@fjall/components-infrastructure 7.3.0 → 9.0.0

package/dist/lib/resources/aws/compute/ecsNetworking.js

@@ -11,6 +11,9 @@ import { SecurityGroup } from "../networking/securityGroup.js";
 import { DNS_APEX, isManagedDomainBinding, isWithinZone } from "../../../utils/domainTypes.js";
 import { readInjectedManagedDomainBinding } from "../../../utils/managedDomainContext.js";
 import { ResourceNaming } from "../../../utils/resourceNaming.js";
+import { stackScopedExportName } from "../../../utils/exportNaming.js";
+import { registerAlbAliasTarget } from "../../../utils/albAliasTargetRegistry.js";
+import { albDnsExportName, albHostedZoneIdExportName } from "@fjall/util";
 import { getSafeZoneName, toPascalCase } from "../../../utils/capitaliseString.js";
 import { FjallLogger } from "../../../utils/validationLogger.js";
 import { isServiceEc2 } from "./ecsTaskDefinition.js";
@@ -44,27 +47,42 @@ export function addLoadBalancer(ctx, anyServiceUsesEc2, asgSecurityGroup) {
     });
     new CfnOutput(ctx.scope, `${ctx.outputName}LoadBalancerDnsName`, {
         key: `${ctx.outputName}LoadBalancerDnsName`,
-        exportName: `${props.clusterName}LoadBalancerDnsName`,
+        exportName: stackScopedExportName(ctx.scope, `${props.clusterName}LoadBalancerDnsName`),
         value: loadBalancer.loadBalancerDnsName
     });
-    // Cross-stack exports consumed by the Domain construct's `fjallApp(<name>)`
-    // alias target. Names mirror the consumer contract in `cross-system-parity`.
+    // Cross-stack exports consumed by the Domain construct's
+    // `fjallApp(<app>, <compute>)` alias target. Keyed on the APP name — not
+    // `ctx.outputName` (the compute construct id) — because `fjall add compute`
+    // names the compute from the user's --name, so an app "my-app" with a
+    // compute "api" exported `ApiAlbDnsName` while the Domain asked for
+    // `MyAppAlbDnsName`. Qualified by the compute too, because an app may front
+    // several ALBs and the app-keyed name alone collides; the unqualified
+    // app-level pair is emitted once by App.synth, and only when there is
+    // exactly one (albAliasTargetRegistry.ts).
+    const targetAppName = props.appName ?? props.clusterName;
+    registerAlbAliasTarget({
+        appName: targetAppName,
+        computeName: props.clusterName,
+        scope: ctx.scope,
+        dnsName: loadBalancer.loadBalancerDnsName,
+        hostedZoneId: loadBalancer.loadBalancerCanonicalHostedZoneId
+    });
     new CfnOutput(ctx.scope, `${ctx.outputName}AlbDnsName`, {
         key: `${ctx.outputName}AlbDnsName`,
-        exportName: `${ctx.outputName}AlbDnsName`,
+        exportName: albDnsExportName(targetAppName, props.clusterName),
         value: loadBalancer.loadBalancerDnsName,
         description: `ALB DNS name for ${props.clusterName} (consumed by Domain alias targets)`
     });
     new CfnOutput(ctx.scope, `${ctx.outputName}AlbHostedZoneId`, {
         key: `${ctx.outputName}AlbHostedZoneId`,
-        exportName: `${ctx.outputName}AlbHostedZoneId`,
+        exportName: albHostedZoneIdExportName(targetAppName, props.clusterName),
         value: loadBalancer.loadBalancerCanonicalHostedZoneId,
         description: `ALB canonical hosted zone ID for ${props.clusterName}`
     });
     const customDomain = props.cluster?.domain || props.cluster?.domainConfig?.domainName;
     new CfnOutput(ctx.scope, `${ctx.outputName}LoadBalancerUrl`, {
         key: `${ctx.outputName}LoadBalancerUrl`,
-        exportName: `${props.clusterName}LoadBalancerUrl`,
+        exportName: stackScopedExportName(ctx.scope, `${props.clusterName}LoadBalancerUrl`),
         value: customDomain
             ? `https://${customDomain}`
             : `http://${loadBalancer.loadBalancerDnsName}`,
@@ -73,7 +91,7 @@ export function addLoadBalancer(ctx, anyServiceUsesEc2, asgSecurityGroup) {
     // Export load balancer ARN for monitoring
     new CfnOutput(ctx.scope, `${ctx.outputName}LoadBalancerArn`, {
         key: `${ctx.outputName}LoadBalancerArn`,
-        exportName: `${props.clusterName}LoadBalancerArn`,
+        exportName: stackScopedExportName(ctx.scope, `${props.clusterName}LoadBalancerArn`),
         value: loadBalancer.loadBalancerArn,
         description: `Load Balancer ARN for ${props.clusterName}`
     });
@@ -469,13 +487,13 @@ export function addDirectAccessOutputs(ctx, autoScalingGroup) {
         3000;
     new CfnOutput(ctx.scope, `${ctx.outputName}AutoScalingGroupName`, {
         key: `${ctx.outputName}AutoScalingGroupName`,
-        exportName: `${props.clusterName}AutoScalingGroupName`,
+        exportName: stackScopedExportName(ctx.scope, `${props.clusterName}AutoScalingGroupName`),
         value: autoScalingGroup.autoScalingGroupName,
         description: `Run: aws autoscaling describe-auto-scaling-groups --auto-scaling-group-names <name> to find instance IP`
     });
     new CfnOutput(ctx.scope, `${ctx.outputName}DirectAccessPort`, {
         key: `${ctx.outputName}DirectAccessPort`,
-        exportName: `${props.clusterName}DirectAccessPort`,
+        exportName: stackScopedExportName(ctx.scope, `${props.clusterName}DirectAccessPort`),
         value: String(containerPort),
         description: `Access your app at http://<EC2-PUBLIC-IP>:${containerPort}`
     });

package/dist/lib/resources/aws/compute/ecsServiceFactory.js

@@ -10,6 +10,7 @@ import { SecurityGroup } from "../networking/securityGroup.js";
 import { Ec2Instance } from "./ec2.js";
 import { vpcHasNatGateways } from "../../../utils/vpcUtils.js";
 import { toPascalCase } from "../../../utils/capitaliseString.js";
+import { stackScopedExportName } from "../../../utils/exportNaming.js";
 import { DEFAULT_EC2_INSTANCE_TYPE, DEFAULT_EC2_MIN_CAPACITY, DEFAULT_EC2_MAX_CAPACITY, DEFAULT_EC2_INSTANCE_MONITORING, DEFAULT_WARM_POOL_MIN_SIZE, DEFAULT_WARM_POOL_REUSE_ON_SCALE_IN, DEFAULT_HEALTH_CHECK_GRACE_SECONDS, DEFAULT_MIN_HEALTHY_PERCENT, DEFAULT_MAX_HEALTHY_PERCENT, DEFAULT_DESIRED_COUNT, inferAmiHardwareType } from "./ecsConstants.js";
 import { assertAnchorUnique, assertSharedAsgConfigMatches, assertValidCapacitySlot, getEc2ConfigKey, legacyAnchorFromKey, LEGACY_KEY_FIELDS, resolveCapacityAnchor, resolveCapacitySlot } from "./ecsCapacityConfig.js";
 import { lookupCapacityIdentityPin } from "../../../utils/capacityIdentityContext.js";
@@ -308,7 +309,7 @@ export function createService(ctx, serviceName, serviceProps, taskDefinition, as
     }
     new CfnOutput(ctx.scope, `${ctx.outputName}${toPascalCase(serviceName)}ServiceArn`, {
         key: `${ctx.outputName}${toPascalCase(serviceName)}ServiceArn`,
-        exportName: `${ctx.props.clusterName}${serviceName}ServiceArn`,
+        exportName: stackScopedExportName(ctx.scope, `${ctx.props.clusterName}${serviceName}ServiceArn`),
         value: service.serviceArn,
         description: `ECS Service ARN for ${serviceName}`
     });

package/dist/lib/resources/aws/compute/ecsTaskDefinition.js

@@ -159,9 +159,13 @@ export function addContainersToTask(ctx, serviceName, serviceProps, taskDefiniti
             }
         }
         if (containerConfig.secrets && containerConfig.secrets.length > 0) {
+            // `secrets` is a set of names: a repeated entry (hand-merged arrays,
+            // shared-const spread overlap) must not construct a second SSM import —
+            // the construct id embeds the name, and a duplicate id fails synth.
+            const uniqueSecretNames = [...new Set(containerConfig.secrets)];
             if (containerConfig.secretsImport) {
                 const secretsImportKeys = Object.keys(containerConfig.secretsImport);
-                const duplicateKeys = containerConfig.secrets.filter((key) => secretsImportKeys.includes(key));
+                const duplicateKeys = uniqueSecretNames.filter((key) => secretsImportKeys.includes(key));
                 if (duplicateKeys.length > 0) {
                     throw new Error(`Container '${containerConfig.name}' in service '${serviceName}' has duplicate secret keys ` +
                         `defined in both secrets and secretsImport: ${duplicateKeys.join(", ")}. ` +
@@ -169,7 +173,7 @@ export function addContainersToTask(ctx, serviceName, serviceProps, taskDefiniti
                 }
             }
             const ssmSecretsPath = deriveSsmSecretsPath(ctx.props, serviceName, serviceProps.ssmSecretsPath);
-            for (const secretName of containerConfig.secrets) {
+            for (const secretName of uniqueSecretNames) {
                 validateSecretName(secretName, `container '${containerConfig.name}' of service '${serviceName}'`);
                 const paramPath = `${ssmSecretsPath}/${secretName}`;
                 const param = StringParameter.fromSecureStringParameterAttributes(ctx.scope, `${ctx.props.clusterName}${serviceName}${containerConfig.name}${secretName}SsmParam`, { parameterName: paramPath });

package/dist/lib/resources/aws/database/rdsAuroraGlobal.js

@@ -3,6 +3,7 @@ import { CfnGlobalCluster } from "aws-cdk-lib/aws-rds";
 import { Construct } from "constructs";
 import { RdsAurora } from "./rdsAurora.js";
 import { ResourceNaming } from "../../../utils/resourceNaming.js";
+import { stackScopedExportName } from "../../../utils/exportNaming.js";
 import { toPascalCase } from "../../../utils/capitaliseString.js";
 export class RdsAuroraGlobal extends Construct {
     connections;
@@ -133,7 +134,7 @@ export class RdsAuroraGlobal extends Construct {
         const outputName = toPascalCase(this.props.databaseName);
         new CfnOutput(this, `${outputName}GlobalClusterIdentifierOutput`, {
             value: this.globalId,
-            exportName: `${outputName}GlobalClusterIdentifier`
+            exportName: stackScopedExportName(this, `${outputName}GlobalClusterIdentifier`)
         });
     }
     getCredentials() {

package/dist/lib/resources/aws/database/rdsHelpers.js

@@ -32,7 +32,13 @@ const MULTI_USER_ROTATION_APPLICATIONS = {
  */
 export function resolveStorageEncryptionKey(scope, databaseName, storageKey) {
     if (isCMKRequested(storageKey)) {
-        return new CustomerManagedKey(scope, `${databaseName}ClusterEncryptionKey`, { aliasName: ResourceNaming.storageEncryptionKeyAlias(databaseName) }).key;
+        return new CustomerManagedKey(scope, `${databaseName}ClusterEncryptionKey`, {
+            aliasName: ResourceNaming.storageEncryptionKeyAlias(databaseName),
+            // RDS is RemovalPolicy.SNAPSHOT, so deleting the stack leaves a final
+            // snapshot behind. Destroying its storage key would make that snapshot
+            // permanently unrestorable.
+            protects: "outlives-stack"
+        }).key;
     }
     if (isAwsManagedKey(storageKey) || storageKey === undefined) {
         return undefined;
@@ -45,7 +51,11 @@ export function resolveStorageEncryptionKey(scope, databaseName, storageKey) {
  */
 export function resolvePerformanceInsightsKey(scope, databaseName, piEnabled, encryptionKey) {
     if (piEnabled && isCMKRequested(encryptionKey)) {
-        return new CustomerManagedKey(scope, `${databaseName}PerformanceInsightsKey`, { aliasName: ResourceNaming.insightsKeyAlias(databaseName) }).key;
+        return new CustomerManagedKey(scope, `${databaseName}PerformanceInsightsKey`, {
+            aliasName: ResourceNaming.insightsKeyAlias(databaseName),
+            // Performance-insights data dies with the instance.
+            protects: "stack-scoped"
+        }).key;
     }
     return undefined;
 }

package/dist/lib/resources/aws/database/rdsInstance.js

@@ -237,7 +237,8 @@ export class RdsInstance extends Construct {
         const { piEnabled, piConfig } = resolveDatabaseInsights(props.databaseInsights);
         const readReplicaPerformanceInsightsKey = piEnabled && isCMKRequested(piConfig?.encryptionKey)
             ? new CustomerManagedKey(this, `${this.databaseNameValue}ReadReplicaReaderInsightsKey`, {
-                aliasName: ResourceNaming.readReplicaInsightsKeyAlias(this.databaseNameValue)
+                aliasName: ResourceNaming.readReplicaInsightsKeyAlias(this.databaseNameValue),
+                protects: "stack-scoped"
             }).key
             : undefined;
         this.readReplicaSecurityGroup = new SecurityGroup(this, `${this.databaseNameValue}ReadReplicaSecurityGroup`, {

package/dist/lib/resources/aws/database/rdsProxyOutput.js

@@ -1,5 +1,6 @@
 import { CfnOutput } from "aws-cdk-lib";
 import { toPascalCase } from "../../../utils/capitaliseString.js";
+import { stackScopedExportName } from "../../../utils/exportNaming.js";
 /**
  * Add a CfnOutput for the RDS proxy endpoint.
  * Shared by RdsAurora and RdsInstance constructs.
@@ -8,7 +9,7 @@ export function addProxyCfnOutput(scope, constructId, databaseName, proxy) {
     const outputName = toPascalCase(databaseName);
     new CfnOutput(scope, `${outputName}ProxyEndpointOutput`, {
         key: `${outputName}ProxyEndpoint`,
-        exportName: `${outputName}ProxyEndpoint`,
+        exportName: stackScopedExportName(scope, `${outputName}ProxyEndpoint`),
         value: proxy.endpoint
     });
 }

package/dist/lib/resources/aws/logging/cloudTrail.js

@@ -29,6 +29,9 @@ export class Trail extends Construct {
             ? RemovalPolicy.RETAIN
             : RemovalPolicy.DESTROY;
         this.encryptionKey = new CustomerManagedKey(this, `${id}CloudTrailEncryptionKey`, {
+            // Bound to the bucket's own policy below — the trail's log objects
+            // outlive the stack exactly when the bucket does.
+            protects: "outlives-stack",
             aliasName: `cmk/cloudtrail/${id}/encryptionKey`,
             removalPolicy: storagePolicy
         });

package/dist/lib/resources/aws/networking/ipamPool.js

@@ -6,6 +6,7 @@ import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
 import { ResourceShare } from "../utilities/resourceShare.js";
 import { CustomResource } from "../utilities/customResource.js";
 import getAccountId from "../../../utils/getAccountId.js";
+import { IPAM_PRIVATE_DEFAULT_SCOPE_EXPORT_NAME } from "../../../utils/exportNaming.js";
 import { accountConstructKey, findAccountNameCollision } from "../../../utils/capitaliseString.js";
 import { FjallLogger } from "../../../utils/validationLogger.js";
 import { formatIpamPairTagValue, IPAM_OPERATIONS_POOL_TAG_KEY } from "@fjall/util/aws";
@@ -20,7 +21,7 @@ export class IpamPool extends Construct {
     constructor(scope, id, props) {
         super(scope, id);
         // Get the default IPAM scope ID from props, or CFN import
-        const ipamScopeId = props.ipamScope || Fn.importValue("ipamPrivateDefaultScopeId");
+        const ipamScopeId = props.ipamScope || Fn.importValue(IPAM_PRIVATE_DEFAULT_SCOPE_EXPORT_NAME);
         const regions = props.regions;
         if (!regions || regions.length === 0) {
             throw new Error("At least one region must be specified for IPAM pools");

package/dist/lib/resources/aws/networking/vpc.js

@@ -27,9 +27,14 @@ export class Vpc extends ec2.Vpc {
         });
         this.hasNatGateways = natGateways !== 0;
         this.addInterfaceEndpoints(id, props, this.hasNatGateways);
+        // Export names are unique per account+region, so the id is load-bearing:
+        // without it a stack holding two VPCs emits the name twice and
+        // CloudFormation rejects the template. The `-vpc-cidr` suffix must stay
+        // last — the webapp finds a linked app's CIDR by ListExports + suffix
+        // filter (webapp app/.server/services/infrastructure/captureVpcCidr.ts).
         new CfnOutput(this, "VpcCidrBlock", {
             value: this.vpcCidrBlock,
-            exportName: `${Stack.of(this).stackName}-vpc-cidr`
+            exportName: `${Stack.of(this).stackName}${id}-vpc-cidr`
         });
     }
     static gatewayEndpoints(props) {

package/dist/lib/resources/aws/secrets/kms.d.ts

@@ -1,20 +1,37 @@
 import { RemovalPolicy } from "aws-cdk-lib";
 import { Alias, Key } from "aws-cdk-lib/aws-kms";
 import { Construct } from "constructs";
+export declare const KEY_PROTECTION_SCOPES: readonly ["stack-scoped", "outlives-stack"];
+export type KeyProtectionScope = (typeof KEY_PROTECTION_SCOPES)[number];
 interface CustomerManagedKeyProps {
     description?: string;
     aliasName?: string;
     /**
-     * Removal policy for the KMS key.
+     * Whether anything this key encrypts survives deletion of the stack that
+     * created it. Required, and deliberately not defaulted: a key destroyed
+     * while a resource it encrypted still exists makes that resource
+     * permanently unreadable, and nothing downstream can detect it.
      *
-     * IMPORTANT: KMS keys cannot be immediately deleted. When RemovalPolicy.DESTROY
-     * is used, the key will be scheduled for deletion with a 7-day waiting period
-     * (AWS minimum). During this period, the key is disabled but can be recovered.
+     * - `"stack-scoped"` — everything the key encrypts goes with the stack (an
+     *   SSM parameter, a Secrets Manager secret, performance-insights data).
+     *   The key follows the env-aware default (D17): production RETAINs, every
+     *   other recognised stage DESTROYs. This is what stops a torn-down dev
+     *   stack leaving a chargeable key behind forever.
+     * - `"outlives-stack"` — at least one encrypted resource survives (an RDS
+     *   final snapshot under `RemovalPolicy.SNAPSHOT`, a retained audit bucket,
+     *   a backup vault). The key RETAINs in every environment: ~$1/month is not
+     *   a reason to render a surviving snapshot unrestorable.
      *
-     * For production workloads, always use RETAIN (default) to prevent accidental
-     * data loss - deleting a KMS key makes all encrypted data permanently unrecoverable.
+     * A caller that knows better may still override with `removalPolicy` — the
+     * teardown paths that delete the survivor first legitimately do.
+     */
+    readonly protects: KeyProtectionScope;
+    /**
+     * Explicit removal policy, overriding what `protects` would resolve to.
      *
-     * @default RemovalPolicy.RETAIN
+     * Prefer binding it to the policy of the thing being encrypted rather than
+     * choosing independently — `CloudTrail` passes the same `storagePolicy` to
+     * its bucket and its key precisely so the two cannot drift apart.
      */
     removalPolicy?: RemovalPolicy;
 }

package/dist/lib/resources/aws/secrets/kms.js

@@ -3,6 +3,22 @@ import { Alias, Key } from "aws-cdk-lib/aws-kms";
 import { Construct } from "constructs";
 import { toPascalCase } from "../../../utils/capitaliseString.js";
 import { ResourceNaming } from "../../../utils/resourceNaming.js";
+import { stackScopedExportName } from "../../../utils/exportNaming.js";
+import { envAwareRemovalPolicyDefault, toRemovalPolicy } from "../../../utils/removalPolicy.js";
+export const KEY_PROTECTION_SCOPES = [
+    "stack-scoped",
+    "outlives-stack"
+];
+/**
+ * How long a scheduled-for-deletion key stays recoverable.
+ *
+ * The window must cover the longest recovery affordance of anything the key
+ * protects, or the survivor becomes unreadable before its own recovery period
+ * expires. The longest in this codebase is Secrets Manager's 30-day recovery
+ * window, so the key matches it. (30 days is also AWS's own default and its
+ * maximum; the minimum is 7.)
+ */
+const PENDING_DELETION_WINDOW = Duration.days(30);
 export class CustomerManagedKey extends Construct {
     key;
     alias;
@@ -10,17 +26,23 @@ export class CustomerManagedKey extends Construct {
         super(scope, id);
         // Sanitise id for CloudFormation output keys (must be alphanumeric)
         const outputName = toPascalCase(id);
+        const removalPolicy = props.removalPolicy ??
+            (props.protects === "outlives-stack"
+                ? RemovalPolicy.RETAIN
+                : toRemovalPolicy(envAwareRemovalPolicyDefault()));
         this.key = new Key(this, `${id}Key`, {
             description: props.description || `${id} KMS Key`,
-            removalPolicy: props.removalPolicy ?? RemovalPolicy.RETAIN,
-            pendingWindow: props.removalPolicy === RemovalPolicy.DESTROY
-                ? Duration.days(14)
+            removalPolicy,
+            // Keyed on the RESOLVED policy: reading props.removalPolicy here meant
+            // a key that resolved to DESTROY any other way got no window at all.
+            pendingWindow: removalPolicy === RemovalPolicy.DESTROY
+                ? PENDING_DELETION_WINDOW
                 : undefined
         });
         new CfnOutput(this, `${outputName}KeyArn`, {
             key: `${outputName}Arn`,
             value: this.key.keyArn,
-            exportName: `${outputName}KeyArn`
+            exportName: stackScopedExportName(this, `${outputName}KeyArn`)
         });
         this.alias = new Alias(this, `${id}KeyAlias`, {
             aliasName: props.aliasName || ResourceNaming.defaultKeyAlias(id),
@@ -29,7 +51,7 @@ export class CustomerManagedKey extends Construct {
         new CfnOutput(this, `${outputName}KeyAliasArn`, {
             key: `${outputName}AliasArn`,
             value: this.alias.aliasArn,
-            exportName: `${outputName}KeyAliasArn`
+            exportName: stackScopedExportName(this, `${outputName}KeyAliasArn`)
         });
     }
 }

package/dist/lib/resources/aws/secrets/parameter.js

@@ -26,7 +26,9 @@ export class SecureStringParameter extends Construct {
         else {
             this.cmk = new CustomerManagedKey(this, `${id}Key`, {
                 description: props.description || `${id} KMS Key`,
-                aliasName: props.aliasName
+                aliasName: props.aliasName,
+                // The parameter is deleted with the stack; nothing it encrypts survives.
+                protects: "stack-scoped"
             });
         }
         this.parameter = new AwsCustomResource(this, `${id}SecureStringParameter`, {

package/dist/lib/resources/aws/secrets/secret.js

@@ -72,7 +72,10 @@ export class Secret extends Construct {
         }
         // Create KMS key for new secrets only
         const customerManagedKey = new CustomerManagedKey(this, `${id}CustomerManagedKey`, {
-            aliasName: props.aliasName ?? ResourceNaming.defaultKeyAlias(id)
+            aliasName: props.aliasName ?? ResourceNaming.defaultKeyAlias(id),
+            // The secret goes with the stack. Its 30-day recovery window is
+            // covered by the key's own pending-deletion window, not by retention.
+            protects: "stack-scoped"
         });
         this.secretsCustomerManagedKey = customerManagedKey;
         /**

package/dist/lib/resources/aws/storage/ecr.d.ts

@@ -7,6 +7,12 @@ interface EcrProps {
     /** Default IMMUTABLE (supply-chain guard). Dev-slot repos MUST pass MUTABLE —
      *  every `fjall dev up` repushes the branch tag (BUG-22). */
     tagMutability?: TagMutability;
+    /**
+     * Overrides the env-aware default (D17: production → RETAIN, every other
+     * recognised environment → DESTROY). RETAIN outlives the stack; DESTROY
+     * takes the repository AND every image in it.
+     */
+    removalPolicy?: "DESTROY" | "RETAIN";
 }
 export declare class EcrFactory {
     static build(id: string, props?: EcrProps): (app: App, scope: Construct) => Ecr;

package/dist/lib/resources/aws/storage/ecr.js

@@ -1,5 +1,6 @@
 import { Repository, TagMutability } from "aws-cdk-lib/aws-ecr";
 import { CfnOutput, RemovalPolicy } from "aws-cdk-lib";
+import { envAwareRemovalPolicyDefault } from "../../../utils/removalPolicy.js";
 export class EcrFactory {
     static build(id, props) {
         return (app, scope) => {
@@ -24,14 +25,17 @@ export class Ecr extends Repository {
         });
     }
     static getRepositoryProps(props) {
-        // Gotcha: DESTROY + emptyOnDelete:true silently wipes every pushed image
-        // on stack teardown — next deploy pulls "not found" for any referenced tag.
+        const destroy = (props?.removalPolicy ?? envAwareRemovalPolicyDefault()) === "DESTROY";
         return {
             ...(props?.repositoryName && { repositoryName: props.repositoryName }),
             imageScanOnPush: true,
             imageTagMutability: props?.tagMutability ?? TagMutability.IMMUTABLE,
-            emptyOnDelete: false,
-            removalPolicy: RemovalPolicy.RETAIN
+            // CloudFormation refuses to delete a repository still holding images, so
+            // DESTROY with `false` is not a gentler DESTROY — it fails the stack
+            // delete outright. Gotcha: DESTROY wipes every pushed image, so a
+            // redeploy pulls "not found" for any tag the old repository held.
+            emptyOnDelete: destroy,
+            removalPolicy: destroy ? RemovalPolicy.DESTROY : RemovalPolicy.RETAIN
         };
     }
     static build(id, props) {

package/dist/lib/resources/aws/storage/s3.d.ts

@@ -36,6 +36,16 @@ export interface S3BucketProps extends BucketProps {
     backupVaultTier?: BackupTier;
     publicReadAccess?: boolean;
     websiteHosting?: WebsiteHostingConfig;
+    /**
+     * Name a `fjallBucket(<name>)` alias target uses to import this bucket's
+     * website exports. Defaults to `bucketName ?? id`, which is right for a
+     * direct `new S3Bucket(scope, "Assets", …)` — `id` is then the author's own
+     * handle. A wrapper that nests the bucket under a derived id MUST pass this:
+     * `Storage` builds its bucket at `${id}Bucket`, so without it a
+     * `fjallBucket("assets")` record would import `AssetsWebsiteEndpoint`
+     * against an exported `AssetsBucketWebsiteEndpoint`.
+     */
+    aliasTargetName?: string;
     /**
      * Declarative bucket-policy statements, each appended via
      * `addToResourcePolicy`. The TLS-only `enforceSSL` deny is always applied

package/dist/lib/resources/aws/storage/s3.js

@@ -4,6 +4,7 @@ import { BlockPublicAccess, Bucket } from "aws-cdk-lib/aws-s3";
 import { ArnPrincipal, Effect, PolicyStatement, StarPrincipal } from "aws-cdk-lib/aws-iam";
 import { RegionInfo } from "aws-cdk-lib/region-info";
 import { toPascalCase } from "../../../utils/capitaliseString.js";
+import { bucketWebsiteEndpointExportName, bucketWebsiteHostedZoneIdExportName } from "@fjall/util";
 import { envAwareRemovalPolicyDefault, toRemovalPolicy } from "../../../utils/removalPolicy.js";
 export { SDK_PRE_EMPTY_TAG_KEY } from "@fjall/util/aws";
 function shouldAutoVersion(tier) {
@@ -17,7 +18,7 @@ function toResourcePolicyPrincipal(identifier) {
 export class S3Bucket extends Bucket {
     backupVaultTier;
     constructor(scope, id, props = {}) {
-        const { websiteHosting, backupVaultTier, resourcePolicyStatements, ...cdkProps } = props;
+        const { websiteHosting, backupVaultTier, resourcePolicyStatements, aliasTargetName, ...cdkProps } = props;
         const isPublic = props.publicReadAccess === true || websiteHosting !== undefined;
         const versioned = props.versioned ?? shouldAutoVersion(backupVaultTier);
         const removalPolicy = props.removalPolicy ?? toRemovalPolicy(envAwareRemovalPolicyDefault());
@@ -73,10 +74,14 @@ export class S3Bucket extends Bucket {
             Tags.of(this).add(SDK_PRE_EMPTY_TAG_KEY, "true");
         }
         if (websiteHosting) {
-            const safeBucket = toPascalCase((props.bucketName ?? id).replace(/[^A-Za-z0-9-]/g, ""));
+            const targetBucketName = aliasTargetName ?? props.bucketName ?? id;
+            // Only the export name routes through the contract helper. `safeBucket`
+            // stays local so the CfnOutput logical ids are unchanged — unifying the
+            // two would silently rename them.
+            const safeBucket = toPascalCase(targetBucketName.replace(/[^A-Za-z0-9-]/g, ""));
             new CfnOutput(this, `${safeBucket}WebsiteEndpoint`, {
                 key: `${safeBucket}WebsiteEndpoint`,
-                exportName: `${safeBucket}WebsiteEndpoint`,
+                exportName: bucketWebsiteEndpointExportName(targetBucketName),
                 value: this.bucketWebsiteDomainName,
                 description: `S3 website endpoint for ${id} (consumed by Domain alias targets)`
             });
@@ -88,7 +93,7 @@ export class S3Bucket extends Bucket {
             }
             new CfnOutput(this, `${safeBucket}WebsiteHostedZoneId`, {
                 key: `${safeBucket}WebsiteHostedZoneId`,
-                exportName: `${safeBucket}WebsiteHostedZoneId`,
+                exportName: bucketWebsiteHostedZoneIdExportName(targetBucketName),
                 value: websiteHostedZoneId,
                 description: `Route 53 hosted zone id for the S3 website endpoint of ${id}`
             });

package/dist/lib/utils/albAliasTargetRegistry.d.ts

@@ -0,0 +1,44 @@
+import type { Construct } from "constructs";
+/**
+ * The app-level half of the `Domain` ALB alias-target contract.
+ *
+ * `fjallApp(appName)` resolves `<App>AlbDnsName` / `<App>AlbHostedZoneId` from
+ * a *different* stack, so the name has to be derivable from the app name
+ * alone — the Domain stack cannot see how many ALBs the app has. But an app
+ * may legitimately front several: one per ALB-bearing compute. Emitting the
+ * app-keyed pair from each of them produced the identical `Outputs` entry N
+ * times and CloudFormation rejected the entire template ("The Outputs section
+ * contains duplicate Export names"), which is how the compute deploy-test
+ * suite — seven ALB-bearing clusters in one app — failed on 2026-08-09.
+ *
+ * So the two halves are split by who can answer the question:
+ *
+ *   - Each compute emits its own `<App>-<Compute>-Alb…` pair unconditionally.
+ *     Always unique, always present, addressable as `fjallApp(app, compute)`.
+ *   - The App emits the unqualified `<App>Alb…` pair at synth time, and ONLY
+ *     when the app registered exactly one ALB — the sole case where "the
+ *     app's ALB" names one thing.
+ *
+ * Two or more and no app-level export is written. A `Domain` using the bare
+ * `fjallApp(app)` then fails at CloudFormation with "No export named
+ * <App>AlbDnsName found", which names the missing export and is fixed by
+ * naming the compute. Picking one of N silently would deploy a domain
+ * pointing at an arbitrary load balancer, and would keep working right up
+ * until the registration order changed.
+ */
+export interface AlbAliasTargetRegistration {
+    readonly appName: string;
+    readonly computeName: string;
+    /** Stack-attached scope the app-level `CfnOutput` is emitted into. */
+    readonly scope: Construct;
+    readonly dnsName: string;
+    readonly hostedZoneId: string;
+}
+export declare function registerAlbAliasTarget(registration: AlbAliasTargetRegistration): void;
+/**
+ * Emit the unqualified app-level alias exports for every app in this tree
+ * that registered exactly one ALB. Call once, from `App.synth()`, before
+ * `super.synth()` — the construct tree is still mutable there, and that is
+ * the same window `applyTagsAspect()` uses.
+ */
+export declare function emitAppLevelAlbAliasExports(root: Construct): void;

package/dist/lib/utils/albAliasTargetRegistry.js

@@ -0,0 +1,69 @@
+import { CfnOutput } from "aws-cdk-lib";
+import { albDnsExportName, albHostedZoneIdExportName } from "@fjall/util";
+import { toPascalCase } from "./capitaliseString.js";
+import { FjallLogger } from "./validationLogger.js";
+/**
+ * Keyed on the construct-tree root (the `App`) so two apps synthesised in one
+ * process — the platform and organisation stacks do this — never see each
+ * other's registrations. Weak so a discarded tree does not leak.
+ */
+const registryByRoot = new WeakMap();
+export function registerAlbAliasTarget(registration) {
+    const root = registration.scope.node.root;
+    const existing = registryByRoot.get(root);
+    if (existing === undefined) {
+        registryByRoot.set(root, [registration]);
+        return;
+    }
+    existing.push(registration);
+}
+/**
+ * Emit the unqualified app-level alias exports for every app in this tree
+ * that registered exactly one ALB. Call once, from `App.synth()`, before
+ * `super.synth()` — the construct tree is still mutable there, and that is
+ * the same window `applyTagsAspect()` uses.
+ */
+export function emitAppLevelAlbAliasExports(root) {
+    const registrations = registryByRoot.get(root);
+    if (registrations === undefined)
+        return;
+    // `App.synth()` is re-entrant (CDK caches the assembly and returns it), and
+    // a second emission would collide on the output's construct id. Draining
+    // makes the call idempotent.
+    registryByRoot.delete(root);
+    const byApp = new Map();
+    for (const registration of registrations) {
+        const forApp = byApp.get(registration.appName);
+        if (forApp === undefined) {
+            byApp.set(registration.appName, [registration]);
+        }
+        else {
+            forApp.push(registration);
+        }
+    }
+    for (const [appName, forApp] of byApp) {
+        const only = forApp.length === 1 ? forApp[0] : undefined;
+        if (only === undefined) {
+            const computeNames = forApp.map((r) => r.computeName).join(", ");
+            FjallLogger.warn(`App '${appName}' fronts ${String(forApp.length)} load balancers (${computeNames}), ` +
+                `so no app-level '${albDnsExportName(appName)}' export was emitted — ` +
+                `'the app's ALB' would be ambiguous. Target a specific one with ` +
+                `fjallApp('${appName}', '<compute>') in your Domain records.`);
+            continue;
+        }
+        // Output logical ids are alphanumeric-only; the app name is not.
+        const logicalId = `${toPascalCase(appName)}AppAlb`;
+        new CfnOutput(only.scope, `${logicalId}DnsName`, {
+            key: `${logicalId}DnsName`,
+            exportName: albDnsExportName(appName),
+            value: only.dnsName,
+            description: `ALB DNS name for ${appName} (sole ALB; consumed by fjallApp('${appName}'))`
+        });
+        new CfnOutput(only.scope, `${logicalId}HostedZoneId`, {
+            key: `${logicalId}HostedZoneId`,
+            exportName: albHostedZoneIdExportName(appName),
+            value: only.hostedZoneId,
+            description: `ALB canonical hosted zone ID for ${appName} (sole ALB)`
+        });
+    }
+}

package/dist/lib/utils/env.d.ts

@@ -47,6 +47,15 @@ export declare function getEnvironment(): string;
  * sentinel meaning "no signal at all".
  */
 export declare function hasExplicitEnvironmentSignal(): boolean;
+/**
+ * True when this synth was driven by Fjall rather than run bare. deploy-core
+ * supplies `-c orgConfig=` on every synth it drives and nothing else does, so
+ * its presence separates "a developer is inspecting a template" from "an
+ * account is about to be deployed to" — a distinction consumers that pick a
+ * default on missing input need, because the safe default differs between the
+ * two. See `envAwareRemovalPolicyDefault`.
+ */
+export declare function isFjallDrivenSynth(): boolean;
 /**
  * Resolve an environment-specific value at CDK synth time.
  *

package/dist/lib/utils/env.js

@@ -77,6 +77,18 @@ export function hasExplicitEnvironmentSignal() {
     const ctxValue = parseContextArg("environment");
     return ctxValue !== undefined && ctxValue !== "";
 }
+/**
+ * True when this synth was driven by Fjall rather than run bare. deploy-core
+ * supplies `-c orgConfig=` on every synth it drives and nothing else does, so
+ * its presence separates "a developer is inspecting a template" from "an
+ * account is about to be deployed to" — a distinction consumers that pick a
+ * default on missing input need, because the safe default differs between the
+ * two. See `envAwareRemovalPolicyDefault`.
+ */
+export function isFjallDrivenSynth() {
+    const raw = parseContextArg(CDK_CONTEXT_KEYS.ORG_CONFIG);
+    return raw !== undefined && raw !== "";
+}
 /**
  * Resolve an environment-specific value at CDK synth time.
  *