thinkwork-cli 0.13.1 → 1.0.0

package/dist/terraform/examples/greenfield/main.tf

@@ -81,6 +81,24 @@ variable "plugin_catalog_github_token_secret_arn" {
   default     = ""
 }
 
+variable "brain_m2m_platform_agent_secret_arn" {
+  description = "Optional Secrets Manager ARN of the Company Brain platform-agent machine-lane secret (Cognito client-credentials blob, THINK-628). When set, the shared API Lambda role may read it so MCP config build can mint short-lived bearers for the Brain connector. Empty leaves the tkt_ lane untouched."
+  type        = string
+  default     = ""
+}
+
+variable "brain_ops_api_url" {
+  description = "Optional Company Brain ops-api base URL for the Send-to-the-Brain flag path (THINK-781). Empty disables the action."
+  type        = string
+  default     = ""
+}
+
+variable "brain_ops_m2m_secret_arn" {
+  description = "Optional Secrets Manager ARN of the Brain agent-identity m2m secret (ops-api operator pool, scope etl-agent/tasks) used by flagThreadToBrain to POST /flags (THINK-781)."
+  type        = string
+  default     = ""
+}
+
 variable "db_password" {
   description = "Master password for the Aurora cluster"
   type        = string
@@ -93,16 +111,16 @@ variable "database_engine" {
   default     = "aurora-serverless"
 }
 
-variable "hindsight_database_name" {
-  description = "Dedicated Hindsight database name (THINK-220 cutover flag). Empty keeps Hindsight in the hindsight schema of the primary database."
-  type        = string
-  default     = ""
-}
-
 variable "enable_hindsight" {
-  description = "Enable Hindsight canonical user and Space memory. Full ThinkWork installs default this on; set false only for explicit low-cost/development AgentCore-only deployments."
+  description = "DEPRECATED (THINK-407): the Hindsight memory engine and its infrastructure were removed; this input is inert and ignored. Retained so existing tfvars keep working."
   type        = bool
-  default     = true
+  default     = false
+}
+
+variable "external_kb_source_arns" {
+  description = "DEPRECATED (THINK-402): Knowledge Bases were removed from the product; this input is inert and ignored. Retained so existing tfvars keep working."
+  type        = list(string)
+  default     = []
 }
 
 variable "enable_capability_broker" {
@@ -111,14 +129,86 @@ variable "enable_capability_broker" {
   default     = false
 }
 
-variable "analyst_lambda_vpc_egress" {
-  description = "VPC-attach the analyst data-path Lambdas so their egress rides the NAT gateway's stable EIP — required when an external analyst data source sits behind an IP allowlist. See the thinkwork module's analyst_egress_ip output for the IP to allowlist."
+variable "auth_state_store" {
+  description = "THINK-643: backing store for short-lived auth-flow state (AppSync subscription tickets + connect rate-limit counters). \"postgres\" (default) keeps the Aurora auth_subscription_tickets path; \"dynamo\" provisions thinkwork-<stage>-auth-state and points the auth handlers at it. Ship-inert: dev opts in via the deploy workflow, customer stages on their own cadence."
+  type        = string
+  default     = "postgres"
+
+  validation {
+    condition     = contains(["postgres", "dynamo"], var.auth_state_store)
+    error_message = "auth_state_store must be \"postgres\" or \"dynamo\"."
+  }
+}
+
+
+variable "enable_agentcore_multiplayer_proof" {
+  description = "Opt in to the non-production THINK-316 AgentCore Identity/Gateway proof substrate."
   type        = bool
   default     = false
 }
 
+variable "agentcore_multiplayer_proof_tenant_slug" {
+  description = "Explicit non-production tenant slug used for the one-Harness multiplayer proof."
+  type        = string
+  default     = ""
+}
+
+variable "agentcore_multiplayer_proof_owner_allowlist" {
+  description = "Comma-separated non-production subjects for the manual authorization-code and mixed-disclosure fixtures. Signed OBO turn participants do not require registration here."
+  type        = string
+  default     = ""
+}
+
+variable "agentcore_turn_assertion_key_versions" {
+  description = "One or two published AgentCore assertion key versions during rotation."
+  type        = list(string)
+  default     = ["v1"]
+}
+
+variable "agentcore_turn_assertion_active_key_version" {
+  description = "AgentCore assertion key version used to sign new tokens."
+  type        = string
+  default     = "v1"
+}
+
+variable "neptune_endpoint" {
+  type        = string
+  default     = ""
+  description = "Company Brain twin: Neptune writer endpoint (etl-platform neptune stack output; empty = twin disabled)"
+}
+
+variable "brain_mcp_url" {
+  type        = string
+  default     = ""
+  description = "Platform-served Brain MCP endpoint (consolidation U14); empty = legacy product-served /mcp/twin"
+}
+
+variable "neptune_cluster_resource_id" {
+  type        = string
+  default     = ""
+  description = "Company Brain twin: Neptune cluster resource id for IAM ARNs"
+}
+
+variable "neptune_client_security_group_id" {
+  type        = string
+  default     = ""
+  description = "Company Brain twin: neptune-client SG id for the identity-graph-projector"
+}
+
+variable "neptune_load_bucket" {
+  type        = string
+  default     = ""
+  description = "Company Brain twin: Neptune bulk-load staging bucket (empty = bulk-rebuild disabled)"
+}
+
+variable "neptune_loader_role_arn" {
+  type        = string
+  default     = ""
+  description = "Company Brain twin: IAM role the Neptune cluster assumes to read the load bucket"
+}
+
 variable "memory_engine" {
-  description = "Active long-term memory engine. Empty selects Hindsight when enable_hindsight = true. Use 'agentcore' only for explicit low-cost/development managed-memory deployments."
+  description = "DEPRECATED (THINK-407): AgentCore managed memory is the only engine; this input is inert and ignored. Retained so existing tfvars keep working."
   type        = string
   default     = ""
 }
@@ -128,6 +218,12 @@ variable "twenty_provisioned" {
   default     = false
 }
 
+variable "release_image_mirror_principal_arns" {
+  description = "IAM principals allowed to push release runtime images into this stage's AgentCore ECR repository (THINK-616). ThinkWork-operated customer stages set [\"arn:aws:iam::487219502366:root\"] so the release workflow can mirror `<releaseVersion>-pi-arm64`; leave empty for self-hosted deployments."
+  type        = list(string)
+  default     = []
+}
+
 variable "twenty_runtime_enabled" {
   description = "Run Twenty CRM server/worker tasks when the retained substrate is provisioned."
   type        = bool
@@ -298,14 +394,86 @@ variable "google_oauth_client_secret" {
   default     = ""
 }
 
+variable "microsoft_oauth_client_id" {
+  description = "Microsoft Entra application client ID for direct Cognito organizations login"
+  type        = string
+  default     = ""
+}
+
+variable "microsoft_oauth_client_secret" {
+  description = "Microsoft Entra application client secret for direct Cognito organizations login"
+  type        = string
+  sensitive   = true
+  default     = ""
+}
+
+variable "microsoft_oauth_tenant" {
+  description = "Microsoft Entra directory GUID for the deployment's default Microsoft login route"
+  type        = string
+  default     = ""
+}
+
+variable "tenant_entra_connections" {
+  description = "Safe tenant-specific Entra provider metadata. Secret values must never be placed in tfvars."
+  type = list(object({
+    connection_key = string
+    tenant_id      = string
+    provider_name  = string
+    display_name   = string
+  }))
+  default = []
+}
+
+variable "console_client_enabled" {
+  description = "Create the optional Company Brain console Cognito app client (U13). Default false = ship-inert."
+  type        = bool
+  default     = false
+}
+
+variable "console_callback_urls" {
+  description = "OAuth callback URLs for the console client — must include the console hosting URL BEFORE first login (redirect_mismatch otherwise)"
+  type        = list(string)
+  default     = []
+}
+
+variable "console_logout_urls" {
+  description = "OAuth logout URLs for the console client"
+  type        = list(string)
+  default     = []
+}
+
 variable "pre_signup_lambda_zip" {
   description = "Path to the Cognito pre-signup Lambda zip"
   type        = string
   default     = ""
 }
 
+variable "auth_retirement_phase" {
+  description = "Native-auth migration phase. Greenfield installs are native-only; use coexistence/cutover only for an existing deployment migration."
+  type        = string
+  default     = "retired"
+
+  validation {
+    condition     = contains(["coexistence", "cutover", "retired"], var.auth_retirement_phase)
+    error_message = "auth_retirement_phase must be coexistence, cutover, or retired."
+  }
+}
+
+variable "auth_migration_recovery_deadline" {
+  description = "RFC3339 deadline for legacy-session identity migration; required only when explicitly deploying coexistence."
+  type        = string
+  default     = ""
+
+  validation {
+    condition = trimspace(var.auth_migration_recovery_deadline) == "" || (
+      can(timecmp(var.auth_migration_recovery_deadline, var.auth_migration_recovery_deadline))
+    )
+    error_message = "auth_migration_recovery_deadline must be empty or an RFC3339 timestamp."
+  }
+}
+
 variable "cognito_custom_auth_lambda_zip" {
-  description = "Path to the Cognito custom-auth challenge Lambda zip"
+  description = "Path to the WorkOS rollback Cognito custom-auth Lambda zip for source-checkout deployments."
   type        = string
   default     = ""
 }
@@ -353,6 +521,41 @@ variable "platform_operator_emails" {
   default     = ""
 }
 
+# THINK-583 U3 — provisioned concurrency for chat-agent-invoke /
+# workspace-renderer (KTD5: never the Pi Lambda). Default 0 = disabled;
+# the `live` alias always exists so alias-qualified invokers work either
+# way. Dev sets 1/1 via scripts/deploy/terraform-vars.sh; customer stages
+# opt in through their runner-secrets tfvars on their release cadence.
+
+variable "agentcore_runtime_dispatch_enabled" {
+  description = "THINK-585 U6: stage kill-switch for AgentCore Runtime chat dispatch."
+  type        = bool
+  default     = false
+}
+
+variable "agentcore_session_scope" {
+  description = "THINK-909/THINK-946 AgentCore runtime session scope. \"thread\" (default) keys the runtime session per thread; \"user\" keys it per (tenant, agent, user) so a user's NEW thread lands on their already-warm microVM and reuses its MCP connections and toolset. Set \"user\" only after the stage's Pi runtime image dual-accepts both session ids. mcpherson runs \"user\"; every other stage runs the default."
+  type        = string
+  default     = "thread"
+
+  validation {
+    condition     = contains(["thread", "user"], var.agentcore_session_scope)
+    error_message = "agentcore_session_scope must be \"thread\" or \"user\"."
+  }
+}
+
+variable "chat_agent_invoke_provisioned_concurrency" {
+  description = "Provisioned concurrency on chat-agent-invoke's `live` alias. 0 = disabled (alias still exists)."
+  type        = number
+  default     = 0
+}
+
+variable "workspace_renderer_provisioned_concurrency" {
+  description = "Provisioned concurrency on workspace-renderer's `live` alias. 0 = disabled (alias still exists)."
+  type        = number
+  default     = 0
+}
+
 variable "www_domain" {
   description = "Public website apex domain (e.g. thinkwork.ai). Leave empty to skip the custom domain and DNS wiring."
   type        = string
@@ -389,21 +592,6 @@ variable "stripe_price_ids_json" {
   default     = "{}"
 }
 
-variable "wiki_compile_model_id" {
-  description = <<-EOT
-    Bedrock model id the wiki-compile Lambda uses for the leaf planner,
-    aggregation planner, and section writer. Any Converse-compatible
-    model works; change without a code deploy.
-
-    Default: openai.gpt-oss-120b-1:0 (strong output quality at a lower
-    per-minute throttle risk than Claude Haiku 4.5 on shared dev
-    accounts). Swap to us.anthropic.claude-haiku-4-5-20251001-v1:0 for
-    Claude, or amazon.nova-micro-v1:0 for a low-cost spike.
-  EOT
-  type        = string
-  default     = "openai.gpt-oss-120b-1:0"
-}
-
 variable "requester_idle_memory_learning_enabled" {
   description = "Enable requester-scoped 15-minute idle memory learning."
   type        = bool
@@ -428,18 +616,6 @@ variable "brain_dream_state_enabled" {
   default     = false
 }
 
-variable "retry_dispatcher_enabled" {
-  description = "Enable the recurring retry-dispatcher schedule (THINK-307). Never enable on a stage before THINK-305, THINK-308, and THINK-309 are live there; manual invokes work regardless."
-  type        = bool
-  default     = false
-}
-
-variable "stall_threshold_minutes" {
-  description = "Minutes of turn inactivity before the stall monitor marks a running turn timed_out; the retry dispatcher reads the same knob as its origin-freshness guard (THINK-306/THINK-307)."
-  type        = number
-  default     = 5
-}
-
 variable "requester_memory_dreaming_model_id" {
   description = "Bedrock Converse model id for requester memory REM reflection."
   type        = string
@@ -456,8 +632,20 @@ variable "brain_source_agent_model_id" {
   default     = "us.anthropic.claude-haiku-4-5-20251001-v1:0"
 }
 
-variable "knowledge_graph_observations_ingest_enabled" {
-  description = "Enable the Brain distillation schedule (observations -> knowledge graph). Ships disabled; flip on dev after a validated manual run (plan 2026-07-03-005 U4)."
+variable "identity_drift_match_enabled" {
+  description = "Enable the recurring per-tenant identity drift match sweep (THINK-321 U7/KTD-7 — R10). Ships disabled; enabled per stage once bootstrap matching has been proven there."
+  type        = bool
+  default     = false
+}
+
+variable "vpc_interface_endpoint_services" {
+  description = "AWS services that get a private interface endpoint (null = legacy full set, [] = none). See modules/thinkwork. Cost review 2026-08-28."
+  type        = list(string)
+  default     = null
+}
+
+variable "vpc_interface_endpoint_single_az" {
+  description = "One ENI per interface endpoint instead of one per AZ. Cost review 2026-08-28."
   type        = bool
   default     = false
 }
@@ -473,23 +661,6 @@ variable "wiki_source" {
   }
 }
 
-variable "analyst_policy_source" {
-  description = "THINK-229 KTD5 enforcement flip for the analyst connection policy source: 'row' (default — signed sidecar policy is shadow-only) or 'sidecar' (the sidecar block is authoritative). Flip only after clean shadow parity on live traffic."
-  type        = string
-  default     = "row"
-
-  validation {
-    condition     = contains(["row", "sidecar"], var.analyst_policy_source)
-    error_message = "analyst_policy_source must be 'row' or 'sidecar'."
-  }
-}
-
-variable "capability_self_extension_tenants" {
-  description = "Governed autonomy opt-in: comma/space-separated tenant ids allowed to autonomously self-extend capabilities (self_admit_connection / self_approve_routine). Empty (default) = NO tenant enabled; self-extension ships inert and fail-closed."
-  type        = string
-  default     = ""
-}
-
 variable "wiki_aggregation_pass_enabled" {
   description = <<-EOT
     Feature flag for the wiki aggregation pass — the second LLM call
@@ -504,23 +675,6 @@ variable "wiki_aggregation_pass_enabled" {
   default     = "true"
 }
 
-variable "google_places_api_key" {
-  description = <<-EOT
-    Google Places API (New) key used by wiki-compile to enrich POI records
-    with city/state/country hierarchy during compile. When empty, compile
-    gracefully degrades to metadata-only place rows (no hierarchy, no
-    backing pages), so this is opt-in. Stored as a SecureString at
-    /thinkwork/<stage>/google-places/api-key — see
-    terraform/modules/app/lambda-api/handlers.tf for the SSM resource.
-
-    The parameter's value has lifecycle.ignore_changes set, so you can
-    rotate via `aws ssm put-parameter --overwrite` without terraform
-    fighting you on the next apply.
-  EOT
-  type        = string
-  default     = ""
-  sensitive   = true
-}
 
 variable "mapbox_public_token" {
   description = <<-EOT
@@ -600,6 +754,30 @@ variable "customer_domain" {
   default     = ""
 }
 
+variable "deployment_runner_in_vpc" {
+  description = "Run the deployment runner CodeBuild inside the VPC and grant it tcp/5432 on the database security group instead of relying on the world-open DB ingress (THINK-1082). Also turns on the VPC NAT gateway. Default false = no networking change."
+  type        = bool
+  default     = false
+}
+
+variable "api_lambdas_in_vpc" {
+  description = "Run every database-connected Lambda (api handlers, agentcore-admin, Pi, broker) inside the VPC behind the api-lambda security group, granted tcp/5432 on the database security group (THINK-1082). Also turns on the VPC NAT gateway. Default false = no networking change."
+  type        = bool
+  default     = false
+}
+
+variable "db_publicly_accessible" {
+  description = "Aurora publicly_accessible (THINK-1082). Default true. Set false only after api_lambdas_in_vpc and deployment_runner_in_vpc are live."
+  type        = bool
+  default     = true
+}
+
+variable "db_public_ingress_cidrs" {
+  description = "tcp/5432 CIDR ingress seeded on a NEW database security group (THINK-1082). Default [\"0.0.0.0/0\"]; [] = none. Does not revoke a live rule — see modules/app/deployment-control-plane/README.md."
+  type        = list(string)
+  default     = ["0.0.0.0/0"]
+}
+
 variable "customer_domain_delegated" {
   description = "Set true once the apex zone's NS records point at the customer zone (claim tool phase two). Gates the ACM certificate, the web alias records, and the customer-domain Cognito callback entries. Requires customer_domain."
   type        = bool
@@ -612,9 +790,20 @@ variable "customer_domain_legacy_retired" {
   default     = false
 }
 
+variable "additional_admin_callback_urls" {
+  description = "Extra OAuth callback URLs appended to the web-family Cognito clients (e.g. a hosted Company Brain console origin). Supply both the bare origin and its /auth/callback variant. Empty leaves behavior unchanged."
+  type        = list(string)
+  default     = []
+}
+
+variable "additional_admin_logout_urls" {
+  description = "Extra OAuth logout URLs appended to the web-family Cognito clients (companion to additional_admin_callback_urls)."
+  type        = list(string)
+  default     = []
+}
+
 locals {
   www_dns_enabled = var.www_domain != "" && var.cloudflare_zone_id != ""
-  docs_domain     = var.www_domain != "" ? "docs.${var.www_domain}" : ""
   app_domain      = var.www_domain != "" ? "app.${var.www_domain}" : ""
   computer_domain = var.www_domain != "" ? "computer.${var.www_domain}" : ""
   sandbox_domain  = var.www_domain != "" ? "sandbox.${var.www_domain}" : ""
@@ -775,63 +964,85 @@ module "thinkwork" {
   account_id = var.account_id
 
   plugin_catalog_github_token_secret_arn = var.plugin_catalog_github_token_secret_arn
-
-  db_password                       = var.db_password
-  database_engine                   = var.database_engine
-  enable_hindsight                  = var.enable_hindsight
-  enable_capability_broker          = var.enable_capability_broker
-  analyst_lambda_vpc_egress         = var.analyst_lambda_vpc_egress
-  hindsight_database_name           = var.hindsight_database_name
-  memory_engine                     = var.memory_engine
-  twenty_provisioned                = var.twenty_provisioned
-  twenty_runtime_enabled            = var.twenty_runtime_enabled
-  twenty_image_uri                  = var.twenty_image_uri
-  twenty_db_username                = var.twenty_db_username
-  twenty_db_name                    = var.twenty_db_name
-  twenty_db_url_secret_arn          = var.twenty_db_url_secret_arn
-  twenty_encryption_key_secret_arn  = var.twenty_encryption_key_secret_arn
-  twenty_email_from_address         = var.twenty_email_from_address
-  twenty_email_from_name            = var.twenty_email_from_name
-  twenty_public_url                 = local.twenty_url
-  twenty_certificate_arn            = var.twenty_certificate_arn != "" ? var.twenty_certificate_arn : (local.twenty_managed_certificate_enabled ? aws_acm_certificate_validation.twenty[0].certificate_arn : "")
-  n8n_provisioned                   = var.n8n_provisioned
-  n8n_runtime_enabled               = var.n8n_runtime_enabled
-  n8n_image_uri                     = var.n8n_image_uri
-  n8n_database_admin_secret_arn     = var.n8n_database_admin_secret_arn
-  n8n_database_url_secret_arn       = var.n8n_database_url_secret_arn
-  n8n_database_username             = var.n8n_database_username
-  n8n_database_name                 = var.n8n_database_name
-  n8n_encryption_key_secret_arn     = var.n8n_encryption_key_secret_arn
-  n8n_operator_secret_arn           = var.n8n_operator_secret_arn
-  n8n_service_credential_secret_arn = var.n8n_service_credential_secret_arn
-  n8n_storage_bucket_name           = var.n8n_storage_bucket_name
-  n8n_container_port                = var.n8n_container_port
-  n8n_cache_engine                  = var.n8n_cache_engine
-  n8n_domain                        = local.n8n_domain
-  n8n_public_url                    = local.n8n_url
-  n8n_certificate_arn               = var.n8n_certificate_arn != "" ? var.n8n_certificate_arn : (local.n8n_managed_certificate_enabled ? aws_acm_certificate_validation.n8n[0].certificate_arn : "")
-  google_oauth_client_id            = var.google_oauth_client_id
-  google_oauth_client_secret        = var.google_oauth_client_secret
-  pre_signup_lambda_zip             = var.pre_signup_lambda_zip
-  cognito_custom_auth_lambda_zip    = var.cognito_custom_auth_lambda_zip
-  lambda_zips_dir                   = var.lambda_zips_dir
-  lambda_artifact_bucket            = var.lambda_artifact_bucket
-  lambda_artifact_prefix            = var.lambda_artifact_prefix
-  require_lambda_artifacts          = var.require_lambda_artifacts
-  enable_workspace_orchestration    = var.enable_workspace_orchestration
-  api_auth_secret                   = var.api_auth_secret
-  platform_operator_emails          = var.platform_operator_emails
+  brain_m2m_platform_agent_secret_arn    = var.brain_m2m_platform_agent_secret_arn
+  brain_ops_api_url                      = var.brain_ops_api_url
+  brain_ops_m2m_secret_arn               = var.brain_ops_m2m_secret_arn
+
+  db_password                                 = var.db_password
+  database_engine                             = var.database_engine
+  enable_hindsight                            = var.enable_hindsight
+  external_kb_source_arns                     = var.external_kb_source_arns
+  enable_capability_broker                    = var.enable_capability_broker
+  auth_state_store                            = var.auth_state_store
+  enable_agentcore_multiplayer_proof          = var.enable_agentcore_multiplayer_proof
+  agentcore_multiplayer_proof_tenant_slug     = var.agentcore_multiplayer_proof_tenant_slug
+  agentcore_multiplayer_proof_owner_allowlist = var.agentcore_multiplayer_proof_owner_allowlist
+  agentcore_turn_assertion_key_versions       = var.agentcore_turn_assertion_key_versions
+  agentcore_turn_assertion_active_key_version = var.agentcore_turn_assertion_active_key_version
+  neptune_endpoint                            = var.neptune_endpoint
+  brain_mcp_url                               = var.brain_mcp_url
+  neptune_cluster_resource_id                 = var.neptune_cluster_resource_id
+  neptune_client_security_group_id            = var.neptune_client_security_group_id
+  neptune_load_bucket                         = var.neptune_load_bucket
+  neptune_loader_role_arn                     = var.neptune_loader_role_arn
+  memory_engine                               = var.memory_engine
+  release_image_mirror_principal_arns         = var.release_image_mirror_principal_arns
+  twenty_provisioned                          = var.twenty_provisioned
+  twenty_runtime_enabled                      = var.twenty_runtime_enabled
+  twenty_image_uri                            = var.twenty_image_uri
+  twenty_db_username                          = var.twenty_db_username
+  twenty_db_name                              = var.twenty_db_name
+  twenty_db_url_secret_arn                    = var.twenty_db_url_secret_arn
+  twenty_encryption_key_secret_arn            = var.twenty_encryption_key_secret_arn
+  twenty_email_from_address                   = var.twenty_email_from_address
+  twenty_email_from_name                      = var.twenty_email_from_name
+  twenty_public_url                           = local.twenty_url
+  twenty_certificate_arn                      = var.twenty_certificate_arn != "" ? var.twenty_certificate_arn : (local.twenty_managed_certificate_enabled ? aws_acm_certificate_validation.twenty[0].certificate_arn : "")
+  n8n_provisioned                             = var.n8n_provisioned
+  n8n_runtime_enabled                         = var.n8n_runtime_enabled
+  n8n_image_uri                               = var.n8n_image_uri
+  n8n_database_admin_secret_arn               = var.n8n_database_admin_secret_arn
+  n8n_database_url_secret_arn                 = var.n8n_database_url_secret_arn
+  n8n_database_username                       = var.n8n_database_username
+  n8n_database_name                           = var.n8n_database_name
+  n8n_encryption_key_secret_arn               = var.n8n_encryption_key_secret_arn
+  n8n_operator_secret_arn                     = var.n8n_operator_secret_arn
+  n8n_service_credential_secret_arn           = var.n8n_service_credential_secret_arn
+  n8n_storage_bucket_name                     = var.n8n_storage_bucket_name
+  n8n_container_port                          = var.n8n_container_port
+  n8n_cache_engine                            = var.n8n_cache_engine
+  n8n_domain                                  = local.n8n_domain
+  n8n_public_url                              = local.n8n_url
+  n8n_certificate_arn                         = var.n8n_certificate_arn != "" ? var.n8n_certificate_arn : (local.n8n_managed_certificate_enabled ? aws_acm_certificate_validation.n8n[0].certificate_arn : "")
+  google_oauth_client_id                      = var.google_oauth_client_id
+  google_oauth_client_secret                  = var.google_oauth_client_secret
+  microsoft_oauth_client_id                   = var.microsoft_oauth_client_id
+  microsoft_oauth_client_secret               = var.microsoft_oauth_client_secret
+  microsoft_oauth_tenant                      = var.microsoft_oauth_tenant
+  tenant_entra_connections                    = var.tenant_entra_connections
+  console_client_enabled                      = var.console_client_enabled
+  console_callback_urls                       = var.console_callback_urls
+  console_logout_urls                         = var.console_logout_urls
+  pre_signup_lambda_zip                       = var.pre_signup_lambda_zip
+  auth_retirement_phase                       = var.auth_retirement_phase
+  auth_migration_recovery_deadline            = var.auth_migration_recovery_deadline
+  cognito_custom_auth_lambda_zip              = var.cognito_custom_auth_lambda_zip
+  lambda_zips_dir                             = var.lambda_zips_dir
+  lambda_artifact_bucket                      = var.lambda_artifact_bucket
+  lambda_artifact_prefix                      = var.lambda_artifact_prefix
+  require_lambda_artifacts                    = var.require_lambda_artifacts
+  enable_workspace_orchestration              = var.enable_workspace_orchestration
+  api_auth_secret                             = var.api_auth_secret
+  platform_operator_emails                    = var.platform_operator_emails
+  agentcore_runtime_dispatch_enabled          = var.agentcore_runtime_dispatch_enabled
+  agentcore_session_scope                     = var.agentcore_session_scope
+  chat_agent_invoke_provisioned_concurrency   = var.chat_agent_invoke_provisioned_concurrency
+  workspace_renderer_provisioned_concurrency  = var.workspace_renderer_provisioned_concurrency
 
   # Public website custom domain (optional — wired only when www_domain is set)
   www_domain          = var.www_domain
   www_certificate_arn = local.www_dns_enabled ? module.www_dns[0].certificate_arn : ""
 
-  # Docs site custom domain (derived from www_domain — docs.<apex>). The
-  # same ACM cert covers apex + www + docs + app/computer so every distribution
-  # shares it.
-  docs_domain          = local.www_dns_enabled ? local.docs_domain : ""
-  docs_certificate_arn = local.www_dns_enabled ? module.www_dns[0].certificate_arn : ""
-
   # End-user app custom domain (derived from www_domain — app.<apex>).
   # Same ACM cert covers it via the include_app SAN gate on www_dns.
   app_domain          = local.www_dns_enabled ? local.app_domain : ""
@@ -845,7 +1056,7 @@ module "thinkwork" {
 
   # Computer iframe sandbox (derived from www_domain — sandbox.<apex>).
   # Uses its own ACM certificate so sandbox bootstrap/rotation cannot replace
-  # the shared apex/www/docs/app/computer/api certificate.
+  # the shared apex/www/app/computer/api certificate.
   computer_sandbox_domain                 = local.www_dns_enabled ? local.sandbox_domain : ""
   computer_sandbox_certificate_arn        = local.www_dns_enabled ? aws_acm_certificate_validation.computer_sandbox[0].certificate_arn : ""
   computer_sandbox_allowed_parent_origins = local.www_dns_enabled ? "https://${local.app_domain}" : ""
@@ -858,21 +1069,17 @@ module "thinkwork" {
   # Wiki compile Lambda config. Pinned so unrelated terraform applies
   # don't wipe the Bedrock model or the aggregation flag back to
   # whatever the Lambda env defaults to.
-  wiki_compile_model_id                         = var.wiki_compile_model_id
   brain_source_agent_model_id                   = var.brain_source_agent_model_id
   wiki_aggregation_pass_enabled                 = var.wiki_aggregation_pass_enabled
   wiki_source                                   = var.wiki_source
-  analyst_policy_source                         = var.analyst_policy_source
-  capability_self_extension_tenants             = var.capability_self_extension_tenants
-  knowledge_graph_observations_ingest_enabled   = var.knowledge_graph_observations_ingest_enabled
+  vpc_interface_endpoint_services               = var.vpc_interface_endpoint_services
+  vpc_interface_endpoint_single_az              = var.vpc_interface_endpoint_single_az
+  identity_drift_match_enabled                  = var.identity_drift_match_enabled
   wiki_deterministic_linking_enabled            = var.wiki_deterministic_linking_enabled
-  google_places_api_key                         = var.google_places_api_key
   requester_idle_memory_learning_enabled        = var.requester_idle_memory_learning_enabled
   requester_memory_dreaming_enabled             = var.requester_memory_dreaming_enabled
   requester_memory_dreaming_schedule_expression = var.requester_memory_dreaming_schedule_expression
   brain_dream_state_enabled                     = var.brain_dream_state_enabled
-  retry_dispatcher_enabled                      = var.retry_dispatcher_enabled
-  stall_threshold_minutes                       = var.stall_threshold_minutes
   requester_memory_dreaming_model_id            = var.requester_memory_dreaming_model_id
   agentcore_code_interpreter_id                 = var.agentcore_code_interpreter_id
   agentcore_memory_id                           = var.agentcore_memory_id
@@ -897,11 +1104,21 @@ module "thinkwork" {
   customer_domain_delegated      = var.customer_domain_delegated
   customer_domain_legacy_retired = var.customer_domain_legacy_retired
 
+  # Deployment runner / API Lambdas inside the VPC + database exposure (THINK-1082)
+  # — see modules/app/deployment-control-plane/README.md, "Closing the database port".
+  deployment_runner_in_vpc = var.deployment_runner_in_vpc
+  api_lambdas_in_vpc       = var.api_lambdas_in_vpc
+  db_publicly_accessible   = var.db_publicly_accessible
+  db_public_ingress_cidrs  = var.db_public_ingress_cidrs
+
+  additional_admin_callback_urls = var.additional_admin_callback_urls
+  additional_admin_logout_urls   = var.additional_admin_logout_urls
+
   # Greenfield: create everything (all defaults are true)
 }
 
 ################################################################################
-# Public Website DNS (Cloudflare zone, ACM cert, www→apex redirect, docs)
+# Public Website DNS (Cloudflare zone, ACM cert, www→apex redirect)
 ################################################################################
 
 module "www_dns" {
@@ -913,12 +1130,10 @@ module "www_dns" {
   cloudflare_zone_id     = var.cloudflare_zone_id
   cloudfront_domain_name = module.thinkwork.www_distribution_domain
 
-  # Docs: include_docs is a plain bool (no output reference) so the
-  # ACM cert SAN list doesn't depend on the docs distribution output,
-  # which itself depends on the cert. docs_cloudfront_domain_name is
-  # read only after the cert is created, for the CNAME record.
-  include_docs                = true
-  docs_cloudfront_domain_name = module.thinkwork.docs_distribution_domain
+  # This stack predates THINK-702, so the shared cert still carries the
+  # retired docs.<domain> SAN. Dropping it would force a cert replacement
+  # that cycles against the thinkwork module — keep the dead SAN instead.
+  retain_docs_san = true
 
   # End-user app: canonical app.<apex> host. The compatibility output names
   # still use computer_* while the source path is apps/web.
@@ -1025,12 +1240,6 @@ output "appsync_realtime_url" {
   value       = module.thinkwork.appsync_realtime_url
 }
 
-output "appsync_api_key" {
-  description = "AppSync API key"
-  value       = module.thinkwork.appsync_api_key
-  sensitive   = true
-}
-
 output "mapbox_public_token" {
   description = "Mapbox public token used by apps/web MapView. Read by scripts/build-web.sh to inline VITE_MAPBOX_PUBLIC_TOKEN at build time; empty string lets MapView fall back to OpenStreetMap tiles."
   value       = module.thinkwork.mapbox_public_token
@@ -1052,11 +1261,31 @@ output "admin_client_id" {
   value       = module.thinkwork.admin_client_id
 }
 
+output "auth_route_clients" {
+  description = "Safe Cognito app-client manifest for local, Google, Microsoft, and tenant Entra routes."
+  value       = module.thinkwork.auth_route_clients
+}
+
+output "auth_retirement_phase" {
+  description = "Applied authentication retirement phase used for safe controller upgrades."
+  value       = module.thinkwork.auth_retirement_phase
+}
+
+output "web_local_client_id" {
+  description = "Local-password-only Cognito app client used by the web runtime."
+  value       = module.thinkwork.web_local_client_id
+}
+
 output "mobile_client_id" {
   description = "Cognito app client ID for mobile"
   value       = module.thinkwork.mobile_client_id
 }
 
+output "console_client_id" {
+  description = "Cognito app client ID for the Company Brain console (null while console_client_enabled = false)"
+  value       = module.thinkwork.console_client_id
+}
+
 output "ecr_repository_url" {
   description = "ECR repository URL for the AgentCore container"
   value       = module.thinkwork.ecr_repository_url
@@ -1082,15 +1311,6 @@ output "database_name" {
   value       = module.thinkwork.database_name
 }
 
-output "hindsight_enabled" {
-  description = "Whether Hindsight canonical memory is enabled"
-  value       = module.thinkwork.hindsight_enabled
-}
-
-output "hindsight_endpoint" {
-  description = "Hindsight API endpoint (null when enable_hindsight = false)"
-  value       = module.thinkwork.hindsight_endpoint
-}
 output "twenty_provisioned" {
   description = "Whether the Twenty CRM retained managed-app substrate is provisioned"
   value       = module.thinkwork.twenty_provisioned
@@ -1266,21 +1486,6 @@ output "computer_sandbox_allowed_parent_origins" {
   value       = module.thinkwork.computer_sandbox_allowed_parent_origins
 }
 
-output "docs_url" {
-  description = "Docs site URL"
-  value       = local.www_dns_enabled ? "https://${local.docs_domain}" : "https://${module.thinkwork.docs_distribution_domain}"
-}
-
-output "docs_distribution_id" {
-  description = "CloudFront distribution ID for docs (for cache invalidation)"
-  value       = module.thinkwork.docs_distribution_id
-}
-
-output "docs_bucket_name" {
-  description = "S3 bucket for docs site assets"
-  value       = module.thinkwork.docs_bucket_name
-}
-
 output "www_url" {
   description = "Public website URL"
   value       = var.www_domain != "" ? "https://${var.www_domain}" : "https://${module.thinkwork.www_distribution_domain}"
@@ -1352,7 +1557,17 @@ output "customer_domain_name_servers" {
   value       = module.thinkwork.customer_domain_name_servers
 }
 
-output "analyst_egress_ip" {
-  description = "Stable NAT egress IP of the VPC-attached analyst data-path Lambdas (null unless analyst_lambda_vpc_egress is set)"
-  value       = module.thinkwork.analyst_egress_ip
+# The original AgentCore Twenty reconciliation marker never owned external
+# cleanup, but an interrupted local-exec may have left it tainted. Forget it
+# from state without refresh or destroy provisioners — the child module owns
+# the replacement idempotent reconciliation marker under a new address. The
+# managed customer-update root (deployment-control-plane runner) carries the
+# same block; without it here, a dev push plans a delete the destructive-apply
+# guard rightly refuses.
+removed {
+  from = module.thinkwork.module.agentcore_proof_identity.terraform_data.twenty_identity_lifecycle
+
+  lifecycle {
+    destroy = false
+  }
 }