@fluid-app/fluid-cli-mist 0.1.30 → 0.1.32

package/dist/index.mjs

@@ -1,13 +1,14 @@
-import { Command } from "commander";
+import { Command, InvalidArgumentError, Option } from "commander";
 import chalk from "chalk";
-import { getAuthToken, gitSyncActorFromMe, gitSyncCommitSubject, parseNameStatusZ, resolveGitSyncActor, summarizeChanges } from "@fluid-app/fluid-cli";
-import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { getAuthToken, getConfigDir, gitSyncActorFromMe, gitSyncCommitSubject, parseNameStatusZ, resolveGitSyncActor, summarizeChanges } from "@fluid-app/fluid-cli";
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import path, { join, resolve } from "node:path";
 import os from "node:os";
 import { execa } from "execa";
 import ora from "ora";
 import prompts from "prompts";
 import open from "open";
+import { randomUUID } from "node:crypto";
 //#region src/api/client.ts
 /**
 * Generic fetch wrapper for the Mist Rails API.
@@ -815,6 +816,9 @@ function writeMistFile(dir, mist) {
 	};
 	writeFileSync(join(dir, MIST_FILE), JSON.stringify(payload, null, 2) + "\n", "utf8");
 }
+function readMistFileFrom(dir = process.cwd()) {
+	return readMistFile(dir);
+}
 //#endregion
 //#region src/lib/error-handler.ts
 /**
@@ -1192,6 +1196,9 @@ function buildDropletCreateInput(opts) {
 function createDroplet(client, body) {
 	return client.post(BASE$3, body);
 }
+function getDroplet(client, uuid) {
+	return client.get(`${BASE$3}/${encodeURIComponent(uuid)}`);
+}
 /** Page size + runaway guard for walking the page-paginated droplets list. */
 const PER_PAGE$1 = 100;
 const MAX_PAGES$1 = 25;
@@ -1391,7 +1398,7 @@ const DEFAULT_TIMING = {
 	envTimeoutMs: 12e4,
 	envIntervalMs: 5e3
 };
-const defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+const defaultSleep$1 = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 const KIND_LABEL$1 = {
 	droplet: "droplet",
 	"drop-zone": "drop zone",
@@ -1407,7 +1414,7 @@ async function provisionSurface(client, options) {
 		...DEFAULT_TIMING,
 		...options.timing
 	};
-	const sleep = options.sleep ?? defaultSleep;
+	const sleep = options.sleep ?? defaultSleep$1;
 	const label = KIND_LABEL$1[kind];
 	reporter.start("Resolving mist…");
 	const mist = (await showMist(client, slugOrId)).mist;
@@ -2358,6 +2365,7 @@ const logsCommand = new Command("logs").description("Fetch deployment logs (use
 	if (opts.json && !opts.tail) return printJson(initial);
 	for (const entry of initial.logs) printLine(entry);
 	if (!opts.tail) return;
+	process.stdout.write(`${chalk.dim(`Streaming production logs for ${resolved}${initial.deployment_id ? ` (deployment ${initial.deployment_id})` : ""} — waiting for new entries…`)}\n`);
 	let since = initial.logs.length > 0 ? initial.logs[initial.logs.length - 1].timestamp : (/* @__PURE__ */ new Date()).toISOString();
 	while (true) {
 		await sleep(POLL_MS);
@@ -2456,11 +2464,43 @@ const envListCommand = new Command("list").description("List a mist's env vars")
 	])]);
 }));
 //#endregion
+//#region ../../mist/core/src/secret-generator.ts
+const MIN_BYTES = 16;
+const MAX_BYTES = 128;
+const DEFAULT_BYTES = 32;
+/** Return a random secret. Pure + synchronous so it's trivially
+*  testable (entropy + encoding + clamping) without any I/O. */
+function generateSecret(options = {}) {
+	const encoding = options.encoding ?? "base64url";
+	const requested = options.bytes ?? DEFAULT_BYTES;
+	const bytes = Math.min(MAX_BYTES, Math.max(MIN_BYTES, Math.trunc(requested)));
+	const buf = new Uint8Array(bytes);
+	globalThis.crypto.getRandomValues(buf);
+	return {
+		secret: encode(buf, encoding),
+		bytes,
+		encoding
+	};
+}
+function encode(buf, encoding) {
+	if (encoding === "hex") return Array.from(buf, (byte) => byte.toString(16).padStart(2, "0")).join("");
+	const base64 = btoa(String.fromCharCode(...buf));
+	if (encoding === "base64") return base64;
+	return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+//#endregion
 //#region src/commands/env/set.ts
 /**
 * `fluid mist env set <slug> KEY=value [KEY=value ...]` — POST for new
 * keys, PATCH for existing. Spec §3 + §4.
+*
+* `fluid mist env set [slug] KEY --generate [--bytes N]` mints a random
+* secret for KEY instead (the generator Mist's `set_mist_env_var` uses),
+* writes it, and prints it exactly once.
 */
+/** Env var name rule enforced by Rails (mirrors Mist's ENV_KEY_RE). */
+const ENV_KEY_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+const GENERATED_SECRET_NOTICE = "This secret is shown once and won't be shown again; Fluid stores it encrypted. Copy it now if you also need it in .env.local. Redeploy (fluid mist push) for the change to take effect.";
 function parsePair(pair) {
 	const eq = pair.indexOf("=");
 	if (eq <= 0) throw new Error(`Invalid pair "${pair}". Use KEY=value (no leading spaces).`);
@@ -2469,8 +2509,42 @@ function parsePair(pair) {
 		value: pair.slice(eq + 1)
 	};
 }
-const envSetCommand = new Command("set").description("Set one or more env vars (KEY=value KEY=value …)").argument("<slug-or-pair>", "The mist slug, or the first KEY=value pair").argument("[pairs...]", "Additional KEY=value pairs").action(async (slugOrPair, pairs) => {
+function parseBytes(value) {
+	const bytes = Number(value);
+	if (!Number.isInteger(bytes) || bytes < 16 || bytes > 128) throw new InvalidArgumentError("Use a whole number from 16 to 128.");
+	return bytes;
+}
+/**
+* Generate a secret for `key` and write it to the Mist. Refuses invalid
+* and Mist-managed keys BEFORE generating, so a secret is only ever
+* returned once it has been stored.
+*/
+async function setGeneratedEnvVar(client, slug, key, bytes) {
+	if (!ENV_KEY_RE.test(key)) throw new Error(`Invalid env var name "${key}". Use letters, digits and underscores, not starting with a digit.`);
+	const current = ((await listEnvVars(client, slug)).env_vars ?? []).find((v) => v.key === key);
+	if (current?.managed_by === "mist") throw new Error(`"${key}" is managed by Fluid and can't be set; it is provisioned automatically for the Mist.`);
+	const secret = generateSecret(bytes === void 0 ? {} : { bytes });
+	if (current) await updateEnvVar(client, slug, key, secret.secret);
+	else await createEnvVar(client, slug, key, secret.secret);
+	return {
+		key,
+		action: current ? "updated" : "created",
+		generatedSecret: secret.secret,
+		bytes: secret.bytes,
+		encoding: secret.encoding,
+		note: GENERATED_SECRET_NOTICE
+	};
+}
+const envSetCommand = new Command("set").description("Set one or more env vars (KEY=value KEY=value …), or generate a secret for KEY with --generate").argument("<slug-or-pair>", "The mist slug, or the first KEY=value pair (or KEY with --generate)").argument("[pairs...]", "Additional KEY=value pairs (or KEY with --generate)").option("--generate", "Generate a random secret as the value of one KEY and print it once").option("--bytes <n>", "Entropy for --generate, in bytes (16-128, default 32)", parseBytes).option("--json", "Emit JSON (with --generate)").action(async (slugOrPair, pairs, opts) => {
 	await runAction(async () => {
+		if (opts.generate) {
+			await runGenerate([slugOrPair, ...pairs], opts);
+			return;
+		}
+		if (opts.bytes !== void 0) {
+			console.error(chalk.red("--bytes only applies with --generate."));
+			process.exit(1);
+		}
 		let slug;
 		let rawPairs;
 		if (slugOrPair.includes("=")) {
@@ -2499,6 +2573,31 @@ const envSetCommand = new Command("set").description("Set one or more env vars (
 		}
 	});
 });
+/** `env set [slug] KEY --generate`: exactly one KEY, without a value. */
+async function runGenerate(args, opts) {
+	if (args.length > 2) {
+		console.error(chalk.red("--generate sets one key at a time: env set [slug] KEY --generate"));
+		process.exit(1);
+	}
+	const [first, second] = args;
+	const key = (second ?? first ?? "").trim();
+	if (key.includes("=")) {
+		console.error(chalk.red(`--generate creates the value itself; pass the key alone (e.g. ${key.split("=")[0]}).`));
+		process.exit(1);
+	}
+	const slug = second === void 0 ? resolveSlug() : resolveSlug(first);
+	const result = await setGeneratedEnvVar(createMistClient(), slug, key, opts.bytes);
+	if (opts.json) {
+		printJson(result);
+		return;
+	}
+	const verb = result.action === "updated" ? chalk.green("updated") : chalk.cyan("created");
+	console.log(`${verb}  ${result.key}  (${result.bytes}-byte generated secret)`);
+	console.log();
+	console.log(result.generatedSecret);
+	console.log();
+	console.log(chalk.yellow(result.note));
+}
 //#endregion
 //#region src/commands/env/unset.ts
 /** `fluid mist env unset <slug> KEY [KEY ...]` — DELETE per key. Spec §3. */
@@ -2609,6 +2708,933 @@ const envPullCommand = new Command("pull").description("Write user-managed env v
 /** `fluid mist env` — sub-command aggregator. */
 const envCommand = new Command("env").description("Manage a mist's environment variables").addCommand(envListCommand).addCommand(envSetCommand).addCommand(envUnsetCommand).addCommand(envPullCommand);
 //#endregion
+//#region ../../mist/core/src/droplet-lifecycle-repair.ts
+const DEFAULT_DROPLET_LIFECYCLE_PATHS = Object.freeze({
+	installPath: "/api/webhooks/installed",
+	uninstallPath: "/api/webhooks/uninstalled"
+});
+/** The note every repair summary carries: the repair fixes future delivery,
+*  it does not replay `droplet.installed` for an existing installation. */
+const LIFECYCLE_REPAIR_NOTE = "This repairs future Droplet install/uninstall lifecycle delivery. It does not replay droplet.installed for an already-installed Droplet.";
+/** Strip trailing slashes; null for an absent or empty value. */
+function normalizePublicUrl(value) {
+	if (!value) return null;
+	return value.replace(/\/+$/, "");
+}
+/** A blank or missing path falls back; a relative one gains a leading `/`. */
+function normalizeWebhookPath(value, fallback) {
+	if (typeof value !== "string") return fallback;
+	const trimmed = value.trim();
+	if (!trimmed) return fallback;
+	return trimmed.startsWith("/") ? trimmed : `/${trimmed}`;
+}
+/**
+* Lifecycle paths from a parsed `fluid.capabilities.json`
+* (`dropletLifecycle.installPath` / `uninstallPath`). Anything that is not
+* the expected shape yields the defaults.
+*/
+function dropletLifecyclePathsFromCapabilities(capabilities) {
+	if (!isRecord$1(capabilities)) return { ...DEFAULT_DROPLET_LIFECYCLE_PATHS };
+	const lifecycle = capabilities["dropletLifecycle"];
+	const source = isRecord$1(lifecycle) ? lifecycle : {};
+	return {
+		installPath: normalizeWebhookPath(source["installPath"], DEFAULT_DROPLET_LIFECYCLE_PATHS.installPath),
+		uninstallPath: normalizeWebhookPath(source["uninstallPath"], DEFAULT_DROPLET_LIFECYCLE_PATHS.uninstallPath)
+	};
+}
+/** The canonical Droplet URLs for a Mist served at `publicUrl`. */
+function canonicalDropletUrls(publicUrl, paths = DEFAULT_DROPLET_LIFECYCLE_PATHS) {
+	const embedUrl = normalizePublicUrl(publicUrl);
+	if (!embedUrl) throw new Error("publicUrl is required");
+	return {
+		embedUrl,
+		installWebhookUrl: `${embedUrl}${paths.installPath}`,
+		uninstallWebhookUrl: `${embedUrl}${paths.uninstallPath}`
+	};
+}
+/** Exact match on all three fields — the repair's no-op condition and its
+*  post-PATCH verification. */
+function dropletUrlsMatch(droplet, canonical) {
+	return droplet?.embed_url === canonical.embedUrl && droplet.install_webhook_url === canonical.installWebhookUrl && droplet.uninstall_webhook_url === canonical.uninstallWebhookUrl;
+}
+/** The `PATCH /api/droplets/:uuid` body. Only these three fields change. */
+function dropletRepairPatch(canonical) {
+	return { droplet: {
+		embed_url: canonical.embedUrl,
+		install_webhook_url: canonical.installWebhookUrl,
+		uninstall_webhook_url: canonical.uninstallWebhookUrl
+	} };
+}
+/**
+* The repair summary before any mutation. `alreadyCorrect` means the caller
+* must not PATCH; otherwise a dry run reports "planned" and a live run
+* reports "updated" (callers overwrite it after verification).
+*/
+function planLifecycleRepair(input) {
+	const alreadyCorrect = dropletUrlsMatch(input.current, input.canonical);
+	return {
+		alreadyCorrect,
+		summary: {
+			status: alreadyCorrect ? "unchanged" : input.dryRun ? "planned" : "updated",
+			mistId: input.mistId,
+			mistSlug: input.mistSlug,
+			dropletUuid: input.dropletUuid,
+			embedUrl: input.canonical.embedUrl,
+			installWebhookUrl: input.canonical.installWebhookUrl,
+			uninstallWebhookUrl: input.canonical.uninstallWebhookUrl,
+			previous: {
+				embedUrl: input.current?.embed_url ?? null,
+				installWebhookUrl: input.current?.install_webhook_url ?? null,
+				uninstallWebhookUrl: input.current?.uninstall_webhook_url ?? null
+			},
+			note: LIFECYCLE_REPAIR_NOTE
+		}
+	};
+}
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//#endregion
+//#region ../../mist/core/src/lifecycle-types.ts
+const lifecycleOperationStates = [
+	"queued",
+	"running",
+	"succeeded",
+	"failed",
+	"requires_action"
+];
+const lifecycleOperationKinds = ["replacement"];
+const connectionStates = [
+	"pending",
+	"connected",
+	"degraded",
+	"requires_action"
+];
+function isTerminalOperation(operation) {
+	return operation.state === "succeeded" || operation.state === "failed" || operation.state === "requires_action";
+}
+//#endregion
+//#region ../../mist/core/src/recovery-classification.ts
+function classifyLifecycleRecovery(result) {
+	if (result.status === "not_found") return {
+		status: "requires_action",
+		action: "rediscover_operation"
+	};
+	if (result.status === "timed_out") return {
+		status: "retryable",
+		action: "resume_status_polling"
+	};
+	return classifyTerminalOperation(result.operation);
+}
+function classifyTerminalOperation(operation) {
+	if (operation.state === "succeeded") return {
+		status: "complete",
+		action: null
+	};
+	if (operation.state === "failed") return {
+		status: "failed",
+		action: operation.recovery_action ?? "verify_lifecycle_destination"
+	};
+	return {
+		status: "requires_action",
+		action: operation.recovery_action ?? "reconcile_lifecycle"
+	};
+}
+const REPLACEMENT_IDEMPOTENCY_SCOPE = "single replacement attempt; a later approved retry receives a new key";
+const REPLACEMENT_OWNERSHIP_NOTE = "Fluid owns revocation, uninstall delivery, terminalization, replacement creation, and retry recovery as one durable operation.";
+function replacementOperationsPath(mistId, installationUuid) {
+	return `/api/v202604/mists/${encodeURIComponent(mistId)}/droplet_installations/${encodeURIComponent(installationUuid)}/replacement_operations`;
+}
+function replacementOperationStatusPath(mistId, installationUuid, operationId) {
+	return `${replacementOperationsPath(mistId, installationUuid)}/${encodeURIComponent(operationId)}`;
+}
+/** The operation id a 409 "active_operation_exists" response points at. */
+function parseActiveOperationId(value) {
+	if (!isRecord(value)) return null;
+	const error = value["error"];
+	if (!isRecord(error)) return null;
+	const details = error["details"];
+	if (!isRecord(details)) return null;
+	const operationId = details["operation_id"];
+	return typeof operationId === "string" ? operationId : null;
+}
+/** Seconds from a `Retry-After` header; undefined when absent or invalid. */
+function parseRetryAfterHeader(value) {
+	if (!value) return void 0;
+	const seconds = Number(value);
+	return Number.isFinite(seconds) && seconds >= 0 ? seconds : void 0;
+}
+/** Parse and validate `{ replacement_operation: {...} }`. Throws on a
+*  malformed body rather than trusting a partial operation. */
+function parseReplacementOperation(value) {
+	const key = "replacement_operation";
+	if (!isRecord(value)) throw new Error("Lifecycle response must be an object");
+	const candidate = value[key];
+	if (!isRecord(candidate)) throw new Error(`Lifecycle response is missing ${key}`);
+	const id = candidate["id"];
+	const kind = candidate["kind"];
+	const state = candidate["state"];
+	const stage = candidate["stage"];
+	const mistId = candidate["mist_id"];
+	const createdAt = candidate["created_at"];
+	const updatedAt = candidate["updated_at"];
+	if (typeof id !== "string" || !isLifecycleOperationKind(kind) || !isLifecycleOperationState(state) || typeof stage !== "string" || typeof mistId !== "string" || typeof createdAt !== "string" || typeof updatedAt !== "string") throw new Error("Lifecycle operation response is malformed");
+	const dropletUuid = candidate["droplet_uuid"];
+	const installationUuid = candidate["installation_uuid"];
+	const connectionState = candidate["connection_state"];
+	const errorCode = candidate["error_code"];
+	const recoveryAction = candidate["recovery_action"];
+	const terminalAt = candidate["terminal_at"];
+	const retryAfterSeconds = candidate["retry_after_seconds"];
+	if (!isOptionalNullableString(dropletUuid) || !isOptionalNullableString(installationUuid) || !isOptionalConnectionState(connectionState) || !isOptionalNullableString(errorCode) || !isOptionalNullableString(recoveryAction) || !isOptionalNullableString(terminalAt) || !isOptionalNullableNumber(retryAfterSeconds)) throw new Error("Lifecycle operation response has malformed optional fields");
+	return {
+		id,
+		kind,
+		state,
+		stage,
+		mist_id: mistId,
+		created_at: createdAt,
+		updated_at: updatedAt,
+		...dropletUuid !== void 0 ? { droplet_uuid: dropletUuid } : {},
+		...installationUuid !== void 0 ? { installation_uuid: installationUuid } : {},
+		...connectionState !== void 0 ? { connection_state: connectionState } : {},
+		...errorCode !== void 0 ? { error_code: errorCode } : {},
+		...recoveryAction !== void 0 ? { recovery_action: recoveryAction } : {},
+		...terminalAt !== void 0 ? { terminal_at: terminalAt } : {},
+		...retryAfterSeconds !== void 0 ? { retry_after_seconds: retryAfterSeconds } : {}
+	};
+}
+/**
+* Guard the request before any network call. A resume must name the
+* installation it started on: status is scoped to the SOURCE installation,
+* the backend terminalizes that source mid-flight, and polling whichever
+* installation is attached now would report a false "not_found".
+*/
+function checkReplacementRequest(args) {
+	const resumeOperationId = args.resumeOperationId?.trim() || null;
+	if (resumeOperationId && !args.installationUuid) return {
+		ok: false,
+		code: "resume_requires_installation"
+	};
+	return {
+		ok: true,
+		resumeOperationId
+	};
+}
+/** Starting a new replacement needs explicit confirmation; resuming only
+*  reads an operation the user already approved. */
+function replacementStartNeedsConfirmation(args, resumeOperationId) {
+	return !resumeOperationId && args.confirmDestructiveReinstall !== true;
+}
+/**
+* The installation to replace. An explicitly named `installationUuid`
+* always wins: it is the recovery path for a source that a failed attempt
+* already terminalized (which may sit beside a newer active installation
+* of the same Droplet), and a resume must watch the installation its
+* operation started on, never a rediscovered one. Without a name, the
+* company's active installation of the attached Droplet is used.
+*/
+function selectReplacementInstallation(input) {
+	if (input.installationUuid) return input.installations.find((candidate) => candidate.uuid === input.installationUuid && candidate.droplet_uuid === input.dropletUuid) ?? {
+		uuid: input.installationUuid,
+		droplet_uuid: input.dropletUuid
+	};
+	if (input.resumeOperationId) return void 0;
+	return input.installations.find((candidate) => candidate.droplet_uuid === input.dropletUuid);
+}
+function buildReplacementPlan(input) {
+	const { installation } = input;
+	return {
+		status: input.dryRun ? "planned" : input.resumeOperationId ? "watching" : "pending",
+		mistId: input.mistId,
+		dropletUuid: input.dropletUuid,
+		installationUuid: installation.uuid,
+		lifecycleRepair: input.lifecycleRepair,
+		replacementPath: replacementOperationsPath(input.mistId, installation.uuid),
+		idempotencyKey: input.resumeOperationId ? null : input.idempotencyKey,
+		idempotencyScope: REPLACEMENT_IDEMPOTENCY_SCOPE,
+		irreversible: true,
+		preservedByBackend: {
+			scopes: Array.isArray(installation.scopes),
+			role_id: typeof installation.role_id === "string" || typeof installation.role_id === "number"
+		},
+		note: REPLACEMENT_OWNERSHIP_NOTE
+	};
+}
+/**
+* The final result of one watch. A timed-out poll is this caller's watch
+* budget expiring, NOT the backend giving up: it reports "still_running"
+* with the ids needed to resume, and is not an error. Only "succeeded" is
+* complete.
+*/
+function summarizeReplacementWatch(input) {
+	const { pollResult, startedOperation } = input;
+	const recovery = classifyLifecycleRecovery(pollResult);
+	const stillRunning = pollResult.status === "timed_out";
+	const latestOperation = pollResult.status === "terminal" ? pollResult.operation : pollResult.status === "timed_out" ? pollResult.operation ?? startedOperation : startedOperation;
+	return {
+		result: {
+			...input.plan,
+			status: pollResult.status === "terminal" ? pollResult.operation.state : stillRunning ? "still_running" : pollResult.status,
+			replacementOperation: latestOperation,
+			recovery,
+			...stillRunning ? {
+				watchedForMs: input.watchedForMs,
+				resumeOperationId: input.operationId,
+				nextStep: input.nextStep({
+					operationId: input.operationId,
+					installationUuid: input.installationUuid,
+					stage: latestOperation?.stage ?? "unknown"
+				})
+			} : {}
+		},
+		isError: !stillRunning && recovery.status !== "complete"
+	};
+}
+function isLifecycleOperationKind(value) {
+	return lifecycleOperationKinds.some((candidate) => candidate === value);
+}
+function isLifecycleOperationState(value) {
+	return lifecycleOperationStates.some((candidate) => candidate === value);
+}
+function isOptionalNullableString(value) {
+	return value === void 0 || value === null || typeof value === "string";
+}
+function isOptionalNullableNumber(value) {
+	return value === void 0 || value === null || typeof value === "number";
+}
+function isOptionalConnectionState(value) {
+	return value === void 0 || value === null || connectionStates.some((candidate) => candidate === value);
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//#endregion
+//#region ../../mist/core/src/operation-polling.ts
+async function pollLifecycleOperation({ fetchStatus, timeoutMs = 1800 * 1e3, minimumIntervalMs = 2e3, sleep: sleepOverride, now = Date.now, abortSignal }) {
+	const sleep = sleepOverride ?? ((durationMs) => defaultSleep(durationMs, abortSignal));
+	const startedAt = now();
+	let latestOperation;
+	while (now() - startedAt < timeoutMs) {
+		abortSignal?.throwIfAborted();
+		const response = await fetchStatus();
+		abortSignal?.throwIfAborted();
+		if (response.status === 404) return { status: "not_found" };
+		const transientServerError = response.status >= 500 && response.status < 600;
+		if (response.status !== 200 && response.status !== 429 && !transientServerError) throw new Error(`Lifecycle status request failed with HTTP ${response.status}`);
+		if (response.operation) {
+			latestOperation = response.operation;
+			if (isTerminalOperation(response.operation)) return {
+				status: "terminal",
+				operation: response.operation
+			};
+		}
+		const retryAfterMs = Math.max(minimumIntervalMs, (response.retryAfterSeconds ?? response.operation?.retry_after_seconds ?? 0) * 1e3);
+		await sleep(Math.min(retryAfterMs, Math.max(0, timeoutMs - (now() - startedAt))));
+		abortSignal?.throwIfAborted();
+	}
+	return latestOperation ? {
+		status: "timed_out",
+		operation: latestOperation
+	} : { status: "timed_out" };
+}
+function defaultSleep(durationMs, abortSignal) {
+	return new Promise((resolve, reject) => {
+		const onAbort = () => {
+			clearTimeout(timer);
+			reject(abortSignal?.reason);
+		};
+		const timer = setTimeout(() => {
+			abortSignal?.removeEventListener("abort", onAbort);
+			resolve();
+		}, durationMs);
+		abortSignal?.addEventListener("abort", onAbort, { once: true });
+	});
+}
+//#endregion
+//#region src/api/droplet_replacements.ts
+async function startDropletReplacement(client, input) {
+	const response = await send(client, replacementOperationsPath(input.mistId, input.installationUuid), {
+		method: "POST",
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify({ idempotency_key: input.idempotencyKey })
+	});
+	const body = await readJson(response);
+	if (response.ok) return parseReplacementOperation(body);
+	const activeOperationId = response.status === 409 ? parseActiveOperationId(body) : null;
+	if (activeOperationId) return fetchDropletReplacement(client, {
+		mistId: input.mistId,
+		installationUuid: input.installationUuid,
+		operationId: activeOperationId
+	});
+	const retryAfterSeconds = parseRetryAfterHeader(response.headers.get("Retry-After"));
+	const retryHint = retryAfterSeconds === void 0 ? "" : `; retry after ${retryAfterSeconds}s`;
+	throw new MistApiError(`Droplet replacement start failed with HTTP ${response.status}${retryHint}`, response.status);
+}
+async function fetchDropletReplacement(client, input) {
+	const response = await send(client, replacementOperationStatusPath(input.mistId, input.installationUuid, input.operationId), { method: "GET" });
+	if (!response.ok) throw new MistApiError(`Active replacement status failed with HTTP ${response.status}`, response.status);
+	return parseReplacementOperation(await readJson(response));
+}
+/** Poll an operation until it is terminal, gone, or `timeoutMs` elapses. */
+function pollDropletReplacement(client, input) {
+	const statusPath = replacementOperationStatusPath(input.mistId, input.installationUuid, input.operationId);
+	return pollLifecycleOperation({
+		timeoutMs: input.timeoutMs,
+		...input.sleep ? { sleep: input.sleep } : {},
+		fetchStatus: async () => {
+			const response = await send(client, statusPath, { method: "GET" });
+			const retryAfterSeconds = parseRetryAfterHeader(response.headers.get("Retry-After"));
+			if (response.status === 404 || response.status === 429) return {
+				status: response.status,
+				retryAfterSeconds
+			};
+			if (!response.ok) return { status: response.status };
+			return {
+				status: response.status,
+				operation: parseReplacementOperation(await readJson(response)),
+				retryAfterSeconds
+			};
+		}
+	});
+}
+async function send(client, path, init) {
+	try {
+		return await client.request(path, init);
+	} catch (err) {
+		throw new MistApiError(`Network error: ${err instanceof Error ? err.message : String(err)}`, 0);
+	}
+}
+async function readJson(response) {
+	const text = await response.text();
+	if (!text) return null;
+	try {
+		return JSON.parse(text);
+	} catch {
+		return null;
+	}
+}
+//#endregion
+//#region src/lib/reinstall-plan-store.ts
+/**
+* Plan receipts for `fluid mist droplet reinstall`.
+*
+* Mist Desktop's agent must show a dry-run plan and get explicit approval
+* before it may confirm the irreversible replacement. A CLI has no
+* conversation to hold that sequence, so `--dry-run` records a receipt of
+* the exact Droplet, installation and lifecycle URLs it showed, and
+* `--confirm` refuses unless a receipt for the same plan is younger than
+* {@link REINSTALL_PLAN_TTL_MS}. `--confirm` claims the receipt atomically
+* (a rename only one process can win) before checking it, so one plan
+* approves at most one attempt and every retry needs a fresh plan.
+*
+* Receipts live under the Fluid config dir (`~/.fluid/mist/reinstall-plans`)
+* and hold only ids and a timestamp — no tokens or secrets.
+*/
+/** How long a shown plan stays valid for `--confirm`. */
+const REINSTALL_PLAN_TTL_MS = 900 * 1e3;
+function createFileReinstallPlanStore(dir = join(getConfigDir(), "mist", "reinstall-plans")) {
+	const fileFor = (mistId) => join(dir, `${encodeURIComponent(mistId)}.json`);
+	return {
+		save(receipt) {
+			mkdirSync(dir, {
+				recursive: true,
+				mode: 448
+			});
+			writeFileSync(fileFor(receipt.mistId), JSON.stringify(receipt, null, 2) + "\n", {
+				encoding: "utf8",
+				mode: 384
+			});
+		},
+		load(mistId) {
+			try {
+				const parsed = JSON.parse(readFileSync(fileFor(mistId), "utf8"));
+				return isReceipt(parsed) && parsed.mistId === mistId ? parsed : null;
+			} catch {
+				return null;
+			}
+		},
+		claim(mistId) {
+			const claimed = `${fileFor(mistId)}.claimed-${process.pid}-${randomUUID()}`;
+			try {
+				renameSync(fileFor(mistId), claimed);
+			} catch {
+				return null;
+			}
+			try {
+				const parsed = JSON.parse(readFileSync(claimed, "utf8"));
+				return isReceipt(parsed) && parsed.mistId === mistId ? parsed : null;
+			} catch {
+				return null;
+			} finally {
+				rmSync(claimed, { force: true });
+			}
+		}
+	};
+}
+/** Whether `receipt` approves executing the freshly computed plan. */
+function checkPlanReceipt(receipt, fresh, now) {
+	if (!receipt) return {
+		ok: false,
+		code: "plan_required"
+	};
+	const plannedAt = Date.parse(receipt.plannedAt);
+	if (!Number.isFinite(plannedAt) || now - plannedAt > 9e5) return {
+		ok: false,
+		code: "plan_stale"
+	};
+	if (plannedAt > now) return {
+		ok: false,
+		code: "plan_stale"
+	};
+	if (receipt.dropletUuid !== fresh.dropletUuid || receipt.installationUuid !== fresh.installationUuid || receipt.embedUrl !== fresh.embedUrl || receipt.installWebhookUrl !== fresh.installWebhookUrl || receipt.uninstallWebhookUrl !== fresh.uninstallWebhookUrl) return {
+		ok: false,
+		code: "plan_changed"
+	};
+	return { ok: true };
+}
+function isReceipt(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const record = value;
+	return typeof record["mistId"] === "string" && typeof record["dropletUuid"] === "string" && typeof record["installationUuid"] === "string" && typeof record["embedUrl"] === "string" && typeof record["installWebhookUrl"] === "string" && typeof record["uninstallWebhookUrl"] === "string" && typeof record["plannedAt"] === "string";
+}
+//#endregion
+//#region src/lib/droplet-repair.ts
+/**
+* Orchestration for `fluid mist droplet repair` and
+* `fluid mist droplet reinstall`, ported from Mist Desktop's
+* `repair_droplet_lifecycle_webhooks` and `repair_and_reinstall_droplet`
+* tools (`apps/mist-desktop/src/main/tools/index.ts` in the fluid repo).
+*
+* The planning and safety rules are shared through `@fluid-app/mist-core`
+* (`droplet-lifecycle-repair`, `droplet-replacement`); this module only
+* wires them to the CLI's API client, the `.mist` marker and the plan
+* receipt store. Every function takes its client and collaborators as
+* arguments so tests drive it with fakes.
+*/
+/** A refusal: the command stops before (or instead of) mutating anything
+*  and exits non-zero. `code` is stable for scripts. */
+var DropletRepairRefusal = class extends Error {
+	code;
+	constructor(code, message) {
+		super(message);
+		this.name = "DropletRepairRefusal";
+		this.code = code;
+	}
+};
+/**
+* Resolve the Mist (slug argument or the `.mist` in `cwd`), its public URL,
+* the Droplet it is attached to, and the canonical Droplet URLs. Refuses
+* when the Mist has no public URL or no attached Droplet.
+*/
+async function resolveRepairTarget(client, input) {
+	const slug = resolveSlug(input.slug, input.cwd);
+	const marker = readMistFileFrom(input.cwd);
+	const isCwdProject = marker !== null && marker.slug === slug;
+	const mistId = await resolveMistId(client, slug);
+	const { mist } = await showMist(client, mistId);
+	const publicUrl = normalizePublicUrl(mist.public_url);
+	if (!publicUrl) throw new DropletRepairRefusal("no_public_url", "Mist has no public_url yet. Publish the Mist first (`fluid mist push`), then repair lifecycle webhooks.");
+	const dropletUuid = await resolveAttachedDropletUuid(client, mist, mistId, publicUrl);
+	const paths = isCwdProject ? readLifecyclePaths(input.cwd) : null;
+	return {
+		mistId,
+		mistSlug: mist.slug ?? slug,
+		dropletUuid,
+		canonical: canonicalDropletUrls(publicUrl, paths ?? DEFAULT_DROPLET_LIFECYCLE_PATHS),
+		lifecyclePathsSource: paths ? "fluid.capabilities.json" : "defaults"
+	};
+}
+/**
+* The Mist's own Droplet. The server-owned link wins (the Mist record, then
+* its droplet integration point); matching `embed_url` is only a legacy
+* fallback, because a broken embed URL is exactly what the repair fixes.
+*/
+async function resolveAttachedDropletUuid(client, mist, mistId, publicUrl) {
+	if (typeof mist.droplet?.uuid === "string" && mist.droplet.uuid.length > 0) return mist.droplet.uuid;
+	try {
+		const { integration_points } = await listIntegrationPoints(client, mistId);
+		const attached = findDropletIntegrationPoint(integration_points);
+		if (attached?.integratable_uuid) return attached.integratable_uuid;
+		if (attached?.integratable_id != null) {
+			const uuid = await findDropletUuidByNumericId(client, attached.integratable_id);
+			if (uuid) return uuid;
+		}
+	} catch (err) {
+		if (err instanceof MistApiError && err.status === 0) throw err;
+	}
+	const byEmbedUrl = await findDropletByEmbedUrl(client, publicUrl);
+	if (byEmbedUrl) {
+		if (!byEmbedUrl.uuid) throw new DropletRepairRefusal("droplet_not_found", `Droplet with embed_url ${publicUrl} was found, but its API response did not include a uuid.`);
+		return byEmbedUrl.uuid;
+	}
+	throw new DropletRepairRefusal("droplet_not_found", "This Mist is not attached to a Droplet, and no Droplet with a matching embed_url was found. Attach or recreate the Droplet first (`fluid mist attach-droplet`), then retry.");
+}
+/** Lifecycle paths from `fluid.capabilities.json`, or null when absent or
+*  unreadable (the caller then uses the defaults). */
+function readLifecyclePaths(cwd) {
+	const file = join(cwd, "fluid.capabilities.json");
+	if (!existsSync(file)) return null;
+	try {
+		return dropletLifecyclePathsFromCapabilities(JSON.parse(readFileSync(file, "utf8")));
+	} catch {
+		return null;
+	}
+}
+/** Read the Droplet and report the planned repair without mutating. */
+async function planDropletRepair(client, target, dryRun) {
+	const { droplet } = await getDroplet(client, target.dropletUuid);
+	const { alreadyCorrect, summary } = planLifecycleRepair({
+		mistId: target.mistId,
+		mistSlug: target.mistSlug,
+		dropletUuid: target.dropletUuid,
+		canonical: target.canonical,
+		current: droplet,
+		dryRun
+	});
+	return {
+		alreadyCorrect,
+		summary: {
+			...summary,
+			lifecyclePathsSource: target.lifecyclePathsSource
+		}
+	};
+}
+/**
+* PATCH only the embed and lifecycle webhook URLs, then re-read the Droplet
+* to verify. A no-op when they already match.
+*/
+async function applyDropletRepair(client, target) {
+	const planned = await planDropletRepair(client, target, false);
+	if (planned.alreadyCorrect) return {
+		summary: planned.summary,
+		isError: false
+	};
+	await client.patch(`/api/droplets/${encodeURIComponent(target.dropletUuid)}`, dropletRepairPatch(target.canonical));
+	let verifyStatus = 200;
+	let verified = false;
+	try {
+		const { droplet } = await getDroplet(client, target.dropletUuid);
+		verified = dropletUrlsMatch(droplet, target.canonical);
+	} catch (err) {
+		verifyStatus = err instanceof MistApiError ? err.status : 0;
+	}
+	return {
+		summary: {
+			...planned.summary,
+			status: verified ? "updated" : "error",
+			verified,
+			verifyStatus
+		},
+		isError: !verified
+	};
+}
+const PLAN_TTL_MINUTES = REINSTALL_PLAN_TTL_MS / 6e4;
+/**
+* `fluid mist droplet reinstall`. Same sequencing as Mist's
+* `repair_and_reinstall_droplet`: plan first, explicit approval, one
+* backend-owned replacement, resumable watching. Refusals return a
+* non-zero exit code; nothing irreversible starts without `--confirm`
+* matching a fresh `--dry-run` plan.
+*/
+async function runDropletReinstall(deps, opts) {
+	const now = deps.now ?? Date.now;
+	const refusal = (code, message) => ({
+		output: {
+			status: "refused",
+			code,
+			message
+		},
+		exitCode: 1
+	});
+	if (opts.dryRun && opts.confirm) return refusal("conflicting_flags", "Pass either --dry-run (show the plan) or --confirm (execute it), not both.");
+	if (opts.dryRun && opts.resumeOperationId?.trim()) return refusal("conflicting_flags", "--resume keeps watching a replacement that already started; it does not take --dry-run. Run it with --installation only.");
+	const request = {
+		dryRun: opts.dryRun === true,
+		confirmDestructiveReinstall: opts.confirm === true,
+		installationUuid: opts.installationUuid?.trim() || void 0,
+		resumeOperationId: opts.resumeOperationId
+	};
+	const requestCheck = checkReplacementRequest(request);
+	if (!requestCheck.ok) return refusal(requestCheck.code, "--resume also needs --installation with the installationUuid from that same \"still_running\" result. Replacement status is scoped to the installation the operation started on, so resuming without it would watch the wrong one.");
+	const { resumeOperationId } = requestCheck;
+	if (!request.dryRun && replacementStartNeedsConfirmation(request, resumeOperationId)) return refusal("confirmation_required", opts.yes ? "--yes does not approve an irreversible reinstall. Run with --dry-run, review the exact dropletUuid and installationUuid, then rerun with --confirm." : "Refused to start an irreversible replacement without explicit confirmation. Run with --dry-run, review the exact dropletUuid and installationUuid, then rerun with --confirm.");
+	try {
+		const target = await resolveRepairTarget(deps.client, {
+			slug: deps.slug,
+			cwd: deps.cwd
+		});
+		const plannedRepair = await planDropletRepair(deps.client, target, true);
+		const installation = selectReplacementInstallation({
+			installations: await listAllDropletInstallations(deps.client),
+			dropletUuid: target.dropletUuid,
+			installationUuid: request.installationUuid,
+			resumeOperationId
+		});
+		if (!installation?.uuid) return refusal("installation_not_found", `No active installation for attached Droplet ${target.dropletUuid} was found. If a previous approved replacement terminalized the source, rerun with that plan's --installation <uuid>; otherwise install the Droplet once from Fluid first.`);
+		const installationUuid = installation.uuid;
+		const idempotencyKey = deps.newIdempotencyKey();
+		const planInput = {
+			dryRun: request.dryRun,
+			resumeOperationId,
+			mistId: target.mistId,
+			dropletUuid: target.dropletUuid,
+			installation: {
+				...installation,
+				uuid: installationUuid
+			},
+			idempotencyKey
+		};
+		if (request.dryRun) {
+			deps.planStore.save({
+				mistId: target.mistId,
+				dropletUuid: target.dropletUuid,
+				installationUuid,
+				...target.canonical,
+				plannedAt: new Date(now()).toISOString()
+			});
+			const confirmCommand = reinstallCommand(target.mistSlug, ["--confirm", ...request.installationUuid ? ["--installation", installationUuid] : []]);
+			return {
+				output: {
+					...buildReplacementPlan({
+						...planInput,
+						lifecycleRepair: plannedRepair.summary
+					}),
+					nextStep: `Review the dropletUuid and installationUuid above. This replacement is irreversible. To approve it, run \`${confirmCommand}\` within ${PLAN_TTL_MINUTES} minutes.`
+				},
+				exitCode: 0
+			};
+		}
+		let lifecycleRepair = plannedRepair.summary;
+		let startedOperation = null;
+		if (!resumeOperationId) {
+			const receiptCheck = checkPlanReceipt(deps.planStore.claim(target.mistId), {
+				dropletUuid: target.dropletUuid,
+				installationUuid,
+				...target.canonical
+			}, now());
+			if (!receiptCheck.ok) return refusal(receiptCheck.code, planReceiptMessage(receiptCheck.code));
+			const repaired = await applyDropletRepair(deps.client, target);
+			lifecycleRepair = repaired.summary;
+			if (repaired.isError) return {
+				output: {
+					status: "error",
+					code: "lifecycle_repair_failed",
+					message: "The Droplet lifecycle URLs did not verify after the repair, so no replacement was started.",
+					lifecycleRepair
+				},
+				exitCode: 1
+			};
+			startedOperation = await startDropletReplacement(deps.client, {
+				mistId: target.mistId,
+				installationUuid,
+				idempotencyKey
+			});
+		}
+		const plan = buildReplacementPlan({
+			...planInput,
+			lifecycleRepair
+		});
+		const operationId = resumeOperationId ?? startedOperation?.id;
+		if (!operationId) return {
+			output: {
+				...plan,
+				status: "error",
+				code: "missing_operation_id",
+				message: "Fluid accepted the replacement but did not return an operation id to watch."
+			},
+			exitCode: 1
+		};
+		const watchedForMs = opts.watchTimeoutMs ?? 12e4;
+		const watch = summarizeReplacementWatch({
+			plan,
+			pollResult: await pollDropletReplacement(deps.client, {
+				mistId: target.mistId,
+				installationUuid,
+				operationId,
+				timeoutMs: watchedForMs,
+				...deps.sleep ? { sleep: deps.sleep } : {}
+			}),
+			startedOperation,
+			operationId,
+			installationUuid,
+			watchedForMs,
+			nextStep: ({ operationId: id, installationUuid: source, stage }) => `Fluid is still working on this replacement: it is not finished and it did not fail. Current stage: ${stage}. Keep watching with \`${reinstallCommand(target.mistSlug, [
+				"--resume",
+				id,
+				"--installation",
+				source
+			])}\`. The reinstall is complete only when status is "succeeded".`
+		});
+		return {
+			output: { ...watch.result },
+			exitCode: watch.isError ? 1 : 0
+		};
+	} catch (err) {
+		if (err instanceof DropletRepairRefusal) return refusal(err.code, err.message);
+		throw err;
+	}
+}
+function reinstallCommand(slug, flags) {
+	return [
+		"fluid mist droplet reinstall",
+		slug,
+		...flags
+	].join(" ");
+}
+function planReceiptMessage(code) {
+	switch (code) {
+		case "plan_required": return "Refused: no reinstall plan has been shown for this Mist. Run with --dry-run first, review the plan, then rerun with --confirm.";
+		case "plan_stale": return `Refused: the reinstall plan is older than ${PLAN_TTL_MINUTES} minutes. Run with --dry-run again, review the plan, then rerun with --confirm.`;
+		case "plan_changed": return "Refused: the Droplet, installation or lifecycle URLs changed since the plan was shown. Run with --dry-run again, review the new plan, then rerun with --confirm.";
+	}
+}
+//#endregion
+//#region src/commands/droplet/reinstall.ts
+/**
+* `fluid mist droplet reinstall [slug] --dry-run | --confirm`
+*   [--installation <uuid>] [--resume <operationId>] [--watch-timeout <s>]
+*
+* Port of Mist Desktop's `repair_and_reinstall_droplet`: an IRREVERSIBLE
+* repair plus backend-owned replacement of the Mist's own attached Droplet
+* installation. Same safety rules as Mist:
+*
+*   - The Droplet is always the one attached to the Mist; there is no flag
+*     to name another, and the backend rejects installations of any other
+*     Droplet.
+*   - `--dry-run` shows the exact plan and mutates nothing.
+*   - `--confirm` executes, and only after a `--dry-run` plan for the same
+*     Droplet and installation was shown within the last 15 minutes.
+*     `--yes` never approves it.
+*   - Execution repairs the lifecycle URLs, starts ONE durable replacement
+*     operation, and watches it. It never DELETEs and re-creates an
+*     installation itself and never reports success before Fluid does.
+*   - A slow replacement returns "still_running" with the ids to resume:
+*     `--resume <operationId> --installation <uuid>` (both required).
+*   - `--installation <uuid>` alone recovers a source installation that a
+*     failed attempt already terminalized.
+*
+* Output is always JSON; refusals and failures exit non-zero.
+*/
+function parseSeconds(value) {
+	const seconds = Number(value);
+	if (!Number.isInteger(seconds) || seconds < 1 || seconds > 3600) throw new InvalidArgumentError("Use a whole number of seconds (1-3600).");
+	return seconds;
+}
+const dropletReinstallCommand = new Command("reinstall").description("Irreversibly repair and replace the Mist's attached Droplet installation (plan with --dry-run, then --confirm)").argument("[slug]", "Mist slug (defaults to the .mist file in CWD)").option("--dry-run", "Show the exact plan without changing anything").option("--confirm", "Execute the plan shown by the latest --dry-run (irreversible)").option("--installation <uuid>", "Recovery: the source installation uuid from an earlier plan or still_running result").option("--resume <operationId>", "Keep watching a replacement that already started (needs --installation)").option("--watch-timeout <seconds>", "How long to watch before returning still_running (default 120)", parseSeconds).addOption(new Option("-y, --yes", "Not accepted; use --confirm").hideHelp()).action((slug, opts) => runAction(async () => {
+	let outcome;
+	try {
+		outcome = await runDropletReinstall({
+			client: createMistClient(),
+			cwd: process.cwd(),
+			slug,
+			planStore: createFileReinstallPlanStore(),
+			newIdempotencyKey: () => `fluid-cli-repair-${randomUUID()}`
+		}, {
+			dryRun: opts.dryRun,
+			confirm: opts.confirm,
+			yes: opts.yes,
+			installationUuid: opts.installation,
+			resumeOperationId: opts.resume,
+			watchTimeoutMs: opts.watchTimeout === void 0 ? void 0 : opts.watchTimeout * 1e3
+		});
+	} catch (err) {
+		printJson({
+			status: "error",
+			message: err instanceof Error ? err.message : String(err),
+			...err instanceof MistApiError ? { httpStatus: err.status } : {}
+		});
+		process.exit(err instanceof MistApiError ? err.exitCode : 1);
+	}
+	printJson(outcome.output);
+	if (outcome.exitCode !== 0) process.exit(outcome.exitCode);
+}));
+//#endregion
+//#region src/commands/droplet/repair.ts
+/**
+* `fluid mist droplet repair [slug] [--dry-run] [--yes] [--json]`
+*
+* Port of Mist Desktop's `repair_droplet_lifecycle_webhooks`: point the
+* Mist's attached Droplet's embed URL and install/uninstall webhook URLs at
+* the Mist's public URL. Only those three Droplet fields change, and the
+* Droplet is re-read to verify. This does not replay `droplet.installed`
+* for an existing installation — use `fluid mist droplet reinstall` when
+* the app needs a fresh install event.
+*/
+const dropletRepairCommand = new Command("repair").description("Repair the attached Droplet's embed and lifecycle webhook URLs").argument("[slug]", "Mist slug (defaults to the .mist file in CWD)").option("--dry-run", "Show the planned change without updating the Droplet").option("-y, --yes", "Apply without a confirmation prompt").option("--json", "Emit JSON").action((slug, opts) => runAction(async () => {
+	const client = createMistClient();
+	let result;
+	try {
+		const target = await resolveRepairTarget(client, {
+			slug,
+			cwd: process.cwd()
+		});
+		const planned = await planDropletRepair(client, target, opts.dryRun === true || !opts.yes);
+		if (opts.dryRun || planned.alreadyCorrect) result = {
+			summary: planned.summary,
+			isError: false
+		};
+		else {
+			if (!opts.yes) {
+				if (!(process.stdin.isTTY && !opts.json)) throw new DropletRepairRefusal("confirmation_required", "Refused to update the Droplet without confirmation. Rerun with --yes, or with --dry-run to preview.");
+				printSummary(planned.summary, { preview: true });
+				const { confirmed } = await prompts({
+					type: "confirm",
+					name: "confirmed",
+					message: "Update these Droplet URLs?",
+					initial: false
+				}, { onCancel: () => process.exit(130) });
+				if (!confirmed) {
+					console.log(chalk.dim("Aborted."));
+					return;
+				}
+			}
+			result = await applyDropletRepair(client, target);
+		}
+	} catch (err) {
+		if (opts.json && !(err instanceof DropletRepairRefusal)) {
+			printJson({
+				status: "error",
+				message: err instanceof Error ? err.message : String(err),
+				...err instanceof MistApiError ? { httpStatus: err.status } : {}
+			});
+			process.exit(err instanceof MistApiError ? err.exitCode : 1);
+		}
+		if (!(err instanceof DropletRepairRefusal)) throw err;
+		if (opts.json) printJson({
+			status: "refused",
+			code: err.code,
+			message: err.message
+		});
+		else console.error(chalk.red(err.message));
+		process.exit(1);
+	}
+	if (opts.json) printJson(result.summary);
+	else printSummary(result.summary);
+	if (result.isError) process.exit(1);
+}));
+function printSummary(summary, options = {}) {
+	const label = {
+		unchanged: chalk.green("Already correct; nothing to change."),
+		planned: chalk.yellow("Planned (dry run); nothing was changed."),
+		updated: chalk.green("Updated and verified."),
+		error: chalk.red("Updated, but the Droplet did not verify.")
+	};
+	console.log();
+	console.log(`${chalk.bold(summary.mistSlug ?? summary.mistId)}  ${chalk.dim(summary.dropletUuid)}`);
+	const row = (name, previous, next) => previous === next ? `  ${name.padEnd(10)} ${next}` : `  ${name.padEnd(10)} ${chalk.dim(previous ?? "(none)")} → ${chalk.cyan(next)}`;
+	console.log(row("embed", summary.previous.embedUrl, summary.embedUrl));
+	console.log(row("install", summary.previous.installWebhookUrl, summary.installWebhookUrl));
+	console.log(row("uninstall", summary.previous.uninstallWebhookUrl, summary.uninstallWebhookUrl));
+	if (summary.lifecyclePathsSource === "defaults") console.log(chalk.dim("  Webhook paths: defaults (no fluid.capabilities.json for this Mist in the current directory)."));
+	if (!options.preview) console.log(`  ${label[summary.status]}`);
+	console.log(chalk.dim(`  ${summary.note}`));
+}
+//#endregion
+//#region src/commands/droplet/index.ts
+/** `fluid mist droplet` — sub-command aggregator for the attached Droplet. */
+const dropletCommand = new Command("droplet").description("Repair or reinstall the Mist's attached Droplet").addCommand(dropletRepairCommand).addCommand(dropletReinstallCommand);
+//#endregion
 //#region src/index.ts
 /**
 * @fluid-app/fluid-cli-mist
@@ -2621,7 +3647,7 @@ const envCommand = new Command("env").description("Manage a mist's environment v
 */
 const plugin = {
 	name: "fluid-cli-mist",
-	version: "0.1.0",
+	version: "0.1.32",
 	async register(ctx) {
 		const mist = new Command("mist").description("Create, manage, and deploy Mist hosted extensions");
 		mist.addCommand(listCommand);
@@ -2639,6 +3665,7 @@ const plugin = {
 		mist.addCommand(deploymentsCommand);
 		mist.addCommand(logsCommand);
 		mist.addCommand(envCommand);
+		mist.addCommand(dropletCommand);
 		ctx.program.addCommand(mist);
 	}
 };