@mesh-tech/mesh-cli 0.40.4 → 0.40.6

package/dist/build-info.json

@@ -1,4 +1,4 @@
 {
-  "commit": "302e83050",
-  "builtAt": "2026-10-19T17:38:44.215Z"
+  "commit": "d3a5dfdea",
+  "builtAt": "2026-10-20T06:06:39.788Z"
 }

package/fragments/base/index.ts.hbs

@@ -33,6 +33,12 @@ const TASK_QUEUE = "{{name}}";
 // itself reads, and a hand-copied spelling that drifts is a partner refused
 // with no explanation. The primitive cannot add them for you — this identity
 // builds its roles now, before the events service exists.
+//
+// Declaring roles turns project role assertion ON, so granted roles ride in the
+// token.
+// A sign-in (`oidc`) client added later that must carry ANOTHER project's roles
+// (e.g. forwarding the user's token to Temporal) turns project assertion off and
+// sets `accessTokenRoleAssertion: true` + requests `projects:roles` — see authz.md.
 
 const connector = new mesh.auth.ZitadelConnector("idp", { tenant, env: platform.env });
 
@@ -123,6 +129,9 @@ const config = new mesh.apps.AppConfig("config", {
 // migration Job and fails when it fails, and the service's pods are held until
 // the schema has applied.
 //
+// Its log lines carry `service: "{{name}}-events"`, which the Hub's log search
+// filters by, with nothing to set here.
+//
 // A knob written HERE is pinned in code: Kubernetes keeps an explicit `env`
 // entry over the `envFrom` the app values arrive through, so a value in this
 // block wins over whatever an operator saves in the Hub. Leave one out to hand
@@ -173,6 +182,8 @@ const api = new mesh.apps.Service("api", {
   ],
   ingress: env.buildIngress({ subdomain: "{{name}}" }),
   // Drives readiness, liveness and the Hub uptime sampler on BOTH ingress kinds.
+  // An `ingress.pathMatches` list must route this path too: the sampler
+  // requests it on the public URL.
   // `ingress.healthCheckPath` sets the ALB target group's path only, and a
   // gateway (HTTPRoute) tenant has no target group — so the path belongs here.
   // A boot that can outlast the liveness window (a busy node, a tight CPU
@@ -241,7 +252,9 @@ const worker = new mesh.apps.TemporalWorker("worker", {
 // =============================================================================
 // Access — LAST. The pointer is what the Hub's App -> Access tab reads; without
 // it the tab is blank and no one can be granted a role, including the two the
-// events service authorizes its subscribers by.
+// events service authorizes its subscribers by. Keep the name "authz": an app
+// that moves to policy-engine hands its metadata path to SpiceDBSchema, which
+// adopts the Export published under that name.
 // =============================================================================
 
 new mesh.auth.AppAuthzPointer("authz", {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mesh-tech/mesh-cli",
-  "version": "0.40.4",
+  "version": "0.40.6",
   "description": "CLI for Mesh platform development utilities",
   "type": "module",
   "license": "UNLICENSED",
@@ -42,7 +42,7 @@
   },
   "devDependencies": {
     "@mesh-tech/agent-contracts": "0.6.0",
-    "@mesh-tech/tsconfig": "2.46.0",
+    "@mesh-tech/tsconfig": "2.48.0",
     "@mesh-tech/workflow-viz": "0.3.2",
     "@tanstack/intent": "^0.3.6",
     "@types/node": "^20.0.0",

package/templates/api-auth/index.ts.hbs

@@ -42,6 +42,11 @@ const connector = new mesh.auth.ZitadelConnector("idp", { tenant, env: platform.
 // The schema's coarse roles become Zitadel PROJECT ROLES: the vocabulary the
 // Hub grants people and API keys against. An `api`-type application is the
 // resource server tokens are minted for (its clientId is the JWT audience).
+// Declaring roles turns project role assertion ON, so granted roles ride in the
+// token.
+// A sign-in (`oidc`) client added later that must carry ANOTHER project's roles
+// (e.g. forwarding the user's token to Temporal) turns project assertion off and
+// sets `accessTokenRoleAssertion: true` + requests `projects:roles` — see authz.md.
 const identity = new mesh.auth.ZitadelAppIdentity("identity", {
   connector,
   tenant,
@@ -107,6 +112,8 @@ const api = new mesh.apps.Service("api", {
   },
   ingress: env.buildIngress({ subdomain: "{{name}}-api" }),
   // Drives readiness, liveness and the Hub uptime sampler on BOTH ingress kinds.
+  // An `ingress.pathMatches` list must route this path too: the sampler
+  // requests it on the public URL.
   // `ingress.healthCheckPath` sets the ALB target group's path only, and a
   // gateway (HTTPRoute) tenant has no target group — so the path belongs here.
   // A boot that can outlast the liveness window (a busy node, a tight CPU

package/templates/api-role-gating/index.ts.hbs

@@ -45,6 +45,9 @@ const connector = new mesh.auth.ZitadelConnector("idp", { tenant, env: platform.
 // roleAssertion defaults ON (roles are declared) so granted roles ride in the
 // token — without it a minted API key authenticates but carries no roles, which
 // is fatal for role-gating (no SpiceDB fallback).
+// A sign-in (`oidc`) client added later that must carry ANOTHER project's roles
+// (e.g. forwarding the user's token to Temporal) turns project assertion off and
+// sets `accessTokenRoleAssertion: true` + requests `projects:roles` — see authz.md.
 const identity = new mesh.auth.ZitadelAppIdentity("identity", {
   connector,
   tenant,
@@ -83,6 +86,8 @@ const api = new mesh.apps.Service("api", {
   },
   ingress: env.buildIngress({ subdomain: "{{name}}-api" }),
   // Drives readiness, liveness and the Hub uptime sampler on BOTH ingress kinds.
+  // An `ingress.pathMatches` list must route this path too: the sampler
+  // requests it on the public URL.
   // `ingress.healthCheckPath` sets the ALB target group's path only, and a
   // gateway (HTTPRoute) tenant has no target group — so the path belongs here.
   // A boot that can outlast the liveness window (a busy node, a tight CPU
@@ -102,7 +107,9 @@ const api = new mesh.apps.Service("api", {
 // component to publish it, so the pointer publishes the compiled blob itself
 // at the conventional …/authz/ops-hub-metadata path and references it.
 // It publishes env.zitadel — the project bound above through zitadelAppProjectId;
-// never pass a `zitadel:` override here (that is the Hub's own escape hatch). ---
+// never pass a `zitadel:` override here (that is the Hub's own escape hatch).
+// Keep the name "authz": an app that moves to policy-engine hands this path to
+// SpiceDBSchema, which adopts the Export published under that name. ---
 new mesh.auth.AppAuthzPointer("authz", {
   env,
   mode: "role-gating",

package/templates/external-service/index.ts.hbs

@@ -73,6 +73,8 @@ const api = new mesh.apps.Service("api", {
   link: [vendorpay.link()],
   ingress: env.buildIngress({ subdomain: "{{name}}-api" }),
   // Drives readiness, liveness and the Hub uptime sampler on BOTH ingress kinds.
+  // An `ingress.pathMatches` list must route this path too: the sampler
+  // requests it on the public URL.
   // `ingress.healthCheckPath` sets the ALB target group's path only, and a
   // gateway (HTTPRoute) tenant has no target group — so the path belongs here.
   // A boot that can outlast the liveness window (a busy node, a tight CPU

package/templates/workflow/index.ts.hbs

@@ -46,6 +46,8 @@ const api = new mesh.apps.Service("api", {
   ],
   ingress: env.buildIngress({ subdomain: "{{name}}-api" }),
   // Drives readiness, liveness and the Hub uptime sampler on BOTH ingress kinds.
+  // An `ingress.pathMatches` list must route this path too: the sampler
+  // requests it on the public URL.
   // `ingress.healthCheckPath` sets the ALB target group's path only, and a
   // gateway (HTTPRoute) tenant has no target group — so the path belongs here.
   // A boot that can outlast the liveness window (a busy node, a tight CPU