@aws-blocks/core 0.1.13 → 0.1.18

package/src/scripts/dev-server.ts

@@ -13,6 +13,7 @@ import { ApiError } from '../errors.js';
 import { BLOCKS_RPC_PREFIX, BLOCKS_SANDBOX_PREFIX } from '../constants.js';
 import { BLOCKS_SANDBOX_DIR } from '../common/constants.js';
 import { matchRoute, lockRouteRegistry } from '../raw-route.js';
+import { CORS_MAX_AGE } from '../cors.js';
 import { registerBuiltinRoutes } from '../builtin-routes.js';
 import {
   parseRpcRequest,
@@ -45,6 +46,24 @@ export function resolveDevCorsOrigin(origin: string): string {
   return LOCALHOST_PATTERN.test(origin) ? origin : 'http://localhost:3000';
 }
 
+/**
+ * Build the CORS response headers the dev server sets on every request.
+ *
+ * Mirrors the Lambda path's cache posture — same {@link CORS_MAX_AGE} and the
+ * same `Vary: Origin` — so the reflected `Access-Control-Allow-Origin` can't be
+ * served across origins by a shared cache, and so the two sites can't drift.
+ */
+export function buildDevCorsHeaders(requestOrigin: string): Record<string, string> {
+  return {
+    'Access-Control-Allow-Origin': resolveDevCorsOrigin(requestOrigin),
+    'Vary': 'Origin',
+    'Access-Control-Allow-Methods': 'GET, POST, PUT, DELETE, PATCH, HEAD, OPTIONS',
+    'Access-Control-Allow-Headers': 'Content-Type',
+    'Access-Control-Allow-Credentials': 'true',
+    'Access-Control-Max-Age': CORS_MAX_AGE,
+  };
+}
+
 /** Shape of the client runtime config the browser fetches to discover the API URL. */
 export interface BlocksRuntimeConfig {
   apiUrl: string;
@@ -854,12 +873,9 @@ export async function startDevServer(options: DevServerOptions) {
 
     // CORS headers
     const requestOrigin = req.headers.origin || '';
-    const allowedOrigin = resolveDevCorsOrigin(requestOrigin);
-    res.setHeader('Access-Control-Allow-Origin', allowedOrigin);
-    res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, PATCH, HEAD, OPTIONS');
-    res.setHeader('Access-Control-Allow-Headers', 'Content-Type');
-    res.setHeader('Access-Control-Allow-Credentials', 'true');
-    res.setHeader('Access-Control-Max-Age', '86400');
+    for (const [name, value] of Object.entries(buildDevCorsHeaders(requestOrigin))) {
+      res.setHeader(name, value);
+    }
 
     if (method === 'OPTIONS') {
       res.writeHead(200);
@@ -1244,6 +1260,20 @@ function handleApiRequest(
     return;
   }
 
-  res.writeHead(404);
-  res.end();
+  // Anything that reaches here didn't match `POST /aws-blocks/api`. Returning a
+  // bare empty 404 leaves a developer poking at the endpoint (e.g. opening it in
+  // a browser, which sends a GET, or trying a REST-style URL) with no feedback.
+  // Reply with a small JSON hint pointing at the one supported shape. When the
+  // path was right but the method wasn't, say so explicitly.
+  const wrongMethodOnApi = url.pathname === BLOCKS_RPC_PREFIX;
+  const message = wrongMethodOnApi
+    ? `The AWS Blocks JSON-RPC API expects POST, not ${method}.`
+    : 'Not found. The AWS Blocks JSON-RPC API is served at POST /aws-blocks/api.';
+  res.writeHead(404, { 'Content-Type': 'application/json' });
+  res.end(
+    JSON.stringify({
+      error: message,
+      expected: { method: 'POST', path: BLOCKS_RPC_PREFIX },
+    }),
+  );
 }

package/src/scripts/sandbox.ts

@@ -150,7 +150,7 @@ export async function startSandbox(options: SandboxOptions) {
   console.log(`\n   Open http://localhost:${clientPort}\n`);
 
   const cdkWatch = spawnCommand("npx", [
-    "cdk", "watch", "--hotswap",
+    "cdk", "watch",
     `--outputs-file`, `${outDir}/outputs.json`,
     `--context`, `projectRoot=${process.cwd()}`,
     `--context`, `sandboxMode=true`,

package/src/telemetry/client.ts

@@ -199,16 +199,16 @@ export function sendEvent(event: BlocksTelemetryEvent): void {
     const workerPath = path.join(dir, 'telemetry-send-worker.js');
     const child = spawn(process.execPath, [workerPath, endpoint], {
       detached: true,
-      stdio: ['pipe', 'ignore', 'ignore'],
+      stdio: ['pipe', 'ignore', process.env.NODE_DEBUG?.includes('blocks-telemetry') ? 'inherit' : 'ignore'],
       // Clear NODE_OPTIONS so inherited flags (e.g. --conditions=cdk) don't interfere
       env: { ...process.env, NODE_OPTIONS: '' },
     });
 
-    child.stdin!.on('error', (err) => { debug('stdin write failed: %s', err.message); });
+    child.stdin?.on('error', (err) => { debug('stdin write failed: %s', err.message); });
     // Payload is small (<1KB JSON) so it fits in the kernel pipe buffer (~64KB)
     // and survives the parent closing its fd on exit.
-    child.stdin!.write(payload);
-    child.stdin!.end();
+    child.stdin?.write(payload);
+    child.stdin?.end();
     child.on('error', (err) => { debug('spawn failed: %s', err.message); });
     child.unref();
     debug('spawned telemetry subprocess (pid=%d)', child.pid);

package/src/telemetry/telemetry-send-worker.ts

@@ -1,6 +1,11 @@
 // Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
+// NOTE: This worker is an intentional near-duplicate of
+// packages/create-blocks-app/src/telemetry-send-worker.ts. It is kept separate
+// because the worker must run with zero project/package imports. Any change
+// here should be mirrored in both files.
+
 /**
  * Telemetry send worker — spawned as a detached subprocess.
  * Reads JSON payload from stdin, POSTs it to the endpoint (argv[2]).

package/src/version.ts

@@ -1,2 +1,2 @@
 // Auto-generated by scripts/generate-version.mjs — do not edit manually
-export const CORE_VERSION = '0.1.13';
+export const CORE_VERSION = '0.1.18';