@cowliss/cli 0.2.0 → 0.4.0

package/dist/index.js

@@ -7,13 +7,14 @@ import { copyFile, mkdir, readFile, readdir, rm, stat, watch, writeFile } from "
 import { homedir } from "node:os";
 import { basename, dirname, join, relative, resolve, sep } from "node:path";
 import { Command, InvalidArgumentError } from "commander";
-import { existsSync, readFileSync } from "node:fs";
-import { fileURLToPath, pathToFileURL } from "node:url";
 import { execFile, spawn } from "node:child_process";
+import { fileURLToPath, pathToFileURL } from "node:url";
 import { promisify } from "node:util";
 import { MessagePort } from "node:worker_threads";
 import { build, formatMessagesSync } from "esbuild";
 import { create, extract } from "tar";
+import { parse } from "@babel/parser";
+import { existsSync, readFileSync } from "node:fs";
 import { createServer } from "node:http";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
 import { createInterface } from "node:readline/promises";
@@ -121,6 +122,29 @@ const TOPUP_PRESETS_MICROS = [
 */
 const CONSENT_PURPOSES = ["emailMarketing", "dataProcessing"];
 /**
+* The marketing purpose by name, since it is the one every gate, the
+* unsubscribe route, and the developer's own toggle all reach for.
+*/
+const EMAIL_MARKETING = "emailMarketing";
+/**
+* What a purpose means when the profile's map does not answer it, matching
+* the `profiles.consent` column default: marketing is asked for, everything
+* else about the data the developer already sends is granted.
+*/
+const CONSENT_PURPOSE_DEFAULTS = {
+	emailMarketing: false,
+	dataProcessing: true
+};
+/**
+* The `defaults` argument `consentGranted` takes, built from an org's
+* purpose rows. Every surface that renders or gates a purpose reads those
+* rows and then needs this same map, so the reshaping lives here rather
+* than in each of them.
+*/
+function consentDefaultsOf(rows) {
+	return Object.fromEntries(rows.map((row) => [row.key, row.defaultGranted]));
+}
+/**
 * The two classes of send, declared on the template rather than passed per
 * call so the class cannot drift between two sends of the same message.
 *
@@ -261,9 +285,9 @@ const searchQuerySchema = z.string().trim().max(200, "q must be at most 200 char
 * key belongs to and which routes it may reach, never anything a client
 * sends or reads. So /v1/settings/deploy-keys reuses these schemas.
 */
-const nameSchema$4 = z.string().trim().min(1, "name is required").max(100, "name must be at most 100 characters");
+const nameSchema$3 = z.string().trim().min(1, "name is required").max(100, "name must be at most 100 characters");
 /** Body for POST /v1/settings/api-keys. */
-const createApiKeyBodySchema = z.object({ data: z.object({ name: nameSchema$4 }) });
+const createApiKeyBodySchema = z.object({ data: z.object({ name: nameSchema$3 }) });
 /**
 * Query for GET /v1/settings/api-keys. Cursor-paginated like every list
 * endpoint; the cursor is an opaque offset cursor (Clerk pages by
@@ -3295,6 +3319,44 @@ const insertCatalogEventSchema = createInsertSchema(catalogEvents);
 const selectCatalogTraitSchema = createSelectSchema(catalogTraits);
 const insertCatalogTraitSchema = createInsertSchema(catalogTraits);
 
+//#endregion
+//#region ../../packages/db/src/schema/consent-purposes.ts
+/**
+* The consent purposes an org's profiles answer: the two fixed ones, seeded
+* the first time the set is read, plus whatever the org's projects declare
+* in their `cow.json`. One read here returns the whole set, so nothing
+* downstream unions a table with a constant.
+*
+* Org-wide rather than per-project or per-environment: `profiles.consent` is
+* one jsonb map per profile, so an answer given under one project is the
+* same answer under the next, and two projects declaring one key must agree
+* on its label and default or the deploy is refused.
+*
+* A deploy adds and updates rows and never deletes one (ADR 0009): profiles
+* already hold answers against a purpose, and deleting it would orphan them.
+*/
+const consentPurposes = pgTable("consent_purposes", {
+	orgId: text("org_id").notNull(),
+	/** camelCase, and a key in every profile's `consent` map. */
+	key: text("key").notNull(),
+	/** What the dashboard renders beside the switch. */
+	label: text("label").notNull(),
+	/**
+	* What the purpose means for a profile whose map does not answer it. A
+	* declared purpose is marketing-class and denied by default: it is
+	* absent on every profile that already exists.
+	*/
+	defaultGranted: boolean("default_granted").notNull(),
+	/**
+	* The project whose `cow.json` declared it, and the one a disagreeing
+	* deploy is refused in the name of. Null for the two fixed purposes,
+	* which every org has and no project owns.
+	*/
+	projectId: text("project_id"),
+	createdAt: createdAt(),
+	updatedAt: updatedAt()
+}, (table) => [primaryKey({ columns: [table.orgId, table.key] })]);
+
 //#endregion
 //#region ../../packages/db/src/schema/deliveries.ts
 /**
@@ -3338,6 +3400,7 @@ const deliveryStatusEnum = pgEnum("delivery_status", [
 	"skipped_quota",
 	"skipped_frequency_cap",
 	"skipped_consent",
+	"skipped_sender",
 	"skipped_domain",
 	"skipped_ssrf",
 	"would_send",
@@ -3347,6 +3410,7 @@ const deliveryStatusEnum = pgEnum("delivery_status", [
 	"would_skip_quota",
 	"would_skip_frequency_cap",
 	"would_skip_consent",
+	"would_skip_sender",
 	"would_skip_domain",
 	"would_skip_ssrf"
 ]);
@@ -3664,9 +3728,11 @@ const idempotencyKeys = pgTable("idempotency_keys", {
 * creating one when none is known.
 *
 * traits is the merged trait bag (RFC 7386 key-level merge on write).
-* consent is the fixed-purpose consent map from the spec ({ emailMarketing,
-* dataProcessing }, both default true); writes never touch it except the
-* consent editor and the automatic revocations.
+* consent is the fixed-purpose consent map from the spec. Marketing starts
+* denied and data processing granted: nobody is subscribed by the act of
+* being ingested, while the processing the product runs on is the basis the
+* profile exists under at all. It is written by the identify path (a caller
+* passing `consent`), the consent editor, and the automatic revocations.
 *
 * `environment` is the app's, stamped at creation and never changed: a
 * person in development and a person in production are two rows even when
@@ -3690,7 +3756,7 @@ const profiles = pgTable("profiles", {
 	sourceId: text("source_id").notNull(),
 	traits: jsonb("traits").$type().notNull().default({}),
 	consent: jsonb("consent").$type().notNull().default({
-		emailMarketing: true,
+		emailMarketing: false,
 		dataProcessing: true
 	}),
 	mergedInto: text("merged_into"),
@@ -3796,12 +3862,6 @@ const insertJourneyRunSchema = createInsertSchema(journeyRuns);
 //#endregion
 //#region ../../packages/db/src/schema/journeys.ts
 /**
-* The fixed consent purposes from the spec (fixed enum for the prototype).
-* The literal list mirrors CONSENT_PURPOSES in packages/shared; db cannot
-* import it without closing a package cycle (shared -> db).
-*/
-const consentPurposeEnum = pgEnum("consent_purpose", ["emailMarketing", "dataProcessing"]);
-/**
 * Derived journey rows: one per (org, environment, key), upserted from the
 * manifest inside the deploy transaction. Nothing here is authored through
 * the API, which is why there is no id of its own: the key is the name the
@@ -3835,7 +3895,14 @@ const journeys$1 = pgTable("journeys", {
 	/** The author's labels, from the manifest; the dashboard's only grouping. */
 	tags: text("tags").array().notNull().default(sql`'{}'::text[]`),
 	trigger: jsonb("trigger").$type().notNull(),
-	purpose: consentPurposeEnum("purpose").notNull(),
+	/**
+	* The consent purpose this journey's sends are gated on: one of the two
+	* fixed keys or one the project declares in `cow.json`. Text and not an
+	* enum, because the set is the org's `consent_purposes` rows, which a
+	* deploy checks the key against; a database enum could only ever hold
+	* the fixed pair.
+	*/
+	purpose: text("purpose").notNull(),
 	/** The manifest's `environments` contains this environment. */
 	active: boolean("active").notNull(),
 	spine: jsonb("spine").$type().notNull(),
@@ -3929,6 +3996,19 @@ const orgSettings = pgTable("org_settings", {
 		mode: "date",
 		precision: 3
 	}),
+	/**
+	* When this org's SES tenant was created and fully associated. Null means
+	* it has none yet, and a send goes out untenanted; set means the send names
+	* the tenant, so SES meters that org's reputation on its own and keeps its
+	* suppressed addresses off every other org's list. The tenant's name is the
+	* org id. Written last by ensureOrgTenant, never before the associations:
+	* a tenant SES cannot send for must not look ready here.
+	*/
+	sesTenantAt: timestamp("ses_tenant_at", {
+		withTimezone: true,
+		mode: "date",
+		precision: 3
+	}),
 	createdAt: createdAt(),
 	updatedAt: updatedAt()
 });
@@ -4056,8 +4136,15 @@ const releaseStatusEnum = pgEnum("release_status", [
 * it doubles as the tenancy key.
 *
 * Immutable except for the compile result, which is why there is no
-* `updatedAt`: `compiledAt` and `error` are the only fields that ever move,
-* and they move exactly once.
+* `updatedAt`: `compiledAt`, `error` and `compiledEntries` are the only
+* fields that ever move. The first two move exactly once; `compiledEntries`
+* climbs while the compile runs, because a push is minutes of silence
+* otherwise and the manifest's own length is the denominator.
+*
+* A counter rather than a row per entry: the question both the CLI and the
+* dashboard ask is "how far along", which one integer answers at a fraction
+* of the write volume. Naming which entry is compiling needs per-entry rows
+* and is a different question.
 */
 const releases$1 = pgTable("releases", {
 	id: text("id").primaryKey(),
@@ -4075,7 +4162,9 @@ const releases$1 = pgTable("releases", {
 		mode: "date",
 		precision: 3
 	}),
-	error: text("error")
+	error: text("error"),
+	/** How many manifest entries have compiled and passed their checks. */
+	compiledEntries: integer("compiled_entries").notNull().default(0)
 }, (table) => [uniqueIndex("releases_org_id_project_id_seq_unique").on(table.orgId, table.projectId, table.seq), index("releases_org_id_created_at_idx").on(table.orgId, table.createdAt)]);
 const selectReleaseSchema = createSelectSchema(releases$1);
 const insertReleaseSchema = createInsertSchema(releases$1);
@@ -4457,14 +4546,14 @@ const appSchema = selectAppSchema.extend({
 	/** The most recent accepted delivery across those sources. */
 	lastReceivedAt: z.iso.datetime().nullable()
 });
-const nameSchema$3 = z.string().trim().min(1, "name is required").max(100, "name must be at most 100 characters");
+const nameSchema$2 = z.string().trim().min(1, "name is required").max(100, "name must be at most 100 characters");
 const createAppBodySchema = z.object({ data: z.object({
-	name: nameSchema$3,
+	name: nameSchema$2,
 	/** Immutable after creation; production when omitted. */
 	environment: environmentSchema.default("production")
 }) });
 const updateAppBodySchema = z.object({ data: z.object({
-	name: nameSchema$3.optional(),
+	name: nameSchema$2.optional(),
 	status: z.literal("archived").optional()
 }).refine((data) => data.name !== void 0 || data.status !== void 0, { message: "at least one field (name or status) is required" }) });
 /** `q` is a substring search over the app's name; `status` narrows to one state. */
@@ -4565,6 +4654,269 @@ const identifierDtoSchema = z.object({
 	createdAt: z.iso.datetime()
 });
 
+//#endregion
+//#region ../../packages/shared/src/journeys-v2/manifest.ts
+/**
+* The release manifest (spec: Build; Push and compile): what `cow build`
+* extracts from a project and `cow push` uploads with the bundles. The
+* server validates it with these schemas, compiles every bundle, and stores
+* the compiled form on the release row.
+*/
+/**
+* A journey or template key: the file basename under `journeys/` or
+* `emails/`, kebab-case and unique across the project. Becomes part of the
+* Temporal workflow id and travels in the journey chain, so it stays short.
+*/
+const JOURNEY_KEY_PATTERN = /^[a-z0-9]+(-[a-z0-9]+)*$/;
+const journeyKeySchema = z.string().max(64).regex(JOURNEY_KEY_PATTERN, "key must be kebab-case (a-z, 0-9, hyphens)");
+/**
+* An author's labels on a journey or a template: how the dashboard groups
+* and filters them, and the only grouping there is. Case is kept as
+* written, each entry is trimmed and non-empty, the list is deduplicated,
+* and both ceilings are low on purpose: tags are a handful of words, not a
+* taxonomy. Absent means `[]`.
+*
+* The count is capped on the list as written, before the deduplication, so
+* a 21st entry is an error even when it is a repeat: that keeps `maxItems`
+* in the generated JSON Schema, and an author who wrote 21 tags wants to
+* hear about it.
+*/
+const tagsSchema = z.array(z.string().trim().min(1).max(50, "a tag must be at most 50 characters")).max(20, "a journey or template takes at most 20 tags").default([]).transform((tags) => [...new Set(tags)]);
+/**
+* A consent purpose key: camelCase, matching the fixed `emailMarketing` and
+* `dataProcessing`. Purposes are keys in the `consent` map a customer reads
+* on their own profile, which is why they are not the kebab-case of a
+* journey key.
+*/
+const CONSENT_PURPOSE_KEY_PATTERN = /^[a-z][a-zA-Z0-9]*$/;
+/**
+* One purpose key wherever a key is named rather than declared: a journey's
+* `purpose`, and the keys of the consent patch an identify carries. The set
+* a key is checked against is the org's declared rows, which no schema can
+* see, so validation here is the shape only; the deploy and the ingestion
+* write refuse a key the org has not declared.
+*/
+const consentPurposeKeySchema = z.string().max(50, "a purpose key must be at most 50 characters").regex(CONSENT_PURPOSE_KEY_PATTERN, "a consent purpose key must be camelCase (a letter first, then letters and digits)");
+/**
+* One purpose a project declares in `cow.json` (spec: Decisions). A declared
+* purpose is marketing-class and sits under the `emailMarketing` umbrella,
+* so `denied` is the only default it may carry: the purpose is absent on
+* every profile that already exists, and a granted default would answer for
+* all of them at once.
+*
+* The field stays required rather than disappearing, so every `cow.json` and
+* every stored manifest written before this still parses, and the column
+* behind it still holds `granted` for the seeded `dataProcessing` row: this
+* is a refusal at declaration time, not a narrower storage shape.
+*
+* The two fixed purposes cannot be declared. They are seeded for every org
+* and owned by no project, so a project redeclaring one would be renaming
+* the master switch every other project's journeys hang off.
+*/
+const declaredPurposeSchema = z.strictObject({
+	key: consentPurposeKeySchema.refine((key) => !CONSENT_PURPOSES.includes(key), `${CONSENT_PURPOSES.join(" and ")} are fixed purposes and cannot be declared`),
+	/** What the dashboard and the account modal render beside the switch. */
+	label: z.string().trim().min(1).max(50, "a purpose label must be at most 50 characters"),
+	/** What the purpose means for a profile whose map does not answer it. */
+	default: z.literal("denied", "a declared purpose's \"default\" must be \"denied\": nobody has answered it yet, and a granted default would opt every profile you already have into it")
+});
+/**
+* The purposes one project declares. Capped low the way tags are: a purpose
+* is a category a recipient reads on a preferences switch, not a taxonomy.
+* Absent means the project declares none, which is every project today.
+*/
+const purposesSchema = z.array(declaredPurposeSchema).max(20, "a project declares at most 20 consent purposes");
+/**
+* A matcher field: one pattern or a non-empty list of them, a list being a
+* disjunction. See `matchesPattern` in ../patterns for the dialect (`*`
+* only) and for why a pattern whose literal prefix is not `system.` never
+* reaches a system event.
+*/
+const onePatternSchema = z.string().min(1).max(200, "a pattern must be at most 200 characters");
+const patternSchema = z.union([onePatternSchema, z.array(onePatternSchema).min(1).max(20, "a matcher takes at most 20 patterns")]);
+/**
+* What starts a journey: an event (optionally narrowed to an app id or a
+* list of them) or a segment entry. The registry DTO in `../journeys`
+* reuses it.
+*
+* Both members are strict, so a journey holding the retired `source` key
+* fails to compile a release instead of silently triggering on every app.
+* There is deliberately no pipe filter: a trigger narrows by the app the
+* write is attributed to, the same token a segment definition names.
+*/
+const triggerSchema = z.union([z.strictObject({
+	event: patternSchema,
+	appId: patternSchema.optional()
+}), z.strictObject({ segment: z.string().min(1) })]);
+/**
+* A destination's name: the token a journey addresses it by, in a
+* `send.webhook` call or a journey's `senderIdentity`.
+*
+* Defined here rather than beside the destinations contract, and imported
+* from here by it, because a journey manifest names one and the guest layer
+* is bundled into every tenant module: importing it the other way round
+* would pull the Drizzle destinations table into all of them.
+*/
+const destinationNameSchema = z.string().trim().min(1, "name is required").max(100, "name must be at most 100 characters");
+/** A content address: `sha256:` plus the lowercase hex digest. */
+const digestSchema = z.string().regex(/^sha256:[0-9a-f]{64}$/, "digest must be sha256:<64 hex>");
+/**
+* The names of the capability calls a journey may make. Grouped by verb and
+* then channel (`send.email`, not `email.send`), because the verb is the
+* thing a journey author is choosing between and the name should read the
+* way the code is written.
+*/
+const COMMAND_NAMES = [
+	"sleep",
+	"waitForEvent",
+	"send.email",
+	"send.webhook",
+	"traits.set",
+	"traits.unset",
+	"profile.get",
+	"profiles.get",
+	"events.track",
+	"restart"
+];
+/**
+* What a spine entry can be: every capability call, plus the control flow
+* `cow build` reads off the journey's source: an `if` (a condition, with
+* `steps` and `otherwise`), a `loop` (with `steps` as its body), and the `end`
+* of a path.
+*/
+const SPINE_ENTRY_NAMES = [
+	...COMMAND_NAMES,
+	"if",
+	"loop",
+	"end"
+];
+const spineEntrySchema = z.object({
+	name: z.enum(SPINE_ENTRY_NAMES),
+	detail: z.string().max(200).optional(),
+	/**
+	* The sender identity a `send.email` call named for itself, overriding
+	* the journey's own. Present only when the author wrote one on the call,
+	* which is what lets the deploy warning and the journey detail page name
+	* the override without re-reading the code.
+	*/
+	senderIdentity: z.string().max(100).optional(),
+	/** A `waitForEvent` timeout, as the author wrote it. */
+	timeout: z.string().max(50).optional(),
+	get steps() {
+		return z.array(spineEntrySchema).optional();
+	},
+	get otherwise() {
+		return z.array(spineEntrySchema).optional();
+	}
+}).meta({ id: "JourneySpineEntry" });
+const manifestJourneySchema = z.object({
+	key: journeyKeySchema,
+	/** The author's labels; the dashboard's only grouping. */
+	tags: tagsSchema,
+	trigger: triggerSchema,
+	/**
+	* A fixed purpose or one the project declares. Checked against the org's
+	* declared set at deploy time, not here: a manifest is built and pushed
+	* without ever reaching the org whose rows say what exists.
+	*/
+	purpose: consentPurposeKeySchema,
+	/**
+	* The sender identity every `send.email` in this journey goes out as,
+	* unless the call names its own. A name, never a `dst_` id: an org has one
+	* row per environment, so an id would send in production and fail in
+	* development, which is the one thing a journey must not do.
+	*
+	* Optional here and required at `defineJourney`, exactly like `purposes`: a
+	* release pushed before the field existed carries none and its stored
+	* manifest still parses. The author's build is where the error is useful.
+	*/
+	senderIdentity: destinationNameSchema.optional(),
+	/** The author's rollout gate: the journey is active only in these. */
+	environments: environmentsSchema,
+	spine: z.array(spineEntrySchema),
+	bundle: digestSchema
+});
+const manifestTemplateSchema = z.object({
+	key: journeyKeySchema,
+	/** The author's labels; the dashboard's only grouping. */
+	tags: tagsSchema,
+	sendClass: z.enum(SEND_CLASSES),
+	/** True asks the host to mint a signed `verifyUrl` prop at send time. */
+	verifyLink: z.boolean(),
+	/** JSON Schema of the template's `props`, converted by `cow build`. */
+	propsSchema: z.record(z.string(), z.unknown()),
+	bundle: digestSchema
+});
+function uniqueKeys(items, ctx, path) {
+	const seen = /* @__PURE__ */ new Set();
+	for (const [index, item] of items.entries()) {
+		if (seen.has(item.key)) ctx.addIssue({
+			code: "custom",
+			message: `duplicate ${path} key "${item.key}"`,
+			path: [
+				path,
+				index,
+				"key"
+			]
+		});
+		seen.add(item.key);
+	}
+}
+/**
+* What `cow build` writes to `.cow/build/manifest.json`, and the shape a
+* release row stores for good.
+*
+* `protocol` is any positive integer rather than the current constant on
+* purpose: a release is immutable and an execution stays pinned to the one it
+* started on, so the day the protocol is bumped every stored release must
+* still parse, or the runner, the deploy, and every API response the client
+* validates all break at once for any org with history. The literal lives at
+* push time only (`createReleaseBodySchema`), which is where a stale CLI is
+* the developer's own fixable problem, and deploy plus the runner refuse a
+* release built for another protocol with a message naming both numbers.
+*/
+const manifestSchema = z.object({
+	protocol: z.number().int().positive(),
+	/** The `@cowliss/cli` version the project was built with. */
+	sdk: z.string().min(1),
+	journeys: z.array(manifestJourneySchema).max(RELEASE_LIMITS.journeys),
+	templates: z.array(manifestTemplateSchema).max(RELEASE_LIMITS.templates),
+	/**
+	* The consent purposes this project declares, copied from `cow.json`.
+	* Optional rather than defaulted: a release pushed before purposes
+	* existed carries none, and its stored manifest still parses.
+	*/
+	purposes: purposesSchema.optional(),
+	/** Digest of the gzipped source tarball. */
+	source: digestSchema
+}).superRefine((manifest, ctx) => {
+	uniqueKeys(manifest.journeys, ctx, "journeys");
+	uniqueKeys(manifest.templates, ctx, "templates");
+	uniqueKeys(manifest.purposes ?? [], ctx, "purposes");
+});
+/**
+* The manifest as the release row stores it once compilation succeeded:
+* the pushed manifest plus the compiled module digest per key, and the
+* digest of the Javy engine plugin the toolchain that compiled them was
+* built from.
+*
+* Journeys and templates are keyed separately because they share a key
+* space: `welcome.ts` and `welcome.tsx` are one journey and the email it
+* sends in every example, and a flat map would let one overwrite the other.
+*
+* `plugin` is a toolchain record, not a linked artifact: modules are
+* statically linked, so the plugin bytes are inside each module. It says
+* which engine compiled the release, which is what a later bug report or a
+* reproducible rebuild needs.
+*/
+const compiledManifestSchema = manifestSchema.safeExtend({
+	modules: z.object({
+		journeys: z.record(journeyKeySchema, digestSchema),
+		templates: z.record(journeyKeySchema, digestSchema)
+	}),
+	plugin: digestSchema
+});
+
 //#endregion
 //#region ../../packages/shared/src/timestamp.ts
 /**
@@ -4606,6 +4958,21 @@ const traitBagSchema = z.custom((value) => value !== null && typeof value === "o
 	additionalProperties: true
 });
 /**
+* A partial map over the org's consent purposes, applied as an RFC 7386
+* merge patch, so omitting a purpose leaves it as it was. At least one
+* purpose is required: an empty patch is a no-op request, not a valid one.
+*
+* The key schema is the shape only, because purposes are declared per org
+* and no schema can see which. It is still a trust boundary: a key that is
+* not a purpose key never reaches the jsonb map, and the ingestion write
+* refuses the ones this org has not declared.
+*
+* It lives here rather than beside the dashboard's consent editor because
+* `identify` carries it too: the grant has to have a route in through
+* ingestion, or the only thing anyone can express is the revocation.
+*/
+const consentPatchSchema = z.partialRecord(consentPurposeKeySchema.meta({ examples: [EMAIL_MARKETING] }), z.boolean()).refine((data) => Object.keys(data).length > 0, { message: "at least one consent purpose is required" });
+/**
 * The identify payload fields, shared between the single-call body schema
 * and the batch item schema (which drops `sourceId`: a batch names one
 * source for every item) so both wire shapes stay in sync.
@@ -4617,6 +4984,7 @@ const identifyFieldsSchema = z.object({
 	sourceId: z.string().min(1, "sourceId is required"),
 	identifiers: identifiersSchema,
 	traits: traitBagSchema.default({}),
+	consent: consentPatchSchema.optional(),
 	timestamp: z.iso.datetime().optional(),
 	messageId: z.string().optional()
 });
@@ -4936,7 +5304,7 @@ function propertyTypeLabel(type) {
 * in its trigger unless it is handed one.
 */
 const PROPERTY_TYPE_LABELS = Object.fromEntries(PROPERTY_TYPES.map((type) => [type, propertyTypeLabel(type)]));
-const nameSchema$2 = z.string().trim().min(1, "name is required").max(200, "name must be at most 200 characters");
+const nameSchema$1 = z.string().trim().min(1, "name is required").max(200, "name must be at most 200 characters");
 const propertiesSchema = z.record(z.string().min(1).max(200), propertyTypeSchema);
 const catalogEventSchema = selectCatalogEventSchema.extend({
 	properties: propertiesSchema,
@@ -4944,7 +5312,7 @@ const catalogEventSchema = selectCatalogEventSchema.extend({
 	updatedAt: z.iso.datetime()
 });
 const createCatalogEventBodySchema = z.object({ data: z.object({
-	name: nameSchema$2,
+	name: nameSchema$1,
 	properties: propertiesSchema.default({})
 }) });
 /**
@@ -4959,7 +5327,7 @@ const catalogTraitSchema = selectCatalogTraitSchema.extend({
 	updatedAt: z.iso.datetime()
 });
 const createCatalogTraitBodySchema = z.object({ data: z.object({
-	name: nameSchema$2,
+	name: nameSchema$1,
 	type: propertyTypeSchema
 }) });
 /**
@@ -5013,6 +5381,28 @@ const quarantineActionBodySchema = z.object({ data: z.object({
 	name: z.string().min(1)
 }) });
 
+//#endregion
+//#region ../../packages/shared/src/consent.ts
+/**
+* One consent purpose as an org holds it. Every surface that renders a
+* purpose reads these rows rather than a constant: a purpose a project
+* declared in `cow.json` exists only as a row, so a label kept anywhere else
+* would answer nothing for it.
+*/
+const consentPurposeSchema = z.object({
+	key: consentPurposeKeySchema,
+	/** What a switch is labelled with, from the project that declared it. */
+	label: z.string(),
+	/** What the purpose means for a profile whose map does not answer it. */
+	defaultGranted: z.boolean()
+});
+/**
+* Query for GET /v1/consent-purposes. Cursor-paginated like every list
+* endpoint, even though an org holds a handful: the page shape is the
+* convention, not an estimate of how many rows there are.
+*/
+const listConsentPurposesQuerySchema = paginationQuerySchema;
+
 //#endregion
 //#region ../../packages/shared/src/delivery.ts
 /**
@@ -5188,8 +5578,9 @@ const destinationSchema = selectDestinationSchema.extend({
 	signingSecret: true,
 	consecutiveFailures: true
 });
+/** The two kinds of destination, from the table's own enum. */
+const destinationTypeSchema = destinationSchema.shape.type;
 const destinationCreatedSchema = destinationSchema.extend({ signingSecret: z.string().optional() });
-const nameSchema$1 = z.string().trim().min(1, "name is required").max(100, "name must be at most 100 characters");
 const webhookConfigSchema = z.object({ url: z.url("config.url must be a valid URL").refine((url) => {
 	try {
 		return ["http:", "https:"].includes(new URL(url).protocol);
@@ -5214,14 +5605,14 @@ const senderIdentityConfigSchema = z.object({
 * what gives react-hook-form a non-union field path to register.
 */
 const webhookDestinationInputSchema = z.object({
-	name: nameSchema$1,
+	name: destinationNameSchema,
 	/** The environment this destination lives in; immutable after creation. */
 	environment: environmentSchema,
 	type: z.literal("webhook"),
 	config: webhookConfigSchema
 });
 const senderIdentityDestinationInputSchema = z.object({
-	name: nameSchema$1,
+	name: destinationNameSchema,
 	/** The environment this destination lives in; immutable after creation. */
 	environment: environmentSchema,
 	type: z.literal("sender_identity"),
@@ -5238,12 +5629,19 @@ const createDestinationBodySchema = z.object({ data: z.discriminatedUnion("type"
 * `enabled: false` is the same switch operated by hand.
 */
 const updateDestinationBodySchema = z.object({ data: z.object({
-	name: nameSchema$1.optional(),
+	name: destinationNameSchema.optional(),
 	config: z.unknown().optional(),
 	enabled: z.boolean().optional()
 }).refine((data) => data.name !== void 0 || data.config !== void 0 || data.enabled !== void 0, { message: "at least one field (name, config, or enabled) is required" }) });
-/** `q` is a substring search over the destination's name. */
-const listDestinationsQuerySchema = paginationQuerySchema.extend({ q: searchQuerySchema });
+/**
+* `q` is a substring search over the destination's name; `type` narrows to
+* one kind, because the webhooks page and the sender identities section on
+* the domains page each want one and the table holds both.
+*/
+const listDestinationsQuerySchema = paginationQuerySchema.extend({
+	q: searchQuerySchema,
+	type: destinationTypeSchema.optional()
+});
 
 //#endregion
 //#region ../../packages/shared/src/domains.ts
@@ -5294,6 +5692,16 @@ const createSenderDomainBodySchema = z.object({ data: senderDomainInputSchema })
 const updateSenderDomainBodySchema = z.object({ data: z.object({ clickTracking: z.boolean() }) });
 /** `q` is a substring search over the domain string. */
 const listSenderDomainsQuerySchema = paginationQuerySchema.extend({ q: searchQuerySchema });
+/**
+* Where the one-click DNS setup sends the admin, or null when their DNS
+* provider does not offer it. Computed per request (it costs a DNS lookup
+* and two calls to the provider), never stored.
+*/
+const domainDnsSetupSchema = z.object({
+	url: z.url().nullable(),
+	/** The DNS provider's own name for itself, for the button's label. */
+	provider: z.string().nullable()
+});
 
 //#endregion
 //#region ../../packages/shared/src/patterns.ts
@@ -5378,172 +5786,24 @@ function patternPlaceholder(pattern) {
 }
 
 //#endregion
-//#region ../../packages/shared/src/journeys-v2/manifest.ts
+//#region ../../packages/shared/src/journeys-v2/guest.ts
 /**
-* The release manifest (spec: Build; Push and compile): what `cow build`
-* extracts from a project and `cow push` uploads with the bundles. The
-* server validates it with these schemas, compiles every bundle, and stores
-* the compiled form on the release row.
+* The guest protocol (spec: Guest protocol): the JSON a compiled module
+* reads on stdin and writes on stdout. The sandbox worker parses every byte
+* a guest returns with these schemas before anything acts on it; the guest
+* SDK and the Node simulator produce and consume the same shapes.
 */
-/**
-* A journey or template key: the file basename under `journeys/` or
-* `emails/`, kebab-case and unique across the project. Becomes part of the
-* Temporal workflow id and travels in the journey chain, so it stays short.
-*/
-const JOURNEY_KEY_PATTERN = /^[a-z0-9]+(-[a-z0-9]+)*$/;
-const journeyKeySchema = z.string().max(64).regex(JOURNEY_KEY_PATTERN, "key must be kebab-case (a-z, 0-9, hyphens)");
-/**
-* An author's labels on a journey or a template: how the dashboard groups
-* and filters them, and the only grouping there is. Case is kept as
-* written, each entry is trimmed and non-empty, the list is deduplicated,
-* and both ceilings are low on purpose: tags are a handful of words, not a
-* taxonomy. Absent means `[]`.
-*
-* The count is capped on the list as written, before the deduplication, so
-* a 21st entry is an error even when it is a repeat: that keeps `maxItems`
-* in the generated JSON Schema, and an author who wrote 21 tags wants to
-* hear about it.
-*/
-const tagsSchema = z.array(z.string().trim().min(1).max(50, "a tag must be at most 50 characters")).max(20, "a journey or template takes at most 20 tags").default([]).transform((tags) => [...new Set(tags)]);
-/**
-* A matcher field: one pattern or a non-empty list of them, a list being a
-* disjunction. See `matchesPattern` in ../patterns for the dialect (`*`
-* only) and for why a pattern whose literal prefix is not `system.` never
-* reaches a system event.
-*/
-const onePatternSchema = z.string().min(1).max(200, "a pattern must be at most 200 characters");
-const patternSchema = z.union([onePatternSchema, z.array(onePatternSchema).min(1).max(20, "a matcher takes at most 20 patterns")]);
-/**
-* What starts a journey: an event (optionally narrowed to an app id or a
-* list of them) or a segment entry. The registry DTO in `../journeys`
-* reuses it.
-*
-* Both members are strict, so a journey holding the retired `source` key
-* fails to compile a release instead of silently triggering on every app.
-* There is deliberately no pipe filter: a trigger narrows by the app the
-* write is attributed to, the same token a segment definition names.
-*/
-const triggerSchema = z.union([z.strictObject({
-	event: patternSchema,
-	appId: patternSchema.optional()
-}), z.strictObject({ segment: z.string().min(1) })]);
-/** A content address: `sha256:` plus the lowercase hex digest. */
-const digestSchema = z.string().regex(/^sha256:[0-9a-f]{64}$/, "digest must be sha256:<64 hex>");
-/** The names of the capability calls a journey may make. */
-const COMMAND_NAMES = [
-	"sleep",
-	"waitForEvent",
-	"email.send",
-	"webhook.send",
-	"traits.set",
-	"traits.unset",
-	"profile.get",
-	"profiles.get",
-	"events.track",
-	"restart"
-];
-/**
-* One entry of the step spine `cow build` records by running `run` once
-* against a recording stub. Display only, never trusted: a journey's real
-* control flow is whatever its code does at runtime. `detail` names the
-* template, destination, event, or trait key when the call has one.
-*/
-const spineEntrySchema = z.object({
-	name: z.enum(COMMAND_NAMES),
-	detail: z.string().max(200).optional()
-});
-const manifestJourneySchema = z.object({
-	key: journeyKeySchema,
-	/** The author's labels; the dashboard's only grouping. */
-	tags: tagsSchema,
-	trigger: triggerSchema,
-	purpose: z.enum(CONSENT_PURPOSES),
-	/** The author's rollout gate: the journey is active only in these. */
-	environments: environmentsSchema,
-	spine: z.array(spineEntrySchema),
-	bundle: digestSchema
-});
-const manifestTemplateSchema = z.object({
-	key: journeyKeySchema,
-	/** The author's labels; the dashboard's only grouping. */
-	tags: tagsSchema,
-	sendClass: z.enum(SEND_CLASSES),
-	/** True asks the host to mint a signed `verifyUrl` prop at send time. */
-	verifyLink: z.boolean(),
-	/** JSON Schema of the template's `props`, converted by `cow build`. */
-	propsSchema: z.record(z.string(), z.unknown()),
-	bundle: digestSchema
-});
-function uniqueKeys(items, ctx, path) {
-	const seen = /* @__PURE__ */ new Set();
-	for (const [index, item] of items.entries()) {
-		if (seen.has(item.key)) ctx.addIssue({
-			code: "custom",
-			message: `duplicate ${path} key "${item.key}"`,
-			path: [
-				path,
-				index,
-				"key"
-			]
-		});
-		seen.add(item.key);
-	}
-}
-/** What `cow build` writes to `.cow/build/manifest.json` and `cow push` sends. */
-const manifestSchema = z.object({
-	protocol: z.literal(1),
-	/** The `@cowliss/cli` version the project was built with. */
-	sdk: z.string().min(1),
-	journeys: z.array(manifestJourneySchema).max(RELEASE_LIMITS.journeys),
-	templates: z.array(manifestTemplateSchema).max(RELEASE_LIMITS.templates),
-	/** Digest of the gzipped source tarball. */
-	source: digestSchema
-}).superRefine((manifest, ctx) => {
-	uniqueKeys(manifest.journeys, ctx, "journeys");
-	uniqueKeys(manifest.templates, ctx, "templates");
-});
-/**
-* The manifest as the release row stores it once compilation succeeded:
-* the pushed manifest plus the compiled module digest per key, and the
-* digest of the Javy engine plugin the toolchain that compiled them was
-* built from.
-*
-* Journeys and templates are keyed separately because they share a key
-* space: `welcome.ts` and `welcome.tsx` are one journey and the email it
-* sends in every example, and a flat map would let one overwrite the other.
-*
-* `plugin` is a toolchain record, not a linked artifact: modules are
-* statically linked, so the plugin bytes are inside each module. It says
-* which engine compiled the release, which is what a later bug report or a
-* reproducible rebuild needs.
-*/
-const compiledManifestSchema = manifestSchema.safeExtend({
-	modules: z.object({
-		journeys: z.record(journeyKeySchema, digestSchema),
-		templates: z.record(journeyKeySchema, digestSchema)
-	}),
-	plugin: digestSchema
-});
-
-//#endregion
-//#region ../../packages/shared/src/journeys-v2/guest.ts
-/**
-* The guest protocol (spec: Guest protocol): the JSON a compiled module
-* reads on stdin and writes on stdout. The sandbox worker parses every byte
-* a guest returns with these schemas before anything acts on it; the guest
-* SDK and the Node simulator produce and consume the same shapes.
-*/
-/** A duration as journey code writes it: an ms-style string ("2d") or milliseconds. */
-const durationSchema = z.union([z.string().min(1), z.number().int().nonnegative()]);
-const DURATION_PATTERN = /^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d|w)$/;
-const DURATION_UNIT_MS = {
-	ms: 1,
-	s: 1e3,
-	m: 6e4,
-	h: 36e5,
-	d: 864e5,
-	w: 6048e5
-};
+/** A duration as journey code writes it: an ms-style string ("2d") or milliseconds. */
+const durationSchema = z.union([z.string().min(1), z.number().int().nonnegative()]);
+const DURATION_PATTERN = /^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d|w)$/;
+const DURATION_UNIT_MS = {
+	ms: 1,
+	s: 1e3,
+	m: 6e4,
+	h: 36e5,
+	d: 864e5,
+	w: 6048e5
+};
 /**
 * A duration in milliseconds. The simulator's virtual clock and the runner's
 * timers both need it, and neither may pull in Temporal's `msToNumber` (one
@@ -5588,14 +5848,21 @@ const commandSchema = z.discriminatedUnion("name", [
 		})
 	}),
 	z.object({
-		name: z.literal("email.send"),
+		name: z.literal("send.email"),
 		args: z.strictObject({
 			template: journeyKeySchema,
-			props: properties
+			props: properties,
+			/**
+			* Which sender identity this mail leaves as, by name. Required, and
+			* the guest SDK fills in the journey's own when the call does not name
+			* one, so the host has one resolution path and never has to read the
+			* manifest to find a sender.
+			*/
+			senderIdentity: destinationNameSchema
 		})
 	}),
 	z.object({
-		name: z.literal("webhook.send"),
+		name: z.literal("send.webhook"),
 		args: z.strictObject({
 			destination: z.string().min(1),
 			payload: properties
@@ -5672,7 +5939,7 @@ const executionLimitsSchema = z.object({
 	logLineBytes: z.number().int().positive()
 });
 const journeyStepInputSchema = z.object({
-	protocol: z.literal(1),
+	protocol: z.literal(2),
 	kind: z.literal("journey"),
 	key: journeyKeySchema,
 	event: guestEventSchema,
@@ -5712,7 +5979,7 @@ const journeyStepOutputSchema = z.discriminatedUnion("status", [
 	})
 ]);
 const templateRenderInputSchema = z.object({
-	protocol: z.literal(1),
+	protocol: z.literal(2),
 	kind: z.literal("template"),
 	key: journeyKeySchema,
 	props: properties
@@ -5731,6 +5998,7 @@ const manifestInputSchema = z.object({ kind: z.literal("manifest") });
 const manifestOutputSchema = z.discriminatedUnion("kind", [manifestJourneySchema.pick({
 	trigger: true,
 	purpose: true,
+	senderIdentity: true,
 	environments: true,
 	tags: true
 }).extend({ kind: z.literal("journey") }), manifestTemplateSchema.pick({
@@ -5826,14 +6094,14 @@ const listExecutionsQuerySchema = paginationQuerySchema.extend({
 */
 const journeyTriggerSchema = triggerSchema;
 /**
-* The step spine `cow build` recorded by running the journey once against a
-* recording stub. Display only, never trusted: a journey's real control flow
-* is whatever its code does at run time.
+* The step spine `cow build` read from the journey's source: its calls,
+* conditions, and loops. Display only, never trusted: a journey's real
+* control flow is whatever its code does at run time.
 */
 const journeySpineEntrySchema = spineEntrySchema;
 const journeySchema = selectJourneySchema.extend({
 	trigger: journeyTriggerSchema,
-	purpose: z.enum(CONSENT_PURPOSES),
+	purpose: consentPurposeKeySchema,
 	spine: z.array(journeySpineEntrySchema),
 	enabled: z.boolean(),
 	createdAt: z.iso.datetime(),
@@ -5933,8 +6201,21 @@ const cowConfigSchema = z.strictObject({
 	* slice of the deployed journeys, so every project says which it is.
 	*/
 	project: projectNameSchema,
+	/**
+	* The consent purposes this project declares. They are org-wide, so two
+	* projects declaring one key must agree on its label and default or the
+	* deploy is refused; a deploy adds and updates them and never deletes
+	* one, because profiles hold answers against them.
+	*/
+	purposes: purposesSchema.optional(),
 	/** Overrides the API the CLI talks to; the hosted product needs none. */
-	apiUrl: z.url().optional()
+	apiUrl: z.url().optional(),
+	/**
+	* Overrides the dashboard `cow login` opens. Paired with `apiUrl`: a
+	* login against one Cowliss's dashboard yields a token the other's API
+	* rejects, so a config that names an API names its dashboard too.
+	*/
+	webUrl: z.url().optional()
 }).meta({
 	title: "cow.json",
 	description: "A cow project: the organization and the project it deploys to."
@@ -6007,6 +6288,38 @@ const journeyScenarioSchema = z.object({
 	}))
 });
 
+//#endregion
+//#region ../../packages/shared/src/me.ts
+/**
+* The signed-in developer's own record (/v1/me), as opposed to the profiles
+* their org holds. Cowliss's developers are profiles in the platform
+* workspace, so this is the one place a person answers for themselves rather
+* than an operator answering for someone else, and it is why the routes are
+* not org-scoped: the caller's own org has nothing to do with mail Cowliss
+* sends them.
+*/
+/**
+* One thing Cowliss may send, as this developer has answered it: a purpose
+* the platform workspace declares, plus their own answer to it.
+*/
+const notificationPurposeSchema = consentPurposeSchema.extend({ 
+/** Their answer, or the purpose's default where they have not given one. */
+granted: z.boolean() });
+/**
+* What Cowliss may send this developer beyond the operational mail every
+* account gets: the marketing purposes the platform workspace declares, each
+* with the label it declared and this developer's answer. A list rather than
+* a fixed flag, because Cowliss declares its purposes in a `cow.json` like
+* any other project and may add one without touching this route.
+*/
+const notificationPreferencesSchema = z.object({ purposes: z.array(notificationPurposeSchema) });
+/**
+* Changing them: a merge patch over the purposes above, so a request names
+* only what was just answered and leaves the rest alone. The same patch
+* shape `identify` takes, because that is where the write actually goes.
+*/
+const updateNotificationPreferencesBodySchema = z.object({ data: z.object({ purposes: consentPatchSchema }) });
+
 //#endregion
 //#region ../../packages/shared/src/releases.ts
 /**
@@ -6045,16 +6358,30 @@ const putArtifactQuerySchema = z.object({ kind: z.enum(["bundle", "source"]) });
 *
 * `deployedIn` is not a column: it is the environments whose latest
 * deployment names this release, computed on read, so it can never fall out
-* of sync with the append-only deployment log.
+* of sync with the append-only deployment log. Neither is `totalEntries`:
+* the manifest is already here and its journeys plus its templates are the
+* denominator, so storing it beside `compiledEntries` would only invite the
+* two to disagree.
 */
 const releaseSchema = selectReleaseSchema.extend({
 	manifest: z.union([compiledManifestSchema, manifestSchema]),
 	deployedIn: z.array(environmentSchema),
+	/**
+	* How many journeys and templates the manifest holds: the denominator
+	* `compiledEntries` climbs towards, counted on read rather than stored.
+	*/
+	totalEntries: z.number().int(),
 	createdAt: z.iso.datetime(),
 	compiledAt: z.iso.datetime().nullable()
 });
 const createReleaseBodySchema = z.object({ data: z.object({
-	manifest: manifestSchema,
+	/**
+	* The one place the protocol is pinned to the constant. The stored shape
+	* takes any positive integer, because a release outlives a bump; a push
+	* is a live CLI talking to a live platform, so a mismatch here is a 422
+	* the developer fixes by updating `@cowliss/cli`, and nothing is stored.
+	*/
+	manifest: manifestSchema.safeExtend({ protocol: z.literal(2) }),
 	/** The `cow.json` project this push belongs to. */
 	project: projectNameSchema
 }) });
@@ -6540,13 +6867,6 @@ const findUserQuerySchema = z.object({ identifier: z.string().trim().min(3, "ide
 * endpoint answers with: a merged-away id redirects to its survivor.
 */
 const userDetailSchema = profileDtoSchema.extend({ mergedIds: z.array(z.string()) });
-/**
-* Consent editor body (PATCH /v1/users/:profileId/consent): a partial map
-* over the fixed purposes, applied as a merge patch, so omitting a purpose
-* leaves it as it was. At least one purpose is required: an empty patch is
-* a no-op request, not a valid one.
-*/
-const consentPatchSchema = z.partialRecord(z.enum(CONSENT_PURPOSES), z.boolean()).refine((data) => Object.keys(data).length > 0, { message: `at least one consent purpose (${CONSENT_PURPOSES.join(", ")}) is required` });
 const updateConsentBodySchema = z.object({ data: consentPatchSchema });
 /**
 * DELETE /v1/users/:profileId: what erasure did, so the dashboard action
@@ -6736,134 +7056,422 @@ async function clearCredentials$1(path = defaultCredentialsPath()) {
 }
 
 //#endregion
-//#region src/lib/config.ts
-const DEFAULT_API_URL = "http://localhost:3400";
-const DEFAULT_WEB_URL = "http://localhost:5273";
-function credentialsPath(env) {
-	return env.COW_CREDENTIALS_PATH ?? defaultCredentialsPath();
-}
-function readCredentials(env) {
-	return readCredentials$1(credentialsPath(env));
-}
-function writeCredentials(env, credentials) {
-	return writeCredentials$1(credentialsPath(env), credentials).then(() => credentialsPath(env));
-}
-function clearCredentials(env) {
-	return clearCredentials$1(credentialsPath(env));
-}
+//#region ../../packages/shared/src/stable-json.ts
 /**
-* The token every command sends, and where it came from. Precedence:
-* `COW_DEPLOY_KEY` > `COW_TOKEN` > the cached login. The deploy key wins
-* because a machine that has one is CI (or a long-running `cow dev`), and a
-* stale session left in `~/.cow` on that machine must not quietly become the
-* credential a pipeline runs as. `COW_TOKEN` is a session token handed over
-* explicitly, so it reports as one and outranks the cached file.
+* A key-sorted JSON rendering, for comparing or hashing two values a JSON
+* round trip may have reordered. `undefined` members are dropped the way
+* `JSON.stringify` drops them.
 *
-* A deploy key only reaches the release lifecycle, so a `cow users list` on
-* a box that exports one answers 401 rather than falling back to the
-* session. That is the honest failure: the two credentials are different
-* identities, and silently switching between them per command is how a
-* pipeline ends up passing locally and failing in CI.
+* Its own module with no imports at all, because both users need it and
+* they sit on opposite sides of a boundary: the release digest (which pulls
+* in node:crypto) and the compile workflow (which may not pull in anything).
 */
-function resolveCredential(env, credentials) {
-	if (env.COW_DEPLOY_KEY) return {
-		token: env.COW_DEPLOY_KEY,
-		kind: "deployKey"
-	};
-	if (env.COW_TOKEN) return {
-		token: env.COW_TOKEN,
-		kind: "session"
-	};
-	if (credentials?.token) return {
-		token: credentials.token,
-		kind: "session"
-	};
-	return {
-		token: null,
-		kind: "none"
-	};
+function stableJson(value) {
+	if (Array.isArray(value)) return `[${value.map(stableJson).join(",")}]`;
+	if (value !== null && typeof value === "object") return `{${Object.entries(value).filter(([, item]) => item !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([key, item]) => `${JSON.stringify(key)}:${stableJson(item)}`).join(",")}}`;
+	return JSON.stringify(value) ?? "null";
 }
-/** Precedence: --api flag > env > credentials (from login) > default. */
-function resolveApiUrl(env, credentials, flag) {
-	return flag ?? env.COW_API_URL ?? credentials?.apiUrl ?? "http://localhost:3400";
+
+//#endregion
+//#region ../../packages/shared/src/digest.ts
+/**
+* `sha256:` plus the lowercase hex digest of these exact bytes: how every
+* artifact in the release lifecycle is named. `cow build` computes it over
+* each bundle and the source tarball, and the API recomputes it over an
+* upload's body before storing it, so the two must agree byte for byte.
+*
+* Deliberately NOT re-exported from the package index: node:crypto, and the
+* dashboard bundles @cowliss/shared for the browser. Import from
+* `@cowliss/shared/digest`.
+*/
+function digestOf(bytes) {
+	return `sha256:${createHash("sha256").update(bytes).digest("hex")}`;
 }
 /**
-* Decode a JWT payload without verification. Display only: the API is the
-* verifier; the CLI just shows what it is about to send.
+* The digest of a release manifest, computed over a key-sorted rendering so
+* `cow push` and the API agree on the value whatever order the JSON arrived
+* in. It is what decides "this tree is already released": a disagreement
+* would silently turn the unchanged-tree skip off, which is why neither side
+* hashes `JSON.stringify(manifest)` directly.
 */
-function decodeTokenPayload(token) {
-	const parts = token.split(".");
-	if (parts.length !== 3) return null;
+function manifestDigestOf(manifest) {
+	return digestOf(stableJson(manifest));
+}
+
+//#endregion
+//#region src/lib/package.ts
+let cached;
+function readCliPackage() {
+	cached ??= readFile(new URL(import.meta.resolve("@cowliss/cli/package.json")), "utf8").then((text) => JSON.parse(text));
+	return cached;
+}
+
+//#endregion
+//#region src/build/spine.ts
+/**
+* The step spine, read off the source of `run` rather than recorded by
+* running it: a run against stub data follows one path and never sees an
+* `if` on a profile trait, which is the shape of half the journeys there
+* are. Reading the code sees every branch, labelled with its condition.
+*
+* What it reads: `await api.*` calls (in source order, with the literal
+* template, destination, event, key, or duration when the author wrote one
+* inline), `if`/`else`, `switch`, loops, `try`/`catch`, `return`, `throw`, and
+* `api.restart()`. Calls behind a helper function in another file, and a
+* `run` that is not an inline function on the `defineJourney` object, are
+* not followed: the spine is display only, and its ceiling is the source in
+* front of it. The typecheck that ran first is TypeScript's; syntax it accepts
+* and this parser does not yields an empty spine, never a failed build.
+*/
+function readSpine(source) {
+	let program;
 	try {
-		const json = Buffer.from(parts[1] ?? "", "base64url").toString("utf8");
-		const payload = JSON.parse(json);
-		if (typeof payload !== "object" || payload === null) return null;
-		return payload;
+		program = parse(source, {
+			sourceType: "module",
+			plugins: ["typescript"],
+			errorRecovery: true
+		}).program;
 	} catch {
-		return null;
+		return [];
+	}
+	const run = findRun(program);
+	if (!run) return [];
+	const api = run.params[1];
+	if (api?.type !== "Identifier") return [];
+	const reader = new Reader(source, api.name);
+	if (run.body.type !== "BlockStatement") return [...reader.calls(run.body), {
+		name: "end",
+		detail: "returned"
+	}];
+	const body = reader.block(run.body.body);
+	return body.ended ? body.entries : [...body.entries, {
+		name: "end",
+		detail: "returned"
+	}];
+}
+/** The `run` function on the object `export default defineJourney({...})` receives. */
+function findRun(program) {
+	for (const statement of program.body) {
+		if (statement.type !== "ExportDefaultDeclaration") continue;
+		let expr = statement.declaration;
+		while (expr.type === "TSAsExpression" || expr.type === "TSSatisfiesExpression" || expr.type === "ParenthesizedExpression") expr = expr.expression;
+		if (expr.type !== "CallExpression" || expr.arguments[0]?.type !== "ObjectExpression") return;
+		for (const prop of expr.arguments[0].properties) {
+			if (prop.type === "ObjectMethod" && keyName(prop.key) === "run") return prop;
+			if (prop.type === "ObjectProperty" && keyName(prop.key) === "run" && (prop.value.type === "ArrowFunctionExpression" || prop.value.type === "FunctionExpression")) return prop.value;
+		}
+	}
+}
+function keyName(key) {
+	if (key.type === "Identifier") return key.name;
+	if (key.type === "StringLiteral") return key.value;
+}
+var Reader = class {
+	source;
+	api;
+	/** Variables holding a `waitForEvent` result, by name, to the event waited for. */
+	waits = /* @__PURE__ */ new Map();
+	constructor(source, api) {
+		this.source = source;
+		this.api = api;
+	}
+	block(statements) {
+		const entries = [];
+		for (const statement of statements) {
+			const step = this.statement(statement);
+			entries.push(...step.entries);
+			if (step.ended) return {
+				entries,
+				ended: true
+			};
+		}
+		return {
+			entries,
+			ended: false
+		};
+	}
+	statement(node) {
+		switch (node.type) {
+			case "BlockStatement": return this.block(node.body);
+			case "IfStatement": {
+				const entries = this.calls(node.test);
+				const then = this.block([node.consequent]);
+				const otherwise = node.alternate ? this.block([node.alternate]) : void 0;
+				entries.push({
+					name: "if",
+					detail: this.condition(node.test),
+					steps: then.entries,
+					...otherwise ? { otherwise: otherwise.entries } : {}
+				});
+				return {
+					entries,
+					ended: then.ended && otherwise?.ended === true
+				};
+			}
+			case "SwitchStatement": {
+				const entries = this.calls(node.discriminant);
+				for (const kase of node.cases) {
+					const body = this.block(kase.consequent).entries;
+					if (kase.test) entries.push({
+						name: "if",
+						detail: `${this.describe(node.discriminant)} is ${this.describe(kase.test)}`,
+						steps: body
+					});
+					else entries.push(...body);
+				}
+				return {
+					entries,
+					ended: false
+				};
+			}
+			case "ForStatement":
+			case "ForOfStatement":
+			case "ForInStatement":
+			case "WhileStatement":
+			case "DoWhileStatement": return {
+				entries: [{
+					name: "loop",
+					detail: this.loopDetail(node),
+					steps: this.block([node.body]).entries
+				}],
+				ended: false
+			};
+			case "TryStatement": {
+				const entries = this.block(node.block.body).entries;
+				if (node.handler) entries.push({
+					name: "if",
+					detail: "that fails",
+					steps: this.block(node.handler.body.body).entries
+				});
+				if (node.finalizer) entries.push(...this.block(node.finalizer.body).entries);
+				return {
+					entries,
+					ended: false
+				};
+			}
+			case "ReturnStatement": {
+				const entries = node.argument ? this.calls(node.argument) : [];
+				if (entries.at(-1)?.name !== "restart") entries.push({
+					name: "end",
+					detail: "returned"
+				});
+				return {
+					entries,
+					ended: true
+				};
+			}
+			case "ThrowStatement": return {
+				entries: [...this.calls(node.argument), {
+					name: "end",
+					detail: "failed"
+				}],
+				ended: true
+			};
+			case "VariableDeclaration": {
+				const entries = [];
+				for (const declarator of node.declarations) if (declarator.init) {
+					entries.push(...this.calls(declarator.init));
+					const call = unwrap(declarator.init);
+					if (declarator.id.type === "Identifier" && call?.type === "CallExpression" && this.apiPath(call.callee) === "waitForEvent") this.waits.set(declarator.id.name, this.literalPattern(call.arguments[0]) ?? "the event");
+				}
+				return {
+					entries,
+					ended: false
+				};
+			}
+			default: {
+				const entries = this.calls(node);
+				return {
+					entries,
+					ended: entries.at(-1)?.name === "restart"
+				};
+			}
+		}
+	}
+	/** Every `api.*` call inside a node, in source order. */
+	calls(node) {
+		const entries = [];
+		const visit = (child) => {
+			if (child.type === "CallExpression") {
+				const path = this.apiPath(child.callee);
+				if (path && COMMAND_NAMES.includes(path)) {
+					for (const argument of child.arguments) visit(argument);
+					entries.push(this.call(path, child.arguments));
+					return;
+				}
+			}
+			if (child.type === "ArrowFunctionExpression" || child.type === "FunctionExpression") return;
+			for (const key of Object.keys(child)) {
+				if (key === "loc" || key === "leadingComments" || key === "trailingComments") continue;
+				const value = child[key];
+				for (const item of Array.isArray(value) ? value : [value]) if (isNode(item)) visit(item);
+			}
+		};
+		visit(node);
+		return entries;
+	}
+	call(name, args) {
+		const first = args[0];
+		const entry = { name };
+		const detail = (value) => {
+			if (value !== void 0) entry.detail = value;
+		};
+		switch (name) {
+			case "sleep":
+				detail(first ? this.literal(first) ?? this.text(first) : void 0);
+				break;
+			case "waitForEvent": {
+				detail(first ? this.literalPattern(first) ?? this.text(first) : void 0);
+				const timeout = this.property(args[1], "timeout");
+				if (timeout) entry.timeout = timeout;
+				break;
+			}
+			case "send.email": {
+				detail(this.property(first, "template"));
+				const sender = this.property(first, "senderIdentity");
+				if (sender) entry.senderIdentity = sender;
+				break;
+			}
+			case "send.webhook":
+				detail(this.property(first, "destination"));
+				break;
+			case "traits.set":
+			case "traits.unset":
+			case "events.track":
+			case "profiles.get": detail(first ? this.literal(first) ?? this.text(first) : void 0);
+		}
+		return entry;
+	}
+	/** `api.send.email` → "send.email"; anything not rooted at the api param → undefined. */
+	apiPath(callee) {
+		const parts = [];
+		let node = callee;
+		while (node.type === "MemberExpression" && !node.computed) {
+			if (node.property.type !== "Identifier") return;
+			parts.unshift(node.property.name);
+			node = node.object;
+		}
+		return node.type === "Identifier" && node.name === this.api && parts.length ? parts.join(".") : void 0;
+	}
+	text(node) {
+		return this.source.slice(node.start ?? 0, node.end ?? 0);
+	}
+	literal(node) {
+		switch (node.type) {
+			case "StringLiteral": return node.value;
+			case "NumericLiteral":
+			case "BooleanLiteral": return String(node.value);
+			case "TemplateLiteral": return node.expressions.length === 0 ? node.quasis.map((quasi) => quasi.value.cooked ?? "").join("") : void 0;
+			case "TSAsExpression":
+			case "TSSatisfiesExpression":
+			case "TSNonNullExpression": return this.literal(node.expression);
+			default: return;
+		}
+	}
+	/** A literal pattern, one or a list, the way the trigger label shows it. */
+	literalPattern(node) {
+		if (!node) return;
+		if (node.type === "ArrayExpression") {
+			const items = node.elements.map((item) => item ? this.literal(item) : void 0);
+			return items.every((item) => item !== void 0) ? patternLabel(items) : void 0;
+		}
+		return this.literal(node);
+	}
+	/** The literal value of `key` in an inline object argument. */
+	property(node, key) {
+		if (node?.type !== "ObjectExpression") return;
+		for (const prop of node.properties) if (prop.type === "ObjectProperty" && keyName(prop.key) === key) return this.literal(prop.value);
+	}
+	loopDetail(node) {
+		switch (node.type) {
+			case "ForStatement": return node.test ? `while ${this.condition(node.test)}` : "forever";
+			case "WhileStatement":
+			case "DoWhileStatement": return `while ${this.condition(node.test)}`;
+			default: return `for each of ${this.describe(node.right)}`;
+		}
+	}
+	/**
+	* A condition as a sentence: "the plan trait is \"pro\"", "org_activated
+	* arrives in time", "the orgActivated trait is not true". Whatever the
+	* rules do not know stays as the author wrote it.
+	*/
+	condition(node) {
+		switch (node.type) {
+			case "LogicalExpression": return `${this.condition(node.left)} ${node.operator === "&&" ? "and" : node.operator === "||" ? "or" : "or else"} ${this.condition(node.right)}`;
+			case "UnaryExpression":
+				if (node.operator === "!") return negate(this.condition(node.argument));
+				return this.text(node);
+			case "BinaryExpression": {
+				const { operator } = node;
+				const left = node.left;
+				if (operator === "===" || operator === "==" || operator === "!==" || operator === "!=") {
+					const positive = operator === "===" || operator === "==";
+					const right = this.rightHand(node.right);
+					const sentence = `${this.describe(left)} ${right}`;
+					return positive ? sentence : negate(sentence);
+				}
+				return `${this.describe(left)} ${operator} ${this.describe(node.right)}`;
+			}
+			case "ParenthesizedExpression": return this.condition(node.expression);
+			default: {
+				const wait = node.type === "Identifier" && this.waits.get(node.name);
+				if (wait) return `${wait} arrives in time`;
+				return `${this.describe(node)} is set`;
+			}
+		}
 	}
+	/** The predicate for a comparison's right side: "is true", "is missing", "is \"pro\"". */
+	rightHand(node) {
+		if (node.type === "NullLiteral") return "is missing";
+		if (node.type === "Identifier" && node.name === "undefined") return "is missing";
+		if (node.type === "StringLiteral") return `is "${node.value}"`;
+		if (node.type === "NumericLiteral" || node.type === "BooleanLiteral") return `is ${String(node.value)}`;
+		return `is ${this.describe(node)}`;
+	}
+	/** An operand as a noun phrase: "the plan trait", "the via property", "the event name". */
+	describe(node) {
+		if (node.type === "MemberExpression" && !node.computed && node.property.type === "Identifier") {
+			const object = node.object;
+			if (object.type === "MemberExpression" && !object.computed && object.property.type === "Identifier") {
+				if (object.property.name === "traits") return `the ${node.property.name} trait`;
+				if (object.property.name === "properties") return `the ${node.property.name} property`;
+			}
+			if (object.type === "Identifier" && node.property.name === "name" && object.name === "event") return "the event name";
+		}
+		if (node.type === "MemberExpression" && node.computed && node.object.type === "MemberExpression" && !node.object.computed && node.object.property.type === "Identifier") {
+			const key = this.literal(node.property);
+			if (key !== void 0 && node.object.property.name === "traits") return `the ${key} trait`;
+			if (key !== void 0 && node.object.property.name === "properties") return `the ${key} property`;
+		}
+		if (node.type === "Identifier") {
+			const wait = this.waits.get(node.name);
+			if (wait) return `the ${wait} event`;
+		}
+		const literal = this.literal(node);
+		return literal !== void 0 && node.type === "StringLiteral" ? `"${literal}"` : literal ?? this.text(node);
+	}
+};
+/** Each pair is a sentence and its negation; whichever side is present flips. */
+const NEGATIONS = [
+	[" arrives in time", " does not arrive in time"],
+	[" is missing", " is present"],
+	[" is set", " is not set"],
+	[" is ", " is not "]
+];
+function negate(sentence) {
+	for (const [positive, negative] of NEGATIONS) {
+		if (sentence.includes(negative)) return sentence.replace(negative, positive);
+		if (sentence.includes(positive)) return sentence.replace(positive, negative);
+	}
+	return `not ${sentence}`;
 }
-function decodeSessionToken(token) {
-	const payload = decodeTokenPayload(token);
-	if (!payload) return null;
-	const o = payload.o;
-	return {
-		userId: typeof payload.sub === "string" ? payload.sub : null,
-		orgId: o && typeof o === "object" && typeof o.id === "string" ? o.id : typeof payload.org_id === "string" ? payload.org_id : null,
-		role: o && typeof o === "object" && typeof o.rol === "string" ? `org:${o.rol}` : typeof payload.org_role === "string" ? payload.org_role : null,
-		expiresAt: typeof payload.exp === "number" ? (/* @__PURE__ */ new Date(payload.exp * 1e3)).toISOString() : null
-	};
-}
-
-//#endregion
-//#region src/lib/package.ts
-let cached;
-function readCliPackage() {
-	cached ??= readFile(new URL(import.meta.resolve("@cowliss/cli/package.json")), "utf8").then((text) => JSON.parse(text));
-	return cached;
-}
-
-//#endregion
-//#region ../../packages/shared/src/stable-json.ts
-/**
-* A key-sorted JSON rendering, for comparing or hashing two values a JSON
-* round trip may have reordered. `undefined` members are dropped the way
-* `JSON.stringify` drops them.
-*
-* Its own module with no imports at all, because both users need it and
-* they sit on opposite sides of a boundary: the release digest (which pulls
-* in node:crypto) and the compile workflow (which may not pull in anything).
-*/
-function stableJson(value) {
-	if (Array.isArray(value)) return `[${value.map(stableJson).join(",")}]`;
-	if (value !== null && typeof value === "object") return `{${Object.entries(value).filter(([, item]) => item !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([key, item]) => `${JSON.stringify(key)}:${stableJson(item)}`).join(",")}}`;
-	return JSON.stringify(value) ?? "null";
-}
-
-//#endregion
-//#region ../../packages/shared/src/digest.ts
-/**
-* `sha256:` plus the lowercase hex digest of these exact bytes: how every
-* artifact in the release lifecycle is named. `cow build` computes it over
-* each bundle and the source tarball, and the API recomputes it over an
-* upload's body before storing it, so the two must agree byte for byte.
-*
-* Deliberately NOT re-exported from the package index: node:crypto, and the
-* dashboard bundles @cowliss/shared for the browser. Import from
-* `@cowliss/shared/digest`.
-*/
-function digestOf(bytes) {
-	return `sha256:${createHash("sha256").update(bytes).digest("hex")}`;
+function unwrap(node) {
+	let current = node;
+	while (current.type === "AwaitExpression" || current.type === "TSAsExpression" || current.type === "TSNonNullExpression" || current.type === "ParenthesizedExpression") current = current.type === "AwaitExpression" ? current.argument : current.expression;
+	return current;
 }
-/**
-* The digest of a release manifest, computed over a key-sorted rendering so
-* `cow push` and the API agree on the value whatever order the JSON arrived
-* in. It is what decides "this tree is already released": a disagreement
-* would silently turn the unchanged-tree skip off, which is why neither side
-* hashes `JSON.stringify(manifest)` directly.
-*/
-function manifestDigestOf(manifest) {
-	return digestOf(stableJson(manifest));
+function isNode(value) {
+	return typeof value === "object" && value !== null && typeof value.type === "string";
 }
 
 //#endregion
@@ -6878,18 +7486,18 @@ const execFileAsync$1 = promisify(execFile);
 /** Where build output lives, relative to the project root. */
 const BUILD_DIR = join(".cow", "build");
 const TYPES_FILE = join(".cow", "types.d.ts");
-/** The config files the source tarball carries besides `journeys/` and `emails/`. */
+/**
+* The config files the source tarball carries besides `journeys/` and
+* `emails/`. Always the committed `cow.json`, never a `--config` override: a
+* release records the project as the repo declares it, not the local file
+* whoever pushed happened to point at.
+*/
 const CONFIG_FILES$1 = [
 	"cow.json",
 	"package.json",
 	"tsconfig.json"
 ];
 /**
-* The spine is display only, so a loop that would record forever is cut
-* here rather than being allowed to grow the manifest.
-*/
-const SPINE_LIMIT = 200;
-/**
 * The guest SDK a bundle links against is always the CLI's own, whatever
 * the project has installed: the manifest records that version as `sdk`,
 * and the sandbox runs the driver from these files.
@@ -6965,7 +7573,7 @@ async function discover(projectDir, kind, extension) {
 }
 /**
 * Two files under the same directory tree cannot share a key: the key is
-* what a release, a workflow id, and `api.email.send` all address. A
+* what a release, a workflow id, and `api.send.email` all address. A
 * journey and a template may share one (they are separate namespaces, and
 * a journey that sends its own email usually does).
 */
@@ -6979,7 +7587,7 @@ function assertUniqueKeys(files) {
 }
 /**
 * `.cow/types.d.ts`: one `typeof import(...)` per template, merged into the
-* SDK's `CowTemplates`, which is what types `api.email.send`. Written before
+* SDK's `CowTemplates`, which is what types `api.send.email`. Written before
 * the typecheck, because the typecheck is what it exists for.
 */
 function templateTypes(templates) {
@@ -7148,93 +7756,29 @@ async function loadNodeBundle(projectDir, key, kind = "journeys") {
 		runGuest: loaded.runGuest
 	};
 }
-/** Stops the recording stub at `restart` and at the spine cap. */
-var SpineStop = class extends Error {};
 /**
-* A profile with nothing in it but the id and traits given: what the spine
-* stub's reads answer, and the base the simulator answers `profile.get` with.
-* The spec says a spine read returns an empty object; a bare `{}` ends most
-* recordings at the first `me.traits.x`, which is the first line of half the
-* journeys there are, so the shape is kept and the contents emptied. Consent
-* reads true so a gated send still shows up.
+* A profile with nothing in it but the id and traits given: the base the
+* simulator answers `profile.get` with.
+*
+* Consent covers the project's declared purposes as well as the two fixed
+* ones, each reading its own default, which is what a profile that answered
+* nothing gets in production, so a dry run and a real send agree.
 */
-function emptyProfile(id = "", traits = {}) {
+function emptyProfile(id = "", traits = {}, purposes = []) {
 	return {
 		id,
 		traits,
-		consent: Object.fromEntries(CONSENT_PURPOSES.map((purpose) => [purpose, true])),
+		consent: {
+			...CONSENT_PURPOSE_DEFAULTS,
+			...consentDefaultsOf(purposes.map((purpose) => ({
+				key: purpose.key,
+				defaultGranted: false
+			})))
+		},
 		identifiers: {},
 		segments: []
 	};
 }
-/**
-* The step spine: `run` once against a stub whose reads answer empty and
-* whose waits answer null, keeping what was recorded up to the first throw.
-*
-* ponytail: a journey that awaits a promise nothing settles (rather than an
-* api call) hangs the build here. The cap covers the loop that matters,
-* `for (;;) await api.sleep(...)`; a wall-clock guard is the upgrade if a
-* real project ever manages it.
-*/
-async function recordSpine(module, trigger) {
-	const spine = [];
-	const push = (name, detail) => {
-		if (spine.length >= SPINE_LIMIT) throw new SpineStop();
-		spine.push(detail === void 0 ? { name } : {
-			name,
-			detail
-		});
-	};
-	const api = {
-		sleep: async () => {
-			push("sleep");
-		},
-		waitForEvent: async (pattern) => {
-			push("waitForEvent", patternLabel(pattern));
-			return null;
-		},
-		email: { send: async (args) => {
-			push("email.send", String(args.template));
-			return {};
-		} },
-		webhook: { send: async (args) => {
-			push("webhook.send", args.destination);
-		} },
-		traits: {
-			set: async (key) => {
-				push("traits.set", key);
-			},
-			unset: async (key) => {
-				push("traits.unset", key);
-			}
-		},
-		profile: { get: async () => {
-			push("profile.get");
-			return emptyProfile();
-		} },
-		profiles: { get: async (id) => {
-			push("profiles.get", id);
-			return emptyProfile();
-		} },
-		events: { track: async (name) => {
-			push("events.track", name);
-		} },
-		log: () => {},
-		restart: async () => {
-			push("restart");
-			throw new SpineStop();
-		}
-	};
-	const journey = module.default;
-	try {
-		await journey.run({
-			name: "event" in trigger ? patternPlaceholder(trigger.event) : SYSTEM_EVENTS.segmentEntered,
-			properties: {},
-			timestamp: 0
-		}, api);
-	} catch {}
-	return spine;
-}
 /** The release limits (spec: Limits), naming the offending count or size. */
 function limitFailure(sizes) {
 	if (sizes.journeys > RELEASE_LIMITS.journeys) return `This project has ${sizes.journeys} journeys; a release carries at most ${RELEASE_LIMITS.journeys}.`;
@@ -7254,18 +7798,41 @@ async function writeSourceTarball(projectDir, outFile) {
 	}, files);
 	return (await stat(outFile)).size;
 }
-/** The project's cow.json; throws unless `projectDir` holds a valid one. */
+/** The project config a checkout carries by default. */
+const DEFAULT_CONFIG_FILE = "cow.json";
+/**
+* Which project config every command in this process reads. Resolved once
+* from `--config`/`COW_CONFIG` at startup rather than threaded through nine
+* call sites: the CLI is one shot, and the answer cannot change mid-run.
+*/
+let configFile = DEFAULT_CONFIG_FILE;
+function setConfigFile(name) {
+	configFile = name;
+}
+function projectConfigFile() {
+	return configFile;
+}
+/** The project's config; throws unless `projectDir` holds a valid one. */
 async function assertCowConfig(projectDir) {
+	const name = projectConfigFile();
 	let text;
 	try {
-		text = await readFile(join(projectDir, "cow.json"), "utf8");
+		text = await readFile(join(projectDir, name), "utf8");
 	} catch {
-		throw new Error(`No cow.json in "${projectDir}". Run \`cow init\` to create a project.`);
+		throw new Error(name === "cow.json" ? `No ${name} in "${projectDir}". Run \`cow init\` to create a project.` : `No ${name} in "${projectDir}". That file was selected with --config or COW_CONFIG.`);
 	}
 	const parsed = cowConfigSchema.safeParse(JSON.parse(text));
-	if (!parsed.success) throw new Error(`cow.json is invalid: ${parsed.error.issues.map((issue) => `${issue.path.join(".") || "(root)"}: ${issue.message}`).join("; ")}`);
+	if (!parsed.success) throw new Error(`${name} is invalid: ${parsed.error.issues.map((issue) => `${issue.path.join(".") || "(root)"}: ${issue.message}`).join("; ")}`);
 	return parsed.data;
 }
+/** The project's config, or null when this directory has none. */
+async function readCowConfig(projectDir) {
+	try {
+		return await assertCowConfig(projectDir);
+	} catch {
+		return null;
+	}
+}
 /**
 * Which project of the org this directory belongs to: the `project` in its
 * `cow.json`, or undefined when there is no `cow.json` here at all. The
@@ -7325,8 +7892,9 @@ async function buildProject(projectDir) {
 			tags: report.tags,
 			trigger: report.trigger,
 			purpose: report.purpose,
+			senderIdentity: report.senderIdentity,
 			environments: report.environments,
-			spine: await recordSpine(module, report.trigger),
+			spine: readSpine(await readFile(built.source.file, "utf8")),
 			bundle: built.digest
 		});
 		else manifestTemplates.push({
@@ -7351,10 +7919,11 @@ async function buildProject(projectDir) {
 	});
 	if (failure) throw new Error(failure);
 	const manifest = manifestSchema.parse({
-		protocol: 1,
+		protocol: 2,
 		sdk: (await readCliPackage()).version,
 		journeys: manifestJourneys,
 		templates: manifestTemplates,
+		purposes: config.purposes,
 		source: digestOf(await readFile(sourceFile))
 	});
 	await writeFile(join(outDir, "manifest.json"), `${JSON.stringify(manifest, null, 2)}\n`);
@@ -7387,6 +7956,95 @@ async function buildIfStale(projectDir) {
 	if ((await Promise.all(sources.map((file) => stat(join(projectDir, file)).then((stats) => stats.mtimeMs, () => 0)))).some((time) => time > builtAt)) await buildProject(projectDir);
 }
 
+//#endregion
+//#region src/lib/config.ts
+const DEFAULT_API_URL = "http://localhost:3400";
+const DEFAULT_WEB_URL = "http://localhost:5273";
+function credentialsPath(env) {
+	return env.COW_CREDENTIALS_PATH ?? defaultCredentialsPath();
+}
+function readCredentials(env) {
+	return readCredentials$1(credentialsPath(env));
+}
+function writeCredentials(env, credentials) {
+	return writeCredentials$1(credentialsPath(env), credentials).then(() => credentialsPath(env));
+}
+function clearCredentials(env) {
+	return clearCredentials$1(credentialsPath(env));
+}
+/**
+* The token every command sends, and where it came from. Precedence:
+* `COW_DEPLOY_KEY` > `COW_TOKEN` > the cached login. The deploy key wins
+* because a machine that has one is CI (or a long-running `cow dev`), and a
+* stale session left in `~/.cow` on that machine must not quietly become the
+* credential a pipeline runs as. `COW_TOKEN` is a session token handed over
+* explicitly, so it reports as one and outranks the cached file.
+*
+* A deploy key only reaches the release lifecycle, so a `cow users list` on
+* a box that exports one answers 401 rather than falling back to the
+* session. That is the honest failure: the two credentials are different
+* identities, and silently switching between them per command is how a
+* pipeline ends up passing locally and failing in CI.
+*/
+function resolveCredential(env, credentials) {
+	if (env.COW_DEPLOY_KEY) return {
+		token: env.COW_DEPLOY_KEY,
+		kind: "deployKey"
+	};
+	if (env.COW_TOKEN) return {
+		token: env.COW_TOKEN,
+		kind: "session"
+	};
+	if (credentials?.token) return {
+		token: credentials.token,
+		kind: "session"
+	};
+	return {
+		token: null,
+		kind: "none"
+	};
+}
+/**
+* Precedence: `--api` flag > env > the project config > credentials (from
+* login) > default.
+*
+* The project's own `apiUrl` outranks the credentials file because it is the
+* more specific answer: `cow.json` says where this project deploys, while the
+* credentials only remember where somebody last logged in. Without it a
+* checkout whose config names production silently fell through to
+* `DEFAULT_API_URL`, which is how a production deploy reaches localhost.
+*/
+function resolveApiUrl(env, credentials, flag, projectApiUrl) {
+	return flag ?? env.COW_API_URL ?? projectApiUrl ?? credentials?.apiUrl ?? "http://localhost:3400";
+}
+/**
+* Decode a JWT payload without verification. Display only: the API is the
+* verifier; the CLI just shows what it is about to send.
+*/
+function decodeTokenPayload(token) {
+	const parts = token.split(".");
+	if (parts.length !== 3) return null;
+	try {
+		const json = Buffer.from(parts[1] ?? "", "base64url").toString("utf8");
+		const payload = JSON.parse(json);
+		if (typeof payload !== "object" || payload === null) return null;
+		return payload;
+	} catch {
+		return null;
+	}
+}
+function decodeSessionToken(token) {
+	const payload = decodeTokenPayload(token);
+	if (!payload) return null;
+	const o = payload.o;
+	return {
+		userId: typeof payload.sub === "string" ? payload.sub : null,
+		orgId: o && typeof o === "object" && typeof o.id === "string" ? o.id : typeof payload.org_id === "string" ? payload.org_id : null,
+		role: o && typeof o === "object" && typeof o.rol === "string" ? `org:${o.rol}` : typeof payload.org_role === "string" ? payload.org_role : null,
+		expiresAt: typeof payload.exp === "number" ? (/* @__PURE__ */ new Date(payload.exp * 1e3)).toISOString() : null
+	};
+}
+
 //#endregion
 //#region src/commands/add.ts
 /**
@@ -7463,7 +8121,7 @@ async function login(env, options) {
 	if (options.token !== void 0) {
 		token = options.token.trim();
 		if (decodeTokenPayload(token) === null) throw new Error("The provided --token value is not a JWT");
-	} else token = await collectTokenViaBrowser(options.webUrl ?? env.COW_WEB_URL ?? "http://localhost:5273", 3e5, options.noOpen === true);
+	} else token = await collectTokenViaBrowser(options.webUrl ?? env.COW_WEB_URL ?? (await readCowConfig(process.cwd()))?.webUrl ?? "http://localhost:5273", 3e5, options.noOpen === true);
 	const claims = decodeSessionToken(token);
 	if (claims === null) throw new Error("Token is not a decodable JWT");
 	if (claims.userId === null) throw new Error("Token has no subject claim. Is it a Clerk session token?");
@@ -7503,7 +8161,14 @@ function collectTokenViaBrowser(webUrl, timeoutMs = 18e4, noOpen = false) {
 				clearTimeout(timer);
 				try {
 					const body = JSON.parse(Buffer.concat(chunks).toString("utf8"));
-					const token = typeof body === "object" && body !== null && "token" in body ? body.token : void 0;
+					const field = (name) => typeof body === "object" && body !== null && name in body ? body[name] : void 0;
+					if (field("denied") === true) {
+						res.writeHead(200, { "Content-Type": "application/json" });
+						res.end(JSON.stringify({ ok: true }));
+						reject(/* @__PURE__ */ new Error("Sign-in was denied in the browser. No access was granted."));
+						return;
+					}
+					const token = field("token");
 					if (typeof token !== "string" || token.length === 0) {
 						res.writeHead(400, { "Content-Type": "application/json" });
 						res.end(JSON.stringify({ error: "missing token" }));
@@ -7550,7 +8215,7 @@ function openBrowser(url) {
 //#region src/commands/auth.ts
 /** login/logout/whoami: session-token management, no contract route. */
 function registerAuth(program, env, io) {
-	program.command("login").description("authenticate via the dashboard browser flow (or --token) and cache the session token").option("--token <jwt>", "paste a Clerk session token instead of the browser flow").option("--web <url>", `dashboard URL (default ${DEFAULT_WEB_URL})`).option("--no-open", "do not open the browser; print the URL and wait (headless/agent use)").action(async (opts) => {
+	program.command("login").description("authenticate via the dashboard browser flow (or --token) and cache the session token").option("--token <jwt>", "paste a Clerk session token instead of the browser flow").option("--web <url>", `dashboard URL; overrides COW_WEB_URL and webUrl in the project config (default ${DEFAULT_WEB_URL})`).option("--no-open", "do not open the browser; print the URL and wait (headless/agent use)").action(async (opts) => {
 		const outcome = await login(env, {
 			token: opts.token,
 			webUrl: opts.web,
@@ -8366,6 +9031,31 @@ const catalog = defineModule(defineRoute({
 	}
 }));
 
+//#endregion
+//#region ../../packages/shared/src/contract/consent.ts
+/**
+* The consent purposes an organization's profiles answer: the two fixed ones
+* every org has, plus whatever its projects declare in their `cow.json`.
+*
+* Read-only, and deliberately so. Purposes are code, like journeys and
+* templates: a deploy upserts them and never deletes one, because profiles
+* already hold answers against them.
+*/
+const consent = defineModule(defineRoute({
+	method: "get",
+	path: "/v1/consent-purposes",
+	operationId: "consent.purposes.list",
+	tags: ["consent"],
+	summary: "List the consent purposes this organization declares",
+	security: SESSION_AUTH,
+	request: { query: listConsentPurposesQuerySchema },
+	responses: {
+		200: list(consentPurposeSchema),
+		...sessionErrors,
+		...errors("validation_failed")
+	}
+}));
+
 //#endregion
 //#region ../../packages/shared/src/contract/deliveries.ts
 /**
@@ -8425,7 +9115,16 @@ const deliveries = defineModule(defineRoute({
 	summary: "One-click unsubscribe (public)",
 	security: NO_AUTH,
 	surfaces: HIDDEN_FROM_TOOLS,
-	request: { query: tokenQuery },
+	request: { query: tokenQuery.extend({ 
+	/**
+	* The confirmation page's second button, "stop all marketing
+	* email": the same token, revoking the master purpose instead of
+	* the one the mail was sent under. A flag rather than a second
+	* route, because the claim already names the org and the profile.
+	* The List-Unsubscribe header never carries it, so a mail client's
+	* one-click POST stops one purpose, as RFC 8058 intends.
+	*/
+all: z.literal("1").optional() }) },
 	responses: {
 		200: htmlResponse("Confirmation page"),
 		400: { description: "Invalid or incomplete unsubscribe link" }
@@ -8599,6 +9298,21 @@ const domains = defineModule(defineRoute({
 		...sessionErrors,
 		...errors("conflict", "validation_failed", "malformed_request", "dependency_unavailable")
 	}
+}), defineRoute({
+	method: "get",
+	path: "/v1/domains/{id}/dns-setup",
+	operationId: "domains.dnsSetup",
+	tags: ["domains"],
+	summary: "Where the DNS provider can publish the records",
+	description: "The Domain Connect link for this domain's DNS provider, which shows the admin the records and asks them to confirm. `url` is null when the provider does not support it.",
+	security: SESSION_AUTH,
+	surfaces: HIDDEN_FROM_TOOLS,
+	request: { params: params$7 },
+	responses: {
+		200: envelope(domainDnsSetupSchema),
+		...sessionErrors,
+		...errors("not_found")
+	}
 }), defineRoute({
 	method: "post",
 	path: "/v1/domains/{id}/verify",
@@ -8965,6 +9679,55 @@ const journeys = defineModule(defineRoute({
 	}
 }));
 
+//#endregion
+//#region ../../packages/shared/src/contract/me.ts
+/**
+* The signed-in developer's own settings. Session auth like the rest of the
+* dashboard API, but deliberately not org-scoped and indifferent to the
+* environment header: the subject is the caller's own platform-workspace
+* profile, taken from their session, never from the request.
+*
+* Hidden from the CLI and the MCP server. Both act with an org's key on that
+* org's data, and neither has a signed-in human whose mail preferences this
+* could mean; an operator changing an end user's consent uses
+* `users.updateConsent`, which is the same decision made by someone else.
+*/
+const me = defineModule(defineRoute({
+	method: "get",
+	path: "/v1/me/notifications",
+	operationId: "me.notifications.get",
+	tags: ["me"],
+	summary: "What Cowliss may send you",
+	security: SESSION_AUTH,
+	surfaces: {
+		cli: false,
+		mcp: false,
+		docs: false
+	},
+	responses: {
+		200: envelope(notificationPreferencesSchema),
+		...sessionErrors
+	}
+}), defineRoute({
+	method: "patch",
+	path: "/v1/me/notifications",
+	operationId: "me.notifications.update",
+	tags: ["me"],
+	summary: "Change what Cowliss may send you",
+	security: SESSION_AUTH,
+	surfaces: {
+		cli: false,
+		mcp: false,
+		docs: false
+	},
+	request: { body: jsonBody(updateNotificationPreferencesBodySchema) },
+	responses: {
+		200: envelope(notificationPreferencesSchema),
+		...sessionErrors,
+		...errors("validation_failed", "malformed_request", "internal")
+	}
+}));
+
 //#endregion
 //#region ../../packages/shared/src/contract/project.ts
 /**
@@ -9660,6 +10423,8 @@ const contract = {
 	openapi,
 	ingestion,
 	users,
+	me,
+	consent,
 	events,
 	apps,
 	sources,
@@ -10117,23 +10882,55 @@ async function latestRelease(client, project) {
 	} })).data[0] ?? null;
 }
 /**
+* How far a compile has got, as `18/26`. Only meaningful while the release is
+* pending: a `ready` release can legitimately sit below its total (every row
+* from before the counter existed reads 0, and the last progress write is
+* advisory), so completion is read from the status, never from this.
+*/
+function compiledFraction(release) {
+	return `${release.compiledEntries}/${release.totalEntries}`;
+}
+/**
+* The progress writer for a terminal, or nothing at all when there is no one
+* watching. It rewrites one line on stderr, so what a command prints to
+* stdout is the same bytes whether or not a terminal is attached.
+*
+* The flag is stdout's: a redirected push is a script reading the summary,
+* and it gets no cursor codes in either stream. `--json` is silent for the
+* same reason, since its whole output is one envelope.
+*/
+function progressLineFor(io, json) {
+	if (!io.isTTY || json === true) return;
+	let drawn = false;
+	return (text) => {
+		if (text === "" && !drawn) return;
+		drawn = text !== "";
+		io.stderr(`\r\x1b[2K${text}`);
+	};
+}
+/**
 * Poll until the compile settles. Backs off from a quarter second to two,
 * because a small project is ready almost at once and a large one is not
 * worth asking about ten times a second.
 */
-async function awaitCompile(client, releaseId, sleep) {
+async function awaitCompile(client, releaseId, sleep, progress) {
 	let waited = 0;
 	let interval = POLL_START_MS;
-	for (;;) {
-		const { data } = await client.request(contract.releases["releases.get"], { params: { id: releaseId } });
-		if (data.status !== "pending") return data;
-		if (waited >= POLL_BUDGET_MS) throw new Error(`Release ${releaseId} is still compiling after ${Math.round(waited / 1e3)}s. Check \`cow releases get ${releaseId}\`.`);
-		await sleep(interval);
-		waited += interval;
-		interval = Math.min(interval * 2, POLL_MAX_MS);
+	try {
+		for (;;) {
+			const { data } = await client.request(contract.releases["releases.get"], { params: { id: releaseId } });
+			if (data.status !== "pending") return data;
+			if (waited >= POLL_BUDGET_MS) throw new Error(`Release ${releaseId} is still compiling after ${Math.round(waited / 1e3)}s (${compiledFraction(data)} compiled). Check \`cow releases get ${releaseId}\`.`);
+			progress?.(`Compiling ${compiledFraction(data)}`);
+			await sleep(interval);
+			waited += interval;
+			interval = Math.min(interval * 2, POLL_MAX_MS);
+		}
+	} finally {
+		progress?.("");
 	}
 }
-async function pushProject({ client, projectDir, force, sleep = (ms) => setTimeout$1(ms) }) {
+async function pushProject({ client, projectDir, force, sleep = (ms) => setTimeout$1(ms), progress }) {
 	const { manifest, config } = await buildProject(projectDir);
 	const project = await ensureProject(client, config.project);
 	if (project.orgId !== config.orgId) throw new Error(`cow.json is for ${config.orgId} but the credential belongs to ${project.orgId}. Log in to that organization, or use its deploy key.`);
@@ -10156,9 +10953,12 @@ async function pushProject({ client, projectDir, force, sleep = (ms) => setTimeo
 	}
 	return {
 		release: await awaitCompile(client, (await client.request(contract.releases["releases.create"], { body: {
-			manifest,
+			manifest: {
+				...manifest,
+				protocol: 2
+			},
 			project: project.name
-		} })).data.id, sleep),
+		} })).data.id, sleep, progress),
 		uploaded
 	};
 }
@@ -10179,7 +10979,8 @@ function registerPush(program, clientFor, io) {
 		const outcome = await pushProject({
 			client: await clientFor(merged),
 			projectDir: process.cwd(),
-			force: opts.force === true
+			force: opts.force === true,
+			progress: progressLineFor(io, merged.json === true)
 		});
 		if (merged.json === true) emit({ data: outcome.release }, io, true);
 		else io.stdout(`${pushSummary(outcome)}\n`);
@@ -10190,7 +10991,7 @@ function registerPush(program, clientFor, io) {
 //#endregion
 //#region src/commands/deploy.ts
 /** The release to deploy, and the push message when a push produced it. */
-async function releaseToDeploy({ client, projectDir, releaseId, sleep }) {
+async function releaseToDeploy({ client, projectDir, releaseId, sleep, progress }) {
 	if (releaseId) {
 		const { data } = await client.request(contract.releases["releases.get"], { params: { id: releaseId } });
 		return { release: data };
@@ -10198,7 +10999,8 @@ async function releaseToDeploy({ client, projectDir, releaseId, sleep }) {
 	const pushed = await pushProject({
 		client,
 		projectDir,
-		sleep
+		sleep,
+		progress
 	});
 	return {
 		release: pushed.release,
@@ -10207,7 +11009,7 @@ async function releaseToDeploy({ client, projectDir, releaseId, sleep }) {
 }
 async function deployProject(options) {
 	const { release, skipped } = await releaseToDeploy(options);
-	if (release.status !== "ready") throw new Error(release.status === "failed" ? `${release.id} #${release.seq} failed to compile, so there is nothing to deploy: ${release.error ?? "no reason recorded"}` : `${release.id} #${release.seq} is still compiling; wait for it to be ready.`);
+	if (release.status !== "ready") throw new Error(release.status === "failed" ? `${release.id} #${release.seq} failed to compile, so there is nothing to deploy: ${release.error ?? "no reason recorded"}` : `${release.id} #${release.seq} is still compiling (${compiledFraction(release)} compiled); wait for it to be ready.`);
 	const { data } = await options.client.request(contract.deployments["deployments.create"], { body: { releaseId: release.id } });
 	return {
 		deployment: data,
@@ -10234,7 +11036,8 @@ function registerDeploy(program, clientFor, env, io) {
 		const outcome = await deployProject({
 			client: await clientFor(merged),
 			projectDir: process.cwd(),
-			releaseId: opts.release
+			releaseId: opts.release,
+			progress: progressLineFor(io, merged.json === true)
 		});
 		if (merged.json === true) {
 			emit({ data: outcome.deployment }, io, true);
@@ -10994,7 +11797,7 @@ async function runScenario(projectDir, key, scenario) {
 	if (!journey) throw new Error(`Unknown journey "${key}". This project builds: ${manifest?.journeys.map((one) => one.key).join(", ") || "no journeys"}.`);
 	const wallStart = Date.now();
 	const { module, runGuest } = await loadNodeBundle(projectDir, key);
-	const profile = emptyProfile(scenario.user.id, { ...scenario.user.traits });
+	const profile = emptyProfile(scenario.user.id, { ...scenario.user.traits }, manifest?.purposes);
 	const scripted = scenario.events.map((one) => ({
 		...one,
 		atMs: SIM_START + parseDuration(one.at),
@@ -11043,7 +11846,7 @@ async function runScenario(projectDir, key, scenario) {
 					now
 				};
 			}
-			case "email.send":
+			case "send.email":
 				record("sendEmail", command.args);
 				sends += 1;
 				return {
@@ -11053,7 +11856,7 @@ async function runScenario(projectDir, key, scenario) {
 					}),
 					now: clock
 				};
-			case "webhook.send":
+			case "send.webhook":
 				record("sendWebhook", command.args);
 				return {
 					result: ok(null),
@@ -11119,7 +11922,7 @@ async function runScenario(projectDir, key, scenario) {
 	let error;
 	for (;;) {
 		const output = await runGuest(module, {
-			protocol: 1,
+			protocol: 2,
 			kind: "journey",
 			key,
 			event: trigger,
@@ -11236,11 +12039,15 @@ function emit(result, io, json) {
 }
 function buildProgram(env, io) {
 	const program = new Command();
-	program.name("cow").description("Admin CLI for Cowliss: a thin client of the dashboard API").option("--api <url>", "API base URL (overrides env and saved config)").option("--env <environment>", `environment to act on: ${ENVIRONMENTS.join(" | ")} (overrides COW_ENVIRONMENT; default ${DEFAULT_ENVIRONMENT})`, parseEnvironment).option("--json", "force compact single-line JSON output");
+	program.name("cow").description("Admin CLI for Cowliss: a thin client of the dashboard API").option("--api <url>", "API base URL (overrides env and saved config)").option("--env <environment>", `environment to act on: ${ENVIRONMENTS.join(" | ")} (overrides COW_ENVIRONMENT; default ${DEFAULT_ENVIRONMENT})`, parseEnvironment).option("--json", "force compact single-line JSON output").option("--config <file>", `project config to read instead of ${DEFAULT_CONFIG_FILE} (overrides COW_CONFIG)`);
+	program.hook("preAction", () => {
+		const flag = program.opts().config;
+		setConfigFile((typeof flag === "string" ? flag : void 0) ?? env.COW_CONFIG ?? "cow.json");
+	});
 	const clientFor = async (opts) => {
 		const credentials = await readCredentials(env);
 		return createClient({
-			baseUrl: resolveApiUrl(env, credentials, typeof opts.api === "string" ? opts.api : void 0),
+			baseUrl: resolveApiUrl(env, credentials, typeof opts.api === "string" ? opts.api : void 0, (await readCowConfig(process.cwd()))?.apiUrl),
 			auth: async () => resolveCredential(env, await readCredentials(env)).token,
 			headers: async () => ({
 				[ENVIRONMENT_HEADER]: environmentFor(env, opts),
@@ -11285,7 +12092,13 @@ const envSchema = z.object({
 	/** An org deploy key for CI; when set it wins over the cached session (ticket 05 reads it). */
 	COW_DEPLOY_KEY: z.string().min(1).optional(),
 	/** The environment admin calls select; `--env` overrides it, production is the default. */
-	COW_ENVIRONMENT: environmentSchema.optional()
+	COW_ENVIRONMENT: environmentSchema.optional(),
+	/**
+	* The project config to read instead of `cow.json`, so one checkout can
+	* hold both the committed production config and a local override.
+	* `--config` overrides it.
+	*/
+	COW_CONFIG: z.string().min(1).optional()
 });
 function loadEnv() {
 	const parsed = envSchema.safeParse(process.env);