@configdirector/cli 0.1.0-beta.1 → 0.5.0-beta.1

package/dist/configdirector.mjs

@@ -1,14 +1,16 @@
 #!/usr/bin/env node
 import { homedir } from "node:os";
-import { Command, CommanderError } from "commander";
-import { access, mkdir, open, readFile, readdir, stat, writeFile } from "node:fs/promises";
+import { Command, CommanderError, Option } from "commander";
 import * as v from "valibot";
+import { access, mkdir, open, readFile, readdir, stat, writeFile } from "node:fs/promises";
 import { basename, dirname, extname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { createInterface } from "node:readline";
 import ignore from "ignore";
 import picomatch from "picomatch";
+import { randomUUID } from "node:crypto";
+import { text } from "node:stream/consumers";
 //#region package.json
-var version = "0.1.0-beta.1";
+var version = "0.5.0-beta.1";
 //#endregion
 //#region src/CliError.ts
 var CliError = class extends Error {
@@ -38,15 +40,39 @@ const ApiValidationErrorBodySchema = v.object({ errors: v.array(v.object({
 	message: v.string()
 })) });
 const ServiceSuspendedBodySchema = v.object({ code: v.literal("SERVICE_SUSPENDED") });
+const EvaluationNotFoundBodySchema = v.object({
+	error: v.string(),
+	code: v.picklist([
+		"CONFIG_NOT_FOUND",
+		"ENVIRONMENT_NOT_FOUND",
+		"CONTEXT_NOT_FOUND"
+	])
+});
 const describeFieldError = (fieldError) => fieldError.name === void 0 ? fieldError.message : `${fieldError.name}: ${fieldError.message}`;
 var ApiAuthorizationError = class extends CliError {
 	constructor(code, apiMessage) {
 		super(`The Admin API refused the request: ${apiMessage} (${code})`);
+		this.code = code;
+	}
+};
+const ifPermitted = async (request) => {
+	try {
+		return await request;
+	} catch (error) {
+		if (error instanceof ApiAuthorizationError && error.code === "INSUFFICIENT_PERMISSIONS") return;
+		throw error;
 	}
 };
 var ApiValidationError = class extends CliError {
-	constructor(errors) {
-		super(`The Admin API rejected the request:\n${errors.map((error) => `  ${describeFieldError(error)}`).join("\n")}`);
+	constructor(fieldErrors) {
+		super(`The Admin API rejected the request:\n${fieldErrors.map((error) => `  ${describeFieldError(error)}`).join("\n")}`);
+		this.fieldErrors = fieldErrors;
+	}
+};
+var EvaluationNotFoundError = class extends CliError {
+	constructor(code, apiMessage) {
+		super(`The Admin API could not evaluate the config: ${apiMessage} (${code})`);
+		this.code = code;
 	}
 };
 var ServiceSuspendedError = class extends CliError {
@@ -66,6 +92,566 @@ var UnexpectedApiResponseError = class extends CliError {
 	}
 };
 //#endregion
+//#region src/aligned-columns.ts
+const COLUMN_GAP = "   ";
+const widestCellOf = (rows, column) => Math.max(0, ...rows.map((row) => row[column]?.length ?? 0));
+const alignedColumns = (rows) => rows.map((row) => row.map((cell, column) => column === row.length - 1 ? cell : cell.padEnd(widestCellOf(rows, column))).join(COLUMN_GAP));
+//#endregion
+//#region src/admin-api/targeting-rules.ts
+const RuleValueSchema = v.union([
+	v.string(),
+	v.number(),
+	v.boolean()
+]);
+const attributeConditionEntries = {
+	attribute: v.string(),
+	trait: v.nullish(v.string()),
+	operator: v.string(),
+	targetValues: v.array(v.unknown())
+};
+const AttributeConditionSchema = v.object(attributeConditionEntries);
+const ConditionGroupSchema = v.array(AttributeConditionSchema);
+const SegmentConditionSchema = v.object({
+	id: v.string(),
+	kind: v.literal("segment"),
+	operator: v.string(),
+	segmentId: v.string()
+});
+const ConditionSchema = v.variant("kind", [v.object({
+	id: v.string(),
+	kind: v.literal("attribute"),
+	...attributeConditionEntries
+}), SegmentConditionSchema]);
+const PercentageSchema = v.object({
+	percentage: v.number(),
+	value: RuleValueSchema
+});
+const RuleSchema = v.variant("type", [v.variant("target", [v.object({
+	id: v.string(),
+	type: v.literal("conditional"),
+	conditions: v.array(ConditionSchema),
+	target: v.literal("value"),
+	value: RuleValueSchema
+}), v.object({
+	id: v.string(),
+	type: v.literal("conditional"),
+	conditions: v.array(ConditionSchema),
+	target: v.literal("percentage"),
+	percentages: v.array(PercentageSchema)
+})]), v.object({
+	id: v.string(),
+	type: v.literal("percentage"),
+	percentages: v.array(PercentageSchema)
+})]);
+//#endregion
+//#region src/admin-api/config-with-targeting-rules.ts
+const TargetingRulesInEnvironmentSchema = v.object({
+	environment: v.object({
+		slug: v.string(),
+		live: v.boolean()
+	}),
+	rules: v.array(RuleSchema),
+	defaultValue: v.string()
+});
+const NumericBoundSchema = v.object({
+	relation: v.string(),
+	value: v.number()
+});
+const NumericBoundsSchema = v.object({
+	min: v.optional(NumericBoundSchema),
+	max: v.optional(NumericBoundSchema)
+});
+const EnumValuesSchema = v.object({
+	valueType: v.string(),
+	values: v.array(v.string())
+});
+const TimespanRangeSchema = v.object({
+	unit: v.string(),
+	allowFractions: v.nullish(v.boolean()),
+	min: v.number(),
+	max: v.number()
+});
+const ConstrainedTypeSchema = v.variant("type", [
+	v.object({
+		type: v.literal("integer"),
+		typeOptions: v.nullish(NumericBoundsSchema)
+	}),
+	v.object({
+		type: v.literal("float"),
+		typeOptions: v.nullish(NumericBoundsSchema)
+	}),
+	v.object({
+		type: v.literal("enum"),
+		typeOptions: EnumValuesSchema
+	}),
+	v.object({
+		type: v.literal("timespan"),
+		typeOptions: TimespanRangeSchema
+	}),
+	v.object({
+		type: v.literal("url"),
+		typeOptions: v.nullish(v.object({ secureOnly: v.nullish(v.boolean()) }))
+	}),
+	v.object({
+		type: v.literal("json"),
+		typeOptions: v.nullish(v.object({ useSchema: v.optional(v.boolean()) }))
+	})
+]);
+const CONSTRAINED_TYPE_NAMES = new Set(ConstrainedTypeSchema.options.map((option) => option.entries.type.literal));
+const ConfigTypeSchema = v.union([ConstrainedTypeSchema, v.object({ type: v.pipe(v.string(), v.notValues([...CONSTRAINED_TYPE_NAMES])) })]);
+const hasTypeConstraints = (configType) => CONSTRAINED_TYPE_NAMES.has(configType.type);
+const ConfigWithTargetingRulesSchema = v.intersect([v.object({
+	key: v.string(),
+	description: v.nullish(v.string()),
+	role: v.string(),
+	lifetime: v.string(),
+	state: v.string(),
+	client: v.boolean(),
+	server: v.boolean(),
+	tags: v.array(v.object({ name: v.string() })),
+	targets: v.array(TargetingRulesInEnvironmentSchema)
+}), ConfigTypeSchema]);
+//#endregion
+//#region src/old-key-lines.ts
+const oldKeyLines = (requestedKey, currentKey) => requestedKey === currentKey ? [] : [`${requestedKey} is an old key of ${currentKey}.`];
+//#endregion
+//#region src/rule-sentences.ts
+const TRAIT_POINTER_PREFIX = "/";
+const ATTRIBUTE_LABELS = {
+	identifier: "context identifier",
+	kind: "context kind",
+	name: "context name",
+	appName: "app name",
+	appVersion: "app version"
+};
+const formatPercentage = (value) => Number(value.toFixed(3)).toString();
+const subjectOf = (condition) => {
+	if (condition.attribute === "traits" && condition.trait != null) return condition.trait.startsWith(TRAIT_POINTER_PREFIX) ? condition.trait.slice(1) : condition.trait;
+	return ATTRIBUTE_LABELS[condition.attribute] ?? condition.attribute;
+};
+const segmentNameOf = (segmentId, segments) => segments[segmentId]?.name ?? segmentId;
+const describeAttributeCondition = (condition) => `${subjectOf(condition)} ${condition.operator} ${condition.targetValues.map(String).join(", ")}`;
+const describeConditionGroup = (group) => group.map(describeAttributeCondition).join(" and ");
+const describeCondition = (condition, segments) => {
+	switch (condition.kind) {
+		case "attribute": return describeAttributeCondition(condition);
+		case "segment": return `${condition.operator} segment ${segmentNameOf(condition.segmentId, segments)}`;
+	}
+};
+const describePercentages = (percentages) => percentages.map((percentage) => `${formatPercentage(percentage.percentage)}% get ${String(percentage.value)}`).join(", ");
+const describeRule = (rule, segments) => {
+	if (rule.type === "percentage") return describePercentages(rule.percentages);
+	return `${rule.conditions.map((condition) => describeCondition(condition, segments)).join(" and ")}: ${rule.target === "value" ? String(rule.value) : describePercentages(rule.percentages)}`;
+};
+//#endregion
+//#region src/configs/config-text.ts
+const boundsDescriptions = (bounds) => {
+	const limits = [bounds?.min, bounds?.max].flatMap((bound) => bound === void 0 ? [] : [`${bound.relation} ${bound.value}`]);
+	return limits.length === 0 ? [] : [limits.join(" and ")];
+};
+const enumValuesDescription = ({ valueType, values }) => valueType === "number" ? `one of the numbers ${values.join(", ")}` : `one of ${values.join(", ")}`;
+const timespanRangeDescriptions = (range) => [`${range.min} to ${range.max} ${range.unit}`, ...range.allowFractions ? ["fractions allowed"] : []];
+const typeConstraintDescriptions = (config) => {
+	if (!hasTypeConstraints(config)) return [];
+	switch (config.type) {
+		case "integer":
+		case "float": return boundsDescriptions(config.typeOptions);
+		case "enum": return [enumValuesDescription(config.typeOptions)];
+		case "timespan": return timespanRangeDescriptions(config.typeOptions);
+		case "url": return config.typeOptions?.secureOnly ? ["HTTPS only"] : [];
+		case "json": return config.typeOptions?.useSchema ? ["checked against a JSON schema"] : [];
+	}
+};
+const availabilityDescription = (config) => {
+	if (config.client && config.server) return "client and server SDKs";
+	if (config.client) return "client-only";
+	if (config.server) return "server-only";
+	return "served to no SDK";
+};
+const settingLines = (config) => [
+	...config.description ? [`Description: ${config.description}`] : [],
+	`Type: ${[config.type, ...typeConstraintDescriptions(config)].join(", ")}`,
+	`Role: ${config.role}`,
+	`Lifetime: ${config.lifetime}`,
+	`Availability: ${availabilityDescription(config)}`,
+	`Lifecycle state: ${config.state}`,
+	...config.tags.length === 0 ? [] : [`Tags: ${config.tags.map((tag) => tag.name).join(", ")}`]
+];
+const environmentHeading = (targetingRules) => targetingRules.environment.live ? `${targetingRules.environment.slug} (live)` : targetingRules.environment.slug;
+const targetingRuleLines = (targetingRules, segments) => [
+	environmentHeading(targetingRules),
+	...targetingRules.rules.map((rule, index) => `  ${index + 1}. ${describeRule(rule, segments)}`),
+	`  Default targeting rule: ${targetingRules.defaultValue}`
+];
+const configText = (config, requestedKey, segments) => [
+	...oldKeyLines(requestedKey, config.key),
+	config.key,
+	...settingLines(config).map((line) => `  ${line}`),
+	...config.targets.flatMap((targetingRules) => ["", ...targetingRuleLines(targetingRules, segments)]),
+	""
+].join("\n");
+//#endregion
+//#region src/file-contents.ts
+const readFileIfPresent = async (file) => {
+	try {
+		return await readFile(file, "utf8");
+	} catch (error) {
+		if (error.code === "ENOENT") return;
+		throw error;
+	}
+};
+const readOptionFile = async (argumentLabel, path, workingDirectory) => {
+	const file = resolve(workingDirectory, path);
+	const contents = await readFileIfPresent(file);
+	if (contents === void 0) throw new CliError(`${argumentLabel} names ${file}, which does not exist.`);
+	return {
+		file,
+		contents
+	};
+};
+const FILE_ARGUMENT_MARKER = "@";
+const atFileArgumentText = async (argumentLabel, argument, workingDirectory) => {
+	if (!argument.startsWith(FILE_ARGUMENT_MARKER)) return argument;
+	return (await readOptionFile(argumentLabel, argument.slice(1), workingDirectory)).contents;
+};
+const isJsonObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const parseJson = (contents) => {
+	try {
+		return JSON.parse(contents);
+	} catch {
+		return;
+	}
+};
+const pathExists = (path) => stat(path).then(() => true, () => false);
+const fileExists = (path) => stat(path).then((stats) => stats.isFile(), () => false);
+//#endregion
+//#region src/configs/new-config.ts
+const CONFIG_TYPES = [
+	"boolean",
+	"string",
+	"integer",
+	"float",
+	"timespan",
+	"enum",
+	"url",
+	"json"
+];
+const CONFIG_ROLES = [
+	"config",
+	"flag",
+	"kill-switch",
+	"experiment"
+];
+const CONFIG_LIFETIMES = ["permanent", "temporary"];
+const TIMESPAN_UNITS = [
+	"milliseconds",
+	"seconds",
+	"minutes"
+];
+const ENUM_VALUE_TYPES = ["string", "number"];
+const DEFAULT_ENUM_VALUE_TYPE = "string";
+const TYPE_CONSTRAINT_OPTION_NAMES = {
+	min: "--min",
+	max: "--max",
+	exclusiveMin: "--exclusive-min",
+	exclusiveMax: "--exclusive-max",
+	unit: "--unit",
+	allowFractions: "--allow-fractions",
+	allowedValue: "--allowed-value",
+	enumValueType: "--enum-value-type",
+	httpsOnly: "--https-only",
+	jsonSchema: "--json-schema"
+};
+const availabilityOf = (options) => {
+	if (options.clientOnly) return {
+		client: true,
+		server: false
+	};
+	if (options.serverOnly) return {
+		client: false,
+		server: true
+	};
+	return {
+		client: true,
+		server: true
+	};
+};
+const BOOLEAN_VALUES = new Map([["true", true], ["false", false]]);
+const numberOf = (text) => {
+	const value = parseJson(text);
+	return typeof value === "number" && Number.isFinite(value) ? value : void 0;
+};
+const constraintNumberOf = (options, option) => {
+	const text = options[option];
+	if (text === void 0) return;
+	const value = numberOf(text);
+	if (value === void 0) throw new CliError(`${TYPE_CONSTRAINT_OPTION_NAMES[option]} takes a number, not ${text}.`);
+	return value;
+};
+const boundOf = (options, option, relation) => {
+	const value = constraintNumberOf(options, option);
+	return value === void 0 ? void 0 : {
+		relation,
+		value
+	};
+};
+const numericBoundsOf = (options) => ({
+	min: boundOf(options, "min", ">=") ?? boundOf(options, "exclusiveMin", ">"),
+	max: boundOf(options, "max", "<=") ?? boundOf(options, "exclusiveMax", "<")
+});
+const jsonTextOf = async ({ argumentLabel, text, workingDirectory }) => {
+	const jsonText = (await atFileArgumentText(argumentLabel, text, workingDirectory)).trim();
+	return parseJson(jsonText) === void 0 ? void 0 : jsonText;
+};
+const jsonSchemaOptionsOf = async (options, workingDirectory) => {
+	if (options.jsonSchema === void 0) return;
+	const { file, contents } = await readOptionFile(TYPE_CONSTRAINT_OPTION_NAMES.jsonSchema, options.jsonSchema, workingDirectory);
+	const schema = parseJson(contents);
+	if (schema === void 0) throw new CliError(`${TYPE_CONSTRAINT_OPTION_NAMES.jsonSchema} names ${file}, which is not JSON.`);
+	return {
+		useSchema: true,
+		schema
+	};
+};
+const timespanRangeOf = async (options) => {
+	if (options.unit === void 0 || options.min === void 0 || options.max === void 0) throw new CliError("--type timespan needs --unit, --min and --max.");
+	return {
+		unit: options.unit,
+		min: constraintNumberOf(options, "min"),
+		max: constraintNumberOf(options, "max"),
+		allowFractions: options.allowFractions
+	};
+};
+const NUMERIC_BOUND_OPTIONS = [
+	"min",
+	"max",
+	"exclusiveMin",
+	"exclusiveMax"
+];
+const CONFIG_TYPE_RULES = {
+	boolean: {
+		constraintOptions: [],
+		valueDescription: "true or false",
+		valueOf: async ({ text }) => BOOLEAN_VALUES.get(text),
+		typeOptionsOf: async () => void 0
+	},
+	string: {
+		constraintOptions: [],
+		valueDescription: "text",
+		valueOf: async ({ text }) => text,
+		typeOptionsOf: async () => void 0
+	},
+	integer: {
+		constraintOptions: NUMERIC_BOUND_OPTIONS,
+		valueDescription: "a number",
+		valueOf: async ({ text }) => numberOf(text),
+		typeOptionsOf: async (options) => ({
+			isInteger: true,
+			...numericBoundsOf(options)
+		})
+	},
+	float: {
+		constraintOptions: NUMERIC_BOUND_OPTIONS,
+		valueDescription: "a number",
+		valueOf: async ({ text }) => numberOf(text),
+		typeOptionsOf: async (options) => ({
+			isInteger: false,
+			...numericBoundsOf(options)
+		})
+	},
+	timespan: {
+		constraintOptions: [
+			"min",
+			"max",
+			"unit",
+			"allowFractions"
+		],
+		valueDescription: "a number",
+		valueOf: async ({ text }) => numberOf(text),
+		typeOptionsOf: timespanRangeOf
+	},
+	enum: {
+		constraintOptions: ["allowedValue", "enumValueType"],
+		valueDescription: "text",
+		valueOf: async ({ text }) => text,
+		typeOptionsOf: async (options) => ({
+			values: options.allowedValue ?? [],
+			valueType: options.enumValueType ?? DEFAULT_ENUM_VALUE_TYPE
+		})
+	},
+	url: {
+		constraintOptions: ["httpsOnly"],
+		valueDescription: "text",
+		valueOf: async ({ text }) => text,
+		typeOptionsOf: async (options) => ({ secureOnly: options.httpsOnly === true })
+	},
+	json: {
+		constraintOptions: ["jsonSchema"],
+		valueDescription: "JSON or @<file>",
+		valueOf: jsonTextOf,
+		typeOptionsOf: jsonSchemaOptionsOf
+	}
+};
+const typeAlternatives = (types) => types.length === 1 ? `${types[0]}` : `${types.slice(0, -1).join(", ")} or ${types.at(-1)}`;
+const typesTaking = (option) => CONFIG_TYPES.filter((type) => CONFIG_TYPE_RULES[type].constraintOptions.includes(option));
+const typeConstraintHelpGroup = (option) => `Options for --type ${typeAlternatives(typesTaking(option))}:`;
+const TYPE_CONSTRAINT_OPTIONS = Object.keys(TYPE_CONSTRAINT_OPTION_NAMES);
+const rejectOptionsOfOtherTypes = (options) => {
+	const { constraintOptions } = CONFIG_TYPE_RULES[options.type];
+	const otherTypeOption = TYPE_CONSTRAINT_OPTIONS.find((option) => options[option] !== void 0 && !constraintOptions.includes(option));
+	if (otherTypeOption !== void 0) throw new CliError(`${TYPE_CONSTRAINT_OPTION_NAMES[otherTypeOption]} cannot be used with --type ${options.type}. It applies to --type ${typeAlternatives(typesTaking(otherTypeOption))}.`);
+};
+const typedValueOf = async (type, argument) => {
+	const rules = CONFIG_TYPE_RULES[type];
+	const value = await rules.valueOf(argument);
+	if (value === void 0) throw new CliError(`${argument.argumentLabel} takes ${rules.valueDescription} with --type ${type}, not ${argument.text}.`);
+	return value;
+};
+const VARIATION_SEPARATOR = "=";
+const variationOf = async (type, variation, workingDirectory) => {
+	const separatorIndex = variation.indexOf(VARIATION_SEPARATOR);
+	const name = variation.slice(0, separatorIndex);
+	if (separatorIndex === -1 || name === "") throw new CliError(`--variation takes name=value, not ${variation}.`);
+	const text = variation.slice(separatorIndex + 1);
+	return {
+		name,
+		value: await typedValueOf(type, {
+			argumentLabel: `--variation ${name}`,
+			text,
+			workingDirectory
+		})
+	};
+};
+const variationsOf = async (options, workingDirectory) => {
+	const variations = [];
+	for (const variation of options.variation ?? []) variations.push(await variationOf(options.type, variation, workingDirectory));
+	return variations;
+};
+const newConfigOf = async (options, workingDirectory) => {
+	rejectOptionsOfOtherTypes(options);
+	return {
+		key: options.key,
+		description: options.description,
+		role: options.role,
+		lifetime: options.lifetime,
+		type: options.type,
+		typeOptions: await CONFIG_TYPE_RULES[options.type].typeOptionsOf(options, workingDirectory),
+		...availabilityOf(options),
+		variations: await variationsOf(options, workingDirectory),
+		defaultValue: await typedValueOf(options.type, {
+			argumentLabel: "--default-value",
+			text: options.defaultValue,
+			workingDirectory
+		})
+	};
+};
+//#endregion
+//#region src/admin-api/config-creation.ts
+const CreatedConfigSchema = v.object({
+	key: v.string(),
+	type: v.string(),
+	role: v.string(),
+	lifetime: v.string(),
+	client: v.boolean(),
+	server: v.boolean()
+});
+//#endregion
+//#region src/admin-api/segments.ts
+const SegmentSchema = v.object({
+	id: v.string(),
+	key: v.string(),
+	name: v.string(),
+	usages: v.array(v.unknown())
+});
+const SegmentDefinitionSchema = v.object({
+	key: v.string(),
+	name: v.string(),
+	groups: v.array(ConditionGroupSchema),
+	overrides: v.record(v.string(), v.array(ConditionGroupSchema))
+});
+//#endregion
+//#region src/admin-api/targeting-rules-reference.ts
+const TargetingRulesReferenceSchema = v.object({
+	notes: v.array(v.string()),
+	conditionKinds: v.array(v.string()),
+	conditionAttributes: v.array(v.string()),
+	contextKindOperators: v.array(v.string()),
+	segmentOperators: v.array(v.string()),
+	operatorsByTargetType: v.record(v.string(), v.array(v.string()))
+});
+//#endregion
+//#region src/admin-api/config-evaluation.ts
+const CheckedOutcomeSchema = v.picklist(["matched", "not-matched"]);
+const AttributeConditionExplanationSchema = v.object({
+	conditionId: v.string(),
+	kind: v.literal("attribute"),
+	outcome: CheckedOutcomeSchema,
+	resolvedValue: v.optional(v.unknown()),
+	resolvedType: v.picklist([
+		"absent",
+		"scalar",
+		"array",
+		"object",
+		"unknown-attribute"
+	])
+});
+const SegmentConditionExplanationSchema = v.object({
+	conditionId: v.string(),
+	kind: v.literal("segment"),
+	outcome: CheckedOutcomeSchema,
+	segmentId: v.string(),
+	segmentFound: v.boolean(),
+	matchedGroupIndex: v.optional(v.number())
+});
+const ConditionExplanationSchema = v.union([
+	v.object({
+		conditionId: v.string(),
+		outcome: v.literal("not-evaluated")
+	}),
+	AttributeConditionExplanationSchema,
+	SegmentConditionExplanationSchema
+]);
+const BucketSchema = v.object({
+	defaultedToPredefinedBucket: v.boolean(),
+	assignedPercentage: v.number(),
+	shares: v.array(v.object({
+		percentageId: v.string(),
+		from: v.number(),
+		to: v.number()
+	})),
+	selectedPercentageId: v.optional(v.string())
+});
+const RuleExplanationSchema = v.object({
+	ruleId: v.string(),
+	outcome: v.picklist([
+		"matched",
+		"not-matched",
+		"not-evaluated",
+		"errored"
+	]),
+	conditions: v.array(ConditionExplanationSchema),
+	bucket: v.optional(BucketSchema)
+});
+const ConfigEvaluationSchema = v.object({
+	key: v.string(),
+	environment: v.object({ name: v.string() }),
+	context: v.nullable(v.object({
+		kind: v.string(),
+		identifier: v.nullable(v.string())
+	})),
+	value: v.optional(v.string()),
+	servedBy: v.variant("kind", [v.object({
+		kind: v.literal("rule"),
+		ruleId: v.string()
+	}), v.object({ kind: v.literal("default") })]),
+	rules: v.array(RuleExplanationSchema),
+	targetingRules: v.object({
+		rules: v.array(RuleSchema),
+		defaultValue: v.string()
+	}),
+	segments: v.record(v.string(), v.object({ name: v.string() }))
+});
+//#endregion
 //#region src/admin-api/AdminApiClient.ts
 const ProjectSchema = v.object({
 	id: v.string(),
@@ -75,6 +661,9 @@ const ProjectSchema = v.object({
 const configFields = {
 	key: v.string(),
 	deprecatedKeys: v.array(v.object({ key: v.string() })),
+	role: v.string(),
+	lifetime: v.string(),
+	state: v.string(),
 	client: v.boolean(),
 	server: v.boolean()
 };
@@ -91,6 +680,28 @@ const ConfigSchema = v.variant("type", [EnumConfigSchema, v.object({
 	type: v.pipe(v.string(), v.notValue("enum"))
 })]);
 const isEnumConfig = (config) => config.type === "enum";
+const EnvironmentSchema = v.object({
+	id: v.string(),
+	slug: v.string(),
+	name: v.string(),
+	live: v.boolean()
+});
+const ConfigActivitySchema = v.object({ latestEvaluations: v.array(v.object({
+	environment: v.object({ slug: v.string() }),
+	source: v.string(),
+	sdkName: v.nullable(v.string()),
+	sdkVersion: v.nullable(v.string()),
+	time: v.pipe(v.string(), v.isoTimestamp())
+})) });
+const TagSchema = v.object({ id: v.string() });
+const tagFilterQuery = (tagFilter) => {
+	switch (tagFilter.form) {
+		case "every-config": return "";
+		case "tagged": return `?${new URLSearchParams(tagFilter.tagIds.map((tagId) => ["tagIds", tagId]))}`;
+		case "untagged": return "?untagged=true";
+	}
+};
+const MissingResourceBodySchema = v.strictObject({});
 const readJsonBody = async (response) => {
 	try {
 		return await response.json();
@@ -109,6 +720,10 @@ const failureFor = (url, response, body) => {
 			const authorizationError = v.safeParse(ApiAuthorizationErrorBodySchema, body);
 			return authorizationError.success ? new ApiAuthorizationError(authorizationError.output.code, authorizationError.output.error) : new UnexpectedApiResponseError(url, describeStatus(response));
 		}
+		case 404: {
+			const notFoundError = v.safeParse(EvaluationNotFoundBodySchema, body);
+			return notFoundError.success ? new EvaluationNotFoundError(notFoundError.output.code, notFoundError.output.error) : new UnexpectedApiResponseError(url, describeStatus(response));
+		}
 		case 429: {
 			const retryAfterSeconds = response.headers.get("retry-after");
 			return v.is(ServiceSuspendedBodySchema, body) && retryAfterSeconds !== null ? new ServiceSuspendedError(retryAfterSeconds) : new UnexpectedApiResponseError(url, describeStatus(response));
@@ -116,6 +731,16 @@ const failureFor = (url, response, body) => {
 		default: return new UnexpectedApiResponseError(url, describeStatus(response));
 	}
 };
+const isMissingResource = (received) => received.response.status === 404 && v.is(MissingResourceBodySchema, received.body);
+const parsedResponseOf = ({ url, response, body }, schema) => {
+	if (!response.ok) throw failureFor(url, response, body);
+	const parsedBody = v.safeParse(schema, body);
+	if (!parsedBody.success) throw new UnexpectedApiResponseError(url, `an ${describeStatus(response)} response the CLI cannot read`);
+	return {
+		responseBody: body,
+		parsedBody: parsedBody.output
+	};
+};
 var AdminApiClient = class {
 	constructor(connection) {
 		this.connection = connection;
@@ -123,51 +748,101 @@ var AdminApiClient = class {
 	listProjects() {
 		return this.get("/v1/projects", v.array(ProjectSchema));
 	}
-	listConfigs(projectId) {
-		return this.get(`/v1/projects/${encodeURIComponent(projectId)}/configs`, v.array(ConfigSchema));
+	async listConfigs(projectId, tagFilter) {
+		const { parsedBody: configs, responseBody } = await this.get(`/v1/projects/${encodeURIComponent(projectId)}/configs${tagFilterQuery(tagFilter)}`, v.array(ConfigSchema));
+		const receivedConfigs = v.parse(v.array(v.unknown()), responseBody);
+		return configs.map((config, index) => ({
+			config,
+			receivedConfig: receivedConfigs[index]
+		}));
+	}
+	listEnvironments(projectId) {
+		return this.get(`/v1/projects/${encodeURIComponent(projectId)}/environments`, v.array(EnvironmentSchema));
+	}
+	getConfig(projectId, configKey) {
+		return this.getIfFound(`/v1/projects/${encodeURIComponent(projectId)}/configs/${encodeURIComponent(configKey)}`, ConfigWithTargetingRulesSchema);
+	}
+	getConfigActivity(projectId, configKey) {
+		return this.getIfFound(`/v1/projects/${encodeURIComponent(projectId)}/configs/${encodeURIComponent(configKey)}/activity`, ConfigActivitySchema);
+	}
+	listSegments(projectId) {
+		return this.get(`/v1/projects/${encodeURIComponent(projectId)}/segments`, v.array(SegmentSchema));
+	}
+	getSegment(projectId, segmentKey) {
+		return this.getIfFound(`/v1/projects/${encodeURIComponent(projectId)}/segments/${encodeURIComponent(segmentKey)}`, SegmentDefinitionSchema);
+	}
+	async findTagByName(projectId, name) {
+		return (await this.getIfFound(`/v1/projects/${encodeURIComponent(projectId)}/tags/by-name?${new URLSearchParams({ name })}`, TagSchema))?.parsedBody;
+	}
+	createConfig(projectId, request) {
+		return this.requestJson(`/v1/projects/${encodeURIComponent(projectId)}/configs`, CreatedConfigSchema, {
+			method: "POST",
+			body: request
+		});
+	}
+	async evaluateConfig(projectId, configKey, request) {
+		const { responseBody, parsedBody } = await this.requestJson(`/v1/projects/${encodeURIComponent(projectId)}/configs/${encodeURIComponent(configKey)}/evaluate`, ConfigEvaluationSchema, {
+			method: "POST",
+			body: request
+		});
+		return {
+			evaluation: parsedBody,
+			responseBody
+		};
+	}
+	getTargetingRulesReference() {
+		return this.get("/v1/targeting-rules-reference", TargetingRulesReferenceSchema);
+	}
+	async replaceTargetingRules(projectId, configKey, request) {
+		return await this.requestIfFound(`/v1/projects/${encodeURIComponent(projectId)}/configs/${encodeURIComponent(configKey)}/targets`, v.unknown(), {
+			method: "PUT",
+			body: request
+		}) === void 0 ? "not-found" : "replaced";
+	}
+	get(path, schema) {
+		return this.requestJson(path, schema, { method: "GET" });
+	}
+	getIfFound(path, schema) {
+		return this.requestIfFound(path, schema, { method: "GET" });
+	}
+	async requestIfFound(path, schema, request) {
+		const received = await this.send(path, request);
+		return isMissingResource(received) ? void 0 : parsedResponseOf(received, schema);
+	}
+	async requestJson(path, schema, request) {
+		return parsedResponseOf(await this.send(path, request), schema);
 	}
-	async get(path, schema) {
+	async send(path, request) {
 		const url = `${this.connection.baseUrl}${path}`;
-		const response = await this.fetchResponse(url);
-		const body = await readJsonBody(response);
-		if (!response.ok) throw failureFor(url, response, body);
-		const parsedBody = v.safeParse(schema, body);
-		if (!parsedBody.success) throw new UnexpectedApiResponseError(url, `an ${describeStatus(response)} response the CLI cannot read`);
-		return parsedBody.output;
-	}
-	async fetchResponse(url) {
+		const response = await this.fetchResponse(url, request);
+		return {
+			url,
+			response,
+			body: await readJsonBody(response)
+		};
+	}
+	async fetchResponse(url, request) {
+		const headers = {
+			Accept: "application/json",
+			Authorization: `Bearer ${this.connection.token}`,
+			"User-Agent": `configdirector-cli/${version}`,
+			"X-SourceClient": "cli"
+		};
 		try {
-			return await fetch(url, { headers: {
-				Accept: "application/json",
-				Authorization: `Bearer ${this.connection.token}`,
-				"User-Agent": `configdirector-cli/${version}`,
-				"X-SourceClient": "cli"
-			} });
+			return await fetch(url, request.method === "GET" ? { headers } : {
+				method: request.method,
+				headers: {
+					...headers,
+					"Content-Type": "application/json"
+				},
+				body: JSON.stringify(request.body)
+			});
 		} catch (error) {
 			throw new ApiUnreachableError(this.connection.baseUrl, error);
 		}
 	}
 };
 //#endregion
-//#region src/file-contents.ts
-const readFileIfPresent = async (file) => {
-	try {
-		return await readFile(file, "utf8");
-	} catch (error) {
-		if (error.code === "ENOENT") return;
-		throw error;
-	}
-};
-const parseJson = (contents) => {
-	try {
-		return JSON.parse(contents);
-	} catch {
-		return;
-	}
-};
-const pathExists = (path) => stat(path).then(() => true, () => false);
-const fileExists = (path) => stat(path).then((stats) => stats.isFile(), () => false);
-//#endregion
 //#region src/saved-api-token.ts
 const SavedApiTokenSchema = v.object({ token: v.string() });
 const platformConfigDirectory = (invocation) => {
@@ -210,22 +885,6 @@ const configuredApiToken = async (context) => {
 	return token;
 };
 //#endregion
-//#region src/project-selection.ts
-const requireProjectSlug = (context) => {
-	if (context.projectSlug === void 0) throw new CliError("Name the project with --project <slug> or CONFIGDIRECTOR_PROJECT.");
-	return context.projectSlug;
-};
-const requireLinkedProjectSlug = (context, settings) => {
-	const slug = context.projectSlug ?? settings?.project;
-	if (slug === void 0) throw new CliError("Name the project with --project <slug>, CONFIGDIRECTOR_PROJECT, or `project` in configdirector.json, which `configdirector init` writes.");
-	return slug;
-};
-const findProjectBySlug = async (client, slug) => {
-	const project = (await client.listProjects()).find((listedProject) => listedProject.slug === slug);
-	if (project === void 0) throw new CliError(`No project in the API token's organization has the slug "${slug}".`);
-	return project;
-};
-//#endregion
 //#region src/project-settings.ts
 const ProjectSettingsSchema = v.object({
 	project: v.optional(v.string()),
@@ -247,6 +906,395 @@ const readProjectSettings = async (workingDirectory) => {
 	return settings.output;
 };
 //#endregion
+//#region src/project-selection.ts
+const requireProjectSlug = (context) => {
+	if (context.projectSlug === void 0) throw new CliError("Name the project with --project <slug> or CONFIGDIRECTOR_PROJECT.");
+	return context.projectSlug;
+};
+const requireLinkedProjectSlug = (context, settings) => {
+	const slug = context.projectSlug ?? settings?.project;
+	if (slug === void 0) throw new CliError("Name the project with --project <slug>, CONFIGDIRECTOR_PROJECT, or `project` in configdirector.json, which `configdirector init` writes.");
+	return slug;
+};
+const findProjectBySlug = async (client, slug) => {
+	const { parsedBody: projects } = await client.listProjects();
+	const project = projects.find((listedProject) => listedProject.slug === slug);
+	if (project === void 0) throw new CliError(`No project in the API token's organization has the slug "${slug}".`);
+	return project;
+};
+const connectToLinkedProject = async (context) => {
+	const projectSlug = requireLinkedProjectSlug(context, await readProjectSettings(context.invocation.workingDirectory));
+	const client = new AdminApiClient({
+		baseUrl: context.baseUrl,
+		token: await configuredApiToken(context)
+	});
+	return {
+		client,
+		project: await findProjectBySlug(client, projectSlug)
+	};
+};
+//#endregion
+//#region src/commands/configs.ts
+const LIFECYCLE_STATES = [
+	"new",
+	"in-use",
+	"settled",
+	"archive-ready",
+	"stale"
+];
+const tagIdNamed = async (client, project, name) => {
+	const tag = await client.findTagByName(project.id, name);
+	if (tag === void 0) throw new CliError(`No tag in ${project.slug} has the name "${name}".`);
+	return tag.id;
+};
+const tagIdsNamed = async (client, project, names) => {
+	const tagIds = [];
+	for (const name of names) tagIds.push(await tagIdNamed(client, project, name));
+	return tagIds;
+};
+const tagFilterOf = async (client, project, options) => {
+	if (options.untagged) return { form: "untagged" };
+	if (options.tag === void 0) return { form: "every-config" };
+	return {
+		form: "tagged",
+		tagIds: await tagIdsNamed(client, project, options.tag)
+	};
+};
+const configsInState = (listedConfigs, state) => state === void 0 ? listedConfigs : listedConfigs.filter((listedConfig) => listedConfig.config.state === state);
+const summaryColumnsOf = (config) => [
+	config.key,
+	config.type,
+	config.role,
+	config.lifetime,
+	config.state
+];
+const configLines = (projectSlug, configs) => configs.length === 0 ? [`No configs found in ${projectSlug}.`] : alignedColumns(configs.map(summaryColumnsOf));
+const listConfigs = async (context, _commandArguments, options) => {
+	const { client, project } = await connectToLinkedProject(context);
+	const listedConfigs = configsInState(await client.listConfigs(project.id, await tagFilterOf(client, project, options)), options.state);
+	return {
+		json: listedConfigs.map((listedConfig) => listedConfig.receivedConfig),
+		text: [...configLines(project.slug, listedConfigs.map((listedConfig) => listedConfig.config)), ""].join("\n"),
+		exitCode: ExitCode.success
+	};
+};
+const referencesSegments = (config) => config.targets.some((targetingRules) => targetingRules.rules.some((rule) => rule.type === "conditional" && rule.conditions.some((condition) => condition.kind === "segment")));
+const segmentNamesFor = async (client, project, config) => {
+	if (!referencesSegments(config)) return {};
+	const segments = await ifPermitted(client.listSegments(project.id));
+	return Object.fromEntries((segments?.parsedBody ?? []).map((segment) => [segment.id, segment]));
+};
+const getConfig = async (context, [configKey]) => {
+	const { client, project } = await connectToLinkedProject(context);
+	const receivedConfig = await client.getConfig(project.id, configKey);
+	if (receivedConfig === void 0) throw new CliError(`No config in ${project.slug} has the key "${configKey}".`);
+	const { parsedBody: config, responseBody } = receivedConfig;
+	return {
+		json: responseBody,
+		text: configText(config, configKey, await segmentNamesFor(client, project, config)),
+		exitCode: ExitCode.success
+	};
+};
+const createdConfigLines = (projectSlug, createdConfig, newConfig) => {
+	const settings = [
+		createdConfig.type,
+		createdConfig.role,
+		createdConfig.lifetime,
+		availabilityDescription(createdConfig)
+	];
+	return [`Created ${createdConfig.key} in ${projectSlug}: ${settings.join(", ")}.`, `Default targeting rule in every environment: ${String(newConfig.defaultValue)}`];
+};
+const keyTakenLines = (projectSlug, configKey, existingConfig) => [`${projectSlug} already has a config with the key ${configKey}, so no config was created:`, ...alignedColumns([summaryColumnsOf(existingConfig)])];
+const rejectsKey = (error) => error instanceof ApiValidationError && error.fieldErrors.some((fieldError) => fieldError.name === "key");
+const requestCreation = async (client, project, request) => {
+	try {
+		const { parsedBody: createdConfig, responseBody } = await client.createConfig(project.id, request);
+		return {
+			outcome: "created",
+			createdConfig,
+			responseBody
+		};
+	} catch (error) {
+		if (!rejectsKey(error)) throw error;
+		const existingConfig = await client.getConfig(project.id, request.key);
+		if (existingConfig === void 0) throw error;
+		return {
+			outcome: "key-taken",
+			existingConfig: existingConfig.parsedBody,
+			responseBody: existingConfig.responseBody
+		};
+	}
+};
+const creationOutput = (project, newConfig, creation) => {
+	switch (creation.outcome) {
+		case "created": return {
+			json: creation.responseBody,
+			text: [...createdConfigLines(project.slug, creation.createdConfig, newConfig), ""].join("\n"),
+			exitCode: ExitCode.success
+		};
+		case "key-taken": return {
+			json: creation.responseBody,
+			text: [...keyTakenLines(project.slug, newConfig.key, creation.existingConfig), ""].join("\n"),
+			exitCode: ExitCode.problemsFound
+		};
+	}
+};
+const createConfig = async (context, _commandArguments, options) => {
+	const newConfig = await newConfigOf(options, context.invocation.workingDirectory);
+	const { client, project } = await connectToLinkedProject(context);
+	return creationOutput(project, newConfig, await requestCreation(client, project, {
+		...newConfig,
+		tagIds: await tagIdsNamed(client, project, options.tag ?? [])
+	}));
+};
+const sdkDescription = (evaluation) => [evaluation.sdkName ?? "unknown SDK", ...evaluation.sdkVersion === null ? [] : [evaluation.sdkVersion]].join(" ");
+const utcMinute = (time) => {
+	const isoTime = new Date(time).toISOString();
+	return `${isoTime.slice(0, 10)} ${isoTime.slice(11, 16)} UTC`;
+};
+const activityLines = (configKey, activity) => activity.latestEvaluations.length === 0 ? [`No SDK evaluations of ${configKey} found.`] : alignedColumns(activity.latestEvaluations.map((evaluation) => [
+	evaluation.environment.slug,
+	evaluation.source,
+	sdkDescription(evaluation),
+	utcMinute(evaluation.time)
+]));
+const showConfigActivity = async (context, [configKey]) => {
+	const { client, project } = await connectToLinkedProject(context);
+	const receivedActivity = await client.getConfigActivity(project.id, configKey);
+	if (receivedActivity === void 0) throw new CliError(`No config in ${project.slug} has the key "${configKey}".`);
+	return {
+		json: receivedActivity.responseBody,
+		text: [...activityLines(configKey, receivedActivity.parsedBody), ""].join("\n"),
+		exitCode: ExitCode.success
+	};
+};
+//#endregion
+//#region src/commands/environments.ts
+const environmentColumns = (environment) => environment.live ? [
+	environment.slug,
+	environment.name,
+	"live"
+] : [environment.slug, environment.name];
+const environmentLines = (projectSlug, environments) => environments.length === 0 ? [`No environments found in ${projectSlug}.`] : alignedColumns(environments.map(environmentColumns));
+const listEnvironments = async (context) => {
+	const { client, project } = await connectToLinkedProject(context);
+	const { parsedBody: environments, responseBody } = await client.listEnvironments(project.id);
+	return {
+		json: responseBody,
+		text: [...environmentLines(project.slug, environments), ""].join("\n"),
+		exitCode: ExitCode.success
+	};
+};
+//#endregion
+//#region src/environment-selection.ts
+const environmentSlugsSentence = (environments) => environments.length === 0 ? "The project has no environments." : `Its environments are ${environments.map((environment) => environment.slug).join(", ")}.`;
+const findEnvironmentBySlug = async (client, project, slug) => {
+	const { parsedBody: environments } = await client.listEnvironments(project.id);
+	const environment = environments.find((listedEnvironment) => listedEnvironment.slug === slug);
+	if (environment === void 0) throw new CliError(`No environment in ${project.slug} has the slug "${slug}". ${environmentSlugsSentence(environments)}`);
+	return environment;
+};
+//#endregion
+//#region src/evaluate/context-form.ts
+const DEFAULT_CONTEXT_KIND = "user";
+const TYPED_TRAIT_MARKER = ":";
+const traitUsageError = (trait) => new CliError(`--context-trait ${trait} is not a trait. Write name=value for a string, or name:=<json> for a typed value, as in plan=pro or beta:=true.`);
+const parseTraitJson = (trait, json) => {
+	try {
+		return JSON.parse(json);
+	} catch {
+		throw new CliError(`--context-trait ${trait} has a value after := that is not JSON. Write name=value for a string.`);
+	}
+};
+const traitEntryOf = (trait) => {
+	const separatorIndex = trait.indexOf("=");
+	if (separatorIndex === -1) throw traitUsageError(trait);
+	const isTyped = trait[separatorIndex - 1] === TYPED_TRAIT_MARKER;
+	const name = trait.slice(0, isTyped ? separatorIndex - 1 : separatorIndex);
+	if (name === "") throw traitUsageError(trait);
+	const value = trait.slice(separatorIndex + 1);
+	return [name, isTyped ? parseTraitJson(trait, value) : value];
+};
+const contextJsonUsageError = () => new CliError("--context-json takes the context as a JSON object, as in {\"kind\":\"user\",\"identifier\":\"123\"}, or @<file>.");
+const contextOfJson = async (contextJson, workingDirectory) => {
+	const context = parseJson(await atFileArgumentText("--context-json", contextJson, workingDirectory));
+	if (!isJsonObject(context)) throw contextJsonUsageError();
+	return context;
+};
+const inlineContextOf = (options) => ({
+	kind: options.contextKind ?? DEFAULT_CONTEXT_KIND,
+	identifier: options.contextId,
+	name: options.contextName,
+	traits: options.contextTrait === void 0 ? void 0 : Object.fromEntries(options.contextTrait.map(traitEntryOf))
+});
+const SAVED_CONTEXT_SEPARATOR = ":";
+const savedContextReferenceOf = (savedContext) => {
+	const separatorIndex = savedContext.indexOf(SAVED_CONTEXT_SEPARATOR);
+	const kind = savedContext.slice(0, separatorIndex);
+	const identifier = savedContext.slice(separatorIndex + 1);
+	if (separatorIndex === -1 || kind === "" || identifier === "") throw new CliError(`--saved-context takes <kind>:<identifier>, as in user:123, not ${savedContext}.`);
+	return {
+		kind,
+		identifier
+	};
+};
+const givenInlineOptionNames = (options) => [
+	...options.contextKind === void 0 ? [] : ["--context-kind"],
+	...options.contextId === void 0 ? [] : ["--context-id"],
+	...options.contextName === void 0 ? [] : ["--context-name"],
+	...options.contextTrait === void 0 ? [] : ["--context-trait"]
+];
+const givenContextDoors = (options) => {
+	const { savedContext, contextJson } = options;
+	const inlineOptionNames = givenInlineOptionNames(options);
+	return [
+		...savedContext === void 0 ? [] : [{
+			optionNames: ["--saved-context"],
+			contextForm: async () => ({
+				form: "saved",
+				reference: savedContextReferenceOf(savedContext)
+			})
+		}],
+		...contextJson === void 0 ? [] : [{
+			optionNames: ["--context-json"],
+			contextForm: async (workingDirectory) => ({
+				form: "inline",
+				context: await contextOfJson(contextJson, workingDirectory)
+			})
+		}],
+		...inlineOptionNames.length === 0 ? [] : [{
+			optionNames: inlineOptionNames,
+			contextForm: async () => ({
+				form: "inline",
+				context: inlineContextOf(options)
+			})
+		}]
+	];
+};
+const contextFormOf = async (options, workingDirectory) => {
+	const [door, ...otherDoors] = givenContextDoors(options);
+	if (door === void 0) return { form: "empty" };
+	if (otherDoors.length > 0) throw new CliError(`${door.optionNames.join(", ")} cannot be combined with ${otherDoors.flatMap((otherDoor) => otherDoor.optionNames).join(", ")}. Give the context one way: --saved-context, --context-json, or the --context-kind, --context-id, --context-name and --context-trait options.`);
+	return door.contextForm(workingDirectory);
+};
+//#endregion
+//#region src/evaluate/evaluation-text.ts
+const RESOLVED_VALUE_DESCRIPTIONS = {
+	absent: () => "absent",
+	"unknown-attribute": () => "unknown to the evaluator",
+	scalar: (resolvedValue) => JSON.stringify(resolvedValue),
+	array: (resolvedValue) => JSON.stringify(resolvedValue),
+	object: (resolvedValue) => JSON.stringify(resolvedValue)
+};
+const contextDescription = (evaluation, contextForm) => {
+	const evaluatedContext = evaluation.context;
+	if (evaluatedContext === null) return "an empty context";
+	if (evaluatedContext.identifier === null) return `a ${evaluatedContext.kind} context without an identifier`;
+	const identity = `${evaluatedContext.kind} ${evaluatedContext.identifier}`;
+	return contextForm.form === "saved" ? `saved context ${identity}` : identity;
+};
+const servedByDescription = (evaluation) => {
+	const { servedBy } = evaluation;
+	switch (servedBy.kind) {
+		case "rule": return `served by rule ${evaluation.rules.findIndex((rule) => rule.ruleId === servedBy.ruleId) + 1}`;
+		case "default": return "served by the default targeting rule";
+	}
+};
+const describeShareRange = (from, to) => `${formatPercentage(from)} to ${formatPercentage(to)}`;
+const bucketPlacement = (bucket) => {
+	const assigned = `bucket ${bucket.assignedPercentage.toFixed(1)}`;
+	const selectedShare = bucket.shares.find((share) => share.percentageId === bucket.selectedPercentageId);
+	if (selectedShare !== void 0) return `${assigned} is in ${describeShareRange(selectedShare.from, selectedShare.to)}`;
+	return `${assigned} is outside ${describeShareRange(0, bucket.shares.at(-1)?.to ?? 0)}`;
+};
+const describeBucket = (bucket) => bucket.defaultedToPredefinedBucket ? `no identifier, so ${bucketPlacement(bucket)}` : bucketPlacement(bucket);
+const withBucket = (outcome, bucket) => bucket === void 0 ? outcome : `${outcome}: ${describeBucket(bucket)}`;
+const conditionsOf = (rule) => rule?.type === "conditional" ? rule.conditions : [];
+const segmentMismatchEvidence = (explanation) => {
+	if (!explanation.segmentFound) return "the segment was not found";
+	return explanation.matchedGroupIndex === void 0 ? "no group matched" : `group ${explanation.matchedGroupIndex + 1} matched`;
+};
+const mismatchEvidence = (failingCondition) => {
+	switch (failingCondition.kind) {
+		case "attribute": return `it is ${RESOLVED_VALUE_DESCRIPTIONS[failingCondition.resolvedType](failingCondition.resolvedValue)}`;
+		case "segment": return segmentMismatchEvidence(failingCondition);
+	}
+};
+const isFailingCondition = (condition) => condition.outcome === "not-matched";
+const failingConditionDescription = (explanation, conditions, segments) => {
+	const failingCondition = explanation.conditions.find(isFailingCondition);
+	const condition = conditions.find((ruleCondition) => ruleCondition.id === failingCondition?.conditionId);
+	return failingCondition === void 0 || condition === void 0 ? void 0 : `${describeCondition(condition, segments)}, but ${mismatchEvidence(failingCondition)}`;
+};
+const describeNotMatched = (explanation, conditions, segments) => {
+	const failingCondition = failingConditionDescription(explanation, conditions, segments);
+	return failingCondition === void 0 ? withBucket("not matched", explanation.bucket) : `not matched: ${failingCondition}`;
+};
+const RULE_OUTCOME_DESCRIPTIONS = {
+	matched: (explanation) => withBucket("matched", explanation.bucket),
+	"not-matched": describeNotMatched,
+	"not-evaluated": () => "not evaluated",
+	errored: () => "errored"
+};
+const ruleLines = (evaluation) => {
+	const rulesById = new Map(evaluation.targetingRules.rules.map((rule) => [rule.id, rule]));
+	return alignedColumns(evaluation.rules.map((explanation, index) => {
+		const rule = rulesById.get(explanation.ruleId);
+		return [`${index + 1}. ${rule === void 0 ? explanation.ruleId : describeRule(rule, evaluation.segments)}`, RULE_OUTCOME_DESCRIPTIONS[explanation.outcome](explanation, conditionsOf(rule), evaluation.segments)];
+	}));
+};
+const evaluationText = (evaluation, requested) => [
+	...oldKeyLines(requested.configKey, evaluation.key),
+	`${evaluation.key} in ${evaluation.environment.name} for ${contextDescription(evaluation, requested.contextForm)}`,
+	"",
+	`${evaluation.value ?? "no value"}, ${servedByDescription(evaluation)}`,
+	"",
+	...ruleLines(evaluation),
+	`Default targeting rule: ${evaluation.targetingRules.defaultValue}`,
+	""
+].join("\n");
+//#endregion
+//#region src/commands/evaluate.ts
+const contextFieldsOf = (contextForm) => {
+	switch (contextForm.form) {
+		case "inline": return { context: contextForm.context };
+		case "saved": return { savedContext: contextForm.reference };
+		case "empty": return {};
+	}
+};
+const NOT_FOUND_MESSAGES = {
+	CONFIG_NOT_FOUND: ({ project, configKey }) => `No config in ${project.slug} has the key "${configKey}".`,
+	ENVIRONMENT_NOT_FOUND: ({ project, environment }) => `No environment in ${project.slug} has the slug "${environment.slug}" any more.`,
+	CONTEXT_NOT_FOUND: ({ environment, contextForm }, error) => contextForm.form === "saved" ? `No context saved in ${environment.slug} has the context kind ${contextForm.reference.kind} and the identifier "${contextForm.reference.identifier}".` : error.message
+};
+const requestEvaluation = async (client, requested) => {
+	try {
+		return await client.evaluateConfig(requested.project.id, requested.configKey, {
+			environmentId: requested.environment.id,
+			...contextFieldsOf(requested.contextForm)
+		});
+	} catch (error) {
+		if (error instanceof EvaluationNotFoundError) throw new CliError(NOT_FOUND_MESSAGES[error.code](requested, error));
+		throw error;
+	}
+};
+const evaluate = async (context, [configKey], options) => {
+	const contextForm = await contextFormOf(options, context.invocation.workingDirectory);
+	const { client, project } = await connectToLinkedProject(context);
+	const requested = {
+		project,
+		configKey,
+		environment: await findEnvironmentBySlug(client, project, options.environment),
+		contextForm
+	};
+	const { evaluation, responseBody } = await requestEvaluation(client, requested);
+	return {
+		json: responseBody,
+		text: evaluationText(evaluation, requested),
+		exitCode: ExitCode.success
+	};
+};
+//#endregion
 //#region src/commands/init.ts
 const refuseExistingFile = async (file) => {
 	if (await access(file).then(() => true, () => false)) throw new CliError(`${file} already exists. init never overwrites it; edit the file instead.`);
@@ -350,6 +1398,20 @@ const login = async (context) => {
 	};
 };
 //#endregion
+//#region src/commands/projects.ts
+const projectLines = (projects) => projects.length === 0 ? ["No projects found."] : alignedColumns(projects.map((project) => [project.slug, project.name]));
+const listProjects = async (context) => {
+	const { parsedBody: projects, responseBody } = await new AdminApiClient({
+		baseUrl: context.baseUrl,
+		token: await configuredApiToken(context)
+	}).listProjects();
+	return {
+		json: responseBody,
+		text: [...projectLines(projects), ""].join("\n"),
+		exitCode: ExitCode.success
+	};
+};
+//#endregion
 //#region src/plural.ts
 const plural = (count, singular, pluralForm) => count === 1 ? singular : pluralForm;
 //#endregion
@@ -1077,6 +2139,10 @@ const DART_RE_EXPORT_DIRECTIVES = ["export"];
 const SWIFT_PACKAGE_MANIFEST = "Package.swift";
 const SWIFT_PACKAGE_TARGETS_DIRECTORIES = ["Sources", "Tests"];
 const XCODE_PROJECT_EXTENSION = ".xcodeproj";
+const JVM_SOURCE_EXTENSIONS = [".kt", ".java"];
+const CSHARP_PROJECT_EXTENSION = ".csproj";
+const CSHARP_SOURCE_EXTENSION = ".cs";
+const CSHARP_BUILD_OUTPUT_DIRECTORIES = ["bin", "obj"];
 const stringAt = (code, index) => code.token(index)?.kind === "string" ? plainStringContent(code, {
 	first: index,
 	last: index
@@ -1245,6 +2311,63 @@ const goPackageNameIn = (code) => {
 	const name = code.token(1);
 	return code.isIdentifier(0, "package") && name?.kind === "identifier" ? name.text : void 0;
 };
+const isCapitalized = (name) => name.charAt(0) >= "A" && name.charAt(0) <= "Z";
+const capitalizedNamesIn = (code) => new Set(code.tokens.flatMap((token) => token.kind === "identifier" && isCapitalized(token.text) ? [token.text] : []));
+const dottedNameAt = (code, start) => {
+	const segments = [];
+	let index = start;
+	for (let token = code.token(index); token?.kind === "identifier"; token = code.token(index)) {
+		segments.push(token.text);
+		if (!code.isPunctuation(index + 1, ".")) break;
+		index += 2;
+	}
+	return {
+		segments,
+		endsWithWildcard: code.isPunctuation(index - 1, ".") && code.isPunctuation(index, "*")
+	};
+};
+const jvmPackagePathIn = (code) => {
+	const packageIndex = code.tokens.findIndex((_token, index) => code.startsLine(index) && code.isIdentifier(index, "package"));
+	return packageIndex === -1 ? [] : dottedNameAt(code, packageIndex + 1).segments;
+};
+const jvmImportsIn = (code) => code.tokens.flatMap((_token, index) => {
+	if (!code.startsLine(index) || !code.isIdentifier(index, "import")) return [];
+	const isStaticImport = code.isIdentifier(index + 1, "static");
+	const { segments, endsWithWildcard } = dottedNameAt(code, isStaticImport ? index + 2 : index + 1);
+	return [endsWithWildcard && !isStaticImport ? {
+		kind: "wholePackage",
+		packagePath: segments
+	} : {
+		kind: "classOrMember",
+		path: segments
+	}];
+});
+const jvmSourceRootOf = (directory, packagePath) => {
+	const sourceRoot = ancestorDirectory(directory, packagePath.length);
+	return join(sourceRoot, ...packagePath) === directory ? sourceRoot : void 0;
+};
+const jvmClassFileCandidates = (sourceRoot, importPath) => importPath.flatMap((_segment, index) => {
+	const classPath = join(sourceRoot, ...importPath.slice(0, importPath.length - index));
+	return JVM_SOURCE_EXTENSIONS.map((extension) => classPath + extension);
+});
+const csharpProjectRootDeclaredIn = async (directory) => {
+	return (await readdir(directory, { withFileTypes: true }).catch(() => [])).some((entry) => entry.isFile() && extname(entry.name) === CSHARP_PROJECT_EXTENSION) ? directory : void 0;
+};
+const isSearchedForHolderClasses = (directoryName) => !CSHARP_BUILD_OUTPUT_DIRECTORIES.includes(directoryName) && !EXCLUDED_DIRECTORY_NAMES.has(directoryName);
+const csharpFilesUnder = async (directory) => {
+	const entries = await readdir(directory, { withFileTypes: true }).catch(() => []);
+	const files = entries.filter((entry) => entry.isFile() && extname(entry.name) === CSHARP_SOURCE_EXTENSION).map((entry) => join(directory, entry.name));
+	const filesOfSubdirectories = await Promise.all(entries.filter((entry) => entry.isDirectory() && isSearchedForHolderClasses(entry.name)).map((entry) => csharpFilesUnder(join(directory, entry.name))));
+	return [...files, ...filesOfSubdirectories.flat()];
+};
+const filesOfCsharpClassName = (files) => {
+	const filesOfClassName = /* @__PURE__ */ new Map();
+	for (const file of files) {
+		const className = basename(file, CSHARP_SOURCE_EXTENSION);
+		filesOfClassName.set(className, [...filesOfClassName.get(className) ?? [], file]);
+	}
+	return filesOfClassName;
+};
 const goPackageNameOfFile = async (file) => {
 	const contents = await readFileWithinSizeLimit(file);
 	return contents === void 0 ? void 0 : goPackageNameIn(new SourceCode(contents, "go"));
@@ -1253,14 +2376,17 @@ var LocalImports = class {
 	dartPackages;
 	goModules;
 	swiftProjects;
+	csharpProjectRoots;
 	pathAliases;
-	goFilesOfDirectory = /* @__PURE__ */ new Map();
+	filesOfDirectory = /* @__PURE__ */ new Map();
+	csharpClassFilesOfProject = /* @__PURE__ */ new Map();
 	fileExistence = /* @__PURE__ */ new Map();
 	constructor(highestDirectory) {
 		this.highestDirectory = highestDirectory;
 		this.dartPackages = new NearestDeclarations(highestDirectory, dartPackageDeclaredIn);
 		this.goModules = new NearestDeclarations(highestDirectory, goModuleDeclaredIn);
 		this.swiftProjects = new NearestDeclarations(highestDirectory, swiftProjectDeclaredIn);
+		this.csharpProjectRoots = new NearestDeclarations(highestDirectory, csharpProjectRootDeclaredIn);
 		this.pathAliases = new PathAliases(highestDirectory);
 	}
 	filesImportedBy(code, file) {
@@ -1287,6 +2413,18 @@ var LocalImports = class {
 			case "csharp": return Promise.resolve([]);
 		}
 	}
+	holderClassFilesReferencedBy(code, file) {
+		switch (code.language) {
+			case "kotlin":
+			case "java": return this.jvmHolderClassFilesReferencedBy(code, file);
+			case "csharp": return this.csharpHolderClassFilesReferencedBy(code, file);
+			case "javascript":
+			case "python":
+			case "dart":
+			case "go":
+			case "swift": return Promise.resolve([]);
+		}
+	}
 	filesReExportedBy(code, file) {
 		switch (code.language) {
 			case "javascript": return this.javascriptFilesAt(javascriptReExportSpecifiers(code), file);
@@ -1380,11 +2518,53 @@ var LocalImports = class {
 			case "xcodeProject": return project.root;
 		}
 	}
-	goFilesIn(directory) {
-		const filesListedBefore = this.goFilesOfDirectory.get(directory);
+	async jvmHolderClassFilesReferencedBy(code, file) {
+		const directory = dirname(file);
+		const classNames = capitalizedNamesIn(code);
+		const sourceRoot = jvmSourceRootOf(directory, jvmPackagePathIn(code));
+		return [...sourceRoot === void 0 ? [] : await this.jvmClassFilesImportedFrom(sourceRoot, jvmImportsIn(code), classNames), ...await this.jvmClassFilesIn(directory, classNames)];
+	}
+	async jvmClassFilesImportedFrom(sourceRoot, imports, classNames) {
+		const files = [];
+		for (const jvmImport of imports) switch (jvmImport.kind) {
+			case "classOrMember": {
+				const importedFile = await this.firstExistingFile(jvmClassFileCandidates(sourceRoot, jvmImport.path));
+				if (importedFile !== void 0) files.push(importedFile);
+				break;
+			}
+			case "wholePackage":
+				files.push(...await this.jvmClassFilesIn(join(sourceRoot, ...jvmImport.packagePath), classNames));
+				break;
+		}
+		return files;
+	}
+	async jvmClassFilesIn(directory, classNames) {
+		return (await this.filesIn(directory)).filter((file) => {
+			const extension = extname(file);
+			return JVM_SOURCE_EXTENSIONS.includes(extension) && classNames.has(basename(file, extension));
+		});
+	}
+	async csharpHolderClassFilesReferencedBy(code, file) {
+		const projectRoot = await this.csharpProjectRoots.declarationAbove(file);
+		if (projectRoot === void 0) return [];
+		const filesOfClassName = await this.csharpClassFilesIn(projectRoot);
+		return [...capitalizedNamesIn(code)].flatMap((className) => filesOfClassName.get(className) ?? []);
+	}
+	csharpClassFilesIn(projectRoot) {
+		const classFilesListedBefore = this.csharpClassFilesOfProject.get(projectRoot);
+		if (classFilesListedBefore !== void 0) return classFilesListedBefore;
+		const classFiles = csharpFilesUnder(projectRoot).then(filesOfCsharpClassName);
+		this.csharpClassFilesOfProject.set(projectRoot, classFiles);
+		return classFiles;
+	}
+	async goFilesIn(directory) {
+		return (await this.filesIn(directory)).filter((file) => extname(file) === ".go");
+	}
+	filesIn(directory) {
+		const filesListedBefore = this.filesOfDirectory.get(directory);
 		if (filesListedBefore !== void 0) return filesListedBefore;
-		const files = readdir(directory, { withFileTypes: true }).then((entries) => entries.filter((entry) => entry.isFile() && extname(entry.name) === ".go").map((entry) => join(directory, entry.name)), () => []);
-		this.goFilesOfDirectory.set(directory, files);
+		const files = readdir(directory, { withFileTypes: true }).then((entries) => entries.filter((entry) => entry.isFile()).map((entry) => join(directory, entry.name)), () => []);
+		this.filesOfDirectory.set(directory, files);
 		return files;
 	}
 };
@@ -2457,19 +3637,24 @@ const sdkFamiliesUsedIn = (highestDirectory) => {
 			}
 		}
 	};
-	const familiesMarkedThroughImports = async (file, code) => {
-		const importedPaths = await localImports.filesImportedBy(code, file.path);
-		return (await Promise.all(importedPaths.map((importedPath) => familiesReachedThrough(importedPath, RE_EXPORT_STEPS_FOLLOWED)))).flat();
+	const familiesReachedThroughEach = async (paths) => {
+		return (await Promise.all(paths.map((path) => familiesReachedThrough(path, RE_EXPORT_STEPS_FOLLOWED)))).flat();
 	};
+	const familiesMarkedThroughImports = async (file, code) => familiesReachedThroughEach(await localImports.filesImportedBy(code, file.path));
+	const familiesMarkedInHolderClasses = async (file, code) => familiesReachedThroughEach(await localImports.holderClassFilesReferencedBy(code, file.path));
 	const familiesMarkedInSamePackageOrTarget = async (file, code) => {
 		const familiesFoundBefore = familiesMarkedInPackageOrTargetOfFile.get(file.path);
 		if (familiesFoundBefore !== void 0) return familiesFoundBefore;
 		const filesOfPackageOrTarget = await localImports.filesOfSamePackageOrTarget(code, file.path);
-		const families = Promise.all(filesOfPackageOrTarget.map((fileOfPackageOrTarget) => familiesReachedThrough(fileOfPackageOrTarget, RE_EXPORT_STEPS_FOLLOWED))).then((familiesOfFiles) => familiesOfFiles.flat());
+		const families = familiesReachedThroughEach(filesOfPackageOrTarget);
 		for (const fileOfPackageOrTarget of filesOfPackageOrTarget) familiesMarkedInPackageOrTargetOfFile.set(fileOfPackageOrTarget, families);
 		return families;
 	};
-	const familiesMarkedByOtherFiles = async (file, code) => [...await familiesMarkedThroughImports(file, code), ...await familiesMarkedInSamePackageOrTarget(file, code)];
+	const familiesMarkedByOtherFiles = async (file, code) => [
+		...await familiesMarkedThroughImports(file, code),
+		...await familiesMarkedInSamePackageOrTarget(file, code),
+		...await familiesMarkedInHolderClasses(file, code)
+	];
 	return async (file, code) => {
 		const familiesForExtension = familiesOfExtension(file.extension);
 		const markedHere = familiesWithMarkerIn(file.contents, familiesForExtension);
@@ -2543,7 +3728,7 @@ const scanProject = async (context, path) => {
 		token: await configuredApiToken(context)
 	});
 	const project = await findProjectBySlug(client, projectSlug);
-	const configs = await client.listConfigs(project.id);
+	const configs = (await client.listConfigs(project.id, { form: "every-config" })).map((listedConfig) => listedConfig.config);
 	const projectKeys = new Set(configs.flatMap((config) => [config.key, ...config.deprecatedKeys.map((deprecatedKey) => deprecatedKey.key)]));
 	const codeReferenceScan = await scanCodeReferences({
 		root,
@@ -2642,6 +3827,140 @@ const scan = async (context, [path]) => {
 	};
 };
 //#endregion
+//#region src/segments/segment-text.ts
+const conditionGroupLines = (heading, groups) => [
+	"",
+	heading,
+	...groups.map((group, index) => `  ${index + 1}. ${describeConditionGroup(group)}`)
+];
+const segmentText = (segment, environmentSlugs) => [
+	segment.key,
+	`  Name: ${segment.name}`,
+	...conditionGroupLines("Project definition", segment.groups),
+	...Object.entries(segment.overrides).flatMap(([environmentId, groups]) => conditionGroupLines(`Override in ${environmentSlugs.get(environmentId) ?? environmentId}`, groups)),
+	""
+].join("\n");
+//#endregion
+//#region src/commands/segments.ts
+const usageDescription = (segment) => `used by ${segment.usages.length} ${plural(segment.usages.length, "config", "configs")}`;
+const segmentLines = (projectSlug, segments) => segments.length === 0 ? [`No segments found in ${projectSlug}.`] : alignedColumns(segments.map((segment) => [
+	segment.key,
+	segment.name,
+	usageDescription(segment)
+]));
+const listSegments = async (context) => {
+	const { client, project } = await connectToLinkedProject(context);
+	const { parsedBody: segments, responseBody } = await client.listSegments(project.id);
+	return {
+		json: responseBody,
+		text: [...segmentLines(project.slug, segments), ""].join("\n"),
+		exitCode: ExitCode.success
+	};
+};
+const environmentSlugsFor = async (client, project, segment) => {
+	if (Object.keys(segment.overrides).length === 0) return /* @__PURE__ */ new Map();
+	const environments = await ifPermitted(client.listEnvironments(project.id));
+	return new Map((environments?.parsedBody ?? []).map((environment) => [environment.id, environment.slug]));
+};
+const getSegment = async (context, [segmentKey]) => {
+	const { client, project } = await connectToLinkedProject(context);
+	const receivedSegment = await client.getSegment(project.id, segmentKey);
+	if (receivedSegment === void 0) throw new CliError(`No segment in ${project.slug} has the key "${segmentKey}".`);
+	const { parsedBody: segment, responseBody } = receivedSegment;
+	return {
+		json: responseBody,
+		text: segmentText(segment, await environmentSlugsFor(client, project, segment)),
+		exitCode: ExitCode.success
+	};
+};
+//#endregion
+//#region src/targeting-rules/reference-text.ts
+const headedListLines = (heading, items) => [heading, ...items.map((item) => `  ${item}`)];
+const operatorsByTargetTypeLines = (operatorsByTargetType) => ["Operators per target type:", ...Object.entries(operatorsByTargetType).flatMap(([targetType, operators]) => [`  ${targetType}:`, ...operators.map((operator) => `    ${operator}`)])];
+const targetingRulesReferenceText = (reference) => [
+	...reference.notes.flatMap((note) => [note, ""]),
+	...headedListLines("Condition kinds:", reference.conditionKinds),
+	"",
+	...headedListLines("Attributes a condition can test:", reference.conditionAttributes),
+	"",
+	...headedListLines("Context kind operators:", reference.contextKindOperators),
+	"",
+	...headedListLines("Segment operators:", reference.segmentOperators),
+	"",
+	...operatorsByTargetTypeLines(reference.operatorsByTargetType),
+	""
+].join("\n");
+//#endregion
+//#region src/targeting-rules/targeting-rules-file.ts
+const STANDARD_INPUT_ARGUMENT = "-";
+const readRulesSource = async (rulesArgument, invocation) => {
+	if (rulesArgument === STANDARD_INPUT_ARGUMENT) return {
+		origin: "--rules reads stdin",
+		contents: await text(invocation.stdin)
+	};
+	const { file, contents } = await readOptionFile("--rules", rulesArgument, invocation.workingDirectory);
+	return {
+		origin: `--rules names ${file}`,
+		contents
+	};
+};
+const readTargetingRulesFile = async (rulesArgument, invocation) => {
+	const { origin, contents } = await readRulesSource(rulesArgument, invocation);
+	const targetingRules = parseJson(contents);
+	if (!isJsonObject(targetingRules)) throw new CliError(`${origin}, which does not hold a JSON object. It takes {"defaultValue": ..., "rules": [...]}, like an entry of targets in configs get --json.`);
+	return targetingRules;
+};
+const withId = (entry) => entry.id === void 0 ? {
+	id: randomUUID(),
+	...entry
+} : entry;
+const conditionOrPercentageWithId = (conditionOrPercentage) => isJsonObject(conditionOrPercentage) ? withId(conditionOrPercentage) : conditionOrPercentage;
+const conditionsOrPercentagesWithIds = (rule, field) => {
+	const conditionsOrPercentages = rule[field];
+	return Array.isArray(conditionsOrPercentages) ? { [field]: conditionsOrPercentages.map(conditionOrPercentageWithId) } : {};
+};
+const ruleWithIds = (rule) => isJsonObject(rule) ? {
+	...withId(rule),
+	...conditionsOrPercentagesWithIds(rule, "conditions"),
+	...conditionsOrPercentagesWithIds(rule, "percentages")
+} : rule;
+const withGeneratedIds = (targetingRules) => Array.isArray(targetingRules.rules) ? {
+	...targetingRules,
+	rules: targetingRules.rules.map(ruleWithIds)
+} : targetingRules;
+//#endregion
+//#region src/commands/targeting-rules.ts
+const replacedRulesLine = (configKey, environment, targetingRules) => {
+	const ruleCount = Array.isArray(targetingRules.rules) ? targetingRules.rules.length : 0;
+	return `Replaced the targeting rules of ${configKey} in ${environment.slug} with ${ruleCount} ${plural(ruleCount, "rule", "rules")} and the default targeting rule value ${String(targetingRules.defaultValue)}.`;
+};
+const setTargetingRules = async (context, [configKey], options) => {
+	const targetingRules = withGeneratedIds(await readTargetingRulesFile(options.rules, context.invocation));
+	const { client, project } = await connectToLinkedProject(context);
+	const environment = await findEnvironmentBySlug(client, project, options.environment);
+	const request = {
+		...targetingRules,
+		environmentId: environment.id
+	};
+	if (await client.replaceTargetingRules(project.id, configKey, request) === "not-found") throw new CliError(`No config in ${project.slug} has the key "${configKey}".`);
+	return {
+		json: request,
+		text: [replacedRulesLine(configKey, environment, targetingRules), ""].join("\n"),
+		exitCode: ExitCode.success
+	};
+};
+const showTargetingRulesReference = async (context) => {
+	const { parsedBody: reference, responseBody } = await new AdminApiClient({
+		baseUrl: context.baseUrl,
+		token: await configuredApiToken(context)
+	}).getTargetingRulesReference();
+	return {
+		json: responseBody,
+		text: targetingRulesReferenceText(reference),
+		exitCode: ExitCode.success
+	};
+};
+//#endregion
 //#region src/validate/findings.ts
 const servedValueTypesOfConfigTypes = new Map([
 	["boolean", "boolean"],
@@ -2855,6 +4174,7 @@ const withoutTrailingSlashes = (url) => {
 	while (trimmedUrl.endsWith("/")) trimmedUrl = trimmedUrl.slice(0, -1);
 	return trimmedUrl;
 };
+const repeatedOption = (value, values) => [...values ?? [], value];
 const runCommand = async (invocation, command, actionArguments) => {
 	const parsedCommand = actionArguments.at(-1);
 	const options = parsedCommand.optsWithGlobals();
@@ -2863,7 +4183,7 @@ const runCommand = async (invocation, command, actionArguments) => {
 		baseUrl: withoutTrailingSlashes(options.baseUrl ?? nonEmptyVariable(invocation, "CONFIGDIRECTOR_BASE_URL") ?? DEFAULT_BASE_URL),
 		tokenOption: options.token,
 		projectSlug: options.project ?? nonEmptyVariable(invocation, "CONFIGDIRECTOR_PROJECT")
-	}, parsedCommand.processedArgs);
+	}, parsedCommand.processedArgs, parsedCommand.opts());
 	invocation.stdout.write(options.json ? `${JSON.stringify(output.json, null, 2)}\n` : output.text);
 	return output.exitCode;
 };
@@ -2889,6 +4209,20 @@ const run = async (invocation) => {
 	program.command("init").description("write configdirector.json for a project in the current directory").action(commandAction(init));
 	program.command("scan").argument("[path]", "directory or file to scan (default: the current directory)").description("list where the code reads config keys through a ConfigDirector SDK").action(commandAction(scan));
 	program.command("validate").argument("[path]", "directory or file to check (default: the current directory)").description("check every config key the code reads against the project's configs, exiting 1 when one is wrong").action(commandAction(validate));
+	program.command("evaluate").argument("<key>", "the config's key").description("show the value a context gets for a config in an environment, and why").requiredOption("--environment <slug>", "slug of the environment whose targeting rules to evaluate (required)").option("--context-kind <kind>", "context kind of the context to evaluate for (default: user)").option("--context-id <identifier>", "identifier of the context").option("--context-name <name>", "name of the context").option("--context-trait <name=value>", "a trait of the context, as a string, or name:=<json> for a number, boolean, array or object; repeatable", repeatedOption).option("--context-json <json>", "the whole context as a JSON object, or @<file> to read it from a file").option("--saved-context <kind:identifier>", "a context ConfigDirector saved from SDK evaluations in the environment, such as user:123").addHelpText("after", "\nGive the context with the --context-* options, with --context-json, or with --saved-context. Without any of them, the config is evaluated for an empty context, as an SDK given none would.").action(commandAction(evaluate));
+	program.command("projects").description("list the projects of the API token's organization").command("list").description("list the organization's projects, whatever project is selected").action(commandAction(listProjects));
+	program.command("environments").description("list the project's environments").command("list").description("list the project's environments with their slugs, marking the live ones").action(commandAction(listEnvironments));
+	const configsCommand = program.command("configs").description("list, show and create a project's configs");
+	configsCommand.command("list").description("list the project's configs with their type, role, lifetime and lifecycle state").option("--tag <name>", "list only the configs that have this tag; repeatable, for configs with any of them", repeatedOption).addOption(new Option("--untagged", "list only the configs without tags").conflicts("tag")).addOption(new Option("--state <state>", "list only the configs in this lifecycle state").choices(LIFECYCLE_STATES)).action(commandAction(listConfigs));
+	configsCommand.command("get").argument("<key>", "the config's key, or an old key of it").description("show a config's settings and its targeting rules in every environment").action(commandAction(getConfig));
+	configsCommand.command("activity").argument("<key>", "the config's key, or an old key of it").description("show when SDKs last evaluated a config, per environment, SDK key kind, SDK name and SDK version").action(commandAction(showConfigActivity));
+	configsCommand.command("create").description("create a config from options that mirror the Admin API's fields").requiredOption("--key <key>", "the config's key (required)").option("--description <text>", "a description shown with the config in the dashboard").addOption(new Option("--type <type>", "the type of the config's values (required)").choices(CONFIG_TYPES).makeOptionMandatory()).addOption(new Option("--role <role>", "what the config is for (required)").choices(CONFIG_ROLES).makeOptionMandatory()).addOption(new Option("--lifetime <lifetime>", "whether the config is expected to be removed (required)").choices(CONFIG_LIFETIMES).makeOptionMandatory()).requiredOption("--default-value <value>", "the default targeting rule value every environment starts with, in the type given by --type; not the in-code default value an application passes to the SDK (required)").option("--client-only", "serve the config to client SDKs only (default: client and server SDKs)").addOption(new Option("--server-only", "serve the config to server SDKs only (default: client and server SDKs)").conflicts("clientOnly")).option("--tag <name>", "assign the project's tag with this name; repeatable", repeatedOption).option("--variation <name=value>", "a variation of an experiment, its value in the type given by --type; repeatable", repeatedOption).addOption(new Option("--min <number>", "the smallest value allowed, included").helpGroup(typeConstraintHelpGroup("min"))).addOption(new Option("--max <number>", "the largest value allowed, included").helpGroup(typeConstraintHelpGroup("max"))).addOption(new Option("--exclusive-min <number>", "values must be greater than this number").conflicts("min").helpGroup(typeConstraintHelpGroup("exclusiveMin"))).addOption(new Option("--exclusive-max <number>", "values must be less than this number").conflicts("max").helpGroup(typeConstraintHelpGroup("exclusiveMax"))).addOption(new Option("--unit <unit>", "the unit of the number the SDKs receive (required)").choices(TIMESPAN_UNITS).helpGroup(typeConstraintHelpGroup("unit"))).addOption(new Option("--allow-fractions", "allow values with a fraction of the unit").helpGroup(typeConstraintHelpGroup("allowFractions"))).addOption(new Option("--allowed-value <value>", "a value the config can take; repeatable").argParser(repeatedOption).helpGroup(typeConstraintHelpGroup("allowedValue"))).addOption(new Option("--enum-value-type <type>", "whether the allowed values are strings or numbers (default: string)").choices(ENUM_VALUE_TYPES).helpGroup(typeConstraintHelpGroup("enumValueType"))).addOption(new Option("--https-only", "allow only HTTPS URLs").helpGroup(typeConstraintHelpGroup("httpsOnly"))).addOption(new Option("--json-schema <file>", "a file holding the JSON Schema every value must match").helpGroup(typeConstraintHelpGroup("jsonSchema"))).action(commandAction(createConfig));
+	const segmentsCommand = program.command("segments").description("list a project's segments and show one segment");
+	segmentsCommand.command("list").description("list the project's segments with how many configs use each").action(commandAction(listSegments));
+	segmentsCommand.command("get").argument("<key>", "the segment's key").description("show a segment's condition groups and its environment overrides").action(commandAction(getSegment));
+	const targetingRulesCommand = program.command("targeting-rules").description("replace a config's targeting rules in one environment and show the format they take");
+	targetingRulesCommand.command("set").argument("<key>", "the config's key, or an old key of it").description("replace a config's targeting rules in one environment with the rules of a JSON file").requiredOption("--environment <slug>", "slug of the environment whose targeting rules to replace (required)").requiredOption("--rules <file>", "a JSON file holding defaultValue and rules as the Admin API takes them, or - to read it from stdin (required)").addHelpText("after", "\nThe file holds {\"defaultValue\": ..., \"rules\": [...]}, like an entry of targets in configs get --json, so you can edit that output and write it back. Every rule of the environment is replaced. A rule, condition or percentage without an id gets a new one. configdirector targeting-rules reference lists the condition kinds, attributes and operators.").action(commandAction(setTargetingRules));
+	targetingRulesCommand.command("reference").description("show the format targeting rules take: the condition kinds, the attributes a condition can test and the operators").action(commandAction(showTargetingRulesReference));
 	try {
 		await program.parseAsync(invocation.commandLineArguments, { from: "user" });
 		return exitCode;