@aws-blocks/core 0.1.12 → 0.1.17

package/dist/scripts/deploy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/scripts/deploy.ts"],"names":[],"mappings":"AAaA,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,wBAAsB,MAAM,CAAC,OAAO,EAAE,aAAa,iBA0FlD"}
+{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/scripts/deploy.ts"],"names":[],"mappings":"AAaA,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,wBAAsB,MAAM,CAAC,OAAO,EAAE,aAAa,iBAiGlD"}

package/dist/scripts/deploy.js

@@ -8,7 +8,7 @@ import { ensureSecrets, loadProductionEnv } from './ensure-secrets.js';
 import { applyExternalMigrations } from './external-migrations-step.js';
 import { trackCommand } from '../telemetry/trackCommand.js';
 import { getCdkTelemetryEnv } from './cdk-telemetry-env.js';
-import { runSync } from './run-command.js';
+import { runStreaming, buildCdkDeployArgs } from './deploy-stream.js';
 export async function deploy(options) {
     return trackCommand('deploy', async () => {
         console.log('🏗️  Preparing deployment...');
@@ -44,14 +44,14 @@ export async function deploy(options) {
         console.log('   (This may take a few minutes on first deploy)');
         console.log('   - Backend API (Lambda + API Gateway)');
         console.log('   - Frontend hosting (S3 + CloudFront)');
+        console.log('   Streaming CloudFormation events below; the deploy keeps running if this');
+        console.log('   process is backgrounded (press Ctrl-C, or send SIGTERM twice, to abort).');
         try {
-            runSync("npx", [
-                "cdk", "deploy",
-                "--require-approval", "never",
-                "--outputs-file", ".blocks-sandbox/outputs.json",
-                "--context", `projectRoot=${options.projectRoot}`,
-            ], {
-                stdio: 'inherit',
+            await runStreaming("npx", buildCdkDeployArgs({
+                projectRoot: options.projectRoot,
+                outputsFile: '.blocks-sandbox/outputs.json',
+            }), {
+                label: 'cdk deploy',
                 cwd: options.projectRoot,
                 env: {
                     ...process.env,
@@ -61,7 +61,14 @@ export async function deploy(options) {
             });
         }
         catch (error) {
-            console.error('\n❌ Deployment failed.');
+            // Terminal verdict on stdout: a caller that only captures stdout (the case
+            // that produced phantom failures) must still be able to tell a failed
+            // deploy from a killed process. This banner deliberately moved off stderr,
+            // so grepping stderr for this exact string no longer matches — the failure
+            // *reason* is still there. The CDK CLI keeps error-level output on stderr
+            // even under `--ci`, and the entrypoint prints the error itself with
+            // `console.error(error)`.
+            console.log('\n❌ Deployment failed.');
             throw error;
         }
         const outputs = JSON.parse(readFileSync(join(options.projectRoot, '.blocks-sandbox', 'outputs.json'), 'utf-8'));

package/dist/scripts/dev-server-cors.test.js

@@ -2,7 +2,8 @@
 // SPDX-License-Identifier: Apache-2.0
 import { describe, it } from 'node:test';
 import assert from 'node:assert';
-import { resolveDevCorsOrigin, LOCALHOST_PATTERN } from './dev-server.js';
+import { resolveDevCorsOrigin, LOCALHOST_PATTERN, buildDevCorsHeaders } from './dev-server.js';
+import { CORS_MAX_AGE } from '../cors.js';
 describe('resolveDevCorsOrigin — dev server CORS', () => {
     it('reflects localhost origin back as-is', () => {
         assert.strictEqual(resolveDevCorsOrigin('http://localhost:3000'), 'http://localhost:3000');
@@ -21,3 +22,20 @@ describe('resolveDevCorsOrigin — dev server CORS', () => {
         assert.strictEqual(resolveDevCorsOrigin('http://localhost.evil.com'), 'http://localhost:3000');
     });
 });
+describe('buildDevCorsHeaders — dev server header set', () => {
+    it('shares one Max-Age value with the Lambda path so the two cannot drift', () => {
+        assert.strictEqual(buildDevCorsHeaders('http://localhost:3000')['Access-Control-Max-Age'], CORS_MAX_AGE);
+    });
+    it('sets Vary: Origin because Allow-Origin is reflected per request', () => {
+        assert.strictEqual(buildDevCorsHeaders('http://localhost:3000')['Vary'], 'Origin');
+        assert.strictEqual(buildDevCorsHeaders('https://evil.com')['Vary'], 'Origin');
+    });
+    it('reflects an allowed localhost origin', () => {
+        const headers = buildDevCorsHeaders('http://127.0.0.1:5173');
+        assert.strictEqual(headers['Access-Control-Allow-Origin'], 'http://127.0.0.1:5173');
+        assert.strictEqual(headers['Access-Control-Allow-Credentials'], 'true');
+    });
+    it('does not reflect a non-localhost origin', () => {
+        assert.strictEqual(buildDevCorsHeaders('https://evil.com')['Access-Control-Allow-Origin'], 'http://localhost:3000');
+    });
+});

package/dist/scripts/dev-server-rpc.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=dev-server-rpc.test.d.ts.map

package/dist/scripts/dev-server-rpc.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dev-server-rpc.test.d.ts","sourceRoot":"","sources":["../../src/scripts/dev-server-rpc.test.ts"],"names":[],"mappings":""}

package/dist/scripts/dev-server-rpc.test.js

@@ -0,0 +1,157 @@
+import { afterEach, describe, it } from 'node:test';
+import assert from 'node:assert';
+import { spawn } from 'node:child_process';
+import { createServer } from 'node:http';
+import { mkdirSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+const __dirname = dirname(fileURLToPath(import.meta.url));
+async function getAvailablePort() {
+    const server = createServer();
+    await new Promise((resolve, reject) => {
+        server.once('error', reject);
+        server.listen(0, '127.0.0.1', resolve);
+    });
+    const address = server.address();
+    assert.ok(address && typeof address === 'object');
+    const { port } = address;
+    // TOCTOU: brief window between closing this probe and the dev server binding
+    // the port; port: 0 would require the dev server to expose its assigned port.
+    await new Promise((resolve, reject) => server.close(error => error ? reject(error) : resolve()));
+    return port;
+}
+describe('dev-server RPC integration', () => {
+    let devProcess = null;
+    let tempDir = null;
+    afterEach(async () => {
+        if (devProcess && devProcess.exitCode === null) {
+            devProcess.kill('SIGTERM');
+            await new Promise((resolve) => {
+                const timeout = setTimeout(() => {
+                    devProcess?.kill('SIGKILL');
+                    resolve();
+                }, 2_000);
+                devProcess?.once('exit', () => {
+                    clearTimeout(timeout);
+                    resolve();
+                });
+            });
+        }
+        if (tempDir)
+            rmSync(tempDir, { recursive: true, force: true });
+    });
+    it('returns success for a void handler in verbose mode', async () => {
+        const port = await getAvailablePort();
+        tempDir = join(tmpdir(), `dev-rpc-test-${process.pid}-${Date.now()}`);
+        mkdirSync(tempDir, { recursive: true });
+        writeFileSync(join(tempDir, 'backend.ts'), `
+export const testApi = {
+  pingVoid: async () => undefined,
+};
+`);
+        // Polyfill process.loadEnvFile for Node <20.6; ENOENT means no .env file.
+        writeFileSync(join(tempDir, 'preload.mjs'), `
+if (!process.loadEnvFile) {
+  process.loadEnvFile = () => { throw Object.assign(new Error('ENOENT'), { code: 'ENOENT' }); };
+}
+`);
+        writeFileSync(join(tempDir, 'run-dev.ts'), `
+import { startDevServer } from '${join(__dirname, 'dev-server.js').replace(/\\/g, '/')}';
+startDevServer({ backendPath: '${join(tempDir, 'backend.ts').replace(/\\/g, '/')}', port: ${port} });
+`);
+        const tsxBin = join(__dirname, '..', '..', '..', '..', 'node_modules', '.bin', 'tsx');
+        devProcess = spawn(tsxBin, ['--import', join(tempDir, 'preload.mjs'), join(tempDir, 'run-dev.ts')], {
+            cwd: tempDir,
+            env: {
+                ...process.env,
+                AWS_BLOCKS_DISABLE_TELEMETRY: '1',
+                // Empty is falsy, keeping verbose logging on even if the parent sets quiet mode.
+                BLOCKS_DEV_QUIET: '',
+            },
+            stdio: ['ignore', 'pipe', 'pipe'],
+        });
+        let stdout = '';
+        let stderr = '';
+        devProcess.stdout?.on('data', chunk => { stdout += chunk.toString(); });
+        devProcess.stderr?.on('data', chunk => { stderr += chunk.toString(); });
+        const deadline = Date.now() + 15_000;
+        let response;
+        let lastError;
+        while (!response && Date.now() < deadline) {
+            try {
+                response = await fetch(`http://127.0.0.1:${port}/aws-blocks/api`, {
+                    method: 'POST',
+                    headers: { 'Content-Type': 'application/json' },
+                    body: JSON.stringify({ jsonrpc: '2.0', method: 'testApi.pingVoid', params: [], id: 1 }),
+                });
+            }
+            catch (error) {
+                lastError = error;
+                await new Promise(resolve => setTimeout(resolve, 100));
+            }
+        }
+        assert.ok(response, `Dev server did not respond: ${String(lastError)}\nstdout: ${stdout}\nstderr: ${stderr}`);
+        assert.strictEqual(response.status, 200);
+        const payload = await response.json();
+        assert.strictEqual(payload.jsonrpc, '2.0');
+        assert.strictEqual(payload.id, 1);
+        assert.ok(!('error' in payload), `Unexpected RPC error: ${JSON.stringify(payload.error)}`);
+        const logDeadline = Date.now() + 1_000;
+        while (!stdout.includes('[rpc-ok] testApi.pingVoid') && Date.now() < logDeadline) {
+            await new Promise(resolve => setTimeout(resolve, 25));
+        }
+        assert.ok(stdout.includes('[rpc-ok] testApi.pingVoid'), `Missing verbose success log. stdout: ${stdout}`);
+        assert.ok(!stdout.includes('[rpc-err]'), `Unexpected RPC error log. stdout: ${stdout}`);
+    });
+    it('returns a JSON usage hint (not an empty body) for a GET on the API path', async () => {
+        const port = await getAvailablePort();
+        tempDir = join(tmpdir(), `dev-404-test-${process.pid}-${Date.now()}`);
+        mkdirSync(tempDir, { recursive: true });
+        writeFileSync(join(tempDir, 'backend.ts'), `
+export const testApi = {
+  pingVoid: async () => undefined,
+};
+`);
+        writeFileSync(join(tempDir, 'preload.mjs'), `
+if (!process.loadEnvFile) {
+  process.loadEnvFile = () => { throw Object.assign(new Error('ENOENT'), { code: 'ENOENT' }); };
+}
+`);
+        writeFileSync(join(tempDir, 'run-dev.ts'), `
+import { startDevServer } from '${join(__dirname, 'dev-server.js').replace(/\\/g, '/')}';
+startDevServer({ backendPath: '${join(tempDir, 'backend.ts').replace(/\\/g, '/')}', port: ${port} });
+`);
+        const tsxBin = join(__dirname, '..', '..', '..', '..', 'node_modules', '.bin', 'tsx');
+        devProcess = spawn(tsxBin, ['--import', join(tempDir, 'preload.mjs'), join(tempDir, 'run-dev.ts')], {
+            cwd: tempDir,
+            env: { ...process.env, AWS_BLOCKS_DISABLE_TELEMETRY: '1', BLOCKS_DEV_QUIET: '1' },
+            stdio: ['ignore', 'pipe', 'pipe'],
+        });
+        let stdout = '';
+        let stderr = '';
+        devProcess.stdout?.on('data', chunk => { stdout += chunk.toString(); });
+        devProcess.stderr?.on('data', chunk => { stderr += chunk.toString(); });
+        // A GET on the API path (e.g. opening it in a browser) hits the API handler
+        // but not the POST branch — the exact case that used to return an empty 404.
+        const deadline = Date.now() + 15_000;
+        let response;
+        let lastError;
+        while (!response && Date.now() < deadline) {
+            try {
+                response = await fetch(`http://127.0.0.1:${port}/aws-blocks/api`, { method: 'GET' });
+            }
+            catch (error) {
+                lastError = error;
+                await new Promise(resolve => setTimeout(resolve, 100));
+            }
+        }
+        assert.ok(response, `Dev server did not respond: ${String(lastError)}\nstdout: ${stdout}\nstderr: ${stderr}`);
+        assert.strictEqual(response.status, 404);
+        assert.strictEqual(response.headers.get('content-type'), 'application/json');
+        const payload = await response.json();
+        assert.match(payload.error ?? '', /POST/, `404 body should hint at the POST requirement: ${JSON.stringify(payload)}`);
+        assert.strictEqual(payload.expected?.method, 'POST');
+        assert.strictEqual(payload.expected?.path, '/aws-blocks/api');
+    });
+});

package/dist/scripts/dev-server.d.ts

@@ -4,6 +4,14 @@ export declare const LOCALHOST_PATTERN: RegExp;
  * Reflects back origins matching localhost/127.0.0.1; otherwise returns the fallback.
  */
 export declare function resolveDevCorsOrigin(origin: string): string;
+/**
+ * Build the CORS response headers the dev server sets on every request.
+ *
+ * Mirrors the Lambda path's cache posture — same {@link CORS_MAX_AGE} and the
+ * same `Vary: Origin` — so the reflected `Access-Control-Allow-Origin` can't be
+ * served across origins by a shared cache, and so the two sites can't drift.
+ */
+export declare function buildDevCorsHeaders(requestOrigin: string): Record<string, string>;
 /** Shape of the client runtime config the browser fetches to discover the API URL. */
 export interface BlocksRuntimeConfig {
     apiUrl: string;

package/dist/scripts/dev-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dev-server.d.ts","sourceRoot":"","sources":["../../src/scripts/dev-server.ts"],"names":[],"mappings":"AAqCA,eAAO,MAAM,iBAAiB,QAAiD,CAAC;AAEhF;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED,sFAAsF;AACtF,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,OAAO,GAAG,SAAS,CAAC;CAClC;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,mBAAmB,CAKvF;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE/E;AAED,MAAM,WAAW,gBAAgB;IAC/B,2CAA2C;IAC3C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oCAAoC;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,8DAA8D;IAC9D,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAiBD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,SAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAa/F;AAYD,+DAA+D;AAC/D,MAAM,WAAW,qBAAqB;IACpC,oFAAoF;IACpF,WAAW,EAAE,MAAM,CAAC;IACpB,2DAA2D;IAC3D,QAAQ,EAAE,MAAM,CAAC;IACjB,yEAAyE;IACzE,SAAS,EAAE,MAAM,CAAC;IAClB,oDAAoD;IACpD,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,uFAAuF;AACvF,eAAO,MAAM,+BAA+B,EAAE,qBAK7C,CAAC;AAEF,kDAAkD;AAClD,MAAM,WAAW,eAAe;IAC9B,oDAAoD;IACpD,OAAO,EAAE,OAAO,CAAC;IACjB,mEAAmE;IACnE,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,uBAAuB,CACrC,cAAc,EAAE,MAAM,EAAE,EACxB,GAAG,EAAE,MAAM,EACX,MAAM,GAAE,qBAAuD,GAC9D,eAAe,CAOjB;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,SAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAOnF;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE;IAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,EAC5E,OAAO,EAAE,OAAO,GACf,OAAO,CAOT;AAID,sCAAsC;AACtC,MAAM,WAAW,aAAa;IAC5B,uDAAuD;IACvD,OAAO,EAAE,OAAO,CAAC;IACjB,oFAAoF;IACpF,SAAS,EAAE,OAAO,CAAC;IACnB,yGAAyG;IACzG,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,kFAAkF;AAClF,MAAM,WAAW,eAAe;IAC9B,4CAA4C;IAC5C,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1C,gDAAgD;IAChD,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;IACrC,6EAA6E;IAC7E,QAAQ,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC;IACxD,kDAAkD;IAClD,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/D;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,OAAO,CAAC,eAAe,CAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAwB3G;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAW3F;AAED,gFAAgF;AAChF,MAAM,WAAW,mBAAmB;IAClC,sEAAsE;IACtE,WAAW,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,oFAAoF;AACpF,eAAO,MAAM,8BAA8B,EAAE,mBAG5C,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,EACf,MAAM,GAAE,mBAAoD,GAC3D;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAGrC;AAED,4GAA4G;AAC5G,MAAM,WAAW,aAAa;IAC5B,0EAA0E;IAC1E,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IAClD,wEAAwE;IACxE,QAAQ,EAAE,MAAM,IAAI,CAAC;IACrB,wEAAwE;IACxE,aAAa,EAAE,CAAC,EAAE,EAAE,MAAM,IAAI,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACzD,+EAA+E;IAC/E,WAAW,EAAE,MAAM,IAAI,CAAC;IACxB,oDAAoD;IACpD,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,aAAa,EACnB,MAAM,GAAE,mBAAoD,GAC3D,MAAM,IAAI,CAwBZ;AAID,8EAA8E;AAC9E,MAAM,WAAW,kBAAkB;IACjC,wCAAwC;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ,mFAAmF;IACnF,IAAI,EAAE,MAAM,CAAC;IACb,8CAA8C;IAC9C,IAAI,EAAE,MAAM,CAAC;CACd;AAED,mGAAmG;AACnG,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI,CAUtE;AAED,wGAAwG;AACxG,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,IAAmC,GAAG,OAAO,CAQ3H;AAED,8GAA8G;AAC9G,MAAM,MAAM,iBAAiB,GAAG;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3F;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,kBAAkB,GAAG,IAAI,EACnC,IAAI,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EACnC,SAAS,EAAE,OAAO,EAClB,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,GAChC,iBAAiB,CASnB;AAED,wBAAsB,cAAc,CAAC,OAAO,EAAE,gBAAgB,iBAsiB7D"}
+{"version":3,"file":"dev-server.d.ts","sourceRoot":"","sources":["../../src/scripts/dev-server.ts"],"names":[],"mappings":"AAsCA,eAAO,MAAM,iBAAiB,QAAiD,CAAC;AAEhF;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CASjF;AAED,sFAAsF;AACtF,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,OAAO,GAAG,SAAS,CAAC;CAClC;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,mBAAmB,CAKvF;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE/E;AAED,MAAM,WAAW,gBAAgB;IAC/B,2CAA2C;IAC3C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oCAAoC;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,8DAA8D;IAC9D,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAiBD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,SAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAa/F;AAYD,+DAA+D;AAC/D,MAAM,WAAW,qBAAqB;IACpC,oFAAoF;IACpF,WAAW,EAAE,MAAM,CAAC;IACpB,2DAA2D;IAC3D,QAAQ,EAAE,MAAM,CAAC;IACjB,yEAAyE;IACzE,SAAS,EAAE,MAAM,CAAC;IAClB,oDAAoD;IACpD,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,uFAAuF;AACvF,eAAO,MAAM,+BAA+B,EAAE,qBAK7C,CAAC;AAEF,kDAAkD;AAClD,MAAM,WAAW,eAAe;IAC9B,oDAAoD;IACpD,OAAO,EAAE,OAAO,CAAC;IACjB,mEAAmE;IACnE,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,uBAAuB,CACrC,cAAc,EAAE,MAAM,EAAE,EACxB,GAAG,EAAE,MAAM,EACX,MAAM,GAAE,qBAAuD,GAC9D,eAAe,CAOjB;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,SAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAOnF;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE;IAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,EAC5E,OAAO,EAAE,OAAO,GACf,OAAO,CAOT;AAID,sCAAsC;AACtC,MAAM,WAAW,aAAa;IAC5B,uDAAuD;IACvD,OAAO,EAAE,OAAO,CAAC;IACjB,oFAAoF;IACpF,SAAS,EAAE,OAAO,CAAC;IACnB,yGAAyG;IACzG,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,kFAAkF;AAClF,MAAM,WAAW,eAAe;IAC9B,4CAA4C;IAC5C,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1C,gDAAgD;IAChD,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;IACrC,6EAA6E;IAC7E,QAAQ,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC;IACxD,kDAAkD;IAClD,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/D;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,OAAO,CAAC,eAAe,CAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAwB3G;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAW3F;AAED,gFAAgF;AAChF,MAAM,WAAW,mBAAmB;IAClC,sEAAsE;IACtE,WAAW,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,oFAAoF;AACpF,eAAO,MAAM,8BAA8B,EAAE,mBAG5C,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,EACf,MAAM,GAAE,mBAAoD,GAC3D;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAGrC;AAED,4GAA4G;AAC5G,MAAM,WAAW,aAAa;IAC5B,0EAA0E;IAC1E,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IAClD,wEAAwE;IACxE,QAAQ,EAAE,MAAM,IAAI,CAAC;IACrB,wEAAwE;IACxE,aAAa,EAAE,CAAC,EAAE,EAAE,MAAM,IAAI,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACzD,+EAA+E;IAC/E,WAAW,EAAE,MAAM,IAAI,CAAC;IACxB,oDAAoD;IACpD,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,aAAa,EACnB,MAAM,GAAE,mBAAoD,GAC3D,MAAM,IAAI,CAwBZ;AAID,8EAA8E;AAC9E,MAAM,WAAW,kBAAkB;IACjC,wCAAwC;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ,mFAAmF;IACnF,IAAI,EAAE,MAAM,CAAC;IACb,8CAA8C;IAC9C,IAAI,EAAE,MAAM,CAAC;CACd;AAED,mGAAmG;AACnG,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI,CAUtE;AAED,wGAAwG;AACxG,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,IAAmC,GAAG,OAAO,CAQ3H;AAED,8GAA8G;AAC9G,MAAM,MAAM,iBAAiB,GAAG;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3F;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,kBAAkB,GAAG,IAAI,EACnC,IAAI,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EACnC,SAAS,EAAE,OAAO,EAClB,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,GAChC,iBAAiB,CASnB;AAED,wBAAsB,cAAc,CAAC,OAAO,EAAE,gBAAgB,iBAmiB7D"}

package/dist/scripts/dev-server.js

@@ -12,6 +12,7 @@ import { ApiError } from '../errors.js';
 import { BLOCKS_RPC_PREFIX, BLOCKS_SANDBOX_PREFIX } from '../constants.js';
 import { BLOCKS_SANDBOX_DIR } from '../common/constants.js';
 import { matchRoute, lockRouteRegistry } from '../raw-route.js';
+import { CORS_MAX_AGE } from '../cors.js';
 import { registerBuiltinRoutes } from '../builtin-routes.js';
 import { parseRpcRequest, successResponse, errorResponseFromCatch, methodNotFoundResponse, } from '../rpc.js';
 import { redactToJson } from '../redact.js';
@@ -36,6 +37,23 @@ export const LOCALHOST_PATTERN = /^https?:\/\/(localhost|127\.0\.0\.1)(:\d+)?$/;
 export function resolveDevCorsOrigin(origin) {
     return LOCALHOST_PATTERN.test(origin) ? origin : 'http://localhost:3000';
 }
+/**
+ * Build the CORS response headers the dev server sets on every request.
+ *
+ * Mirrors the Lambda path's cache posture — same {@link CORS_MAX_AGE} and the
+ * same `Vary: Origin` — so the reflected `Access-Control-Allow-Origin` can't be
+ * served across origins by a shared cache, and so the two sites can't drift.
+ */
+export function buildDevCorsHeaders(requestOrigin) {
+    return {
+        'Access-Control-Allow-Origin': resolveDevCorsOrigin(requestOrigin),
+        'Vary': 'Origin',
+        'Access-Control-Allow-Methods': 'GET, POST, PUT, DELETE, PATCH, HEAD, OPTIONS',
+        'Access-Control-Allow-Headers': 'Content-Type',
+        'Access-Control-Allow-Credentials': 'true',
+        'Access-Control-Max-Age': CORS_MAX_AGE,
+    };
+}
 /**
  * Build the runtime config the browser fetches at `${BLOCKS_SANDBOX_PREFIX}/config.json`.
  * In sandbox mode the browser still targets the localhost front door (the dev
@@ -699,12 +717,9 @@ export async function startDevServer(options) {
         const method = req.method || 'GET';
         // CORS headers
         const requestOrigin = req.headers.origin || '';
-        const allowedOrigin = resolveDevCorsOrigin(requestOrigin);
-        res.setHeader('Access-Control-Allow-Origin', allowedOrigin);
-        res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, PATCH, HEAD, OPTIONS');
-        res.setHeader('Access-Control-Allow-Headers', 'Content-Type');
-        res.setHeader('Access-Control-Allow-Credentials', 'true');
-        res.setHeader('Access-Control-Max-Age', '86400');
+        for (const [name, value] of Object.entries(buildDevCorsHeaders(requestOrigin))) {
+            res.setHeader(name, value);
+        }
         if (method === 'OPTIONS') {
             res.writeHead(200);
             res.end();
@@ -1066,6 +1081,18 @@ function handleApiRequest(req, res, url, method, apis) {
         });
         return;
     }
-    res.writeHead(404);
-    res.end();
+    // Anything that reaches here didn't match `POST /aws-blocks/api`. Returning a
+    // bare empty 404 leaves a developer poking at the endpoint (e.g. opening it in
+    // a browser, which sends a GET, or trying a REST-style URL) with no feedback.
+    // Reply with a small JSON hint pointing at the one supported shape. When the
+    // path was right but the method wasn't, say so explicitly.
+    const wrongMethodOnApi = url.pathname === BLOCKS_RPC_PREFIX;
+    const message = wrongMethodOnApi
+        ? `The AWS Blocks JSON-RPC API expects POST, not ${method}.`
+        : 'Not found. The AWS Blocks JSON-RPC API is served at POST /aws-blocks/api.';
+    res.writeHead(404, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({
+        error: message,
+        expected: { method: 'POST', path: BLOCKS_RPC_PREFIX },
+    }));
 }

package/dist/scripts/sandbox.js

@@ -124,7 +124,7 @@ export async function startSandbox(options) {
     console.log("🌐 Starting local dev server (proxying to AWS)...");
     console.log(`\n   Open http://localhost:${clientPort}\n`);
     const cdkWatch = spawnCommand("npx", [
-        "cdk", "watch", "--hotswap",
+        "cdk", "watch",
         `--outputs-file`, `${outDir}/outputs.json`,
         `--context`, `projectRoot=${process.cwd()}`,
         `--context`, `sandboxMode=true`,

package/dist/telemetry/client.js

@@ -192,15 +192,15 @@ export function sendEvent(event) {
         const workerPath = path.join(dir, 'telemetry-send-worker.js');
         const child = spawn(process.execPath, [workerPath, endpoint], {
             detached: true,
-            stdio: ['pipe', 'ignore', 'ignore'],
+            stdio: ['pipe', 'ignore', process.env.NODE_DEBUG?.includes('blocks-telemetry') ? 'inherit' : 'ignore'],
             // Clear NODE_OPTIONS so inherited flags (e.g. --conditions=cdk) don't interfere
             env: { ...process.env, NODE_OPTIONS: '' },
         });
-        child.stdin.on('error', (err) => { debug('stdin write failed: %s', err.message); });
+        child.stdin?.on('error', (err) => { debug('stdin write failed: %s', err.message); });
         // Payload is small (<1KB JSON) so it fits in the kernel pipe buffer (~64KB)
         // and survives the parent closing its fd on exit.
-        child.stdin.write(payload);
-        child.stdin.end();
+        child.stdin?.write(payload);
+        child.stdin?.end();
         child.on('error', (err) => { debug('spawn failed: %s', err.message); });
         child.unref();
         debug('spawned telemetry subprocess (pid=%d)', child.pid);

package/dist/telemetry/telemetry-send-worker.js

@@ -1,5 +1,9 @@
 // Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
+// NOTE: This worker is an intentional near-duplicate of
+// packages/create-blocks-app/src/telemetry-send-worker.ts. It is kept separate
+// because the worker must run with zero project/package imports. Any change
+// here should be mirrored in both files.
 /**
  * Telemetry send worker — spawned as a detached subprocess.
  * Reads JSON payload from stdin, POSTs it to the endpoint (argv[2]).

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const CORE_VERSION = "0.1.12";
+export declare const CORE_VERSION = "0.1.17";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -1,2 +1,2 @@
 // Auto-generated by scripts/generate-version.mjs — do not edit manually
-export const CORE_VERSION = '0.1.12';
+export const CORE_VERSION = '0.1.17';

package/package.json

@@ -1,6 +1,15 @@
 {
   "name": "@aws-blocks/core",
-  "version": "0.1.12",
+  "version": "0.1.17",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/aws-devtools-labs/aws-blocks.git",
+    "directory": "packages/core"
+  },
+  "homepage": "https://github.com/aws-devtools-labs/aws-blocks/tree/main/packages/core#readme",
+  "bugs": {
+    "url": "https://github.com/aws-devtools-labs/aws-blocks/issues"
+  },
   "author": "Amazon Web Services",
   "license": "Apache-2.0",
   "type": "module",

package/src/cors.test.ts

@@ -3,7 +3,7 @@
 import { describe, it, beforeEach } from 'node:test';
 import assert from 'node:assert';
 
-import { parseCorsPatterns, _resetCorsPatterns } from './cors.js';
+import { parseCorsPatterns, _resetCorsPatterns, buildCorsHeaders, CORS_MAX_AGE } from './cors.js';
 import { createLambdaHandler } from './lambda-handler.js';
 import { clearRouteRegistry } from './raw-route.js';
 
@@ -59,6 +59,95 @@ describe('parseCorsPatterns', () => {
   });
 });
 
+// ── buildCorsHeaders unit tests ─────────────────────────────────────────────
+
+describe('buildCorsHeaders', () => {
+  beforeEach(() => {
+    delete process.env.CORS_ALLOWED_ORIGINS;
+    delete process.env.CORS_HOSTING_ORIGINS;
+    _resetCorsPatterns();
+  });
+
+  it('reflects an origin that matches the configured allowlist', () => {
+    process.env.CORS_ALLOWED_ORIGINS = 'https://myapp\\.example\\.com';
+    _resetCorsPatterns();
+
+    const headers = buildCorsHeaders('https://myapp.example.com');
+    assert.strictEqual(headers['Access-Control-Allow-Origin'], 'https://myapp.example.com');
+    assert.strictEqual(headers['Access-Control-Allow-Credentials'], 'true');
+  });
+
+  it('never reflects an origin that is not on a configured allowlist', () => {
+    process.env.CORS_ALLOWED_ORIGINS = 'https://myapp\\.example\\.com';
+    _resetCorsPatterns();
+
+    const headers = buildCorsHeaders('https://evil.example.com');
+    assert.strictEqual(headers['Access-Control-Allow-Origin'], undefined);
+    assert.strictEqual(headers['Access-Control-Allow-Credentials'], undefined);
+    assert.deepStrictEqual(headers, { Vary: 'Origin' });
+  });
+
+  it('never reflects an origin when no allowlist is configured', () => {
+    const headers = buildCorsHeaders('https://evil.example.com');
+    assert.strictEqual(headers['Access-Control-Allow-Origin'], undefined);
+    assert.deepStrictEqual(headers, { Vary: 'Origin' });
+  });
+
+  it('returns no reflection headers when there is no origin', () => {
+    process.env.CORS_ALLOWED_ORIGINS = 'https://myapp\\.example\\.com';
+    _resetCorsPatterns();
+
+    assert.deepStrictEqual(buildCorsHeaders(''), { Vary: 'Origin' });
+  });
+
+  it('always sets Vary: Origin so shared caches key on the request origin', () => {
+    process.env.CORS_ALLOWED_ORIGINS = 'https://myapp\\.example\\.com';
+    _resetCorsPatterns();
+
+    assert.strictEqual(buildCorsHeaders('https://myapp.example.com').Vary, 'Origin');
+    assert.strictEqual(buildCorsHeaders('https://evil.example.com').Vary, 'Origin');
+    assert.strictEqual(buildCorsHeaders('').Vary, 'Origin');
+  });
+
+  it('warns only once per distinct disallowed origin', () => {
+    process.env.CORS_ALLOWED_ORIGINS = 'https://myapp\\.example\\.com';
+    _resetCorsPatterns();
+
+    const original = console.warn;
+    const lines: string[] = [];
+    console.warn = (msg: string) => { lines.push(msg); };
+    try {
+      buildCorsHeaders('https://evil.example.com');
+      buildCorsHeaders('https://evil.example.com');
+      buildCorsHeaders('https://evil.example.com');
+      assert.strictEqual(lines.length, 1, 'repeat requests from one origin should warn once');
+
+      buildCorsHeaders('https://other.example.com');
+      assert.strictEqual(lines.length, 2, 'a distinct origin should still warn');
+      assert.ok(lines[0].includes('https://evil.example.com'));
+      assert.ok(lines[1].includes('https://other.example.com'));
+    } finally {
+      console.warn = original;
+    }
+  });
+
+  it('does not warn for an allowed origin or an absent origin', () => {
+    process.env.CORS_ALLOWED_ORIGINS = 'https://myapp\\.example\\.com';
+    _resetCorsPatterns();
+
+    const original = console.warn;
+    const lines: string[] = [];
+    console.warn = (msg: string) => { lines.push(msg); };
+    try {
+      buildCorsHeaders('https://myapp.example.com');
+      buildCorsHeaders('');
+      assert.strictEqual(lines.length, 0);
+    } finally {
+      console.warn = original;
+    }
+  });
+});
+
 // ── isOriginAllowed + getCorsPatterns integration via handler ────────────────
 
 // These tests exercise the full CORS flow through createLambdaHandler to
@@ -159,7 +248,12 @@ describe('createLambdaHandler — CORS origin validation', () => {
     assert.strictEqual(result.headers['Access-Control-Allow-Credentials'], 'true');
     assert.ok(result.headers['Access-Control-Allow-Methods']);
     assert.ok(result.headers['Access-Control-Allow-Headers']);
-    assert.strictEqual(result.headers['Access-Control-Max-Age'], '86400');
+    assert.strictEqual(result.headers['Access-Control-Max-Age'], CORS_MAX_AGE);
+    assert.strictEqual(result.headers['Vary'], 'Origin');
+  });
+
+  it('pins Access-Control-Max-Age at the browser preflight cap', () => {
+    assert.strictEqual(CORS_MAX_AGE, '7200');
   });
 
   it('OPTIONS preflight with rejected origin returns 403', async () => {

package/src/cors.ts

@@ -1,6 +1,16 @@
 // Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
+/**
+ * `Access-Control-Max-Age` for preflight responses, in seconds.
+ *
+ * Chromium caps the preflight cache at 7200s and silently clamps anything
+ * higher, so a larger value buys nothing while widening the window in which a
+ * stale per-origin grant can be served. Shared by the Lambda handler and the
+ * local dev server so the two can't drift.
+ */
+export const CORS_MAX_AGE = '7200';
+
 /**
  * Parse a comma-separated CORS origin string into anchored RegExp patterns.
  *
@@ -72,20 +82,67 @@ export function isOriginAllowed(origin: string): boolean {
   return patterns.some(re => re.test(origin));
 }
 
+/**
+ * Distinct origins already warned about, so a caller retrying — or a bot
+ * spraying bogus `Origin` values — can't amplify one log line per request now
+ * that this helper runs on every response path.
+ */
+const warnedOrigins = new Set<string>();
+
+/** Cap on {@link warnedOrigins} so an untrusted input can't grow it unbounded. */
+const WARNED_ORIGINS_LIMIT = 100;
+
+function warnDisallowedOriginOnce(origin: string): void {
+  if (warnedOrigins.has(origin)) return;
+  if (warnedOrigins.size < WARNED_ORIGINS_LIMIT) warnedOrigins.add(origin);
+  const example = 'CORS_ALLOWED_ORIGINS=https://myapp\\.com,^https?://(localhost|127\\.0\\.0\\.1)(:\\d+)?$';
+  console.warn(
+    `[CORS] Origin "${origin}" is not allowed. Set the CORS_ALLOWED_ORIGINS environment variable to allow this origin. Example: ${example}`
+  );
+}
+
+/**
+ * Build the CORS response headers for a request origin.
+ *
+ * Only reflects the origin when it matches the configured allowlist. When no
+ * allowlist is configured, or the origin is configured-but-not-allowed, no
+ * `Access-Control-Allow-Origin` / `Access-Control-Allow-Credentials` headers
+ * are emitted, so a disallowed origin is never reflected back.
+ *
+ * `Vary: Origin` is always emitted, including on the not-allowed path: the
+ * response headers depend on the request `Origin`, so any shared cache (CDN,
+ * forward proxy) must key on it or it can serve one origin's grant — or one
+ * origin's *absence* of a grant — to a different origin.
+ *
+ * @param origin - The `Origin` header value from the request (may be empty)
+ * @returns The CORS headers to merge into the response
+ */
+export function buildCorsHeaders(origin: string): Record<string, string> {
+  const headers: Record<string, string> = { Vary: 'Origin' };
+  if (isOriginAllowed(origin)) {
+    headers['Access-Control-Allow-Origin'] = origin;
+    headers['Access-Control-Allow-Credentials'] = 'true';
+  } else if (origin) {
+    warnDisallowedOriginOnce(origin);
+  }
+  return headers;
+}
+
 /**
  * Build a 403 Forbidden response for cross-origin requests from disallowed origins.
  */
 export function corsRejection(): { statusCode: number; headers: Record<string, string>; body: string } {
   return {
     statusCode: 403,
-    headers: { 'Content-Type': 'application/json' },
+    headers: { 'Content-Type': 'application/json', Vary: 'Origin' },
     body: JSON.stringify({ error: 'Forbidden: cross-origin request rejected' }),
   };
 }
 
 /**
- * Reset the lazy CORS pattern cache. **For testing only.**
+ * Reset the lazy CORS pattern cache and the warned-origin set. **For testing only.**
  */
 export function _resetCorsPatterns(): void {
   _corsPatterns = undefined;
+  warnedOrigins.clear();
 }