@mesh-tech/mesh-cli 0.43.3 → 0.45.0

package/dist/bin/{mesh.chunk-VCQKLVZJ.js → mesh.chunk-G4TCVQLL.js}

@@ -7,40 +7,48 @@ import {
   parseInstanceIndex,
   resolveSecretsContext,
   setCommand
-} from "./mesh.chunk-QUKWWFZI.js";
+} from "./mesh.chunk-JSY6THRF.js";
 import {
   cliReferenceStaleness,
   resolveCliRuntime,
   runPortalCommand
-} from "./mesh.chunk-OOWKJR4H.js";
+} from "./mesh.chunk-6OGUV2DU.js";
 import {
   registerAppCommands,
   registerCreateAppCommand
-} from "./mesh.chunk-QE5LUIHN.js";
+} from "./mesh.chunk-252LTIHZ.js";
 import {
   PLATFORM_SETUP_DEFAULTS
-} from "./mesh.chunk-ZNM3DDAM.js";
+} from "./mesh.chunk-HPLMVIBO.js";
 import {
   registerRegistryCommands
-} from "./mesh.chunk-PANTMVC3.js";
+} from "./mesh.chunk-NN3LTNUM.js";
 import {
   registerSkillsCommands,
   resolveTargetRoot,
   syncSkills
 } from "./mesh.chunk-F4654EPX.js";
 import {
+  LAUNCH_AGENTS_MACOS_ONLY,
+  LAUNCH_AGENT_LABEL,
   LOGIN_CONTEXT,
   MOCK_OIDC_PORT,
   MOCK_SAML_PORT,
   TEST_USERS,
   acquireTemporalBearer,
   atomicWriteFileSync,
+  awsConfigFileOf,
   buildLaunchCommand,
+  caddyDownloadUrl,
+  caddyHasRoute53,
+  certificateExpiry,
   credProbeToPreflightError,
+  credentialProcessProblem,
   derivePlatformContext,
   detectContext,
   detectLocalTenant,
   devSessionsRoot,
+  discoveryRecordName,
   ensureKubeconfig,
   findAppRoot,
   findRepoRoot,
@@ -51,34 +59,52 @@ import {
   getValidToken,
   hubAuthComposeEnv,
   idpEndpoints,
+  isInsideGitTree,
+  launchAgentSearchPath,
+  launchAgentsSupported,
+  listRoutes,
   mockIdpComposeEnv,
+  parseDiscoveryRecord,
   pickLaunchHostEnv,
   probeCredentials,
+  profileYieldsCredentials,
+  proxyEnv,
   pulumiStackOutput,
+  readCredentialProcess,
   readCredentials,
   readHubAuth,
   readStackConfig,
   readStackPlatform,
+  readWorkstationIdentity,
   reconcileRegistryFromZitadel,
   registerDevCommand,
   registerLoginCommand,
   registerVpnCommands,
   removeAllAliasContainers,
   removeLocalAppSpiceDBs,
+  renderCredentialProcessProfile,
+  renderLaunchAgent,
+  renderWorkstationCaddyfile,
   resolveAwsCredentials,
   resolveHubPlatformName,
   resolvePulumiEnv,
   resolveTemporalAuth,
   resolveWorktreeIdentity,
+  rewriteCredentialProgram,
   rewriteDatabaseUrl,
   seedMockIdps,
   seedZitadel,
+  shimFallsBackToGlobal,
   stackNeedsWorktreeIsolation,
   tunnelClientAddress,
+  upsertManagedAwsConfigSection,
   waitForPort,
+  workstationDir,
+  workstationWarnings,
   worktreeStackName,
-  writeEnvFile
-} from "./mesh.chunk-HB2IZKLP.js";
+  writeEnvFile,
+  zoneCandidates
+} from "./mesh.chunk-SFIJZF3S.js";
 import {
   COMPOSE_PROJECT,
   DEFAULT_HUB_PORT,
@@ -127,7 +153,7 @@ import {
   homeNpmrcPath,
   isNpmAuthError,
   probeRegistryToken
-} from "./mesh.chunk-HC7V75J3.js";
+} from "./mesh.chunk-UJAPUO2W.js";
 import {
   createVcsFolderReader,
   deriveVcsBaseUrl,
@@ -864,26 +890,26 @@ async function startTunnelBackground(instanceId, rdsHost, rdsPort, localPort) {
   throw new Error(`Tunnel failed to start after ${maxAttempts} seconds`);
 }
 function checkPort(port) {
-  return new Promise((resolve8) => {
+  return new Promise((resolve9) => {
     const socket = new net.Socket();
     socket.setTimeout(500);
     socket.on("connect", () => {
       socket.destroy();
-      resolve8(true);
+      resolve9(true);
     });
     socket.on("timeout", () => {
       socket.destroy();
-      resolve8(false);
+      resolve9(false);
     });
     socket.on("error", () => {
       socket.destroy();
-      resolve8(false);
+      resolve9(false);
     });
     socket.connect(port, "localhost");
   });
 }
 function sleep(ms) {
-  return new Promise((resolve8) => setTimeout(resolve8, ms));
+  return new Promise((resolve9) => setTimeout(resolve9, ms));
 }
 async function psqlCommand(options) {
   const platform = platformAxis(options, USAGE4);
@@ -894,13 +920,13 @@ async function psqlCommand(options) {
     logInfo(`App credentials: tenant=${app.tenant}, stage=${app.stage}, app=${appName}`);
   }
   const psqlCheck = spawn2("which", ["psql"]);
-  await new Promise((resolve8, reject) => {
+  await new Promise((resolve9, reject) => {
     psqlCheck.on("exit", (code) => {
       if (code !== 0) {
         logError("psql not found. Install with: brew install postgresql");
         reject(new Error("psql not found"));
       } else {
-        resolve8();
+        resolve9();
       }
     });
   });
@@ -984,26 +1010,26 @@ function findSstOutputs() {
   return null;
 }
 function checkPort2(port) {
-  return new Promise((resolve8) => {
+  return new Promise((resolve9) => {
     const socket = new net2.Socket();
     socket.setTimeout(500);
     socket.on("connect", () => {
       socket.destroy();
-      resolve8(true);
+      resolve9(true);
     });
     socket.on("timeout", () => {
       socket.destroy();
-      resolve8(false);
+      resolve9(false);
     });
     socket.on("error", () => {
       socket.destroy();
-      resolve8(false);
+      resolve9(false);
     });
     socket.connect(port, "localhost");
   });
 }
 function sleep2(ms) {
-  return new Promise((resolve8) => setTimeout(resolve8, ms));
+  return new Promise((resolve9) => setTimeout(resolve9, ms));
 }
 async function startTunnelBackground2(instanceId, rdsEndpoint, rdsPort, localPort) {
   logInfo("Starting database tunnel...");
@@ -1542,7 +1568,7 @@ var DOCS_PREVIEW_PORT = "4410";
 var CLI_REFERENCE_PATH = "docs/portal/generated/cli-reference.md";
 async function renderCliReference() {
   const [{ createProgram: createProgram2 }, { extractCliReference, renderCliReferenceMarkdown }] = await Promise.all([
-    import("./mesh.program-GEKNV2LY.js"),
+    import("./mesh.program-CMOLQWZI.js"),
     import("./mesh.cli-reference-H3TOPIET.js")
   ]);
   return renderCliReferenceMarkdown(extractCliReference(createProgram2()));
@@ -1614,7 +1640,7 @@ function registerDocsCommand(program) {
     "Serve the Mesh docs locally \u2014 detached in a tmux session by default; the working tree in a mesh-platform checkout, or the published @mesh-tech/docs artifact (role-gated registry) anywhere else"
   ).option("-v, --version <version>", "docs version to serve (== the @mesh-tech/* baseline it describes); default: latest", void 0).option("-p, --port <port>", "port to serve on (0 picks a free one)", "4400").option("--dev", "in a checkout: run the Zudoku dev server (HMR) in the foreground, for authoring", false).option("--foreground", "serve in the foreground (the agent/CI path; automatic when not a TTY)", false).action(
     (opts) => guarded(async () => {
-      const { runDocsStart } = await import("./mesh.start-HE6P3TCS.js");
+      const { runDocsStart } = await import("./mesh.start-3MUKXN2U.js");
       await runDocsStart({
         repoRoot: findRepoRoot(process.cwd()),
         version: opts.version,
@@ -1626,13 +1652,13 @@ function registerDocsCommand(program) {
   );
   docs.command("stop").description(`Stop the detached docs server (the tmux session "${"mesh-docs"}")`).action(
     () => guarded(async () => {
-      const { runDocsStop } = await import("./mesh.start-HE6P3TCS.js");
+      const { runDocsStop } = await import("./mesh.start-3MUKXN2U.js");
       runDocsStop();
     })()
   );
   docs.command("serve-static", { hidden: true }).option("--root <dir>", "built site root", "").option("--port <port>", "port", "4400").action(
     (opts) => guarded(async () => {
-      const { runDocsServeStatic } = await import("./mesh.start-HE6P3TCS.js");
+      const { runDocsServeStatic } = await import("./mesh.start-3MUKXN2U.js");
       await runDocsServeStatic(opts);
     })()
   );
@@ -1675,7 +1701,7 @@ function registerDocsCommand(program) {
   );
   docs.command("list").description("List the published docs versions (each is an @mesh-tech/* baseline)").action(
     () => guarded(async () => {
-      const { runDocsList } = await import("./mesh.start-HE6P3TCS.js");
+      const { runDocsList } = await import("./mesh.start-3MUKXN2U.js");
       await runDocsList();
     })()
   );
@@ -1954,24 +1980,24 @@ function resolvePlatformDir(explicit, cwd, env = process.env) {
   );
 }
 async function findFreePort() {
-  return new Promise((resolve8, reject) => {
+  return new Promise((resolve9, reject) => {
     const server = net3.createServer();
     server.listen(0, "127.0.0.1", () => {
       const address = server.address();
       server.close(
-        () => typeof address === "object" && address ? resolve8(address.port) : reject(new Error("no port"))
+        () => typeof address === "object" && address ? resolve9(address.port) : reject(new Error("no port"))
       );
     });
     server.on("error", reject);
   });
 }
 function isPortListening(port) {
-  return new Promise((resolve8) => {
+  return new Promise((resolve9) => {
     const socket = net3.connect({ host: "127.0.0.1", port, timeout: 400 });
     const done = (ok) => {
       socket.removeAllListeners();
       socket.destroy();
-      resolve8(ok);
+      resolve9(ok);
     };
     socket.once("connect", () => done(true));
     socket.once("timeout", () => done(false));
@@ -2198,7 +2224,7 @@ async function registryChecks(args) {
   const { fix, profile } = args;
   const probe = args.probe ?? probeRegistryToken;
   const login = args.login ?? (async () => {
-    const { runRegistryLogin } = await import("./mesh.registry-KA3CNNPZ.js");
+    const { runRegistryLogin } = await import("./mesh.registry-BDBH6DRP.js");
     await runRegistryLogin(void 0, profile ? { profile } : {});
   });
   const REGISTRY_FIX = registryFixCommand(profile);
@@ -2354,7 +2380,7 @@ function registerInitCommands(program) {
     `nothing deployed yet \u2014 scaffold a tenant platform repo for \`<tenant>.<env>\` (default env: ${PLATFORM_SETUP_DEFAULTS.env}) and print its deploy sequence`
   ).option("--region <region>", `--new-platform: AWS region (default: ${PLATFORM_SETUP_DEFAULTS.region})`).option("--domain <domain>", "--new-platform: base public domain you control; the core stack creates the zone {env}.{domain} and stops at the mesh-gateway Ingress until you delegate its NS records. No default \u2014 a placeholder scaffolds a zone that can never validate").option("--state-bucket <bucket>", "--new-platform: Pulumi state S3 bucket (default: {tenant}-mesh-platform-pulumi-state)").option("--create-state-bucket", "--new-platform: create the state bucket (versioned) if it does not exist").option("--no-create-state-bucket", "--new-platform: never create the state bucket; print the aws command instead").option("--dir <path>", "--new-platform: where to scaffold the platform repo (default: ./{tenant}-mesh-platform)").option("--device", "device-code sign-in for the registry and platform steps (headless / SSH)").option("--profile <aws-profile>", "AWS profile this machine uses: read the registry without the broker (deployers only), and the profile a --new-platform stack config references").option("--skip-repo", "do not bootstrap, check or record anything in the current repo", false).option("--yes", "accept every default and never prompt", false).option("--json", "one JSON document on stdout ({tenant, mode, steps, next}); human output on stderr", false).action(
     async (opts) => {
-      const { runInitWizard } = await import("./mesh.wizard-QGWPV4XN.js");
+      const { runInitWizard } = await import("./mesh.wizard-EH3SQEHW.js");
       const code = await runInitWizard(opts);
       if (code !== 0) process.exitCode = code;
     }
@@ -2370,7 +2396,7 @@ function registerInitCommands(program) {
         throw new MeshCliError(`Invalid tenant name '${tenant}' (lowercase alphanumeric + dashes).`);
       }
       const interactive = Boolean(process.stdin.isTTY && process.stdout.isTTY);
-      const { resolvePlatformSetup, scaffoldPlatformRepo, ensureStateBucket, renderPlatformNextSteps } = await import("./mesh.platform-setup-YK6KSOP7.js");
+      const { resolvePlatformSetup, scaffoldPlatformRepo, ensureStateBucket, renderPlatformNextSteps } = await import("./mesh.platform-setup-MTY6ICAO.js");
       const setup = await resolvePlatformSetup(tenant, opts, {
         prompts: interactive && !opts.yes ? await setupPrompts() : void 0,
         interactive
@@ -3002,7 +3028,7 @@ async function waitForStack(opts, io = {
       );
     }
     logInfo(`Waiting for ${pending.map((e) => e.label).join(", ")} \u2026`);
-    await new Promise((resolve8) => setTimeout(resolve8, WAIT_POLL_MS));
+    await new Promise((resolve9) => setTimeout(resolve9, WAIT_POLL_MS));
   }
 }
 function printEndpoints(hubRunning) {
@@ -3259,7 +3285,7 @@ Re-running start from here may recreate shared containers with this checkout's c
         for (let i = 0; i < 60 && !up; i++) {
           const crashed = crashedServices(stackServices(), { overlays });
           if (crashed.length > 0) throw crashError(crashed);
-          await new Promise((resolve8) => setTimeout(resolve8, 2e3));
+          await new Promise((resolve9) => setTimeout(resolve9, 2e3));
           up = await probeEndpoint(endpoint);
         }
         if (!up) {
@@ -3399,7 +3425,7 @@ function registerMcpCommands(program) {
     "--secret <id>",
     "Secrets Manager secret holding the Integration credential (default: the deployed ExternalService's own secret)"
   ).action(async (manifest, opts) => {
-    const { runMcpReviewCommand } = await import("./mesh.review-command-3ZXPS6Y3.js");
+    const { runMcpReviewCommand } = await import("./mesh.review-command-E7V2L5AM.js");
     try {
       await runMcpReviewCommand(manifest, opts);
     } catch (error) {
@@ -3434,7 +3460,7 @@ function registerMcpCommands(program) {
           `No pnpm-workspace.yaml above ${serveDir}: the worker image installs this package from a pnpm workspace, so it must be in one.`
         );
       } else if (!membership.member && membership.suggestedGlob) {
-        const { ensureWorkspaceGlobs } = await import("./mesh.create-app-DVMZDEQP.js");
+        const { ensureWorkspaceGlobs } = await import("./mesh.create-app-BHB3BGH7.js");
         const added = ensureWorkspaceGlobs(path9.dirname(membership.workspaceFile), [
           membership.suggestedGlob
         ]);
@@ -4790,6 +4816,69 @@ Specify which to base on: mesh stack init --from <stack>`
   });
 }
 
+// packages/mesh-cli/src/utils/temporal-inspect.ts
+import { createRequire as createRequire2 } from "node:module";
+function enumMemberName(member, prefix) {
+  return member.slice(prefix.length).toLowerCase().split("_").map((w) => w.charAt(0).toUpperCase() + w.slice(1)).join("");
+}
+function eventTypeNames(enumObject = loadEventTypeEnum()) {
+  const names = {};
+  for (const [member, value] of Object.entries(enumObject)) {
+    if (typeof value === "number" && member.startsWith("EVENT_TYPE_") && value !== 0) {
+      names[value] = enumMemberName(member, "EVENT_TYPE_");
+    }
+  }
+  return names;
+}
+function loadEventTypeEnum() {
+  try {
+    const require2 = createRequire2(import.meta.url);
+    const fromClient = createRequire2(require2.resolve("@temporalio/client"));
+    const proto = fromClient("@temporalio/proto");
+    return proto.temporal.api.enums.v1.EventType;
+  } catch {
+    return {};
+  }
+}
+var LIST_STATUSES = {
+  running: "Running",
+  completed: "Completed",
+  failed: "Failed",
+  canceled: "Canceled",
+  terminated: "Terminated",
+  "continued-as-new": "ContinuedAsNew",
+  "timed-out": "TimedOut"
+};
+function quote(value) {
+  return `'${value.replace(/\\/g, "\\\\").replace(/'/g, "\\'")}'`;
+}
+function buildListQuery(opts) {
+  const clauses = [];
+  if (opts.type) clauses.push(`WorkflowType = ${quote(opts.type)}`);
+  if (opts.status) {
+    const status = LIST_STATUSES[opts.status.toLowerCase()];
+    if (!status) throw new Error(`--status must be one of: ${Object.keys(LIST_STATUSES).join(", ")}`);
+    clauses.push(`ExecutionStatus = ${quote(status)}`);
+  }
+  if (opts.parent) clauses.push(`ParentWorkflowId = ${quote(opts.parent)}`);
+  if (opts.query) clauses.push(clauses.length > 0 ? `(${opts.query})` : opts.query);
+  return clauses.join(" AND ");
+}
+function formatListRows(rows) {
+  const table = [
+    ["WORKFLOW ID", "TYPE", "STATUS", "STARTED", "PARENT"],
+    ...rows.map((r) => [
+      r.workflowId,
+      r.type,
+      r.status,
+      r.startTime ? r.startTime.toISOString().replace(/\.\d{3}Z$/, "Z") : "-",
+      r.parentWorkflowId ?? "-"
+    ])
+  ];
+  const widths = table[0].map((_, i) => Math.max(...table.map((row) => row[i].length)));
+  return table.map((row) => row.map((cell, i) => i === row.length - 1 ? cell : cell.padEnd(widths[i])).join("  "));
+}
+
 // packages/mesh-cli/src/commands/temporal.ts
 import { spawnSync as spawnSync2 } from "node:child_process";
 import { writeFileSync as writeFileSync5, mkdirSync as mkdirSync5 } from "node:fs";
@@ -5265,47 +5354,16 @@ async function resolveBearerToken(auth) {
     return void 0;
   }
 }
-var EVENT_TYPE_NAMES = {
-  1: "WorkflowExecutionStarted",
-  2: "WorkflowExecutionCompleted",
-  3: "WorkflowExecutionFailed",
-  4: "WorkflowExecutionTimedOut",
-  5: "WorkflowTaskScheduled",
-  6: "WorkflowTaskStarted",
-  7: "WorkflowTaskCompleted",
-  8: "WorkflowTaskTimedOut",
-  9: "WorkflowTaskFailed",
-  10: "ActivityTaskScheduled",
-  11: "ActivityTaskStarted",
-  12: "ActivityTaskCompleted",
-  13: "ActivityTaskFailed",
-  14: "ActivityTaskTimedOut",
-  15: "ActivityTaskCancelRequested",
-  16: "ActivityTaskCanceled",
-  17: "TimerStarted",
-  18: "TimerFired",
-  19: "TimerCanceled",
-  20: "WorkflowExecutionCancelRequested",
-  21: "WorkflowExecutionCanceled",
-  24: "WorkflowExecutionSignaled",
-  // not 22/23 which were removed
-  25: "WorkflowExecutionTerminated",
-  26: "WorkflowExecutionSignaled",
-  29: "WorkflowPropertiesModified",
-  40: "ChildWorkflowExecutionStarted",
-  41: "ChildWorkflowExecutionCompleted",
-  42: "ChildWorkflowExecutionFailed",
-  43: "ChildWorkflowExecutionCanceled",
-  44: "ChildWorkflowExecutionTimedOut",
-  45: "ChildWorkflowExecutionTerminated",
-  46: "WorkflowPropertiesModified",
-  48: "NexusOperationScheduled",
-  49: "NexusOperationStarted",
-  50: "NexusOperationCompleted",
-  51: "NexusOperationFailed",
-  52: "NexusOperationCanceled",
-  53: "NexusOperationTimedOut"
-};
+var eventTypeNameTable;
+function eventTypeName(type) {
+  if (!eventTypeNameTable) {
+    eventTypeNameTable = eventTypeNames();
+    if (Object.keys(eventTypeNameTable).length === 0) {
+      logWarn("could not load Temporal's EventType enum; event names will show as Unknown(n)");
+    }
+  }
+  return eventTypeNameTable[type] ?? `Unknown(${type})`;
+}
 var STATUS_NAMES = {
   0: "UNSPECIFIED",
   1: "RUNNING",
@@ -5438,7 +5496,7 @@ ${totalShown} events shown (workflow ended).`);
 }
 async function printEvent(event, decrypter) {
   const eventType = event.eventType ?? 0;
-  const typeName = EVENT_TYPE_NAMES[eventType] ?? `Unknown(${eventType})`;
+  const typeName = eventTypeName(eventType);
   const id = String(event.eventId).padStart(4);
   const detail = extractEventDetail(event);
   const detailStr = detail ? ` \u2014 ${detail}` : "";
@@ -5698,6 +5756,50 @@ function warnIfNotGitIgnored(outPath) {
    This fixture contains DECRYPTED production payloads. Add it to .gitignore or move it outside the repo \u2014 do NOT commit it.`
   );
 }
+function timestampToDate(ts) {
+  if (!ts || ts.seconds === null || ts.seconds === void 0) return void 0;
+  const seconds = Number(ts.seconds);
+  return Number.isFinite(seconds) ? new Date(seconds * 1e3 + Math.floor((ts.nanos ?? 0) / 1e6)) : void 0;
+}
+async function listWorkflows(options) {
+  const query = buildListQuery(options);
+  const limit = Math.max(1, parseInt(options.limit ?? "20", 10) || 20);
+  const conn = await connect2(options);
+  try {
+    const rows = [];
+    let nextPageToken;
+    do {
+      const page = await conn.connection.workflowService.listWorkflowExecutions({
+        namespace: conn.namespace,
+        query,
+        pageSize: Math.min(limit - rows.length, 100),
+        ...nextPageToken ? { nextPageToken } : {}
+      });
+      for (const info of page.executions ?? []) {
+        rows.push({
+          workflowId: info.execution?.workflowId ?? "?",
+          type: info.type?.name ?? "?",
+          status: STATUS_NAMES[info.status ?? 0] ?? String(info.status),
+          startTime: timestampToDate(info.startTime),
+          ...info.parentExecution?.workflowId ? { parentWorkflowId: info.parentExecution.workflowId } : {}
+        });
+        if (rows.length >= limit) break;
+      }
+      nextPageToken = page.nextPageToken?.length ? page.nextPageToken : void 0;
+    } while (nextPageToken && rows.length < limit);
+    if (options.json) {
+      console.log(JSON.stringify(rows, null, 2));
+      return;
+    }
+    if (rows.length === 0) {
+      console.log(`No workflows${query ? ` match ${query}` : ""} in ${conn.namespace}.`);
+      return;
+    }
+    for (const line of formatListRows(rows)) console.log(line);
+  } finally {
+    conn.connection.close();
+  }
+}
 async function terminateWorkflow(workflowId, runId, options) {
   const conn = await connect2(options);
   try {
@@ -5730,6 +5832,16 @@ async function connect2(options) {
 function registerTemporalCommands(program) {
   const temporal = program.command("temporal").description("Inspect Temporal workflows for the current app/stack");
   const sharedOpts = (cmd) => cmd.option("--stack <stack>", "Pulumi stack name (auto-detected from current directory)").option("--address <addr>", "Temporal server address (default: from stack output)").option("--namespace <ns>", "Temporal namespace (default: from stack output)");
+  sharedOpts(
+    temporal.command("list").description("List workflows in the app's namespace, running first, then most recently closed (find the id the other commands take)").option("--type <workflowType>", "only this workflow type (e.g. agentWorkflow)").option("--status <status>", `only this status: ${Object.keys(LIST_STATUSES).join(", ")}`).option("--parent <workflowId>", "only the children of this workflow").option("--query <visibilityQuery>", "a Temporal visibility query, AND-ed with the flags above").option("-n, --limit <n>", "maximum workflows to list", "20").option("--json", "print JSON")
+  ).action(async (opts) => {
+    try {
+      await listWorkflows(opts);
+    } catch (err) {
+      logError(err instanceof Error ? err.message : String(err));
+      process.exitCode = 1;
+    }
+  });
   sharedOpts(
     temporal.command("describe <workflowId> [runId]").description("Show workflow status and metadata")
   ).action(async (workflowId, runId, opts) => {
@@ -6216,9 +6328,9 @@ async function tunnelServices(serviceNames, options) {
   process.on("SIGTERM", cleanup);
   await Promise.race(
     processes.map(
-      (proc) => new Promise((resolve8) => {
-        proc.on("exit", () => resolve8());
-        proc.on("error", () => resolve8());
+      (proc) => new Promise((resolve9) => {
+        proc.on("exit", () => resolve9());
+        proc.on("error", () => resolve9());
       })
     )
   );
@@ -6315,9 +6427,9 @@ async function tunnelExternal(name, options) {
   };
   process.on("SIGINT", cleanup);
   process.on("SIGTERM", cleanup);
-  await new Promise((resolve8) => {
-    proc.on("exit", () => resolve8());
-    proc.on("error", () => resolve8());
+  await new Promise((resolve9) => {
+    proc.on("exit", () => resolve9());
+    proc.on("error", () => resolve9());
   });
   cleanup();
 }
@@ -6427,7 +6539,7 @@ async function resolveToken(opts) {
   if (opts.token) return opts.token;
   if (process.env.VCS_TOKEN) return process.env.VCS_TOKEN;
   if (opts.context) {
-    const { getValidToken: getValidToken2 } = await import("./mesh.login-Q6R5GMVM.js");
+    const { getValidToken: getValidToken2 } = await import("./mesh.login-4O5PMS25.js");
     const token = await getValidToken2(opts.context);
     if (token) return token;
   }
@@ -6435,8 +6547,8 @@ async function resolveToken(opts) {
     "no token: pass --token, set VCS_TOKEN, or pass --context <platform-context> (after mesh login)"
   );
 }
-async function vcsApi(baseUrl, token, path15, method = "GET", body) {
-  const res = await fetch(`${baseUrl}${path15}`, {
+async function vcsApi(baseUrl, token, path16, method = "GET", body) {
+  const res = await fetch(`${baseUrl}${path16}`, {
     method,
     headers: {
       authorization: `Bearer ${token}`,
@@ -6447,7 +6559,7 @@ async function vcsApi(baseUrl, token, path15, method = "GET", body) {
   const data = await res.json().catch(() => ({}));
   if (!res.ok) {
     throw new Error(
-      `${method} ${path15} failed (${res.status}): ${String(data.error ?? "unknown error")}`
+      `${method} ${path16} failed (${res.status}): ${String(data.error ?? "unknown error")}`
     );
   }
   return data;
@@ -6481,7 +6593,7 @@ async function cloneCommand(repo, dest, opts) {
 // packages/mesh-cli/src/commands/vcs/get.ts
 import { writeFile, mkdir } from "node:fs/promises";
 import { join as join16, dirname as dirname9 } from "node:path";
-async function getCommand(repo, path15, opts) {
+async function getCommand(repo, path16, opts) {
   let vcsBaseUrl;
   let token;
   if (opts.target) {
@@ -6496,9 +6608,9 @@ async function getCommand(repo, path15, opts) {
   if (!token) throw new Error("no token: pass --target (after mesh login), or --token / --context");
   const reader = createVcsFolderReader({ vcsBaseUrl, token });
   try {
-    const { ref, files } = await reader.readPath(repo, path15);
+    const { ref, files } = await reader.readPath(repo, path16);
     if (files.length === 0) {
-      logInfo(`no files at ${repo}:${path15}`);
+      logInfo(`no files at ${repo}:${path16}`);
       return;
     }
     if (opts.output) {
@@ -6507,7 +6619,7 @@ async function getCommand(repo, path15, opts) {
         await mkdir(dirname9(abs), { recursive: true });
         await writeFile(abs, f.contents);
       }
-      logInfo(`wrote ${files.length} file(s) from ${repo}:${path15} (${ref}) \u2192 ${opts.output}`);
+      logInfo(`wrote ${files.length} file(s) from ${repo}:${path16} (${ref}) \u2192 ${opts.output}`);
     } else {
       for (const f of files) {
         if (files.length > 1) process.stdout.write(`
@@ -6522,10 +6634,10 @@ async function getCommand(repo, path15, opts) {
 }
 
 // packages/mesh-cli/src/commands/vcs/drafts.ts
-async function call(opts, repo, path15, method = "GET", body) {
+async function call(opts, repo, path16, method = "GET", body) {
   const target = await resolveTarget2({ ...opts, repo });
   const token = await resolveToken(opts);
-  return vcsApi(target.baseUrl, token, `/v1/repos/${repo}${path15}`, method, body);
+  return vcsApi(target.baseUrl, token, `/v1/repos/${repo}${path16}`, method, body);
 }
 async function draftsListCommand(repo, opts) {
   const data = await call(opts, repo, `/drafts${opts.all ? "?all=true" : ""}`);
@@ -6607,13 +6719,13 @@ function parseStatus(out) {
   }
   return changes;
 }
-async function writeOp(cwd, path15) {
-  const buf = await readFile2(join17(cwd, path15));
+async function writeOp(cwd, path16) {
+  const buf = await readFile2(join17(cwd, path16));
   const asUtf8 = buf.toString("utf8");
   if (Buffer.from(asUtf8, "utf8").equals(buf)) {
-    return { op: "write", path: path15, content: asUtf8 };
+    return { op: "write", path: path16, content: asUtf8 };
   }
-  return { op: "write", path: path15, content: buf.toString("base64"), encoding: "base64" };
+  return { op: "write", path: path16, content: buf.toString("base64"), encoding: "base64" };
 }
 async function proposeCommand(opts) {
   const cwd = process.cwd();
@@ -6657,8 +6769,8 @@ async function proposeCommand(opts) {
     operations,
     ...opts.mergeParent ? { mergeParent: opts.mergeParent } : {}
   };
-  const path15 = opts.revise ? `/v1/repos/${target.repo}/proposals/${opts.revise}/revisions` : `/v1/repos/${target.repo}/proposals`;
-  const data = await vcsApi(target.baseUrl, token, path15, "POST", body);
+  const path16 = opts.revise ? `/v1/repos/${target.repo}/proposals/${opts.revise}/revisions` : `/v1/repos/${target.repo}/proposals`;
+  const data = await vcsApi(target.baseUrl, token, path16, "POST", body);
   console.log(
     `proposal ${data.proposalId} @ ${data.sha.slice(0, 8)} \u2014 review: mesh vcs show ${target.repo} ${data.proposalId} --url ${target.baseUrl}`
   );
@@ -6674,21 +6786,21 @@ function normalize(p) {
 function expandPathsToDeletions(repoFiles, requested) {
   const out = /* @__PURE__ */ new Set();
   for (const raw of requested) {
-    const path15 = normalize(raw);
-    if (path15.startsWith("/") || path15.split("/").includes("..")) {
+    const path16 = normalize(raw);
+    if (path16.startsWith("/") || path16.split("/").includes("..")) {
       throw new Error(
         `"${raw}" is not a repo-relative path \u2014 vcs paths never start with "/" or traverse with "..".`
       );
     }
-    const exact = repoFiles.filter((f) => f === path15);
+    const exact = repoFiles.filter((f) => f === path16);
     if (exact.length > 0) {
       for (const f of exact) out.add(f);
       continue;
     }
-    const under = repoFiles.filter((f) => f.startsWith(`${path15}/`));
+    const under = repoFiles.filter((f) => f.startsWith(`${path16}/`));
     if (under.length === 0) {
       throw new Error(
-        `"${raw}" matched no files in the repo \u2014 nothing was proposed. Check the path with: mesh vcs get <repo> ${path15}`
+        `"${raw}" matched no files in the repo \u2014 nothing was proposed. Check the path with: mesh vcs get <repo> ${path16}`
       );
     }
     for (const f of under) out.add(f);
@@ -6724,7 +6836,7 @@ async function rmCommand(repo, paths, opts) {
     const body = {
       baseCommit: head.trim(),
       message: opts.message ?? `Delete ${doomed.length} file(s)`,
-      operations: doomed.map((path15) => ({ op: "delete", path: path15 }))
+      operations: doomed.map((path16) => ({ op: "delete", path: path16 }))
     };
     const data = await vcsApi(
       baseUrl,
@@ -6744,10 +6856,10 @@ async function rmCommand(repo, paths, opts) {
 }
 
 // packages/mesh-cli/src/commands/vcs/review.ts
-async function call2(opts, repo, path15, method = "GET", body) {
+async function call2(opts, repo, path16, method = "GET", body) {
   const target = await resolveTarget2({ ...opts, repo });
   const token = await resolveToken(opts);
-  return vcsApi(target.baseUrl, token, `/v1/repos/${repo}${path15}`, method, body);
+  return vcsApi(target.baseUrl, token, `/v1/repos/${repo}${path16}`, method, body);
 }
 async function proposalsCommand(repo, opts) {
   console.log(JSON.stringify(await call2(opts, repo, "/proposals"), null, 2));
@@ -6837,7 +6949,7 @@ function registerVcsCommands(program) {
 // packages/mesh-cli/src/commands/workflow.ts
 import * as fs13 from "fs";
 import * as path14 from "path";
-import { createRequire as createRequire2 } from "module";
+import { createRequire as createRequire3 } from "module";
 import { execFileSync as execFileSync8 } from "child_process";
 var DISCOVERY_HELPERS_SRC = `
 function discoverAux(filePath, source) {
@@ -6931,7 +7043,7 @@ function discoverProcessArtifact(filePath, source) {
 `;
 function resolveExtractorPath() {
   try {
-    const require2 = createRequire2(import.meta.url);
+    const require2 = createRequire3(import.meta.url);
     const resolved = require2.resolve("@mesh-tech/workflow-viz/ast-extractor");
     return resolved;
   } catch {
@@ -6959,7 +7071,7 @@ const target = ${JSON.stringify(targetPath)};
 const explicitProcessArtifact = ${JSON.stringify(explicitProcessArtifact ?? null)};
 const stat = statSync(target);
 const files = stat.isDirectory()
-  ? readdirSync(target).filter(f => f.endsWith(".ts") && f !== "index.ts").map(f => join(target, f))
+  ? readdirSync(target).filter(f => f.endsWith(".ts") && f !== "index.ts" && !/\\.(test|spec|d)\\.ts$/.test(f)).map(f => join(target, f))
   : [target];
 
 const results = [];
@@ -7005,7 +7117,7 @@ ${DISCOVERY_HELPERS_SRC}
 const target = ${JSON.stringify(targetPath)};
 const stat = statSync(target);
 const files = stat.isDirectory()
-  ? readdirSync(target).filter(f => f.endsWith(".ts") && f !== "index.ts").map(f => join(target, f))
+  ? readdirSync(target).filter(f => f.endsWith(".ts") && f !== "index.ts" && !/\\.(test|spec|d)\\.ts$/.test(f)).map(f => join(target, f))
   : [target];
 
 const results = [];
@@ -7059,7 +7171,7 @@ const target = ${JSON.stringify(targetPath)};
 const explicitProcessArtifact = ${JSON.stringify(explicitProcessArtifact ?? null)};
 const stat = statSync(target);
 const files = stat.isDirectory()
-  ? readdirSync(target).filter(f => f.endsWith(".ts") && f !== "index.ts").map(f => join(target, f))
+  ? readdirSync(target).filter(f => f.endsWith(".ts") && f !== "index.ts" && !/\\.(test|spec|d)\\.ts$/.test(f)).map(f => join(target, f))
   : [target];
 
 const results = [];
@@ -7093,22 +7205,7 @@ process.stdout.write(JSON.stringify(results));
     return null;
   }
 }
-async function uploadToS3(bucket, appName, workflows) {
-  const { S3Client, PutObjectCommand } = await import("@aws-sdk/client-s3");
-  const s3 = new S3Client({ region: process.env.AWS_REGION ?? "us-east-2" });
-  for (const wf of workflows) {
-    const key = `workflow-ir/${appName}/${wf.workflowType}.json`;
-    const body = JSON.stringify(wf.ir, null, 2);
-    logInfo(`  Uploading s3://${bucket}/${key} (${body.length} bytes)`);
-    await s3.send(
-      new PutObjectCommand({
-        Bucket: bucket,
-        Key: key,
-        Body: body,
-        ContentType: "application/json"
-      })
-    );
-  }
+function workflowIrFiles(appName, workflows, root) {
   const manifest = {
     extractedAt: (/* @__PURE__ */ new Date()).toISOString(),
     app: appName,
@@ -7116,23 +7213,33 @@ async function uploadToS3(bucket, appName, workflows) {
       workflows.map((wf) => [
         wf.workflowType,
         {
-          sourceFile: wf.sourceFile,
+          sourceFile: path14.relative(root, wf.sourceFile) || path14.basename(wf.sourceFile),
           nodeCount: wf.ir.nodes.length,
           edgeCount: wf.ir.edges.length
         }
       ])
     )
   };
-  const manifestKey = `workflow-ir/${appName}/_manifest.json`;
-  logInfo(`  Uploading s3://${bucket}/${manifestKey}`);
-  await s3.send(
-    new PutObjectCommand({
-      Bucket: bucket,
-      Key: manifestKey,
-      Body: JSON.stringify(manifest, null, 2),
-      ContentType: "application/json"
-    })
-  );
+  return [
+    ...workflows.map((wf) => ({ name: `${wf.workflowType}.json`, body: JSON.stringify(wf.ir, null, 2) })),
+    { name: "_manifest.json", body: JSON.stringify(manifest, null, 2) }
+  ];
+}
+async function uploadToS3(bucket, appName, files) {
+  const { S3Client, PutObjectCommand } = await import("@aws-sdk/client-s3");
+  const s3 = new S3Client({ region: process.env.AWS_REGION ?? "us-east-2", followRegionRedirects: true });
+  for (const file of files) {
+    const key = `workflow-ir/${appName}/${file.name}`;
+    logInfo(`  Uploading s3://${bucket}/${key} (${file.body.length} bytes)`);
+    await s3.send(
+      new PutObjectCommand({
+        Bucket: bucket,
+        Key: key,
+        Body: file.body,
+        ContentType: "application/json"
+      })
+    );
+  }
 }
 function parseNameList(value) {
   return value ? value.split(",").map((name) => name.trim()).filter((name) => name.length > 0) : void 0;
@@ -7144,6 +7251,9 @@ function registerWorkflowCommands(program) {
   ).option("--app <name>", "Application name (used as S3 key prefix)").option(
     "--upload <bucket>",
     "S3 bucket to upload extracted IR (requires --app)"
+  ).option(
+    "--out <dir>",
+    "Write the files the upload would write (one JSON per workflow type, plus _manifest.json) to a directory (requires --app)"
   ).option(
     "--process <path>",
     "Path to a process artifact JSON file (docs/plans/2026-07-05-process-artifact-design.md \xA71); renders substeps/actors/outcomes in place of a BUSINESS_STAGES map. Absent this flag, a sibling process/*.process.json is auto-discovered per workflow file."
@@ -7185,15 +7295,29 @@ function registerWorkflowCommands(program) {
             `  ${wf.workflowType} (${wf.ir.nodes.length} nodes, ${wf.ir.edges.length} edges)`
           );
         }
-        if (opts.upload && opts.app) {
+        if ((opts.upload || opts.out) && !opts.app) {
+          logError("--upload and --out need --app (the IR's key prefix)");
+          process.exitCode = 1;
+          return;
+        }
+        const root = fs13.statSync(resolvedPath).isDirectory() ? resolvedPath : path14.dirname(resolvedPath);
+        const files = opts.app ? workflowIrFiles(opts.app, results, root) : [];
+        if (opts.out) {
+          const outDir = path14.resolve(opts.out);
+          fs13.mkdirSync(outDir, { recursive: true });
+          for (const file of files) fs13.writeFileSync(path14.join(outDir, file.name), file.body);
+          logSuccess(`Wrote ${files.length} file(s) to ${outDir}`);
+        }
+        if (opts.upload) {
           logInfo(
             `Uploading ${results.length} workflow IR(s) to s3://${opts.upload}/workflow-ir/${opts.app}/`
           );
-          await uploadToS3(opts.upload, opts.app, results);
+          await uploadToS3(opts.upload, opts.app, files);
           logSuccess("Upload complete");
-        } else if (opts.upload || opts.app) {
-          logWarn("Both --app and --upload required for S3 upload");
-        } else {
+        } else if (opts.app && !opts.out) {
+          logWarn("--app does nothing without --upload or --out");
+        }
+        if (!opts.upload && !opts.out) {
           console.log(JSON.stringify(results.map((r) => r.ir), null, 2));
         }
       } catch (error) {
@@ -7352,6 +7476,339 @@ ${inventory.workflowType} (${sourceFile})`);
   });
 }
 
+// packages/mesh-cli/src/commands/workstation.ts
+import { execFileSync as execFileSync9, spawn as spawn6, spawnSync as spawnSync3 } from "child_process";
+import { promises as dns } from "dns";
+import * as fs14 from "fs";
+import * as os4 from "os";
+import * as path15 from "path";
+function tmuxSessionAlive(name) {
+  try {
+    execFileSync9("tmux", ["has-session", "-t", `=${name}`], { stdio: "ignore" });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function profileProblem(proxy) {
+  if (!proxy.awsProfile) return void 0;
+  let text;
+  try {
+    text = fs14.readFileSync(awsConfigFileOf(proxy), "utf8");
+  } catch (e) {
+    return `cannot read ${awsConfigFileOf(proxy)}: ${e.message}`;
+  }
+  return credentialProcessProblem(readCredentialProcess(text, proxy.awsProfile), {
+    exists: (p) => fs14.existsSync(p),
+    isInsideGitTree
+  });
+}
+function adminPortInUse() {
+  try {
+    execFileSync9("lsof", ["-nP", "-iTCP@127.0.0.1:2119", "-sTCP:LISTEN"], { stdio: "ignore" });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function launchAgentPath() {
+  return path15.join(os4.homedir(), "Library", "LaunchAgents", `${LAUNCH_AGENT_LABEL}.plist`);
+}
+function launchctl(args) {
+  return launchctlRun(args).ok;
+}
+function launchctlRun(args) {
+  const r = spawnSync3("launchctl", args, { encoding: "utf8" });
+  return { ok: r.status === 0, output: `${r.stdout ?? ""}${r.stderr ?? ""}`.trim() };
+}
+function sleepMs(ms) {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+function reloadLaunchAgent(domain, plist) {
+  const service = `${domain}/${LAUNCH_AGENT_LABEL}`;
+  launchctl(["bootout", service]);
+  for (let i = 0; i < 50 && launchctl(["print", service]); i++) sleepMs(100);
+  let last = { ok: false, output: "" };
+  for (let attempt = 0; attempt < 5; attempt++) {
+    last = launchctlRun(["bootstrap", domain, plist]);
+    if (last.ok) return last;
+    sleepMs(500);
+  }
+  return last;
+}
+var WORKSTATION_PROFILE = "mesh-workstation";
+function fail(message) {
+  logError(message);
+  process.exit(1);
+}
+async function lookupTxt(resolver, record) {
+  try {
+    return (await resolver.resolveTxt(record)).map((chunks) => chunks.join(""));
+  } catch (e) {
+    return e.code ?? e.message;
+  }
+}
+async function lookupTxtAtZone(platform, record) {
+  for (const zone of zoneCandidates(platform)) {
+    let servers;
+    try {
+      servers = await dns.resolveNs(zone);
+    } catch {
+      continue;
+    }
+    const ips = (await Promise.all(servers.map((ns) => dns.resolve4(ns).catch(() => [])))).flat();
+    if (ips.length === 0) continue;
+    const resolver = new dns.Resolver();
+    resolver.setServers(ips);
+    return lookupTxt(resolver, record);
+  }
+  return "no name servers found";
+}
+function firstDiscovery(values) {
+  if (typeof values === "string") return void 0;
+  return values.map((v) => parseDiscoveryRecord(v)).find((p) => typeof p !== "string");
+}
+async function discoverWorkstation(name, platform) {
+  const record = discoveryRecordName(name, platform);
+  const viaResolver = await lookupTxt(dns, record);
+  const found = firstDiscovery(viaResolver);
+  if (found) return found;
+  const viaZone = await lookupTxtAtZone(platform, record);
+  const direct = firstDiscovery(viaZone);
+  if (direct) {
+    logInfo(`Your resolver has not seen ${record} yet; the zone's name servers answered`);
+    return direct;
+  }
+  const why = typeof viaZone === "string" ? viaZone : "no v=1 record";
+  fail(`No discovery record ${record} (${why}): is "${name}" in the platform's workstation stack, and deployed?`);
+}
+function requireFallbackShim(cli) {
+  let text;
+  try {
+    text = fs14.readFileSync(cli, "utf8");
+  } catch {
+    fail(`No mesh shim at ${cli}. Install one: npm i -g @mesh-tech/mesh-cli && mesh install-shim (or pass --cli <path>)`);
+  }
+  if (!shimFallsBackToGlobal(text)) {
+    fail(`${cli} is an older shim that fails outside a workspace, where renewal runs. Update it: mesh install-shim --force`);
+  }
+}
+async function ensureCaddy(dir) {
+  const caddy = path15.join(dir, "bin", "caddy");
+  const hasRoute53 = (bin) => {
+    try {
+      return caddyHasRoute53(execFileSync9(bin, ["list-modules"], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }));
+    } catch {
+      return false;
+    }
+  };
+  if (fs14.existsSync(caddy) && hasRoute53(caddy)) return caddy;
+  const url = caddyDownloadUrl(process.platform, process.arch);
+  logInfo(`Downloading Caddy with the Route 53 module (${url})...`);
+  const resp = await fetch(url);
+  if (!resp.ok) fail(`Caddy download failed: HTTP ${resp.status}. Build it instead (xcaddy build --with github.com/caddy-dns/route53) and pass --caddy`);
+  fs14.mkdirSync(path15.dirname(caddy), { recursive: true });
+  const tmp = `${caddy}.download`;
+  fs14.writeFileSync(tmp, Buffer.from(await resp.arrayBuffer()), { mode: 493 });
+  if (!hasRoute53(tmp)) {
+    fs14.rmSync(tmp, { force: true });
+    fail("The downloaded Caddy has no dns.providers.route53 module");
+  }
+  fs14.renameSync(tmp, caddy);
+  logSuccess(`Caddy: ${caddy}`);
+  return caddy;
+}
+function writeCaddyfile(dir, identity) {
+  const caddyfile = path15.join(dir, "Caddyfile");
+  fs14.mkdirSync(path15.join(dir, "routes"), { recursive: true });
+  fs14.writeFileSync(caddyfile, renderWorkstationCaddyfile(identity, dir));
+  return caddyfile;
+}
+function requireIdentity(dir) {
+  const identity = readWorkstationIdentity(dir);
+  if (!identity) {
+    logError(`This machine is not a workstation (no ${path15.join(dir, "workstation.json")}). Run: mesh workstation init`);
+    process.exit(1);
+  }
+  return identity;
+}
+function registerWorkstationCommands(program) {
+  const ws = program.command("workstation").description("HTTPS names on this machine for the services it runs (dev servers, local stacks)");
+  ws.command("init").description("Make this machine a workstation: its name, certificate credentials and proxy binary").requiredOption("--name <label>", "this machine's host label in the workstation stack (e.g. mbp)").option("--platform <domain>", "the platform it is named under (e.g. dev.acme.example.com): the rest is discovered").option("--domain <domain>", "without --platform: <name>.<platform zone>").option("--zone-id <id>", "the Route 53 zone (default: discovered)").option("--region <region>", "AWS region for Route 53 (default: discovered, else us-east-2)").option("--aws-profile <profile>", "use this existing profile instead of writing one").option("--aws-config-file <file>", "the AWS config file holding --aws-profile").option("--caddy <path>", "Caddy built with github.com/caddy-dns/route53 (default: downloaded)").option("--cli <path>", "the mesh CLI the profile runs (default: the shim, ~/.local/bin/mesh)").option("--allow-checkout-cli", "accept a credential_process inside a git checkout (renewal breaks when it is removed)").option("--force", "overwrite an existing workstation.json").action(async (opts) => {
+    const dir = workstationDir();
+    const file = path15.join(dir, "workstation.json");
+    if (fs14.existsSync(file) && !opts.force) fail(`${file} exists; --force to replace it`);
+    fs14.mkdirSync(dir, { recursive: true });
+    let domain;
+    let zoneId = opts.zoneId;
+    let region = opts.region;
+    let roleArn;
+    if (opts.platform) {
+      domain = `${opts.name}.${opts.platform.replace(/\.$/, "")}`;
+      if (opts.domain && opts.domain !== domain) fail(`--domain ${opts.domain} is not ${domain} (--name under --platform)`);
+      const found = await discoverWorkstation(opts.name, opts.platform);
+      roleArn = found.roleArn;
+      zoneId ??= found.zoneId;
+      region ??= found.region;
+      logInfo(`Discovered ${domain}: zone ${found.zoneId}, role ${found.roleArn.split("/").pop()}`);
+    } else {
+      if (!opts.domain || !zoneId) fail("Give --platform <domain> (everything else is discovered), or --domain and --zone-id");
+      domain = opts.domain;
+    }
+    if (!domain.startsWith(`${opts.name}.`)) fail(`--domain must be under --name: ${opts.name}.<zone>`);
+    region ??= "us-east-2";
+    const cli = path15.resolve(opts.cli ?? path15.join(os4.homedir(), ".local", "bin", "mesh"));
+    let awsProfile = opts.awsProfile;
+    let awsConfigFile = opts.awsConfigFile ? path15.resolve(opts.awsConfigFile) : void 0;
+    if (!awsProfile) {
+      if (!opts.platform || !roleArn) fail("Without --platform, give --aws-profile (a mesh login --export profile)");
+      if (!opts.cli) requireFallbackShim(cli);
+      awsProfile = WORKSTATION_PROFILE;
+      awsConfigFile = path15.join(dir, "aws-config");
+      const profile = renderCredentialProcessProfile({ profileName: awsProfile, context: opts.platform, roleArn, region, meshBin: cli });
+      const existing = fs14.existsSync(awsConfigFile) ? fs14.readFileSync(awsConfigFile, "utf8") : "";
+      fs14.writeFileSync(awsConfigFile, upsertManagedAwsConfigSection(existing, `workstation ${opts.platform}`, profile));
+      logSuccess(`${awsConfigFile}: [profile ${awsProfile}] runs ${cli}`);
+    } else if (opts.cli) {
+      const configFile = awsConfigFile ?? path15.join(os4.homedir(), ".aws", "config");
+      fs14.writeFileSync(configFile, rewriteCredentialProgram(fs14.readFileSync(configFile, "utf8"), awsProfile, cli));
+      logSuccess(`${configFile}: [profile ${awsProfile}] now runs ${cli}`);
+    }
+    const caddy = opts.caddy ? path15.resolve(opts.caddy) : await ensureCaddy(dir);
+    const identity = {
+      name: opts.name,
+      domain,
+      proxy: {
+        zoneId,
+        region,
+        awsProfile,
+        ...awsConfigFile ? { awsConfigFile } : {},
+        caddy
+      }
+    };
+    const proxy = identity.proxy;
+    const problem = profileProblem(proxy);
+    if (problem && !opts.allowCheckoutCli) {
+      logError(`The profile ${awsProfile} will not keep renewing the certificate: ${problem}.`);
+      logInfo("  Point it at a mesh CLI outside any checkout: --cli <path>, or --allow-checkout-cli to accept it.");
+      process.exit(1);
+    }
+    if (problem) logWarn(`Accepted (--allow-checkout-cli): ${problem}.`);
+    if (!profileYieldsCredentials(proxy)) {
+      if (!opts.platform) fail(`The profile ${awsProfile} yields no AWS credentials yet: run its mesh login, then init again`);
+      logInfo(`Signing in to ${opts.platform} for the certificate role...`);
+      const login = spawnSync3(process.execPath, [...process.execArgv, process.argv[1], "login", opts.platform], { stdio: "inherit" });
+      if (login.status !== 0 || !profileYieldsCredentials(proxy)) {
+        fail(`The profile ${awsProfile} still yields no credentials for ${roleArn}: is your Zitadel user one of the stack's subjects?`);
+      }
+    }
+    fs14.mkdirSync(path15.join(dir, "routes"), { recursive: true });
+    fs14.writeFileSync(file, JSON.stringify(identity, null, 2) + "\n");
+    logSuccess(`Workstation ${opts.name}: https://*.${domain} (${file})`);
+    logInfo("Keep its proxy running with: mesh workstation proxy --install");
+  });
+  ws.command("proxy").description("Run the workstation's proxy (Caddy) in the foreground: certificate, routes, reloads").option("--print", "print the Caddyfile and the command instead of running").option("--install", "run it as a LaunchAgent (starts now, at login, and again if it exits)").option("--uninstall", "stop the LaunchAgent and remove it").action((opts) => {
+    const dir = workstationDir();
+    const domain = `gui/${os4.userInfo().uid}`;
+    if ((opts.install || opts.uninstall) && !launchAgentsSupported()) {
+      logError(LAUNCH_AGENTS_MACOS_ONLY);
+      process.exit(1);
+    }
+    if (opts.uninstall) {
+      launchctl(["bootout", `${domain}/${LAUNCH_AGENT_LABEL}`]);
+      fs14.rmSync(launchAgentPath(), { force: true });
+      logSuccess(`Removed the ${LAUNCH_AGENT_LABEL} LaunchAgent`);
+      return;
+    }
+    const identity = requireIdentity(dir);
+    if (!identity.proxy) {
+      logError("workstation.json has no proxy settings. Run: mesh workstation init --force \u2026");
+      process.exit(1);
+    }
+    const proxy = identity.proxy;
+    const caddyfile = writeCaddyfile(dir, { ...identity, proxy });
+    const caddy = proxy.caddy ?? "caddy";
+    const args = ["run", "--watch", "--config", caddyfile, "--adapter", "caddyfile"];
+    if (opts.print) {
+      console.log(fs14.readFileSync(caddyfile, "utf8"));
+      console.log(`${caddy} ${args.join(" ")}`);
+      return;
+    }
+    if (opts.install) {
+      if (!launchctl(["print", `${domain}/${LAUNCH_AGENT_LABEL}`]) && adminPortInUse()) {
+        logError("Another workstation proxy is running (127.0.0.1:2119 answers). Stop it, then run --install again.");
+        process.exit(1);
+      }
+      const problem = profileProblem(proxy);
+      if (problem) logWarn(`The profile will not keep renewing the certificate: ${problem}.`);
+      const env = proxyEnv({ PATH: launchAgentSearchPath(process.env.PATH, process.execPath), HOME: os4.homedir() }, proxy);
+      const plist = renderLaunchAgent({ caddy, caddyfile, dir, env });
+      fs14.mkdirSync(path15.dirname(launchAgentPath()), { recursive: true });
+      fs14.writeFileSync(launchAgentPath(), plist);
+      const loaded = reloadLaunchAgent(domain, launchAgentPath());
+      if (!loaded.ok) {
+        logError(`launchctl bootstrap failed for ${launchAgentPath()}${loaded.output ? `: ${loaded.output}` : ""}`);
+        process.exit(1);
+      }
+      logSuccess(`LaunchAgent ${LAUNCH_AGENT_LABEL}: serving https://*.${identity.domain} (log: ${path15.join(dir, "proxy.log")})`);
+      return;
+    }
+    logInfo(`Serving https://*.${identity.domain} \u2014 routes in ${path15.join(dir, "routes")}`);
+    const child = spawn6(caddy, args, { stdio: "inherit", env: proxyEnv(process.env, identity.proxy) });
+    child.on("error", (e) => {
+      logError(`Could not start ${caddy}: ${e.message}. Build it with: xcaddy build --with github.com/caddy-dns/route53`);
+      process.exit(1);
+    });
+    child.on("exit", (code) => process.exit(code ?? 1));
+  });
+  ws.command("routes").description("List the HTTPS names this workstation serves").option("--prune", "remove routes of mesh dev sessions that are no longer running").option("--json", "print JSON").action((opts) => {
+    const dir = workstationDir();
+    requireIdentity(dir);
+    let routes = listRoutes(dir).map((r) => ({
+      ...r,
+      alive: r.session ? tmuxSessionAlive(r.session) : void 0
+    }));
+    if (opts.prune) {
+      for (const r of routes.filter((r2) => r2.session && !r2.alive)) {
+        fs14.rmSync(r.file, { force: true });
+        logInfo(`Removed ${r.hostname} (session ${r.session} is not running)`);
+      }
+      routes = routes.filter((r) => !r.session || r.alive);
+    }
+    if (opts.json) {
+      console.log(JSON.stringify(routes, null, 2));
+      return;
+    }
+    if (routes.length === 0) {
+      logInfo("No routes.");
+      return;
+    }
+    for (const r of routes) {
+      const owner = r.session ? `mesh dev ${r.session}${r.alive ? "" : " (not running)"}` : "stack";
+      console.log(`  https://${r.hostname.padEnd(56)} \u2192 :${String(r.port).padEnd(6)} ${owner}`);
+    }
+    if (routes.some((r) => r.session && !r.alive)) logWarn("Clear routes of stopped sessions with: mesh workstation routes --prune");
+  });
+  ws.command("status").description("Is this workstation healthy: proxy running, certificate fresh, renewal credentials alive").action(() => {
+    const dir = workstationDir();
+    const identity = requireIdentity(dir);
+    const expiry = certificateExpiry(dir, identity.domain);
+    const launchd = launchAgentsSupported();
+    const agent = launchd && launchctl(["print", `gui/${os4.userInfo().uid}/${LAUNCH_AGENT_LABEL}`]);
+    const problem = identity.proxy ? profileProblem(identity.proxy) : void 0;
+    const credentialOk = identity.proxy ? profileYieldsCredentials(identity.proxy) : true;
+    console.log(`  workstation   ${identity.name} (*.${identity.domain})`);
+    const proxyLine = !launchd ? LAUNCH_AGENTS_MACOS_ONLY : agent ? `LaunchAgent ${LAUNCH_AGENT_LABEL}` : "no LaunchAgent (mesh workstation proxy --install)";
+    console.log(`  proxy         ${proxyLine}`);
+    console.log(`  certificate   ${expiry ? `expires ${expiry.toISOString().slice(0, 10)}` : "none issued yet"}`);
+    console.log(`  credentials   ${credentialOk ? "ok" : "FAILING"}${identity.proxy?.awsProfile ? ` (profile ${identity.proxy.awsProfile})` : ""}`);
+    console.log(`  routes        ${listRoutes(dir).length}`);
+    const warnings = workstationWarnings({ now: /* @__PURE__ */ new Date(), certExpiry: expiry, credentialOk, credentialProblem: problem });
+    for (const w of warnings) logWarn(w);
+    if (warnings.length > 0) process.exitCode = 1;
+  });
+}
+
 // packages/mesh-cli/src/program.ts
 var CLI_NAME = "mesh";
 var CLI_DESCRIPTION = "Build, run and deploy apps on a Mesh platform";
@@ -7385,6 +7842,7 @@ function createProgram(options = {}) {
   registerInitCommands(program);
   registerTenantCommands(program);
   registerInstallShimCommand(program);
+  registerWorkstationCommands(program);
   return program;
 }