thinkwork-cli 0.12.16 → 0.13.0

package/dist/plugins/twenty/scripts/provision-twenty-members.ts

@@ -0,0 +1,214 @@
+#!/usr/bin/env npx tsx
+/**
+ * Provision TEI's LastMile sales reps as Twenty workspace members.
+ *
+ * TEI's Twenty does not serve the auth GraphQL schema (see lib/provision-
+ * members-db.ts for the evidence), so members are written directly to Twenty's
+ * Postgres. INSERT-only, idempotent by email, one transaction per rep.
+ *
+ * Environment:
+ *   TWENTY_DATABASE_URL      Twenty's Postgres (secretsmanager thinkwork/tei-e2e/twenty/db-url)
+ *   LASTMILE_DATABASE_URL    LastMile dispatch Postgres (read-only)
+ *   TWENTY_REP_PASSWORD      Shared validation-window password. ROTATE AT CUTOVER.
+ *   TWENTY_REP_EMAIL_DOMAIN  Fallback email domain (default texasenterprises.com)
+ *   TWENTY_WORKSPACE_ID      Optional; resolved from core.workspace when single-workspace
+ *
+ * Usage:
+ *   npx tsx scripts/provision-twenty-members.ts                 # dry-run: who would be created
+ *   npx tsx scripts/provision-twenty-members.ts --apply         # create them
+ *   npx tsx scripts/provision-twenty-members.ts --apply --only me@x.com   # one rep, for proof
+ *
+ * After provisioning, re-run migrate-lastmile.ts --apply so every company and
+ * opportunity picks up its owner.
+ */
+
+import process from "node:process";
+
+import pg from "pg";
+
+import { createLastmileReader } from "./lib/lastmile-reader";
+import { deriveRepEmail } from "./lib/mappers";
+import {
+  provisionMembers,
+  type ProvisionRep,
+} from "./lib/provision-members-db";
+
+function requireEnv(name: string): string {
+  const value = process.env[name];
+  if (!value) throw new Error(`Missing required environment variable: ${name}`);
+  return value;
+}
+
+function log(message: string): void {
+  process.stderr.write(`${message}\n`);
+}
+
+interface WorkspaceContext {
+  workspaceId: string;
+  roleId: string;
+  applicationId: string;
+  workspaceSchema: string;
+}
+
+/** Read the workspace's own wiring rather than hardcode ids. */
+async function readWorkspaceContext(
+  databaseUrl: string,
+  workspaceIdOverride: string | undefined,
+): Promise<WorkspaceContext> {
+  const pool = new pg.Pool({ connectionString: databaseUrl, max: 1 });
+  try {
+    // core.workspace has no schemaName column on this version; the data
+    // schema is resolved from information_schema below.
+    const workspaces = await pool.query<{
+      id: string;
+      defaultRoleId: string | null;
+    }>(
+      `select id, "defaultRoleId" from core.workspace where "deletedAt" is null`,
+    );
+    if (workspaces.rows.length === 0) throw new Error("No workspace found.");
+    const workspace = workspaceIdOverride
+      ? workspaces.rows.find((row) => row.id === workspaceIdOverride)
+      : workspaces.rows[0];
+    if (!workspace)
+      throw new Error(`Workspace ${workspaceIdOverride} not found.`);
+    if (workspaces.rows.length > 1 && !workspaceIdOverride) {
+      throw new Error("Multiple workspaces — set TWENTY_WORKSPACE_ID.");
+    }
+    if (!workspace.defaultRoleId) {
+      throw new Error(
+        "Workspace has no defaultRoleId; refusing to guess a role.",
+      );
+    }
+
+    // Reuse the applicationId the workspace's existing roleTargets carry.
+    const roleTarget = await pool.query<{ applicationId: string }>(
+      `select "applicationId" from core."roleTarget" where "workspaceId" = $1 limit 1`,
+      [workspace.id],
+    );
+    if (roleTarget.rows.length === 0) {
+      throw new Error("No existing roleTarget to copy applicationId from.");
+    }
+
+    const schemas = await pool.query<{ schema_name: string }>(
+      `select schema_name from information_schema.schemata where schema_name like 'workspace\\_%'`,
+    );
+    if (schemas.rows.length !== 1) {
+      throw new Error(
+        `Expected exactly one workspace_* data schema, found ${schemas.rows.length}.`,
+      );
+    }
+    const schemaName = schemas.rows[0].schema_name;
+
+    return {
+      workspaceId: workspace.id,
+      roleId: workspace.defaultRoleId,
+      applicationId: roleTarget.rows[0].applicationId,
+      workspaceSchema: schemaName,
+    };
+  } finally {
+    await pool.end();
+  }
+}
+
+async function main(): Promise<void> {
+  const argv = process.argv.slice(2);
+  let apply = false;
+  let only: string | null = null;
+  for (let index = 0; index < argv.length; index += 1) {
+    const arg = argv[index];
+    if (arg === "--apply") apply = true;
+    else if (arg === "--dry-run") apply = false;
+    else if (arg === "--only") {
+      only = argv[++index] ?? null;
+      if (!only) throw new Error("--only requires an email");
+    } else throw new Error(`Unknown argument: ${arg}`);
+  }
+  const dryRun = !apply;
+
+  const twentyDbUrl = requireEnv("TWENTY_DATABASE_URL");
+  const lastmileUrl = requireEnv("LASTMILE_DATABASE_URL");
+  const password = requireEnv("TWENTY_REP_PASSWORD");
+  const emailDomain =
+    process.env.TWENTY_REP_EMAIL_DOMAIN ?? "texasenterprises.com";
+
+  const context = await readWorkspaceContext(
+    twentyDbUrl,
+    process.env.TWENTY_WORKSPACE_ID,
+  );
+  log(
+    `workspace ${context.workspaceId} schema ${context.workspaceSchema} role ${context.roleId}`,
+  );
+
+  const reader = createLastmileReader(lastmileUrl);
+  let reps: ProvisionRep[];
+  try {
+    const sourceReps = await reader.readReps();
+    const seen = new Set<string>();
+    reps = [];
+    let derived = 0;
+    for (const rep of sourceReps) {
+      if (rep.archived) continue;
+      const email =
+        rep.email ?? deriveRepEmail(rep.firstName, rep.lastName, emailDomain);
+      if (!email) continue; // house/intercompany/placeholder rows get no login
+      if (!rep.email) derived += 1;
+      // Two rep rows can share an email (a house row reusing a real address,
+      // or one person duplicated). Email is the login identity: one user.
+      if (seen.has(email)) continue;
+      seen.add(email);
+      reps.push({
+        repId: rep.id,
+        email,
+        firstName: rep.firstName,
+        lastName: rep.lastName,
+      });
+    }
+    log(
+      `reps: ${reps.length} provisionable (${derived} with derived @${emailDomain} emails), ` +
+        `${sourceReps.filter((rep) => !rep.archived).length - reps.length} unprovisionable`,
+    );
+  } finally {
+    await reader.close();
+  }
+
+  if (only) {
+    const target = only.toLowerCase();
+    reps = reps.filter((rep) => rep.email.toLowerCase() === target);
+    if (reps.length === 0) throw new Error(`--only ${only} matched no rep`);
+  }
+
+  const result = await provisionMembers({
+    databaseUrl: twentyDbUrl,
+    workspaceId: context.workspaceId,
+    roleId: context.roleId,
+    applicationId: context.applicationId,
+    workspaceSchema: context.workspaceSchema,
+    password,
+    reps,
+    dryRun,
+    log,
+  });
+
+  process.stdout.write(
+    `${JSON.stringify(
+      {
+        mode: dryRun ? "dry-run" : "apply",
+        workspaceId: context.workspaceId,
+        created: result.created,
+        existing: result.existing,
+        failed: result.failed,
+        rows: result.rows.slice(0, 200),
+      },
+      null,
+      2,
+    )}\n`,
+  );
+  if (result.failed > 0) process.exitCode = 2;
+}
+
+main().catch((error) => {
+  process.stderr.write(
+    `${error instanceof Error ? error.message : String(error)}\n`,
+  );
+  process.exit(1);
+});

package/dist/plugins/twenty/src/manifest.ts

@@ -255,5 +255,104 @@ export const twentyManifest = {
         },
       ],
     },
+    {
+      version: "0.3.1",
+      requiredOauthScopes: [],
+      components: [
+        {
+          type: "mcp-server",
+          key: "crm",
+          displayName: "Twenty CRM",
+          description:
+            "CRM records (people, companies, opportunities, notes) on the tenant's deployed Twenty instance.",
+          endpointFrom: {
+            managedApp: "twenty",
+            configKey: "publicUrl",
+            path: "/mcp",
+          },
+          auth: { mode: "oauth-per-instance" },
+          recordLinkHints: {
+            schemaVersion: 1,
+            source: "plugin-manifest",
+            routes: [
+              {
+                objectType: "opportunity",
+                routeTemplate: "/object/opportunity/{id}",
+                idFields: [
+                  "id",
+                  "opportunityId",
+                  "record.id",
+                  "opportunity.id",
+                ],
+                labelFields: [
+                  "name",
+                  "opportunityName",
+                  "record.name",
+                  "opportunity.name",
+                ],
+              },
+            ],
+          },
+          resultTransforms: [
+            {
+              type: "scaled-integer-to-decimal",
+              sourceField: "amountMicros",
+              targetField: "value",
+              scale: 6,
+              removeSource: true,
+            },
+          ],
+          toolNotes: [
+            "Twenty's MCP server exposes CRM object tools (people, companies, opportunities, tasks, notes); list tools first — the set varies by Twenty release.",
+          ],
+        },
+        {
+          type: "infrastructure",
+          key: "runtime",
+          managedAppKey: "twenty",
+          terraformInputs: {
+            imageUri: {
+              description:
+                "Twenty CRM container image URI pinned with @sha256.",
+              type: "string",
+            },
+            dbUrlSecretArn: {
+              description: "Secrets Manager ARN containing PG_DATABASE_URL.",
+              type: "string",
+            },
+            encryptionKeySecretArn: {
+              description: "Secrets Manager ARN containing ENCRYPTION_KEY.",
+              type: "string",
+            },
+            publicUrl: {
+              description: "Public HTTPS origin for Twenty CRM.",
+              type: "string",
+            },
+            certificateArn: {
+              description: "ACM certificate ARN for the public HTTPS listener.",
+              type: "string",
+            },
+          },
+        },
+        {
+          type: "ui-surface",
+          key: "client-engagement",
+          displayName: "Client Engagement",
+          intendedMount: "apps.main",
+          launch: {
+            schemaVersion: 1,
+            type: "app",
+            appKey: "twenty-client-engagement",
+            routeSegment: "client-engagement",
+            mount: "main-shell",
+            runtime: "trusted-bundled-react",
+            description:
+              "Account and opportunity engagement workspace for Twenty CRM records.",
+            icon: "layout-dashboard",
+            entitlementProductKey: "twenty-client-engagement",
+          },
+        },
+      ],
+    },
   ],
 };

package/dist/plugins/twenty/terraform/twenty/README.md

@@ -1,7 +1,7 @@
 # Twenty CRM App Module
 
 This module provisions the optional Twenty CRM managed application substrate for
-ThinkWork. It follows the Cognee optional-app shape but uses a public HTTPS ALB,
+ThinkWork. It follows the managed optional-app shape but uses a public HTTPS ALB,
 separate ECS services for the Twenty server and worker, a dedicated PostgreSQL
 database URL injected from Secrets Manager, EFS for local server storage, and
 ElastiCache for Valkey/Redis OSS.

package/dist/plugins/twenty/test/manifest.test.ts

@@ -108,6 +108,7 @@ describe("twenty plugin manifest", () => {
       "0.1.0",
       "0.2.0",
       "0.3.0",
+      "0.3.1",
     ]);
 
     const components = latestVersion(validated).components;
@@ -162,7 +163,7 @@ describe("twenty plugin manifest", () => {
         },
       ],
     });
-    expect(latestVersion(validated).version).toBe("0.3.0");
+    expect(latestVersion(validated).version).toBe("0.3.1");
     expect(latestMcp.recordLinkHints).toEqual({
       schemaVersion: 1,
       source: "plugin-manifest",
@@ -180,6 +181,15 @@ describe("twenty plugin manifest", () => {
         },
       ],
     });
+    expect(latestMcp.resultTransforms).toEqual([
+      {
+        type: "scaled-integer-to-decimal",
+        sourceField: "amountMicros",
+        targetField: "value",
+        scale: 6,
+        removeSource: true,
+      },
+    ]);
   });
 
   it("publishes a launchable Client Engagement app surface in the latest version", () => {
@@ -457,7 +467,7 @@ describe("twenty plugin manifest", () => {
       validatedTwentyManifest.versions.map(
         (version) => version.requiredOauthScopes,
       ),
-    ).toEqual([[], [], []]);
+    ).toEqual([[], [], [], []]);
     expect(() => validatePluginManifest(twentyManifest)).not.toThrow();
   });
 });