@mesh-tech/mesh-cli 0.35.0 → 0.35.2

package/dist/src/utils/aws-auth.js

@@ -151,16 +151,83 @@ function toEnv(credentials) {
         AWS_SESSION_TOKEN: SessionToken,
     };
 }
-function isMaxSessionDurationError(err) {
-    if (!(err instanceof Error))
+export const ROLE_CHAINING_MAX_SESSION_SECONDS = 3600;
+export const DEFAULT_ASSUME_ROLE_SECONDS = 43200;
+export function isRoleChainedCaller(callerArn) {
+    return !!callerArn && /^arn:aws[a-z-]*:sts::\d+:assumed-role\//.test(callerArn);
+}
+export function stsErrorDetail(err) {
+    if (!err || typeof err !== "object")
+        return { text: String(err) };
+    const e = err;
+    const str = (v) => (typeof v === "string" && v ? v : undefined);
+    const name = str(e.name);
+    const typeCode = str(str(e.__type)?.split("#").pop());
+    const code = str(e.Code) ??
+        typeCode ??
+        str(e.Error?.Code) ??
+        (name && name !== "Error" ? name : undefined);
+    const text = str(e.Error?.Message) ?? str(e.Message) ?? str(e.message) ?? code ?? String(err);
+    return { code, text };
+}
+export function isSessionDurationError(err) {
+    if (!err || typeof err !== "object")
+        return false;
+    const { code, text } = stsErrorDetail(err);
+    if (code !== undefined && code !== "ValidationError")
         return false;
-    const message = err.message ?? "";
-    return (message.includes("MaxSessionDuration") ||
-        message.includes("DurationSeconds"));
+    return /DurationSeconds|MaxSessionDuration|role chaining/i.test(text);
 }
-export async function assumeRole(roleArn, sessionName = "mesh-cli", durationSeconds = 43200) {
-    const sts = newStsClient();
-    for (const duration of [durationSeconds, 3600]) {
+function formatDuration(seconds) {
+    return seconds % 3600 === 0 ? `${seconds / 3600}h` : `${seconds}s`;
+}
+export function describeAssumeRoleFailure(opts) {
+    const reason = opts.code && opts.code !== opts.text ? `${opts.code}: ${opts.text}` : opts.text;
+    const lines = [
+        `AssumeRole failed for ${opts.roleArn} — requested a ` +
+            `${formatDuration(opts.durationSeconds)} session (DurationSeconds=${opts.durationSeconds}): ${reason}`,
+    ];
+    if (opts.callerArn)
+        lines.push(`  Caller: ${opts.callerArn}`);
+    const zitadel = `mesh login ${opts.loginContext ?? "<platform>.<env>"}`;
+    if (isExpiredAwsTokenMessage(`${opts.code ?? ""} ${opts.text}`)) {
+        lines.push(`  Your AWS SSO session looks expired or missing — refresh with: ${SSO_LOGIN_FIX}`);
+        lines.push(`  Or assume the role via Zitadel instead: ${zitadel}`);
+    }
+    else if (opts.code === "AccessDenied" || /not authorized/i.test(opts.text)) {
+        lines.push("  The role does not trust this AWS identity. Assume it via Zitadel instead:");
+        lines.push(`    ${zitadel}`);
+        lines.push("  or switch to an AWS profile the role's trust policy allows.");
+    }
+    else if (isSessionDurationError({ Code: opts.code, message: opts.text })) {
+        lines.push(`  The role refused even a ${formatDuration(ROLE_CHAINING_MAX_SESSION_SECONDS)} session. ` +
+            "Check its MaxSessionDuration, or assume it via Zitadel instead:");
+        lines.push(`    ${zitadel}`);
+    }
+    else {
+        lines.push(`  Try assuming the role via Zitadel: ${zitadel}`);
+        lines.push(`  or refresh the AWS session: ${SSO_LOGIN_FIX}`);
+    }
+    return lines.join("\n");
+}
+export async function assumeRole(roleArn, sessionName = "mesh-cli", durationSeconds = DEFAULT_ASSUME_ROLE_SECONDS, options = {}) {
+    const sts = options.sts ?? newStsClient();
+    let callerArn;
+    try {
+        callerArn = (await sts.send(new GetCallerIdentityCommand({}))).Arn;
+    }
+    catch {
+    }
+    let requested = durationSeconds;
+    if (isRoleChainedCaller(callerArn) && requested > ROLE_CHAINING_MAX_SESSION_SECONDS) {
+        requested = ROLE_CHAINING_MAX_SESSION_SECONDS;
+        logInfo(`Current AWS identity is an assumed-role session — requesting a ` +
+            `${formatDuration(requested)} session (role chaining caps AssumeRole at one hour)`);
+    }
+    const attempts = requested > ROLE_CHAINING_MAX_SESSION_SECONDS
+        ? [requested, ROLE_CHAINING_MAX_SESSION_SECONDS]
+        : [requested];
+    for (const [i, duration] of attempts.entries()) {
         try {
             const resp = await sts.send(new AssumeRoleCommand({
                 RoleArn: roleArn,
@@ -172,14 +239,22 @@ export async function assumeRole(roleArn, sessionName = "mesh-cli", durationSeco
             return toEnv(resp.Credentials);
         }
         catch (err) {
-            if (!isMaxSessionDurationError(err) || duration === 3600) {
-                const message = err instanceof Error ? err.message : String(err);
-                logWarn(`AssumeRole failed: ${message}`);
-                if (isExpiredAwsTokenMessage(message)) {
-                    logWarn(`  Your AWS SSO session looks expired or missing — refresh with: ${SSO_LOGIN_FIX}`);
-                }
-                return null;
+            const isLast = i === attempts.length - 1;
+            if (!isLast && isSessionDurationError(err)) {
+                logInfo(`STS refused a ${formatDuration(duration)} session for ${roleArn} — ` +
+                    `retrying with ${formatDuration(ROLE_CHAINING_MAX_SESSION_SECONDS)}`);
+                continue;
             }
+            const { code, text } = stsErrorDetail(err);
+            logWarn(describeAssumeRoleFailure({
+                roleArn,
+                durationSeconds: duration,
+                code,
+                text,
+                callerArn,
+                loginContext: options.loginContext,
+            }));
+            return null;
         }
     }
     return null;
@@ -207,8 +282,9 @@ export async function assumeRoleCredentials(roleArn, idToken, sessionName, durat
             };
         }
         catch (err) {
-            if (!isMaxSessionDurationError(err) || duration === 3600) {
-                logWarn(`AssumeRoleWithWebIdentity failed: ${err instanceof Error ? err.message : String(err)}`);
+            if (!isSessionDurationError(err) || duration === ROLE_CHAINING_MAX_SESSION_SECONDS) {
+                const { code, text } = stsErrorDetail(err);
+                logWarn(`AssumeRoleWithWebIdentity failed: ${code && code !== text ? `${code}: ${text}` : text}`);
                 return null;
             }
         }
@@ -340,7 +416,9 @@ export async function resolveAwsCredentials(roleArn, appRoot, stack) {
         }
     }
     logInfo(`Assuming ${roleName} via AWS SSO`);
-    const creds = await assumeRole(roleArn, "mesh-cli");
+    const creds = await assumeRole(roleArn, "mesh-cli", DEFAULT_ASSUME_ROLE_SECONDS, {
+        loginContext: platformContext ?? undefined,
+    });
     if (creds) {
         logSuccess(`Assumed ${roleName}`);
         return { env: creds, method: "sso" };

package/fragments/base/index.ts.hbs

@@ -112,8 +112,9 @@ const config = new mesh.apps.AppConfig("config", {
 // Events and webhooks: the service, its own database, an app-scoped KMS key
 // for endpoint credentials, the publisher key, the Zitadel introspection app,
 // the delivery task queue, the worker registration that lists the app's
-// Temporal namespace on the Hub's Workflows page, and the registry surface —
-// all children of this one declaration.
+// Temporal namespace on the Hub's Workflows page (with the service's own
+// housekeeping workflows marked internal, so only staff see them there), and
+// the registry surface — all children of this one declaration.
 //
 // Its database's schema migration gates the deploy: `pulumi up` waits for the
 // migration Job and fails when it fails, and the service's pods are held until
@@ -171,6 +172,9 @@ const api = new mesh.apps.Service("api", {
   // Drives readiness, liveness and the Hub uptime sampler on BOTH ingress kinds.
   // `ingress.healthCheckPath` sets the ALB target group's path only, and a
   // gateway (HTTPRoute) tenant has no target group — so the path belongs here.
+  // A boot that can outlast the liveness window (a busy node, a tight CPU
+  // limit) takes `healthCheck: { path: "/health", startup: {} }`: a startup
+  // probe that holds liveness for up to five minutes of boot.
   healthCheck: "/health",
   replicas: deploy ? 2 : 1,
   resources: { cpu: "100m", memory: "128Mi" },
@@ -205,7 +209,7 @@ const worker = new mesh.apps.TemporalWorker("worker", {
 // shape: it still deploys, for the sites that are public today, and warns at
 // every preview. This declaration names none of it, and a new app needs
 // none. The site's readers hold this app's `docs` project role: declare the
-// role on the ZitadelAppIdentity and grant it from Access → People; that same
+// role on the ZitadelAppIdentity and grant it from Access → Users; that same
 // role is what the Hub reads when a partner holding the Hub's `docs:<tenant>`
 // role opens this app's Docs tab, and the app then appears in their Apps list.
 // `mesh app check` flags a docs site put on an ingress instead
@@ -219,7 +223,10 @@ const worker = new mesh.apps.TemporalWorker("worker", {
 // Hub on the ports it published and refuses it on every other one, so a
 // registry entry cannot walk the Hub onto a port the surface never opened.
 // Nothing here declares that — it rides the surface (`hubDialPolicy`, on by
-// default wherever the namespace is in the service mesh).
+// default wherever the namespace is in the service mesh). A surface fronting
+// a vendor the tenant already declares names that declaration with
+// `externalService`; its registry entry publishes the name, and the Hub reads
+// the app's Core connection from the vendor's shared health measurement.
 // =============================================================================
 
 new mesh.apps.ApiDocs("docs", {

package/fragments/service/api/package.json.hbs

@@ -17,10 +17,8 @@
     "@aws-sdk/client-s3": "^3.700.0",
 {{/if}}
     "@hono/node-server": "^1.13.0",
-    "@mesh-tech/logger": "{{#if workspaceDeps}}workspace:*{{else}}{{meshRange}}{{/if}}",
-{{#if temporal}}
     "@mesh-tech/app-kit": "{{#if workspaceDeps}}workspace:*{{else}}{{meshRange}}{{/if}}",
-{{/if}}
+    "@mesh-tech/logger": "{{#if workspaceDeps}}workspace:*{{else}}{{meshRange}}{{/if}}",
 {{#if database}}
     "@prisma/adapter-pg": "^6.0.0",
     "@prisma/client": "^6.0.0",

package/fragments/service/api/src/index.ts.hbs

@@ -19,6 +19,7 @@
 
 import { Hono } from "hono";
 import { serve } from "@hono/node-server";
+import { configureServerKeepAlive } from "@mesh-tech/app-kit/outbound-http";
 import { createLogger, requestLogger } from "@mesh-tech/logger";
 {{#if temporal}}
 import { createTemporalClient } from "@mesh-tech/app-kit/temporal-client";
@@ -82,6 +83,13 @@ app.post("/things", async (c) => {
 
 {{/if}}
 // Start server
-serve({ fetch: app.fetch, port: PORT, hostname: "0.0.0.0" }, (info) => {
-  log.info({ port: info.port }, "{{titleCase name}} API listening");
-});
+// Hold idle keep-alive sockets for 75s rather than Node's 5s default. The
+// proxy in front of this service pools connections to it and keeps them idle
+// longer than 5s (the Istio gateway's Envoy, through ztunnel, or an ALB for
+// 60s), so at the default the server keeps closing sockets the pool may be
+// about to reuse.
+configureServerKeepAlive(
+  serve({ fetch: app.fetch, port: PORT, hostname: "0.0.0.0" }, (info) => {
+    log.info({ port: info.port }, "{{titleCase name}} API listening");
+  }),
+);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mesh-tech/mesh-cli",
-  "version": "0.35.0",
+  "version": "0.35.2",
   "description": "CLI for Mesh platform development utilities",
   "type": "module",
   "license": "UNLICENSED",
@@ -42,7 +42,7 @@
   },
   "devDependencies": {
     "@mesh-tech/agent-contracts": "0.2.0",
-    "@mesh-tech/tsconfig": "2.34.0",
+    "@mesh-tech/tsconfig": "2.36.0",
     "@mesh-tech/workflow-viz": "0.3.1",
     "@tanstack/intent": "^0.3.6",
     "@types/node": "^20.0.0",

package/templates/api-auth/api/package.json.hbs

@@ -11,6 +11,7 @@
     "seed:authz": "tsx scripts/seed-authz.ts"
   },
   "dependencies": {
+    "@mesh-tech/app-kit": "latest",
     "@mesh-tech/authn": "latest",
     "@mesh-tech/authz": "latest",
     "@mesh-tech/logger": "latest",

package/templates/api-auth/api/src/index.ts.hbs

@@ -15,6 +15,7 @@
 
 import { Hono } from "hono";
 import { serve } from "@hono/node-server";
+import { configureServerKeepAlive } from "@mesh-tech/app-kit/outbound-http";
 import { createAuthn } from "@mesh-tech/authn";
 import { zitadelJwtScheme } from "@mesh-tech/authn/schemes/zitadel-jwt";
 import { createAuthnMiddleware, type AuthnVariables } from "@mesh-tech/authn/hono";
@@ -102,6 +103,13 @@ app.get("/api/report", m.require("report", "view", { id: () => "quarterly" }), (
   c.json({ id: "quarterly", title: "Quarterly Report", classification: "internal" }),
 );
 
-serve({ fetch: app.fetch, port: PORT }, () => {
-  log.info({ port: PORT, issuer: ZITADEL_ISSUER }, "{{name}} api listening");
-});
+// Hold idle keep-alive sockets for 75s rather than Node's 5s default. The
+// proxy in front of this service pools connections to it and keeps them idle
+// longer than 5s (the Istio gateway's Envoy, through ztunnel, or an ALB for
+// 60s), so at the default the server keeps closing sockets the pool may be
+// about to reuse.
+configureServerKeepAlive(
+  serve({ fetch: app.fetch, port: PORT }, () => {
+    log.info({ port: PORT, issuer: ZITADEL_ISSUER }, "{{name}} api listening");
+  }),
+);

package/templates/api-auth/api/src/schema.ts.hbs

@@ -36,4 +36,7 @@ export const schema = defineSchema({
   },
   coarseRoles: ["user"] as const,
   zitadelSync: "coarse",
+  // A protected Admin — every action on every resource, locked in the Hub —
+  // is one bundle with `admin: true` and no `grants`. Assigning it
+  // tenant-wide needs an `isRoot` resource the others `parent`-link to.
 });

package/templates/api-auth/index.ts.hbs

@@ -109,6 +109,9 @@ const api = new mesh.apps.Service("api", {
   // Drives readiness, liveness and the Hub uptime sampler on BOTH ingress kinds.
   // `ingress.healthCheckPath` sets the ALB target group's path only, and a
   // gateway (HTTPRoute) tenant has no target group — so the path belongs here.
+  // A boot that can outlast the liveness window (a busy node, a tight CPU
+  // limit) takes `healthCheck: { path: "/health", startup: {} }`: a startup
+  // probe that holds liveness for up to five minutes of boot.
   healthCheck: "/health",
   replicas: 1,
   resources: { cpu: "100m", memory: "128Mi" },

package/templates/api-role-gating/api/package.json.hbs

@@ -14,6 +14,7 @@
     "check-types": "tsc --noEmit"
   },
   "dependencies": {
+    "@mesh-tech/app-kit": "latest",
     "@mesh-tech/authn": "latest",
     "@mesh-tech/authz": "latest",
     "@mesh-tech/logger": "latest",

package/templates/api-role-gating/api/src/main.ts.hbs

@@ -8,6 +8,7 @@
  */
 import { serve } from "@hono/node-server";
 import { Hono } from "hono";
+import { configureServerKeepAlive } from "@mesh-tech/app-kit/outbound-http";
 import { createAuthnMiddleware, type AuthnVariables } from "@mesh-tech/authn/hono";
 import { createAuthzMiddleware, type AuthzVariables } from "@mesh-tech/authz/hono";
 import { createLogger, requestLogger } from "@mesh-tech/logger";
@@ -58,6 +59,11 @@ export const createApp = (deps: { testAuth?: TestAuth } = {}) => {
 
 if (process.env.NODE_ENV !== "test" && process.argv[1]?.endsWith("main.js")) {
   const port = Number(process.env.PORT ?? 3000);
-  serve({ fetch: createApp().fetch, port });
+  // Hold idle keep-alive sockets for 75s rather than Node's 5s default. The
+  // proxy in front of this service pools connections to it and keeps them idle
+  // longer than 5s (the Istio gateway's Envoy, through ztunnel, or an ALB for
+  // 60s), so at the default the server keeps closing sockets the pool may be
+  // about to reuse.
+  configureServerKeepAlive(serve({ fetch: createApp().fetch, port }));
   log.info({ port, mode: "role-gating" }, "{{name}} api listening");
 }

package/templates/api-role-gating/index.ts.hbs

@@ -85,6 +85,9 @@ const api = new mesh.apps.Service("api", {
   // Drives readiness, liveness and the Hub uptime sampler on BOTH ingress kinds.
   // `ingress.healthCheckPath` sets the ALB target group's path only, and a
   // gateway (HTTPRoute) tenant has no target group — so the path belongs here.
+  // A boot that can outlast the liveness window (a busy node, a tight CPU
+  // limit) takes `healthCheck: { path: "/health", startup: {} }`: a startup
+  // probe that holds liveness for up to five minutes of boot.
   healthCheck: "/health",
   replicas: 1,
   resources: { cpu: "100m", memory: "128Mi" },

package/templates/external-service/api/src/index.ts.hbs

@@ -17,6 +17,7 @@
 import { serve } from "@hono/node-server";
 import { Hono } from "hono";
 import { resolveCredentials } from "@mesh-tech/app-kit/credentials";
+import { configureServerKeepAlive } from "@mesh-tech/app-kit/outbound-http";
 import { traceExternalCall } from "@mesh-tech/app-kit/tracing";
 import { enhanceFetch } from "@mesh-tech/http-client";
 import { createLogger, requestLogger } from "@mesh-tech/logger";
@@ -81,6 +82,13 @@ app.post("/payments/quote", async (c) => {
 });
 
 const port = Number(process.env.PORT ?? 3000);
-serve({ fetch: app.fetch, port }, () => {
-  log.info({ port }, "{{titleCase name}} API listening");
-});
+// Hold idle keep-alive sockets for 75s rather than Node's 5s default. The
+// proxy in front of this service pools connections to it and keeps them idle
+// longer than 5s (the Istio gateway's Envoy, through ztunnel, or an ALB for
+// 60s), so at the default the server keeps closing sockets the pool may be
+// about to reuse.
+configureServerKeepAlive(
+  serve({ fetch: app.fetch, port }, () => {
+    log.info({ port }, "{{titleCase name}} API listening");
+  }),
+);

package/templates/external-service/index.ts.hbs

@@ -75,6 +75,9 @@ const api = new mesh.apps.Service("api", {
   // Drives readiness, liveness and the Hub uptime sampler on BOTH ingress kinds.
   // `ingress.healthCheckPath` sets the ALB target group's path only, and a
   // gateway (HTTPRoute) tenant has no target group — so the path belongs here.
+  // A boot that can outlast the liveness window (a busy node, a tight CPU
+  // limit) takes `healthCheck: { path: "/health", startup: {} }`: a startup
+  // probe that holds liveness for up to five minutes of boot.
   healthCheck: "/health",
   replicas: 1,
   resources: { cpu: "100m", memory: "128Mi" },

package/templates/workflow/api/src/index.ts.hbs

@@ -11,6 +11,7 @@
 
 import { Hono } from "hono";
 import { serve } from "@hono/node-server";
+import { configureServerKeepAlive } from "@mesh-tech/app-kit/outbound-http";
 import { createTemporalClient, type WithClient } from "@mesh-tech/app-kit/temporal-client";
 import { createLogger, requestLogger } from "@mesh-tech/logger";
 
@@ -125,9 +126,16 @@ app.get("/workflows/:id", async (c) => {
 // Start server
 initClient()
   .then(() => {
-    serve({ fetch: app.fetch, port: PORT, hostname: "0.0.0.0" }, () => {
-      log.info({ port: PORT }, "{{titleCase name}} API listening");
-    });
+    // Hold idle keep-alive sockets for 75s rather than Node's 5s default. The
+    // proxy in front of this service pools connections to it and keeps them idle
+    // longer than 5s (the Istio gateway's Envoy, through ztunnel, or an ALB for
+    // 60s), so at the default the server keeps closing sockets the pool may be
+    // about to reuse.
+    configureServerKeepAlive(
+      serve({ fetch: app.fetch, port: PORT, hostname: "0.0.0.0" }, () => {
+        log.info({ port: PORT }, "{{titleCase name}} API listening");
+      }),
+    );
   })
   .catch((err) => {
     log.error({ err }, "Failed to initialize");

package/templates/workflow/index.ts.hbs

@@ -47,6 +47,9 @@ const api = new mesh.apps.Service("api", {
   // Drives readiness, liveness and the Hub uptime sampler on BOTH ingress kinds.
   // `ingress.healthCheckPath` sets the ALB target group's path only, and a
   // gateway (HTTPRoute) tenant has no target group — so the path belongs here.
+  // A boot that can outlast the liveness window (a busy node, a tight CPU
+  // limit) takes `healthCheck: { path: "/health", startup: {} }`: a startup
+  // probe that holds liveness for up to five minutes of boot.
   healthCheck: "/health",
   replicas: 1,
   resources: { cpu: "100m", memory: "128Mi" },