@mesh-tech/mesh-cli 0.23.1 → 0.24.1

package/dist/bin/mesh.js

@@ -6258,7 +6258,7 @@ var init_hub_roles = __esm({
   "libs/api-registry/src/hub-roles.ts"() {
     "use strict";
     HUB_STAFF_ROLES = ["ops", "admin"];
-    HUB_RESTRICTED_ROLES = ["developer", "auditor", "vendor"];
+    HUB_RESTRICTED_ROLES = ["developer", "auditor", "vendor", "docs"];
     HUB_BASE_ROLES = [
       ...HUB_STAFF_ROLES,
       ...HUB_RESTRICTED_ROLES
@@ -6271,7 +6271,7 @@ var init_hub_roles = __esm({
 
 // libs/api-registry/src/index.ts
 import { z } from "zod";
-var rateLimitSpecSchema, rateLimitDefaultsSchema, integrationHealthSchema, apiSurfaceKindSchema, apiSurfaceSchema, apiRegistryEntrySchema, integrationStatusSchema;
+var rateLimitSpecSchema, rateLimitDefaultsSchema, integrationHealthSchema, apiSurfaceKindSchema, apiDocsSiteAudienceSchema, apiSurfaceSchema, apiRegistryEntrySchema, integrationStatusSchema;
 var init_src = __esm({
   "libs/api-registry/src/index.ts"() {
     "use strict";
@@ -6286,6 +6286,10 @@ var init_src = __esm({
       z.object({ unavailable: z.string().trim().min(1) })
     ]);
     apiSurfaceKindSchema = z.enum(["app", "vendor"]);
+    apiDocsSiteAudienceSchema = z.discriminatedUnion("readers", [
+      z.object({ readers: z.literal("partner"), roles: z.array(z.string().min(1)) }),
+      z.object({ readers: z.literal("operator") })
+    ]);
     apiSurfaceSchema = z.object({
       http: z.object({ url: z.string().min(1) }).optional(),
       nexus: z.object({ endpoint: z.string().min(1), taskQueue: z.string().min(1) }).optional()
@@ -6304,7 +6308,7 @@ var init_src = __esm({
         url: z.string().min(1),
         contentHash: z.string().min(1),
         siteUrl: z.string().min(1).optional(),
-        siteInternalUrl: z.string().min(1).optional()
+        audience: apiDocsSiteAudienceSchema.optional()
       }),
       enabledOps: z.array(z.string()),
       // The consumer schema strips unknown keys, so a producer-side field that is
@@ -10953,10 +10957,14 @@ function objectLiteralOf(value, program2) {
   const decl = new RegExp(`\\bconst\\s+${id}\\s*(?::[^=]+)?=\\s*\\{`).exec(program2);
   return decl ? balancedSpan(program2, decl.index + decl[0].length - 1) || void 0 : void 0;
 }
-function optionsObject(body) {
+function optionsObject(body, program2) {
   for (const arg of splitTopLevel(body.slice(1, -1))) {
-    const trimmed = arg.trim();
+    const trimmed = stripTrailingComments(stripLeadingComments(arg).trim());
     if (trimmed.startsWith("{")) return balancedSpan(trimmed, 0) || void 0;
+    if (/^[A-Za-z_$][\w$]*$/.test(trimmed)) {
+      const resolved = objectLiteralOf(trimmed, program2);
+      if (resolved) return resolved;
+    }
   }
   return void 0;
 }
@@ -10969,13 +10977,16 @@ function surfaceDeclarations(text, pattern = RE_SURFACE_NEW) {
   }
   return out;
 }
-function isClientAuth(value) {
-  return value !== void 0 && value !== "undefined" && !RE_DEV_BYPASS.test(value);
+function isWritten(value) {
+  return value !== void 0 && value !== "undefined";
+}
+function hasIngress(value) {
+  return isWritten(value) && !/^(null|false)$/.test(value);
 }
 function docsSiteFindings(text) {
   const findings = [];
   for (const decl of surfaceDeclarations(text)) {
-    const options = optionsObject(decl.body);
+    const options = optionsObject(decl.body, text);
     if (!options) continue;
     const args = topLevelProperties(options);
     const docsText = objectLiteralOf(args.get("docs"), text);
@@ -10983,13 +10994,13 @@ function docsSiteFindings(text) {
     const docs = topLevelProperties(docsText);
     if (docs.get("site") === "false") continue;
     if (docs.get("site") !== "true" && !DOCS_SITE_FIELDS.some((f) => docs.has(f))) continue;
-    const httpText = objectLiteralOf(topLevelProperties(objectLiteralOf(args.get("surfaces"), text) ?? "{}").get("http"), text);
-    const hasClient = isClientAuth(docs.get("auth")) || isClientAuth(topLevelProperties(httpText ?? "{}").get("auth"));
-    if (!hasClient) {
+    const retired = DOCS_SITE_RETIRED_FIELDS.filter((f) => isWritten(docs.get(f)));
+    if (retired.length > 0) {
+      const named = retired.map((f) => `docs.${f}`).join(", ");
       findings.push({
-        code: "DOCS_SITE_UNAUTHED",
+        code: "DOCS_SITE_PUBLIC",
         line: decl.line,
-        why: `mesh.apps.${decl.ctor} declares a docs site with no OIDC client \u2014 the site is served behind the platform sign-in proxy, which needs one (docs.auth, or a client on surfaces.http.auth)`
+        why: `mesh.apps.${decl.ctor} declares a docs site with ${named} \u2014 retired: a docs site has no hostname, no sign-in and no door switch of its own; it is read inside the Hub through the docs door, and the primitive ignores ${retired.length > 1 ? "them" : "it"}`
       });
     }
     const kindStated = decl.ctor === "AppApiSurface" || decl.ctor === "VendorApiSurface" || args.has("kind");
@@ -10997,21 +11008,21 @@ function docsSiteFindings(text) {
       findings.push({
         code: "DOCS_AUDIENCE_IMPLICIT",
         line: decl.line,
-        why: `mesh.apps.${decl.ctor} declares a docs site but neither its kind nor its audience \u2014 who may read it would fall out of the name heuristic, and a vendor surface must never default to partner-readable that way`
+        why: `mesh.apps.${decl.ctor} declares a docs site but neither its kind nor its audience \u2014 who the Hub admits through the door would fall out of the name heuristic, and a vendor surface must never default to partner-readable that way`
       });
     }
+    const httpText = objectLiteralOf(topLevelProperties(objectLiteralOf(args.get("surfaces"), text) ?? "{}").get("http"), text);
     for (const f of docsAudienceUngrantable(text, decl, args, docs, httpText)) findings.push(f);
   }
   for (const decl of surfaceDeclarations(text, RE_APIDOCS_NEW)) {
-    const options = optionsObject(decl.body);
+    const options = optionsObject(decl.body, text);
     if (!options) continue;
     const args = topLevelProperties(options);
-    if (!args.has("ingress") || args.get("ingress") === "undefined") continue;
-    if (isClientAuth(args.get("auth"))) continue;
+    if (!hasIngress(args.get("ingress"))) continue;
     findings.push({
-      code: "DOCS_SITE_UNAUTHED",
+      code: "DOCS_SITE_PUBLIC",
       line: decl.line,
-      why: `mesh.apps.ApiDocs is published on an ingress with no auth \u2014 the site (reference and playground) is reachable by anyone; put the platform sign-in proxy in front of it, or drop the ingress`
+      why: `mesh.apps.ApiDocs is published on an ingress \u2014 a docs site has no hostname of its own; it is read inside the Hub through the docs door of the API surface that declares it, and the ingress is retired (it still deploys, with a preview warning, until a coming minor release refuses it)`
     });
   }
   return findings;
@@ -11029,7 +11040,7 @@ function docsAudienceUngrantable(text, decl, args, docs, httpText) {
   if (!roles || roles.length === 0) return findings;
   const identities = [];
   for (const d of surfaceDeclarations(text, RE_IDENTITY_NEW)) {
-    const options = optionsObject(d.body);
+    const options = optionsObject(d.body, text);
     if (!options) continue;
     const binding = [...text.matchAll(RE_IDENTITY_BINDING)].find((m) => text.indexOf(d.body, m.index) === m.index + m[0].length - 1)?.[1];
     identities.push({ binding, options: topLevelProperties(options) });
@@ -11037,8 +11048,7 @@ function docsAudienceUngrantable(text, decl, args, docs, httpText) {
   if (identities.length === 0) return findings;
   const docsAuth = objectLiteralOf(docs.get("auth"), text);
   const clientExpr = (docsAuth ? topLevelProperties(docsAuth).get("clientId") : void 0) ?? (httpText ? topLevelProperties(objectLiteralOf(topLevelProperties(httpText).get("auth"), text) ?? "{}").get("clientId") : void 0);
-  const appName = clientExpr ? RE_IDENTITY_APP_CLIENT.exec(clientExpr)?.[1] : void 0;
-  const clientRoot = clientExpr ? /^([A-Za-z_$][\w$]*)\.applications\./.exec(clientExpr.trim())?.[1] : void 0;
+  const clientRoot = clientExpr ? /^([A-Za-z_$][\w$]*)\.(?:clientIds|applications)\./.exec(clientExpr.trim())?.[1] : void 0;
   const identity = (clientRoot ? identities.find((id) => id.binding === clientRoot) : void 0) ?? (identities.length === 1 ? identities[0] : void 0);
   if (!identity) return findings;
   const rolesText = identity.options.get("roles");
@@ -11054,16 +11064,6 @@ function docsAudienceUngrantable(text, decl, args, docs, httpText) {
       });
     }
   }
-  if (!appName) return findings;
-  const apps = objectLiteralOf(identity.options.get("applications"), text);
-  const app = apps ? objectLiteralOf(topLevelProperties(apps).get(appName), text) : void 0;
-  if (app && topLevelProperties(app).get("idTokenRoleAssertion") === "false") {
-    findings.push({
-      code: "DOCS_AUDIENCE_UNGRANTABLE",
-      line: decl.line,
-      why: `the docs sign-in client is applications.${appName} on the ZitadelAppIdentity, which sets idTokenRoleAssertion: false \u2014 the proxy's ID token then carries no roles and the site's gate admits nobody`
-    });
-  }
   return findings;
 }
 function listApps(root) {
@@ -11271,7 +11271,7 @@ function registerAppCommands(program2) {
     }
   });
 }
-var APP_CHECK_RULES, APP_CHECK_CODES, SRC_EXT, SKIP_DIRS, NON_SERVICE_DIRS, RE_HTML, RE_OIDC, RE_COOKIE, RE_LOGGER, RE_EXPOSURE, RE_POINTER, RE_METADATA, RE_IAC_GRANT, RE_POINTER_OVERRIDE, RE_PASSWORD, RE_ALLOWLIST, RE_USERS_TABLE, RE_SURFACE_NEW, RE_APIDOCS_NEW, RE_IDENTITY_NEW, RE_IDENTITY_BINDING, DEFAULT_PARTNER_DOCS_ROLES, RE_IDENTITY_APP_CLIENT, DOCS_SITE_FIELDS, RE_DEV_BYPASS, RE_PROPERTY;
+var APP_CHECK_RULES, APP_CHECK_CODES, SRC_EXT, SKIP_DIRS, NON_SERVICE_DIRS, RE_HTML, RE_OIDC, RE_COOKIE, RE_LOGGER, RE_EXPOSURE, RE_POINTER, RE_METADATA, RE_IAC_GRANT, RE_POINTER_OVERRIDE, RE_PASSWORD, RE_ALLOWLIST, RE_USERS_TABLE, RE_SURFACE_NEW, RE_APIDOCS_NEW, RE_IDENTITY_NEW, RE_IDENTITY_BINDING, DEFAULT_PARTNER_DOCS_ROLES, DOCS_SITE_FIELDS, DOCS_SITE_RETIRED_FIELDS, RE_PROPERTY;
 var init_app_check = __esm({
   "libs/mesh-cli/src/commands/app-check.ts"() {
     "use strict";
@@ -11371,11 +11371,14 @@ var init_app_check = __esm({
         remediation: "drop the table; people and roles live in Zitadel and are administered from the Hub",
         scope: "app"
       },
-      DOCS_SITE_UNAUTHED: {
+      DOCS_SITE_PUBLIC: {
         gate: "0.3",
-        title: "Docs site behind the platform sign-in",
-        severity: "block",
-        remediation: 'on an API surface: docs: { auth: { clientId, clientSecret } } (or a client on surfaces.http.auth), or opt out with docs: { site: false }; on a mesh.apps.ApiDocs: auth: { provider: "mesh", clientId, clientSecret }, or drop the ingress (an in-cluster site is reachable through mesh dev)',
+        title: "Docs site read through the Hub, not on a hostname of its own",
+        // Advisory while the hostname is deprecated rather than refused: a site
+        // that still deploys on one keeps deploying this release, with a preview
+        // warning, and its tenant CI should say so without going red.
+        severity: "advisory",
+        remediation: "drop the docs hostname \u2014 a docs site is read inside the Hub through the docs door, which signs every reader in: on an API surface remove docs.ingress (docs.auth, docs.basePath and docs.hubDoor are retired with it); on a mesh.apps.ApiDocs remove the ingress (and its auth / authentication) and declare the API as a mesh.apps.AppApiSurface whose docs block builds the site",
         scope: "app"
       },
       DOCS_AUDIENCE_IMPLICIT: {
@@ -11389,7 +11392,7 @@ var init_app_check = __esm({
         gate: "H",
         title: "Docs audience grantable from the Hub",
         severity: "block",
-        remediation: `declare every audience role on the ZitadelAppIdentity (roles: ["docs"]) so the Hub can grant it, and do not set idTokenRoleAssertion: false on the application the docs sign-in proxy uses (applications.<name>) \u2014 the identity asserts roles into the ID token by default, and the site's gate reads that token`,
+        remediation: `declare every audience role on the ZitadelAppIdentity (roles: ["docs"]) so the Hub can grant it from the app's Access tab \u2014 the audience is published on the surface's registry entry as the reader set for the Hub to admit by, and a role nobody can be granted admits nobody`,
         scope: "app"
       }
     };
@@ -11427,9 +11430,8 @@ var init_app_check = __esm({
     RE_IDENTITY_NEW = /new\s+mesh\.auth\.(ZitadelAppIdentity)\s*\(/g;
     RE_IDENTITY_BINDING = /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*(?::[^=]+)?=\s*new\s+mesh\.auth\.ZitadelAppIdentity\s*\(/g;
     DEFAULT_PARTNER_DOCS_ROLES = ["docs"];
-    RE_IDENTITY_APP_CLIENT = /\bapplications\.([A-Za-z_$][\w$]*)\.clientId\b/;
     DOCS_SITE_FIELDS = ["pages", "playground", "audience", "basePath", "ingress", "auth"];
-    RE_DEV_BYPASS = /^["']dev-bypass["']$/;
+    DOCS_SITE_RETIRED_FIELDS = ["auth", "ingress", "basePath", "hubDoor"];
     RE_PROPERTY = /^(?:"([^"]+)"|'([^']+)'|([A-Za-z_$][\w$]*))\s*(?::\s*([\s\S]*))?$/;
   }
 });
@@ -13076,7 +13078,7 @@ async function checkScaffoldContract(appDir) {
   }
   console.log(renderReport(report, { verbose: false }));
   if (report.status === "warn") {
-    logSuccess("app contract: met \u2014 the \u26A0 lines above are advisories on the repo, not on this app (mesh app check)");
+    logSuccess("app contract: met \u2014 the \u26A0 lines above are advisories, not blocking findings (mesh app check)");
     return;
   }
   if (report.status === "error") {