@composurecdk/cloudfront 0.4.2 → 0.4.4

package/dist/alarm-config.d.ts

@@ -5,9 +5,8 @@ import type { AlarmConfig } from "@composurecdk/cloudwatch";
  * Set individual alarms to `false` to disable them, or provide an
  * {@link AlarmConfig} to tune thresholds.
  *
- * Function-level alarms (FunctionValidationErrors, FunctionExecutionErrors,
- * FunctionThrottles) require per-function dimensions and are not created
- * automatically. Use {@link IDistributionBuilder.addAlarm} to add them.
+ * Function-level alarms are created automatically for every inline function
+ * declared on a behavior — see {@link FunctionAlarmConfig} to tune them.
  *
  * @see https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Best_Practice_Recommended_Alarms_AWS_Services.html#CloudFront
  */
@@ -42,4 +41,54 @@ export interface DistributionAlarmConfig {
      */
     originLatency?: AlarmConfig | false;
 }
+/**
+ * Controls which recommended alarms are created for a CloudFront Function
+ * declared inline on a cache behavior. All alarms are enabled by default
+ * with AWS-recommended thresholds. Set individual alarms to `false` to
+ * disable them, or provide an {@link AlarmConfig} to tune thresholds.
+ *
+ * CloudFront Function metrics are emitted in the `us-east-1` region only
+ * (CloudFront is a global service). The alarms live in the stack's region —
+ * if that is not `us-east-1`, the alarms will not receive data.
+ *
+ * @see https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/monitoring-functions.html
+ */
+export interface FunctionAlarmConfig {
+    /**
+     * Master switch: set to `false` to disable all recommended alarms for
+     * this function. Individual alarms can also be disabled via their own entry.
+     * @default true
+     */
+    enabled?: boolean;
+    /**
+     * Alarm when the function raises runtime exceptions while processing a
+     * viewer request or response.
+     *
+     * Metric: `AWS/CloudFront FunctionExecutionErrors`, statistic Sum,
+     * period 1 minute. Default threshold: > 0 errors.
+     *
+     * @see https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/monitoring-functions.html
+     */
+    executionErrors?: AlarmConfig | false;
+    /**
+     * Alarm when the function returns an event object that fails validation
+     * (e.g. malformed headers, unsupported response shape).
+     *
+     * Metric: `AWS/CloudFront FunctionValidationErrors`, statistic Sum,
+     * period 1 minute. Default threshold: > 0 errors.
+     *
+     * @see https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/monitoring-functions.html
+     */
+    validationErrors?: AlarmConfig | false;
+    /**
+     * Alarm when the function is throttled — typically because it exceeded
+     * the 1ms compute-utilization budget.
+     *
+     * Metric: `AWS/CloudFront FunctionThrottles`, statistic Sum,
+     * period 1 minute. Default threshold: > 0 throttles.
+     *
+     * @see https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/cloudfront-function-restrictions.html
+     */
+    throttles?: AlarmConfig | false;
+}
 //# sourceMappingURL=alarm-config.d.ts.map

package/dist/alarm-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"alarm-config.d.ts","sourceRoot":"","sources":["../src/alarm-config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAE5D;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,WAAW,GAAG,KAAK,CAAC;IAEhC;;;;;;;;;;;;OAYG;IACH,aAAa,CAAC,EAAE,WAAW,GAAG,KAAK,CAAC;CACrC"}
+{"version":3,"file":"alarm-config.d.ts","sourceRoot":"","sources":["../src/alarm-config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAE5D;;;;;;;;;;GAUG;AACH,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,WAAW,GAAG,KAAK,CAAC;IAEhC;;;;;;;;;;;;OAYG;IACH,aAAa,CAAC,EAAE,WAAW,GAAG,KAAK,CAAC;CACrC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB;;;;;;;;OAQG;IACH,eAAe,CAAC,EAAE,WAAW,GAAG,KAAK,CAAC;IAEtC;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,WAAW,GAAG,KAAK,CAAC;IAEvC;;;;;;;;OAQG;IACH,SAAS,CAAC,EAAE,WAAW,GAAG,KAAK,CAAC;CACjC"}

package/dist/alarm-defaults.d.ts

@@ -4,11 +4,25 @@ interface DistributionAlarmDefaults {
     errorRate: Required<AlarmConfig>;
     originLatency: Required<AlarmConfig>;
 }
+interface FunctionAlarmDefaults {
+    enabled: true;
+    executionErrors: Required<AlarmConfig>;
+    validationErrors: Required<AlarmConfig>;
+    throttles: Required<AlarmConfig>;
+}
 /**
  * AWS-recommended default alarm configuration for CloudFront distributions.
  *
  * @see https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Best_Practice_Recommended_Alarms_AWS_Services.html#CloudFront
  */
 export declare const DISTRIBUTION_ALARM_DEFAULTS: DistributionAlarmDefaults;
+/**
+ * Default alarm configuration for CloudFront Functions declared inline on
+ * a cache behavior. Any non-zero count of errors or throttles is worth
+ * investigating since a function executes on every viewer request/response.
+ *
+ * @see https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/monitoring-functions.html
+ */
+export declare const FUNCTION_ALARM_DEFAULTS: FunctionAlarmDefaults;
 export {};
 //# sourceMappingURL=alarm-defaults.d.ts.map

package/dist/alarm-defaults.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"alarm-defaults.d.ts","sourceRoot":"","sources":["../src/alarm-defaults.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAE5D,UAAU,yBAAyB;IACjC,OAAO,EAAE,IAAI,CAAC;IACd,SAAS,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;IACjC,aAAa,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;CACtC;AAED;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,EAAE,yBAyBzC,CAAC"}
+{"version":3,"file":"alarm-defaults.d.ts","sourceRoot":"","sources":["../src/alarm-defaults.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAE5D,UAAU,yBAAyB;IACjC,OAAO,EAAE,IAAI,CAAC;IACd,SAAS,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;IACjC,aAAa,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;CACtC;AAED,UAAU,qBAAqB;IAC7B,OAAO,EAAE,IAAI,CAAC;IACd,eAAe,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;IACvC,gBAAgB,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;IACxC,SAAS,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;CAClC;AAED;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,EAAE,yBAyBzC,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,EAAE,qBA0BrC,CAAC"}

package/dist/alarm-defaults.js

@@ -28,4 +28,35 @@ export const DISTRIBUTION_ALARM_DEFAULTS = {
         treatMissingData: TreatMissingData.NOT_BREACHING,
     },
 };
+/**
+ * Default alarm configuration for CloudFront Functions declared inline on
+ * a cache behavior. Any non-zero count of errors or throttles is worth
+ * investigating since a function executes on every viewer request/response.
+ *
+ * @see https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/monitoring-functions.html
+ */
+export const FUNCTION_ALARM_DEFAULTS = {
+    enabled: true,
+    /** Any execution error indicates a runtime fault on the edge; threshold 0. */
+    executionErrors: {
+        threshold: 0,
+        evaluationPeriods: 1,
+        datapointsToAlarm: 1,
+        treatMissingData: TreatMissingData.NOT_BREACHING,
+    },
+    /** Any validation error indicates the function returned a bad event; threshold 0. */
+    validationErrors: {
+        threshold: 0,
+        evaluationPeriods: 1,
+        datapointsToAlarm: 1,
+        treatMissingData: TreatMissingData.NOT_BREACHING,
+    },
+    /** Any throttle indicates the function exceeded its 1ms compute budget; threshold 0. */
+    throttles: {
+        threshold: 0,
+        evaluationPeriods: 1,
+        datapointsToAlarm: 1,
+        treatMissingData: TreatMissingData.NOT_BREACHING,
+    },
+};
 //# sourceMappingURL=alarm-defaults.js.map

package/dist/alarm-defaults.js.map

@@ -1 +1 @@
-{"version":3,"file":"alarm-defaults.js","sourceRoot":"","sources":["../src/alarm-defaults.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAS9D;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAA8B;IACpE,OAAO,EAAE,IAAI;IAEb;;;OAGG;IACH,SAAS,EAAE;QACT,SAAS,EAAE,CAAC;QACZ,iBAAiB,EAAE,CAAC;QACpB,iBAAiB,EAAE,CAAC;QACpB,gBAAgB,EAAE,gBAAgB,CAAC,aAAa;KACjD;IAED;;;;OAIG;IACH,aAAa,EAAE;QACb,SAAS,EAAE,IAAI;QACf,iBAAiB,EAAE,CAAC;QACpB,iBAAiB,EAAE,CAAC;QACpB,gBAAgB,EAAE,gBAAgB,CAAC,aAAa;KACjD;CACF,CAAC"}
+{"version":3,"file":"alarm-defaults.js","sourceRoot":"","sources":["../src/alarm-defaults.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAgB9D;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAA8B;IACpE,OAAO,EAAE,IAAI;IAEb;;;OAGG;IACH,SAAS,EAAE;QACT,SAAS,EAAE,CAAC;QACZ,iBAAiB,EAAE,CAAC;QACpB,iBAAiB,EAAE,CAAC;QACpB,gBAAgB,EAAE,gBAAgB,CAAC,aAAa;KACjD;IAED;;;;OAIG;IACH,aAAa,EAAE;QACb,SAAS,EAAE,IAAI;QACf,iBAAiB,EAAE,CAAC;QACpB,iBAAiB,EAAE,CAAC;QACpB,gBAAgB,EAAE,gBAAgB,CAAC,aAAa;KACjD;CACF,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAA0B;IAC5D,OAAO,EAAE,IAAI;IAEb,8EAA8E;IAC9E,eAAe,EAAE;QACf,SAAS,EAAE,CAAC;QACZ,iBAAiB,EAAE,CAAC;QACpB,iBAAiB,EAAE,CAAC;QACpB,gBAAgB,EAAE,gBAAgB,CAAC,aAAa;KACjD;IAED,qFAAqF;IACrF,gBAAgB,EAAE;QAChB,SAAS,EAAE,CAAC;QACZ,iBAAiB,EAAE,CAAC;QACpB,iBAAiB,EAAE,CAAC;QACpB,gBAAgB,EAAE,gBAAgB,CAAC,aAAa;KACjD;IAED,wFAAwF;IACxF,SAAS,EAAE;QACT,SAAS,EAAE,CAAC;QACZ,iBAAiB,EAAE,CAAC;QACpB,iBAAiB,EAAE,CAAC;QACpB,gBAAgB,EAAE,gBAAgB,CAAC,aAAa;KACjD;CACF,CAAC"}

package/dist/behavior-function-alarms.d.ts

@@ -0,0 +1,44 @@
+import type { Function as CfFunction, FunctionEventType } from "aws-cdk-lib/aws-cloudfront";
+import type { AlarmDefinition } from "@composurecdk/cloudwatch";
+import type { FunctionAlarmConfig } from "./alarm-config.js";
+/**
+ * Converts a CloudFront cache-behavior path pattern into a PascalCase slug
+ * suitable for alarm keys and CDK construct ids. A single leading `/` is
+ * dropped (the common case), interior `/` becomes `Slash` so sibling patterns
+ * don't collide, `*` becomes `Star`, and `?` becomes `Q`. Other
+ * non-alphanumeric characters are stripped.
+ *
+ * Examples:
+ * - `/api/*` → `ApiSlashStar`
+ * - `/api*`  → `ApiStar` (distinct from `/api/*`)
+ * - `*.html` → `StarHtml`
+ * - `images/*` → `ImagesSlashStar`
+ *
+ * @internal
+ */
+export declare function pathPatternSlug(pattern: string): string;
+/**
+ * Converts a {@link FunctionEventType} value (e.g. `"viewer-request"`) into
+ * PascalCase (e.g. `"ViewerRequest"`) for use in alarm keys and construct ids.
+ *
+ * @internal
+ */
+export declare function eventTypePascal(eventType: FunctionEventType): string;
+/**
+ * Builds the prefix used for every alarm key produced for a given inline
+ * function — e.g. `defaultBehaviorViewerRequest` or `behaviorApiStarViewerRequest`.
+ * Pass `null` for the default behavior.
+ *
+ * @internal
+ */
+export declare function behaviorFunctionKeyPrefix(pathPattern: string | null, eventType: FunctionEventType): string;
+/**
+ * Produces fully-resolved {@link AlarmDefinition}s for the three AWS-recommended
+ * CloudFront Function alarms — execution errors, validation errors, throttles —
+ * scoped to a single behavior + event type so the keys and descriptions stay
+ * actionable when the same underlying function is used on multiple behaviors.
+ *
+ * @internal
+ */
+export declare function resolveBehaviorFunctionAlarmDefinitions(pathPattern: string | null, eventType: FunctionEventType, fn: CfFunction, config: FunctionAlarmConfig | false | undefined): AlarmDefinition[];
+//# sourceMappingURL=behavior-function-alarms.d.ts.map

package/dist/behavior-function-alarms.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"behavior-function-alarms.d.ts","sourceRoot":"","sources":["../src/behavior-function-alarms.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,IAAI,UAAU,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC5F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAEhE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AA0B7D;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAUvD;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,iBAAiB,GAAG,MAAM,CAKpE;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,WAAW,EAAE,MAAM,GAAG,IAAI,EAC1B,SAAS,EAAE,iBAAiB,GAC3B,MAAM,CAIR;AAUD;;;;;;;GAOG;AACH,wBAAgB,uCAAuC,CACrD,WAAW,EAAE,MAAM,GAAG,IAAI,EAC1B,SAAS,EAAE,iBAAiB,EAC5B,EAAE,EAAE,UAAU,EACd,MAAM,EAAE,mBAAmB,GAAG,KAAK,GAAG,SAAS,GAC9C,eAAe,EAAE,CAyDnB"}

package/dist/behavior-function-alarms.js

@@ -0,0 +1,136 @@
+import { Duration } from "aws-cdk-lib";
+import { ComparisonOperator, Metric, Stats } from "aws-cdk-lib/aws-cloudwatch";
+import { resolveAlarmConfig } from "@composurecdk/cloudwatch";
+import { FUNCTION_ALARM_DEFAULTS } from "./alarm-defaults.js";
+const METRIC_PERIOD = Duration.minutes(1);
+const METRIC_PERIOD_LABEL = `${String(METRIC_PERIOD.toMinutes())} minute`;
+/**
+ * CloudFront Function metrics are emitted in the `us-east-1` region only
+ * (CloudFront is a global service). Metric dimensions are
+ * `FunctionName` + `Region=Global`.
+ *
+ * @see https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/monitoring-functions.html
+ */
+function functionMetric(fn, metricName) {
+    return new Metric({
+        namespace: "AWS/CloudFront",
+        metricName,
+        dimensionsMap: {
+            FunctionName: fn.functionName,
+            Region: "Global",
+        },
+        statistic: Stats.SUM,
+        period: METRIC_PERIOD,
+    });
+}
+/**
+ * Converts a CloudFront cache-behavior path pattern into a PascalCase slug
+ * suitable for alarm keys and CDK construct ids. A single leading `/` is
+ * dropped (the common case), interior `/` becomes `Slash` so sibling patterns
+ * don't collide, `*` becomes `Star`, and `?` becomes `Q`. Other
+ * non-alphanumeric characters are stripped.
+ *
+ * Examples:
+ * - `/api/*` → `ApiSlashStar`
+ * - `/api*`  → `ApiStar` (distinct from `/api/*`)
+ * - `*.html` → `StarHtml`
+ * - `images/*` → `ImagesSlashStar`
+ *
+ * @internal
+ */
+export function pathPatternSlug(pattern) {
+    const stripped = pattern.startsWith("/") ? pattern.slice(1) : pattern;
+    return stripped
+        .replace(/\//g, " Slash ")
+        .replace(/\*/g, " Star ")
+        .replace(/\?/g, " Q ")
+        .split(/[^A-Za-z0-9]+/)
+        .filter(Boolean)
+        .map((part) => part.charAt(0).toUpperCase() + part.slice(1).toLowerCase())
+        .join("");
+}
+/**
+ * Converts a {@link FunctionEventType} value (e.g. `"viewer-request"`) into
+ * PascalCase (e.g. `"ViewerRequest"`) for use in alarm keys and construct ids.
+ *
+ * @internal
+ */
+export function eventTypePascal(eventType) {
+    return eventType
+        .split("-")
+        .map((part) => part.charAt(0).toUpperCase() + part.slice(1).toLowerCase())
+        .join("");
+}
+/**
+ * Builds the prefix used for every alarm key produced for a given inline
+ * function — e.g. `defaultBehaviorViewerRequest` or `behaviorApiStarViewerRequest`.
+ * Pass `null` for the default behavior.
+ *
+ * @internal
+ */
+export function behaviorFunctionKeyPrefix(pathPattern, eventType) {
+    const scope = pathPattern === null ? "defaultBehavior" : `behavior${pathPatternSlug(pathPattern)}`;
+    return `${scope}${eventTypePascal(eventType)}`;
+}
+function behaviorFunctionScopeLabel(pathPattern, eventType) {
+    const scope = pathPattern === null ? "default behavior" : `behavior "${pathPattern}"`;
+    return `${scope} (${eventType})`;
+}
+/**
+ * Produces fully-resolved {@link AlarmDefinition}s for the three AWS-recommended
+ * CloudFront Function alarms — execution errors, validation errors, throttles —
+ * scoped to a single behavior + event type so the keys and descriptions stay
+ * actionable when the same underlying function is used on multiple behaviors.
+ *
+ * @internal
+ */
+export function resolveBehaviorFunctionAlarmDefinitions(pathPattern, eventType, fn, config) {
+    if (config === false)
+        return [];
+    if (config?.enabled === false)
+        return [];
+    const keyPrefix = behaviorFunctionKeyPrefix(pathPattern, eventType);
+    const scopeLabel = behaviorFunctionScopeLabel(pathPattern, eventType);
+    const definitions = [];
+    if (config?.executionErrors !== false) {
+        const cfg = resolveAlarmConfig(config?.executionErrors, FUNCTION_ALARM_DEFAULTS.executionErrors);
+        definitions.push({
+            key: `${keyPrefix}ExecutionErrors`,
+            metric: functionMetric(fn, "FunctionExecutionErrors"),
+            threshold: cfg.threshold,
+            comparisonOperator: ComparisonOperator.GREATER_THAN_THRESHOLD,
+            evaluationPeriods: cfg.evaluationPeriods,
+            datapointsToAlarm: cfg.datapointsToAlarm,
+            treatMissingData: cfg.treatMissingData,
+            description: `CloudFront Function on ${scopeLabel} is raising execution errors. Threshold: > ${String(cfg.threshold)} errors in ${METRIC_PERIOD_LABEL}.`,
+        });
+    }
+    if (config?.validationErrors !== false) {
+        const cfg = resolveAlarmConfig(config?.validationErrors, FUNCTION_ALARM_DEFAULTS.validationErrors);
+        definitions.push({
+            key: `${keyPrefix}ValidationErrors`,
+            metric: functionMetric(fn, "FunctionValidationErrors"),
+            threshold: cfg.threshold,
+            comparisonOperator: ComparisonOperator.GREATER_THAN_THRESHOLD,
+            evaluationPeriods: cfg.evaluationPeriods,
+            datapointsToAlarm: cfg.datapointsToAlarm,
+            treatMissingData: cfg.treatMissingData,
+            description: `CloudFront Function on ${scopeLabel} is producing validation errors. Threshold: > ${String(cfg.threshold)} errors in ${METRIC_PERIOD_LABEL}.`,
+        });
+    }
+    if (config?.throttles !== false) {
+        const cfg = resolveAlarmConfig(config?.throttles, FUNCTION_ALARM_DEFAULTS.throttles);
+        definitions.push({
+            key: `${keyPrefix}Throttles`,
+            metric: functionMetric(fn, "FunctionThrottles"),
+            threshold: cfg.threshold,
+            comparisonOperator: ComparisonOperator.GREATER_THAN_THRESHOLD,
+            evaluationPeriods: cfg.evaluationPeriods,
+            datapointsToAlarm: cfg.datapointsToAlarm,
+            treatMissingData: cfg.treatMissingData,
+            description: `CloudFront Function on ${scopeLabel} is being throttled — likely exceeding its 1ms compute budget. Threshold: > ${String(cfg.threshold)} throttles in ${METRIC_PERIOD_LABEL}.`,
+        });
+    }
+    return definitions;
+}
+//# sourceMappingURL=behavior-function-alarms.js.map

package/dist/behavior-function-alarms.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"behavior-function-alarms.js","sourceRoot":"","sources":["../src/behavior-function-alarms.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,kBAAkB,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAC;AAG/E,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAE9D,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAE9D,MAAM,aAAa,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAC1C,MAAM,mBAAmB,GAAG,GAAG,MAAM,CAAC,aAAa,CAAC,SAAS,EAAE,CAAC,SAAS,CAAC;AAE1E;;;;;;GAMG;AACH,SAAS,cAAc,CAAC,EAAc,EAAE,UAAkB;IACxD,OAAO,IAAI,MAAM,CAAC;QAChB,SAAS,EAAE,gBAAgB;QAC3B,UAAU;QACV,aAAa,EAAE;YACb,YAAY,EAAE,EAAE,CAAC,YAAY;YAC7B,MAAM,EAAE,QAAQ;SACjB;QACD,SAAS,EAAE,KAAK,CAAC,GAAG;QACpB,MAAM,EAAE,aAAa;KACtB,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IACtE,OAAO,QAAQ;SACZ,OAAO,CAAC,KAAK,EAAE,SAAS,CAAC;SACzB,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC;SACxB,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;SACrB,KAAK,CAAC,eAAe,CAAC;SACtB,MAAM,CAAC,OAAO,CAAC;SACf,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;SACzE,IAAI,CAAC,EAAE,CAAC,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,SAA4B;IAC1D,OAAO,SAAS;SACb,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;SACzE,IAAI,CAAC,EAAE,CAAC,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CACvC,WAA0B,EAC1B,SAA4B;IAE5B,MAAM,KAAK,GACT,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,WAAW,eAAe,CAAC,WAAW,CAAC,EAAE,CAAC;IACvF,OAAO,GAAG,KAAK,GAAG,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC;AACjD,CAAC;AAED,SAAS,0BAA0B,CACjC,WAA0B,EAC1B,SAA4B;IAE5B,MAAM,KAAK,GAAG,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,aAAa,WAAW,GAAG,CAAC;IACtF,OAAO,GAAG,KAAK,KAAK,SAAS,GAAG,CAAC;AACnC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,uCAAuC,CACrD,WAA0B,EAC1B,SAA4B,EAC5B,EAAc,EACd,MAA+C;IAE/C,IAAI,MAAM,KAAK,KAAK;QAAE,OAAO,EAAE,CAAC;IAChC,IAAI,MAAM,EAAE,OAAO,KAAK,KAAK;QAAE,OAAO,EAAE,CAAC;IAEzC,MAAM,SAAS,GAAG,yBAAyB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IACpE,MAAM,UAAU,GAAG,0BAA0B,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IACtE,MAAM,WAAW,GAAsB,EAAE,CAAC;IAE1C,IAAI,MAAM,EAAE,eAAe,KAAK,KAAK,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,kBAAkB,CAC5B,MAAM,EAAE,eAAe,EACvB,uBAAuB,CAAC,eAAe,CACxC,CAAC;QACF,WAAW,CAAC,IAAI,CAAC;YACf,GAAG,EAAE,GAAG,SAAS,iBAAiB;YAClC,MAAM,EAAE,cAAc,CAAC,EAAE,EAAE,yBAAyB,CAAC;YACrD,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,kBAAkB,EAAE,kBAAkB,CAAC,sBAAsB;YAC7D,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;YACxC,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;YACxC,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;YACtC,WAAW,EAAE,0BAA0B,UAAU,8CAA8C,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,mBAAmB,GAAG;SACzJ,CAAC,CAAC;IACL,CAAC;IAED,IAAI,MAAM,EAAE,gBAAgB,KAAK,KAAK,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,kBAAkB,CAC5B,MAAM,EAAE,gBAAgB,EACxB,uBAAuB,CAAC,gBAAgB,CACzC,CAAC;QACF,WAAW,CAAC,IAAI,CAAC;YACf,GAAG,EAAE,GAAG,SAAS,kBAAkB;YACnC,MAAM,EAAE,cAAc,CAAC,EAAE,EAAE,0BAA0B,CAAC;YACtD,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,kBAAkB,EAAE,kBAAkB,CAAC,sBAAsB;YAC7D,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;YACxC,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;YACxC,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;YACtC,WAAW,EAAE,0BAA0B,UAAU,iDAAiD,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,mBAAmB,GAAG;SAC5J,CAAC,CAAC;IACL,CAAC;IAED,IAAI,MAAM,EAAE,SAAS,KAAK,KAAK,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,kBAAkB,CAAC,MAAM,EAAE,SAAS,EAAE,uBAAuB,CAAC,SAAS,CAAC,CAAC;QACrF,WAAW,CAAC,IAAI,CAAC;YACf,GAAG,EAAE,GAAG,SAAS,WAAW;YAC5B,MAAM,EAAE,cAAc,CAAC,EAAE,EAAE,mBAAmB,CAAC;YAC/C,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,kBAAkB,EAAE,kBAAkB,CAAC,sBAAsB;YAC7D,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;YACxC,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;YACxC,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;YACtC,WAAW,EAAE,0BAA0B,UAAU,+EAA+E,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,iBAAiB,mBAAmB,GAAG;SAC7L,CAAC,CAAC;IACL,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC"}

package/dist/defaults.d.ts

@@ -1,4 +1,4 @@
-import type { DistributionBuilderProps } from "./distribution-builder.js";
+import type { DistributionBuilderProps, InlineFunctionDefinition } from "./distribution-builder.js";
 /**
  * Secure, AWS-recommended defaults applied to every CloudFront distribution
  * built with {@link createDistributionBuilder}. Each property can be individually
@@ -9,4 +9,9 @@ import type { DistributionBuilderProps } from "./distribution-builder.js";
  * then the resolved origin is injected.
  */
 export declare const DISTRIBUTION_DEFAULTS: Partial<DistributionBuilderProps>;
+/**
+ * Defaults applied to every inline CloudFront Function declared on a cache
+ * behavior. User-provided properties take precedence.
+ */
+export declare const INLINE_FUNCTION_DEFAULTS: Partial<InlineFunctionDefinition>;
 //# sourceMappingURL=defaults.d.ts.map

package/dist/defaults.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"defaults.d.ts","sourceRoot":"","sources":["../src/defaults.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAE1E;;;;;;;;GAQG;AACH,eAAO,MAAM,qBAAqB,EAAE,OAAO,CAAC,wBAAwB,CAkDnE,CAAC"}
+{"version":3,"file":"defaults.d.ts","sourceRoot":"","sources":["../src/defaults.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAEpG;;;;;;;;GAQG;AACH,eAAO,MAAM,qBAAqB,EAAE,OAAO,CAAC,wBAAwB,CAkDnE,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,wBAAwB,EAAE,OAAO,CAAC,wBAAwB,CAOtE,CAAC"}

package/dist/defaults.js

@@ -1,4 +1,4 @@
-import { HttpVersion, PriceClass, ResponseHeadersPolicy, SecurityPolicyProtocol, ViewerProtocolPolicy, } from "aws-cdk-lib/aws-cloudfront";
+import { FunctionRuntime, HttpVersion, PriceClass, ResponseHeadersPolicy, SecurityPolicyProtocol, ViewerProtocolPolicy, } from "aws-cdk-lib/aws-cloudfront";
 /**
  * Secure, AWS-recommended defaults applied to every CloudFront distribution
  * built with {@link createDistributionBuilder}. Each property can be individually
@@ -53,4 +53,16 @@ export const DISTRIBUTION_DEFAULTS = {
         responseHeadersPolicy: ResponseHeadersPolicy.SECURITY_HEADERS,
     },
 };
+/**
+ * Defaults applied to every inline CloudFront Function declared on a cache
+ * behavior. User-provided properties take precedence.
+ */
+export const INLINE_FUNCTION_DEFAULTS = {
+    /**
+     * Use the `cloudfront-js-2.0` runtime by default. It is a superset of
+     * `cloudfront-js-1.0` (async/await, `crypto.subtle`, KeyValueStore support).
+     * @see https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/functions-javascript-runtime-20.html
+     */
+    runtime: FunctionRuntime.JS_2_0,
+};
 //# sourceMappingURL=defaults.js.map

package/dist/defaults.js.map

@@ -1 +1 @@
-{"version":3,"file":"defaults.js","sourceRoot":"","sources":["../src/defaults.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,UAAU,EACV,qBAAqB,EACrB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,4BAA4B,CAAC;AAGpC;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAsC;IACtE;;;;;OAKG;IACH,aAAa,EAAE,IAAI;IAEnB;;;;OAIG;IACH,UAAU,EAAE,UAAU,CAAC,eAAe;IAEtC;;;;OAIG;IACH,WAAW,EAAE,WAAW,CAAC,WAAW;IAEpC;;;OAGG;IACH,iBAAiB,EAAE,YAAY;IAE/B;;;;OAIG;IACH,sBAAsB,EAAE,sBAAsB,CAAC,aAAa;IAE5D,eAAe,EAAE;QACf;;;WAGG;QACH,oBAAoB,EAAE,oBAAoB,CAAC,iBAAiB;QAE5D;;;;WAIG;QACH,qBAAqB,EAAE,qBAAqB,CAAC,gBAAgB;KAC9D;CACF,CAAC"}
+{"version":3,"file":"defaults.js","sourceRoot":"","sources":["../src/defaults.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,WAAW,EACX,UAAU,EACV,qBAAqB,EACrB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,4BAA4B,CAAC;AAGpC;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAsC;IACtE;;;;;OAKG;IACH,aAAa,EAAE,IAAI;IAEnB;;;;OAIG;IACH,UAAU,EAAE,UAAU,CAAC,eAAe;IAEtC;;;;OAIG;IACH,WAAW,EAAE,WAAW,CAAC,WAAW;IAEpC;;;OAGG;IACH,iBAAiB,EAAE,YAAY;IAE/B;;;;OAIG;IACH,sBAAsB,EAAE,sBAAsB,CAAC,aAAa;IAE5D,eAAe,EAAE;QACf;;;WAGG;QACH,oBAAoB,EAAE,oBAAoB,CAAC,iBAAiB;QAE5D;;;;WAIG;QACH,qBAAqB,EAAE,qBAAqB,CAAC,gBAAgB;KAC9D;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAsC;IACzE;;;;OAIG;IACH,OAAO,EAAE,eAAe,CAAC,MAAM;CAChC,CAAC"}

package/dist/distribution-alarms.d.ts

@@ -1,26 +1,9 @@
-import { type Alarm } from "aws-cdk-lib/aws-cloudwatch";
 import type { Distribution } from "aws-cdk-lib/aws-cloudfront";
-import type { IConstruct } from "constructs";
 import type { AlarmDefinition } from "@composurecdk/cloudwatch";
-import { AlarmDefinitionBuilder } from "@composurecdk/cloudwatch";
 import type { DistributionAlarmConfig } from "./alarm-config.js";
 /**
  * Resolves the recommended alarm configuration into fully-resolved
  * {@link AlarmDefinition}s for a CloudFront distribution.
  */
 export declare function resolveDistributionAlarmDefinitions(distribution: Distribution, config: DistributionAlarmConfig | undefined): AlarmDefinition[];
-/**
- * Creates AWS-recommended CloudWatch alarms for a CloudFront distribution,
- * merging recommended definitions with any custom alarm builders.
- *
- * @param scope - CDK construct scope for creating alarm constructs.
- * @param id - Base identifier for alarm construct ids.
- * @param distribution - The CloudFront distribution to create alarms for.
- * @param config - User-provided alarm configuration, or `false` to disable all.
- * @param customAlarms - Custom alarm builders added via `addAlarm()`.
- * @returns A record mapping alarm keys to their created Alarm constructs.
- *
- * @see https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Best_Practice_Recommended_Alarms_AWS_Services.html#CloudFront
- */
-export declare function createDistributionAlarms(scope: IConstruct, id: string, distribution: Distribution, config: DistributionAlarmConfig | false | undefined, customAlarms?: AlarmDefinitionBuilder<Distribution>[]): Record<string, Alarm>;
 //# sourceMappingURL=distribution-alarms.d.ts.map

package/dist/distribution-alarms.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"distribution-alarms.d.ts","sourceRoot":"","sources":["../src/distribution-alarms.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,KAAK,EAAqC,MAAM,4BAA4B,CAAC;AAC3F,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAoC,MAAM,0BAA0B,CAAC;AACpG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AA2BjE;;;GAGG;AACH,wBAAgB,mCAAmC,CACjD,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE,uBAAuB,GAAG,SAAS,GAC1C,eAAe,EAAE,CAqCnB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,UAAU,EACjB,EAAE,EAAE,MAAM,EACV,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE,uBAAuB,GAAG,KAAK,GAAG,SAAS,EACnD,YAAY,GAAE,sBAAsB,CAAC,YAAY,CAAC,EAAO,GACxD,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAUvB"}
+{"version":3,"file":"distribution-alarms.d.ts","sourceRoot":"","sources":["../src/distribution-alarms.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAEhE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AA2BjE;;;GAGG;AACH,wBAAgB,mCAAmC,CACjD,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE,uBAAuB,GAAG,SAAS,GAC1C,eAAe,EAAE,CAqCnB"}

package/dist/distribution-alarms.js

@@ -1,6 +1,6 @@
 import { Duration } from "aws-cdk-lib";
 import { ComparisonOperator, Metric, Stats } from "aws-cdk-lib/aws-cloudwatch";
-import { createAlarms, resolveAlarmConfig } from "@composurecdk/cloudwatch";
+import { resolveAlarmConfig } from "@composurecdk/cloudwatch";
 import { DISTRIBUTION_ALARM_DEFAULTS } from "./alarm-defaults.js";
 const METRIC_PERIOD = Duration.minutes(1);
 const METRIC_PERIOD_LABEL = `${String(METRIC_PERIOD.toMinutes())} minute`;
@@ -56,27 +56,4 @@ export function resolveDistributionAlarmDefinitions(distribution, config) {
     }
     return definitions;
 }
-/**
- * Creates AWS-recommended CloudWatch alarms for a CloudFront distribution,
- * merging recommended definitions with any custom alarm builders.
- *
- * @param scope - CDK construct scope for creating alarm constructs.
- * @param id - Base identifier for alarm construct ids.
- * @param distribution - The CloudFront distribution to create alarms for.
- * @param config - User-provided alarm configuration, or `false` to disable all.
- * @param customAlarms - Custom alarm builders added via `addAlarm()`.
- * @returns A record mapping alarm keys to their created Alarm constructs.
- *
- * @see https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Best_Practice_Recommended_Alarms_AWS_Services.html#CloudFront
- */
-export function createDistributionAlarms(scope, id, distribution, config, customAlarms = []) {
-    if (config === false)
-        return {};
-    const enabled = config?.enabled ?? DISTRIBUTION_ALARM_DEFAULTS.enabled;
-    if (!enabled)
-        return {};
-    const recommended = resolveDistributionAlarmDefinitions(distribution, config);
-    const custom = customAlarms.map((b) => b.resolve(distribution));
-    return createAlarms(scope, id, [...recommended, ...custom]);
-}
 //# sourceMappingURL=distribution-alarms.js.map

package/dist/distribution-alarms.js.map

@@ -1 +1 @@
-{"version":3,"file":"distribution-alarms.js","sourceRoot":"","sources":["../src/distribution-alarms.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAc,kBAAkB,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAC;AAI3F,OAAO,EAA0B,YAAY,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAEpG,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAElE,MAAM,aAAa,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAC1C,MAAM,mBAAmB,GAAG,GAAG,MAAM,CAAC,aAAa,CAAC,SAAS,EAAE,CAAC,SAAS,CAAC;AAE1E;;;GAGG;AACH,SAAS,kBAAkB,CACzB,YAA0B,EAC1B,UAAkB,EAClB,SAAiB;IAEjB,OAAO,IAAI,MAAM,CAAC;QAChB,SAAS,EAAE,gBAAgB;QAC3B,UAAU;QACV,aAAa,EAAE;YACb,cAAc,EAAE,YAAY,CAAC,cAAc;YAC3C,MAAM,EAAE,QAAQ;SACjB;QACD,SAAS;QACT,MAAM,EAAE,aAAa;KACtB,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mCAAmC,CACjD,YAA0B,EAC1B,MAA2C;IAE3C,IAAI,MAAM,EAAE,OAAO,KAAK,KAAK;QAAE,OAAO,EAAE,CAAC;IAEzC,MAAM,WAAW,GAAsB,EAAE,CAAC;IAE1C,IAAI,MAAM,EAAE,SAAS,KAAK,KAAK,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,kBAAkB,CAAC,MAAM,EAAE,SAAS,EAAE,2BAA2B,CAAC,SAAS,CAAC,CAAC;QACzF,WAAW,CAAC,IAAI,CAAC;YACf,GAAG,EAAE,WAAW;YAChB,MAAM,EAAE,kBAAkB,CAAC,YAAY,EAAE,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC;YACvE,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,kBAAkB,EAAE,kBAAkB,CAAC,sBAAsB;YAC7D,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;YACxC,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;YACxC,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;YACtC,WAAW,EAAE,oEAAoE,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,mBAAmB,GAAG;SACrI,CAAC,CAAC;IACL,CAAC;IAED,IAAI,MAAM,EAAE,aAAa,KAAK,KAAK,EAAE,CAAC;QACpC,MAAM,GAAG,GAAG,kBAAkB,CAC5B,MAAM,EAAE,aAAa,EACrB,2BAA2B,CAAC,aAAa,CAC1C,CAAC;QACF,WAAW,CAAC,IAAI,CAAC;YACf,GAAG,EAAE,eAAe;YACpB,MAAM,EAAE,kBAAkB,CAAC,YAAY,EAAE,eAAe,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YAC/E,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,kBAAkB,EAAE,kBAAkB,CAAC,sBAAsB;YAC7D,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;YACxC,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;YACxC,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;YACtC,WAAW,EAAE,uDAAuD,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,aAAa,mBAAmB,GAAG;SAC7H,CAAC,CAAC;IACL,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,wBAAwB,CACtC,KAAiB,EACjB,EAAU,EACV,YAA0B,EAC1B,MAAmD,EACnD,eAAuD,EAAE;IAEzD,IAAI,MAAM,KAAK,KAAK;QAAE,OAAO,EAAE,CAAC;IAEhC,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,IAAI,2BAA2B,CAAC,OAAO,CAAC;IACvE,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IAExB,MAAM,WAAW,GAAG,mCAAmC,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAC9E,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;IAEhE,OAAO,YAAY,CAAC,KAAK,EAAE,EAAE,EAAE,CAAC,GAAG,WAAW,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC;AAC9D,CAAC"}
+{"version":3,"file":"distribution-alarms.js","sourceRoot":"","sources":["../src/distribution-alarms.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,kBAAkB,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAC;AAG/E,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAE9D,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAElE,MAAM,aAAa,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAC1C,MAAM,mBAAmB,GAAG,GAAG,MAAM,CAAC,aAAa,CAAC,SAAS,EAAE,CAAC,SAAS,CAAC;AAE1E;;;GAGG;AACH,SAAS,kBAAkB,CACzB,YAA0B,EAC1B,UAAkB,EAClB,SAAiB;IAEjB,OAAO,IAAI,MAAM,CAAC;QAChB,SAAS,EAAE,gBAAgB;QAC3B,UAAU;QACV,aAAa,EAAE;YACb,cAAc,EAAE,YAAY,CAAC,cAAc;YAC3C,MAAM,EAAE,QAAQ;SACjB;QACD,SAAS;QACT,MAAM,EAAE,aAAa;KACtB,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mCAAmC,CACjD,YAA0B,EAC1B,MAA2C;IAE3C,IAAI,MAAM,EAAE,OAAO,KAAK,KAAK;QAAE,OAAO,EAAE,CAAC;IAEzC,MAAM,WAAW,GAAsB,EAAE,CAAC;IAE1C,IAAI,MAAM,EAAE,SAAS,KAAK,KAAK,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,kBAAkB,CAAC,MAAM,EAAE,SAAS,EAAE,2BAA2B,CAAC,SAAS,CAAC,CAAC;QACzF,WAAW,CAAC,IAAI,CAAC;YACf,GAAG,EAAE,WAAW;YAChB,MAAM,EAAE,kBAAkB,CAAC,YAAY,EAAE,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC;YACvE,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,kBAAkB,EAAE,kBAAkB,CAAC,sBAAsB;YAC7D,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;YACxC,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;YACxC,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;YACtC,WAAW,EAAE,oEAAoE,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,mBAAmB,GAAG;SACrI,CAAC,CAAC;IACL,CAAC;IAED,IAAI,MAAM,EAAE,aAAa,KAAK,KAAK,EAAE,CAAC;QACpC,MAAM,GAAG,GAAG,kBAAkB,CAC5B,MAAM,EAAE,aAAa,EACrB,2BAA2B,CAAC,aAAa,CAC1C,CAAC;QACF,WAAW,CAAC,IAAI,CAAC;YACf,GAAG,EAAE,eAAe;YACpB,MAAM,EAAE,kBAAkB,CAAC,YAAY,EAAE,eAAe,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YAC/E,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,kBAAkB,EAAE,kBAAkB,CAAC,sBAAsB;YAC7D,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;YACxC,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;YACxC,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;YACtC,WAAW,EAAE,uDAAuD,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,aAAa,mBAAmB,GAAG;SAC7H,CAAC,CAAC;IACL,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC"}

package/dist/distribution-builder.d.ts

@@ -1,24 +1,109 @@
-import { Distribution, type DistributionProps, type IOrigin, type AddBehaviorOptions } from "aws-cdk-lib/aws-cloudfront";
+import { Distribution, type DistributionProps, type IOrigin, type AddBehaviorOptions, type BehaviorOptions, type Function as CfFunction, type FunctionCode, type FunctionEventType, type FunctionRuntime, type IKeyValueStore } from "aws-cdk-lib/aws-cloudfront";
 import { type ICertificate } from "aws-cdk-lib/aws-certificatemanager";
 import { type Alarm } from "aws-cdk-lib/aws-cloudwatch";
 import { type Bucket } from "aws-cdk-lib/aws-s3";
 import { type IConstruct } from "constructs";
 import { type IBuilder, type Lifecycle, type Resolvable } from "@composurecdk/core";
 import { AlarmDefinitionBuilder } from "@composurecdk/cloudwatch";
-import type { DistributionAlarmConfig } from "./alarm-config.js";
+import type { DistributionAlarmConfig, FunctionAlarmConfig } from "./alarm-config.js";
+/**
+ * A CloudFront Function declared inline on a cache behavior. The distribution
+ * builder creates the underlying {@link CfFunction} construct and wires it
+ * into the behavior's function associations. Recommended alarms for the
+ * function are emitted automatically, scoped to the behavior's path pattern.
+ *
+ * Only inline declarations are supported — there is no "bring your own
+ * function" escape hatch, because the whole point of owning the function is
+ * to emit path-scoped `FunctionExecutionErrors` / `FunctionValidationErrors`
+ * / `FunctionThrottles` alarms that couldn't be emitted from an external
+ * `IFunctionRef` (which exposes only an ARN, not a function name).
+ *
+ * @see https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/cloudfront-functions.html
+ */
+export interface InlineFunctionDefinition {
+    /** The viewer event that should invoke the function. */
+    eventType: FunctionEventType;
+    /** The source for the function — `FunctionCode.fromInline()` or `.fromFile()`. */
+    code: FunctionCode;
+    /**
+     * Explicit physical name for the function. Useful when operators search
+     * CloudWatch logs or metrics by function name rather than by ARN. If omitted,
+     * CDK generates a name derived from the construct path.
+     */
+    functionName?: string;
+    /**
+     * JavaScript runtime.
+     * @default FunctionRuntime.JS_2_0
+     */
+    runtime?: FunctionRuntime;
+    /** Optional comment stored on the function resource. */
+    comment?: string;
+    /**
+     * Key-value store to associate with the function. Only supported on the
+     * `cloudfront-js-2.0` runtime.
+     */
+    keyValueStore?: IKeyValueStore;
+    /**
+     * Per-function alarm configuration. Defaults to the three AWS-recommended
+     * alarms (execution errors, validation errors, throttles) each with
+     * threshold 0. Set to `false` to disable all alarms for this function, or
+     * override individual alarms via their config entry.
+     *
+     * **Region requirement:** CloudFront metrics are emitted in `us-east-1`
+     * only. CloudWatch alarms are regional, so these alarms will only fire if
+     * the containing stack is deployed in `us-east-1`. The builder emits a
+     * synth-time warning if this isn't the case.
+     *
+     * @see https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/monitoring-functions.html
+     */
+    recommendedAlarms?: FunctionAlarmConfig | false;
+}
+/**
+ * Configuration for the distribution's default cache behavior.
+ *
+ * The origin is set separately via {@link IDistributionBuilder.origin}. The
+ * `functionAssociations` field from {@link AddBehaviorOptions} is replaced by
+ * {@link functions}, which takes {@link InlineFunctionDefinition}s — the
+ * builder owns the CloudFront Function constructs so it can emit alarms for
+ * them.
+ */
+export interface DefaultBehaviorConfig extends Omit<AddBehaviorOptions, "functionAssociations"> {
+    /**
+     * CloudFront Functions to associate with the default behavior. At most one
+     * function per {@link FunctionEventType} is allowed.
+     */
+    functions?: InlineFunctionDefinition[];
+}
+/**
+ * Configuration for a path-pattern cache behavior attached to the distribution
+ * via {@link IDistributionBuilder.behavior}.
+ *
+ * Unlike {@link DefaultBehaviorConfig}, `origin` is required. It may be a
+ * concrete {@link IOrigin} or a {@link Resolvable} (typically a {@link ref})
+ * for cross-component wiring.
+ */
+export interface AdditionalBehaviorConfig extends Omit<BehaviorOptions, "origin" | "functionAssociations"> {
+    /** The origin for this behavior, concrete or resolved at build time. */
+    origin: Resolvable<IOrigin>;
+    /**
+     * CloudFront Functions to associate with this behavior. At most one
+     * function per {@link FunctionEventType} is allowed.
+     */
+    functions?: InlineFunctionDefinition[];
+}
 /**
  * Configuration properties for the CloudFront distribution builder.
  *
  * Extends the CDK {@link DistributionProps} with additional builder-specific
- * options. The `defaultBehavior` field is replaced with {@link AddBehaviorOptions}
- * (which excludes `origin`) because the origin is set separately via the
- * {@link IDistributionBuilder.origin | origin()} method, which supports
- * {@link Resolvable} for cross-component wiring.
+ * options. `defaultBehavior` accepts a {@link DefaultBehaviorConfig} with
+ * inline function definitions; additional behaviors are added via the
+ * {@link IDistributionBuilder.behavior} method rather than the raw
+ * `additionalBehaviors` record.
  *
  * The `enableLogging` CDK prop is replaced by {@link accessLogging}, which
  * auto-creates a logging bucket with secure defaults when enabled.
  */
-export interface DistributionBuilderProps extends Omit<DistributionProps, "defaultBehavior" | "enableLogging" | "certificate"> {
+export interface DistributionBuilderProps extends Omit<DistributionProps, "defaultBehavior" | "additionalBehaviors" | "enableLogging" | "certificate"> {
     /**
      * Whether to automatically create an S3 bucket for CloudFront standard
      * access logging.
@@ -44,36 +129,59 @@ export interface DistributionBuilderProps extends Omit<DistributionProps, "defau
      */
     certificate?: Resolvable<ICertificate>;
     /**
-     * Options for the default cache behavior, excluding `origin`.
-     *
-     * The origin is set via the {@link IDistributionBuilder.origin | origin()}
-     * method and injected at build time. All other behavior options (cache
-     * policy, function associations, viewer protocol policy, etc.) can be
-     * configured here.
+     * Configuration for the default cache behavior. The origin is set via
+     * {@link IDistributionBuilder.origin}. Inline CloudFront Functions declared
+     * in `functions` are created by the builder and receive path-scoped alarms
+     * automatically.
      */
-    defaultBehavior?: AddBehaviorOptions;
+    defaultBehavior?: DefaultBehaviorConfig;
     /**
-     * Configuration for AWS-recommended CloudWatch alarms.
+     * Configuration for AWS-recommended CloudWatch alarms at the **distribution**
+     * level (5xx error rate, origin latency).
+     *
+     * Scope: this setting controls *distribution-level* alarms only. Per-function
+     * alarms (`FunctionExecutionErrors`, `FunctionValidationErrors`,
+     * `FunctionThrottles`) are configured independently via each
+     * {@link InlineFunctionDefinition.recommendedAlarms}, because their
+     * correct disposition depends on the behavior the function is attached to.
+     *
+     * **Region requirement:** CloudFront metrics are emitted in `us-east-1`
+     * only. CloudWatch alarms are regional, so *every* alarm created by this
+     * builder (distribution-level and per-function) will only fire if the
+     * containing stack is deployed in `us-east-1`. The builder emits a
+     * synth-time warning if this isn't the case.
      *
-     * By default, the builder creates recommended alarms for 5xx error rate
-     * and origin latency. Individual alarms can be customized or disabled.
-     * Set to `false` to disable all alarms.
+     * By default, the builder creates recommended distribution alarms.
+     * Individual alarms can be customized or disabled; set to `false` to
+     * disable all distribution-level alarms — **function alarms remain
+     * enabled**. To disable function alarms, set `recommendedAlarms: false`
+     * on the corresponding {@link InlineFunctionDefinition}.
      *
-     * No alarm actions are configured by default since notification
-     * methods are user-specific. Access alarms from the build result
-     * or use an `afterBuild` hook to apply actions.
+     * No alarm actions are configured by default since notification methods
+     * are user-specific. Access alarms from the build result or use an
+     * `afterBuild` hook to apply actions.
      *
-     * Function-level alarms (FunctionValidationErrors, FunctionExecutionErrors,
-     * FunctionThrottles) require per-function dimensions. Use
-     * {@link IDistributionBuilder.addAlarm} to add them.
+     * @example
+     * ```ts
+     * createDistributionBuilder()
+     *   .origin(siteOrigin)
+     *   .recommendedAlarms(false)          // disables distribution alarms only
+     *   .defaultBehavior({
+     *     functions: [{
+     *       eventType: FunctionEventType.VIEWER_REQUEST,
+     *       code,
+     *       recommendedAlarms: false,      // must also disable function alarms explicitly
+     *     }],
+     *   });
+     * ```
      *
      * @see https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Best_Practice_Recommended_Alarms_AWS_Services.html#CloudFront
      */
     recommendedAlarms?: DistributionAlarmConfig | false;
 }
 /**
- * The build output of a {@link IDistributionBuilder}. Contains the CDK constructs
- * created during {@link Lifecycle.build}, keyed by role.
+ * The build output of an {@link IDistributionBuilder}. Contains the CDK
+ * constructs created during {@link Lifecycle.build}, keyed by role.
  */
 export interface DistributionBuilderResult {
     /** The CloudFront distribution construct created by the builder. */
@@ -84,42 +192,56 @@ export interface DistributionBuilderResult {
      */
     accessLogsBucket?: Bucket;
     /**
-     * CloudWatch alarms created for the distribution, keyed by alarm name.
+     * CloudFront Functions created by the builder for inline function
+     * definitions, keyed by `<behaviorScope><EventType>` —
+     * e.g. `defaultBehaviorViewerRequest`, `behaviorApiStarViewerRequest`.
      *
-     * Includes both AWS-recommended alarms and any custom alarms added
-     * via {@link IDistributionBuilder.addAlarm}. Access individual alarms
-     * by key (e.g., `result.alarms.errorRate`).
-     *
-     * No alarm actions are configured — apply them via the result or an
-     * `afterBuild` hook.
+     * Empty if no inline functions were declared.
+     */
+    functions: Record<string, CfFunction>;
+    /**
+     * CloudWatch alarms created for the distribution and its inline functions,
+     * keyed by alarm name. Distribution-level keys: `errorRate`, `originLatency`.
+     * Function-level keys are prefixed by behavior scope and event type —
+     * e.g. `defaultBehaviorViewerRequestExecutionErrors`.
      *
-     * @see https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Best_Practice_Recommended_Alarms_AWS_Services.html#CloudFront
+     * Includes both recommended alarms and custom alarms added via
+     * {@link IDistributionBuilder.addAlarm}. No alarm actions are configured.
      */
     alarms: Record<string, Alarm>;
 }
 /**
  * A fluent builder for configuring and creating a CloudFront distribution.
  *
- * Configuration properties from CDK {@link DistributionProps} are exposed as
- * overloaded getter/setter methods via the builder proxy. The origin is set
- * via the {@link origin} method, which accepts a concrete {@link IOrigin} or
- * a {@link Ref} for cross-component wiring.
+ * Properties from CDK {@link DistributionProps} are exposed as overloaded
+ * getter/setter methods. The origin is set via {@link origin}, which accepts
+ * a concrete {@link IOrigin} or a {@link Ref} for cross-component wiring.
+ * Additional cache behaviors are added via {@link behavior}, which takes a
+ * path pattern and a config including its own origin and inline functions.
  *
  * The builder implements {@link Lifecycle}, so it can be used directly as a
- * component in a {@link compose | composed system}. When built, it creates
- * a CloudFront distribution with the configured properties and returns a
- * {@link DistributionBuilderResult}.
+ * component in a {@link compose | composed system}. When built, it creates a
+ * CloudFront distribution, any inline CloudFront Functions declared on its
+ * behaviors, and AWS-recommended alarms scoped per-behavior.
  *
  * @example
  * ```ts
  * const cdn = createDistributionBuilder()
- *   .origin(ref("site", (r: BucketBuilderResult) =>
- *     S3BucketOrigin.withOriginAccessControl(r.bucket)))
- *   .errorResponses([{
- *     httpStatus: 404,
- *     responsePagePath: "/index.html",
- *     responseHttpStatus: 200,
- *   }]);
+ *   .origin(siteOrigin)
+ *   .defaultBehavior({
+ *     functions: [{
+ *       eventType: FunctionEventType.VIEWER_REQUEST,
+ *       code: FunctionCode.fromFile({ filePath: "src/edge/rewrite.js" }),
+ *     }],
+ *   })
+ *   .behavior("/api/*", {
+ *     origin: apiOrigin,
+ *     cachePolicy: CachePolicy.CACHING_DISABLED,
+ *     functions: [{
+ *       eventType: FunctionEventType.VIEWER_REQUEST,
+ *       code: FunctionCode.fromFile({ filePath: "src/edge/api-auth.js" }),
+ *     }],
+ *   });
  * ```
  */
 export type IDistributionBuilder = IBuilder<DistributionBuilderProps, DistributionBuilder>;
@@ -137,6 +259,15 @@ declare class DistributionBuilder implements Lifecycle<DistributionBuilderResult
      * @returns This builder for chaining.
      */
     origin(origin: Resolvable<IOrigin>): this;
+    /**
+     * Adds an additional cache behavior for a path pattern. The behavior's
+     * origin is required (concrete or Resolvable). Any inline functions are
+     * created by the builder and receive per-behavior alarms scoped to the
+     * path pattern.
+     *
+     * @throws If a behavior for the same path pattern has already been added.
+     */
+    behavior(pathPattern: string, config: AdditionalBehaviorConfig): this;
     build(scope: IConstruct, id: string, context?: Record<string, object>): DistributionBuilderResult;
 }
 /**
@@ -145,26 +276,27 @@ declare class DistributionBuilder implements Lifecycle<DistributionBuilderResult
  * This is the entry point for defining a CloudFront distribution component.
  * The returned builder exposes every {@link DistributionBuilderProps} property
  * as a fluent setter/getter, plus {@link IDistributionBuilder.origin | origin()}
- * for setting the default origin with Ref support. It implements {@link Lifecycle}
- * for use with {@link compose}.
+ * for setting the default origin with Ref support and
+ * {@link IDistributionBuilder.behavior | behavior()} for path-pattern behaviors.
+ * It implements {@link Lifecycle} for use with {@link compose}.
  *
  * @returns A fluent builder for a CloudFront distribution.
  *
  * @example
  * ```ts
  * const cdn = createDistributionBuilder()
- *   .origin(ref("site", (r: BucketBuilderResult) =>
+ *   .origin(ref<BucketBuilderResult>("site", (r) =>
  *     S3BucketOrigin.withOriginAccessControl(r.bucket)))
- *   .comment("Community website CDN");
- *
- * // Use standalone:
- * const result = cdn.build(stack, "CDN");
- *
- * // Or compose into a system:
- * const system = compose(
- *   { site: createBucketBuilder(), cdn },
- *   { site: [], cdn: ["site"] },
- * );
+ *   .defaultBehavior({
+ *     functions: [{
+ *       eventType: FunctionEventType.VIEWER_REQUEST,
+ *       code: FunctionCode.fromFile({ filePath: "src/edge/rewrite.js" }),
+ *     }],
+ *   })
+ *   .behavior("/api/*", {
+ *     origin: apiOrigin,
+ *     cachePolicy: CachePolicy.CACHING_DISABLED,
+ *   });
  * ```
  */
 export declare function createDistributionBuilder(): IDistributionBuilder;

package/dist/distribution-builder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"distribution-builder.d.ts","sourceRoot":"","sources":["../src/distribution-builder.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,KAAK,iBAAiB,EACtB,KAAK,OAAO,EACZ,KAAK,kBAAkB,EACxB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,KAAK,YAAY,EAAE,MAAM,oCAAoC,CAAC;AACvE,OAAO,EAAE,KAAK,KAAK,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,EAAE,KAAK,MAAM,EAAmB,MAAM,oBAAoB,CAAC;AAElE,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAEL,KAAK,QAAQ,EACb,KAAK,SAAS,EAEd,KAAK,UAAU,EAChB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAElE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAIjE;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,wBAAyB,SAAQ,IAAI,CACpD,iBAAiB,EACjB,iBAAiB,GAAG,eAAe,GAAG,aAAa,CACpD;IACC;;;;;;;;;;;;;;OAcG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IAExB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC;IAEvC;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,kBAAkB,CAAC;IAErC;;;;;;;;;;;;;;;;OAgBG;IACH,iBAAiB,CAAC,EAAE,uBAAuB,GAAG,KAAK,CAAC;CACrD;AAED;;;GAGG;AACH,MAAM,WAAW,yBAAyB;IACxC,oEAAoE;IACpE,YAAY,EAAE,YAAY,CAAC;IAE3B;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B;;;;;;;;;;;OAWG;IACH,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;CAC/B;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,MAAM,oBAAoB,GAAG,QAAQ,CAAC,wBAAwB,EAAE,mBAAmB,CAAC,CAAC;AAE3F,cAAM,mBAAoB,YAAW,SAAS,CAAC,yBAAyB,CAAC;;IACvE,KAAK,EAAE,OAAO,CAAC,wBAAwB,CAAC,CAAM;IAI9C,QAAQ,CACN,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,CACT,KAAK,EAAE,sBAAsB,CAAC,YAAY,CAAC,KACxC,sBAAsB,CAAC,YAAY,CAAC,GACxC,IAAI;IAKP;;;;;;;;OAQG;IACH,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC,GAAG,IAAI;IAKzC,KAAK,CACH,KAAK,EAAE,UAAU,EACjB,EAAE,EAAE,MAAM,EACV,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,yBAAyB;CA4E7B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,yBAAyB,IAAI,oBAAoB,CAEhE"}
+{"version":3,"file":"distribution-builder.d.ts","sourceRoot":"","sources":["../src/distribution-builder.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,KAAK,iBAAiB,EACtB,KAAK,OAAO,EACZ,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,QAAQ,IAAI,UAAU,EAC3B,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,cAAc,EACpB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,KAAK,YAAY,EAAE,MAAM,oCAAoC,CAAC;AACvE,OAAO,EAAE,KAAK,KAAK,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,EAAE,KAAK,MAAM,EAAmB,MAAM,oBAAoB,CAAC;AAElE,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAEL,KAAK,QAAQ,EACb,KAAK,SAAS,EAEd,KAAK,UAAU,EAChB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,sBAAsB,EAAgB,MAAM,0BAA0B,CAAC;AAEhF,OAAO,KAAK,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAMtF;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,wBAAwB;IACvC,wDAAwD;IACxD,SAAS,EAAE,iBAAiB,CAAC;IAE7B,kFAAkF;IAClF,IAAI,EAAE,YAAY,CAAC;IAEnB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;;OAGG;IACH,OAAO,CAAC,EAAE,eAAe,CAAC;IAE1B,wDAAwD;IACxD,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB;;;OAGG;IACH,aAAa,CAAC,EAAE,cAAc,CAAC;IAE/B;;;;;;;;;;;;OAYG;IACH,iBAAiB,CAAC,EAAE,mBAAmB,GAAG,KAAK,CAAC;CACjD;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,qBAAsB,SAAQ,IAAI,CAAC,kBAAkB,EAAE,sBAAsB,CAAC;IAC7F;;;OAGG;IACH,SAAS,CAAC,EAAE,wBAAwB,EAAE,CAAC;CACxC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,wBAAyB,SAAQ,IAAI,CACpD,eAAe,EACf,QAAQ,GAAG,sBAAsB,CAClC;IACC,wEAAwE;IACxE,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;IAE5B;;;OAGG;IACH,SAAS,CAAC,EAAE,wBAAwB,EAAE,CAAC;CACxC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,wBAAyB,SAAQ,IAAI,CACpD,iBAAiB,EACjB,iBAAiB,GAAG,qBAAqB,GAAG,eAAe,GAAG,aAAa,CAC5E;IACC;;;;;;;;;;;;;;OAcG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IAExB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC;IAEvC;;;;;OAKG;IACH,eAAe,CAAC,EAAE,qBAAqB,CAAC;IAExC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAyCG;IACH,iBAAiB,CAAC,EAAE,uBAAuB,GAAG,KAAK,CAAC;CACrD;AAED;;;GAGG;AACH,MAAM,WAAW,yBAAyB;IACxC,oEAAoE;IACpE,YAAY,EAAE,YAAY,CAAC;IAE3B;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B;;;;;;OAMG;IACH,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAEtC;;;;;;;;OAQG;IACH,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;CAC/B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,MAAM,oBAAoB,GAAG,QAAQ,CAAC,wBAAwB,EAAE,mBAAmB,CAAC,CAAC;AAsB3F,cAAM,mBAAoB,YAAW,SAAS,CAAC,yBAAyB,CAAC;;IACvE,KAAK,EAAE,OAAO,CAAC,wBAAwB,CAAC,CAAM;IAM9C,QAAQ,CACN,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,CACT,KAAK,EAAE,sBAAsB,CAAC,YAAY,CAAC,KACxC,sBAAsB,CAAC,YAAY,CAAC,GACxC,IAAI;IAKP;;;;;;;;OAQG;IACH,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC,GAAG,IAAI;IAKzC;;;;;;;OAOG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,wBAAwB,GAAG,IAAI;IAuBrE,KAAK,CACH,KAAK,EAAE,UAAU,EACjB,EAAE,EAAE,MAAM,EACV,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,yBAAyB;CAgG7B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,yBAAyB,IAAI,oBAAoB,CAEhE"}

package/dist/distribution-builder.js

@@ -1,14 +1,36 @@
 import { Distribution, } from "aws-cdk-lib/aws-cloudfront";
 import { ObjectOwnership } from "aws-cdk-lib/aws-s3";
-import { RemovalPolicy } from "aws-cdk-lib";
+import { Annotations, RemovalPolicy, Stack, Token } from "aws-cdk-lib";
 import { Builder, resolve, } from "@composurecdk/core";
-import { AlarmDefinitionBuilder } from "@composurecdk/cloudwatch";
+import { AlarmDefinitionBuilder, createAlarms } from "@composurecdk/cloudwatch";
 import { createBucketBuilder } from "@composurecdk/s3";
-import { createDistributionAlarms } from "./distribution-alarms.js";
+import { resolveDistributionAlarmDefinitions } from "./distribution-alarms.js";
 import { DISTRIBUTION_DEFAULTS } from "./defaults.js";
+import { resolveBehaviors } from "./resolve-behaviors.js";
+import { pathPatternSlug } from "./behavior-function-alarms.js";
+/**
+ * CloudFront metrics are emitted in `us-east-1` only. CloudWatch alarms are
+ * regional, so alarms created in any other region will never receive data
+ * and will never fire. Warn (don't error) the user if this builder is used
+ * from a stack deployed outside `us-east-1`, unless the region is an
+ * unresolved token (env-agnostic stack — user knows best).
+ */
+function warnIfNotUsEast1(scope) {
+    const region = Stack.of(scope).region;
+    if (Token.isUnresolved(region))
+        return;
+    if (region === "us-east-1")
+        return;
+    Annotations.of(scope).addWarningV2("@composurecdk/cloudfront:alarm-region", `CloudFront metrics are emitted in us-east-1 only, but this stack is deployed ` +
+        `in "${region}". CloudWatch alarms created here will not fire. Deploy the ` +
+        `stack in us-east-1, or disable recommended alarms and wire up a cross-region ` +
+        `alarm pattern yourself.`);
+}
 class DistributionBuilder {
     props = {};
     #origin;
+    #additionalBehaviors = new Map();
+    #behaviorSlugs = new Map();
     #customAlarms = [];
     addAlarm(key, configure) {
         this.#customAlarms.push(configure(new AlarmDefinitionBuilder(key)));
@@ -27,6 +49,32 @@ class DistributionBuilder {
         this.#origin = origin;
         return this;
     }
+    /**
+     * Adds an additional cache behavior for a path pattern. The behavior's
+     * origin is required (concrete or Resolvable). Any inline functions are
+     * created by the builder and receive per-behavior alarms scoped to the
+     * path pattern.
+     *
+     * @throws If a behavior for the same path pattern has already been added.
+     */
+    behavior(pathPattern, config) {
+        if (this.#additionalBehaviors.has(pathPattern)) {
+            throw new Error(`DistributionBuilder: behavior for path pattern "${pathPattern}" is already defined.`);
+        }
+        // Alarm keys and Function construct ids are derived from a PascalCase slug
+        // of the path pattern. Patterns that differ only by stripped characters
+        // (e.g. `/*.html` vs `*.html`) would collide downstream at createAlarms() —
+        // surface the collision here with the patterns named.
+        const slug = pathPatternSlug(pathPattern);
+        const existingPattern = this.#behaviorSlugs.get(slug);
+        if (existingPattern !== undefined) {
+            throw new Error(`DistributionBuilder: path pattern "${pathPattern}" produces the same alarm/construct ` +
+                `slug ("${slug}") as "${existingPattern}". Pick distinct patterns.`);
+        }
+        this.#behaviorSlugs.set(slug, pathPattern);
+        this.#additionalBehaviors.set(pathPattern, config);
+        return this;
+    }
     build(scope, id, context) {
         const resolvedOrigin = this.#origin ? resolve(this.#origin, context ?? {}) : undefined;
         if (!resolvedOrigin) {
@@ -35,7 +83,7 @@ class DistributionBuilder {
         }
         const { accessLogging, certificate, defaultBehavior: userBehavior, recommendedAlarms: alarmConfig, ...distProps } = this.props;
         const resolvedCertificate = certificate ? resolve(certificate, context ?? {}) : undefined;
-        const { accessLogging: defaultAccessLogging, defaultBehavior: defaultBehavior, ...cdkDefaults } = DISTRIBUTION_DEFAULTS;
+        const { accessLogging: defaultAccessLogging, defaultBehavior: defaultBehaviorDefaults, ...cdkDefaults } = DISTRIBUTION_DEFAULTS;
         const autoAccessLog = (accessLogging ?? defaultAccessLogging) && !distProps.logBucket;
         let accessLogsBucket;
         let accessLogProps = {};
@@ -52,16 +100,24 @@ class DistributionBuilder {
                 logBucket: accessLogsBucket,
             };
         }
+        const behaviors = resolveBehaviors({
+            scope,
+            id,
+            context: context ?? {},
+            defaultOrigin: resolvedOrigin,
+            defaultBehavior: userBehavior,
+            defaultBehaviorDefaults: defaultBehaviorDefaults ?? {},
+            additionalBehaviors: this.#additionalBehaviors,
+        });
         const mergedProps = {
             ...cdkDefaults,
             ...accessLogProps,
             ...distProps,
             ...(resolvedCertificate ? { certificate: resolvedCertificate } : {}),
-            defaultBehavior: {
-                ...defaultBehavior,
-                ...userBehavior,
-                origin: resolvedOrigin,
-            },
+            defaultBehavior: behaviors.defaultBehavior,
+            ...(Object.keys(behaviors.additionalBehaviors).length > 0
+                ? { additionalBehaviors: behaviors.additionalBehaviors }
+                : {}),
         };
         const distribution = new Distribution(scope, id, mergedProps);
         // Ensure CloudFront is deleted before the access logs bucket during stack teardown.
@@ -69,10 +125,23 @@ class DistributionBuilder {
         if (accessLogsBucket) {
             distribution.node.addDependency(accessLogsBucket);
         }
-        const alarms = createDistributionAlarms(scope, id, distribution, alarmConfig, this.#customAlarms);
+        const distributionAlarmDefs = alarmConfig === false || alarmConfig?.enabled === false
+            ? []
+            : resolveDistributionAlarmDefinitions(distribution, alarmConfig);
+        const customAlarmDefs = this.#customAlarms.map((b) => b.resolve(distribution));
+        const allAlarmDefs = [
+            ...distributionAlarmDefs,
+            ...behaviors.alarmDefinitions,
+            ...customAlarmDefs,
+        ];
+        if (allAlarmDefs.length > 0) {
+            warnIfNotUsEast1(scope);
+        }
+        const alarms = createAlarms(scope, id, allAlarmDefs);
         return {
             distribution,
             accessLogsBucket,
+            functions: behaviors.functions,
             alarms,
         };
     }
@@ -83,26 +152,27 @@ class DistributionBuilder {
  * This is the entry point for defining a CloudFront distribution component.
  * The returned builder exposes every {@link DistributionBuilderProps} property
  * as a fluent setter/getter, plus {@link IDistributionBuilder.origin | origin()}
- * for setting the default origin with Ref support. It implements {@link Lifecycle}
- * for use with {@link compose}.
+ * for setting the default origin with Ref support and
+ * {@link IDistributionBuilder.behavior | behavior()} for path-pattern behaviors.
+ * It implements {@link Lifecycle} for use with {@link compose}.
  *
  * @returns A fluent builder for a CloudFront distribution.
  *
  * @example
  * ```ts
  * const cdn = createDistributionBuilder()
- *   .origin(ref("site", (r: BucketBuilderResult) =>
+ *   .origin(ref<BucketBuilderResult>("site", (r) =>
  *     S3BucketOrigin.withOriginAccessControl(r.bucket)))
- *   .comment("Community website CDN");
- *
- * // Use standalone:
- * const result = cdn.build(stack, "CDN");
- *
- * // Or compose into a system:
- * const system = compose(
- *   { site: createBucketBuilder(), cdn },
- *   { site: [], cdn: ["site"] },
- * );
+ *   .defaultBehavior({
+ *     functions: [{
+ *       eventType: FunctionEventType.VIEWER_REQUEST,
+ *       code: FunctionCode.fromFile({ filePath: "src/edge/rewrite.js" }),
+ *     }],
+ *   })
+ *   .behavior("/api/*", {
+ *     origin: apiOrigin,
+ *     cachePolicy: CachePolicy.CACHING_DISABLED,
+ *   });
  * ```
  */
 export function createDistributionBuilder() {

package/dist/distribution-builder.js.map

@@ -1 +1 @@
-{"version":3,"file":"distribution-builder.js","sourceRoot":"","sources":["../src/distribution-builder.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,GAIb,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EAAe,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EACL,OAAO,EAGP,OAAO,GAER,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAEvD,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAkItD,MAAM,mBAAmB;IACvB,KAAK,GAAsC,EAAE,CAAC;IAC9C,OAAO,CAAuB;IACrB,aAAa,GAA2C,EAAE,CAAC;IAEpE,QAAQ,CACN,GAAW,EACX,SAEyC;QAEzC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,sBAAsB,CAAe,GAAG,CAAC,CAAC,CAAC,CAAC;QAClF,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,MAA2B;QAChC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CACH,KAAiB,EACjB,EAAU,EACV,OAAgC;QAEhC,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAEvF,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CACb,wBAAwB,EAAE,wBAAwB;gBAChD,iDAAiD,CACpD,CAAC;QACJ,CAAC;QAED,MAAM,EACJ,aAAa,EACb,WAAW,EACX,eAAe,EAAE,YAAY,EAC7B,iBAAiB,EAAE,WAAW,EAC9B,GAAG,SAAS,EACb,GAAG,IAAI,CAAC,KAAK,CAAC;QACf,MAAM,mBAAmB,GAAG,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1F,MAAM,EACJ,aAAa,EAAE,oBAAoB,EACnC,eAAe,EAAE,eAAe,EAChC,GAAG,WAAW,EACf,GAAG,qBAAqB,CAAC;QAC1B,MAAM,aAAa,GAAG,CAAC,aAAa,IAAI,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC;QAEtF,IAAI,gBAAoC,CAAC;QACzC,IAAI,cAAc,GAAG,EAAE,CAAC;QAExB,IAAI,aAAa,EAAE,CAAC;YAClB,gBAAgB,GAAG,mBAAmB,EAAE;iBACrC,aAAa,CAAC,KAAK,CAAC;iBACpB,SAAS,CAAC,KAAK,CAAC;gBACjB,oFAAoF;iBACnF,eAAe,CAAC,eAAe,CAAC,sBAAsB,CAAC;iBACvD,aAAa,CAAC,aAAa,CAAC,MAAM,CAAC;iBACnC,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC,MAAM,CAAC;YAC1C,cAAc,GAAG;gBACf,aAAa,EAAE,IAAI;gBACnB,SAAS,EAAE,gBAAgB;aAC5B,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GAAG;YAClB,GAAG,WAAW;YACd,GAAG,cAAc;YACjB,GAAG,SAAS;YACZ,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,eAAe,EAAE;gBACf,GAAG,eAAe;gBAClB,GAAG,YAAY;gBACf,MAAM,EAAE,cAAc;aACvB;SACmB,CAAC;QAEvB,MAAM,YAAY,GAAG,IAAI,YAAY,CAAC,KAAK,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC;QAE9D,oFAAoF;QACpF,gGAAgG;QAChG,IAAI,gBAAgB,EAAE,CAAC;YACrB,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC;QACpD,CAAC;QAED,MAAM,MAAM,GAAG,wBAAwB,CACrC,KAAK,EACL,EAAE,EACF,YAAY,EACZ,WAAW,EACX,IAAI,CAAC,aAAa,CACnB,CAAC;QAEF,OAAO;YACL,YAAY;YACZ,gBAAgB;YAChB,MAAM;SACP,CAAC;IACJ,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,UAAU,yBAAyB;IACvC,OAAO,OAAO,CAAgD,mBAAmB,CAAC,CAAC;AACrF,CAAC"}
+{"version":3,"file":"distribution-builder.js","sourceRoot":"","sources":["../src/distribution-builder.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,GAUb,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EAAe,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAEvE,OAAO,EACL,OAAO,EAGP,OAAO,GAER,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,sBAAsB,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAChF,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAEvD,OAAO,EAAE,mCAAmC,EAAE,MAAM,0BAA0B,CAAC;AAC/E,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AA0QhE;;;;;;GAMG;AACH,SAAS,gBAAgB,CAAC,KAAiB;IACzC,MAAM,MAAM,GAAG,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;IACtC,IAAI,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC;QAAE,OAAO;IACvC,IAAI,MAAM,KAAK,WAAW;QAAE,OAAO;IACnC,WAAW,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,YAAY,CAChC,uCAAuC,EACvC,+EAA+E;QAC7E,OAAO,MAAM,8DAA8D;QAC3E,+EAA+E;QAC/E,yBAAyB,CAC5B,CAAC;AACJ,CAAC;AAED,MAAM,mBAAmB;IACvB,KAAK,GAAsC,EAAE,CAAC;IAC9C,OAAO,CAAuB;IACrB,oBAAoB,GAAG,IAAI,GAAG,EAAoC,CAAC;IACnE,cAAc,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,aAAa,GAA2C,EAAE,CAAC;IAEpE,QAAQ,CACN,GAAW,EACX,SAEyC;QAEzC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,sBAAsB,CAAe,GAAG,CAAC,CAAC,CAAC,CAAC;QAClF,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,MAA2B;QAChC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;OAOG;IACH,QAAQ,CAAC,WAAmB,EAAE,MAAgC;QAC5D,IAAI,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CACb,mDAAmD,WAAW,uBAAuB,CACtF,CAAC;QACJ,CAAC;QACD,2EAA2E;QAC3E,wEAAwE;QACxE,4EAA4E;QAC5E,sDAAsD;QACtD,MAAM,IAAI,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;QAC1C,MAAM,eAAe,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtD,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CACb,sCAAsC,WAAW,sCAAsC;gBACrF,UAAU,IAAI,UAAU,eAAe,4BAA4B,CACtE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QAC3C,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QACnD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CACH,KAAiB,EACjB,EAAU,EACV,OAAgC;QAEhC,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAEvF,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CACb,wBAAwB,EAAE,wBAAwB;gBAChD,iDAAiD,CACpD,CAAC;QACJ,CAAC;QAED,MAAM,EACJ,aAAa,EACb,WAAW,EACX,eAAe,EAAE,YAAY,EAC7B,iBAAiB,EAAE,WAAW,EAC9B,GAAG,SAAS,EACb,GAAG,IAAI,CAAC,KAAK,CAAC;QACf,MAAM,mBAAmB,GAAG,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1F,MAAM,EACJ,aAAa,EAAE,oBAAoB,EACnC,eAAe,EAAE,uBAAuB,EACxC,GAAG,WAAW,EACf,GAAG,qBAAqB,CAAC;QAC1B,MAAM,aAAa,GAAG,CAAC,aAAa,IAAI,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC;QAEtF,IAAI,gBAAoC,CAAC;QACzC,IAAI,cAAc,GAAG,EAAE,CAAC;QAExB,IAAI,aAAa,EAAE,CAAC;YAClB,gBAAgB,GAAG,mBAAmB,EAAE;iBACrC,aAAa,CAAC,KAAK,CAAC;iBACpB,SAAS,CAAC,KAAK,CAAC;gBACjB,oFAAoF;iBACnF,eAAe,CAAC,eAAe,CAAC,sBAAsB,CAAC;iBACvD,aAAa,CAAC,aAAa,CAAC,MAAM,CAAC;iBACnC,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC,MAAM,CAAC;YAC1C,cAAc,GAAG;gBACf,aAAa,EAAE,IAAI;gBACnB,SAAS,EAAE,gBAAgB;aAC5B,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,gBAAgB,CAAC;YACjC,KAAK;YACL,EAAE;YACF,OAAO,EAAE,OAAO,IAAI,EAAE;YACtB,aAAa,EAAE,cAAc;YAC7B,eAAe,EAAE,YAAY;YAC7B,uBAAuB,EAAE,uBAAuB,IAAI,EAAE;YACtD,mBAAmB,EAAE,IAAI,CAAC,oBAAoB;SAC/C,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG;YAClB,GAAG,WAAW;YACd,GAAG,cAAc;YACjB,GAAG,SAAS;YACZ,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,eAAe,EAAE,SAAS,CAAC,eAAe;YAC1C,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC,MAAM,GAAG,CAAC;gBACvD,CAAC,CAAC,EAAE,mBAAmB,EAAE,SAAS,CAAC,mBAAmB,EAAE;gBACxD,CAAC,CAAC,EAAE,CAAC;SACa,CAAC;QAEvB,MAAM,YAAY,GAAG,IAAI,YAAY,CAAC,KAAK,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC;QAE9D,oFAAoF;QACpF,gGAAgG;QAChG,IAAI,gBAAgB,EAAE,CAAC;YACrB,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC;QACpD,CAAC;QAED,MAAM,qBAAqB,GACzB,WAAW,KAAK,KAAK,IAAI,WAAW,EAAE,OAAO,KAAK,KAAK;YACrD,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,mCAAmC,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;QACrE,MAAM,eAAe,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;QAE/E,MAAM,YAAY,GAAG;YACnB,GAAG,qBAAqB;YACxB,GAAG,SAAS,CAAC,gBAAgB;YAC7B,GAAG,eAAe;SACnB,CAAC;QAEF,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC;QAED,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,EAAE,EAAE,YAAY,CAAC,CAAC;QAErD,OAAO;YACL,YAAY;YACZ,gBAAgB;YAChB,SAAS,EAAE,SAAS,CAAC,SAAS;YAC9B,MAAM;SACP,CAAC;IACJ,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,UAAU,yBAAyB;IACvC,OAAO,OAAO,CAAgD,mBAAmB,CAAC,CAAC;AACrF,CAAC"}

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-export { createDistributionBuilder, type DistributionBuilderProps, type DistributionBuilderResult, type IDistributionBuilder, } from "./distribution-builder.js";
-export { DISTRIBUTION_DEFAULTS } from "./defaults.js";
-export { type DistributionAlarmConfig } from "./alarm-config.js";
-export { DISTRIBUTION_ALARM_DEFAULTS } from "./alarm-defaults.js";
+export { createDistributionBuilder, type DistributionBuilderProps, type DistributionBuilderResult, type IDistributionBuilder, type DefaultBehaviorConfig, type AdditionalBehaviorConfig, type InlineFunctionDefinition, } from "./distribution-builder.js";
+export { DISTRIBUTION_DEFAULTS, INLINE_FUNCTION_DEFAULTS } from "./defaults.js";
+export { type DistributionAlarmConfig, type FunctionAlarmConfig } from "./alarm-config.js";
+export { DISTRIBUTION_ALARM_DEFAULTS, FUNCTION_ALARM_DEFAULTS } from "./alarm-defaults.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,EACzB,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,oBAAoB,GAC1B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,KAAK,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,EACzB,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,GAC9B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAChF,OAAO,EAAE,KAAK,uBAAuB,EAAE,KAAK,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC3F,OAAO,EAAE,2BAA2B,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/index.js

@@ -1,4 +1,4 @@
 export { createDistributionBuilder, } from "./distribution-builder.js";
-export { DISTRIBUTION_DEFAULTS } from "./defaults.js";
-export { DISTRIBUTION_ALARM_DEFAULTS } from "./alarm-defaults.js";
+export { DISTRIBUTION_DEFAULTS, INLINE_FUNCTION_DEFAULTS } from "./defaults.js";
+export { DISTRIBUTION_ALARM_DEFAULTS, FUNCTION_ALARM_DEFAULTS } from "./alarm-defaults.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,GAI1B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAEtD,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,GAO1B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAEhF,OAAO,EAAE,2BAA2B,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/resolve-behaviors.d.ts

@@ -0,0 +1,55 @@
+import { type AddBehaviorOptions, type BehaviorOptions, Function as CfFunction, type IOrigin } from "aws-cdk-lib/aws-cloudfront";
+import type { IConstruct } from "constructs";
+import type { AlarmDefinition } from "@composurecdk/cloudwatch";
+import type { AdditionalBehaviorConfig, DefaultBehaviorConfig } from "./distribution-builder.js";
+/**
+ * Input required to resolve the default behavior, all additional behaviors,
+ * and any inline CloudFront Functions into concrete CDK objects.
+ */
+export interface ResolveBehaviorsInput {
+    /** The construct scope under which functions and behaviors are created. */
+    scope: IConstruct;
+    /** The distribution's construct id — used as a prefix for Function ids. */
+    id: string;
+    /** Compose context forwarded to {@link resolve}. Empty record if unused. */
+    context: Record<string, object>;
+    /** The already-resolved default origin. */
+    defaultOrigin: IOrigin;
+    /** User-provided default-behavior config (may be undefined). */
+    defaultBehavior: DefaultBehaviorConfig | undefined;
+    /** The builder's default-behavior defaults, applied before user props. */
+    defaultBehaviorDefaults: Partial<AddBehaviorOptions>;
+    /**
+     * Ordered map of path-pattern → config for additional behaviors. Origins
+     * are resolved here via {@link resolve}.
+     */
+    additionalBehaviors: Map<string, AdditionalBehaviorConfig>;
+}
+/**
+ * Output of {@link resolveBehaviors}: concrete behavior options ready to pass
+ * to the CDK `Distribution` constructor, plus any owned {@link CfFunction}
+ * instances and their alarm definitions.
+ */
+export interface ResolveBehaviorsResult {
+    /** Concrete `BehaviorOptions` for the default cache behavior. */
+    defaultBehavior: BehaviorOptions;
+    /** Concrete `BehaviorOptions` keyed by path pattern, in insertion order. */
+    additionalBehaviors: Record<string, BehaviorOptions>;
+    /**
+     * Owned inline CloudFront Functions, keyed by
+     * `<behaviorScope><EventType>` — e.g. `defaultBehaviorViewerRequest`.
+     */
+    functions: Record<string, CfFunction>;
+    /** Alarm definitions for the owned inline functions. */
+    alarmDefinitions: AlarmDefinition[];
+}
+/**
+ * Materializes the default and additional cache behaviors into CDK-ready
+ * `BehaviorOptions`, creating any inline CloudFront Functions along the way
+ * and producing their path-scoped alarm definitions.
+ *
+ * Enforces CloudFront invariants at configure time: at most one function per
+ * event type per behavior, and `keyValueStore` requires `FunctionRuntime.JS_2_0`.
+ */
+export declare function resolveBehaviors(input: ResolveBehaviorsInput): ResolveBehaviorsResult;
+//# sourceMappingURL=resolve-behaviors.d.ts.map

package/dist/resolve-behaviors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-behaviors.d.ts","sourceRoot":"","sources":["../src/resolve-behaviors.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,QAAQ,IAAI,UAAU,EAKtB,KAAK,OAAO,EACb,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAQhE,OAAO,KAAK,EACV,wBAAwB,EACxB,qBAAqB,EAEtB,MAAM,2BAA2B,CAAC;AAEnC;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,2EAA2E;IAC3E,KAAK,EAAE,UAAU,CAAC;IAElB,2EAA2E;IAC3E,EAAE,EAAE,MAAM,CAAC;IAEX,4EAA4E;IAC5E,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEhC,2CAA2C;IAC3C,aAAa,EAAE,OAAO,CAAC;IAEvB,gEAAgE;IAChE,eAAe,EAAE,qBAAqB,GAAG,SAAS,CAAC;IAEnD,0EAA0E;IAC1E,uBAAuB,EAAE,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAErD;;;OAGG;IACH,mBAAmB,EAAE,GAAG,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;CAC5D;AAED;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,iEAAiE;IACjE,eAAe,EAAE,eAAe,CAAC;IAEjC,4EAA4E;IAC5E,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAErD;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAEtC,wDAAwD;IACxD,gBAAgB,EAAE,eAAe,EAAE,CAAC;CACrC;AAiDD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,GAAG,sBAAsB,CA+DrF"}

package/dist/resolve-behaviors.js

@@ -0,0 +1,96 @@
+import { Function as CfFunction, FunctionRuntime, } from "aws-cdk-lib/aws-cloudfront";
+import { resolve } from "@composurecdk/core";
+import { behaviorFunctionKeyPrefix, eventTypePascal, pathPatternSlug, resolveBehaviorFunctionAlarmDefinitions, } from "./behavior-function-alarms.js";
+import { INLINE_FUNCTION_DEFAULTS } from "./defaults.js";
+function scopeLabel(pathPattern) {
+    return pathPattern === null ? "default behavior" : `behavior "${pathPattern}"`;
+}
+function behaviorIdScope(pathPattern) {
+    return pathPattern === null ? "DefaultBehavior" : `Behavior${pathPatternSlug(pathPattern)}`;
+}
+function assertUniqueEventTypes(functions, pathPattern) {
+    const seen = new Set();
+    for (const fn of functions) {
+        if (seen.has(fn.eventType)) {
+            throw new Error(`DistributionBuilder: ${scopeLabel(pathPattern)} has multiple functions for eventType "${fn.eventType}". ` +
+                `CloudFront allows at most one function per event type per behavior.`);
+        }
+        seen.add(fn.eventType);
+    }
+}
+function omit(obj, ...keys) {
+    const skip = new Set(keys);
+    const out = {};
+    for (const [k, v] of Object.entries(obj)) {
+        if (!skip.has(k))
+            out[k] = v;
+    }
+    return out;
+}
+function assertKeyValueStoreRuntime(def, pathPattern) {
+    if (!def.keyValueStore)
+        return;
+    const effectiveRuntime = def.runtime ?? INLINE_FUNCTION_DEFAULTS.runtime;
+    if (effectiveRuntime !== FunctionRuntime.JS_2_0) {
+        throw new Error(`DistributionBuilder: ${scopeLabel(pathPattern)} function (${def.eventType}) uses a ` +
+            `keyValueStore, which requires FunctionRuntime.JS_2_0.`);
+    }
+}
+/**
+ * Materializes the default and additional cache behaviors into CDK-ready
+ * `BehaviorOptions`, creating any inline CloudFront Functions along the way
+ * and producing their path-scoped alarm definitions.
+ *
+ * Enforces CloudFront invariants at configure time: at most one function per
+ * event type per behavior, and `keyValueStore` requires `FunctionRuntime.JS_2_0`.
+ */
+export function resolveBehaviors(input) {
+    const { scope, id, context, defaultOrigin, defaultBehavior, defaultBehaviorDefaults } = input;
+    const functions = {};
+    const alarmDefinitions = [];
+    const buildInlineFunctions = (pathPattern, definitions) => {
+        if (!definitions || definitions.length === 0)
+            return [];
+        assertUniqueEventTypes(definitions, pathPattern);
+        const scopeId = behaviorIdScope(pathPattern);
+        const associations = [];
+        for (const def of definitions) {
+            assertKeyValueStoreRuntime(def, pathPattern);
+            const { eventType } = def;
+            const fnId = `${id}${scopeId}${eventTypePascal(eventType)}Fn`;
+            const fn = new CfFunction(scope, fnId, {
+                ...INLINE_FUNCTION_DEFAULTS,
+                ...omit(def, "eventType", "recommendedAlarms"),
+            });
+            functions[behaviorFunctionKeyPrefix(pathPattern, eventType)] = fn;
+            associations.push({ function: fn, eventType });
+            alarmDefinitions.push(...resolveBehaviorFunctionAlarmDefinitions(pathPattern, eventType, fn, def.recommendedAlarms));
+        }
+        return associations;
+    };
+    const defaultAssociations = buildInlineFunctions(null, defaultBehavior?.functions);
+    const userDefaultBehavior = omit(defaultBehavior ?? {}, "functions");
+    const resolvedDefaultBehavior = {
+        ...defaultBehaviorDefaults,
+        ...userDefaultBehavior,
+        ...(defaultAssociations.length > 0 ? { functionAssociations: defaultAssociations } : {}),
+        origin: defaultOrigin,
+    };
+    const resolvedAdditionalBehaviors = {};
+    for (const [pathPattern, config] of input.additionalBehaviors) {
+        const resolvedOrigin = resolve(config.origin, context);
+        const associations = buildInlineFunctions(pathPattern, config.functions);
+        resolvedAdditionalBehaviors[pathPattern] = {
+            ...omit(config, "functions", "origin"),
+            origin: resolvedOrigin,
+            ...(associations.length > 0 ? { functionAssociations: associations } : {}),
+        };
+    }
+    return {
+        defaultBehavior: resolvedDefaultBehavior,
+        additionalBehaviors: resolvedAdditionalBehaviors,
+        functions,
+        alarmDefinitions,
+    };
+}
+//# sourceMappingURL=resolve-behaviors.js.map

package/dist/resolve-behaviors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-behaviors.js","sourceRoot":"","sources":["../src/resolve-behaviors.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,QAAQ,IAAI,UAAU,EAItB,eAAe,GAEhB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE7C,OAAO,EACL,yBAAyB,EACzB,eAAe,EACf,eAAe,EACf,uCAAuC,GACxC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AA2DzD,SAAS,UAAU,CAAC,WAA0B;IAC5C,OAAO,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,aAAa,WAAW,GAAG,CAAC;AACjF,CAAC;AAED,SAAS,eAAe,CAAC,WAA0B;IACjD,OAAO,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,WAAW,eAAe,CAAC,WAAW,CAAC,EAAE,CAAC;AAC9F,CAAC;AAED,SAAS,sBAAsB,CAC7B,SAAqC,EACrC,WAA0B;IAE1B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC1C,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;QAC3B,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CACb,wBAAwB,UAAU,CAAC,WAAW,CAAC,0CAA0C,EAAE,CAAC,SAAS,KAAK;gBACxG,qEAAqE,CACxE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;IACzB,CAAC;AACH,CAAC;AAED,SAAS,IAAI,CAAsC,GAAM,EAAE,GAAG,IAAS;IACrE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAc,IAAI,CAAC,CAAC;IACxC,MAAM,GAAG,GAAiC,EAAE,CAAC;IAC7C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,GAAiB,CAAC;AAC3B,CAAC;AAED,SAAS,0BAA0B,CACjC,GAA6B,EAC7B,WAA0B;IAE1B,IAAI,CAAC,GAAG,CAAC,aAAa;QAAE,OAAO;IAC/B,MAAM,gBAAgB,GAAG,GAAG,CAAC,OAAO,IAAI,wBAAwB,CAAC,OAAO,CAAC;IACzE,IAAI,gBAAgB,KAAK,eAAe,CAAC,MAAM,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CACb,wBAAwB,UAAU,CAAC,WAAW,CAAC,cAAc,GAAG,CAAC,SAAS,WAAW;YACnF,uDAAuD,CAC1D,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAA4B;IAC3D,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,uBAAuB,EAAE,GAAG,KAAK,CAAC;IAE9F,MAAM,SAAS,GAA+B,EAAE,CAAC;IACjD,MAAM,gBAAgB,GAAsB,EAAE,CAAC;IAE/C,MAAM,oBAAoB,GAAG,CAC3B,WAA0B,EAC1B,WAAmD,EAC5B,EAAE;QACzB,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACxD,sBAAsB,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QACjD,MAAM,OAAO,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;QAC7C,MAAM,YAAY,GAA0B,EAAE,CAAC;QAC/C,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;YAC9B,0BAA0B,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;YAC7C,MAAM,EAAE,SAAS,EAAE,GAAG,GAAG,CAAC;YAC1B,MAAM,IAAI,GAAG,GAAG,EAAE,GAAG,OAAO,GAAG,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC;YAC9D,MAAM,EAAE,GAAG,IAAI,UAAU,CAAC,KAAK,EAAE,IAAI,EAAE;gBACrC,GAAG,wBAAwB;gBAC3B,GAAG,IAAI,CAAC,GAAG,EAAE,WAAW,EAAE,mBAAmB,CAAC;aAC9B,CAAC,CAAC;YACpB,SAAS,CAAC,yBAAyB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,GAAG,EAAE,CAAC;YAClE,YAAY,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;YAC/C,gBAAgB,CAAC,IAAI,CACnB,GAAG,uCAAuC,CACxC,WAAW,EACX,SAAS,EACT,EAAE,EACF,GAAG,CAAC,iBAAiB,CACtB,CACF,CAAC;QACJ,CAAC;QACD,OAAO,YAAY,CAAC;IACtB,CAAC,CAAC;IAEF,MAAM,mBAAmB,GAAG,oBAAoB,CAAC,IAAI,EAAE,eAAe,EAAE,SAAS,CAAC,CAAC;IACnF,MAAM,mBAAmB,GAAG,IAAI,CAAC,eAAe,IAAI,EAAE,EAAE,WAAW,CAAC,CAAC;IAErE,MAAM,uBAAuB,GAAoB;QAC/C,GAAG,uBAAuB;QAC1B,GAAG,mBAAmB;QACtB,GAAG,CAAC,mBAAmB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxF,MAAM,EAAE,aAAa;KACtB,CAAC;IAEF,MAAM,2BAA2B,GAAoC,EAAE,CAAC;IACxE,KAAK,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,KAAK,CAAC,mBAAmB,EAAE,CAAC;QAC9D,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACvD,MAAM,YAAY,GAAG,oBAAoB,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QACzE,2BAA2B,CAAC,WAAW,CAAC,GAAG;YACzC,GAAG,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC;YACtC,MAAM,EAAE,cAAc;YACtB,GAAG,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3E,CAAC;IACJ,CAAC;IAED,OAAO;QACL,eAAe,EAAE,uBAAuB;QACxC,mBAAmB,EAAE,2BAA2B;QAChD,SAAS;QACT,gBAAgB;KACjB,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@composurecdk/cloudfront",
-  "version": "0.4.2",
+  "version": "0.4.4",
   "description": "Composable CloudFront distribution builder with well-architected defaults",
   "repository": {
     "type": "git",