@augmenting-integrations/aws 0.0.1

package/README.md

@@ -0,0 +1,17 @@
+# @augmenting-integrations/aws
+
+Server-only AWS SDK wrappers used across spokes:
+
+- `getSecret(arn)` -- module-cached Secrets Manager fetch
+- `createEmailSender({fromAddress, region?})` -- factory returning a typed `sendEmail`
+- Cognito per-user flows (`associateSoftwareToken`, `verifySoftwareToken`, `setUserMfaPreference`, `changePassword`) plus helpers (`regionFromIssuer`, `buildOtpAuthUri`, `computeSecretHash`)
+
+All exports are under the `/server` subpath. Importing from `@augmenting-integrations/aws/server` keeps the AWS SDK out of any client bundle.
+
+```ts
+import {
+  getSecret,
+  createEmailSender,
+  associateSoftwareToken,
+} from "@augmenting-integrations/aws/server";
+```

package/dist/cognito.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Parse the Cognito region out of the issuer URL.
+ *   issuer = https://cognito-idp.<region>.amazonaws.com/<pool>
+ */
+export declare function regionFromIssuer(issuer: string): string;
+/**
+ * SECRET_HASH for Cognito app clients that have a client secret. Only needed
+ * for username+password flows like InitiateAuth -- the access-token-based
+ * flows below don't use it.
+ */
+export declare function computeSecretHash(username: string, clientId: string, clientSecret: string): string;
+export declare function associateSoftwareToken(args: {
+    accessToken: string;
+    region?: string;
+}): Promise<{
+    secretCode: string;
+}>;
+export declare function verifySoftwareToken(args: {
+    accessToken: string;
+    code: string;
+    friendlyDeviceName?: string;
+    region?: string;
+}): Promise<{
+    status: string;
+}>;
+export declare function setUserMfaPreference(args: {
+    accessToken: string;
+    enabled: boolean;
+    region?: string;
+}): Promise<void>;
+export declare function changePassword(args: {
+    accessToken: string;
+    previousPassword: string;
+    proposedPassword: string;
+    region?: string;
+}): Promise<void>;
+/**
+ * Build the otpauth:// URI an authenticator app expects. Caller turns this
+ * into a QR code (data URL) before sending it to the browser.
+ */
+export declare function buildOtpAuthUri(params: {
+    secret: string;
+    accountName: string;
+    issuer: string;
+}): string;
+//# sourceMappingURL=cognito.d.ts.map

package/dist/cognito.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cognito.d.ts","sourceRoot":"","sources":["../src/cognito.ts"],"names":[],"mappings":"AA0BA;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAMvD;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,GACnB,MAAM,CAIR;AAED,wBAAsB,sBAAsB,CAAC,IAAI,EAAE;IACjD,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,CAQlC;AAED,wBAAsB,mBAAmB,CAAC,IAAI,EAAE;IAC9C,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAS9B;AAED,wBAAsB,oBAAoB,CAAC,IAAI,EAAE;IAC/C,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC,IAAI,CAAC,CAUhB;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE;IACzC,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC,IAAI,CAAC,CAQhB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,MAAM,CAKT"}

package/dist/email.d.ts

@@ -0,0 +1,18 @@
+export type SendEmailInput = {
+    to: string;
+    subject: string;
+    html: string;
+    text?: string;
+};
+export type SendEmailResult = {
+    messageId: string | undefined;
+};
+export type CreateEmailSenderOptions = {
+    /** RFC 5322 from address. Required. */
+    fromAddress: string;
+    /** AWS region; defaults to the SDK's environment-derived region. */
+    region?: string;
+};
+export type EmailSender = (input: SendEmailInput) => Promise<SendEmailResult>;
+export declare function createEmailSender(opts: CreateEmailSenderOptions): EmailSender;
+//# sourceMappingURL=email.d.ts.map

package/dist/email.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"email.d.ts","sourceRoot":"","sources":["../src/email.ts"],"names":[],"mappings":"AAUA,MAAM,MAAM,cAAc,GAAG;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACrC,uCAAuC;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,CAAC,KAAK,EAAE,cAAc,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;AAE9E,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,wBAAwB,GAAG,WAAW,CA6B7E"}

package/dist/secrets.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Fetch a secret value by ARN from Secrets Manager. Caches the resolved
+ * value for the lifetime of the Lambda container. If `arn` is undefined or
+ * empty, returns undefined -- consumer falls back to other config.
+ */
+export declare function getSecret(arn: string | undefined): Promise<string | undefined>;
+//# sourceMappingURL=secrets.d.ts.map

package/dist/secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../src/secrets.ts"],"names":[],"mappings":"AAgBA;;;;GAIG;AACH,wBAAsB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAQpF"}

package/dist/server.cjs

@@ -0,0 +1,166 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/server.ts
+var server_exports = {};
+__export(server_exports, {
+  associateSoftwareToken: () => associateSoftwareToken,
+  buildOtpAuthUri: () => buildOtpAuthUri,
+  changePassword: () => changePassword,
+  computeSecretHash: () => computeSecretHash,
+  createEmailSender: () => createEmailSender,
+  getSecret: () => getSecret,
+  regionFromIssuer: () => regionFromIssuer,
+  setUserMfaPreference: () => setUserMfaPreference,
+  verifySoftwareToken: () => verifySoftwareToken
+});
+module.exports = __toCommonJS(server_exports);
+
+// src/secrets.ts
+var import_client_secrets_manager = require("@aws-sdk/client-secrets-manager");
+var cache = /* @__PURE__ */ new Map();
+var client;
+function getClient() {
+  if (!client) client = new import_client_secrets_manager.SecretsManagerClient({});
+  return client;
+}
+async function getSecret(arn) {
+  if (!arn) return void 0;
+  const cached = cache.get(arn);
+  if (cached !== void 0) return cached;
+  const out = await getClient().send(new import_client_secrets_manager.GetSecretValueCommand({ SecretId: arn }));
+  const value = out.SecretString ?? "";
+  cache.set(arn, value);
+  return value;
+}
+
+// src/email.ts
+var import_client_sesv2 = require("@aws-sdk/client-sesv2");
+function createEmailSender(opts) {
+  if (!opts.fromAddress) {
+    throw new Error("[aws] createEmailSender requires `fromAddress`");
+  }
+  let client2;
+  const getClient3 = () => {
+    if (!client2) client2 = new import_client_sesv2.SESv2Client(opts.region ? { region: opts.region } : {});
+    return client2;
+  };
+  return async (input) => {
+    const command = new import_client_sesv2.SendEmailCommand({
+      FromEmailAddress: opts.fromAddress,
+      Destination: { ToAddresses: [input.to] },
+      Content: {
+        Simple: {
+          Subject: { Data: input.subject, Charset: "UTF-8" },
+          Body: {
+            Html: { Data: input.html, Charset: "UTF-8" },
+            Text: {
+              Data: input.text ?? stripHtml(input.html),
+              Charset: "UTF-8"
+            }
+          }
+        }
+      }
+    });
+    const res = await getClient3().send(command);
+    return { messageId: res.MessageId };
+  };
+}
+function stripHtml(html) {
+  return html.replace(/<style[\s\S]*?<\/style>/gi, "").replace(/<script[\s\S]*?<\/script>/gi, "").replace(/<[^>]+>/g, " ").replace(/\s+/g, " ").trim();
+}
+
+// src/cognito.ts
+var import_node_crypto = require("crypto");
+var import_client_cognito_identity_provider = require("@aws-sdk/client-cognito-identity-provider");
+var cachedClient;
+function getClient2(region) {
+  if (!cachedClient) {
+    cachedClient = new import_client_cognito_identity_provider.CognitoIdentityProviderClient(region ? { region } : {});
+  }
+  return cachedClient;
+}
+function regionFromIssuer(issuer) {
+  const m = issuer.match(/cognito-idp\.([^.]+)\.amazonaws\.com/);
+  if (!m?.[1]) {
+    throw new Error(`[aws/cognito] issuer not parseable for region: ${issuer}`);
+  }
+  return m[1];
+}
+function computeSecretHash(username, clientId, clientSecret) {
+  return (0, import_node_crypto.createHmac)("sha256", clientSecret).update(username + clientId).digest("base64");
+}
+async function associateSoftwareToken(args) {
+  const out = await getClient2(args.region).send(
+    new import_client_cognito_identity_provider.AssociateSoftwareTokenCommand({ AccessToken: args.accessToken })
+  );
+  if (!out.SecretCode) {
+    throw new Error("[aws/cognito] AssociateSoftwareToken returned no SecretCode");
+  }
+  return { secretCode: out.SecretCode };
+}
+async function verifySoftwareToken(args) {
+  const out = await getClient2(args.region).send(
+    new import_client_cognito_identity_provider.VerifySoftwareTokenCommand({
+      AccessToken: args.accessToken,
+      UserCode: args.code,
+      FriendlyDeviceName: args.friendlyDeviceName
+    })
+  );
+  return { status: out.Status ?? "UNKNOWN" };
+}
+async function setUserMfaPreference(args) {
+  await getClient2(args.region).send(
+    new import_client_cognito_identity_provider.SetUserMFAPreferenceCommand({
+      AccessToken: args.accessToken,
+      SoftwareTokenMfaSettings: {
+        Enabled: args.enabled,
+        PreferredMfa: args.enabled
+      }
+    })
+  );
+}
+async function changePassword(args) {
+  await getClient2(args.region).send(
+    new import_client_cognito_identity_provider.ChangePasswordCommand({
+      AccessToken: args.accessToken,
+      PreviousPassword: args.previousPassword,
+      ProposedPassword: args.proposedPassword
+    })
+  );
+}
+function buildOtpAuthUri(params) {
+  const issuer = encodeURIComponent(params.issuer);
+  const account = encodeURIComponent(params.accountName);
+  const secret = encodeURIComponent(params.secret);
+  return `otpauth://totp/${issuer}:${account}?secret=${secret}&issuer=${issuer}&algorithm=SHA1&digits=6&period=30`;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  associateSoftwareToken,
+  buildOtpAuthUri,
+  changePassword,
+  computeSecretHash,
+  createEmailSender,
+  getSecret,
+  regionFromIssuer,
+  setUserMfaPreference,
+  verifySoftwareToken
+});
+//# sourceMappingURL=server.cjs.map

package/dist/server.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server.ts","../src/secrets.ts","../src/email.ts","../src/cognito.ts"],"sourcesContent":["export { getSecret } from \"./secrets.js\";\nexport {\n  createEmailSender,\n  type EmailSender,\n  type SendEmailInput,\n  type SendEmailResult,\n  type CreateEmailSenderOptions,\n} from \"./email.js\";\nexport {\n  associateSoftwareToken,\n  verifySoftwareToken,\n  setUserMfaPreference,\n  changePassword,\n  computeSecretHash,\n  regionFromIssuer,\n  buildOtpAuthUri,\n} from \"./cognito.js\";\n","import {\n  SecretsManagerClient,\n  GetSecretValueCommand,\n} from \"@aws-sdk/client-secrets-manager\";\n\n// Module-scope cache. One Lambda container = one client + one cache map.\n// Container recycling flushes the cache, picking up rotated secrets without\n// redeploy.\nconst cache = new Map<string, string>();\nlet client: SecretsManagerClient | undefined;\n\nfunction getClient(): SecretsManagerClient {\n  if (!client) client = new SecretsManagerClient({});\n  return client;\n}\n\n/**\n * Fetch a secret value by ARN from Secrets Manager. Caches the resolved\n * value for the lifetime of the Lambda container. If `arn` is undefined or\n * empty, returns undefined -- consumer falls back to other config.\n */\nexport async function getSecret(arn: string | undefined): Promise<string | undefined> {\n  if (!arn) return undefined;\n  const cached = cache.get(arn);\n  if (cached !== undefined) return cached;\n  const out = await getClient().send(new GetSecretValueCommand({ SecretId: arn }));\n  const value = out.SecretString ?? \"\";\n  cache.set(arn, value);\n  return value;\n}\n","import { SESv2Client, SendEmailCommand } from \"@aws-sdk/client-sesv2\";\n\n// =============================================================================\n// SES v2 email sender.\n//\n// Each consuming app calls createEmailSender() with its own fromAddress (the\n// SES domain identity differs per tenant). The returned `sendEmail` function\n// is cached + ready for use.\n// =============================================================================\n\nexport type SendEmailInput = {\n  to: string;\n  subject: string;\n  html: string;\n  text?: string;\n};\n\nexport type SendEmailResult = {\n  messageId: string | undefined;\n};\n\nexport type CreateEmailSenderOptions = {\n  /** RFC 5322 from address. Required. */\n  fromAddress: string;\n  /** AWS region; defaults to the SDK's environment-derived region. */\n  region?: string;\n};\n\nexport type EmailSender = (input: SendEmailInput) => Promise<SendEmailResult>;\n\nexport function createEmailSender(opts: CreateEmailSenderOptions): EmailSender {\n  if (!opts.fromAddress) {\n    throw new Error(\"[aws] createEmailSender requires `fromAddress`\");\n  }\n  let client: SESv2Client | undefined;\n  const getClient = () => {\n    if (!client) client = new SESv2Client(opts.region ? { region: opts.region } : {});\n    return client;\n  };\n  return async (input) => {\n    const command = new SendEmailCommand({\n      FromEmailAddress: opts.fromAddress,\n      Destination: { ToAddresses: [input.to] },\n      Content: {\n        Simple: {\n          Subject: { Data: input.subject, Charset: \"UTF-8\" },\n          Body: {\n            Html: { Data: input.html, Charset: \"UTF-8\" },\n            Text: {\n              Data: input.text ?? stripHtml(input.html),\n              Charset: \"UTF-8\",\n            },\n          },\n        },\n      },\n    });\n    const res = await getClient().send(command);\n    return { messageId: res.MessageId };\n  };\n}\n\nfunction stripHtml(html: string): string {\n  return html\n    .replace(/<style[\\s\\S]*?<\\/style>/gi, \"\")\n    .replace(/<script[\\s\\S]*?<\\/script>/gi, \"\")\n    .replace(/<[^>]+>/g, \" \")\n    .replace(/\\s+/g, \" \")\n    .trim();\n}\n","import { createHmac } from \"node:crypto\";\nimport {\n  CognitoIdentityProviderClient,\n  AssociateSoftwareTokenCommand,\n  VerifySoftwareTokenCommand,\n  SetUserMFAPreferenceCommand,\n  ChangePasswordCommand,\n} from \"@aws-sdk/client-cognito-identity-provider\";\n\n// =============================================================================\n// Cognito Identity Provider wrappers.\n//\n// User-pool is provisioned by central infra. Per-user flows (TOTP enrollment,\n// password change) need the caller's *access token* -- no admin-* fallback\n// because that would require broad cognito:* IAM permissions on every Lambda.\n// =============================================================================\n\nlet cachedClient: CognitoIdentityProviderClient | undefined;\n\nfunction getClient(region?: string): CognitoIdentityProviderClient {\n  if (!cachedClient) {\n    cachedClient = new CognitoIdentityProviderClient(region ? { region } : {});\n  }\n  return cachedClient;\n}\n\n/**\n * Parse the Cognito region out of the issuer URL.\n *   issuer = https://cognito-idp.<region>.amazonaws.com/<pool>\n */\nexport function regionFromIssuer(issuer: string): string {\n  const m = issuer.match(/cognito-idp\\.([^.]+)\\.amazonaws\\.com/);\n  if (!m?.[1]) {\n    throw new Error(`[aws/cognito] issuer not parseable for region: ${issuer}`);\n  }\n  return m[1];\n}\n\n/**\n * SECRET_HASH for Cognito app clients that have a client secret. Only needed\n * for username+password flows like InitiateAuth -- the access-token-based\n * flows below don't use it.\n */\nexport function computeSecretHash(\n  username: string,\n  clientId: string,\n  clientSecret: string,\n): string {\n  return createHmac(\"sha256\", clientSecret)\n    .update(username + clientId)\n    .digest(\"base64\");\n}\n\nexport async function associateSoftwareToken(args: {\n  accessToken: string;\n  region?: string;\n}): Promise<{ secretCode: string }> {\n  const out = await getClient(args.region).send(\n    new AssociateSoftwareTokenCommand({ AccessToken: args.accessToken }),\n  );\n  if (!out.SecretCode) {\n    throw new Error(\"[aws/cognito] AssociateSoftwareToken returned no SecretCode\");\n  }\n  return { secretCode: out.SecretCode };\n}\n\nexport async function verifySoftwareToken(args: {\n  accessToken: string;\n  code: string;\n  friendlyDeviceName?: string;\n  region?: string;\n}): Promise<{ status: string }> {\n  const out = await getClient(args.region).send(\n    new VerifySoftwareTokenCommand({\n      AccessToken: args.accessToken,\n      UserCode: args.code,\n      FriendlyDeviceName: args.friendlyDeviceName,\n    }),\n  );\n  return { status: out.Status ?? \"UNKNOWN\" };\n}\n\nexport async function setUserMfaPreference(args: {\n  accessToken: string;\n  enabled: boolean;\n  region?: string;\n}): Promise<void> {\n  await getClient(args.region).send(\n    new SetUserMFAPreferenceCommand({\n      AccessToken: args.accessToken,\n      SoftwareTokenMfaSettings: {\n        Enabled: args.enabled,\n        PreferredMfa: args.enabled,\n      },\n    }),\n  );\n}\n\nexport async function changePassword(args: {\n  accessToken: string;\n  previousPassword: string;\n  proposedPassword: string;\n  region?: string;\n}): Promise<void> {\n  await getClient(args.region).send(\n    new ChangePasswordCommand({\n      AccessToken: args.accessToken,\n      PreviousPassword: args.previousPassword,\n      ProposedPassword: args.proposedPassword,\n    }),\n  );\n}\n\n/**\n * Build the otpauth:// URI an authenticator app expects. Caller turns this\n * into a QR code (data URL) before sending it to the browser.\n */\nexport function buildOtpAuthUri(params: {\n  secret: string;\n  accountName: string;\n  issuer: string;\n}): string {\n  const issuer = encodeURIComponent(params.issuer);\n  const account = encodeURIComponent(params.accountName);\n  const secret = encodeURIComponent(params.secret);\n  return `otpauth://totp/${issuer}:${account}?secret=${secret}&issuer=${issuer}&algorithm=SHA1&digits=6&period=30`;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,oCAGO;AAKP,IAAM,QAAQ,oBAAI,IAAoB;AACtC,IAAI;AAEJ,SAAS,YAAkC;AACzC,MAAI,CAAC,OAAQ,UAAS,IAAI,mDAAqB,CAAC,CAAC;AACjD,SAAO;AACT;AAOA,eAAsB,UAAU,KAAsD;AACpF,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,SAAS,MAAM,IAAI,GAAG;AAC5B,MAAI,WAAW,OAAW,QAAO;AACjC,QAAM,MAAM,MAAM,UAAU,EAAE,KAAK,IAAI,oDAAsB,EAAE,UAAU,IAAI,CAAC,CAAC;AAC/E,QAAM,QAAQ,IAAI,gBAAgB;AAClC,QAAM,IAAI,KAAK,KAAK;AACpB,SAAO;AACT;;;AC7BA,0BAA8C;AA8BvC,SAAS,kBAAkB,MAA6C;AAC7E,MAAI,CAAC,KAAK,aAAa;AACrB,UAAM,IAAI,MAAM,gDAAgD;AAAA,EAClE;AACA,MAAIA;AACJ,QAAMC,aAAY,MAAM;AACtB,QAAI,CAACD,QAAQ,CAAAA,UAAS,IAAI,gCAAY,KAAK,SAAS,EAAE,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC;AAChF,WAAOA;AAAA,EACT;AACA,SAAO,OAAO,UAAU;AACtB,UAAM,UAAU,IAAI,qCAAiB;AAAA,MACnC,kBAAkB,KAAK;AAAA,MACvB,aAAa,EAAE,aAAa,CAAC,MAAM,EAAE,EAAE;AAAA,MACvC,SAAS;AAAA,QACP,QAAQ;AAAA,UACN,SAAS,EAAE,MAAM,MAAM,SAAS,SAAS,QAAQ;AAAA,UACjD,MAAM;AAAA,YACJ,MAAM,EAAE,MAAM,MAAM,MAAM,SAAS,QAAQ;AAAA,YAC3C,MAAM;AAAA,cACJ,MAAM,MAAM,QAAQ,UAAU,MAAM,IAAI;AAAA,cACxC,SAAS;AAAA,YACX;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF,CAAC;AACD,UAAM,MAAM,MAAMC,WAAU,EAAE,KAAK,OAAO;AAC1C,WAAO,EAAE,WAAW,IAAI,UAAU;AAAA,EACpC;AACF;AAEA,SAAS,UAAU,MAAsB;AACvC,SAAO,KACJ,QAAQ,6BAA6B,EAAE,EACvC,QAAQ,+BAA+B,EAAE,EACzC,QAAQ,YAAY,GAAG,EACvB,QAAQ,QAAQ,GAAG,EACnB,KAAK;AACV;;;ACpEA,yBAA2B;AAC3B,8CAMO;AAUP,IAAI;AAEJ,SAASC,WAAU,QAAgD;AACjE,MAAI,CAAC,cAAc;AACjB,mBAAe,IAAI,sEAA8B,SAAS,EAAE,OAAO,IAAI,CAAC,CAAC;AAAA,EAC3E;AACA,SAAO;AACT;AAMO,SAAS,iBAAiB,QAAwB;AACvD,QAAM,IAAI,OAAO,MAAM,sCAAsC;AAC7D,MAAI,CAAC,IAAI,CAAC,GAAG;AACX,UAAM,IAAI,MAAM,kDAAkD,MAAM,EAAE;AAAA,EAC5E;AACA,SAAO,EAAE,CAAC;AACZ;AAOO,SAAS,kBACd,UACA,UACA,cACQ;AACR,aAAO,+BAAW,UAAU,YAAY,EACrC,OAAO,WAAW,QAAQ,EAC1B,OAAO,QAAQ;AACpB;AAEA,eAAsB,uBAAuB,MAGT;AAClC,QAAM,MAAM,MAAMA,WAAU,KAAK,MAAM,EAAE;AAAA,IACvC,IAAI,sEAA8B,EAAE,aAAa,KAAK,YAAY,CAAC;AAAA,EACrE;AACA,MAAI,CAAC,IAAI,YAAY;AACnB,UAAM,IAAI,MAAM,6DAA6D;AAAA,EAC/E;AACA,SAAO,EAAE,YAAY,IAAI,WAAW;AACtC;AAEA,eAAsB,oBAAoB,MAKV;AAC9B,QAAM,MAAM,MAAMA,WAAU,KAAK,MAAM,EAAE;AAAA,IACvC,IAAI,mEAA2B;AAAA,MAC7B,aAAa,KAAK;AAAA,MAClB,UAAU,KAAK;AAAA,MACf,oBAAoB,KAAK;AAAA,IAC3B,CAAC;AAAA,EACH;AACA,SAAO,EAAE,QAAQ,IAAI,UAAU,UAAU;AAC3C;AAEA,eAAsB,qBAAqB,MAIzB;AAChB,QAAMA,WAAU,KAAK,MAAM,EAAE;AAAA,IAC3B,IAAI,oEAA4B;AAAA,MAC9B,aAAa,KAAK;AAAA,MAClB,0BAA0B;AAAA,QACxB,SAAS,KAAK;AAAA,QACd,cAAc,KAAK;AAAA,MACrB;AAAA,IACF,CAAC;AAAA,EACH;AACF;AAEA,eAAsB,eAAe,MAKnB;AAChB,QAAMA,WAAU,KAAK,MAAM,EAAE;AAAA,IAC3B,IAAI,8DAAsB;AAAA,MACxB,aAAa,KAAK;AAAA,MAClB,kBAAkB,KAAK;AAAA,MACvB,kBAAkB,KAAK;AAAA,IACzB,CAAC;AAAA,EACH;AACF;AAMO,SAAS,gBAAgB,QAIrB;AACT,QAAM,SAAS,mBAAmB,OAAO,MAAM;AAC/C,QAAM,UAAU,mBAAmB,OAAO,WAAW;AACrD,QAAM,SAAS,mBAAmB,OAAO,MAAM;AAC/C,SAAO,kBAAkB,MAAM,IAAI,OAAO,WAAW,MAAM,WAAW,MAAM;AAC9E;","names":["client","getClient","getClient"]}

package/dist/server.d.ts

@@ -0,0 +1,4 @@
+export { getSecret } from "./secrets.js";
+export { createEmailSender, type EmailSender, type SendEmailInput, type SendEmailResult, type CreateEmailSenderOptions, } from "./email.js";
+export { associateSoftwareToken, verifySoftwareToken, setUserMfaPreference, changePassword, computeSecretHash, regionFromIssuer, buildOtpAuthUri, } from "./cognito.js";
+//# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EACL,iBAAiB,EACjB,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,wBAAwB,GAC9B,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,oBAAoB,EACpB,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,GAChB,MAAM,cAAc,CAAC"}

package/dist/server.js

@@ -0,0 +1,140 @@
+// src/secrets.ts
+import {
+  SecretsManagerClient,
+  GetSecretValueCommand
+} from "@aws-sdk/client-secrets-manager";
+var cache = /* @__PURE__ */ new Map();
+var client;
+function getClient() {
+  if (!client) client = new SecretsManagerClient({});
+  return client;
+}
+async function getSecret(arn) {
+  if (!arn) return void 0;
+  const cached = cache.get(arn);
+  if (cached !== void 0) return cached;
+  const out = await getClient().send(new GetSecretValueCommand({ SecretId: arn }));
+  const value = out.SecretString ?? "";
+  cache.set(arn, value);
+  return value;
+}
+
+// src/email.ts
+import { SESv2Client, SendEmailCommand } from "@aws-sdk/client-sesv2";
+function createEmailSender(opts) {
+  if (!opts.fromAddress) {
+    throw new Error("[aws] createEmailSender requires `fromAddress`");
+  }
+  let client2;
+  const getClient3 = () => {
+    if (!client2) client2 = new SESv2Client(opts.region ? { region: opts.region } : {});
+    return client2;
+  };
+  return async (input) => {
+    const command = new SendEmailCommand({
+      FromEmailAddress: opts.fromAddress,
+      Destination: { ToAddresses: [input.to] },
+      Content: {
+        Simple: {
+          Subject: { Data: input.subject, Charset: "UTF-8" },
+          Body: {
+            Html: { Data: input.html, Charset: "UTF-8" },
+            Text: {
+              Data: input.text ?? stripHtml(input.html),
+              Charset: "UTF-8"
+            }
+          }
+        }
+      }
+    });
+    const res = await getClient3().send(command);
+    return { messageId: res.MessageId };
+  };
+}
+function stripHtml(html) {
+  return html.replace(/<style[\s\S]*?<\/style>/gi, "").replace(/<script[\s\S]*?<\/script>/gi, "").replace(/<[^>]+>/g, " ").replace(/\s+/g, " ").trim();
+}
+
+// src/cognito.ts
+import { createHmac } from "crypto";
+import {
+  CognitoIdentityProviderClient,
+  AssociateSoftwareTokenCommand,
+  VerifySoftwareTokenCommand,
+  SetUserMFAPreferenceCommand,
+  ChangePasswordCommand
+} from "@aws-sdk/client-cognito-identity-provider";
+var cachedClient;
+function getClient2(region) {
+  if (!cachedClient) {
+    cachedClient = new CognitoIdentityProviderClient(region ? { region } : {});
+  }
+  return cachedClient;
+}
+function regionFromIssuer(issuer) {
+  const m = issuer.match(/cognito-idp\.([^.]+)\.amazonaws\.com/);
+  if (!m?.[1]) {
+    throw new Error(`[aws/cognito] issuer not parseable for region: ${issuer}`);
+  }
+  return m[1];
+}
+function computeSecretHash(username, clientId, clientSecret) {
+  return createHmac("sha256", clientSecret).update(username + clientId).digest("base64");
+}
+async function associateSoftwareToken(args) {
+  const out = await getClient2(args.region).send(
+    new AssociateSoftwareTokenCommand({ AccessToken: args.accessToken })
+  );
+  if (!out.SecretCode) {
+    throw new Error("[aws/cognito] AssociateSoftwareToken returned no SecretCode");
+  }
+  return { secretCode: out.SecretCode };
+}
+async function verifySoftwareToken(args) {
+  const out = await getClient2(args.region).send(
+    new VerifySoftwareTokenCommand({
+      AccessToken: args.accessToken,
+      UserCode: args.code,
+      FriendlyDeviceName: args.friendlyDeviceName
+    })
+  );
+  return { status: out.Status ?? "UNKNOWN" };
+}
+async function setUserMfaPreference(args) {
+  await getClient2(args.region).send(
+    new SetUserMFAPreferenceCommand({
+      AccessToken: args.accessToken,
+      SoftwareTokenMfaSettings: {
+        Enabled: args.enabled,
+        PreferredMfa: args.enabled
+      }
+    })
+  );
+}
+async function changePassword(args) {
+  await getClient2(args.region).send(
+    new ChangePasswordCommand({
+      AccessToken: args.accessToken,
+      PreviousPassword: args.previousPassword,
+      ProposedPassword: args.proposedPassword
+    })
+  );
+}
+function buildOtpAuthUri(params) {
+  const issuer = encodeURIComponent(params.issuer);
+  const account = encodeURIComponent(params.accountName);
+  const secret = encodeURIComponent(params.secret);
+  return `otpauth://totp/${issuer}:${account}?secret=${secret}&issuer=${issuer}&algorithm=SHA1&digits=6&period=30`;
+}
+export {
+  associateSoftwareToken,
+  buildOtpAuthUri,
+  changePassword,
+  computeSecretHash,
+  createEmailSender,
+  getSecret,
+  regionFromIssuer,
+  setUserMfaPreference,
+  verifySoftwareToken
+};
+//# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/secrets.ts","../src/email.ts","../src/cognito.ts"],"sourcesContent":["import {\n  SecretsManagerClient,\n  GetSecretValueCommand,\n} from \"@aws-sdk/client-secrets-manager\";\n\n// Module-scope cache. One Lambda container = one client + one cache map.\n// Container recycling flushes the cache, picking up rotated secrets without\n// redeploy.\nconst cache = new Map<string, string>();\nlet client: SecretsManagerClient | undefined;\n\nfunction getClient(): SecretsManagerClient {\n  if (!client) client = new SecretsManagerClient({});\n  return client;\n}\n\n/**\n * Fetch a secret value by ARN from Secrets Manager. Caches the resolved\n * value for the lifetime of the Lambda container. If `arn` is undefined or\n * empty, returns undefined -- consumer falls back to other config.\n */\nexport async function getSecret(arn: string | undefined): Promise<string | undefined> {\n  if (!arn) return undefined;\n  const cached = cache.get(arn);\n  if (cached !== undefined) return cached;\n  const out = await getClient().send(new GetSecretValueCommand({ SecretId: arn }));\n  const value = out.SecretString ?? \"\";\n  cache.set(arn, value);\n  return value;\n}\n","import { SESv2Client, SendEmailCommand } from \"@aws-sdk/client-sesv2\";\n\n// =============================================================================\n// SES v2 email sender.\n//\n// Each consuming app calls createEmailSender() with its own fromAddress (the\n// SES domain identity differs per tenant). The returned `sendEmail` function\n// is cached + ready for use.\n// =============================================================================\n\nexport type SendEmailInput = {\n  to: string;\n  subject: string;\n  html: string;\n  text?: string;\n};\n\nexport type SendEmailResult = {\n  messageId: string | undefined;\n};\n\nexport type CreateEmailSenderOptions = {\n  /** RFC 5322 from address. Required. */\n  fromAddress: string;\n  /** AWS region; defaults to the SDK's environment-derived region. */\n  region?: string;\n};\n\nexport type EmailSender = (input: SendEmailInput) => Promise<SendEmailResult>;\n\nexport function createEmailSender(opts: CreateEmailSenderOptions): EmailSender {\n  if (!opts.fromAddress) {\n    throw new Error(\"[aws] createEmailSender requires `fromAddress`\");\n  }\n  let client: SESv2Client | undefined;\n  const getClient = () => {\n    if (!client) client = new SESv2Client(opts.region ? { region: opts.region } : {});\n    return client;\n  };\n  return async (input) => {\n    const command = new SendEmailCommand({\n      FromEmailAddress: opts.fromAddress,\n      Destination: { ToAddresses: [input.to] },\n      Content: {\n        Simple: {\n          Subject: { Data: input.subject, Charset: \"UTF-8\" },\n          Body: {\n            Html: { Data: input.html, Charset: \"UTF-8\" },\n            Text: {\n              Data: input.text ?? stripHtml(input.html),\n              Charset: \"UTF-8\",\n            },\n          },\n        },\n      },\n    });\n    const res = await getClient().send(command);\n    return { messageId: res.MessageId };\n  };\n}\n\nfunction stripHtml(html: string): string {\n  return html\n    .replace(/<style[\\s\\S]*?<\\/style>/gi, \"\")\n    .replace(/<script[\\s\\S]*?<\\/script>/gi, \"\")\n    .replace(/<[^>]+>/g, \" \")\n    .replace(/\\s+/g, \" \")\n    .trim();\n}\n","import { createHmac } from \"node:crypto\";\nimport {\n  CognitoIdentityProviderClient,\n  AssociateSoftwareTokenCommand,\n  VerifySoftwareTokenCommand,\n  SetUserMFAPreferenceCommand,\n  ChangePasswordCommand,\n} from \"@aws-sdk/client-cognito-identity-provider\";\n\n// =============================================================================\n// Cognito Identity Provider wrappers.\n//\n// User-pool is provisioned by central infra. Per-user flows (TOTP enrollment,\n// password change) need the caller's *access token* -- no admin-* fallback\n// because that would require broad cognito:* IAM permissions on every Lambda.\n// =============================================================================\n\nlet cachedClient: CognitoIdentityProviderClient | undefined;\n\nfunction getClient(region?: string): CognitoIdentityProviderClient {\n  if (!cachedClient) {\n    cachedClient = new CognitoIdentityProviderClient(region ? { region } : {});\n  }\n  return cachedClient;\n}\n\n/**\n * Parse the Cognito region out of the issuer URL.\n *   issuer = https://cognito-idp.<region>.amazonaws.com/<pool>\n */\nexport function regionFromIssuer(issuer: string): string {\n  const m = issuer.match(/cognito-idp\\.([^.]+)\\.amazonaws\\.com/);\n  if (!m?.[1]) {\n    throw new Error(`[aws/cognito] issuer not parseable for region: ${issuer}`);\n  }\n  return m[1];\n}\n\n/**\n * SECRET_HASH for Cognito app clients that have a client secret. Only needed\n * for username+password flows like InitiateAuth -- the access-token-based\n * flows below don't use it.\n */\nexport function computeSecretHash(\n  username: string,\n  clientId: string,\n  clientSecret: string,\n): string {\n  return createHmac(\"sha256\", clientSecret)\n    .update(username + clientId)\n    .digest(\"base64\");\n}\n\nexport async function associateSoftwareToken(args: {\n  accessToken: string;\n  region?: string;\n}): Promise<{ secretCode: string }> {\n  const out = await getClient(args.region).send(\n    new AssociateSoftwareTokenCommand({ AccessToken: args.accessToken }),\n  );\n  if (!out.SecretCode) {\n    throw new Error(\"[aws/cognito] AssociateSoftwareToken returned no SecretCode\");\n  }\n  return { secretCode: out.SecretCode };\n}\n\nexport async function verifySoftwareToken(args: {\n  accessToken: string;\n  code: string;\n  friendlyDeviceName?: string;\n  region?: string;\n}): Promise<{ status: string }> {\n  const out = await getClient(args.region).send(\n    new VerifySoftwareTokenCommand({\n      AccessToken: args.accessToken,\n      UserCode: args.code,\n      FriendlyDeviceName: args.friendlyDeviceName,\n    }),\n  );\n  return { status: out.Status ?? \"UNKNOWN\" };\n}\n\nexport async function setUserMfaPreference(args: {\n  accessToken: string;\n  enabled: boolean;\n  region?: string;\n}): Promise<void> {\n  await getClient(args.region).send(\n    new SetUserMFAPreferenceCommand({\n      AccessToken: args.accessToken,\n      SoftwareTokenMfaSettings: {\n        Enabled: args.enabled,\n        PreferredMfa: args.enabled,\n      },\n    }),\n  );\n}\n\nexport async function changePassword(args: {\n  accessToken: string;\n  previousPassword: string;\n  proposedPassword: string;\n  region?: string;\n}): Promise<void> {\n  await getClient(args.region).send(\n    new ChangePasswordCommand({\n      AccessToken: args.accessToken,\n      PreviousPassword: args.previousPassword,\n      ProposedPassword: args.proposedPassword,\n    }),\n  );\n}\n\n/**\n * Build the otpauth:// URI an authenticator app expects. Caller turns this\n * into a QR code (data URL) before sending it to the browser.\n */\nexport function buildOtpAuthUri(params: {\n  secret: string;\n  accountName: string;\n  issuer: string;\n}): string {\n  const issuer = encodeURIComponent(params.issuer);\n  const account = encodeURIComponent(params.accountName);\n  const secret = encodeURIComponent(params.secret);\n  return `otpauth://totp/${issuer}:${account}?secret=${secret}&issuer=${issuer}&algorithm=SHA1&digits=6&period=30`;\n}\n"],"mappings":";AAAA;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAKP,IAAM,QAAQ,oBAAI,IAAoB;AACtC,IAAI;AAEJ,SAAS,YAAkC;AACzC,MAAI,CAAC,OAAQ,UAAS,IAAI,qBAAqB,CAAC,CAAC;AACjD,SAAO;AACT;AAOA,eAAsB,UAAU,KAAsD;AACpF,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,SAAS,MAAM,IAAI,GAAG;AAC5B,MAAI,WAAW,OAAW,QAAO;AACjC,QAAM,MAAM,MAAM,UAAU,EAAE,KAAK,IAAI,sBAAsB,EAAE,UAAU,IAAI,CAAC,CAAC;AAC/E,QAAM,QAAQ,IAAI,gBAAgB;AAClC,QAAM,IAAI,KAAK,KAAK;AACpB,SAAO;AACT;;;AC7BA,SAAS,aAAa,wBAAwB;AA8BvC,SAAS,kBAAkB,MAA6C;AAC7E,MAAI,CAAC,KAAK,aAAa;AACrB,UAAM,IAAI,MAAM,gDAAgD;AAAA,EAClE;AACA,MAAIA;AACJ,QAAMC,aAAY,MAAM;AACtB,QAAI,CAACD,QAAQ,CAAAA,UAAS,IAAI,YAAY,KAAK,SAAS,EAAE,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC;AAChF,WAAOA;AAAA,EACT;AACA,SAAO,OAAO,UAAU;AACtB,UAAM,UAAU,IAAI,iBAAiB;AAAA,MACnC,kBAAkB,KAAK;AAAA,MACvB,aAAa,EAAE,aAAa,CAAC,MAAM,EAAE,EAAE;AAAA,MACvC,SAAS;AAAA,QACP,QAAQ;AAAA,UACN,SAAS,EAAE,MAAM,MAAM,SAAS,SAAS,QAAQ;AAAA,UACjD,MAAM;AAAA,YACJ,MAAM,EAAE,MAAM,MAAM,MAAM,SAAS,QAAQ;AAAA,YAC3C,MAAM;AAAA,cACJ,MAAM,MAAM,QAAQ,UAAU,MAAM,IAAI;AAAA,cACxC,SAAS;AAAA,YACX;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF,CAAC;AACD,UAAM,MAAM,MAAMC,WAAU,EAAE,KAAK,OAAO;AAC1C,WAAO,EAAE,WAAW,IAAI,UAAU;AAAA,EACpC;AACF;AAEA,SAAS,UAAU,MAAsB;AACvC,SAAO,KACJ,QAAQ,6BAA6B,EAAE,EACvC,QAAQ,+BAA+B,EAAE,EACzC,QAAQ,YAAY,GAAG,EACvB,QAAQ,QAAQ,GAAG,EACnB,KAAK;AACV;;;ACpEA,SAAS,kBAAkB;AAC3B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAUP,IAAI;AAEJ,SAASC,WAAU,QAAgD;AACjE,MAAI,CAAC,cAAc;AACjB,mBAAe,IAAI,8BAA8B,SAAS,EAAE,OAAO,IAAI,CAAC,CAAC;AAAA,EAC3E;AACA,SAAO;AACT;AAMO,SAAS,iBAAiB,QAAwB;AACvD,QAAM,IAAI,OAAO,MAAM,sCAAsC;AAC7D,MAAI,CAAC,IAAI,CAAC,GAAG;AACX,UAAM,IAAI,MAAM,kDAAkD,MAAM,EAAE;AAAA,EAC5E;AACA,SAAO,EAAE,CAAC;AACZ;AAOO,SAAS,kBACd,UACA,UACA,cACQ;AACR,SAAO,WAAW,UAAU,YAAY,EACrC,OAAO,WAAW,QAAQ,EAC1B,OAAO,QAAQ;AACpB;AAEA,eAAsB,uBAAuB,MAGT;AAClC,QAAM,MAAM,MAAMA,WAAU,KAAK,MAAM,EAAE;AAAA,IACvC,IAAI,8BAA8B,EAAE,aAAa,KAAK,YAAY,CAAC;AAAA,EACrE;AACA,MAAI,CAAC,IAAI,YAAY;AACnB,UAAM,IAAI,MAAM,6DAA6D;AAAA,EAC/E;AACA,SAAO,EAAE,YAAY,IAAI,WAAW;AACtC;AAEA,eAAsB,oBAAoB,MAKV;AAC9B,QAAM,MAAM,MAAMA,WAAU,KAAK,MAAM,EAAE;AAAA,IACvC,IAAI,2BAA2B;AAAA,MAC7B,aAAa,KAAK;AAAA,MAClB,UAAU,KAAK;AAAA,MACf,oBAAoB,KAAK;AAAA,IAC3B,CAAC;AAAA,EACH;AACA,SAAO,EAAE,QAAQ,IAAI,UAAU,UAAU;AAC3C;AAEA,eAAsB,qBAAqB,MAIzB;AAChB,QAAMA,WAAU,KAAK,MAAM,EAAE;AAAA,IAC3B,IAAI,4BAA4B;AAAA,MAC9B,aAAa,KAAK;AAAA,MAClB,0BAA0B;AAAA,QACxB,SAAS,KAAK;AAAA,QACd,cAAc,KAAK;AAAA,MACrB;AAAA,IACF,CAAC;AAAA,EACH;AACF;AAEA,eAAsB,eAAe,MAKnB;AAChB,QAAMA,WAAU,KAAK,MAAM,EAAE;AAAA,IAC3B,IAAI,sBAAsB;AAAA,MACxB,aAAa,KAAK;AAAA,MAClB,kBAAkB,KAAK;AAAA,MACvB,kBAAkB,KAAK;AAAA,IACzB,CAAC;AAAA,EACH;AACF;AAMO,SAAS,gBAAgB,QAIrB;AACT,QAAM,SAAS,mBAAmB,OAAO,MAAM;AAC/C,QAAM,UAAU,mBAAmB,OAAO,WAAW;AACrD,QAAM,SAAS,mBAAmB,OAAO,MAAM;AAC/C,SAAO,kBAAkB,MAAM,IAAI,OAAO,WAAW,MAAM,WAAW,MAAM;AAC9E;","names":["client","getClient","getClient"]}

package/package.json

@@ -0,0 +1,39 @@
+{
+  "name": "@augmenting-integrations/aws",
+  "version": "0.0.1",
+  "description": "AWS SDK wrappers for the augint platform: SecretsManager value cache, SES v2 email sender, Cognito IDP per-user flows (TOTP enrollment, password change). All server-only.",
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  },
+  "sideEffects": false,
+  "main": "./dist/server.cjs",
+  "module": "./dist/server.js",
+  "types": "./dist/server.d.ts",
+  "exports": {
+    "./server": {
+      "types": "./dist/server.d.ts",
+      "import": "./dist/server.js",
+      "require": "./dist/server.cjs"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "tsup",
+    "clean": "rm -rf dist",
+    "test": "vitest run --passWithNoTests"
+  },
+  "dependencies": {
+    "@aws-sdk/client-secrets-manager": "^3.700.0",
+    "@aws-sdk/client-sesv2": "^3.700.0",
+    "@aws-sdk/client-cognito-identity-provider": "^3.700.0"
+  },
+  "devDependencies": {
+    "tsup": "^8.3.5",
+    "typescript": "^5.7.2",
+    "vitest": "^4.1.5"
+  }
+}