thinkwork-cli 0.13.1 → 1.0.0

package/dist/terraform/modules/app/agentcore-identity/scripts/bootstrap_twenty_oauth_client.sh

@@ -0,0 +1,239 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+: "${AWS_REGION:?AWS_REGION is required}"
+: "${TWENTY_OAUTH_ISSUER:?TWENTY_OAUTH_ISSUER is required}"
+: "${TWENTY_CLIENT_SECRET_ARN:?TWENTY_CLIENT_SECRET_ARN is required}"
+: "${TWENTY_CREDENTIAL_PROVIDER_NAME:?TWENTY_CREDENTIAL_PROVIDER_NAME is required}"
+
+script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+issuer="${TWENTY_OAUTH_ISSUER%/}"
+
+read_client_record() {
+  aws secretsmanager get-secret-value \
+    --region "$AWS_REGION" \
+    --secret-id "$TWENTY_CLIENT_SECRET_ARN" \
+    --query SecretString \
+    --output text 2>/dev/null || printf '{}'
+}
+
+write_client_record() {
+  aws secretsmanager put-secret-value \
+    --region "$AWS_REGION" \
+    --secret-id "$TWENTY_CLIENT_SECRET_ARN" \
+    --secret-string file:///dev/stdin >/dev/null
+}
+
+# Twenty's authorize endpoint is "$issuer/authorize" (NOT /oauth/authorize —
+# observed live on tei-e2e: the previously hard-coded path 404s). Fetch the
+# issuer's discovery document once and take both provider endpoints from it,
+# falling back to the documented paths when discovery is unavailable.
+discovery="$(curl --silent --fail --max-time 15 \
+  "$issuer/.well-known/oauth-authorization-server" 2>/dev/null || printf '')"
+provider_endpoint() {
+  local field="$1" fallback="$2"
+  local discovered
+  discovered="$(jq -r --arg f "$field" '.[$f] // empty' <<<"$discovery" 2>/dev/null)"
+  if [[ -n "$discovered" ]]; then
+    printf '%s' "$discovered"
+  else
+    printf '%s' "$fallback"
+  fi
+}
+
+reconcile_provider() {
+  local client_id="$1"
+  local runtime_script="$script_dir/reconcile_twenty_provider.mjs"
+  if [[ -n "${THINKWORK_AGENTCORE_CONTROL_RUNTIME_DIR:-}" ]]; then
+    runtime_script="$THINKWORK_AGENTCORE_CONTROL_RUNTIME_DIR/reconcile_twenty_provider.js"
+    if [[ ! -f "$runtime_script" ]]; then
+      printf '%s\n' 'Managed AgentCore control runtime is missing reconcile_twenty_provider.js' >&2
+      return 66
+    fi
+  fi
+  jq -n \
+    --arg region "$AWS_REGION" \
+    --arg name "$TWENTY_CREDENTIAL_PROVIDER_NAME" \
+    --arg issuer "$issuer" \
+    --arg authorizationEndpoint "$(provider_endpoint authorization_endpoint "$issuer/authorize")" \
+    --arg tokenEndpoint "$(provider_endpoint token_endpoint "$issuer/oauth/token")" \
+    --arg clientId "$client_id" \
+    --arg secretArn "$TWENTY_CLIENT_SECRET_ARN" \
+    '{
+      region: $region,
+      name: $name,
+      issuer: $issuer,
+      authorizationEndpoint: $authorizationEndpoint,
+      tokenEndpoint: $tokenEndpoint,
+      clientId: $clientId,
+      secretArn: $secretArn
+    }' | node "$runtime_script"
+}
+
+verify_provider() {
+  local response="$1"
+  local expected_client_id="$2"
+  local expected_callback="$3"
+  jq -e \
+    --arg name "$TWENTY_CREDENTIAL_PROVIDER_NAME" \
+    --arg client_id "$expected_client_id" \
+    --arg callback "$expected_callback" \
+    --arg secret_arn "$TWENTY_CLIENT_SECRET_ARN" \
+    '.name == $name and
+     .clientId == $client_id and
+     .callbackUrl == $callback and
+     .clientSecretArn == $secret_arn and
+     .clientSecretJsonKey == "client_secret" and
+     .clientSecretSource == "EXTERNAL" and
+     .status == "READY"' <<<"$response" >/dev/null
+}
+
+client_record="$(read_client_record)"
+if ! jq -e 'type == "object"' <<<"$client_record" >/dev/null 2>&1; then
+  printf '%s\n' 'Twenty client secret must contain a JSON object' >&2
+  exit 1
+fi
+
+client_id="$(jq -r '.client_id // empty' <<<"$client_record")"
+client_secret_ready=false
+if [[ -n "$client_id" ]] &&
+  jq -e '.client_secret | type == "string" and length > 0' \
+    <<<"$client_record" >/dev/null 2>&1 &&
+  [[ "$(jq -r '.bootstrap_state // empty' <<<"$client_record")" == "ready" ]]; then
+  client_secret_ready=true
+else
+  placeholder_id="thinkwork-bootstrap-$(openssl rand -hex 12)"
+  placeholder_secret="$(openssl rand -base64 48 | tr -d '\n')"
+  client_record="$(jq -n \
+    --arg client_id "$placeholder_id" \
+    --arg client_secret "$placeholder_secret" \
+    '{
+      bootstrap_state: "placeholder",
+      client_id: $client_id,
+      client_secret: $client_secret,
+      token_endpoint_auth_method: "client_secret_post"
+    }')"
+  printf '%s' "$client_record" | write_client_record
+  client_id="$placeholder_id"
+fi
+
+# AgentCore issues a provider-specific callback only after the provider exists.
+# The placeholder is never used for a user grant; it only lets AgentCore return
+# the callback that Twenty must bind to the confidential client registration.
+provider_response="$(reconcile_provider "$client_id")"
+callback_url="$(jq -r '.callbackUrl // empty' <<<"$provider_response")"
+if [[ -z "$callback_url" ]]; then
+  printf '%s\n' 'AgentCore Identity did not return a provider callback URL' >&2
+  exit 1
+fi
+
+registered_callback_matches=false
+if $client_secret_ready &&
+  jq -e --arg callback "$callback_url" \
+    '.redirect_uris | type == "array" and index($callback) != null' \
+    <<<"$client_record" >/dev/null 2>&1 &&
+  [[ "$(jq -r '.token_endpoint_auth_method // empty' <<<"$client_record")" == \
+    "client_secret_post" ]]; then
+  registered_callback_matches=true
+fi
+
+if $registered_callback_matches; then
+  verify_provider "$provider_response" "$client_id" "$callback_url"
+  printf 'Twenty confidential OAuth client reused: provider=%s callback=%s\n' \
+    "$TWENTY_CREDENTIAL_PROVIDER_NAME" "$callback_url" >&2
+  printf '%s' "$provider_response"
+  exit 0
+fi
+
+if [[ -z "$discovery" ]]; then
+  printf '%s\n' 'Twenty discovery document is unavailable' >&2
+  exit 1
+fi
+registration_endpoint="$(jq -r '.registration_endpoint // empty' <<<"$discovery")"
+if ! python3 - "$issuer" "$registration_endpoint" <<'PY'
+import sys
+from urllib.parse import urlsplit
+
+
+def origin(url: str) -> tuple[str, str, int]:
+    parsed = urlsplit(url)
+    if parsed.scheme != "https" or not parsed.hostname or parsed.username or parsed.password:
+        raise ValueError("HTTPS origin without userinfo required")
+    return parsed.scheme, parsed.hostname.lower(), parsed.port or 443
+
+
+try:
+    issuer_origin = origin(sys.argv[1])
+    registration_origin = origin(sys.argv[2])
+except (ValueError, IndexError):
+    raise SystemExit(1)
+raise SystemExit(0 if issuer_origin == registration_origin else 1)
+PY
+then
+  printf '%s\n' 'Twenty registration endpoint is not on the exact issuer origin' >&2
+  exit 1
+fi
+if ! jq -e \
+    --arg issuer "$issuer" \
+    '.issuer == $issuer and
+     (.grant_types_supported | index("authorization_code") != null) and
+     (.token_endpoint_auth_methods_supported | index("client_secret_post") != null) and
+     (.scopes_supported | index("api") != null) and
+     (.scopes_supported | index("profile") != null)' \
+    <<<"$discovery" >/dev/null; then
+  printf '%s\n' \
+    'Twenty discovery does not advertise same-origin confidential authorization-code DCR' >&2
+  exit 1
+fi
+
+registration_payload="$(jq -n \
+  --arg callback "$callback_url" \
+  '{
+    client_name: "ThinkWork AgentCore Identity Twenty CRM",
+    redirect_uris: [$callback],
+    grant_types: ["authorization_code"],
+    response_types: ["code"],
+    token_endpoint_auth_method: "client_secret_post",
+    scope: "api profile"
+  }')"
+registration_response="$(curl --silent --show-error --fail-with-body \
+  -H 'content-type: application/json' \
+  --data-binary "$registration_payload" \
+  "$registration_endpoint")"
+
+client_record="$(jq -e \
+  --arg callback "$callback_url" \
+  '{
+    bootstrap_state: "ready",
+    client_id: .client_id,
+    client_secret: .client_secret,
+    client_id_issued_at: .client_id_issued_at,
+    client_secret_expires_at: .client_secret_expires_at,
+    client_name: .client_name,
+    redirect_uris: .redirect_uris,
+    grant_types: .grant_types,
+    response_types: .response_types,
+    token_endpoint_auth_method: .token_endpoint_auth_method,
+    scope: (.scope // "api profile"),
+    registration_access_token: .registration_access_token,
+    registration_client_uri: .registration_client_uri
+  } | select(
+    (.client_id | type == "string" and length > 0) and
+    (.client_secret | type == "string" and length > 0) and
+    (.redirect_uris | type == "array" and index($callback) != null) and
+    .token_endpoint_auth_method == "client_secret_post"
+  )' <<<"$registration_response")" || {
+  printf '%s\n' 'Twenty DCR did not return a confidential callback-bound client' >&2
+  exit 1
+}
+
+# A Secrets Manager version write is atomic. The plaintext client secret never
+# enters Terraform state or process arguments and is not printed to logs.
+printf '%s' "$client_record" | write_client_record
+client_id="$(jq -r '.client_id' <<<"$client_record")"
+provider_response="$(reconcile_provider "$client_id")"
+verify_provider "$provider_response" "$client_id" "$callback_url"
+
+printf 'Twenty confidential OAuth client registered: provider=%s callback=%s\n' \
+  "$TWENTY_CREDENTIAL_PROVIDER_NAME" "$callback_url" >&2
+printf '%s' "$provider_response"

package/dist/terraform/modules/app/agentcore-identity/scripts/delete_identity.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+: "${AWS_REGION:?AWS_REGION is required}"
+: "${WORKLOAD_IDENTITY_NAME:?WORKLOAD_IDENTITY_NAME is required}"
+: "${CREDENTIAL_PROVIDER_NAME:?CREDENTIAL_PROVIDER_NAME is required}"
+
+if aws bedrock-agentcore-control get-oauth2-credential-provider \
+  --region "$AWS_REGION" \
+  --name "$CREDENTIAL_PROVIDER_NAME" >/dev/null 2>&1; then
+  aws bedrock-agentcore-control delete-oauth2-credential-provider \
+    --region "$AWS_REGION" \
+    --name "$CREDENTIAL_PROVIDER_NAME" >/dev/null
+fi
+
+# THINK-324: the workload identity is SHARED with the live Twenty connector
+# (per-user grants live under it). Its deletion is owned by
+# workload_identity_cleanup_owner / delete_workload_identity.sh — retiring
+# the proof plane must never delete it. See main.tf for the proof-only-stage
+# leak trade-off.
+printf 'AgentCore Identity proof provider deleted (workload identity retained): workload=%s provider=%s\n' \
+  "$WORKLOAD_IDENTITY_NAME" "$CREDENTIAL_PROVIDER_NAME"

package/dist/terraform/modules/app/agentcore-identity/scripts/delete_twenty_identity.sh

@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+: "${AWS_REGION:?AWS_REGION is required}"
+: "${TWENTY_CREDENTIAL_PROVIDER_NAME:?TWENTY_CREDENTIAL_PROVIDER_NAME is required}"
+
+if aws bedrock-agentcore-control get-oauth2-credential-provider \
+  --region "$AWS_REGION" \
+  --name "$TWENTY_CREDENTIAL_PROVIDER_NAME" >/dev/null 2>&1; then
+  aws bedrock-agentcore-control delete-oauth2-credential-provider \
+    --region "$AWS_REGION" \
+    --name "$TWENTY_CREDENTIAL_PROVIDER_NAME" >/dev/null
+fi
+
+printf 'AgentCore Twenty provider deleted: provider=%s\n' \
+  "$TWENTY_CREDENTIAL_PROVIDER_NAME"

package/dist/terraform/modules/app/agentcore-identity/scripts/delete_workload_identity.sh

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# THINK-324 — final deletion of the SHARED workload identity, owned by the
+# Twenty identity half (workload_identity_cleanup_owner). Runs only when the
+# Twenty user-federation identity is itself being removed.
+
+: "${AWS_REGION:?AWS_REGION is required}"
+: "${WORKLOAD_IDENTITY_NAME:?WORKLOAD_IDENTITY_NAME is required}"
+
+if aws bedrock-agentcore-control get-workload-identity \
+  --region "$AWS_REGION" \
+  --name "$WORKLOAD_IDENTITY_NAME" >/dev/null 2>&1; then
+  aws bedrock-agentcore-control delete-workload-identity \
+    --region "$AWS_REGION" \
+    --name "$WORKLOAD_IDENTITY_NAME" >/dev/null
+fi
+
+printf 'AgentCore workload identity deleted: %s\n' "$WORKLOAD_IDENTITY_NAME"

package/dist/terraform/modules/app/agentcore-identity/scripts/ensure_workload_identity.sh

@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# THINK-324 — Twenty-side workload-identity guarantee. Create-if-missing
+# ONLY: when the identity already exists (created by the proof lifecycle or a
+# prior run) this script must not touch it — reconcile_twenty_identity.sh
+# owns the return-url allowlist and always runs afterwards.
+
+: "${AWS_REGION:?AWS_REGION is required}"
+: "${WORKLOAD_IDENTITY_NAME:?WORKLOAD_IDENTITY_NAME is required}"
+: "${OAUTH_RETURN_URLS_JSON:?OAUTH_RETURN_URLS_JSON is required}"
+
+jq -e 'type == "array" and length > 0 and all(.[]; type == "string" and length > 0)' \
+  <<<"$OAUTH_RETURN_URLS_JSON" >/dev/null
+
+if aws bedrock-agentcore-control get-workload-identity \
+  --region "$AWS_REGION" \
+  --name "$WORKLOAD_IDENTITY_NAME" >/dev/null 2>&1; then
+  printf 'AgentCore workload identity already present: %s\n' "$WORKLOAD_IDENTITY_NAME"
+  exit 0
+fi
+
+aws bedrock-agentcore-control create-workload-identity \
+  --region "$AWS_REGION" \
+  --name "$WORKLOAD_IDENTITY_NAME" \
+  --allowed-resource-oauth2-return-urls "$OAUTH_RETURN_URLS_JSON" \
+  --tags '{"purpose":"twenty-user-federation","managed-by":"terraform"}' >/dev/null
+
+printf 'AgentCore workload identity created: %s\n' "$WORKLOAD_IDENTITY_NAME"

package/dist/terraform/modules/app/agentcore-identity/scripts/read_identity.sh

@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+input="$(cat)"
+region="$(jq -r '.region // empty' <<<"$input")"
+workload_name="$(jq -r '.workload_identity_name // empty' <<<"$input")"
+provider_name="$(jq -r '.credential_provider_name // empty' <<<"$input")"
+twenty_provider_name="$(jq -r '.twenty_credential_provider_name // empty' <<<"$input")"
+# THINK-324: an empty provider name means that half is disabled (proof
+# retired, or Twenty absent on a proof-only stage) — skip its reads and
+# return empty fields instead of failing.
+if [[ -z "$region" || -z "$workload_name" ]]; then
+  printf '%s\n' '{"error":"region and workload_identity_name are required"}' >&2
+  exit 1
+fi
+
+workload_json="$(aws bedrock-agentcore-control get-workload-identity \
+  --region "$region" --name "$workload_name" --output json)"
+
+provider_json='{}'
+if [[ -n "$provider_name" ]]; then
+  provider_json="$(aws bedrock-agentcore-control get-oauth2-credential-provider \
+    --region "$region" --name "$provider_name" --output json)"
+fi
+
+twenty_provider_json='{}'
+if [[ -n "$twenty_provider_name" ]]; then
+  twenty_provider_json="$(aws bedrock-agentcore-control get-oauth2-credential-provider \
+    --region "$region" --name "$twenty_provider_name" --output json)"
+fi
+
+jq -n \
+  --arg proof_enabled "$provider_name" \
+  --arg twenty_enabled "$twenty_provider_name" \
+  --arg workload_identity_arn "$(jq -r '.workloadIdentityArn // empty' <<<"$workload_json")" \
+  --arg credential_provider_arn "$(jq -r '.credentialProviderArn // empty' <<<"$provider_json")" \
+  --arg credential_secret_arn "$(jq -r '
+    if (.clientSecretArn | type) == "object"
+    then .clientSecretArn.secretArn // empty
+    else .clientSecretArn // empty
+    end
+  ' <<<"$provider_json")" \
+  --arg twenty_credential_provider_arn "$(jq -r '.credentialProviderArn // empty' <<<"$twenty_provider_json")" \
+  --arg twenty_oauth_callback_url "$(jq -r '.callbackUrl // empty' <<<"$twenty_provider_json")" \
+  'if ($workload_identity_arn == ""
+       or ($proof_enabled != "" and ($credential_provider_arn == "" or $credential_secret_arn == ""))
+       or ($twenty_enabled != "" and ($twenty_credential_provider_arn == "" or $twenty_oauth_callback_url == "")))
+   then error("AgentCore Identity readback omitted required ARNs")
+   else {
+     workload_identity_arn: $workload_identity_arn,
+     credential_provider_arn: $credential_provider_arn,
+     credential_secret_arn: $credential_secret_arn,
+     twenty_credential_provider_arn: $twenty_credential_provider_arn,
+     twenty_oauth_callback_url: $twenty_oauth_callback_url
+   } end'

package/dist/terraform/modules/app/agentcore-identity/scripts/reconcile_identity.sh

@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+: "${AWS_REGION:?AWS_REGION is required}"
+: "${WORKLOAD_IDENTITY_NAME:?WORKLOAD_IDENTITY_NAME is required}"
+: "${CREDENTIAL_PROVIDER_NAME:?CREDENTIAL_PROVIDER_NAME is required}"
+: "${OAUTH_ISSUER:?OAUTH_ISSUER is required}"
+: "${OAUTH_CLIENT_ID:?OAUTH_CLIENT_ID is required}"
+: "${OAUTH_CLIENT_SECRET:?OAUTH_CLIENT_SECRET is required}"
+: "${OAUTH_RETURN_URL:?OAUTH_RETURN_URL is required}"
+
+if aws bedrock-agentcore-control get-workload-identity \
+  --region "$AWS_REGION" \
+  --name "$WORKLOAD_IDENTITY_NAME" >/dev/null 2>&1; then
+  aws bedrock-agentcore-control update-workload-identity \
+    --region "$AWS_REGION" \
+    --name "$WORKLOAD_IDENTITY_NAME" \
+    --allowed-resource-oauth2-return-urls "$OAUTH_RETURN_URL" >/dev/null
+else
+  aws bedrock-agentcore-control create-workload-identity \
+    --region "$AWS_REGION" \
+    --name "$WORKLOAD_IDENTITY_NAME" \
+    --allowed-resource-oauth2-return-urls "$OAUTH_RETURN_URL" \
+    --tags '{"purpose":"think-316-proof","managed-by":"terraform"}' >/dev/null
+fi
+
+payload_file="$(mktemp)"
+trap 'rm -f "$payload_file"' EXIT
+jq -n \
+  --arg name "$CREDENTIAL_PROVIDER_NAME" \
+  --arg issuer "$OAUTH_ISSUER" \
+  --arg authorizationEndpoint "$OAUTH_ISSUER/authorize" \
+  --arg tokenEndpoint "$OAUTH_ISSUER/token" \
+  --arg clientId "$OAUTH_CLIENT_ID" \
+  --arg clientSecret "$OAUTH_CLIENT_SECRET" \
+  '{
+    name: $name,
+    credentialProviderVendor: "CustomOauth2",
+    oauth2ProviderConfigInput: {
+      customOauth2ProviderConfig: {
+        oauthDiscovery: {
+          authorizationServerMetadata: {
+            issuer: $issuer,
+            authorizationEndpoint: $authorizationEndpoint,
+            tokenEndpoint: $tokenEndpoint,
+            responseTypes: ["code"]
+          }
+        },
+        clientId: $clientId,
+        clientSecret: $clientSecret,
+        clientAuthenticationMethod: "CLIENT_SECRET_BASIC",
+        onBehalfOfTokenExchangeConfig: {
+          grantType: "TOKEN_EXCHANGE",
+          tokenExchangeGrantTypeConfig: {actorTokenContent: "NONE"}
+        }
+      }
+    }
+  }' >"$payload_file"
+
+if aws bedrock-agentcore-control get-oauth2-credential-provider \
+  --region "$AWS_REGION" \
+  --name "$CREDENTIAL_PROVIDER_NAME" >/dev/null 2>&1; then
+  aws bedrock-agentcore-control update-oauth2-credential-provider \
+    --region "$AWS_REGION" \
+    --cli-input-json "file://$payload_file" >/dev/null
+else
+  aws bedrock-agentcore-control create-oauth2-credential-provider \
+    --region "$AWS_REGION" \
+    --cli-input-json "file://$payload_file" >/dev/null
+fi
+
+printf 'AgentCore Identity proof resources reconciled: workload=%s provider=%s\n' \
+  "$WORKLOAD_IDENTITY_NAME" "$CREDENTIAL_PROVIDER_NAME"

package/dist/terraform/modules/app/agentcore-identity/scripts/reconcile_twenty_identity.sh

@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+: "${AWS_REGION:?AWS_REGION is required}"
+: "${WORKLOAD_IDENTITY_NAME:?WORKLOAD_IDENTITY_NAME is required}"
+: "${OAUTH_RETURN_URLS_JSON:?OAUTH_RETURN_URLS_JSON is required}"
+: "${TWENTY_CREDENTIAL_PROVIDER_NAME:?TWENTY_CREDENTIAL_PROVIDER_NAME is required}"
+: "${TWENTY_CLIENT_SECRET_ARN:?TWENTY_CLIENT_SECRET_ARN is required}"
+: "${TWENTY_OAUTH_ISSUER:?TWENTY_OAUTH_ISSUER is required}"
+: "${TWENTY_OAUTH_RESOURCE:?TWENTY_OAUTH_RESOURCE is required}"
+
+jq -e 'type == "array" and length > 0 and all(.[]; type == "string" and length > 0)' \
+  <<<"$OAUTH_RETURN_URLS_JSON" >/dev/null
+
+# The core lifecycle owns this workload. Extend its allowlist in place; never
+# delete or recreate it while adding a downstream user-federation provider.
+aws bedrock-agentcore-control update-workload-identity \
+  --region "$AWS_REGION" \
+  --name "$WORKLOAD_IDENTITY_NAME" \
+  --allowed-resource-oauth2-return-urls "$OAUTH_RETURN_URLS_JSON" >/dev/null
+
+script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+provider_response="$(bash "$script_dir/bootstrap_twenty_oauth_client.sh")"
+callback_url="$(jq -r '.callbackUrl // empty' <<<"$provider_response")"
+if [[ -z "$callback_url" || "$callback_url" == "None" ]]; then
+  printf '%s\n' 'AgentCore Identity did not return the Twenty callback URL' >&2
+  exit 1
+fi
+
+client_record="$(aws secretsmanager get-secret-value \
+  --region "$AWS_REGION" \
+  --secret-id "$TWENTY_CLIENT_SECRET_ARN" \
+  --query SecretString \
+  --output text)"
+jq -e --arg callback "$callback_url" \
+  '.bootstrap_state == "ready" and
+   (.client_id | type == "string" and length > 0) and
+   (.client_secret | type == "string" and length > 0) and
+   (.redirect_uris | type == "array" and index($callback) != null) and
+   .token_endpoint_auth_method == "client_secret_post"' \
+  <<<"$client_record" >/dev/null
+
+printf 'AgentCore Twenty provider reconciled: workload=%s provider=%s resource=%s callback=%s\n' \
+  "$WORKLOAD_IDENTITY_NAME" "$TWENTY_CREDENTIAL_PROVIDER_NAME" \
+  "$TWENTY_OAUTH_RESOURCE" "$callback_url"

package/dist/terraform/modules/app/agentcore-identity/scripts/reconcile_twenty_provider.mjs

@@ -0,0 +1,123 @@
+#!/usr/bin/env node
+
+import {
+  BedrockAgentCoreControlClient,
+  CreateOauth2CredentialProviderCommand,
+  GetOauth2CredentialProviderCommand,
+  ResourceNotFoundException,
+  UpdateOauth2CredentialProviderCommand,
+} from "@aws-sdk/client-bedrock-agentcore-control";
+
+if (process.argv[2] === "--runtime-preflight") {
+  process.stdout.write(
+    JSON.stringify({
+      entrypoint: "reconcile_twenty_provider",
+      sdkImportReady:
+        typeof BedrockAgentCoreControlClient === "function" &&
+        typeof CreateOauth2CredentialProviderCommand === "function" &&
+        typeof GetOauth2CredentialProviderCommand === "function" &&
+        typeof UpdateOauth2CredentialProviderCommand === "function",
+    }),
+  );
+  process.exit(0);
+}
+
+const chunks = [];
+for await (const chunk of process.stdin) chunks.push(chunk);
+const input = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+
+const client = new BedrockAgentCoreControlClient({ region: input.region });
+const providerInput = {
+  name: input.name,
+  credentialProviderVendor: "CustomOauth2",
+  oauth2ProviderConfigInput: {
+    customOauth2ProviderConfig: {
+      oauthDiscovery: {
+        authorizationServerMetadata: {
+          issuer: input.issuer,
+          authorizationEndpoint: input.authorizationEndpoint,
+          tokenEndpoint: input.tokenEndpoint,
+          responseTypes: ["code"],
+        },
+      },
+      clientId: input.clientId,
+      clientSecretConfig: {
+        secretId: input.secretArn,
+        jsonKey: "client_secret",
+      },
+      clientSecretSource: "EXTERNAL",
+      clientAuthenticationMethod: "CLIENT_SECRET_POST",
+    },
+  },
+};
+
+let exists = false;
+try {
+  await client.send(
+    new GetOauth2CredentialProviderCommand({ name: input.name }),
+  );
+  exists = true;
+} catch (error) {
+  if (!(error instanceof ResourceNotFoundException)) throw error;
+}
+
+if (exists) {
+  await client.send(new UpdateOauth2CredentialProviderCommand(providerInput));
+} else {
+  await client.send(new CreateOauth2CredentialProviderCommand(providerInput));
+}
+
+const sleep = (milliseconds) =>
+  new Promise((resolve) => setTimeout(resolve, milliseconds));
+
+let response;
+for (let attempt = 0; attempt < 30; attempt += 1) {
+  response = await client.send(
+    new GetOauth2CredentialProviderCommand({ name: input.name }),
+  );
+  const status = response.status;
+  const provider =
+    response.oauth2ProviderConfigOutput?.customOauth2ProviderConfig;
+  const secretArn =
+    typeof response.clientSecretArn === "string"
+      ? response.clientSecretArn
+      : response.clientSecretArn?.secretArn;
+  const ready =
+    response.callbackUrl &&
+    response.credentialProviderArn &&
+    provider?.clientId === input.clientId &&
+    secretArn === input.secretArn &&
+    response.clientSecretJsonKey === "client_secret" &&
+    response.clientSecretSource === "EXTERNAL" &&
+    status === "READY";
+  if (ready) break;
+  if (status?.endsWith("_FAILED")) {
+    throw new Error(`AgentCore OAuth provider ${input.name} entered ${status}`);
+  }
+  if (attempt === 29) {
+    throw new Error(
+      `AgentCore OAuth provider ${input.name} did not converge to the requested client and external secret`,
+    );
+  }
+  await sleep(2000);
+}
+
+const secretArn =
+  typeof response.clientSecretArn === "string"
+    ? response.clientSecretArn
+    : response.clientSecretArn?.secretArn;
+const provider =
+  response.oauth2ProviderConfigOutput?.customOauth2ProviderConfig;
+
+process.stdout.write(
+  JSON.stringify({
+    name: response.name,
+    callbackUrl: response.callbackUrl,
+    credentialProviderArn: response.credentialProviderArn,
+    clientId: provider?.clientId,
+    clientSecretArn: secretArn,
+    clientSecretJsonKey: response.clientSecretJsonKey,
+    clientSecretSource: response.clientSecretSource,
+    status: response.status,
+  }),
+);

package/dist/terraform/modules/app/agentcore-identity/tests/tainted-marker/after.tf

@@ -0,0 +1,15 @@
+terraform {
+  required_version = "= 1.8.5"
+}
+
+removed {
+  from = module.thinkwork.module.agentcore_proof_identity.terraform_data.twenty_identity_lifecycle
+
+  lifecycle {
+    destroy = false
+  }
+}
+
+module "thinkwork" {
+  source = "./thinkwork"
+}

package/dist/terraform/modules/app/agentcore-identity/tests/tainted-marker/before.tf

@@ -0,0 +1,7 @@
+terraform {
+  required_version = "= 1.8.5"
+}
+
+module "thinkwork" {
+  source = "./thinkwork"
+}

package/dist/terraform/modules/app/agentcore-identity/tests/tainted-marker/identity-after.tf

@@ -0,0 +1,8 @@
+resource "terraform_data" "twenty_identity_reconciliation" {
+  count = 1
+  input = "new-idempotent-reconciliation-marker"
+
+  provisioner "local-exec" {
+    command = "printf '%s\\n' reconciled > '${path.root}/reconciled.log'"
+  }
+}

package/dist/terraform/modules/app/agentcore-identity/tests/tainted-marker/identity-before.tf

@@ -0,0 +1,9 @@
+resource "terraform_data" "twenty_identity_lifecycle" {
+  count = 1
+  input = "legacy-state-only-marker"
+
+  provisioner "local-exec" {
+    when    = destroy
+    command = "printf '%s\\n' destroyed > '${path.root}/destroyed.log'"
+  }
+}