@mesh-tech/mesh-cli 0.40.5 → 0.40.7

package/dist/build-info.json

@@ -1,4 +1,4 @@
 {
-  "commit": "50b326b85",
-  "builtAt": "2026-10-19T21:38:19.079Z"
+  "commit": "e57b68dab",
+  "builtAt": "2026-10-20T19:37:57.604Z"
 }

package/fragments/base/index.ts.hbs

@@ -182,6 +182,8 @@ const api = new mesh.apps.Service("api", {
   ],
   ingress: env.buildIngress({ subdomain: "{{name}}" }),
   // Drives readiness, liveness and the Hub uptime sampler on BOTH ingress kinds.
+  // An `ingress.pathMatches` list must route this path too: the sampler
+  // requests it on the public URL.
   // `ingress.healthCheckPath` sets the ALB target group's path only, and a
   // gateway (HTTPRoute) tenant has no target group — so the path belongs here.
   // A boot that can outlast the liveness window (a busy node, a tight CPU
@@ -250,7 +252,9 @@ const worker = new mesh.apps.TemporalWorker("worker", {
 // =============================================================================
 // Access — LAST. The pointer is what the Hub's App -> Access tab reads; without
 // it the tab is blank and no one can be granted a role, including the two the
-// events service authorizes its subscribers by.
+// events service authorizes its subscribers by. Keep the name "authz": an app
+// that moves to policy-engine hands its metadata path to SpiceDBSchema, which
+// adopts the Export published under that name.
 // =============================================================================
 
 new mesh.auth.AppAuthzPointer("authz", {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mesh-tech/mesh-cli",
-  "version": "0.40.5",
+  "version": "0.40.7",
   "description": "CLI for Mesh platform development utilities",
   "type": "module",
   "license": "UNLICENSED",
@@ -42,7 +42,7 @@
   },
   "devDependencies": {
     "@mesh-tech/agent-contracts": "0.6.0",
-    "@mesh-tech/tsconfig": "2.47.0",
+    "@mesh-tech/tsconfig": "2.48.1",
     "@mesh-tech/workflow-viz": "0.3.2",
     "@tanstack/intent": "^0.3.6",
     "@types/node": "^20.0.0",

package/templates/api-auth/index.ts.hbs

@@ -112,6 +112,8 @@ const api = new mesh.apps.Service("api", {
   },
   ingress: env.buildIngress({ subdomain: "{{name}}-api" }),
   // Drives readiness, liveness and the Hub uptime sampler on BOTH ingress kinds.
+  // An `ingress.pathMatches` list must route this path too: the sampler
+  // requests it on the public URL.
   // `ingress.healthCheckPath` sets the ALB target group's path only, and a
   // gateway (HTTPRoute) tenant has no target group — so the path belongs here.
   // A boot that can outlast the liveness window (a busy node, a tight CPU

package/templates/api-role-gating/index.ts.hbs

@@ -86,6 +86,8 @@ const api = new mesh.apps.Service("api", {
   },
   ingress: env.buildIngress({ subdomain: "{{name}}-api" }),
   // Drives readiness, liveness and the Hub uptime sampler on BOTH ingress kinds.
+  // An `ingress.pathMatches` list must route this path too: the sampler
+  // requests it on the public URL.
   // `ingress.healthCheckPath` sets the ALB target group's path only, and a
   // gateway (HTTPRoute) tenant has no target group — so the path belongs here.
   // A boot that can outlast the liveness window (a busy node, a tight CPU
@@ -105,7 +107,9 @@ const api = new mesh.apps.Service("api", {
 // component to publish it, so the pointer publishes the compiled blob itself
 // at the conventional …/authz/ops-hub-metadata path and references it.
 // It publishes env.zitadel — the project bound above through zitadelAppProjectId;
-// never pass a `zitadel:` override here (that is the Hub's own escape hatch). ---
+// never pass a `zitadel:` override here (that is the Hub's own escape hatch).
+// Keep the name "authz": an app that moves to policy-engine hands this path to
+// SpiceDBSchema, which adopts the Export published under that name. ---
 new mesh.auth.AppAuthzPointer("authz", {
   env,
   mode: "role-gating",

package/templates/external-service/index.ts.hbs

@@ -73,6 +73,8 @@ const api = new mesh.apps.Service("api", {
   link: [vendorpay.link()],
   ingress: env.buildIngress({ subdomain: "{{name}}-api" }),
   // Drives readiness, liveness and the Hub uptime sampler on BOTH ingress kinds.
+  // An `ingress.pathMatches` list must route this path too: the sampler
+  // requests it on the public URL.
   // `ingress.healthCheckPath` sets the ALB target group's path only, and a
   // gateway (HTTPRoute) tenant has no target group — so the path belongs here.
   // A boot that can outlast the liveness window (a busy node, a tight CPU

package/templates/workflow/index.ts.hbs

@@ -46,6 +46,8 @@ const api = new mesh.apps.Service("api", {
   ],
   ingress: env.buildIngress({ subdomain: "{{name}}-api" }),
   // Drives readiness, liveness and the Hub uptime sampler on BOTH ingress kinds.
+  // An `ingress.pathMatches` list must route this path too: the sampler
+  // requests it on the public URL.
   // `ingress.healthCheckPath` sets the ALB target group's path only, and a
   // gateway (HTTPRoute) tenant has no target group — so the path belongs here.
   // A boot that can outlast the liveness window (a busy node, a tight CPU