thinkwork-cli 0.12.15 → 0.12.16

package/dist/{api-client-4VT3FWOH.js → api-client-JUBCQQDF.js}

@@ -5,7 +5,7 @@ import {
   readTfVar,
   resolveApiConfig,
   resolveTfvarsPath
-} from "./chunk-H7AB42ES.js";
+} from "./chunk-STY44FQO.js";
 export {
   apiFetch,
   apiFetchRaw,

package/dist/{chunk-H7AB42ES.js → chunk-STY44FQO.js}

@@ -310,6 +310,18 @@ function resolveTerraformRoot(startDir = process.cwd()) {
 function isTerraformRoot(dir) {
   return existsSync3(path2.join(dir, "examples", "greenfield")) || existsSync3(path2.join(dir, "environments")) || existsSync3(path2.join(dir, "main.tf"));
 }
+function resolveTerraformRootForStage(stage, recordedDir, startDir = process.cwd()) {
+  const cwdRoot = resolveTerraformRoot(startDir);
+  try {
+    resolveTierDir(cwdRoot, stage, "app");
+    return cwdRoot;
+  } catch {
+    if (recordedDir && existsSync3(path2.join(recordedDir, "main.tf"))) {
+      return recordedDir;
+    }
+    return cwdRoot;
+  }
+}
 function resolveTierDir(terraformDir, stage, tier) {
   const envDir = path2.join(terraformDir, "environments", stage, tier);
   if (existsSync3(envDir)) {
@@ -668,6 +680,7 @@ export {
   ensureStateBackend,
   parseLockError,
   resolveTerraformRoot,
+  resolveTerraformRootForStage,
   resolveTierDir,
   isInitScaffoldedLayout,
   ensureWorkspace,

package/dist/cli.js

@@ -26,13 +26,14 @@ import {
   resolveApiConfig,
   resolveTerraformDir,
   resolveTerraformRoot,
+  resolveTerraformRootForStage,
   resolveTierDir,
   runTerraform,
   runTerraformTee,
   saveEnterpriseDeployment,
   saveEnvironment,
   terraformOutput
-} from "./chunk-H7AB42ES.js";
+} from "./chunk-STY44FQO.js";
 
 // src/cli.ts
 import { Command } from "commander";
@@ -319,6 +320,7 @@ function registerPlanCommand(program2) {
 
 // src/commands/deploy.ts
 import { spawn as spawn2, spawnSync as spawnSync6 } from "child_process";
+import { randomBytes as randomBytes4 } from "crypto";
 import {
   existsSync as existsSync9,
   mkdirSync as mkdirSync3,
@@ -402,6 +404,7 @@ function checkAwsIdentity() {
   };
 }
 var DOCTOR_BEDROCK_PROBE_MODEL_ID = "us.anthropic.claude-haiku-4-5-20251001-v1:0";
+var DOCTOR_BEDROCK_FALLBACK_MODEL_ID = "us.anthropic.claude-sonnet-4-5-20250929-v1:0";
 function evaluateBedrockProbe(error) {
   if (error === null) {
     return {
@@ -435,22 +438,34 @@ function evaluateBedrockProbe(error) {
 function checkBedrockAccess() {
   return {
     name: "Bedrock model invocation",
-    run: () => {
+    run: async () => {
       const region = process.env.AWS_REGION || "us-east-1";
-      try {
-        execSync2(
-          `aws bedrock-runtime converse --model-id ${DOCTOR_BEDROCK_PROBE_MODEL_ID} --messages '[{"role":"user","content":[{"text":"Reply with OK"}]}]' --inference-config '{"maxTokens":1}' --output json --region ${region}`,
-          {
-            encoding: "utf-8",
-            timeout: 3e4,
-            stdio: ["pipe", "pipe", "pipe"]
+      let lastError = null;
+      const models = [
+        DOCTOR_BEDROCK_PROBE_MODEL_ID,
+        DOCTOR_BEDROCK_PROBE_MODEL_ID,
+        DOCTOR_BEDROCK_FALLBACK_MODEL_ID
+      ];
+      for (let attempt = 1; attempt <= 3; attempt++) {
+        try {
+          execSync2(
+            `aws bedrock-runtime converse --model-id ${models[attempt - 1]} --messages '[{"role":"user","content":[{"text":"Reply with OK"}]}]' --inference-config '{"maxTokens":1}' --output json --region ${region}`,
+            {
+              encoding: "utf-8",
+              timeout: 3e4,
+              stdio: ["pipe", "pipe", "pipe"]
+            }
+          );
+          return evaluateBedrockProbe(null);
+        } catch (err) {
+          lastError = err instanceof Error && "stderr" in err ? String(err.stderr ?? err.message) : String(err);
+          if (!lastError.includes("ThrottlingException") || attempt === 3) {
+            return evaluateBedrockProbe(lastError);
           }
-        );
-        return evaluateBedrockProbe(null);
-      } catch (err) {
-        const stderr = err instanceof Error && "stderr" in err ? String(err.stderr ?? err.message) : String(err);
-        return evaluateBedrockProbe(stderr);
+          await new Promise((r) => setTimeout(r, attempt * 5e3));
+        }
       }
+      return evaluateBedrockProbe(lastError);
     }
   };
 }
@@ -618,6 +633,62 @@ function checkSesStatus(exec = awsExec) {
     }
   };
 }
+function parseEcrImageUri(uri) {
+  const match = uri.match(/^(\d+\.dkr\.ecr\.([a-z0-9-]+)\.amazonaws\.com)\//);
+  return match ? { registry: match[1], region: match[2] } : null;
+}
+function evaluateAgentcorePiImageProbe(input17) {
+  if (!input17.dockerAvailable) {
+    return {
+      pass: true,
+      detail: "docker unavailable \u2014 cannot probe the pinned image; the apply-time seed reports pull failures"
+    };
+  }
+  if (input17.reachable) {
+    return { pass: true, detail: `${input17.uri} reachable` };
+  }
+  const reason = (input17.error ?? "").trim().split("\n")[0].slice(0, 160);
+  return {
+    pass: false,
+    detail: `pinned AgentCore image ${input17.uri} is not pullable from this machine` + (reason ? ` (${reason})` : "") + ". The apply keeps an already-seeded ECR image or builds from a repo checkout; otherwise set agentcore_pi_source_image_uri in terraform.tfvars to a pullable image."
+  };
+}
+function checkAgentcorePiSourceImage(uri) {
+  return {
+    name: "AgentCore image pullable",
+    blocking: false,
+    run: () => {
+      const docker = spawnSync("docker", ["--version"], { encoding: "utf8" });
+      if (docker.status !== 0) {
+        return evaluateAgentcorePiImageProbe({
+          uri,
+          dockerAvailable: false,
+          reachable: false
+        });
+      }
+      const ecr = parseEcrImageUri(uri);
+      if (ecr) {
+        spawnSync(
+          "bash",
+          [
+            "-c",
+            `aws ecr get-login-password --region ${ecr.region} | docker login --username AWS --password-stdin ${ecr.registry}`
+          ],
+          { encoding: "utf8" }
+        );
+      }
+      const probe = spawnSync("docker", ["manifest", "inspect", uri], {
+        encoding: "utf8"
+      });
+      return evaluateAgentcorePiImageProbe({
+        uri,
+        dockerAvailable: true,
+        reachable: probe.status === 0,
+        error: probe.stderr
+      });
+    }
+  };
+}
 function doctorChecks() {
   return [
     checkAwsCli(),
@@ -636,6 +707,9 @@ function preflightChecks(ctx) {
   if (ctx.backend) checks.push(checkStateBackend(ctx.backend));
   if (ctx.domain) checks.push(checkDomainDelegation(ctx.domain));
   if (ctx.sesConfigured) checks.push(checkSesStatus());
+  if (ctx.agentcorePiSourceImage) {
+    checks.push(checkAgentcorePiSourceImage(ctx.agentcorePiSourceImage));
+  }
   return checks;
 }
 async function runChecks(checks) {
@@ -1247,6 +1321,83 @@ COMMIT;`;
   }
 }
 
+// src/lib/owner-tenant.ts
+import { randomBytes as randomBytes2 } from "crypto";
+
+// ../../packages/database-pg/src/utils/reserved-slugs.ts
+var TENANT_SLUG_PATTERN = /^[a-z0-9][a-z0-9-]{1,28}[a-z0-9]$/;
+var RESERVED_TENANT_SLUGS = [
+  "admin",
+  "agents",
+  "api",
+  "app",
+  "assets",
+  "canary",
+  "cdn",
+  "dev",
+  "docs",
+  "mail",
+  "mobile",
+  "prod",
+  "staging",
+  "test",
+  "www"
+];
+var RESERVED_TENANT_SLUG_SET = new Set(RESERVED_TENANT_SLUGS);
+function isReservedTenantSlug(slug) {
+  return RESERVED_TENANT_SLUG_SET.has(slug);
+}
+
+// src/lib/owner-tenant.ts
+function deriveOwnerTenantSlug(stage, random = () => randomBytes2(3).toString("hex")) {
+  const sanitized = stage.toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
+  if (TENANT_SLUG_PATTERN.test(sanitized) && !isReservedTenantSlug(sanitized)) {
+    return sanitized;
+  }
+  return `workspace-${random()}`;
+}
+function deriveOwnerTenantName(slug) {
+  return slug.split("-").map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join(" ");
+}
+function sqlQuote(value) {
+  return `'${value.replace(/'/g, "''")}'`;
+}
+function buildEnsureOwnerTenantSql(input17) {
+  const name = sqlQuote(input17.name);
+  const slug = sqlQuote(input17.slug);
+  const email = sqlQuote(input17.email.toLowerCase());
+  return `WITH new_tenant AS (
+  INSERT INTO tenants (name, slug, issue_prefix, issue_counter, pending_owner_email, first_admin_claim_required)
+  SELECT ${name}, ${slug}, 'TW', 0, ${email}, true
+  WHERE NOT EXISTS (SELECT 1 FROM tenants)
+  RETURNING id
+)
+INSERT INTO tenant_settings (tenant_id)
+SELECT id FROM new_tenant
+ON CONFLICT DO NOTHING
+RETURNING tenant_id;`;
+}
+async function ensureOwnerTenant(options) {
+  const slug = deriveOwnerTenantSlug(options.stage);
+  const runner = await (options.connect ?? connectPsql)(options.connection);
+  try {
+    const result = await runner.query(
+      buildEnsureOwnerTenantSql({
+        name: deriveOwnerTenantName(slug),
+        slug,
+        email: options.email
+      })
+    );
+    return {
+      created: (result.rows ?? []).length > 0,
+      slug,
+      email: options.email.toLowerCase()
+    };
+  } finally {
+    await runner.end();
+  }
+}
+
 // src/commands/bootstrap.ts
 import { spawn } from "child_process";
 import { existsSync as existsSync4 } from "fs";
@@ -1320,7 +1471,10 @@ function registerBootstrapCommand(program2) {
     }
     const identity = getAwsIdentity();
     printHeader("bootstrap", stage, identity);
-    const terraformDir = resolveTerraformRoot();
+    const terraformDir = resolveTerraformRootForStage(
+      stage,
+      loadEnvironment(stage)?.terraformDir
+    );
     const cwd = resolveTierDir(terraformDir, stage, "app");
     await ensureInit(cwd);
     await ensureWorkspace(cwd, stage);
@@ -1486,6 +1640,28 @@ function buildVerifyChecks(ctx) {
               break;
             }
           }
+          if (url) {
+            const cfg = httpProbe(`${url}/thinkwork-runtime-config.json`);
+            if (cfg.status !== 200 || !cfg.body.includes("cognitoClientId")) {
+              return {
+                pass: false,
+                detail: `${url} serves HTML but /thinkwork-runtime-config.json is ${cfg.status === 200 ? "incomplete" : "missing"} \u2014 the app cannot sign in. Rerun thinkwork deploy to publish it.`
+              };
+            }
+            const parsed = (() => {
+              try {
+                return JSON.parse(cfg.body);
+              } catch {
+                return {};
+              }
+            })();
+            if (!parsed.viteEnv?.VITE_COGNITO_CLIENT_ID) {
+              return {
+                pass: false,
+                detail: `${url} runtime config has no viteEnv.VITE_COGNITO_CLIENT_ID \u2014 sign-in would be unavailable.`
+              };
+            }
+          }
           if (!url && candidates.length > 0) {
             url = `https://${candidates[0].Domain}`;
           }
@@ -3173,7 +3349,7 @@ function git(args) {
 
 // src/commands/enterprise/secrets.ts
 import { execFileSync as execFileSync5 } from "child_process";
-import { randomBytes as randomBytes2 } from "crypto";
+import { randomBytes as randomBytes3 } from "crypto";
 var GhCliEnterpriseSecretSetter = class {
   async setEnvironmentSecret(repository, stage, name, value) {
     execFileSync5(
@@ -3241,7 +3417,7 @@ async function setEnterpriseStageSecrets(repository, stageSecrets, setter) {
   return results;
 }
 function generateUrlSafeSecret(bytes = 32) {
-  return randomBytes2(bytes).toString("base64url");
+  return randomBytes3(bytes).toString("base64url");
 }
 async function resolveSecretValue(stage, name, explicit, stdinIsTty, promptSecret, generateSecret2) {
   if (explicit) return explicit;
@@ -4187,6 +4363,167 @@ async function ensureReleaseArtifacts(cwd, identity, stage, versionFlag) {
   }
   return { version, webAssetSource };
 }
+function buildRuntimeConfig(values) {
+  const cognitoDomain = values.authDomain.startsWith("https://") ? values.authDomain : values.authDomain ? `https://${values.authDomain}.auth.${values.region}.amazoncognito.com` : "";
+  const api = values.apiEndpoint.replace(/\/+$/, "");
+  return {
+    stage: values.stage,
+    region: values.region,
+    accountId: values.accountId,
+    releaseVersion: values.releaseVersion,
+    releaseManifestUrl: null,
+    releaseManifestSha256: null,
+    deploymentId: `thinkwork-${values.stage}`,
+    displayName: "ThinkWork",
+    appUrl: values.appUrl,
+    apiEndpoint: values.apiEndpoint,
+    graphqlHttpUrl: api ? `${api}/graphql` : "",
+    appsyncUrl: values.appsyncUrl,
+    appsyncRealtimeUrl: values.appsyncRealtimeUrl,
+    appsyncApiKey: values.appsyncApiKey,
+    cognitoDomain,
+    cognitoUserPoolId: values.userPoolId,
+    cognitoClientId: values.adminClientId,
+    controller: null,
+    issuedAt: values.issuedAt,
+    // The web app consumes ONLY this map (runtime-config.ts reads
+    // raw.viteEnv) — the outer profile is for tooling. Omitting it kept the
+    // sign-in screen dead even with the file published (HCI test).
+    viteEnv: {
+      VITE_API_URL: values.apiEndpoint,
+      VITE_GRAPHQL_HTTP_URL: api ? `${api}/graphql` : "",
+      VITE_GRAPHQL_URL: values.appsyncUrl,
+      VITE_GRAPHQL_WS_URL: values.appsyncRealtimeUrl,
+      VITE_GRAPHQL_API_KEY: values.appsyncApiKey,
+      VITE_COGNITO_DOMAIN: cognitoDomain,
+      VITE_COGNITO_USER_POOL_ID: values.userPoolId,
+      VITE_COGNITO_CLIENT_ID: values.adminClientId,
+      VITE_DEPLOYMENT_ID: `thinkwork-${values.stage}`,
+      VITE_DEPLOYMENT_DISPLAY_NAME: "ThinkWork",
+      VITE_DEPLOYMENT_PROFILE_ISSUED_AT: values.issuedAt,
+      VITE_SPACES_URL: values.appUrl,
+      VITE_STAGE: values.stage,
+      VITE_AWS_REGION: values.region,
+      VITE_AWS_ACCOUNT_ID: values.accountId,
+      VITE_RELEASE_VERSION: values.releaseVersion ?? ""
+    }
+  };
+}
+async function publishRuntimeConfig(cwd, bucket, identity, stage, releaseVersion) {
+  const output = async (key) => {
+    try {
+      return await terraformOutput(cwd, key);
+    } catch {
+      return "";
+    }
+  };
+  const config = buildRuntimeConfig({
+    stage,
+    region: identity.region,
+    accountId: identity.account,
+    releaseVersion,
+    apiEndpoint: await output("api_endpoint"),
+    appUrl: await output("app_url"),
+    authDomain: await output("auth_domain"),
+    appsyncUrl: await output("appsync_api_url"),
+    appsyncRealtimeUrl: await output("appsync_realtime_url"),
+    appsyncApiKey: await output("appsync_api_key"),
+    userPoolId: await output("user_pool_id"),
+    adminClientId: await output("admin_client_id") || await output("admin_client_id_out"),
+    issuedAt: (/* @__PURE__ */ new Date()).toISOString()
+  });
+  const tempDir = mkdtempSync5(pathJoinTmp("thinkwork-runtime-config-"));
+  const file = join9(tempDir, "thinkwork-runtime-config.json");
+  writeFileSync7(file, JSON.stringify(config, null, 2) + "\n");
+  const put = spawnSync6(
+    "aws",
+    [
+      "s3",
+      "cp",
+      file,
+      `s3://${bucket}/thinkwork-runtime-config.json`,
+      "--content-type",
+      "application/json",
+      "--cache-control",
+      "no-store",
+      "--region",
+      identity.region
+    ],
+    { encoding: "utf8" }
+  );
+  if (put.status !== 0) {
+    throw new Error(
+      `Could not publish runtime config: ${(put.stderr ?? "").trim().slice(0, 200)}`
+    );
+  }
+  printSuccess(`Runtime config published to s3://${bucket}/thinkwork-runtime-config.json`);
+  const distributionId = await output("app_distribution_id");
+  if (distributionId) {
+    spawnSync6(
+      "aws",
+      [
+        "cloudfront",
+        "create-invalidation",
+        "--distribution-id",
+        distributionId,
+        "--paths",
+        "/thinkwork-runtime-config.json",
+        "/index.html"
+      ],
+      { encoding: "utf8" }
+    );
+  }
+}
+async function ensureOwnerUser(cwd, region) {
+  const email = (readTfvarsSignalsRaw(cwd).platform_operator_emails ?? "").split(",")[0]?.trim();
+  if (!email) return null;
+  const userPoolId = await terraformOutput(cwd, "user_pool_id").catch(() => "");
+  if (!userPoolId) return null;
+  const exists = spawnSync6(
+    "aws",
+    [
+      "cognito-idp",
+      "admin-get-user",
+      "--user-pool-id",
+      userPoolId,
+      "--username",
+      email,
+      "--region",
+      region
+    ],
+    { encoding: "utf8" }
+  );
+  if (exists.status === 0) return { email, tempPassword: null };
+  const tempPassword = `Tw1!${randomBytes4(12).toString("base64url")}`;
+  const created = spawnSync6(
+    "aws",
+    [
+      "cognito-idp",
+      "admin-create-user",
+      "--user-pool-id",
+      userPoolId,
+      "--username",
+      email,
+      "--user-attributes",
+      `Name=email,Value=${email}`,
+      "Name=email_verified,Value=true",
+      "--temporary-password",
+      tempPassword,
+      "--message-action",
+      "SUPPRESS",
+      "--region",
+      region
+    ],
+    { encoding: "utf8" }
+  );
+  if (created.status !== 0) {
+    printWarning(
+      `Could not create the owner user ${email}: ${(created.stderr ?? "").trim().slice(0, 200)}`
+    );
+    return null;
+  }
+  return { email, tempPassword };
+}
 async function publishWebAssets(cwd, webAssetSource) {
   const bucket = await terraformOutput(cwd, "app_bucket_name");
   if (!bucket) {
@@ -4247,6 +4584,20 @@ async function applySchemaMigrations(cwd, identity, stage) {
     );
     return;
   }
+  const connection = await resolveStageDbConnection(cwd, identity, stage);
+  console.log("\n  Applying database schema (full migration history)...");
+  const summary = await applyMigrations({
+    drizzleDir,
+    stage,
+    region: identity.region,
+    connection,
+    log: (line) => console.log(`    ${line}`)
+  });
+  console.log(
+    `  Schema: ${summary.applied.length} migration(s) applied, ${summary.skipped} already present` + (summary.skippedFiles.length > 0 ? `, ${summary.skippedFiles.length} operator-only file(s) skipped` : "") + "."
+  );
+}
+async function resolveStageDbConnection(cwd, identity, stage) {
   const endpoint = await terraformOutput(cwd, "db_cluster_endpoint");
   if (!endpoint) {
     throw new Error(
@@ -4280,23 +4631,13 @@ async function applySchemaMigrations(cwd, identity, stage) {
       `Secret thinkwork-${stage}-db-credentials is missing username/password.`
     );
   }
-  console.log("\n  Applying database schema (full migration history)...");
-  const summary = await applyMigrations({
-    drizzleDir,
-    stage,
-    region: identity.region,
-    connection: {
-      host: endpoint,
-      port: 5432,
-      user: parsed.username,
-      password: parsed.password,
-      database: "thinkwork"
-    },
-    log: (line) => console.log(`    ${line}`)
-  });
-  console.log(
-    `  Schema: ${summary.applied.length} migration(s) applied, ${summary.skipped} already present` + (summary.skippedFiles.length > 0 ? `, ${summary.skippedFiles.length} operator-only file(s) skipped` : "") + "."
-  );
+  return {
+    host: endpoint,
+    port: 5432,
+    user: parsed.username,
+    password: parsed.password,
+    database: "thinkwork"
+  };
 }
 function resolveBedrockLoggingPin(assignments, logGroupExists) {
   if (assignments.manage_bedrock_invocation_logging !== void 0) return null;
@@ -4396,7 +4737,10 @@ async function runLocalTerraformDeploy(opts) {
       );
     }
   }
-  const terraformDir = resolveTerraformRoot();
+  const terraformDir = resolveTerraformRootForStage(
+    stage,
+    loadEnvironment(stage)?.terraformDir
+  );
   const tiers = expandComponent(opts.component);
   const cwd0 = resolveTierDir(terraformDir, stage, tiers[0]);
   const scaffolded = isInitScaffoldedLayout(cwd0);
@@ -4408,7 +4752,8 @@ async function runLocalTerraformDeploy(opts) {
     const ctx = {
       backend: caller && scaffolded ? backendTarget(caller.account, caller.region, stage) : void 0,
       domain: signals.domain,
-      sesConfigured: signals.sesConfigured
+      sesConfigured: signals.sesConfigured,
+      agentcorePiSourceImage: readTfvarsSignalsRaw(preflightCwd).agentcore_pi_source_image_uri || void 0
     };
     console.log("\n  Preflight checks:");
     const summary = await runChecks(preflightChecks(ctx));
@@ -4432,6 +4777,7 @@ async function runLocalTerraformDeploy(opts) {
     printWarning("Preflight skipped (--skip-preflight).");
   }
   let webAssetSource = null;
+  let releaseVersionPin = null;
   if (scaffolded && caller) {
     ensureBedrockLoggingPin(cwd0, caller.region);
     const release = await ensureReleaseArtifacts(
@@ -4441,6 +4787,7 @@ async function runLocalTerraformDeploy(opts) {
       opts.releaseVersion
     );
     webAssetSource = release.webAssetSource;
+    releaseVersionPin = release.version;
   }
   for (let i = 0; i < tiers.length; i++) {
     const tier = tiers[i];
@@ -4486,9 +4833,45 @@ async function runLocalTerraformDeploy(opts) {
   if (scaffolded && caller) {
     await applySchemaMigrations(cwd0, caller, stage);
   }
+  let ownerUser = null;
+  if (scaffolded && caller) {
+    const operatorEmail = (readTfvarsSignalsRaw(cwd0).platform_operator_emails ?? "").split(",")[0]?.trim();
+    if (operatorEmail) {
+      try {
+        const connection = await resolveStageDbConnection(cwd0, caller, stage);
+        const ownerTenant = await ensureOwnerTenant({
+          stage,
+          email: operatorEmail,
+          connection
+        });
+        if (ownerTenant.created) {
+          printSuccess(
+            `Owner tenant "${ownerTenant.slug}" pre-provisioned \u2014 first sign-in by ${ownerTenant.email} claims it.`
+          );
+        }
+      } catch (err) {
+        printWarning(
+          `Could not pre-provision the owner tenant: ${err instanceof Error ? err.message : String(err)}. First sign-in will show "No tenant assigned" until this is resolved \u2014 rerun the deploy.`
+        );
+      }
+    }
+    ownerUser = await ensureOwnerUser(cwd0, caller.region);
+  }
   if (scaffolded && webAssetSource) {
     await publishWebAssets(cwd0, webAssetSource);
   }
+  if (scaffolded && caller) {
+    const bucket = await terraformOutput(cwd0, "app_bucket_name");
+    if (bucket) {
+      await publishRuntimeConfig(
+        cwd0,
+        bucket,
+        caller,
+        stage,
+        releaseVersionPin ?? null
+      );
+    }
+  }
   if (scaffolded && caller) {
     console.log("\n  Seeding workspace defaults...");
     await runWorkspaceBootstrap(cwd0, stage, caller.region);
@@ -4506,6 +4889,7 @@ async function runLocalTerraformDeploy(opts) {
       )
     });
     if (!verification.passed) {
+      printOwnerCredentials(ownerUser);
       printError(
         `Deploy applied but the stack failed verification (${verification.failures.length} probe(s)). Fix the items above and rerun \`thinkwork deploy -s ${stage}\` \u2014 reruns converge.`
       );
@@ -4515,6 +4899,19 @@ async function runLocalTerraformDeploy(opts) {
   printSuccess("Deploy complete");
   await runPostDeployProbe(stage);
   printSummary("deploy", stage, tiers, startTime);
+  printOwnerCredentials(ownerUser);
+}
+function printOwnerCredentials(ownerUser) {
+  if (ownerUser?.tempPassword) {
+    console.log("");
+    printSuccess(`Owner user created: ${ownerUser.email}`);
+    console.log(
+      `    Temporary password (shown ONCE \u2014 Cognito requires a change at first sign-in):`
+    );
+    console.log(`      ${ownerUser.tempPassword}`);
+  } else if (ownerUser) {
+    console.log(`  Owner user ${ownerUser.email} already exists.`);
+  }
 }
 async function offerStaleLockRecovery(cwd, stage, tier, lock) {
   console.log("");
@@ -5066,7 +5463,10 @@ async function runLocalTerraformDestroy(opts) {
       process.exit(0);
     }
   }
-  const terraformDir = resolveTerraformRoot();
+  const terraformDir = resolveTerraformRootForStage(
+    stage,
+    localEnv?.terraformDir
+  );
   const tiers = expandComponent(opts.component).reverse();
   const preRegion = identity && identity.region !== "unknown" ? identity.region : "us-east-1";
   const cluster = disableClusterDeletionProtection(stage, preRegion);
@@ -6046,7 +6446,7 @@ function discoverCognitoConfig(stage, region) {
 import {
   createServer
 } from "http";
-import { randomBytes as randomBytes3 } from "crypto";
+import { randomBytes as randomBytes5 } from "crypto";
 import { spawn as spawn3 } from "child_process";
 import chalk6 from "chalk";
 var CLI_LOOPBACK_PORT = 42010;
@@ -6056,7 +6456,7 @@ async function loginWithCognito(opts) {
   const port = opts.port ?? CLI_LOOPBACK_PORT;
   const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
   const redirectUri = `http://127.0.0.1:${port}${CALLBACK_PATH}`;
-  const state = randomBytes3(16).toString("hex");
+  const state = randomBytes5(16).toString("hex");
   const authorizeUrl = buildAuthorizeUrl(opts.cognito, redirectUri, state);
   const code = await waitForCallbackCode({
     port,
@@ -7044,8 +7444,10 @@ function findBundledTerraform() {
 function parseTfvarsAssignments(content) {
   const values = {};
   for (const line of content.split("\n")) {
-    const match = line.match(/^\s*([a-zA-Z0-9_]+)\s*=\s*"([^"]*)"/);
-    if (match) values[match[1]] = match[2];
+    const match = line.match(
+      /^\s*([a-zA-Z0-9_]+)\s*=\s*(?:"([^"]*)"|(true|false|[0-9]+))\s*$/
+    );
+    if (match) values[match[1]] = match[2] ?? match[3];
   }
   const hasContent = content.split("\n").some((l) => l.trim() && !l.trim().startsWith("#"));
   if (hasContent && !values.stage) {
@@ -7127,6 +7529,25 @@ function buildTfvars(config) {
       `customer_domain_delegated = ${config.customer_domain_delegated === "true"}`
     );
   }
+  if (config.stage === "prod" || config.stage === "production") {
+    lines.push(``);
+    lines.push(
+      `# \u2500\u2500 Compliance (prod requirement) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500`
+    );
+    lines.push(
+      `# Object Lock COMPLIANCE is REQUIRED for prod-named stages (terraform`
+    );
+    lines.push(
+      `# precondition). Retention is irreversible until it expires \u2014 even AWS`
+    );
+    lines.push(
+      `# root cannot delete anchors early. Raise retention for audit posture.`
+    );
+    lines.push(`compliance_anchor_object_lock_mode = "COMPLIANCE"`);
+    lines.push(
+      `compliance_anchor_retention_days   = ${config.compliance_anchor_retention_days || "30"}`
+    );
+  }
   if (config.platform_operator_emails) {
     lines.push(``);
     lines.push(
@@ -7278,7 +7699,7 @@ function registerInitCommand(program2) {
         config.admin_url = "http://localhost:5174";
         config.mobile_scheme = "thinkwork";
         config.customer_domain = existing?.customer_domain ?? "";
-        config.customer_domain_delegated = "false";
+        config.customer_domain_delegated = existing?.customer_domain_delegated ?? "false";
         config.platform_operator_emails = existing?.platform_operator_emails ?? "";
         config.ses_parent_domain = existing?.ses_parent_domain ?? "";
       } else {
@@ -7312,7 +7733,7 @@ function registerInitCommand(program2) {
           "Domain (e.g. thinkwork.acme.com; empty to skip)",
           existing?.customer_domain ?? ""
         );
-        config.customer_domain_delegated = "false";
+        config.customer_domain_delegated = existing?.customer_domain_delegated ?? "false";
         config.platform_operator_emails = await ask2(
           "Operator email(s), comma-separated",
           existing?.platform_operator_emails ?? ""
@@ -7420,10 +7841,24 @@ function registerInitCommand(program2) {
       if (existsSync13(schemaPath) && !existsSync13(join12(tfDir, "schema.graphql"))) {
         cpSync(schemaPath, join12(tfDir, "schema.graphql"));
       }
-      const tfvars = buildTfvars(config);
+      let tfvars = buildTfvars(config);
+      const generatedKeys = new Set(
+        [...tfvars.matchAll(/^\s*([a-zA-Z0-9_]+)\s*=/gm)].map((m) => m[1])
+      );
+      const preserved = Object.entries(existing ?? {}).filter(
+        ([key]) => !generatedKeys.has(key)
+      );
+      if (preserved.length > 0) {
+        tfvars += `
+# \u2500\u2500 Preserved from previous configuration (init rerun) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+` + preserved.map(
+          ([key, value]) => /^(true|false|[0-9]+)$/.test(value) ? `${key} = ${value}` : `${key} = "${value}"`
+        ).join("\n") + `
+`;
+      }
       writeFileSync9(tfvarsPath, tfvars);
       const mainTfPath = join12(tfDir, "main.tf");
-      if (!existsSync13(mainTfPath)) {
+      {
         writeFileSync9(
           mainTfPath,
           `################################################################################
@@ -7779,6 +8214,20 @@ variable "agentcore_pi_source_image_uri" {
   default = ""
 }
 
+# Object Lock posture for the compliance anchor bucket. Stages named
+# prod/production REQUIRE "COMPLIANCE" (terraform precondition) \u2014 set
+# automatically by init for those stage names. COMPLIANCE retention is
+# irreversible until it expires (even AWS root cannot delete early).
+variable "compliance_anchor_object_lock_mode" {
+  type    = string
+  default = "GOVERNANCE"
+}
+
+variable "compliance_anchor_retention_days" {
+  type    = number
+  default = 365
+}
+
 # Pinned by \`thinkwork deploy\`: true only when this stage is the first
 # ThinkWork stack in the account+region (the Bedrock invocation-logging
 # resources are account-scoped singletons).
@@ -7814,6 +8263,9 @@ module "thinkwork" {
   skill_trust_runner_enabled        = false
   manage_bedrock_invocation_logging = var.manage_bedrock_invocation_logging
 
+  compliance_anchor_object_lock_mode = var.compliance_anchor_object_lock_mode
+  compliance_anchor_retention_days   = var.compliance_anchor_retention_days
+
   db_password                = var.db_password
   database_engine            = var.database_engine
   enable_hindsight           = var.enable_hindsight
@@ -7870,6 +8322,38 @@ output "api_endpoint" {
   value = module.thinkwork.api_endpoint
 }
 
+# Outputs consumed by \`thinkwork deploy\`'s web runtime-config generation \u2014
+# the web app fetches /thinkwork-runtime-config.json at boot; without these
+# the published bundle renders "Sign-in options are unavailable".
+output "app_url" {
+  value = module.thinkwork.app_url
+}
+
+output "auth_domain" {
+  value = module.thinkwork.auth_domain
+}
+
+output "appsync_api_url" {
+  value = module.thinkwork.appsync_api_url
+}
+
+output "appsync_realtime_url" {
+  value = module.thinkwork.appsync_realtime_url
+}
+
+output "appsync_api_key" {
+  value     = module.thinkwork.appsync_api_key
+  sensitive = true
+}
+
+output "admin_client_id_out" {
+  value = module.thinkwork.admin_client_id
+}
+
+output "app_distribution_id" {
+  value = module.thinkwork.app_distribution_id
+}
+
 output "app_bucket_name" {
   value = module.thinkwork.app_bucket_name
 }
@@ -10609,6 +11093,182 @@ var CliDeleteBudgetPolicyDocument = {
     }
   ]
 };
+var CliCapabilityInspectorDocument = {
+  kind: "Document",
+  definitions: [
+    {
+      kind: "OperationDefinition",
+      operation: "query",
+      name: { kind: "Name", value: "CliCapabilityInspector" },
+      variableDefinitions: [
+        {
+          kind: "VariableDefinition",
+          variable: {
+            kind: "Variable",
+            name: { kind: "Name", value: "tenantId" }
+          },
+          type: {
+            kind: "NonNullType",
+            type: { kind: "NamedType", name: { kind: "Name", value: "ID" } }
+          }
+        },
+        {
+          kind: "VariableDefinition",
+          variable: {
+            kind: "Variable",
+            name: { kind: "Name", value: "agentId" }
+          },
+          type: { kind: "NamedType", name: { kind: "Name", value: "ID" } }
+        },
+        {
+          kind: "VariableDefinition",
+          variable: {
+            kind: "Variable",
+            name: { kind: "Name", value: "spaceId" }
+          },
+          type: { kind: "NamedType", name: { kind: "Name", value: "ID" } }
+        },
+        {
+          kind: "VariableDefinition",
+          variable: {
+            kind: "Variable",
+            name: { kind: "Name", value: "agentProfileId" }
+          },
+          type: { kind: "NamedType", name: { kind: "Name", value: "ID" } }
+        },
+        {
+          kind: "VariableDefinition",
+          variable: {
+            kind: "Variable",
+            name: { kind: "Name", value: "perspectiveUserId" }
+          },
+          type: { kind: "NamedType", name: { kind: "Name", value: "ID" } }
+        }
+      ],
+      selectionSet: {
+        kind: "SelectionSet",
+        selections: [
+          {
+            kind: "Field",
+            name: { kind: "Name", value: "capabilityInspector" },
+            arguments: [
+              {
+                kind: "Argument",
+                name: { kind: "Name", value: "tenantId" },
+                value: {
+                  kind: "Variable",
+                  name: { kind: "Name", value: "tenantId" }
+                }
+              },
+              {
+                kind: "Argument",
+                name: { kind: "Name", value: "agentId" },
+                value: {
+                  kind: "Variable",
+                  name: { kind: "Name", value: "agentId" }
+                }
+              },
+              {
+                kind: "Argument",
+                name: { kind: "Name", value: "spaceId" },
+                value: {
+                  kind: "Variable",
+                  name: { kind: "Name", value: "spaceId" }
+                }
+              },
+              {
+                kind: "Argument",
+                name: { kind: "Name", value: "agentProfileId" },
+                value: {
+                  kind: "Variable",
+                  name: { kind: "Name", value: "agentProfileId" }
+                }
+              },
+              {
+                kind: "Argument",
+                name: { kind: "Name", value: "perspectiveUserId" },
+                value: {
+                  kind: "Variable",
+                  name: { kind: "Name", value: "perspectiveUserId" }
+                }
+              }
+            ],
+            selectionSet: {
+              kind: "SelectionSet",
+              selections: [
+                { kind: "Field", name: { kind: "Name", value: "state" } },
+                { kind: "Field", name: { kind: "Name", value: "stateDetail" } },
+                { kind: "Field", name: { kind: "Name", value: "agentId" } },
+                {
+                  kind: "Field",
+                  name: { kind: "Name", value: "noUserBaseline" }
+                },
+                {
+                  kind: "Field",
+                  name: { kind: "Name", value: "predicted" },
+                  selectionSet: {
+                    kind: "SelectionSet",
+                    selections: [
+                      {
+                        kind: "Field",
+                        name: { kind: "Name", value: "computedAt" }
+                      },
+                      {
+                        kind: "Field",
+                        name: { kind: "Name", value: "configFingerprint" }
+                      },
+                      {
+                        kind: "Field",
+                        name: { kind: "Name", value: "items" },
+                        selectionSet: {
+                          kind: "SelectionSet",
+                          selections: [
+                            {
+                              kind: "Field",
+                              name: { kind: "Name", value: "capabilityClass" }
+                            },
+                            {
+                              kind: "Field",
+                              name: { kind: "Name", value: "capabilityId" }
+                            },
+                            {
+                              kind: "Field",
+                              name: { kind: "Name", value: "displayName" }
+                            },
+                            {
+                              kind: "Field",
+                              name: { kind: "Name", value: "active" }
+                            },
+                            {
+                              kind: "Field",
+                              name: { kind: "Name", value: "provenance" }
+                            },
+                            {
+                              kind: "Field",
+                              name: { kind: "Name", value: "reason" }
+                            },
+                            {
+                              kind: "Field",
+                              name: { kind: "Name", value: "detail" }
+                            },
+                            {
+                              kind: "Field",
+                              name: { kind: "Name", value: "tokenStatus" }
+                            }
+                          ]
+                        }
+                      }
+                    ]
+                  }
+                }
+              ]
+            }
+          }
+        ]
+      }
+    }
+  ]
+};
 var CliCostSummaryDocument = {
   kind: "Document",
   definitions: [
@@ -19937,6 +20597,7 @@ var documents = {
   "\n  query CliBudgetStatus($tenantId: ID!) {\n    budgetStatus(tenantId: $tenantId) {\n      policy {\n        id\n        scope\n        agentId\n        userId\n        period\n        limitUsd\n      }\n      spentUsd\n      remainingUsd\n      percentUsed\n      status\n    }\n  }\n": CliBudgetStatusDocument,
   "\n  mutation CliUpsertBudgetPolicy(\n    $tenantId: ID!\n    $input: UpsertBudgetPolicyInput!\n  ) {\n    upsertBudgetPolicy(tenantId: $tenantId, input: $input) {\n      id\n      scope\n      agentId\n      userId\n      limitUsd\n      period\n      actionOnExceed\n    }\n  }\n": CliUpsertBudgetPolicyDocument,
   "\n  mutation CliDeleteBudgetPolicy($id: ID!) {\n    deleteBudgetPolicy(id: $id)\n  }\n": CliDeleteBudgetPolicyDocument,
+  "\n  query CliCapabilityInspector(\n    $tenantId: ID!\n    $agentId: ID\n    $spaceId: ID\n    $agentProfileId: ID\n    $perspectiveUserId: ID\n  ) {\n    capabilityInspector(\n      tenantId: $tenantId\n      agentId: $agentId\n      spaceId: $spaceId\n      agentProfileId: $agentProfileId\n      perspectiveUserId: $perspectiveUserId\n    ) {\n      state\n      stateDetail\n      agentId\n      noUserBaseline\n      predicted {\n        computedAt\n        configFingerprint\n        items {\n          capabilityClass\n          capabilityId\n          displayName\n          active\n          provenance\n          reason\n          detail\n          tokenStatus\n        }\n      }\n    }\n  }\n": CliCapabilityInspectorDocument,
   "\n  query CliCostSummary($tenantId: ID!, $from: AWSDateTime, $to: AWSDateTime) {\n    costSummary(tenantId: $tenantId, from: $from, to: $to) {\n      totalUsd\n      llmUsd\n      computeUsd\n      toolsUsd\n      evalUsd\n      totalInputTokens\n      totalOutputTokens\n      eventCount\n    }\n  }\n": CliCostSummaryDocument,
   "\n  query CliCostByAgent($tenantId: ID!, $from: AWSDateTime, $to: AWSDateTime) {\n    costByAgent(tenantId: $tenantId, from: $from, to: $to) {\n      agentId\n      agentName\n      totalUsd\n      eventCount\n    }\n  }\n": CliCostByAgentDocument,
   "\n  query CliCostByUser($tenantId: ID!, $from: AWSDateTime, $to: AWSDateTime) {\n    costByUser(tenantId: $tenantId, from: $from, to: $to) {\n      userId\n      userName\n      userEmail\n      totalUsd\n      eventCount\n      isSystem\n    }\n  }\n": CliCostByUserDocument,
@@ -25107,7 +25768,7 @@ async function runWebhookTest(id, _opts) {
   try {
     const tokenData = await gqlQuery(ctx.client, WebhookForTestDoc, { id });
     if (tokenData.webhook?.token) {
-      const { resolveApiConfig: resolveApiConfig2 } = await import("./api-client-4VT3FWOH.js");
+      const { resolveApiConfig: resolveApiConfig2 } = await import("./api-client-JUBCQQDF.js");
       const api = resolveApiConfig2(ctx.stage);
       if (api?.apiUrl) {
         const base = api.apiUrl.replace(/\/$/, "");
@@ -26789,6 +27450,112 @@ function registerTraceCommand(program2) {
   trace.command("turn <turnId>").description("Per-invocation logs for a single thread turn.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(runTraceTurn);
 }
 
+// src/commands/capabilities.ts
+var CapabilityInspectorDoc = graphql(`
+  query CliCapabilityInspector(
+    $tenantId: ID!
+    $agentId: ID
+    $spaceId: ID
+    $agentProfileId: ID
+    $perspectiveUserId: ID
+  ) {
+    capabilityInspector(
+      tenantId: $tenantId
+      agentId: $agentId
+      spaceId: $spaceId
+      agentProfileId: $agentProfileId
+      perspectiveUserId: $perspectiveUserId
+    ) {
+      state
+      stateDetail
+      agentId
+      noUserBaseline
+      predicted {
+        computedAt
+        configFingerprint
+        items {
+          capabilityClass
+          capabilityId
+          displayName
+          active
+          provenance
+          reason
+          detail
+          tokenStatus
+        }
+      }
+    }
+  }
+`);
+async function runCapabilities(opts) {
+  if (opts.json) setJsonMode(true);
+  const ctx = await resolveTenantContext(opts);
+  const data = await gqlQuery(ctx.client, CapabilityInspectorDoc, {
+    tenantId: ctx.tenantId,
+    agentId: opts.agent ?? null,
+    spaceId: opts.space ?? null,
+    agentProfileId: opts.profile ?? null,
+    perspectiveUserId: opts.user ?? null
+  });
+  const inspection = data.capabilityInspector;
+  if (isJsonMode()) {
+    printJson(inspection);
+    if (inspection.state !== "ok") process.exitCode = 1;
+    return;
+  }
+  if (inspection.state === "invalid_selection") {
+    printError(`Invalid selection: ${inspection.stateDetail}`);
+    process.exitCode = 1;
+    return;
+  }
+  if (inspection.state === "resolution_fault") {
+    printError(`Resolution fault: ${inspection.stateDetail}`);
+    process.exitCode = 1;
+    return;
+  }
+  const predicted = inspection.predicted;
+  if (!predicted) {
+    printError("Inspector returned no capability set.");
+    process.exitCode = 1;
+    return;
+  }
+  if (inspection.noUserBaseline) {
+    console.log(
+      "No-user baseline (what a scheduled/wakeup turn gets). Pass --user <id> for a user's perspective.\n"
+    );
+  }
+  printTable(
+    predicted.items.map((item) => ({
+      class: item.capabilityClass,
+      id: item.displayName || item.capabilityId,
+      state: item.active ? "active" : item.reason ?? "inactive",
+      token: item.tokenStatus ?? "\u2014",
+      provenance: item.provenance ?? "\u2014",
+      detail: item.detail ?? "\u2014"
+    })),
+    [
+      { key: "class", header: "CLASS" },
+      { key: "id", header: "CAPABILITY" },
+      { key: "state", header: "STATE" },
+      { key: "token", header: "TOKEN" },
+      { key: "provenance", header: "PROVENANCE" },
+      { key: "detail", header: "DETAIL" }
+    ]
+  );
+  console.log(
+    `
+Computed ${predicted.computedAt} \xB7 fingerprint ${predicted.configFingerprint.slice(0, 12)}`
+  );
+}
+function registerCapabilitiesCommand(program2) {
+  program2.command("capabilities").description(
+    "Effective capability set for an agent context \u2014 every skill, tool, MCP server, extension, and plugin with its state and gate reason."
+  ).option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--agent <agentId>", "Agent id (defaults to the platform agent)").option("--space <spaceId>", "Space id").option("--profile <agentProfileId>", "Agent Profile id").option(
+    "--user <userId>",
+    "Perspective user id (omit for the no-invoker baseline)"
+  ).option("--json", "Raw JSON output").action(runCapabilities);
+}
+
 // src/commands/dashboard.ts
 var DashboardDoc = graphql(`
   query CliDashboard($tenantId: ID!) {
@@ -30216,6 +30983,7 @@ registerCostCommand(program);
 registerBudgetCommand(program);
 registerPerformanceCommand(program);
 registerTraceCommand(program);
+registerCapabilitiesCommand(program);
 registerDashboardCommand(program);
 registerEvalCommand(program);
 registerEnterpriseCommand(program);

package/dist/drizzle/0197_rcm_context_columns.sql

@@ -0,0 +1,28 @@
+-- Resolved capability manifest context columns (capability-mapping plan U11).
+-- Additive: turn/context identity + config fingerprint on the append-only
+-- manifest audit table, plus the covering index for "newest manifest matching
+-- context" retrieval (U13) and the retention sweep's tenant+created_at range.
+-- Plain uuids, deliberately NOT foreign keys — matching template_id/user_id on
+-- the same table: audit rows must survive deletion of their source rows.
+-- creates-column: public.resolved_capability_manifests.thread_id
+-- creates-column: public.resolved_capability_manifests.thread_turn_id
+-- creates-column: public.resolved_capability_manifests.space_id
+-- creates-column: public.resolved_capability_manifests.agent_profile_id
+-- creates-column: public.resolved_capability_manifests.config_fingerprint
+-- creates: public.idx_rcm_context
+
+ALTER TABLE public.resolved_capability_manifests
+  ADD COLUMN IF NOT EXISTS thread_id uuid,
+  ADD COLUMN IF NOT EXISTS thread_turn_id uuid,
+  ADD COLUMN IF NOT EXISTS space_id uuid,
+  ADD COLUMN IF NOT EXISTS agent_profile_id uuid,
+  ADD COLUMN IF NOT EXISTS config_fingerprint text;
+
+CREATE INDEX IF NOT EXISTS idx_rcm_context
+  ON public.resolved_capability_manifests (
+    tenant_id,
+    agent_id,
+    space_id,
+    agent_profile_id,
+    created_at
+  );

package/dist/terraform/modules/app/agentcore-pi/main.tf

@@ -24,6 +24,8 @@ locals {
   chat_agent_finalize_fn_arn  = "arn:aws:lambda:${var.region}:${var.account_id}:function:${local.chat_agent_finalize_fn_name}"
   chat_agent_activity_fn_name = "thinkwork-${var.stage}-api-chat-agent-activity"
   chat_agent_activity_fn_arn  = "arn:aws:lambda:${var.region}:${var.account_id}:function:${local.chat_agent_activity_fn_name}"
+  manifest_log_fn_name        = "thinkwork-${var.stage}-api-manifest-log"
+  manifest_log_fn_arn         = "arn:aws:lambda:${var.region}:${var.account_id}:function:${local.manifest_log_fn_name}"
   pi_image_uri                = "${var.ecr_repository_url}:pi-latest"
   cognee_vpc_enabled          = length(var.cognee_subnet_ids) > 0 && length(var.cognee_security_group_ids) > 0
   okf_efs_vpc_enabled         = var.okf_efs_enabled && length(var.okf_efs_subnet_ids) > 0 && length(var.okf_efs_security_group_ids) > 0
@@ -246,8 +248,9 @@ resource "aws_iam_role_policy" "agentcore_pi" {
       },
       {
         # Invoke API Lambdas from Pi's private VPC. Memory retain is queued
-        # async; chat activity/finalize are RequestResponse callbacks because
-        # public API Gateway endpoints are not reachable reliably from this VPC.
+        # async; chat activity/finalize and the per-turn capability-manifest
+        # POST are RequestResponse callbacks because public API Gateway
+        # endpoints are not reachable reliably from this VPC.
         Sid    = "ApiLambdaInvoke"
         Effect = "Allow"
         Action = ["lambda:InvokeFunction"]
@@ -255,6 +258,7 @@ resource "aws_iam_role_policy" "agentcore_pi" {
           local.memory_retain_fn_arn,
           local.chat_agent_finalize_fn_arn,
           local.chat_agent_activity_fn_arn,
+          local.manifest_log_fn_arn,
         ]
       },
       {
@@ -349,6 +353,14 @@ resource "terraform_data" "seed_pi_image" {
         source_id="$(docker image inspect --format '{{.Id}}' "${var.source_image_uri}")"
         docker tag "$source_id" "${local.pi_image_uri}"
       else
+        # Unreachable source must not fail a stack whose target tag is already
+        # seeded (rerun after a partial deploy, or a registry that went
+        # private) — the Lambda only consumes the target ECR tag.
+        repo_name="$(basename "${var.ecr_repository_url}")"
+        if aws ecr describe-images --repository-name "$repo_name" --image-ids imageTag=pi-latest --region ${var.region} >/dev/null 2>&1; then
+          echo "WARN: could not pull ${var.source_image_uri}; ${local.pi_image_uri} is already seeded — keeping the existing image."
+          exit 0
+        fi
         dockerfile="$repo_root/packages/agentcore-pi/agent-container/Dockerfile"
         if [[ ! -f "$dockerfile" ]]; then
           echo "ERROR: could not pull ${var.source_image_uri} and there is no repo checkout at $repo_root to build from." >&2
@@ -389,6 +401,7 @@ resource "aws_lambda_function" "agentcore_pi" {
       MEMORY_RETAIN_FN_NAME                  = local.memory_retain_fn_name
       CHAT_AGENT_FINALIZE_FN_NAME            = local.chat_agent_finalize_fn_name
       CHAT_AGENT_ACTIVITY_FN_NAME            = local.chat_agent_activity_fn_name
+      MANIFEST_LOG_FUNCTION_NAME             = local.manifest_log_fn_name
       HINDSIGHT_ENDPOINT                     = var.hindsight_endpoint
       THINKWORK_API_URL                      = var.api_endpoint
       API_AUTH_SECRET                        = var.api_auth_secret

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkwork-cli",
-  "version": "0.12.15",
+  "version": "0.12.16",
   "description": "Thinkwork CLI — deploy, manage, and interact with your Thinkwork stack",
   "license": "Apache-2.0",
   "type": "module",
@@ -33,6 +33,7 @@
     "@graphql-codegen/cli": "^5.0.6",
     "@graphql-codegen/client-preset": "^4.8.2",
     "@thinkwork/admin-ops": "workspace:*",
+    "@thinkwork/database-pg": "workspace:*",
     "@types/node": "^25.6.0",
     "tsup": "^8.0.0",
     "tsx": "^4.0.0",