thinkwork-cli 0.12.12 → 0.12.15

package/dist/plugins/company-brain/test/api/migration.test.ts

@@ -0,0 +1,465 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import type {
+  BrainArtifactManifestRow,
+  BrainMigrationDeps,
+  BrainSubstrateMigrationRow,
+  BrainSubstrateStateRow,
+} from "../../src/api/migration.js";
+import {
+  requestCompanyBrainProductionMigration,
+  updateCompanyBrainMigration,
+} from "../../src/api/migration.js";
+
+const now = new Date("2026-06-14T12:00:00.000Z");
+
+function substrate(
+  overrides: Partial<BrainSubstrateStateRow> = {},
+): BrainSubstrateStateRow {
+  return {
+    id: "substrate-1",
+    tenant_id: "tenant-1",
+    managed_application_id: "app-1",
+    latest_deployment_job_id: "job-1",
+    storage_tier: "default",
+    active_backend: "default",
+    status: "ready",
+    health_status: "healthy",
+    backend_mode: "default",
+    graph_provider: "cognee",
+    vector_provider: "postgres",
+    embedding_model: "amazon.titan-embed-text-v2:0",
+    vector_dimension: 1024,
+    cognee_version: "0.2.0",
+    cognee_endpoint: "https://cognee.internal.example.com",
+    s3_artifact_root: "s3://brain-artifacts/tenant-1/",
+    s3_manifest_root: "s3://brain-manifests/tenant-1/",
+    s3_vault_projection_root: "s3://brain-vault/tenant-1/",
+    neptune_graph_id: null,
+    neptune_endpoint: null,
+    efs_file_system_id: null,
+    production_posture: null,
+    latest_ingest_at: null,
+    latest_projection_at: null,
+    ingestion_queue_depth: 0,
+    failed_ingest_count: 0,
+    graph_entity_count: null,
+    graph_edge_count: null,
+    source_artifact_count: null,
+    vault_projection_count: null,
+    ontology_version: null,
+    launch_capabilities: {},
+    optional_capabilities: {},
+    operator_evidence: { smoke: "pass" },
+    last_failure_message: null,
+    last_failure_at: null,
+    created_at: new Date("2026-06-14T11:00:00.000Z"),
+    updated_at: new Date("2026-06-14T11:30:00.000Z"),
+    ...overrides,
+  };
+}
+
+function manifest(
+  overrides: Partial<BrainArtifactManifestRow> = {},
+): BrainArtifactManifestRow {
+  return {
+    id: "manifest-1",
+    tenant_id: "tenant-1",
+    substrate_id: "substrate-1",
+    migration_id: null,
+    ingest_run_id: "ingest-1",
+    manifest_kind: "source_artifact",
+    storage_tier: "default",
+    source_family: "threads",
+    source_kind: "thread",
+    source_type: "thread",
+    source_ids: ["thread-1"],
+    source_id_hash: "hash-1",
+    manifest_uri: "s3://brain-manifests/tenant-1/manifest-1.json",
+    artifact_root_uri: "s3://brain-artifacts/tenant-1/thread-1/",
+    vault_projection_root_uri: null,
+    object_version_id: null,
+    content_type: "application/json",
+    content_encoding: null,
+    byte_length: 512,
+    checksum_sha256: "sha256",
+    object_count: 3,
+    source_count: 1,
+    embedding_model: "amazon.titan-embed-text-v2:0",
+    vector_dimension: 1024,
+    ontology_version: "company-brain-v1",
+    ontology_mechanism: "default",
+    status: "active",
+    metadata: {},
+    created_at: new Date("2026-06-14T11:00:00.000Z"),
+    updated_at: new Date("2026-06-14T11:30:00.000Z"),
+    ...overrides,
+  };
+}
+
+function migration(
+  overrides: Partial<BrainSubstrateMigrationRow> = {},
+): BrainSubstrateMigrationRow {
+  return {
+    id: "migration-1",
+    tenant_id: "tenant-1",
+    substrate_id: "substrate-1",
+    from_storage_tier: "default",
+    to_storage_tier: "production",
+    phase: "validating",
+    status: "running",
+    requested_by_user_id: "user-1",
+    deployment_job_id: null,
+    embedding_model: "amazon.titan-embed-text-v2:0",
+    vector_dimension: 1024,
+    validation_summary: { validationPassed: false, vectorDimension: 1024 },
+    operator_evidence: { runbook: "checked" },
+    error_message: null,
+    requested_at: new Date("2026-06-14T11:40:00.000Z"),
+    started_at: new Date("2026-06-14T11:41:00.000Z"),
+    completed_at: null,
+    rollback_window_closes_at: null,
+    created_at: new Date("2026-06-14T11:40:00.000Z"),
+    updated_at: new Date("2026-06-14T11:50:00.000Z"),
+    ...overrides,
+  };
+}
+
+function deps(args: {
+  substrate?: BrainSubstrateStateRow | null;
+  migration?: BrainSubstrateMigrationRow | null;
+  activeMigration?: BrainSubstrateMigrationRow | null;
+  manifests?: BrainArtifactManifestRow[];
+}) {
+  const state = {
+    substrate: args.substrate ?? substrate(),
+    migration: args.migration ?? migration(),
+  };
+  const testDeps: BrainMigrationDeps & {
+    createdMigrations: BrainSubstrateMigrationRow[];
+    migrationPatches: Array<Partial<BrainSubstrateMigrationRow>>;
+    substratePatches: Array<Partial<BrainSubstrateStateRow>>;
+    events: Array<Record<string, unknown>>;
+  } = {
+    createdMigrations: [],
+    migrationPatches: [],
+    substratePatches: [],
+    events: [],
+    getSubstrateState: vi.fn(async () => state.substrate),
+    getMigration: vi.fn(async () => state.migration),
+    getActiveMigration: vi.fn(async () => args.activeMigration ?? null),
+    listReplayManifests: vi.fn(async () => args.manifests ?? [manifest()]),
+    createMigration: vi.fn(async (values) => {
+      const created = migration({
+        ...values,
+        id: "migration-new",
+        phase: values.phase ?? "requested",
+        status: values.status ?? "requested",
+      });
+      testDeps.createdMigrations.push(created);
+      state.migration = created;
+      return created;
+    }),
+    updateMigration: vi.fn(async ({ patch }) => {
+      testDeps.migrationPatches.push(patch);
+      const updated = migration({ ...state.migration, ...patch });
+      state.migration = updated;
+      return updated;
+    }),
+    updateSubstrate: vi.fn(async ({ patch }) => {
+      testDeps.substratePatches.push(patch);
+      if (state.substrate)
+        state.substrate = substrate({ ...state.substrate, ...patch });
+    }),
+    appendEvent: vi.fn(async (event) => {
+      testDeps.events.push(event as Record<string, unknown>);
+    }),
+    now: () => now,
+  };
+  return testDeps;
+}
+
+beforeEach(() => {
+  vi.restoreAllMocks();
+});
+
+describe("requestCompanyBrainProductionMigration", () => {
+  it("creates a requested migration and marks the default substrate as migrating", async () => {
+    const testDeps = deps({});
+
+    const result = await requestCompanyBrainProductionMigration(
+      {
+        tenantId: "tenant-1",
+        requestedByUserId: "user-1",
+        operatorEvidence: { ticket: "THNK-6" },
+      },
+      testDeps,
+    );
+
+    expect(result).toMatchObject({
+      id: "migration-new",
+      from_storage_tier: "default",
+      to_storage_tier: "production",
+      phase: "requested",
+      status: "requested",
+      embedding_model: "amazon.titan-embed-text-v2:0",
+      vector_dimension: 1024,
+      requested_by_user_id: "user-1",
+      validation_summary: expect.objectContaining({
+        replayManifestCount: 1,
+        sourceCount: 1,
+        objectCount: 3,
+        validationPassed: false,
+      }),
+    });
+    expect(testDeps.substratePatches.at(-1)).toMatchObject({
+      status: "migrating",
+      health_status: "degraded",
+      operator_evidence: {
+        smoke: "pass",
+        latestMigrationId: "migration-new",
+      },
+    });
+    expect(testDeps.events.at(-1)).toMatchObject({
+      event_type: "brain.migration.requested",
+      migration_id: "migration-new",
+    });
+  });
+
+  it("requires explicit empty-source approval before migrating without replay manifests", async () => {
+    const testDeps = deps({ manifests: [] });
+
+    await expect(
+      requestCompanyBrainProductionMigration(
+        { tenantId: "tenant-1" },
+        testDeps,
+      ),
+    ).rejects.toMatchObject({ extensions: { code: "BAD_USER_INPUT" } });
+    expect(testDeps.createdMigrations).toHaveLength(0);
+    expect(testDeps.substratePatches).toHaveLength(0);
+  });
+
+  it("rejects manifests whose vector dimension does not match the target", async () => {
+    const testDeps = deps({
+      manifests: [
+        manifest({ id: "manifest-mismatch", vector_dimension: 1536 }),
+      ],
+    });
+
+    await expect(
+      requestCompanyBrainProductionMigration(
+        { tenantId: "tenant-1", vectorDimension: 1024 },
+        testDeps,
+      ),
+    ).rejects.toThrow(/vector dimension/i);
+    expect(testDeps.createdMigrations).toHaveLength(0);
+  });
+
+  it("rejects duplicate active migrations before creating another row", async () => {
+    const testDeps = deps({
+      activeMigration: migration({ id: "migration-active", status: "running" }),
+    });
+
+    await expect(
+      requestCompanyBrainProductionMigration(
+        { tenantId: "tenant-1" },
+        testDeps,
+      ),
+    ).rejects.toThrow(/already active/i);
+    expect(testDeps.createdMigrations).toHaveLength(0);
+    expect(testDeps.substratePatches).toHaveLength(0);
+  });
+
+  it("only allows requests from ready default substrates", async () => {
+    const testDeps = deps({
+      substrate: substrate({ status: "migrating" }),
+    });
+
+    await expect(
+      requestCompanyBrainProductionMigration(
+        { tenantId: "tenant-1" },
+        testDeps,
+      ),
+    ).rejects.toThrow(/migrating/i);
+    expect(testDeps.getActiveMigration).not.toHaveBeenCalled();
+    expect(testDeps.createdMigrations).toHaveLength(0);
+  });
+});
+
+describe("updateCompanyBrainMigration", () => {
+  it("refuses cutover until validation evidence passes", async () => {
+    const testDeps = deps({
+      migration: migration({
+        phase: "validating",
+        validation_summary: { validationPassed: false, vectorDimension: 1024 },
+      }),
+    });
+
+    await expect(
+      updateCompanyBrainMigration(
+        {
+          tenantId: "tenant-1",
+          migrationId: "migration-1",
+          phase: "cutover",
+        },
+        testDeps,
+      ),
+    ).rejects.toThrow(/validationPassed/i);
+    expect(testDeps.migrationPatches).toHaveLength(0);
+    expect(testDeps.substratePatches).toHaveLength(0);
+  });
+
+  it("promotes the active backend to production when validation completes", async () => {
+    const testDeps = deps({
+      migration: migration({
+        phase: "cutover",
+        validation_summary: { validationPassed: true, vectorDimension: 1024 },
+      }),
+    });
+
+    const result = await updateCompanyBrainMigration(
+      {
+        tenantId: "tenant-1",
+        migrationId: "migration-1",
+        phase: "completed",
+        status: "completed",
+        validationSummary: { validationPassed: true, vectorDimension: 1024 },
+      },
+      testDeps,
+    );
+
+    expect(result).toMatchObject({
+      phase: "completed",
+      status: "completed",
+      completed_at: now,
+    });
+    expect(testDeps.substratePatches.at(-1)).toMatchObject({
+      storage_tier: "production",
+      active_backend: "production",
+      status: "ready",
+      health_status: "healthy",
+      operator_evidence: {
+        smoke: "pass",
+        latestMigrationId: "migration-1",
+        activeMigrationCompletedAt: now.toISOString(),
+      },
+    });
+    expect(testDeps.events.at(-1)).toMatchObject({
+      event_type: "brain.migration.completed",
+      payload: expect.objectContaining({
+        phase: "completed",
+        status: "completed",
+      }),
+    });
+  });
+
+  it("keeps the default backend active when a migration rolls back", async () => {
+    const testDeps = deps({
+      migration: migration({
+        phase: "failed",
+        status: "failed",
+        validation_summary: { validationPassed: true, vectorDimension: 1024 },
+      }),
+    });
+
+    await updateCompanyBrainMigration(
+      {
+        tenantId: "tenant-1",
+        migrationId: "migration-1",
+        phase: "rolled_back",
+        status: "rolled_back",
+      },
+      testDeps,
+    );
+
+    expect(testDeps.substratePatches.at(-1)).toMatchObject({
+      storage_tier: "default",
+      active_backend: "default",
+      status: "ready",
+      health_status: "healthy",
+    });
+  });
+
+  it("rejects skipped phase transitions before cutover", async () => {
+    const testDeps = deps({
+      migration: migration({
+        phase: "requested",
+        status: "requested",
+        validation_summary: { validationPassed: true, vectorDimension: 1024 },
+      }),
+    });
+
+    await expect(
+      updateCompanyBrainMigration(
+        {
+          tenantId: "tenant-1",
+          migrationId: "migration-1",
+          phase: "completed",
+          status: "completed",
+          validationSummary: { validationPassed: true, vectorDimension: 1024 },
+        },
+        testDeps,
+      ),
+    ).rejects.toThrow(/phase transition/i);
+    expect(testDeps.migrationPatches).toHaveLength(0);
+    expect(testDeps.substratePatches).toHaveLength(0);
+  });
+
+  it("rejects terminal statuses that do not match the requested phase", async () => {
+    const testDeps = deps({
+      migration: migration({
+        phase: "validating",
+        validation_summary: { validationPassed: true, vectorDimension: 1024 },
+      }),
+    });
+
+    await expect(
+      updateCompanyBrainMigration(
+        {
+          tenantId: "tenant-1",
+          migrationId: "migration-1",
+          phase: "validating",
+          status: "completed",
+        },
+        testDeps,
+      ),
+    ).rejects.toThrow(/status does not match phase/i);
+    expect(testDeps.migrationPatches).toHaveLength(0);
+    expect(testDeps.substratePatches).toHaveLength(0);
+  });
+
+  it("redacts raw validation details from the public summary", async () => {
+    const testDeps = deps({
+      migration: migration({
+        phase: "replaying",
+        validation_summary: {
+          sourceCount: 1,
+          rawSourceIds: ["thread-secret"],
+        },
+      }),
+    });
+
+    const result = await updateCompanyBrainMigration(
+      {
+        tenantId: "tenant-1",
+        migrationId: "migration-1",
+        phase: "validating",
+        validationSummary: {
+          validationPassed: false,
+          vectorDimension: 1024,
+          rawS3Uri: "s3://private-bucket/key",
+        },
+      },
+      testDeps,
+    );
+
+    expect(result.validation_summary).toEqual({
+      sourceCount: 1,
+      vectorDimension: 1024,
+      validationPassed: false,
+    });
+    expect(JSON.stringify(result.validation_summary)).not.toContain("s3://");
+    expect(JSON.stringify(result.validation_summary)).not.toContain(
+      "thread-secret",
+    );
+  });
+});

package/dist/plugins/company-brain/test/manifest.test.ts

@@ -0,0 +1,95 @@
+import { describe, expect, it } from "vitest";
+
+import {
+  validatePluginManifest,
+  type InfrastructureComponent,
+  type McpServerComponent,
+} from "@thinkwork/plugin-catalog/contracts";
+
+import { companyBrainManifest } from "../src/manifest";
+
+const latestVersion =
+  companyBrainManifest.versions[companyBrainManifest.versions.length - 1]!;
+
+describe("ThinkWork Brain plugin manifest", () => {
+  it("validates as a premium infrastructure plus MCP plugin", () => {
+    const validated = validatePluginManifest(companyBrainManifest);
+    expect(validated.pluginKey).toBe("company-brain");
+    expect(validated.displayName).toBe("ThinkWork Brain");
+    expect(validated.premium).toEqual({
+      entitlementProductKey: "company-brain",
+      installKeyRequired: true,
+      installKeyPrompt:
+        "Enter the ThinkWork Brain install key provided by ThinkWork to unlock this premium plugin for your tenant.",
+    });
+    expect(validated.versions.map((version) => version.version)).toEqual([
+      "0.1.0",
+      "0.1.1",
+    ]);
+    expect(validated.versions[0].components).toHaveLength(1);
+    expect(latestVersion.requiredOauthScopes).toEqual([]);
+    expect(latestVersion.components).toHaveLength(2);
+    expect(latestVersion.components[0].type).toBe("infrastructure");
+    expect(latestVersion.components[1].type).toBe("mcp-server");
+  });
+
+  it("declares the internal Cognee-backed Brain substrate component", () => {
+    const component = latestVersion.components[0] as InfrastructureComponent;
+    expect(component).toMatchObject({
+      type: "infrastructure",
+      key: "brain-substrate",
+      managedAppKey: "cognee",
+    });
+    expect(Object.keys(component.terraformInputs).sort()).toEqual([
+      "bedrockModelResourceArns",
+      "dbPasswordSecretArn",
+      "imageUri",
+    ]);
+    expect(component.terraformInputs.bedrockModelResourceArns.type).toBe(
+      "list(string)",
+    );
+  });
+
+  it("declares ThinkWork Brain MCP as a plugin-owned direct agent surface", () => {
+    const component = latestVersion.components[1] as McpServerComponent;
+    expect(component).toMatchObject({
+      type: "mcp-server",
+      key: "brain",
+      displayName: "ThinkWork Brain",
+      endpointFrom: {
+        managedApp: "cognee",
+        configKey: "cogneeEndpoint",
+        path: "/mcp-server/http",
+      },
+      auth: { mode: "none" },
+    });
+    const toolNotes = component.toolNotes?.join("\n") ?? "";
+    expect(toolNotes).toMatch(/Brain substrate operations/i);
+    expect(toolNotes).toMatch(/Hindsight-backed ThinkWork memory APIs/i);
+    expect(toolNotes).not.toMatch(/user and Space memory provider/i);
+  });
+
+  it("does not declare Full Brain runtime, skills, or rendered UI surfaces in v1", () => {
+    const componentTypes = latestVersion.components.map(
+      (component) => component.type,
+    );
+    expect(componentTypes).toEqual(["infrastructure", "mcp-server"]);
+    expect(latestVersion.requiredOauthScopes).toEqual([]);
+  });
+
+  it("keeps customer-facing copy on ThinkWork Brain rather than Cognee", () => {
+    const customerFacingText = [
+      companyBrainManifest.displayName,
+      companyBrainManifest.description,
+      companyBrainManifest.premium?.installKeyPrompt,
+      ...Object.values(
+        (latestVersion.components[0] as InfrastructureComponent)
+          .terraformInputs,
+      ).map((spec) => spec.description),
+    ].join("\n");
+
+    expect(customerFacingText).toContain("ThinkWork Brain");
+    expect(customerFacingText).not.toContain("Company Brain");
+    expect(customerFacingText).not.toMatch(/\bCognee\b/);
+  });
+});

package/dist/plugins/company-brain/tsconfig.json

@@ -0,0 +1,8 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "outDir": "./dist",
+    "rootDir": "."
+  },
+  "include": ["./**/*.ts"]
+}

package/dist/plugins/company-data/README.md

@@ -0,0 +1,49 @@
+# Company Data Plugin
+
+The Company Data plugin is the package-owned source boundary for the
+first-party operational facts substrate. This slice publishes the stable
+catalog identity and normal ThinkWork install path before any live Company Data
+runtime exists.
+
+The shell intentionally does not deploy extraction runners, projection database
+schema, mapping workflows, schedules, pipelines, MCP servers, skills,
+credentials, datalake, warehouse, query engine, monitoring, analytics UI, BI,
+Context Engine providers, live operator UI, source-system writes, or
+Terraform-managed resources. Future Company Data work should extend this
+`company-data` package and version line with explicit requirements,
+handler-backed components, and deployed verification before introducing runtime
+capability.
+
+## Owned Source
+
+- `src/manifest.ts` declares the catalog manifest with empty OAuth scopes,
+  no capabilities, and one declared-only `ui-surface` component.
+- `test/manifest.test.ts` validates the shell boundary, manifest shape,
+  customer-facing operational facts copy, and deferred-resource language.
+
+## Shell Scope
+
+V1 is deliberately narrow:
+
+- Company Data appears in the first-party plugin catalog as
+  `company-data@0.1.0`.
+- Tenant administrators can install the shell through the normal plugin
+  install flow.
+- The plugin engine records only the install and one no-op UI-surface component
+  with an empty handler reference.
+- Live extraction runtime, projection schema, mapping workflows, schedules,
+  pipelines, MCP servers, skills, credentials, Context Engine providers,
+  analytics UI, BI, lakehouse query UI, source-system writes, and
+  infrastructure are deferred follow-up work.
+
+## Verification Notes
+
+Package-local verification:
+
+```bash
+pnpm --filter @thinkwork/plugin-company-data test
+pnpm --filter @thinkwork/plugin-company-data typecheck
+pnpm --filter @thinkwork/plugin-catalog test
+pnpm --filter @thinkwork/plugin-catalog typecheck
+node scripts/verify-plugin-source-boundary.mjs
+```

package/dist/plugins/company-data/package.json

@@ -0,0 +1,21 @@
+{
+  "name": "@thinkwork/plugin-company-data",
+  "version": "0.0.0",
+  "private": true,
+  "type": "module",
+  "main": "./src/index.ts",
+  "exports": {
+    ".": "./src/index.ts",
+    "./manifest": "./src/manifest.ts"
+  },
+  "scripts": {
+    "build": "tsc --build",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run"
+  },
+  "devDependencies": {
+    "@thinkwork/plugin-catalog": "workspace:*",
+    "typescript": "^5.5.0",
+    "vitest": "^2.0.0"
+  }
+}

package/dist/plugins/company-data/src/index.ts

@@ -0,0 +1,30 @@
+import { companyDataManifest } from "./manifest";
+
+export const companyDataPluginPackage = {
+  packageKey: "company-data",
+  sourceRoot: "plugins/company-data",
+  manifest: companyDataManifest,
+  ownedSources: [
+    {
+      kind: "manifest",
+      path: "plugins/company-data/src/manifest.ts",
+      description:
+        "Company Data catalog manifest for the shell-only plugin identity.",
+    },
+    {
+      kind: "docs",
+      path: "plugins/company-data/README.md",
+      description:
+        "Company Data package ownership and deferred resource notes.",
+    },
+    {
+      kind: "tests",
+      path: "plugins/company-data/test",
+      description:
+        "Company Data package-local manifest and shell-boundary tests.",
+    },
+  ],
+  compatibilityLinks: [],
+} as const;
+
+export { companyDataManifest };

package/dist/plugins/company-data/src/manifest.ts

@@ -0,0 +1,26 @@
+import type { PluginManifest } from "@thinkwork/plugin-catalog/contracts";
+
+export const COMPANY_DATA_SETTINGS_SURFACE =
+  "settings.plugins.detail.tab" as const;
+
+export const companyDataManifest = {
+  pluginKey: "company-data",
+  displayName: "ThinkWork Data Warehouse",
+  description:
+    "Establishes a governed operational facts substrate for agent and UI reads. Extraction runners, projection databases, Context Engine providers, MCP tools, analytics, BI, and source-system writes belong to later ThinkWork Data Warehouse releases.",
+  versions: [
+    {
+      version: "0.1.0",
+      requiredOauthScopes: [],
+      capabilities: [],
+      components: [
+        {
+          type: "ui-surface",
+          key: "settings",
+          displayName: "ThinkWork Data Warehouse settings",
+          intendedMount: COMPANY_DATA_SETTINGS_SURFACE,
+        },
+      ],
+    },
+  ],
+} satisfies PluginManifest;