@fluid-app/fluid-cli-mist 0.1.35 → 0.1.37

package/dist/index.mjs

@@ -6,9 +6,9 @@ import path, { join, resolve } from "node:path";
 import os from "node:os";
 import { execa } from "execa";
 import ora from "ora";
+import { randomUUID } from "node:crypto";
 import prompts from "prompts";
 import open from "open";
-import { randomUUID } from "node:crypto";
 //#region src/api/client.ts
 /**
 * Generic fetch wrapper for the Mist Rails API.
@@ -25,13 +25,17 @@ var MistApiError = class extends Error {
 	/** HTTP status, or 0 for network-level failures. */
 	status;
 	details;
+	/** The response's top-level `errors` object (Rails' legacy envelope), when
+	*  it has one: the fields the API refused. */
+	fieldErrors;
 	/** Best-guess exit code per the spec: 2 for 4xx, 3 for 5xx/vendor, 4 for net. */
 	exitCode;
-	constructor(message, status, details) {
+	constructor(message, status, details, fieldErrors) {
 		super(message);
 		this.name = "MistApiError";
 		this.status = status;
 		this.details = details;
+		this.fieldErrors = fieldErrors;
 		if (status === 0) this.exitCode = 4;
 		else if (status >= 500) this.exitCode = 3;
 		else this.exitCode = 2;
@@ -80,7 +84,9 @@ function createMistClient() {
 		}
 		if (!response.ok) {
 			const body = parsed;
-			throw new MistApiError(body.error?.message ?? `HTTP ${response.status}`, response.status, body.error?.details);
+			const message = body.error?.message ?? `HTTP ${response.status}`;
+			const fieldErrors = body.errors && typeof body.errors === "object" ? body.errors : void 0;
+			throw new MistApiError(message, response.status, body.error?.details, fieldErrors);
 		}
 		return parsed;
 	}
@@ -1191,6 +1197,7 @@ function buildDropletCreateInput(opts) {
 		input.embed_url = opts.embedUrl;
 		Object.assign(input, dropletWebhookUrls(opts.embedUrl));
 	}
+	if (opts.egressProxy) input.egress_proxy_requested = true;
 	return input;
 }
 function createDroplet(client, body) {
@@ -1238,6 +1245,10 @@ async function findDropletByEmbedUrl(client, embedUrl) {
 	}
 	return null;
 }
+/** PATCH droplet fields, e.g. the embed URL once known or the egress proxy switch. */
+function updateDroplet(client, uuid, input) {
+	return client.patch(`${BASE$3}/${encodeURIComponent(uuid)}`, { droplet: input });
+}
 //#endregion
 //#region src/api/droplet_installations.ts
 const BASE$2 = "/api/droplet_installations";
@@ -1364,2131 +1375,2319 @@ const MANAGED_DROPLET_ENV_KEYS = [
 	"FLUID_WEBHOOK_AUTH_TOKEN"
 ];
 //#endregion
-//#region src/lib/surface-provision.ts
-/**
-* Surface provisioning engine — the one place the "create a Fluid surface and
-* wire it to a mist" flow lives, at parity with Mist Desktop's
-* mist-integration-points-api.service.ts. Exposed via `fluid mist create`
-* (create a bare mist first, then run this), `fluid mist attach` (any kind),
-* and `fluid mist attach-droplet` (droplet shortcut).
-*
-* Three surface kinds, each with its own create endpoint + attach identifier:
-*   - droplet     → POST /api/droplets              → drp_ uuid → integratable_uuid
-*   - drop-zone   → POST /api/drop_zones            → dz_  uuid → integratable_uuid
-*   - mobile-embed→ POST /api/company/mobile_widgets→ numeric id → integratable_id
-*
-* Design tenets (repo philosophy — "server is source of truth"):
-*   - No local progress file. State is re-derived from the API each run.
-*   - Attach-existing is idempotent: if an integration point already links the
-*     target surface (matched via the #19689 integratable_uuid echo, or the
-*     numeric id for mobile), skip. A droplet is 1-per-mist, so creating a new
-*     droplet also skips when one is already attached. Drop-zones/mobile
-*     embeds are additive (a mist can have many).
-*   - Only a droplet attach provisions managed env keys
-*     (FLUID_DROPLET_UUID/_SECRET/_WEBHOOK_AUTH_TOKEN); this flow only
-*     VERIFIES they landed — it never writes them (the API 422s on write).
-*   - A droplet must also be INSTALLED (POST /api/droplet_installations) —
-*     create + link alone leave it not-connected/inactive, so install-scoped
-*     features (dit/dex exchange, admin embeds, install webhooks) don't work.
-*     The install step is idempotent (skips when an installation exists).
-*/
-const DEFAULT_TIMING = {
-	publicUrlTimeoutMs: 9e4,
-	publicUrlIntervalMs: 3e3,
-	envTimeoutMs: 12e4,
-	envIntervalMs: 5e3
-};
-const defaultSleep$1 = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
-const KIND_LABEL$1 = {
-	droplet: "droplet",
-	"drop-zone": "drop zone",
-	"mobile-embed": "mobile embed"
-};
+//#region ../../mist/core/src/droplet-lifecycle-repair.ts
+const DEFAULT_DROPLET_LIFECYCLE_PATHS = Object.freeze({
+	installPath: "/api/webhooks/installed",
+	uninstallPath: "/api/webhooks/uninstalled"
+});
+/** The note every repair summary carries: the repair fixes future delivery,
+*  it does not replay `droplet.installed` for an existing installation. */
+const LIFECYCLE_REPAIR_NOTE = "This repairs future Droplet install/uninstall lifecycle delivery. It does not replay droplet.installed for an already-installed Droplet.";
+/** Strip trailing slashes; null for an absent or empty value. */
+function normalizePublicUrl(value) {
+	if (!value) return null;
+	return value.replace(/\/+$/, "");
+}
+/** A blank or missing path falls back; a relative one gains a leading `/`. */
+function normalizeWebhookPath(value, fallback) {
+	if (typeof value !== "string") return fallback;
+	const trimmed = value.trim();
+	if (!trimmed) return fallback;
+	return trimmed.startsWith("/") ? trimmed : `/${trimmed}`;
+}
 /**
-* Create (or reuse) a surface of `kind` and wire it to the mist. Idempotent
-* for droplet + attach-existing; additive for new drop-zones/mobile embeds.
+* Lifecycle paths from a parsed `fluid.capabilities.json`
+* (`dropletLifecycle.installPath` / `uninstallPath`). Anything that is not
+* the expected shape yields the defaults.
 */
-async function provisionSurface(client, options) {
-	const { reporter, slugOrId, kind } = options;
-	const timing = {
-		...DEFAULT_TIMING,
-		...options.timing
+function dropletLifecyclePathsFromCapabilities(capabilities) {
+	if (!isRecord$1(capabilities)) return { ...DEFAULT_DROPLET_LIFECYCLE_PATHS };
+	const lifecycle = capabilities["dropletLifecycle"];
+	const source = isRecord$1(lifecycle) ? lifecycle : {};
+	return {
+		installPath: normalizeWebhookPath(source["installPath"], DEFAULT_DROPLET_LIFECYCLE_PATHS.installPath),
+		uninstallPath: normalizeWebhookPath(source["uninstallPath"], DEFAULT_DROPLET_LIFECYCLE_PATHS.uninstallPath)
 	};
-	const sleep = options.sleep ?? defaultSleep$1;
-	const label = KIND_LABEL$1[kind];
-	reporter.start("Resolving mist…");
-	const mist = (await showMist(client, slugOrId)).mist;
-	reporter.succeed(`Mist ${mist.slug} (${mist.state})`);
-	reporter.start("Checking existing integrations…");
-	const points = (await listIntegrationPoints(client, slugOrId)).integration_points;
-	let surfaceUuid = null;
-	let surfaceNumericId = null;
-	let surfaceName = null;
-	let surfaceCreated = false;
-	let embedUrlSet = false;
-	let integrationPoint;
-	const attachingExisting = options.existingUuid != null || options.existingId != null;
-	const alreadyLinked = attachingExisting ? findIntegrationPointBySurface(points, {
-		kind,
-		uuid: options.existingUuid,
-		id: options.existingId
-	}) : kind === "droplet" ? findDropletIntegrationPoint(points) : void 0;
-	if (alreadyLinked) {
-		reporter.skip(`${label} already attached (integration #${alreadyLinked.id}) — skipping`);
-		surfaceUuid = alreadyLinked.integratable_uuid ?? options.existingUuid ?? null;
-		surfaceNumericId = alreadyLinked.integratable_id ?? options.existingId ?? null;
-		integrationPoint = {
-			id: alreadyLinked.id,
-			integratableUuid: alreadyLinked.integratable_uuid ?? null,
-			created: false
-		};
-	} else {
-		reporter.succeed("No matching integration yet");
-		let attachUuid = options.existingUuid;
-		let attachId = options.existingId;
-		if (!attachingExisting) {
-			const embedUrl = await resolvePublicUrl(client, {
-				slugOrId,
-				initial: mist.public_url,
-				reporter,
-				timing,
-				sleep
-			});
-			if (!embedUrl) throw new Error("The mist has no public_url yet — wait for the first deploy before creating a surface.");
-			const name = options.name?.trim() || mist.name?.trim() || mist.vendor_name || mist.slug;
-			if (kind === "droplet") {
-				reporter.start("Checking for an interrupted Droplet create…");
-				const recovered = await findDropletByEmbedUrl(client, embedUrl);
-				if (recovered) {
-					surfaceUuid = recovered.uuid;
-					surfaceNumericId = recovered.id ?? null;
-					surfaceName = recovered.name;
-					attachUuid = recovered.uuid;
-					embedUrlSet = true;
-					reporter.skip(`Reusing droplet ${surfaceUuid} from an interrupted attach`);
-				} else {
-					reporter.start(`Creating ${label} "${name}"…`);
-					const created = await createDroplet(client, { droplet: buildDropletCreateInput({
-						name,
-						embedUrl,
-						requestedScopes: options.requestedScopes
-					}) });
-					surfaceUuid = created.droplet.uuid;
-					surfaceNumericId = created.droplet.id ?? null;
-					surfaceName = created.droplet.name;
-					attachUuid = created.droplet.uuid;
-					embedUrlSet = true;
-					surfaceCreated = true;
-					reporter.succeed(`Created droplet ${surfaceUuid}`);
-				}
-			} else if (kind === "drop-zone") {
-				reporter.start(`Creating ${label} "${name}"…`);
-				const created = await createDropZone(client, { drop_zone: buildDropZoneCreateInput({
-					name,
-					embedUrl,
-					zone: options.zone,
-					heightPx: options.heightPx
-				}) });
-				surfaceUuid = created.drop_zone.uuid;
-				surfaceName = created.drop_zone.name;
-				attachUuid = created.drop_zone.uuid;
-				embedUrlSet = true;
-				surfaceCreated = true;
-				reporter.succeed(`Created drop zone ${surfaceUuid}`);
-			} else {
-				reporter.start(`Creating ${label} "${name}"…`);
-				const created = await createMobileWidget(client, { mobile_widget: buildMobileWidgetCreateInput({
-					name,
-					embedUrl,
-					coverImageUrl: options.coverImageUrl,
-					heightPx: options.heightPx
-				}) });
-				surfaceNumericId = created.mobile_widget.id;
-				surfaceName = created.mobile_widget.name;
-				attachId = created.mobile_widget.id;
-				embedUrlSet = true;
-				surfaceCreated = true;
-				reporter.succeed(`Created mobile embed #${surfaceNumericId}`);
-			}
-		} else {
-			surfaceUuid = options.existingUuid ?? null;
-			surfaceNumericId = options.existingId ?? null;
-			embedUrlSet = true;
-		}
-		const attachInput = kind === "mobile-embed" ? {
-			kind,
-			integratable_id: attachId
-		} : {
-			kind,
-			integratable_uuid: attachUuid
-		};
-		reporter.start(`Attaching ${label}…`);
-		let ipResp;
-		try {
-			ipResp = await createIntegrationPoint(client, slugOrId, attachInput);
-		} catch (err) {
-			reporter.fail("Attach failed");
-			throw normalizeAttachError(err, attachUuid ?? String(attachId), kind);
-		}
-		integrationPoint = {
-			id: ipResp.integration_point.id,
-			integratableUuid: ipResp.integration_point.integratable_uuid ?? null,
-			created: true
-		};
-		if (!surfaceUuid) surfaceUuid = ipResp.integration_point.integratable_uuid ?? attachUuid ?? null;
-		if (surfaceNumericId == null) surfaceNumericId = ipResp.integration_point.integratable_id ?? null;
-		reporter.succeed(kind === "droplet" ? "Droplet attached — provisioning env + redeploy…" : `${label} attached`);
-	}
-	let installation = null;
-	if (kind === "droplet") {
-		if (!surfaceUuid && surfaceNumericId != null) try {
-			surfaceUuid = await findDropletUuidByNumericId(client, surfaceNumericId);
-		} catch {}
-		if (!surfaceUuid) {
-			reporter.fail("Droplet uuid unknown — cannot install");
-			throw new Error("Couldn't determine the droplet uuid, so the droplet is linked but NOT installed — it stays inactive until an installation exists. Re-run with `--existing <droplet-uuid>`, or install manually: POST /api/droplet_installations with {\"droplet_uuid\":\"<uuid>\"}.");
-		}
-		installation = await ensureDropletInstalled(client, {
-			dropletUuid: surfaceUuid,
-			scopes: options.requestedScopes ?? DEFAULT_DROPLET_SCOPES,
-			reporter
-		});
-	}
-	const managedEnv = kind === "droplet" ? await verifyManagedEnv(client, {
-		slugOrId,
-		reporter,
-		timing,
-		sleep,
-		enabled: options.verifyEnv !== false
-	}) : null;
+}
+/** The canonical Droplet URLs for a Mist served at `publicUrl`. */
+function canonicalDropletUrls(publicUrl, paths = DEFAULT_DROPLET_LIFECYCLE_PATHS) {
+	const embedUrl = normalizePublicUrl(publicUrl);
+	if (!embedUrl) throw new Error("publicUrl is required");
 	return {
-		mist: {
-			id: mist.id,
-			slug: mist.slug,
-			name: mist.name,
-			public_url: mist.public_url,
-			state: mist.state
-		},
-		kind,
-		surface: {
-			uuid: surfaceUuid,
-			id: surfaceNumericId,
-			name: surfaceName
-		},
-		integrationPoint: integrationPoint ?? {
-			id: "",
-			integratableUuid: null,
-			created: false
-		},
-		surfaceCreated,
-		embedUrlSet,
-		installation,
-		managedEnv
+		embedUrl,
+		installWebhookUrl: `${embedUrl}${paths.installPath}`,
+		uninstallWebhookUrl: `${embedUrl}${paths.uninstallPath}`
 	};
 }
-/**
-* Install the droplet for the current company (idempotent). Checks the
-* installations list first; treats the API's already-installed rejection as
-* success too, so re-runs and races both converge. A hard failure throws with
-* the droplet uuid + recovery steps — the created droplet and mist link stay
-* in place, so an idempotent re-run finishes the job.
-*/
-async function ensureDropletInstalled(client, args) {
-	const { reporter, dropletUuid } = args;
-	reporter.start("Installing droplet…");
-	let existing;
-	try {
-		existing = findInstallationForDroplet(await listAllDropletInstallations(client), dropletUuid);
-	} catch {}
-	if (existing) {
-		reporter.skip(`Droplet already installed${existing.uuid ? ` (${existing.uuid})` : ""} — skipping`);
-		return {
-			uuid: existing.uuid ?? null,
-			created: false
-		};
-	}
-	try {
-		const uuid = (await createDropletInstallation(client, {
-			droplet_uuid: dropletUuid,
-			scopes: [...args.scopes]
-		})).droplet_installation?.uuid ?? null;
-		reporter.succeed(`Droplet installed${uuid ? ` (${uuid})` : ""}`);
-		return {
-			uuid,
-			created: true
-		};
-	} catch (err) {
-		if (err instanceof MistApiError && (err.status === 409 || err.status === 422)) {
-			const confirmed = await lookupInstallation(client, dropletUuid);
-			if (confirmed) {
-				reporter.skip("Droplet already installed — skipping");
-				return {
-					uuid: confirmed.uuid ?? null,
-					created: false
-				};
-			}
-		}
-		reporter.fail("Droplet install failed");
-		throw normalizeInstallError(err, dropletUuid);
-	}
+/** Exact match on all three fields — the repair's no-op condition and its
+*  post-PATCH verification. */
+function dropletUrlsMatch(droplet, canonical) {
+	return droplet?.embed_url === canonical.embedUrl && droplet.install_webhook_url === canonical.installWebhookUrl && droplet.uninstall_webhook_url === canonical.uninstallWebhookUrl;
 }
-/** Best-effort installation lookup for a droplet; null when the row can't
-*  be found or the list call fails. */
-async function lookupInstallation(client, dropletUuid) {
-	try {
-		return findInstallationForDroplet(await listAllDropletInstallations(client), dropletUuid) ?? null;
-	} catch {
-		return null;
-	}
+/** The `PATCH /api/droplets/:uuid` body. Only these three fields change. */
+function dropletRepairPatch(canonical) {
+	return { droplet: {
+		embed_url: canonical.embedUrl,
+		install_webhook_url: canonical.installWebhookUrl,
+		uninstall_webhook_url: canonical.uninstallWebhookUrl
+	} };
 }
 /**
-* Install failures must NOT read as "wired up" — an uninstalled droplet means
-* dit/dex token exchange, admin embeds, and install webhooks silently don't
-* work. Surface the droplet uuid + recovery path; keep the MistApiError
-* status so the error handler exits with the spec'd non-zero code.
+* The repair summary before any mutation. `alreadyCorrect` means the caller
+* must not PATCH; otherwise a dry run reports "planned" and a live run
+* reports "updated" (callers overwrite it after verification).
 */
-function normalizeInstallError(err, dropletUuid) {
-	const message = `Droplet ${dropletUuid} was created and linked to the mist, but installing it failed: ${err instanceof Error ? err.message : String(err)}. The droplet and its link were left in place — re-run this command to finish the install, or install manually: POST /api/droplet_installations with {"droplet_uuid":"${dropletUuid}"}.`;
-	return err instanceof MistApiError ? new MistApiError(message, err.status, err.details) : new Error(message);
+function planLifecycleRepair(input) {
+	const alreadyCorrect = dropletUrlsMatch(input.current, input.canonical);
+	return {
+		alreadyCorrect,
+		summary: {
+			status: alreadyCorrect ? "unchanged" : input.dryRun ? "planned" : "updated",
+			mistId: input.mistId,
+			mistSlug: input.mistSlug,
+			dropletUuid: input.dropletUuid,
+			embedUrl: input.canonical.embedUrl,
+			installWebhookUrl: input.canonical.installWebhookUrl,
+			uninstallWebhookUrl: input.canonical.uninstallWebhookUrl,
+			previous: {
+				embedUrl: input.current?.embed_url ?? null,
+				installWebhookUrl: input.current?.install_webhook_url ?? null,
+				uninstallWebhookUrl: input.current?.uninstall_webhook_url ?? null
+			},
+			note: LIFECYCLE_REPAIR_NOTE
+		}
+	};
 }
-/**
-* If the integration-points endpoint rejects the attach identifier (e.g. an
-* older API that predates #19688's attach-by-uuid support), surface an
-* actionable message noting the surface WAS created. Other errors pass through.
-*/
-function normalizeAttachError(err, surfaceRef, kind) {
-	if (err instanceof MistApiError && (err.status === 400 || err.status === 422)) {
-		const blob = `${err.message} ${JSON.stringify(err.details ?? {})}`;
-		if (/integratable_uuid|integratable_id|unpermitted|unknown|param/i.test(blob)) return new MistApiError(`The ${KIND_LABEL$1[kind]} ${surfaceRef} was created, but this API rejected the attach (needs the #19688 integration-points endpoint). Re-run once the API is updated.`, err.status, err.details);
-	}
-	return err instanceof Error ? err : new Error(String(err));
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-/**
-* Return the mist's public_url, polling briefly if it isn't ready yet
-* (async-first-deploy). Returns null if it never appears within the window.
-*/
-async function resolvePublicUrl(client, args) {
-	if (args.initial) return args.initial;
-	args.reporter.start("Waiting for the mist's public URL…");
-	const deadline = Date.now() + args.timing.publicUrlTimeoutMs;
-	for (;;) {
-		const url = (await showMist(client, args.slugOrId)).mist.public_url;
-		if (url) {
-			args.reporter.succeed(`Public URL ready: ${url}`);
-			return url;
-		}
-		if (Date.now() >= deadline) break;
-		await args.sleep(args.timing.publicUrlIntervalMs);
-	}
-	return null;
+//#endregion
+//#region ../../mist/core/src/lifecycle-types.ts
+const lifecycleOperationStates = [
+	"queued",
+	"running",
+	"succeeded",
+	"failed",
+	"requires_action"
+];
+const lifecycleOperationKinds = ["replacement"];
+const connectionStates = [
+	"pending",
+	"connected",
+	"degraded",
+	"requires_action"
+];
+function isTerminalOperation(operation) {
+	return operation.state === "succeeded" || operation.state === "failed" || operation.state === "requires_action";
 }
-/**
-* Poll `GET …/env_vars` until the Mist-managed droplet keys appear with
-* `managed_by: "mist"`. Never fails the flow — a redeploy in progress is a
-* normal, transient state we simply report.
-*/
-async function verifyManagedEnv(client, args) {
-	const required = [...MANAGED_DROPLET_ENV_KEYS];
-	if (!args.enabled) return {
-		ready: false,
-		present: [],
-		missing: required
+//#endregion
+//#region ../../mist/core/src/recovery-classification.ts
+function classifyLifecycleRecovery(result) {
+	if (result.status === "not_found") return {
+		status: "requires_action",
+		action: "rediscover_operation"
 	};
-	args.reporter.start("Verifying managed environment…");
-	const deadline = Date.now() + args.timing.envTimeoutMs;
-	let present = [];
-	for (;;) {
-		const envVars = (await listEnvVars(client, args.slugOrId)).env_vars ?? [];
-		const managed = new Set(envVars.filter((e) => e.managed_by === "mist").map((e) => e.key));
-		present = required.filter((k) => managed.has(k));
-		if (present.length === required.length) {
-			args.reporter.succeed("Managed env keys present — droplet is wired up");
-			return {
-				ready: true,
-				present,
-				missing: []
-			};
-		}
-		if (Date.now() >= deadline) break;
-		args.reporter.update(`Verifying managed environment… (${present.length}/${required.length} keys, redeploy in progress)`);
-		await args.sleep(args.timing.envIntervalMs);
-	}
-	const missing = required.filter((k) => !present.includes(k));
-	args.reporter.warn(`Redeploy in progress — managed keys not visible yet (${present.length}/${required.length}). Check later with \`fluid mist env list\`. Missing: ${missing.join(", ")}`);
-	return {
-		ready: false,
-		present,
-		missing
+	if (result.status === "timed_out") return {
+		status: "retryable",
+		action: "resume_status_polling"
 	};
+	return classifyTerminalOperation(result.operation);
 }
-//#endregion
-//#region src/lib/surface-flags.ts
-const KIND_ALIASES = {
-	droplet: "droplet",
-	droplets: "droplet",
-	"drop-zone": "drop-zone",
-	drop_zone: "drop-zone",
-	dropzone: "drop-zone",
-	zone: "drop-zone",
-	"mobile-embed": "mobile-embed",
-	mobile_embed: "mobile-embed",
-	mobile: "mobile-embed",
-	"mobile-widget": "mobile-embed",
-	mobilewidget: "mobile-embed"
-};
-const SURFACE_KIND_LIST = "droplet, drop-zone, mobile-embed";
-function parseSurfaceKind(raw) {
-	const hit = KIND_ALIASES[raw.trim().toLowerCase()];
-	if (!hit) throw new Error(`Unknown surface kind "${raw}". Use one of: ${SURFACE_KIND_LIST}.`);
-	return hit;
+function classifyTerminalOperation(operation) {
+	if (operation.state === "succeeded") return {
+		status: "complete",
+		action: null
+	};
+	if (operation.state === "failed") return {
+		status: "failed",
+		action: operation.recovery_action ?? "verify_lifecycle_destination"
+	};
+	return {
+		status: "requires_action",
+		action: operation.recovery_action ?? "reconcile_lifecycle"
+	};
 }
-function parseHeight(raw) {
-	if (raw == null) return void 0;
-	const n = Number(raw);
-	if (!Number.isInteger(n) || n <= 0) throw new Error(`Invalid --height "${raw}". Must be a positive integer (px).`);
-	return n;
+const REPLACEMENT_IDEMPOTENCY_SCOPE = "single replacement attempt; a later approved retry receives a new key";
+const REPLACEMENT_OWNERSHIP_NOTE = "Fluid owns revocation, uninstall delivery, terminalization, replacement creation, and retry recovery as one durable operation.";
+function replacementOperationsPath(mistId, installationUuid) {
+	return `/api/v202604/mists/${encodeURIComponent(mistId)}/droplet_installations/${encodeURIComponent(installationUuid)}/replacement_operations`;
 }
-/**
-* Map CLI flags to the kind-specific `provisionSurface` options, enforcing the
-* per-kind requirements the API needs:
-*  - drop-zone requires `--zone <page__zone>` (else it never renders).
-*  - mobile-embed requires `--cover-image <url>` (the API 422s without one; the
-*    CLI has no DAM picker, so the user must supply a url).
-*/
-function surfaceProvisionOptionsFromFlags(kind, flags) {
-	const heightPx = parseHeight(flags.height);
-	if (kind === "drop-zone") {
-		if (!flags.zone?.trim()) throw new Error("A drop-zone needs a slot — pass `--zone <page__zone>` (e.g. --zone checkout__below_total).");
-		return {
-			zone: flags.zone.trim(),
-			heightPx
-		};
-	}
-	if (kind === "mobile-embed") {
-		if (!flags.coverImage?.trim()) throw new Error("A mobile-embed needs a cover image — pass `--cover-image <url>` (the mobile API requires one; the CLI has no image picker).");
-		return {
-			coverImageUrl: flags.coverImage.trim(),
-			heightPx
-		};
-	}
-	return {};
+function replacementOperationStatusPath(mistId, installationUuid, operationId) {
+	return `${replacementOperationsPath(mistId, installationUuid)}/${encodeURIComponent(operationId)}`;
 }
-//#endregion
-//#region src/lib/surface-summary.ts
-/** Shared human-readable summary for a surface provision result. */
-const KIND_LABEL = {
-	droplet: "droplet",
-	"drop-zone": "drop zone",
-	"mobile-embed": "mobile embed"
-};
-function printSurfaceSummary(result) {
-	const ref = result.surface.uuid ?? (result.surface.id != null ? `#${result.surface.id}` : "(unknown)");
-	const state = result.surfaceCreated ? "created" : "existing";
-	console.log(chalk.dim(`  ${KIND_LABEL[result.kind]}: ${ref} (${state}) · integration ${result.integrationPoint.id}`));
-	if (result.kind === "droplet" && result.installation) {
-		const ref = result.installation.uuid ?? "(uuid unknown)";
-		console.log(chalk.dim(`  installation: ${ref} (${result.installation.created ? "installed" : "already installed"})`));
-	}
-	if (result.kind === "droplet" && result.managedEnv) if (result.managedEnv.ready) console.log(chalk.dim("  env: managed keys provisioned ✓"));
-	else console.log(chalk.yellow("  env: redeploy in progress — run `fluid mist env list` shortly to confirm managed keys"));
+/** The operation id a 409 "active_operation_exists" response points at. */
+function parseActiveOperationId(value) {
+	if (!isRecord(value)) return null;
+	const error = value["error"];
+	if (!isRecord(error)) return null;
+	const details = error["details"];
+	if (!isRecord(details)) return null;
+	const operationId = details["operation_id"];
+	return typeof operationId === "string" ? operationId : null;
+}
+/** Seconds from a `Retry-After` header; undefined when absent or invalid. */
+function parseRetryAfterHeader(value) {
+	if (!value) return void 0;
+	const seconds = Number(value);
+	return Number.isFinite(seconds) && seconds >= 0 ? seconds : void 0;
+}
+/** Parse and validate `{ replacement_operation: {...} }`. Throws on a
+*  malformed body rather than trusting a partial operation. */
+function parseReplacementOperation(value) {
+	const key = "replacement_operation";
+	if (!isRecord(value)) throw new Error("Lifecycle response must be an object");
+	const candidate = value[key];
+	if (!isRecord(candidate)) throw new Error(`Lifecycle response is missing ${key}`);
+	const id = candidate["id"];
+	const kind = candidate["kind"];
+	const state = candidate["state"];
+	const stage = candidate["stage"];
+	const mistId = candidate["mist_id"];
+	const createdAt = candidate["created_at"];
+	const updatedAt = candidate["updated_at"];
+	if (typeof id !== "string" || !isLifecycleOperationKind(kind) || !isLifecycleOperationState(state) || typeof stage !== "string" || typeof mistId !== "string" || typeof createdAt !== "string" || typeof updatedAt !== "string") throw new Error("Lifecycle operation response is malformed");
+	const dropletUuid = candidate["droplet_uuid"];
+	const installationUuid = candidate["installation_uuid"];
+	const connectionState = candidate["connection_state"];
+	const errorCode = candidate["error_code"];
+	const recoveryAction = candidate["recovery_action"];
+	const terminalAt = candidate["terminal_at"];
+	const retryAfterSeconds = candidate["retry_after_seconds"];
+	if (!isOptionalNullableString(dropletUuid) || !isOptionalNullableString(installationUuid) || !isOptionalConnectionState(connectionState) || !isOptionalNullableString(errorCode) || !isOptionalNullableString(recoveryAction) || !isOptionalNullableString(terminalAt) || !isOptionalNullableNumber(retryAfterSeconds)) throw new Error("Lifecycle operation response has malformed optional fields");
+	return {
+		id,
+		kind,
+		state,
+		stage,
+		mist_id: mistId,
+		created_at: createdAt,
+		updated_at: updatedAt,
+		...dropletUuid !== void 0 ? { droplet_uuid: dropletUuid } : {},
+		...installationUuid !== void 0 ? { installation_uuid: installationUuid } : {},
+		...connectionState !== void 0 ? { connection_state: connectionState } : {},
+		...errorCode !== void 0 ? { error_code: errorCode } : {},
+		...recoveryAction !== void 0 ? { recovery_action: recoveryAction } : {},
+		...terminalAt !== void 0 ? { terminal_at: terminalAt } : {},
+		...retryAfterSeconds !== void 0 ? { retry_after_seconds: retryAfterSeconds } : {}
+	};
 }
-//#endregion
-//#region src/commands/create.ts
 /**
-* `fluid mist create` — provision a new mist, optionally creating and attaching
-* a surface in one step. All attach paths go through integration points
-* (hostable is retired — #19684/#19687).
-*
-*   --droplet [name]           Create a NEW droplet and attach it. Bare →
-*                              droplet name defaults to the mist name. The
-*                              "one command that sets everything up" path.
-*   --kind <kind> [flags]      Create + attach a surface of any kind:
-*                              droplet | drop-zone | mobile-embed. Kind flags:
-*                                drop-zone   --zone <page__zone> --height <px>
-*                                mobile-embed --cover-image <url> --height <px>
-*   --hostable droplet:<uuid>  Attach an EXISTING droplet by its drp_… uuid.
-*
-* With none of these, creates a plain standalone mist.
+* Guard the request before any network call. A resume must name the
+* installation it started on: status is scoped to the SOURCE installation,
+* the backend terminalizes that source mid-flight, and polling whichever
+* installation is attached now would report a false "not_found".
 */
-const createCommand = new Command("create").description("Provision a new mist (optionally create + attach a surface in one step)").option("--droplet [name]", "Create a droplet and attach it. Bare uses the mist name; pass a value to override.").option("--kind <kind>", "Create + attach a surface: droplet | drop-zone | mobile-embed").option("--hostable <ref>", "Attach an existing droplet by uuid: droplet:<uuid> (e.g. droplet:drp_abc123)").option("--name <label>", "Display label for the mist (and the surface)").option("--zone <slot>", "drop-zone slot id: page__zone (e.g. checkout__below_total)").option("--height <px>", "Embed height in px (drop-zone + mobile-embed)").option("--cover-image <url>", "Mobile-embed cover image url (required for mobile-embed)").option("--mist-kind <kind>", "Mist kind (default: next_app)").option("--no-wait", "Don't wait for managed env keys to appear after attach").option("--json", "Emit raw JSON").action((opts) => runAction(async () => {
-	const wantDroplet = opts.droplet !== void 0;
-	const wantKind = !!opts.kind;
-	const wantHostable = !!opts.hostable;
-	if ([
-		wantDroplet,
-		wantKind,
-		wantHostable
-	].filter(Boolean).length > 1) throw new Error("Pass only one of `--droplet`, `--kind`, or `--hostable` — they're mutually exclusive.");
-	let kind;
-	let existingDropletUuid;
-	let nameOverride;
-	if (wantDroplet) {
-		kind = "droplet";
-		nameOverride = typeof opts.droplet === "string" ? opts.droplet.trim() : void 0;
-	} else if (wantKind) kind = parseSurfaceKind(opts.kind);
-	else if (wantHostable) {
-		kind = "droplet";
-		existingDropletUuid = parseDropletRef(opts.hostable);
-	}
-	const mistBody = { kind: opts.mistKind ?? "next_app" };
-	if (opts.name?.trim()) mistBody.name = opts.name.trim();
-	const client = createMistClient();
-	const reporter = opts.json ? createSilentReporter() : createOraReporter();
-	reporter.start("Setting up your Mist Cloud environment…");
-	let created;
-	try {
-		created = await createMist(client, { mist: mistBody });
-	} catch (err) {
-		reporter.fail("Provisioning failed");
-		throw err;
-	}
-	const mist = created.mist;
-	reporter.succeed(`Provisioned ${mist.slug}`);
-	let provision;
-	if (kind) provision = await provisionSurface(client, {
-		slugOrId: mist.slug,
-		kind,
-		name: nameOverride ?? opts.name?.trim(),
-		existingUuid: existingDropletUuid,
-		verifyEnv: opts.wait !== false,
-		reporter,
-		...surfaceProvisionOptionsFromFlags(kind, opts)
-	});
-	if (opts.json) return printJson(provision ? {
-		mist,
-		provision
-	} : created);
-	const label = mistLabel(mist.name, mist.vendor_name);
-	console.log();
-	console.log(`${label}  ${chalk.dim(mist.slug)}  ${colorState(mist.state)}`);
-	if (mist.public_url) console.log(`  ${chalk.cyan(mist.public_url)}`);
-	if (provision) printSurfaceSummary(provision);
-	console.log();
-	console.log(chalk.dim(`Clone with: fluid mist clone ${mist.slug}`));
-}));
-//#endregion
-//#region src/commands/attach.ts
+function checkReplacementRequest(args) {
+	const resumeOperationId = args.resumeOperationId?.trim() || null;
+	if (resumeOperationId && !args.installationUuid) return {
+		ok: false,
+		code: "resume_requires_installation"
+	};
+	return {
+		ok: true,
+		resumeOperationId
+	};
+}
+/** Starting a new replacement needs explicit confirmation; resuming only
+*  reads an operation the user already approved. */
+function replacementStartNeedsConfirmation(args, resumeOperationId) {
+	return !resumeOperationId && args.confirmDestructiveReinstall !== true;
+}
 /**
-* `fluid mist attach --kind <kind> [flags] [slug]` — create a surface and wire
-* it to an existing mist. One command for all three kinds:
-*
-*   --kind droplet                       (managed-env-provisioning droplet)
-*   --kind drop-zone --zone page__zone   [--height <px>]
-*   --kind mobile-embed --cover-image <url> [--height <px>]
-*
-* Attach an EXISTING surface instead of creating one with `--existing <ref>`:
-*   droplet/drop-zone → droplet:drp_… / drop-zone:dz_… / bare uuid
-*   mobile-embed      → mobile-embed:<numericId>
-*
-* Idempotent for droplet + attach-existing (skips when already linked).
+* The installation to replace. An explicitly named `installationUuid`
+* always wins: it is the recovery path for a source that a failed attempt
+* already terminalized (which may sit beside a newer active installation
+* of the same Droplet), and a resume must watch the installation its
+* operation started on, never a rediscovered one. Without a name, the
+* company's active installation of the attached Droplet is used.
 */
-/** Parse `--existing <ref>` into a uuid or numeric id for the given kind. */
-function parseExisting(kind, raw) {
-	const trimmed = (raw.includes(":") ? raw.slice(raw.lastIndexOf(":") + 1) : raw).trim();
-	if (!trimmed) throw new Error(`Empty --existing reference "${raw}".`);
-	if (kind === "mobile-embed") {
-		const id = Number(trimmed);
-		if (!Number.isInteger(id) || id <= 0) throw new Error(`mobile-embed attaches by numeric id — pass \`--existing <id>\` (got "${raw}").`);
-		return { existingId: id };
-	}
-	return { existingUuid: trimmed };
+function selectReplacementInstallation(input) {
+	if (input.installationUuid) return input.installations.find((candidate) => candidate.uuid === input.installationUuid && candidate.droplet_uuid === input.dropletUuid) ?? {
+		uuid: input.installationUuid,
+		droplet_uuid: input.dropletUuid
+	};
+	if (input.resumeOperationId) return void 0;
+	return input.installations.find((candidate) => candidate.droplet_uuid === input.dropletUuid);
+}
+function buildReplacementPlan(input) {
+	const { installation } = input;
+	return {
+		status: input.dryRun ? "planned" : input.resumeOperationId ? "watching" : "pending",
+		mistId: input.mistId,
+		dropletUuid: input.dropletUuid,
+		installationUuid: installation.uuid,
+		lifecycleRepair: input.lifecycleRepair,
+		replacementPath: replacementOperationsPath(input.mistId, installation.uuid),
+		idempotencyKey: input.resumeOperationId ? null : input.idempotencyKey,
+		idempotencyScope: REPLACEMENT_IDEMPOTENCY_SCOPE,
+		irreversible: true,
+		preservedByBackend: {
+			scopes: Array.isArray(installation.scopes),
+			role_id: typeof installation.role_id === "string" || typeof installation.role_id === "number"
+		},
+		note: REPLACEMENT_OWNERSHIP_NOTE
+	};
 }
-const attachCommand = new Command("attach").description(`Create a surface (${SURFACE_KIND_LIST}) and wire it to an existing mist`).argument("[slug]", "Mist slug (defaults to the .mist file in CWD)").requiredOption("--kind <kind>", `Surface kind: ${SURFACE_KIND_LIST}`).option("--name <label>", "Surface name (defaults to the mist's name)").option("--zone <slot>", "drop-zone slot id: page__zone (e.g. checkout__below_total)").option("--height <px>", "Embed height in px (drop-zone + mobile-embed)").option("--cover-image <url>", "Mobile-embed cover image url (required for mobile-embed)").option("--existing <ref>", "Attach an existing surface instead of creating one (uuid, or numeric id for mobile-embed)").option("--no-wait", "Don't wait for managed env keys to appear after attach").option("--json", "Emit raw JSON").action((slug, opts) => runAction(async () => {
-	const kind = parseSurfaceKind(opts.kind);
-	const resolved = resolveSlug(slug);
-	const client = createMistClient();
-	const reporter = opts.json ? createSilentReporter() : createOraReporter();
-	const existing = opts.existing ? parseExisting(kind, opts.existing) : void 0;
-	const result = await provisionSurface(client, {
-		slugOrId: resolved,
-		kind,
-		name: opts.name?.trim(),
-		verifyEnv: opts.wait !== false,
-		reporter,
-		...existing,
-		...existing ? {} : surfaceProvisionOptionsFromFlags(kind, opts)
-	});
-	if (opts.json) return printJson(result);
-	console.log();
-	console.log(`${chalk.bold(result.mist.name ?? result.mist.slug)}  ${chalk.dim(result.mist.slug)}`);
-	printSurfaceSummary(result);
-}));
-//#endregion
-//#region src/commands/attach-droplet.ts
 /**
-* `fluid mist attach-droplet [name] [slug]` — droplet shortcut for
-* `fluid mist attach --kind droplet`. Creates a droplet and wires it to an
-* existing standalone mist (provisioning the managed env). Idempotent: if a
-* droplet is already attached, it skips create + attach and just verifies env.
-*
-*   name   Optional droplet name (defaults to the mist's name).
-*   slug   Optional mist slug (defaults to the `.mist` file in CWD).
+* The final result of one watch. A timed-out poll is this caller's watch
+* budget expiring, NOT the backend giving up: it reports "still_running"
+* with the ids needed to resume, and is not an error. Only "succeeded" is
+* complete.
 */
-const attachDropletCommand = new Command("attach-droplet").description("Create a droplet and wire it to an existing standalone mist (idempotent)").argument("[name]", "Droplet name (defaults to the mist's name)").argument("[slug]", "Mist slug (defaults to the .mist file in CWD)").option("--no-wait", "Don't wait for managed env keys to appear after attach").option("--json", "Emit raw JSON").action((name, slug, opts) => runAction(async () => {
-	const resolved = resolveSlug(slug);
-	const client = createMistClient();
-	const reporter = opts.json ? createSilentReporter() : createOraReporter();
-	const result = await provisionSurface(client, {
-		slugOrId: resolved,
-		kind: "droplet",
-		name: name?.trim() || void 0,
-		verifyEnv: opts.wait !== false,
-		reporter
-	});
-	if (opts.json) return printJson(result);
-	console.log();
-	console.log(`${chalk.bold(result.mist.name ?? result.mist.slug)}  ${chalk.dim(result.mist.slug)}`);
-	printSurfaceSummary(result);
-}));
+function summarizeReplacementWatch(input) {
+	const { pollResult, startedOperation } = input;
+	const recovery = classifyLifecycleRecovery(pollResult);
+	const stillRunning = pollResult.status === "timed_out";
+	const latestOperation = pollResult.status === "terminal" ? pollResult.operation : pollResult.status === "timed_out" ? pollResult.operation ?? startedOperation : startedOperation;
+	return {
+		result: {
+			...input.plan,
+			status: pollResult.status === "terminal" ? pollResult.operation.state : stillRunning ? "still_running" : pollResult.status,
+			replacementOperation: latestOperation,
+			recovery,
+			...stillRunning ? {
+				watchedForMs: input.watchedForMs,
+				resumeOperationId: input.operationId,
+				nextStep: input.nextStep({
+					operationId: input.operationId,
+					installationUuid: input.installationUuid,
+					stage: latestOperation?.stage ?? "unknown"
+				})
+			} : {}
+		},
+		isError: !stillRunning && recovery.status !== "complete"
+	};
+}
+function isLifecycleOperationKind(value) {
+	return lifecycleOperationKinds.some((candidate) => candidate === value);
+}
+function isLifecycleOperationState(value) {
+	return lifecycleOperationStates.some((candidate) => candidate === value);
+}
+function isOptionalNullableString(value) {
+	return value === void 0 || value === null || typeof value === "string";
+}
+function isOptionalNullableNumber(value) {
+	return value === void 0 || value === null || typeof value === "number";
+}
+function isOptionalConnectionState(value) {
+	return value === void 0 || value === null || connectionStates.some((candidate) => candidate === value);
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
 //#endregion
-//#region src/commands/update.ts
-/**
-* `fluid mist update` — mutate an existing mist. Hostable is retired
-* (#19684/#19687), so attach/detach operate on integration points:
-*
-*   --name <label>            Rename the mist (PATCH /mists/:id).
-*   --hostable droplet:<uuid> Attach a droplet by uuid. No-ops if that same
-*                             droplet is already attached; replaces it if a
-*                             different droplet is attached (droplet is
-*                             1-per-mist — it provisions the managed env).
-*   --detach                  Remove the droplet integration point.
-*
-* The integration-point link is immutable (no update route, no `active`
-* field) — enablement lives on the surface record, so there's no toggle here.
-* All ops re-derive state from the integration-points index (which echoes
-* `integratable_uuid` since #19689) and only make the calls that change it.
-*/
-const updateCommand = new Command("update").description("Rename a mist, or attach/detach its droplet").argument("[slug]", "The mist slug (defaults to .mist file in CWD)").option("--name <label>", "Set the display label").option("--hostable <ref>", "Attach a droplet: droplet:<uuid> (e.g. droplet:drp_abc123)").option("--detach", "Remove the droplet integration point").option("--json", "Emit raw API JSON").action((slug, opts) => runAction(async () => {
-	if (opts.hostable && opts.detach) throw new Error("Pass either `--hostable` OR `--detach`, not both — they're mutually exclusive.");
-	if (!opts.name && !opts.hostable && !opts.detach) throw new Error("Nothing to do — pass `--name`, `--hostable`, or `--detach`.");
-	const resolved = resolveSlug(slug);
-	const client = createMistClient();
-	const notes = [];
-	let renameResp;
-	if (opts.name?.trim()) {
-		renameResp = await updateMist(client, resolved, { mist: { name: opts.name.trim() } });
-		if (!opts.json) {
-			const m = renameResp.mist;
-			console.log(`${mistLabel(m.name, m.vendor_name)}  ${chalk.dim(m.slug)}  ${colorState(m.state)}`);
+//#region ../../mist/core/src/operation-polling.ts
+async function pollLifecycleOperation({ fetchStatus, timeoutMs = 1800 * 1e3, minimumIntervalMs = 2e3, sleep: sleepOverride, now = Date.now, abortSignal }) {
+	const sleep = sleepOverride ?? ((durationMs) => defaultSleep$1(durationMs, abortSignal));
+	const startedAt = now();
+	let latestOperation;
+	while (now() - startedAt < timeoutMs) {
+		abortSignal?.throwIfAborted();
+		const response = await fetchStatus();
+		abortSignal?.throwIfAborted();
+		if (response.status === 404) return { status: "not_found" };
+		const transientServerError = response.status >= 500 && response.status < 600;
+		if (response.status !== 200 && response.status !== 429 && !transientServerError) throw new Error(`Lifecycle status request failed with HTTP ${response.status}`);
+		if (response.operation) {
+			latestOperation = response.operation;
+			if (isTerminalOperation(response.operation)) return {
+				status: "terminal",
+				operation: response.operation
+			};
 		}
+		const retryAfterMs = Math.max(minimumIntervalMs, (response.retryAfterSeconds ?? response.operation?.retry_after_seconds ?? 0) * 1e3);
+		await sleep(Math.min(retryAfterMs, Math.max(0, timeoutMs - (now() - startedAt))));
+		abortSignal?.throwIfAborted();
 	}
-	if (opts.hostable || opts.detach) {
-		const existing = findDropletIntegrationPoint((await listIntegrationPoints(client, resolved)).integration_points);
-		if (opts.hostable) {
-			const dropletUuid = parseDropletRef(opts.hostable);
-			if (existing && existing.integratable_uuid === dropletUuid) notes.push(`droplet ${dropletUuid} already attached (integration ${existing.id})`);
-			else {
-				if (existing) {
-					await deleteIntegrationPoint(client, resolved, existing.id);
-					notes.push(`replaced integration ${existing.id}`);
-				}
-				const ip = await createIntegrationPoint(client, resolved, {
-					kind: "droplet",
-					integratable_uuid: dropletUuid
-				});
-				notes.push(`attached droplet ${dropletUuid} (integration ${ip.integration_point.id})`);
-			}
-		} else if (opts.detach) if (existing) {
-			await deleteIntegrationPoint(client, resolved, existing.id);
-			notes.push(`detached droplet (removed integration ${existing.id})`);
-		} else notes.push("already standalone (no droplet integration)");
-	}
-	if (opts.json) return printJson(renameResp ? {
-		...renameResp,
-		slug: resolved,
-		notes
-	} : {
-		slug: resolved,
-		notes
+	return latestOperation ? {
+		status: "timed_out",
+		operation: latestOperation
+	} : { status: "timed_out" };
+}
+function defaultSleep$1(durationMs, abortSignal) {
+	return new Promise((resolve, reject) => {
+		const onAbort = () => {
+			clearTimeout(timer);
+			reject(abortSignal?.reason);
+		};
+		const timer = setTimeout(() => {
+			abortSignal?.removeEventListener("abort", onAbort);
+			resolve();
+		}, durationMs);
+		abortSignal?.addEventListener("abort", onAbort, { once: true });
 	});
-	for (const note of notes) console.log(chalk.dim(`  ${note}`));
-}));
+}
 //#endregion
-//#region src/commands/delete.ts
-/**
-* `fluid mist delete` — scheduled teardown 15 days out (spec §3 "15-day
-* grace period"). DO NOT poll for completion.
-*/
-const deleteCommand = new Command("delete").description("Schedule a mist for destruction (15-day grace window)").argument("[slug]", "The mist slug (defaults to .mist file in CWD)").option("-y, --yes", "Skip confirmation prompt").option("--json", "Emit raw API JSON").action((slug, opts) => runAction(async () => {
-	const resolved = resolveSlug(slug);
-	const client = createMistClient();
-	if (!opts.yes) {
-		const { mist } = await showMist(client, resolved);
-		const fifteenDaysOut = new Date(Date.now() + 15 * 864e5).toISOString().slice(0, 10);
-		console.log();
-		console.log(`About to schedule ${chalk.bold(mist.name ?? mist.vendor_name ?? mist.slug)} (${chalk.dim(mist.slug)}) for destruction on ${chalk.yellow(fifteenDaysOut)}.`);
-		console.log(chalk.dim(`Vendor resources stay alive until then; run \`fluid mist restore ${mist.slug}\` to undo.`));
-		const { confirmed } = await prompts({
-			type: "confirm",
-			name: "confirmed",
-			message: "Continue?",
-			initial: false
-		}, { onCancel: () => process.exit(130) });
-		if (!confirmed) {
-			console.log(chalk.dim("Aborted."));
-			process.exit(0);
+//#region src/api/droplet_replacements.ts
+async function startDropletReplacement(client, input) {
+	const response = await send(client, replacementOperationsPath(input.mistId, input.installationUuid), {
+		method: "POST",
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify({ idempotency_key: input.idempotencyKey })
+	});
+	const body = await readJson(response);
+	if (response.ok) return parseReplacementOperation(body);
+	const activeOperationId = response.status === 409 ? parseActiveOperationId(body) : null;
+	if (activeOperationId) return fetchDropletReplacement(client, {
+		mistId: input.mistId,
+		installationUuid: input.installationUuid,
+		operationId: activeOperationId
+	});
+	const retryAfterSeconds = parseRetryAfterHeader(response.headers.get("Retry-After"));
+	const retryHint = retryAfterSeconds === void 0 ? "" : `; retry after ${retryAfterSeconds}s`;
+	throw new MistApiError(`Droplet replacement start failed with HTTP ${response.status}${retryHint}`, response.status);
+}
+async function fetchDropletReplacement(client, input) {
+	const response = await send(client, replacementOperationStatusPath(input.mistId, input.installationUuid, input.operationId), { method: "GET" });
+	if (!response.ok) throw new MistApiError(`Active replacement status failed with HTTP ${response.status}`, response.status);
+	return parseReplacementOperation(await readJson(response));
+}
+/** Poll an operation until it is terminal, gone, or `timeoutMs` elapses. */
+function pollDropletReplacement(client, input) {
+	const statusPath = replacementOperationStatusPath(input.mistId, input.installationUuid, input.operationId);
+	return pollLifecycleOperation({
+		timeoutMs: input.timeoutMs,
+		...input.sleep ? { sleep: input.sleep } : {},
+		fetchStatus: async () => {
+			const response = await send(client, statusPath, { method: "GET" });
+			const retryAfterSeconds = parseRetryAfterHeader(response.headers.get("Retry-After"));
+			if (response.status === 404 || response.status === 429) return {
+				status: response.status,
+				retryAfterSeconds
+			};
+			if (!response.ok) return { status: response.status };
+			return {
+				status: response.status,
+				operation: parseReplacementOperation(await readJson(response)),
+				retryAfterSeconds
+			};
 		}
+	});
+}
+async function send(client, path, init) {
+	try {
+		return await client.request(path, init);
+	} catch (err) {
+		throw new MistApiError(`Network error: ${err instanceof Error ? err.message : String(err)}`, 0);
+	}
+}
+async function readJson(response) {
+	const text = await response.text();
+	if (!text) return null;
+	try {
+		return JSON.parse(text);
+	} catch {
+		return null;
 	}
-	const { mist } = await deleteMist(client, resolved);
-	if (opts.json) return printJson({ mist });
-	console.log(chalk.magenta(`Scheduled for destruction on ${mist.scheduled_destroy_at ? formatAbsolute(mist.scheduled_destroy_at) : "the 15-day mark"}.`));
-	console.log(chalk.dim(`Vendor resources stay alive until then; run \`fluid mist restore ${mist.slug}\` to undo.`));
-}));
-//#endregion
-//#region src/commands/restore.ts
-/** `fluid mist restore` — un-delete within the 15-day window. Spec §3. */
-const restoreCommand = new Command("restore").description("Cancel a scheduled mist destruction (15-day window)").argument("[slug]", "The mist slug (defaults to .mist file in CWD)").option("--json", "Emit raw API JSON").action((slug, opts) => runAction(async () => {
-	const resolved = resolveSlug(slug);
-	const { mist } = await restoreMist(createMistClient(), resolved);
-	if (opts.json) return printJson({ mist });
-	console.log(`Restored: ${mist.public_url ? chalk.cyan(mist.public_url) : mist.name ?? mist.vendor_name ?? mist.slug} (${colorState(mist.state)})`);
-}));
-//#endregion
-//#region src/api/git_credential.ts
-async function createGitCredential(client, slug) {
-	const id = await resolveMistId(client, slug);
-	return client.post(`/api/v202604/mists/${id}/git_credential`);
 }
 //#endregion
-//#region src/commands/clone.ts
-/**
-* `fluid mist clone <slug>` — mints a fresh git credential and clones
-* into ./<vendor-name>/, writes a `.mist` marker file. Spec §3 + §11.
-*/
+//#region src/lib/reinstall-plan-store.ts
 /**
-* Render a path for the copy-pasteable `cd` hint so the printed command
-* enters the directory that was actually created:
-* - Prefixes `./` when the path starts with `~` (blocks tilde expansion —
-*   the clone went into a literal `~…` directory under CWD) or `-` (stops
-*   `cd` from parsing it as an option).
-* - Otherwise single-quotes anything beyond safe characters, escaping
-*   embedded single quotes POSIX-style (`'\''`).
+* Plan receipts for `fluid mist droplet reinstall`.
+*
+* Mist Desktop's agent must show a dry-run plan and get explicit approval
+* before it may confirm the irreversible replacement. A CLI has no
+* conversation to hold that sequence, so `--dry-run` records a receipt of
+* the exact Droplet, installation and lifecycle URLs it showed, and
+* `--confirm` refuses unless a receipt for the same plan is younger than
+* {@link REINSTALL_PLAN_TTL_MS}. `--confirm` claims the receipt atomically
+* (a rename only one process can win) before checking it, so one plan
+* approves at most one attempt and every retry needs a fresh plan.
+*
+* Receipts live under the Fluid config dir (`~/.fluid/mist/reinstall-plans`)
+* and hold only ids and a timestamp — no tokens or secrets.
 */
-function quotePathIfNeeded(path) {
-	const prefixed = /^[~-]/.test(path) ? `./${path}` : path;
-	if (/^[A-Za-z0-9_./-]+$/.test(prefixed)) return prefixed;
-	return `'${prefixed.replace(/'/g, "'\\''")}'`;
+/** How long a shown plan stays valid for `--confirm`. */
+const REINSTALL_PLAN_TTL_MS = 900 * 1e3;
+function createFileReinstallPlanStore(dir = join(getConfigDir(), "mist", "reinstall-plans")) {
+	const fileFor = (mistId) => join(dir, `${encodeURIComponent(mistId)}.json`);
+	return {
+		save(receipt) {
+			mkdirSync(dir, {
+				recursive: true,
+				mode: 448
+			});
+			writeFileSync(fileFor(receipt.mistId), JSON.stringify(receipt, null, 2) + "\n", {
+				encoding: "utf8",
+				mode: 384
+			});
+		},
+		load(mistId) {
+			try {
+				const parsed = JSON.parse(readFileSync(fileFor(mistId), "utf8"));
+				return isReceipt(parsed) && parsed.mistId === mistId ? parsed : null;
+			} catch {
+				return null;
+			}
+		},
+		claim(mistId) {
+			const claimed = `${fileFor(mistId)}.claimed-${process.pid}-${randomUUID()}`;
+			try {
+				renameSync(fileFor(mistId), claimed);
+			} catch {
+				return null;
+			}
+			try {
+				const parsed = JSON.parse(readFileSync(claimed, "utf8"));
+				return isReceipt(parsed) && parsed.mistId === mistId ? parsed : null;
+			} catch {
+				return null;
+			} finally {
+				rmSync(claimed, { force: true });
+			}
+		}
+	};
 }
-const cloneCommand = new Command("clone").description("Clone the mist's GitHub repo (mints a fresh token per call)").argument("[slug]", "The mist slug (defaults to .mist file in CWD)").option("--dir <dir>", "Target directory (defaults to ./<vendor-name>/)").action((slug, opts) => runAction(async () => {
-	await ensureGitAvailable();
-	const resolvedSlug = resolveSlug(slug);
-	const client = createMistClient();
-	const spinner = ora("Resolving mist…").start();
-	const { mist } = await showMist(client, resolvedSlug);
-	spinner.text = "Minting git credential…";
-	const { git_credential: cred } = await createGitCredential(client, mist.slug);
-	const dirName = mist.name ?? mist.vendor_name ?? mist.slug;
-	const targetDir = resolve(opts.dir ?? dirName);
-	if (existsSync(targetDir)) {
-		spinner.fail(`Directory ${targetDir} already exists. Pass --dir or remove it first.`);
-		process.exit(1);
-	}
-	spinner.text = `Cloning into ${dirName}/…`;
-	try {
-		await gitClone(cred.remote_url, targetDir);
-	} catch (err) {
-		spinner.fail("git clone failed");
-		throw err;
-	}
-	writeMistFile(targetDir, mist);
-	spinner.succeed(`Cloned into ${chalk.cyan(targetDir)}`);
-	const displayPath = opts.dir ?? join(".", dirName);
-	console.log(chalk.dim(`  cd ${quotePathIfNeeded(displayPath)}`));
-	if (mist.public_url) console.log(chalk.dim(`  ${chalk.cyan(mist.public_url)}`));
-}));
-//#endregion
-//#region src/api/deployments.ts
-async function listDeployments(client, slug, limit) {
-	const id = await resolveMistId(client, slug);
-	return client.get(`/api/v202604/mists/${id}/deployments`, limit != null ? { limit } : void 0);
+/** Whether `receipt` approves executing the freshly computed plan. */
+function checkPlanReceipt(receipt, fresh, now) {
+	if (!receipt) return {
+		ok: false,
+		code: "plan_required"
+	};
+	const plannedAt = Date.parse(receipt.plannedAt);
+	if (!Number.isFinite(plannedAt) || now - plannedAt > 9e5) return {
+		ok: false,
+		code: "plan_stale"
+	};
+	if (plannedAt > now) return {
+		ok: false,
+		code: "plan_stale"
+	};
+	if (receipt.dropletUuid !== fresh.dropletUuid || receipt.installationUuid !== fresh.installationUuid || receipt.embedUrl !== fresh.embedUrl || receipt.installWebhookUrl !== fresh.installWebhookUrl || receipt.uninstallWebhookUrl !== fresh.uninstallWebhookUrl) return {
+		ok: false,
+		code: "plan_changed"
+	};
+	return { ok: true };
 }
-async function showDeployment(client, slug, deploymentId) {
-	const id = await resolveMistId(client, slug);
-	return client.get(`/api/v202604/mists/${id}/deployments/${deploymentId}`);
+function isReceipt(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const record = value;
+	return typeof record["mistId"] === "string" && typeof record["dropletUuid"] === "string" && typeof record["installationUuid"] === "string" && typeof record["embedUrl"] === "string" && typeof record["installWebhookUrl"] === "string" && typeof record["uninstallWebhookUrl"] === "string" && typeof record["plannedAt"] === "string";
 }
 //#endregion
-//#region src/api/me.ts
-async function fetchCurrentUser(client) {
-	const raw = await client.get("/api/me");
-	const composed = [raw.first_name, raw.last_name].filter(Boolean).join(" ").trim();
-	const fullName = raw.full_name ?? (composed.length > 0 ? composed : null);
+//#region src/lib/droplet-repair.ts
+/**
+* Orchestration for `fluid mist droplet repair` and
+* `fluid mist droplet reinstall`, ported from Mist Desktop's
+* `repair_droplet_lifecycle_webhooks` and `repair_and_reinstall_droplet`
+* tools (`apps/mist-desktop/src/main/tools/index.ts` in the fluid repo).
+*
+* The planning and safety rules are shared through `@fluid-app/mist-core`
+* (`droplet-lifecycle-repair`, `droplet-replacement`); this module only
+* wires them to the CLI's API client, the `.mist` marker and the plan
+* receipt store. Every function takes its client and collaborators as
+* arguments so tests drive it with fakes.
+*/
+/** A refusal: the command stops before (or instead of) mutating anything
+*  and exits non-zero. `code` is stable for scripts. */
+var DropletRepairRefusal = class extends Error {
+	code;
+	constructor(code, message) {
+		super(message);
+		this.name = "DropletRepairRefusal";
+		this.code = code;
+	}
+};
+/**
+* Resolve the Mist (slug argument or the `.mist` in `cwd`), its public URL,
+* the Droplet it is attached to, and the canonical Droplet URLs. Refuses
+* when the Mist has no public URL or no attached Droplet.
+*/
+async function resolveRepairTarget(client, input) {
+	const slug = resolveSlug(input.slug, input.cwd);
+	const marker = readMistFileFrom(input.cwd);
+	const isCwdProject = marker !== null && marker.slug === slug;
+	const mistId = await resolveMistId(client, slug);
+	const { mist } = await showMist(client, mistId);
+	const publicUrl = normalizePublicUrl(mist.public_url);
+	if (!publicUrl) throw new DropletRepairRefusal("no_public_url", "Mist has no public_url yet. Publish the Mist first (`fluid mist push`), then repair lifecycle webhooks.");
+	const dropletUuid = await resolveAttachedDropletUuid(client, mist, mistId, publicUrl);
+	const paths = isCwdProject ? readLifecyclePaths(input.cwd) : null;
 	return {
-		id: raw.id,
-		public_id: raw.public_id ?? String(raw.id),
-		full_name: fullName,
-		first_name: raw.first_name ?? null,
-		last_name: raw.last_name ?? null,
-		email: raw.email ?? null
+		mistId,
+		mistSlug: mist.slug ?? slug,
+		dropletUuid,
+		canonical: canonicalDropletUrls(publicUrl, paths ?? DEFAULT_DROPLET_LIFECYCLE_PATHS),
+		lifecyclePathsSource: paths ? "fluid.capabilities.json" : "defaults"
 	};
 }
-//#endregion
-//#region src/commands/push.ts
 /**
-* `fluid mist push [--watch]` — mints a credential, pushes to origin, and
-* (with --watch) polls /deployments until READY/ERROR. Spec §3 + §4.
+* The Mist's own Droplet. The server-owned link wins (the Mist record, then
+* its droplet integration point); matching `embed_url` is only a legacy
+* fallback, because a broken embed URL is exactly what the repair fixes.
 */
-/** Used when there's no `-m` and no readable diff to describe. */
-const FALLBACK_ACTION = "Publish from Mist Desktop";
-const POLL_MS$1 = 2e3;
-const LOCATE_TIMEOUT_MS = 2 * 6e4;
-const READY_TIMEOUT_MS = 5 * 6e4;
-const PUBLIC_URL_TIMEOUT_MS = 5e3;
-function sleep$1(ms) {
-	return new Promise((r) => setTimeout(r, ms));
-}
-async function withTimeout(promise, timeoutMs) {
-	let timer = null;
+async function resolveAttachedDropletUuid(client, mist, mistId, publicUrl) {
+	if (typeof mist.droplet?.uuid === "string" && mist.droplet.uuid.length > 0) return mist.droplet.uuid;
 	try {
-		return await Promise.race([promise, new Promise((_, reject) => {
-			timer = setTimeout(() => reject(/* @__PURE__ */ new Error(`timed out after ${timeoutMs / 1e3}s`)), timeoutMs);
-		})]);
-	} finally {
-		if (timer) clearTimeout(timer);
+		const { integration_points } = await listIntegrationPoints(client, mistId);
+		const attached = findDropletIntegrationPoint(integration_points);
+		if (attached?.integratable_uuid) return attached.integratable_uuid;
+		if (attached?.integratable_id != null) {
+			const uuid = await findDropletUuidByNumericId(client, attached.integratable_id);
+			if (uuid) return uuid;
+		}
+	} catch (err) {
+		if (err instanceof MistApiError && err.status === 0) throw err;
+	}
+	const byEmbedUrl = publicUrl ? await findDropletByEmbedUrl(client, publicUrl) : null;
+	if (byEmbedUrl) {
+		if (!byEmbedUrl.uuid) throw new DropletRepairRefusal("droplet_not_found", `Droplet with embed_url ${publicUrl} was found, but its API response did not include a uuid.`);
+		return byEmbedUrl.uuid;
 	}
+	throw new DropletRepairRefusal("droplet_not_found", "This Mist is not attached to a Droplet, and no Droplet with a matching embed_url was found. Attach or recreate the Droplet first (`fluid mist attach-droplet`), then retry.");
 }
-const pushCommand = new Command("push").description("Commit working-tree changes and push to the Mist-managed remote (triggers a hosted deployment)").argument("[slug]", "The mist slug (defaults to .mist file in CWD)").option("--watch", "Poll /deployments until ready or error").option("--branch <name>", "Branch to push (default: main)").option("--no-commit", "Skip the auto-commit step (push existing commits only)").option("-m, --message <message>", "Commit message for the auto-commit (default: timestamped Publish)").action((slug, opts) => runAction(async () => {
-	await ensureGitAvailable();
-	const resolved = resolveSlug(slug);
-	const client = createMistClient();
-	const branch = opts.branch ?? "main";
-	const cwd = process.cwd();
-	const driftSpinner = ora("Checking for remote changes…").start();
+/** Lifecycle paths from `fluid.capabilities.json`, or null when absent or
+*  unreadable (the caller then uses the defaults). */
+function readLifecyclePaths(cwd) {
+	const file = join(cwd, "fluid.capabilities.json");
+	if (!existsSync(file)) return null;
 	try {
-		const { git_credential: fetchCred } = await createGitCredential(client, resolved);
-		await gitFetch(cwd, fetchCred.remote_url, branch);
-		const { ahead, behind } = await gitAheadBehindVsFetchHead(cwd);
-		if (behind > 0 && ahead === 0) {
-			const wasDirty = await hasUncommittedChanges(cwd);
-			driftSpinner.text = `Pulling ${behind} commit${behind === 1 ? "" : "s"} from origin/main…`;
-			if (wasDirty) await gitStash(cwd, "mist-push: pre-pull stash");
-			try {
-				await gitMergeFastForward(cwd);
-			} finally {
-				if (wasDirty) await gitStashPop(cwd);
-			}
-			driftSpinner.succeed(`Pulled ${behind} commit${behind === 1 ? "" : "s"} from origin/main`);
-		} else if (behind > 0 && ahead > 0) {
-			driftSpinner.fail(`Your branch and origin/main have diverged (you're ${ahead} ahead, ${behind} behind).`);
-			console.error(chalk.yellow("  Resolve in a terminal: `git pull --rebase`, fix any conflicts, then re-run Publish."));
-			process.exit(1);
-		} else driftSpinner.succeed("Up to date with origin/main");
-	} catch (err) {
-		if (err instanceof Error && err.message.includes("Resolve in a terminal")) throw err;
-		driftSpinner.fail("Couldn't sync with origin/main");
-		throw err;
+		return dropletLifecyclePathsFromCapabilities(JSON.parse(readFileSync(file, "utf8")));
+	} catch {
+		return null;
 	}
-	if (opts.commit !== false) {
-		if (await hasUncommittedChanges(cwd)) {
-			const explicit = opts.message?.trim();
-			const actor = await resolveGitSyncActor(async () => {
-				try {
-					return gitSyncActorFromMe(await withTimeout(fetchCurrentUser(client), 5e3));
-				} catch (err) {
-					const reason = err instanceof Error ? err.message : String(err);
-					console.warn(chalk.yellow(`  (skipping user-stamp on commit — couldn't fetch /api/me: ${reason})`));
-					return null;
-				}
-			});
-			let subject = "";
-			const commitSpinner = ora("Committing changes…").start();
-			try {
-				await gitAutoCommit(cwd, (changes) => {
-					subject = gitSyncCommitSubject(explicit || summarizeChanges(changes) || FALLBACK_ACTION, actor);
-					return subject;
-				});
-				commitSpinner.succeed(subject ? `Committed — ${subject}` : "Committed");
-			} catch (err) {
-				commitSpinner.fail("Commit failed");
-				throw err;
-			}
-		}
-	}
-	const spinner = ora("Minting git credential…").start();
-	const { git_credential: cred } = await createGitCredential(client, resolved);
-	spinner.text = `Pushing ${branch} to origin…`;
-	try {
-		await gitPush(cwd, cred.remote_url, branch);
-	} catch (err) {
-		spinner.fail("git push failed");
-		throw err;
-	}
-	spinner.succeed("Push complete");
-	if (!opts.watch) return;
-	let pushedSha = null;
-	try {
-		const { execa } = await import("execa");
-		pushedSha = (await execa("git", ["rev-parse", "HEAD"], { cwd })).stdout.trim();
-	} catch {}
-	const locateStart = Date.now();
-	let deploymentId = null;
-	let attempt = 0;
-	while (Date.now() - locateStart < LOCATE_TIMEOUT_MS) {
-		attempt++;
-		const { deployments } = await listDeployments(client, resolved, 5);
-		const match = pushedSha ? deployments.find((d) => d.commit_sha === pushedSha) : deployments[0];
-		if (match) {
-			deploymentId = match.id;
-			console.log(`Located deployment ${match.id} (${match.state})`);
-			break;
-		}
-		if (attempt === 1) console.log(`Locating deployment for commit ${pushedSha?.slice(0, 7) ?? "(unknown)"}…`);
-		else if (attempt % 5 === 0) console.log(`  …still waiting (${attempt * 2}s elapsed)`);
-		await sleep$1(POLL_MS$1);
-	}
-	if (!deploymentId) {
-		console.warn(chalk.yellow(`Push succeeded, but hosting has not started commit ${pushedSha?.slice(0, 7) ?? "(unknown)"} after ${LOCATE_TIMEOUT_MS / 1e3}s.`));
-		console.warn(chalk.yellow("The deployment is still queued and may appear later. Run `fluid mist deployments` to check it — do not retry or rewrite the commit just because the hosting queue is slow."));
-		return;
-	}
-	const readyStart = Date.now();
-	let lastState = null;
-	while (Date.now() - readyStart < READY_TIMEOUT_MS) {
-		const { deployment } = await showDeployment(client, resolved, deploymentId);
-		if (deployment.state !== lastState) {
-			console.log(`  ${deployment.state}…`);
-			lastState = deployment.state;
-		}
-		if (deployment.state === "ready") {
-			let publicUrl = null;
-			try {
-				publicUrl = (await withTimeout(showMist(client, resolved), PUBLIC_URL_TIMEOUT_MS)).mist.public_url;
-			} catch (err) {
-				const reason = err instanceof Error ? err.message : String(err);
-				console.warn(chalk.yellow(`  Deployment is ready, but the public URL lookup failed: ${reason}`));
-			}
-			console.log(readyDeploymentMessage(publicUrl, resolved));
-			return;
-		}
-		if (deployment.state === "error" || deployment.state === "canceled") {
-			console.error(`✘ Deployment ${deployment.state}`);
-			process.exit(3);
-		}
-		await sleep$1(POLL_MS$1);
-	}
-	console.error(`Watch timed out after ${READY_TIMEOUT_MS / 1e3}s. Last state: ${lastState}.`);
-	console.error("Run `fluid mist deployments` to check the latest state.");
-	process.exit(3);
-}));
-//#endregion
-//#region src/commands/pull.ts
-/** `fluid mist pull` — git pull origin main. Spec §3. */
-const pullCommand = new Command("pull").description("git pull from the Mist-managed remote").argument("[slug]", "The mist slug (defaults to .mist file in CWD)").option("--branch <name>", "Branch to pull (default: main)").action((slug, opts) => runAction(async () => {
-	await ensureGitAvailable();
-	const resolved = resolveSlug(slug);
-	const client = createMistClient();
-	const branch = opts.branch ?? "main";
-	const spinner = ora("Minting git credential…").start();
-	const { git_credential: cred } = await createGitCredential(client, resolved);
-	spinner.text = `Pulling ${branch}…`;
-	try {
-		await gitPull(process.cwd(), cred.remote_url, branch);
-	} catch (err) {
-		spinner.fail("git pull failed");
-		throw err;
-	}
-	spinner.succeed("Pull complete");
-}));
-//#endregion
-//#region src/commands/open.ts
-/** `fluid mist open` — opens public_url in the default browser. Spec §3. */
-const openCommand = new Command("open").description("Open the mist's public URL in your browser").argument("[slug]", "The mist slug (defaults to .mist file in CWD)").action((slug) => runAction(async () => {
-	const resolved = resolveSlug(slug);
-	const { mist } = await showMist(createMistClient(), resolved);
-	if (!mist.public_url) {
-		console.error(chalk.yellow(`Mist ${mist.slug} has no public URL yet (state: ${mist.state}).`));
-		process.exit(1);
-	}
-	console.log(chalk.cyan(mist.public_url));
-	await open(mist.public_url);
-}));
-//#endregion
-//#region src/commands/deployments.ts
-/** `fluid mist deployments` — list recent deployments. Spec §3. */
-const STATE_COLOR = {
-	ready: chalk.green,
-	building: chalk.yellow,
-	queued: chalk.dim,
-	error: chalk.red,
-	canceled: chalk.red
-};
-const deploymentsCommand = new Command("deployments").description("List recent deployments for a mist").argument("[slug]", "The mist slug (defaults to .mist file in CWD)").option("--limit <n>", "How many to fetch (default 10)").option("--json", "Emit raw API JSON").action((slug, opts) => runAction(async () => {
-	const resolved = resolveSlug(slug);
-	const response = await listDeployments(createMistClient(), resolved, opts.limit ? parseInt(opts.limit, 10) : 10);
-	if (opts.json) return printJson(response);
-	const deployments = response.deployments ?? [];
-	if (deployments.length === 0) {
-		console.log(chalk.dim("No deployments yet."));
-		return;
-	}
-	printTable([[
-		chalk.bold("ID"),
-		chalk.bold("STATE"),
-		chalk.bold("COMMIT"),
-		chalk.bold("MESSAGE"),
-		chalk.bold("AGE")
-	], ...deployments.map((d) => [
-		d.id,
-		(STATE_COLOR[d.state] ?? chalk.white)(d.state),
-		d.commit_sha ? d.commit_sha.slice(0, 7) : chalk.dim("—"),
-		d.commit_message ? d.commit_message.slice(0, 48) : chalk.dim("—"),
-		relativeDate(d.created_at)
-	])]);
-}));
-//#endregion
-//#region src/api/logs.ts
-async function fetchLogs(client, slug, params = {}) {
-	const id = await resolveMistId(client, slug);
-	return client.get(`/api/v202604/mists/${id}/logs`, params);
-}
-//#endregion
-//#region src/commands/logs.ts
-/** `fluid mist logs [--tail]` — poll /logs?since=<last> every 2s. Spec §4. */
-const POLL_MS = 2e3;
-function sleep(ms) {
-	return new Promise((r) => setTimeout(r, ms));
-}
-function levelColor(level) {
-	return level === "stderr" ? chalk.red : chalk.dim;
-}
-function printLine(entry) {
-	const ts = entry.timestamp.slice(11, 19);
-	process.stdout.write(`${chalk.dim(ts)} ${levelColor(entry.level)(entry.level.padEnd(6))} ${entry.message}\n`);
 }
-const logsCommand = new Command("logs").description("Fetch deployment logs (use --tail to stream)").argument("[slug]", "The mist slug (defaults to .mist file in CWD)").option("--tail", "Stream new logs every 2s").option("--limit <n>", "Initial fetch size (default 200)").option("--deployment <id>", "Logs from a specific deployment ID").option("--json", "Emit raw API JSON (one batch; ignored when --tail)").action((slug, opts) => runAction(async () => {
-	const resolved = resolveSlug(slug);
-	const client = createMistClient();
-	const limit = opts.limit ? parseInt(opts.limit, 10) : 200;
-	const initial = await fetchLogs(client, resolved, {
-		...opts.deployment ? { deployment_id: opts.deployment } : {},
-		limit
+/** Read the Droplet and report the planned repair without mutating. */
+async function planDropletRepair(client, target, dryRun) {
+	const { droplet } = await getDroplet(client, target.dropletUuid);
+	const { alreadyCorrect, summary } = planLifecycleRepair({
+		mistId: target.mistId,
+		mistSlug: target.mistSlug,
+		dropletUuid: target.dropletUuid,
+		canonical: target.canonical,
+		current: droplet,
+		dryRun
 	});
-	if (opts.json && !opts.tail) return printJson(initial);
-	for (const entry of initial.logs) printLine(entry);
-	if (!opts.tail) return;
-	process.stdout.write(`${chalk.dim(`Streaming production logs for ${resolved}${initial.deployment_id ? ` (deployment ${initial.deployment_id})` : ""} — waiting for new entries…`)}\n`);
-	let since = initial.logs.length > 0 ? initial.logs[initial.logs.length - 1].timestamp : (/* @__PURE__ */ new Date()).toISOString();
-	while (true) {
-		await sleep(POLL_MS);
-		const batch = await fetchLogs(client, resolved, {
-			...opts.deployment ? { deployment_id: opts.deployment } : {},
-			since,
-			limit
-		});
-		for (const entry of batch.logs) {
-			printLine(entry);
-			since = entry.timestamp;
+	return {
+		alreadyCorrect,
+		summary: {
+			...summary,
+			lifecyclePathsSource: target.lifecyclePathsSource
 		}
-	}
-}));
-//#endregion
-//#region src/lib/encrypted-env.ts
-/**
-* Detects Vercel-encrypted env var ciphertext.
-*
-* `GET /api/v202604/mists/:id/env_vars` is a thin proxy to the Mist's
-* Vercel project env — it returns values ENCRYPTED, never plaintext (see
-* apps/mist-desktop/src/main/services/mist-env-vars.service.ts:25-28,
-* which documents the same server behavior for the desktop app's copy of
-* this API). The ciphertext is a base64-encoded JSON envelope of shape
-* `{"v":"v2","c":"<base64 ciphertext>","k":[<byte array>]}`.
-*
-* `fluid mist env pull` uses this to avoid writing that ciphertext into
-* `.env.local` as if it were a usable value.
-*/
-const BASE64_RE = /^[A-Za-z0-9+/]+={0,2}$/;
-function looksLikeBase64(value) {
-	return value.length > 0 && value.length % 4 === 0 && BASE64_RE.test(value);
-}
-function hasEncryptedEnvelopeShape(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value) && "v" in value && "c" in value && "k" in value;
+	};
 }
 /**
-* True when `value` is the Vercel encrypted-env envelope: a base64 string
-* that decodes to a JSON object with the `{ v, c, k }` shape. Returns
-* false for empty strings, non-base64 strings, and base64 strings that
-* decode to plaintext or to JSON that doesn't match the envelope shape —
-* so real plaintext secrets that happen to look like base64 are never
-* misclassified as ciphertext.
+* PATCH only the embed and lifecycle webhook URLs, then re-read the Droplet
+* to verify. A no-op when they already match.
 */
-function isVercelEncryptedEnvValue(value) {
-	if (!looksLikeBase64(value)) return false;
-	let decoded;
+async function applyDropletRepair(client, target) {
+	const planned = await planDropletRepair(client, target, false);
+	if (planned.alreadyCorrect) return {
+		summary: planned.summary,
+		isError: false
+	};
+	await client.patch(`/api/droplets/${encodeURIComponent(target.dropletUuid)}`, dropletRepairPatch(target.canonical));
+	let verifyStatus = 200;
+	let verified = false;
 	try {
-		decoded = Buffer.from(value, "base64").toString("utf8");
-	} catch {
-		return false;
+		const { droplet } = await getDroplet(client, target.dropletUuid);
+		verified = dropletUrlsMatch(droplet, target.canonical);
+	} catch (err) {
+		verifyStatus = err instanceof MistApiError ? err.status : 0;
 	}
-	let parsed;
-	try {
-		parsed = JSON.parse(decoded);
-	} catch {
-		return false;
-	}
-	return hasEncryptedEnvelopeShape(parsed);
-}
-//#endregion
-//#region src/commands/env/list.ts
-/** `fluid mist env list` — list env vars; mark managed_by entries. Spec §4. */
-function maskValue(value) {
-	if (value.length <= 8) return "•".repeat(value.length);
-	return `${value.slice(0, 4)}${"•".repeat(8)}${value.slice(-2)}`;
+	return {
+		summary: {
+			...planned.summary,
+			status: verified ? "updated" : "error",
+			verified,
+			verifyStatus
+		},
+		isError: !verified
+	};
 }
+const PLAN_TTL_MINUTES = REINSTALL_PLAN_TTL_MS / 6e4;
 /**
-* Values come back Vercel-encrypted ciphertext (see
-* `../../lib/encrypted-env.ts`) — never show that raw blob, masked or not,
-* since it isn't the real secret and can run to ~1KB of base64.
+* `fluid mist droplet reinstall`. Same sequencing as Mist's
+* `repair_and_reinstall_droplet`: plan first, explicit approval, one
+* backend-owned replacement, resumable watching. Refusals return a
+* non-zero exit code; nothing irreversible starts without `--confirm`
+* matching a fresh `--dry-run` plan.
 */
-function displayValue(v, showValues) {
-	if (isVercelEncryptedEnvValue(v.value)) return chalk.dim("<encrypted>");
-	return showValues ? v.value : maskValue(v.value);
-}
-const envListCommand = new Command("list").description("List a mist's env vars").argument("[slug]", "The mist slug (defaults to .mist file in CWD)").option("--show-values", "Print full values instead of masking them").option("--json", "Emit raw API JSON").action((slug, opts) => runAction(async () => {
-	const resolved = resolveSlug(slug);
-	const response = await listEnvVars(createMistClient(), resolved);
-	if (opts.json) return printJson(response);
-	const vars = response.env_vars ?? [];
-	if (vars.length === 0) {
-		console.log(chalk.dim("No env vars."));
-		return;
-	}
-	printTable([[
-		chalk.bold("KEY"),
-		chalk.bold("VALUE"),
-		chalk.bold("TARGETS"),
-		chalk.bold("MANAGED")
-	], ...vars.map((v) => [
-		v.key,
-		displayValue(v, opts.showValues),
-		v.targets.join(","),
-		v.managed_by === "mist" ? chalk.magenta("mist") : chalk.dim("user")
-	])]);
-}));
-//#endregion
-//#region ../../mist/core/src/secret-generator.ts
-const MIN_BYTES = 16;
-const MAX_BYTES = 128;
-const DEFAULT_BYTES = 32;
-/** Return a random secret. Pure + synchronous so it's trivially
-*  testable (entropy + encoding + clamping) without any I/O. */
-function generateSecret(options = {}) {
-	const encoding = options.encoding ?? "base64url";
-	const requested = options.bytes ?? DEFAULT_BYTES;
-	const bytes = Math.min(MAX_BYTES, Math.max(MIN_BYTES, Math.trunc(requested)));
-	const buf = new Uint8Array(bytes);
-	globalThis.crypto.getRandomValues(buf);
-	return {
-		secret: encode(buf, encoding),
-		bytes,
-		encoding
+async function runDropletReinstall(deps, opts) {
+	const now = deps.now ?? Date.now;
+	const refusal = (code, message) => ({
+		output: {
+			status: "refused",
+			code,
+			message
+		},
+		exitCode: 1
+	});
+	if (opts.dryRun && opts.confirm) return refusal("conflicting_flags", "Pass either --dry-run (show the plan) or --confirm (execute it), not both.");
+	if (opts.dryRun && opts.resumeOperationId?.trim()) return refusal("conflicting_flags", "--resume keeps watching a replacement that already started; it does not take --dry-run. Run it with --installation only.");
+	const request = {
+		dryRun: opts.dryRun === true,
+		confirmDestructiveReinstall: opts.confirm === true,
+		installationUuid: opts.installationUuid?.trim() || void 0,
+		resumeOperationId: opts.resumeOperationId
 	};
+	const requestCheck = checkReplacementRequest(request);
+	if (!requestCheck.ok) return refusal(requestCheck.code, "--resume also needs --installation with the installationUuid from that same \"still_running\" result. Replacement status is scoped to the installation the operation started on, so resuming without it would watch the wrong one.");
+	const { resumeOperationId } = requestCheck;
+	if (!request.dryRun && replacementStartNeedsConfirmation(request, resumeOperationId)) return refusal("confirmation_required", opts.yes ? "--yes does not approve an irreversible reinstall. Run with --dry-run, review the exact dropletUuid and installationUuid, then rerun with --confirm." : "Refused to start an irreversible replacement without explicit confirmation. Run with --dry-run, review the exact dropletUuid and installationUuid, then rerun with --confirm.");
+	try {
+		const target = await resolveRepairTarget(deps.client, {
+			slug: deps.slug,
+			cwd: deps.cwd
+		});
+		const plannedRepair = await planDropletRepair(deps.client, target, true);
+		const installation = selectReplacementInstallation({
+			installations: await listAllDropletInstallations(deps.client),
+			dropletUuid: target.dropletUuid,
+			installationUuid: request.installationUuid,
+			resumeOperationId
+		});
+		if (!installation?.uuid) return refusal("installation_not_found", `No active installation for attached Droplet ${target.dropletUuid} was found. If a previous approved replacement terminalized the source, rerun with that plan's --installation <uuid>; otherwise install the Droplet once from Fluid first.`);
+		const installationUuid = installation.uuid;
+		const idempotencyKey = deps.newIdempotencyKey();
+		const planInput = {
+			dryRun: request.dryRun,
+			resumeOperationId,
+			mistId: target.mistId,
+			dropletUuid: target.dropletUuid,
+			installation: {
+				...installation,
+				uuid: installationUuid
+			},
+			idempotencyKey
+		};
+		if (request.dryRun) {
+			deps.planStore.save({
+				mistId: target.mistId,
+				dropletUuid: target.dropletUuid,
+				installationUuid,
+				...target.canonical,
+				plannedAt: new Date(now()).toISOString()
+			});
+			const confirmCommand = reinstallCommand(target.mistSlug, ["--confirm", ...request.installationUuid ? ["--installation", installationUuid] : []]);
+			return {
+				output: {
+					...buildReplacementPlan({
+						...planInput,
+						lifecycleRepair: plannedRepair.summary
+					}),
+					nextStep: `Review the dropletUuid and installationUuid above. This replacement is irreversible. To approve it, run \`${confirmCommand}\` within ${PLAN_TTL_MINUTES} minutes.`
+				},
+				exitCode: 0
+			};
+		}
+		let lifecycleRepair = plannedRepair.summary;
+		let startedOperation = null;
+		if (!resumeOperationId) {
+			const receiptCheck = checkPlanReceipt(deps.planStore.claim(target.mistId), {
+				dropletUuid: target.dropletUuid,
+				installationUuid,
+				...target.canonical
+			}, now());
+			if (!receiptCheck.ok) return refusal(receiptCheck.code, planReceiptMessage(receiptCheck.code));
+			const repaired = await applyDropletRepair(deps.client, target);
+			lifecycleRepair = repaired.summary;
+			if (repaired.isError) return {
+				output: {
+					status: "error",
+					code: "lifecycle_repair_failed",
+					message: "The Droplet lifecycle URLs did not verify after the repair, so no replacement was started.",
+					lifecycleRepair
+				},
+				exitCode: 1
+			};
+			startedOperation = await startDropletReplacement(deps.client, {
+				mistId: target.mistId,
+				installationUuid,
+				idempotencyKey
+			});
+		}
+		const plan = buildReplacementPlan({
+			...planInput,
+			lifecycleRepair
+		});
+		const operationId = resumeOperationId ?? startedOperation?.id;
+		if (!operationId) return {
+			output: {
+				...plan,
+				status: "error",
+				code: "missing_operation_id",
+				message: "Fluid accepted the replacement but did not return an operation id to watch."
+			},
+			exitCode: 1
+		};
+		const watchedForMs = opts.watchTimeoutMs ?? 12e4;
+		const watch = summarizeReplacementWatch({
+			plan,
+			pollResult: await pollDropletReplacement(deps.client, {
+				mistId: target.mistId,
+				installationUuid,
+				operationId,
+				timeoutMs: watchedForMs,
+				...deps.sleep ? { sleep: deps.sleep } : {}
+			}),
+			startedOperation,
+			operationId,
+			installationUuid,
+			watchedForMs,
+			nextStep: ({ operationId: id, installationUuid: source, stage }) => `Fluid is still working on this replacement: it is not finished and it did not fail. Current stage: ${stage}. Keep watching with \`${reinstallCommand(target.mistSlug, [
+				"--resume",
+				id,
+				"--installation",
+				source
+			])}\`. The reinstall is complete only when status is "succeeded".`
+		});
+		return {
+			output: { ...watch.result },
+			exitCode: watch.isError ? 1 : 0
+		};
+	} catch (err) {
+		if (err instanceof DropletRepairRefusal) return refusal(err.code, err.message);
+		throw err;
+	}
 }
-function encode(buf, encoding) {
-	if (encoding === "hex") return Array.from(buf, (byte) => byte.toString(16).padStart(2, "0")).join("");
-	const base64 = btoa(String.fromCharCode(...buf));
-	if (encoding === "base64") return base64;
-	return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+function reinstallCommand(slug, flags) {
+	return [
+		"fluid mist droplet reinstall",
+		slug,
+		...flags
+	].join(" ");
+}
+function planReceiptMessage(code) {
+	switch (code) {
+		case "plan_required": return "Refused: no reinstall plan has been shown for this Mist. Run with --dry-run first, review the plan, then rerun with --confirm.";
+		case "plan_stale": return `Refused: the reinstall plan is older than ${PLAN_TTL_MINUTES} minutes. Run with --dry-run again, review the plan, then rerun with --confirm.`;
+		case "plan_changed": return "Refused: the Droplet, installation or lifecycle URLs changed since the plan was shown. Run with --dry-run again, review the new plan, then rerun with --confirm.";
+	}
 }
 //#endregion
-//#region src/commands/env/set.ts
+//#region src/lib/droplet-egress.ts
+/**
+* Ask Fluid for, or withdraw, egress through its egress proxy for the Mist's
+* attached Droplet (`fluid mist droplet egress-proxy`). The owner's ask is the
+* droplet's `egress_proxy_requested`; the grant the proxy honours,
+* `egress_proxy_enabled`, is set by a Fluid root admin, who approves it.
+* Withdrawing the request also withdraws the grant.
+*/
+/** Why a droplet response can lack the egress fields. Fluid returns them only
+*  to company admins (and root admins), and older Fluids not at all. */
+const EGRESS_NOT_RETURNED = "Fluid did not return the droplet's egress fields: only a company admin can see or ask for egress, or this Fluid predates it.";
+/** Fluid refused the egress request outright (401): it accepts one only
+*  from a company admin. Distinct from an older Fluid, which ignores the
+*  field and omits it from the response. */
+const EGRESS_REFUSED = "Fluid refused the egress request: only a company admin can ask for egress. The droplet was set up without it.";
+/** Whether an API error is Fluid refusing the egress request: a 401 whose
+*  `errors` names `egress_proxy_requested`. Matched exactly, so a real
+*  authentication failure is reported as one rather than as a refusal. */
+function isEgressRefusal(error) {
+	return error instanceof MistApiError && error.status === 401 && error.fieldErrors?.egress_proxy_requested !== void 0;
+}
+/** The API answered without the egress fields. */
+var EgressProxyUnsupportedError = class extends Error {
+	constructor() {
+		super(EGRESS_NOT_RETURNED);
+		this.name = "EgressProxyUnsupportedError";
+	}
+};
 /**
-* `fluid mist env set <slug> KEY=value [KEY=value ...]` — POST for new
-* keys, PATCH for existing. Spec §3 + §4.
-*
-* `fluid mist env set [slug] KEY --generate [--bytes N]` mints a random
-* secret for KEY instead (the generator Mist's `set_mist_env_var` uses),
-* writes it, and prints it exactly once.
+* Set the attached droplet's egress request. Reads it first so an
+* already-correct droplet is left untouched, then PATCHes and trusts only
+* the values the API returns.
 */
-/** Env var name rule enforced by Rails (mirrors Mist's ENV_KEY_RE). */
-const ENV_KEY_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
-const GENERATED_SECRET_NOTICE = "This secret is shown once and won't be shown again; Fluid stores it encrypted. Copy it now if you also need it in .env.local. Redeploy (fluid mist push) for the change to take effect.";
-function parsePair(pair) {
-	const eq = pair.indexOf("=");
-	if (eq <= 0) throw new Error(`Invalid pair "${pair}". Use KEY=value (no leading spaces).`);
+async function setDropletEgressProxy(client, input) {
+	const slug = resolveSlug(input.slug, input.cwd);
+	const mistId = await resolveMistId(client, slug);
+	const { mist } = await showMist(client, mistId);
+	const dropletUuid = await resolveAttachedDropletUuid(client, mist, mistId, mist.public_url ?? null);
+	const mistSlug = mist.slug ?? slug;
+	const current = (await getDroplet(client, dropletUuid)).droplet;
+	if (current.egress_proxy_requested === void 0) throw new EgressProxyUnsupportedError();
+	const grantLeftOn = !input.requested && current.egress_proxy_enabled === true;
+	if (current.egress_proxy_requested === input.requested && !grantLeftOn) return {
+		mistSlug,
+		dropletUuid,
+		requested: current.egress_proxy_requested,
+		granted: current.egress_proxy_enabled === true,
+		changed: false
+	};
+	const updated = (await updateDroplet(client, dropletUuid, { egress_proxy_requested: input.requested })).droplet;
+	if (updated.egress_proxy_requested === void 0) throw new EgressProxyUnsupportedError();
 	return {
-		key: pair.slice(0, eq),
-		value: pair.slice(eq + 1)
+		mistSlug,
+		dropletUuid,
+		requested: updated.egress_proxy_requested,
+		granted: updated.egress_proxy_enabled === true,
+		changed: true
 	};
 }
-function parseBytes(value) {
-	const bytes = Number(value);
-	if (!Number.isInteger(bytes) || bytes < 16 || bytes > 128) throw new InvalidArgumentError("Use a whole number from 16 to 128.");
-	return bytes;
-}
-/**
-* Generate a secret for `key` and write it to the Mist. Refuses invalid
-* and Mist-managed keys BEFORE generating, so a secret is only ever
-* returned once it has been stored.
-*/
-async function setGeneratedEnvVar(client, slug, key, bytes) {
-	if (!ENV_KEY_RE.test(key)) throw new Error(`Invalid env var name "${key}". Use letters, digits and underscores, not starting with a digit.`);
-	const current = ((await listEnvVars(client, slug)).env_vars ?? []).find((v) => v.key === key);
-	if (current?.managed_by === "mist") throw new Error(`"${key}" is managed by Fluid and can't be set; it is provisioned automatically for the Mist.`);
-	const secret = generateSecret(bytes === void 0 ? {} : { bytes });
-	if (current) await updateEnvVar(client, slug, key, secret.secret);
-	else await createEnvVar(client, slug, key, secret.secret);
-	return {
-		key,
-		action: current ? "updated" : "created",
-		generatedSecret: secret.secret,
-		bytes: secret.bytes,
-		encoding: secret.encoding,
-		note: GENERATED_SECRET_NOTICE
-	};
-}
-const envSetCommand = new Command("set").description("Set one or more env vars (KEY=value KEY=value …), or generate a secret for KEY with --generate").argument("<slug-or-pair>", "The mist slug, or the first KEY=value pair (or KEY with --generate)").argument("[pairs...]", "Additional KEY=value pairs (or KEY with --generate)").option("--generate", "Generate a random secret as the value of one KEY and print it once").option("--bytes <n>", "Entropy for --generate, in bytes (16-128, default 32)", parseBytes).option("--json", "Emit JSON (with --generate)").action(async (slugOrPair, pairs, opts) => {
-	await runAction(async () => {
-		if (opts.generate) {
-			await runGenerate([slugOrPair, ...pairs], opts);
-			return;
-		}
-		if (opts.bytes !== void 0) {
-			console.error(chalk.red("--bytes only applies with --generate."));
-			process.exit(1);
-		}
-		let slug;
-		let rawPairs;
-		if (slugOrPair.includes("=")) {
-			slug = resolveSlug();
-			rawPairs = [slugOrPair, ...pairs];
-		} else {
-			slug = resolveSlug(slugOrPair);
-			rawPairs = pairs;
-		}
-		if (rawPairs.length === 0) {
-			console.error(chalk.red("Pass at least one KEY=value pair."));
-			process.exit(1);
-		}
-		const client = createMistClient();
-		const existing = await listEnvVars(client, slug);
-		const existingKeys = new Set((existing.env_vars ?? []).map((v) => v.key));
-		for (const raw of rawPairs) {
-			const { key, value } = parsePair(raw);
-			if (existingKeys.has(key)) {
-				await updateEnvVar(client, slug, key, value);
-				console.log(`${chalk.green("updated")}  ${key}`);
-			} else {
-				await createEnvVar(client, slug, key, value);
-				console.log(`${chalk.cyan("created")}  ${key}`);
-			}
-		}
-	});
-});
-/** `env set [slug] KEY --generate`: exactly one KEY, without a value. */
-async function runGenerate(args, opts) {
-	if (args.length > 2) {
-		console.error(chalk.red("--generate sets one key at a time: env set [slug] KEY --generate"));
-		process.exit(1);
-	}
-	const [first, second] = args;
-	const key = (second ?? first ?? "").trim();
-	if (key.includes("=")) {
-		console.error(chalk.red(`--generate creates the value itself; pass the key alone (e.g. ${key.split("=")[0]}).`));
-		process.exit(1);
-	}
-	const slug = second === void 0 ? resolveSlug() : resolveSlug(first);
-	const result = await setGeneratedEnvVar(createMistClient(), slug, key, opts.bytes);
-	if (opts.json) {
-		printJson(result);
-		return;
-	}
-	const verb = result.action === "updated" ? chalk.green("updated") : chalk.cyan("created");
-	console.log(`${verb}  ${result.key}  (${result.bytes}-byte generated secret)`);
-	console.log();
-	console.log(result.generatedSecret);
-	console.log();
-	console.log(chalk.yellow(result.note));
-}
-//#endregion
-//#region src/commands/env/unset.ts
-/** `fluid mist env unset <slug> KEY [KEY ...]` — DELETE per key. Spec §3. */
-const envUnsetCommand = new Command("unset").description("Delete one or more env vars").argument("<slug-or-key>", "The mist slug, or the first KEY (if .mist file is present)").argument("[keys...]", "Additional keys").action(async (slugOrKey, keys) => {
-	await runAction(async () => {
-		let slug;
-		let toDelete;
-		if (/^[A-Z_][A-Z0-9_]*$/.test(slugOrKey)) {
-			slug = resolveSlug();
-			toDelete = [slugOrKey, ...keys];
-		} else {
-			slug = resolveSlug(slugOrKey);
-			toDelete = keys;
-		}
-		if (toDelete.length === 0) {
-			console.error(chalk.red("Pass at least one KEY."));
-			process.exit(1);
-		}
-		const client = createMistClient();
-		for (const key of toDelete) {
-			await deleteEnvVar(client, slug, key);
-			console.log(`${chalk.red("deleted")}  ${key}`);
-		}
-	});
-});
 //#endregion
-//#region src/commands/env/pull.ts
+//#region src/lib/surface-provision.ts
 /**
-* `fluid mist env pull` — writes `.env.local` with user-managed vars only.
-* Skips `managed_by: "mist"` entries (DATABASE_URL, FLUID_*) since local
-* dev uses PGlite, not the production database. Spec §4 + §5.
+* Surface provisioning engine — the one place the "create a Fluid surface and
+* wire it to a mist" flow lives, at parity with Mist Desktop's
+* mist-integration-points-api.service.ts. Exposed via `fluid mist create`
+* (create a bare mist first, then run this), `fluid mist attach` (any kind),
+* and `fluid mist attach-droplet` (droplet shortcut).
 *
-* Also skips user-managed vars whose value comes back as Vercel-encrypted
-* ciphertext (`GET .../env_vars` is a proxy to Vercel's project env, which
-* never returns plaintext — see `../../lib/encrypted-env.ts`). Writing that
-* ciphertext into `.env.local` verbatim would silently produce an unusable
-* file, so those keys are collected and surfaced as a warning instead.
+* Three surface kinds, each with its own create endpoint + attach identifier:
+*   - droplet     → POST /api/droplets              → drp_ uuid → integratable_uuid
+*   - drop-zone   → POST /api/drop_zones            → dz_  uuid → integratable_uuid
+*   - mobile-embed→ POST /api/company/mobile_widgets→ numeric id → integratable_id
 *
-* The output file is MERGED, not replaced: pulled plaintext values update
-* their existing lines (or are appended), while every other existing line
-* — comments, locally maintained secrets for encrypted/managed keys, and
-* local-only vars — is preserved verbatim. Replacing the file wholesale
-* would delete manually set values for skipped keys, and an all-encrypted
-* response would truncate the file to zero bytes right before telling the
-* user to set those same values locally.
+* Design tenets (repo philosophy — "server is source of truth"):
+*   - No local progress file. State is re-derived from the API each run.
+*   - Attach-existing is idempotent: if an integration point already links the
+*     target surface (matched via the #19689 integratable_uuid echo, or the
+*     numeric id for mobile), skip. A droplet is 1-per-mist, so creating a new
+*     droplet also skips when one is already attached. Drop-zones/mobile
+*     embeds are additive (a mist can have many).
+*   - Only a droplet attach provisions managed env keys
+*     (FLUID_DROPLET_UUID/_SECRET/_WEBHOOK_AUTH_TOKEN); this flow only
+*     VERIFIES they landed — it never writes them (the API 422s on write).
+*   - A droplet must also be INSTALLED (POST /api/droplet_installations) —
+*     create + link alone leave it not-connected/inactive, so install-scoped
+*     features (dit/dex exchange, admin embeds, install webhooks) don't work.
+*     The install step is idempotent (skips when an installation exists).
 */
-function escapeValue(v) {
-	if (/[\s#"']/.test(v)) return `"${v.replace(/(["\\$`])/g, "\\$1")}"`;
-	return v;
-}
+const DEFAULT_TIMING = {
+	publicUrlTimeoutMs: 9e4,
+	publicUrlIntervalMs: 3e3,
+	envTimeoutMs: 12e4,
+	envIntervalMs: 5e3
+};
+const defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+const KIND_LABEL$1 = {
+	droplet: "droplet",
+	"drop-zone": "drop zone",
+	"mobile-embed": "mobile embed"
+};
 /**
-* Splits the raw env-var list into what `env pull` can safely write vs.
-* what it must skip, and why. Pure — no I/O — so it's unit-testable
-* without mocking the API client or the filesystem.
+* Create (or reuse) a surface of `kind` and wire it to the mist. Idempotent
+* for droplet + attach-existing; additive for new drop-zones/mobile embeds.
 */
-function partitionPullEnvVars(envVars) {
-	const plaintext = [];
-	const encrypted = [];
-	const managed = [];
-	for (const v of envVars) if (v.managed_by === "mist") managed.push(v);
-	else if (isVercelEncryptedEnvValue(v.value)) encrypted.push(v);
-	else plaintext.push(v);
-	return {
-		plaintext,
-		encrypted,
-		managed
+async function provisionSurface(client, options) {
+	const { reporter, slugOrId, kind } = options;
+	const timing = {
+		...DEFAULT_TIMING,
+		...options.timing
 	};
-}
-/** Matches a `KEY=` / `export KEY=` assignment line and captures the key. */
-const ENV_ASSIGNMENT = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=/;
-/**
-* Merges pulled plaintext vars into the existing env-file contents.
-* Existing assignment lines for pulled keys are updated in place; every
-* other line (comments, blank lines, locally maintained values for keys
-* the pull skipped) is preserved verbatim; new keys are appended. Pure —
-* no I/O — so it's unit-testable without touching the filesystem.
-*/
-function mergeEnvContents(existing, plaintext) {
-	const updates = new Map(plaintext.map((v) => [v.key, `${v.key}=${escapeValue(v.value)}`]));
-	const lines = existing.length > 0 ? existing.split("\n") : [];
-	if (lines.at(-1) === "") lines.pop();
-	const out = [];
-	for (const line of lines) {
-		const key = ENV_ASSIGNMENT.exec(line)?.[1];
-		const replacement = key === void 0 ? void 0 : updates.get(key);
-		if (key !== void 0 && replacement !== void 0) {
-			out.push(replacement);
-			updates.delete(key);
-		} else out.push(line);
-	}
-	for (const rendered of updates.values()) out.push(rendered);
-	return out.length > 0 ? out.join("\n") + "\n" : "";
-}
-const envPullCommand = new Command("pull").description("Write user-managed env vars to .env.local in the CWD").argument("[slug]", "The mist slug (defaults to .mist file in CWD)").option("--out <path>", "Output path (default: .env.local)").action((slug, opts) => runAction(async () => {
-	const resolved = resolveSlug(slug);
-	const { env_vars } = await listEnvVars(createMistClient(), resolved);
-	const { plaintext, encrypted, managed } = partitionPullEnvVars(env_vars);
-	const outName = opts.out ?? ".env.local";
-	const target = join(process.cwd(), outName);
-	const existing = existsSync(target) ? readFileSync(target, "utf8") : "";
-	writeFileSync(target, mergeEnvContents(existing, plaintext), "utf8");
-	console.log(chalk.green(`Wrote ${plaintext.length} var(s) to ${target.replace(process.cwd() + "/", "")}${existing.length > 0 ? " (existing entries for other keys preserved)" : ""}.`));
-	if (managed.length > 0) console.log(chalk.dim(`Skipped ${managed.length} Mist-managed var(s): ${managed.map((v) => v.key).join(", ")} (local dev uses PGlite)`));
-	if (encrypted.length > 0) console.log(chalk.yellow(`Skipped ${encrypted.length} var(s) whose values are stored encrypted and can't be pulled: ${encrypted.map((v) => v.key).join(", ")} — set them locally in ${outName} yourself (values are visible in the Vercel dashboard) or re-set them via \`fluid mist env set\`.`));
-}));
-//#endregion
-//#region src/commands/env/index.ts
-/** `fluid mist env` — sub-command aggregator. */
-const envCommand = new Command("env").description("Manage a mist's environment variables").addCommand(envListCommand).addCommand(envSetCommand).addCommand(envUnsetCommand).addCommand(envPullCommand);
-//#endregion
-//#region ../../mist/core/src/droplet-lifecycle-repair.ts
-const DEFAULT_DROPLET_LIFECYCLE_PATHS = Object.freeze({
-	installPath: "/api/webhooks/installed",
-	uninstallPath: "/api/webhooks/uninstalled"
-});
-/** The note every repair summary carries: the repair fixes future delivery,
-*  it does not replay `droplet.installed` for an existing installation. */
-const LIFECYCLE_REPAIR_NOTE = "This repairs future Droplet install/uninstall lifecycle delivery. It does not replay droplet.installed for an already-installed Droplet.";
-/** Strip trailing slashes; null for an absent or empty value. */
-function normalizePublicUrl(value) {
-	if (!value) return null;
-	return value.replace(/\/+$/, "");
-}
-/** A blank or missing path falls back; a relative one gains a leading `/`. */
-function normalizeWebhookPath(value, fallback) {
-	if (typeof value !== "string") return fallback;
-	const trimmed = value.trim();
-	if (!trimmed) return fallback;
-	return trimmed.startsWith("/") ? trimmed : `/${trimmed}`;
-}
-/**
-* Lifecycle paths from a parsed `fluid.capabilities.json`
-* (`dropletLifecycle.installPath` / `uninstallPath`). Anything that is not
-* the expected shape yields the defaults.
-*/
-function dropletLifecyclePathsFromCapabilities(capabilities) {
-	if (!isRecord$1(capabilities)) return { ...DEFAULT_DROPLET_LIFECYCLE_PATHS };
-	const lifecycle = capabilities["dropletLifecycle"];
-	const source = isRecord$1(lifecycle) ? lifecycle : {};
+	const sleep = options.sleep ?? defaultSleep;
+	const label = KIND_LABEL$1[kind];
+	reporter.start("Resolving mist…");
+	const mist = (await showMist(client, slugOrId)).mist;
+	reporter.succeed(`Mist ${mist.slug} (${mist.state})`);
+	reporter.start("Checking existing integrations…");
+	const points = (await listIntegrationPoints(client, slugOrId)).integration_points;
+	let surfaceUuid = null;
+	let surfaceNumericId = null;
+	let surfaceName = null;
+	let surfaceCreated = false;
+	let embedUrlSet = false;
+	let createdEgressProxy;
+	let integrationPoint;
+	const attachingExisting = options.existingUuid != null || options.existingId != null;
+	const alreadyLinked = attachingExisting ? findIntegrationPointBySurface(points, {
+		kind,
+		uuid: options.existingUuid,
+		id: options.existingId
+	}) : kind === "droplet" ? findDropletIntegrationPoint(points) : void 0;
+	if (alreadyLinked) {
+		reporter.skip(`${label} already attached (integration #${alreadyLinked.id}) — skipping`);
+		surfaceUuid = alreadyLinked.integratable_uuid ?? options.existingUuid ?? null;
+		surfaceNumericId = alreadyLinked.integratable_id ?? options.existingId ?? null;
+		integrationPoint = {
+			id: alreadyLinked.id,
+			integratableUuid: alreadyLinked.integratable_uuid ?? null,
+			created: false
+		};
+	} else {
+		reporter.succeed("No matching integration yet");
+		let attachUuid = options.existingUuid;
+		let attachId = options.existingId;
+		if (!attachingExisting) {
+			const embedUrl = await resolvePublicUrl(client, {
+				slugOrId,
+				initial: mist.public_url,
+				reporter,
+				timing,
+				sleep
+			});
+			if (!embedUrl) throw new Error("The mist has no public_url yet — wait for the first deploy before creating a surface.");
+			const name = options.name?.trim() || mist.name?.trim() || mist.vendor_name || mist.slug;
+			if (kind === "droplet") {
+				reporter.start("Checking for an interrupted Droplet create…");
+				const recovered = await findDropletByEmbedUrl(client, embedUrl);
+				if (recovered) {
+					surfaceUuid = recovered.uuid;
+					surfaceNumericId = recovered.id ?? null;
+					surfaceName = recovered.name;
+					attachUuid = recovered.uuid;
+					embedUrlSet = true;
+					reporter.skip(`Reusing droplet ${surfaceUuid} from an interrupted attach`);
+				} else {
+					reporter.start(`Creating ${label} "${name}"…`);
+					const createInput = (egressProxy) => buildDropletCreateInput({
+						name,
+						embedUrl,
+						requestedScopes: options.requestedScopes,
+						egressProxy
+					});
+					let created;
+					try {
+						created = await createDroplet(client, { droplet: createInput(options.egressProxy) });
+					} catch (err) {
+						if (!(options.egressProxy && isEgressRefusal(err))) throw err;
+						created = await createDroplet(client, { droplet: createInput(false) });
+					}
+					createdEgressProxy = created.droplet;
+					surfaceUuid = created.droplet.uuid;
+					surfaceNumericId = created.droplet.id ?? null;
+					surfaceName = created.droplet.name;
+					attachUuid = created.droplet.uuid;
+					embedUrlSet = true;
+					surfaceCreated = true;
+					reporter.succeed(`Created droplet ${surfaceUuid}`);
+				}
+			} else if (kind === "drop-zone") {
+				reporter.start(`Creating ${label} "${name}"…`);
+				const created = await createDropZone(client, { drop_zone: buildDropZoneCreateInput({
+					name,
+					embedUrl,
+					zone: options.zone,
+					heightPx: options.heightPx
+				}) });
+				surfaceUuid = created.drop_zone.uuid;
+				surfaceName = created.drop_zone.name;
+				attachUuid = created.drop_zone.uuid;
+				embedUrlSet = true;
+				surfaceCreated = true;
+				reporter.succeed(`Created drop zone ${surfaceUuid}`);
+			} else {
+				reporter.start(`Creating ${label} "${name}"…`);
+				const created = await createMobileWidget(client, { mobile_widget: buildMobileWidgetCreateInput({
+					name,
+					embedUrl,
+					coverImageUrl: options.coverImageUrl,
+					heightPx: options.heightPx
+				}) });
+				surfaceNumericId = created.mobile_widget.id;
+				surfaceName = created.mobile_widget.name;
+				attachId = created.mobile_widget.id;
+				embedUrlSet = true;
+				surfaceCreated = true;
+				reporter.succeed(`Created mobile embed #${surfaceNumericId}`);
+			}
+		} else {
+			surfaceUuid = options.existingUuid ?? null;
+			surfaceNumericId = options.existingId ?? null;
+			embedUrlSet = true;
+		}
+		const attachInput = kind === "mobile-embed" ? {
+			kind,
+			integratable_id: attachId
+		} : {
+			kind,
+			integratable_uuid: attachUuid
+		};
+		reporter.start(`Attaching ${label}…`);
+		let ipResp;
+		try {
+			ipResp = await createIntegrationPoint(client, slugOrId, attachInput);
+		} catch (err) {
+			reporter.fail("Attach failed");
+			throw normalizeAttachError(err, attachUuid ?? String(attachId), kind);
+		}
+		integrationPoint = {
+			id: ipResp.integration_point.id,
+			integratableUuid: ipResp.integration_point.integratable_uuid ?? null,
+			created: true
+		};
+		if (!surfaceUuid) surfaceUuid = ipResp.integration_point.integratable_uuid ?? attachUuid ?? null;
+		if (surfaceNumericId == null) surfaceNumericId = ipResp.integration_point.integratable_id ?? null;
+		reporter.succeed(kind === "droplet" ? "Droplet attached — provisioning env + redeploy…" : `${label} attached`);
+	}
+	let installation = null;
+	let egressProxy = null;
+	if (kind === "droplet") {
+		if (!surfaceUuid && surfaceNumericId != null) try {
+			surfaceUuid = await findDropletUuidByNumericId(client, surfaceNumericId);
+		} catch {}
+		if (!surfaceUuid) {
+			reporter.fail("Droplet uuid unknown — cannot install");
+			throw new Error("Couldn't determine the droplet uuid, so the droplet is linked but NOT installed — it stays inactive until an installation exists. Re-run with `--existing <droplet-uuid>`, or install manually: POST /api/droplet_installations with {\"droplet_uuid\":\"<uuid>\"}.");
+		}
+		if (options.egressProxy) egressProxy = await ensureEgressProxy(client, {
+			dropletUuid: surfaceUuid,
+			created: createdEgressProxy,
+			reporter
+		});
+		installation = await ensureDropletInstalled(client, {
+			dropletUuid: surfaceUuid,
+			scopes: options.requestedScopes ?? DEFAULT_DROPLET_SCOPES,
+			reporter
+		});
+	}
+	const managedEnv = kind === "droplet" ? await verifyManagedEnv(client, {
+		slugOrId,
+		reporter,
+		timing,
+		sleep,
+		enabled: options.verifyEnv !== false
+	}) : null;
 	return {
-		installPath: normalizeWebhookPath(source["installPath"], DEFAULT_DROPLET_LIFECYCLE_PATHS.installPath),
-		uninstallPath: normalizeWebhookPath(source["uninstallPath"], DEFAULT_DROPLET_LIFECYCLE_PATHS.uninstallPath)
+		mist: {
+			id: mist.id,
+			slug: mist.slug,
+			name: mist.name,
+			public_url: mist.public_url,
+			state: mist.state
+		},
+		kind,
+		surface: {
+			uuid: surfaceUuid,
+			id: surfaceNumericId,
+			name: surfaceName
+		},
+		integrationPoint: integrationPoint ?? {
+			id: "",
+			integratableUuid: null,
+			created: false
+		},
+		surfaceCreated,
+		embedUrlSet,
+		installation,
+		managedEnv,
+		egressProxy
 	};
 }
-/** The canonical Droplet URLs for a Mist served at `publicUrl`. */
-function canonicalDropletUrls(publicUrl, paths = DEFAULT_DROPLET_LIFECYCLE_PATHS) {
-	const embedUrl = normalizePublicUrl(publicUrl);
-	if (!embedUrl) throw new Error("publicUrl is required");
+/**
+* Make sure the droplet has asked Fluid for egress through its proxy. A
+* droplet this run created already carries the request; one that existed
+* (reused, already linked, or `--existing`) is read first and PATCHed only if
+* it has not asked yet, so the flag is never silently ignored and an existing
+* request is not reported as new. Fluid refusing the request (only a company
+* admin can ask) warns and lets provisioning carry on; a response without the
+* fields (a non-admin, or an older Fluid) warns instead of claiming success.
+*/
+async function ensureEgressProxy(client, args) {
+	const { reporter } = args;
+	let record = args.created;
+	let changed = record?.egress_proxy_requested === true;
+	if (record === void 0) record = await readDropletIfAllowed(client, args.dropletUuid);
+	if (record?.egress_proxy_requested !== true) {
+		reporter.start("Asking Fluid for egress through its proxy…");
+		try {
+			record = (await updateDroplet(client, args.dropletUuid, { egress_proxy_requested: true })).droplet;
+		} catch (err) {
+			if (!isEgressRefusal(err)) throw err;
+			reporter.warn(EGRESS_REFUSED);
+			return {
+				requested: false,
+				granted: false,
+				changed: false
+			};
+		}
+		changed = record.egress_proxy_requested === true;
+	}
+	const requested = record?.egress_proxy_requested === true;
+	const granted = record?.egress_proxy_enabled === true;
+	if (granted) reporter.succeed("Egress granted — the droplet can reach Exigo through Fluid");
+	else if (requested) reporter.succeed("Egress requested — a Fluid admin must approve it before the proxy admits the droplet");
+	else reporter.warn(`${EGRESS_NOT_RETURNED} Re-run \`fluid mist droplet egress-proxy on\` as a company admin.`);
 	return {
-		embedUrl,
-		installWebhookUrl: `${embedUrl}${paths.installPath}`,
-		uninstallWebhookUrl: `${embedUrl}${paths.uninstallPath}`
+		requested,
+		granted,
+		changed
 	};
 }
-/** Exact match on all three fields — the repair's no-op condition and its
-*  post-PATCH verification. */
-function dropletUrlsMatch(droplet, canonical) {
-	return droplet?.embed_url === canonical.embedUrl && droplet.install_webhook_url === canonical.installWebhookUrl && droplet.uninstall_webhook_url === canonical.uninstallWebhookUrl;
-}
-/** The `PATCH /api/droplets/:uuid` body. Only these three fields change. */
-function dropletRepairPatch(canonical) {
-	return { droplet: {
-		embed_url: canonical.embedUrl,
-		install_webhook_url: canonical.installWebhookUrl,
-		uninstall_webhook_url: canonical.uninstallWebhookUrl
-	} };
-}
 /**
-* The repair summary before any mutation. `alreadyCorrect` means the caller
-* must not PATCH; otherwise a dry run reports "planned" and a live run
-* reports "updated" (callers overwrite it after verification).
+* Read an existing droplet so an existing request is not written again. Fluid
+* gates reading a droplet (`droplets.view`) separately from updating it
+* (`droplets.update`), so a caller allowed to update may not be allowed to
+* read: then this returns undefined and the caller just makes the request,
+* which is idempotent. Any other failure propagates.
 */
-function planLifecycleRepair(input) {
-	const alreadyCorrect = dropletUrlsMatch(input.current, input.canonical);
-	return {
-		alreadyCorrect,
-		summary: {
-			status: alreadyCorrect ? "unchanged" : input.dryRun ? "planned" : "updated",
-			mistId: input.mistId,
-			mistSlug: input.mistSlug,
-			dropletUuid: input.dropletUuid,
-			embedUrl: input.canonical.embedUrl,
-			installWebhookUrl: input.canonical.installWebhookUrl,
-			uninstallWebhookUrl: input.canonical.uninstallWebhookUrl,
-			previous: {
-				embedUrl: input.current?.embed_url ?? null,
-				installWebhookUrl: input.current?.install_webhook_url ?? null,
-				uninstallWebhookUrl: input.current?.uninstall_webhook_url ?? null
-			},
-			note: LIFECYCLE_REPAIR_NOTE
-		}
-	};
-}
-function isRecord$1(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-//#endregion
-//#region ../../mist/core/src/lifecycle-types.ts
-const lifecycleOperationStates = [
-	"queued",
-	"running",
-	"succeeded",
-	"failed",
-	"requires_action"
-];
-const lifecycleOperationKinds = ["replacement"];
-const connectionStates = [
-	"pending",
-	"connected",
-	"degraded",
-	"requires_action"
-];
-function isTerminalOperation(operation) {
-	return operation.state === "succeeded" || operation.state === "failed" || operation.state === "requires_action";
+async function readDropletIfAllowed(client, dropletUuid) {
+	try {
+		return (await getDroplet(client, dropletUuid)).droplet;
+	} catch (err) {
+		if (err instanceof MistApiError && err.status === 403) return void 0;
+		throw err;
+	}
 }
-//#endregion
-//#region ../../mist/core/src/recovery-classification.ts
-function classifyLifecycleRecovery(result) {
-	if (result.status === "not_found") return {
-		status: "requires_action",
-		action: "rediscover_operation"
-	};
-	if (result.status === "timed_out") return {
-		status: "retryable",
-		action: "resume_status_polling"
-	};
-	return classifyTerminalOperation(result.operation);
-}
-function classifyTerminalOperation(operation) {
-	if (operation.state === "succeeded") return {
-		status: "complete",
-		action: null
-	};
-	if (operation.state === "failed") return {
-		status: "failed",
-		action: operation.recovery_action ?? "verify_lifecycle_destination"
-	};
-	return {
-		status: "requires_action",
-		action: operation.recovery_action ?? "reconcile_lifecycle"
-	};
-}
-const REPLACEMENT_IDEMPOTENCY_SCOPE = "single replacement attempt; a later approved retry receives a new key";
-const REPLACEMENT_OWNERSHIP_NOTE = "Fluid owns revocation, uninstall delivery, terminalization, replacement creation, and retry recovery as one durable operation.";
-function replacementOperationsPath(mistId, installationUuid) {
-	return `/api/v202604/mists/${encodeURIComponent(mistId)}/droplet_installations/${encodeURIComponent(installationUuid)}/replacement_operations`;
-}
-function replacementOperationStatusPath(mistId, installationUuid, operationId) {
-	return `${replacementOperationsPath(mistId, installationUuid)}/${encodeURIComponent(operationId)}`;
-}
-/** The operation id a 409 "active_operation_exists" response points at. */
-function parseActiveOperationId(value) {
-	if (!isRecord(value)) return null;
-	const error = value["error"];
-	if (!isRecord(error)) return null;
-	const details = error["details"];
-	if (!isRecord(details)) return null;
-	const operationId = details["operation_id"];
-	return typeof operationId === "string" ? operationId : null;
+/**
+* Install the droplet for the current company (idempotent). Checks the
+* installations list first; treats the API's already-installed rejection as
+* success too, so re-runs and races both converge. A hard failure throws with
+* the droplet uuid + recovery steps — the created droplet and mist link stay
+* in place, so an idempotent re-run finishes the job.
+*/
+async function ensureDropletInstalled(client, args) {
+	const { reporter, dropletUuid } = args;
+	reporter.start("Installing droplet…");
+	let existing;
+	try {
+		existing = findInstallationForDroplet(await listAllDropletInstallations(client), dropletUuid);
+	} catch {}
+	if (existing) {
+		reporter.skip(`Droplet already installed${existing.uuid ? ` (${existing.uuid})` : ""} — skipping`);
+		return {
+			uuid: existing.uuid ?? null,
+			created: false
+		};
+	}
+	try {
+		const uuid = (await createDropletInstallation(client, {
+			droplet_uuid: dropletUuid,
+			scopes: [...args.scopes]
+		})).droplet_installation?.uuid ?? null;
+		reporter.succeed(`Droplet installed${uuid ? ` (${uuid})` : ""}`);
+		return {
+			uuid,
+			created: true
+		};
+	} catch (err) {
+		if (err instanceof MistApiError && (err.status === 409 || err.status === 422)) {
+			const confirmed = await lookupInstallation(client, dropletUuid);
+			if (confirmed) {
+				reporter.skip("Droplet already installed — skipping");
+				return {
+					uuid: confirmed.uuid ?? null,
+					created: false
+				};
+			}
+		}
+		reporter.fail("Droplet install failed");
+		throw normalizeInstallError(err, dropletUuid);
+	}
 }
-/** Seconds from a `Retry-After` header; undefined when absent or invalid. */
-function parseRetryAfterHeader(value) {
-	if (!value) return void 0;
-	const seconds = Number(value);
-	return Number.isFinite(seconds) && seconds >= 0 ? seconds : void 0;
+/** Best-effort installation lookup for a droplet; null when the row can't
+*  be found or the list call fails. */
+async function lookupInstallation(client, dropletUuid) {
+	try {
+		return findInstallationForDroplet(await listAllDropletInstallations(client), dropletUuid) ?? null;
+	} catch {
+		return null;
+	}
 }
-/** Parse and validate `{ replacement_operation: {...} }`. Throws on a
-*  malformed body rather than trusting a partial operation. */
-function parseReplacementOperation(value) {
-	const key = "replacement_operation";
-	if (!isRecord(value)) throw new Error("Lifecycle response must be an object");
-	const candidate = value[key];
-	if (!isRecord(candidate)) throw new Error(`Lifecycle response is missing ${key}`);
-	const id = candidate["id"];
-	const kind = candidate["kind"];
-	const state = candidate["state"];
-	const stage = candidate["stage"];
-	const mistId = candidate["mist_id"];
-	const createdAt = candidate["created_at"];
-	const updatedAt = candidate["updated_at"];
-	if (typeof id !== "string" || !isLifecycleOperationKind(kind) || !isLifecycleOperationState(state) || typeof stage !== "string" || typeof mistId !== "string" || typeof createdAt !== "string" || typeof updatedAt !== "string") throw new Error("Lifecycle operation response is malformed");
-	const dropletUuid = candidate["droplet_uuid"];
-	const installationUuid = candidate["installation_uuid"];
-	const connectionState = candidate["connection_state"];
-	const errorCode = candidate["error_code"];
-	const recoveryAction = candidate["recovery_action"];
-	const terminalAt = candidate["terminal_at"];
-	const retryAfterSeconds = candidate["retry_after_seconds"];
-	if (!isOptionalNullableString(dropletUuid) || !isOptionalNullableString(installationUuid) || !isOptionalConnectionState(connectionState) || !isOptionalNullableString(errorCode) || !isOptionalNullableString(recoveryAction) || !isOptionalNullableString(terminalAt) || !isOptionalNullableNumber(retryAfterSeconds)) throw new Error("Lifecycle operation response has malformed optional fields");
-	return {
-		id,
-		kind,
-		state,
-		stage,
-		mist_id: mistId,
-		created_at: createdAt,
-		updated_at: updatedAt,
-		...dropletUuid !== void 0 ? { droplet_uuid: dropletUuid } : {},
-		...installationUuid !== void 0 ? { installation_uuid: installationUuid } : {},
-		...connectionState !== void 0 ? { connection_state: connectionState } : {},
-		...errorCode !== void 0 ? { error_code: errorCode } : {},
-		...recoveryAction !== void 0 ? { recovery_action: recoveryAction } : {},
-		...terminalAt !== void 0 ? { terminal_at: terminalAt } : {},
-		...retryAfterSeconds !== void 0 ? { retry_after_seconds: retryAfterSeconds } : {}
-	};
+/**
+* Install failures must NOT read as "wired up" — an uninstalled droplet means
+* dit/dex token exchange, admin embeds, and install webhooks silently don't
+* work. Surface the droplet uuid + recovery path; keep the MistApiError
+* status so the error handler exits with the spec'd non-zero code.
+*/
+function normalizeInstallError(err, dropletUuid) {
+	const message = `Droplet ${dropletUuid} was created and linked to the mist, but installing it failed: ${err instanceof Error ? err.message : String(err)}. The droplet and its link were left in place — re-run this command to finish the install, or install manually: POST /api/droplet_installations with {"droplet_uuid":"${dropletUuid}"}.`;
+	return err instanceof MistApiError ? new MistApiError(message, err.status, err.details) : new Error(message);
 }
 /**
-* Guard the request before any network call. A resume must name the
-* installation it started on: status is scoped to the SOURCE installation,
-* the backend terminalizes that source mid-flight, and polling whichever
-* installation is attached now would report a false "not_found".
+* If the integration-points endpoint rejects the attach identifier (e.g. an
+* older API that predates #19688's attach-by-uuid support), surface an
+* actionable message noting the surface WAS created. Other errors pass through.
 */
-function checkReplacementRequest(args) {
-	const resumeOperationId = args.resumeOperationId?.trim() || null;
-	if (resumeOperationId && !args.installationUuid) return {
-		ok: false,
-		code: "resume_requires_installation"
-	};
-	return {
-		ok: true,
-		resumeOperationId
-	};
+function normalizeAttachError(err, surfaceRef, kind) {
+	if (err instanceof MistApiError && (err.status === 400 || err.status === 422)) {
+		const blob = `${err.message} ${JSON.stringify(err.details ?? {})}`;
+		if (/integratable_uuid|integratable_id|unpermitted|unknown|param/i.test(blob)) return new MistApiError(`The ${KIND_LABEL$1[kind]} ${surfaceRef} was created, but this API rejected the attach (needs the #19688 integration-points endpoint). Re-run once the API is updated.`, err.status, err.details);
+	}
+	return err instanceof Error ? err : new Error(String(err));
 }
-/** Starting a new replacement needs explicit confirmation; resuming only
-*  reads an operation the user already approved. */
-function replacementStartNeedsConfirmation(args, resumeOperationId) {
-	return !resumeOperationId && args.confirmDestructiveReinstall !== true;
+/**
+* Return the mist's public_url, polling briefly if it isn't ready yet
+* (async-first-deploy). Returns null if it never appears within the window.
+*/
+async function resolvePublicUrl(client, args) {
+	if (args.initial) return args.initial;
+	args.reporter.start("Waiting for the mist's public URL…");
+	const deadline = Date.now() + args.timing.publicUrlTimeoutMs;
+	for (;;) {
+		const url = (await showMist(client, args.slugOrId)).mist.public_url;
+		if (url) {
+			args.reporter.succeed(`Public URL ready: ${url}`);
+			return url;
+		}
+		if (Date.now() >= deadline) break;
+		await args.sleep(args.timing.publicUrlIntervalMs);
+	}
+	return null;
 }
 /**
-* The installation to replace. An explicitly named `installationUuid`
-* always wins: it is the recovery path for a source that a failed attempt
-* already terminalized (which may sit beside a newer active installation
-* of the same Droplet), and a resume must watch the installation its
-* operation started on, never a rediscovered one. Without a name, the
-* company's active installation of the attached Droplet is used.
+* Poll `GET …/env_vars` until the Mist-managed droplet keys appear with
+* `managed_by: "mist"`. Never fails the flow — a redeploy in progress is a
+* normal, transient state we simply report.
 */
-function selectReplacementInstallation(input) {
-	if (input.installationUuid) return input.installations.find((candidate) => candidate.uuid === input.installationUuid && candidate.droplet_uuid === input.dropletUuid) ?? {
-		uuid: input.installationUuid,
-		droplet_uuid: input.dropletUuid
+async function verifyManagedEnv(client, args) {
+	const required = [...MANAGED_DROPLET_ENV_KEYS];
+	if (!args.enabled) return {
+		ready: false,
+		present: [],
+		missing: required
 	};
-	if (input.resumeOperationId) return void 0;
-	return input.installations.find((candidate) => candidate.droplet_uuid === input.dropletUuid);
-}
-function buildReplacementPlan(input) {
-	const { installation } = input;
+	args.reporter.start("Verifying managed environment…");
+	const deadline = Date.now() + args.timing.envTimeoutMs;
+	let present = [];
+	for (;;) {
+		const envVars = (await listEnvVars(client, args.slugOrId)).env_vars ?? [];
+		const managed = new Set(envVars.filter((e) => e.managed_by === "mist").map((e) => e.key));
+		present = required.filter((k) => managed.has(k));
+		if (present.length === required.length) {
+			args.reporter.succeed("Managed env keys present — droplet is wired up");
+			return {
+				ready: true,
+				present,
+				missing: []
+			};
+		}
+		if (Date.now() >= deadline) break;
+		args.reporter.update(`Verifying managed environment… (${present.length}/${required.length} keys, redeploy in progress)`);
+		await args.sleep(args.timing.envIntervalMs);
+	}
+	const missing = required.filter((k) => !present.includes(k));
+	args.reporter.warn(`Redeploy in progress — managed keys not visible yet (${present.length}/${required.length}). Check later with \`fluid mist env list\`. Missing: ${missing.join(", ")}`);
 	return {
-		status: input.dryRun ? "planned" : input.resumeOperationId ? "watching" : "pending",
-		mistId: input.mistId,
-		dropletUuid: input.dropletUuid,
-		installationUuid: installation.uuid,
-		lifecycleRepair: input.lifecycleRepair,
-		replacementPath: replacementOperationsPath(input.mistId, installation.uuid),
-		idempotencyKey: input.resumeOperationId ? null : input.idempotencyKey,
-		idempotencyScope: REPLACEMENT_IDEMPOTENCY_SCOPE,
-		irreversible: true,
-		preservedByBackend: {
-			scopes: Array.isArray(installation.scopes),
-			role_id: typeof installation.role_id === "string" || typeof installation.role_id === "number"
-		},
-		note: REPLACEMENT_OWNERSHIP_NOTE
+		ready: false,
+		present,
+		missing
 	};
 }
+//#endregion
+//#region src/lib/surface-flags.ts
+const EGRESS_PROXY_FLAG_DESCRIPTION = "Ask Fluid to let the droplet reach external systems such as Exigo through its egress proxy (a Fluid admin approves it)";
 /**
-* The final result of one watch. A timed-out poll is this caller's watch
-* budget expiring, NOT the backend giving up: it reports "still_running"
-* with the ids needed to resume, and is not an error. Only "succeeded" is
-* complete.
+* `--egress-proxy` only means something for a droplet: only a droplet's
+* installation token authenticates to the proxy. Refuse it on other kinds
+* rather than silently ignoring it.
 */
-function summarizeReplacementWatch(input) {
-	const { pollResult, startedOperation } = input;
-	const recovery = classifyLifecycleRecovery(pollResult);
-	const stillRunning = pollResult.status === "timed_out";
-	const latestOperation = pollResult.status === "terminal" ? pollResult.operation : pollResult.status === "timed_out" ? pollResult.operation ?? startedOperation : startedOperation;
+function egressProxyFromFlags(kind, flags) {
+	if (!flags.egressProxy) return void 0;
+	if (kind !== "droplet") throw new Error("`--egress-proxy` applies to droplets only — drop it, or use `--kind droplet`.");
+	return true;
+}
+const KIND_ALIASES = {
+	droplet: "droplet",
+	droplets: "droplet",
+	"drop-zone": "drop-zone",
+	drop_zone: "drop-zone",
+	dropzone: "drop-zone",
+	zone: "drop-zone",
+	"mobile-embed": "mobile-embed",
+	mobile_embed: "mobile-embed",
+	mobile: "mobile-embed",
+	"mobile-widget": "mobile-embed",
+	mobilewidget: "mobile-embed"
+};
+const SURFACE_KIND_LIST = "droplet, drop-zone, mobile-embed";
+function parseSurfaceKind(raw) {
+	const hit = KIND_ALIASES[raw.trim().toLowerCase()];
+	if (!hit) throw new Error(`Unknown surface kind "${raw}". Use one of: ${SURFACE_KIND_LIST}.`);
+	return hit;
+}
+function parseHeight(raw) {
+	if (raw == null) return void 0;
+	const n = Number(raw);
+	if (!Number.isInteger(n) || n <= 0) throw new Error(`Invalid --height "${raw}". Must be a positive integer (px).`);
+	return n;
+}
+/**
+* Map CLI flags to the kind-specific `provisionSurface` options, enforcing the
+* per-kind requirements the API needs:
+*  - drop-zone requires `--zone <page__zone>` (else it never renders).
+*  - mobile-embed requires `--cover-image <url>` (the API 422s without one; the
+*    CLI has no DAM picker, so the user must supply a url).
+*/
+function surfaceProvisionOptionsFromFlags(kind, flags) {
+	const heightPx = parseHeight(flags.height);
+	if (kind === "drop-zone") {
+		if (!flags.zone?.trim()) throw new Error("A drop-zone needs a slot — pass `--zone <page__zone>` (e.g. --zone checkout__below_total).");
+		return {
+			zone: flags.zone.trim(),
+			heightPx
+		};
+	}
+	if (kind === "mobile-embed") {
+		if (!flags.coverImage?.trim()) throw new Error("A mobile-embed needs a cover image — pass `--cover-image <url>` (the mobile API requires one; the CLI has no image picker).");
+		return {
+			coverImageUrl: flags.coverImage.trim(),
+			heightPx
+		};
+	}
+	return {};
+}
+//#endregion
+//#region src/lib/surface-summary.ts
+/** Shared human-readable summary for a surface provision result. */
+const KIND_LABEL = {
+	droplet: "droplet",
+	"drop-zone": "drop zone",
+	"mobile-embed": "mobile embed"
+};
+function printSurfaceSummary(result) {
+	const ref = result.surface.uuid ?? (result.surface.id != null ? `#${result.surface.id}` : "(unknown)");
+	const state = result.surfaceCreated ? "created" : "existing";
+	console.log(chalk.dim(`  ${KIND_LABEL[result.kind]}: ${ref} (${state}) · integration ${result.integrationPoint.id}`));
+	if (result.kind === "droplet" && result.installation) {
+		const ref = result.installation.uuid ?? "(uuid unknown)";
+		console.log(chalk.dim(`  installation: ${ref} (${result.installation.created ? "installed" : "already installed"})`));
+	}
+	if (result.kind === "droplet" && result.managedEnv) if (result.managedEnv.ready) console.log(chalk.dim("  env: managed keys provisioned ✓"));
+	else console.log(chalk.yellow("  env: redeploy in progress — run `fluid mist env list` shortly to confirm managed keys"));
+	if (result.kind === "droplet" && result.egressProxy) console.log(result.egressProxy.granted ? chalk.dim("  egress proxy: granted ✓") : result.egressProxy.requested ? chalk.yellow("  egress proxy: requested — waiting for a Fluid admin to approve it") : chalk.yellow("  egress proxy: not requested — only a company admin can ask for it, or this Fluid predates it"));
+}
+//#endregion
+//#region src/commands/create.ts
+/**
+* `fluid mist create` — provision a new mist, optionally creating and attaching
+* a surface in one step. All attach paths go through integration points
+* (hostable is retired — #19684/#19687).
+*
+*   --droplet [name]           Create a NEW droplet and attach it. Bare →
+*                              droplet name defaults to the mist name. The
+*                              "one command that sets everything up" path.
+*   --kind <kind> [flags]      Create + attach a surface of any kind:
+*                              droplet | drop-zone | mobile-embed. Kind flags:
+*                                drop-zone   --zone <page__zone> --height <px>
+*                                mobile-embed --cover-image <url> --height <px>
+*   --hostable droplet:<uuid>  Attach an EXISTING droplet by its drp_… uuid.
+*   --egress-proxy             With a droplet: let it reach external systems
+*                              such as Exigo through Fluid's egress proxy.
+*
+* With none of these, creates a plain standalone mist.
+*/
+const createCommand = new Command("create").description("Provision a new mist (optionally create + attach a surface in one step)").option("--droplet [name]", "Create a droplet and attach it. Bare uses the mist name; pass a value to override.").option("--kind <kind>", "Create + attach a surface: droplet | drop-zone | mobile-embed").option("--hostable <ref>", "Attach an existing droplet by uuid: droplet:<uuid> (e.g. droplet:drp_abc123)").option("--name <label>", "Display label for the mist (and the surface)").option("--zone <slot>", "drop-zone slot id: page__zone (e.g. checkout__below_total)").option("--height <px>", "Embed height in px (drop-zone + mobile-embed)").option("--cover-image <url>", "Mobile-embed cover image url (required for mobile-embed)").option("--egress-proxy", EGRESS_PROXY_FLAG_DESCRIPTION).option("--mist-kind <kind>", "Mist kind (default: next_app)").option("--no-wait", "Don't wait for managed env keys to appear after attach").option("--json", "Emit raw JSON").action((opts) => runAction(async () => {
+	const wantDroplet = opts.droplet !== void 0;
+	const wantKind = !!opts.kind;
+	const wantHostable = !!opts.hostable;
+	if ([
+		wantDroplet,
+		wantKind,
+		wantHostable
+	].filter(Boolean).length > 1) throw new Error("Pass only one of `--droplet`, `--kind`, or `--hostable` — they're mutually exclusive.");
+	let kind;
+	let existingDropletUuid;
+	let nameOverride;
+	if (wantDroplet) {
+		kind = "droplet";
+		nameOverride = typeof opts.droplet === "string" ? opts.droplet.trim() : void 0;
+	} else if (wantKind) kind = parseSurfaceKind(opts.kind);
+	else if (wantHostable) {
+		kind = "droplet";
+		existingDropletUuid = parseDropletRef(opts.hostable);
+	}
+	if (opts.egressProxy && !kind) throw new Error("`--egress-proxy` needs a droplet — add `--droplet`, `--kind droplet`, or `--hostable droplet:<uuid>`.");
+	const egressProxy = kind ? egressProxyFromFlags(kind, opts) : void 0;
+	const mistBody = { kind: opts.mistKind ?? "next_app" };
+	if (opts.name?.trim()) mistBody.name = opts.name.trim();
+	const client = createMistClient();
+	const reporter = opts.json ? createSilentReporter() : createOraReporter();
+	reporter.start("Setting up your Mist Cloud environment…");
+	let created;
+	try {
+		created = await createMist(client, { mist: mistBody });
+	} catch (err) {
+		reporter.fail("Provisioning failed");
+		throw err;
+	}
+	const mist = created.mist;
+	reporter.succeed(`Provisioned ${mist.slug}`);
+	let provision;
+	if (kind) provision = await provisionSurface(client, {
+		slugOrId: mist.slug,
+		kind,
+		name: nameOverride ?? opts.name?.trim(),
+		existingUuid: existingDropletUuid,
+		egressProxy,
+		verifyEnv: opts.wait !== false,
+		reporter,
+		...surfaceProvisionOptionsFromFlags(kind, opts)
+	});
+	if (opts.json) return printJson(provision ? {
+		mist,
+		provision
+	} : created);
+	const label = mistLabel(mist.name, mist.vendor_name);
+	console.log();
+	console.log(`${label}  ${chalk.dim(mist.slug)}  ${colorState(mist.state)}`);
+	if (mist.public_url) console.log(`  ${chalk.cyan(mist.public_url)}`);
+	if (provision) printSurfaceSummary(provision);
+	console.log();
+	console.log(chalk.dim(`Clone with: fluid mist clone ${mist.slug}`));
+}));
+//#endregion
+//#region src/commands/attach.ts
+/**
+* `fluid mist attach --kind <kind> [flags] [slug]` — create a surface and wire
+* it to an existing mist. One command for all three kinds:
+*
+*   --kind droplet                       (managed-env-provisioning droplet)
+*   --kind drop-zone --zone page__zone   [--height <px>]
+*   --kind mobile-embed --cover-image <url> [--height <px>]
+*
+* Attach an EXISTING surface instead of creating one with `--existing <ref>`:
+*   droplet/drop-zone → droplet:drp_… / drop-zone:dz_… / bare uuid
+*   mobile-embed      → mobile-embed:<numericId>
+*
+* `--egress-proxy` (droplet only) lets the droplet reach external systems
+* such as Exigo through Fluid's egress proxy — on a new droplet, and on an
+* existing or already-attached one.
+*
+* Idempotent for droplet + attach-existing (skips when already linked).
+*/
+/** Parse `--existing <ref>` into a uuid or numeric id for the given kind. */
+function parseExisting(kind, raw) {
+	const trimmed = (raw.includes(":") ? raw.slice(raw.lastIndexOf(":") + 1) : raw).trim();
+	if (!trimmed) throw new Error(`Empty --existing reference "${raw}".`);
+	if (kind === "mobile-embed") {
+		const id = Number(trimmed);
+		if (!Number.isInteger(id) || id <= 0) throw new Error(`mobile-embed attaches by numeric id — pass \`--existing <id>\` (got "${raw}").`);
+		return { existingId: id };
+	}
+	return { existingUuid: trimmed };
+}
+const attachCommand = new Command("attach").description(`Create a surface (${SURFACE_KIND_LIST}) and wire it to an existing mist`).argument("[slug]", "Mist slug (defaults to the .mist file in CWD)").requiredOption("--kind <kind>", `Surface kind: ${SURFACE_KIND_LIST}`).option("--name <label>", "Surface name (defaults to the mist's name)").option("--zone <slot>", "drop-zone slot id: page__zone (e.g. checkout__below_total)").option("--height <px>", "Embed height in px (drop-zone + mobile-embed)").option("--cover-image <url>", "Mobile-embed cover image url (required for mobile-embed)").option("--existing <ref>", "Attach an existing surface instead of creating one (uuid, or numeric id for mobile-embed)").option("--egress-proxy", EGRESS_PROXY_FLAG_DESCRIPTION).option("--no-wait", "Don't wait for managed env keys to appear after attach").option("--json", "Emit raw JSON").action((slug, opts) => runAction(async () => {
+	const kind = parseSurfaceKind(opts.kind);
+	const egressProxy = egressProxyFromFlags(kind, opts);
+	const resolved = resolveSlug(slug);
+	const client = createMistClient();
+	const reporter = opts.json ? createSilentReporter() : createOraReporter();
+	const existing = opts.existing ? parseExisting(kind, opts.existing) : void 0;
+	const result = await provisionSurface(client, {
+		slugOrId: resolved,
+		kind,
+		name: opts.name?.trim(),
+		egressProxy,
+		verifyEnv: opts.wait !== false,
+		reporter,
+		...existing,
+		...existing ? {} : surfaceProvisionOptionsFromFlags(kind, opts)
+	});
+	if (opts.json) return printJson(result);
+	console.log();
+	console.log(`${chalk.bold(result.mist.name ?? result.mist.slug)}  ${chalk.dim(result.mist.slug)}`);
+	printSurfaceSummary(result);
+}));
+//#endregion
+//#region src/commands/attach-droplet.ts
+/**
+* `fluid mist attach-droplet [name] [slug]` — droplet shortcut for
+* `fluid mist attach --kind droplet`. Creates a droplet and wires it to an
+* existing standalone mist (provisioning the managed env). Idempotent: if a
+* droplet is already attached, it skips create + attach and just verifies env.
+*
+*   name   Optional droplet name (defaults to the mist's name).
+*   slug   Optional mist slug (defaults to the `.mist` file in CWD).
+*
+* `--egress-proxy` lets the droplet reach external systems such as Exigo
+* through Fluid's egress proxy, including one that was already attached.
+*/
+const attachDropletCommand = new Command("attach-droplet").description("Create a droplet and wire it to an existing standalone mist (idempotent)").argument("[name]", "Droplet name (defaults to the mist's name)").argument("[slug]", "Mist slug (defaults to the .mist file in CWD)").option("--egress-proxy", EGRESS_PROXY_FLAG_DESCRIPTION).option("--no-wait", "Don't wait for managed env keys to appear after attach").option("--json", "Emit raw JSON").action((name, slug, opts) => runAction(async () => {
+	const resolved = resolveSlug(slug);
+	const client = createMistClient();
+	const reporter = opts.json ? createSilentReporter() : createOraReporter();
+	const result = await provisionSurface(client, {
+		slugOrId: resolved,
+		kind: "droplet",
+		name: name?.trim() || void 0,
+		egressProxy: opts.egressProxy === true || void 0,
+		verifyEnv: opts.wait !== false,
+		reporter
+	});
+	if (opts.json) return printJson(result);
+	console.log();
+	console.log(`${chalk.bold(result.mist.name ?? result.mist.slug)}  ${chalk.dim(result.mist.slug)}`);
+	printSurfaceSummary(result);
+}));
+//#endregion
+//#region src/commands/update.ts
+/**
+* `fluid mist update` — mutate an existing mist. Hostable is retired
+* (#19684/#19687), so attach/detach operate on integration points:
+*
+*   --name <label>            Rename the mist (PATCH /mists/:id).
+*   --hostable droplet:<uuid> Attach a droplet by uuid. No-ops if that same
+*                             droplet is already attached; replaces it if a
+*                             different droplet is attached (droplet is
+*                             1-per-mist — it provisions the managed env).
+*   --detach                  Remove the droplet integration point.
+*
+* The integration-point link is immutable (no update route, no `active`
+* field) — enablement lives on the surface record, so there's no toggle here.
+* All ops re-derive state from the integration-points index (which echoes
+* `integratable_uuid` since #19689) and only make the calls that change it.
+*/
+const updateCommand = new Command("update").description("Rename a mist, or attach/detach its droplet").argument("[slug]", "The mist slug (defaults to .mist file in CWD)").option("--name <label>", "Set the display label").option("--hostable <ref>", "Attach a droplet: droplet:<uuid> (e.g. droplet:drp_abc123)").option("--detach", "Remove the droplet integration point").option("--json", "Emit raw API JSON").action((slug, opts) => runAction(async () => {
+	if (opts.hostable && opts.detach) throw new Error("Pass either `--hostable` OR `--detach`, not both — they're mutually exclusive.");
+	if (!opts.name && !opts.hostable && !opts.detach) throw new Error("Nothing to do — pass `--name`, `--hostable`, or `--detach`.");
+	const resolved = resolveSlug(slug);
+	const client = createMistClient();
+	const notes = [];
+	let renameResp;
+	if (opts.name?.trim()) {
+		renameResp = await updateMist(client, resolved, { mist: { name: opts.name.trim() } });
+		if (!opts.json) {
+			const m = renameResp.mist;
+			console.log(`${mistLabel(m.name, m.vendor_name)}  ${chalk.dim(m.slug)}  ${colorState(m.state)}`);
+		}
+	}
+	if (opts.hostable || opts.detach) {
+		const existing = findDropletIntegrationPoint((await listIntegrationPoints(client, resolved)).integration_points);
+		if (opts.hostable) {
+			const dropletUuid = parseDropletRef(opts.hostable);
+			if (existing && existing.integratable_uuid === dropletUuid) notes.push(`droplet ${dropletUuid} already attached (integration ${existing.id})`);
+			else {
+				if (existing) {
+					await deleteIntegrationPoint(client, resolved, existing.id);
+					notes.push(`replaced integration ${existing.id}`);
+				}
+				const ip = await createIntegrationPoint(client, resolved, {
+					kind: "droplet",
+					integratable_uuid: dropletUuid
+				});
+				notes.push(`attached droplet ${dropletUuid} (integration ${ip.integration_point.id})`);
+			}
+		} else if (opts.detach) if (existing) {
+			await deleteIntegrationPoint(client, resolved, existing.id);
+			notes.push(`detached droplet (removed integration ${existing.id})`);
+		} else notes.push("already standalone (no droplet integration)");
+	}
+	if (opts.json) return printJson(renameResp ? {
+		...renameResp,
+		slug: resolved,
+		notes
+	} : {
+		slug: resolved,
+		notes
+	});
+	for (const note of notes) console.log(chalk.dim(`  ${note}`));
+}));
+//#endregion
+//#region src/commands/delete.ts
+/**
+* `fluid mist delete` — scheduled teardown 15 days out (spec §3 "15-day
+* grace period"). DO NOT poll for completion.
+*/
+const deleteCommand = new Command("delete").description("Schedule a mist for destruction (15-day grace window)").argument("[slug]", "The mist slug (defaults to .mist file in CWD)").option("-y, --yes", "Skip confirmation prompt").option("--json", "Emit raw API JSON").action((slug, opts) => runAction(async () => {
+	const resolved = resolveSlug(slug);
+	const client = createMistClient();
+	if (!opts.yes) {
+		const { mist } = await showMist(client, resolved);
+		const fifteenDaysOut = new Date(Date.now() + 15 * 864e5).toISOString().slice(0, 10);
+		console.log();
+		console.log(`About to schedule ${chalk.bold(mist.name ?? mist.vendor_name ?? mist.slug)} (${chalk.dim(mist.slug)}) for destruction on ${chalk.yellow(fifteenDaysOut)}.`);
+		console.log(chalk.dim(`Vendor resources stay alive until then; run \`fluid mist restore ${mist.slug}\` to undo.`));
+		const { confirmed } = await prompts({
+			type: "confirm",
+			name: "confirmed",
+			message: "Continue?",
+			initial: false
+		}, { onCancel: () => process.exit(130) });
+		if (!confirmed) {
+			console.log(chalk.dim("Aborted."));
+			process.exit(0);
+		}
+	}
+	const { mist } = await deleteMist(client, resolved);
+	if (opts.json) return printJson({ mist });
+	console.log(chalk.magenta(`Scheduled for destruction on ${mist.scheduled_destroy_at ? formatAbsolute(mist.scheduled_destroy_at) : "the 15-day mark"}.`));
+	console.log(chalk.dim(`Vendor resources stay alive until then; run \`fluid mist restore ${mist.slug}\` to undo.`));
+}));
+//#endregion
+//#region src/commands/restore.ts
+/** `fluid mist restore` — un-delete within the 15-day window. Spec §3. */
+const restoreCommand = new Command("restore").description("Cancel a scheduled mist destruction (15-day window)").argument("[slug]", "The mist slug (defaults to .mist file in CWD)").option("--json", "Emit raw API JSON").action((slug, opts) => runAction(async () => {
+	const resolved = resolveSlug(slug);
+	const { mist } = await restoreMist(createMistClient(), resolved);
+	if (opts.json) return printJson({ mist });
+	console.log(`Restored: ${mist.public_url ? chalk.cyan(mist.public_url) : mist.name ?? mist.vendor_name ?? mist.slug} (${colorState(mist.state)})`);
+}));
+//#endregion
+//#region src/api/git_credential.ts
+async function createGitCredential(client, slug) {
+	const id = await resolveMistId(client, slug);
+	return client.post(`/api/v202604/mists/${id}/git_credential`);
+}
+//#endregion
+//#region src/commands/clone.ts
+/**
+* `fluid mist clone <slug>` — mints a fresh git credential and clones
+* into ./<vendor-name>/, writes a `.mist` marker file. Spec §3 + §11.
+*/
+/**
+* Render a path for the copy-pasteable `cd` hint so the printed command
+* enters the directory that was actually created:
+* - Prefixes `./` when the path starts with `~` (blocks tilde expansion —
+*   the clone went into a literal `~…` directory under CWD) or `-` (stops
+*   `cd` from parsing it as an option).
+* - Otherwise single-quotes anything beyond safe characters, escaping
+*   embedded single quotes POSIX-style (`'\''`).
+*/
+function quotePathIfNeeded(path) {
+	const prefixed = /^[~-]/.test(path) ? `./${path}` : path;
+	if (/^[A-Za-z0-9_./-]+$/.test(prefixed)) return prefixed;
+	return `'${prefixed.replace(/'/g, "'\\''")}'`;
+}
+const cloneCommand = new Command("clone").description("Clone the mist's GitHub repo (mints a fresh token per call)").argument("[slug]", "The mist slug (defaults to .mist file in CWD)").option("--dir <dir>", "Target directory (defaults to ./<vendor-name>/)").action((slug, opts) => runAction(async () => {
+	await ensureGitAvailable();
+	const resolvedSlug = resolveSlug(slug);
+	const client = createMistClient();
+	const spinner = ora("Resolving mist…").start();
+	const { mist } = await showMist(client, resolvedSlug);
+	spinner.text = "Minting git credential…";
+	const { git_credential: cred } = await createGitCredential(client, mist.slug);
+	const dirName = mist.name ?? mist.vendor_name ?? mist.slug;
+	const targetDir = resolve(opts.dir ?? dirName);
+	if (existsSync(targetDir)) {
+		spinner.fail(`Directory ${targetDir} already exists. Pass --dir or remove it first.`);
+		process.exit(1);
+	}
+	spinner.text = `Cloning into ${dirName}/…`;
+	try {
+		await gitClone(cred.remote_url, targetDir);
+	} catch (err) {
+		spinner.fail("git clone failed");
+		throw err;
+	}
+	writeMistFile(targetDir, mist);
+	spinner.succeed(`Cloned into ${chalk.cyan(targetDir)}`);
+	const displayPath = opts.dir ?? join(".", dirName);
+	console.log(chalk.dim(`  cd ${quotePathIfNeeded(displayPath)}`));
+	if (mist.public_url) console.log(chalk.dim(`  ${chalk.cyan(mist.public_url)}`));
+}));
+//#endregion
+//#region src/api/deployments.ts
+async function listDeployments(client, slug, limit) {
+	const id = await resolveMistId(client, slug);
+	return client.get(`/api/v202604/mists/${id}/deployments`, limit != null ? { limit } : void 0);
+}
+async function showDeployment(client, slug, deploymentId) {
+	const id = await resolveMistId(client, slug);
+	return client.get(`/api/v202604/mists/${id}/deployments/${deploymentId}`);
+}
+//#endregion
+//#region src/api/me.ts
+async function fetchCurrentUser(client) {
+	const raw = await client.get("/api/me");
+	const composed = [raw.first_name, raw.last_name].filter(Boolean).join(" ").trim();
+	const fullName = raw.full_name ?? (composed.length > 0 ? composed : null);
 	return {
-		result: {
-			...input.plan,
-			status: pollResult.status === "terminal" ? pollResult.operation.state : stillRunning ? "still_running" : pollResult.status,
-			replacementOperation: latestOperation,
-			recovery,
-			...stillRunning ? {
-				watchedForMs: input.watchedForMs,
-				resumeOperationId: input.operationId,
-				nextStep: input.nextStep({
-					operationId: input.operationId,
-					installationUuid: input.installationUuid,
-					stage: latestOperation?.stage ?? "unknown"
-				})
-			} : {}
-		},
-		isError: !stillRunning && recovery.status !== "complete"
+		id: raw.id,
+		public_id: raw.public_id ?? String(raw.id),
+		full_name: fullName,
+		first_name: raw.first_name ?? null,
+		last_name: raw.last_name ?? null,
+		email: raw.email ?? null
 	};
 }
-function isLifecycleOperationKind(value) {
-	return lifecycleOperationKinds.some((candidate) => candidate === value);
+//#endregion
+//#region src/commands/push.ts
+/**
+* `fluid mist push [--watch]` — mints a credential, pushes to origin, and
+* (with --watch) polls /deployments until READY/ERROR. Spec §3 + §4.
+*/
+/** Used when there's no `-m` and no readable diff to describe. */
+const FALLBACK_ACTION = "Publish from Mist Desktop";
+const POLL_MS$1 = 2e3;
+const LOCATE_TIMEOUT_MS = 2 * 6e4;
+const READY_TIMEOUT_MS = 5 * 6e4;
+const PUBLIC_URL_TIMEOUT_MS = 5e3;
+function sleep$1(ms) {
+	return new Promise((r) => setTimeout(r, ms));
 }
-function isLifecycleOperationState(value) {
-	return lifecycleOperationStates.some((candidate) => candidate === value);
+async function withTimeout(promise, timeoutMs) {
+	let timer = null;
+	try {
+		return await Promise.race([promise, new Promise((_, reject) => {
+			timer = setTimeout(() => reject(/* @__PURE__ */ new Error(`timed out after ${timeoutMs / 1e3}s`)), timeoutMs);
+		})]);
+	} finally {
+		if (timer) clearTimeout(timer);
+	}
 }
-function isOptionalNullableString(value) {
-	return value === void 0 || value === null || typeof value === "string";
+const pushCommand = new Command("push").description("Commit working-tree changes and push to the Mist-managed remote (triggers a hosted deployment)").argument("[slug]", "The mist slug (defaults to .mist file in CWD)").option("--watch", "Poll /deployments until ready or error").option("--branch <name>", "Branch to push (default: main)").option("--no-commit", "Skip the auto-commit step (push existing commits only)").option("-m, --message <message>", "Commit message for the auto-commit (default: timestamped Publish)").action((slug, opts) => runAction(async () => {
+	await ensureGitAvailable();
+	const resolved = resolveSlug(slug);
+	const client = createMistClient();
+	const branch = opts.branch ?? "main";
+	const cwd = process.cwd();
+	const driftSpinner = ora("Checking for remote changes…").start();
+	try {
+		const { git_credential: fetchCred } = await createGitCredential(client, resolved);
+		await gitFetch(cwd, fetchCred.remote_url, branch);
+		const { ahead, behind } = await gitAheadBehindVsFetchHead(cwd);
+		if (behind > 0 && ahead === 0) {
+			const wasDirty = await hasUncommittedChanges(cwd);
+			driftSpinner.text = `Pulling ${behind} commit${behind === 1 ? "" : "s"} from origin/main…`;
+			if (wasDirty) await gitStash(cwd, "mist-push: pre-pull stash");
+			try {
+				await gitMergeFastForward(cwd);
+			} finally {
+				if (wasDirty) await gitStashPop(cwd);
+			}
+			driftSpinner.succeed(`Pulled ${behind} commit${behind === 1 ? "" : "s"} from origin/main`);
+		} else if (behind > 0 && ahead > 0) {
+			driftSpinner.fail(`Your branch and origin/main have diverged (you're ${ahead} ahead, ${behind} behind).`);
+			console.error(chalk.yellow("  Resolve in a terminal: `git pull --rebase`, fix any conflicts, then re-run Publish."));
+			process.exit(1);
+		} else driftSpinner.succeed("Up to date with origin/main");
+	} catch (err) {
+		if (err instanceof Error && err.message.includes("Resolve in a terminal")) throw err;
+		driftSpinner.fail("Couldn't sync with origin/main");
+		throw err;
+	}
+	if (opts.commit !== false) {
+		if (await hasUncommittedChanges(cwd)) {
+			const explicit = opts.message?.trim();
+			const actor = await resolveGitSyncActor(async () => {
+				try {
+					return gitSyncActorFromMe(await withTimeout(fetchCurrentUser(client), 5e3));
+				} catch (err) {
+					const reason = err instanceof Error ? err.message : String(err);
+					console.warn(chalk.yellow(`  (skipping user-stamp on commit — couldn't fetch /api/me: ${reason})`));
+					return null;
+				}
+			});
+			let subject = "";
+			const commitSpinner = ora("Committing changes…").start();
+			try {
+				await gitAutoCommit(cwd, (changes) => {
+					subject = gitSyncCommitSubject(explicit || summarizeChanges(changes) || FALLBACK_ACTION, actor);
+					return subject;
+				});
+				commitSpinner.succeed(subject ? `Committed — ${subject}` : "Committed");
+			} catch (err) {
+				commitSpinner.fail("Commit failed");
+				throw err;
+			}
+		}
+	}
+	const spinner = ora("Minting git credential…").start();
+	const { git_credential: cred } = await createGitCredential(client, resolved);
+	spinner.text = `Pushing ${branch} to origin…`;
+	try {
+		await gitPush(cwd, cred.remote_url, branch);
+	} catch (err) {
+		spinner.fail("git push failed");
+		throw err;
+	}
+	spinner.succeed("Push complete");
+	if (!opts.watch) return;
+	let pushedSha = null;
+	try {
+		const { execa } = await import("execa");
+		pushedSha = (await execa("git", ["rev-parse", "HEAD"], { cwd })).stdout.trim();
+	} catch {}
+	const locateStart = Date.now();
+	let deploymentId = null;
+	let attempt = 0;
+	while (Date.now() - locateStart < LOCATE_TIMEOUT_MS) {
+		attempt++;
+		const { deployments } = await listDeployments(client, resolved, 5);
+		const match = pushedSha ? deployments.find((d) => d.commit_sha === pushedSha) : deployments[0];
+		if (match) {
+			deploymentId = match.id;
+			console.log(`Located deployment ${match.id} (${match.state})`);
+			break;
+		}
+		if (attempt === 1) console.log(`Locating deployment for commit ${pushedSha?.slice(0, 7) ?? "(unknown)"}…`);
+		else if (attempt % 5 === 0) console.log(`  …still waiting (${attempt * 2}s elapsed)`);
+		await sleep$1(POLL_MS$1);
+	}
+	if (!deploymentId) {
+		console.warn(chalk.yellow(`Push succeeded, but hosting has not started commit ${pushedSha?.slice(0, 7) ?? "(unknown)"} after ${LOCATE_TIMEOUT_MS / 1e3}s.`));
+		console.warn(chalk.yellow("The deployment is still queued and may appear later. Run `fluid mist deployments` to check it — do not retry or rewrite the commit just because the hosting queue is slow."));
+		return;
+	}
+	const readyStart = Date.now();
+	let lastState = null;
+	while (Date.now() - readyStart < READY_TIMEOUT_MS) {
+		const { deployment } = await showDeployment(client, resolved, deploymentId);
+		if (deployment.state !== lastState) {
+			console.log(`  ${deployment.state}…`);
+			lastState = deployment.state;
+		}
+		if (deployment.state === "ready") {
+			let publicUrl = null;
+			try {
+				publicUrl = (await withTimeout(showMist(client, resolved), PUBLIC_URL_TIMEOUT_MS)).mist.public_url;
+			} catch (err) {
+				const reason = err instanceof Error ? err.message : String(err);
+				console.warn(chalk.yellow(`  Deployment is ready, but the public URL lookup failed: ${reason}`));
+			}
+			console.log(readyDeploymentMessage(publicUrl, resolved));
+			return;
+		}
+		if (deployment.state === "error" || deployment.state === "canceled") {
+			console.error(`✘ Deployment ${deployment.state}`);
+			process.exit(3);
+		}
+		await sleep$1(POLL_MS$1);
+	}
+	console.error(`Watch timed out after ${READY_TIMEOUT_MS / 1e3}s. Last state: ${lastState}.`);
+	console.error("Run `fluid mist deployments` to check the latest state.");
+	process.exit(3);
+}));
+//#endregion
+//#region src/commands/pull.ts
+/** `fluid mist pull` — git pull origin main. Spec §3. */
+const pullCommand = new Command("pull").description("git pull from the Mist-managed remote").argument("[slug]", "The mist slug (defaults to .mist file in CWD)").option("--branch <name>", "Branch to pull (default: main)").action((slug, opts) => runAction(async () => {
+	await ensureGitAvailable();
+	const resolved = resolveSlug(slug);
+	const client = createMistClient();
+	const branch = opts.branch ?? "main";
+	const spinner = ora("Minting git credential…").start();
+	const { git_credential: cred } = await createGitCredential(client, resolved);
+	spinner.text = `Pulling ${branch}…`;
+	try {
+		await gitPull(process.cwd(), cred.remote_url, branch);
+	} catch (err) {
+		spinner.fail("git pull failed");
+		throw err;
+	}
+	spinner.succeed("Pull complete");
+}));
+//#endregion
+//#region src/commands/open.ts
+/** `fluid mist open` — opens public_url in the default browser. Spec §3. */
+const openCommand = new Command("open").description("Open the mist's public URL in your browser").argument("[slug]", "The mist slug (defaults to .mist file in CWD)").action((slug) => runAction(async () => {
+	const resolved = resolveSlug(slug);
+	const { mist } = await showMist(createMistClient(), resolved);
+	if (!mist.public_url) {
+		console.error(chalk.yellow(`Mist ${mist.slug} has no public URL yet (state: ${mist.state}).`));
+		process.exit(1);
+	}
+	console.log(chalk.cyan(mist.public_url));
+	await open(mist.public_url);
+}));
+//#endregion
+//#region src/commands/deployments.ts
+/** `fluid mist deployments` — list recent deployments. Spec §3. */
+const STATE_COLOR = {
+	ready: chalk.green,
+	building: chalk.yellow,
+	queued: chalk.dim,
+	error: chalk.red,
+	canceled: chalk.red
+};
+const deploymentsCommand = new Command("deployments").description("List recent deployments for a mist").argument("[slug]", "The mist slug (defaults to .mist file in CWD)").option("--limit <n>", "How many to fetch (default 10)").option("--json", "Emit raw API JSON").action((slug, opts) => runAction(async () => {
+	const resolved = resolveSlug(slug);
+	const response = await listDeployments(createMistClient(), resolved, opts.limit ? parseInt(opts.limit, 10) : 10);
+	if (opts.json) return printJson(response);
+	const deployments = response.deployments ?? [];
+	if (deployments.length === 0) {
+		console.log(chalk.dim("No deployments yet."));
+		return;
+	}
+	printTable([[
+		chalk.bold("ID"),
+		chalk.bold("STATE"),
+		chalk.bold("COMMIT"),
+		chalk.bold("MESSAGE"),
+		chalk.bold("AGE")
+	], ...deployments.map((d) => [
+		d.id,
+		(STATE_COLOR[d.state] ?? chalk.white)(d.state),
+		d.commit_sha ? d.commit_sha.slice(0, 7) : chalk.dim("—"),
+		d.commit_message ? d.commit_message.slice(0, 48) : chalk.dim("—"),
+		relativeDate(d.created_at)
+	])]);
+}));
+//#endregion
+//#region src/api/logs.ts
+async function fetchLogs(client, slug, params = {}) {
+	const id = await resolveMistId(client, slug);
+	return client.get(`/api/v202604/mists/${id}/logs`, params);
 }
-function isOptionalNullableNumber(value) {
-	return value === void 0 || value === null || typeof value === "number";
+//#endregion
+//#region src/commands/logs.ts
+/** `fluid mist logs [--tail]` — poll /logs?since=<last> every 2s. Spec §4. */
+const POLL_MS = 2e3;
+function sleep(ms) {
+	return new Promise((r) => setTimeout(r, ms));
 }
-function isOptionalConnectionState(value) {
-	return value === void 0 || value === null || connectionStates.some((candidate) => candidate === value);
+function levelColor(level) {
+	return level === "stderr" ? chalk.red : chalk.dim;
 }
-function isRecord(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
+function printLine(entry) {
+	const ts = entry.timestamp.slice(11, 19);
+	process.stdout.write(`${chalk.dim(ts)} ${levelColor(entry.level)(entry.level.padEnd(6))} ${entry.message}\n`);
 }
-//#endregion
-//#region ../../mist/core/src/operation-polling.ts
-async function pollLifecycleOperation({ fetchStatus, timeoutMs = 1800 * 1e3, minimumIntervalMs = 2e3, sleep: sleepOverride, now = Date.now, abortSignal }) {
-	const sleep = sleepOverride ?? ((durationMs) => defaultSleep(durationMs, abortSignal));
-	const startedAt = now();
-	let latestOperation;
-	while (now() - startedAt < timeoutMs) {
-		abortSignal?.throwIfAborted();
-		const response = await fetchStatus();
-		abortSignal?.throwIfAborted();
-		if (response.status === 404) return { status: "not_found" };
-		const transientServerError = response.status >= 500 && response.status < 600;
-		if (response.status !== 200 && response.status !== 429 && !transientServerError) throw new Error(`Lifecycle status request failed with HTTP ${response.status}`);
-		if (response.operation) {
-			latestOperation = response.operation;
-			if (isTerminalOperation(response.operation)) return {
-				status: "terminal",
-				operation: response.operation
-			};
+const logsCommand = new Command("logs").description("Fetch deployment logs (use --tail to stream)").argument("[slug]", "The mist slug (defaults to .mist file in CWD)").option("--tail", "Stream new logs every 2s").option("--limit <n>", "Initial fetch size (default 200)").option("--deployment <id>", "Logs from a specific deployment ID").option("--json", "Emit raw API JSON (one batch; ignored when --tail)").action((slug, opts) => runAction(async () => {
+	const resolved = resolveSlug(slug);
+	const client = createMistClient();
+	const limit = opts.limit ? parseInt(opts.limit, 10) : 200;
+	const initial = await fetchLogs(client, resolved, {
+		...opts.deployment ? { deployment_id: opts.deployment } : {},
+		limit
+	});
+	if (opts.json && !opts.tail) return printJson(initial);
+	for (const entry of initial.logs) printLine(entry);
+	if (!opts.tail) return;
+	process.stdout.write(`${chalk.dim(`Streaming production logs for ${resolved}${initial.deployment_id ? ` (deployment ${initial.deployment_id})` : ""} — waiting for new entries…`)}\n`);
+	let since = initial.logs.length > 0 ? initial.logs[initial.logs.length - 1].timestamp : (/* @__PURE__ */ new Date()).toISOString();
+	while (true) {
+		await sleep(POLL_MS);
+		const batch = await fetchLogs(client, resolved, {
+			...opts.deployment ? { deployment_id: opts.deployment } : {},
+			since,
+			limit
+		});
+		for (const entry of batch.logs) {
+			printLine(entry);
+			since = entry.timestamp;
 		}
-		const retryAfterMs = Math.max(minimumIntervalMs, (response.retryAfterSeconds ?? response.operation?.retry_after_seconds ?? 0) * 1e3);
-		await sleep(Math.min(retryAfterMs, Math.max(0, timeoutMs - (now() - startedAt))));
-		abortSignal?.throwIfAborted();
 	}
-	return latestOperation ? {
-		status: "timed_out",
-		operation: latestOperation
-	} : { status: "timed_out" };
-}
-function defaultSleep(durationMs, abortSignal) {
-	return new Promise((resolve, reject) => {
-		const onAbort = () => {
-			clearTimeout(timer);
-			reject(abortSignal?.reason);
-		};
-		const timer = setTimeout(() => {
-			abortSignal?.removeEventListener("abort", onAbort);
-			resolve();
-		}, durationMs);
-		abortSignal?.addEventListener("abort", onAbort, { once: true });
-	});
-}
+}));
 //#endregion
-//#region src/api/droplet_replacements.ts
-async function startDropletReplacement(client, input) {
-	const response = await send(client, replacementOperationsPath(input.mistId, input.installationUuid), {
-		method: "POST",
-		headers: { "Content-Type": "application/json" },
-		body: JSON.stringify({ idempotency_key: input.idempotencyKey })
-	});
-	const body = await readJson(response);
-	if (response.ok) return parseReplacementOperation(body);
-	const activeOperationId = response.status === 409 ? parseActiveOperationId(body) : null;
-	if (activeOperationId) return fetchDropletReplacement(client, {
-		mistId: input.mistId,
-		installationUuid: input.installationUuid,
-		operationId: activeOperationId
-	});
-	const retryAfterSeconds = parseRetryAfterHeader(response.headers.get("Retry-After"));
-	const retryHint = retryAfterSeconds === void 0 ? "" : `; retry after ${retryAfterSeconds}s`;
-	throw new MistApiError(`Droplet replacement start failed with HTTP ${response.status}${retryHint}`, response.status);
-}
-async function fetchDropletReplacement(client, input) {
-	const response = await send(client, replacementOperationStatusPath(input.mistId, input.installationUuid, input.operationId), { method: "GET" });
-	if (!response.ok) throw new MistApiError(`Active replacement status failed with HTTP ${response.status}`, response.status);
-	return parseReplacementOperation(await readJson(response));
+//#region src/lib/encrypted-env.ts
+/**
+* Detects Vercel-encrypted env var ciphertext.
+*
+* `GET /api/v202604/mists/:id/env_vars` is a thin proxy to the Mist's
+* Vercel project env — it returns values ENCRYPTED, never plaintext (see
+* apps/mist-desktop/src/main/services/mist-env-vars.service.ts:25-28,
+* which documents the same server behavior for the desktop app's copy of
+* this API). The ciphertext is a base64-encoded JSON envelope of shape
+* `{"v":"v2","c":"<base64 ciphertext>","k":[<byte array>]}`.
+*
+* `fluid mist env pull` uses this to avoid writing that ciphertext into
+* `.env.local` as if it were a usable value.
+*/
+const BASE64_RE = /^[A-Za-z0-9+/]+={0,2}$/;
+function looksLikeBase64(value) {
+	return value.length > 0 && value.length % 4 === 0 && BASE64_RE.test(value);
 }
-/** Poll an operation until it is terminal, gone, or `timeoutMs` elapses. */
-function pollDropletReplacement(client, input) {
-	const statusPath = replacementOperationStatusPath(input.mistId, input.installationUuid, input.operationId);
-	return pollLifecycleOperation({
-		timeoutMs: input.timeoutMs,
-		...input.sleep ? { sleep: input.sleep } : {},
-		fetchStatus: async () => {
-			const response = await send(client, statusPath, { method: "GET" });
-			const retryAfterSeconds = parseRetryAfterHeader(response.headers.get("Retry-After"));
-			if (response.status === 404 || response.status === 429) return {
-				status: response.status,
-				retryAfterSeconds
-			};
-			if (!response.ok) return { status: response.status };
-			return {
-				status: response.status,
-				operation: parseReplacementOperation(await readJson(response)),
-				retryAfterSeconds
-			};
-		}
-	});
+function hasEncryptedEnvelopeShape(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value) && "v" in value && "c" in value && "k" in value;
 }
-async function send(client, path, init) {
+/**
+* True when `value` is the Vercel encrypted-env envelope: a base64 string
+* that decodes to a JSON object with the `{ v, c, k }` shape. Returns
+* false for empty strings, non-base64 strings, and base64 strings that
+* decode to plaintext or to JSON that doesn't match the envelope shape —
+* so real plaintext secrets that happen to look like base64 are never
+* misclassified as ciphertext.
+*/
+function isVercelEncryptedEnvValue(value) {
+	if (!looksLikeBase64(value)) return false;
+	let decoded;
 	try {
-		return await client.request(path, init);
-	} catch (err) {
-		throw new MistApiError(`Network error: ${err instanceof Error ? err.message : String(err)}`, 0);
+		decoded = Buffer.from(value, "base64").toString("utf8");
+	} catch {
+		return false;
 	}
-}
-async function readJson(response) {
-	const text = await response.text();
-	if (!text) return null;
+	let parsed;
 	try {
-		return JSON.parse(text);
+		parsed = JSON.parse(decoded);
 	} catch {
-		return null;
+		return false;
 	}
+	return hasEncryptedEnvelopeShape(parsed);
 }
 //#endregion
-//#region src/lib/reinstall-plan-store.ts
+//#region src/commands/env/list.ts
+/** `fluid mist env list` — list env vars; mark managed_by entries. Spec §4. */
+function maskValue(value) {
+	if (value.length <= 8) return "•".repeat(value.length);
+	return `${value.slice(0, 4)}${"•".repeat(8)}${value.slice(-2)}`;
+}
 /**
-* Plan receipts for `fluid mist droplet reinstall`.
-*
-* Mist Desktop's agent must show a dry-run plan and get explicit approval
-* before it may confirm the irreversible replacement. A CLI has no
-* conversation to hold that sequence, so `--dry-run` records a receipt of
-* the exact Droplet, installation and lifecycle URLs it showed, and
-* `--confirm` refuses unless a receipt for the same plan is younger than
-* {@link REINSTALL_PLAN_TTL_MS}. `--confirm` claims the receipt atomically
-* (a rename only one process can win) before checking it, so one plan
-* approves at most one attempt and every retry needs a fresh plan.
-*
-* Receipts live under the Fluid config dir (`~/.fluid/mist/reinstall-plans`)
-* and hold only ids and a timestamp — no tokens or secrets.
+* Values come back Vercel-encrypted ciphertext (see
+* `../../lib/encrypted-env.ts`) — never show that raw blob, masked or not,
+* since it isn't the real secret and can run to ~1KB of base64.
 */
-/** How long a shown plan stays valid for `--confirm`. */
-const REINSTALL_PLAN_TTL_MS = 900 * 1e3;
-function createFileReinstallPlanStore(dir = join(getConfigDir(), "mist", "reinstall-plans")) {
-	const fileFor = (mistId) => join(dir, `${encodeURIComponent(mistId)}.json`);
-	return {
-		save(receipt) {
-			mkdirSync(dir, {
-				recursive: true,
-				mode: 448
-			});
-			writeFileSync(fileFor(receipt.mistId), JSON.stringify(receipt, null, 2) + "\n", {
-				encoding: "utf8",
-				mode: 384
-			});
-		},
-		load(mistId) {
-			try {
-				const parsed = JSON.parse(readFileSync(fileFor(mistId), "utf8"));
-				return isReceipt(parsed) && parsed.mistId === mistId ? parsed : null;
-			} catch {
-				return null;
-			}
-		},
-		claim(mistId) {
-			const claimed = `${fileFor(mistId)}.claimed-${process.pid}-${randomUUID()}`;
-			try {
-				renameSync(fileFor(mistId), claimed);
-			} catch {
-				return null;
-			}
-			try {
-				const parsed = JSON.parse(readFileSync(claimed, "utf8"));
-				return isReceipt(parsed) && parsed.mistId === mistId ? parsed : null;
-			} catch {
-				return null;
-			} finally {
-				rmSync(claimed, { force: true });
-			}
-		}
-	};
+function displayValue(v, showValues) {
+	if (isVercelEncryptedEnvValue(v.value)) return chalk.dim("<encrypted>");
+	return showValues ? v.value : maskValue(v.value);
 }
-/** Whether `receipt` approves executing the freshly computed plan. */
-function checkPlanReceipt(receipt, fresh, now) {
-	if (!receipt) return {
-		ok: false,
-		code: "plan_required"
-	};
-	const plannedAt = Date.parse(receipt.plannedAt);
-	if (!Number.isFinite(plannedAt) || now - plannedAt > 9e5) return {
-		ok: false,
-		code: "plan_stale"
-	};
-	if (plannedAt > now) return {
-		ok: false,
-		code: "plan_stale"
-	};
-	if (receipt.dropletUuid !== fresh.dropletUuid || receipt.installationUuid !== fresh.installationUuid || receipt.embedUrl !== fresh.embedUrl || receipt.installWebhookUrl !== fresh.installWebhookUrl || receipt.uninstallWebhookUrl !== fresh.uninstallWebhookUrl) return {
-		ok: false,
-		code: "plan_changed"
+const envListCommand = new Command("list").description("List a mist's env vars").argument("[slug]", "The mist slug (defaults to .mist file in CWD)").option("--show-values", "Print full values instead of masking them").option("--json", "Emit raw API JSON").action((slug, opts) => runAction(async () => {
+	const resolved = resolveSlug(slug);
+	const response = await listEnvVars(createMistClient(), resolved);
+	if (opts.json) return printJson(response);
+	const vars = response.env_vars ?? [];
+	if (vars.length === 0) {
+		console.log(chalk.dim("No env vars."));
+		return;
+	}
+	printTable([[
+		chalk.bold("KEY"),
+		chalk.bold("VALUE"),
+		chalk.bold("TARGETS"),
+		chalk.bold("MANAGED")
+	], ...vars.map((v) => [
+		v.key,
+		displayValue(v, opts.showValues),
+		v.targets.join(","),
+		v.managed_by === "mist" ? chalk.magenta("mist") : chalk.dim("user")
+	])]);
+}));
+//#endregion
+//#region ../../mist/core/src/secret-generator.ts
+const MIN_BYTES = 16;
+const MAX_BYTES = 128;
+const DEFAULT_BYTES = 32;
+/** Return a random secret. Pure + synchronous so it's trivially
+*  testable (entropy + encoding + clamping) without any I/O. */
+function generateSecret(options = {}) {
+	const encoding = options.encoding ?? "base64url";
+	const requested = options.bytes ?? DEFAULT_BYTES;
+	const bytes = Math.min(MAX_BYTES, Math.max(MIN_BYTES, Math.trunc(requested)));
+	const buf = new Uint8Array(bytes);
+	globalThis.crypto.getRandomValues(buf);
+	return {
+		secret: encode(buf, encoding),
+		bytes,
+		encoding
 	};
-	return { ok: true };
 }
-function isReceipt(value) {
-	if (typeof value !== "object" || value === null) return false;
-	const record = value;
-	return typeof record["mistId"] === "string" && typeof record["dropletUuid"] === "string" && typeof record["installationUuid"] === "string" && typeof record["embedUrl"] === "string" && typeof record["installWebhookUrl"] === "string" && typeof record["uninstallWebhookUrl"] === "string" && typeof record["plannedAt"] === "string";
+function encode(buf, encoding) {
+	if (encoding === "hex") return Array.from(buf, (byte) => byte.toString(16).padStart(2, "0")).join("");
+	const base64 = btoa(String.fromCharCode(...buf));
+	if (encoding === "base64") return base64;
+	return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
 //#endregion
-//#region src/lib/droplet-repair.ts
+//#region src/commands/env/set.ts
 /**
-* Orchestration for `fluid mist droplet repair` and
-* `fluid mist droplet reinstall`, ported from Mist Desktop's
-* `repair_droplet_lifecycle_webhooks` and `repair_and_reinstall_droplet`
-* tools (`apps/mist-desktop/src/main/tools/index.ts` in the fluid repo).
+* `fluid mist env set <slug> KEY=value [KEY=value ...]` — POST for new
+* keys, PATCH for existing. Spec §3 + §4.
 *
-* The planning and safety rules are shared through `@fluid-app/mist-core`
-* (`droplet-lifecycle-repair`, `droplet-replacement`); this module only
-* wires them to the CLI's API client, the `.mist` marker and the plan
-* receipt store. Every function takes its client and collaborators as
-* arguments so tests drive it with fakes.
-*/
-/** A refusal: the command stops before (or instead of) mutating anything
-*  and exits non-zero. `code` is stable for scripts. */
-var DropletRepairRefusal = class extends Error {
-	code;
-	constructor(code, message) {
-		super(message);
-		this.name = "DropletRepairRefusal";
-		this.code = code;
-	}
-};
-/**
-* Resolve the Mist (slug argument or the `.mist` in `cwd`), its public URL,
-* the Droplet it is attached to, and the canonical Droplet URLs. Refuses
-* when the Mist has no public URL or no attached Droplet.
+* `fluid mist env set [slug] KEY --generate [--bytes N]` mints a random
+* secret for KEY instead (the generator Mist's `set_mist_env_var` uses),
+* writes it, and prints it exactly once.
 */
-async function resolveRepairTarget(client, input) {
-	const slug = resolveSlug(input.slug, input.cwd);
-	const marker = readMistFileFrom(input.cwd);
-	const isCwdProject = marker !== null && marker.slug === slug;
-	const mistId = await resolveMistId(client, slug);
-	const { mist } = await showMist(client, mistId);
-	const publicUrl = normalizePublicUrl(mist.public_url);
-	if (!publicUrl) throw new DropletRepairRefusal("no_public_url", "Mist has no public_url yet. Publish the Mist first (`fluid mist push`), then repair lifecycle webhooks.");
-	const dropletUuid = await resolveAttachedDropletUuid(client, mist, mistId, publicUrl);
-	const paths = isCwdProject ? readLifecyclePaths(input.cwd) : null;
+/** Env var name rule enforced by Rails (mirrors Mist's ENV_KEY_RE). */
+const ENV_KEY_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+const GENERATED_SECRET_NOTICE = "This secret is shown once and won't be shown again; Fluid stores it encrypted. Copy it now if you also need it in .env.local. Redeploy (fluid mist push) for the change to take effect.";
+function parsePair(pair) {
+	const eq = pair.indexOf("=");
+	if (eq <= 0) throw new Error(`Invalid pair "${pair}". Use KEY=value (no leading spaces).`);
 	return {
-		mistId,
-		mistSlug: mist.slug ?? slug,
-		dropletUuid,
-		canonical: canonicalDropletUrls(publicUrl, paths ?? DEFAULT_DROPLET_LIFECYCLE_PATHS),
-		lifecyclePathsSource: paths ? "fluid.capabilities.json" : "defaults"
+		key: pair.slice(0, eq),
+		value: pair.slice(eq + 1)
 	};
 }
+function parseBytes(value) {
+	const bytes = Number(value);
+	if (!Number.isInteger(bytes) || bytes < 16 || bytes > 128) throw new InvalidArgumentError("Use a whole number from 16 to 128.");
+	return bytes;
+}
 /**
-* The Mist's own Droplet. The server-owned link wins (the Mist record, then
-* its droplet integration point); matching `embed_url` is only a legacy
-* fallback, because a broken embed URL is exactly what the repair fixes.
+* Generate a secret for `key` and write it to the Mist. Refuses invalid
+* and Mist-managed keys BEFORE generating, so a secret is only ever
+* returned once it has been stored.
 */
-async function resolveAttachedDropletUuid(client, mist, mistId, publicUrl) {
-	if (typeof mist.droplet?.uuid === "string" && mist.droplet.uuid.length > 0) return mist.droplet.uuid;
-	try {
-		const { integration_points } = await listIntegrationPoints(client, mistId);
-		const attached = findDropletIntegrationPoint(integration_points);
-		if (attached?.integratable_uuid) return attached.integratable_uuid;
-		if (attached?.integratable_id != null) {
-			const uuid = await findDropletUuidByNumericId(client, attached.integratable_id);
-			if (uuid) return uuid;
+async function setGeneratedEnvVar(client, slug, key, bytes) {
+	if (!ENV_KEY_RE.test(key)) throw new Error(`Invalid env var name "${key}". Use letters, digits and underscores, not starting with a digit.`);
+	const current = ((await listEnvVars(client, slug)).env_vars ?? []).find((v) => v.key === key);
+	if (current?.managed_by === "mist") throw new Error(`"${key}" is managed by Fluid and can't be set; it is provisioned automatically for the Mist.`);
+	const secret = generateSecret(bytes === void 0 ? {} : { bytes });
+	if (current) await updateEnvVar(client, slug, key, secret.secret);
+	else await createEnvVar(client, slug, key, secret.secret);
+	return {
+		key,
+		action: current ? "updated" : "created",
+		generatedSecret: secret.secret,
+		bytes: secret.bytes,
+		encoding: secret.encoding,
+		note: GENERATED_SECRET_NOTICE
+	};
+}
+const envSetCommand = new Command("set").description("Set one or more env vars (KEY=value KEY=value …), or generate a secret for KEY with --generate").argument("<slug-or-pair>", "The mist slug, or the first KEY=value pair (or KEY with --generate)").argument("[pairs...]", "Additional KEY=value pairs (or KEY with --generate)").option("--generate", "Generate a random secret as the value of one KEY and print it once").option("--bytes <n>", "Entropy for --generate, in bytes (16-128, default 32)", parseBytes).option("--json", "Emit JSON (with --generate)").action(async (slugOrPair, pairs, opts) => {
+	await runAction(async () => {
+		if (opts.generate) {
+			await runGenerate([slugOrPair, ...pairs], opts);
+			return;
 		}
-	} catch (err) {
-		if (err instanceof MistApiError && err.status === 0) throw err;
+		if (opts.bytes !== void 0) {
+			console.error(chalk.red("--bytes only applies with --generate."));
+			process.exit(1);
+		}
+		let slug;
+		let rawPairs;
+		if (slugOrPair.includes("=")) {
+			slug = resolveSlug();
+			rawPairs = [slugOrPair, ...pairs];
+		} else {
+			slug = resolveSlug(slugOrPair);
+			rawPairs = pairs;
+		}
+		if (rawPairs.length === 0) {
+			console.error(chalk.red("Pass at least one KEY=value pair."));
+			process.exit(1);
+		}
+		const client = createMistClient();
+		const existing = await listEnvVars(client, slug);
+		const existingKeys = new Set((existing.env_vars ?? []).map((v) => v.key));
+		for (const raw of rawPairs) {
+			const { key, value } = parsePair(raw);
+			if (existingKeys.has(key)) {
+				await updateEnvVar(client, slug, key, value);
+				console.log(`${chalk.green("updated")}  ${key}`);
+			} else {
+				await createEnvVar(client, slug, key, value);
+				console.log(`${chalk.cyan("created")}  ${key}`);
+			}
+		}
+	});
+});
+/** `env set [slug] KEY --generate`: exactly one KEY, without a value. */
+async function runGenerate(args, opts) {
+	if (args.length > 2) {
+		console.error(chalk.red("--generate sets one key at a time: env set [slug] KEY --generate"));
+		process.exit(1);
 	}
-	const byEmbedUrl = await findDropletByEmbedUrl(client, publicUrl);
-	if (byEmbedUrl) {
-		if (!byEmbedUrl.uuid) throw new DropletRepairRefusal("droplet_not_found", `Droplet with embed_url ${publicUrl} was found, but its API response did not include a uuid.`);
-		return byEmbedUrl.uuid;
+	const [first, second] = args;
+	const key = (second ?? first ?? "").trim();
+	if (key.includes("=")) {
+		console.error(chalk.red(`--generate creates the value itself; pass the key alone (e.g. ${key.split("=")[0]}).`));
+		process.exit(1);
 	}
-	throw new DropletRepairRefusal("droplet_not_found", "This Mist is not attached to a Droplet, and no Droplet with a matching embed_url was found. Attach or recreate the Droplet first (`fluid mist attach-droplet`), then retry.");
-}
-/** Lifecycle paths from `fluid.capabilities.json`, or null when absent or
-*  unreadable (the caller then uses the defaults). */
-function readLifecyclePaths(cwd) {
-	const file = join(cwd, "fluid.capabilities.json");
-	if (!existsSync(file)) return null;
-	try {
-		return dropletLifecyclePathsFromCapabilities(JSON.parse(readFileSync(file, "utf8")));
-	} catch {
-		return null;
+	const slug = second === void 0 ? resolveSlug() : resolveSlug(first);
+	const result = await setGeneratedEnvVar(createMistClient(), slug, key, opts.bytes);
+	if (opts.json) {
+		printJson(result);
+		return;
 	}
+	const verb = result.action === "updated" ? chalk.green("updated") : chalk.cyan("created");
+	console.log(`${verb}  ${result.key}  (${result.bytes}-byte generated secret)`);
+	console.log();
+	console.log(result.generatedSecret);
+	console.log();
+	console.log(chalk.yellow(result.note));
 }
-/** Read the Droplet and report the planned repair without mutating. */
-async function planDropletRepair(client, target, dryRun) {
-	const { droplet } = await getDroplet(client, target.dropletUuid);
-	const { alreadyCorrect, summary } = planLifecycleRepair({
-		mistId: target.mistId,
-		mistSlug: target.mistSlug,
-		dropletUuid: target.dropletUuid,
-		canonical: target.canonical,
-		current: droplet,
-		dryRun
-	});
-	return {
-		alreadyCorrect,
-		summary: {
-			...summary,
-			lifecyclePathsSource: target.lifecyclePathsSource
+//#endregion
+//#region src/commands/env/unset.ts
+/** `fluid mist env unset <slug> KEY [KEY ...]` — DELETE per key. Spec §3. */
+const envUnsetCommand = new Command("unset").description("Delete one or more env vars").argument("<slug-or-key>", "The mist slug, or the first KEY (if .mist file is present)").argument("[keys...]", "Additional keys").action(async (slugOrKey, keys) => {
+	await runAction(async () => {
+		let slug;
+		let toDelete;
+		if (/^[A-Z_][A-Z0-9_]*$/.test(slugOrKey)) {
+			slug = resolveSlug();
+			toDelete = [slugOrKey, ...keys];
+		} else {
+			slug = resolveSlug(slugOrKey);
+			toDelete = keys;
 		}
-	};
+		if (toDelete.length === 0) {
+			console.error(chalk.red("Pass at least one KEY."));
+			process.exit(1);
+		}
+		const client = createMistClient();
+		for (const key of toDelete) {
+			await deleteEnvVar(client, slug, key);
+			console.log(`${chalk.red("deleted")}  ${key}`);
+		}
+	});
+});
+//#endregion
+//#region src/commands/env/pull.ts
+/**
+* `fluid mist env pull` — writes `.env.local` with user-managed vars only.
+* Skips `managed_by: "mist"` entries (DATABASE_URL, FLUID_*) since local
+* dev uses PGlite, not the production database. Spec §4 + §5.
+*
+* Also skips user-managed vars whose value comes back as Vercel-encrypted
+* ciphertext (`GET .../env_vars` is a proxy to Vercel's project env, which
+* never returns plaintext — see `../../lib/encrypted-env.ts`). Writing that
+* ciphertext into `.env.local` verbatim would silently produce an unusable
+* file, so those keys are collected and surfaced as a warning instead.
+*
+* The output file is MERGED, not replaced: pulled plaintext values update
+* their existing lines (or are appended), while every other existing line
+* — comments, locally maintained secrets for encrypted/managed keys, and
+* local-only vars — is preserved verbatim. Replacing the file wholesale
+* would delete manually set values for skipped keys, and an all-encrypted
+* response would truncate the file to zero bytes right before telling the
+* user to set those same values locally.
+*/
+function escapeValue(v) {
+	if (/[\s#"']/.test(v)) return `"${v.replace(/(["\\$`])/g, "\\$1")}"`;
+	return v;
 }
 /**
-* PATCH only the embed and lifecycle webhook URLs, then re-read the Droplet
-* to verify. A no-op when they already match.
+* Splits the raw env-var list into what `env pull` can safely write vs.
+* what it must skip, and why. Pure — no I/O — so it's unit-testable
+* without mocking the API client or the filesystem.
 */
-async function applyDropletRepair(client, target) {
-	const planned = await planDropletRepair(client, target, false);
-	if (planned.alreadyCorrect) return {
-		summary: planned.summary,
-		isError: false
-	};
-	await client.patch(`/api/droplets/${encodeURIComponent(target.dropletUuid)}`, dropletRepairPatch(target.canonical));
-	let verifyStatus = 200;
-	let verified = false;
-	try {
-		const { droplet } = await getDroplet(client, target.dropletUuid);
-		verified = dropletUrlsMatch(droplet, target.canonical);
-	} catch (err) {
-		verifyStatus = err instanceof MistApiError ? err.status : 0;
-	}
+function partitionPullEnvVars(envVars) {
+	const plaintext = [];
+	const encrypted = [];
+	const managed = [];
+	for (const v of envVars) if (v.managed_by === "mist") managed.push(v);
+	else if (isVercelEncryptedEnvValue(v.value)) encrypted.push(v);
+	else plaintext.push(v);
 	return {
-		summary: {
-			...planned.summary,
-			status: verified ? "updated" : "error",
-			verified,
-			verifyStatus
-		},
-		isError: !verified
+		plaintext,
+		encrypted,
+		managed
 	};
 }
-const PLAN_TTL_MINUTES = REINSTALL_PLAN_TTL_MS / 6e4;
+/** Matches a `KEY=` / `export KEY=` assignment line and captures the key. */
+const ENV_ASSIGNMENT = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=/;
 /**
-* `fluid mist droplet reinstall`. Same sequencing as Mist's
-* `repair_and_reinstall_droplet`: plan first, explicit approval, one
-* backend-owned replacement, resumable watching. Refusals return a
-* non-zero exit code; nothing irreversible starts without `--confirm`
-* matching a fresh `--dry-run` plan.
+* Merges pulled plaintext vars into the existing env-file contents.
+* Existing assignment lines for pulled keys are updated in place; every
+* other line (comments, blank lines, locally maintained values for keys
+* the pull skipped) is preserved verbatim; new keys are appended. Pure —
+* no I/O — so it's unit-testable without touching the filesystem.
 */
-async function runDropletReinstall(deps, opts) {
-	const now = deps.now ?? Date.now;
-	const refusal = (code, message) => ({
-		output: {
-			status: "refused",
-			code,
-			message
-		},
-		exitCode: 1
-	});
-	if (opts.dryRun && opts.confirm) return refusal("conflicting_flags", "Pass either --dry-run (show the plan) or --confirm (execute it), not both.");
-	if (opts.dryRun && opts.resumeOperationId?.trim()) return refusal("conflicting_flags", "--resume keeps watching a replacement that already started; it does not take --dry-run. Run it with --installation only.");
-	const request = {
-		dryRun: opts.dryRun === true,
-		confirmDestructiveReinstall: opts.confirm === true,
-		installationUuid: opts.installationUuid?.trim() || void 0,
-		resumeOperationId: opts.resumeOperationId
-	};
-	const requestCheck = checkReplacementRequest(request);
-	if (!requestCheck.ok) return refusal(requestCheck.code, "--resume also needs --installation with the installationUuid from that same \"still_running\" result. Replacement status is scoped to the installation the operation started on, so resuming without it would watch the wrong one.");
-	const { resumeOperationId } = requestCheck;
-	if (!request.dryRun && replacementStartNeedsConfirmation(request, resumeOperationId)) return refusal("confirmation_required", opts.yes ? "--yes does not approve an irreversible reinstall. Run with --dry-run, review the exact dropletUuid and installationUuid, then rerun with --confirm." : "Refused to start an irreversible replacement without explicit confirmation. Run with --dry-run, review the exact dropletUuid and installationUuid, then rerun with --confirm.");
-	try {
-		const target = await resolveRepairTarget(deps.client, {
-			slug: deps.slug,
-			cwd: deps.cwd
-		});
-		const plannedRepair = await planDropletRepair(deps.client, target, true);
-		const installation = selectReplacementInstallation({
-			installations: await listAllDropletInstallations(deps.client),
-			dropletUuid: target.dropletUuid,
-			installationUuid: request.installationUuid,
-			resumeOperationId
-		});
-		if (!installation?.uuid) return refusal("installation_not_found", `No active installation for attached Droplet ${target.dropletUuid} was found. If a previous approved replacement terminalized the source, rerun with that plan's --installation <uuid>; otherwise install the Droplet once from Fluid first.`);
-		const installationUuid = installation.uuid;
-		const idempotencyKey = deps.newIdempotencyKey();
-		const planInput = {
-			dryRun: request.dryRun,
-			resumeOperationId,
-			mistId: target.mistId,
-			dropletUuid: target.dropletUuid,
-			installation: {
-				...installation,
-				uuid: installationUuid
-			},
-			idempotencyKey
-		};
-		if (request.dryRun) {
-			deps.planStore.save({
-				mistId: target.mistId,
-				dropletUuid: target.dropletUuid,
-				installationUuid,
-				...target.canonical,
-				plannedAt: new Date(now()).toISOString()
-			});
-			const confirmCommand = reinstallCommand(target.mistSlug, ["--confirm", ...request.installationUuid ? ["--installation", installationUuid] : []]);
-			return {
-				output: {
-					...buildReplacementPlan({
-						...planInput,
-						lifecycleRepair: plannedRepair.summary
-					}),
-					nextStep: `Review the dropletUuid and installationUuid above. This replacement is irreversible. To approve it, run \`${confirmCommand}\` within ${PLAN_TTL_MINUTES} minutes.`
-				},
-				exitCode: 0
-			};
-		}
-		let lifecycleRepair = plannedRepair.summary;
-		let startedOperation = null;
-		if (!resumeOperationId) {
-			const receiptCheck = checkPlanReceipt(deps.planStore.claim(target.mistId), {
-				dropletUuid: target.dropletUuid,
-				installationUuid,
-				...target.canonical
-			}, now());
-			if (!receiptCheck.ok) return refusal(receiptCheck.code, planReceiptMessage(receiptCheck.code));
-			const repaired = await applyDropletRepair(deps.client, target);
-			lifecycleRepair = repaired.summary;
-			if (repaired.isError) return {
-				output: {
-					status: "error",
-					code: "lifecycle_repair_failed",
-					message: "The Droplet lifecycle URLs did not verify after the repair, so no replacement was started.",
-					lifecycleRepair
-				},
-				exitCode: 1
-			};
-			startedOperation = await startDropletReplacement(deps.client, {
-				mistId: target.mistId,
-				installationUuid,
-				idempotencyKey
-			});
-		}
-		const plan = buildReplacementPlan({
-			...planInput,
-			lifecycleRepair
-		});
-		const operationId = resumeOperationId ?? startedOperation?.id;
-		if (!operationId) return {
-			output: {
-				...plan,
-				status: "error",
-				code: "missing_operation_id",
-				message: "Fluid accepted the replacement but did not return an operation id to watch."
-			},
-			exitCode: 1
-		};
-		const watchedForMs = opts.watchTimeoutMs ?? 12e4;
-		const watch = summarizeReplacementWatch({
-			plan,
-			pollResult: await pollDropletReplacement(deps.client, {
-				mistId: target.mistId,
-				installationUuid,
-				operationId,
-				timeoutMs: watchedForMs,
-				...deps.sleep ? { sleep: deps.sleep } : {}
-			}),
-			startedOperation,
-			operationId,
-			installationUuid,
-			watchedForMs,
-			nextStep: ({ operationId: id, installationUuid: source, stage }) => `Fluid is still working on this replacement: it is not finished and it did not fail. Current stage: ${stage}. Keep watching with \`${reinstallCommand(target.mistSlug, [
-				"--resume",
-				id,
-				"--installation",
-				source
-			])}\`. The reinstall is complete only when status is "succeeded".`
-		});
-		return {
-			output: { ...watch.result },
-			exitCode: watch.isError ? 1 : 0
-		};
-	} catch (err) {
-		if (err instanceof DropletRepairRefusal) return refusal(err.code, err.message);
-		throw err;
+function mergeEnvContents(existing, plaintext) {
+	const updates = new Map(plaintext.map((v) => [v.key, `${v.key}=${escapeValue(v.value)}`]));
+	const lines = existing.length > 0 ? existing.split("\n") : [];
+	if (lines.at(-1) === "") lines.pop();
+	const out = [];
+	for (const line of lines) {
+		const key = ENV_ASSIGNMENT.exec(line)?.[1];
+		const replacement = key === void 0 ? void 0 : updates.get(key);
+		if (key !== void 0 && replacement !== void 0) {
+			out.push(replacement);
+			updates.delete(key);
+		} else out.push(line);
 	}
+	for (const rendered of updates.values()) out.push(rendered);
+	return out.length > 0 ? out.join("\n") + "\n" : "";
 }
-function reinstallCommand(slug, flags) {
-	return [
-		"fluid mist droplet reinstall",
+const envPullCommand = new Command("pull").description("Write user-managed env vars to .env.local in the CWD").argument("[slug]", "The mist slug (defaults to .mist file in CWD)").option("--out <path>", "Output path (default: .env.local)").action((slug, opts) => runAction(async () => {
+	const resolved = resolveSlug(slug);
+	const { env_vars } = await listEnvVars(createMistClient(), resolved);
+	const { plaintext, encrypted, managed } = partitionPullEnvVars(env_vars);
+	const outName = opts.out ?? ".env.local";
+	const target = join(process.cwd(), outName);
+	const existing = existsSync(target) ? readFileSync(target, "utf8") : "";
+	writeFileSync(target, mergeEnvContents(existing, plaintext), "utf8");
+	console.log(chalk.green(`Wrote ${plaintext.length} var(s) to ${target.replace(process.cwd() + "/", "")}${existing.length > 0 ? " (existing entries for other keys preserved)" : ""}.`));
+	if (managed.length > 0) console.log(chalk.dim(`Skipped ${managed.length} Mist-managed var(s): ${managed.map((v) => v.key).join(", ")} (local dev uses PGlite)`));
+	if (encrypted.length > 0) console.log(chalk.yellow(`Skipped ${encrypted.length} var(s) whose values are stored encrypted and can't be pulled: ${encrypted.map((v) => v.key).join(", ")} — set them locally in ${outName} yourself (values are visible in the Vercel dashboard) or re-set them via \`fluid mist env set\`.`));
+}));
+//#endregion
+//#region src/commands/env/index.ts
+/** `fluid mist env` — sub-command aggregator. */
+const envCommand = new Command("env").description("Manage a mist's environment variables").addCommand(envListCommand).addCommand(envSetCommand).addCommand(envUnsetCommand).addCommand(envPullCommand);
+//#endregion
+//#region src/commands/droplet/egress-proxy.ts
+/**
+* `fluid mist droplet egress-proxy <on|off> [slug] [--json]`
+*
+* Ask Fluid (on) to let the Mist's attached Droplet reach external systems
+* such as Exigo through its egress proxy, or withdraw the request (off). A
+* Fluid admin approves the request; withdrawing it also removes the grant.
+* Leaves an already-correct droplet untouched. Safe Mode treats this as a
+* write (apps/mist-desktop fluid-cli-policy).
+*/
+function parseEgressProxyState(value) {
+	const normalized = value.trim().toLowerCase();
+	if (normalized === "on") return true;
+	if (normalized === "off") return false;
+	throw new InvalidArgumentError("Use \"on\" or \"off\".");
+}
+const dropletEgressProxyCommand = new Command("egress-proxy").description("Ask Fluid (on) or stop asking (off) to let the attached Droplet reach external systems such as Exigo through its egress proxy; a Fluid admin approves it").argument("<state>", "on | off", parseEgressProxyState).argument("[slug]", "Mist slug (defaults to the .mist file in CWD)").option("--json", "Emit JSON").action((requested, slug, opts) => runAction(async () => {
+	const result = await setDropletEgressProxy(createMistClient(), {
 		slug,
-		...flags
-	].join(" ");
-}
-function planReceiptMessage(code) {
-	switch (code) {
-		case "plan_required": return "Refused: no reinstall plan has been shown for this Mist. Run with --dry-run first, review the plan, then rerun with --confirm.";
-		case "plan_stale": return `Refused: the reinstall plan is older than ${PLAN_TTL_MINUTES} minutes. Run with --dry-run again, review the plan, then rerun with --confirm.`;
-		case "plan_changed": return "Refused: the Droplet, installation or lifecycle URLs changed since the plan was shown. Run with --dry-run again, review the new plan, then rerun with --confirm.";
-	}
-}
+		cwd: process.cwd(),
+		requested
+	});
+	if (opts.json) return printJson(result);
+	const target = `droplet ${result.dropletUuid} (${result.mistSlug})`;
+	if (!result.requested) console.log(result.changed ? `${chalk.green("✓")} Egress request withdrawn for ${target}` : chalk.dim(`No egress request for ${target}`));
+	else if (result.granted) console.log(`${chalk.green("✓")} Egress granted for ${target}`);
+	else console.log(`${chalk.green("✓")} Egress requested for ${target}. A Fluid admin must approve it before the proxy admits the droplet.`);
+}));
 //#endregion
 //#region src/commands/droplet/reinstall.ts
 /**
@@ -3633,7 +3832,7 @@ function printSummary(summary, options = {}) {
 //#endregion
 //#region src/commands/droplet/index.ts
 /** `fluid mist droplet` — sub-command aggregator for the attached Droplet. */
-const dropletCommand = new Command("droplet").description("Repair or reinstall the Mist's attached Droplet").addCommand(dropletRepairCommand).addCommand(dropletReinstallCommand);
+const dropletCommand = new Command("droplet").description("Repair, reinstall, or set egress for the Mist's attached Droplet").addCommand(dropletRepairCommand).addCommand(dropletReinstallCommand).addCommand(dropletEgressProxyCommand);
 //#endregion
 //#region src/index.ts
 /**