@fjall/components-infrastructure 14.2.0 → 15.0.0

package/dist/lib/patterns/aws/dnsRecordComposer.js

@@ -16,15 +16,29 @@ import { DNS_APEX } from "@fjall/util";
  * runtime guard catches user-crafted `{ kind, ... }` literals that lack
  * `bind()`.
  *
- * Construct-id formula (`${safeZone}${safeName}${type}Record${index}`) is
- * byte-identical to the legacy composer — this is an eject-contract
- * invariant (Phase 3 depends on stable IDs).
+ * Construct-id formulas (`recordIds` on `DomainCommonProps`):
+ * - `"indexed"` (default): `${safeZone}${safeName}${type}Record${index}` —
+ *   byte-identical to the legacy composer, an eject-contract invariant
+ *   (Phase 3 depends on stable IDs). Position-coupled, so the records list
+ *   is append-only for deployed zones.
+ * - `"stable"`: `${safeZone}${safeName}${type}Record` — position-free.
+ *   {@link assertStableIdsDerivable} refuses the two shapes that would
+ *   collide, with cures, before CDK's opaque duplicate-construct-id error
+ *   can fire.
+ * A per-record `id` (PascalCase alphanumeric) replaces the `safeName`
+ * segment in either mode — the escape hatch the stable-mode collision
+ * refusal names.
  */
-export function composeTypedDnsRecords(scope, zone, zoneName, records) {
+export function composeTypedDnsRecords(scope, zone, zoneName, records, recordIds = "indexed") {
     const safeZone = toPascalCase(getSafeZoneName(zoneName));
+    if (recordIds === "stable") {
+        assertStableIdsDerivable(zoneName, records);
+    }
     records.forEach((record, index) => {
-        const safeName = toPascalCase(record.name === DNS_APEX ? "Apex" : record.name);
-        const constructId = `${safeZone}${safeName}${record.type}Record${index}`;
+        const safeName = recordIdNameSegment(record);
+        const constructId = recordIds === "stable"
+            ? `${safeZone}${safeName}${record.type}Record`
+            : `${safeZone}${safeName}${record.type}Record${index}`;
         const common = {
             zone,
             zoneName,
@@ -40,6 +54,9 @@ export function composeTypedDnsRecords(scope, zone, zoneName, records) {
             }
             new AliasRecord(scope, constructId, {
                 ...common,
+                // A declared AAAA alias must DEPLOY as AAAA — the resource defaults
+                // to "A" for its pattern-internal (IPv4) call sites only.
+                recordType: record.type,
                 target: target
             });
             return;
@@ -102,6 +119,71 @@ export function composeTypedDnsRecords(scope, zone, zoneName, records) {
         }
     });
 }
+/**
+ * Construct-id name segment: an explicit `id` verbatim (validated — it
+ * becomes a CloudFormation logical-ID segment), else the pascal-cased
+ * record name. The no-`id` derivation is byte-identical to the legacy
+ * inline formula (eject contract).
+ */
+function recordIdNameSegment(record) {
+    if (record.id !== undefined) {
+        if (!/^[A-Za-z][A-Za-z0-9]*$/.test(record.id)) {
+            throw new Error(`DNS record '${record.name}' (${record.type}): 'id' must be ` +
+                `alphanumeric starting with a letter (got '${record.id}') — it ` +
+                "becomes a CloudFormation logical-ID segment.");
+        }
+        return record.id;
+    }
+    return toPascalCase(record.name === DNS_APEX ? "Apex" : record.name);
+}
+/**
+ * Stable-mode pre-flight: refuse the two list shapes whose derived
+ * construct ids would collide, each with its own cure, BEFORE CDK's opaque
+ * "already a Construct with name" error can fire.
+ *
+ * - Duplicate (name, type) pairs are illegal Route53 regardless of id
+ *   scheme (one record set per (zone, name, type) — the same doctrine the
+ *   DNS claim registry enforces across constructs; this vocabulary cannot
+ *   express routing-policy variants). Indexed mode surfaces them via the
+ *   registry at claim time; stable mode must refuse before construction.
+ * - DISTINCT records whose derived construct ids concatenate to one string
+ *   — same-type names that sanitise to one PascalCase segment (e.g.
+ *   'mail-eu' and 'mailEu'), or cross-type segment/type ambiguity (id
+ *   'ApiAAA' + type 'A' vs segment 'Api' + type 'AAAA' both derive
+ *   'ApiAAAARecord') — are legal Route53 but collide as construct ids; the
+ *   per-record `id` escape hatch disambiguates. Keyed on the FULL derived
+ *   id, never on (segment, type) pairs, precisely so the concatenation
+ *   ambiguity cannot slip past to CDK.
+ */
+function assertStableIdsDerivable(zoneName, records) {
+    const byRecordSet = new Map();
+    const byConstructId = new Map();
+    for (const record of records) {
+        const setKey = [
+            record.name.toLowerCase().replace(/\.$/, ""),
+            record.type
+        ].join("|");
+        const priorSet = byRecordSet.get(setKey);
+        if (priorSet !== undefined) {
+            throw new Error(`DNS record '${record.name}' (${record.type}) in zone '${zoneName}': ` +
+                "declared twice in this records list. Route53 allows one record " +
+                "set per (zone, name, type); CloudFormation would reject this at " +
+                "deploy. Merge the values into one entry (multi-value records " +
+                "take a string array), or remove one.");
+        }
+        byRecordSet.set(setKey, record);
+        const constructKey = `${recordIdNameSegment(record)}${record.type}Record`;
+        const prior = byConstructId.get(constructKey);
+        if (prior !== undefined) {
+            throw new Error(`DNS records '${prior.name}' (${prior.type}) and '${record.name}' ` +
+                `(${record.type}) in zone '${zoneName}': both derive record ` +
+                `construct id '${constructKey}' under recordIds: "stable". Give ` +
+                "one of them a distinct per-record 'id' (PascalCase " +
+                "alphanumeric) to disambiguate.");
+        }
+        byConstructId.set(constructKey, record);
+    }
+}
 // Parse "10 mail.example.com" → { priority: 10, hostName: "mail.example.com" }.
 function parseMxValue(raw) {
     const parts = raw.trim().split(/\s+/);

package/dist/lib/patterns/aws/domainCertificateComposer.js

@@ -1,9 +1,8 @@
 import { CfnOutput, Stack, Stage, Token } from "aws-cdk-lib";
 import { HostedZone as AWSHostedZone } from "aws-cdk-lib/aws-route53";
-import { getDomainExportNames, getDomainUsEast1CertificatesStackName } from "@fjall/util";
+import { getDomainExportNames, getDomainUsEast1CertificatesStackName, hostsExportPartName, serialiseHostsChunks } from "@fjall/util";
 import { DomainCertificate } from "../../resources/aws/networking/domainCertificate.js";
 import { toPascalCase } from "../../utils/capitaliseString.js";
-import { FjallLogger } from "../../utils/validationLogger.js";
 const US_EAST_1 = "us-east-1";
 /**
  * Certificate composition shared by `composeApexDomain` and
@@ -49,15 +48,7 @@ export function composeDomainCertificates(scope, composition) {
             // certificates whose ARNs it binds, never a zone-level aggregate
             // (which would list hostnames of certificates that are not on the
             // consumer's listener and over-claim coverage).
-            const serialisedHosts = JSON.stringify(certificateHosts(normalised));
-            if (hostsOutputWithinCfnLimit(serialisedHosts, normalised.domainName)) {
-                new CfnOutput(scope, `${certId}Hosts`, {
-                    key: `${certId}Hosts`,
-                    value: serialisedHosts,
-                    exportName: getDomainExportNames(normalised.domainName)
-                        .certificateHosts
-                });
-            }
+            emitHostsOutputs(scope, `${certId}Hosts`, getDomainExportNames(normalised.domainName).certificateHosts, certificateHosts(normalised));
             certificates.set(normalised.domainName, dc.certificate);
             return;
         }
@@ -136,27 +127,39 @@ function certificateHosts(cert) {
     ];
 }
 /**
- * Guard on CloudFormation's 1024-byte output-value limit (1000-byte
- * threshold for headroom under the hard cap): a certificate with enough —
- * or long enough — SANs would otherwise fail the WHOLE domain-stack deploy
- * with an opaque CFN error. Per the D5 fail-open contract the hosts output
- * is SKIPPED instead: the deploy keeps succeeding, and consumers see
- * coverage-unknown for this certificate (W1 — its coverage stays
- * unverifiable at CDN synth), never a false verdict.
+ * CloudFormation caps output values at 1024 bytes: a certificate with
+ * enough — or long enough — SANs would fail the WHOLE domain-stack deploy
+ * with an opaque CFN error if its hosts list rode one output. Hosts lists
+ * that fit keep the base export name and construct ID byte-identical to
+ * the single-output era (no logical-ID churn on deployed stacks);
+ * oversized lists are emitted as a part family (`<base>-1`, `<base>-2`, …,
+ * each a self-contained JSON array under the threshold) with the base name
+ * OMITTED — a consumer that only knows the base name reads absence as
+ * coverage-unknown, never a partial list it would misread as complete (see
+ * `hostsExportPartName`). Coverage is therefore always published; the old
+ * over-limit fail-open (skip the output, coverage permanently
+ * unverifiable) is gone. The chunking algorithm (`serialiseHostsChunks`)
+ * is homed in @fjall/util so the CLI's eject templates split identically.
  */
-const HOSTS_OUTPUT_MAX_BYTES = 1000;
-function hostsOutputWithinCfnLimit(serialisedHosts, certificateDomainName) {
-    const bytes = Buffer.byteLength(serialisedHosts, "utf8");
-    if (bytes <= HOSTS_OUTPUT_MAX_BYTES)
-        return true;
-    FjallLogger.warn(`Certificate '${certificateDomainName}': its hosts list serialises to ` +
-        `${bytes} bytes, over the ${HOSTS_OUTPUT_MAX_BYTES}-byte guard for ` +
-        "CloudFormation's 1024-byte output-value limit, so its " +
-        "certificate-hosts output is skipped and the certificate's coverage " +
-        "stays unverifiable at CDN synth (W1) — the deploy itself keeps " +
-        "succeeding. Trim the certificate's SAN list, or split the hosts " +
-        "across multiple certificates.");
-    return false;
+function emitHostsOutputs(scope, keyPrefix, baseExportName, hosts) {
+    const chunks = serialiseHostsChunks(hosts);
+    const single = chunks.length === 1 ? chunks[0] : undefined;
+    if (single !== undefined) {
+        new CfnOutput(scope, keyPrefix, {
+            key: keyPrefix,
+            value: single,
+            exportName: baseExportName
+        });
+        return;
+    }
+    chunks.forEach((chunk, index) => {
+        const id = `${keyPrefix}${index + 1}`;
+        new CfnOutput(scope, id, {
+            key: id,
+            value: chunk,
+            exportName: hostsExportPartName(baseExportName, index + 1)
+        });
+    });
 }
 /**
  * The zone-level `<zone>-us-east-1-certificate-hosts` output (D5 companion
@@ -165,15 +168,8 @@ function hostsOutputWithinCfnLimit(serialisedHosts, certificateDomainName) {
  * reaches it in one call regardless of where the certificate itself lives.
  */
 function emitUsEast1HostsOutput(scope, composition, cert) {
-    const serialisedHosts = JSON.stringify(certificateHosts(cert));
-    if (!hostsOutputWithinCfnLimit(serialisedHosts, cert.domainName))
-        return;
     const exports = getDomainExportNames(composition.effectiveZoneName);
-    new CfnOutput(scope, `${composition.safeZone}UsEast1CertificateHosts`, {
-        key: `${composition.safeZone}UsEast1CertificateHosts`,
-        value: serialisedHosts,
-        exportName: exports.usEast1CertificateHosts
-    });
+    emitHostsOutputs(scope, `${composition.safeZone}UsEast1CertificateHosts`, exports.usEast1CertificateHosts, certificateHosts(cert));
 }
 /**
  * The zone-level `<zone>-us-east-1-certificate-arn` export

package/dist/lib/patterns/aws/interfaces/domain.d.ts

@@ -33,12 +33,22 @@ export interface StandardRecord {
     readonly name: string;
     readonly value: string | string[];
     readonly ttl?: number;
+    /**
+     * Overrides the record's derived construct-id name segment (PascalCase
+     * alphanumeric). The rare escape hatch for two record names that sanitise
+     * to the same PascalCase segment under `recordIds: "stable"` — the
+     * composer's collision refusal names it. Round-tripped by the generator's
+     * zone importer and the webapp record splice.
+     */
+    readonly id?: string;
 }
 export interface AliasRecord {
     readonly type: "A" | "AAAA";
     readonly name: string;
     readonly target: FjallTarget;
     readonly ttl?: never;
+    /** Same construct-id override as {@link StandardRecord.id}. */
+    readonly id?: string;
 }
 export type DnsRecord = StandardRecord | AliasRecord;
 export type Certificate = string | {
@@ -65,6 +75,28 @@ export type Certificate = string | {
 export interface DomainCommonProps {
     readonly zoneName: string;
     readonly records?: DnsRecord[];
+    /**
+     * Construct-id scheme for the records list.
+     *
+     * `"indexed"` (default) embeds each record's LIST POSITION in its logical
+     * ID (`...Record0`, `...Record1`, …) — the legacy eject-contract formula,
+     * byte-frozen for deployed stacks. Under it the records list is
+     * APPEND-ONLY: inserting or removing an entry renumbers every later
+     * record, which CloudFormation executes as delete + recreate of live
+     * record sets.
+     *
+     * `"stable"` derives position-independent IDs
+     * (`<Zone><Name><Type>Record`) so entries can be inserted, removed and
+     * reordered freely. Collision-free by the same doctrine the DNS claim
+     * registry enforces (one owner per (zone, name, type); this vocabulary
+     * cannot express routing-policy variants) — the composer refuses
+     * duplicate (name, type) pairs and sanitised-name collisions at synth,
+     * naming the per-record `id` escape hatch. `fjall domain import` emits it
+     * for fresh zones. Flipping an ALREADY-DEPLOYED zone renames every
+     * record's logical ID (delete + recreate at deploy) — a deliberate
+     * two-deploy migration, never a casual edit.
+     */
+    readonly recordIds?: "indexed" | "stable";
     readonly certificates?: Certificate[];
     readonly tags?: Record<string, string>;
     readonly description?: string;

package/dist/lib/patterns/aws/patternDomain.d.ts

@@ -57,6 +57,15 @@ export interface ResolvedPatternZone {
     readonly hostedZone: IHostedZone;
     readonly zoneName: string;
 }
+/**
+ * Resolve the hosted zone for a pattern domain from explicit identity only
+ * (H2). Throws when no identity is given or when the domain falls outside
+ * the declared zone. The D2 precedence (explicit `managedDomain` beats the
+ * CLI-injected binding, ahead of the BYO `zoneName`/`hostedZoneId` chain)
+ * and the binding-vs-exports zone-id branch live in the shared
+ * `resolveEffectiveManagedDomain` — the same resolution the ECS networking
+ * lane consumes.
+ */
 export declare function resolvePatternZone(request: PatternDomainRequest): ResolvedPatternZone;
 /**
  * Resolve the CloudFront viewer certificate for a pattern domain (H3/D3).

package/dist/lib/patterns/aws/patternDomain.js

@@ -30,37 +30,30 @@ import { Certificate } from "aws-cdk-lib/aws-certificatemanager";
 import { HostedZone } from "aws-cdk-lib/aws-route53";
 import { DomainCertificate } from "../../resources/aws/networking/index.js";
 import { isManagedDomainBinding, isWithinZone } from "../../utils/domainTypes.js";
-import { readInjectedManagedDomainBinding } from "../../utils/managedDomainContext.js";
+import { readInjectedManagedDomainCoverage, resolveEffectiveManagedDomain } from "../../utils/managedDomainContext.js";
+import { certNameMatches } from "../../resources/aws/compute/ingressProfile.js";
+import { cdnOriginRefusal } from "./cdnAppOrigin.js";
 const US_EAST_1 = "us-east-1";
 /**
  * Resolve the hosted zone for a pattern domain from explicit identity only
- * (H2). Throws when no identity is given or when the domain falls outside the
- * declared zone.
+ * (H2). Throws when no identity is given or when the domain falls outside
+ * the declared zone. The D2 precedence (explicit `managedDomain` beats the
+ * CLI-injected binding, ahead of the BYO `zoneName`/`hostedZoneId` chain)
+ * and the binding-vs-exports zone-id branch live in the shared
+ * `resolveEffectiveManagedDomain` — the same resolution the ECS networking
+ * lane consumes.
  */
-/**
- * Effective managed-domain identity for a request (D2): an EXPLICIT
- * `managedDomain` prop wins over the CLI-injected context binding (explicit
- * beats injected), and the context read sits ahead of the BYO
- * `zoneName`/`hostedZoneId` chain. Bare-CDK synth carries no context entry
- * and falls straight through to the explicit props.
- */
-function resolveEffectiveManagedDomain(request) {
-    return (request.identity.managedDomain ??
-        readInjectedManagedDomainBinding(request.scope.node, request.domain, request.context));
-}
 export function resolvePatternZone(request) {
     const { scope, idPrefix, context, domain, identity } = request;
-    const managed = resolveEffectiveManagedDomain(request);
-    if (managed !== undefined) {
-        assertDomainWithinZone(context, domain, managed.zoneName);
-        const hostedZoneId = isManagedDomainBinding(managed)
-            ? // CLI-injected literal (D2) — carries no Fn.importValue constraint.
-                managed.hostedZoneId
-            : // Legacy export-name fallback — same-account, same-region only.
-                Fn.importValue(managed.hostedZoneIdExport);
+    const effective = effectiveManagedDomainFor(request);
+    if (effective !== undefined) {
+        assertDomainWithinZone(context, domain, effective.zoneName);
         return {
-            hostedZone: HostedZone.fromHostedZoneAttributes(scope, `${idPrefix}ManagedHostedZone`, { hostedZoneId, zoneName: managed.zoneName }),
-            zoneName: managed.zoneName
+            hostedZone: HostedZone.fromHostedZoneAttributes(scope, `${idPrefix}ManagedHostedZone`, {
+                hostedZoneId: effective.hostedZoneId,
+                zoneName: effective.zoneName
+            }),
+            zoneName: effective.zoneName
         };
     }
     if (identity.zoneName !== undefined) {
@@ -110,8 +103,11 @@ export function resolvePatternZone(request) {
  */
 export function resolvePatternCloudFrontCertificate(request, zone) {
     const { scope, app, idPrefix, context, domain, identity } = request;
-    const managed = resolveEffectiveManagedDomain(request);
-    if (managed !== undefined && isManagedDomainBinding(managed)) {
+    const effective = effectiveManagedDomainFor(request);
+    const managed = effective?.managed;
+    if (effective !== undefined &&
+        managed !== undefined &&
+        isManagedDomainBinding(managed)) {
         const arn = managed.usEast1CertificateArn;
         if (arn === undefined) {
             throw new Error(`${context}: managed domain binding for zone '${managed.zoneName}' ` +
@@ -122,10 +118,13 @@ export function resolvePatternCloudFrontCertificate(request, zone) {
                 "'zoneName' to provision an app-owned us-east-1 certificate.");
         }
         assertUsEast1CertificateArn(context, arn);
+        assertViewerHostCovered(request, effective);
         return Certificate.fromCertificateArn(scope, `${idPrefix}ManagedCertificate`, arn);
     }
     const region = resolvedRegionOf(scope);
-    if (managed !== undefined && (region === undefined || region === US_EAST_1)) {
+    if (managed !== undefined &&
+        !isManagedDomainBinding(managed) &&
+        (region === undefined || region === US_EAST_1)) {
         // Legacy export-name form: Fn.importValue resolves same-account,
         // same-region only, so the imported certificate satisfies CloudFront
         // exactly when the app itself deploys to us-east-1. A region-unresolved
@@ -170,6 +169,40 @@ export function resolvePatternCloudFrontCertificate(request, zone) {
         exportCertificateArn: false
     }).certificate;
 }
+function effectiveManagedDomainFor(request) {
+    return resolveEffectiveManagedDomain(request.scope.node, request.identity.managedDomain, request.domain, request.context);
+}
+/**
+ * E11 — the requested viewer hostname against the managed us-east-1 viewer
+ * certificate's declared hosts (D5 coverage context). A definite miss fails
+ * CloudFront's own alias-vs-certificate validation at deploy with an opaque
+ * InvalidViewerCertificate — refuse at synth with the cure instead. Absent
+ * or provenance-gated coverage stays SILENT (no warning): CloudFront
+ * validates at deploy regardless, so unknown coverage carries no runtime
+ * risk here — unlike the origin lane's W1, where an uncovered hostname only
+ * fails at request time.
+ */
+function assertViewerHostCovered(request, effective) {
+    // D5 provenance gate: an explicit pinned binding may name an OLDER
+    // certificate the current coverage does not describe.
+    if (effective.explicitPinnedBinding)
+        return;
+    const coverage = readInjectedManagedDomainCoverage(request.scope.node, effective.zoneName, request.context);
+    const hosts = coverage?.usEast1CertificateHosts;
+    if (hosts === undefined || hosts.length === 0)
+        return;
+    if (hosts.some((pattern) => certNameMatches(pattern, request.domain))) {
+        return;
+    }
+    throw cdnOriginRefusal("E11", `${request.context}: the managed domain's us-east-1 viewer certificate ` +
+        `covers ${hosts.join(", ")} — none matches '${request.domain}'. ` +
+        "CloudFront rejects a distribution whose alias its viewer " +
+        "certificate does not cover (InvalidViewerCertificate, at deploy). " +
+        `Declare '${request.domain}' (or a covering wildcard) on the domain ` +
+        "stack's cloudFront certificate and redeploy it, or set 'zoneName' " +
+        "instead of the managed domain to provision an app-owned us-east-1 " +
+        "certificate.");
+}
 function assertDomainWithinZone(context, domain, zoneName) {
     if (!isWithinZone(domain, zoneName)) {
         throw new Error(`${context}: domain '${domain}' is not within zone '${zoneName}' ` +

package/dist/lib/resources/aws/cdn/cloudFront.d.ts

@@ -90,6 +90,11 @@ export interface CloudFrontDistributionProps {
 export declare class CloudFrontDistribution extends Construct {
     readonly id: string;
     private distribution;
+    private readonly origins;
+    /** Shared S3 access identities, keyed by the owning stack (see
+     * `s3OriginAccessIdentityFor` for why the key is a Stack). */
+    private readonly s3AccessIdentities;
+    private s3AccessControl?;
     constructor(scope: Construct, id: string, props: CloudFrontDistributionProps);
     /**
      * Build a composable CloudFront Function for VIEWER_REQUEST.
@@ -107,7 +112,39 @@ export declare class CloudFrontDistribution extends Construct {
     /** SPA fallback: serve /index.html @200 for 403/404 so client-side routing
      * handles the path. CloudFront returns 403 (not 404) for missing S3 keys. */
     private buildSpaErrorResponses;
+    /**
+     * One `IOrigin` per distinct origin configuration: behaviours that
+     * resolve to the same origin (same bucket/ALB/hostname with the same
+     * options) share a single distribution origin entry instead of minting an
+     * identical one per behaviour. Token-bearing hostnames (e.g. a Lambda
+     * function URL) memoize per token instance — two independently-derived
+     * tokens never share, which is the safe direction.
+     */
     private createOrigin;
+    private static originKey;
+    /**
+     * S3 access identities are created HERE, at a position-independent scope,
+     * and handed to `S3BucketOrigin` — never left to CDK's default, which
+     * creates them under the distribution's positional `Origin${n}` child.
+     * An OAI/OAC is semantically "the identity this distribution presents to
+     * S3": one per distribution, shared by every S3 origin. Position-scoped
+     * identities couple a DEPLOYED IAM resource's logical ID to the origin
+     * list's order — origin dedup (or any behaviour insertion) would then
+     * silently delete/repurpose a live OAI and atomically swap the bucket
+     * policy it gates, 403-ing the paths the edge still serves with the old
+     * identity until the distribution update propagates.
+     *
+     * Cross-stack buckets get their identity in the BUCKET's stack (same rule
+     * CDK's default applies): the bucket policy must reference the OAI, and a
+     * distribution-stack OAI would complete a cycle with the CDN stack's
+     * reference to the bucket.
+     */
+    private s3OriginAccessIdentityFor;
+    /** OAC twin of `s3OriginAccessIdentityFor` — an OAC is a signing config,
+     * not a bucket grant (bucket policies key on the distribution ARN), so a
+     * single distribution-scoped one serves every OAC origin. */
+    private s3OriginAccessControl;
+    private buildOrigin;
     private resolveCachePolicy;
     private resolveAllowedMethods;
     private resolveOriginProtocolPolicy;

package/dist/lib/resources/aws/cdn/cloudFront.js

@@ -1,12 +1,17 @@
 import { Construct } from "constructs";
-import { CfnOutput } from "aws-cdk-lib";
+import { CfnOutput, Names, Stack } from "aws-cdk-lib";
 import { toPascalCase } from "../../../utils/capitaliseString.js";
 import { cdnDomainExportName } from "@fjall/util";
-import { Distribution, PriceClass, ViewerProtocolPolicy, CachePolicy, OriginRequestPolicy, AllowedMethods, OriginProtocolPolicy, Function as CloudFrontFunction, FunctionCode, FunctionRuntime, FunctionEventType } from "aws-cdk-lib/aws-cloudfront";
+import { Distribution, PriceClass, ViewerProtocolPolicy, CachePolicy, OriginRequestPolicy, AllowedMethods, OriginProtocolPolicy, Function as CloudFrontFunction, FunctionCode, FunctionRuntime, FunctionEventType, OriginAccessIdentity, S3OriginAccessControl } from "aws-cdk-lib/aws-cloudfront";
 import { S3BucketOrigin, LoadBalancerV2Origin, HttpOrigin } from "aws-cdk-lib/aws-cloudfront-origins";
 export class CloudFrontDistribution extends Construct {
     id;
     distribution;
+    origins = new Map();
+    /** Shared S3 access identities, keyed by the owning stack (see
+     * `s3OriginAccessIdentityFor` for why the key is a Stack). */
+    s3AccessIdentities = new Map();
+    s3AccessControl;
     constructor(scope, id, props) {
         super(scope, id);
         this.id = id;
@@ -144,7 +149,92 @@ export class CloudFrontDistribution extends Construct {
             responsePagePath: "/index.html"
         }));
     }
+    /**
+     * One `IOrigin` per distinct origin configuration: behaviours that
+     * resolve to the same origin (same bucket/ALB/hostname with the same
+     * options) share a single distribution origin entry instead of minting an
+     * identical one per behaviour. Token-bearing hostnames (e.g. a Lambda
+     * function URL) memoize per token instance — two independently-derived
+     * tokens never share, which is the safe direction.
+     */
     createOrigin(config) {
+        const key = CloudFrontDistribution.originKey(config);
+        const memoized = this.origins.get(key);
+        if (memoized !== undefined) {
+            return memoized;
+        }
+        const origin = this.buildOrigin(config);
+        this.origins.set(key, origin);
+        return origin;
+    }
+    static originKey(config) {
+        switch (config.type) {
+            case "s3":
+                return [
+                    "s3",
+                    config.bucket.node.addr,
+                    config.originPath ?? "",
+                    config.originAccess ?? ""
+                ].join("|");
+            case "alb":
+                return [
+                    "alb",
+                    config.loadBalancer.node.addr,
+                    config.httpPort ?? "",
+                    config.httpsPort ?? "",
+                    config.protocolPolicy ?? ""
+                ].join("|");
+            case "http":
+                return [
+                    "http",
+                    config.domainName,
+                    config.originPath ?? "",
+                    config.httpPort ?? "",
+                    config.httpsPort ?? "",
+                    config.protocolPolicy ?? ""
+                ].join("|");
+        }
+    }
+    /**
+     * S3 access identities are created HERE, at a position-independent scope,
+     * and handed to `S3BucketOrigin` — never left to CDK's default, which
+     * creates them under the distribution's positional `Origin${n}` child.
+     * An OAI/OAC is semantically "the identity this distribution presents to
+     * S3": one per distribution, shared by every S3 origin. Position-scoped
+     * identities couple a DEPLOYED IAM resource's logical ID to the origin
+     * list's order — origin dedup (or any behaviour insertion) would then
+     * silently delete/repurpose a live OAI and atomically swap the bucket
+     * policy it gates, 403-ing the paths the edge still serves with the old
+     * identity until the distribution update propagates.
+     *
+     * Cross-stack buckets get their identity in the BUCKET's stack (same rule
+     * CDK's default applies): the bucket policy must reference the OAI, and a
+     * distribution-stack OAI would complete a cycle with the CDN stack's
+     * reference to the bucket.
+     */
+    s3OriginAccessIdentityFor(bucket) {
+        const bucketStack = Stack.of(bucket);
+        const existing = this.s3AccessIdentities.get(bucketStack);
+        if (existing !== undefined) {
+            return existing;
+        }
+        const sameStack = bucketStack === Stack.of(this);
+        const identity = sameStack
+            ? new OriginAccessIdentity(this, "S3OriginAccessIdentity", {
+                comment: `Identity for ${this.node.path}`
+            })
+            : new OriginAccessIdentity(bucketStack, `${Names.uniqueId(this)}S3OriginAccessIdentity`, { comment: `Identity for ${this.node.path}` });
+        this.s3AccessIdentities.set(bucketStack, identity);
+        return identity;
+    }
+    /** OAC twin of `s3OriginAccessIdentityFor` — an OAC is a signing config,
+     * not a bucket grant (bucket policies key on the distribution ARN), so a
+     * single distribution-scoped one serves every OAC origin. */
+    s3OriginAccessControl() {
+        this.s3AccessControl ??= new S3OriginAccessControl(this, "S3OriginAccessControl");
+        return this.s3AccessControl;
+    }
+    buildOrigin(config) {
         switch (config.type) {
             case "s3":
                 // OAC (single-stack only) is safe when the bucket and distribution live
@@ -153,11 +243,13 @@ export class CloudFrontDistribution extends Construct {
                 // See: https://github.com/aws/aws-cdk/issues/31462
                 if (config.originAccess === "oac") {
                     return S3BucketOrigin.withOriginAccessControl(config.bucket, {
-                        originPath: config.originPath
+                        originPath: config.originPath,
+                        originAccessControl: this.s3OriginAccessControl()
                     });
                 }
                 return S3BucketOrigin.withOriginAccessIdentity(config.bucket, {
-                    originPath: config.originPath
+                    originPath: config.originPath,
+                    originAccessIdentity: this.s3OriginAccessIdentityFor(config.bucket)
                 });
             case "alb":
                 return new LoadBalancerV2Origin(config.loadBalancer, {