@mesh-tech/mesh-cli 0.1.0

package/templates/temporal-api-worker/api/src/encryption-codec.ts

@@ -0,0 +1,133 @@
+/**
+ * Encryption Codec for Temporal Payload Encryption
+ *
+ * Implements AES-256-GCM encryption for workflow payloads.
+ * Uses TEMPORAL_ENCODING_KEY environment variable.
+ *
+ * This is a copy of the worker's encryption codec - both need
+ * to use the same encryption to communicate.
+ */
+
+import * as crypto from "crypto";
+import {
+  PayloadCodec,
+  Payload,
+  encodingKeys,
+  METADATA_ENCODING_KEY,
+} from "@temporalio/common";
+import proto from "@temporalio/proto";
+
+const { temporal } = proto;
+
+const ENCODING_TYPE = "binary/encrypted";
+const ALGORITHM = "aes-256-gcm";
+const IV_LENGTH = 12;
+const AUTH_TAG_LENGTH = 16;
+
+/**
+ * Derive a 256-bit key from the encoding key using SHA-256
+ */
+async function deriveKey(encodingKey: string): Promise<Buffer> {
+  return crypto.createHash("sha256").update(encodingKey).digest();
+}
+
+/**
+ * Encrypt data using AES-256-GCM
+ */
+function encrypt(data: Uint8Array, key: Buffer): Uint8Array {
+  const iv = crypto.randomBytes(IV_LENGTH);
+  const cipher = crypto.createCipheriv(ALGORITHM, key, iv);
+
+  const encrypted = Buffer.concat([cipher.update(data), cipher.final()]);
+  const authTag = cipher.getAuthTag();
+
+  // Format: IV (12 bytes) + Ciphertext + AuthTag (16 bytes)
+  return Buffer.concat([iv, encrypted, authTag]);
+}
+
+/**
+ * Decrypt data using AES-256-GCM
+ */
+function decrypt(data: Uint8Array, key: Buffer): Uint8Array {
+  const iv = data.slice(0, IV_LENGTH);
+  const authTag = data.slice(-AUTH_TAG_LENGTH);
+  const ciphertext = data.slice(IV_LENGTH, -AUTH_TAG_LENGTH);
+
+  const decipher = crypto.createDecipheriv(ALGORITHM, key, iv);
+  decipher.setAuthTag(authTag);
+
+  return Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+}
+
+/**
+ * Encryption codec implementing Temporal's PayloadCodec interface
+ */
+export class EncryptionCodec implements PayloadCodec {
+  private readonly key: Buffer;
+  private readonly keyId: string;
+
+  private constructor(key: Buffer, keyId: string) {
+    this.key = key;
+    this.keyId = keyId;
+  }
+
+  static async create(encodingKey: string): Promise<EncryptionCodec> {
+    const key = await deriveKey(encodingKey);
+    // Use first 8 chars of key hash as key ID
+    const keyId = crypto
+      .createHash("sha256")
+      .update(encodingKey)
+      .digest("hex")
+      .slice(0, 8);
+    return new EncryptionCodec(key, keyId);
+  }
+
+  async encode(payloads: Payload[]): Promise<Payload[]> {
+    return payloads.map((payload) => {
+      // Serialize the payload to bytes
+      const bytes = temporal.api.common.v1.Payload.encode(payload).finish();
+
+      // Encrypt
+      const encrypted = encrypt(bytes, this.key);
+
+      return {
+        metadata: {
+          [METADATA_ENCODING_KEY]: encodingKeys.METADATA_ENCODING_RAW,
+          "encryption-codec": Buffer.from(ENCODING_TYPE),
+          "encryption-key-id": Buffer.from(this.keyId),
+        },
+        data: encrypted,
+      };
+    });
+  }
+
+  async decode(payloads: Payload[]): Promise<Payload[]> {
+    return payloads.map((payload) => {
+      // Check if this payload is encrypted by us
+      const encoding = payload.metadata?.["encryption-codec"];
+      if (!encoding || Buffer.from(encoding).toString() !== ENCODING_TYPE) {
+        return payload;
+      }
+
+      // Decrypt
+      const decrypted = decrypt(payload.data!, this.key);
+
+      // Deserialize back to Payload
+      return temporal.api.common.v1.Payload.decode(decrypted);
+    });
+  }
+}
+
+/**
+ * Create encryption codec from environment variable
+ */
+export async function createEncryptionCodec(): Promise<
+  EncryptionCodec | undefined
+> {
+  const encodingKey = process.env.TEMPORAL_ENCODING_KEY;
+  if (!encodingKey) {
+    return undefined;
+  }
+
+  return EncryptionCodec.create(encodingKey);
+}

package/templates/temporal-api-worker/api/src/index.ts.hbs

@@ -0,0 +1,145 @@
+/**
+ * {{titleCase name}} API
+ *
+ * HTTP API for triggering Temporal workflows.
+ *
+ * Environment variables:
+ * - PORT: Server port (default: 3000)
+ * - TEMPORAL_ADDRESS: Temporal server address (default: localhost:7233)
+ * - TEMPORAL_NAMESPACE: Temporal namespace (required)
+ * - TEMPORAL_TASK_QUEUE: Task queue name (required)
+ * - TEMPORAL_ENCODING_KEY: Encoding key for payload encryption (optional)
+ */
+
+import express, { Request, Response } from "express";
+import { Client, Connection } from "@temporalio/client";
+import { createEncryptionCodec } from "./encryption-codec.js";
+
+const PORT = parseInt(process.env.PORT ?? "3000", 10);
+const TEMPORAL_ADDRESS = process.env.TEMPORAL_ADDRESS ?? "localhost:7233";
+
+function requireEnv(name: string): string {
+  const value = process.env[name];
+  if (!value) {
+    throw new Error(`${name} environment variable is required`);
+  }
+  return value;
+}
+
+const TEMPORAL_NAMESPACE = requireEnv("TEMPORAL_NAMESPACE");
+const TEMPORAL_TASK_QUEUE = requireEnv("TEMPORAL_TASK_QUEUE");
+
+const app = express();
+app.use(express.json());
+
+let client: Client;
+
+// Initialize Temporal client
+async function initClient(): Promise<void> {
+  console.log(`[API] Connecting to Temporal at ${TEMPORAL_ADDRESS}...`);
+
+  const connection = await Connection.connect({
+    address: TEMPORAL_ADDRESS,
+  });
+
+  // Set up payload encryption if encoding key is available
+  const encryptionCodec = await createEncryptionCodec();
+  const dataConverter = encryptionCodec
+    ? { payloadCodecs: [encryptionCodec] }
+    : undefined;
+
+  client = new Client({
+    connection,
+    namespace: TEMPORAL_NAMESPACE,
+    dataConverter,
+  });
+
+  console.log(`[API] Connected. Namespace: ${TEMPORAL_NAMESPACE}`);
+}
+
+// Health check
+app.get("/health", (_req: Request, res: Response) => {
+  res.json({ status: "ok" });
+});
+
+// Trigger greeting workflow
+app.post("/greet", async (req: Request, res: Response) => {
+  try {
+    const { name } = req.body as { name: string };
+    if (!name) {
+      res.status(400).json({ error: "name is required" });
+      return;
+    }
+
+    const handle = await client.workflow.start("greetingWorkflow", {
+      taskQueue: TEMPORAL_TASK_QUEUE,
+      workflowId: `greeting-${Date.now()}`,
+      args: [name],
+    });
+
+    // Wait for result (greeting is quick)
+    const result = await handle.result();
+    res.json({ workflowId: handle.workflowId, result });
+  } catch (error) {
+    console.error("[API] Error starting workflow:", error);
+    res.status(500).json({ error: "Failed to start workflow" });
+  }
+});
+
+// Trigger task workflow
+app.post("/task", async (req: Request, res: Response) => {
+  try {
+    const { taskId, userId } = req.body as { taskId: string; userId: string };
+    if (!taskId || !userId) {
+      res.status(400).json({ error: "taskId and userId are required" });
+      return;
+    }
+
+    const handle = await client.workflow.start("taskWorkflow", {
+      taskQueue: TEMPORAL_TASK_QUEUE,
+      workflowId: `task-${taskId}`,
+      args: [taskId, userId],
+    });
+
+    // Don't wait for result - return workflow ID immediately
+    res.json({
+      workflowId: handle.workflowId,
+      status: "started",
+      message: "Workflow started. Check Temporal Web UI for progress.",
+    });
+  } catch (error) {
+    console.error("[API] Error starting workflow:", error);
+    res.status(500).json({ error: "Failed to start workflow" });
+  }
+});
+
+// Get workflow status
+app.get("/workflow/:workflowId", async (req: Request, res: Response) => {
+  try {
+    const { workflowId } = req.params;
+    const handle = client.workflow.getHandle(workflowId);
+    const describe = await handle.describe();
+
+    res.json({
+      workflowId,
+      status: describe.status.name,
+      startTime: describe.startTime,
+      closeTime: describe.closeTime,
+    });
+  } catch (error) {
+    console.error("[API] Error getting workflow:", error);
+    res.status(500).json({ error: "Failed to get workflow status" });
+  }
+});
+
+// Start server
+initClient()
+  .then(() => {
+    app.listen(PORT, "0.0.0.0", () => {
+      console.log(`[API] {{titleCase name}} API listening on port ${PORT}`);
+    });
+  })
+  .catch((err) => {
+    console.error("[API] Failed to initialize:", err);
+    process.exit(1);
+  });

package/templates/temporal-api-worker/api/tsconfig.json

@@ -0,0 +1,14 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "outDir": "./dist",
+    "rootDir": "./src",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "declaration": true
+  },
+  "include": ["src/**/*"]
+}

package/templates/temporal-api-worker/package.json.hbs

@@ -0,0 +1,29 @@
+{
+  "name": "{{name}}",
+  "version": "0.0.1",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "typecheck": "tsc --noEmit",
+    "sst:patch": "patch-sst-pulumi .",
+    "dev": "pnpm run sst:patch && sst dev",
+    "deploy": "pnpm run sst:patch && sst deploy",
+    "deploy:dev": "pnpm run sst:patch && sst deploy --stage dev",
+    "deploy:prod": "pnpm run sst:patch && sst deploy --stage prod",
+    "remove": "sst remove"
+  },
+  "dependencies": {
+    "@mesh-tech/infra-components": "workspace:*",
+    "@pulumi/aws": "6.66.2",
+    "@pulumi/docker-build": "^0.0.15",
+    "@pulumi/eks": "4.2.0",
+    "@pulumi/kubernetes": "4.24.1",
+    "@pulumi/pulumi": "3.214.1",
+    "@pulumi/random": "4.18.2",
+    "sst": "^3.3.61"
+  },
+  "devDependencies": {
+    "@aws-sdk/credential-providers": "^3.964.0",
+    "typescript": "^5.7.2"
+  }
+}

package/templates/temporal-api-worker/sst.config.ts.hbs

@@ -0,0 +1,161 @@
+/// <reference path="./.sst/platform/config.d.ts" />
+
+/**
+ * {{titleCase name}} - Temporal Workflow Application
+ *
+ * This app demonstrates Temporal workflow orchestration with:
+ * - AppEnvironment with temporal: true (namespace provisioning, encoding key)
+ * - TemporalWorker component (auto-configured env vars, no Service/Ingress)
+ * - API Service for triggering workflows
+ *
+ * Dev mode:
+ *   1. Run: pnpm mesh dev (auto-starts tunnel to Temporal + DB)
+ *   2. Start worker manually in SST dev UI
+ *
+ * Deploy:
+ *   pnpm deploy --stage dev
+ */
+
+export default $config({
+  app(input) {
+    return {
+      name: "{{name}}",
+      removal: input?.stage === "prod" ? "retain" : "remove",
+      protect: ["prod"].includes(input?.stage ?? ""),
+      home: "aws",
+      providers: {
+        aws: {
+          region: "us-east-2",
+        },
+      },
+    };
+  },
+  async run() {
+    // Dynamic imports (SST requirement for non-SST packages)
+    const { mesh } = await import("@mesh-tech/infra-components");
+    const { config, getPlatform } = await import("../config.js");
+
+    const stage = $app.stage;
+    const tenant = config.tenant;
+    const platform = getPlatform(stage);
+
+    // =========================================================================
+    // AppEnvironment with Temporal enabled
+    // =========================================================================
+    // This creates:
+    // - Kubernetes namespace (deploy mode)
+    // - Temporal namespace (via TemporalNamespaceProvisioner Lambda)
+    // - Encoding key K8s Secret for payload encryption
+    // - Codec server deployment (for Web UI decryption)
+    // - Unified dev tunnel (mesh tunnel dev) for Temporal + DB access
+
+    const env = new mesh.apps.AppEnvironment("env", {
+      tenant,
+      platform,
+      stage,
+      appName: "{{name}}",
+      dev: $dev,
+      namespace: !$dev,
+
+      // Enable Temporal support
+      temporal: true,
+      DevCommand: sst.x.DevCommand,
+    });
+
+    // =========================================================================
+    // Temporal Worker
+    // =========================================================================
+    // TemporalWorker automatically handles:
+    // - Temporal environment variables (ADDRESS, NAMESPACE, TASK_QUEUE)
+    // - Encoding key secret mounting for payload encryption
+    // - No Service/Ingress (workers don't serve HTTP)
+    // - Dev mode: doesn't autostart (waits for namespace provisioning)
+
+    const worker = new mesh.apps.TemporalWorker(
+      "worker",
+      {
+        env,
+        rootDir: $cli.paths.root,
+        src: "./worker",
+        devCommand: ["pnpm", "dev"],
+
+        // Task queue defaults to worker name ("worker")
+        taskQueue: "{{name}}",
+
+        environment: {
+          NODE_ENV: $dev ? "development" : "production",
+        },
+
+        replicas: 1,
+        resources: {
+          cpu: "100m",
+          memory: "256Mi",
+        },
+      },
+      {
+        providers: env.providers,
+        parent: env,
+      },
+    );
+
+    // =========================================================================
+    // API Service (triggers workflows)
+    // =========================================================================
+    const api = new mesh.apps.Service(
+      "api",
+      {
+        dev: $dev,
+        tenant,
+        stage,
+        appName: "{{name}}",
+        namespace: env.namespace!,
+        rootDir: $cli.paths.root,
+        src: "./api",
+        port: 3000,
+        devCommand: ["pnpm", "dev"],
+
+        environment: {
+          NODE_ENV: $dev ? "development" : "production",
+          TEMPORAL_ADDRESS: env.temporal!.endpoint.apply((e) =>
+            $dev ? "localhost:7233" : `${e}:7233`,
+          ),
+          TEMPORAL_NAMESPACE: env.temporal!.namespace,
+          TEMPORAL_TASK_QUEUE: "{{name}}",
+          // Dev mode: inject encoding key directly
+          ...($dev && env.temporal!.devEncodingKey
+            ? { TEMPORAL_ENCODING_KEY: env.temporal!.devEncodingKey }
+            : {}),
+        },
+
+        // Deploy mode: inject encoding key from K8s secret
+        envFromSecrets: $dev ? [] : [env.temporal!.encodingKeySecretName],
+
+        ingress: env.buildIngress({
+          subdomain: "{{name}}-api",
+          healthCheckPath: "/health",
+        }),
+
+        replicas: 1,
+        resources: {
+          cpu: "100m",
+          memory: "128Mi",
+        },
+      },
+      {
+        providers: env.providers,
+        parent: env,
+        dependsOn: [worker],
+      },
+    );
+
+    return {
+      namespace: env.namespace,
+      temporalNamespace: env.temporal?.namespace,
+      temporalEndpoint: env.temporal?.endpoint,
+      encodingKeySecret: env.temporal?.encodingKeySecretName,
+      codecServerUrl: env.temporal?.codecServerUrl,
+      workerTaskQueue: worker.taskQueue,
+      apiUrl: api.url,
+    };
+  },
+});

package/templates/temporal-api-worker/tsconfig.json

@@ -0,0 +1,10 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true
+  }
+}

package/templates/temporal-api-worker/worker/.dockerignore

@@ -0,0 +1,4 @@
+node_modules
+dist
+*.log
+.env*

package/templates/temporal-api-worker/worker/Dockerfile

@@ -0,0 +1,11 @@
+FROM node:20-slim
+
+WORKDIR /app
+
+COPY package*.json ./
+RUN npm ci --omit=dev
+
+COPY . .
+RUN npm run build
+
+CMD ["node", "dist/worker.js"]

package/templates/temporal-api-worker/worker/package.json.hbs

@@ -0,0 +1,25 @@
+{
+  "name": "@{{tenant}}/{{name}}-worker",
+  "version": "0.0.1",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "dev": "tsx watch src/worker.ts",
+    "start": "node dist/worker.js",
+    "build": "tsc && npm run bundle:workflows",
+    "bundle:workflows": "tsx src/bundle-workflows.ts"
+  },
+  "dependencies": {
+    "@temporalio/activity": "^1.11.7",
+    "@temporalio/client": "^1.11.7",
+    "@temporalio/common": "^1.11.7",
+    "@temporalio/proto": "^1.11.7",
+    "@temporalio/worker": "^1.11.7",
+    "@temporalio/workflow": "^1.11.7"
+  },
+  "devDependencies": {
+    "@types/node": "^20.0.0",
+    "tsx": "^4.0.0",
+    "typescript": "^5.0.0"
+  }
+}

package/templates/temporal-api-worker/worker/src/activities.ts.hbs

@@ -0,0 +1,49 @@
+/**
+ * {{titleCase name}} Activities
+ *
+ * Activities are the building blocks of workflows. They handle
+ * non-deterministic operations like API calls, database queries,
+ * and external service interactions.
+ *
+ * Activities can:
+ * - Make HTTP requests
+ * - Query databases
+ * - Send emails/notifications
+ * - Access the file system
+ * - Use Date.now(), Math.random(), etc.
+ */
+
+/**
+ * Generate a greeting message
+ */
+export async function greet(name: string): Promise<string> {
+  console.log(`[Activity] Generating greeting for ${name}`);
+  return `Hello, ${name}!`;
+}
+
+/**
+ * Process a task (simulated)
+ */
+export async function processTask(taskId: string): Promise<string> {
+  console.log(`[Activity] Processing task ${taskId}`);
+
+  // Simulate processing time
+  await new Promise((resolve) => setTimeout(resolve, 1000));
+
+  return "completed";
+}
+
+/**
+ * Send a notification (simulated)
+ */
+export async function sendNotification(
+  userId: string,
+  message: string
+): Promise<boolean> {
+  console.log(`[Activity] Sending notification to ${userId}: ${message}`);
+
+  // Simulate sending
+  await new Promise((resolve) => setTimeout(resolve, 500));
+
+  return true;
+}

package/templates/temporal-api-worker/worker/src/bundle-workflows.ts

@@ -0,0 +1,38 @@
+/**
+ * Bundle Workflows for Production
+ *
+ * Pre-bundles workflows to avoid runtime bundling in production.
+ * Run with: npm run bundle:workflows
+ */
+
+import * as fs from "fs";
+import * as path from "path";
+import { fileURLToPath } from "url";
+import { bundleWorkflowCode } from "@temporalio/worker";
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+
+async function bundle() {
+  console.log("[Bundle] Bundling workflows...");
+
+  const bundle = await bundleWorkflowCode({
+    workflowsPath: path.join(__dirname, "workflows.ts"),
+  });
+
+  const outPath = path.join(__dirname, "..", "dist", "workflows-bundle.js");
+
+  // Ensure dist directory exists
+  const distDir = path.dirname(outPath);
+  if (!fs.existsSync(distDir)) {
+    fs.mkdirSync(distDir, { recursive: true });
+  }
+
+  fs.writeFileSync(outPath, bundle.code);
+  console.log(`[Bundle] Wrote bundle to ${outPath}`);
+}
+
+bundle().catch((err) => {
+  console.error("[Bundle] Failed:", err);
+  process.exit(1);
+});