@drip-apex/apex-cli 0.15.1 → 0.15.3

package/dist/cli.js

@@ -7325,7 +7325,7 @@ async function checkForUpdate(current) {
 // package.json
 var package_default = {
   name: "@drip-apex/apex-cli",
-  version: "0.15.1",
+  version: "0.15.3",
   license: "MIT",
   description: "Apex CLI for managing experiments, approved roadmap ideas, and draft workspaces.",
   private: false,
@@ -7589,7 +7589,8 @@ function classifyApiError(status4, details) {
   const code = details?.code;
   if (code === "shop_context_required" || code === "org_context_required")
     return EXIT_CODES.validation;
-  if (code === "shop_access_denied" || code === "org_access_denied") return EXIT_CODES.auth;
+  if (code === "shop_access_denied" || code === "org_access_denied" || code === "member_suspended")
+    return EXIT_CODES.auth;
   return classifyStatus(status4);
 }
 function confirmationRequired(command, message, retry) {
@@ -7686,7 +7687,7 @@ function errorReason(error) {
   const body5 = error.api?.body;
   const code = body5?.code ?? body5?.error?.code ?? (error.api ? details?.code : void 0);
   if (typeof code === "string" && code) return code;
-  if (["shop_context_required", "local_file_error", "validation_failed"].includes(
+  if (["shop_context_required", "local_file_error", "validation_failed", "member_suspended"].includes(
     String(details?.code)
   ))
     return String(details?.code);
@@ -7704,6 +7705,13 @@ function errorReason(error) {
 function errorNextSteps(error) {
   const reason2 = errorReason(error);
   const steps = [];
+  if (reason2 === "member_suspended")
+    return [
+      {
+        command: "contact organization admin",
+        why: "Ask an organization owner or admin to reinstate your membership."
+      }
+    ];
   if (reason2 === "auth_required" || error.api?.status === 401) {
     steps.push({ command: "apex login", why: "Authenticate with a valid API key." });
     if (!error.api)
@@ -8438,6 +8446,7 @@ function listExperiments(creds, opts) {
   if (opts?.includeArchived) params.set("archived", "1");
   if (opts?.view) params.set("view", opts.view);
   if (opts?.fields !== void 0) params.set("fields", opts.fields);
+  if (opts?.url !== void 0) params.set("url", opts.url);
   const qs = params.toString();
   return request(creds, "GET", `/api/v1/experiments${qs ? `?${qs}` : ""}`);
 }
@@ -8485,6 +8494,8 @@ function getExperimentFilesystem(creds, id) {
 function getExperimentResults(creds, id, opts) {
   const params = new URLSearchParams();
   if (opts?.currency) params.set("currency", opts.currency);
+  for (const key of ["segment", "exclude_segment"])
+    if (opts?.[key] !== void 0) params.set(key, opts[key]);
   const qs = params.toString();
   return request(
     creds,
@@ -8530,6 +8541,7 @@ function applyExperimentFilesystem(creds, id, body5) {
     `/api/v1/experiments/${id}/filesystem/apply`,
     {
       files: body5.files,
+      ...body5.accept_qa_invalidation !== void 0 ? { accept_qa_invalidation: body5.accept_qa_invalidation } : {},
       ...body5.confirmTargetingReplace === true ? { confirmTargetingReplace: true } : {}
     }
   );
@@ -8537,6 +8549,17 @@ function applyExperimentFilesystem(creds, id, body5) {
 function getExperimentQaRun(creds, id) {
   return request(creds, "GET", `/api/v1/experiments/${id}/qa/run`);
 }
+function getExperimentQaEvents(creds, id, options = {}) {
+  const params = new URLSearchParams();
+  if (options.session) params.set("qa_session", options.session);
+  if (options.minutes !== void 0) params.set("minutes", String(options.minutes));
+  if (options.type) params.set("type", options.type);
+  return request(
+    creds,
+    "GET",
+    `/api/v1/experiments/${id}/qa/events${params.size ? `?${params}` : ""}`
+  );
+}
 function updateExperimentQaRun(creds, id, body5) {
   return request(creds, "PATCH", `/api/v1/experiments/${id}/qa/run`, body5);
 }
@@ -8746,7 +8769,7 @@ function testTargeting(creds, url, opts) {
   if (opts?.status) params.set("status", opts.status);
   return request(creds, "GET", `/api/v1/targeting/test?${params.toString()}`);
 }
-function createSos(creds, body5) {
+function createSos(creds, body5, options = {}) {
   const idempotency_key = body5.idempotency_key ?? (0, import_node_crypto2.createHash)("sha256").update(
     [
       body5.type,
@@ -8754,11 +8777,29 @@ function createSos(creds, body5) {
       body5.description,
       body5.sub_class ?? "",
       body5.loom_url ?? "",
+      ...options.attachmentDigests ?? [],
       String(Math.floor(Date.now() / 36e5))
     ].join("\0")
   ).digest("hex");
   return request(creds, "POST", "/api/v1/sos", { ...body5, idempotency_key });
 }
+function createSosUploadGrants(creds, files) {
+  return request(
+    creds,
+    "POST",
+    "/api/v1/sos/attachment-uploads",
+    { files }
+  );
+}
+async function uploadSosAttachment(signedUrl, contentType, bytes) {
+  const response = await fetch(signedUrl, {
+    method: "PUT",
+    headers: { "Content-Type": contentType },
+    body: bytes,
+    signal: AbortSignal.timeout(12e4)
+  });
+  if (!response.ok) throw new Error(`Attachment upload failed (${response.status})`);
+}
 function listMySos(creds) {
   return request(creds, "GET", "/api/v1/sos/mine");
 }
@@ -8869,6 +8910,15 @@ function createAdminCustomer(creds, body5) {
     body5
   );
 }
+function setAdminCustomerCategory(creds, orgId, body5) {
+  return request(userCredentials(creds), "PATCH", `/api/v1/admin/customers/${orgId}`, body5);
+}
+function setAdminCustomerManagedBy(creds, orgId, body5) {
+  return request(userCredentials(creds), "PATCH", `/api/v1/admin/customers/${orgId}`, body5);
+}
+function setAdminCustomerWorkspaceType(creds, orgId, body5) {
+  return request(userCredentials(creds), "PATCH", `/api/v1/admin/customers/${orgId}`, body5);
+}
 function getAdminSettings(creds) {
   return request(userCredentials(creds), "GET", "/api/v1/admin/settings");
 }
@@ -9023,6 +9073,17 @@ function revokeOrgInvite(creds, id) {
 function setOrgMember(creds, id, body5) {
   return request(userCreds(creds), "PATCH", `/api/v1/org/members/${encodeURIComponent(id)}`, body5);
 }
+function suspendOrgMember(creds, id, reason2) {
+  return request(userCreds(creds), "PATCH", `/api/v1/org/members/${encodeURIComponent(id)}`, {
+    suspended: true,
+    ...reason2 ? { reason: reason2 } : {}
+  });
+}
+function reinstateOrgMember(creds, id) {
+  return request(userCreds(creds), "PATCH", `/api/v1/org/members/${encodeURIComponent(id)}`, {
+    suspended: false
+  });
+}
 function removeOrgMember(creds, id) {
   return request(userCreds(creds), "DELETE", `/api/v1/org/members/${encodeURIComponent(id)}`);
 }
@@ -9166,6 +9227,14 @@ function getOrderJourney(creds, opts) {
     45e3
   );
 }
+function moveAdminCustomerStores(creds, orgId, body5) {
+  return request(
+    userCredentials(creds),
+    "POST",
+    `/api/v1/admin/customers/${orgId}/move-stores`,
+    body5
+  );
+}
 
 // src/context.ts
 var import_node_readline = __toESM(require("node:readline"));
@@ -9377,10 +9446,14 @@ async function waitForBrowserLogin(baseUrl, userMode = false) {
         const returnedState = params.get("state");
         const apiKey = params.get("apiKey");
         const error = params.get("error");
+        const code = params.get("code");
         if (error) {
           res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
           res.end("<h1>Apex CLI login failed</h1><p>You can close this window.</p>");
-          finish(new Error(error));
+          const details = code ? { code } : void 0;
+          finish(
+            details ? new CliError(error, classifyApiError(400, details), details) : new Error(error)
+          );
           return;
         }
         if (returnedState !== state) {
@@ -9464,6 +9537,7 @@ var loginCommand = new Command("login").description("Authenticate with Apex").op
     try {
       apiKey = await waitForBrowserLogin(baseUrl, true);
     } catch (err) {
+      if (err instanceof CliError) throw err;
       fail(this, err instanceof Error ? err.message : "Browser login failed.");
     }
   }
@@ -9755,13 +9829,18 @@ function buildQaPreviewUrl(experiment2, options = {}) {
 }
 
 // src/lib/qa-preview-url.ts
-function buildQaPreviewUrl2(storeUrl, experimentId, variationId) {
-  const url = buildQaPreviewUrl({
-    id: experimentId,
-    store_url: storeUrl,
-    variations: [{ id: variationId, is_control: false }]
-  });
+function buildQaPreviewUrl2(storeUrl, experimentId, variationId, qaSessionId) {
+  const url = buildQaPreviewUrl(
+    {
+      id: experimentId,
+      store_url: storeUrl,
+      variations: [{ id: variationId, is_control: false }]
+    },
+    { qaSessionId }
+  );
   if (!url) throw new TypeError("Invalid QA preview URL");
+  if (qaSessionId && url.searchParams.get("drip_qa_session") !== qaSessionId)
+    url.searchParams.set("drip_qa_session", qaSessionId);
   return url;
 }
 
@@ -10159,6 +10238,755 @@ function createAssetReferenceRewriter(options) {
   return { rewrite, rewriteUnknown };
 }
 
+// src/generated/experiment-filesystem.schema.json
+var experiment_filesystem_schema_default = {
+  $id: "https://api.drip-apex.com/schemas/experiment-filesystem-v1.json",
+  $schema: "https://json-schema.org/draft/2020-12/schema",
+  files: {
+    "experiment.json": {
+      $schema: "https://json-schema.org/draft/2020-12/schema",
+      additionalProperties: false,
+      properties: {
+        autoStopOverride: {
+          anyOf: [
+            {},
+            {
+              type: "null"
+            }
+          ]
+        },
+        countingType: {
+          anyOf: [
+            {
+              enum: ["standard", "setup_test", "aa_test", "non_program"],
+              type: "string"
+            },
+            {
+              type: "null"
+            }
+          ]
+        },
+        description: {
+          anyOf: [
+            {
+              type: "string"
+            },
+            {
+              type: "null"
+            }
+          ]
+        },
+        environmentKey: {
+          type: "string"
+        },
+        experimentType: {
+          enum: ["mutation", "redirect"],
+          type: "string"
+        },
+        id: {
+          anyOf: [
+            {
+              type: "string"
+            },
+            {
+              type: "null"
+            }
+          ]
+        },
+        name: {
+          type: "string"
+        },
+        schemaVersion: {
+          const: 1,
+          type: "number"
+        },
+        sequentialTestingEnabled: {
+          type: "boolean"
+        },
+        significanceLevel: {
+          type: "number"
+        },
+        slug: {
+          anyOf: [
+            {
+              type: "string"
+            },
+            {
+              type: "null"
+            }
+          ]
+        },
+        statisticalPower: {
+          type: "number"
+        },
+        storeUrl: {
+          anyOf: [
+            {
+              type: "string"
+            },
+            {
+              type: "null"
+            }
+          ]
+        },
+        testKey: {
+          anyOf: [
+            {
+              type: "string"
+            },
+            {
+              type: "null"
+            }
+          ]
+        },
+        trafficAllocation: {
+          maximum: 1,
+          minimum: 0,
+          type: "number"
+        }
+      },
+      required: ["schemaVersion"],
+      type: "object"
+    },
+    "experiment/index.css": {
+      $schema: "https://json-schema.org/draft/2020-12/schema",
+      contentMediaType: "text/css",
+      type: "string"
+    },
+    "experiment/index.js": {
+      $schema: "https://json-schema.org/draft/2020-12/schema",
+      contentMediaType: "text/javascript",
+      type: "string"
+    },
+    "experiment/reset.js": {
+      $schema: "https://json-schema.org/draft/2020-12/schema",
+      contentMediaType: "text/javascript",
+      type: "string"
+    },
+    "launch.json": {
+      $schema: "https://json-schema.org/draft/2020-12/schema",
+      additionalProperties: false,
+      properties: {
+        endedAt: {
+          anyOf: [
+            {
+              type: "string"
+            },
+            {
+              type: "null"
+            }
+          ]
+        },
+        launchApproval: {
+          anyOf: [
+            {
+              additionalProperties: false,
+              properties: {
+                decidedAt: {
+                  anyOf: [
+                    {
+                      type: "string"
+                    },
+                    {
+                      type: "null"
+                    }
+                  ]
+                },
+                note: {
+                  anyOf: [
+                    {
+                      type: "string"
+                    },
+                    {
+                      type: "null"
+                    }
+                  ]
+                },
+                status: {
+                  type: "string"
+                }
+              },
+              required: ["status", "decidedAt", "note"],
+              type: "object"
+            },
+            {
+              type: "null"
+            }
+          ]
+        },
+        launchGate: {
+          additionalProperties: false,
+          properties: {
+            qaApproved: {
+              type: "boolean"
+            },
+            treatmentArtifactsApproved: {
+              type: "boolean"
+            }
+          },
+          required: ["qaApproved", "treatmentArtifactsApproved"],
+          type: "object"
+        },
+        readonly: {
+          const: true,
+          type: "boolean"
+        },
+        scheduledEndAt: {
+          anyOf: [
+            {
+              type: "string"
+            },
+            {
+              type: "null"
+            }
+          ]
+        },
+        scheduledStartAt: {
+          anyOf: [
+            {
+              type: "string"
+            },
+            {
+              type: "null"
+            }
+          ]
+        },
+        schemaVersion: {
+          const: 1,
+          type: "number"
+        },
+        startedAt: {
+          anyOf: [
+            {
+              type: "string"
+            },
+            {
+              type: "null"
+            }
+          ]
+        },
+        status: {
+          type: "string"
+        }
+      },
+      readOnly: true,
+      required: [
+        "schemaVersion",
+        "readonly",
+        "status",
+        "scheduledStartAt",
+        "scheduledEndAt",
+        "startedAt",
+        "endedAt",
+        "launchApproval",
+        "launchGate"
+      ],
+      type: "object"
+    },
+    "metrics.json": {
+      $schema: "https://json-schema.org/draft/2020-12/schema",
+      additionalProperties: false,
+      properties: {
+        goals: {
+          items: {
+            additionalProperties: false,
+            properties: {
+              capture: {
+                anyOf: [
+                  {},
+                  {
+                    type: "null"
+                  }
+                ]
+              },
+              countOnce: {
+                type: "boolean"
+              },
+              eventName: {
+                anyOf: [
+                  {
+                    type: "string"
+                  },
+                  {
+                    type: "null"
+                  }
+                ]
+              },
+              filter: {
+                anyOf: [
+                  {},
+                  {
+                    type: "null"
+                  }
+                ]
+              },
+              id: {
+                anyOf: [
+                  {
+                    type: "string"
+                  },
+                  {
+                    type: "null"
+                  }
+                ]
+              },
+              isPrimary: {
+                type: "boolean"
+              },
+              measurement: {},
+              name: {
+                type: "string"
+              },
+              pageId: {
+                anyOf: [
+                  {
+                    type: "string"
+                  },
+                  {
+                    type: "null"
+                  }
+                ]
+              },
+              selector: {
+                anyOf: [
+                  {
+                    type: "string"
+                  },
+                  {
+                    type: "null"
+                  }
+                ]
+              },
+              textMatch: {
+                anyOf: [
+                  {
+                    type: "string"
+                  },
+                  {
+                    type: "null"
+                  }
+                ]
+              },
+              type: {
+                enum: ["click", "pageview", "custom", "revenue"],
+                type: "string"
+              },
+              urlPattern: {
+                anyOf: [
+                  {
+                    type: "string"
+                  },
+                  {
+                    type: "null"
+                  }
+                ]
+              },
+              valueProperty: {
+                anyOf: [
+                  {
+                    type: "string"
+                  },
+                  {
+                    type: "null"
+                  }
+                ]
+              },
+              valueUnit: {
+                anyOf: [
+                  {
+                    type: "string"
+                  },
+                  {
+                    type: "null"
+                  }
+                ]
+              }
+            },
+            required: ["name", "type"],
+            type: "object"
+          },
+          type: "array"
+        },
+        primaryGoalId: {
+          anyOf: [
+            {
+              type: "string"
+            },
+            {
+              type: "null"
+            }
+          ]
+        },
+        schemaVersion: {
+          const: 1,
+          type: "number"
+        }
+      },
+      required: ["schemaVersion", "primaryGoalId", "goals"],
+      type: "object"
+    },
+    "qa.json": {
+      $schema: "https://json-schema.org/draft/2020-12/schema",
+      additionalProperties: false,
+      properties: {
+        latestRun: {
+          anyOf: [
+            {
+              additionalProperties: false,
+              properties: {
+                approvedAt: {
+                  anyOf: [
+                    {
+                      type: "string"
+                    },
+                    {
+                      type: "null"
+                    }
+                  ]
+                },
+                completedAt: {
+                  anyOf: [
+                    {
+                      type: "string"
+                    },
+                    {
+                      type: "null"
+                    }
+                  ]
+                },
+                id: {
+                  type: "string"
+                },
+                source: {
+                  type: "string"
+                },
+                status: {
+                  type: "string"
+                },
+                summary: {
+                  anyOf: [
+                    {},
+                    {
+                      type: "null"
+                    }
+                  ]
+                }
+              },
+              required: ["id", "status", "source", "approvedAt", "completedAt", "summary"],
+              type: "object"
+            },
+            {
+              type: "null"
+            }
+          ]
+        },
+        qaApprovedAt: {
+          anyOf: [
+            {
+              type: "string"
+            },
+            {
+              type: "null"
+            }
+          ]
+        },
+        qaApprovedBy: {
+          anyOf: [
+            {
+              type: "string"
+            },
+            {
+              type: "null"
+            }
+          ]
+        },
+        readonly: {
+          const: true,
+          type: "boolean"
+        },
+        schemaVersion: {
+          const: 1,
+          type: "number"
+        }
+      },
+      readOnly: true,
+      required: ["schemaVersion", "readonly", "qaApprovedAt", "qaApprovedBy", "latestRun"],
+      type: "object"
+    },
+    "targeting.json": {
+      $schema: "https://json-schema.org/draft/2020-12/schema",
+      additionalProperties: {},
+      properties: {
+        authorUrl: {
+          items: {
+            additionalProperties: false,
+            properties: {
+              include: {
+                type: "boolean"
+              },
+              match_type: {
+                enum: ["exact", "contains", "wildcard", "regex"],
+                type: "string"
+              },
+              matchType: {
+                enum: ["exact", "contains", "wildcard", "regex"],
+                type: "string"
+              },
+              pattern: {
+                minLength: 1,
+                type: "string"
+              },
+              type: {
+                enum: ["regex", "simple"],
+                type: "string"
+              }
+            },
+            required: ["type", "pattern"],
+            type: "object"
+          },
+          type: "array"
+        },
+        custom: {},
+        device: {},
+        deviceType: {
+          type: "string"
+        },
+        lifecycle: {},
+        pageRules: {
+          items: {},
+          type: "array"
+        },
+        pages: {
+          items: {},
+          type: "array"
+        },
+        segments: {
+          items: {},
+          type: "array"
+        },
+        url: {
+          items: {
+            additionalProperties: false,
+            properties: {
+              include: {
+                type: "boolean"
+              },
+              match_type: {
+                enum: ["exact", "contains", "wildcard", "regex"],
+                type: "string"
+              },
+              matchType: {
+                enum: ["exact", "contains", "wildcard", "regex"],
+                type: "string"
+              },
+              pattern: {
+                minLength: 1,
+                type: "string"
+              },
+              type: {
+                enum: ["regex", "simple"],
+                type: "string"
+              }
+            },
+            required: ["type", "pattern"],
+            type: "object"
+          },
+          type: "array"
+        }
+      },
+      type: "object"
+    },
+    "variations/*/anti-flicker.json": {
+      $schema: "https://json-schema.org/draft/2020-12/schema",
+      items: {
+        type: "string"
+      },
+      type: "array"
+    },
+    "variations/*/index.css": {
+      $schema: "https://json-schema.org/draft/2020-12/schema",
+      contentMediaType: "text/css",
+      type: "string"
+    },
+    "variations/*/index.js": {
+      $schema: "https://json-schema.org/draft/2020-12/schema",
+      contentMediaType: "text/javascript",
+      type: "string"
+    },
+    "variations/*/mutations.json": {
+      $schema: "https://json-schema.org/draft/2020-12/schema",
+      items: {
+        additionalProperties: {},
+        anyOf: [
+          {
+            required: ["selector"]
+          },
+          {
+            properties: {
+              action: {
+                enum: [
+                  "priceTest",
+                  "shippingTest",
+                  "offerTest",
+                  "postPurchaseOffer",
+                  "checkoutBlock"
+                ]
+              }
+            },
+            required: ["action"]
+          }
+        ],
+        properties: {
+          action: {
+            type: "string"
+          },
+          selector: {
+            minLength: 1,
+            type: "string"
+          },
+          type: {
+            type: "string"
+          }
+        },
+        type: "object"
+      },
+      type: "array"
+    },
+    "variations/*/reset.js": {
+      $schema: "https://json-schema.org/draft/2020-12/schema",
+      contentMediaType: "text/javascript",
+      type: "string"
+    },
+    "variations/*/url-blocks.json": {
+      $schema: "https://json-schema.org/draft/2020-12/schema",
+      items: {},
+      type: "array"
+    },
+    "variations/*/variation.json": {
+      $schema: "https://json-schema.org/draft/2020-12/schema",
+      additionalProperties: false,
+      properties: {
+        artifactReview: {
+          additionalProperties: false,
+          properties: {
+            hash: {
+              anyOf: [
+                {
+                  type: "string"
+                },
+                {
+                  type: "null"
+                }
+              ]
+            },
+            reviewedAt: {
+              anyOf: [
+                {
+                  type: "string"
+                },
+                {
+                  type: "null"
+                }
+              ]
+            },
+            reviewedBy: {
+              anyOf: [
+                {
+                  type: "string"
+                },
+                {
+                  type: "null"
+                }
+              ]
+            },
+            source: {
+              anyOf: [
+                {
+                  type: "string"
+                },
+                {
+                  type: "null"
+                }
+              ]
+            },
+            status: {
+              type: "string"
+            }
+          },
+          required: ["status"],
+          type: "object"
+        },
+        codeDeliveryMode: {
+          enum: ["inline", "external"],
+          type: "string"
+        },
+        cssArtifactId: {
+          anyOf: [
+            {
+              type: "string"
+            },
+            {
+              type: "null"
+            }
+          ]
+        },
+        id: {
+          anyOf: [
+            {
+              type: "string"
+            },
+            {
+              type: "null"
+            }
+          ]
+        },
+        isControl: {
+          type: "boolean"
+        },
+        jsArtifactId: {
+          anyOf: [
+            {
+              type: "string"
+            },
+            {
+              type: "null"
+            }
+          ]
+        },
+        name: {
+          type: "string"
+        },
+        redirectUrl: {
+          anyOf: [
+            {
+              type: "string"
+            },
+            {
+              type: "null"
+            }
+          ]
+        },
+        schemaVersion: {
+          const: 1,
+          type: "number"
+        },
+        slug: {
+          type: "string"
+        },
+        weight: {
+          maximum: 1,
+          minimum: 0,
+          type: "number"
+        }
+      },
+      required: ["schemaVersion"],
+      type: "object"
+    }
+  },
+  schemaVersion: 1,
+  source: "experiment-filesystem"
+};
+
 // src/commands/experiments.ts
 function formatDate(iso) {
   return new Date(iso).toLocaleDateString("en-US", {
@@ -10222,6 +11050,13 @@ function formatRevenue(value, currency) {
     return String(value);
   }
 }
+function audienceLine(segmentApplied) {
+  if (!segmentApplied || typeof segmentApplied !== "object") return null;
+  const { requested, applied, reason: reason2 } = segmentApplied;
+  if (!requested) return null;
+  const label = `${requested.mode === "exclude" ? "excluding " : ""}${String(requested.dim)}=${String(requested.value)}`;
+  return applied === true ? label : `all visitors (${label} not applied: ${typeof reason2 === "string" ? reason2 : "unknown reason"})`;
+}
 function printExperimentResults(results2, currency) {
   const summary = summarizeResults(results2);
   const { experiment: experiment2, totals, decision, verdictWithheld, statisticsState, presentedOutcome } = summary;
@@ -10229,6 +11064,8 @@ function printExperimentResults(results2, currency) {
   console.log();
   console.log(source_default.bold(String(experiment2.name ?? experiment2.id ?? "Experiment results")));
   console.log(`  Status:      ${statusBadge(String(experiment2.status ?? "unknown"))}`);
+  const audience = audienceLine(results2.segment_applied);
+  if (audience) console.log(`  Audience:    ${audience}`);
   console.log(`  Visitors:    ${String(totals.visitors ?? 0)}`);
   console.log(`  Conversions: ${String(totals.primaryConversions ?? 0)}`);
   console.log(`  Revenue:     ${formatRevenue(totals.revenue, currency)}`);
@@ -10292,18 +11129,11 @@ function printExperimentResults(results2, currency) {
   }
   console.log();
 }
+var filesystemPaths = Object.keys(experiment_filesystem_schema_default.files);
 var EXPERIMENT_FILESYSTEM_PATH_SCHEMA = {
-  topLevel: ["experiment.json", "targeting.json", "metrics.json", "qa.json", "launch.json"],
-  experiment: ["index.css", "index.js", "reset.js"],
-  variation: [
-    "variation.json",
-    "mutations.json",
-    "url-blocks.json",
-    "index.css",
-    "index.js",
-    "reset.js",
-    "anti-flicker.json"
-  ]
+  topLevel: filesystemPaths.filter((entry) => !entry.includes("/")),
+  experiment: filesystemPaths.filter((entry) => entry.startsWith("experiment/")).map((entry) => entry.slice("experiment/".length)),
+  variation: filesystemPaths.filter((entry) => entry.startsWith("variations/*/")).map((entry) => entry.slice("variations/*/".length))
 };
 var SERVER_OWNED_EXPERIMENT_FILES = /* @__PURE__ */ new Set(["qa.json", "launch.json"]);
 var escapeRegex = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -10507,14 +11337,31 @@ function printFilesystemPlan(plan2) {
   }
   console.log();
   console.log(`QA invalidated: ${plan2.invalidatesQa ? source_default.yellow("yes") : "no"}`);
-  console.log(`Acknowledgment: ${plan2.invalidatesQa ? "--accept-qa-invalidation" : "none"}`);
+  console.log(
+    `QA approval:   ${!plan2.qaApproval ? "unknown (older server)" : plan2.qaApproval.present ? `present${plan2.qaApproval.approvedAt ? ` (approved ${plan2.qaApproval.approvedAt})` : ""}` : "none"}`
+  );
+  console.log(`Acknowledgment: ${requiredQaAcknowledgment(plan2) ?? "none"}`);
   console.log(`Precompile:     ${plan2.precompileRequired ? "yes" : "no"}`);
 }
+function requiredQaAcknowledgment(plan2) {
+  return "requiredAcknowledgment" in plan2 ? plan2.requiredAcknowledgment ?? null : plan2.invalidatesQa ? "accept-qa-invalidation" : null;
+}
 function blockingIssueSummary(issues) {
   if (!issues?.length) return "Experiment filesystem plan has errors.";
   const remaining = issues.length - 1;
   return `Experiment filesystem plan has errors. ${issues[0].message}${remaining ? ` and ${remaining} more` : ""}`;
 }
+function qaApprovalRefusal(approvedAt, folderArg) {
+  return {
+    message: `Applying these changes revokes the QA approval from ${approvedAt ?? "an unspecified time"}; pass --accept-qa-invalidation to confirm.`,
+    details: {
+      reason: "qa_approval_present",
+      qa_approved_at: approvedAt,
+      required_acknowledgment: "accept-qa-invalidation",
+      retry: `apex experiments apply ${folderArg} --accept-qa-invalidation`
+    }
+  };
+}
 async function getQaPreviewUrls(creds, experimentId) {
   const fallbackDashboardUrl = buildDashboardUrl(
     creds.baseUrl,
@@ -10738,20 +11585,31 @@ var list = new Command("list").alias("ls").description(
   "List experiments in summary view by default; use --full for details or --fields for selected columns (archived experiments are hidden by default)"
 ).option(
   "-s, --status <status>",
-  "Filter by status (draft|awaiting_client_approval|changes_requested|client_approved|qa|ready_to_launch|running|paused|completed)"
+  "Filter by status (draft|awaiting_client_approval|changes_requested|client_approved|qa|ready_to_launch|running|paused|completed) (applied server-side)"
+).option(
+  "--url <absolute-url>",
+  "Filter by effective storefront URL targeting (applied server-side)"
 ).option("-n, --limit <n>", "Max results", "20").option("--include-archived", "Include archived experiments").option("--full", "Return full experiment details instead of the default summary").option(
   "--fields <list>",
   "Comma-separated fields to return and table columns in order (JSON always keeps id)"
 ).action(async function action3(opts) {
   const creds = requireCredentials();
   const spinner = await createSpinner("Fetching experiments...");
-  const res = await listExperiments(creds, {
+  const listDefault = () => listExperiments(creds, {
     status: opts.status,
     limit: parseInt(opts.limit, 10),
     includeArchived: opts.includeArchived,
     view: opts.full ? "full" : "summary",
     fields: opts.fields
   });
+  const res = opts.url !== void 0 ? await listExperiments(creds, {
+    status: opts.status,
+    limit: parseInt(opts.limit, 10),
+    includeArchived: opts.includeArchived,
+    view: opts.full ? "full" : "summary",
+    fields: opts.fields,
+    url: opts.url
+  }) : await listDefault();
   if (!res.ok) {
     spinner?.fail("Failed to fetch experiments");
     fail(this, res.error, classifyStatus(res.status), res.errorDetails);
@@ -10889,7 +11747,13 @@ ${JSON.stringify(data.order, null, 2)}`);
   console.log(`
 Definitions: ${data.definitions_url}`);
 }
-var results = new Command("results").description("Read experiment results and timeseries by ID or slug").argument("<id-or-slug>", EXPERIMENT_REFERENCE_DESCRIPTION).option("--currency <code>", "Currency code for revenue formatting").option("--explain", "Explain raw-event exclusions and residuals").option("--goal <id>", "Goal ID or event key for --explain").option("--order <key>", "Order label trail for --explain").option("--samples", "Show sample identifiers with --explain").action(async function action7(idOrSlug, opts) {
+var results = new Command("results").description("Read experiment results and timeseries by ID or slug").argument("<id-or-slug>", EXPERIMENT_REFERENCE_DESCRIPTION).option("--currency <code>", "Currency code for revenue formatting").option("--segment <dim:value>", "Include one audience segment").option("--exclude-segment <dim:value>", "Exclude one audience segment (include wins)").option("--explain", "Explain raw-event exclusions and residuals").option("--goal <id>", "Goal ID or event key for --explain").option("--order <key>", "Order label trail for --explain").option("--samples", "Show sample identifiers with --explain").action(async function action7(idOrSlug, opts) {
+  if (opts.explain && (opts.segment !== void 0 || opts.excludeSegment !== void 0))
+    fail(
+      this,
+      "--segment and --exclude-segment are only available for results, without --explain",
+      EXIT_CODES.validation
+    );
   if (!opts.explain && (opts.goal || opts.order || opts.samples))
     fail(this, "--goal, --order and --samples require --explain", EXIT_CODES.validation);
   const creds = requireCredentials();
@@ -10900,7 +11764,11 @@ var results = new Command("results").description("Read experiment results and ti
       spinner?.fail(`Experiment "${idOrSlug}" not found`);
       fail(this, `Experiment "${idOrSlug}" not found.`, EXIT_CODES.validation);
     }
-    const res = opts.explain ? await getExperimentResultsExplain(creds, exp.id, opts) : await getExperimentResults(creds, exp.id, { currency: opts.currency });
+    const res = opts.explain ? await getExperimentResultsExplain(creds, exp.id, opts) : await getExperimentResults(creds, exp.id, {
+      currency: opts.currency,
+      segment: opts.segment,
+      exclude_segment: opts.excludeSegment
+    });
     if (!res.ok || !res.data) {
       spinner?.fail("Failed to fetch experiment results");
       fail(
@@ -11174,7 +12042,7 @@ var create = new Command("create").description(
   []
 ).option(
   "--goal <goal-id|new:fields>",
-  "Goal id or new:type=...,selector=...,name=... (repeatable)",
+  "Goal id or new:type=...,selector=...,name=... (repeatable; omitted uses the shop default main goal)",
   collectCreateOption,
   []
 ).option(
@@ -11593,6 +12461,7 @@ var pullFilesystem = new Command("pull").description("Pull an experiment as an e
     output(
       this,
       {
+        schemaVersion: 1,
         folder,
         experimentId: exp.id,
         files: res.data.files.map((file) => import_node_path6.default.join(folder, file.path))
@@ -11890,7 +12759,7 @@ var planFilesystem = new Command("plan").description("Plan experiment filesystem
         folder,
         experimentId: session.experimentId,
         plan: res.data,
-        requiredAcknowledgment: res.data.invalidatesQa ? "accept-qa-invalidation" : null
+        requiredAcknowledgment: requiredQaAcknowledgment(res.data)
       },
       () => printFilesystemPlan(res.data)
     );
@@ -11902,7 +12771,10 @@ var planFilesystem = new Command("plan").description("Plan experiment filesystem
 var applyFilesystem = new Command("apply").option(
   "--confirm-targeting-replace",
   "Confirm that attaching a Page may replace URL targeting authored through the API"
-).option("--sync", "Refresh local authored files with the stored server bytes").description("Apply experiment filesystem changes to Apex").argument("[folder]", "Experiment filesystem folder", ".").option("--accept-qa-invalidation", "Acknowledge that applying changes invalidates QA approval").addOption(new Option("-f, --force", "Deprecated alias for --accept-qa-invalidation").hideHelp()).option("--no-asset-upload", "Keep inline and local image references unchanged").action(async function action15(folderArg, opts) {
+).option("--sync", "Refresh local authored files with the stored server bytes").description("Apply experiment filesystem changes to Apex").argument("[folder]", "Experiment filesystem folder", ".").option(
+  "--accept-qa-invalidation",
+  "Confirm an apply that revokes an existing QA approval (required only when the experiment holds one)"
+).addOption(new Option("-f, --force", "Deprecated alias for --accept-qa-invalidation").hideHelp()).option("--no-asset-upload", "Keep inline and local image references unchanged").action(async function action15(folderArg, opts) {
   const creds = requireCredentials();
   try {
     const folder = folderPath(folderArg);
@@ -11949,7 +12821,7 @@ var applyFilesystem = new Command("apply").option(
             why: "Retry with hosted asset upload."
           }
         ] : [],
-        requiredAcknowledgment: planRes.data.invalidatesQa ? "accept-qa-invalidation" : null
+        requiredAcknowledgment: requiredQaAcknowledgment(planRes.data)
       });
     }
     if (planRes.data.changes.length === 0) {
@@ -11966,7 +12838,7 @@ var applyFilesystem = new Command("apply").option(
           synced: synced2,
           dashboardUrl: dashboardUrl2,
           plan: planRes.data,
-          requiredAcknowledgment: planRes.data.invalidatesQa ? "accept-qa-invalidation" : null,
+          requiredAcknowledgment: requiredQaAcknowledgment(planRes.data),
           message: "No changes."
         },
         () => {
@@ -11978,23 +12850,23 @@ var applyFilesystem = new Command("apply").option(
       );
       return;
     }
-    if (planRes.data.invalidatesQa && !opts.force && !opts.acceptQaInvalidation) {
-      const ok = await confirmApply("This apply invalidates QA approval. Continue?");
+    let acceptQaInvalidation = Boolean(opts.force || opts.acceptQaInvalidation);
+    if (requiredQaAcknowledgment(planRes.data) && !acceptQaInvalidation) {
+      const refusal = qaApprovalRefusal(planRes.data.qaApproval?.approvedAt ?? null, folderArg);
+      const ok = await confirmApply(`${refusal.message} Continue?`);
       if (ok === null) {
-        confirmationRequired(
-          this,
-          "Applying these changes invalidates QA approval and requires confirmation.",
-          `apex experiments apply ${folderArg} --accept-qa-invalidation`
-        );
+        fail(this, refusal.message, EXIT_CODES.confirmationRequired, refusal.details);
       }
       if (!ok) {
         output(this, { aborted: true }, () => console.log("Aborted."));
         return;
       }
+      acceptQaInvalidation = true;
     }
     const spinner = process.stderr.isTTY ? await createSpinner("Applying experiment filesystem...") : null;
     let res = await applyExperimentFilesystem(creds, session.experimentId, {
       files,
+      accept_qa_invalidation: acceptQaInvalidation,
       ...opts.confirmTargetingReplace ? { confirmTargetingReplace: true } : {}
     });
     if (!res.ok && res.status === 409 && res.errorDetails?.code === "confirm_targeting_replace_required" && !opts.confirmTargetingReplace) {
@@ -12015,9 +12887,19 @@ var applyFilesystem = new Command("apply").option(
       }
       res = await applyExperimentFilesystem(creds, session.experimentId, {
         files,
+        accept_qa_invalidation: acceptQaInvalidation,
         confirmTargetingReplace: true
       });
     }
+    if (!res.ok && res.status === 409 && res.errorDetails?.code === "qa_acknowledgment_required") {
+      spinner?.stop();
+      const approvedAt = res.errorDetails.qa_approved_at;
+      const refusal = qaApprovalRefusal(
+        typeof approvedAt === "string" ? approvedAt : null,
+        folderArg
+      );
+      fail(this, refusal.message, EXIT_CODES.confirmationRequired, refusal.details);
+    }
     if (!res.ok || !res.data?.applied) {
       spinner?.fail("Failed to apply experiment filesystem");
       fail(this, res.error ?? "Apply failed", classifyStatus(res.status), {
@@ -12056,7 +12938,7 @@ var applyFilesystem = new Command("apply").option(
         experimentId: session.experimentId,
         applied: true,
         plan: planRes.data,
-        requiredAcknowledgment: planRes.data.invalidatesQa ? "accept-qa-invalidation" : null,
+        requiredAcknowledgment: requiredQaAcknowledgment(planRes.data),
         result: res.data,
         synced,
         dashboardUrl,
@@ -12408,7 +13290,55 @@ var qaEvidence = new Command("evidence").description("Attach screenshot jobs or
     throw error;
   }
 });
-var qa = new Command("qa").description("Manage experiment QA runs from the CLI").addCommand(qaStatus).addCommand(qaCheck).addCommand(qaNotes).addCommand(qaApprove).addCommand(qaReopen).addCommand(qaEvidence);
+var qa = new Command("qa").description("Manage experiment QA runs from the CLI").addCommand(qaStatus).addCommand(
+  new Command("events").description("List QA-tagged events for an experiment session").argument("<id-or-slug>", EXPERIMENT_REFERENCE_DESCRIPTION).option("--session <id>", "QA session id (defaults to the latest QA run)").option("--minutes <n>", "Lookback window in minutes", "60").option("--type <type>", "Event type: all, goal, or custom", "all").action(async function(target, opts) {
+    const minutes = Number(opts.minutes);
+    if (!Number.isInteger(minutes) || minutes < 5 || minutes > 1440)
+      fail(this, "--minutes must be an integer between 5 and 1440", EXIT_CODES.validation);
+    if (!["all", "goal", "custom"].includes(opts.type))
+      fail(this, "--type must be all, goal, or custom", EXIT_CODES.validation);
+    const creds = requireCredentials();
+    const experiment2 = { id: (await resolveExperimentForFilesystemOrId(target)).experimentId };
+    let session = opts.session;
+    if (!session) {
+      const status4 = await getExperimentQaRun(creds, experiment2.id);
+      if (!status4.ok || !status4.data)
+        throw new CliError(
+          status4.error ?? "Failed to fetch QA run",
+          classifyStatus(status4.status),
+          status4.errorDetails
+        );
+      session = status4.data.run.id;
+    }
+    const response = await getExperimentQaEvents(creds, experiment2.id, {
+      session,
+      minutes,
+      type: opts.type
+    });
+    if (!response.ok || !response.data)
+      throw new CliError(
+        response.error ?? "Failed to fetch QA events",
+        classifyStatus(response.status),
+        response.errorDetails
+      );
+    output(
+      this,
+      response.data,
+      () => printTable(
+        ["TYPE", "EVENT", "VARIATION", "SESSION", "COUNT", "LAST SEEN", "LAST URL"],
+        response.data.data.map((row) => [
+          row.event_type === "goal" ? "goal" : "custom",
+          row.event_name || row.goal_id,
+          row.variation_id,
+          row.qa_session_id,
+          String(row.events),
+          row.last_event_at ?? "\u2014",
+          row.last_url ?? "\u2014"
+        ])
+      )
+    );
+  })
+).addCommand(qaCheck).addCommand(qaNotes).addCommand(qaApprove).addCommand(qaReopen).addCommand(qaEvidence);
 var SCREENSHOT_DEVICES = [
   "desktop_chrome",
   "iphone_15_pro",
@@ -13057,6 +13987,25 @@ var pushCommand = new Command("push").description("Push experiment definitions f
 
 // src/commands/preview.ts
 init_source();
+async function signedPreviewFromReadiness(creds, experimentId, variationId, targetUrl) {
+  try {
+    const client = createHttpClient(creds, {
+      onNetworkError: (info) => {
+        throw new Error(info.cause);
+      }
+    });
+    const query = new URLSearchParams({ variation_id: variationId, target_url: targetUrl });
+    const response = await client.request(
+      "GET",
+      `/api/v1/experiments/${encodeURIComponent(experimentId)}/readiness?${query}`,
+      void 0,
+      5e3
+    );
+    return response.ok ? response.data?.data : void 0;
+  } catch {
+    return void 0;
+  }
+}
 var previewCommand = new Command("preview").description(
   "Open QA preview URL for an experiment variation; proxy previews return a QA run receipt"
 ).argument("<id-or-slug>", "Experiment ID or slug").argument("[variation-id]", "Variation ID (defaults to first non-control)").option("--store-url <url>", "Override experiment store_url (target website URL)").option("--proxy", "Create an artifact-injecting proxy preview").option("--ttl <hours>", "Proxy preview lifetime in hours (1-168)").option("--no-open", "Print URL instead of opening browser").action(
@@ -13168,28 +14117,51 @@ var previewCommand = new Command("preview").description(
       variation = exp.variations.find((v) => !v.is_control) ?? exp.variations[0];
     }
     spinner.stop();
-    const storeUrl = opts?.storeUrl ?? exp.preview_target?.url ?? exp.store_url;
+    const storeUrl = opts?.storeUrl ?? (!variation.is_control && variation.redirect_url?.trim() ? variation.redirect_url : null) ?? exp.preview_target?.url ?? exp.store_url;
     if (!storeUrl) {
       fail(
         previewCommand,
         'Experiment is missing "store_url". Set it on the experiment or pass --store-url <url>.'
       );
     }
+    const snapshot = await getExperimentFilesystem(creds, exp.id).catch(() => null);
+    let qaRun;
+    if (snapshot?.ok && snapshot.data) {
+      const qaFile = snapshot.data.files.find((file) => file.path === "qa.json");
+      if (qaFile) {
+        try {
+          const run3 = JSON.parse(qaFile.content)?.latestRun;
+          if (run3 && typeof run3.id === "string" && run3.id.trim()) qaRun = run3;
+        } catch {
+        }
+      }
+    }
     let previewUrl;
     try {
-      previewUrl = buildQaPreviewUrl2(storeUrl, exp.id, variation.id);
+      previewUrl = buildQaPreviewUrl2(storeUrl, exp.id, variation.id, qaRun?.id);
     } catch {
       fail(
         previewCommand,
         'Invalid store URL. Pass an absolute URL like "https://example.com/products/item".'
       );
     }
+    const signed = await signedPreviewFromReadiness(creds, exp.id, variation.id, storeUrl);
+    const selectedPreviewUrl = signed?.signed_preview_url ?? previewUrl.toString();
+    if (signed?.signed_preview_url) {
+      const signedSessionId = signed.signed_preview_qa_session_id;
+      qaRun = signedSessionId ? qaRun?.id === signedSessionId ? qaRun : { id: signedSessionId } : void 0;
+    }
+    const warning = signed?.signed_preview_url ? null : "Test images may not load on this unsigned link. Open Apex \u2192 QA for a signed link.";
+    if (warning) console.error(warning);
     output(
       previewCommand,
       {
         experimentId: exp.id,
         variationId: variation.id,
-        previewUrl: previewUrl.toString(),
+        previewUrl: selectedPreviewUrl,
+        expiresAt: signed?.signed_preview_expires_at ?? null,
+        ...warning ? { warning } : {},
+        ...qaRun ? { qa_run: qaRun, qa_session_id: qaRun.id } : {},
         ...!opts?.storeUrl && exp.preview_target ? { previewTarget: exp.preview_target } : {}
       },
       () => {
@@ -13205,14 +14177,16 @@ var previewCommand = new Command("preview").description(
           }
         }
         console.log();
-        console.log(source_default.cyan(previewUrl.toString()));
+        console.log(source_default.cyan(selectedPreviewUrl));
+        if (signed?.signed_preview_expires_at)
+          console.log(`Valid until ${signed.signed_preview_expires_at}.`);
         console.log();
       }
     );
     if (opts?.open !== false && !shouldUseJson(previewCommand)) {
       try {
         const open3 = (await Promise.resolve().then(() => (init_open(), open_exports))).default;
-        await open3(previewUrl.toString());
+        await open3(selectedPreviewUrl);
         console.log(source_default.dim("Opened in browser."));
       } catch {
         console.log(source_default.dim("Copy the URL above to preview."));
@@ -14199,9 +15173,7 @@ function commonCookieDomain(hostnames) {
   const suffix = suffixes[0];
   return suffix && suffixes.every((candidate) => candidate === suffix) ? `.${suffix}` : null;
 }
-function defaultManifestPath() {
-  return import_node_path11.default.resolve(process.cwd(), ".apex", "tracking-manifest.json");
-}
+var DEFAULT_MANIFEST_PATH = ".apex/tracking-manifest.json";
 function readManifest(filePath) {
   if (!import_node_fs13.default.existsSync(filePath)) throw new Error(`Manifest not found: ${filePath}`);
   const parsed = JSON.parse(import_node_fs13.default.readFileSync(filePath, "utf8"));
@@ -14277,7 +15249,7 @@ function buildManifest(urlArgs, opts) {
   };
 }
 function manifestPath(input) {
-  return import_node_path11.default.resolve(process.cwd(), input ?? defaultManifestPath());
+  return import_node_path11.default.resolve(process.cwd(), input ?? DEFAULT_MANIFEST_PATH);
 }
 function printManifestPlan(manifest) {
   console.log(source_default.bold("Apex tracking ingestion plan"));
@@ -14305,7 +15277,11 @@ function printManifestPlan(manifest) {
 var trackingCommand = new Command("tracking").description(
   "Create Apex-first tracking ingestion manifests and QA handoffs"
 );
-trackingCommand.command("inspect").description("Create a local tracking manifest from funnel URLs").argument("<urls...>", "Landing, storefront, checkout, or confirmation URLs").option("--shop-id <id>", "Apex shop ID for snippet generation").option("--endpoint <url>", "Apex Worker endpoint", "https://events.drip-apex.com").option("--out <path>", "Manifest output path", defaultManifestPath()).action(function(urls, opts) {
+trackingCommand.command("inspect").description("Create a local tracking manifest from funnel URLs").argument("<urls...>", "Landing, storefront, checkout, or confirmation URLs").option("--shop-id <id>", "Apex shop ID for snippet generation").option("--endpoint <url>", "Apex Worker endpoint", "https://events.drip-apex.com").option(
+  "--out <path>",
+  "Manifest output path, relative to the current directory",
+  DEFAULT_MANIFEST_PATH
+).action(function(urls, opts) {
   const manifest = buildManifest(urls, opts);
   const outPath = manifestPath(opts.out);
   writeManifest(outPath, manifest);
@@ -14321,12 +15297,20 @@ trackingCommand.command("inspect").description("Create a local tracking manifest
     }
   });
 });
-trackingCommand.command("plan").description("Print the implementation plan from a tracking manifest").argument("[manifest]", "Tracking manifest path", defaultManifestPath()).action(function(input) {
+trackingCommand.command("plan").description("Print the implementation plan from a tracking manifest").argument(
+  "[manifest]",
+  "Tracking manifest path, relative to the current directory",
+  DEFAULT_MANIFEST_PATH
+).action(function(input) {
   const filePath = manifestPath(input);
   const manifest = readManifest(filePath);
   output(this, { path: filePath, manifest }, () => printManifestPlan(manifest));
 });
-trackingCommand.command("qa").description("Print the QA checklist for a tracking manifest").argument("[manifest]", "Tracking manifest path", defaultManifestPath()).action(function(input) {
+trackingCommand.command("qa").description("Print the QA checklist for a tracking manifest").argument(
+  "[manifest]",
+  "Tracking manifest path, relative to the current directory",
+  DEFAULT_MANIFEST_PATH
+).action(function(input) {
   const filePath = manifestPath(input);
   const manifest = readManifest(filePath);
   output(this, { path: filePath, checks: manifest.qa.checks }, () => {
@@ -18540,16 +19524,21 @@ async function checkServedConfig(configUrl, workerBaseUrl, workerBaseSource) {
     message: "Worker served a recognized config document for this shop."
   };
 }
-var installCommand = new Command("install").description("Check Apex storefront installation").command("check").description("Verify snippet, served config, and recent tracking for the current shop").option("--url <url>", "Check one explicit bound storefront URL").option("--shop-id <id>", "Apex shop ID to verify (falls back to DRIP_SHOP_ID)").option(
+var installCommand = new Command("install").description("Check Apex storefront installation").command("check").description(
+  "Verify snippet, served config, and recent tracking using --shop-id, the selected shop, or DRIP_SHOP_ID"
+).option("--url <url>", "Check one explicit bound storefront URL").option(
+  "--shop-id <id>",
+  "Apex shop ID to verify (falls back to --shop/apex use, then DRIP_SHOP_ID)"
+).option(
   "--worker-url <url>",
   "Apex Worker base URL that serves /config (defaults to the URL in the served snippet, then DRIP_WORKER_URL, then the production worker)"
 ).option("--environment <key>", "Environment key to request from the worker", "production").action(async function action65(opts) {
   const creds = requireCredentials();
-  const shopId = opts.shopId?.trim() || process.env.DRIP_SHOP_ID?.trim() || null;
+  const shopId = opts.shopId?.trim() || resolveContext(creds).shopId?.trim() || process.env.DRIP_SHOP_ID?.trim() || null;
   if (!shopId)
     fail(
       this,
-      "Shop ID is required: pass --shop-id <id> or set DRIP_SHOP_ID",
+      "Shop ID is required: pass --shop-id <id>, select a shop with --shop <id> or apex use, or set DRIP_SHOP_ID",
       EXIT_CODES.validation,
       { field: "shop-id" }
     );
@@ -19589,6 +20578,7 @@ var test2 = new Command("test").description("Evaluate experiment URL targeting f
 var targetingCommand = new Command("targeting").description("Test experiment targeting").addCommand(test2);
 
 // src/commands/sos.ts
+var import_node_crypto7 = require("node:crypto");
 init_source();
 var import_node_fs24 = __toESM(require("node:fs"));
 var import_node_path21 = __toESM(require("node:path"));
@@ -19630,6 +20620,11 @@ var create4 = new Command("create").description("Create an Apex SOS ticket").opt
   "--type <type>",
   "full_handover|design|development|qa|config|bug|help (internal types require a DRIP account)",
   "qa"
+).option(
+  "--attach <file>",
+  "Attach an image or video (repeatable, maximum 5)",
+  (file, files) => [...files, file],
+  []
 ).option("--loom <url>", "Loom URL with reproduction or QA context").option("--experiment <id>", "Experiment ID").option("--backlog-item <id>", "Backlog item ID (internal SOS only)").option("--sub-class <text>", "SOS sub-classification").option("--description <text-or-@file>", "Description text or @path").argument("[description]", "Description text").action(async function action68(descriptionArg, opts) {
   if (!SOS_TYPES.has(opts.type)) {
     fail(
@@ -19641,16 +20636,76 @@ var create4 = new Command("create").description("Create an Apex SOS ticket").opt
   if (opts.experiment && opts.backlogItem) {
     fail(this, "Provide only one of --experiment or --backlog-item", 3);
   }
+  const mediaTypes = {
+    ".png": "image/png",
+    ".jpg": "image/jpeg",
+    ".jpeg": "image/jpeg",
+    ".webp": "image/webp",
+    ".gif": "image/gif",
+    ".mp4": "video/mp4",
+    ".webm": "video/webm",
+    ".mov": "video/quicktime"
+  };
+  if (opts.attach.length > 5) fail(this, "Attach no more than 5 files", 3);
+  const files = opts.attach.map((file) => {
+    const filename = import_node_path21.default.basename(file);
+    const content_type = mediaTypes[import_node_path21.default.extname(file).toLowerCase()];
+    if (!content_type) fail(this, "Unsupported attachment type", 3);
+    let size;
+    try {
+      size = import_node_fs24.default.statSync(file).size;
+    } catch {
+      fail(this, `Attachment not found: ${file}`, 3);
+    }
+    const cap = (content_type.startsWith("video/") ? 50 : 10) * 1024 * 1024;
+    if (size <= 0 || size > cap) fail(this, "Attachment exceeds its size limit or is empty", 3);
+    let bytes;
+    try {
+      bytes = import_node_fs24.default.readFileSync(file);
+    } catch {
+      fail(this, `Attachment not found: ${file}`, 3);
+    }
+    return { filename, content_type, size, bytes };
+  });
   const creds = requireCredentials();
+  const attachmentPaths = [];
+  const attachmentDigests = [];
+  if (files.length) {
+    const grants = await createSosUploadGrants(
+      creds,
+      files.map(({ filename, content_type, size }) => ({ filename, content_type, size }))
+    );
+    if (!grants.ok || !grants.data)
+      fail(
+        this,
+        grants.error ?? "Failed to get upload grants",
+        classifyStatus(grants.status),
+        grants.errorDetails
+      );
+    if (grants.data.data.uploads.length !== files.length)
+      fail(this, "Invalid upload grant response", 1);
+    for (const [index, file] of files.entries()) {
+      const grant = grants.data.data.uploads[index];
+      const bytes = file.bytes;
+      await uploadSosAttachment(grant.signed_url, file.content_type, bytes);
+      attachmentPaths.push(grant.path);
+      attachmentDigests.push((0, import_node_crypto7.createHash)("sha256").update(bytes).digest("hex"));
+    }
+  }
   const description = readText(opts.description) ?? descriptionArg ?? `Apex CLI ${opts.type} SOS request${opts.loom ? ` with Loom evidence: ${opts.loom}` : "."}`;
-  const res = await createSos(creds, {
-    type: opts.type,
-    description,
-    experiment_id: opts.experiment ?? null,
-    backlog_item_id: opts.backlogItem ?? null,
-    sub_class: opts.subClass ?? null,
-    loom_url: opts.loom ?? null
-  });
+  const res = await createSos(
+    creds,
+    {
+      ...attachmentPaths.length ? { attachment_paths: attachmentPaths } : {},
+      type: opts.type,
+      description,
+      experiment_id: opts.experiment ?? null,
+      backlog_item_id: opts.backlogItem ?? null,
+      sub_class: opts.subClass ?? null,
+      loom_url: opts.loom ?? null
+    },
+    { attachmentDigests }
+  );
   if (!res.ok || !res.data) {
     fail(
       this,
@@ -19955,6 +21010,7 @@ function optionSchema(option) {
     description: option.description,
     required: option.required,
     optional: option.optional,
+    mandatory: Boolean(option.mandatory),
     variadic: option.variadic,
     ...option.defaultValue === void 0 ? {} : { defaultValue: option.defaultValue }
   };
@@ -19977,8 +21033,17 @@ function commandSchema(command) {
   };
 }
 function createSchemaCommand(program3) {
-  return new Command("schema").description("Print the current Apex CLI command and flag schema").option("--json", "Print JSON schema").action(function action78() {
-    const schema = commandSchema(program3);
+  return new Command("schema").description("Print the current Apex CLI command, flag, and mandatory-option schema").option("--json", "Print JSON schema").action(function action78() {
+    const schema = {
+      schemaVersion: 2,
+      contract: {
+        optionValueArity: "Options' required and optional fields describe whether the option's value is required or optional when the flag is given.",
+        mandatoryOptions: "An option's mandatory field is true only when the flag itself must be passed.",
+        requiredArguments: "An argument's required field means the positional is mandatory."
+      },
+      ...commandSchema(program3),
+      files: experiment_filesystem_schema_default
+    };
     output(this, schema, () => {
       process.stdout.write(`${JSON.stringify(schema, null, 2)}
 `);
@@ -20618,7 +21683,15 @@ var skillsCommand = new Command("skills").description("Print or install the Apex
   });
 });
 
+// ../../ops/org-split/move-plan.mjs
+var uuid = /^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$/;
+function validateMoveInput(shopIds, toOrgId) {
+  if (typeof toOrgId !== "string" || !uuid.test(toOrgId) || !Array.isArray(shopIds) || !shopIds.length || shopIds.some((id) => typeof id !== "string" || !uuid.test(id))) throw new Error("Choose valid store and destination UUIDs");
+  return { shopIds: [...new Set(shopIds.map((id) => id.toLowerCase()))].sort(), toOrgId: toOrgId.toLowerCase() };
+}
+
 // src/commands/admin.ts
+var uuid2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 function switchValue(value) {
   if (value === "on") return true;
   if (value === "off") return false;
@@ -20745,8 +21818,7 @@ var create6 = new Command("create").description("Create an internal, demo or dog
     fail(this, "--name must be 1 to 60 characters", 3);
   if (opts.reason.trim().length < 8 || opts.reason.trim().length > 500)
     fail(this, "--reason must be 8 to 500 characters", 3);
-  const uuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
-  if (opts.claimShop && !uuid.test(opts.claimShop)) fail(this, "--claim-shop must be a UUID", 3);
+  if (opts.claimShop && !uuid2.test(opts.claimShop)) fail(this, "--claim-shop must be a UUID", 3);
   if (opts.claimShop && (opts.domain || opts.platform))
     fail(this, "Use --claim-shop or --domain with --platform", 3);
   if (!!opts.domain !== !!opts.platform)
@@ -20767,7 +21839,7 @@ var create6 = new Command("create").description("Create an internal, demo or dog
     fail(this, "--owner requires a store for the invitation", 3);
   if (opts.plan !== "self_managed" && (!opts.consultant || !opts.consultantTitle?.trim()))
     fail(this, "Managed plans require --consultant and --consultant-title", 3);
-  if (opts.consultant && !uuid.test(opts.consultant))
+  if (opts.consultant && !uuid2.test(opts.consultant))
     fail(this, "--consultant must be a platform access UUID", 3);
   if (!!opts.consultant !== !!opts.consultantTitle?.trim())
     fail(this, "Provide --consultant and --consultant-title together", 3);
@@ -20831,14 +21903,169 @@ var create6 = new Command("create").description("Create an internal, demo or dog
       );
   });
 });
-var customers = new Command("customers").description("Create engineering accounts; customer accounts use Admin, Links").addCommand(create6);
+var setCategory = new Command("set-category").description("Change an existing account's category with an audit reason").argument("<org-id>", "Organization UUID").requiredOption("--category <category>", "internal, demo, dogfood or customer").requiredOption("--reason <text>", "Audit reason, 8 to 500 characters").option("--confirm", "Confirm category change").option("--json", "Output JSON").action(async function(orgId, opts) {
+  if (!uuid2.test(orgId)) fail(this, "<org-id> must be a UUID", 3);
+  if (!["internal", "demo", "dogfood", "customer"].includes(opts.category))
+    fail(this, "--category must be internal, demo, dogfood or customer", 3);
+  const reason2 = opts.reason.trim();
+  if (reason2.length < 8 || reason2.length > 500)
+    fail(this, "--reason must be 8 to 500 characters", 3);
+  if (!opts.confirm) {
+    const quote = (value) => `'${value.replaceAll("'", "'\\''")}'`;
+    confirmationRequired(
+      this,
+      "--confirm is required to change an account category",
+      `apex admin customers set-category ${orgId} --category ${quote(opts.category)} --reason ${quote(reason2)} --confirm`
+    );
+  }
+  const body5 = {
+    category: opts.category,
+    reason: reason2
+  };
+  const res = await setAdminCustomerCategory(requireUserCredentials(), orgId, body5);
+  if (!res.ok || !res.data)
+    fail(
+      this,
+      res.error ?? "Failed to change account category",
+      classifyStatus(res.status),
+      res.errorDetails
+    );
+  output(this, res.data, () => {
+    const result = res.data.data;
+    printTable(["RESULT"], [[`Customer ${result.customerId} moved to ${result.category}`]]);
+  });
+});
+var setManagedBy = new Command("set-managed-by").description("Assign or clear a managing agency with an audit reason").argument("<org-id>", "Organization UUID").option("--by <org-id>", "Managing agency UUID").option("--clear", "Clear the managing agency").requiredOption("--reason <text>", "Audit reason, 8 to 500 characters").option("--confirm", "Confirm manager change").option("--json", "Output JSON").action(async function(orgId, opts) {
+  if (!uuid2.test(orgId)) fail(this, "<org-id> must be a UUID", 3);
+  if (!!opts.by === !!opts.clear) fail(this, "Use exactly one of --by or --clear", 3);
+  if (opts.by && !uuid2.test(opts.by)) fail(this, "--by must be a UUID", 3);
+  const reason2 = opts.reason.trim();
+  if (reason2.length < 8 || reason2.length > 500)
+    fail(this, "--reason must be 8 to 500 characters", 3);
+  if (!opts.confirm) {
+    const quote = (value) => `'${value.replaceAll("'", "'\\''")}'`;
+    confirmationRequired(
+      this,
+      "--confirm is required to change a managing agency",
+      `apex admin customers set-managed-by ${orgId} ${opts.by ? `--by ${opts.by}` : "--clear"} --reason ${quote(reason2)} --confirm`
+    );
+  }
+  const res = await setAdminCustomerManagedBy(requireUserCredentials(), orgId, {
+    managed_by_org_id: opts.by ?? null,
+    reason: reason2
+  });
+  if (!res.ok || !res.data)
+    fail(
+      this,
+      res.error ?? "Failed to change managing agency",
+      classifyStatus(res.status),
+      res.errorDetails
+    );
+  output(
+    this,
+    res.data,
+    () => printTable(
+      ["CUSTOMER", "MANAGING AGENCY"],
+      [[res.data.data.customerId, res.data.data.managed_by_org_id ?? "None"]]
+    )
+  );
+});
+var setWorkspaceType = new Command("set-workspace-type").description("Change a workspace type with an audit reason").argument("<org-id>", "Organization UUID").requiredOption("--type <company|agency>", "Workspace type").requiredOption("--reason <text>", "Audit reason, 8 to 500 characters").option("--confirm", "Confirm workspace type change").option("--json", "Output JSON").action(async function(orgId, opts) {
+  if (!uuid2.test(orgId)) fail(this, "<org-id> must be a UUID", 3);
+  if (opts.type !== "company" && opts.type !== "agency")
+    fail(this, "--type must be company or agency", 3);
+  const reason2 = opts.reason.trim();
+  if (reason2.length < 8 || reason2.length > 500)
+    fail(this, "--reason must be 8 to 500 characters", 3);
+  if (!opts.confirm) {
+    const quote = (value) => `'${value.replaceAll("'", "'\\''")}'`;
+    confirmationRequired(
+      this,
+      "--confirm is required to change a workspace type",
+      `apex admin customers set-workspace-type ${orgId} --type ${opts.type} --reason ${quote(reason2)} --confirm`
+    );
+  }
+  const res = await setAdminCustomerWorkspaceType(requireUserCredentials(), orgId, {
+    workspace_type: opts.type,
+    reason: reason2
+  });
+  if (!res.ok || !res.data)
+    fail(
+      this,
+      res.error ?? "Failed to change workspace type",
+      classifyStatus(res.status),
+      res.errorDetails
+    );
+  output(
+    this,
+    res.data,
+    () => printTable(
+      ["CUSTOMER", "WORKSPACE TYPE"],
+      [[res.data.data.customerId, res.data.data.workspace_type]]
+    )
+  );
+});
+function storeMoveRequest(opts) {
+  const { shopIds, toOrgId } = validateMoveInput(opts.shop, opts.to);
+  const reason2 = opts.reason.trim();
+  if (reason2.length < 8 || reason2.length > 500)
+    throw new Error("--reason must be 8 to 500 characters");
+  return {
+    toOrgId,
+    body: {
+      shop_ids: shopIds,
+      reason: reason2,
+      keep_grants: !!opts.keepGrants,
+      dry_run: !opts.confirm
+    }
+  };
+}
+var moveStores = new Command("move-stores").description("Preview or confirm an audited set of store moves").requiredOption("--to <org-id>", "Destination organization UUID").requiredOption(
+  "--shop <shop-id>",
+  "Store UUID, repeat for each store",
+  (value, previous) => [...previous, value],
+  []
+).requiredOption("--reason <text>", "Audit reason, 8 to 500 characters").option("--keep-grants", "Preserve explicit store roles and overrides").option("--confirm", "Perform the move; otherwise return a read-only plan").option("--json", "Output JSON").action(async function(opts) {
+  let request2;
+  try {
+    request2 = storeMoveRequest(opts);
+  } catch (error) {
+    fail(this, error instanceof Error ? error.message : "Invalid move request", 3);
+  }
+  const res = await moveAdminCustomerStores(
+    requireUserCredentials(),
+    request2.toOrgId,
+    request2.body
+  );
+  if (!res.ok || !res.data)
+    fail(
+      this,
+      res.error ?? "Failed to move stores",
+      classifyStatus(res.status),
+      res.errorDetails
+    );
+  output(this, res.data, () => {
+    printTable(
+      ["FIELD", "VALUE"],
+      Object.entries(res.data.data).map(([key, value]) => [key, JSON.stringify(value)])
+    );
+  });
+});
+var customers = new Command("customers").description("Create engineering accounts and manage existing account categories").addCommand(create6).addCommand(setCategory).addCommand(setManagedBy).addCommand(setWorkspaceType).addCommand(moveStores);
 var adminCommand = new Command("admin").description("Operate allowlisted platform controls").addCommand(settingsGet).addCommand(quarantine).addCommand(shops).addCommand(customers);
 
 // src/commands/membership.ts
 init_source();
 async function run2(c, p, label) {
   const r = await p;
-  if (!r.ok) fail(c, r.error ?? `Failed to ${label}`, classifyStatus(r.status), r.errorDetails);
+  if (!r.ok)
+    fail(
+      c,
+      r.error ?? `Failed to ${label}`,
+      classifyStatus(r.status),
+      r.errorDetails,
+      apiFailureOf(r)
+    );
   output(c, r.data ?? {}, () => process.stdout.write(`${JSON.stringify(r.data, null, 2)}
 `));
 }
@@ -20874,7 +22101,27 @@ orgCommand.command("update").option("--name <name>").option("--slug <slug>").opt
   );
 });
 orgCommand.command("members").action(async function() {
-  await run2(this, listOrgMembers(requireUserCredentials()), "list members");
+  const r = await listOrgMembers(requireUserCredentials());
+  if (!r.ok)
+    fail(
+      this,
+      r.error ?? "Failed to list members",
+      classifyStatus(r.status),
+      r.errorDetails,
+      apiFailureOf(r)
+    );
+  const rows = r.data?.data ?? [];
+  output(this, r.data ?? {}, () => {
+    printTable(
+      ["ID", "MEMBER", "ROLE", "SUSPENDED"],
+      rows.map((row) => [
+        String(row.id),
+        String(row.email ?? row.name ?? "-"),
+        String(row.role),
+        String(row.suspended_at ?? "-")
+      ])
+    );
+  });
 });
 orgCommand.command("invite").argument("<email>").option("--role <role>", "Alias for --org-role").option("--org-role <role>", "Organization role", "member").addOption(
   new Option(
@@ -20911,6 +22158,26 @@ orgCommand.command("set-role").argument("<memberId>").argument("<role>").option(
     "set role"
   );
 });
+orgCommand.command("suspend-member").argument("<memberId>").option("--reason <text>").option("-f, --force").action(async function(id, o) {
+  if (!await confirm(
+    this,
+    o.force,
+    `Suspend organization member ${id}`,
+    `apex org suspend-member ${id} --force`
+  ))
+    return;
+  await run2(this, suspendOrgMember(requireUserCredentials(), id, o.reason), "suspend member");
+});
+orgCommand.command("reinstate-member").argument("<memberId>").option("-f, --force").action(async function(id, o) {
+  if (!await confirm(
+    this,
+    o.force,
+    `Reinstate organization member ${id}`,
+    `apex org reinstate-member ${id} --force`
+  ))
+    return;
+  await run2(this, reinstateOrgMember(requireUserCredentials(), id), "reinstate member");
+});
 orgCommand.command("remove-member").argument("<memberId>").option("-f, --force").action(async function(id, o) {
   if (!await confirm(
     this,
@@ -21568,7 +22835,7 @@ var import_node_fs29 = __toESM(require("node:fs"));
 var import_node_path26 = __toESM(require("node:path"));
 
 // src/commands/landing-pages.ts
-var import_node_crypto7 = __toESM(require("node:crypto"));
+var import_node_crypto8 = __toESM(require("node:crypto"));
 var import_node_fs28 = __toESM(require("node:fs"));
 var import_node_path25 = __toESM(require("node:path"));
 function apiFailure(command, response, fallback2) {
@@ -21582,7 +22849,7 @@ function apiFailure(command, response, fallback2) {
   }
 }
 function sha256(body5) {
-  return import_node_crypto7.default.createHash("sha256").update(body5).digest("hex");
+  return import_node_crypto8.default.createHash("sha256").update(body5).digest("hex");
 }
 function markerPath(folder) {
   return import_node_path25.default.join(folder, LANDING_PAGE_CHECKOUT_MARKER);
@@ -21910,7 +23177,10 @@ async function pullCheckout(command, creds, id, folder, force = false) {
     notes: listing.data.notes ?? []
   };
 }
-var create9 = new Command("create").description("Create a landing page to build outside Apex").requiredOption("--name <name>", "Page name").option("--slug <slug>", "URL slug (default: from the name)").option("--idea <key>", "Idea key or id the page is built for").option("--out <folder>", "Also pull the new page into this folder").action(async function(opts) {
+var create9 = new Command("create").description("Create a landing page to build outside Apex").requiredOption("--name <name>", "Page name").option(
+  "--slug <slug>",
+  "URL slug (default: from the name; -2, -3 added only if the shop already uses it)"
+).option("--idea <key>", "Idea key or id the page is built for").option("--out <folder>", "Also pull the new page into this folder").action(async function(opts) {
   const creds = requireCredentials();
   const created = await landingPages(creds).create({
     name: opts.name,
@@ -22405,6 +23675,35 @@ program2.hook("preAction", (_thisCommand, actionCommand) => {
 process.on("beforeExit", () => {
   flushFallbackEnvelope();
 });
-maybeCheckForUpdate().then(() => program2.parseAsync(process.argv)).then(async () => {
+function isExplicitJsonVersionRequest(args) {
+  let hasJson = false;
+  let hasVersion = false;
+  for (let index = 0; index < args.length; index++) {
+    const arg = args[index];
+    if (arg === "--") break;
+    if (arg === "--json") {
+      hasJson = true;
+    } else if (arg === "--version" || arg === "-V") {
+      hasVersion = true;
+    } else if (arg === "--org" || arg === "--shop") {
+      const value = args[++index];
+      if (!value || value.startsWith("-")) return false;
+    } else if (arg.startsWith("--org=") || arg.startsWith("--shop=")) {
+      const value = arg.slice(arg.indexOf("=") + 1);
+      if (!value || value.startsWith("-")) return false;
+    } else {
+      return false;
+    }
+  }
+  return hasJson && hasVersion;
+}
+var explicitJsonVersionRequest = isExplicitJsonVersionRequest(process.argv.slice(2));
+maybeCheckForUpdate().then(() => {
+  if (explicitJsonVersionRequest) {
+    writeEnvelope({ name: "@drip-apex/apex-cli", version: CLI_VERSION }, "version");
+    return;
+  }
+  return program2.parseAsync(process.argv);
+}).then(async () => {
   await finishInvocation({ exitCode: process.exitCode ?? 0 });
 }).catch((err) => handleCliError(err, program2));