thinkwork-cli 0.12.11 → 0.12.15

package/README.md

@@ -38,7 +38,7 @@ thinkwork plan -s dev
 # 5. Deploy (~5 min)
 thinkwork deploy -s dev
 
-# 6. Seed workspace files + skill catalog
+# 6. Seed workspace files
 thinkwork bootstrap -s dev
 
 # 7. Show what was deployed
@@ -66,36 +66,40 @@ No repo clone required — `thinkwork init` scaffolds all Terraform modules from
 
 ### Setup
 
-| Command | Description |
-|---------|-------------|
-| `thinkwork login` | Configure AWS credentials (access keys or `--sso`) |
-| `thinkwork login --stage <s>` | Sign in to a deployed stack via Cognito (OAuth; Google supported). Caches tokens in `~/.thinkwork/config.json` |
-| `thinkwork login --stage <s> --api-key <secret>` | Non-interactive CI path; stores the api_auth_secret as the session |
-| `thinkwork logout [--stage <s> \| --all]` | Forget stored sessions |
-| `thinkwork me [--stage <s>]` | Print who you're signed in as on a stage (verifies via a live `me` query) |
-| `thinkwork init -s <stage>` | Initialize a new environment — generates terraform.tfvars, scaffolds Terraform modules, runs `terraform init` |
-| `thinkwork doctor -s <stage>` | Check prerequisites (AWS CLI, Terraform, credentials, Bedrock access) |
+| Command                                          | Description                                                                                                    |
+| ------------------------------------------------ | -------------------------------------------------------------------------------------------------------------- |
+| `thinkwork login`                                | Configure AWS credentials (access keys or `--sso`)                                                             |
+| `thinkwork login --stage <s>`                    | Sign in to a deployed stack via Cognito (OAuth; Google supported). Caches tokens in `~/.thinkwork/config.json` |
+| `thinkwork login --stage <s> --api-key <secret>` | Non-interactive CI path; stores the api_auth_secret as the session                                             |
+| `thinkwork logout [--stage <s> \| --all]`        | Forget stored sessions                                                                                         |
+| `thinkwork me [--stage <s>]`                     | Print who you're signed in as on a stage (verifies via a live `me` query)                                      |
+| `thinkwork init -s <stage>`                      | Initialize a new environment — generates terraform.tfvars, scaffolds Terraform modules, runs `terraform init`  |
+| `thinkwork doctor -s <stage>`                    | Check prerequisites (AWS CLI, Terraform, credentials, Bedrock access)                                          |
 
 ### Deploy
 
-| Command | Description |
-|---------|-------------|
-| `thinkwork plan -s <stage>` | Preview infrastructure changes |
-| `thinkwork deploy -s <stage>` | Deploy infrastructure (terraform apply) |
-| `thinkwork bootstrap -s <stage>` | Seed workspace defaults, skill catalog, and per-tenant files |
-| `thinkwork destroy -s <stage>` | Tear down infrastructure |
+| Command                          | Description                                                                                                                                                            |
+| -------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `thinkwork plan -s <stage>`      | Preview infrastructure changes                                                                                                                                         |
+| `thinkwork deploy -s <stage>`    | Full deploy pipeline: preflight checks → terraform apply → release artifacts → schema migrations → post-deploy verification. Reruns converge from any partial failure. |
+| `thinkwork verify -s <stage>`    | Prove a deployed stage works: GraphQL, authenticated call, web, database schema, Hindsight, seeding, deployed-artifact evidence, pending-approvals checklist           |
+| `thinkwork bootstrap -s <stage>` | Seed workspace defaults and per-tenant workspace files                                                                                                                 |
+| `thinkwork destroy -s <stage>`   | Tear down to a redeployable clean slate: buckets pre-emptied (all versions), bounded retry, lingering secrets force-deleted, orphan scan                               |
+
+`deploy` details: preflight runs the `doctor` check registry (credentials + expiry margin, Bedrock invocation, Lambda quota, state backend, domain DNS delegation) and reports **all** blockers before any resource is created (`--skip-preflight` to bypass). Init-scaffolded environments get a per-account Terraform state backend (versioned, encrypted S3 + DynamoDB locking) and deploy a pinned ThinkWork release (`--release-version <tag>` to override). SES production access pending approval never blocks — it's tracked as a checklist item. A stale state lock from an interrupted run gets guided recovery on the next deploy.
 
 ### Manage
 
-| Command | Description |
-|---------|-------------|
-| `thinkwork status` | Discover all deployed environments in AWS (clickable URLs) |
-| `thinkwork status -s <stage>` | Detailed view for one environment |
-| `thinkwork outputs -s <stage>` | Show deployment outputs (API URL, Cognito IDs, etc.) |
-| `thinkwork config list` | List all initialized environments |
-| `thinkwork config list -s <stage>` | Show full config for an environment (secrets masked) |
-| `thinkwork config get <key> -s <stage>` | Read a configuration value |
-| `thinkwork config set <key> <value> -s <stage>` | Update a configuration value |
+| Command                                         | Description                                                                         |
+| ----------------------------------------------- | ----------------------------------------------------------------------------------- |
+| `thinkwork status`                              | Discover all deployed environments in AWS (clickable URLs)                          |
+| `thinkwork status -s <stage>`                   | Detailed view for one environment                                                   |
+| `thinkwork outputs -s <stage>`                  | Show deployment outputs (API URL, Cognito IDs, etc.)                                |
+| `thinkwork config list`                         | List all initialized environments                                                   |
+| `thinkwork config list -s <stage>`              | Show full config for an environment (secrets masked)                                |
+| `thinkwork config get <key> -s <stage>`         | Read a configuration value                                                          |
+| `thinkwork config set <key> <value> -s <stage>` | Update a configuration value                                                        |
+| `thinkwork config graduate <stage>`             | Mark a stage as a graduated persistent environment (arms destroy's strongest guard) |
 
 ### Wiki (Compounding Memory)
 
@@ -103,11 +107,11 @@ Admin-only. Operator controls for the wiki compile pipeline — kick a compile,
 rebuild from scratch, or inspect recent compile jobs without leaving the
 terminal.
 
-| Command | Description |
-|---------|-------------|
-| `thinkwork wiki compile` | Enqueue a compile for one agent (`--agent`) or every tenant agent (`--all`). `--model <id>` spikes a non-default Bedrock model for one run. `--watch` follows the job (single-agent only). |
-| `thinkwork wiki rebuild --agent <id>` | Destructive: archive the agent's active pages, clear the compile cursor, and enqueue a fresh compile. Confirm unless `--yes`. `--all` is intentionally rejected. |
-| `thinkwork wiki status` | Show recent compile jobs for a tenant. `--agent <id>` restricts to one scope. `--watch` polls until the latest job reaches a terminal state. |
+| Command                               | Description                                                                                                                                                                                |
+| ------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `thinkwork wiki compile`              | Enqueue a compile for one agent (`--agent`) or every tenant agent (`--all`). `--model <id>` spikes a non-default Bedrock model for one run. `--watch` follows the job (single-agent only). |
+| `thinkwork wiki rebuild --agent <id>` | Destructive: archive the agent's active pages, clear the compile cursor, and enqueue a fresh compile. Confirm unless `--yes`. `--all` is intentionally rejected.                           |
+| `thinkwork wiki status`               | Show recent compile jobs for a tenant. `--agent <id>` restricts to one scope. `--watch` polls until the latest job reaches a terminal state.                                               |
 
 Requires admin credentials (api-key session, or an admin-promoted tenant
 membership). Cognito end-user sessions see a clear "admin access required"
@@ -142,14 +146,14 @@ Any flag accepted by a command is also inferrable from env vars:
 All 25 originally-scaffolded commands across Phases 1–5 are now live.
 `thinkwork <cmd> --help` is authoritative for flags + examples.
 
-| Phase | Domain | Commands |
-|-------|--------|----------|
-| 0 | Foundation | `login` (chains AWS profile + Cognito API session), `logout`, `me`, `--json`, GraphQL client, codegen, shared helpers |
-| 1 | Work & approvals | `thread`, `message`, `label`, `inbox` |
-| 2 | Agents & workspace | `member`, `team`, `kb`, `template`, `tenant`, `agent` |
-| 3 | Automation & integrations | `routine`, `scheduled-job`, `turn`, `wakeup`, `webhook`, `skill` (`connector` retired) |
-| 4 | Memory & artifacts | `memory`, `recipe`, `artifact` |
-| 5 | Observability & spend | `cost`, `budget`, `performance`, `trace`, `dashboard` |
+| Phase | Domain                    | Commands                                                                                                              |
+| ----- | ------------------------- | --------------------------------------------------------------------------------------------------------------------- |
+| 0     | Foundation                | `login` (chains AWS profile + Cognito API session), `logout`, `me`, `--json`, GraphQL client, codegen, shared helpers |
+| 1     | Work & approvals          | `thread`, `message`, `label`, `inbox`                                                                                 |
+| 2     | Agents & workspace        | `member`, `team`, `kb`, `template`, `tenant`, `agent`                                                                 |
+| 3     | Automation & integrations | `routine`, `scheduled-job`, `turn`, `wakeup`, `webhook`, `skill` (`connector` retired)                                |
+| 4     | Memory & artifacts        | `memory`, `recipe`, `artifact`                                                                                        |
+| 5     | Observability & spend     | `cost`, `budget`, `performance`, `trace`, `dashboard`                                                                 |
 
 `skill create` and `skill update` were retired in favor of
 `thinkwork skill push <folder>` — that's the real custom-skill authoring

package/dist/{api-client-ASJWIG3Z.js → api-client-4VT3FWOH.js}

@@ -5,7 +5,7 @@ import {
   readTfVar,
   resolveApiConfig,
   resolveTfvarsPath
-} from "./chunk-JEHV35EU.js";
+} from "./chunk-H7AB42ES.js";
 export {
   apiFetch,
   apiFetchRaw,

package/dist/{chunk-JEHV35EU.js → chunk-H7AB42ES.js}

@@ -5,7 +5,7 @@ var __export = (target, all) => {
 };
 
 // src/api-client.ts
-import { readFileSync as readFileSync2, existsSync as existsSync3 } from "fs";
+import { readFileSync as readFileSync3, existsSync as existsSync4 } from "fs";
 import { execSync as execSync2 } from "child_process";
 
 // src/environments.ts
@@ -77,26 +77,271 @@ function resolveTerraformDir(stage) {
 
 // src/terraform.ts
 import { spawn } from "child_process";
-import { existsSync as existsSync2 } from "fs";
+import { existsSync as existsSync3 } from "fs";
+import path2 from "path";
+
+// src/lib/state-backend.ts
+import { spawnSync } from "child_process";
+import { existsSync as existsSync2, readFileSync as readFileSync2, readdirSync as readdirSync2 } from "fs";
 import path from "path";
+var NONCURRENT_VERSION_RETENTION_DAYS = 90;
+function defaultExec(args) {
+  const proc = spawnSync("aws", args, { encoding: "utf8" });
+  return {
+    status: proc.status ?? 1,
+    stdout: proc.stdout ?? "",
+    stderr: proc.stderr ?? ""
+  };
+}
+function backendResourceNames(accountId) {
+  return {
+    bucket: `thinkwork-tfstate-${accountId}`,
+    lockTable: `thinkwork-tflocks-${accountId}`
+  };
+}
+function backendKey(stage) {
+  return `thinkwork/${stage}/terraform.tfstate`;
+}
+function backendTarget(accountId, region, stage) {
+  const names = backendResourceNames(accountId);
+  return {
+    bucket: names.bucket,
+    lockTable: names.lockTable,
+    key: backendKey(stage),
+    region
+  };
+}
+function backendConfigArgs(target) {
+  return [
+    `-backend-config=bucket=${target.bucket}`,
+    `-backend-config=key=${target.key}`,
+    `-backend-config=region=${target.region}`,
+    `-backend-config=dynamodb_table=${target.lockTable}`,
+    `-backend-config=encrypt=true`
+  ];
+}
+function ensureStateBackend(accountId, region, stage, exec = defaultExec) {
+  const target = backendTarget(accountId, region, stage);
+  const head = exec(["s3api", "head-bucket", "--bucket", target.bucket]);
+  let createdBucket = false;
+  if (head.status !== 0) {
+    const createArgs = [
+      "s3api",
+      "create-bucket",
+      "--bucket",
+      target.bucket,
+      "--region",
+      region
+    ];
+    if (region !== "us-east-1") {
+      createArgs.push(
+        "--create-bucket-configuration",
+        `LocationConstraint=${region}`
+      );
+    }
+    const created = exec(createArgs);
+    if (created.status !== 0) {
+      throw new Error(
+        `Could not create state bucket ${target.bucket}: ${created.stderr.trim()}`
+      );
+    }
+    createdBucket = true;
+  }
+  const hardening = [
+    [
+      "s3api",
+      "put-bucket-versioning",
+      "--bucket",
+      target.bucket,
+      "--versioning-configuration",
+      "Status=Enabled"
+    ],
+    [
+      "s3api",
+      "put-bucket-encryption",
+      "--bucket",
+      target.bucket,
+      "--server-side-encryption-configuration",
+      '{"Rules":[{"ApplyServerSideEncryptionByDefault":{"SSEAlgorithm":"AES256"}}]}'
+    ],
+    [
+      "s3api",
+      "put-public-access-block",
+      "--bucket",
+      target.bucket,
+      "--public-access-block-configuration",
+      "BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true"
+    ],
+    [
+      "s3api",
+      "put-bucket-lifecycle-configuration",
+      "--bucket",
+      target.bucket,
+      "--lifecycle-configuration",
+      JSON.stringify({
+        Rules: [
+          {
+            ID: "expire-noncurrent-state-versions",
+            Status: "Enabled",
+            Filter: {},
+            NoncurrentVersionExpiration: {
+              NoncurrentDays: NONCURRENT_VERSION_RETENTION_DAYS
+            }
+          }
+        ]
+      })
+    ]
+  ];
+  for (const args of hardening) {
+    const res = exec(args);
+    if (res.status !== 0) {
+      throw new Error(
+        `Could not apply ${args[1]} to ${target.bucket}: ${res.stderr.trim()}`
+      );
+    }
+  }
+  const describe = exec([
+    "dynamodb",
+    "describe-table",
+    "--table-name",
+    target.lockTable,
+    "--region",
+    region
+  ]);
+  let createdLockTable = false;
+  if (describe.status !== 0) {
+    const created = exec([
+      "dynamodb",
+      "create-table",
+      "--table-name",
+      target.lockTable,
+      "--attribute-definitions",
+      "AttributeName=LockID,AttributeType=S",
+      "--key-schema",
+      "AttributeName=LockID,KeyType=HASH",
+      "--billing-mode",
+      "PAY_PER_REQUEST",
+      "--region",
+      region
+    ]);
+    if (created.status !== 0) {
+      throw new Error(
+        `Could not create lock table ${target.lockTable}: ${created.stderr.trim()}`
+      );
+    }
+    createdLockTable = true;
+  }
+  return { target, createdBucket, createdLockTable };
+}
+function readRecordedBackend(cwd) {
+  const recordPath = path.join(cwd, ".terraform", "terraform.tfstate");
+  if (!existsSync2(recordPath)) return null;
+  try {
+    const parsed = JSON.parse(readFileSync2(recordPath, "utf8"));
+    if (!parsed.backend?.type) return null;
+    const config = parsed.backend.config ?? {};
+    return {
+      type: parsed.backend.type,
+      bucket: config.bucket,
+      key: config.key,
+      region: config.region,
+      dynamodb_table: config.dynamodb_table
+    };
+  } catch {
+    return null;
+  }
+}
+function backendMatches(recorded, target) {
+  return recorded !== null && recorded.type === "s3" && recorded.bucket === target.bucket && recorded.key === target.key && recorded.dynamodb_table === target.lockTable;
+}
+function detectLocalStateOrphanRisk(cwd) {
+  const candidates = [path.join(cwd, "terraform.tfstate")];
+  const workspaceDir = path.join(cwd, "terraform.tfstate.d");
+  if (existsSync2(workspaceDir)) {
+    try {
+      for (const ws of readdirSync2(workspaceDir)) {
+        candidates.push(path.join(workspaceDir, ws, "terraform.tfstate"));
+      }
+    } catch {
+    }
+  }
+  for (const candidate of candidates) {
+    if (!existsSync2(candidate)) continue;
+    try {
+      const parsed = JSON.parse(readFileSync2(candidate, "utf8"));
+      if ((parsed.resources?.length ?? 0) > 0) return true;
+    } catch {
+      return true;
+    }
+  }
+  return false;
+}
+function parseLockError(text) {
+  if (!/Error acquiring the state lock/i.test(text)) return null;
+  const field = (name) => {
+    const match = text.match(
+      new RegExp(`(?:^|[^A-Za-z])${name}:\\s*(.+)`, "i")
+    );
+    return match?.[1]?.replace(/[│,]/g, " ").trim();
+  };
+  const rawId = field("ID");
+  return {
+    id: rawId?.split(/\s+/)[0],
+    who: field("Who"),
+    operation: field("Operation"),
+    created: field("Created")
+  };
+}
+
+// src/terraform.ts
+function resolveTerraformRoot(startDir = process.cwd()) {
+  const configured = process.env.THINKWORK_TERRAFORM_DIR;
+  if (configured) return configured;
+  let current = path2.resolve(startDir);
+  while (true) {
+    if (isTerraformRoot(current)) return current;
+    const nestedTerraform = path2.join(current, "terraform");
+    if (isTerraformRoot(nestedTerraform)) return nestedTerraform;
+    const parent = path2.dirname(current);
+    if (parent === current) return path2.resolve(startDir);
+    current = parent;
+  }
+}
+function isTerraformRoot(dir) {
+  return existsSync3(path2.join(dir, "examples", "greenfield")) || existsSync3(path2.join(dir, "environments")) || existsSync3(path2.join(dir, "main.tf"));
+}
 function resolveTierDir(terraformDir, stage, tier) {
-  const envDir = path.join(terraformDir, "environments", stage, tier);
-  if (existsSync2(envDir)) {
+  const envDir = path2.join(terraformDir, "environments", stage, tier);
+  if (existsSync3(envDir)) {
     return envDir;
   }
-  const greenfield = path.join(terraformDir, "examples", "greenfield");
-  if (existsSync2(greenfield)) {
+  const flat = path2.join(terraformDir);
+  if (existsSync3(path2.join(flat, "main.tf")) && existsSync3(path2.join(flat, "terraform.tfvars"))) {
+    return flat;
+  }
+  const greenfield = path2.join(terraformDir, "examples", "greenfield");
+  if (existsSync3(greenfield)) {
     return greenfield;
   }
-  const flat = path.join(terraformDir);
-  if (existsSync2(path.join(flat, "main.tf"))) {
+  if (existsSync3(path2.join(flat, "main.tf"))) {
     return flat;
   }
-  const cwdTf = path.join(process.cwd(), "terraform");
-  if (existsSync2(path.join(cwdTf, "main.tf"))) {
+  const cwdTf = path2.join(process.cwd(), "terraform");
+  if (existsSync3(path2.join(cwdTf, "main.tf"))) {
     return cwdTf;
   }
-  return terraformDir;
+  throw new Error(
+    `No Terraform layout found for stage "${stage}" (tier "${tier}").
+  Looked for:
+    - ${envDir}
+    - ${greenfield}
+    - ${path2.join(flat, "main.tf")}
+    - ${path2.join(cwdTf, "main.tf")}
+  Run \`thinkwork init -s ${stage}\` to scaffold an environment, or run from its directory.`
+  );
+}
+function isInitScaffoldedLayout(cwd) {
+  return existsSync3(path2.join(cwd, "main.tf")) && !cwd.endsWith(path2.join("examples", "greenfield")) && existsSync3(path2.join(cwd, "modules"));
 }
 async function ensureWorkspace(cwd, stage) {
   const list = await runTerraformRaw(cwd, ["workspace", "list"]);
@@ -119,7 +364,12 @@ function runTerraformRaw(cwd, args) {
     proc.stderr.on("data", (d) => stderr += d);
     proc.on("close", (code) => {
       if (code === 0) resolve(stdout);
-      else reject(new Error(`terraform ${args.join(" ")} failed (exit ${code}): ${stderr}`));
+      else
+        reject(
+          new Error(
+            `terraform ${args.join(" ")} failed (exit ${code}): ${stderr}`
+          )
+        );
     });
   });
 }
@@ -135,14 +385,62 @@ function runTerraform(cwd, args) {
     proc.on("close", (code) => resolve(code ?? 1));
   });
 }
-async function ensureInit(cwd) {
-  const dotTerraform = path.join(cwd, ".terraform");
-  if (!existsSync2(dotTerraform)) {
-    const code = await runTerraform(cwd, ["init"]);
-    if (code !== 0) {
+async function ensureInit(cwd, backend) {
+  const dotTerraform = path2.join(cwd, ".terraform");
+  const backendArgs = backend ? backendConfigArgs(backend) : [];
+  if (!existsSync3(dotTerraform)) {
+    const code2 = await runTerraform(cwd, ["init", ...backendArgs]);
+    if (code2 !== 0) {
       throw new Error("terraform init failed");
     }
+    return;
   }
+  if (!backend) return;
+  const recorded = readRecordedBackend(cwd);
+  if (backendMatches(recorded, backend)) return;
+  if (detectLocalStateOrphanRisk(cwd)) {
+    throw new Error(
+      `This directory has local Terraform state with resources, but the deploy now targets the remote backend s3://${backend.bucket}/${backend.key}.
+  Switching with -reconfigure would orphan that state. Migrate it first:
+    terraform init -migrate-state ${backendConfigArgs(backend).join(" ")}
+  (run inside ${cwd})`
+    );
+  }
+  console.log(
+    `  Backend changed (recorded: ${recorded ? `${recorded.type}${recorded.bucket ? ` s3://${recorded.bucket}/${recorded.key}` : ""}` : "none"} \u2192 s3://${backend.bucket}/${backend.key}); re-running terraform init -reconfigure`
+  );
+  const code = await runTerraform(cwd, [
+    "init",
+    "-reconfigure",
+    ...backendArgs
+  ]);
+  if (code !== 0) {
+    throw new Error("terraform init -reconfigure failed");
+  }
+}
+function terraformOutput(cwd, key) {
+  return runTerraformRaw(cwd, ["output", "-raw", key]).then((v) => v.trim());
+}
+function runTerraformTee(cwd, args) {
+  return new Promise((resolve) => {
+    console.log(`
+  \u2192 terraform ${args.join(" ")}
+`);
+    const proc = spawn("terraform", args, {
+      cwd,
+      stdio: ["inherit", "pipe", "pipe"]
+    });
+    let output = "";
+    proc.stdout.on("data", (d) => {
+      output += d.toString();
+      process.stdout.write(d);
+    });
+    proc.stderr.on("data", (d) => {
+      output += d.toString();
+      process.stderr.write(d);
+    });
+    proc.on("close", (code) => resolve({ code: code ?? 1, output }));
+  });
 }
 
 // src/aws-discovery.ts
@@ -225,7 +523,11 @@ function printHeader(command, stage, identity) {
   console.log(chalk.bold.cyan("  \u2B21 Thinkwork") + chalk.dim(` \u2014 ${command}`));
   console.log(chalk.dim(`  Stage: ${chalk.white(stage)}`));
   if (identity) {
-    console.log(chalk.dim(`  AWS:   ${chalk.white(identity.account)} / ${chalk.white(identity.region)}`));
+    console.log(
+      chalk.dim(
+        `  AWS:   ${chalk.white(identity.account)} / ${chalk.white(identity.region)}`
+      )
+    );
   }
   console.log("");
 }
@@ -259,9 +561,7 @@ function printMissingApiSessionError(stage, hasSession) {
     console.log("");
     console.log(`  ${chalk.bold("To fix:")}  thinkwork login --stage ${stage}`);
     console.log(
-      chalk.dim(
-        `  Or pass --tenant <slug>, or set THINKWORK_TENANT.`
-      )
+      chalk.dim(`  Or pass --tenant <slug>, or set THINKWORK_TENANT.`)
     );
     console.log("");
   }
@@ -275,15 +575,17 @@ function printSummary(command, stage, tiers, startTime) {
   console.log(chalk.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
   console.log(`  ${chalk.bold("Command:")}  ${command}`);
   console.log(`  ${chalk.bold("Stage:")}    ${stage}`);
-  console.log(`  ${chalk.bold("Tiers:")}    ${tiers.map((t) => TIER_LABELS[t] ?? t).join(" \u2192 ")}`);
+  console.log(
+    `  ${chalk.bold("Tiers:")}    ${tiers.map((t) => TIER_LABELS[t] ?? t).join(" \u2192 ")}`
+  );
   console.log(`  ${chalk.bold("Time:")}     ${elapsed}s`);
   console.log(chalk.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
 }
 
 // src/api-client.ts
 function readTfVar(tfvarsPath, key) {
-  if (!existsSync3(tfvarsPath)) return null;
-  const content = readFileSync2(tfvarsPath, "utf-8");
+  if (!existsSync4(tfvarsPath)) return null;
+  const content = readFileSync3(tfvarsPath, "utf-8");
   const match = content.match(new RegExp(`^${key}\\s*=\\s*"([^"]*)"`, "m"));
   return match ? match[1] : null;
 }
@@ -291,9 +593,9 @@ function resolveTfvarsPath(stage) {
   const tfDir = resolveTerraformDir(stage);
   if (tfDir) {
     const direct = `${tfDir}/terraform.tfvars`;
-    if (existsSync3(direct)) return direct;
+    if (existsSync4(direct)) return direct;
   }
-  const terraformDir = process.env.THINKWORK_TERRAFORM_DIR || process.cwd();
+  const terraformDir = resolveTerraformRoot();
   const cwd = resolveTierDir(terraformDir, stage, "app");
   return `${cwd}/terraform.tfvars`;
 }
@@ -308,8 +610,8 @@ function getApiEndpoint2(stage, region) {
     return null;
   }
 }
-async function apiFetch(apiUrl, authSecret, path2, options = {}, extraHeaders = {}) {
-  const res = await fetch(`${apiUrl}${path2}`, {
+async function apiFetch(apiUrl, authSecret, path3, options = {}, extraHeaders = {}) {
+  const res = await fetch(`${apiUrl}${path3}`, {
     ...options,
     headers: {
       "Content-Type": "application/json",
@@ -324,8 +626,8 @@ async function apiFetch(apiUrl, authSecret, path2, options = {}, extraHeaders =
   }
   return res.json();
 }
-async function apiFetchRaw(apiUrl, authSecret, path2, options = {}, extraHeaders = {}) {
-  const res = await fetch(`${apiUrl}${path2}`, {
+async function apiFetchRaw(apiUrl, authSecret, path3, options = {}, extraHeaders = {}) {
+  const res = await fetch(`${apiUrl}${path3}`, {
     ...options,
     headers: {
       "Content-Type": "application/json",
@@ -361,10 +663,18 @@ function resolveApiConfig(stage, regionOverride) {
 
 export {
   __export,
+  backendTarget,
+  backendConfigArgs,
+  ensureStateBackend,
+  parseLockError,
+  resolveTerraformRoot,
   resolveTierDir,
+  isInitScaffoldedLayout,
   ensureWorkspace,
   runTerraform,
   ensureInit,
+  terraformOutput,
+  runTerraformTee,
   printHeader,
   printTierHeader,
   printSuccess,