in, but the explicit per-block `false` wins: only the
+    // main bucket is provisioned, no dedicated access-log bucket.
+    template.resourceCountIs('AWS::S3::Bucket', 1);
+});
+// ── Noncurrent-version expiration (PR review comment A) ──────────────────────
+test('CDK: versioned bucket expires noncurrent versions after the default 90 days', () => {
+    const { stack, parent } = setup();
+    new FileBucket(parent, 'uploads');
+    const template = Template.fromStack(stack);
+    template.hasResourceProperties('AWS::S3::Bucket', Match.objectLike({
+        VersioningConfiguration: { Status: 'Enabled' },
+        LifecycleConfiguration: Match.objectLike({
+            Rules: Match.arrayWith([
+                Match.objectLike({
+                    NoncurrentVersionExpiration: { NoncurrentDays: 90 },
+                    Status: 'Enabled',
+                }),
+            ]),
+        }),
+    }));
+});
+test('CDK: noncurrentVersionExpirationDays is honored', () => {
+    const { stack, parent } = setup();
+    new FileBucket(parent, 'uploads', { noncurrentVersionExpirationDays: 30 });
+    const template = Template.fromStack(stack);
+    template.hasResourceProperties('AWS::S3::Bucket', Match.objectLike({
+        LifecycleConfiguration: Match.objectLike({
+            Rules: Match.arrayWith([
+                Match.objectLike({ NoncurrentVersionExpiration: { NoncurrentDays: 30 } }),
+            ]),
+        }),
+    }));
+});
+test('CDK: noncurrentVersionExpirationDays of 0 throws at synth', () => {
+    const { parent } = setup();
+    assert.throws(() => new FileBucket(parent, 'uploads', { noncurrentVersionExpirationDays: 0 }), (err) => err instanceof Error &&
+        /noncurrentVersionExpirationDays must be a positive integer/.test(err.message) &&
+        /got 0/.test(err.message));
+});
+test('CDK: negative noncurrentVersionExpirationDays throws at synth', () => {
+    const { parent } = setup();
+    assert.throws(() => new FileBucket(parent, 'uploads', { noncurrentVersionExpirationDays: -1 }), (err) => err instanceof Error &&
+        /noncurrentVersionExpirationDays must be a positive integer/.test(err.message) &&
+        /got -1/.test(err.message));
+});
+test('CDK: non-integer noncurrentVersionExpirationDays throws at synth', () => {
+    const { parent } = setup();
+    assert.throws(() => new FileBucket(parent, 'uploads', { noncurrentVersionExpirationDays: 1.5 }), (err) => err instanceof Error &&
+        /noncurrentVersionExpirationDays must be a positive integer/.test(err.message));
+});
+test('CDK: versioned:false bucket has NO noncurrent-version expiration rule', () => {
+    const { stack, parent } = setup();
+    new FileBucket(parent, 'uploads', { versioned: false });
+    const template = Template.fromStack(stack);
+    const buckets = template.findResources('AWS::S3::Bucket');
+    const props = (Object.values(buckets)[0].Properties ?? {});
+    const rules = props.LifecycleConfiguration?.Rules ?? [];
+    assert.ok(!rules.some((r) => r.NoncurrentVersionExpiration !== undefined), 'a non-versioned bucket must not carry a noncurrent-version expiration rule');
+});
+test('CDK: noncurrentVersionExpirationDays FORMAT is validated even when versioned:false', () => {
+    // The format guard is decoupled from the `versioned` gate: a malformed value
+    // must fail loudly at synth regardless of whether versioning is on, rather
+    // than being silently ignored because the rule would not be applied.
+    for (const bad of [0, -1, 1.5]) {
+        const { parent } = setup();
+        assert.throws(() => new FileBucket(parent, 'uploads', { versioned: false, noncurrentVersionExpirationDays: bad }), (err) => err instanceof Error &&
+            /noncurrentVersionExpirationDays must be a positive integer/.test(err.message) &&
+            new RegExp(`got ${bad}`).test(err.message), `versioned:false with noncurrentVersionExpirationDays=${bad} must throw at synth`);
+    }
+});
+test('CDK: versioned:false with NO noncurrent option does not throw and adds no noncurrent rule', () => {
+    const { stack, parent } = setup();
+    assert.doesNotThrow(() => new FileBucket(parent, 'uploads', { versioned: false }));
+    const template = Template.fromStack(stack);
+    const buckets = template.findResources('AWS::S3::Bucket');
+    const props = (Object.values(buckets)[0].Properties ?? {});
+    const rules = props.LifecycleConfiguration?.Rules ?? [];
+    assert.ok(!rules.some((r) => r.NoncurrentVersionExpiration !== undefined), 'versioned:false with no noncurrent option must add no noncurrent-version expiration rule');
+});
+// ── CORS synth guard (unchanged behavior) ───────────────────────────────────
+test('CDK: wildcard-origin CORS with a mutating method throws at synth', () => {
+    const { parent } = setup();
+    assert.throws(() => new FileBucket(parent, 'uploads', {
+        corsRules: [
+            { allowedOrigins: ['*'], allowedMethods: ['GET', 'PUT'] },
+        ],
+    }), (err) => err instanceof Error &&
+        /\*/.test(err.message) &&
+        /PUT/.test(err.message));
+});
+test('CDK: wildcard-origin CORS with only safe methods is allowed', () => {
+    const { parent } = setup();
+    assert.doesNotThrow(() => new FileBucket(parent, 'uploads', {
+        corsRules: [{ allowedOrigins: ['*'], allowedMethods: ['GET', 'HEAD'] }],
+    }));
+});
+test('CDK: explicit-origin CORS with a mutating method is allowed', () => {
+    const { parent } = setup();
+    assert.doesNotThrow(() => new FileBucket(parent, 'uploads', {
+        corsRules: [
+            { allowedOrigins: ['https://app.example.com'], allowedMethods: ['PUT', 'POST'] },
+        ],
+    }));
+});

package/dist/index.mock.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.mock.d.ts","sourceRoot":"","sources":["../src/index.mock.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,EAA0B,MAAM,kBAAkB,CAAC;AAEjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAWpD,OAAO,KAAK,EACX,iBAAiB,EAAE,UAAU,EAAE,aAAa,EAAE,WAAW,EACzD,WAAW,EAAE,QAAQ,EAAE,iBAAiB,EACxC,kBAAkB,EAAE,gBAAgB,EAAE,eAAe,EACrD,aAAa,EAAE,gBAAgB,EAAE,gBAAgB,EACjD,MAAM,YAAY,CAAC;AAEpB,YAAY,EACX,iBAAiB,EAAE,UAAU,EAAE,aAAa,EAAE,aAAa,EAAE,WAAW,EACxE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,iBAAiB,EACjE,kBAAkB,EAAE,gBAAgB,EAAE,eAAe,EACrD,sBAAsB,EAAE,oBAAoB,EAC5C,mBAAmB,EAAE,sBAAsB,EAAE,sBAAsB,EACnE,aAAa,EAAE,gBAAgB,EAAE,gBAAgB,GACjD,MAAM,YAAY,CAAC;AAGpB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAGzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAyB/C;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,UAAU,CAAC,CAAC,SAAS,iBAAiB,GAAG,iBAAiB,CAAE,SAAQ,KAAK;IACrF,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,SAAS,CAAU;IAE3B,2FAA2F;IAC3F,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC;gBAEf,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IAkBvD;;;;;;;;;;;;;;;OAeG;IACG,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,OAAO,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IA0BnF;;;;;;;;;;;;;;OAcG;IACG,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAyBhF;;;;;;;;;;;;;;;;OAgBG;IACG,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAoBxE;;;;;;;;;;;;OAYG;IACG,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAMjD;;;;;;;;;;;OAWG;IACG,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IAU1E;;;;;;;;;;;;;;OAcG;IACG,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC;IAOpE;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACG,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAa7F;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACG,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAkB1F;;;;;;;;;;;;;;;;OAgBG;IACI,IAAI,CAAC,OAAO,CAAC,EAAE,WAAW,GAAG,aAAa,CAAC,QAAQ,CAAC;IAY3D;;;;;;;;;;;;;;;;OAgBG;IACG,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IA2B5D;;;;;;;;;;;;;;OAcG;IACG,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUpE;;;;OAIG;IACH,MAAM,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,iBAAiB;IAM1D,OAAO,CAAC,WAAW;IAOnB,OAAO,CAAC,SAAS;IAMjB,OAAO,CAAC,QAAQ;IAIhB,OAAO,CAAC,eAAe;IAIvB,OAAO,CAAC,YAAY;IAOpB,OAAO,CAAC,OAAO;IAcf,OAAO,CAAC,aAAa;CASrB"}
+{"version":3,"file":"index.mock.d.ts","sourceRoot":"","sources":["../src/index.mock.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,EAA0B,MAAM,kBAAkB,CAAC;AAEjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAWpD,OAAO,KAAK,EACX,iBAAiB,EAAE,UAAU,EAAE,aAAa,EAAE,WAAW,EACzD,WAAW,EAAE,QAAQ,EAAE,iBAAiB,EACxC,kBAAkB,EAAE,gBAAgB,EAAE,eAAe,EACrD,aAAa,EAAE,gBAAgB,EAAE,gBAAgB,EACjD,MAAM,YAAY,CAAC;AAEpB,YAAY,EACX,iBAAiB,EAAE,UAAU,EAAE,aAAa,EAAE,aAAa,EAAE,WAAW,EACxE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,iBAAiB,EACjE,kBAAkB,EAAE,gBAAgB,EAAE,eAAe,EACrD,sBAAsB,EAAE,oBAAoB,EAC5C,mBAAmB,EAAE,sBAAsB,EAAE,sBAAsB,EACnE,aAAa,EAAE,gBAAgB,EAAE,gBAAgB,GACjD,MAAM,YAAY,CAAC;AAGpB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAGzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAoC/C;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,UAAU,CAAC,CAAC,SAAS,iBAAiB,GAAG,iBAAiB,CAAE,SAAQ,KAAK;IACrF,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,SAAS,CAAU;IAE3B,2FAA2F;IAC3F,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC;gBAEf,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IAsDvD;;;;;;;;;;;;;;;OAeG;IACG,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,OAAO,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IA0BnF;;;;;;;;;;;;;;OAcG;IACG,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAyBhF;;;;;;;;;;;;;;;;OAgBG;IACG,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAoBxE;;;;;;;;;;;;OAYG;IACG,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAMjD;;;;;;;;;;;OAWG;IACG,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IAU1E;;;;;;;;;;;;;;OAcG;IACG,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC;IAOpE;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACG,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAa7F;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACG,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAkB1F;;;;;;;;;;;;;;;;OAgBG;IACI,IAAI,CAAC,OAAO,CAAC,EAAE,WAAW,GAAG,aAAa,CAAC,QAAQ,CAAC;IAY3D;;;;;;;;;;;;;;;;OAgBG;IACG,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IA2B5D;;;;;;;;;;;;;;OAcG;IACG,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUpE;;;;OAIG;IACH,MAAM,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,iBAAiB;IAM1D,OAAO,CAAC,WAAW;IAOnB,OAAO,CAAC,SAAS;IAMjB,OAAO,CAAC,QAAQ;IAIhB,OAAO,CAAC,eAAe;IAIvB,OAAO,CAAC,YAAY;IAOpB,OAAO,CAAC,OAAO;IAcf,OAAO,CAAC,aAAa;CASrB"}

package/dist/index.mock.js

@@ -13,6 +13,14 @@ import { BB_NAME, BB_VERSION } from './version.js';
 export { FileBucketErrors } from './errors.js';
 // ── Helpers ─────────────────────────────────────────────────────────────────
 const MAX_KEY_BYTES = 1024; // S3 key limit
+// Mirrors of the CDK synth-time-guard constants (index.cdk.ts). Duplicated here
+// rather than imported — the CDK entry (index.cdk.ts) pulls in aws-cdk-lib and
+// must never be imported into the mock runtime. Kept byte-identical to the CDK
+// definitions so the two guards below reject exactly what `cdk synth` rejects.
+/** Default number of days after which noncurrent object versions expire. */
+const DEFAULT_NONCURRENT_VERSION_EXPIRATION_DAYS = 90;
+/** HTTP methods that mutate bucket state; unsafe to expose to wildcard origins. */
+const MUTATING_CORS_METHODS = ['PUT', 'POST', 'DELETE'];
 function blocksError(name, message) {
     const err = new Error(`${name}: ${message}`);
     err.name = name;
@@ -57,9 +65,41 @@ export class FileBucket extends Scope {
         // parity with the CDK path.
         if (!options?.bucket)
             validateBucketName(this.fullId);
+        // Mirror the CDK's two synth-time guards (index.cdk.ts) VERBATIM so a
+        // local/unit run rejects exactly what `cdk synth` would. Gated on
+        // `!options?.bucket` alongside validateBucketName: the CDK's
+        // external-bucket branch returns before these checks, so a wrapped
+        // bucket bypasses them here too. Plain `throw new Error(...)` (no
+        // `name`, no blocksError factory) to match the CDK path exactly — using
+        // blocksError() would set an `error.name` the CDK guards don't, breaking
+        // mock↔cdk parity.
+        if (!options?.bucket) {
+            // Reject unsafe CORS: a wildcard origin ('*') combined with a mutating
+            // method (PUT/POST/DELETE) lets any site issue state-changing
+            // cross-origin requests.
+            for (const rule of options?.corsRules ?? []) {
+                if (rule.allowedOrigins.includes('*')) {
+                    const mutating = rule.allowedMethods.filter(m => MUTATING_CORS_METHODS.includes(m));
+                    if (mutating.length > 0) {
+                        throw new Error(`FileBucket "${this.fullId}": CORS rule with wildcard origin '*' must not allow mutating method(s) ${mutating.join(', ')}. ` +
+                            `Specify explicit allowedOrigins (e.g. 'https://app.example.com') for ${mutating.join(', ')} instead of '*'.`);
+                    }
+                }
+            }
+            // Reject a non-positive or non-integer noncurrent-version expiration.
+            // The FORMAT is validated regardless of `versioned` (matching CDK) so
+            // a malformed value is caught even when versioning is off.
+            if (options?.noncurrentVersionExpirationDays !== undefined) {
+                const days = options.noncurrentVersionExpirationDays;
+                if (!Number.isInteger(days) || days <= 0) {
+                    throw new Error(`FileBucket "${this.fullId}": noncurrentVersionExpirationDays must be a positive integer (got ${days}). ` +
+                        `Omit it to use the default of ${DEFAULT_NONCURRENT_VERSION_EXPIRATION_DAYS} days.`);
+                }
+            }
+        }
         this.log = options?.logger ?? new Logger(this, 'logger', { level: 'error' });
         this.dataDir = getMockDataDir(this);
-        this.versioned = options?.versioned ?? false;
+        this.versioned = options?.versioned ?? true;
         this.registerClientMiddleware('@aws-blocks/bb-file-bucket/middleware');
         this.registerDevAttachment('@aws-blocks/bb-file-bucket/file-server');
         registerSdkIdentifiers(this.fullId, { bucketName: `mock-${this.fullId}` });

package/dist/index.test.js

@@ -298,8 +298,11 @@ test('versioned: listVersions returns newest first', async () => {
 });
 // ── Static type checks: conditional version types ───────────────────────────
 function _conditionalVersionTypeChecks() {
-    const plain = new FileBucket(scope, 'plain');
+    // Explicit opt-out selects the non-versioned option types.
+    const plain = new FileBucket(scope, 'plain', { versioned: false });
     const versioned = new FileBucket(scope, 'versioned', { versioned: true });
+    // No options now defaults to versioned-aware typings (Default: true).
+    const dflt = new FileBucket(scope, 'dflt');
     // Non-versioned: get/delete accept no options
     plain.get('file.txt');
     plain.delete('file.txt');
@@ -315,4 +318,85 @@ function _conditionalVersionTypeChecks() {
     versioned.delete('file.txt');
     versioned.delete('file.txt', { versionId: 'v1' });
     versioned.getUrl('file.txt', { versionId: 'v1', expiresIn: 600 });
+    // Default (no options) is versioned-aware: versionId is accepted.
+    dflt.get('file.txt');
+    dflt.get('file.txt', { versionId: 'v1' });
+    dflt.delete('file.txt', { versionId: 'v1' });
+    dflt.getUrl('file.txt', { versionId: 'v1', expiresIn: 600 });
 }
+// ── Versioning on by default (new secure default) ───────────────────────────
+test('default (no options) bucket is versioned: put creates versions', async () => {
+    const bucket = new FileBucket(scope, 'default-versioned');
+    await bucket.put('file.txt', 'v1');
+    await bucket.put('file.txt', 'v2');
+    const versions = await bucket.listVersions('file.txt');
+    assert.strictEqual(versions.length, 2);
+    assert.strictEqual(versions[0].isCurrent, true);
+});
+test('versioned:false opt-out disables versioning at runtime', async () => {
+    const bucket = new FileBucket(scope, 'optout-versioned', { versioned: false });
+    await bucket.put('file.txt', 'v1');
+    await bucket.put('file.txt', 'v2');
+    const versions = await bucket.listVersions('file.txt');
+    assert.strictEqual(versions.length, 0);
+    const file = await bucket.get('file.txt');
+    assert.ok(file);
+    assert.strictEqual(file.body.toString(), 'v2');
+});
+// ── Synth-time validation parity (mock mirrors the CDK's index.cdk.ts guards) ─
+// The mock reproduces the CDK's two synth-time guards VERBATIM so a local/unit
+// run fails the same way `cdk synth` would (mock↔cdk parity). Mirrors the
+// corresponding cases in index.cdk.test.ts.
+test('mock: noncurrentVersionExpirationDays of 0 throws', () => {
+    assert.throws(() => new FileBucket(scope, 'uploads', { noncurrentVersionExpirationDays: 0 }), (err) => err instanceof Error &&
+        /noncurrentVersionExpirationDays must be a positive integer/.test(err.message) &&
+        /got 0/.test(err.message));
+});
+test('mock: negative noncurrentVersionExpirationDays throws', () => {
+    assert.throws(() => new FileBucket(scope, 'uploads', { noncurrentVersionExpirationDays: -1 }), (err) => err instanceof Error &&
+        /noncurrentVersionExpirationDays must be a positive integer/.test(err.message) &&
+        /got -1/.test(err.message));
+});
+test('mock: non-integer noncurrentVersionExpirationDays throws', () => {
+    assert.throws(() => new FileBucket(scope, 'uploads', { noncurrentVersionExpirationDays: 1.5 }), (err) => err instanceof Error &&
+        /noncurrentVersionExpirationDays must be a positive integer/.test(err.message));
+});
+test('mock: noncurrentVersionExpirationDays FORMAT is validated even when versioned:false', () => {
+    // Format guard is decoupled from the `versioned` gate (matches CDK): a
+    // malformed value must fail regardless of whether versioning is on.
+    assert.throws(() => new FileBucket(scope, 'uploads', { versioned: false, noncurrentVersionExpirationDays: 0 }), (err) => err instanceof Error &&
+        /noncurrentVersionExpirationDays must be a positive integer/.test(err.message) &&
+        /got 0/.test(err.message));
+});
+test('mock: valid noncurrentVersionExpirationDays does not throw', () => {
+    assert.doesNotThrow(() => new FileBucket(scope, 'uploads', { noncurrentVersionExpirationDays: 30 }));
+});
+test('mock: wildcard-origin CORS with a mutating method throws', () => {
+    assert.throws(() => new FileBucket(scope, 'uploads', {
+        corsRules: [{ allowedOrigins: ['*'], allowedMethods: ['GET', 'PUT'] }],
+    }), (err) => err instanceof Error &&
+        /\*/.test(err.message) &&
+        /PUT/.test(err.message));
+});
+test('mock: wildcard-origin CORS with only safe methods is allowed', () => {
+    assert.doesNotThrow(() => new FileBucket(scope, 'uploads', {
+        corsRules: [{ allowedOrigins: ['*'], allowedMethods: ['GET', 'HEAD'] }],
+    }));
+});
+test('mock: explicit-origin CORS with a mutating method is allowed', () => {
+    assert.doesNotThrow(() => new FileBucket(scope, 'uploads', {
+        corsRules: [{ allowedOrigins: ['https://app.example.com'], allowedMethods: ['PUT', 'POST'] }],
+    }));
+});
+test('mock: when both guards are tripped, the CORS guard fires first (matches CDK order)', () => {
+    // The CDK (index.cdk.ts) evaluates the CORS guard before the noncurrent
+    // check, so a config that violates BOTH must surface the CORS message — not
+    // the noncurrent one — in the mock too, keeping mock↔cdk parity.
+    assert.throws(() => new FileBucket(scope, 'uploads', {
+        noncurrentVersionExpirationDays: 0,
+        corsRules: [{ allowedOrigins: ['*'], allowedMethods: ['PUT'] }],
+    }), (err) => err instanceof Error &&
+        /CORS rule with wildcard origin/.test(err.message) &&
+        /PUT/.test(err.message) &&
+        !/noncurrentVersionExpirationDays/.test(err.message));
+});

package/dist/types.d.ts

@@ -4,13 +4,61 @@
  */
 import type { ChildLogger } from '@aws-blocks/bb-logger';
 export interface FileBucketOptions {
-    /** Enable object versioning. Default: false. */
+    /**
+     * Enable object versioning. Default: true. Pass `false` to opt out.
+     *
+     * Note for the version-aware method typings (`get`/`delete`/`getUrl`/
+     * `getFileHandle`): selecting the NON-versioned (optionless) typings
+     * requires the literal `versioned: false`. A non-literal `boolean` value
+     * (e.g. one widened from a variable) — or omitting the option entirely —
+     * resolves to the versioned-aware typings, which match the default-on
+     * runtime behavior. See {@link GetOptionsFor} et al.
+     */
     versioned?: boolean;
     /** CORS rules for browser-based access. */
     corsRules?: CorsRule[];
     /** Lifecycle rules for automatic object expiration or transitions. */
     lifecycleRules?: LifecycleRule[];
-    /** Wrap an existing S3 bucket instead of creating one. */
+    /**
+     * Enable S3 server access logging. Default: false (opt-in).
+     *
+     * When `true`, a dedicated, locked-down log bucket is provisioned
+     * (all public access blocked, S3-managed encryption, SSL enforced) and
+     * the main bucket delivers its access logs there under the
+     * `access-logs/` prefix. Access logs are expired automatically after the
+     * stack-wide `logRetention` default (see `BlocksDefaults.logRetention`);
+     * `RetentionDays.INFINITE` keeps them indefinitely (no expiry rule).
+     *
+     * Resolves from the stack `defaults.accessLogging` when omitted, so a
+     * production-postured stack can opt every FileBucket into logging without
+     * a per-block option. Ignored by the mock and browser runtimes (no AWS
+     * resource).
+     */
+    accessLogging?: boolean;
+    /**
+     * Days after which NONCURRENT object versions are permanently expired,
+     * bounding the storage cost that versioning would otherwise let grow
+     * unbounded. Only applies when versioning is enabled (the default).
+     * Default: 90.
+     *
+     * Must be a positive integer; a non-positive or non-integer value is
+     * rejected at synth. There is no "disable" sentinel — noncurrent-version
+     * expiration is always on for a versioned bucket to cap version growth. To
+     * opt out entirely, disable versioning (`versioned: false`), which drops
+     * the rule. Ignored by the mock and browser runtimes (no AWS resource).
+     */
+    noncurrentVersionExpirationDays?: number;
+    /**
+     * Wrap an existing S3 bucket instead of creating one.
+     *
+     * @remarks
+     * When set, FileBucket binds to the supplied bucket as-is and returns early:
+     * NONE of the secure defaults this construct normally applies are applied to
+     * an externally-supplied bucket — not `enforceSSL`, versioning + noncurrent-version
+     * expiration, server access logging, `blockPublicAccess`, encryption, nor the
+     * wildcard-CORS guard. You own that bucket's security posture; configure these
+     * on the bucket itself (or via its own CDK construct) before wrapping it.
+     */
     bucket?: ExternalBucketRef;
     /**
      * CDK removal behavior for the underlying S3 bucket. When omitted,
@@ -74,24 +122,32 @@ export interface VersionedGetUrlOptions extends GetUrlOptions {
 /**
  * Resolves the get options type based on whether versioning is enabled.
  * Versioned buckets accept `{ versionId }`, non-versioned accept no options.
+ * Versioning is on by default, so only an explicit `versioned: false` selects
+ * the non-versioned (optionless) shape. A non-literal `boolean` (widened from
+ * a variable) or an absent `versioned` resolves to the versioned-aware shape,
+ * matching the default-on runtime behavior.
  */
 export type GetOptionsFor<O extends FileBucketOptions> = O extends {
-    versioned: true;
-} ? VersionedGetOptions : undefined;
+    versioned: false;
+} ? undefined : VersionedGetOptions;
 /**
  * Resolves the delete options type based on whether versioning is enabled.
  * Versioned buckets accept `{ versionId }`, non-versioned accept no options.
+ * Versioning is on by default, so only an explicit `versioned: false` selects
+ * the non-versioned (optionless) shape.
  */
 export type DeleteOptionsFor<O extends FileBucketOptions> = O extends {
-    versioned: true;
-} ? VersionedDeleteOptions : undefined;
+    versioned: false;
+} ? undefined : VersionedDeleteOptions;
 /**
  * Resolves the getUrl/getFileHandle options type based on whether versioning is enabled.
  * Versioned buckets accept `{ expiresIn, versionId }`, non-versioned accept `{ expiresIn }`.
+ * Versioning is on by default, so only an explicit `versioned: false` selects
+ * the non-versioned shape.
  */
 export type GetUrlOptionsFor<O extends FileBucketOptions> = O extends {
-    versioned: true;
-} ? VersionedGetUrlOptions : GetUrlOptions;
+    versioned: false;
+} ? GetUrlOptions : VersionedGetUrlOptions;
 export interface FileContent {
     /** The file body as a Buffer. */
     body: Buffer;
@@ -136,6 +192,11 @@ export interface LifecycleRule {
     /** Days after creation to transition to Infrequent Access. */
     transitionToIaDays?: number;
 }
+/**
+ * A reference to a pre-existing S3 bucket to wrap via {@link FileBucketOptions.bucket}
+ * (see that field's remarks — a wrapped bucket does not receive FileBucket's
+ * secure defaults). Produced by `FileBucket.fromExisting(bucketName)`.
+ */
 export interface ExternalBucketRef {
     readonly __brand: 'ExternalBucketRef';
     readonly bucketName: string;

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAGA;;;GAGG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAIzD,MAAM,WAAW,iBAAiB;IACjC,gDAAgD;IAChD,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,2CAA2C;IAC3C,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC;IACvB,sEAAsE;IACtE,cAAc,CAAC,EAAE,aAAa,EAAE,CAAC;IACjC,0DAA0D;IAC1D,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAC3B;;;;;;;;;;;;;;;;;OAiBG;IACH,aAAa,CAAC,EAAE,SAAS,GAAG,QAAQ,CAAC;IACrC,yGAAyG;IACzG,MAAM,CAAC,EAAE,WAAW,CAAC;CACrB;AAID,MAAM,WAAW,UAAU;IAC1B,iDAAiD;IACjD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uCAAuC;IACvC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,kCAAkC;IAClC,YAAY,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC7B,gDAAgD;IAChD,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC7B,gDAAgD;IAChD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4CAA4C;IAC5C,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,WAAW;IAC3B,yDAAyD;IACzD,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAID,4CAA4C;AAC5C,MAAM,WAAW,mBAAmB;IACnC,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,+CAA+C;AAC/C,MAAM,WAAW,sBAAsB;IACtC,4EAA4E;IAC5E,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,6DAA6D;AAC7D,MAAM,WAAW,sBAAuB,SAAQ,aAAa;IAC5D,2CAA2C;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAID;;;GAGG;AACH,MAAM,MAAM,aAAa,CAAC,CAAC,SAAS,iBAAiB,IACpD,CAAC,SAAS;IAAE,SAAS,EAAE,IAAI,CAAA;CAAE,GAAG,mBAAmB,GAAG,SAAS,CAAC;AAEjE;;;GAGG;AACH,MAAM,MAAM,gBAAgB,CAAC,CAAC,SAAS,iBAAiB,IACvD,CAAC,SAAS;IAAE,SAAS,EAAE,IAAI,CAAA;CAAE,GAAG,sBAAsB,GAAG,SAAS,CAAC;AAEpE;;;GAGG;AACH,MAAM,MAAM,gBAAgB,CAAC,CAAC,SAAS,iBAAiB,IACvD,CAAC,SAAS;IAAE,SAAS,EAAE,IAAI,CAAA;CAAE,GAAG,sBAAsB,GAAG,aAAa,CAAC;AAIxE,MAAM,WAAW,WAAW;IAC3B,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,6BAA6B;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,uCAAuC;IACvC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,0BAA0B;IAC1B,IAAI,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,QAAQ;IACxB,sBAAsB;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,0BAA0B;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,mCAAmC;IACnC,YAAY,EAAE,IAAI,CAAC;CACnB;AAED,4CAA4C;AAC5C,MAAM,WAAW,eAAe;IAC/B,8BAA8B;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,qCAAqC;IACrC,YAAY,EAAE,IAAI,CAAC;IACnB,qBAAqB;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,oDAAoD;IACpD,SAAS,EAAE,OAAO,CAAC;CACnB;AAID,MAAM,WAAW,QAAQ;IACxB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,cAAc,EAAE,CAAC,KAAK,GAAG,KAAK,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAC,EAAE,CAAC;IAC/D,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,aAAa;IAC7B,kCAAkC;IAClC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6CAA6C;IAC7C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,8DAA8D;IAC9D,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,iBAAiB;IACjC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC5B;AAID,+FAA+F;AAC/F,MAAM,WAAW,kBAAkB;IAClC,kEAAkE;IAClE,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,6BAA6B;IAC7B,MAAM,IAAI,MAAM,CAAC;IACjB,uFAAuF;IACvF,MAAM,IAAI,sBAAsB,CAAC;CACjC;AAED,6FAA6F;AAC7F,MAAM,WAAW,gBAAgB;IAChC,+CAA+C;IAC/C,MAAM,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,GAAG,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvD,6BAA6B;IAC7B,MAAM,IAAI,MAAM,CAAC;IACjB,uFAAuF;IACvF,MAAM,IAAI,oBAAoB,CAAC;CAC/B;AAID,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAC;IAC1C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,oBAAoB;IACpC,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAGA;;;GAGG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAIzD,MAAM,WAAW,iBAAiB;IACjC;;;;;;;;;OASG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,2CAA2C;IAC3C,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC;IACvB,sEAAsE;IACtE,cAAc,CAAC,EAAE,aAAa,EAAE,CAAC;IACjC;;;;;;;;;;;;;;OAcG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;;;;;;;OAWG;IACH,+BAA+B,CAAC,EAAE,MAAM,CAAC;IACzC;;;;;;;;;;OAUG;IACH,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAC3B;;;;;;;;;;;;;;;;;OAiBG;IACH,aAAa,CAAC,EAAE,SAAS,GAAG,QAAQ,CAAC;IACrC,yGAAyG;IACzG,MAAM,CAAC,EAAE,WAAW,CAAC;CACrB;AAID,MAAM,WAAW,UAAU;IAC1B,iDAAiD;IACjD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uCAAuC;IACvC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,kCAAkC;IAClC,YAAY,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC7B,gDAAgD;IAChD,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC7B,gDAAgD;IAChD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4CAA4C;IAC5C,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,WAAW;IAC3B,yDAAyD;IACzD,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAID,4CAA4C;AAC5C,MAAM,WAAW,mBAAmB;IACnC,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,+CAA+C;AAC/C,MAAM,WAAW,sBAAsB;IACtC,4EAA4E;IAC5E,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,6DAA6D;AAC7D,MAAM,WAAW,sBAAuB,SAAQ,aAAa;IAC5D,2CAA2C;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAID;;;;;;;GAOG;AACH,MAAM,MAAM,aAAa,CAAC,CAAC,SAAS,iBAAiB,IACpD,CAAC,SAAS;IAAE,SAAS,EAAE,KAAK,CAAA;CAAE,GAAG,SAAS,GAAG,mBAAmB,CAAC;AAElE;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,CAAC,CAAC,SAAS,iBAAiB,IACvD,CAAC,SAAS;IAAE,SAAS,EAAE,KAAK,CAAA;CAAE,GAAG,SAAS,GAAG,sBAAsB,CAAC;AAErE;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,CAAC,CAAC,SAAS,iBAAiB,IACvD,CAAC,SAAS;IAAE,SAAS,EAAE,KAAK,CAAA;CAAE,GAAG,aAAa,GAAG,sBAAsB,CAAC;AAIzE,MAAM,WAAW,WAAW;IAC3B,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,6BAA6B;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,uCAAuC;IACvC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,0BAA0B;IAC1B,IAAI,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,QAAQ;IACxB,sBAAsB;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,0BAA0B;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,mCAAmC;IACnC,YAAY,EAAE,IAAI,CAAC;CACnB;AAED,4CAA4C;AAC5C,MAAM,WAAW,eAAe;IAC/B,8BAA8B;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,qCAAqC;IACrC,YAAY,EAAE,IAAI,CAAC;IACnB,qBAAqB;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,oDAAoD;IACpD,SAAS,EAAE,OAAO,CAAC;CACnB;AAID,MAAM,WAAW,QAAQ;IACxB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,cAAc,EAAE,CAAC,KAAK,GAAG,KAAK,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAC,EAAE,CAAC;IAC/D,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,aAAa;IAC7B,kCAAkC;IAClC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6CAA6C;IAC7C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,8DAA8D;IAC9D,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IACjC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC5B;AAID,+FAA+F;AAC/F,MAAM,WAAW,kBAAkB;IAClC,kEAAkE;IAClE,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,6BAA6B;IAC7B,MAAM,IAAI,MAAM,CAAC;IACjB,uFAAuF;IACvF,MAAM,IAAI,sBAAsB,CAAC;CACjC;AAED,6FAA6F;AAC7F,MAAM,WAAW,gBAAgB;IAChC,+CAA+C;IAC/C,MAAM,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,GAAG,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvD,6BAA6B;IAC7B,MAAM,IAAI,MAAM,CAAC;IACjB,uFAAuF;IACvF,MAAM,IAAI,oBAAoB,CAAC;CAC/B;AAID,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAC;IAC1C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,oBAAoB;IACpC,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B"}

package/dist/version.d.ts

@@ -1,3 +1,3 @@
 export declare const BB_NAME = "FileBucket";
-export declare const BB_VERSION = "0.1.5";
+export declare const BB_VERSION = "0.2.1";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -1,3 +1,3 @@
 // Auto-generated by scripts/generate-version.mjs — do not edit manually
 export const BB_NAME = 'FileBucket';
-export const BB_VERSION = '0.1.5';
+export const BB_VERSION = '0.2.1';

package/package.json

@@ -1,6 +1,12 @@
 {
   "name": "@aws-blocks/bb-file-bucket",
-  "version": "0.1.5",
+  "version": "0.2.1",
+  "keywords": [
+    "aws-blocks",
+    "storage",
+    "s3",
+    "file-upload"
+  ],
   "repository": {
     "type": "git",
     "url": "git+https://github.com/aws-devtools-labs/aws-blocks.git",
@@ -50,8 +56,8 @@
     "test": "node --test dist/index.test.js dist/index.cdk.test.js dist/scan.test.js dist/file-server.test.js dist/url-encoding.test.js dist/path-containment.test.js dist/bucket-name.test.js"
   },
   "dependencies": {
-    "@aws-blocks/bb-logger": "^0.1.5",
-    "@aws-blocks/core": "^0.3.0",
+    "@aws-blocks/bb-logger": "^0.2.0",
+    "@aws-blocks/core": "^0.5.0",
     "@aws-sdk/client-s3": "^3.0.0",
     "@aws-sdk/s3-request-presigner": "^3.0.0"
   },