@mesh-tech/mesh-cli 0.44.0 → 0.45.0

package/dist/bin/{mesh.chunk-HC7V75J3.js → mesh.chunk-UJAPUO2W.js}

@@ -107,7 +107,7 @@ async function registryPreflight(opts) {
   const probe = await probeRegistryToken(opts);
   let session = null;
   try {
-    const { readRegistrySession } = await import("./mesh.registry-identity-DSTAHXUS.js");
+    const { readRegistrySession } = await import("./mesh.registry-identity-QOGDEMZO.js");
     session = readRegistrySession();
   } catch {
   }

package/dist/bin/{mesh.create-app-DVMZDEQP.js → mesh.create-app-BHB3BGH7.js}

@@ -13,14 +13,14 @@ import {
   resolveAppDir,
   shouldBootstrapAppsRepo,
   workspaceGlobForApp
-} from "./mesh.chunk-QE5LUIHN.js";
+} from "./mesh.chunk-252LTIHZ.js";
 import "./mesh.chunk-F4654EPX.js";
-import "./mesh.chunk-HB2IZKLP.js";
+import "./mesh.chunk-SFIJZF3S.js";
 import "./mesh.chunk-PL3P54MY.js";
 import "./mesh.chunk-MCBMHWXP.js";
 import "./mesh.chunk-WFFDF346.js";
 import "./mesh.chunk-IQOBTL42.js";
-import "./mesh.chunk-HC7V75J3.js";
+import "./mesh.chunk-UJAPUO2W.js";
 export {
   NO_REGISTRY_ACCESS_MESSAGE,
   PLATFORM_MONOREPO_NAME,

package/dist/bin/{mesh.dev-token-server-4N6HGQAF.js → mesh.dev-token-server-6TNWX5TY.js}

@@ -2,7 +2,7 @@ import {
   decodeJwtPayload,
   getValidToken,
   readCredentials
-} from "./mesh.chunk-HB2IZKLP.js";
+} from "./mesh.chunk-SFIJZF3S.js";
 import "./mesh.chunk-PL3P54MY.js";
 import "./mesh.chunk-MCBMHWXP.js";
 import {
@@ -10,7 +10,7 @@ import {
   logWarn
 } from "./mesh.chunk-WFFDF346.js";
 import "./mesh.chunk-IQOBTL42.js";
-import "./mesh.chunk-HC7V75J3.js";
+import "./mesh.chunk-UJAPUO2W.js";
 
 // packages/mesh-cli/src/commands/dev-token-server.ts
 import * as http from "node:http";

package/dist/bin/mesh.js

@@ -1,25 +1,25 @@
 #!/usr/bin/env node
 import {
   createProgram
-} from "./mesh.chunk-XOCERV6F.js";
-import "./mesh.chunk-QUKWWFZI.js";
+} from "./mesh.chunk-G4TCVQLL.js";
+import "./mesh.chunk-JSY6THRF.js";
 import {
   formatVersionLine,
   resolveCliRuntime
-} from "./mesh.chunk-OQA2UBOD.js";
-import "./mesh.chunk-QE5LUIHN.js";
-import "./mesh.chunk-ZNM3DDAM.js";
-import "./mesh.chunk-PANTMVC3.js";
+} from "./mesh.chunk-6OGUV2DU.js";
+import "./mesh.chunk-252LTIHZ.js";
+import "./mesh.chunk-HPLMVIBO.js";
+import "./mesh.chunk-NN3LTNUM.js";
 import "./mesh.chunk-F4654EPX.js";
-import "./mesh.chunk-TYM27CO3.js";
-import "./mesh.chunk-HB2IZKLP.js";
+import "./mesh.chunk-4Y3JGAYZ.js";
+import "./mesh.chunk-SFIJZF3S.js";
 import "./mesh.chunk-PL3P54MY.js";
 import "./mesh.chunk-MCBMHWXP.js";
 import "./mesh.chunk-WFFDF346.js";
 import {
   handleCliError
 } from "./mesh.chunk-IQOBTL42.js";
-import "./mesh.chunk-HC7V75J3.js";
+import "./mesh.chunk-UJAPUO2W.js";
 import "./mesh.chunk-OW5EMVG5.js";
 
 // packages/mesh-cli/bin/mesh.ts

package/dist/bin/{mesh.login-Q6R5GMVM.js → mesh.login-4O5PMS25.js}

@@ -40,12 +40,12 @@ import {
   tokenStillValid,
   withDiscoveredFields,
   writeContextConfig
-} from "./mesh.chunk-HB2IZKLP.js";
+} from "./mesh.chunk-SFIJZF3S.js";
 import "./mesh.chunk-PL3P54MY.js";
 import "./mesh.chunk-MCBMHWXP.js";
 import "./mesh.chunk-WFFDF346.js";
 import "./mesh.chunk-IQOBTL42.js";
-import "./mesh.chunk-HC7V75J3.js";
+import "./mesh.chunk-UJAPUO2W.js";
 export {
   CONFIG_DIR,
   CONFIG_FILE,

package/dist/bin/{mesh.platform-setup-YK6KSOP7.js → mesh.platform-setup-MTY6ICAO.js}

@@ -15,7 +15,7 @@ import {
   validateEnv,
   validateRegion,
   validateStateBucket
-} from "./mesh.chunk-ZNM3DDAM.js";
+} from "./mesh.chunk-HPLMVIBO.js";
 import "./mesh.chunk-IQOBTL42.js";
 export {
   DOMAIN_REQUIRED_MESSAGE,

package/dist/bin/{mesh.program-NOBVA3JS.js → mesh.program-CMOLQWZI.js}

@@ -2,20 +2,20 @@ import {
   CLI_DESCRIPTION,
   CLI_NAME,
   createProgram
-} from "./mesh.chunk-XOCERV6F.js";
-import "./mesh.chunk-QUKWWFZI.js";
-import "./mesh.chunk-OQA2UBOD.js";
-import "./mesh.chunk-QE5LUIHN.js";
-import "./mesh.chunk-ZNM3DDAM.js";
-import "./mesh.chunk-PANTMVC3.js";
+} from "./mesh.chunk-G4TCVQLL.js";
+import "./mesh.chunk-JSY6THRF.js";
+import "./mesh.chunk-6OGUV2DU.js";
+import "./mesh.chunk-252LTIHZ.js";
+import "./mesh.chunk-HPLMVIBO.js";
+import "./mesh.chunk-NN3LTNUM.js";
 import "./mesh.chunk-F4654EPX.js";
-import "./mesh.chunk-TYM27CO3.js";
-import "./mesh.chunk-HB2IZKLP.js";
+import "./mesh.chunk-4Y3JGAYZ.js";
+import "./mesh.chunk-SFIJZF3S.js";
 import "./mesh.chunk-PL3P54MY.js";
 import "./mesh.chunk-MCBMHWXP.js";
 import "./mesh.chunk-WFFDF346.js";
 import "./mesh.chunk-IQOBTL42.js";
-import "./mesh.chunk-HC7V75J3.js";
+import "./mesh.chunk-UJAPUO2W.js";
 import "./mesh.chunk-OW5EMVG5.js";
 export {
   CLI_DESCRIPTION,

package/dist/bin/{mesh.registry-KA3CNNPZ.js → mesh.registry-BDBH6DRP.js}

@@ -17,14 +17,14 @@ import {
   runRegistryStatus,
   shouldRemintAfter,
   shouldRepairUserNpmrc
-} from "./mesh.chunk-PANTMVC3.js";
-import "./mesh.chunk-TYM27CO3.js";
-import "./mesh.chunk-HB2IZKLP.js";
+} from "./mesh.chunk-NN3LTNUM.js";
+import "./mesh.chunk-4Y3JGAYZ.js";
+import "./mesh.chunk-SFIJZF3S.js";
 import "./mesh.chunk-PL3P54MY.js";
 import "./mesh.chunk-MCBMHWXP.js";
 import "./mesh.chunk-WFFDF346.js";
 import "./mesh.chunk-IQOBTL42.js";
-import "./mesh.chunk-HC7V75J3.js";
+import "./mesh.chunk-UJAPUO2W.js";
 export {
   CONTEXT_IGNORED_NOTICE,
   NOT_AUTHORIZED_RERUN,

package/dist/bin/{mesh.registry-identity-DSTAHXUS.js → mesh.registry-identity-QOGDEMZO.js}

@@ -15,13 +15,13 @@ import {
   registrySessionCandidates,
   registryTokenRoles,
   resolveRegistryIdentity
-} from "./mesh.chunk-TYM27CO3.js";
-import "./mesh.chunk-HB2IZKLP.js";
+} from "./mesh.chunk-4Y3JGAYZ.js";
+import "./mesh.chunk-SFIJZF3S.js";
 import "./mesh.chunk-PL3P54MY.js";
 import "./mesh.chunk-MCBMHWXP.js";
 import "./mesh.chunk-WFFDF346.js";
 import "./mesh.chunk-IQOBTL42.js";
-import "./mesh.chunk-HC7V75J3.js";
+import "./mesh.chunk-UJAPUO2W.js";
 export {
   REGISTRY_ALIAS,
   REGISTRY_CREDENTIAL_KEY,

package/dist/bin/{mesh.review-command-3ZXPS6Y3.js → mesh.review-command-E7V2L5AM.js}

@@ -10,15 +10,15 @@ import {
   discoverStackExternalServices,
   ensureAwsCredentialsForStack,
   resolveExternalServiceScope
-} from "./mesh.chunk-QUKWWFZI.js";
-import "./mesh.chunk-HB2IZKLP.js";
+} from "./mesh.chunk-JSY6THRF.js";
+import "./mesh.chunk-SFIJZF3S.js";
 import "./mesh.chunk-PL3P54MY.js";
 import "./mesh.chunk-MCBMHWXP.js";
 import {
   logInfo
 } from "./mesh.chunk-WFFDF346.js";
 import "./mesh.chunk-IQOBTL42.js";
-import "./mesh.chunk-HC7V75J3.js";
+import "./mesh.chunk-UJAPUO2W.js";
 
 // packages/mesh-cli/src/commands/mcp/review-command.ts
 import { SSMClient } from "@aws-sdk/client-ssm";

package/dist/bin/{mesh.start-JDSYIRZI.js → mesh.start-3MUKXN2U.js}

@@ -4,7 +4,7 @@ import {
   reportAssembly,
   resolveCliRuntime,
   runAssemble
-} from "./mesh.chunk-OQA2UBOD.js";
+} from "./mesh.chunk-6OGUV2DU.js";
 import {
   logError,
   logInfo,
@@ -13,7 +13,7 @@ import {
 import {
   homeNpmrcPath,
   parseNpmrcRegistryAuth
-} from "./mesh.chunk-HC7V75J3.js";
+} from "./mesh.chunk-UJAPUO2W.js";
 
 // packages/mesh-cli/src/docs/start.ts
 import { execFileSync as execFileSync2 } from "node:child_process";

package/dist/bin/{mesh.wizard-QGWPV4XN.js → mesh.wizard-EH3SQEHW.js}

@@ -2,24 +2,24 @@ import {
   bootstrapAppsRepo,
   isInsidePlatformMonorepo,
   shouldBootstrapAppsRepo
-} from "./mesh.chunk-QE5LUIHN.js";
+} from "./mesh.chunk-252LTIHZ.js";
 import {
   PLATFORM_SETUP_DEFAULTS,
   ensureStateBucket,
   renderPlatformNextSteps,
   resolvePlatformSetup,
   scaffoldPlatformRepo
-} from "./mesh.chunk-ZNM3DDAM.js";
+} from "./mesh.chunk-HPLMVIBO.js";
 import {
   RegistryNotAuthorizedError
-} from "./mesh.chunk-PANTMVC3.js";
+} from "./mesh.chunk-NN3LTNUM.js";
 import {
   resolveTargetRoot,
   syncSkills
 } from "./mesh.chunk-F4654EPX.js";
 import {
   readRegistrySession
-} from "./mesh.chunk-TYM27CO3.js";
+} from "./mesh.chunk-4Y3JGAYZ.js";
 import {
   detectLocalTenant,
   discoverConfigForContext,
@@ -31,7 +31,7 @@ import {
   runLoginFlow,
   tokenStillValid,
   writeMeshJson
-} from "./mesh.chunk-HB2IZKLP.js";
+} from "./mesh.chunk-SFIJZF3S.js";
 import "./mesh.chunk-PL3P54MY.js";
 import "./mesh.chunk-MCBMHWXP.js";
 import {
@@ -44,7 +44,7 @@ import {
 } from "./mesh.chunk-IQOBTL42.js";
 import {
   probeRegistryToken
-} from "./mesh.chunk-HC7V75J3.js";
+} from "./mesh.chunk-UJAPUO2W.js";
 
 // packages/mesh-cli/src/commands/init/wizard.ts
 import * as fs from "fs";
@@ -157,7 +157,7 @@ var registryStep = {
     try {
       logInfo(REGISTRY_WHY);
       const login = ctx.seams?.runRegistryLogin ?? (async (opts) => {
-        const { runRegistryLogin } = await import("./mesh.registry-KA3CNNPZ.js");
+        const { runRegistryLogin } = await import("./mesh.registry-BDBH6DRP.js");
         await runRegistryLogin(void 0, opts);
       });
       await login({ device: ctx.device, profile: ctx.profile });

package/dist/build-info.json

@@ -1,4 +1,4 @@
 {
-  "commit": "d86991f76",
-  "builtAt": "2026-11-12T18:37:32.328Z"
+  "commit": "f796ae877",
+  "builtAt": "2026-11-15T16:42:23.109Z"
 }

package/dist/src/commands/dev.d.ts

@@ -12,6 +12,7 @@ interface DevService {
     command: string[];
     env?: Record<string, DevEnvVar>;
     kind?: 'dagster';
+    route?: string | false;
 }
 interface DevTunnel {
     host: string;

package/dist/src/commands/dev.js

@@ -36,6 +36,8 @@ import { ALL_CHECKS, aggregateStatus, classifyPaneLiveness, classifySessionServi
 import { awaitServiceReadiness, paneTail, parseWaitSeconds, portHeldByAnother, RESTART_READY_TIMEOUT_MS, TEMPORAL_WORKER_RUNNING, } from './dev-readiness.js';
 import { resolveWorktreeIdentity, withAppScopedPortBlock, blockBasePort, PORT_BLOCK_SERVICE_SUBRANGE, } from '../utils/worktree-identity.js';
 import { devSessionsRoot } from '../utils/dev-sessions-root.js';
+import { workstationRenewalWarnings } from '../utils/workstation-machine.js';
+import { planSessionRoutes, readWorkstationIdentity, removeSessionRoutes, usableRouteUrls, worktreeRouteSuffix, writeSessionRoutes, } from '../utils/workstation-routes.js';
 export function registerServiceProbes(devOutput, tenant, probeFiles) {
     const services = {};
     for (const [name, service] of Object.entries(devOutput.services)) {
@@ -142,6 +144,12 @@ function removeSessionState(sessionName) {
         fs.unlinkSync(getSessionStatePath(sessionName));
     }
     catch { }
+    try {
+        const removed = removeSessionRoutes(sessionName);
+        if (removed.length > 0)
+            logInfo(`Removed workstation routes: ${removed.join(', ')}`);
+    }
+    catch { }
     try {
         fs.rmSync(getSessionEnvDir(sessionName), { recursive: true, force: true });
     }
@@ -1345,6 +1353,45 @@ async function updateDevboxProxy(devOutput, appRoot) {
         logInfo(`  http://${hostname} → localhost:${port}`);
     }
 }
+function planWorkstationRoutes(appRoot, devOutput) {
+    const identity = readWorkstationIdentity();
+    if (!identity)
+        return [];
+    return planSessionRoutes({
+        identity,
+        app: devOutput.app ?? path.basename(appRoot),
+        services: devOutput.services,
+        suffix: worktreeRouteSuffix(resolveWorktreeIdentity(appRoot), process.env.MESH_DEV_ROUTE_SUFFIX),
+    });
+}
+function workstationUrlVar(appRoot, devOutput, serviceName) {
+    try {
+        const url = usableRouteUrls(planWorkstationRoutes(appRoot, devOutput))[serviceName];
+        return url ? { MESH_DEV_PUBLIC_URL: url } : {};
+    }
+    catch {
+        return {};
+    }
+}
+function applyWorkstationRoutes(sessionName, appRoot, devOutput) {
+    try {
+        const planned = planWorkstationRoutes(appRoot, devOutput);
+        if (planned.length === 0)
+            return {};
+        const result = writeSessionRoutes(sessionName, planned);
+        for (const warning of workstationRenewalWarnings())
+            logWarn(warning);
+        for (const c of result.conflicts) {
+            logWarn(`Workstation route ${c.hostname} is held by ${c.heldBy} (port ${c.heldPort}); ${c.service} (port ${c.port}) is not routed. ` +
+                'Pick another name with --route-suffix <name>.');
+        }
+        return result.urls;
+    }
+    catch (e) {
+        logWarn(`Workstation routes skipped: ${e.message}`);
+        return {};
+    }
+}
 async function setupSubdomainRouting(devOutput, appRoot) {
     const tsInfo = await getTailscaleInfo();
     if (!tsInfo)
@@ -1589,6 +1636,7 @@ async function startServices(sessionName, appRoot, devOutput, headless, awsEnv,
         logInfo('  Hub UI will show unauthenticated state without valid credentials.');
     }
     const monorepoRoot = findMonorepoRoot();
+    const routeUrls = applyWorkstationRoutes(sessionName, appRoot, devOutput);
     const notLaunched = [];
     for (const [name, service] of Object.entries(devOutput.services)) {
         const cmd = service.command.join(' ');
@@ -1632,6 +1680,7 @@ async function startServices(sessionName, appRoot, devOutput, headless, awsEnv,
             ...temporalAuthVars,
             ...devUserVars,
             ...(taskQueueSuffix ? { MESH_TASK_QUEUE_SUFFIX: taskQueueSuffix } : {}),
+            ...(routeUrls[name] ? { MESH_DEV_PUBLIC_URL: routeUrls[name] } : {}),
             ...awsEnv,
             ...sessionEnv,
         };
@@ -1682,7 +1731,10 @@ async function startServices(sessionName, appRoot, devOutput, headless, awsEnv,
         const s = devOutput.services[name];
         const hasCmd = s.command && s.command.length > 0;
         if (hasCmd) {
-            if (subdomainCtx && s.port) {
+            if (routeUrls[name]) {
+                console.log(`  ${name.padEnd(20)} ${routeUrls[name]}  (localhost:${s.port})`);
+            }
+            else if (subdomainCtx && s.port) {
                 console.log(`  ${name.padEnd(20)} http://${name}.${subdomainCtx.baseDomain}`);
             }
             else {
@@ -1836,6 +1888,7 @@ async function restartService(sessionName, serviceName, appRoot, devOutput, awsE
             ...temporalAuthVars,
             ...resolveDevUserVars(merged),
             ...(taskQueueSuffix ? { MESH_TASK_QUEUE_SUFFIX: taskQueueSuffix } : {}),
+            ...workstationUrlVar(appRoot, merged, serviceName),
             ...awsEnv,
             ...readTmuxSessionEnv(sessionName, ['KUBECONFIG', 'DEV_USER_TOKEN_URL']),
         };
@@ -2034,6 +2087,7 @@ export function registerDevCommand(program) {
         .option('--stack <stack>', 'Pulumi stack name (default: auto-detect)')
         .addOption(new Option('--stage <stack>', 'Deprecated alias for --stack').hideHelp())
         .option('--headless', 'Start without attaching to tmux')
+        .option('--route-suffix <name>', "On a workstation: the suffix of this session's HTTPS names (default: the worktree's name; '' for none)")
         .option('--kill', 'Kill existing dev session')
         .option('--status', 'Show service status')
         .option('--json', 'Output status as JSON (with --status)')
@@ -2053,6 +2107,8 @@ export function registerDevCommand(program) {
         await startTokenServer(Number(port), context);
     });
     dev.action(async (options) => {
+        if (options.routeSuffix !== undefined)
+            process.env.MESH_DEV_ROUTE_SUFFIX = options.routeSuffix;
         if (options.profile) {
             applyAwsProfileOverride(options.profile);
         }

package/dist/src/commands/temporal.js

@@ -901,6 +901,22 @@ var init_worktree_identity = __esm({
   }
 });
 
+// packages/mesh-cli/src/utils/workstation-routes.ts
+var init_workstation_routes = __esm({
+  "packages/mesh-cli/src/utils/workstation-routes.ts"() {
+    "use strict";
+  }
+});
+
+// packages/mesh-cli/src/utils/workstation-machine.ts
+var init_workstation_machine = __esm({
+  "packages/mesh-cli/src/utils/workstation-machine.ts"() {
+    "use strict";
+    init_log();
+    init_workstation_routes();
+  }
+});
+
 // packages/mesh-cli/src/commands/dev.ts
 import { Option } from "commander";
 import { SecretsManagerClient as SecretsManagerClient2, GetSecretValueCommand as GetSecretValueCommand2 } from "@aws-sdk/client-secrets-manager";
@@ -938,6 +954,8 @@ var init_dev = __esm({
     init_dev_readiness();
     init_worktree_identity();
     init_dev_sessions_root();
+    init_workstation_machine();
+    init_workstation_routes();
   }
 });
 
@@ -1903,6 +1921,69 @@ var init_capture_history = __esm({
   }
 });
 
+// packages/mesh-cli/src/utils/temporal-inspect.ts
+import { createRequire } from "node:module";
+function enumMemberName(member, prefix2) {
+  return member.slice(prefix2.length).toLowerCase().split("_").map((w) => w.charAt(0).toUpperCase() + w.slice(1)).join("");
+}
+function eventTypeNames(enumObject = loadEventTypeEnum()) {
+  const names = {};
+  for (const [member, value] of Object.entries(enumObject)) {
+    if (typeof value === "number" && member.startsWith("EVENT_TYPE_") && value !== 0) {
+      names[value] = enumMemberName(member, "EVENT_TYPE_");
+    }
+  }
+  return names;
+}
+function loadEventTypeEnum() {
+  try {
+    const require2 = createRequire(import.meta.url);
+    const fromClient = createRequire(require2.resolve("@temporalio/client"));
+    const proto = fromClient("@temporalio/proto");
+    return proto.temporal.api.enums.v1.EventType;
+  } catch {
+    return {};
+  }
+}
+var LIST_STATUSES = {
+  running: "Running",
+  completed: "Completed",
+  failed: "Failed",
+  canceled: "Canceled",
+  terminated: "Terminated",
+  "continued-as-new": "ContinuedAsNew",
+  "timed-out": "TimedOut"
+};
+function quote(value) {
+  return `'${value.replace(/\\/g, "\\\\").replace(/'/g, "\\'")}'`;
+}
+function buildListQuery(opts) {
+  const clauses = [];
+  if (opts.type) clauses.push(`WorkflowType = ${quote(opts.type)}`);
+  if (opts.status) {
+    const status = LIST_STATUSES[opts.status.toLowerCase()];
+    if (!status) throw new Error(`--status must be one of: ${Object.keys(LIST_STATUSES).join(", ")}`);
+    clauses.push(`ExecutionStatus = ${quote(status)}`);
+  }
+  if (opts.parent) clauses.push(`ParentWorkflowId = ${quote(opts.parent)}`);
+  if (opts.query) clauses.push(clauses.length > 0 ? `(${opts.query})` : opts.query);
+  return clauses.join(" AND ");
+}
+function formatListRows(rows) {
+  const table = [
+    ["WORKFLOW ID", "TYPE", "STATUS", "STARTED", "PARENT"],
+    ...rows.map((r) => [
+      r.workflowId,
+      r.type,
+      r.status,
+      r.startTime ? r.startTime.toISOString().replace(/\.\d{3}Z$/, "Z") : "-",
+      r.parentWorkflowId ?? "-"
+    ])
+  ];
+  const widths = table[0].map((_, i) => Math.max(...table.map((row) => row[i].length)));
+  return table.map((row) => row.map((cell, i) => i === row.length - 1 ? cell : cell.padEnd(widths[i])).join("  "));
+}
+
 // packages/mesh-cli/src/commands/temporal.ts
 init_log();
 import { spawnSync } from "node:child_process";
@@ -2385,47 +2466,16 @@ async function resolveBearerToken(auth) {
     return void 0;
   }
 }
-var EVENT_TYPE_NAMES = {
-  1: "WorkflowExecutionStarted",
-  2: "WorkflowExecutionCompleted",
-  3: "WorkflowExecutionFailed",
-  4: "WorkflowExecutionTimedOut",
-  5: "WorkflowTaskScheduled",
-  6: "WorkflowTaskStarted",
-  7: "WorkflowTaskCompleted",
-  8: "WorkflowTaskTimedOut",
-  9: "WorkflowTaskFailed",
-  10: "ActivityTaskScheduled",
-  11: "ActivityTaskStarted",
-  12: "ActivityTaskCompleted",
-  13: "ActivityTaskFailed",
-  14: "ActivityTaskTimedOut",
-  15: "ActivityTaskCancelRequested",
-  16: "ActivityTaskCanceled",
-  17: "TimerStarted",
-  18: "TimerFired",
-  19: "TimerCanceled",
-  20: "WorkflowExecutionCancelRequested",
-  21: "WorkflowExecutionCanceled",
-  24: "WorkflowExecutionSignaled",
-  // not 22/23 which were removed
-  25: "WorkflowExecutionTerminated",
-  26: "WorkflowExecutionSignaled",
-  29: "WorkflowPropertiesModified",
-  40: "ChildWorkflowExecutionStarted",
-  41: "ChildWorkflowExecutionCompleted",
-  42: "ChildWorkflowExecutionFailed",
-  43: "ChildWorkflowExecutionCanceled",
-  44: "ChildWorkflowExecutionTimedOut",
-  45: "ChildWorkflowExecutionTerminated",
-  46: "WorkflowPropertiesModified",
-  48: "NexusOperationScheduled",
-  49: "NexusOperationStarted",
-  50: "NexusOperationCompleted",
-  51: "NexusOperationFailed",
-  52: "NexusOperationCanceled",
-  53: "NexusOperationTimedOut"
-};
+var eventTypeNameTable;
+function eventTypeName(type) {
+  if (!eventTypeNameTable) {
+    eventTypeNameTable = eventTypeNames();
+    if (Object.keys(eventTypeNameTable).length === 0) {
+      logWarn("could not load Temporal's EventType enum; event names will show as Unknown(n)");
+    }
+  }
+  return eventTypeNameTable[type] ?? `Unknown(${type})`;
+}
 var STATUS_NAMES = {
   0: "UNSPECIFIED",
   1: "RUNNING",
@@ -2558,7 +2608,7 @@ ${totalShown} events shown (workflow ended).`);
 }
 async function printEvent(event, decrypter) {
   const eventType = event.eventType ?? 0;
-  const typeName = EVENT_TYPE_NAMES[eventType] ?? `Unknown(${eventType})`;
+  const typeName = eventTypeName(eventType);
   const id = String(event.eventId).padStart(4);
   const detail = extractEventDetail(event);
   const detailStr = detail ? ` \u2014 ${detail}` : "";
@@ -2818,6 +2868,50 @@ function warnIfNotGitIgnored(outPath) {
    This fixture contains DECRYPTED production payloads. Add it to .gitignore or move it outside the repo \u2014 do NOT commit it.`
   );
 }
+function timestampToDate(ts) {
+  if (!ts || ts.seconds === null || ts.seconds === void 0) return void 0;
+  const seconds = Number(ts.seconds);
+  return Number.isFinite(seconds) ? new Date(seconds * 1e3 + Math.floor((ts.nanos ?? 0) / 1e6)) : void 0;
+}
+async function listWorkflows(options) {
+  const query = buildListQuery(options);
+  const limit = Math.max(1, parseInt(options.limit ?? "20", 10) || 20);
+  const conn = await connect(options);
+  try {
+    const rows = [];
+    let nextPageToken;
+    do {
+      const page = await conn.connection.workflowService.listWorkflowExecutions({
+        namespace: conn.namespace,
+        query,
+        pageSize: Math.min(limit - rows.length, 100),
+        ...nextPageToken ? { nextPageToken } : {}
+      });
+      for (const info of page.executions ?? []) {
+        rows.push({
+          workflowId: info.execution?.workflowId ?? "?",
+          type: info.type?.name ?? "?",
+          status: STATUS_NAMES[info.status ?? 0] ?? String(info.status),
+          startTime: timestampToDate(info.startTime),
+          ...info.parentExecution?.workflowId ? { parentWorkflowId: info.parentExecution.workflowId } : {}
+        });
+        if (rows.length >= limit) break;
+      }
+      nextPageToken = page.nextPageToken?.length ? page.nextPageToken : void 0;
+    } while (nextPageToken && rows.length < limit);
+    if (options.json) {
+      console.log(JSON.stringify(rows, null, 2));
+      return;
+    }
+    if (rows.length === 0) {
+      console.log(`No workflows${query ? ` match ${query}` : ""} in ${conn.namespace}.`);
+      return;
+    }
+    for (const line of formatListRows(rows)) console.log(line);
+  } finally {
+    conn.connection.close();
+  }
+}
 async function terminateWorkflow(workflowId, runId, options) {
   const conn = await connect(options);
   try {
@@ -2850,6 +2944,16 @@ async function connect(options) {
 function registerTemporalCommands(program) {
   const temporal = program.command("temporal").description("Inspect Temporal workflows for the current app/stack");
   const sharedOpts = (cmd) => cmd.option("--stack <stack>", "Pulumi stack name (auto-detected from current directory)").option("--address <addr>", "Temporal server address (default: from stack output)").option("--namespace <ns>", "Temporal namespace (default: from stack output)");
+  sharedOpts(
+    temporal.command("list").description("List workflows in the app's namespace, running first, then most recently closed (find the id the other commands take)").option("--type <workflowType>", "only this workflow type (e.g. agentWorkflow)").option("--status <status>", `only this status: ${Object.keys(LIST_STATUSES).join(", ")}`).option("--parent <workflowId>", "only the children of this workflow").option("--query <visibilityQuery>", "a Temporal visibility query, AND-ed with the flags above").option("-n, --limit <n>", "maximum workflows to list", "20").option("--json", "print JSON")
+  ).action(async (opts) => {
+    try {
+      await listWorkflows(opts);
+    } catch (err) {
+      logError(err instanceof Error ? err.message : String(err));
+      process.exitCode = 1;
+    }
+  });
   sharedOpts(
     temporal.command("describe <workflowId> [runId]").description("Show workflow status and metadata")
   ).action(async (workflowId, runId, opts) => {