@mesh-tech/mesh-cli 0.29.0 → 0.31.0

package/dist/bin/mesh.js

@@ -3892,6 +3892,7 @@ __export(login_exports, {
   REGISTRY_SEPARATE_HINT: () => REGISTRY_SEPARATE_HINT,
   RESERVED_REGISTRY_CONTEXT: () => RESERVED_REGISTRY_CONTEXT,
   accountIdFromRoleArn: () => accountIdFromRoleArn,
+  adoptPublishedHubProject: () => adoptPublishedHubProject,
   atomicWriteFileSync: () => atomicWriteFileSync,
   clearContextConfig: () => clearContextConfig,
   clearCredentials: () => clearCredentials,
@@ -3904,6 +3905,7 @@ __export(login_exports, {
   getContextConfig: () => getContextConfig,
   getValidToken: () => getValidToken,
   isRemoteEnvironment: () => isRemoteEnvironment,
+  loginScopes: () => loginScopes,
   loginTimeoutMessage: () => loginTimeoutMessage,
   probeCredentials: () => probeCredentials,
   readAllContextConfigs: () => readAllContextConfigs,
@@ -3919,7 +3921,9 @@ __export(login_exports, {
   resolveUserAwsConfigPath: () => resolveUserAwsConfigPath,
   runLoginFlow: () => runLoginFlow,
   shorthandContext: () => shorthandContext,
+  tokenAudience: () => tokenAudience,
   tokenStillValid: () => tokenStillValid,
+  withDiscoveredFields: () => withDiscoveredFields,
   writeContextConfig: () => writeContextConfig
 });
 import * as http from "http";
@@ -3927,6 +3931,17 @@ import * as crypto2 from "crypto";
 import * as fs11 from "fs";
 import * as path11 from "path";
 import { execFileSync as execFileSync10 } from "child_process";
+function loginScopes(config) {
+  return config.hubProjectId ? `${BASE_SCOPES} urn:zitadel:iam:org:project:id:${config.hubProjectId}:aud` : BASE_SCOPES;
+}
+function withDiscoveredFields(config, data) {
+  const out = { ...config };
+  for (const key of ["vpn", "vpnJoinBroker", "registryBroker", "hubProjectId"]) {
+    const value = data[key];
+    if (typeof value === "string" && value) out[key] = value;
+  }
+  return out;
+}
 function readConfig() {
   if (!fs11.existsSync(CONFIG_FILE)) return {};
   try {
@@ -3957,12 +3972,12 @@ function parseTenantEnv(context) {
   if (parts.length !== 2 || !parts[0] || !parts[1]) return null;
   return { tenant: parts[0], env: parts[1] };
 }
-async function discoverConfigFromSsm(context) {
+async function discoverConfigFromSsm(context, opts = {}) {
   const parsed = parseTenantEnv(context);
   if (!parsed) return null;
   const { tenant, env } = parsed;
   const ssmPath = `/mesh-platform/${tenant}/${env}/platform/zitadel`;
-  logInfo(`Attempting SSM discovery from ${ssmPath}...`);
+  if (!opts.quiet) logInfo(`Attempting SSM discovery from ${ssmPath}...`);
   try {
     const { SSMClient: SSMClient5, GetParameterCommand: GetParameterCommand2 } = await import("@aws-sdk/client-ssm");
     const region = process.env.AWS_REGION ?? process.env.AWS_DEFAULT_REGION ?? "us-east-2";
@@ -3970,30 +3985,31 @@ async function discoverConfigFromSsm(context) {
     const resp = await ssm.send(new GetParameterCommand2({ Name: ssmPath }));
     const raw = resp.Parameter?.Value;
     if (!raw) {
-      logWarn(`SSM parameter ${ssmPath} has no value`);
+      if (!opts.silent) logWarn(`SSM parameter ${ssmPath} has no value`);
       return null;
     }
     const data = JSON.parse(raw);
     const issuer = data.endpoint;
     const clientId = data.cliClientId;
     if (typeof issuer !== "string" || !issuer) {
-      logWarn("SSM zitadel entry missing 'endpoint' field");
+      if (!opts.silent) logWarn("SSM zitadel entry missing 'endpoint' field");
       return null;
     }
     if (typeof clientId !== "string" || !clientId) {
-      logWarn(
-        "SSM zitadel entry missing 'cliClientId' field.\n  The platform needs to be deployed with an updated ZitadelPlatformIdentity\n  that exports cliClientId. Until then, contact your platform admin."
-      );
+      if (!opts.silent) {
+        logWarn(
+          "SSM zitadel entry missing 'cliClientId' field.\n  The platform needs to be deployed with an updated ZitadelPlatformIdentity\n  that exports cliClientId. Until then, contact your platform admin."
+        );
+      }
       return null;
     }
-    const config = { issuer, clientId };
-    if (typeof data.vpn === "string") config.vpn = data.vpn;
-    if (typeof data.vpnJoinBroker === "string") config.vpnJoinBroker = data.vpnJoinBroker;
-    if (typeof data.registryBroker === "string") config.registryBroker = data.registryBroker;
+    const config = withDiscoveredFields({ issuer, clientId }, data);
+    if (opts.quiet) return config;
     writeContextConfig(context, config);
     logSuccess(`Discovered platform configuration for ${context} via SSM`);
     return config;
   } catch (err) {
+    if (opts.silent) return null;
     const message = err instanceof Error ? err.message : String(err);
     if (message.includes("ExpiredToken") || message.includes("credentials")) {
       logWarn(`SSM discovery failed: AWS credentials expired or unavailable.`);
@@ -4021,26 +4037,24 @@ async function discoverConfig(domain, contextKey = domain, opts = {}) {
     const resp = await fetch(url, { signal: controller.signal });
     clearTimeout(timeout);
     if (!resp.ok) {
-      logWarn(`Discovery endpoint returned ${resp.status}`);
+      if (!opts.silent) logWarn(`Discovery endpoint returned ${resp.status}`);
       return null;
     }
     const data = await resp.json();
     const issuer = data.issuer;
     const clientId = data.clientId;
     if (typeof issuer !== "string" || !issuer || typeof clientId !== "string" || !clientId) {
-      logWarn("Discovery endpoint returned invalid config (missing issuer or clientId)");
+      if (!opts.silent) logWarn("Discovery endpoint returned invalid config (missing issuer or clientId)");
       return null;
     }
-    const config = { issuer, clientId };
-    if (typeof data.vpn === "string") config.vpn = data.vpn;
-    if (typeof data.vpnJoinBroker === "string") config.vpnJoinBroker = data.vpnJoinBroker;
-    if (typeof data.registryBroker === "string") config.registryBroker = data.registryBroker;
+    const config = withDiscoveredFields({ issuer, clientId }, data);
     if (!opts.quiet) {
       writeContextConfig(contextKey, config);
       logSuccess(`Discovered platform configuration for ${contextKey}`);
     }
     return config;
   } catch (err) {
+    if (opts.silent) return null;
     const message = err instanceof Error ? err.message : String(err);
     if (message.includes("abort")) {
       logWarn("Discovery timed out");
@@ -4149,7 +4163,7 @@ function login(context, config) {
     authUrl.searchParams.set("client_id", config.clientId);
     authUrl.searchParams.set("redirect_uri", REDIRECT_URI);
     authUrl.searchParams.set("response_type", "code");
-    authUrl.searchParams.set("scope", SCOPES);
+    authUrl.searchParams.set("scope", loginScopes(config));
     authUrl.searchParams.set("code_challenge", codeChallenge);
     authUrl.searchParams.set("code_challenge_method", "S256");
     authUrl.searchParams.set("state", state);
@@ -4277,7 +4291,7 @@ async function attemptDeviceCode(context, config) {
     headers: { "Content-Type": "application/x-www-form-urlencoded" },
     body: new URLSearchParams({
       client_id: config.clientId,
-      scope: SCOPES
+      scope: loginScopes(config)
     }).toString()
   });
   if (!resp.ok) {
@@ -4499,9 +4513,11 @@ async function showStatus(context, config) {
     return;
   }
   let tenants = [];
+  let audience = [];
   try {
     const accessPayload = decodeJwtPayload(creds.accessToken);
     tenants = accessPayload["urn:mesh:tenants"] ?? [];
+    audience = tokenAudience(accessPayload);
   } catch {
   }
   logSuccess(`Logged in as ${creds.email ?? "unknown"} (${context})`);
@@ -4510,6 +4526,25 @@ async function showStatus(context, config) {
   if (tenants.length > 0) {
     logInfo(`Deployable tenants: ${tenants.join(", ")}`);
   }
+  if (audience.length > 0) {
+    logInfo(`Audience: ${audience.join(", ")}`);
+    if (config.hubProjectId && !audience.includes(config.hubProjectId)) {
+      logWarn(
+        `This session does not carry the Hub project audience (${config.hubProjectId}); a Hub that enforces its audience will refuse it. Re-run: mesh login ${context}`
+      );
+    }
+  }
+  if (!config.hubProjectId) {
+    logInfo(
+      `Hub project: not in this context's discovery record, so this session was requested without a Hub audience \u2014 a Hub that enforces its audience would refuse it. \`mesh login ${context}\` re-checks what the platform publishes.`
+    );
+  }
+}
+function tokenAudience(payload) {
+  const aud = payload.aud;
+  if (typeof aud === "string") return [aud];
+  if (Array.isArray(aud)) return aud.filter((a) => typeof a === "string");
+  return [];
 }
 function registerLoginCommand(program2) {
   program2.command("login").description(
@@ -4560,6 +4595,7 @@ function registerLoginCommand(program2) {
     if (opts.registry === false) {
       logWarn(NO_REGISTRY_DEPRECATED);
     }
+    config = await adoptPublishedHubProject(context, config);
     try {
       await runLoginFlow(context, config, opts);
     } catch (err) {
@@ -4756,8 +4792,9 @@ async function ensureValidToken(context, config, opts) {
   let token = await getValidToken(context);
   if (token) return token;
   logInfo(`No valid Zitadel session for ${context} \u2014 running login flow`);
+  const adopted = await adoptPublishedHubProject(context, config);
   try {
-    await runLoginFlow(context, config, opts);
+    await runLoginFlow(context, adopted, opts);
   } catch (err) {
     logError(`Login failed: ${err.message}`);
     return null;
@@ -4777,23 +4814,34 @@ async function ensureLogin(context, opts = {}) {
   if (!token) return null;
   return readCredentials(context);
 }
-async function discoverConfigGuarded(context) {
+async function discoverConfigGuarded(context, opts = {}) {
   let config = null;
   if (parseTenantEnv(context)) {
-    config = await discoverConfigFromSsm(context);
+    config = await discoverConfigFromSsm(context, opts);
   }
   if (!config) {
     const pinned = firstPartyDomainFor(context);
     if (pinned) {
-      logInfo(`"${context}" is a known Mesh platform \u2014 resolving via ${pinned} (no AWS needed)`);
-      config = await discoverConfig(pinned, context);
+      if (!opts.quiet) {
+        logInfo(`"${context}" is a known Mesh platform \u2014 resolving via ${pinned} (no AWS needed)`);
+      }
+      config = await discoverConfig(pinned, context, opts);
     }
   }
   if (!config && context.split(".").length - 1 >= 2) {
-    config = await discoverConfig(context);
+    config = await discoverConfig(context, context, opts);
   }
   return config;
 }
+async function adoptPublishedHubProject(context, config, discover = discoverConfigGuarded, write = writeContextConfig) {
+  if (config.hubProjectId) return config;
+  const fresh = await discover(context, { quiet: true, silent: true });
+  if (!fresh?.hubProjectId) return config;
+  const merged = { ...config, hubProjectId: fresh.hubProjectId };
+  write(context, merged);
+  logInfo(`${context} publishes its Hub project (${fresh.hubProjectId}) \u2014 requesting the Hub audience for this login`);
+  return merged;
+}
 async function exportAwsCredentials(context, config, opts) {
   const token = await ensureValidToken(context, config, opts);
   if (!token) {
@@ -4914,7 +4962,7 @@ function readAllContextConfigs() {
 async function discoverConfigForContext(context) {
   return getContextConfig(context) ?? await discoverConfigGuarded(context);
 }
-var CONFIG_DIR, CONFIG_FILE, CREDENTIALS_FILE, REDIRECT_PORT, REDIRECT_URI, SCOPES, atomicWriteCounter, MAX_DEVICE_CODES, RESERVED_REGISTRY_CONTEXT, NO_REGISTRY_DEPRECATED, REGISTRY_SEPARATE_HINT;
+var CONFIG_DIR, CONFIG_FILE, CREDENTIALS_FILE, REDIRECT_PORT, REDIRECT_URI, BASE_SCOPES, atomicWriteCounter, MAX_DEVICE_CODES, RESERVED_REGISTRY_CONTEXT, NO_REGISTRY_DEPRECATED, REGISTRY_SEPARATE_HINT;
 var init_login = __esm({
   "libs/mesh-cli/src/commands/login.ts"() {
     "use strict";
@@ -4931,7 +4979,7 @@ var init_login = __esm({
     CREDENTIALS_FILE = path11.join(CONFIG_DIR, "credentials.json");
     REDIRECT_PORT = 9876;
     REDIRECT_URI = `http://localhost:${REDIRECT_PORT}/callback`;
-    SCOPES = "openid email profile offline_access urn:zitadel:iam:org:project:id:zitadel:aud";
+    BASE_SCOPES = "openid email profile offline_access urn:zitadel:iam:org:project:id:zitadel:aud";
     atomicWriteCounter = 0;
     MAX_DEVICE_CODES = 3;
     RESERVED_REGISTRY_CONTEXT = "registry";
@@ -11755,7 +11803,7 @@ function docsSiteFindings(text) {
       findings.push({
         code: "DOCS_SITE_PUBLIC",
         line: decl.line,
-        why: `mesh.apps.${decl.ctor} declares a docs site with ${named} \u2014 retired: a docs site has no hostname, no sign-in and no door switch of its own; it is read inside the Hub through the docs door, and the primitive ignores ${retired.length > 1 ? "them" : "it"}`
+        why: `mesh.apps.${decl.ctor} declares a docs site with ${named} \u2014 deprecated: the Hub docs door is the path this site is published on, and it is already built for it (no hostname, no sign-in and no door switch of its own), so the primitive ignores ${retired.length > 1 ? "them" : "it"}`
       });
     }
     const kindStated = decl.ctor === "AppApiSurface" || decl.ctor === "VendorApiSurface" || args.has("kind");
@@ -11788,7 +11836,7 @@ function docsSiteFindings(text) {
     findings.push({
       code: "DOCS_SITE_PUBLIC",
       line: decl.line,
-      why: `mesh.apps.ApiDocs is published on an ingress \u2014 a docs site has no hostname of its own; it is read inside the Hub through the docs door of the API surface that declares it, and the ingress is retired (it still deploys, with a preview warning, until a coming minor release refuses it)`
+      why: `mesh.apps.ApiDocs is published on an ingress \u2014 deprecated: the Hub docs door is the path a docs site is published on, and it opens for the API surface that declares the site. The hostname still deploys, with a preview warning, as the compatibility path`
     });
   }
   return findings;
@@ -12172,12 +12220,12 @@ var init_app_check = __esm({
       },
       DOCS_SITE_PUBLIC: {
         gate: "0.3",
-        title: "Docs site read through the Hub, not on a hostname of its own",
-        // Advisory while the hostname is deprecated rather than refused: a site
-        // that still deploys on one keeps deploying this release, with a preview
-        // warning, and its tenant CI should say so without going red.
+        title: "Docs site published through the Hub docs door",
+        // Advisory because the public shape is the compatibility path, not a
+        // fault: a site on it keeps deploying, and its tenant CI should read the
+        // route without going red.
         severity: "advisory",
-        remediation: "drop the docs hostname \u2014 a docs site is read inside the Hub through the docs door, which signs every reader in: on an API surface remove docs.ingress (docs.auth, docs.basePath and docs.hubDoor are retired with it); on a mesh.apps.ApiDocs remove the ingress (and its auth / authentication) and declare the API as a mesh.apps.AppApiSurface whose docs block builds the site",
+        remediation: "publish the site through the Hub docs door \u2014 declare the API as a mesh.apps.AppApiSurface whose docs block builds this same site (docs: { spec, pages }), declare its readers' role on the ZitadelAppIdentity and grant it from the Hub's Access tab; then drop the hostname (docs.ingress on an API surface, where docs.auth, docs.basePath and docs.hubDoor do nothing either; the ingress with its auth and authentication on a mesh.apps.ApiDocs). The public shape keeps deploying until you do",
         scope: "app"
       },
       DOCS_AUDIENCE_IMPLICIT: {