dynamodb-reactive 0.1.21 → 0.2.1

package/dist/infra.js

@@ -1,15 +1,17 @@
-import { SystemTableNames } from './chunk-ZAJA4KBE.js';
 import * as fs from 'fs';
 import * as path from 'path';
 import * as cdk2 from 'aws-cdk-lib';
 import * as apigatewayv2 from 'aws-cdk-lib/aws-apigatewayv2';
 import * as apigatewayv2Integrations from 'aws-cdk-lib/aws-apigatewayv2-integrations';
+import * as dynamodb from 'aws-cdk-lib/aws-dynamodb';
 import * as iam from 'aws-cdk-lib/aws-iam';
 import * as lambda from 'aws-cdk-lib/aws-lambda';
 import * as nodejs from 'aws-cdk-lib/aws-lambda-nodejs';
 import * as logs from 'aws-cdk-lib/aws-logs';
 import { Construct } from 'constructs';
-import * as dynamodb from 'aws-cdk-lib/aws-dynamodb';
+import { z } from 'zod';
+
+// ../infra/src/engine.ts
 
 // ../infra/src/handlers/lambda-handlers.ts
 function generateEntryPointCode() {
@@ -25,6 +27,156 @@ export const messageHandler = handlers.messageHandler;
 export const streamHandler = handlers.streamHandler;
 `;
 }
+var FilterConditionSchema = z.lazy(() => {
+  const comparison = z.object({
+    type: z.literal("comparison"),
+    operator: z.enum(["eq", "ne", "gt", "gte", "lt", "lte"]),
+    field: z.string().min(1),
+    value: z.unknown()
+  }).strict();
+  const queryFunction = z.union([
+    z.object({
+      type: z.literal("function"),
+      operator: z.literal("between"),
+      field: z.string().min(1),
+      value: z.unknown(),
+      value2: z.unknown()
+    }).strict(),
+    z.object({
+      type: z.literal("function"),
+      operator: z.enum(["beginsWith", "contains"]),
+      field: z.string().min(1),
+      value: z.unknown()
+    }).strict()
+  ]);
+  const logical = z.object({
+    type: z.literal("logical"),
+    operator: z.enum(["and", "or", "not"]),
+    conditions: z.array(FilterConditionSchema).min(1)
+  }).strict().superRefine((condition, context) => {
+    if (condition.operator === "not" && condition.conditions.length !== 1) {
+      context.addIssue({
+        code: "custom",
+        path: ["conditions"],
+        message: "not requires exactly one condition"
+      });
+    }
+  });
+  return z.union([comparison, queryFunction, logical]);
+});
+var QueryMetadataSchema = z.object({
+  planVersion: z.literal(1),
+  tableName: z.string().min(1),
+  indexName: z.string().min(1).optional(),
+  indexPkField: z.string().min(1).optional(),
+  indexSkField: z.string().min(1).optional(),
+  filterConditions: z.array(FilterConditionSchema),
+  sortField: z.string().min(1).optional(),
+  sortOrder: z.enum(["asc", "desc"]).optional(),
+  limit: z.number().int().positive().optional()
+}).strict().superRefine((metadata, context) => {
+  if (metadata.indexName && !metadata.indexPkField) {
+    context.addIssue({
+      code: "custom",
+      path: ["indexPkField"],
+      message: "Index metadata requires its partition key field"
+    });
+  }
+  if (!metadata.indexName && (metadata.indexPkField || metadata.indexSkField)) {
+    context.addIssue({
+      code: "custom",
+      path: ["indexName"],
+      message: "Index key fields require an index name"
+    });
+  }
+  if (Boolean(metadata.sortField) !== Boolean(metadata.sortOrder)) {
+    context.addIssue({
+      code: "custom",
+      path: ["sortOrder"],
+      message: "Sort field and order must be specified together"
+    });
+  }
+});
+var DeliveryVersionSchema = z.object({
+  generation: z.number().int().nonnegative(),
+  fromVersion: z.number().int().nonnegative(),
+  toVersion: z.number().int().positive(),
+  messageId: z.string().min(1)
+});
+var PendingDeliverySchema = z.discriminatedUnion("type", [
+  DeliveryVersionSchema.extend({
+    type: z.literal("patch"),
+    patches: z.array(
+      z.object({
+        op: z.enum(["add", "remove", "replace", "move", "copy", "test"]),
+        path: z.string(),
+        value: z.unknown().optional(),
+        from: z.string().optional()
+      })
+    )
+  }),
+  DeliveryVersionSchema.extend({
+    type: z.literal("resync")
+  }).strict()
+]);
+({
+  /**
+   * ReactiveConnectionsV2 - Tracks active WebSocket connections
+   */
+  connections: z.object({
+    connectionId: z.string(),
+    status: z.enum(["open", "closed"]),
+    context: z.record(z.string(), z.unknown()).optional(),
+    authorizerContext: z.record(z.string(), z.unknown()).optional(),
+    requestIdentity: z.record(z.string(), z.unknown()).optional(),
+    connectedAt: z.number(),
+    ttl: z.number()
+  }),
+  /**
+   * ReactiveDependenciesV2 - The inverted index for O(1) lookups
+   */
+  dependencies: z.object({
+    pk: z.string(),
+    // Versioned encoded dependency key
+    sk: z.string(),
+    // ConnectionID#SubscriptionID
+    connectionId: z.string(),
+    subscriptionId: z.string(),
+    tableName: z.string(),
+    fieldName: z.string(),
+    fieldValue: z.string(),
+    generation: z.number().int().nonnegative(),
+    registrationId: z.string().min(1),
+    ttl: z.number()
+  }),
+  /**
+   * ReactiveConnectionQueriesV2 - Stores subscription state for diffing
+   */
+  queries: z.object({
+    pk: z.string(),
+    // ConnectionID
+    sk: z.string(),
+    // SubscriptionID
+    connectionId: z.string(),
+    subscriptionId: z.string(),
+    status: z.enum(["registering", "active", "cancelled", "faulted"]),
+    generation: z.number().int().nonnegative(),
+    registrationId: z.string().min(1),
+    queryMetadata: QueryMetadataSchema,
+    lastResult: z.array(z.unknown()),
+    dependencies: z.array(z.string()),
+    version: z.number().int().nonnegative(),
+    pendingDelivery: PendingDeliverySchema.optional(),
+    createdAt: z.number(),
+    updatedAt: z.number(),
+    ttl: z.number()
+  })
+});
+var SystemTableNames = {
+  connections: "ReactiveConnectionsV2",
+  dependencies: "ReactiveDependenciesV2",
+  queries: "ReactiveConnectionQueriesV2"
+};
 var ReactiveSystemTables = class extends Construct {
   /**
    * ReactiveConnections table - tracks WebSocket connections
@@ -38,10 +190,16 @@ var ReactiveSystemTables = class extends Construct {
    * ReactiveConnectionQueries table - stores subscription state
    */
   queriesTable;
-  constructor(scope, id, props = {}) {
+  constructor(scope, id, props) {
     super(scope, id);
-    const prefix = props.tablePrefix ? `${props.tablePrefix}-` : "";
+    if (cdk2.Token.isUnresolved(props.tablePrefix) || !/^[A-Za-z0-9][A-Za-z0-9_-]*$/.test(props.tablePrefix) || props.tablePrefix.length > 229) {
+      throw new Error(
+        "ReactiveSystemTables tablePrefix must be a nonempty concrete value of at most 229 letters, numbers, hyphens, or underscores, starting with a letter or number."
+      );
+    }
+    const tableName = (name) => `${props.tablePrefix}-${name}`;
     const provisioningMode = props.provisioningMode ?? "ON_DEMAND";
+    const removalPolicy = props.removalPolicy ?? cdk2.RemovalPolicy.RETAIN;
     const isOnDemand = provisioningMode === "ON_DEMAND";
     const capacityProps = isOnDemand ? { billingMode: dynamodb.BillingMode.PAY_PER_REQUEST } : {
       billingMode: dynamodb.BillingMode.PROVISIONED,
@@ -49,17 +207,17 @@ var ReactiveSystemTables = class extends Construct {
       writeCapacity: provisioningMode.readWrite
     };
     this.connectionsTable = new dynamodb.Table(this, "ConnectionsTable", {
-      tableName: `${prefix}${SystemTableNames.connections}`,
+      tableName: tableName(SystemTableNames.connections),
       partitionKey: {
         name: "connectionId",
         type: dynamodb.AttributeType.STRING
       },
       ...capacityProps,
-      removalPolicy: cdk2.RemovalPolicy.DESTROY,
+      removalPolicy,
       timeToLiveAttribute: "ttl"
     });
     this.dependenciesTable = new dynamodb.Table(this, "DependenciesTable", {
-      tableName: `${prefix}${SystemTableNames.dependencies}`,
+      tableName: tableName(SystemTableNames.dependencies),
       partitionKey: {
         name: "pk",
         // Format: "TableName#FieldName#FieldValue"
@@ -71,7 +229,7 @@ var ReactiveSystemTables = class extends Construct {
         type: dynamodb.AttributeType.STRING
       },
       ...capacityProps,
-      removalPolicy: cdk2.RemovalPolicy.DESTROY,
+      removalPolicy,
       timeToLiveAttribute: "ttl"
     });
     const gsiProps = isOnDemand ? {} : {
@@ -88,7 +246,7 @@ var ReactiveSystemTables = class extends Construct {
       ...gsiProps
     });
     this.queriesTable = new dynamodb.Table(this, "QueriesTable", {
-      tableName: `${prefix}${SystemTableNames.queries}`,
+      tableName: tableName(SystemTableNames.queries),
       partitionKey: {
         name: "pk",
         // ConnectionID
@@ -100,14 +258,20 @@ var ReactiveSystemTables = class extends Construct {
         type: dynamodb.AttributeType.STRING
       },
       ...capacityProps,
-      removalPolicy: cdk2.RemovalPolicy.DESTROY,
+      removalPolicy,
       timeToLiveAttribute: "ttl"
     });
   }
 };
 
 // ../infra/src/engine.ts
+var PARTIQL_ACTIONS = [
+  "dynamodb:PartiQLInsert",
+  "dynamodb:PartiQLUpdate",
+  "dynamodb:PartiQLDelete"
+];
 var ReactiveEngine = class extends Construct {
+  tables;
   systemTables;
   webSocketApi;
   webSocketStage;
@@ -119,16 +283,40 @@ var ReactiveEngine = class extends Construct {
   callbackUrl;
   constructor(scope, id, props) {
     super(scope, id);
-    const prefix = props.resourcePrefix ?? "";
+    if (cdk2.Token.isUnresolved(props.resourcePrefix) || !/^[A-Za-z0-9][A-Za-z0-9_-]*$/.test(props.resourcePrefix) || props.resourcePrefix.length > 45) {
+      throw new Error(
+        "ReactiveEngine resourcePrefix must be a nonempty concrete value of at most 45 letters, numbers, hyphens, or underscores, starting with a letter or number."
+      );
+    }
+    if (props.connectAuthorizer && props.allowUnauthenticatedConnections) {
+      throw new Error(
+        "Specify either connectAuthorizer or allowUnauthenticatedConnections, not both."
+      );
+    }
+    if (props.connectAuthorizer instanceof apigatewayv2.WebSocketNoneAuthorizer) {
+      throw new Error(
+        "WebSocketNoneAuthorizer does not authenticate connections. Set allowUnauthenticatedConnections to true instead."
+      );
+    }
+    if (!props.connectAuthorizer && !props.allowUnauthenticatedConnections) {
+      throw new Error(
+        "WebSocket authentication is required. Provide connectAuthorizer or explicitly set allowUnauthenticatedConnections to true."
+      );
+    }
+    for (const binding of props.tables) {
+      this.validateTableName(binding);
+      this.validateStream(binding);
+    }
+    this.tables = [...props.tables];
+    const resourceName = (name) => `${props.resourcePrefix}-${name}`;
     const memorySize = 128;
     const timeout = cdk2.Duration.seconds(30);
-    const logRetention = logs.RetentionDays.ONE_DAY;
     this.systemTables = new ReactiveSystemTables(this, "SystemTables", {
-      tablePrefix: prefix,
-      ...props.systemTablesProps
+      ...props.systemTablesProps,
+      tablePrefix: props.resourcePrefix
     });
     this.webSocketApi = new apigatewayv2.WebSocketApi(this, "WebSocketApi", {
-      apiName: `${prefix}ReactiveWebSocket`
+      apiName: resourceName("ReactiveWebSocket")
     });
     this.webSocketStage = new apigatewayv2.WebSocketStage(
       this,
@@ -141,88 +329,145 @@ var ReactiveEngine = class extends Construct {
     );
     this.webSocketUrl = this.webSocketStage.url;
     this.callbackUrl = this.webSocketStage.callbackUrl;
-    const entryPointCode = generateEntryPointCode();
     const cdkOutDir = path.join(process.cwd(), "cdk.out", ".generated");
     fs.mkdirSync(cdkOutDir, { recursive: true });
-    const entryPointPath = path.join(
-      cdkOutDir,
-      `reactive-entry-${id}-${Date.now()}.ts`
-    );
-    fs.writeFileSync(entryPointPath, entryPointCode);
+    const entryPointPath = path.join(cdkOutDir, "reactive-entry.ts");
+    fs.writeFileSync(entryPointPath, generateEntryPointCode());
     const environment = {
+      ...props.environment,
       CONNECTIONS_TABLE: this.systemTables.connectionsTable.tableName,
       DEPENDENCIES_TABLE: this.systemTables.dependenciesTable.tableName,
       QUERIES_TABLE: this.systemTables.queriesTable.tableName,
       WEBSOCKET_ENDPOINT: this.callbackUrl,
-      ...props.environment,
       LOG_LEVEL: props.environment?.LOG_LEVEL ?? "INFO"
     };
+    const bundling = {
+      format: nodejs.OutputFormat.CJS,
+      minify: true,
+      sourceMap: false,
+      target: "node24"
+    };
     this.connectHandler = new nodejs.NodejsFunction(this, "ConnectHandler", {
-      functionName: `${prefix}ReactiveConnect`,
-      runtime: lambda.Runtime.NODEJS_LATEST,
+      functionName: resourceName("ReactiveConnect"),
+      runtime: lambda.Runtime.NODEJS_24_X,
       handler: "connectHandler",
       entry: entryPointPath,
+      bundling,
       environment,
       memorySize,
       timeout,
-      logRetention
+      logGroup: this.createLogGroup("ConnectLogGroup")
     });
     this.disconnectHandler = new nodejs.NodejsFunction(
       this,
       "DisconnectHandler",
       {
-        functionName: `${prefix}ReactiveDisconnect`,
-        runtime: lambda.Runtime.NODEJS_LATEST,
+        functionName: resourceName("ReactiveDisconnect"),
+        runtime: lambda.Runtime.NODEJS_24_X,
         handler: "disconnectHandler",
         entry: entryPointPath,
+        bundling,
         environment,
         memorySize,
         timeout,
-        logRetention
+        logGroup: this.createLogGroup("DisconnectLogGroup")
       }
     );
     this.messageHandler = new nodejs.NodejsFunction(this, "MessageHandler", {
-      functionName: `${prefix}ReactiveMessage`,
-      runtime: lambda.Runtime.NODEJS_LATEST,
+      functionName: resourceName("ReactiveMessage"),
+      runtime: lambda.Runtime.NODEJS_24_X,
       handler: "messageHandler",
       entry: entryPointPath,
+      bundling,
       environment,
       memorySize,
       timeout,
-      logRetention
+      logGroup: this.createLogGroup("MessageLogGroup")
     });
     this.streamHandler = new nodejs.NodejsFunction(this, "StreamHandler", {
-      functionName: `${prefix}ReactiveStream`,
-      runtime: lambda.Runtime.NODEJS_LATEST,
+      functionName: resourceName("ReactiveStream"),
+      runtime: lambda.Runtime.NODEJS_24_X,
       handler: "streamHandler",
       entry: entryPointPath,
+      bundling,
       environment: {
         ...environment,
-        USER_TABLES: props.tables.map((t) => t.tableName).join(",")
+        USER_TABLES: props.tables.map(({ definition }) => definition.tableName).join(",")
       },
       memorySize,
       timeout,
-      logRetention
+      logGroup: this.createLogGroup("StreamLogGroup")
+    });
+    iam.Grant.addToPrincipal({
+      grantee: this.connectHandler,
+      actions: ["dynamodb:PutItem"],
+      resourceArns: [this.systemTables.connectionsTable.tableArn]
+    });
+    iam.Grant.addToPrincipal({
+      grantee: this.disconnectHandler,
+      actions: ["dynamodb:UpdateItem"],
+      resourceArns: [this.systemTables.connectionsTable.tableArn]
+    });
+    iam.Grant.addToPrincipal({
+      grantee: this.disconnectHandler,
+      actions: ["dynamodb:Query", "dynamodb:UpdateItem"],
+      resourceArns: [this.systemTables.queriesTable.tableArn]
+    });
+    iam.Grant.addToPrincipal({
+      grantee: this.disconnectHandler,
+      actions: ["dynamodb:DeleteItem"],
+      resourceArns: [this.systemTables.dependenciesTable.tableArn]
+    });
+    iam.Grant.addToPrincipal({
+      grantee: this.messageHandler,
+      actions: ["dynamodb:UpdateItem"],
+      resourceArns: [this.systemTables.connectionsTable.tableArn]
+    });
+    iam.Grant.addToPrincipal({
+      grantee: this.streamHandler,
+      actions: ["dynamodb:UpdateItem"],
+      resourceArns: [this.systemTables.connectionsTable.tableArn]
+    });
+    iam.Grant.addToPrincipal({
+      grantee: this.streamHandler,
+      actions: ["dynamodb:Query", "dynamodb:DeleteItem"],
+      resourceArns: [this.systemTables.dependenciesTable.tableArn]
+    });
+    iam.Grant.addToPrincipal({
+      grantee: this.streamHandler,
+      actions: [
+        "dynamodb:GetItem",
+        "dynamodb:Query",
+        "dynamodb:UpdateItem"
+      ],
+      resourceArns: [this.systemTables.queriesTable.tableArn]
     });
-    this.systemTables.connectionsTable.grantReadWriteData(this.connectHandler);
-    this.systemTables.connectionsTable.grantReadWriteData(
-      this.disconnectHandler
-    );
-    this.systemTables.connectionsTable.grantReadWriteData(this.messageHandler);
-    this.systemTables.connectionsTable.grantReadWriteData(this.streamHandler);
-    this.systemTables.dependenciesTable.grantReadWriteData(this.messageHandler);
-    this.systemTables.dependenciesTable.grantReadWriteData(this.streamHandler);
-    this.systemTables.queriesTable.grantReadWriteData(this.messageHandler);
-    this.systemTables.queriesTable.grantReadWriteData(this.streamHandler);
     const managementPolicy = new iam.PolicyStatement({
       actions: ["execute-api:ManageConnections"],
       resources: [
-        `arn:aws:execute-api:${cdk2.Stack.of(this).region}:${cdk2.Stack.of(this).account}:${this.webSocketApi.apiId}/${this.webSocketStage.stageName}/POST/@connections/*`
+        cdk2.Stack.of(this).formatArn({
+          service: "execute-api",
+          resource: this.webSocketApi.apiId,
+          resourceName: `${this.webSocketStage.stageName}/POST/@connections/*`,
+          arnFormat: cdk2.ArnFormat.SLASH_RESOURCE_NAME
+        })
       ]
     });
     this.messageHandler.addToRolePolicy(managementPolicy);
     this.streamHandler.addToRolePolicy(managementPolicy);
+    const connectAuthorizer = props.connectAuthorizer ? {
+      bind: (options) => {
+        const config = props.connectAuthorizer.bind(options);
+        if (config.authorizationType === "NONE") {
+          throw new Error(
+            "The connectAuthorizer bind result uses NONE authorization. Set allowUnauthenticatedConnections to true instead."
+          );
+        }
+        return config;
+      }
+    } : void 0;
     this.webSocketApi.addRoute("$connect", {
+      authorizer: connectAuthorizer,
       integration: new apigatewayv2Integrations.WebSocketLambdaIntegration(
         "ConnectIntegration",
         this.connectHandler
@@ -240,126 +485,108 @@ var ReactiveEngine = class extends Construct {
         this.messageHandler
       )
     });
-    for (const table of props.tables) {
-      this.setupStreamProcessing(table);
+    for (const [index, binding] of props.tables.entries()) {
+      this.setupStreamProcessing(binding, index);
     }
     new cdk2.CfnOutput(this, "WebSocketUrl", {
       value: this.webSocketUrl,
       description: "WebSocket URL for reactive connections"
     });
   }
-  setupStreamProcessing(table) {
-    const tableArn = `arn:aws:dynamodb:${cdk2.Stack.of(this).region}:${cdk2.Stack.of(this).account}:table/${table.tableName}`;
-    const streamArn = `${tableArn}/stream/*`;
-    this.streamHandler.addToRolePolicy(
-      new iam.PolicyStatement({
-        actions: [
-          "dynamodb:GetRecords",
-          "dynamodb:GetShardIterator",
-          "dynamodb:DescribeStream",
-          "dynamodb:ListStreams"
-        ],
-        resources: [streamArn]
-      })
-    );
-    const tableReadPolicy = new iam.PolicyStatement({
-      actions: [
-        "dynamodb:Query",
-        "dynamodb:Scan",
-        "dynamodb:GetItem",
-        "dynamodb:BatchGetItem",
-        "dynamodb:PartiQLSelect"
-      ],
-      resources: [tableArn, `${tableArn}/index/*`]
+  /** Grant an external application handler access to reactive and user data. */
+  grantApplicationAccess(grantee) {
+    this.systemTables.connectionsTable.grantReadWriteData(grantee);
+    this.systemTables.dependenciesTable.grantReadWriteData(grantee);
+    this.systemTables.queriesTable.grantReadWriteData(grantee);
+    iam.Grant.addToPrincipal({
+      grantee,
+      actions: ["dynamodb:TransactWriteItems"],
+      resourceArns: [
+        this.systemTables.connectionsTable.tableArn,
+        this.systemTables.dependenciesTable.tableArn,
+        this.systemTables.queriesTable.tableArn
+      ]
     });
-    this.streamHandler.addToRolePolicy(tableReadPolicy);
-    this.messageHandler.addToRolePolicy(tableReadPolicy);
-    this.messageHandler.addToRolePolicy(
-      new iam.PolicyStatement({
-        actions: [
-          "dynamodb:PutItem",
-          "dynamodb:UpdateItem",
-          "dynamodb:DeleteItem",
-          "dynamodb:BatchWriteItem",
-          "dynamodb:PartiQLInsert",
-          "dynamodb:PartiQLUpdate",
-          "dynamodb:PartiQLDelete"
-        ],
-        resources: [tableArn, `${tableArn}/index/*`]
-      })
-    );
-  }
-  addTable(table) {
-    if (!table.tableStreamArn) {
-      throw new Error(`Table ${table.tableName} does not have streams enabled`);
+    for (const { table } of this.tables) {
+      table.grantReadWriteData(grantee);
+      iam.Grant.addToPrincipal({
+        grantee,
+        actions: ["dynamodb:PartiQLSelect"],
+        resourceArns: [table.tableArn, `${table.tableArn}/index/*`]
+      });
+      iam.Grant.addToPrincipal({
+        grantee,
+        actions: PARTIQL_ACTIONS,
+        resourceArns: [table.tableArn]
+      });
     }
+  }
+  setupStreamProcessing(binding, index) {
+    const { table } = binding;
     table.grantStreamRead(this.streamHandler);
-    table.grantReadData(this.streamHandler);
-    new lambda.EventSourceMapping(this, `Stream-${table.tableName}`, {
+    iam.Grant.addToPrincipal({
+      grantee: this.streamHandler,
+      actions: ["dynamodb:PartiQLSelect"],
+      resourceArns: [table.tableArn, `${table.tableArn}/index/*`]
+    });
+    new lambda.EventSourceMapping(this, `UserTableStream${index}`, {
       target: this.streamHandler,
       eventSourceArn: table.tableStreamArn,
       startingPosition: lambda.StartingPosition.TRIM_HORIZON,
       batchSize: 100,
-      maxBatchingWindow: cdk2.Duration.seconds(5)
+      maxBatchingWindow: cdk2.Duration.seconds(5),
+      bisectBatchOnError: true,
+      reportBatchItemFailures: true
     });
   }
-};
-var DynamoDBStreamSource = class extends Construct {
-  eventSourceMapping;
-  constructor(scope, id, props) {
-    super(scope, id);
-    const {
-      table,
-      target,
-      batchSize = 100,
-      maxBatchingWindow = cdk2.Duration.seconds(5),
-      startingPosition = lambda.StartingPosition.TRIM_HORIZON,
-      parallelizationFactor = 1,
-      maxRecordAge = cdk2.Duration.days(1),
-      retryAttempts = 3,
-      filters
-    } = props;
+  createLogGroup(id) {
+    return new logs.LogGroup(this, id, {
+      retention: logs.RetentionDays.ONE_DAY,
+      removalPolicy: cdk2.RemovalPolicy.DESTROY
+    });
+  }
+  validateStream(binding) {
+    const { definition, table } = binding;
     if (!table.tableStreamArn) {
       throw new Error(
-        `Table ${table.tableName} does not have DynamoDB Streams enabled. Enable streams with streamSpecification when creating the table.`
+        `Table ${definition.tableName} does not have DynamoDB Streams enabled. NEW_AND_OLD_IMAGES is required.`
       );
     }
-    table.grantStreamRead(target);
-    this.eventSourceMapping = new lambda.EventSourceMapping(
-      this,
-      "EventSource",
-      {
-        target,
-        eventSourceArn: table.tableStreamArn,
-        startingPosition,
-        batchSize,
-        maxBatchingWindow,
-        parallelizationFactor,
-        maxRecordAge,
-        retryAttempts,
-        bisectBatchOnError: true,
-        reportBatchItemFailures: true,
-        filters
-      }
+    const child = table.node.defaultChild;
+    if (!(child instanceof dynamodb.CfnTable) && !(child instanceof dynamodb.CfnGlobalTable)) {
+      return;
+    }
+    const specification = cdk2.Stack.of(this).resolve(
+      child.streamSpecification
     );
+    if (!specification || cdk2.Token.isUnresolved(specification) || typeof specification !== "object" || !("streamViewType" in specification)) {
+      return;
+    }
+    const streamViewType = specification.streamViewType;
+    if (!cdk2.Token.isUnresolved(streamViewType) && streamViewType !== dynamodb.StreamViewType.NEW_AND_OLD_IMAGES) {
+      throw new Error(
+        `Table ${definition.tableName} uses stream view ${streamViewType}; NEW_AND_OLD_IMAGES is required.`
+      );
+    }
   }
-};
-function createStreamFilter(options) {
-  const filters = [];
-  if (options.eventName) {
-    filters.push({
-      eventName: options.eventName
-    });
-  }
-  if (options.patterns) {
-    filters.push(...options.patterns);
-  }
-  if (filters.length === 0) {
-    return [];
+  validateTableName(binding) {
+    const { definition, table } = binding;
+    const child = table.node.defaultChild;
+    const childTableName = child && typeof child === "object" && "tableName" in child ? child.tableName : void 0;
+    const physicalTableName = !cdk2.Token.isUnresolved(table.tableName) ? table.tableName : childTableName && !cdk2.Token.isUnresolved(childTableName) ? childTableName : table.tableName;
+    if (!physicalTableName || cdk2.Token.isUnresolved(physicalTableName)) {
+      throw new Error(
+        `Table ${definition.tableName} has an unresolved physical table name. Set an explicit tableName equal to definition.tableName; separately bundled application code cannot coordinate CloudFormation-generated names.`
+      );
+    }
+    if (physicalTableName !== definition.tableName) {
+      throw new Error(
+        `Table binding name mismatch: definition.tableName is "${definition.tableName}" but the physical table name is "${physicalTableName}". Set an explicit matching tableName.`
+      );
+    }
   }
-  return [lambda.FilterCriteria.filter({ filters })];
-}
+};
 
-export { DynamoDBStreamSource, ReactiveEngine, ReactiveSystemTables, createStreamFilter, generateEntryPointCode };
+export { ReactiveEngine };
 //# sourceMappingURL=infra.js.map
 //# sourceMappingURL=infra.js.map