@mesh-tech/mesh-cli 0.1.1 → 0.12.0

package/stack/observability/otel-collector.yaml

@@ -0,0 +1,73 @@
+# Local OTel Collector — the SAME ingestion topology the hosted platform runs
+# (OpenTelemetryStack: collector → Loki via OTLP, → Tempo via OTLP gRPC,
+# metrics scraped by Prometheus). Locally the k8sattributes processor's job —
+# stamping k8s.namespace.name / k8s.deployment.name / k8s.container.name on
+# every record — is done at the edges instead:
+#   - filelog: derives them from the log path
+#     /var/log/mesh-apps/{namespace}/{service}.log (written by
+#     `mesh dev --local`, namespace = {tenant}-{env}-{app})
+#   - otlp: apps send OTEL_RESOURCE_ATTRIBUTES injected by `mesh dev --local`
+# so hub-api's LogQL/TraceQL queries run UNCHANGED against local data.
+receivers:
+  otlp:
+    protocols:
+      grpc:
+        endpoint: 0.0.0.0:4317
+      http:
+        endpoint: 0.0.0.0:4318
+  filelog:
+    include:
+      - /var/log/mesh-apps/*/*.log
+    start_at: beginning
+    include_file_path: true
+    operators:
+      - type: regex_parser
+        parse_from: attributes["log.file.path"]
+        regex: '^/var/log/mesh-apps/(?P<mesh_namespace>[^/]+)/(?P<mesh_service>[^/]+)\.log$'
+      - type: move
+        from: attributes.mesh_namespace
+        to: resource["k8s.namespace.name"]
+      - type: move
+        from: attributes.mesh_service
+        to: resource["k8s.deployment.name"]
+      - type: copy
+        from: resource["k8s.deployment.name"]
+        to: resource["k8s.container.name"]
+
+processors:
+  batch: {}
+
+exporters:
+  # Same exporter shape as the hosted collector: Loki's native OTLP endpoint.
+  # Loki promotes k8s.namespace.name / k8s.deployment.name /
+  # k8s.container.name to index labels (k8s_namespace_name, …) by default.
+  otlphttp/loki:
+    endpoint: http://loki:3100/otlp
+  otlp/tempo:
+    endpoint: tempo:4317
+    tls:
+      insecure: true
+  prometheus:
+    endpoint: 0.0.0.0:8889
+    resource_to_telemetry_conversion:
+      enabled: true
+
+extensions:
+  health_check:
+    endpoint: 0.0.0.0:13133
+
+service:
+  extensions: [health_check]
+  pipelines:
+    logs:
+      receivers: [otlp, filelog]
+      processors: [batch]
+      exporters: [otlphttp/loki]
+    traces:
+      receivers: [otlp]
+      processors: [batch]
+      exporters: [otlp/tempo]
+    metrics:
+      receivers: [otlp]
+      processors: [batch]
+      exporters: [prometheus]

package/stack/observability/prometheus.yml

@@ -0,0 +1,36 @@
+# Local Prometheus — scrapes the OTel collector's exporter so app metrics
+# sent via OTLP land where hub-api's PROMETHEUS_URL queries expect them.
+global:
+  scrape_interval: 15s
+
+scrape_configs:
+  - job_name: otel-collector
+    static_configs:
+      - targets: ['otel-collector:8889']
+
+  # External-service health probes (blackbox exporter) — the hosted Probe-CR
+  # topology: targets + labels come from file_sd JSON written by the CLI
+  # (mesh dev --externals / ExternalService wiring); probe_success/probe_duration
+  # land with type/tenant/env/app/external_service labels, exactly what
+  # hub-api's health enrichment and uptime views query.
+  - job_name: external-services
+    metrics_path: /probe
+    params:
+      module: [http_2xx]
+    scrape_interval: 30s
+    file_sd_configs:
+      - files: ['/etc/prometheus/probes/*.json']
+        refresh_interval: 15s
+    relabel_configs:
+      - source_labels: [__address__]
+        target_label: __param_target
+      - source_labels: [__param_target]
+        target_label: instance
+      # Per-target module override: file_sd entries may carry a
+      # __probe_module label (e.g. tcp_connect for databases/SFTP, where an
+      # HTTP GET can never succeed); default stays http_2xx from params.
+      - source_labels: [__probe_module]
+        regex: (.+)
+        target_label: __param_module
+      - target_label: __address__
+        replacement: blackbox-exporter:9115

package/stack/observability/tempo.yaml

@@ -0,0 +1,25 @@
+# Local Tempo — trace store behind the OTel collector, same backend the
+# hosted platform runs. hub-api queries it via TEMPO_URL (http://tempo:3200).
+server:
+  http_listen_port: 3200
+
+distributor:
+  receivers:
+    otlp:
+      protocols:
+        grpc:
+          endpoint: 0.0.0.0:4317
+        http:
+          endpoint: 0.0.0.0:4318
+
+storage:
+  trace:
+    backend: local
+    local:
+      path: /var/tempo/blocks
+    wal:
+      path: /var/tempo/wal
+
+compactor:
+  compaction:
+    block_retention: 48h

package/stack/temporal/local.yaml

@@ -0,0 +1,44 @@
+# Local Development Temporal Dynamic Configuration
+# Environment-specific settings for local development.
+# NO authorization block here: the local stack runs Temporal open
+# (TEMPORAL_AUTH_ENABLED=false in compose) and the seeder connects
+# without a token — auth is exercised on deployed platforms only.
+system.forceSearchAttributesCacheRefreshOnRead:
+  - value: true
+    constraints: {}
+
+frontend.enableUpdateWorkflowExecution:
+  - value: true
+    constraints: {}
+
+frontend.enableUpdateWorkflowExecutionAsyncAccepted:
+  - value: true
+    constraints: {}
+
+system.enableEagerWorkflowStart:
+  - value: true
+    constraints: {}
+
+system.enableActivityEagerExecution:
+  - value: true
+    constraints: {}
+
+frontend.enableWorkerVersioningDataAPIs:
+  - value: true
+    constraints: {}
+
+frontend.enableWorkerVersioningWorkflowAPIs:
+  - value: true
+    constraints: {}
+
+frontend.enableWorkerVersioningRuleAPIs:
+  - value: true
+    constraints: {}
+
+worker.buildIdScavengerEnabled:
+  - value: true
+    constraints: {}
+
+frontend.enableExecuteMultiOperation:
+  - value: true
+    constraints: {}

package/templates/api-auth/AGENTS.md.hbs

@@ -0,0 +1,16 @@
+# Agent guidance — {{name}}
+
+- Invoke the CLI as `pnpm mesh <cmd>` or (cwd-independent) `pnpm exec mesh <cmd>` —
+  a `"mesh"` script + the bundled `@mesh-tech/*` dep make both work after
+  `pnpm install`. For a bare `mesh` on PATH, run once: `pnpm exec mesh install-shim`.
+- Operations are `mesh` commands, never raw `aws`/`pulumi`/`kubectl`:
+  `mesh start`, `mesh login local`, `mesh dev`, `mesh deploy`.
+- The full local proof is in the README: 401 (no token) → 200 (`mesh login
+  local` token) → 403 (no grant) → `pnpm seed:authz` → 200.
+- Authorization rules live ONLY in `api/src/schema.ts` (`defineSchema`);
+  routes enforce them with `m.require(resource, action)`. Never hand-roll
+  permission checks in route handlers.
+- `spicedb-http-provider.ts` is a starter — swap for the first-party
+  provider when @mesh-tech/authz ships it.
+- Pattern skills for authn/authz ship inside those packages (TanStack
+  Intent discovers them after `pnpm install`).

package/templates/api-auth/Pulumi.dev.yaml.hbs

@@ -0,0 +1,8 @@
+config:
+  aws:region: us-east-2
+  mesh:tenant: {{tenant}}
+  mesh:platform:
+    name: mesh
+    env: dev
+  mesh:deploy: false
+  mesh:deployerRole: arn:aws:iam::123456789012:role/{{tenant}}-dev-apps-deployer

package/templates/api-auth/Pulumi.yaml.hbs

@@ -0,0 +1,8 @@
+name: {{name}}
+runtime:
+  name: nodejs
+  options:
+    packagemanager: pnpm
+    nodeargs: "--import tsx"
+backend:
+  url: s3://mesh-platform-pulumi-state

package/templates/api-auth/README.md.hbs

@@ -0,0 +1,67 @@
+# {{titleCase name}}
+
+Platform-authenticated API: `@mesh-tech/authn` (Zitadel JWT) + `@mesh-tech/authz`
+(schema-driven SpiceDB permissions). Three routes: open, authenticated,
+permission-gated.
+
+## Run it locally (no AWS, no VPN)
+
+```bash
+mesh start            # local platform (seeded Zitadel + SpiceDB)
+mesh login local      # sign in as dev@local.mesh / LocalDev1!
+pnpm install
+mesh dev              # wires the api to the local platform
+```
+
+## Prove the auth planes (401 → 200 → 403 → 200)
+
+```bash
+# open route — no token
+curl -s http://localhost:3000/health
+# → {"status":"ok"}
+
+# authenticated route without a token → 401
+curl -s -o /dev/null -w '%{http_code}\n' http://localhost:3000/api/me
+# → 401
+
+# with your mesh login token → 200
+TOKEN=$(jq -r '.local.accessToken' ~/.config/mesh/credentials.json)
+curl -s http://localhost:3000/api/me -H "Authorization: Bearer $TOKEN"
+# → {"sub":"…","email":"dev@local.mesh"}
+
+# permission-gated route before any grant → 403
+curl -s -o /dev/null -w '%{http_code}\n' http://localhost:3000/api/report -H "Authorization: Bearer $TOKEN"
+# → 403
+
+# grant yourself report:view (writes the SpiceDB schema + relation) …
+SUB=$(jq -r '.local.sub' ~/.config/mesh/credentials.json)
+cd api && pnpm seed:authz -- "$SUB" && cd ..
+
+# … now 200
+curl -s http://localhost:3000/api/report -H "Authorization: Bearer $TOKEN"
+# → {"id":"quarterly","title":"Quarterly Report",…}
+```
+
+Log in as `ops@local.mesh` instead and `/api/report` stays 403 — the grant
+is per-subject, in SpiceDB, exactly like the deployed platform.
+
+## Deploy to a tenant environment
+
+The deployed Service runs behind the platform's oauth2-proxy sidecar
+(`auth: { provider: "mesh", … }` in `index.ts`), which needs its own OIDC
+client in the platform Zitadel:
+
+```bash
+mesh login {{tenant}}.dev
+pulumi config set {{name}}:authClientId <clientId>
+pulumi config set --secret {{name}}:authClientSecret <clientSecret>
+mesh deploy up --yes
+```
+
+## Layout
+
+- `index.ts` — Pulumi program (`Service` with platform auth + `/health` open)
+- `api/src/index.ts` — Hono app: authn middleware + authz `require()`
+- `api/src/schema.ts` — the authorization schema (single source of truth)
+- `api/src/spicedb-http-provider.ts` — starter `AuthzProvider` (HTTP API)
+- `api/src/seed-authz.ts` — local schema write + grant

package/templates/api-auth/api/package.json.hbs

@@ -0,0 +1,28 @@
+{
+  "name": "{{name}}-api",
+  "version": "0.0.1",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "dev": "tsx watch src/index.ts",
+    "start": "node dist/index.js",
+    "build": "esm-bundle src/index.ts --outfile dist/index.js",
+    "check-types": "tsc --noEmit",
+    "seed:authz": "tsx src/seed-authz.ts"
+  },
+  "dependencies": {
+    "@mesh-tech/authn": "latest",
+    "@mesh-tech/authz": "latest",
+    "@opentelemetry/auto-instrumentations-node": "^0.78.0",
+    "@mesh-tech/sinks": "latest",
+    "hono": "^4.0.0",
+    "@hono/node-server": "^1.0.0",
+    "zod": "^4.0.0"
+  },
+  "devDependencies": {
+    "@mesh-tech/esm-bundle": "latest",
+    "@types/node": "^20.0.0",
+    "tsx": "^4.0.0",
+    "typescript": "^5.0.0"
+  }
+}

package/templates/api-auth/api/src/index.ts.hbs

@@ -0,0 +1,96 @@
+/**
+ * {{titleCase name}} API — platform auth on both planes.
+ *
+ * authn (@mesh-tech/authn): verifies Zitadel JWTs (zitadel-jwt scheme).
+ * authz (@mesh-tech/authz): schema-driven permission checks via SpiceDB.
+ *
+ * Routes:
+ *   GET /health      public (no token)
+ *   GET /api/me      authenticated (valid JWT → 200, none → 401)
+ *   GET /api/report  permission-gated (needs report:view via SpiceDB → else 403)
+ *
+ * Environment (mesh dev injects all of these — local or tethered):
+ *   PORT, ZITADEL_ISSUER, SPICEDB_ENDPOINT, SPICEDB_PRESHARED_KEY
+ */
+
+import { Hono } from "hono";
+import { serve } from "@hono/node-server";
+import { createAuthn } from "@mesh-tech/authn";
+import { zitadelJwtScheme } from "@mesh-tech/authn/schemes/zitadel-jwt";
+import { createAuthnMiddleware, type AuthnVariables } from "@mesh-tech/authn/hono";
+import { createAuthz } from "@mesh-tech/authz/runtime";
+import { createAuthzMiddleware, type AuthzVariables } from "@mesh-tech/authz/hono";
+import { schema } from "./schema.js";
+import { spiceDbHttpProvider } from "./spicedb-http-provider.js";
+
+const PORT = parseInt(process.env.PORT ?? "3000", 10);
+const ZITADEL_ISSUER = process.env.ZITADEL_ISSUER ?? "http://localhost:8080";
+
+// --- authn: who is calling ---
+
+// Audience: locally, mesh dev injects the seeded CLI app's clientId
+// (tokens come from `mesh login local`); in the cloud this is the app's own
+// audience and consumers request its project-audience scope.
+const AUTH_AUDIENCE = process.env.AUTH_AUDIENCE ?? "{{name}}";
+
+const authn = createAuthn({
+  schemes: {
+    "zitadel-jwt": zitadelJwtScheme({ issuer: ZITADEL_ISSUER, audience: AUTH_AUDIENCE }),
+  },
+});
+const { middleware: requireAuth, public: publicRoute } = createAuthnMiddleware(authn);
+
+// --- authz: what they may do ---
+
+const authz = createAuthz({
+  schemas: {
+    "{{name}}": {
+      schema,
+      provider: spiceDbHttpProvider({
+        endpoint: process.env.SPICEDB_HTTP_ENDPOINT ?? "http://localhost:8443",
+        // "local-dev-key" is the `mesh start` stack's key — local ONLY. In
+        // any deployed env the platform injects SPICEDB_PRESHARED_KEY; fail
+        // loudly rather than silently authing with the public default.
+        presharedKey:
+          process.env.SPICEDB_PRESHARED_KEY ??
+          (process.env.NODE_ENV === "production"
+            ? (() => {
+                throw new Error("SPICEDB_PRESHARED_KEY is required in production");
+              })()
+            : "local-dev-key"),
+      }),
+    },
+  },
+});
+// Explicit subject mapping: authenticated humans are the schema's `user`
+// subject. Required, not optional — the default resolver types EVERY caller as
+// `api_key` (MESH-2472), and a relation cannot target `api_key`, so this app's
+// `viewer: { subject: "user" }` relation would never match without this.
+const m = createAuthzMiddleware(authz, {
+  resolveSubject: (c) => ({ type: "user", id: (c as { get(key: "auth"): { subjectSub: string } }).get("auth").subjectSub }),
+});
+
+// --- routes ---
+
+const app = new Hono<{ Variables: AuthnVariables & AuthzVariables }>();
+
+// Open: no token needed (also excluded from the oauth2-proxy in the cloud)
+app.get("/health", publicRoute(), (c) => c.json({ status: "ok" }));
+
+// Everything under /api requires a valid Zitadel JWT…
+app.use("/api/*", requireAuth());
+app.use("/api/*", m.authContextMiddleware());
+
+// …authenticated is enough here:
+app.get("/api/me", (c) =>
+  c.json({ sub: c.var.auth.subjectSub, email: c.var.auth.claims?.email }),
+);
+
+// …and this one additionally needs the report:view permission (SpiceDB):
+app.get("/api/report", m.require("report", "view", { id: () => "quarterly" }), (c) =>
+  c.json({ id: "quarterly", title: "Quarterly Report", classification: "internal" }),
+);
+
+serve({ fetch: app.fetch, port: PORT }, () => {
+  console.log(`{{name}} api listening on :${PORT} (issuer: ${ZITADEL_ISSUER})`);
+});

package/templates/api-auth/api/src/schema.ts.hbs

@@ -0,0 +1,35 @@
+/**
+ * Authorization schema — the single source of truth (@mesh-tech/authz).
+ *
+ * One resource (`report`) with one gated action (`view`), grantable via the
+ * `viewer` relation. `pnpm seed:authz` compiles this to SpiceDB and grants
+ * the local dev test user; in the cloud the compiled schema ships through
+ * the platform's authz pipeline.
+ */
+
+import { defineSchema } from "@mesh-tech/authz/schema";
+import { z } from "zod";
+
+const Report = z.object({
+  id: z.string(),
+  title: z.string(),
+});
+
+export const schema = defineSchema({
+  namespace: "{{name}}",
+  version: "1.0.0",
+  subjects: {
+    user: { coarseRoles: ["user"], identity: { claim: "sub" } },
+  },
+  resources: {
+    report: {
+      schema: Report,
+      actions: ["view"] as const,
+      relations: {
+        viewer: { subject: "user", grants: ["view"], writeAuthority: "app" },
+      },
+    },
+  },
+  coarseRoles: ["user"] as const,
+  zitadelSync: "coarse",
+});

package/templates/api-auth/api/src/seed-authz.ts.hbs

@@ -0,0 +1,48 @@
+/**
+ * Local authz seed: compile the schema to SpiceDB and grant the dev test
+ * user the report `viewer` relation — the 403→200 half of the README proof.
+ *
+ *   pnpm seed:authz               # after `mesh start`
+ *
+ * dev@local.mesh gets report:view; ops@local.mesh does not (stays 403).
+ */
+
+import { compileSpiceDBSchema } from "@mesh-tech/authz/compilers";
+import { schema } from "./schema.js";
+import { spiceDbHttpProvider } from "./spicedb-http-provider.js";
+
+const ENDPOINT = process.env.SPICEDB_HTTP_ENDPOINT ?? "http://localhost:8443";
+const KEY = process.env.SPICEDB_PRESHARED_KEY ?? "local-dev-key";
+
+// The Zitadel subject (`sub` claim) of the user to grant. Find it after
+// `mesh login local`: the CLI caches it in ~/.config/mesh/credentials.json,
+// or pass it explicitly: pnpm seed:authz -- <sub>
+// pnpm may forward a literal "--" — ignore it
+const sub = process.argv.slice(2).filter((a) => a !== "--")[0] ?? process.env.SEED_USER_SUB;
+if (!sub) {
+  console.error("Usage: pnpm seed:authz <zitadel-user-sub>");
+  console.error("(the `sub` from your mesh login local session — see README)");
+  process.exit(1);
+}
+
+const { zed } = compileSpiceDBSchema(schema);
+
+const res = await fetch(`${ENDPOINT}/v1/schema/write`, {
+  method: "POST",
+  headers: { Authorization: `Bearer ${KEY}`, "Content-Type": "application/json" },
+  body: JSON.stringify({ schema: zed }),
+});
+if (!res.ok) {
+  console.error(`schema write failed: ${res.status} ${await res.text()}`);
+  process.exit(1);
+}
+console.log("✓ SpiceDB schema written");
+
+const provider = spiceDbHttpProvider({ endpoint: ENDPOINT, presharedKey: KEY });
+await provider.writeRelationship({
+  subject: { type: "user", id: sub },
+  relation: "viewer",
+  resource: { type: "report", id: "quarterly" },
+  op: "touch",
+});
+console.log(`✓ Granted report:view on 'quarterly' to user ${sub}`);

package/templates/api-auth/api/src/spicedb-http-provider.ts.hbs

@@ -0,0 +1,89 @@
+/**
+ * Minimal AuthzProvider over SpiceDB's HTTP API.
+ *
+ * The `mesh start` local platform exposes SpiceDB HTTP on :8443 (preshared
+ * key `local-dev-key`); deployed SpiceDB exposes the same API. When the
+ * platform ships a first-party gRPC provider in @mesh-tech/authz (tracked
+ * under MESH-1823-adjacent runtime work), swap this file for it — the
+ * AuthzProvider seam is the whole point.
+ */
+
+import type { AuthzProvider } from "@mesh-tech/authz/runtime";
+
+export interface SpiceDbHttpConfig {
+  /** e.g. http://localhost:8443 */
+  endpoint: string;
+  presharedKey: string;
+}
+
+async function call(cfg: SpiceDbHttpConfig, path: string, body: unknown): Promise<any> {
+  const res = await fetch(`${cfg.endpoint}${path}`, {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${cfg.presharedKey}`,
+      "Content-Type": "application/json",
+    },
+    body: JSON.stringify(body),
+  });
+  const data: any = await res.json().catch(() => ({}));
+  if (!res.ok) {
+    throw new Error(`SpiceDB ${path} → ${res.status}: ${data?.message ?? "error"}`);
+  }
+  return data;
+}
+
+export function spiceDbHttpProvider(cfg: SpiceDbHttpConfig): AuthzProvider {
+  // compileSpiceDBSchema emits unprefixed definitions (`definition report`),
+  // so object types pass through as-is.
+  const objectType = (type: string) => type;
+  return {
+    name: "spicedb-http",
+
+    async checkPermission({ subject, action, resource, consistency }) {
+      // An id-less m.require() would silently check the wildcard resource —
+      // fail-closed in practice, but it hides the caller's bug. Fail loud.
+      if (!resource.id) {
+        throw new Error(
+          `checkPermission: resource.id is required (got type '${resource.type}' with no id) — pass the object id being authorized.`,
+        );
+      }
+      // Default to fully-consistent: the hello-world flow grants then checks
+      // immediately, and SpiceDB's minimize-latency default can serve a stale
+      // denial. Tune per-call via the runtime's consistency hint in real apps.
+      const data = await call(cfg, "/v1/permissions/check", {
+        consistency:
+          consistency === "minimize-latency" ? { minimizeLatency: true } : { fullyConsistent: true },
+        resource: { objectType: objectType(resource.type), objectId: resource.id },
+        permission: action,
+        subject: { object: { objectType: objectType(subject.type), objectId: subject.id } },
+      });
+      return { allowed: data.permissionship === "PERMISSIONSHIP_HAS_PERMISSION" };
+    },
+
+    async writeRelationship({ subject, relation, resource, op }) {
+      const operation =
+        op === "delete" ? "OPERATION_DELETE" : op === "create" ? "OPERATION_CREATE" : "OPERATION_TOUCH";
+      await call(cfg, "/v1/relationships/write", {
+        updates: [
+          {
+            operation,
+            relationship: {
+              resource: { objectType: objectType(resource.type), objectId: resource.id },
+              relation,
+              subject: { object: { objectType: objectType(subject.type), objectId: subject.id } },
+            },
+          },
+        ],
+      });
+      return {};
+    },
+
+    async lookupResources() {
+      throw new Error("lookupResources not implemented by the HTTP starter provider");
+    },
+
+    async lookupSubjects() {
+      throw new Error("lookupSubjects not implemented by the HTTP starter provider");
+    },
+  };
+}

package/templates/api-auth/index.ts.hbs

@@ -0,0 +1,65 @@
+/**
+ * {{titleCase name}} — Platform-authenticated API
+ *
+ * Infrastructure: AppEnvironment + API Service behind platform auth
+ * (oauth2-proxy sidecar against the platform Zitadel).
+ *
+ * Local:   mesh start && mesh dev   (runtime auth only — no proxy sidecar)
+ * Deploy:  mesh deploy up
+ */
+
+import * as pulumi from "@pulumi/pulumi";
+import * as path from "node:path";
+import { fileURLToPath } from "node:url";
+import { mesh } from "@mesh-tech/app-kit";
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const { tenant, platform, stack, deploy } = mesh.apps.getConfig(pulumi);
+
+// --- Environment ---
+
+const env = new mesh.apps.AppEnvironment("env", {
+  tenant,
+  platform,
+  stack,
+  deploy,
+  appName: "{{name}}",
+  namespace: true,
+  rootDir: __dirname,
+});
+
+// --- Services ---
+
+// The oauth2-proxy sidecar needs its own OIDC client in the platform
+// Zitadel. Approved tenant-auth pattern: one Zitadel PROJECT per app (in
+// your app tenant's org), one APPLICATION per service — create the app's
+// project if it doesn't exist, add a web application for this service, and
+// set both values on the stack:
+//   pulumi config set {{name}}:authClientId <clientId>
+//   pulumi config set --secret {{name}}:authClientSecret <clientSecret>
+const appConfig = new pulumi.Config("{{name}}");
+
+const api = new mesh.apps.Service("api", {
+  env,
+  runtime: "node",
+  src: "./api",
+  port: 3000,
+  auth: {
+    provider: "mesh", // issuer auto-derived from the platform Zitadel
+    clientId: appConfig.require("authClientId"),
+    clientSecret: appConfig.requireSecret("authClientSecret"),
+    allowUnauthenticated: ["/health"],
+  },
+  ingress: env.buildIngress({
+    subdomain: "{{name}}-api",
+    healthCheckPath: "/health",
+  }),
+  replicas: 1,
+  resources: { cpu: "100m", memory: "128Mi" },
+});
+
+// --- Outputs ---
+
+export const app = env.register({
+  description: "{{titleCase name}} — platform-authenticated API (authn + authz)",
+});

package/templates/api-auth/package.json.hbs

@@ -0,0 +1,20 @@
+{
+  "name": "{{name}}",
+  "version": "0.0.1",
+  "private": true,
+  "type": "module",
+  "packageManager": "pnpm@10.29.2",
+  "keywords": ["tanstack-intent"],
+  "scripts": {
+    "mesh": "mesh",
+    "typecheck": "tsc --noEmit"
+  },
+  "dependencies": {
+    "@mesh-tech/app-kit": "latest",
+    "@pulumi/pulumi": "^3.214.1"
+  },
+  "devDependencies": {
+    "tsx": "^4.20.4",
+    "typescript": "^5.7.2"
+  }
+}