@fluid-app/fluid-cli-mist 0.1.0

package/dist/index.mjs

@@ -0,0 +1,1398 @@
+import { Command } from "commander";
+import chalk from "chalk";
+import { getAuthToken } from "@fluid-app/fluid-cli";
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import path, { join, resolve } from "node:path";
+import ora from "ora";
+import prompts from "prompts";
+import os from "node:os";
+import { execa } from "execa";
+import open from "open";
+//#region src/api/client.ts
+/**
+* Generic fetch wrapper for the Mist Rails API.
+*
+* Spec: `features/mist/cli-spec.md` §4.
+* - Base URL: `https://api.fluid.app` (overridable via FLUID_API_BASE)
+* - Auth: `Authorization: Bearer <token>` from the standard fluid-cli token
+*   store; the host CLI's PluginContext provides `getAuthToken()`.
+* - Errors: maps API responses to a typed `MistApiError` that the
+*   error-handler turns into the spec's exit codes (1/2/3/4).
+*/
+const DEFAULT_BASE = "https://api.fluid.app";
+var MistApiError = class extends Error {
+	/** HTTP status, or 0 for network-level failures. */
+	status;
+	details;
+	/** Best-guess exit code per the spec: 2 for 4xx, 3 for 5xx/vendor, 4 for net. */
+	exitCode;
+	constructor(message, status, details) {
+		super(message);
+		this.name = "MistApiError";
+		this.status = status;
+		this.details = details;
+		if (status === 0) this.exitCode = 4;
+		else if (status >= 500) this.exitCode = 3;
+		else this.exitCode = 2;
+	}
+};
+function apiBase() {
+	return process.env["FLUID_API_BASE"] ?? DEFAULT_BASE;
+}
+/** Build a typed Mist API client. Throws if the user isn't logged in. */
+function createMistClient() {
+	const token = getAuthToken();
+	if (!token) throw new MistApiError("No active Fluid session — run `fluid login` first.", 401);
+	const base = apiBase();
+	function buildUrl(path, query) {
+		const url = new URL(path.startsWith("/") ? path : `/${path}`, base);
+		if (query) for (const [k, v] of Object.entries(query)) {
+			if (v == null) continue;
+			url.searchParams.set(k, String(v));
+		}
+		return url.toString();
+	}
+	async function call(method, path, opts) {
+		const url = buildUrl(path, opts?.query);
+		let response;
+		try {
+			response = await fetch(url, {
+				method,
+				headers: {
+					Authorization: `Bearer ${token}`,
+					Accept: "application/json",
+					...opts?.body !== void 0 ? { "Content-Type": "application/json" } : {}
+				},
+				...opts?.body !== void 0 ? { body: JSON.stringify(opts.body) } : {}
+			});
+		} catch (err) {
+			throw new MistApiError(`Network error: ${err instanceof Error ? err.message : String(err)}`, 0);
+		}
+		if (response.status === 204) return void 0;
+		const text = await response.text();
+		let parsed;
+		try {
+			parsed = text.length > 0 ? JSON.parse(text) : {};
+		} catch {
+			if (!response.ok) throw new MistApiError(`HTTP ${response.status}: ${text.slice(0, 200)}`, response.status);
+			return;
+		}
+		if (!response.ok) {
+			const body = parsed;
+			throw new MistApiError(body.error?.message ?? `HTTP ${response.status}`, response.status, body.error?.details);
+		}
+		return parsed;
+	}
+	return {
+		get: (path, query) => call("GET", path, { query }),
+		post: (path, body) => call("POST", path, { body }),
+		patch: (path, body) => call("PATCH", path, { body }),
+		delete: (path, body) => call("DELETE", path, body !== void 0 ? { body } : void 0),
+		async request(path, init) {
+			const url = buildUrl(path);
+			return fetch(url, {
+				...init,
+				headers: {
+					Authorization: `Bearer ${token}`,
+					Accept: "application/json",
+					...init?.headers ?? {}
+				}
+			});
+		}
+	};
+}
+//#endregion
+//#region src/api/id-resolver.ts
+const MISTS_BASE = "/api/v202604/mists";
+function listMistsForResolve(client, params = {}) {
+	return client.get(MISTS_BASE, params);
+}
+const cache = /* @__PURE__ */ new Map();
+const UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/** Returns true if the input already looks like a UUID we can use as-is. */
+function isUuid(s) {
+	return UUID_REGEX.test(s.trim());
+}
+/**
+* Resolve a user-supplied slug-or-id to the API's canonical UUID id.
+* No-op when the input already looks like a UUID.
+*/
+async function resolveMistId(client, slugOrId) {
+	const key = slugOrId.trim();
+	if (!key) throw new Error("Empty mist identifier.");
+	if (isUuid(key)) return key;
+	const hit = cache.get(key);
+	if (hit) return hit;
+	const response = await listMistsForResolve(client, { limit: 100 });
+	for (const m of response.mists ?? []) if (m.slug) cache.set(m.slug, m.id);
+	const found = cache.get(key);
+	if (!found) throw new Error(`No mist found with slug "${key}". Try \`fluid mist list\` to see what's available.`);
+	return found;
+}
+//#endregion
+//#region src/api/mists.ts
+const BASE = "/api/v202604/mists";
+function listMists(client, params = {}) {
+	return client.get(BASE, params);
+}
+async function showMist(client, slug) {
+	const id = await resolveMistId(client, slug);
+	return client.get(`${BASE}/${id}`);
+}
+function createMist(client, body) {
+	return client.post(BASE, body);
+}
+async function updateMist(client, slug, body) {
+	const id = await resolveMistId(client, slug);
+	return client.patch(`${BASE}/${id}`, body);
+}
+async function deleteMist(client, slug) {
+	const id = await resolveMistId(client, slug);
+	return client.delete(`${BASE}/${id}`);
+}
+async function restoreMist(client, slug) {
+	const id = await resolveMistId(client, slug);
+	return client.post(`${BASE}/${id}/restore`);
+}
+//#endregion
+//#region src/lib/hostable.ts
+const SHORTHAND = {
+	droplet: "Droplet::Application",
+	droplets: "Droplet::Application",
+	mobile_widget: "MobileWidget",
+	"mobile-widget": "MobileWidget",
+	mobilewidget: "MobileWidget",
+	widget: "MobileWidget",
+	drop_zone: "DropZone",
+	"drop-zone": "DropZone",
+	dropzone: "DropZone"
+};
+/** Friendly label for help text + error output. */
+const SHORTHAND_LIST = "droplet, mobile_widget, drop_zone";
+var HostableParseError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "HostableParseError";
+	}
+};
+/**
+* Parse a `<type>:<id>` shorthand, or accept already-canonical
+* `Droplet::Application:42` if the user prefers the Rails-style form.
+*/
+function parseHostableRef(raw) {
+	const trimmed = raw.trim();
+	if (!trimmed) throw new HostableParseError(`Empty hostable reference. Use <type>:<id> where <type> is one of ${SHORTHAND_LIST}.`);
+	const lastColon = trimmed.lastIndexOf(":");
+	if (lastColon <= 0 || lastColon === trimmed.length - 1) throw new HostableParseError(`Invalid hostable reference "${raw}". Expected <type>:<id>, e.g. droplet:42.`);
+	const typePart = trimmed.slice(0, lastColon).trim();
+	const idPart = trimmed.slice(lastColon + 1).trim();
+	const id = Number(idPart);
+	if (!Number.isInteger(id) || id <= 0) throw new HostableParseError(`Invalid hostable id "${idPart}". Must be a positive integer.`);
+	return {
+		hostable_type: canonicalizeHostableType(typePart),
+		hostable_id: id
+	};
+}
+/** Map an input string to the canonical Rails class name, throwing on miss. */
+function canonicalizeHostableType(typePart) {
+	if ([
+		"Droplet::Application",
+		"MobileWidget",
+		"DropZone"
+	].includes(typePart)) return typePart;
+	const looked = SHORTHAND[typePart.toLowerCase().replace(/\s+/g, "")];
+	if (looked) return looked;
+	throw new HostableParseError(`Unknown hostable type "${typePart}". Use one of: ${SHORTHAND_LIST}.`);
+}
+//#endregion
+//#region src/lib/slug-resolver.ts
+/**
+* Slug resolution — spec §3 conventions:
+*   1. If a slug arg is passed, use it.
+*   2. Otherwise look for a `.mist` file in CWD (written by `fluid mist
+*      clone`) and use the slug from it.
+*   3. Otherwise error: tell the user to pass a slug or cd into a cloned dir.
+*/
+const MIST_FILE = ".mist";
+var SlugResolutionError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "SlugResolutionError";
+	}
+};
+function readMistFile(dir) {
+	const filePath = join(dir, MIST_FILE);
+	if (!existsSync(filePath)) return null;
+	try {
+		const raw = readFileSync(filePath, "utf8");
+		const parsed = JSON.parse(raw);
+		if (!parsed || typeof parsed !== "object") return null;
+		const obj = parsed;
+		if (typeof obj["slug"] !== "string") return null;
+		return {
+			slug: obj["slug"],
+			vendor_name: typeof obj["vendor_name"] === "string" ? obj["vendor_name"] : "",
+			public_url: typeof obj["public_url"] === "string" ? obj["public_url"] : null
+		};
+	} catch {
+		return null;
+	}
+}
+/** Returns the slug from arg or `.mist` file; throws if neither is present. */
+function resolveSlug(arg, cwd = process.cwd()) {
+	if (arg && arg.trim().length > 0) return arg.trim();
+	const file = readMistFile(cwd);
+	if (file) return file.slug;
+	throw new SlugResolutionError("No slug provided and no `.mist` file in this directory. Pass the slug as an argument or cd into a cloned mist.");
+}
+/** Write a `.mist` file after `fluid mist clone`. */
+function writeMistFile(dir, mist) {
+	const payload = {
+		slug: mist.slug,
+		vendor_name: mist.vendor_name,
+		public_url: mist.public_url
+	};
+	writeFileSync(join(dir, MIST_FILE), JSON.stringify(payload, null, 2) + "\n", "utf8");
+}
+//#endregion
+//#region src/lib/error-handler.ts
+/**
+* Centralized error handling — maps thrown errors to spec'd exit codes
+* and friendly messages. Imported by every command's `.action()` so each
+* file doesn't repeat the same try/catch.
+*
+* Exit codes (spec §3 "Conventions"):
+*   0 success | 1 user error | 2 API 4xx | 3 API 5xx / vendor | 4 network
+*/
+/** Run an async action and translate failures into pretty output + exit. */
+async function runAction(fn) {
+	try {
+		await fn();
+	} catch (err) {
+		handle(err);
+	}
+}
+function handle(err) {
+	if (err instanceof SlugResolutionError) {
+		console.error(chalk.red(err.message));
+		process.exit(1);
+	}
+	if (err instanceof HostableParseError) {
+		console.error(chalk.red(err.message));
+		process.exit(1);
+	}
+	if (err instanceof MistApiError) {
+		if (err.status === 403) {
+			const action = err.details?.["permission"];
+			console.error(chalk.red(action ? `Your role doesn't include \`mist.${String(action)}\` — ask your Fluid admin to grant it.` : err.message));
+		} else if (err.status === 409) {
+			const date = err.details?.["scheduled_destroy_at"];
+			console.error(chalk.yellow(typeof date === "string" ? `This mist is scheduled for destruction on ${date.slice(0, 10)}. Run \`fluid mist restore <slug>\` first.` : err.message));
+		} else if (err.status === 422) {
+			const details = err.details ?? {};
+			const idErrors = details["hostable_id"];
+			if (Array.isArray(idErrors) && idErrors.some((e) => /already taken/i.test(String(e)))) console.error(chalk.yellow("That hostable is already attached to another mist. Detach it first or pick a different one."));
+			else if (typeof err.message === "string" && /hostable_type and hostable_id/.test(err.message)) console.error(chalk.yellow("Pass `--hostable <type>:<id>` (or both `--hostable-type` and `--hostable-id`)."));
+			else if (typeof err.message === "string" && /Hostable not found/.test(err.message)) {
+				const t = details["hostable_type"];
+				const id = details["hostable_id"];
+				console.error(chalk.yellow(`Couldn't find ${typeof t === "string" ? t : "hostable"}${id != null ? ` #${String(id)}` : ""} in this company.`));
+			} else console.error(chalk.red(err.message));
+		} else if (err.status === 410) console.error(chalk.red("Grace period expired — vendor teardown is in flight. Create a fresh mist with `fluid mist create`."));
+		else console.error(chalk.red(err.message));
+		process.exit(err.exitCode);
+	}
+	if (err instanceof Error) console.error(chalk.red(err.message));
+	else console.error(chalk.red(String(err)));
+	process.exit(1);
+}
+//#endregion
+//#region src/lib/output.ts
+/**
+* Output helpers — human-readable by default, `--json` emits raw API
+* payload. NO_COLOR respected via chalk's built-in detection.
+*/
+function printJson(payload) {
+	process.stdout.write(JSON.stringify(payload, null, 2) + "\n");
+}
+const STATE_COLOR$1 = {
+	pending: chalk.gray,
+	provisioning: chalk.yellow,
+	live: chalk.green,
+	failed: chalk.red,
+	pending_destroy: chalk.magenta,
+	archived: chalk.dim
+};
+function colorState(state) {
+	return STATE_COLOR$1[state](state);
+}
+/** Pad columns to width — cheap manual table; avoids cli-table3 dep for v1. */
+function printTable(rows) {
+	if (rows.length === 0) return;
+	const widths = [];
+	for (const row of rows) row.forEach((cell, i) => {
+		const visible = stripAnsi(cell).length;
+		widths[i] = Math.max(widths[i] ?? 0, visible);
+	});
+	for (const row of rows) {
+		const padded = row.map((cell, i) => {
+			const w = widths[i] ?? 0;
+			return cell + " ".repeat(Math.max(0, w - stripAnsi(cell).length));
+		});
+		process.stdout.write(padded.join("  ") + "\n");
+	}
+}
+function stripAnsi(s) {
+	return s.replace(/\x1b\[[0-9;]*m/g, "");
+}
+function relativeDate(iso) {
+	if (!iso) return "—";
+	const diff = Date.now() - new Date(iso).getTime();
+	const minutes = Math.floor(diff / 6e4);
+	if (minutes < 1) return "just now";
+	if (minutes < 60) return `${minutes}m ago`;
+	const hours = Math.floor(minutes / 60);
+	if (hours < 24) return `${hours}h ago`;
+	const days = Math.floor(hours / 24);
+	if (days < 30) return `${days}d ago`;
+	return new Date(iso).toISOString().slice(0, 10);
+}
+/** Human-friendly absolute date for one-off prints (scheduled_destroy_at). */
+function formatAbsolute(iso) {
+	return new Date(iso).toISOString().slice(0, 10);
+}
+//#endregion
+//#region src/commands/list.ts
+/** `fluid mist list` — GET /mists with optional filters. Spec §3. */
+const listCommand = new Command("list").description("List the mists you have access to").option("--state <state>", "Filter by state: live | provisioning | failed | pending_destroy | archived").option("--kind <kind>", "Filter by kind (default: next_app)").option("--limit <n>", "Page size 1..100 (default 25)").option("--json", "Emit raw API JSON").action((opts) => runAction(async () => {
+	const client = createMistClient();
+	const limit = opts.limit ? parseInt(opts.limit, 10) : void 0;
+	const response = await listMists(client, {
+		...opts.state ? { state: opts.state } : {},
+		...opts.kind ? { kind: opts.kind } : {},
+		...limit && Number.isFinite(limit) ? { limit } : {}
+	});
+	if (opts.json) return printJson(response);
+	const mists = response.mists ?? [];
+	if (mists.length === 0) {
+		console.log(chalk.dim("No mists found."));
+		return;
+	}
+	printTable([[
+		chalk.bold("SLUG"),
+		chalk.bold("NAME"),
+		chalk.bold("STATE"),
+		chalk.bold("ATTACHED"),
+		chalk.bold("UPDATED")
+	], ...mists.map((m) => [
+		m.slug,
+		m.name ?? m.droplet?.name ?? m.vendor_name,
+		colorState(m.state),
+		m.hostable_type ?? chalk.dim("standalone"),
+		relativeDate(m.updated_at)
+	])]);
+}));
+//#endregion
+//#region src/commands/show.ts
+/** `fluid mist show <slug>` — single mist detail. Surfaces
+*  scheduled_destroy_at when state is pending_destroy. Spec §3. */
+const showCommand = new Command("show").description("Show one mist by slug").argument("[slug]", "The mist slug (defaults to .mist file in CWD)").option("--json", "Emit raw API JSON").action((slug, opts) => runAction(async () => {
+	const resolved = resolveSlug(slug);
+	const { mist } = await showMist(createMistClient(), resolved);
+	if (opts.json) return printJson({ mist });
+	const lines = [];
+	const label = mist.name ?? mist.droplet?.name ?? mist.vendor_name;
+	lines.push(`${chalk.bold(label)}  ${chalk.dim(mist.slug)}`);
+	if (mist.name && mist.name !== mist.vendor_name) lines.push(`  vendor   ${chalk.dim(mist.vendor_name)}`);
+	lines.push(`  state    ${colorState(mist.state)}`);
+	if (mist.kind) lines.push(`  kind     ${mist.kind}`);
+	if (mist.public_url) lines.push(`  url      ${chalk.cyan(mist.public_url)}`);
+	if (mist.hostable_type) lines.push(`  attached ${mist.hostable_type}`);
+	if (mist.droplet) lines.push(`  droplet  ${mist.droplet.name} (#${mist.droplet.id})`);
+	if (mist.provisioned_at) lines.push(`  live     ${relativeDate(mist.provisioned_at)}`);
+	lines.push(`  updated  ${relativeDate(mist.updated_at)}`);
+	if (mist.scheduled_destroy_at) lines.push(chalk.magenta(`  destroy  scheduled ${formatAbsolute(mist.scheduled_destroy_at)} (run \`fluid mist restore ${mist.slug}\` to undo)`));
+	console.log(lines.join("\n"));
+}));
+//#endregion
+//#region src/commands/create.ts
+/**
+* `fluid mist create` — POST /mists. Synchronous; 30–60s.
+*
+* Updated for `fluid` PR #18678: the API no longer creates Droplets inline.
+* Pass an existing hostable via `--hostable <type>:<id>` (shorthand) or the
+* pair `--hostable-type` / `--hostable-id`. Optional `--name <label>` sets
+* the display label; if blank, the API falls back to the hostable's name.
+*/
+const createCommand = new Command("create").description(`Provision a new mist (optionally attached to an existing hostable: ${SHORTHAND_LIST})`).option("--hostable <ref>", "Attach to an existing hostable. Shorthand: <type>:<id> (e.g. droplet:42)").option("--hostable-type <type>", `Hostable type when not using shorthand (${SHORTHAND_LIST})`).option("--hostable-id <id>", "Hostable id when not using shorthand").option("--name <label>", "Optional display label (defaults to hostable name)").option("--kind <kind>", "Mist kind (default: next_app)").option("--json", "Emit raw API JSON").action((opts) => runAction(async () => {
+	const mist = {};
+	if (opts.kind) mist.kind = opts.kind;
+	if (opts.name?.trim()) mist.name = opts.name.trim();
+	const hasShorthand = !!opts.hostable;
+	const hasPair = !!opts.hostableType || !!opts.hostableId;
+	if (hasShorthand && hasPair) throw new Error("Use either `--hostable <type>:<id>` OR `--hostable-type` + `--hostable-id`, not both.");
+	if (hasShorthand) {
+		const pair = parseHostableRef(opts.hostable);
+		mist.hostable_type = pair.hostable_type;
+		mist.hostable_id = pair.hostable_id;
+	} else if (hasPair) {
+		if (!opts.hostableType || !opts.hostableId) throw new Error("`--hostable-type` and `--hostable-id` must be passed together.");
+		const id = Number(opts.hostableId);
+		if (!Number.isInteger(id) || id <= 0) throw new Error(`Invalid --hostable-id "${opts.hostableId}". Must be a positive integer.`);
+		mist.hostable_type = canonicalizeHostableType(opts.hostableType);
+		mist.hostable_id = id;
+	}
+	const client = createMistClient();
+	const spinner = ora("Setting up your Mist Cloud environment…").start();
+	try {
+		const response = await createMist(client, { mist });
+		spinner.succeed("Provisioned");
+		if (opts.json) return printJson(response);
+		const m = response.mist;
+		console.log();
+		const label = m.name ?? m.droplet?.name ?? m.vendor_name;
+		console.log(`${chalk.bold(label)}  ${chalk.dim(m.slug)}  ${colorState(m.state)}`);
+		if (m.public_url) console.log(`  ${chalk.cyan(m.public_url)}`);
+		if (m.hostable_type && m.hostable_id != null) console.log(chalk.dim(`  attached: ${m.hostable_type} #${m.hostable_id}`));
+		console.log();
+		console.log(chalk.dim(`Clone with: fluid mist clone ${m.slug}`));
+	} catch (err) {
+		spinner.fail("Provisioning failed");
+		throw err;
+	}
+}));
+//#endregion
+//#region src/commands/update.ts
+/**
+* `fluid mist update` — PATCH /mists/:id. Covers three operations on one
+* endpoint:
+*
+*   - Rename:   --name <label>
+*   - Attach:   --hostable <type>:<id>
+*   - Detach:   --detach (sends explicit nulls for both keys)
+*
+* `--hostable` and `--detach` are mutually exclusive at the CLI surface so
+* the user can't accidentally express contradictory intent. The wire-level
+* rule (both keys must be paired or both null) is enforced server-side.
+*/
+const updateCommand = new Command("update").description("Rename a mist, attach/replace a hostable, or detach one").argument("[slug]", "The mist slug (defaults to .mist file in CWD)").option("--name <label>", "Set the display label").option("--hostable <ref>", `Attach or replace the hostable. Shorthand: <type>:<id> (${SHORTHAND_LIST})`).option("--detach", "Detach the hostable (sends explicit nulls)").option("--json", "Emit raw API JSON").action((slug, opts) => runAction(async () => {
+	if (opts.hostable && opts.detach) throw new Error("Pass either `--hostable` OR `--detach`, not both — they're mutually exclusive.");
+	if (!opts.name && !opts.hostable && !opts.detach) throw new Error("Nothing to do — pass at least one of `--name`, `--hostable`, or `--detach`.");
+	const body = { mist: {} };
+	if (opts.name?.trim()) body.mist.name = opts.name.trim();
+	if (opts.hostable) {
+		const pair = parseHostableRef(opts.hostable);
+		body.mist.hostable_type = pair.hostable_type;
+		body.mist.hostable_id = pair.hostable_id;
+	}
+	if (opts.detach) {
+		body.mist.hostable_type = null;
+		body.mist.hostable_id = null;
+	}
+	const resolved = resolveSlug(slug);
+	const response = await updateMist(createMistClient(), resolved, body);
+	if (opts.json) return printJson(response);
+	const m = response.mist;
+	const label = m.name ?? m.droplet?.name ?? m.vendor_name;
+	console.log(`${chalk.bold(label)}  ${chalk.dim(m.slug)}  ${colorState(m.state)}`);
+	if (m.hostable_type && m.hostable_id != null) console.log(chalk.dim(`  attached: ${m.hostable_type} #${m.hostable_id}`));
+	else console.log(chalk.dim(`  standalone (no hostable)`));
+}));
+//#endregion
+//#region src/commands/delete.ts
+/**
+* `fluid mist delete` — scheduled teardown 15 days out (spec §3 "15-day
+* grace period"). DO NOT poll for completion.
+*/
+const deleteCommand = new Command("delete").description("Schedule a mist for destruction (15-day grace window)").argument("[slug]", "The mist slug (defaults to .mist file in CWD)").option("-y, --yes", "Skip confirmation prompt").option("--json", "Emit raw API JSON").action((slug, opts) => runAction(async () => {
+	const resolved = resolveSlug(slug);
+	const client = createMistClient();
+	if (!opts.yes) {
+		const { mist } = await showMist(client, resolved);
+		const fifteenDaysOut = new Date(Date.now() + 15 * 864e5).toISOString().slice(0, 10);
+		console.log();
+		console.log(`About to schedule ${chalk.bold(mist.vendor_name)} (${chalk.dim(mist.slug)}) for destruction on ${chalk.yellow(fifteenDaysOut)}.`);
+		console.log(chalk.dim(`Vendor resources stay alive until then; run \`fluid mist restore ${mist.slug}\` to undo.`));
+		const { confirmed } = await prompts({
+			type: "confirm",
+			name: "confirmed",
+			message: "Continue?",
+			initial: false
+		}, { onCancel: () => process.exit(130) });
+		if (!confirmed) {
+			console.log(chalk.dim("Aborted."));
+			process.exit(0);
+		}
+	}
+	const { mist } = await deleteMist(client, resolved);
+	if (opts.json) return printJson({ mist });
+	console.log(chalk.magenta(`Scheduled for destruction on ${mist.scheduled_destroy_at ? formatAbsolute(mist.scheduled_destroy_at) : "the 15-day mark"}.`));
+	console.log(chalk.dim(`Vendor resources stay alive until then; run \`fluid mist restore ${mist.slug}\` to undo.`));
+}));
+//#endregion
+//#region src/commands/restore.ts
+/** `fluid mist restore` — un-delete within the 15-day window. Spec §3. */
+const restoreCommand = new Command("restore").description("Cancel a scheduled mist destruction (15-day window)").argument("[slug]", "The mist slug (defaults to .mist file in CWD)").option("--json", "Emit raw API JSON").action((slug, opts) => runAction(async () => {
+	const resolved = resolveSlug(slug);
+	const { mist } = await restoreMist(createMistClient(), resolved);
+	if (opts.json) return printJson({ mist });
+	console.log(`Restored: ${mist.public_url ? chalk.cyan(mist.public_url) : mist.vendor_name} (${colorState(mist.state)})`);
+}));
+//#endregion
+//#region src/api/git_credential.ts
+async function createGitCredential(client, slug) {
+	const id = await resolveMistId(client, slug);
+	return client.post(`/api/v202604/mists/${id}/git_credential`);
+}
+//#endregion
+//#region src/lib/git.ts
+/**
+* Git wrapper — shells out to system `git` via execa. Spec §11.1: we
+* deliberately do NOT bundle git or use a pure-JS impl; users are expected
+* to have it installed.
+*
+* Security: token-bearing `remote_url` from POST /git_credential must never
+* be logged, persisted, *or* exposed in the process table. The token is
+* stripped from the URL and handed to git through a GIT_ASKPASS script via
+* env vars (MIST_GIT_USER / MIST_GIT_PASS) — so it never appears in argv
+* (visible to `ps aux` on macOS, `/proc/<pid>/cmdline` on Linux) and is
+* never written to `.git/config`.
+*/
+var GitError = class extends Error {
+	exitCode;
+	constructor(message, exitCode = 1) {
+		super(message);
+		this.name = "GitError";
+		this.exitCode = exitCode;
+	}
+};
+/** execa throws ENOENT when the git binary itself is missing — the
+*  single most common failure on non-developer machines. Translate it
+*  into an actionable message instead of "git <verb> failed (exit 1)".
+*  Returns null for every other failure so call sites keep their
+*  specific messages. */
+function gitMissingError(err) {
+	if (err?.code !== "ENOENT") return null;
+	return new GitError("Git isn't installed on this machine. In Mist Desktop, use the Install button in the yellow banner at the top of the app. From a terminal: macOS `xcode-select --install`, or download from https://git-scm.com/downloads.", 127);
+}
+/**
+* Split a token-bearing remote URL into the userless URL + creds. Used
+* to keep the token off git's argv: we pass `cleanUrl` to git and feed
+* `username` / `password` back through GIT_ASKPASS env vars.
+*
+* If the URL has no embedded credentials, returns empty strings — fine
+* for public repos where git won't even invoke askpass.
+*/
+function splitRemoteCredentials(remoteUrl) {
+	const u = new URL(remoteUrl);
+	const username = decodeURIComponent(u.username);
+	const password = decodeURIComponent(u.password);
+	u.username = "";
+	u.password = "";
+	return {
+		cleanUrl: u.toString(),
+		username,
+		password
+	};
+}
+/**
+* Write a stub GIT_ASKPASS script (shell on POSIX, .cmd on Windows) to
+* a per-process tmpdir and return its path. The script itself contains
+* no secret — it just echoes back whichever env var (MIST_GIT_USER /
+* MIST_GIT_PASS) matches git's prompt ("Username for …" / "Password
+* for …"). The credentials only live in the spawned git process's env
+* for the duration of the call.
+*
+* Idempotent: subsequent calls reuse the same script path.
+*/
+let askpassPath = null;
+function ensureAskpassScript() {
+	if (askpassPath && existsSync(askpassPath)) return askpassPath;
+	const dir = path.join(os.tmpdir(), `mist-cli-askpass-${process.pid}`);
+	if (!existsSync(dir)) mkdirSync(dir, {
+		recursive: true,
+		mode: 448
+	});
+	if (process.platform === "win32") {
+		const p = path.join(dir, "askpass.cmd");
+		writeFileSync(p, `@echo off\r\nset "p=%~1"\r\nif /i "%p:~0,1%"=="U" (<nul set /p=%MIST_GIT_USER%) else (<nul set /p=%MIST_GIT_PASS%)\r\n`);
+		askpassPath = p;
+	} else {
+		const p = path.join(dir, "askpass.sh");
+		writeFileSync(p, `#!/bin/sh\ncase "$1" in\n  Username*) printf '%s' "$MIST_GIT_USER" ;;\n  *) printf '%s' "$MIST_GIT_PASS" ;;\nesac\n`, { mode: 448 });
+		chmodSync(p, 448);
+		askpassPath = p;
+	}
+	return askpassPath;
+}
+/**
+* Build the spawn env + cleaned URL for a credentialed git invocation.
+* Returns:
+*   - `cleanUrl`: URL with userinfo stripped — safe to pass as argv.
+*   - `env`: parent env plus GIT_ASKPASS + MIST_GIT_USER / MIST_GIT_PASS.
+*            GIT_TERMINAL_PROMPT=0 prevents the TTY-prompt fallback if
+*            the credentials are empty (we want auth to fail fast, not
+*            hang the desktop waiting for interactive input).
+*/
+function gitAuthSpawn(remoteUrl) {
+	const { cleanUrl, username, password } = splitRemoteCredentials(remoteUrl);
+	return {
+		cleanUrl,
+		env: {
+			...process.env,
+			GIT_ASKPASS: ensureAskpassScript(),
+			GIT_TERMINAL_PROMPT: "0",
+			MIST_GIT_USER: username,
+			MIST_GIT_PASS: password
+		}
+	};
+}
+/** Confirm git is installed. Cheap call once at startup. */
+async function ensureGitAvailable() {
+	try {
+		await execa("git", ["--version"]);
+	} catch {
+		throw new GitError("`git` is required but not found on your PATH. Install it from https://git-scm.com/downloads or via `brew install git`.");
+	}
+}
+/**
+* `git clone <cleanUrl> <targetDir>`. The original remoteUrl carries a
+* token; gitAuthSpawn strips it from the URL and re-injects it via
+* GIT_ASKPASS so it never appears in argv. `credential.helper=` stops
+* git from caching what askpass returned to any system credential
+* store.
+*/
+async function gitClone(remoteUrl, targetDir) {
+	const { cleanUrl, env } = gitAuthSpawn(remoteUrl);
+	try {
+		await execa("git", [
+			"-c",
+			"credential.helper=",
+			"clone",
+			"--quiet",
+			cleanUrl,
+			targetDir
+		], {
+			env,
+			stdio: [
+				"ignore",
+				"inherit",
+				"inherit"
+			]
+		});
+	} catch (err) {
+		const missing = gitMissingError(err);
+		if (missing) throw missing;
+		const e = err;
+		throw new GitError(`git clone failed${e.exitCode != null ? ` (exit ${e.exitCode})` : ""}`, e.exitCode ?? 1);
+	}
+}
+/** `git push origin <branch>` — credentials supplied via GIT_ASKPASS,
+*  never in argv. The `.extraheader=` override clears any cached
+*  Authorization header that a CI-style git config might inject. */
+async function gitPush(cwd, remoteUrl, branch = "main") {
+	const { cleanUrl, env } = gitAuthSpawn(remoteUrl);
+	try {
+		await execa("git", [
+			"-c",
+			"credential.helper=",
+			"-c",
+			`http.https://github.com/.extraheader=`,
+			"push",
+			cleanUrl,
+			`HEAD:${branch}`
+		], {
+			cwd,
+			env,
+			stdio: [
+				"ignore",
+				"inherit",
+				"inherit"
+			]
+		});
+	} catch (err) {
+		const missing = gitMissingError(err);
+		if (missing) throw missing;
+		const e = err;
+		throw new GitError(`git push failed${e.exitCode != null ? ` (exit ${e.exitCode})` : ""}`, e.exitCode ?? 1);
+	}
+}
+/** `git pull origin <branch>`. Token supplied via GIT_ASKPASS, same as push. */
+async function gitPull(cwd, remoteUrl, branch = "main") {
+	const { cleanUrl, env } = gitAuthSpawn(remoteUrl);
+	try {
+		await execa("git", [
+			"-c",
+			"credential.helper=",
+			"pull",
+			"--ff-only",
+			cleanUrl,
+			branch
+		], {
+			cwd,
+			env,
+			stdio: [
+				"ignore",
+				"inherit",
+				"inherit"
+			]
+		});
+	} catch (err) {
+		const missing = gitMissingError(err);
+		if (missing) throw missing;
+		const e = err;
+		throw new GitError(`git pull failed${e.exitCode != null ? ` (exit ${e.exitCode})` : ""}`, e.exitCode ?? 1);
+	}
+}
+/**
+* Are there uncommitted changes (working tree or index) in this repo?
+* `git status --porcelain` is empty when everything is clean, non-empty
+* otherwise — so the count is just "is the output non-trivial".
+*/
+async function hasUncommittedChanges(cwd) {
+	try {
+		const { stdout } = await execa("git", ["status", "--porcelain"], { cwd });
+		return stdout.trim().length > 0;
+	} catch {
+		return false;
+	}
+}
+/**
+* Fetch the given branch from the token-bearing remote URL, writing
+* `FETCH_HEAD` so `git rev-list HEAD...FETCH_HEAD` is meaningful.
+*
+* Same security stance as gitPush — installation token comes through
+* GIT_ASKPASS, never argv or `.git/config`.
+*/
+async function gitFetch(cwd, remoteUrl, branch = "main") {
+	const { cleanUrl, env } = gitAuthSpawn(remoteUrl);
+	try {
+		await execa("git", [
+			"-c",
+			"credential.helper=",
+			"fetch",
+			"--quiet",
+			cleanUrl,
+			branch
+		], {
+			cwd,
+			env
+		});
+	} catch (err) {
+		const missing = gitMissingError(err);
+		if (missing) throw missing;
+		const e = err;
+		throw new GitError(`git fetch failed${e.exitCode != null ? ` (exit ${e.exitCode})` : ""}`, e.exitCode ?? 1);
+	}
+}
+/**
+* Count commits in local HEAD vs `FETCH_HEAD` (after `gitFetch`). Returns
+* `{ahead, behind}`: how many commits HEAD has that the remote doesn't,
+* and vice versa. A `0/0` result means "in sync".
+*/
+async function gitAheadBehindVsFetchHead(cwd) {
+	try {
+		const { stdout } = await execa("git", [
+			"rev-list",
+			"--left-right",
+			"--count",
+			"HEAD...FETCH_HEAD"
+		], { cwd });
+		const [a, b] = stdout.trim().split(/\s+/);
+		const ahead = Number.parseInt(a ?? "0", 10);
+		const behind = Number.parseInt(b ?? "0", 10);
+		return {
+			ahead: Number.isFinite(ahead) ? ahead : 0,
+			behind: Number.isFinite(behind) ? behind : 0
+		};
+	} catch {
+		return {
+			ahead: 0,
+			behind: 0
+		};
+	}
+}
+/** Fast-forward `HEAD` to `FETCH_HEAD`. Fails (non-zero exit) if not
+*  fast-forwardable — caller must check ahead-count first. */
+async function gitMergeFastForward(cwd) {
+	try {
+		await execa("git", [
+			"merge",
+			"--ff-only",
+			"FETCH_HEAD"
+		], { cwd });
+	} catch (err) {
+		const missing = gitMissingError(err);
+		if (missing) throw missing;
+		const e = err;
+		throw new GitError(`git fast-forward merge failed${e.exitCode != null ? ` (exit ${e.exitCode})` : ""}`, e.exitCode ?? 1);
+	}
+}
+/**
+* Stash working-tree + untracked changes with a Mist-tagged message.
+* Returns the stash ref (`stash@{0}`) we created. Callers should pair
+* this with `gitStashPop` after the dangerous step is done.
+*/
+async function gitStash(cwd, message) {
+	try {
+		await execa("git", [
+			"stash",
+			"push",
+			"--include-untracked",
+			"--message",
+			message
+		], { cwd });
+	} catch (err) {
+		const missing = gitMissingError(err);
+		if (missing) throw missing;
+		throw new GitError(`git stash push failed`, err.exitCode ?? 1);
+	}
+}
+/**
+* Pop the most recent stash. Throws on conflict so callers can surface
+* the situation (the working tree will have conflict markers; the user
+* needs to resolve manually).
+*/
+async function gitStashPop(cwd) {
+	try {
+		await execa("git", ["stash", "pop"], { cwd });
+	} catch (err) {
+		const missing = gitMissingError(err);
+		if (missing) throw missing;
+		throw new GitError(`Couldn't restore your local changes after pulling — the file edits collided with a teammate's. Run \`git stash list\` and resolve manually.`, err.exitCode ?? 1);
+	}
+}
+/**
+* `git add -A && git commit -m <message>` in `cwd`.
+*
+* Mist Desktop's "Publish" UX target is non-technical: the user expects
+* "ship my changes" to ship the changes they made, not to know about
+* staging or commit messages. This helper bundles working-tree edits
+* into one commit per publish so push has something to send.
+*
+* The commit author falls back to the repo's configured user; if there
+* isn't one we pass `-c user.email=… -c user.name=…` flags pointing at a
+* synthetic bot identity so the commit isn't rejected by git.
+*/
+async function gitAutoCommit(cwd, message) {
+	try {
+		await execa("git", ["add", "-A"], { cwd });
+	} catch (err) {
+		const missing = gitMissingError(err);
+		if (missing) throw missing;
+		throw new GitError(`git add failed`, err.exitCode ?? 1);
+	}
+	let hasName = false;
+	let hasEmail = false;
+	try {
+		hasName = (await execa("git", ["config", "user.name"], { cwd })).stdout.trim().length > 0;
+	} catch {}
+	try {
+		hasEmail = (await execa("git", ["config", "user.email"], { cwd })).stdout.trim().length > 0;
+	} catch {}
+	const identityArgs = [...hasName ? [] : ["-c", "user.name=Mist Desktop"], ...hasEmail ? [] : ["-c", "user.email=mist@fluid.app"]];
+	try {
+		await execa("git", [
+			...identityArgs,
+			"commit",
+			"-m",
+			message
+		], {
+			cwd,
+			stdio: [
+				"ignore",
+				"inherit",
+				"inherit"
+			]
+		});
+	} catch (err) {
+		const missing = gitMissingError(err);
+		if (missing) throw missing;
+		const e = err;
+		if (typeof e.stderr === "string" && /nothing to commit/i.test(e.stderr)) return;
+		throw new GitError(`git commit failed${e.exitCode != null ? ` (exit ${e.exitCode})` : ""}`, e.exitCode ?? 1);
+	}
+}
+//#endregion
+//#region src/commands/clone.ts
+/**
+* `fluid mist clone <slug>` — mints a fresh git credential and clones
+* into ./<vendor-name>/, writes a `.mist` marker file. Spec §3 + §11.
+*/
+const cloneCommand = new Command("clone").description("Clone the mist's GitHub repo (mints a fresh token per call)").argument("[slug]", "The mist slug (defaults to .mist file in CWD)").option("--dir <dir>", "Target directory (defaults to ./<vendor-name>/)").action((slug, opts) => runAction(async () => {
+	await ensureGitAvailable();
+	const resolvedSlug = resolveSlug(slug);
+	const client = createMistClient();
+	const spinner = ora("Resolving mist…").start();
+	const { mist } = await showMist(client, resolvedSlug);
+	spinner.text = "Minting git credential…";
+	const { git_credential: cred } = await createGitCredential(client, mist.slug);
+	const targetDir = resolve(opts.dir ?? mist.vendor_name);
+	if (existsSync(targetDir)) {
+		spinner.fail(`Directory ${targetDir} already exists. Pass --dir or remove it first.`);
+		process.exit(1);
+	}
+	spinner.text = `Cloning into ${mist.vendor_name}/…`;
+	try {
+		await gitClone(cred.remote_url, targetDir);
+	} catch (err) {
+		spinner.fail("git clone failed");
+		throw err;
+	}
+	writeMistFile(targetDir, mist);
+	spinner.succeed(`Cloned into ${chalk.cyan(targetDir)}`);
+	console.log(chalk.dim(`  cd ${join(".", mist.vendor_name)}`));
+	if (mist.public_url) console.log(chalk.dim(`  ${chalk.cyan(mist.public_url)}`));
+}));
+//#endregion
+//#region src/api/deployments.ts
+async function listDeployments(client, slug, limit) {
+	const id = await resolveMistId(client, slug);
+	return client.get(`/api/v202604/mists/${id}/deployments`, limit != null ? { limit } : void 0);
+}
+async function showDeployment(client, slug, deploymentId) {
+	const id = await resolveMistId(client, slug);
+	return client.get(`/api/v202604/mists/${id}/deployments/${deploymentId}`);
+}
+//#endregion
+//#region src/api/me.ts
+async function fetchCurrentUser(client) {
+	const raw = await client.get("/api/me");
+	const composed = [raw.first_name, raw.last_name].filter(Boolean).join(" ").trim();
+	const fullName = raw.full_name ?? (composed.length > 0 ? composed : null);
+	return {
+		id: raw.id,
+		public_id: raw.public_id ?? String(raw.id),
+		full_name: fullName,
+		first_name: raw.first_name ?? null,
+		last_name: raw.last_name ?? null,
+		email: raw.email ?? null
+	};
+}
+//#endregion
+//#region src/commands/push.ts
+/**
+* `fluid mist push [--watch]` — mints a credential, pushes to origin, and
+* (with --watch) polls /deployments until READY/ERROR. Spec §3 + §4.
+*/
+const POLL_MS$1 = 2e3;
+const LOCATE_TIMEOUT_MS = 2 * 6e4;
+const READY_TIMEOUT_MS = 5 * 6e4;
+function sleep$1(ms) {
+	return new Promise((r) => setTimeout(r, ms));
+}
+const pushCommand = new Command("push").description("Commit working-tree changes and push to the Mist-managed remote (triggers a Vercel deploy)").argument("[slug]", "The mist slug (defaults to .mist file in CWD)").option("--watch", "Poll /deployments until ready or error").option("--branch <name>", "Branch to push (default: main)").option("--no-commit", "Skip the auto-commit step (push existing commits only)").option("-m, --message <message>", "Commit message for the auto-commit (default: timestamped Publish)").action((slug, opts) => runAction(async () => {
+	await ensureGitAvailable();
+	const resolved = resolveSlug(slug);
+	const client = createMistClient();
+	const branch = opts.branch ?? "main";
+	const cwd = process.cwd();
+	const driftSpinner = ora("Checking for remote changes…").start();
+	try {
+		const { git_credential: fetchCred } = await createGitCredential(client, resolved);
+		await gitFetch(cwd, fetchCred.remote_url, branch);
+		const { ahead, behind } = await gitAheadBehindVsFetchHead(cwd);
+		if (behind > 0 && ahead === 0) {
+			const wasDirty = await hasUncommittedChanges(cwd);
+			driftSpinner.text = `Pulling ${behind} commit${behind === 1 ? "" : "s"} from origin/main…`;
+			if (wasDirty) await gitStash(cwd, "mist-push: pre-pull stash");
+			try {
+				await gitMergeFastForward(cwd);
+			} finally {
+				if (wasDirty) await gitStashPop(cwd);
+			}
+			driftSpinner.succeed(`Pulled ${behind} commit${behind === 1 ? "" : "s"} from origin/main`);
+		} else if (behind > 0 && ahead > 0) {
+			driftSpinner.fail(`Your branch and origin/main have diverged (you're ${ahead} ahead, ${behind} behind).`);
+			console.error(chalk.yellow("  Resolve in a terminal: `git pull --rebase`, fix any conflicts, then re-run Publish."));
+			process.exit(1);
+		} else driftSpinner.succeed("Up to date with origin/main");
+	} catch (err) {
+		if (err instanceof Error && err.message.includes("Resolve in a terminal")) throw err;
+		driftSpinner.fail("Couldn't sync with origin/main");
+		throw err;
+	}
+	if (opts.commit !== false) {
+		if (await hasUncommittedChanges(cwd)) {
+			const baseMessage = opts.message ?? `Publish from Mist Desktop · ${(/* @__PURE__ */ new Date()).toISOString().slice(0, 19).replace("T", " ")}`;
+			let namePrefix = "";
+			let idSuffix = "";
+			try {
+				const me = await Promise.race([fetchCurrentUser(client), new Promise((_, reject) => setTimeout(() => reject(/* @__PURE__ */ new Error("timed out after 5s")), 5e3))]);
+				const name = me.full_name && me.full_name.trim() || me.email || (Number.isFinite(me.id) ? `user-${me.id}` : null);
+				const id = me.public_id && me.public_id.trim();
+				if (name) namePrefix = `${name}: `;
+				if (id) idSuffix = ` (${id})`;
+			} catch (err) {
+				const reason = err instanceof Error ? err.message : String(err);
+				console.warn(chalk.yellow(`  (skipping user-stamp on commit — couldn't fetch /api/me: ${reason})`));
+			}
+			const message = `${namePrefix}${baseMessage}${idSuffix}`;
+			const commitSpinner = ora(`Committing changes (${message.length > 60 ? message.slice(0, 57) + "…" : message})…`).start();
+			try {
+				await gitAutoCommit(cwd, message);
+				commitSpinner.succeed("Committed");
+			} catch (err) {
+				commitSpinner.fail("Commit failed");
+				throw err;
+			}
+		}
+	}
+	const spinner = ora("Minting git credential…").start();
+	const { git_credential: cred } = await createGitCredential(client, resolved);
+	spinner.text = `Pushing ${branch} to origin…`;
+	try {
+		await gitPush(cwd, cred.remote_url, branch);
+	} catch (err) {
+		spinner.fail("git push failed");
+		throw err;
+	}
+	spinner.succeed("Push complete");
+	if (!opts.watch) return;
+	let pushedSha = null;
+	try {
+		const { execa } = await import("execa");
+		pushedSha = (await execa("git", ["rev-parse", "HEAD"], { cwd })).stdout.trim();
+	} catch {}
+	const locateStart = Date.now();
+	let deploymentId = null;
+	let attempt = 0;
+	while (Date.now() - locateStart < LOCATE_TIMEOUT_MS) {
+		attempt++;
+		const { deployments } = await listDeployments(client, resolved, 5);
+		const match = pushedSha ? deployments.find((d) => d.commit_sha === pushedSha) : deployments[0];
+		if (match) {
+			deploymentId = match.id;
+			console.log(`Located deployment ${match.id} (${match.state})`);
+			break;
+		}
+		if (attempt === 1) console.log(`Locating deployment for commit ${pushedSha?.slice(0, 7) ?? "(unknown)"}…`);
+		else if (attempt % 5 === 0) console.log(`  …still waiting (${attempt * 2}s elapsed)`);
+		await sleep$1(POLL_MS$1);
+	}
+	if (!deploymentId) {
+		console.error(`No deployment matching ${pushedSha?.slice(0, 7) ?? "the push"} appeared within ${LOCATE_TIMEOUT_MS / 1e3}s.`);
+		console.error("Vercel may still be queueing — run `fluid mist deployments` to check.");
+		process.exit(3);
+	}
+	const readyStart = Date.now();
+	let lastState = null;
+	while (Date.now() - readyStart < READY_TIMEOUT_MS) {
+		const { deployment } = await showDeployment(client, resolved, deploymentId);
+		if (deployment.state !== lastState) {
+			console.log(`  ${deployment.state}…`);
+			lastState = deployment.state;
+		}
+		if (deployment.state === "ready") {
+			console.log(`✔ Ready: ${chalk.cyan(deployment.url ?? "(no url)")}`);
+			return;
+		}
+		if (deployment.state === "error" || deployment.state === "canceled") {
+			console.error(`✘ Deployment ${deployment.state}`);
+			process.exit(3);
+		}
+		await sleep$1(POLL_MS$1);
+	}
+	console.error(`Watch timed out after ${READY_TIMEOUT_MS / 1e3}s. Last state: ${lastState}.`);
+	console.error("Run `fluid mist deployments` to check the latest state.");
+	process.exit(3);
+}));
+//#endregion
+//#region src/commands/pull.ts
+/** `fluid mist pull` — git pull origin main. Spec §3. */
+const pullCommand = new Command("pull").description("git pull from the Mist-managed remote").argument("[slug]", "The mist slug (defaults to .mist file in CWD)").option("--branch <name>", "Branch to pull (default: main)").action((slug, opts) => runAction(async () => {
+	await ensureGitAvailable();
+	const resolved = resolveSlug(slug);
+	const client = createMistClient();
+	const branch = opts.branch ?? "main";
+	const spinner = ora("Minting git credential…").start();
+	const { git_credential: cred } = await createGitCredential(client, resolved);
+	spinner.text = `Pulling ${branch}…`;
+	try {
+		await gitPull(process.cwd(), cred.remote_url, branch);
+	} catch (err) {
+		spinner.fail("git pull failed");
+		throw err;
+	}
+	spinner.succeed("Pull complete");
+}));
+//#endregion
+//#region src/commands/open.ts
+/** `fluid mist open` — opens public_url in the default browser. Spec §3. */
+const openCommand = new Command("open").description("Open the mist's public URL in your browser").argument("[slug]", "The mist slug (defaults to .mist file in CWD)").action((slug) => runAction(async () => {
+	const resolved = resolveSlug(slug);
+	const { mist } = await showMist(createMistClient(), resolved);
+	if (!mist.public_url) {
+		console.error(chalk.yellow(`Mist ${mist.slug} has no public URL yet (state: ${mist.state}).`));
+		process.exit(1);
+	}
+	console.log(chalk.cyan(mist.public_url));
+	await open(mist.public_url);
+}));
+//#endregion
+//#region src/commands/deployments.ts
+/** `fluid mist deployments` — list recent deployments. Spec §3. */
+const STATE_COLOR = {
+	ready: chalk.green,
+	building: chalk.yellow,
+	queued: chalk.dim,
+	error: chalk.red,
+	canceled: chalk.red
+};
+const deploymentsCommand = new Command("deployments").description("List recent deployments for a mist").argument("[slug]", "The mist slug (defaults to .mist file in CWD)").option("--limit <n>", "How many to fetch (default 10)").option("--json", "Emit raw API JSON").action((slug, opts) => runAction(async () => {
+	const resolved = resolveSlug(slug);
+	const response = await listDeployments(createMistClient(), resolved, opts.limit ? parseInt(opts.limit, 10) : 10);
+	if (opts.json) return printJson(response);
+	const deployments = response.deployments ?? [];
+	if (deployments.length === 0) {
+		console.log(chalk.dim("No deployments yet."));
+		return;
+	}
+	printTable([[
+		chalk.bold("ID"),
+		chalk.bold("STATE"),
+		chalk.bold("COMMIT"),
+		chalk.bold("MESSAGE"),
+		chalk.bold("AGE")
+	], ...deployments.map((d) => [
+		d.id,
+		(STATE_COLOR[d.state] ?? chalk.white)(d.state),
+		d.commit_sha ? d.commit_sha.slice(0, 7) : chalk.dim("—"),
+		d.commit_message ? d.commit_message.slice(0, 48) : chalk.dim("—"),
+		relativeDate(d.created_at)
+	])]);
+}));
+//#endregion
+//#region src/api/logs.ts
+async function fetchLogs(client, slug, params = {}) {
+	const id = await resolveMistId(client, slug);
+	return client.get(`/api/v202604/mists/${id}/logs`, params);
+}
+//#endregion
+//#region src/commands/logs.ts
+/** `fluid mist logs [--tail]` — poll /logs?since=<last> every 2s. Spec §4. */
+const POLL_MS = 2e3;
+function sleep(ms) {
+	return new Promise((r) => setTimeout(r, ms));
+}
+function levelColor(level) {
+	return level === "stderr" ? chalk.red : chalk.dim;
+}
+function printLine(entry) {
+	const ts = entry.timestamp.slice(11, 19);
+	process.stdout.write(`${chalk.dim(ts)} ${levelColor(entry.level)(entry.level.padEnd(6))} ${entry.message}\n`);
+}
+const logsCommand = new Command("logs").description("Fetch deployment logs (use --tail to stream)").argument("[slug]", "The mist slug (defaults to .mist file in CWD)").option("--tail", "Stream new logs every 2s").option("--limit <n>", "Initial fetch size (default 200)").option("--deployment <id>", "Logs from a specific deployment ID").option("--json", "Emit raw API JSON (one batch; ignored when --tail)").action((slug, opts) => runAction(async () => {
+	const resolved = resolveSlug(slug);
+	const client = createMistClient();
+	const limit = opts.limit ? parseInt(opts.limit, 10) : 200;
+	const initial = await fetchLogs(client, resolved, {
+		...opts.deployment ? { deployment_id: opts.deployment } : {},
+		limit
+	});
+	if (opts.json && !opts.tail) return printJson(initial);
+	for (const entry of initial.logs) printLine(entry);
+	if (!opts.tail) return;
+	let since = initial.logs.length > 0 ? initial.logs[initial.logs.length - 1].timestamp : (/* @__PURE__ */ new Date()).toISOString();
+	while (true) {
+		await sleep(POLL_MS);
+		const batch = await fetchLogs(client, resolved, {
+			...opts.deployment ? { deployment_id: opts.deployment } : {},
+			since,
+			limit
+		});
+		for (const entry of batch.logs) {
+			printLine(entry);
+			since = entry.timestamp;
+		}
+	}
+}));
+//#endregion
+//#region src/api/env_vars.ts
+function path$1(id, key) {
+	return key ? `/api/v202604/mists/${id}/env_vars/${encodeURIComponent(key)}` : `/api/v202604/mists/${id}/env_vars`;
+}
+async function listEnvVars(client, slug) {
+	const id = await resolveMistId(client, slug);
+	return client.get(path$1(id));
+}
+/** Create a new env var (the spec routes `set` to POST for new keys). */
+async function createEnvVar(client, slug, key, value, targets) {
+	const id = await resolveMistId(client, slug);
+	return client.post(path$1(id), { env_var: {
+		key,
+		value,
+		targets
+	} });
+}
+/** Update an existing env var (the spec routes `set` to PATCH for existing keys). */
+async function updateEnvVar(client, slug, key, value, targets) {
+	const id = await resolveMistId(client, slug);
+	return client.patch(path$1(id, key), { env_var: {
+		value,
+		targets
+	} });
+}
+async function deleteEnvVar(client, slug, key) {
+	const id = await resolveMistId(client, slug);
+	return client.delete(path$1(id, key));
+}
+//#endregion
+//#region src/commands/env/list.ts
+/** `fluid mist env list` — list env vars; mark managed_by entries. Spec §4. */
+function maskValue(value) {
+	if (value.length <= 8) return "•".repeat(value.length);
+	return `${value.slice(0, 4)}${"•".repeat(8)}${value.slice(-2)}`;
+}
+const envListCommand = new Command("list").description("List a mist's env vars").argument("[slug]", "The mist slug (defaults to .mist file in CWD)").option("--show-values", "Print full values instead of masking them").option("--json", "Emit raw API JSON").action((slug, opts) => runAction(async () => {
+	const resolved = resolveSlug(slug);
+	const response = await listEnvVars(createMistClient(), resolved);
+	if (opts.json) return printJson(response);
+	const vars = response.env_vars ?? [];
+	if (vars.length === 0) {
+		console.log(chalk.dim("No env vars."));
+		return;
+	}
+	printTable([[
+		chalk.bold("KEY"),
+		chalk.bold("VALUE"),
+		chalk.bold("TARGETS"),
+		chalk.bold("MANAGED")
+	], ...vars.map((v) => [
+		v.key,
+		opts.showValues ? v.value : maskValue(v.value),
+		v.targets.join(","),
+		v.managed_by === "mist" ? chalk.magenta("mist") : chalk.dim("user")
+	])]);
+}));
+//#endregion
+//#region src/commands/env/set.ts
+/**
+* `fluid mist env set <slug> KEY=value [KEY=value ...]` — POST for new
+* keys, PATCH for existing. Spec §3 + §4.
+*/
+function parsePair(pair) {
+	const eq = pair.indexOf("=");
+	if (eq <= 0) throw new Error(`Invalid pair "${pair}". Use KEY=value (no leading spaces).`);
+	return {
+		key: pair.slice(0, eq),
+		value: pair.slice(eq + 1)
+	};
+}
+const envSetCommand = new Command("set").description("Set one or more env vars (KEY=value KEY=value …)").argument("<slug-or-pair>", "The mist slug, or the first KEY=value pair").argument("[pairs...]", "Additional KEY=value pairs").action(async (slugOrPair, pairs) => {
+	await runAction(async () => {
+		let slug;
+		let rawPairs;
+		if (slugOrPair.includes("=")) {
+			slug = resolveSlug();
+			rawPairs = [slugOrPair, ...pairs];
+		} else {
+			slug = resolveSlug(slugOrPair);
+			rawPairs = pairs;
+		}
+		if (rawPairs.length === 0) {
+			console.error(chalk.red("Pass at least one KEY=value pair."));
+			process.exit(1);
+		}
+		const client = createMistClient();
+		const existing = await listEnvVars(client, slug);
+		const existingKeys = new Set((existing.env_vars ?? []).map((v) => v.key));
+		for (const raw of rawPairs) {
+			const { key, value } = parsePair(raw);
+			if (existingKeys.has(key)) {
+				await updateEnvVar(client, slug, key, value);
+				console.log(`${chalk.green("updated")}  ${key}`);
+			} else {
+				await createEnvVar(client, slug, key, value);
+				console.log(`${chalk.cyan("created")}  ${key}`);
+			}
+		}
+	});
+});
+//#endregion
+//#region src/commands/env/unset.ts
+/** `fluid mist env unset <slug> KEY [KEY ...]` — DELETE per key. Spec §3. */
+const envUnsetCommand = new Command("unset").description("Delete one or more env vars").argument("<slug-or-key>", "The mist slug, or the first KEY (if .mist file is present)").argument("[keys...]", "Additional keys").action(async (slugOrKey, keys) => {
+	await runAction(async () => {
+		let slug;
+		let toDelete;
+		if (/^[A-Z_][A-Z0-9_]*$/.test(slugOrKey)) {
+			slug = resolveSlug();
+			toDelete = [slugOrKey, ...keys];
+		} else {
+			slug = resolveSlug(slugOrKey);
+			toDelete = keys;
+		}
+		if (toDelete.length === 0) {
+			console.error(chalk.red("Pass at least one KEY."));
+			process.exit(1);
+		}
+		const client = createMistClient();
+		for (const key of toDelete) {
+			await deleteEnvVar(client, slug, key);
+			console.log(`${chalk.red("deleted")}  ${key}`);
+		}
+	});
+});
+//#endregion
+//#region src/commands/env/pull.ts
+/**
+* `fluid mist env pull` — writes `.env.local` with user-managed vars only.
+* Skips `managed_by: "mist"` entries (DATABASE_URL, FLUID_*) since local
+* dev uses PGlite, not the production database. Spec §4 + §5.
+*/
+function escapeValue(v) {
+	if (/[\s#"']/.test(v)) return `"${v.replace(/(["\\$`])/g, "\\$1")}"`;
+	return v;
+}
+const envPullCommand = new Command("pull").description("Write user-managed env vars to .env.local in the CWD").argument("[slug]", "The mist slug (defaults to .mist file in CWD)").option("--out <path>", "Output path (default: .env.local)").action((slug, opts) => runAction(async () => {
+	const resolved = resolveSlug(slug);
+	const { env_vars } = await listEnvVars(createMistClient(), resolved);
+	const user = env_vars.filter((v) => v.managed_by === "user");
+	const skipped = env_vars.filter((v) => v.managed_by === "mist");
+	const target = join(process.cwd(), opts.out ?? ".env.local");
+	const body = user.map((v) => `${v.key}=${escapeValue(v.value)}`).join("\n");
+	writeFileSync(target, body + (body.length ? "\n" : ""), "utf8");
+	console.log(chalk.green(`Wrote ${user.length} var(s) to ${target.replace(process.cwd() + "/", "")}.`));
+	if (skipped.length > 0) console.log(chalk.dim(`Skipped ${skipped.length} Mist-managed var(s): ${skipped.map((v) => v.key).join(", ")} (local dev uses PGlite)`));
+}));
+//#endregion
+//#region src/commands/env/index.ts
+/** `fluid mist env` — sub-command aggregator. */
+const envCommand = new Command("env").description("Manage a mist's environment variables").addCommand(envListCommand).addCommand(envSetCommand).addCommand(envUnsetCommand).addCommand(envPullCommand);
+//#endregion
+//#region src/index.ts
+/**
+* @fluid-app/fluid-cli-mist
+*
+* Fluid CLI plugin for managing Mist hosted extensions. Auto-discovered
+* by @fluid-app/fluid-cli via the `fluid-cli-*` naming convention.
+*
+* Source of truth for command surface + behavior:
+*   fluid (sibling repo) features/mist/cli-spec.md
+*/
+const plugin = {
+	name: "fluid-cli-mist",
+	version: "0.1.0",
+	async register(ctx) {
+		const mist = new Command("mist").description("Create, manage, and deploy Mist hosted extensions");
+		mist.addCommand(listCommand);
+		mist.addCommand(showCommand);
+		mist.addCommand(createCommand);
+		mist.addCommand(updateCommand);
+		mist.addCommand(deleteCommand);
+		mist.addCommand(restoreCommand);
+		mist.addCommand(cloneCommand);
+		mist.addCommand(pushCommand);
+		mist.addCommand(pullCommand);
+		mist.addCommand(openCommand);
+		mist.addCommand(deploymentsCommand);
+		mist.addCommand(logsCommand);
+		mist.addCommand(envCommand);
+		ctx.program.addCommand(mist);
+	}
+};
+//#endregion
+export { plugin as default };
+
+//# sourceMappingURL=index.mjs.map