@cowliss/cli 0.1.1 → 0.3.0

package/dist/guest/{driver-BOe7jBFw.js → driver-M6LQVMr2.js}

@@ -1,4 +1,4 @@
-import { a as manifestOutputSchema, i as journeyStepOutputSchema, o as templateRenderOutputSchema, r as guestInputSchema, t as CapabilityError } from "./journeys-CxuS-mHn.js";
+import { a as manifestOutputSchema, i as journeyStepOutputSchema, o as templateRenderOutputSchema, r as guestInputSchema, t as CapabilityError } from "./journeys-BcbIxxI-.js";
 import { z } from "zod";
 import { createElement } from "react";
 import { renderToStaticMarkup } from "react-dom/server.browser";

package/dist/guest/driver.js

@@ -1,3 +1,3 @@
-import { t as runGuest } from "./driver-BOe7jBFw.js";
+import { t as runGuest } from "./driver-M6LQVMr2.js";
 
 export { runGuest };

package/dist/guest/{journeys-CxuS-mHn.js → journeys-BcbIxxI-.js}

@@ -69,19 +69,37 @@ const COW_CONFIG_SCHEMA_URL = `${DOCS_URL}${COW_CONFIG_SCHEMA_PATH}`;
 //#endregion
 //#region ../../packages/shared/src/journeys-v2/config.ts
 /**
-* `cow.json` (spec: Project layout): the org id and nothing more. The
-* folder name is the project's local name, the environment is always a
-* flag, and auth never lives in the project. Strict, so a typo'd key is a
-* build error rather than a silently ignored setting.
+* A project's name: what `cow init` asked for, and what the `projects` row
+* stores. Lives here rather than beside the release DTOs because `cow.json`
+* is the file a developer types it into; `createProjectBodySchema` reuses it.
+*/
+const projectNameSchema = z.string().trim().min(1).max(200);
+/**
+* `cow.json` (spec: Project layout): the org, and which of its projects this
+* directory is. The environment is always a flag, and auth never lives in
+* the project. Strict, so a typo'd key is a build error rather than a
+* silently ignored setting.
 */
 const cowConfigSchema = z.strictObject({
 	$schema: z.url().optional(),
 	orgId: z.string().startsWith(CLERK_ORG_SUBJECT_PREFIX, "orgId must be a Clerk org id"),
+	/**
+	* Which project of the org this directory pushes to. One org can hold
+	* several, one per repo, each with its own release sequence and its own
+	* slice of the deployed journeys, so every project says which it is.
+	*/
+	project: projectNameSchema,
 	/** Overrides the API the CLI talks to; the hosted product needs none. */
-	apiUrl: z.url().optional()
+	apiUrl: z.url().optional(),
+	/**
+	* Overrides the dashboard `cow login` opens. Paired with `apiUrl`: a
+	* login against one Cowliss's dashboard yields a token the other's API
+	* rejects, so a config that names an API names its dashboard too.
+	*/
+	webUrl: z.url().optional()
 }).meta({
 	title: "cow.json",
-	description: "A cow project: the organization it deploys to."
+	description: "A cow project: the organization and the project it deploys to."
 });
 
 //#endregion

package/dist/guest/journeys.js

@@ -1,3 +1,3 @@
-import { n as defineJourney, t as CapabilityError } from "./journeys-CxuS-mHn.js";
+import { n as defineJourney, t as CapabilityError } from "./journeys-BcbIxxI-.js";
 
 export { CapabilityError, defineJourney };

package/dist/guest/wasi.js

@@ -1,4 +1,4 @@
-import { t as runGuest } from "./driver-BOe7jBFw.js";
+import { t as runGuest } from "./driver-M6LQVMr2.js";
 
 //#region src/guest/wasi.ts
 const STDIN = 0;

package/dist/index.js

@@ -7,13 +7,13 @@ import { copyFile, mkdir, readFile, readdir, rm, stat, watch, writeFile } from "
 import { homedir } from "node:os";
 import { basename, dirname, join, relative, resolve, sep } from "node:path";
 import { Command, InvalidArgumentError } from "commander";
-import { existsSync, readFileSync } from "node:fs";
-import { fileURLToPath, pathToFileURL } from "node:url";
 import { execFile, spawn } from "node:child_process";
+import { fileURLToPath, pathToFileURL } from "node:url";
 import { promisify } from "node:util";
 import { MessagePort } from "node:worker_threads";
 import { build, formatMessagesSync } from "esbuild";
 import { create, extract } from "tar";
+import { existsSync, readFileSync } from "node:fs";
 import { createServer } from "node:http";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
 import { createInterface } from "node:readline/promises";
@@ -3802,13 +3802,18 @@ const insertJourneyRunSchema = createInsertSchema(journeyRuns);
 */
 const consentPurposeEnum = pgEnum("consent_purpose", ["emailMarketing", "dataProcessing"]);
 /**
-* Derived journey rows: one per (org, environment, key), rebuilt from the
+* Derived journey rows: one per (org, environment, key), upserted from the
 * manifest inside the deploy transaction. Nothing here is authored through
 * the API, which is why there is no id of its own: the key is the name the
 * author gave the file, and the (org, environment, key) triple is the only
-* identity a journey has. Deleting and reinserting these rows on every
-* deploy is the point, so the row set always matches the environment's
-* current release.
+* identity a journey has.
+*
+* A deploy only ever adds and updates: it owns the keys its release carries
+* and leaves every other row alone, because an org's journeys can come from
+* several projects and a developer may deploy a release holding only some of
+* the files. `projectId` records which project put the row here, which is
+* what makes a key another project owns a refused deploy rather than a silent
+* overwrite. Removing a journey is an explicit delete (ADR 0009).
 *
 * `active` is the author's own rollout gate, flattened from the manifest's
 * `environments` list into this row's environment. The operator's kill
@@ -3823,8 +3828,10 @@ const journeys$1 = pgTable("journeys", {
 	orgId: text("org_id").notNull(),
 	environment: environmentEnum("environment").notNull(),
 	key: text("key").notNull(),
-	/** The release these rows were derived from; the environment's current one. */
+	/** The release this row was derived from; the one its executions run. */
 	releaseId: text("release_id").notNull(),
+	/** The project whose deploy owns this key in this environment. */
+	projectId: text("project_id").notNull(),
 	/** The author's labels, from the manifest; the dashboard's only grouping. */
 	tags: text("tags").array().notNull().default(sql`'{}'::text[]`),
 	trigger: jsonb("trigger").$type().notNull(),
@@ -3932,9 +3939,10 @@ const insertOrgSettingsSchema = createInsertSchema(orgSettings);
 //#region ../../packages/db/src/schema/projects.ts
 /**
 * An org's cow project: the folder a developer runs `cow init` in, and the
-* thing releases belong to. One per org for now (the unique index says so);
-* the row exists rather than hanging releases off the org id directly so
-* many projects per org is additive later without a migration of releases.
+* thing releases belong to. An org may hold several, one per repo, each with
+* its own release sequence, its own current release per environment, and its
+* own slice of the deployed journey rows. The name is how `cow.json` picks
+* one, so it is unique within the org.
 */
 const projects = pgTable("projects", {
 	id: text("id").primaryKey(),
@@ -3942,7 +3950,7 @@ const projects = pgTable("projects", {
 	name: text("name").notNull(),
 	createdAt: createdAt(),
 	updatedAt: updatedAt()
-}, (table) => [uniqueIndex("projects_org_id_unique").on(table.orgId)]);
+}, (table) => [uniqueIndex("projects_org_id_name_unique").on(table.orgId, table.name)]);
 const selectProjectSchema = createSelectSchema(projects);
 const insertProjectSchema = createInsertSchema(projects);
 
@@ -4048,8 +4056,15 @@ const releaseStatusEnum = pgEnum("release_status", [
 * it doubles as the tenancy key.
 *
 * Immutable except for the compile result, which is why there is no
-* `updatedAt`: `compiledAt` and `error` are the only fields that ever move,
-* and they move exactly once.
+* `updatedAt`: `compiledAt`, `error` and `compiledEntries` are the only
+* fields that ever move. The first two move exactly once; `compiledEntries`
+* climbs while the compile runs, because a push is minutes of silence
+* otherwise and the manifest's own length is the denominator.
+*
+* A counter rather than a row per entry: the question both the CLI and the
+* dashboard ask is "how far along", which one integer answers at a fraction
+* of the write volume. Naming which entry is compiling needs per-entry rows
+* and is a different question.
 */
 const releases$1 = pgTable("releases", {
 	id: text("id").primaryKey(),
@@ -4067,7 +4082,9 @@ const releases$1 = pgTable("releases", {
 		mode: "date",
 		precision: 3
 	}),
-	error: text("error")
+	error: text("error"),
+	/** How many manifest entries have compiled and passed their checks. */
+	compiledEntries: integer("compiled_entries").notNull().default(0)
 }, (table) => [uniqueIndex("releases_org_id_project_id_seq_unique").on(table.orgId, table.projectId, table.seq), index("releases_org_id_created_at_idx").on(table.orgId, table.createdAt)]);
 const selectReleaseSchema = createSelectSchema(releases$1);
 const insertReleaseSchema = createInsertSchema(releases$1);
@@ -4087,19 +4104,23 @@ const releaseArtifacts = pgTable("release_artifacts", {
 	table.digest
 ] })]);
 /**
-* Append-only: an environment's current release is its latest row, and
-* rollback is another deployment of an earlier release rather than a
-* mutation. That is what makes the deployment history readable and makes
-* "the last two deployments" the whole of `cow rollback`.
+* Append-only: an environment's current release, for one project, is that
+* project's latest row, and rollback is another deployment of an earlier
+* release rather than a mutation. That is what makes the deployment history
+* readable and makes "the last two deployments" the whole of `cow rollback`.
+*
+* `projectId` is the release's own project, denormalised so "this project's
+* latest deployment in this environment" is one indexed read.
 */
 const deployments$1 = pgTable("deployments", {
 	id: text("id").primaryKey(),
 	orgId: text("org_id").notNull(),
 	environment: environmentEnum("environment").notNull(),
 	releaseId: text("release_id").notNull().references(() => releases$1.id),
+	projectId: text("project_id").notNull().references(() => projects.id),
 	deployedBy: text("deployed_by").notNull(),
 	createdAt: createdAt()
-}, (table) => [index("deployments_org_id_environment_created_at_idx").on(table.orgId, table.environment, table.createdAt)]);
+}, (table) => [index("deployments_org_id_environment_created_at_idx").on(table.orgId, table.environment, table.createdAt), index("deployments_org_id_project_id_environment_created_at_idx").on(table.orgId, table.projectId, table.environment, table.createdAt)]);
 const selectDeploymentSchema = createSelectSchema(deployments$1);
 const insertDeploymentSchema = createInsertSchema(deployments$1);
 
@@ -5282,6 +5303,16 @@ const createSenderDomainBodySchema = z.object({ data: senderDomainInputSchema })
 const updateSenderDomainBodySchema = z.object({ data: z.object({ clickTracking: z.boolean() }) });
 /** `q` is a substring search over the domain string. */
 const listSenderDomainsQuerySchema = paginationQuerySchema.extend({ q: searchQuerySchema });
+/**
+* Where the one-click DNS setup sends the admin, or null when their DNS
+* provider does not offer it. Computed per request (it costs a DNS lookup
+* and two calls to the provider), never stored.
+*/
+const domainDnsSetupSchema = z.object({
+	url: z.url().nullable(),
+	/** The DNS provider's own name for itself, for the button's label. */
+	provider: z.string().nullable()
+});
 
 //#endregion
 //#region ../../packages/shared/src/patterns.ts
@@ -5901,19 +5932,37 @@ const dryRunJourneyBodySchema = z.object({ data: z.object({ profileId: z.string(
 //#endregion
 //#region ../../packages/shared/src/journeys-v2/config.ts
 /**
-* `cow.json` (spec: Project layout): the org id and nothing more. The
-* folder name is the project's local name, the environment is always a
-* flag, and auth never lives in the project. Strict, so a typo'd key is a
-* build error rather than a silently ignored setting.
+* A project's name: what `cow init` asked for, and what the `projects` row
+* stores. Lives here rather than beside the release DTOs because `cow.json`
+* is the file a developer types it into; `createProjectBodySchema` reuses it.
+*/
+const projectNameSchema = z.string().trim().min(1).max(200);
+/**
+* `cow.json` (spec: Project layout): the org, and which of its projects this
+* directory is. The environment is always a flag, and auth never lives in
+* the project. Strict, so a typo'd key is a build error rather than a
+* silently ignored setting.
 */
 const cowConfigSchema = z.strictObject({
 	$schema: z.url().optional(),
 	orgId: z.string().startsWith(CLERK_ORG_SUBJECT_PREFIX, "orgId must be a Clerk org id"),
+	/**
+	* Which project of the org this directory pushes to. One org can hold
+	* several, one per repo, each with its own release sequence and its own
+	* slice of the deployed journeys, so every project says which it is.
+	*/
+	project: projectNameSchema,
 	/** Overrides the API the CLI talks to; the hosted product needs none. */
-	apiUrl: z.url().optional()
+	apiUrl: z.url().optional(),
+	/**
+	* Overrides the dashboard `cow login` opens. Paired with `apiUrl`: a
+	* login against one Cowliss's dashboard yields a token the other's API
+	* rejects, so a config that names an API names its dashboard too.
+	*/
+	webUrl: z.url().optional()
 }).meta({
 	title: "cow.json",
-	description: "A cow project: the organization it deploys to."
+	description: "A cow project: the organization and the project it deploys to."
 });
 
 //#endregion
@@ -6000,7 +6049,9 @@ const projectSchema = selectProjectSchema.extend({
 	updatedAt: z.iso.datetime()
 });
 /** `cow init` names the project after the folder it created. */
-const createProjectBodySchema = z.object({ data: z.object({ name: z.string().trim().min(1).max(200) }) });
+const createProjectBodySchema = z.object({ data: z.object({ name: projectNameSchema }) });
+/** Which project to read: the one the caller's `cow.json` names. */
+const getProjectQuerySchema = z.object({ name: projectNameSchema });
 const artifactDigestParams = z.object({ digest: digestSchema });
 /**
 * Which kind of artifact the uploaded bytes are. Named by the client rather
@@ -6019,16 +6070,30 @@ const putArtifactQuerySchema = z.object({ kind: z.enum(["bundle", "source"]) });
 *
 * `deployedIn` is not a column: it is the environments whose latest
 * deployment names this release, computed on read, so it can never fall out
-* of sync with the append-only deployment log.
+* of sync with the append-only deployment log. Neither is `totalEntries`:
+* the manifest is already here and its journeys plus its templates are the
+* denominator, so storing it beside `compiledEntries` would only invite the
+* two to disagree.
 */
 const releaseSchema = selectReleaseSchema.extend({
 	manifest: z.union([compiledManifestSchema, manifestSchema]),
 	deployedIn: z.array(environmentSchema),
+	/**
+	* How many journeys and templates the manifest holds: the denominator
+	* `compiledEntries` climbs towards, counted on read rather than stored.
+	*/
+	totalEntries: z.number().int(),
 	createdAt: z.iso.datetime(),
 	compiledAt: z.iso.datetime().nullable()
 });
-const createReleaseBodySchema = z.object({ data: z.object({ manifest: manifestSchema }) });
-const listReleasesQuerySchema = paginationQuerySchema;
+const createReleaseBodySchema = z.object({ data: z.object({
+	manifest: manifestSchema,
+	/** The `cow.json` project this push belongs to. */
+	project: projectNameSchema
+}) });
+const listReleasesQuerySchema = paginationQuerySchema.extend({ 
+/** One project's own releases; absent lists the org's. */
+project: projectNameSchema.optional() });
 /**
 * How many live executions the cancel sweep was asked to stop, and the
 * workflow doing the stopping. The count is taken when the request lands, so
@@ -6046,10 +6111,18 @@ const cancelExecutionsSchema = z.object({
 * A deployment, plus the warnings the deploy raised: segment names in
 * triggers and destination names in spines that do not exist in the target
 * environment. They never block, because either may be created afterwards.
+* `left` is the other half of the same conversation: what the deploy did not
+* touch, because a deploy only ever adds and updates (ADR 0009).
 */
 const deploymentSchema = selectDeploymentSchema.extend({
 	createdAt: z.iso.datetime(),
 	warnings: z.array(z.string()),
+	/**
+	* Journeys this project still runs in the environment that the deployed
+	* release does not carry. A deploy never removes one, so these keep running
+	* until someone deletes them; the CLI prints them and says how.
+	*/
+	left: z.array(z.string()),
 	/** The deployed release's per-project sequence number, its human handle. */
 	releaseSeq: z.number().int()
 });
@@ -6057,7 +6130,9 @@ const createDeploymentBodySchema = z.object({ data: z.object({ releaseId: z.stri
 const listDeploymentsQuerySchema = paginationQuerySchema.extend({
 	environment: environmentSchema.optional(),
 	/** One release's own deployment history, across both environments. */
-	release: z.string().trim().min(1).max(200).optional()
+	release: z.string().trim().min(1).max(200).optional(),
+	/** One project's own deployments; absent lists the org's. */
+	project: projectNameSchema.optional()
 });
 
 //#endregion
@@ -6693,94 +6768,6 @@ async function clearCredentials$1(path = defaultCredentialsPath()) {
 	}
 }
 
-//#endregion
-//#region src/lib/config.ts
-const DEFAULT_API_URL = "http://localhost:3400";
-const DEFAULT_WEB_URL = "http://localhost:5273";
-function credentialsPath(env) {
-	return env.COW_CREDENTIALS_PATH ?? defaultCredentialsPath();
-}
-function readCredentials(env) {
-	return readCredentials$1(credentialsPath(env));
-}
-function writeCredentials(env, credentials) {
-	return writeCredentials$1(credentialsPath(env), credentials).then(() => credentialsPath(env));
-}
-function clearCredentials(env) {
-	return clearCredentials$1(credentialsPath(env));
-}
-/**
-* The token every command sends, and where it came from. Precedence:
-* `COW_DEPLOY_KEY` > `COW_TOKEN` > the cached login. The deploy key wins
-* because a machine that has one is CI (or a long-running `cow dev`), and a
-* stale session left in `~/.cow` on that machine must not quietly become the
-* credential a pipeline runs as. `COW_TOKEN` is a session token handed over
-* explicitly, so it reports as one and outranks the cached file.
-*
-* A deploy key only reaches the release lifecycle, so a `cow users list` on
-* a box that exports one answers 401 rather than falling back to the
-* session. That is the honest failure: the two credentials are different
-* identities, and silently switching between them per command is how a
-* pipeline ends up passing locally and failing in CI.
-*/
-function resolveCredential(env, credentials) {
-	if (env.COW_DEPLOY_KEY) return {
-		token: env.COW_DEPLOY_KEY,
-		kind: "deployKey"
-	};
-	if (env.COW_TOKEN) return {
-		token: env.COW_TOKEN,
-		kind: "session"
-	};
-	if (credentials?.token) return {
-		token: credentials.token,
-		kind: "session"
-	};
-	return {
-		token: null,
-		kind: "none"
-	};
-}
-/** Precedence: --api flag > env > credentials (from login) > default. */
-function resolveApiUrl(env, credentials, flag) {
-	return flag ?? env.COW_API_URL ?? credentials?.apiUrl ?? "http://localhost:3400";
-}
-/**
-* Decode a JWT payload without verification. Display only: the API is the
-* verifier; the CLI just shows what it is about to send.
-*/
-function decodeTokenPayload(token) {
-	const parts = token.split(".");
-	if (parts.length !== 3) return null;
-	try {
-		const json = Buffer.from(parts[1] ?? "", "base64url").toString("utf8");
-		const payload = JSON.parse(json);
-		if (typeof payload !== "object" || payload === null) return null;
-		return payload;
-	} catch {
-		return null;
-	}
-}
-function decodeSessionToken(token) {
-	const payload = decodeTokenPayload(token);
-	if (!payload) return null;
-	const o = payload.o;
-	return {
-		userId: typeof payload.sub === "string" ? payload.sub : null,
-		orgId: o && typeof o === "object" && typeof o.id === "string" ? o.id : typeof payload.org_id === "string" ? payload.org_id : null,
-		role: o && typeof o === "object" && typeof o.rol === "string" ? `org:${o.rol}` : typeof payload.org_role === "string" ? payload.org_role : null,
-		expiresAt: typeof payload.exp === "number" ? (/* @__PURE__ */ new Date(payload.exp * 1e3)).toISOString() : null
-	};
-}
-
-//#endregion
-//#region src/lib/package.ts
-let cached;
-function readCliPackage() {
-	cached ??= readFile(new URL(import.meta.resolve("@cowliss/cli/package.json")), "utf8").then((text) => JSON.parse(text));
-	return cached;
-}
-
 //#endregion
 //#region ../../packages/shared/src/stable-json.ts
 /**
@@ -6824,6 +6811,14 @@ function manifestDigestOf(manifest) {
 	return digestOf(stableJson(manifest));
 }
 
+//#endregion
+//#region src/lib/package.ts
+let cached;
+function readCliPackage() {
+	cached ??= readFile(new URL(import.meta.resolve("@cowliss/cli/package.json")), "utf8").then((text) => JSON.parse(text));
+	return cached;
+}
+
 //#endregion
 //#region src/build/index.ts
 /**
@@ -6836,7 +6831,12 @@ const execFileAsync$1 = promisify(execFile);
 /** Where build output lives, relative to the project root. */
 const BUILD_DIR = join(".cow", "build");
 const TYPES_FILE = join(".cow", "types.d.ts");
-/** The config files the source tarball carries besides `journeys/` and `emails/`. */
+/**
+* The config files the source tarball carries besides `journeys/` and
+* `emails/`. Always the committed `cow.json`, never a `--config` override: a
+* release records the project as the repo declares it, not the local file
+* whoever pushed happened to point at.
+*/
 const CONFIG_FILES$1 = [
 	"cow.json",
 	"package.json",
@@ -7212,18 +7212,54 @@ async function writeSourceTarball(projectDir, outFile) {
 	}, files);
 	return (await stat(outFile)).size;
 }
-/** The project's cow.json; throws unless `projectDir` holds a valid one. */
+/** The project config a checkout carries by default. */
+const DEFAULT_CONFIG_FILE = "cow.json";
+/**
+* Which project config every command in this process reads. Resolved once
+* from `--config`/`COW_CONFIG` at startup rather than threaded through nine
+* call sites: the CLI is one shot, and the answer cannot change mid-run.
+*/
+let configFile = DEFAULT_CONFIG_FILE;
+function setConfigFile(name) {
+	configFile = name;
+}
+function projectConfigFile() {
+	return configFile;
+}
+/** The project's config; throws unless `projectDir` holds a valid one. */
 async function assertCowConfig(projectDir) {
+	const name = projectConfigFile();
 	let text;
 	try {
-		text = await readFile(join(projectDir, "cow.json"), "utf8");
+		text = await readFile(join(projectDir, name), "utf8");
 	} catch {
-		throw new Error(`No cow.json in "${projectDir}". Run \`cow init\` to create a project.`);
+		throw new Error(name === "cow.json" ? `No ${name} in "${projectDir}". Run \`cow init\` to create a project.` : `No ${name} in "${projectDir}". That file was selected with --config or COW_CONFIG.`);
 	}
 	const parsed = cowConfigSchema.safeParse(JSON.parse(text));
-	if (!parsed.success) throw new Error(`cow.json is invalid: ${parsed.error.issues.map((issue) => `${issue.path.join(".") || "(root)"}: ${issue.message}`).join("; ")}`);
+	if (!parsed.success) throw new Error(`${name} is invalid: ${parsed.error.issues.map((issue) => `${issue.path.join(".") || "(root)"}: ${issue.message}`).join("; ")}`);
 	return parsed.data;
 }
+/** The project's config, or null when this directory has none. */
+async function readCowConfig(projectDir) {
+	try {
+		return await assertCowConfig(projectDir);
+	} catch {
+		return null;
+	}
+}
+/**
+* Which project of the org this directory belongs to: the `project` in its
+* `cow.json`, or undefined when there is no `cow.json` here at all. The
+* undefined case is `cow pull` into an empty directory, which has no project
+* to scope by yet and reads the org's releases.
+*/
+async function configuredProject(projectDir) {
+	try {
+		return (await assertCowConfig(projectDir)).project;
+	} catch {
+		return;
+	}
+}
 /**
 * Builds the project at `projectDir`. Writes `.cow/types.d.ts` first (the
 * typecheck needs it), then the bundles and the source tarball, and
@@ -7332,6 +7368,95 @@ async function buildIfStale(projectDir) {
 	if ((await Promise.all(sources.map((file) => stat(join(projectDir, file)).then((stats) => stats.mtimeMs, () => 0)))).some((time) => time > builtAt)) await buildProject(projectDir);
 }
 
+//#endregion
+//#region src/lib/config.ts
+const DEFAULT_API_URL = "http://localhost:3400";
+const DEFAULT_WEB_URL = "http://localhost:5273";
+function credentialsPath(env) {
+	return env.COW_CREDENTIALS_PATH ?? defaultCredentialsPath();
+}
+function readCredentials(env) {
+	return readCredentials$1(credentialsPath(env));
+}
+function writeCredentials(env, credentials) {
+	return writeCredentials$1(credentialsPath(env), credentials).then(() => credentialsPath(env));
+}
+function clearCredentials(env) {
+	return clearCredentials$1(credentialsPath(env));
+}
+/**
+* The token every command sends, and where it came from. Precedence:
+* `COW_DEPLOY_KEY` > `COW_TOKEN` > the cached login. The deploy key wins
+* because a machine that has one is CI (or a long-running `cow dev`), and a
+* stale session left in `~/.cow` on that machine must not quietly become the
+* credential a pipeline runs as. `COW_TOKEN` is a session token handed over
+* explicitly, so it reports as one and outranks the cached file.
+*
+* A deploy key only reaches the release lifecycle, so a `cow users list` on
+* a box that exports one answers 401 rather than falling back to the
+* session. That is the honest failure: the two credentials are different
+* identities, and silently switching between them per command is how a
+* pipeline ends up passing locally and failing in CI.
+*/
+function resolveCredential(env, credentials) {
+	if (env.COW_DEPLOY_KEY) return {
+		token: env.COW_DEPLOY_KEY,
+		kind: "deployKey"
+	};
+	if (env.COW_TOKEN) return {
+		token: env.COW_TOKEN,
+		kind: "session"
+	};
+	if (credentials?.token) return {
+		token: credentials.token,
+		kind: "session"
+	};
+	return {
+		token: null,
+		kind: "none"
+	};
+}
+/**
+* Precedence: `--api` flag > env > the project config > credentials (from
+* login) > default.
+*
+* The project's own `apiUrl` outranks the credentials file because it is the
+* more specific answer: `cow.json` says where this project deploys, while the
+* credentials only remember where somebody last logged in. Without it a
+* checkout whose config names production silently fell through to
+* `DEFAULT_API_URL`, which is how a production deploy reaches localhost.
+*/
+function resolveApiUrl(env, credentials, flag, projectApiUrl) {
+	return flag ?? env.COW_API_URL ?? projectApiUrl ?? credentials?.apiUrl ?? "http://localhost:3400";
+}
+/**
+* Decode a JWT payload without verification. Display only: the API is the
+* verifier; the CLI just shows what it is about to send.
+*/
+function decodeTokenPayload(token) {
+	const parts = token.split(".");
+	if (parts.length !== 3) return null;
+	try {
+		const json = Buffer.from(parts[1] ?? "", "base64url").toString("utf8");
+		const payload = JSON.parse(json);
+		if (typeof payload !== "object" || payload === null) return null;
+		return payload;
+	} catch {
+		return null;
+	}
+}
+function decodeSessionToken(token) {
+	const payload = decodeTokenPayload(token);
+	if (!payload) return null;
+	const o = payload.o;
+	return {
+		userId: typeof payload.sub === "string" ? payload.sub : null,
+		orgId: o && typeof o === "object" && typeof o.id === "string" ? o.id : typeof payload.org_id === "string" ? payload.org_id : null,
+		role: o && typeof o === "object" && typeof o.rol === "string" ? `org:${o.rol}` : typeof payload.org_role === "string" ? payload.org_role : null,
+		expiresAt: typeof payload.exp === "number" ? (/* @__PURE__ */ new Date(payload.exp * 1e3)).toISOString() : null
+	};
+}
+
 //#endregion
 //#region src/commands/add.ts
 /**
@@ -7408,7 +7533,7 @@ async function login(env, options) {
 	if (options.token !== void 0) {
 		token = options.token.trim();
 		if (decodeTokenPayload(token) === null) throw new Error("The provided --token value is not a JWT");
-	} else token = await collectTokenViaBrowser(options.webUrl ?? env.COW_WEB_URL ?? "http://localhost:5273", 3e5, options.noOpen === true);
+	} else token = await collectTokenViaBrowser(options.webUrl ?? env.COW_WEB_URL ?? (await readCowConfig(process.cwd()))?.webUrl ?? "http://localhost:5273", 3e5, options.noOpen === true);
 	const claims = decodeSessionToken(token);
 	if (claims === null) throw new Error("Token is not a decodable JWT");
 	if (claims.userId === null) throw new Error("Token has no subject claim. Is it a Clerk session token?");
@@ -7448,7 +7573,14 @@ function collectTokenViaBrowser(webUrl, timeoutMs = 18e4, noOpen = false) {
 				clearTimeout(timer);
 				try {
 					const body = JSON.parse(Buffer.concat(chunks).toString("utf8"));
-					const token = typeof body === "object" && body !== null && "token" in body ? body.token : void 0;
+					const field = (name) => typeof body === "object" && body !== null && name in body ? body[name] : void 0;
+					if (field("denied") === true) {
+						res.writeHead(200, { "Content-Type": "application/json" });
+						res.end(JSON.stringify({ ok: true }));
+						reject(/* @__PURE__ */ new Error("Sign-in was denied in the browser. No access was granted."));
+						return;
+					}
+					const token = field("token");
 					if (typeof token !== "string" || token.length === 0) {
 						res.writeHead(400, { "Content-Type": "application/json" });
 						res.end(JSON.stringify({ error: "missing token" }));
@@ -7495,7 +7627,7 @@ function openBrowser(url) {
 //#region src/commands/auth.ts
 /** login/logout/whoami: session-token management, no contract route. */
 function registerAuth(program, env, io) {
-	program.command("login").description("authenticate via the dashboard browser flow (or --token) and cache the session token").option("--token <jwt>", "paste a Clerk session token instead of the browser flow").option("--web <url>", `dashboard URL (default ${DEFAULT_WEB_URL})`).option("--no-open", "do not open the browser; print the URL and wait (headless/agent use)").action(async (opts) => {
+	program.command("login").description("authenticate via the dashboard browser flow (or --token) and cache the session token").option("--token <jwt>", "paste a Clerk session token instead of the browser flow").option("--web <url>", `dashboard URL; overrides COW_WEB_URL and webUrl in the project config (default ${DEFAULT_WEB_URL})`).option("--no-open", "do not open the browser; print the URL and wait (headless/agent use)").action(async (opts) => {
 		const outcome = await login(env, {
 			token: opts.token,
 			webUrl: opts.web,
@@ -8544,6 +8676,21 @@ const domains = defineModule(defineRoute({
 		...sessionErrors,
 		...errors("conflict", "validation_failed", "malformed_request", "dependency_unavailable")
 	}
+}), defineRoute({
+	method: "get",
+	path: "/v1/domains/{id}/dns-setup",
+	operationId: "domains.dnsSetup",
+	tags: ["domains"],
+	summary: "Where the DNS provider can publish the records",
+	description: "The Domain Connect link for this domain's DNS provider, which shows the admin the records and asks them to confirm. `url` is null when the provider does not support it.",
+	security: SESSION_AUTH,
+	surfaces: HIDDEN_FROM_TOOLS,
+	request: { params: params$7 },
+	responses: {
+		200: envelope(domainDnsSetupSchema),
+		...sessionErrors,
+		...errors("not_found")
+	}
 }), defineRoute({
 	method: "post",
 	path: "/v1/domains/{id}/verify",
@@ -8879,6 +9026,19 @@ const journeys = defineModule(defineRoute({
 		...sessionErrors,
 		...errors("not_found", "validation_failed", "malformed_request")
 	}
+}), defineRoute({
+	method: "delete",
+	path: "/v1/journeys/{key}",
+	operationId: "journeys.delete",
+	tags: ["journeys"],
+	summary: "Remove a journey from the selected environment",
+	security: SESSION_AUTH,
+	request: { params: params$5 },
+	responses: {
+		200: envelope(deletedSchema),
+		...sessionErrors,
+		...errors("not_found")
+	}
 }), defineRoute({
 	method: "post",
 	path: "/v1/journeys/{key}/dry-run",
@@ -8900,28 +9060,29 @@ const journeys = defineModule(defineRoute({
 //#endregion
 //#region ../../packages/shared/src/contract/project.ts
 /**
-* The org's project. Singular in the path on purpose: an org has exactly one
-* for now, so there is no id to put in a URL, and many projects per org is a
-* later, additive change (the `projects` row already exists so it can be).
+* The org's project. Singular in the path on purpose: a caller always means
+* one, the one its `cow.json` names, so the name is a query parameter and
+* there is no id to put in a URL. An org with a single project needs neither.
 */
 const project = defineModule(defineRoute({
 	method: "get",
 	path: "/v1/project",
 	operationId: "project.get",
 	tags: ["project"],
-	summary: "Get the organization's project",
+	summary: "Get one of the organization's projects",
 	security: RELEASE_AUTH,
+	request: { query: getProjectQuerySchema },
 	responses: {
 		200: envelope(projectSchema),
 		...sessionErrors,
-		...errors("project_missing")
+		...errors("project_missing", "validation_failed", "malformed_request")
 	}
 }), defineRoute({
 	method: "post",
 	path: "/v1/project",
 	operationId: "project.create",
 	tags: ["project"],
-	summary: "Create the organization's project",
+	summary: "Create a project in the organization",
 	security: RELEASE_AUTH,
 	request: { body: jsonBody(createProjectBodySchema) },
 	responses: {
@@ -9987,18 +10148,19 @@ const POLL_BUDGET_MS = RELEASE_COMPILE_TIMEOUT_MS + 6e4;
 const POLL_START_MS = 250;
 const POLL_MAX_MS = 2e3;
 /**
-* The org's project, created when it has none. `cow init` usually got there
-* first; a project pushed from a machine that only ever cloned the repo has
-* not, and creating it here is what makes that clone work.
+* This directory's project, created when the org has none by that name.
+* `cow init` usually got there first; a project pushed from a machine that
+* only ever cloned the repo has not, and creating it here is what makes that
+* clone work. The name is `cow.json`'s `project`.
 */
-async function ensureProject(client, projectDir) {
+async function ensureProject(client, name) {
 	try {
-		return (await client.request(contract.project["project.get"])).data;
+		return (await client.request(contract.project["project.get"], { query: { name } })).data;
 	} catch (error) {
 		if (!(error instanceof ApiError) || error.code !== "project_missing") throw error;
 	}
 	try {
-		return (await client.request(contract.project["project.create"], { body: { name: basename(projectDir) } })).data;
+		return (await client.request(contract.project["project.create"], { body: { name } })).data;
 	} catch (error) {
 		const reason = error instanceof Error ? error.message : String(error);
 		throw new Error(`This organization has no project and one could not be created (${reason}). Run \`cow init\` first.`);
@@ -10035,33 +10197,72 @@ function artifactFiles(projectDir, manifest) {
 		}
 	];
 }
-/** The most recent release, or null when the project has none yet. */
-async function latestRelease(client) {
-	return (await client.request(contract.releases["releases.list"], { query: { limit: 1 } })).data[0] ?? null;
+/**
+* This project's most recent release, or null when it has none yet. Scoped to
+* the project because a sibling repo's push must not make this one look
+* unchanged, or changed.
+*/
+async function latestRelease(client, project) {
+	return (await client.request(contract.releases["releases.list"], { query: {
+		limit: 1,
+		project
+	} })).data[0] ?? null;
+}
+/**
+* How far a compile has got, as `18/26`. Only meaningful while the release is
+* pending: a `ready` release can legitimately sit below its total (every row
+* from before the counter existed reads 0, and the last progress write is
+* advisory), so completion is read from the status, never from this.
+*/
+function compiledFraction(release) {
+	return `${release.compiledEntries}/${release.totalEntries}`;
+}
+/**
+* The progress writer for a terminal, or nothing at all when there is no one
+* watching. It rewrites one line on stderr, so what a command prints to
+* stdout is the same bytes whether or not a terminal is attached.
+*
+* The flag is stdout's: a redirected push is a script reading the summary,
+* and it gets no cursor codes in either stream. `--json` is silent for the
+* same reason, since its whole output is one envelope.
+*/
+function progressLineFor(io, json) {
+	if (!io.isTTY || json === true) return;
+	let drawn = false;
+	return (text) => {
+		if (text === "" && !drawn) return;
+		drawn = text !== "";
+		io.stderr(`\r\x1b[2K${text}`);
+	};
 }
 /**
 * Poll until the compile settles. Backs off from a quarter second to two,
 * because a small project is ready almost at once and a large one is not
 * worth asking about ten times a second.
 */
-async function awaitCompile(client, releaseId, sleep) {
+async function awaitCompile(client, releaseId, sleep, progress) {
 	let waited = 0;
 	let interval = POLL_START_MS;
-	for (;;) {
-		const { data } = await client.request(contract.releases["releases.get"], { params: { id: releaseId } });
-		if (data.status !== "pending") return data;
-		if (waited >= POLL_BUDGET_MS) throw new Error(`Release ${releaseId} is still compiling after ${Math.round(waited / 1e3)}s. Check \`cow releases get ${releaseId}\`.`);
-		await sleep(interval);
-		waited += interval;
-		interval = Math.min(interval * 2, POLL_MAX_MS);
+	try {
+		for (;;) {
+			const { data } = await client.request(contract.releases["releases.get"], { params: { id: releaseId } });
+			if (data.status !== "pending") return data;
+			if (waited >= POLL_BUDGET_MS) throw new Error(`Release ${releaseId} is still compiling after ${Math.round(waited / 1e3)}s (${compiledFraction(data)} compiled). Check \`cow releases get ${releaseId}\`.`);
+			progress?.(`Compiling ${compiledFraction(data)}`);
+			await sleep(interval);
+			waited += interval;
+			interval = Math.min(interval * 2, POLL_MAX_MS);
+		}
+	} finally {
+		progress?.("");
 	}
 }
-async function pushProject({ client, projectDir, force, sleep = (ms) => setTimeout$1(ms) }) {
+async function pushProject({ client, projectDir, force, sleep = (ms) => setTimeout$1(ms), progress }) {
 	const { manifest, config } = await buildProject(projectDir);
-	const project = await ensureProject(client, projectDir);
+	const project = await ensureProject(client, config.project);
 	if (project.orgId !== config.orgId) throw new Error(`cow.json is for ${config.orgId} but the credential belongs to ${project.orgId}. Log in to that organization, or use its deploy key.`);
 	const digest = manifestDigestOf(manifest);
-	const latest = await latestRelease(client);
+	const latest = await latestRelease(client, project.name);
 	if (latest && latest.manifestDigest === digest && !force) return {
 		release: latest,
 		uploaded: [],
@@ -10078,7 +10279,10 @@ async function pushProject({ client, projectDir, force, sleep = (ms) => setTimeo
 		uploaded.push(artifact.digest);
 	}
 	return {
-		release: await awaitCompile(client, (await client.request(contract.releases["releases.create"], { body: { manifest } })).data.id, sleep),
+		release: await awaitCompile(client, (await client.request(contract.releases["releases.create"], { body: {
+			manifest,
+			project: project.name
+		} })).data.id, sleep, progress),
 		uploaded
 	};
 }
@@ -10099,7 +10303,8 @@ function registerPush(program, clientFor, io) {
 		const outcome = await pushProject({
 			client: await clientFor(merged),
 			projectDir: process.cwd(),
-			force: opts.force === true
+			force: opts.force === true,
+			progress: progressLineFor(io, merged.json === true)
 		});
 		if (merged.json === true) emit({ data: outcome.release }, io, true);
 		else io.stdout(`${pushSummary(outcome)}\n`);
@@ -10110,7 +10315,7 @@ function registerPush(program, clientFor, io) {
 //#endregion
 //#region src/commands/deploy.ts
 /** The release to deploy, and the push message when a push produced it. */
-async function releaseToDeploy({ client, projectDir, releaseId, sleep }) {
+async function releaseToDeploy({ client, projectDir, releaseId, sleep, progress }) {
 	if (releaseId) {
 		const { data } = await client.request(contract.releases["releases.get"], { params: { id: releaseId } });
 		return { release: data };
@@ -10118,7 +10323,8 @@ async function releaseToDeploy({ client, projectDir, releaseId, sleep }) {
 	const pushed = await pushProject({
 		client,
 		projectDir,
-		sleep
+		sleep,
+		progress
 	});
 	return {
 		release: pushed.release,
@@ -10127,7 +10333,7 @@ async function releaseToDeploy({ client, projectDir, releaseId, sleep }) {
 }
 async function deployProject(options) {
 	const { release, skipped } = await releaseToDeploy(options);
-	if (release.status !== "ready") throw new Error(release.status === "failed" ? `${release.id} #${release.seq} failed to compile, so there is nothing to deploy: ${release.error ?? "no reason recorded"}` : `${release.id} #${release.seq} is still compiling; wait for it to be ready.`);
+	if (release.status !== "ready") throw new Error(release.status === "failed" ? `${release.id} #${release.seq} failed to compile, so there is nothing to deploy: ${release.error ?? "no reason recorded"}` : `${release.id} #${release.seq} is still compiling (${compiledFraction(release)} compiled); wait for it to be ready.`);
 	const { data } = await options.client.request(contract.deployments["deployments.create"], { body: { releaseId: release.id } });
 	return {
 		deployment: data,
@@ -10141,6 +10347,7 @@ function deploySummary(outcome) {
 	const lines = [`${release.id} #${release.seq} deployed to ${deployment.environment}.`];
 	if (outcome.skipped) lines.unshift(outcome.skipped);
 	for (const warning of deployment.warnings) lines.push(`Warning: ${warning}`);
+	if (deployment.left.length > 0) lines.push(`Still running, not in this release: ${deployment.left.join(", ")}. Remove one with \`cow journeys delete <key> --env ${deployment.environment}\`.`);
 	return lines.join("\n");
 }
 function registerDeploy(program, clientFor, env, io) {
@@ -10153,7 +10360,8 @@ function registerDeploy(program, clientFor, env, io) {
 		const outcome = await deployProject({
 			client: await clientFor(merged),
 			projectDir: process.cwd(),
-			releaseId: opts.release
+			releaseId: opts.release,
+			progress: progressLineFor(io, merged.json === true)
 		});
 		if (merged.json === true) {
 			emit({ data: outcome.deployment }, io, true);
@@ -10542,7 +10750,8 @@ function registerInit(program, env, io) {
 		if (orgId === "") throw new Error("No organization id. Pass --org org_… or run `cow login` first.");
 		const config = cowConfigSchema.parse({
 			$schema: COW_CONFIG_SCHEMA_URL,
-			orgId
+			orgId,
+			project: name
 		});
 		const contents = {
 			"cow.json": json(config),
@@ -10752,12 +10961,17 @@ function noGitHere(error) {
 	const failure = error;
 	return failure.code === "ENOENT" || String(failure.stderr ?? "").includes("not a git repository");
 }
-/** The release to restore: the one named, the one an environment runs, else the newest that compiled. */
-async function resolveRelease(client, releaseId, environment) {
+/**
+* The release to restore: the one named, the one an environment runs, else the
+* newest that compiled. Scoped to this directory's project, so a sibling
+* repo's release is never unpacked over this one's files.
+*/
+async function resolveRelease(client, releaseId, environment, project) {
 	if (releaseId) return (await client.request(contract.releases["releases.get"], { params: { id: releaseId } })).data;
 	if (environment) {
 		const current = (await client.request(contract.deployments["deployments.list"], { query: {
 			environment,
+			project,
 			limit: 1
 		} })).data[0];
 		if (!current) throw new Error(`Nothing has been deployed to ${environment}, so there is no release to restore. Name one with --release.`);
@@ -10767,7 +10981,8 @@ async function resolveRelease(client, releaseId, environment) {
 	do {
 		const page = await client.request(contract.releases["releases.list"], { query: {
 			limit: PAGE_SIZE,
-			cursor
+			cursor,
+			project
 		} });
 		const ready = page.data.find((release) => release.status === "ready");
 		if (ready) return ready;
@@ -10776,7 +10991,7 @@ async function resolveRelease(client, releaseId, environment) {
 	throw new Error("This organization has no release that compiled successfully. Run `cow push` first, or name one with --release.");
 }
 async function pullRelease({ client, projectDir, releaseId, environment, force }) {
-	const release = await resolveRelease(client, releaseId, environment);
+	const release = await resolveRelease(client, releaseId, environment, await configuredProject(projectDir));
 	if (!force) {
 		const dirty = await dirtyPaths(projectDir);
 		if (dirty.length > 0) throw new Error(`This working tree has uncommitted changes and \`cow pull\` would write over them:\n  ${dirty.join("\n  ")}\nCommit or stash them, or pass --force.`);
@@ -10820,9 +11035,10 @@ function registerPull(program, clientFor, env, io) {
 
 //#endregion
 //#region src/commands/rollback.ts
-async function rollbackEnvironment({ client, environment }) {
+async function rollbackEnvironment({ client, environment, project }) {
 	const [current, previous] = (await client.request(contract.deployments["deployments.list"], { query: {
 		environment,
+		project,
 		limit: 2
 	} })).data;
 	if (!current) throw new Error(`Nothing has been deployed to ${environment} yet, so there is nothing to roll back.`);
@@ -10849,7 +11065,8 @@ function registerRollback(program, clientFor, env, io) {
 		};
 		const outcome = await rollbackEnvironment({
 			client: await clientFor(merged),
-			environment: requireEnvironment(env, merged)
+			environment: requireEnvironment(env, merged),
+			project: await configuredProject(process.cwd())
 		});
 		if (merged.json === true) {
 			emit({ data: outcome.deployment }, io, true);
@@ -11146,11 +11363,15 @@ function emit(result, io, json) {
 }
 function buildProgram(env, io) {
 	const program = new Command();
-	program.name("cow").description("Admin CLI for Cowliss: a thin client of the dashboard API").option("--api <url>", "API base URL (overrides env and saved config)").option("--env <environment>", `environment to act on: ${ENVIRONMENTS.join(" | ")} (overrides COW_ENVIRONMENT; default ${DEFAULT_ENVIRONMENT})`, parseEnvironment).option("--json", "force compact single-line JSON output");
+	program.name("cow").description("Admin CLI for Cowliss: a thin client of the dashboard API").option("--api <url>", "API base URL (overrides env and saved config)").option("--env <environment>", `environment to act on: ${ENVIRONMENTS.join(" | ")} (overrides COW_ENVIRONMENT; default ${DEFAULT_ENVIRONMENT})`, parseEnvironment).option("--json", "force compact single-line JSON output").option("--config <file>", `project config to read instead of ${DEFAULT_CONFIG_FILE} (overrides COW_CONFIG)`);
+	program.hook("preAction", () => {
+		const flag = program.opts().config;
+		setConfigFile((typeof flag === "string" ? flag : void 0) ?? env.COW_CONFIG ?? "cow.json");
+	});
 	const clientFor = async (opts) => {
 		const credentials = await readCredentials(env);
 		return createClient({
-			baseUrl: resolveApiUrl(env, credentials, typeof opts.api === "string" ? opts.api : void 0),
+			baseUrl: resolveApiUrl(env, credentials, typeof opts.api === "string" ? opts.api : void 0, (await readCowConfig(process.cwd()))?.apiUrl),
 			auth: async () => resolveCredential(env, await readCredentials(env)).token,
 			headers: async () => ({
 				[ENVIRONMENT_HEADER]: environmentFor(env, opts),
@@ -11195,7 +11416,13 @@ const envSchema = z.object({
 	/** An org deploy key for CI; when set it wins over the cached session (ticket 05 reads it). */
 	COW_DEPLOY_KEY: z.string().min(1).optional(),
 	/** The environment admin calls select; `--env` overrides it, production is the default. */
-	COW_ENVIRONMENT: environmentSchema.optional()
+	COW_ENVIRONMENT: environmentSchema.optional(),
+	/**
+	* The project config to read instead of `cow.json`, so one checkout can
+	* hold both the committed production config and a local override.
+	* `--config` overrides it.
+	*/
+	COW_CONFIG: z.string().min(1).optional()
 });
 function loadEnv() {
 	const parsed = envSchema.safeParse(process.env);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cowliss/cli",
-  "version": "0.1.1",
+  "version": "0.3.0",
   "type": "module",
   "bin": {
     "cow": "./dist/index.js"