@cowliss/cli 0.11.0 → 0.13.0

package/dist/guest/{driver-B_pjmy5g.js → driver-BtQYaFXP.js}

@@ -1,4 +1,4 @@
-import { n as journeyStepOutputSchema, r as manifestOutputSchema, t as guestInputSchema } from "./journeys-v2-Djgs8U91.js";
+import { n as journeyStepOutputSchema, r as manifestOutputSchema, t as guestInputSchema } from "./journeys-v2-Cndh4CAr.js";
 import { CapabilityError } from "./journeys.js";
 import { z } from "zod";
 

package/dist/guest/driver-emails.js

@@ -1,6 +1,6 @@
-import { i as templateRenderOutputSchema, t as guestInputSchema } from "./journeys-v2-Djgs8U91.js";
+import { i as templateRenderOutputSchema, t as guestInputSchema } from "./journeys-v2-Cndh4CAr.js";
 import { CapabilityError } from "./journeys.js";
-import { n as readManifest, t as asTemplate } from "./driver-B_pjmy5g.js";
+import { n as readManifest, t as asTemplate } from "./driver-BtQYaFXP.js";
 import { createElement } from "react";
 import { renderToStaticMarkup } from "react-dom/server.browser";
 

package/dist/guest/driver.d.ts

@@ -1,5 +1,5 @@
 import { c as TemplateRenderOutput, o as JourneyStepOutput, s as ManifestOutput } from "./index-DADBwPaG.js";
-import { n as Template } from "./emails-5GindgMQ.js";
+import { n as Template } from "./emails-DUwxKLGO.js";
 //#region src/guest/driver.d.ts
 /**
  * The in-process driver: JSON in, JSON out (spec: Guest protocol). One

package/dist/guest/driver.js

@@ -1,3 +1,3 @@
-import { n as readManifest, r as runGuest, t as asTemplate } from "./driver-B_pjmy5g.js";
+import { n as readManifest, r as runGuest, t as asTemplate } from "./driver-BtQYaFXP.js";
 
 export { asTemplate, readManifest, runGuest };

package/dist/guest/{emails-5GindgMQ.d.ts → emails-DUwxKLGO.d.ts}

@@ -23,7 +23,7 @@ type SendClass = (typeof SEND_CLASSES)[number];
 type Subject<Schema extends z.ZodType> = (props: z.infer<Schema>) => string;
 /**
  * The shape `emails/<key>.tsx` exports. `cow build` reads `props` (turned
- * into JSON Schema in the manifest and into `.cow/types.d.ts`), `subject`,
+ * into JSON Schema in the manifest and into `types.d.ts`), `subject`,
  * and the optional metadata below it; the sandbox renders `default`.
  */
 type Template<Schema extends z.ZodType = z.ZodType> = {

package/dist/guest/emails.d.ts

@@ -1,2 +1,2 @@
-import { n as Template, r as SendClass, t as Subject } from "./emails-5GindgMQ.js";
+import { n as Template, r as SendClass, t as Subject } from "./emails-DUwxKLGO.js";
 export { type SendClass, Subject, Template };

package/dist/guest/{journeys-v2-Djgs8U91.js → journeys-v2-Cndh4CAr.js}

@@ -513,7 +513,7 @@ function uniqueKeys(items, ctx, path) {
 	}
 }
 /**
-* What `cow build` writes to `.cow/build/manifest.json`, and the shape a
+* What `cow build` writes to `.cowliss/build/manifest.json`, and the shape a
 * push row stores for good, entry by entry, on the versions it creates.
 *
 * `protocol` is any positive integer rather than the current constant on

package/dist/guest/journeys.d.ts

@@ -33,7 +33,7 @@ declare class CapabilityError extends Error {
 }
 /**
  * The repository's templates, keyed by template key. `cow build` writes the
- * real interface into `.cow/types.d.ts` and TypeScript merges it into this
+ * real interface into `types.d.ts` and TypeScript merges it into this
  * one, which is what types `api.send.email`. Empty here on purpose: a
  * repository that has not built yet still compiles, with string keys.
  */

package/dist/guest/journeys.js

@@ -1,4 +1,4 @@
-import { a as manifestJourneySchema } from "./journeys-v2-Djgs8U91.js";
+import { a as manifestJourneySchema } from "./journeys-v2-Cndh4CAr.js";
 
 //#region src/guest/journeys.ts
 /**

package/dist/guest/segments.js

@@ -1,4 +1,4 @@
-import { o as manifestSegmentSchema } from "./journeys-v2-Djgs8U91.js";
+import { o as manifestSegmentSchema } from "./journeys-v2-Cndh4CAr.js";
 
 //#region src/guest/segments.ts
 const segmentConfigSchema = manifestSegmentSchema.pick({

package/dist/index.js

@@ -8,13 +8,13 @@ import { homedir } from "node:os";
 import { basename, dirname, join, relative, resolve, sep } from "node:path";
 import { Command, InvalidArgumentError } from "commander";
 import { execFile, spawn } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { promisify } from "node:util";
 import { MessagePort } from "node:worker_threads";
 import { build, formatMessagesSync } from "esbuild";
 import { create, extract } from "tar";
 import { parse } from "@babel/parser";
-import { existsSync, readFileSync } from "node:fs";
 import { createServer } from "node:http";
 import { createInterface } from "node:readline/promises";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
@@ -173,6 +173,8 @@ const SYSTEM_EVENT_PREFIX = "system.";
 * system.profile_deleted is the provider-recorded fact that a provider
 * (e.g. Clerk `user.deleted`) deleted the user upstream — a marker event
 * only, with no deletion semantics (hard-delete belongs to GDPR erasure);
+* system.signed_up and system.logged_in are the same shape for the other end
+* of that lifecycle (Clerk `user.created` and `session.created`);
 * system.email_clicked is a link click reported by SES feedback.
 *
 * Rows carrying one of these names get `system: true` so the usage meter
@@ -187,6 +189,17 @@ const SYSTEM_EVENTS = {
 	consentRevoked: "system.consent_revoked",
 	profileDeleted: "system.profile_deleted",
 	/**
+	* The provider's account lifecycle, as facts rather than as profile state:
+	* a profile can predate its `user.created` (an SDK identify or a
+	* membership delivery may have created it first), so these name what the
+	* provider reported, not what Cowliss did. `signedUp` is the trigger for a
+	* welcome journey fed by a provider source, which `emailRegistered` only
+	* approximates (it fires on an address change too, and never for a
+	* profile with no address). `loggedIn` is one row per session start.
+	*/
+	signedUp: "system.signed_up",
+	loggedIn: "system.logged_in",
+	/**
 	* A write's identifiers named more than one profile and Cowliss merged
 	* them (ticket 69). Lands on the survivor's timeline carrying
 	* `mergedProfileIds`, the ids folded into it.
@@ -5160,7 +5173,7 @@ function uniqueKeys(items, ctx, path) {
 	}
 }
 /**
-* What `cow build` writes to `.cow/build/manifest.json`, and the shape a
+* What `cow build` writes to `.cowliss/build/manifest.json`, and the shape a
 * push row stores for good, entry by entry, on the versions it creates.
 *
 * `protocol` is any positive integer rather than the current constant on
@@ -7873,6 +7886,36 @@ const updateWebhookBodySchema = z.object({ data: z.object({
 /** `q` is a substring search over the webhook's name. */
 const listWebhooksQuerySchema = paginationQuerySchema.extend({ q: searchQuerySchema });
 
+//#endregion
+//#region ../../packages/shared/src/whoami.ts
+/**
+* What an ingestion key plus one source id write into. An org API key is
+* org-scoped and carries no app of its own (`ApiKeyClaims`), so any live
+* `src_` in the organization is accepted by the write path: a well-formed id
+* belonging to another app lands profiles there with a 200. The id the
+* caller is about to send is therefore the input, and this answers where it
+* goes before anything is written.
+*
+* Scoped to that one source's app on purpose: the key stays a write
+* credential, and a leaked one must not enumerate the org's other apps
+* (.scratch/24-onboarding-dx/spec.md).
+*/
+const whoamiQuerySchema = z.object({ sourceId: sourceIdSchema });
+const whoamiSchema = z.object({
+	orgId: z.string(),
+	app: z.object({
+		id: z.string(),
+		name: z.string()
+	}),
+	/** Every live pipe into that app, so "a Clerk source already feeds this" is visible. */
+	sources: z.array(sourceSchema.pick({
+		id: true,
+		kind: true,
+		configured: true,
+		lastReceivedAt: true
+	}))
+});
+
 //#endregion
 //#region ../../packages/api-client/src/client.ts
 var ApiError = class extends Error {
@@ -7897,7 +7940,7 @@ async function send(baseUrl, init) {
 			body: typeof init.body === "string" || init.body === null ? init.body : Uint8Array.from(init.body)
 		});
 	} catch {
-		throw new ApiError("network_error", `Could not reach the API at ${baseUrl}. Is apps/api running?`, 0);
+		throw new ApiError("network_error", `Could not reach the API at ${baseUrl}. Check the address, or set COW_API_URL to the one you meant.`, 0);
 	}
 	const requestId = response.headers.get("X-Request-Id") ?? void 0;
 	if (init.binary && response.ok) return {
@@ -8475,8 +8518,8 @@ function isNode(value) {
 */
 const execFileAsync$1 = promisify(execFile);
 /** Where build output lives, relative to the project root. */
-const BUILD_DIR = join(".cow", "build");
-const TYPES_FILE = join(".cow", "types.d.ts");
+const BUILD_DIR = "build";
+const TYPES_FILE = "types.d.ts";
 /**
 * The config files the source tarball carries besides `journeys/` and
 * `emails/`. Always the committed `cow.json`, never a `--config` override: a
@@ -8597,7 +8640,7 @@ function assertSegmentResolves(relPath, trigger, segmentKeys) {
 	throw new Error(`${relPath}: this journey enrolls from the segment "${trigger.segment}", and there is no segments/${trigger.segment}.ts. ${available} Add that file, or write the predicate list in the trigger.`);
 }
 /**
-* `.cow/types.d.ts`: one `typeof import(...)` per template, merged into the
+* `types.d.ts`: one `typeof import(...)` per template, merged into the
 * SDK's `CowTemplates`, which is what types `api.send.email`. Written before
 * the typecheck, because the typecheck is what it exists for.
 */
@@ -8607,7 +8650,7 @@ import type { z } from "zod";
 
 declare module "@cowliss/cli/journeys" {
   interface CowTemplates {
-${templates.map((template) => `    "${template.key}": z.infer<typeof import("../${template.relPath.replace(/\.tsx$/, "")}").props>;`).join("\n")}
+${templates.map((template) => `    "${template.key}": z.infer<typeof import("./${template.relPath.replace(/\.tsx$/, "")}").props>;`).join("\n")}
   }
 }
 
@@ -8851,6 +8894,21 @@ function setConfigFile(name) {
 function projectConfigFile() {
 	return configFile;
 }
+/**
+* The directory a cow project lives in: `.cowliss/` under the repo root, so
+* a host repository gets one directory instead of four plus a config file.
+* Standing inside the project directory itself (a `cow.json` right here) is
+* the other answer, which is how the project directory is also a directory
+* you can cd into and run `cow` from.
+*
+* A missing `.cowliss/` still resolves to it rather than to the cwd: the
+* error then names the path a project would be at, and `cow init` and
+* `cow pull` create it.
+*/
+const PROJECT_DIR = ".cowliss";
+function resolveProjectDir(cwd = process.cwd()) {
+	return existsSync(join(cwd, projectConfigFile())) ? cwd : join(cwd, PROJECT_DIR);
+}
 /** The project's config; throws unless `projectDir` holds a valid one. */
 async function assertCowConfig(projectDir) {
 	const name = projectConfigFile();
@@ -8888,9 +8946,9 @@ async function configuredApp(projectDir) {
 	}
 }
 /**
-* Builds the project at `projectDir`. Writes `.cow/types.d.ts` first (the
+* Builds the project at `projectDir`. Writes `types.d.ts` first (the
 * typecheck needs it), then the bundles and the source tarball, and
-* `.cow/build/manifest.json` last, so a failed build leaves no manifest and
+* `build/manifest.json` last, so a failed build leaves no manifest and
 * the next `cow test` rebuilds.
 */
 async function buildProject(projectDir) {
@@ -9199,7 +9257,7 @@ async function copyBlueprint(name, dir, force) {
 }
 function registerAdd(program, io) {
 	program.command("add").description("add gallery blueprint code to a cow repo").command("blueprint <name>").description("copy a blueprint's journeys, emails, segments, and scenarios into this repo (local: no API call)").option("--force", "overwrite files that already exist").action(async (name, opts) => {
-		const dir = process.cwd();
+		const dir = resolveProjectDir();
 		await assertCowConfig(dir);
 		const files = await copyBlueprint(name, dir, opts.force === true);
 		emit({ data: {
@@ -9211,170 +9269,6 @@ function registerAdd(program, io) {
 	});
 }
 
-//#endregion
-//#region src/lib/login.ts
-/**
-* Login via the dashboard's /cli-auth bridge: start a loopback server, open
-* the web app there, and the signed-in browser POSTs the Clerk session token
-* back. `--token <jwt>` bypasses the browser entirely (agents, CI).
-*/
-async function login(env, options) {
-	let token;
-	if (options.token !== void 0) {
-		token = options.token.trim();
-		if (decodeTokenPayload(token) === null) throw new Error("The provided --token value is not a JWT");
-	} else token = await collectTokenViaBrowser(resolveWebUrl(env, (await readCowConfig(process.cwd()))?.webUrl, options.webUrl), 3e5, options.noOpen === true);
-	const claims = decodeSessionToken(token);
-	if (claims === null) throw new Error("Token is not a decodable JWT");
-	if (claims.userId === null) throw new Error("Token has no subject claim. Is it a Clerk session token?");
-	const apiUrl = options.apiFlag ?? resolveApiUrl(env, null, void 0, (await readCowConfig(process.cwd()))?.apiUrl);
-	return {
-		credentialsPath: await writeCredentials(env, {
-			token,
-			apiUrl
-		}),
-		apiUrl,
-		userId: claims.userId,
-		orgId: claims.orgId,
-		role: claims.role,
-		hasOrg: claims.orgId !== null
-	};
-}
-/** Open the dashboard bridge and await one POST of { token }. */
-function collectTokenViaBrowser(webUrl, timeoutMs = 18e4, noOpen = false) {
-	return new Promise((resolve, reject) => {
-		let server = null;
-		const timer = setTimeout(() => {
-			server?.close();
-			reject(/* @__PURE__ */ new Error(`Timed out waiting for the browser to sign in (${Math.round(timeoutMs / 1e3)}s). Or paste a token: \`cow login --token <jwt>\`.`));
-		}, timeoutMs);
-		server = createServer((req, res) => {
-			res.setHeader("Access-Control-Allow-Origin", "*");
-			res.setHeader("Access-Control-Allow-Methods", "POST, OPTIONS");
-			res.setHeader("Access-Control-Allow-Headers", "Content-Type");
-			if (req.method === "OPTIONS") {
-				res.writeHead(204).end();
-				return;
-			}
-			if (req.method !== "POST") {
-				res.writeHead(405).end();
-				return;
-			}
-			const chunks = [];
-			req.on("data", (chunk) => chunks.push(chunk));
-			req.on("end", () => {
-				clearTimeout(timer);
-				try {
-					const body = JSON.parse(Buffer.concat(chunks).toString("utf8"));
-					const field = (name) => typeof body === "object" && body !== null && name in body ? body[name] : void 0;
-					if (field("denied") === true) {
-						res.writeHead(200, { "Content-Type": "application/json" });
-						res.end(JSON.stringify({ ok: true }));
-						reject(/* @__PURE__ */ new Error("Sign-in was denied in the browser. No access was granted."));
-						return;
-					}
-					const token = field("token");
-					if (typeof token !== "string" || token.length === 0) {
-						res.writeHead(400, { "Content-Type": "application/json" });
-						res.end(JSON.stringify({ error: "missing token" }));
-						reject(/* @__PURE__ */ new Error("The browser bridge sent no token"));
-						return;
-					}
-					res.writeHead(200, { "Content-Type": "application/json" });
-					res.end(JSON.stringify({ ok: true }));
-					resolve(token);
-				} catch (error) {
-					reject(error instanceof Error ? error : new Error(String(error)));
-				} finally {
-					server?.close();
-				}
-			});
-		});
-		server.listen(0, "127.0.0.1", () => {
-			const address = server?.address();
-			if (address === null || typeof address !== "object") {
-				reject(/* @__PURE__ */ new Error("Could not bind a loopback port"));
-				return;
-			}
-			const callbackUrl = `http://127.0.0.1:${address.port}/cb`;
-			const target = `${webUrl}/cli-auth?cb=${encodeURIComponent(callbackUrl)}`;
-			if (!noOpen) openBrowser(target);
-			process.stderr.write(`Waiting for sign-in at:\n  ${target}\n`);
-		});
-		server.on("error", (error) => {
-			clearTimeout(timer);
-			reject(error);
-		});
-	});
-}
-function openBrowser(url) {
-	const cmd = process.platform === "darwin" ? "open" : process.platform === "linux" ? "xdg-open" : null;
-	if (cmd === null) return;
-	spawn(cmd, [url], {
-		stdio: "ignore",
-		detached: true
-	}).unref();
-}
-
-//#endregion
-//#region src/commands/auth.ts
-/** login/logout/whoami: session-token management, no contract route. */
-function registerAuth(program, env, io) {
-	program.command("login").description("authenticate via the dashboard browser flow (or --token) and cache the session token").option("--token <jwt>", "paste a session token instead of the browser flow").option("--web <url>", `dashboard URL; overrides COW_WEB_URL and webUrl in cow.json (default ${DEFAULT_WEB_URL})`).option("--no-open", "do not open the browser; print the URL and wait (headless/agent use)").action(async (opts) => {
-		const outcome = await login(env, {
-			token: opts.token,
-			webUrl: opts.web,
-			apiFlag: opts.api,
-			noOpen: opts.open === false
-		});
-		emit({ data: {
-			...outcome,
-			warnings: outcome.hasOrg ? void 0 : ["The token carries no active organization. Select one in the dashboard and log in again."]
-		} }, io, opts.json);
-	});
-	program.command("logout").description("delete the cached session token").action(async (opts) => {
-		const removed = await clearCredentials(env);
-		emit({ data: { removed } }, io, opts.json);
-	});
-	program.command("whoami").description("show which credential commands will use, and for a session its subject, org, role, and expiry").action(async (opts) => {
-		const credentials = await readCredentials(env);
-		const { kind } = resolveCredential(env, credentials);
-		if (kind === "none") throw new Error("Not logged in. Run `cow login` first, or set COW_PIPELINE_KEY.");
-		if (kind === "pipelineKey") {
-			emit({ data: {
-				credential: kind,
-				source: "COW_PIPELINE_KEY",
-				note: "A pipeline key may push, enable, disable, and read executions."
-			} }, io, opts.json);
-			return;
-		}
-		const claims = decodeSessionToken(credentials?.token ?? "");
-		if (!claims) throw new Error("Cached token is not decodable. Run `cow login` again.");
-		const projectApiUrl = (await readCowConfig(process.cwd()))?.apiUrl;
-		const apiUrl = resolveApiUrl(env, credentials, opts.api, projectApiUrl);
-		const mintedFor = credentials?.apiUrl;
-		emit({ data: {
-			credential: kind,
-			apiUrl,
-			mintedFor: mintedFor ?? null,
-			...mintedFor !== void 0 && mintedFor !== apiUrl ? { warning: `This token was minted for ${mintedFor}, but commands here talk to ${apiUrl}. Run \`cow login\` again from this directory.` } : {},
-			...claims
-		} }, io, opts.json);
-	});
-}
-
-//#endregion
-//#region src/commands/build.ts
-/**
-* `cow build`: typecheck, bundle, and write `.cow/build` for the project in
-* the current directory. Local only, no API call and no network.
-*/
-function registerBuild(program, io) {
-	program.command("build").description("typecheck and bundle the repo in the current directory, writing .cow/build (local: no API call)").action(async (opts) => {
-		emit({ data: await buildProject(process.cwd()) }, io, opts.json);
-	});
-}
-
 //#endregion
 //#region ../../node_modules/.pnpm/@asteasolutions+zod-to-openapi@9.1.0_zod@4.4.3/node_modules/@asteasolutions/zod-to-openapi/dist/index.cjs
 var require_dist = /* @__PURE__ */ __commonJSMin(((exports) => {
@@ -10659,6 +10553,19 @@ const ingestion = defineModule(defineRoute({
 		200: envelope(batchResultDtoSchema, "Per-item outcomes, positionally aligned"),
 		...ingestionErrors
 	}
+}), defineRoute({
+	method: "get",
+	path: "/v1/whoami",
+	operationId: "ingestion.whoami",
+	tags: ["ingestion"],
+	summary: "Which app a source id writes into",
+	security: API_KEY_AUTH,
+	surfaces: HIDDEN_FROM_TOOLS,
+	request: { query: whoamiQuerySchema },
+	responses: {
+		200: envelope(whoamiSchema, "The source's org, app, and sibling sources"),
+		...errors("invalid_key", "not_found", "validation_failed", "rate_limited")
+	}
 }));
 
 //#endregion
@@ -11887,6 +11794,180 @@ const allRoutes = Object.values(contract).flatMap((module) => Object.values(modu
 /** The tags in the order their modules are declared. */
 const tags = [...new Set(allRoutes.flatMap((route) => route.tags ?? []))];
 
+//#endregion
+//#region src/lib/login.ts
+/**
+* Login via the dashboard's /cli-auth bridge: start a loopback server, open
+* the web app there, and the signed-in browser POSTs the Clerk session token
+* back. `--token <jwt>` bypasses the browser entirely (agents, CI).
+*/
+async function login(env, options) {
+	let token;
+	if (options.token !== void 0) {
+		token = options.token.trim();
+		if (decodeTokenPayload(token) === null) throw new Error("The provided --token value is not a JWT");
+	} else token = await collectTokenViaBrowser(resolveWebUrl(env, (await readCowConfig(process.cwd()))?.webUrl, options.webUrl), 3e5, options.noOpen === true);
+	const claims = decodeSessionToken(token);
+	if (claims === null) throw new Error("Token is not a decodable JWT");
+	if (claims.userId === null) throw new Error("Token has no subject claim. Is it a Clerk session token?");
+	const apiUrl = options.apiFlag ?? resolveApiUrl(env, null, void 0, (await readCowConfig(process.cwd()))?.apiUrl);
+	return {
+		credentialsPath: await writeCredentials(env, {
+			token,
+			apiUrl
+		}),
+		apiUrl,
+		userId: claims.userId,
+		orgId: claims.orgId,
+		role: claims.role,
+		hasOrg: claims.orgId !== null
+	};
+}
+/** Open the dashboard bridge and await one POST of { token }. */
+function collectTokenViaBrowser(webUrl, timeoutMs = 18e4, noOpen = false) {
+	return new Promise((resolve, reject) => {
+		let server = null;
+		const timer = setTimeout(() => {
+			server?.close();
+			reject(/* @__PURE__ */ new Error(`Timed out waiting for the browser to sign in (${Math.round(timeoutMs / 1e3)}s). Or paste a token: \`cow login --token <jwt>\`.`));
+		}, timeoutMs);
+		server = createServer((req, res) => {
+			res.setHeader("Access-Control-Allow-Origin", "*");
+			res.setHeader("Access-Control-Allow-Methods", "POST, OPTIONS");
+			res.setHeader("Access-Control-Allow-Headers", "Content-Type");
+			if (req.method === "OPTIONS") {
+				res.writeHead(204).end();
+				return;
+			}
+			if (req.method !== "POST") {
+				res.writeHead(405).end();
+				return;
+			}
+			const chunks = [];
+			req.on("data", (chunk) => chunks.push(chunk));
+			req.on("end", () => {
+				clearTimeout(timer);
+				try {
+					const body = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+					const field = (name) => typeof body === "object" && body !== null && name in body ? body[name] : void 0;
+					if (field("denied") === true) {
+						res.writeHead(200, { "Content-Type": "application/json" });
+						res.end(JSON.stringify({ ok: true }));
+						reject(/* @__PURE__ */ new Error("Sign-in was denied in the browser. No access was granted."));
+						return;
+					}
+					const token = field("token");
+					if (typeof token !== "string" || token.length === 0) {
+						res.writeHead(400, { "Content-Type": "application/json" });
+						res.end(JSON.stringify({ error: "missing token" }));
+						reject(/* @__PURE__ */ new Error("The browser bridge sent no token"));
+						return;
+					}
+					res.writeHead(200, { "Content-Type": "application/json" });
+					res.end(JSON.stringify({ ok: true }));
+					resolve(token);
+				} catch (error) {
+					reject(error instanceof Error ? error : new Error(String(error)));
+				} finally {
+					server?.close();
+				}
+			});
+		});
+		server.listen(0, "127.0.0.1", () => {
+			const address = server?.address();
+			if (address === null || typeof address !== "object") {
+				reject(/* @__PURE__ */ new Error("Could not bind a loopback port"));
+				return;
+			}
+			const callbackUrl = `http://127.0.0.1:${address.port}/cb`;
+			const target = `${webUrl}/cli-auth?cb=${encodeURIComponent(callbackUrl)}`;
+			if (!noOpen) openBrowser(target);
+			process.stderr.write(`Waiting for sign-in at:\n  ${target}\n`);
+		});
+		server.on("error", (error) => {
+			clearTimeout(timer);
+			reject(error);
+		});
+	});
+}
+function openBrowser(url) {
+	const cmd = process.platform === "darwin" ? "open" : process.platform === "linux" ? "xdg-open" : null;
+	if (cmd === null) return;
+	spawn(cmd, [url], {
+		stdio: "ignore",
+		detached: true
+	}).unref();
+}
+
+//#endregion
+//#region src/commands/auth.ts
+/** login/logout/whoami: session-token management, no contract route. */
+function registerAuth(program, env, io) {
+	program.command("login").description("authenticate via the dashboard browser flow (or --token) and cache the session token").option("--token <jwt>", "paste a session token instead of the browser flow").option("--web <url>", `dashboard URL; overrides COW_WEB_URL and webUrl in cow.json (default ${DEFAULT_WEB_URL})`).option("--no-open", "do not open the browser; print the URL and wait (headless/agent use)").action(async (opts) => {
+		const outcome = await login(env, {
+			token: opts.token,
+			webUrl: opts.web,
+			apiFlag: opts.api,
+			noOpen: opts.open === false
+		});
+		emit({ data: {
+			...outcome,
+			warnings: outcome.hasOrg ? void 0 : ["The token carries no active organization. Select one in the dashboard and log in again."]
+		} }, io, opts.json);
+	});
+	program.command("logout").description("delete the cached session token").action(async (opts) => {
+		const removed = await clearCredentials(env);
+		emit({ data: { removed } }, io, opts.json);
+	});
+	program.command("whoami").description("show which credential commands will use, and for a session its subject, org, role, and expiry").option("--key <ak_...>", "ask the API what an ingestion key writes into, instead of reading the cached session").option("--source <src_...>", "the source id that key is about to send to (required with --key)").action(async (opts) => {
+		if (opts.key) {
+			if (!opts.source) throw new Error("`--key` needs `--source <src_...>`: the id you are about to send to is what this checks.");
+			const client = createClient({
+				baseUrl: resolveApiUrl(env, await readCredentials(env), opts.api, (await readCowConfig(resolveProjectDir()))?.apiUrl),
+				auth: () => opts.key ?? null,
+				headers: { [CLIENT_HEADER]: `@cowliss/cli/${(await readCliPackage()).version}` }
+			});
+			emit(await client.request(contract.ingestion["ingestion.whoami"], { query: { sourceId: opts.source } }), io, opts.json);
+			return;
+		}
+		const credentials = await readCredentials(env);
+		const { kind } = resolveCredential(env, credentials);
+		if (kind === "none") throw new Error("Not logged in. Run `cow login` first, or set COW_PIPELINE_KEY.");
+		if (kind === "pipelineKey") {
+			emit({ data: {
+				credential: kind,
+				source: "COW_PIPELINE_KEY",
+				note: "A pipeline key may push, enable, disable, and read executions."
+			} }, io, opts.json);
+			return;
+		}
+		const claims = decodeSessionToken(credentials?.token ?? "");
+		if (!claims) throw new Error("Cached token is not decodable. Run `cow login` again.");
+		const projectApiUrl = (await readCowConfig(resolveProjectDir()))?.apiUrl;
+		const apiUrl = resolveApiUrl(env, credentials, opts.api, projectApiUrl);
+		const mintedFor = credentials?.apiUrl;
+		emit({ data: {
+			credential: kind,
+			apiUrl,
+			mintedFor: mintedFor ?? null,
+			...mintedFor !== void 0 && mintedFor !== apiUrl ? { warning: `This token was minted for ${mintedFor}, but commands here talk to ${apiUrl}. Run \`cow login\` again from this directory.` } : {},
+			...claims
+		} }, io, opts.json);
+	});
+}
+
+//#endregion
+//#region src/commands/build.ts
+/**
+* `cow build`: typecheck, bundle, and write `build/` for the project in
+* the current directory. Local only, no API call and no network.
+*/
+function registerBuild(program, io) {
+	program.command("build").description("typecheck and bundle the repo in the current directory, writing .cowliss/build (local: no API call)").action(async (opts) => {
+		emit({ data: await buildProject(resolveProjectDir()) }, io, opts.json);
+	});
+}
+
 //#endregion
 //#region ../../packages/shared/src/contract/surfaces.ts
 /** camelCase field name → kebab-case flag body (`sourceId` → `source-id`). */
@@ -12358,7 +12439,7 @@ function flipSummary(journeys, status) {
 * segment's own key joins the set the events are filtered by.
 */
 async function unseenForKeys(client, keys) {
-	const dir = process.cwd();
+	const dir = resolveProjectDir();
 	const project = await assertCowConfig(dir).then(async (config) => ({
 		config,
 		built: await buildProject(dir)
@@ -12384,7 +12465,7 @@ function register(program, clientFor, io, verb, status) {
 		};
 		if (merged.all === true && keys.length > 0) throw new Error(`Name the journeys or pass --all, not both: cow ${verb} welcome.`);
 		if (merged.all !== true && keys.length === 0) throw new Error(`Name at least one journey, or pass --all: cow ${verb} welcome.`);
-		const selector = merged.all === true ? { appId: (await assertCowConfig(process.cwd())).appId } : { keys };
+		const selector = merged.all === true ? { appId: (await assertCowConfig(resolveProjectDir())).appId } : { keys };
 		const client = await clientFor(merged);
 		const updated = await setStatus(client, selector, status);
 		if (merged.json === true) {
@@ -12484,7 +12565,7 @@ async function chooseApp(client, webUrl, flag, org, io, skipPrompts) {
 	return { appId: await ask("App id", only ?? "", io, false) };
 }
 function registerInit(program, clientFor, env, io) {
-	program.command("init").argument("[dir]", "directory to create the repo in (default: here)").description("create a cow repo: cow.json, journeys/, emails/, segments/, and the files to build them").option("--org <id>", "organization id (default: the logged-in org)").option("--app <id>", "app id this repository pushes to (default: ask, or the org's only one)").option("--yes", "accept the defaults instead of prompting").option("--blueprint <name>", "start from a gallery blueprint").action(async (dirArg, opts) => {
+	program.command("init").argument("[dir]", "repository to create the project in (default: here)").description("create a cow project in .cowliss/: cow.json, journeys/, emails/, segments/, and the files to build them").option("--org <id>", "organization id (default: the logged-in org)").option("--app <id>", "app id this repository pushes to (default: ask, or the org's only one)").option("--yes", "accept the defaults instead of prompting").option("--blueprint <name>", "start from a gallery blueprint").action(async (dirArg, opts) => {
 		const merged = {
 			...program.opts(),
 			...opts
@@ -12493,7 +12574,8 @@ function registerInit(program, clientFor, env, io) {
 		const cwd = process.cwd();
 		const defaultName = basename(dirArg ? resolve(cwd, dirArg) : cwd);
 		const name = await ask("Repo name", defaultName, io, skipPrompts);
-		const dir = dirArg ? resolve(cwd, dirArg) : name === defaultName ? cwd : resolve(cwd, name);
+		const repo = dirArg ? resolve(cwd, dirArg) : name === defaultName ? cwd : resolve(cwd, name);
+		const dir = join(repo, PROJECT_DIR);
 		if (existsSync(join(dir, "cow.json"))) throw new Error(`"${dir}" already holds a cow.json. Use \`cow add blueprint\` to add code to it.`);
 		const credentials = await readCredentials(env);
 		const claimedOrg = credentials ? decodeSessionToken(credentials.token)?.orgId ?? null : null;
@@ -12523,10 +12605,10 @@ function registerInit(program, clientFor, env, io) {
 					"journeys",
 					"emails",
 					"segments",
-					".cow/types.d.ts"
+					"types.d.ts"
 				]
 			}),
-			".gitignore": ".cow/\nnode_modules/\n",
+			".gitignore": "build/\ntypes.d.ts\nnode_modules/\n",
 			"journeys/.gitkeep": "",
 			"emails/.gitkeep": "",
 			"segments/.gitkeep": ""
@@ -12548,7 +12630,7 @@ function registerInit(program, clientFor, env, io) {
 		const journey = scenario.slice(10).split(".")[0] ?? "abandoned-checkout";
 		const appLine = app.appId === "" ? `No app named yet (${app.reason}). Put its id in cow.json's "appId"; you will find it on the app's page at ${webUrl}/apps.` : `Pushes to ${app.appId}`;
 		io.stderr([
-			`Created a cow repo in ${here}`,
+			`Created a cow project in ${here}`,
 			appLine,
 			"",
 			"Next steps:",
@@ -12700,8 +12782,8 @@ function registerStatus(program, clientFor, io) {
 			...program.opts(),
 			...opts
 		};
-		const config = await assertCowConfig(process.cwd());
-		const built = await buildProject(process.cwd()).catch(() => null);
+		const config = await assertCowConfig(resolveProjectDir());
+		const built = await buildProject(resolveProjectDir()).catch(() => null);
 		const client = await clientFor(merged);
 		const status = await readStatus(client, config.appId);
 		if (merged.json === true) {
@@ -12939,7 +13021,7 @@ function registerPush(program, clientFor, env, io) {
 			...opts
 		};
 		const client = await clientFor(merged);
-		const projectDir = process.cwd();
+		const projectDir = resolveProjectDir();
 		const json = merged.json === true;
 		const { plan, built } = await planProject({
 			client,
@@ -13007,7 +13089,7 @@ function registerPush(program, clientFor, env, io) {
 async function projectPlan(client) {
 	const { plan } = await planProject({
 		client,
-		projectDir: process.cwd()
+		projectDir: resolveProjectDir()
 	});
 	return { data: plan };
 }
@@ -13020,7 +13102,7 @@ function registerPlan(program, clientFor, io) {
 		const client = await clientFor(merged);
 		const { plan, built } = await planProject({
 			client,
-			projectDir: process.cwd()
+			projectDir: resolveProjectDir()
 		});
 		if (merged.json === true) {
 			emit({ data: plan }, io, true);
@@ -13168,7 +13250,7 @@ const execFileAsync = promisify(execFile);
 *
 * Untracked files count: a journey the developer wrote and has not committed
 * is exactly what the tarball's copy of the same path would bury, and it is
-* the only copy. `.cow/` and `node_modules/` are gitignored by `cow init`, so
+* the only copy. `build/` and `node_modules/` are gitignored by `cow init`, so
 * they never show up here.
 */
 async function dirtyPaths(dir) {
@@ -13217,6 +13299,7 @@ async function pullPush({ client, projectDir, pushId, force }) {
 	}
 	const tarball = await client.request(contract.pushes["pushes.source"], { params: { id: push.id } });
 	const files = [];
+	await mkdir(projectDir, { recursive: true });
 	const unpack = extract({
 		cwd: projectDir,
 		onReadEntry: (entry) => files.push(entry.path)
@@ -13239,7 +13322,7 @@ function registerPull(program, clientFor, io) {
 		};
 		const outcome = await pullPush({
 			client: await clientFor(merged),
-			projectDir: process.cwd(),
+			projectDir: resolveProjectDir(),
 			pushId: opts.push,
 			force: opts.force === true
 		});
@@ -13494,7 +13577,7 @@ function registerTest(program, io) {
 		}
 		const parsed = journeyScenarioSchema.safeParse(json);
 		if (!parsed.success) throw new Error(`Scenario file "${opts.scenario}" is not a valid scenario: ${firstIssueMessage(parsed.error)}`);
-		const projectDir = process.cwd();
+		const projectDir = resolveProjectDir();
 		await buildIfStale(projectDir);
 		const result = await runScenario(projectDir, journey, parsed.data);
 		emit({ data: result }, io, opts.json);
@@ -13519,7 +13602,7 @@ function buildProgram(env, io) {
 	const clientFor = async (opts) => {
 		const credentials = await readCredentials(env);
 		return createClient({
-			baseUrl: resolveApiUrl(env, credentials, typeof opts.api === "string" ? opts.api : void 0, (await readCowConfig(process.cwd()))?.apiUrl),
+			baseUrl: resolveApiUrl(env, credentials, typeof opts.api === "string" ? opts.api : void 0, (await readCowConfig(resolveProjectDir()))?.apiUrl),
 			auth: async () => resolveCredential(env, await readCredentials(env)).token,
 			headers: async () => ({ [CLIENT_HEADER]: `@cowliss/cli/${(await readCliPackage()).version}` })
 		});
@@ -13591,7 +13674,7 @@ function errorMessage(error) {
 			code: error.code,
 			message: error.message
 		} }, null, 2);
-		if (error.code === "invalid_key") return `${envelope}\n(hint: run \`cow login\` to refresh the session token)`;
+		if (error.code === "invalid_key" && !process.argv.includes("--key")) return `${envelope}\n(hint: run \`cow login\` to refresh the session token)`;
 		return envelope;
 	}
 	if (error instanceof Error) return `error: ${error.message}`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cowliss/cli",
-  "version": "0.11.0",
+  "version": "0.13.0",
   "type": "module",
   "bin": {
     "cow": "./dist/index.js"