@fjall/components-infrastructure 0.89.5 → 0.89.6

package/dist/lib/patterns/aws/dnsRecordComposer.js

@@ -0,0 +1,225 @@
+import { CaaTag } from "aws-cdk-lib/aws-route53";
+import { ARecord, AaaaRecord, AliasRecord, CnameRecord, MxRecord, TxtRecord, NsRecord, SrvRecord, CaaRecord } from "../../resources/aws/networking/dnsRecord/index.js";
+import { toPascalCase, getSafeZoneName } from "../../utils/capitaliseString.js";
+import { ALIAS_CDK_PREFIX } from "../../utils/domainTypes.js";
+import { DNS_APEX } from "@fjall/util";
+/**
+ * Legacy composer consumed by `DomainFactory` (deleted in Phase 2). Accepts
+ * the `DnsRecordInput` shape from the BIND-primary era where ALIAS sentinels
+ * live in `value`. Typed targets are not supported here; use
+ * `composeTypedDnsRecords` instead.
+ */
+export function composeDnsRecords(scope, zone, zoneName, records) {
+    const safeZone = toPascalCase(getSafeZoneName(zoneName));
+    records.forEach((record, index) => {
+        // Skip alias sentinels — they are resolved via the typed path in Phase 1+.
+        if (record.value.startsWith(ALIAS_CDK_PREFIX)) {
+            return;
+        }
+        const safeName = toPascalCase(record.name === DNS_APEX ? "Apex" : record.name);
+        const constructId = `${safeZone}${safeName}${record.type}Record${index}`;
+        const common = {
+            zone,
+            zoneName,
+            recordName: record.name,
+            ttl: record.ttl
+        };
+        switch (record.type) {
+            case "A":
+                new ARecord(scope, constructId, {
+                    ...common,
+                    values: [record.value]
+                });
+                break;
+            case "AAAA":
+                new AaaaRecord(scope, constructId, {
+                    ...common,
+                    values: [record.value]
+                });
+                break;
+            case "CNAME":
+                new CnameRecord(scope, constructId, {
+                    ...common,
+                    domainName: record.value
+                });
+                break;
+            case "MX":
+                new MxRecord(scope, constructId, {
+                    ...common,
+                    values: [
+                        {
+                            hostName: record.value,
+                            priority: record.priority ?? 10
+                        }
+                    ]
+                });
+                break;
+            case "TXT":
+                new TxtRecord(scope, constructId, {
+                    ...common,
+                    values: [record.value]
+                });
+                break;
+            case "NS":
+                new NsRecord(scope, constructId, {
+                    ...common,
+                    values: [record.value]
+                });
+                break;
+            case "SRV":
+                new SrvRecord(scope, constructId, {
+                    ...common,
+                    values: [
+                        {
+                            hostName: record.value,
+                            priority: record.priority ?? 10,
+                            weight: record.weight ?? 0,
+                            port: record.port ?? 443
+                        }
+                    ]
+                });
+                break;
+            case "CAA":
+                new CaaRecord(scope, constructId, {
+                    ...common,
+                    values: [
+                        {
+                            flag: 0,
+                            tag: record.value.includes("issuewild")
+                                ? CaaTag.ISSUEWILD
+                                : record.value.includes("iodef")
+                                    ? CaaTag.IODEF
+                                    : CaaTag.ISSUE,
+                            value: record.value
+                        }
+                    ]
+                });
+                break;
+        }
+    });
+}
+/**
+ * Typed composer consumed by the new `Domain` construct. Accepts the
+ * discriminated `DnsRecord` union (`StandardRecord | AliasRecord`).
+ *
+ * `AliasRecord` entries MUST carry a `target` produced by `fjallApp()`,
+ * `fjallCdn()`, `fjallBucket()`, or `aliasTo()` — those helpers return
+ * `FjallTarget & IAliasRecordTarget` so `target.bind()` is guaranteed. A
+ * runtime guard catches user-crafted `{ kind, ... }` literals that lack
+ * `bind()`.
+ *
+ * Construct-id formula (`${safeZone}${safeName}${type}Record${index}`) is
+ * byte-identical to the legacy composer — this is an eject-contract
+ * invariant (Phase 3 depends on stable IDs).
+ */
+export function composeTypedDnsRecords(scope, zone, zoneName, records) {
+    const safeZone = toPascalCase(getSafeZoneName(zoneName));
+    records.forEach((record, index) => {
+        const safeName = toPascalCase(record.name === DNS_APEX ? "Apex" : record.name);
+        const constructId = `${safeZone}${safeName}${record.type}Record${index}`;
+        const common = {
+            zone,
+            zoneName,
+            recordName: record.name
+        };
+        if ("target" in record) {
+            const target = record.target;
+            if (target === null ||
+                typeof target !== "object" ||
+                typeof target.bind !== "function") {
+                throw new Error("AliasRecord target must be constructed via fjallApp()/fjallCdn()/fjallBucket()/aliasTo() — " +
+                    "plain FjallTarget objects lack the bind() method required by CDK's IAliasRecordTarget contract.");
+            }
+            new AliasRecord(scope, constructId, {
+                ...common,
+                target: target
+            });
+            return;
+        }
+        const ttl = record.ttl;
+        const values = Array.isArray(record.value) ? record.value : [record.value];
+        switch (record.type) {
+            case "A":
+                new ARecord(scope, constructId, { ...common, ttl, values });
+                break;
+            case "AAAA":
+                new AaaaRecord(scope, constructId, { ...common, ttl, values });
+                break;
+            case "CNAME":
+                new CnameRecord(scope, constructId, {
+                    ...common,
+                    ttl,
+                    domainName: values[0] ?? ""
+                });
+                break;
+            case "MX":
+                new MxRecord(scope, constructId, {
+                    ...common,
+                    ttl,
+                    values: values.map((raw) => parseMxValue(raw))
+                });
+                break;
+            case "TXT":
+                new TxtRecord(scope, constructId, { ...common, ttl, values });
+                break;
+            case "NS":
+                new NsRecord(scope, constructId, { ...common, ttl, values });
+                break;
+            case "SRV":
+                new SrvRecord(scope, constructId, {
+                    ...common,
+                    ttl,
+                    values: values.map((raw) => parseSrvValue(raw))
+                });
+                break;
+            case "CAA":
+                new CaaRecord(scope, constructId, {
+                    ...common,
+                    ttl,
+                    values: values.map((raw) => ({
+                        flag: 0,
+                        tag: raw.includes("issuewild")
+                            ? CaaTag.ISSUEWILD
+                            : raw.includes("iodef")
+                                ? CaaTag.IODEF
+                                : CaaTag.ISSUE,
+                        value: raw
+                    }))
+                });
+                break;
+            default: {
+                const _exhaustive = record;
+                throw new Error(`Unsupported DnsRecord type: ${String(_exhaustive.type)}`);
+            }
+        }
+    });
+}
+// Parse "10 mail.example.com" → { priority: 10, hostName: "mail.example.com" }.
+function parseMxValue(raw) {
+    const parts = raw.trim().split(/\s+/);
+    if (parts.length < 2) {
+        return { hostName: raw.trim(), priority: 10 };
+    }
+    const priorityPart = parts[0] ?? "10";
+    const hostPart = parts.slice(1).join(" ");
+    const parsed = Number.parseInt(priorityPart, 10);
+    return {
+        priority: Number.isFinite(parsed) ? parsed : 10,
+        hostName: hostPart
+    };
+}
+// Parse "10 0 443 target.example.com" → SRV value. Missing fields fall back
+// to sensible Route53-compatible defaults.
+function parseSrvValue(raw) {
+    const parts = raw.trim().split(/\s+/);
+    const priority = Number.parseInt(parts[0] ?? "10", 10);
+    const weight = Number.parseInt(parts[1] ?? "0", 10);
+    const port = Number.parseInt(parts[2] ?? "443", 10);
+    const hostName = parts.slice(3).join(" ") || (parts[0] ?? "");
+    return {
+        priority: Number.isFinite(priority) ? priority : 10,
+        weight: Number.isFinite(weight) ? weight : 0,
+        port: Number.isFinite(port) ? port : 443,
+        hostName
+    };
+}

package/dist/lib/patterns/aws/domain.d.ts

@@ -0,0 +1,32 @@
+import { Construct } from "constructs";
+import type { IHostedZone } from "aws-cdk-lib/aws-route53";
+import type { ICertificate } from "aws-cdk-lib/aws-certificatemanager";
+import { getDomainExportNames } from "@fjall/util";
+import type { DomainProps, ManualRecord } from "./interfaces/domain.js";
+/**
+ * User-facing Route53-oriented domain construct. Dispatches on
+ * `props.registrar` to one of three per-registrar patterns:
+ *
+ *   - `route53` → `composeApexDomain` (apex HZ + delegations)
+ *   - `external-delegated` → `composeDelegatedDomain` (sub-HZ only)
+ *   - `external-records` → `composeExternalRecords` (no HZ, manual records)
+ *
+ * Applies gold-plating tags (`fjall:description`, three
+ * `fjall:costAllocation:*` tags) and user-supplied tags at the construct
+ * scope. Exposes the composed artefacts as public readonly properties for
+ * callers that need to wire resources (e.g., granting cert references).
+ *
+ * Pure composition — holds no state beyond the props/results. Validation is
+ * performed synchronously in the constructor; CDK surfaces any thrown Error
+ * against the `new Domain(...)` call site.
+ */
+export declare class Domain extends Construct {
+    #private;
+    readonly registrar: DomainProps["registrar"];
+    readonly hostedZone: IHostedZone | undefined;
+    readonly certificates: Map<string, ICertificate>;
+    readonly nameServers: string[] | undefined;
+    readonly manualRecords: ManualRecord[];
+    readonly exportNames: ReturnType<typeof getDomainExportNames>;
+    constructor(scope: Construct, id: string, props: DomainProps);
+}

package/dist/lib/patterns/aws/domain.js

@@ -0,0 +1,115 @@
+import { CfnOutput, Tags } from "aws-cdk-lib";
+import { Construct } from "constructs";
+import { getDomainExportNames } from "@fjall/util";
+import { toPascalCase, getSafeZoneName } from "../../utils/capitaliseString.js";
+import { validateDomainProps } from "./domainValidation.js";
+import { composeApexDomain } from "./apexDomainPattern.js";
+import { composeDelegatedDomain } from "./delegatedDomainPattern.js";
+import { composeExternalRecords } from "./externalRecordsPattern.js";
+/**
+ * User-facing Route53-oriented domain construct. Dispatches on
+ * `props.registrar` to one of three per-registrar patterns:
+ *
+ *   - `route53` → `composeApexDomain` (apex HZ + delegations)
+ *   - `external-delegated` → `composeDelegatedDomain` (sub-HZ only)
+ *   - `external-records` → `composeExternalRecords` (no HZ, manual records)
+ *
+ * Applies gold-plating tags (`fjall:description`, three
+ * `fjall:costAllocation:*` tags) and user-supplied tags at the construct
+ * scope. Exposes the composed artefacts as public readonly properties for
+ * callers that need to wire resources (e.g., granting cert references).
+ *
+ * Pure composition — holds no state beyond the props/results. Validation is
+ * performed synchronously in the constructor; CDK surfaces any thrown Error
+ * against the `new Domain(...)` call site.
+ */
+export class Domain extends Construct {
+    registrar;
+    hostedZone;
+    certificates;
+    nameServers;
+    manualRecords;
+    exportNames;
+    constructor(scope, id, props) {
+        super(scope, id);
+        validateDomainProps(this, props);
+        this.registrar = props.registrar;
+        this.exportNames = getDomainExportNames(resolveEffectiveZoneName(props));
+        switch (props.registrar) {
+            case "route53": {
+                const result = composeApexDomain(this, props);
+                this.hostedZone = result.hostedZone;
+                this.certificates = result.certificates;
+                this.nameServers = result.nameServers;
+                this.manualRecords = result.manualRecords;
+                break;
+            }
+            case "external-delegated": {
+                const result = composeDelegatedDomain(this, props);
+                this.hostedZone = result.hostedZone;
+                this.certificates = result.certificates;
+                this.nameServers = result.nameServers;
+                this.manualRecords = result.manualRecords;
+                break;
+            }
+            case "external-records": {
+                const result = composeExternalRecords(this, props);
+                this.hostedZone = undefined;
+                this.certificates = result.certificates;
+                this.nameServers = undefined;
+                this.manualRecords = result.manualRecords;
+                break;
+            }
+            default: {
+                const _exhaustive = props;
+                throw new Error(`Unsupported Domain registrar: ${String(_exhaustive.registrar)}`);
+            }
+        }
+        this.#applyGoldPlatingTags(props);
+        this.#applyUserTags(props);
+        this.#emitCrossPhaseOutputs(props);
+    }
+    #applyGoldPlatingTags(props) {
+        const effectiveZone = resolveEffectiveZoneName(props);
+        const description = props.description ?? `Fjall-managed domain for ${effectiveZone}`;
+        Tags.of(this).add("fjall:description", description);
+        Tags.of(this).add("fjall:costAllocation:environment", props.costAllocationEnvironment ?? "management");
+        Tags.of(this).add("fjall:costAllocation:service", "domain");
+        Tags.of(this).add("fjall:costAllocation:domain", props.zoneName);
+    }
+    #applyUserTags(props) {
+        if (!props.tags) {
+            return;
+        }
+        for (const [key, value] of Object.entries(props.tags)) {
+            Tags.of(this).add(key, value);
+        }
+    }
+    /**
+     * Re-publish the domain's effective zone name under a predictable export
+     * key so downstream consumers (Phase 2, Phase 3 eject) can resolve the
+     * managed zone without knowing the registrar discriminant. The `Zone` and
+     * `HostedZoneId` outputs on the inner `HostedZone` construct cover the
+     * Route53-backed paths; this output covers external-records mode where no
+     * hosted zone exists.
+     */
+    #emitCrossPhaseOutputs(props) {
+        if (props.registrar !== "external-records") {
+            return;
+        }
+        const safeZone = toPascalCase(getSafeZoneName(props.zoneName));
+        new CfnOutput(this, `${safeZone}ExternalZoneName`, {
+            key: `${safeZone}ExternalZoneName`,
+            value: props.zoneName,
+            description: "External-records zone name (no Fjall-managed HZ)"
+        });
+    }
+}
+function resolveEffectiveZoneName(props) {
+    if (props.registrar === "external-delegated") {
+        const delegated = props;
+        return `${delegated.delegatedSubdomain}.${delegated.zoneName}`;
+    }
+    const narrowed = props;
+    return narrowed.zoneName;
+}

package/dist/lib/patterns/aws/domainDelegation.d.ts

@@ -1,8 +1,8 @@
 import { Construct } from "constructs";
-import * as route53 from "aws-cdk-lib/aws-route53";
-import type { DomainDelegatedProps } from "./interfaces/domain";
+import type { IHostedZone } from "aws-cdk-lib/aws-route53";
+import type { DomainDelegatedProps } from "./interfaces/domain.js";
 export declare class DomainDelegation extends Construct {
     readonly hostedZoneId: string;
-    readonly hostedZone: route53.HostedZone;
+    readonly hostedZone: IHostedZone;
     constructor(scope: Construct, id: string, props: DomainDelegatedProps);
 }

package/dist/lib/patterns/aws/domainDelegation.js

@@ -1,54 +1,45 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.DomainDelegation = void 0;
-const constructs_1 = require("constructs");
-const aws_cdk_lib_1 = require("aws-cdk-lib");
-const route53 = require("aws-cdk-lib/aws-route53");
-const iam_1 = require("../../resources/aws/iam");
-const capitaliseString_1 = require("../../utils/capitaliseString");
-const domainCertificate_1 = require("../../resources/aws/networking/domainCertificate");
-const domainTypes_1 = require("../../utils/domainTypes");
-class DomainDelegation extends constructs_1.Construct {
+import { Construct } from "constructs";
+import { Fn } from "aws-cdk-lib";
+import { getDomainExportNames } from "@fjall/util";
+import { Role } from "../../resources/aws/iam/index.js";
+import { toPascalCase, getSafeZoneName } from "../../utils/capitaliseString.js";
+import { HostedZone } from "../../resources/aws/networking/hostedZone.js";
+import { CrossAccountDelegationRecord } from "../../resources/aws/networking/crossAccountDelegationRecord.js";
+import { DomainCertificate } from "../../resources/aws/networking/domainCertificate.js";
+import { composeDnsRecords } from "./dnsRecordComposer.js";
+export class DomainDelegation extends Construct {
+    hostedZoneId;
+    hostedZone;
     constructor(scope, id, props) {
         super(scope, id);
-        const parentFirstLabel = props.parentZoneName.split(".")[0] ?? "default";
-        const delegationRoleArn = aws_cdk_lib_1.Fn.importValue(`${parentFirstLabel}DelegateHostedZoneRoleArn`);
-        const hostedZoneDelegationRole = iam_1.Role.fromRoleArn(this, "HostedZoneDelegationRole", delegationRoleArn);
-        const safeZone = (0, capitaliseString_1.getSafeZoneName)(props.zoneName);
-        this.hostedZone = new route53.HostedZone(this, `${safeZone}HostedZone`, {
-            zoneName: props.zoneName
+        const delegationRoleArn = Fn.importValue(getDomainExportNames(props.parentZoneName).delegationRoleArn);
+        const hostedZoneDelegationRole = Role.fromRoleArn(this, "HostedZoneDelegationRole", delegationRoleArn);
+        const safeZone = getSafeZoneName(props.zoneName);
+        const zone = new HostedZone(this, `${safeZone}HostedZone`, {
+            zoneName: props.zoneName,
+            createDelegationRole: false
         });
-        this.hostedZoneId = this.hostedZone.hostedZoneId;
-        new route53.CrossAccountZoneDelegationRecord(this, `${safeZone}DelegationRecord`, {
+        this.hostedZone = zone.hostedZone;
+        this.hostedZoneId = zone.hostedZoneId;
+        new CrossAccountDelegationRecord(this, `${safeZone}DelegationRecord`, {
             delegationRole: hostedZoneDelegationRole,
-            delegatedZone: this.hostedZone,
+            delegatedZone: zone.hostedZone,
+            delegatedZoneName: props.zoneName,
             parentHostedZoneName: props.parentZoneName
         });
-        const safeKey = (0, capitaliseString_1.toPascalCase)(safeZone);
-        const exports = (0, domainTypes_1.getDomainExportNames)(props.zoneName);
-        new aws_cdk_lib_1.CfnOutput(this, `${safeKey}HostedZoneId`, {
-            key: `${safeKey}HostedZoneId`,
-            value: this.hostedZoneId,
-            exportName: exports.hostedZoneId
-        });
-        new aws_cdk_lib_1.CfnOutput(this, `${safeKey}Nameservers`, {
-            key: `${safeKey}Nameservers`,
-            value: aws_cdk_lib_1.Fn.join(",", this.hostedZone.hostedZoneNameServers ?? [])
-        });
+        const safeKey = toPascalCase(safeZone);
         if (props.certificates) {
             props.certificates.forEach((cert, index) => {
-                const safeCertName = (0, capitaliseString_1.toPascalCase)(cert.domainName.split(".").join(""));
-                new domainCertificate_1.DomainCertificate(this, `${safeKey}${safeCertName}Cert${index}`, {
+                const safeCertName = toPascalCase(cert.domainName.split(".").join(""));
+                new DomainCertificate(this, `${safeKey}${safeCertName}Cert${index}`, {
                     domainName: cert.domainName,
                     subjectAlternativeNames: cert.subjectAlternativeNames,
-                    hostedZone: this.hostedZone
+                    hostedZone: zone.hostedZone
                 });
             });
         }
         if (props.records) {
-            (0, domainTypes_1.addDnsRecords)(this, this.hostedZone, props.zoneName, props.records);
+            composeDnsRecords(this, zone.hostedZone, props.zoneName, props.records);
         }
     }
 }
-exports.DomainDelegation = DomainDelegation;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZG9tYWluRGVsZWdhdGlvbi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uLy4uL2xpYi9wYXR0ZXJucy9hd3MvZG9tYWluRGVsZWdhdGlvbi50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFBQSwyQ0FBdUM7QUFDdkMsNkNBQTRDO0FBQzVDLG1EQUFtRDtBQUNuRCxpREFBK0M7QUFDL0MsbUVBQTZFO0FBQzdFLHdGQUFxRjtBQUVyRix5REFBOEU7QUFFOUUsTUFBYSxnQkFBaUIsU0FBUSxzQkFBUztJQUk3QyxZQUFZLEtBQWdCLEVBQUUsRUFBVSxFQUFFLEtBQTJCO1FBQ25FLEtBQUssQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLENBQUM7UUFFakIsTUFBTSxnQkFBZ0IsR0FBRyxLQUFLLENBQUMsY0FBYyxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsSUFBSSxTQUFTLENBQUM7UUFDekUsTUFBTSxpQkFBaUIsR0FBRyxnQkFBRSxDQUFDLFdBQVcsQ0FDdEMsR0FBRyxnQkFBZ0IsMkJBQTJCLENBQy9DLENBQUM7UUFFRixNQUFNLHdCQUF3QixHQUFHLFVBQUksQ0FBQyxXQUFXLENBQy9DLElBQUksRUFDSiwwQkFBMEIsRUFDMUIsaUJBQWlCLENBQ2xCLENBQUM7UUFFRixNQUFNLFFBQVEsR0FBRyxJQUFBLGtDQUFlLEVBQUMsS0FBSyxDQUFDLFFBQVEsQ0FBQyxDQUFDO1FBRWpELElBQUksQ0FBQyxVQUFVLEdBQUcsSUFBSSxPQUFPLENBQUMsVUFBVSxDQUFDLElBQUksRUFBRSxHQUFHLFFBQVEsWUFBWSxFQUFFO1lBQ3RFLFFBQVEsRUFBRSxLQUFLLENBQUMsUUFBUTtTQUN6QixDQUFDLENBQUM7UUFFSCxJQUFJLENBQUMsWUFBWSxHQUFHLElBQUksQ0FBQyxVQUFVLENBQUMsWUFBWSxDQUFDO1FBRWpELElBQUksT0FBTyxDQUFDLGdDQUFnQyxDQUMxQyxJQUFJLEVBQ0osR0FBRyxRQUFRLGtCQUFrQixFQUM3QjtZQUNFLGNBQWMsRUFBRSx3QkFBd0I7WUFDeEMsYUFBYSxFQUFFLElBQUksQ0FBQyxVQUFVO1lBQzlCLG9CQUFvQixFQUFFLEtBQUssQ0FBQyxjQUFjO1NBQzNDLENBQ0YsQ0FBQztRQUVGLE1BQU0sT0FBTyxHQUFHLElBQUEsK0JBQVksRUFBQyxRQUFRLENBQUMsQ0FBQztRQUN2QyxNQUFNLE9BQU8sR0FBRyxJQUFBLGtDQUFvQixFQUFDLEtBQUssQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUVyRCxJQUFJLHVCQUFTLENBQUMsSUFBSSxFQUFFLEdBQUcsT0FBTyxjQUFjLEVBQUU7WUFDNUMsR0FBRyxFQUFFLEdBQUcsT0FBTyxjQUFjO1lBQzdCLEtBQUssRUFBRSxJQUFJLENBQUMsWUFBWTtZQUN4QixVQUFVLEVBQUUsT0FBTyxDQUFDLFlBQVk7U0FDakMsQ0FBQyxDQUFDO1FBRUgsSUFBSSx1QkFBUyxDQUFDLElBQUksRUFBRSxHQUFHLE9BQU8sYUFBYSxFQUFFO1lBQzNDLEdBQUcsRUFBRSxHQUFHLE9BQU8sYUFBYTtZQUM1QixLQUFLLEVBQUUsZ0JBQUUsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFLElBQUksQ0FBQyxVQUFVLENBQUMscUJBQXFCLElBQUksRUFBRSxDQUFDO1NBQ2pFLENBQUMsQ0FBQztRQUVILElBQUksS0FBSyxDQUFDLFlBQVksRUFBRSxDQUFDO1lBQ3ZCLEtBQUssQ0FBQyxZQUFZLENBQUMsT0FBTyxDQUFDLENBQUMsSUFBSSxFQUFFLEtBQUssRUFBRSxFQUFFO2dCQUN6QyxNQUFNLFlBQVksR0FBRyxJQUFBLCtCQUFZLEVBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUM7Z0JBQ3ZFLElBQUkscUNBQWlCLENBQUMsSUFBSSxFQUFFLEdBQUcsT0FBTyxHQUFHLFlBQVksT0FBTyxLQUFLLEVBQUUsRUFBRTtvQkFDbkUsVUFBVSxFQUFFLElBQUksQ0FBQyxVQUFVO29CQUMzQix1QkFBdUIsRUFBRSxJQUFJLENBQUMsdUJBQXVCO29CQUNyRCxVQUFVLEVBQUUsSUFBSSxDQUFDLFVBQVU7aUJBQzVCLENBQUMsQ0FBQztZQUNMLENBQUMsQ0FBQyxDQUFDO1FBQ0wsQ0FBQztRQUVELElBQUksS0FBSyxDQUFDLE9BQU8sRUFBRSxDQUFDO1lBQ2xCLElBQUEsMkJBQWEsRUFBQyxJQUFJLEVBQUUsSUFBSSxDQUFDLFVBQVUsRUFBRSxLQUFLLENBQUMsUUFBUSxFQUFFLEtBQUssQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUN0RSxDQUFDO0lBQ0gsQ0FBQztDQUNGO0FBakVELDRDQWlFQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IENvbnN0cnVjdCB9IGZyb20gXCJjb25zdHJ1Y3RzXCI7XG5pbXBvcnQgeyBDZm5PdXRwdXQsIEZuIH0gZnJvbSBcImF3cy1jZGstbGliXCI7XG5pbXBvcnQgKiBhcyByb3V0ZTUzIGZyb20gXCJhd3MtY2RrLWxpYi9hd3Mtcm91dGU1M1wiO1xuaW1wb3J0IHsgUm9sZSB9IGZyb20gXCIuLi8uLi9yZXNvdXJjZXMvYXdzL2lhbVwiO1xuaW1wb3J0IHsgdG9QYXNjYWxDYXNlLCBnZXRTYWZlWm9uZU5hbWUgfSBmcm9tIFwiLi4vLi4vdXRpbHMvY2FwaXRhbGlzZVN0cmluZ1wiO1xuaW1wb3J0IHsgRG9tYWluQ2VydGlmaWNhdGUgfSBmcm9tIFwiLi4vLi4vcmVzb3VyY2VzL2F3cy9uZXR3b3JraW5nL2RvbWFpbkNlcnRpZmljYXRlXCI7XG5pbXBvcnQgdHlwZSB7IERvbWFpbkRlbGVnYXRlZFByb3BzIH0gZnJvbSBcIi4vaW50ZXJmYWNlcy9kb21haW5cIjtcbmltcG9ydCB7IGdldERvbWFpbkV4cG9ydE5hbWVzLCBhZGREbnNSZWNvcmRzIH0gZnJvbSBcIi4uLy4uL3V0aWxzL2RvbWFpblR5cGVzXCI7XG5cbmV4cG9ydCBjbGFzcyBEb21haW5EZWxlZ2F0aW9uIGV4dGVuZHMgQ29uc3RydWN0IHtcbiAgcHVibGljIHJlYWRvbmx5IGhvc3RlZFpvbmVJZDogc3RyaW5nO1xuICBwdWJsaWMgcmVhZG9ubHkgaG9zdGVkWm9uZTogcm91dGU1My5Ib3N0ZWRab25lO1xuXG4gIGNvbnN0cnVjdG9yKHNjb3BlOiBDb25zdHJ1Y3QsIGlkOiBzdHJpbmcsIHByb3BzOiBEb21haW5EZWxlZ2F0ZWRQcm9wcykge1xuICAgIHN1cGVyKHNjb3BlLCBpZCk7XG5cbiAgICBjb25zdCBwYXJlbnRGaXJzdExhYmVsID0gcHJvcHMucGFyZW50Wm9uZU5hbWUuc3BsaXQoXCIuXCIpWzBdID8/IFwiZGVmYXVsdFwiO1xuICAgIGNvbnN0IGRlbGVnYXRpb25Sb2xlQXJuID0gRm4uaW1wb3J0VmFsdWUoXG4gICAgICBgJHtwYXJlbnRGaXJzdExhYmVsfURlbGVnYXRlSG9zdGVkWm9uZVJvbGVBcm5gXG4gICAgKTtcblxuICAgIGNvbnN0IGhvc3RlZFpvbmVEZWxlZ2F0aW9uUm9sZSA9IFJvbGUuZnJvbVJvbGVBcm4oXG4gICAgICB0aGlzLFxuICAgICAgXCJIb3N0ZWRab25lRGVsZWdhdGlvblJvbGVcIixcbiAgICAgIGRlbGVnYXRpb25Sb2xlQXJuXG4gICAgKTtcblxuICAgIGNvbnN0IHNhZmVab25lID0gZ2V0U2FmZVpvbmVOYW1lKHByb3BzLnpvbmVOYW1lKTtcblxuICAgIHRoaXMuaG9zdGVkWm9uZSA9IG5ldyByb3V0ZTUzLkhvc3RlZFpvbmUodGhpcywgYCR7c2FmZVpvbmV9SG9zdGVkWm9uZWAsIHtcbiAgICAgIHpvbmVOYW1lOiBwcm9wcy56b25lTmFtZVxuICAgIH0pO1xuXG4gICAgdGhpcy5ob3N0ZWRab25lSWQgPSB0aGlzLmhvc3RlZFpvbmUuaG9zdGVkWm9uZUlkO1xuXG4gICAgbmV3IHJvdXRlNTMuQ3Jvc3NBY2NvdW50Wm9uZURlbGVnYXRpb25SZWNvcmQoXG4gICAgICB0aGlzLFxuICAgICAgYCR7c2FmZVpvbmV9RGVsZWdhdGlvblJlY29yZGAsXG4gICAgICB7XG4gICAgICAgIGRlbGVnYXRpb25Sb2xlOiBob3N0ZWRab25lRGVsZWdhdGlvblJvbGUsXG4gICAgICAgIGRlbGVnYXRlZFpvbmU6IHRoaXMuaG9zdGVkWm9uZSxcbiAgICAgICAgcGFyZW50SG9zdGVkWm9uZU5hbWU6IHByb3BzLnBhcmVudFpvbmVOYW1lXG4gICAgICB9XG4gICAgKTtcblxuICAgIGNvbnN0IHNhZmVLZXkgPSB0b1Bhc2NhbENhc2Uoc2FmZVpvbmUpO1xuICAgIGNvbnN0IGV4cG9ydHMgPSBnZXREb21haW5FeHBvcnROYW1lcyhwcm9wcy56b25lTmFtZSk7XG5cbiAgICBuZXcgQ2ZuT3V0cHV0KHRoaXMsIGAke3NhZmVLZXl9SG9zdGVkWm9uZUlkYCwge1xuICAgICAga2V5OiBgJHtzYWZlS2V5fUhvc3RlZFpvbmVJZGAsXG4gICAgICB2YWx1ZTogdGhpcy5ob3N0ZWRab25lSWQsXG4gICAgICBleHBvcnROYW1lOiBleHBvcnRzLmhvc3RlZFpvbmVJZFxuICAgIH0pO1xuXG4gICAgbmV3IENmbk91dHB1dCh0aGlzLCBgJHtzYWZlS2V5fU5hbWVzZXJ2ZXJzYCwge1xuICAgICAga2V5OiBgJHtzYWZlS2V5fU5hbWVzZXJ2ZXJzYCxcbiAgICAgIHZhbHVlOiBGbi5qb2luKFwiLFwiLCB0aGlzLmhvc3RlZFpvbmUuaG9zdGVkWm9uZU5hbWVTZXJ2ZXJzID8/IFtdKVxuICAgIH0pO1xuXG4gICAgaWYgKHByb3BzLmNlcnRpZmljYXRlcykge1xuICAgICAgcHJvcHMuY2VydGlmaWNhdGVzLmZvckVhY2goKGNlcnQsIGluZGV4KSA9PiB7XG4gICAgICAgIGNvbnN0IHNhZmVDZXJ0TmFtZSA9IHRvUGFzY2FsQ2FzZShjZXJ0LmRvbWFpbk5hbWUuc3BsaXQoXCIuXCIpLmpvaW4oXCJcIikpO1xuICAgICAgICBuZXcgRG9tYWluQ2VydGlmaWNhdGUodGhpcywgYCR7c2FmZUtleX0ke3NhZmVDZXJ0TmFtZX1DZXJ0JHtpbmRleH1gLCB7XG4gICAgICAgICAgZG9tYWluTmFtZTogY2VydC5kb21haW5OYW1lLFxuICAgICAgICAgIHN1YmplY3RBbHRlcm5hdGl2ZU5hbWVzOiBjZXJ0LnN1YmplY3RBbHRlcm5hdGl2ZU5hbWVzLFxuICAgICAgICAgIGhvc3RlZFpvbmU6IHRoaXMuaG9zdGVkWm9uZVxuICAgICAgICB9KTtcbiAgICAgIH0pO1xuICAgIH1cblxuICAgIGlmIChwcm9wcy5yZWNvcmRzKSB7XG4gICAgICBhZGREbnNSZWNvcmRzKHRoaXMsIHRoaXMuaG9zdGVkWm9uZSwgcHJvcHMuem9uZU5hbWUsIHByb3BzLnJlY29yZHMpO1xuICAgIH1cbiAgfVxufVxuIl19

package/dist/lib/patterns/aws/domainFactory.d.ts

@@ -1,8 +1,23 @@
-import { type Construct } from "constructs";
-import { Domain } from "../../resources/aws/networking/domain";
-import { DomainDelegation } from "./domainDelegation";
-import type { DomainApexProps, DomainDelegatedProps } from "./interfaces/domain";
+import { Construct } from "constructs";
+import type { IHostedZone } from "aws-cdk-lib/aws-route53";
+import { DomainDelegation } from "./domainDelegation.js";
+import type { DomainApexProps, DomainDelegatedProps } from "./interfaces/domain.js";
+/**
+ * @internal
+ * Apex domain composition — combines HostedZone, per-type DNS records, and
+ * certificates. Defined inline here rather than in its own file because Phase 1
+ * replaces this class wholesale with the user-facing `Domain` construct. Extracting
+ * now would be over-investment in a doomed abstraction.
+ *
+ * Exported only so pattern-layer tests can assert `instanceof ApexDomain`.
+ */
+export declare class ApexDomain extends Construct {
+    readonly hostedZone: IHostedZone;
+    readonly hostedZoneId: string;
+    constructor(scope: Construct, id: string, props: DomainApexProps);
+    private addCertificates;
+}
 export declare class DomainFactory {
-    static build(id: string, props: DomainApexProps): (scope: Construct) => Domain;
+    static build(id: string, props: DomainApexProps): (scope: Construct) => ApexDomain;
     static build(id: string, props: DomainDelegatedProps): (scope: Construct) => DomainDelegation;
 }

package/dist/lib/patterns/aws/domainFactory.js

@@ -1,16 +1,56 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.DomainFactory = void 0;
-const domain_1 = require("../../resources/aws/networking/domain");
-const domainDelegation_1 = require("./domainDelegation");
-class DomainFactory {
+import { Construct } from "constructs";
+import { HostedZone } from "../../resources/aws/networking/hostedZone.js";
+import { DomainCertificate } from "../../resources/aws/networking/domainCertificate.js";
+import { toPascalCase } from "../../utils/capitaliseString.js";
+import { DomainDelegation } from "./domainDelegation.js";
+import { composeDnsRecords } from "./dnsRecordComposer.js";
+/**
+ * @internal
+ * Apex domain composition — combines HostedZone, per-type DNS records, and
+ * certificates. Defined inline here rather than in its own file because Phase 1
+ * replaces this class wholesale with the user-facing `Domain` construct. Extracting
+ * now would be over-investment in a doomed abstraction.
+ *
+ * Exported only so pattern-layer tests can assert `instanceof ApexDomain`.
+ */
+export class ApexDomain extends Construct {
+    hostedZone;
+    hostedZoneId;
+    constructor(scope, id, props) {
+        super(scope, id);
+        const zone = new HostedZone(this, "Zone", {
+            zoneName: props.zoneName,
+            hostedZoneId: props.hostedZoneId
+        });
+        this.hostedZone = zone.hostedZone;
+        this.hostedZoneId = zone.hostedZoneId;
+        if (props.records) {
+            composeDnsRecords(this, zone.hostedZone, props.zoneName, props.records);
+        }
+        if (props.certificates) {
+            this.addCertificates(props.certificates, props.zoneName);
+        }
+    }
+    addCertificates(certificates, zoneName) {
+        const safeZone = toPascalCase(zoneName.split(".").join(""));
+        certificates.forEach((cert, index) => {
+            const safeCertName = toPascalCase(cert.domainName.split(".").join(""));
+            new DomainCertificate(this, `${safeZone}${safeCertName}Cert${index}`, {
+                domainName: cert.domainName,
+                subjectAlternativeNames: cert.subjectAlternativeNames,
+                hostedZone: this.hostedZone
+            });
+        });
+    }
+}
+export class DomainFactory {
     static build(id, props) {
         return (scope) => {
             switch (props.type) {
                 case "domain":
-                    return new domain_1.Domain(scope, id, props);
+                    return new ApexDomain(scope, id, props);
                 case "delegated":
-                    return new domainDelegation_1.DomainDelegation(scope, id, props);
+                    return new DomainDelegation(scope, id, props);
                 default: {
                     const _exhaustive = props;
                     throw new Error(`Unsupported domain type: ${String(_exhaustive.type)}`);
@@ -19,5 +59,3 @@ class DomainFactory {
         };
     }
 }
-exports.DomainFactory = DomainFactory;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZG9tYWluRmFjdG9yeS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uLy4uL2xpYi9wYXR0ZXJucy9hd3MvZG9tYWluRmFjdG9yeS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFDQSxrRUFBK0Q7QUFDL0QseURBQXNEO0FBT3RELE1BQWEsYUFBYTtJQVN4QixNQUFNLENBQUMsS0FBSyxDQUNWLEVBQVUsRUFDVixLQUFtQjtRQUVuQixPQUFPLENBQUMsS0FBZ0IsRUFBRSxFQUFFO1lBQzFCLFFBQVEsS0FBSyxDQUFDLElBQUksRUFBRSxDQUFDO2dCQUNuQixLQUFLLFFBQVE7b0JBQ1gsT0FBTyxJQUFJLGVBQU0sQ0FBQyxLQUFLLEVBQUUsRUFBRSxFQUFFLEtBQUssQ0FBQyxDQUFDO2dCQUN0QyxLQUFLLFdBQVc7b0JBQ2QsT0FBTyxJQUFJLG1DQUFnQixDQUFDLEtBQUssRUFBRSxFQUFFLEVBQUUsS0FBSyxDQUFDLENBQUM7Z0JBQ2hELE9BQU8sQ0FBQyxDQUFDLENBQUM7b0JBQ1IsTUFBTSxXQUFXLEdBQVUsS0FBSyxDQUFDO29CQUNqQyxNQUFNLElBQUksS0FBSyxDQUNiLDRCQUE0QixNQUFNLENBQUUsV0FBNEIsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUN6RSxDQUFDO2dCQUNKLENBQUM7WUFDSCxDQUFDO1FBQ0gsQ0FBQyxDQUFDO0lBQ0osQ0FBQztDQUNGO0FBNUJELHNDQTRCQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IHR5cGUgQ29uc3RydWN0IH0gZnJvbSBcImNvbnN0cnVjdHNcIjtcbmltcG9ydCB7IERvbWFpbiB9IGZyb20gXCIuLi8uLi9yZXNvdXJjZXMvYXdzL25ldHdvcmtpbmcvZG9tYWluXCI7XG5pbXBvcnQgeyBEb21haW5EZWxlZ2F0aW9uIH0gZnJvbSBcIi4vZG9tYWluRGVsZWdhdGlvblwiO1xuaW1wb3J0IHR5cGUge1xuICBEb21haW5BcGV4UHJvcHMsXG4gIERvbWFpbkRlbGVnYXRlZFByb3BzLFxuICBJRG9tYWluUHJvcHNcbn0gZnJvbSBcIi4vaW50ZXJmYWNlcy9kb21haW5cIjtcblxuZXhwb3J0IGNsYXNzIERvbWFpbkZhY3Rvcnkge1xuICBzdGF0aWMgYnVpbGQoXG4gICAgaWQ6IHN0cmluZyxcbiAgICBwcm9wczogRG9tYWluQXBleFByb3BzXG4gICk6IChzY29wZTogQ29uc3RydWN0KSA9PiBEb21haW47XG4gIHN0YXRpYyBidWlsZChcbiAgICBpZDogc3RyaW5nLFxuICAgIHByb3BzOiBEb21haW5EZWxlZ2F0ZWRQcm9wc1xuICApOiAoc2NvcGU6IENvbnN0cnVjdCkgPT4gRG9tYWluRGVsZWdhdGlvbjtcbiAgc3RhdGljIGJ1aWxkKFxuICAgIGlkOiBzdHJpbmcsXG4gICAgcHJvcHM6IElEb21haW5Qcm9wc1xuICApOiAoc2NvcGU6IENvbnN0cnVjdCkgPT4gRG9tYWluIHwgRG9tYWluRGVsZWdhdGlvbiB7XG4gICAgcmV0dXJuIChzY29wZTogQ29uc3RydWN0KSA9PiB7XG4gICAgICBzd2l0Y2ggKHByb3BzLnR5cGUpIHtcbiAgICAgICAgY2FzZSBcImRvbWFpblwiOlxuICAgICAgICAgIHJldHVybiBuZXcgRG9tYWluKHNjb3BlLCBpZCwgcHJvcHMpO1xuICAgICAgICBjYXNlIFwiZGVsZWdhdGVkXCI6XG4gICAgICAgICAgcmV0dXJuIG5ldyBEb21haW5EZWxlZ2F0aW9uKHNjb3BlLCBpZCwgcHJvcHMpO1xuICAgICAgICBkZWZhdWx0OiB7XG4gICAgICAgICAgY29uc3QgX2V4aGF1c3RpdmU6IG5ldmVyID0gcHJvcHM7XG4gICAgICAgICAgdGhyb3cgbmV3IEVycm9yKFxuICAgICAgICAgICAgYFVuc3VwcG9ydGVkIGRvbWFpbiB0eXBlOiAke1N0cmluZygoX2V4aGF1c3RpdmUgYXMgSURvbWFpblByb3BzKS50eXBlKX1gXG4gICAgICAgICAgKTtcbiAgICAgICAgfVxuICAgICAgfVxuICAgIH07XG4gIH1cbn1cbiJdfQ==

package/dist/lib/patterns/aws/domainValidation.d.ts

@@ -0,0 +1,11 @@
+import type { Construct } from "constructs";
+import type { DomainProps } from "./interfaces/domain.js";
+/**
+ * Synchronous synth-time validator for `DomainProps`. Throws on hard errors
+ * (CDK catches and surfaces the stack trace pointing at the `new Domain(...)`
+ * call site). Emits CDK warnings (non-fatal) for advisories such as alias
+ * records carrying a runtime TTL that Route53 silently ignores.
+ *
+ * Pure: no I/O, no CDK side effects other than `Annotations.of(scope).addWarning`.
+ */
+export declare function validateDomainProps(scope: Construct, props: DomainProps): void;