@jaypie/constructs 1.1.39 → 1.1.41

package/dist/cjs/index.cjs

@@ -1,18 +1,18 @@
 'use strict';
 
 var constructs = require('constructs');
-var cdk$1 = require('aws-cdk-lib');
+var cdk = require('aws-cdk-lib');
 var acm = require('aws-cdk-lib/aws-certificatemanager');
 var apiGateway = require('aws-cdk-lib/aws-apigateway');
 var route53 = require('aws-cdk-lib/aws-route53');
 var route53Targets = require('aws-cdk-lib/aws-route53-targets');
-var cdk = require('@jaypie/cdk');
+var cdk$1 = require('@jaypie/cdk');
+var lambda = require('aws-cdk-lib/aws-lambda');
+var secretsmanager = require('aws-cdk-lib/aws-secretsmanager');
 var s3 = require('aws-cdk-lib/aws-s3');
 var s3n = require('aws-cdk-lib/aws-s3-notifications');
-var lambda = require('aws-cdk-lib/aws-lambda');
 var sqs = require('aws-cdk-lib/aws-sqs');
 var lambdaEventSources = require('aws-cdk-lib/aws-lambda-event-sources');
-var secretsmanager = require('aws-cdk-lib/aws-secretsmanager');
 var awsIam = require('aws-cdk-lib/aws-iam');
 var awsLogs = require('aws-cdk-lib/aws-logs');
 var sso = require('aws-cdk-lib/aws-sso');
@@ -36,25 +36,118 @@ function _interopNamespaceDefault(e) {
     return Object.freeze(n);
 }
 
-var cdk__namespace = /*#__PURE__*/_interopNamespaceDefault(cdk$1);
+var cdk__namespace = /*#__PURE__*/_interopNamespaceDefault(cdk);
 var acm__namespace = /*#__PURE__*/_interopNamespaceDefault(acm);
 var apiGateway__namespace = /*#__PURE__*/_interopNamespaceDefault(apiGateway);
 var route53__namespace = /*#__PURE__*/_interopNamespaceDefault(route53);
 var route53Targets__namespace = /*#__PURE__*/_interopNamespaceDefault(route53Targets);
+var lambda__namespace = /*#__PURE__*/_interopNamespaceDefault(lambda);
+var secretsmanager__namespace = /*#__PURE__*/_interopNamespaceDefault(secretsmanager);
 var s3__namespace = /*#__PURE__*/_interopNamespaceDefault(s3);
 var s3n__namespace = /*#__PURE__*/_interopNamespaceDefault(s3n);
-var lambda__namespace = /*#__PURE__*/_interopNamespaceDefault(lambda);
 var sqs__namespace = /*#__PURE__*/_interopNamespaceDefault(sqs);
 var lambdaEventSources__namespace = /*#__PURE__*/_interopNamespaceDefault(lambdaEventSources);
-var secretsmanager__namespace = /*#__PURE__*/_interopNamespaceDefault(secretsmanager);
 var sso__namespace = /*#__PURE__*/_interopNamespaceDefault(sso);
 var cloudfront__namespace = /*#__PURE__*/_interopNamespaceDefault(cloudfront);
 var origins__namespace = /*#__PURE__*/_interopNamespaceDefault(origins);
 
+function addDatadogLayer(lambdaFunction, options = {}) {
+    const { datadogApiKeyArn } = options;
+    // Resolve the Datadog API key ARN from multiple sources
+    const resolvedDatadogApiKeyArn = datadogApiKeyArn ||
+        process.env.DATADOG_API_KEY_ARN ||
+        process.env.CDK_ENV_DATADOG_API_KEY_ARN;
+    // Return false if no API key is found
+    if (!resolvedDatadogApiKeyArn) {
+        return false;
+    }
+    const stack = cdk.Stack.of(lambdaFunction);
+    // Create Datadog Node.js layer
+    const datadogNodeLayer = lambda__namespace.LayerVersion.fromLayerVersionArn(stack, `DatadogNodeLayer-${lambdaFunction.node.id}`, `arn:aws:lambda:${stack.region}:464622532012:layer:Datadog-Node20-x:${cdk$1.CDK.DATADOG.LAYER.NODE}`);
+    // Create Datadog Extension layer
+    const datadogExtensionLayer = lambda__namespace.LayerVersion.fromLayerVersionArn(stack, `DatadogExtensionLayer-${lambdaFunction.node.id}`, `arn:aws:lambda:${stack.region}:464622532012:layer:Datadog-Extension:${cdk$1.CDK.DATADOG.LAYER.EXTENSION}`);
+    // Add layers to the lambda function
+    lambdaFunction.addLayers(datadogNodeLayer, datadogExtensionLayer);
+    // Define Datadog environment variables
+    const datadogEnvVars = {
+        DD_API_KEY_SECRET_ARN: resolvedDatadogApiKeyArn,
+        DD_ENHANCED_METRICS: "true",
+        DD_ENV: process.env.PROJECT_ENV || "",
+        DD_PROFILING_ENABLED: "false",
+        DD_SERVERLESS_APPSEC_ENABLED: "false",
+        DD_SERVICE: process.env.PROJECT_SERVICE || "",
+        DD_SITE: cdk$1.CDK.DATADOG.SITE,
+        DD_TAGS: `${cdk$1.CDK.TAG.SPONSOR}:${process.env.PROJECT_SPONSOR || ""}`,
+        DD_TRACE_OTEL_ENABLED: "false",
+    };
+    // Add environment variables only if they don't already exist
+    Object.entries(datadogEnvVars).forEach(([key, value]) => {
+        if (lambdaFunction.environment[key] === undefined) {
+            lambdaFunction.addEnvironment(key, value);
+        }
+    });
+    // Grant Datadog API key read permission
+    const datadogApiKey = secretsmanager__namespace.Secret.fromSecretCompleteArn(stack, `DatadogApiKeyGrant-${lambdaFunction.node.id}`, resolvedDatadogApiKeyArn);
+    datadogApiKey.grantRead(lambdaFunction);
+    return true;
+}
+
+function addParamsAndSecrets(lambdaFunction, options = {}) {
+    const { paramsAndSecrets, paramsAndSecretsOptions } = options;
+    // Return false if explicitly disabled
+    if (paramsAndSecrets === false) {
+        return false;
+    }
+    const stack = cdk.Stack.of(lambdaFunction);
+    let resolvedLayer = undefined;
+    if (paramsAndSecrets instanceof lambda__namespace.ParamsAndSecretsLayerVersion) {
+        // For custom ParamsAndSecretsLayerVersion, we need to extract the ARN
+        // This is a workaround since ParamsAndSecretsLayerVersion doesn't implement ILayerVersion
+        const layerArn = `arn:aws:lambda:${stack.region}:017000801446:layer:AWSLambdaParametersAndSecrets:${lambda__namespace.ParamsAndSecretsVersions.V1_0_103}`;
+        resolvedLayer = lambda__namespace.LayerVersion.fromLayerVersionArn(stack, `ParamsAndSecretsLayer-${lambdaFunction.node.id}`, layerArn);
+        // Set environment variables for configuration
+        if (paramsAndSecretsOptions?.cacheSize) {
+            lambdaFunction.addEnvironment("PARAMETERS_SECRETS_EXTENSION_CACHE_SIZE", paramsAndSecretsOptions.cacheSize.toString());
+        }
+        if (paramsAndSecretsOptions?.logLevel) {
+            lambdaFunction.addEnvironment("PARAMETERS_SECRETS_EXTENSION_LOG_LEVEL", paramsAndSecretsOptions.logLevel);
+        }
+        if (paramsAndSecretsOptions?.parameterStoreTtl) {
+            lambdaFunction.addEnvironment("PARAMETERS_SECRETS_EXTENSION_PARAMETER_STORE_TTL", paramsAndSecretsOptions.parameterStoreTtl.toString());
+        }
+        if (paramsAndSecretsOptions?.secretsManagerTtl) {
+            lambdaFunction.addEnvironment("PARAMETERS_SECRETS_EXTENSION_SECRETS_MANAGER_TTL", paramsAndSecretsOptions.secretsManagerTtl.toString());
+        }
+    }
+    else {
+        // Create default ParamsAndSecrets layer using LayerVersion.fromLayerVersionArn
+        const layerArn = `arn:aws:lambda:${stack.region}:017000801446:layer:AWSLambdaParametersAndSecrets:${lambda__namespace.ParamsAndSecretsVersions.V1_0_103}`;
+        resolvedLayer = lambda__namespace.LayerVersion.fromLayerVersionArn(stack, `ParamsAndSecretsLayer-${lambdaFunction.node.id}`, layerArn);
+        // Set default environment variables
+        if (paramsAndSecretsOptions?.cacheSize) {
+            lambdaFunction.addEnvironment("PARAMETERS_SECRETS_EXTENSION_CACHE_SIZE", paramsAndSecretsOptions.cacheSize.toString());
+        }
+        const logLevel = paramsAndSecretsOptions?.logLevel || lambda__namespace.ParamsAndSecretsLogLevel.WARN;
+        lambdaFunction.addEnvironment("PARAMETERS_SECRETS_EXTENSION_LOG_LEVEL", logLevel);
+        if (paramsAndSecretsOptions?.parameterStoreTtl) {
+            lambdaFunction.addEnvironment("PARAMETERS_SECRETS_EXTENSION_PARAMETER_STORE_TTL", paramsAndSecretsOptions.parameterStoreTtl.toString());
+        }
+        if (paramsAndSecretsOptions?.secretsManagerTtl) {
+            lambdaFunction.addEnvironment("PARAMETERS_SECRETS_EXTENSION_SECRETS_MANAGER_TTL", paramsAndSecretsOptions.secretsManagerTtl.toString());
+        }
+    }
+    // Add the layer to the lambda function
+    if (resolvedLayer) {
+        lambdaFunction.addLayers(resolvedLayer);
+        return true;
+    }
+    return false;
+}
+
 function constructEnvName(name, opts) {
     const env = opts?.env ?? process.env.PROJECT_ENV ?? "build";
     const key = opts?.key ?? process.env.PROJECT_KEY ?? "project";
-    const nonce = opts?.nonce ?? process.env.PROJECT_NONCE ?? "cfe2";
+    const nonce = opts?.nonce ?? process.env.PROJECT_NONCE ?? "cfe2"; // This default is intentionally short. It is not a special value but should not be changed.
     return `${env}-${key}-${name}-${nonce}`;
 }
 
@@ -67,25 +160,6 @@ function constructStackName(key) {
     }
 }
 
-/**
- * Check if the current environment matches the given environment
- */
-function isEnv(env) {
-    return process.env.PROJECT_ENV === env;
-}
-/**
- * Check if the current environment is production
- */
-function isProductionEnv() {
-    return isEnv(cdk.CDK.ENV.PRODUCTION);
-}
-/**
- * Check if the current environment is sandbox
- */
-function isSandboxEnv() {
-    return isEnv(cdk.CDK.ENV.SANDBOX);
-}
-
 const CDK$1 = {
     CREATION: {
         CDK: "cdk",
@@ -109,39 +183,141 @@ const CDK$1 = {
         VERSION: "version",
     },
 };
-function stackTagger(stack, { name } = {}) {
+function constructTagger(construct, { name } = {}) {
     const stackName = name || constructStackName();
     const version = process.env.npm_package_version || process.env.PROJECT_VERSION || null;
     if (process.env.PROJECT_COMMIT && process.env.PROJECT_COMMIT.length > 8) {
-        cdk$1.Tags.of(stack).add(CDK$1.TAG.BUILD_HEX, process.env.PROJECT_COMMIT.slice(0, 8));
+        cdk.Tags.of(construct).add(CDK$1.TAG.BUILD_HEX, process.env.PROJECT_COMMIT.slice(0, 8));
     }
-    cdk$1.Tags.of(stack).add(CDK$1.TAG.BUILD_DATE, new Date().toISOString());
-    cdk$1.Tags.of(stack).add(CDK$1.TAG.BUILD_TIME, Date.now().toString());
+    cdk.Tags.of(construct).add(CDK$1.TAG.BUILD_DATE, new Date().toISOString());
+    cdk.Tags.of(construct).add(CDK$1.TAG.BUILD_TIME, Date.now().toString());
     if (process.env.PROJECT_COMMIT)
-        cdk$1.Tags.of(stack).add(CDK$1.TAG.COMMIT, process.env.PROJECT_COMMIT);
-    cdk$1.Tags.of(stack).add(CDK$1.TAG.CREATION, CDK$1.CREATION.CDK);
+        cdk.Tags.of(construct).add(CDK$1.TAG.COMMIT, process.env.PROJECT_COMMIT);
+    cdk.Tags.of(construct).add(CDK$1.TAG.CREATION, CDK$1.CREATION.CDK);
     if (process.env.PROJECT_ENV)
-        cdk$1.Tags.of(stack).add(CDK$1.TAG.ENV, process.env.PROJECT_ENV);
+        cdk.Tags.of(construct).add(CDK$1.TAG.ENV, process.env.PROJECT_ENV);
     if (process.env.PROJECT_NONCE)
-        cdk$1.Tags.of(stack).add(CDK$1.TAG.NONCE, process.env.PROJECT_NONCE);
+        cdk.Tags.of(construct).add(CDK$1.TAG.NONCE, process.env.PROJECT_NONCE);
     if (process.env.PROJECT_KEY)
-        cdk$1.Tags.of(stack).add(CDK$1.TAG.PROJECT, process.env.PROJECT_KEY);
-    cdk$1.Tags.of(stack).add(CDK$1.TAG.ROLE, CDK$1.ROLE.STACK);
+        cdk.Tags.of(construct).add(CDK$1.TAG.PROJECT, process.env.PROJECT_KEY);
+    cdk.Tags.of(construct).add(CDK$1.TAG.ROLE, CDK$1.ROLE.STACK);
     if (process.env.PROJECT_SERVICE)
-        cdk$1.Tags.of(stack).add(CDK$1.TAG.SERVICE, process.env.PROJECT_SERVICE);
+        cdk.Tags.of(construct).add(CDK$1.TAG.SERVICE, process.env.PROJECT_SERVICE);
     if (process.env.PROJECT_SPONSOR)
-        cdk$1.Tags.of(stack).add(CDK$1.TAG.SPONSOR, process.env.PROJECT_SPONSOR);
+        cdk.Tags.of(construct).add(CDK$1.TAG.SPONSOR, process.env.PROJECT_SPONSOR);
     if (stackName)
-        cdk$1.Tags.of(stack).add(CDK$1.TAG.STACK, stackName);
+        cdk.Tags.of(construct).add(CDK$1.TAG.STACK, stackName);
     if (version)
-        cdk$1.Tags.of(stack).add(CDK$1.TAG.VERSION, version);
+        cdk.Tags.of(construct).add(CDK$1.TAG.VERSION, version);
     return true;
 }
 
+function envHostname({ component, domain, env, subdomain, }) {
+    const resolvedDomain = domain || process.env.CDK_ENV_DOMAIN || process.env.CDK_ENV_HOSTED_ZONE;
+    if (!resolvedDomain) {
+        throw new cdk$1.ConfigurationError("No hostname `domain` provided. Set CDK_ENV_DOMAIN or CDK_ENV_HOSTED_ZONE to use environment domain");
+    }
+    const resolvedComponent = component === "@" || component === "" ? undefined : component;
+    const resolvedSubdomain = subdomain || process.env.CDK_ENV_SUBDOMAIN;
+    const resolvedEnv = env || process.env.PROJECT_ENV;
+    const parts = [
+        resolvedComponent,
+        resolvedSubdomain,
+        resolvedEnv,
+        resolvedDomain,
+    ].filter((part) => part);
+    return parts.join(".");
+}
+
+/**
+ * Check if the current environment matches the given environment
+ */
+function isEnv(env) {
+    return process.env.PROJECT_ENV === env;
+}
+/**
+ * Check if the current environment is production
+ */
+function isProductionEnv() {
+    return isEnv(cdk$1.CDK.ENV.PRODUCTION);
+}
+/**
+ * Check if the current environment is sandbox
+ */
+function isSandboxEnv() {
+    return isEnv(cdk$1.CDK.ENV.SANDBOX);
+}
+
+function jaypieLambdaEnv(options = {}) {
+    const { initialEnvironment = {} } = options;
+    // Start with empty environment - we'll only add valid values
+    let environment = {};
+    // First, add all valid string values from initialEnvironment
+    Object.entries(initialEnvironment).forEach(([key, value]) => {
+        if (typeof value === "string") {
+            environment[key] = value;
+        }
+    });
+    // Default environment values
+    const defaultEnvValues = {
+        AWS_LAMBDA_NODEJS_DISABLE_CALLBACK_WARNING: "true",
+    };
+    // Apply default environment values with user overrides
+    Object.entries(defaultEnvValues).forEach(([key, defaultValue]) => {
+        if (key in initialEnvironment) {
+            const userValue = initialEnvironment[key];
+            // If user passes a string, it's already added above
+            // If user passes non-string falsy value, omit the key
+            if (!userValue) {
+                delete environment[key];
+            }
+            // Ignore non-string truthy values (key not added)
+        }
+        else {
+            // No user override, use default value
+            environment[key] = defaultValue;
+        }
+    });
+    // Default environment variables from process.env if present
+    const defaultEnvVars = [
+        "DATADOG_API_KEY_ARN",
+        "LOG_LEVEL",
+        "MODULE_LOGGER",
+        "MODULE_LOG_LEVEL",
+        "PROJECT_CHAOS",
+        "PROJECT_COMMIT",
+        "PROJECT_ENV",
+        "PROJECT_KEY",
+        "PROJECT_SECRET",
+        "PROJECT_SERVICE",
+        "PROJECT_SPONSOR",
+        "PROJECT_VERSION",
+    ];
+    // Add default environment variables if they exist in process.env
+    defaultEnvVars.forEach((envVar) => {
+        if (process.env[envVar] && !environment[envVar]) {
+            environment[envVar] = process.env[envVar];
+        }
+    });
+    return environment;
+}
+
+function resolveHostedZone(scope, { name = "HostedZone", zone = process.env.CDK_ENV_HOSTED_ZONE, }) {
+    if (!zone) {
+        throw new cdk$1.ConfigurationError("No `zone` provided. Set CDK_ENV_HOSTED_ZONE to use environment zone");
+    }
+    if (typeof zone === "string") {
+        return route53__namespace.HostedZone.fromLookup(scope, name, {
+            domainName: zone,
+        });
+    }
+    return zone;
+}
+
 class JaypieApiGateway extends constructs.Construct {
     constructor(scope, id, props) {
         super(scope, id);
-        const { certificate = true, handler, host: propsHost, name, roleTag = cdk.CDK.ROLE.API, zone: propsZone, } = props;
+        const { certificate = true, handler, host: propsHost, name, roleTag = cdk$1.CDK.ROLE.API, zone: propsZone, } = props;
         // Determine zone from props or environment
         let zone = propsZone;
         if (!zone && process.env.CDK_ENV_API_HOSTED_ZONE) {
@@ -155,7 +331,7 @@ class JaypieApiGateway extends constructs.Construct {
             }
             else if (process.env.CDK_ENV_API_SUBDOMAIN &&
                 process.env.CDK_ENV_API_HOSTED_ZONE) {
-                host = cdk.mergeDomain(process.env.CDK_ENV_API_SUBDOMAIN, process.env.CDK_ENV_API_HOSTED_ZONE);
+                host = cdk$1.mergeDomain(process.env.CDK_ENV_API_SUBDOMAIN, process.env.CDK_ENV_API_HOSTED_ZONE);
             }
         }
         const apiGatewayName = name || constructEnvName("ApiGateway");
@@ -164,20 +340,13 @@ class JaypieApiGateway extends constructs.Construct {
         let hostedZone;
         let certificateToUse;
         if (host && zone) {
-            if (typeof zone === "string") {
-                hostedZone = route53__namespace.HostedZone.fromLookup(this, "HostedZone", {
-                    domainName: zone,
-                });
-            }
-            else {
-                hostedZone = zone;
-            }
+            hostedZone = resolveHostedZone(this, { zone });
             if (certificate === true) {
                 certificateToUse = new acm__namespace.Certificate(this, certificateName, {
                     domainName: host,
                     validation: acm__namespace.CertificateValidation.fromDns(hostedZone),
                 });
-                cdk$1.Tags.of(certificateToUse).add(cdk.CDK.TAG.ROLE, cdk.CDK.ROLE.HOSTING);
+                cdk.Tags.of(certificateToUse).add(cdk$1.CDK.TAG.ROLE, cdk$1.CDK.ROLE.HOSTING);
             }
             else if (typeof certificate === "object") {
                 certificateToUse = certificate;
@@ -196,19 +365,19 @@ class JaypieApiGateway extends constructs.Construct {
             handler,
             ...lambdaRestApiProps,
         });
-        cdk$1.Tags.of(this._api).add(cdk.CDK.TAG.ROLE, roleTag);
+        cdk.Tags.of(this._api).add(cdk$1.CDK.TAG.ROLE, roleTag);
         if (host && certificateToUse && hostedZone) {
             this._domainName = this._api.addDomainName(apiDomainName, {
                 domainName: host,
                 certificate: certificateToUse,
             });
-            cdk$1.Tags.of(this._domainName).add(cdk.CDK.TAG.ROLE, roleTag);
+            cdk.Tags.of(this._domainName).add(cdk$1.CDK.TAG.ROLE, roleTag);
             const record = new route53__namespace.ARecord(this, "AliasRecord", {
                 recordName: host,
                 target: route53__namespace.RecordTarget.fromAlias(new route53Targets__namespace.ApiGatewayDomain(this._domainName)),
                 zone: hostedZone,
             });
-            cdk$1.Tags.of(record).add(cdk.CDK.TAG.ROLE, cdk.CDK.ROLE.NETWORKING);
+            cdk.Tags.of(record).add(cdk$1.CDK.TAG.ROLE, cdk$1.CDK.ROLE.NETWORKING);
         }
     }
     get api() {
@@ -249,8 +418,8 @@ class JaypieApiGateway extends constructs.Construct {
     }
     get env() {
         return {
-            account: cdk$1.Stack.of(this).account,
-            region: cdk$1.Stack.of(this).region,
+            account: cdk.Stack.of(this).account,
+            region: cdk.Stack.of(this).region,
         };
     }
     get stack() {
@@ -288,7 +457,7 @@ class JaypieApiGateway extends constructs.Construct {
     }
 }
 
-class JaypieStack extends cdk$1.Stack {
+class JaypieStack extends cdk.Stack {
     constructor(scope, id, props = {}) {
         const { key, ...stackProps } = props;
         // Handle stackName
@@ -303,7 +472,7 @@ class JaypieStack extends cdk$1.Stack {
         };
         super(scope, id, stackProps);
         // Apply tags
-        stackTagger(this, { name: stackProps.stackName });
+        constructTagger(this, { name: stackProps.stackName });
     }
 }
 
@@ -321,103 +490,12 @@ class JaypieAppStack extends JaypieStack {
 class JaypieLambda extends constructs.Construct {
     constructor(scope, id, props) {
         super(scope, id);
-        const { allowAllOutbound, allowPublicSubnet, architecture = lambda__namespace.Architecture.X86_64, code, codeSigningConfig, datadogApiKeyArn, deadLetterQueue, deadLetterQueueEnabled, deadLetterTopic, description, environment: initialEnvironment = {}, environmentEncryption, envSecrets = {}, ephemeralStorageSize, filesystem, handler = "index.handler", initialPolicy, layers = [], logRetention = cdk.CDK.LAMBDA.LOG_RETENTION, logRetentionRole, logRetentionRetryOptions, maxEventAge, memorySize = cdk.CDK.LAMBDA.MEMORY_SIZE, paramsAndSecrets, paramsAndSecretsOptions, profiling, profilingGroup, provisionedConcurrentExecutions, reservedConcurrentExecutions, retryAttempts, roleTag = cdk.CDK.ROLE.PROCESSING, runtime = lambda__namespace.Runtime.NODEJS_22_X, runtimeManagementMode, secrets = [], securityGroups, timeout = cdk$1.Duration.seconds(cdk.CDK.DURATION.LAMBDA_WORKER), tracing, vendorTag, vpc, vpcSubnets, } = props;
-        // Create a mutable copy of the environment variables
-        let environment = { ...initialEnvironment };
-        // Default environment values
-        const defaultEnvValues = {
-            AWS_LAMBDA_NODEJS_DISABLE_CALLBACK_WARNING: "true",
-        };
-        // Apply default environment values with user overrides
-        Object.entries(defaultEnvValues).forEach(([key, defaultValue]) => {
-            if (key in initialEnvironment) {
-                const userValue = initialEnvironment[key];
-                // If user passes a string, use that value
-                if (typeof userValue === "string") {
-                    environment[key] = userValue;
-                }
-                // If user passes non-string falsy value, omit the key
-                else if (!userValue) {
-                    delete environment[key];
-                }
-                // Ignore non-string truthy values (key already not present)
-            }
-            else {
-                // No user override, use default value
-                environment[key] = defaultValue;
-            }
-        });
-        // Default environment variables from process.env if present
-        const defaultEnvVars = [
-            "DATADOG_API_KEY_ARN",
-            "LOG_LEVEL",
-            "MODULE_LOGGER",
-            "MODULE_LOG_LEVEL",
-            "PROJECT_COMMIT",
-            "PROJECT_ENV",
-            "PROJECT_KEY",
-            "PROJECT_SECRET",
-            "PROJECT_SERVICE",
-            "PROJECT_SPONSOR",
-            "PROJECT_VERSION",
-        ];
-        // Add default environment variables if they exist in process.env
-        defaultEnvVars.forEach((envVar) => {
-            if (process.env[envVar] && !environment[envVar]) {
-                environment[envVar] = process.env[envVar];
-            }
-        });
+        const { allowAllOutbound, allowPublicSubnet, architecture = lambda__namespace.Architecture.X86_64, code, codeSigningConfig, datadogApiKeyArn, deadLetterQueue, deadLetterQueueEnabled, deadLetterTopic, description, environment: initialEnvironment = {}, environmentEncryption, envSecrets = {}, ephemeralStorageSize, filesystem, handler = "index.handler", initialPolicy, layers = [], logRetention = cdk$1.CDK.LAMBDA.LOG_RETENTION, logRetentionRole, logRetentionRetryOptions, maxEventAge, memorySize = cdk$1.CDK.LAMBDA.MEMORY_SIZE, paramsAndSecrets, paramsAndSecretsOptions, profiling, profilingGroup, provisionedConcurrentExecutions, reservedConcurrentExecutions, retryAttempts, roleTag = cdk$1.CDK.ROLE.PROCESSING, runtime = lambda__namespace.Runtime.NODEJS_22_X, runtimeManagementMode, secrets = [], securityGroups, timeout = cdk.Duration.seconds(cdk$1.CDK.DURATION.LAMBDA_WORKER), tracing, vendorTag, vpc, vpcSubnets, } = props;
+        // Get base environment with defaults
+        const environment = jaypieLambdaEnv({ initialEnvironment });
         const codeAsset = typeof code === "string" ? lambda__namespace.Code.fromAsset(code) : code;
         // Create a working copy of layers
         const resolvedLayers = [...layers];
-        // Determine if we should add Datadog integration
-        // Check for datadog API key ARN in different sources
-        const resolvedDatadogApiKeyArn = datadogApiKeyArn ||
-            process.env.DATADOG_API_KEY_ARN ||
-            process.env.CDK_ENV_DATADOG_API_KEY_ARN;
-        // Add Datadog integration if API key is available
-        if (resolvedDatadogApiKeyArn) {
-            // Add Datadog Node.js layer
-            const datadogNodeLayer = lambda__namespace.LayerVersion.fromLayerVersionArn(this, "DatadogNodeLayer", `arn:aws:lambda:${cdk$1.Stack.of(this).region}:464622532012:layer:Datadog-Node20-x:${cdk.CDK.DATADOG.LAYER.NODE}`);
-            resolvedLayers.push(datadogNodeLayer);
-            // Add Datadog Extension layer
-            const datadogExtensionLayer = lambda__namespace.LayerVersion.fromLayerVersionArn(this, "DatadogExtensionLayer", `arn:aws:lambda:${cdk$1.Stack.of(this).region}:464622532012:layer:Datadog-Extension:${cdk.CDK.DATADOG.LAYER.EXTENSION}`);
-            resolvedLayers.push(datadogExtensionLayer);
-            // Set Datadog environment variables
-            Object.assign(environment, {
-                DD_API_KEY_SECRET_ARN: resolvedDatadogApiKeyArn,
-                DD_ENHANCED_METRICS: "true",
-                DD_ENV: process.env.PROJECT_ENV || "",
-                DD_PROFILING_ENABLED: "false",
-                DD_SERVERLESS_APPSEC_ENABLED: "false",
-                DD_SERVICE: process.env.PROJECT_SERVICE || "",
-                DD_SITE: cdk.CDK.DATADOG.SITE,
-                DD_TAGS: `${cdk.CDK.TAG.SPONSOR}:${process.env.PROJECT_SPONSOR || ""}`,
-                DD_TRACE_OTEL_ENABLED: "false",
-            });
-        }
-        // Configure ParamsAndSecrets layer
-        let resolvedParamsAndSecrets = undefined;
-        if (paramsAndSecrets !== false) {
-            if (paramsAndSecrets instanceof lambda__namespace.ParamsAndSecretsLayerVersion) {
-                resolvedParamsAndSecrets = paramsAndSecrets;
-            }
-            else {
-                // Create default ParamsAndSecrets layer
-                resolvedParamsAndSecrets =
-                    lambda__namespace.ParamsAndSecretsLayerVersion.fromVersion(lambda__namespace.ParamsAndSecretsVersions.V1_0_103, {
-                        cacheSize: paramsAndSecretsOptions?.cacheSize,
-                        logLevel: paramsAndSecretsOptions?.logLevel ||
-                            lambda__namespace.ParamsAndSecretsLogLevel.WARN,
-                        parameterStoreTtl: paramsAndSecretsOptions?.parameterStoreTtl
-                            ? cdk$1.Duration.seconds(paramsAndSecretsOptions.parameterStoreTtl)
-                            : undefined,
-                        secretsManagerTtl: paramsAndSecretsOptions?.secretsManagerTtl
-                            ? cdk$1.Duration.seconds(paramsAndSecretsOptions.secretsManagerTtl)
-                            : undefined,
-                    });
-            }
-        }
         // Process secrets environment variables
         const secretsEnvironment = Object.entries(envSecrets).reduce((acc, [key, secret]) => ({
             ...acc,
@@ -460,7 +538,6 @@ class JaypieLambda extends constructs.Construct {
             logRetentionRetryOptions,
             maxEventAge,
             memorySize,
-            paramsAndSecrets: resolvedParamsAndSecrets,
             profiling,
             profilingGroup,
             reservedConcurrentExecutions,
@@ -468,19 +545,26 @@ class JaypieLambda extends constructs.Construct {
             runtime,
             runtimeManagementMode,
             securityGroups,
-            timeout: typeof timeout === "number" ? cdk$1.Duration.seconds(timeout) : timeout,
+            timeout: typeof timeout === "number" ? cdk.Duration.seconds(timeout) : timeout,
             tracing,
             vpc,
             vpcSubnets,
             // Enable auto-publishing of versions when using provisioned concurrency
             currentVersionOptions: provisionedConcurrentExecutions !== undefined
                 ? {
-                    removalPolicy: cdk$1.RemovalPolicy.RETAIN,
+                    removalPolicy: cdk.RemovalPolicy.RETAIN,
                     description: "Auto-published version for provisioned concurrency",
                     // Don't set provisioned concurrency here - it will be set on the alias
                 }
                 : undefined,
         });
+        // Add ParamsAndSecrets layer if configured
+        addParamsAndSecrets(this._lambda, {
+            paramsAndSecrets,
+            paramsAndSecretsOptions,
+        });
+        // Add Datadog layers and environment variables if configured
+        addDatadogLayer(this._lambda, { datadogApiKeyArn });
         // Grant secret read permissions
         Object.values(envSecrets).forEach((secret) => {
             secret.grantRead(this._lambda);
@@ -489,11 +573,6 @@ class JaypieLambda extends constructs.Construct {
         secrets.forEach((secret) => {
             secret.grantRead(this._lambda);
         });
-        // Grant Datadog API key read permission if applicable
-        if (resolvedDatadogApiKeyArn) {
-            const datadogApiKey = secretsmanager__namespace.Secret.fromSecretCompleteArn(this, "DatadogApiKeyGrant", resolvedDatadogApiKeyArn);
-            datadogApiKey.grantRead(this._lambda);
-        }
         // Configure provisioned concurrency if specified
         if (provisionedConcurrentExecutions !== undefined) {
             // Use currentVersion which is auto-published with proper configuration
@@ -508,10 +587,10 @@ class JaypieLambda extends constructs.Construct {
             this._provisioned.node.addDependency(version);
         }
         if (roleTag) {
-            cdk$1.Tags.of(this._lambda).add(cdk.CDK.TAG.ROLE, roleTag);
+            cdk.Tags.of(this._lambda).add(cdk$1.CDK.TAG.ROLE, roleTag);
         }
         if (vendorTag) {
-            cdk$1.Tags.of(this._lambda).add(cdk.CDK.TAG.VENDOR, vendorTag);
+            cdk.Tags.of(this._lambda).add(cdk$1.CDK.TAG.VENDOR, vendorTag);
         }
         // Assign _reference based on provisioned state
         this._reference =
@@ -608,8 +687,8 @@ class JaypieLambda extends constructs.Construct {
     }
     get env() {
         return {
-            account: cdk$1.Stack.of(this).account,
-            region: cdk$1.Stack.of(this).region,
+            account: cdk.Stack.of(this).account,
+            region: cdk.Stack.of(this).region,
         };
     }
     get stack() {
@@ -623,19 +702,19 @@ class JaypieLambda extends constructs.Construct {
 class JaypieQueuedLambda extends constructs.Construct {
     constructor(scope, id, props) {
         super(scope, id);
-        const { batchSize = 1, code, environment = {}, envSecrets = {}, fifo = true, handler = "index.handler", layers = [], logRetention = cdk.CDK.LAMBDA.LOG_RETENTION, memorySize = cdk.CDK.LAMBDA.MEMORY_SIZE, paramsAndSecrets, reservedConcurrentExecutions, roleTag, runtime = lambda__namespace.Runtime.NODEJS_22_X, secrets = [], timeout = cdk$1.Duration.seconds(cdk.CDK.DURATION.LAMBDA_WORKER), vendorTag, visibilityTimeout = cdk$1.Duration.seconds(cdk.CDK.DURATION.LAMBDA_WORKER), } = props;
+        const { batchSize = 1, code, environment = {}, envSecrets = {}, fifo = true, handler = "index.handler", layers = [], logRetention = cdk$1.CDK.LAMBDA.LOG_RETENTION, memorySize = cdk$1.CDK.LAMBDA.MEMORY_SIZE, paramsAndSecrets, reservedConcurrentExecutions, roleTag, runtime = lambda__namespace.Runtime.NODEJS_22_X, secrets = [], timeout = cdk.Duration.seconds(cdk$1.CDK.DURATION.LAMBDA_WORKER), vendorTag, visibilityTimeout = cdk.Duration.seconds(cdk$1.CDK.DURATION.LAMBDA_WORKER), } = props;
         // Create SQS Queue
         this._queue = new sqs__namespace.Queue(this, "Queue", {
             fifo,
             visibilityTimeout: typeof visibilityTimeout === "number"
-                ? cdk$1.Duration.seconds(visibilityTimeout)
+                ? cdk.Duration.seconds(visibilityTimeout)
                 : visibilityTimeout,
         });
         if (roleTag) {
-            cdk$1.Tags.of(this._queue).add(cdk.CDK.TAG.ROLE, roleTag);
+            cdk.Tags.of(this._queue).add(cdk$1.CDK.TAG.ROLE, roleTag);
         }
         if (vendorTag) {
-            cdk$1.Tags.of(this._queue).add(cdk.CDK.TAG.VENDOR, vendorTag);
+            cdk.Tags.of(this._queue).add(cdk$1.CDK.TAG.VENDOR, vendorTag);
         }
         // Create Lambda with JaypieLambda
         this._lambdaConstruct = new JaypieLambda(this, "Function", {
@@ -756,12 +835,12 @@ class JaypieQueuedLambda extends constructs.Construct {
     }
     get env() {
         return {
-            account: cdk$1.Stack.of(this).account,
-            region: cdk$1.Stack.of(this).region,
+            account: cdk.Stack.of(this).account,
+            region: cdk.Stack.of(this).region,
         };
     }
     get stack() {
-        return cdk$1.Stack.of(this);
+        return cdk.Stack.of(this);
     }
     applyRemovalPolicy(policy) {
         this._lambdaConstruct.applyRemovalPolicy(policy);
@@ -836,15 +915,15 @@ class JaypieBucketQueuedLambda extends JaypieQueuedLambda {
         // Create S3 Bucket
         this._bucket = new s3__namespace.Bucket(this, "Bucket", {
             bucketName: bucketOptions.bucketName || bucketName,
-            removalPolicy: bucketOptions.removalPolicy || cdk$1.RemovalPolicy.RETAIN,
+            removalPolicy: bucketOptions.removalPolicy || cdk.RemovalPolicy.RETAIN,
             ...bucketOptions,
         });
         // Add tags to bucket
         if (roleTag) {
-            cdk$1.Tags.of(this._bucket).add(cdk.CDK.TAG.ROLE, roleTag);
+            cdk.Tags.of(this._bucket).add(cdk$1.CDK.TAG.ROLE, roleTag);
         }
         if (vendorTag) {
-            cdk$1.Tags.of(this._bucket).add(cdk.CDK.TAG.VENDOR, vendorTag);
+            cdk.Tags.of(this._bucket).add(cdk$1.CDK.TAG.VENDOR, vendorTag);
         }
         // Add an event notification from the bucket to the queue
         this._bucket.addEventNotification(s3__namespace.EventType.OBJECT_CREATED, new s3n__namespace.SqsDestination(this.queue));
@@ -1009,13 +1088,13 @@ class JaypieBucketQueuedLambda extends JaypieQueuedLambda {
 
 // It is a consumer if the environment is ephemeral
 function checkEnvIsConsumer(env = process.env) {
-    return (env.PROJECT_ENV === cdk.CDK.ENV.PERSONAL ||
+    return (env.PROJECT_ENV === cdk$1.CDK.ENV.PERSONAL ||
         !!env.CDK_ENV_PERSONAL ||
         /** @deprecated */ env.PROJECT_ENV === "ephemeral" ||
         /** @deprecated */ !!env.CDK_ENV_EPHEMERAL);
 }
 function checkEnvIsProvider(env = process.env) {
-    return env.PROJECT_ENV === cdk.CDK.ENV.SANDBOX;
+    return env.PROJECT_ENV === cdk$1.CDK.ENV.SANDBOX;
 }
 function cleanName(name) {
     return name.replace(/[^a-zA-Z0-9:-]/g, "");
@@ -1029,7 +1108,7 @@ function exportEnvName(name, env = process.env) {
     }
     else {
         if (checkEnvIsConsumer(env)) {
-            rawName = `env-${cdk.CDK.ENV.SANDBOX}-${env.PROJECT_KEY}-${name}`;
+            rawName = `env-${cdk$1.CDK.ENV.SANDBOX}-${env.PROJECT_KEY}-${name}`;
         }
         else {
             rawName = `env-${env.PROJECT_ENV}-${env.PROJECT_KEY}-${name}`;
@@ -1050,10 +1129,10 @@ class JaypieEnvSecret extends constructs.Construct {
             exportName = cleanName(exportParam);
         }
         if (consumer) {
-            const secretName = cdk$1.Fn.importValue(exportName);
+            const secretName = cdk.Fn.importValue(exportName);
             this._secret = secretsmanager__namespace.Secret.fromSecretNameV2(this, id, secretName);
             // Add CfnOutput for consumer secrets
-            new cdk$1.CfnOutput(this, `ConsumedName`, {
+            new cdk.CfnOutput(this, `ConsumedName`, {
                 value: this._secret.secretName,
             });
         }
@@ -1062,24 +1141,24 @@ class JaypieEnvSecret extends constructs.Construct {
             const secretProps = {
                 generateSecretString,
                 secretStringValue: !generateSecretString && secretValue
-                    ? cdk$1.SecretValue.unsafePlainText(secretValue)
+                    ? cdk.SecretValue.unsafePlainText(secretValue)
                     : undefined,
             };
             this._secret = new secretsmanager__namespace.Secret(this, id, secretProps);
             if (roleTag) {
-                cdk$1.Tags.of(this._secret).add(cdk.CDK.TAG.ROLE, roleTag);
+                cdk.Tags.of(this._secret).add(cdk$1.CDK.TAG.ROLE, roleTag);
             }
             if (vendorTag) {
-                cdk$1.Tags.of(this._secret).add(cdk.CDK.TAG.VENDOR, vendorTag);
+                cdk.Tags.of(this._secret).add(cdk$1.CDK.TAG.VENDOR, vendorTag);
             }
             if (provider) {
-                new cdk$1.CfnOutput(this, `ProvidedName`, {
+                new cdk.CfnOutput(this, `ProvidedName`, {
                     value: this._secret.secretName,
                     exportName,
                 });
             }
             else {
-                new cdk$1.CfnOutput(this, `CreatedName`, {
+                new cdk.CfnOutput(this, `CreatedName`, {
                     value: this._secret.secretName,
                 });
             }
@@ -1087,12 +1166,12 @@ class JaypieEnvSecret extends constructs.Construct {
     }
     // IResource implementation
     get stack() {
-        return cdk$1.Stack.of(this);
+        return cdk.Stack.of(this);
     }
     get env() {
         return {
-            account: cdk$1.Stack.of(this).account,
-            region: cdk$1.Stack.of(this).region,
+            account: cdk.Stack.of(this).account,
+            region: cdk.Stack.of(this).region,
         };
     }
     applyRemovalPolicy(policy) {
@@ -1144,8 +1223,8 @@ class JaypieDatadogSecret extends JaypieEnvSecret {
     constructor(scope, id = "MongoConnectionString", props) {
         const defaultProps = {
             envKey: "DATADOG_API_KEY",
-            roleTag: cdk.CDK.ROLE.MONITORING,
-            vendorTag: cdk.CDK.VENDOR.DATADOG,
+            roleTag: cdk$1.CDK.ROLE.MONITORING,
+            vendorTag: cdk$1.CDK.VENDOR.DATADOG,
             ...props,
         };
         super(scope, id, defaultProps);
@@ -1155,8 +1234,8 @@ class JaypieDatadogSecret extends JaypieEnvSecret {
 class JaypieExpressLambda extends JaypieLambda {
     constructor(scope, id, props) {
         super(scope, id, {
-            timeout: cdk$1.Duration.seconds(cdk.CDK.DURATION.EXPRESS_API),
-            roleTag: cdk.CDK.ROLE.API,
+            timeout: cdk.Duration.seconds(cdk$1.CDK.DURATION.EXPRESS_API),
+            roleTag: cdk$1.CDK.ROLE.API,
             ...props,
         });
     }
@@ -1172,7 +1251,7 @@ class JaypieHostedZone extends constructs.Construct {
     constructor(scope, id, props) {
         super(scope, id);
         const { destination, zoneName, project } = props;
-        const service = props.service || cdk.CDK.SERVICE.INFRASTRUCTURE;
+        const service = props.service || cdk$1.CDK.SERVICE.INFRASTRUCTURE;
         // Create the log group
         this.logGroup = new awsLogs.LogGroup(this, "LogGroup", {
             logGroupName: process.env.PROJECT_NONCE
@@ -1181,10 +1260,10 @@ class JaypieHostedZone extends constructs.Construct {
             retention: awsLogs.RetentionDays.ONE_WEEK,
         });
         // Add tags
-        cdk__namespace.Tags.of(this.logGroup).add(cdk.CDK.TAG.SERVICE, service);
-        cdk__namespace.Tags.of(this.logGroup).add(cdk.CDK.TAG.ROLE, cdk.CDK.ROLE.NETWORKING);
+        cdk__namespace.Tags.of(this.logGroup).add(cdk$1.CDK.TAG.SERVICE, service);
+        cdk__namespace.Tags.of(this.logGroup).add(cdk$1.CDK.TAG.ROLE, cdk$1.CDK.ROLE.NETWORKING);
         if (project) {
-            cdk__namespace.Tags.of(this.logGroup).add(cdk.CDK.TAG.PROJECT, project);
+            cdk__namespace.Tags.of(this.logGroup).add(cdk$1.CDK.TAG.PROJECT, project);
         }
         // Grant Route 53 permissions to write to the log group
         this.logGroup.grantWrite(new awsIam.ServicePrincipal(SERVICE.ROUTE53));
@@ -1201,10 +1280,10 @@ class JaypieHostedZone extends constructs.Construct {
             zoneName,
         });
         // Add tags
-        cdk__namespace.Tags.of(this.hostedZone).add(cdk.CDK.TAG.SERVICE, service);
-        cdk__namespace.Tags.of(this.hostedZone).add(cdk.CDK.TAG.ROLE, cdk.CDK.ROLE.NETWORKING);
+        cdk__namespace.Tags.of(this.hostedZone).add(cdk$1.CDK.TAG.SERVICE, service);
+        cdk__namespace.Tags.of(this.hostedZone).add(cdk$1.CDK.TAG.ROLE, cdk$1.CDK.ROLE.NETWORKING);
         if (project) {
-            cdk__namespace.Tags.of(this.hostedZone).add(cdk.CDK.TAG.PROJECT, project);
+            cdk__namespace.Tags.of(this.hostedZone).add(cdk$1.CDK.TAG.PROJECT, project);
         }
     }
 }
@@ -1224,7 +1303,7 @@ class JaypieInfrastructureStack extends JaypieStack {
         super(scope, id, { key, ...stackProps });
         // Add infrastructure-specific tag
         if (process.env.CDK_ENV_INFRASTRUCTURE_STACK_SHA) {
-            cdk$1.Tags.of(this).add(CDK.TAG.STACK_SHA, process.env.CDK_ENV_INFRASTRUCTURE_STACK_SHA);
+            cdk.Tags.of(this).add(CDK.TAG.STACK_SHA, process.env.CDK_ENV_INFRASTRUCTURE_STACK_SHA);
         }
     }
 }
@@ -1233,8 +1312,8 @@ class JaypieMongoDbSecret extends JaypieEnvSecret {
     constructor(scope, id = "MongoConnectionString", props) {
         const defaultProps = {
             envKey: "MONGODB_URI",
-            roleTag: cdk.CDK.ROLE.STORAGE,
-            vendorTag: cdk.CDK.VENDOR.MONGODB,
+            roleTag: cdk$1.CDK.ROLE.STORAGE,
+            vendorTag: cdk$1.CDK.VENDOR.MONGODB,
             ...props,
         };
         super(scope, id, defaultProps);
@@ -1245,8 +1324,8 @@ class JaypieOpenAiSecret extends JaypieEnvSecret {
     constructor(scope, id = "OpenAiApiKey", props) {
         const defaultProps = {
             envKey: "OPENAI_API_KEY",
-            roleTag: cdk.CDK.ROLE.PROCESSING,
-            vendorTag: cdk.CDK.VENDOR.OPENAI,
+            roleTag: cdk$1.CDK.ROLE.PROCESSING,
+            vendorTag: cdk$1.CDK.VENDOR.OPENAI,
             ...props,
         };
         super(scope, id, defaultProps);
@@ -1306,11 +1385,11 @@ class JaypieSsoGroups extends constructs.Construct {
             instanceArn: this.instanceArn,
             name: exports.PermissionSetType.ADMINISTRATOR,
             description: "Full administrative access to all AWS services and resources",
-            sessionDuration: cdk$1.Duration.hours(8).toIsoString(),
+            sessionDuration: cdk.Duration.hours(8).toIsoString(),
             managedPolicies: ["arn:aws:iam::aws:policy/AdministratorAccess"],
             inlinePolicy: mergedPolicy,
         });
-        cdk$1.Tags.of(permissionSet).add(cdk.CDK.TAG.SERVICE, cdk.CDK.SERVICE.SSO);
+        cdk.Tags.of(permissionSet).add(cdk$1.CDK.TAG.SERVICE, cdk$1.CDK.SERVICE.SSO);
         this.permissionSets[exports.PermissionSetType.ADMINISTRATOR] = permissionSet;
     }
     /**
@@ -1343,11 +1422,11 @@ class JaypieSsoGroups extends constructs.Construct {
             instanceArn: this.instanceArn,
             name: exports.PermissionSetType.ANALYST,
             description: "Read-only access with billing visibility and limited write access",
-            sessionDuration: cdk$1.Duration.hours(4).toIsoString(),
+            sessionDuration: cdk.Duration.hours(4).toIsoString(),
             managedPolicies: ["arn:aws:iam::aws:policy/ReadOnlyAccess"],
             inlinePolicy: mergedPolicy,
         });
-        cdk$1.Tags.of(permissionSet).add(cdk.CDK.TAG.SERVICE, cdk.CDK.SERVICE.SSO);
+        cdk.Tags.of(permissionSet).add(cdk$1.CDK.TAG.SERVICE, cdk$1.CDK.SERVICE.SSO);
         this.permissionSets[exports.PermissionSetType.ANALYST] = permissionSet;
     }
     /**
@@ -1395,13 +1474,13 @@ class JaypieSsoGroups extends constructs.Construct {
             instanceArn: this.instanceArn,
             name: exports.PermissionSetType.DEVELOPER,
             description: "System administrator access with expanded write permissions",
-            sessionDuration: cdk$1.Duration.hours(8).toIsoString(),
+            sessionDuration: cdk.Duration.hours(8).toIsoString(),
             managedPolicies: [
                 "arn:aws:iam::aws:policy/job-function/SystemAdministrator",
             ],
             inlinePolicy: mergedPolicy,
         });
-        cdk$1.Tags.of(permissionSet).add(cdk.CDK.TAG.SERVICE, cdk.CDK.SERVICE.SSO);
+        cdk.Tags.of(permissionSet).add(cdk$1.CDK.TAG.SERVICE, cdk$1.CDK.SERVICE.SSO);
         this.permissionSets[exports.PermissionSetType.DEVELOPER] = permissionSet;
     }
     /**
@@ -1468,8 +1547,8 @@ class JaypieSsoGroups extends constructs.Construct {
                 targetId: accountId,
                 targetType: "AWS_ACCOUNT",
             });
-            cdk$1.Tags.of(assignment).add(cdk.CDK.TAG.SERVICE, cdk.CDK.SERVICE.SSO);
-            cdk$1.Tags.of(assignment).add("Group", "administrators");
+            cdk.Tags.of(assignment).add(cdk$1.CDK.TAG.SERVICE, cdk$1.CDK.SERVICE.SSO);
+            cdk.Tags.of(assignment).add("Group", "administrators");
         });
     }
     /**
@@ -1495,8 +1574,8 @@ class JaypieSsoGroups extends constructs.Construct {
                 targetId: accountId,
                 targetType: "AWS_ACCOUNT",
             });
-            cdk$1.Tags.of(assignment).add(cdk.CDK.TAG.SERVICE, cdk.CDK.SERVICE.SSO);
-            cdk$1.Tags.of(assignment).add("Group", "analysts");
+            cdk.Tags.of(assignment).add(cdk$1.CDK.TAG.SERVICE, cdk$1.CDK.SERVICE.SSO);
+            cdk.Tags.of(assignment).add("Group", "analysts");
         });
     }
     /**
@@ -1521,8 +1600,8 @@ class JaypieSsoGroups extends constructs.Construct {
                 targetId: accountId,
                 targetType: "AWS_ACCOUNT",
             });
-            cdk$1.Tags.of(assignment).add(cdk.CDK.TAG.SERVICE, cdk.CDK.SERVICE.SSO);
-            cdk$1.Tags.of(assignment).add("Group", "developers");
+            cdk.Tags.of(assignment).add(cdk$1.CDK.TAG.SERVICE, cdk$1.CDK.SERVICE.SSO);
+            cdk.Tags.of(assignment).add("Group", "developers");
         });
     }
 }
@@ -1531,8 +1610,8 @@ class JaypieTraceSigningKeySecret extends JaypieEnvSecret {
     constructor(scope, id = "TraceSigningKey", props) {
         const defaultProps = {
             envKey: "TRACE_SIGNING_KEY",
-            roleTag: cdk.CDK.ROLE.API,
-            vendorTag: cdk.CDK.VENDOR.KNOWTRACE,
+            roleTag: cdk$1.CDK.ROLE.API,
+            vendorTag: cdk$1.CDK.VENDOR.KNOWTRACE,
             ...props,
         };
         super(scope, id, defaultProps);
@@ -1542,19 +1621,19 @@ class JaypieTraceSigningKeySecret extends JaypieEnvSecret {
 class JaypieWebDeploymentBucket extends constructs.Construct {
     constructor(scope, id, props = {}) {
         super(scope, id);
-        const roleTag = props.roleTag || cdk.CDK.ROLE.HOSTING;
+        const roleTag = props.roleTag || cdk$1.CDK.ROLE.HOSTING;
         // Environment variable validation
         if (process.env.CDK_ENV_WEB_SUBDOMAIN &&
-            !cdk.isValidSubdomain(process.env.CDK_ENV_WEB_SUBDOMAIN)) {
-            throw new cdk.ConfigurationError("CDK_ENV_WEB_SUBDOMAIN is not a valid subdomain");
+            !cdk$1.isValidSubdomain(process.env.CDK_ENV_WEB_SUBDOMAIN)) {
+            throw new cdk$1.ConfigurationError("CDK_ENV_WEB_SUBDOMAIN is not a valid subdomain");
         }
         if (process.env.CDK_ENV_WEB_HOSTED_ZONE &&
-            !cdk.isValidHostname(process.env.CDK_ENV_WEB_HOSTED_ZONE)) {
-            throw new cdk.ConfigurationError("CDK_ENV_WEB_HOSTED_ZONE is not a valid hostname");
+            !cdk$1.isValidHostname(process.env.CDK_ENV_WEB_HOSTED_ZONE)) {
+            throw new cdk$1.ConfigurationError("CDK_ENV_WEB_HOSTED_ZONE is not a valid hostname");
         }
         if (process.env.CDK_ENV_HOSTED_ZONE &&
-            !cdk.isValidHostname(process.env.CDK_ENV_HOSTED_ZONE)) {
-            throw new cdk.ConfigurationError("CDK_ENV_HOSTED_ZONE is not a valid hostname");
+            !cdk$1.isValidHostname(process.env.CDK_ENV_HOSTED_ZONE)) {
+            throw new cdk$1.ConfigurationError("CDK_ENV_HOSTED_ZONE is not a valid hostname");
         }
         // Determine host from props or environment
         let host = props.host;
@@ -1562,7 +1641,7 @@ class JaypieWebDeploymentBucket extends constructs.Construct {
             try {
                 host =
                     process.env.CDK_ENV_WEB_HOST ||
-                        cdk.mergeDomain(process.env.CDK_ENV_WEB_SUBDOMAIN || "", process.env.CDK_ENV_WEB_HOSTED_ZONE ||
+                        cdk$1.mergeDomain(process.env.CDK_ENV_WEB_SUBDOMAIN || "", process.env.CDK_ENV_WEB_HOSTED_ZONE ||
                             process.env.CDK_ENV_HOSTED_ZONE ||
                             "");
             }
@@ -1570,8 +1649,8 @@ class JaypieWebDeploymentBucket extends constructs.Construct {
                 host = undefined;
             }
         }
-        if (host && !cdk.isValidHostname(host)) {
-            throw new cdk.ConfigurationError("Host is not a valid hostname");
+        if (host && !cdk$1.isValidHostname(host)) {
+            throw new cdk$1.ConfigurationError("Host is not a valid hostname");
         }
         // Determine zone from props or environment
         const zone = props.zone ||
@@ -1584,7 +1663,7 @@ class JaypieWebDeploymentBucket extends constructs.Construct {
             blockPublicAccess: s3__namespace.BlockPublicAccess.BLOCK_ACLS,
             bucketName: props.name || constructEnvName("web"),
             publicReadAccess: true,
-            removalPolicy: cdk$1.RemovalPolicy.DESTROY,
+            removalPolicy: cdk.RemovalPolicy.DESTROY,
             versioned: false,
             websiteErrorDocument: "index.html",
             websiteIndexDocument: "index.html",
@@ -1602,7 +1681,7 @@ class JaypieWebDeploymentBucket extends constructs.Construct {
         this.isWebsite = this.bucket.isWebsite;
         this.notificationsHandlerRole = undefined;
         this.policy = this.bucket.policy;
-        cdk$1.Tags.of(this.bucket).add(cdk.CDK.TAG.ROLE, roleTag);
+        cdk.Tags.of(this.bucket).add(cdk$1.CDK.TAG.ROLE, roleTag);
         // Create deployment role if repository is configured
         let repo;
         if (process.env.CDK_ENV_REPO) {
@@ -1610,14 +1689,14 @@ class JaypieWebDeploymentBucket extends constructs.Construct {
         }
         if (repo) {
             const bucketDeployRole = new awsIam.Role(this, "DestinationBucketDeployRole", {
-                assumedBy: new awsIam.FederatedPrincipal(cdk$1.Fn.importValue(cdk.CDK.IMPORT.OIDC_PROVIDER), {
+                assumedBy: new awsIam.FederatedPrincipal(cdk.Fn.importValue(cdk$1.CDK.IMPORT.OIDC_PROVIDER), {
                     StringLike: {
                         "token.actions.githubusercontent.com:sub": repo,
                     },
                 }, "sts:AssumeRoleWithWebIdentity"),
-                maxSessionDuration: cdk$1.Duration.hours(1),
+                maxSessionDuration: cdk.Duration.hours(1),
             });
-            cdk$1.Tags.of(bucketDeployRole).add(cdk.CDK.TAG.ROLE, cdk.CDK.ROLE.DEPLOY);
+            cdk.Tags.of(bucketDeployRole).add(cdk$1.CDK.TAG.ROLE, cdk$1.CDK.ROLE.DEPLOY);
             // Allow the role to write to the bucket
             bucketDeployRole.addToPolicy(new awsIam.PolicyStatement({
                 effect: awsIam.Effect.ALLOW,
@@ -1642,7 +1721,7 @@ class JaypieWebDeploymentBucket extends constructs.Construct {
             }));
             this.deployRoleArn = bucketDeployRole.roleArn;
             // Output the deploy role ARN
-            new cdk$1.CfnOutput(this, "DestinationBucketDeployRoleArn", {
+            new cdk.CfnOutput(this, "DestinationBucketDeployRoleArn", {
                 value: bucketDeployRole.roleArn,
             });
         }
@@ -1662,10 +1741,10 @@ class JaypieWebDeploymentBucket extends constructs.Construct {
                             domainName: host,
                             validation: acm__namespace.CertificateValidation.fromDns(hostedZone),
                         });
-                new cdk$1.CfnOutput(this, "CertificateArn", {
+                new cdk.CfnOutput(this, "CertificateArn", {
                     value: this.certificate.certificateArn,
                 });
-                cdk$1.Tags.of(this.certificate).add(cdk.CDK.TAG.ROLE, roleTag);
+                cdk.Tags.of(this.certificate).add(cdk$1.CDK.TAG.ROLE, roleTag);
             }
             // Create CloudFront distribution
             this.distribution = new cloudfront__namespace.Distribution(this, "Distribution", {
@@ -1677,7 +1756,7 @@ class JaypieWebDeploymentBucket extends constructs.Construct {
                 certificate: this.certificate,
                 domainNames: [host],
             });
-            cdk$1.Tags.of(this.distribution).add(cdk.CDK.TAG.ROLE, roleTag);
+            cdk.Tags.of(this.distribution).add(cdk$1.CDK.TAG.ROLE, roleTag);
             // If this is production, enable caching on everything but index.html
             if (isProductionEnv()) {
                 this.distribution.addBehavior("/*", new origins__namespace.S3Origin(this.bucket), {
@@ -1691,7 +1770,7 @@ class JaypieWebDeploymentBucket extends constructs.Construct {
                 target: route53__namespace.RecordTarget.fromAlias(new route53Targets__namespace.CloudFrontTarget(this.distribution)),
                 zone: hostedZone,
             });
-            cdk$1.Tags.of(record).add(cdk.CDK.TAG.ROLE, cdk.CDK.ROLE.NETWORKING);
+            cdk.Tags.of(record).add(cdk$1.CDK.TAG.ROLE, cdk$1.CDK.ROLE.NETWORKING);
             this.distributionDomainName = this.distribution.distributionDomainName;
         }
     }
@@ -1734,6 +1813,9 @@ class JaypieWebDeploymentBucket extends constructs.Construct {
     grantWrite(identity, objectsKeyPattern) {
         return this.bucket.grantWrite(identity, objectsKeyPattern);
     }
+    grantReplicationPermission(identity, props) {
+        return this.bucket.grantReplicationPermission(identity, props);
+    }
     s3UrlForObject(key) {
         return this.bucket.s3UrlForObject(key);
     }
@@ -1800,10 +1882,15 @@ exports.JaypieSsoGroups = JaypieSsoGroups;
 exports.JaypieStack = JaypieStack;
 exports.JaypieTraceSigningKeySecret = JaypieTraceSigningKeySecret;
 exports.JaypieWebDeploymentBucket = JaypieWebDeploymentBucket;
+exports.addDatadogLayer = addDatadogLayer;
+exports.addParamsAndSecrets = addParamsAndSecrets;
 exports.constructEnvName = constructEnvName;
 exports.constructStackName = constructStackName;
+exports.constructTagger = constructTagger;
+exports.envHostname = envHostname;
 exports.isEnv = isEnv;
 exports.isProductionEnv = isProductionEnv;
 exports.isSandboxEnv = isSandboxEnv;
-exports.stackTagger = stackTagger;
+exports.jaypieLambdaEnv = jaypieLambdaEnv;
+exports.resolveHostedZone = resolveHostedZone;
 //# sourceMappingURL=index.cjs.map