@fjall/components-infrastructure 2.34.0 → 3.0.0

package/dist/lib/patterns/aws/patternDomain.js

@@ -0,0 +1,198 @@
+/**
+ * Explicit zone identity + CloudFront certificate resolution shared by the
+ * CloudFront-fronted patterns (staticsite, payload).
+ *
+ * Design 2026-07-17 domain-management gold-plating — decisions D2 (synth
+ * side) and D3, findings H2 and H3:
+ *
+ * - Nothing here guesses a hosted zone. The old `extractRootDomain` label
+ *   split resolved every multi-label public suffix wrongly (e.g.
+ *   'littlebearearthworks.com.au' → zone 'com.au') and mis-placed delegated
+ *   sub-zone records; it is deleted. Zone identity now arrives explicitly, in
+ *   priority order: a CLI-injected {@link ManagedDomainBinding} (literal
+ *   values — crosses accounts and regions), the legacy
+ *   {@link ManagedDomainExports} form (Fn.importValue — same-account,
+ *   same-region only), or the pattern's own `zoneName`/`hostedZoneId` props.
+ *   No identity at all is a synth-time error naming the cures.
+ * - Every path validates the requested domain sits within the declared zone
+ *   (dot-boundary `isWithinZone`), so a mismatch throws at synth instead of
+ *   silently synthesising a record for the wrong FQDN.
+ * - CloudFront accepts viewer certificates from us-east-1 only. A binding
+ *   carries the domain stack's us-east-1 certificate ARN as an inspectable
+ *   literal (asserted here at synth); the BYO and legacy-exports paths
+ *   provision an app-owned DNS-validated certificate — in-stack when the app
+ *   itself deploys to us-east-1, otherwise in the app-owned
+ *   `${app}UsEast1Certificates` stack consumed through CDK cross-region
+ *   references.
+ */
+import { Fn, Stack, Token } from "aws-cdk-lib";
+import { Certificate } from "aws-cdk-lib/aws-certificatemanager";
+import { HostedZone } from "aws-cdk-lib/aws-route53";
+import { DomainCertificate } from "../../resources/aws/networking/index.js";
+import { isManagedDomainBinding, isWithinZone } from "../../utils/domainTypes.js";
+import { readInjectedManagedDomainBinding } from "../../utils/managedDomainContext.js";
+const US_EAST_1 = "us-east-1";
+/**
+ * Resolve the hosted zone for a pattern domain from explicit identity only
+ * (H2). Throws when no identity is given or when the domain falls outside the
+ * declared zone.
+ */
+/**
+ * Effective managed-domain identity for a request (D2): an EXPLICIT
+ * `managedDomain` prop wins over the CLI-injected context binding (explicit
+ * beats injected), and the context read sits ahead of the BYO
+ * `zoneName`/`hostedZoneId` chain. Bare-CDK synth carries no context entry
+ * and falls straight through to the explicit props.
+ */
+function resolveEffectiveManagedDomain(request) {
+    return (request.identity.managedDomain ??
+        readInjectedManagedDomainBinding(request.scope.node, request.domain, request.context));
+}
+export function resolvePatternZone(request) {
+    const { scope, idPrefix, context, domain, identity } = request;
+    const managed = resolveEffectiveManagedDomain(request);
+    if (managed !== undefined) {
+        assertDomainWithinZone(context, domain, managed.zoneName);
+        const hostedZoneId = isManagedDomainBinding(managed)
+            ? // CLI-injected literal (D2) — carries no Fn.importValue constraint.
+                managed.hostedZoneId
+            : // Legacy export-name fallback — same-account, same-region only.
+                Fn.importValue(managed.hostedZoneIdExport);
+        return {
+            hostedZone: HostedZone.fromHostedZoneAttributes(scope, `${idPrefix}ManagedHostedZone`, { hostedZoneId, zoneName: managed.zoneName }),
+            zoneName: managed.zoneName
+        };
+    }
+    if (identity.zoneName !== undefined) {
+        assertDomainWithinZone(context, domain, identity.zoneName);
+        const hostedZone = identity.hostedZoneId !== undefined
+            ? HostedZone.fromHostedZoneAttributes(scope, `${idPrefix}HostedZone`, {
+                hostedZoneId: identity.hostedZoneId,
+                zoneName: identity.zoneName
+            })
+            : // The lookup targets the EXPLICIT zone name — never a value derived
+                // from the domain's labels (H2).
+                HostedZone.fromLookup(scope, `${idPrefix}HostedZone`, {
+                    domainName: identity.zoneName
+                });
+        return { hostedZone, zoneName: identity.zoneName };
+    }
+    if (identity.hostedZoneId !== undefined) {
+        throw new Error(`${context}: 'hostedZoneId' ('${identity.hostedZoneId}') was set ` +
+            "without 'zoneName' (got zoneName undefined). A zone ID alone cannot " +
+            "name the zone, so records and certificates cannot be validated " +
+            `against it. Set 'zoneName' to the hosted zone that contains '${domain}'.`);
+    }
+    throw new Error(`${context}: domain '${domain}' has no zone identity (got neither ` +
+        "'managedDomain' nor 'zoneName'). Fjall does not guess hosted zones " +
+        "from domain labels — the last-two-labels guess resolved '.com.au'-style " +
+        "domains to their public suffix and mis-placed delegated sub-zones. " +
+        "Either bind a managed domain via the CLI ('fjall domain create' or " +
+        "'fjall domain import' — the deploy injects the binding), set " +
+        "'zoneName' (plus 'hostedZoneId' to skip the runtime lookup) to the " +
+        `hosted zone that contains '${domain}', or drop 'domain'.`);
+}
+/**
+ * Resolve the CloudFront viewer certificate for a pattern domain (H3/D3).
+ *
+ * - Managed binding: consume the injected us-east-1 ARN as a literal,
+ *   asserting its region component at synth (literal ARNs are inspectable).
+ * - Legacy exports in a us-east-1 or region-unresolved app: keep the
+ *   same-region Fn.importValue path unchanged (the D2 bare-CDK fallback).
+ * - Otherwise (BYO zone identity, or legacy exports in a non-us-east-1 app):
+ *   provision an app-owned DNS-validated certificate — beside the consumer
+ *   when the app already deploys to us-east-1, else in the dedicated
+ *   `${app}UsEast1Certificates` stack, consumed through CDK cross-region
+ *   references. In-app certificates are consumed in-app, so the
+ *   `<domain>-certificate-arn` export is always suppressed
+ *   (exportCertificateArn: false, §12-I) to avoid colliding with a
+ *   managed-domain/apex stack that owns the domain's exports.
+ */
+export function resolvePatternCloudFrontCertificate(request, zone) {
+    const { scope, app, idPrefix, context, domain, identity } = request;
+    const managed = resolveEffectiveManagedDomain(request);
+    if (managed !== undefined && isManagedDomainBinding(managed)) {
+        const arn = managed.usEast1CertificateArn;
+        if (arn === undefined) {
+            throw new Error(`${context}: managed domain binding for zone '${managed.zoneName}' ` +
+                "carries no usEast1CertificateArn (CloudFront accepts viewer " +
+                "certificates from us-east-1 only). Declare a CloudFront " +
+                `certificate for '${domain}' on the domain stack and redeploy it ` +
+                "so the binding carries the ARN, or drop 'managedDomain' and set " +
+                "'zoneName' to provision an app-owned us-east-1 certificate.");
+        }
+        assertUsEast1CertificateArn(context, arn);
+        return Certificate.fromCertificateArn(scope, `${idPrefix}ManagedCertificate`, arn);
+    }
+    const region = resolvedRegionOf(scope);
+    if (managed !== undefined && (region === undefined || region === US_EAST_1)) {
+        // Legacy export-name form: Fn.importValue resolves same-account,
+        // same-region only, so the imported certificate satisfies CloudFront
+        // exactly when the app itself deploys to us-east-1. A region-unresolved
+        // bare-CDK synth keeps the import unchanged (the documented D2 fallback);
+        // a resolved non-us-east-1 region falls through to app-owned
+        // provisioning instead of importing a certificate CloudFront must
+        // reject (H3).
+        return Certificate.fromCertificateArn(scope, `${idPrefix}ManagedCertificate`, Fn.importValue(managed.certificateArnExport));
+    }
+    if (region === US_EAST_1) {
+        // Single-stack layout: the pattern's own stack already deploys to the
+        // only region CloudFront accepts, so the certificate lives beside its
+        // consumer.
+        return new DomainCertificate(scope, `${idPrefix}Certificate`, {
+            domainName: domain,
+            hostedZone: zone.hostedZone,
+            exportCertificateArn: false
+        }).certificate;
+    }
+    if (region === undefined) {
+        throw new Error(`${context}: cannot place the CloudFront certificate for '${domain}' — ` +
+            "the app's region is unresolved at synth (got a region token), so " +
+            "whether the app already deploys to us-east-1 is unknowable. Deploy " +
+            "through the Fjall CLI, or export CDK_DEFAULT_ACCOUNT and " +
+            "CDK_DEFAULT_REGION before synthesising.");
+    }
+    // Cross-region layout (D3 BYO path): the certificate is provisioned in the
+    // app-owned us-east-1 stack and the distribution consumes the ARN through
+    // CDK cross-region references. The zone reference is re-created inside the
+    // certificate stack: literal attributes travel as-is, while the legacy
+    // exports form must switch from Fn.importValue (unresolvable outside the
+    // exporting region) to a lookup on its declared zone name.
+    const certStack = app.getUsEast1CertificateStack().getStack();
+    const certZone = identity.hostedZoneId !== undefined
+        ? HostedZone.fromHostedZoneAttributes(certStack, `${idPrefix}CertificateZone`, { hostedZoneId: identity.hostedZoneId, zoneName: zone.zoneName })
+        : HostedZone.fromLookup(certStack, `${idPrefix}CertificateZone`, {
+            domainName: zone.zoneName
+        });
+    return new DomainCertificate(certStack, `${idPrefix}Certificate`, {
+        domainName: domain,
+        hostedZone: certZone,
+        exportCertificateArn: false
+    }).certificate;
+}
+function assertDomainWithinZone(context, domain, zoneName) {
+    if (!isWithinZone(domain, zoneName)) {
+        throw new Error(`${context}: domain '${domain}' is not within zone '${zoneName}' ` +
+            "(dot-boundary match). A relative record for it would silently " +
+            `synthesise as '${domain}.${zoneName}' — the wrong FQDN. Point ` +
+            `'domain' at a name under '${zoneName}', or set the zone identity ` +
+            `to the hosted zone that actually contains '${domain}'.`);
+    }
+}
+function assertUsEast1CertificateArn(context, arn) {
+    // Binding values are literals by contract (D2), so the ARN's region
+    // component is inspectable at synth — CloudFront rejects any other region
+    // at deploy with InvalidViewerCertificate, far too late.
+    const region = Token.isUnresolved(arn) ? undefined : arn.split(":")[3];
+    if (region !== US_EAST_1) {
+        throw new Error(`${context}: managed domain binding's usEast1CertificateArn must be a ` +
+            `literal us-east-1 ACM certificate ARN (got '${arn}'). CloudFront ` +
+            "accepts viewer certificates from us-east-1 only — redeploy the " +
+            "domain stack so its CloudFront certificate is provisioned in " +
+            "us-east-1, or correct the injected binding.");
+    }
+}
+function resolvedRegionOf(scope) {
+    const region = Stack.of(scope).region;
+    return Token.isUnresolved(region) ? undefined : region;
+}

package/dist/lib/patterns/aws/payload.js

@@ -22,24 +22,23 @@
  * payload.getDatabase().grantConnect(otherLambda);
  */
 import { Construct } from "constructs";
-import { CfnOutput, Fn, Stack } from "aws-cdk-lib";
+import { CfnOutput, Stack } from "aws-cdk-lib";
 import { Secret } from "../../resources/aws/secrets/index.js";
 import { Code, Runtime, Architecture, FunctionUrlAuthType } from "aws-cdk-lib/aws-lambda";
-import { Certificate, CertificateValidation } from "aws-cdk-lib/aws-certificatemanager";
-import { HostedZone, ARecord, RecordTarget } from "aws-cdk-lib/aws-route53";
+import { Certificate } from "aws-cdk-lib/aws-certificatemanager";
+import { ARecord, RecordTarget } from "aws-cdk-lib/aws-route53";
 import { CloudFrontTarget } from "aws-cdk-lib/aws-route53-targets";
 import { DatabaseFactory } from "./database.js";
 import { ComputeFactory, InvokeMode } from "./compute.js";
 import { StorageFactory } from "./storage.js";
 import { MessagingFactory } from "./messaging.js";
 import { CdnFactory } from "./cdn.js";
+import { resolvePatternZone, resolvePatternCloudFrontCertificate } from "./patternDomain.js";
 import { FjallLogger } from "../../utils/validationLogger.js";
 import { toPascalCase, toValidDatabaseName } from "../../utils/capitaliseString.js";
 const PAYLOAD_DEFAULTS = {
     /** Path to OpenNext output relative to app folder (CDK runs from fjall/<appname>) */
     SOURCE: "../..",
-    /** CloudFront requires us-east-1 for certain resources; used as region fallback */
-    FALLBACK_REGION: "us-east-1",
     DATABASE: {
         TYPE: "Instance",
         /** AWS default; 7 days covers most accidental data loss recovery scenarios */
@@ -78,14 +77,6 @@ const PAYLOAD_DEFAULTS = {
         ADMIN: "/admin/*"
     }
 };
-/**
- * Extract root domain from a full domain name.
- * e.g., "cms.example.com" -> "example.com"
- */
-function extractRootDomain(domain) {
-    const parts = domain.split(".");
-    return parts.length > 2 ? parts.slice(-2).join(".") : domain;
-}
 /**
  * Safely get the underlying Lambda function from a compute resource.
  * Throws a clear error if the function is not available.
@@ -488,23 +479,25 @@ export class Payload extends Construct {
         if (!domain) {
             throw new Error("Domain is required for simple domain resolution");
         }
-        // Managed domain: import zone and cert from domain stack
-        if (this.props.managedDomain) {
-            const managed = this.props.managedDomain;
-            const hostedZone = HostedZone.fromHostedZoneAttributes(this, `${this.pascalName}ManagedHostedZone`, {
-                hostedZoneId: Fn.importValue(managed.hostedZoneIdExport),
-                zoneName: managed.zoneName
-            });
-            const certificate = Certificate.fromCertificateArn(this, `${this.pascalName}ManagedCertificate`, Fn.importValue(managed.certificateArnExport));
-            return { domainNames: [domain], certificate, hostedZone };
-        }
-        const rootDomain = extractRootDomain(domain);
-        const hostedZone = HostedZone.fromLookup(this, `${this.pascalName}HostedZone`, { domainName: rootDomain });
-        const certificate = new Certificate(this, `${this.pascalName}Certificate`, {
-            domainName: domain,
-            validation: CertificateValidation.fromDns(hostedZone)
-        });
-        return { domainNames: [domain], certificate, hostedZone };
+        // Zone identity is explicit only, and the domain is validated against the
+        // declared zone; the CloudFront certificate is the binding's literal
+        // us-east-1 ARN or an app-owned us-east-1 certificate (design H2 + H3/D3
+        // — see patternDomain.ts).
+        const request = {
+            scope: this,
+            app: this.app,
+            idPrefix: this.pascalName,
+            context: `Payload '${this.props.name}'`,
+            domain,
+            identity: {
+                managedDomain: this.props.managedDomain,
+                zoneName: this.props.zoneName,
+                hostedZoneId: this.props.hostedZoneId
+            }
+        };
+        const zone = resolvePatternZone(request);
+        const certificate = resolvePatternCloudFrontCertificate(request, zone);
+        return { domainNames: [domain], certificate, hostedZone: zone.hostedZone };
     }
     resolveAdvancedDomain() {
         const cdnConfig = this.props.cdn;

package/dist/lib/patterns/aws/staticSite.d.ts

@@ -20,6 +20,7 @@
  *   routing: "multipage",
  *   security: { headers: true },
  *   domain: "lbexc.com",
+ *   zoneName: "lbexc.com", // or a CLI-injected `managedDomain` binding
  *   forms: { to: "hello@lbexc.com", corsOrigin: "https://lbexc.com" }
  * }));
  */

package/dist/lib/patterns/aws/staticSite.js

@@ -20,6 +20,7 @@
  *   routing: "multipage",
  *   security: { headers: true },
  *   domain: "lbexc.com",
+ *   zoneName: "lbexc.com", // or a CLI-injected `managedDomain` binding
  *   forms: { to: "hello@lbexc.com", corsOrigin: "https://lbexc.com" }
  * }));
  */
@@ -29,15 +30,14 @@ import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { Code, Runtime, Architecture, FunctionUrlAuthType, HttpMethod } from "aws-cdk-lib/aws-lambda";
 import { PolicyStatement, Effect } from "aws-cdk-lib/aws-iam";
-import { Certificate } from "aws-cdk-lib/aws-certificatemanager";
-import { HostedZone } from "aws-cdk-lib/aws-route53";
 import { CloudFrontTarget } from "aws-cdk-lib/aws-route53-targets";
 import { DNS_APEX, defaultFormsCorsOrigin, defaultFormsFromAddress, isAddressAtDomain } from "@fjall/util";
 import { StorageFactory } from "./storage.js";
 import { CdnFactory } from "./cdn.js";
 import { SecurityHeadersPolicy } from "../../resources/aws/cdn/index.js";
 import { LambdaFunction } from "../../resources/aws/compute/index.js";
-import { DomainCertificate, AliasRecord } from "../../resources/aws/networking/index.js";
+import { AliasRecord } from "../../resources/aws/networking/index.js";
+import { resolvePatternZone, resolvePatternCloudFrontCertificate } from "./patternDomain.js";
 import { toPascalCase } from "../../utils/capitaliseString.js";
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const FORMS_ASSET_DIR = resolve(__dirname, "../../lambda-assets/static-site-forms/asset");
@@ -48,11 +48,6 @@ const FORMS_DEFAULTS = {
     MEMORY_MB: 256,
     MAX_CONCURRENCY: 5
 };
-/** Extract the registrable root (e.g. "a.b.example.com" → "example.com"). */
-function extractRootDomain(domain) {
-    const parts = domain.split(".");
-    return parts.length > 2 ? parts.slice(-2).join(".") : domain;
-}
 /** Record label relative to the zone — DNS_APEX for the apex. */
 function recordLabelFor(domain, zoneName) {
     if (domain === zoneName)
@@ -227,43 +222,43 @@ export class StaticSite extends Construct {
             : {
                 domainNames: undefined,
                 certificate: undefined,
-                hostedZone: undefined
+                hostedZone: undefined,
+                zoneName: undefined
             };
         return this._resolvedDomain;
     }
     resolveSimpleDomain(domain) {
-        if (this.props.managedDomain) {
-            const managed = this.props.managedDomain;
-            const hostedZone = HostedZone.fromHostedZoneAttributes(this, `${this.pascalName}ManagedHostedZone`, {
-                hostedZoneId: Fn.importValue(managed.hostedZoneIdExport),
-                zoneName: managed.zoneName
-            });
-            const certificate = Certificate.fromCertificateArn(this, `${this.pascalName}ManagedCertificate`, Fn.importValue(managed.certificateArnExport));
-            return { domainNames: [domain], certificate, hostedZone };
-        }
-        const rootDomain = extractRootDomain(domain);
-        const hostedZone = HostedZone.fromLookup(this, `${this.pascalName}HostedZone`, { domainName: rootDomain });
-        // Single-stack: the cert is consumed in-stack, so suppress the ARN export
-        // to avoid a collision with a managed-domain/apex stack (§12-I).
-        const domainCert = new DomainCertificate(this, `${this.pascalName}Certificate`, {
-            domainName: domain,
-            hostedZone,
-            exportCertificateArn: false
-        });
+        // Zone identity is explicit only, and the domain is validated against the
+        // declared zone; the CloudFront certificate is the binding's literal
+        // us-east-1 ARN or an app-owned us-east-1 certificate (design H2 + H3/D3
+        // — see patternDomain.ts).
+        const request = {
+            scope: this,
+            app: this.app,
+            idPrefix: this.pascalName,
+            context: `Static site '${this.props.name}'`,
+            domain,
+            identity: {
+                managedDomain: this.props.managedDomain,
+                zoneName: this.props.zoneName,
+                hostedZoneId: this.props.hostedZoneId
+            }
+        };
+        const zone = resolvePatternZone(request);
+        const certificate = resolvePatternCloudFrontCertificate(request, zone);
         return {
             domainNames: [domain],
-            certificate: domainCert.certificate,
-            hostedZone
+            certificate,
+            hostedZone: zone.hostedZone,
+            zoneName: zone.zoneName
         };
     }
     createDnsRecord() {
         if (!this.props.domain)
             return;
-        const { hostedZone } = this.resolveDomainConfig();
-        if (!hostedZone)
+        const { hostedZone, zoneName } = this.resolveDomainConfig();
+        if (!hostedZone || !zoneName)
             return;
-        const zoneName = this.props.managedDomain?.zoneName ??
-            extractRootDomain(this.props.domain);
         // Alias record lives in the CDN stack (where the distribution is) so there
         // is no cross-stack cycle back to this pattern node.
         const cdnStack = this.app.getDefaultCdnStack().getStack();

package/dist/lib/resources/aws/base/awsStack.d.ts

@@ -14,6 +14,14 @@ export interface AwsStackProps {
     readonly accountId?: string;
     readonly region?: string;
     accountName?: string;
+    /**
+     * Enable CDK native cross-region references on this stack. Required on
+     * BOTH the producing and consuming stack of a cross-region reference
+     * (e.g. a us-east-1 CloudFront certificate consumed by a Cdn stack in
+     * another region). Inert unless a cross-region reference is actually
+     * synthesised.
+     */
+    readonly crossRegionReferences?: boolean;
 }
 export declare class AwsStack implements StackBuilder {
     readonly resources: {

package/dist/lib/resources/aws/base/awsStack.js

@@ -32,24 +32,27 @@ export class AwsStack {
         return stack;
     }
     getStackProps(props) {
-        // If no explicit props are provided, fall back to the account/region that
-        // CDK resolved for this run. This allows context look-ups (e.g.
-        // Vpc.fromLookup) to work without every stack having to be created with
-        // explicit env settings.
-        if (!props) {
-            const account = process.env.CDK_DEFAULT_ACCOUNT;
-            const region = process.env.CDK_DEFAULT_REGION;
-            if (account && region) {
-                return { env: { account, region } };
-            }
-            return;
+        const crossRegionReferences = props?.crossRegionReferences
+            ? { crossRegionReferences: true }
+            : {};
+        // An explicit account/region pin wins. Otherwise fall back to the
+        // account/region that CDK resolved for this run, so context look-ups
+        // (e.g. Vpc.fromLookup) work without every stack having to be created
+        // with explicit env settings.
+        if (props?.accountId || props?.region) {
+            return {
+                env: props.accountId && props.region
+                    ? { account: props.accountId, region: props.region }
+                    : undefined,
+                ...crossRegionReferences
+            };
+        }
+        const account = process.env.CDK_DEFAULT_ACCOUNT;
+        const region = process.env.CDK_DEFAULT_REGION;
+        if (account && region) {
+            return { env: { account, region }, ...crossRegionReferences };
         }
-        const stackProps = {
-            env: props.accountId && props.region
-                ? { account: props.accountId, region: props.region }
-                : undefined
-        };
-        return stackProps;
+        return props?.crossRegionReferences ? crossRegionReferences : undefined;
     }
     isConnectable(arg) {
         return typeof arg === "object" && arg !== null && "connections" in arg;

package/dist/lib/resources/aws/compute/ecs.d.ts

@@ -10,7 +10,7 @@ export * from "./ecsContext.js";
 export * from "./ecsTaskDefinition.js";
 export * from "./ecsNetworking.js";
 export { CapacityProviderDependencyAspect } from "./ecsCapacityProviderAspect.js";
-export { validateEcsClusterProps, validateSsmPathComponent } from "./ecsValidation.js";
+export { validateEcsClusterProps, validateEcsDomainConfig, validateSsmPathComponent } from "./ecsValidation.js";
 export * from "./ecsServiceFactory.js";
 /**
  * ECS Cluster supporting multiple services with a shared ALB.

package/dist/lib/resources/aws/compute/ecs.js

@@ -18,7 +18,7 @@ export * from "./ecsContext.js";
 export * from "./ecsTaskDefinition.js";
 export * from "./ecsNetworking.js";
 export { CapacityProviderDependencyAspect } from "./ecsCapacityProviderAspect.js";
-export { validateEcsClusterProps, validateSsmPathComponent } from "./ecsValidation.js";
+export { validateEcsClusterProps, validateEcsDomainConfig, validateSsmPathComponent } from "./ecsValidation.js";
 export * from "./ecsServiceFactory.js";
 /**
  * ECS Cluster supporting multiple services with a shared ALB.

package/dist/lib/resources/aws/compute/ecsNetworking.d.ts

@@ -1,7 +1,7 @@
 import { type ApplicationListener, type ApplicationLoadBalancer, type IApplicationTargetGroup } from "aws-cdk-lib/aws-elasticloadbalancingv2";
 import { type ISecurityGroup } from "aws-cdk-lib/aws-ec2";
 import { type ICertificate } from "aws-cdk-lib/aws-certificatemanager";
-import { ARecord, type IHostedZone } from "aws-cdk-lib/aws-route53";
+import { type ARecord, type IHostedZone } from "aws-cdk-lib/aws-route53";
 import type { AutoScalingGroup } from "aws-cdk-lib/aws-autoscaling";
 import type { ContainerDefinition, FargateService, Ec2Service } from "aws-cdk-lib/aws-ecs";
 import { SecurityGroup } from "../networking/securityGroup.js";