@drip-apex/apex-cli 0.2.1 → 0.3.0

package/dist/cli.js

@@ -1159,8 +1159,8 @@ var require_command = __commonJS({
   "node_modules/commander/lib/command.js"(exports2) {
     var EventEmitter = require("node:events").EventEmitter;
     var childProcess2 = require("node:child_process");
-    var path20 = require("node:path");
-    var fs24 = require("node:fs");
+    var path21 = require("node:path");
+    var fs25 = require("node:fs");
     var process16 = require("node:process");
     var { Argument: Argument2, humanReadableArgName } = require_argument();
     var { CommanderError: CommanderError2 } = require_error();
@@ -2141,7 +2141,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @param {string} subcommandName
        */
       _checkForMissingExecutable(executableFile, executableDir, subcommandName) {
-        if (fs24.existsSync(executableFile)) return;
+        if (fs25.existsSync(executableFile)) return;
         const executableDirMessage = executableDir ? `searched for local subcommand relative to directory '${executableDir}'` : "no directory for search for local subcommand, use .executableDir() to supply a custom directory";
         const executableMissing = `'${executableFile}' does not exist
  - if '${subcommandName}' is not meant to be an executable command, remove description parameter from '.command()' and use '.description()' instead
@@ -2159,11 +2159,11 @@ Expecting one of '${allowedValues.join("', '")}'`);
         let launchWithNode = false;
         const sourceExt = [".js", ".ts", ".tsx", ".mjs", ".cjs"];
         function findFile(baseDir, baseName) {
-          const localBin = path20.resolve(baseDir, baseName);
-          if (fs24.existsSync(localBin)) return localBin;
-          if (sourceExt.includes(path20.extname(baseName))) return void 0;
+          const localBin = path21.resolve(baseDir, baseName);
+          if (fs25.existsSync(localBin)) return localBin;
+          if (sourceExt.includes(path21.extname(baseName))) return void 0;
           const foundExt = sourceExt.find(
-            (ext) => fs24.existsSync(`${localBin}${ext}`)
+            (ext) => fs25.existsSync(`${localBin}${ext}`)
           );
           if (foundExt) return `${localBin}${foundExt}`;
           return void 0;
@@ -2175,21 +2175,21 @@ Expecting one of '${allowedValues.join("', '")}'`);
         if (this._scriptPath) {
           let resolvedScriptPath;
           try {
-            resolvedScriptPath = fs24.realpathSync(this._scriptPath);
+            resolvedScriptPath = fs25.realpathSync(this._scriptPath);
           } catch {
             resolvedScriptPath = this._scriptPath;
           }
-          executableDir = path20.resolve(
-            path20.dirname(resolvedScriptPath),
+          executableDir = path21.resolve(
+            path21.dirname(resolvedScriptPath),
             executableDir
           );
         }
         if (executableDir) {
           let localFile = findFile(executableDir, executableFile);
           if (!localFile && !subcommand._executableFile && this._scriptPath) {
-            const legacyName = path20.basename(
+            const legacyName = path21.basename(
               this._scriptPath,
-              path20.extname(this._scriptPath)
+              path21.extname(this._scriptPath)
             );
             if (legacyName !== this._name) {
               localFile = findFile(
@@ -2200,7 +2200,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
           }
           executableFile = localFile || executableFile;
         }
-        launchWithNode = sourceExt.includes(path20.extname(executableFile));
+        launchWithNode = sourceExt.includes(path21.extname(executableFile));
         let proc;
         if (process16.platform !== "win32") {
           if (launchWithNode) {
@@ -3047,7 +3047,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @return {Command}
        */
       nameFromFilename(filename) {
-        this._name = path20.basename(filename, path20.extname(filename));
+        this._name = path21.basename(filename, path21.extname(filename));
         return this;
       }
       /**
@@ -3061,9 +3061,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @param {string} [path]
        * @return {(string|null|Command)}
        */
-      executableDir(path21) {
-        if (path21 === void 0) return this._executableDir;
-        this._executableDir = path21;
+      executableDir(path22) {
+        if (path22 === void 0) return this._executableDir;
+        this._executableDir = path22;
         return this;
       }
       /**
@@ -4588,15 +4588,15 @@ var init_mjs = __esm({
         this.listeners[ev].push(fn);
       }
       removeListener(ev, fn) {
-        const list12 = this.listeners[ev];
-        const i = list12.indexOf(fn);
+        const list15 = this.listeners[ev];
+        const i = list15.indexOf(fn);
         if (i === -1) {
           return;
         }
-        if (i === 0 && list12.length === 1) {
-          list12.length = 0;
+        if (i === 0 && list15.length === 1) {
+          list15.length = 0;
         } else {
-          list12.splice(i, 1);
+          list15.splice(i, 1);
         }
       }
       emit(ev, code, signal) {
@@ -6743,16 +6743,16 @@ __export(ora_exports, {
 function ora(options) {
   return new Ora(options);
 }
-async function oraPromise(action25, options) {
-  const actionIsFunction = typeof action25 === "function";
-  const actionIsPromise = typeof action25.then === "function";
+async function oraPromise(action68, options) {
+  const actionIsFunction = typeof action68 === "function";
+  const actionIsPromise = typeof action68.then === "function";
   if (!actionIsFunction && !actionIsPromise) {
     throw new TypeError("Parameter `action` must be a Function or a Promise");
   }
   const { successText, failText } = typeof options === "object" ? options : { successText: void 0, failText: void 0 };
   const spinner = ora(options).start();
   try {
-    const promise = actionIsFunction ? action25(spinner) : action25;
+    const promise = actionIsFunction ? action68(spinner) : action68;
     const result = await promise;
     spinner.succeed(
       successText === void 0 ? void 0 : typeof successText === "string" ? successText : successText(result)
@@ -7126,6 +7126,7 @@ var commandName = "apex";
 var wroteEnvelope = false;
 var stdoutLines = [];
 var originalConsoleLog = null;
+var deprecationMarker = null;
 function findPackageVersion() {
   const candidates = [
     import_node_path.default.resolve(__dirname, "../package.json"),
@@ -7182,12 +7183,16 @@ function restoreConsoleLog() {
   console.log = originalConsoleLog;
   originalConsoleLog = null;
 }
+function markDeprecatedInvocation(marker) {
+  deprecationMarker = marker;
+}
 function writeEnvelope(data, command = commandName) {
   const envelope = {
     ok: true,
     version: CLI_VERSION,
     command,
-    data
+    data,
+    ...deprecationMarker ? { deprecated: deprecationMarker } : {}
   };
   wroteEnvelope = true;
   restoreConsoleLog();
@@ -7359,6 +7364,8 @@ function findConfigPath() {
 var import_node_crypto = require("node:crypto");
 var mockEnvironmentPatchAttempts = 0;
 var mockEnvironmentReads = 0;
+var mockDomainsPatchAttempts = 0;
+var mockScreenshotPolls = 0;
 function extractErrorMessage(json, status2) {
   if (!json) return `HTTP ${status2}`;
   const err = json.error;
@@ -7390,6 +7397,13 @@ function extractErrorDetails(json) {
   return Object.keys(details).length > 0 ? details : void 0;
 }
 function mockExperiment() {
+  const collidingVariation = process.env.APEX_CLI_MOCK_SCREENSHOTS === "collision" ? [{
+    id: "deadbeef-0000-4000-8000-000000000002",
+    name: "Trust-Badge",
+    weight: 0,
+    is_control: false,
+    mutations: []
+  }] : [];
   return {
     id: "00000000-0000-4000-8000-000000000001",
     slug: "fixture-test",
@@ -7398,6 +7412,7 @@ function mockExperiment() {
     traffic_allocation: 1,
     store_url: "https://example.com/products/demo",
     created_at: "2026-07-04T00:00:00.000Z",
+    archived_at: null,
     variations: [
       {
         id: "00000000-0000-4000-8000-0000000000c0",
@@ -7407,9 +7422,10 @@ function mockExperiment() {
         is_control: true,
         mutations: []
       },
+      ...collidingVariation,
       {
         id: "00000000-0000-4000-8000-0000000000b1",
-        slug: "badge",
+        slug: process.env.APEX_CLI_MOCK_SCREENSHOTS === "collision" ? void 0 : "badge",
         name: "Trust Badge",
         weight: 0.5,
         is_control: false,
@@ -7418,6 +7434,18 @@ function mockExperiment() {
     ]
   };
 }
+var SECOND_PAGE_GOAL_ID = "00000000-0000-4000-8000-0000000000f2";
+function mockFunnel() {
+  return {
+    id: "00000000-0000-4000-8000-0000000000aa",
+    name: "Fixture funnel",
+    steps: [
+      { order: 1, label: "Collection", url_pattern: "/collections/*" },
+      { order: 2, label: "Product", url_pattern: "/products/*" }
+    ],
+    created_at: "2026-07-04T00:00:00.000Z"
+  };
+}
 function mockGoal() {
   return {
     id: "00000000-0000-4000-8000-0000000000f1",
@@ -7427,11 +7455,24 @@ function mockGoal() {
     selector: null,
     text_match: null,
     url_pattern: null,
+    page_id: null,
     event_name: "purchase",
     capture: null,
     created_at: "2026-07-04T00:00:00.000Z"
   };
 }
+var PAGE_SCOPED_GOAL_ID = "00000000-0000-4000-8000-0000000000f3";
+function mockPageScopedGoal() {
+  return {
+    ...mockGoal(),
+    id: PAGE_SCOPED_GOAL_ID,
+    name: "Fixture page-scoped pageview",
+    type: "pageview",
+    event_name: null,
+    url_pattern: "bestellung-abgeschlossen",
+    page_id: "00000000-0000-4000-8000-0000000000e1"
+  };
+}
 function mockBrandContext() {
   if (process.env.APEX_CLI_MOCK_BRAND_PROFILE === "none") {
     return {
@@ -7481,11 +7522,144 @@ function mockBrandContext() {
     ].join("\n")
   };
 }
-function mockResponse(method, path20, body5) {
+function mockResponse(method, path21, body5) {
   if (process.env.APEX_CLI_MOCK_API !== "1") return null;
-  const url = new URL(path20, "https://mock.apex.local");
+  const url = new URL(path21, "https://mock.apex.local");
   const exp = mockExperiment();
+  if (method === "POST" && url.pathname === `/api/v1/experiments/${exp.id}/screenshots`) {
+    mockScreenshotPolls = 0;
+    return { ok: true, status: 202, data: { job_id: "screenshot_job_1", status: "queued", poll_url: "/api/v1/screenshots/screenshot_job_1" } };
+  }
+  if (method === "GET" && url.pathname === "/api/v1/screenshots/screenshot_job_1") {
+    mockScreenshotPolls += 1;
+    if (process.env.APEX_CLI_MOCK_SCREENSHOTS === "transient" && mockScreenshotPolls === 1) {
+      return { ok: false, status: 503, error: "Service temporarily unavailable" };
+    }
+    if (process.env.APEX_CLI_MOCK_SCREENSHOTS === "timeout" || process.env.APEX_CLI_MOCK_SCREENSHOTS === "deadline-processing" || mockScreenshotPolls === 1 && process.env.APEX_CLI_MOCK_SCREENSHOTS !== "deadline-completed") {
+      return { ok: true, status: 200, data: { job_id: "screenshot_job_1", experiment_id: exp.id, status: "processing", devices: ["desktop_chrome"], variation_ids: exp.variations.map((variation) => variation.id) } };
+    }
+    const results2 = {
+      [exp.variations[0].id]: { desktop_chrome: "data:image/png;base64,iVBORw0KGgo=" }
+    };
+    if (process.env.APEX_CLI_MOCK_SCREENSHOTS !== "partial") {
+      for (const variation of exp.variations.slice(1)) {
+        results2[variation.id] = { desktop_chrome: "data:image/png;base64,iVBORw0KGgo=" };
+      }
+    }
+    return { ok: true, status: 200, data: { job_id: "screenshot_job_1", experiment_id: exp.id, status: "completed", devices: ["desktop_chrome"], variation_ids: exp.variations.map((variation) => variation.id), results: results2 } };
+  }
+  if (url.pathname.startsWith("/api/v1/webhooks")) {
+    const input = body5 ?? {};
+    const webhook = {
+      id: url.pathname.split("/")[4] || "webhook_1",
+      url: String(input.url ?? "https://hooks.example.test/apex"),
+      events: Array.isArray(input.events) ? input.events.map(String) : ["project.published"],
+      active: input.active === void 0 ? true : input.active === true,
+      hasSecret: true,
+      consecutiveFailures: process.env.APEX_CLI_MOCK_WEBHOOK_DISABLED === "1" ? 3 : 1,
+      disabledAt: process.env.APEX_CLI_MOCK_WEBHOOK_DISABLED === "1" ? "2026-08-05T12:00:00.000Z" : null,
+      created_at: "2026-08-05T00:00:00.000Z"
+    };
+    const availableEvents = ["experiment.started", "experiment.completed", "experiment.significant", "experiment.guardian_triggered", "experiment.guardian_paused", "variation.winning", "screenshots.completed", "project.published"];
+    if (method === "GET" && url.pathname === "/api/v1/webhooks") return { ok: true, status: 200, data: { data: [webhook], availableEvents, pagination: { has_more: false, next_cursor: null } } };
+    if (method === "POST" && url.pathname === "/api/v1/webhooks") return { ok: true, status: 201, data: { ...webhook, secret: "whsec_mock_secret" } };
+    if (method === "PATCH") return { ok: true, status: 200, data: webhook };
+    if (method === "DELETE") return { ok: true, status: 200, data: { deleted: true, id: webhook.id } };
+    if (method === "GET" && url.pathname.endsWith("/deliveries")) return { ok: true, status: 200, data: { webhook: { id: webhook.id, active: webhook.active, consecutiveFailures: webhook.consecutiveFailures, disabledAt: webhook.disabledAt }, data: [{ id: "delivery_1", webhook_id: webhook.id, event: "project.published", status: process.env.APEX_CLI_MOCK_WEBHOOK_DISABLED === "1" ? "dead" : "delivered", attempts: 1, response_status: process.env.APEX_CLI_MOCK_WEBHOOK_DISABLED === "1" ? 500 : 200, last_error: process.env.APEX_CLI_MOCK_WEBHOOK_DISABLED === "1" ? "Webhook responded with 500" : null, next_attempt_at: null, processing_started_at: null, delivered_at: "2026-08-05T00:01:00.000Z", created_at: "2026-08-05T00:00:00.000Z", updated_at: "2026-08-05T00:01:00.000Z" }], pagination: { has_more: false, next_cursor: null } } };
+    if (method === "POST" && url.pathname.endsWith("/test")) return { ok: true, status: 200, data: { webhook: { id: webhook.id, active: webhook.active, consecutiveFailures: webhook.consecutiveFailures, disabledAt: webhook.disabledAt }, delivery: { id: "delivery_test", webhook_id: webhook.id, event: "test", status: "delivered", attempts: 1, response_status: 200, last_error: null, next_attempt_at: null, processing_started_at: null, delivered_at: "2026-08-05T00:01:00.000Z", created_at: "2026-08-05T00:00:00.000Z", updated_at: "2026-08-05T00:01:00.000Z" } } };
+  }
+  const forcedStatus = Number(process.env.APEX_CLI_MOCK_ERROR_STATUS ?? 0);
+  if (forcedStatus > 0) {
+    return {
+      ok: false,
+      status: forcedStatus,
+      error: forcedStatus === 401 ? "Invalid API key" : "Resource not found",
+      errorDetails: { mocked: true }
+    };
+  }
+  if (method === "POST" && url.pathname.endsWith("/build") && process.env.APEX_CLI_MOCK_WORKSPACE_BUILD === "blocked-evidence") {
+    return {
+      ok: false,
+      status: 400,
+      error: "Generated custom JavaScript includes an external network or asset call.",
+      data: {
+        ok: false,
+        error: "Generated custom JavaScript includes an external network or asset call.",
+        blockingIssues: [
+          {
+            code: "external_network_call",
+            severity: "blocking",
+            field: "custom_js",
+            message: "Generated custom JavaScript includes an external network or asset call.",
+            evidence: {
+              construct: "String-capable timer execution (fail-closed)",
+              snippet: "setTimeout(unknownHandler, 10)",
+              line: 7,
+              column: 2
+            }
+          },
+          {
+            code: "external_network_call",
+            severity: "blocking",
+            field: "mutations[1].html",
+            message: "Generated HTML includes an external network or asset URL.",
+            evidence: {
+              construct: "External HTML asset URL",
+              url: "https://assets.example.test/pixel.png",
+              matchIndex: 14
+            }
+          },
+          {
+            code: "invalid_custom_code_type",
+            severity: "blocking",
+            field: "custom_css",
+            message: "custom_css must be a string."
+          },
+          {
+            code: "price_node_mutation",
+            severity: "blocking",
+            field: ".product-price",
+            message: "This mutation replaces a price-display node.",
+            evidence: {
+              selector: ".product-price"
+            }
+          },
+          {
+            code: "unknown_validation_family",
+            severity: "blocking",
+            field: "future_guardrail_field",
+            message: "A future guardrail blocked this workspace."
+          }
+        ]
+      }
+    };
+  }
+  if (method === "GET" && url.pathname === "/api/v1/roadmap/approved") {
+    return {
+      ok: true,
+      status: 200,
+      data: {
+        data: [{ id: "roadmap_1", title: "Fixture roadmap idea", linked_experiments: [] }],
+        pagination: { has_more: false, next_cursor: null }
+      }
+    };
+  }
+  if (method === "GET" && url.pathname === "/api/v1/roadmap/items/roadmap_1/handoff") {
+    return {
+      ok: true,
+      status: 200,
+      data: {
+        id: "roadmap_1",
+        title: "Fixture roadmap idea",
+        hypothesis: "The fixture improves conversion",
+        instructions: "Build the fixture"
+      }
+    };
+  }
   if (method === "GET" && url.pathname === `/api/v1/experiments/${exp.id}/filesystem`) {
+    if (process.env.APEX_CLI_MOCK_FILESYSTEM_REFRESH === "failed") {
+      throw new Error("Mock filesystem refresh failed");
+    }
     const fixtures = [
       ["experiment.json", '{"schemaVersion":1,"name":"Fixture Test"}\n'],
       ["targeting.json", '{"url":[],"segments":[]}\n'],
@@ -7497,6 +7671,7 @@ function mockResponse(method, path20, body5) {
       ["launch.json", '{"status":"draft"}\n'],
       ["variations/control/variation.json", '{"slug":"control","isControl":true}\n'],
       ["variations/control/mutations.json", "[]\n"],
+      ["variations/control/url-blocks.json", "[]\n"],
       ["variations/control/index.css", ".control { color: inherit; }\n"],
       ["variations/control/index.js", "window.__apexControl = true;\n"],
       ["variations/control/reset.js", "delete window.__apexControl;\n"],
@@ -7524,6 +7699,36 @@ function mockResponse(method, path20, body5) {
       }
     };
   }
+  const workspaceMatch = url.pathname.match(
+    /^\/api\/v1\/experiments\/([^/]+)\/variations\/([^/]+)\/workspace$/
+  );
+  if (method === "GET" && workspaceMatch) {
+    const content = "window.__apexOperator = true;\n";
+    return {
+      ok: true,
+      status: 200,
+      data: {
+        workspace: {
+          id: "workspace_1",
+          schemaVersion: 1,
+          status: "draft",
+          currentRevisionId: "revision_1",
+          updatedAt: "2026-08-05T00:00:00.000Z"
+        },
+        files: [
+          {
+            path: "src/index.js",
+            kind: "custom_js",
+            contentType: "application/javascript",
+            content,
+            sha256: (0, import_node_crypto.createHash)("sha256").update(content).digest("hex"),
+            sizeBytes: Buffer.byteLength(content),
+            updatedAt: "2026-08-05T00:00:00.000Z"
+          }
+        ]
+      }
+    };
+  }
   const configMatch = url.pathname.match(
     /^\/api\/v1\/(assets|landing-pages)(?:\/([^/]+))?$/
   );
@@ -7703,16 +7908,16 @@ function mockResponse(method, path20, body5) {
     /^\/api\/v1\/(flags|personalizations)(?:\/([^/]+))?(?:\/(activate|pause|archive|status))?$/
   );
   if (managedMatch) {
-    const [, kind5, id = `${kind5.slice(0, -1)}_1`, action25] = managedMatch;
+    const [, kind5, id = `${kind5.slice(0, -1)}_1`, action68] = managedMatch;
     const input = body5 ?? {};
     const item = {
       id,
       key: String(input.key ?? `fixture-${kind5.slice(0, -1)}`),
       name: String(input.name ?? `Fixture ${kind5.slice(0, -1)}`),
-      status: action25 === "activate" ? "active" : action25 === "pause" ? "paused" : action25 === "archive" ? "archived" : "draft",
+      status: action68 === "activate" ? "active" : action68 === "pause" ? "paused" : action68 === "archive" ? "archived" : "draft",
       updated_at: "2026-07-19T00:00:00.000Z"
     };
-    if (kind5 === "flags" && action25 === "status")
+    if (kind5 === "flags" && action68 === "status")
       return {
         ok: true,
         status: 200,
@@ -7745,11 +7950,11 @@ function mockResponse(method, path20, body5) {
     /^\/api\/v1\/(backlog|signals)(?:\/([^/]+))?(?:\/(archive|restore))?$/
   );
   if (insightMatch) {
-    const [, kind5, id = `${kind5}_1`, action25] = insightMatch;
+    const [, kind5, id = `${kind5}_1`, action68] = insightMatch;
     const input = body5 ?? {};
-    if (action25 && (kind5 !== "backlog" || method !== "POST"))
-      return { ok: false, status: 405, error: `${action25} requires POST` };
-    const archived = action25 === "archive" || method === "DELETE" || url.searchParams.get("include_archived") === "true";
+    if (action68 && (kind5 !== "backlog" || method !== "POST"))
+      return { ok: false, status: 405, error: `${action68} requires POST` };
+    const archived = action68 === "archive" || method === "DELETE" || url.searchParams.get("include_archived") === "true";
     const item = {
       id,
       ...kind5 === "backlog" ? {
@@ -7775,20 +7980,24 @@ function mockResponse(method, path20, body5) {
       return { ok: true, status: 200, data: { ok: true } };
     return {
       ok: true,
-      status: method === "POST" && !action25 ? 201 : 200,
+      status: method === "POST" && !action68 ? 201 : 200,
       data: item
     };
   }
   if (method === "GET" && url.pathname === "/api/v1/experiments") {
+    const experiment = url.searchParams.get("archived") === "1" ? { ...exp, archived_at: "2026-07-20T00:00:00.000Z" } : { ...exp, archived_at: null };
     return {
       ok: true,
       status: 200,
       data: {
-        data: [exp],
+        data: [experiment],
         pagination: { has_more: false, next_cursor: null }
       }
     };
   }
+  if (method === "POST" && url.pathname === `/api/v1/experiments/${exp.id}/start`) {
+    return { ok: true, status: 200, data: { ...exp, status: "running" } };
+  }
   if (method === "POST" && url.pathname === "/api/v1/experiments") {
     const input = body5 ?? {};
     if (input.experiment_type === "redirect" && process.env.APEX_CLI_MOCK_REDIRECT_DISABLED === "1") {
@@ -7825,6 +8034,7 @@ function mockResponse(method, path20, body5) {
     return { ok: true, status: 200, data: exp };
   }
   if (method === "GET" && url.pathname === `/api/v1/experiments/${exp.id}/results`) {
+    const withheld = process.env.APEX_CLI_MOCK_RESULTS_STATE === "untrustworthy";
     return {
       ok: true,
       status: 200,
@@ -7852,14 +8062,62 @@ function mockResponse(method, path20, body5) {
           }
         ],
         decision: {
-          state: "collecting",
+          state: withheld ? "untrustworthy" : "collecting",
           treatmentName: "Trust Badge",
           lift: 25,
-          sequentialConfidence: 62.5
+          sequentialConfidence: withheld ? 0 : 62.5,
+          fixedConfidence: withheld ? 0 : 84,
+          judgedConfidence: withheld ? 0 : 84,
+          basis: withheld ? "sequential" : "fixed_horizon",
+          blockingGates: withheld ? ["mixed-currency"] : []
+        },
+        effective_outcome: {
+          outcome: withheld ? "needs_readout" : "winner",
+          statisticsOutcome: withheld ? "needs_readout" : "collecting",
+          provenance: withheld ? "statistics" : "manager_decided"
+        },
+        manager_decision: withheld ? null : {
+          outcome: "winner",
+          reason: "The business case is strong enough to ship.",
+          decided_by: { id: "user_1", name: "Maya Manager" },
+          decided_at: "2026-07-31T09:00:00.000Z",
+          version: 1
         },
         metrics: [],
         series: [],
-        warnings: []
+        warnings: withheld ? [{ code: "mixed-currency", message: "Mixed currencies block the verdict." }] : []
+      }
+    };
+  }
+  if (method === "GET" && url.pathname === `/api/v1/experiments/${exp.id}/qa/run`) {
+    return {
+      ok: true,
+      status: 200,
+      data: {
+        run: {
+          id: "qa_run_1",
+          status: "in_review",
+          checklist: [],
+          urls: [],
+          automatedEvidence: null,
+          acceptanceCriteriaSummary: null,
+          goalVerification: null,
+          summary: {
+            status: "in_review",
+            required: 0,
+            completedRequired: 0,
+            failedRequired: 0,
+            optional: 0,
+            completedOptional: 0,
+            blockers: []
+          },
+          notes: null,
+          createdAt: "2026-07-04T00:00:00.000Z",
+          updatedAt: "2026-07-04T00:00:00.000Z",
+          approvedAt: null,
+          approvedBy: null,
+          completedAt: null
+        }
       }
     };
   }
@@ -7894,6 +8152,29 @@ function mockResponse(method, path20, body5) {
         }
       };
     }
+    if (process.env.APEX_CLI_MOCK_FILESYSTEM_PLAN === "blocking-only") {
+      return {
+        ok: true,
+        status: 200,
+        data: {
+          ok: false,
+          experimentId: exp.id,
+          status: "invalid",
+          changes: [],
+          errors: [],
+          warnings: [],
+          blockingIssues: [{
+            code: "custom_js_parse_error",
+            severity: "blocking",
+            message: "Custom JavaScript does not parse.",
+            path: "variations/control/index.js",
+            variation: "control"
+          }],
+          invalidatesQa: false,
+          precompileRequired: false
+        }
+      };
+    }
     const observedPaths = files.map((file) => file.path).filter((filePath) => typeof filePath === "string");
     return {
       ok: true,
@@ -7999,6 +8280,49 @@ function mockResponse(method, path20, body5) {
       }
     };
   }
+  if (url.pathname === "/api/v1/consent" && (method === "GET" || method === "PATCH")) {
+    const patch = body5;
+    const enabled = typeof patch?.consentMode?.enabled === "boolean" ? patch.consentMode.enabled : true;
+    const provider = typeof patch?.consentMode?.provider === "string" ? patch.consentMode.provider : "cookiescript";
+    const requiredGroup = typeof patch?.consentMode?.requiredGroup === "string" ? patch.consentMode.requiredGroup : "analytics";
+    const getter = typeof patch?.consentMode?.getter === "string" ? patch.consentMode.getter : "";
+    if (method === "PATCH" && patch?.applyCanonicalSplit === false) {
+      return { ok: false, status: 403, error: "applyCanonicalSplit: false is not permitted with the consent:write scope \u2014 clear those prerequisites in the dashboard (shop:settings)." };
+    }
+    return { ok: true, status: 200, data: {
+      consentMode: { enabled, provider, requiredGroup, getter },
+      prerequisites: {
+        showVariationsRule: "return true;",
+        startTrackingRule: "return drip.get('trackingConsentEnabled');"
+      },
+      ...method === "PATCH" ? { precompile: { status: "ok", summary: "Mock edge precompile succeeded" } } : {}
+    } };
+  }
+  if (url.pathname === "/api/v1/install-domains" && (method === "GET" || method === "PATCH")) {
+    const conflictMode = process.env.APEX_CLI_MOCK_DOMAINS_CONFLICT;
+    const serverDomains = conflictMode === "once" && mockDomainsPatchAttempts >= 1 ? ["shop.example.com", "peer.example.com"] : ["shop.example.com"];
+    if (method === "PATCH") {
+      mockDomainsPatchAttempts += 1;
+      if (conflictMode === "always" || conflictMode === "once" && mockDomainsPatchAttempts === 1) {
+        return { ok: false, status: 409, error: "Install domains changed since read \u2014 re-read and retry" };
+      }
+    }
+    const domains = body5?.domains ?? serverDomains;
+    const additionalDomains = method === "PATCH" ? domains : serverDomains;
+    return { ok: true, status: 200, data: {
+      domain: "example.com",
+      additionalDomains,
+      storeOrigins: ["https://example.com", "https://www.example.com", ...additionalDomains.map((domain) => `https://${domain}`)],
+      revision: method === "PATCH" ? "rev_patched" : `rev_${serverDomains.length}`,
+      ...method === "PATCH" ? { precompile: { status: "ok", summary: "Mock edge precompile succeeded" } } : {}
+    } };
+  }
+  if (url.pathname === "/api/v1/external-tracking" && (method === "GET" || method === "PATCH")) {
+    const current = { domains: ["www.example.com", "shop.example.com"], handoverQueryParam: "drip_bucket", handoverTtlSeconds: 120, handoverMintTimeoutMs: 250, signed: true };
+    const patch = body5?.externalTracking;
+    const next = { ...current, ...patch ?? {} };
+    return { ok: true, status: 200, data: { externalTracking: next, revision: "2026-08-05T10:00:00.000Z", ...method === "PATCH" ? { precompile: { status: "ok", summary: "Mock edge precompile succeeded" } } : {} } };
+  }
   const analyticsMatch = url.pathname.match(/^\/api\/v1\/analytics\/(stats|timeseries|traffic|pages|geo|sessions|web-vitals|realtime|entry-exit)$/);
   if (method === "GET" && analyticsMatch) {
     const fixtures = {
@@ -8014,12 +8338,119 @@ function mockResponse(method, path20, body5) {
     };
     return { ok: true, status: 200, data: { data: fixtures[analyticsMatch[1]] } };
   }
+  if (method === "GET" && url.pathname === "/api/v1/analytics/url-inventory") {
+    return { ok: true, status: 200, data: { items: [
+      { host: "getkong.test", path: "/bestellung-abgeschlossen", pageviews: 12, visitors: 10 },
+      { host: "getkong.test", path: "/products/demo", pageviews: 7, visitors: 5 }
+    ], total: 2, truncated: false } };
+  }
+  if (method === "POST" && url.pathname === "/api/v1/analytics/suggest-goals") {
+    return { ok: true, status: 200, data: { goals: [{ name: "Purchase", type: "pageview", urlPattern: "/bestellung-abgeschlossen", explanation: "Fixture" }], funnels: [], triggers: [] } };
+  }
+  if (method === "GET" && url.pathname === "/api/v1/funnels") {
+    return { ok: true, status: 200, data: { data: [mockFunnel()] } };
+  }
+  if (method === "POST" && url.pathname === "/api/v1/funnels") {
+    return { ok: true, status: 201, data: { ...mockFunnel(), ...body5 } };
+  }
+  if (method === "GET" && url.pathname === `/api/v1/funnels/${mockFunnel().id}`) {
+    return { ok: true, status: 200, data: mockFunnel() };
+  }
+  if (method === "PATCH" && url.pathname === `/api/v1/funnels/${mockFunnel().id}`) {
+    return { ok: true, status: 200, data: { ...mockFunnel(), ...body5 } };
+  }
+  if (method === "DELETE" && url.pathname === `/api/v1/funnels/${mockFunnel().id}`) {
+    return { ok: true, status: 200, data: { ok: true } };
+  }
+  if (method === "GET" && url.pathname === `/api/v1/funnels/${mockFunnel().id}/run`) {
+    return { ok: true, status: 200, data: { total_sessions_analyzed: 2, steps: [{ step: 1, label: "Collection", url_pattern: "/collections/*", visitors: 2, drop_off_rate: 0, matched_pageviews: 2 }] } };
+  }
+  if (method === "GET" && url.pathname.endsWith("/workspace")) {
+    const files = [
+      ["experiment.config.json", JSON.stringify({ name: exp.name, storeUrl: exp.store_url, experimentSlug: exp.slug, variationSlug: "badge" }, null, 2) + "\n", "application/json", "config"],
+      ["metrics.json", '{"primary":null,"secondary":[]}\n', "application/json", "metrics"],
+      ["targeting.json", '{"url":[],"segments":[]}\n', "application/json", "targeting"],
+      ["src/index.js", "window.__apexOperatorFixture = true;\n", "application/javascript", "custom_js"],
+      ["src/index.scss", ".apex-operator-fixture { display: block; }\n", "text/x-scss", "custom_css"],
+      ["src/mutations.json", "[]\n", "application/json", "mutations"],
+      ["dev-doc.md", "# Fixture workspace\n", "text/markdown", "doc"],
+      ["brand.md", "# Fixture brand\n", "text/markdown", "brand"]
+    ];
+    return {
+      ok: true,
+      status: 200,
+      data: {
+        workspace: {
+          id: "workspace_1",
+          schemaVersion: 1,
+          status: "draft",
+          currentRevisionId: "revision_1",
+          updatedAt: "2026-07-30T00:00:00.000Z"
+        },
+        files: files.map(([filePath, content, contentType, kind5]) => ({
+          path: filePath,
+          kind: kind5,
+          contentType,
+          content,
+          sha256: (0, import_node_crypto.createHash)("sha256").update(content).digest("hex"),
+          sizeBytes: Buffer.byteLength(content, "utf8"),
+          updatedAt: "2026-07-30T00:00:00.000Z"
+        }))
+      }
+    };
+  }
+  if (method === "PUT" && url.pathname.includes("/variations/") && url.pathname.includes("/files/")) {
+    return { ok: true, status: 200, data: { ok: true } };
+  }
+  if (method === "POST" && url.pathname.endsWith("/build")) {
+    return {
+      ok: true,
+      status: 200,
+      data: { ok: true, mutationCount: 0, customCssBytes: 42, customJsBytes: 58 }
+    };
+  }
+  if (method === "POST" && url.pathname === "/api/v1/harness/sessions") {
+    return { ok: true, status: 201, data: { sessionId: "harness_1", sessionToken: "token", experimentId: exp.id, variationId: exp.variations?.[1]?.id ?? "variation_1", expiresAt: "2026-07-30T01:00:00.000Z", previewUrl: "https://preview.drip-apex.com/api/preview?pst=harness_1" } };
+  }
+  if (method === "POST" && url.pathname === "/api/v1/harness/sessions/harness_1/versions") {
+    return { ok: true, status: 201, data: { sessionId: "harness_1", version: 1, expiresAt: "2026-07-30T01:00:00.000Z", jsArtifactId: "asset_js", cssArtifactId: "asset_css" } };
+  }
+  if (method === "POST" && url.pathname === "/api/v1/harness/sessions/harness_1/publish") {
+    return { ok: true, status: 200, data: { ok: true } };
+  }
   if (method === "GET" && url.pathname === "/api/v1/goals") {
+    if (process.env.APEX_CLI_MOCK_GOAL_PAGES === "2") {
+      if (!url.searchParams.get("cursor")) {
+        return {
+          ok: true,
+          status: 200,
+          data: {
+            data: [mockGoal()],
+            pagination: { has_more: true, next_cursor: "goals_page_2" }
+          }
+        };
+      }
+      return {
+        ok: true,
+        status: 200,
+        data: {
+          data: [{
+            ...mockGoal(),
+            id: SECOND_PAGE_GOAL_ID,
+            name: "Fixture pageview",
+            type: "pageview",
+            event_name: null,
+            url_pattern: "bestellung-abgeschlossen"
+          }],
+          pagination: { has_more: false, next_cursor: null }
+        }
+      };
+    }
     return {
       ok: true,
       status: 200,
       data: {
-        data: [mockGoal()],
+        data: [mockGoal(), mockPageScopedGoal()],
         pagination: { has_more: false, next_cursor: null }
       }
     };
@@ -8195,8 +8626,8 @@ function getUserKeyIdentity(creds2) {
     "/api/v1/me"
   );
 }
-function userRequest(creds2, method, path20, body5) {
-  return request({ ...creds2, apiKey: creds2.userApiKey ?? "", baseUrl: creds2.userBaseUrl ?? creds2.baseUrl }, method, path20, body5);
+function userRequest(creds2, method, path21, body5) {
+  return request({ ...creds2, apiKey: creds2.userApiKey ?? "", baseUrl: creds2.userBaseUrl ?? creds2.baseUrl }, method, path21, body5);
 }
 function getAccountProfile(creds2) {
   return userRequest(creds2, "GET", "/api/v1/account/profile");
@@ -8213,24 +8644,39 @@ function createUserManagedKey(creds2, body5) {
 function revokeUserManagedKey(creds2, id, shopId) {
   return userRequest(creds2, "DELETE", `/api/v1/keys/${encodeURIComponent(id)}?shop_id=${encodeURIComponent(shopId)}`);
 }
-async function request(creds2, method, path20, body5) {
-  const mock = mockResponse(method, path20, body5);
+async function request(creds2, method, path21, body5, requestTimeoutMs) {
+  const mock = mockResponse(method, path21, body5);
   if (mock) return mock;
-  const url = `${creds2.baseUrl}${path20}`;
+  const url = `${creds2.baseUrl}${path21}`;
+  const configuredTimeout = Number(process.env.APEX_TIMEOUT_MS ?? "30000");
+  const defaultTimeoutMs = Number.isFinite(configuredTimeout) && configuredTimeout > 0 ? configuredTimeout : 3e4;
+  const timeoutMs = requestTimeoutMs !== void 0 ? Math.max(1, Math.min(defaultTimeoutMs, requestTimeoutMs)) : defaultTimeoutMs;
   const headers = {
     Authorization: `Bearer ${creds2.apiKey}`,
     "Content-Type": "application/json"
   };
-  const res = await fetch(url, {
-    method,
-    headers,
-    body: body5 ? JSON.stringify(body5) : void 0
-  });
+  let res;
+  try {
+    res = await fetch(url, {
+      method,
+      headers,
+      body: body5 ? JSON.stringify(body5) : void 0,
+      signal: AbortSignal.timeout(timeoutMs)
+    });
+  } catch (error) {
+    const seconds = timeoutMs / 1e3;
+    throw new CliError(
+      `Could not reach ${creds2.baseUrl}: check DRIP_BASE_URL / network; server did not respond within ${seconds}s.`,
+      EXIT_CODES.general,
+      { baseUrl: creds2.baseUrl, timeoutMs, cause: error instanceof Error ? error.message : String(error) }
+    );
+  }
   const json = await res.json().catch(() => null);
   if (!res.ok) {
     return {
       ok: false,
       status: res.status,
+      data: json,
       error: extractErrorMessage(json, res.status),
       errorDetails: extractErrorDetails(json),
       requestId: res.headers.get("x-request-id"),
@@ -8249,15 +8695,28 @@ async function request(creds2, method, path20, body5) {
     data: json
   };
 }
-async function requestForm(creds2, method, path20, body5) {
-  const mock = mockResponse(method, path20, body5);
+async function requestForm(creds2, method, path21, body5) {
+  const mock = mockResponse(method, path21, body5);
   if (mock) return mock;
-  const url = `${creds2.baseUrl}${path20}`;
-  const res = await fetch(url, {
-    method,
-    headers: { Authorization: `Bearer ${creds2.apiKey}` },
-    body: body5
-  });
+  const url = `${creds2.baseUrl}${path21}`;
+  const configuredTimeout = Number(process.env.APEX_TIMEOUT_MS ?? "120000");
+  const timeoutMs = Number.isFinite(configuredTimeout) && configuredTimeout > 0 ? configuredTimeout : 12e4;
+  let res;
+  try {
+    res = await fetch(url, {
+      method,
+      headers: { Authorization: `Bearer ${creds2.apiKey}` },
+      body: body5,
+      signal: AbortSignal.timeout(timeoutMs)
+    });
+  } catch (error) {
+    const seconds = timeoutMs / 1e3;
+    throw new CliError(
+      `Could not reach ${creds2.baseUrl}: check DRIP_BASE_URL / network; server did not respond within ${seconds}s.`,
+      EXIT_CODES.general,
+      { baseUrl: creds2.baseUrl, timeoutMs, cause: error instanceof Error ? error.message : String(error) }
+    );
+  }
   const json = await res.json().catch(() => null);
   if (!res.ok) {
     return {
@@ -8280,6 +8739,7 @@ function listExperiments(creds2, opts) {
   if (opts?.status) params.set("status", opts.status);
   if (opts?.limit) params.set("limit", String(opts.limit));
   if (opts?.cursor) params.set("cursor", opts.cursor);
+  if (opts?.includeArchived) params.set("archived", "1");
   const qs = params.toString();
   return request(
     creds2,
@@ -8341,6 +8801,15 @@ function getExperimentResults(creds2, id, opts) {
     `/api/v1/experiments/${id}/results${qs ? `?${qs}` : ""}`
   );
 }
+function createExperimentScreenshots(creds2, id, body5) {
+  return request(creds2, "POST", `/api/v1/experiments/${id}/screenshots`, body5);
+}
+async function getScreenshotJob(creds2, jobId, timeoutMs) {
+  if (process.env.APEX_CLI_MOCK_API === "1" && ["deadline-processing", "deadline-completed"].includes(process.env.APEX_CLI_MOCK_SCREENSHOTS ?? "")) {
+    await new Promise((resolve) => setTimeout(resolve, 5));
+  }
+  return request(creds2, "GET", `/api/v1/screenshots/${jobId}`, void 0, timeoutMs);
+}
 function planExperimentFilesystem(creds2, id, body5) {
   return request(
     creds2,
@@ -8417,13 +8886,32 @@ function putOperatorWorkspaceFile(creds2, experimentId, variationId, filePath, b
     body5
   );
 }
-function buildOperatorWorkspace(creds2, experimentId, variationId) {
+function buildOperatorWorkspace(creds2, experimentId, variationId, body5) {
   return request(
     creds2,
     "POST",
-    `/api/v1/experiments/${experimentId}/variations/${variationId}/build`
+    `/api/v1/experiments/${experimentId}/variations/${variationId}/build`,
+    body5
   );
 }
+function listFunnels(creds2) {
+  return request(creds2, "GET", "/api/v1/funnels");
+}
+function createFunnel(creds2, body5) {
+  return request(creds2, "POST", "/api/v1/funnels", body5);
+}
+function updateFunnel(creds2, id, body5) {
+  return request(creds2, "PATCH", `/api/v1/funnels/${encodeURIComponent(id)}`, body5);
+}
+function deleteFunnel(creds2, id) {
+  return request(creds2, "DELETE", `/api/v1/funnels/${encodeURIComponent(id)}`);
+}
+function runFunnel(creds2, id, days) {
+  const params = new URLSearchParams();
+  if (days) params.set("days", String(days));
+  const qs = params.toString();
+  return request(creds2, "GET", `/api/v1/funnels/${encodeURIComponent(id)}/run${qs ? `?${qs}` : ""}`);
+}
 function listGoals(creds2, opts) {
   const params = new URLSearchParams();
   if (opts?.limit) params.set("limit", String(opts.limit));
@@ -8442,6 +8930,14 @@ function updateGoal(creds2, id, body5) {
     body5
   );
 }
+function getUrlInventory(creds2, opts) {
+  const params = new URLSearchParams();
+  for (const [key, value] of Object.entries(opts)) if (value !== void 0) params.set(key, String(value));
+  return request(creds2, "GET", `/api/v1/analytics/url-inventory?${params.toString()}`);
+}
+function suggestGoals(creds2) {
+  return request(creds2, "POST", "/api/v1/analytics/suggest-goals", {});
+}
 function getBrandContext(creds2) {
   return request(creds2, "GET", "/api/v1/brand-context");
 }
@@ -8456,6 +8952,24 @@ function updateEnvironments(creds2, body5) {
     body5
   );
 }
+function getConsent(creds2) {
+  return request(creds2, "GET", "/api/v1/consent");
+}
+function updateConsent(creds2, body5) {
+  return request(creds2, "PATCH", "/api/v1/consent", body5);
+}
+function getInstallDomains(creds2) {
+  return request(creds2, "GET", "/api/v1/install-domains");
+}
+function updateInstallDomains(creds2, body5) {
+  return request(creds2, "PATCH", "/api/v1/install-domains", body5);
+}
+function getExternalTracking(creds2) {
+  return request(creds2, "GET", "/api/v1/external-tracking");
+}
+function updateExternalTracking(creds2, body5) {
+  return request(creds2, "PATCH", "/api/v1/external-tracking", body5);
+}
 function verifyTracking(creds2, opts) {
   const params = new URLSearchParams();
   if (opts?.minutes) params.set("minutes", String(opts.minutes));
@@ -8521,7 +9035,22 @@ function listAuditLogs(creds2, opts) {
   if (opts.entityId) p.set("entity_id", opts.entityId);
   if (opts.limit) p.set("limit", String(opts.limit));
   if (opts.offset) p.set("offset", String(opts.offset));
-  return request(creds2, "GET", `/api/v1/audit-logs${p.size ? `?${p}` : ""}`);
+  const query = p.size ? `?${p}` : "";
+  return request(creds2, "GET", `/api/v1/audit-logs${query}`).then(async (shopResult) => {
+    if (shopResult.ok || shopResult.status !== 401 && shopResult.status !== 403) return shopResult;
+    const shopFailure = `Shop key failed: missing audit_logs:read; create a secret shop key with audit_logs:read.`;
+    if (!creds2.userApiKey) return { ...shopResult, error: shopFailure };
+    if (!opts.shopId) return { ...shopResult, error: `${shopFailure} User key was not tried: pass --shop <shop-id> to select an authorized shop.` };
+    const userResult = await userRequest(creds2, "GET", `/api/v1/shops/${encodeURIComponent(opts.shopId)}/audit-logs${query}`);
+    if (userResult.ok) return userResult;
+    const userPathFailure = `User-key shop audit-log path failed: ${userResult.error}`;
+    if (userResult.status === 403 || userResult.status === 404) {
+      return { ...userResult, error: `${shopFailure} ${userPathFailure} Re-run \`apex login --user\`, select the audit_logs:read scope, and use a member of shop ${opts.shopId}.` };
+    }
+    const staleKeyGuidance = userResult.status === 401 ? " Re-run `apex login --user` and select the audit_logs:read scope." : "";
+    const separator = userResult.status === 401 && !/[.!?]$/.test(userPathFailure) ? "." : "";
+    return { ...userResult, error: `${userPathFailure}${separator}${staleKeyGuidance}` };
+  });
 }
 function listInbox(creds2, experimentId) {
   const q = experimentId ? `?experiment_id=${encodeURIComponent(experimentId)}` : "";
@@ -8568,11 +9097,11 @@ function requestTargetingResource(creds2, method, kind5, id, body5, limit, curso
   if (limit) params.set("limit", String(limit));
   if (cursor) params.set("cursor", cursor);
   const query = params.toString();
-  const path20 = `/api/v1/${kind5}${id ? `/${id.split("/").map(encodeURIComponent).join("/")}` : ""}${query ? `?${query}` : ""}`;
-  return request(creds2, method, path20, body5);
+  const path21 = `/api/v1/${kind5}${id ? `/${id.split("/").map(encodeURIComponent).join("/")}` : ""}${query ? `?${query}` : ""}`;
+  return request(creds2, method, path21, body5);
 }
-function managedPath(kind5, id, action25) {
-  return `/api/v1/${kind5}${id ? `/${encodeURIComponent(id)}` : ""}${action25 ? `/${action25}` : ""}`;
+function managedPath(kind5, id, action68) {
+  return `/api/v1/${kind5}${id ? `/${encodeURIComponent(id)}` : ""}${action68 ? `/${action68}` : ""}`;
 }
 function listManagedDeliveries(creds2, kind5, limit) {
   const q = limit ? `?limit=${limit}` : "";
@@ -8594,8 +9123,8 @@ function createManagedDelivery(creds2, kind5, body5) {
 function updateManagedDelivery(creds2, kind5, id, body5) {
   return request(creds2, "PATCH", managedPath(kind5, id), body5);
 }
-function transitionManagedDelivery(creds2, kind5, id, action25) {
-  return request(creds2, "POST", managedPath(kind5, id, action25));
+function transitionManagedDelivery(creds2, kind5, id, action68) {
+  return request(creds2, "POST", managedPath(kind5, id, action68));
 }
 function listConfigResources(creds2, family, opts) {
   const params = new URLSearchParams();
@@ -8763,6 +9292,24 @@ var postShopArea = (c, id, area, body5) => userRequest(
   `/api/v1/shops/${id}/${area}`,
   body5
 );
+function listWebhooks(creds2) {
+  return request(creds2, "GET", "/api/v1/webhooks");
+}
+function createWebhook(creds2, body5) {
+  return request(creds2, "POST", "/api/v1/webhooks", body5);
+}
+function updateWebhook(creds2, id, body5) {
+  return request(creds2, "PATCH", `/api/v1/webhooks/${encodeURIComponent(id)}`, body5);
+}
+function deleteWebhook(creds2, id) {
+  return request(creds2, "DELETE", `/api/v1/webhooks/${encodeURIComponent(id)}`);
+}
+function getWebhookDeliveries(creds2, id, limit) {
+  return request(creds2, "GET", `/api/v1/webhooks/${encodeURIComponent(id)}/deliveries?limit=${encodeURIComponent(String(limit))}`);
+}
+function testWebhook(creds2, id) {
+  return request(creds2, "POST", `/api/v1/webhooks/${encodeURIComponent(id)}/test`);
+}
 
 // src/ui.ts
 init_source();
@@ -8835,8 +9382,8 @@ function prompt(question, hide = false) {
     }
   });
 }
-function printValidationFailure(res) {
-  printError(`${res.error ?? `HTTP ${res.status}`} (HTTP ${res.status})`);
+function printValidationFailure(res, remedy = "") {
+  printError(`${res.error ?? `HTTP ${res.status}`} (HTTP ${res.status})${remedy}`);
   if (res.status === 429) {
     printWarning(
       "The API key reached Apex, but the validation request was rate-limited. If this happens on first login, check the server-side rate-limit backend/configuration."
@@ -9021,7 +9568,7 @@ var loginCommand = new Command("login").description("Authenticate with Apex").op
     spinner.fail(
       res.status === 401 ? "Authentication failed" : "API key validation failed"
     );
-    printValidationFailure(res);
+    printValidationFailure(res, " Run `apex login`.");
     fail(this, res.error ?? "API key validation failed", classifyStatus(res.status), res.errorDetails);
   }
   spinner.succeed("Authenticated successfully");
@@ -9029,7 +9576,13 @@ var loginCommand = new Command("login").description("Authenticate with Apex").op
   output(this, { baseUrl, credentialsFile: "~/.drip/credentials.json" }, () => {
     printSuccess(`Credentials saved to ~/.drip/credentials.json`);
   });
-});
+}).addHelpText("after", `
+Examples:
+  apex login
+  apex login --user
+  apex login --api-key apx_your_key_here
+  apex login --base-url https://app.drip-apex.com
+`);
 var logoutCommand = new Command("logout").description("Remove stored credentials").option("--user", "Remove only the stored user API key").action(function action2(opts) {
   const existing = getStoredCredentials();
   if (!existing) {
@@ -9072,7 +9625,7 @@ var whoamiCommand = new Command("whoami").description("Show current authenticati
       if (res?.ok) {
         printSuccess("Key is valid");
       } else {
-        if (res) printValidationFailure(res);
+        if (res) printValidationFailure(res, " Run `apex login`.");
       }
     } else {
       console.log("API Key:  none (user credential only)");
@@ -9080,7 +9633,7 @@ var whoamiCommand = new Command("whoami").description("Show current authenticati
     if (creds2.userApiKey) {
       console.log(`User Key: ${source_default.dim(creds2.userApiKey.slice(0, 11) + "..." + creds2.userApiKey.slice(-4))}`);
       if (userRes?.ok) console.log(`User Org: ${source_default.cyan(userRes.data.data.org_id)} (${userRes.data.data.org_role})`);
-      else printWarning("User key could not be verified.");
+      else printWarning("User key could not be verified. Run `apex login --user`.");
     }
   });
 });
@@ -9119,22 +9672,40 @@ function printExperiment(exp) {
 function formatPct(value, digits = 1) {
   return typeof value === "number" && Number.isFinite(value) ? `${value.toFixed(digits)}%` : "-";
 }
+function confidenceBasisLabel(value) {
+  if (value === "fixed_horizon") return "fixed-horizon";
+  if (value === "sequential") return "always-valid";
+  return "unknown";
+}
+function statisticsStateLabel(value) {
+  return value === "untrustworthy" ? "verdict withheld" : String(value ?? "unknown");
+}
 function printExperimentResults(results2) {
   const experiment = results2.experiment ?? {};
   const totals = results2.totals ?? {};
   const decision = results2.decision ?? {};
+  const effectiveOutcome = results2.effective_outcome ?? {};
+  const outcomeProvenance = effectiveOutcome.provenance === "manager_decided" ? " (manager decided)" : "";
+  const verdictWithheld = decision.state === "untrustworthy";
+  const statisticsState = verdictWithheld ? decision.state : effectiveOutcome.statisticsOutcome ?? decision.state ?? "unknown";
+  const presentedOutcome = verdictWithheld && effectiveOutcome.provenance !== "manager_decided" ? decision.state : effectiveOutcome.outcome ?? decision.state ?? "unknown";
   console.log();
   console.log(source_default.bold(String(experiment.name ?? experiment.id ?? "Experiment results")));
   console.log(`  Status:      ${statusBadge(String(experiment.status ?? "unknown"))}`);
   console.log(`  Visitors:    ${String(totals.visitors ?? 0)}`);
   console.log(`  Conversions: ${String(totals.primaryConversions ?? 0)}`);
   console.log(`  Revenue:     ${String(totals.revenue ?? 0)}`);
-  console.log(`  Decision:    ${String(decision.state ?? "unknown")}`);
+  console.log(`  Outcome:     ${statisticsStateLabel(presentedOutcome)}${outcomeProvenance}`);
+  console.log(
+    `  Statistics:  ${statisticsStateLabel(statisticsState)}`
+  );
   if (decision.treatmentName) {
     console.log(`  Treatment:   ${String(decision.treatmentName)}`);
   }
-  console.log(`  Lift:        ${formatPct(decision.lift)}`);
-  console.log(`  Confidence:  ${formatPct(decision.sequentialConfidence)}`);
+  console.log(`  Stats lift:  ${formatPct(decision.lift)}`);
+  console.log(
+    `  Confidence (${confidenceBasisLabel(decision.basis)}): ${verdictWithheld ? "withheld \u2014 not decision-grade" : formatPct(decision.judgedConfidence)}`
+  );
   const arms = Array.isArray(results2.arms) ? results2.arms : [];
   if (arms.length > 0) {
     console.log();
@@ -9164,6 +9735,7 @@ var EXPERIMENT_FILESYSTEM_PATH_SCHEMA = {
   variation: [
     "variation.json",
     "mutations.json",
+    "url-blocks.json",
     "index.css",
     "index.js",
     "reset.js",
@@ -9204,6 +9776,10 @@ function writeFilesystemSession(folder, session) {
 function readFilesystemSession(folder) {
   const filePath = filesystemSessionPath(folder);
   if (!import_node_fs6.default.existsSync(filePath)) {
+    const workspaceMarker = import_node_path4.default.join(filesystemApexDir(folder), "session.json");
+    if (import_node_fs6.default.existsSync(workspaceMarker)) {
+      throw new Error("This folder is an operator workspace (apex workspace \u2026), not an experiment filesystem \u2014 run `apex workspace status` here, or `apex experiments pull` into a different folder.");
+    }
     throw new Error(`Missing ${filePath}. Run apex experiments pull first.`);
   }
   return JSON.parse(import_node_fs6.default.readFileSync(filePath, "utf8"));
@@ -9269,47 +9845,50 @@ function printFilesystemPlan(plan) {
     console.log(source_default.yellow("\nWarnings"));
     plan.warnings.forEach((warning) => console.log(`  - ${warning}`));
   }
+  if ((plan.blockingIssues?.length ?? 0) > 0) {
+    console.log(source_default.red("\nBlocking issues"));
+    (plan.blockingIssues ?? []).forEach((issue) => {
+      const context = [issue.path, issue.variation ? `variation: ${issue.variation}` : null].filter(Boolean).join(", ");
+      console.log(`  - [${issue.code}] ${issue.message}${context ? ` (${context})` : ""}`);
+    });
+  }
   console.log(source_default.bold("\nChanges"));
   if (plan.changes.length === 0) {
     console.log(source_default.dim("  No changes."));
   } else {
     plan.changes.forEach((change) => {
       const pathLabel = change.path ? source_default.dim(` ${change.path}`) : "";
-      const qa2 = change.invalidatesQa ? source_default.yellow(" invalidates QA") : "";
-      console.log(`  ${source_default.cyan(change.action)} ${change.entity}${pathLabel} \u2014 ${change.summary}${qa2}`);
+      const qa3 = change.invalidatesQa ? source_default.yellow(" invalidates QA") : "";
+      console.log(`  ${source_default.cyan(change.action)} ${change.entity}${pathLabel} \u2014 ${change.summary}${qa3}`);
     });
   }
   console.log();
   console.log(`QA invalidated: ${plan.invalidatesQa ? source_default.yellow("yes") : "no"}`);
   console.log(`Precompile:     ${plan.precompileRequired ? "yes" : "no"}`);
 }
-function printQaRun(run2, json = false) {
-  if (json) {
-    console.log(JSON.stringify({ run: run2 }, null, 2));
-    return;
-  }
+function printQaRun(run3) {
   console.log();
-  console.log(source_default.bold(`QA run ${run2.id}`));
-  console.log(`  Status:   ${statusBadge(run2.summary.status)}`);
+  console.log(source_default.bold(`QA run ${run3.id}`));
+  console.log(`  Status:   ${statusBadge(run3.summary.status)}`);
   console.log(
-    `  Required: ${run2.summary.completedRequired}/${run2.summary.required}`
+    `  Required: ${run3.summary.completedRequired}/${run3.summary.required}`
   );
-  if (run2.approvedAt) console.log(`  Approved: ${run2.approvedAt}`);
-  if (run2.completedAt) console.log(`  Complete: ${run2.completedAt}`);
-  if (run2.summary.blockers.length > 0) {
+  if (run3.approvedAt) console.log(`  Approved: ${run3.approvedAt}`);
+  if (run3.completedAt) console.log(`  Complete: ${run3.completedAt}`);
+  if (run3.summary.blockers.length > 0) {
     console.log(source_default.yellow("\nBlockers"));
-    run2.summary.blockers.forEach((blocker) => console.log(`  - ${blocker}`));
+    run3.summary.blockers.forEach((blocker) => console.log(`  - ${blocker}`));
   }
   console.log(source_default.bold("\nChecklist"));
-  for (const item of run2.checklist) {
+  for (const item of run3.checklist) {
     const required = item.required ? source_default.yellow(" required") : "";
     const notes = item.notes ? source_default.dim(` \u2014 ${item.notes}`) : "";
     console.log(`  ${statusBadge(item.status)} ${item.id}${required}`);
     console.log(`    ${item.title}${notes}`);
   }
-  if (run2.urls.length > 0) {
+  if (run3.urls.length > 0) {
     console.log(source_default.bold("\nQA URLs"));
-    run2.urls.forEach((url) => {
+    run3.urls.forEach((url) => {
       console.log(`  - ${url.label}: ${source_default.cyan(url.url)}`);
     });
   }
@@ -9363,18 +9942,21 @@ async function resolveExperimentForFilesystemOrId(value) {
 }
 async function refreshExperimentFilesystemFolderIfNeeded(creds2, folder, experimentId) {
   if (!folder) return;
-  const refreshed = await getExperimentFilesystem(creds2, experimentId);
-  if (refreshed.ok && refreshed.data) {
-    writeExperimentFilesystemFiles(folder, refreshed.data.files);
-    writeFilesystemSession(folder, {
-      schemaVersion: 1,
-      baseUrl: creds2.baseUrl,
-      experimentId,
-      pulledAt: (/* @__PURE__ */ new Date()).toISOString(),
-      files: Object.fromEntries(
-        refreshed.data.files.map((file) => [file.path, { sha256: file.sha256 }])
-      )
-    });
+  try {
+    const refreshed = await getExperimentFilesystem(creds2, experimentId);
+    if (refreshed.ok && refreshed.data) {
+      writeExperimentFilesystemFiles(folder, refreshed.data.files);
+      writeFilesystemSession(folder, {
+        schemaVersion: 1,
+        baseUrl: creds2.baseUrl,
+        experimentId,
+        pulledAt: (/* @__PURE__ */ new Date()).toISOString(),
+        files: Object.fromEntries(
+          refreshed.data.files.map((file) => [file.path, { sha256: file.sha256 }])
+        )
+      });
+    }
+  } catch {
   }
 }
 async function resolveExperiment(idOrSlug) {
@@ -9382,20 +9964,29 @@ async function resolveExperiment(idOrSlug) {
   if (/^[0-9a-f-]{36}$/i.test(idOrSlug)) {
     const res2 = await getExperiment(creds2, idOrSlug);
     if (res2.ok) return res2.data;
-    return null;
+    throw new CliError(
+      res2.error ?? `Experiment "${idOrSlug}" not found`,
+      classifyStatus(res2.status),
+      res2.errorDetails
+    );
   }
   const slug = idOrSlug.startsWith("slug:") ? idOrSlug.slice(5) : idOrSlug;
   const res = await getExperimentBySlug(creds2, slug);
   if (res.ok) return res.data;
-  return null;
+  throw new CliError(
+    res.error ?? `Experiment "${idOrSlug}" not found`,
+    classifyStatus(res.status),
+    res.errorDetails
+  );
 }
-var list = new Command("list").alias("ls").description("List experiments").option("-s, --status <status>", "Filter by status (draft|running|paused|completed)").option("-n, --limit <n>", "Max results", "20").action(async function action4(opts) {
+var list = new Command("list").alias("ls").description("List experiments (archived experiments are hidden by default)").option("-s, --status <status>", "Filter by status (draft|running|paused|completed)").option("-n, --limit <n>", "Max results", "20").option("--include-archived", "Include archived experiments").action(async function action4(opts) {
   const creds2 = requireCredentials();
   const ora2 = (await Promise.resolve().then(() => (init_ora(), ora_exports))).default;
   const spinner = process.stderr.isTTY ? ora2("Fetching experiments...").start() : null;
   const res = await listExperiments(creds2, {
     status: opts.status,
-    limit: parseInt(opts.limit, 10)
+    limit: parseInt(opts.limit, 10),
+    includeArchived: opts.includeArchived
   });
   if (!res.ok) {
     spinner?.fail("Failed to fetch experiments");
@@ -9409,15 +10000,16 @@ var list = new Command("list").alias("ls").description("List experiments").optio
       return;
     }
     printTable(
-      ["NAME", "SLUG", "STATUS", "TRAFFIC", "CREATED"],
+      ["NAME", "SLUG", "STATUS", "ARCHIVED", "TRAFFIC", "CREATED"],
       experiments.map((e) => [
         e.name.slice(0, 40),
         e.slug ?? source_default.dim("-"),
         statusBadge(e.status),
+        e.archived_at ? formatDate(e.archived_at) : source_default.dim("-"),
         `${(e.traffic_allocation * 100).toFixed(0)}%`,
         formatDate(e.created_at)
       ]),
-      [40, 25, 12, 8, 15]
+      [40, 25, 12, 15, 8, 15]
     );
     if (res.data.pagination.has_more) {
       console.log(source_default.dim(`
@@ -9587,66 +10179,66 @@ var create = new Command("create").description("Create a new experiment").requir
   spinner?.succeed("Experiment created");
   output(this, { experiment: res.data }, () => printExperiment(res.data));
 });
-var start = new Command("start").description("Start an experiment").argument("<id-or-slug>", "Experiment ID or slug").action(async (idOrSlug) => {
+var start = new Command("start").description("Start an experiment").argument("<id-or-slug>", "Experiment ID or slug").action(async function action8(idOrSlug) {
   const creds2 = requireCredentials();
   const ora2 = (await Promise.resolve().then(() => (init_ora(), ora_exports))).default;
   const spinner = ora2("Starting experiment...").start();
   const exp = await resolveExperiment(idOrSlug);
   if (!exp) {
     spinner.fail(`Experiment "${idOrSlug}" not found`);
-    process.exit(1);
+    fail(this, `Experiment "${idOrSlug}" not found`);
   }
   const res = await startExperiment(creds2, exp.id);
   if (!res.ok) {
     spinner.fail("Failed to start experiment");
-    printError(res.error);
-    process.exit(1);
+    fail(this, res.error ?? "Failed to start experiment", classifyStatus(res.status), res.errorDetails);
   }
-  spinner.succeed(`Experiment "${exp.name}" is now ${statusBadge("running")}`);
+  output(this, { experiment: { id: exp.id, name: exp.name, status: "running" } }, () => {
+    spinner.succeed(`Experiment "${exp.name}" is now ${statusBadge("running")}`);
+  });
 });
-var pause = new Command("pause").description("Pause a running experiment").argument("<id-or-slug>", "Experiment ID or slug").action(async (idOrSlug) => {
+var pause = new Command("pause").description("Pause a running experiment").argument("<id-or-slug>", "Experiment ID or slug").action(async function action9(idOrSlug) {
   const creds2 = requireCredentials();
   const ora2 = (await Promise.resolve().then(() => (init_ora(), ora_exports))).default;
   const spinner = ora2("Pausing experiment...").start();
   const exp = await resolveExperiment(idOrSlug);
   if (!exp) {
     spinner.fail(`Experiment "${idOrSlug}" not found`);
-    process.exit(1);
+    fail(this, `Experiment "${idOrSlug}" not found`);
   }
   const res = await pauseExperiment(creds2, exp.id);
   if (!res.ok) {
     spinner.fail("Failed to pause experiment");
-    printError(res.error);
-    process.exit(1);
+    fail(this, res.error ?? "Failed to pause experiment", classifyStatus(res.status), res.errorDetails);
   }
-  spinner.succeed(`Experiment "${exp.name}" is now ${statusBadge("paused")}`);
+  output(this, { experiment: { id: exp.id, name: exp.name, status: "paused" } }, () => {
+    spinner.succeed(`Experiment "${exp.name}" is now ${statusBadge("paused")}`);
+  });
 });
-var complete = new Command("complete").description("Complete/stop an experiment").argument("<id-or-slug>", "Experiment ID or slug").action(async (idOrSlug) => {
+var complete = new Command("complete").description("Complete/stop an experiment").argument("<id-or-slug>", "Experiment ID or slug").action(async function action10(idOrSlug) {
   const creds2 = requireCredentials();
   const ora2 = (await Promise.resolve().then(() => (init_ora(), ora_exports))).default;
   const spinner = ora2("Completing experiment...").start();
   const exp = await resolveExperiment(idOrSlug);
   if (!exp) {
     spinner.fail(`Experiment "${idOrSlug}" not found`);
-    process.exit(1);
+    fail(this, `Experiment "${idOrSlug}" not found`);
   }
   const res = await completeExperiment(creds2, exp.id);
   if (!res.ok) {
     spinner.fail("Failed to complete experiment");
-    printError(res.error);
-    process.exit(1);
+    fail(this, res.error ?? "Failed to complete experiment", classifyStatus(res.status), res.errorDetails);
   }
-  spinner.succeed(
-    `Experiment "${exp.name}" is now ${statusBadge("completed")}`
-  );
+  output(this, { experiment: { id: exp.id, name: exp.name, status: "completed" } }, () => {
+    spinner.succeed(`Experiment "${exp.name}" is now ${statusBadge("completed")}`);
+  });
 });
-var del = new Command("delete").alias("rm").description("Delete an experiment").argument("<id-or-slug>", "Experiment ID or slug").option("-f, --force", "Skip confirmation").action(async function action8(idOrSlug, opts) {
+var del = new Command("delete").alias("rm").description("Delete an experiment").argument("<id-or-slug>", "Experiment ID or slug").option("-f, --force", "Skip confirmation").action(async function action11(idOrSlug, opts) {
   const creds2 = requireCredentials();
   const ora2 = (await Promise.resolve().then(() => (init_ora(), ora_exports))).default;
   const exp = await resolveExperiment(idOrSlug);
   if (!exp) {
-    printError(`Experiment "${idOrSlug}" not found.`);
-    process.exit(1);
+    fail(this, `Experiment "${idOrSlug}" not found.`);
   }
   if (!opts.force) {
     if (!process.stdin.isTTY || !process.stdout.isTTY) {
@@ -9679,21 +10271,20 @@ var del = new Command("delete").alias("rm").description("Delete an experiment").
   const res = await deleteExperiment(creds2, exp.id);
   if (!res.ok) {
     spinner.fail("Failed to delete experiment");
-    printError(res.error);
-    process.exit(1);
+    fail(this, res.error ?? "Failed to delete experiment", classifyStatus(res.status), res.errorDetails);
   }
-  spinner.succeed(`Experiment "${exp.name}" deleted.`);
+  output(this, { experiment: { id: exp.id, name: exp.name }, deleted: true }, () => spinner.succeed(`Experiment "${exp.name}" deleted.`));
 });
-var pullFilesystem = new Command("pull").description("Pull an experiment as an editable filesystem").argument("<id-or-slug>", "Experiment ID or slug").option("--dir <folder>", "Target folder").action(async (idOrSlug, opts) => {
+var pullFilesystem = new Command("pull").description("Pull an experiment as an editable filesystem").argument("<id-or-slug>", "Experiment ID or slug").option("--out <path>", "Target folder").addOption(new Option("--dir <folder>", "Legacy alias for --out").hideHelp()).action(async function action12(idOrSlug, opts) {
   const creds2 = requireCredentials();
   const ora2 = (await Promise.resolve().then(() => (init_ora(), ora_exports))).default;
   const spinner = ora2("Pulling experiment filesystem...").start();
   try {
     const exp = await resolveExperiment(idOrSlug);
-    if (!exp) throw new Error(`Experiment "${idOrSlug}" not found.`);
+    if (!exp) throw new CliError(`Experiment "${idOrSlug}" not found.`);
     const res = await getExperimentFilesystem(creds2, exp.id);
-    if (!res.ok || !res.data) throw new Error(res.error ?? "Failed to pull experiment filesystem");
-    const folder = folderPath(opts.dir ?? res.data.rootName);
+    if (!res.ok || !res.data) throw new CliError(res.error ?? "Failed to pull experiment filesystem", classifyStatus(res.status), res.errorDetails);
+    const folder = folderPath(opts.out ?? opts.dir ?? res.data.rootName);
     writeExperimentFilesystemFiles(folder, res.data.files);
     writeFilesystemSession(folder, {
       schemaVersion: 1,
@@ -9704,15 +10295,16 @@ var pullFilesystem = new Command("pull").description("Pull an experiment as an e
         res.data.files.map((file) => [file.path, { sha256: file.sha256 }])
       )
     });
-    spinner.succeed(`Pulled ${exp.name}`);
-    console.log(source_default.cyan(folder));
+    output(this, { folder, experimentId: exp.id, files: res.data.files.map((file) => import_node_path4.default.join(folder, file.path)) }, () => {
+      spinner.succeed(`Pulled ${exp.name}`);
+      console.log(source_default.cyan(folder));
+    });
   } catch (error) {
     spinner.fail("Failed to pull experiment filesystem");
-    printError(error instanceof Error ? error.message : String(error));
-    process.exit(1);
+    throw error;
   }
 });
-var planFilesystem = new Command("plan").description("Plan experiment filesystem changes").argument("[folder]", "Experiment filesystem folder", ".").action(async function action9(folderArg) {
+var planFilesystem = new Command("plan").description("Plan experiment filesystem changes").argument("[folder]", "Experiment filesystem folder", ".").action(async function action13(folderArg) {
   const creds2 = requireCredentials();
   try {
     const folder = folderPath(folderArg);
@@ -9723,7 +10315,9 @@ var planFilesystem = new Command("plan").description("Plan experiment filesystem
       fail(this, res.error ?? "Failed to plan experiment filesystem", classifyStatus(res.status), res.errorDetails);
     }
     if (!res.data.ok) {
-      fail(this, "Experiment filesystem plan has errors.", EXIT_CODES.validation, {
+      if (!shouldUseJson(this)) printFilesystemPlan(res.data);
+      const reasons = res.data.blockingIssues?.map((issue) => issue.message) ?? [];
+      fail(this, ["Experiment filesystem plan has errors.", ...reasons].join(" "), EXIT_CODES.validation, {
         errors: res.data.errors,
         plan: res.data
       });
@@ -9734,7 +10328,7 @@ var planFilesystem = new Command("plan").description("Plan experiment filesystem
     fail(this, error instanceof Error ? error.message : String(error));
   }
 });
-var applyFilesystem = new Command("apply").description("Apply experiment filesystem changes to Apex").argument("[folder]", "Experiment filesystem folder", ".").option("-f, --force", "Skip confirmation when QA will be invalidated").action(async function action10(folderArg, opts) {
+var applyFilesystem = new Command("apply").description("Apply experiment filesystem changes to Apex").argument("[folder]", "Experiment filesystem folder", ".").option("-f, --force", "Skip confirmation when QA will be invalidated").action(async function action14(folderArg, opts) {
   const creds2 = requireCredentials();
   const ora2 = (await Promise.resolve().then(() => (init_ora(), ora_exports))).default;
   try {
@@ -9746,7 +10340,9 @@ var applyFilesystem = new Command("apply").description("Apply experiment filesys
       fail(this, planRes.error ?? "Failed to plan experiment filesystem", classifyStatus(planRes.status), planRes.errorDetails);
     }
     if (!planRes.data.ok) {
-      fail(this, "Experiment filesystem plan has errors.", EXIT_CODES.validation, {
+      if (!shouldUseJson(this)) printFilesystemPlan(planRes.data);
+      const reasons = planRes.data.blockingIssues?.map((issue) => issue.message) ?? [];
+      fail(this, ["Experiment filesystem plan has errors.", ...reasons].join(" "), EXIT_CODES.validation, {
         errors: planRes.data.errors,
         plan: planRes.data
       });
@@ -9785,19 +10381,11 @@ var applyFilesystem = new Command("apply").description("Apply experiment filesys
       });
     }
     spinner?.succeed("Applied experiment filesystem");
-    const refreshed = await getExperimentFilesystem(creds2, session.experimentId);
-    if (refreshed.ok && refreshed.data) {
-      writeExperimentFilesystemFiles(folder, refreshed.data.files);
-      writeFilesystemSession(folder, {
-        schemaVersion: 1,
-        baseUrl: creds2.baseUrl,
-        experimentId: session.experimentId,
-        pulledAt: (/* @__PURE__ */ new Date()).toISOString(),
-        files: Object.fromEntries(
-          refreshed.data.files.map((file) => [file.path, { sha256: file.sha256 }])
-        )
-      });
-    }
+    await refreshExperimentFilesystemFolderIfNeeded(
+      creds2,
+      folder,
+      session.experimentId
+    );
     output(this, { folder, experimentId: session.experimentId, applied: true, plan: planRes.data, result: res.data }, () => {
       printFilesystemPlan(planRes.data);
     });
@@ -9806,29 +10394,28 @@ var applyFilesystem = new Command("apply").description("Apply experiment filesys
     fail(this, error instanceof Error ? error.message : String(error));
   }
 });
-var qaStatus = new Command("status").description("Show or create the latest experiment QA run").argument("[folder-or-id]", "Experiment filesystem folder, ID, or slug", ".").option("--json", "Print raw QA run JSON").action(async (target, opts) => {
+var qaStatus = new Command("status").description("Show or create the latest experiment QA run").argument("[folder-or-id]", "Experiment filesystem folder, ID, or slug", ".").option("--json", "Print the QA run in the standard JSON envelope").action(async function action15(target) {
   const creds2 = requireCredentials();
   const ora2 = (await Promise.resolve().then(() => (init_ora(), ora_exports))).default;
   const spinner = ora2("Fetching QA run...").start();
   try {
     const resolved = await resolveExperimentForFilesystemOrId(target);
     const res = await getExperimentQaRun(creds2, resolved.experimentId);
-    if (!res.ok || !res.data) throw new Error(res.error ?? "Failed to fetch QA run");
+    if (!res.ok || !res.data) throw new CliError(res.error ?? "Failed to fetch QA run", classifyStatus(res.status), res.errorDetails);
     spinner.stop();
-    printQaRun(res.data.run, opts.json === true);
     await refreshExperimentFilesystemFolderIfNeeded(
       creds2,
       resolved.folder,
       resolved.experimentId
     );
+    output(this, { run: res.data.run }, () => printQaRun(res.data.run));
   } catch (error) {
     spinner.fail("Failed to fetch QA run");
-    printError(error instanceof Error ? error.message : String(error));
-    process.exit(1);
+    throw error;
   }
 });
 var qaCheck = new Command("check").description("Update one QA checklist item with status, notes, and evidence").argument("[folder-or-id]", "Experiment filesystem folder, ID, or slug", ".").requiredOption("--item <id>", "Checklist item id").requiredOption("--status <status>", "pending|pass|warning|fail|accepted|skipped").option("--notes <text>", "Checklist notes").option("--evidence <json-or-path>", "Evidence JSON object or @path/to/evidence.json").option("--json", "Print raw QA run JSON").action(
-  async (target, opts) => {
+  async function action16(target, opts) {
     const creds2 = requireCredentials();
     const ora2 = (await Promise.resolve().then(() => (init_ora(), ora_exports))).default;
     const spinner = ora2("Updating QA checklist...").start();
@@ -9849,23 +10436,25 @@ var qaCheck = new Command("check").description("Update one QA checklist item wit
         notes: opts.notes,
         evidence
       });
-      if (!res.ok || !res.data) throw new Error(res.error ?? "Failed to update QA run");
-      spinner.succeed("Updated QA checklist");
-      printQaRun(res.data.run, opts.json === true);
+      if (!res.ok || !res.data) throw new CliError(res.error ?? "Failed to update QA run", classifyStatus(res.status), res.errorDetails);
+      const run3 = res.data.run;
       await refreshExperimentFilesystemFolderIfNeeded(
         creds2,
         resolved.folder,
         resolved.experimentId
       );
+      output(this, { run: run3 }, () => {
+        spinner.succeed("Updated QA checklist");
+        printQaRun(run3);
+      });
     } catch (error) {
       spinner.fail("Failed to update QA checklist");
-      printError(error instanceof Error ? error.message : String(error));
-      process.exit(1);
+      throw error;
     }
   }
 );
 var qaNotes = new Command("notes").description("Update QA run notes or acceptance criteria summary").argument("[folder-or-id]", "Experiment filesystem folder, ID, or slug", ".").option("--notes <text>", "QA run notes").option("--acceptance <text>", "Acceptance criteria summary").option("--json", "Print raw QA run JSON").action(
-  async (target, opts) => {
+  async function action17(target, opts) {
     const creds2 = requireCredentials();
     const ora2 = (await Promise.resolve().then(() => (init_ora(), ora_exports))).default;
     const spinner = ora2("Updating QA notes...").start();
@@ -9883,64 +10472,175 @@ var qaNotes = new Command("notes").description("Update QA run notes or acceptanc
         acceptanceCriteriaSummary: opts.acceptance ?? null
       };
       const res = await updateExperimentQaRun(creds2, resolved.experimentId, body5);
-      if (!res.ok || !res.data) throw new Error(res.error ?? "Failed to update QA notes");
-      spinner.succeed("Updated QA notes");
-      printQaRun(res.data.run, opts.json === true);
+      if (!res.ok || !res.data) throw new CliError(res.error ?? "Failed to update QA notes", classifyStatus(res.status), res.errorDetails);
+      const run3 = res.data.run;
       await refreshExperimentFilesystemFolderIfNeeded(
         creds2,
         resolved.folder,
         resolved.experimentId
       );
+      output(this, { run: run3 }, () => {
+        spinner.succeed("Updated QA notes");
+        printQaRun(run3);
+      });
     } catch (error) {
       spinner.fail("Failed to update QA notes");
-      printError(error instanceof Error ? error.message : String(error));
-      process.exit(1);
+      throw error;
     }
   }
 );
-var qaApprove = new Command("approve").description("Mark QA done after the checklist gates are ready").argument("[folder-or-id]", "Experiment filesystem folder, ID, or slug", ".").action(async (target) => {
+var qaApprove = new Command("approve").description("Mark QA done after the checklist gates are ready").argument("[folder-or-id]", "Experiment filesystem folder, ID, or slug", ".").action(async function action18(target) {
   const creds2 = requireCredentials();
   const ora2 = (await Promise.resolve().then(() => (init_ora(), ora_exports))).default;
   const spinner = ora2("Approving QA...").start();
   try {
     const resolved = await resolveExperimentForFilesystemOrId(target);
     const res = await approveExperimentQa(creds2, resolved.experimentId);
-    if (!res.ok) throw new Error(res.error ?? "Failed to approve QA");
-    spinner.succeed(`QA marked done for ${resolved.label}`);
+    if (!res.ok) throw new CliError(res.error ?? "Failed to approve QA", classifyStatus(res.status), res.errorDetails);
     await refreshExperimentFilesystemFolderIfNeeded(
       creds2,
       resolved.folder,
       resolved.experimentId
     );
+    output(this, { experimentId: resolved.experimentId, qaStatus: "done" }, () => spinner.succeed(`QA marked done for ${resolved.label}`));
   } catch (error) {
     spinner.fail("Failed to approve QA");
-    printError(error instanceof Error ? error.message : String(error));
-    process.exit(1);
+    throw error;
   }
 });
-var qaReopen = new Command("reopen").description("Reopen QA and clear scheduled launch state").argument("[folder-or-id]", "Experiment filesystem folder, ID, or slug", ".").action(async (target) => {
+var qaReopen = new Command("reopen").description("Reopen QA and clear scheduled launch state").argument("[folder-or-id]", "Experiment filesystem folder, ID, or slug", ".").action(async function action19(target) {
   const creds2 = requireCredentials();
   const ora2 = (await Promise.resolve().then(() => (init_ora(), ora_exports))).default;
   const spinner = ora2("Reopening QA...").start();
   try {
     const resolved = await resolveExperimentForFilesystemOrId(target);
     const res = await reopenExperimentQa(creds2, resolved.experimentId);
-    if (!res.ok) throw new Error(res.error ?? "Failed to reopen QA");
-    spinner.succeed(`QA reopened for ${resolved.label}`);
+    if (!res.ok) throw new CliError(res.error ?? "Failed to reopen QA", classifyStatus(res.status), res.errorDetails);
     await refreshExperimentFilesystemFolderIfNeeded(
       creds2,
       resolved.folder,
       resolved.experimentId
     );
+    output(this, { experimentId: resolved.experimentId, qaStatus: "open" }, () => spinner.succeed(`QA reopened for ${resolved.label}`));
   } catch (error) {
     spinner.fail("Failed to reopen QA");
-    printError(error instanceof Error ? error.message : String(error));
-    process.exit(1);
+    throw error;
   }
 });
 var qa = new Command("qa").description("Manage experiment QA runs from the CLI").addCommand(qaStatus).addCommand(qaCheck).addCommand(qaNotes).addCommand(qaApprove).addCommand(qaReopen);
-var experimentsCommand = new Command("experiments").alias("exp").description("Manage experiments").addCommand(list).addCommand(get).addCommand(results).addCommand(create).addCommand(start).addCommand(pause).addCommand(complete).addCommand(del).addCommand(pullFilesystem).addCommand(planFilesystem).addCommand(applyFilesystem).addCommand(qa);
-
+var SCREENSHOT_DEVICES = ["desktop_chrome", "iphone_15_pro", "galaxy_s24", "ipad_pro", "desktop_safari"];
+var safeFilenamePart = (value) => value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "") || "screenshot";
+var commaList = (value) => value.split(",").map((item) => item.trim()).filter(Boolean);
+var screenshots = new Command("screenshots").description("Force-assign every capture, including control, to its variation server-side for deterministic screenshots").argument("<experimentRef>", "Experiment ID or slug").option("--url <target>", "Target URL override (not supported by the current v1 API)").option("--devices <list>", `Comma-separated devices (default: ${SCREENSHOT_DEVICES.join(",")})`).option("--variations <list>", "Comma-separated treatment IDs, slugs, or names; control is always included and force-assigned").option("--out <dir>", "Download directory", ".").option("--json", "Print the completed raw job payload with signed URLs").option("--timeout <seconds>", "Maximum wait for completion; finished results are always downloaded", "300").action(async function action20(experimentRef, opts) {
+  if (opts.url) fail(this, "--url is not supported by the current screenshot v1 API.", EXIT_CODES.validation);
+  const timeoutSeconds = Number(opts.timeout);
+  if (!Number.isFinite(timeoutSeconds) || timeoutSeconds <= 0) fail(this, "--timeout must be a positive number of seconds.", EXIT_CODES.validation);
+  const experiment = await resolveExperiment(experimentRef);
+  if (!experiment?.variations?.length) fail(this, "Experiment has no variations to capture.", EXIT_CODES.validation);
+  const devices = opts.devices ? commaList(opts.devices) : SCREENSHOT_DEVICES;
+  if (!devices.length) fail(this, "--devices must contain at least one device.", EXIT_CODES.validation);
+  const unknownDevices = devices.filter((device) => !SCREENSHOT_DEVICES.includes(device));
+  if (unknownDevices.length) fail(this, `Unknown screenshot device(s): ${unknownDevices.join(", ")}`, EXIT_CODES.validation);
+  const requested = opts.variations ? commaList(opts.variations) : [];
+  const control = experiment.variations.find((variation) => variation.is_control);
+  if (!control) fail(this, "Experiment has no control variation.", EXIT_CODES.validation);
+  const matchedById = /* @__PURE__ */ new Map();
+  const unmatched = [];
+  for (const ref of requested) {
+    const variation = experiment.variations.find((candidate) => ref === candidate.id || ref === candidate.slug || ref.toLowerCase() === candidate.name.toLowerCase());
+    if (variation) matchedById.set(variation.id, variation);
+    else unmatched.push(ref);
+  }
+  if (unmatched.length) fail(this, `Unknown --variations value(s): ${unmatched.join(", ")}`, EXIT_CODES.validation);
+  const selected = requested.length ? [...matchedById.values()] : experiment.variations;
+  const variationIds = [.../* @__PURE__ */ new Set([control.id, ...selected.map((variation) => variation.id)])];
+  const creds2 = requireCredentials();
+  const created = await createExperimentScreenshots(creds2, experiment.id, { devices, variation_ids: variationIds });
+  if (!created.ok || !created.data) fail(this, created.error ?? "Failed to create screenshot job", classifyStatus(created.status), created.errorDetails);
+  let job = created.data;
+  const deadline = Date.now() + timeoutSeconds * 1e3;
+  let delayMs = process.env.APEX_CLI_MOCK_API === "1" ? 1 : 1e3;
+  let consecutiveTransientFailures = 0;
+  while (job.status === "queued" || job.status === "processing") {
+    if (Date.now() >= deadline) fail(this, `Screenshot job ${job.job_id} timed out after ${timeoutSeconds}s.`);
+    await new Promise((resolve) => setTimeout(resolve, Math.min(delayMs, Math.max(0, deadline - Date.now()))));
+    if (Date.now() >= deadline) fail(this, `Screenshot job ${job.job_id} timed out after ${timeoutSeconds}s.`);
+    let polled;
+    try {
+      polled = await getScreenshotJob(creds2, job.job_id, Math.max(1, deadline - Date.now()));
+    } catch (error) {
+      if (Date.now() >= deadline) fail(this, `Screenshot job ${job.job_id} timed out after ${timeoutSeconds}s.`);
+      consecutiveTransientFailures += 1;
+      if (consecutiveTransientFailures > 3) throw error;
+      delayMs = Math.min(Math.round(delayMs * 1.6), 1e4);
+      continue;
+    }
+    const polledToTerminalState = polled.ok && polled.data && polled.data.status !== "queued" && polled.data.status !== "processing";
+    if (!polledToTerminalState && Date.now() >= deadline) {
+      fail(this, `Screenshot job ${job.job_id} timed out after ${timeoutSeconds}s.`);
+    }
+    if (!polled.ok || !polled.data) {
+      const transient = polled.status === 429 || polled.status >= 500;
+      if (!transient || ++consecutiveTransientFailures > 3) {
+        fail(this, polled.error ?? "Failed to poll screenshot job", classifyStatus(polled.status), polled.errorDetails);
+      }
+      delayMs = Math.min(Math.round(delayMs * 1.6), 1e4);
+      continue;
+    }
+    consecutiveTransientFailures = 0;
+    job = polled.data;
+    delayMs = Math.min(Math.round(delayMs * 1.6), 1e4);
+  }
+  if (job.status === "failed") fail(this, `Screenshot job failed: ${job.error ?? "unknown error"}`);
+  const outputDir = import_node_path4.default.resolve(process.cwd(), opts.out);
+  import_node_fs6.default.mkdirSync(outputDir, { recursive: true });
+  const rows = [];
+  const errors = [];
+  const usedFilenames = /* @__PURE__ */ new Set();
+  for (const variationId of variationIds) {
+    const variation = experiment.variations.find((item) => item.id === variationId);
+    for (const device of devices) {
+      const url = job.results?.[variationId]?.[device];
+      if (!url) {
+        errors.push(`${variation.name}/${device}: no screenshot returned`);
+        continue;
+      }
+      const baseFilename = `${safeFilenamePart(experiment.slug ?? experiment.name)}-${safeFilenamePart(variation.slug ?? variation.name)}-${safeFilenamePart(device)}`;
+      let filename = `${baseFilename}.png`;
+      if (usedFilenames.has(filename)) {
+        const suffix = variation.id.replace(/[^a-z0-9]/gi, "").slice(-8).toLowerCase();
+        filename = `${baseFilename}-${suffix}.png`;
+        let collisionIndex = 2;
+        while (usedFilenames.has(filename)) filename = `${baseFilename}-${suffix}-${collisionIndex++}.png`;
+      }
+      usedFilenames.add(filename);
+      try {
+        const response = await fetch(url);
+        if (!response.ok) throw new Error(`HTTP ${response.status}`);
+        import_node_fs6.default.writeFileSync(import_node_path4.default.join(outputDir, filename), Buffer.from(await response.arrayBuffer()));
+        rows.push([variation.name, device, filename]);
+      } catch (error) {
+        errors.push(`${variation.name}/${device}: ${error instanceof Error ? error.message : String(error)}`);
+      }
+    }
+  }
+  if (!rows.length) fail(this, `No screenshots succeeded. ${errors.join("; ")}`);
+  if (errors.length) {
+    console.error(source_default.yellow(`Partial result: ${rows.length} saved, ${errors.length} failed.`));
+    errors.forEach((error) => console.error(`  - ${error}`));
+  }
+  output(this, job, () => {
+    printTable(["VARIATION", "DEVICE", "FILE"], rows, [24, 20, 48]);
+  });
+});
+var experimentsCommand = new Command("experiments").alias("exp").description("Manage experiments").addCommand(list).addCommand(get).addCommand(results).addCommand(create).addCommand(start).addCommand(pause).addCommand(complete).addCommand(del).addCommand(pullFilesystem).addCommand(planFilesystem).addCommand(applyFilesystem).addCommand(screenshots).addCommand(qa).addHelpText("after", `
+Examples:
+  apex experiments list --status running
+  apex experiments get checkout-banner
+  apex experiments pull checkout-banner --out ./checkout-banner
+  apex experiments plan ./checkout-banner --json
+`);
+
 // src/commands/push.ts
 init_source();
 var import_node_fs7 = __toESM(require("node:fs"));
@@ -10014,7 +10714,7 @@ function isRecord(value) {
 }
 var pushCommand = new Command("push").description(
   "Push experiment definitions from config file to the API (idempotent by slug)"
-).option("-c, --config <path>", "Config file path").option("--dry-run", "Show what would be pushed without making changes").action(async function action11(opts) {
+).option("-c, --config <path>", "Config file path").option("--dry-run", "Show what would be pushed without making changes").action(async function action21(opts) {
   const creds2 = requireCredentials();
   const ora2 = (await Promise.resolve().then(() => (init_ora(), ora_exports))).default;
   const configPath = opts.config ?? findConfigPath();
@@ -10154,7 +10854,7 @@ var previewCommand = new Command("preview").description("Open QA preview URL for
     }
     const data = created.data;
     output(previewCommand, data, () => console.log(source_default.cyan(data.preview_url)));
-    if (opts.open !== false) {
+    if (opts.open !== false && !shouldUseJson(previewCommand)) {
       try {
         const open2 = (await Promise.resolve().then(() => (init_open(), open_exports))).default;
         await open2(data.preview_url);
@@ -10170,7 +10870,7 @@ var previewCommand = new Command("preview").description("Open QA preview URL for
     const res = await getExperiment(creds2, idOrSlug);
     if (!res.ok) {
       spinner.fail(`Experiment "${idOrSlug}" not found`);
-      process.exit(1);
+      fail(previewCommand, res.error ?? `Experiment "${idOrSlug}" not found`, classifyStatus(res.status), res.errorDetails);
     }
     exp = res.data;
   } else {
@@ -10178,13 +10878,13 @@ var previewCommand = new Command("preview").description("Open QA preview URL for
     const res = await getExperimentBySlug(creds2, slug);
     if (!res.ok) {
       spinner.fail(`Experiment "${slug}" not found`);
-      process.exit(1);
+      fail(previewCommand, res.error ?? `Experiment "${slug}" not found`, classifyStatus(res.status), res.errorDetails);
     }
     exp = res.data;
   }
   if (!exp.variations || exp.variations.length === 0) {
     spinner.fail("Experiment has no variations");
-    process.exit(1);
+    fail(previewCommand, "Experiment has no variations");
   }
   let variation;
   if (variationId) {
@@ -10193,12 +10893,9 @@ var previewCommand = new Command("preview").description("Open QA preview URL for
     );
     if (!variation) {
       spinner.fail(`Variation "${variationId}" not found`);
-      console.log(
-        source_default.dim(
-          `Available: ${exp.variations.map((v) => `${v.name} (${v.id})`).join(", ")}`
-        )
-      );
-      process.exit(1);
+      fail(previewCommand, `Variation "${variationId}" not found`, void 0, {
+        availableVariations: exp.variations.map((v) => ({ id: v.id, name: v.name, slug: v.slug }))
+      });
     }
   } else {
     variation = exp.variations.find((v) => !v.is_control) ?? exp.variations[0];
@@ -10206,30 +10903,28 @@ var previewCommand = new Command("preview").description("Open QA preview URL for
   spinner.stop();
   const storeUrl = exp.store_url ?? opts?.storeUrl;
   if (!storeUrl) {
-    printError(
-      'Experiment is missing "store_url". Set it on the experiment or pass --store-url <url>.'
-    );
-    process.exit(1);
+    fail(previewCommand, 'Experiment is missing "store_url". Set it on the experiment or pass --store-url <url>.');
   }
   let previewUrl;
   try {
     previewUrl = new URL(storeUrl);
   } catch {
-    printError('Invalid store URL. Pass an absolute URL like "https://example.com/products/item".');
-    process.exit(1);
+    fail(previewCommand, 'Invalid store URL. Pass an absolute URL like "https://example.com/products/item".');
   }
   previewUrl.searchParams.set("drip_force", `${exp.id}:${variation.id}`);
   previewUrl.searchParams.set("drip_experiment_id", exp.id);
   previewUrl.searchParams.set("drip_variation_id", variation.id);
   previewUrl.searchParams.set("drip_qa", "1");
   previewUrl.searchParams.set("drip_debug", "1");
-  console.log();
-  console.log(source_default.bold(`Preview: ${exp.name}`));
-  console.log(`Variation: ${variation.name}${variation.is_control ? " (control)" : ""}`);
-  console.log();
-  console.log(source_default.cyan(previewUrl.toString()));
-  console.log();
-  if (opts?.open !== false) {
+  output(previewCommand, { experimentId: exp.id, variationId: variation.id, previewUrl: previewUrl.toString() }, () => {
+    console.log();
+    console.log(source_default.bold(`Preview: ${exp.name}`));
+    console.log(`Variation: ${variation.name}${variation.is_control ? " (control)" : ""}`);
+    console.log();
+    console.log(source_default.cyan(previewUrl.toString()));
+    console.log();
+  });
+  if (opts?.open !== false && !shouldUseJson(previewCommand)) {
     try {
       const open2 = (await Promise.resolve().then(() => (init_open(), open_exports))).default;
       await open2(previewUrl.toString());
@@ -10344,7 +11039,7 @@ async function uploadVersion(params) {
     })
   );
   const res = await uploadHarnessVersion(creds2, params.session.sessionId, form);
-  if (!res.ok) throw new Error(res.error ?? "Failed to upload harness version");
+  if (!res.ok) throw new CliError(res.error ?? "Failed to upload harness version", classifyStatus(res.status), res.errorDetails);
   return res.data;
 }
 async function createSession(folder) {
@@ -10362,40 +11057,43 @@ async function createSession(folder) {
     resetJs: cleanupResetJs(experiment),
     antiFlickerSelectors: apex.antiFlickerSelectors ?? []
   });
-  if (!res.ok) throw new Error(res.error ?? "Failed to create harness session");
+  if (!res.ok) throw new CliError(res.error ?? "Failed to create harness session", classifyStatus(res.status), res.errorDetails);
   return { session: res.data, apex, experiment };
 }
 var harnessCommand = new Command("harness").description("Develop AB Test Harness projects through Apex live QA sessions");
-harnessCommand.command("init").argument("<folder>", "AB Test Harness experiment folder").option("--force", "Overwrite existing apex.harness.json").action((folderArg, opts) => {
+harnessCommand.command("init").argument("<folder>", "AB Test Harness experiment folder").option("--force", "Overwrite existing apex.harness.json").action(function action22(folderArg, opts) {
   const folder = resolveFolder(folderArg);
   const targetPath = apexConfigPath(folder);
   if (import_node_fs8.default.existsSync(targetPath) && !opts.force) {
-    printError(`${targetPath} already exists. Use --force to overwrite.`);
-    process.exit(1);
+    fail(this, `${targetPath} already exists. Use --force to overwrite.`, EXIT_CODES.conflict);
   }
   const { apex } = loadHarnessConfig(folder);
   import_node_fs8.default.writeFileSync(targetPath, `${JSON.stringify(apex, null, 2)}
 `, "utf8");
-  printSuccess(`Created ${targetPath}`);
+  output(this, { folder, configPath: targetPath, experiment: apex.experimentSlug, variation: apex.variationSlug }, () => printSuccess(`Created ${targetPath}`));
 });
-harnessCommand.command("dev").argument("<folder>", "AB Test Harness experiment folder").option("--no-open", "Print preview URL instead of opening it").action(async (folderArg, opts) => {
+harnessCommand.command("dev").argument("<folder>", "AB Test Harness experiment folder").option("--no-open", "Print preview URL instead of opening it").action(async function action23(folderArg, opts) {
   const folder = resolveFolder(folderArg);
   const created = await createSession(folder);
   await runAbHarness(["build", folder], folder);
   const version = await uploadVersion({ ...created, folder });
-  console.log(source_default.bold("\nApex Harness Session"));
-  console.log(`Experiment: ${created.session.experimentId}`);
-  console.log(`Variation:   ${created.session.variationId}`);
-  console.log(`Version:     ${version.version}`);
-  console.log(source_default.cyan(created.session.previewUrl));
-  console.log();
+  output(this, { folder, sessionId: created.session.sessionId, experimentId: created.session.experimentId, variationId: created.session.variationId, version: version.version, previewUrl: created.session.previewUrl }, () => {
+    console.log(source_default.bold("\nApex Harness Session"));
+    console.log(`Experiment: ${created.session.experimentId}`);
+    console.log(`Variation:   ${created.session.variationId}`);
+    console.log(`Version:     ${version.version}`);
+    console.log(source_default.cyan(created.session.previewUrl));
+    console.log();
+  });
   if (opts.open !== false) {
     const open2 = (await Promise.resolve().then(() => (init_open(), open_exports))).default;
     await open2(created.session.previewUrl);
   }
   let uploading = false;
   let queued = false;
+  let closing = false;
   const rebuild = async () => {
+    if (closing) return;
     if (uploading) {
       queued = true;
       return;
@@ -10404,12 +11102,12 @@ harnessCommand.command("dev").argument("<folder>", "AB Test Harness experiment f
     try {
       await runAbHarness(["build", folder], folder);
       const next = await uploadVersion({ ...created, folder });
-      console.log(source_default.dim(`[harness] uploaded version ${next.version}`));
+      console.error(source_default.dim(`[harness] uploaded version ${next.version}`));
     } catch (error) {
       printWarning(error instanceof Error ? error.message : String(error));
     } finally {
       uploading = false;
-      if (queued) {
+      if (queued && !closing) {
         queued = false;
         void rebuild();
       }
@@ -10423,19 +11121,22 @@ harnessCommand.command("dev").argument("<folder>", "AB Test Harness experiment f
     debounce = setTimeout(() => void rebuild(), 300);
   });
   process.on("SIGINT", () => {
+    closing = true;
+    queued = false;
+    if (debounce) clearTimeout(debounce);
     watcher.close();
-    process.exit(0);
+    process.exitCode = 0;
   });
 });
-harnessCommand.command("publish").argument("<folder>", "AB Test Harness experiment folder").action(async (folderArg) => {
+harnessCommand.command("publish").argument("<folder>", "AB Test Harness experiment folder").action(async function action24(folderArg) {
   const folder = resolveFolder(folderArg);
   const created = await createSession(folder);
   await runAbHarness(["verify", folder], folder);
   await runAbHarness(["build", folder], folder);
   await uploadVersion({ ...created, folder });
   const res = await publishHarnessSession(requireCredentials(), created.session.sessionId);
-  if (!res.ok) throw new Error(res.error ?? "Failed to publish harness session");
-  printSuccess("Published latest harness artifact to the Apex draft variation.");
+  if (!res.ok) throw new CliError(res.error ?? "Failed to publish harness session", classifyStatus(res.status), res.errorDetails);
+  output(this, { folder, sessionId: created.session.sessionId, experimentId: created.session.experimentId, variationId: created.session.variationId, published: true }, () => printSuccess("Published latest harness artifact to the Apex draft variation."));
 });
 
 // src/commands/operator.ts
@@ -10444,6 +11145,47 @@ var import_node_crypto4 = __toESM(require("node:crypto"));
 var import_node_fs9 = __toESM(require("node:fs"));
 var import_node_path7 = __toESM(require("node:path"));
 var CANONICAL_FILE_RE = /^(src\/(?:index\.js|index\.scss|info\.js|mutations\.json)|experiment\.config\.json|metrics\.json|targeting\.json|dev-doc\.md|brand\.md|goals\/[a-zA-Z0-9_.-]+\.json|segments\/[a-zA-Z0-9_.-]+\.json|network\/[a-zA-Z0-9_.-]+\.recipe\.json)$/;
+function workspaceIssueFile(field, evidence) {
+  if (field === "custom_js" || field === "reset_js") return "src/index.js";
+  if (field === "custom_css") return "src/index.css";
+  if (field === "mutations" || field.startsWith("mutations[")) {
+    return "src/mutations.json";
+  }
+  if (typeof evidence.selector === "string" && evidence.selector.trim()) {
+    return "src/mutations.json";
+  }
+  if (field === "anti_flicker_selectors") return "experiment.config.json";
+  return null;
+}
+function formatWorkspaceBlockingIssues(value) {
+  if (!value || typeof value !== "object") return null;
+  const issues = value.blockingIssues;
+  if (!Array.isArray(issues) || issues.length === 0) return null;
+  return issues.map((rawIssue, index) => {
+    const issue = rawIssue && typeof rawIssue === "object" ? rawIssue : {};
+    const evidence = issue.evidence && typeof issue.evidence === "object" ? issue.evidence : {};
+    const field = typeof issue.field === "string" ? issue.field : "";
+    const file = workspaceIssueFile(field, evidence);
+    const selector = typeof evidence.selector === "string" && evidence.selector.trim() ? evidence.selector.trim() : null;
+    const lines = [
+      `[${index + 1}] ${typeof issue.message === "string" ? issue.message : "Workspace build blocked."}`,
+      file ? `    File: ${file}${field && !selector ? ` (${field})` : ""}` : `    Field: ${field || "workspace"}`
+    ];
+    if (selector) lines.push(`    Selector: ${selector}`);
+    const construct = typeof evidence.construct === "string" ? evidence.construct : null;
+    const snippet2 = typeof evidence.snippet === "string" ? evidence.snippet : typeof evidence.url === "string" ? evidence.url : null;
+    if (construct) lines.push(`    Match: ${construct}`);
+    if (snippet2) lines.push(`    Evidence: ${snippet2}`);
+    if (typeof evidence.line === "number") {
+      lines.push(
+        `    Location: line ${evidence.line}, column ${typeof evidence.column === "number" ? evidence.column : 0}`
+      );
+    } else if (typeof evidence.matchIndex === "number") {
+      lines.push(`    Location: mutation character ${evidence.matchIndex}`);
+    }
+    return lines.join("\n");
+  }).join("\n");
+}
 function sha256Text2(value) {
   return import_node_crypto4.default.createHash("sha256").update(value).digest("hex");
 }
@@ -10475,9 +11217,11 @@ function writeJsonFile(filePath, value) {
 function readSession(folder) {
   const session = readJsonFile(sessionPath(folder));
   if (!session) {
-    throw new Error(
-      `Missing ${sessionPath(folder)}. Run apex workspace checkout first.`
-    );
+    const filesystemMarker = import_node_path7.default.join(apexDir(folder), "experiment-filesystem.json");
+    if (import_node_fs9.default.existsSync(filesystemMarker)) {
+      throw new Error("This folder is an experiment filesystem (apex experiments \u2026), not an operator workspace \u2014 run `apex experiments plan` here, or `apex workspace checkout` into a different folder.");
+    }
+    throw new Error(`Missing ${sessionPath(folder)}. Run apex workspace checkout first.`);
   }
   return session;
 }
@@ -10611,7 +11355,7 @@ async function createExactHarnessSession(folder, session) {
     targetUrl,
     antiFlickerSelectors: []
   });
-  if (!res.ok || !res.data) throw new Error(res.error ?? "Failed to create harness session");
+  if (!res.ok || !res.data) throw new CliError(res.error ?? "Failed to create harness session", classifyStatus(res.status), res.errorDetails);
   return res.data;
 }
 async function uploadCurrentArtifactVersion(folder, sessionId) {
@@ -10638,7 +11382,7 @@ async function uploadCurrentArtifactVersion(folder, sessionId) {
   }
   form.append("manifest", JSON.stringify(manifest));
   const res = await uploadHarnessVersion(creds2, sessionId, form);
-  if (!res.ok || !res.data) throw new Error(res.error ?? "Failed to upload harness artifact");
+  if (!res.ok || !res.data) throw new CliError(res.error ?? "Failed to upload harness artifact", classifyStatus(res.status), res.errorDetails);
   return res.data;
 }
 async function syncChangedFiles(folder, session) {
@@ -10662,18 +11406,28 @@ async function syncChangedFiles(folder, session) {
         title: `CLI sync ${file.path}`
       }
     );
-    if (!res.ok) throw new Error(res.error ?? `Failed to upload ${file.path}`);
+    if (!res.ok) throw new CliError(res.error ?? `Failed to upload ${file.path}`, classifyStatus(res.status), res.errorDetails);
   }
   return { localFiles, changed };
 }
-async function runPublish(folderArg) {
+async function runPublish(folderArg, opts = {}) {
   const folder = folderPath2(folderArg);
   const session = readSession(folder);
   const { localFiles, changed } = await syncChangedFiles(folder, session);
   const creds2 = requireCredentials();
-  const build = await buildOperatorWorkspace(creds2, session.experimentId, session.variationId);
+  const build = await buildOperatorWorkspace(
+    creds2,
+    session.experimentId,
+    session.variationId,
+    opts.allowGoalWrites ? { allowGoalWrites: true } : void 0
+  );
   if (!build.ok || !build.data?.ok) {
-    throw new Error(build.error ?? JSON.stringify(build.data ?? { error: "Workspace build failed" }, null, 2));
+    const issueDetails = formatWorkspaceBlockingIssues(build.data);
+    throw new CliError(
+      issueDetails ?? build.error ?? JSON.stringify(build.data ?? { error: "Workspace build failed" }, null, 2),
+      classifyStatus(build.status),
+      build.errorDetails
+    );
   }
   let external = null;
   if (shouldUseExternalDelivery(folder)) {
@@ -10698,32 +11452,50 @@ async function runPublish(folderArg) {
   }
   return { build: build.data, changed, external };
 }
-var operatorCommand = new Command("workspace").alias("operator").description("Check out, preview, and publish Apex draft workspace files");
-operatorCommand.command("checkout").argument("<experiment-id>", "Apex experiment ID").requiredOption("--variation <id-or-slug>", "Variation ID, slug, or name").option("--dir <folder>", "Target folder").action(async (experimentId, opts) => {
+var WORKSPACE_CHECKOUT_DIR_REMOVAL_VERSION = "0.4.0";
+var operatorCommand = new Command("workspace").alias("operator").description("Check out, preview, and publish Apex draft workspace files").addHelpText("after", `
+Examples:
+  apex workspace checkout <experiment-id> --variation treatment --out ./workspace
+  apex workspace status ./workspace --json
+  apex workspace dev ./workspace --no-open
+  apex workspace publish ./workspace
+`);
+operatorCommand.command("checkout").argument("<experiment-id>", "Apex experiment ID").requiredOption("--variation <id-or-slug>", "Variation ID, slug, or name").option("--out <path>", "Target folder").addOption(new Option("--dir <folder>", "Legacy alias for --out").hideHelp()).action(async function action25(experimentId, opts) {
   try {
     const creds2 = requireCredentials();
     const expRes = await getExperiment(creds2, experimentId);
-    if (!expRes.ok || !expRes.data) throw new Error(expRes.error ?? "Experiment not found");
-    const variation = resolveVariation(expRes.data, opts.variation);
-    const folder = folderPath2(opts.dir ?? slugify2(`${expRes.data.name}-${variation.name}`, "apex-operator"));
-    const workspace = await getOperatorWorkspace(creds2, expRes.data.id, variation.id);
-    if (!workspace.ok || !workspace.data) throw new Error(workspace.error ?? "Could not load workspace");
+    if (!expRes.ok || !expRes.data) throw new CliError(expRes.error ?? "Experiment not found", classifyStatus(expRes.status), expRes.errorDetails);
+    const experiment = expRes.data;
+    const variation = resolveVariation(experiment, opts.variation);
+    if (opts.dir !== void 0) {
+      process.stderr.write(`Warning: --dir is deprecated for apex workspace checkout; use --out instead. --dir will be removed in v${WORKSPACE_CHECKOUT_DIR_REMOVAL_VERSION}.
+`);
+      markDeprecatedInvocation({
+        option: "--dir",
+        replacement: "--out",
+        removalVersion: WORKSPACE_CHECKOUT_DIR_REMOVAL_VERSION
+      });
+    }
+    const folder = folderPath2(opts.out ?? opts.dir ?? slugify2(`${experiment.name}-${variation.name}`, "apex-operator"));
+    const workspace = await getOperatorWorkspace(creds2, experiment.id, variation.id);
+    if (!workspace.ok || !workspace.data) throw new CliError(workspace.error ?? "Could not load workspace", classifyStatus(workspace.status), workspace.errorDetails);
     import_node_fs9.default.mkdirSync(folder, { recursive: true });
     writeWorkspaceFiles(folder, workspace.data);
     writeSession(folder, sessionFromWorkspace({
       credsBaseUrl: creds2.baseUrl,
-      experimentId: expRes.data.id,
+      experimentId: experiment.id,
       variationId: variation.id,
       workspace: workspace.data
     }));
-    printSuccess(`Checked out ${expRes.data.name} / ${variation.name}`);
-    console.log(source_default.cyan(folder));
+    output(this, { folder, experimentId: experiment.id, variationId: variation.id, files: workspace.data.files.map((file) => file.path) }, () => {
+      printSuccess(`Checked out ${experiment.name} / ${variation.name}`);
+      console.log(source_default.cyan(folder));
+    });
   } catch (error) {
-    printError(error instanceof Error ? error.message : String(error));
-    process.exit(1);
+    throw error;
   }
 });
-operatorCommand.command("status").argument("[folder]", "Operator workspace folder", ".").action(function action12(folderArg) {
+operatorCommand.command("status").argument("[folder]", "Operator workspace folder", ".").action(function action26(folderArg) {
   try {
     const folder = folderPath2(folderArg);
     const session = readSession(folder);
@@ -10751,18 +11523,12 @@ operatorCommand.command("status").argument("[folder]", "Operator workspace folde
     fail(this, error instanceof Error ? error.message : String(error));
   }
 });
-operatorCommand.command("dev").argument("[folder]", "Operator workspace folder", ".").option("--no-open", "Print preview URL instead of opening it").option("--once", "Upload one preview version and exit").action(async (folderArg, opts) => {
+operatorCommand.command("dev").argument("[folder]", "Operator workspace folder", ".").option("--no-open", "Print preview URL instead of opening it").option("--once", "Upload one preview version and exit").action(async function action27(folderArg, opts) {
   try {
     const folder = folderPath2(folderArg);
     const session = readSession(folder);
     const harnessSession = await createExactHarnessSession(folder, session);
     const version = await uploadCurrentArtifactVersion(folder, harnessSession.sessionId);
-    console.log(source_default.bold("\nApex Workspace Preview"));
-    console.log(`Experiment: ${harnessSession.experimentId}`);
-    console.log(`Variation:  ${harnessSession.variationId}`);
-    console.log(`Version:    ${version.version}`);
-    console.log(source_default.cyan(harnessSession.previewUrl));
-    console.log();
     import_node_fs9.default.mkdirSync(apexDir(folder), { recursive: true });
     writeJsonFile(import_node_path7.default.join(apexDir(folder), "harness-session.json"), {
       sessionId: harnessSession.sessionId,
@@ -10772,6 +11538,14 @@ operatorCommand.command("dev").argument("[folder]", "Operator workspace folder",
       previewUrl: harnessSession.previewUrl,
       lastVersion: version.version
     });
+    output(this, { folder, experimentId: harnessSession.experimentId, variationId: harnessSession.variationId, version: version.version, previewUrl: harnessSession.previewUrl }, () => {
+      console.log(source_default.bold("\nApex Workspace Preview"));
+      console.log(`Experiment: ${harnessSession.experimentId}`);
+      console.log(`Variation:  ${harnessSession.variationId}`);
+      console.log(`Version:    ${version.version}`);
+      console.log(source_default.cyan(harnessSession.previewUrl));
+      console.log();
+    });
     if (opts.open !== false) {
       const open2 = (await Promise.resolve().then(() => (init_open(), open_exports))).default;
       await open2(harnessSession.previewUrl);
@@ -10779,7 +11553,9 @@ operatorCommand.command("dev").argument("[folder]", "Operator workspace folder",
     if (opts.once) return;
     let uploading = false;
     let queued = false;
+    let closing = false;
     const upload2 = async () => {
+      if (closing) return;
       if (uploading) {
         queued = true;
         return;
@@ -10787,12 +11563,12 @@ operatorCommand.command("dev").argument("[folder]", "Operator workspace folder",
       uploading = true;
       try {
         const next = await uploadCurrentArtifactVersion(folder, harnessSession.sessionId);
-        console.log(source_default.dim(`[operator] uploaded preview version ${next.version}`));
+        console.error(source_default.dim(`[operator] uploaded preview version ${next.version}`));
       } catch (error) {
         printWarning(error instanceof Error ? error.message : String(error));
       } finally {
         uploading = false;
-        if (queued) {
+        if (queued && !closing) {
           queued = false;
           void upload2();
         }
@@ -10806,28 +11582,29 @@ operatorCommand.command("dev").argument("[folder]", "Operator workspace folder",
       timer = setTimeout(() => void upload2(), 300);
     });
     process.on("SIGINT", () => {
+      closing = true;
+      queued = false;
+      if (timer) clearTimeout(timer);
       watcher.close();
-      process.exit(0);
+      process.exitCode = 0;
     });
   } catch (error) {
-    printError(error instanceof Error ? error.message : String(error));
-    process.exit(1);
+    throw error;
   }
 });
-operatorCommand.command("publish").argument("[folder]", "Operator workspace folder", ".").action(async (folderArg) => {
+operatorCommand.command("publish").argument("[folder]", "Operator workspace folder", ".").option("--allow-goal-writes", "Allow metrics.json to create or update shared shop-level goals").action(async function action28(folderArg, opts) {
   try {
-    const result = await runPublish(folderArg);
-    printSuccess(`Published ${result.changed.length} changed file(s) to Apex`);
+    const result = await runPublish(folderArg, opts);
     const build = result.build;
-    console.log(`Mutations: ${build.mutationCount ?? 0}`);
-    console.log(`CSS bytes: ${build.customCssBytes ?? 0}`);
-    console.log(`JS bytes:  ${build.customJsBytes ?? 0}`);
-    if (result.external) {
-      console.log(`External artifacts: version ${result.external.version}`);
-    }
+    output(this, { changed: result.changed, build, external: result.external ?? null }, () => {
+      printSuccess(`Published ${result.changed.length} changed file(s) to Apex`);
+      console.log(`Mutations: ${build.mutationCount ?? 0}`);
+      console.log(`CSS bytes: ${build.customCssBytes ?? 0}`);
+      console.log(`JS bytes:  ${build.customJsBytes ?? 0}`);
+      if (result.external) console.log(`External artifacts: version ${result.external.version}`);
+    });
   } catch (error) {
-    printError(error instanceof Error ? error.message : String(error));
-    process.exit(1);
+    throw error;
   }
 });
 
@@ -10858,7 +11635,7 @@ function briefLine(item) {
   ].filter(Boolean);
   return parts.join("\n");
 }
-var approved = new Command("approved").description("List approved roadmap ideas ready to build in Apex").option("-n, --limit <n>", "Max results", "20").option("--cursor <id>", "Pagination cursor").option("-q, --query <text>", "Search title, hypothesis, brief, and notes").option("--unbuilt", "Only show approved ideas without a linked experiment").option("--built", "Only show approved ideas with a linked experiment").option("--json", "Print raw JSON").option("--brief", "Print each item with hypothesis and target URL").action(async (opts) => {
+var approved = new Command("approved").description("List approved roadmap ideas ready to build in Apex").option("-n, --limit <n>", "Max results", "20").option("--cursor <id>", "Pagination cursor").option("-q, --query <text>", "Search title, hypothesis, brief, and notes").option("--unbuilt", "Only show approved ideas without a linked experiment").option("--built", "Only show approved ideas with a linked experiment").option("--json", "Print raw JSON").option("--brief", "Print each item with hypothesis and target URL").action(async function action29(opts) {
   const creds2 = requireCredentials();
   const limit = parseInt(opts.limit, 10);
   const hasExperiment = opts.unbuilt ? false : opts.built ? true : void 0;
@@ -10868,63 +11645,56 @@ var approved = new Command("approved").description("List approved roadmap ideas
     q: opts.query,
     hasExperiment
   });
-  if (!res.ok) {
-    printError(res.error ?? "Failed to fetch approved roadmap items");
-    process.exit(1);
-  }
-  if (opts.json) {
-    console.log(JSON.stringify(res.data, null, 2));
-    return;
-  }
+  if (!res.ok) fail(this, res.error ?? "Failed to fetch approved roadmap items", classifyStatus(res.status), res.errorDetails);
   const items = res.data?.data ?? [];
-  if (items.length === 0) {
-    console.log(source_default.dim("No approved roadmap items found."));
-    return;
-  }
-  printTable(
-    ["ID", "SCORE", "TYPE", "EXPERIMENT", "TITLE"],
-    items.map((item) => [
-      item.id,
-      score(item.computed_score),
-      truncate(item.action_type, 14),
-      truncate(experimentState(item), 18),
-      truncate(item.title, 54)
-    ]),
-    [36, 6, 14, 18, 54]
-  );
-  if (opts.brief) {
-    console.log();
-    for (const item of items) {
-      console.log(source_default.bold(item.title));
-      const detail5 = briefLine(item);
-      if (detail5) console.log(detail5);
-      console.log(source_default.dim(`apex roadmap handoff ${item.id}`));
+  output(this, res.data ?? { data: [], pagination: { has_more: false, next_cursor: null } }, () => {
+    if (items.length === 0) {
+      console.log(source_default.dim("No approved roadmap items found."));
+      return;
+    }
+    printTable(
+      ["ID", "SCORE", "TYPE", "EXPERIMENT", "TITLE"],
+      items.map((item) => [
+        item.id,
+        score(item.computed_score),
+        truncate(item.action_type, 14),
+        truncate(experimentState(item), 18),
+        truncate(item.title, 54)
+      ]),
+      [36, 6, 14, 18, 54]
+    );
+    if (opts.brief) {
       console.log();
+      for (const item of items) {
+        console.log(source_default.bold(item.title));
+        const detail5 = briefLine(item);
+        if (detail5) console.log(detail5);
+        console.log(source_default.dim(`apex roadmap handoff ${item.id}`));
+        console.log();
+      }
     }
-  }
-  if (res.data?.pagination.has_more) {
-    console.log(source_default.dim(`
+    if (res.data?.pagination.has_more) {
+      console.log(source_default.dim(`
 More results: --cursor ${res.data.pagination.next_cursor}`));
-  }
+    }
+  });
 });
-var handoff = new Command("handoff").description("Get the full build brief for an approved roadmap item").argument("<id>", "Roadmap/backlog item ID").option("-o, --output <path>", "Write handoff JSON to a file").option("--instructions", "Print only the build instructions").action(async (id, opts) => {
+var handoff = new Command("handoff").description("Get the full build brief for an approved roadmap item").argument("<id>", "Roadmap/backlog item ID").option("--out <path>", "Write handoff JSON to a file").addOption(new Option("-o, --output <path>", "Legacy alias for --out").hideHelp()).option("--instructions", "Print only the build instructions").action(async function action30(id, opts) {
   const creds2 = requireCredentials();
   const res = await getRoadmapItemHandoff(creds2, id);
-  if (!res.ok) {
-    printError(res.error ?? "Failed to fetch roadmap handoff");
-    process.exit(1);
-  }
+  if (!res.ok) fail(this, res.error ?? "Failed to fetch roadmap handoff", classifyStatus(res.status), res.errorDetails);
   const payload = res.data ?? {};
-  const output2 = opts.instructions ? String(payload.instructions ?? "") : `${JSON.stringify(payload, null, 2)}
+  const rendered = opts.instructions ? String(payload.instructions ?? "") : `${JSON.stringify(payload, null, 2)}
 `;
-  if (opts.output) {
-    const target = import_node_path8.default.resolve(process.cwd(), opts.output);
+  const outputData = opts.instructions ? { roadmapItemId: id, instructions: String(payload.instructions ?? "") } : payload;
+  if (opts.out || opts.output) {
+    const target = import_node_path8.default.resolve(process.cwd(), opts.out ?? opts.output);
     import_node_fs10.default.mkdirSync(import_node_path8.default.dirname(target), { recursive: true });
-    import_node_fs10.default.writeFileSync(target, output2, "utf8");
-    printSuccess(`Wrote ${target}`);
+    import_node_fs10.default.writeFileSync(target, rendered, "utf8");
+    output(this, { path: target, roadmapItemId: id }, () => printSuccess(`Wrote ${target}`));
     return;
   }
-  console.log(output2);
+  output(this, outputData, () => console.log(rendered));
 });
 var roadmapCommand = new Command("roadmap").description("Work with approved roadmap ideas and build handoffs");
 roadmapCommand.addCommand(approved);
@@ -11104,7 +11874,7 @@ trackingCommand.command("qa").description("Print the QA checklist for a tracking
     console.log(`${index + 1}. ${check}`);
   });
 });
-trackingCommand.command("verify").description("Verify live tracking events for the current shop").option("--minutes <n>", "Lookback window in minutes", "120").option("--limit <n>", "Recent events to include", "20").option("--experiment <id>", "Filter to one experiment ID").option("--event-type <type>", "Filter to one event type; repeat with comma-separated values").action(async function action13(opts) {
+trackingCommand.command("verify").description("Verify live tracking events for the current shop").option("--minutes <n>", "Lookback window in minutes", "120").option("--limit <n>", "Recent events to include", "20").option("--experiment <id>", "Filter to one experiment ID").option("--event-type <type>", "Filter to one event type; repeat with comma-separated values").action(async function action31(opts) {
   const creds2 = requireCredentials();
   const res = await verifyTracking(creds2, {
     minutes: Number.parseInt(opts.minutes, 10),
@@ -11144,6 +11914,151 @@ trackingCommand.command("verify").description("Verify live tracking events for t
 init_source();
 var import_node_fs12 = __toESM(require("node:fs"));
 var import_node_path10 = __toESM(require("node:path"));
+
+// src/lib/sdk-url-match.ts
+var MAX_PATTERN_LENGTH = 1024;
+var MAX_CACHE_ENTRIES = 256;
+var regexCache = /* @__PURE__ */ new Map();
+function cacheRegex(pattern, compiled) {
+  if (!regexCache.has(pattern) && regexCache.size >= MAX_CACHE_ENTRIES) {
+    const oldest = regexCache.keys().next().value;
+    if (oldest) regexCache.delete(oldest);
+  }
+  regexCache.set(pattern, compiled);
+}
+function safeRegexTest(pattern, input) {
+  if (!pattern || pattern.length > MAX_PATTERN_LENGTH) return false;
+  if (regexCache.has(pattern)) {
+    const cached = regexCache.get(pattern);
+    return cached ? cached.test(input) : false;
+  }
+  try {
+    const compiled = new RegExp(pattern);
+    cacheRegex(pattern, compiled);
+    return compiled.test(input);
+  } catch {
+    cacheRegex(pattern, null);
+    return false;
+  }
+}
+
+// src/lib/sdk-goal-url-match.ts
+function sdkPageviewGoalMatch(urlPattern, href) {
+  if (!urlPattern) return true;
+  return safeRegexTest(urlPattern, href);
+}
+
+// src/commands/goals.ts
+var INVENTORY_PAGE_SIZE = 100;
+var GOALS_PAGE_SIZE = 100;
+var MAX_GOAL_PAGES = 100;
+var NON_QUANTIFIABLE = /* @__PURE__ */ new Set(["(", "|", "^", "$"]);
+function urlPatternDependence(pattern) {
+  let fragment = false;
+  let inClass = false;
+  let quantifiable = false;
+  for (let i = 0; i < pattern.length; i += 1) {
+    const ch = pattern[i];
+    if (ch === "\\") {
+      const next = pattern[i + 1];
+      i += 1;
+      if (next === void 0) break;
+      if (next === "?" || next === "&") return "query";
+      if (next === "#") fragment = true;
+      quantifiable = true;
+      continue;
+    }
+    if (inClass) {
+      if (ch === "]") {
+        inClass = false;
+        quantifiable = true;
+        continue;
+      }
+      if (ch === "?" || ch === "&") return "query";
+      if (ch === "#") fragment = true;
+      continue;
+    }
+    if (ch === "[") {
+      inClass = true;
+      quantifiable = false;
+      continue;
+    }
+    if (ch === "&") return "query";
+    if (ch === "#") {
+      fragment = true;
+      quantifiable = true;
+      continue;
+    }
+    if (ch === "?") {
+      if (!quantifiable && pattern[i - 1] !== "(") return "query";
+      quantifiable = true;
+      continue;
+    }
+    quantifiable = !NON_QUANTIFIABLE.has(ch);
+  }
+  return fragment ? "fragment" : "none";
+}
+var PAGE_SCOPED_REASON = "page-scoped goal: matching is decided by the assigned Page, not url_pattern \u2014 inventory dry-run does not apply";
+function goalPageId(goal) {
+  const raw = goal.page_id ?? goal.pageId ?? null;
+  return typeof raw === "string" && raw.length > 0 ? raw : null;
+}
+var DEPENDENCE_REASON = {
+  query: "URL inventory is path-level only, so query-string-dependent patterns cannot be counted safely.",
+  fragment: "URL fragments are never sent to the server, so fragment-dependent patterns cannot be counted safely."
+};
+function inventoryHref(item) {
+  try {
+    return new URL(item.path, `https://${item.host}`).href;
+  } catch {
+    return null;
+  }
+}
+async function findGoalById(command, creds2, goalId) {
+  let cursor;
+  for (let page = 0; page < MAX_GOAL_PAGES; page += 1) {
+    const res = await listGoals(creds2, { limit: GOALS_PAGE_SIZE, cursor });
+    if (!res.ok || !res.data) fail(command, res.error ?? "Failed to read goals", classifyStatus(res.status), res.errorDetails);
+    const match = res.data.data.find((item) => item.id === goalId);
+    if (match) return match;
+    const next = res.data.pagination?.next_cursor ?? null;
+    if (!res.data.pagination?.has_more || !next || next === cursor) return null;
+    cursor = next;
+  }
+  return null;
+}
+async function readAllInventory(command, creds2, days) {
+  const items = [];
+  let offset = 0;
+  let total = 0;
+  let truncated = false;
+  do {
+    const res = await getUrlInventory(creds2, { days, limit: INVENTORY_PAGE_SIZE, offset });
+    if (!res.ok || !res.data) fail(command, res.error ?? "Failed to read URL inventory", classifyStatus(res.status), res.errorDetails);
+    items.push(...res.data.items);
+    total = res.data.total;
+    truncated = truncated || res.data.truncated;
+    offset += res.data.items.length;
+    if (res.data.items.length === 0) break;
+  } while (offset < total);
+  return { items, total, truncated };
+}
+function printSuggestions(data) {
+  if (data.goals.length) {
+    console.log(source_default.bold("Suggested goals"));
+    printTable(["NAME", "TYPE", "PATTERN/SELECTOR/EVENT"], data.goals.map((goal) => [goal.name.slice(0, 36), goal.type, String(goal.urlPattern ?? goal.selector ?? goal.eventName ?? "-").slice(0, 56)]), [36, 10, 56]);
+  } else console.log(source_default.dim("No suggested goals."));
+  if (data.funnels.length) {
+    console.log();
+    console.log(source_default.bold("Suggested funnels"));
+    for (const funnel of data.funnels) console.log(`- ${funnel.name}: ${funnel.steps.join(" -> ")}`);
+  }
+  if (data.triggers.length) {
+    console.log();
+    console.log(source_default.bold("Suggested test triggers"));
+    for (const trigger of data.triggers) console.log(`- ${trigger.page}: ${trigger.description}`);
+  }
+}
 function parseCapture(command, value) {
   if (!value) return void 0;
   const source = value.startsWith("@") ? value.slice(1) : value;
@@ -11172,7 +12087,7 @@ function printGoal(goal) {
   console.log(`  Count once: ${goal.count_once ? "yes" : "no"}`);
   console.log();
 }
-var list2 = new Command("list").alias("ls").description("List goals").option("-n, --limit <n>", "Max results", "50").action(async function action14(opts) {
+var list2 = new Command("list").alias("ls").description("List goals").option("-n, --limit <n>", "Max results", "50").action(async function action32(opts) {
   const creds2 = requireCredentials();
   const res = await listGoals(creds2, { limit: Number.parseInt(opts.limit, 10) });
   if (!res.ok || !res.data) {
@@ -11194,7 +12109,7 @@ var list2 = new Command("list").alias("ls").description("List goals").option("-n
     );
   });
 });
-var create2 = new Command("create").description("Create a goal").requiredOption("--name <name>", "Goal name").requiredOption("--type <type>", "click|pageview|custom|revenue").option("--selector <selector>", "CSS selector for click goals").option("--text-match <text>", "Text match for click goals").option("--url-pattern <pattern>", "URL pattern for pageview goals").option("--event-name <name>", "Event name for custom goals").option("--count-once", "Count only once per visitor").option("--capture <json-or-path>", "Capture JSON array or @path").action(async function action15(opts) {
+var create2 = new Command("create").description("Create a goal").requiredOption("--name <name>", "Goal name").requiredOption("--type <type>", "click|pageview|custom|revenue").option("--selector <selector>", "CSS selector for click goals").option("--text-match <text>", "Text match for click goals").option("--url-pattern <pattern>", "URL pattern for pageview goals").option("--event-name <name>", "Event name for custom goals").option("--count-once", "Count only once per visitor").option("--capture <json-or-path>", "Capture JSON array or @path").action(async function action33(opts) {
   const creds2 = requireCredentials();
   const body5 = cleanBody({
     name: opts.name,
@@ -11212,7 +12127,7 @@ var create2 = new Command("create").description("Create a goal").requiredOption(
   }
   output(this, { goal: res.data }, () => printGoal(res.data));
 });
-var update = new Command("update").description("Update a goal").argument("<id>", "Goal ID").option("--name <name>", "Goal name").option("--type <type>", "click|pageview|custom|revenue").option("--selector <selector>", "CSS selector for click goals").option("--text-match <text>", "Text match for click goals").option("--url-pattern <pattern>", "URL pattern for pageview goals").option("--event-name <name>", "Event name for custom goals").option("--count-once", "Count only once per visitor").option("--no-count-once", "Do not count only once per visitor").option("--capture <json-or-path>", "Capture JSON array or @path").action(async function action16(id, opts) {
+var update = new Command("update").description("Update a goal").argument("<id>", "Goal ID").option("--name <name>", "Goal name").option("--type <type>", "click|pageview|custom|revenue").option("--selector <selector>", "CSS selector for click goals").option("--text-match <text>", "Text match for click goals").option("--url-pattern <pattern>", "URL pattern for pageview goals").option("--event-name <name>", "Event name for custom goals").option("--count-once", "Count only once per visitor").option("--no-count-once", "Do not count only once per visitor").option("--capture <json-or-path>", "Capture JSON array or @path").action(async function action34(id, opts) {
   const creds2 = requireCredentials();
   const body5 = cleanBody({
     name: opts.name,
@@ -11233,7 +12148,137 @@ var update = new Command("update").description("Update a goal").argument("<id>",
   }
   output(this, { goal: res.data }, () => printGoal(res.data));
 });
-var goalsCommand = new Command("goals").description("Manage conversion and revenue goals").addCommand(list2).addCommand(create2).addCommand(update);
+var test = new Command("test").description("Dry run a goal URL pattern against traffic").option("--pattern <regex>", "URL regex pattern to test (matched against the full URL, as the SDK matches pageview goals)").option("--goal <id>", "Existing goal ID whose URL pattern should be tested").option("--days <n>", "Traffic lookback days", "14").action(async function action35(opts) {
+  if (!opts.pattern && !opts.goal) fail(this, "Provide --pattern or --goal.", EXIT_CODES.validation);
+  if (opts.pattern && opts.goal) fail(this, "Use only one of --pattern or --goal.", EXIT_CODES.validation);
+  const creds2 = requireCredentials();
+  let pattern = opts.pattern;
+  if (opts.goal) {
+    const goal = await findGoalById(this, creds2, opts.goal);
+    if (!goal) fail(this, `Goal not found: ${opts.goal}`, EXIT_CODES.validation);
+    const pageId = goalPageId(goal);
+    if (pageId) {
+      output(this, { verdict: "indeterminate", scope: "page", goal: goal.id, page_id: pageId, pattern: goal.url_pattern ?? null, reason: PAGE_SCOPED_REASON }, () => {
+        console.log(source_default.yellow("INDETERMINATE"));
+        console.log(PAGE_SCOPED_REASON);
+      });
+      return;
+    }
+    pattern = goal.url_pattern ?? void 0;
+    if (!pattern) fail(this, `Goal ${opts.goal} has no URL pattern.`, EXIT_CODES.validation);
+  }
+  const days = Math.max(1, Number.parseInt(opts.days, 10) || 14);
+  const dependence = urlPatternDependence(pattern);
+  if (dependence !== "none") {
+    const reason = DEPENDENCE_REASON[dependence];
+    output(this, { verdict: "indeterminate", pattern, dependence, reason }, () => {
+      console.log(source_default.yellow("INDETERMINATE"));
+      console.log(reason);
+    });
+    return;
+  }
+  const inventory = await readAllInventory(this, creds2, days);
+  const matches = inventory.items.filter((item) => {
+    const href = inventoryHref(item);
+    return href !== null && sdkPageviewGoalMatch(pattern, href);
+  });
+  const totalPageviews = matches.reduce((sum, item) => sum + item.pageviews, 0);
+  output(this, { verdict: "determinate", pattern, days, matches, total_pageviews: totalPageviews, inventory_total: inventory.total, truncated: inventory.truncated, visitor_note: "Per-URL visitor counts are not unioned client-side.", match_note: "Patterns are tested against the full URL (https://host/path), matching the SDK pageview-goal path." }, () => {
+    console.log(source_default.bold(`Matched pageviews: ${totalPageviews}`));
+    console.log(source_default.dim("Per-URL visitor counts are shown; total visitors are not unioned client-side."));
+    if (!matches.length) {
+      console.log(source_default.dim("No matching URLs."));
+      return;
+    }
+    printTable(["URL", "PAGEVIEWS", "VISITORS"], matches.map((item) => [`${item.host}${item.path}`.slice(0, 64), String(item.pageviews), String(item.visitors)]), [64, 10, 10]);
+  });
+});
+var suggest = new Command("suggest").description("Suggest goals and funnels from analytics").option("--create", "Create selected goals after confirmation").option("--yes", "Skip prompts when used with create").action(async function action36(opts) {
+  const creds2 = requireCredentials();
+  const res = await suggestGoals(creds2);
+  if (!res.ok || !res.data) fail(this, res.error ?? "Failed to suggest goals", classifyStatus(res.status), res.errorDetails);
+  output(this, res.data, () => printSuggestions(res.data));
+  if (!opts.create) return;
+  for (const goal of res.data.goals) {
+    console.error(`Would create ${goal.type} goal: ${goal.name}`);
+    if (!opts.yes) {
+      if (!process.stdin.isTTY || !process.stdout.isTTY) fail(this, "Confirmation required; rerun with --yes to create suggested goals.", EXIT_CODES.confirmationRequired);
+      const readline2 = await import("node:readline");
+      const rl = readline2.createInterface({ input: process.stdin, output: process.stderr });
+      const answer = await new Promise((resolve) => rl.question(source_default.yellow("Create this goal? [y/N] "), resolve));
+      rl.close();
+      if (answer.toLowerCase() !== "y") continue;
+    }
+    const created = await createGoal(creds2, cleanBody({ name: goal.name, type: goal.type, selector: goal.selector, url_pattern: goal.urlPattern, event_name: goal.eventName }));
+    if (!created.ok || !created.data) fail(this, created.error ?? "Failed to create suggested goal", classifyStatus(created.status), created.errorDetails);
+  }
+});
+var goalsCommand = new Command("goals").description("Manage conversion and revenue goals").addCommand(list2).addCommand(create2).addCommand(update).addCommand(test).addCommand(suggest).addHelpText("after", `
+Examples:
+  apex goals list --limit 20
+  apex goals create --name "Checkout click" --type click --selector "button[name=checkout]"
+  apex goals create --name "Purchase" --type revenue --count-once
+`);
+
+// src/commands/funnels.ts
+init_source();
+var import_node_fs13 = __toESM(require("node:fs"));
+var import_node_path11 = __toESM(require("node:path"));
+function readSteps(command, file) {
+  let parsed;
+  try {
+    parsed = JSON.parse(import_node_fs13.default.readFileSync(import_node_path11.default.resolve(process.cwd(), file), "utf8"));
+  } catch (error) {
+    fail(command, `Invalid --steps-file JSON: ${error instanceof Error ? error.message : String(error)}`, EXIT_CODES.validation);
+  }
+  if (!Array.isArray(parsed) || parsed.length === 0) fail(command, "steps must be a non-empty array", EXIT_CODES.validation);
+  return parsed.map((step, index) => {
+    if (!step || typeof step !== "object" || typeof step.label !== "string" || typeof step.pattern !== "string") {
+      fail(command, `step ${index + 1} must have label and pattern strings`, EXIT_CODES.validation);
+    }
+    return { order: index + 1, label: step.label, url_pattern: step.pattern };
+  });
+}
+function printFunnel(funnel) {
+  console.log();
+  console.log(source_default.bold(funnel.name));
+  console.log(`  ID: ${source_default.dim(funnel.id)}`);
+  for (const step of [...funnel.steps].sort((a, b) => a.order - b.order)) console.log(`  ${step.order}. ${step.label} \u2014 ${step.url_pattern}`);
+  console.log();
+}
+var list3 = new Command("list").alias("ls").description("List funnels").action(async function action37() {
+  const res = await listFunnels(requireCredentials());
+  if (!res.ok || !res.data) fail(this, res.error ?? "Failed to list funnels", classifyStatus(res.status), res.errorDetails);
+  output(this, { funnels: res.data.data }, () => printTable(["NAME", "ID", "STEPS"], res.data.data.map((f) => [f.name.slice(0, 36), f.id, String(f.steps.length)]), [36, 36, 5]));
+});
+var create3 = new Command("create").description("Create a funnel").requiredOption("--name <name>", "Funnel name").requiredOption("--steps-file <file>", "JSON array of { label, pattern }").action(async function action38(opts) {
+  const res = await createFunnel(requireCredentials(), { name: opts.name, steps: readSteps(this, opts.stepsFile) });
+  if (!res.ok || !res.data) fail(this, res.error ?? "Failed to create funnel", classifyStatus(res.status), res.errorDetails);
+  output(this, { funnel: res.data }, () => printFunnel(res.data));
+});
+var update2 = new Command("update").description("Replace a funnel's steps").argument("<id>", "Funnel ID").requiredOption("--steps-file <file>", "JSON array of { label, pattern }").action(async function action39(id, opts) {
+  const res = await updateFunnel(requireCredentials(), id, { steps: readSteps(this, opts.stepsFile) });
+  if (!res.ok || !res.data) fail(this, res.error ?? "Failed to update funnel", classifyStatus(res.status), res.errorDetails);
+  output(this, { funnel: res.data }, () => printFunnel(res.data));
+});
+var del2 = new Command("delete").description("Delete a funnel").argument("<id>", "Funnel ID").action(async function action40(id) {
+  const res = await deleteFunnel(requireCredentials(), id);
+  if (!res.ok) fail(this, res.error ?? "Failed to delete funnel", classifyStatus(res.status), res.errorDetails);
+  output(this, { deleted: true, id }, () => console.log(`Deleted funnel ${id}`));
+});
+var run = new Command("run").description("Run funnel analysis").argument("<id>", "Funnel ID").option("--days <n>", "Analysis window", "30").action(async function action41(id, opts) {
+  if (!/^[1-9]\d*$/.test(opts.days)) fail(this, "--days must be a positive integer", EXIT_CODES.validation);
+  const days = Number.parseInt(opts.days, 10);
+  if (!Number.isSafeInteger(days)) fail(this, "--days must be a positive integer", EXIT_CODES.validation);
+  const res = await runFunnel(requireCredentials(), id, days);
+  if (!res.ok || !res.data) fail(this, res.error ?? "Failed to run funnel", classifyStatus(res.status), res.errorDetails);
+  output(this, { run: res.data }, () => printTable(["STEP", "LABEL", "VISITORS", "DROP-OFF"], res.data.steps.map((s) => [String(s.step), s.label, String(s.visitors), `${s.drop_off_rate}%`]), [5, 36, 8, 8]));
+});
+var validate2 = new Command("validate").description("Validate funnel steps without writing").requiredOption("--steps-file <file>", "JSON array of { label, pattern }").action(function action42(opts) {
+  const steps = readSteps(this, opts.stepsFile);
+  output(this, { valid: true, steps }, () => console.log(`Valid funnel steps: ${steps.length}`));
+});
+var funnelsCommand = new Command("funnels").description("Manage analytics funnels").addCommand(list3).addCommand(create3).addCommand(update2).addCommand(del2).addCommand(run).addCommand(validate2);
 
 // src/commands/environments.ts
 init_source();
@@ -11286,11 +12331,11 @@ async function load2(command) {
   }
   return result.data;
 }
-var list3 = new Command("list").alias("ls").description("List runtime environments and mapped domains").action(async function action17() {
+var list4 = new Command("list").alias("ls").description("List runtime environments and mapped domains").action(async function action43() {
   const { environments } = await load2(this);
   output(this, { environments }, () => printEnvironments(environments.items));
 });
-var setDomain = new Command("set-domain").description("Map a domain to a runtime environment").argument("<domain>", "Domain to map").requiredOption("--environment <env>", "Environment key").action(async function action18(domain, opts) {
+var setDomain = new Command("set-domain").description("Map a domain to a runtime environment").argument("<domain>", "Domain to map").requiredOption("--environment <env>", "Environment key").action(async function action44(domain, opts) {
   const normalizedDomain = normalizeEnvironmentDomain(domain);
   if (!normalizedDomain) {
     fail(this, "Domain must be a valid hostname containing a dot", EXIT_CODES.validation);
@@ -11333,7 +12378,7 @@ var setDomain = new Command("set-domain").description("Map a domain to a runtime
     () => printEnvironments(result.data.environments.items)
   );
 });
-var removeDomain = new Command("remove-domain").description("Remove a domain mapping").argument("<domain>", "Domain to remove").action(async function action19(domain) {
+var removeDomain = new Command("remove-domain").description("Remove a domain mapping").argument("<domain>", "Domain to remove").action(async function action45(domain) {
   const normalizedDomain = normalizeEnvironmentDomain(domain);
   if (!normalizedDomain) {
     fail(this, "Domain must be a valid hostname containing a dot", EXIT_CODES.validation);
@@ -11366,7 +12411,200 @@ var removeDomain = new Command("remove-domain").description("Remove a domain map
     () => printEnvironments(result.data.environments.items)
   );
 });
-var environmentsCommand = new Command("environments").description("Manage runtime environments and domain mappings").addCommand(list3).addCommand(setDomain).addCommand(removeDomain);
+var environmentsCommand = new Command("environments").description("Manage runtime environments and domain mappings").addCommand(list4).addCommand(setDomain).addCommand(removeDomain);
+
+// src/commands/consent.ts
+init_source();
+function warn(command, precompile) {
+  if (!shouldUseJson(command) && precompile && precompile.status !== "ok") {
+    console.error(source_default.yellow(`Warning (${precompile.status}): ${precompile.summary}`));
+  }
+}
+async function load3(command) {
+  const result = await getConsent(requireCredentials());
+  if (!result.ok || !result.data) fail(command, result.error ?? "Failed to load consent settings", classifyStatus(result.status), result.errorDetails);
+  return result.data;
+}
+function printConsent(data) {
+  console.log(`Consent: ${data.consentMode.enabled ? "on" : "off"}`);
+  console.log(`Provider: ${data.consentMode.provider || "-"}`);
+  console.log(`Group: ${data.consentMode.requiredGroup || "-"}`);
+  console.log(`Getter: ${data.consentMode.getter || "-"}`);
+  console.log(`Split: ${data.prerequisites.showVariationsRule && data.prerequisites.startTrackingRule ? "canonical" : "off"}`);
+}
+var get2 = new Command("get").description("Show consent settings").action(async function action46() {
+  const data = await load3(this);
+  output(this, data, () => printConsent(data));
+});
+var set = new Command("set").description("Enable and configure consent gating").requiredOption("--provider <provider>", "Consent provider").requiredOption("--group <group>", "Required consent group").option("--getter <path>", "Custom consent getter path").action(async function action47(opts) {
+  const consentMode = { enabled: true, provider: opts.provider, requiredGroup: opts.group };
+  if (opts.getter !== void 0) consentMode.getter = opts.getter;
+  const result = await updateConsent(requireCredentials(), { consentMode, applyCanonicalSplit: true });
+  if (!result.ok || !result.data) fail(this, result.error ?? "Failed to update consent settings", classifyStatus(result.status), result.errorDetails);
+  warn(this, result.data.precompile);
+  output(this, result.data, () => printConsent(result.data));
+});
+var off = new Command("off").description("Disable consent gating").action(async function action48() {
+  const result = await updateConsent(requireCredentials(), { consentMode: { enabled: false } });
+  if (!result.ok || !result.data) fail(this, result.error ?? "Failed to disable consent settings", classifyStatus(result.status), result.errorDetails);
+  warn(this, result.data.precompile);
+  output(this, result.data, () => printConsent(result.data));
+});
+var consentCommand = new Command("consent").description("Manage consent gating").addCommand(get2).addCommand(set).addCommand(off);
+
+// src/commands/domains.ts
+init_source();
+function normalizeDomain(value) {
+  return value.trim().replace(/^https?:\/\//i, "").replace(/[/?#].*$/, "").replace(/\.$/, "").toLowerCase();
+}
+function warn2(command, precompile) {
+  if (!shouldUseJson(command) && precompile && precompile.status !== "ok") console.error(source_default.yellow(`Warning (${precompile.status}): ${precompile.summary}`));
+}
+function printDomains(data) {
+  printTable(["TYPE", "DOMAIN"], [["primary", data.domain], ...data.additionalDomains.map((d) => ["additional", d])], [12, 64]);
+}
+async function load4(command) {
+  const result = await getInstallDomains(requireCredentials());
+  if (!result.ok || !result.data) fail(command, result.error ?? "Failed to load install domains", classifyStatus(result.status), result.errorDetails);
+  return result.data;
+}
+async function patchWithRetry(command, build) {
+  let result;
+  for (let attempt = 0; attempt < 2; attempt += 1) {
+    const current = await load4(command);
+    result = await updateInstallDomains(requireCredentials(), { domains: build(current), ifRevision: current.revision });
+    if (result.status !== 409 || attempt === 1) break;
+  }
+  if (!result?.ok || !result.data) fail(command, result?.error ?? "Failed to update install domains", classifyStatus(result?.status ?? 0), result?.errorDetails);
+  warn2(command, result.data.precompile);
+  return result.data;
+}
+var list5 = new Command("list").alias("ls").description("List install domains").action(async function action49() {
+  const data = await load4(this);
+  output(this, data, () => printDomains(data));
+});
+var add = new Command("add").description("Add install domains").argument("<domain...>").action(async function action50(domain) {
+  const added = domain.map(normalizeDomain);
+  const data = await patchWithRetry(this, (current) => Array.from(/* @__PURE__ */ new Set([...current.additionalDomains, ...added])));
+  output(this, data, () => printDomains(data));
+});
+var remove = new Command("remove").description("Remove install domains").argument("<domain...>").action(async function action51(domain) {
+  const removeSet = new Set(domain.map(normalizeDomain));
+  const data = await patchWithRetry(this, (current) => current.additionalDomains.filter((d) => !removeSet.has(normalizeDomain(d))));
+  output(this, data, () => printDomains(data));
+});
+var set2 = new Command("set").description("Replace install domains").argument("<domain...>").action(async function action52(domain) {
+  const replacement = domain.map(normalizeDomain);
+  const data = await patchWithRetry(this, () => replacement);
+  output(this, data, () => printDomains(data));
+});
+var domainsCommand = new Command("domains").description("Manage install domains").addCommand(list5).addCommand(add).addCommand(remove).addCommand(set2);
+
+// src/commands/handover.ts
+init_source();
+function normalizeDomain2(value) {
+  try {
+    const candidate = value.trim().toLowerCase();
+    const parsed = new URL(/^[a-z][a-z0-9+.-]*:\/\//.test(candidate) ? candidate : `http://${candidate}`);
+    const hostname = parsed.hostname.toLowerCase().replace(/\.$/, "");
+    return hostname.includes(".") && /^[a-z0-9.-]+$/.test(hostname) ? hostname : "";
+  } catch {
+    return "";
+  }
+}
+var QA_FETCH_TIMEOUT_MS = 12e3;
+var NAMED_HTML_ENTITIES = {
+  amp: "&",
+  lt: "<",
+  gt: ">",
+  quot: '"',
+  apos: "'",
+  nbsp: "\xA0"
+};
+function decodeHtmlEntities(value) {
+  return value.replace(/&(#[0-9]+|#[xX][0-9a-fA-F]+|[a-zA-Z]+);/g, (match, entity) => {
+    if (entity.startsWith("#")) {
+      const hex = entity[1] === "x" || entity[1] === "X";
+      const code = Number.parseInt(hex ? entity.slice(2) : entity.slice(1), hex ? 16 : 10);
+      return Number.isInteger(code) && code >= 0 && code <= 1114111 ? String.fromCodePoint(code) : match;
+    }
+    return NAMED_HTML_ENTITIES[entity.toLowerCase()] ?? match;
+  });
+}
+function printSettings(settings2) {
+  printTable(["DOMAINS", "PARAM", "TTL", "MINT TIMEOUT", "SIGNED"], [[settings2.domains.join(", ") || "off", settings2.handoverQueryParam, `${settings2.handoverTtlSeconds}s`, `${settings2.handoverMintTimeoutMs}ms`, settings2.signed ? "yes" : "no"]], [48, 20, 8, 14, 8]);
+}
+async function load5(command) {
+  const result = await getExternalTracking(requireCredentials());
+  if (!result.ok || !result.data) fail(command, result.error ?? "Failed to load handover settings", classifyStatus(result.status), result.errorDetails);
+  return result.data;
+}
+async function patchWithRetry2(command, build) {
+  let result;
+  for (let attempt = 0; attempt < 2; attempt += 1) {
+    const current = await load5(command);
+    result = await updateExternalTracking(requireCredentials(), build(current));
+    if (result.status !== 409 || attempt === 1) break;
+  }
+  if (!result || !result.ok || !result.data) fail(command, result?.error ?? "Failed to update handover settings", classifyStatus(result?.status ?? 0), result?.errorDetails);
+  if (!shouldUseJson(command) && result.data.precompile?.status && result.data.precompile.status !== "ok") console.error(source_default.yellow(`Warning (${result.data.precompile.status}): ${result.data.precompile.summary}. Edge config may be stale until republish succeeds.`));
+  return result.data;
+}
+var get3 = new Command("get").description("Show cross-domain handover settings").action(async function action53() {
+  const data = await load5(this);
+  output(this, data, () => printSettings(data.externalTracking));
+});
+var set3 = new Command("set").description("Enable cross-domain identity handover").requiredOption("--domain <domain...>", "Bound handover domain(s)").option("--param <param>", "Handover query parameter").option("--signed", "Require signed handover tokens").option("--allow-unsigned", "Disable signing using the audited escape hatch").action(async function action54(opts) {
+  if (opts.signed && opts.allowUnsigned) fail(this, "--signed and --allow-unsigned cannot be used together", EXIT_CODES.validation);
+  const domains = opts.domain.map(normalizeDomain2);
+  if (domains.some((domain) => !domain)) fail(this, "Every --domain value must be a valid hostname containing a dot", EXIT_CODES.validation);
+  if (opts.param && !/^[a-z_][a-z0-9_]{0,31}$/.test(opts.param)) fail(this, "--param must match ^[a-z_][a-z0-9_]{0,31}$", EXIT_CODES.validation);
+  const data = await patchWithRetry2(this, (current) => ({ externalTracking: { domains: Array.from(new Set(domains)), handoverQueryParam: opts.param ?? current.externalTracking.handoverQueryParam, signed: opts.allowUnsigned ? false : true, ...opts.allowUnsigned ? { allowUnsigned: true } : {} }, ifRevision: current.revision }));
+  output(this, data, () => printSettings(data.externalTracking));
+});
+var off2 = new Command("off").description("Disable cross-domain handover").action(async function action55() {
+  const data = await patchWithRetry2(this, (current) => ({ externalTracking: { domains: [], signed: true }, ifRevision: current.revision }));
+  output(this, data, () => printSettings(data.externalTracking));
+});
+var qa2 = new Command("qa").description("Check static link/form handover parameter carriage").requiredOption("--from <url>", "Page URL to inspect").requiredOption("--to-domain <domain>", "Target domain that should carry the handover parameter").action(async function action56(opts) {
+  const config = await load5(this);
+  const target = normalizeDomain2(opts.toDomain);
+  if (!target) fail(this, "--to-domain must be a valid hostname", EXIT_CODES.validation);
+  let response;
+  let html;
+  try {
+    response = await fetch(opts.from, { signal: AbortSignal.timeout(QA_FETCH_TIMEOUT_MS), redirect: "follow" });
+    if (!response.ok) fail(this, `Fetching ${opts.from} returned HTTP ${response.status}`, classifyStatus(response.status));
+    html = await response.text();
+  } catch (error) {
+    if (error instanceof CliError) throw error;
+    const reason = error instanceof Error ? error.message : String(error);
+    fail(this, `Could not fetch ${opts.from}: ${reason}`, EXIT_CODES.general);
+  }
+  const param = config.externalTracking.handoverQueryParam;
+  const baseUrl = response.url || opts.from;
+  const hrefs = [...html.matchAll(/<(a|form)\b[^>]*(?:href|action)\s*=\s*["']([^"']+)["'][^>]*>/gi)].map((m) => decodeHtmlEntities(m[2]));
+  const targetUrls = hrefs.map((raw) => {
+    try {
+      return new URL(raw, baseUrl);
+    } catch {
+      return null;
+    }
+  }).filter((url) => url !== null && url.hostname.toLowerCase().replace(/^www\./, "") === target.replace(/^www\./, ""));
+  const carrying = targetUrls.filter((url) => url.searchParams.has(param));
+  const warn3 = targetUrls.length === 0 ? "WARN: no static links/forms found for target domain; run the ab-harness browser check for JS-driven navigation." : void 0;
+  const data = { ok: targetUrls.length > 0 && carrying.length === targetUrls.length, from: opts.from, toDomain: target, param, checked: targetUrls.length, carrying: carrying.length, warning: warn3 };
+  const printVerdict = () => {
+    console.log(data.ok ? source_default.green("PASS handover parameter is carried") : source_default.red("FAIL handover parameter is not carried by every target link/form"));
+    if (warn3) console.error(source_default.yellow(warn3));
+  };
+  if (targetUrls.length > 0 && carrying.length !== targetUrls.length) {
+    if (!shouldUseJson(this)) printVerdict();
+    fail(this, `Handover parameter "${param}" is missing on ${targetUrls.length - carrying.length} of ${targetUrls.length} ${target} links/forms`, EXIT_CODES.validation, data);
+  }
+  output(this, data, printVerdict);
+});
+var handoverCommand = new Command("handover").description("Manage cross-domain identity handover").addCommand(get3).addCommand(set3).addCommand(off2).addCommand(qa2);
 
 // src/commands/analytics.ts
 function display(value) {
@@ -11401,7 +12639,7 @@ function analyticsSubcommand(name, description, defaultDays) {
     command.option("--planning-days <n>", "Planning window in days", "180");
     command.option("--limit <n>", "Maximum page rows", "50");
   }
-  return command.action(async function action25(opts) {
+  return command.action(async function action68(opts) {
     const result = await getAnalytics(requireCredentials(), name, {
       days: positiveInteger(this, opts.days, "--days"),
       planningDays: positiveInteger(this, opts.planningDays, "--planning-days"),
@@ -11413,12 +12651,17 @@ function analyticsSubcommand(name, description, defaultDays) {
     output(this, { data: result.data.data }, () => printAnalytics(result.data.data));
   });
 }
-var analyticsCommand = new Command("analytics").description("Read shop analytics").addCommand(analyticsSubcommand("stats", "Show dashboard analytics stats", 7)).addCommand(analyticsSubcommand("timeseries", "Show analytics timeseries", 30)).addCommand(analyticsSubcommand("traffic", "Show traffic sources", 30)).addCommand(analyticsSubcommand("pages", "Show page analytics", 30)).addCommand(analyticsSubcommand("geo", "Show geography and device analytics", 30)).addCommand(analyticsSubcommand("sessions", "Show session analytics", 30)).addCommand(analyticsSubcommand("web-vitals", "Show web vitals analytics", 7)).addCommand(analyticsSubcommand("realtime", "Show realtime analytics")).addCommand(analyticsSubcommand("entry-exit", "Show entry and exit page analytics", 30));
+var analyticsCommand = new Command("analytics").description("Read shop analytics").addCommand(analyticsSubcommand("stats", "Show dashboard analytics stats", 7)).addCommand(analyticsSubcommand("timeseries", "Show analytics timeseries", 30)).addCommand(analyticsSubcommand("traffic", "Show traffic sources", 30)).addCommand(analyticsSubcommand("pages", "Show page analytics", 30)).addCommand(analyticsSubcommand("geo", "Show geography and device analytics", 30)).addCommand(analyticsSubcommand("sessions", "Show session analytics", 30)).addCommand(analyticsSubcommand("web-vitals", "Show web vitals analytics", 7)).addCommand(analyticsSubcommand("realtime", "Show realtime analytics")).addCommand(analyticsSubcommand("entry-exit", "Show entry and exit page analytics", 30)).addHelpText("after", `
+Examples:
+  apex analytics stats --days 7
+  apex analytics pages --planning-days 180 --limit 25
+  apex analytics realtime --json
+`);
 
 // src/commands/flags.ts
 init_source();
-var import_node_fs13 = __toESM(require("node:fs"));
-var import_node_path11 = __toESM(require("node:path"));
+var import_node_fs14 = __toESM(require("node:fs"));
+var import_node_path12 = __toESM(require("node:path"));
 
 // src/edge-status.ts
 function getEdgeDeliveryStatus(deliveryType, expectedWorstCaseSeconds = 420) {
@@ -11460,7 +12703,7 @@ function body(command, value, opts) {
   let parsed = {};
   if (value) {
     const source = value.startsWith("@") ? value.slice(1) : value;
-    const text = value.startsWith("@") || import_node_fs13.default.existsSync(source) ? import_node_fs13.default.readFileSync(import_node_path11.default.resolve(process.cwd(), source), "utf8") : value;
+    const text = value.startsWith("@") || import_node_fs14.default.existsSync(source) ? import_node_fs14.default.readFileSync(import_node_path12.default.resolve(process.cwd(), source), "utf8") : value;
     try {
       parsed = JSON.parse(text);
     } catch (e) {
@@ -11490,7 +12733,7 @@ function detail(x) {
   console.log(`  State: ${x.status}`);
   console.log();
 }
-var list4 = new Command("list").alias("ls").description("List flags").option("-n, --limit <n>", "Max results", "50").action(async function(o) {
+var list6 = new Command("list").alias("ls").description("List flags").option("-n, --limit <n>", "Max results", "50").action(async function(o) {
   const r = await listManagedDeliveries(
     requireCredentials(),
     kind,
@@ -11517,7 +12760,7 @@ var list4 = new Command("list").alias("ls").description("List flags").option("-n
     )
   );
 });
-var get2 = new Command("get").description("Get a flag").argument("<id>").action(async function(id) {
+var get4 = new Command("get").description("Get a flag").argument("<id>").action(async function(id) {
   const r = await getManagedDelivery(requireCredentials(), kind, id);
   if (!r.ok || !r.data)
     fail(
@@ -11588,29 +12831,35 @@ function write(name) {
   });
   return c;
 }
-function lifecycle(action25) {
-  return new Command(action25).description(`${action25[0].toUpperCase()}${action25.slice(1)} a flag`).argument("<id>").action(async function(id) {
+function lifecycle(action68) {
+  return new Command(action68).description(`${action68[0].toUpperCase()}${action68.slice(1)} a flag`).argument("<id>").action(async function(id) {
     const r = await transitionManagedDelivery(
       requireCredentials(),
       kind,
       id,
-      action25
+      action68
     );
     if (!r.ok || !r.data)
       fail(
         this,
-        r.error ?? `Failed to ${action25}`,
+        r.error ?? `Failed to ${action68}`,
         classifyStatus(r.status),
         r.errorDetails
       );
     output(this, { flag: r.data }, () => detail(r.data));
   });
 }
-var flagsCommand = new Command("flags").description("Manage flags").addCommand(list4).addCommand(get2).addCommand(status).addCommand(write("create")).addCommand(write("update")).addCommand(lifecycle("activate")).addCommand(lifecycle("pause")).addCommand(lifecycle("archive"));
+var flagsCommand = new Command("flags").description("Manage flags").addCommand(list6).addCommand(get4).addCommand(status).addCommand(write("create")).addCommand(write("update")).addCommand(lifecycle("activate")).addCommand(lifecycle("pause")).addCommand(lifecycle("archive")).addHelpText("after", `
+Examples:
+  apex flags list --limit 20
+  apex flags get checkout-redesign
+  apex flags create --key checkout-redesign --name "Checkout redesign"
+  apex flags activate <id>
+`);
 
 // src/commands/backlog.ts
-var import_node_fs14 = __toESM(require("node:fs"));
-var import_node_path12 = __toESM(require("node:path"));
+var import_node_fs15 = __toESM(require("node:fs"));
+var import_node_path13 = __toESM(require("node:path"));
 init_source();
 var kind2 = "backlog";
 var singular = "backlog item";
@@ -11618,7 +12867,7 @@ function parse(command, value) {
   if (!value) return {};
   try {
     const source = value.startsWith("@") ? value.slice(1) : value;
-    const text = value.startsWith("@") || import_node_fs14.default.existsSync(source) ? import_node_fs14.default.readFileSync(import_node_path12.default.resolve(process.cwd(), source), "utf8") : value;
+    const text = value.startsWith("@") || import_node_fs15.default.existsSync(source) ? import_node_fs15.default.readFileSync(import_node_path13.default.resolve(process.cwd(), source), "utf8") : value;
     const body5 = JSON.parse(text);
     if (!body5 || typeof body5 !== "object" || Array.isArray(body5)) throw new Error("body must be an object");
     return body5;
@@ -11633,28 +12882,28 @@ function detail2(x) {
   if (x.status) console.log(`  State: ${x.status}`);
   console.log();
 }
-var list5 = new Command("list").alias("ls").description("List backlog").option("-n, --limit <n>", "Max results", "50").option("--cursor <cursor>", "Continue from cursor").option("--include-archived", "Include archived backlog items").action(async function(o) {
+var list7 = new Command("list").alias("ls").description("List backlog").option("-n, --limit <n>", "Max results", "50").option("--cursor <cursor>", "Continue from cursor").option("--include-archived", "Include archived backlog items").action(async function(o) {
   const r = await listInsights(requireCredentials(), kind2, Number(o.limit), o.cursor, o.includeArchived);
   if (!r.ok || !r.data) fail(this, r.error ?? "Failed to list", classifyStatus(r.status), r.errorDetails);
   output(this, { backlog: r.data.data, pagination: r.data.pagination }, () => printTable(["ID", "NAME", "STATE"], r.data.data.map((x) => [x.id, String(x.title ?? x.label ?? x.key ?? "-"), x.status ?? "-"]), [36, 40, 12]));
 });
-var get3 = new Command("get").description("Get a backlog item").argument("<id>", "backlog item ID").action(async function(id) {
+var get5 = new Command("get").description("Get a backlog item").argument("<id>", "backlog item ID").action(async function(id) {
   const r = await getInsight(requireCredentials(), kind2, id);
   if (!r.ok || !r.data) fail(this, r.error ?? "Failed to get", classifyStatus(r.status), r.errorDetails);
   output(this, { backlog_item: r.data }, () => detail2(r.data));
 });
-function write2(action25) {
-  const c = new Command(action25).description(`${action25 === "create" ? "Create" : "Update"} a ${singular}`);
-  if (action25 === "update") c.argument("<id>", `${singular} ID`);
+function write2(action68) {
+  const c = new Command(action68).description(`${action68 === "create" ? "Create" : "Update"} a ${singular}`);
+  if (action68 === "update") c.argument("<id>", `${singular} ID`);
   c.argument("[json]", "Inline JSON, @file, or file path").option("--file <path>", "JSON body file");
   c.action(async function(...args) {
     const o = this.opts();
-    const id = action25 === "update" ? String(args[0]) : void 0;
-    const raw = o.file ? `@${o.file}` : String(args[action25 === "update" ? 1 : 0] ?? "") || void 0;
+    const id = action68 === "update" ? String(args[0]) : void 0;
+    const raw = o.file ? `@${o.file}` : String(args[action68 === "update" ? 1 : 0] ?? "") || void 0;
     const body5 = parse(this, raw);
     if (!Object.keys(body5).length) fail(this, "Provide a JSON body.", EXIT_CODES.validation);
-    const r = action25 === "create" ? await createInsight(requireCredentials(), kind2, body5) : await updateInsight(requireCredentials(), kind2, id, body5);
-    if (!r.ok || !r.data) fail(this, r.error ?? `Failed to ${action25}`, classifyStatus(r.status), r.errorDetails);
+    const r = action68 === "create" ? await createInsight(requireCredentials(), kind2, body5) : await updateInsight(requireCredentials(), kind2, id, body5);
+    if (!r.ok || !r.data) fail(this, r.error ?? `Failed to ${action68}`, classifyStatus(r.status), r.errorDetails);
     output(this, { backlog_item: r.data }, () => detail2(r.data));
   });
   return c;
@@ -11670,7 +12919,7 @@ var restore = new Command("restore").description("Restore an archived backlog it
   if (!r.ok || !r.data) fail(this, r.error ?? "Failed to restore", classifyStatus(r.status), r.errorDetails);
   output(this, { restored: true, id }, () => console.log(`Restored ${id}`));
 });
-var remove = new Command("delete").description("Delete a backlog item").argument("<id>", "backlog item ID").option("-f, --force", "Skip confirmation").action(async function(id, opts) {
+var remove2 = new Command("delete").description("Delete a backlog item").argument("<id>", "backlog item ID").option("-f, --force", "Skip confirmation").action(async function(id, opts) {
   if (!opts.force) {
     if (!process.stdin.isTTY || !process.stdout.isTTY) confirmationRequired(this, "Deleting a backlog item requires confirmation in non-TTY mode.", `apex backlog delete ${id} --force`);
     const readline2 = await import("node:readline");
@@ -11686,11 +12935,11 @@ var remove = new Command("delete").description("Delete a backlog item").argument
   if (!r.ok || !r.data) fail(this, r.error ?? "Failed to delete", classifyStatus(r.status), r.errorDetails);
   output(this, { deleted: true, id }, () => console.log(`Deleted ${id}`));
 });
-var backlogCommand = new Command("backlog").description("Manage backlog").addCommand(list5).addCommand(get3).addCommand(write2("create")).addCommand(write2("update")).addCommand(archive).addCommand(restore).addCommand(remove);
+var backlogCommand = new Command("backlog").description("Manage backlog").addCommand(list7).addCommand(get5).addCommand(write2("create")).addCommand(write2("update")).addCommand(archive).addCommand(restore).addCommand(remove2);
 
 // src/commands/signals.ts
-var import_node_fs15 = __toESM(require("node:fs"));
-var import_node_path13 = __toESM(require("node:path"));
+var import_node_fs16 = __toESM(require("node:fs"));
+var import_node_path14 = __toESM(require("node:path"));
 init_source();
 var kind3 = "signals";
 var singular2 = "signal";
@@ -11698,7 +12947,7 @@ function parse2(command, value) {
   if (!value) return {};
   try {
     const source = value.startsWith("@") ? value.slice(1) : value;
-    const text = value.startsWith("@") || import_node_fs15.default.existsSync(source) ? import_node_fs15.default.readFileSync(import_node_path13.default.resolve(process.cwd(), source), "utf8") : value;
+    const text = value.startsWith("@") || import_node_fs16.default.existsSync(source) ? import_node_fs16.default.readFileSync(import_node_path14.default.resolve(process.cwd(), source), "utf8") : value;
     const body5 = JSON.parse(text);
     if (!body5 || typeof body5 !== "object" || Array.isArray(body5)) throw new Error("body must be an object");
     return body5;
@@ -11713,49 +12962,49 @@ function detail3(x) {
   if (x.status) console.log(`  State: ${x.status}`);
   console.log();
 }
-var list6 = new Command("list").alias("ls").description("List signals").option("-n, --limit <n>", "Max results", "50").option("--cursor <cursor>", "Continue from cursor").option("--include-archived", "Include archived signals").action(async function(o) {
+var list8 = new Command("list").alias("ls").description("List signals").option("-n, --limit <n>", "Max results", "50").option("--cursor <cursor>", "Continue from cursor").option("--include-archived", "Include archived signals").action(async function(o) {
   const r = await listInsights(requireCredentials(), kind3, Number(o.limit), o.cursor, o.includeArchived);
   if (!r.ok || !r.data) fail(this, r.error ?? "Failed to list", classifyStatus(r.status), r.errorDetails);
   output(this, { signals: r.data.data, pagination: r.data.pagination }, () => printTable(["ID", "NAME", "STATE"], r.data.data.map((x) => [x.id, String(x.title ?? x.label ?? x.key ?? "-"), x.status ?? "-"]), [36, 40, 12]));
 });
-var get4 = new Command("get").description("Get a signal").argument("<id>", "signal ID").action(async function(id) {
+var get6 = new Command("get").description("Get a signal").argument("<id>", "signal ID").action(async function(id) {
   const r = await getInsight(requireCredentials(), kind3, id);
   if (!r.ok || !r.data) fail(this, r.error ?? "Failed to get", classifyStatus(r.status), r.errorDetails);
   output(this, { signal: r.data }, () => detail3(r.data));
 });
-function write3(action25) {
-  const c = new Command(action25).description(`${action25 === "create" ? "Create" : "Update"} a ${singular2}`);
-  if (action25 === "update") c.argument("<id>", `${singular2} ID`);
+function write3(action68) {
+  const c = new Command(action68).description(`${action68 === "create" ? "Create" : "Update"} a ${singular2}`);
+  if (action68 === "update") c.argument("<id>", `${singular2} ID`);
   c.argument("[json]", "Inline JSON, @file, or file path").option("--file <path>", "JSON body file");
   c.action(async function(...args) {
     const o = this.opts();
-    const id = action25 === "update" ? String(args[0]) : void 0;
-    const raw = o.file ? `@${o.file}` : String(args[action25 === "update" ? 1 : 0] ?? "") || void 0;
+    const id = action68 === "update" ? String(args[0]) : void 0;
+    const raw = o.file ? `@${o.file}` : String(args[action68 === "update" ? 1 : 0] ?? "") || void 0;
     const body5 = parse2(this, raw);
     if (!Object.keys(body5).length) fail(this, "Provide a JSON body.", EXIT_CODES.validation);
-    const r = action25 === "create" ? await createInsight(requireCredentials(), kind3, body5) : await updateInsight(requireCredentials(), kind3, id, body5);
-    if (!r.ok || !r.data) fail(this, r.error ?? `Failed to ${action25}`, classifyStatus(r.status), r.errorDetails);
+    const r = action68 === "create" ? await createInsight(requireCredentials(), kind3, body5) : await updateInsight(requireCredentials(), kind3, id, body5);
+    if (!r.ok || !r.data) fail(this, r.error ?? `Failed to ${action68}`, classifyStatus(r.status), r.errorDetails);
     output(this, { signal: r.data }, () => detail3(r.data));
   });
   return c;
 }
-var remove2 = new Command("delete").alias("archive").description("Delete or archive a signal").argument("<id>", "signal ID").action(async function(id) {
+var remove3 = new Command("delete").alias("archive").description("Delete or archive a signal").argument("<id>", "signal ID").action(async function(id) {
   const r = await deleteInsight(requireCredentials(), kind3, id);
   if (!r.ok || !r.data) fail(this, r.error ?? "Failed to delete", classifyStatus(r.status), r.errorDetails);
   output(this, { deleted: true, id }, () => console.log(`Deleted ${id}`));
 });
-var signalsCommand = new Command("signals").description("Manage signals").addCommand(list6).addCommand(get4).addCommand(write3("create")).addCommand(write3("update")).addCommand(remove2);
+var signalsCommand = new Command("signals").description("Manage signals").addCommand(list8).addCommand(get6).addCommand(write3("create")).addCommand(write3("update")).addCommand(remove3);
 
 // src/commands/personalizations.ts
 init_source();
-var import_node_fs16 = __toESM(require("node:fs"));
-var import_node_path14 = __toESM(require("node:path"));
+var import_node_fs17 = __toESM(require("node:fs"));
+var import_node_path15 = __toESM(require("node:path"));
 var kind4 = "personalizations";
 function body2(command, value, opts) {
   let parsed = {};
   if (value) {
     const source = value.startsWith("@") ? value.slice(1) : value;
-    const text = value.startsWith("@") || import_node_fs16.default.existsSync(source) ? import_node_fs16.default.readFileSync(import_node_path14.default.resolve(process.cwd(), source), "utf8") : value;
+    const text = value.startsWith("@") || import_node_fs17.default.existsSync(source) ? import_node_fs17.default.readFileSync(import_node_path15.default.resolve(process.cwd(), source), "utf8") : value;
     try {
       parsed = JSON.parse(text);
     } catch (e) {
@@ -11785,7 +13034,7 @@ function detail4(x) {
   console.log(`  State: ${x.status}`);
   console.log();
 }
-var list7 = new Command("list").alias("ls").description("List personalizations").option("-n, --limit <n>", "Max results", "50").action(async function(o) {
+var list9 = new Command("list").alias("ls").description("List personalizations").option("-n, --limit <n>", "Max results", "50").action(async function(o) {
   const r = await listManagedDeliveries(
     requireCredentials(),
     kind4,
@@ -11812,7 +13061,7 @@ var list7 = new Command("list").alias("ls").description("List personalizations")
     )
   );
 });
-var get5 = new Command("get").description("Get a personalization").argument("<id>").action(async function(id) {
+var get7 = new Command("get").description("Get a personalization").argument("<id>").action(async function(id) {
   const r = await getManagedDelivery(requireCredentials(), kind4, id);
   if (!r.ok || !r.data)
     fail(
@@ -11852,37 +13101,37 @@ function write4(name) {
   });
   return c;
 }
-function lifecycle2(action25) {
-  return new Command(action25).description(
-    `${action25[0].toUpperCase()}${action25.slice(1)} a personalization`
+function lifecycle2(action68) {
+  return new Command(action68).description(
+    `${action68[0].toUpperCase()}${action68.slice(1)} a personalization`
   ).argument("<id>").action(async function(id) {
     const r = await transitionManagedDelivery(
       requireCredentials(),
       kind4,
       id,
-      action25
+      action68
     );
     if (!r.ok || !r.data)
       fail(
         this,
-        r.error ?? `Failed to ${action25}`,
+        r.error ?? `Failed to ${action68}`,
         classifyStatus(r.status),
         r.errorDetails
       );
     output(this, { personalization: r.data }, () => detail4(r.data));
   });
 }
-var personalizationsCommand = new Command("personalizations").description("Manage personalizations").addCommand(list7).addCommand(get5).addCommand(write4("create")).addCommand(write4("update")).addCommand(lifecycle2("activate")).addCommand(lifecycle2("pause")).addCommand(lifecycle2("archive"));
+var personalizationsCommand = new Command("personalizations").description("Manage personalizations").addCommand(list9).addCommand(get7).addCommand(write4("create")).addCommand(write4("update")).addCommand(lifecycle2("activate")).addCommand(lifecycle2("pause")).addCommand(lifecycle2("archive"));
 
 // src/commands/targeting-resources.ts
 init_source();
-var import_node_fs17 = __toESM(require("node:fs"));
-var import_node_path15 = __toESM(require("node:path"));
+var import_node_fs18 = __toESM(require("node:fs"));
+var import_node_path16 = __toESM(require("node:path"));
 function body3(command, value) {
   if (!value) return {};
   const source = value.startsWith("@") ? value.slice(1) : value;
   try {
-    const text = value.startsWith("@") || import_node_fs17.default.existsSync(source) ? import_node_fs17.default.readFileSync(import_node_path15.default.resolve(process.cwd(), source), "utf8") : value;
+    const text = value.startsWith("@") || import_node_fs18.default.existsSync(source) ? import_node_fs18.default.readFileSync(import_node_path16.default.resolve(process.cwd(), source), "utf8") : value;
     return JSON.parse(text);
   } catch (error) {
     fail(
@@ -11961,17 +13210,17 @@ function targetingResourceCommand(kind5) {
         );
       })
     );
-  for (const action25 of ["create", "update"]) {
-    const command = new Command(action25).description(
-      `${action25 === "create" ? "Create" : "Update"} a ${singular3}`
+  for (const action68 of ["create", "update"]) {
+    const command = new Command(action68).description(
+      `${action68 === "create" ? "Create" : "Update"} a ${singular3}`
     );
-    if (action25 === "update") command.argument("<id>");
+    if (action68 === "update") command.argument("<id>");
     command.argument("[json]", "Inline JSON, @file, or file path").option("--file <path>", "JSON body file").action(async function(...args) {
       const opts = this.opts();
-      const id = action25 === "update" ? String(args[0]) : void 0;
-      const value = opts.file ? `@${opts.file}` : String(args[action25 === "update" ? 1 : 0] ?? "") || void 0;
+      const id = action68 === "update" ? String(args[0]) : void 0;
+      const value = opts.file ? `@${opts.file}` : String(args[action68 === "update" ? 1 : 0] ?? "") || void 0;
       const requestBody = body3(this, value);
-      if (action25 === "update" && typeof requestBody === "object" && requestBody !== null && !Array.isArray(requestBody) && Object.keys(requestBody).length === 0)
+      if (action68 === "update" && typeof requestBody === "object" && requestBody !== null && !Array.isArray(requestBody) && Object.keys(requestBody).length === 0)
         fail(
           this,
           `Updating a ${singular3} requires at least one field.`,
@@ -11979,7 +13228,7 @@ function targetingResourceCommand(kind5) {
         );
       const response = await requestTargetingResource(
         requireCredentials(),
-        action25 === "create" ? "POST" : "PATCH",
+        action68 === "create" ? "POST" : "PATCH",
         kind5,
         id,
         requestBody
@@ -11987,7 +13236,7 @@ function targetingResourceCommand(kind5) {
       if (!response.ok || !response.data)
         fail(
           this,
-          response.error ?? `Failed to ${action25}`,
+          response.error ?? `Failed to ${action68}`,
           classifyStatus(response.status),
           response.errorDetails
         );
@@ -11996,7 +13245,7 @@ function targetingResourceCommand(kind5) {
         {
           [kind5 === "exclusion-groups" ? "exclusion_group" : singular3]: response.data
         },
-        () => console.log(source_default.green(`${action25}d ${singular3}`))
+        () => console.log(source_default.green(`${action68}d ${singular3}`))
       );
     });
     root.addCommand(command);
@@ -12083,7 +13332,7 @@ var exclusionGroupsCommand = targetingResourceCommand("exclusion-groups");
 // src/commands/brand.ts
 init_source();
 var NO_PROFILE_MESSAGE = "No brand profile yet \u2014 run onboarding or a site check";
-var brandCommand = new Command("brand").description("Print the shop brand context for external agents").action(async function action20() {
+var brandCommand = new Command("brand").description("Print the shop brand context for external agents").action(async function action57() {
   const creds2 = requireCredentials();
   const res = await getBrandContext(creds2);
   if (res.status === 404) {
@@ -12116,7 +13365,7 @@ var brandCommand = new Command("brand").description("Print the shop brand contex
 
 // src/commands/targeting.ts
 init_source();
-var test = new Command("test").description("Evaluate experiment URL targeting for a page").argument("<url>", "URL to evaluate").option("--status <status>", "Comma-separated statuses to include, or all", "all").action(async function action21(url, opts) {
+var test2 = new Command("test").description("Evaluate experiment URL targeting for a page").argument("<url>", "URL to evaluate").option("--status <status>", "Comma-separated statuses to include, or all", "all").action(async function action58(url, opts) {
   const creds2 = requireCredentials();
   const res = await testTargeting(creds2, url, { status: opts.status });
   if (!res.ok || !res.data) {
@@ -12152,17 +13401,17 @@ var test = new Command("test").description("Evaluate experiment URL targeting fo
     }
   });
 });
-var targetingCommand = new Command("targeting").description("Test experiment targeting").addCommand(test);
+var targetingCommand = new Command("targeting").description("Test experiment targeting").addCommand(test2);
 
 // src/commands/sos.ts
 init_source();
-var import_node_fs18 = __toESM(require("node:fs"));
-var import_node_path16 = __toESM(require("node:path"));
+var import_node_fs19 = __toESM(require("node:fs"));
+var import_node_path17 = __toESM(require("node:path"));
 var SOS_TYPES = /* @__PURE__ */ new Set(["full_handover", "design", "development", "qa", "config", "bug"]);
 function readText(value) {
   if (!value) return void 0;
   if (!value.startsWith("@")) return value;
-  return import_node_fs18.default.readFileSync(import_node_path16.default.resolve(process.cwd(), value.slice(1)), "utf8");
+  return import_node_fs19.default.readFileSync(import_node_path17.default.resolve(process.cwd(), value.slice(1)), "utf8");
 }
 function printTicket(ticket, reused) {
   console.log();
@@ -12173,7 +13422,7 @@ function printTicket(ticket, reused) {
   console.log(`  Status: ${ticket.my_status ?? ticket.mapped_status}`);
   console.log();
 }
-var create3 = new Command("create").description("Create an Apex SOS ticket").option("--type <type>", "full_handover|design|development|qa|config|bug", "qa").option("--loom <url>", "Loom URL with reproduction or QA context").option("--experiment <id>", "Experiment ID").option("--sub-class <text>", "SOS sub-classification").option("--description <text-or-@file>", "Description text or @path").argument("[description]", "Description text").action(async function action22(descriptionArg, opts) {
+var create4 = new Command("create").description("Create an Apex SOS ticket").option("--type <type>", "full_handover|design|development|qa|config|bug", "qa").option("--loom <url>", "Loom URL with reproduction or QA context").option("--experiment <id>", "Experiment ID").option("--sub-class <text>", "SOS sub-classification").option("--description <text-or-@file>", "Description text or @path").argument("[description]", "Description text").action(async function action59(descriptionArg, opts) {
   if (!SOS_TYPES.has(opts.type)) {
     fail(this, "Invalid SOS type. Use full_handover, design, development, qa, config, or bug.", 3);
   }
@@ -12191,7 +13440,7 @@ var create3 = new Command("create").description("Create an Apex SOS ticket").opt
   }
   output(this, res.data, () => printTicket(res.data.ticket, res.data.reused));
 });
-var mine = new Command("mine").description("List SOS tickets created by this API key").action(async function action23() {
+var mine = new Command("mine").description("List SOS tickets created by this API key").action(async function action60() {
   const creds2 = requireCredentials();
   const res = await listMySos(creds2);
   if (!res.ok || !res.data) {
@@ -12215,18 +13464,18 @@ var mine = new Command("mine").description("List SOS tickets created by this API
     );
   });
 });
-var sosCommand = new Command("sos").description("Create and inspect Apex SOS tickets").addCommand(create3).addCommand(mine);
+var sosCommand = new Command("sos").description("Create and inspect Apex SOS tickets").addCommand(create4).addCommand(mine);
 
 // src/commands/audit-log.ts
-var list8 = new Command("list").alias("ls").option("--entity-type <type>").option("--entity-id <id>").option("-n, --limit <n>", "Max results", "50").option("--offset <n>", "Pagination offset", "0").action(async function(opts) {
-  const res = await listAuditLogs(requireCredentials(), { entityType: opts.entityType, entityId: opts.entityId, limit: Number.parseInt(opts.limit, 10), offset: Number.parseInt(opts.offset, 10) });
+var list10 = new Command("list").alias("ls").option("--entity-type <type>").option("--entity-id <id>").option("--shop <id>", "Shop ID for user-key fallback").option("-n, --limit <n>", "Max results", "50").option("--offset <n>", "Pagination offset", "0").action(async function(opts) {
+  const res = await listAuditLogs(requireCredentials(), { entityType: opts.entityType, entityId: opts.entityId, shopId: opts.shop, limit: Number.parseInt(opts.limit, 10), offset: Number.parseInt(opts.offset, 10) });
   if (!res.ok || !res.data) fail(this, res.error ?? "Failed to list audit logs", classifyStatus(res.status));
   output(this, res.data, () => printTable(["TIME", "ACTION", "ENTITY", "ENTITY_ID", "ACTOR"], res.data.data.map((x) => [x.created_at, x.action, x.entity_type, x.entity_id, x.user_id])));
 });
-var auditLogCommand = new Command("audit-log").description("Inspect audit logs").addCommand(list8);
+var auditLogCommand = new Command("audit-log").description("Inspect audit logs").addCommand(list10);
 
 // src/commands/inbox.ts
-var list9 = new Command("list").option("--experiment <id>").action(async function(opts) {
+var list11 = new Command("list").option("--experiment <id>").action(async function(opts) {
   const r = await listInbox(requireCredentials(), opts.experiment);
   if (!r.ok || !r.data) fail(this, r.error ?? "Failed to list inbox", classifyStatus(r.status));
   output(this, r.data, () => printTable(["TIME", "ROLE", "MESSAGE"], r.data.messages.map((m) => [m.created_at, m.role, m.body])));
@@ -12241,16 +13490,16 @@ var markRead = new Command("mark-read").option("--channel <key>", "Mark one chan
   if (!r.ok || !r.data) fail(this, r.error ?? "Failed to mark inbox read", classifyStatus(r.status));
   output(this, r.data, () => console.log(`Marked ${r.data.channelKeys.length} channel(s) read`));
 });
-var inboxCommand = new Command("inbox").description("Read and send inbox messages").addCommand(list9).addCommand(send).addCommand(markRead);
+var inboxCommand = new Command("inbox").description("Read and send inbox messages").addCommand(list11).addCommand(send).addCommand(markRead);
 
 // src/commands/shops.ts
-var import_node_fs19 = __toESM(require("node:fs"));
-var import_node_path17 = __toESM(require("node:path"));
+var import_node_fs20 = __toESM(require("node:fs"));
+var import_node_path18 = __toESM(require("node:path"));
 function body4(command, raw) {
   if (!raw) return {};
   try {
     const source = raw.startsWith("@") ? raw.slice(1) : raw;
-    const text = raw.startsWith("@") || import_node_fs19.default.existsSync(source) ? import_node_fs19.default.readFileSync(import_node_path17.default.resolve(source), "utf8") : raw;
+    const text = raw.startsWith("@") || import_node_fs20.default.existsSync(source) ? import_node_fs20.default.readFileSync(import_node_path18.default.resolve(source), "utf8") : raw;
     const value = JSON.parse(text);
     if (!value || typeof value !== "object" || Array.isArray(value))
       throw new Error("body must be an object");
@@ -12271,9 +13520,10 @@ function done(command, r, label) {
       classifyStatus(r.status),
       r.errorDetails
     );
-  output(command, r.data, () => console.log(JSON.stringify(r.data, null, 2)));
+  output(command, r.data, () => process.stdout.write(`${JSON.stringify(r.data, null, 2)}
+`));
 }
-var list10 = new Command("list").alias("ls").description("List organization shops").action(async function() {
+var list12 = new Command("list").alias("ls").description("List organization shops").action(async function() {
   const r = await listShops(requireUserCredentials());
   if (!r.ok || !r.data)
     fail(
@@ -12297,10 +13547,10 @@ var list10 = new Command("list").alias("ls").description("List organization shop
     )
   );
 });
-var get6 = new Command("get").description("Get a shop").argument("<id>").action(async function(id) {
+var get8 = new Command("get").description("Get a shop").argument("<id>").action(async function(id) {
   done(this, await getShop(requireUserCredentials(), id), "get shop");
 });
-var create4 = new Command("create").description("Create a shop").argument("[json]", "Inline JSON, @file, or file path").option("--name <name>", "Shop name").option("--domain <domain>", "Public shop domain").option("--origin <origin>", "Backend origin URL").option("--currency <code>", "Three-letter currency code").action(async function(raw, o) {
+var create5 = new Command("create").description("Create a shop").argument("[json]", "Inline JSON, @file, or file path").option("--name <name>", "Shop name").option("--domain <domain>", "Public shop domain").option("--origin <origin>", "Backend origin URL").option("--currency <code>", "Three-letter currency code").action(async function(raw, o) {
   const flags = {
     ...o.name ? { name: o.name } : {},
     ...o.domain ? { domain: o.domain } : {},
@@ -12313,7 +13563,7 @@ var create4 = new Command("create").description("Create a shop").argument("[json
   const r = await createShop(requireUserCredentials(), payload);
   done(this, r, "create shop");
 });
-var update2 = new Command("update").description("Update a shop").argument("<id>").argument("[json]", "Inline JSON, @file, or file path").option("--holdout-pct <percent>", "Global holdout percent (0-10)").option("--holdout-enabled", "Enable global holdout v1").option("--holdout-disabled", "Disable global holdout v1").option("--confirm-tier", "Confirm a commercially sensitive tier change").action(async function(id, raw, o) {
+var update3 = new Command("update").description("Update a shop").argument("<id>").argument("[json]", "Inline JSON, @file, or file path").option("--holdout-pct <percent>", "Global holdout percent (0-10)").option("--holdout-enabled", "Enable global holdout v1").option("--holdout-disabled", "Disable global holdout v1").option("--confirm-tier", "Confirm a commercially sensitive tier change").action(async function(id, raw, o) {
   const b = raw === void 0 ? {} : body4(this, raw);
   if (o.holdoutEnabled && o.holdoutDisabled)
     fail(this, "Use only one of --holdout-enabled or --holdout-disabled", EXIT_CODES.validation);
@@ -12352,10 +13602,10 @@ function settings(name, description, toggle) {
     async function(id, raw) {
       const opts = this.opts();
       const on = toggle ? Boolean(opts[toggle.on]) : false;
-      const off = toggle ? Boolean(opts[toggle.off]) : false;
-      if (on && off)
+      const off3 = toggle ? Boolean(opts[toggle.off]) : false;
+      if (on && off3)
         fail(this, `Use only one of --${toggle.on} or --${toggle.off}`, EXIT_CODES.validation);
-      const flagBody = on || off ? { enabled: on } : void 0;
+      const flagBody = on || off3 ? { enabled: on } : void 0;
       const patchBody = raw !== void 0 || flagBody !== void 0 ? { ...raw !== void 0 ? body4(this, raw) : {}, ...flagBody ?? {} } : void 0;
       const r = patchBody !== void 0 ? await patchShopArea(requireUserCredentials(), id, name, patchBody) : await getShopArea(requireUserCredentials(), id, name);
       if (!r.ok || !r.data)
@@ -12365,7 +13615,8 @@ function settings(name, description, toggle) {
           classifyStatus(r.status),
           r.errorDetails
         );
-      output(this, r.data, () => console.log(JSON.stringify(r.data, null, 2)));
+      output(this, r.data, () => process.stdout.write(`${JSON.stringify(r.data, null, 2)}
+`));
     }
   );
 }
@@ -12406,7 +13657,8 @@ var reviewFact = new Command("review-fact").argument("<id>").argument("<fact-id>
       classifyStatus(r.status),
       r.errorDetails
     );
-  output(this, r.data, () => console.log(JSON.stringify(r.data, null, 2)));
+  output(this, r.data, () => process.stdout.write(`${JSON.stringify(r.data, null, 2)}
+`));
 });
 var reviewFinding = new Command("review-finding").argument("<id>").argument("<json>").action(async function(id, raw) {
   const r = await postShopArea(
@@ -12422,7 +13674,8 @@ var reviewFinding = new Command("review-finding").argument("<id>").argument("<js
       classifyStatus(r.status),
       r.errorDetails
     );
-  output(this, r.data, () => console.log(JSON.stringify(r.data, null, 2)));
+  output(this, r.data, () => process.stdout.write(`${JSON.stringify(r.data, null, 2)}
+`));
 });
 var startLearningRun = new Command("start-learning-run").argument("<id>").argument("[json]").action(async function(id, raw) {
   const r = await postShopArea(
@@ -12438,7 +13691,8 @@ var startLearningRun = new Command("start-learning-run").argument("<id>").argume
       classifyStatus(r.status),
       r.errorDetails
     );
-  output(this, r.data, () => console.log(JSON.stringify(r.data, null, 2)));
+  output(this, r.data, () => process.stdout.write(`${JSON.stringify(r.data, null, 2)}
+`));
 });
 profile.addCommand(reviewFact).addCommand(reviewFinding).addCommand(startLearningRun);
 var shopware = new Command("shopware").description("Manage Shopware bindings");
@@ -12455,7 +13709,7 @@ shopware.addCommand(
     output(this, result.data, () => console.log(`Pre-bound ${options.shopUrl} to ${id}`));
   })
 );
-var shopsCommand = new Command("shops").description("Manage organization shops").addCommand(list10).addCommand(get6).addCommand(create4).addCommand(update2).addCommand(settings("auto-stop", "Read or update auto-stop defaults", { on: "enable", off: "disable" })).addCommand(settings("testing-defaults", "Read or update testing defaults")).addCommand(settings("guardian", "Read or update guardian defaults", { on: "on", off: "off" })).addCommand(profile).addCommand(shopware);
+var shopsCommand = new Command("shops").description("Manage organization shops").addCommand(list12).addCommand(get8).addCommand(create5).addCommand(update3).addCommand(settings("auto-stop", "Read or update auto-stop defaults", { on: "enable", off: "disable" })).addCommand(settings("testing-defaults", "Read or update testing defaults")).addCommand(settings("guardian", "Read or update guardian defaults", { on: "on", off: "off" })).addCommand(profile).addCommand(shopware);
 
 // src/commands/schema.ts
 function optionSchema(option) {
@@ -12486,25 +13740,26 @@ function commandSchema(command) {
   };
 }
 function createSchemaCommand(program3) {
-  return new Command("schema").description("Print the current Apex CLI command and flag schema").option("--json", "Print JSON schema").action(function action25() {
+  return new Command("schema").description("Print the current Apex CLI command and flag schema").option("--json", "Print JSON schema").action(function action68() {
     const schema = commandSchema(program3);
     output(this, schema, () => {
-      console.log(JSON.stringify(schema, null, 2));
+      process.stdout.write(`${JSON.stringify(schema, null, 2)}
+`);
     });
   });
 }
 
 // src/commands/skills.ts
-var import_node_fs20 = __toESM(require("node:fs"));
-var import_node_path18 = __toESM(require("node:path"));
+var import_node_fs21 = __toESM(require("node:fs"));
+var import_node_path19 = __toESM(require("node:path"));
 function packageRoot() {
   const candidates = [
-    import_node_path18.default.resolve(__dirname, ".."),
-    import_node_path18.default.resolve(import_node_path18.default.dirname(process.argv[1] ?? process.cwd()), ".."),
-    import_node_path18.default.resolve(process.cwd(), "packages/cli")
+    import_node_path19.default.resolve(__dirname, ".."),
+    import_node_path19.default.resolve(import_node_path19.default.dirname(process.argv[1] ?? process.cwd()), ".."),
+    import_node_path19.default.resolve(process.cwd(), "packages/cli")
   ];
   for (const candidate of candidates) {
-    if (import_node_fs20.default.existsSync(import_node_path18.default.join(candidate, "AGENTS.md"))) return candidate;
+    if (import_node_fs21.default.existsSync(import_node_path19.default.join(candidate, "AGENTS.md"))) return candidate;
   }
   throw new Error(
     `Apex CLI package files not found. Looked for AGENTS.md in: ${candidates.join(", ")}`
@@ -12513,24 +13768,24 @@ function packageRoot() {
 function skillPaths() {
   const root = packageRoot();
   return {
-    agents: import_node_path18.default.join(root, "AGENTS.md"),
-    skill: import_node_path18.default.join(root, "skills", "apex-cli", "SKILL.md")
+    agents: import_node_path19.default.join(root, "AGENTS.md"),
+    skill: import_node_path19.default.join(root, "skills", "apex-cli", "SKILL.md")
   };
 }
 function installSkill(paths, targetRoot) {
-  const missing = [paths.skill, paths.agents].filter((filePath) => !import_node_fs20.default.existsSync(filePath));
+  const missing = [paths.skill, paths.agents].filter((filePath) => !import_node_fs21.default.existsSync(filePath));
   if (missing.length > 0) {
     throw new Error(
       `Apex CLI package files not found. Missing: ${missing.join(", ")}`
     );
   }
-  const target = import_node_path18.default.resolve(targetRoot, "apex-cli");
-  import_node_fs20.default.mkdirSync(target, { recursive: true });
-  import_node_fs20.default.copyFileSync(paths.skill, import_node_path18.default.join(target, "SKILL.md"));
-  import_node_fs20.default.copyFileSync(paths.agents, import_node_path18.default.join(target, "AGENTS.md"));
+  const target = import_node_path19.default.resolve(targetRoot, "apex-cli");
+  import_node_fs21.default.mkdirSync(target, { recursive: true });
+  import_node_fs21.default.copyFileSync(paths.skill, import_node_path19.default.join(target, "SKILL.md"));
+  import_node_fs21.default.copyFileSync(paths.agents, import_node_path19.default.join(target, "AGENTS.md"));
   return target;
 }
-var skillsCommand = new Command("skills").description("Print or install the Apex CLI agent skill files").option("--install", "Copy the Apex CLI skill into ./.claude/skills/apex-cli").option("--target <dir>", "Install target skills directory", ".claude/skills").option("--json", "Print JSON").action(function action24(opts) {
+var skillsCommand = new Command("skills").description("Print or install the Apex CLI agent skill files").option("--install", "Copy the Apex CLI skill into ./.claude/skills/apex-cli").option("--target <dir>", "Install target skills directory", ".claude/skills").option("--json", "Print JSON").action(function action61(opts) {
   let paths;
   try {
     paths = skillPaths();
@@ -12564,7 +13819,7 @@ var settingsGet = new Command("settings").description("Show platform operator se
   if (!res.ok || !res.data) fail(this, res.error ?? "Failed to read settings", classifyStatus(res.status));
   output(this, res.data, () => printTable(["SETTING", "VALUE"], Object.entries(res.data.data).map(([k, v]) => [k, v ? "on" : "off"])));
 });
-var set = new Command("set").description("Set platform kill switches").option("--guardian <on|off>").option("--srm-check <on|off>").option("--confirm", "Confirm immediate production impact").action(async function(opts) {
+var set4 = new Command("set").description("Set platform kill switches").option("--guardian <on|off>").option("--srm-check <on|off>").option("--confirm", "Confirm immediate production impact").action(async function(opts) {
   if (!opts.guardian && !opts.srmCheck) fail(this, "Provide --guardian or --srm-check", 3);
   let body5 = {};
   try {
@@ -12581,7 +13836,7 @@ var set = new Command("set").description("Set platform kill switches").option("-
   if (!res.ok || !res.data) fail(this, res.error ?? "Failed to update settings", classifyStatus(res.status));
   output(this, res.data, () => console.log("Platform settings updated."));
 });
-settingsGet.addCommand(set);
+settingsGet.addCommand(set4);
 var quarantine = new Command("quarantine").description("List tracking quarantine events").action(async function() {
   const res = await getAdminQuarantine(requireCredentials());
   if (!res.ok || !res.data) fail(this, res.error ?? "Failed to read quarantine", classifyStatus(res.status));
@@ -12591,10 +13846,11 @@ var adminCommand = new Command("admin").description("Operate allowlisted platfor
 
 // src/commands/membership.ts
 init_source();
-async function run(c, p, label) {
+async function run2(c, p, label) {
   const r = await p;
   if (!r.ok) fail(c, r.error ?? `Failed to ${label}`, classifyStatus(r.status), r.errorDetails);
-  output(c, r.data ?? {}, () => console.log(JSON.stringify(r.data, null, 2)));
+  output(c, r.data ?? {}, () => process.stdout.write(`${JSON.stringify(r.data, null, 2)}
+`));
 }
 async function confirm(c, force, label, retry) {
   if (force) return true;
@@ -12611,43 +13867,43 @@ async function confirm(c, force, label, retry) {
 }
 var orgCommand = new Command("org").description("Manage the current organization");
 orgCommand.command("get").action(async function() {
-  await run(this, getOrg(requireUserCredentials()), "get organization");
+  await run2(this, getOrg(requireUserCredentials()), "get organization");
 });
 orgCommand.command("update").option("--name <name>").option("--slug <slug>").option("--billing-email <email>").action(async function(o) {
-  await run(this, updateOrg(requireUserCredentials(), { ...o.name ? { name: o.name } : {}, ...o.slug ? { slug: o.slug } : {}, ...o.billingEmail ? { billing_email: o.billingEmail } : {} }), "update organization");
+  await run2(this, updateOrg(requireUserCredentials(), { ...o.name ? { name: o.name } : {}, ...o.slug ? { slug: o.slug } : {}, ...o.billingEmail ? { billing_email: o.billingEmail } : {} }), "update organization");
 });
 orgCommand.command("members").action(async function() {
-  await run(this, listOrgMembers(requireUserCredentials()), "list members");
+  await run2(this, listOrgMembers(requireUserCredentials()), "list members");
 });
 orgCommand.command("invite").argument("<email>").option("--role <role>", "Alias for --org-role").option("--org-role <role>", "Organization role", "member").option("--default-shop-role <role>", "Default shop role", "viewer").action(async function(email, o) {
-  await run(this, inviteOrg(requireUserCredentials(), email, o.role ?? o.orgRole, o.defaultShopRole), "invite member");
+  await run2(this, inviteOrg(requireUserCredentials(), email, o.role ?? o.orgRole, o.defaultShopRole), "invite member");
 });
 orgCommand.command("revoke-invite").argument("<id>").action(async function(id) {
-  await run(this, revokeOrgInvite(requireUserCredentials(), id), "revoke invitation");
+  await run2(this, revokeOrgInvite(requireUserCredentials(), id), "revoke invitation");
 });
 orgCommand.command("set-role").argument("<memberId>").argument("<role>").option("--default-shop-role <role>").action(async function(id, role, o) {
-  await run(this, setOrgMember(requireUserCredentials(), id, { role, ...o.defaultShopRole ? { default_shop_role: o.defaultShopRole } : {} }), "set role");
+  await run2(this, setOrgMember(requireUserCredentials(), id, { role, ...o.defaultShopRole ? { default_shop_role: o.defaultShopRole } : {} }), "set role");
 });
 orgCommand.command("remove-member").argument("<memberId>").option("-f, --force").action(async function(id, o) {
   if (!await confirm(this, o.force, `Remove organization member ${id}`, `apex org remove-member ${id} --force`)) return;
-  await run(this, removeOrgMember(requireUserCredentials(), id), "remove member");
+  await run2(this, removeOrgMember(requireUserCredentials(), id), "remove member");
 });
 var teamCommand = new Command("team").description("Manage a shop team");
 teamCommand.command("members").requiredOption("--shop <id>").action(async function(o) {
-  await run(this, listTeamMembers(requireUserCredentials(), o.shop), "list team");
+  await run2(this, listTeamMembers(requireUserCredentials(), o.shop), "list team");
 });
 teamCommand.command("invite").argument("<email>").requiredOption("--shop <id>").requiredOption("--role <role>").action(async function(email, o) {
-  await run(this, inviteTeam(requireUserCredentials(), email, o.shop, o.role), "invite team member");
+  await run2(this, inviteTeam(requireUserCredentials(), email, o.shop, o.role), "invite team member");
 });
 teamCommand.command("revoke-invite").argument("<id>").requiredOption("--shop <id>").action(async function(id, o) {
-  await run(this, revokeTeamInvite(requireUserCredentials(), id, o.shop), "revoke invitation");
+  await run2(this, revokeTeamInvite(requireUserCredentials(), id, o.shop), "revoke invitation");
 });
 teamCommand.command("set-role").argument("<memberId>").argument("<role>").requiredOption("--shop <id>").action(async function(id, role, o) {
-  await run(this, setTeamMember(requireUserCredentials(), id, o.shop, role), "set role");
+  await run2(this, setTeamMember(requireUserCredentials(), id, o.shop, role), "set role");
 });
 teamCommand.command("remove").argument("<memberId>").requiredOption("--shop <id>").option("-f, --force").action(async function(id, o) {
   if (!await confirm(this, o.force, `Remove team member ${id}`, `apex team remove ${id} --shop ${o.shop} --force`)) return;
-  await run(this, removeTeamMember(requireUserCredentials(), id, o.shop), "remove member");
+  await run2(this, removeTeamMember(requireUserCredentials(), id, o.shop), "remove member");
 });
 
 // src/commands/account.ts
@@ -12656,7 +13912,7 @@ function userCredentials2() {
   if (!creds2.userApiKey) throw new CliError('User authentication required. Run "apex login --user".', EXIT_CODES.auth);
   return creds2;
 }
-var set2 = new Command("set").option("--name <text>", "Display name").option("--avatar <url>", "Avatar data URL").action(async function(opts) {
+var set5 = new Command("set").option("--name <text>", "Display name").option("--avatar <url>", "Avatar data URL").action(async function(opts) {
   if (opts.name === void 0 && opts.avatar === void 0) throw new CliError("At least one of --name or --avatar is required", EXIT_CODES.validation);
   const res = await setAccountProfile(userCredentials2(), { ...opts.name !== void 0 ? { displayName: opts.name } : {}, ...opts.avatar !== void 0 ? { avatarDataUrl: opts.avatar } : {} });
   if (!res.ok || !res.data) fail(this, res.error ?? "Failed to update account profile", classifyStatus(res.status));
@@ -12667,7 +13923,7 @@ var profile2 = new Command("profile").description("Show the current account prof
   if (!res.ok || !res.data) fail(this, res.error ?? "Failed to get account profile", classifyStatus(res.status));
   output(this, res.data, () => console.log(`${res.data.data.displayName ?? "(no name)"}
 ${res.data.data.avatarDataUrl ?? "(no avatar)"}`));
-}).addCommand(set2);
+}).addCommand(set5);
 var accountCommand = new Command("account").description("Manage your Apex account").addCommand(profile2);
 
 // src/commands/keys.ts
@@ -12676,12 +13932,12 @@ function creds() {
   if (!value.userApiKey) throw new CliError('User authentication required. Run "apex login --user".', EXIT_CODES.auth);
   return value;
 }
-var list11 = new Command("list").requiredOption("--shop <id>").action(async function(opts) {
+var list13 = new Command("list").requiredOption("--shop <id>").action(async function(opts) {
   const res = await listUserManagedKeys(creds(), opts.shop);
   if (!res.ok || !res.data) fail(this, res.error ?? "Failed to list API keys", classifyStatus(res.status));
   output(this, res.data, () => printTable(["ID", "NAME", "PREFIX", "TYPE"], res.data.data.map((key) => [key.id, key.name, key.key_prefix, key.type])));
 });
-var create5 = new Command("create").requiredOption("--shop <id>").requiredOption("--name <name>").requiredOption("--type <type>").option("--permissions <csv>").action(async function(opts) {
+var create6 = new Command("create").requiredOption("--shop <id>").requiredOption("--name <name>").requiredOption("--type <type>").option("--permissions <csv>").action(async function(opts) {
   if (!["live_secret", "test_secret", "publishable"].includes(opts.type)) throw new CliError("--type must be live_secret, test_secret, or publishable", EXIT_CODES.validation);
   const permissions = opts.permissions?.split(",").map((item) => item.trim()).filter(Boolean);
   const res = await createUserManagedKey(creds(), { shop_id: opts.shop, name: opts.name, type: opts.type, ...permissions?.length ? { permissions } : {} });
@@ -12696,13 +13952,311 @@ var revoke = new Command("revoke").argument("<keyId>").requiredOption("--shop <i
   if (!res.ok || !res.data) fail(this, res.error ?? "Failed to revoke API key", classifyStatus(res.status));
   output(this, res.data, () => console.log(`Revoked ${keyId}`));
 });
-var keysCommand = new Command("keys").description("Manage shop API keys").addCommand(list11).addCommand(create5).addCommand(revoke);
+var keysCommand = new Command("keys").description("Manage shop API keys").addCommand(list13).addCommand(create6).addCommand(revoke);
+
+// src/commands/prospect.ts
+init_source();
+
+// src/lib/detect-markers.ts
+var DETECTION_MARKERS = [
+  { id: "cloudflare_challenge", kind: "protected", verdict: "Cloudflare challenge", match: /cf-browser-verification|cf-chl-|cdn-cgi\/challenge-platform/i },
+  { id: "shopify_cart_js", kind: "platform", verdict: "Shopify", confidence: "high", recipe: { placement: "Shopify theme.liquid before </head> or the customer-deployed edge worker for headless themes." }, match: /__apex_secondary_shopify_cart_js__/i },
+  { id: "shopify", kind: "platform", verdict: "Shopify", confidence: "high", recipe: { placement: "Shopify theme.liquid before </head> or the customer-deployed edge worker for headless themes." }, match: /cdn\.shopify\.com|Shopify\.theme|window\.Shopify|\/cart\.js/i },
+  { id: "woocommerce", kind: "platform", verdict: "WooCommerce", confidence: "high", recipe: { placement: "WordPress header or WooCommerce plugin template before </head>." }, match: /woocommerce|wp-content\/plugins\/woocommerce|wc-cart-fragments/i },
+  { id: "shopware", kind: "platform", verdict: "Shopware", confidence: "high", recipe: { placement: "Shopware storefront base template before </head>." }, match: /shopware|sw-?storefront|data-shopware/i },
+  { id: "next_headless", kind: "platform", verdict: "Next.js headless", confidence: "high", recipe: { placement: "Headless app document/root layout before </head> so Apex loads on every route." }, match: /__NEXT_DATA__|\/_next\//i },
+  { id: "webflow", kind: "platform", verdict: "Webflow", confidence: "high", recipe: { placement: "Webflow Project Settings \u2192 Custom Code \u2192 Head Code." }, match: /data-wf-page|data-wf-site|webflow\.js|assets\.website-files\.com/i },
+  { id: "cookiescript", kind: "cmp", verdict: "CookieScript", recipe: { consentProvider: "cookiescript", consentGroup: "targeting" }, match: /cookie-script\.com|CookieScript|cookiescript/i },
+  { id: "usercentrics", kind: "cmp", verdict: "Usercentrics", recipe: { consentProvider: "usercentrics", consentGroup: "marketing" }, match: /app\.usercentrics\.eu|usercentrics\.eu|UC_UI|usercentrics/i },
+  { id: "cookiebot", kind: "cmp", verdict: "Cookiebot", recipe: { consentProvider: "cookiebot", consentGroup: "marketing" }, match: /consent\.cookiebot\.com|Cookiebot/i },
+  { id: "ccm19", kind: "cmp", verdict: "CCM19", recipe: { consentProvider: "ccm19", consentGroup: "targeting" }, match: /ccm19\.de|CCM\.|ccm19/i },
+  { id: "onetrust", kind: "cmp", verdict: "OneTrust", recipe: { consentProvider: "onetrust", consentGroup: "C0004" }, match: /cdn\.cookielaw\.org|Optanon|OneTrust/i },
+  { id: "pandectes", kind: "cmp", verdict: "Pandectes", recipe: { consentProvider: "pandectes", consentGroup: "marketing" }, match: /pandectes|Pandectes/i },
+  { id: "gtm", kind: "analytics", verdict: "Google Tag Manager", match: /googletagmanager\.com\/gtm\.js|GTM-[A-Z0-9]+/i },
+  { id: "ga4", kind: "analytics", verdict: "Google Analytics", match: /googletagmanager\.com\/gtag\/js\?id=|\bG-[A-Z0-9]{6,}\b|google-analytics\.com/ },
+  { id: "meta_pixel", kind: "analytics", verdict: "Meta Pixel", match: /fbevents\.js|fbq\(/i },
+  { id: "next_spa", kind: "spa", verdict: "Next.js", recipe: { runtimeHint: "applyTiming=after_hydration" }, match: /__NEXT_DATA__|\/_next\//i },
+  { id: "react", kind: "spa", verdict: "React", recipe: { runtimeHint: "applyTiming=after_hydration" }, match: /data-reactroot|react-dom|__REACT_DEVTOOLS_GLOBAL_HOOK__/i },
+  { id: "vue", kind: "spa", verdict: "Vue", recipe: { runtimeHint: "applyTiming=after_hydration" }, match: /data-v-|__VUE__|vue\.runtime/i },
+  { id: "apex_snippet", kind: "apex", verdict: "Apex snippet", match: /sdk\.drip-apex\.com\/drip\.js|events\.drip-apex\.com|edge\.drip-apex\.com|Drip\.init|data-apex/i }
+];
+function matchDetectionMarkers(source, kind5) {
+  return DETECTION_MARKERS.filter((marker) => (!kind5 || marker.kind === kind5) && marker.match.test(source));
+}
+
+// src/commands/prospect.ts
+var DESKTOP_UA = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36 ApexProspectAudit/1.0";
+var MAX_RESPONSE_BYTES = 2 * 1024 * 1024;
+async function readResponseText(res) {
+  if (!res.body) return "";
+  const reader = res.body.getReader();
+  const chunks = [];
+  let totalBytes = 0;
+  try {
+    while (totalBytes < MAX_RESPONSE_BYTES) {
+      const { done: done2, value } = await reader.read();
+      if (done2) break;
+      const remainingBytes = MAX_RESPONSE_BYTES - totalBytes;
+      if (value.byteLength >= remainingBytes) {
+        chunks.push(value.byteLength === remainingBytes ? value : value.slice(0, remainingBytes));
+        totalBytes += remainingBytes;
+        await reader.cancel().catch(() => void 0);
+        break;
+      }
+      chunks.push(value);
+      totalBytes += value.byteLength;
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  const body5 = new Uint8Array(totalBytes);
+  let offset = 0;
+  for (const chunk of chunks) {
+    body5.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return new TextDecoder().decode(body5);
+}
+async function fetchText(url) {
+  if (process.env.APEX_PROSPECT_AUDIT_FIXTURE) {
+    const fixture = JSON.parse(process.env.APEX_PROSPECT_AUDIT_FIXTURE);
+    const hit = fixture[url] ?? fixture[new URL(url).pathname] ?? fixture["*"];
+    if (hit?.throws) throw new Error(hit.throws);
+    return { status: hit?.status ?? 200, text: hit?.body ?? "", finalUrl: url };
+  }
+  const res = await fetch(url, { headers: { "user-agent": DESKTOP_UA, accept: "text/html,application/xhtml+xml,application/json;q=0.9,*/*;q=0.8" }, redirect: "follow", signal: AbortSignal.timeout(12e3) });
+  return { status: res.status, text: await readResponseText(res), finalUrl: res.url };
+}
+function abs(base, path21) {
+  return new URL(path21, base).toString();
+}
+function looksLikeShopifyCart(text) {
+  try {
+    const payload = JSON.parse(text);
+    return payload !== null && typeof payload === "object" && (typeof payload.token === "string" || payload.token === null) && Array.isArray(payload.items);
+  } catch {
+    return false;
+  }
+}
+async function collectSignals(url) {
+  let primary;
+  try {
+    primary = await fetchText(url);
+  } catch {
+    return { reachable: false, protected: false, source: "" };
+  }
+  const chunks = [`__apex_primary_status_${primary.status}__`, primary.text];
+  const protectedHit = primary.status === 403 || primary.status === 429 || matchDetectionMarkers(primary.text, "protected").length > 0;
+  if (!protectedHit) {
+    for (const path21 of ["/cart.js"]) {
+      try {
+        const secondary = await fetchText(abs(primary.finalUrl || url, path21));
+        if (secondary.status >= 200 && secondary.status < 300 && looksLikeShopifyCart(secondary.text)) {
+          chunks.push("__apex_secondary_shopify_cart_js__", secondary.text.slice(0, 2e3));
+        }
+      } catch {
+      }
+    }
+  }
+  return { reachable: primary.status < 500, protected: protectedHit, source: chunks.join("\n") };
+}
+function unique2(values) {
+  return [...new Set(values)];
+}
+async function runProspectAudit(url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    parsed = new URL(`https://${url}`);
+  }
+  if (!["http:", "https:"].includes(parsed.protocol)) throw new Error("URL must use http or https");
+  const { reachable, protected: isProtected, source } = await collectSignals(parsed.toString());
+  if (isProtected) {
+    return { url: parsed.toString(), reachable, protected: true, platform: { verdict: "unknown", confidence: "low", markers: [] }, cmp: { markers: [] }, analytics: [], spa: { markers: [] }, apexSnippet: false, recipe: { placement: "protected: verify in a real browser", runtimeHints: [] }, openQuestions: ["protected: verify in a real browser", "Who owns checkout and revenue-event access?"] };
+  }
+  const platforms = matchDetectionMarkers(source, "platform");
+  const cmps = matchDetectionMarkers(source, "cmp");
+  const analyticsMarkers = matchDetectionMarkers(source, "analytics");
+  const spaMarkers = matchDetectionMarkers(source, "spa");
+  const apexSnippet = matchDetectionMarkers(source, "apex").length > 0;
+  const platform2 = platforms[0];
+  const cmp = cmps[0];
+  const runtimeHints = unique2(spaMarkers.map((marker) => marker.recipe?.runtimeHint).filter(Boolean));
+  return {
+    url: parsed.toString(),
+    reachable,
+    protected: false,
+    platform: { verdict: platform2?.verdict ?? "unknown", confidence: platform2?.confidence ?? "low", markers: platforms.map((m) => m.id) },
+    cmp: { ...cmp?.recipe?.consentProvider ? { vendor: cmp.verdict } : {}, markers: cmps.map((m) => m.id) },
+    analytics: unique2(analyticsMarkers.map((m) => m.verdict)),
+    spa: { ...spaMarkers[0] ? { framework: spaMarkers[0].verdict } : {}, markers: spaMarkers.map((m) => m.id) },
+    apexSnippet,
+    recipe: {
+      placement: platform2?.recipe?.placement ?? "Install the Apex snippet in the global <head> before other experiment code, or use the edge worker for a headless/custom stack.",
+      ...cmp?.recipe?.consentProvider && cmp.recipe.consentGroup ? { consentPreset: { provider: cmp.recipe.consentProvider, suggestedGroup: cmp.recipe.consentGroup } } : {},
+      runtimeHints
+    },
+    openQuestions: ["Who owns checkout and can add/verify order attribution?", "Which revenue event is authoritative and available to Apex?", ...cmp ? [] : ["Which CMP consent category should gate analytics and storage?"]]
+  };
+}
+var prospectCommand = new Command("prospect").description("Pre-sales storefront diagnostics").addCommand(new Command("audit").argument("<url>", "Prospect storefront URL").description("Audit a public storefront URL and recommend an Apex install recipe.").action(async (url, _options, command) => {
+  try {
+    const data = await runProspectAudit(url);
+    if (data.protected) process.stderr.write("WARN protected: verify in a real browser\n");
+    output(command, data, () => {
+      console.log(source_default.bold(`Apex prospect audit: ${data.url}`));
+      console.log(`Readiness: ${data.protected ? "WARN protected: verify in a real browser" : data.reachable ? "reachable" : "unreachable"}`);
+      console.log(`Platform: ${data.platform.verdict} (${data.platform.confidence})`);
+      console.log(`CMP: ${data.cmp.vendor ?? "unknown"}`);
+      console.log(`Analytics: ${data.analytics.join(", ") || "none detected"}`);
+      console.log(`SPA: ${data.spa.framework ?? "none detected"}`);
+      console.log(`Apex snippet: ${data.apexSnippet ? "present" : "not detected"}`);
+      console.log(`Install recipe: ${data.recipe.placement}`);
+      if (data.recipe.consentPreset) console.log(`Consent preset: ${data.recipe.consentPreset.provider} / ${data.recipe.consentPreset.suggestedGroup}`);
+      for (const hint of data.recipe.runtimeHints) console.log(`Runtime hint: ${hint}`);
+      console.log("Open questions:");
+      for (const question of data.openQuestions) console.log(`- ${question}`);
+    });
+  } catch (error) {
+    fail(command, error instanceof Error ? error.message : String(error), EXIT_CODES.general);
+  }
+}));
+
+// src/commands/webhooks.ts
+init_source();
+var SIGNATURE_DOC = "https://app.drip-apex.com/docs/api/webhooks#signatures";
+function requireShopSecretKey(command) {
+  const creds2 = requireCredentials();
+  if (creds2.apiKey.startsWith("apx_uk_")) {
+    fail(
+      command,
+      "apex webhooks requires a secret shop API key (apx_...). User API keys (apx_uk_...) are not accepted by shop-scoped v1 webhook routes.",
+      EXIT_CODES.auth,
+      { required: "secret_shop_api_key", rejectedPrefix: "apx_uk_" }
+    );
+  }
+}
+function handleResult(command, result, fallback2) {
+  if (!result.ok || !result.data) {
+    fail(command, result.error ?? fallback2, classifyStatus(result.status), result.errorDetails);
+  }
+  return result.data;
+}
+async function loadWebhookIndex(command) {
+  requireShopSecretKey(command);
+  return handleResult(command, await listWebhooks(requireCredentials()), "Failed to load webhooks");
+}
+function printWebhooks(items) {
+  if (items.length === 0) {
+    console.log(source_default.dim("No webhooks configured."));
+    return;
+  }
+  printTable(
+    ["ID", "ACTIVE", "FAILURES", "DISABLED", "SECRET", "URL", "EVENTS"],
+    items.map((item) => [
+      item.id,
+      item.active ? "yes" : "no",
+      String(item.consecutiveFailures ?? 0),
+      item.disabledAt ?? "-",
+      item.hasSecret ? "true" : "false",
+      item.url,
+      item.events.join(", ")
+    ]),
+    [28, 8, 8, 24, 8, 42, 48]
+  );
+}
+function printDeliveries(deliveries2, webhook) {
+  if (webhook) {
+    console.log(`Webhook ${webhook.id}: ${webhook.consecutiveFailures ?? 0} consecutive failure(s)${webhook.disabledAt ? `, disabled at ${webhook.disabledAt}. Re-create the webhook to rotate its secret.` : ""}`);
+  }
+  if (deliveries2.length === 0) {
+    console.log(source_default.dim("No deliveries found."));
+    return;
+  }
+  printTable(
+    ["ID", "EVENT", "STATUS", "ATTEMPTS", "HTTP", "ERROR", "CREATED"],
+    deliveries2.map((delivery) => [
+      delivery.id,
+      delivery.event,
+      delivery.status,
+      String(delivery.attempts),
+      delivery.response_status == null ? "-" : String(delivery.response_status),
+      delivery.last_error ?? "-",
+      delivery.created_at
+    ]),
+    [28, 28, 12, 8, 6, 36, 24]
+  );
+}
+function selectedEvents(opts) {
+  return [...new Set((opts.event ?? []).map((event) => event.trim()).filter(Boolean))];
+}
+var list14 = new Command("list").alias("ls").description("List webhooks. JSON includes availableEvents; secrets are never returned after create.").action(async function action62() {
+  const data = await loadWebhookIndex(this);
+  output(this, data, () => printWebhooks(data.data));
+});
+var create7 = new Command("create").description(`Create a webhook. Prints the signing secret once. Signature docs: ${SIGNATURE_DOC}`).requiredOption("--url <url>", "HTTPS callback URL").option("--event <event>", "Webhook event to subscribe to; repeat for multiple events", (value, previous = []) => [...previous, value], []).action(async function action63(opts) {
+  const events = selectedEvents(opts);
+  if (events.length === 0) fail(this, "At least one --event is required", EXIT_CODES.validation);
+  const index = await loadWebhookIndex(this);
+  const allowed = new Set(index.availableEvents);
+  const unknown = events.filter((event) => !allowed.has(event));
+  if (unknown.length > 0) {
+    fail(this, `Unknown webhook event(s): ${unknown.join(", ")}`, EXIT_CODES.validation, { availableEvents: index.availableEvents });
+  }
+  const result = handleResult(this, await createWebhook(requireCredentials(), { url: opts.url, events }), "Failed to create webhook");
+  output(this, { webhook: result, secret: result.secret, signatureDoc: SIGNATURE_DOC, warning: "Store this signing secret now. Apex will not show it again." }, () => {
+    console.log(source_default.green(`Created webhook ${result.id}`));
+    console.log(source_default.yellow("Store this signing secret now. Apex will not show it again."));
+    console.log(result.secret);
+    console.log(`Signature verification: ${SIGNATURE_DOC}`);
+  });
+});
+var remove4 = new Command("delete").alias("rm").description("Delete a webhook").argument("<id>", "Webhook id").action(async function action64(id) {
+  requireShopSecretKey(this);
+  const result = handleResult(this, await deleteWebhook(requireCredentials(), id), "Failed to delete webhook");
+  output(this, result, () => console.log(source_default.green(`Deleted webhook ${id}`)));
+});
+var deliveries = new Command("deliveries").description("List webhook deliveries including failure and disabled state").argument("<id>", "Webhook id").option("--limit <n>", "Maximum deliveries to show", "20").action(async function action65(id, opts) {
+  const limit = Number.parseInt(opts.limit, 10);
+  if (!Number.isInteger(limit) || limit < 1) fail(this, "--limit must be a positive integer", EXIT_CODES.validation);
+  requireShopSecretKey(this);
+  const result = handleResult(this, await getWebhookDeliveries(requireCredentials(), id, limit), "Failed to load deliveries");
+  output(this, result, () => printDeliveries(result.data, result.webhook));
+});
+var update4 = new Command("update").description("Update a webhook URL, events, or active state").argument("<id>", "Webhook id").option("--url <url>", "HTTPS callback URL").option("--event <event>", "Replacement event; repeat for multiple events", (value, previous = []) => [...previous, value], []).option("--active", "Enable the webhook").option("--inactive", "Disable the webhook").action(async function action66(id, opts) {
+  if (opts.active && opts.inactive) fail(this, "Use only one of --active or --inactive", EXIT_CODES.validation);
+  const events = selectedEvents(opts);
+  const body5 = {};
+  if (opts.url) body5.url = opts.url;
+  if (events.length > 0) {
+    const index = await loadWebhookIndex(this);
+    const allowed = new Set(index.availableEvents);
+    const unknown = events.filter((event) => !allowed.has(event));
+    if (unknown.length > 0) fail(this, `Unknown webhook event(s): ${unknown.join(", ")}`, EXIT_CODES.validation, { availableEvents: index.availableEvents });
+    body5.events = events;
+  } else {
+    requireShopSecretKey(this);
+  }
+  if (opts.active) body5.active = true;
+  if (opts.inactive) body5.active = false;
+  if (Object.keys(body5).length === 0) fail(this, "Pass at least one of --url, --event, --active, or --inactive", EXIT_CODES.validation);
+  const result = handleResult(this, await updateWebhook(requireCredentials(), id, body5), "Failed to update webhook");
+  output(this, { webhook: result }, () => printWebhooks([result]));
+});
+var test3 = new Command("test").description("Send a signed test event to a webhook").argument("<id>", "Webhook id").action(async function action67(id) {
+  requireShopSecretKey(this);
+  const result = handleResult(this, await testWebhook(requireCredentials(), id), "Failed to send test webhook");
+  output(this, result, () => console.log(source_default.green(`Sent test delivery ${result.delivery.id}: ${result.delivery.status}`)));
+});
+var webhooksCommand = new Command("webhooks").description("Manage shop webhooks").addCommand(list14).addCommand(create7).addCommand(update4).addCommand(remove4).addCommand(deliveries).addCommand(test3);
 
 // src/commands/config-resources.ts
-var import_node_fs21 = __toESM(require("node:fs"));
-var import_node_path19 = __toESM(require("node:path"));
+var import_node_fs22 = __toESM(require("node:fs"));
+var import_node_path20 = __toESM(require("node:path"));
 function show(resource) {
-  console.log(JSON.stringify(resource, null, 2));
+  process.stdout.write(`${JSON.stringify(resource, null, 2)}
+`);
 }
 var ASSET_MIME_TYPES = {
   ".png": "image/png",
@@ -12732,7 +14286,7 @@ async function confirmAssetDelete(id) {
   return answer.trim().toLowerCase() === "y";
 }
 function readFamily(family, label) {
-  const list12 = new Command("list").alias("ls").description(`List ${label}`).option("-n, --limit <n>", "Max results", "50").option("--cursor <id>", "Pagination cursor").action(async function(o) {
+  const list15 = new Command("list").alias("ls").description(`List ${label}`).option("-n, --limit <n>", "Max results", "50").option("--cursor <id>", "Pagination cursor").action(async function(o) {
     const limit = Number(o.limit);
     if (!Number.isInteger(limit) || limit <= 0)
       fail(
@@ -12765,7 +14319,7 @@ function readFamily(family, label) {
       )
     );
   });
-  const get7 = new Command("get").description(`Get one ${label.slice(0, -1)}`).argument("<id>").action(async function(id) {
+  const get9 = new Command("get").description(`Get one ${label.slice(0, -1)}`).argument("<id>").action(async function(id) {
     const r = await getConfigResource(requireCredentials(), family, id);
     if (!r.ok || !r.data)
       fail(
@@ -12780,18 +14334,18 @@ function readFamily(family, label) {
       () => show(r.data)
     );
   });
-  return { list: list12, get: get7 };
+  return { list: list15, get: get9 };
 }
 var assetReads = readFamily("assets", "assets");
 var upload = new Command("upload").description("Upload an asset").argument("<file>").action(async function(file) {
-  const absolute = import_node_path19.default.resolve(process.cwd(), file);
-  if (!import_node_fs21.default.existsSync(absolute))
+  const absolute = import_node_path20.default.resolve(process.cwd(), file);
+  if (!import_node_fs22.default.existsSync(absolute))
     fail(this, `File not found: ${file}`, 3);
-  const fileStat = import_node_fs21.default.statSync(absolute);
+  const fileStat = import_node_fs22.default.statSync(absolute);
   if (!fileStat.isFile()) fail(this, `File not found: ${file}`, 3);
   if (fileStat.size > MAX_ASSET_SIZE_BYTES)
     fail(this, `${file} is larger than 10 MB`, 3);
-  const mimeType = ASSET_MIME_TYPES[import_node_path19.default.extname(absolute).toLowerCase()];
+  const mimeType = ASSET_MIME_TYPES[import_node_path20.default.extname(absolute).toLowerCase()];
   if (!mimeType)
     fail(
       this,
@@ -12800,8 +14354,8 @@ var upload = new Command("upload").description("Upload an asset").argument("<fil
     );
   const r = await uploadAssets(requireCredentials(), [
     {
-      name: import_node_path19.default.basename(absolute),
-      bytes: import_node_fs21.default.readFileSync(absolute),
+      name: import_node_path20.default.basename(absolute),
+      bytes: import_node_fs22.default.readFileSync(absolute),
       type: mimeType
     }
   ]);
@@ -12814,7 +14368,7 @@ var upload = new Command("upload").description("Upload an asset").argument("<fil
     );
   output(this, r.data, () => r.data.assets.forEach(show));
 });
-var remove3 = new Command("delete").alias("rm").description("Delete an asset").argument("<id>").option("-f, --force", "Skip confirmation").action(async function(id, opts) {
+var remove5 = new Command("delete").alias("rm").description("Delete an asset").argument("<id>").option("-f, --force", "Skip confirmation").action(async function(id, opts) {
   if (!opts.force) {
     const confirmed = await confirmAssetDelete(id);
     if (!confirmed) {
@@ -12835,7 +14389,7 @@ var remove3 = new Command("delete").alias("rm").description("Delete an asset").a
     );
   output(this, r.data, () => console.log(`Deleted ${id}`));
 });
-var assetsCommand = new Command("assets").description("Manage assets").addCommand(assetReads.list).addCommand(assetReads.get).addCommand(upload).addCommand(remove3);
+var assetsCommand = new Command("assets").description("Manage assets").addCommand(assetReads.list).addCommand(assetReads.get).addCommand(upload).addCommand(remove5);
 var landingReads = readFamily("landing-pages", "landing pages");
 var landingPagesCommand = new Command("landing-pages").description("Read landing pages").addCommand(landingReads.list).addCommand(landingReads.get);
 var snippet = new Command("snippet").description("Generate an external purchase pixel snippet").option("--provider <name>").option("--handover-param <name>").option("--global-name <name>").action(async function(opts) {
@@ -12863,12 +14417,14 @@ function addJsonOption(command) {
 }
 var program2 = new Command().name("apex").description(
   source_default.bold("Apex CLI") + " \u2014 A/B testing experiments from the command line"
-).version(CLI_VERSION).showSuggestionAfterError(false).showHelpAfterError(false);
+).version(CLI_VERSION).showSuggestionAfterError(true).showHelpAfterError(true);
 program2.addCommand(loginCommand);
 program2.addCommand(logoutCommand);
 program2.addCommand(whoamiCommand);
 program2.addCommand(accountCommand);
 program2.addCommand(keysCommand);
+program2.addCommand(prospectCommand);
+program2.addCommand(webhooksCommand);
 program2.addCommand(experimentsCommand);
 program2.addCommand(pushCommand);
 program2.addCommand(previewCommand);
@@ -12877,7 +14433,11 @@ program2.addCommand(harnessCommand);
 program2.addCommand(operatorCommand);
 program2.addCommand(trackingCommand);
 program2.addCommand(goalsCommand);
+program2.addCommand(funnelsCommand);
 program2.addCommand(environmentsCommand);
+program2.addCommand(consentCommand);
+program2.addCommand(domainsCommand);
+program2.addCommand(handoverCommand);
 program2.addCommand(analyticsCommand);
 program2.addCommand(flagsCommand);
 program2.addCommand(backlogCommand);