Start as an API.
Grow into a mesh.

A useful service in five minutes.

The default path is ordinary HTTP. No sidecar, controller class or custom query layer is required.

import openmesh, { created } from 'openmesh-node';
import { bodyParser } from 'openmesh-node/plugins';

const app = openmesh();

app.use(bodyParser());

app.post('/users/:id', {
  body: NewUser,
  response: {
    201: User,
    409: Problem
  }
}, async ({ body, params }) => {
  return created(await users.create({
    id: params.id,
    ...body
  }));
});

await app.listen({ port: 3000 });

Use only the layer you need.

Typed contracts without framework ceremony.

OpenMesh 0.5 adds Standard Schema input inference and response contracts directly to app.get/post/.... The advanced functional contract API remains optional.

Your ORM remains your ORM.

openmesh-node/db does not invent a query language. It gives your existing client application lifecycle, readiness and an optional typed transaction boundary.

import { database } from 'openmesh-node/db';

const db = database(prisma, {
  name: 'primary',
  connect: client => client.$connect(),
  disconnect: client => client.$disconnect(),
  transaction: (client, work) => client.$transaction(work)
});

app.register(db);

app.get('/users', async () => db.client.user.findMany());

The service relationship becomes runtime state.

Configure the application once, then use lazy app.mesh(name) handles. The first real call creates one managed service pool and reuses its discovery, pressure and failure state.

const app = openmesh({
  service: 'gateway',
  mesh: {
    control: {
      url: process.env.OPENMESH_CONTROL_URL!,
      token: process.env.OPENMESH_TOKEN!
    }
  }
});

const payments = app.mesh('payments');

const charge = await payments.post('/charges', {
  key: user.id,
  body: { userId: user.id, amount: order.total }
});

Choose the subset before choosing the peer.

0.5 separates traffic targeting from peer selection. That keeps canaries, regional failover and affinity composable with the same retries, circuits and concurrency controls.

mTLS identity belongs to the application boundary.

A service can bind itself to a SPIFFE-style identity. OpenMesh validates the local certificate before startup, requires authenticated inbound peers and verifies the expected service identity on outbound mesh calls.

const payments = openmesh({
  service: 'payments',
  identity: {
    trustDomain: 'mesh.example.internal',
    ca,
    cert,
    key,
    allow: ['gateway']
  }
});

// Expected URI SAN:
// spiffe://mesh.example.internal/service/payments

Versioned state, push-first delivery.

Registration leases, membership revisions and configuration epoch + revision make distributed state changes explicit. Authenticated SSE watches are the steady-state path; polling remains a compatibility fallback.

Instrumentation is opt-in, not baked into the hot path.

Application and peer lifecycle events are emitted only when observers are configured. The OpenTelemetry bridge consumes those events without making the SDK a core runtime dependency.