@configdirector/cli 0.1.0-beta.2 → 0.8.0-beta.1

package/dist/configdirector.mjs

@@ -1,14 +1,18 @@
 #!/usr/bin/env node
 import { homedir } from "node:os";
-import { Command, CommanderError } from "commander";
-import { access, mkdir, open, readFile, readdir, stat, writeFile } from "node:fs/promises";
+import { Command, CommanderError, Option } from "commander";
 import * as v from "valibot";
+import { access, mkdir, open, readFile, readdir, stat, writeFile } from "node:fs/promises";
 import { basename, dirname, extname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { createInterface } from "node:readline";
 import ignore from "ignore";
 import picomatch from "picomatch";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { randomUUID } from "node:crypto";
+import { text } from "node:stream/consumers";
 //#region package.json
-var version = "0.1.0-beta.2";
+var version = "0.8.0-beta.1";
 //#endregion
 //#region src/CliError.ts
 var CliError = class extends Error {
@@ -38,15 +42,45 @@ const ApiValidationErrorBodySchema = v.object({ errors: v.array(v.object({
 	message: v.string()
 })) });
 const ServiceSuspendedBodySchema = v.object({ code: v.literal("SERVICE_SUSPENDED") });
+const RepositoryLimitReachedBodySchema = v.object({ code: v.literal("REPOSITORY_LIMIT_REACHED") });
+const EvaluationNotFoundBodySchema = v.object({
+	error: v.string(),
+	code: v.picklist([
+		"CONFIG_NOT_FOUND",
+		"ENVIRONMENT_NOT_FOUND",
+		"CONTEXT_NOT_FOUND"
+	])
+});
 const describeFieldError = (fieldError) => fieldError.name === void 0 ? fieldError.message : `${fieldError.name}: ${fieldError.message}`;
 var ApiAuthorizationError = class extends CliError {
 	constructor(code, apiMessage) {
 		super(`The Admin API refused the request: ${apiMessage} (${code})`);
+		this.code = code;
+	}
+};
+const ifPermitted = async (request) => {
+	try {
+		return await request;
+	} catch (error) {
+		if (error instanceof ApiAuthorizationError && error.code === "INSUFFICIENT_PERMISSIONS") return;
+		throw error;
 	}
 };
 var ApiValidationError = class extends CliError {
-	constructor(errors) {
-		super(`The Admin API rejected the request:\n${errors.map((error) => `  ${describeFieldError(error)}`).join("\n")}`);
+	constructor(fieldErrors) {
+		super(`The Admin API rejected the request:\n${fieldErrors.map((error) => `  ${describeFieldError(error)}`).join("\n")}`);
+		this.fieldErrors = fieldErrors;
+	}
+};
+var EvaluationNotFoundError = class extends CliError {
+	constructor(code, apiMessage) {
+		super(`The Admin API could not evaluate the config: ${apiMessage} (${code})`);
+		this.code = code;
+	}
+};
+var RepositoryLimitReachedError = class extends CliError {
+	constructor() {
+		super("The project already holds its maximum of scanned repositories, so the Admin API refused the upload (REPOSITORY_LIMIT_REACHED). Remove a repository it no longer needs with `configdirector repositories remove <name>`, then upload again.");
 	}
 };
 var ServiceSuspendedError = class extends CliError {
@@ -66,6 +100,579 @@ var UnexpectedApiResponseError = class extends CliError {
 	}
 };
 //#endregion
+//#region src/aligned-columns.ts
+const COLUMN_GAP = "   ";
+const widestCellOf = (rows, column) => Math.max(0, ...rows.map((row) => row[column]?.length ?? 0));
+const alignedColumns = (rows) => rows.map((row) => row.map((cell, column) => column === row.length - 1 ? cell : cell.padEnd(widestCellOf(rows, column))).join(COLUMN_GAP));
+//#endregion
+//#region src/admin-api/targeting-rules.ts
+const RuleValueSchema = v.union([
+	v.string(),
+	v.number(),
+	v.boolean()
+]);
+const attributeConditionEntries = {
+	attribute: v.string(),
+	trait: v.nullish(v.string()),
+	operator: v.string(),
+	targetValues: v.array(v.unknown())
+};
+const AttributeConditionSchema = v.object(attributeConditionEntries);
+const ConditionGroupSchema = v.array(AttributeConditionSchema);
+const SegmentConditionSchema = v.object({
+	id: v.string(),
+	kind: v.literal("segment"),
+	operator: v.string(),
+	segmentId: v.string()
+});
+const ConditionSchema = v.variant("kind", [v.object({
+	id: v.string(),
+	kind: v.literal("attribute"),
+	...attributeConditionEntries
+}), SegmentConditionSchema]);
+const PercentageSchema = v.object({
+	percentage: v.number(),
+	value: RuleValueSchema
+});
+const RuleSchema = v.variant("type", [v.variant("target", [v.object({
+	id: v.string(),
+	type: v.literal("conditional"),
+	conditions: v.array(ConditionSchema),
+	target: v.literal("value"),
+	value: RuleValueSchema
+}), v.object({
+	id: v.string(),
+	type: v.literal("conditional"),
+	conditions: v.array(ConditionSchema),
+	target: v.literal("percentage"),
+	percentages: v.array(PercentageSchema)
+})]), v.object({
+	id: v.string(),
+	type: v.literal("percentage"),
+	percentages: v.array(PercentageSchema)
+})]);
+//#endregion
+//#region src/admin-api/config-with-targeting-rules.ts
+const TargetingRulesInEnvironmentSchema = v.object({
+	environment: v.object({
+		slug: v.string(),
+		live: v.boolean()
+	}),
+	rules: v.array(RuleSchema),
+	defaultValue: v.string()
+});
+const NumericBoundSchema = v.object({
+	relation: v.string(),
+	value: v.number()
+});
+const NumericBoundsSchema = v.object({
+	min: v.optional(NumericBoundSchema),
+	max: v.optional(NumericBoundSchema)
+});
+const EnumValuesSchema = v.object({
+	valueType: v.string(),
+	values: v.array(v.string())
+});
+const TimespanRangeSchema = v.object({
+	unit: v.string(),
+	allowFractions: v.nullish(v.boolean()),
+	min: v.number(),
+	max: v.number()
+});
+const ConstrainedTypeSchema = v.variant("type", [
+	v.object({
+		type: v.literal("integer"),
+		typeOptions: v.nullish(NumericBoundsSchema)
+	}),
+	v.object({
+		type: v.literal("float"),
+		typeOptions: v.nullish(NumericBoundsSchema)
+	}),
+	v.object({
+		type: v.literal("enum"),
+		typeOptions: EnumValuesSchema
+	}),
+	v.object({
+		type: v.literal("timespan"),
+		typeOptions: TimespanRangeSchema
+	}),
+	v.object({
+		type: v.literal("url"),
+		typeOptions: v.nullish(v.object({ secureOnly: v.nullish(v.boolean()) }))
+	}),
+	v.object({
+		type: v.literal("json"),
+		typeOptions: v.nullish(v.object({ useSchema: v.optional(v.boolean()) }))
+	})
+]);
+const CONSTRAINED_TYPE_NAMES = new Set(ConstrainedTypeSchema.options.map((option) => option.entries.type.literal));
+const ConfigTypeSchema = v.union([ConstrainedTypeSchema, v.object({ type: v.pipe(v.string(), v.notValues([...CONSTRAINED_TYPE_NAMES])) })]);
+const hasTypeConstraints = (configType) => CONSTRAINED_TYPE_NAMES.has(configType.type);
+const ConfigWithTargetingRulesSchema = v.intersect([v.object({
+	key: v.string(),
+	description: v.nullish(v.string()),
+	role: v.string(),
+	lifetime: v.string(),
+	state: v.string(),
+	client: v.boolean(),
+	server: v.boolean(),
+	tags: v.array(v.object({ name: v.string() })),
+	targets: v.array(TargetingRulesInEnvironmentSchema)
+}), ConfigTypeSchema]);
+//#endregion
+//#region src/old-key-lines.ts
+const oldKeyLines = (requestedKey, currentKey) => requestedKey === currentKey ? [] : [`${requestedKey} is an old key of ${currentKey}.`];
+//#endregion
+//#region src/rule-sentences.ts
+const TRAIT_POINTER_PREFIX = "/";
+const ATTRIBUTE_LABELS = {
+	identifier: "context identifier",
+	kind: "context kind",
+	name: "context name",
+	appName: "app name",
+	appVersion: "app version"
+};
+const formatPercentage = (value) => Number(value.toFixed(3)).toString();
+const subjectOf = (condition) => {
+	if (condition.attribute === "traits" && condition.trait != null) return condition.trait.startsWith(TRAIT_POINTER_PREFIX) ? condition.trait.slice(1) : condition.trait;
+	return ATTRIBUTE_LABELS[condition.attribute] ?? condition.attribute;
+};
+const segmentNameOf = (segmentId, segments) => segments[segmentId]?.name ?? segmentId;
+const describeAttributeCondition = (condition) => `${subjectOf(condition)} ${condition.operator} ${condition.targetValues.map(String).join(", ")}`;
+const describeConditionGroup = (group) => group.map(describeAttributeCondition).join(" and ");
+const describeCondition = (condition, segments) => {
+	switch (condition.kind) {
+		case "attribute": return describeAttributeCondition(condition);
+		case "segment": return `${condition.operator} segment ${segmentNameOf(condition.segmentId, segments)}`;
+	}
+};
+const describePercentages = (percentages) => percentages.map((percentage) => `${formatPercentage(percentage.percentage)}% get ${String(percentage.value)}`).join(", ");
+const describeRule = (rule, segments) => {
+	if (rule.type === "percentage") return describePercentages(rule.percentages);
+	return `${rule.conditions.map((condition) => describeCondition(condition, segments)).join(" and ")}: ${rule.target === "value" ? String(rule.value) : describePercentages(rule.percentages)}`;
+};
+//#endregion
+//#region src/configs/config-text.ts
+const boundsDescriptions = (bounds) => {
+	const limits = [bounds?.min, bounds?.max].flatMap((bound) => bound === void 0 ? [] : [`${bound.relation} ${bound.value}`]);
+	return limits.length === 0 ? [] : [limits.join(" and ")];
+};
+const enumValuesDescription = ({ valueType, values }) => valueType === "number" ? `one of the numbers ${values.join(", ")}` : `one of ${values.join(", ")}`;
+const timespanRangeDescriptions = (range) => [`${range.min} to ${range.max} ${range.unit}`, ...range.allowFractions ? ["fractions allowed"] : []];
+const typeConstraintDescriptions = (config) => {
+	if (!hasTypeConstraints(config)) return [];
+	switch (config.type) {
+		case "integer":
+		case "float": return boundsDescriptions(config.typeOptions);
+		case "enum": return [enumValuesDescription(config.typeOptions)];
+		case "timespan": return timespanRangeDescriptions(config.typeOptions);
+		case "url": return config.typeOptions?.secureOnly ? ["HTTPS only"] : [];
+		case "json": return config.typeOptions?.useSchema ? ["checked against a JSON schema"] : [];
+	}
+};
+const availabilityDescription = (config) => {
+	if (config.client && config.server) return "client and server SDKs";
+	if (config.client) return "client-only";
+	if (config.server) return "server-only";
+	return "served to no SDK";
+};
+const settingLines = (config) => [
+	...config.description ? [`Description: ${config.description}`] : [],
+	`Type: ${[config.type, ...typeConstraintDescriptions(config)].join(", ")}`,
+	`Role: ${config.role}`,
+	`Lifetime: ${config.lifetime}`,
+	`Availability: ${availabilityDescription(config)}`,
+	`Lifecycle state: ${config.state}`,
+	...config.tags.length === 0 ? [] : [`Tags: ${config.tags.map((tag) => tag.name).join(", ")}`]
+];
+const environmentHeading = (targetingRules) => targetingRules.environment.live ? `${targetingRules.environment.slug} (live)` : targetingRules.environment.slug;
+const targetingRuleLines = (targetingRules, segments) => [
+	environmentHeading(targetingRules),
+	...targetingRules.rules.map((rule, index) => `  ${index + 1}. ${describeRule(rule, segments)}`),
+	`  Default targeting rule: ${targetingRules.defaultValue}`
+];
+const configText = (config, requestedKey, segments) => [
+	...oldKeyLines(requestedKey, config.key),
+	config.key,
+	...settingLines(config).map((line) => `  ${line}`),
+	...config.targets.flatMap((targetingRules) => ["", ...targetingRuleLines(targetingRules, segments)]),
+	""
+].join("\n");
+//#endregion
+//#region src/file-contents.ts
+const readFileIfPresent = async (file) => {
+	try {
+		return await readFile(file, "utf8");
+	} catch (error) {
+		if (error.code === "ENOENT") return;
+		throw error;
+	}
+};
+const readOptionFile = async (argumentLabel, path, workingDirectory) => {
+	const file = resolve(workingDirectory, path);
+	const contents = await readFileIfPresent(file);
+	if (contents === void 0) throw new CliError(`${argumentLabel} names ${file}, which does not exist.`);
+	return {
+		file,
+		contents
+	};
+};
+const FILE_ARGUMENT_MARKER = "@";
+const atFileArgumentText = async (argumentLabel, argument, workingDirectory) => {
+	if (!argument.startsWith(FILE_ARGUMENT_MARKER)) return argument;
+	return (await readOptionFile(argumentLabel, argument.slice(1), workingDirectory)).contents;
+};
+const isJsonObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const parseJson = (contents) => {
+	try {
+		return JSON.parse(contents);
+	} catch {
+		return;
+	}
+};
+const pathExists = (path) => stat(path).then(() => true, () => false);
+const fileExists = (path) => stat(path).then((stats) => stats.isFile(), () => false);
+//#endregion
+//#region src/configs/new-config.ts
+const CONFIG_TYPES = [
+	"boolean",
+	"string",
+	"integer",
+	"float",
+	"timespan",
+	"enum",
+	"url",
+	"json"
+];
+const CONFIG_ROLES = [
+	"config",
+	"flag",
+	"kill-switch",
+	"experiment"
+];
+const CONFIG_LIFETIMES = ["permanent", "temporary"];
+const TIMESPAN_UNITS = [
+	"milliseconds",
+	"seconds",
+	"minutes"
+];
+const ENUM_VALUE_TYPES = ["string", "number"];
+const DEFAULT_ENUM_VALUE_TYPE = "string";
+const TYPE_CONSTRAINT_OPTION_NAMES = {
+	min: "--min",
+	max: "--max",
+	exclusiveMin: "--exclusive-min",
+	exclusiveMax: "--exclusive-max",
+	unit: "--unit",
+	allowFractions: "--allow-fractions",
+	allowedValue: "--allowed-value",
+	enumValueType: "--enum-value-type",
+	httpsOnly: "--https-only",
+	jsonSchema: "--json-schema"
+};
+const availabilityOf = (options) => {
+	if (options.clientOnly) return {
+		client: true,
+		server: false
+	};
+	if (options.serverOnly) return {
+		client: false,
+		server: true
+	};
+	return {
+		client: true,
+		server: true
+	};
+};
+const BOOLEAN_VALUES = new Map([["true", true], ["false", false]]);
+const numberOf = (text) => {
+	const value = parseJson(text);
+	return typeof value === "number" && Number.isFinite(value) ? value : void 0;
+};
+const constraintNumberOf = (options, option) => {
+	const text = options[option];
+	if (text === void 0) return;
+	const value = numberOf(text);
+	if (value === void 0) throw new CliError(`${TYPE_CONSTRAINT_OPTION_NAMES[option]} takes a number, not ${text}.`);
+	return value;
+};
+const boundOf = (options, option, relation) => {
+	const value = constraintNumberOf(options, option);
+	return value === void 0 ? void 0 : {
+		relation,
+		value
+	};
+};
+const numericBoundsOf = (options) => ({
+	min: boundOf(options, "min", ">=") ?? boundOf(options, "exclusiveMin", ">"),
+	max: boundOf(options, "max", "<=") ?? boundOf(options, "exclusiveMax", "<")
+});
+const jsonTextOf = async ({ argumentLabel, text, workingDirectory }) => {
+	const jsonText = (await atFileArgumentText(argumentLabel, text, workingDirectory)).trim();
+	return parseJson(jsonText) === void 0 ? void 0 : jsonText;
+};
+const jsonSchemaOptionsOf = async (options, workingDirectory) => {
+	if (options.jsonSchema === void 0) return;
+	const { file, contents } = await readOptionFile(TYPE_CONSTRAINT_OPTION_NAMES.jsonSchema, options.jsonSchema, workingDirectory);
+	const schema = parseJson(contents);
+	if (schema === void 0) throw new CliError(`${TYPE_CONSTRAINT_OPTION_NAMES.jsonSchema} names ${file}, which is not JSON.`);
+	return {
+		useSchema: true,
+		schema
+	};
+};
+const timespanRangeOf = async (options) => {
+	if (options.unit === void 0 || options.min === void 0 || options.max === void 0) throw new CliError("--type timespan needs --unit, --min and --max.");
+	return {
+		unit: options.unit,
+		min: constraintNumberOf(options, "min"),
+		max: constraintNumberOf(options, "max"),
+		allowFractions: options.allowFractions
+	};
+};
+const NUMERIC_BOUND_OPTIONS = [
+	"min",
+	"max",
+	"exclusiveMin",
+	"exclusiveMax"
+];
+const CONFIG_TYPE_RULES = {
+	boolean: {
+		constraintOptions: [],
+		valueDescription: "true or false",
+		valueOf: async ({ text }) => BOOLEAN_VALUES.get(text),
+		typeOptionsOf: async () => void 0
+	},
+	string: {
+		constraintOptions: [],
+		valueDescription: "text",
+		valueOf: async ({ text }) => text,
+		typeOptionsOf: async () => void 0
+	},
+	integer: {
+		constraintOptions: NUMERIC_BOUND_OPTIONS,
+		valueDescription: "a number",
+		valueOf: async ({ text }) => numberOf(text),
+		typeOptionsOf: async (options) => ({
+			isInteger: true,
+			...numericBoundsOf(options)
+		})
+	},
+	float: {
+		constraintOptions: NUMERIC_BOUND_OPTIONS,
+		valueDescription: "a number",
+		valueOf: async ({ text }) => numberOf(text),
+		typeOptionsOf: async (options) => ({
+			isInteger: false,
+			...numericBoundsOf(options)
+		})
+	},
+	timespan: {
+		constraintOptions: [
+			"min",
+			"max",
+			"unit",
+			"allowFractions"
+		],
+		valueDescription: "a number",
+		valueOf: async ({ text }) => numberOf(text),
+		typeOptionsOf: timespanRangeOf
+	},
+	enum: {
+		constraintOptions: ["allowedValue", "enumValueType"],
+		valueDescription: "text",
+		valueOf: async ({ text }) => text,
+		typeOptionsOf: async (options) => ({
+			values: options.allowedValue ?? [],
+			valueType: options.enumValueType ?? DEFAULT_ENUM_VALUE_TYPE
+		})
+	},
+	url: {
+		constraintOptions: ["httpsOnly"],
+		valueDescription: "text",
+		valueOf: async ({ text }) => text,
+		typeOptionsOf: async (options) => ({ secureOnly: options.httpsOnly === true })
+	},
+	json: {
+		constraintOptions: ["jsonSchema"],
+		valueDescription: "JSON or @<file>",
+		valueOf: jsonTextOf,
+		typeOptionsOf: jsonSchemaOptionsOf
+	}
+};
+const typeAlternatives = (types) => types.length === 1 ? `${types[0]}` : `${types.slice(0, -1).join(", ")} or ${types.at(-1)}`;
+const typesTaking = (option) => CONFIG_TYPES.filter((type) => CONFIG_TYPE_RULES[type].constraintOptions.includes(option));
+const typeConstraintHelpGroup = (option) => `Options for --type ${typeAlternatives(typesTaking(option))}:`;
+const TYPE_CONSTRAINT_OPTIONS = Object.keys(TYPE_CONSTRAINT_OPTION_NAMES);
+const rejectOptionsOfOtherTypes = (options) => {
+	const { constraintOptions } = CONFIG_TYPE_RULES[options.type];
+	const otherTypeOption = TYPE_CONSTRAINT_OPTIONS.find((option) => options[option] !== void 0 && !constraintOptions.includes(option));
+	if (otherTypeOption !== void 0) throw new CliError(`${TYPE_CONSTRAINT_OPTION_NAMES[otherTypeOption]} cannot be used with --type ${options.type}. It applies to --type ${typeAlternatives(typesTaking(otherTypeOption))}.`);
+};
+const typedValueOf = async (type, argument) => {
+	const rules = CONFIG_TYPE_RULES[type];
+	const value = await rules.valueOf(argument);
+	if (value === void 0) throw new CliError(`${argument.argumentLabel} takes ${rules.valueDescription} with --type ${type}, not ${argument.text}.`);
+	return value;
+};
+const VARIATION_SEPARATOR = "=";
+const variationOf = async (type, variation, workingDirectory) => {
+	const separatorIndex = variation.indexOf(VARIATION_SEPARATOR);
+	const name = variation.slice(0, separatorIndex);
+	if (separatorIndex === -1 || name === "") throw new CliError(`--variation takes name=value, not ${variation}.`);
+	const text = variation.slice(separatorIndex + 1);
+	return {
+		name,
+		value: await typedValueOf(type, {
+			argumentLabel: `--variation ${name}`,
+			text,
+			workingDirectory
+		})
+	};
+};
+const variationsOf = async (options, workingDirectory) => {
+	const variations = [];
+	for (const variation of options.variation ?? []) variations.push(await variationOf(options.type, variation, workingDirectory));
+	return variations;
+};
+const newConfigOf = async (options, workingDirectory) => {
+	rejectOptionsOfOtherTypes(options);
+	return {
+		key: options.key,
+		description: options.description,
+		role: options.role,
+		lifetime: options.lifetime,
+		type: options.type,
+		typeOptions: await CONFIG_TYPE_RULES[options.type].typeOptionsOf(options, workingDirectory),
+		...availabilityOf(options),
+		variations: await variationsOf(options, workingDirectory),
+		defaultValue: await typedValueOf(options.type, {
+			argumentLabel: "--default-value",
+			text: options.defaultValue,
+			workingDirectory
+		})
+	};
+};
+//#endregion
+//#region src/admin-api/config-creation.ts
+const CreatedConfigSchema = v.object({
+	key: v.string(),
+	type: v.string(),
+	role: v.string(),
+	lifetime: v.string(),
+	client: v.boolean(),
+	server: v.boolean()
+});
+//#endregion
+//#region src/admin-api/scanned-repositories.ts
+const scannedRepositoryFields = {
+	name: v.string(),
+	commit: v.pipe(v.string(), v.transform((commit) => commit === "" ? null : commit)),
+	referenceCount: v.number(),
+	dynamicReferenceCount: v.number()
+};
+const ScannedRepositorySchema = v.object(scannedRepositoryFields);
+const ListedScannedRepositorySchema = v.object({
+	...scannedRepositoryFields,
+	scannedAt: v.pipe(v.string(), v.isoTimestamp())
+});
+//#endregion
+//#region src/admin-api/segments.ts
+const SegmentSchema = v.object({
+	id: v.string(),
+	key: v.string(),
+	name: v.string(),
+	usages: v.array(v.unknown())
+});
+const SegmentDefinitionSchema = v.object({
+	key: v.string(),
+	name: v.string(),
+	groups: v.array(ConditionGroupSchema),
+	overrides: v.record(v.string(), v.array(ConditionGroupSchema))
+});
+//#endregion
+//#region src/admin-api/targeting-rules-reference.ts
+const TargetingRulesReferenceSchema = v.object({
+	notes: v.array(v.string()),
+	conditionKinds: v.array(v.string()),
+	conditionAttributes: v.array(v.string()),
+	contextKindOperators: v.array(v.string()),
+	segmentOperators: v.array(v.string()),
+	operatorsByTargetType: v.record(v.string(), v.array(v.string()))
+});
+//#endregion
+//#region src/admin-api/config-evaluation.ts
+const CheckedOutcomeSchema = v.picklist(["matched", "not-matched"]);
+const AttributeConditionExplanationSchema = v.object({
+	conditionId: v.string(),
+	kind: v.literal("attribute"),
+	outcome: CheckedOutcomeSchema,
+	resolvedValue: v.optional(v.unknown()),
+	resolvedType: v.picklist([
+		"absent",
+		"scalar",
+		"array",
+		"object",
+		"unknown-attribute"
+	])
+});
+const SegmentConditionExplanationSchema = v.object({
+	conditionId: v.string(),
+	kind: v.literal("segment"),
+	outcome: CheckedOutcomeSchema,
+	segmentId: v.string(),
+	segmentFound: v.boolean(),
+	matchedGroupIndex: v.optional(v.number())
+});
+const ConditionExplanationSchema = v.union([
+	v.object({
+		conditionId: v.string(),
+		outcome: v.literal("not-evaluated")
+	}),
+	AttributeConditionExplanationSchema,
+	SegmentConditionExplanationSchema
+]);
+const BucketSchema = v.object({
+	defaultedToPredefinedBucket: v.boolean(),
+	assignedPercentage: v.number(),
+	shares: v.array(v.object({
+		percentageId: v.string(),
+		from: v.number(),
+		to: v.number()
+	})),
+	selectedPercentageId: v.optional(v.string())
+});
+const RuleExplanationSchema = v.object({
+	ruleId: v.string(),
+	outcome: v.picklist([
+		"matched",
+		"not-matched",
+		"not-evaluated",
+		"errored"
+	]),
+	conditions: v.array(ConditionExplanationSchema),
+	bucket: v.optional(BucketSchema)
+});
+const ConfigEvaluationSchema = v.object({
+	key: v.string(),
+	environment: v.object({ name: v.string() }),
+	context: v.nullable(v.object({
+		kind: v.string(),
+		identifier: v.nullable(v.string())
+	})),
+	value: v.optional(v.string()),
+	servedBy: v.variant("kind", [v.object({
+		kind: v.literal("rule"),
+		ruleId: v.string()
+	}), v.object({ kind: v.literal("default") })]),
+	rules: v.array(RuleExplanationSchema),
+	targetingRules: v.object({
+		rules: v.array(RuleSchema),
+		defaultValue: v.string()
+	}),
+	segments: v.record(v.string(), v.object({ name: v.string() }))
+});
+//#endregion
 //#region src/admin-api/AdminApiClient.ts
 const ProjectSchema = v.object({
 	id: v.string(),
@@ -75,6 +682,9 @@ const ProjectSchema = v.object({
 const configFields = {
 	key: v.string(),
 	deprecatedKeys: v.array(v.object({ key: v.string() })),
+	role: v.string(),
+	lifetime: v.string(),
+	state: v.string(),
 	client: v.boolean(),
 	server: v.boolean()
 };
@@ -91,6 +701,28 @@ const ConfigSchema = v.variant("type", [EnumConfigSchema, v.object({
 	type: v.pipe(v.string(), v.notValue("enum"))
 })]);
 const isEnumConfig = (config) => config.type === "enum";
+const EnvironmentSchema = v.object({
+	id: v.string(),
+	slug: v.string(),
+	name: v.string(),
+	live: v.boolean()
+});
+const ConfigActivitySchema = v.object({ latestEvaluations: v.array(v.object({
+	environment: v.object({ slug: v.string() }),
+	source: v.string(),
+	sdkName: v.nullable(v.string()),
+	sdkVersion: v.nullable(v.string()),
+	time: v.pipe(v.string(), v.isoTimestamp())
+})) });
+const TagSchema = v.object({ id: v.string() });
+const tagFilterQuery = (tagFilter) => {
+	switch (tagFilter.form) {
+		case "every-config": return "";
+		case "tagged": return `?${new URLSearchParams(tagFilter.tagIds.map((tagId) => ["tagIds", tagId]))}`;
+		case "untagged": return "?untagged=true";
+	}
+};
+const MissingResourceBodySchema = v.strictObject({});
 const readJsonBody = async (response) => {
 	try {
 		return await response.json();
@@ -102,6 +734,7 @@ const describeStatus = (response) => `HTTP ${response.status}`;
 const failureFor = (url, response, body) => {
 	switch (response.status) {
 		case 400: {
+			if (v.is(RepositoryLimitReachedBodySchema, body)) return new RepositoryLimitReachedError();
 			const validationError = v.safeParse(ApiValidationErrorBodySchema, body);
 			return validationError.success ? new ApiValidationError(validationError.output.errors) : new UnexpectedApiResponseError(url, describeStatus(response));
 		}
@@ -109,6 +742,10 @@ const failureFor = (url, response, body) => {
 			const authorizationError = v.safeParse(ApiAuthorizationErrorBodySchema, body);
 			return authorizationError.success ? new ApiAuthorizationError(authorizationError.output.code, authorizationError.output.error) : new UnexpectedApiResponseError(url, describeStatus(response));
 		}
+		case 404: {
+			const notFoundError = v.safeParse(EvaluationNotFoundBodySchema, body);
+			return notFoundError.success ? new EvaluationNotFoundError(notFoundError.output.code, notFoundError.output.error) : new UnexpectedApiResponseError(url, describeStatus(response));
+		}
 		case 429: {
 			const retryAfterSeconds = response.headers.get("retry-after");
 			return v.is(ServiceSuspendedBodySchema, body) && retryAfterSeconds !== null ? new ServiceSuspendedError(retryAfterSeconds) : new UnexpectedApiResponseError(url, describeStatus(response));
@@ -116,6 +753,16 @@ const failureFor = (url, response, body) => {
 		default: return new UnexpectedApiResponseError(url, describeStatus(response));
 	}
 };
+const isMissingResource = (received) => received.response.status === 404 && v.is(MissingResourceBodySchema, received.body);
+const parsedResponseOf = ({ url, response, body }, schema) => {
+	if (!response.ok) throw failureFor(url, response, body);
+	const parsedBody = v.safeParse(schema, body);
+	if (!parsedBody.success) throw new UnexpectedApiResponseError(url, `an ${describeStatus(response)} response the CLI cannot read`);
+	return {
+		responseBody: body,
+		parsedBody: parsedBody.output
+	};
+};
 var AdminApiClient = class {
 	constructor(connection) {
 		this.connection = connection;
@@ -123,51 +770,119 @@ var AdminApiClient = class {
 	listProjects() {
 		return this.get("/v1/projects", v.array(ProjectSchema));
 	}
-	listConfigs(projectId) {
-		return this.get(`/v1/projects/${encodeURIComponent(projectId)}/configs`, v.array(ConfigSchema));
+	async listConfigs(projectId, tagFilter) {
+		const { parsedBody: configs, responseBody } = await this.get(`/v1/projects/${encodeURIComponent(projectId)}/configs${tagFilterQuery(tagFilter)}`, v.array(ConfigSchema));
+		const receivedConfigs = v.parse(v.array(v.unknown()), responseBody);
+		return configs.map((config, index) => ({
+			config,
+			receivedConfig: receivedConfigs[index]
+		}));
+	}
+	listEnvironments(projectId) {
+		return this.get(`/v1/projects/${encodeURIComponent(projectId)}/environments`, v.array(EnvironmentSchema));
+	}
+	getConfig(projectId, configKey) {
+		return this.getIfFound(`/v1/projects/${encodeURIComponent(projectId)}/configs/${encodeURIComponent(configKey)}`, ConfigWithTargetingRulesSchema);
+	}
+	getConfigActivity(projectId, configKey) {
+		return this.getIfFound(`/v1/projects/${encodeURIComponent(projectId)}/configs/${encodeURIComponent(configKey)}/activity`, ConfigActivitySchema);
+	}
+	listSegments(projectId) {
+		return this.get(`/v1/projects/${encodeURIComponent(projectId)}/segments`, v.array(SegmentSchema));
+	}
+	getSegment(projectId, segmentKey) {
+		return this.getIfFound(`/v1/projects/${encodeURIComponent(projectId)}/segments/${encodeURIComponent(segmentKey)}`, SegmentDefinitionSchema);
+	}
+	async findTagByName(projectId, name) {
+		return (await this.getIfFound(`/v1/projects/${encodeURIComponent(projectId)}/tags/by-name?${new URLSearchParams({ name })}`, TagSchema))?.parsedBody;
+	}
+	createConfig(projectId, request) {
+		return this.requestJson(`/v1/projects/${encodeURIComponent(projectId)}/configs`, CreatedConfigSchema, {
+			method: "POST",
+			body: request
+		});
+	}
+	async evaluateConfig(projectId, configKey, request) {
+		const { responseBody, parsedBody } = await this.requestJson(`/v1/projects/${encodeURIComponent(projectId)}/configs/${encodeURIComponent(configKey)}/evaluate`, ConfigEvaluationSchema, {
+			method: "POST",
+			body: request
+		});
+		return {
+			evaluation: parsedBody,
+			responseBody
+		};
+	}
+	getTargetingRulesReference() {
+		return this.get("/v1/targeting-rules-reference", TargetingRulesReferenceSchema);
+	}
+	async replaceTargetingRules(projectId, configKey, request) {
+		return await this.requestIfFound(`/v1/projects/${encodeURIComponent(projectId)}/configs/${encodeURIComponent(configKey)}/targets`, v.unknown(), {
+			method: "PUT",
+			body: request
+		}) === void 0 ? "not-found" : "replaced";
 	}
-	async get(path, schema) {
+	uploadRepositoryScan(projectId, repositoryName, upload) {
+		return this.requestJson(`/v1/projects/${encodeURIComponent(projectId)}/repositories/${encodeURIComponent(repositoryName)}`, ScannedRepositorySchema, {
+			method: "PUT",
+			body: upload
+		});
+	}
+	listScannedRepositories(projectId) {
+		return this.get(`/v1/projects/${encodeURIComponent(projectId)}/repositories`, v.array(ListedScannedRepositorySchema));
+	}
+	async removeScannedRepository(projectId, repositoryName) {
+		return await this.requestIfFound(`/v1/projects/${encodeURIComponent(projectId)}/repositories/${encodeURIComponent(repositoryName)}`, v.unknown(), { method: "DELETE" }) === void 0 ? "not-found" : "removed";
+	}
+	async archiveConfig(projectId, configKey) {
+		return await this.requestIfFound(`/v1/projects/${encodeURIComponent(projectId)}/configs/${encodeURIComponent(configKey)}`, v.unknown(), { method: "DELETE" }) === void 0 ? "not-found" : "archived";
+	}
+	get(path, schema) {
+		return this.requestJson(path, schema, { method: "GET" });
+	}
+	getIfFound(path, schema) {
+		return this.requestIfFound(path, schema, { method: "GET" });
+	}
+	async requestIfFound(path, schema, request) {
+		const received = await this.send(path, request);
+		return isMissingResource(received) ? void 0 : parsedResponseOf(received, schema);
+	}
+	async requestJson(path, schema, request) {
+		return parsedResponseOf(await this.send(path, request), schema);
+	}
+	async send(path, request) {
 		const url = `${this.connection.baseUrl}${path}`;
-		const response = await this.fetchResponse(url);
-		const body = await readJsonBody(response);
-		if (!response.ok) throw failureFor(url, response, body);
-		const parsedBody = v.safeParse(schema, body);
-		if (!parsedBody.success) throw new UnexpectedApiResponseError(url, `an ${describeStatus(response)} response the CLI cannot read`);
-		return parsedBody.output;
-	}
-	async fetchResponse(url) {
+		const response = await this.fetchResponse(url, request);
+		return {
+			url,
+			response,
+			body: await readJsonBody(response)
+		};
+	}
+	async fetchResponse(url, request) {
+		const headers = {
+			Accept: "application/json",
+			Authorization: `Bearer ${this.connection.token}`,
+			"User-Agent": `configdirector-cli/${version}`,
+			"X-SourceClient": "cli"
+		};
 		try {
-			return await fetch(url, { headers: {
-				Accept: "application/json",
-				Authorization: `Bearer ${this.connection.token}`,
-				"User-Agent": `configdirector-cli/${version}`,
-				"X-SourceClient": "cli"
-			} });
+			return await fetch(url, "body" in request ? {
+				method: request.method,
+				headers: {
+					...headers,
+					"Content-Type": "application/json"
+				},
+				body: JSON.stringify(request.body)
+			} : {
+				method: request.method,
+				headers
+			});
 		} catch (error) {
 			throw new ApiUnreachableError(this.connection.baseUrl, error);
 		}
 	}
 };
 //#endregion
-//#region src/file-contents.ts
-const readFileIfPresent = async (file) => {
-	try {
-		return await readFile(file, "utf8");
-	} catch (error) {
-		if (error.code === "ENOENT") return;
-		throw error;
-	}
-};
-const parseJson = (contents) => {
-	try {
-		return JSON.parse(contents);
-	} catch {
-		return;
-	}
-};
-const pathExists = (path) => stat(path).then(() => true, () => false);
-const fileExists = (path) => stat(path).then((stats) => stats.isFile(), () => false);
-//#endregion
 //#region src/saved-api-token.ts
 const SavedApiTokenSchema = v.object({ token: v.string() });
 const platformConfigDirectory = (invocation) => {
@@ -210,22 +925,6 @@ const configuredApiToken = async (context) => {
 	return token;
 };
 //#endregion
-//#region src/project-selection.ts
-const requireProjectSlug = (context) => {
-	if (context.projectSlug === void 0) throw new CliError("Name the project with --project <slug> or CONFIGDIRECTOR_PROJECT.");
-	return context.projectSlug;
-};
-const requireLinkedProjectSlug = (context, settings) => {
-	const slug = context.projectSlug ?? settings?.project;
-	if (slug === void 0) throw new CliError("Name the project with --project <slug>, CONFIGDIRECTOR_PROJECT, or `project` in configdirector.json, which `configdirector init` writes.");
-	return slug;
-};
-const findProjectBySlug = async (client, slug) => {
-	const project = (await client.listProjects()).find((listedProject) => listedProject.slug === slug);
-	if (project === void 0) throw new CliError(`No project in the API token's organization has the slug "${slug}".`);
-	return project;
-};
-//#endregion
 //#region src/project-settings.ts
 const ProjectSettingsSchema = v.object({
 	project: v.optional(v.string()),
@@ -247,6 +946,406 @@ const readProjectSettings = async (workingDirectory) => {
 	return settings.output;
 };
 //#endregion
+//#region src/project-selection.ts
+const requireProjectSlug = (context) => {
+	if (context.projectSlug === void 0) throw new CliError("Name the project with --project <slug> or CONFIGDIRECTOR_PROJECT.");
+	return context.projectSlug;
+};
+const requireLinkedProjectSlug = (context, settings) => {
+	const slug = context.projectSlug ?? settings?.project;
+	if (slug === void 0) throw new CliError("Name the project with --project <slug>, CONFIGDIRECTOR_PROJECT, or `project` in configdirector.json, which `configdirector init` writes.");
+	return slug;
+};
+const findProjectBySlug = async (client, slug) => {
+	const { parsedBody: projects } = await client.listProjects();
+	const project = projects.find((listedProject) => listedProject.slug === slug);
+	if (project === void 0) throw new CliError(`No project in the API token's organization has the slug "${slug}".`);
+	return project;
+};
+const connectToLinkedProject = async (context) => {
+	const projectSlug = requireLinkedProjectSlug(context, await readProjectSettings(context.invocation.workingDirectory));
+	const client = new AdminApiClient({
+		baseUrl: context.baseUrl,
+		token: await configuredApiToken(context)
+	});
+	return {
+		client,
+		project: await findProjectBySlug(client, projectSlug)
+	};
+};
+//#endregion
+//#region src/utc-minute.ts
+const utcMinute = (time) => {
+	const isoTime = new Date(time).toISOString();
+	return `${isoTime.slice(0, 10)} ${isoTime.slice(11, 16)} UTC`;
+};
+//#endregion
+//#region src/commands/configs.ts
+const LIFECYCLE_STATES = [
+	"new",
+	"in-use",
+	"settled",
+	"archive-ready",
+	"stale"
+];
+const tagIdNamed = async (client, project, name) => {
+	const tag = await client.findTagByName(project.id, name);
+	if (tag === void 0) throw new CliError(`No tag in ${project.slug} has the name "${name}".`);
+	return tag.id;
+};
+const tagIdsNamed = async (client, project, names) => {
+	const tagIds = [];
+	for (const name of names) tagIds.push(await tagIdNamed(client, project, name));
+	return tagIds;
+};
+const tagFilterOf = async (client, project, options) => {
+	if (options.untagged) return { form: "untagged" };
+	if (options.tag === void 0) return { form: "every-config" };
+	return {
+		form: "tagged",
+		tagIds: await tagIdsNamed(client, project, options.tag)
+	};
+};
+const configsInState = (listedConfigs, state) => state === void 0 ? listedConfigs : listedConfigs.filter((listedConfig) => listedConfig.config.state === state);
+const summaryColumnsOf = (config) => [
+	config.key,
+	config.type,
+	config.role,
+	config.lifetime,
+	config.state
+];
+const configLines = (projectSlug, configs) => configs.length === 0 ? [`No configs found in ${projectSlug}.`] : alignedColumns(configs.map(summaryColumnsOf));
+const listConfigs = async (context, _commandArguments, options) => {
+	const { client, project } = await connectToLinkedProject(context);
+	const listedConfigs = configsInState(await client.listConfigs(project.id, await tagFilterOf(client, project, options)), options.state);
+	return {
+		json: listedConfigs.map((listedConfig) => listedConfig.receivedConfig),
+		text: [...configLines(project.slug, listedConfigs.map((listedConfig) => listedConfig.config)), ""].join("\n"),
+		exitCode: ExitCode.success
+	};
+};
+const referencesSegments = (config) => config.targets.some((targetingRules) => targetingRules.rules.some((rule) => rule.type === "conditional" && rule.conditions.some((condition) => condition.kind === "segment")));
+const segmentNamesFor = async (client, project, config) => {
+	if (!referencesSegments(config)) return {};
+	const segments = await ifPermitted(client.listSegments(project.id));
+	return Object.fromEntries((segments?.parsedBody ?? []).map((segment) => [segment.id, segment]));
+};
+const getConfig = async (context, [configKey]) => {
+	const { client, project } = await connectToLinkedProject(context);
+	const receivedConfig = await client.getConfig(project.id, configKey);
+	if (receivedConfig === void 0) throw new CliError(`No config in ${project.slug} has the key "${configKey}".`);
+	const { parsedBody: config, responseBody } = receivedConfig;
+	return {
+		json: responseBody,
+		text: configText(config, configKey, await segmentNamesFor(client, project, config)),
+		exitCode: ExitCode.success
+	};
+};
+const createdConfigLines = (projectSlug, createdConfig, newConfig) => {
+	const settings = [
+		createdConfig.type,
+		createdConfig.role,
+		createdConfig.lifetime,
+		availabilityDescription(createdConfig)
+	];
+	return [`Created ${createdConfig.key} in ${projectSlug}: ${settings.join(", ")}.`, `Default targeting rule in every environment: ${String(newConfig.defaultValue)}`];
+};
+const keyTakenLines = (projectSlug, configKey, existingConfig) => [`${projectSlug} already has a config with the key ${configKey}, so no config was created:`, ...alignedColumns([summaryColumnsOf(existingConfig)])];
+const rejectsKey = (error) => error instanceof ApiValidationError && error.fieldErrors.some((fieldError) => fieldError.name === "key");
+const requestCreation = async (client, project, request) => {
+	try {
+		const { parsedBody: createdConfig, responseBody } = await client.createConfig(project.id, request);
+		return {
+			outcome: "created",
+			createdConfig,
+			responseBody
+		};
+	} catch (error) {
+		if (!rejectsKey(error)) throw error;
+		const existingConfig = await client.getConfig(project.id, request.key);
+		if (existingConfig === void 0) throw error;
+		return {
+			outcome: "key-taken",
+			existingConfig: existingConfig.parsedBody,
+			responseBody: existingConfig.responseBody
+		};
+	}
+};
+const creationOutput = (project, newConfig, creation) => {
+	switch (creation.outcome) {
+		case "created": return {
+			json: creation.responseBody,
+			text: [...createdConfigLines(project.slug, creation.createdConfig, newConfig), ""].join("\n"),
+			exitCode: ExitCode.success
+		};
+		case "key-taken": return {
+			json: creation.responseBody,
+			text: [...keyTakenLines(project.slug, newConfig.key, creation.existingConfig), ""].join("\n"),
+			exitCode: ExitCode.problemsFound
+		};
+	}
+};
+const createConfig = async (context, _commandArguments, options) => {
+	const newConfig = await newConfigOf(options, context.invocation.workingDirectory);
+	const { client, project } = await connectToLinkedProject(context);
+	return creationOutput(project, newConfig, await requestCreation(client, project, {
+		...newConfig,
+		tagIds: await tagIdsNamed(client, project, options.tag ?? [])
+	}));
+};
+const archiveConfig = async (context, [configKey]) => {
+	const { client, project } = await connectToLinkedProject(context);
+	if (await client.archiveConfig(project.id, configKey) === "not-found") throw new CliError(`No config in ${project.slug} has the key "${configKey}".`);
+	return {
+		json: { archivedConfigKey: configKey },
+		text: [`Archived ${configKey} in ${project.slug}. It can be restored from the dashboard for 30 days.`, ""].join("\n"),
+		exitCode: ExitCode.success
+	};
+};
+const sdkDescription = (evaluation) => [evaluation.sdkName ?? "unknown SDK", ...evaluation.sdkVersion === null ? [] : [evaluation.sdkVersion]].join(" ");
+const activityLines = (configKey, activity) => activity.latestEvaluations.length === 0 ? [`No SDK evaluations of ${configKey} found.`] : alignedColumns(activity.latestEvaluations.map((evaluation) => [
+	evaluation.environment.slug,
+	evaluation.source,
+	sdkDescription(evaluation),
+	utcMinute(evaluation.time)
+]));
+const showConfigActivity = async (context, [configKey]) => {
+	const { client, project } = await connectToLinkedProject(context);
+	const receivedActivity = await client.getConfigActivity(project.id, configKey);
+	if (receivedActivity === void 0) throw new CliError(`No config in ${project.slug} has the key "${configKey}".`);
+	return {
+		json: receivedActivity.responseBody,
+		text: [...activityLines(configKey, receivedActivity.parsedBody), ""].join("\n"),
+		exitCode: ExitCode.success
+	};
+};
+//#endregion
+//#region src/commands/environments.ts
+const environmentColumns = (environment) => environment.live ? [
+	environment.slug,
+	environment.name,
+	"live"
+] : [environment.slug, environment.name];
+const environmentLines = (projectSlug, environments) => environments.length === 0 ? [`No environments found in ${projectSlug}.`] : alignedColumns(environments.map(environmentColumns));
+const listEnvironments = async (context) => {
+	const { client, project } = await connectToLinkedProject(context);
+	const { parsedBody: environments, responseBody } = await client.listEnvironments(project.id);
+	return {
+		json: responseBody,
+		text: [...environmentLines(project.slug, environments), ""].join("\n"),
+		exitCode: ExitCode.success
+	};
+};
+//#endregion
+//#region src/environment-selection.ts
+const environmentSlugsSentence = (environments) => environments.length === 0 ? "The project has no environments." : `Its environments are ${environments.map((environment) => environment.slug).join(", ")}.`;
+const findEnvironmentBySlug = async (client, project, slug) => {
+	const { parsedBody: environments } = await client.listEnvironments(project.id);
+	const environment = environments.find((listedEnvironment) => listedEnvironment.slug === slug);
+	if (environment === void 0) throw new CliError(`No environment in ${project.slug} has the slug "${slug}". ${environmentSlugsSentence(environments)}`);
+	return environment;
+};
+//#endregion
+//#region src/evaluate/context-form.ts
+const DEFAULT_CONTEXT_KIND = "user";
+const TYPED_TRAIT_MARKER = ":";
+const traitUsageError = (trait) => new CliError(`--context-trait ${trait} is not a trait. Write name=value for a string, or name:=<json> for a typed value, as in plan=pro or beta:=true.`);
+const parseTraitJson = (trait, json) => {
+	try {
+		return JSON.parse(json);
+	} catch {
+		throw new CliError(`--context-trait ${trait} has a value after := that is not JSON. Write name=value for a string.`);
+	}
+};
+const traitEntryOf = (trait) => {
+	const separatorIndex = trait.indexOf("=");
+	if (separatorIndex === -1) throw traitUsageError(trait);
+	const isTyped = trait[separatorIndex - 1] === TYPED_TRAIT_MARKER;
+	const name = trait.slice(0, isTyped ? separatorIndex - 1 : separatorIndex);
+	if (name === "") throw traitUsageError(trait);
+	const value = trait.slice(separatorIndex + 1);
+	return [name, isTyped ? parseTraitJson(trait, value) : value];
+};
+const contextJsonUsageError = () => new CliError("--context-json takes the context as a JSON object, as in {\"kind\":\"user\",\"identifier\":\"123\"}, or @<file>.");
+const contextOfJson = async (contextJson, workingDirectory) => {
+	const context = parseJson(await atFileArgumentText("--context-json", contextJson, workingDirectory));
+	if (!isJsonObject(context)) throw contextJsonUsageError();
+	return context;
+};
+const inlineContextOf = (options) => ({
+	kind: options.contextKind ?? DEFAULT_CONTEXT_KIND,
+	identifier: options.contextId,
+	name: options.contextName,
+	traits: options.contextTrait === void 0 ? void 0 : Object.fromEntries(options.contextTrait.map(traitEntryOf))
+});
+const SAVED_CONTEXT_SEPARATOR = ":";
+const savedContextReferenceOf = (savedContext) => {
+	const separatorIndex = savedContext.indexOf(SAVED_CONTEXT_SEPARATOR);
+	const kind = savedContext.slice(0, separatorIndex);
+	const identifier = savedContext.slice(separatorIndex + 1);
+	if (separatorIndex === -1 || kind === "" || identifier === "") throw new CliError(`--saved-context takes <kind>:<identifier>, as in user:123, not ${savedContext}.`);
+	return {
+		kind,
+		identifier
+	};
+};
+const givenInlineOptionNames = (options) => [
+	...options.contextKind === void 0 ? [] : ["--context-kind"],
+	...options.contextId === void 0 ? [] : ["--context-id"],
+	...options.contextName === void 0 ? [] : ["--context-name"],
+	...options.contextTrait === void 0 ? [] : ["--context-trait"]
+];
+const givenContextDoors = (options) => {
+	const { savedContext, contextJson } = options;
+	const inlineOptionNames = givenInlineOptionNames(options);
+	return [
+		...savedContext === void 0 ? [] : [{
+			optionNames: ["--saved-context"],
+			contextForm: async () => ({
+				form: "saved",
+				reference: savedContextReferenceOf(savedContext)
+			})
+		}],
+		...contextJson === void 0 ? [] : [{
+			optionNames: ["--context-json"],
+			contextForm: async (workingDirectory) => ({
+				form: "inline",
+				context: await contextOfJson(contextJson, workingDirectory)
+			})
+		}],
+		...inlineOptionNames.length === 0 ? [] : [{
+			optionNames: inlineOptionNames,
+			contextForm: async () => ({
+				form: "inline",
+				context: inlineContextOf(options)
+			})
+		}]
+	];
+};
+const contextFormOf = async (options, workingDirectory) => {
+	const [door, ...otherDoors] = givenContextDoors(options);
+	if (door === void 0) return { form: "empty" };
+	if (otherDoors.length > 0) throw new CliError(`${door.optionNames.join(", ")} cannot be combined with ${otherDoors.flatMap((otherDoor) => otherDoor.optionNames).join(", ")}. Give the context one way: --saved-context, --context-json, or the --context-kind, --context-id, --context-name and --context-trait options.`);
+	return door.contextForm(workingDirectory);
+};
+//#endregion
+//#region src/evaluate/evaluation-text.ts
+const RESOLVED_VALUE_DESCRIPTIONS = {
+	absent: () => "absent",
+	"unknown-attribute": () => "unknown to the evaluator",
+	scalar: (resolvedValue) => JSON.stringify(resolvedValue),
+	array: (resolvedValue) => JSON.stringify(resolvedValue),
+	object: (resolvedValue) => JSON.stringify(resolvedValue)
+};
+const contextDescription = (evaluation, contextForm) => {
+	const evaluatedContext = evaluation.context;
+	if (evaluatedContext === null) return "an empty context";
+	if (evaluatedContext.identifier === null) return `a ${evaluatedContext.kind} context without an identifier`;
+	const identity = `${evaluatedContext.kind} ${evaluatedContext.identifier}`;
+	return contextForm.form === "saved" ? `saved context ${identity}` : identity;
+};
+const servedByDescription = (evaluation) => {
+	const { servedBy } = evaluation;
+	switch (servedBy.kind) {
+		case "rule": return `served by rule ${evaluation.rules.findIndex((rule) => rule.ruleId === servedBy.ruleId) + 1}`;
+		case "default": return "served by the default targeting rule";
+	}
+};
+const describeShareRange = (from, to) => `${formatPercentage(from)} to ${formatPercentage(to)}`;
+const bucketPlacement = (bucket) => {
+	const assigned = `bucket ${bucket.assignedPercentage.toFixed(1)}`;
+	const selectedShare = bucket.shares.find((share) => share.percentageId === bucket.selectedPercentageId);
+	if (selectedShare !== void 0) return `${assigned} is in ${describeShareRange(selectedShare.from, selectedShare.to)}`;
+	return `${assigned} is outside ${describeShareRange(0, bucket.shares.at(-1)?.to ?? 0)}`;
+};
+const describeBucket = (bucket) => bucket.defaultedToPredefinedBucket ? `no identifier, so ${bucketPlacement(bucket)}` : bucketPlacement(bucket);
+const withBucket = (outcome, bucket) => bucket === void 0 ? outcome : `${outcome}: ${describeBucket(bucket)}`;
+const conditionsOf = (rule) => rule?.type === "conditional" ? rule.conditions : [];
+const segmentMismatchEvidence = (explanation) => {
+	if (!explanation.segmentFound) return "the segment was not found";
+	return explanation.matchedGroupIndex === void 0 ? "no group matched" : `group ${explanation.matchedGroupIndex + 1} matched`;
+};
+const mismatchEvidence = (failingCondition) => {
+	switch (failingCondition.kind) {
+		case "attribute": return `it is ${RESOLVED_VALUE_DESCRIPTIONS[failingCondition.resolvedType](failingCondition.resolvedValue)}`;
+		case "segment": return segmentMismatchEvidence(failingCondition);
+	}
+};
+const isFailingCondition = (condition) => condition.outcome === "not-matched";
+const failingConditionDescription = (explanation, conditions, segments) => {
+	const failingCondition = explanation.conditions.find(isFailingCondition);
+	const condition = conditions.find((ruleCondition) => ruleCondition.id === failingCondition?.conditionId);
+	return failingCondition === void 0 || condition === void 0 ? void 0 : `${describeCondition(condition, segments)}, but ${mismatchEvidence(failingCondition)}`;
+};
+const describeNotMatched = (explanation, conditions, segments) => {
+	const failingCondition = failingConditionDescription(explanation, conditions, segments);
+	return failingCondition === void 0 ? withBucket("not matched", explanation.bucket) : `not matched: ${failingCondition}`;
+};
+const RULE_OUTCOME_DESCRIPTIONS = {
+	matched: (explanation) => withBucket("matched", explanation.bucket),
+	"not-matched": describeNotMatched,
+	"not-evaluated": () => "not evaluated",
+	errored: () => "errored"
+};
+const ruleLines = (evaluation) => {
+	const rulesById = new Map(evaluation.targetingRules.rules.map((rule) => [rule.id, rule]));
+	return alignedColumns(evaluation.rules.map((explanation, index) => {
+		const rule = rulesById.get(explanation.ruleId);
+		return [`${index + 1}. ${rule === void 0 ? explanation.ruleId : describeRule(rule, evaluation.segments)}`, RULE_OUTCOME_DESCRIPTIONS[explanation.outcome](explanation, conditionsOf(rule), evaluation.segments)];
+	}));
+};
+const evaluationText = (evaluation, requested) => [
+	...oldKeyLines(requested.configKey, evaluation.key),
+	`${evaluation.key} in ${evaluation.environment.name} for ${contextDescription(evaluation, requested.contextForm)}`,
+	"",
+	`${evaluation.value ?? "no value"}, ${servedByDescription(evaluation)}`,
+	"",
+	...ruleLines(evaluation),
+	`Default targeting rule: ${evaluation.targetingRules.defaultValue}`,
+	""
+].join("\n");
+//#endregion
+//#region src/commands/evaluate.ts
+const contextFieldsOf = (contextForm) => {
+	switch (contextForm.form) {
+		case "inline": return { context: contextForm.context };
+		case "saved": return { savedContext: contextForm.reference };
+		case "empty": return {};
+	}
+};
+const NOT_FOUND_MESSAGES = {
+	CONFIG_NOT_FOUND: ({ project, configKey }) => `No config in ${project.slug} has the key "${configKey}".`,
+	ENVIRONMENT_NOT_FOUND: ({ project, environment }) => `No environment in ${project.slug} has the slug "${environment.slug}" any more.`,
+	CONTEXT_NOT_FOUND: ({ environment, contextForm }, error) => contextForm.form === "saved" ? `No context saved in ${environment.slug} has the context kind ${contextForm.reference.kind} and the identifier "${contextForm.reference.identifier}".` : error.message
+};
+const requestEvaluation = async (client, requested) => {
+	try {
+		return await client.evaluateConfig(requested.project.id, requested.configKey, {
+			environmentId: requested.environment.id,
+			...contextFieldsOf(requested.contextForm)
+		});
+	} catch (error) {
+		if (error instanceof EvaluationNotFoundError) throw new CliError(NOT_FOUND_MESSAGES[error.code](requested, error));
+		throw error;
+	}
+};
+const evaluate = async (context, [configKey], options) => {
+	const contextForm = await contextFormOf(options, context.invocation.workingDirectory);
+	const { client, project } = await connectToLinkedProject(context);
+	const requested = {
+		project,
+		configKey,
+		environment: await findEnvironmentBySlug(client, project, options.environment),
+		contextForm
+	};
+	const { evaluation, responseBody } = await requestEvaluation(client, requested);
+	return {
+		json: responseBody,
+		text: evaluationText(evaluation, requested),
+		exitCode: ExitCode.success
+	};
+};
+//#endregion
 //#region src/commands/init.ts
 const refuseExistingFile = async (file) => {
 	if (await access(file).then(() => true, () => false)) throw new CliError(`${file} already exists. init never overwrites it; edit the file instead.`);
@@ -350,9 +1449,66 @@ const login = async (context) => {
 	};
 };
 //#endregion
+//#region src/commands/projects.ts
+const projectLines = (projects) => projects.length === 0 ? ["No projects found."] : alignedColumns(projects.map((project) => [project.slug, project.name]));
+const listProjects = async (context) => {
+	const { parsedBody: projects, responseBody } = await new AdminApiClient({
+		baseUrl: context.baseUrl,
+		token: await configuredApiToken(context)
+	}).listProjects();
+	return {
+		json: responseBody,
+		text: [...projectLines(projects), ""].join("\n"),
+		exitCode: ExitCode.success
+	};
+};
+//#endregion
 //#region src/plural.ts
 const plural = (count, singular, pluralForm) => count === 1 ? singular : pluralForm;
 //#endregion
+//#region src/scanned-repository/short-commit.ts
+const SHORT_COMMIT_LENGTH = 7;
+const shortCommit = (commit) => commit.slice(0, SHORT_COMMIT_LENGTH);
+//#endregion
+//#region src/commands/repositories.ts
+const MAX_SCANNED_REPOSITORIES_PER_PROJECT = 50;
+const commitDescription = (commit) => commit === null ? "no commit" : shortCommit(commit);
+const scannedRepositoryColumnsOf = (repository) => [
+	repository.name,
+	commitDescription(repository.commit),
+	utcMinute(repository.scannedAt),
+	`${repository.referenceCount} ${plural(repository.referenceCount, "reference", "references")}`,
+	`${repository.dynamicReferenceCount} ${plural(repository.dynamicReferenceCount, "dynamic reference", "dynamic references")}`
+];
+const scannedRepositoryLines = (projectSlug, repositories) => repositories.length === 0 ? [`No scanned repositories found in ${projectSlug}. Run configdirector scan --upload in a repository to upload its code references.`] : [
+	...alignedColumns(repositories.map(scannedRepositoryColumnsOf)),
+	"",
+	`${projectSlug} has ${repositories.length} of the ${MAX_SCANNED_REPOSITORIES_PER_PROJECT} scanned repositories a project can hold.`
+];
+const listScannedRepositories = async (context) => {
+	const { client, project } = await connectToLinkedProject(context);
+	const { parsedBody: repositories, responseBody } = await client.listScannedRepositories(project.id);
+	return {
+		json: responseBody,
+		text: [...scannedRepositoryLines(project.slug, repositories), ""].join("\n"),
+		exitCode: ExitCode.success
+	};
+};
+const scannedRepositoryNamesSentence = (repositories) => repositories.length === 0 ? "The project has no scanned repositories." : `Its scanned repositories are ${repositories.map((repository) => repository.name).join(", ")}.`;
+const scannedRepositoryNotFoundError = async (client, project, repositoryName) => {
+	const repositories = await ifPermitted(client.listScannedRepositories(project.id));
+	return new CliError([`No scanned repository in ${project.slug} has the name "${repositoryName}".`, ...repositories === void 0 ? [] : [scannedRepositoryNamesSentence(repositories.parsedBody)]].join(" "));
+};
+const removeScannedRepository = async (context, [repositoryName]) => {
+	const { client, project } = await connectToLinkedProject(context);
+	if (await client.removeScannedRepository(project.id, repositoryName) === "not-found") throw await scannedRepositoryNotFoundError(client, project, repositoryName);
+	return {
+		json: { removedRepository: repositoryName },
+		text: [`Removed ${repositoryName} and its code references from ${project.slug}.`, ""].join("\n"),
+		exitCode: ExitCode.success
+	};
+};
+//#endregion
 //#region src/scan/source-languages.ts
 const languageOfExtension = {
 	".js": "javascript",
@@ -824,6 +1980,7 @@ const scanRootAt = async (workingDirectory, path) => {
 		description: path ?? "the current directory"
 	};
 };
+const scanRootDirectory = (root) => root.isDirectory ? root.path : dirname(root.path);
 const gitignoreRulesIn = async (directory) => {
 	const contents = await readFileIfPresent(join(directory, ".gitignore"));
 	return contents === void 0 ? [] : [{
@@ -1077,6 +2234,10 @@ const DART_RE_EXPORT_DIRECTIVES = ["export"];
 const SWIFT_PACKAGE_MANIFEST = "Package.swift";
 const SWIFT_PACKAGE_TARGETS_DIRECTORIES = ["Sources", "Tests"];
 const XCODE_PROJECT_EXTENSION = ".xcodeproj";
+const JVM_SOURCE_EXTENSIONS = [".kt", ".java"];
+const CSHARP_PROJECT_EXTENSION = ".csproj";
+const CSHARP_SOURCE_EXTENSION = ".cs";
+const CSHARP_BUILD_OUTPUT_DIRECTORIES = ["bin", "obj"];
 const stringAt = (code, index) => code.token(index)?.kind === "string" ? plainStringContent(code, {
 	first: index,
 	last: index
@@ -1245,6 +2406,63 @@ const goPackageNameIn = (code) => {
 	const name = code.token(1);
 	return code.isIdentifier(0, "package") && name?.kind === "identifier" ? name.text : void 0;
 };
+const isCapitalized = (name) => name.charAt(0) >= "A" && name.charAt(0) <= "Z";
+const capitalizedNamesIn = (code) => new Set(code.tokens.flatMap((token) => token.kind === "identifier" && isCapitalized(token.text) ? [token.text] : []));
+const dottedNameAt = (code, start) => {
+	const segments = [];
+	let index = start;
+	for (let token = code.token(index); token?.kind === "identifier"; token = code.token(index)) {
+		segments.push(token.text);
+		if (!code.isPunctuation(index + 1, ".")) break;
+		index += 2;
+	}
+	return {
+		segments,
+		endsWithWildcard: code.isPunctuation(index - 1, ".") && code.isPunctuation(index, "*")
+	};
+};
+const jvmPackagePathIn = (code) => {
+	const packageIndex = code.tokens.findIndex((_token, index) => code.startsLine(index) && code.isIdentifier(index, "package"));
+	return packageIndex === -1 ? [] : dottedNameAt(code, packageIndex + 1).segments;
+};
+const jvmImportsIn = (code) => code.tokens.flatMap((_token, index) => {
+	if (!code.startsLine(index) || !code.isIdentifier(index, "import")) return [];
+	const isStaticImport = code.isIdentifier(index + 1, "static");
+	const { segments, endsWithWildcard } = dottedNameAt(code, isStaticImport ? index + 2 : index + 1);
+	return [endsWithWildcard && !isStaticImport ? {
+		kind: "wholePackage",
+		packagePath: segments
+	} : {
+		kind: "classOrMember",
+		path: segments
+	}];
+});
+const jvmSourceRootOf = (directory, packagePath) => {
+	const sourceRoot = ancestorDirectory(directory, packagePath.length);
+	return join(sourceRoot, ...packagePath) === directory ? sourceRoot : void 0;
+};
+const jvmClassFileCandidates = (sourceRoot, importPath) => importPath.flatMap((_segment, index) => {
+	const classPath = join(sourceRoot, ...importPath.slice(0, importPath.length - index));
+	return JVM_SOURCE_EXTENSIONS.map((extension) => classPath + extension);
+});
+const csharpProjectRootDeclaredIn = async (directory) => {
+	return (await readdir(directory, { withFileTypes: true }).catch(() => [])).some((entry) => entry.isFile() && extname(entry.name) === CSHARP_PROJECT_EXTENSION) ? directory : void 0;
+};
+const isSearchedForHolderClasses = (directoryName) => !CSHARP_BUILD_OUTPUT_DIRECTORIES.includes(directoryName) && !EXCLUDED_DIRECTORY_NAMES.has(directoryName);
+const csharpFilesUnder = async (directory) => {
+	const entries = await readdir(directory, { withFileTypes: true }).catch(() => []);
+	const files = entries.filter((entry) => entry.isFile() && extname(entry.name) === CSHARP_SOURCE_EXTENSION).map((entry) => join(directory, entry.name));
+	const filesOfSubdirectories = await Promise.all(entries.filter((entry) => entry.isDirectory() && isSearchedForHolderClasses(entry.name)).map((entry) => csharpFilesUnder(join(directory, entry.name))));
+	return [...files, ...filesOfSubdirectories.flat()];
+};
+const filesOfCsharpClassName = (files) => {
+	const filesOfClassName = /* @__PURE__ */ new Map();
+	for (const file of files) {
+		const className = basename(file, CSHARP_SOURCE_EXTENSION);
+		filesOfClassName.set(className, [...filesOfClassName.get(className) ?? [], file]);
+	}
+	return filesOfClassName;
+};
 const goPackageNameOfFile = async (file) => {
 	const contents = await readFileWithinSizeLimit(file);
 	return contents === void 0 ? void 0 : goPackageNameIn(new SourceCode(contents, "go"));
@@ -1253,14 +2471,17 @@ var LocalImports = class {
 	dartPackages;
 	goModules;
 	swiftProjects;
+	csharpProjectRoots;
 	pathAliases;
-	goFilesOfDirectory = /* @__PURE__ */ new Map();
+	filesOfDirectory = /* @__PURE__ */ new Map();
+	csharpClassFilesOfProject = /* @__PURE__ */ new Map();
 	fileExistence = /* @__PURE__ */ new Map();
 	constructor(highestDirectory) {
 		this.highestDirectory = highestDirectory;
 		this.dartPackages = new NearestDeclarations(highestDirectory, dartPackageDeclaredIn);
 		this.goModules = new NearestDeclarations(highestDirectory, goModuleDeclaredIn);
 		this.swiftProjects = new NearestDeclarations(highestDirectory, swiftProjectDeclaredIn);
+		this.csharpProjectRoots = new NearestDeclarations(highestDirectory, csharpProjectRootDeclaredIn);
 		this.pathAliases = new PathAliases(highestDirectory);
 	}
 	filesImportedBy(code, file) {
@@ -1287,6 +2508,18 @@ var LocalImports = class {
 			case "csharp": return Promise.resolve([]);
 		}
 	}
+	holderClassFilesReferencedBy(code, file) {
+		switch (code.language) {
+			case "kotlin":
+			case "java": return this.jvmHolderClassFilesReferencedBy(code, file);
+			case "csharp": return this.csharpHolderClassFilesReferencedBy(code, file);
+			case "javascript":
+			case "python":
+			case "dart":
+			case "go":
+			case "swift": return Promise.resolve([]);
+		}
+	}
 	filesReExportedBy(code, file) {
 		switch (code.language) {
 			case "javascript": return this.javascriptFilesAt(javascriptReExportSpecifiers(code), file);
@@ -1380,11 +2613,53 @@ var LocalImports = class {
 			case "xcodeProject": return project.root;
 		}
 	}
-	goFilesIn(directory) {
-		const filesListedBefore = this.goFilesOfDirectory.get(directory);
+	async jvmHolderClassFilesReferencedBy(code, file) {
+		const directory = dirname(file);
+		const classNames = capitalizedNamesIn(code);
+		const sourceRoot = jvmSourceRootOf(directory, jvmPackagePathIn(code));
+		return [...sourceRoot === void 0 ? [] : await this.jvmClassFilesImportedFrom(sourceRoot, jvmImportsIn(code), classNames), ...await this.jvmClassFilesIn(directory, classNames)];
+	}
+	async jvmClassFilesImportedFrom(sourceRoot, imports, classNames) {
+		const files = [];
+		for (const jvmImport of imports) switch (jvmImport.kind) {
+			case "classOrMember": {
+				const importedFile = await this.firstExistingFile(jvmClassFileCandidates(sourceRoot, jvmImport.path));
+				if (importedFile !== void 0) files.push(importedFile);
+				break;
+			}
+			case "wholePackage":
+				files.push(...await this.jvmClassFilesIn(join(sourceRoot, ...jvmImport.packagePath), classNames));
+				break;
+		}
+		return files;
+	}
+	async jvmClassFilesIn(directory, classNames) {
+		return (await this.filesIn(directory)).filter((file) => {
+			const extension = extname(file);
+			return JVM_SOURCE_EXTENSIONS.includes(extension) && classNames.has(basename(file, extension));
+		});
+	}
+	async csharpHolderClassFilesReferencedBy(code, file) {
+		const projectRoot = await this.csharpProjectRoots.declarationAbove(file);
+		if (projectRoot === void 0) return [];
+		const filesOfClassName = await this.csharpClassFilesIn(projectRoot);
+		return [...capitalizedNamesIn(code)].flatMap((className) => filesOfClassName.get(className) ?? []);
+	}
+	csharpClassFilesIn(projectRoot) {
+		const classFilesListedBefore = this.csharpClassFilesOfProject.get(projectRoot);
+		if (classFilesListedBefore !== void 0) return classFilesListedBefore;
+		const classFiles = csharpFilesUnder(projectRoot).then(filesOfCsharpClassName);
+		this.csharpClassFilesOfProject.set(projectRoot, classFiles);
+		return classFiles;
+	}
+	async goFilesIn(directory) {
+		return (await this.filesIn(directory)).filter((file) => extname(file) === ".go");
+	}
+	filesIn(directory) {
+		const filesListedBefore = this.filesOfDirectory.get(directory);
 		if (filesListedBefore !== void 0) return filesListedBefore;
-		const files = readdir(directory, { withFileTypes: true }).then((entries) => entries.filter((entry) => entry.isFile() && extname(entry.name) === ".go").map((entry) => join(directory, entry.name)), () => []);
-		this.goFilesOfDirectory.set(directory, files);
+		const files = readdir(directory, { withFileTypes: true }).then((entries) => entries.filter((entry) => entry.isFile()).map((entry) => join(directory, entry.name)), () => []);
+		this.filesOfDirectory.set(directory, files);
 		return files;
 	}
 };
@@ -2457,19 +3732,24 @@ const sdkFamiliesUsedIn = (highestDirectory) => {
 			}
 		}
 	};
-	const familiesMarkedThroughImports = async (file, code) => {
-		const importedPaths = await localImports.filesImportedBy(code, file.path);
-		return (await Promise.all(importedPaths.map((importedPath) => familiesReachedThrough(importedPath, RE_EXPORT_STEPS_FOLLOWED)))).flat();
+	const familiesReachedThroughEach = async (paths) => {
+		return (await Promise.all(paths.map((path) => familiesReachedThrough(path, RE_EXPORT_STEPS_FOLLOWED)))).flat();
 	};
+	const familiesMarkedThroughImports = async (file, code) => familiesReachedThroughEach(await localImports.filesImportedBy(code, file.path));
+	const familiesMarkedInHolderClasses = async (file, code) => familiesReachedThroughEach(await localImports.holderClassFilesReferencedBy(code, file.path));
 	const familiesMarkedInSamePackageOrTarget = async (file, code) => {
 		const familiesFoundBefore = familiesMarkedInPackageOrTargetOfFile.get(file.path);
 		if (familiesFoundBefore !== void 0) return familiesFoundBefore;
 		const filesOfPackageOrTarget = await localImports.filesOfSamePackageOrTarget(code, file.path);
-		const families = Promise.all(filesOfPackageOrTarget.map((fileOfPackageOrTarget) => familiesReachedThrough(fileOfPackageOrTarget, RE_EXPORT_STEPS_FOLLOWED))).then((familiesOfFiles) => familiesOfFiles.flat());
+		const families = familiesReachedThroughEach(filesOfPackageOrTarget);
 		for (const fileOfPackageOrTarget of filesOfPackageOrTarget) familiesMarkedInPackageOrTargetOfFile.set(fileOfPackageOrTarget, families);
 		return families;
 	};
-	const familiesMarkedByOtherFiles = async (file, code) => [...await familiesMarkedThroughImports(file, code), ...await familiesMarkedInSamePackageOrTarget(file, code)];
+	const familiesMarkedByOtherFiles = async (file, code) => [
+		...await familiesMarkedThroughImports(file, code),
+		...await familiesMarkedInSamePackageOrTarget(file, code),
+		...await familiesMarkedInHolderClasses(file, code)
+	];
 	return async (file, code) => {
 		const familiesForExtension = familiesOfExtension(file.extension);
 		const markedHere = familiesWithMarkerIn(file.contents, familiesForExtension);
@@ -2533,17 +3813,16 @@ const scanCodeReferences = async (scope, projectKeys) => {
 };
 //#endregion
 //#region src/project-scan.ts
-const scanProject = async (context, path) => {
+const scanProject = async (context, root) => {
 	const { workingDirectory } = context.invocation;
 	const settings = await readProjectSettings(workingDirectory);
 	const projectSlug = requireLinkedProjectSlug(context, settings);
-	const root = await scanRootAt(workingDirectory, path);
 	const client = new AdminApiClient({
 		baseUrl: context.baseUrl,
 		token: await configuredApiToken(context)
 	});
 	const project = await findProjectBySlug(client, projectSlug);
-	const configs = await client.listConfigs(project.id);
+	const configs = (await client.listConfigs(project.id, { form: "every-config" })).map((listedConfig) => listedConfig.config);
 	const projectKeys = new Set(configs.flatMap((config) => [config.key, ...config.deprecatedKeys.map((deprecatedKey) => deprecatedKey.key)]));
 	const codeReferenceScan = await scanCodeReferences({
 		root,
@@ -2552,14 +3831,107 @@ const scanProject = async (context, path) => {
 		exclude: settings?.exclude ?? []
 	}, projectKeys);
 	return {
+		client,
 		project,
 		configs,
 		ignoredKeys: new Set(settings?.ignoreKeys ?? []),
-		scannedLocation: root.description,
 		codeReferenceScan
 	};
 };
 //#endregion
+//#region src/scanned-repository/git-checkout.ts
+const execFileAsync = promisify(execFile);
+const firstLineOf = (text) => text.trim().split("\n")[0] ?? "";
+const gitOutput = async (directory, environmentVariables, gitArguments) => {
+	try {
+		const { stdout } = await execFileAsync("git", gitArguments, {
+			cwd: directory,
+			env: { ...environmentVariables }
+		});
+		return {
+			kind: "printed",
+			text: stdout.trim()
+		};
+	} catch (error) {
+		const failure = error;
+		return failure.code === "ENOENT" ? { kind: "git-missing" } : {
+			kind: "failed",
+			message: firstLineOf(failure.stderr ?? "")
+		};
+	}
+};
+const readGitCheckout = async (directory, environmentVariables) => {
+	const workTree = await gitOutput(directory, environmentVariables, ["rev-parse", "--is-inside-work-tree"]);
+	switch (workTree.kind) {
+		case "git-missing": return { kind: "git-missing" };
+		case "failed": return {
+			kind: "no-repository",
+			gitMessage: workTree.message
+		};
+		case "printed": break;
+	}
+	const remoteUrl = await gitOutput(directory, environmentVariables, [
+		"remote",
+		"get-url",
+		"origin"
+	]);
+	if (remoteUrl.kind !== "printed") return { kind: "no-origin-remote" };
+	const commit = await gitOutput(directory, environmentVariables, ["rev-parse", "HEAD"]);
+	return {
+		kind: "origin-remote",
+		remoteUrl: remoteUrl.text,
+		commit: commit.kind === "printed" ? commit.text : ""
+	};
+};
+//#endregion
+//#region src/scanned-repository/repository-identity.ts
+const URL_SCHEME_SEPARATOR = "://";
+const GIT_SUFFIX = ".git";
+const HTTP_PROTOCOLS = ["http:", "https:"];
+const carriesHttpCredentials = (url) => HTTP_PROTOCOLS.includes(url.protocol) && (url.username !== "" || url.password !== "");
+const withoutCredentials = (url) => {
+	const urlWithoutCredentials = new URL(url);
+	urlWithoutCredentials.username = "";
+	urlWithoutCredentials.password = "";
+	return urlWithoutCredentials.href;
+};
+const originRemoteOf = (remoteUrl) => {
+	if (!remoteUrl.includes(URL_SCHEME_SEPARATOR)) return {
+		path: remoteUrl.slice(remoteUrl.indexOf(":") + 1),
+		uploadedUrl: remoteUrl
+	};
+	const url = new URL(remoteUrl);
+	return {
+		path: url.pathname.slice(1),
+		uploadedUrl: carriesHttpCredentials(url) ? withoutCredentials(url) : remoteUrl
+	};
+};
+const repositoryNameOf = (remote) => remote.path.endsWith(GIT_SUFFIX) ? remote.path.slice(0, -4) : remote.path;
+const unnamedCheckoutReason = (checkout, scannedLocation) => {
+	switch (checkout.kind) {
+		case "git-missing": return "git is not installed or not on the PATH";
+		case "no-repository": return `git cannot read a repository in ${scannedLocation} (${checkout.gitMessage})`;
+		case "no-origin-remote": return `the git repository in ${scannedLocation} has no remote named origin`;
+	}
+};
+const unnamedRepositoryError = (checkout, scannedLocation) => new CliError(`scan --upload names the repository after its git remote origin, but ${unnamedCheckoutReason(checkout, scannedLocation)}. Name the repository with --repository <name>.`);
+const repositoryIdentityOf = (checkout, repositoryOption, scannedLocation) => {
+	if (checkout.kind === "origin-remote") {
+		const remote = originRemoteOf(checkout.remoteUrl);
+		return {
+			name: repositoryOption ?? repositoryNameOf(remote),
+			remoteUrl: remote.uploadedUrl,
+			commit: checkout.commit
+		};
+	}
+	if (repositoryOption === void 0) throw unnamedRepositoryError(checkout, scannedLocation);
+	return {
+		name: repositoryOption,
+		remoteUrl: "",
+		commit: ""
+	};
+};
+//#endregion
 //#region src/commands/scan.ts
 const referenceJson = (reference) => {
 	switch (reference.kind) {
@@ -2584,8 +3956,7 @@ const referenceJson = (reference) => {
 		};
 	}
 };
-const scanJson = (projectSlug, scan) => ({
-	project: projectSlug,
+const codeReferenceScanJson = (scan) => ({
 	filesScanned: scan.filesScanned,
 	references: scan.references.map(referenceJson),
 	dynamicReferences: scan.dynamicReferences.map((reference) => ({
@@ -2596,6 +3967,10 @@ const scanJson = (projectSlug, scan) => ({
 		argument: reference.argument
 	}))
 });
+const scanJson = (projectSlug, scan) => ({
+	project: projectSlug,
+	...codeReferenceScanJson(scan)
+});
 const DYNAMIC_REFERENCES_HEADING = "Dynamic references (calls whose key is not a string literal)";
 const withCollapsedWhitespace = (text) => {
 	let collapsed = "";
@@ -2633,11 +4008,169 @@ const scanText = (scan, scannedLocation) => {
 		counts
 	].join("\n\n")}\n`;
 };
-const scan = async (context, [path]) => {
-	const { project, scannedLocation, codeReferenceScan } = await scanProject(context, path);
+const shortCommitText = (commit) => commit === null ? "" : ` at ${shortCommit(commit)}`;
+const uploadLine = (projectSlug, repository, leftOutCount) => `Uploaded the scan of ${repository.name}${shortCommitText(repository.commit)} to ${projectSlug}: ${repository.referenceCount} ${plural(repository.referenceCount, "reference", "references")} and ${repository.dynamicReferenceCount} ${plural(repository.dynamicReferenceCount, "dynamic reference", "dynamic references")}, with ${leftOutCount} left out for a key that cannot be a config key.`;
+const uploadScan = async (context, root, repositoryOption) => {
+	const repository = repositoryIdentityOf(await readGitCheckout(scanRootDirectory(root), context.invocation.environmentVariables), repositoryOption, root.description);
+	const { client, project, codeReferenceScan } = await scanProject(context, root);
+	if (codeReferenceScan.filesScanned === 0) throw new CliError(`No source files to scan in ${root.description}, so nothing was uploaded and ${project.slug} keeps its code references for ${repository.name}. Check the path given to scan, and include and exclude in configdirector.json.`);
+	const configKeyReferences = codeReferenceScan.references.filter((reference) => fitsKeyGrammar(reference.key));
+	const leftOutCount = codeReferenceScan.references.length - configKeyReferences.length;
+	const { parsedBody: scannedRepository, responseBody } = await client.uploadRepositoryScan(project.id, repository.name, {
+		remoteUrl: repository.remoteUrl,
+		commit: repository.commit,
+		...codeReferenceScanJson({
+			...codeReferenceScan,
+			references: configKeyReferences
+		})
+	});
+	return {
+		json: responseBody,
+		text: `${scanText(codeReferenceScan, root.description)}\n${uploadLine(project.slug, scannedRepository, leftOutCount)}\n`,
+		exitCode: ExitCode.success
+	};
+};
+const scan = async (context, [path], options) => {
+	const root = await scanRootAt(context.invocation.workingDirectory, path);
+	if (options.upload) return uploadScan(context, root, options.repository);
+	const { project, codeReferenceScan } = await scanProject(context, root);
 	return {
 		json: scanJson(project.slug, codeReferenceScan),
-		text: scanText(codeReferenceScan, scannedLocation),
+		text: scanText(codeReferenceScan, root.description),
+		exitCode: ExitCode.success
+	};
+};
+//#endregion
+//#region src/segments/segment-text.ts
+const conditionGroupLines = (heading, groups) => [
+	"",
+	heading,
+	...groups.map((group, index) => `  ${index + 1}. ${describeConditionGroup(group)}`)
+];
+const segmentText = (segment, environmentSlugs) => [
+	segment.key,
+	`  Name: ${segment.name}`,
+	...conditionGroupLines("Project definition", segment.groups),
+	...Object.entries(segment.overrides).flatMap(([environmentId, groups]) => conditionGroupLines(`Override in ${environmentSlugs.get(environmentId) ?? environmentId}`, groups)),
+	""
+].join("\n");
+//#endregion
+//#region src/commands/segments.ts
+const usageDescription = (segment) => `used by ${segment.usages.length} ${plural(segment.usages.length, "config", "configs")}`;
+const segmentLines = (projectSlug, segments) => segments.length === 0 ? [`No segments found in ${projectSlug}.`] : alignedColumns(segments.map((segment) => [
+	segment.key,
+	segment.name,
+	usageDescription(segment)
+]));
+const listSegments = async (context) => {
+	const { client, project } = await connectToLinkedProject(context);
+	const { parsedBody: segments, responseBody } = await client.listSegments(project.id);
+	return {
+		json: responseBody,
+		text: [...segmentLines(project.slug, segments), ""].join("\n"),
+		exitCode: ExitCode.success
+	};
+};
+const environmentSlugsFor = async (client, project, segment) => {
+	if (Object.keys(segment.overrides).length === 0) return /* @__PURE__ */ new Map();
+	const environments = await ifPermitted(client.listEnvironments(project.id));
+	return new Map((environments?.parsedBody ?? []).map((environment) => [environment.id, environment.slug]));
+};
+const getSegment = async (context, [segmentKey]) => {
+	const { client, project } = await connectToLinkedProject(context);
+	const receivedSegment = await client.getSegment(project.id, segmentKey);
+	if (receivedSegment === void 0) throw new CliError(`No segment in ${project.slug} has the key "${segmentKey}".`);
+	const { parsedBody: segment, responseBody } = receivedSegment;
+	return {
+		json: responseBody,
+		text: segmentText(segment, await environmentSlugsFor(client, project, segment)),
+		exitCode: ExitCode.success
+	};
+};
+//#endregion
+//#region src/targeting-rules/reference-text.ts
+const headedListLines = (heading, items) => [heading, ...items.map((item) => `  ${item}`)];
+const operatorsByTargetTypeLines = (operatorsByTargetType) => ["Operators per target type:", ...Object.entries(operatorsByTargetType).flatMap(([targetType, operators]) => [`  ${targetType}:`, ...operators.map((operator) => `    ${operator}`)])];
+const targetingRulesReferenceText = (reference) => [
+	...reference.notes.flatMap((note) => [note, ""]),
+	...headedListLines("Condition kinds:", reference.conditionKinds),
+	"",
+	...headedListLines("Attributes a condition can test:", reference.conditionAttributes),
+	"",
+	...headedListLines("Context kind operators:", reference.contextKindOperators),
+	"",
+	...headedListLines("Segment operators:", reference.segmentOperators),
+	"",
+	...operatorsByTargetTypeLines(reference.operatorsByTargetType),
+	""
+].join("\n");
+//#endregion
+//#region src/targeting-rules/targeting-rules-file.ts
+const STANDARD_INPUT_ARGUMENT = "-";
+const readRulesSource = async (rulesArgument, invocation) => {
+	if (rulesArgument === STANDARD_INPUT_ARGUMENT) return {
+		origin: "--rules reads stdin",
+		contents: await text(invocation.stdin)
+	};
+	const { file, contents } = await readOptionFile("--rules", rulesArgument, invocation.workingDirectory);
+	return {
+		origin: `--rules names ${file}`,
+		contents
+	};
+};
+const readTargetingRulesFile = async (rulesArgument, invocation) => {
+	const { origin, contents } = await readRulesSource(rulesArgument, invocation);
+	const targetingRules = parseJson(contents);
+	if (!isJsonObject(targetingRules)) throw new CliError(`${origin}, which does not hold a JSON object. It takes {"defaultValue": ..., "rules": [...]}, like an entry of targets in configs get --json.`);
+	return targetingRules;
+};
+const withId = (entry) => entry.id === void 0 ? {
+	id: randomUUID(),
+	...entry
+} : entry;
+const conditionOrPercentageWithId = (conditionOrPercentage) => isJsonObject(conditionOrPercentage) ? withId(conditionOrPercentage) : conditionOrPercentage;
+const conditionsOrPercentagesWithIds = (rule, field) => {
+	const conditionsOrPercentages = rule[field];
+	return Array.isArray(conditionsOrPercentages) ? { [field]: conditionsOrPercentages.map(conditionOrPercentageWithId) } : {};
+};
+const ruleWithIds = (rule) => isJsonObject(rule) ? {
+	...withId(rule),
+	...conditionsOrPercentagesWithIds(rule, "conditions"),
+	...conditionsOrPercentagesWithIds(rule, "percentages")
+} : rule;
+const withGeneratedIds = (targetingRules) => Array.isArray(targetingRules.rules) ? {
+	...targetingRules,
+	rules: targetingRules.rules.map(ruleWithIds)
+} : targetingRules;
+//#endregion
+//#region src/commands/targeting-rules.ts
+const replacedRulesLine = (configKey, environment, targetingRules) => {
+	const ruleCount = Array.isArray(targetingRules.rules) ? targetingRules.rules.length : 0;
+	return `Replaced the targeting rules of ${configKey} in ${environment.slug} with ${ruleCount} ${plural(ruleCount, "rule", "rules")} and the default targeting rule value ${String(targetingRules.defaultValue)}.`;
+};
+const setTargetingRules = async (context, [configKey], options) => {
+	const targetingRules = withGeneratedIds(await readTargetingRulesFile(options.rules, context.invocation));
+	const { client, project } = await connectToLinkedProject(context);
+	const environment = await findEnvironmentBySlug(client, project, options.environment);
+	const request = {
+		...targetingRules,
+		environmentId: environment.id
+	};
+	if (await client.replaceTargetingRules(project.id, configKey, request) === "not-found") throw new CliError(`No config in ${project.slug} has the key "${configKey}".`);
+	return {
+		json: request,
+		text: [replacedRulesLine(configKey, environment, targetingRules), ""].join("\n"),
+		exitCode: ExitCode.success
+	};
+};
+const showTargetingRulesReference = async (context) => {
+	const { parsedBody: reference, responseBody } = await new AdminApiClient({
+		baseUrl: context.baseUrl,
+		token: await configuredApiToken(context)
+	}).getTargetingRulesReference();
+	return {
+		json: responseBody,
+		text: targetingRulesReferenceText(reference),
 		exitCode: ExitCode.success
 	};
 };
@@ -2836,14 +4369,15 @@ const validateText = (projectSlug, scan, scannedLocation, check) => {
 	}), countsText(scan, check)].join("\n\n")}\n`;
 };
 const validate = async (context, [path]) => {
-	const { project, configs, ignoredKeys, scannedLocation, codeReferenceScan } = await scanProject(context, path);
+	const root = await scanRootAt(context.invocation.workingDirectory, path);
+	const { project, configs, ignoredKeys, codeReferenceScan } = await scanProject(context, root);
 	const check = checkCodeReferences(codeReferenceScan.references, configs, ignoredKeys);
 	return {
 		json: {
 			...scanJson(project.slug, codeReferenceScan),
 			findings: check.findings.map(findingJson)
 		},
-		text: validateText(project.slug, codeReferenceScan, scannedLocation, check),
+		text: validateText(project.slug, codeReferenceScan, root.description, check),
 		exitCode: check.findings.length === 0 ? ExitCode.success : ExitCode.problemsFound
 	};
 };
@@ -2855,6 +4389,7 @@ const withoutTrailingSlashes = (url) => {
 	while (trimmedUrl.endsWith("/")) trimmedUrl = trimmedUrl.slice(0, -1);
 	return trimmedUrl;
 };
+const repeatedOption = (value, values) => [...values ?? [], value];
 const runCommand = async (invocation, command, actionArguments) => {
 	const parsedCommand = actionArguments.at(-1);
 	const options = parsedCommand.optsWithGlobals();
@@ -2863,7 +4398,7 @@ const runCommand = async (invocation, command, actionArguments) => {
 		baseUrl: withoutTrailingSlashes(options.baseUrl ?? nonEmptyVariable(invocation, "CONFIGDIRECTOR_BASE_URL") ?? DEFAULT_BASE_URL),
 		tokenOption: options.token,
 		projectSlug: options.project ?? nonEmptyVariable(invocation, "CONFIGDIRECTOR_PROJECT")
-	}, parsedCommand.processedArgs);
+	}, parsedCommand.processedArgs, parsedCommand.opts());
 	invocation.stdout.write(options.json ? `${JSON.stringify(output.json, null, 2)}\n` : output.text);
 	return output.exitCode;
 };
@@ -2887,8 +4422,26 @@ const run = async (invocation) => {
 	});
 	program.command("login").description("save an API token for later runs, after checking it can list projects").action(commandAction(login));
 	program.command("init").description("write configdirector.json for a project in the current directory").action(commandAction(init));
-	program.command("scan").argument("[path]", "directory or file to scan (default: the current directory)").description("list where the code reads config keys through a ConfigDirector SDK").action(commandAction(scan));
+	program.command("scan").argument("[path]", "directory or file to scan (default: the current directory)").description("list where the code reads config keys through a ConfigDirector SDK").option("--upload", "send the code references to the project, replacing those it holds for this repository").option("--repository <name>", "the repository name to upload under (default: the path of the git remote origin, such as ConfigDirector/cli)").action(commandAction(scan));
 	program.command("validate").argument("[path]", "directory or file to check (default: the current directory)").description("check every config key the code reads against the project's configs, exiting 1 when one is wrong").action(commandAction(validate));
+	program.command("evaluate").argument("<key>", "the config's key").description("show the value a context gets for a config in an environment, and why").requiredOption("--environment <slug>", "slug of the environment whose targeting rules to evaluate (required)").option("--context-kind <kind>", "context kind of the context to evaluate for (default: user)").option("--context-id <identifier>", "identifier of the context").option("--context-name <name>", "name of the context").option("--context-trait <name=value>", "a trait of the context, as a string, or name:=<json> for a number, boolean, array or object; repeatable", repeatedOption).option("--context-json <json>", "the whole context as a JSON object, or @<file> to read it from a file").option("--saved-context <kind:identifier>", "a context ConfigDirector saved from SDK evaluations in the environment, such as user:123").addHelpText("after", "\nGive the context with the --context-* options, with --context-json, or with --saved-context. Without any of them, the config is evaluated for an empty context, as an SDK given none would.").action(commandAction(evaluate));
+	program.command("projects").description("list the projects of the API token's organization").command("list").description("list the organization's projects, whatever project is selected").action(commandAction(listProjects));
+	program.command("environments").description("list the project's environments").command("list").description("list the project's environments with their slugs, marking the live ones").action(commandAction(listEnvironments));
+	const configsCommand = program.command("configs").description("list, show, create and archive a project's configs");
+	configsCommand.command("list").description("list the project's configs with their type, role, lifetime and lifecycle state").option("--tag <name>", "list only the configs that have this tag; repeatable, for configs with any of them", repeatedOption).addOption(new Option("--untagged", "list only the configs without tags").conflicts("tag")).addOption(new Option("--state <state>", "list only the configs in this lifecycle state").choices(LIFECYCLE_STATES)).action(commandAction(listConfigs));
+	configsCommand.command("get").argument("<key>", "the config's key, or an old key of it").description("show a config's settings and its targeting rules in every environment").action(commandAction(getConfig));
+	configsCommand.command("activity").argument("<key>", "the config's key, or an old key of it").description("show when SDKs last evaluated a config, per environment, SDK key kind, SDK name and SDK version").action(commandAction(showConfigActivity));
+	configsCommand.command("create").description("create a config from options that mirror the Admin API's fields").requiredOption("--key <key>", "the config's key (required)").option("--description <text>", "a description shown with the config in the dashboard").addOption(new Option("--type <type>", "the type of the config's values (required)").choices(CONFIG_TYPES).makeOptionMandatory()).addOption(new Option("--role <role>", "what the config is for (required)").choices(CONFIG_ROLES).makeOptionMandatory()).addOption(new Option("--lifetime <lifetime>", "whether the config is expected to be removed (required)").choices(CONFIG_LIFETIMES).makeOptionMandatory()).requiredOption("--default-value <value>", "the default targeting rule value every environment starts with, in the type given by --type; not the in-code default value an application passes to the SDK (required)").option("--client-only", "serve the config to client SDKs only (default: client and server SDKs)").addOption(new Option("--server-only", "serve the config to server SDKs only (default: client and server SDKs)").conflicts("clientOnly")).option("--tag <name>", "assign the project's tag with this name; repeatable", repeatedOption).option("--variation <name=value>", "a variation of an experiment, its value in the type given by --type; repeatable", repeatedOption).addOption(new Option("--min <number>", "the smallest value allowed, included").helpGroup(typeConstraintHelpGroup("min"))).addOption(new Option("--max <number>", "the largest value allowed, included").helpGroup(typeConstraintHelpGroup("max"))).addOption(new Option("--exclusive-min <number>", "values must be greater than this number").conflicts("min").helpGroup(typeConstraintHelpGroup("exclusiveMin"))).addOption(new Option("--exclusive-max <number>", "values must be less than this number").conflicts("max").helpGroup(typeConstraintHelpGroup("exclusiveMax"))).addOption(new Option("--unit <unit>", "the unit of the number the SDKs receive (required)").choices(TIMESPAN_UNITS).helpGroup(typeConstraintHelpGroup("unit"))).addOption(new Option("--allow-fractions", "allow values with a fraction of the unit").helpGroup(typeConstraintHelpGroup("allowFractions"))).addOption(new Option("--allowed-value <value>", "a value the config can take; repeatable").argParser(repeatedOption).helpGroup(typeConstraintHelpGroup("allowedValue"))).addOption(new Option("--enum-value-type <type>", "whether the allowed values are strings or numbers (default: string)").choices(ENUM_VALUE_TYPES).helpGroup(typeConstraintHelpGroup("enumValueType"))).addOption(new Option("--https-only", "allow only HTTPS URLs").helpGroup(typeConstraintHelpGroup("httpsOnly"))).addOption(new Option("--json-schema <file>", "a file holding the JSON Schema every value must match").helpGroup(typeConstraintHelpGroup("jsonSchema"))).action(commandAction(createConfig));
+	configsCommand.command("archive").argument("<key>", "the config's key, or an old key of it").description("archive a config, so SDKs stop receiving it; the dashboard can restore it for 30 days").addHelpText("after", "\nThe config is archived with no confirmation and no check of whether the code still reads its key, so run configdirector scan first. Applications that still read it get their in-code default value.").action(commandAction(archiveConfig));
+	const segmentsCommand = program.command("segments").description("list a project's segments and show one segment");
+	segmentsCommand.command("list").description("list the project's segments with how many configs use each").action(commandAction(listSegments));
+	segmentsCommand.command("get").argument("<key>", "the segment's key").description("show a segment's condition groups and its environment overrides").action(commandAction(getSegment));
+	const targetingRulesCommand = program.command("targeting-rules").description("replace a config's targeting rules in one environment and show the format they take");
+	targetingRulesCommand.command("set").argument("<key>", "the config's key, or an old key of it").description("replace a config's targeting rules in one environment with the rules of a JSON file").requiredOption("--environment <slug>", "slug of the environment whose targeting rules to replace (required)").requiredOption("--rules <file>", "a JSON file holding defaultValue and rules as the Admin API takes them, or - to read it from stdin (required)").addHelpText("after", "\nThe file holds {\"defaultValue\": ..., \"rules\": [...]}, like an entry of targets in configs get --json, so you can edit that output and write it back. Every rule of the environment is replaced. A rule, condition or percentage without an id gets a new one. configdirector targeting-rules reference lists the condition kinds, attributes and operators.").action(commandAction(setTargetingRules));
+	targetingRulesCommand.command("reference").description("show the format targeting rules take: the condition kinds, the attributes a condition can test and the operators").action(commandAction(showTargetingRulesReference));
+	const repositoriesCommand = program.command("repositories").description("list a project's scanned repositories and remove one");
+	repositoriesCommand.command("list").description("list the repositories whose scan was uploaded to the project, with their commit, scan time and reference counts").action(commandAction(listScannedRepositories));
+	repositoriesCommand.command("remove").argument("<name>", "the repository's name, as repositories list shows it, such as ConfigDirector/cli").description("remove a scanned repository and its code references from the project").addHelpText("after", "\nThe repository is removed with no confirmation, and the dashboard stops showing its code references. The next scan --upload from it adds it back.").action(commandAction(removeScannedRepository));
 	try {
 		await program.parseAsync(invocation.commandLineArguments, { from: "user" });
 		return exitCode;