@mesh-tech/mesh-cli 0.34.1 → 0.34.3

package/dist/src/index.js

@@ -1,4 +1,4 @@
-// libs/mesh-cli/src/utils/errors.ts
+// packages/mesh-cli/src/utils/errors.ts
 import chalk from "chalk";
 var MeshCliError = class extends Error {
   remediation;
@@ -55,7 +55,7 @@ function handleCliError(err) {
   process.exit(err instanceof MeshCliError ? err.exitCode : 1);
 }
 
-// libs/mesh-cli/src/utils/log.ts
+// packages/mesh-cli/src/utils/log.ts
 import chalk2 from "chalk";
 function logPrefix(opts) {
   const enabled = opts.envFlag === "1" || opts.envFlag !== "0" && !opts.isTTY;
@@ -107,11 +107,11 @@ function startHeartbeat(label, intervalMs = 15e3) {
   };
 }
 
-// libs/mesh-cli/src/utils/context.ts
+// packages/mesh-cli/src/utils/context.ts
 import * as fs2 from "fs";
 import * as path2 from "path";
 
-// libs/mesh-cli/src/utils/mesh-json.ts
+// packages/mesh-cli/src/utils/mesh-json.ts
 import * as fs from "fs";
 import * as path from "path";
 var MESH_JSON = "mesh.json";
@@ -149,7 +149,7 @@ function findMeshJson(startDir) {
   }
 }
 
-// libs/mesh-cli/src/utils/context.ts
+// packages/mesh-cli/src/utils/context.ts
 function findFileUpwardInRepo(filename, startDir = process.cwd()) {
   let currentDir = startDir;
   const root = path2.parse(currentDir).root;
@@ -459,7 +459,7 @@ function detectContext(stageArg, options = {}) {
   return { tenant, stage, platformEnv, detectedTenant };
 }
 
-// libs/mesh-cli/src/utils/bastion.ts
+// packages/mesh-cli/src/utils/bastion.ts
 import { SSMClient, GetParameterCommand } from "@aws-sdk/client-ssm";
 async function getPlatformBastionInfo(tenant, platformEnv, region) {
   const ssm = new SSMClient(region ? { region } : {});
@@ -543,7 +543,7 @@ async function getBastionInfo(tenant, platformEnv) {
   };
 }
 
-// libs/mesh-cli/src/utils/credentials.ts
+// packages/mesh-cli/src/utils/credentials.ts
 import {
   SecretsManagerClient,
   GetSecretValueCommand
@@ -647,7 +647,7 @@ async function readSstOutputs() {
   return null;
 }
 
-// libs/mesh-cli/src/utils/pulumi.ts
+// packages/mesh-cli/src/utils/pulumi.ts
 import { execFileSync } from "child_process";
 import * as path3 from "path";
 import * as fs3 from "fs";
@@ -713,7 +713,7 @@ function pulumiStackOutput(appRoot, key, extraArgs, env) {
   }
 }
 
-// libs/mesh-cli/src/utils/vpn.ts
+// packages/mesh-cli/src/utils/vpn.ts
 import { execFile, execFileSync as execFileSync2 } from "node:child_process";
 import { existsSync as existsSync4 } from "node:fs";
 var TAILSCALE_PATHS = [

package/dist/src/utils/temporal-codec.js

@@ -1,8 +1,8 @@
-// libs/mesh-cli/src/utils/temporal-codec.ts
+// packages/mesh-cli/src/utils/temporal-codec.ts
 import { execFileSync } from "child_process";
 import { webcrypto as crypto } from "node:crypto";
 
-// libs/mesh-cli/src/utils/log.ts
+// packages/mesh-cli/src/utils/log.ts
 import chalk from "chalk";
 function logPrefix(opts) {
   const enabled = opts.envFlag === "1" || opts.envFlag !== "0" && !opts.isTTY;
@@ -24,7 +24,7 @@ function logWarn(message) {
   console.error(prefix() + chalk.yellow("\u26A0"), message);
 }
 
-// libs/mesh-cli/src/utils/temporal-codec.ts
+// packages/mesh-cli/src/utils/temporal-codec.ts
 function resolveTemporalEncodingKeyFromK8s(namespace) {
   const secretName = `${namespace}-temporal-encoding-key`;
   try {

package/package.json

@@ -1,13 +1,13 @@
 {
   "name": "@mesh-tech/mesh-cli",
-  "version": "0.34.1",
+  "version": "0.34.3",
   "description": "CLI for Mesh platform development utilities",
   "type": "module",
   "license": "UNLICENSED",
   "repository": {
     "type": "git",
     "url": "https://github.com/mesh-tech/mesh-platform.git",
-    "directory": "libs/mesh-cli"
+    "directory": "packages/mesh-cli"
   },
   "bin": {
     "mesh": "./dist/bin/mesh.js"
@@ -42,8 +42,8 @@
   },
   "devDependencies": {
     "@mesh-tech/agent-contracts": "0.2.0",
-    "@mesh-tech/tsconfig": "2.29.0",
-    "@mesh-tech/workflow-viz": "0.3.0",
+    "@mesh-tech/tsconfig": "2.31.0",
+    "@mesh-tech/workflow-viz": "0.3.1",
     "@tanstack/intent": "^0.3.6",
     "@types/node": "^20.0.0",
     "tsx": "^4.20.4"

package/skills/core/SKILL.md

@@ -378,7 +378,7 @@ mesh artifacts get <id>:<artifactId> --target fub
 
 `--target` resolves the same `~/.config/mesh/agent-targets.json` registry the
 MCP `agent_*` tools use; see the dedicated
-`libs/mesh-cli/skills/pull-remote-agent-context` skill for the full recipe
+`packages/mesh-cli/skills/pull-remote-agent-context` skill for the full recipe
 (registry format, auth model, the `conversation_unavailable` → `mesh temporal
 recover-conversation` break-glass path, and the MCP-vs-CLI relationship).
 

package/skills/pull-remote-agent-context/SKILL.md

@@ -187,7 +187,7 @@ fub | jq ...`) rather than pass `--json` — output auto-detects non-TTY.
 
 ## See also
 
-- `libs/mesh-cli/skills/core/SKILL.md` — full `mesh` command reference,
+- `packages/mesh-cli/skills/core/SKILL.md` — full `mesh` command reference,
   including the `conversations`/`artifacts`/`temporal` rows this skill
   builds on.
 - `packages/agent-remote/agent-targets.example.json` — a worked registry

package/templates/api-auth/README.md.hbs

@@ -57,6 +57,10 @@ proxy (`auth: { provider: "mesh" }`). The proxy pins its sign-in callback to
 that Service's own ingress hostname; a Service that answers for more than one
 hostname (`ingress.extraHostnames`) sets `auth.deriveRedirectUrl: true` so each
 host gets its own callback, and registers a redirect URI per host at the IdP.
+The proxy keeps each session in its cookie, which grows with the user's roles;
+once a user holds enough of them the load balancer rejects every request with a
+`400`. `auth.sessionStore: "redis"` keeps sessions in a small Redis the Service
+creates for itself, so the cookie stays under 1KB.
 
 `index.ts` owns the whole access surface, so there is nothing to create by
 hand: `ZitadelAppIdentity` makes the app's Zitadel project + roles,