thinkwork-cli 0.12.9 → 0.12.10

package/dist/terraform/modules/app/www-dns/variables.tf

@@ -42,14 +42,26 @@ variable "admin_cloudfront_domain_name" {
   default     = ""
 }
 
+variable "include_app" {
+  description = "When true, add app.<domain> to the ACM cert SANs and create a Cloudflare CNAME for the canonical end-user app."
+  type        = bool
+  default     = false
+}
+
+variable "app_cloudfront_domain_name" {
+  description = "CloudFront distribution domain name for the canonical end-user app. Used as the target for the app.<domain> Cloudflare CNAME when include_app is true."
+  type        = string
+  default     = ""
+}
+
 variable "include_computer" {
-  description = "When true, add computer.<domain> to the ACM cert SANs and create a Cloudflare CNAME for it. Same cycle-avoidance rationale as include_docs."
+  description = "When true, add computer.<domain> to the ACM cert SANs. With include_app=true this creates a compatibility redirect to app.<domain>; otherwise it creates the legacy CNAME to computer_cloudfront_domain_name."
   type        = bool
   default     = false
 }
 
 variable "computer_cloudfront_domain_name" {
-  description = "CloudFront distribution domain name for the computer SPA. Used as the target for the computer.<domain> Cloudflare CNAME when include_computer is true."
+  description = "Deprecated CloudFront distribution domain name for the legacy computer SPA. Only used when include_computer=true and include_app=false."
   type        = string
   default     = ""
 }

package/dist/terraform/modules/thinkwork/main.tf

@@ -37,6 +37,51 @@ locals {
     ? "agentcore"
     : local.hindsight_enabled ? "hindsight" : "agentcore"
   )
+
+  # The end-user app is now canonically hosted at app.<domain>. Keep
+  # computer_domain as a compatibility fallback so older module callers and
+  # stages can upgrade without a flag-day.
+  end_user_app_domain          = var.app_domain != "" ? var.app_domain : var.computer_domain
+  end_user_app_certificate_arn = var.app_certificate_arn != "" ? var.app_certificate_arn : var.computer_certificate_arn
+  computer_compat_redirect_enabled = (
+    var.app_domain != "" &&
+    var.computer_domain != "" &&
+    var.computer_domain != local.end_user_app_domain
+  )
+  computer_compat_redirect_function_code = local.computer_compat_redirect_enabled ? trimspace(<<-EOF
+    function handler(event) {
+      var request = event.request;
+      var host = request.headers.host && request.headers.host.value;
+      if (host === "${var.computer_domain}") {
+        var parts = [];
+        var querystring = request.querystring || {};
+        for (var key in querystring) {
+          if (!querystring.hasOwnProperty(key)) continue;
+          var item = querystring[key];
+          if (item.multiValue) {
+            for (var i = 0; i < item.multiValue.length; i++) {
+              parts.push(key + '=' + item.multiValue[i].value);
+            }
+          } else if (item.value === '') {
+            parts.push(key);
+          } else {
+            parts.push(key + '=' + item.value);
+          }
+        }
+        return {
+          statusCode: 301,
+          statusDescription: 'Moved Permanently',
+          headers: {
+            location: {
+              value: "https://${local.end_user_app_domain}" + request.uri + (parts.length ? '?' + parts.join('&') : '')
+            }
+          }
+        };
+      }
+      return request;
+    }
+  EOF
+  ) : ""
 }
 
 ################################################################################
@@ -84,29 +129,31 @@ module "cognito" {
   google_oauth_client_secret = var.google_oauth_client_secret
   pre_signup_lambda_zip      = var.pre_signup_lambda_zip
 
-  # Single ThinkworkAdmin Cognito client serves both admin and computer SPAs.
+  # Single ThinkworkAdmin Cognito client serves both admin and end-user SPAs.
   # apps/computer reuses this client by design — same humans, same tenant
   # invitations, single sign-in across both surfaces. Each origin (admin
-  # distribution, admin custom domain, computer distribution, computer custom
-  # domain, plus localhost dev for both) needs both bare and /auth/callback
-  # entries because the OAuth flow lands on /auth/callback and the SPA's
-  # post-OAuth redirect lands on the bare origin.
-  admin_callback_urls = concat(
+  # distribution, admin custom domain, app distribution, app custom domain,
+  # compatibility computer domain, plus localhost dev for both) needs both
+  # bare and /auth/callback entries because the OAuth flow lands on
+  # /auth/callback and the SPA's post-OAuth redirect lands on the bare origin.
+  admin_callback_urls = distinct(concat(
     var.admin_callback_urls,
     ["https://${module.admin_site.distribution_domain}", "https://${module.admin_site.distribution_domain}/auth/callback"],
     var.admin_domain != "" ? ["https://${var.admin_domain}", "https://${var.admin_domain}/auth/callback"] : [],
     ["https://${module.computer_site.distribution_domain}", "https://${module.computer_site.distribution_domain}/auth/callback"],
+    local.end_user_app_domain != "" ? ["https://${local.end_user_app_domain}", "https://${local.end_user_app_domain}/auth/callback"] : [],
     var.computer_domain != "" ? ["https://${var.computer_domain}", "https://${var.computer_domain}/auth/callback"] : [],
     ["http://localhost:5180", "http://localhost:5180/auth/callback"]
-  )
-  admin_logout_urls = concat(
+  ))
+  admin_logout_urls = distinct(concat(
     var.admin_logout_urls,
     ["https://${module.admin_site.distribution_domain}"],
     var.admin_domain != "" ? ["https://${var.admin_domain}"] : [],
     ["https://${module.computer_site.distribution_domain}"],
+    local.end_user_app_domain != "" ? ["https://${local.end_user_app_domain}"] : [],
     var.computer_domain != "" ? ["https://${var.computer_domain}"] : [],
     ["http://localhost:5180"]
-  )
+  ))
   mobile_callback_urls = var.mobile_callback_urls
   mobile_logout_urls   = var.mobile_logout_urls
 }
@@ -585,7 +632,7 @@ module "admin_site" {
 }
 
 ################################################################################
-# Computer Static Site (apps/computer — end-user surface at computer.thinkwork.ai)
+# End-User App Static Site (apps/computer — canonical surface at app.thinkwork.ai)
 ################################################################################
 
 locals {
@@ -607,11 +654,15 @@ locals {
 module "computer_site" {
   source = "../app/static-site"
 
-  stage           = var.stage
-  site_name       = "computer"
-  is_spa          = true
-  custom_domain   = var.computer_domain
-  certificate_arn = var.computer_certificate_arn
+  stage         = var.stage
+  site_name     = "computer"
+  is_spa        = true
+  custom_domain = local.end_user_app_domain
+  custom_domain_aliases = local.computer_compat_redirect_enabled ? [
+    var.computer_domain,
+  ] : []
+  certificate_arn              = local.end_user_app_certificate_arn
+  viewer_request_function_code = local.computer_compat_redirect_function_code
 
   # Plan-012 U10: host CSP defends the parent origin. Iframe-shell's
   # own CSP (set on computer_sandbox_site below) carries the

package/dist/terraform/modules/thinkwork/outputs.tf

@@ -148,25 +148,51 @@ output "admin_url" {
   value       = var.admin_domain != "" ? "https://${var.admin_domain}" : "https://${module.admin_site.distribution_domain}"
 }
 
-# Computer static site (apps/computer — end-user surface)
+locals {
+  end_user_app_url = local.end_user_app_domain != "" ? "https://${local.end_user_app_domain}" : "https://${module.computer_site.distribution_domain}"
+}
+
+# End-user app static site (apps/computer — internal package name retained)
+output "app_distribution_id" {
+  description = "CloudFront distribution ID for the end-user app"
+  value       = module.computer_site.distribution_id
+}
+
+output "app_distribution_domain" {
+  description = "CloudFront domain for the end-user app"
+  value       = module.computer_site.distribution_domain
+}
+
+output "app_bucket_name" {
+  description = "S3 bucket for end-user app assets"
+  value       = module.computer_site.bucket_name
+}
+
+output "app_url" {
+  description = "Public URL for the end-user app (custom app domain when set, CloudFront default otherwise)"
+  value       = local.end_user_app_url
+}
+
+# Deprecated compatibility aliases. Keep these stable for existing scripts and
+# external callers while the source package remains apps/computer.
 output "computer_distribution_id" {
-  description = "CloudFront distribution ID for the computer app"
+  description = "Deprecated alias for app_distribution_id"
   value       = module.computer_site.distribution_id
 }
 
 output "computer_distribution_domain" {
-  description = "CloudFront domain for the computer app"
+  description = "Deprecated alias for app_distribution_domain"
   value       = module.computer_site.distribution_domain
 }
 
 output "computer_bucket_name" {
-  description = "S3 bucket for computer app assets"
+  description = "Deprecated alias for app_bucket_name"
   value       = module.computer_site.bucket_name
 }
 
 output "computer_url" {
-  description = "Public URL for the computer app (custom domain when set, CloudFront default otherwise)"
-  value       = var.computer_domain != "" ? "https://${var.computer_domain}" : "https://${module.computer_site.distribution_domain}"
+  description = "Deprecated alias for app_url"
+  value       = local.end_user_app_url
 }
 
 # Computer sandbox subdomain (plan-012 U3 / U11.5 — iframe-isolated

package/dist/terraform/modules/thinkwork/variables.tf

@@ -350,14 +350,26 @@ variable "admin_certificate_arn" {
   default     = ""
 }
 
+variable "app_domain" {
+  description = "Canonical custom domain for the end-user app (e.g. app.thinkwork.ai). Leave empty to fall back to computer_domain for compatibility."
+  type        = string
+  default     = ""
+}
+
+variable "app_certificate_arn" {
+  description = "ACM certificate ARN for the canonical end-user app domain (us-east-1, required for CloudFront custom domains). Leave empty to fall back to computer_certificate_arn for compatibility."
+  type        = string
+  default     = ""
+}
+
 variable "computer_domain" {
-  description = "Custom domain for the computer SPA (e.g. computer.thinkwork.ai). Leave empty for CloudFront default."
+  description = "Deprecated compatibility domain for the end-user app (e.g. computer.thinkwork.ai). When app_domain is set, this domain should redirect to app_domain instead of serving the SPA directly."
   type        = string
   default     = ""
 }
 
 variable "computer_certificate_arn" {
-  description = "ACM certificate ARN for the computer domain (us-east-1, required for CloudFront custom domains)."
+  description = "Deprecated ACM certificate ARN for the compatibility computer domain. Prefer app_certificate_arn for new deployments."
   type        = string
   default     = ""
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkwork-cli",
-  "version": "0.12.9",
+  "version": "0.12.10",
   "description": "Thinkwork CLI — deploy, manage, and interact with your Thinkwork stack",
   "license": "Apache-2.0",
   "type": "module",