thinkwork-cli 0.13.1 → 1.0.0

package/dist/terraform/modules/app/agentcore-pi/scripts/reconcile_pi_runtime.mjs

@@ -0,0 +1,175 @@
+#!/usr/bin/env node
+// Reconcile the Pi Bedrock AgentCore Runtime to a digest-pinned image
+// (THINK-584 U5). Invoked by the deployment-control-plane runner with a JSON
+// request on STDIN (never argv — the mirrored env contains secrets):
+//
+//   {
+//     "region": "us-east-1",
+//     "runtimeName": "thinkwork_<stage>_pi",
+//     "runtimeId": "<optional known id>",
+//     "roleArn": "arn:aws:iam::...:role/thinkwork-<stage>-agentcore-pi-role",
+//     "imageUri": "<account>.dkr.ecr...amazonaws.com/...@sha256:<digest>",
+//     "environment": { ... mirrored Lambda env, control chars escaped ... },
+//     "waitSeconds": 900
+//   }
+//
+// Creates the runtime when absent, updates it when present, then waits for
+// runtime READY + DEFAULT endpoint liveVersion == runtime version + the
+// exact image URI. Prints a result JSON on stdout. Env VALUES are never
+// printed — counts only (R19).
+
+import {
+  BedrockAgentCoreControlClient,
+  CreateAgentRuntimeCommand,
+  GetAgentRuntimeCommand,
+  ListAgentRuntimesCommand,
+  ListAgentRuntimeEndpointsCommand,
+  UpdateAgentRuntimeCommand,
+} from "@aws-sdk/client-bedrock-agentcore-control";
+
+if (process.argv[2] === "--runtime-preflight") {
+  process.stdout.write(
+    JSON.stringify({
+      entrypoint: "reconcile_pi_runtime",
+      sdkImportReady:
+        typeof BedrockAgentCoreControlClient === "function" &&
+        typeof CreateAgentRuntimeCommand === "function" &&
+        typeof GetAgentRuntimeCommand === "function" &&
+        typeof ListAgentRuntimesCommand === "function" &&
+        typeof ListAgentRuntimeEndpointsCommand === "function" &&
+        typeof UpdateAgentRuntimeCommand === "function",
+    }),
+  );
+  process.exit(0);
+}
+
+const chunks = [];
+for await (const chunk of process.stdin) chunks.push(chunk);
+const input = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+
+const environment = input.environment ?? {};
+const envCount = Object.keys(environment).length;
+if (envCount === 0) {
+  // Atomic-or-abort: an empty mirrored env would strand the runtime.
+  process.stderr.write(
+    "reconcile_pi_runtime: refusing to proceed with an empty environment mirror\n",
+  );
+  process.exit(2);
+}
+if (!/@sha256:[0-9a-f]{64}$/.test(input.imageUri ?? "")) {
+  process.stderr.write(
+    "reconcile_pi_runtime: imageUri must be pinned to an immutable sha256 digest\n",
+  );
+  process.exit(2);
+}
+
+const client = new BedrockAgentCoreControlClient({ region: input.region });
+
+let runtimeId = input.runtimeId || "";
+if (!runtimeId) {
+  let nextToken;
+  do {
+    const page = await client.send(new ListAgentRuntimesCommand({ nextToken }));
+    const match = (page.agentRuntimes ?? []).find(
+      (runtime) => runtime.agentRuntimeName === input.runtimeName,
+    );
+    if (match) {
+      runtimeId = match.agentRuntimeId;
+      break;
+    }
+    nextToken = page.nextToken;
+  } while (nextToken);
+}
+
+const artifact = {
+  containerConfiguration: { containerUri: input.imageUri },
+};
+let created = false;
+if (runtimeId) {
+  await client.send(
+    new UpdateAgentRuntimeCommand({
+      agentRuntimeId: runtimeId,
+      roleArn: input.roleArn,
+      agentRuntimeArtifact: artifact,
+      networkConfiguration: { networkMode: "PUBLIC" },
+      protocolConfiguration: { serverProtocol: "HTTP" },
+      environmentVariables: environment,
+    }),
+  );
+} else {
+  const response = await client.send(
+    new CreateAgentRuntimeCommand({
+      agentRuntimeName: input.runtimeName,
+      roleArn: input.roleArn,
+      agentRuntimeArtifact: artifact,
+      networkConfiguration: { networkMode: "PUBLIC" },
+      protocolConfiguration: { serverProtocol: "HTTP" },
+      environmentVariables: environment,
+    }),
+  );
+  runtimeId = response.agentRuntimeId;
+  created = true;
+}
+
+const sleep = (milliseconds) =>
+  new Promise((resolve) => setTimeout(resolve, milliseconds));
+
+const waitSeconds = Number(input.waitSeconds ?? 900);
+const deadline = Date.now() + waitSeconds * 1000;
+let detail;
+let endpoint;
+for (;;) {
+  detail = await client.send(
+    new GetAgentRuntimeCommand({ agentRuntimeId: runtimeId }),
+  );
+  const endpoints = await client.send(
+    new ListAgentRuntimeEndpointsCommand({ agentRuntimeId: runtimeId }),
+  );
+  endpoint = (endpoints.runtimeEndpoints ?? []).find(
+    (candidate) => candidate.name === "DEFAULT",
+  );
+  const mirroredCount = Object.keys(detail.environmentVariables ?? {}).length;
+  const image =
+    detail.agentRuntimeArtifact?.containerConfiguration?.containerUri ?? "";
+  const settled =
+    detail.status === "READY" &&
+    endpoint?.status === "READY" &&
+    (endpoint?.targetVersion == null ||
+      endpoint.targetVersion === detail.agentRuntimeVersion) &&
+    endpoint?.liveVersion === detail.agentRuntimeVersion &&
+    image === input.imageUri;
+  if (settled) {
+    if (mirroredCount === 0) {
+      // Post-update assertion half of atomic-or-abort: the runtime settled
+      // but reports an EMPTY env — the mirror did not stick. Fail loudly.
+      process.stderr.write(
+        "reconcile_pi_runtime: runtime settled with an EMPTY environment\n",
+      );
+      process.exit(2);
+    }
+    break;
+  }
+  if (Date.now() >= deadline) {
+    process.stderr.write(
+      `reconcile_pi_runtime: timed out waiting for ${runtimeId} ` +
+        `(runtime=${detail.status} endpoint=${endpoint?.status ?? "MISSING"} ` +
+        `live=${endpoint?.liveVersion ?? "null"} target=${endpoint?.targetVersion ?? "null"} ` +
+        `image=${image})\n`,
+    );
+    process.exit(1);
+  }
+  await sleep(15000);
+}
+
+process.stdout.write(
+  JSON.stringify({
+    runtimeId,
+    created,
+    version: detail.agentRuntimeVersion,
+    status: detail.status,
+    endpointStatus: endpoint?.status ?? "UNKNOWN",
+    liveVersion: endpoint?.liveVersion ?? null,
+    image: detail.agentRuntimeArtifact?.containerConfiguration?.containerUri,
+    envCount,
+  }),
+);

package/dist/terraform/modules/app/agentcore-pi/variables.tf

@@ -43,18 +43,6 @@ variable "async_dlq_arn" {
   type        = string
 }
 
-variable "hindsight_endpoint" {
-  description = "Hindsight API endpoint. Empty string (default) disables Hindsight tools in the container; set to an endpoint URL to enable Hindsight as an add-on alongside the always-on managed memory."
-  type        = string
-  default     = ""
-}
-
-variable "hindsight_database_name" {
-  description = "Dedicated Hindsight database name (THINK-220 cutover flag). Empty = the provider's direct SQL (high-confidence-fact recall, access-count writes) targets the `hindsight` schema of the primary database; set = that database's `public` schema."
-  type        = string
-  default     = ""
-}
-
 variable "agentcore_memory_id" {
   description = "AgentCore Memory resource ID. Populated automatically by the agentcore-memory module; injected into the container as AGENTCORE_MEMORY_ID for auto-retention."
   type        = string
@@ -74,16 +62,6 @@ variable "api_auth_secret" {
   sensitive   = true
 }
 
-variable "memory_engine" {
-  description = "Active long-term memory engine ('hindsight' or 'agentcore'). Surfaced to the runtime as MEMORY_ENGINE for telemetry/debugging only; engine selection itself happens in the API's normalized memory layer when memory-retain is invoked."
-  type        = string
-  default     = "hindsight"
-  validation {
-    condition     = contains(["hindsight", "agentcore"], var.memory_engine)
-    error_message = "memory_engine must be 'hindsight' or 'agentcore'."
-  }
-}
-
 variable "requester_idle_memory_learning_enabled" {
   description = "When true, requester memory learning runs through the API idle/dreaming pipeline instead of runtime retain-on-every-turn."
   type        = bool
@@ -103,37 +81,37 @@ variable "db_secret_arn" {
 }
 
 variable "okf_efs_enabled" {
-  description = "When true, mount the generated OKF wiki EFS view into Pi. Requires subnet/security-group inputs and an access point ARN."
+  description = "DEPRECATED (THINK-589): no-op, removal pending. The OKF wiki EFS feature is dead; this input is ignored — Pi is never VPC-attached and never mounts EFS. Declaration retained so existing passthroughs and tfvars keep working until PR 2 deletes it."
   type        = bool
   default     = false
 }
 
 variable "okf_efs_subnet_ids" {
-  description = "Subnet IDs for the Pi Lambda VPC attachment used by the OKF wiki EFS mount."
+  description = "DEPRECATED (THINK-589): no-op, removal pending. The OKF wiki EFS feature is dead; this input is ignored — Pi is never VPC-attached and never mounts EFS. Declaration retained so existing passthroughs and tfvars keep working until PR 2 deletes it."
   type        = list(string)
   default     = []
 }
 
 variable "okf_efs_security_group_ids" {
-  description = "Security group IDs for the Pi Lambda VPC attachment used by the OKF wiki EFS mount."
+  description = "DEPRECATED (THINK-589): no-op, removal pending. The OKF wiki EFS feature is dead; this input is ignored — Pi is never VPC-attached and never mounts EFS. Declaration retained so existing passthroughs and tfvars keep working until PR 2 deletes it."
   type        = list(string)
   default     = []
 }
 
 variable "okf_efs_file_system_arn" {
-  description = "EFS file system ARN for read-only Pi OKF wiki access."
+  description = "DEPRECATED (THINK-589): no-op, removal pending. The OKF wiki EFS feature is dead; this input is ignored — Pi is never VPC-attached and never mounts EFS. Declaration retained so existing passthroughs and tfvars keep working until PR 2 deletes it."
   type        = string
   default     = ""
 }
 
 variable "okf_efs_read_access_point_arn" {
-  description = "EFS access point ARN mounted read-only by Pi for OKF wiki traversal."
+  description = "DEPRECATED (THINK-589): no-op, removal pending. The OKF wiki EFS feature is dead; this input is ignored — Pi is never VPC-attached and never mounts EFS. Declaration retained so existing passthroughs and tfvars keep working until PR 2 deletes it."
   type        = string
   default     = ""
 }
 
 variable "okf_efs_mount_path" {
-  description = "Local Lambda mount path for the OKF wiki EFS view. Must be under /mnt."
+  description = "DEPRECATED (THINK-589): no-op, removal pending. The OKF wiki EFS feature is dead; this input is ignored — Pi is never VPC-attached and never mounts EFS. Declaration retained so existing passthroughs and tfvars keep working until PR 2 deletes it."
   type        = string
   default     = "/mnt/thinkwork-okf"
 }
@@ -151,3 +129,32 @@ variable "capability_signing_public_key" {
   type        = string
   default     = ""
 }
+
+# ---------------------------------------------------------------------------
+# THINK-1082: Pi inside the VPC. Pi holds DB_CLUSTER_ARN + DB_SECRET_ARN (RDS
+# Data API — no network path to the cluster itself) but ships alongside the
+# api handlers, which reach Aurora over its public endpoint today. This lane
+# lets the runtime sit in the same private subnets behind the same api-lambda
+# security group so the stage's database port can close uniformly. NETWORK
+# side only: the THINK-589 EFS mount stays gone (no file_system_config). The
+# private subnets must be NAT-routed — Pi needs Bedrock / Anthropic / GitHub
+# egress. Default off = byte-identical to today.
+# ---------------------------------------------------------------------------
+
+variable "in_vpc" {
+  description = "Attach the Pi runtime Lambda to the VPC (vpc_subnet_ids + vpc_security_group_ids). Requires both lists non-empty and NAT-routed subnets (Bedrock, Anthropic, GitHub egress). Network attachment only — never re-adds the retired EFS mount."
+  type        = bool
+  default     = false
+}
+
+variable "vpc_subnet_ids" {
+  description = "Private (NAT-routed) subnet IDs for the Pi runtime when in_vpc is true."
+  type        = list(string)
+  default     = []
+}
+
+variable "vpc_security_group_ids" {
+  description = "Security groups for the Pi runtime when in_vpc is true (the thinkwork module passes its api-lambda SG)."
+  type        = list(string)
+  default     = []
+}

package/dist/terraform/modules/app/agentcore-platform/main.tf

@@ -10,6 +10,12 @@ variable "stage" {
   type        = string
 }
 
+variable "release_mirror_principal_arns" {
+  description = "IAM principals allowed to mirror release runtime images into this stage's AgentCore ECR repository. AgentCore Runtime is arm64-only and the deployment runner resolves the runtime image from THIS account's ECR by the '<releaseVersion>-pi-arm64' tag, so the ThinkWork release pipeline must be able to push it (THINK-616). Set to [] to disable the cross-account grant and mirror by hand."
+  type        = list(string)
+  default     = []
+}
+
 ################################################################################
 # ECR Repository
 ################################################################################
@@ -48,6 +54,68 @@ resource "aws_ecr_lifecycle_policy" "agentcore" {
   })
 }
 
+################################################################################
+# Cross-account release-image mirror grant (THINK-616)
+#
+# The release workflow's `mirror-customer-images` job pushes
+# `<releaseVersion>-pi-arm64` into this repository from the ThinkWork release
+# account. A repository policy is the whole grant — no role, user, or key is
+# provisioned here.
+#
+# `aws_ecr_repository_policy` REPLACES the repository policy document, so the
+# Lambda image-retrieval statement that Lambda auto-attaches when a container
+# function is created is restated here; dropping it would leave the Pi Lambda's
+# image pull ungranted.
+################################################################################
+
+data "aws_caller_identity" "current" {}
+
+resource "aws_ecr_repository_policy" "agentcore" {
+  count = length(var.release_mirror_principal_arns) > 0 ? 1 : 0
+
+  repository = aws_ecr_repository.agentcore.name
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Sid    = "LambdaECRImageRetrievalPolicy"
+        Effect = "Allow"
+        Principal = {
+          Service = "lambda.amazonaws.com"
+        }
+        Action = [
+          "ecr:BatchGetImage",
+          "ecr:GetDownloadUrlForLayer",
+        ]
+        Condition = {
+          StringLike = {
+            "aws:sourceArn" = "arn:aws:lambda:*:${data.aws_caller_identity.current.account_id}:function:*"
+          }
+        }
+      },
+      {
+        Sid    = "ThinkWorkReleaseImageMirror"
+        Effect = "Allow"
+        Principal = {
+          AWS = var.release_mirror_principal_arns
+        }
+        Action = [
+          "ecr:BatchCheckLayerAvailability",
+          "ecr:BatchGetImage",
+          "ecr:CompleteLayerUpload",
+          "ecr:DescribeImages",
+          "ecr:GetDownloadUrlForLayer",
+          "ecr:InitiateLayerUpload",
+          "ecr:ListImages",
+          "ecr:PutImage",
+          "ecr:UploadLayerPart",
+        ]
+      },
+    ]
+  })
+}
+
 ################################################################################
 # Async-invoke DLQ
 ################################################################################

package/dist/terraform/modules/app/agentcore-runtime/main.tf

@@ -26,12 +26,6 @@ variable "bucket_name" {
   type        = string
 }
 
-variable "hindsight_endpoint" {
-  description = "Hindsight API endpoint. Empty string (default) disables Hindsight tools in the container; set to an endpoint URL to enable Hindsight as an add-on alongside the always-on managed memory."
-  type        = string
-  default     = ""
-}
-
 variable "agentcore_memory_id" {
   description = "AgentCore Memory resource ID. Populated automatically by the agentcore-memory module; injected into the container as AGENTCORE_MEMORY_ID for auto-retention."
   type        = string
@@ -58,16 +52,6 @@ variable "nova_act_api_key" {
   sensitive   = true
 }
 
-variable "memory_engine" {
-  description = "Active long-term memory engine ('hindsight' or 'agentcore'). Surfaced to the runtime as MEMORY_ENGINE for telemetry/debugging only; engine selection itself happens in the API's normalized memory layer when memory-retain is invoked."
-  type        = string
-  default     = "hindsight"
-  validation {
-    condition     = contains(["hindsight", "agentcore"], var.memory_engine)
-    error_message = "memory_engine must be 'hindsight' or 'agentcore'."
-  }
-}
-
 variable "requester_idle_memory_learning_enabled" {
   description = "When true, requester memory learning runs through the API idle/dreaming pipeline instead of runtime retain-on-every-turn."
   type        = bool
@@ -302,9 +286,9 @@ resource "aws_iam_role_policy" "agentcore" {
       },
       {
         # Async-invoke the memory-retain Lambda after every chat turn so
-        # the API's normalized memory layer can run the active engine's
-        # retainTurn() path (Hindsight POST /memories or AgentCore
-        # CreateEvent). InvocationType=Event from the Python client; this
+        # the API's normalized memory layer can run the AgentCore
+        # CreateEvent retainTurn() path. InvocationType=Event from the
+        # Python client; this
         # Lambda is the only target.
         Sid      = "MemoryRetainInvoke"
         Effect   = "Allow"
@@ -346,7 +330,7 @@ resource "aws_lambda_function" "agentcore" {
       AWS_LWA_PORT                           = "8080"
       AGENTCORE_MEMORY_ID                    = var.agentcore_memory_id
       AGENTCORE_FILES_BUCKET                 = var.bucket_name
-      MEMORY_ENGINE                          = var.memory_engine
+      MEMORY_ENGINE                          = "agentcore"
       REQUESTER_IDLE_MEMORY_LEARNING_ENABLED = tostring(var.requester_idle_memory_learning_enabled)
       MEMORY_RETAIN_FN_NAME                  = local.memory_retain_fn_name
       # Needed by run_skill_dispatch.py to POST terminal state back to

package/dist/terraform/modules/app/appsync-subscriptions/main.tf

@@ -18,21 +18,19 @@
 
 resource "aws_appsync_graphql_api" "subscriptions" {
   name                = "thinkwork-${var.stage}-subscriptions"
-  authentication_type = "API_KEY"
+  authentication_type = "AWS_LAMBDA"
   xray_enabled        = false
 
   schema = var.subscription_schema
 
-  additional_authentication_provider {
-    authentication_type = "AWS_IAM"
+  lambda_authorizer_config {
+    authorizer_uri                   = "arn:aws:lambda:${var.region}:${var.account_id}:function:thinkwork-${var.stage}-api-appsync-subscription-authorizer"
+    authorizer_result_ttl_in_seconds = 0
+    identity_validation_expression   = "^twsub1_[A-Za-z0-9_-]+$"
   }
 
   additional_authentication_provider {
-    authentication_type = "AMAZON_COGNITO_USER_POOLS"
-
-    user_pool_config {
-      user_pool_id = var.user_pool_id
-    }
+    authentication_type = "AWS_IAM"
   }
 
   tags = {
@@ -40,19 +38,6 @@ resource "aws_appsync_graphql_api" "subscriptions" {
   }
 }
 
-################################################################################
-# API Key — 365 day expiry
-################################################################################
-
-resource "aws_appsync_api_key" "main" {
-  api_id  = aws_appsync_graphql_api.subscriptions.id
-  expires = timeadd(timestamp(), "8760h")
-
-  lifecycle {
-    ignore_changes = [expires]
-  }
-}
-
 ################################################################################
 # NONE Data Source (passthrough for notification mutations)
 ################################################################################
@@ -84,6 +69,20 @@ locals {
     "notifyEvalRunUpdate",
     "notifyWorkspaceAccessRevoked",
   ]
+  subscription_scopes = {
+    onAgentStatusChanged     = { argument = "tenantId", kind = "tenant" }
+    onNewMessage             = { argument = "threadId", kind = "thread" }
+    onHeartbeatActivity      = { argument = "tenantId", kind = "tenant" }
+    onThreadUpdated          = { argument = "tenantId", kind = "tenant" }
+    onThreadActivity         = { argument = "userId", kind = "user" }
+    onInboxItemStatusChanged = { argument = "tenantId", kind = "tenant" }
+    onThreadTurnUpdated      = { argument = "tenantId", kind = "tenant" }
+    onThreadTurnStep         = { argument = "threadId", kind = "thread" }
+    onOrgUpdated             = { argument = "tenantId", kind = "tenant" }
+    onCostRecorded           = { argument = "tenantId", kind = "tenant" }
+    onEvalRunUpdated         = { argument = "tenantId", kind = "tenant" }
+    onWorkspaceAccessRevoked = { argument = "userId", kind = "user" }
+  }
 }
 
 resource "aws_appsync_resolver" "notifications" {
@@ -113,6 +112,113 @@ resource "aws_appsync_resolver" "notifications" {
   EOF
 }
 
+################################################################################
+# Subscription registration filters + active-connection invalidation
+################################################################################
+
+resource "aws_appsync_resolver" "subscription_admission" {
+  for_each = local.subscription_scopes
+
+  api_id      = aws_appsync_graphql_api.subscriptions.id
+  type        = "Subscription"
+  field       = each.key
+  data_source = aws_appsync_datasource.none.name
+
+  runtime {
+    name            = "APPSYNC_JS"
+    runtime_version = "1.0.0"
+  }
+
+  code = <<-JS
+    import { util, extensions } from '@aws-appsync/utils';
+
+    export function request() {
+      return { payload: null };
+    }
+
+    export function response(ctx) {
+      const identity = (ctx.identity && ctx.identity.resolverContext) || {};
+      const tenantId = identity.tenantId;
+      const userId = identity.stableUserId;
+      const resourceKind = identity.resourceKind;
+      const resourceId = identity.resourceId;
+      if (!tenantId || !userId || !resourceKind || !resourceId) {
+        util.unauthorized();
+      }
+
+      extensions.setSubscriptionFilter(util.transform.toSubscriptionFilter({
+        ${each.value.argument}: { eq: ctx.args.${each.value.argument} },
+      }));
+      extensions.setSubscriptionInvalidationFilter({
+        filterGroup: [
+          { filters: [
+            { fieldName: 'scope', operator: 'eq', value: 'tenant' },
+            { fieldName: 'tenantId', operator: 'eq', value: tenantId },
+          ]},
+          { filters: [
+            { fieldName: 'scope', operator: 'eq', value: 'user' },
+            { fieldName: 'tenantId', operator: 'eq', value: tenantId },
+            { fieldName: 'userId', operator: 'eq', value: userId },
+          ]},
+          { filters: [
+            { fieldName: 'scope', operator: 'eq', value: 'resource' },
+            { fieldName: 'tenantId', operator: 'eq', value: tenantId },
+            { fieldName: 'userId', operator: 'eq', value: userId },
+            { fieldName: 'resourceKind', operator: 'eq', value: resourceKind },
+            { fieldName: 'resourceId', operator: 'eq', value: resourceId },
+          ]},
+        ],
+      });
+      return null;
+    }
+  JS
+}
+
+resource "aws_appsync_resolver" "subscription_invalidation" {
+  api_id      = aws_appsync_graphql_api.subscriptions.id
+  type        = "Mutation"
+  field       = "invalidateSubscription"
+  data_source = aws_appsync_datasource.none.name
+
+  runtime {
+    name            = "APPSYNC_JS"
+    runtime_version = "1.0.0"
+  }
+
+  code = <<-JS
+    import { util, extensions } from '@aws-appsync/utils';
+
+    const fields = {
+      ON_AGENT_STATUS_CHANGED: 'onAgentStatusChanged',
+      ON_NEW_MESSAGE: 'onNewMessage',
+      ON_HEARTBEAT_ACTIVITY: 'onHeartbeatActivity',
+      ON_THREAD_UPDATED: 'onThreadUpdated',
+      ON_THREAD_ACTIVITY: 'onThreadActivity',
+      ON_INBOX_ITEM_STATUS_CHANGED: 'onInboxItemStatusChanged',
+      ON_THREAD_TURN_UPDATED: 'onThreadTurnUpdated',
+      ON_THREAD_TURN_STEP: 'onThreadTurnStep',
+      ON_ORG_UPDATED: 'onOrgUpdated',
+      ON_COST_RECORDED: 'onCostRecorded',
+      ON_EVAL_RUN_UPDATED: 'onEvalRunUpdated',
+      ON_WORKSPACE_ACCESS_REVOKED: 'onWorkspaceAccessRevoked',
+    };
+
+    export function request(ctx) {
+      return { payload: { ...ctx.args, subscriptionField: fields[ctx.args.subscriptionField] } };
+    }
+
+    export function response(ctx) {
+      const payload = ctx.result;
+      if (!payload.subscriptionField) util.error('Invalid subscription field');
+      extensions.invalidateSubscriptions({
+        subscriptionField: payload.subscriptionField,
+        payload,
+      });
+      return payload;
+    }
+  JS
+}
+
 ################################################################################
 # Custom Domain (optional)
 ################################################################################

package/dist/terraform/modules/app/appsync-subscriptions/outputs.tf

@@ -17,9 +17,3 @@ output "graphql_realtime_url" {
   description = "AppSync realtime WebSocket URL (used by frontend subscription clients)"
   value       = aws_appsync_graphql_api.subscriptions.uris["REALTIME"]
 }
-
-output "graphql_api_key" {
-  description = "AppSync API key"
-  value       = aws_appsync_api_key.main.key
-  sensitive   = true
-}

package/dist/terraform/modules/app/appsync-subscriptions/variables.tf

@@ -8,6 +8,11 @@ variable "region" {
   type        = string
 }
 
+variable "account_id" {
+  description = "AWS account ID hosting the AppSync authorizer Lambda"
+  type        = string
+}
+
 variable "user_pool_id" {
   description = "Cognito user pool ID for authentication"
   type        = string

package/dist/terraform/modules/app/capability-broker/main.tf

@@ -8,7 +8,7 @@
 #
 # THINK-144: this module owns a DEDICATED execute-api interface VPC endpoint
 # with private DNS DISABLED. It is never added to the app VPC's shared
-# okf_wiki_interface_endpoint_services list — that list's private DNS would
+# vpc_interface_endpoint_services set — that list's private DNS would
 # capture every *.execute-api call in the VPC and 403 the stack's public HTTP
 # APIs. The session bootstrap targets this endpoint's own DNS name instead.
 
@@ -188,7 +188,7 @@ resource "aws_lambda_function" "broker" {
 
   vpc_config {
     subnet_ids         = var.subnet_ids
-    security_group_ids = [aws_security_group.broker_lambda[0].id]
+    security_group_ids = distinct(concat([aws_security_group.broker_lambda[0].id], var.additional_security_group_ids))
   }
 
   environment {

package/dist/terraform/modules/app/capability-broker/variables.tf

@@ -96,3 +96,14 @@ variable "log_retention_days" {
   type    = number
   default = 30
 }
+
+# THINK-1082: the broker is already VPC-attached (private subnets, its own
+# egress-only SG) but reaches Aurora through the database SG's world-open
+# 0.0.0.0/0 -> 5432 rule (the cluster's public hostname resolves to the
+# private IP from inside the VPC). Extra SGs let the caller attach the
+# api-lambda SG the database SG admits, so the public rule can close.
+variable "additional_security_group_ids" {
+  description = "Extra security groups appended to the broker Lambda's vpc_config (e.g. the api-lambda SG granted tcp/5432 on the database SG). Default none = unchanged."
+  type        = list(string)
+  default     = []
+}