@fjall/components-infrastructure 14.0.0 → 14.2.0

package/dist/lib/resources/aws/networking/dnsRecord/dnsRecordBase.js

@@ -15,17 +15,28 @@ export function defaultDnsComment(recordType, fqdn) {
 /**
  * Claim the (zone, name, type) triple in the app-scoped collision registry
  * (design D5, synth-side). Every wrapper in the dnsRecord family calls this
- * from its constructor so a second claimant — same stack or another stack in
- * the app — fails at synth instead of at CloudFormation deploy. Alias records
- * claim their underlying Route53 type ("A"). Observation only: no constructs
- * are created, so construct trees stay byte-identical.
+ * from its constructor so an illegal second claimant — same stack or another
+ * stack in the app — fails at synth instead of at CloudFormation deploy.
+ * Alias records claim their underlying Route53 type ("A") and pass their
+ * routing variant so legal policy siblings register cleanly. Observation
+ * only: no constructs are created, so construct trees stay byte-identical.
  */
-export function claimDnsRecord(construct, props, recordType, fqdn) {
+export function claimDnsRecord(construct, props, recordType, fqdn, variant) {
     registerDnsRecordClaim(construct, {
         zone: props.zone,
         zoneName: props.zoneName,
         fqdn,
-        recordType
+        recordType,
+        ...(variant?.setIdentifier !== undefined && {
+            setIdentifier: variant.setIdentifier
+        }),
+        ...(variant?.routingPolicy !== undefined && {
+            routingPolicy: variant.routingPolicy
+        }),
+        ...(variant?.region !== undefined && { region: variant.region }),
+        ...(variant?.geoLocationKey !== undefined && {
+            geoLocationKey: variant.geoLocationKey
+        })
     });
 }
 export function applyDnsRecordTags(construct, props) {

package/dist/lib/utils/dnsRecordRegistry.d.ts

@@ -2,13 +2,23 @@ import type { IHostedZone } from "aws-cdk-lib/aws-route53";
 import type { IConstruct } from "constructs";
 /**
  * Synth-time DNS record-collision registry (design D5, synth-side half — the
- * deploy-time preflight against live zones is Phase 2).
+ * deploy-time preflight against live zones is the CLI/deploy-core domain
+ * gate).
  *
- * Route53 allows exactly one record set per (zone, name, type); a second
- * claimant today fails only at CloudFormation deploy with a raw "record set
- * already exists". This registry makes the collision loud at synth: every
- * construct in the dnsRecord wrapper family registers its claim here, and a
- * duplicate claim throws naming both claimant construct paths and the cure.
+ * Route53 allows exactly one record set per (zone, name, type) — EXCEPT for
+ * routing-policy variants, where sibling record sets share the (name, type)
+ * pair and are discriminated by `setIdentifier`. Sibling variants must all
+ * carry the same policy type, and latency variants must each use a distinct
+ * region. A shape Route53 rejects fails only at CloudFormation deploy with a
+ * raw "record set already exists" / "conflicting RRSet"; this registry makes
+ * it loud at synth: every construct in the dnsRecord wrapper family registers
+ * its claim here, and an illegal combination throws naming both claimant
+ * construct paths and the cure.
+ *
+ * Legal coexistence (design 2026-08-17 cdn-domain-ownership C3): two claims
+ * on one (zone, name, type) with the SAME routing-policy type and DISTINCT
+ * `setIdentifier`s — e.g. the compute cluster's latency apex alias and a
+ * CDN's latency apex alias during an ingress migration — register cleanly.
  *
  * Scoping: claims are held per App (the construct-tree root), so multiple CDK
  * Apps in one process — the vitest convention of a fresh `new CdkApp()` per
@@ -22,6 +32,7 @@ import type { IConstruct } from "constructs";
  * (resetForTesting + resetManifestCollector in beforeEach/afterEach) keeps
  * working without a third per-test call.
  */
+export type DnsRoutingPolicyType = "latency" | "weighted" | "geolocation";
 export interface DnsRecordClaim {
     /** Zone the record lands in — consulted for identity resolution. */
     readonly zone: IHostedZone;
@@ -34,14 +45,34 @@ export interface DnsRecordClaim {
      * — an alias and a plain A record on the same name are a real collision.
      */
     readonly recordType: string;
+    /**
+     * Routing-variant discriminator. A claim is a policy variant when it
+     * carries a `routingPolicy` OR a `setIdentifier` (CDK auto-generates a
+     * SetIdentifier for a policy record declared without one, so policy
+     * presence alone makes a legal variant); a claim with neither is a simple
+     * record that tolerates no siblings.
+     */
+    readonly setIdentifier?: string;
+    /** Policy type of a variant claim — siblings must all match. */
+    readonly routingPolicy?: DnsRoutingPolicyType;
+    /**
+     * Latency region of a latency variant — Route53 allows one latency record
+     * per region per (name, type).
+     */
+    readonly region?: string;
+    /**
+     * Serialised location of a geolocation variant — Route53 allows one
+     * geolocation record per location value per (name, type).
+     */
+    readonly geoLocationKey?: string;
 }
 /**
  * Register a record-set claim for `scope`, throwing when a DIFFERENT
- * construct already claimed the same (zoneIdentity, recordName, recordType)
- * triple within the same App. Re-registration by the same construct path
- * (CDK aspects re-visiting, repeated synth) is idempotent. Pure observation:
- * no constructs are created or mutated, so construct trees — including the
- * eject-contract byte-identical composer IDs — are untouched.
+ * construct already claimed a shape Route53 cannot hold alongside it within
+ * the same App. Re-registration by the same construct path (CDK aspects
+ * re-visiting, repeated synth) is idempotent. Pure observation: no constructs
+ * are created or mutated, so construct trees — including the eject-contract
+ * byte-identical composer IDs — are untouched.
  */
 export declare function registerDnsRecordClaim(scope: IConstruct, claim: DnsRecordClaim): void;
 /**

package/dist/lib/utils/dnsRecordRegistry.js

@@ -1,5 +1,17 @@
 import { Token } from "aws-cdk-lib";
-/** Claims per App root: claim key → owning construct path. */
+/**
+ * A claim is a policy variant when it declares a routing policy OR carries a
+ * setIdentifier: CDK's RecordSet auto-generates a SetIdentifier whenever a
+ * policy (region/weight/geoLocation) is set without one, so a policy claim
+ * with no explicit setIdentifier still deploys as a legal sibling variant —
+ * classifying it as simple would refuse shapes Route53 holds happily.
+ * (A setIdentifier WITHOUT a policy cannot deploy — CDK rejects it at synth —
+ * so its classification here never decides a real outcome.)
+ */
+function isVariantEntry(entry) {
+    return entry.routingPolicy !== undefined || entry.setIdentifier !== undefined;
+}
+/** Claims per App root: claim key → claimant entries (variants share a key). */
 let claimsByRoot = new WeakMap();
 /** Lowercase and strip the trailing dot — DNS names are case-insensitive. */
 function normaliseDnsName(name) {
@@ -18,13 +30,20 @@ function resolveZoneIdentity(zone, zoneName) {
     }
     return normaliseDnsName(zoneName);
 }
+function collisionError(claim, recordType, existing, claimantPath, detail) {
+    return new Error(`DNS record '${claim.fqdn}' (${recordType}) in zone '${claim.zoneName}': ` +
+        `already claimed by construct '${existing.path}' — duplicate claim by '${claimantPath}'. ` +
+        `${detail} ` +
+        `Keep one owner per record — satellites own their app records; the domain stack owns zone-level records. ` +
+        `Remove or rename one claimant, or run 'fjall domain records list ${claim.zoneName}' to inspect the zone.`);
+}
 /**
  * Register a record-set claim for `scope`, throwing when a DIFFERENT
- * construct already claimed the same (zoneIdentity, recordName, recordType)
- * triple within the same App. Re-registration by the same construct path
- * (CDK aspects re-visiting, repeated synth) is idempotent. Pure observation:
- * no constructs are created or mutated, so construct trees — including the
- * eject-contract byte-identical composer IDs — are untouched.
+ * construct already claimed a shape Route53 cannot hold alongside it within
+ * the same App. Re-registration by the same construct path (CDK aspects
+ * re-visiting, repeated synth) is idempotent. Pure observation: no constructs
+ * are created or mutated, so construct trees — including the eject-contract
+ * byte-identical composer IDs — are untouched.
  */
 export function registerDnsRecordClaim(scope, claim) {
     const root = scope.node.root;
@@ -40,19 +59,54 @@ export function registerDnsRecordClaim(scope, claim) {
         recordType
     ].join("|");
     const claimantPath = scope.node.path;
+    const entry = {
+        path: claimantPath,
+        setIdentifier: claim.setIdentifier,
+        routingPolicy: claim.routingPolicy,
+        region: claim.region,
+        geoLocationKey: claim.geoLocationKey
+    };
     const existing = claims.get(key);
     if (existing === undefined) {
-        claims.set(key, claimantPath);
+        claims.set(key, [entry]);
         return;
     }
-    if (existing === claimantPath) {
-        return;
+    for (const other of existing) {
+        if (other.path === claimantPath) {
+            return;
+        }
+        const bothVariants = isVariantEntry(other) && isVariantEntry(entry);
+        if (!bothVariants) {
+            // Simple vs simple, or simple vs variant — Route53 holds neither.
+            const detail = isVariantEntry(other) || isVariantEntry(entry)
+                ? "Route53 cannot mix a simple record set with routing-policy variants on one (zone, name, type) — give BOTH records the same routing-policy type with distinct setIdentifiers, or remove one."
+                : "Route53 allows one record set per (zone, name, type); CloudFormation would reject this at deploy.";
+            throw collisionError(claim, recordType, other, claimantPath, detail);
+        }
+        if (other.setIdentifier !== undefined &&
+            other.setIdentifier === entry.setIdentifier) {
+            throw collisionError(claim, recordType, other, claimantPath, `Both records carry setIdentifier '${String(entry.setIdentifier)}' — sibling routing-policy variants need distinct setIdentifiers.`);
+        }
+        // Policy types compare only when both are declared: a setIdentifier-only
+        // claim carries no policy for Route53 to mismatch (and cannot deploy —
+        // CDK rejects setIdentifier on simple records at synth).
+        if (other.routingPolicy !== undefined &&
+            entry.routingPolicy !== undefined &&
+            other.routingPolicy !== entry.routingPolicy) {
+            throw collisionError(claim, recordType, other, claimantPath, `Sibling routing-policy variants must share one policy type (got '${String(other.routingPolicy)}' vs '${String(entry.routingPolicy)}') — Route53 rejects mixed-policy siblings.`);
+        }
+        if (entry.routingPolicy === "latency" &&
+            other.region !== undefined &&
+            other.region === entry.region) {
+            throw collisionError(claim, recordType, other, claimantPath, `Both latency variants use region '${entry.region}' — Route53 allows one latency record per region; give the second variant a different region.`);
+        }
+        if (entry.routingPolicy === "geolocation" &&
+            other.geoLocationKey !== undefined &&
+            other.geoLocationKey === entry.geoLocationKey) {
+            throw collisionError(claim, recordType, other, claimantPath, `Both geolocation variants target location '${entry.geoLocationKey}' — Route53 allows one geolocation record per location value; give the second variant a different location.`);
+        }
     }
-    throw new Error(`DNS record '${claim.fqdn}' (${recordType}) in zone '${claim.zoneName}': ` +
-        `already claimed by construct '${existing}' — duplicate claim by '${claimantPath}'. ` +
-        `Route53 allows one record set per (zone, name, type); CloudFormation would reject this at deploy. ` +
-        `Keep one owner per record — satellites own their app records; the domain stack owns zone-level records. ` +
-        `Remove or rename one claimant, or run 'fjall domain records list ${claim.zoneName}' to inspect the zone.`);
+    existing.push(entry);
 }
 /**
  * Reset all claims (for testing). Called by `App.resetForTesting()` alongside

package/dist/lib/utils/managedDomainContext.d.ts

@@ -20,9 +20,18 @@
  * layer (generator-standards § Infrastructure Layer Boundaries).
  */
 import type { Node } from "constructs";
-import type { ManagedDomainBinding } from "@fjall/util";
+import type { ManagedDomainBinding, ManagedDomainCoverage } from "@fjall/util";
 export declare const MANAGED_DOMAIN_CONTEXT_PREFIX: "fjall:managedDomain:";
 export declare function getManagedDomainContextKey(zoneName: string): string;
+/**
+ * Companion channel to the binding (design 2026-08-18 cdn-app-origin, D5):
+ * the hostnames covered by exactly the certificates the same zone's binding
+ * names. A SEPARATE key on purpose — the binding parser above fails closed
+ * on unknown fields, so coverage could never ride the binding JSON without
+ * breaking older engines fed by a newer CLI.
+ */
+export declare const MANAGED_DOMAIN_COVERAGE_CONTEXT_PREFIX: "fjall:managedDomainCoverage:";
+export declare function getManagedDomainCoverageContextKey(zoneName: string): string;
 /**
  * Read the CLI-injected {@link ManagedDomainBinding} for `domainName`,
  * walking exact → parent zones (mirroring the CLI's
@@ -35,3 +44,19 @@ export declare function getManagedDomainContextKey(zoneName: string): string;
  * `context` prefixes every error, e.g. `Static site 'marketing'`.
  */
 export declare function readInjectedManagedDomainBinding(node: Node, domainName: string, context: string): ManagedDomainBinding | undefined;
+/**
+ * Read the CLI-injected {@link ManagedDomainCoverage} for the zone a binding
+ * already resolved to. Exact-key lookup on purpose (no parent-zone walk):
+ * the CLI injects coverage for precisely the zones it injects bindings for,
+ * and the caller passes the binding's own `zoneName`.
+ *
+ * Absent → undefined (a domain stack that predates the hosts outputs, or a
+ * bare-CDK synth) — consumers treat that as coverage-unknown and warn, never
+ * as not-covered. A present-but-corrupt value still throws (repo posture:
+ * corrupt context fails the synth rather than falling through), but UNKNOWN
+ * FIELDS ARE IGNORED, unlike the binding parser: coverage is advisory
+ * validation input, and forward tolerance here is what lets a future CLI add
+ * coverage fields without breaking older engines — the exact trap that
+ * forced this channel off the binding JSON in the first place.
+ */
+export declare function readInjectedManagedDomainCoverage(node: Node, zoneName: string, context: string): ManagedDomainCoverage | undefined;

package/dist/lib/utils/managedDomainContext.js

@@ -23,6 +23,17 @@ export const MANAGED_DOMAIN_CONTEXT_PREFIX = "fjall:managedDomain:";
 export function getManagedDomainContextKey(zoneName) {
     return `${MANAGED_DOMAIN_CONTEXT_PREFIX}${zoneName}`;
 }
+/**
+ * Companion channel to the binding (design 2026-08-18 cdn-app-origin, D5):
+ * the hostnames covered by exactly the certificates the same zone's binding
+ * names. A SEPARATE key on purpose — the binding parser above fails closed
+ * on unknown fields, so coverage could never ride the binding JSON without
+ * breaking older engines fed by a newer CLI.
+ */
+export const MANAGED_DOMAIN_COVERAGE_CONTEXT_PREFIX = "fjall:managedDomainCoverage:";
+export function getManagedDomainCoverageContextKey(zoneName) {
+    return `${MANAGED_DOMAIN_COVERAGE_CONTEXT_PREFIX}${zoneName}`;
+}
 const REQUIRED_STRING_FIELDS = ["zoneName", "hostedZoneId"];
 const OPTIONAL_STRING_FIELDS = [
     "certificateArn",
@@ -56,6 +67,64 @@ export function readInjectedManagedDomainBinding(node, domainName, context) {
     }
     return undefined;
 }
+/**
+ * Read the CLI-injected {@link ManagedDomainCoverage} for the zone a binding
+ * already resolved to. Exact-key lookup on purpose (no parent-zone walk):
+ * the CLI injects coverage for precisely the zones it injects bindings for,
+ * and the caller passes the binding's own `zoneName`.
+ *
+ * Absent → undefined (a domain stack that predates the hosts outputs, or a
+ * bare-CDK synth) — consumers treat that as coverage-unknown and warn, never
+ * as not-covered. A present-but-corrupt value still throws (repo posture:
+ * corrupt context fails the synth rather than falling through), but UNKNOWN
+ * FIELDS ARE IGNORED, unlike the binding parser: coverage is advisory
+ * validation input, and forward tolerance here is what lets a future CLI add
+ * coverage fields without breaking older engines — the exact trap that
+ * forced this channel off the binding JSON in the first place.
+ */
+export function readInjectedManagedDomainCoverage(node, zoneName, context) {
+    const key = getManagedDomainCoverageContextKey(zoneName);
+    const raw = node.tryGetContext(key);
+    if (raw === undefined)
+        return undefined;
+    let value = raw;
+    if (typeof raw === "string") {
+        try {
+            value = JSON.parse(raw);
+        }
+        catch {
+            throw new Error(`${context}: CDK context '${key}' is not valid JSON (got '${raw}'). ` +
+                "The value must be a JSON ManagedDomainCoverage " +
+                "({ certificateHosts?, usEast1CertificateHosts? }) — re-run the " +
+                "deploy through the Fjall CLI, or correct the hand-set context " +
+                "entry.");
+        }
+    }
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        throw new Error(`${context}: CDK context '${key}' must be a JSON object ` +
+            `ManagedDomainCoverage (got ${JSON.stringify(value)}). Re-run the ` +
+            "deploy through the Fjall CLI, or correct the hand-set context entry.");
+    }
+    const record = value;
+    const coverage = {};
+    for (const field of [
+        "certificateHosts",
+        "usEast1CertificateHosts"
+    ]) {
+        const fieldValue = record[field];
+        if (fieldValue === undefined)
+            continue;
+        if (!Array.isArray(fieldValue) ||
+            fieldValue.some((h) => typeof h !== "string" || h === "")) {
+            throw new Error(`${context}: CDK context '${key}' field '${field}' must be an array ` +
+                `of non-empty strings when present (got ` +
+                `${JSON.stringify(fieldValue)}). Re-run the deploy through the ` +
+                "Fjall CLI, or correct the hand-set context entry.");
+        }
+        coverage[field] = fieldValue;
+    }
+    return coverage;
+}
 function parseManagedDomainBinding(raw, zoneName, key, context) {
     let value = raw;
     if (typeof raw === "string") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/components-infrastructure",
-  "version": "14.0.0",
+  "version": "14.2.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/fjall-tech/fjall.git",
@@ -80,8 +80,8 @@
   },
   "dependencies": {
     "@aws-sdk/client-organizations": "^3.1098.0",
-    "@fjall/generator": "^14.0.0",
-    "@fjall/util": "^14.0.0",
+    "@fjall/generator": "^14.2.0",
+    "@fjall/util": "^14.2.0",
     "constructs": "^10.7.2"
   },
   "overrides": {