@fjall/components-infrastructure 7.2.0 → 8.0.0

package/dist/lib/app.d.ts

@@ -139,6 +139,18 @@ export declare class App extends CdkApp {
      * Retrieve default network stack - named as `${this.name}Network`
      */
     getDefaultNetworkStack(): AwsStack;
+    /**
+     * The Network stack as a dependency, or `undefined` when the app is
+     * networkless.
+     *
+     * `getDefaultNetworkStack()` CREATES the stack as a side effect, so naming
+     * it unconditionally as a dependency is what makes a networkless app
+     * synthesise an empty `<App>Network` — zero resources, which CloudFormation
+     * rejects outright ("Template format error: At least one Resources member
+     * must be defined"). Synth is green, `cdk deploy` is not, so nothing before
+     * the deploy can tell.
+     */
+    private networkDependency;
     /**
      * Retrieve default database stack - named as `${this.name}Database`
      */

package/dist/lib/app.js

@@ -12,6 +12,7 @@ import { ServiceDiscoveryNamespace } from "./resources/aws/networking/serviceDis
 import { BuildkiteFactory } from "./patterns/aws/buildkite.js";
 import { DevSubstrate } from "./patterns/aws/devSubstrate.js";
 import { StandardTagsAspect } from "./utils/standardTagsAspect.js";
+import { emitAppLevelAlbAliasExports } from "./utils/albAliasTargetRegistry.js";
 import { BACKUP_TIER_TAG_KEY, BACKUP_TIER_TAG_MAP } from "./utils/backupTierMapping.js";
 import { randomBytes } from "crypto";
 import { getConfig } from "./utils/getConfig.js";
@@ -203,7 +204,7 @@ export class App extends CdkApp {
      * by CDK when compute resources reference database resources.
      */
     getDefaultComputeStack() {
-        return this.getStack(`${this.stackPrefix}Compute`, this.getDefaultNetworkStack());
+        return this.getStack(`${this.stackPrefix}Compute`, this.networkDependency());
     }
     /**
      * Retrieve default network stack - named as `${this.name}Network`
@@ -211,17 +212,31 @@ export class App extends CdkApp {
     getDefaultNetworkStack() {
         return this.getStack(`${this.stackPrefix}Network`);
     }
+    /**
+     * The Network stack as a dependency, or `undefined` when the app is
+     * networkless.
+     *
+     * `getDefaultNetworkStack()` CREATES the stack as a side effect, so naming
+     * it unconditionally as a dependency is what makes a networkless app
+     * synthesise an empty `<App>Network` — zero resources, which CloudFormation
+     * rejects outright ("Template format error: At least one Resources member
+     * must be defined"). Synth is green, `cdk deploy` is not, so nothing before
+     * the deploy can tell.
+     */
+    networkDependency() {
+        return this.networkDisabled ? undefined : this.getDefaultNetworkStack();
+    }
     /**
      * Retrieve default database stack - named as `${this.name}Database`
      */
     getDefaultDatabaseStack() {
-        return this.getStack(`${this.stackPrefix}Database`, this.getDefaultNetworkStack());
+        return this.getStack(`${this.stackPrefix}Database`, this.networkDependency());
     }
     /**
      * Retrieve default storage stack - named as `${this.name}Storage`
      */
     getDefaultStorageStack() {
-        return this.getStack(`${this.stackPrefix}Storage`, this.getDefaultNetworkStack());
+        return this.getStack(`${this.stackPrefix}Storage`, this.networkDependency());
     }
     /**
      * Retrieve default CDN stack - named as `${this.name}Cdn`
@@ -236,7 +251,9 @@ export class App extends CdkApp {
         // crossRegionReferences is enabled at creation so the Cdn stack can
         // consume a us-east-1 certificate (domain gold-plating D3, BYO path).
         // The flag is inert unless a cross-region reference is synthesised.
-        return this.getStack(`${this.stackPrefix}Cdn`, this.networkDisabled ? undefined : this.getDefaultNetworkStack(), { crossRegionReferences: true });
+        return this.getStack(`${this.stackPrefix}Cdn`, this.networkDependency(), {
+            crossRegionReferences: true
+        });
     }
     /**
      * Retrieve default messaging stack - named as `${this.name}Messaging`
@@ -246,7 +263,7 @@ export class App extends CdkApp {
      * require VPC, but we maintain consistent stack dependency patterns.
      */
     getDefaultMessagingStack() {
-        return this.getStack(`${this.stackPrefix}Messaging`, this.getDefaultNetworkStack());
+        return this.getStack(`${this.stackPrefix}Messaging`, this.networkDependency());
     }
     /**
      * Retrieve the app-owned us-east-1 certificate stack — named
@@ -816,6 +833,9 @@ export class App extends CdkApp {
         // attach directly to the App and never call getStack(), so without this
         // they synthesise untagged. Idempotent via the aspectApplied guard.
         this.applyTagsAspect();
+        // Must precede super.synth(): the tree is still mutable here, and only
+        // now is the ALB count per app final.
+        emitAppLevelAlbAliasExports(this);
         const assembly = super.synth(options);
         // After synthesis, write Fjall manifest to cdk.out
         try {

package/dist/lib/config/aws/ipam.js

@@ -2,6 +2,7 @@ import { CfnOutput } from "aws-cdk-lib";
 import { Construct } from "constructs";
 import { Ipam as IpamClass } from "../../resources/aws/networking/ipam.js";
 import { getConfig } from "../../utils/getConfig.js";
+import { IPAM_PRIVATE_DEFAULT_SCOPE_EXPORT_NAME } from "../../utils/exportNaming.js";
 export class Ipam extends Construct {
     privateDefaultScopeId;
     constructor(scope, id, props) {
@@ -23,10 +24,10 @@ export class Ipam extends Construct {
             ]
         });
         this.privateDefaultScopeId = ipam.attrPrivateDefaultScopeId;
-        new CfnOutput(this, "IpamPrivateDefaultScopeId", {
-            key: "IpamPrivateDefaultScopeId",
+        new CfnOutput(this, IPAM_PRIVATE_DEFAULT_SCOPE_EXPORT_NAME, {
+            key: IPAM_PRIVATE_DEFAULT_SCOPE_EXPORT_NAME,
             value: ipam.attrPrivateDefaultScopeId,
-            exportName: "IpamPrivateDefaultScopeId"
+            exportName: IPAM_PRIVATE_DEFAULT_SCOPE_EXPORT_NAME
         });
     }
 }

package/dist/lib/patterns/aws/cdn.d.ts

@@ -13,6 +13,12 @@ import { type AnyCompute } from "./compute.js";
  * Common CDN props shared across all origin types.
  */
 interface BaseCdnProps {
+    /**
+     * App this CDN fronts, keying the export a `Domain` resolves with
+     * `fjallCdn(<appName>)`. `CdnFactory.build` fills it from the `App`, so it
+     * is only set by hand for a directly-instantiated `Cdn`.
+     */
+    appName?: string;
     cachePolicy?: CachePolicyPreset | ICachePolicy;
     defaultAllowedMethods?: "GET_HEAD" | "GET_HEAD_OPTIONS" | "ALL";
     behaviours?: SmartCdnBehaviour[];
@@ -151,5 +157,5 @@ export declare class CdnFactory {
      * @param props - CDN configuration properties
      * @returns Factory function that creates the CDN when invoked
      */
-    static build(id: string, props: ICdnProps): (_app: App, scope: Construct) => Cdn;
+    static build(id: string, props: ICdnProps): (app: App, scope: Construct) => Cdn;
 }

package/dist/lib/patterns/aws/cdn.js

@@ -82,6 +82,7 @@ export class Cdn extends CloudFrontDistribution {
     static resolveProps(scope, id, props) {
         const defaultOrigin = Cdn.resolveDefaultOrigin(props);
         const behaviours = Cdn.resolveBehaviours(props.behaviours);
+        const appName = props.appName;
         const certificate = props.certificate ??
             (props.certificateArn
                 ? Certificate.fromCertificateArn(scope, `${id}Certificate`, props.certificateArn)
@@ -96,6 +97,7 @@ export class Cdn extends CloudFrontDistribution {
             }
             : {};
         return {
+            appName,
             defaultOrigin,
             defaultCachePolicy: props.cachePolicy,
             defaultAllowedMethods: props.defaultAllowedMethods,
@@ -273,8 +275,13 @@ export class CdnFactory {
      * @returns Factory function that creates the CDN when invoked
      */
     static build(id, props) {
-        return (_app, scope) => {
-            return new Cdn(scope, id, props);
+        return (app, scope) => {
+            // The App is the only place the app name is known here; without it the
+            // export falls back to the construct id and the Domain import misses.
+            return new Cdn(scope, id, {
+                ...props,
+                appName: props.appName ?? app.getName()
+            });
         };
     }
 }

package/dist/lib/patterns/aws/database.js

@@ -6,6 +6,7 @@ import { DynamoDBTable } from "../../resources/aws/database/dynamodb.js";
 import { ClickHouseDatabase } from "./clickhouseDatabase.js";
 import { FjallLogger, warnIfPropertiesIgnored } from "../../utils/validationLogger.js";
 import { toPascalCase } from "../../utils/capitaliseString.js";
+import { ResourceNaming } from "../../utils/resourceNaming.js";
 import { resolveAlertsTopic as resolveAlertsTopicShared } from "../../utils/resolveAlertsTopic.js";
 import { Port } from "aws-cdk-lib/aws-ec2";
 import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
@@ -364,7 +365,7 @@ export class RelationalDatabase extends Construct {
             FjallLogger.warn(`Aurora database '${props.databaseName}' is configured with public accessibility. ` +
                 "This is a security risk and should only be used for development.");
         }
-        this.database = new RdsAurora(this, `${props.databaseName}Rds`, {
+        this.database = new RdsAurora(this, ResourceNaming.rdsChildConstructId(props.databaseName), {
             vpc: props.vpc,
             databaseName: props.databaseName,
             engine: resolvedEngine,
@@ -406,7 +407,7 @@ export class RelationalDatabase extends Construct {
         const resolvedDatabaseEngine = props.databaseEngine ?? "postgresql";
         const resolvedEngine = props.engine ?? getAuroraClusterEngine(resolvedDatabaseEngine);
         const engineConfig = getEngineConfig(resolvedDatabaseEngine);
-        this.database = new RdsAuroraGlobal(this, `${props.databaseName}RdsGlobal`, {
+        this.database = new RdsAuroraGlobal(this, ResourceNaming.globalRdsChildConstructId(props.databaseName), {
             vpc: props.vpc,
             databaseName: props.databaseName,
             primaryRegion: props.primaryRegion,
@@ -439,7 +440,7 @@ export class RelationalDatabase extends Construct {
         const resolvedDatabaseEngine = props.databaseEngine ?? "postgresql";
         const resolvedEngine = props.engine ?? getInstanceEngine(resolvedDatabaseEngine);
         const engineConfig = getEngineConfig(resolvedDatabaseEngine);
-        this.database = new RdsInstance(this, `${props.databaseName}Rds`, {
+        this.database = new RdsInstance(this, ResourceNaming.rdsChildConstructId(props.databaseName), {
             vpc: props.vpc,
             databaseName: props.databaseName,
             instanceType: props.instanceType,

package/dist/lib/patterns/aws/interfaces/domain.d.ts

@@ -11,6 +11,12 @@ export { getDomainExportNames } from "../../../utils/domainTypes.js";
 export type FjallTarget = {
     readonly kind: "ecs";
     readonly appName: string;
+    /**
+     * Names one ALB-bearing compute when the app fronts several. Absent
+     * means the app's sole ALB, which only exists as an export when the app
+     * has exactly one (lib/utils/albAliasTargetRegistry.ts).
+     */
+    readonly computeName?: string;
 } | {
     readonly kind: "cdn";
     readonly appName: string;

package/dist/lib/patterns/aws/storage.js

@@ -60,6 +60,9 @@ export class Storage extends Construct {
             : undefined;
         this.bucket = new S3Bucket(this, `${id}Bucket`, {
             bucketName: props.bucketName,
+            // The bucket nests one level below, so its own id is `${id}Bucket` — the
+            // author's handle for `fjallBucket(<name>)` is THIS construct's id.
+            aliasTargetName: props.bucketName ?? id,
             versioned: props.versioned,
             encryption: toBucketEncryption(props.encryption),
             encryptionKey,

package/dist/lib/patterns/aws/targets/fjallTargets.d.ts

@@ -10,11 +10,16 @@ export type FjallAliasTarget = FjallTarget & IAliasRecordTarget;
 /**
  * Target helper for a Fjall ECS/ALB-fronted app.
  *
- * Requires the app stack to publish exports `${safeApp}AlbDnsName` and
- * `${safeApp}AlbHostedZoneId`. Phase 2 wires these emitters; until then,
- * deploys fail at CloudFormation execution with "No export named … found".
+ * With no `computeName`, requires the app stack to publish exports
+ * `${safeApp}AlbDnsName` and `${safeApp}AlbHostedZoneId` — which `App.synth()`
+ * emits only for an app fronting exactly ONE ALB, since "the app's ALB" names
+ * nothing otherwise. Pass `computeName` for an app with several; that pair
+ * (`${safeApp}-${safeCompute}-Alb…`) is emitted unconditionally per compute.
+ *
+ * Naming an app that has no matching export fails at CloudFormation execution
+ * with "No export named … found", after synth and every unit test pass.
  */
-export declare function fjallApp(appName: string): FjallAliasTarget;
+export declare function fjallApp(appName: string, computeName?: string): FjallAliasTarget;
 /**
  * Target helper for a Fjall CloudFront-fronted app.
  *

package/dist/lib/patterns/aws/targets/fjallTargets.js

@@ -2,15 +2,21 @@ import { resolveBucketTarget, resolveCdnTarget, resolveCustomTarget, resolveEcsT
 /**
  * Target helper for a Fjall ECS/ALB-fronted app.
  *
- * Requires the app stack to publish exports `${safeApp}AlbDnsName` and
- * `${safeApp}AlbHostedZoneId`. Phase 2 wires these emitters; until then,
- * deploys fail at CloudFormation execution with "No export named … found".
+ * With no `computeName`, requires the app stack to publish exports
+ * `${safeApp}AlbDnsName` and `${safeApp}AlbHostedZoneId` — which `App.synth()`
+ * emits only for an app fronting exactly ONE ALB, since "the app's ALB" names
+ * nothing otherwise. Pass `computeName` for an app with several; that pair
+ * (`${safeApp}-${safeCompute}-Alb…`) is emitted unconditionally per compute.
+ *
+ * Naming an app that has no matching export fails at CloudFormation execution
+ * with "No export named … found", after synth and every unit test pass.
  */
-export function fjallApp(appName) {
-    const resolved = resolveEcsTarget(appName);
+export function fjallApp(appName, computeName) {
+    const resolved = resolveEcsTarget(appName, computeName);
     return {
         kind: "ecs",
         appName,
+        ...(computeName !== undefined && { computeName }),
         bind(record, zone) {
             return resolved.bind(record, zone);
         }

package/dist/lib/patterns/aws/targets/targetResolution.d.ts

@@ -1,64 +1,57 @@
 import { type IAliasRecordTarget } from "aws-cdk-lib/aws-route53";
 import type { FjallTarget } from "../interfaces/domain.js";
 /**
- * Cross-phase export-name contract.
+ * Producer-consumer export-name contract for `Domain` alias targets.
  *
- * Phase 1 DEFINES these export names; Phase 2 is responsible for wiring the
- * emitting stacks (`computeEcs.ts`, `cdn.ts`, `storage.ts`) to publish each
- * `CfnOutput` with the matching `exportName`. Until Phase 2 lands the
- * producers, a deploy of any `Domain` with a typed target fails at
- * CloudFormation execution with "No export named … found" — the helpers
- * compile and synthesise, but the cross-stack import resolves at deploy.
+ * Each resolver below imports a value a *different* stack exported. The two
+ * sides agree only if they compose the same string, and CloudFormation is the
+ * first thing that checks: a mismatch synthesises, typechecks and unit-tests
+ * clean, then fails the deploy with "No export named … found".
  *
- * Producer-consumer matrix (see Phase 1 plan §3, D6 / T0.5):
+ * | Producer                            | Consumer              | Export name                             |
+ * |-------------------------------------|-----------------------|-----------------------------------------|
+ * | `App.synth()` (sole-ALB apps only)  | `resolveEcsTarget`    | `<App>AlbDnsName`                       |
+ * | `App.synth()` (sole-ALB apps only)  | `resolveEcsTarget`    | `<App>AlbHostedZoneId`                  |
+ * | `ecsNetworking.ts` app stack        | `resolveEcsTarget`    | `<App>-<Compute>-AlbDnsName`            |
+ * | `ecsNetworking.ts` app stack        | `resolveEcsTarget`    | `<App>-<Compute>-AlbHostedZoneId`       |
+ * | `cloudFront.ts` CDN stack           | `resolveCdnTarget`    | `<App>CdnDistributionDomainName`        |
+ * | `s3.ts` bucket stack                | `resolveBucketTarget` | `<Bucket>WebsiteEndpoint`               |
+ * | `s3.ts` bucket stack                | `resolveBucketTarget` | `<Bucket>WebsiteHostedZoneId`           |
  *
- * | Producer (Phase 2)          | Consumer (Phase 1)      | Export name                              |
- * |-----------------------------|-------------------------|------------------------------------------|
- * | `computeEcs.ts` app stack   | `resolveEcsTarget`      | `${safeApp}AlbDnsName`                    |
- * | `computeEcs.ts` app stack   | `resolveEcsTarget`      | `${safeApp}AlbHostedZoneId`               |
- * | `cdn.ts` CDN stack          | `resolveCdnTarget`      | `${safeApp}CdnDistributionDomainName`     |
- * | `storage.ts` bucket stack   | `resolveBucketTarget`   | `${safeBucket}WebsiteEndpoint`            |
- * | `storage.ts` bucket stack   | `resolveBucketTarget`   | `${safeBucket}WebsiteHostedZoneId`        |
+ * Both sides derive the name from `@fjall/util`'s `…ExportName` helpers, which
+ * take the RAW app or bucket name and sanitise internally. Compose these
+ * strings by hand on either side and the pair silently drifts: an earlier
+ * contract standardised only the suffix and took a pre-sanitised token, so a
+ * producer keyed on its construct id emitted `MyAppCdnCdnDistributionDomainName`
+ * against a consumer asking for `MyAppCdnDistributionDomainName`, and a bucket
+ * named `www.example.com` was imported as a name CloudFormation cannot hold.
+ * Parity is pinned by `lib/__tests__/targetExportParity.test.ts`, which reads
+ * both names out of synthesised templates rather than from the helpers.
  */
-export declare const EXPORT_NAMES: {
-    readonly ALB_DNS: (safeApp: string) => string;
-    readonly ALB_HOSTED_ZONE_ID: (safeApp: string) => string;
-    readonly CDN_DOMAIN: (safeApp: string) => string;
-    readonly BUCKET_WEBSITE_ENDPOINT: (safeBucket: string) => string;
-    readonly BUCKET_WEBSITE_HZ_ID: (safeBucket: string) => string;
-};
 /** Route53-reserved hosted-zone id for CloudFront distributions. */
 export declare const CLOUDFRONT_HOSTED_ZONE_ID = "Z2FDTNDATAQYW2";
 /**
  * Resolve a Fjall ECS/ALB-fronted app to an `IAliasRecordTarget`.
  *
- * Requires the app stack to publish exports:
- *   - `${safeApp}AlbDnsName`
- *   - `${safeApp}AlbHostedZoneId`
- *
- * Phase 2 wires the emitters; until then, deploys of typed targets fail with
- * "No export named … found".
+ * `appName` is the app's name, NOT the cluster or construct id — the producer
+ * in `ecsNetworking.ts` keys on the same value. `computeName` names one of
+ * several ALB-bearing computes; omit it for an app whose sole ALB is exported
+ * unqualified by `App.synth()`.
  */
-export declare function resolveEcsTarget(appName: string): IAliasRecordTarget;
+export declare function resolveEcsTarget(appName: string, computeName?: string): IAliasRecordTarget;
 /**
  * Resolve a Fjall CloudFront-fronted app to an `IAliasRecordTarget`.
  *
- * Requires the CDN stack to publish export `${safeApp}CdnDistributionDomainName`.
- * The CloudFront hosted-zone id is the globally fixed `Z2FDTNDATAQYW2`.
- *
- * Phase 2 wires the emitter; until then, deploys of typed targets fail with
- * "No export named … found".
+ * `appName` is the app's name, NOT the CDN construct id (`fjall add cdn`
+ * defaults that to `<App>Cdn`). The CloudFront hosted-zone id is the globally
+ * fixed `Z2FDTNDATAQYW2`.
  */
 export declare function resolveCdnTarget(appName: string): IAliasRecordTarget;
 /**
  * Resolve a Fjall S3 static-site bucket to an `IAliasRecordTarget`.
  *
- * Requires the bucket stack to publish exports:
- *   - `${safeBucket}WebsiteEndpoint`
- *   - `${safeBucket}WebsiteHostedZoneId`
- *
- * Phase 2 wires the emitters; until then, deploys of typed targets fail with
- * "No export named … found".
+ * `bucketName` is the bucket's name as written, dots and all — the helper
+ * strips what CloudFormation will not hold, and the producer strips the same.
  */
 export declare function resolveBucketTarget(bucketName: string): IAliasRecordTarget;
 /**

package/dist/lib/patterns/aws/targets/targetResolution.js

@@ -1,32 +1,33 @@
 import { Fn } from "aws-cdk-lib";
-import { toPascalCase } from "../../../utils/capitaliseString.js";
+import { albDnsExportName, albHostedZoneIdExportName, cdnDomainExportName, bucketWebsiteEndpointExportName, bucketWebsiteHostedZoneIdExportName } from "@fjall/util";
 /**
- * Cross-phase export-name contract.
+ * Producer-consumer export-name contract for `Domain` alias targets.
  *
- * Phase 1 DEFINES these export names; Phase 2 is responsible for wiring the
- * emitting stacks (`computeEcs.ts`, `cdn.ts`, `storage.ts`) to publish each
- * `CfnOutput` with the matching `exportName`. Until Phase 2 lands the
- * producers, a deploy of any `Domain` with a typed target fails at
- * CloudFormation execution with "No export named … found" — the helpers
- * compile and synthesise, but the cross-stack import resolves at deploy.
+ * Each resolver below imports a value a *different* stack exported. The two
+ * sides agree only if they compose the same string, and CloudFormation is the
+ * first thing that checks: a mismatch synthesises, typechecks and unit-tests
+ * clean, then fails the deploy with "No export named … found".
  *
- * Producer-consumer matrix (see Phase 1 plan §3, D6 / T0.5):
+ * | Producer                            | Consumer              | Export name                             |
+ * |-------------------------------------|-----------------------|-----------------------------------------|
+ * | `App.synth()` (sole-ALB apps only)  | `resolveEcsTarget`    | `<App>AlbDnsName`                       |
+ * | `App.synth()` (sole-ALB apps only)  | `resolveEcsTarget`    | `<App>AlbHostedZoneId`                  |
+ * | `ecsNetworking.ts` app stack        | `resolveEcsTarget`    | `<App>-<Compute>-AlbDnsName`            |
+ * | `ecsNetworking.ts` app stack        | `resolveEcsTarget`    | `<App>-<Compute>-AlbHostedZoneId`       |
+ * | `cloudFront.ts` CDN stack           | `resolveCdnTarget`    | `<App>CdnDistributionDomainName`        |
+ * | `s3.ts` bucket stack                | `resolveBucketTarget` | `<Bucket>WebsiteEndpoint`               |
+ * | `s3.ts` bucket stack                | `resolveBucketTarget` | `<Bucket>WebsiteHostedZoneId`           |
  *
- * | Producer (Phase 2)          | Consumer (Phase 1)      | Export name                              |
- * |-----------------------------|-------------------------|------------------------------------------|
- * | `computeEcs.ts` app stack   | `resolveEcsTarget`      | `${safeApp}AlbDnsName`                    |
- * | `computeEcs.ts` app stack   | `resolveEcsTarget`      | `${safeApp}AlbHostedZoneId`               |
- * | `cdn.ts` CDN stack          | `resolveCdnTarget`      | `${safeApp}CdnDistributionDomainName`     |
- * | `storage.ts` bucket stack   | `resolveBucketTarget`   | `${safeBucket}WebsiteEndpoint`            |
- * | `storage.ts` bucket stack   | `resolveBucketTarget`   | `${safeBucket}WebsiteHostedZoneId`        |
+ * Both sides derive the name from `@fjall/util`'s `…ExportName` helpers, which
+ * take the RAW app or bucket name and sanitise internally. Compose these
+ * strings by hand on either side and the pair silently drifts: an earlier
+ * contract standardised only the suffix and took a pre-sanitised token, so a
+ * producer keyed on its construct id emitted `MyAppCdnCdnDistributionDomainName`
+ * against a consumer asking for `MyAppCdnDistributionDomainName`, and a bucket
+ * named `www.example.com` was imported as a name CloudFormation cannot hold.
+ * Parity is pinned by `lib/__tests__/targetExportParity.test.ts`, which reads
+ * both names out of synthesised templates rather than from the helpers.
  */
-export const EXPORT_NAMES = {
-    ALB_DNS: (safeApp) => `${safeApp}AlbDnsName`,
-    ALB_HOSTED_ZONE_ID: (safeApp) => `${safeApp}AlbHostedZoneId`,
-    CDN_DOMAIN: (safeApp) => `${safeApp}CdnDistributionDomainName`,
-    BUCKET_WEBSITE_ENDPOINT: (safeBucket) => `${safeBucket}WebsiteEndpoint`,
-    BUCKET_WEBSITE_HZ_ID: (safeBucket) => `${safeBucket}WebsiteHostedZoneId`
-};
 /** Route53-reserved hosted-zone id for CloudFront distributions. */
 export const CLOUDFRONT_HOSTED_ZONE_ID = "Z2FDTNDATAQYW2";
 /**
@@ -44,47 +45,36 @@ function buildAliasTarget(dnsName, hostedZoneId) {
 /**
  * Resolve a Fjall ECS/ALB-fronted app to an `IAliasRecordTarget`.
  *
- * Requires the app stack to publish exports:
- *   - `${safeApp}AlbDnsName`
- *   - `${safeApp}AlbHostedZoneId`
- *
- * Phase 2 wires the emitters; until then, deploys of typed targets fail with
- * "No export named … found".
+ * `appName` is the app's name, NOT the cluster or construct id — the producer
+ * in `ecsNetworking.ts` keys on the same value. `computeName` names one of
+ * several ALB-bearing computes; omit it for an app whose sole ALB is exported
+ * unqualified by `App.synth()`.
  */
-export function resolveEcsTarget(appName) {
-    const safeApp = toPascalCase(appName);
-    const dnsName = Fn.importValue(EXPORT_NAMES.ALB_DNS(safeApp));
-    const hostedZoneId = Fn.importValue(EXPORT_NAMES.ALB_HOSTED_ZONE_ID(safeApp));
+export function resolveEcsTarget(appName, computeName) {
+    const dnsName = Fn.importValue(albDnsExportName(appName, computeName));
+    const hostedZoneId = Fn.importValue(albHostedZoneIdExportName(appName, computeName));
     return buildAliasTarget(dnsName, hostedZoneId);
 }
 /**
  * Resolve a Fjall CloudFront-fronted app to an `IAliasRecordTarget`.
  *
- * Requires the CDN stack to publish export `${safeApp}CdnDistributionDomainName`.
- * The CloudFront hosted-zone id is the globally fixed `Z2FDTNDATAQYW2`.
- *
- * Phase 2 wires the emitter; until then, deploys of typed targets fail with
- * "No export named … found".
+ * `appName` is the app's name, NOT the CDN construct id (`fjall add cdn`
+ * defaults that to `<App>Cdn`). The CloudFront hosted-zone id is the globally
+ * fixed `Z2FDTNDATAQYW2`.
  */
 export function resolveCdnTarget(appName) {
-    const safeApp = toPascalCase(appName);
-    const dnsName = Fn.importValue(EXPORT_NAMES.CDN_DOMAIN(safeApp));
+    const dnsName = Fn.importValue(cdnDomainExportName(appName));
     return buildAliasTarget(dnsName, CLOUDFRONT_HOSTED_ZONE_ID);
 }
 /**
  * Resolve a Fjall S3 static-site bucket to an `IAliasRecordTarget`.
  *
- * Requires the bucket stack to publish exports:
- *   - `${safeBucket}WebsiteEndpoint`
- *   - `${safeBucket}WebsiteHostedZoneId`
- *
- * Phase 2 wires the emitters; until then, deploys of typed targets fail with
- * "No export named … found".
+ * `bucketName` is the bucket's name as written, dots and all — the helper
+ * strips what CloudFormation will not hold, and the producer strips the same.
  */
 export function resolveBucketTarget(bucketName) {
-    const safeBucket = toPascalCase(bucketName);
-    const dnsName = Fn.importValue(EXPORT_NAMES.BUCKET_WEBSITE_ENDPOINT(safeBucket));
-    const hostedZoneId = Fn.importValue(EXPORT_NAMES.BUCKET_WEBSITE_HZ_ID(safeBucket));
+    const dnsName = Fn.importValue(bucketWebsiteEndpointExportName(bucketName));
+    const hostedZoneId = Fn.importValue(bucketWebsiteHostedZoneIdExportName(bucketName));
     return buildAliasTarget(dnsName, hostedZoneId);
 }
 /**
@@ -104,11 +94,11 @@ export function resolveCustomTarget(dnsName, hostedZoneId) {
 export function resolveTargetToDnsName(target) {
     switch (target.kind) {
         case "ecs":
-            return Fn.importValue(EXPORT_NAMES.ALB_DNS(toPascalCase(target.appName)));
+            return Fn.importValue(albDnsExportName(target.appName, target.computeName));
         case "cdn":
-            return Fn.importValue(EXPORT_NAMES.CDN_DOMAIN(toPascalCase(target.appName)));
+            return Fn.importValue(cdnDomainExportName(target.appName));
         case "bucket":
-            return Fn.importValue(EXPORT_NAMES.BUCKET_WEBSITE_ENDPOINT(toPascalCase(target.bucketName)));
+            return Fn.importValue(bucketWebsiteEndpointExportName(target.bucketName));
         case "custom":
             return target.dnsName;
         default: {

package/dist/lib/resources/aws/backup/backupVault.js

@@ -15,6 +15,8 @@ export class BackupVault extends Construct {
             new CustomerManagedKey(this, `${props.vaultName}Key`, {
                 description: `Encryption key for backup vault ${props.vaultName}`,
                 aliasName: `cmk/backupVault/${props.vaultName}`,
+                // Recovery points in a retained vault outlive the stack.
+                protects: "outlives-stack",
                 removalPolicy
             });
         this.vault = new Vault(this, `${props.vaultName}Vault`, {

package/dist/lib/resources/aws/cdn/cloudFront.d.ts

@@ -39,6 +39,15 @@ export interface AccessGateConfig {
     password: string;
 }
 export interface CloudFrontDistributionProps {
+    /**
+     * App this CDN fronts. Keys the cross-stack export a `Domain` resolves via
+     * `fjallCdn(<appName>)`. Falls back to the construct id, which is what the
+     * consumer previously disagreed with: `fjall add cdn` defaults the id to
+     * `${toPascalCase(appName)}Cdn`, so the producer emitted
+     * `MyAppCdnCdnDistributionDomainName` for a consumer asking for
+     * `MyAppCdnDistributionDomainName`.
+     */
+    appName?: string;
     defaultOrigin: CdnOriginConfig;
     defaultCachePolicy?: CachePolicyPreset | ICachePolicy;
     defaultAllowedMethods?: "GET_HEAD" | "GET_HEAD_OPTIONS" | "ALL";

package/dist/lib/resources/aws/cdn/cloudFront.js

@@ -1,6 +1,7 @@
 import { Construct } from "constructs";
 import { CfnOutput } from "aws-cdk-lib";
 import { toPascalCase } from "../../../utils/capitaliseString.js";
+import { cdnDomainExportName } from "@fjall/util";
 import { Distribution, PriceClass, ViewerProtocolPolicy, CachePolicy, OriginRequestPolicy, AllowedMethods, OriginProtocolPolicy, Function as CloudFrontFunction, FunctionCode, FunctionRuntime, FunctionEventType } from "aws-cdk-lib/aws-cloudfront";
 import { S3BucketOrigin, LoadBalancerV2Origin, HttpOrigin } from "aws-cdk-lib/aws-cloudfront-origins";
 export class CloudFrontDistribution extends Construct {
@@ -70,7 +71,7 @@ export class CloudFrontDistribution extends Construct {
         });
         new CfnOutput(this, `${outputName}DistributionDomainName`, {
             key: `${outputName}DistributionDomainName`,
-            exportName: `${outputName}CdnDistributionDomainName`,
+            exportName: cdnDomainExportName(props.appName ?? id),
             value: this.distribution.distributionDomainName,
             description: `CloudFront distribution domain name for ${id}`
         });

package/dist/lib/resources/aws/compute/ecs.js

@@ -3,6 +3,7 @@ import { Connections, Port } from "aws-cdk-lib/aws-ec2";
 import { Construct } from "constructs";
 import { CfnOutput, Aspects } from "aws-cdk-lib";
 import { processConnections } from "../../../utils/connections.js";
+import { stackScopedExportName } from "../../../utils/exportNaming.js";
 import { toPascalCase } from "../../../utils/capitaliseString.js";
 import { createEcsServiceAlarms, createLogPatternAlarms } from "../monitoring/index.js";
 // Extracted modules
@@ -307,7 +308,7 @@ export default class EcsCluster extends Construct {
             const safeServiceName = toPascalCase(serviceName);
             new CfnOutput(this, `${this.outputName}${safeServiceName}DeployableService`, {
                 key: `${this.outputName}${safeServiceName}DeployableService`,
-                exportName: `${props.clusterName}${serviceName}DeployableService`,
+                exportName: stackScopedExportName(this, `${props.clusterName}${serviceName}DeployableService`),
                 value: serviceData.service.serviceArn,
                 description: `Deployable ECS Service ARN for ${serviceName} in ${props.clusterName}`
             });
@@ -331,12 +332,12 @@ export default class EcsCluster extends Construct {
         });
         new CfnOutput(this, `${this.outputName}DeployableCluster`, {
             key: `${this.outputName}DeployableCluster`,
-            exportName: `${props.clusterName}DeployableCluster`,
+            exportName: stackScopedExportName(this, `${props.clusterName}DeployableCluster`),
             value: cluster.clusterArn
         });
         new CfnOutput(this, `${this.outputName}ClusterArn`, {
             key: `${this.outputName}ClusterArn`,
-            exportName: `${props.clusterName}ClusterArn`,
+            exportName: stackScopedExportName(this, `${props.clusterName}ClusterArn`),
             value: cluster.clusterArn,
             description: `ECS Cluster ARN for ${props.clusterName}`
         });