@maestro-js/aws-cdk-recipes 1.0.0-alpha.0

package/dist/index.d.ts

@@ -0,0 +1,2284 @@
+import * as aws_cdk_lib_aws_s3 from 'aws-cdk-lib/aws-s3';
+import { Construct } from 'constructs';
+import * as logs from 'aws-cdk-lib/aws-logs';
+import * as aws_cdk_lib_aws_ec2 from 'aws-cdk-lib/aws-ec2';
+import * as aws_cdk_lib_aws_ecs from 'aws-cdk-lib/aws-ecs';
+import * as aws_cdk_lib_aws_cloudfront from 'aws-cdk-lib/aws-cloudfront';
+import * as aws_cdk_lib from 'aws-cdk-lib';
+import { Duration, Size } from 'aws-cdk-lib';
+import * as lambda from 'aws-cdk-lib/aws-lambda';
+import * as lambdaNode from 'aws-cdk-lib/aws-lambda-nodejs';
+import * as aws_cdk_lib_aws_ecr_assets from 'aws-cdk-lib/aws-ecr-assets';
+import * as aws_cdk_lib_aws_elasticloadbalancingv2 from 'aws-cdk-lib/aws-elasticloadbalancingv2';
+import * as aws_cdk_lib_aws_iam from 'aws-cdk-lib/aws-iam';
+import * as aws_cdk_lib_aws_rds from 'aws-cdk-lib/aws-rds';
+import * as secretsmanager from 'aws-cdk-lib/aws-secretsmanager';
+import * as aws_cdk_lib_aws_elasticache from 'aws-cdk-lib/aws-elasticache';
+import * as aws_cdk_lib_aws_ses from 'aws-cdk-lib/aws-ses';
+import * as route53 from 'aws-cdk-lib/aws-route53';
+import * as aws_cdk_lib_aws_sns from 'aws-cdk-lib/aws-sns';
+import * as aws_cdk_lib_aws_sns_subscriptions from 'aws-cdk-lib/aws-sns-subscriptions';
+import * as aws_cdk_lib_aws_sqs from 'aws-cdk-lib/aws-sqs';
+import * as aws_cdk_lib_aws_events_targets from 'aws-cdk-lib/aws-events-targets';
+import * as aws_cdk_lib_aws_events from 'aws-cdk-lib/aws-events';
+
+/**
+ * An S3 bucket with HTTPS enforcement, configurable CORS, lifecycle rules, and custom bucket policies.
+ *
+ * @example
+ * ```ts
+ * const uploads = new Bucket(this, 'Uploads', {
+ *   versioning: true,
+ *   lifecycle: [{ prefix: 'tmp/', expiresIn: '7 days' }]
+ * })
+ * ```
+ */
+declare class Bucket extends Construct {
+    readonly bucket: aws_cdk_lib_aws_s3.Bucket;
+    constructor(scope: Construct, id: string, props?: Bucket.Props);
+}
+/**
+ * Configuration types for {@link Bucket}.
+ *
+ * @example
+ * ```ts
+ * const props: Bucket.Props = {
+ *   access: 'public',
+ *   cors: { allowOrigins: ['https://example.com'], allowMethods: ['GET'] }
+ * }
+ * ```
+ */
+declare namespace Bucket {
+    type CorsMethod = 'GET' | 'PUT' | 'POST' | 'DELETE' | 'HEAD';
+    /** Configure the CORS settings for the bucket. */
+    interface Cors {
+        /** The HTTP headers that browsers can send in requests to the bucket. */
+        allowHeaders?: string[];
+        /** The HTTP methods that browsers can use when making requests to the bucket. @default `['GET']` */
+        allowMethods?: CorsMethod[];
+        /** The origins that are allowed to make requests to the bucket. @default `['*']` */
+        allowOrigins?: string[];
+        /** The HTTP headers in the response that browsers can access. */
+        exposeHeaders?: string[];
+        /** How long (in seconds) browsers can cache the preflight response. */
+        maxAge?: number;
+    }
+    /** A rule that defines when objects in the bucket expire. */
+    interface LifecycleRule {
+        /** A unique identifier for the rule. */
+        id?: string;
+        /** Limit the rule to objects with this key prefix. */
+        prefix?: string;
+        /** Whether the rule is active. @default `true` */
+        enabled?: boolean;
+        /**
+         * Expire objects after a duration relative to their creation date.
+         * @example '30 days'
+         */
+        expiresIn?: `${number} day` | `${number} days`;
+        /** Expire objects on a specific date (ISO 8601). */
+        expiresAt?: string;
+    }
+    /**
+     * An IAM policy condition.
+     * @see https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition.html
+     */
+    interface Condition {
+        /** The condition operator (e.g. `StringEquals`, `ArnLike`, `Bool`). */
+        test: string;
+        /** The condition key to evaluate (e.g. `aws:SecureTransport`). */
+        variable: string;
+        /** The values to compare against. */
+        values: string[];
+    }
+    /** An IAM principal that a policy statement applies to. */
+    interface Principal {
+        /** The type of principal. */
+        type: 'aws' | 'service' | 'federated' | 'canonical';
+        /** ARNs or identifiers for the principals. */
+        identifiers: string[];
+    }
+    /** A bucket policy statement that grants or denies access. */
+    interface PolicyStatement {
+        /** The S3 actions this statement applies to (e.g. `s3:GetObject`). */
+        actions: string[];
+        /** The principals this statement applies to. Use `'*'` for any principal. */
+        principals: '*' | Principal[];
+        /** Whether to allow or deny the actions. @default `'allow'` */
+        effect?: 'allow' | 'deny';
+        /** Limit the statement to specific object key paths. Defaults to the entire bucket. */
+        paths?: string[];
+        /** Additional conditions that must be met for the statement to apply. */
+        conditions?: Condition[];
+    }
+    interface Props {
+        /**
+         * Enable public read access for all files in the bucket.
+         *
+         * When set to `'public'`, a bucket policy is added that allows anyone to read objects.
+         * Public ACLs are blocked — access is granted only through bucket policy.
+         * @default `'private'`
+         */
+        access?: 'public' | 'private';
+        /**
+         * The CORS configuration for the bucket. Set to `false` to disable CORS entirely.
+         *
+         * By default, the bucket is configured to allow all headers, methods, and origins.
+         */
+        cors?: Cors | false;
+        /**
+         * Enable versioning for the bucket. When enabled, S3 stores multiple versions of each
+         * object, protecting against accidental deletion or overwriting.
+         * @default `false`
+         */
+        versioning?: boolean;
+        /**
+         * Enforce HTTPS for all requests to the bucket. Adds a deny policy for any request
+         * made over plain HTTP.
+         * @default `true`
+         */
+        enforceHttps?: boolean;
+        /** Rules that define when objects in the bucket expire. */
+        lifecycle?: LifecycleRule[];
+        /** Additional bucket policy statements. */
+        policy?: PolicyStatement[];
+        /**
+         * Transform the underlying CDK resource props. Use this to customize settings
+         * not directly exposed by this construct.
+         */
+        transform?: {
+            bucket?: (props: aws_cdk_lib_aws_s3.BucketProps) => aws_cdk_lib_aws_s3.BucketProps;
+        };
+    }
+}
+
+/**
+ * A multi-AZ VPC with public and private subnets, configurable NAT strategy, optional WireGuard VPN,
+ * and VPC Flow Logs.
+ *
+ * @example
+ * ```ts
+ * const network = new Vpc(this, 'Network', {
+ *   natGateways: 'single',
+ *   wireguard: true
+ * })
+ * ```
+ */
+declare class Vpc extends Construct {
+    readonly vpc: aws_cdk_lib_aws_ec2.Vpc;
+    readonly publicSubnets: aws_cdk_lib_aws_ec2.ISubnet[];
+    readonly privateSubnets: aws_cdk_lib_aws_ec2.ISubnet[];
+    readonly securityGroup: aws_cdk_lib_aws_ec2.SecurityGroup;
+    readonly wireguard?: aws_cdk_lib_aws_ec2.Instance;
+    readonly wireguardPublicKeyParam?: string;
+    constructor(scope: Construct, id: string, props?: Vpc.Props);
+}
+/**
+ * Configuration types for {@link Vpc}.
+ *
+ * @example
+ * ```ts
+ * const props: Vpc.Props = {
+ *   natGateways: 'ec2',
+ *   maxAzs: 2,
+ *   wireguard: true
+ * }
+ * ```
+ */
+declare namespace Vpc {
+    interface Props {
+        /**
+         * The CIDR block for the VPC.
+         *
+         * @default `"10.0.0.0/16"`
+         */
+        cidr?: string;
+        /**
+         * The number of availability zones to use.
+         *
+         * Services like RDS and Fargate require at least 2 AZs.
+         *
+         * @default `2`
+         */
+        maxAzs?: number;
+        /**
+         * How to provide NAT (outbound internet) for private subnets.
+         *
+         * - `"none"` — No NAT. Private subnets are fully isolated with no outbound internet access.
+         * - `"single"` — A single managed NAT Gateway shared across all AZs. ~$33/month.
+         * - `"onePerAz"` — One managed NAT Gateway per AZ for higher availability. ~$33/month per AZ.
+         * - `"ec2"` — A single `t4g.nano` EC2 instance running the fck-nat AMI. ~$3/month.
+         *
+         * @default `"single"`
+         */
+        natGateways?: 'none' | 'single' | 'onePerAz' | 'ec2';
+        /**
+         * Custom subnet configuration for the VPC. Overrides the default public + private subnet layout.
+         *
+         * @default A public subnet (`/24`) and a private subnet (`/24`) in each AZ.
+         */
+        subnetConfiguration?: aws_cdk_lib_aws_ec2.SubnetConfiguration[];
+        /**
+         * Enable a WireGuard VPN server in a public subnet.
+         *
+         * When enabled, a `t4g.nano` EC2 instance running WireGuard is launched with an Elastic IP.
+         * Server keys and peer config are persisted in SSM Parameter Store so they survive instance
+         * replacement. ~$3/month.
+         *
+         * @default `false`
+         */
+        wireguard?: boolean;
+        /**
+         * Enable VPC Flow Logs to CloudWatch.
+         *
+         * Pass `true` for defaults or an object to customize retention.
+         *
+         * @default `false`
+         * @example
+         * ```ts
+         * { retention: RetentionDays.ONE_WEEK }
+         * ```
+         */
+        flowLogs?: boolean | {
+            retention?: logs.RetentionDays;
+        };
+    }
+}
+
+/**
+ * An ECS cluster inside a VPC with optional Fargate capacity providers for Spot pricing.
+ *
+ * @example
+ * ```ts
+ * const cluster = new Cluster(this, 'Cluster', {
+ *   vpc: network.vpc,
+ *   enableFargateCapacityProviders: true
+ * })
+ * ```
+ */
+declare class Cluster extends Construct {
+    readonly cluster: aws_cdk_lib_aws_ecs.Cluster;
+    constructor(scope: Construct, id: string, props: Cluster.Props);
+}
+/**
+ * Configuration types for {@link Cluster}.
+ *
+ * @example
+ * ```ts
+ * const props: Cluster.Props = {
+ *   vpc: network.vpc,
+ *   enableFargateCapacityProviders: true
+ * }
+ * ```
+ */
+declare namespace Cluster {
+    interface Props {
+        /** The VPC to place the ECS cluster in. */
+        vpc: aws_cdk_lib_aws_ec2.IVpc;
+        /**
+         * Enable Fargate capacity providers (`FARGATE` and `FARGATE_SPOT`) on the cluster.
+         *
+         * When enabled, services can use Fargate Spot for non-critical workloads at up to 70% discount.
+         *
+         * @default `false`
+         */
+        enableFargateCapacityProviders?: boolean;
+        /**
+         * Transform the underlying CDK resource props. Use this to customize settings
+         * not directly exposed by this construct.
+         */
+        transform?: {
+            cluster?: (props: aws_cdk_lib_aws_ecs.ClusterProps) => aws_cdk_lib_aws_ecs.ClusterProps;
+        };
+    }
+}
+
+interface AssetBehavior {
+    pathPattern: string;
+    cachePolicy?: 'CACHING_OPTIMIZED' | 'CACHING_DISABLED' | aws_cdk_lib_aws_cloudfront.ICachePolicy;
+}
+interface FileOption {
+    files: string | string[];
+    ignore?: string | string[];
+    cacheControl?: string;
+    contentType?: string;
+}
+interface DomainProps {
+    name: string;
+    aliases?: string[];
+    certificateArn: string;
+}
+type InvalidationProps = false | {
+    paths?: string[] | 'all';
+    wait?: boolean;
+};
+
+type LogRetention = '1 day' | '3 days' | '5 days' | '1 week' | '2 weeks' | '1 month' | '3 months' | '6 months' | '1 year' | '2 years' | 'forever';
+
+/**
+ * A static site (SPA or static HTML) deployed to S3 with a CloudFront distribution,
+ * custom domain, and configurable cache control.
+ *
+ * @example
+ * ```ts
+ * new StaticSite(this, 'Website', {
+ *   path: 'dist',
+ *   domain: {
+ *     name: 'example.com',
+ *     aliases: ['www.example.com'],
+ *     certificateArn: 'arn:aws:acm:us-east-1:123456789:certificate/abc-123'
+ *   }
+ * })
+ * ```
+ */
+declare class StaticSite extends Construct {
+    readonly bucket: aws_cdk_lib_aws_s3.Bucket;
+    readonly distribution: aws_cdk_lib_aws_cloudfront.Distribution;
+    constructor(scope: Construct, id: string, props: StaticSite.Props);
+}
+/**
+ * Configuration types for {@link StaticSite}.
+ *
+ * @example
+ * ```ts
+ * const props: StaticSite.Props = {
+ *   path: 'dist',
+ *   domain: { name: 'example.com', certificateArn: '...' }
+ * }
+ * ```
+ */
+declare namespace StaticSite {
+    interface Props {
+        /**
+         * Path to the directory where the built static site assets are located.
+         *
+         * @example
+         * ```ts
+         * path: 'dist'
+         * ```
+         */
+        path: string;
+        /**
+         * The name of the index page served at the root of the site. This is a path relative
+         * to the root of the site.
+         *
+         * @default `'index.html'`
+         */
+        indexPage?: string;
+        /**
+         * The page to display on a 403 or 404 error. This is useful for single-page apps
+         * that handle routing client-side.
+         *
+         * @default The value of `indexPage`.
+         */
+        errorPage?: string;
+        /**
+         * Set a custom domain for the site. Requires an ACM certificate in `us-east-1`.
+         *
+         * @example
+         * ```ts
+         * domain: {
+         *   name: 'example.com',
+         *   aliases: ['www.example.com'],
+         *   certificateArn: 'arn:aws:acm:us-east-1:123456789:certificate/abc-123'
+         * }
+         * ```
+         */
+        domain?: DomainProps;
+        /**
+         * Configure how the static site's assets are uploaded to S3.
+         */
+        assets?: {
+            /**
+             * Specify the `Cache-Control` and `Content-Type` headers for specific files using
+             * glob patterns. Later entries override earlier ones for the same file.
+             *
+             * By default, all files are cached immutably for one year and HTML files are not cached.
+             *
+             * @example
+             * ```ts
+             * fileOptions: [
+             *   { files: '**', cacheControl: 'max-age=31536000,public,immutable' },
+             *   { files: '**\/*.html', cacheControl: 'max-age=0,no-cache,no-store,must-revalidate' }
+             * ]
+             * ```
+             */
+            fileOptions?: FileOption[];
+        };
+        /**
+         * Configure CloudFront Functions to customize HTTP request and response behavior at edge
+         * locations. These are lightweight CloudFront Functions (not Lambda\@Edge) that run on
+         * every request.
+         *
+         * @example
+         * ```ts
+         * edge: {
+         *   viewerRequest: new cloudfront.Function(this, 'RewriteFunction', {
+         *     code: cloudfront.FunctionCode.fromInline('function handler(event) { return event.request; }')
+         *   })
+         * }
+         * ```
+         */
+        edge?: {
+            /**
+             * A CloudFront function to run on every incoming viewer request before it reaches
+             * the origin. Use this to rewrite URLs, add headers, or implement authentication.
+             */
+            viewerRequest?: aws_cdk_lib_aws_cloudfront.IFunction;
+            /**
+             * A CloudFront function to run on every outgoing viewer response before it reaches
+             * the client. Use this to add security headers or modify response metadata.
+             */
+            viewerResponse?: aws_cdk_lib_aws_cloudfront.IFunction;
+        };
+        /**
+         * Configure how CloudFront cache invalidations are handled after deployment.
+         * Set to `false` to disable invalidation entirely. Pass an object to configure
+         * which paths to invalidate and whether to wait for completion.
+         *
+         * @default Invalidates all paths (`'/*'`) and waits for completion.
+         *
+         * @example
+         * Invalidate only specific paths:
+         * ```ts
+         * invalidation: {
+         *   paths: ['/index.html', '/assets/*'],
+         *   wait: true
+         * }
+         * ```
+         *
+         * @example
+         * Disable invalidation:
+         * ```ts
+         * invalidation: false
+         * ```
+         */
+        invalidation?: InvalidationProps;
+        /**
+         * Transform the underlying CDK resource props before they are created. Use this
+         * to customize any setting not directly exposed by this construct.
+         *
+         * @example
+         * ```ts
+         * transform: {
+         *   bucket: (props) => ({
+         *     ...props,
+         *     removalPolicy: RemovalPolicy.DESTROY
+         *   })
+         * }
+         * ```
+         */
+        transform?: {
+            /** Transform the S3 bucket props before the bucket is created. */
+            bucket?: (props: aws_cdk_lib_aws_s3.BucketProps) => aws_cdk_lib_aws_s3.BucketProps;
+            /** Transform the CloudFront distribution props before the distribution is created. */
+            distribution?: (props: aws_cdk_lib_aws_cloudfront.DistributionProps) => aws_cdk_lib_aws_cloudfront.DistributionProps;
+        };
+    }
+}
+
+/**
+ * A Lambda function with esbuild bundling, VPC placement, function URLs, streaming responses,
+ * concurrency controls, and IAM permissions.
+ *
+ * @example
+ * ```ts
+ * const api = new LambdaFunction(this, 'Api', {
+ *   handler: 'src/api.handler',
+ *   memory: 512,
+ *   timeout: Duration.seconds(10),
+ *   url: true
+ * })
+ * ```
+ */
+declare class LambdaFunction extends Construct {
+    readonly function: lambda.Function;
+    readonly logGroup: logs.LogGroup;
+    readonly url?: lambda.FunctionUrl;
+    readonly version?: lambda.Version;
+    readonly alias?: lambda.Alias;
+    constructor(scope: Construct, id: string, props: LambdaFunction.Props);
+}
+/**
+ * Configuration types for {@link LambdaFunction}.
+ *
+ * @example
+ * ```ts
+ * const props: LambdaFunction.Props = {
+ *   handler: 'src/api.handler',
+ *   memory: 1024,
+ *   environment: { DATABASE_URL: 'mysql://...' },
+ *   url: true
+ * }
+ * ```
+ */
+declare namespace LambdaFunction {
+    type EsbuildLoader = 'js' | 'jsx' | 'ts' | 'tsx' | 'css' | 'json' | 'text' | 'base64' | 'file' | 'dataurl' | 'binary' | 'copy' | 'default' | 'local-css' | 'global-css' | 'empty';
+    interface Props {
+        /**
+         * Path to the handler function. When bundling is used (no `code` or `bundle`), this follows
+         * SST-style notation: `path/to/file.exportName`.
+         *
+         * When using pre-built code, this is the standard Lambda handler string (e.g. `index.handler`).
+         * @example 'src/api.handler'
+         */
+        handler: string;
+        /**
+         * A pre-built Lambda `Code` asset. Use this when you've already compiled and packaged your
+         * function code. Mutually exclusive with `bundle`.
+         *
+         * Omit both `code` and `bundle` to use esbuild bundling.
+         */
+        code?: lambda.Code;
+        /**
+         * Path to a pre-built directory to deploy as-is. The directory is packaged using
+         * `Code.fromAsset`. Mutually exclusive with `code`.
+         *
+         * Omit both `code` and `bundle` to use esbuild bundling.
+         */
+        bundle?: string;
+        /**
+         * The Lambda runtime to use.
+         * @default `NODEJS_22_X`
+         */
+        runtime?: lambda.Runtime;
+        /**
+         * The CPU architecture for the function.
+         * @default `ARM_64`
+         */
+        architecture?: lambda.Architecture;
+        /**
+         * The amount of memory available to the function at runtime, in MB.
+         * @default `1024`
+         */
+        memory?: number;
+        /**
+         * The maximum time the function can run before being terminated.
+         * @default `Duration.seconds(20)`
+         */
+        timeout?: Duration;
+        /** The size of the `/tmp` directory available to the function. */
+        storage?: Size;
+        /** A human-readable description of the function. */
+        description?: string;
+        /** Lambda layers to attach to the function. */
+        layers?: lambda.ILayerVersion[];
+        /** Key-value pairs that are set as environment variables in the function. */
+        environment?: Record<string, string>;
+        /**
+         * IAM permission statements to attach to the function's execution role.
+         * @example
+         * ```ts
+         * permissions: [{ actions: ['s3:GetObject'], resources: ['arn:aws:s3:::my-bucket/*'] }]
+         * ```
+         */
+        permissions?: Array<{
+            actions: string[];
+            resources: string[];
+        }>;
+        /** ARNs of IAM managed policies to attach to the function's execution role. */
+        policies?: string[];
+        /**
+         * Place the function inside a VPC. Pass a VPC directly to use default subnet/security group
+         * selection, or pass an object for full control over subnets and security groups.
+         */
+        vpc?: aws_cdk_lib_aws_ec2.IVpc | {
+            vpc: aws_cdk_lib_aws_ec2.IVpc;
+            subnets?: aws_cdk_lib_aws_ec2.SubnetSelection;
+            securityGroups?: aws_cdk_lib_aws_ec2.ISecurityGroup[];
+        };
+        /**
+         * Configure the concurrency settings for the function.
+         *
+         * `reserved` sets the maximum number of concurrent executions.
+         * `provisioned` keeps a specified number of instances warm to avoid cold starts.
+         */
+        concurrency?: {
+            /** The maximum number of concurrent executions reserved for this function. */
+            reserved?: number;
+            /** The number of pre-initialized execution environments. Creates a version and alias. */
+            provisioned?: number;
+        };
+        /**
+         * The number of retry attempts for asynchronous invocations (0–2).
+         * @default Uses the Lambda service default (2).
+         */
+        retries?: number;
+        /**
+         * Enable response streaming for the function. Requires `url` to be enabled.
+         * @default `false`
+         */
+        streaming?: boolean;
+        /**
+         * Publish a new version on each deployment. Automatically enabled when
+         * `concurrency.provisioned` is set.
+         * @default `false`
+         */
+        versioning?: boolean;
+        /**
+         * Create a function URL for direct HTTP(S) invocation. Set to `true` for public access
+         * with no auth, or pass an object to configure authorization and CORS.
+         * @default No function URL is created.
+         */
+        url?: boolean | {
+            /** The authorization type for the function URL. @default `'none'` */
+            authorization?: 'none' | 'iam';
+            /** CORS configuration. Set to `true` to allow all origins and methods. */
+            cors?: lambda.FunctionUrlCorsOptions | true;
+        };
+        /** Configure CloudWatch logging for the function. */
+        logging?: {
+            /**
+             * How long to retain log events.
+             * @default `'1 month'`
+             */
+            retention?: LogRetention;
+            /**
+             * The log format for the function.
+             * @default `'text'`
+             */
+            format?: 'text' | 'json';
+        };
+        /** Key-value pairs to tag the function and its resources. */
+        tags?: Record<string, string>;
+        /** Configure esbuild bundling options. Only applies when using bundling mode (no `code` or `bundle`). */
+        nodejs?: {
+            /** Minify the bundled output. @default `true` */
+            minify?: boolean;
+            /** Generate source maps. @default `false` */
+            sourceMap?: boolean;
+            /** The output format for the bundle. @default `ESM` */
+            format?: lambdaNode.OutputFormat;
+            /** A string to prepend to the bundled output. Defaults to ESM compatibility shims when format is ESM. */
+            banner?: string;
+            /** NPM packages to install (not bundle) into `node_modules` in the output. */
+            install?: string[];
+            /**
+             * NPM packages to exclude from the bundle (mark as external).
+             * @default `['@aws-sdk/*']`
+             */
+            exclude?: string[];
+            /** Custom esbuild loaders keyed by file extension (e.g. `{ '.png': 'file' }`). */
+            loader?: Record<string, EsbuildLoader>;
+            /** Additional esbuild flags passed as key-value pairs. */
+            esbuild?: Record<string, string | boolean>;
+            /** Files to copy into the output directory after bundling. */
+            copyFiles?: Array<{
+                /** Source path to copy from. */
+                from: string;
+                /** Destination path in the output directory. Defaults to `from`. */
+                to?: string;
+            }>;
+        };
+        /** Hooks into the build lifecycle. */
+        hook?: {
+            /**
+             * Runs after bundling completes. Return an array of shell commands to execute.
+             * @param outputDir The path to the bundled output directory.
+             */
+            postBuild?: (outputDir: string) => string[];
+        };
+        /**
+         * Transform the underlying CDK resource props. Use this to customize settings
+         * not directly exposed by this construct.
+         */
+        transform?: {
+            /** Transform the Lambda function props before the function is created. */
+            function?: (props: lambdaNode.NodejsFunctionProps | lambda.FunctionProps) => lambdaNode.NodejsFunctionProps | lambda.FunctionProps;
+            /** Transform the CloudWatch log group props before the log group is created. */
+            logGroup?: (props: logs.LogGroupProps) => logs.LogGroupProps;
+        };
+    }
+}
+
+declare namespace SsrSiteLambda {
+    interface Props {
+        streaming?: boolean;
+        environment?: Record<string, string>;
+        vpc?: aws_cdk_lib_aws_ec2.IVpc | {
+            vpc: aws_cdk_lib_aws_ec2.IVpc;
+            subnets?: aws_cdk_lib_aws_ec2.SubnetSelection;
+            securityGroups?: aws_cdk_lib_aws_ec2.ISecurityGroup[];
+        };
+        permissions?: Array<{
+            actions: string[];
+            resources: string[];
+        }>;
+        server: {
+            path?: string;
+            code?: lambda.Code;
+            handler?: string;
+            runtime?: lambda.Runtime;
+            memory?: number;
+            timeout?: aws_cdk_lib.Duration;
+            architecture?: lambda.Architecture;
+            layers?: lambda.ILayerVersion[];
+            nodejs?: LambdaFunction.Props['nodejs'];
+        };
+        assets?: {
+            path?: string;
+            prefix?: string;
+            behaviors?: AssetBehavior[];
+            fileOptions?: FileOption[];
+        };
+        domain?: DomainProps;
+        edge?: {
+            viewerRequest?: aws_cdk_lib_aws_cloudfront.IFunction;
+            viewerResponse?: aws_cdk_lib_aws_cloudfront.IFunction;
+        };
+        invalidation?: InvalidationProps;
+        transform?: {
+            lambda?: (props: lambdaNode.NodejsFunctionProps) => lambdaNode.NodejsFunctionProps;
+            bucket?: (props: aws_cdk_lib_aws_s3.BucketProps) => aws_cdk_lib_aws_s3.BucketProps;
+            distribution?: (props: aws_cdk_lib_aws_cloudfront.DistributionProps) => aws_cdk_lib_aws_cloudfront.DistributionProps;
+        };
+    }
+    interface Resources {
+        lambda: lambda.Function;
+        functionUrl: lambda.FunctionUrl;
+        bucket: aws_cdk_lib_aws_s3.Bucket;
+        distribution: aws_cdk_lib_aws_cloudfront.Distribution;
+    }
+}
+
+/**
+ * A full-stack React Router SSR application on Lambda with CloudFront and S3 static assets.
+ * Automatically generates a Lambda handler that bridges React Router's `createRequestHandler`
+ * to Lambda function URL events, with support for streaming and buffered responses.
+ *
+ * Run `react-router build` before deploying — the construct reads the build output at synth time.
+ *
+ * @example
+ * ```ts
+ * new ReactRouterSsrSiteLambda(this, 'App', {
+ *   domain: {
+ *     name: 'app.example.com',
+ *     certificateArn: 'arn:aws:acm:us-east-1:123456789:certificate/abc-123'
+ *   },
+ *   environment: { DATABASE_URL: 'mysql://...' }
+ * })
+ * ```
+ */
+declare class ReactRouterSsrSiteLambda extends Construct {
+    readonly lambda: lambda.Function;
+    readonly functionUrl: lambda.FunctionUrl;
+    readonly bucket: aws_cdk_lib_aws_s3.Bucket;
+    readonly distribution: aws_cdk_lib_aws_cloudfront.Distribution;
+    constructor(scope: Construct, id: string, props: ReactRouterSsrSiteLambda.Props);
+}
+/**
+ * Configuration types for {@link ReactRouterSsrSiteLambda}.
+ *
+ * @example
+ * ```ts
+ * const props: ReactRouterSsrSiteLambda.Props = {
+ *   path: '.',
+ *   server: { mode: 'streaming', memory: 1024 },
+ *   domain: { name: 'app.example.com', certificateArn: '...' }
+ * }
+ * ```
+ */
+declare namespace ReactRouterSsrSiteLambda {
+    interface Props {
+        /**
+         * Path to the directory where your React Router app is located, relative to the CDK app root.
+         *
+         * @default "."
+         */
+        path?: string;
+        /**
+         * The directory where the build output is located. Should match the `buildDirectory` in your
+         * React Router config.
+         *
+         * @default "build"
+         */
+        buildDirectory?: string;
+        /**
+         * Environment variables to set on the server Lambda function. These are loaded into
+         * `process.env` at runtime.
+         *
+         * @example
+         * ```ts
+         * environment: {
+         *   DATABASE_URL: 'mysql://...',
+         *   STRIPE_SECRET_KEY: stripeSecret.value
+         * }
+         * ```
+         */
+        environment?: Record<string, string>;
+        /**
+         * Configure the server function to connect to a VPC. This allows your React Router app
+         * to access private resources like RDS databases or ElastiCache clusters.
+         */
+        vpc?: SsrSiteLambda.Props['vpc'];
+        /**
+         * IAM permissions that the server function needs to access other AWS resources.
+         *
+         * @example
+         * ```ts
+         * permissions: [
+         *   { actions: ['s3:GetObject'], resources: ['arn:aws:s3:::my-bucket/*'] }
+         * ]
+         * ```
+         */
+        permissions?: SsrSiteLambda.Props['permissions'];
+        server?: {
+            /**
+             * Whether the Lambda function uses streaming or buffered responses. Streaming delivers
+             * chunks to the client as they're generated, improving Time to First Byte (TTFB).
+             *
+             * @default "streaming"
+             */
+            mode?: 'streaming' | 'buffered';
+            /**
+             * The Lambda runtime to use for the server function.
+             *
+             * @default lambda.Runtime.NODEJS_22_X
+             */
+            runtime?: lambda.Runtime;
+            /**
+             * The amount of memory in MB allocated to the server function.
+             * Takes values between 128 and 10240.
+             *
+             * @default 1024
+             */
+            memory?: number;
+            /**
+             * The maximum amount of time the server function can run before timing out.
+             *
+             * @default Duration.seconds(30)
+             */
+            timeout?: aws_cdk_lib.Duration;
+            /**
+             * The processor architecture of the server function.
+             *
+             * @default lambda.Architecture.ARM_64
+             */
+            architecture?: lambda.Architecture;
+            /**
+             * A list of Lambda layer ARNs to add to the server function.
+             */
+            layers?: lambda.ILayerVersion[];
+            /**
+             * Dependencies that need to be installed into the Lambda package instead of being bundled.
+             * Certain npm packages cannot be bundled using esbuild — native modules, for example.
+             */
+            install?: string[];
+            /**
+             * Additional packages to exclude from the server bundle. `@aws-sdk/*` is always excluded.
+             */
+            external?: string[];
+        };
+        assets?: {
+            /**
+             * Path to the directory containing the client assets.
+             *
+             * @default "{buildDirectory}/client"
+             */
+            path?: string;
+            /**
+             * An optional prefix (subfolder) for the assets inside the S3 bucket.
+             */
+            prefix?: string;
+            /**
+             * CloudFront cache behaviors for static assets. Each entry maps a path pattern to
+             * a cache policy.
+             *
+             * @default [{ pathPattern: '/assets/*', cachePolicy: 'CACHING_OPTIMIZED' }]
+             */
+            behaviors?: AssetBehavior[];
+            /**
+             * Configure the `Cache-Control` header for specific files using glob patterns.
+             *
+             * @default [{ files: '**', cacheControl: 'max-age=31536000,public,immutable' }]
+             */
+            fileOptions?: FileOption[];
+        };
+        /**
+         * Set a custom domain for your React Router app. Automatically sets up the CloudFront
+         * distribution with the provided domain name and certificate.
+         */
+        domain?: SsrSiteLambda.Props['domain'];
+        /**
+         * CloudFront Functions to run on viewer request and viewer response events. A default
+         * viewer request function that handles trailing-slash removal and `x-forwarded-host`
+         * is used when not provided.
+         */
+        edge?: SsrSiteLambda.Props['edge'];
+        /**
+         * Configure CloudFront cache invalidation after deployment.
+         */
+        invalidation?: SsrSiteLambda.Props['invalidation'];
+        /**
+         * Transform the underlying CDK resources. Use these callbacks to customize the Lambda
+         * function, S3 bucket, or CloudFront distribution props before they are created.
+         */
+        transform?: SsrSiteLambda.Props['transform'];
+    }
+}
+
+/**
+ * A Fargate service with task definition, containers, optional ALB, auto-scaling, Spot capacity,
+ * and IAM permissions. Supports multi-container sidecars and conditional ALB routing rules.
+ *
+ * @example
+ * ```ts
+ * new EcsFargateService(this, 'Api', {
+ *   cluster: cluster.cluster,
+ *   cpu: 512,
+ *   memoryLimitMiB: 1024,
+ *   containers: [{ port: 3000, environment: { NODE_ENV: 'production' } }],
+ *   loadBalancer: {
+ *     domain: { name: 'api.example.com', certificateArn: '...' }
+ *   },
+ *   scaling: { min: 2, max: 10, cpuTarget: 70 }
+ * })
+ * ```
+ */
+declare class EcsFargateService extends Construct {
+    readonly service: aws_cdk_lib_aws_ecs.FargateService;
+    readonly taskDefinition: aws_cdk_lib_aws_ecs.FargateTaskDefinition;
+    readonly containers: Record<string, aws_cdk_lib_aws_ecs.ContainerDefinition>;
+    readonly logGroups: Record<string, logs.LogGroup>;
+    readonly securityGroup: aws_cdk_lib_aws_ec2.SecurityGroup;
+    readonly alb?: aws_cdk_lib_aws_elasticloadbalancingv2.ApplicationLoadBalancer;
+    readonly listener?: aws_cdk_lib_aws_elasticloadbalancingv2.ApplicationListener;
+    readonly targetGroups?: Record<string, aws_cdk_lib_aws_elasticloadbalancingv2.ApplicationTargetGroup>;
+    constructor(scope: Construct, id: string, props: EcsFargateService.Props);
+}
+/**
+ * Configuration types for {@link EcsFargateService}.
+ *
+ * @example
+ * ```ts
+ * const props: EcsFargateService.Props = {
+ *   cluster: cluster.cluster,
+ *   containers: [{ port: 3000 }],
+ *   loadBalancer: { domain: { name: 'api.example.com', certificateArn: '...' } },
+ *   scaling: { min: 1, max: 4 }
+ * }
+ * ```
+ */
+declare namespace EcsFargateService {
+    type LogRetention = LogRetention;
+    interface ImageBuildProps {
+        /**
+         * The path to the Docker build context directory.
+         * @default `"."`
+         */
+        context?: string;
+        /**
+         * The path to the Dockerfile, relative to the build context.
+         * @default `"Dockerfile"`
+         */
+        dockerfile?: string;
+        /** Key-value pairs passed as Docker build arguments. */
+        args?: Record<string, string>;
+        /** The target stage to build in a multi-stage Dockerfile. */
+        target?: string;
+        /** Glob patterns for files to exclude from the Docker build context. */
+        exclude?: string[];
+    }
+    interface ContainerProps {
+        /**
+         * The name of the container. Required when multiple containers are defined.
+         * Automatically set to `"Container"` for single-container services.
+         */
+        name?: string;
+        /**
+         * The container image to use. Accepts a registry image name, Docker build options, or a
+         * pre-built `DockerImageAsset`.
+         *
+         * @default Builds from a Dockerfile in the current directory.
+         * @example
+         * // Use a pre-built image from a registry
+         * { image: "nginx:latest" }
+         * @example
+         * // Build from a custom Dockerfile
+         * { image: { context: "./app", dockerfile: "Dockerfile.prod" } }
+         */
+        image?: string | ImageBuildProps | aws_cdk_lib_aws_ecr_assets.DockerImageAsset;
+        /** The port the container listens on. Used for load balancer target group routing. */
+        port?: number;
+        /** CPU units allocated to this container. When set, reserves a fixed share of the task's total CPU. */
+        cpu?: number;
+        /** Hard memory limit in MiB for this container. The container is killed if it exceeds this. */
+        memory?: number;
+        /** Override the container's default command. */
+        command?: string[];
+        /** Override the container's default entrypoint. */
+        entrypoint?: string[];
+        /** Key-value pairs set as environment variables on the container. */
+        environment?: Record<string, string>;
+        /**
+         * Map of environment variable names to SSM Parameter Store parameter names or Secrets Manager ARNs.
+         * Values starting with `arn:aws:secretsmanager:` are resolved as Secrets Manager secrets;
+         * all others are resolved as SSM SecureString parameters.
+         *
+         * @example
+         * { ssm: { DATABASE_URL: "arn:aws:secretsmanager:us-east-1:123456789:secret:db-url" } }
+         */
+        ssm?: Record<string, string>;
+        /** Pre-built ECS `Secret` objects to inject as environment variables. Merged with `ssm` entries. */
+        secrets?: Record<string, aws_cdk_lib_aws_ecs.Secret>;
+        /** ECS-managed container health check configuration. */
+        health?: {
+            /** The command to run to check health. Must start with `CMD` or `CMD-SHELL`. */
+            command: string[];
+            /**
+             * Seconds between health checks.
+             * @default 30
+             */
+            interval?: number;
+            /**
+             * Seconds before a health check is considered failed.
+             * @default 5
+             */
+            timeout?: number;
+            /**
+             * Consecutive failures required to mark the container unhealthy.
+             * @default 3
+             */
+            retries?: number;
+            /**
+             * Grace period in seconds before health check failures count.
+             * @default 0
+             */
+            startPeriod?: number;
+        };
+        /** CloudWatch logging configuration. */
+        logging?: {
+            /**
+             * How long to retain CloudWatch logs.
+             * @default `"1 month"`
+             */
+            retention?: LogRetention;
+        };
+    }
+    /**
+     * Defines how the ALB routes traffic. Each rule maps a listener port/protocol to either a
+     * target container or a redirect destination.
+     */
+    interface RoutingRule {
+        /** When set, the rule only applies to requests matching these conditions. Rules without conditions become the default action for their listener. */
+        conditions?: {
+            /** URL path pattern to match (e.g. `"/api/*"`). */
+            path?: string;
+            /** Match requests containing a specific HTTP header with one of the given values. */
+            header?: {
+                name: string;
+                values: string[];
+            };
+            /** Match requests with specific query string key-value pairs. */
+            query?: Array<{
+                key: string;
+                value: string;
+            }>;
+        };
+        /** The name of the container to forward traffic to. Defaults to the single container when only one is defined. */
+        container?: string;
+        /** The port to forward traffic to on the container. Defaults to the container's `port`. */
+        forward?: number;
+        /**
+         * The port and protocol to listen on, formatted as `"port/protocol"`.
+         * @example `"443/https"`, `"80/http"`
+         */
+        listen: string;
+        /**
+         * Redirect to this port/protocol instead of forwarding. Formatted as `"port/protocol"`.
+         * @example `"443/https"` — redirects HTTP to HTTPS.
+         */
+        redirect?: string;
+    }
+    interface Props {
+        /**
+         * The CPU architecture for the Fargate task.
+         * @default `"X86_64"`
+         */
+        architecture?: 'X86_64' | 'ARM64';
+        /**
+         * The Fargate capacity provider strategy. Set to `"spot"` for 100% Spot pricing (~50% discount),
+         * or provide a mix of regular Fargate and Spot with weights and base counts.
+         *
+         * @default Regular Fargate (on-demand).
+         * @example
+         * // 100% Spot
+         * { capacity: "spot" }
+         * @example
+         * // Mixed: 1 on-demand base + Spot for burst
+         * { capacity: { fargate: { weight: 1, base: 1 }, spot: { weight: 3 } } }
+         */
+        capacity?: 'spot' | {
+            fargate?: {
+                weight: number;
+                base?: number;
+            };
+            spot?: {
+                weight: number;
+                base?: number;
+            };
+        };
+        /** The ECS cluster to deploy the service into. */
+        cluster: aws_cdk_lib_aws_ecs.ICluster;
+        /**
+         * The total CPU units for the Fargate task. Must be a
+         * [valid Fargate CPU value](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_definition_parameters.html#task_size).
+         * @default 256
+         */
+        cpu?: number;
+        /**
+         * The total memory (in MiB) for the Fargate task. Must be a valid value for the chosen CPU size.
+         * @default 512
+         */
+        memoryLimitMiB?: number;
+        /**
+         * One or more containers to run in the task. At least one container is required.
+         * Use multiple containers for sidecar patterns (e.g. log routers, proxies).
+         */
+        containers: ContainerProps[];
+        /**
+         * Creates an Application Load Balancer in front of the service. When omitted, no ALB is created
+         * and the service is only reachable within the VPC.
+         */
+        loadBalancer?: {
+            /**
+             * Whether the ALB is internet-facing.
+             * @default true
+             */
+            public?: boolean;
+            /** Custom domain and TLS configuration. When set, HTTPS listeners and HTTP-to-HTTPS redirects are auto-configured. */
+            domain?: {
+                /** The primary domain name (e.g. `"api.example.com"`). */
+                name: string;
+                /** Additional domain aliases for the same certificate. */
+                aliases?: string[];
+                /** The ARN of an ACM certificate covering the domain and aliases. */
+                certificateArn: string;
+            };
+            /** ALB target group health check settings. */
+            health?: {
+                /**
+                 * The HTTP path to check.
+                 * @default `"/health"`
+                 */
+                path?: string;
+                /** Seconds between health checks. */
+                interval?: number;
+                /** Seconds before a health check is considered timed out. */
+                timeout?: number;
+                /** Consecutive successes required to mark a target healthy. */
+                healthyThreshold?: number;
+                /** Consecutive failures required to mark a target unhealthy. */
+                unhealthyThreshold?: number;
+                /** HTTP response codes that indicate a healthy target (e.g. `"200"`, `"200-299"`). */
+                successCodes?: string;
+            };
+            /**
+             * Explicit routing rules for the ALB. When omitted, rules are auto-generated: a single
+             * port-80 listener for HTTP, or port-443 HTTPS + port-80 redirect when `domain` is set.
+             */
+            rules?: RoutingRule[];
+        };
+        /** Auto scaling configuration for the service. */
+        scaling?: {
+            /**
+             * Minimum number of tasks.
+             * @default 1
+             */
+            min?: number;
+            /**
+             * Maximum number of tasks.
+             * @default 4
+             */
+            max?: number;
+            /**
+             * Target average CPU utilization percentage to trigger scaling.
+             * @default 70
+             */
+            cpuTarget?: number;
+            /** Target average memory utilization percentage. When set, enables memory-based scaling. */
+            memoryTarget?: number;
+            /** Target requests per task. When set, enables request-count-based scaling (requires a load balancer). */
+            requestsPerTarget?: number;
+            /** Seconds to wait after a scale-in before another scale-in can occur. */
+            scaleInCooldown?: number;
+            /** Seconds to wait after a scale-out before another scale-out can occur. */
+            scaleOutCooldown?: number;
+        };
+        /**
+         * IAM permissions granted to the task role. Each entry becomes an IAM policy statement.
+         *
+         * @example
+         * {
+         *   permissions: [{
+         *     actions: ["s3:GetObject", "s3:PutObject"],
+         *     resources: ["arn:aws:s3:::my-bucket/*"]
+         *   }]
+         * }
+         */
+        permissions?: Array<{
+            /** IAM actions to allow or deny (e.g. `"s3:GetObject"`). */
+            actions: string[];
+            /** Resource ARNs the policy applies to. Use `"*"` for all resources. */
+            resources: string[];
+            /**
+             * Whether to allow or deny the actions.
+             * @default `"allow"`
+             */
+            effect?: 'allow' | 'deny';
+            /** IAM condition operators to restrict when the policy applies. */
+            conditions?: Record<string, Record<string, string>>;
+        }>;
+        /**
+         * Callbacks to customize the underlying CDK resources before they are created.
+         * Each function receives the default props and returns modified props.
+         */
+        transform?: {
+            /** Customize the ECS task execution role. */
+            executionRole?: (props: aws_cdk_lib_aws_iam.RoleProps) => aws_cdk_lib_aws_iam.RoleProps;
+            /** Customize the ECS task role (the role your application code assumes). */
+            taskRole?: (props: aws_cdk_lib_aws_iam.RoleProps) => aws_cdk_lib_aws_iam.RoleProps;
+            /** Customize the Fargate task definition. */
+            taskDefinition?: (props: aws_cdk_lib_aws_ecs.FargateTaskDefinitionProps) => aws_cdk_lib_aws_ecs.FargateTaskDefinitionProps;
+            /** Customize container definition options. Called once per container. */
+            container?: (props: aws_cdk_lib_aws_ecs.ContainerDefinitionOptions) => aws_cdk_lib_aws_ecs.ContainerDefinitionOptions;
+            /** Customize the Fargate service. */
+            service?: (props: aws_cdk_lib_aws_ecs.FargateServiceProps) => aws_cdk_lib_aws_ecs.FargateServiceProps;
+            /** Customize auto scaling min/max capacity. */
+            autoScalingTarget?: (props: {
+                minCapacity: number;
+                maxCapacity: number;
+            }) => {
+                minCapacity: number;
+                maxCapacity: number;
+            };
+            /** Customize the Application Load Balancer. */
+            alb?: (props: aws_cdk_lib_aws_elasticloadbalancingv2.ApplicationLoadBalancerProps) => aws_cdk_lib_aws_elasticloadbalancingv2.ApplicationLoadBalancerProps;
+            /** Customize the ALB security group. */
+            albSecurityGroup?: (props: aws_cdk_lib_aws_ec2.SecurityGroupProps) => aws_cdk_lib_aws_ec2.SecurityGroupProps;
+            /** Customize ALB listener props. Called once per listener. */
+            listener?: (props: aws_cdk_lib_aws_elasticloadbalancingv2.BaseApplicationListenerProps) => aws_cdk_lib_aws_elasticloadbalancingv2.BaseApplicationListenerProps;
+            /** Customize ALB target group props. Called once per target group. */
+            targetGroup?: (props: aws_cdk_lib_aws_elasticloadbalancingv2.ApplicationTargetGroupProps) => aws_cdk_lib_aws_elasticloadbalancingv2.ApplicationTargetGroupProps;
+            /** Customize CloudWatch log group props. Called once per container. */
+            logGroup?: (props: logs.LogGroupProps) => logs.LogGroupProps;
+        };
+    }
+}
+
+declare namespace SsrSiteEcsService {
+    interface Props {
+        cluster: aws_cdk_lib_aws_ecs.ICluster;
+        image?: string | EcsFargateService.ImageBuildProps | aws_cdk_lib_aws_ecr_assets.DockerImageAsset;
+        port?: number;
+        command?: string[];
+        entrypoint?: string[];
+        environment?: Record<string, string>;
+        ssm?: Record<string, string>;
+        secrets?: Record<string, aws_cdk_lib_aws_ecs.Secret>;
+        architecture?: 'X86_64' | 'ARM64';
+        cpu?: number;
+        memoryLimitMiB?: number;
+        capacity?: EcsFargateService.Props['capacity'];
+        healthCheck?: {
+            path?: string;
+            interval?: number;
+            timeout?: number;
+            healthyThreshold?: number;
+            unhealthyThreshold?: number;
+            successCodes?: string;
+        };
+        scaling?: {
+            min?: number;
+            max?: number;
+            cpuTarget?: number;
+            memoryTarget?: number;
+            requestsPerTarget?: number;
+            scaleInCooldown?: number;
+            scaleOutCooldown?: number;
+        };
+        permissions?: Array<{
+            actions: string[];
+            resources: string[];
+            effect?: 'allow' | 'deny';
+            conditions?: Record<string, Record<string, string>>;
+        }>;
+        assets?: {
+            path?: string;
+            prefix?: string;
+            behaviors?: AssetBehavior[];
+            fileOptions?: FileOption[];
+        };
+        domain?: DomainProps;
+        edge?: {
+            viewerRequest?: aws_cdk_lib_aws_cloudfront.IFunction;
+            viewerResponse?: aws_cdk_lib_aws_cloudfront.IFunction;
+        };
+        invalidation?: InvalidationProps;
+        transform?: {
+            bucket?: (props: aws_cdk_lib_aws_s3.BucketProps) => aws_cdk_lib_aws_s3.BucketProps;
+            distribution?: (props: aws_cdk_lib_aws_cloudfront.DistributionProps) => aws_cdk_lib_aws_cloudfront.DistributionProps;
+            executionRole?: (props: aws_cdk_lib_aws_iam.RoleProps) => aws_cdk_lib_aws_iam.RoleProps;
+            taskRole?: (props: aws_cdk_lib_aws_iam.RoleProps) => aws_cdk_lib_aws_iam.RoleProps;
+            taskDefinition?: (props: aws_cdk_lib_aws_ecs.FargateTaskDefinitionProps) => aws_cdk_lib_aws_ecs.FargateTaskDefinitionProps;
+            container?: (props: aws_cdk_lib_aws_ecs.ContainerDefinitionOptions) => aws_cdk_lib_aws_ecs.ContainerDefinitionOptions;
+            service?: (props: aws_cdk_lib_aws_ecs.FargateServiceProps) => aws_cdk_lib_aws_ecs.FargateServiceProps;
+            autoScalingTarget?: (props: {
+                minCapacity: number;
+                maxCapacity: number;
+            }) => {
+                minCapacity: number;
+                maxCapacity: number;
+            };
+            alb?: (props: aws_cdk_lib_aws_elasticloadbalancingv2.ApplicationLoadBalancerProps) => aws_cdk_lib_aws_elasticloadbalancingv2.ApplicationLoadBalancerProps;
+            albSecurityGroup?: (props: aws_cdk_lib_aws_ec2.SecurityGroupProps) => aws_cdk_lib_aws_ec2.SecurityGroupProps;
+            listener?: (props: aws_cdk_lib_aws_elasticloadbalancingv2.BaseApplicationListenerProps) => aws_cdk_lib_aws_elasticloadbalancingv2.BaseApplicationListenerProps;
+            targetGroup?: (props: aws_cdk_lib_aws_elasticloadbalancingv2.ApplicationTargetGroupProps) => aws_cdk_lib_aws_elasticloadbalancingv2.ApplicationTargetGroupProps;
+            logGroup?: (props: logs.LogGroupProps) => logs.LogGroupProps;
+        };
+    }
+    interface Resources {
+        bucket: aws_cdk_lib_aws_s3.Bucket;
+        distribution: aws_cdk_lib_aws_cloudfront.Distribution;
+        ecsService: EcsFargateService;
+    }
+}
+
+/**
+ * A full-stack React Router SSR application on ECS Fargate with an ALB, CloudFront, and S3
+ * static assets. Auto-generates a Dockerfile when none is provided.
+ *
+ * Run `react-router build` before deploying — the construct reads the build output at synth time.
+ *
+ * @example
+ * ```ts
+ * new ReactRouterSsrSiteEcsFargateService(this, 'App', {
+ *   cluster: cluster.cluster,
+ *   cpu: 512,
+ *   memoryLimitMiB: 1024,
+ *   domain: {
+ *     name: 'app.example.com',
+ *     certificateArn: 'arn:aws:acm:us-east-1:123456789:certificate/abc-123'
+ *   }
+ * })
+ * ```
+ */
+declare class ReactRouterSsrSiteEcsFargateService extends Construct {
+    readonly bucket: aws_cdk_lib_aws_s3.Bucket;
+    readonly distribution: aws_cdk_lib_aws_cloudfront.Distribution;
+    readonly ecsService: EcsFargateService;
+    constructor(scope: Construct, id: string, props: ReactRouterSsrSiteEcsFargateService.Props);
+}
+/**
+ * Configuration types for {@link ReactRouterSsrSiteEcsFargateService}.
+ *
+ * @example
+ * ```ts
+ * const props: ReactRouterSsrSiteEcsFargateService.Props = {
+ *   cluster: cluster.cluster,
+ *   cpu: 1024,
+ *   memoryLimitMiB: 2048,
+ *   domain: { name: 'app.example.com', certificateArn: '...' }
+ * }
+ * ```
+ */
+declare namespace ReactRouterSsrSiteEcsFargateService {
+    interface Props {
+        /**
+         * Path to the directory where your React Router app is located, relative to the CDK app root.
+         *
+         * @default "."
+         */
+        path?: string;
+        /**
+         * The directory where the build output is located. Should match the `buildDirectory` in your
+         * React Router config.
+         *
+         * @default "build"
+         */
+        buildDirectory?: string;
+        /** The ECS cluster to deploy the service into. */
+        cluster: aws_cdk_lib_aws_ecs.ICluster;
+        /**
+         * The container image to use. Accepts a registry image name, Docker build options, or a
+         * pre-built `DockerImageAsset`. When omitted, a Dockerfile is auto-generated that serves
+         * the React Router build output.
+         *
+         * @example
+         * ```ts
+         * // Use a pre-built image from a registry
+         * { image: "my-app:latest" }
+         * ```
+         * @example
+         * ```ts
+         * // Build from a custom Dockerfile
+         * { image: { context: "./app", dockerfile: "Dockerfile.prod" } }
+         * ```
+         */
+        image?: string | EcsFargateService.ImageBuildProps | aws_cdk_lib_aws_ecr_assets.DockerImageAsset;
+        /**
+         * The port the container listens on.
+         *
+         * @default 3000
+         */
+        port?: number;
+        /** Override the container's default command. */
+        command?: string[];
+        /** Override the container's default entrypoint. */
+        entrypoint?: string[];
+        /**
+         * Environment variables to set on the container. These are loaded into
+         * `process.env` at runtime.
+         *
+         * @example
+         * ```ts
+         * environment: {
+         *   DATABASE_URL: 'mysql://...',
+         *   STRIPE_SECRET_KEY: stripeSecret.value
+         * }
+         * ```
+         */
+        environment?: Record<string, string>;
+        /**
+         * Map of environment variable names to SSM Parameter Store parameter names or Secrets Manager ARNs.
+         * Values starting with `arn:aws:secretsmanager:` are resolved as Secrets Manager secrets;
+         * all others are resolved as SSM SecureString parameters.
+         *
+         * @example
+         * ```ts
+         * { ssm: { DATABASE_URL: "arn:aws:secretsmanager:us-east-1:123456789:secret:db-url" } }
+         * ```
+         */
+        ssm?: Record<string, string>;
+        /** Pre-built ECS `Secret` objects to inject as environment variables. Merged with `ssm` entries. */
+        secrets?: Record<string, aws_cdk_lib_aws_ecs.Secret>;
+        /**
+         * The CPU architecture for the Fargate task.
+         *
+         * @default "X86_64"
+         */
+        architecture?: 'X86_64' | 'ARM64';
+        /**
+         * The total CPU units for the Fargate task. Must be a
+         * [valid Fargate CPU value](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_definition_parameters.html#task_size).
+         *
+         * @default 256
+         */
+        cpu?: number;
+        /**
+         * The total memory (in MiB) for the Fargate task. Must be a valid value for the chosen CPU size.
+         *
+         * @default 512
+         */
+        memoryLimitMiB?: number;
+        /**
+         * The Fargate capacity provider strategy. Set to `"spot"` for 100% Spot pricing (~50% discount),
+         * or provide a mix of regular Fargate and Spot with weights and base counts.
+         *
+         * @default Regular Fargate (on-demand).
+         */
+        capacity?: SsrSiteEcsService.Props['capacity'];
+        /** ALB target group health check settings. */
+        healthCheck?: SsrSiteEcsService.Props['healthCheck'];
+        /** Auto scaling configuration for the service. */
+        scaling?: SsrSiteEcsService.Props['scaling'];
+        /**
+         * IAM permissions granted to the task role. Each entry becomes an IAM policy statement.
+         *
+         * @example
+         * ```ts
+         * permissions: [
+         *   { actions: ['s3:GetObject'], resources: ['arn:aws:s3:::my-bucket/*'] }
+         * ]
+         * ```
+         */
+        permissions?: SsrSiteEcsService.Props['permissions'];
+        assets?: {
+            /**
+             * Path to the directory containing the client assets.
+             *
+             * @default "{buildDirectory}/client"
+             */
+            path?: string;
+            /** An optional prefix (subfolder) for the assets inside the S3 bucket. */
+            prefix?: string;
+            /**
+             * CloudFront cache behaviors for static assets. Each entry maps a path pattern to
+             * a cache policy.
+             *
+             * @default [{ pathPattern: '/assets/*', cachePolicy: 'CACHING_OPTIMIZED' }]
+             */
+            behaviors?: AssetBehavior[];
+            /**
+             * Configure the `Cache-Control` header for specific files using glob patterns.
+             *
+             * @default [{ files: '**', cacheControl: 'max-age=31536000,public,immutable' }]
+             */
+            fileOptions?: FileOption[];
+        };
+        /**
+         * Set a custom domain for your React Router app. Automatically sets up the CloudFront
+         * distribution with the provided domain name and certificate.
+         */
+        domain?: SsrSiteEcsService.Props['domain'];
+        /**
+         * CloudFront Functions to run on viewer request and viewer response events. A default
+         * viewer request function that handles trailing-slash removal and `x-forwarded-host`
+         * is used when not provided.
+         */
+        edge?: SsrSiteEcsService.Props['edge'];
+        /** Configure CloudFront cache invalidation after deployment. */
+        invalidation?: SsrSiteEcsService.Props['invalidation'];
+        /**
+         * Callbacks to customize the underlying CDK resources before they are created.
+         * Each function receives the default props and returns modified props.
+         */
+        transform?: SsrSiteEcsService.Props['transform'];
+    }
+}
+
+/**
+ * Builds a Docker image for a React Router app and pushes it to ECR. Auto-generates a
+ * Dockerfile when none is provided. Use this to pre-build an image that can be shared
+ * across multiple ECS services.
+ *
+ * Run `react-router build` before deploying — the construct reads the build output at synth time.
+ *
+ * @example
+ * ```ts
+ * const image = new ReactRouterEcrImage(this, 'AppImage', {
+ *   path: './packages/web',
+ *   architecture: 'ARM64'
+ * })
+ * ```
+ */
+declare class ReactRouterEcrImage extends Construct {
+    readonly asset: aws_cdk_lib_aws_ecr_assets.DockerImageAsset;
+    constructor(scope: Construct, id: string, props?: ReactRouterEcrImage.Props);
+}
+/**
+ * Configuration types for {@link ReactRouterEcrImage}.
+ *
+ * @example
+ * ```ts
+ * const props: ReactRouterEcrImage.Props = {
+ *   path: './packages/web',
+ *   architecture: 'ARM64'
+ * }
+ * ```
+ */
+declare namespace ReactRouterEcrImage {
+    interface Props {
+        /**
+         * Path to the directory where your React Router app is located, relative to the CDK app root.
+         *
+         * @default "."
+         */
+        path?: string;
+        /**
+         * The directory where the build output is located. Should match the `buildDirectory` in your
+         * React Router config.
+         *
+         * @default "build"
+         */
+        buildDirectory?: string;
+        /**
+         * The port the container listens on. Used when auto-generating the Dockerfile.
+         *
+         * @default 3000
+         */
+        port?: number;
+        /**
+         * Custom Docker build options. When omitted, a Dockerfile is auto-generated that serves
+         * the React Router build output.
+         */
+        image?: EcsFargateService.ImageBuildProps;
+        /**
+         * The CPU architecture for the container image.
+         *
+         * @default "X86_64"
+         */
+        architecture?: 'X86_64' | 'ARM64';
+        /**
+         * Override the Docker image platform. When omitted, the platform is derived from `architecture`.
+         */
+        platform?: aws_cdk_lib_aws_ecr_assets.Platform;
+    }
+}
+
+/**
+ * An RDS MySQL instance in private subnets with encrypted storage, automated backups,
+ * and an optional RDS Proxy for connection pooling.
+ *
+ * @example
+ * ```ts
+ * const db = new MySqlDatabase(this, 'Database', {
+ *   vpc: network.vpc,
+ *   database: 'ecommerce',
+ *   multiAz: true,
+ *   proxy: true
+ * })
+ * ```
+ */
+declare class MySqlDatabase extends Construct {
+    readonly instance: aws_cdk_lib_aws_rds.DatabaseInstance;
+    readonly securityGroup: aws_cdk_lib_aws_ec2.SecurityGroup;
+    readonly secret: secretsmanager.ISecret;
+    readonly connections: aws_cdk_lib_aws_ec2.Connections;
+    readonly rdsProxy?: aws_cdk_lib_aws_rds.DatabaseProxy;
+    get host(): string;
+    get port(): string;
+    get proxyEndpoint(): string | undefined;
+    constructor(scope: Construct, id: string, props: MySqlDatabase.Props);
+}
+/**
+ * Configuration types for {@link MySqlDatabase}.
+ *
+ * @example
+ * ```ts
+ * const props: MySqlDatabase.Props = {
+ *   vpc: network.vpc,
+ *   database: 'app',
+ *   storage: 100,
+ *   multiAz: true
+ * }
+ * ```
+ */
+declare namespace MySqlDatabase {
+    interface Props {
+        /** The VPC to deploy the database instance in. */
+        vpc: aws_cdk_lib_aws_ec2.IVpc;
+        /**
+         * The name of a database that is automatically created inside the instance.
+         *
+         * The name must begin with a letter and contain only lowercase letters,
+         * numbers, or underscores.
+         */
+        database: string;
+        /**
+         * The username of the master database user. A secret with the generated
+         * password is stored in Secrets Manager.
+         *
+         * @default `"root"`
+         */
+        username?: string;
+        /**
+         * The MySQL engine version.
+         *
+         * @default `MysqlEngineVersion.VER_8_0`
+         */
+        version?: aws_cdk_lib_aws_rds.MysqlEngineVersion;
+        /**
+         * The type of instance to use for the database.
+         *
+         * @default `t3.micro`
+         */
+        instance?: aws_cdk_lib_aws_ec2.InstanceType;
+        /**
+         * The initial allocated storage for the database in GB.
+         *
+         * The maximum allocated storage will be set to the larger of this value
+         * or 5000 GB to allow for autoscaling.
+         *
+         * @default 20
+         */
+        storage?: number;
+        /**
+         * Enable Multi-AZ deployment for the database.
+         *
+         * When enabled, a standby replica is maintained in a different availability
+         * zone for automatic failover during outages.
+         *
+         * @default false
+         */
+        multiAz?: boolean;
+        /**
+         * Enable an RDS Proxy in front of the instance.
+         *
+         * RDS Proxy sits between your application and the database, managing
+         * connection pooling and failover. Useful for Lambda-backed applications
+         * that can exhaust direct connections.
+         *
+         * @default false
+         */
+        proxy?: boolean;
+        /**
+         * Enable Performance Insights for the instance.
+         *
+         * @default false
+         */
+        performanceInsights?: boolean;
+        /**
+         * The number of days to retain automated backups.
+         *
+         * @default 7
+         */
+        backupRetentionDays?: number;
+        /**
+         * Enable deletion protection on the instance.
+         *
+         * When enabled, the instance cannot be deleted without first disabling this setting.
+         *
+         * @default true
+         */
+        deletionProtection?: boolean;
+        /**
+         * Transform the underlying CDK props before resource creation.
+         *
+         * Use this to customize any property that isn't directly exposed.
+         *
+         * @example
+         * ```ts
+         * transform: {
+         *   instance: (props) => ({ ...props, publiclyAccessible: false })
+         * }
+         * ```
+         */
+        transform?: {
+            instance?: (props: aws_cdk_lib_aws_rds.DatabaseInstanceProps) => aws_cdk_lib_aws_rds.DatabaseInstanceProps;
+            proxy?: (props: aws_cdk_lib_aws_rds.DatabaseProxyProps) => aws_cdk_lib_aws_rds.DatabaseProxyProps;
+        };
+    }
+}
+
+type DurationString = `${number} ${'second' | 'seconds' | 'minute' | 'minutes' | 'hour' | 'hours'}`;
+/**
+ * An Aurora Serverless v2 cluster (MySQL or PostgreSQL) with auto-scaling, optional auto-pause,
+ * read replicas, and RDS Proxy.
+ *
+ * @example
+ * ```ts
+ * const db = new AuroraDatabase(this, 'Database', {
+ *   vpc: network.vpc,
+ *   engine: 'postgres',
+ *   version: rds.AuroraPostgresEngineVersion.VER_17_4,
+ *   database: 'myapp',
+ *   scaling: { min: 0, max: 4, pauseAfter: '10 minutes' }
+ * })
+ * ```
+ */
+declare class AuroraDatabase extends Construct {
+    readonly cluster: aws_cdk_lib_aws_rds.DatabaseCluster;
+    readonly securityGroup: aws_cdk_lib_aws_ec2.SecurityGroup;
+    readonly secret: secretsmanager.ISecret;
+    readonly connections: aws_cdk_lib_aws_ec2.Connections;
+    readonly rdsProxy?: aws_cdk_lib_aws_rds.DatabaseProxy;
+    get host(): string;
+    get port(): string;
+    get readerHost(): string;
+    get proxyEndpoint(): string | undefined;
+    constructor(scope: Construct, id: string, props: AuroraDatabase.Props);
+}
+/**
+ * Configuration types for {@link AuroraDatabase}.
+ *
+ * @example
+ * ```ts
+ * const props: AuroraDatabase.Props = {
+ *   vpc: network.vpc,
+ *   engine: 'postgres',
+ *   version: rds.AuroraPostgresEngineVersion.VER_17_4,
+ *   database: 'myapp',
+ *   scaling: { min: 0.5, max: 16 }
+ * }
+ * ```
+ */
+declare namespace AuroraDatabase {
+    interface BaseProps {
+        /**
+         * Enable the RDS Data API for the cluster.
+         *
+         * The Data API provides a secure HTTP endpoint that lets you run SQL without
+         * managing persistent database connections.
+         *
+         * @default false
+         */
+        dataApi?: boolean;
+        /**
+         * The name of a database that is automatically created inside the cluster.
+         *
+         * The name must begin with a letter and contain only lowercase letters,
+         * numbers, or underscores.
+         */
+        database: string;
+        /**
+         * The port the cluster listens on.
+         *
+         * @default Engine default (5432 for Postgres, 3306 for MySQL)
+         */
+        port?: number;
+        /**
+         * Enable an RDS Proxy in front of the cluster.
+         *
+         * RDS Proxy sits between your application and the database, managing
+         * connection pooling and failover. Useful for Lambda-backed applications
+         * that can exhaust direct connections.
+         *
+         * @default false
+         */
+        proxy?: boolean;
+        /**
+         * The number of Serverless v2 read-only replicas.
+         *
+         * Each reader scales with the writer and can be used to distribute read traffic.
+         *
+         * @default 0
+         */
+        readers?: number;
+        /**
+         * Aurora Serverless v2 scaling configuration.
+         *
+         * @default `{ min: 0, max: 4 }`
+         *
+         * @example
+         * ```ts
+         * scaling: { min: 0.5, max: 16, pauseAfter: '10 minutes' }
+         * ```
+         */
+        scaling?: {
+            /** Minimum ACU capacity. @default 0 */
+            min?: number;
+            /** Maximum ACU capacity. @default 4 */
+            max?: number;
+            /**
+             * Automatically pause the cluster after this duration of inactivity.
+             * Set to pause the database to zero ACUs when idle.
+             */
+            pauseAfter?: DurationString;
+        };
+        /**
+         * The username of the master database user. A secret with the generated
+         * password is stored in Secrets Manager.
+         *
+         * @default `"postgres"` for Postgres, `"root"` for MySQL
+         */
+        username?: string;
+        /** The VPC to deploy the database cluster in. */
+        vpc: aws_cdk_lib_aws_ec2.IVpc;
+        /**
+         * Enable Performance Insights for the cluster.
+         *
+         * @default false
+         */
+        performanceInsights?: boolean;
+        /**
+         * The number of days to retain automated backups.
+         *
+         * @default 7
+         */
+        backupRetentionDays?: number;
+        /**
+         * Enable deletion protection on the cluster.
+         *
+         * When enabled, the cluster cannot be deleted without first disabling this setting.
+         *
+         * @default true
+         */
+        deletionProtection?: boolean;
+        /**
+         * Transform the underlying CDK props before resource creation.
+         *
+         * Use this to customize any property that isn't directly exposed.
+         *
+         * @example
+         * ```ts
+         * transform: {
+         *   cluster: (props) => ({ ...props, storageType: rds.DBClusterStorageType.AURORA_IOPT1 })
+         * }
+         * ```
+         */
+        transform?: {
+            cluster?: (props: aws_cdk_lib_aws_rds.DatabaseClusterProps) => aws_cdk_lib_aws_rds.DatabaseClusterProps;
+            proxy?: (props: aws_cdk_lib_aws_rds.DatabaseProxyProps) => aws_cdk_lib_aws_rds.DatabaseProxyProps;
+        };
+    }
+    type Props = BaseProps & ({
+        /** The Aurora engine. */
+        engine: 'postgres';
+        /** The Postgres engine version (e.g. `AuroraPostgresEngineVersion.VER_17_4`). */
+        version: aws_cdk_lib_aws_rds.AuroraPostgresEngineVersion;
+    } | {
+        /** The Aurora engine. */
+        engine: 'mysql';
+        /** The MySQL engine version (e.g. `AuroraMysqlEngineVersion.VER_3_08_0`). */
+        version: aws_cdk_lib_aws_rds.AuroraMysqlEngineVersion;
+    });
+}
+
+/**
+ * An ElastiCache Redis or Valkey replication group in private subnets with encryption,
+ * auth token, and automatic failover.
+ *
+ * @example
+ * ```ts
+ * const cache = new Redis(this, 'Cache', {
+ *   vpc: network.vpc,
+ *   engine: 'valkey',
+ *   replicas: 1
+ * })
+ * ```
+ */
+declare class Redis extends Construct {
+    readonly replicationGroup: aws_cdk_lib_aws_elasticache.CfnReplicationGroup;
+    readonly securityGroup: aws_cdk_lib_aws_ec2.SecurityGroup;
+    readonly subnetGroup: aws_cdk_lib_aws_elasticache.CfnSubnetGroup;
+    readonly parameterGroup?: aws_cdk_lib_aws_elasticache.CfnParameterGroup;
+    readonly secret: secretsmanager.Secret;
+    get host(): string;
+    get port(): string;
+    constructor(scope: Construct, id: string, props: Redis.Props);
+}
+/**
+ * Configuration types for {@link Redis}.
+ *
+ * @example
+ * ```ts
+ * const props: Redis.Props = {
+ *   vpc: network.vpc,
+ *   engine: 'valkey',
+ *   replicas: 1
+ * }
+ * ```
+ */
+declare namespace Redis {
+    interface Props {
+        /** The VPC to deploy the replication group in. */
+        vpc: aws_cdk_lib_aws_ec2.IVpc;
+        /**
+         * The cache engine.
+         *
+         * @default `"redis"`
+         */
+        engine?: 'redis' | 'valkey';
+        /**
+         * The engine version string (e.g. `"7.1"` for Redis, `"7.2"` for Valkey).
+         *
+         * @default `"7.1"` for Redis, `"7.2"` for Valkey
+         */
+        version?: string;
+        /**
+         * The node instance type.
+         *
+         * @default `"cache.t4g.micro"`
+         */
+        instance?: string;
+        /**
+         * The number of read replicas. The total cluster size is `replicas + 1`.
+         *
+         * Automatic failover is enabled when `replicas >= 1`.
+         *
+         * @default 0
+         */
+        replicas?: number;
+        /**
+         * Custom parameter group overrides.
+         *
+         * When provided, a dedicated `CfnParameterGroup` is created with these values.
+         *
+         * @example
+         * ```ts
+         * parameters: { 'maxmemory-policy': 'allkeys-lru' }
+         * ```
+         */
+        parameters?: Record<string, string>;
+        /**
+         * Transform the underlying CDK props before resource creation.
+         *
+         * Use this to customize any property that isn't directly exposed.
+         *
+         * @example
+         * ```ts
+         * transform: {
+         *   replicationGroup: (props) => ({ ...props, snapshotRetentionLimit: 7 })
+         * }
+         * ```
+         */
+        transform?: {
+            replicationGroup?: (props: aws_cdk_lib_aws_elasticache.CfnReplicationGroupProps) => aws_cdk_lib_aws_elasticache.CfnReplicationGroupProps;
+            subnetGroup?: (props: aws_cdk_lib_aws_elasticache.CfnSubnetGroupProps) => aws_cdk_lib_aws_elasticache.CfnSubnetGroupProps;
+            parameterGroup?: (props: aws_cdk_lib_aws_elasticache.CfnParameterGroupProps) => aws_cdk_lib_aws_elasticache.CfnParameterGroupProps;
+        };
+    }
+}
+
+/**
+ * An Amazon SES email identity with a configuration set, optional DMARC record, and event destinations.
+ *
+ * @example
+ * ```ts
+ * const email = new Email(this, 'Transactional', {
+ *   sender: 'notifications.example.com',
+ *   hostedZone: zone,
+ *   events: [{ types: ['bounce', 'complaint'], snsTopic: alertsTopic }]
+ * })
+ * ```
+ */
+declare class Email extends Construct {
+    readonly identity: aws_cdk_lib_aws_ses.EmailIdentity;
+    readonly configurationSet: aws_cdk_lib_aws_ses.ConfigurationSet;
+    readonly dmarcRecord?: route53.TxtRecord;
+    private _sender;
+    get sender(): string;
+    get configSetName(): string;
+    constructor(scope: Construct, id: string, props: Email.Props);
+}
+/**
+ * Configuration types for {@link Email}.
+ *
+ * @example
+ * ```ts
+ * const props: Email.Props = {
+ *   sender: 'notifications.example.com',
+ *   hostedZone: zone,
+ *   dmarc: 'v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com;'
+ * }
+ * ```
+ */
+declare namespace Email {
+    /** Kebab-case SES sending event types. */
+    type EmailSendingEventType = 'send' | 'reject' | 'bounce' | 'complaint' | 'delivery' | 'open' | 'click' | 'rendering-failure' | 'delivery-delay' | 'subscription';
+    /** A CloudWatch dimension for SES event metrics. */
+    interface CloudWatchDimension {
+        /** The dimension name. */
+        name: string;
+        /** The dimension value source. */
+        source: 'messageTag' | 'emailHeader' | 'linkTag';
+        /** The default value when the source is unavailable. */
+        defaultValue: string;
+    }
+    /** An event destination that receives SES sending events. */
+    interface EventDestination {
+        /**
+         * The sending event types to forward. When omitted, all event types are forwarded.
+         */
+        types?: EmailSendingEventType[];
+        /**
+         * Whether this event destination is enabled.
+         * @default true
+         */
+        enabled?: boolean;
+        /** Send events to an SNS topic. */
+        snsTopic?: aws_cdk_lib_aws_sns.ITopic;
+        /** Send events to CloudWatch as custom dimensions. */
+        cloudWatchDimensions?: CloudWatchDimension[];
+    }
+    interface Props {
+        /**
+         * The email address or domain to verify as an SES identity.
+         *
+         * Use a bare domain (e.g. `'notifications.example.com'`) to verify an entire domain,
+         * or an email address (e.g. `'hello@example.com'`) to verify a single address.
+         */
+        sender: string;
+        /**
+         * A Route 53 hosted zone for automatic DNS verification and DMARC record creation.
+         *
+         * When provided with a domain sender, SES will automatically add the required
+         * DKIM and verification DNS records. A DMARC TXT record is also created.
+         */
+        hostedZone?: route53.IHostedZone;
+        /**
+         * The DMARC policy value for the TXT record. Only valid for domain senders
+         * with a hosted zone.
+         *
+         * @default `'v=DMARC1; p=none;'`
+         */
+        dmarc?: string;
+        /** Event destinations for SES sending events. */
+        events?: EventDestination[];
+        /**
+         * Transform the underlying CDK resource props before creation.
+         *
+         * Use this to customize any property that isn't directly exposed.
+         */
+        transform?: {
+            configurationSet?: (props: aws_cdk_lib_aws_ses.ConfigurationSetProps) => aws_cdk_lib_aws_ses.ConfigurationSetProps;
+            identity?: (props: aws_cdk_lib_aws_ses.EmailIdentityProps) => aws_cdk_lib_aws_ses.EmailIdentityProps;
+        };
+    }
+}
+
+/**
+ * An SNS Topic with convenience methods for subscribing Lambda functions and SQS queues.
+ *
+ * @example
+ * ```ts
+ * const topic = new SnsTopic(this, 'Alerts', {
+ *   displayName: 'Alert Notifications'
+ * })
+ *
+ * topic.subscribe('Handler', handler)
+ * topic.subscribeQueue('Dlq', deadLetterQueue)
+ * ```
+ */
+declare class SnsTopic extends Construct {
+    readonly topic: aws_cdk_lib_aws_sns.Topic;
+    get arn(): string;
+    get topicName(): string;
+    constructor(scope: Construct, id: string, props?: SnsTopic.Props);
+    /**
+     * Subscribe a Lambda function to this topic.
+     */
+    subscribe(name: string, fn: lambda.IFunction, args?: SnsTopic.LambdaSubscribeArgs): void;
+    /**
+     * Subscribe an SQS queue to this topic.
+     */
+    subscribeQueue(name: string, queue: aws_cdk_lib_aws_sqs.IQueue, args?: SnsTopic.SqsSubscribeArgs): void;
+}
+/**
+ * Configuration types for {@link SnsTopic}.
+ *
+ * @example
+ * ```ts
+ * const props: SnsTopic.Props = {
+ *   displayName: 'Order Events',
+ *   fifo: true,
+ *   contentBasedDeduplication: true
+ * }
+ * ```
+ */
+declare namespace SnsTopic {
+    /** Shared subscription arguments for filter policies and dead-letter queues. */
+    interface SubscribeArgs {
+        /**
+         * SNS filter policy applied to message attributes.
+         * Only messages matching the policy are delivered to the subscriber.
+         */
+        filterPolicy?: Record<string, aws_cdk_lib_aws_sns.SubscriptionFilter>;
+        /**
+         * SNS filter policy applied to the message body.
+         * Only messages matching the policy are delivered to the subscriber.
+         */
+        filterPolicyWithMessageBody?: Record<string, aws_cdk_lib_aws_sns.FilterOrPolicy>;
+        /** A dead-letter queue for messages that fail delivery. */
+        deadLetterQueue?: aws_cdk_lib_aws_sqs.IQueue;
+    }
+    /** Arguments for subscribing a Lambda function. */
+    interface LambdaSubscribeArgs extends SubscribeArgs {
+        /** Transform the underlying CDK subscription props before creation. */
+        transform?: {
+            subscription?: (props: aws_cdk_lib_aws_sns_subscriptions.LambdaSubscriptionProps) => aws_cdk_lib_aws_sns_subscriptions.LambdaSubscriptionProps;
+        };
+    }
+    /** Arguments for subscribing an SQS queue. */
+    interface SqsSubscribeArgs extends SubscribeArgs {
+        /**
+         * When enabled, the raw message is delivered to the queue instead of a JSON-wrapped envelope.
+         * @default false
+         */
+        rawMessageDelivery?: boolean;
+        /** Transform the underlying CDK subscription props before creation. */
+        transform?: {
+            subscription?: (props: aws_cdk_lib_aws_sns_subscriptions.SqsSubscriptionProps) => aws_cdk_lib_aws_sns_subscriptions.SqsSubscriptionProps;
+        };
+    }
+    interface Props {
+        /** A human-readable name for the topic, displayed in the AWS Console. */
+        displayName?: string;
+        /**
+         * Create a FIFO (first-in-first-out) topic. FIFO topics guarantee strict message ordering
+         * and exactly-once delivery.
+         * @default false
+         */
+        fifo?: boolean;
+        /**
+         * Transform the underlying CDK resource props before creation.
+         * Use this to customize any property that isn't directly exposed.
+         */
+        transform?: {
+            topic?: (props: aws_cdk_lib_aws_sns.TopicProps) => aws_cdk_lib_aws_sns.TopicProps;
+        };
+    }
+}
+
+/**
+ * An EventBridge Event Bus with convenience methods for subscribing Lambda functions and SQS queues
+ * with event pattern filtering.
+ *
+ * @example
+ * ```ts
+ * const bus = new EventBus(this, 'Orders', {
+ *   description: 'Order domain events'
+ * })
+ *
+ * bus.subscribe('Handler', handler, {
+ *   pattern: { source: ['orders'], detailType: ['OrderPlaced'] }
+ * })
+ * bus.subscribeQueue('Dlq', deadLetterQueue, {
+ *   pattern: { source: ['orders'] }
+ * })
+ * ```
+ */
+declare class EventBus extends Construct {
+    readonly bus: aws_cdk_lib_aws_events.EventBus;
+    get arn(): string;
+    get busName(): string;
+    constructor(scope: Construct, id: string, props?: EventBus.Props);
+    /**
+     * Subscribe a Lambda function to events on this bus.
+     */
+    subscribe(name: string, fn: lambda.IFunction, args?: EventBus.LambdaSubscribeArgs): void;
+    /**
+     * Subscribe an SQS queue to events on this bus.
+     */
+    subscribeQueue(name: string, queue: aws_cdk_lib_aws_sqs.IQueue, args?: EventBus.SqsSubscribeArgs): void;
+}
+/**
+ * Configuration types for {@link EventBus}.
+ *
+ * @example
+ * ```ts
+ * const props: EventBus.Props = {
+ *   eventBusName: 'orders',
+ *   description: 'Order domain events'
+ * }
+ * ```
+ */
+declare namespace EventBus {
+    /** Shared subscription arguments for event pattern filtering. */
+    interface SubscribeArgs {
+        /**
+         * EventBridge event pattern to filter which events trigger the subscription.
+         * All specified fields must match for the event to be delivered.
+         */
+        pattern?: {
+            /** Match events from these sources (e.g. `['orders', 'payments']`). */
+            source?: string[];
+            /** Match events with these detail types (e.g. `['OrderPlaced', 'OrderCancelled']`). */
+            detailType?: string[];
+            /** Match events whose `detail` field matches this pattern. */
+            detail?: Record<string, any>;
+        };
+    }
+    /** Arguments for subscribing a Lambda function. */
+    interface LambdaSubscribeArgs extends SubscribeArgs {
+        /** Transform the underlying CDK resource props before creation. */
+        transform?: {
+            rule?: (props: aws_cdk_lib_aws_events.RuleProps) => aws_cdk_lib_aws_events.RuleProps;
+            target?: (props: aws_cdk_lib_aws_events_targets.LambdaFunctionProps) => aws_cdk_lib_aws_events_targets.LambdaFunctionProps;
+        };
+    }
+    /** Arguments for subscribing an SQS queue. */
+    interface SqsSubscribeArgs extends SubscribeArgs {
+        /** Transform the underlying CDK resource props before creation. */
+        transform?: {
+            rule?: (props: aws_cdk_lib_aws_events.RuleProps) => aws_cdk_lib_aws_events.RuleProps;
+            target?: (props: aws_cdk_lib_aws_events_targets.SqsQueueProps) => aws_cdk_lib_aws_events_targets.SqsQueueProps;
+        };
+    }
+    interface Props {
+        /** The physical name of the event bus. */
+        eventBusName?: string;
+        /** A description for the event bus. */
+        description?: string;
+        /**
+         * Transform the underlying CDK resource props before creation.
+         * Use this to customize any property that isn't directly exposed.
+         */
+        transform?: {
+            bus?: (props: aws_cdk_lib_aws_events.EventBusProps) => aws_cdk_lib_aws_events.EventBusProps;
+        };
+    }
+}
+
+export { AuroraDatabase, Bucket, Cluster, EcsFargateService, Email, EventBus, LambdaFunction, MySqlDatabase, ReactRouterEcrImage, ReactRouterSsrSiteEcsFargateService, ReactRouterSsrSiteLambda, Redis, SnsTopic, StaticSite, Vpc };