thinkwork-cli 0.12.3 → 0.12.4

package/dist/cli.js

@@ -201,7 +201,7 @@ async function ensureWorkspace(cwd, stage) {
   }
 }
 function runTerraformRaw(cwd, args) {
-  return new Promise((resolve6, reject) => {
+  return new Promise((resolve7, reject) => {
     const proc = spawn("terraform", args, {
       cwd,
       stdio: ["pipe", "pipe", "pipe"]
@@ -211,13 +211,13 @@ function runTerraformRaw(cwd, args) {
     proc.stdout.on("data", (d) => stdout += d);
     proc.stderr.on("data", (d) => stderr += d);
     proc.on("close", (code) => {
-      if (code === 0) resolve6(stdout);
+      if (code === 0) resolve7(stdout);
       else reject(new Error(`terraform ${args.join(" ")} failed (exit ${code}): ${stderr}`));
     });
   });
 }
 function runTerraform(cwd, args) {
-  return new Promise((resolve6) => {
+  return new Promise((resolve7) => {
     console.log(`
   \u2192 terraform ${args.join(" ")}
 `);
@@ -225,7 +225,7 @@ function runTerraform(cwd, args) {
       cwd,
       stdio: "inherit"
     });
-    proc.on("close", (code) => resolve6(code ?? 1));
+    proc.on("close", (code) => resolve7(code ?? 1));
   });
 }
 async function ensureInit(cwd) {
@@ -469,10 +469,10 @@ async function confirm(message) {
     input: process.stdin,
     output: process.stdout
   });
-  return new Promise((resolve6) => {
+  return new Promise((resolve7) => {
     rl.question(`${message} [y/N] `, (answer) => {
       rl.close();
-      resolve6(answer.toLowerCase() === "y" || answer.toLowerCase() === "yes");
+      resolve7(answer.toLowerCase() === "y" || answer.toLowerCase() === "yes");
     });
   });
 }
@@ -553,7 +553,7 @@ async function runPostDeployProbe(stage) {
     );
     return;
   }
-  await new Promise((resolve6) => {
+  await new Promise((resolve7) => {
     const proc = spawn2("bash", [scriptPath, "--stage", stage], {
       stdio: "inherit",
       env: process.env
@@ -564,11 +564,11 @@ async function runPostDeployProbe(stage) {
           `post-deploy probe exited ${code} \u2014 deploy not rolled back`
         );
       }
-      resolve6();
+      resolve7();
     });
     proc.on("error", (err) => {
       printWarning(`post-deploy probe spawn failed: ${err.message}`);
-      resolve6();
+      resolve7();
     });
   });
 }
@@ -1025,7 +1025,7 @@ function registerConfigCommand(program2) {
 import { spawn as spawn3 } from "child_process";
 import { resolve } from "path";
 function getTerraformOutput(cwd, key) {
-  return new Promise((resolve6, reject) => {
+  return new Promise((resolve7, reject) => {
     const proc = spawn3("terraform", ["output", "-raw", key], {
       cwd,
       stdio: ["pipe", "pipe", "pipe"]
@@ -1033,17 +1033,17 @@ function getTerraformOutput(cwd, key) {
     let stdout = "";
     proc.stdout.on("data", (d) => stdout += d);
     proc.on("close", (code) => {
-      if (code === 0) resolve6(stdout.trim());
+      if (code === 0) resolve7(stdout.trim());
       else reject(new Error(`terraform output ${key} failed (exit ${code})`));
     });
   });
 }
 function runScript(scriptPath, args) {
-  return new Promise((resolve6) => {
+  return new Promise((resolve7) => {
     const proc = spawn3("bash", [scriptPath, ...args], {
       stdio: "inherit"
     });
-    proc.on("close", (code) => resolve6(code ?? 1));
+    proc.on("close", (code) => resolve7(code ?? 1));
   });
 }
 function registerBootstrapCommand(program2) {
@@ -1418,7 +1418,7 @@ function buildAuthorizeUrl(cognito, redirectUri, state) {
   return `${cognito.domainUrl}/oauth2/authorize?${params.toString()}`;
 }
 function waitForCallbackCode(opts) {
-  return new Promise((resolve6, reject) => {
+  return new Promise((resolve7, reject) => {
     const server = createServer((req, res) => handleRequest(req, res));
     let finished = false;
     const finish = (err, code) => {
@@ -1429,7 +1429,7 @@ function waitForCallbackCode(opts) {
       closer.closeAllConnections?.();
       server.close(() => {
         if (err) reject(err);
-        else resolve6(code);
+        else resolve7(code);
       });
     };
     const timer = setTimeout(() => {
@@ -1620,10 +1620,10 @@ function escapeHtml(s) {
 // src/commands/login.ts
 function ask(prompt) {
   const rl = createInterface2({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve6) => {
+  return new Promise((resolve7) => {
     rl.question(prompt, (answer) => {
       rl.close();
-      resolve6(answer.trim());
+      resolve7(answer.trim());
     });
   });
 }
@@ -2184,10 +2184,10 @@ var __dirname = dirname3(fileURLToPath2(import.meta.url));
 function ask2(prompt, defaultVal = "") {
   const rl = createInterface3({ input: process.stdin, output: process.stdout });
   const suffix = defaultVal ? chalk8.dim(` [${defaultVal}]`) : "";
-  return new Promise((resolve6) => {
+  return new Promise((resolve7) => {
     rl.question(`  ${prompt}${suffix}: `, (answer) => {
       rl.close();
-      resolve6(answer.trim() || defaultVal);
+      resolve7(answer.trim() || defaultVal);
     });
   });
 }
@@ -3923,7 +3923,7 @@ function registerUpdateCommand(program2) {
 import { spawn as spawn5 } from "child_process";
 import { input as input2, select as select7 } from "@inquirer/prompts";
 function getTerraformOutput2(cwd, key) {
-  return new Promise((resolve6, reject) => {
+  return new Promise((resolve7, reject) => {
     const proc = spawn5("terraform", ["output", "-raw", key], {
       cwd,
       stdio: ["pipe", "pipe", "pipe"]
@@ -3933,7 +3933,7 @@ function getTerraformOutput2(cwd, key) {
     proc.stdout.on("data", (d) => stdout += d);
     proc.stderr.on("data", (d) => stderr += d);
     proc.on("close", (code) => {
-      if (code === 0) resolve6(stdout.trim());
+      if (code === 0) resolve7(stdout.trim());
       else
         reject(
           new Error(
@@ -3944,7 +3944,7 @@ function getTerraformOutput2(cwd, key) {
   });
 }
 function runAwsCognitoReset(userPoolId, username, region) {
-  return new Promise((resolve6) => {
+  return new Promise((resolve7) => {
     const args = [
       "cognito-idp",
       "admin-reset-user-password",
@@ -3961,7 +3961,7 @@ function runAwsCognitoReset(userPoolId, username, region) {
     let stderr = "";
     proc.stdout.on("data", (d) => stdout += d);
     proc.stderr.on("data", (d) => stderr += d);
-    proc.on("close", (code) => resolve6({ code: code ?? 1, stdout, stderr }));
+    proc.on("close", (code) => resolve7({ code: code ?? 1, stdout, stderr }));
   });
 }
 function requireTty2(label) {
@@ -4701,6 +4701,7 @@ var CliCreateWebhookDocument = { "kind": "Document", "definitions": [{ "kind": "
 var CliUpdateWebhookDocument = { "kind": "Document", "definitions": [{ "kind": "OperationDefinition", "operation": "mutation", "name": { "kind": "Name", "value": "CliUpdateWebhook" }, "variableDefinitions": [{ "kind": "VariableDefinition", "variable": { "kind": "Variable", "name": { "kind": "Name", "value": "id" } }, "type": { "kind": "NonNullType", "type": { "kind": "NamedType", "name": { "kind": "Name", "value": "ID" } } } }, { "kind": "VariableDefinition", "variable": { "kind": "Variable", "name": { "kind": "Name", "value": "input" } }, "type": { "kind": "NonNullType", "type": { "kind": "NamedType", "name": { "kind": "Name", "value": "UpdateWebhookInput" } } } }], "selectionSet": { "kind": "SelectionSet", "selections": [{ "kind": "Field", "name": { "kind": "Name", "value": "updateWebhook" }, "arguments": [{ "kind": "Argument", "name": { "kind": "Name", "value": "id" }, "value": { "kind": "Variable", "name": { "kind": "Name", "value": "id" } } }, { "kind": "Argument", "name": { "kind": "Name", "value": "input" }, "value": { "kind": "Variable", "name": { "kind": "Name", "value": "input" } } }], "selectionSet": { "kind": "SelectionSet", "selections": [{ "kind": "Field", "name": { "kind": "Name", "value": "id" } }, { "kind": "Field", "name": { "kind": "Name", "value": "name" } }, { "kind": "Field", "name": { "kind": "Name", "value": "targetType" } }, { "kind": "Field", "name": { "kind": "Name", "value": "enabled" } }, { "kind": "Field", "name": { "kind": "Name", "value": "rateLimit" } }] } }] } }] };
 var CliDeleteWebhookDocument = { "kind": "Document", "definitions": [{ "kind": "OperationDefinition", "operation": "mutation", "name": { "kind": "Name", "value": "CliDeleteWebhook" }, "variableDefinitions": [{ "kind": "VariableDefinition", "variable": { "kind": "Variable", "name": { "kind": "Name", "value": "id" } }, "type": { "kind": "NonNullType", "type": { "kind": "NamedType", "name": { "kind": "Name", "value": "ID" } } } }], "selectionSet": { "kind": "SelectionSet", "selections": [{ "kind": "Field", "name": { "kind": "Name", "value": "deleteWebhook" }, "arguments": [{ "kind": "Argument", "name": { "kind": "Name", "value": "id" }, "value": { "kind": "Variable", "name": { "kind": "Name", "value": "id" } } }] }] } }] };
 var CliRegenerateWebhookTokenDocument = { "kind": "Document", "definitions": [{ "kind": "OperationDefinition", "operation": "mutation", "name": { "kind": "Name", "value": "CliRegenerateWebhookToken" }, "variableDefinitions": [{ "kind": "VariableDefinition", "variable": { "kind": "Variable", "name": { "kind": "Name", "value": "id" } }, "type": { "kind": "NonNullType", "type": { "kind": "NamedType", "name": { "kind": "Name", "value": "ID" } } } }], "selectionSet": { "kind": "SelectionSet", "selections": [{ "kind": "Field", "name": { "kind": "Name", "value": "regenerateWebhookToken" }, "arguments": [{ "kind": "Argument", "name": { "kind": "Name", "value": "id" }, "value": { "kind": "Variable", "name": { "kind": "Name", "value": "id" } } }], "selectionSet": { "kind": "SelectionSet", "selections": [{ "kind": "Field", "name": { "kind": "Name", "value": "id" } }, { "kind": "Field", "name": { "kind": "Name", "value": "token" } }] } }] } }] };
+var CliWebhookDeliveriesDocument = { "kind": "Document", "definitions": [{ "kind": "OperationDefinition", "operation": "query", "name": { "kind": "Name", "value": "CliWebhookDeliveries" }, "variableDefinitions": [{ "kind": "VariableDefinition", "variable": { "kind": "Variable", "name": { "kind": "Name", "value": "webhookId" } }, "type": { "kind": "NonNullType", "type": { "kind": "NamedType", "name": { "kind": "Name", "value": "ID" } } } }, { "kind": "VariableDefinition", "variable": { "kind": "Variable", "name": { "kind": "Name", "value": "limit" } }, "type": { "kind": "NamedType", "name": { "kind": "Name", "value": "Int" } } }], "selectionSet": { "kind": "SelectionSet", "selections": [{ "kind": "Field", "name": { "kind": "Name", "value": "webhookDeliveries" }, "arguments": [{ "kind": "Argument", "name": { "kind": "Name", "value": "webhookId" }, "value": { "kind": "Variable", "name": { "kind": "Name", "value": "webhookId" } } }, { "kind": "Argument", "name": { "kind": "Name", "value": "limit" }, "value": { "kind": "Variable", "name": { "kind": "Name", "value": "limit" } } }], "selectionSet": { "kind": "SelectionSet", "selections": [{ "kind": "Field", "name": { "kind": "Name", "value": "id" } }, { "kind": "Field", "name": { "kind": "Name", "value": "providerName" } }, { "kind": "Field", "name": { "kind": "Name", "value": "providerEventId" } }, { "kind": "Field", "name": { "kind": "Name", "value": "normalizedKind" } }, { "kind": "Field", "name": { "kind": "Name", "value": "receivedAt" } }, { "kind": "Field", "name": { "kind": "Name", "value": "signatureStatus" } }, { "kind": "Field", "name": { "kind": "Name", "value": "resolutionStatus" } }, { "kind": "Field", "name": { "kind": "Name", "value": "statusCode" } }, { "kind": "Field", "name": { "kind": "Name", "value": "durationMs" } }, { "kind": "Field", "name": { "kind": "Name", "value": "threadId" } }, { "kind": "Field", "name": { "kind": "Name", "value": "threadCreated" } }, { "kind": "Field", "name": { "kind": "Name", "value": "retryCount" } }, { "kind": "Field", "name": { "kind": "Name", "value": "isReplay" } }, { "kind": "Field", "name": { "kind": "Name", "value": "errorMessage" } }] } }] } }] };
 var CliWebhookTenantBySlugDocument = { "kind": "Document", "definitions": [{ "kind": "OperationDefinition", "operation": "query", "name": { "kind": "Name", "value": "CliWebhookTenantBySlug" }, "variableDefinitions": [{ "kind": "VariableDefinition", "variable": { "kind": "Variable", "name": { "kind": "Name", "value": "slug" } }, "type": { "kind": "NonNullType", "type": { "kind": "NamedType", "name": { "kind": "Name", "value": "String" } } } }], "selectionSet": { "kind": "SelectionSet", "selections": [{ "kind": "Field", "name": { "kind": "Name", "value": "tenantBySlug" }, "arguments": [{ "kind": "Argument", "name": { "kind": "Name", "value": "slug" }, "value": { "kind": "Variable", "name": { "kind": "Name", "value": "slug" } } }], "selectionSet": { "kind": "SelectionSet", "selections": [{ "kind": "Field", "name": { "kind": "Name", "value": "id" } }] } }] } }] };
 var CliWikiTenantBySlugDocument = { "kind": "Document", "definitions": [{ "kind": "OperationDefinition", "operation": "query", "name": { "kind": "Name", "value": "CliWikiTenantBySlug" }, "variableDefinitions": [{ "kind": "VariableDefinition", "variable": { "kind": "Variable", "name": { "kind": "Name", "value": "slug" } }, "type": { "kind": "NonNullType", "type": { "kind": "NamedType", "name": { "kind": "Name", "value": "String" } } } }], "selectionSet": { "kind": "SelectionSet", "selections": [{ "kind": "Field", "name": { "kind": "Name", "value": "tenantBySlug" }, "arguments": [{ "kind": "Argument", "name": { "kind": "Name", "value": "slug" }, "value": { "kind": "Variable", "name": { "kind": "Name", "value": "slug" } } }], "selectionSet": { "kind": "SelectionSet", "selections": [{ "kind": "Field", "name": { "kind": "Name", "value": "id" } }, { "kind": "Field", "name": { "kind": "Name", "value": "slug" } }, { "kind": "Field", "name": { "kind": "Name", "value": "name" } }] } }] } }] };
 var CliAllTenantAgentsForWikiDocument = { "kind": "Document", "definitions": [{ "kind": "OperationDefinition", "operation": "query", "name": { "kind": "Name", "value": "CliAllTenantAgentsForWiki" }, "variableDefinitions": [{ "kind": "VariableDefinition", "variable": { "kind": "Variable", "name": { "kind": "Name", "value": "tenantId" } }, "type": { "kind": "NonNullType", "type": { "kind": "NamedType", "name": { "kind": "Name", "value": "ID" } } } }], "selectionSet": { "kind": "SelectionSet", "selections": [{ "kind": "Field", "name": { "kind": "Name", "value": "allTenantAgents" }, "arguments": [{ "kind": "Argument", "name": { "kind": "Name", "value": "tenantId" }, "value": { "kind": "Variable", "name": { "kind": "Name", "value": "tenantId" } } }, { "kind": "Argument", "name": { "kind": "Name", "value": "includeSystem" }, "value": { "kind": "BooleanValue", "value": false } }, { "kind": "Argument", "name": { "kind": "Name", "value": "includeSubAgents" }, "value": { "kind": "BooleanValue", "value": false } }], "selectionSet": { "kind": "SelectionSet", "selections": [{ "kind": "Field", "name": { "kind": "Name", "value": "id" } }, { "kind": "Field", "name": { "kind": "Name", "value": "name" } }, { "kind": "Field", "name": { "kind": "Name", "value": "slug" } }, { "kind": "Field", "name": { "kind": "Name", "value": "type" } }, { "kind": "Field", "name": { "kind": "Name", "value": "status" } }] } }] } }] };
@@ -4877,6 +4878,7 @@ var documents = {
   "\n  mutation CliUpdateWebhook($id: ID!, $input: UpdateWebhookInput!) {\n    updateWebhook(id: $id, input: $input) {\n      id\n      name\n      targetType\n      enabled\n      rateLimit\n    }\n  }\n": CliUpdateWebhookDocument,
   "\n  mutation CliDeleteWebhook($id: ID!) {\n    deleteWebhook(id: $id)\n  }\n": CliDeleteWebhookDocument,
   "\n  mutation CliRegenerateWebhookToken($id: ID!) {\n    regenerateWebhookToken(id: $id) {\n      id\n      token\n    }\n  }\n": CliRegenerateWebhookTokenDocument,
+  "\n  query CliWebhookDeliveries($webhookId: ID!, $limit: Int) {\n    webhookDeliveries(webhookId: $webhookId, limit: $limit) {\n      id\n      providerName\n      providerEventId\n      normalizedKind\n      receivedAt\n      signatureStatus\n      resolutionStatus\n      statusCode\n      durationMs\n      threadId\n      threadCreated\n      retryCount\n      isReplay\n      errorMessage\n    }\n  }\n": CliWebhookDeliveriesDocument,
   "\n  query CliWebhookTenantBySlug($slug: String!) {\n    tenantBySlug(slug: $slug) {\n      id\n    }\n  }\n": CliWebhookTenantBySlugDocument,
   "\n  query CliWikiTenantBySlug($slug: String!) {\n    tenantBySlug(slug: $slug) {\n      id\n      slug\n      name\n    }\n  }\n": CliWikiTenantBySlugDocument,
   "\n  query CliAllTenantAgentsForWiki($tenantId: ID!) {\n    allTenantAgents(tenantId: $tenantId, includeSystem: false, includeSubAgents: false) {\n      id\n      name\n      slug\n      type\n      status\n    }\n  }\n": CliAllTenantAgentsForWikiDocument,
@@ -10619,6 +10621,26 @@ var RegenerateWebhookTokenDoc = graphql(`
     }
   }
 `);
+var WebhookDeliveriesDoc = graphql(`
+  query CliWebhookDeliveries($webhookId: ID!, $limit: Int) {
+    webhookDeliveries(webhookId: $webhookId, limit: $limit) {
+      id
+      providerName
+      providerEventId
+      normalizedKind
+      receivedAt
+      signatureStatus
+      resolutionStatus
+      statusCode
+      durationMs
+      threadId
+      threadCreated
+      retryCount
+      isReplay
+      errorMessage
+    }
+  }
+`);
 var WebhookTenantBySlugDoc = graphql(`
   query CliWebhookTenantBySlug($slug: String!) {
     tenantBySlug(slug: $slug) {
@@ -10852,6 +10874,50 @@ async function runWebhookRotate(id, opts) {
   console.log("  New token (SAVE THIS):");
   console.log(`    ${wh.token}`);
 }
+async function runWebhookDeliveries(id, opts) {
+  const ctx = await resolveWebhookContext(opts);
+  const limit = Math.min(
+    Math.max(Number.parseInt(opts.limit ?? "25", 10) || 25, 1),
+    500
+  );
+  const data = await gqlQuery(ctx.client, WebhookDeliveriesDoc, {
+    webhookId: id,
+    limit
+  });
+  const rows = data.webhookDeliveries;
+  if (isJsonMode()) {
+    printJson({ items: rows });
+    return;
+  }
+  if (rows.length === 0) {
+    logStderr(`No deliveries recorded for webhook ${id}.`);
+    return;
+  }
+  printTable(
+    rows.map((r) => ({
+      received: r.receivedAt ?? "",
+      provider: r.providerName ?? "\u2014",
+      event: r.normalizedKind ?? r.providerEventId ?? "\u2014",
+      sig: r.signatureStatus,
+      resolution: r.resolutionStatus,
+      status: r.statusCode != null ? String(r.statusCode) : "\u2014",
+      durMs: r.durationMs != null ? String(r.durationMs) : "\u2014",
+      retry: r.retryCount != null ? String(r.retryCount) : "\u2014",
+      thread: r.threadId ?? "\u2014"
+    })),
+    [
+      { key: "received", header: "Received" },
+      { key: "provider", header: "Provider" },
+      { key: "event", header: "Event" },
+      { key: "sig", header: "Sig" },
+      { key: "resolution", header: "Resolution" },
+      { key: "status", header: "Status" },
+      { key: "durMs", header: "Dur(ms)" },
+      { key: "retry", header: "Retry" },
+      { key: "thread", header: "Thread" }
+    ]
+  );
+}
 function notYetImplementedAtApi2(verb) {
   printError(
     `\`webhook ${verb}\` is not yet implemented at the GraphQL API.
@@ -10874,7 +10940,9 @@ Examples:
   wh.command("delete <id>").description("Delete a webhook (its URL stops working immediately).").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("-y, --yes", "Skip confirmation").action(runWebhookDelete);
   wh.command("test <id>").description("Send a synthetic payload to the webhook. (API surface pending.)").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--payload <json>").action(() => notYetImplementedAtApi2("test"));
   wh.command("rotate <id>").description("Generate a new token for an existing webhook.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("-y, --yes", "Skip confirmation").action(runWebhookRotate);
-  wh.command("deliveries <id>").description("Show recent delivery attempts. (API surface pending.)").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--limit <n>", "Max rows", "25").action(() => notYetImplementedAtApi2("deliveries"));
+  wh.command("deliveries <id>").description(
+    "Show recent delivery attempts for a webhook (newest first). Default 25, max 500."
+  ).option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--limit <n>", "Max rows (1-500)", "25").action(runWebhookDeliveries);
 }
 
 // src/lib/plugin-zip.ts
@@ -13267,10 +13335,15 @@ async function runEvalSeed(opts) {
     categories: opts.category && opts.category.length > 0 ? opts.category : null
   });
   if (isJsonMode()) {
-    printJson({ inserted: data.seedEvalTestCases });
+    printJson({
+      source: "built-in-yaml-seed",
+      inserted: data.seedEvalTestCases
+    });
     return;
   }
-  printSuccess(`Seeded ${data.seedEvalTestCases} new test case(s). (Duplicates were skipped.)`);
+  printSuccess(
+    `Seeded ${data.seedEvalTestCases} new test case(s). (Duplicates were skipped.)`
+  );
 }
 
 // src/commands/eval/test-case/list.ts
@@ -15336,12 +15409,541 @@ function printBootstrapSummary(result) {
   }
 }
 
+// src/commands/enterprise/overlay.ts
+import { resolve as resolve6 } from "path";
+
+// src/commands/enterprise/overlay-schema.ts
+import { existsSync as existsSync11, readdirSync as readdirSync3, readFileSync as readFileSync9, statSync as statSync3 } from "fs";
+import { join as join9, relative as relative3, sep as sep2 } from "path";
+function loadEnterpriseOverlayDefinition(repoRoot) {
+  const path2 = join9(repoRoot, "customer", "deployment.json");
+  if (!existsSync11(path2)) {
+    throw new Error(`Missing customer overlay definition: ${path2}`);
+  }
+  const parsed = JSON.parse(readFileSync9(path2, "utf8"));
+  if (parsed.schemaVersion !== 1) {
+    throw new Error(
+      `Unsupported customer/deployment.json schemaVersion ${parsed.schemaVersion}`
+    );
+  }
+  if (!isNonEmptyString(parsed.customerSlug)) {
+    throw new Error("customer/deployment.json requires customerSlug");
+  }
+  if (!isRecord(parsed.stages)) {
+    throw new Error("customer/deployment.json requires stages");
+  }
+  return {
+    schemaVersion: 1,
+    customerSlug: parsed.customerSlug,
+    stages: Object.fromEntries(
+      Object.entries(parsed.stages).map(([stage, value]) => [
+        stage,
+        normalizeStage(stage, value)
+      ])
+    )
+  };
+}
+function stageOverlay(definition, stage) {
+  const config = definition.stages[stage];
+  if (!config) {
+    throw new Error(`customer/deployment.json does not define stage ${stage}`);
+  }
+  return config;
+}
+function readCustomerEvalPack(repoRoot, packName) {
+  assertPackName(packName, "eval");
+  const path2 = join9(repoRoot, "customer", "evals", `${packName}.json`);
+  if (!existsSync11(path2)) {
+    throw new Error(`Eval pack "${packName}" is missing: ${path2}`);
+  }
+  const parsed = JSON.parse(readFileSync9(path2, "utf8"));
+  if (!Array.isArray(parsed)) {
+    throw new Error(`Eval pack "${packName}" must be a JSON array`);
+  }
+  return parsed.map(
+    (value, index) => normalizeEvalSeed(value, `customer/evals/${packName}.json[${index}]`)
+  );
+}
+function readJsonSeedPack(repoRoot, packName) {
+  assertPackName(packName, "seed");
+  const path2 = join9(repoRoot, "customer", "seeds", `${packName}.json`);
+  if (!existsSync11(path2)) {
+    throw new Error(`Seed pack "${packName}" is missing: ${path2}`);
+  }
+  return JSON.parse(readFileSync9(path2, "utf8"));
+}
+function collectOverlayFiles(repoRoot, family, packName) {
+  assertPackName(packName, family);
+  const root = join9(repoRoot, "customer", family, packName);
+  if (!existsSync11(root) || !statSync3(root).isDirectory()) {
+    throw new Error(`Overlay pack "${family}/${packName}" is missing: ${root}`);
+  }
+  const files = [];
+  walkFiles(root, (path2) => {
+    const relativePath = relative3(root, path2).split(sep2).join("/");
+    if (relativePath === ".DS_Store" || relativePath.endsWith("/.DS_Store")) {
+      return;
+    }
+    files.push({
+      relativePath,
+      content: readFileSync9(path2, "utf8")
+    });
+  });
+  if (family === "skills" && !files.some((file) => file.relativePath === "SKILL.md")) {
+    throw new Error(`Skill pack "${packName}" must include SKILL.md`);
+  }
+  if (files.length === 0) {
+    throw new Error(`Overlay pack "${family}/${packName}" contains no files`);
+  }
+  return files.sort((a, b) => a.relativePath.localeCompare(b.relativePath));
+}
+function normalizeStage(stage, value) {
+  if (!isRecord(value)) {
+    throw new Error(`Stage ${stage} must be an object`);
+  }
+  if (!isNonEmptyString(value.tenantSlug)) {
+    throw new Error(`Stage ${stage} requires tenantSlug`);
+  }
+  const branding = value.branding;
+  if (branding !== null && branding !== void 0 && !isRecord(branding)) {
+    throw new Error(`Stage ${stage} branding must be an object or null`);
+  }
+  return {
+    tenantSlug: value.tenantSlug,
+    evalPacks: normalizePackArray(value.evalPacks, `${stage}.evalPacks`),
+    seedPacks: normalizePackArray(value.seedPacks, `${stage}.seedPacks`),
+    skillPacks: normalizePackArray(value.skillPacks, `${stage}.skillPacks`),
+    workspaceDefaultPacks: normalizePackArray(
+      value.workspaceDefaultPacks,
+      `${stage}.workspaceDefaultPacks`
+    ),
+    branding: branding ?? null,
+    defaultAgentTemplateSlug: isNonEmptyString(value.defaultAgentTemplateSlug) ? value.defaultAgentTemplateSlug : "default"
+  };
+}
+function normalizeEvalSeed(value, label) {
+  if (!isRecord(value)) throw new Error(`${label} must be an object`);
+  if (!isNonEmptyString(value.name))
+    throw new Error(`${label}.name is required`);
+  if (!isNonEmptyString(value.category))
+    throw new Error(`${label}.category is required`);
+  if (!isNonEmptyString(value.query))
+    throw new Error(`${label}.query is required`);
+  const assertions = value.assertions;
+  if (!Array.isArray(assertions)) {
+    throw new Error(`${label}.assertions must be an array`);
+  }
+  return {
+    name: value.name,
+    category: value.category,
+    query: value.query,
+    systemPrompt: typeof value.systemPrompt === "string" ? value.systemPrompt : null,
+    agentTemplateId: typeof value.agentTemplateId === "string" ? value.agentTemplateId : null,
+    assertions: assertions.map(
+      (assertion, index) => normalizeAssertion(assertion, `${label}.assertions[${index}]`)
+    ),
+    agentcoreEvaluatorIds: normalizeOptionalStringArray(
+      value.agentcoreEvaluatorIds,
+      `${label}.agentcoreEvaluatorIds`
+    ),
+    tags: normalizeOptionalStringArray(value.tags, `${label}.tags`),
+    enabled: typeof value.enabled === "boolean" ? value.enabled : true
+  };
+}
+function normalizeAssertion(value, label) {
+  if (!isRecord(value)) throw new Error(`${label} must be an object`);
+  if (!isNonEmptyString(value.type))
+    throw new Error(`${label}.type is required`);
+  return {
+    type: value.type,
+    value: typeof value.value === "string" || value.value === null ? value.value : void 0,
+    path: typeof value.path === "string" || value.path === null ? value.path : void 0
+  };
+}
+function normalizePackArray(value, label) {
+  const items = normalizeStringArray(value, label);
+  for (const item of items) assertPackName(item, label);
+  return items;
+}
+function normalizeStringArray(value, label) {
+  if (value === void 0) return [];
+  if (!Array.isArray(value)) throw new Error(`${label} must be an array`);
+  return value.map((item, index) => {
+    if (!isNonEmptyString(item)) {
+      throw new Error(`${label}[${index}] must be a non-empty string`);
+    }
+    return item;
+  });
+}
+function normalizeOptionalStringArray(value, label) {
+  if (value === void 0 || value === null) return [];
+  return normalizeStringArray(value, label);
+}
+function assertPackName(value, label) {
+  if (!/^[a-z0-9][a-z0-9_.-]*$/.test(value)) {
+    throw new Error(
+      `${label} pack "${value}" must use lowercase letters, numbers, dot, underscore, or hyphen`
+    );
+  }
+}
+function walkFiles(root, visit) {
+  for (const entry of readdirSync3(root, { withFileTypes: true })) {
+    const path2 = join9(root, entry.name);
+    if (entry.isDirectory()) {
+      walkFiles(path2, visit);
+    } else if (entry.isFile()) {
+      visit(path2);
+    }
+  }
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isNonEmptyString(value) {
+  return typeof value === "string" && value.trim().length > 0;
+}
+
+// src/commands/enterprise/overlay-apply.ts
+function buildEnterpriseOverlayPlan(options) {
+  const definition = loadEnterpriseOverlayDefinition(options.repoRoot);
+  const stage = stageOverlay(definition, options.stage);
+  return {
+    repoRoot: options.repoRoot,
+    stage: options.stage,
+    tenantSlug: stage.tenantSlug,
+    targetTemplateSlug: stage.defaultAgentTemplateSlug,
+    operations: [
+      ...evalOperations(options.repoRoot, stage),
+      ...workspaceFileOperations(options.repoRoot, stage),
+      ...seedOperations(options.repoRoot, stage),
+      ...stage.branding ? [{ kind: "branding", branding: stage.branding }] : []
+    ]
+  };
+}
+async function applyEnterpriseOverlay(plan, client) {
+  const result = {
+    stage: plan.stage,
+    tenantSlug: plan.tenantSlug,
+    evals: { inserted: 0, updated: 0, skipped: 0, packs: [] },
+    workspaceFiles: { written: 0, packs: [] },
+    seeds: { validated: 0, packs: [] },
+    branding: "not-configured"
+  };
+  const existing = await client.listEvalTestCases();
+  const existingByOverlayKey = new Map(
+    existing.flatMap(
+      (testCase) => (testCase.tags ?? []).filter((tag) => tag.startsWith("customer-overlay:key:")).map((tag) => [tag, testCase])
+    )
+  );
+  for (const operation of plan.operations) {
+    if (operation.kind === "eval-pack") {
+      const packResult = {
+        pack: operation.pack,
+        inserted: 0,
+        updated: 0,
+        skipped: 0
+      };
+      for (const testCase of operation.testCases) {
+        const input20 = withOverlayTags(
+          operation.pack,
+          testCase,
+          client.targetAgentTemplateId
+        );
+        const existingCase = existingByOverlayKey.get(
+          overlayKeyTag(operation.pack, testCase)
+        );
+        if (existingCase) {
+          if (sameEval(existingCase, input20)) {
+            result.evals.skipped++;
+            packResult.skipped++;
+          } else {
+            await client.updateEvalTestCase(existingCase.id, input20);
+            result.evals.updated++;
+            packResult.updated++;
+          }
+        } else {
+          await client.createEvalTestCase(input20);
+          result.evals.inserted++;
+          packResult.inserted++;
+        }
+      }
+      result.evals.packs.push(packResult);
+      continue;
+    }
+    if (operation.kind === "workspace-file-pack") {
+      for (const file of operation.files) {
+        await client.putWorkspaceFile({
+          templateSlug: operation.targetTemplateSlug,
+          path: workspaceTargetPath(
+            operation.family,
+            operation.pack,
+            file.relativePath
+          ),
+          content: file.content
+        });
+        result.workspaceFiles.written++;
+      }
+      result.workspaceFiles.packs.push({
+        family: operation.family,
+        pack: operation.pack,
+        written: operation.files.length
+      });
+      continue;
+    }
+    if (operation.kind === "seed-pack") {
+      result.seeds.validated++;
+      result.seeds.packs.push(operation.pack);
+      continue;
+    }
+    if (operation.kind === "branding") {
+      result.branding = "recorded";
+    }
+  }
+  return result;
+}
+function evalOperations(repoRoot, stage) {
+  return stage.evalPacks.map((pack) => ({
+    kind: "eval-pack",
+    pack,
+    testCases: readCustomerEvalPack(repoRoot, pack)
+  }));
+}
+function workspaceFileOperations(repoRoot, stage) {
+  return [
+    ...stage.skillPacks.map((pack) => ({
+      kind: "workspace-file-pack",
+      family: "skills",
+      pack,
+      targetTemplateSlug: stage.defaultAgentTemplateSlug,
+      files: collectOverlayFiles(repoRoot, "skills", pack)
+    })),
+    ...stage.workspaceDefaultPacks.map((pack) => ({
+      kind: "workspace-file-pack",
+      family: "workspace-defaults",
+      pack,
+      targetTemplateSlug: stage.defaultAgentTemplateSlug,
+      files: collectOverlayFiles(repoRoot, "workspace-defaults", pack)
+    }))
+  ];
+}
+function seedOperations(repoRoot, stage) {
+  return stage.seedPacks.map((pack) => ({
+    kind: "seed-pack",
+    pack,
+    payload: readJsonSeedPack(repoRoot, pack)
+  }));
+}
+function workspaceTargetPath(family, pack, relativePath) {
+  if (family === "skills") return `skills/${pack}/${relativePath}`;
+  return relativePath;
+}
+function withOverlayTags(pack, testCase, defaultAgentTemplateId) {
+  return {
+    ...testCase,
+    agentTemplateId: testCase.agentTemplateId ?? defaultAgentTemplateId,
+    tags: Array.from(
+      /* @__PURE__ */ new Set([
+        ...testCase.tags ?? [],
+        "source:customer-overlay",
+        `customer-overlay:pack:${pack}`,
+        overlayKeyTag(pack, testCase)
+      ])
+    )
+  };
+}
+function overlayKeyTag(pack, testCase) {
+  return `customer-overlay:key:${pack}/${slugify(testCase.name)}`;
+}
+function sameEval(existing, next) {
+  return existing.name === next.name && existing.category === next.category && existing.query === next.query && (existing.systemPrompt ?? null) === (next.systemPrompt ?? null) && JSON.stringify(existing.assertions ?? []) === JSON.stringify(next.assertions ?? []) && JSON.stringify(existing.agentcoreEvaluatorIds ?? []) === JSON.stringify(next.agentcoreEvaluatorIds ?? []) && JSON.stringify(existing.tags ?? []) === JSON.stringify(next.tags ?? []) && (existing.enabled ?? true) === (next.enabled ?? true);
+}
+function slugify(value) {
+  return value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 80);
+}
+
+// src/commands/enterprise/overlay.ts
+function registerEnterpriseOverlayCommand(program2) {
+  const overlay = program2.command("overlay").description(
+    "Validate and apply customer overlay packs from a deployment repo."
+  );
+  overlay.command("plan").argument("[repoRoot]", "Deployment repository root", ".").description(
+    "Validate customer/deployment.json and print the overlay plan."
+  ).option("-s, --stage <name>", "Deployment stage").option("-r, --region <region>", "AWS region", "us-east-1").action(
+    (repoRoot, opts) => runEnterpriseOverlayPlan(repoRoot, opts)
+  );
+  overlay.command("apply").argument("[repoRoot]", "Deployment repository root", ".").description("Apply customer overlay packs to the deployed stage.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("-r, --region <region>", "AWS region", "us-east-1").option("--dry-run", "Validate and print the apply plan without mutation").action(
+    (repoRoot, opts) => runEnterpriseOverlayApply(repoRoot, opts)
+  );
+}
+async function runEnterpriseOverlayPlan(repoRoot, opts) {
+  const plan = buildEnterpriseOverlayPlan({
+    repoRoot: resolve6(repoRoot),
+    stage: resolveOverlayStage(opts)
+  });
+  printJson(publicPlan(plan));
+}
+async function runEnterpriseOverlayApply(repoRoot, opts) {
+  const stage = resolveOverlayStage(opts);
+  const plan = buildEnterpriseOverlayPlan({
+    repoRoot: resolve6(repoRoot),
+    stage
+  });
+  if (opts.dryRun) {
+    printJson({ dryRun: true, plan: publicPlan(plan) });
+    return;
+  }
+  const client = await createOverlayApiClient(plan, opts);
+  const result = await applyEnterpriseOverlay(plan, client);
+  if (isJsonMode()) {
+    printJson(result);
+    return;
+  }
+  printSuccess(
+    `Applied overlay for ${plan.tenantSlug}: ${result.evals.inserted} eval(s) inserted, ${result.evals.updated} updated, ${result.workspaceFiles.written} workspace file(s) written.`
+  );
+}
+async function createOverlayApiClient(plan, opts) {
+  const region = opts.region ?? "us-east-1";
+  const ctx = await resolveEvalContext({
+    stage: plan.stage,
+    region,
+    tenant: opts.tenant ?? plan.tenantSlug
+  });
+  const templateId = await resolveTemplateId(
+    ctx.client,
+    ctx.tenantId,
+    plan.targetTemplateSlug
+  );
+  const auth = await resolveAuth({ stage: plan.stage, region });
+  const apiUrl = getApiEndpoint(plan.stage, region);
+  if (!apiUrl) {
+    printError(
+      `Cannot discover API endpoint for stage "${plan.stage}" in ${region}.`
+    );
+    process.exit(1);
+  }
+  return {
+    targetAgentTemplateId: templateId,
+    async listEvalTestCases() {
+      const data = await gqlQuery(ctx.client, EvalTestCasesDoc, {
+        tenantId: ctx.tenantId,
+        category: null,
+        search: null
+      });
+      return data.evalTestCases;
+    },
+    async createEvalTestCase(input20) {
+      await gqlMutate(ctx.client, CreateEvalTestCaseDoc, {
+        tenantId: ctx.tenantId,
+        input: evalInput(input20)
+      });
+    },
+    async updateEvalTestCase(id, input20) {
+      await gqlMutate(ctx.client, UpdateEvalTestCaseDoc, {
+        id,
+        input: evalInput(input20)
+      });
+    },
+    async putWorkspaceFile(input20) {
+      const response = await fetch(
+        `${apiUrl.replace(/\/+$/, "")}/api/workspaces/files`,
+        {
+          method: "POST",
+          headers: {
+            "content-type": "application/json",
+            ...auth.headers,
+            "x-tenant-id": ctx.tenantId
+          },
+          body: JSON.stringify({
+            action: "put",
+            templateId,
+            path: input20.path,
+            content: input20.content
+          })
+        }
+      );
+      if (!response.ok) {
+        const text = await response.text();
+        throw new Error(
+          `PUT ${input20.path} failed: ${response.status} ${text || response.statusText}`
+        );
+      }
+    }
+  };
+}
+async function resolveTemplateId(client, tenantId, templateSlug) {
+  const data = await gqlQuery(client, AgentTemplatesForEvalDoc, { tenantId });
+  const template = data.agentTemplates.find(
+    (item) => item.slug === templateSlug
+  );
+  if (!template) {
+    throw new Error(
+      `Agent template "${templateSlug}" not found for tenant ${tenantId}`
+    );
+  }
+  return template.id;
+}
+function evalInput(input20) {
+  return {
+    name: input20.name,
+    category: input20.category,
+    query: input20.query,
+    systemPrompt: input20.systemPrompt ?? null,
+    agentTemplateId: input20.agentTemplateId ?? null,
+    assertions: input20.assertions,
+    agentcoreEvaluatorIds: input20.agentcoreEvaluatorIds ?? [],
+    tags: input20.tags ?? [],
+    enabled: input20.enabled ?? true
+  };
+}
+function publicPlan(plan) {
+  return {
+    stage: plan.stage,
+    tenantSlug: plan.tenantSlug,
+    targetTemplateSlug: plan.targetTemplateSlug,
+    operations: plan.operations.map((operation) => {
+      if (operation.kind === "eval-pack") {
+        return {
+          kind: operation.kind,
+          pack: operation.pack,
+          testCases: operation.testCases.length
+        };
+      }
+      if (operation.kind === "workspace-file-pack") {
+        return {
+          kind: operation.kind,
+          family: operation.family,
+          pack: operation.pack,
+          targetTemplateSlug: operation.targetTemplateSlug,
+          files: operation.files.length
+        };
+      }
+      if (operation.kind === "seed-pack") {
+        return {
+          kind: operation.kind,
+          pack: operation.pack,
+          status: "validated"
+        };
+      }
+      return { kind: operation.kind, status: "recorded" };
+    })
+  };
+}
+function resolveOverlayStage(opts) {
+  const stage = opts.stage ?? process.env.STAGE;
+  if (!stage) {
+    throw new Error("Deployment stage is required. Pass --stage or set STAGE.");
+  }
+  return stage;
+}
+
 // src/commands/enterprise.ts
 function registerEnterpriseCommand(program2) {
   const enterprise = program2.command("enterprise").description(
     "Bootstrap and operate customer-owned ThinkWork enterprise deployment repositories."
   );
   registerEnterpriseBootstrapCommand(enterprise);
+  registerEnterpriseOverlayCommand(enterprise);
 }
 
 // src/cli.ts

package/dist/commands/enterprise/templates/deploy-repo/.github/workflows/deploy.yml

@@ -177,10 +177,14 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
-          node scripts/apply-release.mjs record-overlay \
+          CLI_VERSION="${{ steps.lock.outputs.release }}"
+          CLI_VERSION="${CLI_VERSION#v}"
+          TENANT_SLUG="$(jq -r --arg stage "$STAGE" '.stages[$stage].tenantSlug' customer/deployment.json)"
+          npx -y "thinkwork-cli@${CLI_VERSION}" --json enterprise overlay apply . \
             --stage "$STAGE" \
-            --deployment customer/deployment.json \
-            --work-dir "$RELEASE_DIR"
+            --region "${{ vars.AWS_REGION }}" \
+            --tenant "$TENANT_SLUG" \
+            > "$RELEASE_DIR/overlay-report.json"
 
       - name: Run smoke checks
         if: ${{ github.event.inputs.run_smokes == 'true' && (github.event.inputs.component == 'all' || github.event.inputs.component == 'smokes') }}

package/dist/commands/enterprise/templates/deploy-repo/README.md

@@ -23,6 +23,8 @@ artifacts, and customer-specific work lives under `customer/`.
 3. Add required environment secrets, including `TF_VAR_db_password` and
    `TF_VAR_api_auth_secret`.
 4. Dispatch `.github/workflows/deploy.yml` for the target stage.
+5. Use `docs/runbook.md` for release upgrades, overlay-only changes,
+   rollback, and break-glass guidance.
 
 ## Customer Overlay
 

package/dist/commands/enterprise/templates/deploy-repo/docs/runbook.md

@@ -0,0 +1,79 @@
+<!-- thinkwork-managed: enterprise-deploy-template -->
+
+# ThinkWork Enterprise Deployment Runbook
+
+This repository deploys a pinned ThinkWork release into the customer AWS
+account. It is a deployment repository, not a source fork.
+
+## Normal Sequence
+
+1. Bootstrap the repo once:
+
+   ```bash
+   thinkwork enterprise bootstrap . \
+     --customer {{CUSTOMER_SLUG}} \
+     --repo <github-owner>/<github-repo> \
+     --stage dev \
+     --stage prod
+   ```
+
+2. Review GitHub Environment settings for each stage.
+3. Add required secrets such as `TF_VAR_db_password` and
+   `TF_VAR_api_auth_secret`.
+4. Dispatch `.github/workflows/deploy.yml`.
+5. CI verifies `thinkwork.lock`, prepares release artifacts, runs Terraform,
+   updates AgentCore runtimes, applies customer overlays, runs smoke checks,
+   and writes a summary artifact.
+
+The exact operational path is:
+
+```text
+bootstrap -> workflow dispatch -> CI deploy -> overlay apply -> smoke summary
+```
+
+## Release Upgrades
+
+1. Update `thinkwork.lock` to the approved release manifest URL and checksum.
+2. Review ThinkWork release notes for schema or operator changes.
+3. Dispatch the workflow with `component=all`.
+4. Save the deploy summary artifact as evidence.
+
+## Overlay-Only Changes
+
+1. Edit files under `customer/`.
+2. Run a local dry-run:
+
+   ```bash
+   thinkwork enterprise overlay apply . --stage dev --dry-run --json
+   ```
+
+3. Dispatch the workflow with `component=overlays`.
+4. Confirm `overlay-report.json` in the workflow artifacts.
+
+## Secrets
+
+Never commit secrets. Supported secret homes are:
+
+- GitHub Environment secrets for CI inputs.
+- AWS Secrets Manager for deployed application/runtime secrets.
+- SSM Parameter Store for stage configuration consumed by Terraform or runtime
+  code.
+
+Do not store plaintext secrets in `terraform/stages/*.tfvars`, `.env`,
+`customer/`, or runbook files.
+
+## Rollback
+
+To roll back application code, restore `thinkwork.lock` to the previously
+working release and dispatch the workflow. To roll back customer overlays,
+revert the customer repo commit and dispatch `component=overlays`.
+
+If a deploy fails after Terraform apply but before smoke summary, inspect the
+workflow artifacts first: `release-manifest.json`, `overlay-report.json`, and
+the deploy summary identify which stage failed.
+
+## Break Glass
+
+A full ThinkWork source fork is emergency debt. Use it only when the customer
+requires source changes that cannot be shipped upstream quickly enough. Record
+the fork reason, owner, and expected upstream PR before deploying it.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkwork-cli",
-  "version": "0.12.3",
+  "version": "0.12.4",
   "description": "Thinkwork CLI — deploy, manage, and interact with your Thinkwork stack",
   "license": "Apache-2.0",
   "type": "module",