@augmenting-integrations/auth 4.1.0 → 4.1.1

package/dist/index.cjs

@@ -64,6 +64,7 @@ function requireGroup(session, ...names) {
 }
 function validateProdEnv(args) {
   if (!args.isProd) return;
+  if (process.env.NEXT_PHASE === "phase-production-build") return;
   const missing = [];
   if (!args.secret) missing.push("AUTH_SECRET");
   if (!args.cognitoClientId) missing.push("AUTH_COGNITO_ID");

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["// Auth.js v5 (the package is still distributed as `next-auth`, but treat\n// these as Auth.js v5 internally — docs at https://authjs.dev, NOT\n// next-auth.js.org which is v4 and incompatible).\n//\n// Subdomain ecosystem model:\n//   - One Cognito User Pool per tenant.\n//   - One Cognito App Client with ONE callback URL at the apex\n//     (https://<apex>/api/auth/callback/cognito).\n//   - The apex app is the auth broker. Subdomain apps redirect through it.\n//   - Session cookie scoped to Domain=.<apex> so every subdomain sees it.\n//   - All apps use the same createAuth() invocation; the package derives\n//     the right signInPage from appDomain + allowedParentDomain.\n//\n// Provider strategy:\n//   - Production: Cognito OIDC. cognito:groups drives session.user.groups.\n//   - Dev / preview: Credentials with a role picker, shaped to mirror\n//     Cognito's claim payload (same groups, sub, email).\n\nimport NextAuth, {\n  type DefaultSession,\n  type NextAuthConfig,\n  type Session,\n} from \"next-auth\";\nimport Credentials from \"next-auth/providers/credentials\";\nimport Cognito from \"next-auth/providers/cognito\";\n\ndeclare module \"next-auth\" {\n  interface Session {\n    user: {\n      groups: string[];\n      role: string;\n    } & DefaultSession[\"user\"];\n  }\n  interface User {\n    role?: string;\n    groups?: string[];\n  }\n}\n\nexport type CreateAuthOptions = {\n  /** Path prefixes that require an authenticated session. */\n  authedRoutePrefixes: string[];\n  /**\n   * Page to redirect to when an unauthed user hits a gated route.\n   * If omitted, derived automatically from appDomain + allowedParentDomain:\n   * apex app gets `/login`; subdomain apps get `https://<apex>/login`.\n   */\n  signInPage?: string;\n  /**\n   * Cookie Domain attribute. In subdomain ecosystems, set to the parent\n   * (e.g. `.agency.aillc.link`). Default: process.env.AUTH_COOKIE_DOMAIN.\n   * In dev (NODE_ENV !== \"production\") this is ignored — cookies stay\n   * host-only so per-port localhost apps don't collide.\n   */\n  cookieDomain?: string;\n  /**\n   * The parent domain that all subdomain apps share (e.g.\n   * `.agency.aillc.link`). The redirect callback uses this to allow\n   * post-login redirects back to any subdomain of the parent (apex or\n   * `<sub>.agency.aillc.link`). Default: process.env.AUTH_ALLOWED_PARENT_DOMAIN.\n   */\n  allowedParentDomain?: string;\n  /**\n   * This app's full FQDN (e.g. `agency.aillc.link` for the apex app, or\n   * `leads.agency.aillc.link` for a subdomain app). Used to derive the\n   * default signInPage. Default: process.env.APP_DOMAIN.\n   */\n  appDomain?: string;\n  /** Override prod/dev detection. Default reads NODE_ENV. */\n  isProd?: boolean;\n  /**\n   * The JWT signing secret. Default: process.env.AUTH_SECRET.\n   * In prod, pass this from a runtime fetch (Secrets Manager) to keep the\n   * secret out of Lambda env vars and to support rotation without redeploy.\n   */\n  secret?: string;\n  cognito?: {\n    clientId?: string;\n    clientSecret?: string;\n    issuer?: string;\n  };\n};\n\n// ----- AuthError used by requireGroup -----\n\nexport class AuthError extends Error {\n  constructor(public code: \"unauthenticated\" | \"forbidden\") {\n    super(code);\n    this.name = \"AuthError\";\n  }\n}\n\n// ----- Group/authorization helpers -----\n\n/** Returns the user's Cognito groups (always an array, possibly empty). */\nexport function getUserGroups(session: Session | null | undefined): string[] {\n  return session?.user?.groups ?? [];\n}\n\n/** Case-insensitive group membership check. */\nexport function hasGroup(session: Session | null | undefined, name: string): boolean {\n  if (!session) return false;\n  const target = name.toLowerCase();\n  return getUserGroups(session).some((g) => g.toLowerCase() === target);\n}\n\n/**\n * Throws AuthError if no session (`unauthenticated`) or if the user is in\n * none of the provided groups (`forbidden`). Pass multiple names to allow\n * any-of.\n */\nexport function requireGroup(\n  session: Session | null | undefined,\n  ...names: string[]\n): void {\n  if (!session) throw new AuthError(\"unauthenticated\");\n  if (names.length === 0) return;\n  const ok = names.some((n) => hasGroup(session, n));\n  if (!ok) throw new AuthError(\"forbidden\");\n}\n\n// ----- Env validation -----\n\nfunction validateProdEnv(args: {\n  isProd: boolean;\n  cookieDomain: string | undefined;\n  allowedParentDomain: string | undefined;\n  appDomain: string | undefined;\n  secret: string | undefined;\n  cognitoClientId: string | undefined;\n  cognitoClientSecret: string | undefined;\n  cognitoIssuer: string | undefined;\n}): void {\n  if (!args.isProd) return;\n  const missing: string[] = [];\n  if (!args.secret) missing.push(\"AUTH_SECRET\");\n  if (!args.cognitoClientId) missing.push(\"AUTH_COGNITO_ID\");\n  if (!args.cognitoClientSecret) missing.push(\"AUTH_COGNITO_SECRET\");\n  if (!args.cognitoIssuer) missing.push(\"AUTH_COGNITO_ISSUER\");\n  // Subdomain mode: if any of the three multi-domain values is set, all three must be.\n  const hasAny = !!(args.cookieDomain || args.allowedParentDomain || args.appDomain);\n  if (hasAny) {\n    if (!args.cookieDomain) missing.push(\"AUTH_COOKIE_DOMAIN\");\n    if (!args.allowedParentDomain) missing.push(\"AUTH_ALLOWED_PARENT_DOMAIN\");\n    if (!args.appDomain) missing.push(\"APP_DOMAIN\");\n  }\n  if (missing.length > 0) {\n    throw new Error(\n      `[@augmenting-integrations/auth] Missing required prod env vars: ${missing.join(\n        \", \",\n      )}. Provide via createAuth() opts or process.env.`,\n    );\n  }\n}\n\n// ----- Redirect callback factory -----\n\nfunction buildRedirectCallback(allowedParentDomain: string | undefined) {\n  return ({ url, baseUrl }: { url: string; baseUrl: string }): string => {\n    try {\n      const target = new URL(url, baseUrl);\n      if (!allowedParentDomain) {\n        return target.origin === new URL(baseUrl).origin ? target.toString() : baseUrl;\n      }\n      const apex = allowedParentDomain.replace(/^\\./, \"\").toLowerCase();\n      const host = target.hostname.toLowerCase();\n      const ok = host === apex || host.endsWith(`.${apex}`);\n      return ok ? target.toString() : baseUrl;\n    } catch {\n      return baseUrl;\n    }\n  };\n}\n\n// ----- Sign-in page auto-derivation -----\n\nfunction deriveSignInPage(args: {\n  signInPage: string | undefined;\n  appDomain: string | undefined;\n  allowedParentDomain: string | undefined;\n}): string {\n  if (args.signInPage) return args.signInPage;\n  if (args.appDomain && args.allowedParentDomain) {\n    const apex = args.allowedParentDomain.replace(/^\\./, \"\");\n    return args.appDomain === apex ? \"/login\" : `https://${apex}/login`;\n  }\n  return \"/login\";\n}\n\nfunction roleFromGroups(groups: unknown): string {\n  if (Array.isArray(groups) && groups.length > 0) {\n    return String(groups[0]).toLowerCase();\n  }\n  return \"visitor\";\n}\n\n// ----- Main factory -----\n\nexport function createAuth(opts: CreateAuthOptions) {\n  const isProd = opts.isProd ?? process.env.NODE_ENV === \"production\";\n\n  const cookieDomain = isProd\n    ? (opts.cookieDomain ?? process.env.AUTH_COOKIE_DOMAIN)\n    : undefined;\n  const allowedParentDomain =\n    opts.allowedParentDomain ?? process.env.AUTH_ALLOWED_PARENT_DOMAIN;\n  const appDomain = opts.appDomain ?? process.env.APP_DOMAIN;\n\n  const SECRET =\n    opts.secret ??\n    process.env.AUTH_SECRET ??\n    (isProd ? undefined : \"dev-only-fallback-not-for-prod\");\n  const cognitoClientId = opts.cognito?.clientId ?? process.env.AUTH_COGNITO_ID;\n  const cognitoClientSecret =\n    opts.cognito?.clientSecret ?? process.env.AUTH_COGNITO_SECRET;\n  const cognitoIssuer = opts.cognito?.issuer ?? process.env.AUTH_COGNITO_ISSUER;\n\n  validateProdEnv({\n    isProd,\n    cookieDomain,\n    allowedParentDomain,\n    appDomain,\n    secret: SECRET,\n    cognitoClientId,\n    cognitoClientSecret,\n    cognitoIssuer,\n  });\n\n  const signInPage = deriveSignInPage({\n    signInPage: opts.signInPage,\n    appDomain,\n    allowedParentDomain,\n  });\n\n  const config: NextAuthConfig = {\n    secret: SECRET,\n    cookies: cookieDomain\n      ? {\n          sessionToken: {\n            name: \"authjs.session-token\",\n            options: {\n              domain: cookieDomain,\n              sameSite: \"lax\",\n              secure: true,\n              httpOnly: true,\n              path: \"/\",\n            },\n          },\n        }\n      : undefined,\n    providers: isProd\n      ? [\n          Cognito({\n            clientId: cognitoClientId,\n            clientSecret: cognitoClientSecret,\n            issuer: cognitoIssuer,\n          }),\n        ]\n      : [\n          Credentials({\n            name: \"Mock role (dev only)\",\n            credentials: {\n              role: {\n                label: \"Role\",\n                type: \"text\",\n                placeholder: \"any role string\",\n              },\n            },\n            authorize: async (credentials) => {\n              const role = credentials?.role as string | undefined;\n              if (!role) return null;\n              const display = role.charAt(0).toUpperCase() + role.slice(1);\n              return {\n                id: `mock-${role}`,\n                name: `${display} (mock)`,\n                email: `${role}@example.local`,\n                role,\n                groups: [role],\n              };\n            },\n          }),\n        ],\n    session: { strategy: \"jwt\" },\n    callbacks: {\n      jwt: ({ token, user, profile }) => {\n        if (user) {\n          token.sub ??= user.id ?? undefined;\n          token.email ??= user.email ?? undefined;\n          if (!isProd) {\n            const u = user as { groups?: string[]; role?: string };\n            const groups = u.groups ?? (u.role ? [u.role] : []);\n            if (groups.length > 0) {\n              (token as Record<string, unknown>)[\"cognito:groups\"] = groups;\n            }\n          }\n        }\n        if (isProd && profile) {\n          const groups = (profile as Record<string, unknown>)[\"cognito:groups\"];\n          if (groups) {\n            (token as Record<string, unknown>)[\"cognito:groups\"] = groups;\n          }\n        }\n        return token;\n      },\n      session: ({ session, token }) => {\n        const groups =\n          ((token as Record<string, unknown>)[\"cognito:groups\"] as\n            | string[]\n            | undefined) ?? [];\n        session.user.groups = groups;\n        session.user.role = roleFromGroups(groups);\n        return session;\n      },\n      authorized: ({ auth: session, request: { nextUrl } }) => {\n        const path = nextUrl.pathname;\n        const isAuthedRoute = opts.authedRoutePrefixes.some(\n          (prefix) => path === prefix || path.startsWith(`${prefix}/`),\n        );\n        if (!session && isAuthedRoute) return false;\n        return true;\n      },\n      redirect: buildRedirectCallback(allowedParentDomain),\n    },\n    pages: { signIn: signInPage },\n    trustHost: true,\n  };\n\n  return NextAuth(config);\n}\n\nexport type { NextAuthConfig } from \"next-auth\";\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAkBA,uBAIO;AACP,yBAAwB;AACxB,qBAAoB;AA6Db,IAAM,YAAN,cAAwB,MAAM;AAAA,EACnC,YAAmB,MAAuC;AACxD,UAAM,IAAI;AADO;AAEjB,SAAK,OAAO;AAAA,EACd;AAAA,EAHmB;AAIrB;AAKO,SAAS,cAAc,SAA+C;AAC3E,SAAO,SAAS,MAAM,UAAU,CAAC;AACnC;AAGO,SAAS,SAAS,SAAqC,MAAuB;AACnF,MAAI,CAAC,QAAS,QAAO;AACrB,QAAM,SAAS,KAAK,YAAY;AAChC,SAAO,cAAc,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,YAAY,MAAM,MAAM;AACtE;AAOO,SAAS,aACd,YACG,OACG;AACN,MAAI,CAAC,QAAS,OAAM,IAAI,UAAU,iBAAiB;AACnD,MAAI,MAAM,WAAW,EAAG;AACxB,QAAM,KAAK,MAAM,KAAK,CAAC,MAAM,SAAS,SAAS,CAAC,CAAC;AACjD,MAAI,CAAC,GAAI,OAAM,IAAI,UAAU,WAAW;AAC1C;AAIA,SAAS,gBAAgB,MAShB;AACP,MAAI,CAAC,KAAK,OAAQ;AAClB,QAAM,UAAoB,CAAC;AAC3B,MAAI,CAAC,KAAK,OAAQ,SAAQ,KAAK,aAAa;AAC5C,MAAI,CAAC,KAAK,gBAAiB,SAAQ,KAAK,iBAAiB;AACzD,MAAI,CAAC,KAAK,oBAAqB,SAAQ,KAAK,qBAAqB;AACjE,MAAI,CAAC,KAAK,cAAe,SAAQ,KAAK,qBAAqB;AAE3D,QAAM,SAAS,CAAC,EAAE,KAAK,gBAAgB,KAAK,uBAAuB,KAAK;AACxE,MAAI,QAAQ;AACV,QAAI,CAAC,KAAK,aAAc,SAAQ,KAAK,oBAAoB;AACzD,QAAI,CAAC,KAAK,oBAAqB,SAAQ,KAAK,4BAA4B;AACxE,QAAI,CAAC,KAAK,UAAW,SAAQ,KAAK,YAAY;AAAA,EAChD;AACA,MAAI,QAAQ,SAAS,GAAG;AACtB,UAAM,IAAI;AAAA,MACR,mEAAmE,QAAQ;AAAA,QACzE;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAIA,SAAS,sBAAsB,qBAAyC;AACtE,SAAO,CAAC,EAAE,KAAK,QAAQ,MAAgD;AACrE,QAAI;AACF,YAAM,SAAS,IAAI,IAAI,KAAK,OAAO;AACnC,UAAI,CAAC,qBAAqB;AACxB,eAAO,OAAO,WAAW,IAAI,IAAI,OAAO,EAAE,SAAS,OAAO,SAAS,IAAI;AAAA,MACzE;AACA,YAAM,OAAO,oBAAoB,QAAQ,OAAO,EAAE,EAAE,YAAY;AAChE,YAAM,OAAO,OAAO,SAAS,YAAY;AACzC,YAAM,KAAK,SAAS,QAAQ,KAAK,SAAS,IAAI,IAAI,EAAE;AACpD,aAAO,KAAK,OAAO,SAAS,IAAI;AAAA,IAClC,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAIA,SAAS,iBAAiB,MAIf;AACT,MAAI,KAAK,WAAY,QAAO,KAAK;AACjC,MAAI,KAAK,aAAa,KAAK,qBAAqB;AAC9C,UAAM,OAAO,KAAK,oBAAoB,QAAQ,OAAO,EAAE;AACvD,WAAO,KAAK,cAAc,OAAO,WAAW,WAAW,IAAI;AAAA,EAC7D;AACA,SAAO;AACT;AAEA,SAAS,eAAe,QAAyB;AAC/C,MAAI,MAAM,QAAQ,MAAM,KAAK,OAAO,SAAS,GAAG;AAC9C,WAAO,OAAO,OAAO,CAAC,CAAC,EAAE,YAAY;AAAA,EACvC;AACA,SAAO;AACT;AAIO,SAAS,WAAW,MAAyB;AAClD,QAAM,SAAS,KAAK,UAAU,QAAQ,IAAI,aAAa;AAEvD,QAAM,eAAe,SAChB,KAAK,gBAAgB,QAAQ,IAAI,qBAClC;AACJ,QAAM,sBACJ,KAAK,uBAAuB,QAAQ,IAAI;AAC1C,QAAM,YAAY,KAAK,aAAa,QAAQ,IAAI;AAEhD,QAAM,SACJ,KAAK,UACL,QAAQ,IAAI,gBACX,SAAS,SAAY;AACxB,QAAM,kBAAkB,KAAK,SAAS,YAAY,QAAQ,IAAI;AAC9D,QAAM,sBACJ,KAAK,SAAS,gBAAgB,QAAQ,IAAI;AAC5C,QAAM,gBAAgB,KAAK,SAAS,UAAU,QAAQ,IAAI;AAE1D,kBAAgB;AAAA,IACd;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,IACR;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAED,QAAM,aAAa,iBAAiB;AAAA,IAClC,YAAY,KAAK;AAAA,IACjB;AAAA,IACA;AAAA,EACF,CAAC;AAED,QAAM,SAAyB;AAAA,IAC7B,QAAQ;AAAA,IACR,SAAS,eACL;AAAA,MACE,cAAc;AAAA,QACZ,MAAM;AAAA,QACN,SAAS;AAAA,UACP,QAAQ;AAAA,UACR,UAAU;AAAA,UACV,QAAQ;AAAA,UACR,UAAU;AAAA,UACV,MAAM;AAAA,QACR;AAAA,MACF;AAAA,IACF,IACA;AAAA,IACJ,WAAW,SACP;AAAA,UACE,eAAAA,SAAQ;AAAA,QACN,UAAU;AAAA,QACV,cAAc;AAAA,QACd,QAAQ;AAAA,MACV,CAAC;AAAA,IACH,IACA;AAAA,UACE,mBAAAC,SAAY;AAAA,QACV,MAAM;AAAA,QACN,aAAa;AAAA,UACX,MAAM;AAAA,YACJ,OAAO;AAAA,YACP,MAAM;AAAA,YACN,aAAa;AAAA,UACf;AAAA,QACF;AAAA,QACA,WAAW,OAAO,gBAAgB;AAChC,gBAAM,OAAO,aAAa;AAC1B,cAAI,CAAC,KAAM,QAAO;AAClB,gBAAM,UAAU,KAAK,OAAO,CAAC,EAAE,YAAY,IAAI,KAAK,MAAM,CAAC;AAC3D,iBAAO;AAAA,YACL,IAAI,QAAQ,IAAI;AAAA,YAChB,MAAM,GAAG,OAAO;AAAA,YAChB,OAAO,GAAG,IAAI;AAAA,YACd;AAAA,YACA,QAAQ,CAAC,IAAI;AAAA,UACf;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH;AAAA,IACJ,SAAS,EAAE,UAAU,MAAM;AAAA,IAC3B,WAAW;AAAA,MACT,KAAK,CAAC,EAAE,OAAO,MAAM,QAAQ,MAAM;AACjC,YAAI,MAAM;AACR,gBAAM,QAAQ,KAAK,MAAM;AACzB,gBAAM,UAAU,KAAK,SAAS;AAC9B,cAAI,CAAC,QAAQ;AACX,kBAAM,IAAI;AACV,kBAAM,SAAS,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,IAAI,IAAI,CAAC;AACjD,gBAAI,OAAO,SAAS,GAAG;AACrB,cAAC,MAAkC,gBAAgB,IAAI;AAAA,YACzD;AAAA,UACF;AAAA,QACF;AACA,YAAI,UAAU,SAAS;AACrB,gBAAM,SAAU,QAAoC,gBAAgB;AACpE,cAAI,QAAQ;AACV,YAAC,MAAkC,gBAAgB,IAAI;AAAA,UACzD;AAAA,QACF;AACA,eAAO;AAAA,MACT;AAAA,MACA,SAAS,CAAC,EAAE,SAAS,MAAM,MAAM;AAC/B,cAAM,SACF,MAAkC,gBAAgB,KAElC,CAAC;AACrB,gBAAQ,KAAK,SAAS;AACtB,gBAAQ,KAAK,OAAO,eAAe,MAAM;AACzC,eAAO;AAAA,MACT;AAAA,MACA,YAAY,CAAC,EAAE,MAAM,SAAS,SAAS,EAAE,QAAQ,EAAE,MAAM;AACvD,cAAM,OAAO,QAAQ;AACrB,cAAM,gBAAgB,KAAK,oBAAoB;AAAA,UAC7C,CAAC,WAAW,SAAS,UAAU,KAAK,WAAW,GAAG,MAAM,GAAG;AAAA,QAC7D;AACA,YAAI,CAAC,WAAW,cAAe,QAAO;AACtC,eAAO;AAAA,MACT;AAAA,MACA,UAAU,sBAAsB,mBAAmB;AAAA,IACrD;AAAA,IACA,OAAO,EAAE,QAAQ,WAAW;AAAA,IAC5B,WAAW;AAAA,EACb;AAEA,aAAO,iBAAAC,SAAS,MAAM;AACxB;","names":["Cognito","Credentials","NextAuth"]}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["// Auth.js v5 (the package is still distributed as `next-auth`, but treat\n// these as Auth.js v5 internally — docs at https://authjs.dev, NOT\n// next-auth.js.org which is v4 and incompatible).\n//\n// Subdomain ecosystem model:\n//   - One Cognito User Pool per tenant.\n//   - One Cognito App Client with ONE callback URL at the apex\n//     (https://<apex>/api/auth/callback/cognito).\n//   - The apex app is the auth broker. Subdomain apps redirect through it.\n//   - Session cookie scoped to Domain=.<apex> so every subdomain sees it.\n//   - All apps use the same createAuth() invocation; the package derives\n//     the right signInPage from appDomain + allowedParentDomain.\n//\n// Provider strategy:\n//   - Production: Cognito OIDC. cognito:groups drives session.user.groups.\n//   - Dev / preview: Credentials with a role picker, shaped to mirror\n//     Cognito's claim payload (same groups, sub, email).\n\nimport NextAuth, {\n  type DefaultSession,\n  type NextAuthConfig,\n  type Session,\n} from \"next-auth\";\nimport Credentials from \"next-auth/providers/credentials\";\nimport Cognito from \"next-auth/providers/cognito\";\n\ndeclare module \"next-auth\" {\n  interface Session {\n    user: {\n      groups: string[];\n      role: string;\n    } & DefaultSession[\"user\"];\n  }\n  interface User {\n    role?: string;\n    groups?: string[];\n  }\n}\n\nexport type CreateAuthOptions = {\n  /** Path prefixes that require an authenticated session. */\n  authedRoutePrefixes: string[];\n  /**\n   * Page to redirect to when an unauthed user hits a gated route.\n   * If omitted, derived automatically from appDomain + allowedParentDomain:\n   * apex app gets `/login`; subdomain apps get `https://<apex>/login`.\n   */\n  signInPage?: string;\n  /**\n   * Cookie Domain attribute. In subdomain ecosystems, set to the parent\n   * (e.g. `.agency.aillc.link`). Default: process.env.AUTH_COOKIE_DOMAIN.\n   * In dev (NODE_ENV !== \"production\") this is ignored — cookies stay\n   * host-only so per-port localhost apps don't collide.\n   */\n  cookieDomain?: string;\n  /**\n   * The parent domain that all subdomain apps share (e.g.\n   * `.agency.aillc.link`). The redirect callback uses this to allow\n   * post-login redirects back to any subdomain of the parent (apex or\n   * `<sub>.agency.aillc.link`). Default: process.env.AUTH_ALLOWED_PARENT_DOMAIN.\n   */\n  allowedParentDomain?: string;\n  /**\n   * This app's full FQDN (e.g. `agency.aillc.link` for the apex app, or\n   * `leads.agency.aillc.link` for a subdomain app). Used to derive the\n   * default signInPage. Default: process.env.APP_DOMAIN.\n   */\n  appDomain?: string;\n  /** Override prod/dev detection. Default reads NODE_ENV. */\n  isProd?: boolean;\n  /**\n   * The JWT signing secret. Default: process.env.AUTH_SECRET.\n   * In prod, pass this from a runtime fetch (Secrets Manager) to keep the\n   * secret out of Lambda env vars and to support rotation without redeploy.\n   */\n  secret?: string;\n  cognito?: {\n    clientId?: string;\n    clientSecret?: string;\n    issuer?: string;\n  };\n};\n\n// ----- AuthError used by requireGroup -----\n\nexport class AuthError extends Error {\n  constructor(public code: \"unauthenticated\" | \"forbidden\") {\n    super(code);\n    this.name = \"AuthError\";\n  }\n}\n\n// ----- Group/authorization helpers -----\n\n/** Returns the user's Cognito groups (always an array, possibly empty). */\nexport function getUserGroups(session: Session | null | undefined): string[] {\n  return session?.user?.groups ?? [];\n}\n\n/** Case-insensitive group membership check. */\nexport function hasGroup(session: Session | null | undefined, name: string): boolean {\n  if (!session) return false;\n  const target = name.toLowerCase();\n  return getUserGroups(session).some((g) => g.toLowerCase() === target);\n}\n\n/**\n * Throws AuthError if no session (`unauthenticated`) or if the user is in\n * none of the provided groups (`forbidden`). Pass multiple names to allow\n * any-of.\n */\nexport function requireGroup(\n  session: Session | null | undefined,\n  ...names: string[]\n): void {\n  if (!session) throw new AuthError(\"unauthenticated\");\n  if (names.length === 0) return;\n  const ok = names.some((n) => hasGroup(session, n));\n  if (!ok) throw new AuthError(\"forbidden\");\n}\n\n// ----- Env validation -----\n\nfunction validateProdEnv(args: {\n  isProd: boolean;\n  cookieDomain: string | undefined;\n  allowedParentDomain: string | undefined;\n  appDomain: string | undefined;\n  secret: string | undefined;\n  cognitoClientId: string | undefined;\n  cognitoClientSecret: string | undefined;\n  cognitoIssuer: string | undefined;\n}): void {\n  if (!args.isProd) return;\n  // Skip during `next build` -- Cognito values come from SSM dynamic\n  // refs and Secrets Manager at runtime in the deployed Lambda. Build\n  // time only needs to compile route handlers; throwing here breaks\n  // the build with no actionable fix (the values literally don't exist\n  // yet at build time).\n  if (process.env.NEXT_PHASE === \"phase-production-build\") return;\n  const missing: string[] = [];\n  if (!args.secret) missing.push(\"AUTH_SECRET\");\n  if (!args.cognitoClientId) missing.push(\"AUTH_COGNITO_ID\");\n  if (!args.cognitoClientSecret) missing.push(\"AUTH_COGNITO_SECRET\");\n  if (!args.cognitoIssuer) missing.push(\"AUTH_COGNITO_ISSUER\");\n  // Subdomain mode: if any of the three multi-domain values is set, all three must be.\n  const hasAny = !!(args.cookieDomain || args.allowedParentDomain || args.appDomain);\n  if (hasAny) {\n    if (!args.cookieDomain) missing.push(\"AUTH_COOKIE_DOMAIN\");\n    if (!args.allowedParentDomain) missing.push(\"AUTH_ALLOWED_PARENT_DOMAIN\");\n    if (!args.appDomain) missing.push(\"APP_DOMAIN\");\n  }\n  if (missing.length > 0) {\n    throw new Error(\n      `[@augmenting-integrations/auth] Missing required prod env vars: ${missing.join(\n        \", \",\n      )}. Provide via createAuth() opts or process.env.`,\n    );\n  }\n}\n\n// ----- Redirect callback factory -----\n\nfunction buildRedirectCallback(allowedParentDomain: string | undefined) {\n  return ({ url, baseUrl }: { url: string; baseUrl: string }): string => {\n    try {\n      const target = new URL(url, baseUrl);\n      if (!allowedParentDomain) {\n        return target.origin === new URL(baseUrl).origin ? target.toString() : baseUrl;\n      }\n      const apex = allowedParentDomain.replace(/^\\./, \"\").toLowerCase();\n      const host = target.hostname.toLowerCase();\n      const ok = host === apex || host.endsWith(`.${apex}`);\n      return ok ? target.toString() : baseUrl;\n    } catch {\n      return baseUrl;\n    }\n  };\n}\n\n// ----- Sign-in page auto-derivation -----\n\nfunction deriveSignInPage(args: {\n  signInPage: string | undefined;\n  appDomain: string | undefined;\n  allowedParentDomain: string | undefined;\n}): string {\n  if (args.signInPage) return args.signInPage;\n  if (args.appDomain && args.allowedParentDomain) {\n    const apex = args.allowedParentDomain.replace(/^\\./, \"\");\n    return args.appDomain === apex ? \"/login\" : `https://${apex}/login`;\n  }\n  return \"/login\";\n}\n\nfunction roleFromGroups(groups: unknown): string {\n  if (Array.isArray(groups) && groups.length > 0) {\n    return String(groups[0]).toLowerCase();\n  }\n  return \"visitor\";\n}\n\n// ----- Main factory -----\n\nexport function createAuth(opts: CreateAuthOptions) {\n  const isProd = opts.isProd ?? process.env.NODE_ENV === \"production\";\n\n  const cookieDomain = isProd\n    ? (opts.cookieDomain ?? process.env.AUTH_COOKIE_DOMAIN)\n    : undefined;\n  const allowedParentDomain =\n    opts.allowedParentDomain ?? process.env.AUTH_ALLOWED_PARENT_DOMAIN;\n  const appDomain = opts.appDomain ?? process.env.APP_DOMAIN;\n\n  const SECRET =\n    opts.secret ??\n    process.env.AUTH_SECRET ??\n    (isProd ? undefined : \"dev-only-fallback-not-for-prod\");\n  const cognitoClientId = opts.cognito?.clientId ?? process.env.AUTH_COGNITO_ID;\n  const cognitoClientSecret =\n    opts.cognito?.clientSecret ?? process.env.AUTH_COGNITO_SECRET;\n  const cognitoIssuer = opts.cognito?.issuer ?? process.env.AUTH_COGNITO_ISSUER;\n\n  validateProdEnv({\n    isProd,\n    cookieDomain,\n    allowedParentDomain,\n    appDomain,\n    secret: SECRET,\n    cognitoClientId,\n    cognitoClientSecret,\n    cognitoIssuer,\n  });\n\n  const signInPage = deriveSignInPage({\n    signInPage: opts.signInPage,\n    appDomain,\n    allowedParentDomain,\n  });\n\n  const config: NextAuthConfig = {\n    secret: SECRET,\n    cookies: cookieDomain\n      ? {\n          sessionToken: {\n            name: \"authjs.session-token\",\n            options: {\n              domain: cookieDomain,\n              sameSite: \"lax\",\n              secure: true,\n              httpOnly: true,\n              path: \"/\",\n            },\n          },\n        }\n      : undefined,\n    providers: isProd\n      ? [\n          Cognito({\n            clientId: cognitoClientId,\n            clientSecret: cognitoClientSecret,\n            issuer: cognitoIssuer,\n          }),\n        ]\n      : [\n          Credentials({\n            name: \"Mock role (dev only)\",\n            credentials: {\n              role: {\n                label: \"Role\",\n                type: \"text\",\n                placeholder: \"any role string\",\n              },\n            },\n            authorize: async (credentials) => {\n              const role = credentials?.role as string | undefined;\n              if (!role) return null;\n              const display = role.charAt(0).toUpperCase() + role.slice(1);\n              return {\n                id: `mock-${role}`,\n                name: `${display} (mock)`,\n                email: `${role}@example.local`,\n                role,\n                groups: [role],\n              };\n            },\n          }),\n        ],\n    session: { strategy: \"jwt\" },\n    callbacks: {\n      jwt: ({ token, user, profile }) => {\n        if (user) {\n          token.sub ??= user.id ?? undefined;\n          token.email ??= user.email ?? undefined;\n          if (!isProd) {\n            const u = user as { groups?: string[]; role?: string };\n            const groups = u.groups ?? (u.role ? [u.role] : []);\n            if (groups.length > 0) {\n              (token as Record<string, unknown>)[\"cognito:groups\"] = groups;\n            }\n          }\n        }\n        if (isProd && profile) {\n          const groups = (profile as Record<string, unknown>)[\"cognito:groups\"];\n          if (groups) {\n            (token as Record<string, unknown>)[\"cognito:groups\"] = groups;\n          }\n        }\n        return token;\n      },\n      session: ({ session, token }) => {\n        const groups =\n          ((token as Record<string, unknown>)[\"cognito:groups\"] as\n            | string[]\n            | undefined) ?? [];\n        session.user.groups = groups;\n        session.user.role = roleFromGroups(groups);\n        return session;\n      },\n      authorized: ({ auth: session, request: { nextUrl } }) => {\n        const path = nextUrl.pathname;\n        const isAuthedRoute = opts.authedRoutePrefixes.some(\n          (prefix) => path === prefix || path.startsWith(`${prefix}/`),\n        );\n        if (!session && isAuthedRoute) return false;\n        return true;\n      },\n      redirect: buildRedirectCallback(allowedParentDomain),\n    },\n    pages: { signIn: signInPage },\n    trustHost: true,\n  };\n\n  return NextAuth(config);\n}\n\nexport type { NextAuthConfig } from \"next-auth\";\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAkBA,uBAIO;AACP,yBAAwB;AACxB,qBAAoB;AA6Db,IAAM,YAAN,cAAwB,MAAM;AAAA,EACnC,YAAmB,MAAuC;AACxD,UAAM,IAAI;AADO;AAEjB,SAAK,OAAO;AAAA,EACd;AAAA,EAHmB;AAIrB;AAKO,SAAS,cAAc,SAA+C;AAC3E,SAAO,SAAS,MAAM,UAAU,CAAC;AACnC;AAGO,SAAS,SAAS,SAAqC,MAAuB;AACnF,MAAI,CAAC,QAAS,QAAO;AACrB,QAAM,SAAS,KAAK,YAAY;AAChC,SAAO,cAAc,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,YAAY,MAAM,MAAM;AACtE;AAOO,SAAS,aACd,YACG,OACG;AACN,MAAI,CAAC,QAAS,OAAM,IAAI,UAAU,iBAAiB;AACnD,MAAI,MAAM,WAAW,EAAG;AACxB,QAAM,KAAK,MAAM,KAAK,CAAC,MAAM,SAAS,SAAS,CAAC,CAAC;AACjD,MAAI,CAAC,GAAI,OAAM,IAAI,UAAU,WAAW;AAC1C;AAIA,SAAS,gBAAgB,MAShB;AACP,MAAI,CAAC,KAAK,OAAQ;AAMlB,MAAI,QAAQ,IAAI,eAAe,yBAA0B;AACzD,QAAM,UAAoB,CAAC;AAC3B,MAAI,CAAC,KAAK,OAAQ,SAAQ,KAAK,aAAa;AAC5C,MAAI,CAAC,KAAK,gBAAiB,SAAQ,KAAK,iBAAiB;AACzD,MAAI,CAAC,KAAK,oBAAqB,SAAQ,KAAK,qBAAqB;AACjE,MAAI,CAAC,KAAK,cAAe,SAAQ,KAAK,qBAAqB;AAE3D,QAAM,SAAS,CAAC,EAAE,KAAK,gBAAgB,KAAK,uBAAuB,KAAK;AACxE,MAAI,QAAQ;AACV,QAAI,CAAC,KAAK,aAAc,SAAQ,KAAK,oBAAoB;AACzD,QAAI,CAAC,KAAK,oBAAqB,SAAQ,KAAK,4BAA4B;AACxE,QAAI,CAAC,KAAK,UAAW,SAAQ,KAAK,YAAY;AAAA,EAChD;AACA,MAAI,QAAQ,SAAS,GAAG;AACtB,UAAM,IAAI;AAAA,MACR,mEAAmE,QAAQ;AAAA,QACzE;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAIA,SAAS,sBAAsB,qBAAyC;AACtE,SAAO,CAAC,EAAE,KAAK,QAAQ,MAAgD;AACrE,QAAI;AACF,YAAM,SAAS,IAAI,IAAI,KAAK,OAAO;AACnC,UAAI,CAAC,qBAAqB;AACxB,eAAO,OAAO,WAAW,IAAI,IAAI,OAAO,EAAE,SAAS,OAAO,SAAS,IAAI;AAAA,MACzE;AACA,YAAM,OAAO,oBAAoB,QAAQ,OAAO,EAAE,EAAE,YAAY;AAChE,YAAM,OAAO,OAAO,SAAS,YAAY;AACzC,YAAM,KAAK,SAAS,QAAQ,KAAK,SAAS,IAAI,IAAI,EAAE;AACpD,aAAO,KAAK,OAAO,SAAS,IAAI;AAAA,IAClC,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAIA,SAAS,iBAAiB,MAIf;AACT,MAAI,KAAK,WAAY,QAAO,KAAK;AACjC,MAAI,KAAK,aAAa,KAAK,qBAAqB;AAC9C,UAAM,OAAO,KAAK,oBAAoB,QAAQ,OAAO,EAAE;AACvD,WAAO,KAAK,cAAc,OAAO,WAAW,WAAW,IAAI;AAAA,EAC7D;AACA,SAAO;AACT;AAEA,SAAS,eAAe,QAAyB;AAC/C,MAAI,MAAM,QAAQ,MAAM,KAAK,OAAO,SAAS,GAAG;AAC9C,WAAO,OAAO,OAAO,CAAC,CAAC,EAAE,YAAY;AAAA,EACvC;AACA,SAAO;AACT;AAIO,SAAS,WAAW,MAAyB;AAClD,QAAM,SAAS,KAAK,UAAU,QAAQ,IAAI,aAAa;AAEvD,QAAM,eAAe,SAChB,KAAK,gBAAgB,QAAQ,IAAI,qBAClC;AACJ,QAAM,sBACJ,KAAK,uBAAuB,QAAQ,IAAI;AAC1C,QAAM,YAAY,KAAK,aAAa,QAAQ,IAAI;AAEhD,QAAM,SACJ,KAAK,UACL,QAAQ,IAAI,gBACX,SAAS,SAAY;AACxB,QAAM,kBAAkB,KAAK,SAAS,YAAY,QAAQ,IAAI;AAC9D,QAAM,sBACJ,KAAK,SAAS,gBAAgB,QAAQ,IAAI;AAC5C,QAAM,gBAAgB,KAAK,SAAS,UAAU,QAAQ,IAAI;AAE1D,kBAAgB;AAAA,IACd;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,IACR;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAED,QAAM,aAAa,iBAAiB;AAAA,IAClC,YAAY,KAAK;AAAA,IACjB;AAAA,IACA;AAAA,EACF,CAAC;AAED,QAAM,SAAyB;AAAA,IAC7B,QAAQ;AAAA,IACR,SAAS,eACL;AAAA,MACE,cAAc;AAAA,QACZ,MAAM;AAAA,QACN,SAAS;AAAA,UACP,QAAQ;AAAA,UACR,UAAU;AAAA,UACV,QAAQ;AAAA,UACR,UAAU;AAAA,UACV,MAAM;AAAA,QACR;AAAA,MACF;AAAA,IACF,IACA;AAAA,IACJ,WAAW,SACP;AAAA,UACE,eAAAA,SAAQ;AAAA,QACN,UAAU;AAAA,QACV,cAAc;AAAA,QACd,QAAQ;AAAA,MACV,CAAC;AAAA,IACH,IACA;AAAA,UACE,mBAAAC,SAAY;AAAA,QACV,MAAM;AAAA,QACN,aAAa;AAAA,UACX,MAAM;AAAA,YACJ,OAAO;AAAA,YACP,MAAM;AAAA,YACN,aAAa;AAAA,UACf;AAAA,QACF;AAAA,QACA,WAAW,OAAO,gBAAgB;AAChC,gBAAM,OAAO,aAAa;AAC1B,cAAI,CAAC,KAAM,QAAO;AAClB,gBAAM,UAAU,KAAK,OAAO,CAAC,EAAE,YAAY,IAAI,KAAK,MAAM,CAAC;AAC3D,iBAAO;AAAA,YACL,IAAI,QAAQ,IAAI;AAAA,YAChB,MAAM,GAAG,OAAO;AAAA,YAChB,OAAO,GAAG,IAAI;AAAA,YACd;AAAA,YACA,QAAQ,CAAC,IAAI;AAAA,UACf;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH;AAAA,IACJ,SAAS,EAAE,UAAU,MAAM;AAAA,IAC3B,WAAW;AAAA,MACT,KAAK,CAAC,EAAE,OAAO,MAAM,QAAQ,MAAM;AACjC,YAAI,MAAM;AACR,gBAAM,QAAQ,KAAK,MAAM;AACzB,gBAAM,UAAU,KAAK,SAAS;AAC9B,cAAI,CAAC,QAAQ;AACX,kBAAM,IAAI;AACV,kBAAM,SAAS,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,IAAI,IAAI,CAAC;AACjD,gBAAI,OAAO,SAAS,GAAG;AACrB,cAAC,MAAkC,gBAAgB,IAAI;AAAA,YACzD;AAAA,UACF;AAAA,QACF;AACA,YAAI,UAAU,SAAS;AACrB,gBAAM,SAAU,QAAoC,gBAAgB;AACpE,cAAI,QAAQ;AACV,YAAC,MAAkC,gBAAgB,IAAI;AAAA,UACzD;AAAA,QACF;AACA,eAAO;AAAA,MACT;AAAA,MACA,SAAS,CAAC,EAAE,SAAS,MAAM,MAAM;AAC/B,cAAM,SACF,MAAkC,gBAAgB,KAElC,CAAC;AACrB,gBAAQ,KAAK,SAAS;AACtB,gBAAQ,KAAK,OAAO,eAAe,MAAM;AACzC,eAAO;AAAA,MACT;AAAA,MACA,YAAY,CAAC,EAAE,MAAM,SAAS,SAAS,EAAE,QAAQ,EAAE,MAAM;AACvD,cAAM,OAAO,QAAQ;AACrB,cAAM,gBAAgB,KAAK,oBAAoB;AAAA,UAC7C,CAAC,WAAW,SAAS,UAAU,KAAK,WAAW,GAAG,MAAM,GAAG;AAAA,QAC7D;AACA,YAAI,CAAC,WAAW,cAAe,QAAO;AACtC,eAAO;AAAA,MACT;AAAA,MACA,UAAU,sBAAsB,mBAAmB;AAAA,IACrD;AAAA,IACA,OAAO,EAAE,QAAQ,WAAW;AAAA,IAC5B,WAAW;AAAA,EACb;AAEA,aAAO,iBAAAC,SAAS,MAAM;AACxB;","names":["Cognito","Credentials","NextAuth"]}

package/dist/index.js

@@ -26,6 +26,7 @@ function requireGroup(session, ...names) {
 }
 function validateProdEnv(args) {
   if (!args.isProd) return;
+  if (process.env.NEXT_PHASE === "phase-production-build") return;
   const missing = [];
   if (!args.secret) missing.push("AUTH_SECRET");
   if (!args.cognitoClientId) missing.push("AUTH_COGNITO_ID");

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["// Auth.js v5 (the package is still distributed as `next-auth`, but treat\n// these as Auth.js v5 internally — docs at https://authjs.dev, NOT\n// next-auth.js.org which is v4 and incompatible).\n//\n// Subdomain ecosystem model:\n//   - One Cognito User Pool per tenant.\n//   - One Cognito App Client with ONE callback URL at the apex\n//     (https://<apex>/api/auth/callback/cognito).\n//   - The apex app is the auth broker. Subdomain apps redirect through it.\n//   - Session cookie scoped to Domain=.<apex> so every subdomain sees it.\n//   - All apps use the same createAuth() invocation; the package derives\n//     the right signInPage from appDomain + allowedParentDomain.\n//\n// Provider strategy:\n//   - Production: Cognito OIDC. cognito:groups drives session.user.groups.\n//   - Dev / preview: Credentials with a role picker, shaped to mirror\n//     Cognito's claim payload (same groups, sub, email).\n\nimport NextAuth, {\n  type DefaultSession,\n  type NextAuthConfig,\n  type Session,\n} from \"next-auth\";\nimport Credentials from \"next-auth/providers/credentials\";\nimport Cognito from \"next-auth/providers/cognito\";\n\ndeclare module \"next-auth\" {\n  interface Session {\n    user: {\n      groups: string[];\n      role: string;\n    } & DefaultSession[\"user\"];\n  }\n  interface User {\n    role?: string;\n    groups?: string[];\n  }\n}\n\nexport type CreateAuthOptions = {\n  /** Path prefixes that require an authenticated session. */\n  authedRoutePrefixes: string[];\n  /**\n   * Page to redirect to when an unauthed user hits a gated route.\n   * If omitted, derived automatically from appDomain + allowedParentDomain:\n   * apex app gets `/login`; subdomain apps get `https://<apex>/login`.\n   */\n  signInPage?: string;\n  /**\n   * Cookie Domain attribute. In subdomain ecosystems, set to the parent\n   * (e.g. `.agency.aillc.link`). Default: process.env.AUTH_COOKIE_DOMAIN.\n   * In dev (NODE_ENV !== \"production\") this is ignored — cookies stay\n   * host-only so per-port localhost apps don't collide.\n   */\n  cookieDomain?: string;\n  /**\n   * The parent domain that all subdomain apps share (e.g.\n   * `.agency.aillc.link`). The redirect callback uses this to allow\n   * post-login redirects back to any subdomain of the parent (apex or\n   * `<sub>.agency.aillc.link`). Default: process.env.AUTH_ALLOWED_PARENT_DOMAIN.\n   */\n  allowedParentDomain?: string;\n  /**\n   * This app's full FQDN (e.g. `agency.aillc.link` for the apex app, or\n   * `leads.agency.aillc.link` for a subdomain app). Used to derive the\n   * default signInPage. Default: process.env.APP_DOMAIN.\n   */\n  appDomain?: string;\n  /** Override prod/dev detection. Default reads NODE_ENV. */\n  isProd?: boolean;\n  /**\n   * The JWT signing secret. Default: process.env.AUTH_SECRET.\n   * In prod, pass this from a runtime fetch (Secrets Manager) to keep the\n   * secret out of Lambda env vars and to support rotation without redeploy.\n   */\n  secret?: string;\n  cognito?: {\n    clientId?: string;\n    clientSecret?: string;\n    issuer?: string;\n  };\n};\n\n// ----- AuthError used by requireGroup -----\n\nexport class AuthError extends Error {\n  constructor(public code: \"unauthenticated\" | \"forbidden\") {\n    super(code);\n    this.name = \"AuthError\";\n  }\n}\n\n// ----- Group/authorization helpers -----\n\n/** Returns the user's Cognito groups (always an array, possibly empty). */\nexport function getUserGroups(session: Session | null | undefined): string[] {\n  return session?.user?.groups ?? [];\n}\n\n/** Case-insensitive group membership check. */\nexport function hasGroup(session: Session | null | undefined, name: string): boolean {\n  if (!session) return false;\n  const target = name.toLowerCase();\n  return getUserGroups(session).some((g) => g.toLowerCase() === target);\n}\n\n/**\n * Throws AuthError if no session (`unauthenticated`) or if the user is in\n * none of the provided groups (`forbidden`). Pass multiple names to allow\n * any-of.\n */\nexport function requireGroup(\n  session: Session | null | undefined,\n  ...names: string[]\n): void {\n  if (!session) throw new AuthError(\"unauthenticated\");\n  if (names.length === 0) return;\n  const ok = names.some((n) => hasGroup(session, n));\n  if (!ok) throw new AuthError(\"forbidden\");\n}\n\n// ----- Env validation -----\n\nfunction validateProdEnv(args: {\n  isProd: boolean;\n  cookieDomain: string | undefined;\n  allowedParentDomain: string | undefined;\n  appDomain: string | undefined;\n  secret: string | undefined;\n  cognitoClientId: string | undefined;\n  cognitoClientSecret: string | undefined;\n  cognitoIssuer: string | undefined;\n}): void {\n  if (!args.isProd) return;\n  const missing: string[] = [];\n  if (!args.secret) missing.push(\"AUTH_SECRET\");\n  if (!args.cognitoClientId) missing.push(\"AUTH_COGNITO_ID\");\n  if (!args.cognitoClientSecret) missing.push(\"AUTH_COGNITO_SECRET\");\n  if (!args.cognitoIssuer) missing.push(\"AUTH_COGNITO_ISSUER\");\n  // Subdomain mode: if any of the three multi-domain values is set, all three must be.\n  const hasAny = !!(args.cookieDomain || args.allowedParentDomain || args.appDomain);\n  if (hasAny) {\n    if (!args.cookieDomain) missing.push(\"AUTH_COOKIE_DOMAIN\");\n    if (!args.allowedParentDomain) missing.push(\"AUTH_ALLOWED_PARENT_DOMAIN\");\n    if (!args.appDomain) missing.push(\"APP_DOMAIN\");\n  }\n  if (missing.length > 0) {\n    throw new Error(\n      `[@augmenting-integrations/auth] Missing required prod env vars: ${missing.join(\n        \", \",\n      )}. Provide via createAuth() opts or process.env.`,\n    );\n  }\n}\n\n// ----- Redirect callback factory -----\n\nfunction buildRedirectCallback(allowedParentDomain: string | undefined) {\n  return ({ url, baseUrl }: { url: string; baseUrl: string }): string => {\n    try {\n      const target = new URL(url, baseUrl);\n      if (!allowedParentDomain) {\n        return target.origin === new URL(baseUrl).origin ? target.toString() : baseUrl;\n      }\n      const apex = allowedParentDomain.replace(/^\\./, \"\").toLowerCase();\n      const host = target.hostname.toLowerCase();\n      const ok = host === apex || host.endsWith(`.${apex}`);\n      return ok ? target.toString() : baseUrl;\n    } catch {\n      return baseUrl;\n    }\n  };\n}\n\n// ----- Sign-in page auto-derivation -----\n\nfunction deriveSignInPage(args: {\n  signInPage: string | undefined;\n  appDomain: string | undefined;\n  allowedParentDomain: string | undefined;\n}): string {\n  if (args.signInPage) return args.signInPage;\n  if (args.appDomain && args.allowedParentDomain) {\n    const apex = args.allowedParentDomain.replace(/^\\./, \"\");\n    return args.appDomain === apex ? \"/login\" : `https://${apex}/login`;\n  }\n  return \"/login\";\n}\n\nfunction roleFromGroups(groups: unknown): string {\n  if (Array.isArray(groups) && groups.length > 0) {\n    return String(groups[0]).toLowerCase();\n  }\n  return \"visitor\";\n}\n\n// ----- Main factory -----\n\nexport function createAuth(opts: CreateAuthOptions) {\n  const isProd = opts.isProd ?? process.env.NODE_ENV === \"production\";\n\n  const cookieDomain = isProd\n    ? (opts.cookieDomain ?? process.env.AUTH_COOKIE_DOMAIN)\n    : undefined;\n  const allowedParentDomain =\n    opts.allowedParentDomain ?? process.env.AUTH_ALLOWED_PARENT_DOMAIN;\n  const appDomain = opts.appDomain ?? process.env.APP_DOMAIN;\n\n  const SECRET =\n    opts.secret ??\n    process.env.AUTH_SECRET ??\n    (isProd ? undefined : \"dev-only-fallback-not-for-prod\");\n  const cognitoClientId = opts.cognito?.clientId ?? process.env.AUTH_COGNITO_ID;\n  const cognitoClientSecret =\n    opts.cognito?.clientSecret ?? process.env.AUTH_COGNITO_SECRET;\n  const cognitoIssuer = opts.cognito?.issuer ?? process.env.AUTH_COGNITO_ISSUER;\n\n  validateProdEnv({\n    isProd,\n    cookieDomain,\n    allowedParentDomain,\n    appDomain,\n    secret: SECRET,\n    cognitoClientId,\n    cognitoClientSecret,\n    cognitoIssuer,\n  });\n\n  const signInPage = deriveSignInPage({\n    signInPage: opts.signInPage,\n    appDomain,\n    allowedParentDomain,\n  });\n\n  const config: NextAuthConfig = {\n    secret: SECRET,\n    cookies: cookieDomain\n      ? {\n          sessionToken: {\n            name: \"authjs.session-token\",\n            options: {\n              domain: cookieDomain,\n              sameSite: \"lax\",\n              secure: true,\n              httpOnly: true,\n              path: \"/\",\n            },\n          },\n        }\n      : undefined,\n    providers: isProd\n      ? [\n          Cognito({\n            clientId: cognitoClientId,\n            clientSecret: cognitoClientSecret,\n            issuer: cognitoIssuer,\n          }),\n        ]\n      : [\n          Credentials({\n            name: \"Mock role (dev only)\",\n            credentials: {\n              role: {\n                label: \"Role\",\n                type: \"text\",\n                placeholder: \"any role string\",\n              },\n            },\n            authorize: async (credentials) => {\n              const role = credentials?.role as string | undefined;\n              if (!role) return null;\n              const display = role.charAt(0).toUpperCase() + role.slice(1);\n              return {\n                id: `mock-${role}`,\n                name: `${display} (mock)`,\n                email: `${role}@example.local`,\n                role,\n                groups: [role],\n              };\n            },\n          }),\n        ],\n    session: { strategy: \"jwt\" },\n    callbacks: {\n      jwt: ({ token, user, profile }) => {\n        if (user) {\n          token.sub ??= user.id ?? undefined;\n          token.email ??= user.email ?? undefined;\n          if (!isProd) {\n            const u = user as { groups?: string[]; role?: string };\n            const groups = u.groups ?? (u.role ? [u.role] : []);\n            if (groups.length > 0) {\n              (token as Record<string, unknown>)[\"cognito:groups\"] = groups;\n            }\n          }\n        }\n        if (isProd && profile) {\n          const groups = (profile as Record<string, unknown>)[\"cognito:groups\"];\n          if (groups) {\n            (token as Record<string, unknown>)[\"cognito:groups\"] = groups;\n          }\n        }\n        return token;\n      },\n      session: ({ session, token }) => {\n        const groups =\n          ((token as Record<string, unknown>)[\"cognito:groups\"] as\n            | string[]\n            | undefined) ?? [];\n        session.user.groups = groups;\n        session.user.role = roleFromGroups(groups);\n        return session;\n      },\n      authorized: ({ auth: session, request: { nextUrl } }) => {\n        const path = nextUrl.pathname;\n        const isAuthedRoute = opts.authedRoutePrefixes.some(\n          (prefix) => path === prefix || path.startsWith(`${prefix}/`),\n        );\n        if (!session && isAuthedRoute) return false;\n        return true;\n      },\n      redirect: buildRedirectCallback(allowedParentDomain),\n    },\n    pages: { signIn: signInPage },\n    trustHost: true,\n  };\n\n  return NextAuth(config);\n}\n\nexport type { NextAuthConfig } from \"next-auth\";\n"],"mappings":";AAkBA,OAAO,cAIA;AACP,OAAO,iBAAiB;AACxB,OAAO,aAAa;AA6Db,IAAM,YAAN,cAAwB,MAAM;AAAA,EACnC,YAAmB,MAAuC;AACxD,UAAM,IAAI;AADO;AAEjB,SAAK,OAAO;AAAA,EACd;AAAA,EAHmB;AAIrB;AAKO,SAAS,cAAc,SAA+C;AAC3E,SAAO,SAAS,MAAM,UAAU,CAAC;AACnC;AAGO,SAAS,SAAS,SAAqC,MAAuB;AACnF,MAAI,CAAC,QAAS,QAAO;AACrB,QAAM,SAAS,KAAK,YAAY;AAChC,SAAO,cAAc,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,YAAY,MAAM,MAAM;AACtE;AAOO,SAAS,aACd,YACG,OACG;AACN,MAAI,CAAC,QAAS,OAAM,IAAI,UAAU,iBAAiB;AACnD,MAAI,MAAM,WAAW,EAAG;AACxB,QAAM,KAAK,MAAM,KAAK,CAAC,MAAM,SAAS,SAAS,CAAC,CAAC;AACjD,MAAI,CAAC,GAAI,OAAM,IAAI,UAAU,WAAW;AAC1C;AAIA,SAAS,gBAAgB,MAShB;AACP,MAAI,CAAC,KAAK,OAAQ;AAClB,QAAM,UAAoB,CAAC;AAC3B,MAAI,CAAC,KAAK,OAAQ,SAAQ,KAAK,aAAa;AAC5C,MAAI,CAAC,KAAK,gBAAiB,SAAQ,KAAK,iBAAiB;AACzD,MAAI,CAAC,KAAK,oBAAqB,SAAQ,KAAK,qBAAqB;AACjE,MAAI,CAAC,KAAK,cAAe,SAAQ,KAAK,qBAAqB;AAE3D,QAAM,SAAS,CAAC,EAAE,KAAK,gBAAgB,KAAK,uBAAuB,KAAK;AACxE,MAAI,QAAQ;AACV,QAAI,CAAC,KAAK,aAAc,SAAQ,KAAK,oBAAoB;AACzD,QAAI,CAAC,KAAK,oBAAqB,SAAQ,KAAK,4BAA4B;AACxE,QAAI,CAAC,KAAK,UAAW,SAAQ,KAAK,YAAY;AAAA,EAChD;AACA,MAAI,QAAQ,SAAS,GAAG;AACtB,UAAM,IAAI;AAAA,MACR,mEAAmE,QAAQ;AAAA,QACzE;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAIA,SAAS,sBAAsB,qBAAyC;AACtE,SAAO,CAAC,EAAE,KAAK,QAAQ,MAAgD;AACrE,QAAI;AACF,YAAM,SAAS,IAAI,IAAI,KAAK,OAAO;AACnC,UAAI,CAAC,qBAAqB;AACxB,eAAO,OAAO,WAAW,IAAI,IAAI,OAAO,EAAE,SAAS,OAAO,SAAS,IAAI;AAAA,MACzE;AACA,YAAM,OAAO,oBAAoB,QAAQ,OAAO,EAAE,EAAE,YAAY;AAChE,YAAM,OAAO,OAAO,SAAS,YAAY;AACzC,YAAM,KAAK,SAAS,QAAQ,KAAK,SAAS,IAAI,IAAI,EAAE;AACpD,aAAO,KAAK,OAAO,SAAS,IAAI;AAAA,IAClC,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAIA,SAAS,iBAAiB,MAIf;AACT,MAAI,KAAK,WAAY,QAAO,KAAK;AACjC,MAAI,KAAK,aAAa,KAAK,qBAAqB;AAC9C,UAAM,OAAO,KAAK,oBAAoB,QAAQ,OAAO,EAAE;AACvD,WAAO,KAAK,cAAc,OAAO,WAAW,WAAW,IAAI;AAAA,EAC7D;AACA,SAAO;AACT;AAEA,SAAS,eAAe,QAAyB;AAC/C,MAAI,MAAM,QAAQ,MAAM,KAAK,OAAO,SAAS,GAAG;AAC9C,WAAO,OAAO,OAAO,CAAC,CAAC,EAAE,YAAY;AAAA,EACvC;AACA,SAAO;AACT;AAIO,SAAS,WAAW,MAAyB;AAClD,QAAM,SAAS,KAAK,UAAU,QAAQ,IAAI,aAAa;AAEvD,QAAM,eAAe,SAChB,KAAK,gBAAgB,QAAQ,IAAI,qBAClC;AACJ,QAAM,sBACJ,KAAK,uBAAuB,QAAQ,IAAI;AAC1C,QAAM,YAAY,KAAK,aAAa,QAAQ,IAAI;AAEhD,QAAM,SACJ,KAAK,UACL,QAAQ,IAAI,gBACX,SAAS,SAAY;AACxB,QAAM,kBAAkB,KAAK,SAAS,YAAY,QAAQ,IAAI;AAC9D,QAAM,sBACJ,KAAK,SAAS,gBAAgB,QAAQ,IAAI;AAC5C,QAAM,gBAAgB,KAAK,SAAS,UAAU,QAAQ,IAAI;AAE1D,kBAAgB;AAAA,IACd;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,IACR;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAED,QAAM,aAAa,iBAAiB;AAAA,IAClC,YAAY,KAAK;AAAA,IACjB;AAAA,IACA;AAAA,EACF,CAAC;AAED,QAAM,SAAyB;AAAA,IAC7B,QAAQ;AAAA,IACR,SAAS,eACL;AAAA,MACE,cAAc;AAAA,QACZ,MAAM;AAAA,QACN,SAAS;AAAA,UACP,QAAQ;AAAA,UACR,UAAU;AAAA,UACV,QAAQ;AAAA,UACR,UAAU;AAAA,UACV,MAAM;AAAA,QACR;AAAA,MACF;AAAA,IACF,IACA;AAAA,IACJ,WAAW,SACP;AAAA,MACE,QAAQ;AAAA,QACN,UAAU;AAAA,QACV,cAAc;AAAA,QACd,QAAQ;AAAA,MACV,CAAC;AAAA,IACH,IACA;AAAA,MACE,YAAY;AAAA,QACV,MAAM;AAAA,QACN,aAAa;AAAA,UACX,MAAM;AAAA,YACJ,OAAO;AAAA,YACP,MAAM;AAAA,YACN,aAAa;AAAA,UACf;AAAA,QACF;AAAA,QACA,WAAW,OAAO,gBAAgB;AAChC,gBAAM,OAAO,aAAa;AAC1B,cAAI,CAAC,KAAM,QAAO;AAClB,gBAAM,UAAU,KAAK,OAAO,CAAC,EAAE,YAAY,IAAI,KAAK,MAAM,CAAC;AAC3D,iBAAO;AAAA,YACL,IAAI,QAAQ,IAAI;AAAA,YAChB,MAAM,GAAG,OAAO;AAAA,YAChB,OAAO,GAAG,IAAI;AAAA,YACd;AAAA,YACA,QAAQ,CAAC,IAAI;AAAA,UACf;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH;AAAA,IACJ,SAAS,EAAE,UAAU,MAAM;AAAA,IAC3B,WAAW;AAAA,MACT,KAAK,CAAC,EAAE,OAAO,MAAM,QAAQ,MAAM;AACjC,YAAI,MAAM;AACR,gBAAM,QAAQ,KAAK,MAAM;AACzB,gBAAM,UAAU,KAAK,SAAS;AAC9B,cAAI,CAAC,QAAQ;AACX,kBAAM,IAAI;AACV,kBAAM,SAAS,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,IAAI,IAAI,CAAC;AACjD,gBAAI,OAAO,SAAS,GAAG;AACrB,cAAC,MAAkC,gBAAgB,IAAI;AAAA,YACzD;AAAA,UACF;AAAA,QACF;AACA,YAAI,UAAU,SAAS;AACrB,gBAAM,SAAU,QAAoC,gBAAgB;AACpE,cAAI,QAAQ;AACV,YAAC,MAAkC,gBAAgB,IAAI;AAAA,UACzD;AAAA,QACF;AACA,eAAO;AAAA,MACT;AAAA,MACA,SAAS,CAAC,EAAE,SAAS,MAAM,MAAM;AAC/B,cAAM,SACF,MAAkC,gBAAgB,KAElC,CAAC;AACrB,gBAAQ,KAAK,SAAS;AACtB,gBAAQ,KAAK,OAAO,eAAe,MAAM;AACzC,eAAO;AAAA,MACT;AAAA,MACA,YAAY,CAAC,EAAE,MAAM,SAAS,SAAS,EAAE,QAAQ,EAAE,MAAM;AACvD,cAAM,OAAO,QAAQ;AACrB,cAAM,gBAAgB,KAAK,oBAAoB;AAAA,UAC7C,CAAC,WAAW,SAAS,UAAU,KAAK,WAAW,GAAG,MAAM,GAAG;AAAA,QAC7D;AACA,YAAI,CAAC,WAAW,cAAe,QAAO;AACtC,eAAO;AAAA,MACT;AAAA,MACA,UAAU,sBAAsB,mBAAmB;AAAA,IACrD;AAAA,IACA,OAAO,EAAE,QAAQ,WAAW;AAAA,IAC5B,WAAW;AAAA,EACb;AAEA,SAAO,SAAS,MAAM;AACxB;","names":[]}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["// Auth.js v5 (the package is still distributed as `next-auth`, but treat\n// these as Auth.js v5 internally — docs at https://authjs.dev, NOT\n// next-auth.js.org which is v4 and incompatible).\n//\n// Subdomain ecosystem model:\n//   - One Cognito User Pool per tenant.\n//   - One Cognito App Client with ONE callback URL at the apex\n//     (https://<apex>/api/auth/callback/cognito).\n//   - The apex app is the auth broker. Subdomain apps redirect through it.\n//   - Session cookie scoped to Domain=.<apex> so every subdomain sees it.\n//   - All apps use the same createAuth() invocation; the package derives\n//     the right signInPage from appDomain + allowedParentDomain.\n//\n// Provider strategy:\n//   - Production: Cognito OIDC. cognito:groups drives session.user.groups.\n//   - Dev / preview: Credentials with a role picker, shaped to mirror\n//     Cognito's claim payload (same groups, sub, email).\n\nimport NextAuth, {\n  type DefaultSession,\n  type NextAuthConfig,\n  type Session,\n} from \"next-auth\";\nimport Credentials from \"next-auth/providers/credentials\";\nimport Cognito from \"next-auth/providers/cognito\";\n\ndeclare module \"next-auth\" {\n  interface Session {\n    user: {\n      groups: string[];\n      role: string;\n    } & DefaultSession[\"user\"];\n  }\n  interface User {\n    role?: string;\n    groups?: string[];\n  }\n}\n\nexport type CreateAuthOptions = {\n  /** Path prefixes that require an authenticated session. */\n  authedRoutePrefixes: string[];\n  /**\n   * Page to redirect to when an unauthed user hits a gated route.\n   * If omitted, derived automatically from appDomain + allowedParentDomain:\n   * apex app gets `/login`; subdomain apps get `https://<apex>/login`.\n   */\n  signInPage?: string;\n  /**\n   * Cookie Domain attribute. In subdomain ecosystems, set to the parent\n   * (e.g. `.agency.aillc.link`). Default: process.env.AUTH_COOKIE_DOMAIN.\n   * In dev (NODE_ENV !== \"production\") this is ignored — cookies stay\n   * host-only so per-port localhost apps don't collide.\n   */\n  cookieDomain?: string;\n  /**\n   * The parent domain that all subdomain apps share (e.g.\n   * `.agency.aillc.link`). The redirect callback uses this to allow\n   * post-login redirects back to any subdomain of the parent (apex or\n   * `<sub>.agency.aillc.link`). Default: process.env.AUTH_ALLOWED_PARENT_DOMAIN.\n   */\n  allowedParentDomain?: string;\n  /**\n   * This app's full FQDN (e.g. `agency.aillc.link` for the apex app, or\n   * `leads.agency.aillc.link` for a subdomain app). Used to derive the\n   * default signInPage. Default: process.env.APP_DOMAIN.\n   */\n  appDomain?: string;\n  /** Override prod/dev detection. Default reads NODE_ENV. */\n  isProd?: boolean;\n  /**\n   * The JWT signing secret. Default: process.env.AUTH_SECRET.\n   * In prod, pass this from a runtime fetch (Secrets Manager) to keep the\n   * secret out of Lambda env vars and to support rotation without redeploy.\n   */\n  secret?: string;\n  cognito?: {\n    clientId?: string;\n    clientSecret?: string;\n    issuer?: string;\n  };\n};\n\n// ----- AuthError used by requireGroup -----\n\nexport class AuthError extends Error {\n  constructor(public code: \"unauthenticated\" | \"forbidden\") {\n    super(code);\n    this.name = \"AuthError\";\n  }\n}\n\n// ----- Group/authorization helpers -----\n\n/** Returns the user's Cognito groups (always an array, possibly empty). */\nexport function getUserGroups(session: Session | null | undefined): string[] {\n  return session?.user?.groups ?? [];\n}\n\n/** Case-insensitive group membership check. */\nexport function hasGroup(session: Session | null | undefined, name: string): boolean {\n  if (!session) return false;\n  const target = name.toLowerCase();\n  return getUserGroups(session).some((g) => g.toLowerCase() === target);\n}\n\n/**\n * Throws AuthError if no session (`unauthenticated`) or if the user is in\n * none of the provided groups (`forbidden`). Pass multiple names to allow\n * any-of.\n */\nexport function requireGroup(\n  session: Session | null | undefined,\n  ...names: string[]\n): void {\n  if (!session) throw new AuthError(\"unauthenticated\");\n  if (names.length === 0) return;\n  const ok = names.some((n) => hasGroup(session, n));\n  if (!ok) throw new AuthError(\"forbidden\");\n}\n\n// ----- Env validation -----\n\nfunction validateProdEnv(args: {\n  isProd: boolean;\n  cookieDomain: string | undefined;\n  allowedParentDomain: string | undefined;\n  appDomain: string | undefined;\n  secret: string | undefined;\n  cognitoClientId: string | undefined;\n  cognitoClientSecret: string | undefined;\n  cognitoIssuer: string | undefined;\n}): void {\n  if (!args.isProd) return;\n  // Skip during `next build` -- Cognito values come from SSM dynamic\n  // refs and Secrets Manager at runtime in the deployed Lambda. Build\n  // time only needs to compile route handlers; throwing here breaks\n  // the build with no actionable fix (the values literally don't exist\n  // yet at build time).\n  if (process.env.NEXT_PHASE === \"phase-production-build\") return;\n  const missing: string[] = [];\n  if (!args.secret) missing.push(\"AUTH_SECRET\");\n  if (!args.cognitoClientId) missing.push(\"AUTH_COGNITO_ID\");\n  if (!args.cognitoClientSecret) missing.push(\"AUTH_COGNITO_SECRET\");\n  if (!args.cognitoIssuer) missing.push(\"AUTH_COGNITO_ISSUER\");\n  // Subdomain mode: if any of the three multi-domain values is set, all three must be.\n  const hasAny = !!(args.cookieDomain || args.allowedParentDomain || args.appDomain);\n  if (hasAny) {\n    if (!args.cookieDomain) missing.push(\"AUTH_COOKIE_DOMAIN\");\n    if (!args.allowedParentDomain) missing.push(\"AUTH_ALLOWED_PARENT_DOMAIN\");\n    if (!args.appDomain) missing.push(\"APP_DOMAIN\");\n  }\n  if (missing.length > 0) {\n    throw new Error(\n      `[@augmenting-integrations/auth] Missing required prod env vars: ${missing.join(\n        \", \",\n      )}. Provide via createAuth() opts or process.env.`,\n    );\n  }\n}\n\n// ----- Redirect callback factory -----\n\nfunction buildRedirectCallback(allowedParentDomain: string | undefined) {\n  return ({ url, baseUrl }: { url: string; baseUrl: string }): string => {\n    try {\n      const target = new URL(url, baseUrl);\n      if (!allowedParentDomain) {\n        return target.origin === new URL(baseUrl).origin ? target.toString() : baseUrl;\n      }\n      const apex = allowedParentDomain.replace(/^\\./, \"\").toLowerCase();\n      const host = target.hostname.toLowerCase();\n      const ok = host === apex || host.endsWith(`.${apex}`);\n      return ok ? target.toString() : baseUrl;\n    } catch {\n      return baseUrl;\n    }\n  };\n}\n\n// ----- Sign-in page auto-derivation -----\n\nfunction deriveSignInPage(args: {\n  signInPage: string | undefined;\n  appDomain: string | undefined;\n  allowedParentDomain: string | undefined;\n}): string {\n  if (args.signInPage) return args.signInPage;\n  if (args.appDomain && args.allowedParentDomain) {\n    const apex = args.allowedParentDomain.replace(/^\\./, \"\");\n    return args.appDomain === apex ? \"/login\" : `https://${apex}/login`;\n  }\n  return \"/login\";\n}\n\nfunction roleFromGroups(groups: unknown): string {\n  if (Array.isArray(groups) && groups.length > 0) {\n    return String(groups[0]).toLowerCase();\n  }\n  return \"visitor\";\n}\n\n// ----- Main factory -----\n\nexport function createAuth(opts: CreateAuthOptions) {\n  const isProd = opts.isProd ?? process.env.NODE_ENV === \"production\";\n\n  const cookieDomain = isProd\n    ? (opts.cookieDomain ?? process.env.AUTH_COOKIE_DOMAIN)\n    : undefined;\n  const allowedParentDomain =\n    opts.allowedParentDomain ?? process.env.AUTH_ALLOWED_PARENT_DOMAIN;\n  const appDomain = opts.appDomain ?? process.env.APP_DOMAIN;\n\n  const SECRET =\n    opts.secret ??\n    process.env.AUTH_SECRET ??\n    (isProd ? undefined : \"dev-only-fallback-not-for-prod\");\n  const cognitoClientId = opts.cognito?.clientId ?? process.env.AUTH_COGNITO_ID;\n  const cognitoClientSecret =\n    opts.cognito?.clientSecret ?? process.env.AUTH_COGNITO_SECRET;\n  const cognitoIssuer = opts.cognito?.issuer ?? process.env.AUTH_COGNITO_ISSUER;\n\n  validateProdEnv({\n    isProd,\n    cookieDomain,\n    allowedParentDomain,\n    appDomain,\n    secret: SECRET,\n    cognitoClientId,\n    cognitoClientSecret,\n    cognitoIssuer,\n  });\n\n  const signInPage = deriveSignInPage({\n    signInPage: opts.signInPage,\n    appDomain,\n    allowedParentDomain,\n  });\n\n  const config: NextAuthConfig = {\n    secret: SECRET,\n    cookies: cookieDomain\n      ? {\n          sessionToken: {\n            name: \"authjs.session-token\",\n            options: {\n              domain: cookieDomain,\n              sameSite: \"lax\",\n              secure: true,\n              httpOnly: true,\n              path: \"/\",\n            },\n          },\n        }\n      : undefined,\n    providers: isProd\n      ? [\n          Cognito({\n            clientId: cognitoClientId,\n            clientSecret: cognitoClientSecret,\n            issuer: cognitoIssuer,\n          }),\n        ]\n      : [\n          Credentials({\n            name: \"Mock role (dev only)\",\n            credentials: {\n              role: {\n                label: \"Role\",\n                type: \"text\",\n                placeholder: \"any role string\",\n              },\n            },\n            authorize: async (credentials) => {\n              const role = credentials?.role as string | undefined;\n              if (!role) return null;\n              const display = role.charAt(0).toUpperCase() + role.slice(1);\n              return {\n                id: `mock-${role}`,\n                name: `${display} (mock)`,\n                email: `${role}@example.local`,\n                role,\n                groups: [role],\n              };\n            },\n          }),\n        ],\n    session: { strategy: \"jwt\" },\n    callbacks: {\n      jwt: ({ token, user, profile }) => {\n        if (user) {\n          token.sub ??= user.id ?? undefined;\n          token.email ??= user.email ?? undefined;\n          if (!isProd) {\n            const u = user as { groups?: string[]; role?: string };\n            const groups = u.groups ?? (u.role ? [u.role] : []);\n            if (groups.length > 0) {\n              (token as Record<string, unknown>)[\"cognito:groups\"] = groups;\n            }\n          }\n        }\n        if (isProd && profile) {\n          const groups = (profile as Record<string, unknown>)[\"cognito:groups\"];\n          if (groups) {\n            (token as Record<string, unknown>)[\"cognito:groups\"] = groups;\n          }\n        }\n        return token;\n      },\n      session: ({ session, token }) => {\n        const groups =\n          ((token as Record<string, unknown>)[\"cognito:groups\"] as\n            | string[]\n            | undefined) ?? [];\n        session.user.groups = groups;\n        session.user.role = roleFromGroups(groups);\n        return session;\n      },\n      authorized: ({ auth: session, request: { nextUrl } }) => {\n        const path = nextUrl.pathname;\n        const isAuthedRoute = opts.authedRoutePrefixes.some(\n          (prefix) => path === prefix || path.startsWith(`${prefix}/`),\n        );\n        if (!session && isAuthedRoute) return false;\n        return true;\n      },\n      redirect: buildRedirectCallback(allowedParentDomain),\n    },\n    pages: { signIn: signInPage },\n    trustHost: true,\n  };\n\n  return NextAuth(config);\n}\n\nexport type { NextAuthConfig } from \"next-auth\";\n"],"mappings":";AAkBA,OAAO,cAIA;AACP,OAAO,iBAAiB;AACxB,OAAO,aAAa;AA6Db,IAAM,YAAN,cAAwB,MAAM;AAAA,EACnC,YAAmB,MAAuC;AACxD,UAAM,IAAI;AADO;AAEjB,SAAK,OAAO;AAAA,EACd;AAAA,EAHmB;AAIrB;AAKO,SAAS,cAAc,SAA+C;AAC3E,SAAO,SAAS,MAAM,UAAU,CAAC;AACnC;AAGO,SAAS,SAAS,SAAqC,MAAuB;AACnF,MAAI,CAAC,QAAS,QAAO;AACrB,QAAM,SAAS,KAAK,YAAY;AAChC,SAAO,cAAc,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,YAAY,MAAM,MAAM;AACtE;AAOO,SAAS,aACd,YACG,OACG;AACN,MAAI,CAAC,QAAS,OAAM,IAAI,UAAU,iBAAiB;AACnD,MAAI,MAAM,WAAW,EAAG;AACxB,QAAM,KAAK,MAAM,KAAK,CAAC,MAAM,SAAS,SAAS,CAAC,CAAC;AACjD,MAAI,CAAC,GAAI,OAAM,IAAI,UAAU,WAAW;AAC1C;AAIA,SAAS,gBAAgB,MAShB;AACP,MAAI,CAAC,KAAK,OAAQ;AAMlB,MAAI,QAAQ,IAAI,eAAe,yBAA0B;AACzD,QAAM,UAAoB,CAAC;AAC3B,MAAI,CAAC,KAAK,OAAQ,SAAQ,KAAK,aAAa;AAC5C,MAAI,CAAC,KAAK,gBAAiB,SAAQ,KAAK,iBAAiB;AACzD,MAAI,CAAC,KAAK,oBAAqB,SAAQ,KAAK,qBAAqB;AACjE,MAAI,CAAC,KAAK,cAAe,SAAQ,KAAK,qBAAqB;AAE3D,QAAM,SAAS,CAAC,EAAE,KAAK,gBAAgB,KAAK,uBAAuB,KAAK;AACxE,MAAI,QAAQ;AACV,QAAI,CAAC,KAAK,aAAc,SAAQ,KAAK,oBAAoB;AACzD,QAAI,CAAC,KAAK,oBAAqB,SAAQ,KAAK,4BAA4B;AACxE,QAAI,CAAC,KAAK,UAAW,SAAQ,KAAK,YAAY;AAAA,EAChD;AACA,MAAI,QAAQ,SAAS,GAAG;AACtB,UAAM,IAAI;AAAA,MACR,mEAAmE,QAAQ;AAAA,QACzE;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAIA,SAAS,sBAAsB,qBAAyC;AACtE,SAAO,CAAC,EAAE,KAAK,QAAQ,MAAgD;AACrE,QAAI;AACF,YAAM,SAAS,IAAI,IAAI,KAAK,OAAO;AACnC,UAAI,CAAC,qBAAqB;AACxB,eAAO,OAAO,WAAW,IAAI,IAAI,OAAO,EAAE,SAAS,OAAO,SAAS,IAAI;AAAA,MACzE;AACA,YAAM,OAAO,oBAAoB,QAAQ,OAAO,EAAE,EAAE,YAAY;AAChE,YAAM,OAAO,OAAO,SAAS,YAAY;AACzC,YAAM,KAAK,SAAS,QAAQ,KAAK,SAAS,IAAI,IAAI,EAAE;AACpD,aAAO,KAAK,OAAO,SAAS,IAAI;AAAA,IAClC,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAIA,SAAS,iBAAiB,MAIf;AACT,MAAI,KAAK,WAAY,QAAO,KAAK;AACjC,MAAI,KAAK,aAAa,KAAK,qBAAqB;AAC9C,UAAM,OAAO,KAAK,oBAAoB,QAAQ,OAAO,EAAE;AACvD,WAAO,KAAK,cAAc,OAAO,WAAW,WAAW,IAAI;AAAA,EAC7D;AACA,SAAO;AACT;AAEA,SAAS,eAAe,QAAyB;AAC/C,MAAI,MAAM,QAAQ,MAAM,KAAK,OAAO,SAAS,GAAG;AAC9C,WAAO,OAAO,OAAO,CAAC,CAAC,EAAE,YAAY;AAAA,EACvC;AACA,SAAO;AACT;AAIO,SAAS,WAAW,MAAyB;AAClD,QAAM,SAAS,KAAK,UAAU,QAAQ,IAAI,aAAa;AAEvD,QAAM,eAAe,SAChB,KAAK,gBAAgB,QAAQ,IAAI,qBAClC;AACJ,QAAM,sBACJ,KAAK,uBAAuB,QAAQ,IAAI;AAC1C,QAAM,YAAY,KAAK,aAAa,QAAQ,IAAI;AAEhD,QAAM,SACJ,KAAK,UACL,QAAQ,IAAI,gBACX,SAAS,SAAY;AACxB,QAAM,kBAAkB,KAAK,SAAS,YAAY,QAAQ,IAAI;AAC9D,QAAM,sBACJ,KAAK,SAAS,gBAAgB,QAAQ,IAAI;AAC5C,QAAM,gBAAgB,KAAK,SAAS,UAAU,QAAQ,IAAI;AAE1D,kBAAgB;AAAA,IACd;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,IACR;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAED,QAAM,aAAa,iBAAiB;AAAA,IAClC,YAAY,KAAK;AAAA,IACjB;AAAA,IACA;AAAA,EACF,CAAC;AAED,QAAM,SAAyB;AAAA,IAC7B,QAAQ;AAAA,IACR,SAAS,eACL;AAAA,MACE,cAAc;AAAA,QACZ,MAAM;AAAA,QACN,SAAS;AAAA,UACP,QAAQ;AAAA,UACR,UAAU;AAAA,UACV,QAAQ;AAAA,UACR,UAAU;AAAA,UACV,MAAM;AAAA,QACR;AAAA,MACF;AAAA,IACF,IACA;AAAA,IACJ,WAAW,SACP;AAAA,MACE,QAAQ;AAAA,QACN,UAAU;AAAA,QACV,cAAc;AAAA,QACd,QAAQ;AAAA,MACV,CAAC;AAAA,IACH,IACA;AAAA,MACE,YAAY;AAAA,QACV,MAAM;AAAA,QACN,aAAa;AAAA,UACX,MAAM;AAAA,YACJ,OAAO;AAAA,YACP,MAAM;AAAA,YACN,aAAa;AAAA,UACf;AAAA,QACF;AAAA,QACA,WAAW,OAAO,gBAAgB;AAChC,gBAAM,OAAO,aAAa;AAC1B,cAAI,CAAC,KAAM,QAAO;AAClB,gBAAM,UAAU,KAAK,OAAO,CAAC,EAAE,YAAY,IAAI,KAAK,MAAM,CAAC;AAC3D,iBAAO;AAAA,YACL,IAAI,QAAQ,IAAI;AAAA,YAChB,MAAM,GAAG,OAAO;AAAA,YAChB,OAAO,GAAG,IAAI;AAAA,YACd;AAAA,YACA,QAAQ,CAAC,IAAI;AAAA,UACf;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH;AAAA,IACJ,SAAS,EAAE,UAAU,MAAM;AAAA,IAC3B,WAAW;AAAA,MACT,KAAK,CAAC,EAAE,OAAO,MAAM,QAAQ,MAAM;AACjC,YAAI,MAAM;AACR,gBAAM,QAAQ,KAAK,MAAM;AACzB,gBAAM,UAAU,KAAK,SAAS;AAC9B,cAAI,CAAC,QAAQ;AACX,kBAAM,IAAI;AACV,kBAAM,SAAS,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,IAAI,IAAI,CAAC;AACjD,gBAAI,OAAO,SAAS,GAAG;AACrB,cAAC,MAAkC,gBAAgB,IAAI;AAAA,YACzD;AAAA,UACF;AAAA,QACF;AACA,YAAI,UAAU,SAAS;AACrB,gBAAM,SAAU,QAAoC,gBAAgB;AACpE,cAAI,QAAQ;AACV,YAAC,MAAkC,gBAAgB,IAAI;AAAA,UACzD;AAAA,QACF;AACA,eAAO;AAAA,MACT;AAAA,MACA,SAAS,CAAC,EAAE,SAAS,MAAM,MAAM;AAC/B,cAAM,SACF,MAAkC,gBAAgB,KAElC,CAAC;AACrB,gBAAQ,KAAK,SAAS;AACtB,gBAAQ,KAAK,OAAO,eAAe,MAAM;AACzC,eAAO;AAAA,MACT;AAAA,MACA,YAAY,CAAC,EAAE,MAAM,SAAS,SAAS,EAAE,QAAQ,EAAE,MAAM;AACvD,cAAM,OAAO,QAAQ;AACrB,cAAM,gBAAgB,KAAK,oBAAoB;AAAA,UAC7C,CAAC,WAAW,SAAS,UAAU,KAAK,WAAW,GAAG,MAAM,GAAG;AAAA,QAC7D;AACA,YAAI,CAAC,WAAW,cAAe,QAAO;AACtC,eAAO;AAAA,MACT;AAAA,MACA,UAAU,sBAAsB,mBAAmB;AAAA,IACrD;AAAA,IACA,OAAO,EAAE,QAAQ,WAAW;AAAA,IAC5B,WAAW;AAAA,EACb;AAEA,SAAO,SAAS,MAAM;AACxB;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@augmenting-integrations/auth",
-  "version": "4.1.0",
+  "version": "4.1.1",
   "description": "Auth.js v5 factory: Cognito in prod, Credentials role-picker in dev. Same JWT shape (sub, email, cognito:groups) regardless of provider.",
   "license": "MIT",
   "publishConfig": {
@@ -21,6 +21,11 @@
     "dist",
     "README.md"
   ],
+  "scripts": {
+    "build": "tsup",
+    "clean": "rm -rf dist",
+    "test": "vitest run --passWithNoTests"
+  },
   "peerDependencies": {
     "next": "^16.0.0",
     "next-auth": "^5.0.0-beta.31",
@@ -33,10 +38,5 @@
     "tsup": "^8.3.5",
     "typescript": "^5.7.2",
     "vitest": "^4.1.5"
-  },
-  "scripts": {
-    "build": "tsup",
-    "clean": "rm -rf dist",
-    "test": "vitest run --passWithNoTests"
   }
-}
+}

package/LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2026 Augmenting Integrations LLC
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.

package/dist/index.d.ts

@@ -1,73 +0,0 @@
-import { type DefaultSession, type Session } from "next-auth";
-declare module "next-auth" {
-    interface Session {
-        user: {
-            groups: string[];
-            role: string;
-        } & DefaultSession["user"];
-    }
-    interface User {
-        role?: string;
-        groups?: string[];
-    }
-}
-export type CreateAuthOptions = {
-    /** Path prefixes that require an authenticated session. */
-    authedRoutePrefixes: string[];
-    /**
-     * Page to redirect to when an unauthed user hits a gated route.
-     * If omitted, derived automatically from appDomain + allowedParentDomain:
-     * apex app gets `/login`; subdomain apps get `https://<apex>/login`.
-     */
-    signInPage?: string;
-    /**
-     * Cookie Domain attribute. In subdomain ecosystems, set to the parent
-     * (e.g. `.agency.aillc.link`). Default: process.env.AUTH_COOKIE_DOMAIN.
-     * In dev (NODE_ENV !== "production") this is ignored — cookies stay
-     * host-only so per-port localhost apps don't collide.
-     */
-    cookieDomain?: string;
-    /**
-     * The parent domain that all subdomain apps share (e.g.
-     * `.agency.aillc.link`). The redirect callback uses this to allow
-     * post-login redirects back to any subdomain of the parent (apex or
-     * `<sub>.agency.aillc.link`). Default: process.env.AUTH_ALLOWED_PARENT_DOMAIN.
-     */
-    allowedParentDomain?: string;
-    /**
-     * This app's full FQDN (e.g. `agency.aillc.link` for the apex app, or
-     * `leads.agency.aillc.link` for a subdomain app). Used to derive the
-     * default signInPage. Default: process.env.APP_DOMAIN.
-     */
-    appDomain?: string;
-    /** Override prod/dev detection. Default reads NODE_ENV. */
-    isProd?: boolean;
-    /**
-     * The JWT signing secret. Default: process.env.AUTH_SECRET.
-     * In prod, pass this from a runtime fetch (Secrets Manager) to keep the
-     * secret out of Lambda env vars and to support rotation without redeploy.
-     */
-    secret?: string;
-    cognito?: {
-        clientId?: string;
-        clientSecret?: string;
-        issuer?: string;
-    };
-};
-export declare class AuthError extends Error {
-    code: "unauthenticated" | "forbidden";
-    constructor(code: "unauthenticated" | "forbidden");
-}
-/** Returns the user's Cognito groups (always an array, possibly empty). */
-export declare function getUserGroups(session: Session | null | undefined): string[];
-/** Case-insensitive group membership check. */
-export declare function hasGroup(session: Session | null | undefined, name: string): boolean;
-/**
- * Throws AuthError if no session (`unauthenticated`) or if the user is in
- * none of the provided groups (`forbidden`). Pass multiple names to allow
- * any-of.
- */
-export declare function requireGroup(session: Session | null | undefined, ...names: string[]): void;
-export declare function createAuth(opts: CreateAuthOptions): import("next-auth").NextAuthResult;
-export type { NextAuthConfig } from "next-auth";
-//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAkBA,OAAiB,EACf,KAAK,cAAc,EAEnB,KAAK,OAAO,EACb,MAAM,WAAW,CAAC;AAInB,OAAO,QAAQ,WAAW,CAAC;IACzB,UAAU,OAAO;QACf,IAAI,EAAE;YACJ,MAAM,EAAE,MAAM,EAAE,CAAC;YACjB,IAAI,EAAE,MAAM,CAAC;SACd,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;KAC5B;IACD,UAAU,IAAI;QACZ,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;KACnB;CACF;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,2DAA2D;IAC3D,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2DAA2D;IAC3D,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE;QACR,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;CACH,CAAC;AAIF,qBAAa,SAAU,SAAQ,KAAK;IACf,IAAI,EAAE,iBAAiB,GAAG,WAAW;gBAArC,IAAI,EAAE,iBAAiB,GAAG,WAAW;CAIzD;AAID,2EAA2E;AAC3E,wBAAgB,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,EAAE,CAE3E;AAED,+CAA+C;AAC/C,wBAAgB,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAInF;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE,OAAO,GAAG,IAAI,GAAG,SAAS,EACnC,GAAG,KAAK,EAAE,MAAM,EAAE,GACjB,IAAI,CAKN;AA+ED,wBAAgB,UAAU,CAAC,IAAI,EAAE,iBAAiB,sCAkIjD;AAED,YAAY,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC"}