@fjall/components-infrastructure 14.0.0 → 14.2.0

package/dist/lib/resources/aws/compute/ecsNetworking.js

@@ -9,7 +9,8 @@ import { DomainCertificate } from "../networking/domainCertificate.js";
 import { AliasRecord } from "../networking/dnsRecord/aliasRecord.js";
 import { SecurityGroup } from "../networking/securityGroup.js";
 import { DNS_APEX, isManagedDomainBinding, isWithinZone } from "../../../utils/domainTypes.js";
-import { readInjectedManagedDomainBinding } from "../../../utils/managedDomainContext.js";
+import { readInjectedManagedDomainBinding, readInjectedManagedDomainCoverage } from "../../../utils/managedDomainContext.js";
+import { computeListenerDefault404 } from "./ingressProfile.js";
 import { ResourceNaming } from "../../../utils/resourceNaming.js";
 import { stackScopedExportName } from "../../../utils/exportNaming.js";
 import { registerAlbAliasTarget } from "../../../utils/albAliasTargetRegistry.js";
@@ -99,24 +100,15 @@ export function addLoadBalancer(ctx, anyServiceUsesEc2, asgSecurityGroup) {
 }
 export function addLoadBalancerListener(ctx, loadBalancer, certificate, additionalCertificates) {
     const port = certificate ? 443 : 80;
-    const servicesWithPorts = ctx.props.services.filter((s) => s.containers.some((c) => c.port !== undefined));
-    const willHaveMultipleRoutes = servicesWithPorts.length > 1 ||
-        servicesWithPorts.some((s) => {
-            const rules = Array.isArray(s.routing)
-                ? s.routing
-                : s.routing
-                    ? [s.routing]
-                    : [];
-            return rules.length > 1;
-        });
-    // CDK rejects listeners with neither a default action nor target groups.
-    const noServicePorts = servicesWithPorts.length === 0;
     return addRoutingListener(loadBalancer, `${ctx.props.clusterName}Listener`, {
         port,
         ...(certificate && { certificate }),
         ...(additionalCertificates !== undefined &&
             additionalCertificates.length > 0 && { additionalCertificates }),
-        default404: willHaveMultipleRoutes || noServicePorts
+        // Single home for the default-action predicate (ingressProfile.ts): the
+        // ingress profile exports the same value, so downstream verdicts model
+        // the listener the emitter actually built (design cdn-app-origin, P5).
+        default404: computeListenerDefault404(ctx.props.services)
     });
 }
 /**
@@ -302,6 +294,10 @@ export function addHostedZone(ctx, loadBalancer) {
         }
     }
     const subjectAlternativeNames = [...routedHosts, ...redirectHosts].filter((h) => h !== domainName);
+    // Captured BEFORE the BYO override below: whether the managed lane
+    // attached the binding's (or export fallback's) certificate — the D5
+    // coverage context describes exactly that certificate, never a BYO one.
+    const managedCertificateAttached = certificate !== undefined;
     if (domainConfig?.certificate) {
         certificate = domainConfig.certificate;
     }
@@ -333,6 +329,62 @@ export function addHostedZone(ctx, loadBalancer) {
         }).certificate;
     }
     const additionalListenerCertificates = resolveAdditionalListenerCertificates(ctx.scope, props.clusterName, domainConfig?.additionalCertificates, managed);
+    // D5 certificate coverage (design 2026-08-18 cdn-app-origin): fold the SAN
+    // set of every certificate the listener will carry, where knowable at
+    // synth. The cluster-minted certificate's set is the literal minted above;
+    // managed certificates are described by the CLI-injected coverage context
+    // (absent → opaque, a domain stack predating the hosts outputs); BYO
+    // imports are opaque by nature. Fail-open to "partial"/"unknown", never to
+    // a false "covered" — consumers (the Cdn origin lane) error only on
+    // enumerated non-coverage and warn on opacity.
+    //
+    // Provenance gate: the coverage context describes the zone's CURRENT
+    // certificates — the same D2 resolution that produces an injected binding.
+    // An EXPLICIT `domainConfig.managedDomain` BINDING may pin an OLDER
+    // certificateArn (or usEast1CertificateArn) the current coverage does not
+    // describe, so folding it would over-claim and invert P3 (TLS fails at
+    // runtime after E6 passes the hostname as covered). Explicit bindings
+    // therefore stay opaque, exactly as if no coverage context existed. The
+    // explicit EXPORTS form is unaffected: Fn.importValue resolves at deploy
+    // to the zone's current certificate — the one the coverage describes.
+    const explicitPinnedBinding = domainConfig?.managedDomain !== undefined &&
+        isManagedDomainBinding(domainConfig.managedDomain);
+    const injectedCoverage = managed && !explicitPinnedBinding
+        ? readInjectedManagedDomainCoverage(ctx.scope.node, managed.zoneName, `Cluster '${props.clusterName}'`)
+        : undefined;
+    const knownCertificateHosts = [];
+    let anyOpaqueCertificate = false;
+    if (domainConfig?.certificate) {
+        anyOpaqueCertificate = true;
+    }
+    else if (managedCertificateAttached) {
+        if (injectedCoverage?.certificateHosts !== undefined) {
+            knownCertificateHosts.push(...injectedCoverage.certificateHosts);
+        }
+        else {
+            anyOpaqueCertificate = true;
+        }
+    }
+    else {
+        knownCertificateHosts.push(domainName, ...subjectAlternativeNames);
+    }
+    for (const source of domainConfig?.additionalCertificates ?? []) {
+        if ("certificateArn" in source) {
+            anyOpaqueCertificate = true;
+        }
+        else if (injectedCoverage?.usEast1CertificateHosts !== undefined) {
+            knownCertificateHosts.push(...injectedCoverage.usEast1CertificateHosts);
+        }
+        else {
+            anyOpaqueCertificate = true;
+        }
+    }
+    const dedupedCertificateHosts = [...new Set(knownCertificateHosts)];
+    const certificateCoverage = anyOpaqueCertificate
+        ? dedupedCertificateHosts.length > 0
+            ? { kind: "partial", hostnames: dedupedCertificateHosts }
+            : { kind: "unknown" }
+        : { kind: "enumerated", hostnames: dedupedCertificateHosts };
     let aRecord;
     if (loadBalancer) {
         const routingPolicy = domainConfig?.routingPolicy;
@@ -367,22 +419,28 @@ export function addHostedZone(ctx, loadBalancer) {
             ...(geoLocation !== undefined && { geoLocation }),
             ...(setIdentifier !== undefined && { setIdentifier })
         };
-        const apex = new AliasRecord(ctx.scope, `${props.clusterName}ARecord`, {
-            zone: hostedZone,
-            zoneName,
-            recordName: recordLabelWithin(domainName, zoneName),
-            target: new LoadBalancerTarget(loadBalancer, {
-                evaluateTargetHealth: hasRoutingPolicy
-            }),
-            // No-churn adoption: the pre-wrapper raw ARecord carried no comment, so
-            // adding one now would be a property delta on the live production apex
-            // record (flipless-retain-flip principle).
-            omitComment: true,
-            ...routingProps
-        });
-        // Preserve the pre-wrapper logical ID — see preWrapperLogicalId.
-        apex.record.node.defaultChild.overrideLogicalId(preWrapperLogicalId(ctx.scope, `${props.clusterName}ARecord`));
-        aRecord = apex.record;
+        // apexRecord: "none" yields ONLY the domainName record itself (an
+        // ingress-migrated name now owned by a CDN's domainConfig) — routed-host,
+        // redirect-host records, listener, and certificates below are untouched
+        // (design 2026-08-17 cdn-domain-ownership C2).
+        if (domainConfig?.apexRecord !== "none") {
+            const apex = new AliasRecord(ctx.scope, `${props.clusterName}ARecord`, {
+                zone: hostedZone,
+                zoneName,
+                recordName: recordLabelWithin(domainName, zoneName),
+                target: new LoadBalancerTarget(loadBalancer, {
+                    evaluateTargetHealth: hasRoutingPolicy
+                }),
+                // No-churn adoption: the pre-wrapper raw ARecord carried no comment,
+                // so adding one now would be a property delta on the live production
+                // apex record (flipless-retain-flip principle).
+                omitComment: true,
+                ...routingProps
+            });
+            // Preserve the pre-wrapper logical ID — see preWrapperLogicalId.
+            apex.record.node.defaultChild.overrideLogicalId(preWrapperLogicalId(ctx.scope, `${props.clusterName}ARecord`));
+            aRecord = apex.record;
+        }
         for (const host of routedHosts) {
             if (host === domainName)
                 continue;
@@ -424,7 +482,16 @@ export function addHostedZone(ctx, loadBalancer) {
         }),
         ...(redirectHosts.length > 0 && {
             redirectRules: { hostFqdns: redirectHosts, targetHost: domainName }
-        })
+        }),
+        ingress: {
+            hostedZone,
+            zoneName,
+            domainName,
+            routedHosts,
+            redirectHosts,
+            apexRecordMinted: loadBalancer !== undefined && domainConfig?.apexRecord !== "none",
+            certificateCoverage
+        }
     };
 }
 const US_EAST_1 = "us-east-1";

package/dist/lib/resources/aws/compute/ecsTypes.d.ts

@@ -260,6 +260,16 @@ export interface DomainBaseConfig {
      * Omit for a plain alias record.
      */
     routingPolicy?: EcsDomainRoutingPolicy;
+    /**
+     * The cluster's own DNS record for `domainName`. "alias" (default) mints
+     * the alias A record targeting the ALB — the long-standing behaviour.
+     * "none" keeps EVERYTHING else (certificates, HTTPS listener, redirect
+     * hosts and their records, host-routed service records) but yields the
+     * `domainName` record itself — the final state of an ingress migration
+     * where a CDN's `domainConfig` has taken the name over
+     * (design 2026-08-17 cdn-domain-ownership C2).
+     */
+    apexRecord?: "alias" | "none";
     /**
      * Hostnames (FQDNs within the zone, e.g. `"www.example.com"`) that
      * permanently redirect to `domainName` at the ALB. Each host gets an alias

package/dist/lib/resources/aws/compute/ingressProfile.d.ts

@@ -0,0 +1,174 @@
+/**
+ * Synth-time ingress profile for an ECS cluster's ALB (design 2026-08-18
+ * cdn-app-origin, D2). The profile is the one sanctioned answer to "what
+ * does this cluster's listener actually do?" for downstream constructs —
+ * today the `Cdn` construct-reference origin lane, which needs a TLS-valid
+ * origin hostname, certificate coverage, and a forwarding verdict without
+ * re-deriving any of it from props.
+ *
+ * P5 (model the machinery, don't paraphrase it): every fact here is exported
+ * from the SAME computation the emitting code uses — `default404` is the
+ * predicate `addLoadBalancerListener` passes to the listener factory, the
+ * rule structure mirrors `registerServiceWithALB`'s exact branching
+ * (including the single-service conditions-dropped branch), and the covered
+ * SAN set is the one `addHostedZone` mints. Never recompute these facts from
+ * cluster props elsewhere; extend the profile instead.
+ */
+import type { IApplicationLoadBalancer } from "aws-cdk-lib/aws-elasticloadbalancingv2";
+import type { IHostedZone } from "aws-cdk-lib/aws-route53";
+import type { EcsServiceProps } from "./ecsTypes.js";
+/**
+ * What the certificates ATTACHED to the cluster's listener are known to
+ * cover at synth:
+ *
+ * - `enumerated` — every attached certificate's host set is synth-known
+ *   (cluster-minted certs, or managed certs described by the D5 coverage
+ *   context). `hostnames` is complete: a non-matching name is provably
+ *   uncovered.
+ * - `partial` — `hostnames` collects the known certs' hosts, but at least
+ *   one attached certificate is opaque (imported ARN with no coverage
+ *   context), so a non-matching name may still be covered.
+ * - `unknown` — only opaque certificates are attached.
+ */
+export type CertificateCoverage = {
+    kind: "enumerated";
+    hostnames: string[];
+} | {
+    kind: "partial";
+    hostnames: string[];
+} | {
+    kind: "unknown";
+};
+export type CoverageAnswer = "covered" | "unknown" | "not-covered";
+/**
+ * One listener rule as it will actually be emitted. `host` and `path` are
+ * ANDed when both present (`buildRoutingConditions`). Rules the emitter
+ * DROPS — a single ports-bearing service with ≤1 routing rule loses its
+ * conditions and becomes the listener default (`registerServiceWithALB`) —
+ * are deliberately absent here, exactly as they are absent from the ALB.
+ */
+export interface EcsIngressRule {
+    host?: string;
+    path?: string;
+    kind: "forward" | "redirect";
+}
+export interface EcsIngressProfile {
+    loadBalancer: IApplicationLoadBalancer;
+    /** `cluster.loadBalancer === "internal"` — unreachable as a CloudFront origin. */
+    internal: boolean;
+    /** 443 iff a certificate resolved — the cluster ALB has exactly one listener. */
+    listenerPort: 443 | 80;
+    /**
+     * The cluster's resolved zone — the SAME `IHostedZone` instance the
+     * cluster's own records claim with, so a downstream record (the Cdn's
+     * origin record) claims under the identical zone identity. The DNS claim
+     * registry keys on the literal hosted-zone ID; a name-derived re-import
+     * would register under a different key and silently defeat same-name
+     * collision detection.
+     */
+    hostedZone?: IHostedZone;
+    zoneName?: string;
+    domainName?: string;
+    /** Every `services[].routing[].host`, deduped, in declaration order. */
+    routedHosts: string[];
+    redirectHosts: string[];
+    /**
+     * The listener's actual default-action predicate: `true` → fixed-404
+     * default; `false` → the sole target group IS the default action and the
+     * listener forwards EVERY hostname.
+     */
+    default404: boolean;
+    rules: EcsIngressRule[];
+    certificateCoverage: CertificateCoverage;
+}
+/**
+ * Zone-derived profile ingredients assembled by `addHostedZone`, where the
+ * zone, hosts, and certificate coverage are already computed for emission.
+ */
+export interface EcsIngressZoneFacts {
+    hostedZone: IHostedZone;
+    zoneName: string;
+    domainName: string;
+    routedHosts: string[];
+    redirectHosts: string[];
+    /** False when `apexRecord: "none"` yielded the domainName record. */
+    apexRecordMinted: boolean;
+    certificateCoverage: CertificateCoverage;
+}
+/**
+ * The listener's default-action predicate — the SINGLE home of the
+ * computation `addLoadBalancerListener` passes to the listener factory as
+ * `default404`. `true` when ≥2 routes will exist (the emitter then attaches
+ * a fixed-404 default and conditions every rule) or when no service has a
+ * port (CDK rejects a listener with neither a default action nor targets).
+ */
+export declare function computeListenerDefault404(services: EcsServiceProps[]): boolean;
+/**
+ * The listener's rule structure as `registerServiceWithALB` and
+ * `addRedirectHostRules` will emit it. Mirrors the emitters' branching
+ * exactly: a single ports-bearing service with ≤1 rule contributes NO
+ * conditioned rule (its target group is the listener default — even a
+ * declared `routing.host` does not gate it), and every redirect host
+ * contributes a host-matched 301 rule.
+ */
+export declare function enumerateListenerRules(services: EcsServiceProps[], redirectHosts: string[]): EcsIngressRule[];
+/** Lowercase and strip the trailing dot — DNS names are case-insensitive. */
+export declare function normaliseDnsName(name: string): string;
+/**
+ * RFC 6125 certificate-name match: exact, or a single-label `*.` wildcard
+ * (matches exactly one additional label — `*.example.com` covers
+ * `a.example.com`, never `example.com` or `a.b.example.com`). DNS names
+ * compare ASCII case-insensitively (RFC 6125 §6.4.1 via RFC 4343).
+ */
+export declare function certNameMatches(pattern: string, hostname: string): boolean;
+/**
+ * Does the listener's attached-certificate set cover `hostname`?
+ * Fail closed where decidable, honest where opaque (P3): only `enumerated`
+ * coverage may answer `not-covered`; a miss under `partial`/`unknown` is
+ * `unknown` because an opaque certificate may still cover the name.
+ */
+export declare function certificateCovers(coverage: CertificateCoverage, hostname: string): CoverageAnswer;
+export type ForwardingVerdict = {
+    verdict: "forwards";
+} | {
+    verdict: "partial";
+    patterns: string[];
+} | {
+    verdict: "none";
+};
+/**
+ * Would the listener forward `Host: <hostname>` requests, for all paths?
+ * Computed on the real rule model, never a flattened hostname list:
+ *
+ * - no fixed-404 default → the default action forwards every hostname;
+ * - a host-only rule for the hostname, a host-matched catch-all `/*` path
+ *   rule, or a host-less catch-all `/*` path rule, forwards all of its
+ *   paths;
+ * - rules that involve the hostname only together with a narrower path
+ *   condition (ANDed host+path, or host-less non-catch-all paths) forward
+ *   SOME paths — `partial`, with the patterns named so the caller can
+ *   surface them;
+ * - otherwise every request answers the fixed-404 default — `none`.
+ *
+ * Hostnames compare case-insensitively (DNS, RFC 4343) — the rule model
+ * carries the declared spelling, the caller's hostname may differ in case.
+ */
+export declare function forwardingVerdict(profile: EcsIngressProfile, hostname: string): ForwardingVerdict;
+export declare function buildIngressProfile(options: {
+    loadBalancer: IApplicationLoadBalancer;
+    internal: boolean;
+    services: EcsServiceProps[];
+    certificateAttached: boolean;
+    zoneFacts?: EcsIngressZoneFacts;
+}): EcsIngressProfile;
+/**
+ * W3 (design 2026-08-18 cdn-app-origin): a cluster whose listener default is
+ * fixed-404 while its `domainName` has a minted apex record and NO rule
+ * forwards it answers 404 on its own primary domain — usually the aftermath
+ * of adding a second routing rule (which flips the default action from
+ * forward to 404, `computeListenerDefault404`). A warning, not an error:
+ * pre-existing clusters can already be in this state, and narrowing them is
+ * not this check's mandate. Partial forwarding (path-split services) is the
+ * normal multi-route shape and does not warn.
+ */
+export declare function warnWhenRecordedApexUnforwarded(profile: EcsIngressProfile, apexRecordMinted: boolean, clusterName: string): void;

package/dist/lib/resources/aws/compute/ingressProfile.js

@@ -0,0 +1,195 @@
+/**
+ * Synth-time ingress profile for an ECS cluster's ALB (design 2026-08-18
+ * cdn-app-origin, D2). The profile is the one sanctioned answer to "what
+ * does this cluster's listener actually do?" for downstream constructs —
+ * today the `Cdn` construct-reference origin lane, which needs a TLS-valid
+ * origin hostname, certificate coverage, and a forwarding verdict without
+ * re-deriving any of it from props.
+ *
+ * P5 (model the machinery, don't paraphrase it): every fact here is exported
+ * from the SAME computation the emitting code uses — `default404` is the
+ * predicate `addLoadBalancerListener` passes to the listener factory, the
+ * rule structure mirrors `registerServiceWithALB`'s exact branching
+ * (including the single-service conditions-dropped branch), and the covered
+ * SAN set is the one `addHostedZone` mints. Never recompute these facts from
+ * cluster props elsewhere; extend the profile instead.
+ */
+import { FjallLogger } from "../../../utils/validationLogger.js";
+function normaliseRoutingRules(routing) {
+    return Array.isArray(routing) ? routing : routing ? [routing] : [];
+}
+function servicesWithPorts(services) {
+    return services.filter((s) => s.containers.some((c) => c.port !== undefined));
+}
+/**
+ * The listener's default-action predicate — the SINGLE home of the
+ * computation `addLoadBalancerListener` passes to the listener factory as
+ * `default404`. `true` when ≥2 routes will exist (the emitter then attaches
+ * a fixed-404 default and conditions every rule) or when no service has a
+ * port (CDK rejects a listener with neither a default action nor targets).
+ */
+export function computeListenerDefault404(services) {
+    const withPorts = servicesWithPorts(services);
+    const willHaveMultipleRoutes = withPorts.length > 1 ||
+        withPorts.some((s) => normaliseRoutingRules(s.routing).length > 1);
+    return willHaveMultipleRoutes || withPorts.length === 0;
+}
+/**
+ * The listener's rule structure as `registerServiceWithALB` and
+ * `addRedirectHostRules` will emit it. Mirrors the emitters' branching
+ * exactly: a single ports-bearing service with ≤1 rule contributes NO
+ * conditioned rule (its target group is the listener default — even a
+ * declared `routing.host` does not gate it), and every redirect host
+ * contributes a host-matched 301 rule.
+ */
+export function enumerateListenerRules(services, redirectHosts) {
+    const withPorts = servicesWithPorts(services);
+    const isSingleService = withPorts.length === 1;
+    const rules = [];
+    for (const service of withPorts) {
+        const routingRules = normaliseRoutingRules(service.routing);
+        if (isSingleService && routingRules.length <= 1)
+            continue;
+        for (const rule of routingRules) {
+            if (rule.host === undefined && rule.path === undefined)
+                continue;
+            rules.push({
+                ...(rule.host !== undefined && { host: rule.host }),
+                ...(rule.path !== undefined && { path: rule.path }),
+                kind: "forward"
+            });
+        }
+    }
+    for (const host of redirectHosts) {
+        rules.push({ host, kind: "redirect" });
+    }
+    return rules;
+}
+/** Lowercase and strip the trailing dot — DNS names are case-insensitive. */
+export function normaliseDnsName(name) {
+    return name.toLowerCase().replace(/\.$/, "");
+}
+/**
+ * RFC 6125 certificate-name match: exact, or a single-label `*.` wildcard
+ * (matches exactly one additional label — `*.example.com` covers
+ * `a.example.com`, never `example.com` or `a.b.example.com`). DNS names
+ * compare ASCII case-insensitively (RFC 6125 §6.4.1 via RFC 4343).
+ */
+export function certNameMatches(pattern, hostname) {
+    const p = pattern.toLowerCase();
+    const h = hostname.toLowerCase();
+    if (p === h)
+        return true;
+    if (!p.startsWith("*."))
+        return false;
+    const suffix = p.slice(1); // ".example.com"
+    if (!h.endsWith(suffix))
+        return false;
+    const label = h.slice(0, h.length - suffix.length);
+    return label.length > 0 && !label.includes(".");
+}
+/**
+ * Does the listener's attached-certificate set cover `hostname`?
+ * Fail closed where decidable, honest where opaque (P3): only `enumerated`
+ * coverage may answer `not-covered`; a miss under `partial`/`unknown` is
+ * `unknown` because an opaque certificate may still cover the name.
+ */
+export function certificateCovers(coverage, hostname) {
+    if (coverage.kind === "unknown")
+        return "unknown";
+    if (coverage.hostnames.some((p) => certNameMatches(p, hostname))) {
+        return "covered";
+    }
+    return coverage.kind === "enumerated" ? "not-covered" : "unknown";
+}
+/**
+ * Would the listener forward `Host: <hostname>` requests, for all paths?
+ * Computed on the real rule model, never a flattened hostname list:
+ *
+ * - no fixed-404 default → the default action forwards every hostname;
+ * - a host-only rule for the hostname, a host-matched catch-all `/*` path
+ *   rule, or a host-less catch-all `/*` path rule, forwards all of its
+ *   paths;
+ * - rules that involve the hostname only together with a narrower path
+ *   condition (ANDed host+path, or host-less non-catch-all paths) forward
+ *   SOME paths — `partial`, with the patterns named so the caller can
+ *   surface them;
+ * - otherwise every request answers the fixed-404 default — `none`.
+ *
+ * Hostnames compare case-insensitively (DNS, RFC 4343) — the rule model
+ * carries the declared spelling, the caller's hostname may differ in case.
+ */
+export function forwardingVerdict(profile, hostname) {
+    if (!profile.default404)
+        return { verdict: "forwards" };
+    const wanted = normaliseDnsName(hostname);
+    const partial = [];
+    for (const rule of profile.rules) {
+        if (rule.kind !== "forward")
+            continue;
+        const hostMatches = rule.host !== undefined && normaliseDnsName(rule.host) === wanted;
+        if (hostMatches && (rule.path === undefined || rule.path === "/*")) {
+            return { verdict: "forwards" };
+        }
+        if (rule.host === undefined && rule.path === "/*") {
+            return { verdict: "forwards" };
+        }
+        if (hostMatches && rule.path !== undefined) {
+            partial.push(`Host=${rule.host} AND Path=${rule.path}`);
+        }
+        else if (rule.host === undefined && rule.path !== undefined) {
+            partial.push(`Path=${rule.path} (any host)`);
+        }
+    }
+    return partial.length > 0
+        ? { verdict: "partial", patterns: partial }
+        : { verdict: "none" };
+}
+export function buildIngressProfile(options) {
+    const { zoneFacts } = options;
+    const redirectHosts = zoneFacts?.redirectHosts ?? [];
+    return {
+        loadBalancer: options.loadBalancer,
+        internal: options.internal,
+        listenerPort: options.certificateAttached ? 443 : 80,
+        ...(zoneFacts !== undefined && {
+            hostedZone: zoneFacts.hostedZone,
+            zoneName: zoneFacts.zoneName,
+            domainName: zoneFacts.domainName
+        }),
+        routedHosts: zoneFacts?.routedHosts ?? [],
+        redirectHosts,
+        default404: computeListenerDefault404(options.services),
+        rules: enumerateListenerRules(options.services, redirectHosts),
+        certificateCoverage: zoneFacts?.certificateCoverage ?? {
+            // No domain → no certificates attached: the attached set is fully
+            // known (empty), which is the honest enumerated answer, not "unknown".
+            kind: "enumerated",
+            hostnames: []
+        }
+    };
+}
+/**
+ * W3 (design 2026-08-18 cdn-app-origin): a cluster whose listener default is
+ * fixed-404 while its `domainName` has a minted apex record and NO rule
+ * forwards it answers 404 on its own primary domain — usually the aftermath
+ * of adding a second routing rule (which flips the default action from
+ * forward to 404, `computeListenerDefault404`). A warning, not an error:
+ * pre-existing clusters can already be in this state, and narrowing them is
+ * not this check's mandate. Partial forwarding (path-split services) is the
+ * normal multi-route shape and does not warn.
+ */
+export function warnWhenRecordedApexUnforwarded(profile, apexRecordMinted, clusterName) {
+    if (!profile.default404)
+        return;
+    if (profile.domainName === undefined || !apexRecordMinted)
+        return;
+    if (forwardingVerdict(profile, profile.domainName).verdict !== "none")
+        return;
+    FjallLogger.warn(`Cluster '${clusterName}': the listener's default action is a fixed 404 ` +
+        `and no routing rule forwards '${profile.domainName}', but its alias ` +
+        "record is minted — requests to the cluster's own domain will answer " +
+        "404 Not Found. Multiple routing rules flip the listener default from " +
+        "forward to 404; keep a forwarding path for the domain, e.g. a " +
+        'routing rule { path: "/*" } on the service that should serve it.');
+}

package/dist/lib/resources/aws/networking/dnsRecord/aliasRecord.js

@@ -11,8 +11,35 @@ export class AliasRecord extends Construct {
         this.description =
             props.description ?? defaultDnsComment("alias", this.fqdn);
         // An alias record IS an A record set in Route53 — it claims type "A" so
-        // an alias and a plain A record on the same name collide at synth.
-        claimDnsRecord(this, props, "A", this.fqdn);
+        // an alias and a plain A record on the same name collide at synth. The
+        // routing variant rides along: policy siblings with distinct
+        // setIdentifiers (e.g. a compute apex alias and a CDN apex alias during
+        // an ingress migration) are legal and register cleanly.
+        const routingPolicy = props.region !== undefined
+            ? "latency"
+            : props.weight !== undefined
+                ? "weighted"
+                : props.geoLocation !== undefined
+                    ? "geolocation"
+                    : undefined;
+        // Route53 allows one geolocation record per location VALUE — serialise
+        // the location so the registry can compare siblings ("*" = the default
+        // wildcard record, which is equally one-per-(name, type)).
+        const geoLocationKey = props.geoLocation !== undefined
+            ? [
+                props.geoLocation.continentCode,
+                props.geoLocation.countryCode,
+                props.geoLocation.subdivisionCode
+            ]
+                .filter((part) => part !== undefined)
+                .join("/") || "*"
+            : undefined;
+        claimDnsRecord(this, props, "A", this.fqdn, {
+            setIdentifier: props.setIdentifier,
+            routingPolicy,
+            region: props.region,
+            ...(geoLocationKey !== undefined && { geoLocationKey })
+        });
         // Route53 ignores TTL on ALIAS records — the target dictates caching behaviour,
         // so we deliberately do not forward props.ttl to the underlying CDK resource.
         this.record = new CdkARecord(this, "Record", {

package/dist/lib/resources/aws/networking/dnsRecord/dnsRecordBase.d.ts

@@ -14,13 +14,27 @@ export interface DnsRecordCommonProps {
 export declare const DEFAULT_DNS_TTL_SECONDS = 300;
 export declare function resolveTtl(ttlSeconds: number | undefined): Duration;
 export declare function defaultDnsComment(recordType: string, fqdn: string): string;
+/**
+ * Routing-variant half of a claim — filled in by wrappers whose records can
+ * carry a routing policy (today: AliasRecord). Sibling variants with the
+ * same policy type and distinct setIdentifiers legally share a (zone, name,
+ * type) triple; the registry encodes Route53's coexistence rules.
+ */
+export interface DnsRecordClaimVariant {
+    readonly setIdentifier?: string;
+    readonly routingPolicy?: "latency" | "weighted" | "geolocation";
+    readonly region?: string;
+    /** Serialised geolocation value (continent/country/subdivision). */
+    readonly geoLocationKey?: string;
+}
 /**
  * Claim the (zone, name, type) triple in the app-scoped collision registry
  * (design D5, synth-side). Every wrapper in the dnsRecord family calls this
- * from its constructor so a second claimant — same stack or another stack in
- * the app — fails at synth instead of at CloudFormation deploy. Alias records
- * claim their underlying Route53 type ("A"). Observation only: no constructs
- * are created, so construct trees stay byte-identical.
+ * from its constructor so an illegal second claimant — same stack or another
+ * stack in the app — fails at synth instead of at CloudFormation deploy.
+ * Alias records claim their underlying Route53 type ("A") and pass their
+ * routing variant so legal policy siblings register cleanly. Observation
+ * only: no constructs are created, so construct trees stay byte-identical.
  */
-export declare function claimDnsRecord(construct: Construct, props: Pick<DnsRecordCommonProps, "zone" | "zoneName">, recordType: string, fqdn: string): void;
+export declare function claimDnsRecord(construct: Construct, props: Pick<DnsRecordCommonProps, "zone" | "zoneName">, recordType: string, fqdn: string, variant?: DnsRecordClaimVariant): void;
 export declare function applyDnsRecordTags(construct: Construct, props: Pick<DnsRecordCommonProps, "zoneName" | "costAllocationEnvironment" | "costAllocationDomain">): void;