thinkwork-cli 0.13.0 → 0.13.2

package/dist/terraform/modules/thinkwork/outputs.tf

@@ -28,6 +28,30 @@ output "identity_provider_names" {
   value       = module.cognito.identity_provider_names
 }
 
+output "auth_route_clients" {
+  description = "Safe Cognito app-client manifest for local, Google, Microsoft, and tenant Entra routes."
+  value       = module.cognito.auth_route_clients
+}
+
+output "auth_retirement_phase" {
+  description = "Applied authentication retirement phase used for safe controller upgrades."
+  value       = module.cognito.auth_retirement_phase
+}
+
+output "web_local_client_id" {
+  description = "Local-password-only Cognito app client for web login."
+  value       = module.cognito.web_local_client_id
+}
+
+output "mobile_local_client_id" {
+  description = "Local-password-only Cognito app client for mobile login."
+  value       = module.cognito.mobile_local_client_id
+}
+
+output "microsoft_identity_provider_name" {
+  value = module.cognito.microsoft_identity_provider_name
+}
+
 output "kms_key_arn" {
   value = module.kms.key_arn
 }
@@ -107,11 +131,6 @@ output "appsync_realtime_url" {
   value = module.appsync.graphql_realtime_url
 }
 
-output "appsync_api_key" {
-  value     = module.appsync.graphql_api_key
-  sensitive = true
-}
-
 output "auth_domain" {
   description = "Cognito hosted UI domain"
   value       = module.cognito.auth_domain
@@ -604,3 +623,167 @@ output "compliance_anchor_lambda_role_arn" {
   description = "ARN of the IAM role the anchor Lambda (U8a/U8b) will assume. Inert in U7 — no Lambda function references this yet."
   value       = module.compliance_anchors.lambda_role_arn
 }
+
+# Capability broker (THINK-280 U3) — ship-inert; all empty until
+# var.enable_capability_broker flips on. The API-side session opener reads
+# these to build the sandbox SessionBootstrap.
+output "capability_broker_enabled" {
+  description = "Whether the governed capability broker infra is provisioned."
+  value       = module.capability_broker.enabled
+}
+
+output "capability_broker_session_table_name" {
+  description = "DynamoDB session table (CAPABILITY_BROKER_SESSION_TABLE). Empty when disabled."
+  value       = module.capability_broker.session_table_name
+}
+
+output "capability_broker_audience" {
+  description = "PoP session audience (CAPABILITY_BROKER_AUDIENCE). Empty when disabled."
+  value       = module.capability_broker.broker_audience
+}
+
+output "capability_broker_private_api_id" {
+  description = "Private REST API id the sandbox targets through the VPCE (CAPABILITY_BROKER_API_ID). Empty when disabled."
+  value       = module.capability_broker.private_api_id
+}
+
+output "capability_broker_vpce_dns_name" {
+  description = "Endpoint-specific execute-api VPCE DNS name (private DNS OFF; CAPABILITY_BROKER_VPCE_DNS). Empty when disabled."
+  value       = module.capability_broker.execute_api_vpce_dns_name
+}
+
+# THINK-280 U4 — VPC placement for the capability-private interpreter, threaded
+# to the agentcore-admin Lambda (CAPABILITY_PRIVATE_SUBNET_IDS /
+# CAPABILITY_PRIVATE_SECURITY_GROUP_IDS) when U5/U6 wire that handler. Empty
+# when the broker is disabled, so the Lambda skips capability-private entirely.
+output "capability_private_interpreter_subnet_ids" {
+  description = "No-NAT subnets the capability-private VPC-mode interpreter attaches to. Empty when the broker is disabled."
+  value       = module.capability_broker.capability_private_interpreter_subnet_ids
+}
+
+output "capability_private_interpreter_security_group_id" {
+  description = "Egress-only SG (broker execute-api VPCE + DNS only) for the capability-private interpreter. Empty when the broker is disabled."
+  value       = module.capability_broker.capability_private_interpreter_security_group_id
+}
+
+output "analyst_egress_ip" {
+  description = "Stable NAT egress IP of the VPC-attached analyst data-path Lambdas — the address an external database's IP allowlist must admit. Null unless analyst_lambda_vpc_egress is set (and the stack has a NAT gateway)."
+  value       = var.analyst_lambda_vpc_egress ? module.vpc.nat_gateway_public_ip : null
+}
+
+# AgentCore Harness managed runtime outputs. Rollout-era `*_proof_*` aliases
+# remain below so existing automation can migrate without replacing resources.
+output "agentcore_harness_execution_role_arn" {
+  description = "Execution role ARN Harness microVMs assume (CreateHarness executionRoleArn). Empty when enable_agentcore_harness is false."
+  value       = module.agentcore_harness.execution_role_arn
+}
+
+output "agentcore_harness_arn" {
+  description = "Managed tenant/profile AgentCore Harness ARN. Empty when the managed runtime is disabled."
+  value       = module.agentcore_harness.managed_harness_arn
+}
+
+output "agentcore_harness_endpoint_arn" {
+  description = "Named version-pinned managed AgentCore Harness endpoint ARN."
+  value       = module.agentcore_harness.managed_endpoint_arn
+}
+
+output "agentcore_harness_endpoint_name" {
+  description = "Named managed AgentCore Harness endpoint qualifier."
+  value       = module.agentcore_harness.managed_endpoint_name
+}
+
+output "agentcore_harness_version" {
+  description = "Attested immutable AgentCore Harness version served by the managed endpoint."
+  value       = module.agentcore_harness.managed_target_version
+}
+
+output "agentcore_harness_status" {
+  description = "Safe server readiness state for the managed AgentCore Harness runtime."
+  value       = module.agentcore_harness.managed_status
+}
+
+output "agentcore_harness_configuration_fingerprint" {
+  description = "Non-secret fingerprint of the managed AgentCore Harness configuration ceiling."
+  value       = module.agentcore_harness.managed_configuration_fingerprint
+}
+
+output "agentcore_harness_proof_arn" {
+  description = "Deprecated: use agentcore_harness_arn."
+  value       = module.agentcore_harness.managed_harness_arn
+}
+
+output "agentcore_harness_proof_endpoint_arn" {
+  description = "Deprecated: use agentcore_harness_endpoint_arn."
+  value       = module.agentcore_harness.managed_endpoint_arn
+}
+
+output "agentcore_harness_proof_endpoint_name" {
+  description = "Deprecated: use agentcore_harness_endpoint_name."
+  value       = module.agentcore_harness.managed_endpoint_name
+}
+
+output "agentcore_harness_proof_version" {
+  description = "Deprecated: use agentcore_harness_version."
+  value       = module.agentcore_harness.managed_target_version
+}
+
+output "agentcore_harness_proof_status" {
+  description = "Deprecated: use agentcore_harness_status."
+  value       = module.agentcore_harness.managed_status
+}
+
+output "agentcore_harness_proof_configuration_fingerprint" {
+  description = "Deprecated: use agentcore_harness_configuration_fingerprint."
+  value       = module.agentcore_harness.managed_configuration_fingerprint
+}
+
+output "agentcore_turn_assertion_issuer" {
+  description = "Proof CUSTOM_JWT issuer used by deployed operator probes."
+  value       = module.api.agentcore_turn_assertion_issuer
+}
+
+output "agentcore_harness_audience" {
+  description = "Purpose-bound proof Harness audience."
+  value       = module.api.agentcore_harness_audience
+}
+
+output "agentcore_turn_assertion_active_key_arn" {
+  description = "Operator-only active proof signing key ARN."
+  value       = module.api.agentcore_turn_assertion_active_key_arn
+}
+
+output "agentcore_turn_assertion_active_kid" {
+  description = "Public JWKS key identifier for the active proof signing key."
+  value       = module.api.agentcore_turn_assertion_active_kid
+}
+
+output "agentcore_harness_proof_profile_parameter_name" {
+  description = "Deprecated rollout-compatible SSM Harness profile address."
+  value       = var.enable_agentcore_multiplayer_proof ? aws_ssm_parameter.agentcore_harness_proof_profile[0].name : ""
+}
+
+output "agentcore_harness_profile_parameter_name" {
+  description = "Server-only per-tenant SSM profile consumed by the managed Harness runtime."
+  value       = var.enable_agentcore_multiplayer_proof ? aws_ssm_parameter.agentcore_harness_profile[0].name : ""
+}
+
+output "agentcore_multiplayer_proof_gateway_arn" {
+  description = "Proof-only AgentCore Gateway ARN. Empty unless enable_agentcore_multiplayer_proof is true."
+  value       = module.agentcore_proof_gateway.gateway_arn
+}
+
+output "agentcore_multiplayer_proof_gateway_url" {
+  description = "Proof-only AgentCore Gateway MCP endpoint."
+  value       = module.agentcore_proof_gateway.gateway_url
+}
+
+output "agentcore_multiplayer_proof_workload_identity_arn" {
+  description = "Manual proof workload identity ARN used only for U1 Identity verification."
+  value       = module.agentcore_proof_identity.workload_identity_arn
+}
+
+output "agentcore_multiplayer_proof_credential_provider_arn" {
+  description = "Synthetic proof OAuth credential provider ARN."
+  value       = module.agentcore_proof_identity.credential_provider_arn
+}

package/dist/terraform/modules/thinkwork/variables.tf

@@ -51,22 +51,38 @@ variable "google_oauth_client_secret" {
 }
 
 variable "microsoft_oauth_client_id" {
-  description = "Microsoft OAuth client ID reserved for future Cognito/OAuth wiring. Accepted here so deployment-control-plane generated wrappers stay forward-compatible."
+  description = "Microsoft Entra application client ID for the deployment's default tenant-specific Cognito OIDC route."
   type        = string
   default     = ""
 }
 
 variable "microsoft_oauth_client_secret" {
-  description = "Microsoft OAuth client secret reserved for future Cognito/OAuth wiring."
+  description = "Microsoft Entra application client secret for the deployment's default tenant-specific Cognito OIDC route."
   type        = string
   sensitive   = true
   default     = ""
 }
 
 variable "microsoft_oauth_tenant" {
-  description = "Microsoft OAuth tenant reserved for future Cognito/OAuth wiring."
+  description = "Microsoft Entra directory GUID for the deployment's default Microsoft login route. Cognito requires the exact tenant issuer; organizations/common authorities are not valid token issuers."
   type        = string
-  default     = "organizations"
+  default     = ""
+
+  validation {
+    condition     = var.microsoft_oauth_tenant == "" || can(regex("^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$", var.microsoft_oauth_tenant))
+    error_message = "microsoft_oauth_tenant must be an Entra directory GUID."
+  }
+}
+
+variable "tenant_entra_connections" {
+  description = "Safe tenant-specific Entra provider metadata. Secrets are reconciled outside Terraform and are never accepted here."
+  type = list(object({
+    connection_key = string
+    tenant_id      = string
+    provider_name  = string
+    display_name   = string
+  }))
+  default = []
 }
 
 variable "oidc_identity_providers" {
@@ -117,6 +133,12 @@ variable "platform_operator_emails" {
   default     = ""
 }
 
+variable "analyst_lambda_vpc_egress" {
+  description = "VPC-attach the analyst data-path Lambdas (graphql-http, analyst-query-broker, analyst-connection-reconciler) to the stack's private subnets so their egress rides the NAT gateway's stable EIP. Enables external analyst data sources that sit behind an IP allowlist: the DBA admits the one NAT IP (see the analyst_egress_ip output) instead of opening the database to the world. Requires private (NAT-routed) subnets."
+  type        = bool
+  default     = false
+}
+
 variable "okf_wiki_efs_enabled" {
   description = "Provision the OKF Wiki Navigator EFS current-view substrate and mount it into the okf-efs-refresh Lambda plus Pi."
   type        = bool
@@ -315,6 +337,21 @@ variable "existing_identity_pool_id" {
   default = null
 }
 
+variable "existing_auth_route_clients" {
+  description = "Safe route-client manifest for BYO Cognito pools."
+  type = map(object({
+    client_id           = string
+    route_key           = string
+    client_family       = string
+    provider_names      = list(string)
+    explicit_auth_flows = list(string)
+    callback_urls       = list(string)
+    logout_urls         = list(string)
+    lifecycle_state     = string
+  }))
+  default = {}
+}
+
 variable "create_database" {
   description = "Create a new Aurora cluster (false = BYO)"
   type        = bool
@@ -353,6 +390,48 @@ variable "enable_hindsight" {
   default     = true
 }
 
+variable "enable_agentcore_harness" {
+  description = "Create the AgentCore Harness trial IAM surface (THINK-311 U4): the Harness microVM execution role plus the api Lambda's Harness create/invoke grants. Pure-IAM and ship-inert (no handler calls Harness until U5), so it defaults on. Never grants bedrock-agentcore:InvokeAgentRuntimeCommand."
+  type        = bool
+  default     = true
+}
+
+variable "enable_agentcore_multiplayer_proof" {
+  description = "Provision the non-production THINK-316 Identity/Gateway proof substrate. Defaults off; requires the Harness IAM surface and never changes the tenant runtime selector by itself."
+  type        = bool
+  default     = false
+}
+
+variable "agentcore_multiplayer_proof_tenant_slug" {
+  description = "Explicit non-production pilot tenant slug for the one-Harness multiplayer proof. Required when the proof is enabled."
+  type        = string
+  default     = ""
+}
+
+variable "agentcore_multiplayer_proof_owner_allowlist" {
+  description = "Comma-separated non-production subjects for the manual authorization-code and mixed-disclosure fixtures. Signed OBO turn participants are admitted from canonical tenant membership, not this list."
+  type        = string
+  default     = ""
+}
+
+variable "agentcore_turn_assertion_key_versions" {
+  description = "One or two published assertion key versions for the managed Harness proof."
+  type        = list(string)
+  default     = ["v1"]
+}
+
+variable "agentcore_turn_assertion_active_key_version" {
+  description = "Assertion key version used for new Harness and Gateway tokens."
+  type        = string
+  default     = "v1"
+}
+
+variable "enable_capability_broker" {
+  description = "Enable the THINK-280 governed capability broker (private REST API + dedicated execute-api VPCE with private DNS disabled, DynamoDB session store, broker Lambda). Ship-inert: defaults OFF; U4 flips it on after the live negative-egress proof. The broker Lambda code also fails closed independent of this flag."
+  type        = bool
+  default     = false
+}
+
 variable "memory_engine" {
   description = "Active long-term memory engine for canonical recall/inspect/export. Exactly one engine is authoritative per deployment. Empty auto-selects Hindsight for full installs. Accepted values: 'hindsight' (requires enable_hindsight = true) or 'agentcore' (explicit low-cost/development managed-memory mode). Legacy value 'managed' maps to 'agentcore'."
   type        = string
@@ -956,8 +1035,12 @@ variable "admin_callback_urls" {
   default = [
     "http://localhost:5174",
     "http://localhost:5174/auth/callback",
+    "http://127.0.0.1:5174",
+    "http://127.0.0.1:5174/auth/callback",
     "http://localhost:5175",
     "http://localhost:5175/auth/callback",
+    "http://127.0.0.1:5175",
+    "http://127.0.0.1:5175/auth/callback",
     "http://127.0.0.1:42010/callback",
     "http://localhost:42010/callback",
   ]
@@ -967,7 +1050,9 @@ variable "admin_logout_urls" {
   type = list(string)
   default = [
     "http://localhost:5174",
+    "http://127.0.0.1:5174",
     "http://localhost:5175",
+    "http://127.0.0.1:5175",
   ]
 }
 
@@ -980,6 +1065,22 @@ variable "desktop_callback_urls" {
   ]
 }
 
+variable "cli_callback_urls" {
+  type = list(string)
+  default = [
+    "http://127.0.0.1:42010/callback",
+    "http://localhost:42010/callback",
+  ]
+}
+
+variable "cli_logout_urls" {
+  type = list(string)
+  default = [
+    "http://127.0.0.1:42010/callback",
+    "http://localhost:42010/callback",
+  ]
+}
+
 variable "mobile_callback_urls" {
   type    = list(string)
   default = ["exp://localhost:8081", "thinkwork://", "thinkwork://auth/callback"]
@@ -1000,12 +1101,42 @@ variable "pre_signup_lambda_zip" {
   default     = ""
 }
 
+variable "auth_retirement_phase" {
+  description = "Native-auth migration phase. Fresh deployments default to retired (no WorkOS runtime); existing deployments must explicitly select coexistence/cutover until their evidence-gated retirement is complete."
+  type        = string
+  default     = "retired"
+
+  validation {
+    condition     = contains(["coexistence", "cutover", "retired"], var.auth_retirement_phase)
+    error_message = "auth_retirement_phase must be coexistence, cutover, or retired."
+  }
+}
+
+variable "auth_migration_recovery_deadline" {
+  description = "RFC3339 deadline for legacy-session identity migration. Must be supplied explicitly for coexistence deployments."
+  type        = string
+  default     = ""
+
+  validation {
+    condition = trimspace(var.auth_migration_recovery_deadline) == "" || (
+      can(timecmp(var.auth_migration_recovery_deadline, var.auth_migration_recovery_deadline))
+    )
+    error_message = "auth_migration_recovery_deadline must be empty or an RFC3339 timestamp."
+  }
+}
+
 variable "cognito_custom_auth_lambda_zip" {
-  description = "Path to the Cognito custom-auth challenge Lambda zip"
+  description = "Local WorkOS bridge custom-auth artifact retained only as a rollback runtime before auth retirement."
   type        = string
   default     = ""
 }
 
+variable "cognito_denied_app_client_ids" {
+  description = "Cognito app clients denied new and refresh token issuance during native-auth cutover"
+  type        = list(string)
+  default     = []
+}
+
 # ---------------------------------------------------------------------------
 # Docs site (custom domain — optional)
 # ---------------------------------------------------------------------------
@@ -1149,6 +1280,12 @@ variable "enable_slack_workspace_app" {
   default     = true
 }
 
+variable "enable_msteams_app" {
+  description = "Provision Microsoft Teams app install/link Lambdas, API routes, and credentials placeholder secret."
+  type        = bool
+  default     = false
+}
+
 # ---------------------------------------------------------------------------
 # SES inbound email (delegated tenant subzones — Option A)
 # ---------------------------------------------------------------------------
@@ -1247,6 +1384,12 @@ variable "knowledge_graph_observations_ingest_enabled" {
   default     = false
 }
 
+variable "ontology_scan_sweep_enabled" {
+  description = "Enable the recurring per-tenant ontology suggestion scan sweep (THINK-320 U4/KTD-3). Ships disabled."
+  type        = bool
+  default     = false
+}
+
 variable "wiki_source" {
   description = "Wiki compile pipeline source: 'planner' or 'graph' (THINK-133 U8/KTD-4)."
   type        = string
@@ -1328,6 +1471,12 @@ variable "analyst_policy_source" {
   }
 }
 
+variable "capability_self_extension_tenants" {
+  description = "Governed autonomy opt-in: comma/space-separated tenant ids allowed to autonomously self-extend capabilities. Empty (default) = NO tenant enabled; self-extension ships inert and fail-closed."
+  type        = string
+  default     = ""
+}
+
 variable "compliance_anchor_retention_days" {
   description = "Default Object Lock retention in days for the compliance audit-anchor bucket. SOC2 Type 1 baseline is 12 months (365)."
   type        = number