thinkwork-cli 0.13.2 → 1.0.0

package/dist/commands/enterprise/templates/deploy-repo/scripts/apply-release.mjs

@@ -658,7 +658,6 @@ function terraformOutputs(terraformDir) {
     "app_url",
     "admin_url",
     "computer_url",
-    "docs_url",
     "ecr_repository_url",
   ];
   return Object.fromEntries(

package/dist/commands/enterprise/templates/deploy-repo/scripts/smoke.mjs

@@ -13,7 +13,6 @@ try {
   const targets = [
     ["api_endpoint", "api"],
     ["app_url", "web"],
-    ["docs_url", "docs"],
   ]
     .map(([output, name]) => ({
       name,

package/dist/commands/enterprise/templates/deploy-repo/terraform/main.tf

@@ -64,18 +64,6 @@ variable "database_engine" {
   default     = "aurora-serverless"
 }
 
-variable "enable_hindsight" {
-  description = "Enable Hindsight canonical user and Space memory. Full ThinkWork installs default this on; set false only for explicit low-cost/development AgentCore-only deployments."
-  type        = bool
-  default     = true
-}
-
-variable "memory_engine" {
-  description = "Active long-term memory engine. Empty selects Hindsight when enable_hindsight = true. Use 'agentcore' only for explicit low-cost/development managed-memory deployments."
-  type        = string
-  default     = ""
-}
-
 variable "twenty_provisioned" {
   description = "Provision the retained Twenty CRM managed-app substrate. Runtime can be parked independently with twenty_runtime_enabled."
   type        = bool
@@ -164,8 +152,6 @@ module "thinkwork" {
   db_password     = var.db_password
   api_auth_secret = var.api_auth_secret
 
-  enable_hindsight                           = var.enable_hindsight
-  memory_engine                              = var.memory_engine
   twenty_provisioned                         = var.twenty_provisioned
   twenty_runtime_enabled                     = var.twenty_runtime_enabled
   twenty_image_uri                           = var.twenty_image_uri

package/dist/{dist-es-CRV46D5B.js → dist-es-2OTNTL4N.js}

@@ -1,7 +1,7 @@
 import { createRequire as __createRequire } from "node:module"; const require = __createRequire(import.meta.url);
 import {
   setCredentialFeature
-} from "./chunk-QOERT44A.js";
+} from "./chunk-YQCYD6NE.js";
 import {
   CredentialsProviderError,
   TokenProviderError,
@@ -23,7 +23,7 @@ var REFRESH_MESSAGE = `To refresh this SSO session run 'aws sso login' with the
 
 // ../../node_modules/.pnpm/@aws-sdk+token-providers@3.1064.0/node_modules/@aws-sdk/token-providers/dist-es/getSsoOidcClient.js
 var getSsoOidcClient = async (ssoRegion, init = {}, callerClientConfig) => {
-  const { SSOOIDCClient } = await import("./sso-oidc-Q4VXANXY.js");
+  const { SSOOIDCClient } = await import("./sso-oidc-XK673P54.js");
   const coalesce = (prop) => init.clientConfig?.[prop] ?? init.parentClientConfig?.[prop] ?? callerClientConfig?.[prop];
   const ssoOidcClient = new SSOOIDCClient(Object.assign({}, init.clientConfig ?? {}, {
     region: ssoRegion ?? init.clientConfig?.region,
@@ -35,7 +35,7 @@ var getSsoOidcClient = async (ssoRegion, init = {}, callerClientConfig) => {
 
 // ../../node_modules/.pnpm/@aws-sdk+token-providers@3.1064.0/node_modules/@aws-sdk/token-providers/dist-es/getNewSsoOidcToken.js
 var getNewSsoOidcToken = async (ssoToken, ssoRegion, init = {}, callerClientConfig) => {
-  const { CreateTokenCommand } = await import("./sso-oidc-Q4VXANXY.js");
+  const { CreateTokenCommand } = await import("./sso-oidc-XK673P54.js");
   const ssoOidcClient = await getSsoOidcClient(ssoRegion, init, callerClientConfig);
   return ssoOidcClient.send(new CreateTokenCommand({
     clientId: ssoToken.clientId,
@@ -180,7 +180,7 @@ var resolveSSOCredentials = async ({ ssoStartUrl, ssoSession, ssoAccountId, ssoR
     });
   }
   const { accessToken } = token;
-  const { SSOClient, GetRoleCredentialsCommand } = await import("./loadSso-DJVB7BXE.js");
+  const { SSOClient, GetRoleCredentialsCommand } = await import("./loadSso-ETCXTR4I.js");
   const sso = ssoClient || new SSOClient(Object.assign({}, clientConfig ?? {}, {
     logger: clientConfig?.logger ?? callerClientConfig?.logger ?? parentClientConfig?.logger,
     region: clientConfig?.region ?? ssoRegion,

package/dist/{dist-es-ENBUC3JP.js → dist-es-2XVAH4BQ.js}

@@ -63,9 +63,9 @@ import {
   streamCollector,
   toBase64,
   toUtf8
-} from "./chunk-ILZKG5WV.js";
+} from "./chunk-AD2NIWB5.js";
 import "./chunk-EI5ZX7CN.js";
-import "./chunk-QOERT44A.js";
+import "./chunk-YQCYD6NE.js";
 import "./chunk-XYM7PE2A.js";
 import "./chunk-OCPHU34C.js";
 import "./chunk-DV3MRBR5.js";

package/dist/{dist-es-DCY4IC3Y.js → dist-es-3DPDUJAH.js}

@@ -63,9 +63,9 @@ import {
   streamCollector,
   toBase64,
   toUtf8
-} from "./chunk-ILZKG5WV.js";
+} from "./chunk-AD2NIWB5.js";
 import "./chunk-EI5ZX7CN.js";
-import "./chunk-QOERT44A.js";
+import "./chunk-YQCYD6NE.js";
 import "./chunk-XYM7PE2A.js";
 import "./chunk-OCPHU34C.js";
 import "./chunk-DV3MRBR5.js";

package/dist/{dist-es-G7PTG75M.js → dist-es-BNZTBBVC.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-GG5WKBOX.js";
 import {
   setCredentialFeature
-} from "./chunk-QOERT44A.js";
+} from "./chunk-YQCYD6NE.js";
 import {
   CredentialsProviderError,
   HttpRequest

package/dist/{dist-es-GKDBE7E6.js → dist-es-CD2RBDAC.js}

@@ -1,7 +1,7 @@
 import { createRequire as __createRequire } from "node:module"; const require = __createRequire(import.meta.url);
 import {
   setCredentialFeature
-} from "./chunk-QOERT44A.js";
+} from "./chunk-YQCYD6NE.js";
 import {
   CredentialsProviderError,
   externalDataInterceptor,

package/dist/{dist-es-R7FGL2IB.js → dist-es-I4FW57PS.js}

@@ -1,7 +1,7 @@
 import { createRequire as __createRequire } from "node:module"; const require = __createRequire(import.meta.url);
 import {
   setCredentialFeature
-} from "./chunk-QOERT44A.js";
+} from "./chunk-YQCYD6NE.js";
 import {
   CredentialsProviderError,
   externalDataInterceptor,

package/dist/{dist-es-USORBXZ5.js → dist-es-KVFWJNDY.js}

@@ -1,7 +1,7 @@
 import { createRequire as __createRequire } from "node:module"; const require = __createRequire(import.meta.url);
 import {
   setCredentialFeature
-} from "./chunk-QOERT44A.js";
+} from "./chunk-YQCYD6NE.js";
 import {
   CredentialsProviderError,
   TokenProviderError,
@@ -23,7 +23,7 @@ var REFRESH_MESSAGE = `To refresh this SSO session run 'aws sso login' with the
 
 // ../../node_modules/.pnpm/@aws-sdk+token-providers@3.1088.0/node_modules/@aws-sdk/token-providers/dist-es/getSsoOidcClient.js
 var getSsoOidcClient = async (ssoRegion, init = {}, callerClientConfig) => {
-  const { SSOOIDCClient } = await import("./sso-oidc-Q4VXANXY.js");
+  const { SSOOIDCClient } = await import("./sso-oidc-XK673P54.js");
   const coalesce = (prop) => init.clientConfig?.[prop] ?? init.parentClientConfig?.[prop] ?? callerClientConfig?.[prop];
   const ssoOidcClient = new SSOOIDCClient(Object.assign({}, init.clientConfig ?? {}, {
     region: ssoRegion ?? init.clientConfig?.region,
@@ -35,7 +35,7 @@ var getSsoOidcClient = async (ssoRegion, init = {}, callerClientConfig) => {
 
 // ../../node_modules/.pnpm/@aws-sdk+token-providers@3.1088.0/node_modules/@aws-sdk/token-providers/dist-es/getNewSsoOidcToken.js
 var getNewSsoOidcToken = async (ssoToken, ssoRegion, init = {}, callerClientConfig) => {
-  const { CreateTokenCommand } = await import("./sso-oidc-Q4VXANXY.js");
+  const { CreateTokenCommand } = await import("./sso-oidc-XK673P54.js");
   const ssoOidcClient = await getSsoOidcClient(ssoRegion, init, callerClientConfig);
   return ssoOidcClient.send(new CreateTokenCommand({
     clientId: ssoToken.clientId,
@@ -183,7 +183,7 @@ var resolveSSOCredentials = async ({ ssoStartUrl, ssoSession, ssoAccountId, ssoR
     });
   }
   const { accessToken } = token;
-  const { SSOClient, GetRoleCredentialsCommand } = await import("./loadSso-JAMNA3WY.js");
+  const { SSOClient, GetRoleCredentialsCommand } = await import("./loadSso-UBD7KUHE.js");
   const sso = ssoClient || new SSOClient(Object.assign({}, clientConfig ?? {}, {
     logger: clientConfig?.logger ?? callerClientConfig?.logger ?? parentClientConfig?.logger,
     region: clientConfig?.region ?? ssoRegion,

package/dist/{dist-es-HY3535OI.js → dist-es-PS73DWNL.js}

@@ -1,7 +1,7 @@
 import { createRequire as __createRequire } from "node:module"; const require = __createRequire(import.meta.url);
 import {
   setCredentialFeature
-} from "./chunk-QOERT44A.js";
+} from "./chunk-YQCYD6NE.js";
 import {
   CredentialsProviderError,
   externalDataInterceptor
@@ -18,7 +18,7 @@ var fromWebToken = (init) => async (awsIdentityProperties) => {
   const { roleArn, roleSessionName, webIdentityToken, providerId, policyArns, policy, durationSeconds } = init;
   let { roleAssumerWithWebIdentity } = init;
   if (!roleAssumerWithWebIdentity) {
-    const { getDefaultRoleAssumerWithWebIdentity } = await import("./sts-CWLSE3GH.js");
+    const { getDefaultRoleAssumerWithWebIdentity } = await import("./sts-OXI2UALF.js");
     roleAssumerWithWebIdentity = getDefaultRoleAssumerWithWebIdentity({
       ...init.clientConfig,
       credentialProviderLogger: init.logger,

package/dist/{dist-es-LDE437AM.js → dist-es-S3NZQFGT.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-GG5WKBOX.js";
 import {
   setCredentialFeature
-} from "./chunk-QOERT44A.js";
+} from "./chunk-YQCYD6NE.js";
 import {
   CredentialsProviderError,
   HttpRequest

package/dist/{dist-es-G54LBMRN.js → dist-es-SGCA4P32.js}

@@ -1,7 +1,7 @@
 import { createRequire as __createRequire } from "node:module"; const require = __createRequire(import.meta.url);
 import {
   setCredentialFeature
-} from "./chunk-QOERT44A.js";
+} from "./chunk-YQCYD6NE.js";
 import {
   CredentialsProviderError
 } from "./chunk-XYM7PE2A.js";

package/dist/{dist-es-Q57SZXZ7.js → dist-es-WBM6J4RA.js}

@@ -1,7 +1,7 @@
 import { createRequire as __createRequire } from "node:module"; const require = __createRequire(import.meta.url);
 import {
   setCredentialFeature
-} from "./chunk-QOERT44A.js";
+} from "./chunk-YQCYD6NE.js";
 import {
   CredentialsProviderError,
   externalDataInterceptor
@@ -18,7 +18,7 @@ var fromWebToken = (init) => async (awsIdentityProperties) => {
   const { roleArn, roleSessionName, webIdentityToken, providerId, policyArns, policy, durationSeconds } = init;
   let { roleAssumerWithWebIdentity } = init;
   if (!roleAssumerWithWebIdentity) {
-    const { getDefaultRoleAssumerWithWebIdentity } = await import("./sts-DNZLNVOV.js");
+    const { getDefaultRoleAssumerWithWebIdentity } = await import("./sts-SQW4NBK3.js");
     roleAssumerWithWebIdentity = getDefaultRoleAssumerWithWebIdentity({
       ...init.clientConfig,
       credentialProviderLogger: init.logger,

package/dist/{dist-es-P26FWFLT.js → dist-es-ZGVADYIF.js}

@@ -1,7 +1,7 @@
 import { createRequire as __createRequire } from "node:module"; const require = __createRequire(import.meta.url);
 import {
   setCredentialFeature
-} from "./chunk-QOERT44A.js";
+} from "./chunk-YQCYD6NE.js";
 import {
   CredentialsProviderError,
   HttpRequest,
@@ -17,7 +17,7 @@ import "./chunk-DV3MRBR5.js";
 var resolveCredentialSource = (credentialSource, profileName, logger) => {
   const sourceProvidersMap = {
     EcsContainer: async (options) => {
-      const { fromHttp } = await import("./dist-es-G7PTG75M.js");
+      const { fromHttp } = await import("./dist-es-BNZTBBVC.js");
       const { fromContainerMetadata } = await import("./dist-es-KL7Y5NB2.js");
       logger?.debug("@aws-sdk/credential-provider-ini - credential_source is EcsContainer");
       return async () => chain(fromHttp(options ?? {}), fromContainerMetadata(options))().then(setNamedProvider);
@@ -29,7 +29,7 @@ var resolveCredentialSource = (credentialSource, profileName, logger) => {
     },
     Environment: async (options) => {
       logger?.debug("@aws-sdk/credential-provider-ini - credential_source is Environment");
-      const { fromEnv } = await import("./dist-es-G54LBMRN.js");
+      const { fromEnv } = await import("./dist-es-SGCA4P32.js");
       return async () => fromEnv(options)().then(setNamedProvider);
     }
   };
@@ -64,7 +64,7 @@ var resolveAssumeRoleCredentials = async (profileName, profiles, options, caller
   const profileData = profiles[profileName];
   const { source_profile, region } = profileData;
   if (!options.roleAssumer) {
-    const { getDefaultRoleAssumer } = await import("./sts-CWLSE3GH.js");
+    const { getDefaultRoleAssumer } = await import("./sts-OXI2UALF.js");
     options.roleAssumer = getDefaultRoleAssumer({
       ...options.clientConfig,
       credentialProviderLogger: options.logger,
@@ -150,7 +150,7 @@ var LoginCredentialsFetcher = class _LoginCredentialsFetcher {
     return this.profileData.login_session;
   }
   async refresh(token) {
-    const { SigninClient, CreateOAuth2TokenCommand } = await import("./signin-UGDWTGS4.js");
+    const { SigninClient, CreateOAuth2TokenCommand } = await import("./signin-5QZNRSOO.js");
     const { logger, userAgentAppId } = this.callerClientConfig ?? {};
     const isH2 = (requestHandler2) => {
       return requestHandler2?.metadata?.handlerProtocol === "h2";
@@ -393,14 +393,14 @@ var resolveLoginCredentials = async (profileName, options, callerClientConfig) =
 
 // ../../node_modules/.pnpm/@aws-sdk+credential-provider-ini@3.972.51/node_modules/@aws-sdk/credential-provider-ini/dist-es/resolveProcessCredentials.js
 var isProcessProfile = (arg) => Boolean(arg) && typeof arg === "object" && typeof arg.credential_process === "string";
-var resolveProcessCredentials = async (options, profile) => import("./dist-es-GKDBE7E6.js").then(({ fromProcess }) => fromProcess({
+var resolveProcessCredentials = async (options, profile) => import("./dist-es-CD2RBDAC.js").then(({ fromProcess }) => fromProcess({
   ...options,
   profile
 })().then((creds) => setCredentialFeature(creds, "CREDENTIALS_PROFILE_PROCESS", "v")));
 
 // ../../node_modules/.pnpm/@aws-sdk+credential-provider-ini@3.972.51/node_modules/@aws-sdk/credential-provider-ini/dist-es/resolveSsoCredentials.js
 var resolveSsoCredentials = async (profile, profileData, options = {}, callerClientConfig) => {
-  const { fromSSO } = await import("./dist-es-USORBXZ5.js");
+  const { fromSSO } = await import("./dist-es-KVFWJNDY.js");
   return fromSSO({
     profile,
     logger: options.logger,
@@ -434,7 +434,7 @@ var resolveStaticCredentials = async (profile, options) => {
 
 // ../../node_modules/.pnpm/@aws-sdk+credential-provider-ini@3.972.51/node_modules/@aws-sdk/credential-provider-ini/dist-es/resolveWebIdentityCredentials.js
 var isWebIdentityProfile = (arg) => Boolean(arg) && typeof arg === "object" && typeof arg.web_identity_token_file === "string" && typeof arg.role_arn === "string" && ["undefined", "string"].indexOf(typeof arg.role_session_name) > -1;
-var resolveWebIdentityCredentials = async (profile, options, callerClientConfig) => import("./dist-es-Q57SZXZ7.js").then(({ fromTokenFile }) => fromTokenFile({
+var resolveWebIdentityCredentials = async (profile, options, callerClientConfig) => import("./dist-es-WBM6J4RA.js").then(({ fromTokenFile }) => fromTokenFile({
   webIdentityTokenFile: profile.web_identity_token_file,
   roleArn: profile.role_arn,
   roleSessionName: profile.role_session_name,

package/dist/drizzle/0227_analyst_reader_role.sql

@@ -215,11 +215,6 @@ BEGIN
   ELSE
     missing := missing || 'agent_capabilities'::text;
   END IF;
-  IF to_regclass('public.agent_knowledge_bases') IS NOT NULL THEN
-    GRANT SELECT ON public.agent_knowledge_bases TO analyst_reader;
-  ELSE
-    missing := missing || 'agent_knowledge_bases'::text;
-  END IF;
   IF to_regclass('public.agent_loop_iterations') IS NOT NULL THEN
     GRANT SELECT ON public.agent_loop_iterations TO analyst_reader;
   ELSE
@@ -510,12 +505,6 @@ BEGIN
   ELSE
     missing := missing || 'guardrails'::text;
   END IF;
-  IF to_regclass('public.harness_tool_execution_events') IS NOT NULL THEN
-    REVOKE ALL PRIVILEGES ON public.harness_tool_execution_events FROM analyst_reader;
-    GRANT SELECT (created_at, duration_ms, error_preview, event_type, id, idempotency_key, input_preview, operation, output_preview, policy_decision_id, policy_revision, principal_id, principal_type, provider_cost_usd, provider_request_id, tenant_id, thread_id, tool_use_id, turn_id) ON public.harness_tool_execution_events TO analyst_reader;
-  ELSE
-    missing := missing || 'harness_tool_execution_events'::text;
-  END IF;
   IF to_regclass('public.inbox_item_comments') IS NOT NULL THEN
     GRANT SELECT ON public.inbox_item_comments TO analyst_reader;
   ELSE
@@ -531,16 +520,6 @@ BEGIN
   ELSE
     missing := missing || 'inbox_items'::text;
   END IF;
-  IF to_regclass('public.knowledge_base_documents') IS NOT NULL THEN
-    GRANT SELECT ON public.knowledge_base_documents TO analyst_reader;
-  ELSE
-    missing := missing || 'knowledge_base_documents'::text;
-  END IF;
-  IF to_regclass('public.knowledge_bases') IS NOT NULL THEN
-    GRANT SELECT ON public.knowledge_bases TO analyst_reader;
-  ELSE
-    missing := missing || 'knowledge_bases'::text;
-  END IF;
   IF to_regclass('public.linked_task_events') IS NOT NULL THEN
     GRANT SELECT ON public.linked_task_events TO analyst_reader;
   ELSE
@@ -831,11 +810,6 @@ BEGIN
   ELSE
     missing := missing || 'space_integrations'::text;
   END IF;
-  IF to_regclass('public.space_knowledge_bases') IS NOT NULL THEN
-    GRANT SELECT ON public.space_knowledge_bases TO analyst_reader;
-  ELSE
-    missing := missing || 'space_knowledge_bases'::text;
-  END IF;
   IF to_regclass('public.space_mcp_servers') IS NOT NULL THEN
     GRANT SELECT ON public.space_mcp_servers TO analyst_reader;
   ELSE
@@ -973,6 +947,12 @@ BEGIN
   ELSE
     missing := missing || 'threads'::text;
   END IF;
+  IF to_regclass('public.tool_execution_events') IS NOT NULL THEN
+    REVOKE ALL PRIVILEGES ON public.tool_execution_events FROM analyst_reader;
+    GRANT SELECT (created_at, duration_ms, error_preview, event_type, id, idempotency_key, input_preview, operation, output_preview, policy_decision_id, policy_revision, principal_id, principal_type, provider_cost_usd, provider_request_id, tenant_id, thread_id, tool_use_id, turn_id) ON public.tool_execution_events TO analyst_reader;
+  ELSE
+    missing := missing || 'tool_execution_events'::text;
+  END IF;
   IF to_regclass('public.trace_cost_reconciliation_facts') IS NOT NULL THEN
     GRANT SELECT ON public.trace_cost_reconciliation_facts TO analyst_reader;
   ELSE
@@ -993,6 +973,16 @@ BEGIN
   ELSE
     missing := missing || 'trace_source_evidence'::text;
   END IF;
+  IF to_regclass('public.twin_materialization_suggestions') IS NOT NULL THEN
+    GRANT SELECT ON public.twin_materialization_suggestions TO analyst_reader;
+  ELSE
+    missing := missing || 'twin_materialization_suggestions'::text;
+  END IF;
+  IF to_regclass('public.user_brain_claims') IS NOT NULL THEN
+    GRANT SELECT ON public.user_brain_claims TO analyst_reader;
+  ELSE
+    missing := missing || 'user_brain_claims'::text;
+  END IF;
   IF to_regclass('public.user_model_approvals') IS NOT NULL THEN
     GRANT SELECT ON public.user_model_approvals TO analyst_reader;
   ELSE
@@ -1118,6 +1108,7 @@ BEGIN
     RAISE WARNING 'analyst grants skipped for tables missing on this database: %', missing;
   END IF;
 END $$;
+
 -- END GENERATED ANALYST GRANTS
 
 COMMIT;

package/dist/drizzle/0230_analyst_rls.sql

@@ -146,15 +146,6 @@ BEGIN
   ELSE
     missing := missing || 'agent_capabilities'::text;
   END IF;
-  IF to_regclass('public.agent_knowledge_bases') IS NOT NULL THEN
-    ALTER TABLE public.agent_knowledge_bases ENABLE ROW LEVEL SECURITY;
-    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.agent_knowledge_bases;
-    CREATE POLICY analyst_tenant_isolation ON public.agent_knowledge_bases
-      FOR SELECT TO analyst_reader
-      USING (tenant_id = current_setting('thinkwork.analyst_tenant', true)::uuid);
-  ELSE
-    missing := missing || 'agent_knowledge_bases'::text;
-  END IF;
   IF to_regclass('public.agent_loop_iterations') IS NOT NULL THEN
     ALTER TABLE public.agent_loop_iterations ENABLE ROW LEVEL SECURITY;
     DROP POLICY IF EXISTS analyst_tenant_isolation ON public.agent_loop_iterations;
@@ -668,15 +659,6 @@ BEGIN
   ELSE
     missing := missing || 'guardrails'::text;
   END IF;
-  IF to_regclass('public.harness_tool_execution_events') IS NOT NULL THEN
-    ALTER TABLE public.harness_tool_execution_events ENABLE ROW LEVEL SECURITY;
-    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.harness_tool_execution_events;
-    CREATE POLICY analyst_tenant_isolation ON public.harness_tool_execution_events
-      FOR SELECT TO analyst_reader
-      USING (tenant_id = current_setting('thinkwork.analyst_tenant', true)::uuid);
-  ELSE
-    missing := missing || 'harness_tool_execution_events'::text;
-  END IF;
   IF to_regclass('public.inbox_item_comments') IS NOT NULL THEN
     ALTER TABLE public.inbox_item_comments ENABLE ROW LEVEL SECURITY;
     DROP POLICY IF EXISTS analyst_tenant_isolation ON public.inbox_item_comments;
@@ -704,24 +686,6 @@ BEGIN
   ELSE
     missing := missing || 'inbox_items'::text;
   END IF;
-  IF to_regclass('public.knowledge_base_documents') IS NOT NULL THEN
-    ALTER TABLE public.knowledge_base_documents ENABLE ROW LEVEL SECURITY;
-    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.knowledge_base_documents;
-    CREATE POLICY analyst_tenant_isolation ON public.knowledge_base_documents
-      FOR SELECT TO analyst_reader
-      USING (tenant_id = current_setting('thinkwork.analyst_tenant', true)::uuid);
-  ELSE
-    missing := missing || 'knowledge_base_documents'::text;
-  END IF;
-  IF to_regclass('public.knowledge_bases') IS NOT NULL THEN
-    ALTER TABLE public.knowledge_bases ENABLE ROW LEVEL SECURITY;
-    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.knowledge_bases;
-    CREATE POLICY analyst_tenant_isolation ON public.knowledge_bases
-      FOR SELECT TO analyst_reader
-      USING (tenant_id = current_setting('thinkwork.analyst_tenant', true)::uuid);
-  ELSE
-    missing := missing || 'knowledge_bases'::text;
-  END IF;
   IF to_regclass('public.linked_task_events') IS NOT NULL THEN
     ALTER TABLE public.linked_task_events ENABLE ROW LEVEL SECURITY;
     DROP POLICY IF EXISTS analyst_tenant_isolation ON public.linked_task_events;
@@ -1226,15 +1190,6 @@ BEGIN
   ELSE
     missing := missing || 'space_integrations'::text;
   END IF;
-  IF to_regclass('public.space_knowledge_bases') IS NOT NULL THEN
-    ALTER TABLE public.space_knowledge_bases ENABLE ROW LEVEL SECURITY;
-    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.space_knowledge_bases;
-    CREATE POLICY analyst_tenant_isolation ON public.space_knowledge_bases
-      FOR SELECT TO analyst_reader
-      USING (tenant_id = current_setting('thinkwork.analyst_tenant', true)::uuid);
-  ELSE
-    missing := missing || 'space_knowledge_bases'::text;
-  END IF;
   IF to_regclass('public.space_mcp_servers') IS NOT NULL THEN
     ALTER TABLE public.space_mcp_servers ENABLE ROW LEVEL SECURITY;
     DROP POLICY IF EXISTS analyst_tenant_isolation ON public.space_mcp_servers;
@@ -1478,6 +1433,15 @@ BEGIN
   ELSE
     missing := missing || 'threads'::text;
   END IF;
+  IF to_regclass('public.tool_execution_events') IS NOT NULL THEN
+    ALTER TABLE public.tool_execution_events ENABLE ROW LEVEL SECURITY;
+    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.tool_execution_events;
+    CREATE POLICY analyst_tenant_isolation ON public.tool_execution_events
+      FOR SELECT TO analyst_reader
+      USING (tenant_id = current_setting('thinkwork.analyst_tenant', true)::uuid);
+  ELSE
+    missing := missing || 'tool_execution_events'::text;
+  END IF;
   IF to_regclass('public.trace_cost_reconciliation_facts') IS NOT NULL THEN
     ALTER TABLE public.trace_cost_reconciliation_facts ENABLE ROW LEVEL SECURITY;
     DROP POLICY IF EXISTS analyst_tenant_isolation ON public.trace_cost_reconciliation_facts;
@@ -1514,6 +1478,24 @@ BEGIN
   ELSE
     missing := missing || 'trace_source_evidence'::text;
   END IF;
+  IF to_regclass('public.twin_materialization_suggestions') IS NOT NULL THEN
+    ALTER TABLE public.twin_materialization_suggestions ENABLE ROW LEVEL SECURITY;
+    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.twin_materialization_suggestions;
+    CREATE POLICY analyst_tenant_isolation ON public.twin_materialization_suggestions
+      FOR SELECT TO analyst_reader
+      USING (tenant_id = current_setting('thinkwork.analyst_tenant', true)::uuid);
+  ELSE
+    missing := missing || 'twin_materialization_suggestions'::text;
+  END IF;
+  IF to_regclass('public.user_brain_claims') IS NOT NULL THEN
+    ALTER TABLE public.user_brain_claims ENABLE ROW LEVEL SECURITY;
+    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.user_brain_claims;
+    CREATE POLICY analyst_tenant_isolation ON public.user_brain_claims
+      FOR SELECT TO analyst_reader
+      USING (tenant_id = current_setting('thinkwork.analyst_tenant', true)::uuid);
+  ELSE
+    missing := missing || 'user_brain_claims'::text;
+  END IF;
   IF to_regclass('public.user_model_approvals') IS NOT NULL THEN
     ALTER TABLE public.user_model_approvals ENABLE ROW LEVEL SECURITY;
     DROP POLICY IF EXISTS analyst_tenant_isolation ON public.user_model_approvals;
@@ -1734,6 +1716,7 @@ BEGIN
     RAISE WARNING 'analyst RLS skipped for tables missing on this database: %', missing;
   END IF;
 END $$;
+
 -- END GENERATED ANALYST RLS
 
 COMMIT;

package/dist/drizzle/0261_native_auth_control_plane.sql

@@ -21,7 +21,7 @@
 -- creates: public.uq_auth_route_clients_app_client
 -- creates: public.idx_auth_route_clients_lifecycle_status
 -- creates: public.user_auth_identities
--- creates: public.uq_user_auth_identities_cognito_sub
+-- creates: public.uq_user_auth_identities_sub_connection
 -- creates: public.uq_user_auth_identities_provider_subject
 -- creates: public.idx_user_auth_identities_user_status
 -- creates: public.idx_user_auth_identities_tenant_status
@@ -233,8 +233,12 @@ CREATE TABLE IF NOT EXISTS public.user_auth_identities (
     CHECK (status = 'quarantined' OR auth_provider_resource_id IS NOT NULL)
 );
 
-CREATE UNIQUE INDEX IF NOT EXISTS uq_user_auth_identities_cognito_sub
-  ON public.user_auth_identities (cognito_issuer, cognito_sub);
+-- 0288 SUPERSEDED the one-per-subject index: enrollment is one lane per
+-- (subject, connection) now. This file is replayed as desired state on
+-- every deploy (deploy.yml native-auth loop), so it must describe the
+-- CURRENT index — recreating the old one fails on any multi-lane DB.
+CREATE UNIQUE INDEX IF NOT EXISTS uq_user_auth_identities_sub_connection
+  ON public.user_auth_identities (cognito_issuer, cognito_sub, auth_provider_resource_id);
 CREATE UNIQUE INDEX IF NOT EXISTS uq_user_auth_identities_provider_subject
   ON public.user_auth_identities (auth_provider_resource_id, provider_issuer, provider_subject);
 CREATE INDEX IF NOT EXISTS idx_user_auth_identities_user_status

package/dist/drizzle/0270_tool_execution_ledger.sql

@@ -0,0 +1,115 @@
+-- creates: public.tool_execution_events
+-- creates: public.idx_tool_execution_turn
+-- creates: public.uq_tool_execution_started
+-- creates: public.uq_tool_execution_terminal
+-- creates-function: public.reject_tool_execution_event_mutation
+-- creates-function: public.validate_tool_execution_event_insert
+-- creates-trigger: public.tool_execution_events.trg_reject_tool_execution_event_mutation
+-- creates-trigger: public.tool_execution_events.trg_validate_tool_execution_event_insert
+-- Pi runtime tool-execution ledger (THINK-324 Wave-3 C17). Sanitized
+-- append-only event stream: one `started` row per tool call and at most one
+-- terminal row, emitted by the runtime via POST /api/runtime/tool-executions.
+-- Succeeds the retired harness_tool_execution_events contract (0264);
+-- policy columns are nullable until per-call re-authorization (C19) lands.
+
+CREATE TABLE IF NOT EXISTS public.tool_execution_events (
+  id bigserial PRIMARY KEY,
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  thread_id uuid NOT NULL REFERENCES public.threads(id) ON DELETE CASCADE,
+  turn_id uuid NOT NULL REFERENCES public.thread_turns(id) ON DELETE CASCADE,
+  principal_type text NOT NULL CHECK (principal_type IN ('user', 'service')),
+  principal_id text NOT NULL,
+  tool_use_id text NOT NULL,
+  operation text NOT NULL,
+  policy_revision text,
+  policy_decision_id text,
+  idempotency_key text NOT NULL,
+  credential_owner_alias text,
+  event_type text NOT NULL
+    CHECK (event_type IN ('started','completed','failed','uncertain')),
+  input_preview jsonb,
+  output_preview jsonb,
+  error_preview jsonb,
+  provider_request_id text,
+  duration_ms integer CHECK (duration_ms IS NULL OR duration_ms >= 0),
+  provider_cost_usd numeric(18,8)
+    CHECK (provider_cost_usd IS NULL OR provider_cost_usd >= 0),
+  created_at timestamptz NOT NULL DEFAULT now(),
+  CHECK (
+    (
+      event_type = 'started'
+      AND input_preview IS NOT NULL
+      AND output_preview IS NULL
+      AND error_preview IS NULL
+      AND provider_request_id IS NULL
+      AND duration_ms IS NULL
+      AND provider_cost_usd IS NULL
+    )
+    OR (
+      event_type IN ('completed','failed','uncertain')
+      AND input_preview IS NULL
+    )
+  )
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS uq_tool_execution_started
+  ON public.tool_execution_events (tenant_id, idempotency_key)
+  WHERE event_type = 'started';
+
+CREATE UNIQUE INDEX IF NOT EXISTS uq_tool_execution_terminal
+  ON public.tool_execution_events (tenant_id, idempotency_key)
+  WHERE event_type IN ('completed','failed','uncertain');
+
+CREATE INDEX IF NOT EXISTS idx_tool_execution_turn
+  ON public.tool_execution_events (tenant_id, thread_id, turn_id, id);
+
+CREATE OR REPLACE FUNCTION public.validate_tool_execution_event_insert()
+RETURNS trigger
+LANGUAGE plpgsql
+AS $$
+BEGIN
+  IF NEW.event_type = 'started' THEN
+    RETURN NEW;
+  END IF;
+
+  IF NOT EXISTS (
+    SELECT 1
+    FROM public.tool_execution_events started
+    WHERE started.tenant_id = NEW.tenant_id
+      AND started.idempotency_key = NEW.idempotency_key
+      AND started.event_type = 'started'
+      AND started.thread_id = NEW.thread_id
+      AND started.turn_id = NEW.turn_id
+      AND started.principal_type = NEW.principal_type
+      AND started.principal_id = NEW.principal_id
+      AND started.tool_use_id = NEW.tool_use_id
+      AND started.operation = NEW.operation
+      AND started.policy_revision IS NOT DISTINCT FROM NEW.policy_revision
+  ) THEN
+    RAISE EXCEPTION 'tool_execution_terminal_without_matching_start';
+  END IF;
+
+  RETURN NEW;
+END;
+$$;
+
+DROP TRIGGER IF EXISTS trg_validate_tool_execution_event_insert
+  ON public.tool_execution_events;
+CREATE TRIGGER trg_validate_tool_execution_event_insert
+BEFORE INSERT ON public.tool_execution_events
+FOR EACH ROW EXECUTE FUNCTION public.validate_tool_execution_event_insert();
+
+CREATE OR REPLACE FUNCTION public.reject_tool_execution_event_mutation()
+RETURNS trigger
+LANGUAGE plpgsql
+AS $$
+BEGIN
+  RAISE EXCEPTION 'tool_execution_events_are_append_only';
+END;
+$$;
+
+DROP TRIGGER IF EXISTS trg_reject_tool_execution_event_mutation
+  ON public.tool_execution_events;
+CREATE TRIGGER trg_reject_tool_execution_event_mutation
+BEFORE UPDATE OR DELETE ON public.tool_execution_events
+FOR EACH ROW EXECUTE FUNCTION public.reject_tool_execution_event_mutation();