@fjall/components-infrastructure 14.1.0 → 14.3.0

package/dist/lib/patterns/aws/apexDomainPattern.js

@@ -44,7 +44,7 @@ export function composeApexDomain(scope, props) {
         costAllocationDomain: props.zoneName
     });
     if (props.records && props.records.length > 0) {
-        composeTypedDnsRecords(scope, hostedZoneConstruct.hostedZone, props.zoneName, props.records);
+        composeTypedDnsRecords(scope, hostedZoneConstruct.hostedZone, props.zoneName, props.records, props.recordIds);
     }
     return {
         hostedZone: hostedZoneConstruct.hostedZone,

package/dist/lib/patterns/aws/cdn.d.ts

@@ -130,11 +130,36 @@ export interface HttpCdnProps extends BaseCdnProps {
     protocolPolicy?: "HTTP_ONLY" | "HTTPS_ONLY" | "MATCH_VIEWER";
 }
 /**
- * Smart origin CDN props - auto-detect origin type from Fjall resource
+ * Smart origin CDN props - auto-detect origin type from Fjall resource.
+ *
+ * ECS compute origins (design 2026-08-18 cdn-app-origin, D3) resolve a
+ * TLS-valid ORIGIN HOSTNAME from the compute's own ingress profile instead
+ * of the raw ELB hostname (which no ACM certificate ever covers): a routing
+ * host when the compute declares exactly one, else `origin.<domain>`,
+ * derived. Certificate coverage and listener forwarding are validated at
+ * synth; when the Cdn owns the hostname it mints the alias record in this
+ * stack, record-before-distribution ordered.
  */
 export interface SmartCdnProps extends BaseCdnProps {
     originType: "auto";
     origin: Storage | AnyCompute | string;
+    /**
+     * Origin hostname override for the DEFAULT origin's ECS compute (a
+     * behaviour's ECS origin takes the same override on the behaviour
+     * entry). A literal hostname: a compute-declared routing host (the
+     * compute keeps owning its record), or a free name inside the cluster's
+     * zone (the Cdn mints its record). Refused for `redirectHosts` entries —
+     * they 301, never serve. Default: auto-resolution (sole routing host,
+     * else `origin.<domain>`).
+     */
+    originHostname?: string;
+    /**
+     * Whether the Cdn mints the origin alias record when it owns the DEFAULT
+     * origin's hostname (behaviour entries carry their own). "none" = the
+     * record is managed elsewhere (BYO or a migration state). Refused when
+     * the hostname is a routing host — the compute owns that record (P1).
+     */
+    originRecord?: "alias" | "none";
 }
 export type ICdnProps = S3CdnProps | AlbCdnProps | HttpCdnProps | SmartCdnProps;
 /**
@@ -143,15 +168,53 @@ export type ICdnProps = S3CdnProps | AlbCdnProps | HttpCdnProps | SmartCdnProps;
  */
 export interface SmartCdnBehaviour {
     pathPattern: string;
-    origin: Storage | AnyCompute | string;
+    /**
+     * Origin for this path pattern. Omit to route the pattern to the
+     * distribution's DEFAULT origin — the common shape where behaviours exist
+     * to vary caching or allowed methods per path, not to change origins. An
+     * origin-less behaviour is the default behaviour varied per path, so its
+     * omitted `cachePolicy`/`allowedMethods` inherit the distribution's
+     * `cachePolicy`/`defaultAllowedMethods` (a behaviour with its own origin
+     * is an independent config and keeps the resource-layer fallbacks).
+     */
+    origin?: Storage | AnyCompute | string;
     cachePolicy?: CachePolicyPreset | ICachePolicy;
     allowedMethods?: "GET_HEAD" | "GET_HEAD_OPTIONS" | "ALL";
+    /**
+     * Origin hostname override for THIS behaviour's ECS compute origin — the
+     * behaviour-level counterpart of the distribution's `originHostname`
+     * (same semantics; see {@link SmartCdnProps.originHostname}). Overrides
+     * bind per compute: two entries naming the same compute must agree.
+     */
+    originHostname?: string;
+    /**
+     * Record-minting override for THIS behaviour's ECS compute origin — the
+     * behaviour-level counterpart of {@link SmartCdnProps.originRecord}.
+     */
+    originRecord?: "alias" | "none";
 }
 /**
  * CDN wrapper class that extends CloudFrontDistribution with Fjall patterns.
  */
 export declare class Cdn extends CloudFrontDistribution implements ICdn {
     constructor(scope: Construct, id: string, props: ICdnProps);
+    private static createEcsOriginResolver;
+    /**
+     * Assemble the per-compute `originHostname`/`originRecord` overrides the
+     * resolver binds by compute identity: the distribution-level props apply
+     * to the DEFAULT origin's compute, each behaviour's own overrides apply
+     * to that behaviour's compute. Two entries naming the same compute must
+     * agree — one alias record cannot carry two spellings.
+     */
+    private static collectEcsOriginOverrides;
+    /**
+     * Mint the Cdn-owned origin alias records (P1) after the distribution
+     * exists, using the compute profile's own zone instance so the DNS claim
+     * registry sees the same zone identity as the cluster's records. The
+     * distribution depends on each record: the hostname must resolve before a
+     * distribution update referencing it propagates.
+     */
+    private createOriginRecords;
     /**
      * Resolve a `domainConfig` through the shared pattern-domain helpers
      * (design C1): zone identity via `resolvePatternZone` (explicit
@@ -171,11 +234,27 @@ export declare class Cdn extends CloudFrontDistribution implements ICdn {
      */
     private createDomainRecord;
     /**
-     * Resolve ICdnProps to CloudFrontDistributionProps.
+     * Resolve ICdnProps to the distribution props PLUS the Cdn-owned origin
+     * record plans the resolution produced — one resolution pass, one result.
      */
     private static resolveProps;
     /**
-     * Transform smart behaviours to CdnBehaviour objects.
+     * Transform smart behaviours to CdnBehaviour objects. A behaviour with no
+     * origin routes to the distribution's default origin — the same resolved
+     * config, so the resource layer memoizes them onto one distribution
+     * origin entry.
+     *
+     * Knob inheritance is asymmetric BY CONTRACT. An origin-less behaviour IS
+     * the default behaviour varied per path (the shape
+     * `SmartCdnBehaviour.origin` advertises), so its omitted
+     * `cachePolicy`/`allowedMethods` inherit the DISTRIBUTION's defaults —
+     * otherwise a caching-only behaviour on an `allowedMethods: "ALL"` API
+     * distribution would snap its path back to the resource layer's GET/HEAD
+     * fallback and 403 every POST at the edge. A behaviour WITH its own
+     * origin keeps the legacy resource-layer fallbacks (GET_HEAD /
+     * CACHING_OPTIMIZED): those deployed behaviours are byte-frozen, and an
+     * independent origin is an independent config, not a variation of the
+     * default behaviour.
      */
     private static resolveBehaviours;
     /**

package/dist/lib/patterns/aws/cdn.js

@@ -1,27 +1,31 @@
 import { Fn, Token } from "aws-cdk-lib";
 import { Certificate } from "aws-cdk-lib/aws-certificatemanager";
-import { CloudFrontTarget } from "aws-cdk-lib/aws-route53-targets";
+import { CloudFrontTarget, LoadBalancerTarget } from "aws-cdk-lib/aws-route53-targets";
 import { CloudFrontDistribution } from "../../resources/aws/cdn/index.js";
 import { AliasRecord } from "../../resources/aws/networking/index.js";
-import { DNS_APEX } from "@fjall/util";
+import { getSafeZoneName, toPascalCase } from "../../utils/capitaliseString.js";
+import { recordLabelWithin } from "../../utils/domainTypes.js";
 import { resolvePatternZone, resolvePatternCloudFrontCertificate } from "./patternDomain.js";
 import { isStorage } from "./storage.js";
+import { CdnEcsOriginResolver, cdnOriginRefusal, internalAlbMessage, normaliseDnsName } from "./cdnAppOrigin.js";
 import { isCompute, isEcsCompute, isLambdaCompute } from "./compute.js";
 /**
- * Relative record label for `domain` within `zoneName` (the staticSite
- * `recordLabelFor` convention): the zone apex maps to the canonical apex
- * label, sub-names drop the zone suffix.
+ * The distribution's own alias names, normalised — consumed by the
+ * origin-loop guard and by the ECS origin resolver (auto-resolution excludes
+ * them from routed-host candidates, and a resolved origin equal to one is
+ * refused as a loop).
  */
-function recordLabelWithin(domain, zoneName) {
-    if (domain === zoneName) {
-        return DNS_APEX;
+function collectAliasNames(props) {
+    const aliasNames = new Set();
+    if (props.domainConfig !== undefined) {
+        aliasNames.add(normaliseDnsName(props.domainConfig.domainName));
     }
-    const suffix = `.${zoneName}`;
-    return domain.endsWith(suffix) ? domain.slice(0, -suffix.length) : domain;
-}
-/** Lowercase and strip the trailing dot — DNS names are case-insensitive. */
-function normaliseDnsName(name) {
-    return name.toLowerCase().replace(/\.$/, "");
+    for (const name of props.domainNames ?? []) {
+        if (!Token.isUnresolved(name)) {
+            aliasNames.add(normaliseDnsName(name));
+        }
+    }
+    return aliasNames;
 }
 /**
  * Validates CDN props — synth-time hard errors for shapes CloudFormation
@@ -69,15 +73,7 @@ function validateCdnProps(props) {
     // every request CloudFront → DNS → CloudFront until the request-depth
     // limit 508s. Synth can see this shape whenever the origin hostname is a
     // literal, so refuse it with the cure.
-    const aliasNames = new Set();
-    if (props.domainConfig !== undefined) {
-        aliasNames.add(normaliseDnsName(props.domainConfig.domainName));
-    }
-    for (const name of props.domainNames ?? []) {
-        if (!Token.isUnresolved(name)) {
-            aliasNames.add(normaliseDnsName(name));
-        }
-    }
+    const aliasNames = collectAliasNames(props);
     const defaultOriginHostname = props.originType === "http"
         ? props.domainName
         : props.originType === "auto" && typeof props.origin === "string"
@@ -96,7 +92,7 @@ function validateCdnProps(props) {
     for (const originHostname of literalOriginHostnames) {
         if (!Token.isUnresolved(originHostname) &&
             aliasNames.has(normaliseDnsName(originHostname))) {
-            throw new Error(`CDN origin '${originHostname}' is also one of the distribution's own ` +
+            throw cdnOriginRefusal("C4", `CDN origin '${originHostname}' is also one of the distribution's own ` +
                 "domain names — once DNS points that name at the distribution, every " +
                 "request loops CloudFront → CloudFront. Point the origin at a " +
                 "dedicated origin hostname instead (e.g. an ECS service " +
@@ -130,18 +126,64 @@ function validateCdnProps(props) {
             "'certificateArn', or configure the pattern's 'domain' with a zone " +
             "identity so it provisions one.");
     }
-    // Validate ALB origin
+    // Validate ALB origin (design 2026-08-18 cdn-app-origin, D4): CloudFront
+    // validates the origin certificate against the raw `*.elb.amazonaws.com`
+    // hostname, which no ACM certificate ever covers — an effective-HTTPS alb
+    // origin can never complete a TLS handshake. E9, with the cure conditional
+    // on the listener protocol: HTTP_ONLY only works against a port-80
+    // listener, and a cert-bearing cluster has exactly one listener, on 443.
     if (props.originType === "alb") {
-        if (isCompute(props.loadBalancer) && isEcsCompute(props.loadBalancer)) {
-            const lb = props.loadBalancer.getLoadBalancer();
-            if (!lb) {
-                throw new Error("Compute resource does not have a load balancer. " +
-                    "Ensure ECS compute has loadBalancer enabled for CDN origin.");
-            }
+        const computeRef = isCompute(props.loadBalancer) && isEcsCompute(props.loadBalancer)
+            ? props.loadBalancer
+            : undefined;
+        if (computeRef !== undefined && !computeRef.getLoadBalancer()) {
+            throw new Error("Compute resource does not have a load balancer. " +
+                "Ensure ECS compute has loadBalancer enabled for CDN origin.");
+        }
+        const profile = computeRef?.getIngressProfile();
+        if (profile?.internal) {
+            // E2 — same defect as the construct-origin lane, same shared message.
+            throw cdnOriginRefusal("E2", internalAlbMessage("CDN alb origin: the load balancer", "Make the load balancer internet-facing."));
+        }
+        const effectiveProtocol = props.protocolPolicy ?? "HTTPS_ONLY";
+        if (effectiveProtocol !== "HTTP_ONLY") {
+            // E9 — effective HTTPS to the raw ELB hostname.
+            const cure = profile === undefined
+                ? 'If the ALB has an HTTP (port-80) listener, set protocolPolicy: "HTTP_ONLY"; ' +
+                    'otherwise use originType "auto" with the compute as origin, ' +
+                    "which resolves a certificate-covered origin hostname."
+                : profile.listenerPort === 80
+                    ? 'Set protocolPolicy: "HTTP_ONLY" (the cluster\'s listener serves HTTP), ' +
+                        'or use originType "auto" with the compute as origin.'
+                    : 'Use originType "auto" with the compute as origin — the ' +
+                        "cluster's only listener is HTTPS (443), so the sole working " +
+                        "path is a certificate-covered origin hostname.";
+            throw cdnOriginRefusal("E9", `CDN alb origin with protocolPolicy '${effectiveProtocol}' can ` +
+                "never complete a TLS handshake: CloudFront validates the origin " +
+                "certificate against the raw ELB hostname " +
+                "(*.elb.amazonaws.com), which no ACM certificate covers — every " +
+                `origin fetch fails with a 502. ${cure}`);
+        }
+        if (profile !== undefined && profile.listenerPort === 443) {
+            // E9b (HTTP_ONLY variant) — nothing listens on 80: a connect-timeout
+            // 504 instead of a TLS 502, equally broken.
+            throw cdnOriginRefusal("E9b", 'CDN alb origin with protocolPolicy "HTTP_ONLY": the cluster\'s ' +
+                "only listener is HTTPS (443) — a certificate resolved, so " +
+                "nothing listens on port 80 and every origin fetch times out. " +
+                'Use originType "auto" with the compute as origin instead.');
         }
     }
     // Validate smart origin
     if (props.originType === "auto") {
+        if (!(isCompute(props.origin) && isEcsCompute(props.origin)) &&
+            (props.originHostname !== undefined || props.originRecord !== undefined)) {
+            throw new Error("CDN 'originHostname'/'originRecord' configure the distribution's " +
+                "DEFAULT origin, and only when it is an ECS compute — they " +
+                "resolve the origin hostname against that compute's ingress " +
+                "profile. Drop them for storage, Lambda, and literal-hostname " +
+                "default origins; a behaviour's ECS origin takes the same " +
+                "overrides on the behaviour entry itself.");
+        }
         if (isCompute(props.origin)) {
             if (isEcsCompute(props.origin)) {
                 if (!props.origin.getLoadBalancer()) {
@@ -175,11 +217,133 @@ export class Cdn extends CloudFrontDistribution {
         const domain = props.domainConfig !== undefined && props.app !== undefined
             ? Cdn.resolveDomain(scope, id, props.domainConfig, props.app)
             : undefined;
-        const resolvedProps = Cdn.resolveProps(scope, id, props, domain);
-        super(scope, id, resolvedProps);
+        // ECS construct-reference origins resolve through one memoized resolver
+        // (design 2026-08-18 cdn-app-origin, D3): the default origin and every
+        // behaviour referencing the same compute share one resolution and at
+        // most one origin record. The record plans ride the resolution RESULT —
+        // they exist only once every origin has resolved, so returning them from
+        // resolveProps makes the ordering a property of the data flow rather
+        // than a call-sequence convention on the resolver instance.
+        const resolved = Cdn.resolveProps(scope, id, props, domain);
+        super(scope, id, resolved.distributionProps);
         if (domain !== undefined && props.domainConfig !== undefined) {
             this.createDomainRecord(id, props.domainConfig, domain);
         }
+        this.createOriginRecords(resolved.recordPlans);
+    }
+    static createEcsOriginResolver(id, props) {
+        return new CdnEcsOriginResolver({
+            cdnId: id,
+            aliasNames: collectAliasNames(props),
+            overrides: Cdn.collectEcsOriginOverrides(id, props)
+        });
+    }
+    /**
+     * Assemble the per-compute `originHostname`/`originRecord` overrides the
+     * resolver binds by compute identity: the distribution-level props apply
+     * to the DEFAULT origin's compute, each behaviour's own overrides apply
+     * to that behaviour's compute. Two entries naming the same compute must
+     * agree — one alias record cannot carry two spellings.
+     */
+    static collectEcsOriginOverrides(id, props) {
+        const overrides = new Map();
+        const claim = (compute, override, site) => {
+            const existing = overrides.get(compute) ?? {};
+            for (const key of ["originHostname", "originRecord"]) {
+                const incoming = override[key];
+                if (incoming === undefined)
+                    continue;
+                const held = existing[key];
+                if (held !== undefined && held !== incoming) {
+                    throw new Error(`CDN '${id}': conflicting ${key} overrides for the same ECS ` +
+                        `compute origin ('${held}' vs '${incoming}' from ${site}) — ` +
+                        "overrides bind per compute, so every entry naming it must " +
+                        "agree. Keep one spelling.");
+                }
+            }
+            overrides.set(compute, { ...existing, ...override });
+        };
+        if (props.originType === "auto") {
+            const override = {
+                ...(props.originHostname !== undefined && {
+                    originHostname: props.originHostname
+                }),
+                ...(props.originRecord !== undefined && {
+                    originRecord: props.originRecord
+                })
+            };
+            if ((override.originHostname !== undefined ||
+                override.originRecord !== undefined) &&
+                isCompute(props.origin) &&
+                isEcsCompute(props.origin)) {
+                claim(props.origin, override, "the distribution props");
+            }
+        }
+        for (const behaviour of props.behaviours ?? []) {
+            if (behaviour.originHostname === undefined &&
+                behaviour.originRecord === undefined) {
+                continue;
+            }
+            if (behaviour.origin === undefined) {
+                throw new Error(`CDN '${id}': behaviour '${behaviour.pathPattern}' sets ` +
+                    "'originHostname'/'originRecord' but no 'origin' — an " +
+                    "origin-less behaviour routes to the distribution's default " +
+                    "origin, whose overrides live on the distribution props. Move " +
+                    "the override there, or give the behaviour its own origin.");
+            }
+            if (typeof behaviour.origin === "string" ||
+                !isCompute(behaviour.origin) ||
+                !isEcsCompute(behaviour.origin)) {
+                throw new Error(`CDN '${id}': behaviour '${behaviour.pathPattern}' sets ` +
+                    "'originHostname'/'originRecord', but its origin is not an ECS " +
+                    "compute — they configure how the origin hostname resolves " +
+                    "against the compute's ingress profile. Drop them for storage, " +
+                    "Lambda, and literal-hostname origins.");
+            }
+            claim(behaviour.origin, {
+                ...(behaviour.originHostname !== undefined && {
+                    originHostname: behaviour.originHostname
+                }),
+                ...(behaviour.originRecord !== undefined && {
+                    originRecord: behaviour.originRecord
+                })
+            }, `behaviour '${behaviour.pathPattern}'`);
+        }
+        return overrides;
+    }
+    /**
+     * Mint the Cdn-owned origin alias records (P1) after the distribution
+     * exists, using the compute profile's own zone instance so the DNS claim
+     * registry sees the same zone identity as the cluster's records. The
+     * distribution depends on each record: the hostname must resolve before a
+     * distribution update referencing it propagates.
+     */
+    createOriginRecords(plans) {
+        // Plans are memoized per compute, so two entries with one hostname mean
+        // two DIFFERENT computes resolved the same name — an inherently invalid
+        // shape (one alias record cannot target two load balancers). Refuse it
+        // with the cure instead of letting CDK's duplicate-construct-id throw.
+        const seenHostnames = new Set();
+        for (const plan of plans) {
+            const key = normaliseDnsName(plan.hostname);
+            if (seenHostnames.has(key)) {
+                throw new Error(`CDN '${this.node.id}': two ECS compute origins resolved the ` +
+                    `same origin hostname '${plan.hostname}' — one alias record ` +
+                    "cannot target two load balancers. Give one of them a " +
+                    "distinct originHostname.");
+            }
+            seenHostnames.add(key);
+        }
+        for (const plan of plans) {
+            const safeHost = toPascalCase(getSafeZoneName(plan.hostname));
+            const record = new AliasRecord(this, `${safeHost}OriginRecord`, {
+                zone: plan.hostedZone,
+                zoneName: plan.zoneName,
+                recordName: plan.recordName,
+                target: new LoadBalancerTarget(plan.loadBalancer)
+            });
+            this.getDistribution().node.addDependency(record);
+        }
     }
     /**
      * Resolve a `domainConfig` through the shared pattern-domain helpers
@@ -229,16 +393,35 @@ export class Cdn extends CloudFrontDistribution {
         });
     }
     /**
-     * Resolve ICdnProps to CloudFrontDistributionProps.
+     * Resolve ICdnProps to the distribution props PLUS the Cdn-owned origin
+     * record plans the resolution produced — one resolution pass, one result.
      */
     static resolveProps(scope, id, props, domain) {
-        const defaultOrigin = Cdn.resolveDefaultOrigin(props);
-        const behaviours = Cdn.resolveBehaviours(props.behaviours);
+        const ecsOriginResolver = Cdn.createEcsOriginResolver(id, props);
+        const defaultOrigin = Cdn.resolveDefaultOrigin(props, ecsOriginResolver);
+        const behaviours = Cdn.resolveBehaviours(props.behaviours, defaultOrigin, ecsOriginResolver, {
+            cachePolicy: props.cachePolicy,
+            allowedMethods: props.defaultAllowedMethods
+        });
         const appName = props.appName;
         const domainNames = props.domainNames ??
             (props.domainConfig !== undefined
                 ? [props.domainConfig.domainName]
                 : undefined);
+        // ANY origin resolved through the ECS profile lane serves a hostname
+        // that differs from the viewer-facing aliases, so host fidelity via
+        // x-forwarded-host is the sensible default (design D3 step 9) — for a
+        // behaviour's ECS origin exactly as for the default origin, since the
+        // one viewer-request function rides every behaviour. Explicit
+        // `forwardHostHeader: false` wins.
+        const hasEcsOrigin = (props.originType === "auto" &&
+            isCompute(props.origin) &&
+            isEcsCompute(props.origin)) ||
+            (props.behaviours ?? []).some((behaviour) => behaviour.origin !== undefined &&
+                typeof behaviour.origin !== "string" &&
+                isCompute(behaviour.origin) &&
+                isEcsCompute(behaviour.origin));
+        const impliedForwardHostHeader = hasEcsOrigin && (domainNames?.length ?? 0) > 0 ? true : undefined;
         const certificate = props.certificate ??
             (props.certificateArn
                 ? Certificate.fromCertificateArn(scope, `${id}Certificate`, props.certificateArn)
@@ -253,40 +436,65 @@ export class Cdn extends CloudFrontDistribution {
             }
             : {};
         return {
-            appName,
-            defaultOrigin,
-            defaultCachePolicy: props.cachePolicy,
-            defaultAllowedMethods: props.defaultAllowedMethods,
-            behaviours,
-            domainNames,
-            certificate,
-            comment: props.comment,
-            enableLogging: props.enableLogging,
-            logBucket: props.logBucket,
-            priceClass: props.priceClass,
-            forwardHostHeader: props.forwardHostHeader,
-            accessGate: props.accessGate,
-            ...s3Routing
+            distributionProps: {
+                appName,
+                defaultOrigin,
+                defaultCachePolicy: props.cachePolicy,
+                defaultAllowedMethods: props.defaultAllowedMethods,
+                behaviours,
+                domainNames,
+                certificate,
+                comment: props.comment,
+                enableLogging: props.enableLogging,
+                logBucket: props.logBucket,
+                priceClass: props.priceClass,
+                forwardHostHeader: props.forwardHostHeader ?? impliedForwardHostHeader,
+                accessGate: props.accessGate,
+                ...s3Routing
+            },
+            recordPlans: ecsOriginResolver.getRecordPlans()
         };
     }
     /**
-     * Transform smart behaviours to CdnBehaviour objects.
+     * Transform smart behaviours to CdnBehaviour objects. A behaviour with no
+     * origin routes to the distribution's default origin — the same resolved
+     * config, so the resource layer memoizes them onto one distribution
+     * origin entry.
+     *
+     * Knob inheritance is asymmetric BY CONTRACT. An origin-less behaviour IS
+     * the default behaviour varied per path (the shape
+     * `SmartCdnBehaviour.origin` advertises), so its omitted
+     * `cachePolicy`/`allowedMethods` inherit the DISTRIBUTION's defaults —
+     * otherwise a caching-only behaviour on an `allowedMethods: "ALL"` API
+     * distribution would snap its path back to the resource layer's GET/HEAD
+     * fallback and 403 every POST at the edge. A behaviour WITH its own
+     * origin keeps the legacy resource-layer fallbacks (GET_HEAD /
+     * CACHING_OPTIMIZED): those deployed behaviours are byte-frozen, and an
+     * independent origin is an independent config, not a variation of the
+     * default behaviour.
      */
-    static resolveBehaviours(behaviours) {
+    static resolveBehaviours(behaviours, defaultOrigin, ecsOriginResolver, distributionDefaults) {
         if (!behaviours || behaviours.length === 0) {
             return undefined;
         }
-        return behaviours.map((behaviour) => ({
-            pathPattern: behaviour.pathPattern,
-            origin: Cdn.detectOriginFromResource(behaviour.origin),
-            cachePolicy: behaviour.cachePolicy,
-            allowedMethods: behaviour.allowedMethods
-        }));
+        return behaviours.map((behaviour) => behaviour.origin === undefined
+            ? {
+                pathPattern: behaviour.pathPattern,
+                origin: defaultOrigin,
+                cachePolicy: behaviour.cachePolicy ?? distributionDefaults.cachePolicy,
+                allowedMethods: behaviour.allowedMethods ?? distributionDefaults.allowedMethods
+            }
+            : {
+                pathPattern: behaviour.pathPattern,
+                origin: Cdn.detectOriginFromResource(behaviour.origin, ecsOriginResolver),
+                cachePolicy: behaviour.cachePolicy,
+                allowedMethods: behaviour.allowedMethods
+            });
     }
     /**
      * Resolve the default origin from ICdnProps.
      */
-    static resolveDefaultOrigin(props) {
+    static resolveDefaultOrigin(props, ecsOriginResolver) {
         switch (props.originType) {
             case "s3": {
                 const bucket = isStorage(props.bucket)
@@ -332,7 +540,7 @@ export class Cdn extends CloudFrontDistribution {
                     protocolPolicy: props.protocolPolicy
                 };
             case "auto":
-                return Cdn.detectOriginFromResource(props.origin);
+                return Cdn.detectOriginFromResource(props.origin, ecsOriginResolver);
             default: {
                 const _exhaustive = props;
                 throw new Error(`Unsupported CDN origin type: ${props.originType}`);
@@ -342,7 +550,7 @@ export class Cdn extends CloudFrontDistribution {
     /**
      * Auto-detect origin configuration from a Fjall resource.
      */
-    static detectOriginFromResource(resource) {
+    static detectOriginFromResource(resource, ecsOriginResolver) {
         // String → HTTP origin
         if (typeof resource === "string") {
             return {
@@ -357,15 +565,13 @@ export class Cdn extends CloudFrontDistribution {
                 bucket: resource.getBucket()
             };
         }
-        // ECS Compute → ALB origin
+        // ECS Compute → HTTP origin on a resolved, certificate-covered origin
+        // hostname (design 2026-08-18 cdn-app-origin, D3). The former raw-ELB
+        // alb-origin emission was TLS-broken by construction: the resource
+        // layer's HTTPS_ONLY default validated the certificate against
+        // *.elb.amazonaws.com, which no ACM certificate covers.
         if (isEcsCompute(resource)) {
-            const loadBalancer = resource.getLoadBalancer();
-            if (loadBalancer) {
-                return {
-                    type: "alb",
-                    loadBalancer
-                };
-            }
+            return ecsOriginResolver.resolve(resource).originConfig;
         }
         // Lambda Compute → HTTP origin (function URL)
         if (isLambdaCompute(resource)) {
@@ -382,6 +588,10 @@ export class Cdn extends CloudFrontDistribution {
                     domainName
                 };
             }
+            // Targeted error (design D3): a behaviour origin used to fall through
+            // to the generic detect throw for this shape.
+            throw new Error("Lambda compute must have a function URL for CDN origin. " +
+                "Enable functionUrl in your Lambda compute configuration.");
         }
         throw new Error(`Unable to detect CDN origin from resource: ${typeof resource}. ` +
             "Provide explicit origin configuration using originType.");