@mesh-tech/mesh-cli 0.35.0 → 0.35.1

package/dist/build-info.json

@@ -1,4 +1,4 @@
 {
-  "commit": "cf1f2fb06",
-  "builtAt": "2026-09-25T19:28:25.368Z"
+  "commit": "7e553d060",
+  "builtAt": "2026-09-29T02:18:34.716Z"
 }

package/dist/src/commands/app-check.js

@@ -75,7 +75,7 @@ export const APP_CHECK_RULES = {
         gate: "H",
         title: "No role grants in IaC",
         severity: "block",
-        remediation: "remove the per-user grant map; grant roles from the Hub (App → Access → People)",
+        remediation: "remove the per-user grant map; grant roles from the Hub (App → Access → Users)",
         scope: "app",
     },
     POINTER_PROJECT_OVERRIDE: {
@@ -762,7 +762,7 @@ export function scanApp(root, appRel, resolution = probeResolution(root, appRel)
         for (const f of files)
             hit(code, rel(root, f), why);
     };
-    anti("IAC_GRANTS", RE_IAC_GRANT, "per-user role grant baked into IaC — grants belong in the Hub (Access → People), not in a config redeploy");
+    anti("IAC_GRANTS", RE_IAC_GRANT, "per-user role grant baked into IaC — grants belong in the Hub (Access → Users), not in a config redeploy");
     anti("POINTER_PROJECT_OVERRIDE", RE_POINTER_OVERRIDE, "AppAuthzPointer is given a `zitadel:` override — an app binds its project with AppEnvironment's zitadelAppProjectId so every consumer of env.zitadel agrees; the override is reserved for the Hub");
     anti("PASSWORD_STORE", RE_PASSWORD, "password storage or hashing — Zitadel owns credentials; the Hub creates sign-in users with a one-time temporary password");
     anti("EMAIL_ALLOWLIST", RE_ALLOWLIST, "email allowlist standing in for roles — declare a role and let the Hub grant it");

package/fragments/base/index.ts.hbs

@@ -205,7 +205,7 @@ const worker = new mesh.apps.TemporalWorker("worker", {
 // shape: it still deploys, for the sites that are public today, and warns at
 // every preview. This declaration names none of it, and a new app needs
 // none. The site's readers hold this app's `docs` project role: declare the
-// role on the ZitadelAppIdentity and grant it from Access → People; that same
+// role on the ZitadelAppIdentity and grant it from Access → Users; that same
 // role is what the Hub reads when a partner holding the Hub's `docs:<tenant>`
 // role opens this app's Docs tab, and the app then appears in their Apps list.
 // `mesh app check` flags a docs site put on an ingress instead

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mesh-tech/mesh-cli",
-  "version": "0.35.0",
+  "version": "0.35.1",
   "description": "CLI for Mesh platform development utilities",
   "type": "module",
   "license": "UNLICENSED",
@@ -42,7 +42,7 @@
   },
   "devDependencies": {
     "@mesh-tech/agent-contracts": "0.2.0",
-    "@mesh-tech/tsconfig": "2.34.0",
+    "@mesh-tech/tsconfig": "2.35.0",
     "@mesh-tech/workflow-viz": "0.3.1",
     "@tanstack/intent": "^0.3.6",
     "@types/node": "^20.0.0",

package/templates/api-auth/api/src/schema.ts.hbs

@@ -36,4 +36,7 @@ export const schema = defineSchema({
   },
   coarseRoles: ["user"] as const,
   zitadelSync: "coarse",
+  // A protected Admin — every action on every resource, locked in the Hub —
+  // is one bundle with `admin: true` and no `grants`. Assigning it
+  // tenant-wide needs an `isRoot` resource the others `parent`-link to.
 });