thinkwork-cli 0.12.6 → 0.12.7

package/dist/cli.js

@@ -1,9 +1,28 @@
 #!/usr/bin/env node
-var __defProp = Object.defineProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
+import {
+  __export,
+  apiFetch,
+  apiFetchRaw,
+  ensureInit,
+  ensureWorkspace,
+  getApiEndpoint,
+  listDeployedStages,
+  listEnvironments,
+  loadEnvironment,
+  printError,
+  printHeader,
+  printMissingApiSessionError,
+  printSuccess,
+  printSummary,
+  printTierHeader,
+  printWarning,
+  resolveApiConfig,
+  resolveTerraformDir,
+  resolveTierDir,
+  runTerraform,
+  saveEnterpriseDeployment,
+  saveEnvironment
+} from "./chunk-34NMB5AK.js";
 
 // src/cli.ts
 import { Command } from "commander";
@@ -22,20 +41,20 @@ function getCliConfigPath(override) {
   return override ?? join(homedir(), ".thinkwork", "config.json");
 }
 function loadCliConfig(pathOverride) {
-  const path2 = getCliConfigPath(pathOverride);
-  if (!existsSync(path2)) return {};
+  const path = getCliConfigPath(pathOverride);
+  if (!existsSync(path)) return {};
   try {
-    return JSON.parse(readFileSync(path2, "utf-8"));
+    return JSON.parse(readFileSync(path, "utf-8"));
   } catch {
     return {};
   }
 }
 function saveCliConfig(next, pathOverride) {
-  const path2 = getCliConfigPath(pathOverride);
-  const dir = dirname(path2);
+  const path = getCliConfigPath(pathOverride);
+  const dir = dirname(path);
   if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
   const merged = { ...loadCliConfig(pathOverride), ...next };
-  writeFileSync(path2, JSON.stringify(merged, null, 2) + "\n");
+  writeFileSync(path, JSON.stringify(merged, null, 2) + "\n");
 }
 function saveStageSession(stage, session, pathOverride) {
   const current = loadCliConfig(pathOverride);
@@ -168,190 +187,9 @@ function getAwsIdentity() {
   }
 }
 
-// src/terraform.ts
-import { spawn } from "child_process";
-import { existsSync as existsSync2 } from "fs";
-import path from "path";
-function resolveTierDir(terraformDir, stage, tier) {
-  const envDir = path.join(terraformDir, "environments", stage, tier);
-  if (existsSync2(envDir)) {
-    return envDir;
-  }
-  const greenfield = path.join(terraformDir, "examples", "greenfield");
-  if (existsSync2(greenfield)) {
-    return greenfield;
-  }
-  const flat = path.join(terraformDir);
-  if (existsSync2(path.join(flat, "main.tf"))) {
-    return flat;
-  }
-  const cwdTf = path.join(process.cwd(), "terraform");
-  if (existsSync2(path.join(cwdTf, "main.tf"))) {
-    return cwdTf;
-  }
-  return terraformDir;
-}
-async function ensureWorkspace(cwd, stage) {
-  const list = await runTerraformRaw(cwd, ["workspace", "list"]);
-  const workspaces = list.split("\n").map((l) => l.replace("*", "").trim()).filter(Boolean);
-  if (!workspaces.includes(stage)) {
-    await runTerraformRaw(cwd, ["workspace", "new", stage]);
-  } else {
-    await runTerraformRaw(cwd, ["workspace", "select", stage]);
-  }
-}
-function runTerraformRaw(cwd, args) {
-  return new Promise((resolve7, reject) => {
-    const proc = spawn("terraform", args, {
-      cwd,
-      stdio: ["pipe", "pipe", "pipe"]
-    });
-    let stdout = "";
-    let stderr = "";
-    proc.stdout.on("data", (d) => stdout += d);
-    proc.stderr.on("data", (d) => stderr += d);
-    proc.on("close", (code) => {
-      if (code === 0) resolve7(stdout);
-      else reject(new Error(`terraform ${args.join(" ")} failed (exit ${code}): ${stderr}`));
-    });
-  });
-}
-function runTerraform(cwd, args) {
-  return new Promise((resolve7) => {
-    console.log(`
-  \u2192 terraform ${args.join(" ")}
-`);
-    const proc = spawn("terraform", args, {
-      cwd,
-      stdio: "inherit"
-    });
-    proc.on("close", (code) => resolve7(code ?? 1));
-  });
-}
-async function ensureInit(cwd) {
-  const dotTerraform = path.join(cwd, ".terraform");
-  if (!existsSync2(dotTerraform)) {
-    const code = await runTerraform(cwd, ["init"]);
-    if (code !== 0) {
-      throw new Error("terraform init failed");
-    }
-  }
-}
-
-// src/ui.ts
-import chalk2 from "chalk";
-import ora from "ora";
-var TIER_LABELS = {
-  foundation: "Foundation",
-  data: "Data",
-  app: "App"
-};
-function printHeader(command, stage, identity) {
-  console.log("");
-  console.log(chalk2.bold.cyan("  \u2B21 Thinkwork") + chalk2.dim(` \u2014 ${command}`));
-  console.log(chalk2.dim(`  Stage: ${chalk2.white(stage)}`));
-  if (identity) {
-    console.log(chalk2.dim(`  AWS:   ${chalk2.white(identity.account)} / ${chalk2.white(identity.region)}`));
-  }
-  console.log("");
-}
-function printTierHeader(tier, index, total) {
-  const label = TIER_LABELS[tier] ?? tier;
-  const progress = chalk2.dim(`[${index + 1}/${total}]`);
-  console.log(`  ${progress} ${chalk2.bold(label)}`);
-}
-function printSuccess(message) {
-  console.log(`
-  ${chalk2.green("\u2713")} ${chalk2.bold(message)}`);
-}
-function printError(message) {
-  console.log(`
-  ${chalk2.red("\u2717")} ${chalk2.bold.red(message)}`);
-}
-function printMissingApiSessionError(stage, hasSession) {
-  if (!hasSession) {
-    printError(`No API session for stage "${stage}".`);
-    console.log("");
-    console.log(`  ${chalk2.bold("To fix:")}  thinkwork login --stage ${stage}`);
-    console.log(
-      chalk2.dim(
-        `  (the deploy-side \`thinkwork login\` only configures an AWS profile \u2014
-   it does NOT open an API session.)`
-      )
-    );
-    console.log("");
-  } else {
-    printError(`Session for stage "${stage}" has no tenant cached.`);
-    console.log("");
-    console.log(`  ${chalk2.bold("To fix:")}  thinkwork login --stage ${stage}`);
-    console.log(
-      chalk2.dim(
-        `  Or pass --tenant <slug>, or set THINKWORK_TENANT.`
-      )
-    );
-    console.log("");
-  }
-}
-function printWarning(message) {
-  console.log(`  ${chalk2.yellow("\u26A0")} ${message}`);
-}
-function printSummary(command, stage, tiers, startTime) {
-  const elapsed = ((Date.now() - startTime) / 1e3).toFixed(1);
-  console.log("");
-  console.log(chalk2.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
-  console.log(`  ${chalk2.bold("Command:")}  ${command}`);
-  console.log(`  ${chalk2.bold("Stage:")}    ${stage}`);
-  console.log(`  ${chalk2.bold("Tiers:")}    ${tiers.map((t) => TIER_LABELS[t] ?? t).join(" \u2192 ")}`);
-  console.log(`  ${chalk2.bold("Time:")}     ${elapsed}s`);
-  console.log(chalk2.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
-}
-
 // src/lib/resolve-stage.ts
 import { select } from "@inquirer/prompts";
 
-// src/aws-discovery.ts
-import { execSync as execSync2 } from "child_process";
-function runAws(cmd) {
-  try {
-    return execSync2(`aws ${cmd}`, {
-      encoding: "utf-8",
-      timeout: 15e3,
-      stdio: ["pipe", "pipe", "pipe"]
-    }).trim();
-  } catch {
-    return null;
-  }
-}
-function listDeployedStages(region) {
-  const raw = runAws(
-    `lambda list-functions --region ${region} --query "Functions[?starts_with(FunctionName, 'thinkwork-')].FunctionName" --output json`
-  );
-  if (!raw) return [];
-  try {
-    const functions = JSON.parse(raw);
-    const stages = /* @__PURE__ */ new Set();
-    for (const fn of functions) {
-      const m = fn.match(/^thinkwork-(.+?)-api-graphql-http$/);
-      if (m) stages.add(m[1]);
-    }
-    return [...stages].sort();
-  } catch {
-    return [];
-  }
-}
-function getApiEndpoint(stage, region) {
-  const raw = runAws(
-    `apigatewayv2 get-apis --region ${region} --query "Items[?Name=='thinkwork-${stage}-api'].ApiEndpoint|[0]" --output text`
-  );
-  return raw && raw !== "None" ? raw : null;
-}
-function getApiAuthSecretFromLambda(stage, region) {
-  const raw = runAws(
-    `lambda get-function-configuration --function-name thinkwork-${stage}-api-tenants --region ${region} --query "Environment.Variables.API_AUTH_SECRET" --output text`
-  );
-  return raw && raw !== "None" ? raw : null;
-}
-
 // src/lib/interactive.ts
 function isCancellation(err) {
   return err instanceof Error && err.name === "ExitPromptError";
@@ -457,8 +295,8 @@ function registerPlanCommand(program2) {
 }
 
 // src/commands/deploy.ts
-import { spawn as spawn2 } from "child_process";
-import { existsSync as existsSync3 } from "fs";
+import { spawn } from "child_process";
+import { existsSync as existsSync2 } from "fs";
 import { dirname as dirname2, resolve as pathResolve } from "path";
 import { fileURLToPath } from "url";
 
@@ -554,7 +392,7 @@ async function runPostDeployProbe(stage) {
     return;
   }
   await new Promise((resolve7) => {
-    const proc = spawn2("bash", [scriptPath, "--stage", stage], {
+    const proc = spawn("bash", [scriptPath, "--stage", stage], {
       stdio: "inherit",
       env: process.env
     });
@@ -584,7 +422,7 @@ function locatePostDeployScript() {
     )
   ];
   for (const candidate of candidates) {
-    if (existsSync3(candidate)) return candidate;
+    if (existsSync2(candidate)) return candidate;
   }
   return null;
 }
@@ -650,14 +488,14 @@ function registerDestroyCommand(program2) {
 }
 
 // src/commands/doctor.ts
-import chalk3 from "chalk";
-import { execSync as execSync3 } from "child_process";
+import chalk2 from "chalk";
+import { execSync as execSync2 } from "child_process";
 function checkAwsCli() {
   return {
     name: "AWS CLI installed",
     run: () => {
       try {
-        const v = execSync3("aws --version", { encoding: "utf-8", timeout: 5e3, stdio: ["pipe", "pipe", "pipe"] }).trim();
+        const v = execSync2("aws --version", { encoding: "utf-8", timeout: 5e3, stdio: ["pipe", "pipe", "pipe"] }).trim();
         return { pass: true, detail: v.split(" ")[0] ?? v };
       } catch {
         return { pass: false, detail: "aws CLI not found. Install: https://aws.amazon.com/cli/" };
@@ -670,7 +508,7 @@ function checkTerraformCli() {
     name: "Terraform CLI installed",
     run: () => {
       try {
-        const v = execSync3("terraform version -json", { encoding: "utf-8", timeout: 5e3, stdio: ["pipe", "pipe", "pipe"] });
+        const v = execSync2("terraform version -json", { encoding: "utf-8", timeout: 5e3, stdio: ["pipe", "pipe", "pipe"] });
         const parsed = JSON.parse(v);
         return { pass: true, detail: `v${parsed.terraform_version}` };
       } catch {
@@ -696,7 +534,7 @@ function checkBedrockAccess() {
     name: "Bedrock model access",
     run: () => {
       try {
-        execSync3(
+        execSync2(
           "aws bedrock get-foundation-model --model-identifier anthropic.claude-3-haiku-20240307-v1:0 --output json --region us-east-1",
           { encoding: "utf-8", timeout: 1e4, stdio: ["pipe", "pipe", "pipe"] }
         );
@@ -729,17 +567,17 @@ function registerDoctorCommand(program2) {
     let allPass = true;
     for (const check of checks) {
       const result = check.run();
-      const icon = result.pass ? chalk3.green("\u2713") : chalk3.red("\u2717");
-      const detail = result.pass ? chalk3.dim(result.detail) : chalk3.yellow(result.detail);
+      const icon = result.pass ? chalk2.green("\u2713") : chalk2.red("\u2717");
+      const detail = result.pass ? chalk2.dim(result.detail) : chalk2.yellow(result.detail);
       console.log(`  ${icon} ${check.name}  ${detail}`);
       if (!result.pass) allPass = false;
     }
     if (allPass) {
       console.log(`
-  ${chalk3.green.bold("All checks passed.")}`);
+  ${chalk2.green.bold("All checks passed.")}`);
     } else {
       console.log(`
-  ${chalk3.yellow.bold("Some checks failed.")} Fix the issues above before deploying.`);
+  ${chalk2.yellow.bold("Some checks failed.")} Fix the issues above before deploying.`);
     }
     process.exit(allPass ? 0 : 1);
   });
@@ -778,75 +616,11 @@ function registerOutputsCommand(program2) {
 }
 
 // src/commands/config.ts
-import { readFileSync as readFileSync3, writeFileSync as writeFileSync3, existsSync as existsSync5 } from "fs";
-import chalk4 from "chalk";
-
-// src/environments.ts
-import {
-  existsSync as existsSync4,
-  mkdirSync as mkdirSync2,
-  writeFileSync as writeFileSync2,
-  readFileSync as readFileSync2,
-  readdirSync
-} from "fs";
-import { join as join2 } from "path";
-import { homedir as homedir2 } from "os";
-var THINKWORK_HOME = join2(homedir2(), ".thinkwork");
-var ENVIRONMENTS_DIR = join2(THINKWORK_HOME, "environments");
-var ENTERPRISE_DEPLOYMENTS_DIR = join2(
-  THINKWORK_HOME,
-  "enterprise-deployments"
-);
-function ensureDir(dir) {
-  if (!existsSync4(dir)) mkdirSync2(dir, { recursive: true });
-}
-function saveEnvironment(config) {
-  ensureDir(ENVIRONMENTS_DIR);
-  const envDir = join2(ENVIRONMENTS_DIR, config.stage);
-  ensureDir(envDir);
-  writeFileSync2(
-    join2(envDir, "config.json"),
-    JSON.stringify(config, null, 2) + "\n"
-  );
-}
-function saveEnterpriseDeployment(config) {
-  ensureDir(ENTERPRISE_DEPLOYMENTS_DIR);
-  writeFileSync2(
-    join2(ENTERPRISE_DEPLOYMENTS_DIR, `${config.customerSlug}.json`),
-    JSON.stringify(config, null, 2) + "\n"
-  );
-}
-function loadEnvironment(stage) {
-  const configPath = join2(ENVIRONMENTS_DIR, stage, "config.json");
-  if (!existsSync4(configPath)) return null;
-  return JSON.parse(readFileSync2(configPath, "utf-8"));
-}
-function listEnvironments() {
-  if (!existsSync4(ENVIRONMENTS_DIR)) return [];
-  return readdirSync(ENVIRONMENTS_DIR).filter((name) => {
-    return existsSync4(join2(ENVIRONMENTS_DIR, name, "config.json"));
-  }).map((name) => {
-    return JSON.parse(
-      readFileSync2(join2(ENVIRONMENTS_DIR, name, "config.json"), "utf-8")
-    );
-  }).sort((a, b) => a.stage.localeCompare(b.stage));
-}
-function resolveTerraformDir(stage) {
-  const env = loadEnvironment(stage);
-  if (env?.terraformDir && existsSync4(env.terraformDir)) {
-    return env.terraformDir;
-  }
-  const envVar = process.env.THINKWORK_TERRAFORM_DIR;
-  if (envVar && existsSync4(envVar)) return envVar;
-  const cwdTf = join2(process.cwd(), "terraform");
-  if (existsSync4(join2(cwdTf, "main.tf"))) return cwdTf;
-  return null;
-}
-
-// src/commands/config.ts
+import { readFileSync as readFileSync2, writeFileSync as writeFileSync2, existsSync as existsSync3 } from "fs";
+import chalk3 from "chalk";
 function readTfVar(tfvarsPath, key) {
-  if (!existsSync5(tfvarsPath)) return null;
-  const content = readFileSync3(tfvarsPath, "utf-8");
+  if (!existsSync3(tfvarsPath)) return null;
+  const content = readFileSync2(tfvarsPath, "utf-8");
   const quoted = content.match(new RegExp(`^${key}\\s*=\\s*"([^"]*)"`, "m"));
   if (quoted) return quoted[1];
   const bare = content.match(new RegExp(`^${key}\\s*=\\s*([^\\s#]+)`, "m"));
@@ -854,10 +628,10 @@ function readTfVar(tfvarsPath, key) {
 }
 var BARE_KEYS = /* @__PURE__ */ new Set(["enable_hindsight"]);
 function setTfVar(tfvarsPath, key, value) {
-  if (!existsSync5(tfvarsPath)) {
+  if (!existsSync3(tfvarsPath)) {
     throw new Error(`terraform.tfvars not found at ${tfvarsPath}`);
   }
-  let content = readFileSync3(tfvarsPath, "utf-8");
+  let content = readFileSync2(tfvarsPath, "utf-8");
   const bare = BARE_KEYS.has(key);
   const newLine = bare ? `${key} = ${value}` : `${key} = "${value}"`;
   const existingRegex = new RegExp(`^${key}\\s*=\\s*(?:"[^"]*"|[^\\s#]+)`, "m");
@@ -868,13 +642,13 @@ function setTfVar(tfvarsPath, key, value) {
 ${newLine}
 `;
   }
-  writeFileSync3(tfvarsPath, content);
+  writeFileSync2(tfvarsPath, content);
 }
 function resolveTfvarsPath(stage) {
   const tfDir = resolveTerraformDir(stage);
   if (tfDir) {
     const direct = `${tfDir}/terraform.tfvars`;
-    if (existsSync5(direct)) return direct;
+    if (existsSync3(direct)) return direct;
   }
   const terraformDir = process.env.THINKWORK_TERRAFORM_DIR || process.cwd();
   const cwd = resolveTierDir(terraformDir, stage, "app");
@@ -890,21 +664,21 @@ function registerConfigCommand(program2) {
         process.exit(1);
       }
       console.log("");
-      console.log(chalk4.bold.cyan(`  \u2B21 ${env.stage}`));
-      console.log(chalk4.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
-      console.log(`  ${chalk4.bold("Region:")}          ${env.region}`);
-      console.log(`  ${chalk4.bold("Account:")}         ${env.accountId}`);
-      console.log(`  ${chalk4.bold("Database:")}        ${env.databaseEngine}`);
-      console.log(`  ${chalk4.bold("Memory:")}          managed (always on)${env.enableHindsight ? " + hindsight" : ""}`);
-      console.log(`  ${chalk4.bold("Terraform dir:")}   ${env.terraformDir}`);
-      console.log(`  ${chalk4.bold("Created:")}         ${env.createdAt}`);
-      console.log(`  ${chalk4.bold("Updated:")}         ${env.updatedAt}`);
-      console.log(chalk4.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+      console.log(chalk3.bold.cyan(`  \u2B21 ${env.stage}`));
+      console.log(chalk3.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+      console.log(`  ${chalk3.bold("Region:")}          ${env.region}`);
+      console.log(`  ${chalk3.bold("Account:")}         ${env.accountId}`);
+      console.log(`  ${chalk3.bold("Database:")}        ${env.databaseEngine}`);
+      console.log(`  ${chalk3.bold("Memory:")}          managed (always on)${env.enableHindsight ? " + hindsight" : ""}`);
+      console.log(`  ${chalk3.bold("Terraform dir:")}   ${env.terraformDir}`);
+      console.log(`  ${chalk3.bold("Created:")}         ${env.createdAt}`);
+      console.log(`  ${chalk3.bold("Updated:")}         ${env.updatedAt}`);
+      console.log(chalk3.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
       const tfvarsPath = `${env.terraformDir}/terraform.tfvars`;
-      if (existsSync5(tfvarsPath)) {
+      if (existsSync3(tfvarsPath)) {
         console.log("");
-        console.log(chalk4.dim("  terraform.tfvars:"));
-        const content = readFileSync3(tfvarsPath, "utf-8");
+        console.log(chalk3.dim("  terraform.tfvars:"));
+        const content = readFileSync2(tfvarsPath, "utf-8");
         for (const line of content.split("\n")) {
           if (line.trim() && !line.trim().startsWith("#")) {
             const masked = line.replace(
@@ -917,7 +691,7 @@ function registerConfigCommand(program2) {
               /^(google_oauth_client_secret\s*=\s*)".*"/,
               '$1"********"'
             );
-            console.log(`  ${chalk4.dim(masked)}`);
+            console.log(`  ${chalk3.dim(masked)}`);
           }
         }
       }
@@ -928,24 +702,24 @@ function registerConfigCommand(program2) {
     if (envs.length === 0) {
       console.log("");
       console.log("  No environments found.");
-      console.log(`  Run ${chalk4.cyan("thinkwork init -s <stage>")} to create one.`);
+      console.log(`  Run ${chalk3.cyan("thinkwork init -s <stage>")} to create one.`);
       console.log("");
       return;
     }
     console.log("");
-    console.log(chalk4.bold("  Environments"));
-    console.log(chalk4.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+    console.log(chalk3.bold("  Environments"));
+    console.log(chalk3.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
     for (const env of envs) {
-      const memBadge = env.enableHindsight ? chalk4.magenta("managed+hindsight") : chalk4.dim("managed");
-      const dbBadge = env.databaseEngine === "rds-postgres" ? chalk4.yellow("rds") : chalk4.dim("aurora");
+      const memBadge = env.enableHindsight ? chalk3.magenta("managed+hindsight") : chalk3.dim("managed");
+      const dbBadge = env.databaseEngine === "rds-postgres" ? chalk3.yellow("rds") : chalk3.dim("aurora");
       console.log(
-        `  ${chalk4.bold.cyan(env.stage.padEnd(16))}${env.region.padEnd(14)}${env.accountId.padEnd(16)}${dbBadge.padEnd(20)}${memBadge}`
+        `  ${chalk3.bold.cyan(env.stage.padEnd(16))}${env.region.padEnd(14)}${env.accountId.padEnd(16)}${dbBadge.padEnd(20)}${memBadge}`
       );
     }
-    console.log(chalk4.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
-    console.log(chalk4.dim(`  ${envs.length} environment(s)`));
+    console.log(chalk3.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+    console.log(chalk3.dim(`  ${envs.length} environment(s)`));
     console.log("");
-    console.log(`  Show details: ${chalk4.cyan("thinkwork config list -s <stage>")}`);
+    console.log(`  Show details: ${chalk3.cyan("thinkwork config list -s <stage>")}`);
     console.log("");
   });
   config.command("get <key>").description("Get a configuration value (e.g. enable-hindsight). Prompts for stage in a TTY when omitted.").option("-s, --stage <name>", "Deployment stage").action(async (key, opts) => {
@@ -1022,11 +796,11 @@ function registerConfigCommand(program2) {
 }
 
 // src/commands/bootstrap.ts
-import { spawn as spawn3 } from "child_process";
+import { spawn as spawn2 } from "child_process";
 import { resolve } from "path";
 function getTerraformOutput(cwd, key) {
   return new Promise((resolve7, reject) => {
-    const proc = spawn3("terraform", ["output", "-raw", key], {
+    const proc = spawn2("terraform", ["output", "-raw", key], {
       cwd,
       stdio: ["pipe", "pipe", "pipe"]
     });
@@ -1040,7 +814,7 @@ function getTerraformOutput(cwd, key) {
 }
 function runScript(scriptPath, args) {
   return new Promise((resolve7) => {
-    const proc = spawn3("bash", [scriptPath, ...args], {
+    const proc = spawn2("bash", [scriptPath, ...args], {
       stdio: "inherit"
     });
     proc.on("close", (code) => resolve7(code ?? 1));
@@ -1068,8 +842,8 @@ function registerBootstrapCommand(program2) {
       bucket = await getTerraformOutput(cwd, "bucket_name");
       dbEndpoint = await getTerraformOutput(cwd, "db_cluster_endpoint");
       const secretArn = await getTerraformOutput(cwd, "db_secret_arn");
-      const { execSync: execSync11 } = await import("child_process");
-      const secretJson = execSync11(
+      const { execSync: execSync9 } = await import("child_process");
+      const secretJson = execSync9(
         `aws secretsmanager get-secret-value --secret-id "${secretArn}" --query SecretString --output text`,
         { encoding: "utf-8" }
       ).trim();
@@ -1092,17 +866,17 @@ function registerBootstrapCommand(program2) {
 }
 
 // src/commands/login.ts
-import { execSync as execSync6 } from "child_process";
+import { execSync as execSync5 } from "child_process";
 import { createInterface as createInterface2 } from "readline";
 import { select as select2, Separator } from "@inquirer/prompts";
-import chalk7 from "chalk";
+import chalk6 from "chalk";
 
 // src/aws-profiles.ts
-import { existsSync as existsSync6, readFileSync as readFileSync4 } from "fs";
-import { homedir as homedir3 } from "os";
-import { join as join3 } from "path";
-var CREDENTIALS_PATH = join3(homedir3(), ".aws", "credentials");
-var CONFIG_PATH = join3(homedir3(), ".aws", "config");
+import { existsSync as existsSync4, readFileSync as readFileSync3 } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join2 } from "path";
+var CREDENTIALS_PATH = join2(homedir2(), ".aws", "credentials");
+var CONFIG_PATH = join2(homedir2(), ".aws", "config");
 function parseIni(content) {
   const sections = {};
   let current = null;
@@ -1141,8 +915,8 @@ function classify(fields) {
 }
 function listAwsProfiles() {
   const byName = /* @__PURE__ */ new Map();
-  if (existsSync6(CREDENTIALS_PATH)) {
-    const sections = parseIni(readFileSync4(CREDENTIALS_PATH, "utf-8"));
+  if (existsSync4(CREDENTIALS_PATH)) {
+    const sections = parseIni(readFileSync3(CREDENTIALS_PATH, "utf-8"));
     for (const [section, fields] of Object.entries(sections)) {
       byName.set(section, {
         name: section,
@@ -1151,8 +925,8 @@ function listAwsProfiles() {
       });
     }
   }
-  if (existsSync6(CONFIG_PATH)) {
-    const sections = parseIni(readFileSync4(CONFIG_PATH, "utf-8"));
+  if (existsSync4(CONFIG_PATH)) {
+    const sections = parseIni(readFileSync3(CONFIG_PATH, "utf-8"));
     for (const [section, fields] of Object.entries(sections)) {
       const name = normalizeConfigSection(section);
       if (!name) continue;
@@ -1174,14 +948,14 @@ function listAwsProfiles() {
 }
 
 // src/prerequisites.ts
-import { execSync as execSync4 } from "child_process";
-import { mkdirSync as mkdirSync3, createWriteStream, chmodSync } from "fs";
-import { join as join4 } from "path";
-import { homedir as homedir4, platform, arch } from "os";
-import chalk5 from "chalk";
+import { execSync as execSync3 } from "child_process";
+import { mkdirSync as mkdirSync2, createWriteStream, chmodSync } from "fs";
+import { join as join3 } from "path";
+import { homedir as homedir3, platform, arch } from "os";
+import chalk4 from "chalk";
 function run(cmd, opts) {
   try {
-    return execSync4(cmd, {
+    return execSync3(cmd, {
       encoding: "utf-8",
       timeout: 3e4,
       stdio: opts?.silent ? ["pipe", "pipe", "pipe"] : void 0
@@ -1198,27 +972,27 @@ function hasBrew() {
 }
 async function ensureAwsCli() {
   if (isInstalled("aws")) return true;
-  console.log(`  ${chalk5.yellow("\u2192")} AWS CLI not found. Installing...`);
+  console.log(`  ${chalk4.yellow("\u2192")} AWS CLI not found. Installing...`);
   const os = platform();
   if (os === "darwin" && hasBrew()) {
     const result = run("brew install awscli");
     if (result !== null && isInstalled("aws")) {
-      console.log(`  ${chalk5.green("\u2713")} AWS CLI installed via Homebrew`);
+      console.log(`  ${chalk4.green("\u2713")} AWS CLI installed via Homebrew`);
       return true;
     }
   }
   if (os === "linux") {
     try {
-      const tmpDir = join4(homedir4(), ".thinkwork", "tmp");
-      mkdirSync3(tmpDir, { recursive: true });
-      const zipPath = join4(tmpDir, "awscliv2.zip");
+      const tmpDir = join3(homedir3(), ".thinkwork", "tmp");
+      mkdirSync2(tmpDir, { recursive: true });
+      const zipPath = join3(tmpDir, "awscliv2.zip");
       console.log("    Downloading AWS CLI...");
       run(`curl -sL "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "${zipPath}"`);
       run(`cd "${tmpDir}" && unzip -qo "${zipPath}"`);
-      run(`"${tmpDir}/aws/install" --install-dir "${homedir4()}/.thinkwork/aws-cli" --bin-dir "${homedir4()}/.local/bin" --update`);
-      process.env.PATH = `${homedir4()}/.local/bin:${process.env.PATH}`;
+      run(`"${tmpDir}/aws/install" --install-dir "${homedir3()}/.thinkwork/aws-cli" --bin-dir "${homedir3()}/.local/bin" --update`);
+      process.env.PATH = `${homedir3()}/.local/bin:${process.env.PATH}`;
       if (isInstalled("aws")) {
-        console.log(`  ${chalk5.green("\u2713")} AWS CLI installed to ~/.local/bin/aws`);
+        console.log(`  ${chalk4.green("\u2713")} AWS CLI installed to ~/.local/bin/aws`);
         return true;
       }
     } catch {
@@ -1226,31 +1000,31 @@ async function ensureAwsCli() {
   }
   if (os === "darwin") {
     try {
-      const tmpDir = join4(homedir4(), ".thinkwork", "tmp");
-      mkdirSync3(tmpDir, { recursive: true });
-      const pkgPath = join4(tmpDir, "AWSCLIV2.pkg");
+      const tmpDir = join3(homedir3(), ".thinkwork", "tmp");
+      mkdirSync2(tmpDir, { recursive: true });
+      const pkgPath = join3(tmpDir, "AWSCLIV2.pkg");
       console.log("    Downloading AWS CLI...");
       run(`curl -sL "https://awscli.amazonaws.com/AWSCLIV2.pkg" -o "${pkgPath}"`);
       run(`installer -pkg "${pkgPath}" -target CurrentUserHomeDirectory 2>/dev/null || sudo installer -pkg "${pkgPath}" -target /`);
       if (isInstalled("aws")) {
-        console.log(`  ${chalk5.green("\u2713")} AWS CLI installed`);
+        console.log(`  ${chalk4.green("\u2713")} AWS CLI installed`);
         return true;
       }
     } catch {
     }
   }
-  console.log(`  ${chalk5.red("\u2717")} Could not auto-install AWS CLI.`);
-  console.log(`    Install manually: ${chalk5.cyan("https://aws.amazon.com/cli/")}`);
+  console.log(`  ${chalk4.red("\u2717")} Could not auto-install AWS CLI.`);
+  console.log(`    Install manually: ${chalk4.cyan("https://aws.amazon.com/cli/")}`);
   return false;
 }
 async function ensureTerraform() {
   if (isInstalled("terraform")) return true;
-  console.log(`  ${chalk5.yellow("\u2192")} Terraform not found. Installing...`);
+  console.log(`  ${chalk4.yellow("\u2192")} Terraform not found. Installing...`);
   const os = platform();
   if ((os === "darwin" || os === "linux") && hasBrew()) {
     const result = run("brew install hashicorp/tap/terraform");
     if (result !== null && isInstalled("terraform")) {
-      console.log(`  ${chalk5.green("\u2713")} Terraform installed via Homebrew`);
+      console.log(`  ${chalk4.green("\u2713")} Terraform installed via Homebrew`);
       return true;
     }
   }
@@ -1259,30 +1033,30 @@ async function ensureTerraform() {
   const archName = arch() === "arm64" ? "arm64" : "amd64";
   const url = `https://releases.hashicorp.com/terraform/${tfVersion}/terraform_${tfVersion}_${osName}_${archName}.zip`;
   try {
-    const tmpDir = join4(homedir4(), ".thinkwork", "tmp");
-    const binDir = join4(homedir4(), ".local", "bin");
-    mkdirSync3(tmpDir, { recursive: true });
-    mkdirSync3(binDir, { recursive: true });
-    const zipPath = join4(tmpDir, "terraform.zip");
+    const tmpDir = join3(homedir3(), ".thinkwork", "tmp");
+    const binDir = join3(homedir3(), ".local", "bin");
+    mkdirSync2(tmpDir, { recursive: true });
+    mkdirSync2(binDir, { recursive: true });
+    const zipPath = join3(tmpDir, "terraform.zip");
     console.log(`    Downloading Terraform ${tfVersion}...`);
     run(`curl -sL "${url}" -o "${zipPath}"`);
     run(`unzip -qo "${zipPath}" -d "${binDir}"`);
-    chmodSync(join4(binDir, "terraform"), 493);
+    chmodSync(join3(binDir, "terraform"), 493);
     if (!process.env.PATH?.includes(binDir)) {
       process.env.PATH = `${binDir}:${process.env.PATH}`;
     }
     if (isInstalled("terraform")) {
-      console.log(`  ${chalk5.green("\u2713")} Terraform ${tfVersion} installed to ~/.local/bin/terraform`);
+      console.log(`  ${chalk4.green("\u2713")} Terraform ${tfVersion} installed to ~/.local/bin/terraform`);
       return true;
     }
   } catch {
   }
-  console.log(`  ${chalk5.red("\u2717")} Could not auto-install Terraform.`);
-  console.log(`    Install manually: ${chalk5.cyan("https://developer.hashicorp.com/terraform/install")}`);
+  console.log(`  ${chalk4.red("\u2717")} Could not auto-install Terraform.`);
+  console.log(`    Install manually: ${chalk4.cyan("https://developer.hashicorp.com/terraform/install")}`);
   return false;
 }
 async function ensurePrerequisites() {
-  console.log(chalk5.dim("  Checking prerequisites...\n"));
+  console.log(chalk4.dim("  Checking prerequisites...\n"));
   const awsOk2 = await ensureAwsCli();
   const tfOk = await ensureTerraform();
   if (awsOk2 && tfOk) {
@@ -1290,15 +1064,15 @@ async function ensurePrerequisites() {
     return true;
   }
   console.log("");
-  console.log(`  ${chalk5.red("Missing prerequisites.")} Install them and try again.`);
+  console.log(`  ${chalk4.red("Missing prerequisites.")} Install them and try again.`);
   return false;
 }
 
 // src/cognito-discovery.ts
-import { execSync as execSync5 } from "child_process";
-function runAws2(cmd) {
+import { execSync as execSync4 } from "child_process";
+function runAws(cmd) {
   try {
-    return execSync5(`aws ${cmd}`, {
+    return execSync4(`aws ${cmd}`, {
       encoding: "utf-8",
       timeout: 15e3,
       stdio: ["pipe", "pipe", "pipe"]
@@ -1318,7 +1092,7 @@ function tryTerraformOutput(stage) {
   }
   const read = (key) => {
     try {
-      return execSync5(`terraform output -raw ${key}`, {
+      return execSync4(`terraform output -raw ${key}`, {
         cwd,
         encoding: "utf-8",
         timeout: 15e3,
@@ -1334,7 +1108,7 @@ function tryTerraformOutput(stage) {
   return { userPoolId, clientId, domain };
 }
 function tryAwsDiscovery(stage, region) {
-  const listRaw = runAws2(
+  const listRaw = runAws(
     `cognito-idp list-user-pools --max-results 60 --region ${region} --output json`
   );
   if (!listRaw) return {};
@@ -1346,7 +1120,7 @@ function tryAwsDiscovery(stage, region) {
     )
   );
   if (!pool) return {};
-  const clientsRaw = runAws2(
+  const clientsRaw = runAws(
     `cognito-idp list-user-pool-clients --user-pool-id ${pool.Id} --region ${region} --output json`
   );
   let clientId;
@@ -1379,8 +1153,8 @@ function discoverCognitoConfig(stage, region) {
 // src/cognito-oauth.ts
 import { createServer } from "http";
 import { randomBytes } from "crypto";
-import { spawn as spawn4 } from "child_process";
-import chalk6 from "chalk";
+import { spawn as spawn3 } from "child_process";
+import chalk5 from "chalk";
 var CLI_LOOPBACK_PORT = 42010;
 var CALLBACK_PATH = "/callback";
 var DEFAULT_TIMEOUT_MS = 5 * 60 * 1e3;
@@ -1396,9 +1170,9 @@ async function loginWithCognito(opts) {
     timeoutMs,
     onListening: () => {
       logStderr("");
-      logStderr(`  ${chalk6.cyan("Opening browser to sign in\u2026")}`);
-      logStderr(`  ${chalk6.dim("If it doesn't open automatically, visit:")}`);
-      logStderr(`  ${chalk6.dim(authorizeUrl)}`);
+      logStderr(`  ${chalk5.cyan("Opening browser to sign in\u2026")}`);
+      logStderr(`  ${chalk5.dim("If it doesn't open automatically, visit:")}`);
+      logStderr(`  ${chalk5.dim(authorizeUrl)}`);
       logStderr("");
       if (opts.openBrowser !== false) {
         (opts.launchBrowser ?? openInBrowser)(authorizeUrl);
@@ -1558,7 +1332,7 @@ function openInBrowser(url) {
   const cmd = platform2 === "darwin" ? "open" : platform2 === "win32" ? "cmd" : "xdg-open";
   const args = platform2 === "win32" ? ["/c", "start", "", url] : [url];
   try {
-    spawn4(cmd, args, { stdio: "ignore", detached: true }).unref();
+    spawn3(cmd, args, { stdio: "ignore", detached: true }).unref();
   } catch {
   }
 }
@@ -1629,7 +1403,7 @@ function ask(prompt) {
 }
 function verifyProfile(profile) {
   try {
-    const raw = execSync6(
+    const raw = execSync5(
       `aws sts get-caller-identity --profile ${profile} --output json`,
       { encoding: "utf-8", timeout: 15e3, stdio: ["pipe", "pipe", "pipe"] }
     );
@@ -1659,7 +1433,7 @@ async function pickProfile(profiles) {
     return { kind: "cancel" };
   }
   const choices = profiles.map((p) => ({
-    name: `${p.name}  ${chalk7.dim(`(${describeType(p.type)})`)}`,
+    name: `${p.name}  ${chalk6.dim(`(${describeType(p.type)})`)}`,
     value: { kind: "existing", name: p.name }
   }));
   choices.push(new Separator());
@@ -1706,15 +1480,15 @@ async function runKeyEntry(targetProfile) {
   const region = await ask("  Default region [us-east-1]: ");
   const finalRegion = region || "us-east-1";
   try {
-    execSync6(
+    execSync5(
       `aws configure set aws_access_key_id "${accessKeyId}" --profile ${targetProfile}`,
       { stdio: "pipe" }
     );
-    execSync6(
+    execSync5(
       `aws configure set aws_secret_access_key "${secretAccessKey}" --profile ${targetProfile}`,
       { stdio: "pipe" }
     );
-    execSync6(
+    execSync5(
       `aws configure set region "${finalRegion}" --profile ${targetProfile}`,
       { stdio: "pipe" }
     );
@@ -1728,7 +1502,7 @@ function runSsoLogin(targetProfile) {
   console.log("  Launching AWS SSO login...");
   console.log("");
   try {
-    execSync6(`aws sso login --profile ${targetProfile}`, { stdio: "inherit" });
+    execSync5(`aws sso login --profile ${targetProfile}`, { stdio: "inherit" });
     return true;
   } catch {
     printError(
@@ -1757,7 +1531,7 @@ function finalizeAws(profile, mode) {
     `  (\`thinkwork list\`, \`thinkwork deploy\`, \u2026) will use it automatically.`
   );
   console.log(
-    chalk7.dim(
+    chalk6.dim(
       `  Override per-command with --profile <other>, or unset with \`rm ~/.thinkwork/config.json\`.`
     )
   );
@@ -1771,10 +1545,10 @@ async function offerApiLoginChain(opts) {
   if (candidates.length === 0 || !isInteractive()) {
     console.log("");
     console.log(
-      `  ${chalk7.bold("Next:")} run ${chalk7.cyan("thinkwork login --stage <stage>")} if you also need`
+      `  ${chalk6.bold("Next:")} run ${chalk6.cyan("thinkwork login --stage <stage>")} if you also need`
     );
     console.log(
-      `        an API session (required for ${chalk7.cyan("eval")}, ${chalk7.cyan("agent")}, ${chalk7.cyan("thread")}, etc.).`
+      `        an API session (required for ${chalk6.cyan("eval")}, ${chalk6.cyan("agent")}, ${chalk6.cyan("thread")}, etc.).`
     );
     return;
   }
@@ -1808,8 +1582,8 @@ async function offerApiLoginChain(opts) {
   if (!chosen) {
     console.log("");
     console.log(
-      chalk7.dim(
-        `  Skipped. Run ${chalk7.cyan("thinkwork login --stage <stage>")} later for an API session.`
+      chalk6.dim(
+        `  Skipped. Run ${chalk6.cyan("thinkwork login --stage <stage>")} later for an API session.`
       )
     );
     return;
@@ -1906,7 +1680,7 @@ async function doCognitoLogin(opts) {
     }
     console.log("");
     console.log(
-      chalk7.dim(
+      chalk6.dim(
         `  Token expires: ${new Date(tokens.expiresAt * 1e3).toISOString()}. Refreshed automatically.`
       )
     );
@@ -2060,9 +1834,9 @@ Registered callback URL:
       const profiles = listAwsProfiles();
       if (profiles.length === 0) {
         console.log("");
-        console.log(chalk7.dim("  No AWS profiles found in ~/.aws/."));
+        console.log(chalk6.dim("  No AWS profiles found in ~/.aws/."));
         console.log(
-          chalk7.dim("  Falling through to access-key entry for a new profile.")
+          chalk6.dim("  Falling through to access-key entry for a new profile.")
         );
         if (!await runKeyEntry(targetProfile)) process.exit(1);
         process.env.AWS_PROFILE = targetProfile;
@@ -2073,7 +1847,7 @@ Registered callback URL:
       const choice = await pickProfile(profiles);
       if (choice.kind === "cancel") {
         console.log("");
-        console.log(chalk7.dim("  Cancelled. No changes made."));
+        console.log(chalk6.dim("  Cancelled. No changes made."));
         return;
       }
       if (choice.kind === "keys") {
@@ -2174,16 +1948,16 @@ Examples:
 }
 
 // src/commands/init.ts
-import { existsSync as existsSync8, mkdirSync as mkdirSync4, writeFileSync as writeFileSync4, cpSync } from "fs";
-import { resolve as resolve2, join as join5, dirname as dirname3 } from "path";
-import { execSync as execSync7 } from "child_process";
+import { existsSync as existsSync6, mkdirSync as mkdirSync3, writeFileSync as writeFileSync3, cpSync } from "fs";
+import { resolve as resolve2, join as join4, dirname as dirname3 } from "path";
+import { execSync as execSync6 } from "child_process";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { createInterface as createInterface3 } from "readline";
-import chalk8 from "chalk";
+import chalk7 from "chalk";
 var __dirname = dirname3(fileURLToPath2(import.meta.url));
 function ask2(prompt, defaultVal = "") {
   const rl = createInterface3({ input: process.stdin, output: process.stdout });
-  const suffix = defaultVal ? chalk8.dim(` [${defaultVal}]`) : "";
+  const suffix = defaultVal ? chalk7.dim(` [${defaultVal}]`) : "";
   return new Promise((resolve7) => {
     rl.question(`  ${prompt}${suffix}: `, (answer) => {
       rl.close();
@@ -2192,7 +1966,7 @@ function ask2(prompt, defaultVal = "") {
   });
 }
 function choose(prompt, options, defaultVal) {
-  const optStr = options.map((o) => o === defaultVal ? chalk8.bold(o) : chalk8.dim(o)).join(" / ");
+  const optStr = options.map((o) => o === defaultVal ? chalk7.bold(o) : chalk7.dim(o)).join(" / ");
   return ask2(`${prompt} (${optStr})`, defaultVal);
 }
 function generateSecret(length = 32) {
@@ -2205,9 +1979,9 @@ function generateSecret(length = 32) {
 }
 function findBundledTerraform() {
   const bundled = resolve2(__dirname, "terraform");
-  if (existsSync8(join5(bundled, "modules"))) return bundled;
+  if (existsSync6(join4(bundled, "modules"))) return bundled;
   const repoTf = resolve2(__dirname, "..", "..", "..", "terraform");
-  if (existsSync8(join5(repoTf, "modules"))) return repoTf;
+  if (existsSync6(join4(repoTf, "modules"))) return repoTf;
   throw new Error(
     "Terraform modules not found. The CLI package may be incomplete.\nTry reinstalling: npm install -g thinkwork-cli@latest"
   );
@@ -2297,9 +2071,9 @@ function registerInitCommand(program2) {
       process.exit(1);
     }
     const targetDir = resolve2(opts.dir);
-    const tfDir = join5(targetDir, "terraform");
-    const tfvarsPath = join5(tfDir, "terraform.tfvars");
-    if (existsSync8(tfvarsPath)) {
+    const tfDir = join4(targetDir, "terraform");
+    const tfvarsPath = join4(tfDir, "terraform.tfvars");
+    if (existsSync6(tfvarsPath)) {
       printWarning(`terraform.tfvars already exists at ${tfvarsPath}`);
       const overwrite = await ask2("Overwrite?", "N");
       if (overwrite.toLowerCase() !== "y") {
@@ -2323,21 +2097,21 @@ function registerInitCommand(program2) {
       config.admin_url = "http://localhost:5174";
       config.mobile_scheme = "thinkwork";
     } else {
-      console.log(chalk8.bold("  Configure your Thinkwork environment\n"));
+      console.log(chalk7.bold("  Configure your Thinkwork environment\n"));
       const defaultRegion = identity.region !== "unknown" ? identity.region : "us-east-1";
       config.region = await ask2("AWS Region", defaultRegion);
       console.log("");
-      console.log(chalk8.dim("  \u2500\u2500 Database \u2500\u2500"));
+      console.log(chalk7.dim("  \u2500\u2500 Database \u2500\u2500"));
       config.database_engine = await choose("Database engine", ["aurora-serverless", "rds-postgres"], "aurora-serverless");
       console.log("");
-      console.log(chalk8.dim("  \u2500\u2500 Memory \u2500\u2500"));
-      console.log(chalk8.dim("  AgentCore managed memory is always on (automatic retention)."));
-      console.log(chalk8.dim("  Hindsight is an optional add-on: ECS Fargate service for"));
-      console.log(chalk8.dim("  semantic + entity-graph retrieval (~$75/mo)."));
+      console.log(chalk7.dim("  \u2500\u2500 Memory \u2500\u2500"));
+      console.log(chalk7.dim("  AgentCore managed memory is always on (automatic retention)."));
+      console.log(chalk7.dim("  Hindsight is an optional add-on: ECS Fargate service for"));
+      console.log(chalk7.dim("  semantic + entity-graph retrieval (~$75/mo)."));
       const hindsightAnswer = await ask2("Enable Hindsight long-term memory add-on? (y/N)", "N");
       config.enable_hindsight = hindsightAnswer.toLowerCase() === "y" ? "true" : "false";
       console.log("");
-      console.log(chalk8.dim("  \u2500\u2500 Auth \u2500\u2500"));
+      console.log(chalk7.dim("  \u2500\u2500 Auth \u2500\u2500"));
       const useGoogle = await ask2("Enable Google OAuth login? (y/N)", "N");
       if (useGoogle.toLowerCase() === "y") {
         config.google_oauth_client_id = await ask2("Google OAuth Client ID");
@@ -2347,13 +2121,13 @@ function registerInitCommand(program2) {
         config.google_oauth_client_secret = "";
       }
       console.log("");
-      console.log(chalk8.dim("  \u2500\u2500 Frontend URLs \u2500\u2500"));
+      console.log(chalk7.dim("  \u2500\u2500 Frontend URLs \u2500\u2500"));
       config.admin_url = await ask2("Admin UI URL", "http://localhost:5174");
       config.mobile_scheme = await ask2("Mobile app URL scheme", "thinkwork");
       console.log("");
-      console.log(chalk8.dim("  \u2500\u2500 Secrets (auto-generated) \u2500\u2500"));
-      console.log(chalk8.dim(`  DB password:     ${config.db_password.slice(0, 8)}...`));
-      console.log(chalk8.dim(`  API auth secret: ${config.api_auth_secret.slice(0, 16)}...`));
+      console.log(chalk7.dim("  \u2500\u2500 Secrets (auto-generated) \u2500\u2500"));
+      console.log(chalk7.dim(`  DB password:     ${config.db_password.slice(0, 8)}...`));
+      console.log(chalk7.dim(`  API auth secret: ${config.api_auth_secret.slice(0, 16)}...`));
     }
     console.log("");
     console.log("  Scaffolding Terraform modules...");
@@ -2364,24 +2138,24 @@ function registerInitCommand(program2) {
       printError(String(err));
       process.exit(1);
     }
-    mkdirSync4(tfDir, { recursive: true });
+    mkdirSync3(tfDir, { recursive: true });
     const copyDirs = ["modules", "examples"];
     for (const dir of copyDirs) {
-      const src = join5(bundledTf, dir);
-      const dst = join5(tfDir, dir);
-      if (existsSync8(src) && !existsSync8(dst)) {
+      const src = join4(bundledTf, dir);
+      const dst = join4(tfDir, dir);
+      if (existsSync6(src) && !existsSync6(dst)) {
         cpSync(src, dst, { recursive: true });
       }
     }
-    const schemaPath = join5(bundledTf, "schema.graphql");
-    if (existsSync8(schemaPath) && !existsSync8(join5(tfDir, "schema.graphql"))) {
-      cpSync(schemaPath, join5(tfDir, "schema.graphql"));
+    const schemaPath = join4(bundledTf, "schema.graphql");
+    if (existsSync6(schemaPath) && !existsSync6(join4(tfDir, "schema.graphql"))) {
+      cpSync(schemaPath, join4(tfDir, "schema.graphql"));
     }
     const tfvars = buildTfvars(config);
-    writeFileSync4(tfvarsPath, tfvars);
-    const mainTfPath = join5(tfDir, "main.tf");
-    if (!existsSync8(mainTfPath)) {
-      writeFileSync4(mainTfPath, `################################################################################
+    writeFileSync3(tfvarsPath, tfvars);
+    const mainTfPath = join4(tfDir, "main.tf");
+    if (!existsSync6(mainTfPath)) {
+      writeFileSync3(mainTfPath, `################################################################################
 # Thinkwork \u2014 ${config.stage}
 # Generated by: thinkwork init -s ${config.stage}
 ################################################################################
@@ -2558,20 +2332,20 @@ output "agentcore_memory_id" {
 }
 `);
     }
-    console.log(`  Wrote ${chalk8.cyan(tfDir + "/")}`);
+    console.log(`  Wrote ${chalk7.cyan(tfDir + "/")}`);
     console.log("");
-    console.log(chalk8.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
-    console.log(`  ${chalk8.bold("Stage:")}           ${config.stage}`);
-    console.log(`  ${chalk8.bold("Region:")}          ${config.region}`);
-    console.log(`  ${chalk8.bold("Account:")}         ${config.account_id}`);
-    console.log(`  ${chalk8.bold("Database:")}        ${config.database_engine}`);
-    console.log(`  ${chalk8.bold("Memory:")}          managed (always on)${config.enable_hindsight === "true" ? " + hindsight" : ""}`);
-    console.log(`  ${chalk8.bold("Google OAuth:")}    ${config.google_oauth_client_id ? "enabled" : "disabled"}`);
-    console.log(`  ${chalk8.bold("Directory:")}       ${tfDir}`);
-    console.log(chalk8.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+    console.log(chalk7.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+    console.log(`  ${chalk7.bold("Stage:")}           ${config.stage}`);
+    console.log(`  ${chalk7.bold("Region:")}          ${config.region}`);
+    console.log(`  ${chalk7.bold("Account:")}         ${config.account_id}`);
+    console.log(`  ${chalk7.bold("Database:")}        ${config.database_engine}`);
+    console.log(`  ${chalk7.bold("Memory:")}          managed (always on)${config.enable_hindsight === "true" ? " + hindsight" : ""}`);
+    console.log(`  ${chalk7.bold("Google OAuth:")}    ${config.google_oauth_client_id ? "enabled" : "disabled"}`);
+    console.log(`  ${chalk7.bold("Directory:")}       ${tfDir}`);
+    console.log(chalk7.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
     console.log("\n  Initializing Terraform...\n");
     try {
-      execSync7("terraform init", { cwd: tfDir, stdio: "inherit" });
+      execSync6("terraform init", { cwd: tfDir, stdio: "inherit" });
     } catch {
       printWarning("Terraform init failed. Run `thinkwork doctor -s " + stage + "` to check prerequisites.");
       return;
@@ -2590,24 +2364,24 @@ output "agentcore_memory_id" {
     printSuccess(`Environment "${stage}" initialized`);
     console.log("");
     console.log("  Next steps:");
-    console.log(`    ${chalk8.cyan("1.")} thinkwork plan -s ${stage}        ${chalk8.dim("# Review infrastructure plan")}`);
-    console.log(`    ${chalk8.cyan("2.")} thinkwork deploy -s ${stage}       ${chalk8.dim("# Deploy to AWS (~5 min)")}`);
-    console.log(`    ${chalk8.cyan("3.")} thinkwork bootstrap -s ${stage}    ${chalk8.dim("# Seed workspace files + skills")}`);
-    console.log(`    ${chalk8.cyan("4.")} thinkwork outputs -s ${stage}      ${chalk8.dim("# Show API URL, Cognito IDs, etc.")}`);
+    console.log(`    ${chalk7.cyan("1.")} thinkwork plan -s ${stage}        ${chalk7.dim("# Review infrastructure plan")}`);
+    console.log(`    ${chalk7.cyan("2.")} thinkwork deploy -s ${stage}       ${chalk7.dim("# Deploy to AWS (~5 min)")}`);
+    console.log(`    ${chalk7.cyan("3.")} thinkwork bootstrap -s ${stage}    ${chalk7.dim("# Seed workspace files + skills")}`);
+    console.log(`    ${chalk7.cyan("4.")} thinkwork outputs -s ${stage}      ${chalk7.dim("# Show API URL, Cognito IDs, etc.")}`);
     console.log("");
   });
 }
 
 // src/commands/status.ts
-import { execSync as execSync8 } from "child_process";
-import chalk9 from "chalk";
+import { execSync as execSync7 } from "child_process";
+import chalk8 from "chalk";
 function link(url, label) {
   const text = label || url;
   return `\x1B]8;;${url}\x1B\\${text}\x1B]8;;\x1B\\`;
 }
-function runAws3(cmd) {
+function runAws2(cmd) {
   try {
-    return execSync8(`aws ${cmd}`, {
+    return execSync7(`aws ${cmd}`, {
       encoding: "utf-8",
       timeout: 15e3,
       stdio: ["pipe", "pipe", "pipe"]
@@ -2618,7 +2392,7 @@ function runAws3(cmd) {
 }
 function discoverAwsStages(region) {
   const stages = /* @__PURE__ */ new Map();
-  const raw = runAws3(
+  const raw = runAws2(
     `lambda list-functions --region ${region} --query "Functions[?starts_with(FunctionName, 'thinkwork-')].FunctionName" --output json`
   );
   if (!raw) return stages;
@@ -2633,38 +2407,38 @@ function discoverAwsStages(region) {
   for (const [stage, info] of stages) {
     const count = functions.filter((f) => f.startsWith(`thinkwork-${stage}-`)).length;
     info.lambdaCount = count;
-    const apiRaw = runAws3(
+    const apiRaw = runAws2(
       `apigatewayv2 get-apis --region ${region} --query "Items[?Name=='thinkwork-${stage}-api'].ApiEndpoint|[0]" --output text`
     );
     if (apiRaw && apiRaw !== "None") info.apiEndpoint = apiRaw;
-    const appsyncRaw = runAws3(
+    const appsyncRaw = runAws2(
       `appsync list-graphql-apis --region ${region} --query "graphqlApis[?name=='thinkwork-${stage}-subscriptions'].uris.REALTIME|[0]" --output text`
     );
     if (appsyncRaw && appsyncRaw !== "None") info.appsyncUrl = appsyncRaw;
-    const appsyncApiRaw = runAws3(
+    const appsyncApiRaw = runAws2(
       `appsync list-graphql-apis --region ${region} --query "graphqlApis[?name=='thinkwork-${stage}-subscriptions'].uris.GRAPHQL|[0]" --output text`
     );
     if (appsyncApiRaw && appsyncApiRaw !== "None") info.appsyncApiUrl = appsyncApiRaw;
-    const acRaw = runAws3(
+    const acRaw = runAws2(
       `lambda get-function --function-name thinkwork-${stage}-agentcore --region ${region} --query "Configuration.State" --output text 2>/dev/null`
     );
     info.agentcoreStatus = acRaw || "not deployed";
-    const bucketRaw = runAws3(
+    const bucketRaw = runAws2(
       `s3api head-bucket --bucket thinkwork-${stage}-storage --region ${region} 2>/dev/null && echo "exists"`
     );
     info.bucketName = bucketRaw ? `thinkwork-${stage}-storage` : void 0;
-    const ecsRaw = runAws3(
+    const ecsRaw = runAws2(
       `ecs describe-services --cluster thinkwork-${stage}-cluster --services thinkwork-${stage}-hindsight --region ${region} --query "services[0].runningCount" --output text 2>/dev/null`
     );
     if (ecsRaw && ecsRaw !== "None" && ecsRaw !== "0") {
       info.hindsightEnabled = true;
-      const albRaw = runAws3(
+      const albRaw = runAws2(
         `elbv2 describe-load-balancers --region ${region} --query "LoadBalancers[?contains(LoadBalancerName, 'tw-${stage}-hindsight')].DNSName|[0]" --output text`
       );
       if (albRaw && albRaw !== "None") {
         info.hindsightEndpoint = `http://${albRaw}`;
         try {
-          const health = execSync8(`curl -s --max-time 3 http://${albRaw}/health`, { encoding: "utf-8" }).trim();
+          const health = execSync7(`curl -s --max-time 3 http://${albRaw}/health`, { encoding: "utf-8" }).trim();
           info.hindsightHealth = health.includes("healthy") ? "healthy" : "unhealthy";
         } catch {
           info.hindsightHealth = "unreachable";
@@ -2673,15 +2447,15 @@ function discoverAwsStages(region) {
     } else {
       info.hindsightEnabled = false;
     }
-    const dbRaw = runAws3(
+    const dbRaw = runAws2(
       `rds describe-db-clusters --region ${region} --query "DBClusters[?starts_with(DBClusterIdentifier, 'thinkwork-${stage}')].Endpoint|[0]" --output text`
     );
     if (dbRaw && dbRaw !== "None") info.dbEndpoint = dbRaw;
-    const ecrRaw = runAws3(
+    const ecrRaw = runAws2(
       `ecr describe-repositories --region ${region} --query "repositories[?repositoryName=='thinkwork-${stage}-agentcore'].repositoryUri|[0]" --output text`
     );
     if (ecrRaw && ecrRaw !== "None") info.ecrUrl = ecrRaw;
-    const cfJson = runAws3(
+    const cfJson = runAws2(
       `cloudfront list-distributions --query "DistributionList.Items[?contains(Origins.Items[0].DomainName, 'thinkwork-${stage}-')].{Origin:Origins.Items[0].DomainName,Domain:DomainName}" --output json`
     );
     if (cfJson) {
@@ -2698,33 +2472,33 @@ function discoverAwsStages(region) {
   return stages;
 }
 function printStageDetail(info) {
-  console.log(chalk9.bold.cyan(`  \u2B21 ${info.stage}`));
-  console.log(chalk9.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
-  console.log(`  ${chalk9.bold("Source:")}          ${info.source === "both" ? "AWS + local config" : info.source === "aws" ? "AWS (no local config)" : "local only (not in AWS)"}`);
-  console.log(`  ${chalk9.bold("Region:")}          ${info.region}`);
-  console.log(`  ${chalk9.bold("Account:")}         ${info.accountId}`);
-  console.log(`  ${chalk9.bold("Lambda fns:")}      ${info.lambdaCount || "\u2014"}`);
-  console.log(`  ${chalk9.bold("AgentCore:")}       ${info.agentcoreStatus || "unknown"}`);
-  console.log(`  ${chalk9.bold("Memory:")}          managed (always on)`);
+  console.log(chalk8.bold.cyan(`  \u2B21 ${info.stage}`));
+  console.log(chalk8.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+  console.log(`  ${chalk8.bold("Source:")}          ${info.source === "both" ? "AWS + local config" : info.source === "aws" ? "AWS (no local config)" : "local only (not in AWS)"}`);
+  console.log(`  ${chalk8.bold("Region:")}          ${info.region}`);
+  console.log(`  ${chalk8.bold("Account:")}         ${info.accountId}`);
+  console.log(`  ${chalk8.bold("Lambda fns:")}      ${info.lambdaCount || "\u2014"}`);
+  console.log(`  ${chalk8.bold("AgentCore:")}       ${info.agentcoreStatus || "unknown"}`);
+  console.log(`  ${chalk8.bold("Memory:")}          managed (always on)`);
   const hindsightLabel = info.hindsightEnabled === void 0 ? "unknown" : info.hindsightEnabled ? info.hindsightHealth || "running" : "disabled";
-  console.log(`  ${chalk9.bold("Hindsight:")}       ${hindsightLabel}`);
-  if (info.bucketName) console.log(`  ${chalk9.bold("S3 bucket:")}       ${info.bucketName}`);
-  if (info.dbEndpoint) console.log(`  ${chalk9.bold("Database:")}        ${info.dbEndpoint}`);
-  if (info.ecrUrl) console.log(`  ${chalk9.bold("ECR:")}             ${info.ecrUrl}`);
+  console.log(`  ${chalk8.bold("Hindsight:")}       ${hindsightLabel}`);
+  if (info.bucketName) console.log(`  ${chalk8.bold("S3 bucket:")}       ${info.bucketName}`);
+  if (info.dbEndpoint) console.log(`  ${chalk8.bold("Database:")}        ${info.dbEndpoint}`);
+  if (info.ecrUrl) console.log(`  ${chalk8.bold("ECR:")}             ${info.ecrUrl}`);
   console.log("");
-  console.log(chalk9.bold("  URLs:"));
+  console.log(chalk8.bold("  URLs:"));
   if (info.adminUrl) console.log(`    Admin:     ${link(info.adminUrl)}`);
   if (info.docsUrl) console.log(`    Docs:      ${link(info.docsUrl)}`);
   if (info.apiEndpoint) console.log(`    API:       ${link(info.apiEndpoint)}`);
   if (info.appsyncApiUrl) console.log(`    AppSync:   ${link(info.appsyncApiUrl)}`);
   if (info.appsyncUrl) console.log(`    WebSocket: ${link(info.appsyncUrl)}`);
   if (info.hindsightEndpoint) console.log(`    Hindsight: ${link(info.hindsightEndpoint)}`);
-  console.log(chalk9.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+  console.log(chalk8.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
   const local = loadEnvironment(info.stage);
   if (local) {
-    console.log(chalk9.dim(`  Terraform dir: ${local.terraformDir}`));
+    console.log(chalk8.dim(`  Terraform dir: ${local.terraformDir}`));
   } else {
-    console.log(chalk9.dim(`  No local config. Run: thinkwork init -s ${info.stage}`));
+    console.log(chalk8.dim(`  No local config. Run: thinkwork init -s ${info.stage}`));
   }
   console.log("");
 }
@@ -2761,7 +2535,7 @@ and AgentCore for per-stage detail.
       printError("AWS credentials not configured. Run `thinkwork login` first.");
       process.exit(1);
     }
-    console.log(chalk9.dim("  Scanning AWS account for Thinkwork deployments...\n"));
+    console.log(chalk8.dim("  Scanning AWS account for Thinkwork deployments...\n"));
     const awsStages = discoverAwsStages(opts.region);
     const localEnvs = listEnvironments();
     const merged = /* @__PURE__ */ new Map();
@@ -2796,7 +2570,7 @@ and AgentCore for per-stage detail.
     }
     if (merged.size === 0) {
       console.log("  No Thinkwork environments found.");
-      console.log(`  Run ${chalk9.cyan("thinkwork init -s <stage>")} to create one.`);
+      console.log(`  Run ${chalk8.cyan("thinkwork init -s <stage>")} to create one.`);
       console.log("");
       return;
     }
@@ -2807,7 +2581,7 @@ and AgentCore for per-stage detail.
 }
 
 // src/commands/mcp.ts
-import chalk10 from "chalk";
+import chalk9 from "chalk";
 
 // ../../packages/admin-ops/src/client.ts
 var AdminOpsError = class extends Error {
@@ -2823,7 +2597,7 @@ var AdminOpsError = class extends Error {
 function createClient(config) {
   const fetchImpl = config.fetchImpl ?? fetch;
   const base = config.apiUrl.replace(/\/+$/, "");
-  const doFetch = async (path2, init = {}) => {
+  const doFetch = async (path, init = {}) => {
     const headers = {
       "Content-Type": "application/json",
       Authorization: `Bearer ${config.authSecret}`,
@@ -2833,7 +2607,7 @@ function createClient(config) {
     if (config.principalEmail) headers["x-principal-email"] = config.principalEmail;
     if (config.tenantId) headers["x-tenant-id"] = config.tenantId;
     if (config.agentId) headers["x-agent-id"] = config.agentId;
-    const res = await fetchImpl(`${base}${path2}`, {
+    const res = await fetchImpl(`${base}${path}`, {
       ...init,
       headers: { ...headers, ...init.headers }
     });
@@ -2919,87 +2693,6 @@ async function revokeAdminKey(client, tenantIdOrSlug, keyId) {
   );
 }
 
-// src/api-client.ts
-import { readFileSync as readFileSync5, existsSync as existsSync9 } from "fs";
-import { execSync as execSync9 } from "child_process";
-function readTfVar2(tfvarsPath, key) {
-  if (!existsSync9(tfvarsPath)) return null;
-  const content = readFileSync5(tfvarsPath, "utf-8");
-  const match = content.match(new RegExp(`^${key}\\s*=\\s*"([^"]*)"`, "m"));
-  return match ? match[1] : null;
-}
-function resolveTfvarsPath2(stage) {
-  const tfDir = resolveTerraformDir(stage);
-  if (tfDir) {
-    const direct = `${tfDir}/terraform.tfvars`;
-    if (existsSync9(direct)) return direct;
-  }
-  const terraformDir = process.env.THINKWORK_TERRAFORM_DIR || process.cwd();
-  const cwd = resolveTierDir(terraformDir, stage, "app");
-  return `${cwd}/terraform.tfvars`;
-}
-function getApiEndpoint2(stage, region) {
-  try {
-    const raw = execSync9(
-      `aws apigatewayv2 get-apis --region ${region} --query "Items[?Name=='thinkwork-${stage}-api'].ApiEndpoint|[0]" --output text`,
-      { encoding: "utf-8", timeout: 15e3, stdio: ["pipe", "pipe", "pipe"] }
-    ).trim();
-    return raw && raw !== "None" ? raw : null;
-  } catch {
-    return null;
-  }
-}
-async function apiFetch(apiUrl, authSecret, path2, options = {}, extraHeaders = {}) {
-  const res = await fetch(`${apiUrl}${path2}`, {
-    ...options,
-    headers: {
-      "Content-Type": "application/json",
-      Authorization: `Bearer ${authSecret}`,
-      ...extraHeaders,
-      ...options.headers
-    }
-  });
-  if (!res.ok) {
-    const body = await res.json().catch(() => ({}));
-    throw new Error(body.error || `HTTP ${res.status}`);
-  }
-  return res.json();
-}
-async function apiFetchRaw(apiUrl, authSecret, path2, options = {}, extraHeaders = {}) {
-  const res = await fetch(`${apiUrl}${path2}`, {
-    ...options,
-    headers: {
-      "Content-Type": "application/json",
-      Authorization: `Bearer ${authSecret}`,
-      ...extraHeaders,
-      ...options.headers
-    }
-  });
-  const body = await res.json().catch(() => ({}));
-  return { ok: res.ok, status: res.status, body };
-}
-function resolveApiConfig(stage, regionOverride) {
-  const tfvarsPath = resolveTfvarsPath2(stage);
-  const tfAuthSecret = readTfVar2(tfvarsPath, "api_auth_secret");
-  const tfRegion = readTfVar2(tfvarsPath, "region");
-  const region = regionOverride || tfRegion || "us-east-1";
-  const apiUrl = getApiEndpoint2(stage, region);
-  if (!apiUrl) {
-    printError(
-      `Cannot discover API endpoint for stage "${stage}" in ${region}. Is the stack deployed?`
-    );
-    return null;
-  }
-  const authSecret = tfAuthSecret ?? getApiAuthSecretFromLambda(stage, region);
-  if (!authSecret) {
-    printError(
-      `Cannot read api_auth_secret. Tried terraform.tfvars at ${tfvarsPath} and the \`thinkwork-${stage}-api-tenants\` Lambda env. Deploy the stack or set --profile to a role with lambda:GetFunctionConfiguration.`
-    );
-    return null;
-  }
-  return { apiUrl, authSecret };
-}
-
 // src/lib/resolve-tenant.ts
 import { select as select4 } from "@inquirer/prompts";
 async function resolveTenant(opts) {
@@ -3173,7 +2866,7 @@ async function resolveServer(identifier, api, tenantSlug) {
     getId: (s) => s.id,
     getAliases: (s) => [s.slug, s.name],
     resourceLabel: "MCP server",
-    pickerLabel: (s) => `${s.name}  ${chalk10.dim(`(${s.slug}, ${s.id})`)}`
+    pickerLabel: (s) => `${s.name}  ${chalk9.dim(`(${s.slug}, ${s.id})`)}`
   });
 }
 function formatAuth(s) {
@@ -3206,13 +2899,13 @@ Examples:
         { "x-tenant-slug": tenant.slug }
       );
       if (!servers || servers.length === 0) {
-        console.log(chalk10.dim("  No MCP servers registered."));
+        console.log(chalk9.dim("  No MCP servers registered."));
         return;
       }
       console.log("");
       for (const s of servers) {
-        const status = s.enabled ? chalk10.green("enabled") : chalk10.dim("disabled");
-        console.log(`  ${chalk10.bold(s.name)}  ${chalk10.dim(s.slug)}  ${status}`);
+        const status = s.enabled ? chalk9.green("enabled") : chalk9.dim("disabled");
+        console.log(`  ${chalk9.bold(s.name)}  ${chalk9.dim(s.slug)}  ${status}`);
         console.log(`    ID:        ${s.id}`);
         console.log(`    URL:       ${s.url}`);
         console.log(`    Transport: ${s.transport}`);
@@ -3393,12 +3086,12 @@ Examples:
       if (result.ok) {
         printSuccess(`Connection successful: ${server.name}.`);
         if (result.tools?.length) {
-          console.log(chalk10.bold(`
+          console.log(chalk9.bold(`
   Discovered tools (${result.tools.length}):
 `));
           for (const t of result.tools) {
             console.log(
-              `    ${chalk10.cyan(t.name)}${t.description ? chalk10.dim(` - ${t.description}`) : ""}`
+              `    ${chalk9.cyan(t.name)}${t.description ? chalk9.dim(` - ${t.description}`) : ""}`
             );
           }
           console.log("");
@@ -3503,8 +3196,8 @@ old one.
       });
       printJson(created);
       printWarning("This token will NOT be shown again. Copy it now.");
-      printSuccess(`MCP admin key created: ${chalk10.bold(created.name)} (${created.id})`);
-      console.log(`  ${chalk10.dim("Token:")} ${chalk10.cyan(created.token)}`);
+      printSuccess(`MCP admin key created: ${chalk9.bold(created.name)} (${created.id})`);
+      console.log(`  ${chalk9.dim("Token:")} ${chalk9.cyan(created.token)}`);
     } catch (err) {
       if (isCancellation(err)) return;
       printError(err instanceof Error ? err.message : String(err));
@@ -3650,7 +3343,7 @@ SPA (or a future \`thinkwork mcp assign\` CLI pass).
 
 // src/commands/tools.ts
 import { select as select6, password } from "@inquirer/prompts";
-import chalk11 from "chalk";
+import chalk10 from "chalk";
 var TOOL_PROVIDERS = {
   "web-search": ["exa", "serpapi"]
 };
@@ -3691,16 +3384,16 @@ Examples:
         { "x-tenant-slug": tenant.slug }
       );
       if (!rows || rows.length === 0) {
-        console.log(chalk11.dim("  No built-in tools configured."));
-        console.log(chalk11.dim("  Try: thinkwork tools web-search set"));
+        console.log(chalk10.dim("  No built-in tools configured."));
+        console.log(chalk10.dim("  Try: thinkwork tools web-search set"));
         return;
       }
       console.log("");
       for (const r of rows) {
-        const status = r.enabled ? chalk11.green("enabled") : chalk11.dim("disabled");
-        const key = r.hasSecret ? chalk11.green("yes") : chalk11.red("no");
-        const provider = r.provider ?? chalk11.dim("\u2014");
-        console.log(`  ${chalk11.bold(r.toolSlug)}  ${status}`);
+        const status = r.enabled ? chalk10.green("enabled") : chalk10.dim("disabled");
+        const key = r.hasSecret ? chalk10.green("yes") : chalk10.red("no");
+        const provider = r.provider ?? chalk10.dim("\u2014");
+        console.log(`  ${chalk10.bold(r.toolSlug)}  ${status}`);
         console.log(`    Provider:  ${provider}`);
         console.log(`    Has key:   ${key}`);
         if (r.lastTestedAt) console.log(`    Tested:    ${new Date(r.lastTestedAt).toLocaleString()}`);
@@ -3831,12 +3524,12 @@ Examples:
 }
 
 // src/commands/update.ts
-import { execSync as execSync10 } from "child_process";
+import { execSync as execSync8 } from "child_process";
 import { realpathSync } from "fs";
-import chalk12 from "chalk";
+import chalk11 from "chalk";
 function getLatestVersion() {
   try {
-    return execSync10("npm view thinkwork-cli version", {
+    return execSync8("npm view thinkwork-cli version", {
       encoding: "utf-8",
       timeout: 1e4,
       stdio: ["pipe", "pipe", "pipe"]
@@ -3847,7 +3540,7 @@ function getLatestVersion() {
 }
 function detectInstallMethod() {
   try {
-    const which = execSync10("which thinkwork", {
+    const which = execSync8("which thinkwork", {
       encoding: "utf-8",
       timeout: 5e3,
       stdio: ["pipe", "pipe", "pipe"]
@@ -3875,28 +3568,28 @@ function compareVersions(a, b) {
 function registerUpdateCommand(program2) {
   program2.command("update").description("Check for and install CLI updates").option("--check", "Only check for updates, don't install").action(async (opts) => {
     printHeader("update", "", null);
-    console.log(`  Current version: ${chalk12.bold(VERSION)}`);
+    console.log(`  Current version: ${chalk11.bold(VERSION)}`);
     const latest = getLatestVersion();
     if (!latest) {
-      console.log(chalk12.yellow("  Could not check npm registry for updates."));
+      console.log(chalk11.yellow("  Could not check npm registry for updates."));
       return;
     }
-    console.log(`  Latest version:  ${chalk12.bold(latest)}`);
+    console.log(`  Latest version:  ${chalk11.bold(latest)}`);
     console.log("");
     const cmp = compareVersions(VERSION, latest);
     if (cmp >= 0) {
-      console.log(chalk12.green("  \u2713 You're on the latest version."));
+      console.log(chalk11.green("  \u2713 You're on the latest version."));
       console.log("");
       return;
     }
-    console.log(chalk12.cyan(`  Update available: ${VERSION} \u2192 ${latest}`));
+    console.log(chalk11.cyan(`  Update available: ${VERSION} \u2192 ${latest}`));
     console.log("");
     if (opts.check) {
       const method2 = detectInstallMethod();
       if (method2 === "homebrew") {
-        console.log(`  Run: ${chalk12.cyan("brew upgrade thinkwork-ai/tap/thinkwork")}`);
+        console.log(`  Run: ${chalk11.cyan("brew upgrade thinkwork-ai/tap/thinkwork")}`);
       } else {
-        console.log(`  Run: ${chalk12.cyan(`npm install -g thinkwork-cli@${latest}`)}`);
+        console.log(`  Run: ${chalk11.cyan(`npm install -g thinkwork-cli@${latest}`)}`);
       }
       console.log("");
       return;
@@ -3904,27 +3597,27 @@ function registerUpdateCommand(program2) {
     const method = detectInstallMethod();
     const cmd = method === "homebrew" ? "brew upgrade thinkwork-ai/tap/thinkwork" : `npm install -g thinkwork-cli@${latest}`;
     console.log(`  Installing via ${method}...`);
-    console.log(chalk12.dim(`  $ ${cmd}`));
+    console.log(chalk11.dim(`  $ ${cmd}`));
     console.log("");
     try {
-      execSync10(cmd, { stdio: "inherit", timeout: 12e4 });
+      execSync8(cmd, { stdio: "inherit", timeout: 12e4 });
       console.log("");
-      console.log(chalk12.green(`  \u2713 Upgraded to thinkwork-cli@${latest}`));
+      console.log(chalk11.green(`  \u2713 Upgraded to thinkwork-cli@${latest}`));
     } catch {
       console.log("");
-      console.log(chalk12.red(`  Failed to upgrade. Try manually:`));
-      console.log(`    ${chalk12.cyan(cmd)}`);
+      console.log(chalk11.red(`  Failed to upgrade. Try manually:`));
+      console.log(`    ${chalk11.cyan(cmd)}`);
     }
     console.log("");
   });
 }
 
 // src/commands/user.ts
-import { spawn as spawn5 } from "child_process";
+import { spawn as spawn4 } from "child_process";
 import { input as input2, select as select7 } from "@inquirer/prompts";
 function getTerraformOutput2(cwd, key) {
   return new Promise((resolve7, reject) => {
-    const proc = spawn5("terraform", ["output", "-raw", key], {
+    const proc = spawn4("terraform", ["output", "-raw", key], {
       cwd,
       stdio: ["pipe", "pipe", "pipe"]
     });
@@ -3956,7 +3649,7 @@ function runAwsCognitoReset(userPoolId, username, region) {
       "json"
     ];
     if (region) args.push("--region", region);
-    const proc = spawn5("aws", args, { stdio: ["ignore", "pipe", "pipe"] });
+    const proc = spawn4("aws", args, { stdio: ["ignore", "pipe", "pipe"] });
     let stdout = "";
     let stderr = "";
     proc.stdout.on("data", (d) => stdout += d);
@@ -4704,6 +4397,8 @@ var CliUpdateWebhookDocument = { "kind": "Document", "definitions": [{ "kind": "
 var CliDeleteWebhookDocument = { "kind": "Document", "definitions": [{ "kind": "OperationDefinition", "operation": "mutation", "name": { "kind": "Name", "value": "CliDeleteWebhook" }, "variableDefinitions": [{ "kind": "VariableDefinition", "variable": { "kind": "Variable", "name": { "kind": "Name", "value": "id" } }, "type": { "kind": "NonNullType", "type": { "kind": "NamedType", "name": { "kind": "Name", "value": "ID" } } } }], "selectionSet": { "kind": "SelectionSet", "selections": [{ "kind": "Field", "name": { "kind": "Name", "value": "deleteWebhook" }, "arguments": [{ "kind": "Argument", "name": { "kind": "Name", "value": "id" }, "value": { "kind": "Variable", "name": { "kind": "Name", "value": "id" } } }] }] } }] };
 var CliRegenerateWebhookTokenDocument = { "kind": "Document", "definitions": [{ "kind": "OperationDefinition", "operation": "mutation", "name": { "kind": "Name", "value": "CliRegenerateWebhookToken" }, "variableDefinitions": [{ "kind": "VariableDefinition", "variable": { "kind": "Variable", "name": { "kind": "Name", "value": "id" } }, "type": { "kind": "NonNullType", "type": { "kind": "NamedType", "name": { "kind": "Name", "value": "ID" } } } }], "selectionSet": { "kind": "SelectionSet", "selections": [{ "kind": "Field", "name": { "kind": "Name", "value": "regenerateWebhookToken" }, "arguments": [{ "kind": "Argument", "name": { "kind": "Name", "value": "id" }, "value": { "kind": "Variable", "name": { "kind": "Name", "value": "id" } } }], "selectionSet": { "kind": "SelectionSet", "selections": [{ "kind": "Field", "name": { "kind": "Name", "value": "id" } }, { "kind": "Field", "name": { "kind": "Name", "value": "token" } }] } }] } }] };
 var CliWebhookDeliveriesDocument = { "kind": "Document", "definitions": [{ "kind": "OperationDefinition", "operation": "query", "name": { "kind": "Name", "value": "CliWebhookDeliveries" }, "variableDefinitions": [{ "kind": "VariableDefinition", "variable": { "kind": "Variable", "name": { "kind": "Name", "value": "webhookId" } }, "type": { "kind": "NonNullType", "type": { "kind": "NamedType", "name": { "kind": "Name", "value": "ID" } } } }, { "kind": "VariableDefinition", "variable": { "kind": "Variable", "name": { "kind": "Name", "value": "limit" } }, "type": { "kind": "NamedType", "name": { "kind": "Name", "value": "Int" } } }], "selectionSet": { "kind": "SelectionSet", "selections": [{ "kind": "Field", "name": { "kind": "Name", "value": "webhookDeliveries" }, "arguments": [{ "kind": "Argument", "name": { "kind": "Name", "value": "webhookId" }, "value": { "kind": "Variable", "name": { "kind": "Name", "value": "webhookId" } } }, { "kind": "Argument", "name": { "kind": "Name", "value": "limit" }, "value": { "kind": "Variable", "name": { "kind": "Name", "value": "limit" } } }], "selectionSet": { "kind": "SelectionSet", "selections": [{ "kind": "Field", "name": { "kind": "Name", "value": "id" } }, { "kind": "Field", "name": { "kind": "Name", "value": "providerName" } }, { "kind": "Field", "name": { "kind": "Name", "value": "providerEventId" } }, { "kind": "Field", "name": { "kind": "Name", "value": "normalizedKind" } }, { "kind": "Field", "name": { "kind": "Name", "value": "receivedAt" } }, { "kind": "Field", "name": { "kind": "Name", "value": "signatureStatus" } }, { "kind": "Field", "name": { "kind": "Name", "value": "resolutionStatus" } }, { "kind": "Field", "name": { "kind": "Name", "value": "statusCode" } }, { "kind": "Field", "name": { "kind": "Name", "value": "durationMs" } }, { "kind": "Field", "name": { "kind": "Name", "value": "threadId" } }, { "kind": "Field", "name": { "kind": "Name", "value": "threadCreated" } }, { "kind": "Field", "name": { "kind": "Name", "value": "retryCount" } }, { "kind": "Field", "name": { "kind": "Name", "value": "isReplay" } }, { "kind": "Field", "name": { "kind": "Name", "value": "errorMessage" } }] } }] } }] };
+var CliTestWebhookDocument = { "kind": "Document", "definitions": [{ "kind": "OperationDefinition", "operation": "mutation", "name": { "kind": "Name", "value": "CliTestWebhook" }, "variableDefinitions": [{ "kind": "VariableDefinition", "variable": { "kind": "Variable", "name": { "kind": "Name", "value": "id" } }, "type": { "kind": "NonNullType", "type": { "kind": "NamedType", "name": { "kind": "Name", "value": "ID" } } } }], "selectionSet": { "kind": "SelectionSet", "selections": [{ "kind": "Field", "name": { "kind": "Name", "value": "testWebhook" }, "arguments": [{ "kind": "Argument", "name": { "kind": "Name", "value": "id" }, "value": { "kind": "Variable", "name": { "kind": "Name", "value": "id" } } }], "selectionSet": { "kind": "SelectionSet", "selections": [{ "kind": "Field", "name": { "kind": "Name", "value": "id" } }, { "kind": "Field", "name": { "kind": "Name", "value": "webhookId" } }, { "kind": "Field", "name": { "kind": "Name", "value": "tenantId" } }, { "kind": "Field", "name": { "kind": "Name", "value": "receivedAt" } }, { "kind": "Field", "name": { "kind": "Name", "value": "resolutionStatus" } }, { "kind": "Field", "name": { "kind": "Name", "value": "signatureStatus" } }, { "kind": "Field", "name": { "kind": "Name", "value": "statusCode" } }, { "kind": "Field", "name": { "kind": "Name", "value": "bodyPreview" } }] } }] } }] };
+var CliWebhookForTestDocument = { "kind": "Document", "definitions": [{ "kind": "OperationDefinition", "operation": "query", "name": { "kind": "Name", "value": "CliWebhookForTest" }, "variableDefinitions": [{ "kind": "VariableDefinition", "variable": { "kind": "Variable", "name": { "kind": "Name", "value": "id" } }, "type": { "kind": "NonNullType", "type": { "kind": "NamedType", "name": { "kind": "Name", "value": "ID" } } } }], "selectionSet": { "kind": "SelectionSet", "selections": [{ "kind": "Field", "name": { "kind": "Name", "value": "webhook" }, "arguments": [{ "kind": "Argument", "name": { "kind": "Name", "value": "id" }, "value": { "kind": "Variable", "name": { "kind": "Name", "value": "id" } } }], "selectionSet": { "kind": "SelectionSet", "selections": [{ "kind": "Field", "name": { "kind": "Name", "value": "id" } }, { "kind": "Field", "name": { "kind": "Name", "value": "token" } }] } }] } }] };
 var CliWebhookTenantBySlugDocument = { "kind": "Document", "definitions": [{ "kind": "OperationDefinition", "operation": "query", "name": { "kind": "Name", "value": "CliWebhookTenantBySlug" }, "variableDefinitions": [{ "kind": "VariableDefinition", "variable": { "kind": "Variable", "name": { "kind": "Name", "value": "slug" } }, "type": { "kind": "NonNullType", "type": { "kind": "NamedType", "name": { "kind": "Name", "value": "String" } } } }], "selectionSet": { "kind": "SelectionSet", "selections": [{ "kind": "Field", "name": { "kind": "Name", "value": "tenantBySlug" }, "arguments": [{ "kind": "Argument", "name": { "kind": "Name", "value": "slug" }, "value": { "kind": "Variable", "name": { "kind": "Name", "value": "slug" } } }], "selectionSet": { "kind": "SelectionSet", "selections": [{ "kind": "Field", "name": { "kind": "Name", "value": "id" } }] } }] } }] };
 var CliWikiTenantBySlugDocument = { "kind": "Document", "definitions": [{ "kind": "OperationDefinition", "operation": "query", "name": { "kind": "Name", "value": "CliWikiTenantBySlug" }, "variableDefinitions": [{ "kind": "VariableDefinition", "variable": { "kind": "Variable", "name": { "kind": "Name", "value": "slug" } }, "type": { "kind": "NonNullType", "type": { "kind": "NamedType", "name": { "kind": "Name", "value": "String" } } } }], "selectionSet": { "kind": "SelectionSet", "selections": [{ "kind": "Field", "name": { "kind": "Name", "value": "tenantBySlug" }, "arguments": [{ "kind": "Argument", "name": { "kind": "Name", "value": "slug" }, "value": { "kind": "Variable", "name": { "kind": "Name", "value": "slug" } } }], "selectionSet": { "kind": "SelectionSet", "selections": [{ "kind": "Field", "name": { "kind": "Name", "value": "id" } }, { "kind": "Field", "name": { "kind": "Name", "value": "slug" } }, { "kind": "Field", "name": { "kind": "Name", "value": "name" } }] } }] } }] };
 var CliAllTenantAgentsForWikiDocument = { "kind": "Document", "definitions": [{ "kind": "OperationDefinition", "operation": "query", "name": { "kind": "Name", "value": "CliAllTenantAgentsForWiki" }, "variableDefinitions": [{ "kind": "VariableDefinition", "variable": { "kind": "Variable", "name": { "kind": "Name", "value": "tenantId" } }, "type": { "kind": "NonNullType", "type": { "kind": "NamedType", "name": { "kind": "Name", "value": "ID" } } } }], "selectionSet": { "kind": "SelectionSet", "selections": [{ "kind": "Field", "name": { "kind": "Name", "value": "allTenantAgents" }, "arguments": [{ "kind": "Argument", "name": { "kind": "Name", "value": "tenantId" }, "value": { "kind": "Variable", "name": { "kind": "Name", "value": "tenantId" } } }, { "kind": "Argument", "name": { "kind": "Name", "value": "includeSystem" }, "value": { "kind": "BooleanValue", "value": false } }, { "kind": "Argument", "name": { "kind": "Name", "value": "includeSubAgents" }, "value": { "kind": "BooleanValue", "value": false } }], "selectionSet": { "kind": "SelectionSet", "selections": [{ "kind": "Field", "name": { "kind": "Name", "value": "id" } }, { "kind": "Field", "name": { "kind": "Name", "value": "name" } }, { "kind": "Field", "name": { "kind": "Name", "value": "slug" } }, { "kind": "Field", "name": { "kind": "Name", "value": "type" } }, { "kind": "Field", "name": { "kind": "Name", "value": "status" } }] } }] } }] };
@@ -4883,6 +4578,8 @@ var documents = {
   "\n  mutation CliDeleteWebhook($id: ID!) {\n    deleteWebhook(id: $id)\n  }\n": CliDeleteWebhookDocument,
   "\n  mutation CliRegenerateWebhookToken($id: ID!) {\n    regenerateWebhookToken(id: $id) {\n      id\n      token\n    }\n  }\n": CliRegenerateWebhookTokenDocument,
   "\n  query CliWebhookDeliveries($webhookId: ID!, $limit: Int) {\n    webhookDeliveries(webhookId: $webhookId, limit: $limit) {\n      id\n      providerName\n      providerEventId\n      normalizedKind\n      receivedAt\n      signatureStatus\n      resolutionStatus\n      statusCode\n      durationMs\n      threadId\n      threadCreated\n      retryCount\n      isReplay\n      errorMessage\n    }\n  }\n": CliWebhookDeliveriesDocument,
+  "\n  mutation CliTestWebhook($id: ID!) {\n    testWebhook(id: $id) {\n      id\n      webhookId\n      tenantId\n      receivedAt\n      resolutionStatus\n      signatureStatus\n      statusCode\n      bodyPreview\n    }\n  }\n": CliTestWebhookDocument,
+  "\n  query CliWebhookForTest($id: ID!) {\n    webhook(id: $id) {\n      id\n      token\n    }\n  }\n": CliWebhookForTestDocument,
   "\n  query CliWebhookTenantBySlug($slug: String!) {\n    tenantBySlug(slug: $slug) {\n      id\n    }\n  }\n": CliWebhookTenantBySlugDocument,
   "\n  query CliWikiTenantBySlug($slug: String!) {\n    tenantBySlug(slug: $slug) {\n      id\n      slug\n      name\n    }\n  }\n": CliWikiTenantBySlugDocument,
   "\n  query CliAllTenantAgentsForWiki($tenantId: ID!) {\n    allTenantAgents(tenantId: $tenantId, includeSystem: false, includeSubAgents: false) {\n      id\n      name\n      slug\n      type\n      status\n    }\n  }\n": CliAllTenantAgentsForWikiDocument,
@@ -7485,7 +7182,7 @@ Examples:
 }
 
 // src/commands/computer.ts
-import chalk13 from "chalk";
+import chalk12 from "chalk";
 async function resolveComputerContext(opts) {
   const stage = await resolveStage({ flag: opts.stage });
   const api = resolveApiConfig(stage);
@@ -7525,7 +7222,7 @@ function printMigrationReport(response) {
   if (!response.report) return;
   const summary = response.report.summary ?? {};
   console.log("");
-  console.log(chalk13.bold("  Summary"));
+  console.log(chalk12.bold("  Summary"));
   for (const [status, count] of Object.entries(summary)) {
     if (!count) continue;
     console.log(`  ${status.padEnd(28)} ${count}`);
@@ -7606,7 +7303,7 @@ function registerComputerCommand(program2) {
         if (response.status === 409 && response.body.blockers) {
           if (!isJsonMode()) {
             console.log("");
-            console.log(chalk13.bold("  Blockers"));
+            console.log(chalk12.bold("  Blockers"));
             console.log(JSON.stringify(response.body.blockers, null, 2));
           }
         }
@@ -10734,6 +10431,28 @@ var WebhookDeliveriesDoc = graphql(`
     }
   }
 `);
+var TestWebhookDoc = graphql(`
+  mutation CliTestWebhook($id: ID!) {
+    testWebhook(id: $id) {
+      id
+      webhookId
+      tenantId
+      receivedAt
+      resolutionStatus
+      signatureStatus
+      statusCode
+      bodyPreview
+    }
+  }
+`);
+var WebhookForTestDoc = graphql(`
+  query CliWebhookForTest($id: ID!) {
+    webhook(id: $id) {
+      id
+      token
+    }
+  }
+`);
 var WebhookTenantBySlugDoc = graphql(`
   query CliWebhookTenantBySlug($slug: String!) {
     tenantBySlug(slug: $slug) {
@@ -11011,12 +10730,39 @@ async function runWebhookDeliveries(id, opts) {
     ]
   );
 }
-function notYetImplementedAtApi(verb) {
-  printError(
-    `\`webhook ${verb}\` is not yet implemented at the GraphQL API.
-  Use admin UI for now; CLI parity is tracked as a Phase-3 follow-up.`
+async function runWebhookTest(id, _opts) {
+  const ctx = await resolveWebhookContext(_opts);
+  const data = await gqlMutate(ctx.client, TestWebhookDoc, { id });
+  const delivery = data.testWebhook;
+  let curlHint = null;
+  try {
+    const tokenData = await gqlQuery(ctx.client, WebhookForTestDoc, { id });
+    if (tokenData.webhook?.token) {
+      const { resolveApiConfig: resolveApiConfig2 } = await import("./api-client-MC4NOZ4L.js");
+      const api = resolveApiConfig2(ctx.stage);
+      if (api?.apiUrl) {
+        const base = api.apiUrl.replace(/\/$/, "");
+        curlHint = `${base}/webhooks/${tokenData.webhook.token}`;
+      }
+    }
+  } catch {
+  }
+  if (isJsonMode()) {
+    printJson({ delivery, publicUrl: curlHint });
+    return;
+  }
+  printSuccess(
+    `Recorded synthetic delivery ${delivery.id} (resolution=${delivery.resolutionStatus}).`
   );
-  process.exit(2);
+  if (curlHint) {
+    console.log("");
+    console.log("  For end-to-end reachability check, curl the public URL:");
+    console.log(
+      `    curl -X POST -H 'content-type: application/json' \\
+      -d '{"hello":"world"}' \\
+      ${curlHint}`
+    );
+  }
 }
 function registerWebhookCommand(program2) {
   const wh = program2.command("webhook").alias("webhooks").description("Manage inbound webhooks that dispatch to agents or routines.");
@@ -11031,7 +10777,9 @@ Examples:
   ).action(runWebhookCreate);
   wh.command("update <id>").description("Update a webhook's target, rate limit, or enabled state.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--target-type <t>").option("--target-id <id>").option("--rate-limit <rpm>").option("--allowed-ips <csv>").option("--enable").option("--disable").action(runWebhookUpdate);
   wh.command("delete <id>").description("Delete a webhook (its URL stops working immediately).").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("-y, --yes", "Skip confirmation").action(runWebhookDelete);
-  wh.command("test <id>").description("Send a synthetic payload to the webhook. (API surface pending.)").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--payload <json>").action(() => notYetImplementedAtApi("test"));
+  wh.command("test <id>").description(
+    "Record a synthetic test delivery row for the webhook (visible via `webhook deliveries`). Does NOT trigger downstream dispatch; prints a curl one-liner for end-to-end reachability against the public URL."
+  ).option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(runWebhookTest);
   wh.command("rotate <id>").description("Generate a new token for an existing webhook.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("-y, --yes", "Skip confirmation").action(runWebhookRotate);
   wh.command("deliveries <id>").description(
     "Show recent delivery attempts for a webhook (newest first). Default 25, max 500."
@@ -11040,7 +10788,7 @@ Examples:
 
 // src/lib/plugin-zip.ts
 import { createReadStream, promises as fsp, statSync } from "fs";
-import { basename, join as join6, relative, resolve as resolve3, sep } from "path";
+import { basename, join as join5, relative, resolve as resolve3, sep } from "path";
 import JSZip from "jszip";
 var PluginZipError = class extends Error {
   constructor(message, kind) {
@@ -11067,7 +10815,7 @@ async function buildPluginZip(pluginDir) {
       "missing-directory"
     );
   }
-  const manifestPath = join6(root, "plugin.json");
+  const manifestPath = join5(root, "plugin.json");
   let manifestRaw;
   try {
     manifestRaw = await fsp.readFile(manifestPath, "utf8");
@@ -11146,7 +10894,7 @@ async function walkDir(rootDir, currentDir) {
   const out = [];
   const dirents = await fsp.readdir(currentDir, { withFileTypes: true });
   for (const ent of dirents) {
-    const abs = join6(currentDir, ent.name);
+    const abs = join5(currentDir, ent.name);
     const rel = relative(rootDir, abs);
     if (ent.name === ".git" || ent.name === ".DS_Store" || ent.name === "node_modules") {
       continue;
@@ -11339,7 +11087,7 @@ async function runSkillList(opts) {
     ]
   );
 }
-function notYetImplementedAtApi2(verb) {
+function notYetImplementedAtApi(verb) {
   printError(
     `\`skill ${verb}\` is not yet implemented at the GraphQL API.
   The current schema exposes skillCatalog (read), per-computer enableSkill/disableSkill,
@@ -11355,11 +11103,11 @@ function registerSkillCommand(program2) {
   );
   skill.command("catalog").description("Browse the skill catalog. Client-side filters --search and --tag are applied locally.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--search <q>", "Filter by keyword").option("--tag <t>", "Filter by category").action(runSkillCatalog);
   skill.command("list").alias("ls").description("List skills available to the tenant.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--custom-only", "Only show tenant-owned custom skills (source=tenant)").action(runSkillList);
-  skill.command("install <slug>").description("Install a public skill. (API surface pending \u2014 toggle per-agent via `agent skills set`.)").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--version <v>", "Pin to a specific version").action(() => notYetImplementedAtApi2("install"));
-  skill.command("upgrade <slug>").description("Upgrade an installed skill. (API surface pending.)").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(() => notYetImplementedAtApi2("upgrade"));
-  skill.command("create [slug]").description("Publish a custom tenant-scoped skill. (Use `skill push <folder>` for now.)").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--name <n>").option("--description <text>").option("--manifest-file <path>", "Path to the MCP server manifest JSON").option("--endpoint <url>", "MCP server HTTP/SSE endpoint").action(() => notYetImplementedAtApi2("create"));
-  skill.command("update <slug>").description("Update a custom skill. (API surface pending.)").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--name <n>").option("--description <text>").option("--manifest-file <path>").option("--endpoint <url>").action(() => notYetImplementedAtApi2("update"));
-  skill.command("delete <slug>").description("Delete a custom skill. (API surface pending.)").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("-y, --yes", "Skip confirmation").action(() => notYetImplementedAtApi2("delete"));
+  skill.command("install <slug>").description("Install a public skill. (API surface pending \u2014 toggle per-agent via `agent skills set`.)").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--version <v>", "Pin to a specific version").action(() => notYetImplementedAtApi("install"));
+  skill.command("upgrade <slug>").description("Upgrade an installed skill. (API surface pending.)").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(() => notYetImplementedAtApi("upgrade"));
+  skill.command("create [slug]").description("Publish a custom tenant-scoped skill. (Use `skill push <folder>` for now.)").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--name <n>").option("--description <text>").option("--manifest-file <path>", "Path to the MCP server manifest JSON").option("--endpoint <url>", "MCP server HTTP/SSE endpoint").action(() => notYetImplementedAtApi("create"));
+  skill.command("update <slug>").description("Update a custom skill. (API surface pending.)").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--name <n>").option("--description <text>").option("--manifest-file <path>").option("--endpoint <url>").action(() => notYetImplementedAtApi("update"));
+  skill.command("delete <slug>").description("Delete a custom skill. (API surface pending.)").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("-y, --yes", "Skip confirmation").action(() => notYetImplementedAtApi("delete"));
   skill.command("push <folder>").description(
     "Zip a local plugin folder and upload it to the tenant as a pending plugin."
   ).option("-s, --stage <name>", "Deployment stage").option("--region <name>", "AWS region", "us-east-1").addHelpText(
@@ -12789,7 +12537,7 @@ Examples:
 
 // src/commands/eval/run.ts
 import { checkbox, confirm as confirm17 } from "@inquirer/prompts";
-import ora2 from "ora";
+import ora from "ora";
 
 // src/commands/eval/gql.ts
 var EvalRunsDoc = graphql(`
@@ -13174,7 +12922,7 @@ async function runEvalRun(opts) {
 }
 async function pollUntilTerminal(client, runId, intervalSec, timeoutSec) {
   const deadline = Date.now() + timeoutSec * 1e3;
-  const spinner = isJsonMode() ? null : ora2({ text: "Waiting for run to complete\u2026" }).start();
+  const spinner = isJsonMode() ? null : ora({ text: "Waiting for run to complete\u2026" }).start();
   try {
     while (Date.now() < deadline) {
       const data = await gqlQuery(client, EvalRunDoc, { id: runId });
@@ -13304,13 +13052,13 @@ async function runEvalGet(runId, opts) {
 }
 
 // src/commands/eval/watch.ts
-import ora3 from "ora";
+import ora2 from "ora";
 async function runEvalWatch(runId, opts) {
   const ctx = await resolveEvalContext(opts);
   const intervalSec = Number.parseInt(opts.interval ?? "3", 10);
   const timeoutSec = Number.parseInt(opts.timeout ?? "900", 10);
   const deadline = Date.now() + timeoutSec * 1e3;
-  const spinner = isJsonMode() ? null : ora3({ text: `Watching run ${runId}\u2026` }).start();
+  const spinner = isJsonMode() ? null : ora2({ text: `Watching run ${runId}\u2026` }).start();
   try {
     while (Date.now() < deadline) {
       const data = await gqlQuery(ctx.client, EvalRunDoc, { id: runId });
@@ -13515,7 +13263,7 @@ async function runEvalTestCaseGet(id, opts) {
 }
 
 // src/commands/eval/test-case/create.ts
-import { readFileSync as readFileSync6 } from "fs";
+import { readFileSync as readFileSync4 } from "fs";
 import { input as input19, select as select8, checkbox as checkbox2 } from "@inquirer/prompts";
 var DEFAULT_EVALUATORS = [
   "Builtin.Helpfulness",
@@ -13588,7 +13336,7 @@ async function runEvalTestCaseCreate(opts) {
   }
   let assertions = null;
   if (opts.assertionsFile) {
-    const parsed = JSON.parse(readFileSync6(opts.assertionsFile, "utf8"));
+    const parsed = JSON.parse(readFileSync4(opts.assertionsFile, "utf8"));
     if (!Array.isArray(parsed)) {
       printError(`--assertions-file must contain a JSON array.`);
       process.exit(1);
@@ -13619,7 +13367,7 @@ async function runEvalTestCaseCreate(opts) {
 }
 
 // src/commands/eval/test-case/update.ts
-import { readFileSync as readFileSync7 } from "fs";
+import { readFileSync as readFileSync5 } from "fs";
 async function runEvalTestCaseUpdate(id, opts) {
   const ctx = await resolveEvalContext(opts);
   const input20 = {};
@@ -13632,7 +13380,7 @@ async function runEvalTestCaseUpdate(id, opts) {
   if (opts.tag !== void 0) input20.tags = opts.tag;
   if (opts.enabled !== void 0) input20.enabled = opts.enabled;
   if (opts.assertionsFile) {
-    const parsed = JSON.parse(readFileSync7(opts.assertionsFile, "utf8"));
+    const parsed = JSON.parse(readFileSync5(opts.assertionsFile, "utf8"));
     if (!Array.isArray(parsed)) {
       printError(`--assertions-file must contain a JSON array.`);
       process.exit(1);
@@ -13763,7 +13511,7 @@ Examples:
 }
 
 // src/commands/wiki/compile.ts
-import ora4 from "ora";
+import ora3 from "ora";
 
 // src/commands/wiki/gql.ts
 var TenantBySlugDoc2 = graphql(`
@@ -14033,7 +13781,7 @@ async function runWikiCompile(opts) {
   const errors = [];
   let forbiddenHit = false;
   for (const target of targets) {
-    const spinner = isJsonMode() || scope.mode === "all" ? null : ora4({
+    const spinner = isJsonMode() || scope.mode === "all" ? null : ora3({
       text: `Enqueuing compile for ${target.label}\u2026`,
       prefixText: "  "
     }).start();
@@ -14131,7 +13879,7 @@ async function runWikiCompile(opts) {
   }
 }
 async function watchSingleJob(ctx, target) {
-  const spinner = isJsonMode() ? null : ora4({
+  const spinner = isJsonMode() ? null : ora3({
     text: `Watching job ${shortJobId(target.jobId)} for ${target.agentLabel}\u2026`,
     prefixText: "  "
   }).start();
@@ -14180,7 +13928,7 @@ async function watchSingleJob(ctx, target) {
 
 // src/commands/wiki/rebuild.ts
 import { confirm as confirm20 } from "@inquirer/prompts";
-import ora5 from "ora";
+import ora4 from "ora";
 async function runWikiRebuild(opts) {
   if (opts.all) {
     printError(
@@ -14211,7 +13959,7 @@ async function runWikiRebuild(opts) {
       process.exit(0);
     }
   }
-  const resetSpinner = isJsonMode() ? null : ora5({
+  const resetSpinner = isJsonMode() ? null : ora4({
     text: `Archiving active pages for ${agentLabel}\u2026`,
     prefixText: "  "
   }).start();
@@ -14248,7 +13996,7 @@ async function runWikiRebuild(opts) {
     }
     process.exit(1);
   }
-  const compileSpinner = isJsonMode() ? null : ora5({
+  const compileSpinner = isJsonMode() ? null : ora4({
     text: `Enqueuing fresh compile for ${agentLabel}\u2026`,
     prefixText: "  "
   }).start();
@@ -14321,7 +14069,7 @@ async function runWikiRebuild(opts) {
   }
 }
 async function watchRebuildJob(ctx, target) {
-  const spinner = isJsonMode() ? null : ora5({
+  const spinner = isJsonMode() ? null : ora4({
     text: `Watching rebuild job ${shortJobId(target.jobId)}\u2026`,
     prefixText: "  "
   }).start();
@@ -14357,7 +14105,7 @@ async function watchRebuildJob(ctx, target) {
 }
 
 // src/commands/wiki/status.ts
-import ora6 from "ora";
+import ora5 from "ora";
 var DEFAULT_WATCH_INTERVAL_MS = 3e3;
 async function runWikiStatus(opts) {
   const ctx = await resolveWikiContext(opts);
@@ -14409,7 +14157,7 @@ async function runWikiStatus(opts) {
     process.exit(0);
   }
   const latestId = jobs[0].id;
-  const spinner = isJsonMode() ? null : ora6({
+  const spinner = isJsonMode() ? null : ora5({
     text: `Watching job ${shortJobId(latestId)}\u2026`,
     prefixText: "  "
   }).start();
@@ -14626,14 +14374,14 @@ import { resolve as resolve5 } from "path";
 
 // src/commands/enterprise/template.ts
 import {
-  existsSync as existsSync10,
-  mkdirSync as mkdirSync5,
-  readFileSync as readFileSync8,
-  readdirSync as readdirSync2,
+  existsSync as existsSync7,
+  mkdirSync as mkdirSync4,
+  readFileSync as readFileSync6,
+  readdirSync,
   statSync as statSync2,
-  writeFileSync as writeFileSync5
+  writeFileSync as writeFileSync4
 } from "fs";
-import { dirname as dirname4, join as join7, relative as relative2, resolve as resolve4 } from "path";
+import { dirname as dirname4, join as join6, relative as relative2, resolve as resolve4 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 var __dirname2 = dirname4(fileURLToPath3(import.meta.url));
 var MANAGED_MARKER = "thinkwork-managed: enterprise-deploy-template";
@@ -14649,17 +14397,17 @@ function renderEnterpriseDeployRepoTemplate(options) {
     stages
   });
   const templateFiles = listTemplateFiles(templateRoot).filter(
-    (path2) => !relative2(templateRoot, path2).startsWith("terraform/stages/") && !/^terraform\/backend-[^.]+\.hcl$/.test(
-      relative2(templateRoot, path2).split("\\").join("/")
+    (path) => !relative2(templateRoot, path).startsWith("terraform/stages/") && !/^terraform\/backend-[^.]+\.hcl$/.test(
+      relative2(templateRoot, path).split("\\").join("/")
     )
   );
   const written = [];
   const preserved = [];
   for (const templatePath of templateFiles) {
     const relativePath = relative2(templateRoot, templatePath);
-    const outputPath = join7(targetDir, relativePath);
+    const outputPath = join6(targetDir, relativePath);
     let content = applyTemplate(
-      readFileSync8(templatePath, "utf8"),
+      readFileSync6(templatePath, "utf8"),
       replacements
     );
     if (relativePath.split("\\").join("/") === "customer/deployment.json") {
@@ -14667,30 +14415,30 @@ function renderEnterpriseDeployRepoTemplate(options) {
     }
     writeManagedFile(outputPath, content, written, preserved);
   }
-  const stageTemplateRoot = join7(templateRoot, "terraform", "stages");
-  const backendTemplatePath = join7(
+  const stageTemplateRoot = join6(templateRoot, "terraform", "stages");
+  const backendTemplatePath = join6(
     templateRoot,
     "terraform",
     "backend-dev.hcl"
   );
   for (const stage of stages) {
-    const explicitTemplate = join7(stageTemplateRoot, `${stage}.tfvars`);
-    const fallbackTemplate = join7(stageTemplateRoot, "dev.tfvars");
-    const templatePath = existsSync10(explicitTemplate) ? explicitTemplate : fallbackTemplate;
-    const outputPath = join7(
+    const explicitTemplate = join6(stageTemplateRoot, `${stage}.tfvars`);
+    const fallbackTemplate = join6(stageTemplateRoot, "dev.tfvars");
+    const templatePath = existsSync7(explicitTemplate) ? explicitTemplate : fallbackTemplate;
+    const outputPath = join6(
       targetDir,
       "terraform",
       "stages",
       `${stage}.tfvars`
     );
-    const content = applyTemplate(readFileSync8(templatePath, "utf8"), {
+    const content = applyTemplate(readFileSync6(templatePath, "utf8"), {
       ...replacements,
       STAGE: stage
     });
     writeManagedFile(outputPath, content, written, preserved);
-    const backendPath = join7(targetDir, "terraform", `backend-${stage}.hcl`);
+    const backendPath = join6(targetDir, "terraform", `backend-${stage}.hcl`);
     const backendContent = applyTemplate(
-      readFileSync8(backendTemplatePath, "utf8"),
+      readFileSync6(backendTemplatePath, "utf8"),
       {
         ...replacements,
         STAGE: stage
@@ -14730,7 +14478,7 @@ function findEnterpriseTemplateRoot() {
     resolve4(__dirname2, "commands/enterprise/templates/deploy-repo")
   ];
   for (const candidate of candidates) {
-    if (existsSync10(join7(candidate, "thinkwork.lock"))) return candidate;
+    if (existsSync7(join6(candidate, "thinkwork.lock"))) return candidate;
   }
   throw new Error(
     "Enterprise deployment repo template not found. The CLI package may be incomplete."
@@ -14771,13 +14519,13 @@ function renderCustomerDeploymentJson(content, customerSlug, stages) {
 }
 function listTemplateFiles(root) {
   const out = [];
-  for (const entry of readdirSync2(root)) {
-    const path2 = join7(root, entry);
-    const stat = statSync2(path2);
+  for (const entry of readdirSync(root)) {
+    const path = join6(root, entry);
+    const stat = statSync2(path);
     if (stat.isDirectory()) {
-      out.push(...listTemplateFiles(path2));
+      out.push(...listTemplateFiles(path));
     } else if (stat.isFile()) {
-      out.push(path2);
+      out.push(path);
     }
   }
   return out.sort();
@@ -14790,24 +14538,24 @@ function applyTemplate(source, replacements) {
     return replacements[key];
   });
 }
-function writeManagedFile(path2, content, written, preserved) {
-  mkdirSync5(dirname4(path2), { recursive: true });
-  if (existsSync10(path2)) {
-    const current = readFileSync8(path2, "utf8");
+function writeManagedFile(path, content, written, preserved) {
+  mkdirSync4(dirname4(path), { recursive: true });
+  if (existsSync7(path)) {
+    const current = readFileSync6(path, "utf8");
     if (!current.includes(MANAGED_MARKER)) {
-      preserved.push(path2);
+      preserved.push(path);
       return;
     }
   }
-  writeFileSync5(path2, content);
-  written.push(path2);
+  writeFileSync4(path, content);
+  written.push(path);
 }
 
 // src/commands/enterprise/aws-bootstrap.ts
 import { execFileSync } from "child_process";
-import { mkdtempSync, writeFileSync as writeFileSync6 } from "fs";
+import { mkdtempSync, writeFileSync as writeFileSync5 } from "fs";
 import { tmpdir } from "os";
-import { join as join8 } from "path";
+import { join as join7 } from "path";
 function buildEnterpriseAwsBootstrapPlan(config) {
   const oidcProviderArn = `arn:aws:iam::${config.accountId}:oidc-provider/token.actions.githubusercontent.com`;
   return {
@@ -15026,9 +14774,9 @@ var AwsCliEnterpriseBootstrapClient = class {
         message: `Deploy role ${role.roleName} already exists; updated inline deploy policy ${role.deployPolicyName}.`
       };
     }
-    const dir = mkdtempSync(join8(tmpdir(), "thinkwork-enterprise-role-"));
-    const trustPath = join8(dir, "trust.json");
-    writeFileSync6(trustPath, JSON.stringify(role.trustPolicy));
+    const dir = mkdtempSync(join7(tmpdir(), "thinkwork-enterprise-role-"));
+    const trustPath = join7(dir, "trust.json");
+    writeFileSync5(trustPath, JSON.stringify(role.trustPolicy));
     execFileSync("aws", [
       "iam",
       "create-role",
@@ -15046,9 +14794,9 @@ var AwsCliEnterpriseBootstrapClient = class {
   }
 };
 function putRolePolicy(role) {
-  const dir = mkdtempSync(join8(tmpdir(), "thinkwork-enterprise-policy-"));
-  const policyPath = join8(dir, "policy.json");
-  writeFileSync6(policyPath, JSON.stringify(role.deployPolicy));
+  const dir = mkdtempSync(join7(tmpdir(), "thinkwork-enterprise-policy-"));
+  const policyPath = join7(dir, "policy.json");
+  writeFileSync5(policyPath, JSON.stringify(role.deployPolicy));
   execFileSync("aws", [
     "iam",
     "put-role-policy",
@@ -15506,14 +15254,14 @@ function printBootstrapSummary(result) {
 import { resolve as resolve6 } from "path";
 
 // src/commands/enterprise/overlay-schema.ts
-import { existsSync as existsSync11, readdirSync as readdirSync3, readFileSync as readFileSync9, statSync as statSync3 } from "fs";
-import { join as join9, relative as relative3, sep as sep2 } from "path";
+import { existsSync as existsSync8, readdirSync as readdirSync2, readFileSync as readFileSync7, statSync as statSync3 } from "fs";
+import { join as join8, relative as relative3, sep as sep2 } from "path";
 function loadEnterpriseOverlayDefinition(repoRoot) {
-  const path2 = join9(repoRoot, "customer", "deployment.json");
-  if (!existsSync11(path2)) {
-    throw new Error(`Missing customer overlay definition: ${path2}`);
+  const path = join8(repoRoot, "customer", "deployment.json");
+  if (!existsSync8(path)) {
+    throw new Error(`Missing customer overlay definition: ${path}`);
   }
-  const parsed = JSON.parse(readFileSync9(path2, "utf8"));
+  const parsed = JSON.parse(readFileSync7(path, "utf8"));
   if (parsed.schemaVersion !== 1) {
     throw new Error(
       `Unsupported customer/deployment.json schemaVersion ${parsed.schemaVersion}`
@@ -15545,11 +15293,11 @@ function stageOverlay(definition, stage) {
 }
 function readCustomerEvalPack(repoRoot, packName) {
   assertPackName(packName, "eval");
-  const path2 = join9(repoRoot, "customer", "evals", `${packName}.json`);
-  if (!existsSync11(path2)) {
-    throw new Error(`Eval pack "${packName}" is missing: ${path2}`);
+  const path = join8(repoRoot, "customer", "evals", `${packName}.json`);
+  if (!existsSync8(path)) {
+    throw new Error(`Eval pack "${packName}" is missing: ${path}`);
   }
-  const parsed = JSON.parse(readFileSync9(path2, "utf8"));
+  const parsed = JSON.parse(readFileSync7(path, "utf8"));
   if (!Array.isArray(parsed)) {
     throw new Error(`Eval pack "${packName}" must be a JSON array`);
   }
@@ -15559,27 +15307,27 @@ function readCustomerEvalPack(repoRoot, packName) {
 }
 function readJsonSeedPack(repoRoot, packName) {
   assertPackName(packName, "seed");
-  const path2 = join9(repoRoot, "customer", "seeds", `${packName}.json`);
-  if (!existsSync11(path2)) {
-    throw new Error(`Seed pack "${packName}" is missing: ${path2}`);
+  const path = join8(repoRoot, "customer", "seeds", `${packName}.json`);
+  if (!existsSync8(path)) {
+    throw new Error(`Seed pack "${packName}" is missing: ${path}`);
   }
-  return JSON.parse(readFileSync9(path2, "utf8"));
+  return JSON.parse(readFileSync7(path, "utf8"));
 }
 function collectOverlayFiles(repoRoot, family, packName) {
   assertPackName(packName, family);
-  const root = join9(repoRoot, "customer", family, packName);
-  if (!existsSync11(root) || !statSync3(root).isDirectory()) {
+  const root = join8(repoRoot, "customer", family, packName);
+  if (!existsSync8(root) || !statSync3(root).isDirectory()) {
     throw new Error(`Overlay pack "${family}/${packName}" is missing: ${root}`);
   }
   const files = [];
-  walkFiles(root, (path2) => {
-    const relativePath = relative3(root, path2).split(sep2).join("/");
+  walkFiles(root, (path) => {
+    const relativePath = relative3(root, path).split(sep2).join("/");
     if (relativePath === ".DS_Store" || relativePath.endsWith("/.DS_Store")) {
       return;
     }
     files.push({
       relativePath,
-      content: readFileSync9(path2, "utf8")
+      content: readFileSync7(path, "utf8")
     });
   });
   if (family === "skills" && !files.some((file) => file.relativePath === "SKILL.md")) {
@@ -15680,12 +15428,12 @@ function assertPackName(value, label) {
   }
 }
 function walkFiles(root, visit) {
-  for (const entry of readdirSync3(root, { withFileTypes: true })) {
-    const path2 = join9(root, entry.name);
+  for (const entry of readdirSync2(root, { withFileTypes: true })) {
+    const path = join8(root, entry.name);
     if (entry.isDirectory()) {
-      walkFiles(path2, visit);
+      walkFiles(path, visit);
     } else if (entry.isFile()) {
-      visit(path2);
+      visit(path);
     }
   }
 }