@mesh-tech/mesh-cli 0.40.3 → 0.40.5

package/dist/build-info.json

@@ -1,4 +1,4 @@
 {
-  "commit": "da9049b18",
-  "builtAt": "2026-10-19T17:09:34.921Z"
+  "commit": "50b326b85",
+  "builtAt": "2026-10-19T21:38:19.079Z"
 }

package/fragments/base/index.ts.hbs

@@ -33,6 +33,12 @@ const TASK_QUEUE = "{{name}}";
 // itself reads, and a hand-copied spelling that drifts is a partner refused
 // with no explanation. The primitive cannot add them for you — this identity
 // builds its roles now, before the events service exists.
+//
+// Declaring roles turns project role assertion ON, so granted roles ride in the
+// token.
+// A sign-in (`oidc`) client added later that must carry ANOTHER project's roles
+// (e.g. forwarding the user's token to Temporal) turns project assertion off and
+// sets `accessTokenRoleAssertion: true` + requests `projects:roles` — see authz.md.
 
 const connector = new mesh.auth.ZitadelConnector("idp", { tenant, env: platform.env });
 
@@ -123,6 +129,9 @@ const config = new mesh.apps.AppConfig("config", {
 // migration Job and fails when it fails, and the service's pods are held until
 // the schema has applied.
 //
+// Its log lines carry `service: "{{name}}-events"`, which the Hub's log search
+// filters by, with nothing to set here.
+//
 // A knob written HERE is pinned in code: Kubernetes keeps an explicit `env`
 // entry over the `envFrom` the app values arrive through, so a value in this
 // block wins over whatever an operator saves in the Hub. Leave one out to hand

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mesh-tech/mesh-cli",
-  "version": "0.40.3",
+  "version": "0.40.5",
   "description": "CLI for Mesh platform development utilities",
   "type": "module",
   "license": "UNLICENSED",
@@ -42,7 +42,7 @@
   },
   "devDependencies": {
     "@mesh-tech/agent-contracts": "0.6.0",
-    "@mesh-tech/tsconfig": "2.45.0",
+    "@mesh-tech/tsconfig": "2.47.0",
     "@mesh-tech/workflow-viz": "0.3.2",
     "@tanstack/intent": "^0.3.6",
     "@types/node": "^20.0.0",

package/templates/api-auth/index.ts.hbs

@@ -42,6 +42,11 @@ const connector = new mesh.auth.ZitadelConnector("idp", { tenant, env: platform.
 // The schema's coarse roles become Zitadel PROJECT ROLES: the vocabulary the
 // Hub grants people and API keys against. An `api`-type application is the
 // resource server tokens are minted for (its clientId is the JWT audience).
+// Declaring roles turns project role assertion ON, so granted roles ride in the
+// token.
+// A sign-in (`oidc`) client added later that must carry ANOTHER project's roles
+// (e.g. forwarding the user's token to Temporal) turns project assertion off and
+// sets `accessTokenRoleAssertion: true` + requests `projects:roles` — see authz.md.
 const identity = new mesh.auth.ZitadelAppIdentity("identity", {
   connector,
   tenant,

package/templates/api-role-gating/index.ts.hbs

@@ -45,6 +45,9 @@ const connector = new mesh.auth.ZitadelConnector("idp", { tenant, env: platform.
 // roleAssertion defaults ON (roles are declared) so granted roles ride in the
 // token — without it a minted API key authenticates but carries no roles, which
 // is fatal for role-gating (no SpiceDB fallback).
+// A sign-in (`oidc`) client added later that must carry ANOTHER project's roles
+// (e.g. forwarding the user's token to Temporal) turns project assertion off and
+// sets `accessTokenRoleAssertion: true` + requests `projects:roles` — see authz.md.
 const identity = new mesh.auth.ZitadelAppIdentity("identity", {
   connector,
   tenant,