thinkwork-cli 0.12.12 → 0.12.16

package/dist/terraform/examples/greenfield/main.tf

@@ -48,6 +48,13 @@ provider "aws" {
   region = var.region
 }
 
+# us-east-1 alias required by the thinkwork module's customer-domain wiring
+# (CloudFront ACM certs must live in us-east-1 regardless of stack region).
+provider "aws" {
+  alias  = "us_east_1"
+  region = "us-east-1"
+}
+
 # Cloudflare provider reads its token from the CLOUDFLARE_API_TOKEN env var.
 # Never commit the token to tfvars or source control.
 provider "cloudflare" {}
@@ -68,6 +75,12 @@ variable "account_id" {
   type        = string
 }
 
+variable "plugin_catalog_github_token_secret_arn" {
+  description = "Optional Secrets Manager ARN/name containing a GitHub token for API plugin catalog release-asset fetches. Empty uses unauthenticated GitHub requests."
+  type        = string
+  default     = ""
+}
+
 variable "db_password" {
   description = "Master password for the Aurora cluster"
   type        = string
@@ -81,11 +94,431 @@ variable "database_engine" {
 }
 
 variable "enable_hindsight" {
-  description = "Optional Hindsight add-on alongside the always-on managed memory (ECS+ALB for semantic + graph retrieval)"
+  description = "Enable Hindsight canonical user and Space memory. Full ThinkWork installs default this on; set false only for explicit low-cost/development AgentCore-only deployments."
+  type        = bool
+  default     = true
+}
+
+variable "memory_engine" {
+  description = "Active long-term memory engine. Empty selects Hindsight when enable_hindsight = true. Use 'agentcore' only for explicit low-cost/development managed-memory deployments; 'cognee' is legacy diagnostic compatibility, not the supported user/Space memory path."
+  type        = string
+  default     = ""
+}
+
+variable "enable_cognee" {
+  description = "Enable Cognee as optional ThinkWork Brain ontology/knowledge-graph infrastructure. Disabled by default."
+  type        = bool
+  default     = false
+}
+
+variable "cognee_image_uri" {
+  description = "Cognee container image URI pinned to an immutable sha256 digest. Required when enable_cognee = true."
+  type        = string
+  default     = ""
+}
+
+variable "cognee_db_username" {
+  description = "Dedicated PostgreSQL username for Cognee metadata storage."
+  type        = string
+  default     = "thinkwork_cognee"
+}
+
+variable "cognee_db_name" {
+  description = "Dedicated PostgreSQL database name for Cognee metadata storage."
+  type        = string
+  default     = "thinkwork_cognee"
+}
+
+variable "cognee_db_password_secret_arn" {
+  description = "Secrets Manager ARN containing a JSON password field for the dedicated Cognee PostgreSQL user. Required when enable_cognee = true."
+  type        = string
+  default     = ""
+}
+
+variable "cognee_allowed_internal_cidr_blocks" {
+  description = "CIDR blocks allowed to reach the internal Cognee ALB."
+  type        = list(string)
+  default     = []
+}
+
+variable "cognee_allowed_internal_security_group_ids" {
+  description = "Security group IDs allowed to reach the internal Cognee ALB."
+  type        = list(string)
+  default     = []
+}
+
+variable "cognee_backend_mode" {
+  description = "Cognee backend mode. dogfood uses EFS-backed local stores; remote requires graph/vector URLs."
+  type        = string
+  default     = "dogfood"
+}
+
+variable "cognee_desired_count" {
+  description = "Desired Cognee task count. Dogfood mode must stay at 1."
+  type        = number
+  default     = 1
+}
+
+variable "cognee_brain_tenant_id" {
+  description = "Tenant ID for a tenant-scoped Company Brain substrate instance. Empty preserves legacy stage-wide Cognee names."
+  type        = string
+  default     = ""
+}
+
+variable "cognee_brain_instance_key" {
+  description = "Stable tenant-scoped Brain instance key used to derive resource names."
+  type        = string
+  default     = ""
+}
+
+variable "cognee_brain_storage_tier" {
+  description = "Company Brain storage tier: default or production."
+  type        = string
+  default     = "default"
+}
+
+variable "cognee_brain_s3_artifact_root" {
+  description = "Canonical Company Brain S3 root URI for source artifacts."
+  type        = string
+  default     = ""
+}
+
+variable "cognee_brain_s3_manifest_root" {
+  description = "Canonical Company Brain S3 root URI for ingestion manifests."
+  type        = string
+  default     = ""
+}
+
+variable "cognee_brain_s3_vault_projection_root" {
+  description = "Canonical Company Brain S3 root URI for vault/materialized projections."
+  type        = string
+  default     = ""
+}
+
+variable "cognee_brain_artifacts_bucket_arn" {
+  description = "Optional canonical Company Brain artifacts bucket ARN for scoped task-role access."
+  type        = string
+  default     = ""
+}
+
+variable "cognee_brain_artifacts_prefixes" {
+  description = "Tenant/stage prefixes inside cognee_brain_artifacts_bucket_arn the Brain task may access."
+  type        = list(string)
+  default     = []
+}
+
+variable "cognee_private_substrate_mode" {
+  description = "Whether the Company Brain substrate is private/internal-only."
+  type        = bool
+  default     = true
+}
+
+variable "cognee_require_authentication" {
+  description = "Passed to Cognee REQUIRE_AUTHENTICATION."
+  type        = bool
+  default     = false
+}
+
+variable "cognee_enable_backend_access_control" {
+  description = "Passed to Cognee ENABLE_BACKEND_ACCESS_CONTROL."
   type        = bool
   default     = false
 }
 
+variable "cognee_cors_allowed_origins" {
+  description = "Passed to Cognee CORS_ALLOWED_ORIGINS."
+  type        = string
+  default     = ""
+}
+
+variable "cognee_llm_provider" {
+  description = "Cognee LLM provider."
+  type        = string
+  default     = "bedrock"
+}
+
+variable "cognee_llm_model" {
+  description = "Cognee LLM model. Must handle tool-use structured extraction reliably — nova-lite repeatedly produced invalid ToolUse sequences on observation documents, and Haiku is rate-limited on this account. Kimi K2.5 is ON_DEMAND (no inference profile needed)."
+  type        = string
+  default     = "bedrock/moonshotai.kimi-k2.5"
+}
+
+variable "cognee_llm_api_key_secret_arn" {
+  description = "Optional Secrets Manager ARN for non-Bedrock Cognee LLM provider API key."
+  type        = string
+  default     = ""
+}
+
+variable "cognee_embedding_provider" {
+  description = "Cognee embedding provider."
+  type        = string
+  default     = "bedrock"
+}
+
+variable "cognee_embedding_model" {
+  description = "Cognee embedding model."
+  type        = string
+  default     = "amazon.titan-embed-text-v2:0"
+}
+
+variable "cognee_embedding_dimensions" {
+  description = "Cognee embedding dimensions."
+  type        = number
+  default     = 1024
+}
+
+variable "cognee_embedding_api_key_secret_arn" {
+  description = "Optional Secrets Manager ARN for non-Bedrock Cognee embedding provider API key."
+  type        = string
+  default     = ""
+}
+
+variable "cognee_vector_db_provider" {
+  description = "Cognee vector store provider."
+  type        = string
+  default     = "lancedb"
+}
+
+variable "cognee_vector_db_url" {
+  description = "Cognee vector store URL. Empty uses the dogfood local default."
+  type        = string
+  default     = ""
+}
+
+variable "cognee_vector_db_key_secret_arn" {
+  description = "Optional Secrets Manager ARN for remote Cognee vector store credentials."
+  type        = string
+  default     = ""
+}
+
+variable "cognee_graph_database_provider" {
+  description = "Cognee graph store provider."
+  type        = string
+  default     = "kuzu"
+}
+
+variable "cognee_graph_database_url" {
+  description = "Cognee graph store URL. Empty uses the dogfood local default."
+  type        = string
+  default     = ""
+}
+
+variable "cognee_graph_database_username" {
+  description = "Optional Cognee graph store username."
+  type        = string
+  default     = ""
+}
+
+variable "cognee_graph_database_password_secret_arn" {
+  description = "Optional Secrets Manager ARN for remote Cognee graph store password."
+  type        = string
+  default     = ""
+}
+
+variable "cognee_neptune_graph_id" {
+  description = "Neptune Analytics graph ID used by the production Brain tier."
+  type        = string
+  default     = ""
+}
+
+variable "cognee_neptune_graph_arn" {
+  description = "Optional Neptune Analytics graph ARN for scoped task-role access."
+  type        = string
+  default     = ""
+}
+
+variable "cognee_neptune_endpoint" {
+  description = "Neptune Analytics endpoint used by the production Brain tier."
+  type        = string
+  default     = ""
+}
+
+variable "cognee_production_posture" {
+  description = "Operator evidence string for production-tier approval/readiness posture."
+  type        = string
+  default     = ""
+}
+
+variable "cognee_bedrock_model_resource_arns" {
+  description = "Explicit Bedrock model ARNs Cognee may invoke when a Bedrock provider is selected."
+  type        = list(string)
+  default     = []
+}
+
+variable "cognee_kms_key_arns" {
+  description = "Optional KMS key ARNs needed to decrypt Cognee-injected secrets."
+  type        = list(string)
+  default     = []
+}
+
+variable "twenty_provisioned" {
+  description = "Provision the retained Twenty CRM managed-app substrate. Runtime can be parked independently with twenty_runtime_enabled."
+  type        = bool
+  default     = false
+}
+
+variable "twenty_runtime_enabled" {
+  description = "Run Twenty CRM server/worker tasks when the retained substrate is provisioned."
+  type        = bool
+  default     = false
+}
+
+variable "twenty_image_uri" {
+  description = "Twenty CRM container image URI pinned to an immutable sha256 digest. Required when twenty_provisioned = true."
+  type        = string
+  default     = ""
+}
+
+variable "twenty_db_username" {
+  description = "Dedicated PostgreSQL username for Twenty CRM."
+  type        = string
+  default     = "thinkwork_twenty"
+}
+
+variable "twenty_db_name" {
+  description = "Dedicated PostgreSQL database name for Twenty CRM."
+  type        = string
+  default     = "thinkwork_twenty"
+}
+
+variable "twenty_db_url_secret_arn" {
+  description = "Secrets Manager ARN containing a JSON PG_DATABASE_URL field for the dedicated Twenty database. Required when twenty_provisioned = true."
+  type        = string
+  default     = ""
+}
+
+variable "twenty_encryption_key_secret_arn" {
+  description = "Secrets Manager ARN containing a JSON ENCRYPTION_KEY field for Twenty. Required when twenty_provisioned = true."
+  type        = string
+  default     = ""
+}
+
+variable "twenty_email_from_address" {
+  description = "Verified SES sender address for Twenty app emails. Leave empty to derive noreply@ses_inbound_domain."
+  type        = string
+  default     = ""
+}
+
+variable "twenty_email_from_name" {
+  description = "Display name for Twenty app email From headers."
+  type        = string
+  default     = "ThinkWork CRM"
+}
+
+variable "twenty_public_url" {
+  description = "Public HTTPS URL for Twenty CRM. Leave empty to derive https://crm.<www_domain>."
+  type        = string
+  default     = ""
+}
+
+variable "twenty_certificate_arn" {
+  description = "ACM certificate ARN for the Twenty public ALB. Leave empty to create a dedicated crm.<www_domain> certificate when Twenty is provisioned."
+  type        = string
+  default     = ""
+}
+
+variable "n8n_provisioned" {
+  description = "Provision the retained n8n managed-app substrate. Runtime can be parked independently with n8n_runtime_enabled."
+  type        = bool
+  default     = false
+}
+
+variable "n8n_runtime_enabled" {
+  description = "Run n8n main/worker tasks when the retained substrate is provisioned."
+  type        = bool
+  default     = false
+}
+
+variable "n8n_image_uri" {
+  description = "Thin ThinkWork n8n wrapper image URI pinned to an immutable sha256 digest. Required when n8n_provisioned = true."
+  type        = string
+  default     = ""
+}
+
+variable "n8n_database_admin_secret_arn" {
+  description = "Secrets Manager ARN for an admin database credential allowed to create/drop the dedicated n8n database and role."
+  type        = string
+  default     = ""
+}
+
+variable "n8n_database_url_secret_arn" {
+  description = "Secrets Manager ARN containing n8n's least-privilege database secret."
+  type        = string
+  default     = ""
+}
+
+variable "n8n_database_username" {
+  description = "Dedicated PostgreSQL username for n8n."
+  type        = string
+  default     = "thinkwork_n8n"
+}
+
+variable "n8n_database_name" {
+  description = "Dedicated PostgreSQL database name for n8n."
+  type        = string
+  default     = "thinkwork_n8n"
+}
+
+variable "n8n_encryption_key_secret_arn" {
+  description = "Secrets Manager ARN containing N8N_ENCRYPTION_KEY."
+  type        = string
+  default     = ""
+}
+
+variable "n8n_operator_secret_arn" {
+  description = "Secrets Manager ARN containing the shared native n8n operator account credential."
+  type        = string
+  default     = ""
+}
+
+variable "n8n_service_credential_secret_arn" {
+  description = "Secrets Manager ARN containing the tenant service credential used by the native n8n MCP integration."
+  type        = string
+  default     = ""
+}
+
+variable "n8n_agent_step_bridge_credential_secret_arn" {
+  description = "Secrets Manager ARN containing the inbound credential used by n8n workflows to call the ThinkWork agent-step bridge."
+  type        = string
+  default     = ""
+}
+
+variable "n8n_storage_bucket_name" {
+  description = "S3 bucket name used for n8n managed artifacts and optional storage mode objects."
+  type        = string
+  default     = ""
+}
+
+variable "n8n_public_url" {
+  description = "Public HTTPS URL for n8n. Leave empty to derive https://n8n.<www_domain>."
+  type        = string
+  default     = ""
+}
+
+variable "n8n_domain" {
+  description = "Public DNS name for n8n. Leave empty to derive n8n.<www_domain>."
+  type        = string
+  default     = ""
+}
+
+variable "n8n_certificate_arn" {
+  description = "ACM certificate ARN for the n8n public ALB. Leave empty to create a dedicated n8n.<www_domain> certificate when n8n is provisioned."
+  type        = string
+  default     = ""
+}
+
+variable "n8n_container_port" {
+  description = "n8n HTTP listener/container port exposed through the public ALB."
+  type        = number
+  default     = 5678
+}
+
+variable "n8n_cache_engine" {
+  description = "ElastiCache engine for n8n. Prefer valkey; redis is available as a compatibility fallback."
+  type        = string
+  default     = "valkey"
+}
+
 variable "google_oauth_client_id" {
   description = "Google OAuth client ID (optional — leave empty to skip Google login)"
   type        = string
@@ -105,6 +538,12 @@ variable "pre_signup_lambda_zip" {
   default     = ""
 }
 
+variable "cognito_custom_auth_lambda_zip" {
+  description = "Path to the Cognito custom-auth challenge Lambda zip"
+  type        = string
+  default     = ""
+}
+
 variable "lambda_zips_dir" {
   description = "Local directory containing Lambda zip artifacts (from pnpm build:lambdas)"
   type        = string
@@ -142,6 +581,12 @@ variable "api_auth_secret" {
   default     = ""
 }
 
+variable "platform_operator_emails" {
+  description = "Comma-separated email allowlist for operator-gated GraphQL mutations."
+  type        = string
+  default     = ""
+}
+
 variable "www_domain" {
   description = "Public website apex domain (e.g. thinkwork.ai). Leave empty to skip the custom domain and DNS wiring."
   type        = string
@@ -154,12 +599,24 @@ variable "cloudflare_zone_id" {
   default     = ""
 }
 
+variable "ses_parent_domain" {
+  description = "Parent domain for tenant-scoped Space email addresses (e.g. thinkwork.ai). Leave empty to skip SES inbound resources."
+  type        = string
+  default     = ""
+}
+
 variable "ses_inbound_domain" {
-  description = "Subdomain for agent email (e.g. agents.thinkwork.ai). Terraform creates a delegated Route53 hosted zone, SES domain identity + DKIM, MX record, and receipt rule. Leave empty to skip SES inbound resources."
+  description = "Legacy delegated subdomain for agent email (e.g. agents.thinkwork.ai). Keep configured until legacy-address retirement notices are no longer needed."
   type        = string
   default     = ""
 }
 
+variable "tenant_slugs" {
+  description = "Tenant slugs to provision as SES receiving subdomains under ses_parent_domain. Each slug creates <slug>.<ses_parent_domain>."
+  type        = set(string)
+  default     = []
+}
+
 variable "stripe_price_ids_json" {
   description = "JSON object mapping internal plan names to Stripe price IDs for this stage, e.g. {\"starter\":\"price_...\",\"team\":\"price_...\"}. Non-secret; per-stage. Exposed to Lambdas as STRIPE_PRICE_IDS_JSON env var. The secret keys themselves live in AWS Secrets Manager at thinkwork/<stage>/stripe/api-credentials — never in tfvars."
   type        = string
@@ -249,10 +706,10 @@ variable "google_places_api_key" {
 
 variable "mapbox_public_token" {
   description = <<-EOT
-    Mapbox public pk.* token consumed by apps/computer's MapView primitive
+    Mapbox public pk.* token consumed by the apps/web MapView primitive
     (in @thinkwork/computer-stdlib) for inline map tile rendering inside
-    generated applets. Flows through to scripts/build-computer.sh →
-    apps/computer/.env.production as VITE_MAPBOX_PUBLIC_TOKEN.
+    generated applets. Flows through to scripts/build-web.sh →
+    apps/web/.env.production as VITE_MAPBOX_PUBLIC_TOKEN.
 
     Mapbox tokens are designed to ship in public bundles; URL allowlist
     on the Mapbox dashboard is the security boundary. Restrict the token
@@ -267,21 +724,6 @@ variable "mapbox_public_token" {
   sensitive   = true
 }
 
-variable "nova_act_api_key" {
-  description = <<-EOT
-    Nova Act API key used by the Strands Browser Automation tool. When empty,
-    Terraform creates /thinkwork/<stage>/agentcore/nova-act-api-key with a
-    placeholder value; populate or rotate the real key with:
-      aws ssm put-parameter --overwrite --name /thinkwork/<stage>/agentcore/nova-act-api-key --type SecureString --value <KEY>
-
-    The parameter's value has lifecycle.ignore_changes set, so operator
-    rotation sticks across applies.
-  EOT
-  type        = string
-  default     = ""
-  sensitive   = true
-}
-
 variable "wiki_deterministic_linking_enabled" {
   description = <<-EOT
     Feature flag for deterministic compile-time link emission:
@@ -303,6 +745,12 @@ variable "agentcore_code_interpreter_id" {
   default     = ""
 }
 
+variable "agentcore_memory_id" {
+  description = "Optional pre-existing AgentCore Memory resource ID. When set, skips memory auto-provisioning and reuses this ID."
+  type        = string
+  default     = ""
+}
+
 variable "mcp_custom_domain" {
   description = <<-EOT
     MCP custom domain (e.g. "mcp.thinkwork.ai"). Empty disables the
@@ -328,14 +776,38 @@ variable "mcp_custom_domain_ready" {
   default     = false
 }
 
+variable "customer_domain" {
+  description = "Customer domain for this deployment (e.g. tei.thinkwork.ai), claimed via the shared namespace claim tool. Leave empty to skip all customer-domain resources."
+  type        = string
+  default     = ""
+}
+
+variable "customer_domain_delegated" {
+  description = "Set true once the apex zone's NS records point at the customer zone (claim tool phase two). Gates the ACM certificate, the web alias records, and the customer-domain Cognito callback entries. Requires customer_domain."
+  type        = bool
+  default     = false
+}
+
+variable "customer_domain_legacy_retired" {
+  description = "Set true to remove the legacy (non-customer-domain) end-user app URLs from the Cognito callback/logout lists after the dual-domain cutover window closes. Requires customer_domain_delegated."
+  type        = bool
+  default     = false
+}
+
 locals {
   www_dns_enabled = var.www_domain != "" && var.cloudflare_zone_id != ""
   docs_domain     = var.www_domain != "" ? "docs.${var.www_domain}" : ""
-  admin_domain    = var.www_domain != "" ? "admin.${var.www_domain}" : ""
   app_domain      = var.www_domain != "" ? "app.${var.www_domain}" : ""
   computer_domain = var.www_domain != "" ? "computer.${var.www_domain}" : ""
   sandbox_domain  = var.www_domain != "" ? "sandbox.${var.www_domain}" : ""
   api_domain      = var.www_domain != "" ? "api.${var.www_domain}" : ""
+  crm_domain      = var.www_domain != "" ? "crm.${var.www_domain}" : ""
+  n8n_domain      = var.n8n_domain != "" ? var.n8n_domain : (var.www_domain != "" ? "n8n.${var.www_domain}" : "")
+  twenty_url      = var.twenty_public_url != "" ? var.twenty_public_url : (local.crm_domain != "" ? "https://${local.crm_domain}" : "")
+  n8n_url         = var.n8n_public_url != "" ? var.n8n_public_url : (local.n8n_domain != "" ? "https://${local.n8n_domain}" : "")
+
+  twenty_managed_certificate_enabled = local.www_dns_enabled && var.twenty_provisioned && var.twenty_certificate_arn == "" && local.crm_domain != ""
+  n8n_managed_certificate_enabled    = local.www_dns_enabled && var.n8n_provisioned && var.n8n_certificate_arn == "" && local.n8n_domain != ""
 }
 
 resource "aws_acm_certificate" "computer_sandbox" {
@@ -384,40 +856,203 @@ resource "aws_acm_certificate_validation" "computer_sandbox" {
   ]
 }
 
+resource "aws_acm_certificate" "twenty" {
+  count = local.twenty_managed_certificate_enabled ? 1 : 0
+
+  domain_name       = local.crm_domain
+  validation_method = "DNS"
+
+  lifecycle {
+    create_before_destroy = true
+  }
+
+  tags = {
+    Name = "thinkwork-${var.stage}-twenty"
+  }
+}
+
+resource "cloudflare_record" "twenty_acm_validation" {
+  for_each = {
+    for dvo in flatten([
+      for cert in aws_acm_certificate.twenty : tolist(cert.domain_validation_options)
+      ]) : dvo.domain_name => {
+      name  = dvo.resource_record_name
+      value = dvo.resource_record_value
+      type  = dvo.resource_record_type
+    }
+  }
+
+  zone_id = var.cloudflare_zone_id
+  name    = trimsuffix(each.value.name, ".")
+  content = trimsuffix(each.value.value, ".")
+  type    = each.value.type
+  ttl     = 60
+  proxied = false
+  comment = "ACM DNS validation for ${each.key}"
+
+  allow_overwrite = true
+}
+
+resource "aws_acm_certificate_validation" "twenty" {
+  count = local.twenty_managed_certificate_enabled ? 1 : 0
+
+  certificate_arn = aws_acm_certificate.twenty[0].arn
+  validation_record_fqdns = [
+    for record in cloudflare_record.twenty_acm_validation : record.hostname
+  ]
+}
+
+resource "aws_acm_certificate" "n8n" {
+  count = local.n8n_managed_certificate_enabled ? 1 : 0
+
+  domain_name       = local.n8n_domain
+  validation_method = "DNS"
+
+  lifecycle {
+    create_before_destroy = true
+  }
+
+  tags = {
+    Name = "thinkwork-${var.stage}-n8n"
+  }
+}
+
+resource "cloudflare_record" "n8n_acm_validation" {
+  for_each = local.n8n_managed_certificate_enabled ? toset([local.n8n_domain]) : toset([])
+
+  zone_id = var.cloudflare_zone_id
+  name    = trimsuffix(tolist(aws_acm_certificate.n8n[0].domain_validation_options)[0].resource_record_name, ".")
+  content = trimsuffix(tolist(aws_acm_certificate.n8n[0].domain_validation_options)[0].resource_record_value, ".")
+  type    = tolist(aws_acm_certificate.n8n[0].domain_validation_options)[0].resource_record_type
+  ttl     = 60
+  proxied = false
+  comment = "ACM DNS validation for ${each.key}"
+
+  allow_overwrite = true
+}
+
+resource "aws_acm_certificate_validation" "n8n" {
+  count = local.n8n_managed_certificate_enabled ? 1 : 0
+
+  certificate_arn = aws_acm_certificate.n8n[0].arn
+  validation_record_fqdns = [
+    for record in cloudflare_record.n8n_acm_validation : record.hostname
+  ]
+}
+
+moved {
+  from = module.www_dns[0].cloudflare_record.acm_validation["crm.thinkwork.ai"]
+  to   = cloudflare_record.twenty_acm_validation["crm.thinkwork.ai"]
+}
+
 module "thinkwork" {
   source = "../../modules/thinkwork"
 
+  providers = {
+    aws.us_east_1 = aws.us_east_1
+  }
+
   stage      = var.stage
   region     = var.region
   account_id = var.account_id
 
-  db_password                    = var.db_password
-  database_engine                = var.database_engine
-  enable_hindsight               = var.enable_hindsight
-  google_oauth_client_id         = var.google_oauth_client_id
-  google_oauth_client_secret     = var.google_oauth_client_secret
-  pre_signup_lambda_zip          = var.pre_signup_lambda_zip
-  lambda_zips_dir                = var.lambda_zips_dir
-  lambda_artifact_bucket         = var.lambda_artifact_bucket
-  lambda_artifact_prefix         = var.lambda_artifact_prefix
-  require_lambda_artifacts       = var.require_lambda_artifacts
-  enable_workspace_orchestration = var.enable_workspace_orchestration
-  api_auth_secret                = var.api_auth_secret
+  plugin_catalog_github_token_secret_arn = var.plugin_catalog_github_token_secret_arn
+
+  db_password                                 = var.db_password
+  database_engine                             = var.database_engine
+  enable_hindsight                            = var.enable_hindsight
+  memory_engine                               = var.memory_engine
+  enable_cognee                               = var.enable_cognee
+  cognee_image_uri                            = var.cognee_image_uri
+  cognee_db_username                          = var.cognee_db_username
+  cognee_db_name                              = var.cognee_db_name
+  cognee_db_password_secret_arn               = var.cognee_db_password_secret_arn
+  cognee_allowed_internal_cidr_blocks         = var.cognee_allowed_internal_cidr_blocks
+  cognee_allowed_internal_security_group_ids  = var.cognee_allowed_internal_security_group_ids
+  cognee_backend_mode                         = var.cognee_backend_mode
+  cognee_desired_count                        = var.cognee_desired_count
+  cognee_brain_tenant_id                      = var.cognee_brain_tenant_id
+  cognee_brain_instance_key                   = var.cognee_brain_instance_key
+  cognee_brain_storage_tier                   = var.cognee_brain_storage_tier
+  cognee_brain_s3_artifact_root               = var.cognee_brain_s3_artifact_root
+  cognee_brain_s3_manifest_root               = var.cognee_brain_s3_manifest_root
+  cognee_brain_s3_vault_projection_root       = var.cognee_brain_s3_vault_projection_root
+  cognee_brain_artifacts_bucket_arn           = var.cognee_brain_artifacts_bucket_arn
+  cognee_brain_artifacts_prefixes             = var.cognee_brain_artifacts_prefixes
+  cognee_private_substrate_mode               = var.cognee_private_substrate_mode
+  cognee_require_authentication               = var.cognee_require_authentication
+  cognee_enable_backend_access_control        = var.cognee_enable_backend_access_control
+  cognee_cors_allowed_origins                 = var.cognee_cors_allowed_origins
+  cognee_llm_provider                         = var.cognee_llm_provider
+  cognee_llm_model                            = var.cognee_llm_model
+  cognee_llm_api_key_secret_arn               = var.cognee_llm_api_key_secret_arn
+  cognee_embedding_provider                   = var.cognee_embedding_provider
+  cognee_embedding_model                      = var.cognee_embedding_model
+  cognee_embedding_dimensions                 = var.cognee_embedding_dimensions
+  cognee_embedding_api_key_secret_arn         = var.cognee_embedding_api_key_secret_arn
+  cognee_vector_db_provider                   = var.cognee_vector_db_provider
+  cognee_vector_db_url                        = var.cognee_vector_db_url
+  cognee_vector_db_key_secret_arn             = var.cognee_vector_db_key_secret_arn
+  cognee_graph_database_provider              = var.cognee_graph_database_provider
+  cognee_graph_database_url                   = var.cognee_graph_database_url
+  cognee_graph_database_username              = var.cognee_graph_database_username
+  cognee_graph_database_password_secret_arn   = var.cognee_graph_database_password_secret_arn
+  cognee_neptune_graph_id                     = var.cognee_neptune_graph_id
+  cognee_neptune_graph_arn                    = var.cognee_neptune_graph_arn
+  cognee_neptune_endpoint                     = var.cognee_neptune_endpoint
+  cognee_production_posture                   = var.cognee_production_posture
+  cognee_bedrock_model_resource_arns          = var.cognee_bedrock_model_resource_arns
+  cognee_kms_key_arns                         = var.cognee_kms_key_arns
+  twenty_provisioned                          = var.twenty_provisioned
+  twenty_runtime_enabled                      = var.twenty_runtime_enabled
+  twenty_image_uri                            = var.twenty_image_uri
+  twenty_db_username                          = var.twenty_db_username
+  twenty_db_name                              = var.twenty_db_name
+  twenty_db_url_secret_arn                    = var.twenty_db_url_secret_arn
+  twenty_encryption_key_secret_arn            = var.twenty_encryption_key_secret_arn
+  twenty_email_from_address                   = var.twenty_email_from_address
+  twenty_email_from_name                      = var.twenty_email_from_name
+  twenty_public_url                           = local.twenty_url
+  twenty_certificate_arn                      = var.twenty_certificate_arn != "" ? var.twenty_certificate_arn : (local.twenty_managed_certificate_enabled ? aws_acm_certificate_validation.twenty[0].certificate_arn : "")
+  n8n_provisioned                             = var.n8n_provisioned
+  n8n_runtime_enabled                         = var.n8n_runtime_enabled
+  n8n_image_uri                               = var.n8n_image_uri
+  n8n_database_admin_secret_arn               = var.n8n_database_admin_secret_arn
+  n8n_database_url_secret_arn                 = var.n8n_database_url_secret_arn
+  n8n_database_username                       = var.n8n_database_username
+  n8n_database_name                           = var.n8n_database_name
+  n8n_encryption_key_secret_arn               = var.n8n_encryption_key_secret_arn
+  n8n_operator_secret_arn                     = var.n8n_operator_secret_arn
+  n8n_service_credential_secret_arn           = var.n8n_service_credential_secret_arn
+  n8n_agent_step_bridge_credential_secret_arn = var.n8n_agent_step_bridge_credential_secret_arn
+  n8n_storage_bucket_name                     = var.n8n_storage_bucket_name
+  n8n_container_port                          = var.n8n_container_port
+  n8n_cache_engine                            = var.n8n_cache_engine
+  n8n_domain                                  = local.n8n_domain
+  n8n_public_url                              = local.n8n_url
+  n8n_certificate_arn                         = var.n8n_certificate_arn != "" ? var.n8n_certificate_arn : (local.n8n_managed_certificate_enabled ? aws_acm_certificate_validation.n8n[0].certificate_arn : "")
+  google_oauth_client_id                      = var.google_oauth_client_id
+  google_oauth_client_secret                  = var.google_oauth_client_secret
+  pre_signup_lambda_zip                       = var.pre_signup_lambda_zip
+  cognito_custom_auth_lambda_zip              = var.cognito_custom_auth_lambda_zip
+  lambda_zips_dir                             = var.lambda_zips_dir
+  lambda_artifact_bucket                      = var.lambda_artifact_bucket
+  lambda_artifact_prefix                      = var.lambda_artifact_prefix
+  require_lambda_artifacts                    = var.require_lambda_artifacts
+  enable_workspace_orchestration              = var.enable_workspace_orchestration
+  api_auth_secret                             = var.api_auth_secret
+  platform_operator_emails                    = var.platform_operator_emails
 
   # Public website custom domain (optional — wired only when www_domain is set)
   www_domain          = var.www_domain
   www_certificate_arn = local.www_dns_enabled ? module.www_dns[0].certificate_arn : ""
 
   # Docs site custom domain (derived from www_domain — docs.<apex>). The
-  # same ACM cert covers apex + www + docs + admin so every distribution
+  # same ACM cert covers apex + www + docs + app/computer so every distribution
   # shares it.
   docs_domain          = local.www_dns_enabled ? local.docs_domain : ""
   docs_certificate_arn = local.www_dns_enabled ? module.www_dns[0].certificate_arn : ""
 
-  # Admin SPA custom domain (derived from www_domain — admin.<apex>).
-  admin_domain          = local.www_dns_enabled ? local.admin_domain : ""
-  admin_certificate_arn = local.www_dns_enabled ? module.www_dns[0].certificate_arn : ""
-
   # End-user app custom domain (derived from www_domain — app.<apex>).
   # Same ACM cert covers it via the include_app SAN gate on www_dns.
   app_domain          = local.www_dns_enabled ? local.app_domain : ""
@@ -431,13 +1066,15 @@ module "thinkwork" {
 
   # Computer iframe sandbox (derived from www_domain — sandbox.<apex>).
   # Uses its own ACM certificate so sandbox bootstrap/rotation cannot replace
-  # the shared apex/www/docs/admin/computer/api certificate.
+  # the shared apex/www/docs/app/computer/api certificate.
   computer_sandbox_domain                 = local.www_dns_enabled ? local.sandbox_domain : ""
   computer_sandbox_certificate_arn        = local.www_dns_enabled ? aws_acm_certificate_validation.computer_sandbox[0].certificate_arn : ""
-  computer_sandbox_allowed_parent_origins = local.www_dns_enabled ? "https://${local.app_domain},https://${local.admin_domain}" : ""
+  computer_sandbox_allowed_parent_origins = local.www_dns_enabled ? "https://${local.app_domain}" : ""
 
-  # SES inbound email subdomain (delegated Route53 subzone).
+  # SES inbound email subdomains (delegated Route53 subzones).
   ses_inbound_domain = var.ses_inbound_domain
+  ses_parent_domain  = var.ses_parent_domain
+  ses_tenant_slugs   = var.tenant_slugs
 
   # Wiki compile Lambda config. Pinned so unrelated terraform applies
   # don't wipe the Bedrock model or the aggregation flag back to
@@ -451,11 +1088,11 @@ module "thinkwork" {
   requester_memory_dreaming_enabled             = var.requester_memory_dreaming_enabled
   requester_memory_dreaming_schedule_expression = var.requester_memory_dreaming_schedule_expression
   requester_memory_dreaming_model_id            = var.requester_memory_dreaming_model_id
-  nova_act_api_key                              = var.nova_act_api_key
   agentcore_code_interpreter_id                 = var.agentcore_code_interpreter_id
+  agentcore_memory_id                           = var.agentcore_memory_id
 
-  # Mapbox public token for apps/computer MapView primitive. Flows through
-  # to scripts/build-computer.sh → VITE_MAPBOX_PUBLIC_TOKEN.
+  # Mapbox public token for apps/web MapView primitive. Flows through
+  # to scripts/build-web.sh → VITE_MAPBOX_PUBLIC_TOKEN.
   mapbox_public_token = var.mapbox_public_token
 
   # Stripe billing — internal-plan → price-id map (per-stage, non-secret).
@@ -469,6 +1106,11 @@ module "thinkwork" {
   mcp_custom_domain       = var.mcp_custom_domain
   mcp_custom_domain_ready = var.mcp_custom_domain_ready
 
+  # Customer-namespace domain (optional — two-apply flow; see README).
+  customer_domain                = var.customer_domain
+  customer_domain_delegated      = var.customer_domain_delegated
+  customer_domain_legacy_retired = var.customer_domain_legacy_retired
+
   # Greenfield: create everything (all defaults are true)
 }
 
@@ -492,12 +1134,8 @@ module "www_dns" {
   include_docs                = true
   docs_cloudfront_domain_name = module.thinkwork.docs_distribution_domain
 
-  # Admin: same cycle-avoidance pattern.
-  include_admin                = true
-  admin_cloudfront_domain_name = module.thinkwork.admin_distribution_domain
-
-  # End-user app: canonical app.<apex> host. The underlying source package is
-  # still apps/computer for compatibility.
+  # End-user app: canonical app.<apex> host. The compatibility output names
+  # still use computer_* while the source path is apps/web.
   include_app                = true
   app_cloudfront_domain_name = module.thinkwork.app_distribution_domain
 
@@ -515,22 +1153,52 @@ module "www_dns" {
   include_api            = true
   api_gateway_id         = module.thinkwork.api_id
   api_gateway_stage_name = "$default"
+
+  # Twenty CRM custom domain (crm.<apex>). CRM uses its own ACM certificate;
+  # this module owns only the public CNAME to the ALB.
+  include_crm      = var.twenty_provisioned
+  crm_alb_dns_name = module.thinkwork.twenty_alb_dns_name != null ? module.thinkwork.twenty_alb_dns_name : ""
+
+  # n8n custom domain (n8n.<apex>). n8n uses its own ACM certificate; this
+  # module owns only the public CNAME to the ALB.
+  include_n8n      = var.n8n_provisioned
+  n8n_alb_dns_name = module.thinkwork.n8n_alb_dns_name != null ? module.thinkwork.n8n_alb_dns_name : ""
+
 }
 
 ################################################################################
 # SES Inbound DNS Delegation
 #
-# The ses-email module creates a Route53 hosted zone for var.ses_inbound_domain
-# (e.g. agents.thinkwork.ai). For the subzone to resolve, the parent zone
-# (thinkwork.ai at Cloudflare) must carry NS records pointing at the 4 AWS name
-# servers. New Route53 zones always return exactly 4 name servers, so we can
-# hardcode count = 4 without hitting "count value is not known" at plan time.
+# The ses-email module keeps the legacy Route53 hosted zone for
+# var.ses_inbound_domain (e.g. agents.thinkwork.ai) and creates one Route53
+# hosted zone for each tenant subdomain (e.g. dev.thinkwork.ai). For those
+# subzones to resolve, the parent zone (thinkwork.ai at Cloudflare) must carry
+# NS records pointing each subdomain at its 4 AWS name servers. New Route53
+# zones always return exactly 4 name servers, so we can hardcode range(4)
+# without hitting "for_each value is not known" at plan time.
 #
-# Without this delegation, terraform creates the Route53 zone and the MX/DKIM
-# records inside it, but the outside world asks Cloudflare for agents.thinkwork.ai
-# and gets NXDOMAIN because Cloudflare doesn't know to delegate.
+# Without this delegation, terraform creates the Route53 zones and the MX/DKIM
+# records inside them, but the outside world asks Cloudflare for
+# <tenant>.thinkwork.ai and gets NXDOMAIN because Cloudflare doesn't know to
+# delegate.
 ################################################################################
 
+resource "cloudflare_record" "tenant_email_ns" {
+  for_each = var.ses_parent_domain != "" && var.cloudflare_zone_id != "" ? {
+    for pair in setproduct(sort(tolist(var.tenant_slugs)), range(4)) : "${pair[0]}-${pair[1]}" => {
+      slug  = pair[0]
+      index = pair[1]
+    }
+  } : {}
+
+  zone_id = var.cloudflare_zone_id
+  name    = "${each.value.slug}.${var.ses_parent_domain}"
+  content = module.thinkwork.ses_tenant_name_servers[each.value.slug][each.value.index]
+  type    = "NS"
+  ttl     = 300
+  proxied = false
+}
+
 resource "cloudflare_record" "agents_ns" {
   count = var.ses_inbound_domain != "" && var.cloudflare_zone_id != "" ? 4 : 0
 
@@ -578,7 +1246,7 @@ output "appsync_api_key" {
 }
 
 output "mapbox_public_token" {
-  description = "Mapbox public token used by apps/computer MapView. Read by scripts/build-computer.sh to inline VITE_MAPBOX_PUBLIC_TOKEN at build time; empty string lets MapView fall back to OpenStreetMap tiles."
+  description = "Mapbox public token used by apps/web MapView. Read by scripts/build-web.sh to inline VITE_MAPBOX_PUBLIC_TOKEN at build time; empty string lets MapView fall back to OpenStreetMap tiles."
   value       = module.thinkwork.mapbox_public_token
   sensitive   = true
 }
@@ -629,7 +1297,7 @@ output "database_name" {
 }
 
 output "hindsight_enabled" {
-  description = "Whether the Hindsight add-on is enabled"
+  description = "Whether Hindsight canonical memory is enabled"
   value       = module.thinkwork.hindsight_enabled
 }
 
@@ -638,24 +1306,144 @@ output "hindsight_endpoint" {
   value       = module.thinkwork.hindsight_endpoint
 }
 
-output "agentcore_memory_id" {
-  description = "AgentCore Memory resource ID used for automatic retention"
-  value       = module.thinkwork.agentcore_memory_id
+output "cognee_enabled" {
+  description = "Whether the Cognee ontology/KG add-on is enabled"
+  value       = module.thinkwork.cognee_enabled
 }
 
-output "admin_url" {
-  description = "Admin app URL"
-  value       = local.www_dns_enabled ? "https://${local.admin_domain}" : "https://${module.thinkwork.admin_distribution_domain}"
+output "cognee_endpoint" {
+  description = "Internal Cognee API endpoint (null when enable_cognee = false)"
+  value       = module.thinkwork.cognee_endpoint
+}
+
+output "cognee_log_group_name" {
+  description = "CloudWatch log group for Cognee (null when enable_cognee = false)"
+  value       = module.thinkwork.cognee_log_group_name
+}
+
+output "cognee_brain_storage_tier" {
+  description = "Company Brain storage tier (null when enable_cognee = false)"
+  value       = module.thinkwork.cognee_brain_storage_tier
+}
+
+output "cognee_brain_instance_key" {
+  description = "Tenant-scoped Company Brain instance key (null for legacy stage-wide instances)"
+  value       = module.thinkwork.cognee_brain_instance_key
+}
+
+output "cognee_s3_artifact_root" {
+  description = "Canonical Company Brain S3 source artifact root"
+  value       = module.thinkwork.cognee_s3_artifact_root
+}
+
+output "cognee_neptune_graph_id" {
+  description = "Neptune Analytics graph ID for production Company Brain"
+  value       = module.thinkwork.cognee_neptune_graph_id
+}
+
+output "twenty_provisioned" {
+  description = "Whether the Twenty CRM retained managed-app substrate is provisioned"
+  value       = module.thinkwork.twenty_provisioned
+}
+
+output "twenty_runtime_enabled" {
+  description = "Whether the Twenty CRM server/worker runtime is enabled"
+  value       = module.thinkwork.twenty_runtime_enabled
 }
 
-output "admin_distribution_id" {
-  description = "CloudFront distribution ID for admin (for cache invalidation)"
-  value       = module.thinkwork.admin_distribution_id
+output "twenty_url" {
+  description = "Public Twenty CRM URL (null when twenty_provisioned = false)"
+  value       = module.thinkwork.twenty_url
 }
 
-output "admin_bucket_name" {
-  description = "S3 bucket for admin app assets"
-  value       = module.thinkwork.admin_bucket_name
+output "twenty_cluster_arn" {
+  description = "ECS cluster ARN for Twenty CRM (null when twenty_provisioned = false)"
+  value       = module.thinkwork.twenty_cluster_arn
+}
+
+output "twenty_server_service_name" {
+  description = "ECS service name for the Twenty server (null when twenty_provisioned = false)"
+  value       = module.thinkwork.twenty_server_service_name
+}
+
+output "twenty_worker_service_name" {
+  description = "ECS service name for the Twenty worker (null when twenty_provisioned = false)"
+  value       = module.thinkwork.twenty_worker_service_name
+}
+
+output "twenty_server_log_group_name" {
+  description = "CloudWatch log group for the Twenty server (null when twenty_provisioned = false)"
+  value       = module.thinkwork.twenty_server_log_group_name
+}
+
+output "twenty_worker_log_group_name" {
+  description = "CloudWatch log group for the Twenty worker (null when twenty_provisioned = false)"
+  value       = module.thinkwork.twenty_worker_log_group_name
+}
+
+output "twenty_cache_endpoint" {
+  description = "ElastiCache primary endpoint for Twenty CRM (null when twenty_provisioned = false)"
+  value       = module.thinkwork.twenty_cache_endpoint
+}
+
+output "n8n_provisioned" {
+  description = "Whether the n8n retained managed-app substrate is provisioned"
+  value       = module.thinkwork.n8n_provisioned
+}
+
+output "n8n_runtime_enabled" {
+  description = "Whether n8n ECS services are enabled"
+  value       = module.thinkwork.n8n_runtime_enabled
+}
+
+output "n8n_url" {
+  description = "Public n8n URL (null when n8n_provisioned = false)"
+  value       = module.thinkwork.n8n_url
+}
+
+output "n8n_cluster_arn" {
+  description = "ECS cluster ARN for n8n (null when n8n_provisioned = false)"
+  value       = module.thinkwork.n8n_cluster_arn
+}
+
+output "n8n_main_service_name" {
+  description = "ECS service name for n8n main (null when n8n_provisioned = false)"
+  value       = module.thinkwork.n8n_main_service_name
+}
+
+output "n8n_worker_service_name" {
+  description = "ECS service name for n8n worker (null when n8n_provisioned = false)"
+  value       = module.thinkwork.n8n_worker_service_name
+}
+
+output "n8n_valkey_endpoint" {
+  description = "ElastiCache primary endpoint for n8n queue mode (null when n8n_provisioned = false)"
+  value       = module.thinkwork.n8n_valkey_endpoint
+}
+
+output "n8n_storage_bucket_name" {
+  description = "S3 bucket name used for n8n managed artifacts (null when n8n_provisioned = false)"
+  value       = module.thinkwork.n8n_storage_bucket_name
+}
+
+output "n8n_service_credential_secret_arn" {
+  description = "Secrets Manager ARN used for the n8n MCP tenant service credential (null when n8n_provisioned = false)"
+  value       = module.thinkwork.n8n_service_credential_secret_arn
+}
+
+output "n8n_agent_step_bridge_credential_secret_arn" {
+  description = "Secrets Manager ARN used for the inbound n8n agent-step bridge credential (null when n8n_provisioned = false)"
+  value       = module.thinkwork.n8n_agent_step_bridge_credential_secret_arn
+}
+
+output "agentcore_memory_id" {
+  description = "AgentCore Memory resource ID used for automatic retention"
+  value       = module.thinkwork.agentcore_memory_id
+}
+
+output "admin_url" {
+  description = "Deprecated compatibility alias for app_url"
+  value       = local.www_dns_enabled ? "https://${local.app_domain}" : "https://${module.thinkwork.app_distribution_domain}"
 }
 
 output "app_url" {
@@ -673,6 +1461,31 @@ output "app_bucket_name" {
   value       = module.thinkwork.app_bucket_name
 }
 
+output "deployment_state_machine_arn" {
+  description = "Deployment orchestration Step Functions state machine ARN."
+  value       = module.thinkwork.deployment_state_machine_arn
+}
+
+output "deployment_state_machine_name" {
+  description = "Deployment orchestration Step Functions state machine name."
+  value       = module.thinkwork.deployment_state_machine_name
+}
+
+output "deployment_runner_project_name" {
+  description = "CodeBuild project name for the deployment runner."
+  value       = module.thinkwork.deployment_runner_project_name
+}
+
+output "deployment_runner_project_arn" {
+  description = "CodeBuild project ARN for the deployment runner."
+  value       = module.thinkwork.deployment_runner_project_arn
+}
+
+output "deployment_evidence_bucket_name" {
+  description = "S3 bucket for deployment evidence artifacts."
+  value       = module.thinkwork.deployment_evidence_bucket_name
+}
+
 output "computer_url" {
   description = "Deprecated alias for app_url"
   value       = local.www_dns_enabled ? "https://${local.app_domain}" : "https://${module.thinkwork.app_distribution_domain}"
@@ -743,18 +1556,28 @@ output "www_bucket_name" {
   value       = module.thinkwork.www_bucket_name
 }
 
+output "ses_inbound_zone_ids" {
+  description = "Route53 hosted zone IDs for tenant email subdomains, keyed by tenant slug"
+  value       = module.thinkwork.ses_inbound_zone_ids
+}
+
 output "ses_inbound_zone_id" {
-  description = "Route53 hosted zone ID for the email subdomain (null when ses_inbound_domain is not set)"
+  description = "Route53 hosted zone ID for the legacy email subdomain (null when ses_inbound_domain is not set)"
   value       = module.thinkwork.ses_inbound_zone_id
 }
 
+output "ses_tenant_name_servers" {
+  description = "Name servers for delegated tenant email subzones, keyed by tenant slug. Published to Cloudflare when cloudflare_zone_id is set."
+  value       = module.thinkwork.ses_tenant_name_servers
+}
+
 output "ses_inbound_name_servers" {
-  description = "Name servers for the delegated email subzone. Paste these as NS records at the registrar that hosts the parent domain (Google Domains for thinkwork.ai) before SES can verify."
+  description = "Name servers for the legacy delegated email subzone."
   value       = module.thinkwork.ses_inbound_name_servers
 }
 
 output "ses_inbound_mx_target" {
-  description = "MX target host for the email subdomain. Already written into the subzone by Terraform — informational."
+  description = "MX target host for tenant email subdomains. Already written into each subzone by Terraform — informational."
   value       = module.thinkwork.ses_inbound_mx_target
 }
 
@@ -778,3 +1601,8 @@ output "mcp_custom_domain_target" {
   description = "Regional target for the final mcp CNAME — only populated on the second apply after mcp_custom_domain_ready=true. { target_domain_name, hosted_zone_id } or null."
   value       = module.thinkwork.mcp_custom_domain_target
 }
+
+output "customer_domain_name_servers" {
+  description = "The four Route53 name servers for the customer-domain zone — publish these via the claim tool's `claim --set-targets` to delegate (empty when no customer domain is configured)."
+  value       = module.thinkwork.customer_domain_name_servers
+}