thinkwork-cli 0.13.1 → 0.13.2

package/dist/terraform/modules/thinkwork/outputs.tf

@@ -28,6 +28,30 @@ output "identity_provider_names" {
   value       = module.cognito.identity_provider_names
 }
 
+output "auth_route_clients" {
+  description = "Safe Cognito app-client manifest for local, Google, Microsoft, and tenant Entra routes."
+  value       = module.cognito.auth_route_clients
+}
+
+output "auth_retirement_phase" {
+  description = "Applied authentication retirement phase used for safe controller upgrades."
+  value       = module.cognito.auth_retirement_phase
+}
+
+output "web_local_client_id" {
+  description = "Local-password-only Cognito app client for web login."
+  value       = module.cognito.web_local_client_id
+}
+
+output "mobile_local_client_id" {
+  description = "Local-password-only Cognito app client for mobile login."
+  value       = module.cognito.mobile_local_client_id
+}
+
+output "microsoft_identity_provider_name" {
+  value = module.cognito.microsoft_identity_provider_name
+}
+
 output "kms_key_arn" {
   value = module.kms.key_arn
 }
@@ -107,11 +131,6 @@ output "appsync_realtime_url" {
   value = module.appsync.graphql_realtime_url
 }
 
-output "appsync_api_key" {
-  value     = module.appsync.graphql_api_key
-  sensitive = true
-}
-
 output "auth_domain" {
   description = "Cognito hosted UI domain"
   value       = module.cognito.auth_domain
@@ -652,10 +671,119 @@ output "analyst_egress_ip" {
   value       = var.analyst_lambda_vpc_egress ? module.vpc.nat_gateway_public_ip : null
 }
 
-# THINK-311 U4 — AgentCore Harness trial. U5's harness-runner wires this into
-# its handler environment; graphql-http deliberately gets NO new env var (the
-# grouped-env 4KB ceiling, see project_graphql_http_env_4kb_ceiling).
+# AgentCore Harness managed runtime outputs. Rollout-era `*_proof_*` aliases
+# remain below so existing automation can migrate without replacing resources.
 output "agentcore_harness_execution_role_arn" {
   description = "Execution role ARN Harness microVMs assume (CreateHarness executionRoleArn). Empty when enable_agentcore_harness is false."
   value       = module.agentcore_harness.execution_role_arn
 }
+
+output "agentcore_harness_arn" {
+  description = "Managed tenant/profile AgentCore Harness ARN. Empty when the managed runtime is disabled."
+  value       = module.agentcore_harness.managed_harness_arn
+}
+
+output "agentcore_harness_endpoint_arn" {
+  description = "Named version-pinned managed AgentCore Harness endpoint ARN."
+  value       = module.agentcore_harness.managed_endpoint_arn
+}
+
+output "agentcore_harness_endpoint_name" {
+  description = "Named managed AgentCore Harness endpoint qualifier."
+  value       = module.agentcore_harness.managed_endpoint_name
+}
+
+output "agentcore_harness_version" {
+  description = "Attested immutable AgentCore Harness version served by the managed endpoint."
+  value       = module.agentcore_harness.managed_target_version
+}
+
+output "agentcore_harness_status" {
+  description = "Safe server readiness state for the managed AgentCore Harness runtime."
+  value       = module.agentcore_harness.managed_status
+}
+
+output "agentcore_harness_configuration_fingerprint" {
+  description = "Non-secret fingerprint of the managed AgentCore Harness configuration ceiling."
+  value       = module.agentcore_harness.managed_configuration_fingerprint
+}
+
+output "agentcore_harness_proof_arn" {
+  description = "Deprecated: use agentcore_harness_arn."
+  value       = module.agentcore_harness.managed_harness_arn
+}
+
+output "agentcore_harness_proof_endpoint_arn" {
+  description = "Deprecated: use agentcore_harness_endpoint_arn."
+  value       = module.agentcore_harness.managed_endpoint_arn
+}
+
+output "agentcore_harness_proof_endpoint_name" {
+  description = "Deprecated: use agentcore_harness_endpoint_name."
+  value       = module.agentcore_harness.managed_endpoint_name
+}
+
+output "agentcore_harness_proof_version" {
+  description = "Deprecated: use agentcore_harness_version."
+  value       = module.agentcore_harness.managed_target_version
+}
+
+output "agentcore_harness_proof_status" {
+  description = "Deprecated: use agentcore_harness_status."
+  value       = module.agentcore_harness.managed_status
+}
+
+output "agentcore_harness_proof_configuration_fingerprint" {
+  description = "Deprecated: use agentcore_harness_configuration_fingerprint."
+  value       = module.agentcore_harness.managed_configuration_fingerprint
+}
+
+output "agentcore_turn_assertion_issuer" {
+  description = "Proof CUSTOM_JWT issuer used by deployed operator probes."
+  value       = module.api.agentcore_turn_assertion_issuer
+}
+
+output "agentcore_harness_audience" {
+  description = "Purpose-bound proof Harness audience."
+  value       = module.api.agentcore_harness_audience
+}
+
+output "agentcore_turn_assertion_active_key_arn" {
+  description = "Operator-only active proof signing key ARN."
+  value       = module.api.agentcore_turn_assertion_active_key_arn
+}
+
+output "agentcore_turn_assertion_active_kid" {
+  description = "Public JWKS key identifier for the active proof signing key."
+  value       = module.api.agentcore_turn_assertion_active_kid
+}
+
+output "agentcore_harness_proof_profile_parameter_name" {
+  description = "Deprecated rollout-compatible SSM Harness profile address."
+  value       = var.enable_agentcore_multiplayer_proof ? aws_ssm_parameter.agentcore_harness_proof_profile[0].name : ""
+}
+
+output "agentcore_harness_profile_parameter_name" {
+  description = "Server-only per-tenant SSM profile consumed by the managed Harness runtime."
+  value       = var.enable_agentcore_multiplayer_proof ? aws_ssm_parameter.agentcore_harness_profile[0].name : ""
+}
+
+output "agentcore_multiplayer_proof_gateway_arn" {
+  description = "Proof-only AgentCore Gateway ARN. Empty unless enable_agentcore_multiplayer_proof is true."
+  value       = module.agentcore_proof_gateway.gateway_arn
+}
+
+output "agentcore_multiplayer_proof_gateway_url" {
+  description = "Proof-only AgentCore Gateway MCP endpoint."
+  value       = module.agentcore_proof_gateway.gateway_url
+}
+
+output "agentcore_multiplayer_proof_workload_identity_arn" {
+  description = "Manual proof workload identity ARN used only for U1 Identity verification."
+  value       = module.agentcore_proof_identity.workload_identity_arn
+}
+
+output "agentcore_multiplayer_proof_credential_provider_arn" {
+  description = "Synthetic proof OAuth credential provider ARN."
+  value       = module.agentcore_proof_identity.credential_provider_arn
+}

package/dist/terraform/modules/thinkwork/variables.tf

@@ -51,22 +51,38 @@ variable "google_oauth_client_secret" {
 }
 
 variable "microsoft_oauth_client_id" {
-  description = "Microsoft OAuth client ID reserved for future Cognito/OAuth wiring. Accepted here so deployment-control-plane generated wrappers stay forward-compatible."
+  description = "Microsoft Entra application client ID for the deployment's default tenant-specific Cognito OIDC route."
   type        = string
   default     = ""
 }
 
 variable "microsoft_oauth_client_secret" {
-  description = "Microsoft OAuth client secret reserved for future Cognito/OAuth wiring."
+  description = "Microsoft Entra application client secret for the deployment's default tenant-specific Cognito OIDC route."
   type        = string
   sensitive   = true
   default     = ""
 }
 
 variable "microsoft_oauth_tenant" {
-  description = "Microsoft OAuth tenant reserved for future Cognito/OAuth wiring."
+  description = "Microsoft Entra directory GUID for the deployment's default Microsoft login route. Cognito requires the exact tenant issuer; organizations/common authorities are not valid token issuers."
   type        = string
-  default     = "organizations"
+  default     = ""
+
+  validation {
+    condition     = var.microsoft_oauth_tenant == "" || can(regex("^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$", var.microsoft_oauth_tenant))
+    error_message = "microsoft_oauth_tenant must be an Entra directory GUID."
+  }
+}
+
+variable "tenant_entra_connections" {
+  description = "Safe tenant-specific Entra provider metadata. Secrets are reconciled outside Terraform and are never accepted here."
+  type = list(object({
+    connection_key = string
+    tenant_id      = string
+    provider_name  = string
+    display_name   = string
+  }))
+  default = []
 }
 
 variable "oidc_identity_providers" {
@@ -321,6 +337,21 @@ variable "existing_identity_pool_id" {
   default = null
 }
 
+variable "existing_auth_route_clients" {
+  description = "Safe route-client manifest for BYO Cognito pools."
+  type = map(object({
+    client_id           = string
+    route_key           = string
+    client_family       = string
+    provider_names      = list(string)
+    explicit_auth_flows = list(string)
+    callback_urls       = list(string)
+    logout_urls         = list(string)
+    lifecycle_state     = string
+  }))
+  default = {}
+}
+
 variable "create_database" {
   description = "Create a new Aurora cluster (false = BYO)"
   type        = bool
@@ -365,6 +396,36 @@ variable "enable_agentcore_harness" {
   default     = true
 }
 
+variable "enable_agentcore_multiplayer_proof" {
+  description = "Provision the non-production THINK-316 Identity/Gateway proof substrate. Defaults off; requires the Harness IAM surface and never changes the tenant runtime selector by itself."
+  type        = bool
+  default     = false
+}
+
+variable "agentcore_multiplayer_proof_tenant_slug" {
+  description = "Explicit non-production pilot tenant slug for the one-Harness multiplayer proof. Required when the proof is enabled."
+  type        = string
+  default     = ""
+}
+
+variable "agentcore_multiplayer_proof_owner_allowlist" {
+  description = "Comma-separated non-production subjects for the manual authorization-code and mixed-disclosure fixtures. Signed OBO turn participants are admitted from canonical tenant membership, not this list."
+  type        = string
+  default     = ""
+}
+
+variable "agentcore_turn_assertion_key_versions" {
+  description = "One or two published assertion key versions for the managed Harness proof."
+  type        = list(string)
+  default     = ["v1"]
+}
+
+variable "agentcore_turn_assertion_active_key_version" {
+  description = "Assertion key version used for new Harness and Gateway tokens."
+  type        = string
+  default     = "v1"
+}
+
 variable "enable_capability_broker" {
   description = "Enable the THINK-280 governed capability broker (private REST API + dedicated execute-api VPCE with private DNS disabled, DynamoDB session store, broker Lambda). Ship-inert: defaults OFF; U4 flips it on after the live negative-egress proof. The broker Lambda code also fails closed independent of this flag."
   type        = bool
@@ -865,18 +926,6 @@ variable "brain_dream_state_schedule_expression" {
   default     = "cron(0 5 * * ? *)"
 }
 
-variable "retry_dispatcher_enabled" {
-  description = "Enable the recurring retry-dispatcher schedule (THINK-307). Never enable on a stage before THINK-305, THINK-308, and THINK-309 are live there (parent plan deploy ordering); manual invokes work regardless."
-  type        = bool
-  default     = false
-}
-
-variable "stall_threshold_minutes" {
-  description = "Minutes of turn inactivity before the stall monitor marks a running turn timed_out; the retry dispatcher reads the same knob as its origin-freshness guard (THINK-306/THINK-307 — one knob, two consumers)."
-  type        = number
-  default     = 5
-}
-
 # ---------------------------------------------------------------------------
 # Naming / Buckets
 # ---------------------------------------------------------------------------
@@ -986,8 +1035,12 @@ variable "admin_callback_urls" {
   default = [
     "http://localhost:5174",
     "http://localhost:5174/auth/callback",
+    "http://127.0.0.1:5174",
+    "http://127.0.0.1:5174/auth/callback",
     "http://localhost:5175",
     "http://localhost:5175/auth/callback",
+    "http://127.0.0.1:5175",
+    "http://127.0.0.1:5175/auth/callback",
     "http://127.0.0.1:42010/callback",
     "http://localhost:42010/callback",
   ]
@@ -997,7 +1050,9 @@ variable "admin_logout_urls" {
   type = list(string)
   default = [
     "http://localhost:5174",
+    "http://127.0.0.1:5174",
     "http://localhost:5175",
+    "http://127.0.0.1:5175",
   ]
 }
 
@@ -1010,6 +1065,22 @@ variable "desktop_callback_urls" {
   ]
 }
 
+variable "cli_callback_urls" {
+  type = list(string)
+  default = [
+    "http://127.0.0.1:42010/callback",
+    "http://localhost:42010/callback",
+  ]
+}
+
+variable "cli_logout_urls" {
+  type = list(string)
+  default = [
+    "http://127.0.0.1:42010/callback",
+    "http://localhost:42010/callback",
+  ]
+}
+
 variable "mobile_callback_urls" {
   type    = list(string)
   default = ["exp://localhost:8081", "thinkwork://", "thinkwork://auth/callback"]
@@ -1030,12 +1101,42 @@ variable "pre_signup_lambda_zip" {
   default     = ""
 }
 
+variable "auth_retirement_phase" {
+  description = "Native-auth migration phase. Fresh deployments default to retired (no WorkOS runtime); existing deployments must explicitly select coexistence/cutover until their evidence-gated retirement is complete."
+  type        = string
+  default     = "retired"
+
+  validation {
+    condition     = contains(["coexistence", "cutover", "retired"], var.auth_retirement_phase)
+    error_message = "auth_retirement_phase must be coexistence, cutover, or retired."
+  }
+}
+
+variable "auth_migration_recovery_deadline" {
+  description = "RFC3339 deadline for legacy-session identity migration. Must be supplied explicitly for coexistence deployments."
+  type        = string
+  default     = ""
+
+  validation {
+    condition = trimspace(var.auth_migration_recovery_deadline) == "" || (
+      can(timecmp(var.auth_migration_recovery_deadline, var.auth_migration_recovery_deadline))
+    )
+    error_message = "auth_migration_recovery_deadline must be empty or an RFC3339 timestamp."
+  }
+}
+
 variable "cognito_custom_auth_lambda_zip" {
-  description = "Path to the Cognito custom-auth challenge Lambda zip"
+  description = "Local WorkOS bridge custom-auth artifact retained only as a rollback runtime before auth retirement."
   type        = string
   default     = ""
 }
 
+variable "cognito_denied_app_client_ids" {
+  description = "Cognito app clients denied new and refresh token issuance during native-auth cutover"
+  type        = list(string)
+  default     = []
+}
+
 # ---------------------------------------------------------------------------
 # Docs site (custom domain — optional)
 # ---------------------------------------------------------------------------
@@ -1283,6 +1384,12 @@ variable "knowledge_graph_observations_ingest_enabled" {
   default     = false
 }
 
+variable "ontology_scan_sweep_enabled" {
+  description = "Enable the recurring per-tenant ontology suggestion scan sweep (THINK-320 U4/KTD-3). Ships disabled."
+  type        = bool
+  default     = false
+}
+
 variable "wiki_source" {
   description = "Wiki compile pipeline source: 'planner' or 'graph' (THINK-133 U8/KTD-4)."
   type        = string

package/dist/terraform/schema.graphql

@@ -25,7 +25,7 @@ type Query {
 # Event payload types
 # ────────────────────────────────────────────────────────────────────
 
-type AgentStatusEvent {
+type AgentStatusEvent @aws_iam @aws_lambda {
   agentId: ID!
   tenantId: ID!
   status: String!
@@ -33,7 +33,7 @@ type AgentStatusEvent {
   updatedAt: AWSDateTime!
 }
 
-type NewMessageEvent {
+type NewMessageEvent @aws_iam @aws_lambda {
   messageId: ID!
   threadId: ID!
   tenantId: ID!
@@ -46,7 +46,7 @@ type NewMessageEvent {
   createdAt: AWSDateTime!
 }
 
-type HeartbeatActivityEvent {
+type HeartbeatActivityEvent @aws_iam @aws_lambda {
   heartbeatId: ID!
   tenantId: ID!
   status: String!
@@ -54,7 +54,7 @@ type HeartbeatActivityEvent {
   createdAt: AWSDateTime!
 }
 
-type ThreadUpdateEvent {
+type ThreadUpdateEvent @aws_iam @aws_lambda {
   threadId: ID!
   tenantId: ID!
   status: String!
@@ -62,7 +62,7 @@ type ThreadUpdateEvent {
   updatedAt: AWSDateTime!
 }
 
-type ThreadActivityEvent {
+type ThreadActivityEvent @aws_iam @aws_lambda {
   userId: ID!
   tenantId: ID!
   threadId: ID!
@@ -76,7 +76,7 @@ type ThreadActivityEvent {
   shouldNotify: Boolean
 }
 
-type InboxItemStatusEvent {
+type InboxItemStatusEvent @aws_iam @aws_lambda {
   inboxItemId: ID!
   tenantId: ID!
   status: String!
@@ -84,7 +84,7 @@ type InboxItemStatusEvent {
   updatedAt: AWSDateTime!
 }
 
-type ThreadTurnUpdateEvent {
+type ThreadTurnUpdateEvent @aws_iam @aws_lambda {
   runId: ID!
   triggerId: ID
   tenantId: ID!
@@ -99,7 +99,7 @@ type ThreadTurnUpdateEvent {
 # render live (tool/skill/phase steps in Phase 1, coalesced text deltas in
 # Phase 2) without a refetch. seq gives total order; payload carries the
 # step detail (AWSJSON). Subscribe by threadId.
-type ThreadTurnStepEvent {
+type ThreadTurnStepEvent @aws_iam @aws_lambda {
   runId: ID!
   threadId: ID!
   tenantId: ID!
@@ -113,7 +113,7 @@ type ThreadTurnStepEvent {
   createdAt: AWSDateTime!
 }
 
-type OrgUpdateEvent {
+type OrgUpdateEvent @aws_iam @aws_lambda {
   tenantId: ID!
   changeType: String!
   entityType: String
@@ -121,7 +121,7 @@ type OrgUpdateEvent {
   updatedAt: AWSDateTime!
 }
 
-type CostRecordedEvent {
+type CostRecordedEvent @aws_iam @aws_lambda {
   tenantId: ID!
   agentId: ID
   agentName: String
@@ -134,7 +134,7 @@ type CostRecordedEvent {
   updatedAt: AWSDateTime!
 }
 
-type EvalRunUpdateEvent {
+type EvalRunUpdateEvent @aws_iam @aws_lambda {
   runId: ID!
   tenantId: ID!
   agentId: ID
@@ -147,13 +147,37 @@ type EvalRunUpdateEvent {
   updatedAt: AWSDateTime!
 }
 
-type WorkspaceAccessRevokedEvent {
+type WorkspaceAccessRevokedEvent @aws_iam @aws_lambda {
   tenantId: ID!
   spaceId: ID!
   userId: ID!
   revokedAt: AWSDateTime!
 }
 
+type SubscriptionInvalidationEvent @aws_iam @aws_lambda {
+  subscriptionField: String!
+  scope: String!
+  tenantId: ID!
+  userId: ID
+  resourceKind: String
+  resourceId: ID
+}
+
+enum SubscriptionInvalidationField {
+  ON_AGENT_STATUS_CHANGED
+  ON_NEW_MESSAGE
+  ON_HEARTBEAT_ACTIVITY
+  ON_THREAD_UPDATED
+  ON_THREAD_ACTIVITY
+  ON_INBOX_ITEM_STATUS_CHANGED
+  ON_THREAD_TURN_UPDATED
+  ON_THREAD_TURN_STEP
+  ON_ORG_UPDATED
+  ON_COST_RECORDED
+  ON_EVAL_RUN_UPDATED
+  ON_WORKSPACE_ACCESS_REVOKED
+}
+
 # ────────────────────────────────────────────────────────────────────
 # Notification mutations
 #
@@ -164,12 +188,21 @@ type WorkspaceAccessRevokedEvent {
 
 type Mutation {
   _empty: String
+  invalidateSubscription(
+    subscriptionField: SubscriptionInvalidationField!
+    scope: String!
+    tenantId: ID!
+    userId: ID
+    resourceKind: String
+    resourceId: ID
+  ): SubscriptionInvalidationEvent @aws_iam
+
   notifyAgentStatus(
     agentId: ID!
     tenantId: ID!
     status: String!
     name: String!
-  ): AgentStatusEvent @aws_api_key @aws_cognito_user_pools @aws_iam
+  ): AgentStatusEvent @aws_iam
 
   notifyNewMessage(
     messageId: ID!
@@ -181,21 +214,21 @@ type Mutation {
     senderId: ID
     ownerType: String
     ownerId: ID
-  ): NewMessageEvent @aws_api_key @aws_cognito_user_pools @aws_iam
+  ): NewMessageEvent @aws_iam
 
   notifyHeartbeatActivity(
     heartbeatId: ID!
     tenantId: ID!
     status: String!
     message: String
-  ): HeartbeatActivityEvent @aws_api_key @aws_cognito_user_pools @aws_iam
+  ): HeartbeatActivityEvent @aws_iam
 
   notifyThreadUpdate(
     threadId: ID!
     tenantId: ID!
     status: String!
     title: String!
-  ): ThreadUpdateEvent @aws_api_key @aws_cognito_user_pools @aws_iam
+  ): ThreadUpdateEvent @aws_iam
 
   notifyThreadActivity(
     userId: ID!
@@ -209,14 +242,14 @@ type Mutation {
     createdAt: AWSDateTime
     mentioned: Boolean
     shouldNotify: Boolean
-  ): ThreadActivityEvent @aws_api_key @aws_cognito_user_pools @aws_iam
+  ): ThreadActivityEvent @aws_iam
 
   notifyInboxItemUpdate(
     inboxItemId: ID!
     tenantId: ID!
     status: String!
     title: String
-  ): InboxItemStatusEvent @aws_api_key @aws_cognito_user_pools @aws_iam
+  ): InboxItemStatusEvent @aws_iam
 
   notifyThreadTurnUpdate(
     runId: ID!
@@ -226,7 +259,7 @@ type Mutation {
     agentId: ID
     status: String!
     triggerName: String
-  ): ThreadTurnUpdateEvent @aws_api_key @aws_cognito_user_pools @aws_iam
+  ): ThreadTurnUpdateEvent @aws_iam
 
   notifyThreadTurnStep(
     runId: ID!
@@ -240,14 +273,14 @@ type Mutation {
     message: String
     payload: AWSJSON
     createdAt: AWSDateTime!
-  ): ThreadTurnStepEvent @aws_api_key @aws_cognito_user_pools @aws_iam
+  ): ThreadTurnStepEvent @aws_iam
 
   notifyOrgUpdate(
     tenantId: ID!
     changeType: String!
     entityType: String
     entityId: ID
-  ): OrgUpdateEvent @aws_api_key @aws_cognito_user_pools @aws_iam
+  ): OrgUpdateEvent @aws_iam
 
   notifyCostRecorded(
     tenantId: ID!
@@ -259,7 +292,7 @@ type Mutation {
     eventType: String!
     amountUsd: Float!
     model: String
-  ): CostRecordedEvent @aws_api_key @aws_cognito_user_pools @aws_iam
+  ): CostRecordedEvent @aws_iam
 
   notifyEvalRunUpdate(
     runId: ID!
@@ -271,51 +304,51 @@ type Mutation {
     failed: Int
     passRate: Float
     errorMessage: String
-  ): EvalRunUpdateEvent @aws_api_key @aws_cognito_user_pools @aws_iam
+  ): EvalRunUpdateEvent @aws_iam
 
   notifyWorkspaceAccessRevoked(
     tenantId: ID!
     spaceId: ID!
     userId: ID!
     revokedAt: AWSDateTime!
-  ): WorkspaceAccessRevokedEvent @aws_api_key @aws_cognito_user_pools @aws_iam
+  ): WorkspaceAccessRevokedEvent @aws_iam
 }
 
 type Subscription {
   _empty: String
-  onAgentStatusChanged(tenantId: ID!): AgentStatusEvent @aws_api_key @aws_cognito_user_pools @aws_iam
+  onAgentStatusChanged(tenantId: ID!): AgentStatusEvent
     @aws_subscribe(mutations: ["notifyAgentStatus"])
 
-  onNewMessage(threadId: ID!): NewMessageEvent @aws_api_key @aws_cognito_user_pools @aws_iam
+  onNewMessage(threadId: ID!): NewMessageEvent
     @aws_subscribe(mutations: ["notifyNewMessage"])
 
-  onHeartbeatActivity(tenantId: ID!): HeartbeatActivityEvent @aws_api_key @aws_cognito_user_pools @aws_iam
+  onHeartbeatActivity(tenantId: ID!): HeartbeatActivityEvent
     @aws_subscribe(mutations: ["notifyHeartbeatActivity"])
 
-  onThreadUpdated(tenantId: ID!): ThreadUpdateEvent @aws_api_key @aws_cognito_user_pools @aws_iam
+  onThreadUpdated(tenantId: ID!): ThreadUpdateEvent
     @aws_subscribe(mutations: ["notifyThreadUpdate"])
 
-  onThreadActivity(userId: ID!): ThreadActivityEvent @aws_api_key @aws_cognito_user_pools @aws_iam
+  onThreadActivity(userId: ID!): ThreadActivityEvent
     @aws_subscribe(mutations: ["notifyThreadActivity"])
 
-  onInboxItemStatusChanged(tenantId: ID!): InboxItemStatusEvent @aws_api_key @aws_cognito_user_pools @aws_iam
+  onInboxItemStatusChanged(tenantId: ID!): InboxItemStatusEvent
     @aws_subscribe(mutations: ["notifyInboxItemUpdate"])
 
-  onThreadTurnUpdated(tenantId: ID!): ThreadTurnUpdateEvent @aws_api_key @aws_cognito_user_pools @aws_iam
+  onThreadTurnUpdated(tenantId: ID!): ThreadTurnUpdateEvent
     @aws_subscribe(mutations: ["notifyThreadTurnUpdate"])
 
-  onThreadTurnStep(threadId: ID!): ThreadTurnStepEvent @aws_api_key @aws_cognito_user_pools @aws_iam
+  onThreadTurnStep(threadId: ID!): ThreadTurnStepEvent
     @aws_subscribe(mutations: ["notifyThreadTurnStep"])
 
-  onOrgUpdated(tenantId: ID!): OrgUpdateEvent @aws_api_key @aws_cognito_user_pools @aws_iam
+  onOrgUpdated(tenantId: ID!): OrgUpdateEvent
     @aws_subscribe(mutations: ["notifyOrgUpdate"])
 
-  onCostRecorded(tenantId: ID!): CostRecordedEvent @aws_api_key @aws_cognito_user_pools @aws_iam
+  onCostRecorded(tenantId: ID!): CostRecordedEvent
     @aws_subscribe(mutations: ["notifyCostRecorded"])
 
-  onEvalRunUpdated(tenantId: ID!): EvalRunUpdateEvent @aws_api_key @aws_cognito_user_pools @aws_iam
+  onEvalRunUpdated(tenantId: ID!): EvalRunUpdateEvent
     @aws_subscribe(mutations: ["notifyEvalRunUpdate"])
 
-  onWorkspaceAccessRevoked(userId: ID!): WorkspaceAccessRevokedEvent @aws_cognito_user_pools @aws_iam
+  onWorkspaceAccessRevoked(userId: ID!): WorkspaceAccessRevokedEvent
     @aws_subscribe(mutations: ["notifyWorkspaceAccessRevoked"])
 }

package/dist/workspace-defaults/files/USER.md

@@ -1,6 +1,7 @@
 # USER.md - About Your Human
 
 - **Name:** {{HUMAN_NAME}}
+- **Email:** {{HUMAN_EMAIL}}
 - **What to call them:** {{HUMAN_CALL_BY}}
 - **Pronouns:** {{HUMAN_PRONOUNS}}
 - **Timezone:** {{HUMAN_TIMEZONE}}