@mesh-tech/mesh-cli 0.1.1 → 0.12.1

package/templates/external-service/Pulumi.dev.yaml.hbs

@@ -0,0 +1,8 @@
+config:
+  aws:region: us-east-2
+  mesh:tenant: {{tenant}}
+  mesh:platform:
+    name: mesh
+    env: dev
+  mesh:deploy: false
+  mesh:deployerRole: arn:aws:iam::123456789012:role/{{tenant}}-dev-apps-deployer

package/templates/external-service/Pulumi.yaml.hbs

@@ -0,0 +1,8 @@
+name: {{name}}
+runtime:
+  name: nodejs
+  options:
+    packagemanager: pnpm
+    nodeargs: "--import tsx"
+backend:
+  url: s3://mesh-platform-pulumi-state

package/templates/external-service/README.md.hbs

@@ -0,0 +1,56 @@
+# {{titleCase name}}
+
+External-service pattern app: a Hono API that calls a third-party vendor
+(`vendorpay`) through platform-managed credentials. The vendor is declared as
+a first-class `ExternalService` — the platform owns the credential shell,
+Hub registration, and health probe; credentials never live in code or config.
+
+## Run it locally (no AWS, no VPN)
+
+```bash
+mesh start            # local Mesh platform — the Hub is at http://localhost:9000
+pnpm install
+mesh dev --externals  # starts api + the mocks/vendorpay stand-in, and points
+                      # the vendorpay credential secret at it
+```
+
+Prove the pattern end-to-end (the api resolves credentials from Secrets
+Manager, then calls the vendor with them):
+
+```bash
+curl -s http://localhost:3000/health
+# → {"status":"ok"}
+
+curl -s -X POST http://localhost:3000/payments/quote \
+  -H 'content-type: application/json' -d '{"amount": 125.5}'
+# → {"vendor":"vendorpay","amount":125.5,"quote":{"quoteId":"…","fee":3.64,"total":129.14,…}}
+```
+
+The mock enforces the API key exactly like a real vendor — the call only
+succeeds because the api read `baseUrl` + `apiKey` from the credential secret
+at `mesh/{{tenant}}/dev/external/vendorpay`. Watch it in the **Hub**
+(http://localhost:9000 → {{tenant}} → {{name}}): the app's services, the
+`vendorpay` external service, and both services' logs.
+
+`mesh dev --externals=vendorpay` starts a named subset; plain `mesh dev` starts
+only the app services (calls to the vendor fail credential resolution —
+by design, no silent fallbacks).
+
+## Deploy to a tenant environment
+
+```bash
+mesh login {{tenant}}.dev
+mesh deploy up
+mesh secrets set external/vendorpay      # set the REAL baseUrl + apiKey
+```
+
+Deployed, the exact same code runs: `vendorpay.link()` injects
+`VENDORPAY_SECRET_PREFIX` + IAM read permission, `resolveCredentials`
+fetches the real values, and the Hub shows the vendor with its credential
+schema and health probe.
+
+## Layout
+
+- `index.ts` — infra: `AppEnvironment` + `ExternalService("vendorpay")` + api `Service` with `vendorpay.link()`
+- `api/` — the service; `resolveCredentials("vendorpay")` + `@mesh-tech/http-client`
+- `mocks/vendorpay/` — the local vendor stand-in (declared in `package.json` → `mesh.externals`, mode `mock`)

package/templates/external-service/api/Dockerfile

@@ -0,0 +1,15 @@
+FROM node:20-slim
+
+WORKDIR /app
+
+COPY package*.json ./
+# Full install (not --omit=dev): the build needs esm-bundle, a devDependency.
+# npm install (not ci) — these scaffolds ship no lockfile.
+RUN npm install
+
+COPY . .
+RUN npm run build
+
+EXPOSE 3000
+
+CMD ["node", "dist/index.js"]

package/templates/external-service/api/package.json.hbs

@@ -0,0 +1,25 @@
+{
+  "name": "{{name}}-api",
+  "version": "0.0.1",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "dev": "tsx watch src/index.ts",
+    "start": "node dist/index.js",
+    "build": "esm-bundle src/index.ts --outfile dist/index.js",
+    "check-types": "tsc --noEmit"
+  },
+  "dependencies": {
+    "@mesh-tech/app-kit": "latest",
+    "@opentelemetry/auto-instrumentations-node": "^0.78.0",
+    "@mesh-tech/http-client": "latest",
+    "hono": "^4.0.0",
+    "@hono/node-server": "^1.0.0"
+  },
+  "devDependencies": {
+    "@mesh-tech/esm-bundle": "latest",
+    "@types/node": "^20.0.0",
+    "tsx": "^4.0.0",
+    "typescript": "^5.0.0"
+  }
+}

package/templates/external-service/api/src/index.ts.hbs

@@ -0,0 +1,81 @@
+/**
+ * {{titleCase name}} API — calls the vendorpay external service.
+ *
+ * The external-service pattern, runtime side:
+ *   1. Infra links the ExternalService → this process gets
+ *      VENDORPAY_SECRET_PREFIX (+ IAM to read that secret).
+ *   2. resolveCredentials("vendorpay") reads the credential JSON from
+ *      Secrets Manager at runtime (cached 5 min) — never from env/config.
+ *   3. The vendor call goes through @mesh-tech/http-client's enhanceFetch
+ *      (correlation-id propagation + structured request logs).
+ *
+ * Locally (`mesh dev --externals`), the SAME code runs: the credential secret in
+ * the local platform's Secrets Manager points baseUrl at the started
+ * mocks/vendorpay service. The app cannot tell the difference.
+ */
+
+import { serve } from "@hono/node-server";
+import { Hono } from "hono";
+import { resolveCredentials } from "@mesh-tech/app-kit/credentials";
+import { traceExternalCall } from "@mesh-tech/app-kit/tracing";
+import { enhanceFetch } from "@mesh-tech/http-client";
+
+interface VendorpayCredentials extends Record<string, string> {
+  baseUrl: string;
+  apiKey: string;
+}
+
+const vendorFetch = enhanceFetch();
+
+const app = new Hono();
+
+app.get("/health", (c) => c.json({ status: "ok" }));
+
+/**
+ * Quote a payment through the vendor. Demonstrates the full pattern:
+ * resolve credentials → call the vendor → normalize the response.
+ */
+app.post("/payments/quote", async (c) => {
+  const body = await c.req.json().catch(() => ({}));
+  const amount = Number(body?.amount ?? 0);
+  if (!Number.isFinite(amount) || amount <= 0) {
+    return c.json({ error: "amount must be a positive number" }, 400);
+  }
+
+  const creds = await resolveCredentials<VendorpayCredentials>("vendorpay");
+
+  // traceExternalCall wraps the vendor call in an `external.vendorpay/…`
+  // span (span.external_service.name) — the Hub's Integrations → Traces
+  // view is built on exactly these spans. The auto-instrumented fetch
+  // appears as its child with the real network timing.
+  const response = await traceExternalCall("vendorpay", "quote.create", () =>
+    vendorFetch(`${creds.baseUrl.replace(/\/+$/, "")}/quote`, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        "x-api-key": creds.apiKey,
+      },
+      body: JSON.stringify({ amount }),
+    }),
+  );
+
+  // Log vendor interactions with the service name — these lines are what
+  // the Hub's Integrations → Monitoring → Logs view surfaces (it searches
+  // consumer logs for mentions of the external service).
+  console.log(`[vendorpay] quote requested amount=${amount} → ${response.status}`);
+
+  if (!response.ok) {
+    return c.json(
+      { error: `vendorpay quote failed (${response.status})` },
+      502,
+    );
+  }
+
+  const quote = await response.json();
+  return c.json({ vendor: "vendorpay", amount, quote });
+});
+
+const port = Number(process.env.PORT ?? 3000);
+serve({ fetch: app.fetch, port }, () => {
+  console.log(`[API] {{titleCase name}} API listening on port ${port}`);
+});

package/templates/external-service/index.ts.hbs

@@ -0,0 +1,82 @@
+/**
+ * {{titleCase name}} — External-Service Pattern Application
+ *
+ * Declares a third-party vendor as a first-class ExternalService: the
+ * platform owns the credential SHELL (Secrets Manager path + schema + Hub
+ * registration + health probe); real values are set out-of-band with
+ * `mesh secrets set external/vendorpay` (or the Hub UI) and the app resolves
+ * them at RUNTIME — credentials never touch code, config files, or Pulumi
+ * state.
+ *
+ * Dev mode:  mesh dev --externals   (starts mocks/vendorpay and points the
+ *                                    credential secret at it — same runtime path)
+ * Deploy:    mesh deploy up
+ */
+
+import * as pulumi from "@pulumi/pulumi";
+import * as path from "node:path";
+import { fileURLToPath } from "node:url";
+import { mesh } from "@mesh-tech/app-kit";
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const { tenant, platform, stack, deploy } = mesh.apps.getConfig(pulumi);
+
+// --- Environment ---
+
+const env = new mesh.apps.AppEnvironment("env", {
+  tenant,
+  platform,
+  stack,
+  deploy,
+  appName: "{{name}}",
+  namespace: true,
+  rootDir: __dirname,
+});
+
+// --- External service (the vendor) ---
+// Registers in the Hub's external-services view, creates the credential
+// shell at mesh/{tenant}/{stage}/external/vendorpay, and (deployed) probes
+// the vendor's health endpoint.
+
+const vendorpay = new mesh.apps.ExternalService("vendorpay", {
+  env,
+  type: "payment",
+  kind: "connection",
+  description: "Example payments vendor (quotes API) — the external-service pattern",
+  credentials: {
+    fields: {
+      baseUrl: { name: "Base URL", description: "Vendor API endpoint" },
+      apiKey: { name: "API Key", description: "Vendor API key", secret: true },
+    },
+  },
+  healthCheck: {
+    // Replace with the vendor's real health/status URL.
+    url: "https://status.vendorpay.example.com/health",
+    intervalSeconds: 300,
+  },
+});
+
+// --- Services ---
+
+const api = new mesh.apps.Service("api", {
+  env,
+  runtime: "node",
+  src: "./api",
+  port: 3000,
+  // link() injects VENDORPAY_SECRET_PREFIX + the IAM permission to read the
+  // credential secret; the api calls resolveCredentials("vendorpay") at
+  // runtime.
+  link: [vendorpay.link()],
+  ingress: env.buildIngress({
+    subdomain: "{{name}}-api",
+    healthCheckPath: "/health",
+  }),
+  replicas: 1,
+  resources: { cpu: "100m", memory: "128Mi" },
+});
+
+// --- Outputs ---
+
+export const app = env.register({
+  description: "{{titleCase name}} — external-service (vendor credentials) pattern",
+});

package/templates/external-service/mocks/vendorpay/package.json.hbs

@@ -0,0 +1,9 @@
+{
+  "name": "{{name}}-mock-vendorpay",
+  "version": "0.0.1",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "dev": "node server.mjs"
+  }
+}

package/templates/external-service/mocks/vendorpay/server.mjs.hbs

@@ -0,0 +1,61 @@
+/**
+ * Mock vendorpay — a stand-in for the real vendor API, started by
+ * `mesh dev --externals`. Enforces the API key exactly like the real vendor
+ * would, so the app's credential path is exercised end-to-end.
+ *
+ * Declared in the root package.json under `mesh.externals.vendorpay`
+ * (mode `mock`); the CLI
+ * allocates a port, seeds the external-service credential secret with this
+ * server's URL + key, and ships its logs to the platform pipeline like any
+ * other service.
+ */
+
+import http from "node:http";
+
+const PORT = Number(process.env.PORT ?? 4610);
+const API_KEY = process.env.MOCK_API_KEY ?? "local-mock-key";
+
+const server = http.createServer((req, res) => {
+  const send = (status, body) => {
+    res.writeHead(status, { "content-type": "application/json" });
+    res.end(JSON.stringify(body));
+  };
+
+  if (req.url === "/health") {
+    return send(200, { status: "ok", vendor: "vendorpay-mock" });
+  }
+
+  if (req.url === "/quote" && req.method === "POST") {
+    if (req.headers["x-api-key"] !== API_KEY) {
+      console.log(`[mock-vendorpay] 401 — bad or missing x-api-key`);
+      return send(401, { error: "invalid api key" });
+    }
+    let raw = "";
+    req.on("data", (chunk) => (raw += chunk));
+    req.on("end", () => {
+      let amount = 0;
+      try {
+        amount = Number(JSON.parse(raw || "{}").amount ?? 0);
+      } catch {
+        /* ignore malformed body */
+      }
+      const fee = Math.max(0.5, Math.round(amount * 2.9) / 100);
+      console.log(`[mock-vendorpay] quote amount=${amount} fee=${fee}`);
+      send(200, {
+        quoteId: `q-${Date.now()}`,
+        amount,
+        fee,
+        total: Math.round((amount + fee) * 100) / 100,
+        currency: "USD",
+        quotedAt: new Date().toISOString(),
+      });
+    });
+    return;
+  }
+
+  send(404, { error: "not found" });
+});
+
+server.listen(PORT, () => {
+  console.log(`[mock-vendorpay] listening on port ${PORT} (api key: ${API_KEY})`);
+});

package/templates/external-service/package.json.hbs

@@ -0,0 +1,34 @@
+{
+  "name": "{{name}}",
+  "version": "0.0.1",
+  "private": true,
+  "type": "module",
+  "packageManager": "pnpm@10.29.2",
+  "keywords": ["tanstack-intent"],
+  "scripts": {
+    "mesh": "mesh",
+    "typecheck": "tsc --noEmit"
+  },
+  "dependencies": {
+    "@mesh-tech/app-kit": "latest",
+    "@pulumi/pulumi": "^3.214.1"
+  },
+  "devDependencies": {
+    "tsx": "^4.20.4",
+    "typescript": "^5.7.2"
+  },
+  "mesh": {
+    "externals": {
+      "vendorpay": {
+        "mode": "mock",
+        "src": "mocks/vendorpay",
+        "external": "vendorpay",
+        "env": { "MOCK_API_KEY": "local-mock-key" },
+        "credentials": {
+          "baseUrl": "\{{url}}",
+          "apiKey": "local-mock-key"
+        }
+      }
+    }
+  }
+}

package/templates/external-service/skills/develop/SKILL.md.hbs

@@ -0,0 +1,55 @@
+---
+name: develop-{{name}}
+description: Run, extend, and deploy the {{name}} external-service app — vendor credentials via the platform, local vendor mock, and the deploy path.
+---
+
+# Developing {{name}}
+
+## Run locally (zero cloud access)
+
+```bash
+mesh start            # local Mesh platform (Hub at http://localhost:9000)
+pnpm install
+mesh dev --externals  # api + mocks/vendorpay, credential secret auto-seeded
+```
+
+Prove it: `curl -s -X POST localhost:3000/payments/quote -H 'content-type: application/json' -d '{"amount":125.5}'` → a quote from the mock, obtained with credentials the api resolved from Secrets Manager. Inspect in the Hub (http://localhost:9000 → {{tenant}} → {{name}}): services, the `vendorpay` external service, logs.
+
+**Reaching a sibling service.** With more than one service in the app, `mesh dev --local` injects `SERVICE_{NAME}_URL` into every service's env — `{NAME}` is the service's directory name upper-cased, with anything outside `A–Z0–9` becoming `_` (`token-manager` → `SERVICE_TOKEN_MANAGER_URL`). To read the *same* variable deployed and locally, name the link to match: `events.link({ environmentPrefix: "SERVICE_EVENTS" })` — then `process.env.SERVICE_EVENTS_URL` works everywhere, with no `isLocal` branch in your code.
+
+## The pattern
+
+1. **Declare** the vendor once in `index.ts`: `new mesh.apps.ExternalService("vendorpay", { credentials: { fields: … }, healthCheck: … })` — the platform owns the secret shell at `mesh/{tenant}/{stage}/external/vendorpay`, the Hub registration, and the health probe.
+2. **Link** it into consumers: `link: [vendorpay.link()]` → injects `VENDORPAY_SECRET_PREFIX` + IAM read.
+3. **Resolve at runtime**: `resolveCredentials("vendorpay")` (`@mesh-tech/app-kit/credentials`) — cached, never in env/config/state.
+4. **Call** through `enhanceFetch()` (`@mesh-tech/http-client`) so requests carry correlation ids and structured logs.
+
+Add a credential field: extend `credentials.fields` in `index.ts` AND the typed interface in `api/src/index.ts`. Add another vendor: repeat the declaration, link it, and (optionally) add a `mesh.externals` entry so `mesh dev --externals` can realize it locally.
+
+## Externals
+
+Declared in the root `package.json` → `mesh.externals.<name>`; `mesh dev --externals` realizes all of them (`--externals vendorpay` a subset). Each declaration runs in one of **three modes**:
+
+| Mode | Meaning | Declare |
+|---|---|---|
+| `mock` | the service is **emulated** — no real instance exists | `{ mode: "mock", src: "mocks/vendorpay", … }` runs the dir's `dev` script as `mock-<name>` (this template), or `{ mode: "mock", openapi: "spec.json", … }` runs a Prism mock server generated from the spec |
+| `local` | a **local version** of the real service runs on this machine | `{ mode: "local", compose: "vendor-db/docker-compose.yml", port, … }` → `docker compose up -d --wait` before your services (vendor-shaped DBs); if another checkout already realized it, it is **adopted** instead of failing (declared port served **by a service this compose file defines** → used as-is; an unrelated publisher on that port is a conflict, not an adoption; a stopped container holding the compose `container_name` → `docker start`); `mesh dev --kill` downs only externals this session created (volumes kept) and never touches adopted ones |
+| `remote` | connect to the **actual** external service | `{ mode: "remote", credentials: { endpoint: "https://sandbox.vendor.com", … } }` (inline vendor credentials), or `{ mode: "remote", remote: { env: "dev" } }` to pull the credentials the app's `dev` environment is configured with |
+
+A declaration may carry **several** realizations (e.g. `compose` *and* `remote.env`); `mode` picks the default and the CLI overrides it per run: `mesh dev --externals vendor-db=remote,vendorpay`. In every mode `credentials` seeds the external secret locally so `resolveCredentials()` runs the deployed code path; values support `\{{url}}`/`\{{host}}`/`\{{port}}` (the stand-in's endpoint) and `\{{env:VAR}}` (your shell — real secrets never land in package.json).
+
+> Compat: the legacy key `mesh.mocks`, the `--mock` flag, and `sandbox: true` (an alias for `mode: "remote"`) are still read — new declarations should use `mesh.externals` / `--externals` / `mode`.
+
+Every stand-in with a local endpoint also gets a blackbox probe, so the Hub's uptime works locally. By default that's an HTTP GET of `healthPath` (`/health`) expecting 2xx — **add `probe: "tcp"` for anything that doesn't speak HTTP** (databases, SFTP, message brokers): it checks only that the port accepts connections. Without it a TDS/SSH port is GETed as if it were HTTP, the probe can never succeed, and the external reads permanently down in the Hub — with no error anywhere.
+
+```jsonc
+"plaid-db": { "compose": "db/docker-compose.yml", "port": 1433, "probe": "tcp", "external": "plaid-db", "credentials": { … } }
+```
+
+## Deploy
+
+```bash
+mesh login {{tenant}}.dev
+mesh deploy up
+mesh secrets set external/vendorpay    # real vendor values (never in git)
+```

package/templates/external-service/tsconfig.json

@@ -0,0 +1,10 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true
+  }
+}

package/templates/platform-repo/AGENTS.md.hbs

@@ -0,0 +1,18 @@
+# Agent guidance — {{tenant}} platform repo
+
+- Invoke the CLI as `pnpm mesh <cmd>` or (cwd-independent) `pnpm exec mesh <cmd>` —
+  a root `"mesh"` script + the `@mesh-tech/mesh-cli` devDependency make both work
+  after `pnpm install`. For a bare `mesh` on PATH, run once: `pnpm exec mesh install-shim`.
+- Operations are `mesh` commands, never raw `aws`/`pulumi`/`kubectl`:
+  `mesh login {{tenant}}.{{env}}`, `mesh deploy preview|up` (run inside
+  `core/` or `platform/`), `mesh init app-tenant` (doctor).
+- Deploy order matters: `core/` before `platform/` (platform imports core
+  from the SSM registry).
+- Capabilities are config, not code: enable/disable platform services in
+  `platform/Pulumi.{{tenant}}-{{env}}.yaml` (temporal/zitadel/hub/tenants/…);
+  the `index.ts` layer programs should rarely change.
+- Registering a new app tenant = `mesh tenant add <name>` from `platform/`,
+  then `mesh deploy up` — never hand-edit `mesh:tenants`, never hand-write
+  registry entries. `mesh tenant list` shows what the stack declares.
+- Pattern skills for `@mesh-tech/infra-components` ship inside the package
+  (TanStack Intent, after `pnpm install`).

package/templates/platform-repo/README.md.hbs

@@ -0,0 +1,38 @@
+# {{tenant}} — Mesh platform tenant
+
+Infrastructure repo for the **{{tenant}}** platform tenant: two Pulumi layers
+built on `@mesh-tech/infra-components`, deployed with `mesh deploy`.
+
+- `core/` — VPC, EKS, shared RDS, DNS (`mesh.layers.MeshCore`)
+- `platform/` — Temporal, Zitadel, Hub, app-tenant environments (`mesh.layers.MeshPlatform`)
+
+Everything self-registers in the SSM registry (`/mesh/{{tenant}}/{{env}}/…`);
+apps and the Hub discover the platform from there — no hardcoded wiring.
+
+## Deploy
+
+```bash
+mesh login {{tenant}}.{{env}}       # or your platform context; registry auth runs automatically
+pnpm install
+
+cd core && mesh deploy up           # ~20 min first run (VPC + EKS)
+cd ../platform && mesh deploy up    # Temporal + Zitadel + Hub + tenant envs
+```
+
+The stack configs (`Pulumi.{{tenant}}-{{env}}.yaml`) are annotated — every
+platform capability is a config block; uncomment to enable.
+
+## After deploy
+
+- **Hub** (operations dashboard): `https://hub.{{env}}.{{domain}}`
+- Temporal UI: `https://temporal.{{env}}.{{domain}}`
+- Register more app tenants: `cd platform && mesh tenant add <name>` then `mesh deploy up` — `mesh tenant list` shows what's declared, and `mesh init app-tenant` in an apps repo verifies the result.
+- Scaffold apps: `mesh create-app --tenant {{tenant}} --name <app> --template workflow|api-auth|api-role-gating|external-service`
+
+## Day-2
+
+```bash
+mesh deploy preview                 # in core/ or platform/
+mesh deploy stack output --json
+mesh init app-tenant                # doctor, from any apps repo
+```

package/templates/platform-repo/core/Pulumi.yaml.hbs

@@ -0,0 +1,12 @@
+name: {{tenant}}-core
+description: Core infrastructure for the {{tenant}} tenant (VPC, EKS, RDS)
+runtime:
+  name: nodejs
+  options:
+    packagemanager: pnpm
+    nodeargs: "--import tsx"
+backend:
+  url: s3://{{stateBucket}}
+config:
+  aws:region: {{region}}
+  mesh:tenant: {{tenant}}

package/templates/platform-repo/core/Pulumi.{{tenant}}-{{env}}.yaml.hbs

@@ -0,0 +1,57 @@
+# Core layer stack config — {{tenant}}/{{env}}.
+# Every value here feeds mesh.layers.MeshCore (see index.ts). Deploy with:
+#   mesh deploy up   (from this directory)
+config:
+  aws:region: {{region}}
+  aws:profile: {{profile}}
+  mesh:pulumiStateBucket: {{stateBucket}}
+
+  # VPC — MeshCore calculates public/private subnet CIDRs automatically.
+  mesh:vpc:
+    cidr: "10.0.0.0/16"
+    azCount: 2
+
+  # EKS — the platform's runtime. Sized for a small tenant; scale nodes as
+  # apps land. Set `mesh:eks: false` for a core-only (no cluster) deploy.
+  mesh:eks:
+    version: "1.34"
+    nodeInstanceType: "m6i.large"
+    minNodes: 2
+    maxNodes: 6
+    desiredNodes: 2 # initial size only — the Cluster Autoscaler owns this after creation
+    addons:
+      ebsCsiDriver: true
+      metricsServer: true
+      clusterAutoscaler: true
+      albController: true
+      externalDns: true
+      certManager: true
+      prometheusStack:
+        enableGrafana: true
+        enableAlertManager: false
+        retention: "15d"
+        storageSize: "20Gi"
+        # Loki — log aggregation the Hub's logs view reads.
+        loki:
+          enabled: true
+          retentionDays: 30
+          storageSize: "10Gi"
+
+  # Shared RDS for app databases + SpiceDB (via the database provisioner).
+  # Set to false to skip; apps can bring their own.
+  mesh:rds:
+    engine: postgres
+    instanceClass: db.t4g.small
+    allocatedStorage: 20
+
+  # Public DNS — required for ingress (Temporal UI, Zitadel, Hub).
+  # The zone must exist (or be delegated) in this account.
+  mesh:dns:
+    publicZoneName: {{env}}.{{domain}}
+
+  # Peering with another tenant's core (optional):
+  # mesh:peering:
+  #   peerWith:
+  #     tenant: mesh
+  #     env: dev
+  #     accountId: "159923586610"

package/templates/platform-repo/core/index.ts

@@ -0,0 +1,62 @@
+import * as pulumi from "@pulumi/pulumi";
+import * as aws from "@pulumi/aws";
+import { mesh, parseEnvFromStack } from "@mesh-tech/infra-components";
+
+// ============================================================================
+// Configuration
+// ============================================================================
+
+const config = new pulumi.Config("mesh");
+const awsConfig = new pulumi.Config("aws");
+
+const tenant = config.require("tenant");
+const region = awsConfig.require("region");
+const env = parseEnvFromStack(tenant);
+const pulumiStateBucket = config.require("pulumiStateBucket");
+
+// Get AWS account ID
+const callerIdentity = await aws.getCallerIdentity();
+const awsAccountId = callerIdentity.accountId;
+
+// ============================================================================
+// Core Infrastructure
+// ============================================================================
+// MeshCore creates:
+// - VPC with public/private subnets (calculated from vpc.cidr)
+// - EKS cluster (if eks config provided)
+// - RDS instance (if rds config provided)
+// - Peering IAM role (if peering.allowPeeringFrom provided)
+// - Auto-exports to SSM: /mesh/{tenant}/{env}/core
+//
+
+const meshCore = new mesh.layers.MeshCore("core", {
+  tenant,
+  env,
+  region,
+  awsAccountId,
+  pulumiStateBucket,
+  vpc: config.requireObject("vpc"),
+  eks: config.getObject("eks") ?? false,
+  rds: config.getObject("rds") ?? false,
+  rdsBastion: config.getObject("rdsBastion") ?? config.getBoolean("rdsBastion") ?? false,
+  peering: config.getObject("peering"),
+  dns: config.getObject("dns"),
+  externalTenants: config.getObject("externalTenants"),
+  // serviceMesh: false to disable, object to configure, undefined for defaults
+  serviceMesh: config.get("serviceMesh") === "false" ? false : config.getObject("serviceMesh"),
+  // Secrets (set via: pulumi config set --secret mesh:newRelicLicenseKey <key>)
+  newRelicLicenseKey: config.getSecret("newRelicLicenseKey"),
+});
+
+// ============================================================================
+// Stack Exports
+// ============================================================================
+// These are available via `pulumi stack output`
+
+export const stack = pulumi.getStack();
+export const tenantName = tenant;
+export const environment = env;
+export const accountId = awsAccountId;
+
+// All core infrastructure outputs (includes VPC, EKS, RDS, IAM, peering, ssmPath)
+export const core = meshCore.outputs;