@mesh-tech/mesh-cli 0.33.0 → 0.34.0

package/dist/build-info.json

@@ -1,4 +1,4 @@
 {
-  "commit": "b286e1b11",
-  "builtAt": "2026-09-22T20:38:52.960Z"
+  "commit": "1e6a7cc8e",
+  "builtAt": "2026-09-22T21:56:57.206Z"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mesh-tech/mesh-cli",
-  "version": "0.33.0",
+  "version": "0.34.0",
   "description": "CLI for Mesh platform development utilities",
   "type": "module",
   "license": "UNLICENSED",
@@ -42,7 +42,7 @@
   },
   "devDependencies": {
     "@mesh-tech/agent-contracts": "0.2.0",
-    "@mesh-tech/tsconfig": "2.27.0",
+    "@mesh-tech/tsconfig": "2.28.0",
     "@mesh-tech/workflow-viz": "0.3.0",
     "@tanstack/intent": "^0.3.6",
     "@types/node": "^20.0.0",

package/templates/api-auth/README.md.hbs

@@ -61,7 +61,12 @@ host gets its own callback, and registers a redirect URI per host at the IdP.
 `index.ts` owns the whole access surface, so there is nothing to create by
 hand: `ZitadelAppIdentity` makes the app's Zitadel project + roles,
 `SpiceDBSchema` compiles `api/src/schema.ts` into the app's own SpiceDB and
-publishes the ops-hub metadata, and `AppAuthzPointer` tells the Hub where to
+publishes the ops-hub metadata — `mesh deploy up` blocks on that Job and fails
+when it fails, so a green deploy means the schema is live. On a cold first
+deploy the Job can lose the race to SpiceDB's own startup and gives up on
+`backoffLimit`, well inside `timeoutMinutes`; `awaitCompletion: false` is the
+lever for that, not a larger `timeoutMinutes`, which does not extend the
+retries. `AppAuthzPointer` tells the Hub where to
 look. People, roles, API keys and sign-in activity are then administered from
 the Hub's **App → Access** tab — never by a runbook step. The contract behind
 that: `@mesh-tech/app-kit#apps` → `references/app-contract.md`; `mesh app

package/templates/api-auth/index.ts.hbs

@@ -72,6 +72,13 @@ const spicedb = new mesh.auth.SpiceDB("spicedb", { env, httpEnabled: true });
 // --- 5. Schema — compile, apply, and publish the ops-hub metadata. ---
 // `opsHubMetadataRef` is the SSM path the pointer below hands to the Hub; without
 // it the Hub's create-key and role catalog answer 409 METADATA_UNPUBLISHED.
+// `mesh deploy up` blocks on the schema-write Job and fails when it fails —
+// every permission check this API makes reads what that Job wrote, so a write
+// that never landed is not a deploy that succeeded. On a cold first deploy the
+// Job can lose the race to SpiceDB's own startup: it retries on backoffLimit
+// and gives up well inside timeoutMinutes, never running for the full budget.
+// If that is your estate, set `awaitCompletion: false` here rather than
+// raising `timeoutMinutes`, which does not extend the retries.
 const schema = new mesh.auth.SpiceDBSchema("schema", {
   env,
   spicedb,