@drip-apex/apex-cli 0.2.0 → 0.2.1

package/README.md

@@ -28,6 +28,9 @@ DRIP_API_KEY=apx_your_key_here apex experiments list --json
 
 ```bash
 apex experiments list
+apex experiments create --name "Redirect test" --type redirect \
+  --source-url "https://shop.example/products/source" \
+  --destination "https://landing.example/products/treatment"
 apex experiments pull <id-or-slug> --dir ./my-test
 apex experiments plan ./my-test --json
 apex experiments apply ./my-test --json

package/dist/cli.js

@@ -6743,16 +6743,16 @@ __export(ora_exports, {
 function ora(options) {
   return new Ora(options);
 }
-async function oraPromise(action24, options) {
-  const actionIsFunction = typeof action24 === "function";
-  const actionIsPromise = typeof action24.then === "function";
+async function oraPromise(action25, options) {
+  const actionIsFunction = typeof action25 === "function";
+  const actionIsPromise = typeof action25.then === "function";
   if (!actionIsFunction && !actionIsPromise) {
     throw new TypeError("Parameter `action` must be a Function or a Promise");
   }
   const { successText, failText } = typeof options === "object" ? options : { successText: void 0, failText: void 0 };
   const spinner = ora(options).start();
   try {
-    const promise = actionIsFunction ? action24(spinner) : action24;
+    const promise = actionIsFunction ? action25(spinner) : action25;
     const result = await promise;
     spinner.succeed(
       successText === void 0 ? void 0 : typeof successText === "string" ? successText : successText(result)
@@ -7090,7 +7090,7 @@ init_source();
 
 // src/commands/login.ts
 init_source();
-var import_node_crypto = __toESM(require("node:crypto"));
+var import_node_crypto2 = __toESM(require("node:crypto"));
 var import_node_http = __toESM(require("node:http"));
 var import_node_os4 = __toESM(require("node:os"));
 var import_node_readline = __toESM(require("node:readline"));
@@ -7356,6 +7356,7 @@ function findConfigPath() {
 }
 
 // src/api.ts
+var import_node_crypto = require("node:crypto");
 var mockEnvironmentPatchAttempts = 0;
 var mockEnvironmentReads = 0;
 function extractErrorMessage(json, status2) {
@@ -7484,6 +7485,45 @@ function mockResponse(method, path20, body5) {
   if (process.env.APEX_CLI_MOCK_API !== "1") return null;
   const url = new URL(path20, "https://mock.apex.local");
   const exp = mockExperiment();
+  if (method === "GET" && url.pathname === `/api/v1/experiments/${exp.id}/filesystem`) {
+    const fixtures = [
+      ["experiment.json", '{"schemaVersion":1,"name":"Fixture Test"}\n'],
+      ["targeting.json", '{"url":[],"segments":[]}\n'],
+      ["experiment/index.js", "window.__apexExperiment = true;\n"],
+      ["experiment/reset.js", "delete window.__apexExperiment;\n"],
+      ["experiment/index.css", ".apex-experiment { display: block; }\n"],
+      ["metrics.json", '{"primary":null,"secondary":[]}\n'],
+      ["qa.json", '{"status":"pending"}\n'],
+      ["launch.json", '{"status":"draft"}\n'],
+      ["variations/control/variation.json", '{"slug":"control","isControl":true}\n'],
+      ["variations/control/mutations.json", "[]\n"],
+      ["variations/control/index.css", ".control { color: inherit; }\n"],
+      ["variations/control/index.js", "window.__apexControl = true;\n"],
+      ["variations/control/reset.js", "delete window.__apexControl;\n"],
+      ["variations/control/anti-flicker.json", "[]\n"]
+    ];
+    const invalidPaths = {
+      invalid: "../secret",
+      traversal: "variations/../../x",
+      absolute: "/abs/path"
+    };
+    const invalidPath = invalidPaths[process.env.APEX_CLI_MOCK_FILESYSTEM_PATHS ?? ""];
+    if (invalidPath) {
+      fixtures.push([invalidPath, "must not be written\n"]);
+    }
+    return {
+      ok: true,
+      status: 200,
+      data: {
+        rootName: "fixture-test",
+        files: fixtures.map(([filePath, content]) => ({
+          path: filePath,
+          content,
+          sha256: (0, import_node_crypto.createHash)("sha256").update(content).digest("hex")
+        }))
+      }
+    };
+  }
   const configMatch = url.pathname.match(
     /^\/api\/v1\/(assets|landing-pages)(?:\/([^/]+))?$/
   );
@@ -7663,16 +7703,16 @@ function mockResponse(method, path20, body5) {
     /^\/api\/v1\/(flags|personalizations)(?:\/([^/]+))?(?:\/(activate|pause|archive|status))?$/
   );
   if (managedMatch) {
-    const [, kind5, id = `${kind5.slice(0, -1)}_1`, action24] = managedMatch;
+    const [, kind5, id = `${kind5.slice(0, -1)}_1`, action25] = managedMatch;
     const input = body5 ?? {};
     const item = {
       id,
       key: String(input.key ?? `fixture-${kind5.slice(0, -1)}`),
       name: String(input.name ?? `Fixture ${kind5.slice(0, -1)}`),
-      status: action24 === "activate" ? "active" : action24 === "pause" ? "paused" : action24 === "archive" ? "archived" : "draft",
+      status: action25 === "activate" ? "active" : action25 === "pause" ? "paused" : action25 === "archive" ? "archived" : "draft",
       updated_at: "2026-07-19T00:00:00.000Z"
     };
-    if (kind5 === "flags" && action24 === "status")
+    if (kind5 === "flags" && action25 === "status")
       return {
         ok: true,
         status: 200,
@@ -7705,11 +7745,11 @@ function mockResponse(method, path20, body5) {
     /^\/api\/v1\/(backlog|signals)(?:\/([^/]+))?(?:\/(archive|restore))?$/
   );
   if (insightMatch) {
-    const [, kind5, id = `${kind5}_1`, action24] = insightMatch;
+    const [, kind5, id = `${kind5}_1`, action25] = insightMatch;
     const input = body5 ?? {};
-    if (action24 && (kind5 !== "backlog" || method !== "POST"))
-      return { ok: false, status: 405, error: `${action24} requires POST` };
-    const archived = action24 === "archive" || method === "DELETE" || url.searchParams.get("include_archived") === "true";
+    if (action25 && (kind5 !== "backlog" || method !== "POST"))
+      return { ok: false, status: 405, error: `${action25} requires POST` };
+    const archived = action25 === "archive" || method === "DELETE" || url.searchParams.get("include_archived") === "true";
     const item = {
       id,
       ...kind5 === "backlog" ? {
@@ -7735,7 +7775,7 @@ function mockResponse(method, path20, body5) {
       return { ok: true, status: 200, data: { ok: true } };
     return {
       ok: true,
-      status: method === "POST" && !action24 ? 201 : 200,
+      status: method === "POST" && !action25 ? 201 : 200,
       data: item
     };
   }
@@ -7749,6 +7789,38 @@ function mockResponse(method, path20, body5) {
       }
     };
   }
+  if (method === "POST" && url.pathname === "/api/v1/experiments") {
+    const input = body5 ?? {};
+    if (input.experiment_type === "redirect" && process.env.APEX_CLI_MOCK_REDIRECT_DISABLED === "1") {
+      return {
+        ok: false,
+        status: 403,
+        error: "Redirect tests are not enabled for this shop"
+      };
+    }
+    const requestedVariations = Array.isArray(input.variations) ? input.variations : exp.variations ?? [];
+    return {
+      ok: true,
+      status: 201,
+      data: {
+        ...exp,
+        name: String(input.name ?? exp.name),
+        slug: typeof input.slug === "string" || input.slug === null ? input.slug : exp.slug,
+        experiment_type: input.experiment_type === "redirect" ? "redirect" : "mutation",
+        traffic_allocation: typeof input.traffic_allocation === "number" ? input.traffic_allocation : exp.traffic_allocation,
+        store_url: typeof input.store_url === "string" ? input.store_url : null,
+        targeting: input.targeting ?? null,
+        variations: requestedVariations.map((variation, index) => ({
+          id: `00000000-0000-4000-8000-${String(index + 1).padStart(12, "0")}`,
+          name: String(variation.name ?? `Variation ${index + 1}`),
+          weight: typeof variation.weight === "number" ? variation.weight : 0,
+          is_control: variation.is_control === true,
+          redirect_url: typeof variation.redirect_url === "string" ? variation.redirect_url : null,
+          mutations: []
+        }))
+      }
+    };
+  }
   if (method === "GET" && (url.pathname === `/api/v1/experiments/${exp.id}` || url.pathname === `/api/v1/experiments/by-slug/${exp.slug}`)) {
     return { ok: true, status: 200, data: exp };
   }
@@ -7822,6 +7894,7 @@ function mockResponse(method, path20, body5) {
         }
       };
     }
+    const observedPaths = files.map((file) => file.path).filter((filePath) => typeof filePath === "string");
     return {
       ok: true,
       status: 200,
@@ -7841,7 +7914,8 @@ function mockResponse(method, path20, body5) {
         errors: [],
         warnings: [],
         invalidatesQa: false,
-        precompileRequired: false
+        precompileRequired: false,
+        ...process.env.APEX_CLI_MOCK_FILESYSTEM_PLAN === "echo-paths" ? { observedPaths } : {}
       }
     };
   }
@@ -8497,8 +8571,8 @@ function requestTargetingResource(creds2, method, kind5, id, body5, limit, curso
   const path20 = `/api/v1/${kind5}${id ? `/${id.split("/").map(encodeURIComponent).join("/")}` : ""}${query ? `?${query}` : ""}`;
   return request(creds2, method, path20, body5);
 }
-function managedPath(kind5, id, action24) {
-  return `/api/v1/${kind5}${id ? `/${encodeURIComponent(id)}` : ""}${action24 ? `/${action24}` : ""}`;
+function managedPath(kind5, id, action25) {
+  return `/api/v1/${kind5}${id ? `/${encodeURIComponent(id)}` : ""}${action25 ? `/${action25}` : ""}`;
 }
 function listManagedDeliveries(creds2, kind5, limit) {
   const q = limit ? `?limit=${limit}` : "";
@@ -8520,8 +8594,8 @@ function createManagedDelivery(creds2, kind5, body5) {
 function updateManagedDelivery(creds2, kind5, id, body5) {
   return request(creds2, "PATCH", managedPath(kind5, id), body5);
 }
-function transitionManagedDelivery(creds2, kind5, id, action24) {
-  return request(creds2, "POST", managedPath(kind5, id, action24));
+function transitionManagedDelivery(creds2, kind5, id, action25) {
+  return request(creds2, "POST", managedPath(kind5, id, action25));
 }
 function listConfigResources(creds2, family, opts) {
   const params = new URLSearchParams();
@@ -8784,7 +8858,7 @@ function parseFormBody(body5) {
   return new URLSearchParams(body5);
 }
 async function waitForBrowserLogin(baseUrl, userMode = false) {
-  const state = import_node_crypto.default.randomBytes(24).toString("base64url");
+  const state = import_node_crypto2.default.randomBytes(24).toString("base64url");
   const clientName = import_node_os4.default.hostname() || "Local machine";
   return new Promise((resolve, reject) => {
     let settled = false;
@@ -9013,7 +9087,7 @@ var whoamiCommand = new Command("whoami").description("Show current authenticati
 
 // src/commands/experiments.ts
 init_source();
-var import_node_crypto2 = __toESM(require("node:crypto"));
+var import_node_crypto3 = __toESM(require("node:crypto"));
 var import_node_fs6 = __toESM(require("node:fs"));
 var import_node_path4 = __toESM(require("node:path"));
 function formatDate(iso) {
@@ -9084,9 +9158,25 @@ function printExperimentResults(results2) {
   }
   console.log();
 }
-var FILESYSTEM_FILE_RE = /^(experiment\.json|targeting\.json|metrics\.json|qa\.json|launch\.json|variations\/[^/]+\/(?:variation\.json|mutations\.json|index\.css|index\.js|reset\.js|anti-flicker\.json))$/;
+var EXPERIMENT_FILESYSTEM_PATH_SCHEMA = {
+  topLevel: ["experiment.json", "targeting.json", "metrics.json", "qa.json", "launch.json"],
+  experiment: ["index.css", "index.js", "reset.js"],
+  variation: [
+    "variation.json",
+    "mutations.json",
+    "index.css",
+    "index.js",
+    "reset.js",
+    "anti-flicker.json"
+  ]
+};
+var escapeRegex = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+var pathAlternation = (paths) => paths.map(escapeRegex).join("|");
+var FILESYSTEM_FILE_RE = new RegExp(
+  `^(?:${pathAlternation(EXPERIMENT_FILESYSTEM_PATH_SCHEMA.topLevel)}|experiment/(?:${pathAlternation(EXPERIMENT_FILESYSTEM_PATH_SCHEMA.experiment)})|variations/[^/]+/(?:${pathAlternation(EXPERIMENT_FILESYSTEM_PATH_SCHEMA.variation)}))$`
+);
 function sha256Text(value) {
-  return import_node_crypto2.default.createHash("sha256").update(value).digest("hex");
+  return import_node_crypto3.default.createHash("sha256").update(value).digest("hex");
 }
 function folderPath(folder) {
   return import_node_path4.default.resolve(process.cwd(), folder);
@@ -9126,8 +9216,12 @@ function validateFilesystemPath(relativePath) {
   return normalized;
 }
 function writeExperimentFilesystemFiles(folder, files) {
-  for (const file of files) {
-    const relativePath = validateFilesystemPath(file.path);
+  const validatedFiles = files.map((file) => ({
+    ...file,
+    relativePath: validateFilesystemPath(file.path)
+  }));
+  for (const file of validatedFiles) {
+    const relativePath = file.relativePath;
     const absPath = import_node_path4.default.join(folder, relativePath);
     import_node_fs6.default.mkdirSync(import_node_path4.default.dirname(absPath), { recursive: true });
     import_node_fs6.default.writeFileSync(absPath, file.content, "utf8");
@@ -9135,26 +9229,25 @@ function writeExperimentFilesystemFiles(folder, files) {
 }
 function listExperimentFilesystemFiles(folder) {
   const files = [];
-  const topLevel = ["experiment.json", "targeting.json", "metrics.json", "qa.json", "launch.json"];
-  for (const fileName of topLevel) {
+  for (const fileName of EXPERIMENT_FILESYSTEM_PATH_SCHEMA.topLevel) {
     const absPath = import_node_path4.default.join(folder, fileName);
     if (!import_node_fs6.default.existsSync(absPath)) continue;
     const content = import_node_fs6.default.readFileSync(absPath, "utf8");
     files.push({ path: fileName, content, sha256: sha256Text(content) });
   }
+  for (const fileName of EXPERIMENT_FILESYSTEM_PATH_SCHEMA.experiment) {
+    const relativePath = `experiment/${fileName}`;
+    const absPath = import_node_path4.default.join(folder, relativePath);
+    if (!import_node_fs6.default.existsSync(absPath)) continue;
+    const content = import_node_fs6.default.readFileSync(absPath, "utf8");
+    files.push({ path: relativePath, content, sha256: sha256Text(content) });
+  }
   const variationsRoot = import_node_path4.default.join(folder, "variations");
   if (import_node_fs6.default.existsSync(variationsRoot)) {
     for (const variationDir of import_node_fs6.default.readdirSync(variationsRoot, { withFileTypes: true })) {
       if (!variationDir.isDirectory()) continue;
       const base = import_node_path4.default.join(variationsRoot, variationDir.name);
-      for (const fileName of [
-        "variation.json",
-        "mutations.json",
-        "index.css",
-        "index.js",
-        "reset.js",
-        "anti-flicker.json"
-      ]) {
+      for (const fileName of EXPERIMENT_FILESYSTEM_PATH_SCHEMA.variation) {
         const absPath = import_node_path4.default.join(base, fileName);
         if (!import_node_fs6.default.existsSync(absPath)) continue;
         const relativePath = validateFilesystemPath(
@@ -9365,23 +9458,134 @@ var results = new Command("results").description("Read experiment results and ti
     fail(this, error instanceof Error ? error.message : String(error));
   }
 });
-var create = new Command("create").description("Create a new experiment").requiredOption("--name <name>", "Experiment name").option("--slug <slug>", "URL-safe slug for GitOps").option("--description <desc>", "Description").option("--traffic <pct>", "Traffic allocation (0-100)", "100").action(async (opts) => {
+function collectCreateOption(value, previous) {
+  return [...previous, value];
+}
+function parseHttpDestination(value) {
+  const trimmed = value.trim();
+  try {
+    const url = new URL(trimmed);
+    if (url.protocol !== "http:" && url.protocol !== "https:") throw new Error();
+  } catch {
+    throw new CliError(
+      `Invalid redirect destination "${value}": expected an HTTP(S) URL.`,
+      EXIT_CODES.validation
+    );
+  }
+  return trimmed;
+}
+function sourceStoreUrl(sourceRules) {
+  for (const rule of sourceRules) {
+    if (rule.includes("*")) continue;
+    try {
+      const url = new URL(rule);
+      if (url.protocol === "http:" || url.protocol === "https:") {
+        return rule;
+      }
+    } catch {
+    }
+  }
+  return null;
+}
+var create = new Command("create").description("Create a new experiment").requiredOption("--name <name>", "Experiment name").option("--slug <slug>", "URL-safe slug for GitOps").option("--description <desc>", "Description").option("--type <type>", "Experiment type: mutation or redirect", "mutation").option(
+  "--source-url <pattern>",
+  "Positive source URL rule (repeatable; accepts exact URLs, paths, or wildcards)",
+  collectCreateOption,
+  []
+).option(
+  "--destination <url>",
+  "Redirect treatment destination (repeatable; creates one treatment per URL)",
+  collectCreateOption,
+  []
+).option("--traffic <pct>", "Traffic allocation (0-100)", "100").action(async function action7(opts) {
+  if (opts.type !== "mutation" && opts.type !== "redirect") {
+    fail(
+      this,
+      "--type must be mutation or redirect",
+      EXIT_CODES.validation
+    );
+  }
+  const traffic = Number(opts.traffic);
+  if (!Number.isFinite(traffic) || traffic < 0 || traffic > 100) {
+    fail(
+      this,
+      "--traffic must be a number from 0 to 100",
+      EXIT_CODES.validation
+    );
+  }
+  const sourceRules = opts.sourceUrl.map((value) => value.trim());
+  if (sourceRules.some((value) => value.length === 0)) {
+    fail(this, "--source-url cannot be empty", EXIT_CODES.validation);
+  }
+  if (opts.type !== "redirect" && opts.destination.length > 0) {
+    fail(
+      this,
+      "--destination is only valid with --type redirect",
+      EXIT_CODES.validation
+    );
+  }
+  if (opts.type === "redirect" && sourceRules.length === 0) {
+    fail(
+      this,
+      "Redirect experiments require at least one --source-url rule",
+      EXIT_CODES.validation
+    );
+  }
+  if (opts.type === "redirect" && opts.destination.length === 0) {
+    fail(
+      this,
+      "Redirect experiments require at least one --destination URL",
+      EXIT_CODES.validation
+    );
+  }
+  const destinations = opts.destination.map(parseHttpDestination);
+  const armWeight = destinations.length > 0 ? 1 / (destinations.length + 1) : null;
   const creds2 = requireCredentials();
   const ora2 = (await Promise.resolve().then(() => (init_ora(), ora_exports))).default;
-  const spinner = ora2("Creating experiment...").start();
+  const spinner = process.stderr.isTTY ? ora2("Creating experiment...").start() : null;
   const res = await createExperiment(creds2, {
     name: opts.name,
     slug: opts.slug ?? null,
     description: opts.description ?? null,
-    traffic_allocation: parseInt(opts.traffic, 10) / 100
+    experiment_type: opts.type,
+    traffic_allocation: traffic / 100,
+    ...sourceRules.length > 0 ? {
+      store_url: sourceStoreUrl(sourceRules),
+      targeting: {
+        url: sourceRules.map((pattern) => ({
+          type: "simple",
+          pattern,
+          include: true
+        }))
+      }
+    } : {},
+    ...armWeight !== null ? {
+      variations: [
+        {
+          name: "Control",
+          weight: armWeight,
+          is_control: true
+        },
+        ...destinations.map((redirectUrl, index) => ({
+          name: destinations.length === 1 ? "Treatment" : `Treatment ${index + 1}`,
+          weight: armWeight,
+          is_control: false,
+          redirect_url: redirectUrl
+        }))
+      ]
+    } : {}
   });
-  if (!res.ok) {
-    spinner.fail("Failed to create experiment");
-    printError(res.error);
-    process.exit(1);
+  if (!res.ok || !res.data) {
+    spinner?.fail("Failed to create experiment");
+    fail(
+      this,
+      res.error ?? "Failed to create experiment",
+      classifyStatus(res.status),
+      res.errorDetails
+    );
   }
-  spinner.succeed("Experiment created");
-  printExperiment(res.data);
+  spinner?.succeed("Experiment created");
+  output(this, { experiment: res.data }, () => printExperiment(res.data));
 });
 var start = new Command("start").description("Start an experiment").argument("<id-or-slug>", "Experiment ID or slug").action(async (idOrSlug) => {
   const creds2 = requireCredentials();
@@ -9436,7 +9640,7 @@ var complete = new Command("complete").description("Complete/stop an experiment"
     `Experiment "${exp.name}" is now ${statusBadge("completed")}`
   );
 });
-var del = new Command("delete").alias("rm").description("Delete an experiment").argument("<id-or-slug>", "Experiment ID or slug").option("-f, --force", "Skip confirmation").action(async function action7(idOrSlug, opts) {
+var del = new Command("delete").alias("rm").description("Delete an experiment").argument("<id-or-slug>", "Experiment ID or slug").option("-f, --force", "Skip confirmation").action(async function action8(idOrSlug, opts) {
   const creds2 = requireCredentials();
   const ora2 = (await Promise.resolve().then(() => (init_ora(), ora_exports))).default;
   const exp = await resolveExperiment(idOrSlug);
@@ -9490,7 +9694,6 @@ var pullFilesystem = new Command("pull").description("Pull an experiment as an e
     const res = await getExperimentFilesystem(creds2, exp.id);
     if (!res.ok || !res.data) throw new Error(res.error ?? "Failed to pull experiment filesystem");
     const folder = folderPath(opts.dir ?? res.data.rootName);
-    import_node_fs6.default.mkdirSync(folder, { recursive: true });
     writeExperimentFilesystemFiles(folder, res.data.files);
     writeFilesystemSession(folder, {
       schemaVersion: 1,
@@ -9509,7 +9712,7 @@ var pullFilesystem = new Command("pull").description("Pull an experiment as an e
     process.exit(1);
   }
 });
-var planFilesystem = new Command("plan").description("Plan experiment filesystem changes").argument("[folder]", "Experiment filesystem folder", ".").action(async function action8(folderArg) {
+var planFilesystem = new Command("plan").description("Plan experiment filesystem changes").argument("[folder]", "Experiment filesystem folder", ".").action(async function action9(folderArg) {
   const creds2 = requireCredentials();
   try {
     const folder = folderPath(folderArg);
@@ -9531,7 +9734,7 @@ var planFilesystem = new Command("plan").description("Plan experiment filesystem
     fail(this, error instanceof Error ? error.message : String(error));
   }
 });
-var applyFilesystem = new Command("apply").description("Apply experiment filesystem changes to Apex").argument("[folder]", "Experiment filesystem folder", ".").option("-f, --force", "Skip confirmation when QA will be invalidated").action(async function action9(folderArg, opts) {
+var applyFilesystem = new Command("apply").description("Apply experiment filesystem changes to Apex").argument("[folder]", "Experiment filesystem folder", ".").option("-f, --force", "Skip confirmation when QA will be invalidated").action(async function action10(folderArg, opts) {
   const creds2 = requireCredentials();
   const ora2 = (await Promise.resolve().then(() => (init_ora(), ora_exports))).default;
   try {
@@ -9811,7 +10014,7 @@ function isRecord(value) {
 }
 var pushCommand = new Command("push").description(
   "Push experiment definitions from config file to the API (idempotent by slug)"
-).option("-c, --config <path>", "Config file path").option("--dry-run", "Show what would be pushed without making changes").action(async function action10(opts) {
+).option("-c, --config <path>", "Config file path").option("--dry-run", "Show what would be pushed without making changes").action(async function action11(opts) {
   const creds2 = requireCredentials();
   const ora2 = (await Promise.resolve().then(() => (init_ora(), ora_exports))).default;
   const configPath = opts.config ?? findConfigPath();
@@ -10237,12 +10440,12 @@ harnessCommand.command("publish").argument("<folder>", "AB Test Harness experime
 
 // src/commands/operator.ts
 init_source();
-var import_node_crypto3 = __toESM(require("node:crypto"));
+var import_node_crypto4 = __toESM(require("node:crypto"));
 var import_node_fs9 = __toESM(require("node:fs"));
 var import_node_path7 = __toESM(require("node:path"));
 var CANONICAL_FILE_RE = /^(src\/(?:index\.js|index\.scss|info\.js|mutations\.json)|experiment\.config\.json|metrics\.json|targeting\.json|dev-doc\.md|brand\.md|goals\/[a-zA-Z0-9_.-]+\.json|segments\/[a-zA-Z0-9_.-]+\.json|network\/[a-zA-Z0-9_.-]+\.recipe\.json)$/;
 function sha256Text2(value) {
-  return import_node_crypto3.default.createHash("sha256").update(value).digest("hex");
+  return import_node_crypto4.default.createHash("sha256").update(value).digest("hex");
 }
 function byteLength(value) {
   return Buffer.byteLength(value, "utf8");
@@ -10520,7 +10723,7 @@ operatorCommand.command("checkout").argument("<experiment-id>", "Apex experiment
     process.exit(1);
   }
 });
-operatorCommand.command("status").argument("[folder]", "Operator workspace folder", ".").action(function action11(folderArg) {
+operatorCommand.command("status").argument("[folder]", "Operator workspace folder", ".").action(function action12(folderArg) {
   try {
     const folder = folderPath2(folderArg);
     const session = readSession(folder);
@@ -10901,7 +11104,7 @@ trackingCommand.command("qa").description("Print the QA checklist for a tracking
     console.log(`${index + 1}. ${check}`);
   });
 });
-trackingCommand.command("verify").description("Verify live tracking events for the current shop").option("--minutes <n>", "Lookback window in minutes", "120").option("--limit <n>", "Recent events to include", "20").option("--experiment <id>", "Filter to one experiment ID").option("--event-type <type>", "Filter to one event type; repeat with comma-separated values").action(async function action12(opts) {
+trackingCommand.command("verify").description("Verify live tracking events for the current shop").option("--minutes <n>", "Lookback window in minutes", "120").option("--limit <n>", "Recent events to include", "20").option("--experiment <id>", "Filter to one experiment ID").option("--event-type <type>", "Filter to one event type; repeat with comma-separated values").action(async function action13(opts) {
   const creds2 = requireCredentials();
   const res = await verifyTracking(creds2, {
     minutes: Number.parseInt(opts.minutes, 10),
@@ -10969,7 +11172,7 @@ function printGoal(goal) {
   console.log(`  Count once: ${goal.count_once ? "yes" : "no"}`);
   console.log();
 }
-var list2 = new Command("list").alias("ls").description("List goals").option("-n, --limit <n>", "Max results", "50").action(async function action13(opts) {
+var list2 = new Command("list").alias("ls").description("List goals").option("-n, --limit <n>", "Max results", "50").action(async function action14(opts) {
   const creds2 = requireCredentials();
   const res = await listGoals(creds2, { limit: Number.parseInt(opts.limit, 10) });
   if (!res.ok || !res.data) {
@@ -10991,7 +11194,7 @@ var list2 = new Command("list").alias("ls").description("List goals").option("-n
     );
   });
 });
-var create2 = new Command("create").description("Create a goal").requiredOption("--name <name>", "Goal name").requiredOption("--type <type>", "click|pageview|custom|revenue").option("--selector <selector>", "CSS selector for click goals").option("--text-match <text>", "Text match for click goals").option("--url-pattern <pattern>", "URL pattern for pageview goals").option("--event-name <name>", "Event name for custom goals").option("--count-once", "Count only once per visitor").option("--capture <json-or-path>", "Capture JSON array or @path").action(async function action14(opts) {
+var create2 = new Command("create").description("Create a goal").requiredOption("--name <name>", "Goal name").requiredOption("--type <type>", "click|pageview|custom|revenue").option("--selector <selector>", "CSS selector for click goals").option("--text-match <text>", "Text match for click goals").option("--url-pattern <pattern>", "URL pattern for pageview goals").option("--event-name <name>", "Event name for custom goals").option("--count-once", "Count only once per visitor").option("--capture <json-or-path>", "Capture JSON array or @path").action(async function action15(opts) {
   const creds2 = requireCredentials();
   const body5 = cleanBody({
     name: opts.name,
@@ -11009,7 +11212,7 @@ var create2 = new Command("create").description("Create a goal").requiredOption(
   }
   output(this, { goal: res.data }, () => printGoal(res.data));
 });
-var update = new Command("update").description("Update a goal").argument("<id>", "Goal ID").option("--name <name>", "Goal name").option("--type <type>", "click|pageview|custom|revenue").option("--selector <selector>", "CSS selector for click goals").option("--text-match <text>", "Text match for click goals").option("--url-pattern <pattern>", "URL pattern for pageview goals").option("--event-name <name>", "Event name for custom goals").option("--count-once", "Count only once per visitor").option("--no-count-once", "Do not count only once per visitor").option("--capture <json-or-path>", "Capture JSON array or @path").action(async function action15(id, opts) {
+var update = new Command("update").description("Update a goal").argument("<id>", "Goal ID").option("--name <name>", "Goal name").option("--type <type>", "click|pageview|custom|revenue").option("--selector <selector>", "CSS selector for click goals").option("--text-match <text>", "Text match for click goals").option("--url-pattern <pattern>", "URL pattern for pageview goals").option("--event-name <name>", "Event name for custom goals").option("--count-once", "Count only once per visitor").option("--no-count-once", "Do not count only once per visitor").option("--capture <json-or-path>", "Capture JSON array or @path").action(async function action16(id, opts) {
   const creds2 = requireCredentials();
   const body5 = cleanBody({
     name: opts.name,
@@ -11083,11 +11286,11 @@ async function load2(command) {
   }
   return result.data;
 }
-var list3 = new Command("list").alias("ls").description("List runtime environments and mapped domains").action(async function action16() {
+var list3 = new Command("list").alias("ls").description("List runtime environments and mapped domains").action(async function action17() {
   const { environments } = await load2(this);
   output(this, { environments }, () => printEnvironments(environments.items));
 });
-var setDomain = new Command("set-domain").description("Map a domain to a runtime environment").argument("<domain>", "Domain to map").requiredOption("--environment <env>", "Environment key").action(async function action17(domain, opts) {
+var setDomain = new Command("set-domain").description("Map a domain to a runtime environment").argument("<domain>", "Domain to map").requiredOption("--environment <env>", "Environment key").action(async function action18(domain, opts) {
   const normalizedDomain = normalizeEnvironmentDomain(domain);
   if (!normalizedDomain) {
     fail(this, "Domain must be a valid hostname containing a dot", EXIT_CODES.validation);
@@ -11130,7 +11333,7 @@ var setDomain = new Command("set-domain").description("Map a domain to a runtime
     () => printEnvironments(result.data.environments.items)
   );
 });
-var removeDomain = new Command("remove-domain").description("Remove a domain mapping").argument("<domain>", "Domain to remove").action(async function action18(domain) {
+var removeDomain = new Command("remove-domain").description("Remove a domain mapping").argument("<domain>", "Domain to remove").action(async function action19(domain) {
   const normalizedDomain = normalizeEnvironmentDomain(domain);
   if (!normalizedDomain) {
     fail(this, "Domain must be a valid hostname containing a dot", EXIT_CODES.validation);
@@ -11198,7 +11401,7 @@ function analyticsSubcommand(name, description, defaultDays) {
     command.option("--planning-days <n>", "Planning window in days", "180");
     command.option("--limit <n>", "Maximum page rows", "50");
   }
-  return command.action(async function action24(opts) {
+  return command.action(async function action25(opts) {
     const result = await getAnalytics(requireCredentials(), name, {
       days: positiveInteger(this, opts.days, "--days"),
       planningDays: positiveInteger(this, opts.planningDays, "--planning-days"),
@@ -11385,18 +11588,18 @@ function write(name) {
   });
   return c;
 }
-function lifecycle(action24) {
-  return new Command(action24).description(`${action24[0].toUpperCase()}${action24.slice(1)} a flag`).argument("<id>").action(async function(id) {
+function lifecycle(action25) {
+  return new Command(action25).description(`${action25[0].toUpperCase()}${action25.slice(1)} a flag`).argument("<id>").action(async function(id) {
     const r = await transitionManagedDelivery(
       requireCredentials(),
       kind,
       id,
-      action24
+      action25
     );
     if (!r.ok || !r.data)
       fail(
         this,
-        r.error ?? `Failed to ${action24}`,
+        r.error ?? `Failed to ${action25}`,
         classifyStatus(r.status),
         r.errorDetails
       );
@@ -11440,18 +11643,18 @@ var get3 = new Command("get").description("Get a backlog item").argument("<id>",
   if (!r.ok || !r.data) fail(this, r.error ?? "Failed to get", classifyStatus(r.status), r.errorDetails);
   output(this, { backlog_item: r.data }, () => detail2(r.data));
 });
-function write2(action24) {
-  const c = new Command(action24).description(`${action24 === "create" ? "Create" : "Update"} a ${singular}`);
-  if (action24 === "update") c.argument("<id>", `${singular} ID`);
+function write2(action25) {
+  const c = new Command(action25).description(`${action25 === "create" ? "Create" : "Update"} a ${singular}`);
+  if (action25 === "update") c.argument("<id>", `${singular} ID`);
   c.argument("[json]", "Inline JSON, @file, or file path").option("--file <path>", "JSON body file");
   c.action(async function(...args) {
     const o = this.opts();
-    const id = action24 === "update" ? String(args[0]) : void 0;
-    const raw = o.file ? `@${o.file}` : String(args[action24 === "update" ? 1 : 0] ?? "") || void 0;
+    const id = action25 === "update" ? String(args[0]) : void 0;
+    const raw = o.file ? `@${o.file}` : String(args[action25 === "update" ? 1 : 0] ?? "") || void 0;
     const body5 = parse(this, raw);
     if (!Object.keys(body5).length) fail(this, "Provide a JSON body.", EXIT_CODES.validation);
-    const r = action24 === "create" ? await createInsight(requireCredentials(), kind2, body5) : await updateInsight(requireCredentials(), kind2, id, body5);
-    if (!r.ok || !r.data) fail(this, r.error ?? `Failed to ${action24}`, classifyStatus(r.status), r.errorDetails);
+    const r = action25 === "create" ? await createInsight(requireCredentials(), kind2, body5) : await updateInsight(requireCredentials(), kind2, id, body5);
+    if (!r.ok || !r.data) fail(this, r.error ?? `Failed to ${action25}`, classifyStatus(r.status), r.errorDetails);
     output(this, { backlog_item: r.data }, () => detail2(r.data));
   });
   return c;
@@ -11520,18 +11723,18 @@ var get4 = new Command("get").description("Get a signal").argument("<id>", "sign
   if (!r.ok || !r.data) fail(this, r.error ?? "Failed to get", classifyStatus(r.status), r.errorDetails);
   output(this, { signal: r.data }, () => detail3(r.data));
 });
-function write3(action24) {
-  const c = new Command(action24).description(`${action24 === "create" ? "Create" : "Update"} a ${singular2}`);
-  if (action24 === "update") c.argument("<id>", `${singular2} ID`);
+function write3(action25) {
+  const c = new Command(action25).description(`${action25 === "create" ? "Create" : "Update"} a ${singular2}`);
+  if (action25 === "update") c.argument("<id>", `${singular2} ID`);
   c.argument("[json]", "Inline JSON, @file, or file path").option("--file <path>", "JSON body file");
   c.action(async function(...args) {
     const o = this.opts();
-    const id = action24 === "update" ? String(args[0]) : void 0;
-    const raw = o.file ? `@${o.file}` : String(args[action24 === "update" ? 1 : 0] ?? "") || void 0;
+    const id = action25 === "update" ? String(args[0]) : void 0;
+    const raw = o.file ? `@${o.file}` : String(args[action25 === "update" ? 1 : 0] ?? "") || void 0;
     const body5 = parse2(this, raw);
     if (!Object.keys(body5).length) fail(this, "Provide a JSON body.", EXIT_CODES.validation);
-    const r = action24 === "create" ? await createInsight(requireCredentials(), kind3, body5) : await updateInsight(requireCredentials(), kind3, id, body5);
-    if (!r.ok || !r.data) fail(this, r.error ?? `Failed to ${action24}`, classifyStatus(r.status), r.errorDetails);
+    const r = action25 === "create" ? await createInsight(requireCredentials(), kind3, body5) : await updateInsight(requireCredentials(), kind3, id, body5);
+    if (!r.ok || !r.data) fail(this, r.error ?? `Failed to ${action25}`, classifyStatus(r.status), r.errorDetails);
     output(this, { signal: r.data }, () => detail3(r.data));
   });
   return c;
@@ -11649,20 +11852,20 @@ function write4(name) {
   });
   return c;
 }
-function lifecycle2(action24) {
-  return new Command(action24).description(
-    `${action24[0].toUpperCase()}${action24.slice(1)} a personalization`
+function lifecycle2(action25) {
+  return new Command(action25).description(
+    `${action25[0].toUpperCase()}${action25.slice(1)} a personalization`
   ).argument("<id>").action(async function(id) {
     const r = await transitionManagedDelivery(
       requireCredentials(),
       kind4,
       id,
-      action24
+      action25
     );
     if (!r.ok || !r.data)
       fail(
         this,
-        r.error ?? `Failed to ${action24}`,
+        r.error ?? `Failed to ${action25}`,
         classifyStatus(r.status),
         r.errorDetails
       );
@@ -11758,17 +11961,17 @@ function targetingResourceCommand(kind5) {
         );
       })
     );
-  for (const action24 of ["create", "update"]) {
-    const command = new Command(action24).description(
-      `${action24 === "create" ? "Create" : "Update"} a ${singular3}`
+  for (const action25 of ["create", "update"]) {
+    const command = new Command(action25).description(
+      `${action25 === "create" ? "Create" : "Update"} a ${singular3}`
     );
-    if (action24 === "update") command.argument("<id>");
+    if (action25 === "update") command.argument("<id>");
     command.argument("[json]", "Inline JSON, @file, or file path").option("--file <path>", "JSON body file").action(async function(...args) {
       const opts = this.opts();
-      const id = action24 === "update" ? String(args[0]) : void 0;
-      const value = opts.file ? `@${opts.file}` : String(args[action24 === "update" ? 1 : 0] ?? "") || void 0;
+      const id = action25 === "update" ? String(args[0]) : void 0;
+      const value = opts.file ? `@${opts.file}` : String(args[action25 === "update" ? 1 : 0] ?? "") || void 0;
       const requestBody = body3(this, value);
-      if (action24 === "update" && typeof requestBody === "object" && requestBody !== null && !Array.isArray(requestBody) && Object.keys(requestBody).length === 0)
+      if (action25 === "update" && typeof requestBody === "object" && requestBody !== null && !Array.isArray(requestBody) && Object.keys(requestBody).length === 0)
         fail(
           this,
           `Updating a ${singular3} requires at least one field.`,
@@ -11776,7 +11979,7 @@ function targetingResourceCommand(kind5) {
         );
       const response = await requestTargetingResource(
         requireCredentials(),
-        action24 === "create" ? "POST" : "PATCH",
+        action25 === "create" ? "POST" : "PATCH",
         kind5,
         id,
         requestBody
@@ -11784,7 +11987,7 @@ function targetingResourceCommand(kind5) {
       if (!response.ok || !response.data)
         fail(
           this,
-          response.error ?? `Failed to ${action24}`,
+          response.error ?? `Failed to ${action25}`,
           classifyStatus(response.status),
           response.errorDetails
         );
@@ -11793,7 +11996,7 @@ function targetingResourceCommand(kind5) {
         {
           [kind5 === "exclusion-groups" ? "exclusion_group" : singular3]: response.data
         },
-        () => console.log(source_default.green(`${action24}d ${singular3}`))
+        () => console.log(source_default.green(`${action25}d ${singular3}`))
       );
     });
     root.addCommand(command);
@@ -11880,7 +12083,7 @@ var exclusionGroupsCommand = targetingResourceCommand("exclusion-groups");
 // src/commands/brand.ts
 init_source();
 var NO_PROFILE_MESSAGE = "No brand profile yet \u2014 run onboarding or a site check";
-var brandCommand = new Command("brand").description("Print the shop brand context for external agents").action(async function action19() {
+var brandCommand = new Command("brand").description("Print the shop brand context for external agents").action(async function action20() {
   const creds2 = requireCredentials();
   const res = await getBrandContext(creds2);
   if (res.status === 404) {
@@ -11913,7 +12116,7 @@ var brandCommand = new Command("brand").description("Print the shop brand contex
 
 // src/commands/targeting.ts
 init_source();
-var test = new Command("test").description("Evaluate experiment URL targeting for a page").argument("<url>", "URL to evaluate").option("--status <status>", "Comma-separated statuses to include, or all", "all").action(async function action20(url, opts) {
+var test = new Command("test").description("Evaluate experiment URL targeting for a page").argument("<url>", "URL to evaluate").option("--status <status>", "Comma-separated statuses to include, or all", "all").action(async function action21(url, opts) {
   const creds2 = requireCredentials();
   const res = await testTargeting(creds2, url, { status: opts.status });
   if (!res.ok || !res.data) {
@@ -11970,7 +12173,7 @@ function printTicket(ticket, reused) {
   console.log(`  Status: ${ticket.my_status ?? ticket.mapped_status}`);
   console.log();
 }
-var create3 = new Command("create").description("Create an Apex SOS ticket").option("--type <type>", "full_handover|design|development|qa|config|bug", "qa").option("--loom <url>", "Loom URL with reproduction or QA context").option("--experiment <id>", "Experiment ID").option("--sub-class <text>", "SOS sub-classification").option("--description <text-or-@file>", "Description text or @path").argument("[description]", "Description text").action(async function action21(descriptionArg, opts) {
+var create3 = new Command("create").description("Create an Apex SOS ticket").option("--type <type>", "full_handover|design|development|qa|config|bug", "qa").option("--loom <url>", "Loom URL with reproduction or QA context").option("--experiment <id>", "Experiment ID").option("--sub-class <text>", "SOS sub-classification").option("--description <text-or-@file>", "Description text or @path").argument("[description]", "Description text").action(async function action22(descriptionArg, opts) {
   if (!SOS_TYPES.has(opts.type)) {
     fail(this, "Invalid SOS type. Use full_handover, design, development, qa, config, or bug.", 3);
   }
@@ -11988,7 +12191,7 @@ var create3 = new Command("create").description("Create an Apex SOS ticket").opt
   }
   output(this, res.data, () => printTicket(res.data.ticket, res.data.reused));
 });
-var mine = new Command("mine").description("List SOS tickets created by this API key").action(async function action22() {
+var mine = new Command("mine").description("List SOS tickets created by this API key").action(async function action23() {
   const creds2 = requireCredentials();
   const res = await listMySos(creds2);
   if (!res.ok || !res.data) {
@@ -12110,10 +12313,19 @@ var create4 = new Command("create").description("Create a shop").argument("[json
   const r = await createShop(requireUserCredentials(), payload);
   done(this, r, "create shop");
 });
-var update2 = new Command("update").description("Update a shop").argument("<id>").argument("<json>", "Inline JSON, @file, or file path").option("--confirm-tier", "Confirm a commercially sensitive tier change").action(async function(id, raw, o) {
-  const b = body4(this, raw);
+var update2 = new Command("update").description("Update a shop").argument("<id>").argument("[json]", "Inline JSON, @file, or file path").option("--holdout-pct <percent>", "Global holdout percent (0-10)").option("--holdout-enabled", "Enable global holdout v1").option("--holdout-disabled", "Disable global holdout v1").option("--confirm-tier", "Confirm a commercially sensitive tier change").action(async function(id, raw, o) {
+  const b = raw === void 0 ? {} : body4(this, raw);
+  if (o.holdoutEnabled && o.holdoutDisabled)
+    fail(this, "Use only one of --holdout-enabled or --holdout-disabled", EXIT_CODES.validation);
+  if (o.holdoutPct !== void 0) {
+    const pct = Number(o.holdoutPct);
+    if (!Number.isFinite(pct) || pct < 0 || pct > 10)
+      fail(this, "--holdout-pct must be between 0 and 10", EXIT_CODES.validation);
+    b.holdout_pct = pct;
+  }
+  if (o.holdoutEnabled || o.holdoutDisabled) b.holdout_v1_enabled = Boolean(o.holdoutEnabled);
   if (!Object.keys(b).length)
-    fail(this, "Provide a JSON body.", EXIT_CODES.validation);
+    fail(this, "Provide a JSON body or holdout flags.", EXIT_CODES.validation);
   if (Object.hasOwn(b, "tier") && !o.confirmTier)
     fail(
       this,
@@ -12274,7 +12486,7 @@ function commandSchema(command) {
   };
 }
 function createSchemaCommand(program3) {
-  return new Command("schema").description("Print the current Apex CLI command and flag schema").option("--json", "Print JSON schema").action(function action24() {
+  return new Command("schema").description("Print the current Apex CLI command and flag schema").option("--json", "Print JSON schema").action(function action25() {
     const schema = commandSchema(program3);
     output(this, schema, () => {
       console.log(JSON.stringify(schema, null, 2));
@@ -12318,7 +12530,7 @@ function installSkill(paths, targetRoot) {
   import_node_fs20.default.copyFileSync(paths.agents, import_node_path18.default.join(target, "AGENTS.md"));
   return target;
 }
-var skillsCommand = new Command("skills").description("Print or install the Apex CLI agent skill files").option("--install", "Copy the Apex CLI skill into ./.claude/skills/apex-cli").option("--target <dir>", "Install target skills directory", ".claude/skills").option("--json", "Print JSON").action(function action23(opts) {
+var skillsCommand = new Command("skills").description("Print or install the Apex CLI agent skill files").option("--install", "Copy the Apex CLI skill into ./.claude/skills/apex-cli").option("--target <dir>", "Install target skills directory", ".claude/skills").option("--json", "Print JSON").action(function action24(opts) {
   let paths;
   try {
     paths = skillPaths();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@drip-apex/apex-cli",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "license": "MIT",
   "description": "Apex CLI for managing experiments, approved roadmap ideas, and draft workspaces.",
   "private": false,