thinkwork-cli 0.13.1 → 0.13.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkwork-cli",
-  "version": "0.13.1",
+  "version": "0.13.2",
   "description": "Thinkwork CLI — deploy, manage, and interact with your Thinkwork stack",
   "license": "Apache-2.0",
   "type": "module",
@@ -11,7 +11,7 @@
     "dist"
   ],
   "scripts": {
-    "build": "tsup src/cli.ts --format esm --dts --clean && node scripts/bundle-terraform.js",
+    "build": "tsup && node scripts/bundle-terraform.js",
     "dev": "tsx src/cli.ts",
     "codegen": "graphql-codegen --config codegen.ts",
     "typecheck": "tsc --noEmit",
@@ -33,6 +33,7 @@
     "@graphql-codegen/cli": "^5.0.6",
     "@graphql-codegen/client-preset": "^4.8.2",
     "@thinkwork/admin-ops": "workspace:*",
+    "@thinkwork/api": "workspace:*",
     "@thinkwork/database-pg": "workspace:*",
     "@types/node": "^25.6.0",
     "tsup": "^8.0.0",

package/dist/drizzle/0261_thread_turns_origin_turn_index.sql

@@ -1,11 +0,0 @@
--- THINK-307 KTD4: the retry dispatcher's successor-turn guard, THINK-308's
--- finalize reconciliation, and THINK-309's recovery resolver all look up
--- thread_turns by origin_turn_id; no index covers that column today.
--- Additive — safe to apply ahead of code deploy.
---
--- Hand-rolled (drizzle meta journal is not in use for this change);
--- apply with: psql "$DATABASE_URL" -f drizzle/0261_thread_turns_origin_turn_index.sql
--- creates: public.idx_thread_turns_origin_turn
-
-CREATE INDEX IF NOT EXISTS idx_thread_turns_origin_turn
-  ON public.thread_turns (origin_turn_id);

package/dist/plugins/workos-auth/package.json

@@ -1,22 +0,0 @@
-{
-  "name": "@thinkwork/plugin-workos-auth",
-  "version": "0.0.0",
-  "private": true,
-  "type": "module",
-  "main": "./src/index.ts",
-  "exports": {
-    ".": "./src/index.ts",
-    "./manifest": "./src/manifest.ts",
-    "./provider-contract": "./src/provider-contract.ts"
-  },
-  "scripts": {
-    "build": "tsc --build",
-    "typecheck": "tsc --noEmit",
-    "test": "vitest run"
-  },
-  "devDependencies": {
-    "@thinkwork/plugin-catalog": "workspace:*",
-    "typescript": "^5.5.0",
-    "vitest": "^2.0.0"
-  }
-}

package/dist/plugins/workos-auth/src/index.ts

@@ -1,30 +0,0 @@
-import { workosAuthManifest } from "./manifest";
-
-export const workosAuthPluginPackage = {
-  packageKey: "workos-auth",
-  sourceRoot: "plugins/workos-auth",
-  manifest: workosAuthManifest,
-  ownedSources: [
-    {
-      kind: "manifest",
-      path: "plugins/workos-auth/src/manifest.ts",
-      description:
-        "WorkOS Auth catalog manifest and Cognito auth-provider component contract.",
-    },
-    {
-      kind: "api",
-      path: "plugins/workos-auth/src/provider-contract.ts",
-      description:
-        "WorkOS Auth provider keys, admin config fields, and U1-approved public option metadata.",
-    },
-    {
-      kind: "tests",
-      path: "plugins/workos-auth/test",
-      description: "WorkOS Auth package-local manifest and contract tests.",
-    },
-  ],
-  compatibilityLinks: [],
-} as const;
-
-export { workosAuthManifest };
-export * from "./provider-contract";

package/dist/plugins/workos-auth/src/manifest.ts

@@ -1,40 +0,0 @@
-import type { PluginManifest } from "@thinkwork/plugin-catalog/contracts";
-
-import {
-  WORKOS_AUTH_COGNITO_IDP_NAME,
-  WORKOS_AUTH_PROVIDER_COMPONENT_KEY,
-  WORKOS_AUTH_SETTINGS_SURFACE,
-  workosAuthConfigFields,
-  workosAuthPublicOptions,
-} from "./provider-contract";
-
-export const workosAuthManifest = {
-  pluginKey: "workos-auth",
-  displayName: "WorkOS Auth",
-  description:
-    "WorkOS-backed SSO broker that federates through Cognito while keeping Cognito as ThinkWork's final session issuer.",
-  versions: [
-    {
-      version: "0.1.0",
-      requiredOauthScopes: [],
-      components: [
-        {
-          type: "auth-provider",
-          key: WORKOS_AUTH_PROVIDER_COMPONENT_KEY,
-          displayName: "WorkOS Cognito federation",
-          provider: "workos",
-          settingsSurface: WORKOS_AUTH_SETTINGS_SURFACE,
-          cognitoIdentityProviderName: WORKOS_AUTH_COGNITO_IDP_NAME,
-          configFields: workosAuthConfigFields,
-          publicOptions: workosAuthPublicOptions,
-        },
-        {
-          type: "ui-surface",
-          key: "settings",
-          displayName: "WorkOS Auth settings",
-          intendedMount: WORKOS_AUTH_SETTINGS_SURFACE,
-        },
-      ],
-    },
-  ],
-} satisfies PluginManifest;

package/dist/plugins/workos-auth/src/provider-contract.ts

@@ -1,39 +0,0 @@
-import type {
-  AuthProviderConfigField,
-  AuthProviderPublicOption,
-} from "@thinkwork/plugin-catalog/contracts";
-
-export const WORKOS_AUTH_PROVIDER_COMPONENT_KEY = "workos-auth" as const;
-export const WORKOS_AUTH_SETTINGS_SURFACE =
-  "settings.plugins.workos-auth" as const;
-export const WORKOS_AUTH_COGNITO_IDP_NAME = "WorkOSAuth" as const;
-
-export const workosAuthConfigFields = [
-  {
-    key: "issuerUrl",
-    displayName: "WorkOS AuthKit issuer URL",
-    required: true,
-    storage: "metadata",
-  },
-  {
-    key: "clientId",
-    displayName: "WorkOS OAuth client ID",
-    required: true,
-    storage: "metadata",
-  },
-  {
-    key: "clientSecret",
-    displayName: "WorkOS OAuth client secret",
-    required: true,
-    storage: "secret-ref",
-  },
-] satisfies AuthProviderConfigField[];
-
-export const workosAuthPublicOptions = [
-  {
-    key: "sso",
-    displayName: "Continue with SSO",
-    providerSpecific: false,
-    recommended: true,
-  },
-] satisfies AuthProviderPublicOption[];

package/dist/plugins/workos-auth/test/manifest.test.ts

@@ -1,94 +0,0 @@
-import { describe, expect, it } from "vitest";
-
-import {
-  validatePluginManifest,
-  type AuthProviderComponent,
-} from "@thinkwork/plugin-catalog/contracts";
-import { defineFirstPartyPluginPackage } from "@thinkwork/plugin-catalog/plugin-package";
-
-import { workosAuthPluginPackage } from "../src";
-import { workosAuthManifest } from "../src/manifest";
-import {
-  WORKOS_AUTH_COGNITO_IDP_NAME,
-  WORKOS_AUTH_PROVIDER_COMPONENT_KEY,
-  WORKOS_AUTH_SETTINGS_SURFACE,
-  workosAuthConfigFields,
-  workosAuthPublicOptions,
-} from "../src/provider-contract";
-
-function authProviderComponent(): AuthProviderComponent {
-  const component = workosAuthManifest.versions[0].components.find(
-    (candidate) => candidate.type === "auth-provider",
-  );
-  if (component?.type !== "auth-provider") {
-    throw new Error("WorkOS Auth manifest is missing auth-provider component");
-  }
-  return component;
-}
-
-describe("WorkOS Auth plugin manifest", () => {
-  it("validates as an auth-provider plugin with a settings surface", () => {
-    const validated = validatePluginManifest(workosAuthManifest);
-
-    expect(validated.pluginKey).toBe("workos-auth");
-    expect(validated.displayName).toBe("WorkOS Auth");
-    expect(validated.versions[0].requiredOauthScopes).toEqual([]);
-    expect(validated.versions[0].components.map((component) => component.type))
-      .toEqual(["auth-provider", "ui-surface"]);
-  });
-
-  it("declares the U1-approved single SSO fallback instead of provider buttons", () => {
-    const component = authProviderComponent();
-
-    expect(component).toMatchObject({
-      type: "auth-provider",
-      key: WORKOS_AUTH_PROVIDER_COMPONENT_KEY,
-      provider: "workos",
-      settingsSurface: WORKOS_AUTH_SETTINGS_SURFACE,
-      cognitoIdentityProviderName: WORKOS_AUTH_COGNITO_IDP_NAME,
-    });
-    expect(component.publicOptions).toEqual(workosAuthPublicOptions);
-    expect(component.publicOptions).toEqual([
-      {
-        key: "sso",
-        displayName: "Continue with SSO",
-        providerSpecific: false,
-        recommended: true,
-      },
-    ]);
-  });
-
-  it("models secrets as secret references, never manifest values", () => {
-    expect(workosAuthConfigFields).toEqual([
-      {
-        key: "issuerUrl",
-        displayName: "WorkOS AuthKit issuer URL",
-        required: true,
-        storage: "metadata",
-      },
-      {
-        key: "clientId",
-        displayName: "WorkOS OAuth client ID",
-        required: true,
-        storage: "metadata",
-      },
-      {
-        key: "clientSecret",
-        displayName: "WorkOS OAuth client secret",
-        required: true,
-        storage: "secret-ref",
-      },
-    ]);
-    expect(JSON.stringify(workosAuthManifest)).not.toMatch(
-      /client_secret|sk_|secretValue|currentValue/,
-    );
-  });
-
-  it("defines a first-party package boundary under plugins/workos-auth", () => {
-    const defined = defineFirstPartyPluginPackage(workosAuthPluginPackage);
-
-    expect(defined.packageKey).toBe("workos-auth");
-    expect(defined.sourceRoot).toBe("plugins/workos-auth");
-    expect(defined.compatibilityLinks).toEqual([]);
-  });
-});

package/dist/plugins/workos-auth/tsconfig.json

@@ -1,8 +0,0 @@
-{
-  "extends": "../../tsconfig.base.json",
-  "compilerOptions": {
-    "outDir": "./dist",
-    "rootDir": "."
-  },
-  "include": ["./**/*.ts"]
-}