thinkwork-cli 0.12.16 → 0.13.0

package/dist/drizzle/0231_cost_events_cache_write_enforcement_exempt.sql

@@ -0,0 +1,11 @@
+-- THINK-245: cache-write token capture + budget-grace flag on cost_events.
+-- Hand-rolled (db:generate blocked by an unrelated interactive rename prompt);
+-- apply with: psql "$DATABASE_URL" -f this file. Idempotent.
+-- creates-column: public.cost_events.cached_write_tokens
+-- creates-column: public.cost_events.enforcement_exempt
+
+ALTER TABLE "cost_events"
+  ADD COLUMN IF NOT EXISTS "cached_write_tokens" integer;
+
+ALTER TABLE "cost_events"
+  ADD COLUMN IF NOT EXISTS "enforcement_exempt" boolean NOT NULL DEFAULT false;

package/dist/plugins/catalog/package.json

@@ -21,7 +21,6 @@
     "build:catalog": "tsx scripts/generate-plugin-registry.ts --check && tsx scripts/build-catalog.ts"
   },
   "dependencies": {
-    "@thinkwork/plugin-company-brain": "workspace:*",
     "@thinkwork/plugin-company-data": "workspace:*",
     "@thinkwork/plugin-company-etl": "workspace:*",
     "@thinkwork/plugin-email-channel": "workspace:*",

package/dist/plugins/catalog/src/__tests__/build-catalog.test.ts

@@ -37,7 +37,6 @@ describe("buildSignedCatalogJson", () => {
       "n8n",
       "email-channel",
       "sendgrid",
-      "company-brain",
       "company-data",
       "company-etl",
       "twenty",

package/dist/plugins/catalog/src/__tests__/catalog.test.ts

@@ -13,7 +13,8 @@ import {
   verifyPluginCatalog,
   type SignedPluginCatalogDocument,
 } from "../catalog";
-import { companyBrainManifest, lastmileManifest } from "../registry";
+import type { PluginManifest } from "../contracts";
+import { lastmileManifest, n8nManifest } from "../registry";
 
 function keyPair() {
   const pair = generateKeyPairSync("ed25519");
@@ -95,23 +96,30 @@ describe("buildPluginCatalog", () => {
 
   it("sorts catalog plugins alphabetically by display name", () => {
     const catalog = buildPluginCatalog({
-      manifests: [lastmileManifest, companyBrainManifest],
+      manifests: [n8nManifest, lastmileManifest],
     });
 
     expect(catalog.plugins.map((plugin) => plugin.displayName)).toEqual([
       "LastMile",
-      "ThinkWork Brain",
+      "n8n",
     ]);
   });
 
   it("preserves premium metadata on catalog entries", () => {
-    const catalog = buildPluginCatalog({ manifests: [companyBrainManifest] });
-    expect(catalog.plugins[0].pluginKey).toBe("company-brain");
+    const premiumManifest: PluginManifest = {
+      ...lastmileManifest,
+      premium: {
+        entitlementProductKey: "lastmile-premium",
+        installKeyRequired: true,
+        installKeyPrompt: "Enter the install key.",
+      },
+    };
+    const catalog = buildPluginCatalog({ manifests: [premiumManifest] });
+    expect(catalog.plugins[0].pluginKey).toBe("lastmile");
     expect(catalog.plugins[0].premium).toEqual({
-      entitlementProductKey: "company-brain",
+      entitlementProductKey: "lastmile-premium",
       installKeyRequired: true,
-      installKeyPrompt:
-        "Enter the ThinkWork Brain install key provided by ThinkWork to unlock this premium plugin for your tenant.",
+      installKeyPrompt: "Enter the install key.",
     });
   });
 

package/dist/plugins/catalog/src/__tests__/contracts.test.ts

@@ -284,6 +284,62 @@ describe("validatePluginManifest", () => {
     expect(validatedServer.recordLinkHints).toEqual(server.recordLinkHints);
   });
 
+  it("accepts provider-neutral MCP result transforms", () => {
+    const ok = manifest();
+    const server = version(ok).components[0];
+    if (server.type !== "mcp-server") throw new Error("missing mcp-server");
+    (server as unknown as Record<string, unknown>).resultTransforms = [
+      {
+        type: "scaled-integer-to-decimal",
+        sourceField: "amountMicros",
+        targetField: "value",
+        scale: 6,
+        removeSource: true,
+      },
+    ];
+
+    const validated = validatePluginManifest(ok);
+    const validatedServer = validated.versions[0].components[0];
+    if (validatedServer.type !== "mcp-server") {
+      throw new Error("expected mcp-server");
+    }
+    expect(
+      (validatedServer as unknown as Record<string, unknown>).resultTransforms,
+    ).toEqual((server as unknown as Record<string, unknown>).resultTransforms);
+  });
+
+  it("rejects unsafe or unbounded MCP result transforms", () => {
+    for (const transform of [
+      {
+        type: "unknown-transform",
+        sourceField: "amountMicros",
+        targetField: "value",
+        scale: 6,
+      },
+      {
+        type: "scaled-integer-to-decimal",
+        sourceField: "auth.token",
+        targetField: "value",
+        scale: 6,
+      },
+      {
+        type: "scaled-integer-to-decimal",
+        sourceField: "amountMicros",
+        targetField: "value",
+        scale: 100,
+      },
+    ]) {
+      const bad = manifest();
+      const server = version(bad).components[0];
+      if (server.type !== "mcp-server") throw new Error("missing mcp-server");
+      (server as unknown as Record<string, unknown>).resultTransforms = [
+        transform,
+      ];
+
+      expect(() => validatePluginManifest(bad)).toThrow(/resultTransforms/);
+    }
+  });
+
   it("rejects unsafe MCP record-link route templates", () => {
     for (const routeTemplate of [
       "https://crm.example.com/object/opportunity/{id}",

package/dist/plugins/catalog/src/__tests__/plugin-package.test.ts

@@ -13,7 +13,6 @@ import {
 describe("first-party plugin packages", () => {
   it("registers n8n from its root plugin package boundary", () => {
     expect(firstPartyPluginPackages.map((entry) => entry.packageKey)).toEqual([
-      "company-brain",
       "company-data",
       "company-etl",
       "email-channel",
@@ -51,7 +50,6 @@ describe("first-party plugin packages", () => {
       "n8n",
       "email-channel",
       "sendgrid",
-      "company-brain",
       "company-data",
       "company-etl",
       "twenty",

package/dist/plugins/catalog/src/__tests__/plugin-registry.test.ts

@@ -18,11 +18,6 @@ describe("generated first-party plugin registry", () => {
         exportName: entry.exportName,
       })),
     ).toEqual([
-      {
-        packageKey: "company-brain",
-        packageName: "@thinkwork/plugin-company-brain",
-        exportName: "companyBrainPluginPackage",
-      },
       {
         packageKey: "company-data",
         packageName: "@thinkwork/plugin-company-data",

package/dist/plugins/catalog/src/contracts.ts

@@ -181,6 +181,21 @@ export interface McpRecordLinkHints {
   workspace?: McpRecordLinkWorkspaceHint;
 }
 
+/** Provider-neutral, declarative transformation applied to successful MCP results. */
+export interface McpScaledIntegerToDecimalTransform {
+  type: "scaled-integer-to-decimal";
+  /** Object field containing an integer encoded in the provider's base unit. */
+  sourceField: string;
+  /** Sibling field receiving the exact decimal string. */
+  targetField: string;
+  /** Number of base-10 fractional digits in the source integer. */
+  scale: number;
+  /** Drop the provider-specific source field after a successful conversion. */
+  removeSource?: boolean;
+}
+
+export type McpResultTransform = McpScaledIntegerToDecimalTransform;
+
 export interface McpServerComponent {
   type: "mcp-server";
   key: string;
@@ -193,6 +208,8 @@ export interface McpServerComponent {
   auth: McpServerAuth;
   /** Optional non-secret hints for generating links from trusted MCP results. */
   recordLinkHints?: McpRecordLinkHints;
+  /** Optional provider-owned, data-only normalization rules for tool results. */
+  resultTransforms?: McpResultTransform[];
   /** Optional human notes about the tools the server exposes. */
   toolNotes?: string[];
 }
@@ -697,6 +714,9 @@ function validateMcpServerComponent(
   if (component.recordLinkHints !== undefined) {
     validateRecordLinkHints(component.recordLinkHints, prefix);
   }
+  if (component.resultTransforms !== undefined) {
+    validateMcpResultTransforms(component.resultTransforms, prefix);
+  }
   if (component.toolNotes !== undefined) {
     if (
       !Array.isArray(component.toolNotes) ||
@@ -746,6 +766,14 @@ function validateMcpServerComponent(
 }
 
 const RECORD_LINK_FIELD_RE = /^[A-Za-z][A-Za-z0-9_.-]{0,127}$/;
+const RESULT_TRANSFORM_FIELD_RE = /^[A-Za-z][A-Za-z0-9_-]{0,63}$/;
+const RESULT_TRANSFORM_ALLOWED_KEYS = [
+  "type",
+  "sourceField",
+  "targetField",
+  "scale",
+  "removeSource",
+] as const;
 const RECORD_LINK_ALLOWED_HINT_KEYS = [
   "schemaVersion",
   "source",
@@ -771,6 +799,90 @@ const RECORD_LINK_FORBIDDEN_FIELD_PARTS = [
   "header",
 ] as const;
 
+function validateMcpResultTransforms(
+  transforms: McpResultTransform[],
+  prefix: string,
+): void {
+  const label = `${prefix}.resultTransforms`;
+  if (
+    !Array.isArray(transforms) ||
+    transforms.length === 0 ||
+    transforms.length > 8
+  ) {
+    throw new PluginManifestError(`${label} must contain 1–8 transforms`);
+  }
+  const seenTargets = new Set<string>();
+  for (const [index, transform] of transforms.entries()) {
+    const transformLabel = `${label}[${index}]`;
+    if (
+      !transform ||
+      typeof transform !== "object" ||
+      Array.isArray(transform)
+    ) {
+      throw new PluginManifestError(`${transformLabel} must be an object`);
+    }
+    rejectUnknownKeys(
+      transform as unknown as Record<string, unknown>,
+      RESULT_TRANSFORM_ALLOWED_KEYS,
+      transformLabel,
+    );
+    if (transform.type !== "scaled-integer-to-decimal") {
+      throw new PluginManifestError(
+        `${transformLabel}.type must be "scaled-integer-to-decimal"`,
+      );
+    }
+    for (const [fieldName, fieldValue] of [
+      ["sourceField", transform.sourceField],
+      ["targetField", transform.targetField],
+    ] as const) {
+      requireString(fieldValue, `${transformLabel}.${fieldName}`);
+      if (!RESULT_TRANSFORM_FIELD_RE.test(fieldValue)) {
+        throw new PluginManifestError(
+          `${transformLabel}.${fieldName} must be a simple non-sensitive object field`,
+        );
+      }
+      const normalized = fieldValue.toLowerCase();
+      if (
+        RECORD_LINK_FORBIDDEN_FIELD_PARTS.some((part) =>
+          normalized.includes(part),
+        )
+      ) {
+        throw new PluginManifestError(
+          `${transformLabel}.${fieldName} must not be credential-shaped`,
+        );
+      }
+    }
+    if (transform.sourceField === transform.targetField) {
+      throw new PluginManifestError(
+        `${transformLabel}.targetField must differ from sourceField`,
+      );
+    }
+    if (
+      !Number.isInteger(transform.scale) ||
+      transform.scale < 0 ||
+      transform.scale > 12
+    ) {
+      throw new PluginManifestError(
+        `${transformLabel}.scale must be an integer from 0 through 12`,
+      );
+    }
+    if (
+      transform.removeSource !== undefined &&
+      typeof transform.removeSource !== "boolean"
+    ) {
+      throw new PluginManifestError(
+        `${transformLabel}.removeSource must be a boolean`,
+      );
+    }
+    if (seenTargets.has(transform.targetField)) {
+      throw new PluginManifestError(
+        `${label} declares duplicate targetField "${transform.targetField}"`,
+      );
+    }
+    seenTargets.add(transform.targetField);
+  }
+}
+
 function validateRecordLinkHints(
   hints: Partial<McpRecordLinkHints>,
   prefix: string,

package/dist/plugins/catalog/src/registry/generated-first-party.ts

@@ -3,7 +3,6 @@
 //   pnpm --filter @thinkwork/plugin-catalog generate:plugins
 
 import { defineFirstPartyPluginPackage } from "../plugin-package";
-import { companyBrainPluginPackage as rawCompanyBrainPluginPackage } from "@thinkwork/plugin-company-brain";
 import { companyDataPluginPackage as rawCompanyDataPluginPackage } from "@thinkwork/plugin-company-data";
 import { companyEtlPluginPackage as rawCompanyEtlPluginPackage } from "@thinkwork/plugin-company-etl";
 import { emailChannelPluginPackage as rawEmailChannelPluginPackage } from "@thinkwork/plugin-email-channel";
@@ -13,9 +12,6 @@ import { sendgridPluginPackage as rawSendgridPluginPackage } from "@thinkwork/pl
 import { twentyPluginPackage as rawTwentyPluginPackage } from "@thinkwork/plugin-twenty";
 import { workosAuthPluginPackage as rawWorkosAuthPluginPackage } from "@thinkwork/plugin-workos-auth";
 
-export const companyBrainPluginPackage = defineFirstPartyPluginPackage(
-  rawCompanyBrainPluginPackage,
-);
 export const companyDataPluginPackage = defineFirstPartyPluginPackage(
   rawCompanyDataPluginPackage,
 );
@@ -41,7 +37,6 @@ export const workosAuthPluginPackage = defineFirstPartyPluginPackage(
   rawWorkosAuthPluginPackage,
 );
 
-export const companyBrainManifest = companyBrainPluginPackage.manifest;
 export const companyDataManifest = companyDataPluginPackage.manifest;
 export const companyEtlManifest = companyEtlPluginPackage.manifest;
 export const emailChannelManifest = emailChannelPluginPackage.manifest;
@@ -52,7 +47,6 @@ export const twentyManifest = twentyPluginPackage.manifest;
 export const workosAuthManifest = workosAuthPluginPackage.manifest;
 
 export const firstPartyPluginPackages = [
-  companyBrainPluginPackage,
   companyDataPluginPackage,
   companyEtlPluginPackage,
   emailChannelPluginPackage,

package/dist/plugins/n8n/README.md

@@ -91,42 +91,10 @@ activate, publish, delete, retry, or stop.
    workflow, project, or folder that agents may inspect.
 6. Assign the `n8n--workflow-management` MCP server to the appropriate
    ThinkWork agent.
-7. For n8n-to-ThinkWork agent steps, configure the separate
-   `agentStepBridgeCredentialSecretArn` managed-app input. Do not reuse the
-   native n8n MCP service credential; MCP auth lets ThinkWork agents call n8n,
-   while the bridge credential lets n8n workflows call ThinkWork.
-
-## Agent-Step Bridge Recipe
-
-The v1 bridge is webhook-first and node-later. Workflow authors should build
-with stock n8n nodes:
-
-1. A Webhook or other trigger starts the n8n execution.
-2. An HTTP Request node posts to ThinkWork
-   `/api/integrations/n8n/agent-steps` with the bridge bearer credential,
-   target `spaceId`, `agentId`, instructions, structured `input`,
-   `workflowId`, `executionId`, `stepId`, `correlationId`, and the current
-   n8n Wait resume URL.
-3. A Wait node pauses the execution with the On webhook call resume mode. n8n
-   exposes the per-execution resume URL as `$execution.resumeUrl`; pass that
-   value to ThinkWork as `resumeUrl`.
-4. ThinkWork creates or reuses the visible Space thread, dispatches the agent,
-   holds for human input inside ThinkWork when needed, and later calls the n8n
-   waiting-webhook URL with structured JSON.
-5. Downstream n8n nodes branch on `status` and read `output`, `error`,
-   `summary`, and `links`. They should not scrape the ThinkWork thread page.
-
-The idempotency key is derived from tenant, workflow id, execution id,
-correlation id, and step id. Retrying the same HTTP Request for the same n8n
-execution and bridge step should recover or replay the existing bridge run
-rather than creating duplicate ThinkWork threads. If a run expires, n8n resumes
-with a structured `expired` result so the workflow can branch explicitly.
-
-Operator runbook details live in the docs site:
-
-- `docs/runbooks/n8n-thinkwork-native-app-install.md`
-- `docs/src/content/docs/applications/n8n.mdx`
-- `docs/src/content/docs/applications/n8n-agent-step-bridge.mdx`
+
+The former n8n→ThinkWork agent-step bridge was retired with the canonical
+workflow model (THINK-217): n8n workflows now call the generic ThinkWork
+workflow webhook endpoints instead.
 
 ## Verification
 

package/dist/plugins/n8n/src/deployment/managed-app.ts

@@ -52,7 +52,6 @@ const statusOutputs = [
   "n8n_image_digest",
   "n8n_package_config_digest",
   "n8n_service_credential_secret_arn",
-  "n8n_agent_step_bridge_credential_secret_arn",
 ] as const;
 
 const DEFAULT_DATABASE_NAME = "thinkwork_n8n";
@@ -98,13 +97,6 @@ const provisionRequiredInputs: RequiredManagedAppInput[] = [
     terraformVariable: "n8n_service_credential_secret_arn",
     secret: true,
   },
-  {
-    key: "agentStepBridgeCredentialSecretArn",
-    description:
-      "Secrets Manager ARN containing the inbound credential used by n8n workflows to call the ThinkWork agent-step bridge.",
-    terraformVariable: "n8n_agent_step_bridge_credential_secret_arn",
-    secret: true,
-  },
   {
     key: "storageBucketName",
     description: "S3 bucket name used for n8n binary data and runtime files.",
@@ -209,11 +201,6 @@ export const n8nAdapter: ManagedAppAdapter = {
         "serviceCredentialSecretArn",
         "n8n serviceCredentialSecretArn",
       ),
-      n8n_agent_step_bridge_credential_secret_arn: requireStringInput(
-        desiredConfig,
-        "agentStepBridgeCredentialSecretArn",
-        "n8n agentStepBridgeCredentialSecretArn",
-      ),
       n8n_storage_bucket_name: requireStringInput(
         desiredConfig,
         "storageBucketName",
@@ -399,10 +386,6 @@ export const n8nAdapter: ManagedAppAdapter = {
           terraformOutputs,
           "n8n_service_credential_secret_arn",
         ),
-        agentStepBridgeCredentialSecretArn: stringOutput(
-          terraformOutputs,
-          "n8n_agent_step_bridge_credential_secret_arn",
-        ),
       },
     };
   },

package/dist/plugins/n8n/src/manifest.ts

@@ -271,11 +271,6 @@ const N8N_INFRA_COMPONENT: InfrastructureComponent = {
         "Secrets Manager ARN containing the tenant service credential used by the native n8n MCP integration.",
       type: "string",
     },
-    agentStepBridgeCredentialSecretArn: {
-      description:
-        "Secrets Manager ARN containing the inbound credential used by n8n workflows to call the ThinkWork agent-step bridge.",
-      type: "string",
-    },
     storageBucketName: {
       description: "S3 bucket name used for n8n binary data and runtime files.",
       type: "string",

package/dist/plugins/n8n/terraform/n8n/main.tf

@@ -74,14 +74,6 @@ locals {
         N8N_MCP_SERVICE_CREDENTIAL = random_password.service_credential.result
       })
     }
-    agent_step_bridge_credential = {
-      enabled     = var.create_secret_placeholders && var.agent_step_bridge_credential_secret_arn == ""
-      name        = "thinkwork/${var.stage}/n8n/agent-step-bridge-credential"
-      description = "Inbound credential used by n8n workflows to call the ThinkWork agent-step bridge"
-      secret_string = jsonencode({
-        THINKWORK_N8N_AGENT_STEP_BRIDGE_TOKEN = random_password.agent_step_bridge_credential.result
-      })
-    }
   }
 
   managed_secrets = {
@@ -108,18 +100,11 @@ locals {
     ? var.service_credential_secret_arn
     : try(aws_secretsmanager_secret.n8n["service_credential"].arn, "")
   )
-  effective_agent_step_bridge_credential_secret_arn = (
-    var.agent_step_bridge_credential_secret_arn != ""
-    ? var.agent_step_bridge_credential_secret_arn
-    : try(aws_secretsmanager_secret.n8n["agent_step_bridge_credential"].arn, "")
-  )
-
   secret_arns = compact([
     local.effective_database_url_secret_arn,
     local.effective_encryption_key_secret_arn,
     local.effective_operator_secret_arn,
     local.effective_service_credential_secret_arn,
-    local.effective_agent_step_bridge_credential_secret_arn,
   ])
 
   base_environment = concat(
@@ -199,11 +184,6 @@ resource "random_password" "service_credential" {
   special = false
 }
 
-resource "random_password" "agent_step_bridge_credential" {
-  length  = 48
-  special = false
-}
-
 resource "aws_secretsmanager_secret" "n8n" {
   for_each = local.managed_secrets
 
@@ -325,7 +305,6 @@ resource "terraform_data" "configuration_guardrails" {
     encryption_key_secret_arn               = local.effective_encryption_key_secret_arn
     operator_secret_arn                     = local.effective_operator_secret_arn
     service_credential_secret_arn           = local.effective_service_credential_secret_arn
-    agent_step_bridge_credential_secret_arn = local.effective_agent_step_bridge_credential_secret_arn
     storage_bucket_name                     = var.storage_bucket_name
     storage_prefix                          = local.storage_prefix
     queue_mode                              = var.queue_mode
@@ -369,11 +348,6 @@ resource "terraform_data" "configuration_guardrails" {
       error_message = "n8n requires service_credential_secret_arn or create_secret_placeholders = true."
     }
 
-    precondition {
-      condition     = local.effective_agent_step_bridge_credential_secret_arn != ""
-      error_message = "n8n requires agent_step_bridge_credential_secret_arn or create_secret_placeholders = true."
-    }
-
     precondition {
       condition     = var.storage_bucket_name != ""
       error_message = "n8n requires storage_bucket_name."

package/dist/plugins/n8n/terraform/n8n/outputs.tf

@@ -83,11 +83,6 @@ output "n8n_service_credential_secret_arn" {
   value       = local.effective_service_credential_secret_arn
 }
 
-output "n8n_agent_step_bridge_credential_secret_arn" {
-  description = "Secrets Manager ARN used for the inbound n8n agent-step bridge credential."
-  value       = local.effective_agent_step_bridge_credential_secret_arn
-}
-
 output "n8n_valkey_replication_group_id" {
   description = "ElastiCache replication group ID for the n8n queue."
   value       = aws_elasticache_replication_group.n8n.id

package/dist/plugins/n8n/terraform/n8n/variables.tf

@@ -199,12 +199,6 @@ variable "service_credential_secret_arn" {
   default     = ""
 }
 
-variable "agent_step_bridge_credential_secret_arn" {
-  description = "Secrets Manager ARN containing the inbound credential used by n8n workflows to call the ThinkWork agent-step bridge."
-  type        = string
-  default     = ""
-}
-
 variable "create_secret_placeholders" {
   description = "Create operator-owned Secrets Manager placeholder containers for missing n8n secrets. Placeholder values are generated once and ignored after creation so rotation survives Terraform applies."
   type        = bool

package/dist/plugins/n8n/test/manifest.test.ts

@@ -91,7 +91,6 @@ describe("n8n plugin manifest", () => {
       "encryptionKeySecretArn",
       "operatorSecretArn",
       "serviceCredentialSecretArn",
-      "agentStepBridgeCredentialSecretArn",
       "storageBucketName",
       "publicUrl",
       "certificateArn",

package/dist/plugins/twenty/package.json

@@ -19,8 +19,13 @@
     "graphql": "^16.10.0"
   },
   "devDependencies": {
+    "@aws-sdk/client-s3": "^3.700.0",
     "@thinkwork/deployment-runner": "workspace:*",
     "@thinkwork/plugin-catalog": "workspace:*",
+    "@types/bcryptjs": "^2.4.6",
+    "@types/pg": "^8.11.0",
+    "bcryptjs": "^2.4.3",
+    "pg": "^8.13.0",
     "typescript": "^5.5.0",
     "vitest": "^2.0.0"
   }