READ FIRST — HTTPS CANONICALIZATION IS A SHIP-BLOCKING RULE

Problem:

  Users have seen Chrome's "This site doesn't support a secure connection"
  warning on 8k.art / beta directory browser paths. That must not be visible to
  public users.

Permanent rule:

  Every public 8k.art / S3 / CloudFront directory-browser path must be HTTPS
  canonical. HTTP paths must automatically redirect to HTTPS before page content
  is served.

Required CloudFront settings:

  For every public cache behavior:
    Viewer protocol policy = Redirect HTTP to HTTPS

  Required behaviors to audit:
    Default behavior /*
    /beta/*
    /beta/_daily-builds/*
    any behavior invoking the Lambda@Edge directory browser

Required source behavior:

  Directory browser source must never generate absolute http:// links.
  Use root-relative links for same-host paths.
  Use https:// when an absolute public URL is unavoidable.

v097 source fallback:

  index.mjs now includes enforceHttpsCanonicalizationV097(request).

  It should run immediately after obtaining:
    const request = event.Records[0].cf.request;

  If CloudFront headers show an HTTP viewer request, it returns:
    301 Location: https://same-host/same-path?same-query

S3 rule:

  Public canonical URLs must not be S3 website endpoints. S3 website endpoints
  are HTTP-only and cannot be the final public secure URL.

HSTS rule:

  After every public subdomain/path is confirmed HTTPS-safe, attach a CloudFront
  response headers policy with Strict-Transport-Security.

Do not enable HSTS preload until every subdomain is verified safe.