@jaypie/constructs 1.1.39 → 1.1.41

package/dist/esm/JaypieWebDeploymentBucket.d.ts

@@ -62,6 +62,7 @@ export declare class JaypieWebDeploymentBucket extends Construct implements s3.I
     grantRead(identity: any, objectsKeyPattern?: any): any;
     grantReadWrite(identity: any, objectsKeyPattern?: any): any;
     grantWrite(identity: any, objectsKeyPattern?: any): any;
+    grantReplicationPermission(identity: any, props: any): any;
     s3UrlForObject(key?: string): string;
     urlForObject(key?: string): string;
     virtualHostedUrlForObject(key?: string, options?: s3.VirtualHostedStyleUrlOptions): string;

package/dist/esm/helpers/__tests__/envHostname.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/esm/helpers/__tests__/jaypieLambdaEnv.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/esm/helpers/addDatadogLayer.d.ts

@@ -0,0 +1,5 @@
+import * as lambda from "aws-cdk-lib/aws-lambda";
+export interface AddDatadogLayerOptions {
+    datadogApiKeyArn?: string;
+}
+export declare function addDatadogLayer(lambdaFunction: lambda.Function, options?: AddDatadogLayerOptions): boolean;

package/dist/esm/helpers/addParamsAndSecrets.d.ts

@@ -0,0 +1,11 @@
+import * as lambda from "aws-cdk-lib/aws-lambda";
+export interface AddParamsAndSecretsOptions {
+    paramsAndSecrets?: lambda.ParamsAndSecretsLayerVersion | boolean;
+    paramsAndSecretsOptions?: {
+        cacheSize?: number;
+        logLevel?: lambda.ParamsAndSecretsLogLevel;
+        parameterStoreTtl?: number;
+        secretsManagerTtl?: number;
+    };
+}
+export declare function addParamsAndSecrets(lambdaFunction: lambda.Function, options?: AddParamsAndSecretsOptions): boolean;

package/dist/esm/helpers/constructTagger.d.ts

@@ -0,0 +1,4 @@
+import { Construct } from "constructs";
+export declare function constructTagger(construct: Construct, { name }?: {
+    name?: string;
+}): boolean;

package/dist/esm/helpers/envHostname.d.ts

@@ -0,0 +1,6 @@
+export declare function envHostname({ component, domain, env, subdomain, }: {
+    component?: string;
+    domain?: string;
+    env?: string;
+    subdomain?: string;
+}): string;

package/dist/esm/helpers/index.d.ts

@@ -1,4 +1,9 @@
+export { addDatadogLayer } from "./addDatadogLayer";
+export { addParamsAndSecrets } from "./addParamsAndSecrets";
 export { constructEnvName } from "./constructEnvName";
 export { constructStackName } from "./constructStackName";
+export { constructTagger } from "./constructTagger";
+export { envHostname } from "./envHostname";
 export { isEnv, isProductionEnv, isSandboxEnv } from "./isEnv";
-export { stackTagger } from "./stackTagger";
+export { jaypieLambdaEnv } from "./jaypieLambdaEnv";
+export { resolveHostedZone } from "./resolveHostedZone";

package/dist/esm/helpers/jaypieLambdaEnv.d.ts

@@ -0,0 +1,8 @@
+export interface JaypieLambdaEnvOptions {
+    initialEnvironment?: {
+        [key: string]: string;
+    };
+}
+export declare function jaypieLambdaEnv(options?: JaypieLambdaEnvOptions): {
+    [key: string]: string;
+};

package/dist/esm/helpers/resolveHostedZone.d.ts

@@ -0,0 +1,6 @@
+import { Construct } from "constructs";
+import * as route53 from "aws-cdk-lib/aws-route53";
+export declare function resolveHostedZone(scope: Construct, { name, zone, }: {
+    name?: string;
+    zone?: string | route53.IHostedZone;
+}): route53.IHostedZone;

package/dist/esm/index.js

@@ -1,28 +1,121 @@
 import { Construct } from 'constructs';
 import * as cdk from 'aws-cdk-lib';
-import { Tags, Stack, Duration, RemovalPolicy, Fn, CfnOutput, SecretValue } from 'aws-cdk-lib';
+import { Stack, Tags, Duration, RemovalPolicy, Fn, CfnOutput, SecretValue } from 'aws-cdk-lib';
 import * as acm from 'aws-cdk-lib/aws-certificatemanager';
 import * as apiGateway from 'aws-cdk-lib/aws-apigateway';
 import * as route53 from 'aws-cdk-lib/aws-route53';
 import { HostedZone } from 'aws-cdk-lib/aws-route53';
 import * as route53Targets from 'aws-cdk-lib/aws-route53-targets';
-import { CDK as CDK$2, mergeDomain, isValidSubdomain, ConfigurationError, isValidHostname } from '@jaypie/cdk';
+import { CDK as CDK$2, ConfigurationError, mergeDomain, isValidSubdomain, isValidHostname } from '@jaypie/cdk';
+import * as lambda from 'aws-cdk-lib/aws-lambda';
+import * as secretsmanager from 'aws-cdk-lib/aws-secretsmanager';
 import * as s3 from 'aws-cdk-lib/aws-s3';
 import * as s3n from 'aws-cdk-lib/aws-s3-notifications';
-import * as lambda from 'aws-cdk-lib/aws-lambda';
 import * as sqs from 'aws-cdk-lib/aws-sqs';
 import * as lambdaEventSources from 'aws-cdk-lib/aws-lambda-event-sources';
-import * as secretsmanager from 'aws-cdk-lib/aws-secretsmanager';
 import { ServicePrincipal, Role, FederatedPrincipal, PolicyStatement, Effect } from 'aws-cdk-lib/aws-iam';
 import { LogGroup, RetentionDays, FilterPattern } from 'aws-cdk-lib/aws-logs';
 import * as sso from 'aws-cdk-lib/aws-sso';
 import * as cloudfront from 'aws-cdk-lib/aws-cloudfront';
 import * as origins from 'aws-cdk-lib/aws-cloudfront-origins';
 
+function addDatadogLayer(lambdaFunction, options = {}) {
+    const { datadogApiKeyArn } = options;
+    // Resolve the Datadog API key ARN from multiple sources
+    const resolvedDatadogApiKeyArn = datadogApiKeyArn ||
+        process.env.DATADOG_API_KEY_ARN ||
+        process.env.CDK_ENV_DATADOG_API_KEY_ARN;
+    // Return false if no API key is found
+    if (!resolvedDatadogApiKeyArn) {
+        return false;
+    }
+    const stack = Stack.of(lambdaFunction);
+    // Create Datadog Node.js layer
+    const datadogNodeLayer = lambda.LayerVersion.fromLayerVersionArn(stack, `DatadogNodeLayer-${lambdaFunction.node.id}`, `arn:aws:lambda:${stack.region}:464622532012:layer:Datadog-Node20-x:${CDK$2.DATADOG.LAYER.NODE}`);
+    // Create Datadog Extension layer
+    const datadogExtensionLayer = lambda.LayerVersion.fromLayerVersionArn(stack, `DatadogExtensionLayer-${lambdaFunction.node.id}`, `arn:aws:lambda:${stack.region}:464622532012:layer:Datadog-Extension:${CDK$2.DATADOG.LAYER.EXTENSION}`);
+    // Add layers to the lambda function
+    lambdaFunction.addLayers(datadogNodeLayer, datadogExtensionLayer);
+    // Define Datadog environment variables
+    const datadogEnvVars = {
+        DD_API_KEY_SECRET_ARN: resolvedDatadogApiKeyArn,
+        DD_ENHANCED_METRICS: "true",
+        DD_ENV: process.env.PROJECT_ENV || "",
+        DD_PROFILING_ENABLED: "false",
+        DD_SERVERLESS_APPSEC_ENABLED: "false",
+        DD_SERVICE: process.env.PROJECT_SERVICE || "",
+        DD_SITE: CDK$2.DATADOG.SITE,
+        DD_TAGS: `${CDK$2.TAG.SPONSOR}:${process.env.PROJECT_SPONSOR || ""}`,
+        DD_TRACE_OTEL_ENABLED: "false",
+    };
+    // Add environment variables only if they don't already exist
+    Object.entries(datadogEnvVars).forEach(([key, value]) => {
+        if (lambdaFunction.environment[key] === undefined) {
+            lambdaFunction.addEnvironment(key, value);
+        }
+    });
+    // Grant Datadog API key read permission
+    const datadogApiKey = secretsmanager.Secret.fromSecretCompleteArn(stack, `DatadogApiKeyGrant-${lambdaFunction.node.id}`, resolvedDatadogApiKeyArn);
+    datadogApiKey.grantRead(lambdaFunction);
+    return true;
+}
+
+function addParamsAndSecrets(lambdaFunction, options = {}) {
+    const { paramsAndSecrets, paramsAndSecretsOptions } = options;
+    // Return false if explicitly disabled
+    if (paramsAndSecrets === false) {
+        return false;
+    }
+    const stack = Stack.of(lambdaFunction);
+    let resolvedLayer = undefined;
+    if (paramsAndSecrets instanceof lambda.ParamsAndSecretsLayerVersion) {
+        // For custom ParamsAndSecretsLayerVersion, we need to extract the ARN
+        // This is a workaround since ParamsAndSecretsLayerVersion doesn't implement ILayerVersion
+        const layerArn = `arn:aws:lambda:${stack.region}:017000801446:layer:AWSLambdaParametersAndSecrets:${lambda.ParamsAndSecretsVersions.V1_0_103}`;
+        resolvedLayer = lambda.LayerVersion.fromLayerVersionArn(stack, `ParamsAndSecretsLayer-${lambdaFunction.node.id}`, layerArn);
+        // Set environment variables for configuration
+        if (paramsAndSecretsOptions?.cacheSize) {
+            lambdaFunction.addEnvironment("PARAMETERS_SECRETS_EXTENSION_CACHE_SIZE", paramsAndSecretsOptions.cacheSize.toString());
+        }
+        if (paramsAndSecretsOptions?.logLevel) {
+            lambdaFunction.addEnvironment("PARAMETERS_SECRETS_EXTENSION_LOG_LEVEL", paramsAndSecretsOptions.logLevel);
+        }
+        if (paramsAndSecretsOptions?.parameterStoreTtl) {
+            lambdaFunction.addEnvironment("PARAMETERS_SECRETS_EXTENSION_PARAMETER_STORE_TTL", paramsAndSecretsOptions.parameterStoreTtl.toString());
+        }
+        if (paramsAndSecretsOptions?.secretsManagerTtl) {
+            lambdaFunction.addEnvironment("PARAMETERS_SECRETS_EXTENSION_SECRETS_MANAGER_TTL", paramsAndSecretsOptions.secretsManagerTtl.toString());
+        }
+    }
+    else {
+        // Create default ParamsAndSecrets layer using LayerVersion.fromLayerVersionArn
+        const layerArn = `arn:aws:lambda:${stack.region}:017000801446:layer:AWSLambdaParametersAndSecrets:${lambda.ParamsAndSecretsVersions.V1_0_103}`;
+        resolvedLayer = lambda.LayerVersion.fromLayerVersionArn(stack, `ParamsAndSecretsLayer-${lambdaFunction.node.id}`, layerArn);
+        // Set default environment variables
+        if (paramsAndSecretsOptions?.cacheSize) {
+            lambdaFunction.addEnvironment("PARAMETERS_SECRETS_EXTENSION_CACHE_SIZE", paramsAndSecretsOptions.cacheSize.toString());
+        }
+        const logLevel = paramsAndSecretsOptions?.logLevel || lambda.ParamsAndSecretsLogLevel.WARN;
+        lambdaFunction.addEnvironment("PARAMETERS_SECRETS_EXTENSION_LOG_LEVEL", logLevel);
+        if (paramsAndSecretsOptions?.parameterStoreTtl) {
+            lambdaFunction.addEnvironment("PARAMETERS_SECRETS_EXTENSION_PARAMETER_STORE_TTL", paramsAndSecretsOptions.parameterStoreTtl.toString());
+        }
+        if (paramsAndSecretsOptions?.secretsManagerTtl) {
+            lambdaFunction.addEnvironment("PARAMETERS_SECRETS_EXTENSION_SECRETS_MANAGER_TTL", paramsAndSecretsOptions.secretsManagerTtl.toString());
+        }
+    }
+    // Add the layer to the lambda function
+    if (resolvedLayer) {
+        lambdaFunction.addLayers(resolvedLayer);
+        return true;
+    }
+    return false;
+}
+
 function constructEnvName(name, opts) {
     const env = opts?.env ?? process.env.PROJECT_ENV ?? "build";
     const key = opts?.key ?? process.env.PROJECT_KEY ?? "project";
-    const nonce = opts?.nonce ?? process.env.PROJECT_NONCE ?? "cfe2";
+    const nonce = opts?.nonce ?? process.env.PROJECT_NONCE ?? "cfe2"; // This default is intentionally short. It is not a special value but should not be changed.
     return `${env}-${key}-${name}-${nonce}`;
 }
 
@@ -35,25 +128,6 @@ function constructStackName(key) {
     }
 }
 
-/**
- * Check if the current environment matches the given environment
- */
-function isEnv(env) {
-    return process.env.PROJECT_ENV === env;
-}
-/**
- * Check if the current environment is production
- */
-function isProductionEnv() {
-    return isEnv(CDK$2.ENV.PRODUCTION);
-}
-/**
- * Check if the current environment is sandbox
- */
-function isSandboxEnv() {
-    return isEnv(CDK$2.ENV.SANDBOX);
-}
-
 const CDK$1 = {
     CREATION: {
         CDK: "cdk",
@@ -77,35 +151,137 @@ const CDK$1 = {
         VERSION: "version",
     },
 };
-function stackTagger(stack, { name } = {}) {
+function constructTagger(construct, { name } = {}) {
     const stackName = name || constructStackName();
     const version = process.env.npm_package_version || process.env.PROJECT_VERSION || null;
     if (process.env.PROJECT_COMMIT && process.env.PROJECT_COMMIT.length > 8) {
-        Tags.of(stack).add(CDK$1.TAG.BUILD_HEX, process.env.PROJECT_COMMIT.slice(0, 8));
+        Tags.of(construct).add(CDK$1.TAG.BUILD_HEX, process.env.PROJECT_COMMIT.slice(0, 8));
     }
-    Tags.of(stack).add(CDK$1.TAG.BUILD_DATE, new Date().toISOString());
-    Tags.of(stack).add(CDK$1.TAG.BUILD_TIME, Date.now().toString());
+    Tags.of(construct).add(CDK$1.TAG.BUILD_DATE, new Date().toISOString());
+    Tags.of(construct).add(CDK$1.TAG.BUILD_TIME, Date.now().toString());
     if (process.env.PROJECT_COMMIT)
-        Tags.of(stack).add(CDK$1.TAG.COMMIT, process.env.PROJECT_COMMIT);
-    Tags.of(stack).add(CDK$1.TAG.CREATION, CDK$1.CREATION.CDK);
+        Tags.of(construct).add(CDK$1.TAG.COMMIT, process.env.PROJECT_COMMIT);
+    Tags.of(construct).add(CDK$1.TAG.CREATION, CDK$1.CREATION.CDK);
     if (process.env.PROJECT_ENV)
-        Tags.of(stack).add(CDK$1.TAG.ENV, process.env.PROJECT_ENV);
+        Tags.of(construct).add(CDK$1.TAG.ENV, process.env.PROJECT_ENV);
     if (process.env.PROJECT_NONCE)
-        Tags.of(stack).add(CDK$1.TAG.NONCE, process.env.PROJECT_NONCE);
+        Tags.of(construct).add(CDK$1.TAG.NONCE, process.env.PROJECT_NONCE);
     if (process.env.PROJECT_KEY)
-        Tags.of(stack).add(CDK$1.TAG.PROJECT, process.env.PROJECT_KEY);
-    Tags.of(stack).add(CDK$1.TAG.ROLE, CDK$1.ROLE.STACK);
+        Tags.of(construct).add(CDK$1.TAG.PROJECT, process.env.PROJECT_KEY);
+    Tags.of(construct).add(CDK$1.TAG.ROLE, CDK$1.ROLE.STACK);
     if (process.env.PROJECT_SERVICE)
-        Tags.of(stack).add(CDK$1.TAG.SERVICE, process.env.PROJECT_SERVICE);
+        Tags.of(construct).add(CDK$1.TAG.SERVICE, process.env.PROJECT_SERVICE);
     if (process.env.PROJECT_SPONSOR)
-        Tags.of(stack).add(CDK$1.TAG.SPONSOR, process.env.PROJECT_SPONSOR);
+        Tags.of(construct).add(CDK$1.TAG.SPONSOR, process.env.PROJECT_SPONSOR);
     if (stackName)
-        Tags.of(stack).add(CDK$1.TAG.STACK, stackName);
+        Tags.of(construct).add(CDK$1.TAG.STACK, stackName);
     if (version)
-        Tags.of(stack).add(CDK$1.TAG.VERSION, version);
+        Tags.of(construct).add(CDK$1.TAG.VERSION, version);
     return true;
 }
 
+function envHostname({ component, domain, env, subdomain, }) {
+    const resolvedDomain = domain || process.env.CDK_ENV_DOMAIN || process.env.CDK_ENV_HOSTED_ZONE;
+    if (!resolvedDomain) {
+        throw new ConfigurationError("No hostname `domain` provided. Set CDK_ENV_DOMAIN or CDK_ENV_HOSTED_ZONE to use environment domain");
+    }
+    const resolvedComponent = component === "@" || component === "" ? undefined : component;
+    const resolvedSubdomain = subdomain || process.env.CDK_ENV_SUBDOMAIN;
+    const resolvedEnv = env || process.env.PROJECT_ENV;
+    const parts = [
+        resolvedComponent,
+        resolvedSubdomain,
+        resolvedEnv,
+        resolvedDomain,
+    ].filter((part) => part);
+    return parts.join(".");
+}
+
+/**
+ * Check if the current environment matches the given environment
+ */
+function isEnv(env) {
+    return process.env.PROJECT_ENV === env;
+}
+/**
+ * Check if the current environment is production
+ */
+function isProductionEnv() {
+    return isEnv(CDK$2.ENV.PRODUCTION);
+}
+/**
+ * Check if the current environment is sandbox
+ */
+function isSandboxEnv() {
+    return isEnv(CDK$2.ENV.SANDBOX);
+}
+
+function jaypieLambdaEnv(options = {}) {
+    const { initialEnvironment = {} } = options;
+    // Start with empty environment - we'll only add valid values
+    let environment = {};
+    // First, add all valid string values from initialEnvironment
+    Object.entries(initialEnvironment).forEach(([key, value]) => {
+        if (typeof value === "string") {
+            environment[key] = value;
+        }
+    });
+    // Default environment values
+    const defaultEnvValues = {
+        AWS_LAMBDA_NODEJS_DISABLE_CALLBACK_WARNING: "true",
+    };
+    // Apply default environment values with user overrides
+    Object.entries(defaultEnvValues).forEach(([key, defaultValue]) => {
+        if (key in initialEnvironment) {
+            const userValue = initialEnvironment[key];
+            // If user passes a string, it's already added above
+            // If user passes non-string falsy value, omit the key
+            if (!userValue) {
+                delete environment[key];
+            }
+            // Ignore non-string truthy values (key not added)
+        }
+        else {
+            // No user override, use default value
+            environment[key] = defaultValue;
+        }
+    });
+    // Default environment variables from process.env if present
+    const defaultEnvVars = [
+        "DATADOG_API_KEY_ARN",
+        "LOG_LEVEL",
+        "MODULE_LOGGER",
+        "MODULE_LOG_LEVEL",
+        "PROJECT_CHAOS",
+        "PROJECT_COMMIT",
+        "PROJECT_ENV",
+        "PROJECT_KEY",
+        "PROJECT_SECRET",
+        "PROJECT_SERVICE",
+        "PROJECT_SPONSOR",
+        "PROJECT_VERSION",
+    ];
+    // Add default environment variables if they exist in process.env
+    defaultEnvVars.forEach((envVar) => {
+        if (process.env[envVar] && !environment[envVar]) {
+            environment[envVar] = process.env[envVar];
+        }
+    });
+    return environment;
+}
+
+function resolveHostedZone(scope, { name = "HostedZone", zone = process.env.CDK_ENV_HOSTED_ZONE, }) {
+    if (!zone) {
+        throw new ConfigurationError("No `zone` provided. Set CDK_ENV_HOSTED_ZONE to use environment zone");
+    }
+    if (typeof zone === "string") {
+        return route53.HostedZone.fromLookup(scope, name, {
+            domainName: zone,
+        });
+    }
+    return zone;
+}
+
 class JaypieApiGateway extends Construct {
     constructor(scope, id, props) {
         super(scope, id);
@@ -132,14 +308,7 @@ class JaypieApiGateway extends Construct {
         let hostedZone;
         let certificateToUse;
         if (host && zone) {
-            if (typeof zone === "string") {
-                hostedZone = route53.HostedZone.fromLookup(this, "HostedZone", {
-                    domainName: zone,
-                });
-            }
-            else {
-                hostedZone = zone;
-            }
+            hostedZone = resolveHostedZone(this, { zone });
             if (certificate === true) {
                 certificateToUse = new acm.Certificate(this, certificateName, {
                     domainName: host,
@@ -271,7 +440,7 @@ class JaypieStack extends Stack {
         };
         super(scope, id, stackProps);
         // Apply tags
-        stackTagger(this, { name: stackProps.stackName });
+        constructTagger(this, { name: stackProps.stackName });
     }
 }
 
@@ -290,102 +459,11 @@ class JaypieLambda extends Construct {
     constructor(scope, id, props) {
         super(scope, id);
         const { allowAllOutbound, allowPublicSubnet, architecture = lambda.Architecture.X86_64, code, codeSigningConfig, datadogApiKeyArn, deadLetterQueue, deadLetterQueueEnabled, deadLetterTopic, description, environment: initialEnvironment = {}, environmentEncryption, envSecrets = {}, ephemeralStorageSize, filesystem, handler = "index.handler", initialPolicy, layers = [], logRetention = CDK$2.LAMBDA.LOG_RETENTION, logRetentionRole, logRetentionRetryOptions, maxEventAge, memorySize = CDK$2.LAMBDA.MEMORY_SIZE, paramsAndSecrets, paramsAndSecretsOptions, profiling, profilingGroup, provisionedConcurrentExecutions, reservedConcurrentExecutions, retryAttempts, roleTag = CDK$2.ROLE.PROCESSING, runtime = lambda.Runtime.NODEJS_22_X, runtimeManagementMode, secrets = [], securityGroups, timeout = Duration.seconds(CDK$2.DURATION.LAMBDA_WORKER), tracing, vendorTag, vpc, vpcSubnets, } = props;
-        // Create a mutable copy of the environment variables
-        let environment = { ...initialEnvironment };
-        // Default environment values
-        const defaultEnvValues = {
-            AWS_LAMBDA_NODEJS_DISABLE_CALLBACK_WARNING: "true",
-        };
-        // Apply default environment values with user overrides
-        Object.entries(defaultEnvValues).forEach(([key, defaultValue]) => {
-            if (key in initialEnvironment) {
-                const userValue = initialEnvironment[key];
-                // If user passes a string, use that value
-                if (typeof userValue === "string") {
-                    environment[key] = userValue;
-                }
-                // If user passes non-string falsy value, omit the key
-                else if (!userValue) {
-                    delete environment[key];
-                }
-                // Ignore non-string truthy values (key already not present)
-            }
-            else {
-                // No user override, use default value
-                environment[key] = defaultValue;
-            }
-        });
-        // Default environment variables from process.env if present
-        const defaultEnvVars = [
-            "DATADOG_API_KEY_ARN",
-            "LOG_LEVEL",
-            "MODULE_LOGGER",
-            "MODULE_LOG_LEVEL",
-            "PROJECT_COMMIT",
-            "PROJECT_ENV",
-            "PROJECT_KEY",
-            "PROJECT_SECRET",
-            "PROJECT_SERVICE",
-            "PROJECT_SPONSOR",
-            "PROJECT_VERSION",
-        ];
-        // Add default environment variables if they exist in process.env
-        defaultEnvVars.forEach((envVar) => {
-            if (process.env[envVar] && !environment[envVar]) {
-                environment[envVar] = process.env[envVar];
-            }
-        });
+        // Get base environment with defaults
+        const environment = jaypieLambdaEnv({ initialEnvironment });
         const codeAsset = typeof code === "string" ? lambda.Code.fromAsset(code) : code;
         // Create a working copy of layers
         const resolvedLayers = [...layers];
-        // Determine if we should add Datadog integration
-        // Check for datadog API key ARN in different sources
-        const resolvedDatadogApiKeyArn = datadogApiKeyArn ||
-            process.env.DATADOG_API_KEY_ARN ||
-            process.env.CDK_ENV_DATADOG_API_KEY_ARN;
-        // Add Datadog integration if API key is available
-        if (resolvedDatadogApiKeyArn) {
-            // Add Datadog Node.js layer
-            const datadogNodeLayer = lambda.LayerVersion.fromLayerVersionArn(this, "DatadogNodeLayer", `arn:aws:lambda:${Stack.of(this).region}:464622532012:layer:Datadog-Node20-x:${CDK$2.DATADOG.LAYER.NODE}`);
-            resolvedLayers.push(datadogNodeLayer);
-            // Add Datadog Extension layer
-            const datadogExtensionLayer = lambda.LayerVersion.fromLayerVersionArn(this, "DatadogExtensionLayer", `arn:aws:lambda:${Stack.of(this).region}:464622532012:layer:Datadog-Extension:${CDK$2.DATADOG.LAYER.EXTENSION}`);
-            resolvedLayers.push(datadogExtensionLayer);
-            // Set Datadog environment variables
-            Object.assign(environment, {
-                DD_API_KEY_SECRET_ARN: resolvedDatadogApiKeyArn,
-                DD_ENHANCED_METRICS: "true",
-                DD_ENV: process.env.PROJECT_ENV || "",
-                DD_PROFILING_ENABLED: "false",
-                DD_SERVERLESS_APPSEC_ENABLED: "false",
-                DD_SERVICE: process.env.PROJECT_SERVICE || "",
-                DD_SITE: CDK$2.DATADOG.SITE,
-                DD_TAGS: `${CDK$2.TAG.SPONSOR}:${process.env.PROJECT_SPONSOR || ""}`,
-                DD_TRACE_OTEL_ENABLED: "false",
-            });
-        }
-        // Configure ParamsAndSecrets layer
-        let resolvedParamsAndSecrets = undefined;
-        if (paramsAndSecrets !== false) {
-            if (paramsAndSecrets instanceof lambda.ParamsAndSecretsLayerVersion) {
-                resolvedParamsAndSecrets = paramsAndSecrets;
-            }
-            else {
-                // Create default ParamsAndSecrets layer
-                resolvedParamsAndSecrets =
-                    lambda.ParamsAndSecretsLayerVersion.fromVersion(lambda.ParamsAndSecretsVersions.V1_0_103, {
-                        cacheSize: paramsAndSecretsOptions?.cacheSize,
-                        logLevel: paramsAndSecretsOptions?.logLevel ||
-                            lambda.ParamsAndSecretsLogLevel.WARN,
-                        parameterStoreTtl: paramsAndSecretsOptions?.parameterStoreTtl
-                            ? Duration.seconds(paramsAndSecretsOptions.parameterStoreTtl)
-                            : undefined,
-                        secretsManagerTtl: paramsAndSecretsOptions?.secretsManagerTtl
-                            ? Duration.seconds(paramsAndSecretsOptions.secretsManagerTtl)
-                            : undefined,
-                    });
-            }
-        }
         // Process secrets environment variables
         const secretsEnvironment = Object.entries(envSecrets).reduce((acc, [key, secret]) => ({
             ...acc,
@@ -428,7 +506,6 @@ class JaypieLambda extends Construct {
             logRetentionRetryOptions,
             maxEventAge,
             memorySize,
-            paramsAndSecrets: resolvedParamsAndSecrets,
             profiling,
             profilingGroup,
             reservedConcurrentExecutions,
@@ -449,6 +526,13 @@ class JaypieLambda extends Construct {
                 }
                 : undefined,
         });
+        // Add ParamsAndSecrets layer if configured
+        addParamsAndSecrets(this._lambda, {
+            paramsAndSecrets,
+            paramsAndSecretsOptions,
+        });
+        // Add Datadog layers and environment variables if configured
+        addDatadogLayer(this._lambda, { datadogApiKeyArn });
         // Grant secret read permissions
         Object.values(envSecrets).forEach((secret) => {
             secret.grantRead(this._lambda);
@@ -457,11 +541,6 @@ class JaypieLambda extends Construct {
         secrets.forEach((secret) => {
             secret.grantRead(this._lambda);
         });
-        // Grant Datadog API key read permission if applicable
-        if (resolvedDatadogApiKeyArn) {
-            const datadogApiKey = secretsmanager.Secret.fromSecretCompleteArn(this, "DatadogApiKeyGrant", resolvedDatadogApiKeyArn);
-            datadogApiKey.grantRead(this._lambda);
-        }
         // Configure provisioned concurrency if specified
         if (provisionedConcurrentExecutions !== undefined) {
             // Use currentVersion which is auto-published with proper configuration
@@ -1702,6 +1781,9 @@ class JaypieWebDeploymentBucket extends Construct {
     grantWrite(identity, objectsKeyPattern) {
         return this.bucket.grantWrite(identity, objectsKeyPattern);
     }
+    grantReplicationPermission(identity, props) {
+        return this.bucket.grantReplicationPermission(identity, props);
+    }
     s3UrlForObject(key) {
         return this.bucket.s3UrlForObject(key);
     }
@@ -1752,5 +1834,5 @@ class JaypieWebDeploymentBucket extends Construct {
     }
 }
 
-export { JaypieApiGateway, JaypieAppStack, JaypieBucketQueuedLambda, JaypieDatadogSecret, JaypieEnvSecret, JaypieExpressLambda, JaypieHostedZone, JaypieInfrastructureStack, JaypieLambda, JaypieMongoDbSecret, JaypieOpenAiSecret, JaypieQueuedLambda, JaypieSsoGroups, JaypieStack, JaypieTraceSigningKeySecret, JaypieWebDeploymentBucket, PermissionSetType, constructEnvName, constructStackName, isEnv, isProductionEnv, isSandboxEnv, stackTagger };
+export { JaypieApiGateway, JaypieAppStack, JaypieBucketQueuedLambda, JaypieDatadogSecret, JaypieEnvSecret, JaypieExpressLambda, JaypieHostedZone, JaypieInfrastructureStack, JaypieLambda, JaypieMongoDbSecret, JaypieOpenAiSecret, JaypieQueuedLambda, JaypieSsoGroups, JaypieStack, JaypieTraceSigningKeySecret, JaypieWebDeploymentBucket, PermissionSetType, addDatadogLayer, addParamsAndSecrets, constructEnvName, constructStackName, constructTagger, envHostname, isEnv, isProductionEnv, isSandboxEnv, jaypieLambdaEnv, resolveHostedZone };
 //# sourceMappingURL=index.js.map