[litianningdatadog]

What does this PR do?

Two optional builder methods on LogFlusher:

• with_api_key_resolver(ApiKeyResolver): an async closure called for the primary key on every flush, so a reloaded key is used right away. If it returns no key, the primary is skipped for that flush with one error line; additional endpoints are still sent.
• with_datadog_intake_url(url): replaces the default Datadog intake URL (keeps any path), Datadog mode only.

Motivation

Part of SVLS-8713: bottlecap (the Datadog Lambda Extension) is replacing its own logs aggregator and flusher with this crate. Two rules for the whole stack:

• Nothing changes for existing users of this crate (for example serverless-compat): every new behavior is opt-in, defaults and public API stay the same (additions only), no new environment variables, no new dependencies.
• Nothing changes for Lambda users: the options let bottlecap reproduce its current behavior exactly.

bottlecap's key can come from AWS Secrets Manager/KMS/SSM and can be reloaded (api_key_secret_reload_interval), and users can set DD_LOGS_CONFIG_LOGS_DD_URL. A closure instead of taking bottlecap's key factory type keeps dogstatsd (~38 crates) out of this crate.

Additional Notes

Without these methods the flusher behaves exactly as before. No new dependencies.

Describe how to test/QA your changes

98 tests pass (new: resolved key used, resolver called every flush, reloaded key used next flush, no-key path still sends extras, URL override used in Datadog mode and ignored for OPW).

Stack

Each PR is nested under the PR it builds on (and targets). Review and merge from the top down.

serverless-components (datadog-logs-agent options; merge first)

• main
  • [SVLS-8713] test(logs-agent): pin current default behavior with characterization tests #189 characterization tests (pin today's defaults)
    • [SVLS-8713] build(logs-agent): let users choose the FIPS TLS backend #190 default / fips features
      • [SVLS-8713] feat(logs-agent): accept pre-serialized logs and an oversize policy #191 pre-serialized logs + oversize policy
        • 👉 [SVLS-8713] feat(logs-agent): optional API key resolver and Datadog intake URL override #192 API key resolver + intake URL override ← this PR
          • [SVLS-8713] feat(logs-agent): add a retry-only method and an optional flush policy #193 retry() + FlushPolicy
            • [SVLS-8713] perf(logs-agent): compress each log batch only once #194 compress each batch once
              • [SVLS-8713] perf(logs-agent): compress log batches before waiting for the API key #195 compress before waiting for the API key

datadog-lambda-extension (bottlecap)

• main
  • [SVLS-8713] test(logs): contract tests, fake logs intake and benchmark for the logs pipeline datadog-lambda-extension#1448 contract tests, fake intake, benchmark
    • [SVLS-8713] fix(logs): send additional endpoints the Datadog intake format when OPW is on datadog-lambda-extension#1449 fix: OPW applies only to the primary endpoint
      • [SVLS-8713] fix(logs): drop a log too large for any payload instead of blocking the queue datadog-lambda-extension#1450 fix: drop a log too large for any payload
        • [SVLS-8713] test(logs): pin that a reloaded API key is used on the next flush datadog-lambda-extension#1451 pin: reloaded API key is used
          • bc-1: use the shared aggregator (opens after the serverless-components PRs merge)
            • bc-2: use the shared flusher (opens after the serverless-components PRs merge)

🤖 Generated with Claude Code