thinkwork-cli 0.12.12 → 0.12.15

package/dist/plugins/twenty/src/api/cutover.ts

@@ -0,0 +1,209 @@
+/**
+ * One-time Twenty plugin cutover (plan 2026-06-12-001 U10).
+ *
+ * Run ONCE per tenant (by the `cutoverTwentyPlugin` admin mutation) after
+ * the `twenty` plugin install exists. It moves MCP ownership from the
+ * legacy managed-application reconciler to the plugin engine:
+ *
+ *   1. ADOPT — when the legacy managed row (management_source
+ *      'managed_application', managed_application_key 'twenty-crm') still
+ *      exists and the plugin MCP handler has not created its own row, the
+ *      legacy row is adopted in place: slug → `twenty--crm` (so the
+ *      handler's idempotent (tenant, install, slug) lookup converges on
+ *      it), management_source → 'plugin', plugin_install_id set, and the
+ *      install's `crm` component handler_ref is pointed at the row
+ *      (state 'provisioned'). URL, auth_config, and url_hash are
+ *      untouched — the plugin row is wire-identical to the managed row.
+ *   2. DEDUPE — when the plugin handler ALREADY provisioned its own row
+ *      (same endpoint), the legacy row is redundant: its inventory
+ *      (user tokens + secrets, context tools, agent/template/space
+ *      assignments, the row itself) is removed; the plugin row stays
+ *      canonical.
+ *   3. In both cases the legacy row's per-server `user_mcp_tokens` are
+ *      invalidated (token rows deleted, secrets deleted via Secrets
+ *      Manager) so users re-activate at APP level through the plugin
+ *      activation flow.
+ *
+ * Idempotent: a re-run after a completed cutover finds no legacy row and
+ * reports a no-op. Mutating runs emit a `plugin.cutover` compliance event
+ * transactionally with the row changes (control-evidence tier).
+ */
+
+import { GraphQLError } from "graphql";
+
+export const TWENTY_PLUGIN_KEY = "twenty";
+export const TWENTY_PLUGIN_MCP_COMPONENT_KEY = "crm";
+export const TWENTY_PLUGIN_MCP_SLUG = `${TWENTY_PLUGIN_KEY}--${TWENTY_PLUGIN_MCP_COMPONENT_KEY}`;
+
+export interface TwentyCutoverAuditInput {
+  tenantId: string;
+  actorId: string;
+  actorType: "user" | "system";
+  eventType: "plugin.cutover";
+  source: "graphql";
+  payload: Record<string, unknown>;
+  resourceType: "plugin_install";
+  resourceId: string;
+  action: "cutover";
+  outcome: "success";
+}
+
+export interface TwentyCutoverResult {
+  /** True when this run changed ownership (adopt or legacy-row removal). */
+  adopted: boolean;
+  /** The canonical plugin-owned Twenty MCP row after the run, if any. */
+  mcpServerId: string | null;
+  /** Per-server user_mcp_tokens invalidated (rows deleted) by this run. */
+  invalidatedUserTokenCount: number;
+  message: string;
+}
+
+interface ServerRowSnapshot {
+  id: string;
+  url: string;
+}
+
+export interface TwentyCutoverDeps {
+  getTwentyInstall(tenantId: string): Promise<{ id: string } | null>;
+  /** The legacy managed-application row, if it still exists. */
+  getLegacyManagedRow(tenantId: string): Promise<ServerRowSnapshot | null>;
+  /** The plugin-handler-created row for the install, if any. */
+  getPluginRow(
+    tenantId: string,
+    installId: string,
+  ): Promise<ServerRowSnapshot | null>;
+  /** Delete the row's user tokens (+ their secrets); returns the count. */
+  invalidateUserTokens(serverId: string): Promise<number>;
+  /**
+   * Adopt the legacy row in place (slug/management_source/plugin_install_id)
+   * and point the install's mcp component handler_ref at it — one
+   * transaction with the audit event.
+   */
+  adoptLegacyRow(args: {
+    tenantId: string;
+    installId: string;
+    serverId: string;
+    serverUrl: string;
+    audit: TwentyCutoverAuditInput;
+  }): Promise<void>;
+  /**
+   * Remove the redundant legacy row + its full inventory (context tools,
+   * agent/template/space assignments, the row) — one transaction with the
+   * audit event. Tokens are already gone via invalidateUserTokens.
+   */
+  removeLegacyRow(args: {
+    tenantId: string;
+    serverId: string;
+    audit: TwentyCutoverAuditInput;
+  }): Promise<void>;
+}
+
+function cutoverAudit(args: {
+  tenantId: string;
+  actorId: string;
+  actorType: "user" | "system";
+  installId: string;
+  mcpServerId: string;
+  mode: "adopted" | "legacy_row_removed";
+  invalidatedUserTokenCount: number;
+}): TwentyCutoverAuditInput {
+  return {
+    tenantId: args.tenantId,
+    actorId: args.actorId,
+    actorType: args.actorType,
+    eventType: "plugin.cutover",
+    source: "graphql",
+    payload: {
+      pluginInstallId: args.installId,
+      pluginKey: TWENTY_PLUGIN_KEY,
+      mcpServerId: args.mcpServerId,
+      mode: args.mode,
+      invalidatedUserTokenCount: args.invalidatedUserTokenCount,
+    },
+    resourceType: "plugin_install",
+    resourceId: args.installId,
+    action: "cutover",
+    outcome: "success",
+  };
+}
+
+export async function cutoverTwentyPluginForTenant(
+  args: {
+    tenantId: string;
+    actorId: string;
+    actorType: "user" | "system";
+  },
+  deps: TwentyCutoverDeps,
+): Promise<TwentyCutoverResult> {
+  const install = await deps.getTwentyInstall(args.tenantId);
+  if (!install) {
+    throw new GraphQLError(
+      "Install the twenty plugin before running the cutover",
+      { extensions: { code: "FAILED_PRECONDITION" } },
+    );
+  }
+
+  const legacy = await deps.getLegacyManagedRow(args.tenantId);
+  const pluginRow = await deps.getPluginRow(args.tenantId, install.id);
+
+  if (!legacy) {
+    return {
+      adopted: false,
+      mcpServerId: pluginRow?.id ?? null,
+      invalidatedUserTokenCount: 0,
+      message: pluginRow
+        ? "Twenty MCP row is already plugin-owned; nothing to adopt (idempotent re-run)."
+        : "No managed Twenty MCP row exists for this tenant; nothing to adopt.",
+    };
+  }
+
+  const invalidatedUserTokenCount = await deps.invalidateUserTokens(legacy.id);
+
+  if (pluginRow) {
+    // The plugin handler already provisioned its own row — the legacy row
+    // is a redundant same-endpoint duplicate. Remove it; the plugin row
+    // stays canonical.
+    await deps.removeLegacyRow({
+      tenantId: args.tenantId,
+      serverId: legacy.id,
+      audit: cutoverAudit({
+        tenantId: args.tenantId,
+        actorId: args.actorId,
+        actorType: args.actorType,
+        installId: install.id,
+        mcpServerId: pluginRow.id,
+        mode: "legacy_row_removed",
+        invalidatedUserTokenCount,
+      }),
+    });
+    return {
+      adopted: true,
+      mcpServerId: pluginRow.id,
+      invalidatedUserTokenCount,
+      message: `Removed the redundant legacy Twenty MCP row (the plugin row is canonical) and invalidated ${invalidatedUserTokenCount} per-server user token(s); users re-activate at app level.`,
+    };
+  }
+
+  await deps.adoptLegacyRow({
+    tenantId: args.tenantId,
+    installId: install.id,
+    serverId: legacy.id,
+    serverUrl: legacy.url,
+    audit: cutoverAudit({
+      tenantId: args.tenantId,
+      actorId: args.actorId,
+      actorType: args.actorType,
+      installId: install.id,
+      mcpServerId: legacy.id,
+      mode: "adopted",
+      invalidatedUserTokenCount,
+    }),
+  });
+
+  return {
+    adopted: true,
+    mcpServerId: legacy.id,
+    invalidatedUserTokenCount,
+    message: `Adopted the managed Twenty MCP row to plugin ownership and invalidated ${invalidatedUserTokenCount} per-server user token(s); users re-activate at app level.`,
+  };
+}

package/dist/plugins/twenty/src/deployment/managed-app.ts

@@ -0,0 +1,253 @@
+import {
+  type ManagedAppAdapter,
+  type RequiredManagedAppInput,
+} from "@thinkwork/deployment-runner/apps/registry";
+import {
+  boolOutput,
+  optionalNumber,
+  optionalString,
+  optionalStringArray,
+  requireDigestImage,
+  requireStringInput,
+  stringOutput,
+} from "@thinkwork/deployment-runner/apps/utils";
+
+const smokeContracts = [
+  {
+    id: "twenty-health",
+    command: "plugins/twenty/smoke/twenty-managed-app-smoke.mjs",
+    required: true,
+  },
+] as const;
+
+const statusOutputs = [
+  "twenty_provisioned",
+  "twenty_runtime_enabled",
+  "twenty_url",
+  "twenty_alb_arn",
+  "twenty_target_group_arn",
+  "twenty_cluster_arn",
+  "twenty_server_service_name",
+  "twenty_worker_service_name",
+  "twenty_server_log_group_name",
+  "twenty_worker_log_group_name",
+  "twenty_cache_endpoint",
+  "twenty_storage_file_system_id",
+] as const;
+
+const provisionRequiredInputs: RequiredManagedAppInput[] = [
+  {
+    key: "imageUri",
+    description: "Twenty CRM container image URI pinned with @sha256.",
+    terraformVariable: "twenty_image_uri",
+  },
+  {
+    key: "dbUrlSecretArn",
+    description: "Secrets Manager ARN containing PG_DATABASE_URL.",
+    terraformVariable: "twenty_db_url_secret_arn",
+    secret: true,
+  },
+  {
+    key: "encryptionKeySecretArn",
+    description: "Secrets Manager ARN containing ENCRYPTION_KEY.",
+    terraformVariable: "twenty_encryption_key_secret_arn",
+    secret: true,
+  },
+  {
+    key: "publicUrl",
+    description: "Public HTTPS origin for Twenty CRM.",
+    terraformVariable: "twenty_public_url",
+  },
+  {
+    key: "certificateArn",
+    description: "ACM certificate ARN for the public HTTPS listener.",
+    terraformVariable: "twenty_certificate_arn",
+  },
+];
+
+export const twentyAdapter: ManagedAppAdapter = {
+  appKey: "twenty",
+  displayName: "Twenty CRM",
+  description: "Customer-owned CRM runtime with dedicated data and storage.",
+  catalogVisible: true,
+  terraformModulePath: "plugins/twenty/terraform/twenty",
+  requiredInputs(operation) {
+    return operation === "DESTROY" ? [] : provisionRequiredInputs;
+  },
+  buildTerraformVariables({ operation, desiredConfig }) {
+    if (operation === "DESTROY") {
+      return {
+        twenty_provisioned: false,
+        twenty_runtime_enabled: false,
+      };
+    }
+
+    const runtimeEnabled = operation !== "PARK";
+    return compactObject({
+      twenty_provisioned: true,
+      twenty_runtime_enabled: runtimeEnabled,
+      twenty_image_uri: requireDigestImage(
+        desiredConfig,
+        "imageUri",
+        "Twenty imageUri",
+      ),
+      twenty_db_username: optionalString(desiredConfig, "dbUsername"),
+      twenty_db_name: optionalString(desiredConfig, "dbName"),
+      twenty_db_url_secret_arn: requireStringInput(
+        desiredConfig,
+        "dbUrlSecretArn",
+        "Twenty dbUrlSecretArn",
+      ),
+      twenty_encryption_key_secret_arn: requireStringInput(
+        desiredConfig,
+        "encryptionKeySecretArn",
+        "Twenty encryptionKeySecretArn",
+      ),
+      twenty_email_from_address: optionalString(
+        desiredConfig,
+        "emailFromAddress",
+      ),
+      twenty_email_from_name: optionalString(desiredConfig, "emailFromName"),
+      twenty_email_smtp_host: optionalString(desiredConfig, "emailSmtpHost"),
+      twenty_fallback_encryption_key_secret_arn: optionalString(
+        desiredConfig,
+        "fallbackEncryptionKeySecretArn",
+      ),
+      twenty_app_secret_arn: optionalString(desiredConfig, "appSecretArn"),
+      twenty_domain: optionalString(desiredConfig, "domain"),
+      twenty_public_url: requireStringInput(
+        desiredConfig,
+        "publicUrl",
+        "Twenty publicUrl",
+      ),
+      twenty_certificate_arn: requireStringInput(
+        desiredConfig,
+        "certificateArn",
+        "Twenty certificateArn",
+      ),
+      twenty_server_desired_count: optionalNumber(
+        desiredConfig,
+        "serverDesiredCount",
+      ),
+      twenty_worker_desired_count: optionalNumber(
+        desiredConfig,
+        "workerDesiredCount",
+      ),
+      twenty_cache_engine: optionalString(desiredConfig, "cacheEngine"),
+      twenty_cache_engine_version: optionalString(
+        desiredConfig,
+        "cacheEngineVersion",
+      ),
+      twenty_cache_parameter_group_family: optionalString(
+        desiredConfig,
+        "cacheParameterGroupFamily",
+      ),
+      twenty_cache_node_type: optionalString(desiredConfig, "cacheNodeType"),
+      twenty_cache_num_cache_clusters: optionalNumber(
+        desiredConfig,
+        "cacheNumCacheClusters",
+      ),
+      twenty_allowed_public_cidr_blocks: optionalStringArray(
+        desiredConfig,
+        "allowedPublicCidrBlocks",
+      ),
+      twenty_kms_key_arns: optionalStringArray(desiredConfig, "kmsKeyArns"),
+    });
+  },
+  dataImpact(operation) {
+    if (operation !== "DESTROY") {
+      return {
+        destructive: false,
+        summary: "No destructive Twenty CRM teardown requested.",
+        resources: [],
+      };
+    }
+    return {
+      destructive: true,
+      summary:
+        "Twenty CRM destroy deletes CRM runtime resources and customer CRM data owned by the managed app.",
+      resources: [
+        "Twenty server and worker ECS services, task definitions, task/execution IAM roles, and public ALB/listener/target-group resources",
+        "Dedicated Twenty database, database role, DB URL secret, encryption key secret, fallback key secret, and app secret",
+        "Encrypted EFS file system, access point, mount targets, and local file storage",
+        "ElastiCache Valkey/Redis replication group, subnet group, parameter group, and cache endpoint",
+        "CloudWatch log groups and deployment evidence artifacts for the Twenty job",
+      ],
+    };
+  },
+  preDestroySteps(operation) {
+    if (operation !== "DESTROY") return [];
+    return [
+      {
+        id: "twenty-db-drop",
+        description:
+          "Drop the dedicated Twenty database and least-privilege role after active sessions are terminated.",
+        evidenceKey: "pre-destroy/twenty-db-drop.json",
+      },
+      {
+        id: "twenty-secret-cleanup",
+        description:
+          "Verify Terraform-owned Twenty secrets are deleted or marked for deletion with recovery windows recorded.",
+        evidenceKey: "pre-destroy/twenty-secret-cleanup.json",
+      },
+    ];
+  },
+  smokeContracts,
+  statusOutputs: [...statusOutputs],
+  extractStatus(terraformOutputs) {
+    const provisioned = boolOutput(terraformOutputs, "twenty_provisioned");
+    const runtimeEnabled = boolOutput(
+      terraformOutputs,
+      "twenty_runtime_enabled",
+    );
+    const endpoint = stringOutput(terraformOutputs, "twenty_url");
+    return {
+      provisioned,
+      runtimeEnabled,
+      endpoint,
+      status: !provisioned ? "disabled" : runtimeEnabled ? "running" : "parked",
+      evidence: {
+        endpoint,
+        albArn: stringOutput(terraformOutputs, "twenty_alb_arn"),
+        targetGroupArn: stringOutput(
+          terraformOutputs,
+          "twenty_target_group_arn",
+        ),
+        clusterArn: stringOutput(terraformOutputs, "twenty_cluster_arn"),
+        serverServiceName: stringOutput(
+          terraformOutputs,
+          "twenty_server_service_name",
+        ),
+        workerServiceName: stringOutput(
+          terraformOutputs,
+          "twenty_worker_service_name",
+        ),
+        serverLogGroupName: stringOutput(
+          terraformOutputs,
+          "twenty_server_log_group_name",
+        ),
+        workerLogGroupName: stringOutput(
+          terraformOutputs,
+          "twenty_worker_log_group_name",
+        ),
+        cacheEndpoint: stringOutput(terraformOutputs, "twenty_cache_endpoint"),
+        storageFileSystemId: stringOutput(
+          terraformOutputs,
+          "twenty_storage_file_system_id",
+        ),
+      },
+    };
+  },
+};
+
+function compactObject(
+  value: Record<string, unknown>,
+): Record<string, unknown> {
+  return Object.fromEntries(
+    Object.entries(value).filter(([, entry]) => {
+      if (entry === undefined || entry === null || entry === "") return false;
+      if (Array.isArray(entry) && entry.length === 0) return false;
+      return true;
+    }),
+  );
+}

package/dist/plugins/twenty/src/index.ts

@@ -0,0 +1,55 @@
+import { twentyManifest } from "./manifest";
+
+export const twentyPluginPackage = {
+  packageKey: "twenty",
+  sourceRoot: "plugins/twenty",
+  manifest: twentyManifest,
+  ownedSources: [
+    {
+      kind: "manifest",
+      path: "plugins/twenty/src/manifest.ts",
+      description: "Twenty catalog manifest and versioned component contract.",
+    },
+    {
+      kind: "smoke",
+      path: "plugins/twenty/smoke",
+      description: "Twenty managed-app and MCP OAuth smoke validation scripts.",
+    },
+    {
+      kind: "deployment",
+      path: "plugins/twenty/src/deployment/managed-app.ts",
+      description: "Twenty managed-app deployment adapter.",
+    },
+    {
+      kind: "terraform",
+      path: "plugins/twenty/terraform/twenty",
+      description: "Twenty managed-app Terraform module.",
+    },
+    {
+      kind: "api",
+      path: "plugins/twenty/src/api/cutover.ts",
+      description: "Twenty MCP cutover orchestration contract.",
+    },
+    {
+      kind: "runtime",
+      path: "plugins/twenty/twenty-app",
+      description:
+        "Native Twenty app package that exposes the ThinkWork Webhook workflow action.",
+    },
+    {
+      kind: "tests",
+      path: "plugins/twenty/test",
+      description: "Twenty package-local manifest and contract tests.",
+    },
+    {
+      kind: "docs",
+      path: "plugins/twenty/README.md",
+      description: "Twenty package ownership and migration notes.",
+    },
+  ],
+  compatibilityLinks: [],
+} as const;
+
+export { twentyManifest };
+export { twentyAdapter } from "./deployment/managed-app";
+export * from "./api/cutover";