thinkwork-cli 0.13.1 → 1.0.0

package/dist/terraform/modules/thinkwork/outputs.tf

@@ -19,6 +19,10 @@ output "mobile_client_id" {
   value = module.cognito.mobile_client_id
 }
 
+output "console_client_id" {
+  value = module.cognito.console_client_id
+}
+
 output "identity_pool_id" {
   value = module.cognito.identity_pool_id
 }
@@ -28,6 +32,30 @@ output "identity_provider_names" {
   value       = module.cognito.identity_provider_names
 }
 
+output "auth_route_clients" {
+  description = "Safe Cognito app-client manifest for local, Google, Microsoft, and tenant Entra routes."
+  value       = module.cognito.auth_route_clients
+}
+
+output "auth_retirement_phase" {
+  description = "Applied authentication retirement phase used for safe controller upgrades."
+  value       = module.cognito.auth_retirement_phase
+}
+
+output "web_local_client_id" {
+  description = "Local-password-only Cognito app client for web login."
+  value       = module.cognito.web_local_client_id
+}
+
+output "mobile_local_client_id" {
+  description = "Local-password-only Cognito app client for mobile login."
+  value       = module.cognito.mobile_local_client_id
+}
+
+output "microsoft_identity_provider_name" {
+  value = module.cognito.microsoft_identity_provider_name
+}
+
 output "kms_key_arn" {
   value = module.kms.key_arn
 }
@@ -80,10 +108,6 @@ output "aurora_aws_s3_iam_role_arn" {
   value       = module.database.aws_s3_iam_role_arn
 }
 
-output "kb_service_role_arn" {
-  value = module.bedrock_kb.kb_service_role_arn
-}
-
 # App
 output "api_endpoint" {
   value = module.api.api_endpoint
@@ -107,11 +131,6 @@ output "appsync_realtime_url" {
   value = module.appsync.graphql_realtime_url
 }
 
-output "appsync_api_key" {
-  value     = module.appsync.graphql_api_key
-  sensitive = true
-}
-
 output "auth_domain" {
   description = "Cognito hosted UI domain"
   value       = module.cognito.auth_domain
@@ -182,16 +201,6 @@ output "agentcore_memory_id" {
   value       = module.agentcore_memory.memory_id
 }
 
-output "hindsight_enabled" {
-  description = "Whether Hindsight canonical memory is enabled"
-  value       = local.hindsight_enabled
-}
-
-output "hindsight_endpoint" {
-  description = "Hindsight API endpoint (null when enable_hindsight = false)"
-  value       = local.hindsight_enabled ? module.hindsight[0].hindsight_endpoint : null
-}
-
 output "brain_artifacts_bucket_name" {
   description = "Canonical ThinkWork Brain S3 bucket for source artifacts, ingestion manifests, migration snapshots, vault projections, and exports."
   value       = module.api.brain_artifacts_bucket_name
@@ -203,33 +212,23 @@ output "brain_artifacts_bucket_arn" {
 }
 
 output "okf_wiki_efs_enabled" {
-  description = "Whether the OKF Wiki Navigator EFS current-view substrate is provisioned and wired."
-  value       = var.okf_wiki_efs_enabled
+  description = "DEPRECATED (THINK-589): always false — the OKF wiki EFS substrate is no longer wired to any consumer. Removal pending (PR 2)."
+  value       = false
 }
 
 output "okf_wiki_efs_file_system_id" {
-  description = "EFS file system ID for the OKF wiki current view, or null when disabled."
+  description = "DEPRECATED (THINK-589): ID of the orphaned OKF wiki EFS filesystem retained for PR 2's gated delete, or null. No consumer mounts it."
   value       = var.okf_wiki_efs_enabled ? aws_efs_file_system.okf_wiki[0].id : null
 }
 
 output "okf_wiki_refresh_access_point_arn" {
-  description = "EFS access point ARN used by the okf-efs-refresh hydrator, or null when disabled."
-  value       = var.okf_wiki_efs_enabled ? aws_efs_access_point.okf_wiki_refresh[0].arn : null
+  description = "DEPRECATED (THINK-589): always null — the hydrator access point is removed. Removal pending (PR 2)."
+  value       = null
 }
 
 output "okf_wiki_pi_read_access_point_arn" {
-  description = "EFS access point ARN mounted by Pi for read-only OKF wiki traversal, or null when disabled."
-  value       = var.okf_wiki_efs_enabled ? aws_efs_access_point.okf_wiki_pi_read[0].arn : null
-}
-
-output "okf_efs_refresh_fn_name" {
-  description = "OKF EFS refresh Lambda function name."
-  value       = module.api.okf_efs_refresh_fn_name
-}
-
-output "okf_efs_refresh_fn_arn" {
-  description = "OKF EFS refresh Lambda ARN."
-  value       = module.api.okf_efs_refresh_fn_arn
+  description = "DEPRECATED (THINK-589): always null — the Pi read access point is removed. Removal pending (PR 2)."
+  value       = null
 }
 
 output "twenty_provisioned" {
@@ -503,26 +502,10 @@ output "computer_sandbox_url" {
 }
 
 output "computer_sandbox_allowed_parent_origins" {
-  description = "Comma-separated list of trusted parent origins for the iframe-shell, including desktop custom-protocol origins. Mirrors the CSP frame-ancestors directive on the sandbox distribution and is wired into the iframe-shell's __ALLOWED_PARENT_ORIGINS__ Vite define at build time."
+  description = "Comma-separated list of trusted parent origins for the iframe-shell. Mirrors the CSP frame-ancestors directive on the sandbox distribution and is wired into the iframe-shell's __ALLOWED_PARENT_ORIGINS__ Vite define at build time."
   value       = local.computer_sandbox_allowed_parent_origins_effective
 }
 
-# Docs static site
-output "docs_distribution_id" {
-  description = "CloudFront distribution ID for the docs site"
-  value       = module.docs_site.distribution_id
-}
-
-output "docs_distribution_domain" {
-  description = "CloudFront domain for the docs site"
-  value       = module.docs_site.distribution_domain
-}
-
-output "docs_bucket_name" {
-  description = "S3 bucket for docs site assets"
-  value       = module.docs_site.bucket_name
-}
-
 # Public website (www)
 output "www_distribution_id" {
   description = "CloudFront distribution ID for the public website"
@@ -647,15 +630,14 @@ output "capability_private_interpreter_security_group_id" {
   value       = module.capability_broker.capability_private_interpreter_security_group_id
 }
 
-output "analyst_egress_ip" {
-  description = "Stable NAT egress IP of the VPC-attached analyst data-path Lambdas — the address an external database's IP allowlist must admit. Null unless analyst_lambda_vpc_egress is set (and the stack has a NAT gateway)."
-  value       = var.analyst_lambda_vpc_egress ? module.vpc.nat_gateway_public_ip : null
+# AgentCore Harness managed runtime outputs. Rollout-era `*_proof_*` aliases
+# remain below so existing automation can migrate without replacing resources.
+output "agentcore_multiplayer_proof_workload_identity_arn" {
+  description = "Manual proof workload identity ARN used only for U1 Identity verification."
+  value       = module.agentcore_proof_identity.workload_identity_arn
 }
 
-# THINK-311 U4 — AgentCore Harness trial. U5's harness-runner wires this into
-# its handler environment; graphql-http deliberately gets NO new env var (the
-# grouped-env 4KB ceiling, see project_graphql_http_env_4kb_ceiling).
-output "agentcore_harness_execution_role_arn" {
-  description = "Execution role ARN Harness microVMs assume (CreateHarness executionRoleArn). Empty when enable_agentcore_harness is false."
-  value       = module.agentcore_harness.execution_role_arn
+output "agentcore_multiplayer_proof_credential_provider_arn" {
+  description = "Synthetic proof OAuth credential provider ARN."
+  value       = module.agentcore_proof_identity.credential_provider_arn
 }