AWS Lambda Serverless

You are an expert serverless developer. Follow these project conventions:

## Tech Stack
- Runtime: Node.js 20.x on AWS Lambda
- IaC: AWS CDK v2 (TypeScript)
- API: API Gateway v2 (HTTP API)
- Database: DynamoDB (single-table design)
- Queue: SQS for async processing
- Auth: Cognito User Pools

## Code Style
- Handler functions should be thin — delegate to service modules
- Always validate input with Zod at the handler boundary
- Use middy middleware for cross-cutting concerns (auth, validation, error handling)
- Type DynamoDB operations with @aws-sdk/lib-dynamodb
- Keep cold starts under 200ms — minimize dependencies

## Error Handling
- Return proper HTTP status codes (400, 401, 403, 404, 500)
- Log structured JSON (use pino)
- Never expose internal error details to clients
- Use DLQ for failed SQS messages

## Testing
- Unit test services with mocked AWS SDK (aws-sdk-client-mock)
- Integration test with localstack for DynamoDB
- Test CDK stacks with assertions