@augmenting-integrations/create-tenant 8.4.1 → 8.5.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@augmenting-integrations/create-tenant",
-  "version": "8.4.1",
+  "version": "8.5.0",
   "description": "Scaffold a new tenant apex app for an augint deployment. Generates a Next 16 + Auth.js v5 + Cognito apex with TenantConfig wired up, library-owned /api/apps registry handler, and /studio admin. Single command: pnpm dlx @augmenting-integrations/create-tenant my-tenant.",
   "license": "MIT",
   "publishConfig": {

package/templates/app.manifest.json.tmpl

@@ -0,0 +1,22 @@
+{
+  "schemaVersion": 1,
+  "tenantSlug": "__TENANT_NAME__",
+  "appSlug": "apex",
+  "role": "apex",
+  "subdomain": "",
+  "displayName": "__TENANT_NAME__ Portal",
+  "navOrder": 0,
+  "access": {
+    "requiredIdentityGroups": []
+  },
+  "features": {
+    "billing": false,
+    "settings": true,
+    "invitations": false,
+    "impersonation": true
+  },
+  "dataPlane": {
+    "type": "none",
+    "migrations": false
+  }
+}

package/templates/package.json.tmpl

@@ -14,6 +14,7 @@
     "@augmenting-integrations/auth": "^8.0.0",
     "@augmenting-integrations/aws": "^8.0.0",
     "@augmenting-integrations/brand": "^8.0.0",
+    "@augmenting-integrations/platform": "^8.0.0",
     "@augmenting-integrations/registry": "^8.0.0",
     "@augmenting-integrations/themes": "^8.0.0",
     "@augmenting-integrations/ui": "^8.0.0",

package/templates/src/app/Providers.tsx.tmpl

@@ -6,7 +6,7 @@ import { SessionProvider } from "@augmenting-integrations/ui";
 import {
   TenantProvider,
   type TenantPublicConfig,
-} from "@augmenting-integrations/auth/client";
+} from "@augmenting-integrations/platform/client";
 
 export function Providers({
   children,

package/templates/src/app/layout.tsx.tmpl

@@ -5,7 +5,7 @@ import {
   THEME_VARIANT_COOKIE_KEY,
 } from "@augmenting-integrations/themes";
 import { ThemeBootScript } from "@augmenting-integrations/ui";
-import { TenantBootScript, publicSubset } from "@augmenting-integrations/auth/server";
+import { TenantBootScript, publicSubset } from "@augmenting-integrations/platform/server";
 import { auth, tenant } from "@/lib/auth";
 import { Providers } from "./Providers";
 import "./globals.css";

package/templates/src/lib/auth.ts.tmpl

@@ -1,5 +1,19 @@
-import { createAuth, loadTenantConfig } from "@augmenting-integrations/auth/server";
+import { createAuth } from "@augmenting-integrations/auth/server";
+import { loadTenantConfig } from "@augmenting-integrations/platform/server";
+import { validateManifest } from "@augmenting-integrations/platform/manifest";
 import { getSecret } from "@augmenting-integrations/aws/server";
+import manifestJson from "../../app.manifest.json";
+
+// app.manifest.json is the local source of truth for slug / subdomain /
+// access policy / feature enablement. Validate at module init so a bad
+// manifest fails the deploy loudly with the field-by-field error list.
+const manifestResult = validateManifest(manifestJson);
+if (!manifestResult.ok) {
+  throw new Error(
+    `app.manifest.json failed validation: ${manifestResult.errors.map((e) => `${e.path}: ${e.message}`).join("; ")}`,
+  );
+}
+export const manifest = manifestResult.value;
 
 // Single tenant configuration source.
 export const tenant = loadTenantConfig({ role: "apex" });
@@ -17,4 +31,7 @@ export const { handlers, auth, signIn, signOut } = createAuth({
   authedRoutePrefixes: ["/home", "/studio"],
   authSecret,
   cognitoClientSecret: cognitoClientSecretRaw,
+  appAccess: {
+    requiredIdentityGroups: manifest.access.requiredIdentityGroups,
+  },
 });