@mesh-tech/mesh-cli 0.1.0

package/templates/api-web-db/sst.config.ts.hbs

@@ -0,0 +1,151 @@
+/// <reference path="./.sst/platform/config.d.ts" />
+
+export default $config({
+  app(input) {
+    return {
+      name: "{{name}}",
+      removal: input?.stage === "prod" ? "retain" : "remove",
+      protect: ["prod"].includes(input?.stage ?? ""),
+      home: "aws",
+      providers: {
+        aws: {
+          region: "us-east-1",
+        },
+      },
+    };
+  },
+  async run() {
+    // Dynamic imports (SST requirement for non-SST packages)
+    const { mesh } = await import("@mesh-tech/infra-components");
+    const { config, getPlatform } = await import("../config.js");
+
+    const stage = $app.stage;
+    const tenant = config.tenant;
+    const platform = getPlatform(stage);
+
+    // Create tenant environment (isolated per-app namespace)
+    // DevCommand enables unified dev tunnel (mesh tunnel dev) for DB access
+    const env = new mesh.apps.AppEnvironment("env", {
+      tenant,
+      platform,
+      stage,
+      appName: "{{name}}",
+      dev: $dev,
+      namespace: true,
+      DevCommand: sst.x.DevCommand,
+    });
+
+    // Create database
+    // Credentials are injected at runtime via envFromSecrets:
+    // - Dev mode: mesh db exec fetches from Secrets Manager
+    // - K8s mode: ExternalSecrets syncs to K8s Secret, envFrom injects
+    const db = new mesh.apps.Database("db", {
+      env,
+    });
+
+    // Prisma DevCommand for migrations and Studio
+    // Usage: npx sst shell --target Prisma -- npx prisma <command>
+    // Uses mesh db exec to load DATABASE_URL from secret (same as web/api)
+    new sst.x.DevCommand("Prisma", {
+      dev: {
+        title: "prisma",
+        command: $interpolate`pnpm exec mesh db exec --secret=${db.secretArn} --ssl=require -- npx prisma studio`,
+        directory: "./web",
+        autostart: false,
+      },
+    });
+
+    // ==========================================================================
+    // API Service (Hono)
+    // ==========================================================================
+    const api = new mesh.apps.Service(
+      "api",
+      {
+        dev: $dev,
+        tenant,
+        stage,
+        appName: "{{name}}",
+        namespace: env.namespace!,
+        rootDir: $cli.paths.root,
+        src: "./api",
+        port: 3001,
+        devCommand: ["pnpm", "dev"],
+        environment: {
+          APP_NAME: "api",
+          STAGE: stage,
+          NODE_ENV: $dev ? "development" : "production",
+        },
+        // Inject DB credentials via envFromSecrets (works in both dev and K8s mode)
+        // Dev: mesh db exec fetches from Secrets Manager at runtime
+        // K8s: ExternalSecret syncs to K8s Secret, envFrom injects
+        envFromSecrets: $dev ? [db.secretArn] : [db.k8sSecretName!],
+        ingress: env.buildIngress({
+          subdomain: "{{name}}-api",
+          healthCheckPath: "/health",
+        }),
+        waitForDns: true,
+        replicas: 1,
+        resources: {
+          cpu: $dev ? "50m" : "100m",
+          memory: "128Mi",
+        },
+      },
+      {
+        providers: env.providers,
+        parent: env,
+      },
+    );
+
+    // ==========================================================================
+    // Web Service (React Router v7)
+    // ==========================================================================
+    const web = new mesh.apps.Service(
+      "web",
+      {
+        dev: $dev,
+        tenant,
+        stage,
+        appName: "{{name}}",
+        namespace: env.namespace!,
+        rootDir: $cli.paths.root,
+        src: "./web",
+        port: 3000,
+        devCommand: ["pnpm", "dev"],
+        environment: {
+          APP_NAME: "web",
+          STAGE: stage,
+          NODE_ENV: $dev ? "development" : "production",
+          API_URL: api.serviceEndpoint ?? api.url,
+          PUBLIC_API_URL: api.url,
+        },
+        // Inject DB credentials via envFromSecrets (works in both dev and K8s mode)
+        // Dev: mesh db exec fetches from Secrets Manager at runtime
+        // K8s: ExternalSecret syncs to K8s Secret, envFrom injects
+        envFromSecrets: $dev ? [db.secretArn] : [db.k8sSecretName!],
+        ingress: env.buildIngress({
+          subdomain: "{{name}}",
+          healthCheckPath: "/",
+        }),
+        waitForDns: true,
+        replicas: 1,
+        resources: {
+          cpu: $dev ? "50m" : "200m",
+          memory: $dev ? "128Mi" : "256Mi",
+        },
+      },
+      {
+        providers: env.providers,
+        parent: env,
+        dependsOn: [api],
+      },
+    );
+
+    return {
+      namespace: env.namespace,
+      apiUrl: api.url,
+      webUrl: web.url,
+      databaseUrl: db.url,
+      databaseName: db.name,
+    };
+  },
+});

package/templates/api-web-db/tsconfig.json

@@ -0,0 +1,11 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "esModuleInterop": true,
+    "strict": true,
+    "skipLibCheck": true
+  },
+  "include": ["sst.config.ts"]
+}

package/templates/api-web-db/web/.dockerignore

@@ -0,0 +1,3 @@
+node_modules
+build
+.react-router

package/templates/api-web-db/web/Dockerfile

@@ -0,0 +1,17 @@
+FROM node:22-alpine AS builder
+WORKDIR /app
+RUN corepack enable && corepack prepare pnpm@latest --activate
+COPY package.json pnpm-lock.yaml* ./
+RUN pnpm install
+COPY . .
+RUN pnpm build
+
+FROM node:22-alpine
+WORKDIR /app
+RUN corepack enable && corepack prepare pnpm@latest --activate
+COPY package.json pnpm-lock.yaml* ./
+RUN pnpm install --prod --frozen-lockfile || pnpm install --prod
+COPY --from=builder /app/build ./build
+ENV NODE_ENV=production PORT=3000
+EXPOSE 3000
+CMD ["pnpm", "start"]

package/templates/api-web-db/web/app/lib/db.server.ts

@@ -0,0 +1,36 @@
+/**
+ * Database connection for server-side code (loaders/actions)
+ *
+ * Uses Prisma v7 adapter pattern with DATABASE_URL from environment.
+ * - Dev mode: DATABASE_URL includes password (set by mesh db exec from SecretImport)
+ * - K8s mode: DATABASE_URL comes from ExternalSecret via envFrom
+ *
+ * This pattern eliminates runtime Secrets Manager calls.
+ */
+
+import { Pool } from "pg";
+import { PrismaClient } from "../../src/generated/prisma/client";
+import { PrismaPg } from "@prisma/adapter-pg";
+
+let prisma: PrismaClient | null = null;
+
+export function getDb(): PrismaClient {
+  if (!prisma) {
+    // Create pg Pool with SSL for RDS (required even through SSM tunnel)
+    const pool = new Pool({
+      connectionString: process.env.DATABASE_URL,
+      ssl: { rejectUnauthorized: false },
+    });
+    const adapter = new PrismaPg(pool);
+    prisma = new PrismaClient({ adapter });
+  }
+  return prisma;
+}
+
+// Cleanup function for graceful shutdown
+export async function closeDb(): Promise<void> {
+  if (prisma) {
+    await prisma.$disconnect();
+    prisma = null;
+  }
+}

package/templates/api-web-db/web/app/root.tsx

@@ -0,0 +1,29 @@
+import {
+  Links,
+  Meta,
+  Outlet,
+  Scripts,
+  ScrollRestoration,
+} from "react-router";
+
+export function Layout({ children }: { children: React.ReactNode }) {
+  return (
+    <html lang="en">
+      <head>
+        <meta charSet="utf-8" />
+        <meta name="viewport" content="width=device-width, initial-scale=1" />
+        <Meta />
+        <Links />
+      </head>
+      <body style={{ fontFamily: "system-ui, sans-serif", margin: 0 }}>
+        {children}
+        <ScrollRestoration />
+        <Scripts />
+      </body>
+    </html>
+  );
+}
+
+export default function App() {
+  return <Outlet />;
+}

package/templates/api-web-db/web/app/routes/home.tsx.hbs

@@ -0,0 +1,114 @@
+import type { Route } from "./+types/home";
+
+export function meta({}: Route.MetaArgs) {
+  return [
+    { title: "{{titleCase name}}" },
+    { name: "description", content: "{{titleCase name}} - Mesh App" },
+  ];
+}
+
+export async function loader({}: Route.LoaderArgs) {
+  const apiUrl = process.env.API_URL || "http://localhost:3001";
+
+  // Fetch API hello endpoint
+  let apiData = { message: "API unavailable", timestamp: null };
+  try {
+    const response = await fetch(`${apiUrl}/hello`);
+    apiData = await response.json();
+  } catch (error) {
+    console.error("API fetch error:", error);
+  }
+
+  // Fetch database status
+  let dbData = { status: "unknown", database: null, user: null, version: null };
+  try {
+    const response = await fetch(`${apiUrl}/db`);
+    dbData = await response.json();
+  } catch (error) {
+    console.error("DB fetch error:", error);
+    dbData = { status: "error", database: null, user: null, version: null };
+  }
+
+  return {
+    message: apiData.message,
+    timestamp: apiData.timestamp,
+    stage: process.env.STAGE || "unknown",
+    db: dbData,
+  };
+}
+
+export default function Home({ loaderData }: Route.ComponentProps) {
+  const { message, timestamp, stage, db } = loaderData;
+  const dbConnected = db?.status === "connected";
+
+  return (
+    <div style=\{{ padding: "2rem", maxWidth: "600px", margin: "0 auto" }}>
+      <h1 style=\{{ fontSize: "2rem", marginBottom: "1rem" }}>{{titleCase name}}</h1>
+
+      <div
+        style=\{{
+          background: "#f0f9ff",
+          border: "1px solid #0ea5e9",
+          borderRadius: "8px",
+          padding: "1rem",
+          marginBottom: "1rem",
+        }}
+      >
+        <h2 style=\{{ margin: "0 0 0.5rem 0", fontSize: "1rem" }}>
+          Web (React Router v7)
+        </h2>
+        <p style=\{{ margin: 0, color: "#666" }}>Stage: {stage}</p>
+      </div>
+
+      <div
+        style=\{{
+          background: "#f0fdf4",
+          border: "1px solid #22c55e",
+          borderRadius: "8px",
+          padding: "1rem",
+          marginBottom: "1rem",
+        }}
+      >
+        <h2 style=\{{ margin: "0 0 0.5rem 0", fontSize: "1rem" }}>
+          API Response (Hono)
+        </h2>
+        <p style=\{{ margin: "0 0 0.25rem 0" }}>Message: {message}</p>
+        {timestamp && (
+          <p style=\{{ margin: 0, color: "#666", fontSize: "0.875rem" }}>
+            Timestamp: {timestamp}
+          </p>
+        )}
+      </div>
+
+      <div
+        style=\{{
+          background: dbConnected ? "#fdf4ff" : "#fef2f2",
+          border: `1px solid ${dbConnected ? "#a855f7" : "#ef4444"}`,
+          borderRadius: "8px",
+          padding: "1rem",
+        }}
+      >
+        <h2 style=\{{ margin: "0 0 0.5rem 0", fontSize: "1rem" }}>
+          Database (RDS)
+        </h2>
+        <p style=\{{ margin: "0 0 0.25rem 0" }}>
+          Status: {dbConnected ? "Connected" : `${db?.status || "Unknown"}`}
+        </p>
+        {dbConnected && (
+          <>
+            <p style=\{{ margin: "0 0 0.25rem 0", color: "#666", fontSize: "0.875rem" }}>
+              Database: {db.database}
+            </p>
+            <p style=\{{ margin: 0, color: "#666", fontSize: "0.875rem" }}>
+              User: {db.user}
+            </p>
+          </>
+        )}
+      </div>
+
+      <p style=\{{ marginTop: "1.5rem", color: "#666", fontSize: "0.875rem" }}>
+        Edit files in <code>web/</code> or <code>api/</code> to see live reload!
+      </p>
+    </div>
+  );
+}

package/templates/api-web-db/web/app/routes.ts

@@ -0,0 +1,3 @@
+import { type RouteConfig, index } from "@react-router/dev/routes";
+
+export default [index("routes/home.tsx")] satisfies RouteConfig;

package/templates/api-web-db/web/package.json.hbs

@@ -0,0 +1,30 @@
+{
+  "name": "{{name}}-web",
+  "type": "module",
+  "scripts": {
+    "dev": "react-router dev",
+    "build": "react-router build",
+    "start": "react-router-serve ./build/server/index.js"
+  },
+  "dependencies": {
+    "@prisma/adapter-pg": "^7.0.0",
+    "@prisma/client": "^7.0.0",
+    "@react-router/node": "^7.1.1",
+    "@react-router/serve": "^7.1.1",
+    "isbot": "^5.1.17",
+    "pg": "^8.13.0",
+    "prisma": "^7.0.0",
+    "react": "^19.0.0",
+    "react-dom": "^19.0.0",
+    "react-router": "^7.1.1"
+  },
+  "devDependencies": {
+    "@react-router/dev": "^7.1.1",
+    "@types/node": "^22.10.5",
+    "@types/pg": "^8.11.0",
+    "@types/react": "^19.0.2",
+    "@types/react-dom": "^19.0.2",
+    "typescript": "^5.7.2",
+    "vite": "^6.0.7"
+  }
+}

package/templates/api-web-db/web/prisma/schema.prisma

@@ -0,0 +1,25 @@
+// Prisma v7 Schema
+// Docs: https://www.prisma.io/docs
+
+generator client {
+  provider = "prisma-client"
+  output   = "../src/generated/prisma"
+}
+
+datasource db {
+  provider = "postgresql"
+  // Note: url is configured in prisma.config.ts (Prisma v7 pattern)
+}
+
+// =============================================================================
+// Example Model - Replace with your domain models
+// =============================================================================
+
+model Example {
+  id        String   @id @default(cuid())
+  name      String
+  createdAt DateTime @default(now())
+  updatedAt DateTime @updatedAt
+
+  @@map("examples")
+}

package/templates/api-web-db/web/prisma.config.ts

@@ -0,0 +1,18 @@
+/**
+ * Prisma v7 configuration for CLI commands (migrations, db push, etc.)
+ *
+ * Usage with SST:
+ *   npx sst shell --target Prisma -- npx prisma db push
+ *   npx sst shell --target Prisma -- npx prisma migrate dev --name <name>
+ *   npx sst shell --target Prisma -- npx prisma studio
+ */
+
+import { defineConfig } from "prisma/config";
+
+export default defineConfig({
+  schema: "prisma/schema.prisma",
+
+  datasource: {
+    url: process.env.DATABASE_URL!,
+  },
+});

package/templates/api-web-db/web/react-router.config.ts

@@ -0,0 +1,5 @@
+import type { Config } from "@react-router/dev/config";
+
+export default {
+  ssr: true,
+} satisfies Config;

package/templates/api-web-db/web/tsconfig.json

@@ -0,0 +1,19 @@
+{
+  "include": [
+    "**/*.ts",
+    "**/*.tsx",
+    ".react-router/types/**/*"
+  ],
+  "compilerOptions": {
+    "target": "ES2022",
+    "lib": ["DOM", "DOM.Iterable", "ES2022"],
+    "types": ["node", "@react-router/node", "vite/client"],
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "jsx": "react-jsx",
+    "strict": true,
+    "skipLibCheck": true,
+    "noEmit": true,
+    "rootDirs": [".", "./.react-router/types"]
+  }
+}

package/templates/api-web-db/web/vite.config.ts

@@ -0,0 +1,9 @@
+import { reactRouter } from "@react-router/dev/vite";
+import { defineConfig } from "vite";
+
+export default defineConfig({
+  plugins: [reactRouter()],
+  server: {
+    port: parseInt(process.env.PORT || "3000", 10),
+  },
+});

package/templates/temporal-api-worker/README.md.hbs

@@ -0,0 +1,133 @@
+# {{titleCase name}}
+
+Temporal workflow application for {{tenant}}.
+
+## Overview
+
+This app demonstrates Temporal workflow orchestration with:
+- **Worker**: Executes workflows and activities
+- **API**: HTTP endpoints to trigger workflows
+
+## Prerequisites
+
+- MeshPlatform deployed with `temporal: { ... }` enabled
+- AWS credentials with apps-deployer role
+
+## Development
+
+### 1. Start Dev Server
+
+```bash
+pnpm mesh dev
+# Auto-starts unified tunnel (Temporal gRPC:7233, Web UI:8080, DB:5432)
+```
+
+### 2. Start Worker Manually
+
+Workers don't auto-start because they need the Temporal namespace to exist first.
+After `sst dev` is ready:
+1. Open SST dev UI
+2. Find the worker service
+3. Click to start it
+
+### 4. Test Workflows
+
+```bash
+# Trigger greeting workflow
+curl -X POST http://localhost:3000/greet \
+  -H "Content-Type: application/json" \
+  -d '{"name": "World"}'
+
+# Trigger task workflow
+curl -X POST http://localhost:3000/task \
+  -H "Content-Type: application/json" \
+  -d '{"taskId": "TASK-123", "userId": "user-456"}'
+
+# Check workflow status
+curl http://localhost:3000/workflow/task-TASK-123
+```
+
+### 5. View in Web UI
+
+Open http://localhost:8080 and navigate to your namespace.
+
+## Deployment
+
+```bash
+pnpm deploy --stage dev
+```
+
+## Project Structure
+
+```
+{{name}}/
+├── sst.config.ts      # SST config with AppEnvironment + TemporalWorker
+├── worker/
+│   ├── src/
+│   │   ├── worker.ts      # Worker entry point
+│   │   ├── workflows.ts   # Workflow definitions
+│   │   ├── activities.ts  # Activity implementations
+│   │   └── encryption-codec.ts  # Payload encryption
+│   ├── Dockerfile
+│   └── package.json
+├── api/
+│   ├── src/
+│   │   ├── index.ts       # Express API
+│   │   └── encryption-codec.ts  # Payload encryption
+│   ├── Dockerfile
+│   └── package.json
+└── README.md
+```
+
+## Customization
+
+### Adding Workflows
+
+1. Define workflow in `worker/src/workflows.ts`
+2. Add activities in `worker/src/activities.ts`
+3. Add API endpoint in `api/src/index.ts`
+
+### Workflow Patterns
+
+```typescript
+// Simple workflow
+export async function myWorkflow(input: string): Promise<string> {
+  const result = await myActivity(input);
+  return result;
+}
+
+// Workflow with timer
+export async function timedWorkflow(): Promise<void> {
+  await doSomething();
+  await sleep("1 hour");  // Durable timer
+  await doSomethingElse();
+}
+
+// Workflow with error handling
+export async function safeWorkflow(): Promise<string> {
+  try {
+    return await riskyActivity();
+  } catch (err) {
+    return await fallbackActivity();
+  }
+}
+```
+
+## Troubleshooting
+
+### Worker Can't Connect
+
+1. Ensure tunnel is running in SST dev (check "tunnel" pane)
+2. Check `TEMPORAL_ADDRESS` in worker logs
+3. Or start tunnel manually: `pnpm mesh tunnel dev`
+
+### Encrypted Payloads in Web UI
+
+Configure codec server in Web UI settings:
+- Dev: `http://localhost:8083`
+- Deploy: Check `codecServerUrl` output
+
+### Workflow Not Found
+
+1. Ensure worker is running
+2. Check task queue name matches between API and worker

package/templates/temporal-api-worker/api/.dockerignore

@@ -0,0 +1,4 @@
+node_modules
+dist
+*.log
+.env*

package/templates/temporal-api-worker/api/Dockerfile

@@ -0,0 +1,13 @@
+FROM node:20-slim
+
+WORKDIR /app
+
+COPY package*.json ./
+RUN npm ci --omit=dev
+
+COPY . .
+RUN npm run build
+
+EXPOSE 3000
+
+CMD ["node", "dist/index.js"]

package/templates/temporal-api-worker/api/package.json.hbs

@@ -0,0 +1,23 @@
+{
+  "name": "@{{tenant}}/{{name}}-api",
+  "version": "0.0.1",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "dev": "tsx watch src/index.ts",
+    "start": "node dist/index.js",
+    "build": "tsc"
+  },
+  "dependencies": {
+    "@temporalio/client": "^1.11.7",
+    "@temporalio/common": "^1.11.7",
+    "@temporalio/proto": "^1.11.7",
+    "express": "^4.21.0"
+  },
+  "devDependencies": {
+    "@types/express": "^4.17.21",
+    "@types/node": "^20.0.0",
+    "tsx": "^4.0.0",
+    "typescript": "^5.0.0"
+  }
+}