thinkwork-cli 0.12.11 → 0.12.15

package/dist/terraform/modules/thinkwork/outputs.tf

@@ -23,6 +23,11 @@ output "identity_pool_id" {
   value = module.cognito.identity_pool_id
 }
 
+output "identity_provider_names" {
+  description = "Supported Cognito identity providers for created app clients."
+  value       = module.cognito.identity_provider_names
+}
+
 output "kms_key_arn" {
   value = module.kms.key_arn
 }
@@ -50,6 +55,16 @@ output "bucket_name" {
   value = module.s3.bucket_name
 }
 
+output "billing_export_bucket_name" {
+  description = "Configured AWS billing export bucket consumed by the bill reconciler, or empty when not configured."
+  value       = module.api.billing_export_bucket_name
+}
+
+output "billing_export_manifest_key" {
+  description = "Configured AWS billing export manifest key consumed by the bill reconciler, or empty when not configured."
+  value       = module.api.billing_export_manifest_key
+}
+
 output "backups_bucket_name" {
   description = "S3 bucket for operational backups (pre-drop snapshots from destructive migrations, via the aws_s3 Aurora extension)."
   value       = module.s3_backups.bucket_name
@@ -102,14 +117,64 @@ output "auth_domain" {
   value       = module.cognito.auth_domain
 }
 
+output "deployment_control_plane_enabled" {
+  description = "Whether the AWS-native deployment control plane is enabled."
+  value       = var.enable_deployment_control_plane
+}
+
+output "deployment_state_machine_arn" {
+  description = "Deployment orchestration Step Functions state machine ARN."
+  value       = var.enable_deployment_control_plane ? module.deployment_control_plane[0].state_machine_arn : (var.deployment_state_machine_arn != "" ? var.deployment_state_machine_arn : null)
+}
+
+output "deployment_state_machine_name" {
+  description = "Deployment orchestration Step Functions state machine name."
+  value       = var.enable_deployment_control_plane ? module.deployment_control_plane[0].state_machine_name : null
+}
+
+output "deployment_runner_project_name" {
+  description = "CodeBuild project name for the deployment runner."
+  value       = var.enable_deployment_control_plane ? module.deployment_control_plane[0].codebuild_project_name : null
+}
+
+output "deployment_runner_project_arn" {
+  description = "CodeBuild project ARN for the deployment runner."
+  value       = var.enable_deployment_control_plane ? module.deployment_control_plane[0].codebuild_project_arn : null
+}
+
+output "deployment_evidence_bucket_name" {
+  description = "S3 bucket for deployment evidence artifacts."
+  value       = var.enable_deployment_control_plane ? module.deployment_control_plane[0].evidence_bucket_name : (var.deployment_evidence_bucket != "" ? var.deployment_evidence_bucket : null)
+}
+
+output "deployment_ssm_prefix" {
+  description = "SSM parameter prefix for deployment control-plane metadata."
+  value       = var.enable_deployment_control_plane ? module.deployment_control_plane[0].ssm_prefix : null
+}
+
+output "deployment_appconfig_application_id" {
+  description = "AppConfig application ID for deployment configuration."
+  value       = var.enable_deployment_control_plane ? module.deployment_control_plane[0].appconfig_application_id : null
+}
+
+output "deployment_appconfig_environment_id" {
+  description = "AppConfig environment ID for deployment configuration."
+  value       = var.enable_deployment_control_plane ? module.deployment_control_plane[0].appconfig_environment_id : null
+}
+
+output "deployment_appconfig_configuration_profile_id" {
+  description = "AppConfig configuration profile ID for deployment configuration."
+  value       = var.enable_deployment_control_plane ? module.deployment_control_plane[0].appconfig_configuration_profile_id : null
+}
+
 output "mapbox_public_token" {
-  description = "Mapbox public token used by apps/computer MapView. Surfaced for scripts/build-computer.sh to inline as VITE_MAPBOX_PUBLIC_TOKEN at build time. MapView falls back to OSM tiles when this is empty."
+  description = "Mapbox public token used by apps/web MapView. Surfaced for scripts/build-web.sh to inline as VITE_MAPBOX_PUBLIC_TOKEN at build time. MapView falls back to OSM tiles when this is empty."
   value       = var.mapbox_public_token
   sensitive   = true
 }
 
 output "ecr_repository_url" {
-  value = module.agentcore.ecr_repository_url
+  value = module.agentcore_platform.ecr_repository_url
 }
 
 output "agentcore_memory_id" {
@@ -118,7 +183,7 @@ output "agentcore_memory_id" {
 }
 
 output "hindsight_enabled" {
-  description = "Whether the Hindsight add-on is enabled"
+  description = "Whether Hindsight canonical memory is enabled"
   value       = local.hindsight_enabled
 }
 
@@ -127,32 +192,356 @@ output "hindsight_endpoint" {
   value       = local.hindsight_enabled ? module.hindsight[0].hindsight_endpoint : null
 }
 
-# Admin static site
-output "admin_distribution_id" {
-  description = "CloudFront distribution ID for the admin app"
-  value       = module.admin_site.distribution_id
+output "cognee_enabled" {
+  description = "Whether the Cognee ontology/knowledge-graph add-on is enabled"
+  value       = local.cognee_enabled
+}
+
+output "cognee_endpoint" {
+  description = "Internal Cognee API endpoint (null when enable_cognee = false)"
+  value       = local.cognee_enabled ? module.cognee[0].cognee_endpoint : null
+}
+
+output "cognee_log_group_name" {
+  description = "CloudWatch log group for Cognee (null when enable_cognee = false)"
+  value       = local.cognee_enabled ? module.cognee[0].cognee_log_group_name : null
+}
+
+output "cognee_task_role_arn" {
+  description = "IAM role assumed by the Cognee ECS task (null when enable_cognee = false)"
+  value       = local.cognee_enabled ? module.cognee[0].cognee_task_role_arn : null
+}
+
+output "cognee_execution_role_arn" {
+  description = "IAM role used by ECS to pull the Cognee image and inject secrets (null when enable_cognee = false)"
+  value       = local.cognee_enabled ? module.cognee[0].cognee_execution_role_arn : null
+}
+
+output "cognee_backend_mode" {
+  description = "Selected Cognee backend mode (null when enable_cognee = false)"
+  value       = local.cognee_enabled ? module.cognee[0].cognee_backend_mode : null
+}
+
+output "cognee_brain_instance_key" {
+  description = "Tenant-scoped Company Brain instance key (null when enable_cognee = false or legacy stage-wide mode)."
+  value       = local.cognee_enabled ? module.cognee[0].cognee_brain_instance_key : null
+}
+
+output "cognee_brain_tenant_id" {
+  description = "Tenant ID owning this Company Brain substrate instance (null when enable_cognee = false or legacy stage-wide mode)."
+  value       = local.cognee_enabled ? module.cognee[0].cognee_brain_tenant_id : null
+}
+
+output "cognee_brain_storage_tier" {
+  description = "Company Brain storage tier (null when enable_cognee = false)."
+  value       = local.cognee_enabled ? module.cognee[0].cognee_brain_storage_tier : null
+}
+
+output "cognee_graph_database_provider" {
+  description = "Cognee graph provider selected for Company Brain (null when enable_cognee = false)."
+  value       = local.cognee_enabled ? module.cognee[0].cognee_graph_database_provider : null
 }
 
-output "admin_distribution_domain" {
-  description = "CloudFront domain for the admin app"
-  value       = module.admin_site.distribution_domain
+output "cognee_vector_db_provider" {
+  description = "Cognee vector provider selected for Company Brain (null when enable_cognee = false)."
+  value       = local.cognee_enabled ? module.cognee[0].cognee_vector_db_provider : null
 }
 
-output "admin_bucket_name" {
-  description = "S3 bucket for admin app assets"
-  value       = module.admin_site.bucket_name
+output "cognee_embedding_model" {
+  description = "Embedding model selected for Company Brain (null when enable_cognee = false)."
+  value       = local.cognee_enabled ? module.cognee[0].cognee_embedding_model : null
+}
+
+output "cognee_embedding_dimensions" {
+  description = "Embedding vector dimension selected for Company Brain (null when enable_cognee = false)."
+  value       = local.cognee_enabled ? module.cognee[0].cognee_embedding_dimensions : null
+}
+
+output "cognee_cluster_arn" {
+  description = "Company Brain ECS cluster ARN hosting the Cognee service (null when enable_cognee = false)"
+  value       = local.cognee_enabled ? module.cognee[0].cognee_cluster_arn : null
+}
+
+output "cognee_service_name" {
+  description = "ECS service name for Cognee (null when enable_cognee = false)"
+  value       = local.cognee_enabled ? module.cognee[0].cognee_service_name : null
+}
+
+output "cognee_security_group_id" {
+  description = "Security group ID for the Cognee ECS task (null when enable_cognee = false)"
+  value       = local.cognee_enabled ? module.cognee[0].cognee_security_group_id : null
+}
+
+output "cognee_worker_security_group_id" {
+  description = "Security group ID attached to the Knowledge Graph ingest worker Lambda (null when enable_cognee = false)"
+  value       = local.cognee_enabled ? aws_security_group.cognee_worker[0].id : null
+}
+
+output "knowledge_graph_thread_ingest_fn_name" {
+  description = "Knowledge Graph thread ingest worker Lambda function name"
+  value       = module.api.knowledge_graph_thread_ingest_fn_name
+}
+
+output "knowledge_graph_thread_ingest_fn_arn" {
+  description = "Knowledge Graph thread ingest worker Lambda ARN"
+  value       = module.api.knowledge_graph_thread_ingest_fn_arn
+}
+
+output "brain_artifacts_bucket_name" {
+  description = "Canonical Company Brain S3 bucket for source artifacts, ingestion manifests, migration snapshots, vault projections, and exports."
+  value       = module.api.brain_artifacts_bucket_name
+}
+
+output "brain_artifacts_bucket_arn" {
+  description = "ARN of the canonical Company Brain artifact bucket."
+  value       = module.api.brain_artifacts_bucket_arn
+}
+
+output "okf_wiki_efs_enabled" {
+  description = "Whether the OKF Wiki Navigator EFS current-view substrate is provisioned and wired."
+  value       = var.okf_wiki_efs_enabled
+}
+
+output "okf_wiki_efs_file_system_id" {
+  description = "EFS file system ID for the OKF wiki current view, or null when disabled."
+  value       = var.okf_wiki_efs_enabled ? aws_efs_file_system.okf_wiki[0].id : null
+}
+
+output "okf_wiki_refresh_access_point_arn" {
+  description = "EFS access point ARN used by the okf-efs-refresh hydrator, or null when disabled."
+  value       = var.okf_wiki_efs_enabled ? aws_efs_access_point.okf_wiki_refresh[0].arn : null
+}
+
+output "okf_wiki_pi_read_access_point_arn" {
+  description = "EFS access point ARN mounted by Pi for read-only OKF wiki traversal, or null when disabled."
+  value       = var.okf_wiki_efs_enabled ? aws_efs_access_point.okf_wiki_pi_read[0].arn : null
+}
+
+output "okf_efs_refresh_fn_name" {
+  description = "OKF EFS refresh Lambda function name."
+  value       = module.api.okf_efs_refresh_fn_name
+}
+
+output "okf_efs_refresh_fn_arn" {
+  description = "OKF EFS refresh Lambda ARN."
+  value       = module.api.okf_efs_refresh_fn_arn
+}
+
+output "cognee_storage_file_system_id" {
+  description = "EFS file system ID backing Cognee writable data/system directories (null when enable_cognee = false)"
+  value       = local.cognee_enabled ? module.cognee[0].cognee_storage_file_system_id : null
+}
+
+output "cognee_s3_artifact_root" {
+  description = "Canonical Company Brain S3 source artifact root (null when enable_cognee = false)."
+  value       = local.cognee_enabled ? module.cognee[0].cognee_s3_artifact_root : null
+}
+
+output "cognee_s3_manifest_root" {
+  description = "Canonical Company Brain S3 ingestion manifest root (null when enable_cognee = false)."
+  value       = local.cognee_enabled ? module.cognee[0].cognee_s3_manifest_root : null
+}
+
+output "cognee_s3_vault_projection_root" {
+  description = "Canonical Company Brain S3 vault projection root (null when enable_cognee = false)."
+  value       = local.cognee_enabled ? module.cognee[0].cognee_s3_vault_projection_root : null
+}
+
+output "cognee_neptune_graph_id" {
+  description = "Neptune Analytics graph ID for production Company Brain (null when enable_cognee = false)."
+  value       = local.cognee_enabled ? module.cognee[0].cognee_neptune_graph_id : null
+}
+
+output "cognee_neptune_endpoint" {
+  description = "Neptune Analytics endpoint for production Company Brain (null when enable_cognee = false)."
+  value       = local.cognee_enabled ? module.cognee[0].cognee_neptune_endpoint : null
+}
+
+output "cognee_private_substrate_mode" {
+  description = "Whether Company Brain substrate is private/internal-only (null when enable_cognee = false)."
+  value       = local.cognee_enabled ? module.cognee[0].cognee_private_substrate_mode : null
+}
+
+output "cognee_production_posture" {
+  description = "Operator evidence string for production-tier approval/readiness posture (null when enable_cognee = false)."
+  value       = local.cognee_enabled ? module.cognee[0].cognee_production_posture : null
+}
+
+output "twenty_provisioned" {
+  description = "Whether the Twenty CRM retained managed-app substrate is provisioned"
+  value       = local.twenty_provisioned
+}
+
+output "twenty_runtime_enabled" {
+  description = "Whether the Twenty CRM server/worker runtime is enabled"
+  value       = local.twenty_runtime_enabled
+}
+
+output "twenty_url" {
+  description = "Public Twenty CRM URL (null when twenty_provisioned = false)"
+  value       = local.twenty_provisioned ? module.twenty[0].twenty_url : null
+}
+
+output "twenty_alb_dns_name" {
+  description = "Public ALB DNS name for Twenty CRM (null when twenty_provisioned = false)"
+  value       = local.twenty_provisioned ? module.twenty[0].twenty_alb_dns_name : null
+}
+
+output "twenty_alb_arn" {
+  description = "Public ALB ARN for Twenty CRM (null when twenty_provisioned = false)"
+  value       = local.twenty_provisioned ? module.twenty[0].twenty_alb_arn : null
+}
+
+output "twenty_target_group_arn" {
+  description = "Target group ARN for Twenty CRM server (null when twenty_provisioned = false)"
+  value       = local.twenty_provisioned ? module.twenty[0].twenty_target_group_arn : null
+}
+
+output "twenty_cluster_arn" {
+  description = "ECS cluster ARN for Twenty CRM (null when twenty_provisioned = false)"
+  value       = local.twenty_provisioned ? module.twenty[0].twenty_cluster_arn : null
+}
+
+output "twenty_server_service_name" {
+  description = "ECS service name for the Twenty server (null when twenty_provisioned = false)"
+  value       = local.twenty_provisioned ? module.twenty[0].twenty_server_service_name : null
+}
+
+output "twenty_worker_service_name" {
+  description = "ECS service name for the Twenty worker (null when twenty_provisioned = false)"
+  value       = local.twenty_provisioned ? module.twenty[0].twenty_worker_service_name : null
+}
+
+output "twenty_server_log_group_name" {
+  description = "CloudWatch log group for the Twenty server (null when twenty_provisioned = false)"
+  value       = local.twenty_provisioned ? module.twenty[0].twenty_server_log_group_name : null
+}
+
+output "twenty_worker_log_group_name" {
+  description = "CloudWatch log group for the Twenty worker (null when twenty_provisioned = false)"
+  value       = local.twenty_provisioned ? module.twenty[0].twenty_worker_log_group_name : null
+}
+
+output "twenty_cache_endpoint" {
+  description = "ElastiCache primary endpoint for Twenty CRM (null when twenty_provisioned = false)"
+  value       = local.twenty_provisioned ? module.twenty[0].twenty_cache_endpoint : null
+}
+
+output "twenty_storage_file_system_id" {
+  description = "EFS file system ID backing Twenty CRM local storage (null when twenty_provisioned = false)"
+  value       = local.twenty_provisioned ? module.twenty[0].twenty_storage_file_system_id : null
+}
+
+output "n8n_provisioned" {
+  description = "Whether the retained n8n substrate is provisioned"
+  value       = local.n8n_provisioned
+}
+
+output "n8n_runtime_enabled" {
+  description = "Whether n8n ECS services are configured to run"
+  value       = local.n8n_runtime_enabled
+}
+
+output "n8n_url" {
+  description = "Public n8n URL (null when n8n_provisioned = false)"
+  value       = local.n8n_provisioned ? module.n8n[0].n8n_url : null
+}
+
+output "n8n_alb_dns_name" {
+  description = "Public ALB DNS name for n8n (null when n8n_provisioned = false)"
+  value       = local.n8n_provisioned ? module.n8n[0].n8n_alb_dns_name : null
+}
+
+output "n8n_alb_arn" {
+  description = "Public ALB ARN for n8n (null when n8n_provisioned = false)"
+  value       = local.n8n_provisioned ? module.n8n[0].n8n_alb_arn : null
+}
+
+output "n8n_target_group_arn" {
+  description = "Target group ARN for the n8n main service (null when n8n_provisioned = false)"
+  value       = local.n8n_provisioned ? module.n8n[0].n8n_target_group_arn : null
+}
+
+output "n8n_cluster_arn" {
+  description = "ECS cluster ARN for n8n (null when n8n_provisioned = false)"
+  value       = local.n8n_provisioned ? module.n8n[0].n8n_cluster_arn : null
+}
+
+output "n8n_main_service_name" {
+  description = "ECS service name for the n8n main service (null when n8n_provisioned = false)"
+  value       = local.n8n_provisioned ? module.n8n[0].n8n_main_service_name : null
+}
+
+output "n8n_worker_service_name" {
+  description = "ECS service name for the n8n worker service (null when n8n_provisioned = false)"
+  value       = local.n8n_provisioned ? module.n8n[0].n8n_worker_service_name : null
+}
+
+output "n8n_main_log_group_name" {
+  description = "CloudWatch log group for the n8n main service (null when n8n_provisioned = false)"
+  value       = local.n8n_provisioned ? module.n8n[0].n8n_main_log_group_name : null
+}
+
+output "n8n_worker_log_group_name" {
+  description = "CloudWatch log group for the n8n worker service (null when n8n_provisioned = false)"
+  value       = local.n8n_provisioned ? module.n8n[0].n8n_worker_log_group_name : null
+}
+
+output "n8n_database_name" {
+  description = "Dedicated n8n database name (null when n8n_provisioned = false)"
+  value       = local.n8n_provisioned ? module.n8n[0].n8n_database_name : null
+}
+
+output "n8n_database_secret_arn" {
+  description = "Secrets Manager ARN used for n8n database runtime credentials (null when n8n_provisioned = false)"
+  value       = local.n8n_provisioned ? module.n8n[0].n8n_database_secret_arn : null
+}
+
+output "n8n_valkey_endpoint" {
+  description = "ElastiCache primary endpoint for n8n queue mode (null when n8n_provisioned = false)"
+  value       = local.n8n_provisioned ? module.n8n[0].n8n_valkey_endpoint : null
+}
+
+output "n8n_storage_bucket_name" {
+  description = "S3 bucket name used for n8n managed artifacts (null when n8n_provisioned = false)"
+  value       = local.n8n_provisioned ? module.n8n[0].n8n_storage_bucket_name : null
+}
+
+output "n8n_storage_prefix" {
+  description = "S3 prefix reserved for n8n managed artifacts (null when n8n_provisioned = false)"
+  value       = local.n8n_provisioned ? module.n8n[0].n8n_storage_prefix : null
+}
+
+output "n8n_image_digest" {
+  description = "Immutable digest extracted from the n8n wrapper image URI (null when n8n_provisioned = false)"
+  value       = local.n8n_provisioned ? module.n8n[0].n8n_image_digest : null
+}
+
+output "n8n_package_config_digest" {
+  description = "Digest of the reviewed n8n custom-package configuration (null when n8n_provisioned = false)"
+  value       = local.n8n_provisioned ? module.n8n[0].n8n_package_config_digest : null
+}
+
+output "n8n_service_credential_secret_arn" {
+  description = "Secrets Manager ARN used for the n8n MCP tenant service credential (null when n8n_provisioned = false)"
+  value       = local.n8n_provisioned ? module.n8n[0].n8n_service_credential_secret_arn : null
+}
+
+output "n8n_agent_step_bridge_credential_secret_arn" {
+  description = "Secrets Manager ARN used for the inbound n8n agent-step bridge credential (null when n8n_provisioned = false)"
+  value       = local.n8n_provisioned ? module.n8n[0].n8n_agent_step_bridge_credential_secret_arn : null
 }
 
 output "admin_url" {
-  description = "Public URL for the admin app (custom domain when set, CloudFront default otherwise)"
-  value       = var.admin_domain != "" ? "https://${var.admin_domain}" : "https://${module.admin_site.distribution_domain}"
+  description = "Deprecated compatibility alias for app_url"
+  value       = local.end_user_app_url
 }
 
 locals {
   end_user_app_url = local.end_user_app_domain != "" ? "https://${local.end_user_app_domain}" : "https://${module.computer_site.distribution_domain}"
 }
 
-# End-user app static site (apps/computer — internal package name retained)
+# End-user app static site (apps/web).
 output "app_distribution_id" {
   description = "CloudFront distribution ID for the end-user app"
   value       = module.computer_site.distribution_id
@@ -169,12 +558,46 @@ output "app_bucket_name" {
 }
 
 output "app_url" {
-  description = "Public URL for the end-user app (custom app domain when set, CloudFront default otherwise)"
+  description = "Public URL for the end-user app (delegated customer domain first, then custom app domain, CloudFront default otherwise)"
   value       = local.end_user_app_url
 }
 
+# Customer domain (<name>.thinkwork.ai). Zone outputs are populated as soon
+# as customer_domain is set; the certificate output waits for the
+# customer_domain_delegated gate. The name servers are the phase-two input
+# for the namespace claim tool's `claim --set-targets <ns...>`.
+output "customer_domain" {
+  description = "Customer domain configured for this deployment (empty when none)"
+  value       = var.customer_domain
+}
+
+output "customer_domain_zone_id" {
+  description = "Route53 hosted zone ID for the customer domain (empty when no customer domain is configured)"
+  value       = module.customer_domain.zone_id
+}
+
+output "customer_domain_name_servers" {
+  description = "The four Route53 name servers for the customer-domain zone — publish these via the claim tool's `claim --set-targets` to delegate (empty when no customer domain is configured)"
+  value       = module.customer_domain.name_servers
+}
+
+output "customer_domain_certificate_arn" {
+  description = "Validated ACM certificate ARN for the customer domain (us-east-1; empty until customer_domain_delegated is true)"
+  value       = module.customer_domain.certificate_arn
+}
+
+output "customer_domain_ses_identity_arn" {
+  description = "SES domain identity ARN for the customer domain (empty when no customer domain is configured). Candidate cognito_email_source_arn value — switching Cognito email to it is an operator action taken only after the identity verifies and SES production access is granted (R11), never automatic."
+  value       = module.customer_domain.ses_identity_arn
+}
+
+output "customer_domain_ses_rule_set_name" {
+  description = "SES receipt rule set name owned by the customer-domain module (empty when no customer domain is configured). Active only when the ses-email module is disabled in this account — KTD6."
+  value       = module.customer_domain.rule_set_name
+}
+
 # Deprecated compatibility aliases. Keep these stable for existing scripts and
-# external callers while the source package remains apps/computer.
+# external callers while the source path is apps/web.
 output "computer_distribution_id" {
   description = "Deprecated alias for app_distribution_id"
   value       = module.computer_site.distribution_id
@@ -197,7 +620,7 @@ output "computer_url" {
 
 # Computer sandbox subdomain (plan-012 U3 / U11.5 — iframe-isolated
 # fragment substrate). Provisioned only when var.computer_sandbox_domain
-# is set. scripts/build-computer.sh reads these to sync the iframe-shell
+# is set. scripts/build-web.sh reads these to sync the iframe-shell
 # bundle and invalidate the sandbox distribution.
 output "computer_sandbox_distribution_id" {
   description = "CloudFront distribution ID for the iframe-isolated sandbox subdomain (empty when not provisioned)"
@@ -220,8 +643,8 @@ output "computer_sandbox_url" {
 }
 
 output "computer_sandbox_allowed_parent_origins" {
-  description = "Comma-separated list of trusted parent origins for the iframe-shell. Mirrors the CSP frame-ancestors directive on the sandbox distribution and is wired into the iframe-shell's __ALLOWED_PARENT_ORIGINS__ Vite define at build time."
-  value       = var.computer_sandbox_allowed_parent_origins
+  description = "Comma-separated list of trusted parent origins for the iframe-shell, including desktop custom-protocol origins. Mirrors the CSP frame-ancestors directive on the sandbox distribution and is wired into the iframe-shell's __ALLOWED_PARENT_ORIGINS__ Vite define at build time."
+  value       = local.computer_sandbox_allowed_parent_origins_effective
 }
 
 # Docs static site
@@ -257,18 +680,28 @@ output "www_bucket_name" {
 }
 
 # SES inbound email
+output "ses_inbound_zone_ids" {
+  description = "Route53 hosted zone IDs for tenant email subdomains, keyed by tenant slug"
+  value       = module.ses.zone_ids
+}
+
 output "ses_inbound_zone_id" {
-  description = "Route53 hosted zone ID for the email subdomain (null when ses_inbound_domain is not set)"
+  description = "Route53 hosted zone ID for the legacy email subdomain (null when ses_inbound_domain is not set)"
   value       = module.ses.zone_id
 }
 
+output "ses_tenant_name_servers" {
+  description = "Name servers for delegated tenant email subzones, keyed by tenant slug. Publish each set as NS records at the parent domain host before SES can verify."
+  value       = module.ses.tenant_name_servers
+}
+
 output "ses_inbound_name_servers" {
-  description = "Name servers for the delegated email subzone. Paste these as NS records at the registrar that hosts the parent domain (e.g. Google Domains) before SES can verify."
+  description = "Name servers for the legacy delegated email subzone. Keep until legacy-address retirement notices are no longer needed."
   value       = module.ses.name_servers
 }
 
 output "ses_inbound_mx_target" {
-  description = "MX target host for the email subdomain. Terraform already writes this into the subzone — this output is informational."
+  description = "MX target host for tenant email subdomains. Terraform already writes this into each subzone — this output is informational."
   value       = module.ses.mx_target
 }