constructs

type APICommonProps struct {
	// Name of the API
	Name *string
	// Description of the API
	Description *string
	// Enable CORS
	EnableCORS *bool
	// CORS allowed origins (defaults to ["*"] if not specified)
	AllowOrigins *[]*string
	// Custom domain name
	DomainName *string
	// Certificate ARN for custom domain
	CertificateArn *string
	// Enable access logging
	EnableAccessLogging *bool
	// CloudWatch log group for access logs
	AccessLogGroup awslogs.ILogGroup
	// Throttle settings
	ThrottleRateLimit  *float64
	ThrottleBurstLimit *float64
	// Stage name
	StageName *string
}

type APIGatewayAlarmsConfig struct {
	BaseAlarmsConfig

	// ClientErrorThreshold is the threshold for 4xx errors
	// Default: 10
	ClientErrorThreshold *float64

	// ServerErrorThreshold is the threshold for 5xx errors
	// Default: 5
	ServerErrorThreshold *float64
}

type APIGatewayAlarmsProps struct {
	// ApiId is the API Gateway ID (required)
	ApiId *string

	// StageName is the API Gateway stage name
	// Default: "latest"
	StageName *string

	// AlarmTopic is the SNS topic for alarm notifications (required)
	AlarmTopic awssns.ITopic

	// AlarmNamePrefix is the prefix for alarm names (required)
	// Example: "merchant-application-partner-stage"
	AlarmNamePrefix *string

	// Config contains threshold configuration (optional - uses defaults if nil)
	Config *APIGatewayAlarmsConfig
}

type APIKeyAuthorizer struct {
	constructs.Construct
	Authorizer        awsapigatewayv2.IHttpRouteAuthorizer
	ValidatorFunction awslambda.IFunction
}

type APIKeyAuthorizerProps struct {
	// API key parameter source (header or query)
	APIKeySource *string `json:"apiKeySource"`
	// Parameter name (e.g., "X-API-Key" for header or "apiKey" for query)
	APIKeyParameter *string `json:"apiKeyParameter"`
	// Optional function to validate API keys (if not provided, creates one)
	ValidatorFunction awslambda.IFunction `json:"validatorFunction"`
	// DynamoDB table name for storing API keys (optional)
	APIKeyTableName *string `json:"apiKeyTableName"`
	// Cache results for this many seconds (0-3600)
	ResultsCacheTtl *float64 `json:"resultsCacheTtl"`
}

type AlarmConfig struct {
	// Enable error rate alarm
	EnableErrorAlarm *bool
	// Error rate threshold (percentage)
	ErrorRateThreshold *float64
	// Enable latency alarm
	EnableLatencyAlarm *bool
	// Latency threshold in milliseconds
	LatencyThreshold *float64
	// Enable throttle alarm
	EnableThrottleAlarm *bool
	// Throttle count threshold
	ThrottleThreshold *float64
	// Enable concurrent executions alarm
	EnableConcurrentAlarm *bool
	// Concurrent executions threshold
	ConcurrentThreshold *float64
	// SNS topic for alarm notifications
	AlarmTopic awssns.ITopic
}

type AlarmThresholds struct {
	// Error rate threshold (percentage)
	ErrorRate *float64
	// Latency threshold (milliseconds)
	LatencyP99 *float64
	// Throttle count threshold
	ThrottleCount *float64
	// Concurrent executions threshold
	ConcurrentExecutions *float64
	// Custom thresholds
	CustomThresholds *map[string]*float64
}

type AuditLevel string

type AuditingConstruct struct {
	// AuditLogGroup is the CloudWatch log group for audit logs
	AuditLogGroup awslogs.LogGroup
	// Embedded Construct for CDK compatibility
	constructs.Construct
	// EncryptionKey is the KMS key used for encrypting logs
	EncryptionKey awskms.Key
	// CloudTrail is the CloudTrail instance for API call logging
	CloudTrail awscloudtrail.Trail
	// ApplicationLogGroup is the CloudWatch log group for application logs
	ApplicationLogGroup awslogs.LogGroup
	// DatabaseLogGroup is the CloudWatch log group for database logs
	DatabaseLogGroup awslogs.LogGroup
	// AuditBucket is the S3 bucket for storing audit logs
	AuditBucket awss3.Bucket
	// LogProcessingFunction is the Lambda function for processing logs
	LogProcessingFunction awslambda.Function
	// AuditDashboard is the CloudWatch dashboard for monitoring audit logs
	AuditDashboard awscloudwatch.Dashboard
	// FirehoseDeliveryStream is the Kinesis Firehose for log delivery
	FirehoseDeliveryStream awskinesisfirehose.CfnDeliveryStream
	// LogStream is the Kinesis stream for log collection
	LogStream awskinesis.Stream
	// ComplianceFunction is the Lambda function for compliance checking
	ComplianceFunction awslambda.Function
	// IntegrityFunction is the Lambda function for integrity checking
	IntegrityFunction awslambda.Function
	// AuditAlarms is a list of CloudWatch alarms for audit log alerting
	AuditAlarms []awscloudwatch.Alarm
}

type AuditingProps struct {
	// EncryptionKey is the KMS key used for encrypting audit logs
	EncryptionKey awskms.IKey
	// AuditBucket is the S3 bucket used for storing audit logs
	AuditBucket awss3.IBucket
	// EnableComplianceReporting enables compliance reporting features
	EnableComplianceReporting *bool
	// EnableImmutableLogs makes audit logs immutable to prevent tampering
	EnableImmutableLogs *bool
	// EnableDatabaseLogs enables database query logging
	EnableDatabaseLogs *bool
	// EnableRealTimeProcessing enables real-time log processing
	EnableRealTimeProcessing *bool
	// EnableTamperProtection enables tamper protection for audit logs
	EnableTamperProtection *bool
	// EnableLogAggregation enables log aggregation from multiple sources
	EnableLogAggregation *bool
	// LogRetentionDays specifies how many days to retain logs
	LogRetentionDays *float64
	// EnableSIEMIntegration enables integration with SIEM systems
	EnableSIEMIntegration *bool
	// SIEMEndpoint is the endpoint for SIEM integration
	SIEMEndpoint *string
	// EnableLogAnalysis enables automated log analysis
	EnableLogAnalysis *bool
	// ComplianceFrameworks specifies which compliance frameworks to support
	ComplianceFrameworks *[]string
	// EnableApplicationLogs enables application-level logging
	EnableApplicationLogs *bool
	// AppName is the name of the application being audited
	AppName *string
	// EnableCloudTrail enables AWS CloudTrail for API call logging
	EnableCloudTrail *bool
	// EnableEncryption enables encryption for logs at rest and in transit
	EnableEncryption *bool
	// EnableCrossAccountAccess enables cross-account access for audit logs
	EnableCrossAccountAccess *bool
	// CrossAccountRoleArns specifies the ARNs of roles for cross-account access
	CrossAccountRoleArns *[]*string
	// EnableIntegrityChecking enables integrity checking for audit logs
	EnableIntegrityChecking *bool
	// EnableDashboard enables a CloudWatch dashboard for audit logs
	EnableDashboard *bool
	// EnableAlerting enables CloudWatch alerts for audit logs
	EnableAlerting *bool
	// AlertTopicArn is the ARN of the SNS topic for alerts
	AlertTopicArn *string
	// Environment specifies the deployment environment (dev, test, prod)
	Environment *string
	// EnableRegulatoryCompliance enables features for regulatory compliance
	EnableRegulatoryCompliance *bool
	// AuditLevel specifies the level of audit logging (BASIC, DETAILED, COMPREHENSIVE)
	AuditLevel AuditLevel
}

type BaseAlarmsConfig struct {
	// EvaluationPeriods is the number of periods to evaluate
	EvaluationPeriods *float64

	// Period is the evaluation period in seconds
	// Default: 300 (5 minutes)
	Period *float64
}

type BaseManagementTableProps struct {
	// Table name
	TableName *string
	// TTL attribute name for automatic cleanup
	TimeToLiveAttribute *string
	// Default table name if not provided
	DefaultTableName string
}

type ComplianceFramework string

type ComplianceStack struct {
	constructs.Construct
	CloudTrail         awscloudtrail.Trail
	ConfigRecorder     awsconfig.CfnConfigurationRecorder
	GuardDutyDetector  awsguardduty.CfnDetector
	SecurityHub        awssecurityhub.CfnHub
	ComplianceBucket   awss3.Bucket
	EncryptionKey      awskms.Key
	ComplianceLogGroup awslogs.LogGroup
	ComplianceFunction awslambda.Function
}

type ComplianceStackProps struct {
	// Application name for resource naming
	AppName *string

	// Compliance frameworks to implement
	ComplianceFrameworks *[]ComplianceFramework

	// Enable CloudTrail logging
	EnableCloudTrail *bool

	// Enable AWS Config rules
	EnableConfig *bool

	// Enable GuardDuty threat detection
	EnableGuardDuty *bool

	// Enable Security Hub
	EnableSecurityHub *bool

	// Enable data encryption at rest
	EnableEncryption *bool

	// Data retention period in days
	DataRetentionDays *float64

	// Enable compliance reports
	EnableComplianceReports *bool

	// S3 bucket for compliance data
	ComplianceBucket awss3.IBucket

	// KMS key for encryption
	EncryptionKey awskms.IKey

	// CloudWatch log group for compliance logs
	ComplianceLogGroup awslogs.ILogGroup

	// Enable detailed access logging
	EnableDetailedLogging *bool

	// Enable audit trail
	EnableAuditTrail *bool

	// Environment for compliance (dev, staging, prod)
	Environment *string

	// Organization ID for multi-account setup
	OrganizationId *string

	// Enable compliance automation
	EnableAutomation *bool

	// Notification topic ARN for compliance alerts
	NotificationTopicArn *string
}

type ConnectionTable struct {
	*LiftTable
	// contains filtered or unexported fields
}

type ConnectionTableProps struct {
	// Table name
	TableName *string
	// Enable TTL for automatic connection cleanup
	TimeToLiveAttribute *string
	// Enable default GSIs used by Lift's connection store (default: true)
	EnableConnectionIndexes *bool
}

type DynamORMEventStore struct {
	constructs.Construct

	// Event table for storing events
	EventTable *LiftTable

	// Snapshot table for storing snapshots
	SnapshotTable *LiftTable

	// S3 bucket for archival (if enabled)
	ArchivalBucket awss3.IBucket

	// CloudWatch metrics
	Metrics map[string]awscloudwatch.Metric

	// IAM roles for different access patterns
	EventReaderRole     awsiam.Role
	EventWriterRole     awsiam.Role
	SnapshotManagerRole awsiam.Role
	// contains filtered or unexported fields
}

type DynamORMEventStoreProps struct {
	ArchivalAfter          awscdk.Duration
	ArchivalBucket         awss3.IBucket
	EventTTL               awscdk.Duration
	SnapshotTimeInterval   awscdk.Duration
	SnapshotRetention      awscdk.Duration
	SnapshotFrequency      *int
	EnableEventEncryption  *bool
	Tags                   *map[string]*string
	EventTableName         *string
	SnapshotTableName      *string
	TenantAttribute        *string
	KMSKey                 *string
	ReadCapacity           *float64
	WriteCapacity          *float64
	EnableGSIs             *bool
	SnapshotSizeLimit      *int
	EnableMultiTenant      *bool
	EnableEventVersioning  *bool
	AlertThresholds        *EventStoreAlertThresholds
	EnableEventCompression *bool
	EventStreamEnabled     *bool
	SnapshotStreamEnabled  *bool
	EnableAutoScaling      *bool
	EnableArchival         *bool
	EnableMetrics          *bool
	EnableDetailedMetrics  *bool
	EnableEncryption       *bool
	Pattern                EventStorePattern
	SnapshotStrategy       SnapshotStrategy
	ProjectionQueries      []string
}

type DynamoDBAlarmsConfig struct {
	BaseAlarmsConfig

	// LatencyThreshold is the threshold in milliseconds for latency alarm
	// Default: 250
	LatencyThreshold *float64

	// ReadCapacityThreshold is the threshold for consumed read capacity units
	// Default: 900
	ReadCapacityThreshold *float64

	// WriteCapacityThreshold is the threshold for consumed write capacity units
	// Default: 900
	WriteCapacityThreshold *float64
}

type DynamoDBAlarmsProps struct {
	// TableName is the DynamoDB table name (required)
	TableName *string

	// AlarmTopic is the SNS topic for alarm notifications (required)
	AlarmTopic awssns.ITopic

	// AlarmNamePrefix is the prefix for alarm names (required)
	// Example: "merchant-application-partner-stage"
	AlarmNamePrefix *string

	// Config contains threshold configuration (optional - uses defaults if nil)
	Config *DynamoDBAlarmsConfig
}

type DynamoStreamProcessor struct {
	constructs.Construct

	// The Lambda function processing DynamoDB stream records
	Function *LiftFunction

	// The DynamORM streaming table
	StreamingTable *StreamingTable

	// Dead letter queue (if enabled)
	DeadLetterQueue awssqs.IQueue

	// Event source mapping
	EventSource awslambdaeventsources.DynamoEventSource
}

type DynamoStreamProcessorProps struct {
	// StreamingTableProps defines the properties of the underlying DynamORM streaming table.
	StreamingTableProps *StreamingTableProps
	// DeadLetterQueueProps configures an optional SQS dead‑letter queue for failed stream records.
	DeadLetterQueueProps *awssqs.QueueProps
	// EventSourceProps allows overriding any of the default DynamoDB event source settings.
	EventSourceProps *awslambdaeventsources.DynamoEventSourceProps

	// Optional fine‑grained tuning parameters. If nil, sensible defaults are applied.
	BatchSize               *float64 // Number of records to fetch per batch (default 10)
	RetryAttempts           *float64 // Max retry attempts for failed batches (default 10000)
	ParallelizationFactor   *float64 // Parallelism factor for batch processing (default 1)
	EnableDeadLetterQueue   *bool    // Whether to provision a dead‑letter queue (default true)
	BisectBatchOnError      *bool    // Split failing batch into smaller batches (default false)
	ReportBatchItemFailures *bool    // Report individual item failures to Lambda (default true)
	EnableTracing           *bool    // Enable X‑Ray tracing for the Lambda function
	EnableMultiTenant       *bool    // Configure the function for multi‑tenant use cases
	EnableMonitoring        *bool    // Attach CloudWatch monitoring dashboards

	// Duration settings control throttling and record retention.
	MaxBatchingWindow awscdk.Duration // Maximum time to wait before invoking the function (default 5 s)
	MaxRecordAge      awscdk.Duration // Maximum age of a stream record before it is discarded (default 24 h)
	TumblingWindow    awscdk.Duration // Optional tumbling window for aggregating records

	// FunctionProps contains the underlying Lambda configuration.
	FunctionProps awslambda.FunctionProps
	// StartingPosition specifies where the stream should start reading.
	StartingPosition awslambda.StartingPosition
}

type EnhancedMonitoring struct {
	constructs.Construct
	Metrics       map[string]awscloudwatch.IMetric
	Alarms        map[string]awscloudwatch.IAlarm
	Dashboard     awscloudwatch.Dashboard
	LogGroup      awslogs.LogGroup
	MetricFilters map[string]awslogs.MetricFilter
}

type EnhancedMonitoringProps struct {
	// Resource to monitor
	Resource MonitorableResource
	// Custom namespace for metrics
	Namespace *string
	// Alert configuration
	AlertTopic awssns.ITopic
	// Dashboard configuration
	DashboardName *string
	// Metric configuration
	MetricConfig *MetricConfiguration
	// Alarm thresholds
	AlarmThresholds *AlarmThresholds
	// Enable real-time streaming
	EnableRealTimeStreaming *bool
	// Environment tag
	Environment *string
}

type EnhancedSecurity struct {
	constructs.Construct
	SecurityGroup    awsec2.SecurityGroup
	WAF              awswafv2.CfnWebACL
	Secrets          map[string]awssecretsmanager.Secret
	VPCFlowLogsGroup awslogs.LogGroup
	SecurityMetrics  map[string]awscloudwatch.IMetric
	VPCEndpoints     map[string]awsec2.InterfaceVpcEndpoint
}

type EnhancedSecurityProps struct {
	Vpc               awsec2.IVpc
	EnableWAF         *bool
	WAFConfig         *WAFRuleConfig
	EnableVPCFlowLogs *bool
	EnableGuardDuty   *bool
	EnableSecurityHub *bool
	EnableConfigRules *bool
	Environment       *string
	ApplicationName   *string
	IngressRules      []SecurityRule
	EgressRules       []SecurityRule
	Secrets           []SecretConfig
	VPCEndpointConfig *VPCEndpointConfig
}

type EventBridgeHandler struct {
	constructs.Construct

	// The Lambda function handling events
	Function *LiftFunction

	// The EventBridge rule
	Rule awsevents.Rule

	// The event bus (default or custom)
	EventBus awsevents.IEventBus

	// Dead letter queue (if enabled)
	DeadLetterQueue awssqs.IQueue

	// Lambda target
	Target awseventstargets.LambdaFunction
}

type EventBridgeHandlerProps struct {
	// Lambda function properties
	FunctionProps awslambda.FunctionProps

	// Event rule properties (optional - creates new rule if not provided)
	RuleProps *awsevents.RuleProps

	// Existing rule to use (optional - creates new if not provided)
	ExistingRule awsevents.Rule

	// Existing event bus to use (optional - uses default if not provided)
	ExistingEventBus awsevents.IEventBus

	// Event bus properties for creating a custom event bus
	EventBusProps *awsevents.EventBusProps

	// Event pattern for filtering events
	EventPattern *awsevents.EventPattern

	// Schedule expression for scheduled events (conflicts with EventPattern)
	ScheduleExpression *string

	// Lambda target properties
	TargetProps *awseventstargets.LambdaFunctionProps

	// Dead letter queue properties (optional)
	DeadLetterQueueProps *awssqs.QueueProps

	// Enable dead letter queue (default: true)
	EnableDeadLetterQueue *bool

	// Maximum event age in seconds (default: 3600)
	MaxEventAge awscdk.Duration

	// Retry attempts for failed invocations (default: 3)
	RetryAttempts *float64

	// Enable input transformation
	InputTransformation *awsevents.RuleTargetInput

	// Lift-specific settings
	EnableTracing     *bool
	EnableMultiTenant *bool
	EnableMonitoring  *bool

	// Cross-account event bus support
	CrossAccountEventBusArn *string
}

type EventBusProcessor struct {
	constructs.Construct

	Function *LiftFunction
	Table    *EventBusTable

	DeadLetterQueue awssqs.IQueue
	EventSource     awslambdaeventsources.DynamoEventSource
}

type EventBusProcessorProps struct {
	// Lambda function configuration (required).
	FunctionProps awslambda.FunctionProps

	// Existing EventBus table (optional). If omitted, a new EventBusTable is created.
	Table *EventBusTable
	// Properties for creating a new EventBus table (optional).
	TableProps *EventBusTableProps

	// Optional event source overrides.
	EventSourceProps *awslambdaeventsources.DynamoEventSourceProps

	// Optional tuning parameters (defaults are applied when nil/zero).
	BatchSize               *float64
	RetryAttempts           *float64
	ParallelizationFactor   *float64
	EnableDeadLetterQueue   *bool
	BisectBatchOnError      *bool
	ReportBatchItemFailures *bool

	DeadLetterQueueProps *awssqs.QueueProps

	// EventTypes filters stream events by `dynamodb.NewImage.event_type.S`.
	// When empty, no filter is applied (the processor will receive all stream records).
	EventTypes []string

	StartingPosition  awslambda.StartingPosition
	MaxBatchingWindow awscdk.Duration
	MaxRecordAge      awscdk.Duration
}

type EventBusScheduler struct {
	constructs.Construct

	Table   *EventBusTable
	Handler *EventBridgeHandler
}

type EventBusSchedulerProps struct {
	// Existing EventBus table (optional). If omitted, a new EventBusTable is created.
	Table *EventBusTable
	// Properties for creating a new EventBus table (optional).
	TableProps *EventBusTableProps

	// Required: schedule expression like "rate(1 minute)" or "cron(0/1 * * * ? *)".
	ScheduleExpression *string

	// Required: Lambda function configuration.
	FunctionProps awslambda.FunctionProps

	// Optional: EventBridge rule overrides.
	RuleProps *awsevents.RuleProps

	// Optional: EventBridge target tuning.
	MaxEventAge   awscdk.Duration
	RetryAttempts *float64
	EnableDLQ     *bool
	DLQProps      *awssqs.QueueProps

	// Optional: stable naming + runtime table resolution.
	// When AppName+Stage are provided, Lift injects APP_NAME/STAGE[/PARTNER] into the function env,
	// and uses them for deterministic resource names.
	AppName *string
	Stage   *string
	Partner *string
}

type EventBusTable struct {
	constructs.Construct

	// Table is the DynamoDB table
	Table awsdynamodb.Table

	// EventIDIndex is the GSI for querying by event ID (if enabled)
	EventIDIndex awsdynamodb.GlobalSecondaryIndexProps

	// StreamArn is the DynamoDB Stream ARN (if enabled)
	StreamArn *string
}

type EventBusTableProps struct {
	// Pointer fields (8 bytes each)
	TableName                 *string             // DynamoDB table name - MUST be unique
	ReadCapacity              *float64            // Provisioned read capacity
	WriteCapacity             *float64            // Provisioned write capacity
	EnablePointInTimeRecovery *bool               // Enable automated backups
	TimeToLiveAttribute       *string             // TTL attribute name (default: "ttl")
	EnableStream              *bool               // Enable DynamoDB Streams
	EnableEventIDIndex        *bool               // Add GSI for event ID lookups
	Tags                      *map[string]*string // Resource tags
	EncryptionKey             awskms.IKey         // KMS encryption key (optional)

	// Value types
	BillingMode    awsdynamodb.BillingMode    // Billing mode (default: PAY_PER_REQUEST)
	RemovalPolicy  awscdk.RemovalPolicy       // Removal policy for stack deletion
	StreamViewType awsdynamodb.StreamViewType // Stream data type
}

type EventRoutingTable struct {
	*LiftTable
	// contains filtered or unexported fields
}

type EventRoutingTableProps struct {
	// Table name
	TableName *string
	// TTL attribute name for automatic cleanup
	TimeToLiveAttribute *string
}

type EventStoreAlertThresholds struct {
	HighEventRate        *float64 // Events per second threshold
	HighErrorRate        *float64 // Error rate threshold
	HighLatency          *float64 // Latency threshold (ms)
	LowSnapshotFrequency *float64 // Minimum snapshot frequency
	HighStorageUsage     *float64 // Storage usage threshold (GB)
}

type EventStorePattern string

type FrontendDistribution struct {
	constructs.Construct

	Bucket       awss3.Bucket
	Distribution awscloudfront.Distribution
	Certificate  awscertificatemanager.ICertificate

	WWWRedirect *HostRedirect
}

type FrontendDistributionProps struct {
	// Required: hosted zone authoritative for DomainName.
	HostedZone awsroute53.IHostedZone
	// Optional: custom domain certificate. If omitted, Lift creates a DNS-validated certificate in us-east-1.
	Certificate awscertificatemanager.ICertificate
	// Optional: override response headers policy for static content.
	ResponseHeadersPolicy awscloudfront.IResponseHeadersPolicy
	// Optional: cache policy for API behaviors.
	// Note: Authorization must be forwarded via CachePolicy (not OriginRequestPolicy).
	ApiCachePolicy awscloudfront.ICachePolicy
	// Optional: origin request policy for API behaviors (default: none).
	ApiOriginRequestPolicy awscloudfront.IOriginRequestPolicy

	// Required: apex/canonical domain (e.g., "example.com").
	DomainName *string

	// Required: API origin host (e.g., "api.example.com" or "*.execute-api.*.amazonaws.com").
	ApiOriginDomainName *string

	// Optional: stable naming inputs for deterministic bucket names.
	AppName    *string
	Stage      *string
	Partner    *string
	BucketName *string

	// Optional: bucket configuration.
	AutoDeleteObjects *bool
	Versioned         *bool

	// Optional: additional SANs to include when Lift creates a certificate.
	SubjectAlternativeNames *[]*string

	// Optional: enable www.<domain> redirect to apex (default true).
	EnableWWWRedirect *bool
	WWWDomainName     *string

	// Optional: treat site as SPA by serving /index.html for 403/404 (default false).
	SinglePageApp *bool

	// Optional: WAFv2 Web ACL ARN (global scope) to attach to the distribution.
	WebAclId *string

	// Optional: distribution tuning.
	EnableIpv6 *bool

	// Optional: cache path patterns that should receive long-lived "hashed asset" caching.
	HashedAssetPathPatterns *[]*string

	// Optional: path patterns routed to the API origin (default: ["api/*", "graphql", ".well-known/*"]).
	ApiPathPatterns *[]*string

	// Optional: tags applied to created resources.
	Tags *map[string]*string

	// Optional: bucket configuration.
	RemovalPolicy awscdk.RemovalPolicy

	// Optional: distribution tuning.
	PriceClass  awscloudfront.PriceClass
	HttpVersion awscloudfront.HttpVersion
}

type HostRedirect struct {
	constructs.Construct

	Distribution awscloudfront.Distribution
	Function     awscloudfront.Function
	Certificate  awscertificatemanager.ICertificate
}

type HostRedirectProps struct {
	// Required: source host (e.g., "www.example.com").
	FromDomainName *string
	// Required: target host (e.g., "example.com").
	ToDomainName *string
	// Required: hosted zone authoritative for FromDomainName.
	HostedZone awsroute53.IHostedZone

	// Optional: certificate for FromDomainName. If omitted, Lift creates a DNS-validated certificate in us-east-1.
	Certificate awscertificatemanager.ICertificate

	// Optional: WAFv2 Web ACL ARN (global scope).
	WebAclId *string

	// Optional: create AAAA alias record (default true).
	EnableIpv6 *bool

	// Optional: tags applied to created resources.
	Tags *map[string]*string
}

type IdempotencyTableProps struct {
	// Table name
	TableName *string
	// TTL attribute name for automatic cleanup
	TimeToLiveAttribute *string
}

type IdempotentFunction struct {
	constructs.Construct
	Function         *LiftFunction
	IdempotencyTable *LiftTable
}

type IdempotentFunctionProps struct {
	// Embedded struct first (largest)
	LiftFunctionProps
	// Pointers (8 bytes each)
	KeyField              *string
	TTLSeconds            *float64
	TableName             *string
	EnableResponseCaching *bool
	MaxResponseSizeKB     *float64
	// Smaller types last
	KeyExtractor IdempotentKeyExtractor
}

type IdempotentKeyExtractor string

type IntegrationOptions struct {
	// Authorizer for this method
	Authorizer awsapigateway.IAuthorizer
	// Request validator
	RequestValidator awsapigateway.IRequestValidator
	// API key required
	ApiKeyRequired *bool
	// EnableStreaming overrides LiftRestAPIProps.EnableStreaming for this method.
	EnableStreaming *bool
	// StreamingTimeoutSeconds overrides LiftRestAPIProps.StreamingTimeout for this method.
	StreamingTimeoutSeconds *int
}

type KinesisProcessor struct {
	constructs.Construct
	Stream   awskinesis.IStream
	Function LiftFunction
	DLQ      awssqs.IQueue
	Consumer awskinesis.IStreamConsumer
}

type KinesisProcessorProps struct {
	// The Lambda function configuration
	FunctionProps *LiftFunctionProps `field:"required"`

	// Optional: Stream configuration
	StreamProps *awskinesis.StreamProps `field:"optional"`

	// Optional: Use an existing stream instead of creating a new one
	ExistingStream awskinesis.IStream `field:"optional"`

	// Optional: Event source configuration
	EventSourceProps *awslambdaeventsources.KinesisEventSourceProps `field:"optional"`

	// Optional: Enable dead letter queue for failed records
	EnableDLQ *bool `field:"optional"`

	// Optional: DLQ configuration
	DLQProps *awssqs.QueueProps `field:"optional"`

	// Optional: Stream mode (provisioned or on-demand)
	StreamMode *awskinesis.StreamMode `field:"optional"`

	// Optional: Number of shards (for provisioned mode)
	ShardCount *float64 `field:"optional"`

	// Optional: Data retention period in hours (24-8760 hours)
	RetentionPeriodHours *float64 `field:"optional"`

	// Optional: Enable encryption
	Encryption *awskinesis.StreamEncryption `field:"optional"`

	// Optional: Enable enhanced fan-out
	EnableEnhancedFanOut *bool `field:"optional"`

	// Optional: Consumer name for enhanced fan-out
	ConsumerName *string `field:"optional"`

	// Optional: Batch size for processing (1-10000)
	BatchSize *float64 `field:"optional"`

	// Optional: Maximum batching window in seconds
	MaxBatchingWindowSeconds *float64 `field:"optional"`

	// Optional: Parallelization factor (1-10)
	ParallelizationFactor *float64 `field:"optional"`

	// Optional: Starting position
	StartingPosition *awslambda.StartingPosition `field:"optional"`

	// Optional: Maximum record age in seconds
	MaxRecordAgeSeconds *float64 `field:"optional"`

	// Optional: Bisect batch on function error
	BisectBatchOnError *bool `field:"optional"`

	// Optional: Maximum retry attempts
	RetryAttempts *float64 `field:"optional"`

	// Optional: Tumbling window in seconds
	TumblingWindowSeconds *float64 `field:"optional"`

	// Optional: Report batch item failures
	ReportBatchItemFailures *bool `field:"optional"`
}

type LambdaAlarmsConfig struct {
	BaseAlarmsConfig

	// ErrorThreshold is the threshold for Lambda errors
	// Default: 1
	ErrorThreshold *float64

	// ThrottleThreshold is the threshold for Lambda throttles
	// Default: 1
	ThrottleThreshold *float64

	// DurationThreshold is the threshold in milliseconds for duration alarm
	// Default: 30000 (30 seconds)
	DurationThreshold *float64
}

type LambdaAlarmsProps struct {
	// FunctionName is the Lambda function name (required)
	FunctionName *string

	// AlarmTopic is the SNS topic for alarm notifications (required)
	AlarmTopic awssns.ITopic

	// AlarmNamePrefix is the prefix for alarm names (required)
	// Example: "merchant-application-partner-stage-my-function"
	AlarmNamePrefix *string

	// Config contains threshold configuration (optional - uses defaults if nil)
	Config *LambdaAlarmsConfig
}

type LambdaFunctionConfig struct {
	Environment  map[string]*string // 8 bytes (map)
	Timeout      awscdk.Duration    // 8 bytes (int64)
	FunctionName string             // 16 bytes
	Description  string             // 16 bytes
	Permissions  string             // PermissionRead or PermissionReadWrite - 16 bytes
}

type LiftAPI struct {
	constructs.Construct
	HttpAPI       awsapigatewayv2.HttpApi
	Stage         awsapigatewayv2.IHttpStage
	LogGroup      awslogs.ILogGroup
	VPCAuthorizer *VPCAuthorizer // Optional VPC authorizer for Cfn routes
	// contains filtered or unexported fields
}

type LiftAPIGatewayAlarms struct {
	Construct constructs.Construct

	ClientErrorsAlarm awscloudwatch.Alarm
	ServerErrorsAlarm awscloudwatch.Alarm
}

type LiftAPIProps struct {
	APICommonProps
	// Enable detailed CloudWatch metrics for the HTTP API stage
	EnableDetailedMetrics *bool
	// API Key configuration
	RequireApiKey *bool
	// Request/Response validation models
	RequestValidators map[string]*RequestValidator
	// Default authorizer for all routes (HTTP API specific)
	DefaultAuthorizer awsapigatewayv2.IHttpRouteAuthorizer
}

type LiftApiDomain struct {
	constructs.Construct
	DomainName   awsapigatewayv2.DomainName
	ApiMapping   awsapigatewayv2.ApiMapping
	CNAMERecord  awsroute53.CnameRecord
	DomainString *string
}

type LiftApiDomainProps struct {
	// Domain name for the API (e.g., "api.example.com")
	DomainName *string

	// Optional: API mapping key (base path)
	ApiMappingKey *string

	// ACM certificate for the domain (required)
	Certificate awscertificatemanager.ICertificate

	// HTTP API to map to the domain (required)
	HttpAPI awsapigatewayv2.IHttpApi

	// Optional: Stage to map (defaults to HttpAPI.DefaultStage() if not provided)
	Stage awsapigatewayv2.IStage

	// Optional: Hosted zone for creating DNS records
	// If provided, a CNAME record will be created pointing to the API Gateway domain
	HostedZone awsroute53.IHostedZone

	// Optional: Enable mutual TLS authentication
	MutualTlsAuthentication *awsapigatewayv2.MTLSConfig

	// Optional: TTL for the CNAME record in seconds (default: 300)
	RecordTTL *float64

	// Optional: Create CNAME record in Route53 (default: true if HostedZone is provided)
	CreateCNAME *bool

	// Optional: Security policy (default: TLS_1_2)
	SecurityPolicy awsapigatewayv2.SecurityPolicy
}

type LiftCertificate struct {
	constructs.Construct
	Certificate awscertificatemanager.Certificate
}

type LiftCertificateProps struct {
	// Domain name for the certificate (e.g., "api.example.com")
	DomainName *string

	// Subject Alternative Names (SANs) for the certificate
	SubjectAlternativeNames *[]*string

	// Hosted zone for DNS validation (required)
	HostedZone awsroute53.IHostedZone

	// Optional: Override the validation zone (if different from hosted zone)
	ValidationZone awsroute53.IHostedZone

	// Optional: Enable/disable certificate transparency logging (default: true)
	TransparencyLoggingEnabled *bool

	// Optional: Certificate name for identification
	CertificateName *string
}

type LiftDynamoDBAlarms struct {
	Construct constructs.Construct

	LatencyAlarm       awscloudwatch.Alarm
	ReadCapacityAlarm  awscloudwatch.Alarm
	WriteCapacityAlarm awscloudwatch.Alarm
}

type LiftEventSourceMapping struct {
	// The underlying construct
	Construct constructs.Construct

	// Event source mapping (if created directly)
	EventSourceMapping awslambda.EventSourceMapping

	// Custom resource (if using dynamic ARN lookup)
	CustomResource awscdk.CustomResource

	// Custom resource handler function (if using dynamic ARN lookup)
	CustomResourceHandler awslambda.Function
}

type LiftEventSourceMappingProps struct {
	// Target Lambda function
	TargetFunction awslambda.IFunction

	// Event source ARN (for primary region with known ARN)
	EventSourceArn *string

	// Table name (for secondary region where ARN is discovered at runtime)
	TableName *string

	// Batch size for processing
	BatchSize *float64

	// Maximum retry attempts
	RetryAttempts *float64

	// Parallelization factor
	ParallelizationFactor *float64

	// Maximum batching window
	MaxBatchingWindow awscdk.Duration

	// Maximum record age
	MaxRecordAge awscdk.Duration

	// Bisect batch on error
	BisectBatchOnError *bool

	// Report batch item failures
	ReportBatchItemFailures *bool

	// Use custom resource for dynamic ARN lookup (for secondary regions)
	UseCustomResource *bool

	// Starting position for stream reading
	StartingPosition awslambda.StartingPosition
}

type LiftFunction struct {
	constructs.Construct
	Function awslambda.Function
}

type LiftFunctionProps struct {
	awslambda.FunctionProps
	// EnableTracing enables X-Ray tracing for the function
	EnableTracing *bool
	// EnableMetrics enables CloudWatch metrics
	EnableMetrics *bool
	// EnableMultiTenant enables multi-tenant support
	EnableMultiTenant *bool
	// ReservedConcurrentExecutions to limit concurrent executions
	ReservedConcurrentExecutions *float64
	// EnableDynamORM configures DynamORM environment variables
	EnableDynamORM *bool
	// DynamORM table name (optional - for when using DynamORM)
	DynamORMTableName *string
	// DynamORM debug mode
	DynamORMDebug *bool
}

type LiftHostedZone struct {
	constructs.Construct
	HostedZone   awsroute53.IHostedZone
	HostedZoneId *string
	ZoneName     *string
	IsImported   bool
}

type LiftHostedZoneProps struct {
	// Zone name (e.g., "example.com")
	ZoneName *string

	// Comment for the hosted zone
	Comment *string

	// If true, attempts to import existing zone instead of creating new one
	// Requires ExistingZoneId to be provided
	ImportIfExists *bool

	// Existing zone ID (for import mode)
	ExistingZoneId *string

	// Enable SSM parameter export for zone ID
	EnableSSMExport *bool

	// SSM parameter path for zone ID (only used if EnableSSMExport is true)
	// Default: /route53/zones/{ZoneName}/id
	SSMParameterPath *string

	// Enable CloudFormation output export
	EnableCfnExport *bool

	// CloudFormation export name
	CfnExportName *string

	// Tags to apply to the hosted zone
	Tags *map[string]*string
}

type LiftKMSKey struct {
	constructs.Construct

	// The KMS key (either direct key or replica)
	Key awskms.IKey

	// Alias for the key
	Alias awskms.Alias

	// SSM Parameter (if enabled)
	SSMParameter awsssm.StringParameter

	// Key ARN
	KeyArn *string

	// Key ID
	KeyId *string
}

type LiftKMSKeyProps struct {
	// Key configuration
	Description *string

	// Alias configuration
	AliasName *string

	// Replica configuration
	PrimaryKeyArn    *string     // ARN of the primary key for replicas
	AdministratorArn *string     // Optional admin principal ARN
	CustomKeyPolicy  interface{} // Optional custom key policy
	SSMParameterPath *string     // Parameter Store path to store key ARN
	Tags             *map[string]*string
	EnabledRegions   *[]*string

	// Boolean flags
	MultiRegion        *bool
	IsReplicaKey       *bool
	EnableKeyRotation  *bool
	EnableSSMParameter *bool

	// Additional permissions
	GrantEncryptDecrypt []awsiam.IGrantable
	GrantGenerateMac    []awsiam.IGrantable

	// Non-pointer configuration
	KeySpec       awskms.KeySpec
	KeyUsage      awskms.KeyUsage
	PendingWindow awscdk.Duration
	RemovalPolicy awscdk.RemovalPolicy
}

type LiftLambdaAlarms struct {
	Construct constructs.Construct

	ErrorsAlarm    awscloudwatch.Alarm
	ThrottlesAlarm awscloudwatch.Alarm
	DurationAlarm  awscloudwatch.Alarm
}

type LiftLambdaRole struct {
	constructs.Construct
	Role awsiam.Role
}

type LiftLambdaRoleProps struct {
	// Basic configuration
	RoleName    *string
	Description *string

	// Service principal (defaults to lambda.amazonaws.com)
	ServicePrincipal *string

	// Managed policies
	ManagedPolicyArns []string

	// Enable common AWS managed policies
	EnableBasicExecution     *bool // AWSLambdaBasicExecutionRole
	EnableVPCExecution       *bool // AWSLambdaVPCAccessExecutionRole
	EnableCloudWatchInsights *bool // CloudWatchLambdaInsightsExecutionRolePolicy
	EnableXRayDaemonWrite    *bool // AWSXRayDaemonWriteAccess

	// DynamoDB access
	DynamoDBTables       []awsdynamodb.ITable
	DynamoDBTableArns    []string
	DynamoDBStreamAccess *bool // Grant stream read access
	DynamoDBFullAccess   *bool // Grant full access vs read/write

	// KMS access
	KMSKeys              []awskms.IKey
	KMSKeyArns           []string
	EnableMultiRegionKMS *bool    // Grant access to multi-region keys (mrk-*)
	KMSActions           []string // Custom KMS actions (defaults to Encrypt, Decrypt, GenerateDataKey)

	// Secrets Manager access
	SecretsManagerArns  []string
	EnableSecretsAccess *bool // Grant access to all secrets (not recommended for production)

	// SSM Parameter Store access
	SSMParameterPaths []string
	EnableSSMAccess   *bool // Grant access to all parameters

	// Payment Cryptography (AWS Payment Cryptography Service)
	EnablePaymentCrypto  *bool
	PaymentCryptoActions []string // Defaults to DecryptData, EncryptData, GetAlias

	// SQS access
	SQSQueueArns           []string
	EnableSQSSendMessage   *bool
	EnableSQSReceiveDelete *bool

	// S3 access
	S3BucketArns  []string
	EnableS3Read  *bool
	EnableS3Write *bool

	// Custom inline policies
	InlinePolicies map[string]awsiam.PolicyDocument

	// Additional policy statements
	AdditionalPolicyStatements []awsiam.PolicyStatement

	// Tags
	Tags map[string]string
}

type LiftRestAPI struct {
	constructs.Construct
	RestAPI  awsapigateway.RestApi
	LogGroup awslogs.ILogGroup
	// contains filtered or unexported fields
}

type LiftRestAPIProps struct {
	APICommonProps
	// AppName is an alias for Name (backwards compatible).
	AppName *string
	// EnableStreaming enables API Gateway REST API response streaming by default
	// for methods added via AddLambdaIntegration*.
	//
	// Methods can override this default via IntegrationOptions.EnableStreaming.
	EnableStreaming *bool
	// StreamingTimeout sets the default integration timeout in seconds for streaming
	// methods (up to 15 minutes).
	//
	// Methods can override this default via IntegrationOptions.StreamingTimeoutSeconds.
	StreamingTimeout *int
	// Certificate configures a custom domain when DomainName is set.
	Certificate awscertificatemanager.ICertificate
	// Enable detailed CloudWatch metrics (REST API only)
	EnableDetailedMetrics *bool
	// API Key configuration
	RequireApiKey *bool
	// Endpoint configuration (REGIONAL, EDGE, PRIVATE)
	EndpointType awsapigateway.EndpointType
	// Default authorizer for all routes
	DefaultAuthorizer awsapigateway.IAuthorizer
}

type LiftSQSAlarms struct {
	Construct constructs.Construct

	// Main queue alarms
	VisibleMessagesAlarm    awscloudwatch.Alarm
	NotVisibleMessagesAlarm awscloudwatch.Alarm
	OldestMessageAlarm      awscloudwatch.Alarm

	// DLQ alarms
	DLQVisibleMessagesAlarm    awscloudwatch.Alarm
	DLQNotVisibleMessagesAlarm awscloudwatch.Alarm
	DLQOldestMessageAlarm      awscloudwatch.Alarm
}

type LiftSQSQueue struct {
	constructs.Construct

	// The SQS queue
	Queue awssqs.Queue

	// Dead letter queue (if enabled)
	DeadLetterQueue awssqs.Queue

	// Event source mapping (if enabled)
	EventSource awslambdaeventsources.SqsEventSource

	// SSM Parameter (if enabled)
	SSMParameter awsssm.StringParameter
}

type LiftSQSQueueProps struct {
	// Required: Existing Lambda function to attach this queue to
	Function awslambda.Function

	// Queue configuration
	QueueName              *string
	VisibilityTimeout      awscdk.Duration // Default: 5 minutes
	MessageRetentionPeriod awscdk.Duration // Default: 14 days
	ReceiveMessageWaitTime awscdk.Duration // For long polling, default: 20 seconds

	// Dead letter queue configuration
	EnableDeadLetterQueue *bool           // Default: true
	DeadLetterQueueName   *string         // Default: {QueueName}-dlq
	MaxReceiveCount       *float64        // Default: 3
	DLQRetentionPeriod    awscdk.Duration // Default: 14 days

	// Encryption configuration
	EncryptionMasterKey awskms.IKey     // Required for K3 - partner-specific KMS key
	DataKeyReuse        awscdk.Duration // Default: 300 seconds

	// Event source configuration
	EnableEventSource       *bool           // Default: true
	BatchSize               *float64        // Default: 10
	MaxBatchingWindow       awscdk.Duration // Default: 5 seconds
	ReportBatchItemFailures *bool           // Default: true
	MaxConcurrency          *float64        // Default: 5

	// Environment variable configuration
	QueueUrlEnvVar *string // Custom env var name for queue URL (e.g., "K3_PROCESSOR_INSTRUMENT_QUEUE_URL")
	DLQUrlEnvVar   *string // Custom env var name for DLQ URL (optional)

	// SSM Parameter Store configuration
	EnableSSMParameter *bool   // Default: false
	SSMParameterName   *string // SSM parameter name to store queue URL
	SSMDescription     *string // SSM parameter description

	// FIFO queue configuration
	FifoQueue                       *bool
	EnableContentBasedDeduplication *bool

	// Additional permissions
	GrantSendMessages    *bool // Default: true - grant Lambda permission to send messages
	GrantConsumeMessages *bool // Default: true - grant Lambda permission to consume messages
}

type LiftTable struct {
	constructs.Construct
	Table awsdynamodb.Table
	GSIs  map[string]*awsdynamodb.GlobalSecondaryIndexProps
}

type LiftTableProps struct {
	TableName           *string
	PartitionKeyName    *string
	SortKeyName         *string
	TimeToLiveAttribute *string

	// Billing configuration
	ReadCapacity  *float64
	WriteCapacity *float64

	// Feature flags
	EnablePointInTimeRecovery *bool
	EnableStreams             *bool
	EnableAutoScaling         *bool
	DeletionProtection        *bool

	// Auto-scaling configuration
	MinReadCapacity   *float64
	MaxReadCapacity   *float64
	MinWriteCapacity  *float64
	MaxWriteCapacity  *float64
	TargetUtilization *float64

	// Global Secondary Indexes
	GlobalSecondaryIndexes *[]*awsdynamodb.GlobalSecondaryIndexProps

	// GSI Auto-scaling configuration
	GSIMinReadCapacity  *float64
	GSIMaxReadCapacity  *float64
	GSIMinWriteCapacity *float64
	GSIMaxWriteCapacity *float64

	// Replication and tagging
	ReplicationRegions *[]*string
	Tags               *map[string]*string

	// Non-pointer configuration values
	StreamViewType awsdynamodb.StreamViewType
	RemovalPolicy  awscdk.RemovalPolicy
	Encryption     awsdynamodb.TableEncryption
}

type ManagementTableConfig struct {
	DefaultTableName string
	PermissionMethod string // e.g., "GrantConnectionManagement", "GrantEventManagement"
}

type MediaCDN struct {
	constructs.Construct

	Bucket       awss3.Bucket
	Distribution awscloudfront.Distribution
	Certificate  awscertificatemanager.ICertificate

	// Only set when EnablePrivateMedia is true.
	PublicKey awscloudfront.PublicKey
	KeyGroup  awscloudfront.KeyGroup
}

type MediaCDNProps struct {
	// Required: hosted zone authoritative for DomainName.
	HostedZone awsroute53.IHostedZone
	// Optional: custom domain certificate. If omitted, Lift creates a DNS-validated certificate in us-east-1.
	Certificate awscertificatemanager.ICertificate
	// Optional: override response headers policy.
	ResponseHeadersPolicy awscloudfront.IResponseHeadersPolicy

	// Required: domain name (e.g., "media.example.com").
	DomainName *string

	// Optional: stable naming inputs for deterministic bucket names.
	AppName    *string
	Stage      *string
	Partner    *string
	BucketName *string

	// Optional: bucket configuration.
	AutoDeleteObjects *bool
	Versioned         *bool

	// Optional: additional SANs to include when Lift creates a certificate.
	SubjectAlternativeNames *[]*string

	// Optional: enable private media via CloudFront Key Groups (signed URLs/cookies).
	EnablePrivateMedia *bool

	// Required when EnablePrivateMedia is true: PEM-encoded public key used by CloudFront for validation.
	PublicKeyEncoded *string

	// Optional: path patterns that require signed URLs/cookies (default: ["private/*"]).
	PrivatePathPatterns *[]*string

	// Optional: WAFv2 Web ACL ARN (global scope) to attach to the distribution.
	WebAclId *string

	// Optional: distribution tuning.
	EnableIpv6 *bool

	// Optional: tags applied to created resources.
	Tags *map[string]*string

	// Optional: bucket configuration.
	RemovalPolicy awscdk.RemovalPolicy

	// Optional: distribution tuning.
	PriceClass  awscloudfront.PriceClass
	HttpVersion awscloudfront.HttpVersion
}

type MetricConfiguration struct {
	// Enable detailed metrics
	DetailedMetrics *bool
	// Custom dimensions
	Dimensions *map[string]*string
	// Metric resolution (1 or 60 seconds)
	Resolution *float64
	// Percentiles to track
	Percentiles *[]*float64
	// Enable custom business metrics
	EnableBusinessMetrics *bool
}

type MonitorableResource interface {
	// GetResourceName returns the name of the resource.
	// Returns:
	//   - A pointer to the name of the resource
	GetResourceName() *string
}

type MonitoredFunction struct {
	constructs.Construct
	Function  *LiftFunction
	Dashboard awscloudwatch.Dashboard
	Alarms    map[string]awscloudwatch.Alarm
}

type MonitoredFunctionProps struct {
	LiftFunctionProps
	// Enable CloudWatch dashboard
	EnableDashboard *bool
	// Dashboard name (optional - will generate if not provided)
	DashboardName *string
	// Alarm configuration
	AlarmConfig *AlarmConfig
	// Custom metrics namespace
	MetricsNamespace *string
	// Enable enhanced monitoring (Lambda Insights)
	EnableLambdaInsights *bool
	// Log level (ERROR, WARN, INFO, DEBUG)
	LogLevel *string
	// Enable CloudWatch Logs Insights queries
	EnableLogInsightsQueries *bool
}

type PathRoutedFrontendDistribution struct {
	constructs.Construct

	ClientBucket awss3.Bucket
	AuthBucket   awss3.Bucket

	Distribution awscloudfront.Distribution
	Certificate  awscertificatemanager.ICertificate

	RewriteFunction awscloudfront.Function
}

type PathRoutedFrontendDistributionProps struct {
	// Required: hosted zone authoritative for DomainName.
	HostedZone awsroute53.IHostedZone
	// Optional: custom domain certificate. If omitted, Lift creates a DNS-validated certificate in us-east-1.
	Certificate awscertificatemanager.ICertificate

	// Optional: cache policy for API behavior (default: Lift API cache policy with TTL 0).
	ApiCachePolicy awscloudfront.ICachePolicy
	// Optional: origin request policy for API behavior (default: none).
	ApiOriginRequestPolicy awscloudfront.IOriginRequestPolicy

	// Optional: override response headers policy for static content.
	StaticResponseHeadersPolicy awscloudfront.IResponseHeadersPolicy

	// Required: apex/canonical domain (e.g., "dev.example.com").
	DomainName *string
	// Required: API origin host (e.g., "api.dev.example.com" or "*.execute-api.*.amazonaws.com").
	ApiOriginDomainName *string

	// Required: S3 bucket name for the client SPA served under ClientPathPrefix.
	ClientBucketName *string
	// Required: S3 bucket name for the auth SPA served under AuthPathPrefix.
	AuthBucketName *string

	// Optional: path prefix for client SPA (default: "l").
	ClientPathPrefix *string
	// Optional: path prefix for auth SPA (default: "auth").
	AuthPathPrefix *string
	// Optional: API path pattern that must bypass the auth SPA (default: "<authPrefix>/wallet/*").
	AuthWalletApiPathPattern *string
	// Optional: treat client UI as an SPA by rewriting extensionless routes to /index.html (default true).
	ClientSinglePageApp *bool
	// Optional: treat auth UI as an SPA by rewriting extensionless routes to /index.html (default true).
	// If false, extensionless routes rewrite to "<path>/index.html" to support multi-page static outputs.
	AuthSinglePageApp *bool

	// Optional: stable naming inputs for deterministic resource naming.
	AppName *string
	Stage   *string
	Partner *string

	// Optional: tags applied to created resources.
	Tags *map[string]*string

	// Optional: bucket configuration.
	AutoDeleteObjects *bool
	Versioned         *bool
	RemovalPolicy     awscdk.RemovalPolicy

	// Optional: WAFv2 Web ACL ARN (global scope) to attach to the distribution.
	WebAclId *string

	// Optional: distribution tuning.
	EnableIpv6  *bool
	PriceClass  awscloudfront.PriceClass
	HttpVersion awscloudfront.HttpVersion
}

type RateLimitTableProps struct {
	// Table name
	TableName *string
	// TTL attribute name for automatic cleanup
	TimeToLiveAttribute *string
}

type RateLimitType string

type RateLimitedFunction struct {
	constructs.Construct
	Function  *LiftFunction
	RateTable *LiftTable
	// contains filtered or unexported fields
}

type RateLimitedFunctionProps struct {
	// Embedded struct first (largest)
	LiftFunctionProps
	// Pointers (8 bytes each)
	WindowSeconds *float64
	Limit         *float64
	TableName     *string
	EnableMetrics *bool
	// Smaller types last
	RateLimitType RateLimitType
}

type RequestTrackingTable struct {
	*LiftTable
	// contains filtered or unexported fields
}

type RequestTrackingTableProps struct {
	// Table name
	TableName *string
	// TTL attribute name for automatic cleanup
	TimeToLiveAttribute *string
}

type RequestValidator struct {
	// Validate request body
	ValidateBody *bool
	// Validate request parameters
	ValidateParameters *bool
	// JSON schema for body validation
	BodySchema interface{}
}

type RouteOptions struct {
	// Authorizer for this route
	Authorizer awsapigatewayv2.IHttpRouteAuthorizer
	// Request validation
	RequestValidator *RequestValidator
	// Route-specific throttling
	ThrottleRateLimit  *float64
	ThrottleBurstLimit *float64
}

type S3EventFilter struct {
	Prefix *string
	Suffix *string
}

type S3Processor struct {
	constructs.Construct

	// The Lambda function processing S3 events
	Function *LiftFunction

	// The S3 bucket
	Bucket awss3.IBucket

	// Dead letter queue (if enabled)
	DeadLetterQueue awssqs.IQueue

	// Event source mapping
	EventSource awslambdaeventsources.S3EventSource

	// Replication bucket (if cross-region replication is enabled)
	ReplicationBucket awss3.IBucket
}

type S3ProcessorProps struct {
	// Lambda function properties
	FunctionProps awslambda.FunctionProps

	// S3 bucket properties (optional - creates new bucket if not provided)
	BucketProps *awss3.BucketProps

	// Existing bucket to use (optional - creates new if not provided)
	ExistingBucket awss3.IBucket

	// S3 event types to process (default: ObjectCreated)
	EventTypes *[]awss3.EventType

	// Key prefix filter for S3 events (optional)
	KeyPrefix *string

	// Key suffix filter for S3 events (optional)
	KeySuffix *string

	// Dead letter queue properties (optional)
	DeadLetterQueueProps *awssqs.QueueProps

	// Enable dead letter queue (default: true)
	EnableDeadLetterQueue *bool

	// S3 event source configuration
	EventSourceProps *awslambdaeventsources.S3EventSourceProps

	// Additional S3 processor settings
	BatchSize         *float64        // Default: 10
	MaxBatchingWindow awscdk.Duration // Default: 5 seconds

	// Multi-region support
	CrossRegionReplication *bool
	ReplicationBucket      awss3.IBucket

	// Lifecycle rules
	EnableLifecycleRules *bool
	LifecycleRules       *[]*awss3.LifecycleRule

	// External bucket support
	ExternalBucket awss3.IBucket

	// Event filtering
	EventFilter *S3EventFilter

	// Access logging
	EnableAccessLogging *bool
	AccessLogsBucket    awss3.IBucket
	AccessLogsPrefix    *string

	// Versioning and backup
	EnableVersioning *bool
	EnableBackup     *bool

	// Lift-specific settings
	EnableTracing     *bool
	EnableMultiTenant *bool
	EnableMonitoring  *bool
}

type SNSProcessor struct {
	constructs.Construct
	Topic    awssns.ITopic
	Function LiftFunction
	DLQ      awssqs.IQueue
}

type SNSProcessorProps struct {
	// The Lambda function configuration
	FunctionProps *LiftFunctionProps `field:"required"`

	// Optional: Topic configuration
	TopicProps *awssns.TopicProps `field:"optional"`

	// Optional: Use an existing topic instead of creating a new one
	ExistingTopic awssns.ITopic `field:"optional"`

	// Optional: SNS subscription configuration
	SubscriptionProps *awslambdaeventsources.SnsEventSourceProps `field:"optional"`

	// Optional: Enable dead letter queue for failed messages
	EnableDLQ *bool `field:"optional"`

	// Optional: DLQ configuration
	DLQProps *awssqs.QueueProps `field:"optional"`

	// Optional: Message filtering policy
	FilterPolicy *map[string]awssns.SubscriptionFilter `field:"optional"`

	// Optional: Enable FIFO topic
	EnableFifo *bool `field:"optional"`

	// Optional: Enable content-based deduplication
	ContentBasedDeduplication *bool `field:"optional"`

	// Optional: Message retention period in seconds (1 hour to 14 days)
	MessageRetentionSeconds *float64 `field:"optional"`

	// Optional: Display name for the topic
	DisplayName *string `field:"optional"`

	// Optional: Subscription protocol (defaults to lambda)
	Protocol *string `field:"optional"`

	// Optional: Raw message delivery
	RawMessageDelivery *bool `field:"optional"`
}

type SQSAlarmsConfig struct {
	BaseAlarmsConfig

	// VisibleMessagesThreshold is the threshold for visible messages alarm
	// Default: 2
	VisibleMessagesThreshold *float64

	// NotVisibleMessagesThreshold is the threshold for not visible messages alarm
	// Default: 2
	NotVisibleMessagesThreshold *float64

	// OldestMessageAgeThreshold is the threshold in seconds for oldest message alarm
	// Default: 900 (15 minutes)
	OldestMessageAgeThreshold *float64

	// DLQOldestMessageAgeThreshold is the threshold in seconds for DLQ oldest message alarm
	// Default: 1 (alert immediately when any message hits DLQ)
	DLQOldestMessageAgeThreshold *float64
}

type SQSAlarmsProps struct {
	// Queue is the main SQS queue to monitor (required)
	Queue awssqs.IQueue

	// DeadLetterQueue is the DLQ to monitor (optional)
	DeadLetterQueue awssqs.IQueue

	// AlarmTopic is the SNS topic for alarm notifications (required)
	AlarmTopic awssns.ITopic

	// AlarmNamePrefix is the prefix for alarm names (required)
	// Example: "merchant-application-partner-stage"
	AlarmNamePrefix *string

	// Config contains threshold configuration (optional - uses defaults if nil)
	Config *SQSAlarmsConfig
}

type SQSLargePayloadProps struct {
	// Enabled toggles large payload support. When nil, defaults to true when
	// LargePayload is provided.
	Enabled *bool

	// ExistingBucket uses an existing bucket for payload storage (optional).
	// When provided, BucketProps is ignored.
	ExistingBucket awss3.IBucket

	// BucketProps creates a new bucket for payload storage when ExistingBucket is nil.
	// If BucketProps.BucketName is omitted, Lift will derive a deterministic name
	// when stable naming context is available (see milestone 2).
	BucketProps *awss3.BucketProps

	// Prefix scopes object storage to a per-queue prefix within the bucket.
	// If omitted, Lift derives a prefix from the queue name (see milestone 2).
	Prefix *string

	// Expiration is the S3 lifecycle expiration for payload objects (TTL fallback).
	// When nil, defaults to 7 days.
	Expiration awscdk.Duration
}

type SQSProcessor struct {
	constructs.Construct

	// The Lambda function processing SQS messages
	Function *LiftFunction

	// The SQS queue
	Queue awssqs.IQueue

	// Dead letter queue (if enabled)
	DeadLetterQueue awssqs.IQueue

	// Event source mapping
	EventSource awslambdaeventsources.SqsEventSource

	// LargePayloadBucket stores oversized SQS message bodies (optional).
	LargePayloadBucket awss3.IBucket

	// LargePayloadPrefix scopes object keys + IAM permissions (optional).
	LargePayloadPrefix *string
}

type SQSProcessorProps struct {
	// Lambda function properties
	FunctionProps awslambda.FunctionProps

	// SQS queue properties (optional - creates new queue if not provided)
	QueueProps *awssqs.QueueProps

	// Existing queue to use (optional - creates new if not provided)
	ExistingQueue awssqs.IQueue

	// Dead letter queue properties (optional)
	DeadLetterQueueProps *awssqs.QueueProps

	// Enable dead letter queue (default: true)
	EnableDeadLetterQueue *bool

	// SQS event source configuration
	EventSourceProps *awslambdaeventsources.SqsEventSourceProps

	// Additional SQS processor settings
	BatchSize                       *float64        // Default: 10
	MaxBatchingWindow               awscdk.Duration // Default: 5 seconds
	VisibilityTimeout               awscdk.Duration // Default: 6 times function timeout
	MessageRetentionPeriod          awscdk.Duration // Default: 14 days
	MaxReceiveCount                 *float64        // Default: 3
	EnableContentBasedDeduplication *bool           // For FIFO queues
	FifoQueue                       *bool           // Default: false
	ReceiveMessageWaitTimeSeconds   *float64        // For long polling (0-20)

	// Lift-specific settings
	EnableTracing     *bool
	EnableMultiTenant *bool
	EnableMonitoring  *bool

	// Large payload support (optional).
	//
	// When enabled, Lift provisions (or attaches) an S3 bucket that can store
	// payloads larger than SQS's 256KB limit. Producers publish a small pointer
	// envelope to SQS containing the S3 bucket + key. Consumers hydrate the full
	// payload from S3 and delete it on success (with lifecycle TTL as a fallback).
	LargePayload *SQSLargePayloadProps
}

type SecretConfig struct {
	RotationLambda   awslambda.IFunction
	RotationSchedule *awssecretsmanager.RotationScheduleOptions
	Name             string
	Description      string
	Template         string
	GenerateKey      string
	ExcludeChars     string
	Length           float64
	EnableRotation   bool
}

type SecureFunction struct {
	constructs.Construct
	Function      *LiftFunction
	SecurityGroup awsec2.ISecurityGroup
	KmsKey        awskms.IKey
	Vpc           awsec2.IVpc
	VpcEndpoints  map[string]awsec2.InterfaceVpcEndpoint
}

type SecureFunctionProps struct {
	LiftFunctionProps
	// VPC to deploy the function in (optional - will create if not provided)
	Vpc awsec2.IVpc
	// VPC subnets to use (defaults to private subnets)
	VpcSubnets *awsec2.SubnetSelection
	// Security group IDs to attach
	SecurityGroupIds *[]*string
	// Enable KMS encryption for environment variables
	EnableKMSEncryption *bool
	// KMS key for encryption (optional - will create if not provided)
	KmsKey awskms.IKey
	// Secrets to inject from Secrets Manager
	Secrets *map[string]awssecretsmanager.ISecret
	// Enable private endpoints only (no internet access)
	PrivateOnly *bool
	// Additional security policies to attach
	AdditionalPolicies *[]awsiam.PolicyStatement
}