@jaypie/constructs 1.1.28 → 1.1.30

package/dist/esm/index.js

@@ -1,22 +1,279 @@
+import { Construct } from 'constructs';
 import * as cdk from 'aws-cdk-lib';
-import { Duration, Stack, Tags, RemovalPolicy, Fn, CfnOutput, SecretValue } from 'aws-cdk-lib';
+import { Tags, Stack, Duration, RemovalPolicy, Fn, CfnOutput, SecretValue } from 'aws-cdk-lib';
+import * as acm from 'aws-cdk-lib/aws-certificatemanager';
+import * as apiGateway from 'aws-cdk-lib/aws-apigateway';
+import * as route53 from 'aws-cdk-lib/aws-route53';
+import { HostedZone } from 'aws-cdk-lib/aws-route53';
+import * as route53Targets from 'aws-cdk-lib/aws-route53-targets';
+import { CDK as CDK$2, isValidSubdomain, ConfigurationError, isValidHostname, mergeDomain } from '@jaypie/cdk';
 import * as s3 from 'aws-cdk-lib/aws-s3';
 import * as s3n from 'aws-cdk-lib/aws-s3-notifications';
-import { CDK } from '@jaypie/cdk';
-import { Construct } from 'constructs';
 import * as lambda from 'aws-cdk-lib/aws-lambda';
 import * as sqs from 'aws-cdk-lib/aws-sqs';
 import * as lambdaEventSources from 'aws-cdk-lib/aws-lambda-event-sources';
 import * as secretsmanager from 'aws-cdk-lib/aws-secretsmanager';
-import { ServicePrincipal } from 'aws-cdk-lib/aws-iam';
+import { ServicePrincipal, Role, FederatedPrincipal, PolicyStatement, Effect } from 'aws-cdk-lib/aws-iam';
 import { LogGroup, RetentionDays, FilterPattern } from 'aws-cdk-lib/aws-logs';
-import { HostedZone } from 'aws-cdk-lib/aws-route53';
 import * as sso from 'aws-cdk-lib/aws-sso';
+import * as cloudfront from 'aws-cdk-lib/aws-cloudfront';
+import * as origins from 'aws-cdk-lib/aws-cloudfront-origins';
+
+function constructEnvName(name, opts) {
+    const env = opts?.env ?? process.env.PROJECT_ENV ?? "build";
+    const key = opts?.key ?? process.env.PROJECT_KEY ?? "project";
+    const nonce = opts?.nonce ?? process.env.PROJECT_NONCE ?? "cfe2";
+    return `${env}-${key}-${name}-${nonce}`;
+}
+
+function constructStackName(key) {
+    if (!key) {
+        return `cdk-${process.env.PROJECT_SPONSOR}-${process.env.PROJECT_KEY}-${process.env.PROJECT_ENV}-${process.env.PROJECT_NONCE}`;
+    }
+    else {
+        return `cdk-${process.env.PROJECT_SPONSOR}-${process.env.PROJECT_KEY}-${process.env.PROJECT_ENV}-${process.env.PROJECT_NONCE}-${key}`;
+    }
+}
+
+/**
+ * Check if the current environment matches the given environment
+ */
+function isEnv(env) {
+    return process.env.PROJECT_ENV === env;
+}
+/**
+ * Check if the current environment is production
+ */
+function isProductionEnv() {
+    return isEnv(CDK$2.ENV.PRODUCTION);
+}
+/**
+ * Check if the current environment is sandbox
+ */
+function isSandboxEnv() {
+    return isEnv(CDK$2.ENV.SANDBOX);
+}
+
+const CDK$1 = {
+    CREATION: {
+        CDK: "cdk",
+    },
+    ROLE: {
+        STACK: "stack",
+    },
+    TAG: {
+        BUILD_DATE: "buildDate",
+        BUILD_HEX: "buildHex",
+        BUILD_TIME: "buildTime",
+        COMMIT: "commit",
+        CREATION: "creation",
+        ENV: "env",
+        NONCE: "nonce",
+        PROJECT: "project",
+        ROLE: "role",
+        SERVICE: "service",
+        SPONSOR: "sponsor",
+        STACK: "stack",
+        VERSION: "version",
+    },
+};
+function stackTagger(stack, { name } = {}) {
+    const stackName = name || constructStackName();
+    const version = process.env.npm_package_version || process.env.PROJECT_VERSION || null;
+    if (process.env.PROJECT_COMMIT && process.env.PROJECT_COMMIT.length > 8) {
+        Tags.of(stack).add(CDK$1.TAG.BUILD_HEX, process.env.PROJECT_COMMIT.slice(0, 8));
+    }
+    Tags.of(stack).add(CDK$1.TAG.BUILD_DATE, new Date().toISOString());
+    Tags.of(stack).add(CDK$1.TAG.BUILD_TIME, Date.now().toString());
+    if (process.env.PROJECT_COMMIT)
+        Tags.of(stack).add(CDK$1.TAG.COMMIT, process.env.PROJECT_COMMIT);
+    Tags.of(stack).add(CDK$1.TAG.CREATION, CDK$1.CREATION.CDK);
+    if (process.env.PROJECT_ENV)
+        Tags.of(stack).add(CDK$1.TAG.ENV, process.env.PROJECT_ENV);
+    if (process.env.PROJECT_NONCE)
+        Tags.of(stack).add(CDK$1.TAG.NONCE, process.env.PROJECT_NONCE);
+    if (process.env.PROJECT_KEY)
+        Tags.of(stack).add(CDK$1.TAG.PROJECT, process.env.PROJECT_KEY);
+    Tags.of(stack).add(CDK$1.TAG.ROLE, CDK$1.ROLE.STACK);
+    if (process.env.PROJECT_SERVICE)
+        Tags.of(stack).add(CDK$1.TAG.SERVICE, process.env.PROJECT_SERVICE);
+    if (process.env.PROJECT_SPONSOR)
+        Tags.of(stack).add(CDK$1.TAG.SPONSOR, process.env.PROJECT_SPONSOR);
+    if (stackName)
+        Tags.of(stack).add(CDK$1.TAG.STACK, stackName);
+    if (version)
+        Tags.of(stack).add(CDK$1.TAG.VERSION, version);
+    return true;
+}
+
+class JaypieApiGateway extends Construct {
+    constructor(scope, id, props) {
+        super(scope, id);
+        const { certificate = true, handler, host, name, roleTag = CDK$2.ROLE.API, zone, } = props;
+        const apiGatewayName = name || constructEnvName("ApiGateway");
+        const certificateName = constructEnvName("Certificate");
+        const apiDomainName = constructEnvName("ApiDomainName");
+        let hostedZone;
+        let certificateToUse;
+        if (host && zone) {
+            if (typeof zone === "string") {
+                hostedZone = route53.HostedZone.fromLookup(this, "HostedZone", {
+                    domainName: zone,
+                });
+            }
+            else {
+                hostedZone = zone;
+            }
+            if (certificate === true) {
+                certificateToUse = new acm.Certificate(this, certificateName, {
+                    domainName: host,
+                    validation: acm.CertificateValidation.fromDns(hostedZone),
+                });
+                Tags.of(certificateToUse).add(CDK$2.TAG.ROLE, CDK$2.ROLE.HOSTING);
+            }
+            else if (typeof certificate === "object") {
+                certificateToUse = certificate;
+            }
+            this._certificate = certificateToUse;
+            this._host = host;
+        }
+        const { 
+        // * `...lambdaRestApiProps` cannot be moved to the first const destructuring because it needs to exclude the custom properties first.
+        // Ignore the variables we already assigned to other properties
+        /* eslint-disable @typescript-eslint/no-unused-vars */
+        certificate: _certificate, host: _host, name: _name, roleTag: _roleTag, zone: _zone, handler: _handler, 
+        /* eslint-enable @typescript-eslint/no-unused-vars */
+        ...lambdaRestApiProps } = props;
+        this._api = new apiGateway.LambdaRestApi(this, apiGatewayName, {
+            handler,
+            ...lambdaRestApiProps,
+        });
+        Tags.of(this._api).add(CDK$2.TAG.ROLE, roleTag);
+        if (host && certificateToUse && hostedZone) {
+            this._domainName = this._api.addDomainName(apiDomainName, {
+                domainName: host,
+                certificate: certificateToUse,
+            });
+            Tags.of(this._domainName).add(CDK$2.TAG.ROLE, roleTag);
+            const record = new route53.ARecord(this, "AliasRecord", {
+                recordName: host,
+                target: route53.RecordTarget.fromAlias(new route53Targets.ApiGatewayDomain(this._domainName)),
+                zone: hostedZone,
+            });
+            Tags.of(record).add(CDK$2.TAG.ROLE, CDK$2.ROLE.NETWORKING);
+        }
+    }
+    get api() {
+        return this._api;
+    }
+    get url() {
+        return this._api.url;
+    }
+    get certificateArn() {
+        return this._certificate?.certificateArn;
+    }
+    get domainName() {
+        return this._domainName?.domainName;
+    }
+    get host() {
+        return this._host;
+    }
+    get restApiId() {
+        return this._api.restApiId;
+    }
+    get restApiName() {
+        return this._api.restApiName;
+    }
+    get restApiRootResourceId() {
+        return this._api.restApiRootResourceId;
+    }
+    get deploymentStage() {
+        return this._api.deploymentStage;
+    }
+    get domainNameAliasDomainName() {
+        return this._domainName?.domainNameAliasDomainName;
+    }
+    get domainNameAliasHostedZoneId() {
+        return this._domainName?.domainNameAliasHostedZoneId;
+    }
+    get root() {
+        return this._api.root;
+    }
+    get env() {
+        return {
+            account: Stack.of(this).account,
+            region: Stack.of(this).region,
+        };
+    }
+    get stack() {
+        return this._api.stack;
+    }
+    arnForExecuteApi(method, path, stage) {
+        return this._api.arnForExecuteApi(method, path, stage);
+    }
+    metric(metricName, props) {
+        return this._api.metric(metricName, props);
+    }
+    metricCacheHitCount(props) {
+        return this._api.metricCacheHitCount(props);
+    }
+    metricCacheMissCount(props) {
+        return this._api.metricCacheMissCount(props);
+    }
+    metricClientError(props) {
+        return this._api.metricClientError(props);
+    }
+    metricCount(props) {
+        return this._api.metricCount(props);
+    }
+    metricIntegrationLatency(props) {
+        return this._api.metricIntegrationLatency(props);
+    }
+    metricLatency(props) {
+        return this._api.metricLatency(props);
+    }
+    metricServerError(props) {
+        return this._api.metricServerError(props);
+    }
+    applyRemovalPolicy(policy) {
+        this._api.applyRemovalPolicy(policy);
+    }
+}
+
+class JaypieStack extends Stack {
+    constructor(scope, id, props = {}) {
+        const { key, ...stackProps } = props;
+        // Handle stackName
+        if (!stackProps.stackName) {
+            stackProps.stackName = constructStackName(key);
+        }
+        // Handle env
+        stackProps.env = {
+            account: process.env.CDK_DEFAULT_ACCOUNT,
+            region: process.env.CDK_DEFAULT_REGION,
+            ...stackProps.env,
+        };
+        super(scope, id, stackProps);
+        // Apply tags
+        stackTagger(this, { name: stackProps.stackName });
+    }
+}
+
+class JaypieAppStack extends JaypieStack {
+    constructor(scope, id, props = {}) {
+        const { key = "app", ...stackProps } = props;
+        // Handle stackName
+        if (!stackProps.stackName) {
+            stackProps.stackName = constructStackName(key);
+        }
+        super(scope, id, { key, ...stackProps });
+    }
+}
 
 class JaypieLambda extends Construct {
     constructor(scope, id, props) {
         super(scope, id);
-        const { code, datadogApiKeyArn, environment: initialEnvironment = {}, envSecrets = {}, handler = "index.handler", layers = [], logRetention = CDK.LAMBDA.LOG_RETENTION, memorySize = CDK.LAMBDA.MEMORY_SIZE, paramsAndSecrets, paramsAndSecretsOptions, reservedConcurrentExecutions, roleTag, runtime = lambda.Runtime.NODEJS_22_X, secrets = [], timeout = Duration.seconds(CDK.DURATION.LAMBDA_WORKER), vendorTag, } = props;
+        const { code, datadogApiKeyArn, environment: initialEnvironment = {}, envSecrets = {}, handler = "index.handler", layers = [], logRetention = CDK$2.LAMBDA.LOG_RETENTION, memorySize = CDK$2.LAMBDA.MEMORY_SIZE, paramsAndSecrets, paramsAndSecretsOptions, provisionedConcurrentExecutions, reservedConcurrentExecutions, roleTag = CDK$2.ROLE.PROCESSING, runtime = lambda.Runtime.NODEJS_22_X, secrets = [], timeout = Duration.seconds(CDK$2.DURATION.LAMBDA_WORKER), vendorTag, } = props;
         // Create a mutable copy of the environment variables
         let environment = { ...initialEnvironment };
         // Default environment variables from process.env if present
@@ -50,18 +307,18 @@ class JaypieLambda extends Construct {
         // Add Datadog integration if API key is available
         if (resolvedDatadogApiKeyArn) {
             // Add Datadog Node.js layer
-            const datadogNodeLayer = lambda.LayerVersion.fromLayerVersionArn(this, "DatadogNodeLayer", `arn:aws:lambda:${Stack.of(this).region}:464622532012:layer:Datadog-Node20-x:${CDK.DATADOG.LAYER.NODE}`);
+            const datadogNodeLayer = lambda.LayerVersion.fromLayerVersionArn(this, "DatadogNodeLayer", `arn:aws:lambda:${Stack.of(this).region}:464622532012:layer:Datadog-Node20-x:${CDK$2.DATADOG.LAYER.NODE}`);
             resolvedLayers.push(datadogNodeLayer);
             // Add Datadog Extension layer
-            const datadogExtensionLayer = lambda.LayerVersion.fromLayerVersionArn(this, "DatadogExtensionLayer", `arn:aws:lambda:${Stack.of(this).region}:464622532012:layer:Datadog-Extension:${CDK.DATADOG.LAYER.EXTENSION}`);
+            const datadogExtensionLayer = lambda.LayerVersion.fromLayerVersionArn(this, "DatadogExtensionLayer", `arn:aws:lambda:${Stack.of(this).region}:464622532012:layer:Datadog-Extension:${CDK$2.DATADOG.LAYER.EXTENSION}`);
             resolvedLayers.push(datadogExtensionLayer);
             // Set Datadog environment variables
             Object.assign(environment, {
                 DD_API_KEY_SECRET_ARN: resolvedDatadogApiKeyArn,
                 DD_ENV: process.env.PROJECT_ENV || "",
                 DD_SERVICE: process.env.PROJECT_SERVICE || "",
-                DD_SITE: CDK.DATADOG.SITE,
-                DD_TAGS: `${CDK.TAG.SPONSOR}:${process.env.PROJECT_SPONSOR || ""}`,
+                DD_SITE: CDK$2.DATADOG.SITE,
+                DD_TAGS: `${CDK$2.TAG.SPONSOR}:${process.env.PROJECT_SPONSOR || ""}`,
             });
         }
         // Configure ParamsAndSecrets layer
@@ -132,11 +389,19 @@ class JaypieLambda extends Construct {
             const datadogApiKey = secretsmanager.Secret.fromSecretCompleteArn(this, "DatadogApiKeyGrant", resolvedDatadogApiKeyArn);
             datadogApiKey.grantRead(this._lambda);
         }
+        // Configure provisioned concurrency if specified
+        if (provisionedConcurrentExecutions !== undefined) {
+            new lambda.Alias(this, "ProvisionedAlias", {
+                aliasName: "provisioned",
+                version: this._lambda.currentVersion,
+                provisionedConcurrentExecutions,
+            });
+        }
         if (roleTag) {
-            Tags.of(this._lambda).add(CDK.TAG.ROLE, roleTag);
+            Tags.of(this._lambda).add(CDK$2.TAG.ROLE, roleTag);
         }
         if (vendorTag) {
-            Tags.of(this._lambda).add(CDK.TAG.VENDOR, vendorTag);
+            Tags.of(this._lambda).add(CDK$2.TAG.VENDOR, vendorTag);
         }
     }
     // Public accessors
@@ -246,7 +511,7 @@ class JaypieLambda extends Construct {
 class JaypieQueuedLambda extends Construct {
     constructor(scope, id, props) {
         super(scope, id);
-        const { batchSize = 1, code, environment = {}, envSecrets = {}, fifo = true, handler = "index.handler", layers = [], logRetention = CDK.LAMBDA.LOG_RETENTION, memorySize = CDK.LAMBDA.MEMORY_SIZE, paramsAndSecrets, reservedConcurrentExecutions, roleTag, runtime = lambda.Runtime.NODEJS_22_X, secrets = [], timeout = Duration.seconds(CDK.DURATION.LAMBDA_WORKER), vendorTag, visibilityTimeout = Duration.seconds(CDK.DURATION.LAMBDA_WORKER), } = props;
+        const { batchSize = 1, code, environment = {}, envSecrets = {}, fifo = true, handler = "index.handler", layers = [], logRetention = CDK$2.LAMBDA.LOG_RETENTION, memorySize = CDK$2.LAMBDA.MEMORY_SIZE, paramsAndSecrets, reservedConcurrentExecutions, roleTag, runtime = lambda.Runtime.NODEJS_22_X, secrets = [], timeout = Duration.seconds(CDK$2.DURATION.LAMBDA_WORKER), vendorTag, visibilityTimeout = Duration.seconds(CDK$2.DURATION.LAMBDA_WORKER), } = props;
         // Create SQS Queue
         this._queue = new sqs.Queue(this, "Queue", {
             fifo,
@@ -255,10 +520,10 @@ class JaypieQueuedLambda extends Construct {
                 : visibilityTimeout,
         });
         if (roleTag) {
-            Tags.of(this._queue).add(CDK.TAG.ROLE, roleTag);
+            Tags.of(this._queue).add(CDK$2.TAG.ROLE, roleTag);
         }
         if (vendorTag) {
-            Tags.of(this._queue).add(CDK.TAG.VENDOR, vendorTag);
+            Tags.of(this._queue).add(CDK$2.TAG.VENDOR, vendorTag);
         }
         // Create Lambda with JaypieLambda
         this._lambdaConstruct = new JaypieLambda(this, "Function", {
@@ -464,10 +729,10 @@ class JaypieBucketQueuedLambda extends JaypieQueuedLambda {
         });
         // Add tags to bucket
         if (roleTag) {
-            Tags.of(this._bucket).add(CDK.TAG.ROLE, roleTag);
+            Tags.of(this._bucket).add(CDK$2.TAG.ROLE, roleTag);
         }
         if (vendorTag) {
-            Tags.of(this._bucket).add(CDK.TAG.VENDOR, vendorTag);
+            Tags.of(this._bucket).add(CDK$2.TAG.VENDOR, vendorTag);
         }
         // Add an event notification from the bucket to the queue
         this._bucket.addEventNotification(s3.EventType.OBJECT_CREATED, new s3n.SqsDestination(this.queue));
@@ -632,13 +897,13 @@ class JaypieBucketQueuedLambda extends JaypieQueuedLambda {
 
 // It is a consumer if the environment is ephemeral
 function checkEnvIsConsumer(env = process.env) {
-    return (env.PROJECT_ENV === CDK.ENV.PERSONAL ||
+    return (env.PROJECT_ENV === CDK$2.ENV.PERSONAL ||
         !!env.CDK_ENV_PERSONAL ||
         /** @deprecated */ env.PROJECT_ENV === "ephemeral" ||
         /** @deprecated */ !!env.CDK_ENV_EPHEMERAL);
 }
 function checkEnvIsProvider(env = process.env) {
-    return env.PROJECT_ENV === CDK.ENV.SANDBOX;
+    return env.PROJECT_ENV === CDK$2.ENV.SANDBOX;
 }
 function cleanName(name) {
     return name.replace(/[^a-zA-Z0-9:-]/g, "");
@@ -652,7 +917,7 @@ function exportEnvName(name, env = process.env) {
     }
     else {
         if (checkEnvIsConsumer(env)) {
-            rawName = `env-${CDK.ENV.SANDBOX}-${env.PROJECT_KEY}-${name}`;
+            rawName = `env-${CDK$2.ENV.SANDBOX}-${env.PROJECT_KEY}-${name}`;
         }
         else {
             rawName = `env-${env.PROJECT_ENV}-${env.PROJECT_KEY}-${name}`;
@@ -689,10 +954,10 @@ class JaypieEnvSecret extends Construct {
             };
             this._secret = new secretsmanager.Secret(this, id, secretProps);
             if (roleTag) {
-                Tags.of(this._secret).add(CDK.TAG.ROLE, roleTag);
+                Tags.of(this._secret).add(CDK$2.TAG.ROLE, roleTag);
             }
             if (vendorTag) {
-                Tags.of(this._secret).add(CDK.TAG.VENDOR, vendorTag);
+                Tags.of(this._secret).add(CDK$2.TAG.VENDOR, vendorTag);
             }
             if (provider) {
                 new CfnOutput(this, `ProvidedName`, {
@@ -766,8 +1031,8 @@ class JaypieDatadogSecret extends JaypieEnvSecret {
     constructor(scope, id = "MongoConnectionString", props) {
         const defaultProps = {
             envKey: "DATADOG_API_KEY",
-            roleTag: CDK.ROLE.MONITORING,
-            vendorTag: CDK.VENDOR.DATADOG,
+            roleTag: CDK$2.ROLE.MONITORING,
+            vendorTag: CDK$2.VENDOR.DATADOG,
             ...props,
         };
         super(scope, id, defaultProps);
@@ -777,8 +1042,8 @@ class JaypieDatadogSecret extends JaypieEnvSecret {
 class JaypieExpressLambda extends JaypieLambda {
     constructor(scope, id, props) {
         super(scope, id, {
-            timeout: Duration.seconds(CDK.DURATION.EXPRESS_API),
-            roleTag: CDK.ROLE.API,
+            timeout: Duration.seconds(CDK$2.DURATION.EXPRESS_API),
+            roleTag: CDK$2.ROLE.API,
             ...props,
         });
     }
@@ -794,7 +1059,7 @@ class JaypieHostedZone extends Construct {
     constructor(scope, id, props) {
         super(scope, id);
         const { destination, zoneName, project } = props;
-        const service = props.service || CDK.SERVICE.INFRASTRUCTURE;
+        const service = props.service || CDK$2.SERVICE.INFRASTRUCTURE;
         // Create the log group
         this.logGroup = new LogGroup(this, "LogGroup", {
             logGroupName: process.env.PROJECT_NONCE
@@ -803,10 +1068,10 @@ class JaypieHostedZone extends Construct {
             retention: RetentionDays.ONE_WEEK,
         });
         // Add tags
-        cdk.Tags.of(this.logGroup).add(CDK.TAG.SERVICE, service);
-        cdk.Tags.of(this.logGroup).add(CDK.TAG.ROLE, CDK.ROLE.NETWORKING);
+        cdk.Tags.of(this.logGroup).add(CDK$2.TAG.SERVICE, service);
+        cdk.Tags.of(this.logGroup).add(CDK$2.TAG.ROLE, CDK$2.ROLE.NETWORKING);
         if (project) {
-            cdk.Tags.of(this.logGroup).add(CDK.TAG.PROJECT, project);
+            cdk.Tags.of(this.logGroup).add(CDK$2.TAG.PROJECT, project);
         }
         // Grant Route 53 permissions to write to the log group
         this.logGroup.grantWrite(new ServicePrincipal(SERVICE.ROUTE53));
@@ -823,10 +1088,30 @@ class JaypieHostedZone extends Construct {
             zoneName,
         });
         // Add tags
-        cdk.Tags.of(this.hostedZone).add(CDK.TAG.SERVICE, service);
-        cdk.Tags.of(this.hostedZone).add(CDK.TAG.ROLE, CDK.ROLE.NETWORKING);
+        cdk.Tags.of(this.hostedZone).add(CDK$2.TAG.SERVICE, service);
+        cdk.Tags.of(this.hostedZone).add(CDK$2.TAG.ROLE, CDK$2.ROLE.NETWORKING);
         if (project) {
-            cdk.Tags.of(this.hostedZone).add(CDK.TAG.PROJECT, project);
+            cdk.Tags.of(this.hostedZone).add(CDK$2.TAG.PROJECT, project);
+        }
+    }
+}
+
+const CDK = {
+    TAG: {
+        STACK_SHA: "stackSha",
+    },
+};
+class JaypieInfrastructureStack extends JaypieStack {
+    constructor(scope, id, props = {}) {
+        const { key = "infra", ...stackProps } = props;
+        // Handle stackName
+        if (!stackProps.stackName) {
+            stackProps.stackName = constructStackName(key);
+        }
+        super(scope, id, { key, ...stackProps });
+        // Add infrastructure-specific tag
+        if (process.env.CDK_ENV_INFRASTRUCTURE_STACK_SHA) {
+            Tags.of(this).add(CDK.TAG.STACK_SHA, process.env.CDK_ENV_INFRASTRUCTURE_STACK_SHA);
         }
     }
 }
@@ -835,8 +1120,8 @@ class JaypieMongoDbSecret extends JaypieEnvSecret {
     constructor(scope, id = "MongoConnectionString", props) {
         const defaultProps = {
             envKey: "MONGODB_URI",
-            roleTag: CDK.ROLE.STORAGE,
-            vendorTag: CDK.VENDOR.MONGODB,
+            roleTag: CDK$2.ROLE.STORAGE,
+            vendorTag: CDK$2.VENDOR.MONGODB,
             ...props,
         };
         super(scope, id, defaultProps);
@@ -847,8 +1132,8 @@ class JaypieOpenAiSecret extends JaypieEnvSecret {
     constructor(scope, id = "OpenAiApiKey", props) {
         const defaultProps = {
             envKey: "OPENAI_API_KEY",
-            roleTag: CDK.ROLE.PROCESSING,
-            vendorTag: CDK.VENDOR.OPENAI,
+            roleTag: CDK$2.ROLE.PROCESSING,
+            vendorTag: CDK$2.VENDOR.OPENAI,
             ...props,
         };
         super(scope, id, defaultProps);
@@ -912,7 +1197,7 @@ class JaypieSsoGroups extends Construct {
             managedPolicies: ["arn:aws:iam::aws:policy/AdministratorAccess"],
             inlinePolicy: mergedPolicy,
         });
-        Tags.of(permissionSet).add(CDK.TAG.SERVICE, CDK.SERVICE.SSO);
+        Tags.of(permissionSet).add(CDK$2.TAG.SERVICE, CDK$2.SERVICE.SSO);
         this.permissionSets[PermissionSetType.ADMINISTRATOR] = permissionSet;
     }
     /**
@@ -949,7 +1234,7 @@ class JaypieSsoGroups extends Construct {
             managedPolicies: ["arn:aws:iam::aws:policy/ReadOnlyAccess"],
             inlinePolicy: mergedPolicy,
         });
-        Tags.of(permissionSet).add(CDK.TAG.SERVICE, CDK.SERVICE.SSO);
+        Tags.of(permissionSet).add(CDK$2.TAG.SERVICE, CDK$2.SERVICE.SSO);
         this.permissionSets[PermissionSetType.ANALYST] = permissionSet;
     }
     /**
@@ -1003,7 +1288,7 @@ class JaypieSsoGroups extends Construct {
             ],
             inlinePolicy: mergedPolicy,
         });
-        Tags.of(permissionSet).add(CDK.TAG.SERVICE, CDK.SERVICE.SSO);
+        Tags.of(permissionSet).add(CDK$2.TAG.SERVICE, CDK$2.SERVICE.SSO);
         this.permissionSets[PermissionSetType.DEVELOPER] = permissionSet;
     }
     /**
@@ -1070,7 +1355,7 @@ class JaypieSsoGroups extends Construct {
                 targetId: accountId,
                 targetType: "AWS_ACCOUNT",
             });
-            Tags.of(assignment).add(CDK.TAG.SERVICE, CDK.SERVICE.SSO);
+            Tags.of(assignment).add(CDK$2.TAG.SERVICE, CDK$2.SERVICE.SSO);
             Tags.of(assignment).add("Group", "administrators");
         });
     }
@@ -1097,7 +1382,7 @@ class JaypieSsoGroups extends Construct {
                 targetId: accountId,
                 targetType: "AWS_ACCOUNT",
             });
-            Tags.of(assignment).add(CDK.TAG.SERVICE, CDK.SERVICE.SSO);
+            Tags.of(assignment).add(CDK$2.TAG.SERVICE, CDK$2.SERVICE.SSO);
             Tags.of(assignment).add("Group", "analysts");
         });
     }
@@ -1123,7 +1408,7 @@ class JaypieSsoGroups extends Construct {
                 targetId: accountId,
                 targetType: "AWS_ACCOUNT",
             });
-            Tags.of(assignment).add(CDK.TAG.SERVICE, CDK.SERVICE.SSO);
+            Tags.of(assignment).add(CDK$2.TAG.SERVICE, CDK$2.SERVICE.SSO);
             Tags.of(assignment).add("Group", "developers");
         });
     }
@@ -1133,13 +1418,258 @@ class JaypieTraceSigningKeySecret extends JaypieEnvSecret {
     constructor(scope, id = "TraceSigningKey", props) {
         const defaultProps = {
             envKey: "TRACE_SIGNING_KEY",
-            roleTag: CDK.ROLE.API,
-            vendorTag: CDK.VENDOR.KNOWTRACE,
+            roleTag: CDK$2.ROLE.API,
+            vendorTag: CDK$2.VENDOR.KNOWTRACE,
             ...props,
         };
         super(scope, id, defaultProps);
     }
 }
 
-export { JaypieBucketQueuedLambda, JaypieDatadogSecret, JaypieEnvSecret, JaypieExpressLambda, JaypieHostedZone, JaypieLambda, JaypieMongoDbSecret, JaypieOpenAiSecret, JaypieQueuedLambda, JaypieSsoGroups, JaypieTraceSigningKeySecret, PermissionSetType };
+class JaypieWebDeploymentBucket extends Construct {
+    constructor(scope, id, props = {}) {
+        super(scope, id);
+        const roleTag = props.roleTag || CDK$2.ROLE.HOSTING;
+        // Environment variable validation
+        if (process.env.CDK_ENV_WEB_SUBDOMAIN &&
+            !isValidSubdomain(process.env.CDK_ENV_WEB_SUBDOMAIN)) {
+            throw new ConfigurationError("CDK_ENV_WEB_SUBDOMAIN is not a valid subdomain");
+        }
+        if (process.env.CDK_ENV_WEB_HOSTED_ZONE &&
+            !isValidHostname(process.env.CDK_ENV_WEB_HOSTED_ZONE)) {
+            throw new ConfigurationError("CDK_ENV_WEB_HOSTED_ZONE is not a valid hostname");
+        }
+        if (process.env.CDK_ENV_HOSTED_ZONE &&
+            !isValidHostname(process.env.CDK_ENV_HOSTED_ZONE)) {
+            throw new ConfigurationError("CDK_ENV_HOSTED_ZONE is not a valid hostname");
+        }
+        // Determine host from props or environment
+        let host = props.host;
+        if (!host) {
+            try {
+                host =
+                    process.env.CDK_ENV_WEB_HOST ||
+                        mergeDomain(process.env.CDK_ENV_WEB_SUBDOMAIN || "", process.env.CDK_ENV_WEB_HOSTED_ZONE ||
+                            process.env.CDK_ENV_HOSTED_ZONE ||
+                            "");
+            }
+            catch {
+                host = undefined;
+            }
+        }
+        if (host && !isValidHostname(host)) {
+            throw new ConfigurationError("Host is not a valid hostname");
+        }
+        // Determine zone from props or environment
+        const zone = props.zone ||
+            process.env.CDK_ENV_WEB_HOSTED_ZONE ||
+            process.env.CDK_ENV_HOSTED_ZONE;
+        // Create the S3 bucket
+        this.bucket = new s3.Bucket(this, "DestinationBucket", {
+            accessControl: s3.BucketAccessControl.BUCKET_OWNER_FULL_CONTROL,
+            autoDeleteObjects: true,
+            blockPublicAccess: s3.BlockPublicAccess.BLOCK_ACLS,
+            bucketName: props.name || constructEnvName("web"),
+            publicReadAccess: true,
+            removalPolicy: RemovalPolicy.DESTROY,
+            versioned: false,
+            websiteErrorDocument: "index.html",
+            websiteIndexDocument: "index.html",
+            ...props,
+        });
+        // Delegate IBucket properties to the bucket
+        this.bucketArn = this.bucket.bucketArn;
+        this.bucketDomainName = this.bucket.bucketDomainName;
+        this.bucketDualStackDomainName = this.bucket.bucketDualStackDomainName;
+        this.bucketName = this.bucket.bucketName;
+        this.bucketRegionalDomainName = this.bucket.bucketRegionalDomainName;
+        this.bucketWebsiteDomainName = this.bucket.bucketWebsiteDomainName;
+        this.bucketWebsiteUrl = this.bucket.bucketWebsiteUrl;
+        this.encryptionKey = this.bucket.encryptionKey;
+        this.isWebsite = this.bucket.isWebsite;
+        this.notificationsHandlerRole = undefined;
+        this.policy = this.bucket.policy;
+        Tags.of(this.bucket).add(CDK$2.TAG.ROLE, roleTag);
+        // Create deployment role if repository is configured
+        let repo;
+        if (process.env.CDK_ENV_REPO) {
+            repo = `repo:${process.env.CDK_ENV_REPO}:*`;
+        }
+        if (repo) {
+            const bucketDeployRole = new Role(this, "DestinationBucketDeployRole", {
+                assumedBy: new FederatedPrincipal(Fn.importValue(CDK$2.IMPORT.OIDC_PROVIDER), {
+                    StringLike: {
+                        "token.actions.githubusercontent.com:sub": repo,
+                    },
+                }, "sts:AssumeRoleWithWebIdentity"),
+                maxSessionDuration: Duration.hours(1),
+            });
+            Tags.of(bucketDeployRole).add(CDK$2.TAG.ROLE, CDK$2.ROLE.DEPLOY);
+            // Allow the role to write to the bucket
+            bucketDeployRole.addToPolicy(new PolicyStatement({
+                effect: Effect.ALLOW,
+                actions: [
+                    "s3:DeleteObject",
+                    "s3:GetObject",
+                    "s3:ListObjectsV2",
+                    "s3:PutObject",
+                ],
+                resources: [`${this.bucket.bucketArn}/*`],
+            }));
+            bucketDeployRole.addToPolicy(new PolicyStatement({
+                effect: Effect.ALLOW,
+                actions: ["s3:ListBucket"],
+                resources: [this.bucket.bucketArn],
+            }));
+            // Allow the role to deploy CDK apps
+            bucketDeployRole.addToPolicy(new PolicyStatement({
+                actions: ["cloudformation:DescribeStacks"],
+                effect: Effect.ALLOW,
+                resources: ["*"], // TODO: restrict to this stack
+            }));
+            this.deployRoleArn = bucketDeployRole.roleArn;
+            // Output the deploy role ARN
+            new CfnOutput(this, "DestinationBucketDeployRoleArn", {
+                value: bucketDeployRole.roleArn,
+            });
+        }
+        // Create CloudFront distribution and certificate if host and zone are provided
+        if (host && zone) {
+            const hostedZone = typeof zone === "string"
+                ? route53.HostedZone.fromLookup(this, "HostedZone", {
+                    domainName: zone,
+                })
+                : zone;
+            // Create certificate if not provided
+            if (props.certificate !== false) {
+                this.certificate =
+                    typeof props.certificate === "object"
+                        ? props.certificate
+                        : new acm.Certificate(this, "Certificate", {
+                            domainName: host,
+                            validation: acm.CertificateValidation.fromDns(hostedZone),
+                        });
+                new CfnOutput(this, "CertificateArn", {
+                    value: this.certificate.certificateArn,
+                });
+                Tags.of(this.certificate).add(CDK$2.TAG.ROLE, roleTag);
+            }
+            // Create CloudFront distribution
+            this.distribution = new cloudfront.Distribution(this, "Distribution", {
+                defaultBehavior: {
+                    cachePolicy: cloudfront.CachePolicy.CACHING_DISABLED,
+                    origin: new origins.S3Origin(this.bucket),
+                    viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+                },
+                certificate: this.certificate,
+                domainNames: [host],
+            });
+            Tags.of(this.distribution).add(CDK$2.TAG.ROLE, roleTag);
+            // If this is production, enable caching on everything but index.html
+            if (isProductionEnv()) {
+                this.distribution.addBehavior("/*", new origins.S3Origin(this.bucket), {
+                    viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+                    cachePolicy: cloudfront.CachePolicy.CACHING_OPTIMIZED,
+                });
+            }
+            // Create DNS record
+            const record = new route53.ARecord(this, "AliasRecord", {
+                recordName: host,
+                target: route53.RecordTarget.fromAlias(new route53Targets.CloudFrontTarget(this.distribution)),
+                zone: hostedZone,
+            });
+            Tags.of(record).add(CDK$2.TAG.ROLE, CDK$2.ROLE.NETWORKING);
+            this.distributionDomainName = this.distribution.distributionDomainName;
+        }
+    }
+    // Implement remaining IBucket methods by delegating to the bucket
+    addEventNotification(event, dest, ...filters) {
+        this.bucket.addEventNotification(event, dest, ...filters);
+    }
+    addObjectCreatedNotification(dest, ...filters) {
+        this.bucket.addObjectCreatedNotification(dest, ...filters);
+    }
+    addObjectRemovedNotification(dest, ...filters) {
+        this.bucket.addObjectRemovedNotification(dest, ...filters);
+    }
+    addToResourcePolicy(permission) {
+        return this.bucket.addToResourcePolicy(permission);
+    }
+    arnForObjects(keyPattern) {
+        return this.bucket.arnForObjects(keyPattern);
+    }
+    grantDelete(identity, objectsKeyPattern) {
+        return this.bucket.grantDelete(identity, objectsKeyPattern);
+    }
+    grantPublicAccess(allowedActions, keyPrefix) {
+        return keyPrefix
+            ? this.bucket.grantPublicAccess(allowedActions, keyPrefix)
+            : this.bucket.grantPublicAccess(allowedActions);
+    }
+    grantPut(identity, objectsKeyPattern) {
+        return this.bucket.grantPut(identity, objectsKeyPattern);
+    }
+    grantPutAcl(identity, objectsKeyPattern) {
+        return this.bucket.grantPutAcl(identity, objectsKeyPattern);
+    }
+    grantRead(identity, objectsKeyPattern) {
+        return this.bucket.grantRead(identity, objectsKeyPattern);
+    }
+    grantReadWrite(identity, objectsKeyPattern) {
+        return this.bucket.grantReadWrite(identity, objectsKeyPattern);
+    }
+    grantWrite(identity, objectsKeyPattern) {
+        return this.bucket.grantWrite(identity, objectsKeyPattern);
+    }
+    s3UrlForObject(key) {
+        return this.bucket.s3UrlForObject(key);
+    }
+    urlForObject(key) {
+        return this.bucket.urlForObject(key);
+    }
+    virtualHostedUrlForObject(key, options) {
+        return this.bucket.virtualHostedUrlForObject(key, options);
+    }
+    transferAccelerationUrlForObject(key) {
+        return this.bucket.transferAccelerationUrlForObject(key);
+    }
+    onCloudTrailEvent(id, options) {
+        return this.bucket.onCloudTrailEvent(id, options);
+    }
+    onCloudTrailPutObject(id, options) {
+        return this.bucket.onCloudTrailPutObject(id, options);
+    }
+    onCloudTrailWriteObject(id, options) {
+        return this.bucket.onCloudTrailWriteObject(id, options);
+    }
+    addCorsRule(rule) {
+        this.bucket.addCorsRule(rule);
+    }
+    addInventory(inventory) {
+        this.bucket.addInventory(inventory);
+    }
+    addLifecycleRule(rule) {
+        this.bucket.addLifecycleRule(rule);
+    }
+    addMetric(metric) {
+        this.bucket.addMetric(metric);
+    }
+    enableEventBridgeNotification() {
+        this.bucket.enableEventBridgeNotification();
+    }
+    addReplicationPolicy(policy) {
+        this.bucket.addReplicationPolicy(policy);
+    }
+    get stack() {
+        return this.bucket.stack;
+    }
+    get env() {
+        return this.bucket.env;
+    }
+    applyRemovalPolicy(policy) {
+        this.bucket.applyRemovalPolicy(policy);
+    }
+}
+
+export { JaypieApiGateway, JaypieAppStack, JaypieBucketQueuedLambda, JaypieDatadogSecret, JaypieEnvSecret, JaypieExpressLambda, JaypieHostedZone, JaypieInfrastructureStack, JaypieLambda, JaypieMongoDbSecret, JaypieOpenAiSecret, JaypieQueuedLambda, JaypieSsoGroups, JaypieStack, JaypieTraceSigningKeySecret, JaypieWebDeploymentBucket, PermissionSetType, constructEnvName, constructStackName, isEnv, isProductionEnv, isSandboxEnv, stackTagger };
 //# sourceMappingURL=index.js.map