thinkwork-cli 0.12.16 → 0.12.17

package/dist/plugins/company-brain/terraform/cognee/outputs.tf

@@ -1,144 +0,0 @@
-output "cognee_endpoint" {
-  description = "Internal Cognee API endpoint"
-  value       = "http://${aws_lb.cognee.dns_name}"
-}
-
-output "cognee_log_group_name" {
-  description = "CloudWatch log group for Cognee"
-  value       = aws_cloudwatch_log_group.cognee.name
-}
-
-output "cognee_task_role_arn" {
-  description = "IAM role assumed by the Cognee ECS task"
-  value       = aws_iam_role.ecs_task.arn
-}
-
-output "cognee_execution_role_arn" {
-  description = "IAM role used by ECS to pull the Cognee image and inject secrets"
-  value       = aws_iam_role.ecs_execution.arn
-}
-
-output "cognee_backend_mode" {
-  description = "Selected Cognee backend mode"
-  value       = var.backend_mode
-}
-
-output "cognee_brain_instance_key" {
-  description = "Tenant-scoped Company Brain instance key used for resource naming; null for legacy stage-wide instances."
-  value       = local.tenant_scoped_brain_instance ? local.normalized_brain_instance_key : null
-}
-
-output "cognee_brain_tenant_id" {
-  description = "Tenant ID owning this Company Brain substrate instance; null for legacy stage-wide instances."
-  value       = var.brain_tenant_id != "" ? var.brain_tenant_id : null
-}
-
-output "cognee_brain_storage_tier" {
-  description = "Company Brain storage tier selected for this substrate instance."
-  value       = var.brain_storage_tier
-}
-
-output "cognee_graph_database_provider" {
-  description = "Cognee graph database provider selected for the Brain substrate."
-  value       = var.graph_database_provider
-}
-
-output "cognee_vector_db_provider" {
-  description = "Cognee vector database provider selected for the Brain substrate."
-  value       = var.vector_db_provider
-}
-
-output "cognee_embedding_model" {
-  description = "Embedding model configured for Brain retrieval and migration evidence."
-  value       = var.embedding_model
-}
-
-output "cognee_embedding_dimensions" {
-  description = "Embedding vector dimension configured for Brain retrieval and migration evidence."
-  value       = var.embedding_dimensions
-}
-
-output "cognee_s3_artifact_root" {
-  description = "Canonical Company Brain S3 source artifact root."
-  value       = var.brain_s3_artifact_root
-}
-
-output "cognee_s3_manifest_root" {
-  description = "Canonical Company Brain S3 ingestion manifest root."
-  value       = var.brain_s3_manifest_root
-}
-
-output "cognee_s3_vault_projection_root" {
-  description = "Canonical Company Brain S3 vault projection root."
-  value       = var.brain_s3_vault_projection_root
-}
-
-output "cognee_neptune_graph_id" {
-  description = "Neptune Analytics graph ID for production Brain tier."
-  value       = var.neptune_graph_id
-}
-
-output "cognee_neptune_endpoint" {
-  description = "Neptune Analytics endpoint for production Brain tier."
-  value       = var.neptune_endpoint
-}
-
-output "cognee_private_substrate_mode" {
-  description = "Whether the Brain substrate is configured as private/internal-only."
-  value       = var.private_substrate_mode
-}
-
-output "cognee_production_posture" {
-  description = "Operator evidence string for production-tier approval/readiness posture."
-  value       = var.production_posture
-}
-
-output "cognee_cluster_arn" {
-  description = "Company Brain ECS cluster ARN hosting the Cognee service"
-  value       = aws_ecs_cluster.main.arn
-}
-
-output "cognee_service_name" {
-  description = "ECS service name for Cognee"
-  value       = aws_ecs_service.cognee.name
-}
-
-output "cognee_alb_arn" {
-  description = "Internal ALB ARN for Cognee"
-  value       = aws_lb.cognee.arn
-}
-
-output "cognee_security_group_id" {
-  description = "Security group ID for the Cognee ECS task"
-  value       = aws_security_group.cognee.id
-}
-
-output "cognee_storage_file_system_id" {
-  description = "EFS file system ID backing Cognee writable data/system directories"
-  value       = aws_efs_file_system.cognee.id
-}
-
-output "cognee_db_password_secret_arn" {
-  description = "Secrets Manager ARN used for the Cognee DB password"
-  value       = local.effective_db_password_secret_arn
-}
-
-output "cognee_llm_api_key_secret_arn" {
-  description = "Secrets Manager ARN used for the optional Cognee LLM API key"
-  value       = local.effective_llm_api_key_secret_arn
-}
-
-output "cognee_embedding_api_key_secret_arn" {
-  description = "Secrets Manager ARN used for the optional Cognee embedding API key"
-  value       = local.effective_embedding_api_key_secret_arn
-}
-
-output "cognee_vector_db_key_secret_arn" {
-  description = "Secrets Manager ARN used for the optional Cognee vector store key"
-  value       = local.effective_vector_db_key_secret_arn
-}
-
-output "cognee_graph_database_password_secret_arn" {
-  description = "Secrets Manager ARN used for the optional Cognee graph store password"
-  value       = local.effective_graph_database_password_secret_arn
-}

package/dist/plugins/company-brain/terraform/cognee/variables.tf

@@ -1,402 +0,0 @@
-variable "stage" {
-  description = "Deployment stage (e.g. dev, prod)"
-  type        = string
-}
-
-variable "vpc_id" {
-  description = "VPC ID for Cognee networking"
-  type        = string
-}
-
-variable "subnet_ids" {
-  description = "Public subnet IDs for the Cognee ECS task and internal ALB. Public subnets provide outbound egress in phase 1; the ALB remains internal."
-  type        = list(string)
-}
-
-variable "db_security_group_id" {
-  description = "Security group ID for the shared PostgreSQL database"
-  type        = string
-}
-
-variable "db_host" {
-  description = "PostgreSQL host for Cognee metadata storage"
-  type        = string
-}
-
-variable "db_port" {
-  description = "PostgreSQL port for Cognee metadata storage"
-  type        = number
-  default     = 5432
-}
-
-variable "db_name" {
-  description = "PostgreSQL database name for Cognee metadata storage"
-  type        = string
-  default     = "thinkwork"
-}
-
-variable "db_username" {
-  description = "Dedicated PostgreSQL username for Cognee metadata storage. Do not use the shared Aurora admin/master user."
-  type        = string
-
-  validation {
-    condition     = !contains(["postgres", "thinkwork_admin", "rdsadmin"], lower(var.db_username))
-    error_message = "db_username must be a dedicated least-privilege Cognee database user, not the shared admin/master user."
-  }
-}
-
-variable "db_password_secret_arn" {
-  description = "Secrets Manager ARN containing a JSON password field for the Cognee PostgreSQL user. Leave empty only when create_secret_placeholders = true."
-  type        = string
-  default     = ""
-}
-
-variable "create_secret_placeholders" {
-  description = "Create operator-owned Secrets Manager placeholder containers for missing Cognee secrets. Secret values are seeded with placeholders and ignored after creation so rotation survives Terraform applies."
-  type        = bool
-  default     = false
-}
-
-variable "allowed_internal_cidr_blocks" {
-  description = "CIDR blocks allowed to reach the internal Cognee ALB. Leave empty to create the endpoint without caller ingress."
-  type        = list(string)
-  default     = []
-
-  validation {
-    condition = alltrue([
-      for cidr in var.allowed_internal_cidr_blocks :
-      cidr != "0.0.0.0/0" && cidr != "::/0"
-    ])
-    error_message = "allowed_internal_cidr_blocks must not include all-network CIDRs such as 0.0.0.0/0 or ::/0."
-  }
-}
-
-variable "allowed_internal_security_group_ids" {
-  description = "Security group IDs allowed to reach the internal Cognee ALB"
-  type        = list(string)
-  default     = []
-}
-
-variable "image_uri" {
-  description = "Cognee container image URI pinned to a reviewed immutable digest."
-  type        = string
-
-  validation {
-    condition     = can(regex("@sha256:[0-9a-f]{64}$", var.image_uri))
-    error_message = "image_uri must be pinned to an immutable sha256 image digest."
-  }
-}
-
-variable "cpu" {
-  description = "Fargate task CPU units"
-  type        = number
-  default     = 2048
-}
-
-variable "memory" {
-  description = "Fargate task memory in MB. 2048 OOM-crashed the dogfood task during cognify (Kuzu graph + LanceDB vectors + embedding/LLM client + extraction pipeline in one task); 8192 gives the single-task pipeline real headroom. Valid Fargate combo with cpu=2048 (4096-16384 MB)."
-  type        = number
-  default     = 8192
-}
-
-variable "desired_count" {
-  description = "Desired number of Cognee ECS tasks. Dogfood/local backend mode must stay single-task."
-  type        = number
-  default     = 1
-}
-
-variable "brain_tenant_id" {
-  description = "Tenant ID for a tenant-scoped Company Brain substrate instance. Empty preserves the legacy stage-wide Cognee resource names."
-  type        = string
-  default     = ""
-}
-
-variable "brain_instance_key" {
-  description = "Stable tenant-scoped Brain instance key used to derive resource names. Empty falls back to brain_tenant_id, and both empty preserve legacy stage-wide names."
-  type        = string
-  default     = ""
-
-  validation {
-    condition     = var.brain_instance_key == "" || can(regex("^[A-Za-z0-9][A-Za-z0-9_-]{0,47}$", var.brain_instance_key))
-    error_message = "brain_instance_key must be empty or a stable 1-48 character alphanumeric, underscore, or dash key."
-  }
-}
-
-variable "brain_storage_tier" {
-  description = "Company Brain storage tier: default uses local LanceDB/Kuzu-style stores; production uses Neptune Analytics graph/vector providers."
-  type        = string
-  default     = "default"
-
-  validation {
-    condition     = contains(["default", "production"], var.brain_storage_tier)
-    error_message = "brain_storage_tier must be default or production."
-  }
-}
-
-variable "brain_s3_artifact_root" {
-  description = "Canonical Company Brain S3 root URI for source artifacts. Used as runner/status evidence; S3 is the replay source of truth."
-  type        = string
-  default     = ""
-}
-
-variable "brain_s3_manifest_root" {
-  description = "Canonical Company Brain S3 root URI for ingestion manifests."
-  type        = string
-  default     = ""
-}
-
-variable "brain_s3_vault_projection_root" {
-  description = "Canonical Company Brain S3 root URI for vault/materialized projections."
-  type        = string
-  default     = ""
-}
-
-variable "brain_artifacts_bucket_arn" {
-  description = "Optional S3 bucket ARN for canonical Brain artifacts. When set with brain_artifacts_prefixes, the task role receives scoped object access."
-  type        = string
-  default     = ""
-}
-
-variable "brain_artifacts_prefixes" {
-  description = "Tenant/stage prefixes inside brain_artifacts_bucket_arn the Brain task may access."
-  type        = list(string)
-  default     = []
-}
-
-variable "private_substrate_mode" {
-  description = "Whether the Brain substrate is private/internal-only. Public substrate mode is intentionally unsupported for Company Brain."
-  type        = bool
-  default     = true
-}
-
-variable "require_authentication" {
-  description = "Passed to Cognee REQUIRE_AUTHENTICATION. Defaults false for current internal ALB compatibility; Company Brain can set true when the runtime supports it."
-  type        = bool
-  default     = false
-}
-
-variable "enable_backend_access_control" {
-  description = "Passed to Cognee ENABLE_BACKEND_ACCESS_CONTROL for private-substrate hardening."
-  type        = bool
-  default     = false
-}
-
-variable "cors_allowed_origins" {
-  description = "Passed to Cognee CORS_ALLOWED_ORIGINS. Keep empty for internal-only Company Brain substrate."
-  type        = string
-  default     = ""
-}
-
-variable "cpu_architecture" {
-  description = "Fargate CPU architecture for the Cognee task"
-  type        = string
-  default     = "X86_64"
-
-  validation {
-    condition     = contains(["X86_64", "ARM64"], var.cpu_architecture)
-    error_message = "cpu_architecture must be X86_64 or ARM64."
-  }
-}
-
-variable "container_port" {
-  description = "Cognee API container port"
-  type        = number
-  default     = 8000
-}
-
-variable "health_check_path" {
-  description = "HTTP path used by ALB health checks"
-  type        = string
-  default     = "/health"
-}
-
-variable "health_check_grace_period_seconds" {
-  description = "Seconds ECS ignores failing load balancer health checks while Cognee starts"
-  type        = number
-  default     = 300
-}
-
-variable "wait_for_steady_state" {
-  description = "Whether Terraform waits for the Cognee ECS service to reach steady state"
-  type        = bool
-  default     = true
-}
-
-variable "enable_execute_command" {
-  description = "Enable `aws ecs execute-command` into the Cognee container (and grant the SSM-messages channel on the task role). The dogfood Cognee ALB is VPC-internal, so exec is the only way to introspect its store/API directly. Defaults on for the current dogfood/dev deployment; set false for hardened multi-tenant production."
-  type        = bool
-  default     = true
-}
-
-variable "log_retention_days" {
-  description = "CloudWatch log retention for the Cognee service"
-  type        = number
-  default     = 14
-}
-
-variable "backend_mode" {
-  description = "Cognee backend mode. dogfood uses local graph/vector paths on EFS; remote requires remote graph/vector URLs."
-  type        = string
-  default     = "dogfood"
-
-  validation {
-    condition     = contains(["dogfood", "remote"], var.backend_mode)
-    error_message = "backend_mode must be dogfood or remote."
-  }
-}
-
-variable "llm_provider" {
-  description = "Cognee LLM provider"
-  type        = string
-  default     = "bedrock"
-}
-
-variable "llm_model" {
-  description = "Cognee LLM model"
-  type        = string
-  default     = "bedrock/amazon.nova-lite-v1:0"
-}
-
-variable "llm_api_key_secret_arn" {
-  description = "Optional Secrets Manager ARN for non-Bedrock LLM provider API key"
-  type        = string
-  default     = ""
-}
-
-variable "embedding_provider" {
-  description = "Cognee embedding provider"
-  type        = string
-  default     = "bedrock"
-}
-
-variable "embedding_model" {
-  description = "Cognee embedding model"
-  type        = string
-  default     = "amazon.titan-embed-text-v2:0"
-}
-
-variable "embedding_dimensions" {
-  description = "Embedding vector dimensions. Must match the selected vector store."
-  type        = number
-  default     = 1024
-}
-
-variable "embedding_api_key_secret_arn" {
-  description = "Optional Secrets Manager ARN for non-Bedrock embedding provider API key"
-  type        = string
-  default     = ""
-}
-
-variable "embedding_max_completion_tokens" {
-  description = "Optional embedding max token setting for Cognee"
-  type        = string
-  default     = ""
-}
-
-variable "vector_db_provider" {
-  description = "Cognee vector store provider"
-  type        = string
-  default     = "lancedb"
-}
-
-variable "vector_db_url" {
-  description = "Cognee vector store URL. Leave empty in dogfood mode to use the EFS-backed local default."
-  type        = string
-  default     = ""
-
-  validation {
-    condition = (
-      var.vector_db_url == "" ||
-      (
-        !can(regex("://[^/?#]*@", var.vector_db_url)) &&
-        !can(regex("[?&][^=]*(token|key|secret|password|pass)[^=]*=", lower(var.vector_db_url)))
-      )
-    )
-    error_message = "vector_db_url must not embed credentials; use vector_db_key_secret_arn for secrets."
-  }
-}
-
-variable "vector_db_key_secret_arn" {
-  description = "Optional Secrets Manager ARN for a remote vector store key"
-  type        = string
-  default     = ""
-}
-
-variable "graph_database_provider" {
-  description = "Cognee graph store provider"
-  type        = string
-  default     = "kuzu"
-}
-
-variable "graph_database_url" {
-  description = "Cognee graph store URL. Leave empty in dogfood mode to use the EFS-backed local Kuzu default."
-  type        = string
-  default     = ""
-
-  validation {
-    condition = (
-      var.graph_database_url == "" ||
-      (
-        !can(regex("://[^/?#]*@", var.graph_database_url)) &&
-        !can(regex("[?&][^=]*(token|key|secret|password|pass)[^=]*=", lower(var.graph_database_url)))
-      )
-    )
-    error_message = "graph_database_url must not embed credentials; use graph_database_password_secret_arn for secrets."
-  }
-}
-
-variable "graph_database_username" {
-  description = "Optional Cognee graph store username"
-  type        = string
-  default     = ""
-}
-
-variable "graph_database_password_secret_arn" {
-  description = "Optional Secrets Manager ARN for a remote graph store password"
-  type        = string
-  default     = ""
-}
-
-variable "neptune_graph_id" {
-  description = "Neptune Analytics graph ID used by the production Brain tier."
-  type        = string
-  default     = ""
-}
-
-variable "neptune_graph_arn" {
-  description = "Optional Neptune Analytics graph ARN. When set, the task role receives scoped Neptune graph query access."
-  type        = string
-  default     = ""
-}
-
-variable "neptune_endpoint" {
-  description = "Neptune Analytics endpoint used by the production Brain tier."
-  type        = string
-  default     = ""
-}
-
-variable "production_posture" {
-  description = "Operator evidence string for production-tier approval/readiness posture."
-  type        = string
-  default     = ""
-}
-
-variable "bedrock_model_resource_arns" {
-  description = "Explicit Bedrock model ARNs Cognee may invoke when a Bedrock LLM or embedding provider is selected."
-  type        = list(string)
-  default     = []
-
-  validation {
-    condition = alltrue([
-      for arn in var.bedrock_model_resource_arns :
-      arn != "*" && !can(regex("\\*", arn))
-    ])
-    error_message = "bedrock_model_resource_arns must list explicit model or inference-profile ARNs, not wildcards."
-  }
-}
-
-variable "kms_key_arns" {
-  description = "Optional KMS key ARNs needed to decrypt injected secrets"
-  type        = list(string)
-  default     = []
-}