thinkwork-cli 0.13.2 → 1.0.0

package/dist/drizzle/0261_managed_harness_multiplayer.sql

@@ -1,313 +0,0 @@
--- creates: public.harness_managed_thread_enrollments
--- creates: public.thread_public_events
--- creates: public.harness_participant_sessions
--- creates: public.harness_participant_session_events
--- creates: public.harness_governed_tool_executions
--- creates: public.harness_disclosure_decisions
--- creates-function: public.capture_harness_message_public_event
--- creates-function: public.capture_harness_artifact_public_event
--- creates-trigger: public.messages.trg_capture_harness_message_public_event
--- creates-trigger: public.message_artifacts.trg_capture_harness_artifact_public_event
--- Managed multiplayer Harness proof ledger. Hand-rolled because this migration
--- also installs admission triggers over existing canonical message tables.
-
-CREATE TABLE IF NOT EXISTS public.harness_managed_thread_enrollments (
-  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
-  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
-  thread_id uuid NOT NULL REFERENCES public.threads(id) ON DELETE CASCADE,
-  logical_agent_id uuid NOT NULL REFERENCES public.agents(id),
-  trust_profile text NOT NULL,
-  harness_arn text NOT NULL,
-  qualifier text NOT NULL,
-  resolved_version text NOT NULL,
-  session_strategy text NOT NULL DEFAULT 'fresh'
-    CHECK (session_strategy = 'fresh'),
-  prior_runtime text NOT NULL,
-  status text NOT NULL DEFAULT 'active'
-    CHECK (status IN ('active', 'restoring', 'restored', 'failed')),
-  enrolled_by_user_id uuid NOT NULL REFERENCES public.users(id),
-  created_at timestamptz NOT NULL DEFAULT now(),
-  restored_at timestamptz,
-  UNIQUE (tenant_id, thread_id)
-);
-
-CREATE UNIQUE INDEX IF NOT EXISTS uq_harness_enrollment_active_profile
-  ON public.harness_managed_thread_enrollments (tenant_id, trust_profile)
-  WHERE status = 'active';
-
-CREATE TABLE IF NOT EXISTS public.thread_public_events (
-  id bigserial PRIMARY KEY,
-  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
-  thread_id uuid NOT NULL REFERENCES public.threads(id) ON DELETE CASCADE,
-  source_kind text NOT NULL CHECK (source_kind IN ('message', 'message_artifact')),
-  source_id uuid NOT NULL,
-  source_version text NOT NULL,
-  event_kind text NOT NULL CHECK (event_kind IN ('insert', 'invalidate')),
-  canonical_digest text NOT NULL,
-  created_at timestamptz NOT NULL DEFAULT now(),
-  UNIQUE (tenant_id, thread_id, source_kind, source_id, source_version)
-);
-
-CREATE INDEX IF NOT EXISTS idx_thread_public_events_prefix
-  ON public.thread_public_events (tenant_id, thread_id, id);
-
-CREATE TABLE IF NOT EXISTS public.harness_participant_sessions (
-  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
-  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
-  enrollment_id uuid NOT NULL REFERENCES public.harness_managed_thread_enrollments(id) ON DELETE CASCADE,
-  thread_id uuid NOT NULL REFERENCES public.threads(id) ON DELETE CASCADE,
-  participant_user_id uuid NOT NULL REFERENCES public.users(id),
-  turn_id uuid NOT NULL REFERENCES public.thread_turns(id) ON DELETE CASCADE,
-  runtime_session_id text NOT NULL UNIQUE,
-  generation integer NOT NULL DEFAULT 1 CHECK (generation = 1),
-  captured_high_water bigint NOT NULL,
-  applied_high_water bigint,
-  qualifier text NOT NULL,
-  resolved_version text NOT NULL,
-  base_fingerprint text NOT NULL,
-  participant_fingerprint text NOT NULL,
-  state text NOT NULL DEFAULT 'allocated'
-    CHECK (state IN ('allocated', 'running', 'finalizing', 'completed', 'abandoned')),
-  failure_reason text,
-  created_at timestamptz NOT NULL DEFAULT now(),
-  started_at timestamptz,
-  finished_at timestamptz,
-  UNIQUE (tenant_id, turn_id),
-  CHECK (
-    (state IN ('completed', 'abandoned') AND finished_at IS NOT NULL)
-    OR (state NOT IN ('completed', 'abandoned') AND finished_at IS NULL)
-  )
-);
-
-CREATE INDEX IF NOT EXISTS idx_harness_participant_sessions_thread
-  ON public.harness_participant_sessions
-  (tenant_id, thread_id, participant_user_id, created_at);
-
-CREATE TABLE IF NOT EXISTS public.harness_participant_session_events (
-  id bigserial PRIMARY KEY,
-  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
-  session_id uuid NOT NULL REFERENCES public.harness_participant_sessions(id) ON DELETE CASCADE,
-  turn_id uuid NOT NULL REFERENCES public.thread_turns(id) ON DELETE CASCADE,
-  event_type text NOT NULL,
-  from_state text,
-  to_state text NOT NULL
-    CHECK (to_state IN ('allocated', 'running', 'finalizing', 'completed', 'abandoned')),
-  reason_code text,
-  applied_high_water bigint,
-  evidence jsonb,
-  created_at timestamptz NOT NULL DEFAULT now()
-);
-
-CREATE INDEX IF NOT EXISTS idx_harness_session_events_session
-  ON public.harness_participant_session_events (session_id, id);
-
-CREATE TABLE IF NOT EXISTS public.harness_governed_tool_executions (
-  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
-  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
-  turn_id uuid NOT NULL REFERENCES public.thread_turns(id) ON DELETE CASCADE,
-  participant_user_id uuid NOT NULL REFERENCES public.users(id),
-  session_id uuid NOT NULL REFERENCES public.harness_participant_sessions(id) ON DELETE CASCADE,
-  idempotency_key text NOT NULL,
-  audience text NOT NULL,
-  operation text NOT NULL,
-  tool_use_id text NOT NULL,
-  input_digest text NOT NULL,
-  state text NOT NULL DEFAULT 'claimed'
-    CHECK (state IN ('claimed', 'completed', 'failed', 'ambiguous')),
-  policy_decision_id text,
-  credential_owner_alias text,
-  sanitized_result jsonb,
-  failure_reason text,
-  claimed_at timestamptz NOT NULL DEFAULT now(),
-  completed_at timestamptz,
-  UNIQUE (tenant_id, idempotency_key)
-);
-
-CREATE INDEX IF NOT EXISTS idx_harness_governed_tool_turn
-  ON public.harness_governed_tool_executions (turn_id);
-
-CREATE TABLE IF NOT EXISTS public.harness_disclosure_decisions (
-  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
-  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
-  participant_user_id uuid NOT NULL REFERENCES public.users(id),
-  thread_id uuid NOT NULL REFERENCES public.threads(id) ON DELETE CASCADE,
-  turn_id uuid NOT NULL REFERENCES public.thread_turns(id) ON DELETE CASCADE,
-  session_id uuid NOT NULL REFERENCES public.harness_participant_sessions(id) ON DELETE CASCADE,
-  operation text NOT NULL,
-  projection_digest text NOT NULL,
-  status text NOT NULL
-    CHECK (status IN ('published', 'withheld', 'confirmation_required')),
-  reason_code text NOT NULL,
-  expires_at timestamptz NOT NULL,
-  created_at timestamptz NOT NULL DEFAULT now()
-);
-
-CREATE INDEX IF NOT EXISTS idx_harness_disclosure_turn
-  ON public.harness_disclosure_decisions (turn_id);
-
-CREATE OR REPLACE FUNCTION public.capture_harness_message_public_event()
-RETURNS trigger
-LANGUAGE plpgsql
-AS $$
-DECLARE
-  digest_value text;
-  version_value text;
-  event_value text;
-  admitted_before boolean;
-  admitted_now boolean;
-BEGIN
-  IF TG_OP = 'DELETE' THEN
-    IF NOT EXISTS (
-      SELECT 1 FROM public.thread_public_events e
-      WHERE e.tenant_id = OLD.tenant_id
-        AND e.thread_id = OLD.thread_id
-        AND e.source_kind = 'message'
-        AND e.source_id = OLD.id
-    ) THEN
-      RETURN OLD;
-    END IF;
-    digest_value := encode(digest(concat_ws('|', OLD.role, coalesce(OLD.content, ''), coalesce(OLD.parts::text, ''), coalesce(OLD.metadata::text, '')), 'sha256'), 'hex');
-    version_value := 'delete:' || digest_value;
-    event_value := 'invalidate';
-    INSERT INTO public.thread_public_events (
-      tenant_id, thread_id, source_kind, source_id, source_version,
-      event_kind, canonical_digest
-    ) VALUES (
-      OLD.tenant_id, OLD.thread_id, 'message', OLD.id,
-      version_value, event_value, digest_value
-    ) ON CONFLICT DO NOTHING;
-    RETURN OLD;
-  END IF;
-
-  admitted_now := NEW.role IN ('user', 'assistant')
-    AND coalesce(NEW.metadata->>'visibility', 'public') = 'public'
-    AND coalesce(NEW.metadata->>'disclosure_status', 'published') NOT IN ('withheld', 'confirmation_required')
-    AND EXISTS (
-      SELECT 1 FROM public.harness_managed_thread_enrollments e
-      WHERE e.tenant_id = NEW.tenant_id
-        AND e.thread_id = NEW.thread_id
-        AND e.status = 'active'
-    );
-
-  IF TG_OP = 'UPDATE' THEN
-    admitted_before := EXISTS (
-      SELECT 1 FROM public.thread_public_events e
-      WHERE e.tenant_id = OLD.tenant_id
-        AND e.thread_id = OLD.thread_id
-        AND e.source_kind = 'message'
-        AND e.source_id = OLD.id
-    );
-    IF admitted_before THEN
-      digest_value := encode(digest(concat_ws('|', OLD.role, coalesce(OLD.content, ''), coalesce(OLD.parts::text, ''), coalesce(OLD.metadata::text, '')), 'sha256'), 'hex');
-      version_value := 'invalidate:update:' || encode(digest(concat_ws('|', NEW.role, coalesce(NEW.content, ''), coalesce(NEW.parts::text, ''), coalesce(NEW.metadata::text, '')), 'sha256'), 'hex');
-      INSERT INTO public.thread_public_events (
-        tenant_id, thread_id, source_kind, source_id, source_version,
-        event_kind, canonical_digest
-      ) VALUES (
-        OLD.tenant_id, OLD.thread_id, 'message', OLD.id,
-        version_value, 'invalidate', digest_value
-      ) ON CONFLICT DO NOTHING;
-    END IF;
-  END IF;
-
-  IF NOT admitted_now THEN
-    RETURN NEW;
-  END IF;
-
-  digest_value := encode(digest(concat_ws('|', NEW.role, coalesce(NEW.content, ''), coalesce(NEW.parts::text, '')), 'sha256'), 'hex');
-  version_value := lower(TG_OP) || ':' || digest_value || ':' || encode(digest(coalesce(NEW.metadata::text, ''), 'sha256'), 'hex');
-  INSERT INTO public.thread_public_events (
-    tenant_id, thread_id, source_kind, source_id, source_version,
-    event_kind, canonical_digest
-  ) VALUES (
-    NEW.tenant_id, NEW.thread_id, 'message', NEW.id,
-    version_value, 'insert', digest_value
-  ) ON CONFLICT DO NOTHING;
-  RETURN NEW;
-END;
-$$;
-
-DROP TRIGGER IF EXISTS trg_capture_harness_message_public_event ON public.messages;
-CREATE TRIGGER trg_capture_harness_message_public_event
-AFTER INSERT OR UPDATE OR DELETE ON public.messages
-FOR EACH ROW EXECUTE FUNCTION public.capture_harness_message_public_event();
-
-CREATE OR REPLACE FUNCTION public.capture_harness_artifact_public_event()
-RETURNS trigger
-LANGUAGE plpgsql
-AS $$
-DECLARE
-  digest_value text;
-  version_value text;
-  admitted_before boolean;
-  admitted_now boolean;
-BEGIN
-  IF TG_OP = 'DELETE' THEN
-    IF NOT EXISTS (
-      SELECT 1 FROM public.thread_public_events e
-      WHERE e.tenant_id = OLD.tenant_id
-        AND e.thread_id = OLD.thread_id
-        AND e.source_kind = 'message_artifact'
-        AND e.source_id = OLD.id
-    ) THEN
-      RETURN OLD;
-    END IF;
-    digest_value := encode(digest(concat_ws('|', OLD.artifact_type, coalesce(OLD.name, ''), coalesce(OLD.artifact_id::text, ''), coalesce(OLD.metadata::text, '')), 'sha256'), 'hex');
-    INSERT INTO public.thread_public_events (
-      tenant_id, thread_id, source_kind, source_id, source_version,
-      event_kind, canonical_digest
-    ) VALUES (
-      OLD.tenant_id, OLD.thread_id, 'message_artifact', OLD.id,
-      'delete:' || digest_value, 'invalidate', digest_value
-    ) ON CONFLICT DO NOTHING;
-    RETURN OLD;
-  END IF;
-
-  admitted_now := EXISTS (
-    SELECT 1 FROM public.harness_managed_thread_enrollments e
-    WHERE e.tenant_id = NEW.tenant_id
-      AND e.thread_id = NEW.thread_id
-      AND e.status = 'active'
-  ) AND coalesce(NEW.metadata->>'access_state', 'public') = 'public';
-
-  IF TG_OP = 'UPDATE' THEN
-    admitted_before := EXISTS (
-      SELECT 1 FROM public.thread_public_events e
-      WHERE e.tenant_id = OLD.tenant_id
-        AND e.thread_id = OLD.thread_id
-        AND e.source_kind = 'message_artifact'
-        AND e.source_id = OLD.id
-    );
-    IF admitted_before THEN
-      digest_value := encode(digest(concat_ws('|', OLD.artifact_type, coalesce(OLD.name, ''), coalesce(OLD.artifact_id::text, ''), coalesce(OLD.metadata::text, '')), 'sha256'), 'hex');
-      version_value := 'invalidate:update:' || encode(digest(concat_ws('|', NEW.artifact_type, coalesce(NEW.name, ''), coalesce(NEW.artifact_id::text, ''), coalesce(NEW.metadata::text, '')), 'sha256'), 'hex');
-      INSERT INTO public.thread_public_events (
-        tenant_id, thread_id, source_kind, source_id, source_version,
-        event_kind, canonical_digest
-      ) VALUES (
-        OLD.tenant_id, OLD.thread_id, 'message_artifact', OLD.id,
-        version_value, 'invalidate', digest_value
-      ) ON CONFLICT DO NOTHING;
-    END IF;
-  END IF;
-
-  IF NOT admitted_now THEN
-    RETURN NEW;
-  END IF;
-
-  digest_value := encode(digest(concat_ws('|', NEW.artifact_type, coalesce(NEW.name, ''), coalesce(NEW.artifact_id::text, ''), coalesce(NEW.metadata::text, '')), 'sha256'), 'hex');
-  INSERT INTO public.thread_public_events (
-    tenant_id, thread_id, source_kind, source_id, source_version,
-    event_kind, canonical_digest
-  ) VALUES (
-    NEW.tenant_id, NEW.thread_id, 'message_artifact', NEW.id,
-    lower(TG_OP) || ':' || digest_value, 'insert', digest_value
-  ) ON CONFLICT DO NOTHING;
-  RETURN NEW;
-END;
-$$;
-
-DROP TRIGGER IF EXISTS trg_capture_harness_artifact_public_event ON public.message_artifacts;
-CREATE TRIGGER trg_capture_harness_artifact_public_event
-AFTER INSERT OR UPDATE OR DELETE ON public.message_artifacts
-FOR EACH ROW EXECUTE FUNCTION public.capture_harness_artifact_public_event();

package/dist/drizzle/0262_parallel_harness_threads.sql

@@ -1,9 +0,0 @@
--- creates: public.idx_harness_enrollment_active_profile
--- Allow multiple normal Composer threads to remain pinned to the same
--- tenant/trust-profile Harness while Pi threads continue independently.
-
-DROP INDEX IF EXISTS public.uq_harness_enrollment_active_profile;
-
-CREATE INDEX IF NOT EXISTS idx_harness_enrollment_active_profile
-  ON public.harness_managed_thread_enrollments (tenant_id, trust_profile)
-  WHERE status = 'active';

package/dist/drizzle/0264_harness_tool_execution_ledger.sql

@@ -1,113 +0,0 @@
--- creates: public.harness_tool_execution_events
--- creates: public.idx_harness_tool_execution_turn
--- creates: public.uq_harness_tool_execution_started
--- creates: public.uq_harness_tool_execution_terminal
--- creates-function: public.reject_harness_tool_execution_event_mutation
--- creates-function: public.validate_harness_tool_execution_event_insert
--- creates-trigger: public.harness_tool_execution_events.trg_reject_harness_tool_execution_event_mutation
--- creates-trigger: public.harness_tool_execution_events.trg_validate_harness_tool_execution_event_insert
--- Target-side Harness tool evidence. This is a sanitized append-only event
--- stream, separate from the governed-effect claim/result cache in migration
--- 0261. Targets write before credential resolution and once at terminal state.
-
-CREATE TABLE IF NOT EXISTS public.harness_tool_execution_events (
-  id bigserial PRIMARY KEY,
-  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
-  thread_id uuid NOT NULL REFERENCES public.threads(id) ON DELETE CASCADE,
-  turn_id uuid NOT NULL REFERENCES public.thread_turns(id) ON DELETE CASCADE,
-  principal_type text NOT NULL CHECK (principal_type IN ('user', 'service')),
-  principal_id text NOT NULL,
-  tool_use_id text NOT NULL,
-  operation text NOT NULL,
-  policy_revision text NOT NULL,
-  policy_decision_id text,
-  idempotency_key text NOT NULL,
-  credential_owner_alias text,
-  event_type text NOT NULL
-    CHECK (event_type IN ('started','completed','failed','uncertain')),
-  input_preview jsonb,
-  output_preview jsonb,
-  error_preview jsonb,
-  provider_request_id text,
-  duration_ms integer CHECK (duration_ms IS NULL OR duration_ms >= 0),
-  provider_cost_usd numeric(18,8)
-    CHECK (provider_cost_usd IS NULL OR provider_cost_usd >= 0),
-  created_at timestamptz NOT NULL DEFAULT now(),
-  CHECK (
-    (
-      event_type = 'started'
-      AND input_preview IS NOT NULL
-      AND output_preview IS NULL
-      AND error_preview IS NULL
-      AND provider_request_id IS NULL
-      AND duration_ms IS NULL
-      AND provider_cost_usd IS NULL
-    )
-    OR (
-      event_type IN ('completed','failed','uncertain')
-      AND input_preview IS NULL
-    )
-  )
-);
-
-CREATE UNIQUE INDEX IF NOT EXISTS uq_harness_tool_execution_started
-  ON public.harness_tool_execution_events (tenant_id, idempotency_key)
-  WHERE event_type = 'started';
-
-CREATE UNIQUE INDEX IF NOT EXISTS uq_harness_tool_execution_terminal
-  ON public.harness_tool_execution_events (tenant_id, idempotency_key)
-  WHERE event_type IN ('completed','failed','uncertain');
-
-CREATE INDEX IF NOT EXISTS idx_harness_tool_execution_turn
-  ON public.harness_tool_execution_events (tenant_id, thread_id, turn_id, id);
-
-CREATE OR REPLACE FUNCTION public.validate_harness_tool_execution_event_insert()
-RETURNS trigger
-LANGUAGE plpgsql
-AS $$
-BEGIN
-  IF NEW.event_type = 'started' THEN
-    RETURN NEW;
-  END IF;
-
-  IF NOT EXISTS (
-    SELECT 1
-    FROM public.harness_tool_execution_events started
-    WHERE started.tenant_id = NEW.tenant_id
-      AND started.idempotency_key = NEW.idempotency_key
-      AND started.event_type = 'started'
-      AND started.thread_id = NEW.thread_id
-      AND started.turn_id = NEW.turn_id
-      AND started.principal_type = NEW.principal_type
-      AND started.principal_id = NEW.principal_id
-      AND started.tool_use_id = NEW.tool_use_id
-      AND started.operation = NEW.operation
-      AND started.policy_revision = NEW.policy_revision
-  ) THEN
-    RAISE EXCEPTION 'harness_tool_execution_terminal_without_matching_start';
-  END IF;
-
-  RETURN NEW;
-END;
-$$;
-
-DROP TRIGGER IF EXISTS trg_validate_harness_tool_execution_event_insert
-  ON public.harness_tool_execution_events;
-CREATE TRIGGER trg_validate_harness_tool_execution_event_insert
-BEFORE INSERT ON public.harness_tool_execution_events
-FOR EACH ROW EXECUTE FUNCTION public.validate_harness_tool_execution_event_insert();
-
-CREATE OR REPLACE FUNCTION public.reject_harness_tool_execution_event_mutation()
-RETURNS trigger
-LANGUAGE plpgsql
-AS $$
-BEGIN
-  RAISE EXCEPTION 'harness_tool_execution_events_are_append_only';
-END;
-$$;
-
-DROP TRIGGER IF EXISTS trg_reject_harness_tool_execution_event_mutation
-  ON public.harness_tool_execution_events;
-CREATE TRIGGER trg_reject_harness_tool_execution_event_mutation
-BEFORE UPDATE OR DELETE ON public.harness_tool_execution_events
-FOR EACH ROW EXECUTE FUNCTION public.reject_harness_tool_execution_event_mutation();

package/dist/plugins/company-data/README.md

@@ -1,49 +0,0 @@
-# Company Data Plugin
-
-The Company Data plugin is the package-owned source boundary for the
-first-party operational facts substrate. This slice publishes the stable
-catalog identity and normal ThinkWork install path before any live Company Data
-runtime exists.
-
-The shell intentionally does not deploy extraction runners, projection database
-schema, mapping workflows, schedules, pipelines, MCP servers, skills,
-credentials, datalake, warehouse, query engine, monitoring, analytics UI, BI,
-Context Engine providers, live operator UI, source-system writes, or
-Terraform-managed resources. Future Company Data work should extend this
-`company-data` package and version line with explicit requirements,
-handler-backed components, and deployed verification before introducing runtime
-capability.
-
-## Owned Source
-
-- `src/manifest.ts` declares the catalog manifest with empty OAuth scopes,
-  no capabilities, and one declared-only `ui-surface` component.
-- `test/manifest.test.ts` validates the shell boundary, manifest shape,
-  customer-facing operational facts copy, and deferred-resource language.
-
-## Shell Scope
-
-V1 is deliberately narrow:
-
-- Company Data appears in the first-party plugin catalog as
-  `company-data@0.1.0`.
-- Tenant administrators can install the shell through the normal plugin
-  install flow.
-- The plugin engine records only the install and one no-op UI-surface component
-  with an empty handler reference.
-- Live extraction runtime, projection schema, mapping workflows, schedules,
-  pipelines, MCP servers, skills, credentials, Context Engine providers,
-  analytics UI, BI, lakehouse query UI, source-system writes, and
-  infrastructure are deferred follow-up work.
-
-## Verification Notes
-
-Package-local verification:
-
-```bash
-pnpm --filter @thinkwork/plugin-company-data test
-pnpm --filter @thinkwork/plugin-company-data typecheck
-pnpm --filter @thinkwork/plugin-catalog test
-pnpm --filter @thinkwork/plugin-catalog typecheck
-node scripts/verify-plugin-source-boundary.mjs
-```

package/dist/plugins/company-data/package.json

@@ -1,21 +0,0 @@
-{
-  "name": "@thinkwork/plugin-company-data",
-  "version": "0.0.0",
-  "private": true,
-  "type": "module",
-  "main": "./src/index.ts",
-  "exports": {
-    ".": "./src/index.ts",
-    "./manifest": "./src/manifest.ts"
-  },
-  "scripts": {
-    "build": "tsc --build",
-    "typecheck": "tsc --noEmit",
-    "test": "vitest run"
-  },
-  "devDependencies": {
-    "@thinkwork/plugin-catalog": "workspace:*",
-    "typescript": "^5.5.0",
-    "vitest": "^2.0.0"
-  }
-}

package/dist/plugins/company-data/src/index.ts

@@ -1,30 +0,0 @@
-import { companyDataManifest } from "./manifest";
-
-export const companyDataPluginPackage = {
-  packageKey: "company-data",
-  sourceRoot: "plugins/company-data",
-  manifest: companyDataManifest,
-  ownedSources: [
-    {
-      kind: "manifest",
-      path: "plugins/company-data/src/manifest.ts",
-      description:
-        "Company Data catalog manifest for the shell-only plugin identity.",
-    },
-    {
-      kind: "docs",
-      path: "plugins/company-data/README.md",
-      description:
-        "Company Data package ownership and deferred resource notes.",
-    },
-    {
-      kind: "tests",
-      path: "plugins/company-data/test",
-      description:
-        "Company Data package-local manifest and shell-boundary tests.",
-    },
-  ],
-  compatibilityLinks: [],
-} as const;
-
-export { companyDataManifest };

package/dist/plugins/company-data/src/manifest.ts

@@ -1,26 +0,0 @@
-import type { PluginManifest } from "@thinkwork/plugin-catalog/contracts";
-
-export const COMPANY_DATA_SETTINGS_SURFACE =
-  "settings.plugins.detail.tab" as const;
-
-export const companyDataManifest = {
-  pluginKey: "company-data",
-  displayName: "ThinkWork Data Warehouse",
-  description:
-    "Establishes a governed operational facts substrate for agent and UI reads. Extraction runners, projection databases, Context Engine providers, MCP tools, analytics, BI, and source-system writes belong to later ThinkWork Data Warehouse releases.",
-  versions: [
-    {
-      version: "0.1.0",
-      requiredOauthScopes: [],
-      capabilities: [],
-      components: [
-        {
-          type: "ui-surface",
-          key: "settings",
-          displayName: "ThinkWork Data Warehouse settings",
-          intendedMount: COMPANY_DATA_SETTINGS_SURFACE,
-        },
-      ],
-    },
-  ],
-} satisfies PluginManifest;

package/dist/plugins/company-data/test/manifest.test.ts

@@ -1,116 +0,0 @@
-import { readFileSync } from "node:fs";
-import { fileURLToPath } from "node:url";
-import { describe, expect, it } from "vitest";
-
-import {
-  validatePluginManifest,
-  type PluginComponentType,
-} from "@thinkwork/plugin-catalog/contracts";
-import { defineFirstPartyPluginPackage } from "@thinkwork/plugin-catalog/plugin-package";
-
-import { companyDataPluginPackage } from "../src";
-import {
-  COMPANY_DATA_SETTINGS_SURFACE,
-  companyDataManifest,
-} from "../src/manifest";
-
-describe("ThinkWork Data Warehouse plugin manifest", () => {
-  it("validates as an inert shell plugin", () => {
-    const validated = validatePluginManifest(companyDataManifest);
-
-    expect(validated.pluginKey).toBe("company-data");
-    expect(validated.displayName).toBe("ThinkWork Data Warehouse");
-    expect(validated.versions[0].version).toBe("0.1.0");
-    expect(validated.versions[0].requiredOauthScopes).toEqual([]);
-    expect(validated.versions[0].capabilities).toEqual([]);
-    expect(validated.versions[0].components).toEqual([
-      {
-        type: "ui-surface",
-        key: "settings",
-        displayName: "ThinkWork Data Warehouse settings",
-        intendedMount: COMPANY_DATA_SETTINGS_SURFACE,
-      },
-    ]);
-  });
-
-  it("does not declare side-effecting components, OAuth scopes, or secrets", () => {
-    const version = companyDataManifest.versions[0];
-    const componentTypes = version.components.map(
-      (component) => component.type as PluginComponentType,
-    );
-    const serializedManifest = JSON.stringify(companyDataManifest);
-
-    expect(componentTypes).toEqual(["ui-surface"]);
-    expect(componentTypes).not.toContain("infrastructure");
-    expect(componentTypes).not.toContain("mcp-server");
-    expect(componentTypes).not.toContain("skills");
-    expect(version.requiredOauthScopes).toEqual([]);
-    expect(serializedManifest).not.toMatch(
-      /https?:\/\/|\.invalid|terraform|managedAppKey|endpointUrl|endpointFrom|credential|secret|skillMd/i,
-    );
-  });
-
-  it("keeps customer-facing copy on the governed operational facts scope", () => {
-    const customerFacingText = [
-      companyDataManifest.displayName,
-      companyDataManifest.description,
-      ...companyDataManifest.versions[0].components.map(
-        (component) => component.displayName,
-      ),
-    ].join("\n");
-
-    expect(customerFacingText).toContain("ThinkWork Data Warehouse");
-    expect(customerFacingText).toContain("governed operational facts");
-    expect(customerFacingText).toContain("agent and UI reads");
-    expect(customerFacingText).toContain(
-      "later ThinkWork Data Warehouse releases",
-    );
-    expect(customerFacingText).not.toContain("Company Data");
-    expect(customerFacingText).not.toMatch(
-      /\b(stores?|loads?)\s+every\s+operational\s+row\s+in\s+Company\s+Brain/i,
-    );
-    expect(customerFacingText).not.toMatch(
-      /\b(deploys?|provides?|operates?)\s+(analytics|BI|dashboards?|lakehouse query|ELT jobs?|extraction runners?|projection databases?)/i,
-    );
-    expect(customerFacingText).not.toMatch(
-      /\b(replaces?|mutates?|writes? back to)\s+source systems?/i,
-    );
-  });
-
-  it("defines a first-party package boundary under plugins/company-data", () => {
-    const defined = defineFirstPartyPluginPackage(companyDataPluginPackage);
-
-    expect(defined.packageKey).toBe("company-data");
-    expect(defined.sourceRoot).toBe("plugins/company-data");
-    expect(defined.ownedSources).toContainEqual({
-      kind: "manifest",
-      path: "plugins/company-data/src/manifest.ts",
-      description:
-        "Company Data catalog manifest for the shell-only plugin identity.",
-    });
-    expect(defined.ownedSources).toContainEqual({
-      kind: "tests",
-      path: "plugins/company-data/test",
-      description:
-        "Company Data package-local manifest and shell-boundary tests.",
-    });
-    expect(defined.compatibilityLinks).toEqual([]);
-  });
-
-  it("documents deferred resource deployment for future implementers", () => {
-    const readmePath = fileURLToPath(new URL("../README.md", import.meta.url));
-    const readme = readFileSync(readmePath, "utf8");
-
-    expect(readme).toContain("intentionally does not deploy");
-    expect(readme).toContain("extraction runners");
-    expect(readme).toContain("projection database");
-    expect(readme).toContain("mapping workflows");
-    expect(readme).toContain("MCP");
-    expect(readme).toContain("Context Engine providers");
-    expect(readme).toContain("credentials");
-    expect(readme).toContain("analytics UI");
-    expect(readme).toContain("BI");
-    expect(readme).toContain("source-system writes");
-    expect(readme).toContain("Terraform-managed resources");
-  });
-});