@cowliss/cli 0.2.0 → 0.3.0

package/dist/guest/{driver-D8cPyQgF.js → driver-M6LQVMr2.js}

@@ -1,4 +1,4 @@
-import { a as manifestOutputSchema, i as journeyStepOutputSchema, o as templateRenderOutputSchema, r as guestInputSchema, t as CapabilityError } from "./journeys-CR_wIAtP.js";
+import { a as manifestOutputSchema, i as journeyStepOutputSchema, o as templateRenderOutputSchema, r as guestInputSchema, t as CapabilityError } from "./journeys-BcbIxxI-.js";
 import { z } from "zod";
 import { createElement } from "react";
 import { renderToStaticMarkup } from "react-dom/server.browser";

package/dist/guest/driver.js

@@ -1,3 +1,3 @@
-import { t as runGuest } from "./driver-D8cPyQgF.js";
+import { t as runGuest } from "./driver-M6LQVMr2.js";
 
 export { runGuest };

package/dist/guest/{journeys-CR_wIAtP.js → journeys-BcbIxxI-.js}

@@ -90,7 +90,13 @@ const cowConfigSchema = z.strictObject({
 	*/
 	project: projectNameSchema,
 	/** Overrides the API the CLI talks to; the hosted product needs none. */
-	apiUrl: z.url().optional()
+	apiUrl: z.url().optional(),
+	/**
+	* Overrides the dashboard `cow login` opens. Paired with `apiUrl`: a
+	* login against one Cowliss's dashboard yields a token the other's API
+	* rejects, so a config that names an API names its dashboard too.
+	*/
+	webUrl: z.url().optional()
 }).meta({
 	title: "cow.json",
 	description: "A cow project: the organization and the project it deploys to."

package/dist/guest/journeys.js

@@ -1,3 +1,3 @@
-import { n as defineJourney, t as CapabilityError } from "./journeys-CR_wIAtP.js";
+import { n as defineJourney, t as CapabilityError } from "./journeys-BcbIxxI-.js";
 
 export { CapabilityError, defineJourney };

package/dist/guest/wasi.js

@@ -1,4 +1,4 @@
-import { t as runGuest } from "./driver-D8cPyQgF.js";
+import { t as runGuest } from "./driver-M6LQVMr2.js";
 
 //#region src/guest/wasi.ts
 const STDIN = 0;

package/dist/index.js

@@ -7,13 +7,13 @@ import { copyFile, mkdir, readFile, readdir, rm, stat, watch, writeFile } from "
 import { homedir } from "node:os";
 import { basename, dirname, join, relative, resolve, sep } from "node:path";
 import { Command, InvalidArgumentError } from "commander";
-import { existsSync, readFileSync } from "node:fs";
-import { fileURLToPath, pathToFileURL } from "node:url";
 import { execFile, spawn } from "node:child_process";
+import { fileURLToPath, pathToFileURL } from "node:url";
 import { promisify } from "node:util";
 import { MessagePort } from "node:worker_threads";
 import { build, formatMessagesSync } from "esbuild";
 import { create, extract } from "tar";
+import { existsSync, readFileSync } from "node:fs";
 import { createServer } from "node:http";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
 import { createInterface } from "node:readline/promises";
@@ -4056,8 +4056,15 @@ const releaseStatusEnum = pgEnum("release_status", [
 * it doubles as the tenancy key.
 *
 * Immutable except for the compile result, which is why there is no
-* `updatedAt`: `compiledAt` and `error` are the only fields that ever move,
-* and they move exactly once.
+* `updatedAt`: `compiledAt`, `error` and `compiledEntries` are the only
+* fields that ever move. The first two move exactly once; `compiledEntries`
+* climbs while the compile runs, because a push is minutes of silence
+* otherwise and the manifest's own length is the denominator.
+*
+* A counter rather than a row per entry: the question both the CLI and the
+* dashboard ask is "how far along", which one integer answers at a fraction
+* of the write volume. Naming which entry is compiling needs per-entry rows
+* and is a different question.
 */
 const releases$1 = pgTable("releases", {
 	id: text("id").primaryKey(),
@@ -4075,7 +4082,9 @@ const releases$1 = pgTable("releases", {
 		mode: "date",
 		precision: 3
 	}),
-	error: text("error")
+	error: text("error"),
+	/** How many manifest entries have compiled and passed their checks. */
+	compiledEntries: integer("compiled_entries").notNull().default(0)
 }, (table) => [uniqueIndex("releases_org_id_project_id_seq_unique").on(table.orgId, table.projectId, table.seq), index("releases_org_id_created_at_idx").on(table.orgId, table.createdAt)]);
 const selectReleaseSchema = createSelectSchema(releases$1);
 const insertReleaseSchema = createInsertSchema(releases$1);
@@ -5294,6 +5303,16 @@ const createSenderDomainBodySchema = z.object({ data: senderDomainInputSchema })
 const updateSenderDomainBodySchema = z.object({ data: z.object({ clickTracking: z.boolean() }) });
 /** `q` is a substring search over the domain string. */
 const listSenderDomainsQuerySchema = paginationQuerySchema.extend({ q: searchQuerySchema });
+/**
+* Where the one-click DNS setup sends the admin, or null when their DNS
+* provider does not offer it. Computed per request (it costs a DNS lookup
+* and two calls to the provider), never stored.
+*/
+const domainDnsSetupSchema = z.object({
+	url: z.url().nullable(),
+	/** The DNS provider's own name for itself, for the button's label. */
+	provider: z.string().nullable()
+});
 
 //#endregion
 //#region ../../packages/shared/src/patterns.ts
@@ -5934,7 +5953,13 @@ const cowConfigSchema = z.strictObject({
 	*/
 	project: projectNameSchema,
 	/** Overrides the API the CLI talks to; the hosted product needs none. */
-	apiUrl: z.url().optional()
+	apiUrl: z.url().optional(),
+	/**
+	* Overrides the dashboard `cow login` opens. Paired with `apiUrl`: a
+	* login against one Cowliss's dashboard yields a token the other's API
+	* rejects, so a config that names an API names its dashboard too.
+	*/
+	webUrl: z.url().optional()
 }).meta({
 	title: "cow.json",
 	description: "A cow project: the organization and the project it deploys to."
@@ -6045,11 +6070,19 @@ const putArtifactQuerySchema = z.object({ kind: z.enum(["bundle", "source"]) });
 *
 * `deployedIn` is not a column: it is the environments whose latest
 * deployment names this release, computed on read, so it can never fall out
-* of sync with the append-only deployment log.
+* of sync with the append-only deployment log. Neither is `totalEntries`:
+* the manifest is already here and its journeys plus its templates are the
+* denominator, so storing it beside `compiledEntries` would only invite the
+* two to disagree.
 */
 const releaseSchema = selectReleaseSchema.extend({
 	manifest: z.union([compiledManifestSchema, manifestSchema]),
 	deployedIn: z.array(environmentSchema),
+	/**
+	* How many journeys and templates the manifest holds: the denominator
+	* `compiledEntries` climbs towards, counted on read rather than stored.
+	*/
+	totalEntries: z.number().int(),
 	createdAt: z.iso.datetime(),
 	compiledAt: z.iso.datetime().nullable()
 });
@@ -6735,94 +6768,6 @@ async function clearCredentials$1(path = defaultCredentialsPath()) {
 	}
 }
 
-//#endregion
-//#region src/lib/config.ts
-const DEFAULT_API_URL = "http://localhost:3400";
-const DEFAULT_WEB_URL = "http://localhost:5273";
-function credentialsPath(env) {
-	return env.COW_CREDENTIALS_PATH ?? defaultCredentialsPath();
-}
-function readCredentials(env) {
-	return readCredentials$1(credentialsPath(env));
-}
-function writeCredentials(env, credentials) {
-	return writeCredentials$1(credentialsPath(env), credentials).then(() => credentialsPath(env));
-}
-function clearCredentials(env) {
-	return clearCredentials$1(credentialsPath(env));
-}
-/**
-* The token every command sends, and where it came from. Precedence:
-* `COW_DEPLOY_KEY` > `COW_TOKEN` > the cached login. The deploy key wins
-* because a machine that has one is CI (or a long-running `cow dev`), and a
-* stale session left in `~/.cow` on that machine must not quietly become the
-* credential a pipeline runs as. `COW_TOKEN` is a session token handed over
-* explicitly, so it reports as one and outranks the cached file.
-*
-* A deploy key only reaches the release lifecycle, so a `cow users list` on
-* a box that exports one answers 401 rather than falling back to the
-* session. That is the honest failure: the two credentials are different
-* identities, and silently switching between them per command is how a
-* pipeline ends up passing locally and failing in CI.
-*/
-function resolveCredential(env, credentials) {
-	if (env.COW_DEPLOY_KEY) return {
-		token: env.COW_DEPLOY_KEY,
-		kind: "deployKey"
-	};
-	if (env.COW_TOKEN) return {
-		token: env.COW_TOKEN,
-		kind: "session"
-	};
-	if (credentials?.token) return {
-		token: credentials.token,
-		kind: "session"
-	};
-	return {
-		token: null,
-		kind: "none"
-	};
-}
-/** Precedence: --api flag > env > credentials (from login) > default. */
-function resolveApiUrl(env, credentials, flag) {
-	return flag ?? env.COW_API_URL ?? credentials?.apiUrl ?? "http://localhost:3400";
-}
-/**
-* Decode a JWT payload without verification. Display only: the API is the
-* verifier; the CLI just shows what it is about to send.
-*/
-function decodeTokenPayload(token) {
-	const parts = token.split(".");
-	if (parts.length !== 3) return null;
-	try {
-		const json = Buffer.from(parts[1] ?? "", "base64url").toString("utf8");
-		const payload = JSON.parse(json);
-		if (typeof payload !== "object" || payload === null) return null;
-		return payload;
-	} catch {
-		return null;
-	}
-}
-function decodeSessionToken(token) {
-	const payload = decodeTokenPayload(token);
-	if (!payload) return null;
-	const o = payload.o;
-	return {
-		userId: typeof payload.sub === "string" ? payload.sub : null,
-		orgId: o && typeof o === "object" && typeof o.id === "string" ? o.id : typeof payload.org_id === "string" ? payload.org_id : null,
-		role: o && typeof o === "object" && typeof o.rol === "string" ? `org:${o.rol}` : typeof payload.org_role === "string" ? payload.org_role : null,
-		expiresAt: typeof payload.exp === "number" ? (/* @__PURE__ */ new Date(payload.exp * 1e3)).toISOString() : null
-	};
-}
-
-//#endregion
-//#region src/lib/package.ts
-let cached;
-function readCliPackage() {
-	cached ??= readFile(new URL(import.meta.resolve("@cowliss/cli/package.json")), "utf8").then((text) => JSON.parse(text));
-	return cached;
-}
-
 //#endregion
 //#region ../../packages/shared/src/stable-json.ts
 /**
@@ -6866,6 +6811,14 @@ function manifestDigestOf(manifest) {
 	return digestOf(stableJson(manifest));
 }
 
+//#endregion
+//#region src/lib/package.ts
+let cached;
+function readCliPackage() {
+	cached ??= readFile(new URL(import.meta.resolve("@cowliss/cli/package.json")), "utf8").then((text) => JSON.parse(text));
+	return cached;
+}
+
 //#endregion
 //#region src/build/index.ts
 /**
@@ -6878,7 +6831,12 @@ const execFileAsync$1 = promisify(execFile);
 /** Where build output lives, relative to the project root. */
 const BUILD_DIR = join(".cow", "build");
 const TYPES_FILE = join(".cow", "types.d.ts");
-/** The config files the source tarball carries besides `journeys/` and `emails/`. */
+/**
+* The config files the source tarball carries besides `journeys/` and
+* `emails/`. Always the committed `cow.json`, never a `--config` override: a
+* release records the project as the repo declares it, not the local file
+* whoever pushed happened to point at.
+*/
 const CONFIG_FILES$1 = [
 	"cow.json",
 	"package.json",
@@ -7254,18 +7212,41 @@ async function writeSourceTarball(projectDir, outFile) {
 	}, files);
 	return (await stat(outFile)).size;
 }
-/** The project's cow.json; throws unless `projectDir` holds a valid one. */
+/** The project config a checkout carries by default. */
+const DEFAULT_CONFIG_FILE = "cow.json";
+/**
+* Which project config every command in this process reads. Resolved once
+* from `--config`/`COW_CONFIG` at startup rather than threaded through nine
+* call sites: the CLI is one shot, and the answer cannot change mid-run.
+*/
+let configFile = DEFAULT_CONFIG_FILE;
+function setConfigFile(name) {
+	configFile = name;
+}
+function projectConfigFile() {
+	return configFile;
+}
+/** The project's config; throws unless `projectDir` holds a valid one. */
 async function assertCowConfig(projectDir) {
+	const name = projectConfigFile();
 	let text;
 	try {
-		text = await readFile(join(projectDir, "cow.json"), "utf8");
+		text = await readFile(join(projectDir, name), "utf8");
 	} catch {
-		throw new Error(`No cow.json in "${projectDir}". Run \`cow init\` to create a project.`);
+		throw new Error(name === "cow.json" ? `No ${name} in "${projectDir}". Run \`cow init\` to create a project.` : `No ${name} in "${projectDir}". That file was selected with --config or COW_CONFIG.`);
 	}
 	const parsed = cowConfigSchema.safeParse(JSON.parse(text));
-	if (!parsed.success) throw new Error(`cow.json is invalid: ${parsed.error.issues.map((issue) => `${issue.path.join(".") || "(root)"}: ${issue.message}`).join("; ")}`);
+	if (!parsed.success) throw new Error(`${name} is invalid: ${parsed.error.issues.map((issue) => `${issue.path.join(".") || "(root)"}: ${issue.message}`).join("; ")}`);
 	return parsed.data;
 }
+/** The project's config, or null when this directory has none. */
+async function readCowConfig(projectDir) {
+	try {
+		return await assertCowConfig(projectDir);
+	} catch {
+		return null;
+	}
+}
 /**
 * Which project of the org this directory belongs to: the `project` in its
 * `cow.json`, or undefined when there is no `cow.json` here at all. The
@@ -7387,6 +7368,95 @@ async function buildIfStale(projectDir) {
 	if ((await Promise.all(sources.map((file) => stat(join(projectDir, file)).then((stats) => stats.mtimeMs, () => 0)))).some((time) => time > builtAt)) await buildProject(projectDir);
 }
 
+//#endregion
+//#region src/lib/config.ts
+const DEFAULT_API_URL = "http://localhost:3400";
+const DEFAULT_WEB_URL = "http://localhost:5273";
+function credentialsPath(env) {
+	return env.COW_CREDENTIALS_PATH ?? defaultCredentialsPath();
+}
+function readCredentials(env) {
+	return readCredentials$1(credentialsPath(env));
+}
+function writeCredentials(env, credentials) {
+	return writeCredentials$1(credentialsPath(env), credentials).then(() => credentialsPath(env));
+}
+function clearCredentials(env) {
+	return clearCredentials$1(credentialsPath(env));
+}
+/**
+* The token every command sends, and where it came from. Precedence:
+* `COW_DEPLOY_KEY` > `COW_TOKEN` > the cached login. The deploy key wins
+* because a machine that has one is CI (or a long-running `cow dev`), and a
+* stale session left in `~/.cow` on that machine must not quietly become the
+* credential a pipeline runs as. `COW_TOKEN` is a session token handed over
+* explicitly, so it reports as one and outranks the cached file.
+*
+* A deploy key only reaches the release lifecycle, so a `cow users list` on
+* a box that exports one answers 401 rather than falling back to the
+* session. That is the honest failure: the two credentials are different
+* identities, and silently switching between them per command is how a
+* pipeline ends up passing locally and failing in CI.
+*/
+function resolveCredential(env, credentials) {
+	if (env.COW_DEPLOY_KEY) return {
+		token: env.COW_DEPLOY_KEY,
+		kind: "deployKey"
+	};
+	if (env.COW_TOKEN) return {
+		token: env.COW_TOKEN,
+		kind: "session"
+	};
+	if (credentials?.token) return {
+		token: credentials.token,
+		kind: "session"
+	};
+	return {
+		token: null,
+		kind: "none"
+	};
+}
+/**
+* Precedence: `--api` flag > env > the project config > credentials (from
+* login) > default.
+*
+* The project's own `apiUrl` outranks the credentials file because it is the
+* more specific answer: `cow.json` says where this project deploys, while the
+* credentials only remember where somebody last logged in. Without it a
+* checkout whose config names production silently fell through to
+* `DEFAULT_API_URL`, which is how a production deploy reaches localhost.
+*/
+function resolveApiUrl(env, credentials, flag, projectApiUrl) {
+	return flag ?? env.COW_API_URL ?? projectApiUrl ?? credentials?.apiUrl ?? "http://localhost:3400";
+}
+/**
+* Decode a JWT payload without verification. Display only: the API is the
+* verifier; the CLI just shows what it is about to send.
+*/
+function decodeTokenPayload(token) {
+	const parts = token.split(".");
+	if (parts.length !== 3) return null;
+	try {
+		const json = Buffer.from(parts[1] ?? "", "base64url").toString("utf8");
+		const payload = JSON.parse(json);
+		if (typeof payload !== "object" || payload === null) return null;
+		return payload;
+	} catch {
+		return null;
+	}
+}
+function decodeSessionToken(token) {
+	const payload = decodeTokenPayload(token);
+	if (!payload) return null;
+	const o = payload.o;
+	return {
+		userId: typeof payload.sub === "string" ? payload.sub : null,
+		orgId: o && typeof o === "object" && typeof o.id === "string" ? o.id : typeof payload.org_id === "string" ? payload.org_id : null,
+		role: o && typeof o === "object" && typeof o.rol === "string" ? `org:${o.rol}` : typeof payload.org_role === "string" ? payload.org_role : null,
+		expiresAt: typeof payload.exp === "number" ? (/* @__PURE__ */ new Date(payload.exp * 1e3)).toISOString() : null
+	};
+}
+
 //#endregion
 //#region src/commands/add.ts
 /**
@@ -7463,7 +7533,7 @@ async function login(env, options) {
 	if (options.token !== void 0) {
 		token = options.token.trim();
 		if (decodeTokenPayload(token) === null) throw new Error("The provided --token value is not a JWT");
-	} else token = await collectTokenViaBrowser(options.webUrl ?? env.COW_WEB_URL ?? "http://localhost:5273", 3e5, options.noOpen === true);
+	} else token = await collectTokenViaBrowser(options.webUrl ?? env.COW_WEB_URL ?? (await readCowConfig(process.cwd()))?.webUrl ?? "http://localhost:5273", 3e5, options.noOpen === true);
 	const claims = decodeSessionToken(token);
 	if (claims === null) throw new Error("Token is not a decodable JWT");
 	if (claims.userId === null) throw new Error("Token has no subject claim. Is it a Clerk session token?");
@@ -7503,7 +7573,14 @@ function collectTokenViaBrowser(webUrl, timeoutMs = 18e4, noOpen = false) {
 				clearTimeout(timer);
 				try {
 					const body = JSON.parse(Buffer.concat(chunks).toString("utf8"));
-					const token = typeof body === "object" && body !== null && "token" in body ? body.token : void 0;
+					const field = (name) => typeof body === "object" && body !== null && name in body ? body[name] : void 0;
+					if (field("denied") === true) {
+						res.writeHead(200, { "Content-Type": "application/json" });
+						res.end(JSON.stringify({ ok: true }));
+						reject(/* @__PURE__ */ new Error("Sign-in was denied in the browser. No access was granted."));
+						return;
+					}
+					const token = field("token");
 					if (typeof token !== "string" || token.length === 0) {
 						res.writeHead(400, { "Content-Type": "application/json" });
 						res.end(JSON.stringify({ error: "missing token" }));
@@ -7550,7 +7627,7 @@ function openBrowser(url) {
 //#region src/commands/auth.ts
 /** login/logout/whoami: session-token management, no contract route. */
 function registerAuth(program, env, io) {
-	program.command("login").description("authenticate via the dashboard browser flow (or --token) and cache the session token").option("--token <jwt>", "paste a Clerk session token instead of the browser flow").option("--web <url>", `dashboard URL (default ${DEFAULT_WEB_URL})`).option("--no-open", "do not open the browser; print the URL and wait (headless/agent use)").action(async (opts) => {
+	program.command("login").description("authenticate via the dashboard browser flow (or --token) and cache the session token").option("--token <jwt>", "paste a Clerk session token instead of the browser flow").option("--web <url>", `dashboard URL; overrides COW_WEB_URL and webUrl in the project config (default ${DEFAULT_WEB_URL})`).option("--no-open", "do not open the browser; print the URL and wait (headless/agent use)").action(async (opts) => {
 		const outcome = await login(env, {
 			token: opts.token,
 			webUrl: opts.web,
@@ -8599,6 +8676,21 @@ const domains = defineModule(defineRoute({
 		...sessionErrors,
 		...errors("conflict", "validation_failed", "malformed_request", "dependency_unavailable")
 	}
+}), defineRoute({
+	method: "get",
+	path: "/v1/domains/{id}/dns-setup",
+	operationId: "domains.dnsSetup",
+	tags: ["domains"],
+	summary: "Where the DNS provider can publish the records",
+	description: "The Domain Connect link for this domain's DNS provider, which shows the admin the records and asks them to confirm. `url` is null when the provider does not support it.",
+	security: SESSION_AUTH,
+	surfaces: HIDDEN_FROM_TOOLS,
+	request: { params: params$7 },
+	responses: {
+		200: envelope(domainDnsSetupSchema),
+		...sessionErrors,
+		...errors("not_found")
+	}
 }), defineRoute({
 	method: "post",
 	path: "/v1/domains/{id}/verify",
@@ -10117,23 +10209,55 @@ async function latestRelease(client, project) {
 	} })).data[0] ?? null;
 }
 /**
+* How far a compile has got, as `18/26`. Only meaningful while the release is
+* pending: a `ready` release can legitimately sit below its total (every row
+* from before the counter existed reads 0, and the last progress write is
+* advisory), so completion is read from the status, never from this.
+*/
+function compiledFraction(release) {
+	return `${release.compiledEntries}/${release.totalEntries}`;
+}
+/**
+* The progress writer for a terminal, or nothing at all when there is no one
+* watching. It rewrites one line on stderr, so what a command prints to
+* stdout is the same bytes whether or not a terminal is attached.
+*
+* The flag is stdout's: a redirected push is a script reading the summary,
+* and it gets no cursor codes in either stream. `--json` is silent for the
+* same reason, since its whole output is one envelope.
+*/
+function progressLineFor(io, json) {
+	if (!io.isTTY || json === true) return;
+	let drawn = false;
+	return (text) => {
+		if (text === "" && !drawn) return;
+		drawn = text !== "";
+		io.stderr(`\r\x1b[2K${text}`);
+	};
+}
+/**
 * Poll until the compile settles. Backs off from a quarter second to two,
 * because a small project is ready almost at once and a large one is not
 * worth asking about ten times a second.
 */
-async function awaitCompile(client, releaseId, sleep) {
+async function awaitCompile(client, releaseId, sleep, progress) {
 	let waited = 0;
 	let interval = POLL_START_MS;
-	for (;;) {
-		const { data } = await client.request(contract.releases["releases.get"], { params: { id: releaseId } });
-		if (data.status !== "pending") return data;
-		if (waited >= POLL_BUDGET_MS) throw new Error(`Release ${releaseId} is still compiling after ${Math.round(waited / 1e3)}s. Check \`cow releases get ${releaseId}\`.`);
-		await sleep(interval);
-		waited += interval;
-		interval = Math.min(interval * 2, POLL_MAX_MS);
+	try {
+		for (;;) {
+			const { data } = await client.request(contract.releases["releases.get"], { params: { id: releaseId } });
+			if (data.status !== "pending") return data;
+			if (waited >= POLL_BUDGET_MS) throw new Error(`Release ${releaseId} is still compiling after ${Math.round(waited / 1e3)}s (${compiledFraction(data)} compiled). Check \`cow releases get ${releaseId}\`.`);
+			progress?.(`Compiling ${compiledFraction(data)}`);
+			await sleep(interval);
+			waited += interval;
+			interval = Math.min(interval * 2, POLL_MAX_MS);
+		}
+	} finally {
+		progress?.("");
 	}
 }
-async function pushProject({ client, projectDir, force, sleep = (ms) => setTimeout$1(ms) }) {
+async function pushProject({ client, projectDir, force, sleep = (ms) => setTimeout$1(ms), progress }) {
 	const { manifest, config } = await buildProject(projectDir);
 	const project = await ensureProject(client, config.project);
 	if (project.orgId !== config.orgId) throw new Error(`cow.json is for ${config.orgId} but the credential belongs to ${project.orgId}. Log in to that organization, or use its deploy key.`);
@@ -10158,7 +10282,7 @@ async function pushProject({ client, projectDir, force, sleep = (ms) => setTimeo
 		release: await awaitCompile(client, (await client.request(contract.releases["releases.create"], { body: {
 			manifest,
 			project: project.name
-		} })).data.id, sleep),
+		} })).data.id, sleep, progress),
 		uploaded
 	};
 }
@@ -10179,7 +10303,8 @@ function registerPush(program, clientFor, io) {
 		const outcome = await pushProject({
 			client: await clientFor(merged),
 			projectDir: process.cwd(),
-			force: opts.force === true
+			force: opts.force === true,
+			progress: progressLineFor(io, merged.json === true)
 		});
 		if (merged.json === true) emit({ data: outcome.release }, io, true);
 		else io.stdout(`${pushSummary(outcome)}\n`);
@@ -10190,7 +10315,7 @@ function registerPush(program, clientFor, io) {
 //#endregion
 //#region src/commands/deploy.ts
 /** The release to deploy, and the push message when a push produced it. */
-async function releaseToDeploy({ client, projectDir, releaseId, sleep }) {
+async function releaseToDeploy({ client, projectDir, releaseId, sleep, progress }) {
 	if (releaseId) {
 		const { data } = await client.request(contract.releases["releases.get"], { params: { id: releaseId } });
 		return { release: data };
@@ -10198,7 +10323,8 @@ async function releaseToDeploy({ client, projectDir, releaseId, sleep }) {
 	const pushed = await pushProject({
 		client,
 		projectDir,
-		sleep
+		sleep,
+		progress
 	});
 	return {
 		release: pushed.release,
@@ -10207,7 +10333,7 @@ async function releaseToDeploy({ client, projectDir, releaseId, sleep }) {
 }
 async function deployProject(options) {
 	const { release, skipped } = await releaseToDeploy(options);
-	if (release.status !== "ready") throw new Error(release.status === "failed" ? `${release.id} #${release.seq} failed to compile, so there is nothing to deploy: ${release.error ?? "no reason recorded"}` : `${release.id} #${release.seq} is still compiling; wait for it to be ready.`);
+	if (release.status !== "ready") throw new Error(release.status === "failed" ? `${release.id} #${release.seq} failed to compile, so there is nothing to deploy: ${release.error ?? "no reason recorded"}` : `${release.id} #${release.seq} is still compiling (${compiledFraction(release)} compiled); wait for it to be ready.`);
 	const { data } = await options.client.request(contract.deployments["deployments.create"], { body: { releaseId: release.id } });
 	return {
 		deployment: data,
@@ -10234,7 +10360,8 @@ function registerDeploy(program, clientFor, env, io) {
 		const outcome = await deployProject({
 			client: await clientFor(merged),
 			projectDir: process.cwd(),
-			releaseId: opts.release
+			releaseId: opts.release,
+			progress: progressLineFor(io, merged.json === true)
 		});
 		if (merged.json === true) {
 			emit({ data: outcome.deployment }, io, true);
@@ -11236,11 +11363,15 @@ function emit(result, io, json) {
 }
 function buildProgram(env, io) {
 	const program = new Command();
-	program.name("cow").description("Admin CLI for Cowliss: a thin client of the dashboard API").option("--api <url>", "API base URL (overrides env and saved config)").option("--env <environment>", `environment to act on: ${ENVIRONMENTS.join(" | ")} (overrides COW_ENVIRONMENT; default ${DEFAULT_ENVIRONMENT})`, parseEnvironment).option("--json", "force compact single-line JSON output");
+	program.name("cow").description("Admin CLI for Cowliss: a thin client of the dashboard API").option("--api <url>", "API base URL (overrides env and saved config)").option("--env <environment>", `environment to act on: ${ENVIRONMENTS.join(" | ")} (overrides COW_ENVIRONMENT; default ${DEFAULT_ENVIRONMENT})`, parseEnvironment).option("--json", "force compact single-line JSON output").option("--config <file>", `project config to read instead of ${DEFAULT_CONFIG_FILE} (overrides COW_CONFIG)`);
+	program.hook("preAction", () => {
+		const flag = program.opts().config;
+		setConfigFile((typeof flag === "string" ? flag : void 0) ?? env.COW_CONFIG ?? "cow.json");
+	});
 	const clientFor = async (opts) => {
 		const credentials = await readCredentials(env);
 		return createClient({
-			baseUrl: resolveApiUrl(env, credentials, typeof opts.api === "string" ? opts.api : void 0),
+			baseUrl: resolveApiUrl(env, credentials, typeof opts.api === "string" ? opts.api : void 0, (await readCowConfig(process.cwd()))?.apiUrl),
 			auth: async () => resolveCredential(env, await readCredentials(env)).token,
 			headers: async () => ({
 				[ENVIRONMENT_HEADER]: environmentFor(env, opts),
@@ -11285,7 +11416,13 @@ const envSchema = z.object({
 	/** An org deploy key for CI; when set it wins over the cached session (ticket 05 reads it). */
 	COW_DEPLOY_KEY: z.string().min(1).optional(),
 	/** The environment admin calls select; `--env` overrides it, production is the default. */
-	COW_ENVIRONMENT: environmentSchema.optional()
+	COW_ENVIRONMENT: environmentSchema.optional(),
+	/**
+	* The project config to read instead of `cow.json`, so one checkout can
+	* hold both the committed production config and a local override.
+	* `--config` overrides it.
+	*/
+	COW_CONFIG: z.string().min(1).optional()
 });
 function loadEnv() {
 	const parsed = envSchema.safeParse(process.env);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cowliss/cli",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "type": "module",
   "bin": {
     "cow": "./dist/index.js"