thinkwork-cli 0.12.12 → 0.12.15

package/dist/terraform/modules/app/lambda-api/main.tf

@@ -18,6 +18,12 @@
 
 data "aws_caller_identity" "current" {}
 
+locals {
+  cognee_worker_vpc_enabled = var.cognee_enabled && length(var.cognee_worker_subnet_ids) > 0 && length(var.cognee_worker_security_group_ids) > 0
+  okf_efs_vpc_enabled       = length(var.okf_efs_subnet_ids) > 0 && length(var.okf_efs_security_group_ids) > 0
+  api_base_url              = var.custom_domain != "" ? "https://${var.custom_domain}" : trimsuffix(aws_apigatewayv2_stage.default.invoke_url, "/")
+}
+
 ################################################################################
 # API Gateway V2 — HTTP API
 ################################################################################
@@ -144,536 +150,17 @@ resource "aws_iam_role_policy_attachment" "lambda_basic" {
   policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
 }
 
-resource "aws_iam_role_policy_attachment" "computer_runtime_manager" {
-  # No count guard: module.computer_runtime is unconditional (see
-  # terraform/modules/thinkwork/main.tf), so the policy ARN is always
-  # populated. A `count = var.X != "" ? 1 : 0` guard fails terraform
-  # plan with "Invalid count argument" because var.X resolves from
-  # aws_iam_policy.manager.arn — a computed attribute only known at
-  # apply time, not at plan time. If a future caller wants to make
-  # this attachment conditional, gate it on a known-at-plan-time
-  # boolean variable rather than the ARN string.
-  role       = aws_iam_role.lambda.name
-  policy_arn = var.computer_runtime_manager_policy_arn
-}
-
-resource "aws_iam_role_policy" "lambda_rds" {
-  name = "rds-data-api"
-  role = aws_iam_role.lambda.id
-
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [{
-      Effect = "Allow"
-      Action = [
-        "rds-data:ExecuteStatement",
-        "rds-data:BatchExecuteStatement",
-        "rds-data:BeginTransaction",
-        "rds-data:CommitTransaction",
-        "rds-data:RollbackTransaction",
-      ]
-      Resource = var.db_cluster_arn
-    }]
-  })
-}
-
-resource "aws_iam_role_policy" "lambda_secrets" {
-  name = "secrets-manager"
-  role = aws_iam_role.lambda.id
-
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [
-      {
-        Effect   = "Allow"
-        Action   = ["secretsmanager:GetSecretValue"]
-        Resource = var.graphql_db_secret_arn
-      },
-      {
-        Effect = "Allow"
-        Action = [
-          "secretsmanager:CreateSecret",
-          "secretsmanager:UpdateSecret",
-          "secretsmanager:DeleteSecret",
-          "secretsmanager:GetSecretValue"
-        ]
-        Resource = "arn:aws:secretsmanager:${var.region}:${var.account_id}:secret:thinkwork/*"
-      }
-    ]
-  })
-}
-
-resource "aws_iam_role_policy" "lambda_s3" {
-  name = "s3-access"
-  role = aws_iam_role.lambda.id
-
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [{
-      Effect = "Allow"
-      Action = [
-        "s3:GetObject",
-        "s3:PutObject",
-        "s3:DeleteObject",
-        "s3:ListBucket",
-      ]
-      Resource = [
-        var.bucket_arn,
-        "${var.bucket_arn}/*",
-      ]
-    }]
-  })
-}
-
-resource "aws_iam_role_policy" "lambda_cognito" {
-  name = "cognito-access"
-  role = aws_iam_role.lambda.id
-
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [{
-      Effect = "Allow"
-      Action = [
-        "cognito-idp:AdminCreateUser",
-        "cognito-idp:AdminGetUser",
-        "cognito-idp:AdminUpdateUserAttributes",
-        "cognito-idp:ListUsers",
-      ]
-      Resource = var.user_pool_arn
-    }]
-  })
-}
-
-resource "aws_iam_role_policy" "lambda_cloudwatch_read" {
-  name = "cloudwatch-logs-read"
-  role = aws_iam_role.lambda.id
-
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [{
-      Effect   = "Allow"
-      Action   = ["logs:FilterLogEvents", "logs:GetLogEvents", "logs:DescribeLogGroups"]
-      Resource = "arn:aws:logs:${var.region}:${var.account_id}:log-group:*model-invocations*"
-    }]
-  })
-}
-
-resource "aws_iam_role_policy" "lambda_bedrock" {
-  name = "bedrock-invoke"
-  role = aws_iam_role.lambda.id
-
-  # Cross-region inference profiles (us.anthropic.claude-*) require
-  # `bedrock:InvokeModel` on the *inference-profile* ARN AND on the
-  # underlying foundation-model ARN in *every* region the profile can
-  # route to (e.g. us-east-2 for us.anthropic.claude-haiku-4-5). The
-  # region wildcard below covers all of them. Needed by the eval-runner
-  # llm-rubric judge and any handler that calls Converse with a profile ID.
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [{
-      Effect = "Allow"
-      Action = ["bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream"]
-      Resource = [
-        "arn:aws:bedrock:*::foundation-model/*",
-        "arn:aws:bedrock:*:${var.account_id}:inference-profile/*",
-      ]
-    }]
-  })
-}
-
-# SES send permissions for the email-send handler. Scoped to any
-# verified identity in this account+region so the email-send Lambda
-# can SendRawEmail from agents.thinkwork.ai (and any other domain
-# identity a future deployment might add).
-resource "aws_iam_role_policy" "lambda_ses_send" {
-  name = "ses-send"
-  role = aws_iam_role.lambda.id
-
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [{
-      Effect = "Allow"
-      Action = [
-        "ses:SendEmail",
-        "ses:SendRawEmail",
-      ]
-      Resource = [
-        "arn:aws:ses:${var.region}:${var.account_id}:identity/*",
-        "arn:aws:ses:${var.region}:${var.account_id}:configuration-set/*",
-      ]
-    }]
-  })
-}
-
-# Allow API Lambdas to directly invoke the AgentCore Lambda. Used by
-# chat-agent-invoke (and future wake-up/retry paths) via InvokeCommand.
-resource "aws_iam_role_policy" "lambda_agentcore_invoke" {
-  count = var.agentcore_function_arn != "" ? 1 : 0
-  name  = "agentcore-invoke"
-  role  = aws_iam_role.lambda.id
-
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [{
-      Effect = "Allow"
-      Action = [
-        "lambda:InvokeFunction",
-      ]
-      Resource = compact([
-        var.agentcore_function_arn,
-        "${var.agentcore_function_arn}:*",
-        var.agentcore_flue_function_arn,
-        var.agentcore_flue_function_arn != "" ? "${var.agentcore_flue_function_arn}:*" : "",
-      ])
-    }]
-  })
-}
-
-# Eval-runner: invoke the AgentCore Runtime data plane to run an agent
-# under test, and call AgentCore Evaluations.Evaluate to score the
-# resulting spans. Both APIs are on the bedrock-agentcore service. Also
-# allow reading spans + log events from CloudWatch Logs (aws/spans is
-# the Transaction Search destination; the runtime log groups carry the
-# OTel scope=strands.telemetry.tracer log records that EvaluateCommand
-# requires alongside the spans).
-resource "aws_iam_role_policy" "lambda_eval_runner" {
-  name = "eval-runner-bedrock-agentcore"
-  role = aws_iam_role.lambda.id
-
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [
-      {
-        Sid      = "AgentCoreInvokeRuntime"
-        Effect   = "Allow"
-        Action   = ["bedrock-agentcore:InvokeAgentRuntime"]
-        Resource = "arn:aws:bedrock-agentcore:${var.region}:${var.account_id}:runtime/*"
-      },
-      {
-        Sid    = "AgentCoreEvaluate"
-        Effect = "Allow"
-        Action = [
-          "bedrock-agentcore:Evaluate",
-          "bedrock-agentcore:GetEvaluator",
-          "bedrock-agentcore:ListEvaluators",
-        ]
-        Resource = "*"
-      },
-      {
-        Sid    = "EvalSpansRead"
-        Effect = "Allow"
-        Action = [
-          "logs:FilterLogEvents",
-          "logs:GetLogEvents",
-          "logs:DescribeLogGroups",
-          "logs:DescribeLogStreams",
-        ]
-        Resource = [
-          "arn:aws:logs:${var.region}:${var.account_id}:log-group:aws/spans",
-          "arn:aws:logs:${var.region}:${var.account_id}:log-group:aws/spans:*",
-          "arn:aws:logs:${var.region}:${var.account_id}:log-group:/aws/bedrock-agentcore/runtimes/*",
-          "arn:aws:logs:${var.region}:${var.account_id}:log-group:/aws/bedrock-agentcore/runtimes/*:*",
-        ]
-      },
-      {
-        Sid      = "SsmReadEvalRunnerCfg"
-        Effect   = "Allow"
-        Action   = ["ssm:GetParameter", "ssm:GetParameters"]
-        Resource = "arn:aws:ssm:${var.region}:${var.account_id}:parameter/thinkwork/${var.stage}/agentcore/runtime-id-*"
-      },
-    ]
-  })
-}
-
-# AgentCore Memory read access for the GraphQL memory resolvers.
-# memoryRecords / memorySearch call ListMemoryRecordsCommand to fetch
-# records across the tenant's agents.
-resource "aws_iam_role_policy" "lambda_agentcore_memory" {
-  name = "agentcore-memory-rw"
-  role = aws_iam_role.lambda.id
-
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [{
-      Effect = "Allow"
-      Action = [
-        "bedrock-agentcore:ListMemoryRecords",
-        "bedrock-agentcore:RetrieveMemoryRecords",
-        "bedrock-agentcore:GetMemoryRecord",
-        "bedrock-agentcore:BatchCreateMemoryRecords",
-        "bedrock-agentcore:BatchUpdateMemoryRecords",
-        "bedrock-agentcore:BatchDeleteMemoryRecords",
-        "bedrock-agentcore:DeleteMemoryRecord",
-      ]
-      Resource = "*"
-    }]
-  })
-}
+# All other IAM grants for aws_iam_role.lambda live in the four grouped
+# customer-managed policies in iam-grouped.tf (R9, plan 2026-06-11-006 U6).
+# Do not add inline aws_iam_role_policy resources to this role: the inline
+# aggregate hit IAM's 10,240-byte cap on 2026-06-11 (#2378/#2379). New grants
+# go into the grouped managed policies, never inline.
 
-# graphql-http's sendMessage mutation reads SSM parameters like
-# /thinkwork/${stage}/chat-agent-invoke-fn-arn to discover the direct
-# Lambda targets for cross-function invocation. Without this, the SSM
-# GetParameter call fails with AccessDenied, the caller silently
-# catches the error, and sendMessage falls back to the wakeup-processor
-# path — which doesn't load messages_history from Aurora. That's why
-# multi-turn chat was losing prior context: history was only loaded on
-# the direct path, which never ran.
-resource "aws_iam_role_policy" "lambda_ssm_read" {
-  name = "ssm-param-read"
-  role = aws_iam_role.lambda.id
-
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [
-      {
-        Effect = "Allow"
-        Action = [
-          "ssm:GetParameter",
-          "ssm:GetParameters",
-        ]
-        Resource = "arn:aws:ssm:${var.region}:${var.account_id}:parameter/thinkwork/${var.stage}/*"
-      },
-      # SecureString parameters (e.g. /thinkwork/<stage>/google-places/api-key)
-      # are encrypted with the default AWS-managed SSM key. The default key's
-      # resource policy auto-grants Decrypt to any IAM principal with
-      # ssm:GetParameter on the parameter via `kms:ViaService = ssm.*`, so
-      # this explicit grant is a belt-and-suspenders clarification. If we
-      # later move to a customer-managed KMS key, this is the scope that
-      # needs updating.
-      {
-        Effect   = "Allow"
-        Action   = ["kms:Decrypt"]
-        Resource = "*"
-        Condition = {
-          StringEquals = {
-            "kms:ViaService" = "ssm.${var.region}.amazonaws.com"
-          }
-        }
-      },
-    ]
-  })
-}
+resource "aws_iam_role_policy_attachment" "lambda_cognee_worker_vpc_access" {
+  count = local.cognee_worker_vpc_enabled || local.okf_efs_vpc_enabled ? 1 : 0
 
-# job-schedule-manager creates/updates/deletes EventBridge Scheduler
-# schedules (and the thinkwork-jobs schedule group on first use). Without
-# these permissions the manager Lambda threw silently and every scheduled
-# automation was orphaned with eb_schedule_name = null.
-resource "aws_iam_role_policy" "lambda_scheduler" {
-  name = "eventbridge-scheduler-rw"
-  role = aws_iam_role.lambda.id
-
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [
-      {
-        Effect = "Allow"
-        Action = [
-          "scheduler:CreateSchedule",
-          "scheduler:UpdateSchedule",
-          "scheduler:DeleteSchedule",
-          "scheduler:GetSchedule",
-          "scheduler:ListSchedules",
-          "scheduler:CreateScheduleGroup",
-          "scheduler:GetScheduleGroup",
-          "scheduler:DeleteScheduleGroup",
-          "scheduler:TagResource",
-        ]
-        Resource = "*"
-      },
-      # Scheduler.CreateSchedule takes a RoleArn for the target; AWS requires
-      # the caller to have iam:PassRole on that role. Without this the
-      # CreateSchedule call fails with AccessDenied even if the scheduler
-      # permissions above are set.
-      {
-        Effect   = "Allow"
-        Action   = ["iam:PassRole"]
-        Resource = var.job_scheduler_role_arn != "" ? var.job_scheduler_role_arn : "*"
-      },
-    ]
-  })
-}
-
-# Allow API handler Lambdas to invoke each other directly. sendMessage
-# dispatches to chat-agent-invoke for instant chat response; the memory
-# resolvers reach knowledge-base-manager and job-schedule-manager for
-# admin-driven operations. The existing lambda_agentcore_invoke policy
-# covers the Strands runtime Lambda only — this one covers internal
-# api-to-api calls. ARNs are constructed deterministically from the
-# handler naming pattern so we don't create a dependency cycle with the
-# handler resource.
-resource "aws_iam_role_policy" "lambda_api_cross_invoke" {
-  name = "api-cross-function-invoke"
-  role = aws_iam_role.lambda.id
-
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [{
-      Effect = "Allow"
-      Action = ["lambda:InvokeFunction"]
-      Resource = [
-        "arn:aws:lambda:${var.region}:${var.account_id}:function:thinkwork-${var.stage}-api-chat-agent-invoke",
-        "arn:aws:lambda:${var.region}:${var.account_id}:function:thinkwork-${var.stage}-api-knowledge-base-manager",
-        "arn:aws:lambda:${var.region}:${var.account_id}:function:thinkwork-${var.stage}-api-job-schedule-manager",
-        # eval-runner: graphql-http's startEvalRun mutation Event-invokes
-        # this asynchronously after inserting the eval_runs row.
-        "arn:aws:lambda:${var.region}:${var.account_id}:function:thinkwork-${var.stage}-api-eval-runner",
-        # wiki-compile: memory-retain Event-invokes this after a successful
-        # retainTurn when the tenant's wiki_compile_enabled flag is on.
-        # compileWikiNow admin mutation also Event-invokes.
-        "arn:aws:lambda:${var.region}:${var.account_id}:function:thinkwork-${var.stage}-api-wiki-compile",
-        # wiki-bootstrap-import: bootstrapJournalImport admin mutation
-        # Event-invokes this for the long-running ingest path.
-        "arn:aws:lambda:${var.region}:${var.account_id}:function:thinkwork-${var.stage}-api-wiki-bootstrap-import",
-        # ontology-scan: startOntologySuggestionScan Event-invokes this
-        # after inserting a durable scan job row.
-        "arn:aws:lambda:${var.region}:${var.account_id}:function:thinkwork-${var.stage}-api-ontology-scan",
-        # ontology-reprocess: approveOntologyChangeSet Event-invokes this
-        # after inserting a durable reprocess job row.
-        "arn:aws:lambda:${var.region}:${var.account_id}:function:thinkwork-${var.stage}-api-ontology-reprocess",
-        # routine-resume: routine-approval-bridge (Phase B U8) invokes
-        # this with RequestResponse after a HITL decideInboxItem
-        # decision. Calls SendTaskSuccess/SendTaskFailure on the SFN
-        # task token; idempotent on already-consumed tokens.
-        "arn:aws:lambda:${var.region}:${var.account_id}:function:thinkwork-${var.stage}-api-routine-resume",
-        # workspace-files-efs: workspace-files invokes this (RequestResponse)
-        # for Computer-target list/get to bypass the computer_tasks queue
-        # and read EFS directly. Standalone resource below.
-        "arn:aws:lambda:${var.region}:${var.account_id}:function:thinkwork-${var.stage}-api-workspace-files-efs",
-      ]
-    }]
-  })
-}
-
-resource "aws_iam_policy" "thread_idle_memory_learning_invoke" {
-  name        = "thinkwork-${var.stage}-thread-idle-memory-learning-invoke"
-  description = "Allow API job-trigger Lambda to invoke requester idle memory learning worker."
-
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [{
-      Effect   = "Allow"
-      Action   = ["lambda:InvokeFunction"]
-      Resource = "arn:aws:lambda:${var.region}:${var.account_id}:function:thinkwork-${var.stage}-api-thread-idle-memory-learning"
-    }]
-  })
-}
-
-resource "aws_iam_role_policy_attachment" "lambda_thread_idle_memory_learning_invoke" {
   role       = aws_iam_role.lambda.name
-  policy_arn = aws_iam_policy.thread_idle_memory_learning_invoke.arn
-}
-
-# Step Functions admin operations — for createRoutine / publishRoutineVersion
-# / triggerRoutineRun / updateRoutine resolvers (Phase B U7) and the
-# routine-asl-validator Lambda (Phase A U5). State-machine ARNs follow the
-# naming convention `thinkwork-${stage}-routine-*`; aliases follow the
-# state-machine ARN with a colon-separated alias name.
-resource "aws_iam_role_policy" "lambda_routines_stepfunctions" {
-  name = "routines-step-functions"
-  role = aws_iam_role.lambda.id
-
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [
-      {
-        Sid    = "RoutineStateMachineLifecycle"
-        Effect = "Allow"
-        Action = [
-          "states:CreateStateMachine",
-          "states:UpdateStateMachine",
-          "states:DeleteStateMachine",
-          "states:DescribeStateMachine",
-          "states:ListStateMachines",
-          "states:TagResource",
-          "states:UntagResource",
-          "states:PublishStateMachineVersion",
-          "states:DeleteStateMachineVersion",
-          "states:ListStateMachineVersions",
-          "states:CreateStateMachineAlias",
-          "states:UpdateStateMachineAlias",
-          "states:DeleteStateMachineAlias",
-          "states:DescribeStateMachineAlias",
-          "states:ListStateMachineAliases",
-          "states:DescribeStateMachineForExecution",
-        ]
-        Resource = "arn:aws:states:${var.region}:${var.account_id}:stateMachine:thinkwork-${var.stage}-routine-*"
-      },
-      {
-        Sid    = "RoutineExecution"
-        Effect = "Allow"
-        Action = [
-          "states:StartExecution",
-          "states:StartSyncExecution",
-          "states:StopExecution",
-          "states:DescribeExecution",
-          "states:ListExecutions",
-          "states:GetExecutionHistory",
-        ]
-        Resource = [
-          "arn:aws:states:${var.region}:${var.account_id}:stateMachine:thinkwork-${var.stage}-routine-*",
-          "arn:aws:states:${var.region}:${var.account_id}:execution:thinkwork-${var.stage}-routine-*:*",
-        ]
-      },
-      {
-        Sid    = "RoutineTaskTokens"
-        Effect = "Allow"
-        Action = [
-          "states:SendTaskSuccess",
-          "states:SendTaskFailure",
-          "states:SendTaskHeartbeat",
-        ]
-        Resource = "*"
-      },
-      {
-        Sid      = "RoutineValidate"
-        Effect   = "Allow"
-        Action   = ["states:ValidateStateMachineDefinition"]
-        Resource = "*"
-      },
-      {
-        # PassRole so the createRoutine resolver can hand the routines
-        # execution role to a newly-created state machine. Scoped to the
-        # specific role created by the routines-stepfunctions module.
-        Sid      = "RoutinePassExecutionRole"
-        Effect   = "Allow"
-        Action   = ["iam:PassRole"]
-        Resource = "arn:aws:iam::${var.account_id}:role/thinkwork-${var.stage}-routines-execution-role"
-        Condition = {
-          StringEquals = {
-            "iam:PassedToService" = "states.amazonaws.com"
-          }
-        }
-      },
-      {
-        # routine-task-python (Phase B U6) wraps the AgentCore code
-        # interpreter so SFN can run `python` recipe states. Three calls
-        # per Task: Start session, Invoke, Stop. Resource is `*` because
-        # interpreter sessions are runtime-scoped, not provisioned.
-        Sid    = "RoutineTaskPythonCodeInterpreter"
-        Effect = "Allow"
-        Action = [
-          "bedrock-agentcore:StartCodeInterpreterSession",
-          "bedrock-agentcore:InvokeCodeInterpreter",
-          "bedrock-agentcore:StopCodeInterpreterSession",
-          "bedrock-agentcore:GetCodeInterpreterSession",
-        ]
-        Resource = "*"
-      },
-      {
-        # routine-task-python S3 offload — full stdout/stderr land in
-        # the per-stage routine-output bucket under
-        # <tenantId>/<sfn-execution-id>/<nodeId>/{stdout,stderr}.log.
-        # PutObject only — the read path is GraphQL-fronted and runs
-        # under the graphql-http handler's role, not this one.
-        Sid    = "RoutineTaskPythonS3Offload"
-        Effect = "Allow"
-        Action = [
-          "s3:PutObject",
-        ]
-        Resource = "arn:aws:s3:::thinkwork-${var.stage}-routine-output/*"
-      },
-    ]
-  })
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"
 }
 
 ################################################################################

package/dist/terraform/modules/app/lambda-api/mcp-oauth.tf

@@ -2,7 +2,7 @@ locals {
   mcp_oauth_api_base_url       = "https://${aws_apigatewayv2_api.main.id}.execute-api.${var.region}.amazonaws.com"
   mcp_oauth_cognito_base_url   = var.cognito_auth_domain != "" ? "https://${var.cognito_auth_domain}.auth.${var.region}.amazoncognito.com" : ""
   mcp_oauth_identity_providers = var.google_oauth_client_id != "" ? ["Google", "COGNITO"] : ["COGNITO"]
-  mcp_oauth_logo_path          = "${path.module}/../../../../apps/admin/public/logo.png"
+  mcp_oauth_logo_path          = "${path.module}/../../../../apps/web/public/logo.png"
 }
 
 resource "aws_dynamodb_table" "mcp_oauth_revocations" {
@@ -98,21 +98,5 @@ resource "aws_cognito_user_pool_ui_customization" "mcp_oauth" {
   CSS
 }
 
-resource "aws_iam_role_policy" "lambda_mcp_oauth_revocations" {
-  name = "mcp-oauth-revocations"
-  role = aws_iam_role.lambda.id
-
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [
-      {
-        Effect = "Allow"
-        Action = [
-          "dynamodb:GetItem",
-          "dynamodb:PutItem"
-        ]
-        Resource = aws_dynamodb_table.mcp_oauth_revocations.arn
-      }
-    ]
-  })
-}
+# The shared-role DynamoDB grant for the revocations table moved to
+# aws_iam_policy.api_data_plane in iam-grouped.tf (R9).

package/dist/terraform/modules/app/lambda-api/outputs.tf

@@ -4,8 +4,8 @@ output "api_id" {
 }
 
 output "api_endpoint" {
-  description = "API Gateway V2 endpoint URL"
-  value       = aws_apigatewayv2_stage.default.invoke_url
+  description = "Public HTTP API base URL. Uses the custom domain when configured so VPC runtimes with execute-api private DNS can still call service callbacks."
+  value       = local.api_base_url
 }
 
 output "api_execution_arn" {
@@ -34,23 +34,67 @@ output "lambda_artifact_mode" {
 }
 
 output "memory_retain_fn_name" {
-  description = "Memory-retain Lambda function name. Strands runtime invokes this directly to push conversational turns into the active memory engine."
+  description = "Memory-retain Lambda function name. Pi invokes this directly to push conversational turns into the active memory engine."
   value       = local.deploy_lambda_handlers ? aws_lambda_function.handler["memory-retain"].function_name : ""
 }
 
 output "memory_retain_fn_arn" {
-  description = "Memory-retain Lambda ARN. Used to grant lambda:InvokeFunction to the agentcore-runtime role."
+  description = "Memory-retain Lambda ARN. Used to grant lambda:InvokeFunction to the Pi runtime role."
   value       = local.deploy_lambda_handlers ? aws_lambda_function.handler["memory-retain"].arn : ""
 }
 
+output "knowledge_graph_thread_ingest_fn_name" {
+  description = "Knowledge Graph thread ingest worker Lambda function name."
+  value       = local.deploy_lambda_handlers ? aws_lambda_function.handler["knowledge-graph-thread-ingest"].function_name : ""
+}
+
+output "knowledge_graph_thread_ingest_fn_arn" {
+  description = "Knowledge Graph thread ingest worker Lambda ARN."
+  value       = local.deploy_lambda_handlers ? aws_lambda_function.handler["knowledge-graph-thread-ingest"].arn : ""
+}
+
+output "okf_efs_refresh_fn_name" {
+  description = "OKF EFS refresh Lambda function name."
+  value       = local.deploy_lambda_handlers ? aws_lambda_function.handler["okf-efs-refresh"].function_name : ""
+}
+
+output "okf_efs_refresh_fn_arn" {
+  description = "OKF EFS refresh Lambda ARN."
+  value       = local.deploy_lambda_handlers ? aws_lambda_function.handler["okf-efs-refresh"].arn : ""
+}
+
+output "brain_artifacts_bucket_name" {
+  description = "Canonical Company Brain S3 bucket for source artifacts, ingestion manifests, migration snapshots, vault projections, and exports."
+  value       = aws_s3_bucket.brain_artifacts.bucket
+}
+
+output "brain_artifacts_bucket_arn" {
+  description = "ARN of the canonical Company Brain artifact bucket."
+  value       = aws_s3_bucket.brain_artifacts.arn
+}
+
+output "billing_export_bucket_name" {
+  description = "Configured AWS billing export bucket consumed by the THNK-74 bill reconciler, or empty when not configured."
+  value       = var.billing_export_bucket_name
+}
+
+output "billing_export_manifest_key" {
+  description = "Configured AWS billing export manifest key consumed by the THNK-74 bill reconciler, or empty when not configured."
+  value       = var.billing_export_manifest_key
+}
+
 output "email_inbound_fn_arn" {
   description = "email-inbound Lambda ARN. Used by the SES module to wire the receipt rule Lambda action."
-  value       = local.deploy_lambda_handlers ? aws_lambda_function.handler["email-inbound"].arn : ""
+  # Statically constructed (not a resource attribute): SES/customer-domain gate
+  # count on this value, and an apply-time-unknown breaks the FIRST apply in a
+  # fresh account ("Invalid count argument" — THINK-118 harness cycle 4).
+  value = local.deploy_lambda_handlers ? "arn:aws:lambda:${var.region}:${var.account_id}:function:thinkwork-${var.stage}-api-email-inbound" : ""
 }
 
 output "email_inbound_fn_name" {
   description = "email-inbound Lambda function name. Used by the SES module for lambda:InvokeFunction permissions."
-  value       = local.deploy_lambda_handlers ? aws_lambda_function.handler["email-inbound"].function_name : ""
+  # Static for the same fresh-account plan-time reason as email_inbound_fn_arn.
+  value       = local.deploy_lambda_handlers ? "thinkwork-${var.stage}-api-email-inbound" : ""
 }
 
 # ---------------------------------------------------------------------------