@fjall/components-infrastructure 14.1.0 → 14.2.0

package/dist/lib/patterns/aws/cdn.d.ts

@@ -130,11 +130,36 @@ export interface HttpCdnProps extends BaseCdnProps {
     protocolPolicy?: "HTTP_ONLY" | "HTTPS_ONLY" | "MATCH_VIEWER";
 }
 /**
- * Smart origin CDN props - auto-detect origin type from Fjall resource
+ * Smart origin CDN props - auto-detect origin type from Fjall resource.
+ *
+ * ECS compute origins (design 2026-08-18 cdn-app-origin, D3) resolve a
+ * TLS-valid ORIGIN HOSTNAME from the compute's own ingress profile instead
+ * of the raw ELB hostname (which no ACM certificate ever covers): a routing
+ * host when the compute declares exactly one, else `origin.<domain>`,
+ * derived. Certificate coverage and listener forwarding are validated at
+ * synth; when the Cdn owns the hostname it mints the alias record in this
+ * stack, record-before-distribution ordered.
  */
 export interface SmartCdnProps extends BaseCdnProps {
     originType: "auto";
     origin: Storage | AnyCompute | string;
+    /**
+     * Origin hostname override for the DEFAULT origin's ECS compute (a
+     * behaviour's ECS origin takes the same override on the behaviour
+     * entry). A literal hostname: a compute-declared routing host (the
+     * compute keeps owning its record), or a free name inside the cluster's
+     * zone (the Cdn mints its record). Refused for `redirectHosts` entries —
+     * they 301, never serve. Default: auto-resolution (sole routing host,
+     * else `origin.<domain>`).
+     */
+    originHostname?: string;
+    /**
+     * Whether the Cdn mints the origin alias record when it owns the DEFAULT
+     * origin's hostname (behaviour entries carry their own). "none" = the
+     * record is managed elsewhere (BYO or a migration state). Refused when
+     * the hostname is a routing host — the compute owns that record (P1).
+     */
+    originRecord?: "alias" | "none";
 }
 export type ICdnProps = S3CdnProps | AlbCdnProps | HttpCdnProps | SmartCdnProps;
 /**
@@ -146,12 +171,41 @@ export interface SmartCdnBehaviour {
     origin: Storage | AnyCompute | string;
     cachePolicy?: CachePolicyPreset | ICachePolicy;
     allowedMethods?: "GET_HEAD" | "GET_HEAD_OPTIONS" | "ALL";
+    /**
+     * Origin hostname override for THIS behaviour's ECS compute origin — the
+     * behaviour-level counterpart of the distribution's `originHostname`
+     * (same semantics; see {@link SmartCdnProps.originHostname}). Overrides
+     * bind per compute: two entries naming the same compute must agree.
+     */
+    originHostname?: string;
+    /**
+     * Record-minting override for THIS behaviour's ECS compute origin — the
+     * behaviour-level counterpart of {@link SmartCdnProps.originRecord}.
+     */
+    originRecord?: "alias" | "none";
 }
 /**
  * CDN wrapper class that extends CloudFrontDistribution with Fjall patterns.
  */
 export declare class Cdn extends CloudFrontDistribution implements ICdn {
     constructor(scope: Construct, id: string, props: ICdnProps);
+    private static createEcsOriginResolver;
+    /**
+     * Assemble the per-compute `originHostname`/`originRecord` overrides the
+     * resolver binds by compute identity: the distribution-level props apply
+     * to the DEFAULT origin's compute, each behaviour's own overrides apply
+     * to that behaviour's compute. Two entries naming the same compute must
+     * agree — one alias record cannot carry two spellings.
+     */
+    private static collectEcsOriginOverrides;
+    /**
+     * Mint the Cdn-owned origin alias records (P1) after the distribution
+     * exists, using the compute profile's own zone instance so the DNS claim
+     * registry sees the same zone identity as the cluster's records. The
+     * distribution depends on each record: the hostname must resolve before a
+     * distribution update referencing it propagates.
+     */
+    private createOriginRecords;
     /**
      * Resolve a `domainConfig` through the shared pattern-domain helpers
      * (design C1): zone identity via `resolvePatternZone` (explicit

package/dist/lib/patterns/aws/cdn.js

@@ -1,27 +1,30 @@
 import { Fn, Token } from "aws-cdk-lib";
 import { Certificate } from "aws-cdk-lib/aws-certificatemanager";
-import { CloudFrontTarget } from "aws-cdk-lib/aws-route53-targets";
+import { CloudFrontTarget, LoadBalancerTarget } from "aws-cdk-lib/aws-route53-targets";
 import { CloudFrontDistribution } from "../../resources/aws/cdn/index.js";
 import { AliasRecord } from "../../resources/aws/networking/index.js";
-import { DNS_APEX } from "@fjall/util";
+import { getSafeZoneName, toPascalCase } from "../../utils/capitaliseString.js";
 import { resolvePatternZone, resolvePatternCloudFrontCertificate } from "./patternDomain.js";
 import { isStorage } from "./storage.js";
+import { CdnEcsOriginResolver, recordLabelWithin, normaliseDnsName } from "./cdnAppOrigin.js";
 import { isCompute, isEcsCompute, isLambdaCompute } from "./compute.js";
 /**
- * Relative record label for `domain` within `zoneName` (the staticSite
- * `recordLabelFor` convention): the zone apex maps to the canonical apex
- * label, sub-names drop the zone suffix.
+ * The distribution's own alias names, normalised — consumed by the
+ * origin-loop guard and by the ECS origin resolver (auto-resolution excludes
+ * them from routed-host candidates, and a resolved origin equal to one is
+ * refused as a loop).
  */
-function recordLabelWithin(domain, zoneName) {
-    if (domain === zoneName) {
-        return DNS_APEX;
+function collectAliasNames(props) {
+    const aliasNames = new Set();
+    if (props.domainConfig !== undefined) {
+        aliasNames.add(normaliseDnsName(props.domainConfig.domainName));
     }
-    const suffix = `.${zoneName}`;
-    return domain.endsWith(suffix) ? domain.slice(0, -suffix.length) : domain;
-}
-/** Lowercase and strip the trailing dot — DNS names are case-insensitive. */
-function normaliseDnsName(name) {
-    return name.toLowerCase().replace(/\.$/, "");
+    for (const name of props.domainNames ?? []) {
+        if (!Token.isUnresolved(name)) {
+            aliasNames.add(normaliseDnsName(name));
+        }
+    }
+    return aliasNames;
 }
 /**
  * Validates CDN props — synth-time hard errors for shapes CloudFormation
@@ -69,15 +72,7 @@ function validateCdnProps(props) {
     // every request CloudFront → DNS → CloudFront until the request-depth
     // limit 508s. Synth can see this shape whenever the origin hostname is a
     // literal, so refuse it with the cure.
-    const aliasNames = new Set();
-    if (props.domainConfig !== undefined) {
-        aliasNames.add(normaliseDnsName(props.domainConfig.domainName));
-    }
-    for (const name of props.domainNames ?? []) {
-        if (!Token.isUnresolved(name)) {
-            aliasNames.add(normaliseDnsName(name));
-        }
-    }
+    const aliasNames = collectAliasNames(props);
     const defaultOriginHostname = props.originType === "http"
         ? props.domainName
         : props.originType === "auto" && typeof props.origin === "string"
@@ -130,18 +125,66 @@ function validateCdnProps(props) {
             "'certificateArn', or configure the pattern's 'domain' with a zone " +
             "identity so it provisions one.");
     }
-    // Validate ALB origin
+    // Validate ALB origin (design 2026-08-18 cdn-app-origin, D4): CloudFront
+    // validates the origin certificate against the raw `*.elb.amazonaws.com`
+    // hostname, which no ACM certificate ever covers — an effective-HTTPS alb
+    // origin can never complete a TLS handshake. E9, with the cure conditional
+    // on the listener protocol: HTTP_ONLY only works against a port-80
+    // listener, and a cert-bearing cluster has exactly one listener, on 443.
     if (props.originType === "alb") {
-        if (isCompute(props.loadBalancer) && isEcsCompute(props.loadBalancer)) {
-            const lb = props.loadBalancer.getLoadBalancer();
-            if (!lb) {
-                throw new Error("Compute resource does not have a load balancer. " +
-                    "Ensure ECS compute has loadBalancer enabled for CDN origin.");
-            }
+        const computeRef = isCompute(props.loadBalancer) && isEcsCompute(props.loadBalancer)
+            ? props.loadBalancer
+            : undefined;
+        if (computeRef !== undefined && !computeRef.getLoadBalancer()) {
+            throw new Error("Compute resource does not have a load balancer. " +
+                "Ensure ECS compute has loadBalancer enabled for CDN origin.");
+        }
+        const profile = computeRef?.getIngressProfile();
+        if (profile?.internal) {
+            // E2 — same defect as the construct-origin lane: no public path in.
+            throw new Error("CDN alb origin: the load balancer is internal — CloudFront " +
+                "reaches origins over the public internet and cannot address an " +
+                "internal ALB. Make the load balancer internet-facing.");
+        }
+        const effectiveProtocol = props.protocolPolicy ?? "HTTPS_ONLY";
+        if (effectiveProtocol !== "HTTP_ONLY") {
+            // E9 — effective HTTPS to the raw ELB hostname.
+            const cure = profile === undefined
+                ? 'If the ALB has an HTTP (port-80) listener, set protocolPolicy: "HTTP_ONLY"; ' +
+                    'otherwise use originType "auto" with the compute as origin, ' +
+                    "which resolves a certificate-covered origin hostname."
+                : profile.listenerPort === 80
+                    ? 'Set protocolPolicy: "HTTP_ONLY" (the cluster\'s listener serves HTTP), ' +
+                        'or use originType "auto" with the compute as origin.'
+                    : 'Use originType "auto" with the compute as origin — the ' +
+                        "cluster's only listener is HTTPS (443), so the sole working " +
+                        "path is a certificate-covered origin hostname.";
+            throw new Error(`CDN alb origin with protocolPolicy '${effectiveProtocol}' can ` +
+                "never complete a TLS handshake: CloudFront validates the origin " +
+                "certificate against the raw ELB hostname " +
+                "(*.elb.amazonaws.com), which no ACM certificate covers — every " +
+                `origin fetch fails with a 502. ${cure}`);
+        }
+        if (profile !== undefined && profile.listenerPort === 443) {
+            // E9 (HTTP_ONLY variant) — nothing listens on 80: a connect-timeout
+            // 504 instead of a TLS 502, equally broken.
+            throw new Error('CDN alb origin with protocolPolicy "HTTP_ONLY": the cluster\'s ' +
+                "only listener is HTTPS (443) — a certificate resolved, so " +
+                "nothing listens on port 80 and every origin fetch times out. " +
+                'Use originType "auto" with the compute as origin instead.');
         }
     }
     // Validate smart origin
     if (props.originType === "auto") {
+        if (!(isCompute(props.origin) && isEcsCompute(props.origin)) &&
+            (props.originHostname !== undefined || props.originRecord !== undefined)) {
+            throw new Error("CDN 'originHostname'/'originRecord' configure the distribution's " +
+                "DEFAULT origin, and only when it is an ECS compute — they " +
+                "resolve the origin hostname against that compute's ingress " +
+                "profile. Drop them for storage, Lambda, and literal-hostname " +
+                "default origins; a behaviour's ECS origin takes the same " +
+                "overrides on the behaviour entry itself.");
+        }
         if (isCompute(props.origin)) {
             if (isEcsCompute(props.origin)) {
                 if (!props.origin.getLoadBalancer()) {
@@ -175,11 +218,124 @@ export class Cdn extends CloudFrontDistribution {
         const domain = props.domainConfig !== undefined && props.app !== undefined
             ? Cdn.resolveDomain(scope, id, props.domainConfig, props.app)
             : undefined;
-        const resolvedProps = Cdn.resolveProps(scope, id, props, domain);
+        // ECS construct-reference origins resolve through one memoized resolver
+        // (design 2026-08-18 cdn-app-origin, D3): the default origin and every
+        // behaviour referencing the same compute share one resolution and at
+        // most one origin record.
+        const ecsOriginResolver = Cdn.createEcsOriginResolver(id, props);
+        const resolvedProps = Cdn.resolveProps(scope, id, props, domain, ecsOriginResolver);
         super(scope, id, resolvedProps);
         if (domain !== undefined && props.domainConfig !== undefined) {
             this.createDomainRecord(id, props.domainConfig, domain);
         }
+        this.createOriginRecords(ecsOriginResolver.getRecordPlans());
+    }
+    static createEcsOriginResolver(id, props) {
+        return new CdnEcsOriginResolver({
+            cdnId: id,
+            aliasNames: collectAliasNames(props),
+            overrides: Cdn.collectEcsOriginOverrides(id, props)
+        });
+    }
+    /**
+     * Assemble the per-compute `originHostname`/`originRecord` overrides the
+     * resolver binds by compute identity: the distribution-level props apply
+     * to the DEFAULT origin's compute, each behaviour's own overrides apply
+     * to that behaviour's compute. Two entries naming the same compute must
+     * agree — one alias record cannot carry two spellings.
+     */
+    static collectEcsOriginOverrides(id, props) {
+        const overrides = new Map();
+        const claim = (compute, override, site) => {
+            const existing = overrides.get(compute) ?? {};
+            for (const key of ["originHostname", "originRecord"]) {
+                const incoming = override[key];
+                if (incoming === undefined)
+                    continue;
+                const held = existing[key];
+                if (held !== undefined && held !== incoming) {
+                    throw new Error(`CDN '${id}': conflicting ${key} overrides for the same ECS ` +
+                        `compute origin ('${held}' vs '${incoming}' from ${site}) — ` +
+                        "overrides bind per compute, so every entry naming it must " +
+                        "agree. Keep one spelling.");
+                }
+            }
+            overrides.set(compute, { ...existing, ...override });
+        };
+        if (props.originType === "auto") {
+            const override = {
+                ...(props.originHostname !== undefined && {
+                    originHostname: props.originHostname
+                }),
+                ...(props.originRecord !== undefined && {
+                    originRecord: props.originRecord
+                })
+            };
+            if ((override.originHostname !== undefined ||
+                override.originRecord !== undefined) &&
+                isCompute(props.origin) &&
+                isEcsCompute(props.origin)) {
+                claim(props.origin, override, "the distribution props");
+            }
+        }
+        for (const behaviour of props.behaviours ?? []) {
+            if (behaviour.originHostname === undefined &&
+                behaviour.originRecord === undefined) {
+                continue;
+            }
+            if (typeof behaviour.origin === "string" ||
+                !isCompute(behaviour.origin) ||
+                !isEcsCompute(behaviour.origin)) {
+                throw new Error(`CDN '${id}': behaviour '${behaviour.pathPattern}' sets ` +
+                    "'originHostname'/'originRecord', but its origin is not an ECS " +
+                    "compute — they configure how the origin hostname resolves " +
+                    "against the compute's ingress profile. Drop them for storage, " +
+                    "Lambda, and literal-hostname origins.");
+            }
+            claim(behaviour.origin, {
+                ...(behaviour.originHostname !== undefined && {
+                    originHostname: behaviour.originHostname
+                }),
+                ...(behaviour.originRecord !== undefined && {
+                    originRecord: behaviour.originRecord
+                })
+            }, `behaviour '${behaviour.pathPattern}'`);
+        }
+        return overrides;
+    }
+    /**
+     * Mint the Cdn-owned origin alias records (P1) after the distribution
+     * exists, using the compute profile's own zone instance so the DNS claim
+     * registry sees the same zone identity as the cluster's records. The
+     * distribution depends on each record: the hostname must resolve before a
+     * distribution update referencing it propagates.
+     */
+    createOriginRecords(plans) {
+        // Plans are memoized per compute, so two entries with one hostname mean
+        // two DIFFERENT computes resolved the same name — an inherently invalid
+        // shape (one alias record cannot target two load balancers). Refuse it
+        // with the cure instead of letting CDK's duplicate-construct-id throw.
+        const byHostname = new Map();
+        for (const plan of plans) {
+            const key = normaliseDnsName(plan.hostname);
+            if (byHostname.has(key)) {
+                throw new Error(`CDN '${this.node.id}': two ECS compute origins resolved the ` +
+                    `same origin hostname '${plan.hostname}' — one alias record ` +
+                    "cannot target two load balancers. Give one of them a " +
+                    "distinct originHostname.");
+            }
+            byHostname.set(key, plan);
+        }
+        for (const plan of plans) {
+            const safeHost = toPascalCase(getSafeZoneName(plan.hostname));
+            const record = new AliasRecord(this, `${safeHost}OriginRecord`, {
+                zone: plan.hostedZone,
+                zoneName: plan.zoneName,
+                recordName: plan.recordName,
+                target: new LoadBalancerTarget(plan.loadBalancer)
+            });
+            this.getDistribution().node.addDependency(record);
+        }
     }
     /**
      * Resolve a `domainConfig` through the shared pattern-domain helpers
@@ -231,14 +387,24 @@ export class Cdn extends CloudFrontDistribution {
     /**
      * Resolve ICdnProps to CloudFrontDistributionProps.
      */
-    static resolveProps(scope, id, props, domain) {
-        const defaultOrigin = Cdn.resolveDefaultOrigin(props);
-        const behaviours = Cdn.resolveBehaviours(props.behaviours);
+    static resolveProps(scope, id, props, domain, ecsOriginResolver) {
+        const defaultOrigin = Cdn.resolveDefaultOrigin(props, ecsOriginResolver);
+        const behaviours = Cdn.resolveBehaviours(props.behaviours, ecsOriginResolver);
         const appName = props.appName;
         const domainNames = props.domainNames ??
             (props.domainConfig !== undefined
                 ? [props.domainConfig.domainName]
                 : undefined);
+        // A default origin resolved through the ECS profile lane serves a
+        // hostname that differs from the viewer-facing aliases, so host
+        // fidelity via x-forwarded-host is the sensible default (design D3
+        // step 9). Explicit `forwardHostHeader: false` wins.
+        const impliedForwardHostHeader = props.originType === "auto" &&
+            isCompute(props.origin) &&
+            isEcsCompute(props.origin) &&
+            (domainNames?.length ?? 0) > 0
+            ? true
+            : undefined;
         const certificate = props.certificate ??
             (props.certificateArn
                 ? Certificate.fromCertificateArn(scope, `${id}Certificate`, props.certificateArn)
@@ -264,7 +430,7 @@ export class Cdn extends CloudFrontDistribution {
             enableLogging: props.enableLogging,
             logBucket: props.logBucket,
             priceClass: props.priceClass,
-            forwardHostHeader: props.forwardHostHeader,
+            forwardHostHeader: props.forwardHostHeader ?? impliedForwardHostHeader,
             accessGate: props.accessGate,
             ...s3Routing
         };
@@ -272,13 +438,13 @@ export class Cdn extends CloudFrontDistribution {
     /**
      * Transform smart behaviours to CdnBehaviour objects.
      */
-    static resolveBehaviours(behaviours) {
+    static resolveBehaviours(behaviours, ecsOriginResolver) {
         if (!behaviours || behaviours.length === 0) {
             return undefined;
         }
         return behaviours.map((behaviour) => ({
             pathPattern: behaviour.pathPattern,
-            origin: Cdn.detectOriginFromResource(behaviour.origin),
+            origin: Cdn.detectOriginFromResource(behaviour.origin, ecsOriginResolver),
             cachePolicy: behaviour.cachePolicy,
             allowedMethods: behaviour.allowedMethods
         }));
@@ -286,7 +452,7 @@ export class Cdn extends CloudFrontDistribution {
     /**
      * Resolve the default origin from ICdnProps.
      */
-    static resolveDefaultOrigin(props) {
+    static resolveDefaultOrigin(props, ecsOriginResolver) {
         switch (props.originType) {
             case "s3": {
                 const bucket = isStorage(props.bucket)
@@ -332,7 +498,7 @@ export class Cdn extends CloudFrontDistribution {
                     protocolPolicy: props.protocolPolicy
                 };
             case "auto":
-                return Cdn.detectOriginFromResource(props.origin);
+                return Cdn.detectOriginFromResource(props.origin, ecsOriginResolver);
             default: {
                 const _exhaustive = props;
                 throw new Error(`Unsupported CDN origin type: ${props.originType}`);
@@ -342,7 +508,7 @@ export class Cdn extends CloudFrontDistribution {
     /**
      * Auto-detect origin configuration from a Fjall resource.
      */
-    static detectOriginFromResource(resource) {
+    static detectOriginFromResource(resource, ecsOriginResolver) {
         // String → HTTP origin
         if (typeof resource === "string") {
             return {
@@ -357,15 +523,13 @@ export class Cdn extends CloudFrontDistribution {
                 bucket: resource.getBucket()
             };
         }
-        // ECS Compute → ALB origin
+        // ECS Compute → HTTP origin on a resolved, certificate-covered origin
+        // hostname (design 2026-08-18 cdn-app-origin, D3). The former raw-ELB
+        // alb-origin emission was TLS-broken by construction: the resource
+        // layer's HTTPS_ONLY default validated the certificate against
+        // *.elb.amazonaws.com, which no ACM certificate covers.
         if (isEcsCompute(resource)) {
-            const loadBalancer = resource.getLoadBalancer();
-            if (loadBalancer) {
-                return {
-                    type: "alb",
-                    loadBalancer
-                };
-            }
+            return ecsOriginResolver.resolve(resource).originConfig;
         }
         // Lambda Compute → HTTP origin (function URL)
         if (isLambdaCompute(resource)) {
@@ -382,6 +546,10 @@ export class Cdn extends CloudFrontDistribution {
                     domainName
                 };
             }
+            // Targeted error (design D3): a behaviour origin used to fall through
+            // to the generic detect throw for this shape.
+            throw new Error("Lambda compute must have a function URL for CDN origin. " +
+                "Enable functionUrl in your Lambda compute configuration.");
         }
         throw new Error(`Unable to detect CDN origin from resource: ${typeof resource}. ` +
             "Provide explicit origin configuration using originType.");

package/dist/lib/patterns/aws/cdnAppOrigin.d.ts

@@ -0,0 +1,74 @@
+/**
+ * ECS construct-reference origin resolution for the `Cdn` pattern (design
+ * 2026-08-18 cdn-app-origin, D3). Given a fronted ECS compute, resolve a
+ * TLS-valid ORIGIN HOSTNAME from the compute's own ingress profile, decide
+ * who owns its DNS record (P1: the construct that declares a hostname owns
+ * its record — a `routing[].host` hostname is the compute's; a derived or
+ * free hostname is the Cdn's), and validate certificate coverage and
+ * listener forwarding at synth — fail closed where decidable, warn where
+ * opaque or partial (P3).
+ *
+ * The resolver is memoized per compute within one `Cdn`: the default origin
+ * and every behaviour referencing the same compute share one resolution and
+ * at most one record.
+ */
+import type { IHostedZone } from "aws-cdk-lib/aws-route53";
+import type { IApplicationLoadBalancer } from "aws-cdk-lib/aws-elasticloadbalancingv2";
+import type { CdnOriginConfig } from "../../resources/aws/cdn/index.js";
+import type { IEcsCompute } from "./interfaces/compute.js";
+import { normaliseDnsName } from "../../resources/aws/compute/ingressProfile.js";
+export { normaliseDnsName };
+/**
+ * Relative record label for `domain` within `zoneName` (the staticSite
+ * `recordLabelFor` convention): the zone apex maps to the canonical apex
+ * label, sub-names drop the zone suffix.
+ */
+export declare function recordLabelWithin(domain: string, zoneName: string): string;
+/** A Cdn-owned origin alias record to mint after the distribution exists. */
+export interface EcsOriginRecordPlan {
+    hostname: string;
+    hostedZone: IHostedZone;
+    zoneName: string;
+    recordName: string;
+    loadBalancer: IApplicationLoadBalancer;
+}
+export interface ResolvedEcsOrigin {
+    hostname: string;
+    originConfig: CdnOriginConfig;
+    /** Present when the Cdn owns the record and `originRecord` is not "none". */
+    recordPlan?: EcsOriginRecordPlan;
+    /** True when the hostname is a compute-declared routing host (P1). */
+    computeOwnsRecord: boolean;
+}
+/**
+ * Explicit per-compute origin overrides: the distribution-level
+ * `originHostname`/`originRecord` for the default origin's compute, and each
+ * behaviour's own `originHostname`/`originRecord` for its compute — so every
+ * lane that can throw E3 can also cure it (design D3: behaviour origins get
+ * the same targeted validation AND the same override surface).
+ */
+export interface EcsOriginOverride {
+    originHostname?: string;
+    originRecord?: "alias" | "none";
+}
+export interface CdnEcsOriginResolverOptions {
+    cdnId: string;
+    /** The distribution's own alias names, normalised — the origin-loop guard. */
+    aliasNames: ReadonlySet<string>;
+    /** Per-compute explicit overrides — assembled by the Cdn from the
+     * distribution props (default origin) and each behaviour entry. */
+    overrides?: ReadonlyMap<IEcsCompute, EcsOriginOverride>;
+}
+export declare class CdnEcsOriginResolver {
+    private readonly options;
+    private readonly resolutions;
+    private warnedUnknownCoverage;
+    constructor(options: CdnEcsOriginResolverOptions);
+    resolve(compute: IEcsCompute): ResolvedEcsOrigin;
+    /** Every Cdn-owned record the resolutions so far require, one per compute. */
+    getRecordPlans(): EcsOriginRecordPlan[];
+    private resolveFresh;
+    private explicitHostnameFor;
+    private effectiveOriginRecord;
+    private selectHostname;
+}