thinkwork-cli 0.13.0 → 0.13.2

package/dist/terraform/examples/greenfield/main.tf

@@ -105,6 +105,48 @@ variable "enable_hindsight" {
   default     = true
 }
 
+variable "enable_capability_broker" {
+  description = "THINK-280 governed capability runtime. When true, brings up the capability broker (PoP session table, private REST API, dedicated execute-api VPCE with private DNS off, no-NAT interpreter SG) and enables capability-private interpreter provisioning. Default false — currently flipped on only for the dev dogfood via deploy.yml."
+  type        = bool
+  default     = false
+}
+
+variable "enable_agentcore_multiplayer_proof" {
+  description = "Opt in to the non-production THINK-316 AgentCore Identity/Gateway proof substrate."
+  type        = bool
+  default     = false
+}
+
+variable "agentcore_multiplayer_proof_tenant_slug" {
+  description = "Explicit non-production tenant slug used for the one-Harness multiplayer proof."
+  type        = string
+  default     = ""
+}
+
+variable "agentcore_multiplayer_proof_owner_allowlist" {
+  description = "Comma-separated non-production subjects for the manual authorization-code and mixed-disclosure fixtures. Signed OBO turn participants do not require registration here."
+  type        = string
+  default     = ""
+}
+
+variable "agentcore_turn_assertion_key_versions" {
+  description = "One or two published AgentCore assertion key versions during rotation."
+  type        = list(string)
+  default     = ["v1"]
+}
+
+variable "agentcore_turn_assertion_active_key_version" {
+  description = "AgentCore assertion key version used to sign new tokens."
+  type        = string
+  default     = "v1"
+}
+
+variable "analyst_lambda_vpc_egress" {
+  description = "VPC-attach the analyst data-path Lambdas so their egress rides the NAT gateway's stable EIP — required when an external analyst data source sits behind an IP allowlist. See the thinkwork module's analyst_egress_ip output for the IP to allowlist."
+  type        = bool
+  default     = false
+}
+
 variable "memory_engine" {
   description = "Active long-term memory engine. Empty selects Hindsight when enable_hindsight = true. Use 'agentcore' only for explicit low-cost/development managed-memory deployments."
   type        = string
@@ -286,14 +328,68 @@ variable "google_oauth_client_secret" {
   default     = ""
 }
 
+variable "microsoft_oauth_client_id" {
+  description = "Microsoft Entra application client ID for direct Cognito organizations login"
+  type        = string
+  default     = ""
+}
+
+variable "microsoft_oauth_client_secret" {
+  description = "Microsoft Entra application client secret for direct Cognito organizations login"
+  type        = string
+  sensitive   = true
+  default     = ""
+}
+
+variable "microsoft_oauth_tenant" {
+  description = "Microsoft Entra directory GUID for the deployment's default Microsoft login route"
+  type        = string
+  default     = ""
+}
+
+variable "tenant_entra_connections" {
+  description = "Safe tenant-specific Entra provider metadata. Secret values must never be placed in tfvars."
+  type = list(object({
+    connection_key = string
+    tenant_id      = string
+    provider_name  = string
+    display_name   = string
+  }))
+  default = []
+}
+
 variable "pre_signup_lambda_zip" {
   description = "Path to the Cognito pre-signup Lambda zip"
   type        = string
   default     = ""
 }
 
+variable "auth_retirement_phase" {
+  description = "Native-auth migration phase. Greenfield installs are native-only; use coexistence/cutover only for an existing deployment migration."
+  type        = string
+  default     = "retired"
+
+  validation {
+    condition     = contains(["coexistence", "cutover", "retired"], var.auth_retirement_phase)
+    error_message = "auth_retirement_phase must be coexistence, cutover, or retired."
+  }
+}
+
+variable "auth_migration_recovery_deadline" {
+  description = "RFC3339 deadline for legacy-session identity migration; required only when explicitly deploying coexistence."
+  type        = string
+  default     = ""
+
+  validation {
+    condition = trimspace(var.auth_migration_recovery_deadline) == "" || (
+      can(timecmp(var.auth_migration_recovery_deadline, var.auth_migration_recovery_deadline))
+    )
+    error_message = "auth_migration_recovery_deadline must be empty or an RFC3339 timestamp."
+  }
+}
+
 variable "cognito_custom_auth_lambda_zip" {
-  description = "Path to the Cognito custom-auth challenge Lambda zip"
+  description = "Path to the WorkOS rollback Cognito custom-auth Lambda zip for source-checkout deployments."
   type        = string
   default     = ""
 }
@@ -438,6 +534,12 @@ variable "knowledge_graph_observations_ingest_enabled" {
   default     = false
 }
 
+variable "ontology_scan_sweep_enabled" {
+  description = "Enable the recurring per-tenant ontology suggestion scan sweep (THINK-320 U4/KTD-3). Ships disabled; enabled per stage once the Living Map review surfaces land."
+  type        = bool
+  default     = false
+}
+
 variable "wiki_source" {
   description = "Wiki compile pipeline source: 'planner' (LLM compile) or 'graph' (deterministic graph->wiki materializer). Dev flips first per THINK-133 U8/KTD-4; the default flips for all stages only after dev comparison evidence holds."
   type        = string
@@ -460,6 +562,12 @@ variable "analyst_policy_source" {
   }
 }
 
+variable "capability_self_extension_tenants" {
+  description = "Governed autonomy opt-in: comma/space-separated tenant ids allowed to autonomously self-extend capabilities (self_admit_connection / self_approve_routine). Empty (default) = NO tenant enabled; self-extension ships inert and fail-closed."
+  type        = string
+  default     = ""
+}
+
 variable "wiki_aggregation_pass_enabled" {
   description = <<-EOT
     Feature flag for the wiki aggregation pass — the second LLM call
@@ -746,49 +854,62 @@ module "thinkwork" {
 
   plugin_catalog_github_token_secret_arn = var.plugin_catalog_github_token_secret_arn
 
-  db_password                       = var.db_password
-  database_engine                   = var.database_engine
-  enable_hindsight                  = var.enable_hindsight
-  hindsight_database_name           = var.hindsight_database_name
-  memory_engine                     = var.memory_engine
-  twenty_provisioned                = var.twenty_provisioned
-  twenty_runtime_enabled            = var.twenty_runtime_enabled
-  twenty_image_uri                  = var.twenty_image_uri
-  twenty_db_username                = var.twenty_db_username
-  twenty_db_name                    = var.twenty_db_name
-  twenty_db_url_secret_arn          = var.twenty_db_url_secret_arn
-  twenty_encryption_key_secret_arn  = var.twenty_encryption_key_secret_arn
-  twenty_email_from_address         = var.twenty_email_from_address
-  twenty_email_from_name            = var.twenty_email_from_name
-  twenty_public_url                 = local.twenty_url
-  twenty_certificate_arn            = var.twenty_certificate_arn != "" ? var.twenty_certificate_arn : (local.twenty_managed_certificate_enabled ? aws_acm_certificate_validation.twenty[0].certificate_arn : "")
-  n8n_provisioned                   = var.n8n_provisioned
-  n8n_runtime_enabled               = var.n8n_runtime_enabled
-  n8n_image_uri                     = var.n8n_image_uri
-  n8n_database_admin_secret_arn     = var.n8n_database_admin_secret_arn
-  n8n_database_url_secret_arn       = var.n8n_database_url_secret_arn
-  n8n_database_username             = var.n8n_database_username
-  n8n_database_name                 = var.n8n_database_name
-  n8n_encryption_key_secret_arn     = var.n8n_encryption_key_secret_arn
-  n8n_operator_secret_arn           = var.n8n_operator_secret_arn
-  n8n_service_credential_secret_arn = var.n8n_service_credential_secret_arn
-  n8n_storage_bucket_name           = var.n8n_storage_bucket_name
-  n8n_container_port                = var.n8n_container_port
-  n8n_cache_engine                  = var.n8n_cache_engine
-  n8n_domain                        = local.n8n_domain
-  n8n_public_url                    = local.n8n_url
-  n8n_certificate_arn               = var.n8n_certificate_arn != "" ? var.n8n_certificate_arn : (local.n8n_managed_certificate_enabled ? aws_acm_certificate_validation.n8n[0].certificate_arn : "")
-  google_oauth_client_id            = var.google_oauth_client_id
-  google_oauth_client_secret        = var.google_oauth_client_secret
-  pre_signup_lambda_zip             = var.pre_signup_lambda_zip
-  cognito_custom_auth_lambda_zip    = var.cognito_custom_auth_lambda_zip
-  lambda_zips_dir                   = var.lambda_zips_dir
-  lambda_artifact_bucket            = var.lambda_artifact_bucket
-  lambda_artifact_prefix            = var.lambda_artifact_prefix
-  require_lambda_artifacts          = var.require_lambda_artifacts
-  enable_workspace_orchestration    = var.enable_workspace_orchestration
-  api_auth_secret                   = var.api_auth_secret
-  platform_operator_emails          = var.platform_operator_emails
+  db_password                                 = var.db_password
+  database_engine                             = var.database_engine
+  enable_hindsight                            = var.enable_hindsight
+  enable_capability_broker                    = var.enable_capability_broker
+  enable_agentcore_multiplayer_proof          = var.enable_agentcore_multiplayer_proof
+  agentcore_multiplayer_proof_tenant_slug     = var.agentcore_multiplayer_proof_tenant_slug
+  agentcore_multiplayer_proof_owner_allowlist = var.agentcore_multiplayer_proof_owner_allowlist
+  agentcore_turn_assertion_key_versions       = var.agentcore_turn_assertion_key_versions
+  agentcore_turn_assertion_active_key_version = var.agentcore_turn_assertion_active_key_version
+  analyst_lambda_vpc_egress                   = var.analyst_lambda_vpc_egress
+  hindsight_database_name                     = var.hindsight_database_name
+  memory_engine                               = var.memory_engine
+  twenty_provisioned                          = var.twenty_provisioned
+  twenty_runtime_enabled                      = var.twenty_runtime_enabled
+  twenty_image_uri                            = var.twenty_image_uri
+  twenty_db_username                          = var.twenty_db_username
+  twenty_db_name                              = var.twenty_db_name
+  twenty_db_url_secret_arn                    = var.twenty_db_url_secret_arn
+  twenty_encryption_key_secret_arn            = var.twenty_encryption_key_secret_arn
+  twenty_email_from_address                   = var.twenty_email_from_address
+  twenty_email_from_name                      = var.twenty_email_from_name
+  twenty_public_url                           = local.twenty_url
+  twenty_certificate_arn                      = var.twenty_certificate_arn != "" ? var.twenty_certificate_arn : (local.twenty_managed_certificate_enabled ? aws_acm_certificate_validation.twenty[0].certificate_arn : "")
+  n8n_provisioned                             = var.n8n_provisioned
+  n8n_runtime_enabled                         = var.n8n_runtime_enabled
+  n8n_image_uri                               = var.n8n_image_uri
+  n8n_database_admin_secret_arn               = var.n8n_database_admin_secret_arn
+  n8n_database_url_secret_arn                 = var.n8n_database_url_secret_arn
+  n8n_database_username                       = var.n8n_database_username
+  n8n_database_name                           = var.n8n_database_name
+  n8n_encryption_key_secret_arn               = var.n8n_encryption_key_secret_arn
+  n8n_operator_secret_arn                     = var.n8n_operator_secret_arn
+  n8n_service_credential_secret_arn           = var.n8n_service_credential_secret_arn
+  n8n_storage_bucket_name                     = var.n8n_storage_bucket_name
+  n8n_container_port                          = var.n8n_container_port
+  n8n_cache_engine                            = var.n8n_cache_engine
+  n8n_domain                                  = local.n8n_domain
+  n8n_public_url                              = local.n8n_url
+  n8n_certificate_arn                         = var.n8n_certificate_arn != "" ? var.n8n_certificate_arn : (local.n8n_managed_certificate_enabled ? aws_acm_certificate_validation.n8n[0].certificate_arn : "")
+  google_oauth_client_id                      = var.google_oauth_client_id
+  google_oauth_client_secret                  = var.google_oauth_client_secret
+  microsoft_oauth_client_id                   = var.microsoft_oauth_client_id
+  microsoft_oauth_client_secret               = var.microsoft_oauth_client_secret
+  microsoft_oauth_tenant                      = var.microsoft_oauth_tenant
+  tenant_entra_connections                    = var.tenant_entra_connections
+  pre_signup_lambda_zip                       = var.pre_signup_lambda_zip
+  auth_retirement_phase                       = var.auth_retirement_phase
+  auth_migration_recovery_deadline            = var.auth_migration_recovery_deadline
+  cognito_custom_auth_lambda_zip              = var.cognito_custom_auth_lambda_zip
+  lambda_zips_dir                             = var.lambda_zips_dir
+  lambda_artifact_bucket                      = var.lambda_artifact_bucket
+  lambda_artifact_prefix                      = var.lambda_artifact_prefix
+  require_lambda_artifacts                    = var.require_lambda_artifacts
+  enable_workspace_orchestration              = var.enable_workspace_orchestration
+  api_auth_secret                             = var.api_auth_secret
+  platform_operator_emails                    = var.platform_operator_emails
 
   # Public website custom domain (optional — wired only when www_domain is set)
   www_domain          = var.www_domain
@@ -831,7 +952,9 @@ module "thinkwork" {
   wiki_aggregation_pass_enabled                 = var.wiki_aggregation_pass_enabled
   wiki_source                                   = var.wiki_source
   analyst_policy_source                         = var.analyst_policy_source
+  capability_self_extension_tenants             = var.capability_self_extension_tenants
   knowledge_graph_observations_ingest_enabled   = var.knowledge_graph_observations_ingest_enabled
+  ontology_scan_sweep_enabled                   = var.ontology_scan_sweep_enabled
   wiki_deterministic_linking_enabled            = var.wiki_deterministic_linking_enabled
   google_places_api_key                         = var.google_places_api_key
   requester_idle_memory_learning_enabled        = var.requester_idle_memory_learning_enabled
@@ -990,12 +1113,6 @@ output "appsync_realtime_url" {
   value       = module.thinkwork.appsync_realtime_url
 }
 
-output "appsync_api_key" {
-  description = "AppSync API key"
-  value       = module.thinkwork.appsync_api_key
-  sensitive   = true
-}
-
 output "mapbox_public_token" {
   description = "Mapbox public token used by apps/web MapView. Read by scripts/build-web.sh to inline VITE_MAPBOX_PUBLIC_TOKEN at build time; empty string lets MapView fall back to OpenStreetMap tiles."
   value       = module.thinkwork.mapbox_public_token
@@ -1017,6 +1134,21 @@ output "admin_client_id" {
   value       = module.thinkwork.admin_client_id
 }
 
+output "auth_route_clients" {
+  description = "Safe Cognito app-client manifest for local, Google, Microsoft, and tenant Entra routes."
+  value       = module.thinkwork.auth_route_clients
+}
+
+output "auth_retirement_phase" {
+  description = "Applied authentication retirement phase used for safe controller upgrades."
+  value       = module.thinkwork.auth_retirement_phase
+}
+
+output "web_local_client_id" {
+  description = "Local-password-only Cognito app client used by the web runtime."
+  value       = module.thinkwork.web_local_client_id
+}
+
 output "mobile_client_id" {
   description = "Cognito app client ID for mobile"
   value       = module.thinkwork.mobile_client_id
@@ -1316,3 +1448,68 @@ output "customer_domain_name_servers" {
   description = "The four Route53 name servers for the customer-domain zone — publish these via the claim tool's `claim --set-targets` to delegate (empty when no customer domain is configured)."
   value       = module.thinkwork.customer_domain_name_servers
 }
+
+output "analyst_egress_ip" {
+  description = "Stable NAT egress IP of the VPC-attached analyst data-path Lambdas (null unless analyst_lambda_vpc_egress is set)"
+  value       = module.thinkwork.analyst_egress_ip
+}
+
+output "agentcore_harness_proof_arn" {
+  description = "Deprecated: use agentcore_harness_arn."
+  value       = module.thinkwork.agentcore_harness_proof_arn
+}
+
+output "agentcore_harness_arn" {
+  description = "Managed tenant/profile AgentCore Harness ARN."
+  value       = module.thinkwork.agentcore_harness_arn
+}
+
+output "agentcore_harness_endpoint_name" {
+  description = "Named version-pinned managed AgentCore Harness qualifier."
+  value       = module.thinkwork.agentcore_harness_endpoint_name
+}
+
+output "agentcore_harness_version" {
+  description = "Attested immutable managed AgentCore Harness version."
+  value       = module.thinkwork.agentcore_harness_version
+}
+
+output "agentcore_harness_status" {
+  description = "Safe managed AgentCore Harness readiness state."
+  value       = module.thinkwork.agentcore_harness_status
+}
+
+output "agentcore_harness_proof_endpoint_name" {
+  description = "Deprecated: use agentcore_harness_endpoint_name."
+  value       = module.thinkwork.agentcore_harness_proof_endpoint_name
+}
+
+output "agentcore_harness_proof_version" {
+  description = "Deprecated: use agentcore_harness_version."
+  value       = module.thinkwork.agentcore_harness_proof_version
+}
+
+output "agentcore_harness_proof_status" {
+  description = "Deprecated: use agentcore_harness_status."
+  value       = module.thinkwork.agentcore_harness_proof_status
+}
+
+output "agentcore_turn_assertion_issuer" {
+  description = "Proof CUSTOM_JWT issuer used by deployed operator probes."
+  value       = module.thinkwork.agentcore_turn_assertion_issuer
+}
+
+output "agentcore_harness_audience" {
+  description = "Purpose-bound proof Harness audience."
+  value       = module.thinkwork.agentcore_harness_audience
+}
+
+output "agentcore_turn_assertion_active_key_arn" {
+  description = "Operator-only active proof signing key ARN."
+  value       = module.thinkwork.agentcore_turn_assertion_active_key_arn
+}
+
+output "agentcore_turn_assertion_active_kid" {
+  description = "Public JWKS key identifier for the active proof signing key."
+  value       = module.thinkwork.agentcore_turn_assertion_active_kid
+}

package/dist/terraform/examples/greenfield/terraform.tfvars.example

@@ -72,10 +72,24 @@ db_password = "CHANGE_ME_strong_password_here"
 # Google OAuth (optional — leave empty to skip Google social login)
 # google_oauth_client_id     = ""
 # google_oauth_client_secret = ""
+# microsoft_oauth_client_id     = ""
+# microsoft_oauth_client_secret = "" # Supply securely; never commit a real value.
+# microsoft_oauth_tenant        = "" # Entra directory GUID; organizations/common are not valid Cognito issuers.
+
+# Tenant-specific Entra IdPs are reconciled by `thinkwork enterprise
+# identity-provider`; Terraform receives safe provider metadata only.
+# tenant_entra_connections = [{
+#   connection_key = "microsoft:tenant:00000000-0000-4000-8000-000000000000"
+#   tenant_id      = "00000000-0000-4000-8000-000000000000"
+#   provider_name  = "Entra_0000000000004000_ab12cd34"
+#   display_name   = "Example organization"
+# }]
 
 # Cognito trigger Lambdas (optional — leave empty if not using custom auth logic)
 # pre_signup_lambda_zip           = "./lambdas/cognito-pre-signup.zip"
-# cognito_custom_auth_lambda_zip  = "./lambdas/cognito-custom-auth.zip"
+# auth_retirement_phase          = "retired" # greenfield default; existing upgrades explicitly use coexistence -> cutover -> retired
+# auth_migration_recovery_deadline = "2026-08-01T00:00:00Z" # required when auth_retirement_phase = "coexistence"
+# cognito_custom_auth_lambda_zip = "./lambdas/cognito-custom-auth.zip" # rollback only
 
 # Lambda artifacts:
 # - Source checkout deploys can set lambda_zips_dir after `pnpm build:lambdas`.