@fjall/components-infrastructure 14.2.0 → 14.3.0

package/dist/lib/utils/managedDomainContext.d.ts

@@ -20,7 +20,7 @@
  * layer (generator-standards § Infrastructure Layer Boundaries).
  */
 import type { Node } from "constructs";
-import type { ManagedDomainBinding, ManagedDomainCoverage } from "@fjall/util";
+import { type ManagedDomainBinding, type ManagedDomainCoverage, type ManagedDomainExports } from "@fjall/util";
 export declare const MANAGED_DOMAIN_CONTEXT_PREFIX: "fjall:managedDomain:";
 export declare function getManagedDomainContextKey(zoneName: string): string;
 /**
@@ -60,3 +60,35 @@ export declare function readInjectedManagedDomainBinding(node: Node, domainName:
  * forced this channel off the binding JSON in the first place.
  */
 export declare function readInjectedManagedDomainCoverage(node: Node, zoneName: string, context: string): ManagedDomainCoverage | undefined;
+/**
+ * The one managed-domain identity a consumer acts on, resolved by the D2
+ * precedence every lane shares: an EXPLICIT `managedDomain` prop wins over
+ * the CLI-injected context binding (explicit beats injected); bare-CDK
+ * synth carries no context entry and yields undefined.
+ */
+export interface EffectiveManagedDomain {
+    managed: ManagedDomainBinding | ManagedDomainExports;
+    zoneName: string;
+    /**
+     * Zone id ready for `HostedZone.fromHostedZoneAttributes`: the binding's
+     * literal (crosses accounts and regions), or an `Fn.importValue` token on
+     * the exports form (same-account, same-region only).
+     */
+    hostedZoneId: string;
+    /**
+     * True when the identity is an EXPLICIT binding prop. An explicit binding
+     * may pin certificate ARNs older than the zone's current ones, so the
+     * injected coverage context — which describes the CURRENT certificates —
+     * must not be applied to it (the D5 provenance gate): folding it would
+     * over-claim coverage and invert P3. Injected bindings and the exports
+     * form (which resolves at deploy to the current certificate) are safe.
+     */
+    explicitPinnedBinding: boolean;
+}
+/**
+ * Resolve the effective managed-domain identity for `domainName` — the
+ * SINGLE home of the explicit-beats-injected precedence and of the
+ * binding-vs-exports zone-id branch, shared by the resources layer
+ * (`ecsNetworking.addHostedZone`) and the patterns layer (`patternDomain`).
+ */
+export declare function resolveEffectiveManagedDomain(node: Node, explicit: ManagedDomainBinding | ManagedDomainExports | undefined, domainName: string, context: string): EffectiveManagedDomain | undefined;

package/dist/lib/utils/managedDomainContext.js

@@ -19,6 +19,8 @@
  * (`patternDomain.resolvePatternZone`), and utils is their lowest common
  * layer (generator-standards § Infrastructure Layer Boundaries).
  */
+import { Fn } from "aws-cdk-lib";
+import { isManagedDomainBinding } from "@fjall/util";
 export const MANAGED_DOMAIN_CONTEXT_PREFIX = "fjall:managedDomain:";
 export function getManagedDomainContextKey(zoneName) {
     return `${MANAGED_DOMAIN_CONTEXT_PREFIX}${zoneName}`;
@@ -114,10 +116,15 @@ export function readInjectedManagedDomainCoverage(node, zoneName, context) {
         const fieldValue = record[field];
         if (fieldValue === undefined)
             continue;
+        // An empty array is corruption, never data: a real certificate always
+        // covers at least its domain name, and the CLI never emits []. Letting
+        // it through would read as an enumerated "covers nothing" fact and turn
+        // an UNKNOWN coverage state into a definite (false) not-covered verdict.
         if (!Array.isArray(fieldValue) ||
+            fieldValue.length === 0 ||
             fieldValue.some((h) => typeof h !== "string" || h === "")) {
-            throw new Error(`${context}: CDK context '${key}' field '${field}' must be an array ` +
-                `of non-empty strings when present (got ` +
+            throw new Error(`${context}: CDK context '${key}' field '${field}' must be a ` +
+                `non-empty array of non-empty strings when present (got ` +
                 `${JSON.stringify(fieldValue)}). Re-run the deploy through the ` +
                 "Fjall CLI, or correct the hand-set context entry.");
         }
@@ -125,6 +132,26 @@ export function readInjectedManagedDomainCoverage(node, zoneName, context) {
     }
     return coverage;
 }
+/**
+ * Resolve the effective managed-domain identity for `domainName` — the
+ * SINGLE home of the explicit-beats-injected precedence and of the
+ * binding-vs-exports zone-id branch, shared by the resources layer
+ * (`ecsNetworking.addHostedZone`) and the patterns layer (`patternDomain`).
+ */
+export function resolveEffectiveManagedDomain(node, explicit, domainName, context) {
+    const managed = explicit ?? readInjectedManagedDomainBinding(node, domainName, context);
+    if (managed === undefined)
+        return undefined;
+    const isBinding = isManagedDomainBinding(managed);
+    return {
+        managed,
+        zoneName: managed.zoneName,
+        hostedZoneId: isBinding
+            ? managed.hostedZoneId
+            : Fn.importValue(managed.hostedZoneIdExport),
+        explicitPinnedBinding: explicit !== undefined && isBinding
+    };
+}
 function parseManagedDomainBinding(raw, zoneName, key, context) {
     let value = raw;
     if (typeof raw === "string") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/components-infrastructure",
-  "version": "14.2.0",
+  "version": "14.3.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/fjall-tech/fjall.git",
@@ -80,8 +80,8 @@
   },
   "dependencies": {
     "@aws-sdk/client-organizations": "^3.1098.0",
-    "@fjall/generator": "^14.2.0",
-    "@fjall/util": "^14.2.0",
+    "@fjall/generator": "^14.3.0",
+    "@fjall/util": "^14.3.0",
     "constructs": "^10.7.2"
   },
   "overrides": {