thinkwork-cli 0.12.8 → 0.12.10

package/README.md

@@ -137,26 +137,31 @@ The CLI has two modes for every API-backed command:
 Any flag accepted by a command is also inferrable from env vars:
 `THINKWORK_STAGE`, `THINKWORK_TENANT`, `THINKWORK_API_KEY` (for CI).
 
-## Roadmap
+## Command surface
 
-The commands below are **scaffolded** in Phase 0 (help text + argument parsing
-ships now, so `thinkwork --help` shows the full surface area) and fill in
-phase-by-phase. Running a scaffolded command prints a "not yet implemented"
-message and exits with code 2.
+All 25 originally-scaffolded commands across Phases 1–5 are now live.
+`thinkwork <cmd> --help` is authoritative for flags + examples.
 
 | Phase | Domain | Commands |
 |-------|--------|----------|
-| **0 (now)** | Foundation | `login` (Cognito + AWS), `logout`, `me`, `--json`, GraphQL client, codegen, shared helpers |
-| 1 | Work & approvals | ✅ `thread`, `message`, `label`, `inbox` — **Phase 1 complete** |
-| 2 | Agents & workspace | ✅ `member`, `team`, `kb`, `template`, `tenant`, `agent` — **Phase 2 complete** |
-| 3 | Automation & integrations | ✅ `routine`, `scheduled-job`, `turn`, `wakeup`, `webhook`, `skill` — **Phase 3 complete** (`connector` retired) |
-| 4 | Memory & artifacts | ✅ `memory`, `recipe`, `artifact` — **Phase 4 complete** |
-| 5 | Observability & spend | ✅ `cost`, `budget`, `performance`, `trace`, `dashboard` — **Phase 5 complete** |
-
-Each phase ships as one PR. Mid-phase stubs keep `thinkwork --help` complete
-so the full surface is always discoverable; individual commands flip from
-stub to real implementation as their phase lands. Run any
-`thinkwork <cmd> --help` today to see the planned flags + examples.
+| 0 | Foundation | `login` (chains AWS profile + Cognito API session), `logout`, `me`, `--json`, GraphQL client, codegen, shared helpers |
+| 1 | Work & approvals | `thread`, `message`, `label`, `inbox` |
+| 2 | Agents & workspace | `member`, `team`, `kb`, `template`, `tenant`, `agent` |
+| 3 | Automation & integrations | `routine`, `scheduled-job`, `turn`, `wakeup`, `webhook`, `skill` (`connector` retired) |
+| 4 | Memory & artifacts | `memory`, `recipe`, `artifact` |
+| 5 | Observability & spend | `cost`, `budget`, `performance`, `trace`, `dashboard` |
+
+`skill create` and `skill update` were retired in favor of
+`thinkwork skill push <folder>` — that's the real custom-skill authoring
+surface. Invoking them prints "retired — use `skill push`" and exits 2.
+
+Auth model: the CLI's auto-fallback to the deploy-stage's
+`api_auth_secret` admits most admin-tier paths via the server's
+`requireAdminOrServiceCaller` gate. Paths that stamp a specific user
+identity onto the row (`createThread`, `sendMessage`, `core/*` member
+mutations) stay Cognito-required so service callers can't ghost-write
+as a user — sign in via `thinkwork login --stage <s>` (or the chained
+prompt from `thinkwork login`) for those.
 
 ## Interactive Init
 

package/dist/{api-client-MC4NOZ4L.js → api-client-ASJWIG3Z.js}

@@ -5,7 +5,7 @@ import {
   readTfVar,
   resolveApiConfig,
   resolveTfvarsPath
-} from "./chunk-34NMB5AK.js";
+} from "./chunk-JEHV35EU.js";
 export {
   apiFetch,
   apiFetchRaw,

package/dist/{chunk-34NMB5AK.js → chunk-JEHV35EU.js}

@@ -43,6 +43,11 @@ function saveEnterpriseDeployment(config) {
     JSON.stringify(config, null, 2) + "\n"
   );
 }
+function loadEnterpriseDeployment(customerSlug) {
+  const configPath = join(ENTERPRISE_DEPLOYMENTS_DIR, `${customerSlug}.json`);
+  if (!existsSync(configPath)) return null;
+  return JSON.parse(readFileSync(configPath, "utf-8"));
+}
 function loadEnvironment(stage) {
   const configPath = join(ENVIRONMENTS_DIR, stage, "config.json");
   if (!existsSync(configPath)) return null;
@@ -176,6 +181,30 @@ function getApiEndpoint(stage, region) {
   );
   return raw && raw !== "None" ? raw : null;
 }
+function discoverThinkworkStageUrls(stage, region) {
+  const urls = {};
+  const apiEndpoint = getApiEndpoint(stage, region);
+  if (apiEndpoint) urls.apiEndpoint = apiEndpoint;
+  const appSyncUrl = runAws(
+    `appsync list-graphql-apis --region ${region} --query "graphqlApis[?name=='thinkwork-${stage}-subscriptions'].uris.GRAPHQL|[0]" --output text`
+  );
+  if (appSyncUrl && appSyncUrl !== "None") urls.appSyncUrl = appSyncUrl;
+  const distributions = runAws(
+    `cloudfront list-distributions --query "DistributionList.Items[?contains(Origins.Items[0].DomainName, 'thinkwork-${stage}-')].{Origin:Origins.Items[0].DomainName,Domain:DomainName}" --output json`
+  );
+  if (distributions) {
+    const parsed = JSON.parse(distributions);
+    for (const distribution of parsed) {
+      if (distribution.Origin.includes(`thinkwork-${stage}-admin`)) {
+        urls.adminUrl = `https://${distribution.Domain}`;
+      }
+      if (distribution.Origin.includes(`thinkwork-${stage}-docs`)) {
+        urls.docsUrl = `https://${distribution.Domain}`;
+      }
+    }
+  }
+  return urls;
+}
 function getApiAuthSecretFromLambda(stage, region) {
   const raw = runAws(
     `lambda get-function-configuration --function-name thinkwork-${stage}-api-tenants --region ${region} --query "Environment.Variables.API_AUTH_SECRET" --output text`
@@ -345,8 +374,10 @@ export {
   printSummary,
   listDeployedStages,
   getApiEndpoint,
+  discoverThinkworkStageUrls,
   saveEnvironment,
   saveEnterpriseDeployment,
+  loadEnterpriseDeployment,
   loadEnvironment,
   listEnvironments,
   resolveTerraformDir,