@drip-apex/apex-cli 0.13.0 → 0.14.1

package/dist/cli.js

@@ -1159,8 +1159,8 @@ var require_command = __commonJS({
   "node_modules/commander/lib/command.js"(exports2) {
     var EventEmitter = require("node:events").EventEmitter;
     var childProcess2 = require("node:child_process");
-    var path24 = require("node:path");
-    var fs28 = require("node:fs");
+    var path25 = require("node:path");
+    var fs29 = require("node:fs");
     var process16 = require("node:process");
     var { Argument: Argument2, humanReadableArgName } = require_argument();
     var { CommanderError: CommanderError2 } = require_error();
@@ -2141,7 +2141,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @param {string} subcommandName
        */
       _checkForMissingExecutable(executableFile, executableDir, subcommandName) {
-        if (fs28.existsSync(executableFile)) return;
+        if (fs29.existsSync(executableFile)) return;
         const executableDirMessage = executableDir ? `searched for local subcommand relative to directory '${executableDir}'` : "no directory for search for local subcommand, use .executableDir() to supply a custom directory";
         const executableMissing = `'${executableFile}' does not exist
  - if '${subcommandName}' is not meant to be an executable command, remove description parameter from '.command()' and use '.description()' instead
@@ -2159,11 +2159,11 @@ Expecting one of '${allowedValues.join("', '")}'`);
         let launchWithNode = false;
         const sourceExt = [".js", ".ts", ".tsx", ".mjs", ".cjs"];
         function findFile(baseDir, baseName) {
-          const localBin = path24.resolve(baseDir, baseName);
-          if (fs28.existsSync(localBin)) return localBin;
-          if (sourceExt.includes(path24.extname(baseName))) return void 0;
+          const localBin = path25.resolve(baseDir, baseName);
+          if (fs29.existsSync(localBin)) return localBin;
+          if (sourceExt.includes(path25.extname(baseName))) return void 0;
           const foundExt = sourceExt.find(
-            (ext) => fs28.existsSync(`${localBin}${ext}`)
+            (ext) => fs29.existsSync(`${localBin}${ext}`)
           );
           if (foundExt) return `${localBin}${foundExt}`;
           return void 0;
@@ -2175,21 +2175,21 @@ Expecting one of '${allowedValues.join("', '")}'`);
         if (this._scriptPath) {
           let resolvedScriptPath;
           try {
-            resolvedScriptPath = fs28.realpathSync(this._scriptPath);
+            resolvedScriptPath = fs29.realpathSync(this._scriptPath);
           } catch {
             resolvedScriptPath = this._scriptPath;
           }
-          executableDir = path24.resolve(
-            path24.dirname(resolvedScriptPath),
+          executableDir = path25.resolve(
+            path25.dirname(resolvedScriptPath),
             executableDir
           );
         }
         if (executableDir) {
           let localFile = findFile(executableDir, executableFile);
           if (!localFile && !subcommand._executableFile && this._scriptPath) {
-            const legacyName = path24.basename(
+            const legacyName = path25.basename(
               this._scriptPath,
-              path24.extname(this._scriptPath)
+              path25.extname(this._scriptPath)
             );
             if (legacyName !== this._name) {
               localFile = findFile(
@@ -2200,7 +2200,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
           }
           executableFile = localFile || executableFile;
         }
-        launchWithNode = sourceExt.includes(path24.extname(executableFile));
+        launchWithNode = sourceExt.includes(path25.extname(executableFile));
         let proc;
         if (process16.platform !== "win32") {
           if (launchWithNode) {
@@ -3047,7 +3047,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @return {Command}
        */
       nameFromFilename(filename) {
-        this._name = path24.basename(filename, path24.extname(filename));
+        this._name = path25.basename(filename, path25.extname(filename));
         return this;
       }
       /**
@@ -3061,9 +3061,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @param {string} [path]
        * @return {(string|null|Command)}
        */
-      executableDir(path25) {
-        if (path25 === void 0) return this._executableDir;
-        this._executableDir = path25;
+      executableDir(path26) {
+        if (path26 === void 0) return this._executableDir;
+        this._executableDir = path26;
         return this;
       }
       /**
@@ -3080,9 +3080,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
           helpWidth: context.helpWidth,
           outputHasColors: context.hasColors
         });
-        const text = helper.formatHelp(this, helper);
-        if (context.hasColors) return text;
-        return this._outputConfiguration.stripColor(text);
+        const text2 = helper.formatHelp(this, helper);
+        if (context.hasColors) return text2;
+        return this._outputConfiguration.stripColor(text2);
       }
       /**
        * @typedef HelpContext
@@ -3236,7 +3236,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @param {(string | Function)} text - string to add, or a function returning a string
        * @return {Command} `this` command for chaining
        */
-      addHelpText(position, text) {
+      addHelpText(position, text2) {
         const allowedValues = ["beforeAll", "before", "after", "afterAll"];
         if (!allowedValues.includes(position)) {
           throw new Error(`Unexpected value for position to addHelpText.
@@ -3245,10 +3245,10 @@ Expecting one of '${allowedValues.join("', '")}'`);
         const helpEvent = `${position}Help`;
         this.on(helpEvent, (context) => {
           let helpStr;
-          if (typeof text === "function") {
-            helpStr = text({ error: context.error, command: context.command });
+          if (typeof text2 === "function") {
+            helpStr = text2({ error: context.error, command: context.command });
           } else {
-            helpStr = text;
+            helpStr = text2;
           }
           if (helpStr) {
             context.write(`${helpStr}
@@ -3583,7 +3583,7 @@ function _supportsColor(haveStream, { streamIsTTY, sniffFlags = true } = {}) {
     return min;
   }
   if (import_node_process.default.platform === "win32") {
-    const osRelease = import_node_os.default.release().split(".");
+    const osRelease = import_node_os3.default.release().split(".");
     if (Number(osRelease[0]) >= 10 && Number(osRelease[2]) >= 10586) {
       return Number(osRelease[2]) >= 14931 ? 3 : 2;
     }
@@ -3642,11 +3642,11 @@ function createSupportsColor(stream, options = {}) {
   });
   return translateLevel(level);
 }
-var import_node_process, import_node_os, import_node_tty, env, flagForceColor, supportsColor, supports_color_default;
+var import_node_process, import_node_os3, import_node_tty, env, flagForceColor, supportsColor, supports_color_default;
 var init_supports_color = __esm({
   "node_modules/chalk/source/vendor/supports-color/index.js"() {
     import_node_process = __toESM(require("node:process"), 1);
-    import_node_os = __toESM(require("node:os"), 1);
+    import_node_os3 = __toESM(require("node:os"), 1);
     import_node_tty = __toESM(require("node:tty"), 1);
     ({ env } = import_node_process.default);
     if (hasFlag("no-color") || hasFlag("no-colors") || hasFlag("color=false") || hasFlag("color=never")) {
@@ -4073,12 +4073,12 @@ var init_mjs = __esm({
         for (const sig of signals) {
           this.#sigListeners[sig] = () => {
             const listeners = this.#process.listeners(sig);
-            let { count } = this.#emitter;
+            let { count: count2 } = this.#emitter;
             const p = process16;
             if (typeof p.__signal_exit_emitter__ === "object" && typeof p.__signal_exit_emitter__.count === "number") {
-              count += p.__signal_exit_emitter__.count;
+              count2 += p.__signal_exit_emitter__.count;
             }
-            if (listeners.length === count) {
+            if (listeners.length === count2) {
               this.unload();
               const ret = this.#emitter.emit("exit", null, sig);
               const s = sig === "SIGHUP" ? this.#hupSig : sig;
@@ -6405,9 +6405,9 @@ var init_ora = __esm({
         this.#linesToClear = this.#lineCount;
         return this;
       }
-      start(text) {
-        if (text) {
-          this.text = text;
+      start(text2) {
+        if (text2) {
+          this.text = text2;
         }
         if (this.#isSilent) {
           return this;
@@ -6450,17 +6450,17 @@ var init_ora = __esm({
         }
         return this;
       }
-      succeed(text) {
-        return this.stopAndPersist({ symbol: log_symbols_default.success, text });
+      succeed(text2) {
+        return this.stopAndPersist({ symbol: log_symbols_default.success, text: text2 });
       }
-      fail(text) {
-        return this.stopAndPersist({ symbol: log_symbols_default.error, text });
+      fail(text2) {
+        return this.stopAndPersist({ symbol: log_symbols_default.error, text: text2 });
       }
-      warn(text) {
-        return this.stopAndPersist({ symbol: log_symbols_default.warning, text });
+      warn(text2) {
+        return this.stopAndPersist({ symbol: log_symbols_default.warning, text: text2 });
       }
-      info(text) {
-        return this.stopAndPersist({ symbol: log_symbols_default.info, text });
+      info(text2) {
+        return this.stopAndPersist({ symbol: log_symbols_default.info, text: text2 });
       }
       stopAndPersist(options = {}) {
         if (this.#isSilent) {
@@ -6469,9 +6469,9 @@ var init_ora = __esm({
         const prefixText = options.prefixText ?? this.#prefixText;
         const fullPrefixText = this.#getFullPrefixText(prefixText, " ");
         const symbolText = options.symbol ?? " ";
-        const text = options.text ?? this.text;
+        const text2 = options.text ?? this.text;
         const separatorText = symbolText ? " " : "";
-        const fullText = typeof text === "string" ? separatorText + text : "";
+        const fullText = typeof text2 === "string" ? separatorText + text2 : "";
         const suffixText = options.suffixText ?? this.#suffixText;
         const fullSuffixText = this.#getFullSuffixText(suffixText, " ");
         const textToWrite = fullPrefixText + symbolText + fullText + fullSuffixText + "\n";
@@ -6486,7 +6486,7 @@ var init_ora = __esm({
 // node_modules/is-docker/index.js
 function hasDockerEnv() {
   try {
-    import_node_fs3.default.statSync("/.dockerenv");
+    import_node_fs4.default.statSync("/.dockerenv");
     return true;
   } catch {
     return false;
@@ -6494,7 +6494,7 @@ function hasDockerEnv() {
 }
 function hasDockerCGroup() {
   try {
-    return import_node_fs3.default.readFileSync("/proc/self/cgroup", "utf8").includes("docker");
+    return import_node_fs4.default.readFileSync("/proc/self/cgroup", "utf8").includes("docker");
   } catch {
     return false;
   }
@@ -6505,10 +6505,10 @@ function isDocker() {
   }
   return isDockerCached;
 }
-var import_node_fs3, isDockerCached;
+var import_node_fs4, isDockerCached;
 var init_is_docker = __esm({
   "node_modules/is-docker/index.js"() {
-    import_node_fs3 = __toESM(require("node:fs"), 1);
+    import_node_fs4 = __toESM(require("node:fs"), 1);
   }
 });
 
@@ -6519,14 +6519,14 @@ function isInsideContainer() {
   }
   return cachedResult;
 }
-var import_node_fs4, cachedResult, hasContainerEnv;
+var import_node_fs5, cachedResult, hasContainerEnv;
 var init_is_inside_container = __esm({
   "node_modules/is-inside-container/index.js"() {
-    import_node_fs4 = __toESM(require("node:fs"), 1);
+    import_node_fs5 = __toESM(require("node:fs"), 1);
     init_is_docker();
     hasContainerEnv = () => {
       try {
-        import_node_fs4.default.statSync("/run/.containerenv");
+        import_node_fs5.default.statSync("/run/.containerenv");
         return true;
       } catch {
         return false;
@@ -6536,25 +6536,25 @@ var init_is_inside_container = __esm({
 });
 
 // node_modules/is-wsl/index.js
-var import_node_process8, import_node_os4, import_node_fs5, isWsl, is_wsl_default;
+var import_node_process8, import_node_os5, import_node_fs6, isWsl, is_wsl_default;
 var init_is_wsl = __esm({
   "node_modules/is-wsl/index.js"() {
     import_node_process8 = __toESM(require("node:process"), 1);
-    import_node_os4 = __toESM(require("node:os"), 1);
-    import_node_fs5 = __toESM(require("node:fs"), 1);
+    import_node_os5 = __toESM(require("node:os"), 1);
+    import_node_fs6 = __toESM(require("node:fs"), 1);
     init_is_inside_container();
     isWsl = () => {
       if (import_node_process8.default.platform !== "linux") {
         return false;
       }
-      if (import_node_os4.default.release().toLowerCase().includes("microsoft")) {
+      if (import_node_os5.default.release().toLowerCase().includes("microsoft")) {
         if (isInsideContainer()) {
           return false;
         }
         return true;
       }
       try {
-        return import_node_fs5.default.readFileSync("/proc/version", "utf8").toLowerCase().includes("microsoft") ? !isInsideContainer() : false;
+        return import_node_fs6.default.readFileSync("/proc/version", "utf8").toLowerCase().includes("microsoft") ? !isInsideContainer() : false;
       } catch {
         return false;
       }
@@ -6564,11 +6564,11 @@ var init_is_wsl = __esm({
 });
 
 // node_modules/wsl-utils/index.js
-var import_node_process9, import_promises, wslDrivesMountPoint, powerShellPathFromWsl, powerShellPath;
+var import_node_process9, import_promises2, wslDrivesMountPoint, powerShellPathFromWsl, powerShellPath;
 var init_wsl_utils = __esm({
   "node_modules/wsl-utils/index.js"() {
     import_node_process9 = __toESM(require("node:process"), 1);
-    import_promises = __toESM(require("node:fs/promises"), 1);
+    import_promises2 = __toESM(require("node:fs/promises"), 1);
     init_is_wsl();
     init_is_wsl();
     wslDrivesMountPoint = /* @__PURE__ */ (() => {
@@ -6581,14 +6581,14 @@ var init_wsl_utils = __esm({
         const configFilePath = "/etc/wsl.conf";
         let isConfigFileExists = false;
         try {
-          await import_promises.default.access(configFilePath, import_promises.constants.F_OK);
+          await import_promises2.default.access(configFilePath, import_promises2.constants.F_OK);
           isConfigFileExists = true;
         } catch {
         }
         if (!isConfigFileExists) {
           return defaultMountPoint;
         }
-        const configContent = await import_promises.default.readFile(configFilePath, { encoding: "utf8" });
+        const configContent = await import_promises2.default.readFile(configFilePath, { encoding: "utf8" });
         const configMountPoint = /(?<!#.*)root\s*=\s*(?<mountPoint>.*)/g.exec(configContent);
         if (!configMountPoint) {
           return defaultMountPoint;
@@ -6823,24 +6823,24 @@ function detectPlatformBinary({ [platform]: platformBinary }, { wsl }) {
   }
   return detectArchBinary(platformBinary);
 }
-var import_node_process13, import_node_buffer, import_node_path3, import_node_url, import_node_util5, import_node_child_process5, import_promises2, import_meta, execFile5, __dirname2, localXdgOpenPath, platform, arch, pTryEach, baseOpen, open, openApp, apps, open_default;
+var import_node_process13, import_node_buffer, import_node_path4, import_node_url, import_node_util5, import_node_child_process5, import_promises3, import_meta, execFile5, __dirname2, localXdgOpenPath, platform, arch, pTryEach, baseOpen, open, openApp, apps, open_default;
 var init_open = __esm({
   "node_modules/open/index.js"() {
     import_node_process13 = __toESM(require("node:process"), 1);
     import_node_buffer = require("node:buffer");
-    import_node_path3 = __toESM(require("node:path"), 1);
+    import_node_path4 = __toESM(require("node:path"), 1);
     import_node_url = require("node:url");
     import_node_util5 = require("node:util");
     import_node_child_process5 = __toESM(require("node:child_process"), 1);
-    import_promises2 = __toESM(require("node:fs/promises"), 1);
+    import_promises3 = __toESM(require("node:fs/promises"), 1);
     init_wsl_utils();
     init_define_lazy_prop();
     init_default_browser();
     init_is_inside_container();
     import_meta = {};
     execFile5 = (0, import_node_util5.promisify)(import_node_child_process5.default.execFile);
-    __dirname2 = import_node_path3.default.dirname((0, import_node_url.fileURLToPath)(import_meta.url));
-    localXdgOpenPath = import_node_path3.default.join(__dirname2, "xdg-open");
+    __dirname2 = import_node_path4.default.dirname((0, import_node_url.fileURLToPath)(import_meta.url));
+    localXdgOpenPath = import_node_path4.default.join(__dirname2, "xdg-open");
     ({ platform, arch } = import_node_process13.default);
     pTryEach = async (array, mapper) => {
       let latestError;
@@ -6965,7 +6965,7 @@ var init_open = __esm({
           const isBundled = !__dirname2 || __dirname2 === "/";
           let exeLocalXdgOpen = false;
           try {
-            await import_promises2.default.access(localXdgOpenPath, import_promises2.constants.X_OK);
+            await import_promises3.default.access(localXdgOpenPath, import_promises3.constants.X_OK);
             exeLocalXdgOpen = true;
           } catch {
           }
@@ -7085,34 +7085,247 @@ var {
   Help
 } = import_index.default;
 
-// src/test-harness.ts
-var readSetting;
-function cliTestSetting(name) {
-  return readSetting?.(name);
+// ../api-client/src/client-identity.ts
+var import_node_crypto = require("node:crypto");
+var invocationId = (0, import_node_crypto.randomUUID)();
+var identity;
+function setClientIdentity(value) {
+  identity = { ...value, invocationId };
 }
-function cliTestHarnessActive() {
-  return readSetting !== void 0;
+function getClientIdentity() {
+  return identity ? { ...identity } : void 0;
+}
+function clientIdentityHeaders() {
+  if (!identity) return {};
+  return {
+    "User-Agent": `${identity.client}/${identity.version} (${process.platform}; node/${process.versions.node.split(".")[0]})`,
+    "X-Apex-Invocation-Id": invocationId,
+    ...identity.command ? { "X-Apex-Client-Command": identity.command } : {}
+  };
 }
 
-// src/cli.ts
-init_source();
+// ../api-client/src/http.ts
+var APEX_API_VERSION_HEADER = "x-apex-api-version";
+var SUPPORTED_APEX_API_VERSION = "1";
+function extractErrorMessage(json, status3) {
+  if (!json) return `HTTP ${status3}`;
+  const error = json.error;
+  if (typeof error === "string" && error.trim()) return error;
+  if (error && typeof error === "object") {
+    const message = error.message;
+    if (typeof message === "string" && message.trim()) return message;
+  }
+  return typeof json.message === "string" && json.message.trim() ? json.message : `HTTP ${status3}`;
+}
+function extractErrorDetails(json) {
+  if (!json) return void 0;
+  const nested = json.error && typeof json.error === "object" && !Array.isArray(json.error) ? json.error : null;
+  const code = typeof json.code === "string" ? json.code : typeof nested?.code === "string" ? nested.code : void 0;
+  for (const value of [json.details, json.meta, nested?.details]) if (value && typeof value === "object" && !Array.isArray(value)) return { ...value, ...code ? { code } : {} };
+  const details = Object.fromEntries(["limit", "current", "max", "actual", "field", "code"].filter((key) => key in json).map((key) => [key, json[key]]));
+  if (code) details.code = code;
+  return Object.keys(details).length ? details : void 0;
+}
+var warnedAboutVersionSkew = false;
+function createHttpClient(creds, options) {
+  const warn3 = options.warn ?? ((message) => process.stderr.write(message));
+  function inspectVersion(headers) {
+    const value = headers.get(APEX_API_VERSION_HEADER);
+    if (!value || warnedAboutVersionSkew) return;
+    const version = Number(value);
+    if (!Number.isFinite(version) || version === Number(SUPPORTED_APEX_API_VERSION)) return;
+    warnedAboutVersionSkew = true;
+    warn3(version > 1 ? "CLI is behind the server \u2014 update.\n" : "Server API is older than this CLI supports.\n");
+  }
+  async function request2(method, path25, body5, requestTimeoutMs, form = false) {
+    const started2 = performance.now();
+    const observe = (status3, requestId2, errorCode) => {
+      try {
+        options.onResponse?.({ method, path: path25, status: status3, requestId: requestId2, errorCode: typeof errorCode === "string" ? errorCode : void 0, durationMs: Math.max(0, Math.round(performance.now() - started2)) });
+      } catch {
+      }
+    };
+    const fallback2 = form ? 12e4 : 3e4;
+    const configured = Number(process.env.APEX_TIMEOUT_MS ?? fallback2);
+    const defaultMs = Number.isFinite(configured) && configured > 0 ? configured : fallback2;
+    const timeoutMs = requestTimeoutMs === void 0 ? defaultMs : Math.max(1, Math.min(defaultMs, requestTimeoutMs));
+    const headers = { ...clientIdentityHeaders(), Authorization: `Bearer ${creds.apiKey}` };
+    if (!form) headers["Content-Type"] = "application/json";
+    if (creds.credentialKind === "user" || creds.apiKey.startsWith("apx_uk_")) {
+      if (creds.resolvedContext?.orgId) headers["X-Apex-Org"] = creds.resolvedContext.orgId;
+      if (creds.resolvedContext?.shopId) headers["X-Apex-Shop"] = creds.resolvedContext.shopId;
+    }
+    const mock = options.transport?.(method, path25, body5, headers);
+    if (mock !== void 0) {
+      const version = options.testTransportVersion?.();
+      if (version) inspectVersion(new Headers({ [APEX_API_VERSION_HEADER]: version }));
+      observe(mock.status, mock.requestId, mock.errorDetails?.code);
+      return mock;
+    }
+    let response;
+    try {
+      response = await fetch(`${creds.baseUrl}${path25}`, { method, headers, body: form ? body5 : body5 ? JSON.stringify(body5) : void 0, signal: AbortSignal.timeout(timeoutMs) });
+    } catch (error) {
+      const outer = error && typeof error === "object" ? error : void 0;
+      const nested = outer?.cause && typeof outer.cause === "object" ? outer.cause : void 0;
+      return options.onNetworkError({
+        baseUrl: creds.baseUrl,
+        timeoutMs,
+        cause: error instanceof Error ? error.message : String(error),
+        code: typeof nested?.code === "string" ? nested.code : typeof outer?.code === "string" ? outer.code : void 0,
+        name: typeof outer?.name === "string" ? outer.name : void 0,
+        causeMessage: typeof nested?.message === "string" ? nested.message : void 0
+      });
+    }
+    inspectVersion(response.headers);
+    const json = await response.json().catch(() => null);
+    const requestId = response.headers.get("x-request-id") ?? response.headers.get("x-vercel-id") ?? response.headers.get("cf-ray");
+    observe(response.status, requestId, extractErrorDetails(json)?.code);
+    if (!response.ok) return { ok: false, status: response.status, data: json, error: extractErrorMessage(json, response.status), errorDetails: extractErrorDetails(json), requestId, retryAfter: response.headers.get("retry-after"), rateLimit: { limit: response.headers.get("x-ratelimit-limit"), remaining: response.headers.get("x-ratelimit-remaining"), reset: response.headers.get("x-ratelimit-reset") } };
+    return { ok: true, status: response.status, data: json };
+  }
+  return { request: (method, path25, body5, timeoutMs) => request2(method, path25, body5, timeoutMs), requestForm: (method, path25, body5) => request2(method, path25, body5, void 0, true) };
+}
 
-// src/commands/login.ts
-init_source();
-var import_node_crypto2 = __toESM(require("node:crypto"));
-var import_node_http = __toESM(require("node:http"));
-var import_node_os5 = __toESM(require("node:os"));
-var import_node_readline2 = __toESM(require("node:readline"));
+// ../api-client/src/credentials.ts
+var import_node_fs = __toESM(require("node:fs"), 1);
+var import_node_os = __toESM(require("node:os"), 1);
+var import_node_path = __toESM(require("node:path"), 1);
+function readStoredCredentials(file = import_node_path.default.join(import_node_os.default.homedir(), ".drip", "credentials.json")) {
+  try {
+    return JSON.parse(import_node_fs.default.readFileSync(file, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function resolveCredentials(env2 = process.env, stored = readStoredCredentials()) {
+  const context = {
+    orgId: env2.DRIP_ORG || stored?.context?.orgId,
+    shopId: env2.DRIP_SHOP || stored?.context?.shopId
+  };
+  const environmentApiKey = env2.APEX_API_KEY || env2.DRIP_API_KEY;
+  const environmentBaseUrl = env2.APEX_BASE_URL || env2.DRIP_BASE_URL;
+  if (environmentApiKey) {
+    const user = environmentApiKey.startsWith("apx_uk_");
+    return {
+      ...stored ?? { apiKey: "", baseUrl: "https://app.drip-apex.com" },
+      apiKey: environmentApiKey,
+      baseUrl: environmentBaseUrl ?? "https://app.drip-apex.com",
+      credentialKind: user ? "user" : "shop",
+      resolvedContext: context
+    };
+  }
+  if (stored?.userApiKey) return {
+    ...stored,
+    apiKey: stored.userApiKey,
+    baseUrl: stored.userBaseUrl ?? stored.baseUrl,
+    credentialKind: "user",
+    resolvedContext: context
+  };
+  if (stored?.apiKey) return { ...stored, credentialKind: "shop", resolvedContext: context };
+  return null;
+}
 
 // src/config.ts
-var import_node_fs2 = __toESM(require("node:fs"));
+var import_node_fs3 = __toESM(require("node:fs"));
+var import_node_path3 = __toESM(require("node:path"));
+var import_node_os4 = __toESM(require("node:os"));
+
+// src/update.ts
+var import_node_fs2 = require("node:fs");
+var import_promises = require("node:fs/promises");
+var import_node_os2 = require("node:os");
 var import_node_path2 = __toESM(require("node:path"));
-var import_node_os3 = __toESM(require("node:os"));
+var TTL = 24 * 60 * 60 * 1e3;
+var FAILURE_TTL = 60 * 60 * 1e3;
+function versionParts(version) {
+  return /^\d+\.\d+\.\d+$/.test(version) ? version.split(".").map(Number) : void 0;
+}
+async function checkForUpdate(current) {
+  if (process.env.APEX_NO_UPDATE_CHECK === "1") return;
+  if (process.env[["APEX", "CLI", "MOCK", "API"].join("_")] === "1" || process.env.CI) return;
+  const installed = versionParts(current);
+  if (!installed) return;
+  const controller = new AbortController();
+  let timer;
+  const cachePath = import_node_path2.default.join((0, import_node_os2.homedir)(), ".drip", "update-check.json");
+  const lookup2 = async () => {
+    let latest;
+    const remember = async (value) => {
+      try {
+        await (0, import_promises.mkdir)(import_node_path2.default.dirname(cachePath), { recursive: true });
+        await (0, import_promises.writeFile)(cachePath, JSON.stringify({ latest: value, checked_at: Date.now() }), {
+          mode: 384
+        });
+      } catch {
+      }
+    };
+    try {
+      const cache = JSON.parse(await (0, import_promises.readFile)(cachePath, "utf8"));
+      const age = Date.now() - cache.checked_at;
+      if (cache.latest === null && typeof cache.checked_at === "number" && age >= 0 && age < FAILURE_TTL)
+        return;
+      if (typeof cache.checked_at === "number" && age >= 0 && age < TTL && typeof cache.latest === "string" && versionParts(cache.latest))
+        latest = cache.latest;
+    } catch {
+    }
+    if (!latest && !controller.signal.aborted) {
+      let body5;
+      try {
+        const response = await fetch("https://registry.npmjs.org/@drip-apex%2Fapex-cli/latest", {
+          headers: { Accept: "application/json" },
+          signal: controller.signal
+        });
+        body5 = response.ok ? await response.json() : void 0;
+      } catch {
+        body5 = void 0;
+      }
+      if (typeof body5?.version !== "string" || !versionParts(body5.version)) {
+        await remember(null);
+        return;
+      }
+      latest = body5.version;
+      await remember(latest);
+    }
+    if (!latest) return;
+    const available = versionParts(latest);
+    const difference = available.findIndex((part, index) => part !== installed[index]);
+    if (difference < 0 || available[difference] < installed[difference]) return;
+    return {
+      current,
+      latest,
+      breaking: available[0] !== installed[0] || installed[0] === 0 && available[1] !== installed[1],
+      notes_url: "https://docs.drip-apex.com/docs/cli/commands-output"
+    };
+  };
+  try {
+    return await Promise.race([
+      lookup2(),
+      new Promise((resolve2) => {
+        timer = setTimeout(() => {
+          controller.abort();
+          try {
+            (0, import_node_fs2.mkdirSync)(import_node_path2.default.dirname(cachePath), { recursive: true });
+            (0, import_node_fs2.writeFileSync)(cachePath, JSON.stringify({ latest: null, checked_at: Date.now() }), {
+              mode: 384
+            });
+          } catch {
+          }
+          resolve2(void 0);
+        }, 900);
+      })
+    ]);
+  } catch {
+    return;
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
 
 // package.json
 var package_default = {
   name: "@drip-apex/apex-cli",
-  version: "0.13.0",
+  version: "0.14.1",
   license: "MIT",
   description: "Apex CLI for managing experiments, approved roadmap ideas, and draft workspaces.",
   private: false,
@@ -7180,18 +7393,20 @@ function recordApiResponse(response) {
     status: response.status,
     body: response.data ?? null,
     message: response.error,
-    details: response.errorDetails
+    details: response.errorDetails,
+    requestId: response.requestId,
+    retryAfter: response.retryAfter
   });
   if (recentApiFailures.length > MAX_RECORDED_API_FAILURES) recentApiFailures.shift();
 }
 function matchApiFailure(message, details) {
   const byDetails = details !== void 0 ? recentApiFailures.find((entry) => entry.details === details) : void 0;
-  if (byDetails) return { status: byDetails.status, body: byDetails.body };
+  if (byDetails) return byDetails;
   const byMessage = recentApiFailures.filter(
     (entry) => Boolean(entry.message) && message.includes(entry.message)
   );
   if (byMessage.length !== 1) return void 0;
-  return { status: byMessage[0].status, body: byMessage[0].body };
+  return byMessage[0];
 }
 var CliError = class extends Error {
   exitCode;
@@ -7206,7 +7421,12 @@ var CliError = class extends Error {
   }
 };
 function apiFailureOf(response) {
-  return response.ok ? void 0 : { status: response.status, body: response.data ?? null };
+  return response.ok ? void 0 : {
+    status: response.status,
+    body: response.data ?? null,
+    requestId: response.requestId,
+    retryAfter: response.retryAfter
+  };
 }
 var initialEnvironmentApiKey = process.env.APEX_API_KEY || process.env.DRIP_API_KEY;
 var envelopeContext = {
@@ -7253,7 +7473,7 @@ function installJsonStdoutGuard() {
   if (rawStdoutWrite) return;
   const stdout = process.stdout;
   const original = stdout.write.bind(stdout);
-  rawStdoutWrite = (text) => original(text);
+  rawStdoutWrite = (text2) => original(text2);
   stdout.write = ((chunk, ...args) => process.stderr.write(
     chunk,
     ...args
@@ -7263,6 +7483,7 @@ function isJsonMode() {
   return jsonMode;
 }
 function configureRuntime(command) {
+  setClientIdentity({ client: "apex-cli", version: CLI_VERSION, command: commandPath(command) });
   commandName = commandPath(command) || commandName;
   jsonMode = shouldUseJson(command);
   if (!jsonMode) return;
@@ -7274,10 +7495,10 @@ function configureRuntime(command) {
   };
 }
 function writeJsonDocument(envelope) {
-  const text = `${JSON.stringify(envelope, null, 2)}
+  const text2 = `${JSON.stringify({ ...envelope, ...updateNotice ? { update: updateNotice } : {} }, null, 2)}
 `;
   if (wroteEnvelope) {
-    process.stderr.write(text);
+    process.stderr.write(text2);
     return;
   }
   wroteEnvelope = true;
@@ -7286,8 +7507,8 @@ function writeJsonDocument(envelope) {
   restoreConsoleLog();
   if (pendingHumanLines.length > 0) process.stderr.write(`${pendingHumanLines.join("\n")}
 `);
-  if (rawStdoutWrite) rawStdoutWrite(text);
-  else process.stdout.write(text);
+  if (rawStdoutWrite) rawStdoutWrite(text2);
+  else process.stdout.write(text2);
 }
 function flushFallbackEnvelope() {
   if (!jsonMode || wroteEnvelope) return;
@@ -7315,6 +7536,11 @@ function writeEnvelope(data, command = commandName) {
   };
   writeJsonDocument(envelope);
 }
+function writeRawCommandOutput(text2) {
+  wroteEnvelope = true;
+  if (rawStdoutWrite) return rawStdoutWrite(text2);
+  return process.stdout.write(text2);
+}
 function writeErrorEnvelope(error, command = commandName) {
   const envelope = {
     ok: false,
@@ -7323,8 +7549,11 @@ function writeErrorEnvelope(error, command = commandName) {
     error: {
       message: error.message,
       code: error.exitCode,
+      reason: errorReason(error),
+      next_steps: errorNextSteps(error),
+      ...error.api?.requestId ? { request_id: error.api.requestId } : {},
       ...error.details ? { details: error.details } : {},
-      ...error.api ? { api: error.api } : {}
+      ...error.api ? { api: { status: error.api.status, body: error.api.body } } : {}
     },
     context: envelopeContext
   };
@@ -7350,18 +7579,18 @@ function commandPath(command) {
 function fail(command, message, exitCode = EXIT_CODES.general, details, api) {
   throw new CliError(message, exitCode, details, api);
 }
-function classifyStatus(status2) {
-  if (status2 === 401 || status2 === 403) return EXIT_CODES.auth;
-  if (status2 === 409) return EXIT_CODES.conflict;
-  if (status2 === 400 || status2 === 413 || status2 === 422) return EXIT_CODES.validation;
+function classifyStatus(status3) {
+  if (status3 === 401 || status3 === 403) return EXIT_CODES.auth;
+  if (status3 === 409) return EXIT_CODES.conflict;
+  if (status3 === 400 || status3 === 413 || status3 === 422) return EXIT_CODES.validation;
   return EXIT_CODES.general;
 }
-function classifyApiError(status2, details) {
+function classifyApiError(status3, details) {
   const code = details?.code;
   if (code === "shop_context_required" || code === "org_context_required")
     return EXIT_CODES.validation;
   if (code === "shop_access_denied" || code === "org_access_denied") return EXIT_CODES.auth;
-  return classifyStatus(status2);
+  return classifyStatus(status3);
 }
 function confirmationRequired(command, message, retry) {
   return fail(command, message, EXIT_CODES.confirmationRequired, { retry });
@@ -7408,33 +7637,25 @@ async function createSpinner(message) {
   }
   return spinner.start();
 }
+var updateNotice;
 async function maybeCheckForUpdate() {
-  if (!process.stderr.isTTY || process.env.APEX_NO_UPDATE_CHECK === "1" || CLI_VERSION === "unknown")
-    return;
-  try {
-    const res = await fetch("https://registry.npmjs.org/@drip-apex%2Fapex-cli/latest", {
-      headers: { Accept: "application/json" },
-      signal: AbortSignal.timeout(900)
-    });
-    if (!res.ok) return;
-    const latest = await res.json();
-    if (latest.version && latest.version !== CLI_VERSION) {
-      process.stderr.write(`Apex CLI ${latest.version} is available; current ${CLI_VERSION}.
+  updateNotice = await checkForUpdate(CLI_VERSION);
+  if (updateNotice)
+    process.stderr.write(`Apex CLI ${updateNotice.latest} is available; current ${CLI_VERSION}.
 `);
-    }
-  } catch {
-  }
 }
 async function handleCliError(err, command) {
   if (err && typeof err === "object" && "exitCode" in err && err.exitCode === 0) {
     flushFallbackEnvelope();
+    await finishInvocation({ exitCode: 0, error: err });
     drainAndExit(0);
     return;
   }
   const commanderExitCode = err && typeof err === "object" && "exitCode" in err && typeof err.exitCode === "number" ? err.exitCode : null;
   const cliError = err instanceof CliError ? err : new CliError(
     err instanceof Error ? err.message : String(err),
-    commanderExitCode === EXIT_CODES.general ? EXIT_CODES.validation : commanderExitCode ?? EXIT_CODES.general
+    commanderExitCode === EXIT_CODES.general ? EXIT_CODES.validation : commanderExitCode ?? EXIT_CODES.general,
+    err && typeof err === "object" && "code" in err && ["ENOENT", "EACCES", "EPERM", "EISDIR", "ENOTDIR", "ENOSPC"].includes(String(err.code)) ? { code: "local_file_error" } : void 0
   );
   const interceptedCommand = err && typeof err === "object" ? interceptedCommands.get(err) : void 0;
   if (shouldUseJson(command)) {
@@ -7443,26 +7664,94 @@ async function handleCliError(err, command) {
       interceptedCommand ? commandPath(interceptedCommand) : commandName
     );
   } else {
-    process.stderr.write(`Error: ${cliError.message}
+    process.stderr.write(
+      `Error: ${cliError.message}${cliError.api?.requestId ? ` (request ${cliError.api.requestId})` : ""}
+`
+    );
+    for (const step of errorNextSteps(cliError))
+      process.stderr.write(`Next: ${step.command} - ${step.why}
 `);
     if (cliError.details?.retry) {
       process.stderr.write(`Retry: ${String(cliError.details.retry)}
 `);
     }
   }
+  await finishInvocation({ exitCode: cliError.exitCode, error: err });
   drainAndExit(cliError.exitCode);
 }
-
-// ../api-client/src/credentials.ts
-var import_node_fs = __toESM(require("node:fs"), 1);
-var import_node_os2 = __toESM(require("node:os"), 1);
-var import_node_path = __toESM(require("node:path"), 1);
-function readStoredCredentials(file = import_node_path.default.join(import_node_os2.default.homedir(), ".drip", "credentials.json")) {
-  try {
-    return JSON.parse(import_node_fs.default.readFileSync(file, "utf8"));
-  } catch {
-    return null;
+function errorReason(error) {
+  const details = error.details;
+  if (!error.api && typeof details?.baseUrl === "string" && typeof details.reason === "string")
+    return `network_${details.reason}`;
+  const body5 = error.api?.body;
+  const code = body5?.code ?? body5?.error?.code ?? (error.api ? details?.code : void 0);
+  if (typeof code === "string" && code) return code;
+  if (["shop_context_required", "local_file_error", "validation_failed"].includes(
+    String(details?.code)
+  ))
+    return String(details?.code);
+  const status3 = error.api?.status;
+  if (status3 === 401) return "auth_required";
+  if (status3 === 403) return "auth_forbidden";
+  if (status3 === 404) return "not_found";
+  if (status3 === 429) return "rate_limited";
+  if (status3 === 409 || error.exitCode === EXIT_CODES.conflict) return "conflict";
+  if (error.exitCode === EXIT_CODES.auth) return "auth_required";
+  if (error.exitCode === EXIT_CODES.confirmationRequired) return "confirmation_required";
+  if (error.exitCode === EXIT_CODES.validation) return "validation_failed";
+  return "internal_error";
+}
+function errorNextSteps(error) {
+  const reason2 = errorReason(error);
+  const steps = [];
+  if (reason2 === "auth_required" || error.api?.status === 401) {
+    steps.push({ command: "apex login", why: "Authenticate with a valid API key." });
+    if (!error.api)
+      steps.push({
+        command: "set APEX_API_KEY",
+        why: "Provide credentials for a headless invocation."
+      });
   }
+  if (reason2 === "auth_forbidden" || error.api?.status === 403)
+    steps.push({ command: "apex whoami", why: "Check the API key scope and permissions." });
+  if (reason2 === "shop_context_required")
+    steps.push({
+      command: typeof error.details?.retry === "string" ? error.details.retry : "apex use <org>/<shop>",
+      why: "Select the shop for this command, or pass --shop <id>."
+    });
+  if (reason2.startsWith("network_")) {
+    steps.push(
+      { command: "check APEX_BASE_URL", why: "Verify the API host and network access." },
+      { command: "retry", why: "Retry the command after connectivity is restored." }
+    );
+    if (reason2.includes("timeout"))
+      steps.push({
+        command: "set APEX_TIMEOUT_MS",
+        why: "Increase the request timeout if needed."
+      });
+  }
+  if (reason2 === "rate_limited" || error.api?.status === 429)
+    steps.push({
+      command: "wait",
+      why: error.api?.retryAfter ? `Wait for Retry-After: ${error.api.retryAfter} before retrying.` : "Wait before retrying the request."
+    });
+  if (typeof error.details?.retry === "string" && reason2 !== "shop_context_required")
+    steps.push({
+      command: error.details.retry,
+      why: "Review the requested action before retrying."
+    });
+  const hints = error.details?.next_steps;
+  if (Array.isArray(hints))
+    for (const hint of hints) {
+      if (hint && typeof hint.command === "string" && typeof hint.why === "string")
+        steps.push({ command: hint.command, why: hint.why });
+    }
+  if (reason2 === "validation_failed" && error.details?.plan)
+    steps.push({
+      command: "apex experiments plan",
+      why: "Correct the reported blocking issues, then validate the folder again."
+    });
+  return steps;
 }
 
 // src/config.ts
@@ -7534,8 +7823,8 @@ function configureInvocationContext() {
     shop_id: context.shopId ?? null
   });
 }
-var DRIP_DIR = import_node_path2.default.join(import_node_os3.default.homedir(), ".drip");
-var CREDS_FILE = import_node_path2.default.join(DRIP_DIR, "credentials.json");
+var DRIP_DIR = import_node_path3.default.join(import_node_os4.default.homedir(), ".drip");
+var CREDS_FILE = import_node_path3.default.join(DRIP_DIR, "credentials.json");
 function getStoredCredentials() {
   return readStoredCredentials(CREDS_FILE);
 }
@@ -7561,14 +7850,14 @@ function getCredentials() {
 }
 function saveCredentials(creds) {
   const { credentialKind: _kind, resolvedContext: _resolved, ...persisted } = creds;
-  import_node_fs2.default.mkdirSync(DRIP_DIR, { recursive: true });
-  import_node_fs2.default.writeFileSync(CREDS_FILE, JSON.stringify(persisted, null, 2) + "\n", {
+  import_node_fs3.default.mkdirSync(DRIP_DIR, { recursive: true });
+  import_node_fs3.default.writeFileSync(CREDS_FILE, JSON.stringify(persisted, null, 2) + "\n", {
     mode: 384
   });
 }
 function clearCredentials() {
   try {
-    import_node_fs2.default.unlinkSync(CREDS_FILE);
+    import_node_fs3.default.unlinkSync(CREDS_FILE);
   } catch {
   }
 }
@@ -7659,89 +7948,264 @@ var CONFIG_NAMES = [".drip.config.ts", ".drip.config.js", "drip.config.ts", "dri
 function findConfigPath() {
   const cwd = process.cwd();
   for (const name of CONFIG_NAMES) {
-    const p = import_node_path2.default.join(cwd, name);
-    if (import_node_fs2.default.existsSync(p)) return p;
+    const p = import_node_path3.default.join(cwd, name);
+    if (import_node_fs3.default.existsSync(p)) return p;
   }
   return null;
 }
 
-// src/api.ts
-var import_node_crypto = require("node:crypto");
-
-// ../api-client/src/http.ts
-var APEX_API_VERSION_HEADER = "x-apex-api-version";
-var SUPPORTED_APEX_API_VERSION = "1";
-function extractErrorMessage(json, status2) {
-  if (!json) return `HTTP ${status2}`;
-  const error = json.error;
-  if (typeof error === "string" && error.trim()) return error;
-  if (error && typeof error === "object") {
-    const message = error.message;
-    if (typeof message === "string" && message.trim()) return message;
-  }
-  return typeof json.message === "string" && json.message.trim() ? json.message : `HTTP ${status2}`;
+// src/test-harness.ts
+var readSetting;
+function cliTestSetting(name) {
+  return readSetting?.(name);
 }
-function extractErrorDetails(json) {
-  if (!json) return void 0;
-  const nested = json.error && typeof json.error === "object" && !Array.isArray(json.error) ? json.error : null;
-  const code = typeof json.code === "string" ? json.code : typeof nested?.code === "string" ? nested.code : void 0;
-  for (const value of [json.details, json.meta, nested?.details]) if (value && typeof value === "object" && !Array.isArray(value)) return { ...value, ...code ? { code } : {} };
-  const details = Object.fromEntries(["limit", "current", "max", "actual", "field", "code"].filter((key) => key in json).map((key) => [key, json[key]]));
-  if (code) details.code = code;
-  return Object.keys(details).length ? details : void 0;
+function cliTestHarnessActive() {
+  return readSetting !== void 0;
 }
-var warnedAboutVersionSkew = false;
-function createHttpClient(creds, options) {
-  const warn3 = options.warn ?? ((message) => process.stderr.write(message));
-  function inspectVersion(headers) {
-    const value = headers.get(APEX_API_VERSION_HEADER);
-    if (!value || warnedAboutVersionSkew) return;
-    const version = Number(value);
-    if (!Number.isFinite(version) || version === Number(SUPPORTED_APEX_API_VERSION)) return;
-    warnedAboutVersionSkew = true;
-    warn3(version > 1 ? "CLI is behind the server \u2014 update.\n" : "Server API is older than this CLI supports.\n");
-  }
-  async function request2(method, path24, body5, requestTimeoutMs, form = false) {
-    const mock = options.transport?.(method, path24, body5);
-    if (mock !== void 0) {
-      const version = options.testTransportVersion?.();
-      if (version) inspectVersion(new Headers({ [APEX_API_VERSION_HEADER]: version }));
-      return mock;
-    }
-    const fallback2 = form ? 12e4 : 3e4;
-    const configured = Number(process.env.APEX_TIMEOUT_MS ?? fallback2);
-    const defaultMs = Number.isFinite(configured) && configured > 0 ? configured : fallback2;
-    const timeoutMs = requestTimeoutMs === void 0 ? defaultMs : Math.max(1, Math.min(defaultMs, requestTimeoutMs));
-    const headers = { Authorization: `Bearer ${creds.apiKey}` };
-    if (!form) headers["Content-Type"] = "application/json";
-    if (creds.credentialKind === "user" || creds.apiKey.startsWith("apx_uk_")) {
-      if (creds.resolvedContext?.orgId) headers["X-Apex-Org"] = creds.resolvedContext.orgId;
-      if (creds.resolvedContext?.shopId) headers["X-Apex-Shop"] = creds.resolvedContext.shopId;
-    }
-    let response;
-    try {
-      response = await fetch(`${creds.baseUrl}${path24}`, { method, headers, body: form ? body5 : body5 ? JSON.stringify(body5) : void 0, signal: AbortSignal.timeout(timeoutMs) });
-    } catch (error) {
-      const outer = error && typeof error === "object" ? error : void 0;
-      const nested = outer?.cause && typeof outer.cause === "object" ? outer.cause : void 0;
-      return options.onNetworkError({
-        baseUrl: creds.baseUrl,
-        timeoutMs,
-        cause: error instanceof Error ? error.message : String(error),
-        code: typeof nested?.code === "string" ? nested.code : typeof outer?.code === "string" ? outer.code : void 0,
-        name: typeof outer?.name === "string" ? outer.name : void 0,
-        causeMessage: typeof nested?.message === "string" ? nested.message : void 0
-      });
+
+// src/telemetry.ts
+var started = performance.now();
+var invocation;
+var firstError;
+var apiCalls = 0;
+var finished = false;
+function beginInvocation(command, context = {}) {
+  const names = /* @__PURE__ */ new Set();
+  for (let current = command; current; current = current.parent) {
+    for (const option of current.options) {
+      const name = option.attributeName();
+      const source = current.getOptionValueSource(name);
+      if (source && source !== "default") names.add(name);
     }
-    inspectVersion(response.headers);
-    const json = await response.json().catch(() => null);
-    if (!response.ok) return { ok: false, status: response.status, data: json, error: extractErrorMessage(json, response.status), errorDetails: extractErrorDetails(json), requestId: response.headers.get("x-request-id"), rateLimit: { limit: response.headers.get("x-ratelimit-limit"), remaining: response.headers.get("x-ratelimit-remaining"), reset: response.headers.get("x-ratelimit-reset") } };
-    return { ok: true, status: response.status, data: json };
   }
-  return { request: (method, path24, body5, timeoutMs) => request2(method, path24, body5, timeoutMs), requestForm: (method, path24, body5) => request2(method, path24, body5, void 0, true) };
+  invocation = {
+    command: commandPath(command).replace(/^apex\s+/, ""),
+    option_names: [...names].sort(),
+    json_mode: shouldUseJson(command),
+    tty: process.stdout.isTTY === true,
+    credential_kind: process.env.APEX_API_KEY || process.env.DRIP_API_KEY ? "env" : defaultCredentialKind(getCredentials()),
+    org_id: context.orgId,
+    shop_id: context.shopId
+  };
+}
+var staticRouteSegments = /* @__PURE__ */ new Set([
+  "account",
+  "activate",
+  "admin",
+  "analytics",
+  "api",
+  "apply",
+  "approve",
+  "approved",
+  "archive",
+  "assets",
+  "audit-logs",
+  "backlog",
+  "brand-context",
+  "build",
+  "bulk",
+  "by-slug",
+  "cli",
+  "complete",
+  "conflicts",
+  "consent",
+  "context",
+  "count",
+  "create",
+  "current",
+  "data-deletion",
+  "data-export",
+  "deliveries",
+  "design",
+  "discovery",
+  "domains",
+  "duplicate",
+  "entry-exit",
+  "environments",
+  "evidence",
+  "exclusion-groups",
+  "experiments",
+  "external-pixels",
+  "external-tracking",
+  "fields",
+  "files",
+  "filesystem",
+  "flags",
+  "funnels",
+  "generate",
+  "geo",
+  "goals",
+  "handoff",
+  "harness",
+  "idea",
+  "ideas",
+  "inbox",
+  "install-domains",
+  "invitations",
+  "items",
+  "keys",
+  "landing-pages",
+  "latency",
+  "list",
+  "manifest",
+  "me",
+  "members",
+  "messages",
+  "mine",
+  "org",
+  "organizations",
+  "orgs",
+  "pages",
+  "pause",
+  "personalizations",
+  "plan",
+  "preview-sessions",
+  "profile",
+  "publish",
+  "qa",
+  "quarantine",
+  "read-state",
+  "realtime",
+  "recipes",
+  "reject",
+  "restore",
+  "results",
+  "revisions",
+  "roadmap",
+  "run",
+  "runs",
+  "runtime-settings",
+  "screenshots",
+  "search",
+  "segments",
+  "sessions",
+  "settings",
+  "shops",
+  "signals",
+  "simulate-trigger",
+  "snippet",
+  "sos",
+  "start",
+  "stats",
+  "status",
+  "suggest-goals",
+  "summary",
+  "targeting",
+  "team",
+  "telemetry",
+  "test",
+  "timeseries",
+  "tracking",
+  "traffic",
+  "triggers",
+  "url-inventory",
+  "v1",
+  "variations",
+  "verify",
+  "versions",
+  "visitor-series",
+  "webhooks",
+  "workspace"
+]);
+function normalizeRoute(path25) {
+  if (!path25.startsWith("/api/")) return ":route";
+  const parts = path25.split(/[?#]/, 1)[0].split("/");
+  const files = parts.indexOf("files");
+  if (files !== -1 && parts.length > files + 1) parts.splice(files + 1, parts.length, ":id");
+  return parts.map((part) => !part || staticRouteSegments.has(part) ? part : ":id").join("/");
+}
+function recordApiResponse2(response) {
+  apiCalls++;
+  if (response.status >= 400 && !firstError)
+    firstError = { ...response, path: normalizeRoute(response.path) };
+}
+function classifyError(exitCode, error, status3) {
+  const detail5 = error && typeof error === "object" ? error : {};
+  if (exitCode === 0) return "ok";
+  if (detail5.code === "commander.unknownCommand") return "unknown_command";
+  if (detail5.code?.startsWith("commander.")) return "validation";
+  if (exitCode === 4) return "confirmation_required";
+  if (status3 === 401 || status3 === 403 || exitCode === 2) return "auth";
+  if (status3 === 404) return "not_found";
+  if (status3 === 429) return "rate_limited";
+  if (status3 === 409 || exitCode === 5) return "conflict";
+  if (status3 && status3 >= 500) return "server";
+  if (status3 === 400 || status3 === 422 || exitCode === 3) return "validation";
+  if (Boolean(
+    detail5.details?.reason && ["network", "dns", "timeout", "tls", "refused", "reset", "unknown"].includes(
+      detail5.details.reason
+    )
+  ) || detail5.details?.code === "network_error" || detail5.name === "TimeoutError")
+    return "network";
+  return "internal";
+}
+async function finishInvocation({
+  exitCode: rawExitCode,
+  error
+}) {
+  const exitCode = Number(rawExitCode);
+  if (finished) return;
+  finished = true;
+  await (async () => {
+    if (process.env.APEX_TELEMETRY === "0" || process.env.NODE_ENV === "test" || cliTestHarnessActive())
+      return;
+    const stored = getStoredCredentials();
+    const creds = resolveCredentials(void 0, stored);
+    if (!creds) return;
+    if (invocation)
+      creds.resolvedContext = {
+        orgId: typeof invocation.org_id === "string" ? invocation.org_id : void 0,
+        shopId: typeof invocation.shop_id === "string" ? invocation.shop_id : void 0
+      };
+    const code = error && typeof error === "object" && "code" in error ? String(error.code) : "";
+    const commanderExit = code.startsWith("commander.");
+    const parse3 = commanderExit && exitCode !== 0;
+    const token = commanderExit ? process.argv.slice(2).find((token2) => !token2.startsWith("-")) : void 0;
+    const attempted = token && (/^(?:apx_|sk_|pk_|rk_|ghp_|gho_|xox|Bearer)/.test(token) || /^[A-Za-z0-9_-]{24,}$/.test(token) || /:\/\/|[/\\@=]/.test(token) || token.length > 40) ? "(redacted)" : token;
+    if (attempted === "login" || attempted === "logout") return;
+    const command = parse3 ? "(parse)" : invocation?.command ?? (commanderExit && exitCode === 0 ? attempted ?? (code === "commander.version" ? "(version)" : "(help)") : void 0);
+    if (!command || command === "login" || command === "logout") return;
+    if (!getClientIdentity()) setClientIdentity({ client: "apex-cli", version: CLI_VERSION });
+    const payload = {
+      ...invocation,
+      command,
+      ...parse3 ? { attempted } : {},
+      invocation_id: getClientIdentity().invocationId,
+      client_version: CLI_VERSION,
+      node_version: process.versions.node,
+      platform: process.platform,
+      exit_code: exitCode,
+      error_class: classifyError(exitCode, error, firstError?.status),
+      api_calls: apiCalls,
+      first_error_status: firstError?.status,
+      first_error_code: firstError?.errorCode,
+      first_error_request_id: firstError?.requestId,
+      first_error_route: firstError?.path,
+      duration_ms: Math.max(0, Math.round(performance.now() - started))
+    };
+    const client = createHttpClient(creds, {
+      onNetworkError() {
+        throw new Error("telemetry unavailable");
+      },
+      warn() {
+      }
+    });
+    await client.request("POST", "/api/v1/telemetry/cli", payload, 800);
+  })().catch(() => void 0);
 }
 
+// src/cli.ts
+init_source();
+
+// src/commands/login.ts
+init_source();
+var import_node_crypto3 = __toESM(require("node:crypto"));
+var import_node_http = __toESM(require("node:http"));
+var import_node_os6 = __toESM(require("node:os"));
+var import_node_readline2 = __toESM(require("node:readline"));
+
 // src/api.ts
+var import_node_crypto2 = require("node:crypto");
 function simulateTriggers(creds, body5) {
   return request(creds, "POST", "/api/v1/tracking/simulate-trigger", body5);
 }
@@ -7765,11 +8229,11 @@ function getUserKeyIdentity(creds) {
 function getAccountContext(creds) {
   return userRequest(creds, "GET", "/api/v1/me/context");
 }
-function userRequest(creds, method, path24, body5) {
+function userRequest(creds, method, path25, body5) {
   return request(
     { ...creds, apiKey: creds.userApiKey ?? "", baseUrl: creds.userBaseUrl ?? creds.baseUrl },
     method,
-    path24,
+    path25,
     body5
   );
 }
@@ -7801,6 +8265,7 @@ function sharedClient(creds) {
   let client = sharedClients.get(creds);
   if (!client) {
     client = createHttpClient(creds, {
+      onResponse: recordApiResponse2,
       transport: testTransport,
       testTransportVersion: () => testTransport ? process.env[["APEX", "CLI", "MOCK", "API", "VERSION"].join("_")] : void 0,
       onNetworkError: (info) => {
@@ -7811,19 +8276,22 @@ function sharedClient(creds) {
         }
         const host = url?.hostname ?? info.baseUrl;
         const code = info.code;
-        let reason = "unknown";
+        let reason2 = "unknown";
         let message = info.causeMessage ?? info.cause;
-        if (info.name === "TimeoutError" || info.name === "AbortError" || code === "UND_ERR_CONNECT_TIMEOUT") {
-          reason = "timeout";
+        if (code === "UND_ERR_CONNECT_TIMEOUT") {
+          reason2 = "connect_timeout";
+          message = `could not open a connection to ${host} within ${info.timeoutMs / 1e3}s`;
+        } else if (info.name === "TimeoutError" || info.name === "AbortError") {
+          reason2 = "timeout";
           message = `server did not respond within ${info.timeoutMs / 1e3}s`;
         } else if (code === "ENOTFOUND" || code === "EAI_AGAIN") {
-          reason = "dns";
+          reason2 = "dns";
           message = `could not resolve host ${host}`;
         } else if (code === "ECONNREFUSED") {
-          reason = "refused";
+          reason2 = "refused";
           message = `connection refused by ${host}:${url?.port || (url?.protocol === "https:" ? "443" : "80")}`;
         } else if (code === "ECONNRESET" || code === "EPIPE") {
-          reason = "reset";
+          reason2 = "reset";
           message = `connection reset by ${host}`;
         } else if (code?.startsWith("CERT_") || code?.startsWith("ERR_TLS_") || [
           "DEPTH_ZERO_SELF_SIGNED_CERT",
@@ -7833,13 +8301,13 @@ function sharedClient(creds) {
           "UNABLE_TO_GET_ISSUER_CERT",
           "HOSTNAME_MISMATCH"
         ].includes(code ?? "")) {
-          reason = "tls";
+          reason2 = "tls";
           message = `TLS error (${code})`;
         }
         throw new CliError(
           `Could not reach ${info.baseUrl}: check APEX_BASE_URL (or DRIP_BASE_URL) / network; ${message}.`,
           EXIT_CODES.general,
-          { reason, code, name: info.name, baseUrl: info.baseUrl, timeoutMs: info.timeoutMs }
+          { reason: reason2, code, name: info.name, baseUrl: info.baseUrl, timeoutMs: info.timeoutMs }
         );
       }
     });
@@ -7847,13 +8315,13 @@ function sharedClient(creds) {
   }
   return client;
 }
-async function request(creds, method, path24, body5, requestTimeoutMs) {
-  const response = await sharedClient(creds).request(method, path24, body5, requestTimeoutMs);
+async function request(creds, method, path25, body5, requestTimeoutMs) {
+  const response = await sharedClient(creds).request(method, path25, body5, requestTimeoutMs);
   recordApiResponse(response);
   return response;
 }
-async function requestForm(creds, method, path24, body5) {
-  const response = await sharedClient(creds).requestForm(method, path24, body5);
+async function requestForm(creds, method, path25, body5) {
+  const response = await sharedClient(creds).requestForm(method, path25, body5);
   recordApiResponse(response);
   return response;
 }
@@ -7868,11 +8336,19 @@ function listExperiments(creds, opts) {
   const qs = params.toString();
   return request(creds, "GET", `/api/v1/experiments${qs ? `?${qs}` : ""}`);
 }
-function getExperiment(creds, id) {
-  return request(creds, "GET", `/api/v1/experiments/${id}`);
+function getExperiment(creds, id, includePreviewTarget = false) {
+  return request(
+    creds,
+    "GET",
+    `/api/v1/experiments/${id}${includePreviewTarget ? "?include=preview_target" : ""}`
+  );
 }
-function getExperimentBySlug(creds, slug) {
-  return request(creds, "GET", `/api/v1/experiments/by-slug/${slug}`);
+function getExperimentBySlug(creds, slug, includePreviewTarget = false) {
+  return request(
+    creds,
+    "GET",
+    `/api/v1/experiments/by-slug/${slug}${includePreviewTarget ? "?include=preview_target" : ""}`
+  );
 }
 function upsertExperimentBySlug(creds, slug, body5) {
   return request(creds, "PUT", `/api/v1/experiments/by-slug/${slug}`, body5);
@@ -7911,6 +8387,16 @@ function getExperimentResults(creds, id, opts) {
     `/api/v1/experiments/${id}/results${qs ? `?${qs}` : ""}`
   );
 }
+function getExperimentResultsExplain(creds, id, opts) {
+  const params = new URLSearchParams();
+  for (const key of ["currency", "goal", "order"])
+    if (opts[key]) params.set(key, opts[key]);
+  return request(
+    creds,
+    "GET",
+    `/api/v1/experiments/${id}/results/explain?${params}`
+  );
+}
 function createExperimentScreenshots(creds, id, body5) {
   return request(creds, "POST", `/api/v1/experiments/${id}/screenshots`, body5);
 }
@@ -7937,7 +8423,10 @@ function applyExperimentFilesystem(creds, id, body5) {
     creds,
     "POST",
     `/api/v1/experiments/${id}/filesystem/apply`,
-    body5
+    {
+      files: body5.files,
+      ...body5.confirmTargetingReplace === true ? { confirmTargetingReplace: true } : {}
+    }
   );
 }
 function getExperimentQaRun(creds, id) {
@@ -8104,6 +8593,15 @@ function verifyTracking(creds, opts) {
     `/api/v1/tracking/verify${qs ? `?${qs}` : ""}`
   );
 }
+function exportEventsPage(creds, opts) {
+  const params = new URLSearchParams({ from: opts.from, to: opts.to });
+  if (opts.experiment) params.set("experiment", opts.experiment);
+  if (opts.eventTypes?.length) params.set("event_type", opts.eventTypes.join(","));
+  if (opts.qa) params.set("qa", opts.qa);
+  if (opts.limit) params.set("limit", String(opts.limit));
+  if (opts.cursor) params.set("cursor", opts.cursor);
+  return request(creds, "GET", `/api/v1/events/export?${params}`);
+}
 function discoverTrackingSchema(creds, minutes) {
   const query = minutes ? `?minutes=${encodeURIComponent(String(minutes))}` : "";
   return request(creds, "GET", `/api/v1/tracking/discovery${query}`);
@@ -8114,7 +8612,7 @@ function testTargeting(creds, url, opts) {
   return request(creds, "GET", `/api/v1/targeting/test?${params.toString()}`);
 }
 function createSos(creds, body5) {
-  const idempotency_key = body5.idempotency_key ?? (0, import_node_crypto.createHash)("sha256").update(
+  const idempotency_key = body5.idempotency_key ?? (0, import_node_crypto2.createHash)("sha256").update(
     [
       body5.type,
       body5.experiment_id ?? "",
@@ -8265,8 +8763,8 @@ function requestTargetingResource(creds, method, kind5, id, body5, limit, cursor
   if (limit) params.set("limit", String(limit));
   if (cursor) params.set("cursor", cursor);
   const query = params.toString();
-  const path24 = `/api/v1/${kind5}${id ? `/${id.split("/").map(encodeURIComponent).join("/")}` : ""}${query ? `?${query}` : ""}`;
-  return request(creds, method, path24, body5);
+  const path25 = `/api/v1/${kind5}${id ? `/${id.split("/").map(encodeURIComponent).join("/")}` : ""}${query ? `?${query}` : ""}`;
+  return request(creds, method, path25, body5);
 }
 function managedPath(kind5, id, action74) {
   return `/api/v1/${kind5}${id ? `/${encodeURIComponent(id)}` : ""}${action74 ? `/${action74}` : ""}`;
@@ -8502,6 +9000,24 @@ function getWebhookDeliveries(creds, id, limit) {
 function testWebhook(creds, id) {
   return request(creds, "POST", `/api/v1/webhooks/${encodeURIComponent(id)}/test`);
 }
+function getOrderJourney(creds, opts) {
+  const params = new URLSearchParams({
+    platform: opts.platform,
+    environment: opts.environment,
+    from: opts.from,
+    to: opts.to
+  });
+  if (opts.orderId !== void 0) params.set("platform_order_id", opts.orderId);
+  if (opts.orderNumber !== void 0) params.set("order_number", opts.orderNumber);
+  if (opts.includeQa) params.set("include_qa", "true");
+  return request(
+    creds,
+    "GET",
+    `/api/v1/analytics/order-journey?${params}`,
+    void 0,
+    45e3
+  );
+}
 
 // src/context.ts
 var import_node_readline = __toESM(require("node:readline"));
@@ -8587,9 +9103,9 @@ var STATUS_COLORS = {
   paused: source_default.yellow,
   completed: source_default.blue
 };
-function statusBadge(status2) {
-  const colorize = STATUS_COLORS[status2] ?? source_default.white;
-  return colorize(status2.toUpperCase());
+function statusBadge(status3) {
+  const colorize = STATUS_COLORS[status3] ?? source_default.white;
+  return colorize(status3.toUpperCase());
 }
 function printTable(headers, rows, widths) {
   const colWidths = widths ?? headers.map((h, i) => Math.max(h.length, ...rows.map((r) => (r[i] ?? "").length)));
@@ -8667,8 +9183,8 @@ function parseFormBody(body5) {
   return new URLSearchParams(body5);
 }
 async function waitForBrowserLogin(baseUrl, userMode = false) {
-  const state = import_node_crypto2.default.randomBytes(24).toString("base64url");
-  const clientName = import_node_os5.default.hostname() || "Local machine";
+  const state = import_node_crypto3.default.randomBytes(24).toString("base64url");
+  const clientName = import_node_os6.default.hostname() || "Local machine";
   return new Promise((resolve2, reject) => {
     let settled = false;
     let timeout = null;
@@ -8999,9 +9515,9 @@ var useCommand = new Command("use").description("Set the current Apex organizati
 
 // src/commands/experiments.ts
 init_source();
-var import_node_crypto4 = __toESM(require("node:crypto"));
-var import_node_fs7 = __toESM(require("node:fs"));
-var import_node_path5 = __toESM(require("node:path"));
+var import_node_crypto5 = __toESM(require("node:crypto"));
+var import_node_fs8 = __toESM(require("node:fs"));
+var import_node_path6 = __toESM(require("node:path"));
 
 // src/lib/qa-vocabulary.ts
 var checklistStatuses = [
@@ -9031,6 +9547,30 @@ var evidenceKinds = [
   "readiness"
 ];
 
+// src/lib/experiment-handover.ts
+function summarizeHandoverQa(value) {
+  const record3 = (value2) => value2 !== null && typeof value2 === "object" && !Array.isArray(value2) ? value2 : {};
+  const qa3 = record3(value);
+  const run3 = record3(qa3.latestRun);
+  const summary = record3(run3.summary);
+  const count2 = (value2) => typeof value2 === "number" && Number.isInteger(value2) && value2 >= 0 ? value2 : null;
+  let requiredDone = count2(summary.completedRequired);
+  let requiredTotal = count2(summary.required);
+  if (requiredDone !== null && requiredTotal !== null && requiredDone > requiredTotal) {
+    requiredDone = null;
+    requiredTotal = null;
+  }
+  const blockers = Array.isArray(summary.blockers) && summary.blockers.every((item) => typeof item === "string") ? summary.blockers : null;
+  const approvedAt = typeof qa3.qaApprovedAt === "string" ? Date.parse(qa3.qaApprovedAt) : Number.NaN;
+  return {
+    run_status: typeof run3.status === "string" ? run3.status : null,
+    required_done: requiredDone,
+    required_total: requiredTotal,
+    blockers,
+    approval_present: Number.isFinite(approvedAt)
+  };
+}
+
 // src/lib/dashboard-url.ts
 function buildDashboardUrl(baseUrl, shopId, experimentId) {
   if (!shopId) return null;
@@ -9148,8 +9688,8 @@ function pageEntries(raw) {
   }
   return [...byId.values()];
 }
-function urlRuleClause(count) {
-  return count === 1 ? "1 URL rule" : `${count} URL rules`;
+function urlRuleClause(count2) {
+  return count2 === 1 ? "1 URL rule" : `${count2} URL rules`;
 }
 function effectivePageTargetingLabel(targeting) {
   const raw = isRecord(targeting) ? targeting : {};
@@ -9194,9 +9734,9 @@ function deriveStoreUrl(patterns) {
 }
 
 // src/lib/asset-upload.ts
-var import_node_crypto3 = __toESM(require("node:crypto"));
-var import_node_fs6 = __toESM(require("node:fs"));
-var import_node_path4 = __toESM(require("node:path"));
+var import_node_crypto4 = __toESM(require("node:crypto"));
+var import_node_fs7 = __toESM(require("node:fs"));
+var import_node_path5 = __toESM(require("node:path"));
 var INLINE_DATA_URI_MAX_CHARS = 4096;
 var DATA_IMAGE_URI_PATTERN = /data:image\/[a-z0-9.+-]+(?:(?:;[^;,\s"'`]*)*;base64,[A-Za-z0-9+/=\s]+|(?:;[^,\s"'`]*)?,[^\s"'`]+)/gi;
 var QUOTED_LOCAL_IMAGE_PATTERN = /(["'])([^"'\n]+?\.(?:png|jpe?g|gif|webp|svg|avif))\1/gi;
@@ -9219,7 +9759,7 @@ var EXTENSION_BY_MIME = {
   "image/avif": ".avif"
 };
 function contentHash(bytes) {
-  return import_node_crypto3.default.createHash("sha256").update(bytes).digest("hex");
+  return import_node_crypto4.default.createHash("sha256").update(bytes).digest("hex");
 }
 function deliveryUrl(baseUrl, asset) {
   const returnedUrl = asset.deliveryUrl ?? asset.delivery_url ?? asset.url;
@@ -9307,23 +9847,23 @@ function createAssetReferenceRewriter(options) {
       if (reference.startsWith("/") || reference.startsWith("data:") || reference.includes("://")) {
         return null;
       }
-      const absolutePath = import_node_path4.default.resolve(baseDir, reference);
+      const absolutePath = import_node_path5.default.resolve(baseDir, reference);
       let realBaseDir;
       let realPath;
       try {
-        realBaseDir = import_node_fs6.default.realpathSync(baseDir);
-        realPath = import_node_fs6.default.realpathSync(absolutePath);
+        realBaseDir = import_node_fs7.default.realpathSync(baseDir);
+        realPath = import_node_fs7.default.realpathSync(absolutePath);
       } catch {
         return null;
       }
-      const relativeRealPath = import_node_path4.default.relative(realBaseDir, realPath);
-      if (relativeRealPath.startsWith("..") || import_node_path4.default.isAbsolute(relativeRealPath)) return null;
-      if (!import_node_fs6.default.statSync(realPath).isFile()) return null;
-      const bytes = import_node_fs6.default.readFileSync(realPath);
-      const extension = import_node_path4.default.extname(realPath).toLowerCase();
+      const relativeRealPath = import_node_path5.default.relative(realBaseDir, realPath);
+      if (relativeRealPath.startsWith("..") || import_node_path5.default.isAbsolute(relativeRealPath)) return null;
+      if (!import_node_fs7.default.statSync(realPath).isFile()) return null;
+      const bytes = import_node_fs7.default.readFileSync(realPath);
+      const extension = import_node_path5.default.extname(realPath).toLowerCase();
       return uploadOnce(
         {
-          name: import_node_path4.default.basename(absolutePath),
+          name: import_node_path5.default.basename(absolutePath),
           bytes,
           type: MIME_BY_EXTENSION[extension]
         },
@@ -9500,6 +10040,16 @@ function printExperimentResults(results2, currency) {
       [32, 8, 6, 8, 10]
     );
   }
+  const metrics = Array.isArray(results2.metrics) ? results2.metrics : [];
+  if (metrics.length > 0) {
+    console.log();
+    console.log(source_default.bold("Goal counting"));
+    metrics.forEach((metric) => {
+      const basis = metric.counting === "once" ? "unique visitors" : metric.counting === "every" ? "every event" : "unknown basis";
+      console.log(`  - ${String(metric.name ?? metric.goalId ?? "Goal")}: ${basis}`);
+    });
+  }
+  console.log("  Definitions: https://docs.drip-apex.com/docs/experiments/metric-definitions");
   const warnings = Array.isArray(results2.warnings) ? results2.warnings : [];
   if (warnings.length > 0) {
     console.log();
@@ -9528,39 +10078,59 @@ var FILESYSTEM_FILE_RE = new RegExp(
   `^(?:${pathAlternation(EXPERIMENT_FILESYSTEM_PATH_SCHEMA.topLevel)}|experiment/(?:${pathAlternation(EXPERIMENT_FILESYSTEM_PATH_SCHEMA.experiment)})|variations/[^/]+/(?:${pathAlternation(EXPERIMENT_FILESYSTEM_PATH_SCHEMA.variation)}))$`
 );
 function sha256Text(value) {
-  return import_node_crypto4.default.createHash("sha256").update(value).digest("hex");
+  return import_node_crypto5.default.createHash("sha256").update(value).digest("hex");
 }
 function folderPath(folder) {
-  return import_node_path5.default.resolve(process.cwd(), folder);
+  return import_node_path6.default.resolve(process.cwd(), folder);
 }
 function filesystemApexDir(folder) {
-  return import_node_path5.default.join(folder, ".apex");
+  return import_node_path6.default.join(folder, ".apex");
 }
 function filesystemSessionPath(folder) {
-  return import_node_path5.default.join(filesystemApexDir(folder), "experiment-filesystem.json");
+  return import_node_path6.default.join(filesystemApexDir(folder), "experiment-filesystem.json");
 }
 function writeFilesystemSession(folder, session) {
-  import_node_fs7.default.mkdirSync(filesystemApexDir(folder), { recursive: true });
-  import_node_fs7.default.writeFileSync(
-    import_node_path5.default.join(filesystemApexDir(folder), ".gitignore"),
+  import_node_fs8.default.mkdirSync(filesystemApexDir(folder), { recursive: true });
+  import_node_fs8.default.writeFileSync(
+    import_node_path6.default.join(filesystemApexDir(folder), ".gitignore"),
     "experiment-filesystem.json\n",
     "utf8"
   );
-  import_node_fs7.default.writeFileSync(filesystemSessionPath(folder), `${JSON.stringify(session, null, 2)}
+  import_node_fs8.default.writeFileSync(filesystemSessionPath(folder), `${JSON.stringify(session, null, 2)}
 `, "utf8");
 }
 function readFilesystemSession(folder) {
   const filePath = filesystemSessionPath(folder);
-  if (!import_node_fs7.default.existsSync(filePath)) {
-    const workspaceMarker = import_node_path5.default.join(filesystemApexDir(folder), "session.json");
-    if (import_node_fs7.default.existsSync(workspaceMarker)) {
-      throw new Error(
-        "This folder is an operator workspace (apex workspace \u2026), not an experiment filesystem \u2014 run `apex workspace status` here, or `apex experiments pull` into a different folder."
+  if (!import_node_fs8.default.existsSync(filePath)) {
+    const workspaceMarker = import_node_path6.default.join(filesystemApexDir(folder), "session.json");
+    if (import_node_fs8.default.existsSync(workspaceMarker)) {
+      throw new CliError(
+        "This folder is an operator workspace (apex workspace \u2026), not an experiment filesystem \u2014 run `apex workspace status` here, or `apex experiments pull` into a different folder.",
+        EXIT_CODES.general,
+        {
+          code: "validation_failed",
+          next_steps: [
+            { command: "apex workspace status", why: "Use the command for this folder format." },
+            {
+              command: "apex experiments pull",
+              why: "Create the required folder in a different directory."
+            }
+          ]
+        }
       );
     }
-    throw new Error(`Missing ${filePath}. Run apex experiments pull first.`);
+    throw new CliError(
+      `Missing ${filePath}. Run apex experiments pull first.`,
+      EXIT_CODES.general,
+      {
+        code: "local_file_error",
+        next_steps: [
+          { command: "apex experiments pull", why: "Create the missing local folder metadata." }
+        ]
+      }
+    );
   }
-  return JSON.parse(import_node_fs7.default.readFileSync(filePath, "utf8"));
+  return JSON.parse(import_node_fs8.default.readFileSync(filePath, "utf8"));
 }
 function validateFilesystemPath(relativePath) {
   const normalized = relativePath.replace(/\\/g, "/").replace(/^\/+/, "");
@@ -9576,17 +10146,17 @@ function writeExperimentFilesystemFiles(folder, files) {
   }));
   for (const file of validatedFiles) {
     const relativePath = file.relativePath;
-    const absPath = import_node_path5.default.join(folder, relativePath);
-    import_node_fs7.default.mkdirSync(import_node_path5.default.dirname(absPath), { recursive: true });
-    import_node_fs7.default.writeFileSync(absPath, file.content, "utf8");
+    const absPath = import_node_path6.default.join(folder, relativePath);
+    import_node_fs8.default.mkdirSync(import_node_path6.default.dirname(absPath), { recursive: true });
+    import_node_fs8.default.writeFileSync(absPath, file.content, "utf8");
   }
 }
 function listExperimentFilesystemFiles(folder, session) {
   const files = [];
   for (const fileName of EXPERIMENT_FILESYSTEM_PATH_SCHEMA.topLevel) {
-    const absPath = import_node_path5.default.join(folder, fileName);
-    if (!import_node_fs7.default.existsSync(absPath)) continue;
-    const content = import_node_fs7.default.readFileSync(absPath, "utf8");
+    const absPath = import_node_path6.default.join(folder, fileName);
+    if (!import_node_fs8.default.existsSync(absPath)) continue;
+    const content = import_node_fs8.default.readFileSync(absPath, "utf8");
     const sha256 = sha256Text(content);
     if (SERVER_OWNED_EXPERIMENT_FILES.has(fileName)) {
       if (session.files[fileName]?.sha256 !== sha256) {
@@ -9600,21 +10170,21 @@ function listExperimentFilesystemFiles(folder, session) {
   }
   for (const fileName of EXPERIMENT_FILESYSTEM_PATH_SCHEMA.experiment) {
     const relativePath = `experiment/${fileName}`;
-    const absPath = import_node_path5.default.join(folder, relativePath);
-    if (!import_node_fs7.default.existsSync(absPath)) continue;
-    const content = import_node_fs7.default.readFileSync(absPath, "utf8");
+    const absPath = import_node_path6.default.join(folder, relativePath);
+    if (!import_node_fs8.default.existsSync(absPath)) continue;
+    const content = import_node_fs8.default.readFileSync(absPath, "utf8");
     files.push({ path: relativePath, content, sha256: sha256Text(content) });
   }
-  const variationsRoot = import_node_path5.default.join(folder, "variations");
-  if (import_node_fs7.default.existsSync(variationsRoot)) {
-    for (const variationDir of import_node_fs7.default.readdirSync(variationsRoot, { withFileTypes: true })) {
+  const variationsRoot = import_node_path6.default.join(folder, "variations");
+  if (import_node_fs8.default.existsSync(variationsRoot)) {
+    for (const variationDir of import_node_fs8.default.readdirSync(variationsRoot, { withFileTypes: true })) {
       if (!variationDir.isDirectory()) continue;
-      const base = import_node_path5.default.join(variationsRoot, variationDir.name);
+      const base = import_node_path6.default.join(variationsRoot, variationDir.name);
       for (const fileName of EXPERIMENT_FILESYSTEM_PATH_SCHEMA.variation) {
-        const absPath = import_node_path5.default.join(base, fileName);
-        if (!import_node_fs7.default.existsSync(absPath)) continue;
-        const relativePath = validateFilesystemPath(import_node_path5.default.relative(folder, absPath));
-        const content = import_node_fs7.default.readFileSync(absPath, "utf8");
+        const absPath = import_node_path6.default.join(base, fileName);
+        if (!import_node_fs8.default.existsSync(absPath)) continue;
+        const relativePath = validateFilesystemPath(import_node_path6.default.relative(folder, absPath));
+        const content = import_node_fs8.default.readFileSync(absPath, "utf8");
         files.push({ path: relativePath, content, sha256: sha256Text(content) });
       }
     }
@@ -9627,7 +10197,7 @@ async function rewriteExperimentFilesystemAssets(input) {
     baseUrl: input.baseUrl,
     enabled: input.enabled,
     upload: async (file) => {
-      const hash = import_node_crypto4.default.createHash("sha256").update(file.bytes).digest("hex");
+      const hash = import_node_crypto5.default.createHash("sha256").update(file.bytes).digest("hex");
       const cached = input.assets[hash];
       if (cached) return cached;
       if (input.upload === null) return null;
@@ -9656,7 +10226,7 @@ async function rewriteExperimentFilesystemAssets(input) {
       }
       const content = await rewriter.rewrite(
         file.content,
-        import_node_path5.default.dirname(import_node_path5.default.join(input.folder, file.path))
+        import_node_path6.default.dirname(import_node_path6.default.join(input.folder, file.path))
       );
       return { ...file, content, sha256: sha256Text(content) };
     })
@@ -9667,9 +10237,17 @@ function printFilesystemPlan(plan) {
     console.log(source_default.red("\nErrors"));
     plan.errors.forEach((error) => console.log(`  - ${error}`));
   }
-  if (plan.warnings.length > 0) {
+  const compatibilityWarnings = (plan.previewCompatibility ?? []).map(
+    (finding) => `${finding.path}:${finding.line}:${finding.column} ${finding.rule}: ${finding.message}. Try: ${finding.alternative}`
+  );
+  if (compatibilityWarnings.length > 0) {
+    console.log(source_default.yellow("\nPreview compatibility"));
+    compatibilityWarnings.forEach((warning) => console.log(`  - ${warning}`));
+  }
+  const otherWarnings = plan.warnings.filter((warning) => !compatibilityWarnings.includes(warning));
+  if (otherWarnings.length > 0) {
     console.log(source_default.yellow("\nWarnings"));
-    plan.warnings.forEach((warning) => console.log(`  - ${warning}`));
+    otherWarnings.forEach((warning) => console.log(`  - ${warning}`));
   }
   if ((plan.blockingIssues?.length ?? 0) > 0) {
     console.log(source_default.red("\nBlocking issues"));
@@ -9744,6 +10322,10 @@ function printQaPreviewUrls(experimentId, result) {
     );
   }
 }
+function qaVersionMarker(value) {
+  const version = value;
+  return version.stale ? " [stale: checked against an earlier version]" : version.unversioned ? " [unversioned]" : "";
+}
 function printQaRun(run3) {
   console.log();
   console.log(source_default.bold(`QA run ${run3.id}`));
@@ -9760,7 +10342,7 @@ function printQaRun(run3) {
   for (const item of run3.checklist) {
     const required = item.required ? source_default.yellow(" required") : "";
     const notes = item.notes ? source_default.dim(` \u2014 ${item.notes}`) : "";
-    console.log(`  ${statusBadge(item.status)} ${item.id}${required}`);
+    console.log(`  ${statusBadge(item.status)} ${item.id}${required}${qaVersionMarker(item)}`);
     console.log(`    ${item.title}${notes}`);
   }
   if (run3.urls.length > 0) {
@@ -9771,10 +10353,10 @@ function printQaRun(run3) {
   }
   if ((run3.evidenceRecords ?? []).length > 0) {
     console.log(source_default.bold("\nEvidence records"));
-    for (const record2 of run3.evidenceRecords ?? []) {
-      const device = record2.device ? ` \xB7 ${record2.device}` : "";
+    for (const record3 of run3.evidenceRecords ?? []) {
+      const device = record3.device ? ` \xB7 ${record3.device}` : "";
       console.log(
-        `  - ${record2.kind} \xB7 ${record2.label} \xB7 ${record2.status}${device} \xB7 ${record2.capturedAt}`
+        `  - ${record3.kind} \xB7 ${record3.label} \xB7 ${record3.status}${device} \xB7 ${record3.capturedAt}${qaVersionMarker(record3)}`
       );
     }
   }
@@ -9795,8 +10377,8 @@ async function confirmApply(message) {
 function parseEvidenceInput(value) {
   if (!value) return void 0;
   const source = value.startsWith("@") ? value.slice(1) : value;
-  const text = value.startsWith("@") || import_node_fs7.default.existsSync(source) ? import_node_fs7.default.readFileSync(import_node_path5.default.resolve(process.cwd(), source), "utf8") : value;
-  const parsed = JSON.parse(text);
+  const text2 = value.startsWith("@") || import_node_fs8.default.existsSync(source) ? import_node_fs8.default.readFileSync(import_node_path6.default.resolve(process.cwd(), source), "utf8") : value;
+  const parsed = JSON.parse(text2);
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
     throw new Error("QA evidence must be a JSON object");
   }
@@ -9840,7 +10422,7 @@ async function resolveExperimentForFilesystemOrId(value) {
     return {
       experimentId: session.experimentId,
       folder: candidate,
-      label: import_node_path5.default.basename(candidate)
+      label: import_node_path6.default.basename(candidate)
     };
   }
   const exp = await resolveExperiment(value);
@@ -10026,7 +10608,53 @@ var detachIdea = new Command("detach-idea").description("Detach an experiment fr
     );
   output(this, res.data, () => printSuccess("Idea detached."));
 });
-var results = new Command("results").description("Read experiment results and timeseries by ID or slug").argument("<id-or-slug>", EXPERIMENT_REFERENCE_DESCRIPTION).option("--currency <code>", "Currency code for revenue formatting").action(async function action7(idOrSlug, opts) {
+function printResultsExplain(body5, samples) {
+  const data = body5.data;
+  console.log("Diagnostic results explanation");
+  for (const arm of data.arms) {
+    console.log(`
+${arm.name} (${arm.variation_id})`);
+    for (const name of ["visitors", "conversions", "orders", "revenue"]) {
+      const metric = arm[name];
+      if (!metric) continue;
+      console.log(`  ${name}`);
+      for (const [label, count2] of Object.entries(metric.counts ?? {}))
+        console.log(`    ${label.padEnd(28)} ${count2}`);
+      console.log(
+        `    Counted: ${metric.classified_counted ?? "unavailable"}  Reported: ${metric.reported ?? "unavailable"}  Residual: ${metric.residual ?? "unavailable"}`
+      );
+      if (metric.explanation) console.log(`    ${metric.explanation}`);
+      if (samples && metric.samples) {
+        for (const [label, entries] of Object.entries(
+          metric.samples
+        )) {
+          for (const entry of entries)
+            console.log(
+              `    ${label}: ${entry.order_key || entry.event_id} ${entry.amount ?? ""} ${entry.currency ?? ""} ${entry.timestamp ?? ""} arm_only=${entry.arm_only ?? false}`
+            );
+        }
+      }
+    }
+  }
+  if (data.order) console.log(`
+Order trail
+${JSON.stringify(data.order, null, 2)}`);
+  const others = data.other_variations ?? [];
+  if (others.length > 0) {
+    console.log("\nOther variations (not part of this test)");
+    for (const other of others) console.log(`  ${other.variation_id}: ${other.row_count} rows`);
+  }
+  const limitations = data.limitations ?? [];
+  if (limitations.length > 0) {
+    console.log("\nLimitations");
+    for (const limitation of limitations) console.log(`  - ${limitation}`);
+  }
+  console.log(`
+Definitions: ${data.definitions_url}`);
+}
+var results = new Command("results").description("Read experiment results and timeseries by ID or slug").argument("<id-or-slug>", EXPERIMENT_REFERENCE_DESCRIPTION).option("--currency <code>", "Currency code for revenue formatting").option("--explain", "Explain raw-event exclusions and residuals").option("--goal <id>", "Goal ID or event key for --explain").option("--order <key>", "Order label trail for --explain").option("--samples", "Show sample identifiers with --explain").action(async function action7(idOrSlug, opts) {
+  if (!opts.explain && (opts.goal || opts.order || opts.samples))
+    fail(this, "--goal, --order and --samples require --explain", EXIT_CODES.validation);
   const creds = requireCredentials();
   const spinner = await createSpinner("Fetching experiment results...");
   try {
@@ -10035,7 +10663,7 @@ var results = new Command("results").description("Read experiment results and ti
       spinner?.fail(`Experiment "${idOrSlug}" not found`);
       fail(this, `Experiment "${idOrSlug}" not found.`, EXIT_CODES.validation);
     }
-    const res = await getExperimentResults(creds, exp.id, { currency: opts.currency });
+    const res = opts.explain ? await getExperimentResultsExplain(creds, exp.id, opts) : await getExperimentResults(creds, exp.id, { currency: opts.currency });
     if (!res.ok || !res.data) {
       spinner?.fail("Failed to fetch experiment results");
       fail(
@@ -10049,7 +10677,7 @@ var results = new Command("results").description("Read experiment results and ti
     output(
       this,
       res.data,
-      () => printExperimentResults(res.data, opts.currency)
+      () => opts.explain ? printResultsExplain(res.data, Boolean(opts.samples)) : printExperimentResults(res.data, opts.currency)
     );
   } catch (error) {
     spinner?.fail("Failed to fetch experiment results");
@@ -10132,7 +10760,7 @@ function parseHttpDestination(value) {
 function readCreateJson(command, reference) {
   const file = reference.startsWith("@") ? reference.slice(1) : reference;
   try {
-    const parsed = JSON.parse(import_node_fs7.default.readFileSync(import_node_path5.default.resolve(process.cwd(), file), "utf8"));
+    const parsed = JSON.parse(import_node_fs8.default.readFileSync(import_node_path6.default.resolve(process.cwd(), file), "utf8"));
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
       throw new Error("expected an object");
     return parsed;
@@ -10168,8 +10796,8 @@ function normalizeNewGoalKey(key) {
   return normalized === "page" ? "page_id" : normalized;
 }
 function validateNewGoal(command, value, body5) {
-  const invalid = (reason) => fail(command, `Invalid --goal "new:${value}"; ${reason}`, EXIT_CODES.validation);
-  const text = (field) => {
+  const invalid = (reason2) => fail(command, `Invalid --goal "new:${value}"; ${reason2}`, EXIT_CODES.validation);
+  const text2 = (field) => {
     const raw = body5[field];
     return typeof raw === "string" && raw.length > 0 ? raw : void 0;
   };
@@ -10179,12 +10807,12 @@ function validateNewGoal(command, value, body5) {
       key === "capture" || key === "filter" ? `${key} is not expressible inline; create the goal with \`apex goals create\` and pass its id` : `unknown field "${key}"; inline fields are ${INLINE_GOAL_FIELDS.join(", ")}`
     );
   }
-  const type = text("type");
-  const name = text("name");
+  const type = text2("type");
+  const name = text2("name");
   if (!type || !name) invalid("type and name are required");
   if (!GOAL_TYPES.includes(type)) invalid(`type must be one of ${GOAL_TYPES.join(", ")}`);
   if (name.length > 255) invalid("name must be 255 characters or fewer");
-  const measurement = text("measurement") ?? "conversion";
+  const measurement = text2("measurement") ?? "conversion";
   if (!GOAL_MEASUREMENTS.includes(measurement))
     invalid(`measurement must be one of ${GOAL_MEASUREMENTS.join(", ")}`);
   if (body5.count_once !== void 0) {
@@ -10192,21 +10820,21 @@ function validateNewGoal(command, value, body5) {
     if (flag !== "true" && flag !== "false") invalid("count-once must be true or false");
     body5.count_once = flag === "true";
   }
-  if (type === "click" && !text("selector") && !text("text_match"))
+  if (type === "click" && !text2("selector") && !text2("text_match"))
     invalid("click goals need selector=<css> or text-match=<text>");
-  if (type === "pageview" && !text("page_id") && !text("url_pattern"))
+  if (type === "pageview" && !text2("page_id") && !text2("url_pattern"))
     invalid("pageview goals need page=<page-id> or url-pattern=<pattern>");
-  if (type === "custom" && !text("event_name")) invalid("custom goals need event-name=<name>");
-  const eventName = text("event_name");
+  if (type === "custom" && !text2("event_name")) invalid("custom goals need event-name=<name>");
+  const eventName = text2("event_name");
   if (eventName && !GOAL_EVENT_NAME.test(eventName))
     invalid("event-name must be 1-120 letters, numbers, dots, colons, underscores, or hyphens");
-  if ((type === "custom" || type === "revenue") && text("page_id"))
+  if ((type === "custom" || type === "revenue") && text2("page_id"))
     invalid(`page is not supported for ${type} goals`);
-  const pageId = text("page_id");
+  const pageId = text2("page_id");
   if (pageId && !GOAL_UUID.test(pageId))
     invalid("page must be a page UUID (list them with `apex pages list`)");
-  const valueProperty = text("value_property");
-  const valueUnit = text("value_unit");
+  const valueProperty = text2("value_property");
+  const valueUnit = text2("value_unit");
   if (measurement !== "value" && (valueProperty || valueUnit))
     invalid("value-property and value-unit need measurement=value");
   if (type === "revenue" && valueProperty)
@@ -10730,7 +11358,7 @@ var pullFilesystem = new Command("pull").description("Pull an experiment as an e
       {
         folder,
         experimentId: exp.id,
-        files: res.data.files.map((file) => import_node_path5.default.join(folder, file.path))
+        files: res.data.files.map((file) => import_node_path6.default.join(folder, file.path))
       },
       () => {
         spinner.succeed(`Pulled ${exp.name}`);
@@ -10742,6 +11370,252 @@ var pullFilesystem = new Command("pull").description("Pull an experiment as an e
     throw error;
   }
 });
+var experimentStatus = new Command("status").description(
+  "Read experiment context, local changes, QA, and handover next steps without writing"
+).argument("[folder-or-id]", "Pulled folder, experiment ID, slug, or test key", ".").action(async function(target) {
+  const creds = requireCredentials();
+  const candidate = folderPath(target);
+  const isFolder = import_node_fs8.default.existsSync(candidate) && import_node_fs8.default.statSync(candidate).isDirectory();
+  const hasApexDir = isFolder && import_node_fs8.default.existsSync(import_node_path6.default.join(candidate, ".apex"));
+  if (isFolder && !hasApexDir && target === ".") {
+    fail(this, "This folder is not a pulled experiment.", EXIT_CODES.validation, {
+      code: "validation_failed",
+      next_steps: [
+        {
+          command: "apex experiments status <experiment-id-or-test-key>",
+          why: "Read the saved experiment without a local folder."
+        },
+        {
+          command: "apex experiments pull <experiment-id-or-test-key> --out <folder>",
+          why: "Pull the experiment to compare local files before handover."
+        }
+      ]
+    });
+  }
+  const session = hasApexDir ? readFilesystemSession(candidate) : null;
+  if (session && new URL(session.baseUrl).origin !== new URL(creds.baseUrl).origin) {
+    fail(
+      this,
+      "This folder was pulled from a different base URL. Select that base URL before inspecting it.",
+      EXIT_CODES.validation
+    );
+  }
+  const response = session ? await getExperiment(creds, session.experimentId) : null;
+  if (response && (!response.ok || !response.data)) {
+    throw new CliError(
+      response.error ?? "Failed to read experiment",
+      classifyStatus(response.status),
+      response.errorDetails,
+      apiFailureOf(response)
+    );
+  }
+  const experiment = response?.data ?? await resolveExperiment(target);
+  if (!experiment) fail(this, "Experiment not found.");
+  const snapshot = await getExperimentFilesystem(creds, experiment.id);
+  if (!snapshot.ok || !snapshot.data) {
+    throw new CliError(
+      snapshot.error ?? "Failed to read experiment filesystem",
+      classifyStatus(snapshot.status),
+      snapshot.errorDetails,
+      apiFailureOf(snapshot)
+    );
+  }
+  let versions = null;
+  if (session) {
+    const localFiles = listExperimentFilesystemFiles(candidate, session);
+    const localHashes = new Map(localFiles.map((file) => [file.path, file.sha256]));
+    for (const name of SERVER_OWNED_EXPERIMENT_FILES) {
+      const file = import_node_path6.default.join(candidate, name);
+      if (import_node_fs8.default.existsSync(file)) localHashes.set(name, sha256Text(import_node_fs8.default.readFileSync(file, "utf8")));
+    }
+    const paths = [.../* @__PURE__ */ new Set([...Object.keys(session.files), ...localHashes.keys()])].sort();
+    const files = paths.map((file) => {
+      const local = localHashes.get(file) ?? null;
+      const pulled = session.files[file]?.sha256 ?? null;
+      return {
+        path: file,
+        state: !local ? "deleted" : !pulled ? "added" : local === pulled ? "unchanged" : "modified",
+        local_sha256: local,
+        pulled_sha256: pulled
+      };
+    });
+    const plannedFiles = await rewriteExperimentFilesystemAssets({
+      files: localFiles,
+      folder: candidate,
+      baseUrl: creds.baseUrl,
+      enabled: true,
+      upload: null,
+      assets: session.assets ?? {},
+      credentials: creds
+    });
+    const plan = await planExperimentFilesystem(creds, experiment.id, { files: plannedFiles });
+    if (!plan.ok || !plan.data) {
+      throw new CliError(
+        plan.error ?? "Failed to read saved state",
+        classifyStatus(plan.status),
+        plan.errorDetails,
+        apiFailureOf(plan)
+      );
+    }
+    versions = {
+      files,
+      saved: {
+        would_change: plan.data.changes.length > 0,
+        invalidates_qa: plan.data.invalidatesQa,
+        blocking_issue_count: plan.data.blockingIssues?.filter((issue) => issue.severity === "blocking").length ?? 0,
+        valid: plan.data.ok,
+        errors: plan.data.errors,
+        warnings: plan.data.warnings
+      }
+    };
+  }
+  const qaFile = snapshot.data.files.find((file) => file.path === "qa.json");
+  let qaSnapshot = null;
+  let qaUnreadable = false;
+  if (qaFile) {
+    try {
+      qaSnapshot = JSON.parse(qaFile.content);
+    } catch {
+      qaUnreadable = true;
+    }
+  }
+  const qa3 = {
+    ...summarizeHandoverQa(qaSnapshot),
+    ready_version_id: experiment.ready_version_id ?? null
+  };
+  const shopId = experiment.shop_id ?? creds.resolvedContext?.shopId ?? null;
+  let org = {
+    id: creds.resolvedContext?.orgId ?? null,
+    name: null
+  };
+  let shop = { id: shopId, name: null };
+  const notes = [];
+  if (qaUnreadable) notes.push("The saved qa.json could not be parsed; QA counts are unknown.");
+  if (!session)
+    notes.push(
+      "Versions are unavailable without a pulled folder. Pull the experiment to compare local files."
+    );
+  if (creds.credentialKind === "user") {
+    const context = await getAccountContext(creds);
+    const owner = context.data?.data?.orgs?.find(
+      (item) => item.shops?.some((item2) => item2.id === shopId)
+    );
+    if (owner) {
+      org = { id: owner.id, name: owner.name };
+      shop = { id: shopId, name: owner.shops.find((item) => item.id === shopId)?.name ?? null };
+    } else notes.push("Organization and shop names are unavailable from account context.");
+  } else
+    notes.push(
+      "Shop credentials do not expose account context; organization and shop names are unknown."
+    );
+  const nextSteps = [];
+  const ref = shellQuote(session ? target : experiment.id);
+  if (!session)
+    nextSteps.push({
+      command: `apex experiments pull ${ref} --out <folder>`,
+      why: "Pull files to verify the local version."
+    });
+  if (versions && (versions.files.some((file) => file.state !== "unchanged") || versions.saved.would_change || !versions.saved.valid || versions.saved.blocking_issue_count > 0)) {
+    nextSteps.push(
+      {
+        command: `apex experiments plan ${ref} --json`,
+        why: "Review local changes, saved differences, and blocking issues."
+      },
+      {
+        command: `apex experiments apply ${ref} --json`,
+        why: "Save the reviewed changes after resolving blockers and any QA invalidation acknowledgment."
+      }
+    );
+  }
+  if (qa3.required_done === null || qa3.required_total === null || qa3.required_done < qa3.required_total || qa3.blockers === null || qa3.blockers.length > 0) {
+    nextSteps.push(
+      {
+        command: `apex experiments qa status ${ref} --json`,
+        why: "Inspect missing required checks and evidence before recording QA results. This separate command can create a QA run."
+      },
+      {
+        command: `apex experiments qa check ${ref} --item <item-id> --status pass`,
+        why: "Record each missing required check; attach supporting evidence with apex experiments qa evidence."
+      }
+    );
+  } else if (!qa3.approval_present) {
+    nextSteps.push({
+      command: `apex experiments qa approve ${ref}`,
+      why: "Required QA checks are complete; approve after verifying the saved version."
+    });
+  }
+  const locallyChanged = versions !== null && (versions.files.some((file) => file.state !== "unchanged") || versions.saved.would_change || !versions.saved.valid || versions.saved.blocking_issue_count > 0);
+  const qaComplete = qa3.required_done !== null && qa3.required_total !== null && qa3.required_done === qa3.required_total && qa3.blockers !== null && qa3.blockers.length === 0;
+  const readyVersionKnown = typeof qa3.ready_version_id === "string" && qa3.ready_version_id.length > 0;
+  const approvalCurrent = qa3.approval_present && readyVersionKnown && !locallyChanged;
+  const lifecycleReady = experiment.status === "ready_to_launch";
+  const readyForHandover = lifecycleReady && approvalCurrent && qaComplete;
+  if (approvalCurrent && qaComplete && !lifecycleReady)
+    notes.push(`The experiment status is ${experiment.status}; handover needs ready_to_launch.`);
+  if (qa3.approval_present && !readyVersionKnown && qaComplete && !locallyChanged)
+    nextSteps.push({
+      command: `apex experiments qa approve ${ref}`,
+      why: "The approval is not bound to a saved version; approve again to bind it before handover."
+    });
+  if (readyForHandover)
+    nextSteps.push({
+      command: "launch in the Apex dashboard",
+      why: "QA is approved for the saved version. Starting a test is a human decision."
+    });
+  if (!versions)
+    notes.push(
+      "Without a pulled folder, readiness reflects the saved version only; local edits elsewhere are not visible."
+    );
+  const data = {
+    context: {
+      org,
+      shop,
+      credential_kind: creds.credentialKind ?? "unknown",
+      base_url: creds.baseUrl
+    },
+    experiment: {
+      id: experiment.id,
+      test_key: experiment.test_key ?? null,
+      name: experiment.name,
+      status: experiment.status,
+      dashboard_url: buildDashboardUrl(creds.baseUrl, shopId, experiment.id)
+    },
+    versions,
+    qa: { ...qa3, approval_current: approvalCurrent },
+    next_steps: nextSteps,
+    ready_for_handover: readyForHandover,
+    notes
+  };
+  output(this, data, () => {
+    console.log(
+      `Context: ${org.name ?? org.id ?? "unknown organization"} / ${shop.name ?? shop.id ?? "unknown shop"}
+Credential: ${data.context.credential_kind}
+Base URL: ${creds.baseUrl}`
+    );
+    console.log(
+      `Experiment: ${experiment.test_key ?? experiment.id} / ${experiment.name} (${experiment.status})
+Dashboard: ${data.experiment.dashboard_url ?? "unknown"}`
+    );
+    console.log("Versions:");
+    if (versions) {
+      for (const file of versions.files) console.log(`  ${file.state}: ${file.path}`);
+      console.log(
+        `  Saved: would change ${versions.saved.would_change}; invalidates QA ${versions.saved.invalidates_qa}; blocking issues ${versions.saved.blocking_issue_count}`
+      );
+      for (const message of [...versions.saved.errors, ...versions.saved.warnings])
+        console.log(`  ${message}`);
+    } else console.log("  unknown (no pulled folder)");
+    console.log(
+      `QA: ${qa3.run_status ?? "unknown"}; required ${qa3.required_done ?? "unknown"}/${qa3.required_total ?? "unknown"}; approval ${qa3.approval_present}; current for this version: ${approvalCurrent}`
+    );
+    for (const blocker of qa3.blockers ?? []) console.log(`  Blocker: ${blocker}`);
+    console.log(`Ready for handover: ${readyForHandover ? "yes" : "no"}
+Next steps:`);
+    for (const step of nextSteps) console.log(`  ${step.command}
+    ${step.why}`);
+    for (const note of notes) console.log(`  ${note}`);
+  });
+});
 var planFilesystem = new Command("plan").description("Plan experiment filesystem changes").argument("[folder]", "Experiment filesystem folder", ".").action(async function action14(folderArg) {
   const creds = requireCredentials();
   try {
@@ -10788,7 +11662,10 @@ var planFilesystem = new Command("plan").description("Plan experiment filesystem
     fail(this, error instanceof Error ? error.message : String(error));
   }
 });
-var applyFilesystem = new Command("apply").option("--sync", "Refresh local authored files with the stored server bytes").description("Apply experiment filesystem changes to Apex").argument("[folder]", "Experiment filesystem folder", ".").option("--accept-qa-invalidation", "Acknowledge that applying changes invalidates QA approval").addOption(new Option("-f, --force", "Deprecated alias for --accept-qa-invalidation").hideHelp()).option("--no-asset-upload", "Keep inline and local image references unchanged").action(async function action15(folderArg, opts) {
+var applyFilesystem = new Command("apply").option(
+  "--confirm-targeting-replace",
+  "Confirm that attaching a Page may replace URL targeting authored through the API"
+).option("--sync", "Refresh local authored files with the stored server bytes").description("Apply experiment filesystem changes to Apex").argument("[folder]", "Experiment filesystem folder", ".").option("--accept-qa-invalidation", "Acknowledge that applying changes invalidates QA approval").addOption(new Option("-f, --force", "Deprecated alias for --accept-qa-invalidation").hideHelp()).option("--no-asset-upload", "Keep inline and local image references unchanged").action(async function action15(folderArg, opts) {
   const creds = requireCredentials();
   try {
     const folder = folderPath(folderArg);
@@ -10822,13 +11699,19 @@ var applyFilesystem = new Command("apply").option("--sync", "Refresh local autho
       if (!shouldUseJson(this)) printFilesystemPlan(planRes.data);
       if (opts.assetUpload === false && planRes.data.blockingIssues?.some((issue) => /inline|hosted asset/i.test(issue.message))) {
         process.stderr.write(
-          `Retry with hosted asset upload: apex experiments apply ${folderArg}
+          `Retry with hosted asset upload: apex experiments apply ${shellQuote(folderArg)}
 `
         );
       }
       fail(this, blockingIssueSummary(planRes.data.blockingIssues), EXIT_CODES.validation, {
         errors: planRes.data.errors,
         plan: planRes.data,
+        next_steps: opts.assetUpload === false && planRes.data.blockingIssues?.some((issue) => /inline|hosted asset/i.test(issue.message)) ? [
+          {
+            command: `apex experiments apply ${shellQuote(folderArg)}`,
+            why: "Retry with hosted asset upload."
+          }
+        ] : [],
         requiredAcknowledgment: planRes.data.invalidatesQa ? "accept-qa-invalidation" : null
       });
     }
@@ -10873,7 +11756,31 @@ var applyFilesystem = new Command("apply").option("--sync", "Refresh local autho
       }
     }
     const spinner = process.stderr.isTTY ? await createSpinner("Applying experiment filesystem...") : null;
-    const res = await applyExperimentFilesystem(creds, session.experimentId, { files });
+    let res = await applyExperimentFilesystem(creds, session.experimentId, {
+      files,
+      ...opts.confirmTargetingReplace ? { confirmTargetingReplace: true } : {}
+    });
+    if (!res.ok && res.status === 409 && res.errorDetails?.code === "confirm_targeting_replace_required" && !opts.confirmTargetingReplace) {
+      spinner?.stop();
+      const ok = await confirmApply(
+        "Attaching this Page replaces URL targeting authored through the API. Continue?"
+      );
+      if (ok === null) {
+        confirmationRequired(
+          this,
+          "Attaching this Page replaces URL targeting authored through the API and requires confirmation.",
+          `apex experiments apply ${folderArg} --confirm-targeting-replace`
+        );
+      }
+      if (!ok) {
+        output(this, { aborted: true }, () => console.log("Aborted."));
+        return;
+      }
+      res = await applyExperimentFilesystem(creds, session.experimentId, {
+        files,
+        confirmTargetingReplace: true
+      });
+    }
     if (!res.ok || !res.data?.applied) {
       spinner?.fail("Failed to apply experiment filesystem");
       fail(this, res.error ?? "Apply failed", classifyStatus(res.status), {
@@ -11154,8 +12061,8 @@ var qaReopen = new Command("reopen").description("Reopen QA and clear scheduled
 });
 function parseJsonValue(value) {
   const source = value.startsWith("@") ? value.slice(1) : value;
-  const text = value.startsWith("@") || import_node_fs7.default.existsSync(source) ? import_node_fs7.default.readFileSync(import_node_path5.default.resolve(process.cwd(), source), "utf8") : value;
-  return JSON.parse(text);
+  const text2 = value.startsWith("@") || import_node_fs8.default.existsSync(source) ? import_node_fs8.default.readFileSync(import_node_path6.default.resolve(process.cwd(), source), "utf8") : value;
+  return JSON.parse(text2);
 }
 function collectFile(value, previous = []) {
   return [...previous, value];
@@ -11207,7 +12114,7 @@ var qaEvidence = new Command("evidence").description("Attach screenshot jobs or
           classifyStatus(current.status),
           current.errorDetails
         );
-      for (const record2 of current.data.run.evidenceRecords) previousIds.add(record2.id);
+      for (const record3 of current.data.run.evidenceRecords) previousIds.add(record3.id);
     }
     let response;
     if (opts.job) {
@@ -11226,12 +12133,12 @@ var qaEvidence = new Command("evidence").description("Attach screenshot jobs or
       const variationId = resolveEvidenceVariation(experiment, opts.variation);
       const form = new FormData();
       for (const filePath of opts.file) {
-        const absolutePath = import_node_path5.default.resolve(process.cwd(), filePath);
-        if (!import_node_fs7.default.existsSync(absolutePath)) throw new Error(`Evidence file not found: ${filePath}`);
-        const bytes = import_node_fs7.default.readFileSync(absolutePath);
-        const extension = import_node_path5.default.extname(absolutePath).toLowerCase();
+        const absolutePath = import_node_path6.default.resolve(process.cwd(), filePath);
+        if (!import_node_fs8.default.existsSync(absolutePath)) throw new Error(`Evidence file not found: ${filePath}`);
+        const bytes = import_node_fs8.default.readFileSync(absolutePath);
+        const extension = import_node_path6.default.extname(absolutePath).toLowerCase();
         const mimeType = extension === ".png" ? "image/png" : extension === ".jpg" || extension === ".jpeg" ? "image/jpeg" : extension === ".webp" ? "image/webp" : "application/octet-stream";
-        form.append("files", new File([bytes], import_node_path5.default.basename(absolutePath), { type: mimeType }));
+        form.append("files", new File([bytes], import_node_path6.default.basename(absolutePath), { type: mimeType }));
       }
       if (opts.label) form.append("label", opts.label);
       const device = normalizeEvidenceDevice(opts.device);
@@ -11252,7 +12159,7 @@ var qaEvidence = new Command("evidence").description("Attach screenshot jobs or
     const run3 = response.data.run;
     const data = opts.summary ? qaSummary(
       run3,
-      run3.evidenceRecords.filter((record2) => !previousIds.has(record2.id))
+      run3.evidenceRecords.filter((record3) => !previousIds.has(record3.id))
     ) : response.data;
     output(this, data, () => {
       if (opts.summary) process.stdout.write(`${JSON.stringify(data, null, 2)}
@@ -11278,8 +12185,8 @@ function shellQuote(value) {
   if (value.length > 0 && /^[A-Za-z0-9_@%+=:,./-]+$/.test(value)) return value;
   return `'${value.replaceAll("'", "'\\''")}'`;
 }
-function isTransientResumeStatus(status2) {
-  return status2 === 429 || status2 !== void 0 && status2 >= 500;
+function isTransientResumeStatus(status3) {
+  return status3 === 429 || status3 !== void 0 && status3 >= 500;
 }
 function screenshotTimeoutMessage(job, experimentRef, out, seconds, flags = {}) {
   const progress = job.progress ? ` Last progress: ${job.progress.captured}/${job.progress.total} captured.` : "";
@@ -11563,8 +12470,8 @@ var screenshots = new Command("screenshots").description(
   }
   if (job.status === "failed")
     fail(this, `Screenshot job failed: ${job.error ?? "unknown error"}`);
-  const outputDir = import_node_path5.default.resolve(process.cwd(), opts.out);
-  import_node_fs7.default.mkdirSync(outputDir, { recursive: true });
+  const outputDir = import_node_path6.default.resolve(process.cwd(), opts.out);
+  import_node_fs8.default.mkdirSync(outputDir, { recursive: true });
   const rows = [];
   const errors = [];
   const usedFilenames = /* @__PURE__ */ new Set();
@@ -11622,8 +12529,8 @@ var screenshots = new Command("screenshots").description(
         try {
           const response = await fetch(url);
           if (!response.ok) throw new Error(`HTTP ${response.status}`);
-          await import_node_fs7.default.promises.writeFile(
-            import_node_path5.default.join(outputDir, filename),
+          await import_node_fs8.default.promises.writeFile(
+            import_node_path6.default.join(outputDir, filename),
             Buffer.from(await response.arrayBuffer())
           );
           workerResults.push({ index, row: [variation.name, device, filename] });
@@ -11650,7 +12557,7 @@ var screenshots = new Command("screenshots").description(
     printTable(["VARIATION", "DEVICE", "FILE"], rows, [24, 20, 48]);
   });
 });
-var experimentsCommand = new Command("experiments").alias("exp").description("Manage experiments").addCommand(list).addCommand(get).addCommand(results).addCommand(update).addCommand(create).addCommand(attachIdea).addCommand(detachIdea).addCommand(pause).addCommand(complete).addCommand(del).addCommand(pullFilesystem).addCommand(planFilesystem).addCommand(applyFilesystem).addCommand(screenshots).addCommand(qa).addHelpText(
+var experimentsCommand = new Command("experiments").alias("exp").description("Manage experiments").addCommand(list).addCommand(get).addCommand(results).addCommand(update).addCommand(create).addCommand(attachIdea).addCommand(detachIdea).addCommand(pause).addCommand(complete).addCommand(del).addCommand(pullFilesystem).addCommand(experimentStatus).addCommand(planFilesystem).addCommand(applyFilesystem).addCommand(screenshots).addCommand(qa).addHelpText(
   "after",
   `
 Examples:
@@ -11663,9 +12570,9 @@ Examples:
 
 // src/commands/push.ts
 init_source();
-var import_node_fs8 = __toESM(require("node:fs"));
-var import_node_os6 = __toESM(require("node:os"));
-var import_node_path6 = __toESM(require("node:path"));
+var import_node_fs9 = __toESM(require("node:fs"));
+var import_node_os7 = __toESM(require("node:os"));
+var import_node_path7 = __toESM(require("node:path"));
 var import_node_url2 = require("node:url");
 function toApiBody(exp) {
   return {
@@ -11706,7 +12613,7 @@ async function rewriteExperimentAssets(exp, rewrite, baseDir) {
   };
 }
 async function importConfigModule(absPath) {
-  const ext = import_node_path6.default.extname(absPath).toLowerCase();
+  const ext = import_node_path7.default.extname(absPath).toLowerCase();
   if (ext === ".js" || ext === ".mjs" || ext === ".cjs") {
     return await import((0, import_node_url2.pathToFileURL)(absPath).href);
   }
@@ -11720,8 +12627,8 @@ async function importConfigModule(absPath) {
 ` + (err instanceof Error ? err.message : String(err))
       );
     }
-    const tmpDir = import_node_fs8.default.mkdtempSync(import_node_path6.default.join(import_node_os6.default.tmpdir(), "drip-config-"));
-    const outFile = import_node_path6.default.join(tmpDir, "config.mjs");
+    const tmpDir = import_node_fs9.default.mkdtempSync(import_node_path7.default.join(import_node_os7.default.tmpdir(), "drip-config-"));
+    const outFile = import_node_path7.default.join(tmpDir, "config.mjs");
     try {
       await esbuild.build({
         entryPoints: [absPath],
@@ -11737,7 +12644,7 @@ async function importConfigModule(absPath) {
       return await import(href);
     } finally {
       try {
-        import_node_fs8.default.rmSync(tmpDir, { recursive: true, force: true });
+        import_node_fs9.default.rmSync(tmpDir, { recursive: true, force: true });
       } catch {
       }
     }
@@ -11758,7 +12665,7 @@ var pushCommand = new Command("push").description("Push experiment definitions f
     );
   }
   const spinner = process.stderr.isTTY ? await createSpinner(`Loading config from ${source_default.cyan(configPath)}...`) : null;
-  const absoluteConfigPath = import_node_path6.default.resolve(configPath);
+  const absoluteConfigPath = import_node_path7.default.resolve(configPath);
   let experiments;
   try {
     const mod = await importConfigModule(absoluteConfigPath);
@@ -11825,7 +12732,7 @@ var pushCommand = new Command("push").description("Push experiment definitions f
     return;
   }
   const assetRewriter = createAssetReferenceRewriter({
-    baseDir: import_node_path6.default.dirname(absoluteConfigPath),
+    baseDir: import_node_path7.default.dirname(absoluteConfigPath),
     baseUrl: creds.baseUrl,
     enabled: opts.assetUpload !== false,
     upload: async (file) => {
@@ -11855,7 +12762,7 @@ var pushCommand = new Command("push").description("Push experiment definitions f
     let body5;
     try {
       body5 = toApiBody(
-        await rewriteExperimentAssets(exp, assetRewriter, import_node_path6.default.dirname(absoluteConfigPath))
+        await rewriteExperimentAssets(exp, assetRewriter, import_node_path7.default.dirname(absoluteConfigPath))
       );
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
@@ -11943,6 +12850,14 @@ var previewCommand = new Command("preview").description(
       const data = created.data;
       output(previewCommand, data, () => {
         console.log(source_default.cyan(data.preview_url));
+        if (data.preview_target) {
+          console.log(`Chosen page: ${data.preview_target.url} (${data.preview_target.source})`);
+          if (!data.preview_target.matches_targeting) {
+            console.log(
+              `The test will not show on this page: ${data.preview_target.reason ?? "The page does not match URL targeting."}`
+            );
+          }
+        }
         console.log(
           data.qa_run.created ? `QA run ${data.qa_run.id} created` : `QA run ${data.qa_run.id} refreshed (${data.qa_run.automated_evidence_count} automated evidence records)`
         );
@@ -11968,7 +12883,7 @@ var previewCommand = new Command("preview").description(
     const spinner = await createSpinner("Fetching experiment...");
     let exp;
     if (/^[0-9a-f-]{36}$/i.test(idOrSlug)) {
-      const res = await getExperiment(creds, idOrSlug);
+      const res = await getExperiment(creds, idOrSlug, !opts?.storeUrl);
       if (!res.ok) {
         spinner.fail(`Experiment "${idOrSlug}" not found`);
         fail(
@@ -11981,7 +12896,7 @@ var previewCommand = new Command("preview").description(
       exp = res.data;
     } else {
       const slug = idOrSlug.startsWith("slug:") ? idOrSlug.slice(5) : idOrSlug;
-      const res = await getExperimentBySlug(creds, slug);
+      const res = await getExperimentBySlug(creds, slug, !opts?.storeUrl);
       if (!res.ok) {
         spinner.fail(`Experiment "${slug}" not found`);
         fail(
@@ -12016,7 +12931,7 @@ var previewCommand = new Command("preview").description(
       variation = exp.variations.find((v) => !v.is_control) ?? exp.variations[0];
     }
     spinner.stop();
-    const storeUrl = opts?.storeUrl ?? exp.store_url;
+    const storeUrl = opts?.storeUrl ?? exp.preview_target?.url ?? exp.store_url;
     if (!storeUrl) {
       fail(
         previewCommand,
@@ -12034,11 +12949,24 @@ var previewCommand = new Command("preview").description(
     }
     output(
       previewCommand,
-      { experimentId: exp.id, variationId: variation.id, previewUrl: previewUrl.toString() },
+      {
+        experimentId: exp.id,
+        variationId: variation.id,
+        previewUrl: previewUrl.toString(),
+        ...!opts?.storeUrl && exp.preview_target ? { previewTarget: exp.preview_target } : {}
+      },
       () => {
         console.log();
         console.log(source_default.bold(`Preview: ${exp.name}`));
         console.log(`Variation: ${variation.name}${variation.is_control ? " (control)" : ""}`);
+        if (!opts?.storeUrl && exp.preview_target) {
+          console.log(`Chosen page: ${exp.preview_target.url} (${exp.preview_target.source})`);
+          if (!exp.preview_target.matches_targeting) {
+            console.log(
+              `The test will not show on this page: ${exp.preview_target.reason ?? "The page does not match URL targeting."}`
+            );
+          }
+        }
         console.log();
         console.log(source_default.cyan(previewUrl.toString()));
         console.log();
@@ -12058,25 +12986,25 @@ var previewCommand = new Command("preview").description(
 
 // src/commands/harness.ts
 init_source();
-var import_node_fs9 = __toESM(require("node:fs"));
-var import_node_path7 = __toESM(require("node:path"));
+var import_node_fs10 = __toESM(require("node:fs"));
+var import_node_path8 = __toESM(require("node:path"));
 var import_node_child_process6 = require("node:child_process");
 function slugify(value, fallback2 = "variation") {
   const slug = value.normalize("NFKD").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 80);
   return slug || fallback2;
 }
 function readJson(filePath) {
-  if (!import_node_fs9.default.existsSync(filePath)) return null;
-  return JSON.parse(import_node_fs9.default.readFileSync(filePath, "utf8"));
+  if (!import_node_fs10.default.existsSync(filePath)) return null;
+  return JSON.parse(import_node_fs10.default.readFileSync(filePath, "utf8"));
 }
 function resolveFolder(folder) {
-  return import_node_path7.default.resolve(process.cwd(), folder);
+  return import_node_path8.default.resolve(process.cwd(), folder);
 }
 function experimentConfigPath(folder) {
-  return import_node_path7.default.join(folder, "experiment.config.json");
+  return import_node_path8.default.join(folder, "experiment.config.json");
 }
 function apexConfigPath(folder) {
-  return import_node_path7.default.join(folder, "apex.harness.json");
+  return import_node_path8.default.join(folder, "apex.harness.json");
 }
 function loadHarnessConfig(folder) {
   const experiment = readJson(experimentConfigPath(folder)) ?? {};
@@ -12085,8 +13013,8 @@ function loadHarnessConfig(folder) {
   const targetOrigin = experiment.targetOrigin?.replace(/\/+$/, "") ?? "";
   const defaultPath = experiment.defaultPath ?? "/";
   const targetUrl = targetOrigin ? new URL(defaultPath, targetOrigin).toString() : "";
-  const id = experiment.id ?? import_node_path7.default.basename(import_node_path7.default.dirname(folder));
-  const variation = import_node_path7.default.basename(folder);
+  const id = experiment.id ?? import_node_path8.default.basename(import_node_path8.default.dirname(folder));
+  const variation = import_node_path8.default.basename(folder);
   return {
     experiment,
     apex: {
@@ -12121,37 +13049,37 @@ function runAbHarness(args, cwd) {
 function artifactPaths(folder, experiment) {
   const variant = experiment.variant;
   if (variant?.endsWith(".bundle.js")) {
-    const jsPath = import_node_path7.default.join(folder, variant.replace(/\.bundle\.js$/, ".js"));
-    const cssPath = import_node_path7.default.join(folder, variant.replace(/\.bundle\.js$/, ".css"));
-    return { jsPath, cssPath: import_node_fs9.default.existsSync(cssPath) ? cssPath : null };
+    const jsPath = import_node_path8.default.join(folder, variant.replace(/\.bundle\.js$/, ".js"));
+    const cssPath = import_node_path8.default.join(folder, variant.replace(/\.bundle\.js$/, ".css"));
+    return { jsPath, cssPath: import_node_fs10.default.existsSync(cssPath) ? cssPath : null };
   }
-  const buildDir = import_node_path7.default.join(folder, "build");
-  const files = import_node_fs9.default.existsSync(buildDir) ? import_node_fs9.default.readdirSync(buildDir) : [];
+  const buildDir = import_node_path8.default.join(folder, "build");
+  const files = import_node_fs10.default.existsSync(buildDir) ? import_node_fs10.default.readdirSync(buildDir) : [];
   const js = files.find(
     (file) => file.endsWith(".js") && !file.endsWith(".bundle.js") && !file.endsWith(".min.js")
   );
   const css = files.find((file) => file.endsWith(".css") && !file.endsWith(".min.css"));
   if (!js) throw new Error("Could not find harness JS artifact in build/");
   return {
-    jsPath: import_node_path7.default.join(buildDir, js),
-    cssPath: css ? import_node_path7.default.join(buildDir, css) : null
+    jsPath: import_node_path8.default.join(buildDir, js),
+    cssPath: css ? import_node_path8.default.join(buildDir, css) : null
   };
 }
 async function uploadVersion(params) {
   const creds = requireCredentials();
   const { jsPath, cssPath } = artifactPaths(params.folder, params.experiment);
-  if (!import_node_fs9.default.existsSync(jsPath)) throw new Error(`Missing JS artifact: ${jsPath}`);
+  if (!import_node_fs10.default.existsSync(jsPath)) throw new Error(`Missing JS artifact: ${jsPath}`);
   const form = new FormData();
   form.append(
     "js",
-    new Blob([import_node_fs9.default.readFileSync(jsPath)], { type: "application/javascript" }),
-    import_node_path7.default.basename(jsPath)
+    new Blob([import_node_fs10.default.readFileSync(jsPath)], { type: "application/javascript" }),
+    import_node_path8.default.basename(jsPath)
   );
-  if (cssPath && import_node_fs9.default.existsSync(cssPath) && import_node_fs9.default.statSync(cssPath).size > 0) {
+  if (cssPath && import_node_fs10.default.existsSync(cssPath) && import_node_fs10.default.statSync(cssPath).size > 0) {
     form.append(
       "css",
-      new Blob([import_node_fs9.default.readFileSync(cssPath)], { type: "text/css" }),
-      import_node_path7.default.basename(cssPath)
+      new Blob([import_node_fs10.default.readFileSync(cssPath)], { type: "text/css" }),
+      import_node_path8.default.basename(cssPath)
     );
   }
   form.append(
@@ -12160,8 +13088,8 @@ async function uploadVersion(params) {
       ...params.apex,
       resetJs: cleanupResetJs(params.experiment),
       builtAt: (/* @__PURE__ */ new Date()).toISOString(),
-      jsPath: import_node_path7.default.relative(params.folder, jsPath),
-      cssPath: cssPath ? import_node_path7.default.relative(params.folder, cssPath) : null
+      jsPath: import_node_path8.default.relative(params.folder, jsPath),
+      cssPath: cssPath ? import_node_path8.default.relative(params.folder, cssPath) : null
     })
   );
   const res = await uploadHarnessVersion(creds, params.session.sessionId, form);
@@ -12202,11 +13130,11 @@ var harnessCommand = new Command("harness").description(
 harnessCommand.command("init").argument("<folder>", "AB Test Harness experiment folder").option("--force", "Overwrite existing apex.harness.json").action(function action24(folderArg, opts) {
   const folder = resolveFolder(folderArg);
   const targetPath = apexConfigPath(folder);
-  if (import_node_fs9.default.existsSync(targetPath) && !opts.force) {
+  if (import_node_fs10.default.existsSync(targetPath) && !opts.force) {
     fail(this, `${targetPath} already exists. Use --force to overwrite.`, EXIT_CODES.conflict);
   }
   const { apex } = loadHarnessConfig(folder);
-  import_node_fs9.default.writeFileSync(targetPath, `${JSON.stringify(apex, null, 2)}
+  import_node_fs10.default.writeFileSync(targetPath, `${JSON.stringify(apex, null, 2)}
 `, "utf8");
   output(
     this,
@@ -12272,7 +13200,7 @@ harnessCommand.command("dev").argument("<folder>", "AB Test Harness experiment f
     }
   };
   let debounce = null;
-  const watcher = import_node_fs9.default.watch(folder, { recursive: true }, (_event, filename) => {
+  const watcher = import_node_fs10.default.watch(folder, { recursive: true }, (_event, filename) => {
     const name = String(filename ?? "");
     if (!name || name.startsWith("build/") || name.includes("/build/")) return;
     if (debounce) clearTimeout(debounce);
@@ -12314,9 +13242,9 @@ harnessCommand.command("publish").argument("<folder>", "AB Test Harness experime
 
 // src/commands/operator.ts
 init_source();
-var import_node_crypto5 = __toESM(require("node:crypto"));
-var import_node_fs10 = __toESM(require("node:fs"));
-var import_node_path8 = __toESM(require("node:path"));
+var import_node_crypto6 = __toESM(require("node:crypto"));
+var import_node_fs11 = __toESM(require("node:fs"));
+var import_node_path9 = __toESM(require("node:path"));
 var CANONICAL_FILE_RE = /^(src\/(?:index\.js|index\.scss|info\.js|mutations\.json)|experiment\.config\.json|metrics\.json|targeting\.json|dev-doc\.md|brand\.md|goals\/[a-zA-Z0-9_.-]+\.json|segments\/[a-zA-Z0-9_.-]+\.json|network\/[a-zA-Z0-9_.-]+\.recipe\.json)$/;
 function workspaceIssueFile(field, evidence) {
   if (field === "custom_js" || field === "reset_js") return "src/index.js";
@@ -12360,7 +13288,7 @@ function formatWorkspaceBlockingIssues(value) {
   }).join("\n");
 }
 function sha256Text2(value) {
-  return import_node_crypto5.default.createHash("sha256").update(value).digest("hex");
+  return import_node_crypto6.default.createHash("sha256").update(value).digest("hex");
 }
 function byteLength(value) {
   return Buffer.byteLength(value, "utf8");
@@ -12370,40 +13298,60 @@ function slugify2(value, fallback2 = "operator") {
   return slug || fallback2;
 }
 function folderPath2(folder) {
-  return import_node_path8.default.resolve(process.cwd(), folder);
+  return import_node_path9.default.resolve(process.cwd(), folder);
 }
 function apexDir(folder) {
-  return import_node_path8.default.join(folder, ".apex");
+  return import_node_path9.default.join(folder, ".apex");
 }
 function sessionPath(folder) {
-  return import_node_path8.default.join(apexDir(folder), "session.json");
+  return import_node_path9.default.join(apexDir(folder), "session.json");
 }
 function readJsonFile(filePath) {
-  if (!import_node_fs10.default.existsSync(filePath)) return null;
-  return JSON.parse(import_node_fs10.default.readFileSync(filePath, "utf8"));
+  if (!import_node_fs11.default.existsSync(filePath)) return null;
+  return JSON.parse(import_node_fs11.default.readFileSync(filePath, "utf8"));
 }
 function writeJsonFile(filePath, value) {
-  import_node_fs10.default.mkdirSync(import_node_path8.default.dirname(filePath), { recursive: true });
-  import_node_fs10.default.writeFileSync(filePath, `${JSON.stringify(value, null, 2)}
+  import_node_fs11.default.mkdirSync(import_node_path9.default.dirname(filePath), { recursive: true });
+  import_node_fs11.default.writeFileSync(filePath, `${JSON.stringify(value, null, 2)}
 `, "utf8");
 }
 function readSession(folder) {
   const session = readJsonFile(sessionPath(folder));
   if (!session) {
-    const filesystemMarker = import_node_path8.default.join(apexDir(folder), "experiment-filesystem.json");
-    if (import_node_fs10.default.existsSync(filesystemMarker)) {
-      throw new Error(
-        "This folder is an experiment filesystem (apex experiments \u2026), not an operator workspace \u2014 run `apex experiments plan` here, or `apex workspace checkout` into a different folder."
+    const filesystemMarker = import_node_path9.default.join(apexDir(folder), "experiment-filesystem.json");
+    if (import_node_fs11.default.existsSync(filesystemMarker)) {
+      throw new CliError(
+        "This folder is an experiment filesystem (apex experiments \u2026), not an operator workspace \u2014 run `apex experiments plan` here, or `apex workspace checkout` into a different folder.",
+        EXIT_CODES.general,
+        {
+          code: "validation_failed",
+          next_steps: [
+            { command: "apex experiments plan", why: "Use the command for this folder format." },
+            {
+              command: "apex workspace checkout",
+              why: "Create the required folder in a different directory."
+            }
+          ]
+        }
       );
     }
-    throw new Error(`Missing ${sessionPath(folder)}. Run apex workspace checkout first.`);
+    throw new CliError(
+      `Missing ${sessionPath(folder)}. Run apex workspace checkout first.`,
+      EXIT_CODES.general,
+      {
+        code: "local_file_error",
+        next_steps: [
+          { command: "apex workspace checkout", why: "Create the missing local folder metadata." }
+        ]
+      }
+    );
   }
   return session;
 }
 function writeSession(folder, session) {
-  import_node_fs10.default.mkdirSync(apexDir(folder), { recursive: true });
-  import_node_fs10.default.writeFileSync(
-    import_node_path8.default.join(apexDir(folder), ".gitignore"),
+  import_node_fs11.default.mkdirSync(apexDir(folder), { recursive: true });
+  import_node_fs11.default.writeFileSync(
+    import_node_path9.default.join(apexDir(folder), ".gitignore"),
     "session.json\nharness-session.json\n",
     "utf8"
   );
@@ -12427,15 +13375,15 @@ function listLocalWorkspaceFiles(folder) {
     "brand.md"
   ];
   function visit2(dir) {
-    if (!import_node_fs10.default.existsSync(dir)) return;
-    for (const entry of import_node_fs10.default.readdirSync(dir, { withFileTypes: true })) {
-      const absPath = import_node_path8.default.join(dir, entry.name);
+    if (!import_node_fs11.default.existsSync(dir)) return;
+    for (const entry of import_node_fs11.default.readdirSync(dir, { withFileTypes: true })) {
+      const absPath = import_node_path9.default.join(dir, entry.name);
       if (entry.isDirectory()) {
         visit2(absPath);
         continue;
       }
-      const relativePath = validateCanonicalPath(import_node_path8.default.relative(folder, absPath));
-      const content = import_node_fs10.default.readFileSync(absPath, "utf8");
+      const relativePath = validateCanonicalPath(import_node_path9.default.relative(folder, absPath));
+      const content = import_node_fs11.default.readFileSync(absPath, "utf8");
       files.push({
         path: relativePath,
         absPath,
@@ -12445,11 +13393,11 @@ function listLocalWorkspaceFiles(folder) {
       });
     }
   }
-  for (const root of roots) visit2(import_node_path8.default.join(folder, root));
+  for (const root of roots) visit2(import_node_path9.default.join(folder, root));
   for (const file of topLevel) {
-    const absPath = import_node_path8.default.join(folder, file);
-    if (!import_node_fs10.default.existsSync(absPath)) continue;
-    const content = import_node_fs10.default.readFileSync(absPath, "utf8");
+    const absPath = import_node_path9.default.join(folder, file);
+    if (!import_node_fs11.default.existsSync(absPath)) continue;
+    const content = import_node_fs11.default.readFileSync(absPath, "utf8");
     files.push({
       path: file,
       absPath,
@@ -12473,7 +13421,7 @@ function validateJsonFiles(files) {
   }
 }
 function readExperimentConfig(folder) {
-  return readJsonFile(import_node_path8.default.join(folder, "experiment.config.json")) ?? {};
+  return readJsonFile(import_node_path9.default.join(folder, "experiment.config.json")) ?? {};
 }
 function resolveVariation(exp, variationArg) {
   const variations = exp.variations ?? [];
@@ -12490,9 +13438,9 @@ function resolveVariation(exp, variationArg) {
 function writeWorkspaceFiles(folder, workspace) {
   for (const file of workspace.files) {
     const relativePath = validateCanonicalPath(file.path);
-    const absPath = import_node_path8.default.join(folder, relativePath);
-    import_node_fs10.default.mkdirSync(import_node_path8.default.dirname(absPath), { recursive: true });
-    import_node_fs10.default.writeFileSync(absPath, file.content, "utf8");
+    const absPath = import_node_path9.default.join(folder, relativePath);
+    import_node_fs11.default.mkdirSync(import_node_path9.default.dirname(absPath), { recursive: true });
+    import_node_fs11.default.writeFileSync(absPath, file.content, "utf8");
   }
 }
 function sessionFromWorkspace(input) {
@@ -12561,10 +13509,10 @@ async function uploadCurrentArtifactVersion(folder, sessionId) {
   form.append(
     "js",
     new Blob([js.content], { type: "application/javascript" }),
-    import_node_path8.default.basename(js.path)
+    import_node_path9.default.basename(js.path)
   );
   if (css && css.content.trim()) {
-    form.append("css", new Blob([css.content], { type: "text/css" }), import_node_path8.default.basename(css.path));
+    form.append("css", new Blob([css.content], { type: "text/css" }), import_node_path9.default.basename(css.path));
   }
   form.append("manifest", JSON.stringify(manifest));
   const res = await uploadHarnessVersion(creds, sessionId, form);
@@ -12683,7 +13631,7 @@ operatorCommand.command("checkout").argument("<experiment-id>", "Apex experiment
         classifyStatus(workspace.status),
         workspace.errorDetails
       );
-    import_node_fs10.default.mkdirSync(folder, { recursive: true });
+    import_node_fs11.default.mkdirSync(folder, { recursive: true });
     writeWorkspaceFiles(folder, workspace.data);
     writeSession(
       folder,
@@ -12740,6 +13688,7 @@ operatorCommand.command("status").argument("[folder]", "Operator workspace folde
       }
     );
   } catch (error) {
+    if (error instanceof CliError) throw error;
     fail(this, error instanceof Error ? error.message : String(error));
   }
 });
@@ -12749,8 +13698,8 @@ operatorCommand.command("dev").argument("[folder]", "Operator workspace folder",
     const session = readSession(folder);
     const harnessSession = await createExactHarnessSession(folder, session);
     const version = await uploadCurrentArtifactVersion(folder, harnessSession.sessionId);
-    import_node_fs10.default.mkdirSync(apexDir(folder), { recursive: true });
-    writeJsonFile(import_node_path8.default.join(apexDir(folder), "harness-session.json"), {
+    import_node_fs11.default.mkdirSync(apexDir(folder), { recursive: true });
+    writeJsonFile(import_node_path9.default.join(apexDir(folder), "harness-session.json"), {
       sessionId: harnessSession.sessionId,
       experimentId: harnessSession.experimentId,
       variationId: harnessSession.variationId,
@@ -12805,7 +13754,7 @@ operatorCommand.command("dev").argument("[folder]", "Operator workspace folder",
       }
     };
     let timer = null;
-    const watcher = import_node_fs10.default.watch(folder, { recursive: true }, (_event, filename) => {
+    const watcher = import_node_fs11.default.watch(folder, { recursive: true }, (_event, filename) => {
       const name = String(filename ?? "");
       if (!name || name.startsWith(".apex/") || name.includes("/.apex/")) return;
       if (timer) clearTimeout(timer);
@@ -12840,13 +13789,13 @@ operatorCommand.command("publish").argument("[folder]", "Operator workspace fold
 
 // src/commands/roadmap.ts
 init_source();
-var import_node_fs11 = __toESM(require("node:fs"));
-var import_node_path9 = __toESM(require("node:path"));
+var import_node_fs12 = __toESM(require("node:fs"));
+var import_node_path10 = __toESM(require("node:path"));
 var LEGACY_OUTPUT_REMOVAL_VERSION = "0.7.0";
 function truncate(value, max) {
-  const text = typeof value === "string" ? value : value == null ? "" : String(value);
-  if (text.length <= max) return text;
-  return `${text.slice(0, Math.max(0, max - 3))}...`;
+  const text2 = typeof value === "string" ? value : value == null ? "" : String(value);
+  if (text2.length <= max) return text2;
+  return `${text2.slice(0, Math.max(0, max - 3))}...`;
 }
 function score(value) {
   if (typeof value !== "number" || !Number.isFinite(value)) return "-";
@@ -12951,9 +13900,9 @@ var handoff = new Command("handoff").description(
 `;
   const outputData = opts.instructions ? { roadmapItemId: id, instructions: String(payload.instructions ?? "") } : payload;
   if (opts.out || opts.output) {
-    const target = import_node_path9.default.resolve(process.cwd(), opts.out ?? opts.output);
-    import_node_fs11.default.mkdirSync(import_node_path9.default.dirname(target), { recursive: true });
-    import_node_fs11.default.writeFileSync(target, rendered, "utf8");
+    const target = import_node_path10.default.resolve(process.cwd(), opts.out ?? opts.output);
+    import_node_fs12.default.mkdirSync(import_node_path10.default.dirname(target), { recursive: true });
+    import_node_fs12.default.writeFileSync(target, rendered, "utf8");
     output(this, { path: target, roadmapItemId: id }, () => printSuccess(`Wrote ${target}`));
     return;
   }
@@ -12967,8 +13916,8 @@ roadmapCommand.addCommand(handoff);
 
 // src/commands/tracking.ts
 init_source();
-var import_node_fs12 = __toESM(require("node:fs"));
-var import_node_path10 = __toESM(require("node:path"));
+var import_node_fs13 = __toESM(require("node:fs"));
+var import_node_path11 = __toESM(require("node:path"));
 function normalizeUrl(input) {
   const value = input.trim();
   if (!value) throw new Error("URL cannot be empty");
@@ -13014,17 +13963,17 @@ function commonCookieDomain(hostnames) {
   return suffix && suffixes.every((candidate) => candidate === suffix) ? `.${suffix}` : null;
 }
 function defaultManifestPath() {
-  return import_node_path10.default.resolve(process.cwd(), ".apex", "tracking-manifest.json");
+  return import_node_path11.default.resolve(process.cwd(), ".apex", "tracking-manifest.json");
 }
 function readManifest(filePath) {
-  if (!import_node_fs12.default.existsSync(filePath)) throw new Error(`Manifest not found: ${filePath}`);
-  const parsed = JSON.parse(import_node_fs12.default.readFileSync(filePath, "utf8"));
+  if (!import_node_fs13.default.existsSync(filePath)) throw new Error(`Manifest not found: ${filePath}`);
+  const parsed = JSON.parse(import_node_fs13.default.readFileSync(filePath, "utf8"));
   if (parsed.schemaVersion !== 1) throw new Error("Unsupported tracking manifest schema");
   return parsed;
 }
 function writeManifest(filePath, manifest) {
-  import_node_fs12.default.mkdirSync(import_node_path10.default.dirname(filePath), { recursive: true });
-  import_node_fs12.default.writeFileSync(filePath, `${JSON.stringify(manifest, null, 2)}
+  import_node_fs13.default.mkdirSync(import_node_path11.default.dirname(filePath), { recursive: true });
+  import_node_fs13.default.writeFileSync(filePath, `${JSON.stringify(manifest, null, 2)}
 `, "utf8");
 }
 function buildSnippet(shopId, endpoint) {
@@ -13091,7 +14040,7 @@ function buildManifest(urlArgs, opts) {
   };
 }
 function manifestPath(input) {
-  return import_node_path10.default.resolve(process.cwd(), input ?? defaultManifestPath());
+  return import_node_path11.default.resolve(process.cwd(), input ?? defaultManifestPath());
 }
 function printManifestPlan(manifest) {
   console.log(source_default.bold("Apex tracking ingestion plan"));
@@ -13181,12 +14130,15 @@ trackingCommand.command("verify").description("Verify live tracking events for t
         ["Last event", totals.last_event_at ?? "-"]
       ]
     );
+    if (res.data.truncated) {
+      console.log(`Showing the newest ${totals.events} events; totals cover this sample only`);
+    }
     const eventTypes = Object.entries(totals.event_types);
     if (eventTypes.length > 0) {
       console.log();
       printTable(
         ["EVENT TYPE", "COUNT"],
-        eventTypes.map(([eventType, count]) => [eventType, String(count)])
+        eventTypes.map(([eventType, count2]) => [eventType, String(count2)])
       );
     }
     if (res.data.recent_events.length > 0) {
@@ -13261,10 +14213,180 @@ trackingCommand.command("latency").description("Measure forced-preview versus na
   });
 });
 
+// src/commands/events.ts
+var import_node_fs14 = __toESM(require("node:fs"));
+var eventsCommand = new Command("events").description("Export raw tracking events");
+eventsCommand.command("export").description("Export every raw event in an absolute time window").requiredOption("--from <iso>", "Inclusive ISO 8601 window start").requiredOption("--to <iso>", "Exclusive ISO 8601 window end").option("--experiment <id>", "Filter by experiment ID").option("--event-type <types>", "Comma-separated event types").option("--qa <scope>", "QA scope: exclude, include, or only", "include").option("--limit <count>", "Page size from 1 to 1000", "500").option("--out <path>", "Write event rows to a file instead of stdout").option("--json-summary", "Print a JSON summary on stdout; requires --out for the NDJSON rows").action(async (opts, command) => {
+  if (!Number.isFinite(Date.parse(opts.from)) || !Number.isFinite(Date.parse(opts.to))) {
+    fail(command, "--from and --to must be ISO 8601 timestamps", EXIT_CODES.validation);
+  }
+  if (!["exclude", "include", "only"].includes(opts.qa)) {
+    fail(command, "--qa must be exclude, include, or only", EXIT_CODES.validation);
+  }
+  const limit = Number(opts.limit);
+  if (!Number.isInteger(limit) || limit < 1 || limit > 1e3) {
+    fail(command, "--limit must be an integer from 1 to 1000", EXIT_CODES.validation);
+  }
+  const summaryOnStdout = Boolean(opts.jsonSummary) || isJsonMode();
+  if (isJsonMode() && !opts.out) {
+    fail(
+      command,
+      "In JSON mode (--json or piped stdout) pass --out <file> for the NDJSON rows; stdout carries one summary document.",
+      EXIT_CODES.validation,
+      {
+        next_steps: [
+          {
+            command: "apex events export --from <iso> --to <iso> --out events.ndjson",
+            why: "Write rows to a file."
+          }
+        ]
+      }
+    );
+  }
+  if (opts.jsonSummary && !opts.out) {
+    fail(command, "--json-summary requires --out for the event rows", EXIT_CODES.validation);
+  }
+  const output2 = opts.out ? import_node_fs14.default.createWriteStream(opts.out, { flags: "wx" }) : null;
+  let outputError = null;
+  output2?.on("error", (error) => {
+    outputError = error;
+  });
+  if (output2) {
+    try {
+      await new Promise((resolve2, reject) => {
+        output2.once("open", () => resolve2());
+        output2.once("error", reject);
+      });
+    } catch (error) {
+      fail(
+        command,
+        `Cannot write ${opts.out}: ${error instanceof Error ? error.message : String(error)}`,
+        EXIT_CODES.general,
+        { code: "local_file_error" }
+      );
+    }
+  }
+  const writeLine = async (line) => {
+    const stream = output2 ?? process.stdout;
+    const accepted = output2 ? output2.write(line) : writeRawCommandOutput(line);
+    if (accepted) return;
+    await new Promise((resolve2, reject) => {
+      const onDrain = () => {
+        stream.off("error", onError);
+        resolve2();
+      };
+      const onError = (error) => {
+        stream.off("drain", onDrain);
+        reject(error);
+      };
+      stream.once("drain", onDrain);
+      stream.once("error", onError);
+    });
+  };
+  let cursor;
+  let written = 0;
+  let pages = 0;
+  let totals;
+  do {
+    const response = await exportEventsPage(requireCredentials(), {
+      from: opts.from,
+      to: opts.to,
+      experiment: opts.experiment,
+      eventTypes: opts.eventType?.split(",").map((value) => value.trim()).filter(Boolean),
+      qa: opts.qa,
+      limit,
+      cursor
+    });
+    if (!response.ok || !response.data) {
+      output2?.destroy();
+      fail(
+        command,
+        response.error ?? "Event export page failed",
+        classifyStatus(response.status),
+        response.errorDetails
+      );
+    }
+    if (outputError)
+      fail(
+        command,
+        `Cannot write ${opts.out}: ${outputError.message}`,
+        EXIT_CODES.general,
+        {
+          code: "local_file_error"
+        }
+      );
+    const page = response.data.data;
+    totals ??= page.totals;
+    for (const event of page.events) {
+      try {
+        await writeLine(`${JSON.stringify(event)}
+`);
+      } catch (error) {
+        fail(
+          command,
+          `Cannot write ${opts.out ?? "stdout"}: ${error instanceof Error ? error.message : String(error)}`,
+          EXIT_CODES.general,
+          { code: "local_file_error" }
+        );
+      }
+      written += 1;
+    }
+    pages += 1;
+    cursor = page.next_cursor ?? void 0;
+  } while (cursor);
+  if (output2) {
+    try {
+      await new Promise((resolve2, reject) => {
+        if (outputError) return reject(outputError);
+        output2.once("error", reject);
+        output2.end(resolve2);
+      });
+    } catch (error) {
+      fail(
+        command,
+        `Cannot write ${opts.out}: ${error instanceof Error ? error.message : String(error)}`,
+        EXIT_CODES.general,
+        { code: "local_file_error" }
+      );
+    }
+    if (outputError)
+      fail(
+        command,
+        `Cannot write ${opts.out}: ${outputError.message}`,
+        EXIT_CODES.general,
+        {
+          code: "local_file_error"
+        }
+      );
+  }
+  const matches = totals ? written === totals.events : false;
+  const summary = {
+    events_written: written,
+    pages,
+    totals: totals ?? null,
+    count_matches: matches
+  };
+  if (!matches)
+    fail(
+      command,
+      "Exported event count does not match the server total. Totals are counted when the first page is read, so events that arrive late for a window ending in the last few minutes, or rows sharing one timestamp and event ID, can cause a difference. Re-run for a window that ended at least 15 minutes ago.",
+      EXIT_CODES.general,
+      {
+        reason: "export_count_mismatch",
+        ...summary
+      }
+    );
+  if (summaryOnStdout) writeEnvelope(summary, "apex events export");
+  process.stderr.write(
+    `Exported ${written} events across ${pages} page(s); total ${totals?.events ?? "unknown"}; count matches: ${matches}.
+`
+  );
+});
+
 // src/commands/goals.ts
 init_source();
-var import_node_fs13 = __toESM(require("node:fs"));
-var import_node_path11 = __toESM(require("node:path"));
+var import_node_fs15 = __toESM(require("node:fs"));
+var import_node_path12 = __toESM(require("node:path"));
 
 // ../sdk/src/safe-regex.ts
 var MAX_PATTERN_LENGTH = 1024;
@@ -13440,9 +14562,9 @@ function printSuggestions(data) {
 function parseCapture(command, value) {
   if (!value) return void 0;
   const source = value.startsWith("@") ? value.slice(1) : value;
-  const text = value.startsWith("@") || import_node_fs13.default.existsSync(source) ? import_node_fs13.default.readFileSync(import_node_path11.default.resolve(process.cwd(), source), "utf8") : value;
+  const text2 = value.startsWith("@") || import_node_fs15.default.existsSync(source) ? import_node_fs15.default.readFileSync(import_node_path12.default.resolve(process.cwd(), source), "utf8") : value;
   try {
-    return JSON.parse(text);
+    return JSON.parse(text2);
   } catch (error) {
     const detail5 = error instanceof Error ? error.message : String(error);
     fail(command, `Invalid --capture JSON: ${detail5}`, EXIT_CODES.validation);
@@ -13586,10 +14708,10 @@ var test = new Command("test").description("Dry run a goal URL pattern against t
   const days = Math.max(1, Number.parseInt(opts.days, 10) || 14);
   const dependence = urlPatternDependence(pattern);
   if (dependence !== "none") {
-    const reason = DEPENDENCE_REASON[dependence];
-    output(this, { verdict: "indeterminate", pattern, dependence, reason }, () => {
+    const reason2 = DEPENDENCE_REASON[dependence];
+    output(this, { verdict: "indeterminate", pattern, dependence, reason: reason2 }, () => {
       console.log(source_default.yellow("INDETERMINATE"));
-      console.log(reason);
+      console.log(reason2);
     });
     return;
   }
@@ -13693,12 +14815,12 @@ Examples:
 
 // src/commands/funnels.ts
 init_source();
-var import_node_fs14 = __toESM(require("node:fs"));
-var import_node_path12 = __toESM(require("node:path"));
+var import_node_fs16 = __toESM(require("node:fs"));
+var import_node_path13 = __toESM(require("node:path"));
 function readSteps(command, file) {
   let parsed;
   try {
-    parsed = JSON.parse(import_node_fs14.default.readFileSync(import_node_path12.default.resolve(process.cwd(), file), "utf8"));
+    parsed = JSON.parse(import_node_fs16.default.readFileSync(import_node_path13.default.resolve(process.cwd(), file), "utf8"));
   } catch (error) {
     fail(
       command,
@@ -14012,8 +15134,8 @@ var off = new Command("off").description("Disable consent gating").action(async
 var consentCommand = new Command("consent").description("Manage consent gating").addCommand(get2).addCommand(set).addCommand(off);
 
 // src/commands/project-code.ts
-var import_node_fs15 = require("node:fs");
-var import_node_path13 = require("node:path");
+var import_node_fs17 = require("node:fs");
+var import_node_path14 = require("node:path");
 
 // src/commands/runtime-settings-shop.ts
 var uuidPattern = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
@@ -14058,7 +15180,7 @@ var fields = ["enabled", "css", "helperJs", "js"];
 function readPatch(command, file) {
   let input;
   try {
-    input = JSON.parse((0, import_node_fs15.readFileSync)(file, "utf8"));
+    input = JSON.parse((0, import_node_fs17.readFileSync)(file, "utf8"));
   } catch (error) {
     fail(command, `Cannot read project code JSON: ${String(error)}`, EXIT_CODES.validation);
   }
@@ -14118,15 +15240,15 @@ var projectCodeCommand = new Command("project-code").description(
 );
 projectCodeCommand.addCommand(
   new Command("get").description("Read complete project code and its opaque version").requiredOption("--shop <domain-or-id>", "Shop domain or UUID").action(async (options, command) => {
-    const { credentials: _credentials, ...identity } = await identifyRuntimeSettingsShop(
+    const { credentials: _credentials, ...identity2 } = await identifyRuntimeSettingsShop(
       command,
       options.shop
     );
-    const current = await readCurrent(command, { ...identity, credentials: _credentials });
+    const current = await readCurrent(command, { ...identity2, credentials: _credentials });
     output(
       command,
-      { ...identity, ...current },
-      () => process.stdout.write(`${JSON.stringify({ ...identity, ...current }, null, 2)}
+      { ...identity2, ...current },
+      () => process.stdout.write(`${JSON.stringify({ ...identity2, ...current }, null, 2)}
 `)
     );
   })
@@ -14144,11 +15266,11 @@ for (const mode of ["diff", "set"]) {
     const patch = readPatch(actionCommand, options.file);
     const shop = await identifyRuntimeSettingsShop(actionCommand, options.shop);
     const current = await readCurrent(actionCommand, shop);
-    const { credentials: _credentials, ...identity } = shop;
+    const { credentials: _credentials, ...identity2 } = shop;
     const diff = effectiveDiff(current.projectCode, patch);
     if (mode === "diff" || diff.changedFields.length === 0) {
       const result2 = {
-        ...identity,
+        ...identity2,
         status: diff.changedFields.length ? "changed" : "unchanged",
         version: current.version,
         diff
@@ -14161,11 +15283,11 @@ for (const mode of ["diff", "set"]) {
       );
       return;
     }
-    const backupPath = (0, import_node_path13.resolve)(options.backup);
+    const backupPath = (0, import_node_path14.resolve)(options.backup);
     try {
-      (0, import_node_fs15.writeFileSync)(
+      (0, import_node_fs17.writeFileSync)(
         backupPath,
-        `${JSON.stringify({ ...identity, ...current, capturedAt: (/* @__PURE__ */ new Date()).toISOString() }, null, 2)}
+        `${JSON.stringify({ ...identity2, ...current, capturedAt: (/* @__PURE__ */ new Date()).toISOString() }, null, 2)}
 `,
         { flag: "wx", mode: 384 }
       );
@@ -14195,14 +15317,14 @@ for (const mode of ["diff", "set"]) {
         `Project code saved; publication ${data.precompile.status}: ${data.precompile.summary}`
       );
     }
-    if (data.shop_id !== identity.shop_id)
+    if (data.shop_id !== identity2.shop_id)
       warnings.push(
         "The write response has a different shop identity; inspect the saved state before another write."
       );
     for (const warning of warnings) process.stderr.write(`WARNING: ${warning}
 `);
     const result = {
-      ...identity,
+      ...identity2,
       status: "saved",
       diff,
       backupPath,
@@ -14222,12 +15344,12 @@ for (const mode of ["diff", "set"]) {
 }
 
 // src/commands/triggers.ts
-var import_node_fs16 = __toESM(require("node:fs"));
-var import_node_path14 = __toESM(require("node:path"));
+var import_node_fs18 = __toESM(require("node:fs"));
+var import_node_path15 = __toESM(require("node:path"));
 
 // src/trigger-proposal.ts
-function runtimePath(path24) {
-  return path24.replaceAll("[]", ".0");
+function runtimePath(path25) {
+  return path25.replaceAll("[]", ".0");
 }
 function fieldsFrom(value, prefix = "", descriptorList = false) {
   if (!value || typeof value !== "object") return [];
@@ -14240,18 +15362,18 @@ function fieldsFrom(value, prefix = "", descriptorList = false) {
       )
     );
   }
-  const record2 = value;
-  const explicitPath = typeof record2.path === "string" ? record2.path : void 0;
+  const record3 = value;
+  const explicitPath = typeof record3.path === "string" ? record3.path : void 0;
   if (descriptorList && explicitPath) {
-    const rawValues = record2.values ?? record2.samples ?? record2.examples ?? record2.example;
+    const rawValues = record3.values ?? record3.samples ?? record3.examples ?? record3.example;
     const values = Array.isArray(rawValues) ? rawValues : rawValues === void 0 ? [] : [rawValues];
-    const magnitude = [record2.mean, record2.average, record2.max, record2.magnitude].find(
+    const magnitude = [record3.mean, record3.average, record3.max, record3.magnitude].find(
       (candidate) => typeof candidate === "number"
     );
-    const numericType = Array.isArray(record2.types) && record2.types.length > 0 && record2.types.every((type) => type === "num" || type === "numstr" || type === "numstr_comma");
+    const numericType = Array.isArray(record3.types) && record3.types.length > 0 && record3.types.every((type) => type === "num" || type === "numstr" || type === "numstr_comma");
     return [{ path: runtimePath(explicitPath), values, magnitude, numericType }];
   }
-  return Object.entries(record2).flatMap(([key, child]) => {
+  return Object.entries(record3).flatMap(([key, child]) => {
     if (["eventName", "event_name", "name", "count", "frequency", "evidence"].includes(key))
       return [];
     const next = prefix ? `${prefix}.${key}` : key;
@@ -14284,8 +15406,8 @@ function isDescriptorArray(value) {
   ]);
   return Array.isArray(value) && value.length > 0 && value.every((item) => {
     if (!item || typeof item !== "object" || Array.isArray(item)) return false;
-    const record2 = item;
-    return typeof record2.path === "string" && record2.path.length > 0 && Object.keys(record2).every((key) => descriptorKeys.has(key));
+    const record3 = item;
+    return typeof record3.path === "string" && record3.path.length > 0 && Object.keys(record3).every((key) => descriptorKeys.has(key));
   });
 }
 function candidatesFrom(report) {
@@ -14305,9 +15427,9 @@ function candidatesFrom(report) {
   }
   return [root];
 }
-function score2(path24, patterns) {
+function score2(path25, patterns) {
   return patterns.reduce(
-    (total, pattern, index) => total + (pattern.test(path24) ? patterns.length - index : 0),
+    (total, pattern, index) => total + (pattern.test(path25) ? patterns.length - index : 0),
     0
   );
 }
@@ -14441,10 +15563,10 @@ var whenOps = new Set(runtime_settings_trigger_constants_default.whenOps);
 function strictObject(value, location, keys) {
   if (!value || typeof value !== "object" || Array.isArray(value))
     throw new Error(`${location} must be an object`);
-  const record2 = value;
-  for (const key of Object.keys(record2))
+  const record3 = value;
+  for (const key of Object.keys(record3))
     if (!keys.has(key)) throw new Error(`${location}.${key} is not allowed`);
-  return record2;
+  return record3;
 }
 function optionalType(value, type, location) {
   if (value !== void 0 && typeof value !== type)
@@ -14471,8 +15593,8 @@ function strictSource(value, location, allowSignal, required = false) {
 function defaultMatchesValueType(value, valueType) {
   if (valueType === "number") {
     if (typeof value !== "string") return Number.isFinite(Number(value));
-    const text = String(value).trim();
-    const normalized = /^-?\d{1,3}(\.\d{3})+,\d+$/.test(text) ? text.replace(/\./g, "").replace(",", ".") : /^-?\d+,\d+$/.test(text) ? text.replace(",", ".") : text;
+    const text2 = String(value).trim();
+    const normalized = /^-?\d{1,3}(\.\d{3})+,\d+$/.test(text2) ? text2.replace(/\./g, "").replace(",", ".") : /^-?\d+,\d+$/.test(text2) ? text2.replace(",", ".") : text2;
     return Number.isFinite(Number(normalized));
   }
   if (valueType === "boolean") {
@@ -14580,19 +15702,19 @@ function strictTriggers(value) {
   return value.map((item, index) => {
     if (!item || typeof item !== "object" || Array.isArray(item))
       throw new Error(`trigger[${index}] must be an object`);
-    const record2 = item;
-    for (const key of Object.keys(record2))
+    const record3 = item;
+    for (const key of Object.keys(record3))
       if (!allowed.has(key)) throw new Error(`trigger[${index}].${key} is not allowed`);
-    if (typeof record2.eventName !== "string" || !record2.eventName.trim())
+    if (typeof record3.eventName !== "string" || !record3.eventName.trim())
       throw new Error(`trigger[${index}].eventName must be a non-empty string`);
     for (const key of ["enabled", "reEvaluate", "trackPageview"])
-      optionalType(record2[key], "boolean", `trigger[${index}].${key}`);
+      optionalType(record3[key], "boolean", `trigger[${index}].${key}`);
     for (const key of ["dataLayerName", "trackEventName"])
-      optionalType(record2[key], "string", `trigger[${index}].${key}`);
-    strictWhen(record2.when, `trigger[${index}].when`);
-    if (record2.trackRevenue !== void 0) {
+      optionalType(record3[key], "string", `trigger[${index}].${key}`);
+    strictWhen(record3.when, `trigger[${index}].when`);
+    if (record3.trackRevenue !== void 0) {
       const revenue = strictObject(
-        record2.trackRevenue,
+        record3.trackRevenue,
         `trigger[${index}].trackRevenue`,
         /* @__PURE__ */ new Set([
           "enabled",
@@ -14615,21 +15737,21 @@ function strictTriggers(value) {
         );
       }
     }
-    if (record2.mappings !== void 0) {
-      if (!Array.isArray(record2.mappings))
+    if (record3.mappings !== void 0) {
+      if (!Array.isArray(record3.mappings))
         throw new Error(`trigger[${index}].mappings must be an array`);
-      record2.mappings.forEach(
+      record3.mappings.forEach(
         (mapping, mappingIndex) => strictMapping(mapping, `trigger[${index}].mappings[${mappingIndex}]`, false)
       );
     }
-    if (record2.properties !== void 0) {
-      if (!Array.isArray(record2.properties))
+    if (record3.properties !== void 0) {
+      if (!Array.isArray(record3.properties))
         throw new Error(`trigger[${index}].properties must be an array`);
-      record2.properties.forEach(
+      record3.properties.forEach(
         (mapping, mappingIndex) => strictMapping(mapping, `trigger[${index}].properties[${mappingIndex}]`, true)
       );
     }
-    return record2;
+    return record3;
   });
 }
 function writeWarnings(result) {
@@ -14649,9 +15771,22 @@ async function identify(command, requestedShop) {
       resolvedContext: { ...credentials.resolvedContext, shopId: void 0 }
     };
     const context = await getAccountContext(discoveryCredentials);
-    const match2 = context.data?.data.orgs.flatMap((org) => org.shops).find((shop) => shop.domain.toLowerCase() === requestedShop.toLowerCase());
-    if (!context.ok || !match2) {
-      fail(command, "TRIGGERS_CONFIG_ABSENT: --shop domain is not available to this user", 2);
+    if (!context.ok) {
+      fail(
+        command,
+        `${context.status === 401 || context.status === 403 ? "TRIGGERS_AUTH" : "TRIGGERS_CONFIG_ABSENT"}: ${context.error ?? "account context unavailable"}`,
+        classifyStatus(context.status),
+        context.errorDetails,
+        apiFailureOf(context)
+      );
+    }
+    const match2 = context.data?.data?.orgs?.flatMap((org) => org.shops).find((shop) => shop.domain.toLowerCase() === requestedShop.toLowerCase());
+    if (!match2) {
+      fail(
+        command,
+        "TRIGGERS_CONFIG_ABSENT: --shop domain is not available to this user",
+        EXIT_CODES.validation
+      );
     }
     credentials = {
       ...credentials,
@@ -14660,46 +15795,49 @@ async function identify(command, requestedShop) {
   }
   const res = await getInstallDomains(credentials);
   if (!res.ok || !res.data) {
-    const exitCode = res.status === 401 || res.status === 403 ? 4 : 2;
     fail(
       command,
-      `${exitCode === 4 ? "TRIGGERS_AUTH" : "TRIGGERS_CONFIG_ABSENT"}: ${res.error ?? "shop identity unavailable"}`,
-      exitCode
+      `${res.status === 401 || res.status === 403 ? "TRIGGERS_AUTH" : "TRIGGERS_CONFIG_ABSENT"}: ${res.error ?? "shop identity unavailable"}`,
+      classifyStatus(res.status)
     );
   }
-  const identity = { shop_id: res.data.shop_id, domain: res.data.domain };
-  if (requestedShop !== identity.shop_id && requestedShop.toLowerCase() !== identity.domain.toLowerCase())
-    fail(command, "TRIGGERS_CONFIG_ABSENT: --shop does not match the authenticated shop", 2);
-  return { ...identity, credentials };
+  const identity2 = { shop_id: res.data.shop_id, domain: res.data.domain };
+  if (requestedShop !== identity2.shop_id && requestedShop.toLowerCase() !== identity2.domain.toLowerCase())
+    fail(
+      command,
+      "TRIGGERS_CONFIG_ABSENT: --shop does not match the authenticated shop",
+      EXIT_CODES.validation
+    );
+  return { ...identity2, credentials };
 }
 async function send(command, requestedShop, body5) {
-  const identity = await identify(command, requestedShop);
-  const res = await updateRuntimeSettings(identity.credentials, body5);
+  const identity2 = await identify(command, requestedShop);
+  const res = await updateRuntimeSettings(identity2.credentials, body5);
   if (!res.ok || !res.data)
     fail(
       command,
       `${res.status === 401 || res.status === 403 ? "TRIGGERS_AUTH" : "TRIGGERS_CONFIG_ABSENT"}: ${res.error ?? "Runtime settings update failed"}`,
-      res.status === 401 || res.status === 403 ? 4 : 2,
+      classifyStatus(res.status),
       res.errorDetails
     );
-  const { credentials: _credentials, ...publicIdentity } = identity;
+  const { credentials: _credentials, ...publicIdentity } = identity2;
   return { data: res.data, identity: publicIdentity };
 }
 var get3 = new Command("get").description("Get data layer triggers").requiredOption("--shop <domain-or-id>", "Shop domain or Apex shop ID").action(async function(opts) {
-  const identity = await identify(this, opts.shop);
-  const res = await getRuntimeSettings(identity.credentials);
+  const identity2 = await identify(this, opts.shop);
+  const res = await getRuntimeSettings(identity2.credentials);
   if (!res.ok || !res.data)
     fail(
       this,
       `${res.status === 401 || res.status === 403 ? "TRIGGERS_AUTH" : "TRIGGERS_CONFIG_ABSENT"}: ${res.error ?? "Runtime settings read failed"}`,
-      res.status === 401 || res.status === 403 ? 4 : classifyStatus(res.status),
+      classifyStatus(res.status),
       res.errorDetails
     );
   const triggers = res.data.runtime_settings.dataLayerTriggers ?? [];
-  const { credentials: _credentials, ...publicIdentity } = identity;
+  const { credentials: _credentials, ...publicIdentity } = identity2;
   output(this, { verdict: "TRIGGERS_GET", ...publicIdentity, triggers }, () => {
     process.stdout.write(
-      `TRIGGERS_GET shop_id=${identity.shop_id} domain=${identity.domain} count=${triggers.length}
+      `TRIGGERS_GET shop_id=${identity2.shop_id} domain=${identity2.domain} count=${triggers.length}
 `
     );
     printTable(
@@ -14716,24 +15854,24 @@ var get3 = new Command("get").description("Get data layer triggers").requiredOpt
 var set2 = new Command("set").requiredOption("--file <json>", "JSON trigger array").requiredOption("--shop <domain-or-id>", "Shop domain or Apex shop ID").action(async function(opts) {
   let triggers;
   try {
-    triggers = strictTriggers(JSON.parse(import_node_fs16.default.readFileSync(import_node_path14.default.resolve(opts.file), "utf8")));
+    triggers = strictTriggers(JSON.parse(import_node_fs18.default.readFileSync(import_node_path15.default.resolve(opts.file), "utf8")));
   } catch (error) {
     fail(
       this,
       `TRIGGERS_CONFIG_ABSENT: ${error instanceof Error ? error.message : String(error)}`,
-      2
+      EXIT_CODES.validation
     );
   }
-  const { data, identity } = await send(this, opts.shop, { dataLayerTriggers: triggers });
+  const { data, identity: identity2 } = await send(this, opts.shop, { dataLayerTriggers: triggers });
   const result = {
     verdict: "TRIGGERS_SET",
-    ...identity,
+    ...identity2,
     updated_at: (/* @__PURE__ */ new Date()).toISOString(),
     ...data
   };
   output(this, result, () => {
     process.stdout.write(
-      `TRIGGERS_SET shop_id=${identity.shop_id} domain=${identity.domain} updated_at=${result.updated_at} count=${triggers.length}
+      `TRIGGERS_SET shop_id=${identity2.shop_id} domain=${identity2.domain} updated_at=${result.updated_at} count=${triggers.length}
 `
     );
     writeWarnings(result);
@@ -14743,17 +15881,21 @@ var propose = new Command("propose").requiredOption("--from-file <u2-report.json
   let proposals;
   let report;
   try {
-    report = JSON.parse(import_node_fs16.default.readFileSync(import_node_path14.default.resolve(opts.fromFile), "utf8"));
+    report = JSON.parse(import_node_fs18.default.readFileSync(import_node_path15.default.resolve(opts.fromFile), "utf8"));
     proposals = proposeTriggers(report);
   } catch (error) {
-    fail(this, error instanceof Error ? error.message : String(error), 2);
+    fail(this, error instanceof Error ? error.message : String(error), EXIT_CODES.validation);
   }
   const reportBody = report.data && typeof report.data === "object" && !Array.isArray(report.data) ? report.data : report;
   const reportShop = reportBody.shop ?? reportBody.shop_context ?? {};
   const shop_id = String(reportShop.shop_id ?? reportShop.id ?? reportBody.shop_id ?? "");
   const domain = String(reportShop.domain ?? reportBody.domain ?? "");
   if (!shop_id || !domain || opts.shop !== shop_id && opts.shop.toLowerCase() !== domain.toLowerCase()) {
-    fail(this, "TRIGGERS_CONFIG_ABSENT: --shop must match the report shop_id or domain", 2);
+    fail(
+      this,
+      "TRIGGERS_CONFIG_ABSENT: --shop must match the report shop_id or domain",
+      EXIT_CODES.validation
+    );
   }
   if (!proposals.length)
     fail(this, "TRIGGERS_NO_DATA: report has no usable purchase candidates", 3);
@@ -14782,29 +15924,34 @@ var recipe = new Command("apply-recipe").argument("<recipeId>").requiredOption("
   const params = Object.fromEntries(
     opts.param.map((pair) => {
       const i = pair.indexOf("=");
-      if (i < 1) fail(this, `TRIGGERS_CONFIG_ABSENT: invalid --param ${pair}; expected k=v`, 2);
+      if (i < 1)
+        fail(
+          this,
+          `TRIGGERS_CONFIG_ABSENT: invalid --param ${pair}; expected k=v`,
+          EXIT_CODES.validation
+        );
       return [pair.slice(0, i), parseParamValue(pair.slice(i + 1))];
     })
   );
-  const identity = await identify(this, opts.shop);
-  const res = await applyRuntimeSettingsRecipe(identity.credentials, { recipeId, params });
+  const identity2 = await identify(this, opts.shop);
+  const res = await applyRuntimeSettingsRecipe(identity2.credentials, { recipeId, params });
   if (!res.ok || !res.data)
     fail(
       this,
       `${res.status === 401 || res.status === 403 ? "TRIGGERS_AUTH" : "TRIGGERS_CONFIG_ABSENT"}: ${res.error ?? "Recipe failed"}`,
-      res.status === 401 || res.status === 403 ? 4 : 2,
+      classifyStatus(res.status),
       res.errorDetails
     );
   const result = {
     verdict: "TRIGGERS_APPLIED",
     ...res.data,
-    shop_id: identity.shop_id,
-    domain: identity.domain,
+    shop_id: identity2.shop_id,
+    domain: identity2.domain,
     applied_at: (/* @__PURE__ */ new Date()).toISOString()
   };
   output(this, result, () => {
     process.stdout.write(
-      `TRIGGERS_APPLIED shop_id=${identity.shop_id} domain=${identity.domain} applied_at=${result.applied_at} recipe=${recipeId}
+      `TRIGGERS_APPLIED shop_id=${identity2.shop_id} domain=${identity2.domain} applied_at=${result.applied_at} recipe=${recipeId}
 `
     );
     writeWarnings(result);
@@ -14813,35 +15960,39 @@ var recipe = new Command("apply-recipe").argument("<recipeId>").requiredOption("
 var enable = new Command("enable-capture").requiredOption("--hours <n>").requiredOption("--shop <domain-or-id>", "Shop domain or Apex shop ID").option("--url-pattern <p>", "URL pattern", collect, []).action(async function(opts) {
   const hours = Number(opts.hours);
   if (!Number.isFinite(hours) || hours <= 0 || hours > 48)
-    fail(this, "TRIGGERS_CONFIG_ABSENT: --hours must be greater than 0 and at most 48", 2);
+    fail(
+      this,
+      "TRIGGERS_CONFIG_ABSENT: --hours must be greater than 0 and at most 48",
+      EXIT_CODES.validation
+    );
   const expiresAt = new Date(Date.now() + hours * 36e5).toISOString();
   const setupCapture = {
     enabled: true,
     expiresAt,
     ...opts.urlPattern.length > 0 ? { urlPatterns: opts.urlPattern } : {}
   };
-  const { data, identity } = await send(this, opts.shop, { setupCapture });
-  const result = { verdict: "CAPTURE_ENABLED", ...identity, expiresAt, ...data };
+  const { data, identity: identity2 } = await send(this, opts.shop, { setupCapture });
+  const result = { verdict: "CAPTURE_ENABLED", ...identity2, expiresAt, ...data };
   output(
     this,
     result,
     () => process.stdout.write(
-      `CAPTURE_ENABLED shop_id=${identity.shop_id} domain=${identity.domain} expires_at=${expiresAt}
+      `CAPTURE_ENABLED shop_id=${identity2.shop_id} domain=${identity2.domain} expires_at=${expiresAt}
 `
     )
   );
 });
 var disable = new Command("disable-capture").requiredOption("--shop <domain-or-id>", "Shop domain or Apex shop ID").action(async function(opts) {
-  const { data, identity } = await send(this, opts.shop, {
+  const { data, identity: identity2 } = await send(this, opts.shop, {
     setupCapture: { enabled: false, expiresAt: null }
   });
   const disabled_at = (/* @__PURE__ */ new Date()).toISOString();
-  const result = { verdict: "CAPTURE_DISABLED", ...identity, disabled_at, ...data };
+  const result = { verdict: "CAPTURE_DISABLED", ...identity2, disabled_at, ...data };
   output(
     this,
     result,
     () => process.stdout.write(
-      `CAPTURE_DISABLED shop_id=${identity.shop_id} domain=${identity.domain} disabled_at=${disabled_at}
+      `CAPTURE_DISABLED shop_id=${identity2.shop_id} domain=${identity2.domain} disabled_at=${disabled_at}
 `
     )
   );
@@ -15061,8 +16212,8 @@ var qa2 = new Command("qa").description("Check static link/form handover paramet
     html = await response.text();
   } catch (error) {
     if (error instanceof CliError) throw error;
-    const reason = error instanceof Error ? error.message : String(error);
-    fail(this, `Could not fetch ${opts.from}: ${reason}`, EXIT_CODES.general);
+    const reason2 = error instanceof Error ? error.message : String(error);
+    fail(this, `Could not fetch ${opts.from}: ${reason2}`, EXIT_CODES.general);
   }
   const param = config.externalTracking.handoverQueryParam;
   const baseUrl = response.url || opts.from;
@@ -15109,6 +16260,138 @@ var qa2 = new Command("qa").description("Check static link/form handover paramet
 });
 var handoverCommand = new Command("handover").description("Manage cross-domain identity handover").addCommand(get4).addCommand(set4).addCommand(off2).addCommand(qa2);
 
+// src/commands/order-journey.ts
+function instant(value) {
+  const m = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2})(?::(\d{2})(?:\.(\d+))?)?(Z|[+-]\d{2}:\d{2})$/.exec(
+    value
+  );
+  if (!m) return null;
+  const year = Number(m[1]), month = Number(m[2]), day = Number(m[3]);
+  const leap = year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0);
+  const days = [31, leap ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
+  if (month < 1 || month > 12 || day < 1 || day > days[month - 1] || Number(m[4]) > 23 || Number(m[5]) > 59 || Number(m[6] ?? 0) > 59 || m[8] !== "Z" && (Number(m[8].slice(1, 3)) > 23 || Number(m[8].slice(4)) > 59))
+    return null;
+  const second = Date.parse(`${m[1]}-${m[2]}-${m[3]}T${m[4]}:${m[5]}:${m[6] ?? "00"}${m[8]}`);
+  return Number.isFinite(second) ? { second, fraction: (m[7] ?? "").replace(/0+$/, "") } : null;
+}
+function compare(a, b) {
+  if (a.second !== b.second) return a.second < b.second ? -1 : 1;
+  const precision = Math.max(a.fraction.length, b.fraction.length);
+  const left = a.fraction.padEnd(precision, "0"), right = b.fraction.padEnd(precision, "0");
+  return left === right ? 0 : left < right ? -1 : 1;
+}
+var record = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+var text = (v) => typeof v === "string" && v.length > 0;
+var reason = (v) => typeof v === "string" && (/^[a-z][a-z0-9_]{0,79}$/.test(v) || /^(publishedConfig|consentPolicy|goalMapping|sdkArtifact|sdkPolicy|identityPolicy|goalDefinition|resultWindow|inputSnapshot)_(expected_unknown|observed_unknown|mismatch|binding_mismatch)$/.test(
+  v
+));
+var member = (v, values) => typeof v === "string" && values.includes(v);
+var status = (v) => member(v, ["pass", "fail", "inconclusive"]);
+var count = (v) => typeof v === "number" && Number.isSafeInteger(v) && v >= 0;
+function validReport(v) {
+  if (!record(v) || v.schemaVersion !== 1 || v.finalStatisticalContribution !== "not_evaluated" || !record(v.evaluation) || !status(v.evaluation.status) || !member(v.evaluation.freshness, ["current", "stale", "unknown"]) || !Array.isArray(v.evaluation.stages) || !v.evaluation.stages.every(
+    (s) => record(s) && (s.freshness === void 0 || member(s.freshness, ["current", "stale", "unknown"])) && member(s.stage, [
+      "consent",
+      "assignment",
+      "event",
+      "order_identity",
+      "authoritative_fact",
+      "attribution",
+      "result"
+    ]) && status(s.status) && Array.isArray(s.reasonCodes) && s.reasonCodes.every(reason)
+  ))
+    return false;
+  if (v.receiptOutcomes !== void 0 && (!Array.isArray(v.receiptOutcomes) || v.receiptOutcomes.length > 6856 || !v.receiptOutcomes.every(
+    (r) => record(r) && text(r.receiptId) && text(r.stage) && text(r.producerContract) && record(r.scope) && [r.scope.experimentId, r.scope.variationId, r.scope.goalId].every(
+      (x) => x === null || text(x)
+    ) && member(r.freshness, ["current", "stale", "unknown"]) && Array.isArray(r.reasonCodes) && r.reasonCodes.every(reason)
+  )))
+    return false;
+  const coverage = v.assignmentCoverage;
+  if (!record(coverage) || typeof coverage.complete !== "boolean" || typeof coverage.overflowCountIsLowerBound !== "boolean" || !(coverage.overflowCount === null || count(coverage.overflowCount)))
+    return false;
+  return Array.isArray(v.assignments) && v.assignments.length <= 50 && v.assignments.every(
+    (a) => record(a) && text(a.experimentId) && text(a.variationId) && (a.storedAttribution === null || typeof a.storedAttribution === "boolean") && reason(a.reasonCode) && Array.isArray(a.goals) && a.goals.length <= 50 && a.goals.every(
+      (g) => record(g) && text(g.goalId) && member(g.status, [
+        "eligible_for_attributed_goal_read",
+        "excluded_from_attributed_goal_read",
+        "unknown"
+      ]) && reason(g.reasonCode)
+    )
+  );
+}
+var orderJourneyCommand = new Command("order-journey").description("Inspect retained order evidence and attributed-goal eligibility (read-only)").requiredOption("--platform <platform>", "shopify, shopware, woocommerce, centra or custom").option("--order-id <id>", "Platform order ID, mutually exclusive with --order-number").option("--order-number <number>", "Order number, mutually exclusive with --order-id").requiredOption("--environment <key>", "Exact environment").requiredOption("--from <iso>", "Inclusive ISO start timestamp").requiredOption("--to <iso>", "Inclusive ISO end timestamp, at most 31 days after start").option("--include-qa", "Include QA in the canonical eligibility read").action(async function(opts) {
+  const key = opts.orderId ?? opts.orderNumber;
+  const from = instant(opts.from), to = instant(opts.to);
+  if (Number(opts.orderId !== void 0) + Number(opts.orderNumber !== void 0) !== 1 || !key?.trim() || key.trim().length > 255 || /[\x00-\x1f\x7f]/.test(key) || !["shopify", "shopware", "woocommerce", "centra", "custom"].includes(opts.platform) || !/^[a-z0-9][a-z0-9_-]{0,63}$/.test(opts.environment) || !from || !to || compare(from, to) > 0 || compare(to, { ...from, second: from.second + 31 * 864e5 }) > 0 || compare(to, instant(new Date(Date.now() + 3e5).toISOString())) > 0) {
+    fail(
+      this,
+      "Invalid order journey query: supply exactly one order identifier and a bounded ISO interval",
+      EXIT_CODES.validation
+    );
+  }
+  const result = await getOrderJourney(requireCredentials(), {
+    ...opts,
+    orderId: opts.orderId?.trim(),
+    orderNumber: opts.orderNumber?.trim()
+  });
+  if (!result.ok || !result.data)
+    fail(this, result.error ?? "Order journey unavailable", classifyStatus(result.status));
+  const report = result.data.data;
+  if (!validReport(report)) fail(this, "Malformed order journey response", EXIT_CODES.general);
+  output(this, { data: report }, () => {
+    const coverage = report.assignmentCoverage;
+    printTable(
+      ["Assignment coverage", "Overflow"],
+      [
+        [
+          coverage.complete ? "complete" : "incomplete",
+          coverage.overflowCount === null ? "unknown" : `${coverage.overflowCount} (${coverage.overflowCountIsLowerBound ? "lower bound" : "exact"})`
+        ]
+      ]
+    );
+    printTable(
+      ["Journey", "Freshness", "Eligibility basis", "Final contribution"],
+      [
+        [
+          report.evaluation.status,
+          report.evaluation.freshness,
+          "attributed_goal_counts",
+          report.finalStatisticalContribution
+        ]
+      ]
+    );
+    printTable(
+      ["Stage", "Status", "Freshness", "Reasons"],
+      report.evaluation.stages.map((s) => [
+        s.stage,
+        s.status,
+        s.freshness ?? "unknown",
+        s.reasonCodes.join(", ")
+      ])
+    );
+    if (report.receiptOutcomes?.length)
+      printTable(
+        ["Receipt", "Stage", "Experiment / variation / goal", "Freshness"],
+        report.receiptOutcomes.map((r) => [
+          r.receiptId,
+          r.stage,
+          [r.scope.experimentId, r.scope.variationId, r.scope.goalId].filter(Boolean).join(" / ") || "global",
+          r.freshness
+        ])
+      );
+    printTable(
+      ["Experiment", "Variation", "Attribution", "Goal eligibility"],
+      report.assignments.map((a) => [
+        a.experimentId,
+        a.variationId,
+        a.storedAttribution === null ? "unknown" : a.storedAttribution ? "present" : "not observed",
+        a.goals.length ? a.goals.map((g) => `${g.goalId}: ${g.status} (${g.reasonCode})`).join("; ") : `unknown (${a.reasonCode})`
+      ])
+    );
+  });
+});
+
 // src/lib/detect-markers.ts
 var DETECTION_MARKERS = [
   {
@@ -15335,11 +16618,11 @@ async function fetchPrimaryHtml(host) {
       headers: { "user-agent": "apex-cli-doctor/1.0" },
       signal: AbortSignal.timeout(PAGE_FETCH_TIMEOUT_MS)
     });
-    const text = await res.text();
-    if (CHALLENGE_STATUSES.includes(res.status) || /cf-chl|challenge-platform|captcha/i.test(text))
+    const text2 = await res.text();
+    if (CHALLENGE_STATUSES.includes(res.status) || /cf-chl|challenge-platform|captcha/i.test(text2))
       return { protected: true };
     if (!res.ok) return { error: `http ${res.status}` };
-    return { html: text };
+    return { html: text2 };
   } catch (error) {
     return { error: error instanceof Error ? error.message : String(error) };
   }
@@ -15361,9 +16644,9 @@ function environmentByHost(envs) {
   }
   return map;
 }
-function devPollutionCheck(eventHosts, envs) {
+function devPollutionCheck(eventHosts, envs, unparsedRows) {
   const dev = eventHosts.filter((host) => isDevHost(host));
-  if (!dev.length)
+  if (!dev.length && !unparsedRows.length)
     return {
       checkId: "dev_pollution",
       status: "PASS",
@@ -15378,6 +16661,13 @@ function devPollutionCheck(eventHosts, envs) {
       return `${host} matches development host markers and is bound to the production environment`;
     return `${host} matches development host markers, sent production-labeled traffic, and is not bound to any environment`;
   });
+  if (unparsedRows.length) {
+    const pageviews = unparsedRows.reduce((sum, row) => sum + row.pageviews, 0);
+    const firstPath = unparsedRows[0].path || "(empty)";
+    evidence.push(
+      `${pageviews} production-labeled pageview(s) carry a host the analytics read could not parse (first path: ${firstPath}); development or local-file traffic cannot be ruled out`
+    );
+  }
   const mappable = dev.filter(
     (host) => (bindings.get(host) ?? PRODUCTION_ENVIRONMENT_KEY) === PRODUCTION_ENVIRONMENT_KEY
   );
@@ -15393,7 +16683,7 @@ var PURCHASE_CADENCE_WINDOW_MINUTES = PURCHASE_WINDOW_MINUTES * 4;
 var MIN_CAPTURE_WINDOW_MINUTES = 60;
 var DUPLICATE_RATE_THRESHOLD = 0.02;
 var MAGNITUDE_TOLERANCE_RATE = 0.1;
-function record(value) {
+function record2(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
 function purchasePlane(config) {
@@ -15401,8 +16691,8 @@ function purchasePlane(config) {
   const names = [];
   const triggers = config.runtime?.dataLayerTriggers ?? config.dataLayerTriggers;
   if (Array.isArray(triggers) && triggers.some((trigger) => {
-    const row = record(trigger);
-    const trackRevenue = record(row?.trackRevenue);
+    const row = record2(trigger);
+    const trackRevenue = record2(row?.trackRevenue);
     return row?.enabled !== false && trackRevenue !== null && trackRevenue.enabled !== false;
   }))
     names.push("dataLayer trigger");
@@ -15444,7 +16734,7 @@ function lineItemSum(value) {
   if (!Array.isArray(value)) return null;
   let sum = 0;
   for (const item of value) {
-    const row = record(item);
+    const row = record2(item);
     const price = numeric(row?.price);
     if (price === null) return null;
     sum += price * (numeric(row?.quantity) ?? 1);
@@ -15838,7 +17128,10 @@ async function runDoctor(options = {}) {
   const rows = inventory.rows;
   const inventoryCaveat = inventory.truncated ? [INVENTORY_TRUNCATED_CAVEAT] : [];
   const hosts = configuredHosts(domainsRes.data, envsRes.data);
-  const eventHosts = [...new Set(rows.map((row) => row.host.toLowerCase()))];
+  const unparsedRows = rows.filter((row) => row.host.trim() === "");
+  const eventHosts = [
+    ...new Set(rows.filter((row) => row.host.trim() !== "").map((row) => row.host.toLowerCase()))
+  ];
   const checks = [];
   const unbound = eventHosts.filter((host) => !hosts.has(host));
   checks.push(
@@ -15859,7 +17152,9 @@ async function runDoctor(options = {}) {
       ]
     }
   );
-  checks.push(withCaveat(devPollutionCheck(eventHosts, envsRes.data), inventoryCaveat));
+  checks.push(
+    withCaveat(devPollutionCheck(eventHosts, envsRes.data, unparsedRows), inventoryCaveat)
+  );
   const primary = hostOnly(domainsRes.data.domain) ?? eventHosts[0];
   const shopId = resolveShopId(options) ?? domainsRes.data.shop_id;
   const workerBase = resolveWorkerBase(options);
@@ -16019,11 +17314,11 @@ function withCaveat(check, caveat) {
 }
 var DAY_MS = 864e5;
 function parseDay(value) {
-  const text = value?.trim();
-  if (!text || !/^\d{4}-\d{2}-\d{2}$/.test(text)) return null;
-  const parsed = Date.parse(`${text}T00:00:00.000Z`);
+  const text2 = value?.trim();
+  if (!text2 || !/^\d{4}-\d{2}-\d{2}$/.test(text2)) return null;
+  const parsed = Date.parse(`${text2}T00:00:00.000Z`);
   if (Number.isNaN(parsed)) return null;
-  return toDay(parsed) === text ? parsed : null;
+  return toDay(parsed) === text2 ? parsed : null;
 }
 function toDay(value) {
   return new Date(value).toISOString().slice(0, 10);
@@ -16263,7 +17558,7 @@ function urlsCommand() {
     );
   });
 }
-var analyticsCommand = new Command("analytics").description("Read shop analytics").addCommand(analyticsSubcommand("stats", "Show dashboard analytics stats", 7)).addCommand(analyticsSubcommand("timeseries", "Show analytics timeseries", 30)).addCommand(analyticsSubcommand("traffic", "Show traffic sources", 30)).addCommand(analyticsSubcommand("pages", "Show page analytics", 30)).addCommand(analyticsSubcommand("geo", "Show geography and device analytics", 30)).addCommand(analyticsSubcommand("sessions", "Show session analytics", 30)).addCommand(analyticsSubcommand("realtime", "Show realtime analytics")).addCommand(analyticsSubcommand("entry-exit", "Show entry and exit page analytics", 30)).addCommand(consentRateCommand).addCommand(urlsCommand()).addHelpText(
+var analyticsCommand = new Command("analytics").description("Read shop analytics").addCommand(orderJourneyCommand).addCommand(analyticsSubcommand("stats", "Show dashboard analytics stats", 7)).addCommand(analyticsSubcommand("timeseries", "Show analytics timeseries", 30)).addCommand(analyticsSubcommand("traffic", "Show traffic sources", 30)).addCommand(analyticsSubcommand("pages", "Show page analytics", 30)).addCommand(analyticsSubcommand("geo", "Show geography and device analytics", 30)).addCommand(analyticsSubcommand("sessions", "Show session analytics", 30)).addCommand(analyticsSubcommand("realtime", "Show realtime analytics")).addCommand(analyticsSubcommand("entry-exit", "Show entry and exit page analytics", 30)).addCommand(consentRateCommand).addCommand(urlsCommand()).addHelpText(
   "after",
   `
 Examples:
@@ -16275,7 +17570,7 @@ Examples:
 );
 
 // src/commands/install.ts
-var import_promises3 = require("node:dns/promises");
+var import_promises4 = require("node:dns/promises");
 var import_node_http2 = require("node:http");
 var import_node_https = require("node:https");
 var import_node_net = require("node:net");
@@ -16284,6 +17579,23 @@ var DESKTOP_UA = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/53
 var PRODUCTION_WORKER_BASE_URL2 = "https://events.drip-apex.com";
 var UrlPolicyError = class extends Error {
 };
+var IdentityProxyError = class extends Error {
+  constructor(originalUrl, proxyHost) {
+    super(
+      `${originalUrl} redirects to ${proxyHost}, an identity-aware proxy sign-in; the install check cannot reach a storefront behind it`
+    );
+    this.originalUrl = originalUrl;
+    this.proxyHost = proxyHost;
+  }
+  originalUrl;
+  proxyHost;
+};
+var IDENTITY_PROXY_HOSTS = ["accounts.google.com", "login.microsoftonline.com"];
+var IDENTITY_PROXY_SUFFIXES = [".cloudflareaccess.com"];
+function identityProxyHost(host) {
+  const normalized = normalizeHostname(host);
+  return IDENTITY_PROXY_HOSTS.includes(normalized) || IDENTITY_PROXY_SUFFIXES.some((suffix) => normalized.endsWith(suffix));
+}
 function normalizeHostname(host) {
   return host.toLowerCase().replace(/\.$/, "");
 }
@@ -16316,7 +17628,7 @@ var testResolver;
 var testFetch;
 async function resolveHost(hostname) {
   const mocked = testResolver?.(hostname) ?? null;
-  const addresses = mocked ?? await (0, import_promises3.lookup)(hostname, { all: true });
+  const addresses = mocked ?? await (0, import_promises4.lookup)(hostname, { all: true });
   return addresses.map((entry) => entry.address);
 }
 async function validateUrl(raw, allowedHosts) {
@@ -16427,7 +17739,7 @@ function overLimitMessage(hostname, maxBytes) {
   return `Response from ${hostname} exceeded the ${maxBytes}-byte cap`;
 }
 function responseFromIncoming(res, body5, decoded) {
-  const status2 = res.statusCode ?? 0;
+  const status3 = res.statusCode ?? 0;
   const headers = new Headers();
   for (const [key, value] of Object.entries(res.headers)) {
     if (Array.isArray(value)) for (const entry of value) headers.append(key, entry);
@@ -16437,9 +17749,9 @@ function responseFromIncoming(res, body5, decoded) {
     headers.delete("content-encoding");
     headers.delete("content-length");
   }
-  const nullBody = status2 === 101 || status2 === 204 || status2 === 205 || status2 === 304;
+  const nullBody = status3 === 101 || status3 === 204 || status3 === 205 || status3 === 304;
   return new Response(nullBody ? null : body5, {
-    status: status2,
+    status: status3,
     statusText: res.statusMessage ?? "",
     headers
   });
@@ -16574,7 +17886,10 @@ async function fetchSafe(raw, allowedHosts, limits) {
     if (![301, 302, 303, 307, 308].includes(result.response.status)) return result;
     const location = result.response.headers.get("location");
     if (!location) return result;
-    target = await validateUrl(new URL(location, target.url).toString(), allowedHosts);
+    const next = new URL(location, target.url);
+    if (identityProxyHost(next.hostname))
+      throw new IdentityProxyError(raw, normalizeHostname(next.hostname));
+    target = await validateUrl(next.toString(), allowedHosts);
   }
   throw new UrlPolicyError("Redirect limit exceeded (5)");
 }
@@ -16584,7 +17899,7 @@ function detectChallenge(html) {
   );
 }
 var LEGACY_SNIPPET_MARKER = /sdk\.drip-apex\.com|events\.drip-apex\.com|\/drip\.js\b|\bDrip\.init\s*\(|\bwindow\.drip\b/i;
-function pageReport(url, shopId, status2, html, workerSnippetPresent, bodyTruncated) {
+function pageReport(url, shopId, status3, html, workerSnippetPresent, bodyTruncated) {
   const challenge = detectChallenge(html);
   const shopIdMatches = html.includes(shopId);
   const snippetPresent = workerSnippetPresent || LEGACY_SNIPPET_MARKER.test(html) && shopIdMatches;
@@ -16592,29 +17907,29 @@ function pageReport(url, shopId, status2, html, workerSnippetPresent, bodyTrunca
     return {
       url,
       status: "WARN",
-      httpStatus: status2,
+      httpStatus: status3,
       snippetPresent,
       shopIdMatches,
       botChallenge: true,
       bodyTruncated,
       message: "Bot challenge detected; verify in a real browser."
     };
-  if (status2 < 200 || status2 >= 300)
+  if (status3 < 200 || status3 >= 300)
     return {
       url,
       status: "FAIL",
-      httpStatus: status2,
+      httpStatus: status3,
       snippetPresent,
       shopIdMatches,
       botChallenge: false,
       bodyTruncated,
-      message: `Storefront page returned HTTP ${status2}; the install cannot be verified from this response.`
+      message: `Storefront page returned HTTP ${status3}; the install cannot be verified from this response.`
     };
   if (!snippetPresent)
     return {
       url,
       status: "FAIL",
-      httpStatus: status2,
+      httpStatus: status3,
       snippetPresent,
       shopIdMatches,
       botChallenge: false,
@@ -16625,7 +17940,7 @@ function pageReport(url, shopId, status2, html, workerSnippetPresent, bodyTrunca
     return {
       url,
       status: "FAIL",
-      httpStatus: status2,
+      httpStatus: status3,
       snippetPresent,
       shopIdMatches,
       botChallenge: false,
@@ -16635,7 +17950,7 @@ function pageReport(url, shopId, status2, html, workerSnippetPresent, bodyTrunca
   return {
     url,
     status: "PASS",
-    httpStatus: status2,
+    httpStatus: status3,
     snippetPresent,
     shopIdMatches,
     botChallenge: false,
@@ -16832,6 +18147,18 @@ var installCommand = new Command("install").description("Check Apex storefront i
         pageReport(url, shopId, response.status, html, derivedWorkerBaseUrl !== null, truncated)
       );
     } catch (error) {
+      if (error instanceof IdentityProxyError) {
+        pages.push({
+          url,
+          status: "WARN",
+          snippetPresent: false,
+          shopIdMatches: false,
+          botChallenge: false,
+          blockedBy: "identity_proxy",
+          message: `blocked_by_identity_proxy: ${error.message}. Verify from a signed-in browser.`
+        });
+        continue;
+      }
       if (error instanceof UrlPolicyError) fail(this, error.message, EXIT_CODES.validation);
       if (error instanceof BodyDecodeError) {
         pages.push({
@@ -16939,18 +18266,18 @@ var installCommand = new Command("install").description("Check Apex storefront i
 
 // src/commands/flags.ts
 init_source();
-var import_node_fs17 = __toESM(require("node:fs"));
-var import_node_path15 = __toESM(require("node:path"));
+var import_node_fs19 = __toESM(require("node:fs"));
+var import_node_path16 = __toESM(require("node:path"));
 
 // src/edge-status.ts
 function getEdgeDeliveryStatus(deliveryType, expectedWorstCaseSeconds = 360) {
   return deliveryType === "api" ? { edge_delivery: "not_applicable", message: `API-delivered flag \u2014 edge delivery is not applicable. A previously cached visual payload may remain at some PoPs for up to ~${expectedWorstCaseSeconds}s; a single-vantage status cannot prove global propagation.` } : { edge_delivery: "applicable", message: null };
 }
 function parsePublicationMetadata(value) {
-  const record2 = value && typeof value === "object" ? value : {};
+  const record3 = value && typeof value === "object" ? value : {};
   return {
-    publication_revision: Number.isSafeInteger(record2.publication_revision) && record2.publication_revision >= 0 ? record2.publication_revision : null,
-    generated_at: typeof record2.generated_at === "string" && !Number.isNaN(Date.parse(record2.generated_at)) ? record2.generated_at : null
+    publication_revision: Number.isSafeInteger(record3.publication_revision) && record3.publication_revision >= 0 ? record3.publication_revision : null,
+    generated_at: typeof record3.generated_at === "string" && !Number.isNaN(Date.parse(record3.generated_at)) ? record3.generated_at : null
   };
 }
 function compareEdgePublication(currentValue, edgeValue, expectedWorstCaseSeconds, flagUpdatedAtValue, confirmedAt = (/* @__PURE__ */ new Date()).toISOString()) {
@@ -16967,13 +18294,13 @@ function compareEdgePublication(currentValue, edgeValue, expectedWorstCaseSecond
   if (edge.publication_revision < current.publication_revision) return { ...base, verdict: "propagating", relationship: "edge_behind" };
   return { ...base, verdict: "live", relationship: edge.publication_revision > current.publication_revision ? "edge_ahead" : "equal" };
 }
-function formatEdgePropagationStatus(status2) {
+function formatEdgePropagationStatus(status3) {
   const caveat = "This checks one CDN vantage point; other PoPs may lag by up to max-age.";
-  if (status2.verdict === "pending_publication") return `Pending publication \u2014 flag updated ${status2.flag_updated_at}, after the latest publication generated ${status2.current.generated_at ?? "never"}; the latest change is not live. After publication, allow ~${status2.expected_worst_case_seconds}s for propagation. ${caveat}`;
-  if (status2.verdict === "unknown") return `Unknown \u2014 edge payload predates publication metadata. ${caveat}`;
-  if (status2.verdict === "propagating") return `Propagating \u2014 edge revision ${status2.edge.publication_revision} (generated ${status2.edge.generated_at}) vs current revision ${status2.current.publication_revision} (generated ${status2.current.generated_at}); expected within ~${status2.expected_worst_case_seconds}s after generation. ${caveat}`;
-  const anomaly = status2.relationship === "edge_ahead" ? ` (edge is ahead of current revision ${status2.current.publication_revision}; anomalous)` : "";
-  return `Live at edge \u2014 revision ${status2.edge.publication_revision} (generated ${status2.edge.generated_at}) confirmed at edge at ${status2.confirmed_at}${anomaly}. ${caveat}`;
+  if (status3.verdict === "pending_publication") return `Pending publication \u2014 flag updated ${status3.flag_updated_at}, after the latest publication generated ${status3.current.generated_at ?? "never"}; the latest change is not live. After publication, allow ~${status3.expected_worst_case_seconds}s for propagation. ${caveat}`;
+  if (status3.verdict === "unknown") return `Unknown \u2014 edge payload predates publication metadata. ${caveat}`;
+  if (status3.verdict === "propagating") return `Propagating \u2014 edge revision ${status3.edge.publication_revision} (generated ${status3.edge.generated_at}) vs current revision ${status3.current.publication_revision} (generated ${status3.current.generated_at}); expected within ~${status3.expected_worst_case_seconds}s after generation. ${caveat}`;
+  const anomaly = status3.relationship === "edge_ahead" ? ` (edge is ahead of current revision ${status3.current.publication_revision}; anomalous)` : "";
+  return `Live at edge \u2014 revision ${status3.edge.publication_revision} (generated ${status3.edge.generated_at}) confirmed at edge at ${status3.confirmed_at}${anomaly}. ${caveat}`;
 }
 
 // src/commands/flags.ts
@@ -16982,9 +18309,9 @@ function body(command, value, opts) {
   let parsed = {};
   if (value) {
     const source = value.startsWith("@") ? value.slice(1) : value;
-    const text = value.startsWith("@") || import_node_fs17.default.existsSync(source) ? import_node_fs17.default.readFileSync(import_node_path15.default.resolve(process.cwd(), source), "utf8") : value;
+    const text2 = value.startsWith("@") || import_node_fs19.default.existsSync(source) ? import_node_fs19.default.readFileSync(import_node_path16.default.resolve(process.cwd(), source), "utf8") : value;
     try {
-      parsed = JSON.parse(text);
+      parsed = JSON.parse(text2);
     } catch (e) {
       fail(
         command,
@@ -17032,7 +18359,7 @@ var get5 = new Command("get").description("Get a flag").argument("<id>").action(
     fail(this, r.error ?? "Failed to get", classifyStatus(r.status), r.errorDetails);
   output(this, r.data, () => detail(r.data));
 });
-var status = new Command("status").description("Check whether a flag publication is live at the edge").argument("<id>").action(async function(id) {
+var status2 = new Command("status").description("Check whether a flag publication is live at the edge").argument("<id>").action(async function(id) {
   const r = await getFlagStatus(requireCredentials(), id);
   if (!r.ok || !r.data)
     fail(this, r.error ?? "Failed to get flag status", classifyStatus(r.status), r.errorDetails);
@@ -17103,7 +18430,7 @@ function lifecycle(action74) {
     output(this, r.data, () => detail(r.data));
   });
 }
-var flagsCommand = new Command("flags").description("Manage flags").addCommand(list6).addCommand(get5).addCommand(status).addCommand(write("create")).addCommand(write("update")).addCommand(lifecycle("activate")).addCommand(lifecycle("pause")).addCommand(lifecycle("archive")).addHelpText(
+var flagsCommand = new Command("flags").description("Manage flags").addCommand(list6).addCommand(get5).addCommand(status2).addCommand(write("create")).addCommand(write("update")).addCommand(lifecycle("activate")).addCommand(lifecycle("pause")).addCommand(lifecycle("archive")).addHelpText(
   "after",
   `
 Examples:
@@ -17115,8 +18442,8 @@ Examples:
 );
 
 // src/commands/backlog.ts
-var import_node_fs18 = __toESM(require("node:fs"));
-var import_node_path16 = __toESM(require("node:path"));
+var import_node_fs20 = __toESM(require("node:fs"));
+var import_node_path17 = __toESM(require("node:path"));
 init_source();
 var kind2 = "backlog";
 var singular = "backlog item";
@@ -17124,8 +18451,8 @@ function parse(command, value) {
   if (!value) return {};
   try {
     const source = value.startsWith("@") ? value.slice(1) : value;
-    const text = value.startsWith("@") || import_node_fs18.default.existsSync(source) ? import_node_fs18.default.readFileSync(import_node_path16.default.resolve(process.cwd(), source), "utf8") : value;
-    const body5 = JSON.parse(text);
+    const text2 = value.startsWith("@") || import_node_fs20.default.existsSync(source) ? import_node_fs20.default.readFileSync(import_node_path17.default.resolve(process.cwd(), source), "utf8") : value;
+    const body5 = JSON.parse(text2);
     if (!body5 || typeof body5 !== "object" || Array.isArray(body5))
       throw new Error("body must be an object");
     return body5;
@@ -17401,8 +18728,8 @@ var fields2 = new Command("fields").description("Manage the shop's own idea fiel
 var backlogCommand = new Command("backlog").description("Manage backlog").addCommand(list7).addCommand(get6).addCommand(write2("create")).addCommand(write2("update")).addCommand(archive).addCommand(restore).addCommand(remove2).addCommand(fields2);
 
 // src/commands/signals.ts
-var import_node_fs19 = __toESM(require("node:fs"));
-var import_node_path17 = __toESM(require("node:path"));
+var import_node_fs21 = __toESM(require("node:fs"));
+var import_node_path18 = __toESM(require("node:path"));
 init_source();
 var kind3 = "signals";
 var singular2 = "signal";
@@ -17410,8 +18737,8 @@ function parse2(command, value) {
   if (!value) return {};
   try {
     const source = value.startsWith("@") ? value.slice(1) : value;
-    const text = value.startsWith("@") || import_node_fs19.default.existsSync(source) ? import_node_fs19.default.readFileSync(import_node_path17.default.resolve(process.cwd(), source), "utf8") : value;
-    const body5 = JSON.parse(text);
+    const text2 = value.startsWith("@") || import_node_fs21.default.existsSync(source) ? import_node_fs21.default.readFileSync(import_node_path18.default.resolve(process.cwd(), source), "utf8") : value;
+    const body5 = JSON.parse(text2);
     if (!body5 || typeof body5 !== "object" || Array.isArray(body5))
       throw new Error("body must be an object");
     return body5;
@@ -17492,16 +18819,16 @@ var signalsCommand = new Command("signals").description("Manage signals").addCom
 
 // src/commands/personalizations.ts
 init_source();
-var import_node_fs20 = __toESM(require("node:fs"));
-var import_node_path18 = __toESM(require("node:path"));
+var import_node_fs22 = __toESM(require("node:fs"));
+var import_node_path19 = __toESM(require("node:path"));
 var kind4 = "personalizations";
 function body2(command, value, opts) {
   let parsed = {};
   if (value) {
     const source = value.startsWith("@") ? value.slice(1) : value;
-    const text = value.startsWith("@") || import_node_fs20.default.existsSync(source) ? import_node_fs20.default.readFileSync(import_node_path18.default.resolve(process.cwd(), source), "utf8") : value;
+    const text2 = value.startsWith("@") || import_node_fs22.default.existsSync(source) ? import_node_fs22.default.readFileSync(import_node_path19.default.resolve(process.cwd(), source), "utf8") : value;
     try {
-      parsed = JSON.parse(text);
+      parsed = JSON.parse(text2);
     } catch (e) {
       fail(
         command,
@@ -17581,14 +18908,14 @@ var personalizationsCommand = new Command("personalizations").description("Manag
 
 // src/commands/targeting-resources.ts
 init_source();
-var import_node_fs21 = __toESM(require("node:fs"));
-var import_node_path19 = __toESM(require("node:path"));
+var import_node_fs23 = __toESM(require("node:fs"));
+var import_node_path20 = __toESM(require("node:path"));
 function body3(command, value) {
   if (!value) return {};
   const source = value.startsWith("@") ? value.slice(1) : value;
   try {
-    const text = value.startsWith("@") || import_node_fs21.default.existsSync(source) ? import_node_fs21.default.readFileSync(import_node_path19.default.resolve(process.cwd(), source), "utf8") : value;
-    return JSON.parse(text);
+    const text2 = value.startsWith("@") || import_node_fs23.default.existsSync(source) ? import_node_fs23.default.readFileSync(import_node_path20.default.resolve(process.cwd(), source), "utf8") : value;
+    return JSON.parse(text2);
   } catch (error) {
     fail(
       command,
@@ -17830,8 +19157,8 @@ var targetingCommand = new Command("targeting").description("Test experiment tar
 
 // src/commands/sos.ts
 init_source();
-var import_node_fs22 = __toESM(require("node:fs"));
-var import_node_path20 = __toESM(require("node:path"));
+var import_node_fs24 = __toESM(require("node:fs"));
+var import_node_path21 = __toESM(require("node:path"));
 var SOS_TYPES = /* @__PURE__ */ new Set([
   "full_handover",
   "design",
@@ -17844,7 +19171,7 @@ var SOS_TYPES = /* @__PURE__ */ new Set([
 function readText(value) {
   if (!value) return void 0;
   if (!value.startsWith("@")) return value;
-  return import_node_fs22.default.readFileSync(import_node_path20.default.resolve(process.cwd(), value.slice(1)), "utf8");
+  return import_node_fs24.default.readFileSync(import_node_path21.default.resolve(process.cwd(), value.slice(1)), "utf8");
 }
 function printTicket(ticket, reused) {
   console.log();
@@ -17982,14 +19309,14 @@ var markRead = new Command("mark-read").option("--channel <key>", "Mark one chan
 var inboxCommand = new Command("inbox").description("Read and send inbox messages").addCommand(list11).addCommand(send2).addCommand(markRead);
 
 // src/commands/shops.ts
-var import_node_fs23 = __toESM(require("node:fs"));
-var import_node_path21 = __toESM(require("node:path"));
+var import_node_fs25 = __toESM(require("node:fs"));
+var import_node_path22 = __toESM(require("node:path"));
 function body4(command, raw) {
   if (!raw) return {};
   try {
     const source = raw.startsWith("@") ? raw.slice(1) : raw;
-    const text = raw.startsWith("@") || import_node_fs23.default.existsSync(source) ? import_node_fs23.default.readFileSync(import_node_path21.default.resolve(source), "utf8") : raw;
-    const value = JSON.parse(text);
+    const text2 = raw.startsWith("@") || import_node_fs25.default.existsSync(source) ? import_node_fs25.default.readFileSync(import_node_path22.default.resolve(source), "utf8") : raw;
+    const value = JSON.parse(text2);
     if (!value || typeof value !== "object" || Array.isArray(value))
       throw new Error("body must be an object");
     return value;
@@ -18370,7 +19697,7 @@ function parseContainer(source, id, dataLayerName = "dataLayer") {
       vtpPaths,
       ecommerceFrom: [...ecommerce][0] ?? null,
       serverContainerUrl: [...serverUrls][0] ?? null,
-      piiPaths: vtpPaths.filter((path24) => /email|phone|address|name/i.test(path24))
+      piiPaths: vtpPaths.filter((path25) => /email|phone|address|name/i.test(path25))
     }
   };
 }
@@ -18439,11 +19766,11 @@ function isContainerField(field) {
   const types = baseFieldTypes(field);
   return types.has("obj") || types.has("arr");
 }
-function hasSyntheticPlaceholder(path24) {
-  return path24.split(".").map((segment) => segment.replace(/\[\]$/, "")).some((segment) => /^<[^>]+>$/.test(segment));
+function hasSyntheticPlaceholder(path25) {
+  return path25.split(".").map((segment) => segment.replace(/\[\]$/, "")).some((segment) => /^<[^>]+>$/.test(segment));
 }
-function ambiguousDottedPrefix(event, path24) {
-  const segments = path24.split(".");
+function ambiguousDottedPrefix(event, path25) {
+  const segments = path25.split(".");
   for (let index = 1; index < segments.length; index += 1) {
     const prefix = segments.slice(0, index).join(".");
     const parent = event.fields.find((field) => field.path === prefix);
@@ -18452,42 +19779,42 @@ function ambiguousDottedPrefix(event, path24) {
   return void 0;
 }
 function dimensionEligibility(event, field) {
-  const path24 = field.path;
-  if (hasSyntheticPlaceholder(path24)) {
+  const path25 = field.path;
+  if (hasSyntheticPlaceholder(path25)) {
     return {
       eligible: false,
-      message: `Path ${JSON.stringify(path24)} is a synthetic placeholder and cannot create a dimension. Choose an observed scalar path.`
+      message: `Path ${JSON.stringify(path25)} is a synthetic placeholder and cannot create a dimension. Choose an observed scalar path.`
     };
   }
   if (isContainerField(field)) {
     return {
       eligible: false,
-      message: `Path ${JSON.stringify(path24)} is container-typed. Choose an observed scalar path.`
+      message: `Path ${JSON.stringify(path25)} is container-typed. Choose an observed scalar path.`
     };
   }
-  if (path24.includes("[]")) {
+  if (path25.includes("[]")) {
     return {
       eligible: false,
-      message: `Path ${JSON.stringify(path24)} includes an array-element segment and cannot create a reliable dimension. Choose a scalar path outside an array.`
+      message: `Path ${JSON.stringify(path25)} includes an array-element segment and cannot create a reliable dimension. Choose a scalar path outside an array.`
     };
   }
   if (!isStableField(field)) {
     return {
       eligible: false,
-      message: `Path ${JSON.stringify(path24)} does not have a stable observed type. Choose a path without a type collision.`
+      message: `Path ${JSON.stringify(path25)} does not have a stable observed type. Choose a path without a type collision.`
     };
   }
   if (!event.event) {
     return {
       eligible: false,
-      message: `Path ${JSON.stringify(path24)} has no observed event name. Choose a path from a named event.`
+      message: `Path ${JSON.stringify(path25)} has no observed event name. Choose a path from a named event.`
     };
   }
-  const ambiguousPrefix = ambiguousDottedPrefix(event, path24);
+  const ambiguousPrefix = ambiguousDottedPrefix(event, path25);
   if (ambiguousPrefix) {
     return {
       eligible: false,
-      message: `Path ${JSON.stringify(path24)} could be a literal key containing dots because the discovery report has no observed container at ${JSON.stringify(ambiguousPrefix)}. Apex cannot safely create a capture for it.`
+      message: `Path ${JSON.stringify(path25)} could be a literal key containing dots because the discovery report has no observed container at ${JSON.stringify(ambiguousPrefix)}. Apex cannot safely create a capture for it.`
     };
   }
   return { eligible: true };
@@ -18496,24 +19823,24 @@ function isNumericField(field) {
   const numericTypes = /* @__PURE__ */ new Set(["num", "numstr", "numstr_comma"]);
   return field.types.length > 0 && field.types.every((type) => numericTypes.has(type.split(":")[0]));
 }
-function defaultDimensionLabel(path24) {
-  const words = path24.split(/[._-]+/).filter(Boolean).join(" ");
-  return words ? `${words[0].toUpperCase()}${words.slice(1)}` : path24;
+function defaultDimensionLabel(path25) {
+  const words = path25.split(/[._-]+/).filter(Boolean).join(" ");
+  return words ? `${words[0].toUpperCase()}${words.slice(1)}` : path25;
 }
 function quoteShellArgument(value) {
   return "'" + value.replaceAll("'", "'\\''") + "'";
 }
-function createDimensionInvocation(path24, eventName) {
-  return `apex discover --create-dimension ${quoteShellArgument(path24)} --event ${quoteShellArgument(eventName)}`;
+function createDimensionInvocation(path25, eventName) {
+  return `apex discover --create-dimension ${quoteShellArgument(path25)} --event ${quoteShellArgument(eventName)}`;
 }
-function resolveDimensionObservation(command, report, path24, eventName) {
+function resolveDimensionObservation(command, report, path25, eventName) {
   const matches = report.data_layer.flatMap(
-    (event) => event.fields.filter((field) => field.path === path24).map((field) => ({ event, field }))
+    (event) => event.fields.filter((field) => field.path === path25).map((field) => ({ event, field }))
   );
   if (!matches.length) {
     fail(
       command,
-      `Path ${JSON.stringify(path24)} was not found in the current discovery report. Run apex discover and copy an observed path exactly.`,
+      `Path ${JSON.stringify(path25)} was not found in the current discovery report. Run apex discover and copy an observed path exactly.`,
       EXIT_CODES.validation
     );
   }
@@ -18523,7 +19850,7 @@ function resolveDimensionObservation(command, report, path24, eventName) {
     if (!eventMatches.length) {
       fail(
         command,
-        `Path ${JSON.stringify(path24)} was not observed on event ${JSON.stringify(eventName)}. Run apex discover and copy the event name exactly.`,
+        `Path ${JSON.stringify(path25)} was not observed on event ${JSON.stringify(eventName)}. Run apex discover and copy the event name exactly.`,
         EXIT_CODES.validation
       );
     }
@@ -18531,7 +19858,7 @@ function resolveDimensionObservation(command, report, path24, eventName) {
     if (layers.length > 1) {
       fail(
         command,
-        `Path ${JSON.stringify(path24)} on event ${JSON.stringify(eventName)} was observed on multiple data layers: ${layers.join(", ")}. Dimensions bind to one layer; this ambiguity cannot be resolved automatically \u2014 capture the value under one layer, or define the dimension in the dashboard with the data layer name set explicitly.`,
+        `Path ${JSON.stringify(path25)} on event ${JSON.stringify(eventName)} was observed on multiple data layers: ${layers.join(", ")}. Dimensions bind to one layer; this ambiguity cannot be resolved automatically \u2014 capture the value under one layer, or define the dimension in the dashboard with the data layer name set explicitly.`,
         EXIT_CODES.validation
       );
     }
@@ -18543,7 +19870,7 @@ function resolveDimensionObservation(command, report, path24, eventName) {
     if (namedEvents.length > 1) {
       fail(
         command,
-        `Path ${JSON.stringify(path24)} was observed on multiple events: ${namedEvents.join(", ")}. Retry with --event <name>.`,
+        `Path ${JSON.stringify(path25)} was observed on multiple events: ${namedEvents.join(", ")}. Retry with --event <name>.`,
         EXIT_CODES.validation
       );
     }
@@ -18552,7 +19879,7 @@ function resolveDimensionObservation(command, report, path24, eventName) {
     if (layers.length > 1) {
       fail(
         command,
-        `Path ${JSON.stringify(path24)} on event ${JSON.stringify(namedEvents[0] ?? "")} was observed on multiple data layers: ${layers.join(", ")}. Dimensions bind to one layer; this ambiguity cannot be resolved automatically \u2014 capture the value under one layer, or define the dimension in the dashboard with the data layer name set explicitly.`,
+        `Path ${JSON.stringify(path25)} on event ${JSON.stringify(namedEvents[0] ?? "")} was observed on multiple data layers: ${layers.join(", ")}. Dimensions bind to one layer; this ambiguity cannot be resolved automatically \u2014 capture the value under one layer, or define the dimension in the dashboard with the data layer name set explicitly.`,
         EXIT_CODES.validation
       );
     }
@@ -18587,9 +19914,9 @@ function renderDiscovery(report) {
       `
 ${event.event || "(unnamed event)"} [${event.dlName}] \u2014 ${event.count} observation(s)${event.matched ? " \u2014 matched" : ""}; t_ms p50=${event.t_ms_p50 ?? "n/a"}, p95=${event.t_ms_p95 ?? "n/a"}, pre-init=${event.pre_init_count}`
     );
-    for (const path24 of event.paths)
+    for (const path25 of event.paths)
       lines.push(
-        `  URL ${path24.path}: ${path24.pageviews} pageviews, ${path24.count} pushes, ${path24.pspReturn_count} PSP returns`
+        `  URL ${path25.path}: ${path25.pageviews} pageviews, ${path25.count} pushes, ${path25.pspReturn_count} PSP returns`
       );
     for (const field of event.fields) {
       lines.push(
@@ -18767,11 +20094,11 @@ var discoverCommand = new Command("discover").description("Read back the trackin
       );
     }
     if (!created.ok || !created.data) {
-      const reason = created.error ?? "The signals API rejected the request";
+      const reason2 = created.error ?? "The signals API rejected the request";
       if (created.status === 409) {
         fail(
           this,
-          `Dimension was not created: ${reason} Choose another --key or archive an existing dimension in Audience > Attributes, then retry.`,
+          `Dimension was not created: ${reason2} Choose another --key or archive an existing dimension in Audience > Attributes, then retry.`,
           classifyStatus(created.status),
           created.errorDetails
         );
@@ -18779,14 +20106,14 @@ var discoverCommand = new Command("discover").description("Read back the trackin
       if (created.status === 400) {
         fail(
           this,
-          `Dimension was not created: ${reason} Check --create-dimension, --event, --key, and --label, then retry.`,
+          `Dimension was not created: ${reason2} Check --create-dimension, --event, --key, and --label, then retry.`,
           classifyStatus(created.status),
           created.errorDetails
         );
       }
       fail(
         this,
-        `Dimension was not created: ${reason}`,
+        `Dimension was not created: ${reason2}`,
         classifyStatus(created.status),
         created.errorDetails
       );
@@ -18802,16 +20129,16 @@ var discoverCommand = new Command("discover").description("Read back the trackin
 });
 
 // src/commands/skills.ts
-var import_node_fs24 = __toESM(require("node:fs"));
-var import_node_path22 = __toESM(require("node:path"));
+var import_node_fs26 = __toESM(require("node:fs"));
+var import_node_path23 = __toESM(require("node:path"));
 function packageRoot() {
   const candidates = [
-    import_node_path22.default.resolve(__dirname, ".."),
-    import_node_path22.default.resolve(import_node_path22.default.dirname(process.argv[1] ?? process.cwd()), ".."),
-    import_node_path22.default.resolve(process.cwd(), "packages/cli")
+    import_node_path23.default.resolve(__dirname, ".."),
+    import_node_path23.default.resolve(import_node_path23.default.dirname(process.argv[1] ?? process.cwd()), ".."),
+    import_node_path23.default.resolve(process.cwd(), "packages/cli")
   ];
   for (const candidate of candidates) {
-    if (import_node_fs24.default.existsSync(import_node_path22.default.join(candidate, "AGENTS.md"))) return candidate;
+    if (import_node_fs26.default.existsSync(import_node_path23.default.join(candidate, "AGENTS.md"))) return candidate;
   }
   throw new Error(
     `Apex CLI package files not found. Looked for AGENTS.md in: ${candidates.join(", ")}`
@@ -18820,19 +20147,19 @@ function packageRoot() {
 function skillPaths() {
   const root = packageRoot();
   return {
-    agents: import_node_path22.default.join(root, "AGENTS.md"),
-    skill: import_node_path22.default.join(root, "skills", "apex-cli", "SKILL.md")
+    agents: import_node_path23.default.join(root, "AGENTS.md"),
+    skill: import_node_path23.default.join(root, "skills", "apex-cli", "SKILL.md")
   };
 }
 function installSkill(paths, targetRoot) {
-  const missing = [paths.skill, paths.agents].filter((filePath) => !import_node_fs24.default.existsSync(filePath));
+  const missing = [paths.skill, paths.agents].filter((filePath) => !import_node_fs26.default.existsSync(filePath));
   if (missing.length > 0) {
     throw new Error(`Apex CLI package files not found. Missing: ${missing.join(", ")}`);
   }
-  const target = import_node_path22.default.resolve(targetRoot, "apex-cli");
-  import_node_fs24.default.mkdirSync(target, { recursive: true });
-  import_node_fs24.default.copyFileSync(paths.skill, import_node_path22.default.join(target, "SKILL.md"));
-  import_node_fs24.default.copyFileSync(paths.agents, import_node_path22.default.join(target, "AGENTS.md"));
+  const target = import_node_path23.default.resolve(targetRoot, "apex-cli");
+  import_node_fs26.default.mkdirSync(target, { recursive: true });
+  import_node_fs26.default.copyFileSync(paths.skill, import_node_path23.default.join(target, "SKILL.md"));
+  import_node_fs26.default.copyFileSync(paths.agents, import_node_path23.default.join(target, "AGENTS.md"));
   return target;
 }
 var skillsCommand = new Command("skills").description("Print or install the Apex CLI agent skill files").option("--install", "Copy the Apex CLI skill into ./.claude/skills/apex-cli").option("--target <dir>", "Install target skills directory", ".claude/skills").option("--json", "Print JSON").action(function action67(opts) {
@@ -19262,12 +20589,12 @@ async function fetchText(url) {
   });
   return { status: res.status, text: await readResponseText(res), finalUrl: res.url };
 }
-function abs(base, path24) {
-  return new URL(path24, base).toString();
+function abs(base, path25) {
+  return new URL(path25, base).toString();
 }
-function looksLikeShopifyCart(text) {
+function looksLikeShopifyCart(text2) {
   try {
-    const payload = JSON.parse(text);
+    const payload = JSON.parse(text2);
     return payload !== null && typeof payload === "object" && (typeof payload.token === "string" || payload.token === null) && Array.isArray(payload.items);
   } catch {
     return false;
@@ -19283,9 +20610,9 @@ async function collectSignals(url) {
   const chunks = [`__apex_primary_status_${primary.status}__`, primary.text];
   const protectedHit = primary.status === 403 || primary.status === 429 || matchDetectionMarkers(primary.text, "protected").length > 0;
   if (!protectedHit) {
-    for (const path24 of ["/cart.js"]) {
+    for (const path25 of ["/cart.js"]) {
       try {
-        const secondary = await fetchText(abs(primary.finalUrl || url, path24));
+        const secondary = await fetchText(abs(primary.finalUrl || url, path25));
         if (secondary.status >= 200 && secondary.status < 300 && looksLikeShopifyCart(secondary.text)) {
           chunks.push("__apex_secondary_shopify_cart_js__", secondary.text.slice(0, 2e3));
         }
@@ -19580,20 +20907,20 @@ var webhooksCommand = new Command("webhooks").description("Manage shop webhooks"
 
 // src/commands/simulate.ts
 init_source();
-var import_node_fs25 = __toESM(require("node:fs"));
-var import_node_path23 = __toESM(require("node:path"));
+var import_node_fs27 = __toESM(require("node:fs"));
+var import_node_path24 = __toESM(require("node:path"));
 function readJson2(file) {
-  const text = file === "-" ? import_node_fs25.default.readFileSync(0, "utf8") : import_node_fs25.default.readFileSync(import_node_path23.default.resolve(file), "utf8");
+  const text2 = file === "-" ? import_node_fs27.default.readFileSync(0, "utf8") : import_node_fs27.default.readFileSync(import_node_path24.default.resolve(file), "utf8");
   try {
-    return JSON.parse(text);
+    return JSON.parse(text2);
   } catch (error) {
     throw new Error(
       `Invalid JSON in ${file}: ${error instanceof Error ? error.message : String(error)}`
     );
   }
 }
-function plural(count, singular3) {
-  return `${count} ${singular3}${count === 1 ? "" : "s"}`;
+function plural(count2, singular3) {
+  return `${count2} ${singular3}${count2 === 1 ? "" : "s"}`;
 }
 function isGtagEventTuple(value) {
   return Array.isArray(value) && value[0] === "event" && typeof value[1] === "string";
@@ -19705,8 +21032,8 @@ var simulateCommand = new Command("simulate").description("Simulate data-layer t
 });
 
 // src/commands/config-resources.ts
-var import_node_fs26 = __toESM(require("node:fs"));
-var import_node_path24 = __toESM(require("node:path"));
+var import_node_fs28 = __toESM(require("node:fs"));
+var import_node_path25 = __toESM(require("node:path"));
 function show(resource) {
   process.stdout.write(`${JSON.stringify(resource, null, 2)}
 `);
@@ -19772,12 +21099,12 @@ function readFamily(family, label) {
 }
 var assetReads = readFamily("assets", "assets");
 var upload = new Command("upload").description("Upload an asset").argument("<file>").action(async function(file) {
-  const absolute = import_node_path24.default.resolve(process.cwd(), file);
-  if (!import_node_fs26.default.existsSync(absolute)) fail(this, `File not found: ${file}`, 3);
-  const fileStat = import_node_fs26.default.statSync(absolute);
+  const absolute = import_node_path25.default.resolve(process.cwd(), file);
+  if (!import_node_fs28.default.existsSync(absolute)) fail(this, `File not found: ${file}`, 3);
+  const fileStat = import_node_fs28.default.statSync(absolute);
   if (!fileStat.isFile()) fail(this, `File not found: ${file}`, 3);
   if (fileStat.size > MAX_ASSET_SIZE_BYTES) fail(this, `${file} is larger than 10 MB`, 3);
-  const mimeType = ASSET_MIME_TYPES[import_node_path24.default.extname(absolute).toLowerCase()];
+  const mimeType = ASSET_MIME_TYPES[import_node_path25.default.extname(absolute).toLowerCase()];
   if (!mimeType)
     fail(
       this,
@@ -19786,8 +21113,8 @@ var upload = new Command("upload").description("Upload an asset").argument("<fil
     );
   const r = await uploadAssets(requireCredentials(), [
     {
-      name: import_node_path24.default.basename(absolute),
-      bytes: import_node_fs26.default.readFileSync(absolute),
+      name: import_node_path25.default.basename(absolute),
+      bytes: import_node_fs28.default.readFileSync(absolute),
       type: mimeType
     }
   ]);
@@ -19872,6 +21199,7 @@ program2.addCommand(roadmapCommand);
 program2.addCommand(harnessCommand);
 program2.addCommand(operatorCommand);
 program2.addCommand(trackingCommand);
+program2.addCommand(eventsCommand);
 program2.addCommand(goalsCommand);
 program2.addCommand(funnelsCommand);
 program2.addCommand(environmentsCommand);
@@ -19913,10 +21241,18 @@ try {
 } catch {
 }
 program2.hook("preAction", (_thisCommand, actionCommand) => {
-  configureInvocationContext();
+  try {
+    configureInvocationContext();
+  } catch (error) {
+    beginInvocation(actionCommand);
+    throw error;
+  }
   configureRuntime(actionCommand);
+  beginInvocation(actionCommand, resolveContext());
 });
 process.on("beforeExit", () => {
   flushFallbackEnvelope();
 });
-program2.parseAsync(process.argv).then(() => maybeCheckForUpdate()).catch((err) => handleCliError(err, program2));
+maybeCheckForUpdate().then(() => program2.parseAsync(process.argv)).then(async () => {
+  await finishInvocation({ exitCode: process.exitCode ?? 0 });
+}).catch((err) => handleCliError(err, program2));