@drip-apex/apex-cli 0.15.0 → 0.15.2

package/README.md

@@ -227,6 +227,8 @@ command inventory:
 
 | Command | Purpose |
 | --- | --- |
+| `apex admin customers set-category <org-id>` | Change an existing account to internal, demo, dogfood or customer with a platform user key. Requires an 8 to 500 character `--reason` and `--confirm`. |
+| `apex admin customers create` | Create internal, demo or dogfood accounts with a platform user key. Requires `--name`, `--category`, an 8 to 500 character `--reason`, and `--confirm`. |
 | `apex admin shops archive <shopId>` | Archive a shop and disable Apex delivery; use `--force` in non-interactive environments. |
 | `apex admin shops restore <shopId>` | Restore an archived shop while leaving its runtime kill switch unchanged. |
 
@@ -240,18 +242,19 @@ apex landing-pages create --name "Fall sale" --out ./fall-sale   # or: pull <id>
 # edit ./fall-sale/index.html and its assets; context/ holds brand, catalog, offers and reviews
 apex landing-pages plan ./fall-sale             # what would change
 apex landing-pages apply ./fall-sale --yes      # new version + signed preview link (24 hours)
-apex landing-pages deploy ./fall-sale           # live on the claimed host in apex-landing-page.json
+apex landing-pages deploy ./fall-sale           # live on <shop>.apex-page.com, or the host in apex-landing-page.json
 apex landing-pages rollback ./fall-sale --version 1
 apex landing-pages experiment ./fall-sale --control 1 --variant 2   # draft split; start it in the dashboard
 ```
 
 The folder holds the page files (index.html at the root, at most 300 files
-and 25 MB; html, css, js, json, svg, images, fonts, txt, xml, webmanifest),
+and 100 MB; html, css, js, json, svg, images, fonts, txt, xml, webmanifest, mp4 and webm),
 `apex-landing-page.json` and the `context/` folder (each pull replaces its JSON
 files with the server's current set). Build with relative asset
 URLs (Vite `base: "./"`). `apex-landing-page.json` sets the name, slug, an
-claimed `host` (deploy needs one, or `--host`: claim it with
-`apex domains claim <host>`; Apex has no shared pages host yet), the `path`, whether Apex injects the shop snippet
+optional `host`, a domain claimed with `apex domains claim <host>` (without
+one, or `--host`, a deploy goes to the shop's own instant host
+`<shop>.apex-page.com`), the `path` (default `/<slug>`), whether Apex injects the shop snippet
 (`snippet`, on by default), the `shop_hosts` that receive the visitor's identity
 on outbound links (default: the shop's install domains), the `goals`
 (key, name, type click, pageview or custom) and an optional `experiment`
@@ -522,3 +525,31 @@ are sent. Login/logout, tests, the mock transport, and runs with no resolvable c
 (`APEX_API_KEY` or `DRIP_API_KEY`) are recorded with credential kind `env` unless
 `APEX_TELEMETRY=0`. Set `APEX_TELEMETRY=0` to disable the beacon. The best-effort request has an
 800 ms timeout and never changes command output or exit status.
+
+MP4 (`video/mp4`) and WebM (`video/webm`) videos are hosted directly by Apex.
+Each version holds at most 300 files and 100 MB; each video is limited to 50 MB,
+and other files to 3 MB. `apply` automatically obtains a 15-minute upload grant
+for videos above 3 MB and sends resumable 8 MB parts straight to the Worker,
+retrying failed parts with progress output. The Worker verifies the declared
+size and SHA-256 before apply records the file. Pull and signed previews also
+fetch large videos directly from the Worker. Video supports byte ranges,
+including Safari's `bytes=0-1` probe; rollback preserves the older bytes.
+
+Engineering account creation uses `apex login --user` credentials with `admin:write`
+and a live platform role with onboarding write permission. Real customer accounts
+are created in **Admin, Links**.
+
+```sh
+apex admin customers create --name "Demo workspace" --category demo --reason "Workshop demo account" --confirm --json
+apex admin customers create --name "Dogfood store" --category dogfood --domain dogfood.example.com --platform woo --owner owner@example.com --reason "Engineering dogfood account" --confirm
+apex admin customers set-category 22222222-2222-4222-8222-222222222222 --category internal --reason "Engineering dev store" --confirm --json
+```
+
+`--type` defaults to `company` (`company|agency`); `--plan` defaults to
+`self_managed` (`self_managed|apex_managed|drip_managed`). Managed plans require
+`--consultant <platform_access UUID>` and `--consultant-title <text>`.
+An optional first store uses `--domain <host> --platform <shopify|shopware|woo|other>`
+or `--claim-shop <UUID>`, exclusively. `woo` maps to `woocommerce` and `other` to
+`custom`. `--owner <email>` sends an owner invitation and requires a store;
+accounts without a store have no invitations. Output includes the organization ID,
+store ID (or null), invitation results and partial delivery status.

package/dist/cli.js

@@ -7325,7 +7325,7 @@ async function checkForUpdate(current) {
 // package.json
 var package_default = {
   name: "@drip-apex/apex-cli",
-  version: "0.15.0",
+  version: "0.15.2",
   license: "MIT",
   description: "Apex CLI for managing experiments, approved roadmap ideas, and draft workspaces.",
   private: false,
@@ -8236,6 +8236,7 @@ function landingPagesApi(request2) {
     ),
     plan: (id, body5) => call("POST", pagePath(id, "filesystem/plan"), body5),
     upload: (id, files) => call("POST", pagePath(id, "filesystem/upload"), { files }),
+    uploadGrant: (id, file) => call("POST", pagePath(id, "filesystem/upload-grant"), file),
     apply: (id, body5) => call("POST", pagePath(id, "filesystem/apply"), body5),
     deploy: (id, body5) => call("POST", pagePath(id, "deploy"), body5),
     versions: (id) => call("GET", pagePath(id, "versions")),
@@ -8261,6 +8262,53 @@ function landingPageBatches(items, size) {
   if (current.length) batches.push(current);
   return batches;
 }
+async function uploadLandingVideo(grant, body5, options = {}) {
+  if (!Number.isSafeInteger(grant.part_bytes) || grant.part_bytes !== 8 * 1024 * 1024) throw new Error("Invalid video part size");
+  const fetcher = options.fetch ?? fetch;
+  const send3 = async (action78, method = "POST", part, bytes) => {
+    const url = new URL(grant.upload_url);
+    url.searchParams.set("action", action78);
+    if (part !== void 0) url.searchParams.set("part", String(part));
+    let error;
+    for (let attempt = 0; attempt < 3; attempt++) {
+      try {
+        const response = await fetcher(url, { method, ...bytes ? { body: bytes } : {}, signal: AbortSignal.timeout(6e4) });
+        if (!response.ok) {
+          const message = await response.text();
+          if (response.status < 500 && response.status !== 429) throw new Error(`Video upload refused (${response.status}): ${message}`);
+          error = new Error(`Video upload failed (${response.status}): ${message}`);
+        } else return await response.json();
+      } catch (caught) {
+        if (caught instanceof Error && caught.message.startsWith("Video upload refused")) throw caught;
+        error = caught;
+      }
+    }
+    throw error;
+  };
+  const started2 = await send3("start");
+  if (!started2.complete) {
+    for (let offset = 0, part = 1; offset < body5.byteLength; offset += grant.part_bytes, part++) {
+      const bytes = body5.subarray(offset, Math.min(body5.byteLength, offset + grant.part_bytes));
+      await send3("part", "PUT", part, bytes);
+      options.progress?.(offset + bytes.byteLength, body5.byteLength);
+    }
+    const result = await send3("complete");
+    if (!result.complete) throw new Error("Worker did not confirm the video upload");
+  }
+}
+function validateLandingPageLocalFiles(files) {
+  const allowed2 = new Set("html css js mjs json svg png jpg jpeg webp avif gif ico woff woff2 txt xml webmanifest mp4 webm".split(" "));
+  if (files.length > 300) throw new Error("A bundle is limited to 300 files");
+  let total = 0;
+  for (const file of files) {
+    const ext = file.path.split(".").at(-1)?.toLowerCase() ?? "";
+    if (!allowed2.has(ext)) throw new Error(`File type is not allowed: ${file.path}`);
+    const cap = ext === "mp4" || ext === "webm" ? 50 * 1024 * 1024 : LANDING_PAGE_BATCH_BYTES;
+    if (!Number.isSafeInteger(file.bytes) || file.bytes < 0 || file.bytes > cap) throw new Error(`File exceeds ${cap} bytes: ${file.path}`);
+    total += file.bytes;
+  }
+  if (total > 100 * 1024 * 1024) throw new Error("A bundle is limited to 100 MB");
+}
 
 // src/api.ts
 function simulateTriggers(creds, body5) {
@@ -8482,6 +8530,7 @@ function applyExperimentFilesystem(creds, id, body5) {
     `/api/v1/experiments/${id}/filesystem/apply`,
     {
       files: body5.files,
+      ...body5.accept_qa_invalidation !== void 0 ? { accept_qa_invalidation: body5.accept_qa_invalidation } : {},
       ...body5.confirmTargetingReplace === true ? { confirmTargetingReplace: true } : {}
     }
   );
@@ -8698,7 +8747,7 @@ function testTargeting(creds, url, opts) {
   if (opts?.status) params.set("status", opts.status);
   return request(creds, "GET", `/api/v1/targeting/test?${params.toString()}`);
 }
-function createSos(creds, body5) {
+function createSos(creds, body5, options = {}) {
   const idempotency_key = body5.idempotency_key ?? (0, import_node_crypto2.createHash)("sha256").update(
     [
       body5.type,
@@ -8706,11 +8755,29 @@ function createSos(creds, body5) {
       body5.description,
       body5.sub_class ?? "",
       body5.loom_url ?? "",
+      ...options.attachmentDigests ?? [],
       String(Math.floor(Date.now() / 36e5))
     ].join("\0")
   ).digest("hex");
   return request(creds, "POST", "/api/v1/sos", { ...body5, idempotency_key });
 }
+function createSosUploadGrants(creds, files) {
+  return request(
+    creds,
+    "POST",
+    "/api/v1/sos/attachment-uploads",
+    { files }
+  );
+}
+async function uploadSosAttachment(signedUrl, contentType, bytes) {
+  const response = await fetch(signedUrl, {
+    method: "PUT",
+    headers: { "Content-Type": contentType },
+    body: bytes,
+    signal: AbortSignal.timeout(12e4)
+  });
+  if (!response.ok) throw new Error(`Attachment upload failed (${response.status})`);
+}
 function listMySos(creds) {
   return request(creds, "GET", "/api/v1/sos/mine");
 }
@@ -8813,6 +8880,17 @@ function markInboxRead(creds, channel) {
 function userCredentials(creds) {
   return { ...creds, apiKey: creds.userApiKey ?? "", baseUrl: creds.userBaseUrl ?? creds.baseUrl };
 }
+function createAdminCustomer(creds, body5) {
+  return request(
+    userCredentials(creds),
+    "POST",
+    "/api/v1/admin/customers",
+    body5
+  );
+}
+function setAdminCustomerCategory(creds, orgId, body5) {
+  return request(userCredentials(creds), "PATCH", `/api/v1/admin/customers/${orgId}`, body5);
+}
 function getAdminSettings(creds) {
   return request(userCredentials(creds), "GET", "/api/v1/admin/settings");
 }
@@ -10451,14 +10529,31 @@ function printFilesystemPlan(plan2) {
   }
   console.log();
   console.log(`QA invalidated: ${plan2.invalidatesQa ? source_default.yellow("yes") : "no"}`);
-  console.log(`Acknowledgment: ${plan2.invalidatesQa ? "--accept-qa-invalidation" : "none"}`);
+  console.log(
+    `QA approval:   ${!plan2.qaApproval ? "unknown (older server)" : plan2.qaApproval.present ? `present${plan2.qaApproval.approvedAt ? ` (approved ${plan2.qaApproval.approvedAt})` : ""}` : "none"}`
+  );
+  console.log(`Acknowledgment: ${requiredQaAcknowledgment(plan2) ?? "none"}`);
   console.log(`Precompile:     ${plan2.precompileRequired ? "yes" : "no"}`);
 }
+function requiredQaAcknowledgment(plan2) {
+  return "requiredAcknowledgment" in plan2 ? plan2.requiredAcknowledgment ?? null : plan2.invalidatesQa ? "accept-qa-invalidation" : null;
+}
 function blockingIssueSummary(issues) {
   if (!issues?.length) return "Experiment filesystem plan has errors.";
   const remaining = issues.length - 1;
   return `Experiment filesystem plan has errors. ${issues[0].message}${remaining ? ` and ${remaining} more` : ""}`;
 }
+function qaApprovalRefusal(approvedAt, folderArg) {
+  return {
+    message: `Applying these changes revokes the QA approval from ${approvedAt ?? "an unspecified time"}; pass --accept-qa-invalidation to confirm.`,
+    details: {
+      reason: "qa_approval_present",
+      qa_approved_at: approvedAt,
+      required_acknowledgment: "accept-qa-invalidation",
+      retry: `apex experiments apply ${folderArg} --accept-qa-invalidation`
+    }
+  };
+}
 async function getQaPreviewUrls(creds, experimentId) {
   const fallbackDashboardUrl = buildDashboardUrl(
     creds.baseUrl,
@@ -11834,7 +11929,7 @@ var planFilesystem = new Command("plan").description("Plan experiment filesystem
         folder,
         experimentId: session.experimentId,
         plan: res.data,
-        requiredAcknowledgment: res.data.invalidatesQa ? "accept-qa-invalidation" : null
+        requiredAcknowledgment: requiredQaAcknowledgment(res.data)
       },
       () => printFilesystemPlan(res.data)
     );
@@ -11846,7 +11941,10 @@ var planFilesystem = new Command("plan").description("Plan experiment filesystem
 var applyFilesystem = new Command("apply").option(
   "--confirm-targeting-replace",
   "Confirm that attaching a Page may replace URL targeting authored through the API"
-).option("--sync", "Refresh local authored files with the stored server bytes").description("Apply experiment filesystem changes to Apex").argument("[folder]", "Experiment filesystem folder", ".").option("--accept-qa-invalidation", "Acknowledge that applying changes invalidates QA approval").addOption(new Option("-f, --force", "Deprecated alias for --accept-qa-invalidation").hideHelp()).option("--no-asset-upload", "Keep inline and local image references unchanged").action(async function action15(folderArg, opts) {
+).option("--sync", "Refresh local authored files with the stored server bytes").description("Apply experiment filesystem changes to Apex").argument("[folder]", "Experiment filesystem folder", ".").option(
+  "--accept-qa-invalidation",
+  "Confirm an apply that revokes an existing QA approval (required only when the experiment holds one)"
+).addOption(new Option("-f, --force", "Deprecated alias for --accept-qa-invalidation").hideHelp()).option("--no-asset-upload", "Keep inline and local image references unchanged").action(async function action15(folderArg, opts) {
   const creds = requireCredentials();
   try {
     const folder = folderPath(folderArg);
@@ -11893,7 +11991,7 @@ var applyFilesystem = new Command("apply").option(
             why: "Retry with hosted asset upload."
           }
         ] : [],
-        requiredAcknowledgment: planRes.data.invalidatesQa ? "accept-qa-invalidation" : null
+        requiredAcknowledgment: requiredQaAcknowledgment(planRes.data)
       });
     }
     if (planRes.data.changes.length === 0) {
@@ -11910,7 +12008,7 @@ var applyFilesystem = new Command("apply").option(
           synced: synced2,
           dashboardUrl: dashboardUrl2,
           plan: planRes.data,
-          requiredAcknowledgment: planRes.data.invalidatesQa ? "accept-qa-invalidation" : null,
+          requiredAcknowledgment: requiredQaAcknowledgment(planRes.data),
           message: "No changes."
         },
         () => {
@@ -11922,23 +12020,23 @@ var applyFilesystem = new Command("apply").option(
       );
       return;
     }
-    if (planRes.data.invalidatesQa && !opts.force && !opts.acceptQaInvalidation) {
-      const ok = await confirmApply("This apply invalidates QA approval. Continue?");
+    let acceptQaInvalidation = Boolean(opts.force || opts.acceptQaInvalidation);
+    if (requiredQaAcknowledgment(planRes.data) && !acceptQaInvalidation) {
+      const refusal = qaApprovalRefusal(planRes.data.qaApproval?.approvedAt ?? null, folderArg);
+      const ok = await confirmApply(`${refusal.message} Continue?`);
       if (ok === null) {
-        confirmationRequired(
-          this,
-          "Applying these changes invalidates QA approval and requires confirmation.",
-          `apex experiments apply ${folderArg} --accept-qa-invalidation`
-        );
+        fail(this, refusal.message, EXIT_CODES.confirmationRequired, refusal.details);
       }
       if (!ok) {
         output(this, { aborted: true }, () => console.log("Aborted."));
         return;
       }
+      acceptQaInvalidation = true;
     }
     const spinner = process.stderr.isTTY ? await createSpinner("Applying experiment filesystem...") : null;
     let res = await applyExperimentFilesystem(creds, session.experimentId, {
       files,
+      accept_qa_invalidation: acceptQaInvalidation,
       ...opts.confirmTargetingReplace ? { confirmTargetingReplace: true } : {}
     });
     if (!res.ok && res.status === 409 && res.errorDetails?.code === "confirm_targeting_replace_required" && !opts.confirmTargetingReplace) {
@@ -11959,9 +12057,19 @@ var applyFilesystem = new Command("apply").option(
       }
       res = await applyExperimentFilesystem(creds, session.experimentId, {
         files,
+        accept_qa_invalidation: acceptQaInvalidation,
         confirmTargetingReplace: true
       });
     }
+    if (!res.ok && res.status === 409 && res.errorDetails?.code === "qa_acknowledgment_required") {
+      spinner?.stop();
+      const approvedAt = res.errorDetails.qa_approved_at;
+      const refusal = qaApprovalRefusal(
+        typeof approvedAt === "string" ? approvedAt : null,
+        folderArg
+      );
+      fail(this, refusal.message, EXIT_CODES.confirmationRequired, refusal.details);
+    }
     if (!res.ok || !res.data?.applied) {
       spinner?.fail("Failed to apply experiment filesystem");
       fail(this, res.error ?? "Apply failed", classifyStatus(res.status), {
@@ -12000,7 +12108,7 @@ var applyFilesystem = new Command("apply").option(
         experimentId: session.experimentId,
         applied: true,
         plan: planRes.data,
-        requiredAcknowledgment: planRes.data.invalidatesQa ? "accept-qa-invalidation" : null,
+        requiredAcknowledgment: requiredQaAcknowledgment(planRes.data),
         result: res.data,
         synced,
         dashboardUrl,
@@ -13001,6 +13109,25 @@ var pushCommand = new Command("push").description("Push experiment definitions f
 
 // src/commands/preview.ts
 init_source();
+async function signedPreviewFromReadiness(creds, experimentId, variationId, targetUrl) {
+  try {
+    const client = createHttpClient(creds, {
+      onNetworkError: (info) => {
+        throw new Error(info.cause);
+      }
+    });
+    const query = new URLSearchParams({ variation_id: variationId, target_url: targetUrl });
+    const response = await client.request(
+      "GET",
+      `/api/v1/experiments/${encodeURIComponent(experimentId)}/readiness?${query}`,
+      void 0,
+      5e3
+    );
+    return response.ok ? response.data?.data : void 0;
+  } catch {
+    return void 0;
+  }
+}
 var previewCommand = new Command("preview").description(
   "Open QA preview URL for an experiment variation; proxy previews return a QA run receipt"
 ).argument("<id-or-slug>", "Experiment ID or slug").argument("[variation-id]", "Variation ID (defaults to first non-control)").option("--store-url <url>", "Override experiment store_url (target website URL)").option("--proxy", "Create an artifact-injecting proxy preview").option("--ttl <hours>", "Proxy preview lifetime in hours (1-168)").option("--no-open", "Print URL instead of opening browser").action(
@@ -13112,7 +13239,7 @@ var previewCommand = new Command("preview").description(
       variation = exp.variations.find((v) => !v.is_control) ?? exp.variations[0];
     }
     spinner.stop();
-    const storeUrl = opts?.storeUrl ?? exp.preview_target?.url ?? exp.store_url;
+    const storeUrl = opts?.storeUrl ?? (!variation.is_control && variation.redirect_url?.trim() ? variation.redirect_url : null) ?? exp.preview_target?.url ?? exp.store_url;
     if (!storeUrl) {
       fail(
         previewCommand,
@@ -13128,12 +13255,18 @@ var previewCommand = new Command("preview").description(
         'Invalid store URL. Pass an absolute URL like "https://example.com/products/item".'
       );
     }
+    const signed = await signedPreviewFromReadiness(creds, exp.id, variation.id, storeUrl);
+    const selectedPreviewUrl = signed?.signed_preview_url ?? previewUrl.toString();
+    const warning = signed?.signed_preview_url ? null : "Test images may not load on this unsigned link. Open Apex \u2192 QA for a signed link.";
+    if (warning) console.error(warning);
     output(
       previewCommand,
       {
         experimentId: exp.id,
         variationId: variation.id,
-        previewUrl: previewUrl.toString(),
+        previewUrl: selectedPreviewUrl,
+        expiresAt: signed?.signed_preview_expires_at ?? null,
+        ...warning ? { warning } : {},
         ...!opts?.storeUrl && exp.preview_target ? { previewTarget: exp.preview_target } : {}
       },
       () => {
@@ -13149,14 +13282,16 @@ var previewCommand = new Command("preview").description(
           }
         }
         console.log();
-        console.log(source_default.cyan(previewUrl.toString()));
+        console.log(source_default.cyan(selectedPreviewUrl));
+        if (signed?.signed_preview_expires_at)
+          console.log(`Valid until ${signed.signed_preview_expires_at}.`);
         console.log();
       }
     );
     if (opts?.open !== false && !shouldUseJson(previewCommand)) {
       try {
         const open3 = (await Promise.resolve().then(() => (init_open(), open_exports))).default;
-        await open3(previewUrl.toString());
+        await open3(selectedPreviewUrl);
         console.log(source_default.dim("Opened in browser."));
       } catch {
         console.log(source_default.dim("Copy the URL above to preview."));
@@ -14143,9 +14278,7 @@ function commonCookieDomain(hostnames) {
   const suffix = suffixes[0];
   return suffix && suffixes.every((candidate) => candidate === suffix) ? `.${suffix}` : null;
 }
-function defaultManifestPath() {
-  return import_node_path11.default.resolve(process.cwd(), ".apex", "tracking-manifest.json");
-}
+var DEFAULT_MANIFEST_PATH = ".apex/tracking-manifest.json";
 function readManifest(filePath) {
   if (!import_node_fs13.default.existsSync(filePath)) throw new Error(`Manifest not found: ${filePath}`);
   const parsed = JSON.parse(import_node_fs13.default.readFileSync(filePath, "utf8"));
@@ -14221,7 +14354,7 @@ function buildManifest(urlArgs, opts) {
   };
 }
 function manifestPath(input) {
-  return import_node_path11.default.resolve(process.cwd(), input ?? defaultManifestPath());
+  return import_node_path11.default.resolve(process.cwd(), input ?? DEFAULT_MANIFEST_PATH);
 }
 function printManifestPlan(manifest) {
   console.log(source_default.bold("Apex tracking ingestion plan"));
@@ -14249,7 +14382,11 @@ function printManifestPlan(manifest) {
 var trackingCommand = new Command("tracking").description(
   "Create Apex-first tracking ingestion manifests and QA handoffs"
 );
-trackingCommand.command("inspect").description("Create a local tracking manifest from funnel URLs").argument("<urls...>", "Landing, storefront, checkout, or confirmation URLs").option("--shop-id <id>", "Apex shop ID for snippet generation").option("--endpoint <url>", "Apex Worker endpoint", "https://events.drip-apex.com").option("--out <path>", "Manifest output path", defaultManifestPath()).action(function(urls, opts) {
+trackingCommand.command("inspect").description("Create a local tracking manifest from funnel URLs").argument("<urls...>", "Landing, storefront, checkout, or confirmation URLs").option("--shop-id <id>", "Apex shop ID for snippet generation").option("--endpoint <url>", "Apex Worker endpoint", "https://events.drip-apex.com").option(
+  "--out <path>",
+  "Manifest output path, relative to the current directory",
+  DEFAULT_MANIFEST_PATH
+).action(function(urls, opts) {
   const manifest = buildManifest(urls, opts);
   const outPath = manifestPath(opts.out);
   writeManifest(outPath, manifest);
@@ -14265,12 +14402,20 @@ trackingCommand.command("inspect").description("Create a local tracking manifest
     }
   });
 });
-trackingCommand.command("plan").description("Print the implementation plan from a tracking manifest").argument("[manifest]", "Tracking manifest path", defaultManifestPath()).action(function(input) {
+trackingCommand.command("plan").description("Print the implementation plan from a tracking manifest").argument(
+  "[manifest]",
+  "Tracking manifest path, relative to the current directory",
+  DEFAULT_MANIFEST_PATH
+).action(function(input) {
   const filePath = manifestPath(input);
   const manifest = readManifest(filePath);
   output(this, { path: filePath, manifest }, () => printManifestPlan(manifest));
 });
-trackingCommand.command("qa").description("Print the QA checklist for a tracking manifest").argument("[manifest]", "Tracking manifest path", defaultManifestPath()).action(function(input) {
+trackingCommand.command("qa").description("Print the QA checklist for a tracking manifest").argument(
+  "[manifest]",
+  "Tracking manifest path, relative to the current directory",
+  DEFAULT_MANIFEST_PATH
+).action(function(input) {
   const filePath = manifestPath(input);
   const manifest = readManifest(filePath);
   output(this, { path: filePath, checks: manifest.qa.checks }, () => {
@@ -18484,16 +18629,21 @@ async function checkServedConfig(configUrl, workerBaseUrl, workerBaseSource) {
     message: "Worker served a recognized config document for this shop."
   };
 }
-var installCommand = new Command("install").description("Check Apex storefront installation").command("check").description("Verify snippet, served config, and recent tracking for the current shop").option("--url <url>", "Check one explicit bound storefront URL").option("--shop-id <id>", "Apex shop ID to verify (falls back to DRIP_SHOP_ID)").option(
+var installCommand = new Command("install").description("Check Apex storefront installation").command("check").description(
+  "Verify snippet, served config, and recent tracking using --shop-id, the selected shop, or DRIP_SHOP_ID"
+).option("--url <url>", "Check one explicit bound storefront URL").option(
+  "--shop-id <id>",
+  "Apex shop ID to verify (falls back to --shop/apex use, then DRIP_SHOP_ID)"
+).option(
   "--worker-url <url>",
   "Apex Worker base URL that serves /config (defaults to the URL in the served snippet, then DRIP_WORKER_URL, then the production worker)"
 ).option("--environment <key>", "Environment key to request from the worker", "production").action(async function action65(opts) {
   const creds = requireCredentials();
-  const shopId = opts.shopId?.trim() || process.env.DRIP_SHOP_ID?.trim() || null;
+  const shopId = opts.shopId?.trim() || resolveContext(creds).shopId?.trim() || process.env.DRIP_SHOP_ID?.trim() || null;
   if (!shopId)
     fail(
       this,
-      "Shop ID is required: pass --shop-id <id> or set DRIP_SHOP_ID",
+      "Shop ID is required: pass --shop-id <id>, select a shop with --shop <id> or apex use, or set DRIP_SHOP_ID",
       EXIT_CODES.validation,
       { field: "shop-id" }
     );
@@ -19533,6 +19683,7 @@ var test2 = new Command("test").description("Evaluate experiment URL targeting f
 var targetingCommand = new Command("targeting").description("Test experiment targeting").addCommand(test2);
 
 // src/commands/sos.ts
+var import_node_crypto7 = require("node:crypto");
 init_source();
 var import_node_fs24 = __toESM(require("node:fs"));
 var import_node_path21 = __toESM(require("node:path"));
@@ -19574,6 +19725,11 @@ var create4 = new Command("create").description("Create an Apex SOS ticket").opt
   "--type <type>",
   "full_handover|design|development|qa|config|bug|help (internal types require a DRIP account)",
   "qa"
+).option(
+  "--attach <file>",
+  "Attach an image or video (repeatable, maximum 5)",
+  (file, files) => [...files, file],
+  []
 ).option("--loom <url>", "Loom URL with reproduction or QA context").option("--experiment <id>", "Experiment ID").option("--backlog-item <id>", "Backlog item ID (internal SOS only)").option("--sub-class <text>", "SOS sub-classification").option("--description <text-or-@file>", "Description text or @path").argument("[description]", "Description text").action(async function action68(descriptionArg, opts) {
   if (!SOS_TYPES.has(opts.type)) {
     fail(
@@ -19585,16 +19741,76 @@ var create4 = new Command("create").description("Create an Apex SOS ticket").opt
   if (opts.experiment && opts.backlogItem) {
     fail(this, "Provide only one of --experiment or --backlog-item", 3);
   }
+  const mediaTypes = {
+    ".png": "image/png",
+    ".jpg": "image/jpeg",
+    ".jpeg": "image/jpeg",
+    ".webp": "image/webp",
+    ".gif": "image/gif",
+    ".mp4": "video/mp4",
+    ".webm": "video/webm",
+    ".mov": "video/quicktime"
+  };
+  if (opts.attach.length > 5) fail(this, "Attach no more than 5 files", 3);
+  const files = opts.attach.map((file) => {
+    const filename = import_node_path21.default.basename(file);
+    const content_type = mediaTypes[import_node_path21.default.extname(file).toLowerCase()];
+    if (!content_type) fail(this, "Unsupported attachment type", 3);
+    let size;
+    try {
+      size = import_node_fs24.default.statSync(file).size;
+    } catch {
+      fail(this, `Attachment not found: ${file}`, 3);
+    }
+    const cap = (content_type.startsWith("video/") ? 50 : 10) * 1024 * 1024;
+    if (size <= 0 || size > cap) fail(this, "Attachment exceeds its size limit or is empty", 3);
+    let bytes;
+    try {
+      bytes = import_node_fs24.default.readFileSync(file);
+    } catch {
+      fail(this, `Attachment not found: ${file}`, 3);
+    }
+    return { filename, content_type, size, bytes };
+  });
   const creds = requireCredentials();
+  const attachmentPaths = [];
+  const attachmentDigests = [];
+  if (files.length) {
+    const grants = await createSosUploadGrants(
+      creds,
+      files.map(({ filename, content_type, size }) => ({ filename, content_type, size }))
+    );
+    if (!grants.ok || !grants.data)
+      fail(
+        this,
+        grants.error ?? "Failed to get upload grants",
+        classifyStatus(grants.status),
+        grants.errorDetails
+      );
+    if (grants.data.data.uploads.length !== files.length)
+      fail(this, "Invalid upload grant response", 1);
+    for (const [index, file] of files.entries()) {
+      const grant = grants.data.data.uploads[index];
+      const bytes = file.bytes;
+      await uploadSosAttachment(grant.signed_url, file.content_type, bytes);
+      attachmentPaths.push(grant.path);
+      attachmentDigests.push((0, import_node_crypto7.createHash)("sha256").update(bytes).digest("hex"));
+    }
+  }
   const description = readText(opts.description) ?? descriptionArg ?? `Apex CLI ${opts.type} SOS request${opts.loom ? ` with Loom evidence: ${opts.loom}` : "."}`;
-  const res = await createSos(creds, {
-    type: opts.type,
-    description,
-    experiment_id: opts.experiment ?? null,
-    backlog_item_id: opts.backlogItem ?? null,
-    sub_class: opts.subClass ?? null,
-    loom_url: opts.loom ?? null
-  });
+  const res = await createSos(
+    creds,
+    {
+      ...attachmentPaths.length ? { attachment_paths: attachmentPaths } : {},
+      type: opts.type,
+      description,
+      experiment_id: opts.experiment ?? null,
+      backlog_item_id: opts.backlogItem ?? null,
+      sub_class: opts.subClass ?? null,
+      loom_url: opts.loom ?? null
+    },
+    { attachmentDigests }
+  );
   if (!res.ok || !res.data) {
     fail(
       this,
@@ -19899,6 +20115,7 @@ function optionSchema(option) {
     description: option.description,
     required: option.required,
     optional: option.optional,
+    mandatory: Boolean(option.mandatory),
     variadic: option.variadic,
     ...option.defaultValue === void 0 ? {} : { defaultValue: option.defaultValue }
   };
@@ -19921,8 +20138,16 @@ function commandSchema(command) {
   };
 }
 function createSchemaCommand(program3) {
-  return new Command("schema").description("Print the current Apex CLI command and flag schema").option("--json", "Print JSON schema").action(function action78() {
-    const schema = commandSchema(program3);
+  return new Command("schema").description("Print the current Apex CLI command, flag, and mandatory-option schema").option("--json", "Print JSON schema").action(function action78() {
+    const schema = {
+      schemaVersion: 2,
+      contract: {
+        optionValueArity: "Options' required and optional fields describe whether the option's value is required or optional when the flag is given.",
+        mandatoryOptions: "An option's mandatory field is true only when the flag itself must be passed.",
+        requiredArguments: "An argument's required field means the positional is mandatory."
+      },
+      ...commandSchema(program3)
+    };
     output(this, schema, () => {
       process.stdout.write(`${JSON.stringify(schema, null, 2)}
 `);
@@ -20563,6 +20788,7 @@ var skillsCommand = new Command("skills").description("Print or install the Apex
 });
 
 // src/commands/admin.ts
+var uuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 function switchValue(value) {
   if (value === "on") return true;
   if (value === "off") return false;
@@ -20677,7 +20903,137 @@ var restore2 = new Command("restore").description("Restore an archived shop").ar
   );
 });
 var shops = new Command("shops").description("Archive and restore shops on the platform admin plane").addCommand(archive2).addCommand(restore2);
-var adminCommand = new Command("admin").description("Operate allowlisted platform controls").addCommand(settingsGet).addCommand(quarantine).addCommand(shops);
+var create6 = new Command("create").description("Create an internal, demo or dogfood account").requiredOption("--name <text>").requiredOption("--category <category>", "internal, demo or dogfood").option("--type <type>", "company or agency", "company").option("--plan <plan>", "self_managed, apex_managed or drip_managed", "self_managed").option("--domain <host>").option("--platform <platform>", "shopify, shopware, woo or other").option("--claim-shop <uuid>").option("--owner <email>").option("--consultant <uuid>", "Platform access ID").option("--consultant-title <text>").requiredOption("--reason <text>", "Audit reason, 8 to 500 characters").option("--confirm", "Confirm account creation").option("--json", "Output JSON").action(async function(opts) {
+  if (opts.category === "customer") fail(this, "Create customer accounts in Admin, Links", 3);
+  if (!["internal", "demo", "dogfood"].includes(opts.category))
+    fail(this, "--category must be internal, demo or dogfood", 3);
+  if (!["company", "agency"].includes(opts.type))
+    fail(this, "--type must be company or agency", 3);
+  if (!["self_managed", "apex_managed", "drip_managed"].includes(opts.plan))
+    fail(this, "Invalid --plan", 3);
+  if (!opts.name.trim() || opts.name.trim().length > 60)
+    fail(this, "--name must be 1 to 60 characters", 3);
+  if (opts.reason.trim().length < 8 || opts.reason.trim().length > 500)
+    fail(this, "--reason must be 8 to 500 characters", 3);
+  if (opts.claimShop && !uuid.test(opts.claimShop)) fail(this, "--claim-shop must be a UUID", 3);
+  if (opts.claimShop && (opts.domain || opts.platform))
+    fail(this, "Use --claim-shop or --domain with --platform", 3);
+  if (!!opts.domain !== !!opts.platform)
+    fail(this, "--domain and --platform must be provided together", 3);
+  if (opts.domain && !/^[a-z0-9-]+(\.[a-z0-9-]+)+$/i.test(opts.domain.trim()))
+    fail(this, "--domain must be a hostname without a protocol or path", 3);
+  const platforms = {
+    shopify: "shopify",
+    shopware: "shopware",
+    woo: "woocommerce",
+    other: "custom"
+  };
+  if (opts.platform && !Object.hasOwn(platforms, opts.platform))
+    fail(this, "--platform must be shopify, shopware, woo or other", 3);
+  if (opts.owner && !/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(opts.owner.trim()))
+    fail(this, "--owner must be an email address", 3);
+  if (opts.owner && !opts.domain && !opts.claimShop)
+    fail(this, "--owner requires a store for the invitation", 3);
+  if (opts.plan !== "self_managed" && (!opts.consultant || !opts.consultantTitle?.trim()))
+    fail(this, "Managed plans require --consultant and --consultant-title", 3);
+  if (opts.consultant && !uuid.test(opts.consultant))
+    fail(this, "--consultant must be a platform access UUID", 3);
+  if (!!opts.consultant !== !!opts.consultantTitle?.trim())
+    fail(this, "Provide --consultant and --consultant-title together", 3);
+  if (opts.consultantTitle && opts.consultantTitle.trim().length > 240)
+    fail(this, "--consultant-title must be at most 240 characters", 3);
+  if (!opts.confirm) {
+    const flags = [
+      ["name", opts.name],
+      ["category", opts.category],
+      ["type", opts.type],
+      ["plan", opts.plan],
+      ["reason", opts.reason],
+      ["domain", opts.domain],
+      ["platform", opts.platform],
+      ["claim-shop", opts.claimShop],
+      ["owner", opts.owner],
+      ["consultant", opts.consultant],
+      ["consultant-title", opts.consultantTitle]
+    ];
+    const retry = flags.filter((entry) => entry[1] !== void 0).map(([flag, value]) => `--${flag} '${value.replaceAll("'", "'\\''")}'`).join(" ");
+    confirmationRequired(
+      this,
+      "--confirm is required to create an account",
+      `apex admin customers create ${retry} --confirm`
+    );
+  }
+  const body5 = {
+    name: opts.name.trim(),
+    category: opts.category,
+    type: opts.type,
+    plan: opts.plan,
+    reason: opts.reason.trim(),
+    teammates: [],
+    consultant: opts.consultant ? { platformAccessId: opts.consultant, title: opts.consultantTitle.trim() } : null,
+    ...opts.claimShop ? { store: { claimShopId: opts.claimShop } } : opts.domain ? {
+      store: {
+        domain: opts.domain.trim().toLowerCase(),
+        platform: platforms[opts.platform]
+      }
+    } : {},
+    ...opts.owner ? { ownerEmail: opts.owner.trim() } : {}
+  };
+  const res = await createAdminCustomer(requireUserCredentials(), body5);
+  if (!res.ok || !res.data)
+    fail(
+      this,
+      res.error ?? "Failed to create account",
+      classifyStatus(res.status),
+      res.errorDetails
+    );
+  output(this, res.data, () => {
+    const result = res.data.data;
+    printTable(
+      ["ORGANIZATION", "STORE", "INVITATIONS"],
+      [[result.orgId, result.shopId ?? "-", String(result.invitations.length)]]
+    );
+    if (result.invitations.length)
+      printTable(
+        ["EMAIL", "ROLE", "STATUS", "NOTE"],
+        result.invitations.map((i) => [i.email, i.role, i.status, i.note])
+      );
+  });
+});
+var setCategory = new Command("set-category").description("Change an existing account's category with an audit reason").argument("<org-id>", "Organization UUID").requiredOption("--category <category>", "internal, demo, dogfood or customer").requiredOption("--reason <text>", "Audit reason, 8 to 500 characters").option("--confirm", "Confirm category change").option("--json", "Output JSON").action(async function(orgId, opts) {
+  if (!uuid.test(orgId)) fail(this, "<org-id> must be a UUID", 3);
+  if (!["internal", "demo", "dogfood", "customer"].includes(opts.category))
+    fail(this, "--category must be internal, demo, dogfood or customer", 3);
+  const reason2 = opts.reason.trim();
+  if (reason2.length < 8 || reason2.length > 500)
+    fail(this, "--reason must be 8 to 500 characters", 3);
+  if (!opts.confirm) {
+    const quote = (value) => `'${value.replaceAll("'", "'\\''")}'`;
+    confirmationRequired(
+      this,
+      "--confirm is required to change an account category",
+      `apex admin customers set-category ${orgId} --category ${quote(opts.category)} --reason ${quote(reason2)} --confirm`
+    );
+  }
+  const body5 = {
+    category: opts.category,
+    reason: reason2
+  };
+  const res = await setAdminCustomerCategory(requireUserCredentials(), orgId, body5);
+  if (!res.ok || !res.data)
+    fail(
+      this,
+      res.error ?? "Failed to change account category",
+      classifyStatus(res.status),
+      res.errorDetails
+    );
+  output(this, res.data, () => {
+    const result = res.data.data;
+    printTable(["RESULT"], [[`Customer ${result.customerId} moved to ${result.category}`]]);
+  });
+});
+var customers = new Command("customers").description("Create engineering accounts and manage existing account categories").addCommand(create6).addCommand(setCategory);
+var adminCommand = new Command("admin").description("Operate allowlisted platform controls").addCommand(settingsGet).addCommand(quarantine).addCommand(shops).addCommand(customers);
 
 // src/commands/membership.ts
 init_source();
@@ -20873,7 +21229,7 @@ var list13 = new Command("list").action(async function() {
     )
   );
 });
-var create6 = new Command("create").requiredOption("--name <name>").requiredOption("--type <type>").option("--permissions <csv>").action(async function(opts) {
+var create7 = new Command("create").requiredOption("--name <name>").requiredOption("--type <type>").option("--permissions <csv>").action(async function(opts) {
   if (!["live_secret", "test_secret", "publishable"].includes(opts.type))
     throw new CliError(
       "--type must be live_secret, test_secret, or publishable",
@@ -20913,7 +21269,7 @@ var revoke = new Command("revoke").argument("<keyId>").action(async function(key
     );
   output(this, res.data, () => console.log(`Revoked ${keyId}`));
 });
-var keysCommand = new Command("keys").description("Manage shop API keys in the current context").addCommand(list13).addCommand(create6).addCommand(revoke);
+var keysCommand = new Command("keys").description("Manage shop API keys in the current context").addCommand(list13).addCommand(create7).addCommand(revoke);
 
 // src/commands/prospect.ts
 init_source();
@@ -21172,7 +21528,7 @@ var list14 = new Command("list").alias("ls").description(
   const data = await loadWebhookIndex(this);
   output(this, data, () => printWebhooks(data.data));
 });
-var create7 = new Command("create").description(`Create a webhook. Prints the signing secret once. Signature docs: ${SIGNATURE_DOC}`).requiredOption("--url <url>", "HTTPS callback URL").option(
+var create8 = new Command("create").description(`Create a webhook. Prints the signing secret once. Signature docs: ${SIGNATURE_DOC}`).requiredOption("--url <url>", "HTTPS callback URL").option(
   "--event <event>",
   "Webhook event to subscribe to; repeat for multiple events",
   (value, previous = []) => [...previous, value],
@@ -21280,7 +21636,7 @@ var test3 = new Command("test").description("Send a signed test event to a webho
     )
   );
 });
-var webhooksCommand = new Command("webhooks").description("Manage shop webhooks").addCommand(list14).addCommand(create7).addCommand(update5).addCommand(remove3).addCommand(deliveries).addCommand(test3);
+var webhooksCommand = new Command("webhooks").description("Manage shop webhooks").addCommand(list14).addCommand(create8).addCommand(update5).addCommand(remove3).addCommand(deliveries).addCommand(test3);
 
 // src/commands/simulate.ts
 init_source();
@@ -21413,7 +21769,7 @@ var import_node_fs29 = __toESM(require("node:fs"));
 var import_node_path26 = __toESM(require("node:path"));
 
 // src/commands/landing-pages.ts
-var import_node_crypto7 = __toESM(require("node:crypto"));
+var import_node_crypto8 = __toESM(require("node:crypto"));
 var import_node_fs28 = __toESM(require("node:fs"));
 var import_node_path25 = __toESM(require("node:path"));
 function apiFailure(command, response, fallback2) {
@@ -21427,7 +21783,7 @@ function apiFailure(command, response, fallback2) {
   }
 }
 function sha256(body5) {
-  return import_node_crypto7.default.createHash("sha256").update(body5).digest("hex");
+  return import_node_crypto8.default.createHash("sha256").update(body5).digest("hex");
 }
 function markerPath(folder) {
   return import_node_path25.default.join(folder, LANDING_PAGE_CHECKOUT_MARKER);
@@ -21502,12 +21858,31 @@ function readCheckoutFiles(folder) {
       if (!isLandingPageCheckoutPath(relative)) continue;
       if (entry.isDirectory()) visit2(absolute);
       else if (entry.isFile()) {
+        try {
+          validateLandingPageLocalFiles([
+            ...files,
+            { path: relative, bytes: import_node_fs28.default.statSync(absolute).size, sha256: "" }
+          ]);
+        } catch (error) {
+          throw new CliError(
+            error instanceof Error ? error.message : "Invalid bundle",
+            EXIT_CODES.validation
+          );
+        }
         const body5 = import_node_fs28.default.readFileSync(absolute);
         files.push({ path: relative, sha256: sha256(body5), bytes: body5.byteLength, body: body5 });
       }
     }
   };
   visit2(folder);
+  try {
+    validateLandingPageLocalFiles(files);
+  } catch (error) {
+    throw new CliError(
+      error instanceof Error ? error.message : "Invalid bundle",
+      EXIT_CODES.validation
+    );
+  }
   return files;
 }
 function readManifest2(command, folder) {
@@ -21564,7 +21939,7 @@ function printPlan(plan2) {
     );
   }
   console.log(
-    `Deploy target: ${plan2.deploy_target ?? "none yet: set host in apex-landing-page.json to a domain this shop holds"}`
+    `Deploy target: ${plan2.deploy_target ?? "none: set host in apex-landing-page.json to a domain this shop holds"}`
   );
 }
 async function confirm2(message) {
@@ -21653,7 +22028,10 @@ async function pullCheckout(command, creds, id, folder, force = false) {
       const target = import_node_path25.default.resolve(folder, file.path);
       if (!target.startsWith(folder + import_node_path25.default.sep))
         fail(command, `Refusing to write outside the checkout: ${file.path}`);
-      const body5 = file.encoding === "base64" ? Buffer.from(file.content ?? "", "base64") : Buffer.from(file.content ?? "", "utf8");
+      const download = file.download_url ? await fetch(file.download_url, { signal: AbortSignal.timeout(6e4) }) : null;
+      if (download && !download.ok)
+        fail(command, `Failed to download ${file.path}: ${download.status}`);
+      const body5 = download ? Buffer.from(await download.arrayBuffer()) : file.encoding === "base64" ? Buffer.from(file.content ?? "", "base64") : Buffer.from(file.content ?? "", "utf8");
       if (sha256(body5) !== file.sha256)
         fail(command, `The server returned ${file.path} incomplete. Pull again.`);
       downloaded.push({ path: file.path, target, body: body5, sha256: file.sha256 });
@@ -21733,7 +22111,10 @@ async function pullCheckout(command, creds, id, folder, force = false) {
     notes: listing.data.notes ?? []
   };
 }
-var create8 = new Command("create").description("Create a landing page to build outside Apex").requiredOption("--name <name>", "Page name").option("--slug <slug>", "URL slug (default: from the name)").option("--idea <key>", "Idea key or id the page is built for").option("--out <folder>", "Also pull the new page into this folder").action(async function(opts) {
+var create9 = new Command("create").description("Create a landing page to build outside Apex").requiredOption("--name <name>", "Page name").option(
+  "--slug <slug>",
+  "URL slug (default: from the name; -2, -3 added only if the shop already uses it)"
+).option("--idea <key>", "Idea key or id the page is built for").option("--out <folder>", "Also pull the new page into this folder").action(async function(opts) {
   const creds = requireCredentials();
   const created = await landingPages(creds).create({
     name: opts.name,
@@ -21811,7 +22192,24 @@ var apply = new Command("apply").description("Apply a checkout as a new version"
   }
   const required = new Set(planned.data.files.upload_required);
   const toUpload = files.filter((file) => required.has(file.path));
-  for (const batch of landingPageBatches(toUpload, (file) => file.bytes)) {
+  for (const file of toUpload.filter((file2) => file2.bytes > LANDING_PAGE_BATCH_BYTES)) {
+    const granted = await api.uploadGrant(marker.landingPageId, {
+      path: file.path,
+      bytes: file.bytes,
+      sha256: file.sha256,
+      base_version_id: planned.data.base_version_id
+    });
+    apiFailure(this, granted, "Failed to grant video upload");
+    await uploadLandingVideo(granted.data, file.body, {
+      progress: (uploaded, total) => {
+        console.error(`Uploading ${file.path}: ${uploaded}/${total} bytes`);
+      }
+    });
+  }
+  for (const batch of landingPageBatches(
+    toUpload.filter((file) => file.bytes <= LANDING_PAGE_BATCH_BYTES),
+    (file) => file.bytes
+  )) {
     const uploaded = await api.upload(
       marker.landingPageId,
       batch.map((file) => ({
@@ -21860,7 +22258,7 @@ var apply = new Command("apply").description("Apply a checkout as a new version"
     console.log(`Version ${applied.data.version_number}`);
     if (applied.data.preview_url) console.log(`Preview: ${applied.data.preview_url}`);
     console.log(
-      `Deploy target: ${applied.data.deploy_target ?? "none yet: set host in apex-landing-page.json to a domain this shop holds"}`
+      `Deploy target: ${applied.data.deploy_target ?? "none: set host in apex-landing-page.json to a domain this shop holds"}`
     );
   });
 });
@@ -21888,9 +22286,11 @@ async function versionIdFor(command, creds, id, raw) {
   return match2.id;
 }
 var SPLIT_KEEPS_SERVING_HELP = "\nWhile an experiment splits this page, visitors keep getting its two arms and its goals stay as they are (new manifest goals are added). The deployed version serves when the experiment ends; its goal changes apply at the next deploy after that.\n";
-var deploy = new Command("deploy").description("Deploy a version to a domain this shop holds").argument("[folder-or-id]", "Checkout folder or landing page id", ".").option(
+var deploy = new Command("deploy").description(
+  "Deploy a version to the shop's instant host (<shop>.apex-page.com) or a domain this shop holds"
+).argument("[folder-or-id]", "Checkout folder or landing page id", ".").option(
   "--host <host>",
-  "Domain claimed with apex domains claim (default: the manifest host; one of the two is required)"
+  "Domain claimed with apex domains claim (default: the manifest host, else the shop's apex-page.com subdomain)"
 ).option("--path <path>", "Path on the host").option("--version <number>", "Version number (default: current)").action(async function(target, opts) {
   const creds = requireCredentials();
   const id = resolvePageId(target);
@@ -21974,7 +22374,7 @@ var open2 = new Command("open").description("Print the page's dashboard URL").ar
   output(this, { url }, () => console.log(url));
 });
 var landingPageWorkspaceCommands = [
-  create8,
+  create9,
   pull,
   plan,
   apply,
@@ -22209,6 +22609,35 @@ program2.hook("preAction", (_thisCommand, actionCommand) => {
 process.on("beforeExit", () => {
   flushFallbackEnvelope();
 });
-maybeCheckForUpdate().then(() => program2.parseAsync(process.argv)).then(async () => {
+function isExplicitJsonVersionRequest(args) {
+  let hasJson = false;
+  let hasVersion = false;
+  for (let index = 0; index < args.length; index++) {
+    const arg = args[index];
+    if (arg === "--") break;
+    if (arg === "--json") {
+      hasJson = true;
+    } else if (arg === "--version" || arg === "-V") {
+      hasVersion = true;
+    } else if (arg === "--org" || arg === "--shop") {
+      const value = args[++index];
+      if (!value || value.startsWith("-")) return false;
+    } else if (arg.startsWith("--org=") || arg.startsWith("--shop=")) {
+      const value = arg.slice(arg.indexOf("=") + 1);
+      if (!value || value.startsWith("-")) return false;
+    } else {
+      return false;
+    }
+  }
+  return hasJson && hasVersion;
+}
+var explicitJsonVersionRequest = isExplicitJsonVersionRequest(process.argv.slice(2));
+maybeCheckForUpdate().then(() => {
+  if (explicitJsonVersionRequest) {
+    writeEnvelope({ name: "@drip-apex/apex-cli", version: CLI_VERSION }, "version");
+    return;
+  }
+  return program2.parseAsync(process.argv);
+}).then(async () => {
   await finishInvocation({ exitCode: process.exitCode ?? 0 });
 }).catch((err) => handleCliError(err, program2));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@drip-apex/apex-cli",
-  "version": "0.15.0",
+  "version": "0.15.2",
   "license": "MIT",
   "description": "Apex CLI for managing experiments, approved roadmap ideas, and draft workspaces.",
   "private": false,