thinkwork-cli 0.12.12 → 0.12.15

package/dist/terraform/modules/app/ses-email/main.tf

@@ -1,15 +1,19 @@
 ################################################################################
 # SES Email — App Module
 #
-# Wires up inbound and outbound email for a delegated subdomain
-# (e.g. agents.thinkwork.ai). The module:
+# Wires up inbound and outbound email for a legacy delegated subdomain
+# (e.g. agents.thinkwork.ai) plus delegated tenant subdomains
+# (e.g. acme.thinkwork.ai). The module:
 #
-#   1. Creates a Route53 hosted zone for the subdomain (Option A — delegated
-#      subzone). The operator pastes the output name servers at whatever hosts
-#      the parent domain (Google, Squarespace, Cloudflare, etc.).
-#   2. Creates the SES domain identity + DKIM tokens.
-#   3. Writes the SES verification TXT, DKIM CNAMEs, and an MX record into the
-#      new subzone.
+#   1. Keeps the legacy Route53 hosted zone for agents.thinkwork.ai when
+#      configured, and creates one Route53 hosted zone per tenant subdomain
+#      (Option A — delegated subzones). The operator publishes each output
+#      name-server set at whatever hosts the parent domain (Cloudflare, Google,
+#      etc.).
+#   2. Creates SES domain identities + DKIM token sets for the configured
+#      legacy domain and each tenant subdomain.
+#   3. Writes SES verification TXT, DKIM CNAME, and MX records into the matching
+#      subzone.
 #   4. Creates an SES receipt rule set that stores inbound mail in S3 at
 #      `email/inbound/<sesMessageId>` and invokes the email-inbound Lambda.
 ################################################################################
@@ -30,12 +34,24 @@ variable "region" {
   default     = "us-east-1"
 }
 
+variable "parent_domain" {
+  description = "Parent domain for tenant email subdomains (e.g. thinkwork.ai). Leave empty to skip all SES resources."
+  type        = string
+  default     = ""
+}
+
 variable "email_domain" {
-  description = "Subdomain used for agent email (e.g. agents.thinkwork.ai). Leave empty to skip all SES resources."
+  description = "Legacy delegated subdomain used for agent email (e.g. agents.thinkwork.ai). Kept until legacy-address retirement notices are no longer needed."
   type        = string
   default     = ""
 }
 
+variable "tenant_slugs" {
+  description = "Tenant slugs to provision as SES receiving subdomains under parent_domain. Each slug creates <slug>.<parent_domain>."
+  type        = set(string)
+  default     = []
+}
+
 variable "inbound_bucket_name" {
   description = "S3 bucket that SES writes raw inbound .eml files into. Its policy must already allow ses.amazonaws.com PutObject."
   type        = string
@@ -54,6 +70,12 @@ variable "email_inbound_fn_name" {
   default     = ""
 }
 
+variable "enable_email_inbound_lambda_action" {
+  description = "Attach the email-inbound Lambda action and invoke permission to SES receipt rules."
+  type        = bool
+  default     = false
+}
+
 variable "manage_active_rule_set" {
   description = "Activate the receipt rule set. Only ONE rule set can be active per region per account, so set false in secondary stages that share an account."
   type        = bool
@@ -61,19 +83,34 @@ variable "manage_active_rule_set" {
 }
 
 locals {
-  enabled       = var.email_domain != ""
+  tenant_slugs   = toset(var.tenant_slugs)
+  legacy_enabled = var.email_domain != ""
+  tenant_enabled = var.parent_domain != "" && length(local.tenant_slugs) > 0
+  enabled        = local.legacy_enabled || local.tenant_enabled
+
+  tenant_domains = {
+    for slug in local.tenant_slugs : slug => "${slug}.${var.parent_domain}"
+  }
+
+  tenant_dkim_records = local.tenant_enabled ? {
+    for pair in setproduct(sort(tolist(local.tenant_slugs)), range(3)) : "${pair[0]}-${pair[1]}" => {
+      slug  = pair[0]
+      index = pair[1]
+    }
+  } : {}
+
   inbound_smtp  = "inbound-smtp.${var.region}.amazonaws.com"
   rule_set_name = "thinkwork-${var.stage}-email-rules"
-  has_lambda    = var.email_inbound_fn_arn != ""
+  has_lambda    = var.enable_email_inbound_lambda_action && var.email_inbound_fn_arn != "" && var.email_inbound_fn_name != ""
   has_bucket    = var.inbound_bucket_name != ""
 }
 
 ################################################################################
-# Route53 — delegated subzone for the agent email subdomain
+# Route53 — delegated subzones for legacy + tenant email subdomains
 ################################################################################
 
 resource "aws_route53_zone" "agents" {
-  count = local.enabled ? 1 : 0
+  count = local.legacy_enabled ? 1 : 0
   name  = var.email_domain
 
   tags = {
@@ -82,26 +119,47 @@ resource "aws_route53_zone" "agents" {
   }
 }
 
+resource "aws_route53_zone" "tenant" {
+  for_each = local.tenant_enabled ? local.tenant_domains : {}
+  name     = each.value
+
+  tags = {
+    Name       = "thinkwork-${var.stage}-${each.key}-email-zone"
+    Stage      = var.stage
+    TenantSlug = each.key
+  }
+}
+
 ################################################################################
-# SES Domain Identity + DKIM
+# SES Domain Identities + DKIM for legacy + tenant subdomains
 ################################################################################
 
 resource "aws_ses_domain_identity" "main" {
-  count  = local.enabled ? 1 : 0
+  count  = local.legacy_enabled ? 1 : 0
   domain = var.email_domain
 }
 
 resource "aws_ses_domain_dkim" "main" {
-  count  = local.enabled ? 1 : 0
+  count  = local.legacy_enabled ? 1 : 0
   domain = aws_ses_domain_identity.main[0].domain
 }
 
+resource "aws_ses_domain_identity" "tenant" {
+  for_each = local.tenant_enabled ? local.tenant_domains : {}
+  domain   = each.value
+}
+
+resource "aws_ses_domain_dkim" "tenant" {
+  for_each = local.tenant_enabled ? local.tenant_domains : {}
+  domain   = aws_ses_domain_identity.tenant[each.key].domain
+}
+
 ################################################################################
-# DNS records in the subzone — verification TXT, DKIM CNAMEs, MX
+# DNS records in legacy + tenant subzones — verification TXT, DKIM CNAMEs, MX
 ################################################################################
 
 resource "aws_route53_record" "ses_verification" {
-  count   = local.enabled ? 1 : 0
+  count   = local.legacy_enabled ? 1 : 0
   zone_id = aws_route53_zone.agents[0].zone_id
   name    = "_amazonses.${var.email_domain}"
   type    = "TXT"
@@ -109,8 +167,17 @@ resource "aws_route53_record" "ses_verification" {
   records = [aws_ses_domain_identity.main[0].verification_token]
 }
 
+resource "aws_route53_record" "tenant_ses_verification" {
+  for_each = local.tenant_enabled ? local.tenant_domains : {}
+  zone_id  = aws_route53_zone.tenant[each.key].zone_id
+  name     = "_amazonses.${each.value}"
+  type     = "TXT"
+  ttl      = 600
+  records  = [aws_ses_domain_identity.tenant[each.key].verification_token]
+}
+
 resource "aws_route53_record" "dkim" {
-  count   = local.enabled ? 3 : 0
+  count   = local.legacy_enabled ? 3 : 0
   zone_id = aws_route53_zone.agents[0].zone_id
   name    = "${aws_ses_domain_dkim.main[0].dkim_tokens[count.index]}._domainkey.${var.email_domain}"
   type    = "CNAME"
@@ -118,8 +185,17 @@ resource "aws_route53_record" "dkim" {
   records = ["${aws_ses_domain_dkim.main[0].dkim_tokens[count.index]}.dkim.amazonses.com"]
 }
 
+resource "aws_route53_record" "tenant_dkim" {
+  for_each = local.tenant_dkim_records
+  zone_id  = aws_route53_zone.tenant[each.value.slug].zone_id
+  name     = "${aws_ses_domain_dkim.tenant[each.value.slug].dkim_tokens[each.value.index]}._domainkey.${local.tenant_domains[each.value.slug]}"
+  type     = "CNAME"
+  ttl      = 600
+  records  = ["${aws_ses_domain_dkim.tenant[each.value.slug].dkim_tokens[each.value.index]}.dkim.amazonses.com"]
+}
+
 resource "aws_route53_record" "mx" {
-  count   = local.enabled ? 1 : 0
+  count   = local.legacy_enabled ? 1 : 0
   zone_id = aws_route53_zone.agents[0].zone_id
   name    = var.email_domain
   type    = "MX"
@@ -127,6 +203,15 @@ resource "aws_route53_record" "mx" {
   records = ["10 ${local.inbound_smtp}"]
 }
 
+resource "aws_route53_record" "tenant_mx" {
+  for_each = local.tenant_enabled ? local.tenant_domains : {}
+  zone_id  = aws_route53_zone.tenant[each.key].zone_id
+  name     = each.value
+  type     = "MX"
+  ttl      = 600
+  records  = ["10 ${local.inbound_smtp}"]
+}
+
 ################################################################################
 # SES Receipt Rule Set + Rule → S3 + Lambda
 ################################################################################
@@ -154,7 +239,7 @@ resource "aws_ses_receipt_rule" "inbound" {
   count         = local.enabled ? 1 : 0
   name          = "thinkwork-${var.stage}-inbound-email"
   rule_set_name = aws_ses_receipt_rule_set.main[0].rule_set_name
-  recipients    = [var.email_domain]
+  recipients    = []
   enabled       = true
   scan_enabled  = true
 
@@ -183,28 +268,56 @@ resource "aws_ses_receipt_rule" "inbound" {
 # Outputs
 ################################################################################
 
+output "ses_domain_identity_arns" {
+  description = "SES domain identity ARNs by tenant slug"
+  value = {
+    for slug, identity in aws_ses_domain_identity.tenant : slug => identity.arn
+  }
+}
+
 output "ses_domain_identity_arn" {
-  description = "SES domain identity ARN"
-  value       = local.enabled ? aws_ses_domain_identity.main[0].arn : null
+  description = "Legacy SES domain identity ARN"
+  value       = local.legacy_enabled ? aws_ses_domain_identity.main[0].arn : null
+}
+
+output "tenant_dkim_tokens" {
+  description = "DKIM tokens by tenant slug (already written as CNAMEs in each subzone)"
+  value = {
+    for slug, dkim in aws_ses_domain_dkim.tenant : slug => dkim.dkim_tokens
+  }
 }
 
 output "dkim_tokens" {
-  description = "DKIM tokens (already written as CNAMEs in the subzone)"
-  value       = local.enabled ? aws_ses_domain_dkim.main[0].dkim_tokens : []
+  description = "Legacy DKIM tokens (already written as CNAMEs in the legacy subzone)"
+  value       = local.legacy_enabled ? aws_ses_domain_dkim.main[0].dkim_tokens : []
+}
+
+output "zone_ids" {
+  description = "Route53 hosted zone IDs by tenant slug"
+  value = {
+    for slug, zone in aws_route53_zone.tenant : slug => zone.zone_id
+  }
 }
 
 output "zone_id" {
-  description = "Route53 hosted zone ID for the email subdomain"
-  value       = local.enabled ? aws_route53_zone.agents[0].zone_id : null
+  description = "Legacy Route53 hosted zone ID"
+  value       = local.legacy_enabled ? aws_route53_zone.agents[0].zone_id : null
+}
+
+output "tenant_name_servers" {
+  description = "Name servers by tenant slug. Publish each set as NS records at the parent domain host before SES can verify."
+  value = {
+    for slug, zone in aws_route53_zone.tenant : slug => zone.name_servers
+  }
 }
 
 output "name_servers" {
-  description = "Name servers for the delegated email subzone. Paste these as NS records at the registrar that hosts the parent domain (e.g. Google Domains) before SES can verify."
-  value       = local.enabled ? aws_route53_zone.agents[0].name_servers : []
+  description = "Legacy email subzone name servers"
+  value       = local.legacy_enabled ? aws_route53_zone.agents[0].name_servers : []
 }
 
 output "mx_target" {
-  description = "MX target host for the email subdomain"
+  description = "MX target host for each tenant email subdomain"
   value       = local.enabled ? local.inbound_smtp : null
 }
 

package/dist/terraform/modules/app/static-site/main.tf

@@ -1,7 +1,7 @@
 ################################################################################
 # Static Site — App Module
 #
-# S3 + CloudFront distribution for static web apps (apps/admin, docs site).
+# S3 + CloudFront distribution for static web apps.
 # Reusable for any static frontend that needs a CDN + custom domain.
 ################################################################################
 
@@ -55,7 +55,7 @@ variable "viewer_request_function_code" {
 # Response-headers policy (optional, plan-012 U3)
 #
 # Two opt-in forms, both backwards compatible — existing callers
-# (computer_site, admin_site, docs_site, www_site) leave both unset and the
+# (computer_site, docs_site, www_site) leave both unset and the
 # distribution is created with no response-headers policy attached:
 #
 #   - Pass `response_headers_policy_id` to attach an existing policy by id.
@@ -144,7 +144,8 @@ check "policy_inputs_are_mutually_exclusive" {
 }
 
 resource "aws_s3_bucket" "site" {
-  bucket = local.bucket_name
+  bucket        = local.bucket_name
+  force_destroy = var.stage == "dev"
 
   tags = {
     Name = "thinkwork-${var.stage}-${var.site_name}"

package/dist/terraform/modules/app/www-dns/main.tf

@@ -12,6 +12,10 @@
 #   6. Optional admin.<domain> CNAME → admin CloudFront distribution.
 #   7. Optional app.<domain> CNAME → end-user app CloudFront distribution.
 #   8. Optional computer.<domain> → app.<domain> 301 compatibility redirect.
+#   9. Optional crm.<domain> CNAME → Twenty CRM public ALB. The CRM ALB uses
+#      its own certificate; this module only owns the public CNAME.
+#  10. Optional n8n.<domain> CNAME → n8n public ALB. The n8n ALB uses its own
+#      certificate; this module only owns the public CNAME.
 #
 # Cloudflare records MUST be DNS-only (grey cloud). CloudFront terminates TLS
 # with the ACM cert and needs the real Host header.
@@ -39,11 +43,13 @@ locals {
   computer = "computer.${var.domain}"
   sandbox  = "sandbox.${var.domain}"
   api      = "api.${var.domain}"
+  crm      = "crm.${var.domain}"
+  n8n      = "n8n.${var.domain}"
   name_id  = replace(var.domain, ".", "-")
 
   # ACM SANs: always include www, conditionally include docs, admin, computer,
-  # and api. The Computer iframe sandbox uses its own certificate so adding or
-  # rotating the sandbox host never forces a replacement of this shared
+  # and api. The Computer iframe sandbox and CRM ALB use their own certificates
+  # so adding or rotating those hosts never forces a replacement of this shared
   # production certificate.
   # Gated on plain bool vars (not on CloudFront/API Gateway outputs) to keep
   # the dependency graph acyclic — distributions / custom domain names
@@ -59,14 +65,16 @@ locals {
 
   # Existing CNAME records stay gated on non-empty targets because their target
   # outputs are already known in the deployed stack. Newly bootstrapped records
-  # such as app/computer compatibility/sandbox CNAMEs must gate only on explicit
-  # booleans so Terraform can plan the resource count before the new CloudFront
-  # distribution exists.
+  # such as app/computer compatibility/sandbox/crm CNAMEs must gate only on
+  # explicit booleans so Terraform can plan the resource count before the new
+  # load balancer exists.
   create_docs_record     = var.include_docs && var.docs_cloudfront_domain_name != ""
   create_admin_record    = var.include_admin && var.admin_cloudfront_domain_name != ""
   create_app_record      = var.include_app
   create_computer_record = var.include_computer
   create_api_record      = var.include_api && var.api_gateway_id != ""
+  create_crm_record      = var.include_crm
+  create_n8n_record      = var.include_n8n
 }
 
 ################################################################################
@@ -373,3 +381,35 @@ resource "cloudflare_record" "api" {
   proxied = false
   comment = "thinkwork-${var.stage} api → API Gateway v2 regional domain"
 }
+
+################################################################################
+# crm.<domain> → Twenty CRM public ALB (optional)
+################################################################################
+
+resource "cloudflare_record" "crm" {
+  count = local.create_crm_record ? 1 : 0
+
+  zone_id = var.cloudflare_zone_id
+  name    = local.crm
+  content = var.crm_alb_dns_name
+  type    = "CNAME"
+  ttl     = 300
+  proxied = false
+  comment = "thinkwork-${var.stage} crm → Twenty CRM public ALB"
+}
+
+################################################################################
+# n8n.<domain> -> n8n public ALB (optional)
+################################################################################
+
+resource "cloudflare_record" "n8n" {
+  count = local.create_n8n_record ? 1 : 0
+
+  zone_id = var.cloudflare_zone_id
+  name    = local.n8n
+  content = var.n8n_alb_dns_name
+  type    = "CNAME"
+  ttl     = 300
+  proxied = false
+  comment = "thinkwork-${var.stage} n8n -> n8n public ALB"
+}

package/dist/terraform/modules/app/www-dns/outputs.tf

@@ -22,3 +22,13 @@ output "api_custom_domain_target" {
   description = "API Gateway regional target domain to CNAME to (useful for external DNS configuration). Empty string when include_api is false."
   value       = var.include_api ? aws_apigatewayv2_domain_name.api[0].domain_name_configuration[0].target_domain_name : ""
 }
+
+output "crm_custom_domain_name" {
+  description = "Custom domain name for Twenty CRM (e.g. crm.thinkwork.ai). Empty string when include_crm is false."
+  value       = var.include_crm ? "crm.${var.domain}" : ""
+}
+
+output "n8n_custom_domain_name" {
+  description = "Custom domain name for n8n (e.g. n8n.thinkwork.ai). Empty string when include_n8n is false."
+  value       = var.include_n8n ? "n8n.${var.domain}" : ""
+}

package/dist/terraform/modules/app/www-dns/variables.tf

@@ -84,6 +84,30 @@ variable "include_api" {
   default     = false
 }
 
+variable "include_crm" {
+  description = "When true, create a Cloudflare CNAME for the Twenty CRM public ALB. The CRM ALB uses its own certificate."
+  type        = bool
+  default     = false
+}
+
+variable "crm_alb_dns_name" {
+  description = "Public ALB DNS name for the Twenty CRM app. Used as the target for the crm.<domain> Cloudflare CNAME when include_crm is true."
+  type        = string
+  default     = ""
+}
+
+variable "include_n8n" {
+  description = "When true, create a Cloudflare CNAME for the n8n public ALB. The n8n ALB uses its own certificate."
+  type        = bool
+  default     = false
+}
+
+variable "n8n_alb_dns_name" {
+  description = "Public ALB DNS name for n8n. Used as the target for the n8n.<domain> Cloudflare CNAME when include_n8n is true."
+  type        = string
+  default     = ""
+}
+
 variable "api_gateway_id" {
   description = "aws_apigatewayv2_api.id of the HTTP API to expose at api.<domain>. Required when include_api is true."
   type        = string

package/dist/terraform/modules/data/aurora-postgres/main.tf

@@ -73,7 +73,11 @@ resource "aws_security_group" "db" {
   }
 
   lifecycle {
-    ignore_changes = [name]
+    # App modules grant their own task security groups database access through
+    # standalone aws_security_group_rule resources. Keep this shared group from
+    # trying to reconcile those externally managed ingress rules during targeted
+    # managed-app deploys.
+    ignore_changes = [name, ingress]
   }
 }
 
@@ -121,6 +125,12 @@ resource "aws_rds_cluster" "main" {
   tags = {
     Name = "thinkwork-${var.stage}-db"
   }
+
+  lifecycle {
+    # Aurora can auto-advance patch versions; never attempt to roll an
+    # existing cluster back to the module's default minor version.
+    ignore_changes = [engine_version]
+  }
 }
 
 resource "aws_rds_cluster_instance" "main" {
@@ -138,6 +148,10 @@ resource "aws_rds_cluster_instance" "main" {
   tags = {
     Name = "thinkwork-${var.stage}-db-1"
   }
+
+  lifecycle {
+    ignore_changes = [engine_version]
+  }
 }
 
 ################################################################################

package/dist/terraform/modules/data/compliance-exports-bucket/main.tf

@@ -216,7 +216,7 @@ resource "aws_iam_role_policy" "runner_s3_allow" {
 }
 
 resource "aws_iam_role_policy" "runner_secrets" {
-  count = length(var.database_secret_arn) > 0 ? 1 : 0
+  count = var.enable_runner_database_secret_access ? 1 : 0
   name  = "exports-runner-secrets"
   role  = aws_iam_role.runner_lambda.id
 

package/dist/terraform/modules/data/compliance-exports-bucket/variables.tf

@@ -38,6 +38,12 @@ variable "database_secret_arn" {
   default     = ""
 }
 
+variable "enable_runner_database_secret_access" {
+  description = "Grant the compliance export runner role access to database_secret_arn."
+  type        = bool
+  default     = false
+}
+
 variable "expiration_days" {
   description = "Number of days an export object lives before lifecycle expiration. SOC2 walkthrough auditors typically download artifacts within hours; 7 days is the audit-window default."
   type        = number