@composurecdk/route53 0.6.0 → 0.8.0

package/README.md

@@ -21,12 +21,56 @@ Every [PublicHostedZoneProps](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cd
 
 Route 53 is a global service, but DNS query logs are emitted in `us-east-1` only — the CloudWatch log group that receives them must live there regardless of where the hosted zone is declared. This is an AWS service constraint, not a restriction on where your hosted zone or records can live.
 
-Supply a pre-configured log group via `.queryLogsLogGroupArn(arn)`. The log group must:
+**Query logging is enabled by default.** When you call `createHostedZoneBuilder().zoneName("example.com")` the builder auto-provisions:
 
-- Be in `us-east-1`.
-- Have a resource policy granting `route53.amazonaws.com` permission to `logs:PutLogEvents` and `logs:CreateLogStream`.
+1. A CloudWatch `LogGroup` named `/aws/route53/<zoneName>` with the `@composurecdk/logs` defaults (`RetentionDays.TWO_YEARS`, `RemovalPolicy.RETAIN`).
+2. A single shared `AWS::Logs::ResourcePolicy` per stack — `ComposureCDK-Route53QueryLogging` — granting `route53.amazonaws.com` permission to `logs:CreateLogStream` and `logs:PutLogEvents` against the `/aws/route53/*` prefix. The policy includes the `aws:SourceAccount` confused-deputy condition.
+3. The `QueryLoggingConfig` on the hosted zone wired to the auto-created log group's ARN, plus a `DependsOn` so Route 53 cannot race the policy on first write.
 
-Auto-creating the log group and resource policy on the user's behalf is planned — see [#44](https://github.com/laazyj/composureCDK/issues/44). Once implemented, enabling query logging will become a single opt-in property with the log group + resource policy wired by default.
+Multiple hosted zones in the same stack share the resource policy — you stay well clear of the [10-policy/region soft limit](https://docs.aws.amazon.com/Route53/latest/APIReference/API_CreateQueryLoggingConfig.html). The auto-created log group is exposed as `result.queryLogGroup` for downstream wiring (subscription filters, metric filters).
+
+#### `queryLogging` configuration
+
+```ts
+type QueryLoggingConfig =
+  | false
+  | {
+      configure?: (b: ILogGroupBuilder) => ILogGroupBuilder; // tweak the auto-created log group
+      logGroupArn?: string; // bring your own us-east-1 log group; you own its resource policy
+    };
+```
+
+Customize the auto-created log group:
+
+```ts
+import { RetentionDays } from "aws-cdk-lib/aws-logs";
+
+createHostedZoneBuilder()
+  .zoneName("example.com")
+  .queryLogging({ configure: (lg) => lg.retention(RetentionDays.SIX_MONTHS) });
+```
+
+Bring your own log group (you own the resource policy too):
+
+```ts
+createHostedZoneBuilder()
+  .zoneName("example.com")
+  .queryLogging({ logGroupArn: "arn:aws:logs:us-east-1:111122223333:log-group:/audit/dns" });
+```
+
+Disable entirely:
+
+```ts
+createHostedZoneBuilder().zoneName("example.com").queryLogging(false);
+```
+
+#### `us-east-1` constraint
+
+If the stack's region resolves to a known non-`us-east-1` region, `build()` throws with three remediations: deploy the stack in `us-east-1`, pass `queryLogging({ logGroupArn })`, or set `queryLogging(false)`. Env-agnostic stacks (where the region is an unresolved CDK token) are not blocked. A user-supplied `logGroupArn` outside `us-east-1` emits the synth warning `@composurecdk/route53:query-logging-region` instead of erroring.
+
+#### Cost note
+
+Default-on query logging adds two long-lived resources per stack: the log group (charged per ingested GB and per stored GB after retention) and the resource policy (free). For high-traffic zones consider lowering retention via the `configure` callback or disabling logging on zones with low security/audit value.
 
 ## Record Builders
 
@@ -76,6 +120,7 @@ Each helper accepts a `Resolvable`, so targets produced by other composed compon
 | Builder                    | Property         | Default               | Rationale                                                                                |
 | -------------------------- | ---------------- | --------------------- | ---------------------------------------------------------------------------------------- |
 | `createHostedZoneBuilder`  | `addTrailingDot` | `true`                | Matches RFC 1035 and the CDK default; unambiguous apex.                                  |
+| `createHostedZoneBuilder`  | `queryLogging`   | _auto-managed_        | DNS query logs to a `/aws/route53/<zoneName>` log group with a shared resource policy.   |
 | `createARecordBuilder`     | `ttl`            | `Duration.minutes(5)` | Balances propagation latency against DNS cache churn; skipped for alias targets.[^alias] |
 | `createAaaaRecordBuilder`  | `ttl`            | `Duration.minutes(5)` | Same as A records; skipped for alias targets.[^alias]                                    |
 | `createCnameRecordBuilder` | `ttl`            | `Duration.minutes(5)` | Same rationale as A records.                                                             |
@@ -343,6 +388,11 @@ import {
 } from "@composurecdk/route53";
 import { ALIAS, APEX, zoneRecords } from "@composurecdk/route53/zone";
 
+// This composition only synthesises cleanly when `stack` is in `us-east-1`,
+// because the default-on query logging on `zone` requires its auto-created
+// log group to live there. To run the same shape outside `us-east-1`, pass
+// `queryLogging({ logGroupArn })` referencing a us-east-1 log group, or
+// `queryLogging(false)` to opt out.
 compose(
   {
     zone: createHostedZoneBuilder().zoneName("example.com"),

package/dist/commonjs/a-record-builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"a-record-builder.d.ts","sourceRoot":"","sources":["../../src/a-record-builder.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,OAAO,EACP,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,YAAY,EAClB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAEL,KAAK,QAAQ,EACb,KAAK,SAAS,EAEd,KAAK,UAAU,EAChB,MAAM,oBAAoB,CAAC;AAG5B;;;;;;GAMG;AACH,MAAM,WAAW,mBAAoB,SAAQ,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,QAAQ,CAAC;IAChF;;;;OAIG;IACH,IAAI,CAAC,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;IAE/B;;;;OAIG;IACH,MAAM,CAAC,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC;CACnC;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,6DAA6D;IAC7D,MAAM,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;;;;;GAWG;AAEH,MAAM,MAAM,eAAe,GAAG,QAAQ,CAAC,mBAAmB,EAAE,cAAc,CAAC,CAAC;AAE5E,cAAM,cAAe,YAAW,SAAS,CAAC,oBAAoB,CAAC;IAC7D,KAAK,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAM;IAEzC,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,oBAAoB;CAuB7F;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,IAAI,eAAe,CAGtD"}

package/dist/commonjs/a-record-builder.js

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createARecordBuilder = createARecordBuilder;
+const aws_route53_1 = require("aws-cdk-lib/aws-route53");
+const core_1 = require("@composurecdk/core");
+const defaults_js_1 = require("./defaults.js");
+class ARecordBuilder {
+    props = {};
+    build(scope, id, context) {
+        const { zone, target, ...rest } = this.props;
+        if (!zone) {
+            throw new Error(`ARecordBuilder "${id}" requires a zone. Call .zone() with an IHostedZone.`);
+        }
+        if (!target) {
+            throw new Error(`ARecordBuilder "${id}" requires a target. Call .target() with a RecordTarget.`);
+        }
+        const resolvedTarget = (0, core_1.resolve)(target, context);
+        const isAlias = resolvedTarget.aliasTarget !== undefined;
+        const mergedProps = {
+            ...(isAlias ? {} : defaults_js_1.A_RECORD_DEFAULTS),
+            ...rest,
+            zone: (0, core_1.resolve)(zone, context),
+            target: resolvedTarget,
+        };
+        const record = new aws_route53_1.ARecord(scope, id, mergedProps);
+        return { record };
+    }
+}
+/**
+ * Creates a new {@link IARecordBuilder} for configuring a Route53 A record.
+ *
+ * @returns A fluent builder for a Route53 A record.
+ */
+function createARecordBuilder() {
+    // eslint-disable-next-line composurecdk/builder-must-be-tagged -- AWS::Route53::RecordSet has no Tags property
+    return (0, core_1.Builder)(ARecordBuilder);
+}
+//# sourceMappingURL=a-record-builder.js.map

package/dist/commonjs/a-record-builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"a-record-builder.js","sourceRoot":"","sources":["../../src/a-record-builder.ts"],"names":[],"mappings":";;AA+FA,oDAGC;AAlGD,yDAKiC;AAEjC,6CAM4B;AAC5B,+CAAkD;AAgDlD,MAAM,cAAc;IAClB,KAAK,GAAiC,EAAE,CAAC;IAEzC,KAAK,CAAC,KAAiB,EAAE,EAAU,EAAE,OAAgC;QACnE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;QAC7C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,mBAAmB,EAAE,sDAAsD,CAAC,CAAC;QAC/F,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,mBAAmB,EAAE,0DAA0D,CAChF,CAAC;QACJ,CAAC;QAED,MAAM,cAAc,GAAG,IAAA,cAAO,EAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAChD,MAAM,OAAO,GAAG,cAAc,CAAC,WAAW,KAAK,SAAS,CAAC;QACzD,MAAM,WAAW,GAAG;YAClB,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,+BAAiB,CAAC;YACrC,GAAG,IAAI;YACP,IAAI,EAAE,IAAA,cAAO,EAAC,IAAI,EAAE,OAAO,CAAC;YAC5B,MAAM,EAAE,cAAc;SACP,CAAC;QAElB,MAAM,MAAM,GAAG,IAAI,qBAAO,CAAC,KAAK,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC;QACnD,OAAO,EAAE,MAAM,EAAE,CAAC;IACpB,CAAC;CACF;AAED;;;;GAIG;AACH,SAAgB,oBAAoB;IAClC,+GAA+G;IAC/G,OAAO,IAAA,cAAO,EAAsC,cAAc,CAAC,CAAC;AACtE,CAAC"}

package/dist/commonjs/aaaa-record-builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aaaa-record-builder.d.ts","sourceRoot":"","sources":["../../src/aaaa-record-builder.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,YAAY,EAClB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAEL,KAAK,QAAQ,EACb,KAAK,SAAS,EAEd,KAAK,UAAU,EAChB,MAAM,oBAAoB,CAAC;AAG5B;;;;;;GAMG;AACH,MAAM,WAAW,sBAAuB,SAAQ,IAAI,CAAC,eAAe,EAAE,MAAM,GAAG,QAAQ,CAAC;IACtF,qDAAqD;IACrD,IAAI,CAAC,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;IAC/B,yBAAyB;IACzB,MAAM,CAAC,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC;CACnC;AAED;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,gEAAgE;IAChE,MAAM,EAAE,UAAU,CAAC;CACpB;AAED;;;;;;GAMG;AAEH,MAAM,MAAM,kBAAkB,GAAG,QAAQ,CAAC,sBAAsB,EAAE,iBAAiB,CAAC,CAAC;AAErF,cAAM,iBAAkB,YAAW,SAAS,CAAC,uBAAuB,CAAC;IACnE,KAAK,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAM;IAE5C,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,uBAAuB;CAyBhG;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,IAAI,kBAAkB,CAG5D"}

package/dist/commonjs/aaaa-record-builder.js

@@ -0,0 +1,39 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAaaaRecordBuilder = createAaaaRecordBuilder;
+const aws_route53_1 = require("aws-cdk-lib/aws-route53");
+const core_1 = require("@composurecdk/core");
+const defaults_js_1 = require("./defaults.js");
+class AaaaRecordBuilder {
+    props = {};
+    build(scope, id, context) {
+        const { zone, target, ...rest } = this.props;
+        if (!zone) {
+            throw new Error(`AaaaRecordBuilder "${id}" requires a zone. Call .zone() with an IHostedZone.`);
+        }
+        if (!target) {
+            throw new Error(`AaaaRecordBuilder "${id}" requires a target. Call .target() with a RecordTarget.`);
+        }
+        const resolvedTarget = (0, core_1.resolve)(target, context);
+        const isAlias = resolvedTarget.aliasTarget !== undefined;
+        const mergedProps = {
+            ...(isAlias ? {} : defaults_js_1.AAAA_RECORD_DEFAULTS),
+            ...rest,
+            zone: (0, core_1.resolve)(zone, context),
+            target: resolvedTarget,
+        };
+        const record = new aws_route53_1.AaaaRecord(scope, id, mergedProps);
+        return { record };
+    }
+}
+/**
+ * Creates a new {@link IAaaaRecordBuilder} for configuring a Route53 AAAA
+ * (IPv6) record.
+ *
+ * @returns A fluent builder for a Route53 AAAA record.
+ */
+function createAaaaRecordBuilder() {
+    // eslint-disable-next-line composurecdk/builder-must-be-tagged -- AWS::Route53::RecordSet has no Tags property
+    return (0, core_1.Builder)(AaaaRecordBuilder);
+}
+//# sourceMappingURL=aaaa-record-builder.js.map

package/dist/commonjs/aaaa-record-builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aaaa-record-builder.js","sourceRoot":"","sources":["../../src/aaaa-record-builder.ts"],"names":[],"mappings":";;AAoFA,0DAGC;AAvFD,yDAKiC;AAEjC,6CAM4B;AAC5B,+CAAqD;AAkCrD,MAAM,iBAAiB;IACrB,KAAK,GAAoC,EAAE,CAAC;IAE5C,KAAK,CAAC,KAAiB,EAAE,EAAU,EAAE,OAAgC;QACnE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;QAC7C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CACb,sBAAsB,EAAE,sDAAsD,CAC/E,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,sBAAsB,EAAE,0DAA0D,CACnF,CAAC;QACJ,CAAC;QAED,MAAM,cAAc,GAAG,IAAA,cAAO,EAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAChD,MAAM,OAAO,GAAG,cAAc,CAAC,WAAW,KAAK,SAAS,CAAC;QACzD,MAAM,WAAW,GAAG;YAClB,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,kCAAoB,CAAC;YACxC,GAAG,IAAI;YACP,IAAI,EAAE,IAAA,cAAO,EAAC,IAAI,EAAE,OAAO,CAAC;YAC5B,MAAM,EAAE,cAAc;SACJ,CAAC;QAErB,MAAM,MAAM,GAAG,IAAI,wBAAU,CAAC,KAAK,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC;QACtD,OAAO,EAAE,MAAM,EAAE,CAAC;IACpB,CAAC;CACF;AAED;;;;;GAKG;AACH,SAAgB,uBAAuB;IACrC,+GAA+G;IAC/G,OAAO,IAAA,cAAO,EAA4C,iBAAiB,CAAC,CAAC;AAC/E,CAAC"}

package/dist/commonjs/alias-targets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"alias-targets.d.ts","sourceRoot":"","sources":["../../src/alias-targets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,KAAK,WAAW,EAAE,KAAK,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAChF,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAEvD,OAAO,EAAS,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAE5D;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CACnC,YAAY,EAAE,UAAU,CAAC,aAAa,CAAC,GACtC,UAAU,CAAC,YAAY,CAAC,CAI1B;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,UAAU,CAAC,WAAW,CAAC,GAAG,UAAU,CAAC,YAAY,CAAC,CAI5F;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,UAAU,CAAC,WAAW,CAAC,GAC9B,UAAU,CAAC,YAAY,CAAC,CAI1B"}

package/dist/commonjs/alias-targets.js

@@ -0,0 +1,50 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.cloudfrontAliasTarget = cloudfrontAliasTarget;
+exports.apiGatewayAliasTarget = apiGatewayAliasTarget;
+exports.apiGatewayDomainAliasTarget = apiGatewayDomainAliasTarget;
+const aws_route53_1 = require("aws-cdk-lib/aws-route53");
+const aws_route53_targets_1 = require("aws-cdk-lib/aws-route53-targets");
+const core_1 = require("@composurecdk/core");
+/**
+ * Builds an alias {@link RecordTarget} for a CloudFront distribution, usable
+ * as the `target` of an A or AAAA record. Accepts a {@link Resolvable} so a
+ * distribution produced by a composed `@composurecdk/cloudfront` component
+ * can be wired in via {@link ref}.
+ *
+ * @example
+ * ```ts
+ * createARecordBuilder()
+ *   .zone(ref("zone", (r: HostedZoneBuilderResult) => r.hostedZone))
+ *   .target(cloudfrontAliasTarget(
+ *     ref("cdn", (r: DistributionBuilderResult) => r.distribution),
+ *   ));
+ * ```
+ */
+function cloudfrontAliasTarget(distribution) {
+    return (0, core_1.isRef)(distribution)
+        ? distribution.map((d) => aws_route53_1.RecordTarget.fromAlias(new aws_route53_targets_1.CloudFrontTarget(d)))
+        : aws_route53_1.RecordTarget.fromAlias(new aws_route53_targets_1.CloudFrontTarget(distribution));
+}
+/**
+ * Builds an alias {@link RecordTarget} for an API Gateway REST API that has a
+ * custom domain name configured via {@link RestApiBase}. Accepts a
+ * {@link Resolvable}.
+ */
+function apiGatewayAliasTarget(api) {
+    return (0, core_1.isRef)(api)
+        ? api.map((a) => aws_route53_1.RecordTarget.fromAlias(new aws_route53_targets_1.ApiGateway(a)))
+        : aws_route53_1.RecordTarget.fromAlias(new aws_route53_targets_1.ApiGateway(api));
+}
+/**
+ * Builds an alias {@link RecordTarget} for an API Gateway custom domain name
+ * (`apigateway.DomainName`). Use this when you manage the domain name resource
+ * separately from the REST API (e.g. to share a custom domain across multiple
+ * APIs). Accepts a {@link Resolvable}.
+ */
+function apiGatewayDomainAliasTarget(domain) {
+    return (0, core_1.isRef)(domain)
+        ? domain.map((d) => aws_route53_1.RecordTarget.fromAlias(new aws_route53_targets_1.ApiGatewayDomain(d)))
+        : aws_route53_1.RecordTarget.fromAlias(new aws_route53_targets_1.ApiGatewayDomain(domain));
+}
+//# sourceMappingURL=alias-targets.js.map

package/dist/commonjs/alias-targets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"alias-targets.js","sourceRoot":"","sources":["../../src/alias-targets.ts"],"names":[],"mappings":";;AAqBA,sDAMC;AAOD,sDAIC;AAQD,kEAMC;AAlDD,yDAAuD;AACvD,yEAAiG;AACjG,6CAA4D;AAE5D;;;;;;;;;;;;;;GAcG;AACH,SAAgB,qBAAqB,CACnC,YAAuC;IAEvC,OAAO,IAAA,YAAK,EAAC,YAAY,CAAC;QACxB,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,0BAAY,CAAC,SAAS,CAAC,IAAI,sCAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1E,CAAC,CAAC,0BAAY,CAAC,SAAS,CAAC,IAAI,sCAAgB,CAAC,YAAY,CAAC,CAAC,CAAC;AACjE,CAAC;AAED;;;;GAIG;AACH,SAAgB,qBAAqB,CAAC,GAA4B;IAChE,OAAO,IAAA,YAAK,EAAC,GAAG,CAAC;QACf,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,0BAAY,CAAC,SAAS,CAAC,IAAI,gCAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3D,CAAC,CAAC,0BAAY,CAAC,SAAS,CAAC,IAAI,gCAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AAClD,CAAC;AAED;;;;;GAKG;AACH,SAAgB,2BAA2B,CACzC,MAA+B;IAE/B,OAAO,IAAA,YAAK,EAAC,MAAM,CAAC;QAClB,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,0BAAY,CAAC,SAAS,CAAC,IAAI,sCAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;QACpE,CAAC,CAAC,0BAAY,CAAC,SAAS,CAAC,IAAI,sCAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;AAC3D,CAAC"}

package/dist/commonjs/caa-record-builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"caa-record-builder.d.ts","sourceRoot":"","sources":["../../src/caa-record-builder.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,KAAK,cAAc,EAAE,KAAK,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3F,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAEL,KAAK,QAAQ,EACb,KAAK,SAAS,EAEd,KAAK,UAAU,EAChB,MAAM,oBAAoB,CAAC;AAG5B;;;;;GAKG;AACH,MAAM,WAAW,qBAAsB,SAAQ,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC;IACzE,qDAAqD;IACrD,IAAI,CAAC,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;CAChC;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,+DAA+D;IAC/D,MAAM,EAAE,SAAS,CAAC;CACnB;AAED;;;;;;;;;;GAUG;AAEH,MAAM,MAAM,iBAAiB,GAAG,QAAQ,CAAC,qBAAqB,EAAE,gBAAgB,CAAC,CAAC;AAElF,cAAM,gBAAiB,YAAW,SAAS,CAAC,sBAAsB,CAAC;IACjE,KAAK,EAAE,OAAO,CAAC,qBAAqB,CAAC,CAAM;IAE3C,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,sBAAsB;CAwB/F;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,IAAI,iBAAiB,CAG1D"}

package/dist/commonjs/caa-record-builder.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createCaaRecordBuilder = createCaaRecordBuilder;
+const aws_route53_1 = require("aws-cdk-lib/aws-route53");
+const core_1 = require("@composurecdk/core");
+const defaults_js_1 = require("./defaults.js");
+class CaaRecordBuilder {
+    props = {};
+    build(scope, id, context) {
+        const { zone, values, ...rest } = this.props;
+        if (!zone) {
+            throw new Error(`CaaRecordBuilder "${id}" requires a zone. Call .zone() with an IHostedZone.`);
+        }
+        if (!values || values.length === 0) {
+            throw new Error(`CaaRecordBuilder "${id}" requires non-empty values. ` +
+                `Call .values() with one or more { flag, tag, value } entries.`);
+        }
+        const mergedProps = {
+            ...defaults_js_1.CAA_RECORD_DEFAULTS,
+            ...rest,
+            values,
+            zone: (0, core_1.resolve)(zone, context),
+        };
+        const record = new aws_route53_1.CaaRecord(scope, id, mergedProps);
+        return { record };
+    }
+}
+/**
+ * Creates a new {@link ICaaRecordBuilder} for configuring a Route53 CAA record.
+ *
+ * @returns A fluent builder for a Route53 CAA record.
+ */
+function createCaaRecordBuilder() {
+    // eslint-disable-next-line composurecdk/builder-must-be-tagged -- AWS::Route53::RecordSet has no Tags property
+    return (0, core_1.Builder)(CaaRecordBuilder);
+}
+//# sourceMappingURL=caa-record-builder.js.map

package/dist/commonjs/caa-record-builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"caa-record-builder.js","sourceRoot":"","sources":["../../src/caa-record-builder.ts"],"names":[],"mappings":";;AA8EA,wDAGC;AAjFD,yDAA2F;AAE3F,6CAM4B;AAC5B,+CAAoD;AAmCpD,MAAM,gBAAgB;IACpB,KAAK,GAAmC,EAAE,CAAC;IAE3C,KAAK,CAAC,KAAiB,EAAE,EAAU,EAAE,OAAgC;QACnE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;QAC7C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CACb,qBAAqB,EAAE,sDAAsD,CAC9E,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CACb,qBAAqB,EAAE,+BAA+B;gBACpD,+DAA+D,CAClE,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GAAG;YAClB,GAAG,iCAAmB;YACtB,GAAG,IAAI;YACP,MAAM;YACN,IAAI,EAAE,IAAA,cAAO,EAAC,IAAI,EAAE,OAAO,CAAC;SACX,CAAC;QAEpB,MAAM,MAAM,GAAG,IAAI,uBAAS,CAAC,KAAK,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC;QACrD,OAAO,EAAE,MAAM,EAAE,CAAC;IACpB,CAAC;CACF;AAED;;;;GAIG;AACH,SAAgB,sBAAsB;IACpC,+GAA+G;IAC/G,OAAO,IAAA,cAAO,EAA0C,gBAAgB,CAAC,CAAC;AAC5E,CAAC"}

package/dist/commonjs/cname-record-builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cname-record-builder.d.ts","sourceRoot":"","sources":["../../src/cname-record-builder.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,KAAK,gBAAgB,EAAE,KAAK,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC/F,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAEL,KAAK,QAAQ,EACb,KAAK,SAAS,EAEd,KAAK,UAAU,EAChB,MAAM,oBAAoB,CAAC;AAG5B;;;;;GAKG;AACH,MAAM,WAAW,uBAAwB,SAAQ,IAAI,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAC7E,qDAAqD;IACrD,IAAI,CAAC,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;CAChC;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,iEAAiE;IACjE,MAAM,EAAE,WAAW,CAAC;CACrB;AAED;;;;;;;GAOG;AAEH,MAAM,MAAM,mBAAmB,GAAG,QAAQ,CAAC,uBAAuB,EAAE,kBAAkB,CAAC,CAAC;AAExF,cAAM,kBAAmB,YAAW,SAAS,CAAC,wBAAwB,CAAC;IACrE,KAAK,EAAE,OAAO,CAAC,uBAAuB,CAAC,CAAM;IAE7C,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,wBAAwB;CA+BjG;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,IAAI,mBAAmB,CAG9D"}

package/dist/commonjs/cname-record-builder.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createCnameRecordBuilder = createCnameRecordBuilder;
+const aws_route53_1 = require("aws-cdk-lib/aws-route53");
+const core_1 = require("@composurecdk/core");
+const defaults_js_1 = require("./defaults.js");
+class CnameRecordBuilder {
+    props = {};
+    build(scope, id, context) {
+        const { zone, domainName, recordName, ...rest } = this.props;
+        if (!zone) {
+            throw new Error(`CnameRecordBuilder "${id}" requires a zone. Call .zone() with an IHostedZone.`);
+        }
+        if (!domainName) {
+            throw new Error(`CnameRecordBuilder "${id}" requires a domainName. ` +
+                `Call .domainName() with the target host (what the CNAME points to).`);
+        }
+        if (!recordName) {
+            throw new Error(`CnameRecordBuilder "${id}" requires a recordName. ` +
+                `Call .recordName() with the subdomain — CNAME records cannot be at the zone apex.`);
+        }
+        const mergedProps = {
+            ...defaults_js_1.CNAME_RECORD_DEFAULTS,
+            ...rest,
+            domainName,
+            recordName,
+            zone: (0, core_1.resolve)(zone, context),
+        };
+        const record = new aws_route53_1.CnameRecord(scope, id, mergedProps);
+        return { record };
+    }
+}
+/**
+ * Creates a new {@link ICnameRecordBuilder} for configuring a Route53 CNAME
+ * record.
+ *
+ * @returns A fluent builder for a Route53 CNAME record.
+ */
+function createCnameRecordBuilder() {
+    // eslint-disable-next-line composurecdk/builder-must-be-tagged -- AWS::Route53::RecordSet has no Tags property
+    return (0, core_1.Builder)(CnameRecordBuilder);
+}
+//# sourceMappingURL=cname-record-builder.js.map

package/dist/commonjs/cname-record-builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cname-record-builder.js","sourceRoot":"","sources":["../../src/cname-record-builder.ts"],"names":[],"mappings":";;AAmFA,4DAGC;AAtFD,yDAA+F;AAE/F,6CAM4B;AAC5B,+CAAsD;AAgCtD,MAAM,kBAAkB;IACtB,KAAK,GAAqC,EAAE,CAAC;IAE7C,KAAK,CAAC,KAAiB,EAAE,EAAU,EAAE,OAAgC;QACnE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;QAC7D,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CACb,uBAAuB,EAAE,sDAAsD,CAChF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CACb,uBAAuB,EAAE,2BAA2B;gBAClD,qEAAqE,CACxE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CACb,uBAAuB,EAAE,2BAA2B;gBAClD,mFAAmF,CACtF,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GAAG;YAClB,GAAG,mCAAqB;YACxB,GAAG,IAAI;YACP,UAAU;YACV,UAAU;YACV,IAAI,EAAE,IAAA,cAAO,EAAC,IAAI,EAAE,OAAO,CAAC;SACT,CAAC;QAEtB,MAAM,MAAM,GAAG,IAAI,yBAAW,CAAC,KAAK,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC;QACvD,OAAO,EAAE,MAAM,EAAE,CAAC;IACpB,CAAC;CACF;AAED;;;;;GAKG;AACH,SAAgB,wBAAwB;IACtC,+GAA+G;IAC/G,OAAO,IAAA,cAAO,EAA8C,kBAAkB,CAAC,CAAC;AAClF,CAAC"}

package/dist/{defaults.d.ts → commonjs/defaults.d.ts}

@@ -11,15 +11,41 @@ import type { DsRecordBuilderProps } from "./ds-record-builder.js";
 import type { HttpsRecordBuilderProps } from "./https-record-builder.js";
 import type { SvcbRecordBuilderProps } from "./svcb-record-builder.js";
 import type { HealthCheckBuilderProps } from "./health-check-builder.js";
+/**
+ * Naming prefix applied to every auto-created Route 53 query-log group. A
+ * single shared resource policy targets `<prefix>/*` so multiple hosted zones
+ * in the same stack share one `AWS::Logs::ResourcePolicy` (the per-region
+ * soft limit is 10). Matches the prefix the Route 53 console uses.
+ *
+ * @see https://docs.aws.amazon.com/Route53/latest/APIReference/API_CreateQueryLoggingConfig.html
+ */
+export declare const QUERY_LOGGING_LOG_GROUP_NAME_PREFIX = "/aws/route53";
+/**
+ * Construct id of the shared `AWS::Logs::ResourcePolicy` materialised once
+ * per stack when any hosted zone in that stack uses auto-managed query
+ * logging. Package-internal — used by the dedup helper and the unit tests, and
+ * intentionally not re-exported from the package barrel; consumers should not
+ * reference the policy directly.
+ */
+export declare const QUERY_LOGGING_RESOURCE_POLICY_ID = "ComposureCDKRoute53QueryLoggingPolicy";
+/**
+ * Stable resource-policy name written into CloudWatch Logs so the policy is
+ * deduplicated when the same stack is re-synthesised across deployments.
+ */
+export declare const QUERY_LOGGING_RESOURCE_POLICY_NAME = "ComposureCDK-Route53QueryLogging";
 /**
  * Secure, AWS-recommended defaults applied to every public hosted zone built
  * with {@link createHostedZoneBuilder}. Each property can be individually
  * overridden via the builder's fluent API.
  *
- * Query logging is not enabled by default: Route53 query logs must be written
- * to a CloudWatch log group in `us-east-1` with a resource policy granting
- * `route53.amazonaws.com` write access. Opt in explicitly by calling
- * `.queryLogsLogGroupArn(...)` with a pre-configured log group.
+ * Query logging is enabled by default: the builder auto-creates a CloudWatch
+ * {@link import("aws-cdk-lib/aws-logs").LogGroup} under
+ * `${QUERY_LOGGING_LOG_GROUP_NAME_PREFIX}/<zoneName>` and a single shared
+ * `AWS::Logs::ResourcePolicy` granting `route53.amazonaws.com` permission to
+ * write log streams. Disable with `.queryLogging(false)` or supply a managed
+ * log group via `.queryLogging({ logGroupArn })`.
+ *
+ * @see https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/query-logs.html
  */
 export declare const HOSTED_ZONE_DEFAULTS: Partial<HostedZoneBuilderProps>;
 /**

package/dist/commonjs/defaults.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"defaults.d.ts","sourceRoot":"","sources":["../../src/defaults.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AACjE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACzE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACzE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAEzE;;;;;;;GAOG;AACH,eAAO,MAAM,mCAAmC,iBAAiB,CAAC;AAElE;;;;;;GAMG;AACH,eAAO,MAAM,gCAAgC,0CAA0C,CAAC;AAExF;;;GAGG;AACH,eAAO,MAAM,kCAAkC,qCAAqC,CAAC;AAErF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,oBAAoB,EAAE,OAAO,CAAC,sBAAsB,CAahE,CAAC;AAaF;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,EAAE,OAAO,CAAC,mBAAmB,CAE1D,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,oBAAoB,EAAE,OAAO,CAAC,sBAAsB,CAEhE,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,qBAAqB,EAAE,OAAO,CAAC,uBAAuB,CAElE,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,mBAAmB,EAAE,OAAO,CAAC,qBAAqB,CAE9D,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,kBAAkB,EAAE,OAAO,CAAC,oBAAoB,CAE5D,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,mBAAmB,EAAE,OAAO,CAAC,qBAAqB,CAE9D,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,mBAAmB,EAAE,OAAO,CAAC,qBAAqB,CAE9D,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,EAAE,OAAO,CAAC,oBAAoB,CAE5D,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,EAAE,OAAO,CAAC,oBAAoB,CAE5D,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,qBAAqB,EAAE,OAAO,CAAC,uBAAuB,CAElE,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,oBAAoB,EAAE,OAAO,CAAC,sBAAsB,CAEhE,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,qBAAqB,EAAE,OAAO,CAAC,uBAAuB,CAIlE,CAAC"}

package/dist/commonjs/defaults.js

@@ -0,0 +1,159 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HEALTH_CHECK_DEFAULTS = exports.SVCB_RECORD_DEFAULTS = exports.HTTPS_RECORD_DEFAULTS = exports.DS_RECORD_DEFAULTS = exports.NS_RECORD_DEFAULTS = exports.CAA_RECORD_DEFAULTS = exports.SRV_RECORD_DEFAULTS = exports.MX_RECORD_DEFAULTS = exports.TXT_RECORD_DEFAULTS = exports.CNAME_RECORD_DEFAULTS = exports.AAAA_RECORD_DEFAULTS = exports.A_RECORD_DEFAULTS = exports.HOSTED_ZONE_DEFAULTS = exports.QUERY_LOGGING_RESOURCE_POLICY_NAME = exports.QUERY_LOGGING_RESOURCE_POLICY_ID = exports.QUERY_LOGGING_LOG_GROUP_NAME_PREFIX = void 0;
+const aws_cdk_lib_1 = require("aws-cdk-lib");
+/**
+ * Naming prefix applied to every auto-created Route 53 query-log group. A
+ * single shared resource policy targets `<prefix>/*` so multiple hosted zones
+ * in the same stack share one `AWS::Logs::ResourcePolicy` (the per-region
+ * soft limit is 10). Matches the prefix the Route 53 console uses.
+ *
+ * @see https://docs.aws.amazon.com/Route53/latest/APIReference/API_CreateQueryLoggingConfig.html
+ */
+exports.QUERY_LOGGING_LOG_GROUP_NAME_PREFIX = "/aws/route53";
+/**
+ * Construct id of the shared `AWS::Logs::ResourcePolicy` materialised once
+ * per stack when any hosted zone in that stack uses auto-managed query
+ * logging. Package-internal — used by the dedup helper and the unit tests, and
+ * intentionally not re-exported from the package barrel; consumers should not
+ * reference the policy directly.
+ */
+exports.QUERY_LOGGING_RESOURCE_POLICY_ID = "ComposureCDKRoute53QueryLoggingPolicy";
+/**
+ * Stable resource-policy name written into CloudWatch Logs so the policy is
+ * deduplicated when the same stack is re-synthesised across deployments.
+ */
+exports.QUERY_LOGGING_RESOURCE_POLICY_NAME = "ComposureCDK-Route53QueryLogging";
+/**
+ * Secure, AWS-recommended defaults applied to every public hosted zone built
+ * with {@link createHostedZoneBuilder}. Each property can be individually
+ * overridden via the builder's fluent API.
+ *
+ * Query logging is enabled by default: the builder auto-creates a CloudWatch
+ * {@link import("aws-cdk-lib/aws-logs").LogGroup} under
+ * `${QUERY_LOGGING_LOG_GROUP_NAME_PREFIX}/<zoneName>` and a single shared
+ * `AWS::Logs::ResourcePolicy` granting `route53.amazonaws.com` permission to
+ * write log streams. Disable with `.queryLogging(false)` or supply a managed
+ * log group via `.queryLogging({ logGroupArn })`.
+ *
+ * @see https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/query-logs.html
+ */
+exports.HOSTED_ZONE_DEFAULTS = {
+    /**
+     * Add a trailing dot to the zone name so the apex is an unambiguous
+     * fully-qualified domain. Matches the CDK default and RFC 1035.
+     */
+    addTrailingDot: true,
+    /**
+     * Enable DNS query logging out of the box, with the auto-managed log
+     * group and shared resource policy described above. Set to `false` or to
+     * `{ logGroupArn: '...' }` to deviate.
+     * @see https://docs.aws.amazon.com/wellarchitected/latest/security-pillar/sec_detect_investigate_events_app_service_logging.html
+     */
+    queryLogging: {},
+};
+/**
+ * Default TTL applied to records built by this package when no TTL is set.
+ *
+ * Five minutes balances propagation latency against downstream DNS cache
+ * churn. For alias records pointing at dynamic AWS resources (CloudFront,
+ * ALB), this matches AWS guidance.
+ *
+ * @see https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-to-cloudfront-distribution.html
+ */
+const DEFAULT_RECORD_TTL = aws_cdk_lib_1.Duration.minutes(5);
+/**
+ * Defaults for {@link createARecordBuilder}. Overridable via the fluent API.
+ * The builder skips the `ttl` default for alias targets — AWS ignores TTL on
+ * alias records and CDK emits a warning when one is set.
+ */
+exports.A_RECORD_DEFAULTS = {
+    ttl: DEFAULT_RECORD_TTL,
+};
+/**
+ * Defaults for {@link createAaaaRecordBuilder}. Overridable via the fluent API.
+ * Same alias-target caveat as {@link A_RECORD_DEFAULTS}.
+ */
+exports.AAAA_RECORD_DEFAULTS = {
+    ttl: DEFAULT_RECORD_TTL,
+};
+/**
+ * Defaults for {@link createCnameRecordBuilder}. Overridable via the fluent API.
+ */
+exports.CNAME_RECORD_DEFAULTS = {
+    ttl: DEFAULT_RECORD_TTL,
+};
+/**
+ * Defaults for {@link createTxtRecordBuilder}. Overridable via the fluent API.
+ */
+exports.TXT_RECORD_DEFAULTS = {
+    ttl: DEFAULT_RECORD_TTL,
+};
+/**
+ * Defaults for {@link createMxRecordBuilder}. Overridable via the fluent API.
+ */
+exports.MX_RECORD_DEFAULTS = {
+    ttl: DEFAULT_RECORD_TTL,
+};
+/**
+ * Defaults for {@link createSrvRecordBuilder}. Overridable via the fluent API.
+ */
+exports.SRV_RECORD_DEFAULTS = {
+    ttl: DEFAULT_RECORD_TTL,
+};
+/**
+ * Defaults for {@link createCaaRecordBuilder}. Overridable via the fluent API.
+ */
+exports.CAA_RECORD_DEFAULTS = {
+    ttl: DEFAULT_RECORD_TTL,
+};
+/**
+ * Defaults for {@link createNsRecordBuilder}. Overridable via the fluent API.
+ *
+ * A longer TTL is appropriate for delegation records — resolvers cache NS
+ * responses, and frequent churn forces parent-side re-delegation lookups.
+ */
+exports.NS_RECORD_DEFAULTS = {
+    ttl: aws_cdk_lib_1.Duration.hours(24),
+};
+/**
+ * Defaults for {@link createDsRecordBuilder}. Overridable via the fluent API.
+ *
+ * DS records change rarely (key-signing rollovers); a long TTL reduces
+ * DNSSEC validation load on resolvers.
+ */
+exports.DS_RECORD_DEFAULTS = {
+    ttl: aws_cdk_lib_1.Duration.hours(24),
+};
+/**
+ * Defaults for {@link createHttpsRecordBuilder}. Overridable via the fluent API.
+ * Same alias-target caveat as {@link A_RECORD_DEFAULTS}.
+ */
+exports.HTTPS_RECORD_DEFAULTS = {
+    ttl: DEFAULT_RECORD_TTL,
+};
+/**
+ * Defaults for {@link createSvcbRecordBuilder}. Overridable via the fluent API.
+ */
+exports.SVCB_RECORD_DEFAULTS = {
+    ttl: DEFAULT_RECORD_TTL,
+};
+/**
+ * Defaults for {@link createHealthCheckBuilder}. Overridable via the fluent API.
+ *
+ * `failureThreshold` and `requestInterval` match CDK's defaults but are set
+ * explicitly so the values are surfaced in the package's defaults table and
+ * can be reasoned about without consulting CDK source. `measureLatency` is
+ * defaulted ON to align with the AWS Well-Architected operational-excellence
+ * pillar (per-region latency visibility on the Route 53 Health Checks
+ * console). It carries a small additional cost — disable explicitly via
+ * `.measureLatency(false)` if cost is a concern.
+ *
+ * @see https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/dns-failover-determining-health-of-endpoints.html
+ */
+exports.HEALTH_CHECK_DEFAULTS = {
+    failureThreshold: 3,
+    requestInterval: aws_cdk_lib_1.Duration.seconds(30),
+    measureLatency: true,
+};
+//# sourceMappingURL=defaults.js.map

package/dist/commonjs/defaults.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"defaults.js","sourceRoot":"","sources":["../../src/defaults.ts"],"names":[],"mappings":";;;AAAA,6CAAuC;AAevC;;;;;;;GAOG;AACU,QAAA,mCAAmC,GAAG,cAAc,CAAC;AAElE;;;;;;GAMG;AACU,QAAA,gCAAgC,GAAG,uCAAuC,CAAC;AAExF;;;GAGG;AACU,QAAA,kCAAkC,GAAG,kCAAkC,CAAC;AAErF;;;;;;;;;;;;;GAaG;AACU,QAAA,oBAAoB,GAAoC;IACnE;;;OAGG;IACH,cAAc,EAAE,IAAI;IACpB;;;;;OAKG;IACH,YAAY,EAAE,EAAE;CACjB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,kBAAkB,GAAG,sBAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAE/C;;;;GAIG;AACU,QAAA,iBAAiB,GAAiC;IAC7D,GAAG,EAAE,kBAAkB;CACxB,CAAC;AAEF;;;GAGG;AACU,QAAA,oBAAoB,GAAoC;IACnE,GAAG,EAAE,kBAAkB;CACxB,CAAC;AAEF;;GAEG;AACU,QAAA,qBAAqB,GAAqC;IACrE,GAAG,EAAE,kBAAkB;CACxB,CAAC;AAEF;;GAEG;AACU,QAAA,mBAAmB,GAAmC;IACjE,GAAG,EAAE,kBAAkB;CACxB,CAAC;AAEF;;GAEG;AACU,QAAA,kBAAkB,GAAkC;IAC/D,GAAG,EAAE,kBAAkB;CACxB,CAAC;AAEF;;GAEG;AACU,QAAA,mBAAmB,GAAmC;IACjE,GAAG,EAAE,kBAAkB;CACxB,CAAC;AAEF;;GAEG;AACU,QAAA,mBAAmB,GAAmC;IACjE,GAAG,EAAE,kBAAkB;CACxB,CAAC;AAEF;;;;;GAKG;AACU,QAAA,kBAAkB,GAAkC;IAC/D,GAAG,EAAE,sBAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;CACxB,CAAC;AAEF;;;;;GAKG;AACU,QAAA,kBAAkB,GAAkC;IAC/D,GAAG,EAAE,sBAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;CACxB,CAAC;AAEF;;;GAGG;AACU,QAAA,qBAAqB,GAAqC;IACrE,GAAG,EAAE,kBAAkB;CACxB,CAAC;AAEF;;GAEG;AACU,QAAA,oBAAoB,GAAoC;IACnE,GAAG,EAAE,kBAAkB;CACxB,CAAC;AAEF;;;;;;;;;;;;GAYG;AACU,QAAA,qBAAqB,GAAqC;IACrE,gBAAgB,EAAE,CAAC;IACnB,eAAe,EAAE,sBAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;IACrC,cAAc,EAAE,IAAI;CACrB,CAAC"}

package/dist/commonjs/ds-record-builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ds-record-builder.d.ts","sourceRoot":"","sources":["../../src/ds-record-builder.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,KAAK,aAAa,EAAE,KAAK,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACzF,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAEL,KAAK,QAAQ,EACb,KAAK,SAAS,EAEd,KAAK,UAAU,EAChB,MAAM,oBAAoB,CAAC;AAG5B;;;;;GAKG;AACH,MAAM,WAAW,oBAAqB,SAAQ,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC;IACvE,qDAAqD;IACrD,IAAI,CAAC,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;CAChC;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,8DAA8D;IAC9D,MAAM,EAAE,QAAQ,CAAC;CAClB;AAED;;;;;;;;GAQG;AAEH,MAAM,MAAM,gBAAgB,GAAG,QAAQ,CAAC,oBAAoB,EAAE,eAAe,CAAC,CAAC;AAE/E,cAAM,eAAgB,YAAW,SAAS,CAAC,qBAAqB,CAAC;IAC/D,KAAK,EAAE,OAAO,CAAC,oBAAoB,CAAC,CAAM;IAE1C,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,qBAAqB;CAsB9F;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,IAAI,gBAAgB,CAGxD"}

package/dist/commonjs/ds-record-builder.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createDsRecordBuilder = createDsRecordBuilder;
+const aws_route53_1 = require("aws-cdk-lib/aws-route53");
+const core_1 = require("@composurecdk/core");
+const defaults_js_1 = require("./defaults.js");
+class DsRecordBuilder {
+    props = {};
+    build(scope, id, context) {
+        const { zone, values, ...rest } = this.props;
+        if (!zone) {
+            throw new Error(`DsRecordBuilder "${id}" requires a zone. Call .zone() with an IHostedZone.`);
+        }
+        if (!values || values.length === 0) {
+            throw new Error(`DsRecordBuilder "${id}" requires non-empty values. ` +
+                `Call .values() with one or more DS rdata strings (keyTag algorithm digestType digest).`);
+        }
+        const mergedProps = {
+            ...defaults_js_1.DS_RECORD_DEFAULTS,
+            ...rest,
+            values,
+            zone: (0, core_1.resolve)(zone, context),
+        };
+        const record = new aws_route53_1.DsRecord(scope, id, mergedProps);
+        return { record };
+    }
+}
+/**
+ * Creates a new {@link IDsRecordBuilder} for configuring a Route53 DS record.
+ *
+ * @returns A fluent builder for a Route53 DS record.
+ */
+function createDsRecordBuilder() {
+    // eslint-disable-next-line composurecdk/builder-must-be-tagged -- AWS::Route53::RecordSet has no Tags property
+    return (0, core_1.Builder)(DsRecordBuilder);
+}
+//# sourceMappingURL=ds-record-builder.js.map

package/dist/commonjs/ds-record-builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ds-record-builder.js","sourceRoot":"","sources":["../../src/ds-record-builder.ts"],"names":[],"mappings":";;AA0EA,sDAGC;AA7ED,yDAAyF;AAEzF,6CAM4B;AAC5B,+CAAmD;AAiCnD,MAAM,eAAe;IACnB,KAAK,GAAkC,EAAE,CAAC;IAE1C,KAAK,CAAC,KAAiB,EAAE,EAAU,EAAE,OAAgC;QACnE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;QAC7C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,oBAAoB,EAAE,sDAAsD,CAAC,CAAC;QAChG,CAAC;QACD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CACb,oBAAoB,EAAE,+BAA+B;gBACnD,wFAAwF,CAC3F,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GAAG;YAClB,GAAG,gCAAkB;YACrB,GAAG,IAAI;YACP,MAAM;YACN,IAAI,EAAE,IAAA,cAAO,EAAC,IAAI,EAAE,OAAO,CAAC;SACZ,CAAC;QAEnB,MAAM,MAAM,GAAG,IAAI,sBAAQ,CAAC,KAAK,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC;QACpD,OAAO,EAAE,MAAM,EAAE,CAAC;IACpB,CAAC;CACF;AAED;;;;GAIG;AACH,SAAgB,qBAAqB;IACnC,+GAA+G;IAC/G,OAAO,IAAA,cAAO,EAAwC,eAAe,CAAC,CAAC;AACzE,CAAC"}

package/dist/{health-check-alarm-builder.d.ts → commonjs/health-check-alarm-builder.d.ts}

@@ -1,7 +1,8 @@
 import { type IHealthCheck } from "aws-cdk-lib/aws-route53";
 import { type Alarm } from "aws-cdk-lib/aws-cloudwatch";
 import { type IConstruct } from "constructs";
-import { type IBuilder, type Lifecycle, type Resolvable } from "@composurecdk/core";
+import { COPY_STATE, type Lifecycle, type Resolvable } from "@composurecdk/core";
+import { type ITaggedBuilder } from "@composurecdk/cloudformation";
 import { AlarmDefinitionBuilder } from "@composurecdk/cloudwatch";
 import type { HealthCheckAlarmConfig } from "./health-check-alarm-config.js";
 import type { HealthCheckBuilderResult } from "./health-check-builder.js";
@@ -51,7 +52,7 @@ export interface HealthCheckAlarmBuilderResult {
  *
  * @see {@link createHealthCheckAlarmBuilder}
  */
-export type IHealthCheckAlarmBuilder = IBuilder<HealthCheckAlarmBuilderProps, HealthCheckAlarmBuilder>;
+export type IHealthCheckAlarmBuilder = ITaggedBuilder<HealthCheckAlarmBuilderProps, HealthCheckAlarmBuilder>;
 /**
  * Shared alarm-assembly used by both {@link createHealthCheckBuilder} (in its
  * own stack) and {@link createHealthCheckAlarmBuilder} (typically in a
@@ -89,6 +90,8 @@ declare class HealthCheckAlarmBuilder implements Lifecycle<HealthCheckAlarmBuild
      * the recommended ones.
      */
     addAlarm(key: string, configure: (alarm: AlarmDefinitionBuilder<IHealthCheck>) => AlarmDefinitionBuilder<IHealthCheck>): this;
+    /** @internal — see ADR-0005. */
+    [COPY_STATE](target: HealthCheckAlarmBuilder): void;
     build(scope: IConstruct, id: string, context?: Record<string, object>): HealthCheckAlarmBuilderResult;
 }
 /**