@fjall/components-infrastructure 14.0.0 → 14.2.0

package/dist/lib/patterns/aws/cdn.js

@@ -1,14 +1,105 @@
 import { Fn, Token } from "aws-cdk-lib";
 import { Certificate } from "aws-cdk-lib/aws-certificatemanager";
+import { CloudFrontTarget, LoadBalancerTarget } from "aws-cdk-lib/aws-route53-targets";
 import { CloudFrontDistribution } from "../../resources/aws/cdn/index.js";
+import { AliasRecord } from "../../resources/aws/networking/index.js";
+import { getSafeZoneName, toPascalCase } from "../../utils/capitaliseString.js";
+import { resolvePatternZone, resolvePatternCloudFrontCertificate } from "./patternDomain.js";
 import { isStorage } from "./storage.js";
+import { CdnEcsOriginResolver, recordLabelWithin, normaliseDnsName } from "./cdnAppOrigin.js";
 import { isCompute, isEcsCompute, isLambdaCompute } from "./compute.js";
+/**
+ * The distribution's own alias names, normalised — consumed by the
+ * origin-loop guard and by the ECS origin resolver (auto-resolution excludes
+ * them from routed-host candidates, and a resolved origin equal to one is
+ * refused as a loop).
+ */
+function collectAliasNames(props) {
+    const aliasNames = new Set();
+    if (props.domainConfig !== undefined) {
+        aliasNames.add(normaliseDnsName(props.domainConfig.domainName));
+    }
+    for (const name of props.domainNames ?? []) {
+        if (!Token.isUnresolved(name)) {
+            aliasNames.add(normaliseDnsName(name));
+        }
+    }
+    return aliasNames;
+}
 /**
  * Validates CDN props — synth-time hard errors for shapes CloudFormation
  * would only reject at deploy.
  */
 function validateCdnProps(props) {
     const hasCertificate = !!(props.certificate || props.certificateArn);
+    // domainConfig is the managed-domain authority for the viewer config —
+    // mixing it with the literal surface would give the alias list and the
+    // certificate two owners with no defined precedence.
+    if (props.domainConfig !== undefined) {
+        if (props.domainNames !== undefined || hasCertificate) {
+            throw new Error(`CDN 'domainConfig' ('${props.domainConfig.domainName}') cannot be ` +
+                "combined with 'domainNames', 'certificate', or 'certificateArn'. " +
+                "'domainConfig' derives the alternate domain names and resolves " +
+                "the us-east-1 viewer certificate itself — drop the literal props, " +
+                "or drop 'domainConfig' and manage both by hand.");
+        }
+        if (props.app === undefined) {
+            throw new Error(`CDN 'domainConfig' ('${props.domainConfig.domainName}') requires ` +
+                "the App for certificate placement, but 'app' is unset. Create the " +
+                "CDN through the factory path — app.addCdn(CdnFactory.build(...)) " +
+                "— which fills it, or pass 'app' explicitly.");
+        }
+        // Latency region and setIdentifier are literals by contract — inspect
+        // them at synth so a config slip fails here with the cure, not at
+        // CloudFormation with a raw Route53 InvalidChangeBatch (or, for the
+        // empty-string cases, a CDK error about a prop the user never set).
+        const region = props.domainConfig.routingPolicy?.region;
+        if (region !== undefined && !/^[a-z]{2,4}(-[a-z]+)+-\d+$/.test(region)) {
+            throw new Error(`CDN 'domainConfig.routingPolicy.region' ('${region}') is not an ` +
+                "AWS region name (expected e.g. 'us-east-1'). Route53 latency " +
+                "records carry a literal region label — fix the region string.");
+        }
+        const setIdentifier = props.domainConfig.setIdentifier;
+        if (setIdentifier !== undefined &&
+            (setIdentifier.trim() === "" || setIdentifier.length > 128)) {
+            throw new Error(`CDN 'domainConfig.setIdentifier' (${JSON.stringify(setIdentifier)}) ` +
+                "must be 1-128 non-blank characters (Route53 SetIdentifier limit). " +
+                "Omit it to use the derived '<id><region>' value.");
+        }
+    }
+    // Origin-loop guard (design 2026-08-17 cdn-domain-ownership C4): an HTTP
+    // origin pointing at one of the distribution's own domain names sends
+    // every request CloudFront → DNS → CloudFront until the request-depth
+    // limit 508s. Synth can see this shape whenever the origin hostname is a
+    // literal, so refuse it with the cure.
+    const aliasNames = collectAliasNames(props);
+    const defaultOriginHostname = props.originType === "http"
+        ? props.domainName
+        : props.originType === "auto" && typeof props.origin === "string"
+            ? props.origin
+            : undefined;
+    // Behaviour origins are the same literal-HTTP-origin surface: a string
+    // behaviour origin becomes an HTTP origin via detectOriginFromResource, so
+    // a self-referential one loops exactly like the default origin — but only
+    // for its path pattern, a PARTIAL outage that is even harder to spot.
+    const literalOriginHostnames = [
+        ...(defaultOriginHostname !== undefined ? [defaultOriginHostname] : []),
+        ...(props.behaviours ?? [])
+            .map((behaviour) => behaviour.origin)
+            .filter((origin) => typeof origin === "string")
+    ];
+    for (const originHostname of literalOriginHostnames) {
+        if (!Token.isUnresolved(originHostname) &&
+            aliasNames.has(normaliseDnsName(originHostname))) {
+            throw new Error(`CDN origin '${originHostname}' is also one of the distribution's own ` +
+                "domain names — once DNS points that name at the distribution, every " +
+                "request loops CloudFront → CloudFront. Point the origin at a " +
+                "dedicated origin hostname instead (e.g. an ECS service " +
+                "'routing[].host' such as 'origin.<zone>' resolving to the load " +
+                "balancer, or a domain-stack record targeting the origin resource) " +
+                "and keep the public name on the CDN.");
+        }
+    }
     // CloudFront accepts viewer certificates from us-east-1 only. A literal
     // ARN is inspectable at synth (design H3/D3 — the old advisory log is
     // replaced by real us-east-1 provisioning in the patterns; this assert
@@ -34,18 +125,66 @@ function validateCdnProps(props) {
             "'certificateArn', or configure the pattern's 'domain' with a zone " +
             "identity so it provisions one.");
     }
-    // Validate ALB origin
+    // Validate ALB origin (design 2026-08-18 cdn-app-origin, D4): CloudFront
+    // validates the origin certificate against the raw `*.elb.amazonaws.com`
+    // hostname, which no ACM certificate ever covers — an effective-HTTPS alb
+    // origin can never complete a TLS handshake. E9, with the cure conditional
+    // on the listener protocol: HTTP_ONLY only works against a port-80
+    // listener, and a cert-bearing cluster has exactly one listener, on 443.
     if (props.originType === "alb") {
-        if (isCompute(props.loadBalancer) && isEcsCompute(props.loadBalancer)) {
-            const lb = props.loadBalancer.getLoadBalancer();
-            if (!lb) {
-                throw new Error("Compute resource does not have a load balancer. " +
-                    "Ensure ECS compute has loadBalancer enabled for CDN origin.");
-            }
+        const computeRef = isCompute(props.loadBalancer) && isEcsCompute(props.loadBalancer)
+            ? props.loadBalancer
+            : undefined;
+        if (computeRef !== undefined && !computeRef.getLoadBalancer()) {
+            throw new Error("Compute resource does not have a load balancer. " +
+                "Ensure ECS compute has loadBalancer enabled for CDN origin.");
+        }
+        const profile = computeRef?.getIngressProfile();
+        if (profile?.internal) {
+            // E2 — same defect as the construct-origin lane: no public path in.
+            throw new Error("CDN alb origin: the load balancer is internal — CloudFront " +
+                "reaches origins over the public internet and cannot address an " +
+                "internal ALB. Make the load balancer internet-facing.");
+        }
+        const effectiveProtocol = props.protocolPolicy ?? "HTTPS_ONLY";
+        if (effectiveProtocol !== "HTTP_ONLY") {
+            // E9 — effective HTTPS to the raw ELB hostname.
+            const cure = profile === undefined
+                ? 'If the ALB has an HTTP (port-80) listener, set protocolPolicy: "HTTP_ONLY"; ' +
+                    'otherwise use originType "auto" with the compute as origin, ' +
+                    "which resolves a certificate-covered origin hostname."
+                : profile.listenerPort === 80
+                    ? 'Set protocolPolicy: "HTTP_ONLY" (the cluster\'s listener serves HTTP), ' +
+                        'or use originType "auto" with the compute as origin.'
+                    : 'Use originType "auto" with the compute as origin — the ' +
+                        "cluster's only listener is HTTPS (443), so the sole working " +
+                        "path is a certificate-covered origin hostname.";
+            throw new Error(`CDN alb origin with protocolPolicy '${effectiveProtocol}' can ` +
+                "never complete a TLS handshake: CloudFront validates the origin " +
+                "certificate against the raw ELB hostname " +
+                "(*.elb.amazonaws.com), which no ACM certificate covers — every " +
+                `origin fetch fails with a 502. ${cure}`);
+        }
+        if (profile !== undefined && profile.listenerPort === 443) {
+            // E9 (HTTP_ONLY variant) — nothing listens on 80: a connect-timeout
+            // 504 instead of a TLS 502, equally broken.
+            throw new Error('CDN alb origin with protocolPolicy "HTTP_ONLY": the cluster\'s ' +
+                "only listener is HTTPS (443) — a certificate resolved, so " +
+                "nothing listens on port 80 and every origin fetch times out. " +
+                'Use originType "auto" with the compute as origin instead.');
         }
     }
     // Validate smart origin
     if (props.originType === "auto") {
+        if (!(isCompute(props.origin) && isEcsCompute(props.origin)) &&
+            (props.originHostname !== undefined || props.originRecord !== undefined)) {
+            throw new Error("CDN 'originHostname'/'originRecord' configure the distribution's " +
+                "DEFAULT origin, and only when it is an ECS compute — they " +
+                "resolve the origin hostname against that compute's ingress " +
+                "profile. Drop them for storage, Lambda, and literal-hostname " +
+                "default origins; a behaviour's ECS origin takes the same " +
+                "overrides on the behaviour entry itself.");
+        }
         if (isCompute(props.origin)) {
             if (isEcsCompute(props.origin)) {
                 if (!props.origin.getLoadBalancer()) {
@@ -73,20 +212,203 @@ function validateCdnProps(props) {
 export class Cdn extends CloudFrontDistribution {
     constructor(scope, id, props) {
         validateCdnProps(props);
-        const resolvedProps = Cdn.resolveProps(scope, id, props);
+        // Zone + certificate resolve BEFORE super() — the viewer certificate is
+        // part of the distribution's props — so their constructs land on the CDN
+        // stack (`scope`) under `${id}`-prefixed IDs, the pattern convention.
+        const domain = props.domainConfig !== undefined && props.app !== undefined
+            ? Cdn.resolveDomain(scope, id, props.domainConfig, props.app)
+            : undefined;
+        // ECS construct-reference origins resolve through one memoized resolver
+        // (design 2026-08-18 cdn-app-origin, D3): the default origin and every
+        // behaviour referencing the same compute share one resolution and at
+        // most one origin record.
+        const ecsOriginResolver = Cdn.createEcsOriginResolver(id, props);
+        const resolvedProps = Cdn.resolveProps(scope, id, props, domain, ecsOriginResolver);
         super(scope, id, resolvedProps);
+        if (domain !== undefined && props.domainConfig !== undefined) {
+            this.createDomainRecord(id, props.domainConfig, domain);
+        }
+        this.createOriginRecords(ecsOriginResolver.getRecordPlans());
+    }
+    static createEcsOriginResolver(id, props) {
+        return new CdnEcsOriginResolver({
+            cdnId: id,
+            aliasNames: collectAliasNames(props),
+            overrides: Cdn.collectEcsOriginOverrides(id, props)
+        });
+    }
+    /**
+     * Assemble the per-compute `originHostname`/`originRecord` overrides the
+     * resolver binds by compute identity: the distribution-level props apply
+     * to the DEFAULT origin's compute, each behaviour's own overrides apply
+     * to that behaviour's compute. Two entries naming the same compute must
+     * agree — one alias record cannot carry two spellings.
+     */
+    static collectEcsOriginOverrides(id, props) {
+        const overrides = new Map();
+        const claim = (compute, override, site) => {
+            const existing = overrides.get(compute) ?? {};
+            for (const key of ["originHostname", "originRecord"]) {
+                const incoming = override[key];
+                if (incoming === undefined)
+                    continue;
+                const held = existing[key];
+                if (held !== undefined && held !== incoming) {
+                    throw new Error(`CDN '${id}': conflicting ${key} overrides for the same ECS ` +
+                        `compute origin ('${held}' vs '${incoming}' from ${site}) — ` +
+                        "overrides bind per compute, so every entry naming it must " +
+                        "agree. Keep one spelling.");
+                }
+            }
+            overrides.set(compute, { ...existing, ...override });
+        };
+        if (props.originType === "auto") {
+            const override = {
+                ...(props.originHostname !== undefined && {
+                    originHostname: props.originHostname
+                }),
+                ...(props.originRecord !== undefined && {
+                    originRecord: props.originRecord
+                })
+            };
+            if ((override.originHostname !== undefined ||
+                override.originRecord !== undefined) &&
+                isCompute(props.origin) &&
+                isEcsCompute(props.origin)) {
+                claim(props.origin, override, "the distribution props");
+            }
+        }
+        for (const behaviour of props.behaviours ?? []) {
+            if (behaviour.originHostname === undefined &&
+                behaviour.originRecord === undefined) {
+                continue;
+            }
+            if (typeof behaviour.origin === "string" ||
+                !isCompute(behaviour.origin) ||
+                !isEcsCompute(behaviour.origin)) {
+                throw new Error(`CDN '${id}': behaviour '${behaviour.pathPattern}' sets ` +
+                    "'originHostname'/'originRecord', but its origin is not an ECS " +
+                    "compute — they configure how the origin hostname resolves " +
+                    "against the compute's ingress profile. Drop them for storage, " +
+                    "Lambda, and literal-hostname origins.");
+            }
+            claim(behaviour.origin, {
+                ...(behaviour.originHostname !== undefined && {
+                    originHostname: behaviour.originHostname
+                }),
+                ...(behaviour.originRecord !== undefined && {
+                    originRecord: behaviour.originRecord
+                })
+            }, `behaviour '${behaviour.pathPattern}'`);
+        }
+        return overrides;
+    }
+    /**
+     * Mint the Cdn-owned origin alias records (P1) after the distribution
+     * exists, using the compute profile's own zone instance so the DNS claim
+     * registry sees the same zone identity as the cluster's records. The
+     * distribution depends on each record: the hostname must resolve before a
+     * distribution update referencing it propagates.
+     */
+    createOriginRecords(plans) {
+        // Plans are memoized per compute, so two entries with one hostname mean
+        // two DIFFERENT computes resolved the same name — an inherently invalid
+        // shape (one alias record cannot target two load balancers). Refuse it
+        // with the cure instead of letting CDK's duplicate-construct-id throw.
+        const byHostname = new Map();
+        for (const plan of plans) {
+            const key = normaliseDnsName(plan.hostname);
+            if (byHostname.has(key)) {
+                throw new Error(`CDN '${this.node.id}': two ECS compute origins resolved the ` +
+                    `same origin hostname '${plan.hostname}' — one alias record ` +
+                    "cannot target two load balancers. Give one of them a " +
+                    "distinct originHostname.");
+            }
+            byHostname.set(key, plan);
+        }
+        for (const plan of plans) {
+            const safeHost = toPascalCase(getSafeZoneName(plan.hostname));
+            const record = new AliasRecord(this, `${safeHost}OriginRecord`, {
+                zone: plan.hostedZone,
+                zoneName: plan.zoneName,
+                recordName: plan.recordName,
+                target: new LoadBalancerTarget(plan.loadBalancer)
+            });
+            this.getDistribution().node.addDependency(record);
+        }
+    }
+    /**
+     * Resolve a `domainConfig` through the shared pattern-domain helpers
+     * (design C1): zone identity via `resolvePatternZone` (explicit
+     * `managedDomain` → CLI-injected binding → BYO `zoneName`/`hostedZoneId`),
+     * viewer certificate via `resolvePatternCloudFrontCertificate` (binding's
+     * literal us-east-1 ARN, else app-owned provisioning). The exact resolution
+     * chain staticSite and payload already use — the CDN stops being the one
+     * CloudFront-fronted pattern without it.
+     */
+    static resolveDomain(scope, id, domainConfig, app) {
+        const request = {
+            scope,
+            app,
+            idPrefix: id,
+            context: `CDN '${id}'`,
+            domain: domainConfig.domainName,
+            identity: domainConfig
+        };
+        const zone = resolvePatternZone(request);
+        const certificate = resolvePatternCloudFrontCertificate(request, zone);
+        return { zone, certificate };
+    }
+    /**
+     * Own the domain's DNS record in the CDN stack (satellite doctrine — the
+     * app owns its records, the domain stack owns zone-level records), exactly
+     * as the ECS cluster owns its apex alias. Latency routing gets the
+     * cluster's setIdentifier derivation (`${id}${region}`) unless overridden;
+     * `record: "none"` skips this entirely (pre-flip validation state).
+     */
+    createDomainRecord(id, domainConfig, domain) {
+        if (domainConfig.record === "none") {
+            return;
+        }
+        const region = domainConfig.routingPolicy?.region;
+        const setIdentifier = domainConfig.setIdentifier ??
+            (region !== undefined ? `${id}${region}` : undefined);
+        new AliasRecord(this, "AliasRecord", {
+            zone: domain.zone.hostedZone,
+            zoneName: domain.zone.zoneName,
+            recordName: recordLabelWithin(domainConfig.domainName, domain.zone.zoneName),
+            // CloudFrontTarget sets no EvaluateTargetHealth — Route53 requires it
+            // absent for CloudFront alias targets.
+            target: new CloudFrontTarget(this.getDistribution()),
+            ...(region !== undefined && { region }),
+            ...(setIdentifier !== undefined && { setIdentifier })
+        });
     }
     /**
      * Resolve ICdnProps to CloudFrontDistributionProps.
      */
-    static resolveProps(scope, id, props) {
-        const defaultOrigin = Cdn.resolveDefaultOrigin(props);
-        const behaviours = Cdn.resolveBehaviours(props.behaviours);
+    static resolveProps(scope, id, props, domain, ecsOriginResolver) {
+        const defaultOrigin = Cdn.resolveDefaultOrigin(props, ecsOriginResolver);
+        const behaviours = Cdn.resolveBehaviours(props.behaviours, ecsOriginResolver);
         const appName = props.appName;
+        const domainNames = props.domainNames ??
+            (props.domainConfig !== undefined
+                ? [props.domainConfig.domainName]
+                : undefined);
+        // A default origin resolved through the ECS profile lane serves a
+        // hostname that differs from the viewer-facing aliases, so host
+        // fidelity via x-forwarded-host is the sensible default (design D3
+        // step 9). Explicit `forwardHostHeader: false` wins.
+        const impliedForwardHostHeader = props.originType === "auto" &&
+            isCompute(props.origin) &&
+            isEcsCompute(props.origin) &&
+            (domainNames?.length ?? 0) > 0
+            ? true
+            : undefined;
         const certificate = props.certificate ??
             (props.certificateArn
                 ? Certificate.fromCertificateArn(scope, `${id}Certificate`, props.certificateArn)
-                : undefined);
+                : domain?.certificate);
         const s3Routing = props.originType === "s3"
             ? {
                 defaultRootObject: props.defaultRootObject,
@@ -102,13 +424,13 @@ export class Cdn extends CloudFrontDistribution {
             defaultCachePolicy: props.cachePolicy,
             defaultAllowedMethods: props.defaultAllowedMethods,
             behaviours,
-            domainNames: props.domainNames,
+            domainNames,
             certificate,
             comment: props.comment,
             enableLogging: props.enableLogging,
             logBucket: props.logBucket,
             priceClass: props.priceClass,
-            forwardHostHeader: props.forwardHostHeader,
+            forwardHostHeader: props.forwardHostHeader ?? impliedForwardHostHeader,
             accessGate: props.accessGate,
             ...s3Routing
         };
@@ -116,13 +438,13 @@ export class Cdn extends CloudFrontDistribution {
     /**
      * Transform smart behaviours to CdnBehaviour objects.
      */
-    static resolveBehaviours(behaviours) {
+    static resolveBehaviours(behaviours, ecsOriginResolver) {
         if (!behaviours || behaviours.length === 0) {
             return undefined;
         }
         return behaviours.map((behaviour) => ({
             pathPattern: behaviour.pathPattern,
-            origin: Cdn.detectOriginFromResource(behaviour.origin),
+            origin: Cdn.detectOriginFromResource(behaviour.origin, ecsOriginResolver),
             cachePolicy: behaviour.cachePolicy,
             allowedMethods: behaviour.allowedMethods
         }));
@@ -130,7 +452,7 @@ export class Cdn extends CloudFrontDistribution {
     /**
      * Resolve the default origin from ICdnProps.
      */
-    static resolveDefaultOrigin(props) {
+    static resolveDefaultOrigin(props, ecsOriginResolver) {
         switch (props.originType) {
             case "s3": {
                 const bucket = isStorage(props.bucket)
@@ -176,7 +498,7 @@ export class Cdn extends CloudFrontDistribution {
                     protocolPolicy: props.protocolPolicy
                 };
             case "auto":
-                return Cdn.detectOriginFromResource(props.origin);
+                return Cdn.detectOriginFromResource(props.origin, ecsOriginResolver);
             default: {
                 const _exhaustive = props;
                 throw new Error(`Unsupported CDN origin type: ${props.originType}`);
@@ -186,7 +508,7 @@ export class Cdn extends CloudFrontDistribution {
     /**
      * Auto-detect origin configuration from a Fjall resource.
      */
-    static detectOriginFromResource(resource) {
+    static detectOriginFromResource(resource, ecsOriginResolver) {
         // String → HTTP origin
         if (typeof resource === "string") {
             return {
@@ -201,15 +523,13 @@ export class Cdn extends CloudFrontDistribution {
                 bucket: resource.getBucket()
             };
         }
-        // ECS Compute → ALB origin
+        // ECS Compute → HTTP origin on a resolved, certificate-covered origin
+        // hostname (design 2026-08-18 cdn-app-origin, D3). The former raw-ELB
+        // alb-origin emission was TLS-broken by construction: the resource
+        // layer's HTTPS_ONLY default validated the certificate against
+        // *.elb.amazonaws.com, which no ACM certificate covers.
         if (isEcsCompute(resource)) {
-            const loadBalancer = resource.getLoadBalancer();
-            if (loadBalancer) {
-                return {
-                    type: "alb",
-                    loadBalancer
-                };
-            }
+            return ecsOriginResolver.resolve(resource).originConfig;
         }
         // Lambda Compute → HTTP origin (function URL)
         if (isLambdaCompute(resource)) {
@@ -226,6 +546,10 @@ export class Cdn extends CloudFrontDistribution {
                     domainName
                 };
             }
+            // Targeted error (design D3): a behaviour origin used to fall through
+            // to the generic detect throw for this shape.
+            throw new Error("Lambda compute must have a function URL for CDN origin. " +
+                "Enable functionUrl in your Lambda compute configuration.");
         }
         throw new Error(`Unable to detect CDN origin from resource: ${typeof resource}. ` +
             "Provide explicit origin configuration using originType.");
@@ -265,6 +589,20 @@ export class Cdn extends CloudFrontDistribution {
  *   domainNames: ["app.example.com"],
  *   certificate: myCert
  * }));
+ *
+ * @example
+ * // Managed domain — the CDN resolves the zone + us-east-1 certificate and
+ * // owns the alias record in its own stack (satellite doctrine), like the
+ * // ECS cluster's domainConfig.
+ * app.addCdn(CdnFactory.build("AppCdn", {
+ *   originType: "http",
+ *   domainName: "origin.example.com",
+ *   forwardHostHeader: true,
+ *   domainConfig: {
+ *     domainName: "example.com",
+ *     routingPolicy: { type: "latency", region: "us-east-1" }
+ *   }
+ * }));
  */
 export class CdnFactory {
     /**
@@ -278,9 +616,12 @@ export class CdnFactory {
         return (app, scope) => {
             // The App is the only place the app name is known here; without it the
             // export falls back to the construct id and the Domain import misses.
+            // The App instance itself rides along for domainConfig resolution
+            // (certificate placement needs app.getUsEast1CertificateStack()).
             return new Cdn(scope, id, {
                 ...props,
-                appName: props.appName ?? app.getName()
+                appName: props.appName ?? app.getName(),
+                app: props.app ?? app
             });
         };
     }

package/dist/lib/patterns/aws/cdnAppOrigin.d.ts

@@ -0,0 +1,74 @@
+/**
+ * ECS construct-reference origin resolution for the `Cdn` pattern (design
+ * 2026-08-18 cdn-app-origin, D3). Given a fronted ECS compute, resolve a
+ * TLS-valid ORIGIN HOSTNAME from the compute's own ingress profile, decide
+ * who owns its DNS record (P1: the construct that declares a hostname owns
+ * its record — a `routing[].host` hostname is the compute's; a derived or
+ * free hostname is the Cdn's), and validate certificate coverage and
+ * listener forwarding at synth — fail closed where decidable, warn where
+ * opaque or partial (P3).
+ *
+ * The resolver is memoized per compute within one `Cdn`: the default origin
+ * and every behaviour referencing the same compute share one resolution and
+ * at most one record.
+ */
+import type { IHostedZone } from "aws-cdk-lib/aws-route53";
+import type { IApplicationLoadBalancer } from "aws-cdk-lib/aws-elasticloadbalancingv2";
+import type { CdnOriginConfig } from "../../resources/aws/cdn/index.js";
+import type { IEcsCompute } from "./interfaces/compute.js";
+import { normaliseDnsName } from "../../resources/aws/compute/ingressProfile.js";
+export { normaliseDnsName };
+/**
+ * Relative record label for `domain` within `zoneName` (the staticSite
+ * `recordLabelFor` convention): the zone apex maps to the canonical apex
+ * label, sub-names drop the zone suffix.
+ */
+export declare function recordLabelWithin(domain: string, zoneName: string): string;
+/** A Cdn-owned origin alias record to mint after the distribution exists. */
+export interface EcsOriginRecordPlan {
+    hostname: string;
+    hostedZone: IHostedZone;
+    zoneName: string;
+    recordName: string;
+    loadBalancer: IApplicationLoadBalancer;
+}
+export interface ResolvedEcsOrigin {
+    hostname: string;
+    originConfig: CdnOriginConfig;
+    /** Present when the Cdn owns the record and `originRecord` is not "none". */
+    recordPlan?: EcsOriginRecordPlan;
+    /** True when the hostname is a compute-declared routing host (P1). */
+    computeOwnsRecord: boolean;
+}
+/**
+ * Explicit per-compute origin overrides: the distribution-level
+ * `originHostname`/`originRecord` for the default origin's compute, and each
+ * behaviour's own `originHostname`/`originRecord` for its compute — so every
+ * lane that can throw E3 can also cure it (design D3: behaviour origins get
+ * the same targeted validation AND the same override surface).
+ */
+export interface EcsOriginOverride {
+    originHostname?: string;
+    originRecord?: "alias" | "none";
+}
+export interface CdnEcsOriginResolverOptions {
+    cdnId: string;
+    /** The distribution's own alias names, normalised — the origin-loop guard. */
+    aliasNames: ReadonlySet<string>;
+    /** Per-compute explicit overrides — assembled by the Cdn from the
+     * distribution props (default origin) and each behaviour entry. */
+    overrides?: ReadonlyMap<IEcsCompute, EcsOriginOverride>;
+}
+export declare class CdnEcsOriginResolver {
+    private readonly options;
+    private readonly resolutions;
+    private warnedUnknownCoverage;
+    constructor(options: CdnEcsOriginResolverOptions);
+    resolve(compute: IEcsCompute): ResolvedEcsOrigin;
+    /** Every Cdn-owned record the resolutions so far require, one per compute. */
+    getRecordPlans(): EcsOriginRecordPlan[];
+    private resolveFresh;
+    private explicitHostnameFor;
+    private effectiveOriginRecord;
+    private selectHostname;
+}