@augmenting-integrations/auth 6.0.0 → 8.0.1

package/dist/tenant-types.d.ts

@@ -0,0 +1,63 @@
+export type TenantRole = "apex" | "spoke";
+export type TenantPublicConfig = {
+    /** The tenant apex FQDN, e.g. "agency.aillc.link". */
+    apex: string;
+    /**
+     * Cookie Domain attribute. Always the apex (no leading dot needed -- the
+     * browser implies it for shared cookies). Auth.js session cookie and the
+     * theme x-theme/x-theme-variant cookies use this. Without it cookies are
+     * host-only and the subdomain ecosystem breaks.
+     */
+    cookieDomain: string;
+    /**
+     * The registrable parent domain (e.g. "aillc.link"). Used by the auth
+     * redirect callback to validate post-login callbacks back to any subdomain
+     * of the tenant. Distinct from cookieDomain in two-level apex setups.
+     */
+    parentDomain: string;
+    /** AWS region. Default: us-east-1. */
+    region: string;
+    /**
+     * For spoke apps: this spoke's slug (matches app registry primary key).
+     * For apex: undefined.
+     */
+    appSlug?: string;
+    /**
+     * For spoke apps: this spoke's FQDN (e.g. "leads.agency.aillc.link").
+     * For apex: same as `apex`.
+     */
+    appDomain: string;
+    /** "apex" or "spoke". Affects which secret-arn fields are required. */
+    role: TenantRole;
+};
+export type TenantServerConfig = TenantPublicConfig & {
+    /** AUTH_SECRET ARN in Secrets Manager. Used by createAuth(). */
+    authSecretArn: string;
+    /** App registry DynamoDB table name. Apex owns the table; spokes read. */
+    registryTable: string;
+    /** Cognito client secret ARN. Apex only -- spokes don't run the OAuth dance. */
+    authCognitoSecretArn?: string;
+    /** Cognito issuer URL (apex only). */
+    cognitoIssuer?: string;
+    /** Cognito client ID (apex only). */
+    cognitoClientId?: string;
+    /** Comma-separated admin emails (auto-promoted on first sign-in). */
+    adminEmails?: string;
+    /** Aurora connection secret ARN (spoke only). */
+    dbSecretArn?: string;
+    /** Aurora endpoint host (spoke only). */
+    dbHost?: string;
+    /** Aurora database name (spoke only). */
+    dbName?: string;
+    /** Stripe credentials bundle ARN (spoke that does billing). */
+    stripeSecretArn?: string;
+    /** Stripe webhook signing secret ARN (spoke that does billing). */
+    stripeWebhookSecretArn?: string;
+};
+export declare const TENANT_GLOBAL_KEY: "__TENANT__";
+declare global {
+    interface Window {
+        [TENANT_GLOBAL_KEY]?: TenantPublicConfig;
+    }
+}
+//# sourceMappingURL=tenant-types.d.ts.map

package/dist/tenant-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-types.d.ts","sourceRoot":"","sources":["../src/tenant-types.ts"],"names":[],"mappings":"AAWA,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,OAAO,CAAC;AAE1C,MAAM,MAAM,kBAAkB,GAAG;IAC/B,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB,sCAAsC;IACtC,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,uEAAuE;IACvE,IAAI,EAAE,UAAU,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG,kBAAkB,GAAG;IACpD,gEAAgE;IAChE,aAAa,EAAE,MAAM,CAAC;IACtB,0EAA0E;IAC1E,aAAa,EAAE,MAAM,CAAC;IACtB,gFAAgF;IAChF,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,sCAAsC;IACtC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,qCAAqC;IACrC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,qEAAqE;IACrE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iDAAiD;IACjD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yCAAyC;IACzC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yCAAyC;IACzC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+DAA+D;IAC/D,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mEAAmE;IACnE,sBAAsB,CAAC,EAAE,MAAM,CAAC;CACjC,CAAC;AAEF,eAAO,MAAM,iBAAiB,EAAG,YAAqB,CAAC;AAEvD,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,MAAM;QACd,CAAC,iBAAiB,CAAC,CAAC,EAAE,kBAAkB,CAAC;KAC1C;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@augmenting-integrations/auth",
-  "version": "6.0.0",
+  "version": "8.0.1",
   "description": "Auth.js v5 factory + JIT user provisioning + impersonation + client-side user menu / sign-out. Subpath exports: /server (createAuth, JIT, impersonation token mint/verify) and /client (AppUserProvider, useAppUser, UserMenu, SignOutButton, ImpersonationBanner).",
   "license": "MIT",
   "publishConfig": {
@@ -33,7 +33,7 @@
     "next": "^16.0.0",
     "next-auth": "^5.0.0-beta.31",
     "react": "^19.0.0",
-    "@augmenting-integrations/aws": "6.0.0"
+    "@augmenting-integrations/aws": "8.0.1"
   },
   "devDependencies": {
     "@types/react": "^19.0.0",
@@ -43,7 +43,7 @@
     "tsup": "^8.3.5",
     "typescript": "^5.7.2",
     "vitest": "^4.1.5",
-    "@augmenting-integrations/aws": "6.0.0"
+    "@augmenting-integrations/aws": "8.0.1"
   },
   "scripts": {
     "build": "tsup",