@fluid-app/fluid-cli-mist 0.1.9 → 0.1.11

package/dist/index.d.mts

@@ -129,9 +129,10 @@ interface DropletUpdateRequest {
 }
 interface DropletRecord {
   /**
-  * Numeric id is NOT returned by `POST /api/droplets` and isn't exposed
-  * anywhere the CLI can read it — attach by `uuid` instead (see
-  * `IntegrationPointCreateInput.integratable_uuid`).
+  * Numeric id is NOT returned by `POST /api/droplets` — attach by `uuid`
+  * instead (see `IntegrationPointCreateInput.integratable_uuid`). The
+  * `GET /api/droplets` list rows DO carry it, which is the only way to
+  * map a legacy integration point's `integratable_id` back to a uuid.
   */
   id?: number;
   uuid: string;
@@ -151,6 +152,50 @@ interface DropletShowResponse {
   meta?: ApiMeta;
   status?: number;
 }
+/**
+* Page-number pagination used by the company-level droplet + installation
+* list endpoints (`?page=&per_page=`) — unlike the mist sub-resources,
+* these do NOT use cursor pagination. Shape mirrors fluid-admin's
+* `networking/droplets.api.ts` response schemas.
+*/
+interface PagePaginationMeta {
+  request_id?: string;
+  timestamp?: string;
+  pagination?: {
+    current_page?: number;
+    total_pages?: number;
+    total_count?: number;
+    per_page?: number;
+  };
+}
+/** `GET /api/droplets` — the company's droplets, page-paginated. The list
+*  rows carry the numeric `id` (unlike `POST /api/droplets`), which is how
+*  a legacy integration point's `integratable_id` maps back to a uuid. */
+interface DropletsListResponse {
+  droplets?: DropletRecord[];
+  meta?: PagePaginationMeta;
+  status?: number;
+}
+interface DropletInstallation {
+  /** The installation's own dri_ uuid (needed to uninstall later). */
+  uuid?: string;
+  /** The installed droplet's drp_ uuid. */
+  droplet_uuid?: string;
+}
+interface DropletInstallationsListResponse {
+  droplet_installations?: DropletInstallation[];
+  meta?: PagePaginationMeta;
+  status?: number;
+}
+interface DropletInstallationCreateRequest {
+  droplet_uuid: string;
+  scopes?: string[];
+}
+interface DropletInstallationCreateResponse {
+  droplet_installation?: DropletInstallation;
+  meta?: ApiMeta;
+  status?: number;
+}
 /** Hyphenated wire kinds the integration-points API speaks. */
 type IntegrationPointKind = "droplet" | "drop-zone" | "mobile-embed";
 interface IntegrationPoint {
@@ -311,5 +356,5 @@ interface MistFile {
 //#region src/index.d.ts
 declare const plugin: FluidPlugin;
 //#endregion
-export { ApiCollection, ApiMeta, Deployment, DeploymentShowResponse, DeploymentState, DeploymentsListResponse, DropZoneCreateInput, DropZoneCreateRequest, DropZoneCreateResponse, DropZoneRecord, Droplet, DropletCreateInput, DropletCreateRequest, DropletCreateResponse, DropletRecord, DropletShowResponse, DropletUpdateInput, DropletUpdateRequest, EnvVar, EnvVarsListResponse, GitCredential, GitCredentialResponse, HostableType, IntegrationPoint, IntegrationPointCreateInput, IntegrationPointCreateRequest, IntegrationPointKind, IntegrationPointShowResponse, IntegrationPointsListResponse, LogEntry, LogsResponse, MANAGED_DROPLET_ENV_KEYS, ManagedDropletEnvKey, Mist, MistCreateRequest, MistFile, MistKind, MistListResponse, MistShowResponse, MistState, MistUpdateRequest, MobileWidgetCreateInput, MobileWidgetCreateRequest, MobileWidgetCreateResponse, MobileWidgetRecord, PaginationCursor, plugin as default };
+export { ApiCollection, ApiMeta, Deployment, DeploymentShowResponse, DeploymentState, DeploymentsListResponse, DropZoneCreateInput, DropZoneCreateRequest, DropZoneCreateResponse, DropZoneRecord, Droplet, DropletCreateInput, DropletCreateRequest, DropletCreateResponse, DropletInstallation, DropletInstallationCreateRequest, DropletInstallationCreateResponse, DropletInstallationsListResponse, DropletRecord, DropletShowResponse, DropletUpdateInput, DropletUpdateRequest, DropletsListResponse, EnvVar, EnvVarsListResponse, GitCredential, GitCredentialResponse, HostableType, IntegrationPoint, IntegrationPointCreateInput, IntegrationPointCreateRequest, IntegrationPointKind, IntegrationPointShowResponse, IntegrationPointsListResponse, LogEntry, LogsResponse, MANAGED_DROPLET_ENV_KEYS, ManagedDropletEnvKey, Mist, MistCreateRequest, MistFile, MistKind, MistListResponse, MistShowResponse, MistState, MistUpdateRequest, MobileWidgetCreateInput, MobileWidgetCreateRequest, MobileWidgetCreateResponse, MobileWidgetRecord, PagePaginationMeta, PaginationCursor, plugin as default };
 //# sourceMappingURL=index.d.mts.map

package/dist/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../src/types.ts","../src/index.ts"],"mappings":";;;;;;AASA;;;;;KAAY,QAAA;AAAA,KAEA,SAAA;;;;AAeZ;;;;KAAY,YAAA;AAAA,UAEK,OAAA;EACf,EAAA;EACA,IAAA;EACA,IAAA;AAAA;;;;;AAWF;;;;cAAa,wBAAA;AAAA,KAMD,oBAAA,WAA+B,wBAAA;AAAA,UAE1B,IAAA;EACf,EAAA;EACA,IAAA;EAJyC;AAE3C;EAKE,IAAA;EACA,KAAA,EAAO,SAAA;EACP,IAAA,EAAM,QAAA;;;;;;EAMN,aAAA,GAAgB,YAAA;;EAEhB,WAAA;;;;;;EAMA,WAAA;EACA,UAAA;;EAEA,oBAAA;EACA,OAAA,EAAS,OAAA;EACT,cAAA;EACA,UAAA;EACA,UAAA;AAAA;AAAA,UAGe,gBAAA;EACf,MAAA;EACA,KAAA;EACA,WAAA;EACA,WAAA;AAAA;AAAA,UAGe,OAAA;EACf,UAAA;EACA,SAAA;EACA,UAAA,GAAa,gBAAA;AAAA;AAAA,UAGE,aAAA;EACf,IAAA,EAAM,OAAA;EACN,MAAA;AAAA;AAAA,KAGU,gBAAA;EACV,KAAA,EAAO,IAAA;EACP,IAAA,EAAM,OAAA;EACN,MAAA;AAAA;AAAA,KAGU,gBAAA;EACV,IAAA,EAAM,IAAA;EACN,IAAA,EAAM,OAAA;EACN,MAAA;AAAA;AAAA,UAGe,iBAAA;EACf,IAAA;IACE,IAAA;IACA,IAAA,GAAO,QAAA;EAAA;AAAA;AAfX;;;;;AAAA,UAwBiB,iBAAA;EACf,IAAA;IACE,IAAA;IACA,IAAA,GAAO,QAAA;EAAA;AAAA;AAAA,UAQM,kBAAA;EACf,IAAA;;;EAGA,SAAA;EACA,mBAAA;EACA,qBAAA;EACA,gBAAA;EACA,QAAA,GAAW,MAAA;AAAA;AAAA,UAGI,kBAAA;EACf,SAAA;EACA,mBAAA;EACA,qBAAA;AAAA;AAAA,UAGe,oBAAA;EACf,OAAA,EAAS,kBAAA;AAAA;AAAA,UAGM,oBAAA;EACf,OAAA,EAAS,kBAAA;AAAA;AAAA,UAGM,aAAA;EApCA;;;;;EA0Cf,EAAA;EACA,IAAA;EACA,IAAA;EACA,SAAA;AAAA;AAAA,UAGe,qBAAA;EACf,OAAA,EAAS,aAAA;EA9BE;;EAiCX,cAAA;EACA,IAAA,GAAO,OAAA;EACP,MAAA;AAAA;AAAA,UAGe,mBAAA;EACf,OAAA,EAAS,aAAA;EACT,IAAA,GAAO,OAAA;EACP,MAAA;AAAA;;KASU,oBAAA;AAAA,UAEK,gBAAA;;EAEf,EAAA;EACA,IAAA,EAAM,oBAAA;;EAEN,eAAA;EAhDF;;;;;EAsDE,iBAAA;EACA,iBAAA;EACA,OAAA;AAAA;;AAhDF;;;;;;;;UA4DiB,2BAAA;EACf,IAAA,EAAM,oBAAA;EACN,iBAAA;EACA,eAAA;AAAA;AAAA,UAGe,6BAAA;EACf,iBAAA,EAAmB,2BAAA;AAAA;AAAA,UAGJ,6BAAA;EACf,kBAAA,EAAoB,gBAAA;EACpB,IAAA,EAAM,OAAA;EACN,MAAA;AAAA;AAAA,UAGe,4BAAA;EACf,iBAAA,EAAmB,gBAAA;EACnB,IAAA,EAAM,OAAA;EACN,MAAA;AAAA;AAAA,UAOe,mBAAA;EACf,IAAA;EACA,SAAA;;EAEA,QAAA;IAAa,IAAA;IAAe,IAAA;IAAe,MAAA;EAAA;AAAA;AAAA,UAG5B,qBAAA;EACf,SAAA,EAAW,mBAAA;AAAA;AAAA,UAGI,cAAA;EACf,IAAA;EACA,IAAA;EACA,SAAA;EACA,MAAA;EACA,QAAA,GAAW,MAAA;AAAA;AAAA,UAGI,sBAAA;EACf,SAAA,EAAW,cAAA;EACX,IAAA,GAAO,OAAA;EACP,MAAA;AAAA;AAAA,UAOe,uBAAA;EACf,IAAA;EACA,SAAA;EAxDM;EA0DN,eAAA;;EAEA,MAAA;EACA,UAAA;AAAA;AAAA,UAGe,yBAAA;EACf,aAAA,EAAe,uBAAA;AAAA;AAAA,UAGA,kBAAA;EACf,EAAA;EACA,IAAA;EACA,SAAA;EACA,eAAA;EACA,MAAA;AAAA;AAAA,UAGe,0BAAA;EACf,aAAA,EAAe,kBAAA;EACf,IAAA,GAAO,OAAA;EACP,MAAA;AAAA;AAAA,UAGe,MAAA;EACf,GAAA;EACA,KAAA;EACA,OAAA;EACA,UAAA;AAAA;AAAA,UAGe,mBAAA;EACf,QAAA,EAAU,MAAA;EACV,IAAA,EAAM,OAAA;EACN,MAAA;AAAA;AAAA,UAGe,aAAA;EACf,UAAA;EACA,UAAA;AAAA;AAAA,UAGe,qBAAA;EACf,cAAA,EAAgB,aAAA;EAChB,IAAA,EAAM,OAAA;EACN,MAAA;AAAA;AAAA,KAGU,eAAA;AAAA,UAOK,UAAA;EACf,EAAA;EACA,KAAA,EAAO,eAAA;EACP,GAAA;EACA,UAAA;EACA,cAAA;EACA,UAAA;EACA,MAAA;AAAA;AAAA,UAGe,uBAAA;EACf,WAAA,EAAa,UAAA;EACb,IAAA,EAAM,OAAA;EACN,MAAA;AAAA;AAAA,UAGe,sBAAA;EACf,UAAA,EAAY,UAAA;EACZ,IAAA,EAAM,OAAA;EACN,MAAA;AAAA;AAAA,UAGe,QAAA;EACf,SAAA;EACA,KAAA;EACA,OAAA;EACA,MAAA;AAAA;AAAA,UAGe,YAAA;EACf,aAAA;EACA,IAAA,EAAM,QAAA;EACN,IAAA,EAAM,OAAA;EACN,MAAA;AAAA;;UAIe,QAAA;EACf,IAAA;;;;;;EAMA,WAAA;EACA,UAAA;AAAA;;;cC9VI,MAAA,EAAQ,WAAA"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../src/types.ts","../src/index.ts"],"mappings":";;;;;;AASA;;;;;KAAY,QAAA;AAAA,KAEA,SAAA;;;;AAeZ;;;;KAAY,YAAA;AAAA,UAEK,OAAA;EACf,EAAA;EACA,IAAA;EACA,IAAA;AAAA;;;;;AAWF;;;;cAAa,wBAAA;AAAA,KAMD,oBAAA,WAA+B,wBAAA;AAAA,UAE1B,IAAA;EACf,EAAA;EACA,IAAA;EAJyC;AAE3C;EAKE,IAAA;EACA,KAAA,EAAO,SAAA;EACP,IAAA,EAAM,QAAA;;;;;;EAMN,aAAA,GAAgB,YAAA;;EAEhB,WAAA;;;;;;EAMA,WAAA;EACA,UAAA;;EAEA,oBAAA;EACA,OAAA,EAAS,OAAA;EACT,cAAA;EACA,UAAA;EACA,UAAA;AAAA;AAAA,UAGe,gBAAA;EACf,MAAA;EACA,KAAA;EACA,WAAA;EACA,WAAA;AAAA;AAAA,UAGe,OAAA;EACf,UAAA;EACA,SAAA;EACA,UAAA,GAAa,gBAAA;AAAA;AAAA,UAGE,aAAA;EACf,IAAA,EAAM,OAAA;EACN,MAAA;AAAA;AAAA,KAGU,gBAAA;EACV,KAAA,EAAO,IAAA;EACP,IAAA,EAAM,OAAA;EACN,MAAA;AAAA;AAAA,KAGU,gBAAA;EACV,IAAA,EAAM,IAAA;EACN,IAAA,EAAM,OAAA;EACN,MAAA;AAAA;AAAA,UAGe,iBAAA;EACf,IAAA;IACE,IAAA;IACA,IAAA,GAAO,QAAA;EAAA;AAAA;AAfX;;;;;AAAA,UAwBiB,iBAAA;EACf,IAAA;IACE,IAAA;IACA,IAAA,GAAO,QAAA;EAAA;AAAA;AAAA,UAQM,kBAAA;EACf,IAAA;;;EAGA,SAAA;EACA,mBAAA;EACA,qBAAA;EACA,gBAAA;EACA,QAAA,GAAW,MAAA;AAAA;AAAA,UAGI,kBAAA;EACf,SAAA;EACA,mBAAA;EACA,qBAAA;AAAA;AAAA,UAGe,oBAAA;EACf,OAAA,EAAS,kBAAA;AAAA;AAAA,UAGM,oBAAA;EACf,OAAA,EAAS,kBAAA;AAAA;AAAA,UAGM,aAAA;EApCA;;;;;;EA2Cf,EAAA;EACA,IAAA;EACA,IAAA;EACA,SAAA;AAAA;AAAA,UAGe,qBAAA;EACf,OAAA,EAAS,aAAA;;;EAGT,cAAA;EACA,IAAA,GAAO,OAAA;EACP,MAAA;AAAA;AAAA,UAGe,mBAAA;EACf,OAAA,EAAS,aAAA;EACT,IAAA,GAAO,OAAA;EACP,MAAA;AAAA;;;;;;;UASe,kBAAA;EACf,UAAA;EACA,SAAA;EACA,UAAA;IACE,YAAA;IACA,WAAA;IACA,WAAA;IACA,QAAA;EAAA;AAAA;;AAzCJ;;UAgDiB,oBAAA;EACf,QAAA,GAAW,aAAA;EACX,IAAA,GAAO,kBAAA;EACP,MAAA;AAAA;AAAA,UAYe,mBAAA;;EAEf,IAAA;EApDF;EAsDE,YAAA;AAAA;AAAA,UAGe,gCAAA;EACf,qBAAA,GAAwB,mBAAA;EACxB,IAAA,GAAO,kBAAA;EACP,MAAA;AAAA;AAAA,UAGe,gCAAA;EACf,YAAA;EACA,MAAA;AAAA;AAAA,UAGe,iCAAA;EACf,oBAAA,GAAuB,mBAAA;EACvB,IAAA,GAAO,OAAA;EACP,MAAA;AAAA;;KASU,oBAAA;AAAA,UAEK,gBAAA;;EAEf,EAAA;EACA,IAAA,EAAM,oBAAA;EAhER;EAkEE,eAAA;;;;;;EAMA,iBAAA;EACA,iBAAA;EACA,OAAA;AAAA;;;AA5DF;;;;;;;UAwEiB,2BAAA;EACf,IAAA,EAAM,oBAAA;EACN,iBAAA;EACA,eAAA;AAAA;AAAA,UAGe,6BAAA;EACf,iBAAA,EAAmB,2BAAA;AAAA;AAAA,UAGJ,6BAAA;EACf,kBAAA,EAAoB,gBAAA;EACpB,IAAA,EAAM,OAAA;EACN,MAAA;AAAA;AAAA,UAGe,4BAAA;EACf,iBAAA,EAAmB,gBAAA;EACnB,IAAA,EAAM,OAAA;EACN,MAAA;AAAA;AAAA,UAOe,mBAAA;EACf,IAAA;EACA,SAAA;EAxEe;EA0Ef,QAAA;IAAa,IAAA;IAAe,IAAA;IAAe,MAAA;EAAA;AAAA;AAAA,UAG5B,qBAAA;EACf,SAAA,EAAW,mBAAA;AAAA;AAAA,UAGI,cAAA;EACf,IAAA;EACA,IAAA;EACA,SAAA;EACA,MAAA;EACA,QAAA,GAAW,MAAA;AAAA;AAAA,UAGI,sBAAA;EACf,SAAA,EAAW,cAAA;EACX,IAAA,GAAO,OAAA;EACP,MAAA;AAAA;AAAA,UAOe,uBAAA;EACf,IAAA;EACA,SAAA;;EAEA,eAAA;;EAEA,MAAA;EACA,UAAA;AAAA;AAAA,UAGe,yBAAA;EACf,aAAA,EAAe,uBAAA;AAAA;AAAA,UAGA,kBAAA;EACf,EAAA;EACA,IAAA;EACA,SAAA;EACA,eAAA;EACA,MAAA;AAAA;AAAA,UAGe,0BAAA;EACf,aAAA,EAAe,kBAAA;EACf,IAAA,GAAO,OAAA;EACP,MAAA;AAAA;AAAA,UAGe,MAAA;EACf,GAAA;EACA,KAAA;EACA,OAAA;EACA,UAAA;AAAA;AAAA,UAGe,mBAAA;EACf,QAAA,EAAU,MAAA;EACV,IAAA,EAAM,OAAA;EACN,MAAA;AAAA;AAAA,UAGe,aAAA;EACf,UAAA;EACA,UAAA;AAAA;AAAA,UAGe,qBAAA;EACf,cAAA,EAAgB,aAAA;EAChB,IAAA,EAAM,OAAA;EACN,MAAA;AAAA;AAAA,KAGU,eAAA;AAAA,UAOK,UAAA;EACf,EAAA;EACA,KAAA,EAAO,eAAA;EACP,GAAA;EACA,UAAA;EACA,cAAA;EACA,UAAA;EACA,MAAA;AAAA;AAAA,UAGe,uBAAA;EACf,WAAA,EAAa,UAAA;EACb,IAAA,EAAM,OAAA;EACN,MAAA;AAAA;AAAA,UAGe,sBAAA;EACf,UAAA,EAAY,UAAA;EACZ,IAAA,EAAM,OAAA;EACN,MAAA;AAAA;AAAA,UAGe,QAAA;EACf,SAAA;EACA,KAAA;EACA,OAAA;EACA,MAAA;AAAA;AAAA,UAGe,YAAA;EACf,aAAA;EACA,IAAA,EAAM,QAAA;EACN,IAAA,EAAM,OAAA;EACN,MAAA;AAAA;;UAIe,QAAA;EACf,IAAA;;;;;;EAMA,WAAA;EACA,UAAA;AAAA;;;cC1ZI,MAAA,EAAQ,WAAA"}

package/dist/index.mjs

@@ -131,28 +131,28 @@ async function resolveMistId(client, slugOrId) {
 }
 //#endregion
 //#region src/api/mists.ts
-const BASE$3 = "/api/v202604/mists";
+const BASE$4 = "/api/v202604/mists";
 function listMists(client, params = {}) {
-	return client.get(BASE$3, params);
+	return client.get(BASE$4, params);
 }
 async function showMist(client, slug) {
 	const id = await resolveMistId(client, slug);
-	return client.get(`${BASE$3}/${id}`);
+	return client.get(`${BASE$4}/${id}`);
 }
 function createMist(client, body) {
-	return client.post(BASE$3, body);
+	return client.post(BASE$4, body);
 }
 async function updateMist(client, slug, body) {
 	const id = await resolveMistId(client, slug);
-	return client.patch(`${BASE$3}/${id}`, body);
+	return client.patch(`${BASE$4}/${id}`, body);
 }
 async function deleteMist(client, slug) {
 	const id = await resolveMistId(client, slug);
-	return client.delete(`${BASE$3}/${id}`);
+	return client.delete(`${BASE$4}/${id}`);
 }
 async function restoreMist(client, slug) {
 	const id = await resolveMistId(client, slug);
-	return client.post(`${BASE$3}/${id}/restore`);
+	return client.post(`${BASE$4}/${id}/restore`);
 }
 //#endregion
 //#region src/lib/hostable.ts
@@ -542,7 +542,7 @@ function createSilentReporter() {
 }
 //#endregion
 //#region src/api/droplets.ts
-const BASE$2 = "/api/droplets";
+const BASE$3 = "/api/droplets";
 /**
 * Full scope set from `Droplet::Installation::VALID_SCOPES`. We request
 * them all by default so a Mist-created droplet's installations carry write
@@ -592,11 +592,33 @@ function buildDropletCreateInput(opts) {
 	return input;
 }
 function createDroplet(client, body) {
-	return client.post(BASE$2, body);
+	return client.post(BASE$3, body);
+}
+/** Page size + runaway guard for walking the page-paginated droplets list. */
+const PER_PAGE$1 = 100;
+const MAX_PAGES$1 = 25;
+/**
+* Recover a droplet's drp_ uuid from its numeric id by paging the company's
+* droplets list (`GET /api/droplets?page=&per_page=` — the list rows carry
+* `id`, unlike the create/show responses). Needed for legacy integration
+* points that only echo `integratable_id`: the show endpoint resolves by
+* uuid, so a numeric id can't be fetched directly. Returns null when no
+* droplet matches within the page cap.
+*/
+async function findDropletUuidByNumericId(client, id) {
+	for (let page = 1; page <= MAX_PAGES$1; page++) {
+		const resp = await client.get(`${BASE$3}?page=${page}&per_page=${PER_PAGE$1}`);
+		const batch = resp.droplets ?? [];
+		const match = batch.find((d) => d.id === id);
+		if (match) return match.uuid ?? null;
+		const totalPages = resp.meta?.pagination?.total_pages;
+		if (totalPages != null ? page >= totalPages : batch.length < PER_PAGE$1) break;
+	}
+	return null;
 }
 /** PATCH the droplet's embed URL (+ derived webhook URLs) once known. */
 function updateDroplet(client, uuid, input) {
-	return client.patch(`${BASE$2}/${encodeURIComponent(uuid)}`, { droplet: input });
+	return client.patch(`${BASE$3}/${encodeURIComponent(uuid)}`, { droplet: input });
 }
 /** Convenience: set embed URL + derived webhook URLs in one PATCH. */
 function setDropletEmbedUrl(client, uuid, embedUrl) {
@@ -606,6 +628,43 @@ function setDropletEmbedUrl(client, uuid, embedUrl) {
 	});
 }
 //#endregion
+//#region src/api/droplet_installations.ts
+const BASE$2 = "/api/droplet_installations";
+/** Page size + runaway guard for walking the page-paginated list. */
+const PER_PAGE = 100;
+const MAX_PAGES = 25;
+/**
+* List ALL of the current company's droplet installations, following the
+* endpoint's page-number pagination (`?page=&per_page=` — same shape as
+* fluid-admin's `getCompanyDroplets`). A single-page fetch would miss rows
+* beyond the first page, making the idempotency check (and the duplicate-
+* rejection confirmation) report a false "not installed" forever.
+*/
+async function listAllDropletInstallations(client) {
+	const rows = [];
+	for (let page = 1; page <= MAX_PAGES; page++) {
+		const resp = await client.get(`${BASE$2}?page=${page}&per_page=${PER_PAGE}`);
+		const batch = resp.droplet_installations ?? [];
+		rows.push(...batch);
+		const totalPages = resp.meta?.pagination?.total_pages;
+		if (totalPages != null ? page >= totalPages : batch.length < PER_PAGE) break;
+	}
+	return rows;
+}
+/** Install a droplet (by drp_ uuid) for the current company. */
+function createDropletInstallation(client, input) {
+	return client.post(BASE$2, input);
+}
+/**
+* The company's installation row for a droplet drp_ uuid, or undefined.
+* The idempotency key for the install step: an existing row means the
+* droplet is already connected (installed via a previous run, Mist Desktop,
+* or the admin marketplace).
+*/
+function findInstallationForDroplet(installations, dropletUuid) {
+	return (installations ?? []).find((i) => i.droplet_uuid === dropletUuid);
+}
+//#endregion
 //#region src/api/drop_zones.ts
 const BASE$1 = "/api/drop_zones";
 /**
@@ -717,6 +776,10 @@ const MANAGED_DROPLET_ENV_KEYS = [
 *   - Only a droplet attach provisions managed env keys
 *     (FLUID_DROPLET_UUID/_SECRET/_WEBHOOK_AUTH_TOKEN); this flow only
 *     VERIFIES they landed — it never writes them (the API 422s on write).
+*   - A droplet must also be INSTALLED (POST /api/droplet_installations) —
+*     create + link alone leave it not-connected/inactive, so install-scoped
+*     features (dit/dex exchange, admin embeds, install webhooks) don't work.
+*     The install step is idempotent (skips when an installation exists).
 */
 const DEFAULT_TIMING = {
 	publicUrlTimeoutMs: 9e4,
@@ -866,6 +929,21 @@ async function provisionSurface(client, options) {
 		if (surfaceNumericId == null) surfaceNumericId = ipResp.integration_point.integratable_id ?? null;
 		reporter.succeed(kind === "droplet" ? "Droplet attached — provisioning env + redeploy…" : `${label} attached`);
 	}
+	let installation = null;
+	if (kind === "droplet") {
+		if (!surfaceUuid && surfaceNumericId != null) try {
+			surfaceUuid = await findDropletUuidByNumericId(client, surfaceNumericId);
+		} catch {}
+		if (!surfaceUuid) {
+			reporter.fail("Droplet uuid unknown — cannot install");
+			throw new Error("Couldn't determine the droplet uuid, so the droplet is linked but NOT installed — it stays inactive until an installation exists. Re-run with `--existing <droplet-uuid>`, or install manually: POST /api/droplet_installations with {\"droplet_uuid\":\"<uuid>\"}.");
+		}
+		installation = await ensureDropletInstalled(client, {
+			dropletUuid: surfaceUuid,
+			scopes: options.requestedScopes ?? DEFAULT_DROPLET_SCOPES,
+			reporter
+		});
+	}
 	const managedEnv = kind === "droplet" ? await verifyManagedEnv(client, {
 		slugOrId,
 		reporter,
@@ -894,10 +972,79 @@ async function provisionSurface(client, options) {
 		},
 		surfaceCreated,
 		embedUrlSet,
+		installation,
 		managedEnv
 	};
 }
 /**
+* Install the droplet for the current company (idempotent). Checks the
+* installations list first; treats the API's already-installed rejection as
+* success too, so re-runs and races both converge. A hard failure throws with
+* the droplet uuid + recovery steps — the created droplet and mist link stay
+* in place, so an idempotent re-run finishes the job.
+*/
+async function ensureDropletInstalled(client, args) {
+	const { reporter, dropletUuid } = args;
+	reporter.start("Installing droplet…");
+	let existing;
+	try {
+		existing = findInstallationForDroplet(await listAllDropletInstallations(client), dropletUuid);
+	} catch {}
+	if (existing) {
+		reporter.skip(`Droplet already installed${existing.uuid ? ` (${existing.uuid})` : ""} — skipping`);
+		return {
+			uuid: existing.uuid ?? null,
+			created: false
+		};
+	}
+	try {
+		const uuid = (await createDropletInstallation(client, {
+			droplet_uuid: dropletUuid,
+			scopes: [...args.scopes]
+		})).droplet_installation?.uuid ?? null;
+		reporter.succeed(`Droplet installed${uuid ? ` (${uuid})` : ""}`);
+		return {
+			uuid,
+			created: true
+		};
+	} catch (err) {
+		if (isAlreadyInstalledError(err)) {
+			const confirmed = await lookupInstallation(client, dropletUuid);
+			if (confirmed) {
+				reporter.skip("Droplet already installed — skipping");
+				return {
+					uuid: confirmed.uuid ?? null,
+					created: false
+				};
+			}
+		}
+		reporter.fail("Droplet install failed");
+		throw normalizeInstallError(err, dropletUuid);
+	}
+}
+function isAlreadyInstalledError(err) {
+	return err instanceof MistApiError && (err.status === 409 || err.status === 422) && /already|taken|installed|exists/i.test(`${err.message} ${JSON.stringify(err.details ?? {})}`);
+}
+/** Best-effort installation lookup for a droplet; null when the row can't
+*  be found or the list call fails. */
+async function lookupInstallation(client, dropletUuid) {
+	try {
+		return findInstallationForDroplet(await listAllDropletInstallations(client), dropletUuid) ?? null;
+	} catch {
+		return null;
+	}
+}
+/**
+* Install failures must NOT read as "wired up" — an uninstalled droplet means
+* dit/dex token exchange, admin embeds, and install webhooks silently don't
+* work. Surface the droplet uuid + recovery path; keep the MistApiError
+* status so the error handler exits with the spec'd non-zero code.
+*/
+function normalizeInstallError(err, dropletUuid) {
+	const message = `Droplet ${dropletUuid} was created and linked to the mist, but installing it failed: ${err instanceof Error ? err.message : String(err)}. The droplet and its link were left in place — re-run this command to finish the install, or install manually: POST /api/droplet_installations with {"droplet_uuid":"${dropletUuid}"}.`;
+	return err instanceof MistApiError ? new MistApiError(message, err.status, err.details) : new Error(message);
+}
+/**
 * If the integration-points endpoint rejects the attach identifier (e.g. an
 * older API that predates #19688's attach-by-uuid support), surface an
 * actionable message noting the surface WAS created. Other errors pass through.
@@ -1031,6 +1178,10 @@ function printSurfaceSummary(result) {
 	const ref = result.surface.uuid ?? (result.surface.id != null ? `#${result.surface.id}` : "(unknown)");
 	const state = result.surfaceCreated ? "created" : "existing";
 	console.log(chalk.dim(`  ${KIND_LABEL[result.kind]}: ${ref} (${state}) · integration ${result.integrationPoint.id}`));
+	if (result.kind === "droplet" && result.installation) {
+		const ref = result.installation.uuid ?? "(uuid unknown)";
+		console.log(chalk.dim(`  installation: ${ref} (${result.installation.created ? "installed" : "already installed"})`));
+	}
 	if (result.kind === "droplet" && result.managedEnv) if (result.managedEnv.ready) console.log(chalk.dim("  env: managed keys provisioned ✓"));
 	else console.log(chalk.yellow("  env: redeploy in progress — run `fluid mist env list` shortly to confirm managed keys"));
 }
@@ -2035,12 +2186,67 @@ const logsCommand = new Command("logs").description("Fetch deployment logs (use
 	}
 }));
 //#endregion
+//#region src/lib/encrypted-env.ts
+/**
+* Detects Vercel-encrypted env var ciphertext.
+*
+* `GET /api/v202604/mists/:id/env_vars` is a thin proxy to the Mist's
+* Vercel project env — it returns values ENCRYPTED, never plaintext (see
+* apps/mist-desktop/src/main/services/mist-env-vars.service.ts:25-28,
+* which documents the same server behavior for the desktop app's copy of
+* this API). The ciphertext is a base64-encoded JSON envelope of shape
+* `{"v":"v2","c":"<base64 ciphertext>","k":[<byte array>]}`.
+*
+* `fluid mist env pull` uses this to avoid writing that ciphertext into
+* `.env.local` as if it were a usable value.
+*/
+const BASE64_RE = /^[A-Za-z0-9+/]+={0,2}$/;
+function looksLikeBase64(value) {
+	return value.length > 0 && value.length % 4 === 0 && BASE64_RE.test(value);
+}
+function hasEncryptedEnvelopeShape(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value) && "v" in value && "c" in value && "k" in value;
+}
+/**
+* True when `value` is the Vercel encrypted-env envelope: a base64 string
+* that decodes to a JSON object with the `{ v, c, k }` shape. Returns
+* false for empty strings, non-base64 strings, and base64 strings that
+* decode to plaintext or to JSON that doesn't match the envelope shape —
+* so real plaintext secrets that happen to look like base64 are never
+* misclassified as ciphertext.
+*/
+function isVercelEncryptedEnvValue(value) {
+	if (!looksLikeBase64(value)) return false;
+	let decoded;
+	try {
+		decoded = Buffer.from(value, "base64").toString("utf8");
+	} catch {
+		return false;
+	}
+	let parsed;
+	try {
+		parsed = JSON.parse(decoded);
+	} catch {
+		return false;
+	}
+	return hasEncryptedEnvelopeShape(parsed);
+}
+//#endregion
 //#region src/commands/env/list.ts
 /** `fluid mist env list` — list env vars; mark managed_by entries. Spec §4. */
 function maskValue(value) {
 	if (value.length <= 8) return "•".repeat(value.length);
 	return `${value.slice(0, 4)}${"•".repeat(8)}${value.slice(-2)}`;
 }
+/**
+* Values come back Vercel-encrypted ciphertext (see
+* `../../lib/encrypted-env.ts`) — never show that raw blob, masked or not,
+* since it isn't the real secret and can run to ~1KB of base64.
+*/
+function displayValue(v, showValues) {
+	if (isVercelEncryptedEnvValue(v.value)) return chalk.dim("<encrypted>");
+	return showValues ? v.value : maskValue(v.value);
+}
 const envListCommand = new Command("list").description("List a mist's env vars").argument("[slug]", "The mist slug (defaults to .mist file in CWD)").option("--show-values", "Print full values instead of masking them").option("--json", "Emit raw API JSON").action((slug, opts) => runAction(async () => {
 	const resolved = resolveSlug(slug);
 	const response = await listEnvVars(createMistClient(), resolved);
@@ -2057,7 +2263,7 @@ const envListCommand = new Command("list").description("List a mist's env vars")
 		chalk.bold("MANAGED")
 	], ...vars.map((v) => [
 		v.key,
-		opts.showValues ? v.value : maskValue(v.value),
+		displayValue(v, opts.showValues),
 		v.targets.join(","),
 		v.managed_by === "mist" ? chalk.magenta("mist") : chalk.dim("user")
 	])]);
@@ -2137,21 +2343,79 @@ const envUnsetCommand = new Command("unset").description("Delete one or more env
 * `fluid mist env pull` — writes `.env.local` with user-managed vars only.
 * Skips `managed_by: "mist"` entries (DATABASE_URL, FLUID_*) since local
 * dev uses PGlite, not the production database. Spec §4 + §5.
+*
+* Also skips user-managed vars whose value comes back as Vercel-encrypted
+* ciphertext (`GET .../env_vars` is a proxy to Vercel's project env, which
+* never returns plaintext — see `../../lib/encrypted-env.ts`). Writing that
+* ciphertext into `.env.local` verbatim would silently produce an unusable
+* file, so those keys are collected and surfaced as a warning instead.
+*
+* The output file is MERGED, not replaced: pulled plaintext values update
+* their existing lines (or are appended), while every other existing line
+* — comments, locally maintained secrets for encrypted/managed keys, and
+* local-only vars — is preserved verbatim. Replacing the file wholesale
+* would delete manually set values for skipped keys, and an all-encrypted
+* response would truncate the file to zero bytes right before telling the
+* user to set those same values locally.
 */
 function escapeValue(v) {
 	if (/[\s#"']/.test(v)) return `"${v.replace(/(["\\$`])/g, "\\$1")}"`;
 	return v;
 }
+/**
+* Splits the raw env-var list into what `env pull` can safely write vs.
+* what it must skip, and why. Pure — no I/O — so it's unit-testable
+* without mocking the API client or the filesystem.
+*/
+function partitionPullEnvVars(envVars) {
+	const plaintext = [];
+	const encrypted = [];
+	const managed = [];
+	for (const v of envVars) if (v.managed_by === "mist") managed.push(v);
+	else if (isVercelEncryptedEnvValue(v.value)) encrypted.push(v);
+	else plaintext.push(v);
+	return {
+		plaintext,
+		encrypted,
+		managed
+	};
+}
+/** Matches a `KEY=` / `export KEY=` assignment line and captures the key. */
+const ENV_ASSIGNMENT = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=/;
+/**
+* Merges pulled plaintext vars into the existing env-file contents.
+* Existing assignment lines for pulled keys are updated in place; every
+* other line (comments, blank lines, locally maintained values for keys
+* the pull skipped) is preserved verbatim; new keys are appended. Pure —
+* no I/O — so it's unit-testable without touching the filesystem.
+*/
+function mergeEnvContents(existing, plaintext) {
+	const updates = new Map(plaintext.map((v) => [v.key, `${v.key}=${escapeValue(v.value)}`]));
+	const lines = existing.length > 0 ? existing.split("\n") : [];
+	if (lines.at(-1) === "") lines.pop();
+	const out = [];
+	for (const line of lines) {
+		const key = ENV_ASSIGNMENT.exec(line)?.[1];
+		const replacement = key === void 0 ? void 0 : updates.get(key);
+		if (key !== void 0 && replacement !== void 0) {
+			out.push(replacement);
+			updates.delete(key);
+		} else out.push(line);
+	}
+	for (const rendered of updates.values()) out.push(rendered);
+	return out.length > 0 ? out.join("\n") + "\n" : "";
+}
 const envPullCommand = new Command("pull").description("Write user-managed env vars to .env.local in the CWD").argument("[slug]", "The mist slug (defaults to .mist file in CWD)").option("--out <path>", "Output path (default: .env.local)").action((slug, opts) => runAction(async () => {
 	const resolved = resolveSlug(slug);
 	const { env_vars } = await listEnvVars(createMistClient(), resolved);
-	const user = env_vars.filter((v) => v.managed_by === "user");
-	const skipped = env_vars.filter((v) => v.managed_by === "mist");
-	const target = join(process.cwd(), opts.out ?? ".env.local");
-	const body = user.map((v) => `${v.key}=${escapeValue(v.value)}`).join("\n");
-	writeFileSync(target, body + (body.length ? "\n" : ""), "utf8");
-	console.log(chalk.green(`Wrote ${user.length} var(s) to ${target.replace(process.cwd() + "/", "")}.`));
-	if (skipped.length > 0) console.log(chalk.dim(`Skipped ${skipped.length} Mist-managed var(s): ${skipped.map((v) => v.key).join(", ")} (local dev uses PGlite)`));
+	const { plaintext, encrypted, managed } = partitionPullEnvVars(env_vars);
+	const outName = opts.out ?? ".env.local";
+	const target = join(process.cwd(), outName);
+	const existing = existsSync(target) ? readFileSync(target, "utf8") : "";
+	writeFileSync(target, mergeEnvContents(existing, plaintext), "utf8");
+	console.log(chalk.green(`Wrote ${plaintext.length} var(s) to ${target.replace(process.cwd() + "/", "")}${existing.length > 0 ? " (existing entries for other keys preserved)" : ""}.`));
+	if (managed.length > 0) console.log(chalk.dim(`Skipped ${managed.length} Mist-managed var(s): ${managed.map((v) => v.key).join(", ")} (local dev uses PGlite)`));
+	if (encrypted.length > 0) console.log(chalk.yellow(`Skipped ${encrypted.length} var(s) whose values are stored encrypted and can't be pulled: ${encrypted.map((v) => v.key).join(", ")} — set them locally in ${outName} yourself (values are visible in the Vercel dashboard) or re-set them via \`fluid mist env set\`.`));
 }));
 //#endregion
 //#region src/commands/env/index.ts