@aws-blocks/core 0.1.13 → 0.1.18

package/dist/cors.js

@@ -1,5 +1,14 @@
 // Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
+/**
+ * `Access-Control-Max-Age` for preflight responses, in seconds.
+ *
+ * Chromium caps the preflight cache at 7200s and silently clamps anything
+ * higher, so a larger value buys nothing while widening the window in which a
+ * stale per-origin grant can be served. Shared by the Lambda handler and the
+ * local dev server so the two can't drift.
+ */
+export const CORS_MAX_AGE = '7200';
 /**
  * Parse a comma-separated CORS origin string into anchored RegExp patterns.
  *
@@ -67,19 +76,63 @@ export function isOriginAllowed(origin) {
         return false;
     return patterns.some(re => re.test(origin));
 }
+/**
+ * Distinct origins already warned about, so a caller retrying — or a bot
+ * spraying bogus `Origin` values — can't amplify one log line per request now
+ * that this helper runs on every response path.
+ */
+const warnedOrigins = new Set();
+/** Cap on {@link warnedOrigins} so an untrusted input can't grow it unbounded. */
+const WARNED_ORIGINS_LIMIT = 100;
+function warnDisallowedOriginOnce(origin) {
+    if (warnedOrigins.has(origin))
+        return;
+    if (warnedOrigins.size < WARNED_ORIGINS_LIMIT)
+        warnedOrigins.add(origin);
+    const example = 'CORS_ALLOWED_ORIGINS=https://myapp\\.com,^https?://(localhost|127\\.0\\.0\\.1)(:\\d+)?$';
+    console.warn(`[CORS] Origin "${origin}" is not allowed. Set the CORS_ALLOWED_ORIGINS environment variable to allow this origin. Example: ${example}`);
+}
+/**
+ * Build the CORS response headers for a request origin.
+ *
+ * Only reflects the origin when it matches the configured allowlist. When no
+ * allowlist is configured, or the origin is configured-but-not-allowed, no
+ * `Access-Control-Allow-Origin` / `Access-Control-Allow-Credentials` headers
+ * are emitted, so a disallowed origin is never reflected back.
+ *
+ * `Vary: Origin` is always emitted, including on the not-allowed path: the
+ * response headers depend on the request `Origin`, so any shared cache (CDN,
+ * forward proxy) must key on it or it can serve one origin's grant — or one
+ * origin's *absence* of a grant — to a different origin.
+ *
+ * @param origin - The `Origin` header value from the request (may be empty)
+ * @returns The CORS headers to merge into the response
+ */
+export function buildCorsHeaders(origin) {
+    const headers = { Vary: 'Origin' };
+    if (isOriginAllowed(origin)) {
+        headers['Access-Control-Allow-Origin'] = origin;
+        headers['Access-Control-Allow-Credentials'] = 'true';
+    }
+    else if (origin) {
+        warnDisallowedOriginOnce(origin);
+    }
+    return headers;
+}
 /**
  * Build a 403 Forbidden response for cross-origin requests from disallowed origins.
  */
 export function corsRejection() {
     return {
         statusCode: 403,
-        headers: { 'Content-Type': 'application/json' },
+        headers: { 'Content-Type': 'application/json', Vary: 'Origin' },
         body: JSON.stringify({ error: 'Forbidden: cross-origin request rejected' }),
     };
 }
 /**
- * Reset the lazy CORS pattern cache. **For testing only.**
+ * Reset the lazy CORS pattern cache and the warned-origin set. **For testing only.**
  */
 export function _resetCorsPatterns() {
     _corsPatterns = undefined;
+    warnedOrigins.clear();
 }

package/dist/cors.test.js

@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: Apache-2.0
 import { describe, it, beforeEach } from 'node:test';
 import assert from 'node:assert';
-import { parseCorsPatterns, _resetCorsPatterns } from './cors.js';
+import { parseCorsPatterns, _resetCorsPatterns, buildCorsHeaders, CORS_MAX_AGE } from './cors.js';
 import { createLambdaHandler } from './lambda-handler.js';
 import { clearRouteRegistry } from './raw-route.js';
 // ── parseCorsPatterns unit tests ────────────────────────────────────────────
@@ -49,6 +49,81 @@ describe('parseCorsPatterns', () => {
         assert.ok(patterns[0].test('http://localhost:9999'));
     });
 });
+// ── buildCorsHeaders unit tests ─────────────────────────────────────────────
+describe('buildCorsHeaders', () => {
+    beforeEach(() => {
+        delete process.env.CORS_ALLOWED_ORIGINS;
+        delete process.env.CORS_HOSTING_ORIGINS;
+        _resetCorsPatterns();
+    });
+    it('reflects an origin that matches the configured allowlist', () => {
+        process.env.CORS_ALLOWED_ORIGINS = 'https://myapp\\.example\\.com';
+        _resetCorsPatterns();
+        const headers = buildCorsHeaders('https://myapp.example.com');
+        assert.strictEqual(headers['Access-Control-Allow-Origin'], 'https://myapp.example.com');
+        assert.strictEqual(headers['Access-Control-Allow-Credentials'], 'true');
+    });
+    it('never reflects an origin that is not on a configured allowlist', () => {
+        process.env.CORS_ALLOWED_ORIGINS = 'https://myapp\\.example\\.com';
+        _resetCorsPatterns();
+        const headers = buildCorsHeaders('https://evil.example.com');
+        assert.strictEqual(headers['Access-Control-Allow-Origin'], undefined);
+        assert.strictEqual(headers['Access-Control-Allow-Credentials'], undefined);
+        assert.deepStrictEqual(headers, { Vary: 'Origin' });
+    });
+    it('never reflects an origin when no allowlist is configured', () => {
+        const headers = buildCorsHeaders('https://evil.example.com');
+        assert.strictEqual(headers['Access-Control-Allow-Origin'], undefined);
+        assert.deepStrictEqual(headers, { Vary: 'Origin' });
+    });
+    it('returns no reflection headers when there is no origin', () => {
+        process.env.CORS_ALLOWED_ORIGINS = 'https://myapp\\.example\\.com';
+        _resetCorsPatterns();
+        assert.deepStrictEqual(buildCorsHeaders(''), { Vary: 'Origin' });
+    });
+    it('always sets Vary: Origin so shared caches key on the request origin', () => {
+        process.env.CORS_ALLOWED_ORIGINS = 'https://myapp\\.example\\.com';
+        _resetCorsPatterns();
+        assert.strictEqual(buildCorsHeaders('https://myapp.example.com').Vary, 'Origin');
+        assert.strictEqual(buildCorsHeaders('https://evil.example.com').Vary, 'Origin');
+        assert.strictEqual(buildCorsHeaders('').Vary, 'Origin');
+    });
+    it('warns only once per distinct disallowed origin', () => {
+        process.env.CORS_ALLOWED_ORIGINS = 'https://myapp\\.example\\.com';
+        _resetCorsPatterns();
+        const original = console.warn;
+        const lines = [];
+        console.warn = (msg) => { lines.push(msg); };
+        try {
+            buildCorsHeaders('https://evil.example.com');
+            buildCorsHeaders('https://evil.example.com');
+            buildCorsHeaders('https://evil.example.com');
+            assert.strictEqual(lines.length, 1, 'repeat requests from one origin should warn once');
+            buildCorsHeaders('https://other.example.com');
+            assert.strictEqual(lines.length, 2, 'a distinct origin should still warn');
+            assert.ok(lines[0].includes('https://evil.example.com'));
+            assert.ok(lines[1].includes('https://other.example.com'));
+        }
+        finally {
+            console.warn = original;
+        }
+    });
+    it('does not warn for an allowed origin or an absent origin', () => {
+        process.env.CORS_ALLOWED_ORIGINS = 'https://myapp\\.example\\.com';
+        _resetCorsPatterns();
+        const original = console.warn;
+        const lines = [];
+        console.warn = (msg) => { lines.push(msg); };
+        try {
+            buildCorsHeaders('https://myapp.example.com');
+            buildCorsHeaders('');
+            assert.strictEqual(lines.length, 0);
+        }
+        finally {
+            console.warn = original;
+        }
+    });
+});
 // ── isOriginAllowed + getCorsPatterns integration via handler ────────────────
 // These tests exercise the full CORS flow through createLambdaHandler to
 // verify origin validation, header injection, and rejection work end-to-end.
@@ -137,7 +212,11 @@ describe('createLambdaHandler — CORS origin validation', () => {
         assert.strictEqual(result.headers['Access-Control-Allow-Credentials'], 'true');
         assert.ok(result.headers['Access-Control-Allow-Methods']);
         assert.ok(result.headers['Access-Control-Allow-Headers']);
-        assert.strictEqual(result.headers['Access-Control-Max-Age'], '86400');
+        assert.strictEqual(result.headers['Access-Control-Max-Age'], CORS_MAX_AGE);
+        assert.strictEqual(result.headers['Vary'], 'Origin');
+    });
+    it('pins Access-Control-Max-Age at the browser preflight cap', () => {
+        assert.strictEqual(CORS_MAX_AGE, '7200');
     });
     it('OPTIONS preflight with rejected origin returns 403', async () => {
         const result = await invoke(echoBackend, makeEvent({

package/dist/errors.test.js

@@ -2,7 +2,32 @@
 // SPDX-License-Identifier: Apache-2.0
 import { describe, it } from 'node:test';
 import assert from 'node:assert';
-import { ApiError, isBlocksError, hasAuthError } from './errors.js';
+import { ApiError, DEFAULT_API_ERROR_NAME, isBlocksError, hasAuthError } from './errors.js';
+describe('ApiError constructor', () => {
+    it('exposes message and status, and stays a real Error', () => {
+        const e = new ApiError('Not found', 404);
+        assert.ok(e instanceof Error);
+        assert.strictEqual(e.message, 'Not found');
+        assert.strictEqual(e.status, 404);
+    });
+    it('defaults name to ApiError and retriable to false', () => {
+        const e = new ApiError('boom', 500);
+        assert.strictEqual(e.name, DEFAULT_API_ERROR_NAME);
+        assert.strictEqual(e.retriable, false);
+    });
+    it('takes name, cause and retriable from the options argument', () => {
+        const cause = new Error('root');
+        const e = new ApiError('Username already taken', 409, {
+            name: 'ConditionalCheckFailedException',
+            cause,
+            retriable: true,
+        });
+        assert.strictEqual(e.name, 'ConditionalCheckFailedException');
+        assert.strictEqual(e.status, 409);
+        assert.strictEqual(e.retriable, true);
+        assert.strictEqual(e.cause, cause);
+    });
+});
 describe('isBlocksError', () => {
     it('matches a thrown ApiError by name', () => {
         const e = new ApiError('nope', 401, { name: 'InvalidCredentialsException' });

package/dist/hosting.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hosting.d.ts","sourceRoot":"","sources":["../src/hosting.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,GAAG,MAAM,aAAa,CAAC;AASnC,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAKvC,OAAO,EAIL,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EAC1B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAIL,KAAK,kBAAkB,EACxB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAGV,aAAa,EACd,MAAM,qBAAqB,CAAC;AAO7B;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,8CAA8C;IAC9C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,EAAE,GAAG,CAAC,QAAQ,GAAG,MAAM,CAAC;IAChC,8FAA8F;IAC9F,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;;;;;;;;;;;OAgBG;IACH,iBAAiB,CAAC,EAAE;QAClB,2EAA2E;QAC3E,mBAAmB,CAAC,EAAE,MAAM,CAAC;KAC9B,CAAC;IACF,uEAAuE;IACvE,YAAY,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC;CAC3C,CAAC;AAEF,YAAY,EAAE,aAAa,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,CAAC;AAE3F;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,mHAAmH;IACnH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,YAAY;IAE3B,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAC;IAEb;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;;OAGG;IACH,SAAS,CAAC,EAAE,aAAa,CAAC;IAE1B;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,mEAAmE;IACnE,aAAa,CAAC,EAAE,kBAAkB,CAAC;IAEnC;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAGlB;;;;;;;;OAQG;IACH,GAAG,CAAC,EAAE,cAAc,CAAC;IAErB;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAGxC,uDAAuD;IACvD,OAAO,CAAC,EAAE,aAAa,CAAC;IAExB,mCAAmC;IACnC,MAAM,CAAC,EAAE,mBAAmB,CAAC;IAE7B,oCAAoC;IACpC,GAAG,CAAC,EAAE,gBAAgB,CAAC;IAEvB,sEAAsE;IACtE,cAAc,CAAC,EAAE,OAAO,CAAC;IAEzB,mDAAmD;IACnD,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAE/B,wDAAwD;IACxD,UAAU,CAAC,EAAE,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC;IAE3C;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE;QACf,IAAI,EAAE,WAAW,GAAG,WAAW,CAAC;QAChC,SAAS,EAAE,MAAM,EAAE,CAAC;KACrB,CAAC;IAEF;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,MAAM,CAAC,EAAE;QACP,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB;;;;;;;;WAQG;QACH,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;IAEF;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE;QACX,OAAO,EAAE,OAAO,CAAC;QACjB,0EAA0E;QAC1E,MAAM,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC;KAC7B,CAAC;IAEF;;;;;;;;;;;;;OAaG;IACH,UAAU,CAAC,EAAE;QACX,iEAAiE;QACjE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,iEAAiE;QACjE,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IAEF;;;OAGG;IACH,OAAO,CAAC,EAAE;QACR,wCAAwC;QACxC,OAAO,EAAE,OAAO,CAAC;QACjB,+CAA+C;QAC/C,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;IAEF;;;;;;OAMG;IACH,UAAU,CAAC,EAAE;QACX,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,6DAA6D;QAC7D,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IAEF;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,oBAAoB,CAAC;CACvC;AAYD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,qBAAa,OAAQ,SAAQ,SAAS;IACpC,2CAA2C;IAC3C,SAAgB,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC;IAC1C,mCAAmC;IACnC,SAAgB,YAAY,EAAE,GAAG,CAAC,cAAc,CAAC,YAAY,CAAC;IAC9D,yDAAyD;IACzD,SAAgB,GAAG,EAAE,MAAM,CAAC;IAC5B,gFAAgF;IAChF,SAAgB,WAAW,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC;IACtD,wFAAwF;IACxF,SAAgB,gBAAgB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC;IACrD,2FAA2F;IAC3F,SAAgB,eAAe,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;gBAEzC,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY;IAsR7D;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IAOvB;;OAEG;IACH,OAAO,CAAC,eAAe;CAwDxB"}
+{"version":3,"file":"hosting.d.ts","sourceRoot":"","sources":["../src/hosting.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,GAAG,MAAM,aAAa,CAAC;AASnC,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAKvC,OAAO,EAIL,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EAC1B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAIL,KAAK,kBAAkB,EACxB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAGV,aAAa,EACd,MAAM,qBAAqB,CAAC;AAQ7B;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,8CAA8C;IAC9C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,EAAE,GAAG,CAAC,QAAQ,GAAG,MAAM,CAAC;IAChC,8FAA8F;IAC9F,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;;;;;;;;;;;OAgBG;IACH,iBAAiB,CAAC,EAAE;QAClB,2EAA2E;QAC3E,mBAAmB,CAAC,EAAE,MAAM,CAAC;KAC9B,CAAC;IACF,uEAAuE;IACvE,YAAY,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC;CAC3C,CAAC;AAEF,YAAY,EAAE,aAAa,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,CAAC;AAE3F;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,mHAAmH;IACnH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,YAAY;IAE3B,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAC;IAEb;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;;OAGG;IACH,SAAS,CAAC,EAAE,aAAa,CAAC;IAE1B;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,mEAAmE;IACnE,aAAa,CAAC,EAAE,kBAAkB,CAAC;IAEnC;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAGlB;;;;;;;;OAQG;IACH,GAAG,CAAC,EAAE,cAAc,CAAC;IAErB;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAGxC,uDAAuD;IACvD,OAAO,CAAC,EAAE,aAAa,CAAC;IAExB,mCAAmC;IACnC,MAAM,CAAC,EAAE,mBAAmB,CAAC;IAE7B,oCAAoC;IACpC,GAAG,CAAC,EAAE,gBAAgB,CAAC;IAEvB,sEAAsE;IACtE,cAAc,CAAC,EAAE,OAAO,CAAC;IAEzB,mDAAmD;IACnD,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAE/B,wDAAwD;IACxD,UAAU,CAAC,EAAE,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC;IAE3C;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE;QACf,IAAI,EAAE,WAAW,GAAG,WAAW,CAAC;QAChC,SAAS,EAAE,MAAM,EAAE,CAAC;KACrB,CAAC;IAEF;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,MAAM,CAAC,EAAE;QACP,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB;;;;;;;;WAQG;QACH,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;IAEF;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE;QACX,OAAO,EAAE,OAAO,CAAC;QACjB,0EAA0E;QAC1E,MAAM,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC;KAC7B,CAAC;IAEF;;;;;;;;;;;;;OAaG;IACH,UAAU,CAAC,EAAE;QACX,iEAAiE;QACjE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,iEAAiE;QACjE,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IAEF;;;OAGG;IACH,OAAO,CAAC,EAAE;QACR,wCAAwC;QACxC,OAAO,EAAE,OAAO,CAAC;QACjB,+CAA+C;QAC/C,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;IAEF;;;;;;OAMG;IACH,UAAU,CAAC,EAAE;QACX,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,6DAA6D;QAC7D,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IAEF;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,oBAAoB,CAAC;CACvC;AAaD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,qBAAa,OAAQ,SAAQ,SAAS;IACpC,2CAA2C;IAC3C,SAAgB,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC;IAC1C,mCAAmC;IACnC,SAAgB,YAAY,EAAE,GAAG,CAAC,cAAc,CAAC,YAAY,CAAC;IAC9D,yDAAyD;IACzD,SAAgB,GAAG,EAAE,MAAM,CAAC;IAC5B,gFAAgF;IAChF,SAAgB,WAAW,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC;IACtD,wFAAwF;IACxF,SAAgB,gBAAgB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC;IACrD,2FAA2F;IAC3F,SAAgB,eAAe,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;gBAEzC,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY;IA8S7D;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IAOvB;;OAEG;IACH,OAAO,CAAC,eAAe;CAwDxB"}

package/dist/hosting.js

@@ -11,11 +11,13 @@ import { join, resolve } from 'node:path';
 import { HostingConstruct, generateBuildId, } from '@aws-blocks/hosting/constructs';
 import { detectFramework, getAdapter, normalizeBasePath, } from '@aws-blocks/hosting/adapters';
 import { BLOCKS_RPC_PREFIX, BLOCKS_AUTH_PREFIX } from './constants.js';
+import { BLOCKS_SANDBOX_DIR } from './common/constants.js';
 import { registerConfig } from './cdk/config-registry.js';
 import { getRegisteredRoutes } from './raw-route.js';
 // ─── Default build output directories per framework ──────────────
 const DEFAULT_BUILD_DIRS = {
     nextjs: '.next',
+    sveltekit: 'build',
     spa: 'dist',
     static: 'dist',
 };
@@ -164,6 +166,18 @@ export class Hosting extends Construct {
         const blocksSandboxDir = join(staticDir, '.blocks-sandbox');
         mkdirSync(blocksSandboxDir, { recursive: true });
         writeFileSync(join(blocksSandboxDir, 'config.json'), JSON.stringify({ _placeholder: true }));
+        // ── 5a. Mark config.json as a no-cache path ─────────────────────
+        //    config.json is a fixed-name, mutable runtime-config file: it must
+        //    NOT inherit the content-hashed mutable-asset cache-control
+        //    (`s-maxage=31536000`) applied to `/assets/<hash>.js`. Registering it
+        //    as a no-cache path uploads the build-time placeholder with
+        //    `no-cache, no-store, must-revalidate` so an edge never caches it
+        //    long-term; the real config is deployed in step 8 with `max-age=60`.
+        const configNoCachePath = `${BLOCKS_SANDBOX_DIR}/config.json`;
+        const existingNoCachePaths = manifest.staticAssets.noCachePaths ?? [];
+        manifest.staticAssets.noCachePaths = existingNoCachePaths.includes(configNoCachePath)
+            ? existingNoCachePaths
+            : [...existingNoCachePaths, configNoCachePath];
         // ── 5b. Inject static route for .blocks-sandbox config ──────────
         //    Insert a static route for /.blocks-sandbox/* so CloudFront
         //    serves config.json from S3 instead of routing to compute.
@@ -249,7 +263,18 @@ export class Hosting extends Construct {
                 destinationKeyPrefix: `builds/${buildId}/.blocks-sandbox`,
                 prune: false,
                 distribution: hosting.distribution,
-                distributionPaths: ['/.blocks-sandbox/*'],
+                // The skew-protection viewer-request CloudFront function rewrites the
+                // URI to `/builds/<buildId>/.blocks-sandbox/config.json` BEFORE the
+                // cache lookup, so the real edge cache key lives under `/builds/<id>/`.
+                // Invalidating only `/.blocks-sandbox/*` never matches that key and is
+                // a no-op for config.json. Invalidate the post-rewrite key too. (The
+                // primary guard against staleness is step 5a's no-cache placeholder;
+                // this is defense-in-depth so a post-deploy invalidation actually
+                // clears any edge entry at its real key.)
+                distributionPaths: [
+                    `/builds/${buildId}/.blocks-sandbox/*`,
+                    '/.blocks-sandbox/*',
+                ],
                 cacheControl: [s3deploy.CacheControl.fromString('public, max-age=60, must-revalidate')],
             });
             // Ensure the config deployment runs AFTER the hosting construct's

package/dist/hosting.test.js

@@ -1134,4 +1134,77 @@ describe('Hosting', () => {
                 `found DependsOn=${JSON.stringify(dependsOn)}`);
         });
     });
+    describe('config.json stale-placeholder guard (#173)', () => {
+        // Helper: pull every BucketDeployment custom resource's Properties.
+        const bucketDeployments = (stack) => {
+            const crs = Template.fromStack(stack).findResources('Custom::CDKBucketDeployment');
+            return Object.values(crs).map((cr) => cr.Properties);
+        };
+        it('uploads the placeholder config.json with a no-cache directive, never the 1-year mutable cache-control', () => {
+            // The build-time placeholder (`{_placeholder:true}`) is written into the
+            // static dir. If it inherits the mutable asset tier's
+            // `s-maxage=31536000` and an edge caches it during the deploy window, the
+            // edge serves the placeholder for up to a year — breaking every client
+            // API call. It must instead be uploaded as a no-cache path so the edge
+            // never caches it long-term.
+            createSpaBuildOutput(tmpDir);
+            const app = new App();
+            const stack = new Stack(app, 'PlaceholderCacheStack');
+            new Hosting(stack, 'Hosting', { root: tmpDir, api: MOCK_API });
+            const deployments = bucketDeployments(stack);
+            const cc = (p) => p.SystemMetadata?.['cache-control'];
+            const includes = (p) => p.Include ?? [];
+            const excludes = (p) => p.Exclude ?? [];
+            // A deployment must upload `.blocks-sandbox/config.json` with the
+            // no-cache directive (this is the placeholder upload).
+            const noCacheDeploy = deployments.find((p) => includes(p).includes('.blocks-sandbox/config.json') &&
+                cc(p) === 'no-cache, no-store, must-revalidate');
+            assert.ok(noCacheDeploy, 'placeholder .blocks-sandbox/config.json must be uploaded with ' +
+                '"no-cache, no-store, must-revalidate"');
+            // No deployment may cover the placeholder with the 1-year mutable
+            // cache-control: the mutable/other tier must EXCLUDE it.
+            const leaks = deployments.filter((p) => {
+                const directive = cc(p);
+                return (typeof directive === 'string' &&
+                    directive.includes('s-maxage=31536000') &&
+                    !excludes(p).includes('.blocks-sandbox/config.json'));
+            });
+            assert.strictEqual(leaks.length, 0, 'no mutable-tier deployment may apply s-maxage=31536000 to ' +
+                '.blocks-sandbox/config.json');
+        });
+        it('registers the placeholder as a no-cache path even for a static-only site (no api)', () => {
+            // The placeholder is always written (step 5), so its no-cache
+            // registration must not depend on `props.api`. This guards against a
+            // regression that moves the registration inside an `if (props.api)`
+            // block, which would reopen the stale-placeholder window for
+            // static-only sites.
+            createSpaBuildOutput(tmpDir);
+            const app = new App();
+            const stack = new Stack(app, 'StaticOnlyPlaceholderStack');
+            new Hosting(stack, 'Hosting', { root: tmpDir });
+            Template.fromStack(stack).hasResourceProperties('Custom::CDKBucketDeployment', Match.objectLike({
+                Include: Match.arrayWith(['.blocks-sandbox/config.json']),
+                SystemMetadata: Match.objectLike({
+                    'cache-control': 'no-cache, no-store, must-revalidate',
+                }),
+            }));
+        });
+        it('invalidates the post-rewrite cache key (/builds/<id>/.blocks-sandbox/*)', () => {
+            // The viewer-request skew-protection function rewrites the URI to
+            // `/builds/<buildId>/.blocks-sandbox/config.json` BEFORE the cache
+            // lookup, so the real edge cache key lives under `/builds/<id>/`.
+            // Invalidating only `/.blocks-sandbox/*` never matches it.
+            createSpaBuildOutput(tmpDir);
+            const app = new App();
+            const stack = new Stack(app, 'InvalidationPathStack');
+            new Hosting(stack, 'Hosting', { root: tmpDir, api: MOCK_API });
+            // Assert via Template + Match so a CDK property rename fails loudly here
+            // rather than silently skipping a structural-heuristic lookup.
+            Template.fromStack(stack).hasResourceProperties('Custom::CDKBucketDeployment', Match.objectLike({
+                DistributionPaths: Match.arrayWith([
+                    Match.stringLikeRegexp('^/builds/.+/\\.blocks-sandbox/\\*$'),
+                ]),
+            }));
+        });
+    });
 });

package/dist/lambda-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lambda-handler.d.ts","sourceRoot":"","sources":["../src/lambda-handler.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAerD,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAElE;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,2BAAkC,CAAC;AAG9D;;;GAGG;AACH,eAAO,MAAM,kBAAkB;;CAErB,CAAC;AAoDX;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAWlF;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,GAAG,GAAG,GAAG,CAwD7C;AAiBD;;;;;;;GAOG;AACH,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,WAAW,GAAG,SAAS,GAAG,QAAQ,CAAC;AAErE;;;;;;;;;;;;;GAaG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,GAAG,GAAG,UAAU,CAWpD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,GAAG,GAAG,OAAO,CAEzD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,CAAC,EAAE,aAAa,GAAG,MAAM,CAIrE;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,wBAAwB,IAAI,MAAM,CAAC;CACpC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,mBAAmB,CAAC,cAAc,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC,IA0BtD,OAAO,GAAG,EAAE,UAAU,aAAa,kBAkElD"}
+{"version":3,"file":"lambda-handler.d.ts","sourceRoot":"","sources":["../src/lambda-handler.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAerD,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAElE;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,2BAAkC,CAAC;AAG9D;;;GAGG;AACH,eAAO,MAAM,kBAAkB;;CAErB,CAAC;AAqCX;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAWlF;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,GAAG,GAAG,GAAG,CAwD7C;AAiBD;;;;;;;GAOG;AACH,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,WAAW,GAAG,SAAS,GAAG,QAAQ,CAAC;AAErE;;;;;;;;;;;;;GAaG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,GAAG,GAAG,UAAU,CAWpD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,GAAG,GAAG,OAAO,CAEzD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,CAAC,EAAE,aAAa,GAAG,MAAM,CAIrE;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,wBAAwB,IAAI,MAAM,CAAC;CACpC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,mBAAmB,CAAC,cAAc,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC,IA0BtD,OAAO,GAAG,EAAE,UAAU,aAAa,kBAiElD"}

package/dist/lambda-handler.js

@@ -8,7 +8,7 @@ import { matchRoute, lockRouteRegistry } from './raw-route.js';
 import { registerBuiltinRoutes } from './builtin-routes.js';
 import { loadConfigToProcessEnv } from './common/config.js';
 import { parseRpcRequest, successResponse, errorResponse, errorResponseFromCatch, methodNotFoundResponse, } from './rpc.js';
-import { getCorsPatterns, isOriginAllowed, corsRejection } from './cors.js';
+import { getCorsPatterns, isOriginAllowed, corsRejection, buildCorsHeaders, CORS_MAX_AGE } from './cors.js';
 export { parseCorsPatterns, _resetCorsPatterns } from './cors.js';
 /**
  * AsyncLocalStorage that carries the inbound HTTP request cookies through
@@ -28,18 +28,6 @@ globalThis.__BLOCKS_REQUEST_COOKIES_STORE__ = requestCookies;
 export const EventSourceMapping = {
     SQS: 'aws:sqs',
 };
-// ── CORS helpers (private to handler) ───────────────────────────────────────
-function buildCorsHeaders(origin) {
-    const headers = {};
-    if (isOriginAllowed(origin)) {
-        headers['Access-Control-Allow-Origin'] = origin;
-        headers['Access-Control-Allow-Credentials'] = 'true';
-    }
-    else if (origin) {
-        console.warn(`[CORS] Origin "${origin}" is not allowed. Set the CORS_ALLOWED_ORIGINS environment variable to allow this origin. Example: CORS_ALLOWED_ORIGINS=https://myapp\\.com,^https?://(localhost|127\\.0\\.0\\.1)(:\\d+)?$`);
-    }
-    return headers;
-}
 // ── Helpers ─────────────────────────────────────────────────────────────────
 /**
  * Decode the Lambda event body and return both the raw string and a ReadableStream.
@@ -330,7 +318,7 @@ export function createLambdaHandler(backendFactory) {
                 // Timeout won the race — build a 504 response. Format depends on
                 // whether the request targeted an RPC endpoint (structured JSON-RPC
                 // error envelope) or a plain HTTP path (simple error JSON).
-                const origin = event.headers?.origin || event.headers?.Origin || '*';
+                const origin = event.headers?.origin || event.headers?.Origin || '';
                 const requestPath = getRequestPath(event);
                 const isRpcPath = requestPath === BLOCKS_RPC_PREFIX || requestPath.startsWith(BLOCKS_RPC_PREFIX + '/');
                 const body = isRpcPath
@@ -340,8 +328,7 @@ export function createLambdaHandler(backendFactory) {
                     statusCode: 504,
                     headers: {
                         'Content-Type': 'application/json',
-                        'Access-Control-Allow-Origin': origin,
-                        'Access-Control-Allow-Credentials': 'true',
+                        ...buildCorsHeaders(origin),
                     },
                     body,
                 };
@@ -414,7 +401,7 @@ function createHandler(backend) {
                     ...corsHeaders,
                     'Access-Control-Allow-Methods': 'GET, POST, PUT, DELETE, PATCH, HEAD, OPTIONS',
                     'Access-Control-Allow-Headers': 'Content-Type, Authorization',
-                    'Access-Control-Max-Age': '86400',
+                    'Access-Control-Max-Age': CORS_MAX_AGE,
                 },
                 body: '',
             };

package/dist/lambda-handler.test.js

@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: Apache-2.0
 import { describe, it, beforeEach } from 'node:test';
 import assert from 'node:assert';
-import { createLambdaHandler, requestCookies, isApiGatewayHttpEvent, computeHttpDeadlineMs, classifyEvent, buildEventUrl, isLoopbackForwardedHost } from './lambda-handler.js';
+import { createLambdaHandler, _resetCorsPatterns, requestCookies, isApiGatewayHttpEvent, computeHttpDeadlineMs, classifyEvent, buildEventUrl, isLoopbackForwardedHost } from './lambda-handler.js';
 import { registerRoute, clearRouteRegistry } from './raw-route.js';
 import { decodeRpcResponse } from './rpc.js';
 beforeEach(() => {
@@ -499,7 +499,7 @@ describe('createLambdaHandler — timeout guard for API Gateway events', () => {
         assert.strictEqual(body.jsonrpc, '2.0');
         assert.strictEqual(body.error.code, 504);
     });
-    it('504 response includes CORS headers from event origin', async () => {
+    it('504 response includes CORS headers for an allowed origin', async () => {
         const backend = {
             api: () => ({
                 async echo() {
@@ -508,6 +508,9 @@ describe('createLambdaHandler — timeout guard for API Gateway events', () => {
                 },
             }),
         };
+        process.env.CORS_ALLOWED_ORIGINS = 'https://myapp\\.example\\.com';
+        delete process.env.CORS_HOSTING_ORIGINS;
+        _resetCorsPatterns();
         const event = makeEvent({
             headers: {
                 'Content-Type': 'application/json',
@@ -519,6 +522,60 @@ describe('createLambdaHandler — timeout guard for API Gateway events', () => {
         assert.strictEqual(result.statusCode, 504);
         assert.strictEqual(result.headers['Access-Control-Allow-Origin'], 'https://myapp.example.com');
         assert.strictEqual(result.headers['Access-Control-Allow-Credentials'], 'true');
+        delete process.env.CORS_ALLOWED_ORIGINS;
+        _resetCorsPatterns();
+    });
+    it('504 response omits CORS headers when no allowlist is configured', async () => {
+        const backend = {
+            api: () => ({
+                async echo() {
+                    await new Promise(resolve => setTimeout(resolve, 5_000));
+                    return {};
+                },
+            }),
+        };
+        delete process.env.CORS_ALLOWED_ORIGINS;
+        delete process.env.CORS_HOSTING_ORIGINS;
+        _resetCorsPatterns();
+        const event = makeEvent({
+            headers: {
+                'Content-Type': 'application/json',
+                origin: 'https://evil.example.com',
+            },
+        });
+        const ctx = makeLambdaContext(50);
+        const result = await invokeWithContext(backend, event, ctx);
+        assert.strictEqual(result.statusCode, 504);
+        assert.strictEqual(result.headers['Access-Control-Allow-Origin'], undefined);
+        assert.strictEqual(result.headers['Access-Control-Allow-Credentials'], undefined);
+        delete process.env.CORS_ALLOWED_ORIGINS;
+        _resetCorsPatterns();
+    });
+    it('disallowed origin with a configured allowlist is rejected with 403 before the timeout path', async () => {
+        const backend = {
+            api: () => ({
+                async echo() {
+                    await new Promise(resolve => setTimeout(resolve, 5_000));
+                    return {};
+                },
+            }),
+        };
+        process.env.CORS_ALLOWED_ORIGINS = 'https://myapp\\.example\\.com';
+        delete process.env.CORS_HOSTING_ORIGINS;
+        _resetCorsPatterns();
+        const event = makeEvent({
+            headers: {
+                'Content-Type': 'application/json',
+                origin: 'https://evil.example.com',
+            },
+        });
+        const ctx = makeLambdaContext(50);
+        const result = await invokeWithContext(backend, event, ctx);
+        assert.strictEqual(result.statusCode, 403);
+        assert.strictEqual(result.headers['Access-Control-Allow-Origin'], undefined);
+        assert.strictEqual(result.headers['Access-Control-Allow-Credentials'], undefined);
+        delete process.env.CORS_ALLOWED_ORIGINS;
+        _resetCorsPatterns();
     });
 });
 describe('createLambdaHandler — async events bypass timeout guard', () => {

package/dist/rpc.test.js

@@ -2,7 +2,8 @@
 // SPDX-License-Identifier: Apache-2.0
 import { describe, it } from 'node:test';
 import assert from 'node:assert';
-import { parseRpcRequest, RpcErrorCode } from './rpc.js';
+import { decodeRpcResponse, errorResponseFromCatch, parseRpcRequest, RpcErrorCode } from './rpc.js';
+import { ApiError, isBlocksError } from './errors.js';
 describe('-32600 Invalid Request error shape', () => {
     it('returns proper JSON-RPC 2.0 envelope with error code', () => {
         const result = parseRpcRequest(JSON.stringify({ method: 'ns.method', id: 1 }));
@@ -58,3 +59,78 @@ describe('-32600 Invalid Request error shape', () => {
         }
     });
 });
+describe('params decoding', () => {
+    it('uses an array of params as positional args', () => {
+        const result = parseRpcRequest(JSON.stringify({ jsonrpc: '2.0', method: 'api.greet', params: ['World', 42], id: 1 }));
+        assert.strictEqual(result.ok, true);
+        if (result.ok) {
+            assert.deepStrictEqual(result.request.args, ['World', 42]);
+            assert.strictEqual(result.request.apiNamespace, 'api');
+            assert.strictEqual(result.request.method, 'greet');
+        }
+    });
+    it('flattens an object of named params in key order', () => {
+        const result = parseRpcRequest(JSON.stringify({ jsonrpc: '2.0', method: 'api.greet', params: { name: 'World', times: 42 }, id: 1 }));
+        assert.strictEqual(result.ok, true);
+        if (result.ok)
+            assert.deepStrictEqual(result.request.args, ['World', 42]);
+    });
+    it('yields no args when params is omitted', () => {
+        const result = parseRpcRequest(JSON.stringify({ jsonrpc: '2.0', method: 'api.ping', id: 7 }));
+        assert.strictEqual(result.ok, true);
+        if (result.ok)
+            assert.deepStrictEqual(result.request.args, []);
+    });
+});
+describe('batch requests (top-level JSON array body)', () => {
+    it('rejects an array body as Invalid Request with a null id', () => {
+        const result = parseRpcRequest(JSON.stringify([
+            { jsonrpc: '2.0', method: 'api.greet', params: ['a'], id: 1 },
+            { jsonrpc: '2.0', method: 'api.greet', params: ['b'], id: 2 },
+        ]));
+        assert.strictEqual(result.ok, false);
+        if (!result.ok) {
+            const parsed = JSON.parse(result.response);
+            assert.strictEqual(parsed.error.code, RpcErrorCode.InvalidRequest);
+            assert.strictEqual(parsed.error.data.name, 'InvalidRequest');
+            assert.strictEqual(parsed.id, null);
+        }
+    });
+    it('reports a parse error for a body that is not JSON at all', () => {
+        const result = parseRpcRequest('{oops');
+        assert.strictEqual(result.ok, false);
+        if (!result.ok) {
+            const parsed = JSON.parse(result.response);
+            assert.strictEqual(parsed.error.code, RpcErrorCode.ParseError);
+            assert.strictEqual(parsed.id, null);
+        }
+    });
+});
+describe('ApiError status ↔ JSON-RPC error code', () => {
+    it('encodes the HTTP status as the error code, with name and retriable in data', () => {
+        const encoded = errorResponseFromCatch(new ApiError('Username already taken', 409, { name: 'ConditionalCheckFailedException', retriable: true }), 1);
+        const parsed = JSON.parse(encoded);
+        assert.strictEqual(parsed.error.code, 409);
+        assert.strictEqual(parsed.error.message, 'Username already taken');
+        assert.strictEqual(parsed.error.data.name, 'ConditionalCheckFailedException');
+        assert.strictEqual(parsed.error.data.retriable, true);
+    });
+    it('encodes a non-ApiError throw as code 500 with no data.name', () => {
+        const parsed = JSON.parse(errorResponseFromCatch(new Error('plain'), 2));
+        assert.strictEqual(parsed.error.code, 500);
+        assert.strictEqual(parsed.error.data, undefined);
+    });
+    it('round-trips status, name and retriable back into an ApiError on the client', () => {
+        const wire = JSON.parse(errorResponseFromCatch(new ApiError('Username already taken', 409, { name: 'ConditionalCheckFailedException', retriable: true }), 1));
+        assert.throws(() => decodeRpcResponse(wire), (e) => {
+            assert.ok(e instanceof ApiError);
+            assert.strictEqual(e.status, 409);
+            assert.strictEqual(e.retriable, true);
+            assert.ok(isBlocksError(e, 'ConditionalCheckFailedException'));
+            return true;
+        });
+    });
+    it('decodes reserved -32xxx codes as status 500', () => {
+        assert.throws(() => decodeRpcResponse({ jsonrpc: '2.0', error: { code: RpcErrorCode.InvalidRequest, message: 'Invalid Request' }, id: null }), (e) => e instanceof ApiError && e.status === 500);
+    });
+});

package/dist/scripts/console.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"console.d.ts","sourceRoot":"","sources":["../../src/scripts/console.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,wBAAsB,WAAW,CAAC,OAAO,EAAE,cAAc,iBAqBxD"}
+{"version":3,"file":"console.d.ts","sourceRoot":"","sources":["../../src/scripts/console.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AA6BD,wBAAsB,WAAW,CAAC,OAAO,EAAE,cAAc,iBAqBxD"}