@jaypie/constructs 1.1.22 → 1.1.24

package/dist/cjs/index.cjs

@@ -1,15 +1,17 @@
 'use strict';
 
+var cdk$1 = require('aws-cdk-lib');
+var s3 = require('aws-cdk-lib/aws-s3');
+var s3n = require('aws-cdk-lib/aws-s3-notifications');
+var cdk = require('@jaypie/cdk');
 var constructs = require('constructs');
-var cdk = require('aws-cdk-lib');
+var lambda = require('aws-cdk-lib/aws-lambda');
+var sqs = require('aws-cdk-lib/aws-sqs');
+var lambdaEventSources = require('aws-cdk-lib/aws-lambda-event-sources');
 var secretsmanager = require('aws-cdk-lib/aws-secretsmanager');
-var cdk$1 = require('@jaypie/cdk');
 var awsIam = require('aws-cdk-lib/aws-iam');
 var awsLogs = require('aws-cdk-lib/aws-logs');
 var awsRoute53 = require('aws-cdk-lib/aws-route53');
-var lambda = require('aws-cdk-lib/aws-lambda');
-var sqs = require('aws-cdk-lib/aws-sqs');
-var lambdaEventSources = require('aws-cdk-lib/aws-lambda-event-sources');
 var sso = require('aws-cdk-lib/aws-sso');
 
 function _interopNamespaceDefault(e) {
@@ -29,196 +31,19 @@ function _interopNamespaceDefault(e) {
     return Object.freeze(n);
 }
 
-var cdk__namespace = /*#__PURE__*/_interopNamespaceDefault(cdk);
-var secretsmanager__namespace = /*#__PURE__*/_interopNamespaceDefault(secretsmanager);
+var cdk__namespace = /*#__PURE__*/_interopNamespaceDefault(cdk$1);
+var s3__namespace = /*#__PURE__*/_interopNamespaceDefault(s3);
+var s3n__namespace = /*#__PURE__*/_interopNamespaceDefault(s3n);
 var lambda__namespace = /*#__PURE__*/_interopNamespaceDefault(lambda);
 var sqs__namespace = /*#__PURE__*/_interopNamespaceDefault(sqs);
 var lambdaEventSources__namespace = /*#__PURE__*/_interopNamespaceDefault(lambdaEventSources);
+var secretsmanager__namespace = /*#__PURE__*/_interopNamespaceDefault(secretsmanager);
 var sso__namespace = /*#__PURE__*/_interopNamespaceDefault(sso);
 
-// It is a consumer if the environment is ephemeral
-function checkEnvIsConsumer(env = process.env) {
-    return (env.PROJECT_ENV === cdk$1.CDK.ENV.PERSONAL ||
-        !!env.CDK_ENV_PERSONAL ||
-        /** @deprecated */ env.PROJECT_ENV === "ephemeral" ||
-        /** @deprecated */ !!env.CDK_ENV_EPHEMERAL);
-}
-function checkEnvIsProvider(env = process.env) {
-    return env.PROJECT_ENV === cdk$1.CDK.ENV.SANDBOX;
-}
-function cleanName(name) {
-    return name.replace(/[^a-zA-Z0-9:-]/g, "");
-}
-function exportEnvName(name, env = process.env) {
-    let rawName;
-    if (checkEnvIsProvider(env)) {
-        rawName = `env-${env.PROJECT_ENV}-${env.PROJECT_KEY}-${name}`;
-        // Clean the entire name to only allow alphanumeric, colons, and hyphens
-        return cleanName(rawName);
-    }
-    else {
-        if (checkEnvIsConsumer(env)) {
-            rawName = `env-${cdk$1.CDK.ENV.SANDBOX}-${env.PROJECT_KEY}-${name}`;
-        }
-        else {
-            rawName = `env-${env.PROJECT_ENV}-${env.PROJECT_KEY}-${name}`;
-        }
-    }
-    return cleanName(rawName);
-}
-class JaypieEnvSecret extends constructs.Construct {
-    constructor(scope, id, props) {
-        super(scope, id);
-        const { consumer = checkEnvIsConsumer(), envKey, export: exportParam, provider = checkEnvIsProvider(), roleTag, vendorTag, value, } = props || {};
-        this._envKey = envKey;
-        let exportName;
-        if (!exportParam) {
-            exportName = exportEnvName(id);
-        }
-        else {
-            exportName = cleanName(exportParam);
-        }
-        if (consumer) {
-            const secretName = cdk.Fn.importValue(exportName);
-            this._secret = secretsmanager__namespace.Secret.fromSecretNameV2(this, id, secretName);
-            // Add CfnOutput for consumer secrets
-            new cdk.CfnOutput(this, `ConsumedName`, {
-                value: this._secret.secretName,
-            });
-        }
-        else {
-            const secretValue = envKey && process.env[envKey] ? process.env[envKey] : value;
-            const secretProps = {
-                secretStringValue: secretValue
-                    ? cdk.SecretValue.unsafePlainText(secretValue)
-                    : undefined,
-            };
-            this._secret = new secretsmanager__namespace.Secret(this, id, secretProps);
-            if (roleTag) {
-                cdk.Tags.of(this._secret).add(cdk$1.CDK.TAG.ROLE, roleTag);
-            }
-            if (vendorTag) {
-                cdk.Tags.of(this._secret).add(cdk$1.CDK.TAG.VENDOR, vendorTag);
-            }
-            if (provider) {
-                new cdk.CfnOutput(this, `ProvidedName`, {
-                    value: this._secret.secretName,
-                    exportName,
-                });
-            }
-            else {
-                new cdk.CfnOutput(this, `CreatedName`, {
-                    value: this._secret.secretName,
-                });
-            }
-        }
-    }
-    // IResource implementation
-    get stack() {
-        return cdk.Stack.of(this);
-    }
-    get env() {
-        return {
-            account: cdk.Stack.of(this).account,
-            region: cdk.Stack.of(this).region,
-        };
-    }
-    applyRemovalPolicy(policy) {
-        this._secret.applyRemovalPolicy(policy);
-    }
-    // ISecret implementation
-    get secretArn() {
-        return this._secret.secretArn;
-    }
-    get secretName() {
-        return this._secret.secretName;
-    }
-    get secretFullArn() {
-        return this._secret.secretFullArn;
-    }
-    get encryptionKey() {
-        return this._secret.encryptionKey;
-    }
-    get secretValue() {
-        return this._secret.secretValue;
-    }
-    secretValueFromJson(key) {
-        return this._secret.secretValueFromJson(key);
-    }
-    grantRead(grantee, versionStages) {
-        return this._secret.grantRead(grantee, versionStages);
-    }
-    grantWrite(grantee) {
-        return this._secret.grantWrite(grantee);
-    }
-    addRotationSchedule(id, options) {
-        return this._secret.addRotationSchedule(id, options);
-    }
-    addToResourcePolicy(statement) {
-        return this._secret.addToResourcePolicy(statement);
-    }
-    denyAccountRootDelete() {
-        this._secret.denyAccountRootDelete();
-    }
-    attach(target) {
-        return this._secret.attach(target);
-    }
-    get envKey() {
-        return this._envKey;
-    }
-}
-
-const SERVICE = {
-    ROUTE53: "route53.amazonaws.com",
-};
-class JaypieHostedZone extends constructs.Construct {
-    /**
-     * Create a new hosted zone with query logging
-     */
-    constructor(scope, id, props) {
-        super(scope, id);
-        const { destination, zoneName, project } = props;
-        const service = props.service || cdk$1.CDK.SERVICE.INFRASTRUCTURE;
-        // Create the log group
-        this.logGroup = new awsLogs.LogGroup(this, "LogGroup", {
-            logGroupName: process.env.PROJECT_NONCE
-                ? `/aws/route53/${zoneName}-${process.env.PROJECT_NONCE}`
-                : `/aws/route53/${zoneName}`,
-            retention: awsLogs.RetentionDays.ONE_WEEK,
-        });
-        // Add tags
-        cdk__namespace.Tags.of(this.logGroup).add(cdk$1.CDK.TAG.SERVICE, service);
-        cdk__namespace.Tags.of(this.logGroup).add(cdk$1.CDK.TAG.ROLE, cdk$1.CDK.ROLE.NETWORKING);
-        if (project) {
-            cdk__namespace.Tags.of(this.logGroup).add(cdk$1.CDK.TAG.PROJECT, project);
-        }
-        // Grant Route 53 permissions to write to the log group
-        this.logGroup.grantWrite(new awsIam.ServicePrincipal(SERVICE.ROUTE53));
-        // Add destination if provided
-        if (destination) {
-            this.logGroup.addSubscriptionFilter("DatadogLambdaDestination", {
-                destination,
-                filterPattern: awsLogs.FilterPattern.allEvents(),
-            });
-        }
-        // Create the hosted zone
-        this.hostedZone = new awsRoute53.HostedZone(this, "HostedZone", {
-            queryLogsLogGroupArn: this.logGroup.logGroupArn,
-            zoneName,
-        });
-        // Add tags
-        cdk__namespace.Tags.of(this.hostedZone).add(cdk$1.CDK.TAG.SERVICE, service);
-        cdk__namespace.Tags.of(this.hostedZone).add(cdk$1.CDK.TAG.ROLE, cdk$1.CDK.ROLE.NETWORKING);
-        if (project) {
-            cdk__namespace.Tags.of(this.hostedZone).add(cdk$1.CDK.TAG.PROJECT, project);
-        }
-    }
-}
-
 class JaypieLambda extends constructs.Construct {
     constructor(scope, id, props) {
         super(scope, id);
-        const { code, datadogApiKeyArn, environment: initialEnvironment = {}, envSecrets = {}, handler = "index.handler", layers = [], logRetention = cdk$1.CDK.LAMBDA.LOG_RETENTION, memorySize = cdk$1.CDK.LAMBDA.MEMORY_SIZE, paramsAndSecrets, paramsAndSecretsOptions, reservedConcurrentExecutions, roleTag, runtime = lambda__namespace.Runtime.NODEJS_20_X, secrets = [], timeout = cdk.Duration.seconds(cdk$1.CDK.DURATION.LAMBDA_WORKER), vendorTag, } = props;
+        const { code, datadogApiKeyArn, environment: initialEnvironment = {}, envSecrets = {}, handler = "index.handler", layers = [], logRetention = cdk.CDK.LAMBDA.LOG_RETENTION, memorySize = cdk.CDK.LAMBDA.MEMORY_SIZE, paramsAndSecrets, paramsAndSecretsOptions, reservedConcurrentExecutions, roleTag, runtime = lambda__namespace.Runtime.NODEJS_20_X, secrets = [], timeout = cdk$1.Duration.seconds(cdk.CDK.DURATION.LAMBDA_WORKER), vendorTag, } = props;
         // Create a mutable copy of the environment variables
         let environment = { ...initialEnvironment };
         this._code = typeof code === "string" ? lambda__namespace.Code.fromAsset(code) : code;
@@ -232,18 +57,18 @@ class JaypieLambda extends constructs.Construct {
         // Add Datadog integration if API key is available
         if (resolvedDatadogApiKeyArn) {
             // Add Datadog Node.js layer
-            const datadogNodeLayer = lambda__namespace.LayerVersion.fromLayerVersionArn(this, "DatadogNodeLayer", `arn:aws:lambda:${cdk.Stack.of(this).region}:464622532012:layer:Datadog-Node20-x:${cdk$1.CDK.DATADOG.LAYER.NODE}`);
+            const datadogNodeLayer = lambda__namespace.LayerVersion.fromLayerVersionArn(this, "DatadogNodeLayer", `arn:aws:lambda:${cdk$1.Stack.of(this).region}:464622532012:layer:Datadog-Node20-x:${cdk.CDK.DATADOG.LAYER.NODE}`);
             resolvedLayers.push(datadogNodeLayer);
             // Add Datadog Extension layer
-            const datadogExtensionLayer = lambda__namespace.LayerVersion.fromLayerVersionArn(this, "DatadogExtensionLayer", `arn:aws:lambda:${cdk.Stack.of(this).region}:464622532012:layer:Datadog-Extension:${cdk$1.CDK.DATADOG.LAYER.EXTENSION}`);
+            const datadogExtensionLayer = lambda__namespace.LayerVersion.fromLayerVersionArn(this, "DatadogExtensionLayer", `arn:aws:lambda:${cdk$1.Stack.of(this).region}:464622532012:layer:Datadog-Extension:${cdk.CDK.DATADOG.LAYER.EXTENSION}`);
             resolvedLayers.push(datadogExtensionLayer);
             // Set Datadog environment variables
             Object.assign(environment, {
                 DD_API_KEY_SECRET_ARN: resolvedDatadogApiKeyArn,
                 DD_ENV: process.env.PROJECT_ENV || "",
                 DD_SERVICE: process.env.PROJECT_SERVICE || "",
-                DD_SITE: cdk$1.CDK.DATADOG.SITE,
-                DD_TAGS: `${cdk$1.CDK.TAG.SPONSOR}:${process.env.PROJECT_SPONSOR || ""}`,
+                DD_SITE: cdk.CDK.DATADOG.SITE,
+                DD_TAGS: `${cdk.CDK.TAG.SPONSOR}:${process.env.PROJECT_SPONSOR || ""}`,
             });
         }
         // Configure ParamsAndSecrets layer
@@ -294,7 +119,7 @@ class JaypieLambda extends constructs.Construct {
             paramsAndSecrets: resolvedParamsAndSecrets,
             reservedConcurrentExecutions,
             runtime,
-            timeout: typeof timeout === "number" ? cdk.Duration.seconds(timeout) : timeout,
+            timeout: typeof timeout === "number" ? cdk$1.Duration.seconds(timeout) : timeout,
         });
         // Grant secret read permissions
         Object.values(envSecrets).forEach((secret) => {
@@ -311,10 +136,10 @@ class JaypieLambda extends constructs.Construct {
             datadogApiKey.grantRead(this._lambda);
         }
         if (roleTag) {
-            cdk.Tags.of(this._lambda).add(cdk$1.CDK.TAG.ROLE, roleTag);
+            cdk$1.Tags.of(this._lambda).add(cdk.CDK.TAG.ROLE, roleTag);
         }
         if (vendorTag) {
-            cdk.Tags.of(this._lambda).add(cdk$1.CDK.TAG.VENDOR, vendorTag);
+            cdk$1.Tags.of(this._lambda).add(cdk.CDK.TAG.VENDOR, vendorTag);
         }
     }
     // Public accessors
@@ -406,8 +231,8 @@ class JaypieLambda extends constructs.Construct {
     }
     get env() {
         return {
-            account: cdk.Stack.of(this).account,
-            region: cdk.Stack.of(this).region,
+            account: cdk$1.Stack.of(this).account,
+            region: cdk$1.Stack.of(this).region,
         };
     }
     get stack() {
@@ -418,46 +243,22 @@ class JaypieLambda extends constructs.Construct {
     }
 }
 
-class JaypieMongoDbSecret extends JaypieEnvSecret {
-    constructor(scope, id = "MongoConnectionString", props) {
-        const defaultProps = {
-            envKey: "MONGODB_URI",
-            roleTag: cdk$1.CDK.ROLE.STORAGE,
-            vendorTag: cdk$1.CDK.VENDOR.MONGODB,
-            ...props,
-        };
-        super(scope, id, defaultProps);
-    }
-}
-
-class JaypieOpenAiSecret extends JaypieEnvSecret {
-    constructor(scope, id = "OpenAiApiKey", props) {
-        const defaultProps = {
-            envKey: "OPENAI_API_KEY",
-            roleTag: cdk$1.CDK.ROLE.PROCESSING,
-            vendorTag: cdk$1.CDK.VENDOR.OPENAI,
-            ...props,
-        };
-        super(scope, id, defaultProps);
-    }
-}
-
 class JaypieQueuedLambda extends constructs.Construct {
     constructor(scope, id, props) {
         super(scope, id);
-        const { batchSize = 1, code, environment = {}, envSecrets = {}, fifo = true, handler = "index.handler", layers = [], logRetention = cdk$1.CDK.LAMBDA.LOG_RETENTION, memorySize = cdk$1.CDK.LAMBDA.MEMORY_SIZE, paramsAndSecrets, reservedConcurrentExecutions, roleTag, runtime = lambda__namespace.Runtime.NODEJS_20_X, secrets = [], timeout = cdk.Duration.seconds(cdk$1.CDK.DURATION.LAMBDA_WORKER), vendorTag, visibilityTimeout = cdk.Duration.seconds(cdk$1.CDK.DURATION.LAMBDA_WORKER), } = props;
+        const { batchSize = 1, code, environment = {}, envSecrets = {}, fifo = true, handler = "index.handler", layers = [], logRetention = cdk.CDK.LAMBDA.LOG_RETENTION, memorySize = cdk.CDK.LAMBDA.MEMORY_SIZE, paramsAndSecrets, reservedConcurrentExecutions, roleTag, runtime = lambda__namespace.Runtime.NODEJS_20_X, secrets = [], timeout = cdk$1.Duration.seconds(cdk.CDK.DURATION.LAMBDA_WORKER), vendorTag, visibilityTimeout = cdk$1.Duration.seconds(cdk.CDK.DURATION.LAMBDA_WORKER), } = props;
         // Create SQS Queue
         this._queue = new sqs__namespace.Queue(this, "Queue", {
             fifo,
             visibilityTimeout: typeof visibilityTimeout === "number"
-                ? cdk.Duration.seconds(visibilityTimeout)
+                ? cdk$1.Duration.seconds(visibilityTimeout)
                 : visibilityTimeout,
         });
         if (roleTag) {
-            cdk.Tags.of(this._queue).add(cdk$1.CDK.TAG.ROLE, roleTag);
+            cdk$1.Tags.of(this._queue).add(cdk.CDK.TAG.ROLE, roleTag);
         }
         if (vendorTag) {
-            cdk.Tags.of(this._queue).add(cdk$1.CDK.TAG.VENDOR, vendorTag);
+            cdk$1.Tags.of(this._queue).add(cdk.CDK.TAG.VENDOR, vendorTag);
         }
         // Create Lambda with JaypieLambda
         this._lambdaConstruct = new JaypieLambda(this, "Function", {
@@ -578,12 +379,12 @@ class JaypieQueuedLambda extends constructs.Construct {
     }
     get env() {
         return {
-            account: cdk.Stack.of(this).account,
-            region: cdk.Stack.of(this).region,
+            account: cdk$1.Stack.of(this).account,
+            region: cdk$1.Stack.of(this).region,
         };
     }
     get stack() {
-        return cdk.Stack.of(this);
+        return cdk$1.Stack.of(this);
     }
     applyRemovalPolicy(policy) {
         this._lambdaConstruct.applyRemovalPolicy(policy);
@@ -650,6 +451,388 @@ class JaypieQueuedLambda extends constructs.Construct {
     }
 }
 
+class JaypieBucketQueuedLambda extends JaypieQueuedLambda {
+    constructor(scope, id, props) {
+        props.fifo = false; // S3 event notifications are not supported for FIFO queues
+        super(scope, id, props);
+        const { bucketName, roleTag, vendorTag, bucketOptions = {} } = props;
+        // Create S3 Bucket
+        this._bucket = new s3__namespace.Bucket(this, "Bucket", {
+            bucketName: bucketOptions.bucketName || bucketName,
+            removalPolicy: bucketOptions.removalPolicy || cdk$1.RemovalPolicy.RETAIN,
+            ...bucketOptions,
+        });
+        // Add tags to bucket
+        if (roleTag) {
+            cdk$1.Tags.of(this._bucket).add(cdk.CDK.TAG.ROLE, roleTag);
+        }
+        if (vendorTag) {
+            cdk$1.Tags.of(this._bucket).add(cdk.CDK.TAG.VENDOR, vendorTag);
+        }
+        // Add an event notification from the bucket to the queue
+        this._bucket.addEventNotification(s3__namespace.EventType.OBJECT_CREATED, new s3n__namespace.SqsDestination(this.queue));
+        // Grant the lambda access to the bucket
+        this._bucket.grantReadWrite(this);
+        // Add environment variable for bucket name
+        this.lambda.addEnvironment("CDK_ENV_BUCKET_NAME", this._bucket.bucketName);
+    }
+    // Public accessors
+    get bucket() {
+        return this._bucket;
+    }
+    // IBucket implementation
+    get bucketArn() {
+        return this._bucket.bucketArn;
+    }
+    get bucketDomainName() {
+        return this._bucket.bucketDomainName;
+    }
+    get bucketDualStackDomainName() {
+        return this._bucket.bucketDualStackDomainName;
+    }
+    get bucketName() {
+        return this._bucket.bucketName;
+    }
+    get bucketRegionalDomainName() {
+        return this._bucket.bucketRegionalDomainName;
+    }
+    get bucketWebsiteDomainName() {
+        return this._bucket.bucketWebsiteDomainName;
+    }
+    get bucketWebsiteUrl() {
+        return this._bucket.bucketWebsiteUrl;
+    }
+    get encryptionKey() {
+        return this._bucket.encryptionKey;
+    }
+    get isWebsite() {
+        return this._bucket.isWebsite || false;
+    }
+    get policy() {
+        return this._bucket.policy;
+    }
+    addEventNotification(event, dest, filters) {
+        this._bucket.addEventNotification(event, dest, ...filters);
+    }
+    addObjectCreatedNotification(dest, ...filters) {
+        this._bucket.addObjectCreatedNotification(dest, ...filters);
+    }
+    addObjectRemovedNotification(dest, ...filters) {
+        this._bucket.addObjectRemovedNotification(dest, ...filters);
+    }
+    addToResourcePolicy(permission) {
+        return this._bucket.addToResourcePolicy(permission);
+    }
+    arnForObjects(objectKeyPattern) {
+        return this._bucket.arnForObjects(objectKeyPattern);
+    }
+    enableEventBridgeNotification() {
+        this._bucket.enableEventBridgeNotification();
+    }
+    grant(grantee, ...actions) {
+        return this._bucket.grant(grantee, ...actions);
+    }
+    grantDelete(grantee, objectsKeyPattern) {
+        return this._bucket.grantDelete(grantee, objectsKeyPattern);
+    }
+    grantPublicAccess(keyPrefix, ...allowedActions) {
+        return this._bucket.grantPublicAccess(keyPrefix, ...allowedActions);
+    }
+    grantPut(grantee, objectsKeyPattern) {
+        return this._bucket.grantPut(grantee, objectsKeyPattern);
+    }
+    grantPutAcl(grantee, objectsKeyPattern) {
+        return this._bucket.grantPutAcl(grantee, objectsKeyPattern);
+    }
+    grantRead(grantee, objectsKeyPattern) {
+        return this._bucket.grantRead(grantee, objectsKeyPattern);
+    }
+    grantReadWrite(grantee, objectsKeyPattern) {
+        return this._bucket.grantReadWrite(grantee, objectsKeyPattern);
+    }
+    grantWrite(grantee, objectsKeyPattern) {
+        return this._bucket.grantWrite(grantee, objectsKeyPattern);
+    }
+    onCloudTrailEvent(id, options) {
+        return this._bucket.onCloudTrailEvent(id, options);
+    }
+    onCloudTrailPutObject(id, options) {
+        return this._bucket.onCloudTrailPutObject(id, options);
+    }
+    onCloudTrailWriteObject(id, options) {
+        return this._bucket.onCloudTrailWriteObject(id, options);
+    }
+    s3UrlForObject(key) {
+        return this._bucket.s3UrlForObject(key);
+    }
+    transferAccelerationUrlForObject(key, options) {
+        return this._bucket.transferAccelerationUrlForObject(key, options);
+    }
+    urlForObject(key) {
+        return this._bucket.urlForObject(key);
+    }
+    virtualHostedUrlForObject(key, options) {
+        return this._bucket.virtualHostedUrlForObject(key, options);
+    }
+    // Bucket metrics
+    metricAllRequests(props) {
+        return this._bucket.metricAllRequests(props);
+    }
+    metricBucketSizeBytes(props) {
+        return this._bucket.metricBucketSizeBytes(props);
+    }
+    metricDeleteRequests(props) {
+        return this._bucket.metricDeleteRequests(props);
+    }
+    metricDownloadBytes(props) {
+        return this._bucket.metricDownloadBytes(props);
+    }
+    metricFirstByteLatency(props) {
+        return this._bucket.metricFirstByteLatency(props);
+    }
+    metricGetRequests(props) {
+        return this._bucket.metricGetRequests(props);
+    }
+    metricHeadRequests(props) {
+        return this._bucket.metricHeadRequests(props);
+    }
+    metricHttpRequests(props) {
+        return this._bucket.metricHttpRequests(props);
+    }
+    metricListRequests(props) {
+        return this._bucket.metricListRequests(props);
+    }
+    metricNumberOfObjects(props) {
+        return this._bucket.metricNumberOfObjects(props);
+    }
+    metricPostRequests(props) {
+        return this._bucket.metricPostRequests(props);
+    }
+    metricPutRequests(props) {
+        return this._bucket.metricPutRequests(props);
+    }
+    metricSelectRequests(props) {
+        return this._bucket.metricSelectRequests(props);
+    }
+    metricSelectScannedBytes(props) {
+        return this._bucket.metricSelectScannedBytes(props);
+    }
+    metricUploadBytes(props) {
+        return this._bucket.metricUploadBytes(props);
+    }
+    metricSelectReturnedBytes(props) {
+        return this._bucket.metricSelectReturnedBytes(props);
+    }
+    // Override applyRemovalPolicy to apply to all resources
+    applyRemovalPolicy(policy) {
+        super.applyRemovalPolicy(policy);
+        this._bucket.applyRemovalPolicy(policy);
+    }
+}
+
+// It is a consumer if the environment is ephemeral
+function checkEnvIsConsumer(env = process.env) {
+    return (env.PROJECT_ENV === cdk.CDK.ENV.PERSONAL ||
+        !!env.CDK_ENV_PERSONAL ||
+        /** @deprecated */ env.PROJECT_ENV === "ephemeral" ||
+        /** @deprecated */ !!env.CDK_ENV_EPHEMERAL);
+}
+function checkEnvIsProvider(env = process.env) {
+    return env.PROJECT_ENV === cdk.CDK.ENV.SANDBOX;
+}
+function cleanName(name) {
+    return name.replace(/[^a-zA-Z0-9:-]/g, "");
+}
+function exportEnvName(name, env = process.env) {
+    let rawName;
+    if (checkEnvIsProvider(env)) {
+        rawName = `env-${env.PROJECT_ENV}-${env.PROJECT_KEY}-${name}`;
+        // Clean the entire name to only allow alphanumeric, colons, and hyphens
+        return cleanName(rawName);
+    }
+    else {
+        if (checkEnvIsConsumer(env)) {
+            rawName = `env-${cdk.CDK.ENV.SANDBOX}-${env.PROJECT_KEY}-${name}`;
+        }
+        else {
+            rawName = `env-${env.PROJECT_ENV}-${env.PROJECT_KEY}-${name}`;
+        }
+    }
+    return cleanName(rawName);
+}
+class JaypieEnvSecret extends constructs.Construct {
+    constructor(scope, id, props) {
+        super(scope, id);
+        const { consumer = checkEnvIsConsumer(), envKey, export: exportParam, provider = checkEnvIsProvider(), roleTag, vendorTag, value, } = props || {};
+        this._envKey = envKey;
+        let exportName;
+        if (!exportParam) {
+            exportName = exportEnvName(id);
+        }
+        else {
+            exportName = cleanName(exportParam);
+        }
+        if (consumer) {
+            const secretName = cdk$1.Fn.importValue(exportName);
+            this._secret = secretsmanager__namespace.Secret.fromSecretNameV2(this, id, secretName);
+            // Add CfnOutput for consumer secrets
+            new cdk$1.CfnOutput(this, `ConsumedName`, {
+                value: this._secret.secretName,
+            });
+        }
+        else {
+            const secretValue = envKey && process.env[envKey] ? process.env[envKey] : value;
+            const secretProps = {
+                secretStringValue: secretValue
+                    ? cdk$1.SecretValue.unsafePlainText(secretValue)
+                    : undefined,
+            };
+            this._secret = new secretsmanager__namespace.Secret(this, id, secretProps);
+            if (roleTag) {
+                cdk$1.Tags.of(this._secret).add(cdk.CDK.TAG.ROLE, roleTag);
+            }
+            if (vendorTag) {
+                cdk$1.Tags.of(this._secret).add(cdk.CDK.TAG.VENDOR, vendorTag);
+            }
+            if (provider) {
+                new cdk$1.CfnOutput(this, `ProvidedName`, {
+                    value: this._secret.secretName,
+                    exportName,
+                });
+            }
+            else {
+                new cdk$1.CfnOutput(this, `CreatedName`, {
+                    value: this._secret.secretName,
+                });
+            }
+        }
+    }
+    // IResource implementation
+    get stack() {
+        return cdk$1.Stack.of(this);
+    }
+    get env() {
+        return {
+            account: cdk$1.Stack.of(this).account,
+            region: cdk$1.Stack.of(this).region,
+        };
+    }
+    applyRemovalPolicy(policy) {
+        this._secret.applyRemovalPolicy(policy);
+    }
+    // ISecret implementation
+    get secretArn() {
+        return this._secret.secretArn;
+    }
+    get secretName() {
+        return this._secret.secretName;
+    }
+    get secretFullArn() {
+        return this._secret.secretFullArn;
+    }
+    get encryptionKey() {
+        return this._secret.encryptionKey;
+    }
+    get secretValue() {
+        return this._secret.secretValue;
+    }
+    secretValueFromJson(key) {
+        return this._secret.secretValueFromJson(key);
+    }
+    grantRead(grantee, versionStages) {
+        return this._secret.grantRead(grantee, versionStages);
+    }
+    grantWrite(grantee) {
+        return this._secret.grantWrite(grantee);
+    }
+    addRotationSchedule(id, options) {
+        return this._secret.addRotationSchedule(id, options);
+    }
+    addToResourcePolicy(statement) {
+        return this._secret.addToResourcePolicy(statement);
+    }
+    denyAccountRootDelete() {
+        this._secret.denyAccountRootDelete();
+    }
+    attach(target) {
+        return this._secret.attach(target);
+    }
+    get envKey() {
+        return this._envKey;
+    }
+}
+
+const SERVICE = {
+    ROUTE53: "route53.amazonaws.com",
+};
+class JaypieHostedZone extends constructs.Construct {
+    /**
+     * Create a new hosted zone with query logging
+     */
+    constructor(scope, id, props) {
+        super(scope, id);
+        const { destination, zoneName, project } = props;
+        const service = props.service || cdk.CDK.SERVICE.INFRASTRUCTURE;
+        // Create the log group
+        this.logGroup = new awsLogs.LogGroup(this, "LogGroup", {
+            logGroupName: process.env.PROJECT_NONCE
+                ? `/aws/route53/${zoneName}-${process.env.PROJECT_NONCE}`
+                : `/aws/route53/${zoneName}`,
+            retention: awsLogs.RetentionDays.ONE_WEEK,
+        });
+        // Add tags
+        cdk__namespace.Tags.of(this.logGroup).add(cdk.CDK.TAG.SERVICE, service);
+        cdk__namespace.Tags.of(this.logGroup).add(cdk.CDK.TAG.ROLE, cdk.CDK.ROLE.NETWORKING);
+        if (project) {
+            cdk__namespace.Tags.of(this.logGroup).add(cdk.CDK.TAG.PROJECT, project);
+        }
+        // Grant Route 53 permissions to write to the log group
+        this.logGroup.grantWrite(new awsIam.ServicePrincipal(SERVICE.ROUTE53));
+        // Add destination if provided
+        if (destination) {
+            this.logGroup.addSubscriptionFilter("DatadogLambdaDestination", {
+                destination,
+                filterPattern: awsLogs.FilterPattern.allEvents(),
+            });
+        }
+        // Create the hosted zone
+        this.hostedZone = new awsRoute53.HostedZone(this, "HostedZone", {
+            queryLogsLogGroupArn: this.logGroup.logGroupArn,
+            zoneName,
+        });
+        // Add tags
+        cdk__namespace.Tags.of(this.hostedZone).add(cdk.CDK.TAG.SERVICE, service);
+        cdk__namespace.Tags.of(this.hostedZone).add(cdk.CDK.TAG.ROLE, cdk.CDK.ROLE.NETWORKING);
+        if (project) {
+            cdk__namespace.Tags.of(this.hostedZone).add(cdk.CDK.TAG.PROJECT, project);
+        }
+    }
+}
+
+class JaypieMongoDbSecret extends JaypieEnvSecret {
+    constructor(scope, id = "MongoConnectionString", props) {
+        const defaultProps = {
+            envKey: "MONGODB_URI",
+            roleTag: cdk.CDK.ROLE.STORAGE,
+            vendorTag: cdk.CDK.VENDOR.MONGODB,
+            ...props,
+        };
+        super(scope, id, defaultProps);
+    }
+}
+
+class JaypieOpenAiSecret extends JaypieEnvSecret {
+    constructor(scope, id = "OpenAiApiKey", props) {
+        const defaultProps = {
+            envKey: "OPENAI_API_KEY",
+            roleTag: cdk.CDK.ROLE.PROCESSING,
+            vendorTag: cdk.CDK.VENDOR.OPENAI,
+            ...props,
+        };
+        super(scope, id, defaultProps);
+    }
+}
+
 /**
  * Permission set types with corresponding AWS managed policies
  */
@@ -703,11 +886,11 @@ class JaypieSsoGroups extends constructs.Construct {
             instanceArn: this.instanceArn,
             name: exports.PermissionSetType.ADMINISTRATOR,
             description: "Full administrative access to all AWS services and resources",
-            sessionDuration: cdk.Duration.hours(8).toIsoString(),
+            sessionDuration: cdk$1.Duration.hours(8).toIsoString(),
             managedPolicies: ["arn:aws:iam::aws:policy/AdministratorAccess"],
             inlinePolicy: mergedPolicy,
         });
-        cdk.Tags.of(permissionSet).add(cdk$1.CDK.TAG.SERVICE, cdk$1.CDK.SERVICE.SSO);
+        cdk$1.Tags.of(permissionSet).add(cdk.CDK.TAG.SERVICE, cdk.CDK.SERVICE.SSO);
         this.permissionSets[exports.PermissionSetType.ADMINISTRATOR] = permissionSet;
     }
     /**
@@ -740,11 +923,11 @@ class JaypieSsoGroups extends constructs.Construct {
             instanceArn: this.instanceArn,
             name: exports.PermissionSetType.ANALYST,
             description: "Read-only access with billing visibility and limited write access",
-            sessionDuration: cdk.Duration.hours(4).toIsoString(),
+            sessionDuration: cdk$1.Duration.hours(4).toIsoString(),
             managedPolicies: ["arn:aws:iam::aws:policy/ReadOnlyAccess"],
             inlinePolicy: mergedPolicy,
         });
-        cdk.Tags.of(permissionSet).add(cdk$1.CDK.TAG.SERVICE, cdk$1.CDK.SERVICE.SSO);
+        cdk$1.Tags.of(permissionSet).add(cdk.CDK.TAG.SERVICE, cdk.CDK.SERVICE.SSO);
         this.permissionSets[exports.PermissionSetType.ANALYST] = permissionSet;
     }
     /**
@@ -792,13 +975,13 @@ class JaypieSsoGroups extends constructs.Construct {
             instanceArn: this.instanceArn,
             name: exports.PermissionSetType.DEVELOPER,
             description: "System administrator access with expanded write permissions",
-            sessionDuration: cdk.Duration.hours(8).toIsoString(),
+            sessionDuration: cdk$1.Duration.hours(8).toIsoString(),
             managedPolicies: [
                 "arn:aws:iam::aws:policy/job-function/SystemAdministrator",
             ],
             inlinePolicy: mergedPolicy,
         });
-        cdk.Tags.of(permissionSet).add(cdk$1.CDK.TAG.SERVICE, cdk$1.CDK.SERVICE.SSO);
+        cdk$1.Tags.of(permissionSet).add(cdk.CDK.TAG.SERVICE, cdk.CDK.SERVICE.SSO);
         this.permissionSets[exports.PermissionSetType.DEVELOPER] = permissionSet;
     }
     /**
@@ -865,8 +1048,8 @@ class JaypieSsoGroups extends constructs.Construct {
                 targetId: accountId,
                 targetType: "AWS_ACCOUNT",
             });
-            cdk.Tags.of(assignment).add(cdk$1.CDK.TAG.SERVICE, cdk$1.CDK.SERVICE.SSO);
-            cdk.Tags.of(assignment).add("Group", "administrators");
+            cdk$1.Tags.of(assignment).add(cdk.CDK.TAG.SERVICE, cdk.CDK.SERVICE.SSO);
+            cdk$1.Tags.of(assignment).add("Group", "administrators");
         });
     }
     /**
@@ -892,8 +1075,8 @@ class JaypieSsoGroups extends constructs.Construct {
                 targetId: accountId,
                 targetType: "AWS_ACCOUNT",
             });
-            cdk.Tags.of(assignment).add(cdk$1.CDK.TAG.SERVICE, cdk$1.CDK.SERVICE.SSO);
-            cdk.Tags.of(assignment).add("Group", "analysts");
+            cdk$1.Tags.of(assignment).add(cdk.CDK.TAG.SERVICE, cdk.CDK.SERVICE.SSO);
+            cdk$1.Tags.of(assignment).add("Group", "analysts");
         });
     }
     /**
@@ -918,8 +1101,8 @@ class JaypieSsoGroups extends constructs.Construct {
                 targetId: accountId,
                 targetType: "AWS_ACCOUNT",
             });
-            cdk.Tags.of(assignment).add(cdk$1.CDK.TAG.SERVICE, cdk$1.CDK.SERVICE.SSO);
-            cdk.Tags.of(assignment).add("Group", "developers");
+            cdk$1.Tags.of(assignment).add(cdk.CDK.TAG.SERVICE, cdk.CDK.SERVICE.SSO);
+            cdk$1.Tags.of(assignment).add("Group", "developers");
         });
     }
 }
@@ -928,14 +1111,15 @@ class JaypieTraceSigningKeySecret extends JaypieEnvSecret {
     constructor(scope, id = "TraceSigningKey", props) {
         const defaultProps = {
             envKey: "TRACE_SIGNING_KEY",
-            roleTag: cdk$1.CDK.ROLE.API,
-            vendorTag: cdk$1.CDK.VENDOR.KNOWTRACE,
+            roleTag: cdk.CDK.ROLE.API,
+            vendorTag: cdk.CDK.VENDOR.KNOWTRACE,
             ...props,
         };
         super(scope, id, defaultProps);
     }
 }
 
+exports.JaypieBucketQueuedLambda = JaypieBucketQueuedLambda;
 exports.JaypieEnvSecret = JaypieEnvSecret;
 exports.JaypieHostedZone = JaypieHostedZone;
 exports.JaypieLambda = JaypieLambda;