@mesh-tech/mesh-cli 0.22.1 → 0.22.2

package/dist/bin/mesh.js

@@ -11084,7 +11084,7 @@ function scanApp(root, appRel) {
     hit(
       "METADATA_UNPUBLISHED",
       rel(root, pointer.file),
-      "AppAuthzPointer present but no compiled ops-hub metadata (compileOpsHubMetadata export or SpiceDBSchema) \u2014 the Hub's create-key and role catalog 409 METADATA_UNPUBLISHED"
+      "AppAuthzPointer present but no compiled ops-hub metadata (opsHubMetadata: compileOpsHubMetadata(schemaDef) on the pointer, or a SpiceDBSchema) \u2014 the Hub's create-key and role catalog 409 METADATA_UNPUBLISHED"
     );
   }
   const anti = (code, re, why) => {
@@ -11261,7 +11261,7 @@ var init_app_check = __esm({
         gate: "H",
         title: "Access surfaced through the Hub",
         severity: "block",
-        remediation: 'publish ops-hub metadata and end index.ts with new mesh.auth.AppAuthzPointer("authz", { env, mode, opsHubMetadataRef })',
+        remediation: 'end index.ts with new mesh.auth.AppAuthzPointer("authz", { env, mode, opsHubMetadata: compileOpsHubMetadata(schemaDef) }) (role-gating) or { env, mode, opsHubMetadataRef: schema.opsHubMetadataRef } (policy-engine)',
         scope: "app"
       },
       METADATA_UNPUBLISHED: {

package/dist/build-info.json

@@ -1,4 +1,4 @@
 {
-  "commit": "2c9e53366",
-  "builtAt": "2026-09-14T14:19:35.432Z"
+  "commit": "f521bf94d",
+  "builtAt": "2026-09-14T16:47:16.010Z"
 }

package/dist/src/commands/app-check.js

@@ -51,7 +51,7 @@ export const APP_CHECK_RULES = {
         gate: "H",
         title: "Access surfaced through the Hub",
         severity: "block",
-        remediation: 'publish ops-hub metadata and end index.ts with new mesh.auth.AppAuthzPointer("authz", { env, mode, opsHubMetadataRef })',
+        remediation: 'end index.ts with new mesh.auth.AppAuthzPointer("authz", { env, mode, opsHubMetadata: compileOpsHubMetadata(schemaDef) }) (role-gating) or { env, mode, opsHubMetadataRef: schema.opsHubMetadataRef } (policy-engine)',
         scope: "app",
     },
     METADATA_UNPUBLISHED: {
@@ -570,7 +570,7 @@ export function scanApp(root, appRel) {
         hit("NO_AUTHZ_POINTER", rel(root, at.file), `${appLabel} authenticates callers or declares roles but publishes no mesh.auth.AppAuthzPointer — the Hub's Access tab is blank for this app`);
     }
     else if (exposure && pointer && !metadata) {
-        hit("METADATA_UNPUBLISHED", rel(root, pointer.file), "AppAuthzPointer present but no compiled ops-hub metadata (compileOpsHubMetadata export or SpiceDBSchema) — the Hub's create-key and role catalog 409 METADATA_UNPUBLISHED");
+        hit("METADATA_UNPUBLISHED", rel(root, pointer.file), "AppAuthzPointer present but no compiled ops-hub metadata (opsHubMetadata: compileOpsHubMetadata(schemaDef) on the pointer, or a SpiceDBSchema) — the Hub's create-key and role catalog 409 METADATA_UNPUBLISHED");
     }
     const anti = (code, re, why) => {
         const files = [...new Set(surface.filter((h) => re.test(h.text)).map((h) => h.file))].sort().slice(0, 3);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mesh-tech/mesh-cli",
-  "version": "0.22.1",
+  "version": "0.22.2",
   "description": "CLI for Mesh platform development utilities",
   "type": "module",
   "license": "UNLICENSED",
@@ -42,7 +42,7 @@
   },
   "devDependencies": {
     "@mesh-tech/agent-contracts": "0.2.0",
-    "@mesh-tech/tsconfig": "2.8.0",
+    "@mesh-tech/tsconfig": "2.9.0",
     "@mesh-tech/workflow-viz": "0.3.0",
     "@tanstack/intent": "^0.3.6",
     "@types/node": "^20.0.0",

package/templates/api-role-gating/AGENTS.md.hbs

@@ -11,9 +11,10 @@
 - **Two non-negotiables for role-gating apps (already wired — keep them):**
   1. `api/package.json` build MUST be `esm-bundle …`, not `tsc` — plain `tsc`
      ships bare `@mesh-tech/*` imports the container can't resolve.
-  2. `index.ts` MUST `Export` `compileOpsHubMetadata(schema)` and pass
-     `opsHubMetadataRef` to `AppAuthzPointer`, or the Hub create-key wizard
-     409s (`METADATA_UNPUBLISHED`).
+  2. `index.ts` MUST pass `opsHubMetadata: compileOpsHubMetadata(schema)` to
+     `AppAuthzPointer` — the pointer publishes the blob at the conventional
+     path itself; do NOT add a separate `mesh.exports.Export`. Without it the
+     Hub create-key wizard 409s (`METADATA_UNPUBLISHED`).
 - Machine/API-key callers carry roles under the project-id-keyed Zitadel claim;
   `authn.ts` passes `projectId` to `zitadelJwtScheme` so it reads the right key.
 - Pattern skills for authn/authz ship inside those packages (TanStack Intent

package/templates/api-role-gating/README.md.hbs

@@ -33,9 +33,10 @@ mesh dev              # wires the api to the local platform
    `esm-bundle src/main.ts --outfile dist/main.js` — plain `tsc` leaves bare
    `@mesh-tech/*` workspace imports unresolvable in the container
    (`ERR_MODULE_NOT_FOUND` / CrashLoopBackOff).
-2. **Publish ops-hub metadata.** `index.ts` exports `compileOpsHubMetadata(schema)`
-   at the conventional path and threads `opsHubMetadataRef` into
-   `AppAuthzPointer`. Without it the Hub's create-key wizard hard-409s
+2. **Publish ops-hub metadata.** `index.ts` hands
+   `opsHubMetadata: compileOpsHubMetadata(schema)` to `AppAuthzPointer`, which
+   publishes the blob at the conventional path — no separate
+   `mesh.exports.Export`. Without it the Hub's create-key wizard hard-409s
    (`METADATA_UNPUBLISHED`) — a role-gating app has no `SpiceDBSchema` component
    to publish the blob for it.
 
@@ -56,8 +57,8 @@ at preview time).
 
 ## Layout
 
-- `index.ts` — Pulumi program (identity + roles, Service, ops-hub metadata,
-  `AppAuthzPointer` mode `role-gating`)
+- `index.ts` — Pulumi program (identity + roles, Service, `AppAuthzPointer`
+  mode `role-gating` publishing the ops-hub metadata)
 - `api/src/main.ts` — Hono app: authn middleware + `m.requireRole(...)`
 - `api/src/schema.ts` — the authz schema (single source of truth; `coarseRoles`)
 - `api/src/authn.ts` — Zitadel JWT scheme (project-id-keyed roles claim)

package/templates/api-role-gating/index.ts.hbs

@@ -12,10 +12,13 @@
  *   2. ZitadelAppIdentity — this app's OWN project; roles = schema.coarseRoles
  *                           (roleAssertion defaults ON so granted roles ride in
  *                           tokens — essential; there is no SpiceDB fallback).
- *   3. AppEnvironment     — namespace + providers, bound to the app's project.
+ *   3. AppEnvironment     — namespace + providers, bound to the app's OWN
+ *                           project via zitadelAppProjectId (the pointer's
+ *                           guard fails the deploy if it is the platform's).
  *   4. api Service        — Hono app gating routes by role, in-process.
- *   5. ops-hub metadata   — the compiled schema blob (coarseRoles + mode).
- *   6. AppAuthzPointer    — mode "role-gating"; guard fails deploy if SpiceDB.
+ *   5. AppAuthzPointer    — mode "role-gating"; publishes the compiled schema
+ *                           blob (coarseRoles + mode) as the ops-hub metadata
+ *                           at …/authz/ops-hub-metadata and points at it.
  *
  * Prerequisite: the target platform must have Zitadel enabled — ZitadelConnector
  * eager-reads it at preview time.
@@ -26,7 +29,6 @@
 import * as pulumi from "@pulumi/pulumi";
 import { mesh } from "@mesh-tech/app-kit/infra";
 import { compileOpsHubMetadata } from "@mesh-tech/authz";
-import type { OpsHubMetadata } from "@mesh-tech/authz";
 // The authz schema is the single source of truth, shared by the api (enforces
 // it) and this Pulumi program (compiles it to ops-hub metadata + Zitadel roles).
 import schemaDef from "./api/src/schema.js";
@@ -54,7 +56,10 @@ const identity = new mesh.auth.ZitadelAppIdentity("identity", {
   },
 });
 
-// --- 3. Environment — bound to the app's own project via zitadelAppProjectId. ---
+// --- 3. Environment — bound to the app's OWN project via zitadelAppProjectId. ---
+// Without it env.zitadel.projectId silently falls back to the shared platform
+// project, whose roles are not this app's — AppAuthzPointer below fails the
+// deploy for a role-gating app in that state, so this line is load-bearing.
 const env = new mesh.apps.AppEnvironment("env", {
   tenant,
   platform,
@@ -84,22 +89,21 @@ const api = new mesh.apps.Service("api", {
   resources: { cpu: "100m", memory: "128Mi" },
 });
 
-// --- 5. Ops-hub metadata — MANDATORY for role-gating apps. ---
-// The Hub create-key path validates requested roles against the PUBLISHED
-// coarseRoles and hard-409s (METADATA_UNPUBLISHED) without it. Role-gating apps
-// have no SpiceDBSchema component to export it, so publish the compiled blob
-// directly at the conventional path the Hub assembler sweeps.
-const opsHubMetadataRef = `/mesh-platform/${tenant}/${platform.env}/apps/${appName}/stacks/${stack}/authz/ops-hub-metadata`;
-new mesh.exports.Export<OpsHubMetadata>("ops-hub-metadata", {
-  path: opsHubMetadataRef,
-  value: compileOpsHubMetadata(schemaDef),
-});
-
-// --- 6. AppAuthzPointer — LAST. mode "role-gating" tells Ops Hub to render the
-// role-gating surface; its guard fails the deploy if any SpiceDB is registered.
+// --- 5. AppAuthzPointer — LAST. mode "role-gating" tells Ops Hub to render the
+// role-gating surface; its guards fail the deploy if any SpiceDB is registered
+// or if the env is bound to the platform project instead of this app's.
+// `opsHubMetadata` is MANDATORY for role-gating apps: the Hub create-key path
+// validates requested roles against the PUBLISHED coarseRoles and hard-409s
+// (METADATA_UNPUBLISHED) without it. Role-gating apps have no SpiceDBSchema
+// component to publish it, so the pointer publishes the compiled blob itself
+// at the conventional …/authz/ops-hub-metadata path and references it.
 // It publishes env.zitadel — the project bound above through zitadelAppProjectId;
 // never pass a `zitadel:` override here (that is the Hub's own escape hatch). ---
-new mesh.auth.AppAuthzPointer("authz", { env, mode: "role-gating", opsHubMetadataRef });
+new mesh.auth.AppAuthzPointer("authz", {
+  env,
+  mode: "role-gating",
+  opsHubMetadata: compileOpsHubMetadata(schemaDef),
+});
 
 export const app = env.register({
   description: "{{titleCase name}} — role-gating API (roles enforced in-process from the Zitadel JWT)",

package/templates/api-role-gating/skills/develop/SKILL.md.hbs

@@ -28,20 +28,25 @@ A token without the role → 403; no/invalid token on a gated route → 401.
 
 ## Two role-gating gotchas (already wired — do NOT regress)
 
-Both were discovered the hard way and each costs a redeploy:
+Each costs a redeploy to rediscover:
 
 1. **`esm-bundle` build, not `tsc`.** `api/package.json`:
    `"build": "esm-bundle src/main.ts --outfile dist/main.js"` with the
    `@mesh-tech/esm-bundle` devDep. Plain `tsc` leaves bare `@mesh-tech/*`
    workspace imports unresolvable in the Service container
    (`ERR_MODULE_NOT_FOUND` / CrashLoopBackOff).
-2. **Publish ops-hub metadata.** `index.ts` does
-   `mesh.exports.Export(compileOpsHubMetadata(schema))` at
-   `…/apps/{{name}}/stacks/{stack}/authz/ops-hub-metadata` and passes that
-   `opsHubMetadataRef` to `AppAuthzPointer`. A role-gating app has no
-   `SpiceDBSchema` component to publish this, and the Hub create-key wizard
-   hard-409s (`METADATA_UNPUBLISHED`) without it — it validates requested roles
-   against the app's PUBLISHED `coarseRoles`.
+2. **Publish ops-hub metadata.** `index.ts` passes
+   `opsHubMetadata: compileOpsHubMetadata(schema)` to `AppAuthzPointer`, which
+   publishes it at `…/apps/{{name}}/stacks/{stack}/authz/ops-hub-metadata` and
+   references it. A role-gating app has no `SpiceDBSchema` component to publish
+   this, and the Hub create-key wizard hard-409s (`METADATA_UNPUBLISHED`)
+   without it — it validates requested roles against the app's PUBLISHED
+   `coarseRoles`.
+3. **Bind the env to this app's OWN Zitadel project.** `ZitadelAppIdentity` is
+   constructed BEFORE `AppEnvironment`, which takes
+   `zitadelAppProjectId: identity.projectId`. Without it the env silently falls
+   back to the shared platform project (no roles of this app live there) and
+   `AppAuthzPointer` fails the deploy naming both projects and this fix.
 
 ## Never add SpiceDB