thinkwork-cli 0.13.2 → 1.0.0

package/dist/terraform/modules/app/agentcore-identity/scripts/bootstrap_twenty_oauth_client.sh

@@ -4,119 +4,236 @@ set -euo pipefail
 : "${AWS_REGION:?AWS_REGION is required}"
 : "${TWENTY_OAUTH_ISSUER:?TWENTY_OAUTH_ISSUER is required}"
 : "${TWENTY_CLIENT_SECRET_ARN:?TWENTY_CLIENT_SECRET_ARN is required}"
-: "${TWENTY_ADMIN_TOKEN_SECRET_ARN:?TWENTY_ADMIN_TOKEN_SECRET_ARN is required}"
-
-callback_url="${TWENTY_CALLBACK_URL:-https://bedrock-agentcore.${AWS_REGION}.amazonaws.com/identities/oauth2/callback}"
-
-if existing_secret="$(aws secretsmanager get-secret-value \
-  --region "$AWS_REGION" \
-  --secret-id "$TWENTY_CLIENT_SECRET_ARN" \
-  --query SecretString \
-  --output text 2>/dev/null)" &&
-  jq -e '.client_id | type == "string" and length > 0' <<<"$existing_secret" >/dev/null &&
-  jq -e '.client_secret | type == "string" and length > 0' <<<"$existing_secret" >/dev/null; then
-  existing_callback="$(jq -r '.redirect_uris[0] // empty' <<<"$existing_secret")"
-  if [[ "$existing_callback" == "$callback_url" ]]; then
-    printf 'Twenty confidential OAuth client already bootstrapped: secret=%s\n' \
-      "$TWENTY_CLIENT_SECRET_ARN"
-    exit 0
+: "${TWENTY_CREDENTIAL_PROVIDER_NAME:?TWENTY_CREDENTIAL_PROVIDER_NAME is required}"
+
+script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+issuer="${TWENTY_OAUTH_ISSUER%/}"
+
+read_client_record() {
+  aws secretsmanager get-secret-value \
+    --region "$AWS_REGION" \
+    --secret-id "$TWENTY_CLIENT_SECRET_ARN" \
+    --query SecretString \
+    --output text 2>/dev/null || printf '{}'
+}
+
+write_client_record() {
+  aws secretsmanager put-secret-value \
+    --region "$AWS_REGION" \
+    --secret-id "$TWENTY_CLIENT_SECRET_ARN" \
+    --secret-string file:///dev/stdin >/dev/null
+}
+
+# Twenty's authorize endpoint is "$issuer/authorize" (NOT /oauth/authorize —
+# observed live on tei-e2e: the previously hard-coded path 404s). Fetch the
+# issuer's discovery document once and take both provider endpoints from it,
+# falling back to the documented paths when discovery is unavailable.
+discovery="$(curl --silent --fail --max-time 15 \
+  "$issuer/.well-known/oauth-authorization-server" 2>/dev/null || printf '')"
+provider_endpoint() {
+  local field="$1" fallback="$2"
+  local discovered
+  discovered="$(jq -r --arg f "$field" '.[$f] // empty' <<<"$discovery" 2>/dev/null)"
+  if [[ -n "$discovered" ]]; then
+    printf '%s' "$discovered"
+  else
+    printf '%s' "$fallback"
   fi
-fi
+}
 
-# Twenty's RFC 7591 endpoint intentionally downgrades all dynamic clients to
-# public clients. Its authenticated metadata API is the supported path for a
-# confidential application registration: Twenty generates and bcrypt-hashes
-# the secret server-side and returns the plaintext exactly once.
-admin_record="$(aws secretsmanager get-secret-value \
-  --region "$AWS_REGION" \
-  --secret-id "$TWENTY_ADMIN_TOKEN_SECRET_ARN" \
-  --query SecretString \
-  --output text)"
-admin_token="$(jq -r '.access_token // empty' <<<"$admin_record")"
-if [[ -z "$admin_token" ]]; then
-  printf '%s\n' 'Twenty administrator token secret has no access_token' >&2
+reconcile_provider() {
+  local client_id="$1"
+  local runtime_script="$script_dir/reconcile_twenty_provider.mjs"
+  if [[ -n "${THINKWORK_AGENTCORE_CONTROL_RUNTIME_DIR:-}" ]]; then
+    runtime_script="$THINKWORK_AGENTCORE_CONTROL_RUNTIME_DIR/reconcile_twenty_provider.js"
+    if [[ ! -f "$runtime_script" ]]; then
+      printf '%s\n' 'Managed AgentCore control runtime is missing reconcile_twenty_provider.js' >&2
+      return 66
+    fi
+  fi
+  jq -n \
+    --arg region "$AWS_REGION" \
+    --arg name "$TWENTY_CREDENTIAL_PROVIDER_NAME" \
+    --arg issuer "$issuer" \
+    --arg authorizationEndpoint "$(provider_endpoint authorization_endpoint "$issuer/authorize")" \
+    --arg tokenEndpoint "$(provider_endpoint token_endpoint "$issuer/oauth/token")" \
+    --arg clientId "$client_id" \
+    --arg secretArn "$TWENTY_CLIENT_SECRET_ARN" \
+    '{
+      region: $region,
+      name: $name,
+      issuer: $issuer,
+      authorizationEndpoint: $authorizationEndpoint,
+      tokenEndpoint: $tokenEndpoint,
+      clientId: $clientId,
+      secretArn: $secretArn
+    }' | node "$runtime_script"
+}
+
+verify_provider() {
+  local response="$1"
+  local expected_client_id="$2"
+  local expected_callback="$3"
+  jq -e \
+    --arg name "$TWENTY_CREDENTIAL_PROVIDER_NAME" \
+    --arg client_id "$expected_client_id" \
+    --arg callback "$expected_callback" \
+    --arg secret_arn "$TWENTY_CLIENT_SECRET_ARN" \
+    '.name == $name and
+     .clientId == $client_id and
+     .callbackUrl == $callback and
+     .clientSecretArn == $secret_arn and
+     .clientSecretJsonKey == "client_secret" and
+     .clientSecretSource == "EXTERNAL" and
+     .status == "READY"' <<<"$response" >/dev/null
+}
+
+client_record="$(read_client_record)"
+if ! jq -e 'type == "object"' <<<"$client_record" >/dev/null 2>&1; then
+  printf '%s\n' 'Twenty client secret must contain a JSON object' >&2
   exit 1
 fi
 
-if [[ -n "${existing_secret:-}" ]] &&
-  jq -e '.registration_id | type == "string" and length > 0' \
-    <<<"$existing_secret" >/dev/null; then
-  registration_id="$(jq -r '.registration_id' <<<"$existing_secret")"
-  update_payload="$(jq -n \
-    --arg id "$registration_id" \
-    --arg callback "$callback_url" \
+client_id="$(jq -r '.client_id // empty' <<<"$client_record")"
+client_secret_ready=false
+if [[ -n "$client_id" ]] &&
+  jq -e '.client_secret | type == "string" and length > 0' \
+    <<<"$client_record" >/dev/null 2>&1 &&
+  [[ "$(jq -r '.bootstrap_state // empty' <<<"$client_record")" == "ready" ]]; then
+  client_secret_ready=true
+else
+  placeholder_id="thinkwork-bootstrap-$(openssl rand -hex 12)"
+  placeholder_secret="$(openssl rand -base64 48 | tr -d '\n')"
+  client_record="$(jq -n \
+    --arg client_id "$placeholder_id" \
+    --arg client_secret "$placeholder_secret" \
     '{
-      query: "mutation UpdateAgentCoreRegistration($input: UpdateApplicationRegistrationInput!) { updateApplicationRegistration(input: $input) { id oAuthRedirectUris oAuthScopes } }",
-      variables: {
-        input: {
-          id: $id,
-          update: {oAuthRedirectUris: [$callback]}
-        }
-      }
+      bootstrap_state: "placeholder",
+      client_id: $client_id,
+      client_secret: $client_secret,
+      token_endpoint_auth_method: "client_secret_post"
     }')"
-  update_response="$(curl --silent --show-error --fail-with-body \
-    -H "authorization: Bearer $admin_token" \
-    -H 'content-type: application/json' \
-    --data-binary "$update_payload" \
-    "${TWENTY_OAUTH_ISSUER%/}/metadata")"
-  if jq -e '.errors | type == "array" and length > 0' <<<"$update_response" >/dev/null; then
-    jq '{errors: [.errors[] | {message, extensions: {code: .extensions.code}}]}' \
-      <<<"$update_response" >&2
-    printf '%s\n' 'Twenty OAuth callback update failed' >&2
-    exit 1
-  fi
-  updated_secret="$(jq --arg callback "$callback_url" \
-    '.redirect_uris = [$callback]' <<<"$existing_secret")"
-  printf '%s' "$updated_secret" | aws secretsmanager put-secret-value \
-    --region "$AWS_REGION" \
-    --secret-id "$TWENTY_CLIENT_SECRET_ARN" \
-    --secret-string file:///dev/stdin >/dev/null
-  printf 'Twenty confidential OAuth client callback updated: secret=%s callback=%s\n' \
-    "$TWENTY_CLIENT_SECRET_ARN" "$callback_url"
+  printf '%s' "$client_record" | write_client_record
+  client_id="$placeholder_id"
+fi
+
+# AgentCore issues a provider-specific callback only after the provider exists.
+# The placeholder is never used for a user grant; it only lets AgentCore return
+# the callback that Twenty must bind to the confidential client registration.
+provider_response="$(reconcile_provider "$client_id")"
+callback_url="$(jq -r '.callbackUrl // empty' <<<"$provider_response")"
+if [[ -z "$callback_url" ]]; then
+  printf '%s\n' 'AgentCore Identity did not return a provider callback URL' >&2
+  exit 1
+fi
+
+registered_callback_matches=false
+if $client_secret_ready &&
+  jq -e --arg callback "$callback_url" \
+    '.redirect_uris | type == "array" and index($callback) != null' \
+    <<<"$client_record" >/dev/null 2>&1 &&
+  [[ "$(jq -r '.token_endpoint_auth_method // empty' <<<"$client_record")" == \
+    "client_secret_post" ]]; then
+  registered_callback_matches=true
+fi
+
+if $registered_callback_matches; then
+  verify_provider "$provider_response" "$client_id" "$callback_url"
+  printf 'Twenty confidential OAuth client reused: provider=%s callback=%s\n' \
+    "$TWENTY_CREDENTIAL_PROVIDER_NAME" "$callback_url" >&2
+  printf '%s' "$provider_response"
   exit 0
 fi
 
-graphql_payload="$(jq -n \
+if [[ -z "$discovery" ]]; then
+  printf '%s\n' 'Twenty discovery document is unavailable' >&2
+  exit 1
+fi
+registration_endpoint="$(jq -r '.registration_endpoint // empty' <<<"$discovery")"
+if ! python3 - "$issuer" "$registration_endpoint" <<'PY'
+import sys
+from urllib.parse import urlsplit
+
+
+def origin(url: str) -> tuple[str, str, int]:
+    parsed = urlsplit(url)
+    if parsed.scheme != "https" or not parsed.hostname or parsed.username or parsed.password:
+        raise ValueError("HTTPS origin without userinfo required")
+    return parsed.scheme, parsed.hostname.lower(), parsed.port or 443
+
+
+try:
+    issuer_origin = origin(sys.argv[1])
+    registration_origin = origin(sys.argv[2])
+except (ValueError, IndexError):
+    raise SystemExit(1)
+raise SystemExit(0 if issuer_origin == registration_origin else 1)
+PY
+then
+  printf '%s\n' 'Twenty registration endpoint is not on the exact issuer origin' >&2
+  exit 1
+fi
+if ! jq -e \
+    --arg issuer "$issuer" \
+    '.issuer == $issuer and
+     (.grant_types_supported | index("authorization_code") != null) and
+     (.token_endpoint_auth_methods_supported | index("client_secret_post") != null) and
+     (.scopes_supported | index("api") != null) and
+     (.scopes_supported | index("profile") != null)' \
+    <<<"$discovery" >/dev/null; then
+  printf '%s\n' \
+    'Twenty discovery does not advertise same-origin confidential authorization-code DCR' >&2
+  exit 1
+fi
+
+registration_payload="$(jq -n \
   --arg callback "$callback_url" \
   '{
-    query: "mutation CreateAgentCoreRegistration($input: CreateApplicationRegistrationInput!) { createApplicationRegistration(input: $input) { applicationRegistration { id universalIdentifier oAuthClientId oAuthRedirectUris oAuthScopes } clientSecret } }",
-    variables: {
-      input: {
-        name: "ThinkWork AgentCore Identity Twenty CRM",
-        oAuthRedirectUris: [$callback],
-        oAuthScopes: ["api", "profile"]
-      }
-    }
+    client_name: "ThinkWork AgentCore Identity Twenty CRM",
+    redirect_uris: [$callback],
+    grant_types: ["authorization_code"],
+    response_types: ["code"],
+    token_endpoint_auth_method: "client_secret_post",
+    scope: "api profile"
   }')"
-graphql_response="$(curl --silent --show-error --fail-with-body \
-  -H "authorization: Bearer $admin_token" \
+registration_response="$(curl --silent --show-error --fail-with-body \
   -H 'content-type: application/json' \
-  --data-binary "$graphql_payload" \
-  "${TWENTY_OAUTH_ISSUER%/}/metadata")"
+  --data-binary "$registration_payload" \
+  "$registration_endpoint")"
 
-if jq -e '.errors | type == "array" and length > 0' <<<"$graphql_response" >/dev/null; then
-  jq '{errors: [.errors[] | {message, extensions: {code: .extensions.code}}]}' \
-    <<<"$graphql_response" >&2
-  printf '%s\n' 'Twenty confidential OAuth client bootstrap failed' >&2
+client_record="$(jq -e \
+  --arg callback "$callback_url" \
+  '{
+    bootstrap_state: "ready",
+    client_id: .client_id,
+    client_secret: .client_secret,
+    client_id_issued_at: .client_id_issued_at,
+    client_secret_expires_at: .client_secret_expires_at,
+    client_name: .client_name,
+    redirect_uris: .redirect_uris,
+    grant_types: .grant_types,
+    response_types: .response_types,
+    token_endpoint_auth_method: .token_endpoint_auth_method,
+    scope: (.scope // "api profile"),
+    registration_access_token: .registration_access_token,
+    registration_client_uri: .registration_client_uri
+  } | select(
+    (.client_id | type == "string" and length > 0) and
+    (.client_secret | type == "string" and length > 0) and
+    (.redirect_uris | type == "array" and index($callback) != null) and
+    .token_endpoint_auth_method == "client_secret_post"
+  )' <<<"$registration_response")" || {
+  printf '%s\n' 'Twenty DCR did not return a confidential callback-bound client' >&2
   exit 1
-fi
+}
+
+# A Secrets Manager version write is atomic. The plaintext client secret never
+# enters Terraform state or process arguments and is not printed to logs.
+printf '%s' "$client_record" | write_client_record
+client_id="$(jq -r '.client_id' <<<"$client_record")"
+provider_response="$(reconcile_provider "$client_id")"
+verify_provider "$provider_response" "$client_id" "$callback_url"
 
-client_record="$(jq -e '{
-  client_id: .data.createApplicationRegistration.applicationRegistration.oAuthClientId,
-  client_secret: .data.createApplicationRegistration.clientSecret,
-  registration_id: .data.createApplicationRegistration.applicationRegistration.id,
-  universal_identifier: .data.createApplicationRegistration.applicationRegistration.universalIdentifier,
-  redirect_uris: .data.createApplicationRegistration.applicationRegistration.oAuthRedirectUris,
-  scopes: .data.createApplicationRegistration.applicationRegistration.oAuthScopes
-} | select(
-  (.client_id | type == "string" and length > 0) and
-  (.client_secret | type == "string" and length > 0)
-)' <<<"$graphql_response")"
-
-printf '%s' "$client_record" | aws secretsmanager put-secret-value \
-  --region "$AWS_REGION" \
-  --secret-id "$TWENTY_CLIENT_SECRET_ARN" \
-  --secret-string file:///dev/stdin >/dev/null
-
-printf 'Twenty confidential OAuth client bootstrapped: secret=%s callback=%s\n' \
-  "$TWENTY_CLIENT_SECRET_ARN" "$callback_url"
+printf 'Twenty confidential OAuth client registered: provider=%s callback=%s\n' \
+  "$TWENTY_CREDENTIAL_PROVIDER_NAME" "$callback_url" >&2
+printf '%s' "$provider_response"

package/dist/terraform/modules/app/agentcore-identity/scripts/delete_identity.sh

@@ -13,13 +13,10 @@ if aws bedrock-agentcore-control get-oauth2-credential-provider \
     --name "$CREDENTIAL_PROVIDER_NAME" >/dev/null
 fi
 
-if aws bedrock-agentcore-control get-workload-identity \
-  --region "$AWS_REGION" \
-  --name "$WORKLOAD_IDENTITY_NAME" >/dev/null 2>&1; then
-  aws bedrock-agentcore-control delete-workload-identity \
-    --region "$AWS_REGION" \
-    --name "$WORKLOAD_IDENTITY_NAME" >/dev/null
-fi
-
-printf 'AgentCore Identity proof resources deleted: workload=%s provider=%s\n' \
+# THINK-324: the workload identity is SHARED with the live Twenty connector
+# (per-user grants live under it). Its deletion is owned by
+# workload_identity_cleanup_owner / delete_workload_identity.sh — retiring
+# the proof plane must never delete it. See main.tf for the proof-only-stage
+# leak trade-off.
+printf 'AgentCore Identity proof provider deleted (workload identity retained): workload=%s provider=%s\n' \
   "$WORKLOAD_IDENTITY_NAME" "$CREDENTIAL_PROVIDER_NAME"

package/dist/terraform/modules/app/agentcore-identity/scripts/delete_workload_identity.sh

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# THINK-324 — final deletion of the SHARED workload identity, owned by the
+# Twenty identity half (workload_identity_cleanup_owner). Runs only when the
+# Twenty user-federation identity is itself being removed.
+
+: "${AWS_REGION:?AWS_REGION is required}"
+: "${WORKLOAD_IDENTITY_NAME:?WORKLOAD_IDENTITY_NAME is required}"
+
+if aws bedrock-agentcore-control get-workload-identity \
+  --region "$AWS_REGION" \
+  --name "$WORKLOAD_IDENTITY_NAME" >/dev/null 2>&1; then
+  aws bedrock-agentcore-control delete-workload-identity \
+    --region "$AWS_REGION" \
+    --name "$WORKLOAD_IDENTITY_NAME" >/dev/null
+fi
+
+printf 'AgentCore workload identity deleted: %s\n' "$WORKLOAD_IDENTITY_NAME"

package/dist/terraform/modules/app/agentcore-identity/scripts/ensure_workload_identity.sh

@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# THINK-324 — Twenty-side workload-identity guarantee. Create-if-missing
+# ONLY: when the identity already exists (created by the proof lifecycle or a
+# prior run) this script must not touch it — reconcile_twenty_identity.sh
+# owns the return-url allowlist and always runs afterwards.
+
+: "${AWS_REGION:?AWS_REGION is required}"
+: "${WORKLOAD_IDENTITY_NAME:?WORKLOAD_IDENTITY_NAME is required}"
+: "${OAUTH_RETURN_URLS_JSON:?OAUTH_RETURN_URLS_JSON is required}"
+
+jq -e 'type == "array" and length > 0 and all(.[]; type == "string" and length > 0)' \
+  <<<"$OAUTH_RETURN_URLS_JSON" >/dev/null
+
+if aws bedrock-agentcore-control get-workload-identity \
+  --region "$AWS_REGION" \
+  --name "$WORKLOAD_IDENTITY_NAME" >/dev/null 2>&1; then
+  printf 'AgentCore workload identity already present: %s\n' "$WORKLOAD_IDENTITY_NAME"
+  exit 0
+fi
+
+aws bedrock-agentcore-control create-workload-identity \
+  --region "$AWS_REGION" \
+  --name "$WORKLOAD_IDENTITY_NAME" \
+  --allowed-resource-oauth2-return-urls "$OAUTH_RETURN_URLS_JSON" \
+  --tags '{"purpose":"twenty-user-federation","managed-by":"terraform"}' >/dev/null
+
+printf 'AgentCore workload identity created: %s\n' "$WORKLOAD_IDENTITY_NAME"

package/dist/terraform/modules/app/agentcore-identity/scripts/read_identity.sh

@@ -6,19 +6,32 @@ region="$(jq -r '.region // empty' <<<"$input")"
 workload_name="$(jq -r '.workload_identity_name // empty' <<<"$input")"
 provider_name="$(jq -r '.credential_provider_name // empty' <<<"$input")"
 twenty_provider_name="$(jq -r '.twenty_credential_provider_name // empty' <<<"$input")"
-if [[ -z "$region" || -z "$workload_name" || -z "$provider_name" || -z "$twenty_provider_name" ]]; then
-  printf '%s\n' '{"error":"region and identity names are required"}' >&2
+# THINK-324: an empty provider name means that half is disabled (proof
+# retired, or Twenty absent on a proof-only stage) — skip its reads and
+# return empty fields instead of failing.
+if [[ -z "$region" || -z "$workload_name" ]]; then
+  printf '%s\n' '{"error":"region and workload_identity_name are required"}' >&2
   exit 1
 fi
 
 workload_json="$(aws bedrock-agentcore-control get-workload-identity \
   --region "$region" --name "$workload_name" --output json)"
-provider_json="$(aws bedrock-agentcore-control get-oauth2-credential-provider \
-  --region "$region" --name "$provider_name" --output json)"
-twenty_provider_json="$(aws bedrock-agentcore-control get-oauth2-credential-provider \
-  --region "$region" --name "$twenty_provider_name" --output json)"
+
+provider_json='{}'
+if [[ -n "$provider_name" ]]; then
+  provider_json="$(aws bedrock-agentcore-control get-oauth2-credential-provider \
+    --region "$region" --name "$provider_name" --output json)"
+fi
+
+twenty_provider_json='{}'
+if [[ -n "$twenty_provider_name" ]]; then
+  twenty_provider_json="$(aws bedrock-agentcore-control get-oauth2-credential-provider \
+    --region "$region" --name "$twenty_provider_name" --output json)"
+fi
 
 jq -n \
+  --arg proof_enabled "$provider_name" \
+  --arg twenty_enabled "$twenty_provider_name" \
   --arg workload_identity_arn "$(jq -r '.workloadIdentityArn // empty' <<<"$workload_json")" \
   --arg credential_provider_arn "$(jq -r '.credentialProviderArn // empty' <<<"$provider_json")" \
   --arg credential_secret_arn "$(jq -r '
@@ -29,7 +42,9 @@ jq -n \
   ' <<<"$provider_json")" \
   --arg twenty_credential_provider_arn "$(jq -r '.credentialProviderArn // empty' <<<"$twenty_provider_json")" \
   --arg twenty_oauth_callback_url "$(jq -r '.callbackUrl // empty' <<<"$twenty_provider_json")" \
-  'if ($workload_identity_arn == "" or $credential_provider_arn == "" or $credential_secret_arn == "" or $twenty_credential_provider_arn == "" or $twenty_oauth_callback_url == "")
+  'if ($workload_identity_arn == ""
+       or ($proof_enabled != "" and ($credential_provider_arn == "" or $credential_secret_arn == ""))
+       or ($twenty_enabled != "" and ($twenty_credential_provider_arn == "" or $twenty_oauth_callback_url == "")))
    then error("AgentCore Identity readback omitted required ARNs")
    else {
      workload_identity_arn: $workload_identity_arn,

package/dist/terraform/modules/app/agentcore-identity/scripts/reconcile_twenty_identity.sh

@@ -19,56 +19,27 @@ aws bedrock-agentcore-control update-workload-identity \
   --name "$WORKLOAD_IDENTITY_NAME" \
   --allowed-resource-oauth2-return-urls "$OAUTH_RETURN_URLS_JSON" >/dev/null
 
-client_record="$(aws secretsmanager get-secret-value \
-  --region "$AWS_REGION" \
-  --secret-id "$TWENTY_CLIENT_SECRET_ARN" \
-  --query SecretString \
-  --output text 2>/dev/null || true)"
-if [[ -z "$client_record" ]]; then
-  client_record='{}'
-fi
-client_id="$(jq -r '.client_id // empty' <<<"$client_record")"
-if [[ -z "$client_id" ]] ||
-  ! jq -e '.client_secret | type == "string" and length > 0' \
-    <<<"$client_record" >/dev/null 2>&1; then
-  printf '%s\n' \
-    'Twenty confidential client is not bootstrapped; run bootstrap_twenty_oauth_client.sh with an authenticated administrator token secret' >&2
-  exit 1
-fi
-
-provider_payload="$(jq -n \
-  --arg region "$AWS_REGION" \
-  --arg name "$TWENTY_CREDENTIAL_PROVIDER_NAME" \
-  --arg issuer "$TWENTY_OAUTH_ISSUER" \
-  --arg authorizationEndpoint "${TWENTY_OAUTH_ISSUER%/}/authorize" \
-  --arg tokenEndpoint "${TWENTY_OAUTH_ISSUER%/}/oauth/token" \
-  --arg clientId "$client_id" \
-  --arg secretArn "$TWENTY_CLIENT_SECRET_ARN" \
-  '{
-    region: $region,
-    name: $name,
-    issuer: $issuer,
-    authorizationEndpoint: $authorizationEndpoint,
-    tokenEndpoint: $tokenEndpoint,
-    clientId: $clientId,
-    secretArn: $secretArn
-  }')"
-
 script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-provider_response="$(printf '%s' "$provider_payload" | \
-  node "$script_dir/reconcile_twenty_provider.mjs")"
+provider_response="$(bash "$script_dir/bootstrap_twenty_oauth_client.sh")"
 callback_url="$(jq -r '.callbackUrl // empty' <<<"$provider_response")"
 if [[ -z "$callback_url" || "$callback_url" == "None" ]]; then
   printf '%s\n' 'AgentCore Identity did not return the Twenty callback URL' >&2
   exit 1
 fi
 
-registered_callback="$(jq -r '.redirect_uris[0] // empty' <<<"$client_record")"
-if [[ "$registered_callback" != "$callback_url" ]]; then
-  printf 'Twenty callback mismatch: registered=%s agentcore=%s\n' \
-    "$registered_callback" "$callback_url" >&2
-  exit 1
-fi
-
-printf 'AgentCore Twenty provider reconciled: workload=%s provider=%s resource=%s\n' \
-  "$WORKLOAD_IDENTITY_NAME" "$TWENTY_CREDENTIAL_PROVIDER_NAME" "$TWENTY_OAUTH_RESOURCE"
+client_record="$(aws secretsmanager get-secret-value \
+  --region "$AWS_REGION" \
+  --secret-id "$TWENTY_CLIENT_SECRET_ARN" \
+  --query SecretString \
+  --output text)"
+jq -e --arg callback "$callback_url" \
+  '.bootstrap_state == "ready" and
+   (.client_id | type == "string" and length > 0) and
+   (.client_secret | type == "string" and length > 0) and
+   (.redirect_uris | type == "array" and index($callback) != null) and
+   .token_endpoint_auth_method == "client_secret_post"' \
+  <<<"$client_record" >/dev/null
+
+printf 'AgentCore Twenty provider reconciled: workload=%s provider=%s resource=%s callback=%s\n' \
+  "$WORKLOAD_IDENTITY_NAME" "$TWENTY_CREDENTIAL_PROVIDER_NAME" \
+  "$TWENTY_OAUTH_RESOURCE" "$callback_url"

package/dist/terraform/modules/app/agentcore-identity/scripts/reconcile_twenty_provider.mjs

@@ -8,6 +8,20 @@ import {
   UpdateOauth2CredentialProviderCommand,
 } from "@aws-sdk/client-bedrock-agentcore-control";
 
+if (process.argv[2] === "--runtime-preflight") {
+  process.stdout.write(
+    JSON.stringify({
+      entrypoint: "reconcile_twenty_provider",
+      sdkImportReady:
+        typeof BedrockAgentCoreControlClient === "function" &&
+        typeof CreateOauth2CredentialProviderCommand === "function" &&
+        typeof GetOauth2CredentialProviderCommand === "function" &&
+        typeof UpdateOauth2CredentialProviderCommand === "function",
+    }),
+  );
+  process.exit(0);
+}
+
 const chunks = [];
 for await (const chunk of process.stdin) chunks.push(chunk);
 const input = JSON.parse(Buffer.concat(chunks).toString("utf8"));
@@ -47,15 +61,63 @@ try {
   if (!(error instanceof ResourceNotFoundException)) throw error;
 }
 
-const response = exists
-  ? await client.send(new UpdateOauth2CredentialProviderCommand(providerInput))
-  : await client.send(new CreateOauth2CredentialProviderCommand(providerInput));
+if (exists) {
+  await client.send(new UpdateOauth2CredentialProviderCommand(providerInput));
+} else {
+  await client.send(new CreateOauth2CredentialProviderCommand(providerInput));
+}
+
+const sleep = (milliseconds) =>
+  new Promise((resolve) => setTimeout(resolve, milliseconds));
+
+let response;
+for (let attempt = 0; attempt < 30; attempt += 1) {
+  response = await client.send(
+    new GetOauth2CredentialProviderCommand({ name: input.name }),
+  );
+  const status = response.status;
+  const provider =
+    response.oauth2ProviderConfigOutput?.customOauth2ProviderConfig;
+  const secretArn =
+    typeof response.clientSecretArn === "string"
+      ? response.clientSecretArn
+      : response.clientSecretArn?.secretArn;
+  const ready =
+    response.callbackUrl &&
+    response.credentialProviderArn &&
+    provider?.clientId === input.clientId &&
+    secretArn === input.secretArn &&
+    response.clientSecretJsonKey === "client_secret" &&
+    response.clientSecretSource === "EXTERNAL" &&
+    status === "READY";
+  if (ready) break;
+  if (status?.endsWith("_FAILED")) {
+    throw new Error(`AgentCore OAuth provider ${input.name} entered ${status}`);
+  }
+  if (attempt === 29) {
+    throw new Error(
+      `AgentCore OAuth provider ${input.name} did not converge to the requested client and external secret`,
+    );
+  }
+  await sleep(2000);
+}
+
+const secretArn =
+  typeof response.clientSecretArn === "string"
+    ? response.clientSecretArn
+    : response.clientSecretArn?.secretArn;
+const provider =
+  response.oauth2ProviderConfigOutput?.customOauth2ProviderConfig;
 
 process.stdout.write(
   JSON.stringify({
     name: response.name,
     callbackUrl: response.callbackUrl,
     credentialProviderArn: response.credentialProviderArn,
+    clientId: provider?.clientId,
+    clientSecretArn: secretArn,
+    clientSecretJsonKey: response.clientSecretJsonKey,
     clientSecretSource: response.clientSecretSource,
+    status: response.status,
   }),
 );

package/dist/terraform/modules/app/agentcore-identity/tests/tainted-marker/after.tf

@@ -0,0 +1,15 @@
+terraform {
+  required_version = "= 1.8.5"
+}
+
+removed {
+  from = module.thinkwork.module.agentcore_proof_identity.terraform_data.twenty_identity_lifecycle
+
+  lifecycle {
+    destroy = false
+  }
+}
+
+module "thinkwork" {
+  source = "./thinkwork"
+}

package/dist/terraform/modules/app/agentcore-identity/tests/tainted-marker/before.tf

@@ -0,0 +1,7 @@
+terraform {
+  required_version = "= 1.8.5"
+}
+
+module "thinkwork" {
+  source = "./thinkwork"
+}