@fjall/components-infrastructure 14.1.0 → 14.3.0

package/dist/lib/patterns/aws/interfaces/domain.d.ts

@@ -33,12 +33,22 @@ export interface StandardRecord {
     readonly name: string;
     readonly value: string | string[];
     readonly ttl?: number;
+    /**
+     * Overrides the record's derived construct-id name segment (PascalCase
+     * alphanumeric). The rare escape hatch for two record names that sanitise
+     * to the same PascalCase segment under `recordIds: "stable"` — the
+     * composer's collision refusal names it. Round-tripped by the generator's
+     * zone importer and the webapp record splice.
+     */
+    readonly id?: string;
 }
 export interface AliasRecord {
     readonly type: "A" | "AAAA";
     readonly name: string;
     readonly target: FjallTarget;
     readonly ttl?: never;
+    /** Same construct-id override as {@link StandardRecord.id}. */
+    readonly id?: string;
 }
 export type DnsRecord = StandardRecord | AliasRecord;
 export type Certificate = string | {
@@ -65,6 +75,28 @@ export type Certificate = string | {
 export interface DomainCommonProps {
     readonly zoneName: string;
     readonly records?: DnsRecord[];
+    /**
+     * Construct-id scheme for the records list.
+     *
+     * `"indexed"` (default) embeds each record's LIST POSITION in its logical
+     * ID (`...Record0`, `...Record1`, …) — the legacy eject-contract formula,
+     * byte-frozen for deployed stacks. Under it the records list is
+     * APPEND-ONLY: inserting or removing an entry renumbers every later
+     * record, which CloudFormation executes as delete + recreate of live
+     * record sets.
+     *
+     * `"stable"` derives position-independent IDs
+     * (`<Zone><Name><Type>Record`) so entries can be inserted, removed and
+     * reordered freely. Collision-free by the same doctrine the DNS claim
+     * registry enforces (one owner per (zone, name, type); this vocabulary
+     * cannot express routing-policy variants) — the composer refuses
+     * duplicate (name, type) pairs and sanitised-name collisions at synth,
+     * naming the per-record `id` escape hatch. `fjall domain import` emits it
+     * for fresh zones. Flipping an ALREADY-DEPLOYED zone renames every
+     * record's logical ID (delete + recreate at deploy) — a deliberate
+     * two-deploy migration, never a casual edit.
+     */
+    readonly recordIds?: "indexed" | "stable";
     readonly certificates?: Certificate[];
     readonly tags?: Record<string, string>;
     readonly description?: string;

package/dist/lib/patterns/aws/patternDomain.d.ts

@@ -57,6 +57,15 @@ export interface ResolvedPatternZone {
     readonly hostedZone: IHostedZone;
     readonly zoneName: string;
 }
+/**
+ * Resolve the hosted zone for a pattern domain from explicit identity only
+ * (H2). Throws when no identity is given or when the domain falls outside
+ * the declared zone. The D2 precedence (explicit `managedDomain` beats the
+ * CLI-injected binding, ahead of the BYO `zoneName`/`hostedZoneId` chain)
+ * and the binding-vs-exports zone-id branch live in the shared
+ * `resolveEffectiveManagedDomain` — the same resolution the ECS networking
+ * lane consumes.
+ */
 export declare function resolvePatternZone(request: PatternDomainRequest): ResolvedPatternZone;
 /**
  * Resolve the CloudFront viewer certificate for a pattern domain (H3/D3).

package/dist/lib/patterns/aws/patternDomain.js

@@ -30,37 +30,30 @@ import { Certificate } from "aws-cdk-lib/aws-certificatemanager";
 import { HostedZone } from "aws-cdk-lib/aws-route53";
 import { DomainCertificate } from "../../resources/aws/networking/index.js";
 import { isManagedDomainBinding, isWithinZone } from "../../utils/domainTypes.js";
-import { readInjectedManagedDomainBinding } from "../../utils/managedDomainContext.js";
+import { readInjectedManagedDomainCoverage, resolveEffectiveManagedDomain } from "../../utils/managedDomainContext.js";
+import { certNameMatches } from "../../resources/aws/compute/ingressProfile.js";
+import { cdnOriginRefusal } from "./cdnAppOrigin.js";
 const US_EAST_1 = "us-east-1";
 /**
  * Resolve the hosted zone for a pattern domain from explicit identity only
- * (H2). Throws when no identity is given or when the domain falls outside the
- * declared zone.
+ * (H2). Throws when no identity is given or when the domain falls outside
+ * the declared zone. The D2 precedence (explicit `managedDomain` beats the
+ * CLI-injected binding, ahead of the BYO `zoneName`/`hostedZoneId` chain)
+ * and the binding-vs-exports zone-id branch live in the shared
+ * `resolveEffectiveManagedDomain` — the same resolution the ECS networking
+ * lane consumes.
  */
-/**
- * Effective managed-domain identity for a request (D2): an EXPLICIT
- * `managedDomain` prop wins over the CLI-injected context binding (explicit
- * beats injected), and the context read sits ahead of the BYO
- * `zoneName`/`hostedZoneId` chain. Bare-CDK synth carries no context entry
- * and falls straight through to the explicit props.
- */
-function resolveEffectiveManagedDomain(request) {
-    return (request.identity.managedDomain ??
-        readInjectedManagedDomainBinding(request.scope.node, request.domain, request.context));
-}
 export function resolvePatternZone(request) {
     const { scope, idPrefix, context, domain, identity } = request;
-    const managed = resolveEffectiveManagedDomain(request);
-    if (managed !== undefined) {
-        assertDomainWithinZone(context, domain, managed.zoneName);
-        const hostedZoneId = isManagedDomainBinding(managed)
-            ? // CLI-injected literal (D2) — carries no Fn.importValue constraint.
-                managed.hostedZoneId
-            : // Legacy export-name fallback — same-account, same-region only.
-                Fn.importValue(managed.hostedZoneIdExport);
+    const effective = effectiveManagedDomainFor(request);
+    if (effective !== undefined) {
+        assertDomainWithinZone(context, domain, effective.zoneName);
         return {
-            hostedZone: HostedZone.fromHostedZoneAttributes(scope, `${idPrefix}ManagedHostedZone`, { hostedZoneId, zoneName: managed.zoneName }),
-            zoneName: managed.zoneName
+            hostedZone: HostedZone.fromHostedZoneAttributes(scope, `${idPrefix}ManagedHostedZone`, {
+                hostedZoneId: effective.hostedZoneId,
+                zoneName: effective.zoneName
+            }),
+            zoneName: effective.zoneName
         };
     }
     if (identity.zoneName !== undefined) {
@@ -110,8 +103,11 @@ export function resolvePatternZone(request) {
  */
 export function resolvePatternCloudFrontCertificate(request, zone) {
     const { scope, app, idPrefix, context, domain, identity } = request;
-    const managed = resolveEffectiveManagedDomain(request);
-    if (managed !== undefined && isManagedDomainBinding(managed)) {
+    const effective = effectiveManagedDomainFor(request);
+    const managed = effective?.managed;
+    if (effective !== undefined &&
+        managed !== undefined &&
+        isManagedDomainBinding(managed)) {
         const arn = managed.usEast1CertificateArn;
         if (arn === undefined) {
             throw new Error(`${context}: managed domain binding for zone '${managed.zoneName}' ` +
@@ -122,10 +118,13 @@ export function resolvePatternCloudFrontCertificate(request, zone) {
                 "'zoneName' to provision an app-owned us-east-1 certificate.");
         }
         assertUsEast1CertificateArn(context, arn);
+        assertViewerHostCovered(request, effective);
         return Certificate.fromCertificateArn(scope, `${idPrefix}ManagedCertificate`, arn);
     }
     const region = resolvedRegionOf(scope);
-    if (managed !== undefined && (region === undefined || region === US_EAST_1)) {
+    if (managed !== undefined &&
+        !isManagedDomainBinding(managed) &&
+        (region === undefined || region === US_EAST_1)) {
         // Legacy export-name form: Fn.importValue resolves same-account,
         // same-region only, so the imported certificate satisfies CloudFront
         // exactly when the app itself deploys to us-east-1. A region-unresolved
@@ -170,6 +169,40 @@ export function resolvePatternCloudFrontCertificate(request, zone) {
         exportCertificateArn: false
     }).certificate;
 }
+function effectiveManagedDomainFor(request) {
+    return resolveEffectiveManagedDomain(request.scope.node, request.identity.managedDomain, request.domain, request.context);
+}
+/**
+ * E11 — the requested viewer hostname against the managed us-east-1 viewer
+ * certificate's declared hosts (D5 coverage context). A definite miss fails
+ * CloudFront's own alias-vs-certificate validation at deploy with an opaque
+ * InvalidViewerCertificate — refuse at synth with the cure instead. Absent
+ * or provenance-gated coverage stays SILENT (no warning): CloudFront
+ * validates at deploy regardless, so unknown coverage carries no runtime
+ * risk here — unlike the origin lane's W1, where an uncovered hostname only
+ * fails at request time.
+ */
+function assertViewerHostCovered(request, effective) {
+    // D5 provenance gate: an explicit pinned binding may name an OLDER
+    // certificate the current coverage does not describe.
+    if (effective.explicitPinnedBinding)
+        return;
+    const coverage = readInjectedManagedDomainCoverage(request.scope.node, effective.zoneName, request.context);
+    const hosts = coverage?.usEast1CertificateHosts;
+    if (hosts === undefined || hosts.length === 0)
+        return;
+    if (hosts.some((pattern) => certNameMatches(pattern, request.domain))) {
+        return;
+    }
+    throw cdnOriginRefusal("E11", `${request.context}: the managed domain's us-east-1 viewer certificate ` +
+        `covers ${hosts.join(", ")} — none matches '${request.domain}'. ` +
+        "CloudFront rejects a distribution whose alias its viewer " +
+        "certificate does not cover (InvalidViewerCertificate, at deploy). " +
+        `Declare '${request.domain}' (or a covering wildcard) on the domain ` +
+        "stack's cloudFront certificate and redeploy it, or set 'zoneName' " +
+        "instead of the managed domain to provision an app-owned us-east-1 " +
+        "certificate.");
+}
 function assertDomainWithinZone(context, domain, zoneName) {
     if (!isWithinZone(domain, zoneName)) {
         throw new Error(`${context}: domain '${domain}' is not within zone '${zoneName}' ` +

package/dist/lib/resources/aws/cdn/cloudFront.d.ts

@@ -90,6 +90,11 @@ export interface CloudFrontDistributionProps {
 export declare class CloudFrontDistribution extends Construct {
     readonly id: string;
     private distribution;
+    private readonly origins;
+    /** Shared S3 access identities, keyed by the owning stack (see
+     * `s3OriginAccessIdentityFor` for why the key is a Stack). */
+    private readonly s3AccessIdentities;
+    private s3AccessControl?;
     constructor(scope: Construct, id: string, props: CloudFrontDistributionProps);
     /**
      * Build a composable CloudFront Function for VIEWER_REQUEST.
@@ -107,7 +112,39 @@ export declare class CloudFrontDistribution extends Construct {
     /** SPA fallback: serve /index.html @200 for 403/404 so client-side routing
      * handles the path. CloudFront returns 403 (not 404) for missing S3 keys. */
     private buildSpaErrorResponses;
+    /**
+     * One `IOrigin` per distinct origin configuration: behaviours that
+     * resolve to the same origin (same bucket/ALB/hostname with the same
+     * options) share a single distribution origin entry instead of minting an
+     * identical one per behaviour. Token-bearing hostnames (e.g. a Lambda
+     * function URL) memoize per token instance — two independently-derived
+     * tokens never share, which is the safe direction.
+     */
     private createOrigin;
+    private static originKey;
+    /**
+     * S3 access identities are created HERE, at a position-independent scope,
+     * and handed to `S3BucketOrigin` — never left to CDK's default, which
+     * creates them under the distribution's positional `Origin${n}` child.
+     * An OAI/OAC is semantically "the identity this distribution presents to
+     * S3": one per distribution, shared by every S3 origin. Position-scoped
+     * identities couple a DEPLOYED IAM resource's logical ID to the origin
+     * list's order — origin dedup (or any behaviour insertion) would then
+     * silently delete/repurpose a live OAI and atomically swap the bucket
+     * policy it gates, 403-ing the paths the edge still serves with the old
+     * identity until the distribution update propagates.
+     *
+     * Cross-stack buckets get their identity in the BUCKET's stack (same rule
+     * CDK's default applies): the bucket policy must reference the OAI, and a
+     * distribution-stack OAI would complete a cycle with the CDN stack's
+     * reference to the bucket.
+     */
+    private s3OriginAccessIdentityFor;
+    /** OAC twin of `s3OriginAccessIdentityFor` — an OAC is a signing config,
+     * not a bucket grant (bucket policies key on the distribution ARN), so a
+     * single distribution-scoped one serves every OAC origin. */
+    private s3OriginAccessControl;
+    private buildOrigin;
     private resolveCachePolicy;
     private resolveAllowedMethods;
     private resolveOriginProtocolPolicy;

package/dist/lib/resources/aws/cdn/cloudFront.js

@@ -1,12 +1,17 @@
 import { Construct } from "constructs";
-import { CfnOutput } from "aws-cdk-lib";
+import { CfnOutput, Names, Stack } from "aws-cdk-lib";
 import { toPascalCase } from "../../../utils/capitaliseString.js";
 import { cdnDomainExportName } from "@fjall/util";
-import { Distribution, PriceClass, ViewerProtocolPolicy, CachePolicy, OriginRequestPolicy, AllowedMethods, OriginProtocolPolicy, Function as CloudFrontFunction, FunctionCode, FunctionRuntime, FunctionEventType } from "aws-cdk-lib/aws-cloudfront";
+import { Distribution, PriceClass, ViewerProtocolPolicy, CachePolicy, OriginRequestPolicy, AllowedMethods, OriginProtocolPolicy, Function as CloudFrontFunction, FunctionCode, FunctionRuntime, FunctionEventType, OriginAccessIdentity, S3OriginAccessControl } from "aws-cdk-lib/aws-cloudfront";
 import { S3BucketOrigin, LoadBalancerV2Origin, HttpOrigin } from "aws-cdk-lib/aws-cloudfront-origins";
 export class CloudFrontDistribution extends Construct {
     id;
     distribution;
+    origins = new Map();
+    /** Shared S3 access identities, keyed by the owning stack (see
+     * `s3OriginAccessIdentityFor` for why the key is a Stack). */
+    s3AccessIdentities = new Map();
+    s3AccessControl;
     constructor(scope, id, props) {
         super(scope, id);
         this.id = id;
@@ -144,7 +149,92 @@ export class CloudFrontDistribution extends Construct {
             responsePagePath: "/index.html"
         }));
     }
+    /**
+     * One `IOrigin` per distinct origin configuration: behaviours that
+     * resolve to the same origin (same bucket/ALB/hostname with the same
+     * options) share a single distribution origin entry instead of minting an
+     * identical one per behaviour. Token-bearing hostnames (e.g. a Lambda
+     * function URL) memoize per token instance — two independently-derived
+     * tokens never share, which is the safe direction.
+     */
     createOrigin(config) {
+        const key = CloudFrontDistribution.originKey(config);
+        const memoized = this.origins.get(key);
+        if (memoized !== undefined) {
+            return memoized;
+        }
+        const origin = this.buildOrigin(config);
+        this.origins.set(key, origin);
+        return origin;
+    }
+    static originKey(config) {
+        switch (config.type) {
+            case "s3":
+                return [
+                    "s3",
+                    config.bucket.node.addr,
+                    config.originPath ?? "",
+                    config.originAccess ?? ""
+                ].join("|");
+            case "alb":
+                return [
+                    "alb",
+                    config.loadBalancer.node.addr,
+                    config.httpPort ?? "",
+                    config.httpsPort ?? "",
+                    config.protocolPolicy ?? ""
+                ].join("|");
+            case "http":
+                return [
+                    "http",
+                    config.domainName,
+                    config.originPath ?? "",
+                    config.httpPort ?? "",
+                    config.httpsPort ?? "",
+                    config.protocolPolicy ?? ""
+                ].join("|");
+        }
+    }
+    /**
+     * S3 access identities are created HERE, at a position-independent scope,
+     * and handed to `S3BucketOrigin` — never left to CDK's default, which
+     * creates them under the distribution's positional `Origin${n}` child.
+     * An OAI/OAC is semantically "the identity this distribution presents to
+     * S3": one per distribution, shared by every S3 origin. Position-scoped
+     * identities couple a DEPLOYED IAM resource's logical ID to the origin
+     * list's order — origin dedup (or any behaviour insertion) would then
+     * silently delete/repurpose a live OAI and atomically swap the bucket
+     * policy it gates, 403-ing the paths the edge still serves with the old
+     * identity until the distribution update propagates.
+     *
+     * Cross-stack buckets get their identity in the BUCKET's stack (same rule
+     * CDK's default applies): the bucket policy must reference the OAI, and a
+     * distribution-stack OAI would complete a cycle with the CDN stack's
+     * reference to the bucket.
+     */
+    s3OriginAccessIdentityFor(bucket) {
+        const bucketStack = Stack.of(bucket);
+        const existing = this.s3AccessIdentities.get(bucketStack);
+        if (existing !== undefined) {
+            return existing;
+        }
+        const sameStack = bucketStack === Stack.of(this);
+        const identity = sameStack
+            ? new OriginAccessIdentity(this, "S3OriginAccessIdentity", {
+                comment: `Identity for ${this.node.path}`
+            })
+            : new OriginAccessIdentity(bucketStack, `${Names.uniqueId(this)}S3OriginAccessIdentity`, { comment: `Identity for ${this.node.path}` });
+        this.s3AccessIdentities.set(bucketStack, identity);
+        return identity;
+    }
+    /** OAC twin of `s3OriginAccessIdentityFor` — an OAC is a signing config,
+     * not a bucket grant (bucket policies key on the distribution ARN), so a
+     * single distribution-scoped one serves every OAC origin. */
+    s3OriginAccessControl() {
+        this.s3AccessControl ??= new S3OriginAccessControl(this, "S3OriginAccessControl");
+        return this.s3AccessControl;
+    }
+    buildOrigin(config) {
         switch (config.type) {
             case "s3":
                 // OAC (single-stack only) is safe when the bucket and distribution live
@@ -153,11 +243,13 @@ export class CloudFrontDistribution extends Construct {
                 // See: https://github.com/aws/aws-cdk/issues/31462
                 if (config.originAccess === "oac") {
                     return S3BucketOrigin.withOriginAccessControl(config.bucket, {
-                        originPath: config.originPath
+                        originPath: config.originPath,
+                        originAccessControl: this.s3OriginAccessControl()
                     });
                 }
                 return S3BucketOrigin.withOriginAccessIdentity(config.bucket, {
-                    originPath: config.originPath
+                    originPath: config.originPath,
+                    originAccessIdentity: this.s3OriginAccessIdentityFor(config.bucket)
                 });
             case "alb":
                 return new LoadBalancerV2Origin(config.loadBalancer, {

package/dist/lib/resources/aws/compute/ecs.d.ts

@@ -4,11 +4,13 @@ import { Construct } from "constructs";
 import type { StackBuilder } from "../base/awsStack.js";
 import type { ApplicationListener, ApplicationLoadBalancer } from "aws-cdk-lib/aws-elasticloadbalancingv2";
 import { type EcsClusterProps } from "./ecsTypes.js";
+import { type EcsIngressProfile } from "./ingressProfile.js";
 export * from "./ecsTypes.js";
 export * from "./ecsConstants.js";
 export * from "./ecsContext.js";
 export * from "./ecsTaskDefinition.js";
 export * from "./ecsNetworking.js";
+export * from "./ingressProfile.js";
 export { CapacityProviderDependencyAspect } from "./ecsCapacityProviderAspect.js";
 export { validateEcsClusterProps, validateEcsDomainConfig, validateSsmPathComponent } from "./ecsValidation.js";
 export * from "./ecsServiceFactory.js";
@@ -54,6 +56,7 @@ export default class EcsCluster extends Construct implements IConnectable {
     private loadBalancer?;
     private loadBalancerListener?;
     private certificate?;
+    private ingressProfile?;
     private asgState;
     private services;
     private scheduledTaskDefinitions;
@@ -69,6 +72,14 @@ export default class EcsCluster extends Construct implements IConnectable {
     getLoadBalancer(): ApplicationLoadBalancer | undefined;
     /** Get the load balancer's listener. Undefined if disabled. */
     getListener(): ApplicationListener | undefined;
+    /**
+     * Synth-time ingress profile (design 2026-08-18 cdn-app-origin, D2):
+     * listener facts (default-action predicate, rule structure, port), the
+     * cluster's zone identity, and certificate coverage — for downstream
+     * constructs that front this cluster. Undefined when the cluster has no
+     * load balancer.
+     */
+    getIngressProfile(): EcsIngressProfile | undefined;
     /** Get a specific service by name. */
     getService(name: string): FargateService | Ec2Service | undefined;
     /** Get all services in this cluster. */

package/dist/lib/resources/aws/compute/ecs.js

@@ -12,12 +12,14 @@ import { validateEcsClusterProps } from "./ecsValidation.js";
 import { createExecutionRole, createTaskRole, createTaskDefinition, addContainersToTask, isServiceFargate, isServiceEc2 } from "./ecsTaskDefinition.js";
 import { addLoadBalancer, addLoadBalancerListener, addHostedZone, addDirectAccessOutputs, addRedirectHostRules, registerServiceWithALB } from "./ecsNetworking.js";
 import { createService, addServiceScaling, getOrCreateAsgCapacityProvider } from "./ecsServiceFactory.js";
+import { buildIngressProfile, warnWhenRecordedApexUnforwarded } from "./ingressProfile.js";
 // Re-export all types/enums/constants so existing consumers are not broken
 export * from "./ecsTypes.js";
 export * from "./ecsConstants.js";
 export * from "./ecsContext.js";
 export * from "./ecsTaskDefinition.js";
 export * from "./ecsNetworking.js";
+export * from "./ingressProfile.js";
 export { CapacityProviderDependencyAspect } from "./ecsCapacityProviderAspect.js";
 export { validateEcsClusterProps, validateEcsDomainConfig, validateSsmPathComponent } from "./ecsValidation.js";
 export * from "./ecsServiceFactory.js";
@@ -64,6 +66,7 @@ export default class EcsCluster extends Construct {
     loadBalancer;
     loadBalancerListener;
     certificate;
+    ingressProfile;
     // EC2-specific (mutable state shared with ecsServiceFactory)
     asgState = {
         providers: new Map(),
@@ -113,6 +116,20 @@ export default class EcsCluster extends Construct {
             if (hzResult?.redirectRules !== undefined) {
                 addRedirectHostRules(this.ctx, this.loadBalancerListener, hzResult.redirectRules, this.priorityState);
             }
+            // D2 (design 2026-08-18 cdn-app-origin): the synth-time answer to
+            // "what does this cluster's listener actually do?", assembled from the
+            // same facts the emitters above used — never re-derived from props by
+            // downstream consumers (the Cdn construct-reference origin lane).
+            this.ingressProfile = buildIngressProfile({
+                loadBalancer: this.loadBalancer,
+                internal: props.cluster?.loadBalancer === "internal",
+                services: props.services,
+                certificateAttached: this.certificate !== undefined,
+                zoneFacts: hzResult?.ingress
+            });
+            if (hzResult?.ingress !== undefined) {
+                warnWhenRecordedApexUnforwarded(this.ingressProfile, hzResult.ingress.apexRecordMinted, props.clusterName);
+            }
         }
         else if (this.directAccessEnabled) {
             addDirectAccessOutputs(this.ctx, this.asgState.autoScalingGroup);
@@ -154,6 +171,16 @@ export default class EcsCluster extends Construct {
     getListener() {
         return this.loadBalancerListener;
     }
+    /**
+     * Synth-time ingress profile (design 2026-08-18 cdn-app-origin, D2):
+     * listener facts (default-action predicate, rule structure, port), the
+     * cluster's zone identity, and certificate coverage — for downstream
+     * constructs that front this cluster. Undefined when the cluster has no
+     * load balancer.
+     */
+    getIngressProfile() {
+        return this.ingressProfile;
+    }
     /** Get a specific service by name. */
     getService(name) {
         return this.services.get(name)?.service;

package/dist/lib/resources/aws/compute/ecsNetworking.d.ts

@@ -5,6 +5,7 @@ import { type ARecord, type IHostedZone } from "aws-cdk-lib/aws-route53";
 import type { AutoScalingGroup } from "aws-cdk-lib/aws-autoscaling";
 import type { ContainerDefinition, FargateService, Ec2Service } from "aws-cdk-lib/aws-ecs";
 import { SecurityGroup } from "../networking/securityGroup.js";
+import { type EcsIngressZoneFacts } from "./ingressProfile.js";
 import type { EcsConstructContext } from "./ecsContext.js";
 import type { EcsServiceProps } from "./ecsTypes.js";
 import { type PriorityState } from "./hostHeaderListenerRule.js";
@@ -40,6 +41,7 @@ export declare function addHostedZone(ctx: EcsConstructContext, loadBalancer?: A
     aRecord?: ARecord;
     additionalListenerCertificates?: IListenerCertificate[];
     redirectRules?: EcsRedirectRuleConfig;
+    ingress?: EcsIngressZoneFacts;
 };
 export declare function addDirectAccessOutputs(ctx: EcsConstructContext, autoScalingGroup?: AutoScalingGroup): void;
 export declare function registerServiceWithALB(ctx: EcsConstructContext, listener: ApplicationListener, serviceName: string, serviceProps: EcsServiceProps, service: FargateService | Ec2Service, primaryContainer: ContainerDefinition, priorityState: PriorityState): IApplicationTargetGroup;