@mesh-tech/mesh-cli 0.40.12 → 0.40.14

package/dist/build-info.json

@@ -1,4 +1,4 @@
 {
-  "commit": "cab0be1b3",
-  "builtAt": "2026-10-26T03:07:11.014Z"
+  "commit": "e6b9e3bce",
+  "builtAt": "2026-10-27T06:37:07.474Z"
 }

package/fragments/base/index.ts.hbs

@@ -95,6 +95,8 @@ const env = new mesh.apps.AppEnvironment("env", {
 // =============================================================================
 {{#if database}}
 
+// Its password reaches the pods through the namespace's own secret store
+// (`mesh-secrets`), which can read this app's secrets and no other app's.
 const db = new mesh.apps.Database("db", { env });
 {{/if}}
 {{#if bucket}}

package/fragments/service/api/src/index.ts.hbs

@@ -83,13 +83,16 @@ app.post("/things", async (c) => {
 
 {{/if}}
 // Start server
+const server = serve({ fetch: app.fetch, port: PORT, hostname: "0.0.0.0" }, (info) => {
+  log.info({ port: info.port }, "{{titleCase name}} API listening");
+});
 // Hold idle keep-alive sockets for 75s rather than Node's 5s default. The
 // proxy in front of this service pools connections to it and keeps them idle
 // longer than 5s (the Istio gateway's Envoy, through ztunnel, or an ALB for
 // 60s), so at the default the server keeps closing sockets the pool may be
 // about to reuse.
-configureServerKeepAlive(
-  serve({ fetch: app.fetch, port: PORT, hostname: "0.0.0.0" }, (info) => {
-    log.info({ port: info.port }, "{{titleCase name}} API listening");
-  }),
-);
+configureServerKeepAlive(server);
+// The deployed image runs node as PID 1, where SIGTERM has no default action:
+// without this listener a pod Kubernetes stops runs on until SIGKILL. Stop
+// taking connections, let in-flight requests finish, then exit.
+process.on("SIGTERM", () => server.close(() => process.exit(0)));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mesh-tech/mesh-cli",
-  "version": "0.40.12",
+  "version": "0.40.14",
   "description": "CLI for Mesh platform development utilities",
   "type": "module",
   "license": "UNLICENSED",
@@ -42,7 +42,7 @@
   },
   "devDependencies": {
     "@mesh-tech/agent-contracts": "0.7.0",
-    "@mesh-tech/tsconfig": "2.50.3",
+    "@mesh-tech/tsconfig": "2.51.3",
     "@mesh-tech/workflow-viz": "0.3.2",
     "@tanstack/intent": "^0.3.6",
     "@types/node": "^20.0.0",

package/templates/api-auth/api/src/index.ts.hbs

@@ -103,13 +103,16 @@ app.get("/api/report", m.require("report", "view", { id: () => "quarterly" }), (
   c.json({ id: "quarterly", title: "Quarterly Report", classification: "internal" }),
 );
 
+const server = serve({ fetch: app.fetch, port: PORT }, () => {
+  log.info({ port: PORT, issuer: ZITADEL_ISSUER }, "{{name}} api listening");
+});
 // Hold idle keep-alive sockets for 75s rather than Node's 5s default. The
 // proxy in front of this service pools connections to it and keeps them idle
 // longer than 5s (the Istio gateway's Envoy, through ztunnel, or an ALB for
 // 60s), so at the default the server keeps closing sockets the pool may be
 // about to reuse.
-configureServerKeepAlive(
-  serve({ fetch: app.fetch, port: PORT }, () => {
-    log.info({ port: PORT, issuer: ZITADEL_ISSUER }, "{{name}} api listening");
-  }),
-);
+configureServerKeepAlive(server);
+// The deployed image runs node as PID 1, where SIGTERM has no default action:
+// without this listener a pod Kubernetes stops runs on until SIGKILL. Stop
+// taking connections, let in-flight requests finish, then exit.
+process.on("SIGTERM", () => server.close(() => process.exit(0)));

package/templates/api-role-gating/api/src/main.ts.hbs

@@ -59,11 +59,16 @@ export const createApp = (deps: { testAuth?: TestAuth } = {}) => {
 
 if (process.env.NODE_ENV !== "test" && process.argv[1]?.endsWith("main.js")) {
   const port = Number(process.env.PORT ?? 3000);
+  const server = serve({ fetch: createApp().fetch, port });
   // Hold idle keep-alive sockets for 75s rather than Node's 5s default. The
   // proxy in front of this service pools connections to it and keeps them idle
   // longer than 5s (the Istio gateway's Envoy, through ztunnel, or an ALB for
   // 60s), so at the default the server keeps closing sockets the pool may be
   // about to reuse.
-  configureServerKeepAlive(serve({ fetch: createApp().fetch, port }));
+  configureServerKeepAlive(server);
+  // The deployed image runs node as PID 1, where SIGTERM has no default action:
+  // without this listener a pod Kubernetes stops runs on until SIGKILL. Stop
+  // taking connections, let in-flight requests finish, then exit.
+  process.on("SIGTERM", () => server.close(() => process.exit(0)));
   log.info({ port, mode: "role-gating" }, "{{name}} api listening");
 }

package/templates/external-service/api/src/index.ts.hbs

@@ -82,13 +82,16 @@ app.post("/payments/quote", async (c) => {
 });
 
 const port = Number(process.env.PORT ?? 3000);
+const server = serve({ fetch: app.fetch, port }, () => {
+  log.info({ port }, "{{titleCase name}} API listening");
+});
 // Hold idle keep-alive sockets for 75s rather than Node's 5s default. The
 // proxy in front of this service pools connections to it and keeps them idle
 // longer than 5s (the Istio gateway's Envoy, through ztunnel, or an ALB for
 // 60s), so at the default the server keeps closing sockets the pool may be
 // about to reuse.
-configureServerKeepAlive(
-  serve({ fetch: app.fetch, port }, () => {
-    log.info({ port }, "{{titleCase name}} API listening");
-  }),
-);
+configureServerKeepAlive(server);
+// The deployed image runs node as PID 1, where SIGTERM has no default action:
+// without this listener a pod Kubernetes stops runs on until SIGKILL. Stop
+// taking connections, let in-flight requests finish, then exit.
+process.on("SIGTERM", () => server.close(() => process.exit(0)));

package/templates/workflow/api/src/index.ts.hbs

@@ -126,16 +126,19 @@ app.get("/workflows/:id", async (c) => {
 // Start server
 initClient()
   .then(() => {
+    const server = serve({ fetch: app.fetch, port: PORT, hostname: "0.0.0.0" }, () => {
+      log.info({ port: PORT }, "{{titleCase name}} API listening");
+    });
     // Hold idle keep-alive sockets for 75s rather than Node's 5s default. The
     // proxy in front of this service pools connections to it and keeps them idle
     // longer than 5s (the Istio gateway's Envoy, through ztunnel, or an ALB for
     // 60s), so at the default the server keeps closing sockets the pool may be
     // about to reuse.
-    configureServerKeepAlive(
-      serve({ fetch: app.fetch, port: PORT, hostname: "0.0.0.0" }, () => {
-        log.info({ port: PORT }, "{{titleCase name}} API listening");
-      }),
-    );
+    configureServerKeepAlive(server);
+    // The deployed image runs node as PID 1, where SIGTERM has no default action:
+    // without this listener a pod Kubernetes stops runs on until SIGKILL. Stop
+    // taking connections, let in-flight requests finish, then exit.
+    process.on("SIGTERM", () => server.close(() => process.exit(0)));
   })
   .catch((err) => {
     log.error({ err }, "Failed to initialize");