@drip-apex/apex-cli 0.6.1 → 0.6.2

package/dist/cli.js

@@ -1159,8 +1159,8 @@ var require_command = __commonJS({
   "node_modules/commander/lib/command.js"(exports2) {
     var EventEmitter = require("node:events").EventEmitter;
     var childProcess2 = require("node:child_process");
-    var path23 = require("node:path");
-    var fs27 = require("node:fs");
+    var path24 = require("node:path");
+    var fs28 = require("node:fs");
     var process16 = require("node:process");
     var { Argument: Argument2, humanReadableArgName } = require_argument();
     var { CommanderError: CommanderError2 } = require_error();
@@ -2141,7 +2141,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @param {string} subcommandName
        */
       _checkForMissingExecutable(executableFile, executableDir, subcommandName) {
-        if (fs27.existsSync(executableFile)) return;
+        if (fs28.existsSync(executableFile)) return;
         const executableDirMessage = executableDir ? `searched for local subcommand relative to directory '${executableDir}'` : "no directory for search for local subcommand, use .executableDir() to supply a custom directory";
         const executableMissing = `'${executableFile}' does not exist
  - if '${subcommandName}' is not meant to be an executable command, remove description parameter from '.command()' and use '.description()' instead
@@ -2159,11 +2159,11 @@ Expecting one of '${allowedValues.join("', '")}'`);
         let launchWithNode = false;
         const sourceExt = [".js", ".ts", ".tsx", ".mjs", ".cjs"];
         function findFile(baseDir, baseName) {
-          const localBin = path23.resolve(baseDir, baseName);
-          if (fs27.existsSync(localBin)) return localBin;
-          if (sourceExt.includes(path23.extname(baseName))) return void 0;
+          const localBin = path24.resolve(baseDir, baseName);
+          if (fs28.existsSync(localBin)) return localBin;
+          if (sourceExt.includes(path24.extname(baseName))) return void 0;
           const foundExt = sourceExt.find(
-            (ext) => fs27.existsSync(`${localBin}${ext}`)
+            (ext) => fs28.existsSync(`${localBin}${ext}`)
           );
           if (foundExt) return `${localBin}${foundExt}`;
           return void 0;
@@ -2175,21 +2175,21 @@ Expecting one of '${allowedValues.join("', '")}'`);
         if (this._scriptPath) {
           let resolvedScriptPath;
           try {
-            resolvedScriptPath = fs27.realpathSync(this._scriptPath);
+            resolvedScriptPath = fs28.realpathSync(this._scriptPath);
           } catch {
             resolvedScriptPath = this._scriptPath;
           }
-          executableDir = path23.resolve(
-            path23.dirname(resolvedScriptPath),
+          executableDir = path24.resolve(
+            path24.dirname(resolvedScriptPath),
             executableDir
           );
         }
         if (executableDir) {
           let localFile = findFile(executableDir, executableFile);
           if (!localFile && !subcommand._executableFile && this._scriptPath) {
-            const legacyName = path23.basename(
+            const legacyName = path24.basename(
               this._scriptPath,
-              path23.extname(this._scriptPath)
+              path24.extname(this._scriptPath)
             );
             if (legacyName !== this._name) {
               localFile = findFile(
@@ -2200,7 +2200,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
           }
           executableFile = localFile || executableFile;
         }
-        launchWithNode = sourceExt.includes(path23.extname(executableFile));
+        launchWithNode = sourceExt.includes(path24.extname(executableFile));
         let proc;
         if (process16.platform !== "win32") {
           if (launchWithNode) {
@@ -3047,7 +3047,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @return {Command}
        */
       nameFromFilename(filename) {
-        this._name = path23.basename(filename, path23.extname(filename));
+        this._name = path24.basename(filename, path24.extname(filename));
         return this;
       }
       /**
@@ -3061,9 +3061,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @param {string} [path]
        * @return {(string|null|Command)}
        */
-      executableDir(path24) {
-        if (path24 === void 0) return this._executableDir;
-        this._executableDir = path24;
+      executableDir(path25) {
+        if (path25 === void 0) return this._executableDir;
+        this._executableDir = path25;
         return this;
       }
       /**
@@ -6158,16 +6158,16 @@ __export(ora_exports, {
 function ora(options) {
   return new Ora(options);
 }
-async function oraPromise(action70, options) {
-  const actionIsFunction = typeof action70 === "function";
-  const actionIsPromise = typeof action70.then === "function";
+async function oraPromise(action71, options) {
+  const actionIsFunction = typeof action71 === "function";
+  const actionIsPromise = typeof action71.then === "function";
   if (!actionIsFunction && !actionIsPromise) {
     throw new TypeError("Parameter `action` must be a Function or a Promise");
   }
   const { successText, failText } = typeof options === "object" ? options : { successText: void 0, failText: void 0 };
   const spinner = ora(options).start();
   try {
-    const promise = actionIsFunction ? action70(spinner) : action70;
+    const promise = actionIsFunction ? action71(spinner) : action71;
     const result = await promise;
     spinner.succeed(
       successText === void 0 ? void 0 : typeof successText === "string" ? successText : successText(result)
@@ -7099,7 +7099,7 @@ init_source();
 
 // src/commands/login.ts
 init_source();
-var import_node_crypto = __toESM(require("node:crypto"));
+var import_node_crypto2 = __toESM(require("node:crypto"));
 var import_node_http = __toESM(require("node:http"));
 var import_node_os5 = __toESM(require("node:os"));
 var import_node_readline2 = __toESM(require("node:readline"));
@@ -7112,7 +7112,7 @@ var import_node_os3 = __toESM(require("node:os"));
 // package.json
 var package_default = {
   name: "@drip-apex/apex-cli",
-  version: "0.6.1",
+  version: "0.6.2",
   license: "MIT",
   description: "Apex CLI for managing experiments, approved roadmap ideas, and draft workspaces.",
   private: false,
@@ -7586,6 +7586,9 @@ function findConfigPath() {
   return null;
 }
 
+// src/api.ts
+var import_node_crypto = require("node:crypto");
+
 // ../api-client/src/http.ts
 var APEX_API_VERSION_HEADER = "x-apex-api-version";
 var SUPPORTED_APEX_API_VERSION = "1";
@@ -7619,8 +7622,8 @@ function createHttpClient(creds, options) {
     warnedAboutVersionSkew = true;
     warn3(version > 1 ? "CLI is behind the server \u2014 update.\n" : "Server API is older than this CLI supports.\n");
   }
-  async function request2(method, path23, body5, requestTimeoutMs, form = false) {
-    const mock = options.transport?.(method, path23, body5);
+  async function request2(method, path24, body5, requestTimeoutMs, form = false) {
+    const mock = options.transport?.(method, path24, body5);
     if (mock !== void 0) {
       const version = options.testTransportVersion?.();
       if (version) inspectVersion(new Headers({ [APEX_API_VERSION_HEADER]: version }));
@@ -7638,7 +7641,7 @@ function createHttpClient(creds, options) {
     }
     let response;
     try {
-      response = await fetch(`${creds.baseUrl}${path23}`, { method, headers, body: form ? body5 : body5 ? JSON.stringify(body5) : void 0, signal: AbortSignal.timeout(timeoutMs) });
+      response = await fetch(`${creds.baseUrl}${path24}`, { method, headers, body: form ? body5 : body5 ? JSON.stringify(body5) : void 0, signal: AbortSignal.timeout(timeoutMs) });
     } catch (error) {
       return options.onNetworkError({ baseUrl: creds.baseUrl, timeoutMs, cause: error instanceof Error ? error.message : String(error) });
     }
@@ -7647,7 +7650,7 @@ function createHttpClient(creds, options) {
     if (!response.ok) return { ok: false, status: response.status, data: form ? void 0 : json, error: extractErrorMessage(json, response.status), errorDetails: extractErrorDetails(json), requestId: response.headers.get("x-request-id"), rateLimit: { limit: response.headers.get("x-ratelimit-limit"), remaining: response.headers.get("x-ratelimit-remaining"), reset: response.headers.get("x-ratelimit-reset") } };
     return { ok: true, status: response.status, data: json };
   }
-  return { request: (method, path23, body5, timeoutMs) => request2(method, path23, body5, timeoutMs), requestForm: (method, path23, body5) => request2(method, path23, body5, void 0, true) };
+  return { request: (method, path24, body5, timeoutMs) => request2(method, path24, body5, timeoutMs), requestForm: (method, path24, body5) => request2(method, path24, body5, void 0, true) };
 }
 
 // src/api.ts
@@ -7674,11 +7677,11 @@ function getUserKeyIdentity(creds) {
 function getAccountContext(creds) {
   return userRequest(creds, "GET", "/api/v1/me/context");
 }
-function userRequest(creds, method, path23, body5) {
+function userRequest(creds, method, path24, body5) {
   return request(
     { ...creds, apiKey: creds.userApiKey ?? "", baseUrl: creds.userBaseUrl ?? creds.baseUrl },
     method,
-    path23,
+    path24,
     body5
   );
 }
@@ -7724,11 +7727,11 @@ function sharedClient(creds) {
   }
   return client;
 }
-async function request(creds, method, path23, body5, requestTimeoutMs) {
-  return sharedClient(creds).request(method, path23, body5, requestTimeoutMs);
+async function request(creds, method, path24, body5, requestTimeoutMs) {
+  return sharedClient(creds).request(method, path24, body5, requestTimeoutMs);
 }
-async function requestForm(creds, method, path23, body5) {
-  return sharedClient(creds).requestForm(method, path23, body5);
+async function requestForm(creds, method, path24, body5) {
+  return sharedClient(creds).requestForm(method, path24, body5);
 }
 function listExperiments(creds, opts) {
   const params = new URLSearchParams();
@@ -7802,6 +7805,12 @@ function getExperimentQaRun(creds, id) {
 function updateExperimentQaRun(creds, id, body5) {
   return request(creds, "PATCH", `/api/v1/experiments/${id}/qa/run`, body5);
 }
+function attachExperimentQaEvidence(creds, id, body5) {
+  return request(creds, "POST", `/api/v1/experiments/${id}/qa/evidence`, body5);
+}
+function uploadExperimentQaEvidence(creds, id, form) {
+  return requestForm(creds, "POST", `/api/v1/experiments/${id}/qa/evidence`, form);
+}
 function approveExperimentQa(creds, id) {
   return request(creds, "PATCH", `/api/v1/experiments/${id}/qa`);
 }
@@ -7959,12 +7968,17 @@ function testTargeting(creds, url, opts) {
   return request(creds, "GET", `/api/v1/targeting/test?${params.toString()}`);
 }
 function createSos(creds, body5) {
-  return request(
-    creds,
-    "POST",
-    "/api/v1/sos",
-    body5
-  );
+  const idempotency_key = body5.idempotency_key ?? (0, import_node_crypto.createHash)("sha256").update(
+    [
+      body5.type,
+      body5.experiment_id ?? "",
+      body5.description,
+      body5.sub_class ?? "",
+      body5.loom_url ?? "",
+      String(Math.floor(Date.now() / 36e5))
+    ].join("\0")
+  ).digest("hex");
+  return request(creds, "POST", "/api/v1/sos", { ...body5, idempotency_key });
 }
 function listMySos(creds) {
   return request(creds, "GET", "/api/v1/sos/mine");
@@ -8086,16 +8100,30 @@ function getAdminQuarantine(creds) {
     "/api/v1/admin/tracking/quarantine"
   );
 }
+function archiveAdminShop(creds, shopId) {
+  return request(
+    userCredentials(creds),
+    "POST",
+    `/api/v1/admin/shops/${encodeURIComponent(shopId)}/archive`
+  );
+}
+function restoreAdminShop(creds, shopId) {
+  return request(
+    userCredentials(creds),
+    "POST",
+    `/api/v1/admin/shops/${encodeURIComponent(shopId)}/restore`
+  );
+}
 function requestTargetingResource(creds, method, kind5, id, body5, limit, cursor) {
   const params = new URLSearchParams();
   if (limit) params.set("limit", String(limit));
   if (cursor) params.set("cursor", cursor);
   const query = params.toString();
-  const path23 = `/api/v1/${kind5}${id ? `/${id.split("/").map(encodeURIComponent).join("/")}` : ""}${query ? `?${query}` : ""}`;
-  return request(creds, method, path23, body5);
+  const path24 = `/api/v1/${kind5}${id ? `/${id.split("/").map(encodeURIComponent).join("/")}` : ""}${query ? `?${query}` : ""}`;
+  return request(creds, method, path24, body5);
 }
-function managedPath(kind5, id, action70) {
-  return `/api/v1/${kind5}${id ? `/${encodeURIComponent(id)}` : ""}${action70 ? `/${action70}` : ""}`;
+function managedPath(kind5, id, action71) {
+  return `/api/v1/${kind5}${id ? `/${encodeURIComponent(id)}` : ""}${action71 ? `/${action71}` : ""}`;
 }
 function listManagedDeliveries(creds, kind5, limit) {
   const q = limit ? `?limit=${limit}` : "";
@@ -8113,8 +8141,8 @@ function createManagedDelivery(creds, kind5, body5) {
 function updateManagedDelivery(creds, kind5, id, body5) {
   return request(creds, "PATCH", managedPath(kind5, id), body5);
 }
-function transitionManagedDelivery(creds, kind5, id, action70) {
-  return request(creds, "POST", managedPath(kind5, id, action70));
+function transitionManagedDelivery(creds, kind5, id, action71) {
+  return request(creds, "POST", managedPath(kind5, id, action71));
 }
 function listConfigResources(creds, family, opts) {
   const params = new URLSearchParams();
@@ -8471,7 +8499,7 @@ function parseFormBody(body5) {
   return new URLSearchParams(body5);
 }
 async function waitForBrowserLogin(baseUrl, userMode = false) {
-  const state = import_node_crypto.default.randomBytes(24).toString("base64url");
+  const state = import_node_crypto2.default.randomBytes(24).toString("base64url");
   const clientName = import_node_os5.default.hostname() || "Local machine";
   return new Promise((resolve, reject) => {
     let settled = false;
@@ -8803,21 +8831,23 @@ var useCommand = new Command("use").description("Set the current Apex organizati
 
 // src/commands/experiments.ts
 init_source();
-var import_node_crypto2 = __toESM(require("node:crypto"));
-var import_node_fs6 = __toESM(require("node:fs"));
-var import_node_path4 = __toESM(require("node:path"));
+var import_node_crypto4 = __toESM(require("node:crypto"));
+var import_node_fs7 = __toESM(require("node:fs"));
+var import_node_path5 = __toESM(require("node:path"));
 
 // ../api-client/src/qa-preview-url.ts
+var FORCE_ALIAS_PARAM_NAMES = ["drip_experiment_id", "drip_experiment", "drip_variation_id", "drip_variation"];
 function applyQaPreviewParams(url, params) {
-  url.searchParams.set("drip_force", `${params.experimentId}:${params.variationId}`);
-  url.searchParams.set("drip_experiment_id", params.experimentId);
-  url.searchParams.set("drip_variation_id", params.variationId);
+  url.searchParams.delete("drip_force");
+  for (const name of FORCE_ALIAS_PARAM_NAMES) url.searchParams.delete(name);
   url.searchParams.set("drip_qa", "1");
   if (params.debug !== false) url.searchParams.set("drip_debug", "1");
   if (params.devtools) url.searchParams.set("drip_devtools", "1");
   if (params.screenshot) url.searchParams.set("drip_screenshot", "1");
   if (params.qaSessionId) url.searchParams.set("drip_qa_session", params.qaSessionId);
   if (params.harnessToken) url.searchParams.set("drip_harness", params.harnessToken);
+  const force = `${params.experimentPublicId ?? params.experimentId}:${params.variationPublicId ?? params.variationId}`;
+  url.search += `${url.search ? "&" : "?"}drip_force=${force}`;
   return url;
 }
 function buildQaPreviewUrl(experiment, options = {}) {
@@ -8825,7 +8855,7 @@ function buildQaPreviewUrl(experiment, options = {}) {
   const target = options.storeUrl ?? experiment.store_url;
   if (!target || !variation) return null;
   try {
-    return applyQaPreviewParams(new URL(target), { experimentId: experiment.id, variationId: variation.id, ...options });
+    return applyQaPreviewParams(new URL(target), { experimentId: experiment.id, variationId: variation.id, experimentPublicId: experiment.public_id, variationPublicId: variation.public_id, ...options });
   } catch {
     return null;
   }
@@ -8842,6 +8872,192 @@ function buildQaPreviewUrl2(storeUrl, experimentId, variationId) {
   return url;
 }
 
+// src/lib/asset-upload.ts
+var import_node_crypto3 = __toESM(require("node:crypto"));
+var import_node_fs6 = __toESM(require("node:fs"));
+var import_node_path4 = __toESM(require("node:path"));
+var INLINE_DATA_URI_MAX_CHARS = 4096;
+var DATA_IMAGE_URI_PATTERN = /data:image\/[a-z0-9.+-]+(?:(?:;[^;,\s"'`]*)*;base64,[A-Za-z0-9+/=\s]+|(?:;[^,\s"'`]*)?,[^\s"'`]+)/gi;
+var QUOTED_LOCAL_IMAGE_PATTERN = /(["'])([^"'\n]+?\.(?:png|jpe?g|gif|webp|svg|avif))\1/gi;
+var LOCAL_IMAGE_PATTERN = /(?:\.{1,2}\/)?[a-z0-9@_%+.,~/-]+\.(?:png|jpe?g|gif|webp|svg|avif)/gi;
+var MIME_BY_EXTENSION = {
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".gif": "image/gif",
+  ".webp": "image/webp",
+  ".svg": "image/svg+xml",
+  ".avif": "image/avif"
+};
+var EXTENSION_BY_MIME = {
+  "image/png": ".png",
+  "image/jpeg": ".jpg",
+  "image/gif": ".gif",
+  "image/webp": ".webp",
+  "image/svg+xml": ".svg",
+  "image/avif": ".avif"
+};
+function contentHash(bytes) {
+  return import_node_crypto3.default.createHash("sha256").update(bytes).digest("hex");
+}
+function deliveryUrl(baseUrl, asset) {
+  const returnedUrl = asset.deliveryUrl ?? asset.delivery_url ?? asset.url;
+  if (returnedUrl) return returnedUrl;
+  const origin = new URL(baseUrl).origin;
+  return `${origin}/api/assets/${encodeURIComponent(asset.id)}/file`;
+}
+function extensionForMimeType(mimeType) {
+  const known = EXTENSION_BY_MIME[mimeType];
+  if (known) return known;
+  const subtype = mimeType.split("/", 2)[1]?.toLowerCase();
+  const safeSubtype = subtype?.replace(/[^a-z0-9.+-]/g, "");
+  return safeSubtype ? `.${safeSubtype}` : ".bin";
+}
+function dataUriFromMatch(value, match2) {
+  let uri = match2[0];
+  const start = match2.index ?? 0;
+  if (/url\(\s*$/i.test(value.slice(0, start))) {
+    const closingParenthesis = uri.indexOf(")");
+    if (closingParenthesis >= 0) uri = uri.slice(0, closingParenthesis);
+  }
+  return uri;
+}
+function surroundingNonWhitespaceNonQuoteRun(value, start, end) {
+  const before = value.slice(0, start).match(/[^\s"']*$/)?.[0] ?? "";
+  const after = value.slice(end).match(/^[^\s"']*/)?.[0] ?? "";
+  return `${before}${value.slice(start, end)}${after}`;
+}
+function isInsideRange(start, end, ranges) {
+  return ranges.some((range) => start >= range.start && end <= range.end);
+}
+function applyReplacements(value, replacements) {
+  let rewritten = value;
+  for (const replacement of replacements.sort((a, b) => b.start - a.start)) {
+    rewritten = rewritten.slice(0, replacement.start) + replacement.value + rewritten.slice(replacement.end);
+  }
+  return rewritten;
+}
+function shouldRewriteExperimentFilesystemAssetReferences(filePath) {
+  const normalized = filePath.replace(/\\/g, "/");
+  if (/^variations\/[^/]+\/.+\.(?:js|ts|css|scss|html|json)$/i.test(normalized)) {
+    return true;
+  }
+  return /^(?:experiment\/index\.(?:js|css)|experiment\/reset\.js)$/i.test(normalized);
+}
+function createAssetReferenceRewriter(options) {
+  const uploadsByHash = /* @__PURE__ */ new Map();
+  const uploadOnce = async (file, source) => {
+    const hash = contentHash(file.bytes);
+    let pending = uploadsByHash.get(hash);
+    if (!pending) {
+      pending = options.upload(file).then((asset) => {
+        if (!asset.id) throw new Error(`Asset upload for ${file.name} returned no ID.`);
+        const url = deliveryUrl(options.baseUrl, asset);
+        options.onUpload?.({ name: file.name, url, source });
+        return url;
+      });
+      uploadsByHash.set(hash, pending);
+      pending.catch(() => uploadsByHash.delete(hash));
+    }
+    return pending;
+  };
+  const rewrite = async (value, baseDir = options.baseDir) => {
+    if (options.enabled === false || !value) return value;
+    let rewritten = value;
+    const inlineMatches = [...rewritten.matchAll(DATA_IMAGE_URI_PATTERN)].map((match2) => ({ match: match2, uri: dataUriFromMatch(rewritten, match2) })).filter(({ uri }) => uri.length > INLINE_DATA_URI_MAX_CHARS);
+    for (const { uri } of inlineMatches) {
+      const commaIndex = uri.indexOf(",");
+      const metadata = uri.slice("data:".length, commaIndex);
+      const mimeType = metadata.split(";", 1)[0].toLowerCase();
+      const payload = uri.slice(commaIndex + 1);
+      let bytes;
+      try {
+        bytes = /;base64$/i.test(metadata) ? Buffer.from(payload.replace(/\s/g, ""), "base64") : Buffer.from(decodeURIComponent(payload), "utf8");
+      } catch {
+        continue;
+      }
+      const hash = contentHash(bytes);
+      const name = `inline-${hash.slice(0, 12)}${extensionForMimeType(mimeType)}`;
+      const url = await uploadOnce({ name, bytes, type: mimeType }, "inline");
+      rewritten = rewritten.split(uri).join(url);
+    }
+    const localAssetUrl = async (reference) => {
+      if (reference.startsWith("/") || reference.startsWith("data:") || reference.includes("://")) {
+        return null;
+      }
+      const absolutePath = import_node_path4.default.resolve(baseDir, reference);
+      let realBaseDir;
+      let realPath;
+      try {
+        realBaseDir = import_node_fs6.default.realpathSync(baseDir);
+        realPath = import_node_fs6.default.realpathSync(absolutePath);
+      } catch {
+        return null;
+      }
+      const relativeRealPath = import_node_path4.default.relative(realBaseDir, realPath);
+      if (relativeRealPath.startsWith("..") || import_node_path4.default.isAbsolute(relativeRealPath)) return null;
+      if (!import_node_fs6.default.statSync(realPath).isFile()) return null;
+      const bytes = import_node_fs6.default.readFileSync(realPath);
+      const extension = import_node_path4.default.extname(realPath).toLowerCase();
+      return uploadOnce(
+        {
+          name: import_node_path4.default.basename(absolutePath),
+          bytes,
+          type: MIME_BY_EXTENSION[extension]
+        },
+        "local"
+      );
+    };
+    const quotedReplacements = [];
+    for (const match2 of rewritten.matchAll(QUOTED_LOCAL_IMAGE_PATTERN)) {
+      const reference = match2[2];
+      const matchStart = match2.index ?? 0;
+      const url = await localAssetUrl(reference);
+      if (!url) continue;
+      const start = matchStart + match2[1].length;
+      quotedReplacements.push({ start, end: start + reference.length, value: url });
+    }
+    rewritten = applyReplacements(rewritten, quotedReplacements);
+    const quotedRanges = [...rewritten.matchAll(QUOTED_LOCAL_IMAGE_PATTERN)].map((match2) => ({
+      start: match2.index ?? 0,
+      end: (match2.index ?? 0) + match2[0].length
+    }));
+    const localMatches = [...rewritten.matchAll(LOCAL_IMAGE_PATTERN)];
+    const bareReplacements = [];
+    for (const match2 of localMatches) {
+      const reference = match2[0];
+      const start = match2.index ?? 0;
+      const end = start + reference.length;
+      const surroundingRun = surroundingNonWhitespaceNonQuoteRun(rewritten, start, end);
+      if (reference.startsWith("/") || reference.startsWith("data:") || isInsideRange(start, end, quotedRanges) || surroundingRun.includes("://") || surroundingRun.startsWith("//")) {
+        continue;
+      }
+      const url = await localAssetUrl(reference);
+      if (!url) continue;
+      bareReplacements.push({ start, end, value: url });
+    }
+    return applyReplacements(rewritten, bareReplacements);
+  };
+  const rewriteUnknown = async (value, baseDir = options.baseDir) => {
+    if (typeof value === "string") return rewrite(value, baseDir);
+    if (Array.isArray(value)) {
+      return Promise.all(value.map((entry) => rewriteUnknown(entry, baseDir)));
+    }
+    if (value !== null && typeof value === "object") {
+      return Object.fromEntries(
+        await Promise.all(
+          Object.entries(value).map(async ([key, entry]) => [
+            key,
+            await rewriteUnknown(entry, baseDir)
+          ])
+        )
+      );
+    }
+    return value;
+  };
+  return { rewrite, rewriteUnknown };
+}
+
 // src/commands/experiments.ts
 function formatDate(iso) {
   return new Date(iso).toLocaleDateString("en-US", {
@@ -8878,7 +9094,19 @@ function confidenceBasisLabel(value) {
 function statisticsStateLabel(value) {
   return value === "untrustworthy" ? "verdict withheld" : String(value ?? "unknown");
 }
-function printExperimentResults(results2) {
+function formatRevenue(value, currency) {
+  if (value === null || value === void 0) return "\u2014";
+  if (!currency || typeof value !== "number" || !Number.isFinite(value)) return String(value);
+  try {
+    return new Intl.NumberFormat("en-US", {
+      style: "currency",
+      currency: currency.trim().toUpperCase()
+    }).format(value);
+  } catch {
+    return String(value);
+  }
+}
+function printExperimentResults(results2, currency) {
   const experiment = results2.experiment ?? {};
   const totals = results2.totals ?? {};
   const decision = results2.decision ?? {};
@@ -8892,7 +9120,7 @@ function printExperimentResults(results2) {
   console.log(`  Status:      ${statusBadge(String(experiment.status ?? "unknown"))}`);
   console.log(`  Visitors:    ${String(totals.visitors ?? 0)}`);
   console.log(`  Conversions: ${String(totals.primaryConversions ?? 0)}`);
-  console.log(`  Revenue:     ${String(totals.revenue ?? 0)}`);
+  console.log(`  Revenue:     ${formatRevenue(totals.revenue, currency)}`);
   console.log(`  Outcome:     ${statisticsStateLabel(presentedOutcome)}${outcomeProvenance}`);
   console.log(`  Statistics:  ${statisticsStateLabel(statisticsState)}`);
   if (decision.treatmentName) {
@@ -8915,7 +9143,7 @@ function printExperimentResults(results2) {
         String(arm.visitors ?? 0),
         String(arm.primaryConversions ?? 0),
         typeof arm.primaryRate === "number" ? `${(arm.primaryRate * 100).toFixed(2)}%` : "-",
-        String(arm.revenue ?? 0)
+        formatRevenue(arm.revenue, currency)
       ]),
       [32, 8, 6, 8, 10]
     );
@@ -8941,45 +9169,46 @@ var EXPERIMENT_FILESYSTEM_PATH_SCHEMA = {
     "anti-flicker.json"
   ]
 };
+var SERVER_OWNED_EXPERIMENT_FILES = /* @__PURE__ */ new Set(["qa.json", "launch.json"]);
 var escapeRegex = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 var pathAlternation = (paths) => paths.map(escapeRegex).join("|");
 var FILESYSTEM_FILE_RE = new RegExp(
   `^(?:${pathAlternation(EXPERIMENT_FILESYSTEM_PATH_SCHEMA.topLevel)}|experiment/(?:${pathAlternation(EXPERIMENT_FILESYSTEM_PATH_SCHEMA.experiment)})|variations/[^/]+/(?:${pathAlternation(EXPERIMENT_FILESYSTEM_PATH_SCHEMA.variation)}))$`
 );
 function sha256Text(value) {
-  return import_node_crypto2.default.createHash("sha256").update(value).digest("hex");
+  return import_node_crypto4.default.createHash("sha256").update(value).digest("hex");
 }
 function folderPath(folder) {
-  return import_node_path4.default.resolve(process.cwd(), folder);
+  return import_node_path5.default.resolve(process.cwd(), folder);
 }
 function filesystemApexDir(folder) {
-  return import_node_path4.default.join(folder, ".apex");
+  return import_node_path5.default.join(folder, ".apex");
 }
 function filesystemSessionPath(folder) {
-  return import_node_path4.default.join(filesystemApexDir(folder), "experiment-filesystem.json");
+  return import_node_path5.default.join(filesystemApexDir(folder), "experiment-filesystem.json");
 }
 function writeFilesystemSession(folder, session) {
-  import_node_fs6.default.mkdirSync(filesystemApexDir(folder), { recursive: true });
-  import_node_fs6.default.writeFileSync(
-    import_node_path4.default.join(filesystemApexDir(folder), ".gitignore"),
+  import_node_fs7.default.mkdirSync(filesystemApexDir(folder), { recursive: true });
+  import_node_fs7.default.writeFileSync(
+    import_node_path5.default.join(filesystemApexDir(folder), ".gitignore"),
     "experiment-filesystem.json\n",
     "utf8"
   );
-  import_node_fs6.default.writeFileSync(filesystemSessionPath(folder), `${JSON.stringify(session, null, 2)}
+  import_node_fs7.default.writeFileSync(filesystemSessionPath(folder), `${JSON.stringify(session, null, 2)}
 `, "utf8");
 }
 function readFilesystemSession(folder) {
   const filePath = filesystemSessionPath(folder);
-  if (!import_node_fs6.default.existsSync(filePath)) {
-    const workspaceMarker = import_node_path4.default.join(filesystemApexDir(folder), "session.json");
-    if (import_node_fs6.default.existsSync(workspaceMarker)) {
+  if (!import_node_fs7.default.existsSync(filePath)) {
+    const workspaceMarker = import_node_path5.default.join(filesystemApexDir(folder), "session.json");
+    if (import_node_fs7.default.existsSync(workspaceMarker)) {
       throw new Error(
         "This folder is an operator workspace (apex workspace \u2026), not an experiment filesystem \u2014 run `apex workspace status` here, or `apex experiments pull` into a different folder."
       );
     }
     throw new Error(`Missing ${filePath}. Run apex experiments pull first.`);
   }
-  return JSON.parse(import_node_fs6.default.readFileSync(filePath, "utf8"));
+  return JSON.parse(import_node_fs7.default.readFileSync(filePath, "utf8"));
 }
 function validateFilesystemPath(relativePath) {
   const normalized = relativePath.replace(/\\/g, "/").replace(/^\/+/, "");
@@ -8995,42 +9224,87 @@ function writeExperimentFilesystemFiles(folder, files) {
   }));
   for (const file of validatedFiles) {
     const relativePath = file.relativePath;
-    const absPath = import_node_path4.default.join(folder, relativePath);
-    import_node_fs6.default.mkdirSync(import_node_path4.default.dirname(absPath), { recursive: true });
-    import_node_fs6.default.writeFileSync(absPath, file.content, "utf8");
+    const absPath = import_node_path5.default.join(folder, relativePath);
+    import_node_fs7.default.mkdirSync(import_node_path5.default.dirname(absPath), { recursive: true });
+    import_node_fs7.default.writeFileSync(absPath, file.content, "utf8");
   }
 }
-function listExperimentFilesystemFiles(folder) {
+function listExperimentFilesystemFiles(folder, session) {
   const files = [];
   for (const fileName of EXPERIMENT_FILESYSTEM_PATH_SCHEMA.topLevel) {
-    const absPath = import_node_path4.default.join(folder, fileName);
-    if (!import_node_fs6.default.existsSync(absPath)) continue;
-    const content = import_node_fs6.default.readFileSync(absPath, "utf8");
-    files.push({ path: fileName, content, sha256: sha256Text(content) });
+    const absPath = import_node_path5.default.join(folder, fileName);
+    if (!import_node_fs7.default.existsSync(absPath)) continue;
+    const content = import_node_fs7.default.readFileSync(absPath, "utf8");
+    const sha256 = sha256Text(content);
+    if (SERVER_OWNED_EXPERIMENT_FILES.has(fileName)) {
+      if (session.files[fileName]?.sha256 !== sha256) {
+        console.error(
+          `${fileName} is server-owned; local edits are ignored (dashboard flow owns QA state)`
+        );
+      }
+      continue;
+    }
+    files.push({ path: fileName, content, sha256 });
   }
   for (const fileName of EXPERIMENT_FILESYSTEM_PATH_SCHEMA.experiment) {
     const relativePath = `experiment/${fileName}`;
-    const absPath = import_node_path4.default.join(folder, relativePath);
-    if (!import_node_fs6.default.existsSync(absPath)) continue;
-    const content = import_node_fs6.default.readFileSync(absPath, "utf8");
+    const absPath = import_node_path5.default.join(folder, relativePath);
+    if (!import_node_fs7.default.existsSync(absPath)) continue;
+    const content = import_node_fs7.default.readFileSync(absPath, "utf8");
     files.push({ path: relativePath, content, sha256: sha256Text(content) });
   }
-  const variationsRoot = import_node_path4.default.join(folder, "variations");
-  if (import_node_fs6.default.existsSync(variationsRoot)) {
-    for (const variationDir of import_node_fs6.default.readdirSync(variationsRoot, { withFileTypes: true })) {
+  const variationsRoot = import_node_path5.default.join(folder, "variations");
+  if (import_node_fs7.default.existsSync(variationsRoot)) {
+    for (const variationDir of import_node_fs7.default.readdirSync(variationsRoot, { withFileTypes: true })) {
       if (!variationDir.isDirectory()) continue;
-      const base = import_node_path4.default.join(variationsRoot, variationDir.name);
+      const base = import_node_path5.default.join(variationsRoot, variationDir.name);
       for (const fileName of EXPERIMENT_FILESYSTEM_PATH_SCHEMA.variation) {
-        const absPath = import_node_path4.default.join(base, fileName);
-        if (!import_node_fs6.default.existsSync(absPath)) continue;
-        const relativePath = validateFilesystemPath(import_node_path4.default.relative(folder, absPath));
-        const content = import_node_fs6.default.readFileSync(absPath, "utf8");
+        const absPath = import_node_path5.default.join(base, fileName);
+        if (!import_node_fs7.default.existsSync(absPath)) continue;
+        const relativePath = validateFilesystemPath(import_node_path5.default.relative(folder, absPath));
+        const content = import_node_fs7.default.readFileSync(absPath, "utf8");
         files.push({ path: relativePath, content, sha256: sha256Text(content) });
       }
     }
   }
   return files.sort((left, right) => left.path.localeCompare(right.path));
 }
+async function rewriteExperimentFilesystemAssets(input) {
+  const rewriter = createAssetReferenceRewriter({
+    baseDir: input.folder,
+    baseUrl: input.baseUrl,
+    enabled: input.enabled,
+    upload: async (file) => {
+      const response = await input.upload(input.credentials, [file]);
+      const asset = response.data?.assets?.[0];
+      if (!response.ok || !asset?.id) {
+        throw new Error(response.error ?? `Failed to upload ${file.name}.`);
+      }
+      return {
+        id: asset.id,
+        url: typeof asset.url === "string" ? asset.url : void 0,
+        deliveryUrl: typeof asset.deliveryUrl === "string" ? asset.deliveryUrl : void 0,
+        delivery_url: typeof asset.delivery_url === "string" ? asset.delivery_url : void 0
+      };
+    },
+    onUpload: ({ name, url }) => {
+      process.stderr.write(`Uploaded asset ${name} -> ${url}
+`);
+    }
+  });
+  return Promise.all(
+    input.files.map(async (file) => {
+      if (!shouldRewriteExperimentFilesystemAssetReferences(file.path)) {
+        return file;
+      }
+      const content = await rewriter.rewrite(
+        file.content,
+        import_node_path5.default.dirname(import_node_path5.default.join(input.folder, file.path))
+      );
+      return { ...file, content, sha256: sha256Text(content) };
+    })
+  );
+}
 function printFilesystemPlan(plan) {
   if (plan.errors.length > 0) {
     console.log(source_default.red("\nErrors"));
@@ -9123,6 +9397,15 @@ function printQaRun(run3) {
       console.log(`  - ${url.label}: ${source_default.cyan(url.url)}`);
     });
   }
+  if ((run3.evidenceRecords ?? []).length > 0) {
+    console.log(source_default.bold("\nEvidence records"));
+    for (const record2 of run3.evidenceRecords ?? []) {
+      const device = record2.device ? ` \xB7 ${record2.device}` : "";
+      console.log(
+        `  - ${record2.kind} \xB7 ${record2.label} \xB7 ${record2.status}${device} \xB7 ${record2.capturedAt}`
+      );
+    }
+  }
   console.log();
 }
 async function confirmApply(message) {
@@ -9140,7 +9423,7 @@ async function confirmApply(message) {
 function parseEvidenceInput(value) {
   if (!value) return void 0;
   const source = value.startsWith("@") ? value.slice(1) : value;
-  const text = value.startsWith("@") || import_node_fs6.default.existsSync(source) ? import_node_fs6.default.readFileSync(import_node_path4.default.resolve(process.cwd(), source), "utf8") : value;
+  const text = value.startsWith("@") || import_node_fs7.default.existsSync(source) ? import_node_fs7.default.readFileSync(import_node_path5.default.resolve(process.cwd(), source), "utf8") : value;
   const parsed = JSON.parse(text);
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
     throw new Error("QA evidence must be a JSON object");
@@ -9164,7 +9447,7 @@ async function resolveExperimentForFilesystemOrId(value) {
     return {
       experimentId: session.experimentId,
       folder: candidate,
-      label: import_node_path4.default.basename(candidate)
+      label: import_node_path5.default.basename(candidate)
     };
   }
   const exp = await resolveExperiment(value);
@@ -9190,6 +9473,27 @@ async function refreshExperimentFilesystemFolderIfNeeded(creds, folder, experime
   } catch {
   }
 }
+async function refreshServerOwnedFilesIfNeeded(creds, folder, experimentId) {
+  if (!folder) return;
+  try {
+    const refreshed = await getExperimentFilesystem(creds, experimentId);
+    if (!refreshed.ok || !refreshed.data) return;
+    const serverOwned = refreshed.data.files.filter(
+      (file) => SERVER_OWNED_EXPERIMENT_FILES.has(file.path)
+    );
+    if (serverOwned.length === 0) return;
+    const session = readFilesystemSession(folder);
+    writeExperimentFilesystemFiles(folder, serverOwned);
+    writeFilesystemSession(folder, {
+      ...session,
+      files: {
+        ...session.files,
+        ...Object.fromEntries(serverOwned.map((file) => [file.path, { sha256: file.sha256 }]))
+      }
+    });
+  } catch {
+  }
+}
 async function resolveExperiment(idOrSlug) {
   const creds = requireCredentials();
   if (/^[0-9a-f-]{36}$/i.test(idOrSlug)) {
@@ -9282,7 +9586,7 @@ var results = new Command("results").description("Read experiment results and ti
     output(
       this,
       { experiment: exp, results: res.data },
-      () => printExperimentResults(res.data)
+      () => printExperimentResults(res.data, opts.currency)
     );
   } catch (error) {
     spinner?.fail("Failed to fetch experiment results");
@@ -9329,7 +9633,7 @@ var create = new Command("create").description("Create a new experiment").requir
   "Redirect treatment destination (repeatable; creates one treatment per URL)",
   collectCreateOption,
   []
-).option("--traffic <pct>", "Traffic allocation (0-100)", "100").action(async function action6(opts) {
+).option("--traffic <pct>", "Traffic allocation (0-100)", "100").option("--backlog-item <id>", "Backlog item UUID or Apex backlog key").action(async function action6(opts) {
   if (opts.type !== "mutation" && opts.type !== "redirect") {
     fail(this, "--type must be mutation or redirect", EXIT_CODES.validation);
   }
@@ -9361,6 +9665,53 @@ var create = new Command("create").description("Create a new experiment").requir
   const destinations = opts.destination.map(parseHttpDestination);
   const armWeight = destinations.length > 0 ? 1 / (destinations.length + 1) : null;
   const creds = requireCredentials();
+  let backlogItemId;
+  if (opts.backlogItem !== void 0) {
+    const ref = opts.backlogItem.trim();
+    if (!ref) {
+      fail(this, "--backlog-item must be a UUID or Apex backlog key", EXIT_CODES.validation);
+    }
+    if (/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(ref)) {
+      backlogItemId = ref;
+    } else if (/^[A-Za-z0-9]{2,8}-\d+$/i.test(ref)) {
+      let cursor;
+      let resolvedId;
+      do {
+        const page = await listInsights(creds, "backlog", 100, cursor);
+        if (!page.ok || !page.data) {
+          fail(
+            this,
+            page.error ?? `Unable to resolve backlog item "${ref}"`,
+            classifyStatus(page.status),
+            page.errorDetails
+          );
+        }
+        const match2 = page.data.data.find((item) => {
+          const metadata = item.metadata && typeof item.metadata === "object" && !Array.isArray(item.metadata) ? item.metadata : {};
+          return typeof metadata.backlog_key === "string" && metadata.backlog_key.toUpperCase() === ref.toUpperCase();
+        });
+        resolvedId = match2?.id;
+        cursor = page.data.pagination.has_more ? page.data.pagination.next_cursor ?? void 0 : void 0;
+      } while (!resolvedId && cursor);
+      const backlog = resolvedId ? { ok: true, status: 200, data: { id: resolvedId } } : await getInsight(creds, "backlog", ref);
+      if (!backlog.ok || !backlog.data?.id) {
+        fail(
+          this,
+          backlog.error ?? `Backlog item "${ref}" not found`,
+          classifyStatus(backlog.status),
+          backlog.errorDetails
+        );
+      }
+      if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(
+        backlog.data.id
+      )) {
+        fail(this, `Backlog item "${ref}" not found`, EXIT_CODES.validation);
+      }
+      backlogItemId = backlog.data.id;
+    } else {
+      fail(this, "--backlog-item must be a UUID or Apex backlog key", EXIT_CODES.validation);
+    }
+  }
   const spinner = await createSpinner("Creating experiment...");
   const res = await createExperiment(creds, {
     name: opts.name,
@@ -9368,6 +9719,7 @@ var create = new Command("create").description("Create a new experiment").requir
     description: opts.description ?? null,
     delivery_type: opts.type,
     traffic_allocation: traffic / 100,
+    ...backlogItemId ? { backlog_item_id: backlogItemId } : {},
     ...sourceRules.length > 0 ? {
       store_url: sourceStoreUrl(sourceRules),
       targeting: {
@@ -9403,8 +9755,15 @@ var create = new Command("create").description("Create a new experiment").requir
       res.errorDetails
     );
   }
-  spinner?.succeed("Experiment created");
-  output(this, { experiment: res.data }, () => printExperiment(res.data));
+  const outcome = res.status === 200 ? "already_linked" : "created";
+  spinner?.succeed(
+    outcome === "created" ? "Experiment created" : `Already linked \u2014 returning existing experiment ${res.data.test_key ?? res.data.slug ?? res.data.id}`
+  );
+  output(
+    this,
+    { outcome, backlog_item_id: backlogItemId ?? null, experiment: res.data },
+    () => printExperiment(res.data)
+  );
 });
 var pause = new Command("pause").description("Pause a running experiment").argument("<id-or-slug>", "Experiment ID or slug").action(async function action7(idOrSlug) {
   const creds = requireCredentials();
@@ -9524,7 +9883,7 @@ var pullFilesystem = new Command("pull").description("Pull an experiment as an e
       {
         folder,
         experimentId: exp.id,
-        files: res.data.files.map((file) => import_node_path4.default.join(folder, file.path))
+        files: res.data.files.map((file) => import_node_path5.default.join(folder, file.path))
       },
       () => {
         spinner.succeed(`Pulled ${exp.name}`);
@@ -9541,7 +9900,7 @@ var planFilesystem = new Command("plan").description("Plan experiment filesystem
   try {
     const folder = folderPath(folderArg);
     const session = readFilesystemSession(folder);
-    const files = listExperimentFilesystemFiles(folder);
+    const files = listExperimentFilesystemFiles(folder, session);
     const res = await planExperimentFilesystem(creds, session.experimentId, { files });
     if (!res.ok || !res.data) {
       fail(
@@ -9558,6 +9917,7 @@ var planFilesystem = new Command("plan").description("Plan experiment filesystem
         plan: res.data
       });
     }
+    await refreshServerOwnedFilesIfNeeded(creds, folder, session.experimentId);
     output(
       this,
       { folder, experimentId: session.experimentId, plan: res.data },
@@ -9568,12 +9928,19 @@ var planFilesystem = new Command("plan").description("Plan experiment filesystem
     fail(this, error instanceof Error ? error.message : String(error));
   }
 });
-var applyFilesystem = new Command("apply").description("Apply experiment filesystem changes to Apex").argument("[folder]", "Experiment filesystem folder", ".").option("-f, --force", "Skip confirmation when QA will be invalidated").action(async function action12(folderArg, opts) {
+var applyFilesystem = new Command("apply").description("Apply experiment filesystem changes to Apex").argument("[folder]", "Experiment filesystem folder", ".").option("-f, --force", "Skip confirmation when QA will be invalidated").option("--no-asset-upload", "Keep inline and local image references unchanged").action(async function action12(folderArg, opts) {
   const creds = requireCredentials();
   try {
     const folder = folderPath(folderArg);
     const session = readFilesystemSession(folder);
-    const files = listExperimentFilesystemFiles(folder);
+    const files = await rewriteExperimentFilesystemAssets({
+      files: listExperimentFilesystemFiles(folder, session),
+      folder,
+      baseUrl: creds.baseUrl,
+      enabled: opts.assetUpload !== false,
+      upload: uploadAssets,
+      credentials: creds
+    });
     const planRes = await planExperimentFilesystem(creds, session.experimentId, { files });
     if (!planRes.ok || !planRes.data) {
       fail(
@@ -9585,6 +9952,12 @@ var applyFilesystem = new Command("apply").description("Apply experiment filesys
     }
     if (!planRes.data.ok) {
       if (!shouldUseJson(this)) printFilesystemPlan(planRes.data);
+      if (opts.assetUpload === false && planRes.data.blockingIssues?.some((issue) => /inline|hosted asset/i.test(issue.message))) {
+        process.stderr.write(
+          `Retry with hosted asset upload: apex experiments apply ${folderArg}
+`
+        );
+      }
       fail(this, blockingIssueSummary(planRes.data.blockingIssues), EXIT_CODES.validation, {
         errors: planRes.data.errors,
         plan: planRes.data
@@ -9810,7 +10183,93 @@ var qaReopen = new Command("reopen").description("Reopen QA and clear scheduled
     throw error;
   }
 });
-var qa = new Command("qa").description("Manage experiment QA runs from the CLI").addCommand(qaStatus).addCommand(qaCheck).addCommand(qaNotes).addCommand(qaApprove).addCommand(qaReopen);
+function parseJsonValue(value) {
+  const source = value.startsWith("@") ? value.slice(1) : value;
+  const text = value.startsWith("@") || import_node_fs7.default.existsSync(source) ? import_node_fs7.default.readFileSync(import_node_path5.default.resolve(process.cwd(), source), "utf8") : value;
+  return JSON.parse(text);
+}
+function collectFile(value, previous = []) {
+  return [...previous, value];
+}
+function normalizeEvidenceDevice(value) {
+  if (!value) return void 0;
+  const normalized = value.trim().toLowerCase();
+  if (normalized === "desktop_chrome" || normalized === "desktop_safari") return "desktop";
+  if (normalized === "iphone_15_pro" || normalized === "galaxy_s24") return "mobile";
+  if (normalized === "ipad_pro") return "tablet";
+  return normalized;
+}
+function resolveEvidenceVariation(experiment, ref) {
+  if (!ref) return void 0;
+  const exact = experiment.variations?.find(
+    (variation) => variation.id === ref || variation.slug === ref
+  );
+  if (exact) return exact.id;
+  const matches = (experiment.variations ?? []).filter(
+    (variation) => variation.name.toLowerCase() === ref.toLowerCase()
+  );
+  if (matches.length === 1) return matches[0].id;
+  if (matches.length > 1) {
+    throw new Error(`Ambiguous --variation value "${ref}". Use a variation ID or slug.`);
+  }
+  throw new Error(`Unknown --variation value: ${ref}`);
+}
+var qaEvidence = new Command("evidence").description("Attach screenshot jobs or upload typed QA evidence").argument("[folder-or-id]", "Experiment filesystem folder, ID, or slug", ".").option("--job <jobId>", "Attach a terminal screenshot job").option("--file <path>", "Upload an evidence image; repeat for more files", collectFile, []).option("--label <text>", "Evidence label").option("--device <device>", "desktop, mobile, tablet, or a raw device value").option("--variation <ref>", "Variation ID, slug, or name").option("--status <status>", "Evidence status").option("--kind <kind>", "Evidence kind", "screenshot").option("--records <json-or-@path>", "Typed evidence record array").option("--json", "Print the QA run in the standard JSON envelope").action(async function action18(target, opts) {
+  const modes = Number(Boolean(opts.job)) + Number(opts.file.length > 0) + Number(Boolean(opts.records));
+  if (modes !== 1) {
+    fail(this, "Provide exactly one of --job, --file, or --records.", EXIT_CODES.validation);
+  }
+  const creds = requireCredentials();
+  const spinner = await createSpinner("Writing QA evidence...");
+  try {
+    const resolved = await resolveExperimentForFilesystemOrId(target);
+    let response;
+    if (opts.job) {
+      response = await attachExperimentQaEvidence(creds, resolved.experimentId, {
+        screenshot_job_id: opts.job
+      });
+    } else if (opts.records) {
+      const parsed = parseJsonValue(opts.records);
+      if (!Array.isArray(parsed)) throw new Error("--records must contain a JSON array.");
+      response = await attachExperimentQaEvidence(creds, resolved.experimentId, {
+        records: parsed
+      });
+    } else {
+      const experiment = await resolveExperiment(resolved.experimentId);
+      if (!experiment) throw new Error("Experiment not found.");
+      const variationId = resolveEvidenceVariation(experiment, opts.variation);
+      const form = new FormData();
+      for (const filePath of opts.file) {
+        const absolutePath = import_node_path5.default.resolve(process.cwd(), filePath);
+        if (!import_node_fs7.default.existsSync(absolutePath)) throw new Error(`Evidence file not found: ${filePath}`);
+        const bytes = import_node_fs7.default.readFileSync(absolutePath);
+        const extension = import_node_path5.default.extname(absolutePath).toLowerCase();
+        const mimeType = extension === ".png" ? "image/png" : extension === ".jpg" || extension === ".jpeg" ? "image/jpeg" : extension === ".webp" ? "image/webp" : "application/octet-stream";
+        form.append("files", new File([bytes], import_node_path5.default.basename(absolutePath), { type: mimeType }));
+      }
+      if (opts.label) form.append("label", opts.label);
+      const device = normalizeEvidenceDevice(opts.device);
+      if (device) form.append("device", device);
+      if (variationId) form.append("variation_id", variationId);
+      if (opts.status) form.append("status", opts.status);
+      if (opts.kind) form.append("kind", opts.kind);
+      response = await uploadExperimentQaEvidence(creds, resolved.experimentId, form);
+    }
+    if (!response.ok || !response.data) {
+      throw new CliError(
+        response.error ?? "Failed to write QA evidence",
+        classifyStatus(response.status),
+        response.errorDetails
+      );
+    }
+    spinner.stop();
+    output(this, { run: response.data.run }, () => printQaRun(response.data.run));
+  } catch (error) {
+    spinner.fail("Failed to write QA evidence");
+    throw error;
+  }
+});
+var qa = new Command("qa").description("Manage experiment QA runs from the CLI").addCommand(qaStatus).addCommand(qaCheck).addCommand(qaNotes).addCommand(qaApprove).addCommand(qaReopen).addCommand(qaEvidence);
 var SCREENSHOT_DEVICES = [
   "desktop_chrome",
   "iphone_15_pro",
@@ -9825,11 +10284,11 @@ var screenshots = new Command("screenshots").description(
 ).argument("<experimentRef>", "Experiment ID or slug").option("--url <target>", "Target URL override (not supported by the current v1 API)").option("--devices <list>", `Comma-separated devices (default: ${SCREENSHOT_DEVICES.join(",")})`).option(
   "--variations <list>",
   "Comma-separated treatment IDs, slugs, or names; control is always included and force-assigned"
-).option("--out <dir>", "Download directory", ".").option("--json", "Print the completed raw job payload with signed URLs").option(
+).option("--out <dir>", "Download directory", ".").option("--json", "Print the completed raw job payload with signed URLs").option("--no-attach-qa", "Do not attach the completed job to the QA run").option(
   "--timeout <seconds>",
   "Maximum wait for completion; finished results are always downloaded",
   "300"
-).action(async function action18(experimentRef, opts) {
+).action(async function action19(experimentRef, opts) {
   if (opts.url)
     fail(this, "--url is not supported by the current screenshot v1 API.", EXIT_CODES.validation);
   const timeoutSeconds = Number(opts.timeout);
@@ -9934,10 +10393,31 @@ var screenshots = new Command("screenshots").description(
     job = polled.data;
     delayMs = Math.min(Math.round(delayMs * 1.6), 1e4);
   }
+  if (opts.attachQa !== false) {
+    const attached = await attachExperimentQaEvidence(creds, experiment.id, {
+      screenshot_job_id: job.job_id
+    });
+    if (!attached.ok) {
+      if (attached.status === 403) {
+        console.error(
+          source_default.yellow(
+            "Warning: this API key cannot attach QA evidence; screenshots will still download."
+          )
+        );
+      } else {
+        fail(
+          this,
+          attached.error ?? "Failed to attach screenshot job to QA",
+          classifyStatus(attached.status),
+          attached.errorDetails
+        );
+      }
+    }
+  }
   if (job.status === "failed")
     fail(this, `Screenshot job failed: ${job.error ?? "unknown error"}`);
-  const outputDir = import_node_path4.default.resolve(process.cwd(), opts.out);
-  import_node_fs6.default.mkdirSync(outputDir, { recursive: true });
+  const outputDir = import_node_path5.default.resolve(process.cwd(), opts.out);
+  import_node_fs7.default.mkdirSync(outputDir, { recursive: true });
   const rows = [];
   const errors = [];
   const usedFilenames = /* @__PURE__ */ new Set();
@@ -9979,8 +10459,8 @@ var screenshots = new Command("screenshots").description(
         try {
           const response = await fetch(url);
           if (!response.ok) throw new Error(`HTTP ${response.status}`);
-          await import_node_fs6.default.promises.writeFile(
-            import_node_path4.default.join(outputDir, filename),
+          await import_node_fs7.default.promises.writeFile(
+            import_node_path5.default.join(outputDir, filename),
             Buffer.from(await response.arrayBuffer())
           );
           workerResults.push({ index, row: [variation.name, device, filename] });
@@ -10020,9 +10500,9 @@ Examples:
 
 // src/commands/push.ts
 init_source();
-var import_node_fs7 = __toESM(require("node:fs"));
+var import_node_fs8 = __toESM(require("node:fs"));
 var import_node_os6 = __toESM(require("node:os"));
-var import_node_path5 = __toESM(require("node:path"));
+var import_node_path6 = __toESM(require("node:path"));
 var import_node_url2 = require("node:url");
 function toApiBody(exp) {
   return {
@@ -10045,8 +10525,25 @@ function toApiBody(exp) {
     goal_ids: exp.goals?.map((g) => g.id)
   };
 }
+async function rewriteExperimentAssets(exp, rewrite, baseDir) {
+  return {
+    ...exp,
+    variations: await Promise.all(
+      exp.variations.map(async (variation) => ({
+        ...variation,
+        mutations: await rewrite.rewriteUnknown(variation.mutations ?? [], baseDir),
+        css: variation.css === void 0 ? void 0 : await rewrite.rewrite(variation.css, baseDir),
+        custom_css: variation.custom_css === void 0 ? void 0 : await rewrite.rewrite(variation.custom_css, baseDir),
+        js: variation.js === void 0 ? void 0 : await rewrite.rewrite(variation.js, baseDir),
+        custom_js: variation.custom_js === void 0 ? void 0 : await rewrite.rewrite(variation.custom_js, baseDir),
+        resetJs: variation.resetJs === void 0 ? void 0 : await rewrite.rewrite(variation.resetJs, baseDir),
+        reset_js: variation.reset_js === void 0 ? void 0 : await rewrite.rewrite(variation.reset_js, baseDir)
+      }))
+    )
+  };
+}
 async function importConfigModule(absPath) {
-  const ext = import_node_path5.default.extname(absPath).toLowerCase();
+  const ext = import_node_path6.default.extname(absPath).toLowerCase();
   if (ext === ".js" || ext === ".mjs" || ext === ".cjs") {
     return await import((0, import_node_url2.pathToFileURL)(absPath).href);
   }
@@ -10060,8 +10557,8 @@ async function importConfigModule(absPath) {
 ` + (err instanceof Error ? err.message : String(err))
       );
     }
-    const tmpDir = import_node_fs7.default.mkdtempSync(import_node_path5.default.join(import_node_os6.default.tmpdir(), "drip-config-"));
-    const outFile = import_node_path5.default.join(tmpDir, "config.mjs");
+    const tmpDir = import_node_fs8.default.mkdtempSync(import_node_path6.default.join(import_node_os6.default.tmpdir(), "drip-config-"));
+    const outFile = import_node_path6.default.join(tmpDir, "config.mjs");
     try {
       await esbuild.build({
         entryPoints: [absPath],
@@ -10077,7 +10574,7 @@ async function importConfigModule(absPath) {
       return await import(href);
     } finally {
       try {
-        import_node_fs7.default.rmSync(tmpDir, { recursive: true, force: true });
+        import_node_fs8.default.rmSync(tmpDir, { recursive: true, force: true });
       } catch {
       }
     }
@@ -10087,7 +10584,7 @@ async function importConfigModule(absPath) {
 function isRecord(value) {
   return !!value && typeof value === "object" && !Array.isArray(value);
 }
-var pushCommand = new Command("push").description("Push experiment definitions from config file to the API (idempotent by slug)").option("-c, --config <path>", "Config file path").option("--dry-run", "Show what would be pushed without making changes").action(async function action19(opts) {
+var pushCommand = new Command("push").description("Push experiment definitions from config file to the API (idempotent by slug)").option("-c, --config <path>", "Config file path").option("--dry-run", "Show what would be pushed without making changes").option("--no-asset-upload", "Keep inline and local image references unchanged").action(async function action20(opts) {
   const creds = requireCredentials();
   const configPath = opts.config ?? findConfigPath();
   if (!configPath) {
@@ -10098,10 +10595,10 @@ var pushCommand = new Command("push").description("Push experiment definitions f
     );
   }
   const spinner = process.stderr.isTTY ? await createSpinner(`Loading config from ${source_default.cyan(configPath)}...`) : null;
+  const absoluteConfigPath = import_node_path6.default.resolve(configPath);
   let experiments;
   try {
-    const absPath = import_node_path5.default.resolve(configPath);
-    const mod = await importConfigModule(absPath);
+    const mod = await importConfigModule(absoluteConfigPath);
     const exported = isRecord(mod) && "default" in mod ? mod.default : mod;
     if (Array.isArray(exported)) {
       experiments = exported;
@@ -10164,17 +10661,57 @@ var pushCommand = new Command("push").description("Push experiment definitions f
     );
     return;
   }
+  const assetRewriter = createAssetReferenceRewriter({
+    baseDir: import_node_path6.default.dirname(absoluteConfigPath),
+    baseUrl: creds.baseUrl,
+    enabled: opts.assetUpload !== false,
+    upload: async (file) => {
+      const response = await uploadAssets(creds, [file]);
+      const asset = response.data?.assets?.[0];
+      if (!response.ok || !asset?.id) {
+        throw new Error(response.error ?? `Failed to upload ${file.name}.`);
+      }
+      return {
+        id: asset.id,
+        url: typeof asset.url === "string" ? asset.url : void 0,
+        deliveryUrl: typeof asset.deliveryUrl === "string" ? asset.deliveryUrl : void 0,
+        delivery_url: typeof asset.delivery_url === "string" ? asset.delivery_url : void 0
+      };
+    },
+    onUpload: ({ name, url }) => {
+      process.stderr.write(`Uploaded asset ${name} -> ${url}
+`);
+    }
+  });
   let created = 0;
   let updated = 0;
   let failed = 0;
   const results2 = [];
   for (const exp of experiments) {
     const s = process.stderr.isTTY ? await createSpinner(`Pushing ${source_default.cyan(exp.slug)}...`) : null;
-    const body5 = toApiBody(exp);
+    let body5;
+    try {
+      body5 = toApiBody(
+        await rewriteExperimentAssets(exp, assetRewriter, import_node_path6.default.dirname(absoluteConfigPath))
+      );
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      s?.fail(`Failed: ${exp.slug}`);
+      printError(message);
+      failed++;
+      results2.push({ slug: exp.slug, status: "failed", error: message });
+      continue;
+    }
     const res = await upsertExperimentBySlug(creds, exp.slug, body5);
     if (!res.ok) {
       s?.fail(`Failed: ${exp.slug}`);
       printError(res.error);
+      if (opts.assetUpload === false && /inline|hosted asset/i.test(res.error ?? "")) {
+        process.stderr.write(
+          `Retry with hosted asset upload: apex push --config ${configPath}
+`
+        );
+      }
       failed++;
       results2.push({
         slug: exp.slug,
@@ -10353,25 +10890,25 @@ var previewCommand = new Command("preview").description("Open QA preview URL for
 
 // src/commands/harness.ts
 init_source();
-var import_node_fs8 = __toESM(require("node:fs"));
-var import_node_path6 = __toESM(require("node:path"));
+var import_node_fs9 = __toESM(require("node:fs"));
+var import_node_path7 = __toESM(require("node:path"));
 var import_node_child_process6 = require("node:child_process");
 function slugify(value, fallback2 = "variation") {
   const slug = value.normalize("NFKD").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 80);
   return slug || fallback2;
 }
 function readJson(filePath) {
-  if (!import_node_fs8.default.existsSync(filePath)) return null;
-  return JSON.parse(import_node_fs8.default.readFileSync(filePath, "utf8"));
+  if (!import_node_fs9.default.existsSync(filePath)) return null;
+  return JSON.parse(import_node_fs9.default.readFileSync(filePath, "utf8"));
 }
 function resolveFolder(folder) {
-  return import_node_path6.default.resolve(process.cwd(), folder);
+  return import_node_path7.default.resolve(process.cwd(), folder);
 }
 function experimentConfigPath(folder) {
-  return import_node_path6.default.join(folder, "experiment.config.json");
+  return import_node_path7.default.join(folder, "experiment.config.json");
 }
 function apexConfigPath(folder) {
-  return import_node_path6.default.join(folder, "apex.harness.json");
+  return import_node_path7.default.join(folder, "apex.harness.json");
 }
 function loadHarnessConfig(folder) {
   const experiment = readJson(experimentConfigPath(folder)) ?? {};
@@ -10380,8 +10917,8 @@ function loadHarnessConfig(folder) {
   const targetOrigin = experiment.targetOrigin?.replace(/\/+$/, "") ?? "";
   const defaultPath = experiment.defaultPath ?? "/";
   const targetUrl = targetOrigin ? new URL(defaultPath, targetOrigin).toString() : "";
-  const id = experiment.id ?? import_node_path6.default.basename(import_node_path6.default.dirname(folder));
-  const variation = import_node_path6.default.basename(folder);
+  const id = experiment.id ?? import_node_path7.default.basename(import_node_path7.default.dirname(folder));
+  const variation = import_node_path7.default.basename(folder);
   return {
     experiment,
     apex: {
@@ -10413,37 +10950,37 @@ function runAbHarness(args, cwd) {
 function artifactPaths(folder, experiment) {
   const variant = experiment.variant;
   if (variant?.endsWith(".bundle.js")) {
-    const jsPath = import_node_path6.default.join(folder, variant.replace(/\.bundle\.js$/, ".js"));
-    const cssPath = import_node_path6.default.join(folder, variant.replace(/\.bundle\.js$/, ".css"));
-    return { jsPath, cssPath: import_node_fs8.default.existsSync(cssPath) ? cssPath : null };
+    const jsPath = import_node_path7.default.join(folder, variant.replace(/\.bundle\.js$/, ".js"));
+    const cssPath = import_node_path7.default.join(folder, variant.replace(/\.bundle\.js$/, ".css"));
+    return { jsPath, cssPath: import_node_fs9.default.existsSync(cssPath) ? cssPath : null };
   }
-  const buildDir = import_node_path6.default.join(folder, "build");
-  const files = import_node_fs8.default.existsSync(buildDir) ? import_node_fs8.default.readdirSync(buildDir) : [];
+  const buildDir = import_node_path7.default.join(folder, "build");
+  const files = import_node_fs9.default.existsSync(buildDir) ? import_node_fs9.default.readdirSync(buildDir) : [];
   const js = files.find(
     (file) => file.endsWith(".js") && !file.endsWith(".bundle.js") && !file.endsWith(".min.js")
   );
   const css = files.find((file) => file.endsWith(".css") && !file.endsWith(".min.css"));
   if (!js) throw new Error("Could not find harness JS artifact in build/");
   return {
-    jsPath: import_node_path6.default.join(buildDir, js),
-    cssPath: css ? import_node_path6.default.join(buildDir, css) : null
+    jsPath: import_node_path7.default.join(buildDir, js),
+    cssPath: css ? import_node_path7.default.join(buildDir, css) : null
   };
 }
 async function uploadVersion(params) {
   const creds = requireCredentials();
   const { jsPath, cssPath } = artifactPaths(params.folder, params.experiment);
-  if (!import_node_fs8.default.existsSync(jsPath)) throw new Error(`Missing JS artifact: ${jsPath}`);
+  if (!import_node_fs9.default.existsSync(jsPath)) throw new Error(`Missing JS artifact: ${jsPath}`);
   const form = new FormData();
   form.append(
     "js",
-    new Blob([import_node_fs8.default.readFileSync(jsPath)], { type: "application/javascript" }),
-    import_node_path6.default.basename(jsPath)
+    new Blob([import_node_fs9.default.readFileSync(jsPath)], { type: "application/javascript" }),
+    import_node_path7.default.basename(jsPath)
   );
-  if (cssPath && import_node_fs8.default.existsSync(cssPath) && import_node_fs8.default.statSync(cssPath).size > 0) {
+  if (cssPath && import_node_fs9.default.existsSync(cssPath) && import_node_fs9.default.statSync(cssPath).size > 0) {
     form.append(
       "css",
-      new Blob([import_node_fs8.default.readFileSync(cssPath)], { type: "text/css" }),
-      import_node_path6.default.basename(cssPath)
+      new Blob([import_node_fs9.default.readFileSync(cssPath)], { type: "text/css" }),
+      import_node_path7.default.basename(cssPath)
     );
   }
   form.append(
@@ -10452,8 +10989,8 @@ async function uploadVersion(params) {
       ...params.apex,
       resetJs: cleanupResetJs(params.experiment),
       builtAt: (/* @__PURE__ */ new Date()).toISOString(),
-      jsPath: import_node_path6.default.relative(params.folder, jsPath),
-      cssPath: cssPath ? import_node_path6.default.relative(params.folder, cssPath) : null
+      jsPath: import_node_path7.default.relative(params.folder, jsPath),
+      cssPath: cssPath ? import_node_path7.default.relative(params.folder, cssPath) : null
     })
   );
   const res = await uploadHarnessVersion(creds, params.session.sessionId, form);
@@ -10491,14 +11028,14 @@ async function createSession(folder) {
 var harnessCommand = new Command("harness").description(
   "Develop AB Test Harness projects through Apex live QA sessions"
 );
-harnessCommand.command("init").argument("<folder>", "AB Test Harness experiment folder").option("--force", "Overwrite existing apex.harness.json").action(function action20(folderArg, opts) {
+harnessCommand.command("init").argument("<folder>", "AB Test Harness experiment folder").option("--force", "Overwrite existing apex.harness.json").action(function action21(folderArg, opts) {
   const folder = resolveFolder(folderArg);
   const targetPath = apexConfigPath(folder);
-  if (import_node_fs8.default.existsSync(targetPath) && !opts.force) {
+  if (import_node_fs9.default.existsSync(targetPath) && !opts.force) {
     fail(this, `${targetPath} already exists. Use --force to overwrite.`, EXIT_CODES.conflict);
   }
   const { apex } = loadHarnessConfig(folder);
-  import_node_fs8.default.writeFileSync(targetPath, `${JSON.stringify(apex, null, 2)}
+  import_node_fs9.default.writeFileSync(targetPath, `${JSON.stringify(apex, null, 2)}
 `, "utf8");
   output(
     this,
@@ -10511,7 +11048,7 @@ harnessCommand.command("init").argument("<folder>", "AB Test Harness experiment
     () => printSuccess(`Created ${targetPath}`)
   );
 });
-harnessCommand.command("dev").argument("<folder>", "AB Test Harness experiment folder").option("--no-open", "Print preview URL instead of opening it").action(async function action21(folderArg, opts) {
+harnessCommand.command("dev").argument("<folder>", "AB Test Harness experiment folder").option("--no-open", "Print preview URL instead of opening it").action(async function action22(folderArg, opts) {
   const folder = resolveFolder(folderArg);
   const created = await createSession(folder);
   await runAbHarness(["build", folder], folder);
@@ -10564,7 +11101,7 @@ harnessCommand.command("dev").argument("<folder>", "AB Test Harness experiment f
     }
   };
   let debounce = null;
-  const watcher = import_node_fs8.default.watch(folder, { recursive: true }, (_event, filename) => {
+  const watcher = import_node_fs9.default.watch(folder, { recursive: true }, (_event, filename) => {
     const name = String(filename ?? "");
     if (!name || name.startsWith("build/") || name.includes("/build/")) return;
     if (debounce) clearTimeout(debounce);
@@ -10578,7 +11115,7 @@ harnessCommand.command("dev").argument("<folder>", "AB Test Harness experiment f
     process.exitCode = 0;
   });
 });
-harnessCommand.command("publish").argument("<folder>", "AB Test Harness experiment folder").action(async function action22(folderArg) {
+harnessCommand.command("publish").argument("<folder>", "AB Test Harness experiment folder").action(async function action23(folderArg) {
   const folder = resolveFolder(folderArg);
   const created = await createSession(folder);
   await runAbHarness(["verify", folder], folder);
@@ -10606,9 +11143,9 @@ harnessCommand.command("publish").argument("<folder>", "AB Test Harness experime
 
 // src/commands/operator.ts
 init_source();
-var import_node_crypto3 = __toESM(require("node:crypto"));
-var import_node_fs9 = __toESM(require("node:fs"));
-var import_node_path7 = __toESM(require("node:path"));
+var import_node_crypto5 = __toESM(require("node:crypto"));
+var import_node_fs10 = __toESM(require("node:fs"));
+var import_node_path8 = __toESM(require("node:path"));
 var CANONICAL_FILE_RE = /^(src\/(?:index\.js|index\.scss|info\.js|mutations\.json)|experiment\.config\.json|metrics\.json|targeting\.json|dev-doc\.md|brand\.md|goals\/[a-zA-Z0-9_.-]+\.json|segments\/[a-zA-Z0-9_.-]+\.json|network\/[a-zA-Z0-9_.-]+\.recipe\.json)$/;
 function workspaceIssueFile(field, evidence) {
   if (field === "custom_js" || field === "reset_js") return "src/index.js";
@@ -10652,7 +11189,7 @@ function formatWorkspaceBlockingIssues(value) {
   }).join("\n");
 }
 function sha256Text2(value) {
-  return import_node_crypto3.default.createHash("sha256").update(value).digest("hex");
+  return import_node_crypto5.default.createHash("sha256").update(value).digest("hex");
 }
 function byteLength(value) {
   return Buffer.byteLength(value, "utf8");
@@ -10662,28 +11199,28 @@ function slugify2(value, fallback2 = "operator") {
   return slug || fallback2;
 }
 function folderPath2(folder) {
-  return import_node_path7.default.resolve(process.cwd(), folder);
+  return import_node_path8.default.resolve(process.cwd(), folder);
 }
 function apexDir(folder) {
-  return import_node_path7.default.join(folder, ".apex");
+  return import_node_path8.default.join(folder, ".apex");
 }
 function sessionPath(folder) {
-  return import_node_path7.default.join(apexDir(folder), "session.json");
+  return import_node_path8.default.join(apexDir(folder), "session.json");
 }
 function readJsonFile(filePath) {
-  if (!import_node_fs9.default.existsSync(filePath)) return null;
-  return JSON.parse(import_node_fs9.default.readFileSync(filePath, "utf8"));
+  if (!import_node_fs10.default.existsSync(filePath)) return null;
+  return JSON.parse(import_node_fs10.default.readFileSync(filePath, "utf8"));
 }
 function writeJsonFile(filePath, value) {
-  import_node_fs9.default.mkdirSync(import_node_path7.default.dirname(filePath), { recursive: true });
-  import_node_fs9.default.writeFileSync(filePath, `${JSON.stringify(value, null, 2)}
+  import_node_fs10.default.mkdirSync(import_node_path8.default.dirname(filePath), { recursive: true });
+  import_node_fs10.default.writeFileSync(filePath, `${JSON.stringify(value, null, 2)}
 `, "utf8");
 }
 function readSession(folder) {
   const session = readJsonFile(sessionPath(folder));
   if (!session) {
-    const filesystemMarker = import_node_path7.default.join(apexDir(folder), "experiment-filesystem.json");
-    if (import_node_fs9.default.existsSync(filesystemMarker)) {
+    const filesystemMarker = import_node_path8.default.join(apexDir(folder), "experiment-filesystem.json");
+    if (import_node_fs10.default.existsSync(filesystemMarker)) {
       throw new Error(
         "This folder is an experiment filesystem (apex experiments \u2026), not an operator workspace \u2014 run `apex experiments plan` here, or `apex workspace checkout` into a different folder."
       );
@@ -10693,9 +11230,9 @@ function readSession(folder) {
   return session;
 }
 function writeSession(folder, session) {
-  import_node_fs9.default.mkdirSync(apexDir(folder), { recursive: true });
-  import_node_fs9.default.writeFileSync(
-    import_node_path7.default.join(apexDir(folder), ".gitignore"),
+  import_node_fs10.default.mkdirSync(apexDir(folder), { recursive: true });
+  import_node_fs10.default.writeFileSync(
+    import_node_path8.default.join(apexDir(folder), ".gitignore"),
     "session.json\nharness-session.json\n",
     "utf8"
   );
@@ -10719,15 +11256,15 @@ function listLocalWorkspaceFiles(folder) {
     "brand.md"
   ];
   function visit2(dir) {
-    if (!import_node_fs9.default.existsSync(dir)) return;
-    for (const entry of import_node_fs9.default.readdirSync(dir, { withFileTypes: true })) {
-      const absPath = import_node_path7.default.join(dir, entry.name);
+    if (!import_node_fs10.default.existsSync(dir)) return;
+    for (const entry of import_node_fs10.default.readdirSync(dir, { withFileTypes: true })) {
+      const absPath = import_node_path8.default.join(dir, entry.name);
       if (entry.isDirectory()) {
         visit2(absPath);
         continue;
       }
-      const relativePath = validateCanonicalPath(import_node_path7.default.relative(folder, absPath));
-      const content = import_node_fs9.default.readFileSync(absPath, "utf8");
+      const relativePath = validateCanonicalPath(import_node_path8.default.relative(folder, absPath));
+      const content = import_node_fs10.default.readFileSync(absPath, "utf8");
       files.push({
         path: relativePath,
         absPath,
@@ -10737,11 +11274,11 @@ function listLocalWorkspaceFiles(folder) {
       });
     }
   }
-  for (const root of roots) visit2(import_node_path7.default.join(folder, root));
+  for (const root of roots) visit2(import_node_path8.default.join(folder, root));
   for (const file of topLevel) {
-    const absPath = import_node_path7.default.join(folder, file);
-    if (!import_node_fs9.default.existsSync(absPath)) continue;
-    const content = import_node_fs9.default.readFileSync(absPath, "utf8");
+    const absPath = import_node_path8.default.join(folder, file);
+    if (!import_node_fs10.default.existsSync(absPath)) continue;
+    const content = import_node_fs10.default.readFileSync(absPath, "utf8");
     files.push({
       path: file,
       absPath,
@@ -10765,7 +11302,7 @@ function validateJsonFiles(files) {
   }
 }
 function readExperimentConfig(folder) {
-  return readJsonFile(import_node_path7.default.join(folder, "experiment.config.json")) ?? {};
+  return readJsonFile(import_node_path8.default.join(folder, "experiment.config.json")) ?? {};
 }
 function resolveVariation(exp, variationArg) {
   const variations = exp.variations ?? [];
@@ -10782,9 +11319,9 @@ function resolveVariation(exp, variationArg) {
 function writeWorkspaceFiles(folder, workspace) {
   for (const file of workspace.files) {
     const relativePath = validateCanonicalPath(file.path);
-    const absPath = import_node_path7.default.join(folder, relativePath);
-    import_node_fs9.default.mkdirSync(import_node_path7.default.dirname(absPath), { recursive: true });
-    import_node_fs9.default.writeFileSync(absPath, file.content, "utf8");
+    const absPath = import_node_path8.default.join(folder, relativePath);
+    import_node_fs10.default.mkdirSync(import_node_path8.default.dirname(absPath), { recursive: true });
+    import_node_fs10.default.writeFileSync(absPath, file.content, "utf8");
   }
 }
 function sessionFromWorkspace(input) {
@@ -10853,10 +11390,10 @@ async function uploadCurrentArtifactVersion(folder, sessionId) {
   form.append(
     "js",
     new Blob([js.content], { type: "application/javascript" }),
-    import_node_path7.default.basename(js.path)
+    import_node_path8.default.basename(js.path)
   );
   if (css && css.content.trim()) {
-    form.append("css", new Blob([css.content], { type: "text/css" }), import_node_path7.default.basename(css.path));
+    form.append("css", new Blob([css.content], { type: "text/css" }), import_node_path8.default.basename(css.path));
   }
   form.append("manifest", JSON.stringify(manifest));
   const res = await uploadHarnessVersion(creds, sessionId, form);
@@ -10953,7 +11490,7 @@ Examples:
   apex workspace publish ./workspace
 `
 );
-operatorCommand.command("checkout").argument("<experiment-id>", "Apex experiment ID").requiredOption("--variation <id-or-slug>", "Variation ID, slug, or name").option("--out <path>", "Target folder").action(async function action23(experimentId, opts) {
+operatorCommand.command("checkout").argument("<experiment-id>", "Apex experiment ID").requiredOption("--variation <id-or-slug>", "Variation ID, slug, or name").option("--out <path>", "Target folder").action(async function action24(experimentId, opts) {
   try {
     const creds = requireCredentials();
     const expRes = await getExperiment(creds, experimentId);
@@ -10975,7 +11512,7 @@ operatorCommand.command("checkout").argument("<experiment-id>", "Apex experiment
         classifyStatus(workspace.status),
         workspace.errorDetails
       );
-    import_node_fs9.default.mkdirSync(folder, { recursive: true });
+    import_node_fs10.default.mkdirSync(folder, { recursive: true });
     writeWorkspaceFiles(folder, workspace.data);
     writeSession(
       folder,
@@ -11003,7 +11540,7 @@ operatorCommand.command("checkout").argument("<experiment-id>", "Apex experiment
     throw error;
   }
 });
-operatorCommand.command("status").argument("[folder]", "Operator workspace folder", ".").action(function action24(folderArg) {
+operatorCommand.command("status").argument("[folder]", "Operator workspace folder", ".").action(function action25(folderArg) {
   try {
     const folder = folderPath2(folderArg);
     const session = readSession(folder);
@@ -11035,14 +11572,14 @@ operatorCommand.command("status").argument("[folder]", "Operator workspace folde
     fail(this, error instanceof Error ? error.message : String(error));
   }
 });
-operatorCommand.command("dev").argument("[folder]", "Operator workspace folder", ".").option("--no-open", "Print preview URL instead of opening it").option("--once", "Upload one preview version and exit").action(async function action25(folderArg, opts) {
+operatorCommand.command("dev").argument("[folder]", "Operator workspace folder", ".").option("--no-open", "Print preview URL instead of opening it").option("--once", "Upload one preview version and exit").action(async function action26(folderArg, opts) {
   try {
     const folder = folderPath2(folderArg);
     const session = readSession(folder);
     const harnessSession = await createExactHarnessSession(folder, session);
     const version = await uploadCurrentArtifactVersion(folder, harnessSession.sessionId);
-    import_node_fs9.default.mkdirSync(apexDir(folder), { recursive: true });
-    writeJsonFile(import_node_path7.default.join(apexDir(folder), "harness-session.json"), {
+    import_node_fs10.default.mkdirSync(apexDir(folder), { recursive: true });
+    writeJsonFile(import_node_path8.default.join(apexDir(folder), "harness-session.json"), {
       sessionId: harnessSession.sessionId,
       experimentId: harnessSession.experimentId,
       variationId: harnessSession.variationId,
@@ -11097,7 +11634,7 @@ operatorCommand.command("dev").argument("[folder]", "Operator workspace folder",
       }
     };
     let timer = null;
-    const watcher = import_node_fs9.default.watch(folder, { recursive: true }, (_event, filename) => {
+    const watcher = import_node_fs10.default.watch(folder, { recursive: true }, (_event, filename) => {
       const name = String(filename ?? "");
       if (!name || name.startsWith(".apex/") || name.includes("/.apex/")) return;
       if (timer) clearTimeout(timer);
@@ -11114,7 +11651,7 @@ operatorCommand.command("dev").argument("[folder]", "Operator workspace folder",
     throw error;
   }
 });
-operatorCommand.command("publish").argument("[folder]", "Operator workspace folder", ".").option("--allow-goal-writes", "Allow metrics.json to create or update shared shop-level goals").action(async function action26(folderArg, opts) {
+operatorCommand.command("publish").argument("[folder]", "Operator workspace folder", ".").option("--allow-goal-writes", "Allow metrics.json to create or update shared shop-level goals").action(async function action27(folderArg, opts) {
   try {
     const result = await runPublish(folderArg, opts);
     const build = result.build;
@@ -11132,8 +11669,8 @@ operatorCommand.command("publish").argument("[folder]", "Operator workspace fold
 
 // src/commands/roadmap.ts
 init_source();
-var import_node_fs10 = __toESM(require("node:fs"));
-var import_node_path8 = __toESM(require("node:path"));
+var import_node_fs11 = __toESM(require("node:fs"));
+var import_node_path9 = __toESM(require("node:path"));
 var LEGACY_OUTPUT_REMOVAL_VERSION = "0.7.0";
 function truncate(value, max) {
   const text = typeof value === "string" ? value : value == null ? "" : String(value);
@@ -11158,7 +11695,7 @@ function briefLine(item) {
   ].filter(Boolean);
   return parts.join("\n");
 }
-var approved = new Command("approved").description("List approved roadmap ideas ready to build in Apex").option("-n, --limit <n>", "Max results", "20").option("--cursor <id>", "Pagination cursor").option("-q, --query <text>", "Search title, hypothesis, brief, and notes").option("--unbuilt", "Only show approved ideas without a linked experiment").option("--built", "Only show approved ideas with a linked experiment").option("--json", "Print raw JSON").option("--brief", "Print each item with hypothesis and target URL").action(async function action27(opts) {
+var approved = new Command("approved").description("List approved roadmap ideas ready to build in Apex").option("-n, --limit <n>", "Max results", "20").option("--cursor <id>", "Pagination cursor").option("-q, --query <text>", "Search title, hypothesis, brief, and notes").option("--unbuilt", "Only show approved ideas without a linked experiment").option("--built", "Only show approved ideas with a linked experiment").option("--json", "Print raw JSON").option("--brief", "Print each item with hypothesis and target URL").action(async function action28(opts) {
   const creds = requireCredentials();
   const limit = parseInt(opts.limit, 10);
   const hasExperiment = opts.unbuilt ? false : opts.built ? true : void 0;
@@ -11212,7 +11749,7 @@ More results: --cursor ${res.data.pagination.next_cursor}`));
     }
   );
 });
-var handoff = new Command("handoff").description("Get the full build brief for an approved roadmap item").argument("<id>", "Roadmap/backlog item ID").option("--out <path>", "Write handoff JSON to a file").addOption(new Option("-o, --output <path>", "Legacy alias for --out").hideHelp()).option("--instructions", "Print only the build instructions").action(async function action28(id, opts) {
+var handoff = new Command("handoff").description("Get the full build brief for an approved roadmap item").argument("<id>", "Roadmap/backlog item ID").option("--out <path>", "Write handoff JSON to a file").addOption(new Option("-o, --output <path>", "Legacy alias for --out").hideHelp()).option("--instructions", "Print only the build instructions").action(async function action29(id, opts) {
   if (opts.output !== void 0) {
     process.stderr.write(
       `Warning: --output is deprecated for apex roadmap handoff; use --out instead. --output will be removed in v${LEGACY_OUTPUT_REMOVAL_VERSION}.
@@ -11238,9 +11775,9 @@ var handoff = new Command("handoff").description("Get the full build brief for a
 `;
   const outputData = opts.instructions ? { roadmapItemId: id, instructions: String(payload.instructions ?? "") } : payload;
   if (opts.out || opts.output) {
-    const target = import_node_path8.default.resolve(process.cwd(), opts.out ?? opts.output);
-    import_node_fs10.default.mkdirSync(import_node_path8.default.dirname(target), { recursive: true });
-    import_node_fs10.default.writeFileSync(target, rendered, "utf8");
+    const target = import_node_path9.default.resolve(process.cwd(), opts.out ?? opts.output);
+    import_node_fs11.default.mkdirSync(import_node_path9.default.dirname(target), { recursive: true });
+    import_node_fs11.default.writeFileSync(target, rendered, "utf8");
     output(this, { path: target, roadmapItemId: id }, () => printSuccess(`Wrote ${target}`));
     return;
   }
@@ -11254,8 +11791,8 @@ roadmapCommand.addCommand(handoff);
 
 // src/commands/tracking.ts
 init_source();
-var import_node_fs11 = __toESM(require("node:fs"));
-var import_node_path9 = __toESM(require("node:path"));
+var import_node_fs12 = __toESM(require("node:fs"));
+var import_node_path10 = __toESM(require("node:path"));
 function normalizeUrl(input) {
   const value = input.trim();
   if (!value) throw new Error("URL cannot be empty");
@@ -11301,17 +11838,17 @@ function commonCookieDomain(hostnames) {
   return suffix && suffixes.every((candidate) => candidate === suffix) ? `.${suffix}` : null;
 }
 function defaultManifestPath() {
-  return import_node_path9.default.resolve(process.cwd(), ".apex", "tracking-manifest.json");
+  return import_node_path10.default.resolve(process.cwd(), ".apex", "tracking-manifest.json");
 }
 function readManifest(filePath) {
-  if (!import_node_fs11.default.existsSync(filePath)) throw new Error(`Manifest not found: ${filePath}`);
-  const parsed = JSON.parse(import_node_fs11.default.readFileSync(filePath, "utf8"));
+  if (!import_node_fs12.default.existsSync(filePath)) throw new Error(`Manifest not found: ${filePath}`);
+  const parsed = JSON.parse(import_node_fs12.default.readFileSync(filePath, "utf8"));
   if (parsed.schemaVersion !== 1) throw new Error("Unsupported tracking manifest schema");
   return parsed;
 }
 function writeManifest(filePath, manifest) {
-  import_node_fs11.default.mkdirSync(import_node_path9.default.dirname(filePath), { recursive: true });
-  import_node_fs11.default.writeFileSync(filePath, `${JSON.stringify(manifest, null, 2)}
+  import_node_fs12.default.mkdirSync(import_node_path10.default.dirname(filePath), { recursive: true });
+  import_node_fs12.default.writeFileSync(filePath, `${JSON.stringify(manifest, null, 2)}
 `, "utf8");
 }
 function buildSnippet(shopId, endpoint) {
@@ -11378,7 +11915,7 @@ function buildManifest(urlArgs, opts) {
   };
 }
 function manifestPath(input) {
-  return import_node_path9.default.resolve(process.cwd(), input ?? defaultManifestPath());
+  return import_node_path10.default.resolve(process.cwd(), input ?? defaultManifestPath());
 }
 function printManifestPlan(manifest) {
   console.log(source_default.bold("Apex tracking ingestion plan"));
@@ -11431,7 +11968,7 @@ trackingCommand.command("qa").description("Print the QA checklist for a tracking
     console.log(`${index + 1}. ${check}`);
   });
 });
-trackingCommand.command("verify").description("Verify live tracking events for the current shop").option("--minutes <n>", "Lookback window in minutes", "120").option("--limit <n>", "Recent events to include", "20").option("--experiment <id>", "Filter to one experiment ID").option("--event-type <type>", "Filter to one event type; repeat with comma-separated values").action(async function action29(opts) {
+trackingCommand.command("verify").description("Verify live tracking events for the current shop").option("--minutes <n>", "Lookback window in minutes", "120").option("--limit <n>", "Recent events to include", "20").option("--experiment <id>", "Filter to one experiment ID").option("--event-type <type>", "Filter to one event type; repeat with comma-separated values").action(async function action30(opts) {
   const creds = requireCredentials();
   const res = await verifyTracking(creds, {
     minutes: Number.parseInt(opts.minutes, 10),
@@ -11485,8 +12022,8 @@ trackingCommand.command("verify").description("Verify live tracking events for t
 
 // src/commands/goals.ts
 init_source();
-var import_node_fs12 = __toESM(require("node:fs"));
-var import_node_path10 = __toESM(require("node:path"));
+var import_node_fs13 = __toESM(require("node:fs"));
+var import_node_path11 = __toESM(require("node:path"));
 
 // ../sdk/src/safe-regex.ts
 var MAX_PATTERN_LENGTH = 1024;
@@ -11662,7 +12199,7 @@ function printSuggestions(data) {
 function parseCapture(command, value) {
   if (!value) return void 0;
   const source = value.startsWith("@") ? value.slice(1) : value;
-  const text = value.startsWith("@") || import_node_fs12.default.existsSync(source) ? import_node_fs12.default.readFileSync(import_node_path10.default.resolve(process.cwd(), source), "utf8") : value;
+  const text = value.startsWith("@") || import_node_fs13.default.existsSync(source) ? import_node_fs13.default.readFileSync(import_node_path11.default.resolve(process.cwd(), source), "utf8") : value;
   try {
     return JSON.parse(text);
   } catch (error) {
@@ -11688,7 +12225,7 @@ function printGoal(goal) {
   console.log(`  Count once: ${goal.count_once ? "yes" : "no"}`);
   console.log();
 }
-var list2 = new Command("list").alias("ls").description("List goals").option("-n, --limit <n>", "Max results", "50").action(async function action30(opts) {
+var list2 = new Command("list").alias("ls").description("List goals").option("-n, --limit <n>", "Max results", "50").action(async function action31(opts) {
   const creds = requireCredentials();
   const res = await listGoals(creds, { limit: Number.parseInt(opts.limit, 10) });
   if (!res.ok || !res.data) {
@@ -11712,7 +12249,7 @@ var list2 = new Command("list").alias("ls").description("List goals").option("-n
     );
   });
 });
-var create2 = new Command("create").description("Create a goal").requiredOption("--name <name>", "Goal name").requiredOption("--type <type>", "click|pageview|custom|revenue").option("--measurement <measurement>", "conversion|value", "conversion").option("--value-property <property>", "Numeric event property for value goals").option("--value-unit <unit>", "currency|number|duration_seconds|percent").option("--selector <selector>", "CSS selector for click goals").option("--text-match <text>", "Text match for click goals").option("--url-pattern <pattern>", "URL pattern for pageview goals").option("--event-name <name>", "Event name for custom goals").option("--count-once", "Count only once per visitor").option("--capture <json-or-path>", "Capture JSON array or @path").action(async function action31(opts) {
+var create2 = new Command("create").description("Create a goal").requiredOption("--name <name>", "Goal name").requiredOption("--type <type>", "click|pageview|custom|revenue").option("--measurement <measurement>", "conversion|value", "conversion").option("--value-property <property>", "Numeric event property for value goals").option("--value-unit <unit>", "currency|number|duration_seconds|percent").option("--selector <selector>", "CSS selector for click goals").option("--text-match <text>", "Text match for click goals").option("--url-pattern <pattern>", "URL pattern for pageview goals").option("--event-name <name>", "Event name for custom goals").option("--count-once", "Count only once per visitor").option("--capture <json-or-path>", "Capture JSON array or @path").action(async function action32(opts) {
   const creds = requireCredentials();
   const body5 = cleanBody({
     name: opts.name,
@@ -11741,7 +12278,7 @@ var create2 = new Command("create").description("Create a goal").requiredOption(
 var update = new Command("update").description("Update a goal").argument("<id>", "Goal ID").option("--name <name>", "Goal name").option("--type <type>", "click|pageview|custom|revenue").option("--measurement <measurement>", "conversion|value").option(
   "--value-property <property>",
   "Numeric event property for value goals; pass null to clear"
-).option("--value-unit <unit>", "currency|number|duration_seconds|percent; pass null to clear").option("--selector <selector>", "CSS selector for click goals").option("--text-match <text>", "Text match for click goals").option("--url-pattern <pattern>", "URL pattern for pageview goals").option("--event-name <name>", "Event name for custom goals").option("--count-once", "Count only once per visitor").option("--no-count-once", "Do not count only once per visitor").option("--capture <json-or-path>", "Capture JSON array or @path").action(async function action32(id, opts) {
+).option("--value-unit <unit>", "currency|number|duration_seconds|percent; pass null to clear").option("--selector <selector>", "CSS selector for click goals").option("--text-match <text>", "Text match for click goals").option("--url-pattern <pattern>", "URL pattern for pageview goals").option("--event-name <name>", "Event name for custom goals").option("--count-once", "Count only once per visitor").option("--no-count-once", "Do not count only once per visitor").option("--capture <json-or-path>", "Capture JSON array or @path").action(async function action33(id, opts) {
   const creds = requireCredentials();
   const body5 = cleanBody({
     name: opts.name,
@@ -11773,7 +12310,7 @@ var update = new Command("update").description("Update a goal").argument("<id>",
 var test = new Command("test").description("Dry run a goal URL pattern against traffic").option(
   "--pattern <regex>",
   "URL regex pattern to test (matched against the full URL, as the SDK matches pageview goals)"
-).option("--goal <id>", "Existing goal ID whose URL pattern should be tested").option("--days <n>", "Traffic lookback days", "14").action(async function action33(opts) {
+).option("--goal <id>", "Existing goal ID whose URL pattern should be tested").option("--days <n>", "Traffic lookback days", "14").action(async function action34(opts) {
   if (!opts.pattern && !opts.goal)
     fail(this, "Provide --pattern or --goal.", EXIT_CODES.validation);
   if (opts.pattern && opts.goal)
@@ -11855,7 +12392,7 @@ var test = new Command("test").description("Dry run a goal URL pattern against t
     }
   );
 });
-var suggest = new Command("suggest").description("Suggest goals and funnels from analytics").option("--create", "Create selected goals after confirmation").option("--yes", "Skip prompts when used with create").action(async function action34(opts) {
+var suggest = new Command("suggest").description("Suggest goals and funnels from analytics").option("--create", "Create selected goals after confirmation").option("--yes", "Skip prompts when used with create").action(async function action35(opts) {
   const creds = requireCredentials();
   const res = await suggestGoals(creds);
   if (!res.ok || !res.data)
@@ -11915,12 +12452,12 @@ Examples:
 
 // src/commands/funnels.ts
 init_source();
-var import_node_fs13 = __toESM(require("node:fs"));
-var import_node_path11 = __toESM(require("node:path"));
+var import_node_fs14 = __toESM(require("node:fs"));
+var import_node_path12 = __toESM(require("node:path"));
 function readSteps(command, file) {
   let parsed;
   try {
-    parsed = JSON.parse(import_node_fs13.default.readFileSync(import_node_path11.default.resolve(process.cwd(), file), "utf8"));
+    parsed = JSON.parse(import_node_fs14.default.readFileSync(import_node_path12.default.resolve(process.cwd(), file), "utf8"));
   } catch (error) {
     fail(
       command,
@@ -11945,7 +12482,7 @@ function printFunnel(funnel) {
     console.log(`  ${step.order}. ${step.label} \u2014 ${step.url_pattern}`);
   console.log();
 }
-var list3 = new Command("list").alias("ls").description("List funnels").action(async function action35() {
+var list3 = new Command("list").alias("ls").description("List funnels").action(async function action36() {
   const res = await listFunnels(requireCredentials());
   if (!res.ok || !res.data)
     fail(
@@ -11964,7 +12501,7 @@ var list3 = new Command("list").alias("ls").description("List funnels").action(a
     )
   );
 });
-var create3 = new Command("create").description("Create a funnel").requiredOption("--name <name>", "Funnel name").requiredOption("--steps-file <file>", "JSON array of { label, pattern }").action(async function action36(opts) {
+var create3 = new Command("create").description("Create a funnel").requiredOption("--name <name>", "Funnel name").requiredOption("--steps-file <file>", "JSON array of { label, pattern }").action(async function action37(opts) {
   const res = await createFunnel(requireCredentials(), {
     name: opts.name,
     steps: readSteps(this, opts.stepsFile)
@@ -11978,7 +12515,7 @@ var create3 = new Command("create").description("Create a funnel").requiredOptio
     );
   output(this, { funnel: res.data }, () => printFunnel(res.data));
 });
-var update2 = new Command("update").description("Replace a funnel's steps").argument("<id>", "Funnel ID").requiredOption("--steps-file <file>", "JSON array of { label, pattern }").action(async function action37(id, opts) {
+var update2 = new Command("update").description("Replace a funnel's steps").argument("<id>", "Funnel ID").requiredOption("--steps-file <file>", "JSON array of { label, pattern }").action(async function action38(id, opts) {
   const res = await updateFunnel(requireCredentials(), id, {
     steps: readSteps(this, opts.stepsFile)
   });
@@ -11991,7 +12528,7 @@ var update2 = new Command("update").description("Replace a funnel's steps").argu
     );
   output(this, { funnel: res.data }, () => printFunnel(res.data));
 });
-var del2 = new Command("delete").description("Delete a funnel").argument("<id>", "Funnel ID").action(async function action38(id) {
+var del2 = new Command("delete").description("Delete a funnel").argument("<id>", "Funnel ID").action(async function action39(id) {
   const res = await deleteFunnel(requireCredentials(), id);
   if (!res.ok)
     fail(
@@ -12002,7 +12539,7 @@ var del2 = new Command("delete").description("Delete a funnel").argument("<id>",
     );
   output(this, { deleted: true, id }, () => console.log(`Deleted funnel ${id}`));
 });
-var run = new Command("run").description("Run funnel analysis").argument("<id>", "Funnel ID").option("--days <n>", "Analysis window", "30").action(async function action39(id, opts) {
+var run = new Command("run").description("Run funnel analysis").argument("<id>", "Funnel ID").option("--days <n>", "Analysis window", "30").action(async function action40(id, opts) {
   if (!/^[1-9]\d*$/.test(opts.days))
     fail(this, "--days must be a positive integer", EXIT_CODES.validation);
   const days = Number.parseInt(opts.days, 10);
@@ -12026,7 +12563,7 @@ var run = new Command("run").description("Run funnel analysis").argument("<id>",
     )
   );
 });
-var validate2 = new Command("validate").description("Validate funnel steps without writing").requiredOption("--steps-file <file>", "JSON array of { label, pattern }").action(function action40(opts) {
+var validate2 = new Command("validate").description("Validate funnel steps without writing").requiredOption("--steps-file <file>", "JSON array of { label, pattern }").action(function action41(opts) {
   const steps = readSteps(this, opts.stepsFile);
   output(this, { valid: true, steps }, () => console.log(`Valid funnel steps: ${steps.length}`));
 });
@@ -12087,11 +12624,11 @@ async function load2(command) {
   }
   return result.data;
 }
-var list4 = new Command("list").alias("ls").description("List runtime environments and mapped domains").action(async function action41() {
+var list4 = new Command("list").alias("ls").description("List runtime environments and mapped domains").action(async function action42() {
   const { environments } = await load2(this);
   output(this, { environments }, () => printEnvironments(environments.items));
 });
-var setDomain = new Command("set-domain").description("Map a domain to a runtime environment").argument("<domain>", "Domain to map").requiredOption("--environment <env>", "Environment key").action(async function action42(domain, opts) {
+var setDomain = new Command("set-domain").description("Map a domain to a runtime environment").argument("<domain>", "Domain to map").requiredOption("--environment <env>", "Environment key").action(async function action43(domain, opts) {
   const normalizedDomain = normalizeEnvironmentDomain(domain);
   if (!normalizedDomain) {
     fail(this, "Domain must be a valid hostname containing a dot", EXIT_CODES.validation);
@@ -12138,7 +12675,7 @@ var setDomain = new Command("set-domain").description("Map a domain to a runtime
     () => printEnvironments(result.data.environments.items)
   );
 });
-var removeDomain = new Command("remove-domain").description("Remove a domain mapping").argument("<domain>", "Domain to remove").action(async function action43(domain) {
+var removeDomain = new Command("remove-domain").description("Remove a domain mapping").argument("<domain>", "Domain to remove").action(async function action44(domain) {
   const normalizedDomain = normalizeEnvironmentDomain(domain);
   if (!normalizedDomain) {
     fail(this, "Domain must be a valid hostname containing a dot", EXIT_CODES.validation);
@@ -12202,11 +12739,11 @@ function printConsent(data) {
     `Split: ${data.prerequisites.showVariationsRule && data.prerequisites.startTrackingRule ? "canonical" : "off"}`
   );
 }
-var get2 = new Command("get").description("Show consent settings").action(async function action44() {
+var get2 = new Command("get").description("Show consent settings").action(async function action45() {
   const data = await load3(this);
   output(this, data, () => printConsent(data));
 });
-var set = new Command("set").description("Enable and configure consent gating").requiredOption("--provider <provider>", "Consent provider").requiredOption("--group <group>", "Required consent group").option("--getter <path>", "Custom consent getter path").action(async function action45(opts) {
+var set = new Command("set").description("Enable and configure consent gating").requiredOption("--provider <provider>", "Consent provider").requiredOption("--group <group>", "Required consent group").option("--getter <path>", "Custom consent getter path").action(async function action46(opts) {
   const consentMode = {
     enabled: true,
     provider: opts.provider,
@@ -12227,7 +12764,7 @@ var set = new Command("set").description("Enable and configure consent gating").
   warn(this, result.data.precompile);
   output(this, result.data, () => printConsent(result.data));
 });
-var off = new Command("off").description("Disable consent gating").action(async function action46() {
+var off = new Command("off").description("Disable consent gating").action(async function action47() {
   const result = await updateConsent(requireCredentials(), { consentMode: { enabled: false } });
   if (!result.ok || !result.data)
     fail(
@@ -12242,22 +12779,34 @@ var off = new Command("off").description("Disable consent gating").action(async
 var consentCommand = new Command("consent").description("Manage consent gating").addCommand(get2).addCommand(set).addCommand(off);
 
 // src/commands/triggers.ts
-var import_node_fs14 = __toESM(require("node:fs"));
-var import_node_path12 = __toESM(require("node:path"));
+var import_node_fs15 = __toESM(require("node:fs"));
+var import_node_path13 = __toESM(require("node:path"));
 
 // src/trigger-proposal.ts
-function fieldsFrom(value, prefix = "") {
+function runtimePath(path24) {
+  return path24.replaceAll("[]", ".0");
+}
+function fieldsFrom(value, prefix = "", descriptorList = false) {
   if (!value || typeof value !== "object") return [];
-  if (Array.isArray(value)) return value.flatMap((item) => fieldsFrom(item, prefix));
+  if (Array.isArray(value)) {
+    return value.flatMap(
+      (item, index) => fieldsFrom(
+        item,
+        descriptorList ? prefix : prefix ? `${prefix}.${index}` : String(index),
+        descriptorList
+      )
+    );
+  }
   const record2 = value;
   const explicitPath = typeof record2.path === "string" ? record2.path : void 0;
-  if (explicitPath) {
+  if (descriptorList && explicitPath) {
     const rawValues = record2.values ?? record2.samples ?? record2.examples ?? record2.example;
     const values = Array.isArray(rawValues) ? rawValues : rawValues === void 0 ? [] : [rawValues];
     const magnitude = [record2.mean, record2.average, record2.max, record2.magnitude].find(
       (candidate) => typeof candidate === "number"
     );
-    return [{ path: explicitPath, values, magnitude }];
+    const numericType = Array.isArray(record2.types) && record2.types.length > 0 && record2.types.every((type) => type === "num" || type === "numstr" || type === "numstr_comma");
+    return [{ path: runtimePath(explicitPath), values, magnitude, numericType }];
   }
   return Object.entries(record2).flatMap(([key, child]) => {
     if (["eventName", "event_name", "name", "count", "frequency", "evidence"].includes(key))
@@ -12275,6 +12824,27 @@ function fieldsFrom(value, prefix = "") {
     return fieldsFrom(child, next);
   });
 }
+function isDescriptorArray(value) {
+  const descriptorKeys = /* @__PURE__ */ new Set([
+    "path",
+    "values",
+    "samples",
+    "examples",
+    "example",
+    "mean",
+    "average",
+    "max",
+    "magnitude",
+    "types",
+    "seen",
+    "type_collision"
+  ]);
+  return Array.isArray(value) && value.length > 0 && value.every((item) => {
+    if (!item || typeof item !== "object" || Array.isArray(item)) return false;
+    const record2 = item;
+    return typeof record2.path === "string" && record2.path.length > 0 && Object.keys(record2).every((key) => descriptorKeys.has(key));
+  });
+}
 function candidatesFrom(report) {
   if (!report || typeof report !== "object") return [];
   const root = report;
@@ -12292,15 +12862,15 @@ function candidatesFrom(report) {
   }
   return [root];
 }
-function score2(path23, patterns) {
+function score2(path24, patterns) {
   return patterns.reduce(
-    (total, pattern, index) => total + (pattern.test(path23) ? patterns.length - index : 0),
+    (total, pattern, index) => total + (pattern.test(path24) ? patterns.length - index : 0),
     0
   );
 }
 function best(fields, patterns, numeric2 = false) {
   const ranked = fields.filter(
-    (field) => !numeric2 || field.values.some((value) => typeof value === "number") || field.magnitude !== void 0
+    (field) => !numeric2 || field.numericType === true || field.values.some((value) => typeof value === "number") || field.magnitude !== void 0
   ).map((field) => ({ field, score: score2(field.path.toLowerCase(), patterns) })).filter((item) => item.score > 0).sort((a, b) => b.score - a.score || (b.field.magnitude ?? 0) - (a.field.magnitude ?? 0));
   if (!ranked.length) return [];
   const top = ranked[0].score;
@@ -12322,9 +12892,9 @@ function proposeTriggers(report) {
       eventName
     ))
       continue;
-    const fields = fieldsFrom(
-      candidate.fields ?? candidate.paths ?? candidate.properties ?? candidate.payload ?? candidate
-    );
+    const descriptors = candidate.fields ?? candidate.paths;
+    const payload = candidate.properties ?? candidate.payload ?? candidate;
+    const fields = descriptors !== void 0 ? fieldsFrom(descriptors, "", true) : fieldsFrom(payload, "", isDescriptorArray(payload));
     const revenues = best(
       fields,
       [/revenue/, /total.*amount|amount.*total/, /grand.*total|total/, /value|amount/],
@@ -12394,6 +12964,20 @@ function proposeTriggers(report) {
   return output2;
 }
 
+// src/generated/runtime-settings-trigger-constants.json
+var runtime_settings_trigger_constants_default = {
+  dotPathPattern: "^[A-Za-z_$][\\w$]*(?:\\.(?:\\d+|[A-Za-z_$][\\w$]*))*$",
+  signalPathPattern: "^signal:[A-Za-z_$][\\w$]*$",
+  valueTypes: ["string", "number", "boolean", "string_array", "json"],
+  whenOps: ["eq", "neq", "gt", "lt", "exists", "not_exists"],
+  maxWhenEntries: 5,
+  maxSourcePaths: 5,
+  maxTransformMapEntries: 20,
+  maxTransformMapKeyChars: 100,
+  maxTransformMapValueChars: 100,
+  maxTriggers: 20
+};
+
 // src/commands/triggers.ts
 var allowed = /* @__PURE__ */ new Set([
   "eventName",
@@ -12402,11 +12986,15 @@ var allowed = /* @__PURE__ */ new Set([
   "reEvaluate",
   "trackPageview",
   "trackEventName",
+  "when",
   "trackRevenue",
-  "mappings"
+  "mappings",
+  "properties"
 ]);
-var pathPattern = /^[A-Za-z_$][\w$]*(?:\.(?:\d+|[A-Za-z_$][\w$]*))*$/;
-var valueTypes = /* @__PURE__ */ new Set(["string", "number", "boolean", "string_array", "json"]);
+var pathPattern = new RegExp(runtime_settings_trigger_constants_default.dotPathPattern);
+var signalPathPattern = new RegExp(runtime_settings_trigger_constants_default.signalPathPattern);
+var valueTypes = new Set(runtime_settings_trigger_constants_default.valueTypes);
+var whenOps = new Set(runtime_settings_trigger_constants_default.whenOps);
 function strictObject(value, location, keys) {
   if (!value || typeof value !== "object" || Array.isArray(value))
     throw new Error(`${location} must be an object`);
@@ -12426,26 +13014,126 @@ function strictPath(value, location, required = false) {
       `${location} must use dot-path syntax with property or array-index segments (for example: ecommerce.items.0.price); bracket syntax is not accepted`
     );
 }
+function strictSource(value, location, allowSignal, required = false) {
+  if (value === void 0 && !required) return;
+  const sources = Array.isArray(value) ? value : [value];
+  if (Array.isArray(value) && (value.length < 1 || value.length > runtime_settings_trigger_constants_default.maxSourcePaths))
+    throw new Error(`${location} must contain 1 to ${runtime_settings_trigger_constants_default.maxSourcePaths} paths`);
+  sources.forEach((source, index) => {
+    const sourceLocation = Array.isArray(value) ? `${location}[${index}]` : location;
+    if (allowSignal && typeof source === "string" && signalPathPattern.test(source)) return;
+    strictPath(source, sourceLocation, true);
+  });
+}
+function defaultMatchesValueType(value, valueType) {
+  if (valueType === "number") {
+    if (typeof value !== "string") return Number.isFinite(Number(value));
+    const text = String(value).trim();
+    const normalized = /^-?\d{1,3}(\.\d{3})+,\d+$/.test(text) ? text.replace(/\./g, "").replace(",", ".") : /^-?\d+,\d+$/.test(text) ? text.replace(",", ".") : text;
+    return Number.isFinite(Number(normalized));
+  }
+  if (valueType === "boolean") {
+    if (typeof value === "boolean") return true;
+    return ["1", "true", "yes", "on", "0", "false", "no", "off"].includes(
+      String(value).trim().toLowerCase()
+    );
+  }
+  return true;
+}
+function strictTransform(value, valueType, location) {
+  if (value === void 0) return;
+  const transform = strictObject(
+    value,
+    location,
+    /* @__PURE__ */ new Set(["trim", "lowercase", "map", "scale", "default"])
+  );
+  optionalType(transform.trim, "boolean", `${location}.trim`);
+  optionalType(transform.lowercase, "boolean", `${location}.lowercase`);
+  if (transform.map !== void 0) {
+    if (!transform.map || typeof transform.map !== "object" || Array.isArray(transform.map))
+      throw new Error(`${location}.map must be an object`);
+    const map = transform.map;
+    const entries = Object.entries(map);
+    if (entries.length > runtime_settings_trigger_constants_default.maxTransformMapEntries)
+      throw new Error(
+        `${location}.map must contain at most ${runtime_settings_trigger_constants_default.maxTransformMapEntries} entries`
+      );
+    for (const [key, mappedValue] of entries) {
+      if (key.length > runtime_settings_trigger_constants_default.maxTransformMapKeyChars)
+        throw new Error(
+          `${location}.map keys must be at most ${runtime_settings_trigger_constants_default.maxTransformMapKeyChars} characters`
+        );
+      if (typeof mappedValue !== "string" || mappedValue.length > runtime_settings_trigger_constants_default.maxTransformMapValueChars)
+        throw new Error(
+          `${location}.map.${key} must be a string of at most ${runtime_settings_trigger_constants_default.maxTransformMapValueChars} characters`
+        );
+    }
+  }
+  if (transform.scale !== void 0 && (typeof transform.scale !== "number" || !Number.isFinite(transform.scale) || transform.scale === 0))
+    throw new Error(`${location}.scale must be finite and non-zero`);
+  if (transform.default !== void 0 && !["string", "number", "boolean"].includes(typeof transform.default))
+    throw new Error(`${location}.default must be a string, number, or boolean`);
+  if (transform.default !== void 0 && !defaultMatchesValueType(transform.default, valueType))
+    throw new Error(`${location}.default must coerce to the mapping valueType`);
+}
 function strictMapping(value, location, revenueProperty) {
   const keys = /* @__PURE__ */ new Set([
     "from",
     "to",
     "valueType",
+    "transform",
     ...revenueProperty ? [] : ["ttlDays", "persist"]
   ]);
   const mapping = strictObject(value, location, keys);
-  strictPath(mapping.from, `${location}.from`, true);
+  strictSource(mapping.from, `${location}.from`, revenueProperty, true);
   strictPath(mapping.to, `${location}.to`, true);
   if (mapping.valueType !== void 0 && !valueTypes.has(String(mapping.valueType)))
     throw new Error(`${location}.valueType must be string, number, boolean, string_array, or json`);
+  strictTransform(mapping.transform, mapping.valueType, `${location}.transform`);
   if (!revenueProperty) {
     optionalType(mapping.ttlDays, "number", `${location}.ttlDays`);
     optionalType(mapping.persist, "boolean", `${location}.persist`);
   }
 }
+function strictWhen(value, location) {
+  if (value === void 0) return;
+  if (!Array.isArray(value) || value.length < 1 || value.length > runtime_settings_trigger_constants_default.maxWhenEntries) {
+    throw new Error(`${location} must contain 1 to ${runtime_settings_trigger_constants_default.maxWhenEntries} entries`);
+  }
+  value.forEach((entry, index) => {
+    const entryLocation = `${location}[${index}]`;
+    const condition = strictObject(entry, entryLocation, /* @__PURE__ */ new Set(["path", "op", "value"]));
+    strictPath(condition.path, `${entryLocation}.path`, true);
+    if (typeof condition.op !== "string" || !whenOps.has(condition.op)) {
+      throw new Error(
+        `${entryLocation}.op must be ${runtime_settings_trigger_constants_default.whenOps.slice(0, -1).join(", ")}, or ${runtime_settings_trigger_constants_default.whenOps.at(-1)}`
+      );
+    }
+    const hasValue = Object.prototype.hasOwnProperty.call(condition, "value");
+    if (condition.op === "exists" || condition.op === "not_exists") {
+      if (hasValue) throw new Error(`${entryLocation}.value is forbidden for ${condition.op}`);
+      return;
+    }
+    if (!hasValue) throw new Error(`${entryLocation}.value is required for ${condition.op}`);
+    if (condition.op === "gt" || condition.op === "lt") {
+      if (typeof condition.value !== "number" || !Number.isFinite(condition.value)) {
+        throw new Error(`${entryLocation}.value must be a number for ${condition.op}`);
+      }
+      return;
+    }
+    if (!["string", "number", "boolean"].includes(typeof condition.value)) {
+      throw new Error(`${entryLocation}.value must be a string, number, or boolean`);
+    }
+    if (typeof condition.value === "number" && !Number.isFinite(condition.value)) {
+      throw new Error(`${entryLocation}.value must be finite`);
+    }
+  });
+}
 function strictTriggers(value) {
-  if (!Array.isArray(value) || value.length > 20)
-    throw new Error("trigger file must contain an array of at most 20 triggers");
+  if (!Array.isArray(value) || value.length > runtime_settings_trigger_constants_default.maxTriggers)
+    throw new Error(
+      `trigger file must contain an array of at most ${runtime_settings_trigger_constants_default.maxTriggers} triggers`
+    );
   return value.map((item, index) => {
     if (!item || typeof item !== "object" || Array.isArray(item))
       throw new Error(`trigger[${index}] must be an object`);
@@ -12458,6 +13146,7 @@ function strictTriggers(value) {
       optionalType(record2[key], "boolean", `trigger[${index}].${key}`);
     for (const key of ["dataLayerName", "trackEventName"])
       optionalType(record2[key], "string", `trigger[${index}].${key}`);
+    strictWhen(record2.when, `trigger[${index}].when`);
     if (record2.trackRevenue !== void 0) {
       const revenue = strictObject(
         record2.trackRevenue,
@@ -12474,7 +13163,7 @@ function strictTriggers(value) {
       );
       optionalType(revenue.enabled, "boolean", `trigger[${index}].trackRevenue.enabled`);
       for (const key of ["revenueFrom", "orderIdFrom", "currencyFrom", "costFrom", "profitFrom"])
-        strictPath(revenue[key], `trigger[${index}].trackRevenue.${key}`);
+        strictSource(revenue[key], `trigger[${index}].trackRevenue.${key}`, false);
       if (revenue.properties !== void 0) {
         if (!Array.isArray(revenue.properties))
           throw new Error(`trigger[${index}].trackRevenue.properties must be an array`);
@@ -12490,9 +13179,24 @@ function strictTriggers(value) {
         (mapping, mappingIndex) => strictMapping(mapping, `trigger[${index}].mappings[${mappingIndex}]`, false)
       );
     }
+    if (record2.properties !== void 0) {
+      if (!Array.isArray(record2.properties))
+        throw new Error(`trigger[${index}].properties must be an array`);
+      record2.properties.forEach(
+        (mapping, mappingIndex) => strictMapping(mapping, `trigger[${index}].properties[${mappingIndex}]`, true)
+      );
+    }
     return record2;
   });
 }
+function writeWarnings(result) {
+  const warnings = result.warnings;
+  if (!Array.isArray(warnings)) return;
+  for (const warning of warnings) {
+    if (typeof warning === "string") process.stderr.write(`WARNING: ${warning}
+`);
+  }
+}
 var uuidPattern = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 async function identify(command, requestedShop) {
   let credentials = requireCredentials();
@@ -12569,7 +13273,7 @@ var get3 = new Command("get").description("Get data layer triggers").requiredOpt
 var set2 = new Command("set").requiredOption("--file <json>", "JSON trigger array").requiredOption("--shop <domain-or-id>", "Shop domain or Apex shop ID").action(async function(opts) {
   let triggers;
   try {
-    triggers = strictTriggers(JSON.parse(import_node_fs14.default.readFileSync(import_node_path12.default.resolve(opts.file), "utf8")));
+    triggers = strictTriggers(JSON.parse(import_node_fs15.default.readFileSync(import_node_path13.default.resolve(opts.file), "utf8")));
   } catch (error) {
     fail(
       this,
@@ -12584,20 +13288,19 @@ var set2 = new Command("set").requiredOption("--file <json>", "JSON trigger arra
     updated_at: (/* @__PURE__ */ new Date()).toISOString(),
     ...data
   };
-  output(
-    this,
-    result,
-    () => process.stdout.write(
+  output(this, result, () => {
+    process.stdout.write(
       `TRIGGERS_SET shop_id=${identity.shop_id} domain=${identity.domain} updated_at=${result.updated_at} count=${triggers.length}
 `
-    )
-  );
+    );
+    writeWarnings(result);
+  });
 });
 var propose = new Command("propose").requiredOption("--from-file <u2-report.json>", "U2 discovery report").requiredOption("--shop <domain-or-id>", "Shop domain or Apex shop ID").action(function(opts) {
   let proposals;
   let report;
   try {
-    report = JSON.parse(import_node_fs14.default.readFileSync(import_node_path12.default.resolve(opts.fromFile), "utf8"));
+    report = JSON.parse(import_node_fs15.default.readFileSync(import_node_path13.default.resolve(opts.fromFile), "utf8"));
     proposals = proposeTriggers(report);
   } catch (error) {
     fail(this, error instanceof Error ? error.message : String(error), 2);
@@ -12656,14 +13359,13 @@ var recipe = new Command("apply-recipe").argument("<recipeId>").requiredOption("
     domain: identity.domain,
     applied_at: (/* @__PURE__ */ new Date()).toISOString()
   };
-  output(
-    this,
-    result,
-    () => process.stdout.write(
+  output(this, result, () => {
+    process.stdout.write(
       `TRIGGERS_APPLIED shop_id=${identity.shop_id} domain=${identity.domain} applied_at=${result.applied_at} recipe=${recipeId}
 `
-    )
-  );
+    );
+    writeWarnings(result);
+  });
 });
 var enable = new Command("enable-capture").requiredOption("--hours <n>").requiredOption("--shop <domain-or-id>", "Shop domain or Apex shop ID").option("--url-pattern <p>", "URL pattern", collect, []).action(async function(opts) {
   const hours = Number(opts.hours);
@@ -12750,11 +13452,11 @@ async function patchWithRetry(command, build) {
   warn2(command, result.data.precompile);
   return result.data;
 }
-var list5 = new Command("list").alias("ls").description("List install domains").action(async function action47() {
+var list5 = new Command("list").alias("ls").description("List install domains").action(async function action48() {
   const data = await load4(this);
   output(this, data, () => printDomains(data));
 });
-var add = new Command("add").description("Add install domains").argument("<domain...>").action(async function action48(domain) {
+var add = new Command("add").description("Add install domains").argument("<domain...>").action(async function action49(domain) {
   const added = domain.map(normalizeDomain);
   const data = await patchWithRetry(
     this,
@@ -12762,7 +13464,7 @@ var add = new Command("add").description("Add install domains").argument("<domai
   );
   output(this, data, () => printDomains(data));
 });
-var remove = new Command("remove").description("Remove install domains").argument("<domain...>").action(async function action49(domain) {
+var remove = new Command("remove").description("Remove install domains").argument("<domain...>").action(async function action50(domain) {
   const removeSet = new Set(domain.map(normalizeDomain));
   const data = await patchWithRetry(
     this,
@@ -12770,7 +13472,7 @@ var remove = new Command("remove").description("Remove install domains").argumen
   );
   output(this, data, () => printDomains(data));
 });
-var set3 = new Command("set").description("Replace install domains").argument("<domain...>").action(async function action50(domain) {
+var set3 = new Command("set").description("Replace install domains").argument("<domain...>").action(async function action51(domain) {
   const replacement = domain.map(normalizeDomain);
   const data = await patchWithRetry(this, () => replacement);
   output(this, data, () => printDomains(data));
@@ -12862,14 +13564,14 @@ async function patchWithRetry2(command, build) {
     );
   return result.data;
 }
-var get4 = new Command("get").description("Show cross-domain handover settings").action(async function action51() {
+var get4 = new Command("get").description("Show cross-domain handover settings").action(async function action52() {
   const data = await load5(this);
   output(this, data, () => printSettings(data.externalTracking));
 });
 var set4 = new Command("set").description("Enable cross-domain identity handover").requiredOption("--domain <domain...>", "Bound handover domain(s)").option("--param <param>", "Handover query parameter").option(
   "--signed",
   "Require signed handover tokens (the default; unsigning is a platform-support action)"
-).action(async function action52(opts) {
+).action(async function action53(opts) {
   const domains = opts.domain.map(normalizeDomain2);
   if (domains.some((domain) => !domain))
     fail(
@@ -12889,14 +13591,14 @@ var set4 = new Command("set").description("Enable cross-domain identity handover
   }));
   output(this, data, () => printSettings(data.externalTracking));
 });
-var off2 = new Command("off").description("Disable cross-domain handover").action(async function action53() {
+var off2 = new Command("off").description("Disable cross-domain handover").action(async function action54() {
   const data = await patchWithRetry2(this, (current) => ({
     externalTracking: { domains: [], signed: true },
     ifRevision: current.revision
   }));
   output(this, data, () => printSettings(data.externalTracking));
 });
-var qa2 = new Command("qa").description("Check static link/form handover parameter carriage").requiredOption("--from <url>", "Page URL to inspect").requiredOption("--to-domain <domain>", "Target domain that should carry the handover parameter").action(async function action54(opts) {
+var qa2 = new Command("qa").description("Check static link/form handover parameter carriage").requiredOption("--from <url>", "Page URL to inspect").requiredOption("--to-domain <domain>", "Target domain that should carry the handover parameter").action(async function action55(opts) {
   const config = await load5(this);
   const target = normalizeDomain2(opts.toDomain);
   if (!target) fail(this, "--to-domain must be a valid hostname", EXIT_CODES.validation);
@@ -13939,7 +14641,7 @@ var doctorCommand = new Command("doctor").description("Check shop configuration
 ).option("--check <id>", "Run one check (for example purchase_capture)").option(
   "--worker <url>",
   `Apex Worker base URL; defaults to DRIP_WORKER_URL or ${PRODUCTION_WORKER_BASE_URL}`
-).action(async function action55(options) {
+).action(async function action56(options) {
   const data = await runDoctor(options);
   if (options.check && data.checks.length === 0)
     fail(this, `Unknown doctor check: ${options.check}`, EXIT_CODES.validation);
@@ -13961,7 +14663,7 @@ function printDoctorReport(checks) {
 var consentRateCommand = new Command("consent-rate").description("Estimate analytics consent acceptance from visitor series").option(
   "--since <date>",
   "Consent gating start date (YYYY-MM-DD); splits the baseline and gated windows"
-).action(async function action56(opts) {
+).action(async function action57(opts) {
   if (opts.since !== void 0 && parseDay(opts.since) === null)
     fail(this, "--since must be a calendar date in YYYY-MM-DD form", EXIT_CODES.validation);
   const result = await getVisitorSeries(requireCredentials(), { days: VISITOR_SERIES_DAYS });
@@ -14021,7 +14723,7 @@ function analyticsSubcommand(name, description, defaultDays) {
     command.option("--planning-days <n>", "Planning window in days", "180");
     command.option("--limit <n>", "Maximum page rows", "50");
   }
-  return command.action(async function action70(opts) {
+  return command.action(async function action71(opts) {
     const result = await getAnalytics(requireCredentials(), name, {
       days: positiveInteger(this, opts.days, "--days"),
       planningDays: positiveInteger(this, opts.planningDays, "--planning-days"),
@@ -14041,7 +14743,7 @@ function urlsCommand() {
   return new Command("urls").description("Show storefront URL inventory from pageview analytics").option("-d, --days <n>", "Analytics window in days", "14").option("--host <host>", "Filter inventory to one host").option("--contains <substring>", "Server-side path substring filter").option(
     "--match <regex>",
     "Client-side regex filter; exhausts inventory pages before filtering"
-  ).option("--limit <n>", "Maximum rows to print", "50").action(async function action70(opts) {
+  ).option("--limit <n>", "Maximum rows to print", "50").action(async function action71(opts) {
     const creds = requireCredentials();
     const days = positiveInteger(this, opts.days, "--days") ?? 14;
     const displayLimit = Math.min(200, positiveInteger(this, opts.limit, "--limit") ?? 50);
@@ -14235,10 +14937,10 @@ function decodeBody(raw, header, limits, hostname, inputTruncated = false) {
     const chunks = [];
     let bytes = 0;
     let settled = false;
-    const settle = (action70) => {
+    const settle = (action71) => {
       if (settled) return;
       settled = true;
-      action70();
+      action71();
     };
     stream.on("data", (chunk) => {
       if (settled) return;
@@ -14309,11 +15011,11 @@ function pinnedFetch(url, addresses, limits) {
       else callback(null, addresses[0], (0, import_node_net.isIP)(addresses[0]));
     };
     let settled = false;
-    const settle = (action70) => {
+    const settle = (action71) => {
       if (settled) return;
       settled = true;
       clearTimeout(deadline);
-      action70();
+      action71();
     };
     const req = send3(
       url,
@@ -14648,7 +15350,7 @@ async function checkServedConfig(configUrl, workerBaseUrl, workerBaseSource) {
 var installCommand = new Command("install").description("Check Apex storefront installation").command("check").description("Verify snippet, served config, and recent tracking for the current shop").option("--url <url>", "Check one explicit bound storefront URL").option("--shop-id <id>", "Apex shop ID to verify (falls back to DRIP_SHOP_ID)").option(
   "--worker-url <url>",
   "Apex Worker base URL that serves /config (defaults to the URL in the served snippet, then DRIP_WORKER_URL, then the production worker)"
-).option("--environment <key>", "Environment key to request from the worker", "production").action(async function action57(opts) {
+).option("--environment <key>", "Environment key to request from the worker", "production").action(async function action58(opts) {
   const creds = requireCredentials();
   const shopId = opts.shopId?.trim() || process.env.DRIP_SHOP_ID?.trim() || null;
   if (!shopId)
@@ -14792,8 +15494,8 @@ var installCommand = new Command("install").description("Check Apex storefront i
 
 // src/commands/flags.ts
 init_source();
-var import_node_fs15 = __toESM(require("node:fs"));
-var import_node_path13 = __toESM(require("node:path"));
+var import_node_fs16 = __toESM(require("node:fs"));
+var import_node_path14 = __toESM(require("node:path"));
 
 // src/edge-status.ts
 function getEdgeDeliveryStatus(deliveryType, expectedWorstCaseSeconds = 360) {
@@ -14835,7 +15537,7 @@ function body(command, value, opts) {
   let parsed = {};
   if (value) {
     const source = value.startsWith("@") ? value.slice(1) : value;
-    const text = value.startsWith("@") || import_node_fs15.default.existsSync(source) ? import_node_fs15.default.readFileSync(import_node_path13.default.resolve(process.cwd(), source), "utf8") : value;
+    const text = value.startsWith("@") || import_node_fs16.default.existsSync(source) ? import_node_fs16.default.readFileSync(import_node_path14.default.resolve(process.cwd(), source), "utf8") : value;
     try {
       parsed = JSON.parse(text);
     } catch (e) {
@@ -14948,11 +15650,11 @@ function write(name) {
   });
   return c;
 }
-function lifecycle(action70) {
-  return new Command(action70).description(`${action70[0].toUpperCase()}${action70.slice(1)} a flag`).argument("<id>").action(async function(id) {
-    const r = await transitionManagedDelivery(requireCredentials(), kind, id, action70);
+function lifecycle(action71) {
+  return new Command(action71).description(`${action71[0].toUpperCase()}${action71.slice(1)} a flag`).argument("<id>").action(async function(id) {
+    const r = await transitionManagedDelivery(requireCredentials(), kind, id, action71);
     if (!r.ok || !r.data)
-      fail(this, r.error ?? `Failed to ${action70}`, classifyStatus(r.status), r.errorDetails);
+      fail(this, r.error ?? `Failed to ${action71}`, classifyStatus(r.status), r.errorDetails);
     output(this, { flag: r.data }, () => detail(r.data));
   });
 }
@@ -14968,8 +15670,8 @@ Examples:
 );
 
 // src/commands/backlog.ts
-var import_node_fs16 = __toESM(require("node:fs"));
-var import_node_path14 = __toESM(require("node:path"));
+var import_node_fs17 = __toESM(require("node:fs"));
+var import_node_path15 = __toESM(require("node:path"));
 init_source();
 var kind2 = "backlog";
 var singular = "backlog item";
@@ -14977,7 +15679,7 @@ function parse(command, value) {
   if (!value) return {};
   try {
     const source = value.startsWith("@") ? value.slice(1) : value;
-    const text = value.startsWith("@") || import_node_fs16.default.existsSync(source) ? import_node_fs16.default.readFileSync(import_node_path14.default.resolve(process.cwd(), source), "utf8") : value;
+    const text = value.startsWith("@") || import_node_fs17.default.existsSync(source) ? import_node_fs17.default.readFileSync(import_node_path15.default.resolve(process.cwd(), source), "utf8") : value;
     const body5 = JSON.parse(text);
     if (!body5 || typeof body5 !== "object" || Array.isArray(body5))
       throw new Error("body must be an object");
@@ -15027,24 +15729,24 @@ var get6 = new Command("get").description("Get a backlog item").argument("<id>",
     fail(this, r.error ?? "Failed to get", classifyStatus(r.status), r.errorDetails);
   output(this, { backlog_item: r.data }, () => detail2(r.data));
 });
-function write2(action70) {
-  const c = new Command(action70).description(
-    `${action70 === "create" ? "Create" : "Update"} a ${singular}`
+function write2(action71) {
+  const c = new Command(action71).description(
+    `${action71 === "create" ? "Create" : "Update"} a ${singular}`
   );
-  if (action70 === "update") c.argument("<id>", `${singular} ID`);
+  if (action71 === "update") c.argument("<id>", `${singular} ID`);
   c.argument("[json]", "Inline JSON, @file, or file path").option(
     "--file <path>",
     "JSON body file"
   );
   c.action(async function(...args) {
     const o = this.opts();
-    const id = action70 === "update" ? String(args[0]) : void 0;
-    const raw = o.file ? `@${o.file}` : String(args[action70 === "update" ? 1 : 0] ?? "") || void 0;
+    const id = action71 === "update" ? String(args[0]) : void 0;
+    const raw = o.file ? `@${o.file}` : String(args[action71 === "update" ? 1 : 0] ?? "") || void 0;
     const body5 = parse(this, raw);
     if (!Object.keys(body5).length) fail(this, "Provide a JSON body.", EXIT_CODES.validation);
-    const r = action70 === "create" ? await createInsight(requireCredentials(), kind2, body5) : await updateInsight(requireCredentials(), kind2, id, body5);
+    const r = action71 === "create" ? await createInsight(requireCredentials(), kind2, body5) : await updateInsight(requireCredentials(), kind2, id, body5);
     if (!r.ok || !r.data)
-      fail(this, r.error ?? `Failed to ${action70}`, classifyStatus(r.status), r.errorDetails);
+      fail(this, r.error ?? `Failed to ${action71}`, classifyStatus(r.status), r.errorDetails);
     output(this, { backlog_item: r.data }, () => detail2(r.data));
   });
   return c;
@@ -15093,8 +15795,8 @@ var remove2 = new Command("delete").description("Delete a backlog item").argumen
 var backlogCommand = new Command("backlog").description("Manage backlog").addCommand(list7).addCommand(get6).addCommand(write2("create")).addCommand(write2("update")).addCommand(archive).addCommand(restore).addCommand(remove2);
 
 // src/commands/signals.ts
-var import_node_fs17 = __toESM(require("node:fs"));
-var import_node_path15 = __toESM(require("node:path"));
+var import_node_fs18 = __toESM(require("node:fs"));
+var import_node_path16 = __toESM(require("node:path"));
 init_source();
 var kind3 = "signals";
 var singular2 = "signal";
@@ -15102,7 +15804,7 @@ function parse2(command, value) {
   if (!value) return {};
   try {
     const source = value.startsWith("@") ? value.slice(1) : value;
-    const text = value.startsWith("@") || import_node_fs17.default.existsSync(source) ? import_node_fs17.default.readFileSync(import_node_path15.default.resolve(process.cwd(), source), "utf8") : value;
+    const text = value.startsWith("@") || import_node_fs18.default.existsSync(source) ? import_node_fs18.default.readFileSync(import_node_path16.default.resolve(process.cwd(), source), "utf8") : value;
     const body5 = JSON.parse(text);
     if (!body5 || typeof body5 !== "object" || Array.isArray(body5))
       throw new Error("body must be an object");
@@ -15152,24 +15854,24 @@ var get7 = new Command("get").description("Get a signal").argument("<id>", "sign
     fail(this, r.error ?? "Failed to get", classifyStatus(r.status), r.errorDetails);
   output(this, { signal: r.data }, () => detail3(r.data));
 });
-function write3(action70) {
-  const c = new Command(action70).description(
-    `${action70 === "create" ? "Create" : "Update"} a ${singular2}`
+function write3(action71) {
+  const c = new Command(action71).description(
+    `${action71 === "create" ? "Create" : "Update"} a ${singular2}`
   );
-  if (action70 === "update") c.argument("<id>", `${singular2} ID`);
+  if (action71 === "update") c.argument("<id>", `${singular2} ID`);
   c.argument("[json]", "Inline JSON, @file, or file path").option(
     "--file <path>",
     "JSON body file"
   );
   c.action(async function(...args) {
     const o = this.opts();
-    const id = action70 === "update" ? String(args[0]) : void 0;
-    const raw = o.file ? `@${o.file}` : String(args[action70 === "update" ? 1 : 0] ?? "") || void 0;
+    const id = action71 === "update" ? String(args[0]) : void 0;
+    const raw = o.file ? `@${o.file}` : String(args[action71 === "update" ? 1 : 0] ?? "") || void 0;
     const body5 = parse2(this, raw);
     if (!Object.keys(body5).length) fail(this, "Provide a JSON body.", EXIT_CODES.validation);
-    const r = action70 === "create" ? await createInsight(requireCredentials(), kind3, body5) : await updateInsight(requireCredentials(), kind3, id, body5);
+    const r = action71 === "create" ? await createInsight(requireCredentials(), kind3, body5) : await updateInsight(requireCredentials(), kind3, id, body5);
     if (!r.ok || !r.data)
-      fail(this, r.error ?? `Failed to ${action70}`, classifyStatus(r.status), r.errorDetails);
+      fail(this, r.error ?? `Failed to ${action71}`, classifyStatus(r.status), r.errorDetails);
     output(this, { signal: r.data }, () => detail3(r.data));
   });
   return c;
@@ -15184,14 +15886,14 @@ var signalsCommand = new Command("signals").description("Manage signals").addCom
 
 // src/commands/personalizations.ts
 init_source();
-var import_node_fs18 = __toESM(require("node:fs"));
-var import_node_path16 = __toESM(require("node:path"));
+var import_node_fs19 = __toESM(require("node:fs"));
+var import_node_path17 = __toESM(require("node:path"));
 var kind4 = "personalizations";
 function body2(command, value, opts) {
   let parsed = {};
   if (value) {
     const source = value.startsWith("@") ? value.slice(1) : value;
-    const text = value.startsWith("@") || import_node_fs18.default.existsSync(source) ? import_node_fs18.default.readFileSync(import_node_path16.default.resolve(process.cwd(), source), "utf8") : value;
+    const text = value.startsWith("@") || import_node_fs19.default.existsSync(source) ? import_node_fs19.default.readFileSync(import_node_path17.default.resolve(process.cwd(), source), "utf8") : value;
     try {
       parsed = JSON.parse(text);
     } catch (e) {
@@ -15261,11 +15963,11 @@ function write4(name) {
   });
   return c;
 }
-function lifecycle2(action70) {
-  return new Command(action70).description(`${action70[0].toUpperCase()}${action70.slice(1)} a personalization`).argument("<id>").action(async function(id) {
-    const r = await transitionManagedDelivery(requireCredentials(), kind4, id, action70);
+function lifecycle2(action71) {
+  return new Command(action71).description(`${action71[0].toUpperCase()}${action71.slice(1)} a personalization`).argument("<id>").action(async function(id) {
+    const r = await transitionManagedDelivery(requireCredentials(), kind4, id, action71);
     if (!r.ok || !r.data)
-      fail(this, r.error ?? `Failed to ${action70}`, classifyStatus(r.status), r.errorDetails);
+      fail(this, r.error ?? `Failed to ${action71}`, classifyStatus(r.status), r.errorDetails);
     output(this, { personalization: r.data }, () => detail4(r.data));
   });
 }
@@ -15273,13 +15975,13 @@ var personalizationsCommand = new Command("personalizations").description("Manag
 
 // src/commands/targeting-resources.ts
 init_source();
-var import_node_fs19 = __toESM(require("node:fs"));
-var import_node_path17 = __toESM(require("node:path"));
+var import_node_fs20 = __toESM(require("node:fs"));
+var import_node_path18 = __toESM(require("node:path"));
 function body3(command, value) {
   if (!value) return {};
   const source = value.startsWith("@") ? value.slice(1) : value;
   try {
-    const text = value.startsWith("@") || import_node_fs19.default.existsSync(source) ? import_node_fs19.default.readFileSync(import_node_path17.default.resolve(process.cwd(), source), "utf8") : value;
+    const text = value.startsWith("@") || import_node_fs20.default.existsSync(source) ? import_node_fs20.default.readFileSync(import_node_path18.default.resolve(process.cwd(), source), "utf8") : value;
     return JSON.parse(text);
   } catch (error) {
     fail(
@@ -15347,21 +16049,21 @@ function targetingResourceCommand(kind5) {
         );
       })
     );
-  for (const action70 of ["create", "update"]) {
-    const command = new Command(action70).description(
-      `${action70 === "create" ? "Create" : "Update"} a ${singular3}`
+  for (const action71 of ["create", "update"]) {
+    const command = new Command(action71).description(
+      `${action71 === "create" ? "Create" : "Update"} a ${singular3}`
     );
-    if (action70 === "update") command.argument("<id>");
+    if (action71 === "update") command.argument("<id>");
     command.argument("[json]", "Inline JSON, @file, or file path").option("--file <path>", "JSON body file").action(async function(...args) {
       const opts = this.opts();
-      const id = action70 === "update" ? String(args[0]) : void 0;
-      const value = opts.file ? `@${opts.file}` : String(args[action70 === "update" ? 1 : 0] ?? "") || void 0;
+      const id = action71 === "update" ? String(args[0]) : void 0;
+      const value = opts.file ? `@${opts.file}` : String(args[action71 === "update" ? 1 : 0] ?? "") || void 0;
       const requestBody = body3(this, value);
-      if (action70 === "update" && typeof requestBody === "object" && requestBody !== null && !Array.isArray(requestBody) && Object.keys(requestBody).length === 0)
+      if (action71 === "update" && typeof requestBody === "object" && requestBody !== null && !Array.isArray(requestBody) && Object.keys(requestBody).length === 0)
         fail(this, `Updating a ${singular3} requires at least one field.`, EXIT_CODES.validation);
       const response = await requestTargetingResource(
         requireCredentials(),
-        action70 === "create" ? "POST" : "PATCH",
+        action71 === "create" ? "POST" : "PATCH",
         kind5,
         id,
         requestBody
@@ -15369,7 +16071,7 @@ function targetingResourceCommand(kind5) {
       if (!response.ok || !response.data)
         fail(
           this,
-          response.error ?? `Failed to ${action70}`,
+          response.error ?? `Failed to ${action71}`,
           classifyStatus(response.status),
           response.errorDetails
         );
@@ -15378,7 +16080,7 @@ function targetingResourceCommand(kind5) {
         {
           [kind5 === "exclusion-groups" ? "exclusion_group" : singular3]: response.data
         },
-        () => console.log(source_default.green(`${action70}d ${singular3}`))
+        () => console.log(source_default.green(`${action71}d ${singular3}`))
       );
     });
     root.addCommand(command);
@@ -15452,7 +16154,7 @@ var exclusionGroupsCommand = targetingResourceCommand("exclusion-groups");
 // src/commands/brand.ts
 init_source();
 var NO_PROFILE_MESSAGE = "No brand profile yet \u2014 run onboarding or a site check";
-var brandCommand = new Command("brand").description("Print the shop brand context for external agents").action(async function action58() {
+var brandCommand = new Command("brand").description("Print the shop brand context for external agents").action(async function action59() {
   const creds = requireCredentials();
   const res = await getBrandContext(creds);
   if (res.status === 404) {
@@ -15485,7 +16187,7 @@ var brandCommand = new Command("brand").description("Print the shop brand contex
 
 // src/commands/targeting.ts
 init_source();
-var test2 = new Command("test").description("Evaluate experiment URL targeting for a page").argument("<url>", "URL to evaluate").option("--status <status>", "Comma-separated statuses to include, or all", "all").action(async function action59(url, opts) {
+var test2 = new Command("test").description("Evaluate experiment URL targeting for a page").argument("<url>", "URL to evaluate").option("--status <status>", "Comma-separated statuses to include, or all", "all").action(async function action60(url, opts) {
   const creds = requireCredentials();
   const res = await testTargeting(creds, url, { status: opts.status });
   if (!res.ok || !res.data) {
@@ -15530,13 +16232,21 @@ var targetingCommand = new Command("targeting").description("Test experiment tar
 
 // src/commands/sos.ts
 init_source();
-var import_node_fs20 = __toESM(require("node:fs"));
-var import_node_path18 = __toESM(require("node:path"));
-var SOS_TYPES = /* @__PURE__ */ new Set(["full_handover", "design", "development", "qa", "config", "bug"]);
+var import_node_fs21 = __toESM(require("node:fs"));
+var import_node_path19 = __toESM(require("node:path"));
+var SOS_TYPES = /* @__PURE__ */ new Set([
+  "full_handover",
+  "design",
+  "development",
+  "qa",
+  "config",
+  "bug",
+  "help"
+]);
 function readText(value) {
   if (!value) return void 0;
   if (!value.startsWith("@")) return value;
-  return import_node_fs20.default.readFileSync(import_node_path18.default.resolve(process.cwd(), value.slice(1)), "utf8");
+  return import_node_fs21.default.readFileSync(import_node_path19.default.resolve(process.cwd(), value.slice(1)), "utf8");
 }
 function printTicket(ticket, reused) {
   console.log();
@@ -15547,11 +16257,26 @@ function printTicket(ticket, reused) {
   console.log(`  Status: ${ticket.my_status ?? ticket.mapped_status}`);
   console.log();
 }
-var create4 = new Command("create").description("Create an Apex SOS ticket").option("--type <type>", "full_handover|design|development|qa|config|bug", "qa").option("--loom <url>", "Loom URL with reproduction or QA context").option("--experiment <id>", "Experiment ID").option("--sub-class <text>", "SOS sub-classification").option("--description <text-or-@file>", "Description text or @path").argument("[description]", "Description text").action(async function action60(descriptionArg, opts) {
+function printCreatedTicket(result) {
+  if ("reused" in result) {
+    printTicket(result.ticket, result.reused);
+    return;
+  }
+  console.log();
+  console.log(source_default.bold(result.deduped ? "Reused customer ticket" : "Created customer ticket"));
+  console.log(`  Reference: ${source_default.dim(result.ticket.reference)}`);
+  console.log(`  Status:    ${result.ticket.status}`);
+  console.log();
+}
+var create4 = new Command("create").description("Create an Apex SOS ticket").option(
+  "--type <type>",
+  "full_handover|design|development|qa|config|bug|help (internal types require a DRIP account)",
+  "qa"
+).option("--loom <url>", "Loom URL with reproduction or QA context").option("--experiment <id>", "Experiment ID").option("--sub-class <text>", "SOS sub-classification").option("--description <text-or-@file>", "Description text or @path").argument("[description]", "Description text").action(async function action61(descriptionArg, opts) {
   if (!SOS_TYPES.has(opts.type)) {
     fail(
       this,
-      "Invalid SOS type. Use full_handover, design, development, qa, config, or bug.",
+      "Invalid SOS type. Use full_handover, design, development, qa, config, bug, or help. Internal types require a DRIP account.",
       3
     );
   }
@@ -15572,9 +16297,9 @@ var create4 = new Command("create").description("Create an Apex SOS ticket").opt
       res.errorDetails
     );
   }
-  output(this, res.data, () => printTicket(res.data.ticket, res.data.reused));
+  output(this, res.data, () => printCreatedTicket(res.data));
 });
-var mine = new Command("mine").description("List SOS tickets created by this API key").action(async function action61() {
+var mine = new Command("mine").description("List SOS tickets created by this API key").action(async function action62() {
   const creds = requireCredentials();
   const res = await listMySos(creds);
   if (!res.ok || !res.data) {
@@ -15655,13 +16380,13 @@ var markRead = new Command("mark-read").option("--channel <key>", "Mark one chan
 var inboxCommand = new Command("inbox").description("Read and send inbox messages").addCommand(list11).addCommand(send2).addCommand(markRead);
 
 // src/commands/shops.ts
-var import_node_fs21 = __toESM(require("node:fs"));
-var import_node_path19 = __toESM(require("node:path"));
+var import_node_fs22 = __toESM(require("node:fs"));
+var import_node_path20 = __toESM(require("node:path"));
 function body4(command, raw) {
   if (!raw) return {};
   try {
     const source = raw.startsWith("@") ? raw.slice(1) : raw;
-    const text = raw.startsWith("@") || import_node_fs21.default.existsSync(source) ? import_node_fs21.default.readFileSync(import_node_path19.default.resolve(source), "utf8") : raw;
+    const text = raw.startsWith("@") || import_node_fs22.default.existsSync(source) ? import_node_fs22.default.readFileSync(import_node_path20.default.resolve(source), "utf8") : raw;
     const value = JSON.parse(text);
     if (!value || typeof value !== "object" || Array.isArray(value))
       throw new Error("body must be an object");
@@ -15889,7 +16614,7 @@ function commandSchema(command) {
   };
 }
 function createSchemaCommand(program3) {
-  return new Command("schema").description("Print the current Apex CLI command and flag schema").option("--json", "Print JSON schema").action(function action70() {
+  return new Command("schema").description("Print the current Apex CLI command and flag schema").option("--json", "Print JSON schema").action(function action71() {
     const schema = commandSchema(program3);
     output(this, schema, () => {
       process.stdout.write(`${JSON.stringify(schema, null, 2)}
@@ -16042,7 +16767,7 @@ function parseContainer(source, id, dataLayerName = "dataLayer") {
       vtpPaths,
       ecommerceFrom: [...ecommerce][0] ?? null,
       serverContainerUrl: [...serverUrls][0] ?? null,
-      piiPaths: vtpPaths.filter((path23) => /email|phone|address|name/i.test(path23))
+      piiPaths: vtpPaths.filter((path24) => /email|phone|address|name/i.test(path24))
     }
   };
 }
@@ -16101,6 +16826,145 @@ function minutesValue(value) {
     throw new CliError("--minutes must be an integer between 1 and 20160", EXIT_CODES.validation);
   return parsed;
 }
+function isStableField(field) {
+  return field.types.length > 0 && !field.type_collision;
+}
+function baseFieldTypes(field) {
+  return new Set(field.types.map((type) => type.split(":")[0]));
+}
+function isContainerField(field) {
+  const types = baseFieldTypes(field);
+  return types.has("obj") || types.has("arr");
+}
+function hasSyntheticPlaceholder(path24) {
+  return path24.split(".").map((segment) => segment.replace(/\[\]$/, "")).some((segment) => /^<[^>]+>$/.test(segment));
+}
+function ambiguousDottedPrefix(event, path24) {
+  const segments = path24.split(".");
+  for (let index = 1; index < segments.length; index += 1) {
+    const prefix = segments.slice(0, index).join(".");
+    const parent = event.fields.find((field) => field.path === prefix);
+    if (!parent || !isContainerField(parent)) return prefix;
+  }
+  return void 0;
+}
+function dimensionEligibility(event, field) {
+  const path24 = field.path;
+  if (hasSyntheticPlaceholder(path24)) {
+    return {
+      eligible: false,
+      message: `Path ${JSON.stringify(path24)} is a synthetic placeholder and cannot create a dimension. Choose an observed scalar path.`
+    };
+  }
+  if (isContainerField(field)) {
+    return {
+      eligible: false,
+      message: `Path ${JSON.stringify(path24)} is container-typed. Choose an observed scalar path.`
+    };
+  }
+  if (path24.includes("[]")) {
+    return {
+      eligible: false,
+      message: `Path ${JSON.stringify(path24)} includes an array-element segment and cannot create a reliable dimension. Choose a scalar path outside an array.`
+    };
+  }
+  if (!isStableField(field)) {
+    return {
+      eligible: false,
+      message: `Path ${JSON.stringify(path24)} does not have a stable observed type. Choose a path without a type collision.`
+    };
+  }
+  if (!event.event) {
+    return {
+      eligible: false,
+      message: `Path ${JSON.stringify(path24)} has no observed event name. Choose a path from a named event.`
+    };
+  }
+  const ambiguousPrefix = ambiguousDottedPrefix(event, path24);
+  if (ambiguousPrefix) {
+    return {
+      eligible: false,
+      message: `Path ${JSON.stringify(path24)} could be a literal key containing dots because the discovery report has no observed container at ${JSON.stringify(ambiguousPrefix)}. Apex cannot safely create a capture for it.`
+    };
+  }
+  return { eligible: true };
+}
+function isNumericField(field) {
+  const numericTypes = /* @__PURE__ */ new Set(["num", "numstr", "numstr_comma"]);
+  return field.types.length > 0 && field.types.every((type) => numericTypes.has(type.split(":")[0]));
+}
+function defaultDimensionLabel(path24) {
+  const words = path24.split(/[._-]+/).filter(Boolean).join(" ");
+  return words ? `${words[0].toUpperCase()}${words.slice(1)}` : path24;
+}
+function quoteShellArgument(value) {
+  return "'" + value.replaceAll("'", "'\\''") + "'";
+}
+function createDimensionInvocation(path24, eventName) {
+  return `apex discover --create-dimension ${quoteShellArgument(path24)} --event ${quoteShellArgument(eventName)}`;
+}
+function resolveDimensionObservation(command, report, path24, eventName) {
+  const matches = report.data_layer.flatMap(
+    (event) => event.fields.filter((field) => field.path === path24).map((field) => ({ event, field }))
+  );
+  if (!matches.length) {
+    fail(
+      command,
+      `Path ${JSON.stringify(path24)} was not found in the current discovery report. Run apex discover and copy an observed path exactly.`,
+      EXIT_CODES.validation
+    );
+  }
+  let selected2;
+  if (eventName !== void 0) {
+    const eventMatches = matches.filter((match2) => match2.event.event === eventName);
+    if (!eventMatches.length) {
+      fail(
+        command,
+        `Path ${JSON.stringify(path24)} was not observed on event ${JSON.stringify(eventName)}. Run apex discover and copy the event name exactly.`,
+        EXIT_CODES.validation
+      );
+    }
+    const layers = [...new Set(eventMatches.map((match2) => match2.event.dlName))].sort();
+    if (layers.length > 1) {
+      fail(
+        command,
+        `Path ${JSON.stringify(path24)} on event ${JSON.stringify(eventName)} was observed on multiple data layers: ${layers.join(", ")}. Dimensions bind to one layer; this ambiguity cannot be resolved automatically \u2014 capture the value under one layer, or define the dimension in the dashboard with the data layer name set explicitly.`,
+        EXIT_CODES.validation
+      );
+    }
+    selected2 = eventMatches[0];
+  } else {
+    const namedEvents = [
+      ...new Set(matches.map((match2) => match2.event.event).filter(Boolean))
+    ].sort();
+    if (namedEvents.length > 1) {
+      fail(
+        command,
+        `Path ${JSON.stringify(path24)} was observed on multiple events: ${namedEvents.join(", ")}. Retry with --event <name>.`,
+        EXIT_CODES.validation
+      );
+    }
+    const eventMatches = namedEvents.length ? matches.filter((match2) => match2.event.event === namedEvents[0]) : matches;
+    const layers = [...new Set(eventMatches.map((match2) => match2.event.dlName))].sort();
+    if (layers.length > 1) {
+      fail(
+        command,
+        `Path ${JSON.stringify(path24)} on event ${JSON.stringify(namedEvents[0] ?? "")} was observed on multiple data layers: ${layers.join(", ")}. Dimensions bind to one layer; this ambiguity cannot be resolved automatically \u2014 capture the value under one layer, or define the dimension in the dashboard with the data layer name set explicitly.`,
+        EXIT_CODES.validation
+      );
+    }
+    selected2 = eventMatches[0];
+  }
+  if (!selected2)
+    fail(command, "No matching dimension observation was selected", EXIT_CODES.validation);
+  const eligibility = dimensionEligibility(selected2.event, selected2.field);
+  if (!eligibility.eligible) fail(command, eligibility.message, EXIT_CODES.validation);
+  return {
+    eventName: selected2.event.event,
+    dlName: selected2.event.dlName,
+    field: selected2.field
+  };
+}
 function renderDiscovery(report) {
   const lines = [
     `Observed tracking schema (${report.window.minutes} minutes)`,
@@ -16120,14 +16984,18 @@ function renderDiscovery(report) {
       `
 ${event.event || "(unnamed event)"} [${event.dlName}] \u2014 ${event.count} observation(s)${event.matched ? " \u2014 matched" : ""}; t_ms p50=${event.t_ms_p50 ?? "n/a"}, p95=${event.t_ms_p95 ?? "n/a"}, pre-init=${event.pre_init_count}`
     );
-    for (const path23 of event.paths)
+    for (const path24 of event.paths)
       lines.push(
-        `  URL ${path23.path}: ${path23.pageviews} pageviews, ${path23.count} pushes, ${path23.pspReturn_count} PSP returns`
+        `  URL ${path24.path}: ${path24.pageviews} pageviews, ${path24.count} pushes, ${path24.pspReturn_count} PSP returns`
       );
-    for (const field of event.fields)
+    for (const field of event.fields) {
       lines.push(
         `${field.type_collision ? "  \u26A0 TYPE COLLISION " : field.types.some((type) => /^(?:num)(?::|$)/.test(type)) && field.types.some((type) => /^(?:numstr|numstr_comma)(?::|$)/.test(type)) ? "  INFO numeric representation " : "  "}${field.path}: ${field.types.join(" | ")} (${field.seen})`
       );
+      if (dimensionEligibility(event, field).eligible) {
+        lines.push(`    Create dimension: ${createDimensionInvocation(field.path, event.event)}`);
+      }
+    }
   }
   if (report.trigger_diagnoses.length) {
     lines.push("\n\u26A0 Trigger diagnoses");
@@ -16161,16 +17029,30 @@ ${event.event || "(unnamed event)"} [${event.dlName}] \u2014 ${event.count} obse
   return `${lines.join("\n")}
 `;
 }
-var discoverCommand = new Command("discover").description("Read back the tracking schema observed for the current shop").option("--minutes <n>", "Observation window in minutes").option("--gtm <url-or-id>", "Mine a public page or GTM container locally").option("--gtm-url <url>", "Fetch an explicit GTM container URL, including first-party proxies").action(async function action62(opts) {
+var discoverCommand = new Command("discover").description("Read back the tracking schema observed for the current shop").option("--minutes <n>", "Observation window in minutes").option("--gtm <url-or-id>", "Mine a public page or GTM container locally").option("--gtm-url <url>", "Fetch an explicit GTM container URL, including first-party proxies").option("--create-dimension <path>", "Create a custom dimension from an observed dataLayer path").option("--event <name>", "Select the observed event when a path appears on multiple events").option("--key <signal-key>", "Override the dimension signal key").option("--label <text>", "Override the dimension label").action(async function action63(opts) {
   if (opts.gtm && opts.gtmUrl)
     fail(this, "Use only one of --gtm or --gtm-url", EXIT_CODES.validation);
+  if (opts.createDimension && (opts.gtm || opts.gtmUrl)) {
+    fail(
+      this,
+      "GTM mining cannot be combined with --create-dimension. Run discovery and creation as separate commands.",
+      EXIT_CODES.validation
+    );
+  }
+  if (!opts.createDimension) {
+    const createOnlyFlag = opts.event !== void 0 ? "--event" : opts.key !== void 0 ? "--key" : opts.label !== void 0 ? "--label" : void 0;
+    if (createOnlyFlag)
+      fail(this, `${createOnlyFlag} requires --create-dimension`, EXIT_CODES.validation);
+  }
   const gtmInput = opts.gtmUrl ?? opts.gtm;
   const minutes = minutesValue(opts.minutes) ?? 10080;
   let report;
   let apiSucceeded = false;
+  let discoveryCredentials;
   let apiFailure;
   try {
-    const result = await discoverTrackingSchema(requireCredentials(), minutes);
+    discoveryCredentials = requireCredentials();
+    const result = await discoverTrackingSchema(discoveryCredentials, minutes);
     if (result.ok && result.data) {
       report = result.data;
       apiSucceeded = true;
@@ -16186,7 +17068,7 @@ var discoverCommand = new Command("discover").description("Read back the trackin
       ...error instanceof CliError ? { details: error.details, cliError: error } : {}
     };
   }
-  if (!report && !gtmInput) {
+  if (!report && (!gtmInput || opts.createDimension)) {
     if (apiFailure?.cliError) throw apiFailure.cliError;
     fail(
       this,
@@ -16241,20 +17123,92 @@ var discoverCommand = new Command("discover").description("Read back the trackin
     report.gtm = gtm;
     report.sources.gtm_static = gtm.containers.length > 0;
   }
+  if (opts.createDimension) {
+    if (!apiSucceeded || !discoveryCredentials) {
+      fail(
+        this,
+        apiFailure?.message ?? "Discovery API data is required to create a dimension",
+        classifyStatus(apiFailure?.status ?? 0),
+        apiFailure?.details
+      );
+    }
+    const observation = resolveDimensionObservation(
+      this,
+      report,
+      opts.createDimension,
+      opts.event
+    );
+    const definition = {
+      key: opts.key ?? opts.createDimension.toLowerCase(),
+      label: opts.label ?? defaultDimensionLabel(opts.createDimension),
+      value_type: isNumericField(observation.field) ? "number" : "string",
+      capture: {
+        mode: "data_layer",
+        ...observation.dlName !== "dataLayer" ? { dataLayerName: observation.dlName } : {},
+        eventName: observation.eventName,
+        from: opts.createDimension,
+        persist: true
+      },
+      is_dimension: true
+    };
+    let created;
+    try {
+      created = await createInsight(discoveryCredentials, "signals", definition);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      fail(
+        this,
+        `Dimension was not created: ${message}`,
+        error instanceof CliError ? error.exitCode : EXIT_CODES.general,
+        error instanceof CliError ? error.details : void 0
+      );
+    }
+    if (!created.ok || !created.data) {
+      const reason = created.error ?? "The signals API rejected the request";
+      if (created.status === 409) {
+        fail(
+          this,
+          `Dimension was not created: ${reason} Choose another --key or archive an existing dimension in Audience > Attributes, then retry.`,
+          classifyStatus(created.status),
+          created.errorDetails
+        );
+      }
+      if (created.status === 400) {
+        fail(
+          this,
+          `Dimension was not created: ${reason} Check --create-dimension, --event, --key, and --label, then retry.`,
+          classifyStatus(created.status),
+          created.errorDetails
+        );
+      }
+      fail(
+        this,
+        `Dimension was not created: ${reason}`,
+        classifyStatus(created.status),
+        created.errorDetails
+      );
+    }
+    output(this, { signal: created.data }, () => {
+      process.stdout.write(`Created dimension ${created.data.id}.
+`);
+      process.stdout.write("Next: open Audience > Attributes in the Apex dashboard.\n");
+    });
+    return;
+  }
   output(this, report, () => process.stdout.write(renderDiscovery(report)));
 });
 
 // src/commands/skills.ts
-var import_node_fs22 = __toESM(require("node:fs"));
-var import_node_path20 = __toESM(require("node:path"));
+var import_node_fs23 = __toESM(require("node:fs"));
+var import_node_path21 = __toESM(require("node:path"));
 function packageRoot() {
   const candidates = [
-    import_node_path20.default.resolve(__dirname, ".."),
-    import_node_path20.default.resolve(import_node_path20.default.dirname(process.argv[1] ?? process.cwd()), ".."),
-    import_node_path20.default.resolve(process.cwd(), "packages/cli")
+    import_node_path21.default.resolve(__dirname, ".."),
+    import_node_path21.default.resolve(import_node_path21.default.dirname(process.argv[1] ?? process.cwd()), ".."),
+    import_node_path21.default.resolve(process.cwd(), "packages/cli")
   ];
   for (const candidate of candidates) {
-    if (import_node_fs22.default.existsSync(import_node_path20.default.join(candidate, "AGENTS.md"))) return candidate;
+    if (import_node_fs23.default.existsSync(import_node_path21.default.join(candidate, "AGENTS.md"))) return candidate;
   }
   throw new Error(
     `Apex CLI package files not found. Looked for AGENTS.md in: ${candidates.join(", ")}`
@@ -16263,22 +17217,22 @@ function packageRoot() {
 function skillPaths() {
   const root = packageRoot();
   return {
-    agents: import_node_path20.default.join(root, "AGENTS.md"),
-    skill: import_node_path20.default.join(root, "skills", "apex-cli", "SKILL.md")
+    agents: import_node_path21.default.join(root, "AGENTS.md"),
+    skill: import_node_path21.default.join(root, "skills", "apex-cli", "SKILL.md")
   };
 }
 function installSkill(paths, targetRoot) {
-  const missing = [paths.skill, paths.agents].filter((filePath) => !import_node_fs22.default.existsSync(filePath));
+  const missing = [paths.skill, paths.agents].filter((filePath) => !import_node_fs23.default.existsSync(filePath));
   if (missing.length > 0) {
     throw new Error(`Apex CLI package files not found. Missing: ${missing.join(", ")}`);
   }
-  const target = import_node_path20.default.resolve(targetRoot, "apex-cli");
-  import_node_fs22.default.mkdirSync(target, { recursive: true });
-  import_node_fs22.default.copyFileSync(paths.skill, import_node_path20.default.join(target, "SKILL.md"));
-  import_node_fs22.default.copyFileSync(paths.agents, import_node_path20.default.join(target, "AGENTS.md"));
+  const target = import_node_path21.default.resolve(targetRoot, "apex-cli");
+  import_node_fs23.default.mkdirSync(target, { recursive: true });
+  import_node_fs23.default.copyFileSync(paths.skill, import_node_path21.default.join(target, "SKILL.md"));
+  import_node_fs23.default.copyFileSync(paths.agents, import_node_path21.default.join(target, "AGENTS.md"));
   return target;
 }
-var skillsCommand = new Command("skills").description("Print or install the Apex CLI agent skill files").option("--install", "Copy the Apex CLI skill into ./.claude/skills/apex-cli").option("--target <dir>", "Install target skills directory", ".claude/skills").option("--json", "Print JSON").action(function action63(opts) {
+var skillsCommand = new Command("skills").description("Print or install the Apex CLI agent skill files").option("--install", "Copy the Apex CLI skill into ./.claude/skills/apex-cli").option("--target <dir>", "Install target skills directory", ".claude/skills").option("--json", "Print JSON").action(function action64(opts) {
   let paths;
   try {
     paths = skillPaths();
@@ -16308,7 +17262,7 @@ function switchValue(value) {
   throw new Error("Use on or off");
 }
 var settingsGet = new Command("settings").description("Show platform operator settings").action(async function() {
-  const res = await getAdminSettings(requireCredentials());
+  const res = await getAdminSettings(requireUserCredentials());
   if (!res.ok || !res.data)
     fail(this, res.error ?? "Failed to read settings", classifyStatus(res.status));
   output(
@@ -16340,14 +17294,14 @@ var set5 = new Command("set").description("Set platform kill switches").option("
       `apex admin settings set ${switches} --confirm`
     );
   }
-  const res = await setAdminSettings(requireCredentials(), body5);
+  const res = await setAdminSettings(requireUserCredentials(), body5);
   if (!res.ok || !res.data)
     fail(this, res.error ?? "Failed to update settings", classifyStatus(res.status));
   output(this, res.data, () => console.log("Platform settings updated."));
 });
 settingsGet.addCommand(set5);
 var quarantine = new Command("quarantine").description("List tracking quarantine events").action(async function() {
-  const res = await getAdminQuarantine(requireCredentials());
+  const res = await getAdminQuarantine(requireUserCredentials());
   if (!res.ok || !res.data)
     fail(this, res.error ?? "Failed to read quarantine", classifyStatus(res.status));
   output(
@@ -16364,7 +17318,56 @@ var quarantine = new Command("quarantine").description("List tracking quarantine
     )
   );
 });
-var adminCommand = new Command("admin").description("Operate allowlisted platform controls").addCommand(settingsGet).addCommand(quarantine);
+async function confirmArchive(command, shopId, force) {
+  if (force) return true;
+  if (!process.stdin.isTTY || !process.stdout.isTTY) {
+    confirmationRequired(
+      command,
+      "Archiving a shop requires confirmation in non-TTY mode.",
+      `apex admin shops archive ${JSON.stringify(shopId)} --force`
+    );
+  }
+  const readline3 = await import("node:readline");
+  const rl = readline3.createInterface({ input: process.stdin, output: process.stderr });
+  const answer = await new Promise((resolve) => {
+    rl.question("Archive this shop? Apex delivery will be disabled. [y/N] ", resolve);
+  });
+  rl.close();
+  if (answer.toLowerCase() !== "y") {
+    console.error("Aborted.");
+    return false;
+  }
+  return true;
+}
+var archive2 = new Command("archive").description("Archive a shop and disable Apex delivery").argument("<shopId>", "Shop ID").option("-f, --force", "Skip confirmation").action(async function(shopId, opts) {
+  if (!await confirmArchive(this, shopId, opts.force)) return;
+  const res = await archiveAdminShop(requireUserCredentials(), shopId);
+  if (!res.ok || !res.data)
+    fail(
+      this,
+      res.error ?? "Failed to archive shop",
+      classifyStatus(res.status),
+      res.errorDetails
+    );
+  output(this, res.data, () => console.log("Shop archived."));
+});
+var restore2 = new Command("restore").description("Restore an archived shop").argument("<shopId>", "Shop ID").action(async function(shopId) {
+  const res = await restoreAdminShop(requireUserCredentials(), shopId);
+  if (!res.ok || !res.data)
+    fail(
+      this,
+      res.error ?? "Failed to restore shop",
+      classifyStatus(res.status),
+      res.errorDetails
+    );
+  output(
+    this,
+    res.data,
+    () => console.log("Shop restored. Delivery remains controlled by the kill switch.")
+  );
+});
+var shops = new Command("shops").description("Archive and restore shops on the platform admin plane").addCommand(archive2).addCommand(restore2);
+var adminCommand = new Command("admin").description("Operate allowlisted platform controls").addCommand(settingsGet).addCommand(quarantine).addCommand(shops);
 
 // src/commands/membership.ts
 init_source();
@@ -16408,7 +17411,12 @@ orgCommand.command("update").option("--name <name>").option("--slug <slug>").opt
 orgCommand.command("members").action(async function() {
   await run2(this, listOrgMembers(requireUserCredentials()), "list members");
 });
-orgCommand.command("invite").argument("<email>").option("--role <role>", "Alias for --org-role").option("--org-role <role>", "Organization role", "member").option("--default-shop-role <role>", "Default shop role", "viewer").action(async function(email, o) {
+orgCommand.command("invite").argument("<email>").option("--role <role>", "Alias for --org-role").option("--org-role <role>", "Organization role", "member").addOption(
+  new Option(
+    "--default-shop-role <role>",
+    "Default shop role for every brand in the workspace (workspace defaults are internal roles)"
+  ).choices(["editor"]).default("editor")
+).action(async function(email, o) {
   if (o.role !== void 0) {
     process.stderr.write(
       "Warning: --role is deprecated for apex org invite; use --org-role instead. --role will be removed in v0.7.0.\n"
@@ -16452,7 +17460,12 @@ var teamCommand = new Command("team").description("Manage a shop team");
 teamCommand.command("members").requiredOption("--shop <id>").action(async function(o) {
   await run2(this, listTeamMembers(requireUserCredentials(), o.shop), "list team");
 });
-teamCommand.command("invite").argument("<email>").requiredOption("--shop <id>").requiredOption("--role <role>").action(async function(email, o) {
+teamCommand.command("invite").argument("<email>").requiredOption("--shop <id>").addOption(
+  new Option(
+    "--role <role>",
+    "Role: editor (create and run tests, manage settings, invite people) or client_viewer (view tests, results and pipeline)"
+  ).choices(["editor", "client_viewer"]).makeOptionMandatory()
+).action(async function(email, o) {
   await run2(
     this,
     inviteTeam(requireUserCredentials(), email, o.shop, o.role),
@@ -16466,7 +17479,12 @@ teamCommand.command("revoke-invite").argument("<id>").requiredOption("--shop <id
     "revoke invitation"
   );
 });
-teamCommand.command("set-role").argument("<memberId>").argument("<role>").requiredOption("--shop <id>").action(async function(id, role, o) {
+teamCommand.command("set-role").argument("<memberId>").addArgument(
+  new Argument(
+    "<role>",
+    "Role: editor (create and run tests, manage settings, invite people) or client_viewer (view tests, results and pipeline)"
+  ).choices(["editor", "client_viewer"])
+).requiredOption("--shop <id>").action(async function(id, role, o) {
   await run2(this, setTeamMember(requireUserCredentials(), id, o.shop, role), "set role");
 });
 teamCommand.command("remove").argument("<memberId>").requiredOption("--shop <id>").option("-f, --force").action(async function(id, o) {
@@ -16636,8 +17654,8 @@ async function fetchText(url) {
   });
   return { status: res.status, text: await readResponseText(res), finalUrl: res.url };
 }
-function abs(base, path23) {
-  return new URL(path23, base).toString();
+function abs(base, path24) {
+  return new URL(path24, base).toString();
 }
 function looksLikeShopifyCart(text) {
   try {
@@ -16657,9 +17675,9 @@ async function collectSignals(url) {
   const chunks = [`__apex_primary_status_${primary.status}__`, primary.text];
   const protectedHit = primary.status === 403 || primary.status === 429 || matchDetectionMarkers(primary.text, "protected").length > 0;
   if (!protectedHit) {
-    for (const path23 of ["/cart.js"]) {
+    for (const path24 of ["/cart.js"]) {
       try {
-        const secondary = await fetchText(abs(primary.finalUrl || url, path23));
+        const secondary = await fetchText(abs(primary.finalUrl || url, path24));
         if (secondary.status >= 200 && secondary.status < 300 && looksLikeShopifyCart(secondary.text)) {
           chunks.push("__apex_secondary_shopify_cart_js__", secondary.text.slice(0, 2e3));
         }
@@ -16838,7 +17856,7 @@ function selectedEvents(opts) {
 }
 var list14 = new Command("list").alias("ls").description(
   "List webhooks. JSON includes availableEvents; secrets are never returned after create."
-).action(async function action64() {
+).action(async function action65() {
   const data = await loadWebhookIndex(this);
   output(this, data, () => printWebhooks(data.data));
 });
@@ -16847,7 +17865,7 @@ var create7 = new Command("create").description(`Create a webhook. Prints the si
   "Webhook event to subscribe to; repeat for multiple events",
   (value, previous = []) => [...previous, value],
   []
-).action(async function action65(opts) {
+).action(async function action66(opts) {
   const events = selectedEvents(opts);
   if (events.length === 0) fail(this, "At least one --event is required", EXIT_CODES.validation);
   const index = await loadWebhookIndex(this);
@@ -16879,7 +17897,7 @@ var create7 = new Command("create").description(`Create a webhook. Prints the si
     }
   );
 });
-var remove4 = new Command("delete").alias("rm").description("Delete a webhook").argument("<id>", "Webhook id").action(async function action66(id) {
+var remove4 = new Command("delete").alias("rm").description("Delete a webhook").argument("<id>", "Webhook id").action(async function action67(id) {
   requireShopSecretKey(this);
   const result = handleResult(
     this,
@@ -16888,7 +17906,7 @@ var remove4 = new Command("delete").alias("rm").description("Delete a webhook").
   );
   output(this, result, () => console.log(source_default.green(`Deleted webhook ${id}`)));
 });
-var deliveries = new Command("deliveries").description("List webhook deliveries including failure and disabled state").argument("<id>", "Webhook id").option("--limit <n>", "Maximum deliveries to show", "20").action(async function action67(id, opts) {
+var deliveries = new Command("deliveries").description("List webhook deliveries including failure and disabled state").argument("<id>", "Webhook id").option("--limit <n>", "Maximum deliveries to show", "20").action(async function action68(id, opts) {
   const limit = Number.parseInt(opts.limit, 10);
   if (!Number.isInteger(limit) || limit < 1)
     fail(this, "--limit must be a positive integer", EXIT_CODES.validation);
@@ -16905,7 +17923,7 @@ var update4 = new Command("update").description("Update a webhook URL, events, o
   "Replacement event; repeat for multiple events",
   (value, previous = []) => [...previous, value],
   []
-).option("--active", "Enable the webhook").option("--inactive", "Disable the webhook").action(async function action68(id, opts) {
+).option("--active", "Enable the webhook").option("--inactive", "Disable the webhook").action(async function action69(id, opts) {
   if (opts.active && opts.inactive)
     fail(this, "Use only one of --active or --inactive", EXIT_CODES.validation);
   const events = selectedEvents(opts);
@@ -16938,7 +17956,7 @@ var update4 = new Command("update").description("Update a webhook URL, events, o
   );
   output(this, { webhook: result }, () => printWebhooks([result]));
 });
-var test3 = new Command("test").description("Send a signed test event to a webhook").argument("<id>", "Webhook id").action(async function action69(id) {
+var test3 = new Command("test").description("Send a signed test event to a webhook").argument("<id>", "Webhook id").action(async function action70(id) {
   requireShopSecretKey(this);
   const result = handleResult(
     this,
@@ -16957,10 +17975,10 @@ var webhooksCommand = new Command("webhooks").description("Manage shop webhooks"
 
 // src/commands/simulate.ts
 init_source();
-var import_node_fs23 = __toESM(require("node:fs"));
-var import_node_path21 = __toESM(require("node:path"));
+var import_node_fs24 = __toESM(require("node:fs"));
+var import_node_path22 = __toESM(require("node:path"));
 function readJson2(file) {
-  const text = file === "-" ? import_node_fs23.default.readFileSync(0, "utf8") : import_node_fs23.default.readFileSync(import_node_path21.default.resolve(file), "utf8");
+  const text = file === "-" ? import_node_fs24.default.readFileSync(0, "utf8") : import_node_fs24.default.readFileSync(import_node_path22.default.resolve(file), "utf8");
   try {
     return JSON.parse(text);
   } catch (error) {
@@ -17082,8 +18100,8 @@ var simulateCommand = new Command("simulate").description("Simulate data-layer t
 });
 
 // src/commands/config-resources.ts
-var import_node_fs24 = __toESM(require("node:fs"));
-var import_node_path22 = __toESM(require("node:path"));
+var import_node_fs25 = __toESM(require("node:fs"));
+var import_node_path23 = __toESM(require("node:path"));
 function show(resource) {
   process.stdout.write(`${JSON.stringify(resource, null, 2)}
 `);
@@ -17156,12 +18174,12 @@ function readFamily(family, label) {
 }
 var assetReads = readFamily("assets", "assets");
 var upload = new Command("upload").description("Upload an asset").argument("<file>").action(async function(file) {
-  const absolute = import_node_path22.default.resolve(process.cwd(), file);
-  if (!import_node_fs24.default.existsSync(absolute)) fail(this, `File not found: ${file}`, 3);
-  const fileStat = import_node_fs24.default.statSync(absolute);
+  const absolute = import_node_path23.default.resolve(process.cwd(), file);
+  if (!import_node_fs25.default.existsSync(absolute)) fail(this, `File not found: ${file}`, 3);
+  const fileStat = import_node_fs25.default.statSync(absolute);
   if (!fileStat.isFile()) fail(this, `File not found: ${file}`, 3);
   if (fileStat.size > MAX_ASSET_SIZE_BYTES) fail(this, `${file} is larger than 10 MB`, 3);
-  const mimeType = ASSET_MIME_TYPES[import_node_path22.default.extname(absolute).toLowerCase()];
+  const mimeType = ASSET_MIME_TYPES[import_node_path23.default.extname(absolute).toLowerCase()];
   if (!mimeType)
     fail(
       this,
@@ -17170,8 +18188,8 @@ var upload = new Command("upload").description("Upload an asset").argument("<fil
     );
   const r = await uploadAssets(requireCredentials(), [
     {
-      name: import_node_path22.default.basename(absolute),
-      bytes: import_node_fs24.default.readFileSync(absolute),
+      name: import_node_path23.default.basename(absolute),
+      bytes: import_node_fs25.default.readFileSync(absolute),
       type: mimeType
     }
   ]);