@jaypie/constructs 1.1.21 → 1.1.23

package/dist/cjs/index.cjs

@@ -1,15 +1,17 @@
 'use strict';
 
+var cdk$1 = require('aws-cdk-lib');
+var s3 = require('aws-cdk-lib/aws-s3');
+var s3n = require('aws-cdk-lib/aws-s3-notifications');
+var cdk = require('@jaypie/cdk');
 var constructs = require('constructs');
-var cdk = require('aws-cdk-lib');
+var lambda = require('aws-cdk-lib/aws-lambda');
+var sqs = require('aws-cdk-lib/aws-sqs');
+var lambdaEventSources = require('aws-cdk-lib/aws-lambda-event-sources');
 var secretsmanager = require('aws-cdk-lib/aws-secretsmanager');
-var cdk$1 = require('@jaypie/cdk');
 var awsIam = require('aws-cdk-lib/aws-iam');
 var awsLogs = require('aws-cdk-lib/aws-logs');
 var awsRoute53 = require('aws-cdk-lib/aws-route53');
-var lambda = require('aws-cdk-lib/aws-lambda');
-var sqs = require('aws-cdk-lib/aws-sqs');
-var lambdaEventSources = require('aws-cdk-lib/aws-lambda-event-sources');
 var sso = require('aws-cdk-lib/aws-sso');
 
 function _interopNamespaceDefault(e) {
@@ -29,234 +31,64 @@ function _interopNamespaceDefault(e) {
     return Object.freeze(n);
 }
 
-var cdk__namespace = /*#__PURE__*/_interopNamespaceDefault(cdk);
-var secretsmanager__namespace = /*#__PURE__*/_interopNamespaceDefault(secretsmanager);
+var cdk__namespace = /*#__PURE__*/_interopNamespaceDefault(cdk$1);
+var s3__namespace = /*#__PURE__*/_interopNamespaceDefault(s3);
+var s3n__namespace = /*#__PURE__*/_interopNamespaceDefault(s3n);
 var lambda__namespace = /*#__PURE__*/_interopNamespaceDefault(lambda);
 var sqs__namespace = /*#__PURE__*/_interopNamespaceDefault(sqs);
 var lambdaEventSources__namespace = /*#__PURE__*/_interopNamespaceDefault(lambdaEventSources);
+var secretsmanager__namespace = /*#__PURE__*/_interopNamespaceDefault(secretsmanager);
 var sso__namespace = /*#__PURE__*/_interopNamespaceDefault(sso);
 
-// It is a consumer if the environment is ephemeral
-function checkEnvIsConsumer(env = process.env) {
-    return (env.PROJECT_ENV === cdk$1.CDK.ENV.PERSONAL ||
-        !!env.CDK_ENV_PERSONAL ||
-        /** @deprecated */ env.PROJECT_ENV === "ephemeral" ||
-        /** @deprecated */ !!env.CDK_ENV_EPHEMERAL);
-}
-function checkEnvIsProvider(env = process.env) {
-    return env.PROJECT_ENV === cdk$1.CDK.ENV.SANDBOX;
-}
-function cleanName(name) {
-    return name.replace(/[^a-zA-Z0-9:-]/g, "");
-}
-function exportEnvName(name, env = process.env) {
-    let rawName;
-    if (checkEnvIsProvider(env)) {
-        rawName = `env-${env.PROJECT_ENV}-${env.PROJECT_KEY}-${name}`;
-        // Clean the entire name to only allow alphanumeric, colons, and hyphens
-        return cleanName(rawName);
-    }
-    else {
-        if (checkEnvIsConsumer(env)) {
-            rawName = `env-${cdk$1.CDK.ENV.SANDBOX}-${env.PROJECT_KEY}-${name}`;
-        }
-        else {
-            rawName = `env-${env.PROJECT_ENV}-${env.PROJECT_KEY}-${name}`;
-        }
-    }
-    return cleanName(rawName);
-}
-class JaypieEnvSecret extends constructs.Construct {
+class JaypieLambda extends constructs.Construct {
     constructor(scope, id, props) {
         super(scope, id);
-        const { consumer = checkEnvIsConsumer(), envKey, export: exportParam, provider = checkEnvIsProvider(), roleTag, vendorTag, value, } = props || {};
-        this._envKey = envKey;
-        let exportName;
-        if (!exportParam) {
-            exportName = exportEnvName(id);
-        }
-        else {
-            exportName = cleanName(exportParam);
-        }
-        if (consumer) {
-            const secretName = cdk.Fn.importValue(exportName);
-            this._secret = secretsmanager__namespace.Secret.fromSecretNameV2(this, id, secretName);
-            // Add CfnOutput for consumer secrets
-            new cdk.CfnOutput(this, `ConsumedName`, {
-                value: this._secret.secretName,
+        const { code, datadogApiKeyArn, environment: initialEnvironment = {}, envSecrets = {}, handler = "index.handler", layers = [], logRetention = cdk.CDK.LAMBDA.LOG_RETENTION, memorySize = cdk.CDK.LAMBDA.MEMORY_SIZE, paramsAndSecrets, paramsAndSecretsOptions, reservedConcurrentExecutions, roleTag, runtime = lambda__namespace.Runtime.NODEJS_20_X, secrets = [], timeout = cdk$1.Duration.seconds(cdk.CDK.DURATION.LAMBDA_WORKER), vendorTag, } = props;
+        // Create a mutable copy of the environment variables
+        let environment = { ...initialEnvironment };
+        this._code = typeof code === "string" ? lambda__namespace.Code.fromAsset(code) : code;
+        // Create a working copy of layers
+        const resolvedLayers = [...layers];
+        // Determine if we should add Datadog integration
+        // Check for datadog API key ARN in different sources
+        const resolvedDatadogApiKeyArn = datadogApiKeyArn ||
+            process.env.DATADOG_API_KEY_ARN ||
+            process.env.CDK_ENV_DATADOG_API_KEY_ARN;
+        // Add Datadog integration if API key is available
+        if (resolvedDatadogApiKeyArn) {
+            // Add Datadog Node.js layer
+            const datadogNodeLayer = lambda__namespace.LayerVersion.fromLayerVersionArn(this, "DatadogNodeLayer", `arn:aws:lambda:${cdk$1.Stack.of(this).region}:464622532012:layer:Datadog-Node20-x:${cdk.CDK.DATADOG.LAYER.NODE}`);
+            resolvedLayers.push(datadogNodeLayer);
+            // Add Datadog Extension layer
+            const datadogExtensionLayer = lambda__namespace.LayerVersion.fromLayerVersionArn(this, "DatadogExtensionLayer", `arn:aws:lambda:${cdk$1.Stack.of(this).region}:464622532012:layer:Datadog-Extension:${cdk.CDK.DATADOG.LAYER.EXTENSION}`);
+            resolvedLayers.push(datadogExtensionLayer);
+            // Set Datadog environment variables
+            Object.assign(environment, {
+                DD_API_KEY_SECRET_ARN: resolvedDatadogApiKeyArn,
+                DD_ENV: process.env.PROJECT_ENV || "",
+                DD_SERVICE: process.env.PROJECT_SERVICE || "",
+                DD_SITE: cdk.CDK.DATADOG.SITE,
+                DD_TAGS: `${cdk.CDK.TAG.SPONSOR}:${process.env.PROJECT_SPONSOR || ""}`,
             });
         }
-        else {
-            const secretValue = envKey && process.env[envKey] ? process.env[envKey] : value;
-            const secretProps = {
-                secretStringValue: secretValue
-                    ? cdk.SecretValue.unsafePlainText(secretValue)
-                    : undefined,
-            };
-            this._secret = new secretsmanager__namespace.Secret(this, id, secretProps);
-            if (roleTag) {
-                cdk.Tags.of(this._secret).add(cdk$1.CDK.TAG.ROLE, roleTag);
-            }
-            if (vendorTag) {
-                cdk.Tags.of(this._secret).add(cdk$1.CDK.TAG.VENDOR, vendorTag);
-            }
-            if (provider) {
-                new cdk.CfnOutput(this, `ProvidedName`, {
-                    value: this._secret.secretName,
-                    exportName,
-                });
+        // Configure ParamsAndSecrets layer
+        let resolvedParamsAndSecrets = undefined;
+        if (paramsAndSecrets !== false) {
+            if (paramsAndSecrets instanceof lambda__namespace.ParamsAndSecretsLayerVersion) {
+                resolvedParamsAndSecrets = paramsAndSecrets;
             }
             else {
-                new cdk.CfnOutput(this, `CreatedName`, {
-                    value: this._secret.secretName,
-                });
+                // Create default ParamsAndSecrets layer
+                resolvedParamsAndSecrets =
+                    lambda__namespace.ParamsAndSecretsLayerVersion.fromVersion(lambda__namespace.ParamsAndSecretsVersions.V1_0_103, {
+                        cacheSize: paramsAndSecretsOptions?.cacheSize,
+                        logLevel: paramsAndSecretsOptions?.logLevel ||
+                            lambda__namespace.ParamsAndSecretsLogLevel.WARN,
+                        parameterStoreTtl: paramsAndSecretsOptions?.parameterStoreTtl,
+                        secretsManagerTtl: paramsAndSecretsOptions?.secretsManagerTtl,
+                    });
             }
         }
-    }
-    // IResource implementation
-    get stack() {
-        return cdk.Stack.of(this);
-    }
-    get env() {
-        return {
-            account: cdk.Stack.of(this).account,
-            region: cdk.Stack.of(this).region,
-        };
-    }
-    applyRemovalPolicy(policy) {
-        this._secret.applyRemovalPolicy(policy);
-    }
-    // ISecret implementation
-    get secretArn() {
-        return this._secret.secretArn;
-    }
-    get secretName() {
-        return this._secret.secretName;
-    }
-    get secretFullArn() {
-        return this._secret.secretFullArn;
-    }
-    get encryptionKey() {
-        return this._secret.encryptionKey;
-    }
-    get secretValue() {
-        return this._secret.secretValue;
-    }
-    secretValueFromJson(key) {
-        return this._secret.secretValueFromJson(key);
-    }
-    grantRead(grantee, versionStages) {
-        return this._secret.grantRead(grantee, versionStages);
-    }
-    grantWrite(grantee) {
-        return this._secret.grantWrite(grantee);
-    }
-    addRotationSchedule(id, options) {
-        return this._secret.addRotationSchedule(id, options);
-    }
-    addToResourcePolicy(statement) {
-        return this._secret.addToResourcePolicy(statement);
-    }
-    denyAccountRootDelete() {
-        this._secret.denyAccountRootDelete();
-    }
-    attach(target) {
-        return this._secret.attach(target);
-    }
-    get envKey() {
-        return this._envKey;
-    }
-}
-
-const SERVICE = {
-    ROUTE53: "route53.amazonaws.com",
-};
-class JaypieHostedZone extends constructs.Construct {
-    /**
-     * Create a new hosted zone with query logging
-     */
-    constructor(scope, id, props) {
-        super(scope, id);
-        const { destination, zoneName, project } = props;
-        const service = props.service || cdk$1.CDK.SERVICE.INFRASTRUCTURE;
-        // Create the log group
-        this.logGroup = new awsLogs.LogGroup(this, "LogGroup", {
-            logGroupName: process.env.PROJECT_NONCE
-                ? `/aws/route53/${zoneName}-${process.env.PROJECT_NONCE}`
-                : `/aws/route53/${zoneName}`,
-            retention: awsLogs.RetentionDays.ONE_WEEK,
-        });
-        // Add tags
-        cdk__namespace.Tags.of(this.logGroup).add(cdk$1.CDK.TAG.SERVICE, service);
-        cdk__namespace.Tags.of(this.logGroup).add(cdk$1.CDK.TAG.ROLE, cdk$1.CDK.ROLE.NETWORKING);
-        if (project) {
-            cdk__namespace.Tags.of(this.logGroup).add(cdk$1.CDK.TAG.PROJECT, project);
-        }
-        // Grant Route 53 permissions to write to the log group
-        this.logGroup.grantWrite(new awsIam.ServicePrincipal(SERVICE.ROUTE53));
-        // Add destination if provided
-        if (destination) {
-            this.logGroup.addSubscriptionFilter("DatadogLambdaDestination", {
-                destination,
-                filterPattern: awsLogs.FilterPattern.allEvents(),
-            });
-        }
-        // Create the hosted zone
-        this.hostedZone = new awsRoute53.HostedZone(this, "HostedZone", {
-            queryLogsLogGroupArn: this.logGroup.logGroupArn,
-            zoneName,
-        });
-        // Add tags
-        cdk__namespace.Tags.of(this.hostedZone).add(cdk$1.CDK.TAG.SERVICE, service);
-        cdk__namespace.Tags.of(this.hostedZone).add(cdk$1.CDK.TAG.ROLE, cdk$1.CDK.ROLE.NETWORKING);
-        if (project) {
-            cdk__namespace.Tags.of(this.hostedZone).add(cdk$1.CDK.TAG.PROJECT, project);
-        }
-    }
-}
-
-class JaypieMongoDbSecret extends JaypieEnvSecret {
-    constructor(scope, id = "MongoConnectionString", props) {
-        const defaultProps = {
-            envKey: "MONGODB_URI",
-            roleTag: cdk$1.CDK.ROLE.STORAGE,
-            vendorTag: cdk$1.CDK.VENDOR.MONGODB,
-            ...props,
-        };
-        super(scope, id, defaultProps);
-    }
-}
-
-class JaypieOpenAiSecret extends JaypieEnvSecret {
-    constructor(scope, id = "OpenAiApiKey", props) {
-        const defaultProps = {
-            envKey: "OPENAI_API_KEY",
-            roleTag: cdk$1.CDK.ROLE.PROCESSING,
-            vendorTag: cdk$1.CDK.VENDOR.OPENAI,
-            ...props,
-        };
-        super(scope, id, defaultProps);
-    }
-}
-
-class JaypieQueuedLambda extends constructs.Construct {
-    constructor(scope, id, props) {
-        super(scope, id);
-        const { batchSize = 1, code, environment = {}, envSecrets = {}, fifo = true, handler = "index.handler", layers = [], logRetention = cdk$1.CDK.LAMBDA.LOG_RETENTION, memorySize = cdk$1.CDK.LAMBDA.MEMORY_SIZE, paramsAndSecrets, reservedConcurrentExecutions, roleTag, runtime = lambda__namespace.Runtime.NODEJS_20_X, secrets = [], timeout = cdk.Duration.seconds(cdk$1.CDK.DURATION.LAMBDA_WORKER), vendorTag, visibilityTimeout = cdk.Duration.seconds(cdk$1.CDK.DURATION.LAMBDA_WORKER), } = props;
-        this._code = typeof code === "string" ? lambda__namespace.Code.fromAsset(code) : code;
-        // Create SQS Queue
-        this._queue = new sqs__namespace.Queue(this, "Queue", {
-            fifo,
-            visibilityTimeout: typeof visibilityTimeout === "number"
-                ? cdk.Duration.seconds(visibilityTimeout)
-                : visibilityTimeout,
-        });
-        if (roleTag) {
-            cdk.Tags.of(this._queue).add(cdk$1.CDK.TAG.ROLE, roleTag);
-        }
-        if (vendorTag) {
-            cdk.Tags.of(this._queue).add(cdk$1.CDK.TAG.VENDOR, vendorTag);
-        }
         // Process secrets environment variables
         const secretsEnvironment = Object.entries(envSecrets).reduce((acc, [key, secret]) => ({
             ...acc,
@@ -276,19 +108,18 @@ class JaypieQueuedLambda extends constructs.Construct {
         this._lambda = new lambda__namespace.Function(this, "Function", {
             code: this._code,
             environment: {
-                CDK_ENV_QUEUE_URL: this._queue.queueUrl,
                 ...environment,
                 ...secretsEnvironment,
                 ...jaypieSecretsEnvironment,
             },
             handler,
-            layers,
+            layers: resolvedLayers,
             logRetention,
             memorySize,
-            paramsAndSecrets,
+            paramsAndSecrets: resolvedParamsAndSecrets,
             reservedConcurrentExecutions,
             runtime,
-            timeout: typeof timeout === "number" ? cdk.Duration.seconds(timeout) : timeout,
+            timeout: typeof timeout === "number" ? cdk$1.Duration.seconds(timeout) : timeout,
         });
         // Grant secret read permissions
         Object.values(envSecrets).forEach((secret) => {
@@ -299,22 +130,19 @@ class JaypieQueuedLambda extends constructs.Construct {
             secret.grantRead(this);
             secret.grantRead(this._lambda);
         });
-        this._queue.grantConsumeMessages(this._lambda);
-        this._queue.grantSendMessages(this._lambda);
-        this._lambda.addEventSource(new lambdaEventSources__namespace.SqsEventSource(this._queue, {
-            batchSize,
-        }));
+        // Grant Datadog API key read permission if applicable
+        if (resolvedDatadogApiKeyArn) {
+            const datadogApiKey = secretsmanager__namespace.Secret.fromSecretCompleteArn(this, "DatadogApiKeyGrant", resolvedDatadogApiKeyArn);
+            datadogApiKey.grantRead(this._lambda);
+        }
         if (roleTag) {
-            cdk.Tags.of(this._lambda).add(cdk$1.CDK.TAG.ROLE, roleTag);
+            cdk$1.Tags.of(this._lambda).add(cdk.CDK.TAG.ROLE, roleTag);
         }
         if (vendorTag) {
-            cdk.Tags.of(this._lambda).add(cdk$1.CDK.TAG.VENDOR, vendorTag);
+            cdk$1.Tags.of(this._lambda).add(cdk.CDK.TAG.VENDOR, vendorTag);
         }
     }
     // Public accessors
-    get queue() {
-        return this._queue;
-    }
     get lambda() {
         return this._lambda;
     }
@@ -403,8 +231,8 @@ class JaypieQueuedLambda extends constructs.Construct {
     }
     get env() {
         return {
-            account: cdk.Stack.of(this).account,
-            region: cdk.Stack.of(this).region,
+            account: cdk$1.Stack.of(this).account,
+            region: cdk$1.Stack.of(this).region,
         };
     }
     get stack() {
@@ -412,29 +240,177 @@ class JaypieQueuedLambda extends constructs.Construct {
     }
     applyRemovalPolicy(policy) {
         this._lambda.applyRemovalPolicy(policy);
-        this._queue.applyRemovalPolicy(policy);
     }
-    // IQueue implementation
-    get fifo() {
-        return this._queue.fifo;
+}
+
+class JaypieQueuedLambda extends constructs.Construct {
+    constructor(scope, id, props) {
+        super(scope, id);
+        const { batchSize = 1, code, environment = {}, envSecrets = {}, fifo = true, handler = "index.handler", layers = [], logRetention = cdk.CDK.LAMBDA.LOG_RETENTION, memorySize = cdk.CDK.LAMBDA.MEMORY_SIZE, paramsAndSecrets, reservedConcurrentExecutions, roleTag, runtime = lambda__namespace.Runtime.NODEJS_20_X, secrets = [], timeout = cdk$1.Duration.seconds(cdk.CDK.DURATION.LAMBDA_WORKER), vendorTag, visibilityTimeout = cdk$1.Duration.seconds(cdk.CDK.DURATION.LAMBDA_WORKER), } = props;
+        // Create SQS Queue
+        this._queue = new sqs__namespace.Queue(this, "Queue", {
+            fifo,
+            visibilityTimeout: typeof visibilityTimeout === "number"
+                ? cdk$1.Duration.seconds(visibilityTimeout)
+                : visibilityTimeout,
+        });
+        if (roleTag) {
+            cdk$1.Tags.of(this._queue).add(cdk.CDK.TAG.ROLE, roleTag);
+        }
+        if (vendorTag) {
+            cdk$1.Tags.of(this._queue).add(cdk.CDK.TAG.VENDOR, vendorTag);
+        }
+        // Create Lambda with JaypieLambda
+        this._lambdaConstruct = new JaypieLambda(this, "Function", {
+            code,
+            environment: {
+                ...environment,
+                CDK_ENV_QUEUE_URL: this._queue.queueUrl,
+            },
+            envSecrets,
+            handler,
+            layers,
+            logRetention,
+            memorySize,
+            paramsAndSecrets,
+            reservedConcurrentExecutions,
+            roleTag,
+            runtime,
+            secrets,
+            timeout,
+            vendorTag,
+        });
+        // Set up queue and lambda integration
+        this._queue.grantConsumeMessages(this._lambdaConstruct);
+        this._queue.grantSendMessages(this._lambdaConstruct);
+        this._lambdaConstruct.addEventSource(new lambdaEventSources__namespace.SqsEventSource(this._queue, {
+            batchSize,
+        }));
     }
-    get queueArn() {
-        return this._queue.queueArn;
+    // Public accessors
+    get queue() {
+        return this._queue;
     }
-    get queueName() {
-        return this._queue.queueName;
+    get lambda() {
+        return this._lambdaConstruct.lambda;
     }
-    get queueUrl() {
-        return this._queue.queueUrl;
+    get code() {
+        return this._lambdaConstruct.code;
     }
-    get encryptionMasterKey() {
-        return this._queue.encryptionMasterKey;
+    // IFunction implementation
+    get functionArn() {
+        return this._lambdaConstruct.functionArn;
     }
-    addToResourcePolicy(statement) {
-        return this._queue.addToResourcePolicy(statement);
+    get functionName() {
+        return this._lambdaConstruct.functionName;
     }
-    grant(grantee, ...actions) {
-        return this._queue.grant(grantee, ...actions);
+    get grantPrincipal() {
+        return this._lambdaConstruct.grantPrincipal;
+    }
+    get role() {
+        return this._lambdaConstruct.role;
+    }
+    get architecture() {
+        return this._lambdaConstruct.architecture;
+    }
+    get connections() {
+        return this._lambdaConstruct.connections;
+    }
+    get isBoundToVpc() {
+        return this._lambdaConstruct.isBoundToVpc;
+    }
+    get latestVersion() {
+        return this._lambdaConstruct.latestVersion;
+    }
+    get permissionsNode() {
+        return this._lambdaConstruct.permissionsNode;
+    }
+    get resourceArnsForGrantInvoke() {
+        return this._lambdaConstruct.resourceArnsForGrantInvoke;
+    }
+    addEventSource(source) {
+        this._lambdaConstruct.addEventSource(source);
+    }
+    addEventSourceMapping(id, options) {
+        return this._lambdaConstruct.addEventSourceMapping(id, options);
+    }
+    addFunctionUrl(options) {
+        return this._lambdaConstruct.addFunctionUrl(options);
+    }
+    addPermission(id, permission) {
+        this._lambdaConstruct.addPermission(id, permission);
+    }
+    addToRolePolicy(statement) {
+        this._lambdaConstruct.addToRolePolicy(statement);
+    }
+    configureAsyncInvoke(options) {
+        this._lambdaConstruct.configureAsyncInvoke(options);
+    }
+    grantInvoke(grantee) {
+        return this._lambdaConstruct.grantInvoke(grantee);
+    }
+    grantInvokeCompositePrincipal(compositePrincipal) {
+        return this._lambdaConstruct.grantInvokeCompositePrincipal(compositePrincipal);
+    }
+    grantInvokeUrl(grantee) {
+        return this._lambdaConstruct.grantInvokeUrl(grantee);
+    }
+    metric(metricName, props) {
+        return this._lambdaConstruct.metric(metricName, props);
+    }
+    metricDuration(props) {
+        return this._lambdaConstruct.metricDuration(props);
+    }
+    metricErrors(props) {
+        return this._lambdaConstruct.metricErrors(props);
+    }
+    metricInvocations(props) {
+        return this._lambdaConstruct.metricInvocations(props);
+    }
+    metricThrottles(props) {
+        return this._lambdaConstruct.metricThrottles(props);
+    }
+    // Additional IFunction implementation
+    grantInvokeLatestVersion(grantee) {
+        return this._lambdaConstruct.grantInvokeLatestVersion(grantee);
+    }
+    grantInvokeVersion(grantee, version) {
+        return this._lambdaConstruct.grantInvokeVersion(grantee, version);
+    }
+    get env() {
+        return {
+            account: cdk$1.Stack.of(this).account,
+            region: cdk$1.Stack.of(this).region,
+        };
+    }
+    get stack() {
+        return cdk$1.Stack.of(this);
+    }
+    applyRemovalPolicy(policy) {
+        this._lambdaConstruct.applyRemovalPolicy(policy);
+        this._queue.applyRemovalPolicy(policy);
+    }
+    // IQueue implementation
+    get fifo() {
+        return this._queue.fifo;
+    }
+    get queueArn() {
+        return this._queue.queueArn;
+    }
+    get queueName() {
+        return this._queue.queueName;
+    }
+    get queueUrl() {
+        return this._queue.queueUrl;
+    }
+    get encryptionMasterKey() {
+        return this._queue.encryptionMasterKey;
+    }
+    addToResourcePolicy(statement) {
+        return this._queue.addToResourcePolicy(statement);
+    }
+    grant(grantee, ...actions) {
+        return this._queue.grant(grantee, ...actions);
     }
     grantConsumeMessages(grantee) {
         return this._queue.grantConsumeMessages(grantee);
@@ -475,6 +451,387 @@ class JaypieQueuedLambda extends constructs.Construct {
     }
 }
 
+class JaypieBucketQueuedLambda extends JaypieQueuedLambda {
+    constructor(scope, id, props) {
+        super(scope, id, props);
+        const { bucketName, roleTag, vendorTag, bucketOptions = {} } = props;
+        // Create S3 Bucket
+        this._bucket = new s3__namespace.Bucket(this, "Bucket", {
+            bucketName: bucketOptions.bucketName || bucketName,
+            removalPolicy: bucketOptions.removalPolicy || cdk$1.RemovalPolicy.RETAIN,
+            ...bucketOptions,
+        });
+        // Add tags to bucket
+        if (roleTag) {
+            cdk$1.Tags.of(this._bucket).add(cdk.CDK.TAG.ROLE, roleTag);
+        }
+        if (vendorTag) {
+            cdk$1.Tags.of(this._bucket).add(cdk.CDK.TAG.VENDOR, vendorTag);
+        }
+        // Add an event notification from the bucket to the queue
+        this._bucket.addEventNotification(s3__namespace.EventType.OBJECT_CREATED, new s3n__namespace.SqsDestination(this.queue));
+        // Grant the lambda access to the bucket
+        this._bucket.grantReadWrite(this);
+        // Add environment variable for bucket name
+        this.lambda.addEnvironment("CDK_ENV_BUCKET_NAME", this._bucket.bucketName);
+    }
+    // Public accessors
+    get bucket() {
+        return this._bucket;
+    }
+    // IBucket implementation
+    get bucketArn() {
+        return this._bucket.bucketArn;
+    }
+    get bucketDomainName() {
+        return this._bucket.bucketDomainName;
+    }
+    get bucketDualStackDomainName() {
+        return this._bucket.bucketDualStackDomainName;
+    }
+    get bucketName() {
+        return this._bucket.bucketName;
+    }
+    get bucketRegionalDomainName() {
+        return this._bucket.bucketRegionalDomainName;
+    }
+    get bucketWebsiteDomainName() {
+        return this._bucket.bucketWebsiteDomainName;
+    }
+    get bucketWebsiteUrl() {
+        return this._bucket.bucketWebsiteUrl;
+    }
+    get encryptionKey() {
+        return this._bucket.encryptionKey;
+    }
+    get isWebsite() {
+        return this._bucket.isWebsite || false;
+    }
+    get policy() {
+        return this._bucket.policy;
+    }
+    addEventNotification(event, dest, filters) {
+        this._bucket.addEventNotification(event, dest, ...filters);
+    }
+    addObjectCreatedNotification(dest, ...filters) {
+        this._bucket.addObjectCreatedNotification(dest, ...filters);
+    }
+    addObjectRemovedNotification(dest, ...filters) {
+        this._bucket.addObjectRemovedNotification(dest, ...filters);
+    }
+    addToResourcePolicy(permission) {
+        return this._bucket.addToResourcePolicy(permission);
+    }
+    arnForObjects(objectKeyPattern) {
+        return this._bucket.arnForObjects(objectKeyPattern);
+    }
+    enableEventBridgeNotification() {
+        this._bucket.enableEventBridgeNotification();
+    }
+    grant(grantee, ...actions) {
+        return this._bucket.grant(grantee, ...actions);
+    }
+    grantDelete(grantee, objectsKeyPattern) {
+        return this._bucket.grantDelete(grantee, objectsKeyPattern);
+    }
+    grantPublicAccess(keyPrefix, ...allowedActions) {
+        return this._bucket.grantPublicAccess(keyPrefix, ...allowedActions);
+    }
+    grantPut(grantee, objectsKeyPattern) {
+        return this._bucket.grantPut(grantee, objectsKeyPattern);
+    }
+    grantPutAcl(grantee, objectsKeyPattern) {
+        return this._bucket.grantPutAcl(grantee, objectsKeyPattern);
+    }
+    grantRead(grantee, objectsKeyPattern) {
+        return this._bucket.grantRead(grantee, objectsKeyPattern);
+    }
+    grantReadWrite(grantee, objectsKeyPattern) {
+        return this._bucket.grantReadWrite(grantee, objectsKeyPattern);
+    }
+    grantWrite(grantee, objectsKeyPattern) {
+        return this._bucket.grantWrite(grantee, objectsKeyPattern);
+    }
+    onCloudTrailEvent(id, options) {
+        return this._bucket.onCloudTrailEvent(id, options);
+    }
+    onCloudTrailPutObject(id, options) {
+        return this._bucket.onCloudTrailPutObject(id, options);
+    }
+    onCloudTrailWriteObject(id, options) {
+        return this._bucket.onCloudTrailWriteObject(id, options);
+    }
+    s3UrlForObject(key) {
+        return this._bucket.s3UrlForObject(key);
+    }
+    transferAccelerationUrlForObject(key, options) {
+        return this._bucket.transferAccelerationUrlForObject(key, options);
+    }
+    urlForObject(key) {
+        return this._bucket.urlForObject(key);
+    }
+    virtualHostedUrlForObject(key, options) {
+        return this._bucket.virtualHostedUrlForObject(key, options);
+    }
+    // Bucket metrics
+    metricAllRequests(props) {
+        return this._bucket.metricAllRequests(props);
+    }
+    metricBucketSizeBytes(props) {
+        return this._bucket.metricBucketSizeBytes(props);
+    }
+    metricDeleteRequests(props) {
+        return this._bucket.metricDeleteRequests(props);
+    }
+    metricDownloadBytes(props) {
+        return this._bucket.metricDownloadBytes(props);
+    }
+    metricFirstByteLatency(props) {
+        return this._bucket.metricFirstByteLatency(props);
+    }
+    metricGetRequests(props) {
+        return this._bucket.metricGetRequests(props);
+    }
+    metricHeadRequests(props) {
+        return this._bucket.metricHeadRequests(props);
+    }
+    metricHttpRequests(props) {
+        return this._bucket.metricHttpRequests(props);
+    }
+    metricListRequests(props) {
+        return this._bucket.metricListRequests(props);
+    }
+    metricNumberOfObjects(props) {
+        return this._bucket.metricNumberOfObjects(props);
+    }
+    metricPostRequests(props) {
+        return this._bucket.metricPostRequests(props);
+    }
+    metricPutRequests(props) {
+        return this._bucket.metricPutRequests(props);
+    }
+    metricSelectRequests(props) {
+        return this._bucket.metricSelectRequests(props);
+    }
+    metricSelectScannedBytes(props) {
+        return this._bucket.metricSelectScannedBytes(props);
+    }
+    metricUploadBytes(props) {
+        return this._bucket.metricUploadBytes(props);
+    }
+    metricSelectReturnedBytes(props) {
+        return this._bucket.metricSelectReturnedBytes(props);
+    }
+    // Override applyRemovalPolicy to apply to all resources
+    applyRemovalPolicy(policy) {
+        super.applyRemovalPolicy(policy);
+        this._bucket.applyRemovalPolicy(policy);
+    }
+}
+
+// It is a consumer if the environment is ephemeral
+function checkEnvIsConsumer(env = process.env) {
+    return (env.PROJECT_ENV === cdk.CDK.ENV.PERSONAL ||
+        !!env.CDK_ENV_PERSONAL ||
+        /** @deprecated */ env.PROJECT_ENV === "ephemeral" ||
+        /** @deprecated */ !!env.CDK_ENV_EPHEMERAL);
+}
+function checkEnvIsProvider(env = process.env) {
+    return env.PROJECT_ENV === cdk.CDK.ENV.SANDBOX;
+}
+function cleanName(name) {
+    return name.replace(/[^a-zA-Z0-9:-]/g, "");
+}
+function exportEnvName(name, env = process.env) {
+    let rawName;
+    if (checkEnvIsProvider(env)) {
+        rawName = `env-${env.PROJECT_ENV}-${env.PROJECT_KEY}-${name}`;
+        // Clean the entire name to only allow alphanumeric, colons, and hyphens
+        return cleanName(rawName);
+    }
+    else {
+        if (checkEnvIsConsumer(env)) {
+            rawName = `env-${cdk.CDK.ENV.SANDBOX}-${env.PROJECT_KEY}-${name}`;
+        }
+        else {
+            rawName = `env-${env.PROJECT_ENV}-${env.PROJECT_KEY}-${name}`;
+        }
+    }
+    return cleanName(rawName);
+}
+class JaypieEnvSecret extends constructs.Construct {
+    constructor(scope, id, props) {
+        super(scope, id);
+        const { consumer = checkEnvIsConsumer(), envKey, export: exportParam, provider = checkEnvIsProvider(), roleTag, vendorTag, value, } = props || {};
+        this._envKey = envKey;
+        let exportName;
+        if (!exportParam) {
+            exportName = exportEnvName(id);
+        }
+        else {
+            exportName = cleanName(exportParam);
+        }
+        if (consumer) {
+            const secretName = cdk$1.Fn.importValue(exportName);
+            this._secret = secretsmanager__namespace.Secret.fromSecretNameV2(this, id, secretName);
+            // Add CfnOutput for consumer secrets
+            new cdk$1.CfnOutput(this, `ConsumedName`, {
+                value: this._secret.secretName,
+            });
+        }
+        else {
+            const secretValue = envKey && process.env[envKey] ? process.env[envKey] : value;
+            const secretProps = {
+                secretStringValue: secretValue
+                    ? cdk$1.SecretValue.unsafePlainText(secretValue)
+                    : undefined,
+            };
+            this._secret = new secretsmanager__namespace.Secret(this, id, secretProps);
+            if (roleTag) {
+                cdk$1.Tags.of(this._secret).add(cdk.CDK.TAG.ROLE, roleTag);
+            }
+            if (vendorTag) {
+                cdk$1.Tags.of(this._secret).add(cdk.CDK.TAG.VENDOR, vendorTag);
+            }
+            if (provider) {
+                new cdk$1.CfnOutput(this, `ProvidedName`, {
+                    value: this._secret.secretName,
+                    exportName,
+                });
+            }
+            else {
+                new cdk$1.CfnOutput(this, `CreatedName`, {
+                    value: this._secret.secretName,
+                });
+            }
+        }
+    }
+    // IResource implementation
+    get stack() {
+        return cdk$1.Stack.of(this);
+    }
+    get env() {
+        return {
+            account: cdk$1.Stack.of(this).account,
+            region: cdk$1.Stack.of(this).region,
+        };
+    }
+    applyRemovalPolicy(policy) {
+        this._secret.applyRemovalPolicy(policy);
+    }
+    // ISecret implementation
+    get secretArn() {
+        return this._secret.secretArn;
+    }
+    get secretName() {
+        return this._secret.secretName;
+    }
+    get secretFullArn() {
+        return this._secret.secretFullArn;
+    }
+    get encryptionKey() {
+        return this._secret.encryptionKey;
+    }
+    get secretValue() {
+        return this._secret.secretValue;
+    }
+    secretValueFromJson(key) {
+        return this._secret.secretValueFromJson(key);
+    }
+    grantRead(grantee, versionStages) {
+        return this._secret.grantRead(grantee, versionStages);
+    }
+    grantWrite(grantee) {
+        return this._secret.grantWrite(grantee);
+    }
+    addRotationSchedule(id, options) {
+        return this._secret.addRotationSchedule(id, options);
+    }
+    addToResourcePolicy(statement) {
+        return this._secret.addToResourcePolicy(statement);
+    }
+    denyAccountRootDelete() {
+        this._secret.denyAccountRootDelete();
+    }
+    attach(target) {
+        return this._secret.attach(target);
+    }
+    get envKey() {
+        return this._envKey;
+    }
+}
+
+const SERVICE = {
+    ROUTE53: "route53.amazonaws.com",
+};
+class JaypieHostedZone extends constructs.Construct {
+    /**
+     * Create a new hosted zone with query logging
+     */
+    constructor(scope, id, props) {
+        super(scope, id);
+        const { destination, zoneName, project } = props;
+        const service = props.service || cdk.CDK.SERVICE.INFRASTRUCTURE;
+        // Create the log group
+        this.logGroup = new awsLogs.LogGroup(this, "LogGroup", {
+            logGroupName: process.env.PROJECT_NONCE
+                ? `/aws/route53/${zoneName}-${process.env.PROJECT_NONCE}`
+                : `/aws/route53/${zoneName}`,
+            retention: awsLogs.RetentionDays.ONE_WEEK,
+        });
+        // Add tags
+        cdk__namespace.Tags.of(this.logGroup).add(cdk.CDK.TAG.SERVICE, service);
+        cdk__namespace.Tags.of(this.logGroup).add(cdk.CDK.TAG.ROLE, cdk.CDK.ROLE.NETWORKING);
+        if (project) {
+            cdk__namespace.Tags.of(this.logGroup).add(cdk.CDK.TAG.PROJECT, project);
+        }
+        // Grant Route 53 permissions to write to the log group
+        this.logGroup.grantWrite(new awsIam.ServicePrincipal(SERVICE.ROUTE53));
+        // Add destination if provided
+        if (destination) {
+            this.logGroup.addSubscriptionFilter("DatadogLambdaDestination", {
+                destination,
+                filterPattern: awsLogs.FilterPattern.allEvents(),
+            });
+        }
+        // Create the hosted zone
+        this.hostedZone = new awsRoute53.HostedZone(this, "HostedZone", {
+            queryLogsLogGroupArn: this.logGroup.logGroupArn,
+            zoneName,
+        });
+        // Add tags
+        cdk__namespace.Tags.of(this.hostedZone).add(cdk.CDK.TAG.SERVICE, service);
+        cdk__namespace.Tags.of(this.hostedZone).add(cdk.CDK.TAG.ROLE, cdk.CDK.ROLE.NETWORKING);
+        if (project) {
+            cdk__namespace.Tags.of(this.hostedZone).add(cdk.CDK.TAG.PROJECT, project);
+        }
+    }
+}
+
+class JaypieMongoDbSecret extends JaypieEnvSecret {
+    constructor(scope, id = "MongoConnectionString", props) {
+        const defaultProps = {
+            envKey: "MONGODB_URI",
+            roleTag: cdk.CDK.ROLE.STORAGE,
+            vendorTag: cdk.CDK.VENDOR.MONGODB,
+            ...props,
+        };
+        super(scope, id, defaultProps);
+    }
+}
+
+class JaypieOpenAiSecret extends JaypieEnvSecret {
+    constructor(scope, id = "OpenAiApiKey", props) {
+        const defaultProps = {
+            envKey: "OPENAI_API_KEY",
+            roleTag: cdk.CDK.ROLE.PROCESSING,
+            vendorTag: cdk.CDK.VENDOR.OPENAI,
+            ...props,
+        };
+        super(scope, id, defaultProps);
+    }
+}
+
 /**
  * Permission set types with corresponding AWS managed policies
  */
@@ -528,11 +885,11 @@ class JaypieSsoGroups extends constructs.Construct {
             instanceArn: this.instanceArn,
             name: exports.PermissionSetType.ADMINISTRATOR,
             description: "Full administrative access to all AWS services and resources",
-            sessionDuration: cdk.Duration.hours(8).toIsoString(),
+            sessionDuration: cdk$1.Duration.hours(8).toIsoString(),
             managedPolicies: ["arn:aws:iam::aws:policy/AdministratorAccess"],
             inlinePolicy: mergedPolicy,
         });
-        cdk.Tags.of(permissionSet).add(cdk$1.CDK.TAG.SERVICE, cdk$1.CDK.SERVICE.SSO);
+        cdk$1.Tags.of(permissionSet).add(cdk.CDK.TAG.SERVICE, cdk.CDK.SERVICE.SSO);
         this.permissionSets[exports.PermissionSetType.ADMINISTRATOR] = permissionSet;
     }
     /**
@@ -565,11 +922,11 @@ class JaypieSsoGroups extends constructs.Construct {
             instanceArn: this.instanceArn,
             name: exports.PermissionSetType.ANALYST,
             description: "Read-only access with billing visibility and limited write access",
-            sessionDuration: cdk.Duration.hours(4).toIsoString(),
+            sessionDuration: cdk$1.Duration.hours(4).toIsoString(),
             managedPolicies: ["arn:aws:iam::aws:policy/ReadOnlyAccess"],
             inlinePolicy: mergedPolicy,
         });
-        cdk.Tags.of(permissionSet).add(cdk$1.CDK.TAG.SERVICE, cdk$1.CDK.SERVICE.SSO);
+        cdk$1.Tags.of(permissionSet).add(cdk.CDK.TAG.SERVICE, cdk.CDK.SERVICE.SSO);
         this.permissionSets[exports.PermissionSetType.ANALYST] = permissionSet;
     }
     /**
@@ -617,13 +974,13 @@ class JaypieSsoGroups extends constructs.Construct {
             instanceArn: this.instanceArn,
             name: exports.PermissionSetType.DEVELOPER,
             description: "System administrator access with expanded write permissions",
-            sessionDuration: cdk.Duration.hours(8).toIsoString(),
+            sessionDuration: cdk$1.Duration.hours(8).toIsoString(),
             managedPolicies: [
                 "arn:aws:iam::aws:policy/job-function/SystemAdministrator",
             ],
             inlinePolicy: mergedPolicy,
         });
-        cdk.Tags.of(permissionSet).add(cdk$1.CDK.TAG.SERVICE, cdk$1.CDK.SERVICE.SSO);
+        cdk$1.Tags.of(permissionSet).add(cdk.CDK.TAG.SERVICE, cdk.CDK.SERVICE.SSO);
         this.permissionSets[exports.PermissionSetType.DEVELOPER] = permissionSet;
     }
     /**
@@ -690,8 +1047,8 @@ class JaypieSsoGroups extends constructs.Construct {
                 targetId: accountId,
                 targetType: "AWS_ACCOUNT",
             });
-            cdk.Tags.of(assignment).add(cdk$1.CDK.TAG.SERVICE, cdk$1.CDK.SERVICE.SSO);
-            cdk.Tags.of(assignment).add("Group", "administrators");
+            cdk$1.Tags.of(assignment).add(cdk.CDK.TAG.SERVICE, cdk.CDK.SERVICE.SSO);
+            cdk$1.Tags.of(assignment).add("Group", "administrators");
         });
     }
     /**
@@ -717,8 +1074,8 @@ class JaypieSsoGroups extends constructs.Construct {
                 targetId: accountId,
                 targetType: "AWS_ACCOUNT",
             });
-            cdk.Tags.of(assignment).add(cdk$1.CDK.TAG.SERVICE, cdk$1.CDK.SERVICE.SSO);
-            cdk.Tags.of(assignment).add("Group", "analysts");
+            cdk$1.Tags.of(assignment).add(cdk.CDK.TAG.SERVICE, cdk.CDK.SERVICE.SSO);
+            cdk$1.Tags.of(assignment).add("Group", "analysts");
         });
     }
     /**
@@ -743,8 +1100,8 @@ class JaypieSsoGroups extends constructs.Construct {
                 targetId: accountId,
                 targetType: "AWS_ACCOUNT",
             });
-            cdk.Tags.of(assignment).add(cdk$1.CDK.TAG.SERVICE, cdk$1.CDK.SERVICE.SSO);
-            cdk.Tags.of(assignment).add("Group", "developers");
+            cdk$1.Tags.of(assignment).add(cdk.CDK.TAG.SERVICE, cdk.CDK.SERVICE.SSO);
+            cdk$1.Tags.of(assignment).add("Group", "developers");
         });
     }
 }
@@ -753,16 +1110,18 @@ class JaypieTraceSigningKeySecret extends JaypieEnvSecret {
     constructor(scope, id = "TraceSigningKey", props) {
         const defaultProps = {
             envKey: "TRACE_SIGNING_KEY",
-            roleTag: cdk$1.CDK.ROLE.API,
-            vendorTag: cdk$1.CDK.VENDOR.KNOWTRACE,
+            roleTag: cdk.CDK.ROLE.API,
+            vendorTag: cdk.CDK.VENDOR.KNOWTRACE,
             ...props,
         };
         super(scope, id, defaultProps);
     }
 }
 
+exports.JaypieBucketQueuedLambda = JaypieBucketQueuedLambda;
 exports.JaypieEnvSecret = JaypieEnvSecret;
 exports.JaypieHostedZone = JaypieHostedZone;
+exports.JaypieLambda = JaypieLambda;
 exports.JaypieMongoDbSecret = JaypieMongoDbSecret;
 exports.JaypieOpenAiSecret = JaypieOpenAiSecret;
 exports.JaypieQueuedLambda = JaypieQueuedLambda;