@mesh-tech/mesh-cli 0.40.15 → 0.42.0

package/dist/build-info.json

@@ -1,4 +1,4 @@
 {
-  "commit": "f87d57532",
-  "builtAt": "2026-10-27T11:09:28.720Z"
+  "commit": "bb94fb407",
+  "builtAt": "2026-10-28T07:09:16.812Z"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mesh-tech/mesh-cli",
-  "version": "0.40.15",
+  "version": "0.42.0",
   "description": "CLI for Mesh platform development utilities",
   "type": "module",
   "license": "UNLICENSED",
@@ -42,8 +42,8 @@
   },
   "devDependencies": {
     "@mesh-tech/agent-contracts": "0.7.0",
-    "@mesh-tech/tsconfig": "2.53.0",
-    "@mesh-tech/workflow-viz": "0.3.2",
+    "@mesh-tech/tsconfig": "2.57.0",
+    "@mesh-tech/workflow-viz": "0.3.4",
     "@tanstack/intent": "^0.3.6",
     "@types/node": "^20.0.0",
     "@types/react": "^19.1.8",

package/skills/mesh/SKILL.md

@@ -371,7 +371,7 @@ Pulumi stack name — a stack called `dev-jane` still deploys against the `dev`
 platform and so assumes `…-dev-apps-deployer`. The distinction is load-bearing
 beyond the role name: the deployer's KMS-alias grant is scoped to
 `alias/{tenant}-{env}-*`, so an app that creates an alias has to prefix it the
-same way. See [Naming resources so the deployer can create them](https://github.com/mesh-tech/mesh-platform/blob/main/libs/infra-components/docs/concepts/deploying.md#naming-resources-so-the-deployer-can-create-them).
+same way. See [Naming resources so the deployer can create them](https://github.com/mesh-tech/mesh-platform/blob/main/packages/infra-components/docs/concepts/deploying.md#naming-resources-so-the-deployer-can-create-them).
 
 ### 5. Database access
 

package/templates/platform-repo/core/Pulumi.{{tenant}}-{{env}}.yaml.hbs

@@ -75,6 +75,20 @@ config:
       certificate: true # wildcard ACM cert for HTTPS ingress
       waitForValidation: false # don't block the deploy on a delegation you have not done yet
 
+  # Platform email (optional): the one address Zitadel, Grafana, Alertmanager
+  # and apps send from, over Amazon SES. Verify the sender's domain in SES and
+  # request SES production access first, once per AWS account. Guide:
+  # node_modules/@mesh-tech/infra-components/docs/guides/platform-email.md
+  # mesh:email: {}               # from ops@meshtech.io, in this stack's region
+  # mesh:email:
+  #   from: ops@{{domain}}
+
+  # The stack's administrators (optional), by email: the Hub makes them its
+  # administrators, and alerts that name no recipient reach them. Unset is the
+  # platform's default list; a list replaces it, and [] means none.
+  # mesh:admins:
+  #   - admin@{{domain}}
+
   # Peering with another tenant's core (optional):
   # mesh:peering:
   #   peerWith:

package/templates/platform-repo/core/index.ts

@@ -26,6 +26,7 @@ const awsAccountId = callerIdentity.accountId;
 // - EKS cluster (if eks config provided)
 // - RDS instance (if rds config provided)
 // - Peering IAM role (if peering.allowPeeringFrom provided)
+// - The platform's email sender (if mesh:email is set)
 // - Auto-exports to SSM: /mesh/{tenant}/{env}/core
 //
 
@@ -46,6 +47,10 @@ const meshCore = new mesh.layers.MeshCore("core", {
   serviceMesh: config.get("serviceMesh") === "false" ? false : config.getObject("serviceMesh"),
   // Secrets (set via: pulumi config set --secret mesh:newRelicLicenseKey <key>)
   newRelicLicenseKey: config.getSecret("newRelicLicenseKey"),
+  // The platform's sender (mesh:email); unset leaves email off.
+  email: config.getObject("email"),
+  // The stack's administrators (mesh:admins); unset is the default list.
+  admins: config.getObject("admins"),
 });
 
 // ============================================================================