@mesh-tech/mesh-cli 0.26.0 → 0.28.0

package/templates/api-role-gating/index.ts.hbs

@@ -107,7 +107,11 @@ new mesh.auth.AppAuthzPointer("authz", {
 });
 
 export const app = env.register({
-  description: "{{titleCase name}} — role-gating API (roles enforced in-process from the Zitadel JWT)",
+  displayName: "{{titleCase name}}",
+  // What a client operator reads on the Apps list. One sentence, their words.
+  description: "Serves the {{titleCase name}} API, with access decided by each caller's role.",
+  // Engineer to engineer; a Hub deployed for a client never serializes it.
+  operatorNote: "Role-gating mode — roles are enforced in-process from the Zitadel JWT, no SpiceDB.",
 });
 
 /** The app's own Zitadel project id (grant API keys against this). */

package/templates/external-service/index.ts.hbs

@@ -42,7 +42,11 @@ const vendorpay = new mesh.apps.ExternalService("vendorpay", {
   env,
   type: "payment",
   kind: "connection",
-  description: "Example payments vendor (quotes API) — the external-service pattern",
+  // One sentence a client operator can act on, in their words. This renders on
+  // the Hub's Integrations row, which a credit union's own staff read.
+  description: "Gets price quotes from our payments vendor.",
+  // Engineer to engineer: never serialized by a Hub deployed for a client.
+  operatorNote: "Example vendor wired the external-service way — credentials in Secrets Manager, no runtime to probe.",
   credentials: {
     fields: {
       baseUrl: { name: "Base URL", description: "Vendor API endpoint" },

package/templates/platform-repo/AGENTS.md.hbs

@@ -3,11 +3,27 @@
 - Invoke the CLI as `pnpm mesh <cmd>` or (cwd-independent) `pnpm exec mesh <cmd>` —
   a root `"mesh"` script + the `@mesh-tech/mesh-cli` devDependency make both work
   after `pnpm install`. For a bare `mesh` on PATH, run once: `pnpm exec mesh install-shim`.
-- Operations are `mesh` commands, never raw `aws`/`pulumi`/`kubectl`:
-  `mesh login {{tenant}}.{{env}}`, `mesh deploy preview|up` (run inside
-  `core/` or `platform/`), `mesh init app-tenant` (doctor).
+- Operations are `mesh` commands, never raw `pulumi`/`kubectl`: `mesh deploy
+  preview|up` (run inside `core/` or `platform/`), `mesh init app-tenant`
+  (doctor). **One exception:** a platform stack carries no `mesh:deployerRole`
+  — only app stacks do — so `mesh deploy` reads credentials from the
+  environment, on the first deploy and on every day-2 run:
+  `aws sso login --profile {{profile}}`, then
+  `eval "$(aws configure export-credentials --profile {{profile}} --format env)"`.
+- **`mesh login {{tenant}}.{{env}}` comes LAST, after the first deploy.** The
+  Zitadel it signs in to is what the `platform/` layer creates; run earlier it
+  fails with `No configuration found for "{{tenant}}.{{env}}"`. Package access
+  is a separate, global sign-in (`mesh registry login`) and is not needed in
+  this repo at all.
 - Deploy order matters: `core/` before `platform/` (platform imports core
-  from the SSM registry).
+  from the SSM registry), and the NS delegation of the public zone is a manual
+  step **in the middle of the `core/` deploy** — that deploy blocks on its ACM
+  certificate until you delegate the new zone's NS records from the parent, so
+  a `core/` deploy that looks hung is waiting on you. README.md holds the full
+  first-deploy sequence, the one `mesh init` printed when it scaffolded this
+  repo. Do not invent a different one.
+- `platform/` builds service images, so it needs Docker; `core/` does not.
+  That is why a Docker-less container can deploy `core/` and stop there.
 - Capabilities are config, not code: enable/disable platform services in
   `platform/Pulumi.{{tenant}}-{{env}}.yaml` (temporal/zitadel/hub/tenants/…);
   the `index.ts` layer programs should rarely change.

package/templates/workflow/index.ts.hbs

@@ -64,5 +64,9 @@ const worker = new mesh.apps.TemporalWorker("worker", {
 // --- Outputs ---
 
 export const app = env.register({
-  description: "{{titleCase name}} — Temporal workflow app",
+  displayName: "{{titleCase name}}",
+  // What a client operator reads on the Apps list. One sentence, their words.
+  description: "Runs {{titleCase name}}'s scheduled and long-running jobs.",
+  // Engineer to engineer; a Hub deployed for a client never serializes it.
+  operatorNote: "Temporal workflow app scaffolded by `mesh create-app --template workflow`.",
 });