@mesh-tech/mesh-cli 0.30.0 → 0.31.0

package/dist/bin/mesh.js

@@ -11803,7 +11803,7 @@ function docsSiteFindings(text) {
       findings.push({
         code: "DOCS_SITE_PUBLIC",
         line: decl.line,
-        why: `mesh.apps.${decl.ctor} declares a docs site with ${named} \u2014 retired: a docs site has no hostname, no sign-in and no door switch of its own; it is read inside the Hub through the docs door, and the primitive ignores ${retired.length > 1 ? "them" : "it"}`
+        why: `mesh.apps.${decl.ctor} declares a docs site with ${named} \u2014 deprecated: the Hub docs door is the path this site is published on, and it is already built for it (no hostname, no sign-in and no door switch of its own), so the primitive ignores ${retired.length > 1 ? "them" : "it"}`
       });
     }
     const kindStated = decl.ctor === "AppApiSurface" || decl.ctor === "VendorApiSurface" || args.has("kind");
@@ -11836,7 +11836,7 @@ function docsSiteFindings(text) {
     findings.push({
       code: "DOCS_SITE_PUBLIC",
       line: decl.line,
-      why: `mesh.apps.ApiDocs is published on an ingress \u2014 a docs site has no hostname of its own; it is read inside the Hub through the docs door of the API surface that declares it, and the ingress is retired (it still deploys, with a preview warning, until a coming minor release refuses it)`
+      why: `mesh.apps.ApiDocs is published on an ingress \u2014 deprecated: the Hub docs door is the path a docs site is published on, and it opens for the API surface that declares the site. The hostname still deploys, with a preview warning, as the compatibility path`
     });
   }
   return findings;
@@ -12220,12 +12220,12 @@ var init_app_check = __esm({
       },
       DOCS_SITE_PUBLIC: {
         gate: "0.3",
-        title: "Docs site read through the Hub, not on a hostname of its own",
-        // Advisory while the hostname is deprecated rather than refused: a site
-        // that still deploys on one keeps deploying this release, with a preview
-        // warning, and its tenant CI should say so without going red.
+        title: "Docs site published through the Hub docs door",
+        // Advisory because the public shape is the compatibility path, not a
+        // fault: a site on it keeps deploying, and its tenant CI should read the
+        // route without going red.
         severity: "advisory",
-        remediation: "drop the docs hostname \u2014 a docs site is read inside the Hub through the docs door, which signs every reader in: on an API surface remove docs.ingress (docs.auth, docs.basePath and docs.hubDoor are retired with it); on a mesh.apps.ApiDocs remove the ingress (and its auth / authentication) and declare the API as a mesh.apps.AppApiSurface whose docs block builds the site",
+        remediation: "publish the site through the Hub docs door \u2014 declare the API as a mesh.apps.AppApiSurface whose docs block builds this same site (docs: { spec, pages }), declare its readers' role on the ZitadelAppIdentity and grant it from the Hub's Access tab; then drop the hostname (docs.ingress on an API surface, where docs.auth, docs.basePath and docs.hubDoor do nothing either; the ingress with its auth and authentication on a mesh.apps.ApiDocs). The public shape keeps deploying until you do",
         scope: "app"
       },
       DOCS_AUDIENCE_IMPLICIT: {