@mesh-tech/mesh-cli 0.27.0 → 0.29.0

package/templates/external-service/index.ts.hbs

@@ -42,7 +42,11 @@ const vendorpay = new mesh.apps.ExternalService("vendorpay", {
   env,
   type: "payment",
   kind: "connection",
-  description: "Example payments vendor (quotes API) — the external-service pattern",
+  // One sentence a client operator can act on, in their words. This renders on
+  // the Hub's Integrations row, which a credit union's own staff read.
+  description: "Gets price quotes from our payments vendor.",
+  // Engineer to engineer: never serialized by a Hub deployed for a client.
+  operatorNote: "Example vendor wired the external-service way — credentials in Secrets Manager, no runtime to probe.",
   credentials: {
     fields: {
       baseUrl: { name: "Base URL", description: "Vendor API endpoint" },

package/templates/platform-repo/AGENTS.md.hbs

@@ -3,11 +3,27 @@
 - Invoke the CLI as `pnpm mesh <cmd>` or (cwd-independent) `pnpm exec mesh <cmd>` —
   a root `"mesh"` script + the `@mesh-tech/mesh-cli` devDependency make both work
   after `pnpm install`. For a bare `mesh` on PATH, run once: `pnpm exec mesh install-shim`.
-- Operations are `mesh` commands, never raw `aws`/`pulumi`/`kubectl`:
-  `mesh login {{tenant}}.{{env}}`, `mesh deploy preview|up` (run inside
-  `core/` or `platform/`), `mesh init app-tenant` (doctor).
+- Operations are `mesh` commands, never raw `pulumi`/`kubectl`: `mesh deploy
+  preview|up` (run inside `core/` or `platform/`), `mesh init app-tenant`
+  (doctor). **One exception:** a platform stack carries no `mesh:deployerRole`
+  — only app stacks do — so `mesh deploy` reads credentials from the
+  environment, on the first deploy and on every day-2 run:
+  `aws sso login --profile {{profile}}`, then
+  `eval "$(aws configure export-credentials --profile {{profile}} --format env)"`.
+- **`mesh login {{tenant}}.{{env}}` comes LAST, after the first deploy.** The
+  Zitadel it signs in to is what the `platform/` layer creates; run earlier it
+  fails with `No configuration found for "{{tenant}}.{{env}}"`. Package access
+  is a separate, global sign-in (`mesh registry login`) and is not needed in
+  this repo at all.
 - Deploy order matters: `core/` before `platform/` (platform imports core
-  from the SSM registry).
+  from the SSM registry), and the NS delegation of the public zone is a manual
+  step **in the middle of the `core/` deploy** — that deploy blocks on its ACM
+  certificate until you delegate the new zone's NS records from the parent, so
+  a `core/` deploy that looks hung is waiting on you. README.md holds the full
+  first-deploy sequence, the one `mesh init` printed when it scaffolded this
+  repo. Do not invent a different one.
+- `platform/` builds service images, so it needs Docker; `core/` does not.
+  That is why a Docker-less container can deploy `core/` and stop there.
 - Capabilities are config, not code: enable/disable platform services in
   `platform/Pulumi.{{tenant}}-{{env}}.yaml` (temporal/zitadel/hub/tenants/…);
   the `index.ts` layer programs should rarely change.

package/templates/platform-repo/platform/index.ts

@@ -71,6 +71,16 @@ const meshPlatform = new mesh.layers.MeshPlatform("platform", {
   // DevBox - remote development instances (optional)
   // Config: mesh:devbox: { users: { <username>: { home: "/Users/<username>", ... } } }
   devbox: config.getObject("devbox") ?? false,
+  // Image build mode for the platform's mesh-built images (Temporal
+  // provisioner, custom server, Hub): "remote" builds them inside the target
+  // cluster as rootless BuildKit Jobs. Three opt-ins still build on the
+  // deploying machine and keep a Docker requirement there:
+  // `mesh:hub: { cdn: true }` (the UI's CDN asset build), `mesh:headscale`
+  // (the VPN join broker image) and `mesh:packageRegistry` (the registry-auth
+  // broker image, on unless `broker: false`).
+  // Config: mesh:buildMode: remote + mesh:remoteBuild: { bucket: ..., bucketRegion: ... }
+  buildMode: config.get<"local" | "remote">("buildMode"),
+  remoteBuild: config.getObject("remoteBuild"),
 });
 
 // ============================================================================

package/templates/workflow/index.ts.hbs

@@ -64,5 +64,9 @@ const worker = new mesh.apps.TemporalWorker("worker", {
 // --- Outputs ---
 
 export const app = env.register({
-  description: "{{titleCase name}} — Temporal workflow app",
+  displayName: "{{titleCase name}}",
+  // What a client operator reads on the Apps list. One sentence, their words.
+  description: "Runs {{titleCase name}}'s scheduled and long-running jobs.",
+  // Engineer to engineer; a Hub deployed for a client never serializes it.
+  operatorNote: "Temporal workflow app scaffolded by `mesh create-app --template workflow`.",
 });