thinkwork-cli 0.1.0 → 0.2.0

package/dist/terraform/modules/thinkwork/outputs.tf

@@ -0,0 +1,87 @@
+################################################################################
+# Thinkwork Composite Root — Outputs
+################################################################################
+
+# Foundation
+output "vpc_id" {
+  value = module.vpc.vpc_id
+}
+
+output "user_pool_id" {
+  value = module.cognito.user_pool_id
+}
+
+output "admin_client_id" {
+  value = module.cognito.admin_client_id
+}
+
+output "mobile_client_id" {
+  value = module.cognito.mobile_client_id
+}
+
+output "identity_pool_id" {
+  value = module.cognito.identity_pool_id
+}
+
+output "kms_key_arn" {
+  value = module.kms.key_arn
+}
+
+# Data
+output "db_cluster_arn" {
+  value = module.database.db_cluster_arn
+}
+
+output "db_cluster_endpoint" {
+  value = module.database.cluster_endpoint
+}
+
+output "db_secret_arn" {
+  description = "Secrets Manager ARN for database credentials"
+  value       = module.database.graphql_db_secret_arn
+}
+
+output "database_name" {
+  description = "Database name"
+  value       = var.database_name
+}
+
+output "bucket_name" {
+  value = module.s3.bucket_name
+}
+
+output "kb_service_role_arn" {
+  value = module.bedrock_kb.kb_service_role_arn
+}
+
+# App
+output "api_endpoint" {
+  value = module.api.api_endpoint
+}
+
+output "appsync_api_url" {
+  value = module.appsync.graphql_api_url
+}
+
+output "appsync_realtime_url" {
+  value = module.appsync.graphql_realtime_url
+}
+
+output "appsync_api_key" {
+  value     = module.appsync.graphql_api_key
+  sensitive = true
+}
+
+output "ecr_repository_url" {
+  value = module.agentcore.ecr_repository_url
+}
+
+output "memory_engine" {
+  description = "Which memory engine is active (managed or hindsight)"
+  value       = var.memory_engine
+}
+
+output "hindsight_endpoint" {
+  description = "Hindsight API endpoint (only when memory_engine = hindsight)"
+  value       = var.memory_engine == "hindsight" ? module.hindsight[0].hindsight_endpoint : null
+}

package/dist/terraform/modules/thinkwork/variables.tf

@@ -0,0 +1,241 @@
+################################################################################
+# Thinkwork Composite Root — Variables
+#
+# This is the friendly front door: `thinkwork-ai/thinkwork/aws` on the
+# Terraform Registry. It wires the three tiers (foundation, data, app)
+# together with sensible defaults. Advanced users can compose sub-modules
+# directly instead.
+################################################################################
+
+# ---------------------------------------------------------------------------
+# Required
+# ---------------------------------------------------------------------------
+
+variable "stage" {
+  description = "Deployment stage (e.g. dev, prod). Must match the Terraform workspace name."
+  type        = string
+}
+
+variable "region" {
+  description = "AWS region"
+  type        = string
+  default     = "us-east-1"
+}
+
+variable "account_id" {
+  description = "AWS account ID"
+  type        = string
+}
+
+# ---------------------------------------------------------------------------
+# Secrets (populate via SSM data sources or tfvars)
+# ---------------------------------------------------------------------------
+
+variable "db_password" {
+  description = "Master password for the Aurora cluster"
+  type        = string
+  sensitive   = true
+}
+
+variable "google_oauth_client_id" {
+  description = "Google OAuth client ID for Cognito social login (optional)"
+  type        = string
+  default     = ""
+}
+
+variable "google_oauth_client_secret" {
+  description = "Google OAuth client secret"
+  type        = string
+  sensitive   = true
+  default     = ""
+}
+
+# ---------------------------------------------------------------------------
+# BYO Foundation (all optional — defaults to creating everything)
+# ---------------------------------------------------------------------------
+
+variable "create_vpc" {
+  description = "Create a new VPC (false = BYO)"
+  type        = bool
+  default     = true
+}
+
+variable "existing_vpc_id" {
+  type    = string
+  default = null
+}
+
+variable "existing_public_subnet_ids" {
+  type    = list(string)
+  default = []
+}
+
+variable "existing_private_subnet_ids" {
+  type    = list(string)
+  default = []
+}
+
+variable "create_cognito" {
+  description = "Create a new Cognito user pool (false = BYO)"
+  type        = bool
+  default     = true
+}
+
+variable "existing_user_pool_id" {
+  type    = string
+  default = null
+}
+
+variable "existing_user_pool_arn" {
+  type    = string
+  default = null
+}
+
+variable "existing_admin_client_id" {
+  type    = string
+  default = null
+}
+
+variable "existing_mobile_client_id" {
+  type    = string
+  default = null
+}
+
+variable "existing_identity_pool_id" {
+  type    = string
+  default = null
+}
+
+variable "create_database" {
+  description = "Create a new Aurora cluster (false = BYO)"
+  type        = bool
+  default     = true
+}
+
+variable "existing_db_cluster_arn" {
+  type    = string
+  default = null
+}
+
+variable "existing_db_secret_arn" {
+  type    = string
+  default = null
+}
+
+variable "existing_db_endpoint" {
+  type    = string
+  default = null
+}
+
+variable "existing_db_security_group_id" {
+  type    = string
+  default = null
+}
+
+variable "database_engine" {
+  description = "Database engine: 'aurora-serverless' (production) or 'rds-postgres' (dev/test, cheaper)"
+  type        = string
+  default     = "aurora-serverless"
+}
+
+variable "memory_engine" {
+  description = "Memory engine: 'managed' (AgentCore built-in, default) or 'hindsight' (ECS+ALB service, opt-in)"
+  type        = string
+  default     = "managed"
+
+  validation {
+    condition     = contains(["managed", "hindsight"], var.memory_engine)
+    error_message = "memory_engine must be 'managed' or 'hindsight'"
+  }
+}
+
+variable "hindsight_image_tag" {
+  description = "Hindsight Docker image tag (only used when memory_engine = 'hindsight')"
+  type        = string
+  default     = "0.4.22"
+}
+
+variable "agentcore_memory_id" {
+  description = "AgentCore Memory resource ID (only used when memory_engine = 'managed')"
+  type        = string
+  default     = ""
+}
+
+# ---------------------------------------------------------------------------
+# Naming / Buckets
+# ---------------------------------------------------------------------------
+
+variable "bucket_name" {
+  description = "Primary S3 bucket name"
+  type        = string
+  default     = ""
+}
+
+variable "database_name" {
+  description = "Aurora database name"
+  type        = string
+  default     = "thinkwork"
+}
+
+# ---------------------------------------------------------------------------
+# Lambda Artifacts
+# ---------------------------------------------------------------------------
+
+variable "lambda_artifact_bucket" {
+  description = "S3 bucket containing Lambda deployment artifacts"
+  type        = string
+  default     = ""
+}
+
+variable "lambda_artifact_prefix" {
+  description = "S3 key prefix for Lambda artifacts"
+  type        = string
+  default     = "latest/lambdas"
+}
+
+variable "lambda_zips_dir" {
+  description = "Local directory containing Lambda zip artifacts (from scripts/build-lambdas.sh). Enables real handlers when set."
+  type        = string
+  default     = ""
+}
+
+variable "api_auth_secret" {
+  description = "Shared secret for inter-service API authentication"
+  type        = string
+  sensitive   = true
+  default     = ""
+}
+
+# ---------------------------------------------------------------------------
+# Cognito Callback URLs (configurable per deployment)
+# ---------------------------------------------------------------------------
+
+variable "admin_callback_urls" {
+  type    = list(string)
+  default = ["http://localhost:5174", "http://localhost:5174/auth/callback"]
+}
+
+variable "admin_logout_urls" {
+  type    = list(string)
+  default = ["http://localhost:5174"]
+}
+
+variable "mobile_callback_urls" {
+  type    = list(string)
+  default = ["exp://localhost:8081", "thinkwork://", "thinkwork://auth/callback"]
+}
+
+variable "mobile_logout_urls" {
+  type    = list(string)
+  default = ["exp://localhost:8081", "thinkwork://"]
+}
+
+# ---------------------------------------------------------------------------
+# Pre-signup Lambda
+# ---------------------------------------------------------------------------
+
+variable "pre_signup_lambda_zip" {
+  description = "Path to the Cognito pre-signup Lambda zip"
+  type        = string
+  default     = ""
+}

package/dist/terraform/schema.graphql

@@ -0,0 +1,199 @@
+# Auto-generated AppSync subscription-only schema.
+# DO NOT EDIT — regenerate with: pnpm schema:build
+#
+# Source: packages/database-pg/graphql/types/subscriptions.graphql
+
+scalar AWSDateTime
+
+schema {
+  query: Query
+  mutation: Mutation
+  subscription: Subscription
+}
+
+type Query {
+  _empty: String
+}
+
+# AppSync Subscriptions — real-time event streams
+#
+# Each subscription filters by tenantId (or threadId) and is triggered
+# by its corresponding notification mutation via @aws_subscribe.
+
+# ────────────────────────────────────────────────────────────────────
+# Event payload types
+# ────────────────────────────────────────────────────────────────────
+
+type AgentStatusEvent {
+  agentId: ID!
+  tenantId: ID!
+  status: String!
+  name: String!
+  updatedAt: AWSDateTime!
+}
+
+type NewMessageEvent {
+  messageId: ID!
+  threadId: ID!
+  tenantId: ID!
+  role: String!
+  content: String
+  senderType: String
+  senderId: ID
+  createdAt: AWSDateTime!
+}
+
+type HeartbeatActivityEvent {
+  heartbeatId: ID!
+  tenantId: ID!
+  status: String!
+  message: String
+  createdAt: AWSDateTime!
+}
+
+type ThreadUpdateEvent {
+  threadId: ID!
+  tenantId: ID!
+  status: String!
+  title: String!
+  updatedAt: AWSDateTime!
+}
+
+type InboxItemStatusEvent {
+  inboxItemId: ID!
+  tenantId: ID!
+  status: String!
+  title: String
+  updatedAt: AWSDateTime!
+}
+
+type ThreadTurnUpdateEvent {
+  runId: ID!
+  triggerId: ID
+  tenantId: ID!
+  threadId: ID
+  agentId: ID
+  status: String!
+  triggerName: String
+  updatedAt: AWSDateTime!
+}
+
+type OrgUpdateEvent {
+  tenantId: ID!
+  changeType: String!
+  entityType: String
+  entityId: ID
+  updatedAt: AWSDateTime!
+}
+
+type CostRecordedEvent {
+  tenantId: ID!
+  agentId: ID
+  agentName: String
+  eventType: String!
+  amountUsd: Float!
+  model: String
+  updatedAt: AWSDateTime!
+}
+
+# ────────────────────────────────────────────────────────────────────
+# Notification mutations
+#
+# These are called by Lambda resolvers (not clients) to trigger the
+# corresponding subscriptions. @aws_subscribe binds each subscription
+# to the mutation(s) whose return type matches the event payload.
+# ────────────────────────────────────────────────────────────────────
+
+type Mutation {
+  _empty: String
+  notifyAgentStatus(
+    agentId: ID!
+    tenantId: ID!
+    status: String!
+    name: String!
+  ): AgentStatusEvent @aws_api_key @aws_cognito_user_pools @aws_iam
+
+  notifyNewMessage(
+    messageId: ID!
+    threadId: ID!
+    tenantId: ID!
+    role: String!
+    content: String
+    senderType: String
+    senderId: ID
+  ): NewMessageEvent @aws_api_key @aws_cognito_user_pools @aws_iam
+
+  notifyHeartbeatActivity(
+    heartbeatId: ID!
+    tenantId: ID!
+    status: String!
+    message: String
+  ): HeartbeatActivityEvent @aws_api_key @aws_cognito_user_pools @aws_iam
+
+  notifyThreadUpdate(
+    threadId: ID!
+    tenantId: ID!
+    status: String!
+    title: String!
+  ): ThreadUpdateEvent @aws_api_key @aws_cognito_user_pools @aws_iam
+
+  notifyInboxItemUpdate(
+    inboxItemId: ID!
+    tenantId: ID!
+    status: String!
+    title: String
+  ): InboxItemStatusEvent @aws_api_key @aws_cognito_user_pools @aws_iam
+
+  notifyThreadTurnUpdate(
+    runId: ID!
+    triggerId: ID
+    tenantId: ID!
+    threadId: ID
+    agentId: ID
+    status: String!
+    triggerName: String
+  ): ThreadTurnUpdateEvent @aws_api_key @aws_cognito_user_pools @aws_iam
+
+  notifyOrgUpdate(
+    tenantId: ID!
+    changeType: String!
+    entityType: String
+    entityId: ID
+  ): OrgUpdateEvent @aws_api_key @aws_cognito_user_pools @aws_iam
+
+  notifyCostRecorded(
+    tenantId: ID!
+    agentId: ID
+    agentName: String
+    eventType: String!
+    amountUsd: Float!
+    model: String
+  ): CostRecordedEvent @aws_api_key @aws_cognito_user_pools @aws_iam
+}
+
+type Subscription {
+  _empty: String
+  onAgentStatusChanged(tenantId: ID!): AgentStatusEvent @aws_api_key @aws_cognito_user_pools @aws_iam
+    @aws_subscribe(mutations: ["notifyAgentStatus"])
+
+  onNewMessage(threadId: ID!): NewMessageEvent @aws_api_key @aws_cognito_user_pools @aws_iam
+    @aws_subscribe(mutations: ["notifyNewMessage"])
+
+  onHeartbeatActivity(tenantId: ID!): HeartbeatActivityEvent @aws_api_key @aws_cognito_user_pools @aws_iam
+    @aws_subscribe(mutations: ["notifyHeartbeatActivity"])
+
+  onThreadUpdated(tenantId: ID!): ThreadUpdateEvent @aws_api_key @aws_cognito_user_pools @aws_iam
+    @aws_subscribe(mutations: ["notifyThreadUpdate"])
+
+  onInboxItemStatusChanged(tenantId: ID!): InboxItemStatusEvent @aws_api_key @aws_cognito_user_pools @aws_iam
+    @aws_subscribe(mutations: ["notifyInboxItemUpdate"])
+
+  onThreadTurnUpdated(tenantId: ID!): ThreadTurnUpdateEvent @aws_api_key @aws_cognito_user_pools @aws_iam
+    @aws_subscribe(mutations: ["notifyThreadTurnUpdate"])
+
+  onOrgUpdated(tenantId: ID!): OrgUpdateEvent @aws_api_key @aws_cognito_user_pools @aws_iam
+    @aws_subscribe(mutations: ["notifyOrgUpdate"])
+
+  onCostRecorded(tenantId: ID!): CostRecordedEvent @aws_api_key @aws_cognito_user_pools @aws_iam
+    @aws_subscribe(mutations: ["notifyCostRecorded"])
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkwork-cli",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Thinkwork CLI — deploy, manage, and interact with your Thinkwork stack",
   "license": "MIT",
   "type": "module",
@@ -11,7 +11,7 @@
     "dist"
   ],
   "scripts": {
-    "build": "tsup src/cli.ts --format esm --dts --clean",
+    "build": "tsup src/cli.ts --format esm --dts --clean && node scripts/bundle-terraform.js",
     "dev": "tsx src/cli.ts",
     "typecheck": "tsc --noEmit",
     "test": "vitest run",