@mesh-tech/mesh-cli 0.1.1 → 0.12.1

package/templates/platform-repo/core/package.json.hbs

@@ -0,0 +1,22 @@
+{
+  "name": "{{tenant}}-core",
+  "version": "0.0.1",
+  "private": true,
+  "description": "Core infrastructure for the {{tenant}} tenant (VPC, EKS, RDS)",
+  "type": "module",
+  "main": "index.ts",
+  "scripts": {
+    "typecheck": "tsc --noEmit"
+  },
+  "dependencies": {
+    "@mesh-tech/infra-components": "latest",
+    "@pulumi/aws": "6.66.2",
+    "@pulumi/pulumi": "3.214.1"
+  },
+  "devDependencies": {
+    "@mesh-tech/tsconfig": "latest",
+    "@types/node": "^24.2.1",
+    "tsx": "^4.20.4",
+    "typescript": "^5.9.2"
+  }
+}

package/templates/platform-repo/core/tsconfig.json

@@ -0,0 +1,8 @@
+{
+  "extends": "@mesh-tech/tsconfig/base.json",
+  "compilerOptions": {
+    "outDir": "./dist",
+    "rootDir": "."
+  },
+  "include": ["*.ts"]
+}

package/templates/platform-repo/package.json.hbs

@@ -0,0 +1,15 @@
+{
+  "name": "{{tenant}}-mesh-platform",
+  "version": "0.0.1",
+  "private": true,
+  "type": "module",
+  "packageManager": "pnpm@10.29.2",
+  "keywords": ["tanstack-intent"],
+  "scripts": {
+    "mesh": "mesh",
+    "typecheck": "pnpm -r typecheck"
+  },
+  "devDependencies": {
+    "@mesh-tech/mesh-cli": "latest"
+  }
+}

package/templates/platform-repo/platform/Pulumi.yaml.hbs

@@ -0,0 +1,12 @@
+name: {{tenant}}-platform
+description: Platform services for the {{tenant}} tenant (Temporal, Zitadel, Monitoring, Hub)
+runtime:
+  name: nodejs
+  options:
+    packagemanager: pnpm
+    nodeargs: "--import tsx"
+backend:
+  url: s3://{{stateBucket}}
+config:
+  aws:region: {{region}}
+  mesh:tenant: {{tenant}}

package/templates/platform-repo/platform/Pulumi.{{tenant}}-{{env}}.yaml.hbs

@@ -0,0 +1,59 @@
+# Platform layer stack config — {{tenant}}/{{env}}. Deploy AFTER core:
+#   cd ../core && mesh deploy up
+#   cd ../platform && mesh deploy up
+# MeshPlatform auto-imports core from SSM and exports its own registrations
+# the same way — apps and the Hub discover everything through the registry.
+config:
+  aws:region: {{region}}
+  aws:profile: {{profile}}
+  # Tenant name; the env is derived from the stack name minus this prefix.
+  mesh:tenant: {{tenant}}
+  mesh:coreEnv: {{env}}
+  # Env-zone DNS (recommended for secondary / personal platform envs):
+  # platform hostnames derive from {env}.{parentZone} instead of the shared
+  # core zone, so envs never collide on DNS. The parent zone must exist in
+  # this account's Route53 (one-time NS delegation at the registrar/CDN).
+  # mesh:dns:
+  #   public:
+  #     parentZone: {{tenant}}.meshtech.io
+  #     # waitForValidation: false  # don't block the deploy while the parent
+  #     #                           # zone's public delegation is propagating
+
+  # Temporal — workflow engine + Web UI behind platform auth.
+  mesh:temporal:
+    webUI:
+      enabled: true
+    ingress:
+      subdomain: temporal
+
+  # Zitadel — the tenant's identity provider (approved tenant-auth pattern:
+  # platform org + app-tenant orgs). Minimal dedicated RDS by default.
+  mesh:zitadel:
+    rds: {}
+
+  # Mesh Hub — the operations dashboard (your platform's front door).
+  # No auth.clientId → MeshHub auto-provisions its Zitadel OIDC app.
+  mesh:hub:
+    enabled: true
+
+  # App tenants served by this platform. Registering a tenant here is the
+  # operator action `mesh init app-tenant` points at — add an entry and
+  # deploy; each gets its own namespace scoping, deployer role, and
+  # registry entries.
+  mesh:tenants:
+    {{tenant}}: {}
+    # another-tenant:
+    #   subdomain: at
+
+  # Database provisioner — creates app/SpiceDB databases on core's shared
+  # RDS on demand.
+  mesh:databaseProvisioner: true
+
+  # Optional platform services — uncomment as needed:
+  # mesh:monitoring: {}
+  # mesh:headscale:            # self-hosted VPN (Tailscale control plane)
+  #   subdomain: vpn
+  #   allowedDomains: [{{domain}}]
+  # mesh:packageRegistry: {}   # CodeArtifact for @-scoped package distribution
+  # mesh:auth:                 # org admins (Zitadel user IDs, post-first-deploy)
+  #   orgAdmins: []

package/templates/platform-repo/platform/index.ts

@@ -0,0 +1,95 @@
+import * as pulumi from "@pulumi/pulumi";
+import * as aws from "@pulumi/aws";
+import { mesh, parseEnvFromStack } from "@mesh-tech/infra-components";
+
+// ============================================================================
+// Configuration
+// ============================================================================
+
+const config = new pulumi.Config("mesh");
+
+const tenant = config.require("tenant");
+const env = parseEnvFromStack(tenant);
+
+// Get AWS account ID
+const callerIdentity = await aws.getCallerIdentity();
+const awsAccountId = callerIdentity.accountId;
+
+// ============================================================================
+// Platform Infrastructure
+// ============================================================================
+// MeshPlatform:
+// - Auto-imports core from SSM (use coreEnv config to override which env)
+// - Creates Temporal, Zitadel, Monitoring (if configured)
+// - Auto-exports to SSM: /mesh/{tenant}/{env}/platform
+
+const meshPlatform = new mesh.layers.MeshPlatform("platform", {
+  tenant,
+  env,
+  // Core environment to import from (defaults to env)
+  // Set mesh:coreEnv in Pulumi config when core is deployed to a different stack
+  coreEnv: config.get("coreEnv"),
+  // Platform services - all disabled by default
+  // Enable via Pulumi config: mesh:temporal, mesh:zitadel, mesh:spicedb, mesh:monitoring
+  // infra-components >= 0.1.130 bundles the Temporal server source, so no
+  // serverSourcePath override is needed — the SDK resolves its bundled copy.
+  // Env-zone DNS (personal / secondary platform stacks): mesh:dns with a
+  // public.parentZone makes every platform hostname derive from
+  // {env}.{parentZone} instead of the shared core zone.
+  dns: config.getObject("dns") ?? false,
+  temporal: config.getObject("temporal") ?? false,
+  zitadel: config.getObject("zitadel") ?? false,
+  headscale: config.getObject("headscale") ?? false,
+  subnetRouter: config.getObject("subnetRouter") ?? false,
+  // Platform auth — org admin seeding (Zitadel users granted platform-wide
+  // Temporal system admin). Config: mesh:auth: { orgAdmins: ["zitadel-id", ...] }
+  // (SpiceDB authorization schemas are owned by apps/stacks, not the platform.)
+  auth: config.getObject("auth") ?? false,
+  monitoring: config.getObject("monitoring") ?? false,
+  // Mesh Hub (operations dashboard) — tenant-opt-in via mesh:hub config.
+  // Omit auth.clientId to have MeshHub auto-provision the Zitadel OIDC app
+  // (requires mesh:zitadel + Temporal auth + public DNS, all enabled here).
+  hub: config.getObject("hub") ?? false,
+  // Database provisioner - enabled when RDS is available in core
+  databaseProvisioner: config.getBoolean("databaseProvisioner") ?? true,
+  // Cluster owner: controls whether cluster-scoped resources are created
+  // Only ONE stack per cluster should be the owner (default: true)
+  // Set mesh:clusterOwner: false for secondary stacks sharing the same EKS cluster
+  clusterOwner: config.getBoolean("clusterOwner") ?? true,
+  // Shared tenants that use this platform (creates per-tenant infra)
+  // Config: mesh:tenants: { acme: {}, smallbank: { subdomain: sb } }
+  tenants: config.getObject("tenants"),
+  // Node pools for primary tenant workloads (e.g., Dagster jobs)
+  // Config: mesh:primaryTenantNodePools: { dagster-jobs: { instanceType: t3.large } }
+  primaryTenantNodePools: config.getObject("primaryTenantNodePools"),
+  // Package registry (CodeArtifact) for distributing @mesh-tech/* packages
+  // Config: mesh:packageRegistry: {} or mesh:packageRegistry: { readerRoleArns: [...] }
+  // NOTE: no monorepoRoot here — package publishing stays with the
+  // mesh-platform monorepo (scripts/publish-packages.sh). This stack only
+  // provisions the CodeArtifact registry.
+  packageRegistry: config.getObject("packageRegistry") ?? false,
+  // DevBox - remote development instances (optional)
+  // Config: mesh:devbox: { users: { trabianmatt: { home: "/Users/mattdean", ... } } }
+  devbox: config.getObject("devbox") ?? false,
+});
+
+// ============================================================================
+// Stack Exports
+// ============================================================================
+// These are available via `pulumi stack output`
+
+export const stack = pulumi.getStack();
+export const tenantName = tenant;
+export const environment = env;
+export const accountId = awsAccountId;
+
+// All platform infrastructure outputs (includes core infra, services, ssmPath)
+export const platform = meshPlatform.outputs;
+
+// Tenant environments (primary + shared) - deployer roles, ingress config
+// Note: Also exported to SSM at /mesh/{tenant}/{env}/app-tenants
+export const tenantEnvironments = {
+  primary: meshPlatform.tenantEnvironments.primaryTenant,
+  shared: meshPlatform.tenantEnvironments.sharedTenants,
+  ssmPath: meshPlatform.tenantEnvironments.ssmPath,
+};

package/templates/platform-repo/platform/package.json.hbs

@@ -0,0 +1,26 @@
+{
+  "name": "{{tenant}}-platform",
+  "version": "0.0.1",
+  "private": true,
+  "description": "Platform services for the {{tenant}} tenant (Temporal, Zitadel, Monitoring, Hub)",
+  "type": "module",
+  "main": "index.ts",
+  "scripts": {
+    "typecheck": "tsc --noEmit"
+  },
+  "dependencies": {
+    "@aws-sdk/client-lambda": "^3.964.0",
+    "@aws-sdk/credential-providers": "^3.964.0",
+    "@mesh-tech/hub": "latest",
+    "@mesh-tech/infra-components": "latest",
+    "@pulumi/aws": "6.66.2",
+    "@pulumi/kubernetes": "4.24.1",
+    "@pulumi/pulumi": "3.214.1"
+  },
+  "devDependencies": {
+    "@mesh-tech/tsconfig": "latest",
+    "@types/node": "^24.2.1",
+    "tsx": "^4.20.4",
+    "typescript": "^5.9.2"
+  }
+}

package/templates/platform-repo/platform/tsconfig.json

@@ -0,0 +1,8 @@
+{
+  "extends": "@mesh-tech/tsconfig/base.json",
+  "compilerOptions": {
+    "outDir": "./dist",
+    "rootDir": "."
+  },
+  "include": ["*.ts"]
+}

package/templates/platform-repo/pnpm-workspace.yaml

@@ -0,0 +1,3 @@
+packages:
+  - "core"
+  - "platform"

package/templates/workflow/AGENTS.md.hbs

@@ -0,0 +1,15 @@
+# Agent guidance — {{name}}
+
+- Invoke the CLI as `pnpm mesh <cmd>` or (cwd-independent) `pnpm exec mesh <cmd>` —
+  a `"mesh"` script + the bundled `@mesh-tech/*` dep make both work after
+  `pnpm install`. For a bare `mesh` on PATH, run once: `pnpm exec mesh install-shim`.
+- Operations are `mesh` commands, never raw `aws`/`pulumi`/`kubectl`:
+  `mesh start` (local platform), `mesh dev` (run services), `mesh login`,
+  `mesh deploy`. Errors print the exact `mesh` command that fixes them.
+- Local loop needs zero cloud access: `mesh start && mesh dev`, then
+  `curl -X POST localhost:3000/workflows/greet -d '{"name":"…"}'`.
+- Workflows (`worker/src/workflows.ts`) must stay deterministic — no
+  `Date.now()`/`Math.random()`/IO; put side effects in `activities.ts`.
+- Pattern skills for the SDKs used here ship inside the `@mesh-tech/*`
+  packages (discoverable via TanStack Intent after `pnpm install`).
+- This app's own skill lives at `skills/develop/SKILL.md`.

package/templates/workflow/Pulumi.dev.yaml.hbs

@@ -0,0 +1,8 @@
+config:
+  aws:region: us-east-2
+  mesh:tenant: {{tenant}}
+  mesh:platform:
+    name: mesh
+    env: dev
+  mesh:deploy: false
+  mesh:deployerRole: arn:aws:iam::123456789012:role/{{tenant}}-dev-apps-deployer

package/templates/workflow/Pulumi.yaml.hbs

@@ -0,0 +1,8 @@
+name: {{name}}
+runtime:
+  name: nodejs
+  options:
+    packagemanager: pnpm
+    nodeargs: "--import tsx"
+backend:
+  url: s3://mesh-platform-pulumi-state

package/templates/workflow/README.md.hbs

@@ -0,0 +1,45 @@
+# {{titleCase name}}
+
+Temporal workflow app: Hono API + Temporal worker + a hello workflow.
+
+## Run it locally (no AWS, no VPN)
+
+```bash
+mesh start          # local Mesh platform (Docker only) — the Hub is at http://localhost:9000
+pnpm install
+mesh dev            # auto-wires api + worker to the local platform (tmux)
+```
+
+Prove the workflow end-to-end:
+
+```bash
+curl -s -X POST http://localhost:3000/workflows/greet \
+  -H 'content-type: application/json' -d '{"name":"Mesh"}'
+# → {"workflowId":"greeting-…","result":"Hello, Mesh!"}
+```
+
+Watch it in the **Hub** (http://localhost:9000 → {{tenant}} → {{name}}) or the
+Temporal UI: http://localhost:8233/namespaces/{{tenant}}-dev-{{name}}/workflows
+(the app gets its own Temporal namespace `{{tenant}}-dev-{{name}}`, exactly
+like a deployed environment; its logs land in the Hub's logs view too).
+
+```bash
+mesh dev logs worker   # tail a service
+mesh dev --kill        # stop the session
+```
+
+## Deploy to a tenant environment
+
+```bash
+mesh login {{tenant}}.dev
+mesh deploy up --yes
+```
+
+The stack registers itself in the platform registry (`env.register()`) and
+appears in the Hub.
+
+## Layout
+
+- `index.ts` — Pulumi program (`AppEnvironment` + API `Service` + `TemporalWorker`)
+- `api/` — Hono API that starts workflows
+- `worker/` — Temporal worker: `workflows.ts` (deterministic) + `activities.ts`

package/templates/workflow/api/.dockerignore

@@ -0,0 +1,4 @@
+node_modules
+dist
+*.log
+.env*

package/templates/workflow/api/Dockerfile

@@ -0,0 +1,15 @@
+FROM node:20-slim
+
+WORKDIR /app
+
+COPY package*.json ./
+# Full install (not --omit=dev): the build needs esm-bundle, a devDependency.
+# npm install (not ci) — these scaffolds ship no lockfile.
+RUN npm install
+
+COPY . .
+RUN npm run build
+
+EXPOSE 3000
+
+CMD ["node", "dist/index.js"]

package/templates/{temporal-api-worker → workflow}/api/package.json.hbs

@@ -1,21 +1,23 @@
 {
-  "name": "@{{tenant}}/{{name}}-api",
+  "name": "{{name}}-api",
   "version": "0.0.1",
   "private": true,
   "type": "module",
   "scripts": {
     "dev": "tsx watch src/index.ts",
     "start": "node dist/index.js",
-    "build": "tsc"
+    "build": "esm-bundle src/index.ts --outfile dist/index.js",
+    "check-types": "tsc --noEmit"
   },
   "dependencies": {
+    "@mesh-tech/app-kit": "latest",
+    "@opentelemetry/auto-instrumentations-node": "^0.78.0",
     "@temporalio/client": "^1.11.7",
-    "@temporalio/common": "^1.11.7",
-    "@temporalio/proto": "^1.11.7",
-    "express": "^4.21.0"
+    "hono": "^4.0.0",
+    "@hono/node-server": "^1.0.0"
   },
   "devDependencies": {
-    "@types/express": "^4.17.21",
+    "@mesh-tech/esm-bundle": "latest",
     "@types/node": "^20.0.0",
     "tsx": "^4.0.0",
     "typescript": "^5.0.0"

package/templates/workflow/api/src/index.ts.hbs

@@ -0,0 +1,130 @@
+/**
+ * {{titleCase name}} API
+ *
+ * HTTP API for triggering Temporal workflows.
+ *
+ * Environment variables:
+ * - PORT: Server port (default: 3000)
+ * - TEMPORAL_ADDRESS, TEMPORAL_NAMESPACE, TEMPORAL_TASK_QUEUE
+ * - TEMPORAL_ENCODING_KEY: Encoding key for payload encryption (optional)
+ */
+
+import { Hono } from "hono";
+import { serve } from "@hono/node-server";
+import { createTemporalClient, type WithClient } from "@mesh-tech/app-kit/temporal-client";
+
+const PORT = parseInt(process.env.PORT ?? "3000", 10);
+const TEMPORAL_TASK_QUEUE = process.env.TEMPORAL_TASK_QUEUE ?? "{{name}}";
+
+const app = new Hono();
+
+// createTemporalClient returns a withClient wrapper (auth is applied
+// per-call); with no TEMPORAL_AUTH_* env it runs unauthenticated — the
+// local platform mode.
+let withClient: WithClient;
+
+async function initClient(): Promise<void> {
+  ({ withClient } = await createTemporalClient());
+}
+
+// Health check
+app.get("/health", (c) => c.json({ status: "ok" }));
+
+// Root
+app.get("/", (c) =>
+  c.json({
+    name: "{{titleCase name}} API",
+    endpoints: [
+      "GET  /health",
+      "POST /workflows/greet",
+      "POST /workflows/task",
+      "GET  /workflows/:id",
+    ],
+  })
+);
+
+// Trigger greeting workflow
+app.post("/workflows/greet", async (c) => {
+  try {
+    const { name } = await c.req.json<{ name: string }>();
+    if (!name) {
+      return c.json({ error: "name is required" }, 400);
+    }
+
+    const { workflowId, result } = await withClient(async (client) => {
+      const handle = await client.workflow.start("greetingWorkflow", {
+        taskQueue: TEMPORAL_TASK_QUEUE,
+        workflowId: `greeting-${Date.now()}`,
+        args: [name],
+      });
+      return { workflowId: handle.workflowId, result: await handle.result() };
+    });
+    return c.json({ workflowId, result });
+  } catch (error) {
+    console.error("[API] Error starting workflow:", error);
+    return c.json({ error: "Failed to start workflow" }, 500);
+  }
+});
+
+// Trigger task workflow
+app.post("/workflows/task", async (c) => {
+  try {
+    const { taskId, userId } = await c.req.json<{
+      taskId: string;
+      userId: string;
+    }>();
+    if (!taskId || !userId) {
+      return c.json({ error: "taskId and userId are required" }, 400);
+    }
+
+    const workflowId = await withClient(async (client) => {
+      const handle = await client.workflow.start("taskWorkflow", {
+        taskQueue: TEMPORAL_TASK_QUEUE,
+        workflowId: `task-${taskId}`,
+        args: [taskId, userId],
+      });
+      return handle.workflowId;
+    });
+
+    return c.json({
+      workflowId,
+      status: "started",
+      message: "Workflow started. Check Temporal Web UI for progress.",
+    });
+  } catch (error) {
+    console.error("[API] Error starting workflow:", error);
+    return c.json({ error: "Failed to start workflow" }, 500);
+  }
+});
+
+// Get workflow status
+app.get("/workflows/:id", async (c) => {
+  try {
+    const workflowId = c.req.param("id");
+    const describe = await withClient((client) =>
+      client.workflow.getHandle(workflowId).describe(),
+    );
+
+    return c.json({
+      workflowId,
+      status: describe.status.name,
+      startTime: describe.startTime,
+      closeTime: describe.closeTime,
+    });
+  } catch (error) {
+    console.error("[API] Error getting workflow:", error);
+    return c.json({ error: "Failed to get workflow status" }, 500);
+  }
+});
+
+// Start server
+initClient()
+  .then(() => {
+    serve({ fetch: app.fetch, port: PORT, hostname: "0.0.0.0" }, () => {
+      console.log(`[API] {{titleCase name}} API listening on port ${PORT}`);
+    });
+  })
+  .catch((err) => {
+    console.error("[API] Failed to initialize:", err);
+    process.exit(1);
+  });

package/templates/workflow/api/tsconfig.json

@@ -0,0 +1,14 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "outDir": "./dist",
+    "rootDir": "./src",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "declaration": true
+  },
+  "include": ["src/**/*"]
+}

package/templates/workflow/index.ts.hbs

@@ -0,0 +1,67 @@
+/**
+ * {{titleCase name}} — Temporal Workflow Application
+ *
+ * Infrastructure: AppEnvironment + API Service + TemporalWorker
+ *
+ * Dev mode:  pnpm mesh dev
+ * Deploy:    pnpm mesh deploy up
+ */
+
+import * as pulumi from "@pulumi/pulumi";
+import * as path from "node:path";
+import { fileURLToPath } from "node:url";
+import { mesh } from "@mesh-tech/app-kit";
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const { tenant, platform, stack, deploy } = mesh.apps.getConfig(pulumi);
+
+const TASK_QUEUE = "{{name}}";
+
+// --- Environment ---
+
+const env = new mesh.apps.AppEnvironment("env", {
+  tenant,
+  platform,
+  stack,
+  deploy,
+  appName: "{{name}}",
+  namespace: true,
+  rootDir: __dirname,
+  temporal: true,
+});
+
+// --- Services ---
+
+const api = new mesh.apps.Service("api", {
+  env,
+  runtime: "node",
+  src: "./api",
+  port: 3000,
+  link: [
+    env.temporal!.link({
+      environmentPrefix: "TEMPORAL",
+      taskQueue: TASK_QUEUE,
+    }),
+  ],
+  ingress: env.buildIngress({
+    subdomain: "{{name}}-api",
+    healthCheckPath: "/health",
+  }),
+  replicas: 1,
+  resources: { cpu: "100m", memory: "128Mi" },
+});
+
+const worker = new mesh.apps.TemporalWorker("worker", {
+  env,
+  runtime: "node",
+  src: "./worker",
+  taskQueue: TASK_QUEUE,
+  replicas: 1,
+  resources: { cpu: "200m", memory: "256Mi" },
+});
+
+// --- Outputs ---
+
+export const app = env.register({
+  description: "{{titleCase name}} — Temporal workflow app",
+});

package/templates/workflow/package.json.hbs

@@ -0,0 +1,20 @@
+{
+  "name": "{{name}}",
+  "version": "0.0.1",
+  "private": true,
+  "type": "module",
+  "packageManager": "pnpm@10.29.2",
+  "keywords": ["tanstack-intent"],
+  "scripts": {
+    "mesh": "mesh",
+    "typecheck": "tsc --noEmit"
+  },
+  "dependencies": {
+    "@mesh-tech/app-kit": "latest",
+    "@pulumi/pulumi": "^3.214.1"
+  },
+  "devDependencies": {
+    "tsx": "^4.20.4",
+    "typescript": "^5.7.2"
+  }
+}

package/templates/workflow/skills/develop/SKILL.md.hbs

@@ -0,0 +1,32 @@
+---
+name: develop-{{name}}
+description: Run, extend, and deploy the {{name}} Temporal workflow app — local loop, adding workflows/activities, and the deploy path.
+---
+
+# Developing {{name}}
+
+## Run locally (zero cloud access)
+
+```bash
+mesh start      # local Mesh platform (Hub at http://localhost:9000)
+pnpm install
+mesh dev        # api + worker in tmux, wired to the local platform
+```
+
+Prove it: `curl -s -X POST http://localhost:3000/workflows/greet -H 'content-type: application/json' -d '{"name":"Mesh"}'` → `{"result":"Hello, Mesh!"}`. Inspect runs in the Hub (http://localhost:9000) or at http://localhost:8233/namespaces/{{tenant}}-dev-{{name}}/workflows (per-app Temporal namespace, same as deployed).
+
+## Add a workflow
+
+1. Define the deterministic function in `worker/src/workflows.ts` (no `Date.now()`/`Math.random()`/IO — use `proxyActivities`).
+2. Side effects go in `worker/src/activities.ts`.
+3. Expose it from the API (`api/src/index.ts`): `client.workflow.start("yourWorkflow", { taskQueue: TEMPORAL_TASK_QUEUE, … })`.
+4. `mesh dev restart worker` picks up the new code; re-curl to verify.
+
+## Deploy
+
+```bash
+mesh login {{tenant}}.dev
+mesh deploy up --yes
+```
+
+Never call `pulumi`/`aws`/`kubectl` directly — every operation has a `mesh` command, and failures name their fix.

package/templates/workflow/tsconfig.json

@@ -0,0 +1,10 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true
+  }
+}