@augmenting-integrations/create-tenant 8.3.0 → 8.4.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Augmenting Integrations LLC
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,42 @@
+# @augmenting-integrations/create-tenant
+
+Scaffold a new tenant apex app for an augint deployment.
+
+```bash
+pnpm dlx @augmenting-integrations/create-tenant acme --apex=acme.com
+```
+
+## What gets generated
+
+The Next.js 16 apex for a new tenant — the single OAuth broker and the
+home of the app registry:
+
+- `/api/auth/[...nextauth]` — the ONLY Cognito callback in the tenant
+  ecosystem; sets the parent-domain session cookie
+- `/api/apps` — registry auto-discovery handler that every spoke's AppShell
+  fetches to render cross-app navigation
+- `/login` — Cognito sign-in entry point (spokes redirect here)
+- `loadTenantConfig({ role: "apex" })` + `<TenantBootScript>` +
+  `<TenantProvider>` so spokes see the same tenant struct
+
+## What you still have to do per-tenant
+
+The generated app is portable; the AWS infra is not:
+
+1. AWS account (staging + prod, separate)
+2. Cognito user pool + one App Client with ONE callback URL:
+   `https://<your-apex>/api/auth/callback/cognito`
+3. Hosted zone + cert for `<your-apex>` and `*.<your-apex>`
+4. App registry DynamoDB table (PK = `slug`); set `APP_REGISTRY_TABLE`
+5. Secrets Manager rows for `AUTH_SECRET`, `AUTH_COGNITO_SECRET`
+6. GitHub OIDC role in each AWS account
+7. SAM `template.yaml` (copy from an existing apex like
+   `augint-example-web` and adapt)
+
+## Adding spokes after the apex exists
+
+```bash
+pnpm dlx @augmenting-integrations/create-spoke my-product-spoke
+```
+
+Then register the spoke in this apex's DynamoDB app registry table.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@augmenting-integrations/create-tenant",
-  "version": "8.3.0",
+  "version": "8.4.1",
   "description": "Scaffold a new tenant apex app for an augint deployment. Generates a Next 16 + Auth.js v5 + Cognito apex with TenantConfig wired up, library-owned /api/apps registry handler, and /studio admin. Single command: pnpm dlx @augmenting-integrations/create-tenant my-tenant.",
   "license": "MIT",
   "publishConfig": {
@@ -15,15 +15,15 @@
     "templates",
     "README.md"
   ],
-  "scripts": {
-    "build": "tsup",
-    "clean": "rm -rf dist",
-    "test": "vitest run --passWithNoTests"
-  },
   "devDependencies": {
     "@types/node": "^22.0.0",
     "tsup": "^8.3.5",
     "typescript": "^5.7.2",
     "vitest": "^4.1.5"
+  },
+  "scripts": {
+    "build": "tsup",
+    "clean": "rm -rf dist",
+    "test": "vitest run --passWithNoTests"
   }
-}
+}

package/templates/.env.example.tmpl

@@ -1,22 +0,0 @@
-APP_DOMAIN=__TENANT_APEX__
-APEX_DOMAIN=__TENANT_APEX__
-AUTH_COOKIE_DOMAIN=__TENANT_PARENT__
-AUTH_ALLOWED_PARENT_DOMAIN=__TENANT_PARENT__
-
-# Cognito (apex-only; from your tenant infra stack)
-AUTH_SECRET_ARN=
-AUTH_COGNITO_SECRET_ARN=
-AUTH_COGNITO_ID=
-AUTH_COGNITO_ISSUER=
-
-# App registry DynamoDB table (apex owns CRUD; spokes read)
-APP_REGISTRY_TABLE=
-TENANT_SLUG=__TENANT_NAME__
-STAGE=staging
-
-AWS_REGION=us-east-1
-ADMIN_EMAILS=
-
-# Local-dev fallbacks
-AUTH_SECRET=dev-only-fallback-not-for-prod
-NODE_ENV=development