thinkwork-cli 0.12.9 → 0.12.11

package/dist/commands/enterprise/templates/deploy-repo/.github/workflows/deploy.yml

@@ -4,6 +4,14 @@ name: Deploy ThinkWork
 on:
   workflow_dispatch:
     inputs:
+      operation:
+        description: "Deploy or destroy the stage stack"
+        type: choice
+        required: true
+        default: deploy
+        options:
+          - deploy
+          - destroy
       stage:
         description: "Deployment stage"
         type: string
@@ -36,10 +44,11 @@ concurrency:
 
 jobs:
   deploy:
-    name: Deploy ${{ github.event.inputs.stage }}
+    name: ${{ github.event.inputs.operation == 'destroy' && 'Destroy' || 'Deploy' }} ${{ github.event.inputs.stage }}
     runs-on: ubuntu-latest
     environment: ${{ github.event.inputs.stage }}
     env:
+      OPERATION: ${{ github.event.inputs.operation }}
       STAGE: ${{ github.event.inputs.stage }}
       COMPONENT: ${{ github.event.inputs.component }}
       RUN_SMOKES: ${{ github.event.inputs.run_smokes }}
@@ -96,7 +105,7 @@ jobs:
           terraform_wrapper: false
 
       - name: Prepare release artifacts
-        if: ${{ github.event.inputs.component == 'all' || github.event.inputs.component == 'foundation' || github.event.inputs.component == 'artifacts' }}
+        if: ${{ github.event.inputs.operation == 'deploy' && (github.event.inputs.component == 'all' || github.event.inputs.component == 'foundation' || github.event.inputs.component == 'artifacts') }}
         shell: bash
         run: |
           set -euo pipefail
@@ -107,25 +116,25 @@ jobs:
             --lambda-prefix "${{ steps.lock.outputs.lambda_prefix }}"
 
       - name: Terraform init
-        if: ${{ github.event.inputs.component == 'all' || github.event.inputs.component == 'foundation' || github.event.inputs.component == 'artifacts' || github.event.inputs.component == 'smokes' }}
+        if: ${{ github.event.inputs.operation == 'destroy' || github.event.inputs.component == 'all' || github.event.inputs.component == 'foundation' || github.event.inputs.component == 'artifacts' || github.event.inputs.component == 'smokes' }}
         working-directory: terraform
         shell: bash
         run: terraform init -backend-config="backend-${STAGE}.hcl"
 
       - name: Select Terraform workspace
-        if: ${{ github.event.inputs.component == 'all' || github.event.inputs.component == 'foundation' || github.event.inputs.component == 'artifacts' || github.event.inputs.component == 'smokes' }}
+        if: ${{ github.event.inputs.operation == 'destroy' || github.event.inputs.component == 'all' || github.event.inputs.component == 'foundation' || github.event.inputs.component == 'artifacts' || github.event.inputs.component == 'smokes' }}
         working-directory: terraform
         shell: bash
         run: |
           set -euo pipefail
-          if [ "$COMPONENT" = "all" ] || [ "$COMPONENT" = "foundation" ]; then
+          if [ "$OPERATION" = "deploy" ] && { [ "$COMPONENT" = "all" ] || [ "$COMPONENT" = "foundation" ]; }; then
             terraform workspace select "$STAGE" || terraform workspace new "$STAGE"
           else
             terraform workspace select "$STAGE"
           fi
 
       - name: Terraform apply
-        if: ${{ github.event.inputs.component == 'all' || github.event.inputs.component == 'foundation' }}
+        if: ${{ github.event.inputs.operation == 'deploy' && (github.event.inputs.component == 'all' || github.event.inputs.component == 'foundation') }}
         working-directory: terraform
         shell: bash
         env:
@@ -139,8 +148,23 @@ jobs:
             -var="lambda_artifact_prefix=${{ steps.lock.outputs.lambda_prefix }}" \
             -auto-approve
 
+      - name: Terraform destroy
+        if: ${{ github.event.inputs.operation == 'destroy' }}
+        working-directory: terraform
+        shell: bash
+        env:
+          TF_VAR_db_password: ${{ secrets.TF_VAR_DB_PASSWORD }}
+          TF_VAR_api_auth_secret: ${{ secrets.TF_VAR_API_AUTH_SECRET }}
+        run: |
+          set -euo pipefail
+          terraform destroy \
+            -var-file="stages/${STAGE}.tfvars" \
+            -var="lambda_artifact_bucket=${{ steps.lock.outputs.artifact_bucket }}" \
+            -var="lambda_artifact_prefix=${{ steps.lock.outputs.lambda_prefix }}" \
+            -auto-approve
+
       - name: Copy runtime images into customer ECR
-        if: ${{ github.event.inputs.component == 'all' || github.event.inputs.component == 'foundation' || github.event.inputs.component == 'artifacts' }}
+        if: ${{ github.event.inputs.operation == 'deploy' && (github.event.inputs.component == 'all' || github.event.inputs.component == 'foundation' || github.event.inputs.component == 'artifacts') }}
         shell: bash
         run: |
           set -euo pipefail
@@ -153,7 +177,7 @@ jobs:
             --ecr-repository-url "$ECR_REPOSITORY_URL"
 
       - name: Update AgentCore runtimes
-        if: ${{ github.event.inputs.component == 'all' || github.event.inputs.component == 'foundation' || github.event.inputs.component == 'artifacts' }}
+        if: ${{ github.event.inputs.operation == 'deploy' && (github.event.inputs.component == 'all' || github.event.inputs.component == 'foundation' || github.event.inputs.component == 'artifacts') }}
         shell: bash
         run: |
           set -euo pipefail
@@ -163,7 +187,7 @@ jobs:
             --region "${{ vars.AWS_REGION }}"
 
       - name: Sync static site bundles
-        if: ${{ github.event.inputs.component == 'all' || github.event.inputs.component == 'foundation' || github.event.inputs.component == 'artifacts' }}
+        if: ${{ github.event.inputs.operation == 'deploy' && (github.event.inputs.component == 'all' || github.event.inputs.component == 'foundation' || github.event.inputs.component == 'artifacts') }}
         shell: bash
         run: |
           set -euo pipefail
@@ -173,7 +197,7 @@ jobs:
             --terraform-dir terraform
 
       - name: Apply customer overlay contract
-        if: ${{ github.event.inputs.component == 'all' || github.event.inputs.component == 'overlays' }}
+        if: ${{ github.event.inputs.operation == 'deploy' && (github.event.inputs.component == 'all' || github.event.inputs.component == 'overlays') }}
         shell: bash
         run: |
           set -euo pipefail
@@ -187,7 +211,7 @@ jobs:
             > "$RELEASE_DIR/overlay-report.json"
 
       - name: Run smoke checks
-        if: ${{ github.event.inputs.run_smokes == 'true' && (github.event.inputs.component == 'all' || github.event.inputs.component == 'smokes') }}
+        if: ${{ github.event.inputs.operation == 'deploy' && github.event.inputs.run_smokes == 'true' && (github.event.inputs.component == 'all' || github.event.inputs.component == 'smokes') }}
         shell: bash
         run: |
           set -euo pipefail
@@ -206,6 +230,7 @@ jobs:
             --work-dir "$RELEASE_DIR" \
             --terraform-dir terraform \
             --stage "$STAGE" \
+            --operation "$OPERATION" \
             --component "$COMPONENT" \
             --output "$DEPLOY_SUMMARY_JSON"
           cat "$DEPLOY_SUMMARY_JSON"
@@ -214,6 +239,7 @@ jobs:
             echo
             jq -r '
               "- Stage: " + .stage,
+              "- Operation: " + .operation,
               "- Release: " + .release.version,
               "- Component: " + .component,
               "- API: " + (.outputs.api_endpoint // "n/a"),
@@ -228,7 +254,7 @@ jobs:
       - uses: actions/upload-artifact@v4
         if: always()
         with:
-          name: thinkwork-deploy-${{ github.event.inputs.stage }}-${{ github.run_id }}
+          name: thinkwork-${{ github.event.inputs.operation }}-${{ github.event.inputs.stage }}-${{ github.run_id }}
           path: |
             /tmp/thinkwork-release/*.json
             /tmp/thinkwork-release/runtime-images.json

package/dist/commands/enterprise/templates/deploy-repo/docs/runbook.md

@@ -16,21 +16,67 @@ bootstrap -> workflow dispatch -> CI deploy -> overlay apply -> smoke summary
 Run these commands from an operator machine with temporary customer AWS admin
 access and GitHub admin access to this repository.
 
-1. Confirm access:
+1. Log in and verify readiness:
 
    ```bash
-   gh auth status
-   aws sts get-caller-identity
+   thinkwork login
    ```
 
-2. Install the CLI:
+2. Run the top-level bootstrap:
 
    ```bash
-   npm install -g thinkwork-cli
-   thinkwork --version
+   thinkwork deploy --bootstrap
    ```
 
-3. Choose the release and checksum:
+   The CLI prompts for the customer slug, stage, GitHub deployment repo,
+   whether to create the repo if it does not exist, and required secret values.
+   It creates or reuses the deployment repo checkout, bootstraps dev and prod
+   deployment authority, sets GitHub Environment secrets through `gh`, commits
+   and pushes managed files, dispatches the dev workflow, waits for the run, and
+   prints deploy evidence plus discovered URLs.
+
+3. Deploy again after repo or overlay changes:
+
+   ```bash
+   thinkwork deploy
+   ```
+
+   Run this from inside the generated deployment repo. From another directory,
+   pass `--customer {{CUSTOMER_SLUG}} --stage dev`.
+
+4. Log in to the deployed stack:
+
+   ```bash
+   thinkwork login --stage dev --region {{REGION}}
+   thinkwork me --stage dev --region {{REGION}}
+   ```
+
+5. Remove a stage:
+
+   ```bash
+   thinkwork destroy
+   ```
+
+   Run this from inside the generated deployment repo. The CLI prompts for the
+   stage, confirms the destructive action, dispatches the customer repo workflow
+   with `operation=destroy`, waits for GitHub Actions, and reports the run URL.
+   It removes the selected stage stack while preserving customer-wide bootstrap
+   resources such as the deployment repo, Terraform state bucket, artifact
+   bucket, OIDC provider, and GitHub Environment configuration.
+
+## Manual Fallback
+
+Use these commands only when troubleshooting or when you need to split the
+one-line flow into explicit steps.
+
+1. Confirm access:
+
+   ```bash
+   gh auth status
+   aws sts get-caller-identity
+   ```
+
+2. Choose the release and checksum:
 
    ```bash
    VERSION="$(thinkwork --version)"
@@ -39,7 +85,7 @@ access and GitHub admin access to this repository.
    MANIFEST_SHA256="$(curl -fsSL "$MANIFEST_URL" | shasum -a 256 | awk '{print $1}')"
    ```
 
-4. Bootstrap AWS trust, GitHub Environments, and managed repo files:
+3. Bootstrap AWS trust, GitHub Environments, and managed repo files:
 
    ```bash
    thinkwork enterprise bootstrap . \
@@ -54,91 +100,56 @@ access and GitHub admin access to this repository.
      --yes
    ```
 
-5. Commit and push generated files:
+4. Commit, push, and dispatch manually:
 
    ```bash
    git add .
    git commit -m "chore: bootstrap ThinkWork deployment repo"
    git push
+
+   gh workflow run deploy.yml \
+     --repo <github-owner>/<github-repo> \
+     -f stage=dev \
+     -f component=all \
+     -f run_smokes=true
    ```
 
-6. Set required GitHub Environment secrets for each stage:
+5. Watch the run and download evidence:
 
    ```bash
-   gh secret set TF_VAR_DB_PASSWORD \
-     --repo <github-owner>/<github-repo> \
-     --env dev \
-     --body "$DEV_DB_PASSWORD"
+   RUN_ID="$(gh run list --repo <github-owner>/<github-repo> --workflow deploy.yml --limit 1 --json databaseId --jq '.[0].databaseId')"
+   gh run watch "$RUN_ID" --repo <github-owner>/<github-repo> --exit-status
 
-   gh secret set TF_VAR_API_AUTH_SECRET \
+   mkdir -p "deploy-artifacts/dev-${RUN_ID}"
+   gh run download "$RUN_ID" \
      --repo <github-owner>/<github-repo> \
-     --env dev \
-     --body "$DEV_API_AUTH_SECRET"
-   ```
+     --name "thinkwork-deploy-dev-${RUN_ID}" \
+     --dir "deploy-artifacts/dev-${RUN_ID}"
 
-   Repeat for `prod` before the production deploy.
+   jq . "deploy-artifacts/dev-${RUN_ID}/deploy-summary.json"
+   jq . "deploy-artifacts/dev-${RUN_ID}/smoke-summary.json"
+   ```
 
-7. Verify GitHub Environment variables:
+6. Deploy production after the `prod` GitHub Environment has required
+   approvals and secrets:
 
    ```bash
-   gh variable list --repo <github-owner>/<github-repo> --env dev
-   gh variable list --repo <github-owner>/<github-repo> --env prod
+   thinkwork deploy --customer {{CUSTOMER_SLUG}} --stage prod --component all
    ```
 
-   Expected variables are `AWS_REGION`, `AWS_ROLE_ARN`, and
-   `THINKWORK_ARTIFACT_BUCKET`.
-
-8. Review stage config:
-   - `terraform/stages/dev.tfvars`
-   - `terraform/stages/prod.tfvars`
-   - `customer/deployment.json`
-
-   Do not commit plaintext secrets to `terraform/stages/*.tfvars`,
-   `customer/`, `.env`, or this runbook.
-
-9. Dispatch the first deploy:
+7. Destroy a stage manually:
 
    ```bash
    gh workflow run deploy.yml \
      --repo <github-owner>/<github-repo> \
+     -f operation=destroy \
      -f stage=dev \
      -f component=all \
-     -f run_smokes=true
+     -f run_smokes=false
    ```
 
-10. Watch the run and download evidence:
-
-    ```bash
-    RUN_ID="$(gh run list --repo <github-owner>/<github-repo> --workflow deploy.yml --limit 1 --json databaseId --jq '.[0].databaseId')"
-    gh run watch "$RUN_ID" --repo <github-owner>/<github-repo> --exit-status
-
-    mkdir -p "deploy-artifacts/dev-${RUN_ID}"
-    gh run download "$RUN_ID" \
-      --repo <github-owner>/<github-repo> \
-      --name "thinkwork-deploy-dev-${RUN_ID}" \
-      --dir "deploy-artifacts/dev-${RUN_ID}"
-
-    jq . "deploy-artifacts/dev-${RUN_ID}/deploy-summary.json"
-    jq . "deploy-artifacts/dev-${RUN_ID}/smoke-summary.json"
-    ```
-
-11. Log in to the deployed stack:
-
-    ```bash
-    thinkwork login --stage dev --region {{REGION}}
-    thinkwork me --stage dev --region {{REGION}}
-    ```
-
-12. Deploy production after the `prod` GitHub Environment has required
-    approvals and secrets:
-
-    ```bash
-    gh workflow run deploy.yml \
-      --repo <github-owner>/<github-repo> \
-      -f stage=prod \
-      -f component=all \
-      -f run_smokes=true
-    ```
+   Prefer `thinkwork destroy`; use direct `gh workflow run` only as a
+   troubleshooting fallback.
 
 ## Workflow Components
 
@@ -150,6 +161,10 @@ access and GitHub admin access to this repository.
 | `overlays`   | Apply only `customer/` evals, skills, workspace defaults, seeds, and branding records.                                                                 |
 | `smokes`     | Run smoke checks against an already-deployed stage.                                                                                                    |
 
+Set workflow `operation=destroy` to remove the selected stage stack. Destroy
+always uses Terraform for the whole stage; component-specific destroy is not
+supported.
+
 ## Overlay-Only Changes
 
 1. Edit files under `customer/`.
@@ -170,11 +185,7 @@ access and GitHub admin access to this repository.
 4. Dispatch:
 
    ```bash
-   gh workflow run deploy.yml \
-     --repo <github-owner>/<github-repo> \
-     -f stage=dev \
-     -f component=overlays \
-     -f run_smokes=false
+   thinkwork deploy --customer {{CUSTOMER_SLUG}} --stage dev --component overlays --no-run-smokes
    ```
 
 ## Release Upgrades
@@ -209,11 +220,7 @@ access and GitHub admin access to this repository.
    git commit -m "chore: bump ThinkWork to ${RELEASE}"
    git push
 
-   gh workflow run deploy.yml \
-     --repo <github-owner>/<github-repo> \
-     -f stage=dev \
-     -f component=all \
-     -f run_smokes=true
+   thinkwork deploy --customer {{CUSTOMER_SLUG}} --stage dev --component all
    ```
 
 3. Deploy to production after dev passes.

package/dist/commands/enterprise/templates/deploy-repo/scripts/apply-release.mjs

@@ -460,6 +460,7 @@ async function writeSummary() {
   const terraformDir = required("--terraform-dir");
   const summary = {
     stage: required("--stage"),
+    operation: optional("--operation") ?? "deploy",
     component: required("--component"),
     release: manifest.release,
     artifacts: await readJson(join(workDir, "prepared-artifacts.json"), null),

package/dist/terraform/examples/greenfield/main.tf

@@ -332,6 +332,7 @@ locals {
   www_dns_enabled = var.www_domain != "" && var.cloudflare_zone_id != ""
   docs_domain     = var.www_domain != "" ? "docs.${var.www_domain}" : ""
   admin_domain    = var.www_domain != "" ? "admin.${var.www_domain}" : ""
+  app_domain      = var.www_domain != "" ? "app.${var.www_domain}" : ""
   computer_domain = var.www_domain != "" ? "computer.${var.www_domain}" : ""
   sandbox_domain  = var.www_domain != "" ? "sandbox.${var.www_domain}" : ""
   api_domain      = var.www_domain != "" ? "api.${var.www_domain}" : ""
@@ -417,8 +418,14 @@ module "thinkwork" {
   admin_domain          = local.www_dns_enabled ? local.admin_domain : ""
   admin_certificate_arn = local.www_dns_enabled ? module.www_dns[0].certificate_arn : ""
 
-  # Computer SPA custom domain (derived from www_domain — computer.<apex>).
-  # Same ACM cert covers it via the include_computer SAN gate on www_dns.
+  # End-user app custom domain (derived from www_domain — app.<apex>).
+  # Same ACM cert covers it via the include_app SAN gate on www_dns.
+  app_domain          = local.www_dns_enabled ? local.app_domain : ""
+  app_certificate_arn = local.www_dns_enabled ? module.www_dns[0].certificate_arn : ""
+
+  # Deprecated compatibility host (derived from www_domain — computer.<apex>).
+  # www-dns redirects this host to app.<apex> while old bookmarks/OAuth
+  # callbacks are still in circulation.
   computer_domain          = local.www_dns_enabled ? local.computer_domain : ""
   computer_certificate_arn = local.www_dns_enabled ? module.www_dns[0].certificate_arn : ""
 
@@ -427,7 +434,7 @@ module "thinkwork" {
   # the shared apex/www/docs/admin/computer/api certificate.
   computer_sandbox_domain                 = local.www_dns_enabled ? local.sandbox_domain : ""
   computer_sandbox_certificate_arn        = local.www_dns_enabled ? aws_acm_certificate_validation.computer_sandbox[0].certificate_arn : ""
-  computer_sandbox_allowed_parent_origins = local.www_dns_enabled ? "https://${local.computer_domain},https://${local.admin_domain}" : ""
+  computer_sandbox_allowed_parent_origins = local.www_dns_enabled ? "https://${local.app_domain},https://${local.admin_domain}" : ""
 
   # SES inbound email subdomain (delegated Route53 subzone).
   ses_inbound_domain = var.ses_inbound_domain
@@ -489,15 +496,14 @@ module "www_dns" {
   include_admin                = true
   admin_cloudfront_domain_name = module.thinkwork.admin_distribution_domain
 
-  # Computer: same cycle-avoidance pattern as docs/admin. Phase one of the
-  # two-phase first apply (#971) used a static empty string here to dodge an
-  # "Invalid count argument" plan error while module.thinkwork.computer_site
-  # didn't yet exist in state. Now that the distribution is created and its
-  # domain is known, this can read the real output — `!= ""` resolves to a
-  # static true and the Cloudflare CNAME for computer.<domain> gets created
-  # on this apply.
-  include_computer                = true
-  computer_cloudfront_domain_name = module.thinkwork.computer_distribution_domain
+  # End-user app: canonical app.<apex> host. The underlying source package is
+  # still apps/computer for compatibility.
+  include_app                = true
+  app_cloudfront_domain_name = module.thinkwork.app_distribution_domain
+
+  # Compatibility host: computer.<apex> redirects to app.<apex> while old
+  # bookmarks and OAuth callbacks are still in circulation.
+  include_computer = true
 
   # Computer iframe sandbox: same cycle-avoidance pattern as computer.
   include_computer_sandbox                = true
@@ -652,18 +658,33 @@ output "admin_bucket_name" {
   value       = module.thinkwork.admin_bucket_name
 }
 
+output "app_url" {
+  description = "End-user app URL"
+  value       = local.www_dns_enabled ? "https://${local.app_domain}" : "https://${module.thinkwork.app_distribution_domain}"
+}
+
+output "app_distribution_id" {
+  description = "CloudFront distribution ID for app (for cache invalidation)"
+  value       = module.thinkwork.app_distribution_id
+}
+
+output "app_bucket_name" {
+  description = "S3 bucket for app assets"
+  value       = module.thinkwork.app_bucket_name
+}
+
 output "computer_url" {
-  description = "Computer app URL"
-  value       = local.www_dns_enabled ? "https://${local.computer_domain}" : "https://${module.thinkwork.computer_distribution_domain}"
+  description = "Deprecated alias for app_url"
+  value       = local.www_dns_enabled ? "https://${local.app_domain}" : "https://${module.thinkwork.app_distribution_domain}"
 }
 
 output "computer_distribution_id" {
-  description = "CloudFront distribution ID for computer (for cache invalidation)"
+  description = "Deprecated alias for app_distribution_id"
   value       = module.thinkwork.computer_distribution_id
 }
 
 output "computer_bucket_name" {
-  description = "S3 bucket for computer app assets"
+  description = "Deprecated alias for app_bucket_name"
   value       = module.thinkwork.computer_bucket_name
 }
 

package/dist/terraform/modules/app/static-site/main.tf

@@ -27,6 +27,12 @@ variable "custom_domain" {
   default     = ""
 }
 
+variable "custom_domain_aliases" {
+  description = "Additional custom domains attached to the same CloudFront distribution. Useful for compatibility hosts that redirect at viewer-request time."
+  type        = list(string)
+  default     = []
+}
+
 variable "certificate_arn" {
   description = "ACM certificate ARN for the custom domain (us-east-1, required for CloudFront)"
   type        = string
@@ -39,6 +45,12 @@ variable "is_spa" {
   default     = false
 }
 
+variable "viewer_request_function_code" {
+  description = "Optional CloudFront Function code to run on viewer-request. When set, it replaces the default non-SPA directory rewrite association."
+  type        = string
+  default     = ""
+}
+
 # ---------------------------------------------------------------------------
 # Response-headers policy (optional, plan-012 U3)
 #
@@ -111,6 +123,17 @@ locals {
       : ""
     )
   )
+
+  viewer_request_function_enabled = var.viewer_request_function_code != ""
+  viewer_request_function_arn = (
+    local.viewer_request_function_enabled
+    ? aws_cloudfront_function.viewer_request[0].arn
+    : (!var.is_spa ? aws_cloudfront_function.rewrite.arn : "")
+  )
+  custom_domain_aliases = distinct(compact(concat(
+    var.custom_domain != "" ? [var.custom_domain] : [],
+    var.custom_domain_aliases,
+  )))
 }
 
 check "policy_inputs_are_mutually_exclusive" {
@@ -240,6 +263,14 @@ resource "aws_cloudfront_function" "rewrite" {
   EOF
 }
 
+resource "aws_cloudfront_function" "viewer_request" {
+  count   = local.viewer_request_function_enabled ? 1 : 0
+  name    = "thinkwork-${var.stage}-${var.site_name}-viewer-request"
+  runtime = "cloudfront-js-2.0"
+  publish = true
+  code    = var.viewer_request_function_code
+}
+
 locals {
   # For SPAs, 403/404 from S3 means "not a real asset" — serve index.html with
   # a 200 so the client router can resolve the route. For directory-style
@@ -260,7 +291,7 @@ locals {
 resource "aws_cloudfront_distribution" "site" {
   enabled             = true
   default_root_object = "index.html"
-  aliases             = var.custom_domain != "" ? [var.custom_domain] : []
+  aliases             = local.custom_domain_aliases
   price_class         = "PriceClass_100"
 
   origin {
@@ -278,10 +309,10 @@ resource "aws_cloudfront_distribution" "site" {
     response_headers_policy_id = local.effective_response_headers_policy_id != "" ? local.effective_response_headers_policy_id : null
 
     dynamic "function_association" {
-      for_each = var.is_spa ? [] : [1]
+      for_each = local.viewer_request_function_arn != "" ? [1] : []
       content {
         event_type   = "viewer-request"
-        function_arn = aws_cloudfront_function.rewrite.arn
+        function_arn = local.viewer_request_function_arn
       }
     }
 

package/dist/terraform/modules/app/www-dns/main.tf

@@ -3,13 +3,15 @@
 #
 # Responsibilities:
 #   1. ACM certificate in us-east-1 covering apex + www
-#      (+ optional docs + optional admin).
+#      (+ optional docs + optional admin + optional app + optional computer).
 #   2. Cloudflare DNS records for ACM DNS validation.
 #   3. Apex CNAME in Cloudflare → primary CloudFront distribution (DNS-only).
 #   4. Second CloudFront distribution fronting an S3 website-redirect bucket
 #      that 301s www.<domain> → https://<domain>, plus its Cloudflare CNAME.
 #   5. Optional docs.<domain> CNAME → docs CloudFront distribution.
 #   6. Optional admin.<domain> CNAME → admin CloudFront distribution.
+#   7. Optional app.<domain> CNAME → end-user app CloudFront distribution.
+#   8. Optional computer.<domain> → app.<domain> 301 compatibility redirect.
 #
 # Cloudflare records MUST be DNS-only (grey cloud). CloudFront terminates TLS
 # with the ACM cert and needs the real Host header.
@@ -33,6 +35,7 @@ locals {
   www      = "www.${var.domain}"
   docs     = "docs.${var.domain}"
   admin    = "admin.${var.domain}"
+  app      = "app.${var.domain}"
   computer = "computer.${var.domain}"
   sandbox  = "sandbox.${var.domain}"
   api      = "api.${var.domain}"
@@ -49,17 +52,20 @@ locals {
     [local.www],
     var.include_docs ? [local.docs] : [],
     var.include_admin ? [local.admin] : [],
+    var.include_app ? [local.app] : [],
     var.include_computer ? [local.computer] : [],
     var.include_api ? [local.api] : [],
   )
 
   # Existing CNAME records stay gated on non-empty targets because their target
   # outputs are already known in the deployed stack. Newly bootstrapped records
-  # such as the sandbox CNAME must gate only on an explicit boolean so Terraform
-  # can plan the resource count before the new CloudFront distribution exists.
+  # such as app/computer compatibility/sandbox CNAMEs must gate only on explicit
+  # booleans so Terraform can plan the resource count before the new CloudFront
+  # distribution exists.
   create_docs_record     = var.include_docs && var.docs_cloudfront_domain_name != ""
   create_admin_record    = var.include_admin && var.admin_cloudfront_domain_name != ""
-  create_computer_record = var.include_computer && var.computer_cloudfront_domain_name != ""
+  create_app_record      = var.include_app
+  create_computer_record = var.include_computer
   create_api_record      = var.include_api && var.api_gateway_id != ""
 }
 
@@ -267,7 +273,28 @@ resource "cloudflare_record" "admin" {
 }
 
 ################################################################################
-# computer.<domain> → computer CloudFront distribution (optional)
+# app.<domain> → end-user app CloudFront distribution (optional)
+################################################################################
+
+resource "cloudflare_record" "app" {
+  count = local.create_app_record ? 1 : 0
+
+  zone_id = var.cloudflare_zone_id
+  name    = local.app
+  content = var.app_cloudfront_domain_name
+  type    = "CNAME"
+  ttl     = 300
+  proxied = false
+  comment = "thinkwork-${var.stage} app → CloudFront"
+}
+
+################################################################################
+# computer.<domain> → compatibility target (optional)
+#
+# With include_app=true, this alias points at the same app distribution as
+# app.<domain>; that distribution's viewer-request function performs the 301
+# to app.<domain>. Legacy deployments without include_app keep the old direct
+# CNAME behavior.
 ################################################################################
 
 resource "cloudflare_record" "computer" {
@@ -275,11 +302,11 @@ resource "cloudflare_record" "computer" {
 
   zone_id = var.cloudflare_zone_id
   name    = local.computer
-  content = var.computer_cloudfront_domain_name
+  content = var.include_app ? var.app_cloudfront_domain_name : var.computer_cloudfront_domain_name
   type    = "CNAME"
   ttl     = 300
   proxied = false
-  comment = "thinkwork-${var.stage} computer → CloudFront"
+  comment = var.include_app ? "thinkwork-${var.stage} computer → app compatibility alias" : "thinkwork-${var.stage} computer → CloudFront"
 }
 
 ################################################################################