@fjall/components-infrastructure 14.1.0 → 14.3.0

package/dist/lib/resources/aws/compute/ecsNetworking.js

@@ -8,8 +8,9 @@ import { LoadBalancerTarget } from "aws-cdk-lib/aws-route53-targets";
 import { DomainCertificate } from "../networking/domainCertificate.js";
 import { AliasRecord } from "../networking/dnsRecord/aliasRecord.js";
 import { SecurityGroup } from "../networking/securityGroup.js";
-import { DNS_APEX, isManagedDomainBinding, isWithinZone } from "../../../utils/domainTypes.js";
-import { readInjectedManagedDomainBinding } from "../../../utils/managedDomainContext.js";
+import { isManagedDomainBinding, isWithinZone, recordLabelWithin } from "../../../utils/domainTypes.js";
+import { readInjectedManagedDomainCoverage, resolveEffectiveManagedDomain } from "../../../utils/managedDomainContext.js";
+import { computeListenerDefault404, planListenerRules } from "./ingressProfile.js";
 import { ResourceNaming } from "../../../utils/resourceNaming.js";
 import { stackScopedExportName } from "../../../utils/exportNaming.js";
 import { registerAlbAliasTarget } from "../../../utils/albAliasTargetRegistry.js";
@@ -99,24 +100,15 @@ export function addLoadBalancer(ctx, anyServiceUsesEc2, asgSecurityGroup) {
 }
 export function addLoadBalancerListener(ctx, loadBalancer, certificate, additionalCertificates) {
     const port = certificate ? 443 : 80;
-    const servicesWithPorts = ctx.props.services.filter((s) => s.containers.some((c) => c.port !== undefined));
-    const willHaveMultipleRoutes = servicesWithPorts.length > 1 ||
-        servicesWithPorts.some((s) => {
-            const rules = Array.isArray(s.routing)
-                ? s.routing
-                : s.routing
-                    ? [s.routing]
-                    : [];
-            return rules.length > 1;
-        });
-    // CDK rejects listeners with neither a default action nor target groups.
-    const noServicePorts = servicesWithPorts.length === 0;
     return addRoutingListener(loadBalancer, `${ctx.props.clusterName}Listener`, {
         port,
         ...(certificate && { certificate }),
         ...(additionalCertificates !== undefined &&
             additionalCertificates.length > 0 && { additionalCertificates }),
-        default404: willHaveMultipleRoutes || noServicePorts
+        // Single home for the default-action predicate (ingressProfile.ts): the
+        // ingress profile exports the same value, so downstream verdicts model
+        // the listener the emitter actually built (design cdn-app-origin, P5).
+        default404: computeListenerDefault404(ctx.props.services)
     });
 }
 /**
@@ -190,12 +182,6 @@ function preWrapperLogicalId(scope, id) {
         .slice(0, 240);
     return human + hash;
 }
-/** Record label for `fqdn` relative to `zoneName` (apex → `@`). */
-function recordLabelWithin(fqdn, zoneName) {
-    return fqdn === zoneName
-        ? DNS_APEX
-        : fqdn.slice(0, fqdn.length - zoneName.length - 1);
-}
 export function addHostedZone(ctx, loadBalancer) {
     const props = ctx.props;
     const domainConfig = props.cluster?.domainConfig;
@@ -206,31 +192,25 @@ export function addHostedZone(ctx, loadBalancer) {
     let hostedZone;
     let zoneName;
     let certificate;
-    // D2 — explicit props.managedDomain wins over the CLI-injected context
-    // binding (explicit beats injected); the context read sits ahead of the
-    // BYO domainConfig.hostedZone chain. Bare-CDK synth has no context entry.
-    const managed = domainConfig?.managedDomain ??
-        readInjectedManagedDomainBinding(ctx.scope.node, domainName, `Cluster '${props.clusterName}'`);
-    if (managed) {
-        zoneName = managed.zoneName;
-        if (isManagedDomainBinding(managed)) {
-            // D2 binding: concrete values injected by the CLI at deploy time —
-            // literals cross accounts and regions where Fn.importValue cannot.
-            hostedZone = AWSHostedZone.fromHostedZoneAttributes(ctx.scope, `${props.clusterName}ManagedHostedZone`, {
-                hostedZoneId: managed.hostedZoneId,
-                zoneName: managed.zoneName
-            });
-            if (managed.certificateArn !== undefined) {
-                certificate = Certificate.fromCertificateArn(ctx.scope, `${props.clusterName}ManagedCertificate`, managed.certificateArn);
-            }
-        }
-        else {
-            // Export-name fallback (bare-CDK synth): same account, same region only.
-            hostedZone = AWSHostedZone.fromHostedZoneAttributes(ctx.scope, `${props.clusterName}ManagedHostedZone`, {
-                hostedZoneId: Fn.importValue(managed.hostedZoneIdExport),
-                zoneName: managed.zoneName
-            });
-            certificate = Certificate.fromCertificateArn(ctx.scope, `${props.clusterName}ManagedCertificate`, Fn.importValue(managed.certificateArnExport));
+    // D2 — the shared precedence and zone-id branch live in
+    // resolveEffectiveManagedDomain (explicit beats injected; binding literal
+    // beats exports Fn.importValue). Bare-CDK synth has no context entry.
+    const effectiveManaged = resolveEffectiveManagedDomain(ctx.scope.node, domainConfig?.managedDomain, domainName, `Cluster '${props.clusterName}'`);
+    const managed = effectiveManaged?.managed;
+    if (effectiveManaged !== undefined && managed !== undefined) {
+        zoneName = effectiveManaged.zoneName;
+        hostedZone = AWSHostedZone.fromHostedZoneAttributes(ctx.scope, `${props.clusterName}ManagedHostedZone`, {
+            hostedZoneId: effectiveManaged.hostedZoneId,
+            zoneName: effectiveManaged.zoneName
+        });
+        // The regional-certificate lane stays per-form: a binding may omit the
+        // ARN (no regional certificate declared), the exports form always
+        // imports it.
+        const certificateArn = isManagedDomainBinding(managed)
+            ? managed.certificateArn
+            : Fn.importValue(managed.certificateArnExport);
+        if (certificateArn !== undefined) {
+            certificate = Certificate.fromCertificateArn(ctx.scope, `${props.clusterName}ManagedCertificate`, certificateArn);
         }
     }
     else if (domainConfig?.hostedZone) {
@@ -302,6 +282,10 @@ export function addHostedZone(ctx, loadBalancer) {
         }
     }
     const subjectAlternativeNames = [...routedHosts, ...redirectHosts].filter((h) => h !== domainName);
+    // Captured BEFORE the BYO override below: whether the managed lane
+    // attached the binding's (or export fallback's) certificate — the D5
+    // coverage context describes exactly that certificate, never a BYO one.
+    const managedCertificateAttached = certificate !== undefined;
     if (domainConfig?.certificate) {
         certificate = domainConfig.certificate;
     }
@@ -332,7 +316,55 @@ export function addHostedZone(ctx, loadBalancer) {
             exportCertificateArn: false
         }).certificate;
     }
-    const additionalListenerCertificates = resolveAdditionalListenerCertificates(ctx.scope, props.clusterName, domainConfig?.additionalCertificates, managed);
+    // D5 provenance gate (design 2026-08-18 cdn-app-origin): the coverage
+    // context describes the zone's CURRENT certificates — the same D2
+    // resolution that produces an injected binding. An EXPLICIT pinned BINDING
+    // may name OLDER ARNs the current coverage does not describe, so folding
+    // it would over-claim and invert P3 (TLS fails at runtime after E6 passes
+    // the hostname as covered); it stays opaque, exactly as if no coverage
+    // context existed (see EffectiveManagedDomain.explicitPinnedBinding). The
+    // explicit EXPORTS form is unaffected: Fn.importValue resolves at deploy
+    // to the zone's current certificate — the one the coverage describes.
+    const injectedCoverage = effectiveManaged !== undefined && !effectiveManaged.explicitPinnedBinding
+        ? readInjectedManagedDomainCoverage(ctx.scope.node, effectiveManaged.zoneName, `Cluster '${props.clusterName}'`)
+        : undefined;
+    // One walk over the additional-certificate sources yields both the
+    // listener attachments and their coverage facts — the fold below never
+    // re-discriminates the source list.
+    const additional = resolveAdditionalListenerCertificates(ctx.scope, props.clusterName, domainConfig?.additionalCertificates, managed, injectedCoverage?.usEast1CertificateHosts);
+    const additionalListenerCertificates = additional.certificates;
+    // D5 certificate coverage: fold the SAN set of every certificate the
+    // listener will carry, where knowable at synth. The cluster-minted
+    // certificate's set is the literal minted above; managed certificates are
+    // described by the CLI-injected coverage context (absent → opaque, a
+    // domain stack predating the hosts outputs); BYO imports are opaque by
+    // nature. Fail-open to "partial"/"unknown", never to a false "covered" —
+    // consumers (the Cdn origin lane) error only on enumerated non-coverage
+    // and warn on opacity.
+    const knownCertificateHosts = [];
+    let anyOpaqueCertificate = false;
+    if (domainConfig?.certificate) {
+        anyOpaqueCertificate = true;
+    }
+    else if (managedCertificateAttached) {
+        if (injectedCoverage?.certificateHosts !== undefined) {
+            knownCertificateHosts.push(...injectedCoverage.certificateHosts);
+        }
+        else {
+            anyOpaqueCertificate = true;
+        }
+    }
+    else {
+        knownCertificateHosts.push(domainName, ...subjectAlternativeNames);
+    }
+    knownCertificateHosts.push(...additional.knownHosts);
+    anyOpaqueCertificate = anyOpaqueCertificate || additional.anyOpaque;
+    const dedupedCertificateHosts = [...new Set(knownCertificateHosts)];
+    const certificateCoverage = anyOpaqueCertificate
+        ? dedupedCertificateHosts.length > 0
+            ? { kind: "partial", hostnames: dedupedCertificateHosts }
+            : { kind: "unknown" }
+        : { kind: "enumerated", hostnames: dedupedCertificateHosts };
     let aRecord;
     if (loadBalancer) {
         const routingPolicy = domainConfig?.routingPolicy;
@@ -430,7 +462,16 @@ export function addHostedZone(ctx, loadBalancer) {
         }),
         ...(redirectHosts.length > 0 && {
             redirectRules: { hostFqdns: redirectHosts, targetHost: domainName }
-        })
+        }),
+        ingress: {
+            hostedZone,
+            zoneName,
+            domainName,
+            routedHosts,
+            redirectHosts,
+            apexRecordMinted: loadBalancer !== undefined && domainConfig?.apexRecord !== "none",
+            certificateCoverage
+        }
     };
 }
 const US_EAST_1 = "us-east-1";
@@ -442,13 +483,18 @@ const US_EAST_1 = "us-east-1";
  * anything else fails at synth rather than as CloudFormation's opaque
  * deploy-time rejection.
  */
-function resolveAdditionalListenerCertificates(scope, clusterName, sources, managed) {
-    if (sources === undefined || sources.length === 0)
-        return [];
+function resolveAdditionalListenerCertificates(scope, clusterName, sources, managed, usEast1CertificateHosts) {
     const certificates = [];
+    const knownHosts = [];
+    let anyOpaque = false;
+    if (sources === undefined || sources.length === 0) {
+        return { certificates, knownHosts, anyOpaque };
+    }
     for (const source of sources) {
         if ("certificateArn" in source) {
+            // BYO import — opaque by nature.
             certificates.push(ListenerCertificate.fromArn(source.certificateArn));
+            anyOpaque = true;
             continue;
         }
         if (managed === undefined ||
@@ -482,8 +528,16 @@ function resolveAdditionalListenerCertificates(scope, clusterName, sources, mana
                 "stack, or supply certificateArn for a same-region certificate.");
         }
         certificates.push(ListenerCertificate.fromArn(arn));
+        // The managed us-east-1 certificate's hosts, when the coverage context
+        // describes them (absent → a domain stack predating the hosts outputs).
+        if (usEast1CertificateHosts !== undefined) {
+            knownHosts.push(...usEast1CertificateHosts);
+        }
+        else {
+            anyOpaque = true;
+        }
     }
-    return certificates;
+    return { certificates, knownHosts, anyOpaque };
 }
 export function addDirectAccessOutputs(ctx, autoScalingGroup) {
     if (!ctx.directAccessEnabled || !autoScalingGroup)
@@ -506,15 +560,17 @@ export function addDirectAccessOutputs(ctx, autoScalingGroup) {
 }
 export function registerServiceWithALB(ctx, listener, serviceName, serviceProps, service, primaryContainer, priorityState) {
     const containerPort = primaryContainer.containerPort;
-    // Normalise routing to array
-    const routingRules = Array.isArray(serviceProps.routing)
-        ? serviceProps.routing
-        : serviceProps.routing
-            ? [serviceProps.routing]
-            : [];
+    // The single home of the listener branching (P5, ingressProfile.ts): the
+    // ingress profile's rule model derives from this same plan, so what the
+    // profile reports is what this emitter builds.
+    const servicePlan = planListenerRules(ctx.props.services, []).services.find((plan) => plan.service === serviceProps);
+    if (servicePlan === undefined) {
+        throw new Error(`Service '${serviceName}' is not in the listener rule plan — ` +
+            "registerServiceWithALB was called for a service with no container " +
+            "ports, which can never receive listener traffic.");
+    }
+    const { routingRules } = servicePlan;
     const healthCheckPath = routingRules.find((r) => r.healthCheckPath)?.healthCheckPath ?? "/";
-    const servicesWithPorts = ctx.props.services.filter((s) => s.containers.some((c) => c.port !== undefined));
-    const isSingleService = servicesWithPorts.length === 1;
     const healthCheckConfig = isServiceEc2(serviceProps)
         ? {
             interval: Duration.seconds(30),
@@ -530,7 +586,7 @@ export function registerServiceWithALB(ctx, listener, serviceName, serviceProps,
             port: `${containerPort}`,
             timeout: Duration.seconds(10)
         };
-    if (isSingleService && routingRules.length <= 1) {
+    if (servicePlan.mode === "default") {
         return listener.addTargets(`${serviceName}TargetGroup`, {
             targets: [
                 service.loadBalancerTarget({

package/dist/lib/resources/aws/compute/ingressProfile.d.ts

@@ -0,0 +1,203 @@
+/**
+ * Synth-time ingress profile for an ECS cluster's ALB (design 2026-08-18
+ * cdn-app-origin, D2). The profile is the one sanctioned answer to "what
+ * does this cluster's listener actually do?" for downstream constructs —
+ * today the `Cdn` construct-reference origin lane, which needs a TLS-valid
+ * origin hostname, certificate coverage, and a forwarding verdict without
+ * re-deriving any of it from props.
+ *
+ * P5 (model the machinery, don't paraphrase it): every fact here is exported
+ * from the SAME computation the emitting code uses — `default404` is the
+ * predicate `addLoadBalancerListener` passes to the listener factory, the
+ * rule structure derives from the `planListenerRules` plan that
+ * `registerServiceWithALB` itself emits from (including the single-service
+ * conditions-dropped branch), and the covered SAN set is the one
+ * `addHostedZone` mints. Never recompute these facts from cluster props
+ * elsewhere; extend the plan or the profile instead.
+ */
+import type { IApplicationLoadBalancer } from "aws-cdk-lib/aws-elasticloadbalancingv2";
+import type { IHostedZone } from "aws-cdk-lib/aws-route53";
+import type { EcsRoutingConfig, EcsServiceProps } from "./ecsTypes.js";
+/**
+ * What the certificates ATTACHED to the cluster's listener are known to
+ * cover at synth:
+ *
+ * - `enumerated` — every attached certificate's host set is synth-known
+ *   (cluster-minted certs, or managed certs described by the D5 coverage
+ *   context). `hostnames` is complete: a non-matching name is provably
+ *   uncovered.
+ * - `partial` — `hostnames` collects the known certs' hosts, but at least
+ *   one attached certificate is opaque (imported ARN with no coverage
+ *   context), so a non-matching name may still be covered.
+ * - `unknown` — only opaque certificates are attached.
+ */
+export type CertificateCoverage = {
+    kind: "enumerated";
+    hostnames: string[];
+} | {
+    kind: "partial";
+    hostnames: string[];
+} | {
+    kind: "unknown";
+};
+export type CoverageAnswer = "covered" | "unknown" | "not-covered";
+/**
+ * One listener rule as it will actually be emitted. `host` and `path` are
+ * ANDed when both present (`buildRoutingConditions`). Rules the emitter
+ * DROPS — a single ports-bearing service with ≤1 routing rule loses its
+ * conditions and becomes the listener default (`registerServiceWithALB`) —
+ * are deliberately absent here, exactly as they are absent from the ALB.
+ */
+export interface EcsIngressRule {
+    host?: string;
+    path?: string;
+    kind: "forward" | "redirect";
+}
+export interface EcsIngressProfile {
+    loadBalancer: IApplicationLoadBalancer;
+    /** `cluster.loadBalancer === "internal"` — unreachable as a CloudFront origin. */
+    internal: boolean;
+    /** 443 iff a certificate resolved — the cluster ALB has exactly one listener. */
+    listenerPort: 443 | 80;
+    /**
+     * The cluster's resolved zone — the SAME `IHostedZone` instance the
+     * cluster's own records claim with, so a downstream record (the Cdn's
+     * origin record) claims under the identical zone identity. The DNS claim
+     * registry keys on the literal hosted-zone ID; a name-derived re-import
+     * would register under a different key and silently defeat same-name
+     * collision detection.
+     */
+    hostedZone?: IHostedZone;
+    zoneName?: string;
+    domainName?: string;
+    /** Every `services[].routing[].host`, deduped, in declaration order. */
+    routedHosts: string[];
+    redirectHosts: string[];
+    /**
+     * The listener's actual default-action predicate: `true` → fixed-404
+     * default; `false` → the sole target group IS the default action and the
+     * listener forwards EVERY hostname.
+     */
+    default404: boolean;
+    rules: EcsIngressRule[];
+    certificateCoverage: CertificateCoverage;
+}
+/**
+ * Zone-derived profile ingredients assembled by `addHostedZone`, where the
+ * zone, hosts, and certificate coverage are already computed for emission.
+ */
+export interface EcsIngressZoneFacts {
+    hostedZone: IHostedZone;
+    zoneName: string;
+    domainName: string;
+    routedHosts: string[];
+    redirectHosts: string[];
+    /** False when `apexRecord: "none"` yielded the domainName record. */
+    apexRecordMinted: boolean;
+    certificateCoverage: CertificateCoverage;
+}
+/**
+ * One ports-bearing service's listener treatment. `mode: "default"` — the
+ * sole ports-bearing service with ≤1 routing rule: its target group is
+ * added UNCONDITIONED and becomes the listener default action (even a
+ * declared `routing.host` does not gate it). `mode: "rules"` — every
+ * routing rule becomes a conditioned, prioritised listener rule; the first
+ * carries the target group.
+ */
+export interface ListenerServicePlan {
+    service: EcsServiceProps;
+    /** The service's `routing` config, normalised to an array. */
+    routingRules: EcsRoutingConfig[];
+    mode: "default" | "rules";
+}
+export interface ListenerRulePlan {
+    /** Ports-bearing services in declaration order (portless services never
+     * reach the listener). */
+    services: ListenerServicePlan[];
+    redirectHosts: string[];
+}
+/**
+ * The listener's rule structure, planned once (P5). This is the SINGLE home
+ * of the branching: `registerServiceWithALB` emits from a service's plan
+ * entry, and the ingress-profile facts below (`computeListenerDefault404`,
+ * `enumerateListenerRules`) derive from the same plan — the emitter and the
+ * model cannot drift because neither re-derives the decisions.
+ */
+export declare function planListenerRules(services: EcsServiceProps[], redirectHosts: string[]): ListenerRulePlan;
+/**
+ * The listener's default-action predicate — the value
+ * `addLoadBalancerListener` passes to the listener factory as `default404`.
+ * `true` exactly when no service plan supplies an unconditioned default
+ * target group: ≥2 routes will exist (the emitter then attaches a fixed-404
+ * default and conditions every rule), or no service has a port (CDK rejects
+ * a listener with neither a default action nor targets).
+ */
+export declare function computeListenerDefault404(services: EcsServiceProps[]): boolean;
+/**
+ * The listener's rule structure as `registerServiceWithALB` and
+ * `addRedirectHostRules` will emit it — derived from the same
+ * `planListenerRules` plan the emitters consume: a `mode: "default"`
+ * service contributes NO conditioned rule (its target group is the listener
+ * default), and every redirect host contributes a host-matched 301 rule.
+ */
+export declare function enumerateListenerRules(services: EcsServiceProps[], redirectHosts: string[]): EcsIngressRule[];
+/** Lowercase and strip the trailing dot — DNS names are case-insensitive. */
+export declare function normaliseDnsName(name: string): string;
+/**
+ * RFC 6125 certificate-name match: exact, or a single-label `*.` wildcard
+ * (matches exactly one additional label — `*.example.com` covers
+ * `a.example.com`, never `example.com` or `a.b.example.com`). DNS names
+ * compare ASCII case-insensitively (RFC 6125 §6.4.1 via RFC 4343).
+ */
+export declare function certNameMatches(pattern: string, hostname: string): boolean;
+/**
+ * Does the listener's attached-certificate set cover `hostname`?
+ * Fail closed where decidable, honest where opaque (P3): only `enumerated`
+ * coverage may answer `not-covered`; a miss under `partial`/`unknown` is
+ * `unknown` because an opaque certificate may still cover the name.
+ */
+export declare function certificateCovers(coverage: CertificateCoverage, hostname: string): CoverageAnswer;
+export type ForwardingVerdict = {
+    verdict: "forwards";
+} | {
+    verdict: "partial";
+    patterns: string[];
+} | {
+    verdict: "none";
+};
+/**
+ * Would the listener forward `Host: <hostname>` requests, for all paths?
+ * Computed on the real rule model, never a flattened hostname list:
+ *
+ * - no fixed-404 default → the default action forwards every hostname;
+ * - a host-only rule for the hostname, a host-matched catch-all `/*` path
+ *   rule, or a host-less catch-all `/*` path rule, forwards all of its
+ *   paths;
+ * - rules that involve the hostname only together with a narrower path
+ *   condition (ANDed host+path, or host-less non-catch-all paths) forward
+ *   SOME paths — `partial`, with the patterns named so the caller can
+ *   surface them;
+ * - otherwise every request answers the fixed-404 default — `none`.
+ *
+ * Hostnames compare case-insensitively (DNS, RFC 4343) — the rule model
+ * carries the declared spelling, the caller's hostname may differ in case.
+ */
+export declare function forwardingVerdict(profile: EcsIngressProfile, hostname: string): ForwardingVerdict;
+export declare function buildIngressProfile(options: {
+    loadBalancer: IApplicationLoadBalancer;
+    internal: boolean;
+    services: EcsServiceProps[];
+    certificateAttached: boolean;
+    zoneFacts?: EcsIngressZoneFacts;
+}): EcsIngressProfile;
+/**
+ * W3 (design 2026-08-18 cdn-app-origin): a cluster whose listener default is
+ * fixed-404 while its `domainName` has a minted apex record and NO rule
+ * forwards it answers 404 on its own primary domain — usually the aftermath
+ * of adding a second routing rule (which flips the default action from
+ * forward to 404, `computeListenerDefault404`). A warning, not an error:
+ * pre-existing clusters can already be in this state, and narrowing them is
+ * not this check's mandate. Partial forwarding (path-split services) is the
+ * normal multi-route shape and does not warn.
+ */
+export declare function warnWhenRecordedApexUnforwarded(profile: EcsIngressProfile, apexRecordMinted: boolean, clusterName: string): void;