@auth-craft/aws-cf-stack 1.7.1 → 1.9.0

package/bin/deploy.sh

@@ -44,6 +44,9 @@ Options (each also reads an env var; the flag wins):
   --stage <dev|staging|prod>   Stage          (env STAGE, default dev; accepts production/development)
   --project <name>             CDK project     (env PROJECT, default "default")
   --app-name <name>            Override app name (env AUTH_CRAFT_APP_NAME; default auth-craft[-project])
+  --layer <name>               Layer namespace within the app (env LAYER, default "auth").
+                               Resource names are {app}-{env}-{layer}-{component}, so a larger
+                               app with other layers (e.g. billing) reuses this CLI per layer.
   --region <region>            AWS region      (env LAMBDA_AWS_REGION, default us-east-1)
   --gateway-secret <v>         env LAMBDA_GATEWAY_SECRET
   --jwt-public-key <v>         env LAMBDA_JWT_PUBLIC_KEY
@@ -51,6 +54,12 @@ Options (each also reads an env var; the flag wins):
   --edge-gate-secret <v>       env CF_EDGE_GATE_SECRET
   --cf-account-id <v>          env CLOUDFLARE_ACCOUNT_ID
   --cf-api-token <v>           env CLOUDFLARE_API_TOKEN
+  --log-retention-days <n>     CloudWatch log retention (env LAMBDA_LOG_RETENTION_DAYS).
+                               Default: 3 in dev, 30 otherwise. Use 'infinite' to never
+                               expire. Only CloudWatch's fixed set is valid
+                               (1,3,5,7,14,30,60,90,120,150,180,365,400,545,731,…).
+  --tracing <mode>             X-Ray tracing: active|disabled|pass_through
+                               (env LAMBDA_TRACING; default disabled in dev, active otherwise)
   --outputs-file <path>        (lambda) write CDK outputs JSON here for your own steps
   --env-file <path>            Optional: source a file first (flags/env still override)
   --skip-build                 No-op (artifacts are prebuilt in the package)
@@ -78,6 +87,7 @@ while [[ $# -gt 0 ]]; do
     --stage)            FLAG[STAGE]="${2:?}"; shift 2 ;;
     --project)          FLAG[PROJECT]="${2:?}"; shift 2 ;;
     --app-name)         FLAG[AUTH_CRAFT_APP_NAME]="${2:?}"; shift 2 ;;
+    --layer)            FLAG[LAYER]="${2:?}"; shift 2 ;;
     --region)           FLAG[LAMBDA_AWS_REGION]="${2:?}"; shift 2 ;;
     --gateway-secret)   FLAG[LAMBDA_GATEWAY_SECRET]="${2:?}"; shift 2 ;;
     --jwt-public-key)   FLAG[LAMBDA_JWT_PUBLIC_KEY]="${2:?}"; shift 2 ;;
@@ -85,6 +95,8 @@ while [[ $# -gt 0 ]]; do
     --edge-gate-secret) FLAG[CF_EDGE_GATE_SECRET]="${2:?}"; shift 2 ;;
     --cf-account-id)    FLAG[CLOUDFLARE_ACCOUNT_ID]="${2:?}"; shift 2 ;;
     --cf-api-token)     FLAG[CLOUDFLARE_API_TOKEN]="${2:?}"; shift 2 ;;
+    --log-retention-days) FLAG[LAMBDA_LOG_RETENTION_DAYS]="${2:?}"; shift 2 ;;
+    --tracing)          FLAG[LAMBDA_TRACING]="${2:?}"; shift 2 ;;
     --outputs-file)     OUTPUTS_FILE="${2:?}"; export OUTPUTS_FILE; shift 2 ;;
     --env-file)         ENV_FILE="${2:?}"; shift 2 ;;
     --skip-build)       shift ;;
@@ -142,7 +154,7 @@ case "$COMMAND" in
     # if not already exported in this process (e.g. snapshot drove `lambda` separately).
     if [[ -z "${LAMBDA_FUNCTION_URL:-}" || -z "${API_BASE_PATH:-}" ]]; then
       require_aws_identity
-      api_stack="${APP_NAME}-${STAGE}-api"
+      api_stack="${RESOURCE_NAME}-api"
       LAMBDA_FUNCTION_URL="$(cfn_output "$api_stack" LambdaFunctionUrl)"
       API_BASE_PATH="$(cfn_output "$api_stack" ApiBasePath)"
       AUTH_SYSTEM_NAME="$(cfn_output "$api_stack" AuthSystemName)"

package/cdk/bin/app.ts

@@ -10,6 +10,7 @@ const app = new cdk.App();
 const rawStage = process.env.STAGE || 'dev';
 const stage = rawStage === 'production' ? 'prod' : rawStage === 'development' ? 'dev' : rawStage;
 const project = process.env.PROJECT || 'default'; // Client project name
+const layer = process.env.LAYER || 'auth'; // Layer namespace within the app (default "auth")
 
 const env = {
   account: process.env.CDK_DEFAULT_ACCOUNT,
@@ -17,18 +18,24 @@ const env = {
 };
 
 // ==================== Naming Convention ====================
-// Stack naming: {app}-{env}-{layer}
-//   - app: AUTH_CRAFT_APP_NAME if set, else "auth-craft" (base) / "auth-craft-{project}"
-//   - env: "dev", "staging", "prod"
-//   - layer: "data", "api"
-//   Examples: auth-craft-dev-data, auth-craft-staging-api, snapshot-auth-prod-api
+// Pattern: {app}-{env}-{layer}-{component}
+//   - app:   AUTH_CRAFT_APP_NAME if set, else "auth-craft" (base) / "auth-craft-{project}"
+//   - env:   "dev", "staging", "prod"
+//   - layer: LAYER (default "auth") — namespaces this deploy within a larger app
+//   - component: per-resource suffix ("data" for the table, "api" for the Lambda)
+//   The {app}-{env}-{layer} base is the resourceName (AUTH_SYSTEM_NAME / JWT issuer);
+//   it carries no component so the iss claim stays stable across resources.
+//   Examples: snapshot-commerce-prod-auth-data, snapshot-commerce-prod-auth-api
 
-const appName =
-  process.env.AUTH_CRAFT_APP_NAME || (project === 'default' ? 'auth-craft' : `auth-craft-${project}`);
+const appName = process.env.AUTH_CRAFT_APP_NAME || (project === 'default' ? 'auth-craft' : `auth-craft-${project}`);
+
+// Base name shared by every resource (also AUTH_SYSTEM_NAME / JWT issuer).
+const resourceBase = `${appName}-${stage}-${layer}`;
 
 console.log(`🚀 Deploying Auth Craft to AWS`);
 console.log(`   App: ${appName}`);
 console.log(`   Stage: ${stage}`);
+console.log(`   Layer: ${layer}`);
 console.log(`   Region: ${env.region}`);
 
 // Common tags for cost allocation
@@ -39,30 +46,29 @@ const costTags = {
   ManagedBy: 'CDK',
 };
 
-// Stack naming helper: {app}-{env}-{layer}
-const getStackName = (layer: string) => `${appName}-${stage}-${layer}`;
-
-// Resource naming helper: {app}-{env}
-const getResourceName = () => `${appName}-${stage}`;
+// Stack / resource naming helper: {app}-{env}-{layer}-{component}
+const nameFor = (component: string) => `${resourceBase}-${component}`;
 
-// DynamoDB Stack (data layer)
-const dynamodbStack = new DynamoDBStack(app, `${appName}-${stage}-data`, {
+// DynamoDB Stack (data component)
+const dynamodbStack = new DynamoDBStack(app, nameFor('data'), {
   env,
-  stackName: getStackName('data'),
-  description: `Auth Craft DynamoDB (${appName}-${stage})`,
+  stackName: nameFor('data'),
+  description: `Auth Craft DynamoDB (${resourceBase})`,
   tags: costTags,
-  resourceName: getResourceName(),
+  tableName: nameFor('data'),
   stage,
 });
 
-// Lambda Stack (api layer)
-const lambdaStack = new LambdaStack(app, `${appName}-${stage}-api`, {
+// Lambda Stack (api component)
+const lambdaStack = new LambdaStack(app, nameFor('api'), {
   env,
-  stackName: getStackName('api'),
-  description: `Auth Craft Lambda API (${appName}-${stage})`,
+  stackName: nameFor('api'),
+  description: `Auth Craft Lambda API (${resourceBase})`,
   table: dynamodbStack.table,
   tags: costTags,
-  resourceName: getResourceName(),
+  functionName: nameFor('api'),
+  // Base {app}-{env}-{layer} — AUTH_SYSTEM_NAME / JWT issuer (no component).
+  resourceName: resourceBase,
   stage,
 });
 

package/cdk/lib/dynamodb-stack.ts

@@ -3,7 +3,7 @@ import * as dynamodb from 'aws-cdk-lib/aws-dynamodb';
 import type { Construct } from 'constructs';
 
 interface DynamoDBStackProps extends cdk.StackProps {
-  resourceName: string; // e.g., "auth-craft-dev", "auth-craft-prod"
+  tableName: string; // {app}-{env}-{layer}-data, e.g. "snapshot-commerce-prod-auth-data"
   stage: string; // "dev" | "staging" | "prod" — passed from the app, single source of truth
 }
 
@@ -13,12 +13,10 @@ export class DynamoDBStack extends cdk.Stack {
   constructor(scope: Construct, id: string, props: DynamoDBStackProps) {
     super(scope, id, props);
 
-    const { resourceName, stage } = props;
+    const { tableName, stage } = props;
 
-    // Resource naming: {app}-{env}
-    // Examples: auth-craft-dev, auth-craft-staging, auth-craft-prod
-    // Multi-project: auth-craft-ecommerce-dev, auth-craft-saas-prod
-    const tableName = resourceName;
+    // Table naming: {app}-{env}-{layer}-data
+    // Examples: snapshot-commerce-prod-auth-data, auth-craft-dev-auth-data
 
     this.table = new dynamodb.Table(this, 'AuthCraftTable', {
       tableName,

package/cdk/lib/lambda-stack.ts

@@ -16,9 +16,82 @@ const __dirname = path.dirname(__filename);
 //   packages/aws-cf-stack/cdk/lib/lambda-stack.ts -> packages/aws-cf-stack/assets/lambda
 const LAMBDA_ASSET_DIR = path.resolve(__dirname, '../../assets/lambda');
 
+// CloudWatch Logs only accepts a fixed set of retention periods — an arbitrary day
+// count is rejected at deploy time. Map the supported values so a typo fails fast at
+// synth (with the valid list) instead of mid-deploy.
+const RETENTION_BY_DAYS: Record<number, logs.RetentionDays> = {
+  1: logs.RetentionDays.ONE_DAY,
+  3: logs.RetentionDays.THREE_DAYS,
+  5: logs.RetentionDays.FIVE_DAYS,
+  7: logs.RetentionDays.ONE_WEEK,
+  14: logs.RetentionDays.TWO_WEEKS,
+  30: logs.RetentionDays.ONE_MONTH,
+  60: logs.RetentionDays.TWO_MONTHS,
+  90: logs.RetentionDays.THREE_MONTHS,
+  120: logs.RetentionDays.FOUR_MONTHS,
+  150: logs.RetentionDays.FIVE_MONTHS,
+  180: logs.RetentionDays.SIX_MONTHS,
+  365: logs.RetentionDays.ONE_YEAR,
+  400: logs.RetentionDays.THIRTEEN_MONTHS,
+  545: logs.RetentionDays.EIGHTEEN_MONTHS,
+  731: logs.RetentionDays.TWO_YEARS,
+  1096: logs.RetentionDays.THREE_YEARS,
+  1827: logs.RetentionDays.FIVE_YEARS,
+  2192: logs.RetentionDays.SIX_YEARS,
+  2557: logs.RetentionDays.SEVEN_YEARS,
+  2922: logs.RetentionDays.EIGHT_YEARS,
+  3288: logs.RetentionDays.NINE_YEARS,
+  3653: logs.RetentionDays.TEN_YEARS,
+};
+
+/**
+ * Resolve the CloudWatch log retention from LAMBDA_LOG_RETENTION_DAYS.
+ * Accepts a supported day count (e.g. "3") or 'infinite' / 'never' to keep logs
+ * forever. Unset → stage default: 3 days in dev (cheap), 1 month otherwise.
+ */
+export function resolveLogRetention(raw: string | undefined, stage: string): logs.RetentionDays {
+  const value = raw?.trim().toLowerCase();
+
+  if (!value) {
+    return stage === 'dev' ? logs.RetentionDays.THREE_DAYS : logs.RetentionDays.ONE_MONTH;
+  }
+
+  if (value === 'infinite' || value === 'never' || value === '0') {
+    return logs.RetentionDays.INFINITE;
+  }
+
+  const days = Number(value);
+  const retention = Number.isInteger(days) ? RETENTION_BY_DAYS[days] : undefined;
+  if (retention === undefined) {
+    throw new Error(
+      `Unsupported LAMBDA_LOG_RETENTION_DAYS: '${raw}'. ` +
+        `CloudWatch Logs accepts only: ${Object.keys(RETENTION_BY_DAYS).join(', ')} (or 'infinite').`,
+    );
+  }
+  return retention;
+}
+
+/**
+ * Resolve X-Ray tracing from LAMBDA_TRACING ('active' | 'disabled').
+ * Unset → disabled in dev (traces are billed per request), active otherwise.
+ */
+export function resolveTracing(raw: string | undefined, stage: string): lambda.Tracing {
+  const value = raw?.trim().toLowerCase();
+
+  if (!value) {
+    return stage === 'dev' ? lambda.Tracing.DISABLED : lambda.Tracing.ACTIVE;
+  }
+  if (value === 'active' || value === 'true' || value === 'enabled') return lambda.Tracing.ACTIVE;
+  if (value === 'disabled' || value === 'false' || value === 'off') return lambda.Tracing.DISABLED;
+  if (value === 'pass_through' || value === 'passthrough') return lambda.Tracing.PASS_THROUGH;
+
+  throw new Error(`Unsupported LAMBDA_TRACING: '${raw}'. Use 'active', 'disabled', or 'pass_through'.`);
+}
+
 interface LambdaStackProps extends cdk.StackProps {
   table: dynamodb.ITable;
-  resourceName: string; // e.g., "auth-craft-dev", "auth-craft-prod"
+  functionName: string; // {app}-{env}-{layer}-api, e.g. "snapshot-commerce-prod-auth-api"
+  resourceName: string; // base {app}-{env}-{layer} — AUTH_SYSTEM_NAME / JWT issuer (no component)
   stage: string; // "dev" | "staging" | "prod" — passed from the app, single source of truth
 }
 
@@ -30,7 +103,7 @@ export class LambdaStack extends cdk.Stack {
   constructor(scope: Construct, id: string, props: LambdaStackProps) {
     super(scope, id, props);
 
-    const { resourceName, stage } = props;
+    const { resourceName, functionName, stage } = props;
 
     // API base path — obscures the Lambda route surface and is forwarded onto by
     // the gateway worker (BACKEND_URL = FunctionUrl + this path). It MUST be stable
@@ -89,25 +162,36 @@ export class LambdaStack extends cdk.Stack {
       }
     }
 
-    // Resource naming: {app}-{env}
-    // Examples: auth-craft-dev, auth-craft-staging, auth-craft-prod
+    // Naming: functionName = {app}-{env}-{layer}-api (the deployed resource);
+    // resourceName = {app}-{env}-{layer} base (AUTH_SYSTEM_NAME / JWT issuer).
+
+    // Log group for Lambda function (matches the function name).
+    // Retention drives CloudWatch Logs storage cost, so it is configurable:
+    // LAMBDA_LOG_RETENTION_DAYS accepts any retention CloudWatch supports, plus
+    // 'infinite' (never expire). Unset → a stage-aware default that keeps dev cheap
+    // (3 days) while staging/prod keep a useful history (1 month).
+    const retention = resolveLogRetention(process.env.LAMBDA_LOG_RETENTION_DAYS, stage);
 
-    // Log group for Lambda function
     const logGroup = new logs.LogGroup(this, 'AuthLambdaLogGroup', {
-      logGroupName: `/aws/lambda/${resourceName}`,
-      retention: logs.RetentionDays.ONE_MONTH,
+      logGroupName: `/aws/lambda/${functionName}`,
+      retention,
       removalPolicy: stage === 'prod' ? cdk.RemovalPolicy.RETAIN : cdk.RemovalPolicy.DESTROY,
     });
 
+    // X-Ray tracing is billed per trace and is rarely worth it in dev, so it is
+    // opt-out there: LAMBDA_TRACING = 'active' | 'disabled' (default: disabled in
+    // dev, active elsewhere).
+    const tracing = resolveTracing(process.env.LAMBDA_TRACING, stage);
+
     // Lambda function from the PREBUILT bundle shipped in this package.
     // Unlike the in-repo app stack (which uses NodejsFunction to build from
     // src/index.ts at synth time), this self-contained package deploys the
     // already-bundled assets/lambda/index.mjs — no monorepo / source needed.
     // The app build (esbuild, ESM, @aws-sdk/* external) emits `export const handler`
     // in index.mjs → handler 'index.handler'.
-    // Function name: {app}-{env}
+    // Function name: {app}-{env}-{layer}-api
     this.lambdaFunction = new lambda.Function(this, 'AuthLambda', {
-      functionName: resourceName,
+      functionName,
       code: lambda.Code.fromAsset(LAMBDA_ASSET_DIR),
       handler: 'index.handler',
       runtime: lambda.Runtime.NODEJS_24_X,
@@ -233,8 +317,8 @@ export class LambdaStack extends cdk.Stack {
         }),
       },
 
-      // Tracing
-      tracing: lambda.Tracing.ACTIVE, // Enable X-Ray tracing
+      // Tracing (X-Ray) — see resolveTracing above; off by default in dev.
+      tracing,
     });
 
     // Grant DynamoDB permissions
@@ -290,6 +374,20 @@ export class LambdaStack extends cdk.Stack {
       exportName: `${this.stackName}-ApiBasePath`,
     });
 
+    // Cost-relevant knobs, echoed so `auth-craft-stack outputs` can show what was
+    // actually deployed (rather than what the caller thinks they set).
+    new cdk.CfnOutput(this, 'LogRetentionDays', {
+      value: String(retention),
+      description: 'CloudWatch log retention in days (0 = never expire)',
+      exportName: `${this.stackName}-LogRetentionDays`,
+    });
+
+    new cdk.CfnOutput(this, 'TracingMode', {
+      value: tracing,
+      description: 'X-Ray tracing mode',
+      exportName: `${this.stackName}-TracingMode`,
+    });
+
     // Output auth system name — used as JWT issuer by Workers to verify tokens
     new cdk.CfnOutput(this, 'AuthSystemName', {
       value: resourceName,

package/lib/common.sh

@@ -76,11 +76,18 @@ load_env_file() {
 }
 
 # ── Stage / naming derivation (mirrors the CI workflow + CDK app.ts) ──────────
-# Inputs: STAGE, PROJECT, optional AUTH_CRAFT_APP_NAME.
-# Exports STAGE (normalized), PROJECT, APP_NAME, RESOURCE_NAME, RUNTIME_NODE_ENV.
+# Inputs: STAGE, PROJECT, LAYER, optional AUTH_CRAFT_APP_NAME.
+# Exports STAGE (normalized), PROJECT, APP_NAME, LAYER, RESOURCE_NAME, RUNTIME_NODE_ENV.
+#
+# Naming pattern: {app}-{env}-{layer}, with a per-resource {component} appended
+#   (data/api/system/…). So table = {app}-{env}-{layer}-data, lambda = …-api, etc.
+#   RESOURCE_NAME is the {app}-{env}-{layer} base (also the AUTH_SYSTEM_NAME / JWT
+#   issuer). LAYER (default "auth") namespaces this deploy within a larger app that
+#   has other layers (e.g. billing); a consumer sets --layer/LAYER to reuse the CLI.
 derive_naming() {
   STAGE="${STAGE:-dev}"
   PROJECT="${PROJECT:-default}"
+  LAYER="${LAYER:-auth}"
 
   # #2 Normalize common stage aliases so a consumer can pass either form.
   #   production -> prod, development -> dev, staging stays staging.
@@ -103,9 +110,12 @@ derive_naming() {
     APP_NAME="auth-craft-${PROJECT}"
   fi
 
-  RESOURCE_NAME="${APP_NAME}-${STAGE}"
+  # Base name shared by every resource: {app}-{env}-{layer}. Per-resource component
+  # (data/api/system/…) is appended at each call site. Also the AUTH_SYSTEM_NAME /
+  # JWT issuer, so it must NOT carry a component (keeps the iss claim stable).
+  RESOURCE_NAME="${APP_NAME}-${STAGE}-${LAYER}"
   RUNTIME_NODE_ENV="$([[ "$STAGE" == "prod" ]] && echo production || echo development)"
-  export STAGE PROJECT APP_NAME RESOURCE_NAME RUNTIME_NODE_ENV
+  export STAGE PROJECT APP_NAME LAYER RESOURCE_NAME RUNTIME_NODE_ENV
 }
 
 # ── Gateway JWT key pair (#5: one source, derive the rest) ────────────────────
@@ -188,16 +198,16 @@ gateway_mode() {
 }
 
 # Derive a gateway worker URL for a scope (custom domain > workers.dev > empty).
-# In shared mode all scopes resolve to the single worker ${APP_NAME}-${STAGE}.
+# In shared mode all scopes resolve to the single worker ${RESOURCE_NAME}.
 gateway_url_for() {
   local scope="$1" upper dom_var custom worker_name
   upper="$(echo "$scope" | tr '[:lower:]' '[:upper:]')"
   dom_var="CF_WORKER_CUSTOM_DOMAIN_${upper}"
   custom="${!dom_var:-}"
   if [[ "$(gateway_mode)" == "shared" ]]; then
-    worker_name="${APP_NAME}-${STAGE}"
+    worker_name="${RESOURCE_NAME}"
   else
-    worker_name="${APP_NAME}-${STAGE}-${scope}"
+    worker_name="${RESOURCE_NAME}-${scope}"
   fi
   if [[ -n "$custom" ]]; then
     echo "https://$custom"
@@ -221,7 +231,7 @@ gateway_url_for() {
 print_outputs_json() {
   require_cmd aws; require_cmd jq
   require_aws_identity
-  local api_stack="${APP_NAME}-${STAGE}-api"
+  local api_stack="${RESOURCE_NAME}-api"
   local url base name table fn backend issuer
   url="$(cfn_output "$api_stack" LambdaFunctionUrl)"
   base="$(cfn_output "$api_stack" ApiBasePath)"
@@ -244,20 +254,28 @@ print_outputs_json() {
   svcPub="$(lambda_env "$fn" INTERNAL_JWT_PUBLIC_KEY)";   svcPub="${svcPub:-${LAMBDA_INTERNAL_JWT_PUBLIC_KEY:-}}"
 
   # Worker names per scope. In multi mode (default) each scope is its own worker
-  # (${APP_NAME}-${STAGE}-${scope}); in shared mode all scopes are the single worker
-  # ${APP_NAME}-${STAGE}. These are what a consumer's Cloudflare Pages project references
+  # (${RESOURCE_NAME}-${scope}); in shared mode all scopes are the single worker
+  # ${RESOURCE_NAME}. These are what a consumer's Cloudflare Pages project references
   # in a Service Binding (`[[services]] service = "<worker name>"`) to front auth
   # same-origin via @auth-craft/pages-auth-proxy. The binding lives in the consumer's
   # Pages project, not here — `serviceBindings` is a ready-to-paste snippet.
+  # Cost knobs, read back from the deployed stack so `outputs` reports what is live
+  # rather than what the caller's env happens to say.
+  local logRetention tracingMode
+  logRetention="$(cfn_output "$api_stack" LogRetentionDays)"
+  tracingMode="$(cfn_output "$api_stack" TracingMode)"
+  [[ -n "$logRetention" && "$logRetention" != "None" ]] || logRetention=""
+  [[ -n "$tracingMode" && "$tracingMode" != "None" ]] || tracingMode=""
+
   local mode wnSystem wnTenant wnCustomer bindingService
   mode="$(gateway_mode)"
   if [[ "$mode" == "shared" ]]; then
-    wnSystem="${APP_NAME}-${STAGE}"; wnTenant="$wnSystem"; wnCustomer="$wnSystem"
+    wnSystem="${RESOURCE_NAME}"; wnTenant="$wnSystem"; wnCustomer="$wnSystem"
     bindingService="$wnSystem"
   else
-    wnSystem="${APP_NAME}-${STAGE}-system"
-    wnTenant="${APP_NAME}-${STAGE}-tenant"
-    wnCustomer="${APP_NAME}-${STAGE}-customer"
+    wnSystem="${RESOURCE_NAME}-system"
+    wnTenant="${RESOURCE_NAME}-tenant"
+    wnCustomer="${RESOURCE_NAME}-customer"
     bindingService="$wnCustomer"
   fi
   local bindingSnippet
@@ -278,11 +296,13 @@ print_outputs_json() {
     --arg rpCustomer "${CF_WORKER_ROUTE_PREFIX_CUSTOMER:-/customer}" \
     --arg wnSystem "$wnSystem" --arg wnTenant "$wnTenant" --arg wnCustomer "$wnCustomer" \
     --arg bindingSnippet "$bindingSnippet" \
+    --arg logRetention "$logRetention" --arg tracingMode "$tracingMode" \
     '{stage:$stage, project:$project, region:$region,
       lambdaFunctionUrl:$url, apiBasePath:$base, authSystemName:$name,
       dynamodbTable:$table, backendUrl:$backend,
       jwtPublicKey:$jwtPub, jwtIssuer:$jwtIssuer, jwtAlgorithm:$jwtAlg,
       serviceJwtPublicKey:$svcPub,
+      observability:{logRetentionDays:$logRetention, tracingMode:$tracingMode},
       gatewayUrls:{system:$gwSystem, tenant:$gwTenant, customer:$gwCustomer},
       workerNames:{system:$wnSystem, tenant:$wnTenant, customer:$wnCustomer},
       routePrefixes:{system:$rpSystem, tenant:$rpTenant, customer:$rpCustomer},

package/lib/deploy-gateway.sh

@@ -295,7 +295,7 @@ deploy_gateway() {
     # ── Shared worker: one worker serves all scopes; scope comes from the path's first
     # segment (worker AUTH_SCOPE unset). CORS unions all scopes; KV uses the customer id.
     local worker_name custom_domain allowed_origins origin_suffixes cors_kv_id
-    worker_name="${APP_NAME}-${STAGE}"
+    worker_name="${RESOURCE_NAME}"
     custom_domain="$(custom_domain_for shared)"
     allowed_origins="$(merge_cors_for_shared allowed_origins_for)"
     origin_suffixes="$(merge_cors_for_shared origin_suffixes_for)"
@@ -324,7 +324,7 @@ deploy_gateway() {
   local scope worker_name route_prefix custom_domain
   local allowed_origins origin_suffixes cors_kv_id
   for scope in system tenant customer; do
-    worker_name="${APP_NAME}-${STAGE}-${scope}"
+    worker_name="${RESOURCE_NAME}-${scope}"
     route_prefix="$(route_prefix_for "$scope")"
     custom_domain="$(custom_domain_for "$scope")"
     allowed_origins="$(allowed_origins_for "$scope")"

package/lib/deploy-lambda.sh

@@ -21,11 +21,11 @@ deploy_lambda() {
   [[ -f "$LAMBDA_ASSET_DIR/index.mjs" ]] \
     || die "Prebuilt Lambda bundle missing: $LAMBDA_ASSET_DIR/index.mjs (was the package built?)"
 
-  local api_stack="${APP_NAME}-${STAGE}-api"
+  local api_stack="${RESOURCE_NAME}-api"
   OUTPUTS_FILE="${OUTPUTS_FILE:-$(mktemp -t auth-craft-cdk-outputs.XXXXXX.json)}"
   export OUTPUTS_FILE
 
-  info "Deploying CDK stacks (${APP_NAME}-${STAGE}-data, ${api_stack})…"
+  info "Deploying CDK stacks (${RESOURCE_NAME}-data, ${api_stack})…"
   (
     cd "$CDK_DIR"
     CDK_DEFAULT_ACCOUNT="$AWS_ACCOUNT_ID" \

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@auth-craft/aws-cf-stack",
-  "version": "1.7.1",
+  "version": "1.9.0",
   "description": "Self-contained, versioned distribution of the Auth Craft AWS (DynamoDB + Lambda) + Cloudflare gateway stack. Bundles prebuilt Lambda/worker artifacts + CDK app so consumers deploy without cloning auth-craft.",
   "type": "module",
   "bin": {
@@ -10,19 +10,23 @@
     "bin",
     "lib",
     "cdk",
+    "!cdk/cdk.out",
     "assets",
     "wrangler",
     "README.md",
     ".env.example"
   ],
   "dependencies": {
-    "aws-cdk-lib": "^2.260.0",
-    "constructs": "^10.6.0"
+    "aws-cdk-lib": "^2.265.0",
+    "constructs": "^10.8.1"
   },
   "devDependencies": {
-    "@types/node": "^25.9.3",
-    "tsx": "^4.22.4",
-    "typescript": "^6.0.3"
+    "@types/node": "^26.2.0",
+    "tsx": "^4.23.12",
+    "typescript": "^7.0.2",
+    "@auth-craft/auth-admin-cli": "2.0.0",
+    "@auth-craft/auth-hono-dynamodb-lambda": "1.0.0",
+    "@auth-craft/cloudflare-auth-gateway": "1.0.0"
   },
   "peerDependencies": {
     "aws-cdk": "^2.1128.0",