@mesh-tech/mesh-cli 0.14.0 → 0.16.0

package/templates/api-auth/api/src/index.ts.hbs

@@ -10,7 +10,7 @@
  *   GET /api/report  permission-gated (needs report:view via SpiceDB → else 403)
  *
  * Environment (mesh dev injects all of these — local or tethered):
- *   PORT, ZITADEL_ISSUER, SPICEDB_ENDPOINT, SPICEDB_PRESHARED_KEY
+ *   PORT, ZITADEL_ISSUER, ZITADEL_PROJECT_ID, SPICEDB_HTTP_ENDPOINT, SPICEDB_TOKEN
  */
 
 import { Hono } from "hono";
@@ -20,22 +20,31 @@ import { zitadelJwtScheme } from "@mesh-tech/authn/schemes/zitadel-jwt";
 import { createAuthnMiddleware, type AuthnVariables } from "@mesh-tech/authn/hono";
 import { createAuthz } from "@mesh-tech/authz/runtime";
 import { createAuthzMiddleware, type AuthzVariables } from "@mesh-tech/authz/hono";
+import { createLogger, requestLogger } from "@mesh-tech/logger";
 import { schema } from "./schema.js";
 import { spiceDbHttpProvider } from "./spicedb-http-provider.js";
 
 const PORT = parseInt(process.env.PORT ?? "3000", 10);
 const ZITADEL_ISSUER = process.env.ZITADEL_ISSUER ?? "http://localhost:8080";
+// Every service logs through @mesh-tech/logger (the Mesh app contract, gate 0.4).
+const log = createLogger({ service: "{{name}}-api" });
 
 // --- authn: who is calling ---
 
 // Audience: locally, mesh dev injects the seeded CLI app's clientId
-// (tokens come from `mesh login local`); in the cloud this is the app's own
-// audience and consumers request its project-audience scope.
-const AUTH_AUDIENCE = process.env.AUTH_AUDIENCE ?? "{{name}}";
+// (tokens come from `mesh login local`); deployed, the app's OWN Zitadel
+// project id (ZitadelAppIdentity in index.ts) is the audience, and passing it
+// as `projectId` makes the scheme read the project-keyed roles claim.
+const ZITADEL_PROJECT_ID = process.env.ZITADEL_PROJECT_ID;
+const AUTH_AUDIENCE = process.env.AUTH_AUDIENCE ?? ZITADEL_PROJECT_ID ?? "{{name}}";
 
 const authn = createAuthn({
   schemes: {
-    "zitadel-jwt": zitadelJwtScheme({ issuer: ZITADEL_ISSUER, audience: AUTH_AUDIENCE }),
+    "zitadel-jwt": zitadelJwtScheme({
+      issuer: ZITADEL_ISSUER,
+      audience: AUTH_AUDIENCE,
+      ...(ZITADEL_PROJECT_ID ? { projectId: ZITADEL_PROJECT_ID } : {}),
+    }),
   },
 });
 const { middleware: requireAuth, public: publicRoute } = createAuthnMiddleware(authn);
@@ -49,13 +58,14 @@ const authz = createAuthz({
       provider: spiceDbHttpProvider({
         endpoint: process.env.SPICEDB_HTTP_ENDPOINT ?? "http://localhost:8443",
         // "local-dev-key" is the `mesh start` stack's key — local ONLY. In
-        // any deployed env the platform injects SPICEDB_PRESHARED_KEY; fail
-        // loudly rather than silently authing with the public default.
+        // any deployed env `spicedb.link()` (index.ts) injects SPICEDB_TOKEN;
+        // fail loudly rather than silently authing with the public default.
         presharedKey:
+          process.env.SPICEDB_TOKEN ??
           process.env.SPICEDB_PRESHARED_KEY ??
           (process.env.NODE_ENV === "production"
             ? (() => {
-                throw new Error("SPICEDB_PRESHARED_KEY is required in production");
+                throw new Error("SPICEDB_TOKEN is required in production");
               })()
             : "local-dev-key"),
       }),
@@ -73,6 +83,7 @@ const m = createAuthzMiddleware(authz, {
 // --- routes ---
 
 const app = new Hono<{ Variables: AuthnVariables & AuthzVariables }>();
+app.use("*", requestLogger(log));
 
 // Open: no token needed (also excluded from the oauth2-proxy in the cloud)
 app.get("/health", publicRoute(), (c) => c.json({ status: "ok" }));
@@ -92,5 +103,5 @@ app.get("/api/report", m.require("report", "view", { id: () => "quarterly" }), (
 );
 
 serve({ fetch: app.fetch, port: PORT }, () => {
-  console.log(`{{name}} api listening on :${PORT} (issuer: ${ZITADEL_ISSUER})`);
+  log.info({ port: PORT, issuer: ZITADEL_ISSUER }, "{{name}} api listening");
 });

package/templates/api-auth/index.ts.hbs

@@ -1,54 +1,102 @@
 /**
- * {{titleCase name}} — Platform-authenticated API
+ * {{titleCase name}} — Platform-authenticated API (authz mode "policy-engine").
  *
- * Infrastructure: AppEnvironment + API Service behind platform auth
- * (oauth2-proxy sidecar against the platform Zitadel).
+ * authn: Zitadel JWTs verified in-process (@mesh-tech/authn) against the app's
+ * OWN Zitadel project. authz: schema-driven permission checks in the app's OWN
+ * SpiceDB (@mesh-tech/authz). Everything the Hub needs to administer people,
+ * roles and API keys for this app is published from here — nothing is created
+ * by hand in Zitadel and nothing lives in a runbook (the Mesh app contract,
+ * gate H: `@mesh-tech/app-kit#apps` → references/app-contract.md).
  *
- * Local:   mesh start && mesh dev   (runtime auth only — no proxy sidecar)
+ * Wires, IN ORDER:
+ *   1. ZitadelConnector   — authed provider for the platform Zitadel.
+ *   2. ZitadelAppIdentity — this app's OWN project; roles = schema.coarseRoles.
+ *   3. AppEnvironment     — namespace + providers, bound to the app's project.
+ *   4. SpiceDB            — the app's OWN SpiceDB instance (shared-DB mode).
+ *   5. SpiceDBSchema      — compiles api/src/schema.ts to .zed + ops-hub
+ *                           metadata, applies it, exports the metadata to SSM.
+ *   6. api Service        — Hono app: authn + authz middleware, linked to SpiceDB.
+ *   7. AppAuthzPointer    — LAST. Tells the Hub where this app's authz lives.
+ *
+ * Prerequisite: the target platform must have Zitadel enabled — ZitadelConnector
+ * eager-reads it at preview time.
+ *
+ * Local:   mesh start && mesh dev   (the local platform's Zitadel + SpiceDB)
  * Deploy:  mesh deploy up
  */
 
 import * as pulumi from "@pulumi/pulumi";
-import * as path from "node:path";
-import { fileURLToPath } from "node:url";
 import { mesh } from "@mesh-tech/app-kit";
+import { compileOpsHubMetadata, compileSpiceDBSchema } from "@mesh-tech/authz";
+// The authz schema is the single source of truth, shared by the api (enforces
+// it) and this Pulumi program (compiles it to SpiceDB + ops-hub metadata + roles).
+import { schema as schemaDef } from "./api/src/schema.js";
 
-const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const { tenant, platform, stack, deploy } = mesh.apps.getConfig(pulumi);
+const appName = "{{name}}";
+
+// --- 1. Connector — authed provider for the platform Zitadel. ---
+const connector = new mesh.auth.ZitadelConnector("idp", { tenant, env: platform.env });
 
-// --- Environment ---
+// --- 2. App identity — this app's OWN Zitadel project + roles. ---
+// The schema's coarse roles become Zitadel PROJECT ROLES: the vocabulary the
+// Hub grants people and API keys against. An `api`-type application is the
+// resource server tokens are minted for (its clientId is the JWT audience).
+const identity = new mesh.auth.ZitadelAppIdentity("identity", {
+  connector,
+  tenant,
+  env: platform.env,
+  project: { name: appName },
+  roles: [...schemaDef.coarseRoles],
+  applications: {
+    api: { type: "api" },
+  },
+});
 
+// --- 3. Environment — bound to the app's own project via zitadelAppProjectId. ---
 const env = new mesh.apps.AppEnvironment("env", {
   tenant,
   platform,
   stack,
   deploy,
-  appName: "{{name}}",
+  appName,
   namespace: true,
-  rootDir: __dirname,
+  database: false,
+  zitadelAppProjectId: identity.projectId,
 });
 
-// --- Services ---
+// --- 4. SpiceDB — the app's OWN instance (omit `rds` → the platform's shared RDS). ---
+// `httpEnabled` serves the REST gateway the starter spicedb-http-provider talks to.
+const spicedb = new mesh.auth.SpiceDB("spicedb", { env, httpEnabled: true });
 
-// The oauth2-proxy sidecar needs its own OIDC client in the platform
-// Zitadel. Approved tenant-auth pattern: one Zitadel PROJECT per app (in
-// your app tenant's org), one APPLICATION per service — create the app's
-// project if it doesn't exist, add a web application for this service, and
-// set both values on the stack:
-//   pulumi config set {{name}}:authClientId <clientId>
-//   pulumi config set --secret {{name}}:authClientSecret <clientSecret>
-const appConfig = new pulumi.Config("{{name}}");
+// --- 5. Schema — compile, apply, and publish the ops-hub metadata. ---
+// `opsHubMetadataRef` is the SSM path the pointer below hands to the Hub; without
+// it the Hub's create-key and role catalog answer 409 METADATA_UNPUBLISHED.
+const schema = new mesh.auth.SpiceDBSchema("schema", {
+  env,
+  spicedb,
+  compiled: {
+    zed: compileSpiceDBSchema(schemaDef).zed,
+    metadata: compileOpsHubMetadata(schemaDef),
+  },
+});
 
+// --- 6. api Service — in-process authn + authz; SpiceDB reached via link(). ---
 const api = new mesh.apps.Service("api", {
   env,
+  title: "{{titleCase name}} API",
+  description: "Platform-authenticated API for {{titleCase name}}",
   runtime: "node",
   src: "./api",
   port: 3000,
-  auth: {
-    provider: "mesh", // issuer auto-derived from the platform Zitadel
-    clientId: appConfig.require("authClientId"),
-    clientSecret: appConfig.requireSecret("authClientSecret"),
-    allowUnauthenticated: ["/health"],
+  // spicedb.link() injects SPICEDB_ENDPOINT (gRPC) + SPICEDB_TOKEN and the IAM
+  // to reach the instance; the HTTP gateway address rides alongside for the
+  // starter provider.
+  link: [spicedb.link()],
+  environment: {
+    ZITADEL_ISSUER: pulumi.output(env.zitadel).apply((z) => z?.issuer ?? ""),
+    ZITADEL_PROJECT_ID: identity.projectId,
+    SPICEDB_HTTP_ENDPOINT: spicedb.httpEndpoint,
   },
   ingress: env.buildIngress({
     subdomain: "{{name}}-api",
@@ -58,8 +106,14 @@ const api = new mesh.apps.Service("api", {
   resources: { cpu: "100m", memory: "128Mi" },
 });
 
+// --- 7. AppAuthzPointer — LAST. The Hub's App → Access tab reads this. ---
+new mesh.auth.AppAuthzPointer("authz", { env, mode: "policy-engine", opsHubMetadataRef: schema.opsHubMetadataRef });
+
 // --- Outputs ---
 
 export const app = env.register({
   description: "{{titleCase name}} — platform-authenticated API (authn + authz)",
 });
+
+/** The app's own Zitadel project id (grant people and API keys against this). */
+export const zitadelProjectId = identity.projectId;

package/templates/api-auth/package.json.hbs

@@ -11,6 +11,7 @@
   },
   "dependencies": {
     "@mesh-tech/app-kit": "latest",
+    "@mesh-tech/authz": "latest",
     "@pulumi/pulumi": "^3.214.1"
   },
   "devDependencies": {

package/templates/api-role-gating/api/package.json.hbs

@@ -16,6 +16,7 @@
   "dependencies": {
     "@mesh-tech/authn": "latest",
     "@mesh-tech/authz": "latest",
+    "@mesh-tech/logger": "latest",
     "hono": "^4.0.0",
     "@hono/node-server": "^1.0.0"
   },

package/templates/api-role-gating/api/src/main.ts.hbs

@@ -10,17 +10,22 @@ import { serve } from "@hono/node-server";
 import { Hono } from "hono";
 import { createAuthnMiddleware, type AuthnVariables } from "@mesh-tech/authn/hono";
 import { createAuthzMiddleware, type AuthzVariables } from "@mesh-tech/authz/hono";
+import { createLogger, requestLogger } from "@mesh-tech/logger";
 import { createAuthnFromEnv } from "./authn.js";
 import { createAppAuthz } from "./authz.js";
 
 type TestAuth = { subjectSub: string; coarseRole?: string | readonly string[] };
 type AppEnv = { Variables: AuthnVariables & AuthzVariables };
 
+// Every service logs through @mesh-tech/logger (the Mesh app contract, gate 0.4).
+const log = createLogger({ service: "{{name}}-api" });
+
 /** The role-gated route paths (kept in one place so authn + authz agree). */
 const GATED = ["/admin", "/reports"] as const;
 
 export const createApp = (deps: { testAuth?: TestAuth } = {}) => {
   const app = new Hono<AppEnv>();
+  app.use("*", requestLogger(log));
   const m = createAuthzMiddleware(createAppAuthz());
 
   // Open: no token needed.
@@ -54,5 +59,5 @@ export const createApp = (deps: { testAuth?: TestAuth } = {}) => {
 if (process.env.NODE_ENV !== "test" && process.argv[1]?.endsWith("main.js")) {
   const port = Number(process.env.PORT ?? 3000);
   serve({ fetch: createApp().fetch, port });
-  console.log(`{{name}} api listening on :${port} (role-gating)`);
+  log.info({ port, mode: "role-gating" }, "{{name}} api listening");
 }

package/templates/external-service/api/package.json.hbs

@@ -13,6 +13,7 @@
     "@mesh-tech/app-kit": "latest",
     "@opentelemetry/auto-instrumentations-node": "^0.78.0",
     "@mesh-tech/http-client": "latest",
+    "@mesh-tech/logger": "latest",
     "hono": "^4.0.0",
     "@hono/node-server": "^1.0.0"
   },

package/templates/external-service/api/src/index.ts.hbs

@@ -19,6 +19,7 @@ import { Hono } from "hono";
 import { resolveCredentials } from "@mesh-tech/app-kit/credentials";
 import { traceExternalCall } from "@mesh-tech/app-kit/tracing";
 import { enhanceFetch } from "@mesh-tech/http-client";
+import { createLogger, requestLogger } from "@mesh-tech/logger";
 
 interface VendorpayCredentials extends Record<string, string> {
   baseUrl: string;
@@ -27,7 +28,11 @@ interface VendorpayCredentials extends Record<string, string> {
 
 const vendorFetch = enhanceFetch();
 
+// Every service logs through @mesh-tech/logger (the Mesh app contract, gate
+// 0.4): structured, masked, trace-correlated lines the Hub can search.
+const log = createLogger({ service: "{{name}}-api" });
 const app = new Hono();
+app.use("*", requestLogger(log));
 
 app.get("/health", (c) => c.json({ status: "ok" }));
 
@@ -62,7 +67,7 @@ app.post("/payments/quote", async (c) => {
   // Log vendor interactions with the service name — these lines are what
   // the Hub's Integrations → Monitoring → Logs view surfaces (it searches
   // consumer logs for mentions of the external service).
-  console.log(`[vendorpay] quote requested amount=${amount} → ${response.status}`);
+  log.info({ externalService: "vendorpay", amount, status: response.status }, "vendorpay quote requested");
 
   if (!response.ok) {
     return c.json(
@@ -77,5 +82,5 @@ app.post("/payments/quote", async (c) => {
 
 const port = Number(process.env.PORT ?? 3000);
 serve({ fetch: app.fetch, port }, () => {
-  console.log(`[API] {{titleCase name}} API listening on port ${port}`);
+  log.info({ port }, "{{titleCase name}} API listening");
 });

package/templates/workflow/api/package.json.hbs

@@ -11,6 +11,7 @@
   },
   "dependencies": {
     "@mesh-tech/app-kit": "latest",
+    "@mesh-tech/logger": "latest",
     "@opentelemetry/auto-instrumentations-node": "^0.78.0",
     "@temporalio/client": "^1.11.7",
     "hono": "^4.0.0",

package/templates/workflow/api/src/index.ts.hbs

@@ -12,11 +12,16 @@
 import { Hono } from "hono";
 import { serve } from "@hono/node-server";
 import { createTemporalClient, type WithClient } from "@mesh-tech/app-kit/temporal-client";
+import { createLogger, requestLogger } from "@mesh-tech/logger";
 
 const PORT = parseInt(process.env.PORT ?? "3000", 10);
 const TEMPORAL_TASK_QUEUE = process.env.TEMPORAL_TASK_QUEUE ?? "{{name}}";
 
+// Every service logs through @mesh-tech/logger (the Mesh app contract, gate
+// 0.4): structured, masked, trace-correlated lines the Hub can search.
+const log = createLogger({ service: "{{name}}-api" });
 const app = new Hono();
+app.use("*", requestLogger(log));
 
 // createTemporalClient returns a withClient wrapper (auth is applied
 // per-call); with no TEMPORAL_AUTH_* env it runs unauthenticated — the
@@ -61,7 +66,7 @@ app.post("/workflows/greet", async (c) => {
     });
     return c.json({ workflowId, result });
   } catch (error) {
-    console.error("[API] Error starting workflow:", error);
+    log.error({ err: error }, "Error starting workflow");
     return c.json({ error: "Failed to start workflow" }, 500);
   }
 });
@@ -92,7 +97,7 @@ app.post("/workflows/task", async (c) => {
       message: "Workflow started. Check Temporal Web UI for progress.",
     });
   } catch (error) {
-    console.error("[API] Error starting workflow:", error);
+    log.error({ err: error }, "Error starting workflow");
     return c.json({ error: "Failed to start workflow" }, 500);
   }
 });
@@ -112,7 +117,7 @@ app.get("/workflows/:id", async (c) => {
       closeTime: describe.closeTime,
     });
   } catch (error) {
-    console.error("[API] Error getting workflow:", error);
+    log.error({ err: error }, "Error getting workflow");
     return c.json({ error: "Failed to get workflow status" }, 500);
   }
 });
@@ -121,10 +126,10 @@ app.get("/workflows/:id", async (c) => {
 initClient()
   .then(() => {
     serve({ fetch: app.fetch, port: PORT, hostname: "0.0.0.0" }, () => {
-      console.log(`[API] {{titleCase name}} API listening on port ${PORT}`);
+      log.info({ port: PORT }, "{{titleCase name}} API listening");
     });
   })
   .catch((err) => {
-    console.error("[API] Failed to initialize:", err);
+    log.error({ err }, "Failed to initialize");
     process.exit(1);
   });

package/templates/workflow/worker/package.json.hbs

@@ -11,6 +11,7 @@
   },
   "dependencies": {
     "@mesh-tech/app-kit": "latest",
+    "@mesh-tech/logger": "latest",
     "@opentelemetry/auto-instrumentations-node": "^0.78.0",
     "@temporalio/activity": "^1.11.7",
     "@temporalio/worker": "^1.11.7",

package/templates/workflow/worker/src/activities.ts.hbs

@@ -13,11 +13,15 @@
  * - Use Date.now(), Math.random(), etc.
  */
 
+// `log` carries the activity context and reaches the platform logger the worker
+// installs — never the console (the Mesh app contract, gate 0.4).
+import { log } from "@temporalio/activity";
+
 /**
  * Generate a greeting message
  */
 export async function greet(name: string): Promise<string> {
-  console.log(`[Activity] Generating greeting for ${name}`);
+  log.info("Generating greeting", { name });
   return `Hello, ${name}!`;
 }
 
@@ -25,7 +29,7 @@ export async function greet(name: string): Promise<string> {
  * Process a task (simulated)
  */
 export async function processTask(taskId: string): Promise<string> {
-  console.log(`[Activity] Processing task ${taskId}`);
+  log.info("Processing task", { taskId });
 
   // Simulate processing time
   await new Promise((resolve) => setTimeout(resolve, 1000));
@@ -40,7 +44,7 @@ export async function sendNotification(
   userId: string,
   message: string
 ): Promise<boolean> {
-  console.log(`[Activity] Sending notification to ${userId}: ${message}`);
+  log.info("Sending notification", { userId, message });
 
   // Simulate sending
   await new Promise((resolve) => setTimeout(resolve, 500));

package/templates/workflow/worker/src/encryption-codec.ts

@@ -16,6 +16,7 @@ import {
   ValueError,
 } from "@temporalio/common";
 import proto from "@temporalio/proto";
+import { logger } from "@mesh-tech/logger";
 
 const { temporal } = proto;
 
@@ -148,9 +149,9 @@ export class EncryptionCodec implements PayloadCodec {
 export async function createEncryptionCodec(): Promise<EncryptionCodec | undefined> {
   const encodingKey = process.env.TEMPORAL_ENCODING_KEY;
   if (!encodingKey) {
-    console.log("[Encryption] No TEMPORAL_ENCODING_KEY set, payloads will not be encrypted");
+    logger.warn("No TEMPORAL_ENCODING_KEY set, payloads will not be encrypted");
     return undefined;
   }
-  console.log("[Encryption] Payload encryption enabled");
+  logger.info("Payload encryption enabled");
   return EncryptionCodec.create(encodingKey);
 }

package/templates/workflow/worker/src/worker.ts.hbs

@@ -3,8 +3,14 @@
  */
 
 import { createTemporalWorker, resolveWorkflows } from "@mesh-tech/app-kit/temporal";
+import { createLogger } from "@mesh-tech/logger";
 import * as activities from "./activities.js";
 
+// The worker process logs through @mesh-tech/logger (the Mesh app contract,
+// gate 0.4). Activities use `log` from @temporalio/activity and workflows `log`
+// from @temporalio/workflow — both route to the Runtime logger app-kit installs.
+const log = createLogger({ service: "{{name}}-worker" });
+
 async function run() {
   const { worker, cleanup } = await createTemporalWorker({
     activities,
@@ -19,6 +25,6 @@ async function run() {
 }
 
 run().catch((err) => {
-  console.error("Worker failed to start:", err);
+  log.error({ err }, "Worker failed to start");
   process.exit(1);
 });

package/templates/workflow/worker/src/workflows.ts.hbs

@@ -11,7 +11,7 @@
  * - Use proxyActivities() to call activities
  */
 
-import { proxyActivities, sleep } from "@temporalio/workflow";
+import { log, proxyActivities, sleep } from "@temporalio/workflow";
 import type * as activities from "./activities.js";
 
 // Configure activity retries and timeouts
@@ -43,7 +43,7 @@ export async function taskWorkflow(
   taskId: string,
   userId: string
 ): Promise<{ status: string; taskId: string }> {
-  console.log(`[Workflow] Processing task ${taskId} for user ${userId}`);
+  log.info("Processing task", { taskId, userId });
 
   // Process the task
   const result = await processTask(taskId);
@@ -51,7 +51,7 @@ export async function taskWorkflow(
   // Wait before completing (demonstrates durable timers)
   await sleep("2 seconds");
 
-  console.log(`[Workflow] Task ${taskId} completed with status: ${result}`);
+  log.info("Task completed", { taskId, result });
 
   return {
     status: result,