trusted surface there is no need for any assembly to be deployed. All you have and need is declarative XAML.
However in a case of extending of trusted surface, fist assemblies which implement custom types have to be deployed. After they are deployed, workflow publishing works as already described above.
To get a feeling about publishing open the browser and paste following:
GET //SharePoint/default/eac2871d-0758-4a2e-8b03-c02598c63c0b/8256fccd-21e8-4435-8327-2affb3234c23/$Workflows?$skip=0&$top=100
Note, the underlined part is the scope path of workflow at your machine (this one is example from my machine). This statement is a REST call to Workflow Manager which will return up to 100 installed workflow definitions.
Similarly following REST call would get the full Workflow Description of workflow with name=’ d1991cf0-0fa3-46d7-9cf7-32014141c6aa‘:
GET //SharePoint/default/eac2871d-0758-4a2e-8b03-c02598c63c0b/8256fccd-21e8-4435-8327-2affb3234c23/$Workflows/d1991cf0-0fa3-46d7-9cf7-32014141c6aa
There is also a REST call which can dump-out the whole XAML implementation.
http://host:12291/yourscope/$Activities/WorkflowXaml_78ba2e34_c23f_4ea9_94fb_86d3efcd3c80