@mesh-tech/mesh-cli 0.35.1 → 0.36.0

package/dist/src/utils/aws-auth.js

@@ -151,16 +151,83 @@ function toEnv(credentials) {
         AWS_SESSION_TOKEN: SessionToken,
     };
 }
-function isMaxSessionDurationError(err) {
-    if (!(err instanceof Error))
+export const ROLE_CHAINING_MAX_SESSION_SECONDS = 3600;
+export const DEFAULT_ASSUME_ROLE_SECONDS = 43200;
+export function isRoleChainedCaller(callerArn) {
+    return !!callerArn && /^arn:aws[a-z-]*:sts::\d+:assumed-role\//.test(callerArn);
+}
+export function stsErrorDetail(err) {
+    if (!err || typeof err !== "object")
+        return { text: String(err) };
+    const e = err;
+    const str = (v) => (typeof v === "string" && v ? v : undefined);
+    const name = str(e.name);
+    const typeCode = str(str(e.__type)?.split("#").pop());
+    const code = str(e.Code) ??
+        typeCode ??
+        str(e.Error?.Code) ??
+        (name && name !== "Error" ? name : undefined);
+    const text = str(e.Error?.Message) ?? str(e.Message) ?? str(e.message) ?? code ?? String(err);
+    return { code, text };
+}
+export function isSessionDurationError(err) {
+    if (!err || typeof err !== "object")
+        return false;
+    const { code, text } = stsErrorDetail(err);
+    if (code !== undefined && code !== "ValidationError")
         return false;
-    const message = err.message ?? "";
-    return (message.includes("MaxSessionDuration") ||
-        message.includes("DurationSeconds"));
+    return /DurationSeconds|MaxSessionDuration|role chaining/i.test(text);
 }
-export async function assumeRole(roleArn, sessionName = "mesh-cli", durationSeconds = 43200) {
-    const sts = newStsClient();
-    for (const duration of [durationSeconds, 3600]) {
+function formatDuration(seconds) {
+    return seconds % 3600 === 0 ? `${seconds / 3600}h` : `${seconds}s`;
+}
+export function describeAssumeRoleFailure(opts) {
+    const reason = opts.code && opts.code !== opts.text ? `${opts.code}: ${opts.text}` : opts.text;
+    const lines = [
+        `AssumeRole failed for ${opts.roleArn} — requested a ` +
+            `${formatDuration(opts.durationSeconds)} session (DurationSeconds=${opts.durationSeconds}): ${reason}`,
+    ];
+    if (opts.callerArn)
+        lines.push(`  Caller: ${opts.callerArn}`);
+    const zitadel = `mesh login ${opts.loginContext ?? "<platform>.<env>"}`;
+    if (isExpiredAwsTokenMessage(`${opts.code ?? ""} ${opts.text}`)) {
+        lines.push(`  Your AWS SSO session looks expired or missing — refresh with: ${SSO_LOGIN_FIX}`);
+        lines.push(`  Or assume the role via Zitadel instead: ${zitadel}`);
+    }
+    else if (opts.code === "AccessDenied" || /not authorized/i.test(opts.text)) {
+        lines.push("  The role does not trust this AWS identity. Assume it via Zitadel instead:");
+        lines.push(`    ${zitadel}`);
+        lines.push("  or switch to an AWS profile the role's trust policy allows.");
+    }
+    else if (isSessionDurationError({ Code: opts.code, message: opts.text })) {
+        lines.push(`  The role refused even a ${formatDuration(ROLE_CHAINING_MAX_SESSION_SECONDS)} session. ` +
+            "Check its MaxSessionDuration, or assume it via Zitadel instead:");
+        lines.push(`    ${zitadel}`);
+    }
+    else {
+        lines.push(`  Try assuming the role via Zitadel: ${zitadel}`);
+        lines.push(`  or refresh the AWS session: ${SSO_LOGIN_FIX}`);
+    }
+    return lines.join("\n");
+}
+export async function assumeRole(roleArn, sessionName = "mesh-cli", durationSeconds = DEFAULT_ASSUME_ROLE_SECONDS, options = {}) {
+    const sts = options.sts ?? newStsClient();
+    let callerArn;
+    try {
+        callerArn = (await sts.send(new GetCallerIdentityCommand({}))).Arn;
+    }
+    catch {
+    }
+    let requested = durationSeconds;
+    if (isRoleChainedCaller(callerArn) && requested > ROLE_CHAINING_MAX_SESSION_SECONDS) {
+        requested = ROLE_CHAINING_MAX_SESSION_SECONDS;
+        logInfo(`Current AWS identity is an assumed-role session — requesting a ` +
+            `${formatDuration(requested)} session (role chaining caps AssumeRole at one hour)`);
+    }
+    const attempts = requested > ROLE_CHAINING_MAX_SESSION_SECONDS
+        ? [requested, ROLE_CHAINING_MAX_SESSION_SECONDS]
+        : [requested];
+    for (const [i, duration] of attempts.entries()) {
         try {
             const resp = await sts.send(new AssumeRoleCommand({
                 RoleArn: roleArn,
@@ -172,14 +239,22 @@ export async function assumeRole(roleArn, sessionName = "mesh-cli", durationSeco
             return toEnv(resp.Credentials);
         }
         catch (err) {
-            if (!isMaxSessionDurationError(err) || duration === 3600) {
-                const message = err instanceof Error ? err.message : String(err);
-                logWarn(`AssumeRole failed: ${message}`);
-                if (isExpiredAwsTokenMessage(message)) {
-                    logWarn(`  Your AWS SSO session looks expired or missing — refresh with: ${SSO_LOGIN_FIX}`);
-                }
-                return null;
+            const isLast = i === attempts.length - 1;
+            if (!isLast && isSessionDurationError(err)) {
+                logInfo(`STS refused a ${formatDuration(duration)} session for ${roleArn} — ` +
+                    `retrying with ${formatDuration(ROLE_CHAINING_MAX_SESSION_SECONDS)}`);
+                continue;
             }
+            const { code, text } = stsErrorDetail(err);
+            logWarn(describeAssumeRoleFailure({
+                roleArn,
+                durationSeconds: duration,
+                code,
+                text,
+                callerArn,
+                loginContext: options.loginContext,
+            }));
+            return null;
         }
     }
     return null;
@@ -207,8 +282,9 @@ export async function assumeRoleCredentials(roleArn, idToken, sessionName, durat
             };
         }
         catch (err) {
-            if (!isMaxSessionDurationError(err) || duration === 3600) {
-                logWarn(`AssumeRoleWithWebIdentity failed: ${err instanceof Error ? err.message : String(err)}`);
+            if (!isSessionDurationError(err) || duration === ROLE_CHAINING_MAX_SESSION_SECONDS) {
+                const { code, text } = stsErrorDetail(err);
+                logWarn(`AssumeRoleWithWebIdentity failed: ${code && code !== text ? `${code}: ${text}` : text}`);
                 return null;
             }
         }
@@ -340,7 +416,9 @@ export async function resolveAwsCredentials(roleArn, appRoot, stack) {
         }
     }
     logInfo(`Assuming ${roleName} via AWS SSO`);
-    const creds = await assumeRole(roleArn, "mesh-cli");
+    const creds = await assumeRole(roleArn, "mesh-cli", DEFAULT_ASSUME_ROLE_SECONDS, {
+        loginContext: platformContext ?? undefined,
+    });
     if (creds) {
         logSuccess(`Assumed ${roleName}`);
         return { env: creds, method: "sso" };

package/dist/src/utils/scaffold-versions.d.ts

@@ -2,6 +2,7 @@ export declare const SCAFFOLD_PACKAGE_LINES: {
     readonly "@mesh-tech/app-kit": "^1.45.0";
     readonly "@mesh-tech/esm-bundle": "^0.1.1";
     readonly "@mesh-tech/events-service": "^0.1.0";
+    readonly "@mesh-tech/events-ui": "^0.1.0";
     readonly "@mesh-tech/authz": "^1.19.0";
 };
 export type ScaffoldPackage = keyof typeof SCAFFOLD_PACKAGE_LINES;

package/dist/src/utils/scaffold-versions.js

@@ -3,6 +3,7 @@ export const SCAFFOLD_PACKAGE_LINES = {
     "@mesh-tech/app-kit": "^1.45.0",
     "@mesh-tech/esm-bundle": "^0.1.1",
     "@mesh-tech/events-service": "^0.1.0",
+    "@mesh-tech/events-ui": "^0.1.0",
     "@mesh-tech/authz": "^1.19.0",
 };
 export const SCAFFOLD_TOOLCHAIN = {

package/fragments/base/index.ts.hbs

@@ -112,8 +112,11 @@ const config = new mesh.apps.AppConfig("config", {
 // Events and webhooks: the service, its own database, an app-scoped KMS key
 // for endpoint credentials, the publisher key, the Zitadel introspection app,
 // the delivery task queue, the worker registration that lists the app's
-// Temporal namespace on the Hub's Workflows page, and the registry surface —
-// all children of this one declaration.
+// Temporal namespace on the Hub's Workflows page (with the service's own
+// housekeeping workflows marked internal, so only staff see them there), the
+// registry surface, and the operator UI (`@mesh-tech/events-ui`, installed in
+// package.json) as its own signed-in Service at `{app}-events-ui` — all
+// children of this one declaration.
 //
 // Its database's schema migration gates the deploy: `pulumi up` waits for the
 // migration Job and fails when it fails, and the service's pods are held until
@@ -126,7 +129,7 @@ const config = new mesh.apps.AppConfig("config", {
 // that as "use the default".
 const events = new mesh.apps.EventsService("events", {
   env,
-  identity: { connector, projectId: identity.projectId },
+  identity: { connector, projectId: identity.projectId, dependsOn: [identity] },
   config,
   // "thin" sends identifiers only, so nothing the API would mask reaches a
   // third-party endpoint and the consumer follows the identifiers back to the
@@ -171,6 +174,9 @@ const api = new mesh.apps.Service("api", {
   // Drives readiness, liveness and the Hub uptime sampler on BOTH ingress kinds.
   // `ingress.healthCheckPath` sets the ALB target group's path only, and a
   // gateway (HTTPRoute) tenant has no target group — so the path belongs here.
+  // A boot that can outlast the liveness window (a busy node, a tight CPU
+  // limit) takes `healthCheck: { path: "/health", startup: {} }`: a startup
+  // probe that holds liveness for up to five minutes of boot.
   healthCheck: "/health",
   replicas: deploy ? 2 : 1,
   resources: { cpu: "100m", memory: "128Mi" },
@@ -219,7 +225,10 @@ const worker = new mesh.apps.TemporalWorker("worker", {
 // Hub on the ports it published and refuses it on every other one, so a
 // registry entry cannot walk the Hub onto a port the surface never opened.
 // Nothing here declares that — it rides the surface (`hubDialPolicy`, on by
-// default wherever the namespace is in the service mesh).
+// default wherever the namespace is in the service mesh). A surface fronting
+// a vendor the tenant already declares names that declaration with
+// `externalService`; its registry entry publishes the name, and the Hub reads
+// the app's Core connection from the vendor's shared health measurement.
 // =============================================================================
 
 new mesh.apps.ApiDocs("docs", {

package/fragments/base/package.json.hbs

@@ -12,6 +12,7 @@
 {{#if events}}
     "@mesh-tech/authz": "{{#if workspaceDeps}}workspace:*{{else}}{{authzRange}}{{/if}}",
     "@mesh-tech/events-service": "{{#if workspaceDeps}}workspace:*{{else}}{{eventsServiceRange}}{{/if}}",
+    "@mesh-tech/events-ui": "{{#if workspaceDeps}}workspace:*{{else}}{{eventsUiRange}}{{/if}}",
 {{/if}}
     "@mesh-tech/infra-components": "{{#if workspaceDeps}}workspace:*{{else}}{{meshRange}}{{/if}}",
 {{#if events}}

package/fragments/service/api/package.json.hbs

@@ -17,10 +17,8 @@
     "@aws-sdk/client-s3": "^3.700.0",
 {{/if}}
     "@hono/node-server": "^1.13.0",
-    "@mesh-tech/logger": "{{#if workspaceDeps}}workspace:*{{else}}{{meshRange}}{{/if}}",
-{{#if temporal}}
     "@mesh-tech/app-kit": "{{#if workspaceDeps}}workspace:*{{else}}{{meshRange}}{{/if}}",
-{{/if}}
+    "@mesh-tech/logger": "{{#if workspaceDeps}}workspace:*{{else}}{{meshRange}}{{/if}}",
 {{#if database}}
     "@prisma/adapter-pg": "^6.0.0",
     "@prisma/client": "^6.0.0",

package/fragments/service/api/src/index.ts.hbs

@@ -19,6 +19,7 @@
 
 import { Hono } from "hono";
 import { serve } from "@hono/node-server";
+import { configureServerKeepAlive } from "@mesh-tech/app-kit/outbound-http";
 import { createLogger, requestLogger } from "@mesh-tech/logger";
 {{#if temporal}}
 import { createTemporalClient } from "@mesh-tech/app-kit/temporal-client";
@@ -82,6 +83,13 @@ app.post("/things", async (c) => {
 
 {{/if}}
 // Start server
-serve({ fetch: app.fetch, port: PORT, hostname: "0.0.0.0" }, (info) => {
-  log.info({ port: info.port }, "{{titleCase name}} API listening");
-});
+// Hold idle keep-alive sockets for 75s rather than Node's 5s default. The
+// proxy in front of this service pools connections to it and keeps them idle
+// longer than 5s (the Istio gateway's Envoy, through ztunnel, or an ALB for
+// 60s), so at the default the server keeps closing sockets the pool may be
+// about to reuse.
+configureServerKeepAlive(
+  serve({ fetch: app.fetch, port: PORT, hostname: "0.0.0.0" }, (info) => {
+    log.info({ port: info.port }, "{{titleCase name}} API listening");
+  }),
+);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mesh-tech/mesh-cli",
-  "version": "0.35.1",
+  "version": "0.36.0",
   "description": "CLI for Mesh platform development utilities",
   "type": "module",
   "license": "UNLICENSED",
@@ -42,7 +42,7 @@
   },
   "devDependencies": {
     "@mesh-tech/agent-contracts": "0.2.0",
-    "@mesh-tech/tsconfig": "2.35.0",
+    "@mesh-tech/tsconfig": "2.37.0",
     "@mesh-tech/workflow-viz": "0.3.1",
     "@tanstack/intent": "^0.3.6",
     "@types/node": "^20.0.0",

package/templates/api-auth/api/package.json.hbs

@@ -11,6 +11,7 @@
     "seed:authz": "tsx scripts/seed-authz.ts"
   },
   "dependencies": {
+    "@mesh-tech/app-kit": "latest",
     "@mesh-tech/authn": "latest",
     "@mesh-tech/authz": "latest",
     "@mesh-tech/logger": "latest",

package/templates/api-auth/api/src/index.ts.hbs

@@ -15,6 +15,7 @@
 
 import { Hono } from "hono";
 import { serve } from "@hono/node-server";
+import { configureServerKeepAlive } from "@mesh-tech/app-kit/outbound-http";
 import { createAuthn } from "@mesh-tech/authn";
 import { zitadelJwtScheme } from "@mesh-tech/authn/schemes/zitadel-jwt";
 import { createAuthnMiddleware, type AuthnVariables } from "@mesh-tech/authn/hono";
@@ -102,6 +103,13 @@ app.get("/api/report", m.require("report", "view", { id: () => "quarterly" }), (
   c.json({ id: "quarterly", title: "Quarterly Report", classification: "internal" }),
 );
 
-serve({ fetch: app.fetch, port: PORT }, () => {
-  log.info({ port: PORT, issuer: ZITADEL_ISSUER }, "{{name}} api listening");
-});
+// Hold idle keep-alive sockets for 75s rather than Node's 5s default. The
+// proxy in front of this service pools connections to it and keeps them idle
+// longer than 5s (the Istio gateway's Envoy, through ztunnel, or an ALB for
+// 60s), so at the default the server keeps closing sockets the pool may be
+// about to reuse.
+configureServerKeepAlive(
+  serve({ fetch: app.fetch, port: PORT }, () => {
+    log.info({ port: PORT, issuer: ZITADEL_ISSUER }, "{{name}} api listening");
+  }),
+);

package/templates/api-auth/index.ts.hbs

@@ -109,6 +109,9 @@ const api = new mesh.apps.Service("api", {
   // Drives readiness, liveness and the Hub uptime sampler on BOTH ingress kinds.
   // `ingress.healthCheckPath` sets the ALB target group's path only, and a
   // gateway (HTTPRoute) tenant has no target group — so the path belongs here.
+  // A boot that can outlast the liveness window (a busy node, a tight CPU
+  // limit) takes `healthCheck: { path: "/health", startup: {} }`: a startup
+  // probe that holds liveness for up to five minutes of boot.
   healthCheck: "/health",
   replicas: 1,
   resources: { cpu: "100m", memory: "128Mi" },

package/templates/api-role-gating/api/package.json.hbs

@@ -14,6 +14,7 @@
     "check-types": "tsc --noEmit"
   },
   "dependencies": {
+    "@mesh-tech/app-kit": "latest",
     "@mesh-tech/authn": "latest",
     "@mesh-tech/authz": "latest",
     "@mesh-tech/logger": "latest",

package/templates/api-role-gating/api/src/main.ts.hbs

@@ -8,6 +8,7 @@
  */
 import { serve } from "@hono/node-server";
 import { Hono } from "hono";
+import { configureServerKeepAlive } from "@mesh-tech/app-kit/outbound-http";
 import { createAuthnMiddleware, type AuthnVariables } from "@mesh-tech/authn/hono";
 import { createAuthzMiddleware, type AuthzVariables } from "@mesh-tech/authz/hono";
 import { createLogger, requestLogger } from "@mesh-tech/logger";
@@ -58,6 +59,11 @@ export const createApp = (deps: { testAuth?: TestAuth } = {}) => {
 
 if (process.env.NODE_ENV !== "test" && process.argv[1]?.endsWith("main.js")) {
   const port = Number(process.env.PORT ?? 3000);
-  serve({ fetch: createApp().fetch, port });
+  // Hold idle keep-alive sockets for 75s rather than Node's 5s default. The
+  // proxy in front of this service pools connections to it and keeps them idle
+  // longer than 5s (the Istio gateway's Envoy, through ztunnel, or an ALB for
+  // 60s), so at the default the server keeps closing sockets the pool may be
+  // about to reuse.
+  configureServerKeepAlive(serve({ fetch: createApp().fetch, port }));
   log.info({ port, mode: "role-gating" }, "{{name}} api listening");
 }

package/templates/api-role-gating/index.ts.hbs

@@ -85,6 +85,9 @@ const api = new mesh.apps.Service("api", {
   // Drives readiness, liveness and the Hub uptime sampler on BOTH ingress kinds.
   // `ingress.healthCheckPath` sets the ALB target group's path only, and a
   // gateway (HTTPRoute) tenant has no target group — so the path belongs here.
+  // A boot that can outlast the liveness window (a busy node, a tight CPU
+  // limit) takes `healthCheck: { path: "/health", startup: {} }`: a startup
+  // probe that holds liveness for up to five minutes of boot.
   healthCheck: "/health",
   replicas: 1,
   resources: { cpu: "100m", memory: "128Mi" },

package/templates/external-service/api/src/index.ts.hbs

@@ -17,6 +17,7 @@
 import { serve } from "@hono/node-server";
 import { Hono } from "hono";
 import { resolveCredentials } from "@mesh-tech/app-kit/credentials";
+import { configureServerKeepAlive } from "@mesh-tech/app-kit/outbound-http";
 import { traceExternalCall } from "@mesh-tech/app-kit/tracing";
 import { enhanceFetch } from "@mesh-tech/http-client";
 import { createLogger, requestLogger } from "@mesh-tech/logger";
@@ -81,6 +82,13 @@ app.post("/payments/quote", async (c) => {
 });
 
 const port = Number(process.env.PORT ?? 3000);
-serve({ fetch: app.fetch, port }, () => {
-  log.info({ port }, "{{titleCase name}} API listening");
-});
+// Hold idle keep-alive sockets for 75s rather than Node's 5s default. The
+// proxy in front of this service pools connections to it and keeps them idle
+// longer than 5s (the Istio gateway's Envoy, through ztunnel, or an ALB for
+// 60s), so at the default the server keeps closing sockets the pool may be
+// about to reuse.
+configureServerKeepAlive(
+  serve({ fetch: app.fetch, port }, () => {
+    log.info({ port }, "{{titleCase name}} API listening");
+  }),
+);

package/templates/external-service/index.ts.hbs

@@ -75,6 +75,9 @@ const api = new mesh.apps.Service("api", {
   // Drives readiness, liveness and the Hub uptime sampler on BOTH ingress kinds.
   // `ingress.healthCheckPath` sets the ALB target group's path only, and a
   // gateway (HTTPRoute) tenant has no target group — so the path belongs here.
+  // A boot that can outlast the liveness window (a busy node, a tight CPU
+  // limit) takes `healthCheck: { path: "/health", startup: {} }`: a startup
+  // probe that holds liveness for up to five minutes of boot.
   healthCheck: "/health",
   replicas: 1,
   resources: { cpu: "100m", memory: "128Mi" },

package/templates/workflow/api/src/index.ts.hbs

@@ -11,6 +11,7 @@
 
 import { Hono } from "hono";
 import { serve } from "@hono/node-server";
+import { configureServerKeepAlive } from "@mesh-tech/app-kit/outbound-http";
 import { createTemporalClient, type WithClient } from "@mesh-tech/app-kit/temporal-client";
 import { createLogger, requestLogger } from "@mesh-tech/logger";
 
@@ -125,9 +126,16 @@ app.get("/workflows/:id", async (c) => {
 // Start server
 initClient()
   .then(() => {
-    serve({ fetch: app.fetch, port: PORT, hostname: "0.0.0.0" }, () => {
-      log.info({ port: PORT }, "{{titleCase name}} API listening");
-    });
+    // Hold idle keep-alive sockets for 75s rather than Node's 5s default. The
+    // proxy in front of this service pools connections to it and keeps them idle
+    // longer than 5s (the Istio gateway's Envoy, through ztunnel, or an ALB for
+    // 60s), so at the default the server keeps closing sockets the pool may be
+    // about to reuse.
+    configureServerKeepAlive(
+      serve({ fetch: app.fetch, port: PORT, hostname: "0.0.0.0" }, () => {
+        log.info({ port: PORT }, "{{titleCase name}} API listening");
+      }),
+    );
   })
   .catch((err) => {
     log.error({ err }, "Failed to initialize");

package/templates/workflow/index.ts.hbs

@@ -47,6 +47,9 @@ const api = new mesh.apps.Service("api", {
   // Drives readiness, liveness and the Hub uptime sampler on BOTH ingress kinds.
   // `ingress.healthCheckPath` sets the ALB target group's path only, and a
   // gateway (HTTPRoute) tenant has no target group — so the path belongs here.
+  // A boot that can outlast the liveness window (a busy node, a tight CPU
+  // limit) takes `healthCheck: { path: "/health", startup: {} }`: a startup
+  // probe that holds liveness for up to five minutes of boot.
   healthCheck: "/health",
   replicas: 1,
   resources: { cpu: "100m", memory: "128Mi" },