@augmenting-integrations/create-spoke 8.3.0 → 8.4.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Augmenting Integrations LLC
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,41 @@
+# @augmenting-integrations/create-spoke
+
+Scaffold a new product subdomain (spoke) for an augint-\* tenant.
+
+```bash
+pnpm dlx @augmenting-integrations/create-spoke my-spoke
+pnpm dlx @augmenting-integrations/create-spoke my-spoke --subdomain=foo --slug=bar
+```
+
+## What gets generated
+
+A Next.js 16 + Auth.js v5 app pre-wired for the augint tenant ecosystem:
+
+- `loadTenantConfig({ role: "spoke" })` in `src/lib/auth.ts` (single env-var read)
+- `<TenantBootScript>` + `<TenantProvider>` mounted in the root layout
+- Library-owned route handlers for `/api/auth/me`, `/api/billing/*`,
+  `/api/invitations/[token]`, and `/api/admin/users/[id]/impersonate` —
+  each is a 2-line re-export from `@augmenting-integrations/auth/server` or
+  `@augmenting-integrations/billing/server`
+- Canonical Prisma fragments (`User`, `Invitation`, `PaymentMethod`,
+  `CreditTransaction`, `ActivityLog`) in `prisma/schema.prisma` — your
+  product models live below the marker comment
+- `prisma/seed.mjs` with the `STAGE=staging` gate so seeds never fire
+  against a production database
+
+## What you still have to do per-tenant
+
+The generated app is portable; the AWS infra around it is per-tenant:
+
+- Provision your tenant's Cognito user pool, hosted zone, app registry
+  table, secrets, GitHub OIDC role (copy `template.yaml` from an existing
+  spoke in the same tenant — see `augint-example-leads-marketplace` for
+  the reference).
+- Register this spoke in the apex's DynamoDB app registry (slug, subdomain,
+  displayName, navOrder) so it shows up in every other spoke's AppShell.
+
+## Bringing your product
+
+The kernel ships only auth/billing/admin route handlers. Product routes
+(`/api/leads`, `/api/quotes`, `/api/widgets`) are yours to design under
+`src/app/api/`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@augmenting-integrations/create-spoke",
-  "version": "8.3.0",
+  "version": "8.4.1",
   "description": "Scaffold a new product subdomain (spoke) for an augint-* tenant. Generates a Next 16 + Auth.js v5 app with TenantConfig wired up, library-owned route handlers, a Prisma canonical schema fragment, and a deployable template.yaml + GitHub workflow. Single command: pnpm dlx @augmenting-integrations/create-spoke my-spoke.",
   "license": "MIT",
   "publishConfig": {
@@ -15,15 +15,15 @@
     "templates",
     "README.md"
   ],
-  "scripts": {
-    "build": "tsup",
-    "clean": "rm -rf dist",
-    "test": "vitest run --passWithNoTests"
-  },
   "devDependencies": {
     "@types/node": "^22.0.0",
     "tsup": "^8.3.5",
     "typescript": "^5.7.2",
     "vitest": "^4.1.5"
+  },
+  "scripts": {
+    "build": "tsup",
+    "clean": "rm -rf dist",
+    "test": "vitest run --passWithNoTests"
   }
-}
+}

package/templates/.env.example.tmpl

@@ -1,25 +0,0 @@
-# Tenant identity (everything else flows from these)
-APP_DOMAIN=__SPOKE_SUBDOMAIN__.tenant.example.com
-APP_SLUG=__SPOKE_SLUG__
-APEX_DOMAIN=tenant.example.com
-AUTH_COOKIE_DOMAIN=.tenant.example.com
-AUTH_ALLOWED_PARENT_DOMAIN=.tenant.example.com
-
-# AWS resources (typically pulled from SSM in deployed Lambda; local dev only)
-AWS_REGION=us-east-1
-AUTH_SECRET_ARN=
-AUTH_COGNITO_ID=
-AUTH_COGNITO_ISSUER=
-DB_SECRET_ARN=
-DB_HOST=
-DB_NAME=
-APP_REGISTRY_TABLE=
-STRIPE_SECRET_ARN=
-STRIPE_WEBHOOK_SECRET_ARN=
-
-# Comma-separated emails auto-promoted to role=admin on first sign-in
-ADMIN_EMAILS=
-
-# Local-dev fallback for testing without Secrets Manager
-AUTH_SECRET=dev-only-fallback-not-for-prod
-NODE_ENV=development