@aws-amplify/backend-notifications 0.0.0-test-20260708085627

package/lib/constants.d.ts

@@ -0,0 +1,122 @@
+/**
+ * Shared constants describing the Customer Profiles object model.
+ *
+ * Referenced by BOTH the CDK object-type definitions and the Lambda handler,
+ * so they must stay in lockstep.
+ */
+/** Profile object type. Declares the searchable identity key + attr schema. */
+export declare const OBJECT_TYPE_PROFILE = "AmplifyProfile";
+/**
+ * Guest profile object type. A distinct object type is
+ * required because Customer Profiles permits EXACTLY ONE `UNIQUE` key per object
+ * type AND `PutProfileObject` requires the ingested object to carry that UNIQUE
+ * key. The authed `AmplifyProfile` reserves its single UNIQUE key for
+ * `cognitoSub`, so guest profiles — keyed on the Identity Pool `identityId` —
+ * get their own object type whose UNIQUE key is `cognitoIdentityKey`. Both
+ * object types create ordinary profiles in the SAME domain; the device object
+ * type carries both identity keys as PROFILE keys so a device resolves to
+ * whichever profile it belongs to.
+ */
+export declare const OBJECT_TYPE_GUEST_PROFILE = "AmplifyGuestProfile";
+/** Device object type. One object per stable deviceId; token is a field. */
+export declare const OBJECT_TYPE_DEVICE = "AmplifyDevice";
+/**
+ * Searchable profile key that binds a profile to a verified Cognito subject.
+ * Profiles are looked up by THIS key (SearchProfiles), never by the Attributes
+ * map. The same key name is used as the PROFILE-resolution key on the device
+ * object type so device objects merge into the correct profile.
+ */
+export declare const COGNITO_USER_KEY = "cognitoUserKey";
+/**
+ * Searchable profile key that binds a profile to an
+ * UNAUTHENTICATED Cognito Identity Pool identity (the `cognitoIdentityId`, e.g.
+ * `us-east-1:<uuid>`). A guest has no JWT `sub`, so its profile is keyed by this
+ * key instead of {@link COGNITO_USER_KEY}. Also the PROFILE-resolution key on the
+ * device object type so a guest's device objects merge into the guest profile.
+ * On sign-in the guest profile is folded into the authed (sub-keyed) profile via
+ * MergeProfiles (see merge_resolver).
+ */
+export declare const COGNITO_IDENTITY_KEY = "cognitoIdentityKey";
+/** Object field carrying the guest identity value (sourced into the key). */
+export declare const COGNITO_IDENTITY_FIELD = "cognitoIdentityId";
+/** Object field carrying the authed identity value (sourced into the key). */
+export declare const COGNITO_SUB_FIELD = "cognitoSub";
+/** Max length of a Customer Profiles attribute value (single string). */
+export declare const MAX_ATTRIBUTE_LENGTH = 255;
+/** Environment variable carrying the Customer Profiles domain name. */
+export declare const ENV_DOMAIN_NAME = "PROFILES_DOMAIN_NAME";
+/**
+ * Environment variable carrying the AWS End User Messaging / Pinpoint
+ * application (project) id the push-delivery Lambda calls `SendMessages`
+ * against.
+ */
+export declare const ENV_EUM_APPLICATION_ID = "EUM_APPLICATION_ID";
+/**
+ * Amazon Connect integration type that binds a Q in Connect (Wisdom) knowledge
+ * base — the store for message templates — to a Connect instance. Used by the
+ * push Lambda's runtime knowledge-base discovery
+ * (ListIntegrationAssociations filtered to this type).
+ */
+export declare const Q_MESSAGE_TEMPLATES_INTEGRATION_TYPE = "Q_MESSAGE_TEMPLATES";
+/**
+ * Channel subtype of the Q in Connect message templates this backend renders.
+ * Only PUSH templates are eligible for push-notification copy resolution.
+ */
+export declare const PUSH_CHANNEL_SUBTYPE = "PUSH";
+/**
+ * Version qualifier appended to a message-template id to reference its ACTIVE
+ * (published) version — e.g. `GetMessageTemplate(<id>:$ACTIVE_VERSION)`.
+ */
+export declare const ACTIVE_VERSION_QUALIFIER = "$ACTIVE_VERSION";
+/** Default push-notification title when the event carries none. */
+export declare const DEFAULT_PUSH_TITLE = "Notification";
+/** Default push-notification body when the event carries none. */
+export declare const DEFAULT_PUSH_BODY = "You have a new notification.";
+/**
+ * Service principals allowed to invoke the push-delivery Lambda via a
+ * resource-based policy. Amazon Connect Journey Custom-actions invoke Lambda
+ * under `connect.amazonaws.com`; Outbound Campaigns v2 uses
+ * `connect-campaigns.amazonaws.com`. Granting both lets the customer's Journey
+ * / campaign call the push Lambda without a broad wildcard principal.
+ */
+export declare const CONNECT_INVOKE_SERVICE_PRINCIPALS: string[];
+/** Default profile / object-type expiration in days. */
+export declare const DEFAULT_EXPIRATION_DAYS = 366;
+/**
+ * Outbound Campaigns v2 <-> Customer Profiles object-type routing map. This
+ * label map binds a campaign channel to the BUILT-IN Customer Profiles object
+ * template of the same name; it is a routing/label map, NOT a set of object
+ * types that must be pre-created via PutProfileObjectType. The same map is
+ * supplied to BOTH `connectcampaignsv2:PutConnectInstanceIntegration` (as
+ * `integrationConfig.customerProfiles.objectTypeNames`) and
+ * `customer-profiles:PutIntegration` (as `ObjectTypeNames`) so Connect Journeys
+ * can target the domain's profiles.
+ */
+export declare const CAMPAIGN_OBJECT_TYPE_NAMES: {
+    readonly 'Campaign-Email': "Campaign-Email";
+    readonly 'Campaign-SMS': "Campaign-SMS";
+    readonly 'Campaign-Telephony': "Campaign-Telephony";
+    readonly 'Campaign-Orchestration': "Campaign-Orchestration";
+};
+/**
+ * Environment variable carrying the Amazon Connect instance id the campaign
+ * -association custom resource onboards to Outbound Campaigns v2 and associates
+ * the created Customer Profiles domain with.
+ */
+export declare const ENV_CONNECT_INSTANCE_ID = "CONNECT_INSTANCE_ID";
+/** AWS service principal that owns the Outbound Campaigns service-linked role. */
+export declare const CONNECT_CAMPAIGNS_SERVICE_NAME = "connect-campaigns.amazonaws.com";
+/** IAM path prefix under which the Outbound Campaigns service-linked role lives. */
+export declare const CONNECT_CAMPAIGNS_SLR_PATH_PREFIX = "/aws-service-role/connect-campaigns.amazonaws.com/";
+/**
+ * Fixed key under `custom` in `amplify_outputs.json` where the notifications
+ * endpoint / region are surfaced to the client (`custom.CustomerProfiles`).
+ *
+ * This is intentionally NOT configurable: every first-party Amplify Gen2
+ * resource (`defineAuth` / `defineData` / `defineStorage` / `defineFunction`)
+ * writes its backend output to a fixed, well-known key rather than a
+ * caller-chosen one, so the client config contributors know where to read it.
+ * This resource follows the same convention with a single stable key.
+ */
+export declare const OUTPUT_KEY = "CustomerProfiles";
+//# sourceMappingURL=constants.d.ts.map

package/lib/constants.js

@@ -0,0 +1,125 @@
+/**
+ * Shared constants describing the Customer Profiles object model.
+ *
+ * Referenced by BOTH the CDK object-type definitions and the Lambda handler,
+ * so they must stay in lockstep.
+ */
+/** Profile object type. Declares the searchable identity key + attr schema. */
+export const OBJECT_TYPE_PROFILE = 'AmplifyProfile';
+/**
+ * Guest profile object type. A distinct object type is
+ * required because Customer Profiles permits EXACTLY ONE `UNIQUE` key per object
+ * type AND `PutProfileObject` requires the ingested object to carry that UNIQUE
+ * key. The authed `AmplifyProfile` reserves its single UNIQUE key for
+ * `cognitoSub`, so guest profiles — keyed on the Identity Pool `identityId` —
+ * get their own object type whose UNIQUE key is `cognitoIdentityKey`. Both
+ * object types create ordinary profiles in the SAME domain; the device object
+ * type carries both identity keys as PROFILE keys so a device resolves to
+ * whichever profile it belongs to.
+ */
+export const OBJECT_TYPE_GUEST_PROFILE = 'AmplifyGuestProfile';
+/** Device object type. One object per stable deviceId; token is a field. */
+export const OBJECT_TYPE_DEVICE = 'AmplifyDevice';
+/**
+ * Searchable profile key that binds a profile to a verified Cognito subject.
+ * Profiles are looked up by THIS key (SearchProfiles), never by the Attributes
+ * map. The same key name is used as the PROFILE-resolution key on the device
+ * object type so device objects merge into the correct profile.
+ */
+export const COGNITO_USER_KEY = 'cognitoUserKey';
+/**
+ * Searchable profile key that binds a profile to an
+ * UNAUTHENTICATED Cognito Identity Pool identity (the `cognitoIdentityId`, e.g.
+ * `us-east-1:<uuid>`). A guest has no JWT `sub`, so its profile is keyed by this
+ * key instead of {@link COGNITO_USER_KEY}. Also the PROFILE-resolution key on the
+ * device object type so a guest's device objects merge into the guest profile.
+ * On sign-in the guest profile is folded into the authed (sub-keyed) profile via
+ * MergeProfiles (see merge_resolver).
+ */
+export const COGNITO_IDENTITY_KEY = 'cognitoIdentityKey';
+/** Object field carrying the guest identity value (sourced into the key). */
+export const COGNITO_IDENTITY_FIELD = 'cognitoIdentityId';
+/** Object field carrying the authed identity value (sourced into the key). */
+export const COGNITO_SUB_FIELD = 'cognitoSub';
+/** Max length of a Customer Profiles attribute value (single string). */
+export const MAX_ATTRIBUTE_LENGTH = 255;
+/** Environment variable carrying the Customer Profiles domain name. */
+export const ENV_DOMAIN_NAME = 'PROFILES_DOMAIN_NAME';
+/**
+ * Environment variable carrying the AWS End User Messaging / Pinpoint
+ * application (project) id the push-delivery Lambda calls `SendMessages`
+ * against.
+ */
+export const ENV_EUM_APPLICATION_ID = 'EUM_APPLICATION_ID';
+/**
+ * Amazon Connect integration type that binds a Q in Connect (Wisdom) knowledge
+ * base — the store for message templates — to a Connect instance. Used by the
+ * push Lambda's runtime knowledge-base discovery
+ * (ListIntegrationAssociations filtered to this type).
+ */
+export const Q_MESSAGE_TEMPLATES_INTEGRATION_TYPE = 'Q_MESSAGE_TEMPLATES';
+/**
+ * Channel subtype of the Q in Connect message templates this backend renders.
+ * Only PUSH templates are eligible for push-notification copy resolution.
+ */
+export const PUSH_CHANNEL_SUBTYPE = 'PUSH';
+/**
+ * Version qualifier appended to a message-template id to reference its ACTIVE
+ * (published) version — e.g. `GetMessageTemplate(<id>:$ACTIVE_VERSION)`.
+ */
+export const ACTIVE_VERSION_QUALIFIER = '$ACTIVE_VERSION';
+/** Default push-notification title when the event carries none. */
+export const DEFAULT_PUSH_TITLE = 'Notification';
+/** Default push-notification body when the event carries none. */
+export const DEFAULT_PUSH_BODY = 'You have a new notification.';
+/**
+ * Service principals allowed to invoke the push-delivery Lambda via a
+ * resource-based policy. Amazon Connect Journey Custom-actions invoke Lambda
+ * under `connect.amazonaws.com`; Outbound Campaigns v2 uses
+ * `connect-campaigns.amazonaws.com`. Granting both lets the customer's Journey
+ * / campaign call the push Lambda without a broad wildcard principal.
+ */
+export const CONNECT_INVOKE_SERVICE_PRINCIPALS = [
+    'connect.amazonaws.com',
+    'connect-campaigns.amazonaws.com',
+];
+/** Default profile / object-type expiration in days. */
+export const DEFAULT_EXPIRATION_DAYS = 366;
+/**
+ * Outbound Campaigns v2 <-> Customer Profiles object-type routing map. This
+ * label map binds a campaign channel to the BUILT-IN Customer Profiles object
+ * template of the same name; it is a routing/label map, NOT a set of object
+ * types that must be pre-created via PutProfileObjectType. The same map is
+ * supplied to BOTH `connectcampaignsv2:PutConnectInstanceIntegration` (as
+ * `integrationConfig.customerProfiles.objectTypeNames`) and
+ * `customer-profiles:PutIntegration` (as `ObjectTypeNames`) so Connect Journeys
+ * can target the domain's profiles.
+ */
+export const CAMPAIGN_OBJECT_TYPE_NAMES = {
+    'Campaign-Email': 'Campaign-Email',
+    'Campaign-SMS': 'Campaign-SMS',
+    'Campaign-Telephony': 'Campaign-Telephony',
+    'Campaign-Orchestration': 'Campaign-Orchestration',
+};
+/**
+ * Environment variable carrying the Amazon Connect instance id the campaign
+ * -association custom resource onboards to Outbound Campaigns v2 and associates
+ * the created Customer Profiles domain with.
+ */
+export const ENV_CONNECT_INSTANCE_ID = 'CONNECT_INSTANCE_ID';
+/** AWS service principal that owns the Outbound Campaigns service-linked role. */
+export const CONNECT_CAMPAIGNS_SERVICE_NAME = 'connect-campaigns.amazonaws.com';
+/** IAM path prefix under which the Outbound Campaigns service-linked role lives. */
+export const CONNECT_CAMPAIGNS_SLR_PATH_PREFIX = '/aws-service-role/connect-campaigns.amazonaws.com/';
+/**
+ * Fixed key under `custom` in `amplify_outputs.json` where the notifications
+ * endpoint / region are surfaced to the client (`custom.CustomerProfiles`).
+ *
+ * This is intentionally NOT configurable: every first-party Amplify Gen2
+ * resource (`defineAuth` / `defineData` / `defineStorage` / `defineFunction`)
+ * writes its backend output to a fixed, well-known key rather than a
+ * caller-chosen one, so the client config contributors know where to read it.
+ * This resource follows the same convention with a single stable key.
+ */
+export const OUTPUT_KEY = 'CustomerProfiles';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29uc3RhbnRzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc3JjL2NvbnN0YW50cy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQTs7Ozs7R0FLRztBQUVILCtFQUErRTtBQUMvRSxNQUFNLENBQUMsTUFBTSxtQkFBbUIsR0FBRyxnQkFBZ0IsQ0FBQztBQUVwRDs7Ozs7Ozs7OztHQVVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0seUJBQXlCLEdBQUcscUJBQXFCLENBQUM7QUFFL0QsNEVBQTRFO0FBQzVFLE1BQU0sQ0FBQyxNQUFNLGtCQUFrQixHQUFHLGVBQWUsQ0FBQztBQUVsRDs7Ozs7R0FLRztBQUNILE1BQU0sQ0FBQyxNQUFNLGdCQUFnQixHQUFHLGdCQUFnQixDQUFDO0FBRWpEOzs7Ozs7OztHQVFHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sb0JBQW9CLEdBQUcsb0JBQW9CLENBQUM7QUFFekQsNkVBQTZFO0FBQzdFLE1BQU0sQ0FBQyxNQUFNLHNCQUFzQixHQUFHLG1CQUFtQixDQUFDO0FBRTFELDhFQUE4RTtBQUM5RSxNQUFNLENBQUMsTUFBTSxpQkFBaUIsR0FBRyxZQUFZLENBQUM7QUFFOUMseUVBQXlFO0FBQ3pFLE1BQU0sQ0FBQyxNQUFNLG9CQUFvQixHQUFHLEdBQUcsQ0FBQztBQUV4Qyx1RUFBdUU7QUFDdkUsTUFBTSxDQUFDLE1BQU0sZUFBZSxHQUFHLHNCQUFzQixDQUFDO0FBRXREOzs7O0dBSUc7QUFDSCxNQUFNLENBQUMsTUFBTSxzQkFBc0IsR0FBRyxvQkFBb0IsQ0FBQztBQUUzRDs7Ozs7R0FLRztBQUNILE1BQU0sQ0FBQyxNQUFNLG9DQUFvQyxHQUFHLHFCQUFxQixDQUFDO0FBRTFFOzs7R0FHRztBQUNILE1BQU0sQ0FBQyxNQUFNLG9CQUFvQixHQUFHLE1BQU0sQ0FBQztBQUUzQzs7O0dBR0c7QUFDSCxNQUFNLENBQUMsTUFBTSx3QkFBd0IsR0FBRyxpQkFBaUIsQ0FBQztBQUUxRCxtRUFBbUU7QUFDbkUsTUFBTSxDQUFDLE1BQU0sa0JBQWtCLEdBQUcsY0FBYyxDQUFDO0FBRWpELGtFQUFrRTtBQUNsRSxNQUFNLENBQUMsTUFBTSxpQkFBaUIsR0FBRyw4QkFBOEIsQ0FBQztBQUVoRTs7Ozs7O0dBTUc7QUFDSCxNQUFNLENBQUMsTUFBTSxpQ0FBaUMsR0FBRztJQUMvQyx1QkFBdUI7SUFDdkIsaUNBQWlDO0NBQ2xDLENBQUM7QUFFRix3REFBd0Q7QUFDeEQsTUFBTSxDQUFDLE1BQU0sdUJBQXVCLEdBQUcsR0FBRyxDQUFDO0FBRTNDOzs7Ozs7Ozs7R0FTRztBQUNILE1BQU0sQ0FBQyxNQUFNLDBCQUEwQixHQUFHO0lBQ3hDLGdCQUFnQixFQUFFLGdCQUFnQjtJQUNsQyxjQUFjLEVBQUUsY0FBYztJQUM5QixvQkFBb0IsRUFBRSxvQkFBb0I7SUFDMUMsd0JBQXdCLEVBQUUsd0JBQXdCO0NBQzFDLENBQUM7QUFFWDs7OztHQUlHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sdUJBQXVCLEdBQUcscUJBQXFCLENBQUM7QUFFN0Qsa0ZBQWtGO0FBQ2xGLE1BQU0sQ0FBQyxNQUFNLDhCQUE4QixHQUFHLGlDQUFpQyxDQUFDO0FBRWhGLG9GQUFvRjtBQUNwRixNQUFNLENBQUMsTUFBTSxpQ0FBaUMsR0FDNUMsb0RBQW9ELENBQUM7QUFFdkQ7Ozs7Ozs7OztHQVNHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHLGtCQUFrQixDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLyoqXG4gKiBTaGFyZWQgY29uc3RhbnRzIGRlc2NyaWJpbmcgdGhlIEN1c3RvbWVyIFByb2ZpbGVzIG9iamVjdCBtb2RlbC5cbiAqXG4gKiBSZWZlcmVuY2VkIGJ5IEJPVEggdGhlIENESyBvYmplY3QtdHlwZSBkZWZpbml0aW9ucyBhbmQgdGhlIExhbWJkYSBoYW5kbGVyLFxuICogc28gdGhleSBtdXN0IHN0YXkgaW4gbG9ja3N0ZXAuXG4gKi9cblxuLyoqIFByb2ZpbGUgb2JqZWN0IHR5cGUuIERlY2xhcmVzIHRoZSBzZWFyY2hhYmxlIGlkZW50aXR5IGtleSArIGF0dHIgc2NoZW1hLiAqL1xuZXhwb3J0IGNvbnN0IE9CSkVDVF9UWVBFX1BST0ZJTEUgPSAnQW1wbGlmeVByb2ZpbGUnO1xuXG4vKipcbiAqIEd1ZXN0IHByb2ZpbGUgb2JqZWN0IHR5cGUuIEEgZGlzdGluY3Qgb2JqZWN0IHR5cGUgaXNcbiAqIHJlcXVpcmVkIGJlY2F1c2UgQ3VzdG9tZXIgUHJvZmlsZXMgcGVybWl0cyBFWEFDVExZIE9ORSBgVU5JUVVFYCBrZXkgcGVyIG9iamVjdFxuICogdHlwZSBBTkQgYFB1dFByb2ZpbGVPYmplY3RgIHJlcXVpcmVzIHRoZSBpbmdlc3RlZCBvYmplY3QgdG8gY2FycnkgdGhhdCBVTklRVUVcbiAqIGtleS4gVGhlIGF1dGhlZCBgQW1wbGlmeVByb2ZpbGVgIHJlc2VydmVzIGl0cyBzaW5nbGUgVU5JUVVFIGtleSBmb3JcbiAqIGBjb2duaXRvU3ViYCwgc28gZ3Vlc3QgcHJvZmlsZXMg4oCUIGtleWVkIG9uIHRoZSBJZGVudGl0eSBQb29sIGBpZGVudGl0eUlkYCDigJRcbiAqIGdldCB0aGVpciBvd24gb2JqZWN0IHR5cGUgd2hvc2UgVU5JUVVFIGtleSBpcyBgY29nbml0b0lkZW50aXR5S2V5YC4gQm90aFxuICogb2JqZWN0IHR5cGVzIGNyZWF0ZSBvcmRpbmFyeSBwcm9maWxlcyBpbiB0aGUgU0FNRSBkb21haW47IHRoZSBkZXZpY2Ugb2JqZWN0XG4gKiB0eXBlIGNhcnJpZXMgYm90aCBpZGVudGl0eSBrZXlzIGFzIFBST0ZJTEUga2V5cyBzbyBhIGRldmljZSByZXNvbHZlcyB0b1xuICogd2hpY2hldmVyIHByb2ZpbGUgaXQgYmVsb25ncyB0by5cbiAqL1xuZXhwb3J0IGNvbnN0IE9CSkVDVF9UWVBFX0dVRVNUX1BST0ZJTEUgPSAnQW1wbGlmeUd1ZXN0UHJvZmlsZSc7XG5cbi8qKiBEZXZpY2Ugb2JqZWN0IHR5cGUuIE9uZSBvYmplY3QgcGVyIHN0YWJsZSBkZXZpY2VJZDsgdG9rZW4gaXMgYSBmaWVsZC4gKi9cbmV4cG9ydCBjb25zdCBPQkpFQ1RfVFlQRV9ERVZJQ0UgPSAnQW1wbGlmeURldmljZSc7XG5cbi8qKlxuICogU2VhcmNoYWJsZSBwcm9maWxlIGtleSB0aGF0IGJpbmRzIGEgcHJvZmlsZSB0byBhIHZlcmlmaWVkIENvZ25pdG8gc3ViamVjdC5cbiAqIFByb2ZpbGVzIGFyZSBsb29rZWQgdXAgYnkgVEhJUyBrZXkgKFNlYXJjaFByb2ZpbGVzKSwgbmV2ZXIgYnkgdGhlIEF0dHJpYnV0ZXNcbiAqIG1hcC4gVGhlIHNhbWUga2V5IG5hbWUgaXMgdXNlZCBhcyB0aGUgUFJPRklMRS1yZXNvbHV0aW9uIGtleSBvbiB0aGUgZGV2aWNlXG4gKiBvYmplY3QgdHlwZSBzbyBkZXZpY2Ugb2JqZWN0cyBtZXJnZSBpbnRvIHRoZSBjb3JyZWN0IHByb2ZpbGUuXG4gKi9cbmV4cG9ydCBjb25zdCBDT0dOSVRPX1VTRVJfS0VZID0gJ2NvZ25pdG9Vc2VyS2V5JztcblxuLyoqXG4gKiBTZWFyY2hhYmxlIHByb2ZpbGUga2V5IHRoYXQgYmluZHMgYSBwcm9maWxlIHRvIGFuXG4gKiBVTkFVVEhFTlRJQ0FURUQgQ29nbml0byBJZGVudGl0eSBQb29sIGlkZW50aXR5ICh0aGUgYGNvZ25pdG9JZGVudGl0eUlkYCwgZS5nLlxuICogYHVzLWVhc3QtMTo8dXVpZD5gKS4gQSBndWVzdCBoYXMgbm8gSldUIGBzdWJgLCBzbyBpdHMgcHJvZmlsZSBpcyBrZXllZCBieSB0aGlzXG4gKiBrZXkgaW5zdGVhZCBvZiB7QGxpbmsgQ09HTklUT19VU0VSX0tFWX0uIEFsc28gdGhlIFBST0ZJTEUtcmVzb2x1dGlvbiBrZXkgb24gdGhlXG4gKiBkZXZpY2Ugb2JqZWN0IHR5cGUgc28gYSBndWVzdCdzIGRldmljZSBvYmplY3RzIG1lcmdlIGludG8gdGhlIGd1ZXN0IHByb2ZpbGUuXG4gKiBPbiBzaWduLWluIHRoZSBndWVzdCBwcm9maWxlIGlzIGZvbGRlZCBpbnRvIHRoZSBhdXRoZWQgKHN1Yi1rZXllZCkgcHJvZmlsZSB2aWFcbiAqIE1lcmdlUHJvZmlsZXMgKHNlZSBtZXJnZV9yZXNvbHZlcikuXG4gKi9cbmV4cG9ydCBjb25zdCBDT0dOSVRPX0lERU5USVRZX0tFWSA9ICdjb2duaXRvSWRlbnRpdHlLZXknO1xuXG4vKiogT2JqZWN0IGZpZWxkIGNhcnJ5aW5nIHRoZSBndWVzdCBpZGVudGl0eSB2YWx1ZSAoc291cmNlZCBpbnRvIHRoZSBrZXkpLiAqL1xuZXhwb3J0IGNvbnN0IENPR05JVE9fSURFTlRJVFlfRklFTEQgPSAnY29nbml0b0lkZW50aXR5SWQnO1xuXG4vKiogT2JqZWN0IGZpZWxkIGNhcnJ5aW5nIHRoZSBhdXRoZWQgaWRlbnRpdHkgdmFsdWUgKHNvdXJjZWQgaW50byB0aGUga2V5KS4gKi9cbmV4cG9ydCBjb25zdCBDT0dOSVRPX1NVQl9GSUVMRCA9ICdjb2duaXRvU3ViJztcblxuLyoqIE1heCBsZW5ndGggb2YgYSBDdXN0b21lciBQcm9maWxlcyBhdHRyaWJ1dGUgdmFsdWUgKHNpbmdsZSBzdHJpbmcpLiAqL1xuZXhwb3J0IGNvbnN0IE1BWF9BVFRSSUJVVEVfTEVOR1RIID0gMjU1O1xuXG4vKiogRW52aXJvbm1lbnQgdmFyaWFibGUgY2FycnlpbmcgdGhlIEN1c3RvbWVyIFByb2ZpbGVzIGRvbWFpbiBuYW1lLiAqL1xuZXhwb3J0IGNvbnN0IEVOVl9ET01BSU5fTkFNRSA9ICdQUk9GSUxFU19ET01BSU5fTkFNRSc7XG5cbi8qKlxuICogRW52aXJvbm1lbnQgdmFyaWFibGUgY2FycnlpbmcgdGhlIEFXUyBFbmQgVXNlciBNZXNzYWdpbmcgLyBQaW5wb2ludFxuICogYXBwbGljYXRpb24gKHByb2plY3QpIGlkIHRoZSBwdXNoLWRlbGl2ZXJ5IExhbWJkYSBjYWxscyBgU2VuZE1lc3NhZ2VzYFxuICogYWdhaW5zdC5cbiAqL1xuZXhwb3J0IGNvbnN0IEVOVl9FVU1fQVBQTElDQVRJT05fSUQgPSAnRVVNX0FQUExJQ0FUSU9OX0lEJztcblxuLyoqXG4gKiBBbWF6b24gQ29ubmVjdCBpbnRlZ3JhdGlvbiB0eXBlIHRoYXQgYmluZHMgYSBRIGluIENvbm5lY3QgKFdpc2RvbSkga25vd2xlZGdlXG4gKiBiYXNlIOKAlCB0aGUgc3RvcmUgZm9yIG1lc3NhZ2UgdGVtcGxhdGVzIOKAlCB0byBhIENvbm5lY3QgaW5zdGFuY2UuIFVzZWQgYnkgdGhlXG4gKiBwdXNoIExhbWJkYSdzIHJ1bnRpbWUga25vd2xlZGdlLWJhc2UgZGlzY292ZXJ5XG4gKiAoTGlzdEludGVncmF0aW9uQXNzb2NpYXRpb25zIGZpbHRlcmVkIHRvIHRoaXMgdHlwZSkuXG4gKi9cbmV4cG9ydCBjb25zdCBRX01FU1NBR0VfVEVNUExBVEVTX0lOVEVHUkFUSU9OX1RZUEUgPSAnUV9NRVNTQUdFX1RFTVBMQVRFUyc7XG5cbi8qKlxuICogQ2hhbm5lbCBzdWJ0eXBlIG9mIHRoZSBRIGluIENvbm5lY3QgbWVzc2FnZSB0ZW1wbGF0ZXMgdGhpcyBiYWNrZW5kIHJlbmRlcnMuXG4gKiBPbmx5IFBVU0ggdGVtcGxhdGVzIGFyZSBlbGlnaWJsZSBmb3IgcHVzaC1ub3RpZmljYXRpb24gY29weSByZXNvbHV0aW9uLlxuICovXG5leHBvcnQgY29uc3QgUFVTSF9DSEFOTkVMX1NVQlRZUEUgPSAnUFVTSCc7XG5cbi8qKlxuICogVmVyc2lvbiBxdWFsaWZpZXIgYXBwZW5kZWQgdG8gYSBtZXNzYWdlLXRlbXBsYXRlIGlkIHRvIHJlZmVyZW5jZSBpdHMgQUNUSVZFXG4gKiAocHVibGlzaGVkKSB2ZXJzaW9uIOKAlCBlLmcuIGBHZXRNZXNzYWdlVGVtcGxhdGUoPGlkPjokQUNUSVZFX1ZFUlNJT04pYC5cbiAqL1xuZXhwb3J0IGNvbnN0IEFDVElWRV9WRVJTSU9OX1FVQUxJRklFUiA9ICckQUNUSVZFX1ZFUlNJT04nO1xuXG4vKiogRGVmYXVsdCBwdXNoLW5vdGlmaWNhdGlvbiB0aXRsZSB3aGVuIHRoZSBldmVudCBjYXJyaWVzIG5vbmUuICovXG5leHBvcnQgY29uc3QgREVGQVVMVF9QVVNIX1RJVExFID0gJ05vdGlmaWNhdGlvbic7XG5cbi8qKiBEZWZhdWx0IHB1c2gtbm90aWZpY2F0aW9uIGJvZHkgd2hlbiB0aGUgZXZlbnQgY2FycmllcyBub25lLiAqL1xuZXhwb3J0IGNvbnN0IERFRkFVTFRfUFVTSF9CT0RZID0gJ1lvdSBoYXZlIGEgbmV3IG5vdGlmaWNhdGlvbi4nO1xuXG4vKipcbiAqIFNlcnZpY2UgcHJpbmNpcGFscyBhbGxvd2VkIHRvIGludm9rZSB0aGUgcHVzaC1kZWxpdmVyeSBMYW1iZGEgdmlhIGFcbiAqIHJlc291cmNlLWJhc2VkIHBvbGljeS4gQW1hem9uIENvbm5lY3QgSm91cm5leSBDdXN0b20tYWN0aW9ucyBpbnZva2UgTGFtYmRhXG4gKiB1bmRlciBgY29ubmVjdC5hbWF6b25hd3MuY29tYDsgT3V0Ym91bmQgQ2FtcGFpZ25zIHYyIHVzZXNcbiAqIGBjb25uZWN0LWNhbXBhaWducy5hbWF6b25hd3MuY29tYC4gR3JhbnRpbmcgYm90aCBsZXRzIHRoZSBjdXN0b21lcidzIEpvdXJuZXlcbiAqIC8gY2FtcGFpZ24gY2FsbCB0aGUgcHVzaCBMYW1iZGEgd2l0aG91dCBhIGJyb2FkIHdpbGRjYXJkIHByaW5jaXBhbC5cbiAqL1xuZXhwb3J0IGNvbnN0IENPTk5FQ1RfSU5WT0tFX1NFUlZJQ0VfUFJJTkNJUEFMUyA9IFtcbiAgJ2Nvbm5lY3QuYW1hem9uYXdzLmNvbScsXG4gICdjb25uZWN0LWNhbXBhaWducy5hbWF6b25hd3MuY29tJyxcbl07XG5cbi8qKiBEZWZhdWx0IHByb2ZpbGUgLyBvYmplY3QtdHlwZSBleHBpcmF0aW9uIGluIGRheXMuICovXG5leHBvcnQgY29uc3QgREVGQVVMVF9FWFBJUkFUSU9OX0RBWVMgPSAzNjY7XG5cbi8qKlxuICogT3V0Ym91bmQgQ2FtcGFpZ25zIHYyIDwtPiBDdXN0b21lciBQcm9maWxlcyBvYmplY3QtdHlwZSByb3V0aW5nIG1hcC4gVGhpc1xuICogbGFiZWwgbWFwIGJpbmRzIGEgY2FtcGFpZ24gY2hhbm5lbCB0byB0aGUgQlVJTFQtSU4gQ3VzdG9tZXIgUHJvZmlsZXMgb2JqZWN0XG4gKiB0ZW1wbGF0ZSBvZiB0aGUgc2FtZSBuYW1lOyBpdCBpcyBhIHJvdXRpbmcvbGFiZWwgbWFwLCBOT1QgYSBzZXQgb2Ygb2JqZWN0XG4gKiB0eXBlcyB0aGF0IG11c3QgYmUgcHJlLWNyZWF0ZWQgdmlhIFB1dFByb2ZpbGVPYmplY3RUeXBlLiBUaGUgc2FtZSBtYXAgaXNcbiAqIHN1cHBsaWVkIHRvIEJPVEggYGNvbm5lY3RjYW1wYWlnbnN2MjpQdXRDb25uZWN0SW5zdGFuY2VJbnRlZ3JhdGlvbmAgKGFzXG4gKiBgaW50ZWdyYXRpb25Db25maWcuY3VzdG9tZXJQcm9maWxlcy5vYmplY3RUeXBlTmFtZXNgKSBhbmRcbiAqIGBjdXN0b21lci1wcm9maWxlczpQdXRJbnRlZ3JhdGlvbmAgKGFzIGBPYmplY3RUeXBlTmFtZXNgKSBzbyBDb25uZWN0IEpvdXJuZXlzXG4gKiBjYW4gdGFyZ2V0IHRoZSBkb21haW4ncyBwcm9maWxlcy5cbiAqL1xuZXhwb3J0IGNvbnN0IENBTVBBSUdOX09CSkVDVF9UWVBFX05BTUVTID0ge1xuICAnQ2FtcGFpZ24tRW1haWwnOiAnQ2FtcGFpZ24tRW1haWwnLFxuICAnQ2FtcGFpZ24tU01TJzogJ0NhbXBhaWduLVNNUycsXG4gICdDYW1wYWlnbi1UZWxlcGhvbnknOiAnQ2FtcGFpZ24tVGVsZXBob255JyxcbiAgJ0NhbXBhaWduLU9yY2hlc3RyYXRpb24nOiAnQ2FtcGFpZ24tT3JjaGVzdHJhdGlvbicsXG59IGFzIGNvbnN0O1xuXG4vKipcbiAqIEVudmlyb25tZW50IHZhcmlhYmxlIGNhcnJ5aW5nIHRoZSBBbWF6b24gQ29ubmVjdCBpbnN0YW5jZSBpZCB0aGUgY2FtcGFpZ25cbiAqIC1hc3NvY2lhdGlvbiBjdXN0b20gcmVzb3VyY2Ugb25ib2FyZHMgdG8gT3V0Ym91bmQgQ2FtcGFpZ25zIHYyIGFuZCBhc3NvY2lhdGVzXG4gKiB0aGUgY3JlYXRlZCBDdXN0b21lciBQcm9maWxlcyBkb21haW4gd2l0aC5cbiAqL1xuZXhwb3J0IGNvbnN0IEVOVl9DT05ORUNUX0lOU1RBTkNFX0lEID0gJ0NPTk5FQ1RfSU5TVEFOQ0VfSUQnO1xuXG4vKiogQVdTIHNlcnZpY2UgcHJpbmNpcGFsIHRoYXQgb3ducyB0aGUgT3V0Ym91bmQgQ2FtcGFpZ25zIHNlcnZpY2UtbGlua2VkIHJvbGUuICovXG5leHBvcnQgY29uc3QgQ09OTkVDVF9DQU1QQUlHTlNfU0VSVklDRV9OQU1FID0gJ2Nvbm5lY3QtY2FtcGFpZ25zLmFtYXpvbmF3cy5jb20nO1xuXG4vKiogSUFNIHBhdGggcHJlZml4IHVuZGVyIHdoaWNoIHRoZSBPdXRib3VuZCBDYW1wYWlnbnMgc2VydmljZS1saW5rZWQgcm9sZSBsaXZlcy4gKi9cbmV4cG9ydCBjb25zdCBDT05ORUNUX0NBTVBBSUdOU19TTFJfUEFUSF9QUkVGSVggPVxuICAnL2F3cy1zZXJ2aWNlLXJvbGUvY29ubmVjdC1jYW1wYWlnbnMuYW1hem9uYXdzLmNvbS8nO1xuXG4vKipcbiAqIEZpeGVkIGtleSB1bmRlciBgY3VzdG9tYCBpbiBgYW1wbGlmeV9vdXRwdXRzLmpzb25gIHdoZXJlIHRoZSBub3RpZmljYXRpb25zXG4gKiBlbmRwb2ludCAvIHJlZ2lvbiBhcmUgc3VyZmFjZWQgdG8gdGhlIGNsaWVudCAoYGN1c3RvbS5DdXN0b21lclByb2ZpbGVzYCkuXG4gKlxuICogVGhpcyBpcyBpbnRlbnRpb25hbGx5IE5PVCBjb25maWd1cmFibGU6IGV2ZXJ5IGZpcnN0LXBhcnR5IEFtcGxpZnkgR2VuMlxuICogcmVzb3VyY2UgKGBkZWZpbmVBdXRoYCAvIGBkZWZpbmVEYXRhYCAvIGBkZWZpbmVTdG9yYWdlYCAvIGBkZWZpbmVGdW5jdGlvbmApXG4gKiB3cml0ZXMgaXRzIGJhY2tlbmQgb3V0cHV0IHRvIGEgZml4ZWQsIHdlbGwta25vd24ga2V5IHJhdGhlciB0aGFuIGFcbiAqIGNhbGxlci1jaG9zZW4gb25lLCBzbyB0aGUgY2xpZW50IGNvbmZpZyBjb250cmlidXRvcnMga25vdyB3aGVyZSB0byByZWFkIGl0LlxuICogVGhpcyByZXNvdXJjZSBmb2xsb3dzIHRoZSBzYW1lIGNvbnZlbnRpb24gd2l0aCBhIHNpbmdsZSBzdGFibGUga2V5LlxuICovXG5leHBvcnQgY29uc3QgT1VUUFVUX0tFWSA9ICdDdXN0b21lclByb2ZpbGVzJztcbiJdfQ==

package/lib/construct.d.ts

@@ -0,0 +1,283 @@
+import { Stack } from 'aws-cdk-lib';
+import { Construct } from 'constructs';
+import * as lambda from 'aws-cdk-lib/aws-lambda';
+import { CfnDomain, CfnObjectType } from 'aws-cdk-lib/aws-customerprofiles';
+import { CfnInstance } from 'aws-cdk-lib/aws-connect';
+import { CfnAPNSChannel, CfnAPNSSandboxChannel, CfnApp, CfnGCMChannel } from 'aws-cdk-lib/aws-pinpoint';
+import * as apigwv2 from 'aws-cdk-lib/aws-apigatewayv2';
+import { ResourceProvider, StackProvider } from '@aws-amplify/plugin-types';
+/** CDK resources exposed by {@link AmplifyNotifications}. */
+export type NotificationsResources = {
+    /** The identify-user Lambda function. */
+    identifyUserFunction: lambda.IFunction;
+    /** The HTTP API fronting the identify-user route. */
+    httpApi: apigwv2.HttpApi;
+    /** The AmplifyProfile object type registered on the domain. */
+    profileObjectType: CfnObjectType;
+    /** The AmplifyGuestProfile object type registered on the domain. */
+    guestProfileObjectType: CfnObjectType;
+    /** The AmplifyDevice object type registered on the domain. */
+    deviceObjectType: CfnObjectType;
+    /**
+     * The push-delivery Lambda function, wired as the target of a Connect Journey
+     * Custom-action (Invoke Lambda).
+     */
+    pushFunction: lambda.IFunction;
+    /** The AWS End User Messaging / Pinpoint application backing push delivery. */
+    pushApplication: CfnApp;
+    /**
+     * The APNs channel enabled on the push application, when `apnsChannel` is
+     * configured. `undefined` when no APNs configuration was provided. Either the
+     * production (`CfnAPNSChannel`) or sandbox (`CfnAPNSSandboxChannel`) channel,
+     * depending on `apnsChannel.sandbox`.
+     */
+    apnsChannel?: CfnAPNSChannel | CfnAPNSSandboxChannel;
+    /**
+     * The GCM/FCM channel enabled on the push application, when `fcmChannel` is
+     * configured. `undefined` when no FCM configuration was provided.
+     */
+    gcmChannel?: CfnGCMChannel;
+    /**
+     * The Amazon Connect instance created in create-from-scratch mode (when
+     * `domainName` is omitted). `undefined` in attach mode.
+     */
+    connectInstance?: CfnInstance;
+    /**
+     * The Customer Profiles domain created in create-from-scratch mode (when
+     * `domainName` is omitted). `undefined` in attach mode, where the object types
+     * are registered into a pre-existing domain the construct does not own.
+     */
+    profilesDomain?: CfnDomain;
+};
+export type AmplifyNotificationsProps = {
+    /**
+     * The JWT issuer URL the HTTP API authorizer trusts. For a Cognito user pool
+     * this is `https://cognito-idp.<region>.amazonaws.com/<userPoolId>`.
+     */
+    readonly jwtIssuer: string;
+    /**
+     * Allowed JWT audiences. For a Cognito user pool this is the app client id(s)
+     * (matched against `aud` for id tokens / `client_id` for access tokens).
+     */
+    readonly jwtAudience: string[];
+    /**
+     * Name of an EXISTING Customer Profiles domain to attach to — e.g. the domain
+     * Amazon Connect auto-creates when Customer Profiles is enabled on an
+     * instance. When provided, the construct runs in ATTACH mode: it registers the
+     * AmplifyProfile / AmplifyDevice object types INTO this domain and never
+     * creates an instance or a domain.
+     *
+     * OMIT this to run in the default CREATE-FROM-SCRATCH mode: the construct
+     * provisions a brand-new Amazon Connect instance AND a brand-new Customer
+     * Profiles domain (with generated, stable names) and wires everything into
+     * that new domain — so a caller needs zero pre-existing Connect setup.
+     */
+    readonly domainName?: string;
+    /**
+     * CREATE mode only: override the auto-generated Amazon Connect instance alias.
+     * Ignored in attach mode. When omitted, a deterministic-yet-unique alias is
+     * derived from the construct's scope so it is stable across deploy/delete and
+     * unique per app. Lowercase alphanumeric characters + hyphens; must not start
+     * with
+     * `d-`.
+     */
+    readonly instanceAlias?: string;
+    /**
+     * Override the directory containing the pre-bundled Lambda asset (an
+     * `index.js` exporting `handler`). Defaults to the handler bundled inside this
+     * package (`lib/handler-asset`, produced by `post:compile`).
+     */
+    readonly lambdaCodePath?: string;
+    /** Profile / object-type expiration in days. Default: 366. */
+    readonly expirationDays?: number;
+    /**
+     * Override the directory containing the pre-bundled push Lambda asset (an
+     * `index.js` exporting `handler`). Defaults to the handler bundled inside this
+     * package (`lib/push-handler-asset`, produced by `post:compile`).
+     */
+    readonly pushLambdaCodePath?: string;
+    /**
+     * Override the directory containing the pre-bundled campaign-association
+     * custom-resource Lambda asset (an `index.js` exporting `handler`). Defaults to
+     * the handler bundled inside this package (`lib/campaign-association-asset`,
+     * produced by `post:compile`). Only used in create-from-scratch mode.
+     */
+    readonly campaignAssociationLambdaCodePath?: string;
+    /**
+     * OPTIONAL APNs channel configuration (token / `.p8` auth). When provided, the
+     * construct enables the APNs channel on the created End User Messaging
+     * (Pinpoint) application. All values are plain strings — the Amplify Gen2
+     * factory resolves the `.p8` key from an Amplify `secret()` before passing it
+     * here, keeping this construct framework-agnostic. When omitted, no APNs
+     * channel is configured.
+     */
+    readonly apnsChannel?: {
+        /** The APNs token signing key contents (the `AuthKey_<keyId>.p8` file). */
+        readonly tokenKey: string;
+        /** The 10-character key identifier assigned to the APNs signing key. */
+        readonly keyId: string;
+        /** The Apple Developer account team identifier. */
+        readonly teamId: string;
+        /** The iOS app bundle identifier. */
+        readonly bundleId: string;
+        /**
+         * Configure the APNs **sandbox** channel instead of the production channel.
+         * @default false
+         */
+        readonly sandbox?: boolean;
+    };
+    /**
+     * OPTIONAL FCM/GCM channel configuration (FCM HTTP v1 auth). When provided, the
+     * construct enables the GCM channel on the created End User Messaging
+     * (Pinpoint) application. The value is a plain string — the Amplify Gen2
+     * factory resolves the service-account JSON from an Amplify `secret()` before
+     * passing it here. When omitted, no GCM channel is configured.
+     */
+    readonly fcmChannel?: {
+        /** The FCM HTTP v1 service-account JSON credential contents. */
+        readonly serviceJson: string;
+    };
+};
+/**
+ * Amazon Connect Customer Profiles backend for the identifyUser contract,
+ * packaged as an AWS CDK construct. Provisions:
+ *   - AmplifyProfile object type: searchable `cognitoUserKey` (PROFILE + UNIQUE)
+ *     identity key + person / targeting attribute schema.
+ *   - AmplifyDevice object type: PROFILE-resolution key = `cognitoUserKey`,
+ *     UNIQUE object key = stable `deviceId`; device fields stored raw.
+ *   - identify-user Lambda with least-privilege profile:* on this domain only.
+ *   - HTTP API + JWT authorizer bound to the supplied issuer / audience.
+ *   - push-delivery Lambda (Connect Journey Custom-action target) + a minimal
+ *     AWS End User Messaging (Pinpoint) application for `SendMessages`.
+ *
+ * It operates in one of two modes, chosen by whether `domainName` is provided:
+ *
+ *   - CREATE-FROM-SCRATCH (default, `domainName` omitted): the construct also
+ *     provisions a brand-new Amazon Connect instance (`AWS::Connect::Instance`,
+ *     CONNECT_MANAGED, inbound/outbound enabled) AND a brand-new Customer
+ *     Profiles domain (`AWS::CustomerProfiles::Domain`) with generated, stable
+ *     names, then registers the object types INTO that new domain. The object
+ *     types depend on the created domain so they provision after it and are torn
+ *     down before it. A caller needs zero pre-existing Connect setup.
+ *   - ATTACH (`domainName` provided): the construct registers the two object
+ *     types INTO the existing `domainName` (additive) — such as the domain
+ *     Amazon Connect auto-creates when Customer Profiles is enabled on an
+ *     instance — WITHOUT creating an instance or a domain, and without touching
+ *     the domain's other integrations (CTR, Outbound Campaigns) or its Identity
+ *     Resolution setting.
+ *
+ * In either mode, identify works against the domain standalone. Outbound
+ * Campaigns association — so journeys can target these profiles — is AUTOMATIC
+ * in create-from-scratch mode (a Lambda-backed custom resource associates the
+ * new domain with the new instance's Outbound Campaigns v2 at deploy time). In
+ * attach mode, associating the pre-existing domain is the user's responsibility
+ * and is left untouched.
+ *
+ * This construct is framework-agnostic (aws-cdk-lib + constructs only). The
+ * `defineNotifications` factory wraps it for Amplify Gen2 backends, wiring the
+ * JWT authorizer to the app's Cognito user pool and surfacing the endpoint via
+ * backend outputs.
+ */
+export declare class AmplifyNotifications extends Construct implements ResourceProvider<NotificationsResources>, StackProvider {
+    /** CDK resources for lower-level access. */
+    readonly resources: NotificationsResources;
+    /** The stack this construct belongs to. */
+    readonly stack: Stack;
+    /** Base invoke URL. Clients call `POST {apiEndpoint}/identify-user`. */
+    readonly apiEndpoint: string;
+    /** The route path appended to {@link apiEndpoint}. */
+    readonly identifyUserPath = "/identify-user";
+    /**
+     * The GUEST route path appended to {@link apiEndpoint}.
+     * IAM/SigV4-authorized; unauthenticated Identity Pool callers sign requests to
+     * `POST {apiEndpoint}/identify-user-guest`.
+     */
+    readonly guestIdentifyUserPath = "/identify-user-guest";
+    /**
+     * The `execute-api:Invoke` ARN of the GUEST route, to
+     * grant to the app's Cognito Identity Pool UNAUTHENTICATED role so guests can
+     * call the route. Scoped to POST on the guest path of this API's default
+     * stage.
+     */
+    readonly guestRouteInvokeArn: string;
+    /** The Customer Profiles domain name the object types are registered into. */
+    readonly domainName: string;
+    /**
+     * `true` when this construct created the Customer Profiles domain + Connect
+     * instance (create-from-scratch mode); `false` when it attached to an existing
+     * domain named by `domainName`.
+     */
+    readonly createsResources: boolean;
+    /**
+     * Id of the Amazon Connect instance created in create-from-scratch mode.
+     * `undefined` in attach mode.
+     */
+    readonly connectInstanceId?: string;
+    /**
+     * ARN of the Amazon Connect instance created in create-from-scratch mode.
+     * `undefined` in attach mode.
+     */
+    readonly connectInstanceArn?: string;
+    /**
+     * ARN of the push-delivery Lambda, to wire as a Connect Journey Custom-action
+     * (Invoke Lambda) target.
+     */
+    readonly pushFunctionArn: string;
+    /**
+     * The AWS End User Messaging / Pinpoint application id this construct created
+     * and the push Lambda calls `SendMessages` against.
+     */
+    readonly eumApplicationId: string;
+    /**
+     * Registers the AmplifyProfile / AmplifyDevice object types into the Customer
+     * Profiles domain (created here in create-from-scratch mode, or the existing
+     * `domainName` in attach mode), the identify-user Lambda + JWT-authorized HTTP
+     * API, and the push-delivery Lambda + AWS End User Messaging application for
+     * this notifications backend.
+     */
+    constructor(scope: Construct, id: string, props: AmplifyNotificationsProps);
+    /**
+     * Create-from-scratch ONLY: a Lambda-backed CDK custom resource that
+     * associates the created Customer Profiles domain with the created Amazon
+     * Connect instance's Outbound Campaigns v2 at deploy time, so Connect Journeys
+     * can target the domain's profiles with no manual console step.
+     *
+     * A `custom-resources.Provider` fronts the handler because onboarding is
+     * asynchronous: the handler starts the instance-onboarding job, then POLLS
+     * GetInstanceOnboardingJobStatus until SUCCEEDED (an `AwsCustomResource` can't
+     * poll). onCreate/onUpdate are idempotent; onDelete best-effort reverses the
+     * integrations + offboards, never failing teardown. The resource depends on
+     * both the instance and the domain so it runs after they exist and is torn
+     * down before them.
+     */
+    private addCampaignAssociation;
+    /**
+     * Deterministic, stable, per-app base name for the created Connect instance
+     * and Customer Profiles domain (create-from-scratch mode).
+     *
+     * The name must be STABLE across deploy and delete (so CFN resolves the same
+     * resource on teardown) and UNIQUE per app / environment (so two apps in the
+     * same account don't collide on the globally-unique Connect alias). It is
+     * derived from a short hash of the root stack name (which, in Amplify Gen2,
+     * embeds the app namespace + branch) plus this construct's path — both stable
+     * inputs.
+     *
+     * The `amazon-connect-` prefix is REQUIRED, not cosmetic: Amazon Connect's
+     * AWS-managed service-linked-role policy (`AmazonConnectServiceLinkedRolePolicy`,
+     * statement `AllowCustomerProfilesForConnectDomain`) grants the instance's
+     * role `profile:*` ONLY on `arn:aws:profile:*:*:domains/amazon-connect-*`. A
+     * domain named otherwise is unreachable by the instance — the Connect console
+     * and Journey segment builder then report "does not have permissions to access
+     * Customer Profiles". The SLR is AWS-protected (no inline policy can be added)
+     * and the managed policy is not editable, so the domain name is the only lever.
+     */
+    private generateResourceName;
+    /**
+     * Coerce an arbitrary string into a valid Amazon Connect instance alias:
+     * lowercase alphanumeric characters + single hyphens, no leading/trailing hyphen, not
+     * starting with the reserved `d-` prefix, and within Connect's 1–62 char
+     * bound.
+     */
+    private sanitizeInstanceAlias;
+}
+//# sourceMappingURL=construct.d.ts.map