@cowliss/cli 0.4.0 → 0.5.0

package/dist/index.js

@@ -3,7 +3,7 @@ import { builtinModules, createRequire } from "node:module";
 import { z, z as z$2 } from "zod";
 import { z as z$1 } from "zod/v4";
 import { createHash } from "node:crypto";
-import { copyFile, mkdir, readFile, readdir, rm, stat, watch, writeFile } from "node:fs/promises";
+import { copyFile, mkdir, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { basename, dirname, join, relative, resolve, sep } from "node:path";
 import { Command, InvalidArgumentError } from "commander";
@@ -16,7 +16,6 @@ import { create, extract } from "tar";
 import { parse } from "@babel/parser";
 import { existsSync, readFileSync } from "node:fs";
 import { createServer } from "node:http";
-import { setTimeout as setTimeout$1 } from "node:timers/promises";
 import { createInterface } from "node:readline/promises";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
@@ -64,8 +63,8 @@ const ENVIRONMENT_HEADER = "X-Cow-Environment";
 *
 * It exists so the published packages are legible in the logs. Customers
 * pin versions and old ones live for years, and knowing which are still
-* calling is only possible if it was collected from the first release, not
-* from the release where it first mattered.
+* calling is only possible if it was collected from the first version, not
+* from the version where it first mattered.
 *
 * A custom header rather than `User-Agent`: browsers forbid scripts from
 * setting that one and drop it in silence, and `@cowliss/sdk` runs in a
@@ -217,23 +216,14 @@ const EXECUTION_LIMITS = {
 	logLines: 100,
 	logLineBytes: 1024
 };
-/** Per release: manifest counts, bundle size, and the source tarball. */
-const RELEASE_LIMITS = {
+/** Per push: manifest counts, bundle size, and the source tarball. */
+const PUSH_LIMITS = {
 	journeys: 100,
 	templates: 200,
 	bundleBytes: 2097152,
 	sourceBytes: 5242880
 };
 /**
-* The whole-release compile budget: how long `compileRelease` may spend on
-* every bundle in a manifest before it gives up and fails the release. A
-* project at the 300-artifact ceiling compiling at the per-bundle timeout
-* would otherwise hold the sandbox queue for ten hours; 30 minutes is
-* generous for a realistic project (a bundle compiles in seconds) and short
-* enough that a stuck release frees the queue on its own.
-*/
-const RELEASE_COMPILE_TIMEOUT_MS = 18e5;
-/**
 * Where the docs site serves the `cow.json` JSON Schema (the `$schema` a
 * project file points at). Generated from `cowConfigSchema` by the docs
 * generator; the path is stable because project files link to it.
@@ -280,10 +270,10 @@ const searchQuerySchema = z.string().trim().max(200, "q must be at most 200 char
 * always scoped to the caller's org, so echoing it would invite a client to
 * believe it can be chosen.
 *
-* Deploy keys (journeys v2 ticket 05) are the same shape on the wire: the
+* Pipeline keys (journeys v2 ticket 05) are the same shape on the wire: the
 * only difference is the Clerk `deploy` scope, which decides which family a
 * key belongs to and which routes it may reach, never anything a client
-* sends or reads. So /v1/settings/deploy-keys reuses these schemas.
+* sends or reads. So /v1/settings/pipeline-keys reuses these schemas.
 */
 const nameSchema$3 = z.string().trim().min(1, "name is required").max(100, "name must be at most 100 characters");
 /** Body for POST /v1/settings/api-keys. */
@@ -3370,6 +3360,16 @@ const consentPurposes = pgTable("consent_purposes", {
 */
 const deliveryChannelEnum = pgEnum("delivery_channel", ["email", "webhook"]);
 /**
+* Why this send happened. `journey` is every send a running journey made,
+* dry runs included. `test` is the dashboard's Send test: a manager checking
+* a template's copy against their own address, with no gate, no recipient
+* profile and no journey behind it, which is why both of those columns are
+* nullable. The meter and the quota gate exclude it (packages/delivery's
+* repository), and every per-profile read excludes it by construction,
+* because it has no profile to be found under.
+*/
+const deliveryKindEnum = pgEnum("delivery_kind", ["journey", "test"]);
+/**
 * The delivery lifecycle, frozen with the API version.
 *
 * - `sent` is the only non-terminal status: it means SES accepted the
@@ -3419,10 +3419,15 @@ const deliveries$1 = pgTable("deliveries", {
 	orgId: text("org_id").notNull(),
 	/** The instance's environment, stamped from the workflow run input. */
 	environment: environmentEnum("environment").notNull(),
-	/** The recipient profile (`usr_`); a text column, since a delivery is a log row and outlives nothing but erasure. */
-	profileId: text("profile_id").notNull(),
-	/** Journey name (the Temporal workflow type), not the registry id. */
-	journey: text("journey").notNull(),
+	/**
+	* The recipient profile (`usr_`); a text column, since a delivery is a
+	* log row and outlives nothing but erasure. Null on a test send, which
+	* goes to the member who asked for it rather than to anyone's profile.
+	*/
+	profileId: text("profile_id"),
+	/** The journey that sent this; null on a test send, which has none. */
+	journey: text("journey"),
+	kind: deliveryKindEnum("kind").notNull().default("journey"),
 	/** Email template name or webhook destination name. */
 	step: text("step").notNull(),
 	channel: deliveryChannelEnum("channel").notNull(),
@@ -3611,13 +3616,13 @@ const executions$1 = pgTable("executions", {
 	id: text("id").primaryKey(),
 	orgId: text("org_id").notNull(),
 	environment: environmentEnum("environment").notNull(),
-	/** The journey's key, not a foreign key: derived journey rows come and go with releases. */
+	/** The journey's key, not a foreign key: derived journey rows come and go with pushes. */
 	journeyKey: text("journey_key").notNull(),
 	profileId: text("profile_id").notNull(),
 	workflowId: text("workflow_id").notNull(),
 	runId: text("run_id").notNull(),
-	/** The release the execution is pinned to for its whole life. */
-	releaseId: text("release_id").notNull(),
+	/** The journey version the execution is pinned to for its whole life. */
+	versionId: text("version_id").notNull(),
 	status: executionStatusEnum("status").notNull(),
 	/** Text summary of the command the execution is on, for the list view. */
 	step: text("step"),
@@ -3659,7 +3664,7 @@ const executions$1 = pgTable("executions", {
 		precision: 3
 	})
 }, (table) => [
-	index("executions_org_id_environment_release_id_status_idx").on(table.orgId, table.environment, table.releaseId, table.status),
+	index("executions_org_id_environment_version_id_status_idx").on(table.orgId, table.environment, table.versionId, table.status),
 	uniqueIndex("executions_org_id_workflow_id_unique").on(table.orgId, table.workflowId),
 	index("executions_org_id_environment_started_at_idx").on(table.orgId, table.environment, table.startedAt)
 ]);
@@ -3862,35 +3867,35 @@ const insertJourneyRunSchema = createInsertSchema(journeyRuns);
 //#endregion
 //#region ../../packages/db/src/schema/journeys.ts
 /**
-* Derived journey rows: one per (org, environment, key), upserted from the
-* manifest inside the deploy transaction. Nothing here is authored through
-* the API, which is why there is no id of its own: the key is the name the
-* author gave the file, and the (org, environment, key) triple is the only
-* identity a journey has.
+* Derived journey rows: one per (org, key), upserted from the manifest a
+* push carried. Nothing here is authored through the API, which is why
+* there is no id of its own: the key is the name the author gave the file,
+* and the (org, key) pair is the only identity a journey has.
 *
-* A deploy only ever adds and updates: it owns the keys its release carries
+* One row for both environments (ADR 0011): the journey's code is its
+* latest ready version, and what differs per environment is the enabled
+* flag alone. A trigger that should fire in both names both of an app's ids.
+*
+* A push only ever adds and updates: it owns the keys its manifest carries
 * and leaves every other row alone, because an org's journeys can come from
-* several projects and a developer may deploy a release holding only some of
+* several projects and a developer may push a project holding only some of
 * the files. `projectId` records which project put the row here, which is
-* what makes a key another project owns a refused deploy rather than a silent
+* what makes a key another project owns a refused push rather than a silent
 * overwrite. Removing a journey is an explicit delete (ADR 0009).
 *
-* `active` is the author's own rollout gate, flattened from the manifest's
-* `environments` list into this row's environment. The operator's kill
-* switch is deliberately NOT here: it lives in journey_states, which is
-* keyed the same way but outlives every release, so a redeploy never
-* silently re-enables something an operator turned off.
+* Whether a journey fires is one flag and one only: journey_states, per
+* environment, which outlives every push, so a push never turns anything on
+* or off. The author has no second gate of their own (ADR 0011).
 *
+* The descriptive columns are what its latest ready version reported, so a
+* failed compile leaves both the code and its description as they were.
 * `spine` is display only and never trusted: a journey's real control flow
 * is whatever its code does at run time.
 */
 const journeys$1 = pgTable("journeys", {
 	orgId: text("org_id").notNull(),
-	environment: environmentEnum("environment").notNull(),
 	key: text("key").notNull(),
-	/** The release this row was derived from; the one its executions run. */
-	releaseId: text("release_id").notNull(),
-	/** The project whose deploy owns this key in this environment. */
+	/** The project whose push owns this key. */
 	projectId: text("project_id").notNull(),
 	/** The author's labels, from the manifest; the dashboard's only grouping. */
 	tags: text("tags").array().notNull().default(sql`'{}'::text[]`),
@@ -3903,28 +3908,22 @@ const journeys$1 = pgTable("journeys", {
 	* the fixed pair.
 	*/
 	purpose: text("purpose").notNull(),
-	/** The manifest's `environments` contains this environment. */
-	active: boolean("active").notNull(),
 	spine: jsonb("spine").$type().notNull(),
 	createdAt: createdAt(),
 	updatedAt: updatedAt()
-}, (table) => [primaryKey({ columns: [
-	table.orgId,
-	table.environment,
-	table.key
-] }), index("journeys_org_id_environment_release_id_idx").on(table.orgId, table.environment, table.releaseId)]);
+}, (table) => [primaryKey({ columns: [table.orgId, table.key] })]);
 const selectJourneySchema = createSelectSchema(journeys$1);
 const insertJourneySchema = createInsertSchema(journeys$1);
 /**
 * Per-org, per-environment enable state for a journey key; the only
-* operator write on a journey. A row exists only once the org's admin has
-* toggled the journey in that environment: no row means the journey is
-* ENABLED there. The API applies that default at read time, so fresh orgs
-* and fresh deploys start with every journey on.
+* operator write on a journey, and the one gate on it. A row exists only
+* once someone turned the journey on or off in that environment: NO ROW
+* MEANS DISABLED (ADR 0011). A push writes none, so a key is off in both
+* environments until `cow enable` or a manager's toggle.
 *
 * Keyed by key rather than by a foreign key into `journeys` on purpose: the
-* derived rows are rebuilt per deploy, and the kill switch has to survive a
-* key that temporarily leaves a release and comes back.
+* flag outlives every push, so it survives a key that temporarily leaves a
+* project and comes back.
 */
 const journeyStates = pgTable("journey_states", {
 	orgId: text("org_id").notNull(),
@@ -4019,7 +4018,7 @@ const insertOrgSettingsSchema = createInsertSchema(orgSettings);
 //#region ../../packages/db/src/schema/projects.ts
 /**
 * An org's cow project: the folder a developer runs `cow init` in, and the
-* thing releases belong to. An org may hold several, one per repo, each with
+* thing pushes belong to. An org may hold several, one per repo, each with
 * its own release sequence, its own current release per environment, and its
 * own slice of the deployed journey rows. The name is how `cow.json` picks
 * one, so it is unique within the org.
@@ -4034,6 +4033,56 @@ const projects = pgTable("projects", {
 const selectProjectSchema = createSelectSchema(projects);
 const insertProjectSchema = createInsertSchema(projects);
 
+//#endregion
+//#region ../../packages/db/src/schema/pushes.ts
+/**
+* One `cow push`: the whole project at one point in time. A push stores the
+* source archive and creates a version of every key whose bundle changed
+* (ADR 0011); it settles nothing and changes no flag, so it has no status
+* of its own. What is compiling is read off its versions.
+*
+* `seq` is the human handle and is per project, allocated inside the create
+* transaction; the unique index leads with the org id so it doubles as the
+* tenancy key.
+*
+* The manifest is kept whole rather than only sliced across the versions:
+* it names the source archive `cow pull` unpacks, and its entry count is
+* the denominator the compile progress climbs towards.
+*/
+const pushes$1 = pgTable("pushes", {
+	id: text("id").primaryKey(),
+	orgId: text("org_id").notNull(),
+	projectId: text("project_id").notNull().references(() => projects.id),
+	seq: integer("seq").notNull(),
+	manifest: jsonb("manifest").$type().notNull(),
+	/** sha256 of the pushed manifest; the CLI compares it to skip a no-op push. */
+	manifestDigest: text("manifest_digest").notNull(),
+	/** Digest of the gzipped source tarball this push stored. */
+	sourceDigest: text("source_digest").notNull(),
+	createdBy: text("created_by").notNull(),
+	createdAt: createdAt()
+}, (table) => [uniqueIndex("pushes_org_id_project_id_seq_unique").on(table.orgId, table.projectId, table.seq), index("pushes_org_id_created_at_idx").on(table.orgId, table.createdAt)]);
+const selectPushSchema = createSelectSchema(pushes$1);
+const insertPushSchema = createInsertSchema(pushes$1);
+/**
+* Which artifacts a push uploaded or compiled, so the prune sweep can delete
+* the bytes no surviving push still needs. Denormalised out of the manifest
+* deliberately: pruning is a join, not a jsonb scan.
+*
+* A push survives while any of its versions does, so a version's module
+* bytes are kept by the push that compiled them.
+*/
+const pushArtifacts = pgTable("push_artifacts", {
+	orgId: text("org_id").notNull(),
+	pushId: text("push_id").notNull().references(() => pushes$1.id),
+	digest: text("digest").notNull(),
+	createdAt: createdAt()
+}, (table) => [primaryKey({ columns: [
+	table.orgId,
+	table.pushId,
+	table.digest
+] })]);
+
 //#endregion
 //#region ../../packages/db/src/schema/violations.ts
 /**
@@ -4114,96 +4163,6 @@ const quarantineEntries = pgTable("quarantine_entries", {
 const selectQuarantineEntrySchema = createSelectSchema(quarantineEntries);
 const insertQuarantineEntrySchema = createInsertSchema(quarantineEntries);
 
-//#endregion
-//#region ../../packages/db/src/schema/releases.ts
-/**
-* `pending` until the compile workflow finishes, then `ready` with module
-* digests recorded in the manifest, or `failed` with the error. Only a
-* `ready` release can be deployed.
-*/
-const releaseStatusEnum = pgEnum("release_status", [
-	"pending",
-	"ready",
-	"failed"
-]);
-/**
-* One `cow push`: the whole project at one point in time. The release, not
-* the journey, is the versioning unit, because it is atomic, matches git,
-* and pins a journey together with the templates it sends.
-*
-* `seq` is the human handle (`rel_… #12`) and is per project, allocated
-* inside the create transaction; the unique index leads with the org id so
-* it doubles as the tenancy key.
-*
-* Immutable except for the compile result, which is why there is no
-* `updatedAt`: `compiledAt`, `error` and `compiledEntries` are the only
-* fields that ever move. The first two move exactly once; `compiledEntries`
-* climbs while the compile runs, because a push is minutes of silence
-* otherwise and the manifest's own length is the denominator.
-*
-* A counter rather than a row per entry: the question both the CLI and the
-* dashboard ask is "how far along", which one integer answers at a fraction
-* of the write volume. Naming which entry is compiling needs per-entry rows
-* and is a different question.
-*/
-const releases$1 = pgTable("releases", {
-	id: text("id").primaryKey(),
-	orgId: text("org_id").notNull(),
-	projectId: text("project_id").notNull().references(() => projects.id),
-	seq: integer("seq").notNull(),
-	status: releaseStatusEnum("status").notNull(),
-	manifest: jsonb("manifest").$type().notNull(),
-	/** sha256 of the pushed manifest; `cow deploy` compares it to decide whether to push. */
-	manifestDigest: text("manifest_digest").notNull(),
-	createdBy: text("created_by").notNull(),
-	createdAt: createdAt(),
-	compiledAt: timestamp("compiled_at", {
-		withTimezone: true,
-		mode: "date",
-		precision: 3
-	}),
-	error: text("error"),
-	/** How many manifest entries have compiled and passed their checks. */
-	compiledEntries: integer("compiled_entries").notNull().default(0)
-}, (table) => [uniqueIndex("releases_org_id_project_id_seq_unique").on(table.orgId, table.projectId, table.seq), index("releases_org_id_created_at_idx").on(table.orgId, table.createdAt)]);
-const selectReleaseSchema = createSelectSchema(releases$1);
-const insertReleaseSchema = createInsertSchema(releases$1);
-/**
-* Which artifacts a release references, so the prune sweep can delete the
-* bytes no surviving release still needs. Denormalised out of the manifest
-* deliberately: pruning is a join, not a jsonb scan.
-*/
-const releaseArtifacts = pgTable("release_artifacts", {
-	orgId: text("org_id").notNull(),
-	releaseId: text("release_id").notNull().references(() => releases$1.id),
-	digest: text("digest").notNull(),
-	createdAt: createdAt()
-}, (table) => [primaryKey({ columns: [
-	table.orgId,
-	table.releaseId,
-	table.digest
-] })]);
-/**
-* Append-only: an environment's current release, for one project, is that
-* project's latest row, and rollback is another deployment of an earlier
-* release rather than a mutation. That is what makes the deployment history
-* readable and makes "the last two deployments" the whole of `cow rollback`.
-*
-* `projectId` is the release's own project, denormalised so "this project's
-* latest deployment in this environment" is one indexed read.
-*/
-const deployments$1 = pgTable("deployments", {
-	id: text("id").primaryKey(),
-	orgId: text("org_id").notNull(),
-	environment: environmentEnum("environment").notNull(),
-	releaseId: text("release_id").notNull().references(() => releases$1.id),
-	projectId: text("project_id").notNull().references(() => projects.id),
-	deployedBy: text("deployed_by").notNull(),
-	createdAt: createdAt()
-}, (table) => [index("deployments_org_id_environment_created_at_idx").on(table.orgId, table.environment, table.createdAt), index("deployments_org_id_project_id_environment_created_at_idx").on(table.orgId, table.projectId, table.environment, table.createdAt)]);
-const selectDeploymentSchema = createSelectSchema(deployments$1);
-const insertDeploymentSchema = createInsertSchema(deployments$1);
-
 //#endregion
 //#region ../../packages/db/src/schema/segments.ts
 /**
@@ -4433,6 +4392,68 @@ const suppressedAddresses = pgTable("suppressed_addresses", {
 const selectSuppressedAddressSchema = createSelectSchema(suppressedAddresses);
 const insertSuppressedAddressSchema = createInsertSchema(suppressedAddresses);
 
+//#endregion
+//#region ../../packages/db/src/schema/versions.ts
+const versionKindEnum = pgEnum("version_kind", ["journey", "template"]);
+/**
+* `compiling` until the push's compile workflow reaches this entry, then
+* `ready` with the module digest recorded, or `failed` with the error. Only
+* a `ready` version runs, so a failed compile leaves the previous one
+* running (ADR 0011).
+*/
+const versionStatusEnum = pgEnum("version_status", [
+	"compiling",
+	"ready",
+	"failed"
+]);
+/**
+* An immutable, content-addressed snapshot of one journey or one template.
+* The latest ready version of a key is what new executions and new sends
+* use; an execution pins the journey version it started on for its whole
+* life (ADR 0004).
+*
+* `moduleDigest` is the content address and is null until the compile
+* settles: a version that never compiled has no module to be addressed by,
+* and Postgres leaves nulls out of the unique index, so a key that fails to
+* compile twice records both failures.
+*
+* `pushedAt` is the ordering key rather than a creation stamp, because an
+* unchanged key gets no new version: a push that re-sends bytes a version
+* already holds bumps this instead, which is what makes `git revert` plus
+* `cow push` put the reverted code back in front.
+*/
+const versions$1 = pgTable("versions", {
+	id: text("id").primaryKey(),
+	orgId: text("org_id").notNull(),
+	/** The file basename its author wrote; unique per org within a kind. */
+	key: text("key").notNull(),
+	kind: versionKindEnum("kind").notNull(),
+	/** The project that pushed this key; ADR 0009's ownership. */
+	projectId: text("project_id").notNull().references(() => projects.id),
+	/** The push that compiled this version's module. */
+	pushId: text("push_id").notNull().references(() => pushes$1.id),
+	moduleDigest: text("module_digest"),
+	manifest: jsonb("manifest").$type().notNull(),
+	status: versionStatusEnum("status").notNull(),
+	pushedAt: timestamp("pushed_at", {
+		withTimezone: true,
+		mode: "date",
+		precision: 3
+	}).notNull().defaultNow(),
+	compiledAt: timestamp("compiled_at", {
+		withTimezone: true,
+		mode: "date",
+		precision: 3
+	}),
+	error: text("error")
+}, (table) => [
+	uniqueIndex("versions_org_id_kind_key_module_digest_unique").on(table.orgId, table.kind, table.key, table.moduleDigest),
+	index("versions_org_id_kind_key_pushed_at_idx").on(table.orgId, table.kind, table.key, table.pushedAt),
+	index("versions_org_id_push_id_idx").on(table.orgId, table.pushId)
+]);
+const selectVersionSchema = createSelectSchema(versions$1);
+const insertVersionSchema = createInsertSchema(versions$1);
+
 //#endregion
 //#region ../../packages/db/src/schema/wallets.ts
 /**
@@ -4589,12 +4610,11 @@ const ERROR_CODE_STATUS = {
 	journey_error: 500,
 	journey_output_invalid: 500,
 	journey_nondeterministic: 500,
-	release_invalid: 422,
-	release_not_ready: 409,
+	push_invalid: 422,
+	version_not_ready: 409,
 	project_exists: 409,
 	project_missing: 404,
-	artifact_too_large: 413,
-	deploy_key_scope: 403
+	artifact_too_large: 413
 };
 /** First zod issue's message: enough signal for a 422 without a novel format. */
 function firstIssueMessage(error) {
@@ -4657,10 +4677,10 @@ const identifierDtoSchema = z.object({
 //#endregion
 //#region ../../packages/shared/src/journeys-v2/manifest.ts
 /**
-* The release manifest (spec: Build; Push and compile): what `cow build`
+* The pushed manifest (spec: Build; Push and compile): what `cow build`
 * extracts from a project and `cow push` uploads with the bundles. The
-* server validates it with these schemas, compiles every bundle, and stores
-* the compiled form on the release row.
+* server validates it with these schemas, compiles every bundle whose key
+* changed, and stores that entry on the version it creates.
 */
 /**
 * A journey or template key: the file basename under `journeys/` or
@@ -4740,7 +4760,7 @@ const patternSchema = z.union([onePatternSchema, z.array(onePatternSchema).min(1
 * reuses it.
 *
 * Both members are strict, so a journey holding the retired `source` key
-* fails to compile a release instead of silently triggering on every app.
+* fails to compile instead of silently triggering on every app.
 * There is deliberately no pipe filter: a trigger narrows by the app the
 * write is attributed to, the same token a segment definition names.
 */
@@ -4809,6 +4829,13 @@ const spineEntrySchema = z.object({
 		return z.array(spineEntrySchema).optional();
 	}
 }).meta({ id: "JourneySpineEntry" });
+/**
+* One journey in a stored manifest. A plain (non-strict) object on purpose:
+* a manifest pushed before the author's rollout gate went away still carries
+* `environments`, and every stored manifest has to keep parsing for good
+* (ADR 0011). Zod strips the key, and the journey runs wherever the
+* per-environment enabled flag says it runs, which is the one gate there is.
+*/
 const manifestJourneySchema = z.object({
 	key: journeyKeySchema,
 	/** The author's labels; the dashboard's only grouping. */
@@ -4816,7 +4843,7 @@ const manifestJourneySchema = z.object({
 	trigger: triggerSchema,
 	/**
 	* A fixed purpose or one the project declares. Checked against the org's
-	* declared set at deploy time, not here: a manifest is built and pushed
+	* declared set at push time, not here: a manifest is built and pushed
 	* without ever reaching the org whose rows say what exists.
 	*/
 	purpose: consentPurposeKeySchema,
@@ -4827,12 +4854,10 @@ const manifestJourneySchema = z.object({
 	* development, which is the one thing a journey must not do.
 	*
 	* Optional here and required at `defineJourney`, exactly like `purposes`: a
-	* release pushed before the field existed carries none and its stored
+	* version pushed before the field existed carries none and its stored
 	* manifest still parses. The author's build is where the error is useful.
 	*/
 	senderIdentity: destinationNameSchema.optional(),
-	/** The author's rollout gate: the journey is active only in these. */
-	environments: environmentsSchema,
 	spine: z.array(spineEntrySchema),
 	bundle: digestSchema
 });
@@ -4864,27 +4889,27 @@ function uniqueKeys(items, ctx, path) {
 }
 /**
 * What `cow build` writes to `.cow/build/manifest.json`, and the shape a
-* release row stores for good.
+* push row stores for good, entry by entry, on the versions it creates.
 *
 * `protocol` is any positive integer rather than the current constant on
-* purpose: a release is immutable and an execution stays pinned to the one it
-* started on, so the day the protocol is bumped every stored release must
-* still parse, or the runner, the deploy, and every API response the client
-* validates all break at once for any org with history. The literal lives at
-* push time only (`createReleaseBodySchema`), which is where a stale CLI is
-* the developer's own fixable problem, and deploy plus the runner refuse a
-* release built for another protocol with a message naming both numbers.
+* purpose: a version is immutable and an execution stays pinned to the one
+* it started on, so the day the protocol is bumped every stored push must
+* still parse, or the runner and every API response the client validates
+* break at once for any org with history. The literal lives at push time
+* only (`createPushBodySchema`), which is where a stale CLI is the
+* developer's own fixable problem, and the runner refuses a version built
+* for another protocol with a message naming both numbers.
 */
 const manifestSchema = z.object({
 	protocol: z.number().int().positive(),
 	/** The `@cowliss/cli` version the project was built with. */
 	sdk: z.string().min(1),
-	journeys: z.array(manifestJourneySchema).max(RELEASE_LIMITS.journeys),
-	templates: z.array(manifestTemplateSchema).max(RELEASE_LIMITS.templates),
+	journeys: z.array(manifestJourneySchema).max(PUSH_LIMITS.journeys),
+	templates: z.array(manifestTemplateSchema).max(PUSH_LIMITS.templates),
 	/**
 	* The consent purposes this project declares, copied from `cow.json`.
-	* Optional rather than defaulted: a release pushed before purposes
-	* existed carries none, and its stored manifest still parses.
+	* Optional rather than defaulted: a push made before purposes existed
+	* carries none, and its stored manifest still parses.
 	*/
 	purposes: purposesSchema.optional(),
 	/** Digest of the gzipped source tarball. */
@@ -4895,27 +4920,12 @@ const manifestSchema = z.object({
 	uniqueKeys(manifest.purposes ?? [], ctx, "purposes");
 });
 /**
-* The manifest as the release row stores it once compilation succeeded:
-* the pushed manifest plus the compiled module digest per key, and the
-* digest of the Javy engine plugin the toolchain that compiled them was
-* built from.
-*
-* Journeys and templates are keyed separately because they share a key
-* space: `welcome.ts` and `welcome.tsx` are one journey and the email it
-* sends in every example, and a flat map would let one overwrite the other.
-*
-* `plugin` is a toolchain record, not a linked artifact: modules are
-* statically linked, so the plugin bytes are inside each module. It says
-* which engine compiled the release, which is what a later bug report or a
-* reproducible rebuild needs.
+* One entry of a stored manifest: what a version is a snapshot of. Journeys
+* and templates are kept apart because they share a key space (`welcome.ts`
+* and `welcome.tsx` are one journey and the email it sends in every
+* example), and the version's own `kind` says which of the two this is.
 */
-const compiledManifestSchema = manifestSchema.safeExtend({
-	modules: z.object({
-		journeys: z.record(journeyKeySchema, digestSchema),
-		templates: z.record(journeyKeySchema, digestSchema)
-	}),
-	plugin: digestSchema
-});
+const versionManifestSchema = z.union([manifestJourneySchema, manifestTemplateSchema]);
 
 //#endregion
 //#region ../../packages/shared/src/timestamp.ts
@@ -5543,6 +5553,8 @@ const listDeliveriesQuerySchema = paginationQuerySchema.extend({
 	direction: sortDirectionSchema.default("desc"),
 	status: deliveryStatusSchema.optional(),
 	journey: z.string().trim().min(1).max(200).optional(),
+	/** The template or destination this attempt was for; a template page's own log. */
+	step: z.string().trim().min(1).max(200).optional(),
 	channel: deliveryChannelSchema.optional(),
 	appId: z.string().trim().min(1).max(200).optional(),
 	/** One person's deliveries, merged ids included, same as the event feed. */
@@ -5703,6 +5715,20 @@ const domainDnsSetupSchema = z.object({
 	provider: z.string().nullable()
 });
 
+//#endregion
+//#region ../../packages/shared/src/enabled.ts
+/**
+* The enable flag per environment; absent rows read as off (ADR 0011).
+*
+* Its own module because both `journeys.ts` and `pushes.ts` need it and
+* neither may import the other: a journey carries the flag, and so does the
+* project status a push is read back through.
+*/
+const journeyEnabledSchema = z.object({
+	development: z.boolean(),
+	production: z.boolean()
+});
+
 //#endregion
 //#region ../../packages/shared/src/patterns.ts
 /**
@@ -5999,7 +6025,6 @@ const manifestOutputSchema = z.discriminatedUnion("kind", [manifestJourneySchema
 	trigger: true,
 	purpose: true,
 	senderIdentity: true,
-	environments: true,
 	tags: true
 }).extend({ kind: z.literal("journey") }), manifestTemplateSchema.pick({
 	sendClass: true,
@@ -6030,8 +6055,8 @@ const executionStatusSchema = z.enum(EXECUTION_STATUSES);
 //#endregion
 //#region ../../packages/shared/src/executions.ts
 /**
-* Executions: one run of one journey for one profile, pinned to the release
-* it started under. This replaces v1's journey instances, which were read
+* Executions: one run of one journey for one profile, pinned to the journey
+* version it started on. This replaces v1's journey instances, which were read
 * straight from Temporal: an execution row outlives its workflow's retention
 * and can be listed and filtered without a Temporal round trip, while
 * Temporal stays the source of truth for the run itself.
@@ -6065,7 +6090,8 @@ const executionDetailSchema = executionSchema.extend({
 const listExecutionsQuerySchema = paginationQuerySchema.extend({
 	/** A journey key; the environment comes from the selection header. */
 	journey: z.string().trim().min(1).max(200).optional(),
-	release: z.string().trim().min(1).max(200).optional(),
+	/** One version's own runs, for the history rows on a journey. */
+	version: z.string().trim().min(1).max(200).optional(),
 	status: executionStatusSchema.optional(),
 	profileId: z.string().trim().min(1).max(200).optional(),
 	/**
@@ -6077,20 +6103,215 @@ const listExecutionsQuerySchema = paginationQuerySchema.extend({
 	*/
 	since: z.iso.datetime().optional()
 });
+/**
+* What to stop: every live execution of one journey in the selected
+* environment, or the ones still pinned to one version. Cancelling is
+* explicit and per environment (ADR 0011): disabling a journey stops new
+* entries and lets what is running finish, and this is the other verb.
+*/
+const cancelExecutionsBodySchema = z.object({ data: z.union([z.object({ journey: z.string().trim().min(1).max(200) }), z.object({ version: z.string().trim().min(1).max(200) })]) });
+/**
+* Cancelling is a request, not an edit: each execution stops when it reaches
+* its next step, so the answer is that the sweep is under way rather than a
+* count of what has already stopped.
+*/
+const cancellingSchema = z.object({ cancelling: z.literal(true) });
+
+//#endregion
+//#region ../../packages/shared/src/journeys-v2/config.ts
+/**
+* A project's name: what `cow init` asked for, and what the `projects` row
+* stores. Lives here rather than beside the release DTOs because `cow.json`
+* is the file a developer types it into; `createProjectBodySchema` reuses it.
+*/
+const projectNameSchema = z.string().trim().min(1).max(200);
+/**
+* `cow.json` (spec: Project layout): the org, and which of its projects this
+* directory is. The environment is always a flag, and auth never lives in
+* the project. Strict, so a typo'd key is a build error rather than a
+* silently ignored setting.
+*/
+const cowConfigSchema = z.strictObject({
+	$schema: z.url().optional(),
+	orgId: z.string().startsWith(CLERK_ORG_SUBJECT_PREFIX, "orgId must be a Clerk org id"),
+	/**
+	* Which project of the org this directory pushes to. One org can hold
+	* several, one per repo, each with its own release sequence and its own
+	* slice of the deployed journeys, so every project says which it is.
+	*/
+	project: projectNameSchema,
+	/**
+	* The consent purposes this project declares. They are org-wide, so two
+	* projects declaring one key must agree on its label and default or the
+	* deploy is refused; a deploy adds and updates them and never deletes
+	* one, because profiles hold answers against them.
+	*/
+	purposes: purposesSchema.optional(),
+	/** Overrides the API the CLI talks to; the hosted product needs none. */
+	apiUrl: z.url().optional(),
+	/**
+	* Overrides the dashboard `cow login` opens. Paired with `apiUrl`: a
+	* login against one Cowliss's dashboard yields a token the other's API
+	* rejects, so a config that names an API names its dashboard too.
+	*/
+	webUrl: z.url().optional()
+}).meta({
+	title: "cow.json",
+	description: "A cow project: the organization and the project it pushes to."
+});
+
+//#endregion
+//#region ../../packages/shared/src/pushes.ts
+/**
+* The push lifecycle's wire contracts (ADR 0011): the project a developer
+* runs `cow init` in, the artifacts `cow push` uploads, the push itself, and
+* the versions its compile produces.
+*
+* Row-derived through drizzle-zod where a row is what the wire carries, so
+* the DTO cannot drift from the column set; the jsonb manifest gets its
+* explicit shared schema, because the column type is opaque to drizzle-zod.
+*/
+const projectSchema = selectProjectSchema.extend({
+	createdAt: z.iso.datetime(),
+	updatedAt: z.iso.datetime()
+});
+/** `cow init` names the project after the folder it created. */
+const createProjectBodySchema = z.object({ data: z.object({ name: projectNameSchema }) });
+/** Which project to read: the one the caller's `cow.json` names. */
+const getProjectQuerySchema = z.object({ name: projectNameSchema });
+const artifactDigestParams = z.object({ digest: digestSchema });
+/**
+* Which kind of artifact the uploaded bytes are. Named by the client rather
+* than sniffed, because only the build knows whether a blob is a journey
+* bundle or the source tarball, and the value is metadata for the prune
+* sweep and the sandbox's cache rather than a trust boundary: what a module
+* is, is decided by the server-side compile step. `module` is absent on
+* purpose, since only that compile step ever writes one.
+*/
+const putArtifactQuerySchema = z.object({ kind: z.enum(["bundle", "source"]) });
+/**
+* One version as the API reports it: the immutable snapshot of one journey
+* or one template, with the manifest entry it was built from. `manifest` is
+* the pushed entry either way; which of the two shapes it is follows `kind`.
+*/
+const versionSchema = selectVersionSchema.extend({
+	manifest: z.union([manifestJourneySchema, manifestTemplateSchema]),
+	pushedAt: z.iso.datetime(),
+	compiledAt: z.iso.datetime().nullable()
+});
+/**
+* A version as another resource points at it: what the dashboard's "latest
+* version" column shows (the short digest, when it was pushed, whether it
+* compiled) and the push its source archive lives on. The manifest entry is
+* left out, because a journey row already carries what its own entry says.
+*/
+const versionSummarySchema = selectVersionSchema.pick({
+	id: true,
+	status: true,
+	moduleDigest: true,
+	pushId: true,
+	projectId: true,
+	error: true
+}).extend({ pushedAt: z.iso.datetime() });
+/**
+* A push as the API reports it, with the versions it created: `cow push`
+* returns as soon as the upload is stored, so what is compiling, what is
+* ready and what failed is read back from here.
+*
+* `compiledEntries` and `totalEntries` are not columns: they are the settled
+* and the total count of those versions, so a counter can never disagree
+* with the rows it counts. A key whose module did not change gets no new
+* version, which is why the denominator is the changed keys rather than the
+* manifest's length.
+*/
+const pushSchema = selectPushSchema.extend({
+	manifest: manifestSchema,
+	versions: z.array(versionSchema),
+	compiledEntries: z.number().int(),
+	totalEntries: z.number().int(),
+	createdAt: z.iso.datetime()
+});
+const createPushBodySchema = z.object({ data: z.object({
+	/**
+	* The one place the protocol is pinned to the constant. The stored shape
+	* takes any positive integer, because a version outlives a bump; a push
+	* is a live CLI talking to a live platform, so a mismatch here is a 422
+	* the developer fixes by updating `@cowliss/cli`, and nothing is stored.
+	*/
+	manifest: manifestSchema.safeExtend({ protocol: z.literal(2) }),
+	/** The `cow.json` project this push belongs to. */
+	project: projectNameSchema
+}) });
+const listPushesQuerySchema = paginationQuerySchema.extend({ 
+/** One project's own pushes; absent lists the org's. */
+project: projectNameSchema.optional() });
+/**
+* One key's version history, newest first. Both the key and the kind are
+* required: journeys and templates share a key space, so `welcome` alone
+* names two different histories.
+*/
+const listVersionsQuerySchema = paginationQuerySchema.extend({
+	key: z.string().trim().min(1).max(200),
+	kind: z.enum(["journey", "template"])
+});
+/**
+* One key of a project as `cow status` and the MCP `status` tool report it:
+* the code the server holds for it, whether it is on, and what is still
+* running. Journeys and templates share the shape, because a developer asks
+* the same question of both; the two fields only a journey has are null on a
+* template.
+*/
+const projectStatusKeySchema = z.object({
+	kind: z.enum(["journey", "template"]),
+	key: z.string(),
+	/**
+	* The newest version of this key, whatever its compile state, which is
+	* what says whether the tree in front of the developer is the code the
+	* server holds. Null only for a journey whose versions are all pruned.
+	*/
+	latestVersion: versionSchema.nullable(),
+	/** The flag per environment; null on a template, which has none. */
+	enabled: journeyEnabledSchema.nullable(),
+	/** Executions still running or waiting, per environment. */
+	liveExecutions: z.object({
+		development: z.number().int(),
+		production: z.number().int()
+	})
+});
+/**
+* Everything the server knows about one project's keys, in one read: the
+* whole project rather than a page of it, because a manifest holds at most
+* `PUSH_LIMITS.journeys + PUSH_LIMITS.templates` keys and the answer to "what
+* is my project doing" is useless split across cursors.
+*
+* `warnings` is what a deploy used to answer with (ADR 0011 retired the
+* deploy): a name a journey references that the environment does not define
+* yet. They never block, because a segment or a destination may be created
+* right after a push.
+*/
+const projectStatusSchema = z.object({
+	project: projectNameSchema,
+	keys: z.array(projectStatusKeySchema),
+	warnings: z.object({
+		development: z.array(z.string()),
+		production: z.array(z.string())
+	})
+});
 
 //#endregion
 //#region ../../packages/shared/src/journeys.ts
 /**
-* Journeys as the API reports them: the rows a deploy derives from the
-* environment's current release, one per (org, environment, key). Nothing
-* here is authored through the API, so the only write is the enable toggle.
+* Journeys as the API reports them: the rows a push derives from its
+* manifest, one per (org, key). Nothing here is authored through the API, so
+* the only write is the enable flag.
 *
 * Derived from the Drizzle table via drizzle-zod so the wire DTO and the row
 * share one source of truth; the jsonb columns get explicit wire schemas
 * because the row types are opaque to drizzle-zod. `enabled` is not a
-* column: it is the effective journey_states value for the caller's org and
-* environment (default true, see the schema comment on journey_states in
-* packages/db).
+* column: it is the journey_states value per environment, absent meaning
+* off, and both environments are reported whichever one the caller selected,
+* because "is this on in production?" is the question the list exists to
+* answer.
 */
 const journeyTriggerSchema = triggerSchema;
 /**
@@ -6103,23 +6324,26 @@ const journeySchema = selectJourneySchema.extend({
 	trigger: journeyTriggerSchema,
 	purpose: consentPurposeKeySchema,
 	spine: z.array(journeySpineEntrySchema),
-	enabled: z.boolean(),
+	enabled: journeyEnabledSchema,
+	/**
+	* The newest version of this key, whatever it compiled to, so a list can
+	* say "pushed 2 hours ago" and "compiling" without a second read. What the
+	* journey RUNS is the newest one that finished compiling, which is this
+	* one unless it is still compiling or failed. Null only for a key whose
+	* versions have all been pruned.
+	*/
+	latestVersion: versionSummarySchema.nullable(),
 	createdAt: z.iso.datetime(),
 	updatedAt: z.iso.datetime()
 });
 /**
-* Enable/disable is the only operator write on a journey, and it is per org
-* and per environment: the environment comes from the selection header, not
-* from the body, so the toggle acts on whichever one the caller is in.
-*/
-const updateJourneyBodySchema = z.object({ data: z.object({ enabled: z.boolean() }) });
-/**
 * Journey list query. `q` is a substring search over the key and the tags,
 * the two things an author names a journey by; `tag` is "has this tag",
 * exact and case-sensitive, so a badge in the table is the way into it.
 * Both are server-side, like every other list filter.
 */
 const listJourneysQuerySchema = paginationQuerySchema.extend({
+	/** On or off in the environment the call selected. */
 	enabled: z.enum(["true", "false"]).optional(),
 	q: z.string().trim().max(200, "q must be at most 200 characters").optional().transform((value) => value ? value : void 0),
 	tag: z.string().trim().max(50, "tag must be at most 50 characters").optional()
@@ -6171,7 +6395,21 @@ const userJourneySchema = z.object({
 });
 const listUserJourneysQuerySchema = paginationQuerySchema;
 /**
-* Dry run: one real profile, the environment's current release, and every
+* Which journeys the flag acts on: the keys the caller named, or every
+* journey of one project. Exactly one of the two, because a call carrying
+* both would have to decide which it meant.
+*
+* A list rather than one key per call so every surface can do what `cow
+* enable` does: name several keys, or `--all` (which is `project`, resolved
+* server-side, so an agent turning a project on is one call too).
+*/
+const setJourneysEnabledBodySchema = z.object({ data: z.object({
+	keys: z.array(journeyKeySchema).min(1).max(PUSH_LIMITS.journeys).optional(),
+	/** Every journey of this project, by the name `cow.json` carries. */
+	project: projectNameSchema.optional()
+}).refine((data) => data.keys === void 0 !== (data.project === void 0), { message: "name keys or a project, not both" }) });
+/**
+* Dry run: one real profile, the journey's latest ready version, and every
 * send gated into a `would_*` row instead of a message. The body is the v1
 * one; the response is the started execution, because executions are rows
 * now and a v1 instance was a Temporal read.
@@ -6179,56 +6417,13 @@ const listUserJourneysQuerySchema = paginationQuerySchema;
 const dryRunJourneyBodySchema = z.object({ data: z.object({ profileId: z.string().min(1) }) });
 
 //#endregion
-//#region ../../packages/shared/src/journeys-v2/config.ts
+//#region ../../packages/shared/src/journeys-v2/sandbox.ts
 /**
-* A project's name: what `cow init` asked for, and what the `projects` row
-* stores. Lives here rather than beside the release DTOs because `cow.json`
-* is the file a developer types it into; `createProjectBodySchema` reuses it.
-*/
-const projectNameSchema = z.string().trim().min(1).max(200);
-/**
-* `cow.json` (spec: Project layout): the org, and which of its projects this
-* directory is. The environment is always a flag, and auth never lives in
-* the project. Strict, so a typo'd key is a build error rather than a
-* silently ignored setting.
-*/
-const cowConfigSchema = z.strictObject({
-	$schema: z.url().optional(),
-	orgId: z.string().startsWith(CLERK_ORG_SUBJECT_PREFIX, "orgId must be a Clerk org id"),
-	/**
-	* Which project of the org this directory pushes to. One org can hold
-	* several, one per repo, each with its own release sequence and its own
-	* slice of the deployed journeys, so every project says which it is.
-	*/
-	project: projectNameSchema,
-	/**
-	* The consent purposes this project declares. They are org-wide, so two
-	* projects declaring one key must agree on its label and default or the
-	* deploy is refused; a deploy adds and updates them and never deletes
-	* one, because profiles hold answers against them.
-	*/
-	purposes: purposesSchema.optional(),
-	/** Overrides the API the CLI talks to; the hosted product needs none. */
-	apiUrl: z.url().optional(),
-	/**
-	* Overrides the dashboard `cow login` opens. Paired with `apiUrl`: a
-	* login against one Cowliss's dashboard yields a token the other's API
-	* rejects, so a config that names an API names its dashboard too.
-	*/
-	webUrl: z.url().optional()
-}).meta({
-	title: "cow.json",
-	description: "A cow project: the organization and the project it deploys to."
-});
-
-//#endregion
-//#region ../../packages/shared/src/journeys-v2/sandbox.ts
-/**
-* What the sandbox worker's activities return (spec: Sandbox worker). A
-* guest failure is a value, not a throw: the runner has to journal it and
-* record it on the execution, and a Temporal retry would only reproduce it.
-* Infrastructure failures (a missing binary, a spawn error, Postgres down)
-* throw and retry on the activity's bounded policy.
+* What the sandbox worker's activities return (spec: Sandbox worker). A
+* guest failure is a value, not a throw: the runner has to journal it and
+* record it on the execution, and a Temporal retry would only reproduce it.
+* Infrastructure failures (a missing binary, a spawn error, Postgres down)
+* throw and retry on the activity's bounded policy.
 */
 /** Every way a guest invocation can fail, as the runner records it. */
 const SANDBOX_FAILURE_CODES = [
@@ -6320,115 +6515,6 @@ const notificationPreferencesSchema = z.object({ purposes: z.array(notificationP
 */
 const updateNotificationPreferencesBodySchema = z.object({ data: z.object({ purposes: consentPatchSchema }) });
 
-//#endregion
-//#region ../../packages/shared/src/releases.ts
-/**
-* The release lifecycle's wire contracts (spec: Releases, deployments,
-* artifacts): the project a developer runs `cow init` in, the artifacts
-* `cow push` uploads, the releases it creates, and the deployments that make
-* one of them the environment's current code.
-*
-* Row-derived through drizzle-zod where a row is what the wire carries, so
-* the DTO cannot drift from the column set; the jsonb manifest gets its
-* explicit shared schema, because the column type is opaque to drizzle-zod.
-*/
-const projectSchema = selectProjectSchema.extend({
-	createdAt: z.iso.datetime(),
-	updatedAt: z.iso.datetime()
-});
-/** `cow init` names the project after the folder it created. */
-const createProjectBodySchema = z.object({ data: z.object({ name: projectNameSchema }) });
-/** Which project to read: the one the caller's `cow.json` names. */
-const getProjectQuerySchema = z.object({ name: projectNameSchema });
-const artifactDigestParams = z.object({ digest: digestSchema });
-/**
-* Which kind of artifact the uploaded bytes are. Named by the client rather
-* than sniffed, because only the build knows whether a blob is a journey
-* bundle or the source tarball, and the value is metadata for the prune
-* sweep and the sandbox's cache rather than a trust boundary: what a module
-* is, is decided by the server-side compile step. `module` is absent on
-* purpose, since only that compile step ever writes one.
-*/
-const putArtifactQuerySchema = z.object({ kind: z.enum(["bundle", "source"]) });
-/**
-* A release as the API reports it. The manifest is the pushed one while the
-* release is `pending` or `failed`, and the compiled one (module digests per
-* key, plus the engine plugin digest) once it is `ready`; the union says so
-* rather than making the compiled fields optional on one shape.
-*
-* `deployedIn` is not a column: it is the environments whose latest
-* deployment names this release, computed on read, so it can never fall out
-* of sync with the append-only deployment log. Neither is `totalEntries`:
-* the manifest is already here and its journeys plus its templates are the
-* denominator, so storing it beside `compiledEntries` would only invite the
-* two to disagree.
-*/
-const releaseSchema = selectReleaseSchema.extend({
-	manifest: z.union([compiledManifestSchema, manifestSchema]),
-	deployedIn: z.array(environmentSchema),
-	/**
-	* How many journeys and templates the manifest holds: the denominator
-	* `compiledEntries` climbs towards, counted on read rather than stored.
-	*/
-	totalEntries: z.number().int(),
-	createdAt: z.iso.datetime(),
-	compiledAt: z.iso.datetime().nullable()
-});
-const createReleaseBodySchema = z.object({ data: z.object({
-	/**
-	* The one place the protocol is pinned to the constant. The stored shape
-	* takes any positive integer, because a release outlives a bump; a push
-	* is a live CLI talking to a live platform, so a mismatch here is a 422
-	* the developer fixes by updating `@cowliss/cli`, and nothing is stored.
-	*/
-	manifest: manifestSchema.safeExtend({ protocol: z.literal(2) }),
-	/** The `cow.json` project this push belongs to. */
-	project: projectNameSchema
-}) });
-const listReleasesQuerySchema = paginationQuerySchema.extend({ 
-/** One project's own releases; absent lists the org's. */
-project: projectNameSchema.optional() });
-/**
-* How many live executions the cancel sweep was asked to stop, and the
-* workflow doing the stopping. The count is taken when the request lands, so
-* it is the size of the job rather than a result: the sweep is asynchronous
-* and the runner records `cancelled` as each execution reaches its next
-* step. A second call while a sweep runs answers with that sweep's id.
-*/
-const cancelExecutionsSchema = z.object({
-	releaseId: z.string(),
-	environment: environmentSchema,
-	requested: z.number().int(),
-	workflowId: z.string()
-});
-/**
-* A deployment, plus the warnings the deploy raised: segment names in
-* triggers and destination names in spines that do not exist in the target
-* environment. They never block, because either may be created afterwards.
-* `left` is the other half of the same conversation: what the deploy did not
-* touch, because a deploy only ever adds and updates (ADR 0009).
-*/
-const deploymentSchema = selectDeploymentSchema.extend({
-	createdAt: z.iso.datetime(),
-	warnings: z.array(z.string()),
-	/**
-	* Journeys this project still runs in the environment that the deployed
-	* release does not carry. A deploy never removes one, so these keep running
-	* until someone deletes them; the CLI prints them and says how.
-	*/
-	left: z.array(z.string()),
-	/** The deployed release's per-project sequence number, its human handle. */
-	releaseSeq: z.number().int()
-});
-const createDeploymentBodySchema = z.object({ data: z.object({ releaseId: z.string().min(1) }) });
-const listDeploymentsQuerySchema = paginationQuerySchema.extend({
-	environment: environmentSchema.optional(),
-	/** One release's own deployment history, across both environments. */
-	release: z.string().trim().min(1).max(200).optional(),
-	/** One project's own deployments; absent lists the org's. */
-	project: projectNameSchema.optional()
-});
-
 //#endregion
 //#region ../../packages/shared/src/violations.ts
 /**
@@ -6807,6 +6893,54 @@ const suppressedAddressSchema = selectSuppressedAddressSchema.extend({
 */
 const listSuppressionsQuerySchema = paginationQuerySchema.extend({ q: searchQuerySchema });
 
+//#endregion
+//#region ../../packages/shared/src/templates.ts
+/**
+* Templates as the API reports them. A template has versions and nothing
+* else (ADR 0011): no row of its own, no environment, no flag. What is
+* reported here is one key, described by its newest version, plus the
+* journeys whose steps send it.
+*
+* The descriptive fields come from that version's manifest entry rather than
+* from a column, which is what keeps them true for a key whose latest push
+* is still compiling: the entry describes the code that was pushed, and the
+* send resolves the latest ready version on its own at send time.
+*/
+const templateSchema = z.object({
+	key: journeyKeySchema,
+	/** The project whose push owns this key (ADR 0009). */
+	projectId: z.string(),
+	/** The author's labels; the dashboard's only grouping. */
+	tags: tagsSchema,
+	sendClass: z.enum(SEND_CLASSES),
+	/** True when the template asks for a signed `verifyUrl` prop at send time. */
+	verifyLink: z.boolean(),
+	/** JSON Schema of the template's props, as `cow build` converted them. */
+	propsSchema: z.record(z.string(), z.unknown()),
+	/** The newest version of this key, whatever it compiled to. */
+	latestVersion: versionSummarySchema,
+	/** Keys of the journeys whose steps send this template. */
+	journeys: z.array(z.string())
+});
+/**
+* Template list query. `q` is a substring search over the key, which is the
+* name the author gave the file. Tags are not a filter here the way they are
+* on journeys: a template has no row, so its tags live inside the version's
+* manifest entry, and searching inside that is a query the database layer
+* would have to grow a helper for. The badges in each row still show them.
+*/
+const listTemplatesQuerySchema = paginationQuerySchema.extend({ q: z.string().trim().max(200, "q must be at most 200 characters").optional().transform((value) => value ? value : void 0) });
+/** The props a preview or a test send renders the template with. */
+const renderTemplateBodySchema = z.object({ data: z.object({ props: z.record(z.string(), z.unknown()).default({}) }) });
+/** What the sandbox rendered: the message as it would go out. */
+const templatePreviewSchema = z.object({
+	subject: z.string(),
+	html: z.string(),
+	text: z.string(),
+	/** The version that rendered it: the latest one that finished compiling. */
+	versionId: z.string()
+});
+
 //#endregion
 //#region ../../packages/shared/src/users.ts
 /**
@@ -7055,28 +7189,11 @@ async function clearCredentials$1(path = defaultCredentialsPath()) {
 	}
 }
 
-//#endregion
-//#region ../../packages/shared/src/stable-json.ts
-/**
-* A key-sorted JSON rendering, for comparing or hashing two values a JSON
-* round trip may have reordered. `undefined` members are dropped the way
-* `JSON.stringify` drops them.
-*
-* Its own module with no imports at all, because both users need it and
-* they sit on opposite sides of a boundary: the release digest (which pulls
-* in node:crypto) and the compile workflow (which may not pull in anything).
-*/
-function stableJson(value) {
-	if (Array.isArray(value)) return `[${value.map(stableJson).join(",")}]`;
-	if (value !== null && typeof value === "object") return `{${Object.entries(value).filter(([, item]) => item !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([key, item]) => `${JSON.stringify(key)}:${stableJson(item)}`).join(",")}}`;
-	return JSON.stringify(value) ?? "null";
-}
-
 //#endregion
 //#region ../../packages/shared/src/digest.ts
 /**
 * `sha256:` plus the lowercase hex digest of these exact bytes: how every
-* artifact in the release lifecycle is named. `cow build` computes it over
+* artifact a push uploads is named. `cow build` computes it over
 * each bundle and the source tarball, and the API recomputes it over an
 * upload's body before storing it, so the two must agree byte for byte.
 *
@@ -7087,16 +7204,6 @@ function stableJson(value) {
 function digestOf(bytes) {
 	return `sha256:${createHash("sha256").update(bytes).digest("hex")}`;
 }
-/**
-* The digest of a release manifest, computed over a key-sorted rendering so
-* `cow push` and the API agree on the value whatever order the JSON arrived
-* in. It is what decides "this tree is already released": a disagreement
-* would silently turn the unchanged-tree skip off, which is why neither side
-* hashes `JSON.stringify(manifest)` directly.
-*/
-function manifestDigestOf(manifest) {
-	return digestOf(stableJson(manifest));
-}
 
 //#endregion
 //#region src/lib/package.ts
@@ -7492,7 +7599,7 @@ const TYPES_FILE = join(".cow", "types.d.ts");
 * release records the project as the repo declares it, not the local file
 * whoever pushed happened to point at.
 */
-const CONFIG_FILES$1 = [
+const CONFIG_FILES = [
 	"cow.json",
 	"package.json",
 	"tsconfig.json"
@@ -7553,7 +7660,7 @@ async function listFiles(dir) {
 */
 async function projectSources(projectDir) {
 	return [
-		...(await Promise.all(CONFIG_FILES$1.map(async (file) => await stat(join(projectDir, file)).then(() => file, () => null)))).filter((file) => file !== null),
+		...(await Promise.all(CONFIG_FILES.map(async (file) => await stat(join(projectDir, file)).then(() => file, () => null)))).filter((file) => file !== null),
 		...(await listFiles(join(projectDir, "journeys"))).map((file) => `journeys/${file}`),
 		...(await listFiles(join(projectDir, "emails"))).map((file) => `emails/${file}`)
 	].sort();
@@ -7779,12 +7886,12 @@ function emptyProfile(id = "", traits = {}, purposes = []) {
 		segments: []
 	};
 }
-/** The release limits (spec: Limits), naming the offending count or size. */
+/** The push limits (spec: Limits), naming the offending count or size. */
 function limitFailure(sizes) {
-	if (sizes.journeys > RELEASE_LIMITS.journeys) return `This project has ${sizes.journeys} journeys; a release carries at most ${RELEASE_LIMITS.journeys}.`;
-	if (sizes.templates > RELEASE_LIMITS.templates) return `This project has ${sizes.templates} templates; a release carries at most ${RELEASE_LIMITS.templates}.`;
-	for (const bundle of sizes.bundles) if (bundle.bytes > RELEASE_LIMITS.bundleBytes) return `Bundle "${bundle.key}" is ${bundle.bytes} bytes; a bundle is at most ${RELEASE_LIMITS.bundleBytes}.`;
-	if (sizes.sourceBytes > RELEASE_LIMITS.sourceBytes) return `The source tarball is ${sizes.sourceBytes} bytes; a release carries at most ${RELEASE_LIMITS.sourceBytes}.`;
+	if (sizes.journeys > PUSH_LIMITS.journeys) return `This project has ${sizes.journeys} journeys; a push carries at most ${PUSH_LIMITS.journeys}.`;
+	if (sizes.templates > PUSH_LIMITS.templates) return `This project has ${sizes.templates} templates; a push carries at most ${PUSH_LIMITS.templates}.`;
+	for (const bundle of sizes.bundles) if (bundle.bytes > PUSH_LIMITS.bundleBytes) return `Bundle "${bundle.key}" is ${bundle.bytes} bytes; a bundle is at most ${PUSH_LIMITS.bundleBytes}.`;
+	if (sizes.sourceBytes > PUSH_LIMITS.sourceBytes) return `The source tarball is ${sizes.sourceBytes} bytes; a push carries at most ${PUSH_LIMITS.sourceBytes}.`;
 	return null;
 }
 async function writeSourceTarball(projectDir, outFile) {
@@ -7893,7 +8000,6 @@ async function buildProject(projectDir) {
 			trigger: report.trigger,
 			purpose: report.purpose,
 			senderIdentity: report.senderIdentity,
-			environments: report.environments,
 			spine: readSpine(await readFile(built.source.file, "utf8")),
 			bundle: built.digest
 		});
@@ -7974,22 +8080,22 @@ function clearCredentials(env) {
 }
 /**
 * The token every command sends, and where it came from. Precedence:
-* `COW_DEPLOY_KEY` > `COW_TOKEN` > the cached login. The deploy key wins
-* because a machine that has one is CI (or a long-running `cow dev`), and a
-* stale session left in `~/.cow` on that machine must not quietly become the
+* `COW_PIPELINE_KEY` > `COW_TOKEN` > the cached login. The pipeline key wins
+* because a machine that has one is CI, and a stale session left in `~/.cow`
+* on that machine must not quietly become the
 * credential a pipeline runs as. `COW_TOKEN` is a session token handed over
 * explicitly, so it reports as one and outranks the cached file.
 *
-* A deploy key only reaches the release lifecycle, so a `cow users list` on
-* a box that exports one answers 401 rather than falling back to the
+* A pipeline key only pushes, flips journeys and reads executions, so a
+* `cow users list` on a box that exports one answers 401 rather than falling back to the
 * session. That is the honest failure: the two credentials are different
 * identities, and silently switching between them per command is how a
 * pipeline ends up passing locally and failing in CI.
 */
 function resolveCredential(env, credentials) {
-	if (env.COW_DEPLOY_KEY) return {
-		token: env.COW_DEPLOY_KEY,
-		kind: "deployKey"
+	if (env.COW_PIPELINE_KEY) return {
+		token: env.COW_PIPELINE_KEY,
+		kind: "pipelineKey"
 	};
 	if (env.COW_TOKEN) return {
 		token: env.COW_TOKEN,
@@ -8009,7 +8115,7 @@ function resolveCredential(env, credentials) {
 * login) > default.
 *
 * The project's own `apiUrl` outranks the credentials file because it is the
-* more specific answer: `cow.json` says where this project deploys, while the
+* more specific answer: `cow.json` says which API this project talks to, while the
 * credentials only remember where somebody last logged in. Without it a
 * checkout whose config names production silently fell through to
 * `DEFAULT_API_URL`, which is how a production deploy reaches localhost.
@@ -8018,6 +8124,15 @@ function resolveApiUrl(env, credentials, flag, projectApiUrl) {
 	return flag ?? env.COW_API_URL ?? projectApiUrl ?? credentials?.apiUrl ?? "http://localhost:3400";
 }
 /**
+* The dashboard this project belongs to: the flag, the env var, the
+* project's own `cow.json`, then the default. Same precedence as the API URL
+* and for the same reason: a checkout pointed at production must not send
+* the developer (or a push's links) to localhost.
+*/
+function resolveWebUrl(env, projectWebUrl, flag) {
+	return flag ?? env.COW_WEB_URL ?? projectWebUrl ?? "http://localhost:5273";
+}
+/**
 * Decode a JWT payload without verification. Display only: the API is the
 * verifier; the CLI just shows what it is about to send.
 */
@@ -8121,7 +8236,7 @@ async function login(env, options) {
 	if (options.token !== void 0) {
 		token = options.token.trim();
 		if (decodeTokenPayload(token) === null) throw new Error("The provided --token value is not a JWT");
-	} else token = await collectTokenViaBrowser(options.webUrl ?? env.COW_WEB_URL ?? (await readCowConfig(process.cwd()))?.webUrl ?? "http://localhost:5273", 3e5, options.noOpen === true);
+	} else token = await collectTokenViaBrowser(resolveWebUrl(env, (await readCowConfig(process.cwd()))?.webUrl, options.webUrl), 3e5, options.noOpen === true);
 	const claims = decodeSessionToken(token);
 	if (claims === null) throw new Error("Token is not a decodable JWT");
 	if (claims.userId === null) throw new Error("Token has no subject claim. Is it a Clerk session token?");
@@ -8234,12 +8349,12 @@ function registerAuth(program, env, io) {
 	program.command("whoami").description("show which credential commands will use, and for a session its subject, org, role, and expiry").action(async (opts) => {
 		const credentials = await readCredentials(env);
 		const { kind } = resolveCredential(env, credentials);
-		if (kind === "none") throw new Error("Not logged in. Run `cow login` first, or set COW_DEPLOY_KEY.");
-		if (kind === "deployKey") {
+		if (kind === "none") throw new Error("Not logged in. Run `cow login` first, or set COW_PIPELINE_KEY.");
+		if (kind === "pipelineKey") {
 			emit({ data: {
 				credential: kind,
-				source: "COW_DEPLOY_KEY",
-				note: "A deploy key reaches the release lifecycle only."
+				source: "COW_PIPELINE_KEY",
+				note: "A pipeline key may push, enable, disable, and read executions."
 			} }, io, opts.json);
 			return;
 		}
@@ -8652,10 +8767,16 @@ const ingestionErrors = errors("invalid_key", "validation_failed", "over_quota",
 const SESSION_AUTH = [{ clerkSession: [] }];
 const API_KEY_AUTH = [{ orgApiKey: [] }];
 /**
-* The release lifecycle: a dashboard session, or an org deploy key. Two
-* alternatives, so a caller needs either one, never both.
+* What a pipeline does: push, enable, disable, and read executions. A
+* dashboard session, or an org pipeline key: two alternatives, so a caller
+* needs either one, never both.
+*
+* The gate itself is path-scoped in `apps/api/src/app.ts`, so it reaches
+* `/pushes/*` whole (a pipeline reads back what it pushed) and the two
+* journey flags by their exact paths; this block is what says so in the
+* OpenAPI document.
 */
-const RELEASE_AUTH = [{ clerkSession: [] }, { orgDeployKey: [] }];
+const PIPELINE_AUTH = [{ clerkSession: [] }, { orgPipelineKey: [] }];
 /** Public routes: their own signature or token check is the authorization. */
 const NO_AUTH = [];
 /** Operations kept off the CLI and MCP surfaces. */
@@ -8683,7 +8804,7 @@ function htmlResponse(description) {
 
 //#endregion
 //#region ../../packages/shared/src/contract/apps.ts
-const params$10 = z.object({ id: z.string() });
+const params$11 = z.object({ id: z.string() });
 /**
 * An app is the attribution unit: what a developer names, what ingestion
 * stamps, and what segments and journey triggers filter on. Its inbound
@@ -8722,7 +8843,7 @@ const apps = defineModule(defineRoute({
 	tags: ["apps"],
 	summary: "Fetch one app",
 	security: SESSION_AUTH,
-	request: { params: params$10 },
+	request: { params: params$11 },
 	responses: {
 		200: envelope(appSchema),
 		...sessionErrors,
@@ -8736,7 +8857,7 @@ const apps = defineModule(defineRoute({
 	summary: "Rename or archive an app",
 	security: SESSION_AUTH,
 	request: {
-		params: params$10,
+		params: params$11,
 		body: jsonBody(updateAppBodySchema)
 	},
 	responses: {
@@ -8765,7 +8886,7 @@ const artifacts = defineModule(defineRoute({
 	operationId: "artifacts.head",
 	tags: ["artifacts"],
 	summary: "Does this organization already have this artifact?",
-	security: RELEASE_AUTH,
+	security: PIPELINE_AUTH,
 	surfaces: HIDDEN_FROM_TOOLS,
 	request: { params: artifactDigestParams },
 	responses: {
@@ -8779,7 +8900,7 @@ const artifacts = defineModule(defineRoute({
 	operationId: "artifacts.put",
 	tags: ["artifacts"],
 	summary: "Upload an artifact by its digest",
-	security: RELEASE_AUTH,
+	security: PIPELINE_AUTH,
 	surfaces: HIDDEN_FROM_TOOLS,
 	request: {
 		params: artifactDigestParams,
@@ -8852,7 +8973,7 @@ const billing = defineModule(defineRoute({
 
 //#endregion
 //#region ../../packages/shared/src/contract/catalog.ts
-const params$9 = z.object({ name: z.string() });
+const params$10 = z.object({ name: z.string() });
 const writeErrors$1 = errors("validation_failed", "malformed_request");
 /** The tracking plan: entries are addressed by name, unique per org. */
 const catalog = defineModule(defineRoute({
@@ -8889,7 +9010,7 @@ const catalog = defineModule(defineRoute({
 	tags: ["catalog"],
 	summary: "Fetch one catalog event",
 	security: SESSION_AUTH,
-	request: { params: params$9 },
+	request: { params: params$10 },
 	responses: {
 		200: envelope(catalogEventSchema),
 		...sessionErrors,
@@ -8903,7 +9024,7 @@ const catalog = defineModule(defineRoute({
 	summary: "Update a catalog event",
 	security: SESSION_AUTH,
 	request: {
-		params: params$9,
+		params: params$10,
 		body: jsonBody(updateCatalogEventBodySchema)
 	},
 	responses: {
@@ -8920,7 +9041,7 @@ const catalog = defineModule(defineRoute({
 	summary: "Allow or deny an event name",
 	security: SESSION_AUTH,
 	request: {
-		params: params$9,
+		params: params$10,
 		body: jsonBody(setGovernanceStateBodySchema)
 	},
 	responses: {
@@ -8962,7 +9083,7 @@ const catalog = defineModule(defineRoute({
 	tags: ["catalog"],
 	summary: "Fetch one catalog trait",
 	security: SESSION_AUTH,
-	request: { params: params$9 },
+	request: { params: params$10 },
 	responses: {
 		200: envelope(catalogTraitSchema),
 		...sessionErrors,
@@ -8976,7 +9097,7 @@ const catalog = defineModule(defineRoute({
 	summary: "Update a catalog trait",
 	security: SESSION_AUTH,
 	request: {
-		params: params$9,
+		params: params$10,
 		body: jsonBody(updateCatalogTraitBodySchema)
 	},
 	responses: {
@@ -8993,7 +9114,7 @@ const catalog = defineModule(defineRoute({
 	summary: "Allow or deny a trait name",
 	security: SESSION_AUTH,
 	request: {
-		params: params$9,
+		params: params$10,
 		body: jsonBody(setGovernanceStateBodySchema)
 	},
 	responses: {
@@ -9064,9 +9185,8 @@ const consent = defineModule(defineRoute({
 * one-click unsubscribe. Those answer the caller's convention, not the
 * envelope.
 *
-* The two reads take a deploy key as well as a session: `cow dev` tails
-* captured emails, and a loop that needs one credential to deploy and a
-* second to see what the deploy sent is not one loop.
+* The two reads are dashboard reads: `cow dev` and its pipeline-key tail are
+* gone (ADR 0011), so a pipeline key has no business in the delivery log.
 */
 const deliveries = defineModule(defineRoute({
 	method: "get",
@@ -9074,7 +9194,7 @@ const deliveries = defineModule(defineRoute({
 	operationId: "deliveries.list",
 	tags: ["deliveries"],
 	summary: "List deliveries, newest first",
-	security: RELEASE_AUTH,
+	security: SESSION_AUTH,
 	request: { query: listDeliveriesQuerySchema },
 	responses: {
 		200: list(deliverySchema),
@@ -9087,7 +9207,7 @@ const deliveries = defineModule(defineRoute({
 	operationId: "deliveries.get",
 	tags: ["deliveries"],
 	summary: "Fetch one delivery with its payload",
-	security: RELEASE_AUTH,
+	security: SESSION_AUTH,
 	request: { params: z.object({ id: z.string() }) },
 	responses: {
 		200: envelope(deliveryDetailSchema),
@@ -9144,48 +9264,9 @@ all: z.literal("1").optional() }) },
 	}
 }));
 
-//#endregion
-//#region ../../packages/shared/src/contract/deployments.ts
-/**
-* Deployments: which release an environment currently runs. Append-only, so
-* the list is the whole history and there is no rollback endpoint: rolling
-* back is deploying the release before the current one, which `cow rollback`
-* works out from the last two rows.
-*
-* The target environment comes from the selection header, like every other
-* environment-scoped operation, rather than from the body.
-*/
-const deployments = defineModule(defineRoute({
-	method: "get",
-	path: "/v1/deployments",
-	operationId: "deployments.list",
-	tags: ["deployments"],
-	summary: "List deployments, newest first",
-	security: RELEASE_AUTH,
-	request: { query: listDeploymentsQuerySchema },
-	responses: {
-		200: list(deploymentSchema),
-		...sessionErrors,
-		...errors("validation_failed")
-	}
-}), defineRoute({
-	method: "post",
-	path: "/v1/deployments",
-	operationId: "deployments.create",
-	tags: ["deployments"],
-	summary: "Deploy a release to the selected environment",
-	security: RELEASE_AUTH,
-	request: { body: jsonBody(createDeploymentBodySchema) },
-	responses: {
-		201: envelope(deploymentSchema, "The deployment, with any warnings"),
-		...sessionErrors,
-		...errors("not_found", "release_not_ready", "validation_failed", "malformed_request")
-	}
-}));
-
 //#endregion
 //#region ../../packages/shared/src/contract/destinations.ts
-const params$8 = z.object({ id: z.string() });
+const params$9 = z.object({ id: z.string() });
 const destinations = defineModule(defineRoute({
 	method: "post",
 	path: "/v1/destinations",
@@ -9219,7 +9300,7 @@ const destinations = defineModule(defineRoute({
 	tags: ["destinations"],
 	summary: "Fetch one destination",
 	security: SESSION_AUTH,
-	request: { params: params$8 },
+	request: { params: params$9 },
 	responses: {
 		200: envelope(destinationSchema),
 		...sessionErrors,
@@ -9233,7 +9314,7 @@ const destinations = defineModule(defineRoute({
 	summary: "Update a destination",
 	security: SESSION_AUTH,
 	request: {
-		params: params$8,
+		params: params$9,
 		body: jsonBody(updateDestinationBodySchema)
 	},
 	responses: {
@@ -9248,7 +9329,7 @@ const destinations = defineModule(defineRoute({
 	tags: ["destinations"],
 	summary: "Delete a destination",
 	security: SESSION_AUTH,
-	request: { params: params$8 },
+	request: { params: params$9 },
 	responses: {
 		200: envelope(deletedSchema),
 		...sessionErrors,
@@ -9258,7 +9339,7 @@ const destinations = defineModule(defineRoute({
 
 //#endregion
 //#region ../../packages/shared/src/contract/domains.ts
-const params$7 = z.object({ id: z.string() });
+const params$8 = z.object({ id: z.string() });
 const domains = defineModule(defineRoute({
 	method: "get",
 	path: "/v1/domains",
@@ -9279,7 +9360,7 @@ const domains = defineModule(defineRoute({
 	tags: ["domains"],
 	summary: "Fetch one sending domain",
 	security: SESSION_AUTH,
-	request: { params: params$7 },
+	request: { params: params$8 },
 	responses: {
 		200: envelope(senderDomainSchema),
 		...sessionErrors,
@@ -9307,7 +9388,7 @@ const domains = defineModule(defineRoute({
 	description: "The Domain Connect link for this domain's DNS provider, which shows the admin the records and asks them to confirm. `url` is null when the provider does not support it.",
 	security: SESSION_AUTH,
 	surfaces: HIDDEN_FROM_TOOLS,
-	request: { params: params$7 },
+	request: { params: params$8 },
 	responses: {
 		200: envelope(domainDnsSetupSchema),
 		...sessionErrors,
@@ -9320,7 +9401,7 @@ const domains = defineModule(defineRoute({
 	tags: ["domains"],
 	summary: "Re-check DNS now",
 	security: SESSION_AUTH,
-	request: { params: params$7 },
+	request: { params: params$8 },
 	responses: {
 		200: envelope(senderDomainSchema),
 		...sessionErrors,
@@ -9334,7 +9415,7 @@ const domains = defineModule(defineRoute({
 	summary: "Toggle click tracking",
 	security: SESSION_AUTH,
 	request: {
-		params: params$7,
+		params: params$8,
 		body: jsonBody(updateSenderDomainBodySchema)
 	},
 	responses: {
@@ -9347,9 +9428,9 @@ const domains = defineModule(defineRoute({
 	path: "/v1/domains/{id}",
 	operationId: "domains.delete",
 	tags: ["domains"],
-	summary: "Release a domain claim",
+	summary: "Give up a domain claim",
 	security: SESSION_AUTH,
-	request: { params: params$7 },
+	request: { params: params$8 },
 	responses: {
 		200: envelope(deletedSchema),
 		...sessionErrors,
@@ -9447,12 +9528,19 @@ const events = defineModule(defineRoute({
 
 //#endregion
 //#region ../../packages/shared/src/contract/executions.ts
-const params$6 = z.object({ id: z.string() });
+const params$7 = z.object({ id: z.string() });
 /**
 * Executions: one run of one journey for one profile. Replaces v1's journey
 * instances, which were read live from Temporal and so could only be listed
-* per journey; these are rows, so they filter by journey, release, status,
+* per journey; these are rows, so they filter by journey, version, status,
 * and profile in one place. The environment comes from the selection header.
+*
+* `cancel` is the only write: stopping is explicit and per environment
+* (ADR 0011), and each execution records `cancelled` when it reaches its
+* next step, so the answer is that the sweep started rather than a count.
+* A pipeline may push, enable, disable and READ executions; stopping runs
+* that are already carrying real people is a person's call, so cancel takes
+* a dashboard session (and org:admin in production).
 */
 const executions = defineModule(defineRoute({
 	method: "get",
@@ -9460,21 +9548,34 @@ const executions = defineModule(defineRoute({
 	operationId: "executions.list",
 	tags: ["executions"],
 	summary: "List executions, newest first",
-	security: RELEASE_AUTH,
+	security: PIPELINE_AUTH,
 	request: { query: listExecutionsQuerySchema },
 	responses: {
 		200: list(executionSchema),
 		...sessionErrors,
 		...errors("validation_failed")
 	}
+}), defineRoute({
+	method: "post",
+	path: "/v1/executions/cancel",
+	operationId: "executions.cancel",
+	tags: ["executions"],
+	summary: "Cancel live executions of a journey, or of one version",
+	security: SESSION_AUTH,
+	request: { body: jsonBody(cancelExecutionsBodySchema) },
+	responses: {
+		200: envelope(cancellingSchema, "The sweep is under way; each execution stops at its next step"),
+		...sessionErrors,
+		...errors("not_found", "validation_failed", "malformed_request")
+	}
 }), defineRoute({
 	method: "get",
 	path: "/v1/executions/{id}",
 	operationId: "executions.get",
 	tags: ["executions"],
 	summary: "Inspect one execution, with its logs",
-	security: RELEASE_AUTH,
-	request: { params: params$6 },
+	security: PIPELINE_AUTH,
+	request: { params: params$7 },
 	responses: {
 		200: envelope(executionDetailSchema),
 		...sessionErrors,
@@ -9583,22 +9684,26 @@ const ingestion = defineModule(defineRoute({
 //#region ../../packages/shared/src/contract/journeys.ts
 /**
 * A journey is addressed by its key: the basename of the file its author
-* wrote, unique across the project. The `jrn_` id it used to carry is
-* retired, because the rows are derived from a release rather than created
-* through the API, and (org, environment, key) is the only identity they
-* have.
+* wrote, unique across the org. The `jrn_` id it used to carry is retired,
+* because the rows are derived from a push rather than created through the
+* API, and (org, key) is the only identity they have.
+*
+* `list` and `get` report the enabled flag of BOTH environments whichever
+* one the caller selected, because "is this on in production?" is the
+* question they exist to answer; `enable` and `disable` act on the selected
+* one, like every other environment-scoped write (docs/standards/api.md).
 *
 * `journeys.listInstances` and `journeys.getInstance` are gone: executions
 * are their own resource now (`executions.list` / `executions.get`), and
 * `journeys.dryRun` answers with the execution it started.
 */
-const params$5 = z.object({ key: z.string() });
+const params$6 = z.object({ key: z.string() });
 const journeys = defineModule(defineRoute({
 	method: "get",
 	path: "/v1/journeys",
 	operationId: "journeys.list",
 	tags: ["journeys"],
-	summary: "List the journeys deployed in the selected environment",
+	summary: "List the organization's journeys",
 	security: SESSION_AUTH,
 	request: { query: listJourneysQuerySchema },
 	responses: {
@@ -9613,7 +9718,7 @@ const journeys = defineModule(defineRoute({
 	tags: ["journeys"],
 	summary: "Inspect one journey",
 	security: SESSION_AUTH,
-	request: { params: params$5 },
+	request: { params: params$6 },
 	responses: {
 		200: envelope(journeySchema),
 		...sessionErrors,
@@ -9626,36 +9731,48 @@ const journeys = defineModule(defineRoute({
 	tags: ["journeys"],
 	summary: "Journey operational stats",
 	security: SESSION_AUTH,
-	request: { params: params$5 },
+	request: { params: params$6 },
 	responses: {
 		200: envelope(journeyStatsSchema),
 		...sessionErrors,
 		...errors("not_found")
 	}
 }), defineRoute({
-	method: "patch",
-	path: "/v1/journeys/{key}",
-	operationId: "journeys.update",
+	method: "post",
+	path: "/v1/journeys/enable",
+	operationId: "journeys.enable",
 	tags: ["journeys"],
-	summary: "Enable or disable a journey in the selected environment",
-	security: SESSION_AUTH,
-	request: {
-		params: params$5,
-		body: jsonBody(updateJourneyBodySchema)
-	},
+	summary: "Turn journeys on in the selected environment",
+	security: PIPELINE_AUTH,
+	surfaces: { cli: false },
+	request: { body: jsonBody(setJourneysEnabledBodySchema) },
 	responses: {
-		200: envelope(journeySchema),
+		200: envelope(z.array(journeySchema), "The journeys as they now stand"),
 		...sessionErrors,
-		...errors("not_found", "validation_failed", "malformed_request")
+		...errors("not_found", "project_missing", "validation_failed", "malformed_request")
+	}
+}), defineRoute({
+	method: "post",
+	path: "/v1/journeys/disable",
+	operationId: "journeys.disable",
+	tags: ["journeys"],
+	summary: "Turn journeys off in the selected environment",
+	security: PIPELINE_AUTH,
+	surfaces: { cli: false },
+	request: { body: jsonBody(setJourneysEnabledBodySchema) },
+	responses: {
+		200: envelope(z.array(journeySchema), "The journeys as they now stand"),
+		...sessionErrors,
+		...errors("not_found", "project_missing", "validation_failed", "malformed_request")
 	}
 }), defineRoute({
 	method: "delete",
 	path: "/v1/journeys/{key}",
 	operationId: "journeys.delete",
 	tags: ["journeys"],
-	summary: "Remove a journey from the selected environment",
+	summary: "Delete a journey",
 	security: SESSION_AUTH,
-	request: { params: params$5 },
+	request: { params: params$6 },
 	responses: {
 		200: envelope(deletedSchema),
 		...sessionErrors,
@@ -9669,7 +9786,7 @@ const journeys = defineModule(defineRoute({
 	summary: "Dry-run a journey against a real user",
 	security: SESSION_AUTH,
 	request: {
-		params: params$5,
+		params: params$6,
 		body: jsonBody(dryRunJourneyBodySchema)
 	},
 	responses: {
@@ -9741,20 +9858,37 @@ const project = defineModule(defineRoute({
 	operationId: "project.get",
 	tags: ["project"],
 	summary: "Get one of the organization's projects",
-	security: RELEASE_AUTH,
+	security: PIPELINE_AUTH,
 	request: { query: getProjectQuerySchema },
 	responses: {
 		200: envelope(projectSchema),
 		...sessionErrors,
 		...errors("project_missing", "validation_failed", "malformed_request")
 	}
+}), defineRoute({
+	method: "get",
+	path: "/v1/project/status",
+	operationId: "project.status",
+	tags: ["project"],
+	summary: "What a project's journeys and templates are doing",
+	security: PIPELINE_AUTH,
+	surfaces: {
+		cli: false,
+		mcpName: "status"
+	},
+	request: { query: getProjectQuerySchema },
+	responses: {
+		200: envelope(projectStatusSchema),
+		...sessionErrors,
+		...errors("project_missing", "validation_failed", "malformed_request")
+	}
 }), defineRoute({
 	method: "post",
 	path: "/v1/project",
 	operationId: "project.create",
 	tags: ["project"],
 	summary: "Create a project in the organization",
-	security: RELEASE_AUTH,
+	security: PIPELINE_AUTH,
 	request: { body: jsonBody(createProjectBodySchema) },
 	responses: {
 		201: envelope(projectSchema, "The created project"),
@@ -9764,87 +9898,75 @@ const project = defineModule(defineRoute({
 }));
 
 //#endregion
-//#region ../../packages/shared/src/contract/releases.ts
-const params$4 = z.object({ id: z.string() });
+//#region ../../packages/shared/src/contract/pushes.ts
+const params$5 = z.object({ id: z.string() });
 /**
-* Releases: one `cow push` each, the whole project at one point in time.
+* Pushes: one `cow push` each, the whole project at one point in time. The
+* push stores the source archive and its compile creates a version of every
+* key whose module changed; it turns nothing on (ADR 0011).
 *
 * `create` and `source` are hidden from the CLI and MCP surfaces because
 * both only make sense next to local files: the manifest `create` takes is
 * whatever `cow build` just wrote, and the tarball `source` returns is what
-* `cow pull` unpacks over a working tree. `list`, `get`, and
-* `cancelExecutions` are ordinary operations an agent should have.
+* `cow pull` unpacks over a working tree.
 */
-const releases = defineModule(defineRoute({
+const pushes = defineModule(defineRoute({
 	method: "post",
-	path: "/v1/releases",
-	operationId: "releases.create",
-	tags: ["releases"],
-	summary: "Create a release from a built manifest",
-	security: RELEASE_AUTH,
+	path: "/v1/pushes",
+	operationId: "pushes.create",
+	tags: ["pushes"],
+	summary: "Push a built project",
+	security: PIPELINE_AUTH,
 	surfaces: HIDDEN_FROM_TOOLS,
-	request: { body: jsonBody(createReleaseBodySchema) },
+	request: { body: jsonBody(createPushBodySchema) },
 	responses: {
-		201: envelope(releaseSchema, "The pending release; compilation follows"),
+		201: envelope(pushSchema, "The stored push and the versions it is compiling"),
 		...sessionErrors,
-		...errors("project_missing", "release_invalid", "validation_failed", "malformed_request", "dependency_unavailable")
+		...errors("project_missing", "push_invalid", "validation_failed", "malformed_request", "dependency_unavailable")
 	}
 }), defineRoute({
 	method: "get",
-	path: "/v1/releases",
-	operationId: "releases.list",
-	tags: ["releases"],
-	summary: "List releases, newest first",
-	security: RELEASE_AUTH,
-	request: { query: listReleasesQuerySchema },
+	path: "/v1/pushes",
+	operationId: "pushes.list",
+	tags: ["pushes"],
+	summary: "List pushes, newest first",
+	security: SESSION_AUTH,
+	request: { query: listPushesQuerySchema },
 	responses: {
-		200: list(releaseSchema),
+		200: list(pushSchema),
 		...sessionErrors,
 		...errors("validation_failed")
 	}
 }), defineRoute({
 	method: "get",
-	path: "/v1/releases/{id}",
-	operationId: "releases.get",
-	tags: ["releases"],
-	summary: "Inspect one release",
-	security: RELEASE_AUTH,
-	request: { params: params$4 },
+	path: "/v1/pushes/{id}",
+	operationId: "pushes.get",
+	tags: ["pushes"],
+	summary: "Inspect one push and what it compiled",
+	security: SESSION_AUTH,
+	request: { params: params$5 },
 	responses: {
-		200: envelope(releaseSchema),
+		200: envelope(pushSchema),
 		...sessionErrors,
 		...errors("not_found")
 	}
 }), defineRoute({
 	method: "get",
-	path: "/v1/releases/{id}/source",
-	operationId: "releases.source",
-	tags: ["releases"],
-	summary: "Download the release's source tarball",
-	security: RELEASE_AUTH,
+	path: "/v1/pushes/{id}/source",
+	operationId: "pushes.source",
+	tags: ["pushes"],
+	summary: "Download the pushed source tarball",
+	security: SESSION_AUTH,
 	surfaces: HIDDEN_FROM_TOOLS,
-	request: { params: params$4 },
+	request: { params: params$5 },
 	responses: {
 		200: {
-			description: "The gzipped source tarball the release was built from",
+			description: "The gzipped source tarball the push stored",
 			content: { "application/gzip": { schema: z.string() } }
 		},
 		...sessionErrors,
 		...errors("not_found")
 	}
-}), defineRoute({
-	method: "post",
-	path: "/v1/releases/{id}/cancel-executions",
-	operationId: "releases.cancelExecutions",
-	tags: ["releases"],
-	summary: "Cancel every live execution pinned to this release",
-	security: RELEASE_AUTH,
-	request: { params: params$4 },
-	responses: {
-		202: envelope(cancelExecutionsSchema, "The cancel sweep was started"),
-		...sessionErrors,
-		...errors("not_found", "dependency_unavailable")
-	}
 }));
 
 //#endregion
@@ -9872,7 +9994,7 @@ const review = defineModule(defineRoute({
 
 //#endregion
 //#region ../../packages/shared/src/contract/segments.ts
-const params$3 = z.object({ id: z.string() });
+const params$4 = z.object({ id: z.string() });
 const writeErrors = errors("validation_failed", "malformed_request");
 /** `preview` precedes `get` so "preview" is never read as an id. */
 const segments = defineModule(defineRoute({
@@ -9922,7 +10044,7 @@ const segments = defineModule(defineRoute({
 	tags: ["segments"],
 	summary: "Fetch one segment with its member count",
 	security: SESSION_AUTH,
-	request: { params: params$3 },
+	request: { params: params$4 },
 	responses: {
 		200: envelope(segmentDetailSchema),
 		...sessionErrors,
@@ -9936,7 +10058,7 @@ const segments = defineModule(defineRoute({
 	summary: "Update a segment",
 	security: SESSION_AUTH,
 	request: {
-		params: params$3,
+		params: params$4,
 		body: jsonBody(updateSegmentBodySchema)
 	},
 	responses: {
@@ -9952,7 +10074,7 @@ const segments = defineModule(defineRoute({
 	tags: ["segments"],
 	summary: "Delete a segment",
 	security: SESSION_AUTH,
-	request: { params: params$3 },
+	request: { params: params$4 },
 	responses: {
 		200: envelope(deletedSchema),
 		...sessionErrors,
@@ -9966,7 +10088,7 @@ const segments = defineModule(defineRoute({
 	summary: "List a segment's members",
 	security: SESSION_AUTH,
 	request: {
-		params: params$3,
+		params: params$4,
 		query: listSegmentMembersQuerySchema
 	},
 	responses: {
@@ -10030,10 +10152,10 @@ const settings = defineModule(defineRoute({
 	}
 }), defineRoute({
 	method: "get",
-	path: "/v1/settings/deploy-keys",
-	operationId: "settings.deployKeys.list",
+	path: "/v1/settings/pipeline-keys",
+	operationId: "settings.pipelineKeys.list",
 	tags: ["settings"],
-	summary: "List org deploy keys",
+	summary: "List org pipeline keys",
 	security: SESSION_AUTH,
 	request: { query: listApiKeysQuerySchema },
 	responses: {
@@ -10043,23 +10165,23 @@ const settings = defineModule(defineRoute({
 	}
 }), defineRoute({
 	method: "post",
-	path: "/v1/settings/deploy-keys",
-	operationId: "settings.deployKeys.create",
+	path: "/v1/settings/pipeline-keys",
+	operationId: "settings.pipelineKeys.create",
 	tags: ["settings"],
-	summary: "Create an org deploy key",
+	summary: "Create an org pipeline key",
 	security: SESSION_AUTH,
 	request: { body: jsonBody(createApiKeyBodySchema) },
 	responses: {
-		201: envelope(createdApiKeyDtoSchema, "The created deploy key; the only response carrying the raw secret"),
+		201: envelope(createdApiKeyDtoSchema, "The created pipeline key; the only response carrying the raw secret"),
 		...sessionErrors,
 		...errors("validation_failed", "malformed_request")
 	}
 }), defineRoute({
 	method: "post",
-	path: "/v1/settings/deploy-keys/{id}/revoke",
-	operationId: "settings.deployKeys.revoke",
+	path: "/v1/settings/pipeline-keys/{id}/revoke",
+	operationId: "settings.pipelineKeys.revoke",
 	tags: ["settings"],
-	summary: "Revoke an org deploy key",
+	summary: "Revoke an org pipeline key",
 	security: SESSION_AUTH,
 	request: {
 		params: z.object({ id: z.string() }),
@@ -10091,7 +10213,7 @@ const settings = defineModule(defineRoute({
 //#endregion
 //#region ../../packages/shared/src/contract/sources.ts
 const appParams = z.object({ appId: z.string() });
-const params$2 = z.object({ id: z.string() });
+const params$3 = z.object({ id: z.string() });
 /**
 * A source is one inbound pipe into an app. It is created and listed under
 * its parent app (the app is the attribution unit) and addressed by its own
@@ -10137,7 +10259,7 @@ const sources = defineModule(defineRoute({
 	tags: ["sources"],
 	summary: "Fetch one source",
 	security: SESSION_AUTH,
-	request: { params: params$2 },
+	request: { params: params$3 },
 	responses: {
 		200: envelope(sourceSchema),
 		...sessionErrors,
@@ -10151,7 +10273,7 @@ const sources = defineModule(defineRoute({
 	summary: "Set or rotate a source's config",
 	security: SESSION_AUTH,
 	request: {
-		params: params$2,
+		params: params$3,
 		body: jsonBody(updateSourceBodySchema)
 	},
 	responses: {
@@ -10166,7 +10288,7 @@ const sources = defineModule(defineRoute({
 	tags: ["sources"],
 	summary: "Archive a source",
 	security: SESSION_AUTH,
-	request: { params: params$2 },
+	request: { params: params$3 },
 	responses: {
 		200: envelope(sourceSchema, "The archived source"),
 		...sessionErrors,
@@ -10223,15 +10345,104 @@ const suppressions = defineModule(defineRoute({
 }));
 
 //#endregion
-//#region ../../packages/shared/src/contract/users.ts
-const params$1 = z.object({ profileId: z.string() });
+//#region ../../packages/shared/src/contract/templates.ts
 /**
-* The answer a merged-away profile id gets (spec: Identity): 307 to the
-* same path with the survivor's id, so the method and body of a redirected
-* call survive the hop. Empty body; the `Location` header is the answer.
+* Templates: the emails a journey sends, addressed by key like a journey.
+* A template has versions and nothing else (ADR 0011), so there is no
+* create and no update here: templates arrive with a push, and the only
+* writes are rendering one to look at it, sending one to yourself, and
+* deleting the key.
+*
+* `preview` and `testSend` both render the latest version that finished
+* compiling, in the sandbox, with the props the caller passes. `testSend`
+* then sends that message to the caller's own address through the
+* organization's default sender: it reaches no recipient, so it passes no
+* consent gate, counts against nothing, and is logged as a test.
 */
-const mergedRedirect = { 307: {
-	description: "The profile was merged into another; Location carries the survivor's URL",
+const params$2 = z.object({ key: z.string() });
+const templates = defineModule(defineRoute({
+	method: "get",
+	path: "/v1/templates",
+	operationId: "templates.list",
+	tags: ["templates"],
+	summary: "List the organization's email templates",
+	security: SESSION_AUTH,
+	request: { query: listTemplatesQuerySchema },
+	responses: {
+		200: list(templateSchema),
+		...sessionErrors,
+		...errors("validation_failed")
+	}
+}), defineRoute({
+	method: "get",
+	path: "/v1/templates/{key}",
+	operationId: "templates.get",
+	tags: ["templates"],
+	summary: "Inspect one email template",
+	security: SESSION_AUTH,
+	request: { params: params$2 },
+	responses: {
+		200: envelope(templateSchema),
+		...sessionErrors,
+		...errors("not_found")
+	}
+}), defineRoute({
+	method: "post",
+	path: "/v1/templates/{key}/preview",
+	operationId: "templates.preview",
+	tags: ["templates"],
+	summary: "Render a template with the props you pass",
+	security: SESSION_AUTH,
+	request: {
+		params: params$2,
+		body: jsonBody(renderTemplateBodySchema)
+	},
+	responses: {
+		200: envelope(templatePreviewSchema, "The rendered message"),
+		...sessionErrors,
+		...errors("not_found", "version_not_ready", "validation_failed", "malformed_request", "dependency_unavailable")
+	}
+}), defineRoute({
+	method: "post",
+	path: "/v1/templates/{key}/test-send",
+	operationId: "templates.testSend",
+	tags: ["templates"],
+	summary: "Send a rendered template to your own address",
+	security: SESSION_AUTH,
+	request: {
+		params: params$2,
+		body: jsonBody(renderTemplateBodySchema)
+	},
+	responses: {
+		201: envelope(deliverySchema, "The test send, as it was logged"),
+		...sessionErrors,
+		...errors("not_found", "version_not_ready", "validation_failed", "malformed_request", "dependency_unavailable")
+	}
+}), defineRoute({
+	method: "delete",
+	path: "/v1/templates/{key}",
+	operationId: "templates.delete",
+	tags: ["templates"],
+	summary: "Delete an email template",
+	security: SESSION_AUTH,
+	request: { params: params$2 },
+	responses: {
+		200: envelope(deletedSchema),
+		...sessionErrors,
+		...errors("not_found", "conflict")
+	}
+}));
+
+//#endregion
+//#region ../../packages/shared/src/contract/users.ts
+const params$1 = z.object({ profileId: z.string() });
+/**
+* The answer a merged-away profile id gets (spec: Identity): 307 to the
+* same path with the survivor's id, so the method and body of a redirected
+* call survive the hop. Empty body; the `Location` header is the answer.
+*/
+const mergedRedirect = { 307: {
+	description: "The profile was merged into another; Location carries the survivor's URL",
 	headers: z.object({ Location: z.string().meta({ description: "The survivor's URL" }) })
 } };
 /**
@@ -10360,6 +10571,29 @@ const users = defineModule(defineRoute({
 	}
 }));
 
+//#endregion
+//#region ../../packages/shared/src/contract/versions.ts
+/**
+* Versions: one key's history, newest first. A version is read-only and
+* addressed through its key rather than on its own path, because "which
+* code does this journey run" is the only question asked of it, and the
+* answer is the first row.
+*/
+const versions = defineModule(defineRoute({
+	method: "get",
+	path: "/v1/versions",
+	operationId: "versions.list",
+	tags: ["versions"],
+	summary: "List a journey's or a template's versions, newest first",
+	security: SESSION_AUTH,
+	request: { query: listVersionsQuerySchema },
+	responses: {
+		200: list(versionSchema),
+		...sessionErrors,
+		...errors("validation_failed")
+	}
+}));
+
 //#endregion
 //#region ../../packages/shared/src/contract/violations.ts
 const params = z.object({ id: z.string() });
@@ -10434,10 +10668,11 @@ const contract = {
 	segments,
 	project,
 	artifacts,
-	releases,
-	deployments,
+	pushes,
+	versions,
 	executions,
 	journeys,
+	templates,
 	destinations,
 	domains,
 	deliveries,
@@ -10811,520 +11046,55 @@ function registerContractCommands(program, run) {
 }
 
 //#endregion
-//#region src/commands/push.ts
-/**
-* How long to wait for a compile before giving up on the poll. A minute past
-* the server's own whole-release cap, so the normal end of a stuck compile is
-* the release turning `failed` with a reason rather than the CLI shrugging.
-*/
-const POLL_BUDGET_MS = RELEASE_COMPILE_TIMEOUT_MS + 6e4;
-const POLL_START_MS = 250;
-const POLL_MAX_MS = 2e3;
-/**
-* This directory's project, created when the org has none by that name.
-* `cow init` usually got there first; a project pushed from a machine that
-* only ever cloned the repo has not, and creating it here is what makes that
-* clone work. The name is `cow.json`'s `project`.
-*/
-async function ensureProject(client, name) {
-	try {
-		return (await client.request(contract.project["project.get"], { query: { name } })).data;
-	} catch (error) {
-		if (!(error instanceof ApiError) || error.code !== "project_missing") throw error;
-	}
-	try {
-		return (await client.request(contract.project["project.create"], { body: { name } })).data;
-	} catch (error) {
-		const reason = error instanceof Error ? error.message : String(error);
-		throw new Error(`This organization has no project and one could not be created (${reason}). Run \`cow init\` first.`);
-	}
-}
-/** Does the org already hold these bytes? A 404 is the answer, not a failure. */
-async function held(client, digest) {
-	try {
-		await client.request(contract.artifacts["artifacts.head"], { params: { digest } });
-		return true;
-	} catch (error) {
-		if (error instanceof ApiError && error.status === 404) return false;
-		throw error;
-	}
-}
-/** Every artifact the manifest names, and the file `cow build` wrote it to. */
-function artifactFiles(projectDir, manifest) {
-	const out = join(projectDir, BUILD_DIR);
-	return [
-		...manifest.journeys.map((journey) => ({
-			digest: journey.bundle,
-			kind: "bundle",
-			file: join(out, "bundles", "journeys", `${journey.key}.js`)
-		})),
-		...manifest.templates.map((template) => ({
-			digest: template.bundle,
-			kind: "bundle",
-			file: join(out, "bundles", "emails", `${template.key}.js`)
-		})),
-		{
-			digest: manifest.source,
-			kind: "source",
-			file: join(out, "source.tgz")
-		}
-	];
-}
-/**
-* This project's most recent release, or null when it has none yet. Scoped to
-* the project because a sibling repo's push must not make this one look
-* unchanged, or changed.
-*/
-async function latestRelease(client, project) {
-	return (await client.request(contract.releases["releases.list"], { query: {
-		limit: 1,
-		project
-	} })).data[0] ?? null;
-}
+//#region src/commands/enable.ts
 /**
-* How far a compile has got, as `18/26`. Only meaningful while the release is
-* pending: a `ready` release can legitimately sit below its total (every row
-* from before the counter existed reads 0, and the last progress write is
-* advisory), so completion is read from the status, never from this.
-*/
-function compiledFraction(release) {
-	return `${release.compiledEntries}/${release.totalEntries}`;
-}
-/**
-* The progress writer for a terminal, or nothing at all when there is no one
-* watching. It rewrites one line on stderr, so what a command prints to
-* stdout is the same bytes whether or not a terminal is attached.
+* `cow enable` and `cow disable`: the one gate on a journey, per
+* environment (ADR 0011). Hand-written rather than derived from
+* `journeys.enable`, because the commands are top-level names a developer
+* types, and because of the `--env` rule below; the route itself takes the
+* same set of keys they do.
 *
-* The flag is stdout's: a redirected push is a script reading the summary,
-* and it gets no cursor codes in either stream. `--json` is silent for the
-* same reason, since its whole output is one envelope.
+* `--env` is never defaulted here (`requireEnvironment`): the default
+* environment is production, and a flag nobody typed must not put code in
+* front of real recipients.
 */
-function progressLineFor(io, json) {
-	if (!io.isTTY || json === true) return;
-	let drawn = false;
-	return (text) => {
-		if (text === "" && !drawn) return;
-		drawn = text !== "";
-		io.stderr(`\r\x1b[2K${text}`);
-	};
-}
 /**
-* Poll until the compile settles. Backs off from a quarter second to two,
-* because a small project is ready almost at once and a large one is not
-* worth asking about ten times a second.
+* One call, whichever way the keys were named: the route takes the set, and
+* `--all` is the project name, resolved on the server against the rows it
+* owns (so it reaches a key whose file the tree lost). A key that is not
+* there refuses the whole call, and nothing flips.
 */
-async function awaitCompile(client, releaseId, sleep, progress) {
-	let waited = 0;
-	let interval = POLL_START_MS;
-	try {
-		for (;;) {
-			const { data } = await client.request(contract.releases["releases.get"], { params: { id: releaseId } });
-			if (data.status !== "pending") return data;
-			if (waited >= POLL_BUDGET_MS) throw new Error(`Release ${releaseId} is still compiling after ${Math.round(waited / 1e3)}s (${compiledFraction(data)} compiled). Check \`cow releases get ${releaseId}\`.`);
-			progress?.(`Compiling ${compiledFraction(data)}`);
-			await sleep(interval);
-			waited += interval;
-			interval = Math.min(interval * 2, POLL_MAX_MS);
-		}
-	} finally {
-		progress?.("");
-	}
+async function setEnabled(client, selector, enabled) {
+	const route = enabled ? contract.journeys["journeys.enable"] : contract.journeys["journeys.disable"];
+	return (await client.request(route, { body: selector })).data;
 }
-async function pushProject({ client, projectDir, force, sleep = (ms) => setTimeout$1(ms), progress }) {
-	const { manifest, config } = await buildProject(projectDir);
-	const project = await ensureProject(client, config.project);
-	if (project.orgId !== config.orgId) throw new Error(`cow.json is for ${config.orgId} but the credential belongs to ${project.orgId}. Log in to that organization, or use its deploy key.`);
-	const digest = manifestDigestOf(manifest);
-	const latest = await latestRelease(client, project.name);
-	if (latest && latest.manifestDigest === digest && !force) return {
-		release: latest,
-		uploaded: [],
-		skipped: latest.status === "failed" ? `Nothing changed since ${latest.id} #${latest.seq}, which failed to compile. Push again with --force to retry it.` : `Nothing changed since ${latest.id} #${latest.seq} (${latest.status}). Nothing to push.`
-	};
-	const uploaded = [];
-	for (const artifact of artifactFiles(projectDir, manifest)) {
-		if (await held(client, artifact.digest)) continue;
-		await client.request(contract.artifacts["artifacts.put"], {
-			params: { digest: artifact.digest },
-			query: { kind: artifact.kind },
-			body: await readFile(artifact.file)
-		});
-		uploaded.push(artifact.digest);
-	}
-	return {
-		release: await awaitCompile(client, (await client.request(contract.releases["releases.create"], { body: {
-			manifest: {
-				...manifest,
-				protocol: 2
-			},
-			project: project.name
-		} })).data.id, sleep, progress),
-		uploaded
-	};
+/** What the terminal says: one line per key, naming where it now stands. */
+function flipSummary(journeys, enabled, environment) {
+	if (journeys.length === 0) return `This project has no journeys to turn ${enabled ? "on" : "off"}.`;
+	return journeys.map((journey) => `${journey.key} is ${enabled ? "on" : "off"} in ${environment}.`).join("\n");
 }
-/** The human report: one line, the same one whether it compiled or not. */
-function pushSummary(outcome) {
-	if (outcome.skipped) return outcome.skipped;
-	const { release } = outcome;
-	const uploaded = outcome.uploaded.length === 0 ? "nothing new to upload" : `${outcome.uploaded.length} artifact${outcome.uploaded.length === 1 ? "" : "s"} uploaded`;
-	if (release.status === "ready") return `${release.id} #${release.seq} ready (${uploaded}).`;
-	return `${release.id} #${release.seq} failed: ${release.error ?? "no reason recorded"}`;
-}
-function registerPush(program, clientFor, io) {
-	program.command("push").description("build the project, upload it, and create a release the server compiles").option("--force", "push even when nothing changed since the last release").action(async (opts) => {
+function register(program, clientFor, env, io, enabled) {
+	const verb = enabled ? "enable" : "disable";
+	program.command(verb).description(`turn journeys ${enabled ? "on" : "off"} in one environment (many keys, or --all for this project's)`).argument("[keys...]", "journey keys").option("--all", "every journey of this project").action(async (keys, opts) => {
 		const merged = {
 			...program.opts(),
 			...opts
 		};
-		const outcome = await pushProject({
-			client: await clientFor(merged),
-			projectDir: process.cwd(),
-			force: opts.force === true,
-			progress: progressLineFor(io, merged.json === true)
-		});
-		if (merged.json === true) emit({ data: outcome.release }, io, true);
-		else io.stdout(`${pushSummary(outcome)}\n`);
-		if (outcome.release.status === "failed") process.exitCode = 1;
-	});
-}
-
-//#endregion
-//#region src/commands/deploy.ts
-/** The release to deploy, and the push message when a push produced it. */
-async function releaseToDeploy({ client, projectDir, releaseId, sleep, progress }) {
-	if (releaseId) {
-		const { data } = await client.request(contract.releases["releases.get"], { params: { id: releaseId } });
-		return { release: data };
-	}
-	const pushed = await pushProject({
-		client,
-		projectDir,
-		sleep,
-		progress
-	});
-	return {
-		release: pushed.release,
-		skipped: pushed.skipped
-	};
-}
-async function deployProject(options) {
-	const { release, skipped } = await releaseToDeploy(options);
-	if (release.status !== "ready") throw new Error(release.status === "failed" ? `${release.id} #${release.seq} failed to compile, so there is nothing to deploy: ${release.error ?? "no reason recorded"}` : `${release.id} #${release.seq} is still compiling (${compiledFraction(release)} compiled); wait for it to be ready.`);
-	const { data } = await options.client.request(contract.deployments["deployments.create"], { body: { releaseId: release.id } });
-	return {
-		deployment: data,
-		release,
-		skipped
-	};
-}
-/** The human report: what is now running, and what it references but cannot find. */
-function deploySummary(outcome) {
-	const { deployment, release } = outcome;
-	const lines = [`${release.id} #${release.seq} deployed to ${deployment.environment}.`];
-	if (outcome.skipped) lines.unshift(outcome.skipped);
-	for (const warning of deployment.warnings) lines.push(`Warning: ${warning}`);
-	if (deployment.left.length > 0) lines.push(`Still running, not in this release: ${deployment.left.join(", ")}. Remove one with \`cow journeys delete <key> --env ${deployment.environment}\`.`);
-	return lines.join("\n");
-}
-function registerDeploy(program, clientFor, env, io) {
-	program.command("deploy").description("push the project when it changed, then make that release the environment's current code").option("--release <id>", "deploy this existing release instead of pushing the working tree").action(async (opts) => {
-		const merged = {
-			...program.opts(),
-			...opts
-		};
-		requireEnvironment(env, merged);
-		const outcome = await deployProject({
-			client: await clientFor(merged),
-			projectDir: process.cwd(),
-			releaseId: opts.release,
-			progress: progressLineFor(io, merged.json === true)
-		});
+		const environment = requireEnvironment(env, merged);
+		if (merged.all === true && keys.length > 0) throw new Error(`Name the journeys or pass --all, not both: cow ${verb} welcome --env ${environment}.`);
+		if (merged.all !== true && keys.length === 0) throw new Error(`Name at least one journey, or pass --all: cow ${verb} welcome --env ${environment}.`);
+		const selector = merged.all === true ? { project: (await assertCowConfig(process.cwd())).project } : { keys };
+		const updated = await setEnabled(await clientFor(merged), selector, enabled);
 		if (merged.json === true) {
-			emit({ data: outcome.deployment }, io, true);
+			emit({ data: updated }, io, true);
 			return;
 		}
-		io.stdout(`${deploySummary(outcome)}\n`);
+		io.stdout(`${flipSummary(updated, enabled, environment)}\n`);
 	});
 }
-
-//#endregion
-//#region src/commands/dev.ts
-/**
-* `cow dev` (spec: CLI, user story 12): the inner loop. Watch the project,
-* build-push-deploy to development on every save, and tail what the journeys
-* did, so the distance between a saved file and a rendered email is seconds.
-*
-* Two halves that never block each other: a watcher whose cycle is exactly
-* `cow deploy --env development` (push skips an unchanged tree, so a save
-* that changes nothing costs one build), and a poller over the two logs. A
-* failure in either prints and the loop keeps running: the whole point of a
-* watcher is that a typo does not end the session.
-*
-* ponytail: polling over server-sent events. Two seconds is under the
-* latency a person notices, and SSE costs a streaming endpoint, a reconnect
-* story, and a proxy that buffers it. Ceiling: neither `updatedAt` column
-* is indexed, so each poll walks the org's development rows; add
-* `(org_id, environment, updated_at)` to executions and deliveries when a
-* development environment grows past a few thousand of them.
-*/
-/** `cow dev` is the development loop; the root `--env` does not move it. */
-const DEV_ENVIRONMENT = "development";
-const DEBOUNCE_MS = 300;
-const POLL_MS = 2e3;
-/**
-* What a save can change: the two source directories and the three config
-* files. Watched as three watchers rather than one recursive watch of the
-* project root, because that root holds `node_modules` (a recursive watch of
-* it exhausts inotify on Linux) and `.cow/build`, which this command's own
-* builds write.
-*/
-const CONFIG_FILES = [
-	"cow.json",
-	"package.json",
-	"tsconfig.json"
-];
-const SOURCE_DIRS = ["journeys", "emails"];
-/**
-* ponytail: the cursor starts from the CLIENT's clock, compared server-side
-* against database timestamps. A laptop running ahead of the database blanks
-* the tail until the skew burns off. A server-time field on the first
-* response would fix it; nothing else in the contract needs one yet.
-*
-* ponytail: the three collections grow for the life of the process, roughly
-* a hundred bytes per execution seen. A day's dev session is thousands, not
-* millions; prune below the cursor if a session ever runs long enough to
-* notice.
-*/
-function initialTailState(from = /* @__PURE__ */ new Date()) {
-	const since = from.toISOString();
-	return {
-		executionsSince: since,
-		deliveriesSince: since,
-		seen: /* @__PURE__ */ new Set(),
-		status: /* @__PURE__ */ new Map(),
-		logged: /* @__PURE__ */ new Map()
-	};
-}
-/**
-* Every page of a list whose rows changed since the cursor. Paged to
-* exhaustion on purpose: the page is ordered by when rows STARTED and
-* filtered by when they last moved, so an old execution that just completed
-* can sit on page two, and advancing the cursor off page one would lose it.
-*/
-async function drain(fetchPage) {
-	const rows = [];
-	let cursor;
-	do {
-		const page = await fetchPage(cursor);
-		rows.push(...page.data);
-		cursor = page.meta?.hasMore ? page.meta.nextCursor ?? void 0 : void 0;
-	} while (cursor);
-	return rows;
-}
-/** The newest `updatedAt` in a batch, or the cursor when the batch is empty. */
-function advance(rows, current) {
-	return rows.reduce((latest, row) => row.updatedAt > latest ? row.updatedAt : latest, current);
-}
-function executionLine(execution) {
-	const step = execution.step ? ` step=${execution.step}` : "";
-	const error = execution.error ? ` ${execution.error}` : "";
-	return `  ${execution.journeyKey} ${execution.profileId} ${execution.status}${step}${error}`;
-}
-function deliveryLine(delivery, subject, webUrl) {
-	const title = subject ? ` "${subject}"` : "";
-	const to = delivery.recipient ? ` to ${delivery.recipient}` : "";
-	return `  ${delivery.journey}/${delivery.step} ${delivery.status}${to}${title} ${webUrl}/automation/deliveries/${delivery.id}`;
-}
-/**
-* One pass over both logs. Separated from the timer so a test can call it
-* twice and prove each row prints once.
-*/
-async function pollTail({ client, io, webUrl, state }) {
-	const executions = await drain((cursor) => client.request(contract.executions["executions.list"], { query: {
-		since: state.executionsSince,
-		limit: 100,
-		cursor
-	} }));
-	for (const execution of [...executions].reverse()) {
-		const key = `${execution.id}:${execution.updatedAt}`;
-		if (state.seen.has(key)) continue;
-		const marker = `${execution.status}:${execution.step ?? ""}`;
-		if (state.status.get(execution.id) !== marker) {
-			state.status.set(execution.id, marker);
-			io.stdout(`${executionLine(execution)}\n`);
-		}
-		const { data } = await client.request(contract.executions["executions.get"], { params: { id: execution.id } });
-		const printed = state.logged.get(execution.id) ?? 0;
-		for (const line of data.logs.slice(printed)) io.stdout(`    log ${line.level}: ${line.message}\n`);
-		state.logged.set(execution.id, Math.max(printed, data.logs.length));
-		state.seen.add(key);
-	}
-	state.executionsSince = advance(executions, state.executionsSince);
-	const captured = await drain((cursor) => client.request(contract.deliveries["deliveries.list"], { query: {
-		since: state.deliveriesSince,
-		limit: 100,
-		cursor,
-		direction: "asc"
-	} }));
-	for (const delivery of captured) {
-		const key = `${delivery.id}:${delivery.updatedAt}`;
-		if (state.seen.has(key)) continue;
-		let subject = null;
-		if (delivery.channel === "email") {
-			const { data } = await client.request(contract.deliveries["deliveries.get"], { params: { id: delivery.id } });
-			subject = data.payload.rendered?.subject ?? null;
-		}
-		io.stdout(`${deliveryLine(delivery, subject, webUrl)}\n`);
-		state.seen.add(key);
-	}
-	state.deliveriesSince = advance(captured, state.deliveriesSince);
-}
-/**
-* The watcher, the cycle, and the tail, until the signal aborts. Resolves
-* when it does, which is what makes `Ctrl-C` a clean exit rather than a
-* killed process mid-upload.
-*/
-async function runDev(options) {
-	const { client, projectDir, io, signal, debounceMs = DEBOUNCE_MS, pollMs = POLL_MS, deploy = (dir, api) => deployProject({
-		client: api,
-		projectDir: dir
-	}) } = options;
-	let running = false;
-	let queued = false;
-	async function cycle() {
-		if (signal.aborted) return;
-		if (running) {
-			queued = true;
-			return;
-		}
-		running = true;
-		try {
-			io.stdout(`${deploySummary(await deploy(projectDir, client))}\n`);
-		} catch (error) {
-			io.stderr(`${error instanceof Error ? error.message : String(error)}\n`);
-		} finally {
-			running = false;
-		}
-		if (queued && !signal.aborted) {
-			queued = false;
-			await cycle();
-		}
-	}
-	const tail = options.tail ? (async () => {
-		const state = initialTailState();
-		while (!signal.aborted) {
-			await setTimeout$1(pollMs, void 0, { signal }).catch(() => {});
-			if (signal.aborted) return;
-			try {
-				await pollTail({
-					client,
-					io,
-					webUrl: options.webUrl,
-					state
-				});
-			} catch (error) {
-				io.stderr(`Tail: ${error instanceof Error ? error.message : String(error)}\n`);
-			}
-		}
-	})() : Promise.resolve();
-	let timer;
-	let pending = Promise.resolve();
-	const schedule = () => {
-		clearTimeout(timer);
-		timer = setTimeout(() => {
-			pending = cycle();
-		}, debounceMs);
-	};
-	async function watchOne(target) {
-		try {
-			for await (const event of watch(target.path, {
-				recursive: target.recursive,
-				signal
-			})) {
-				if (target.names && !target.names.includes(event.filename ?? "")) continue;
-				schedule();
-			}
-		} catch (error) {
-			if (!signal.aborted) throw error;
-		}
-	}
-	const watchers = (await watchTargets(projectDir)).map(watchOne);
-	await cycle();
-	try {
-		await Promise.all([...watchers, tail]);
-	} finally {
-		clearTimeout(timer);
-		await pending;
-	}
-}
-/**
-* The project root (non-recursive, filtered to the three config files) plus
-* each source directory that exists. Resolved once, at start: `cow init`
-* creates both directories, so the only project missing one is a hand-made
-* one, and there `cow dev` has to be restarted after the first template.
-* The root is watched instead of the
-* files themselves because an editor that saves by writing a temp file and
-* renaming it over the original leaves a per-file watch pointing at an
-* inode nobody will write to again.
-*/
-async function watchTargets(projectDir) {
-	const targets = [{
-		path: projectDir,
-		recursive: false,
-		names: CONFIG_FILES
-	}];
-	for (const dir of SOURCE_DIRS) {
-		const path = join(projectDir, dir);
-		if (await stat(path).then((s) => s.isDirectory(), () => false)) targets.push({
-			path,
-			recursive: true
-		});
-	}
-	return targets;
-}
-/**
-* What `cow dev` says about the credential it is about to use, before it
-* uses it (spec: deploy keys and roles, "cow dev says which it is using").
-* Either credential runs the whole loop, deploys and captured emails alike.
-* The session is the one that stops working partway through an afternoon,
-* so it is the one that gets a warning.
-*/
-function credentialNotices(credential) {
-	if (credential.kind === "deployKey") return ["Using COW_DEPLOY_KEY."];
-	if (credential.kind !== "session") return [];
-	const expiry = decodeSessionToken(credential.token ?? "")?.expiresAt;
-	return [`Using your cached login${expiry ? `, which expires ${expiry}` : ""}. Set COW_DEPLOY_KEY to avoid logging in again.`];
-}
-function registerDev(program, clientFor, env, io) {
-	program.command("dev").description("watch the project, build, push, and deploy to development on every save, and tail what the journeys did").option("--no-tail", "skip the execution and delivery tail").action(async (opts) => {
-		const merged = {
-			...program.opts(),
-			...opts,
-			env: DEV_ENVIRONMENT
-		};
-		const credential = resolveCredential(env, await readCredentials(env));
-		if (credential.kind === "none") throw new Error(`No credential: run \`${"cow"} login\`, or set COW_DEPLOY_KEY.`);
-		for (const notice of credentialNotices(credential)) io.stderr(`${notice}\n`);
-		const controller = new AbortController();
-		const stop = () => {
-			io.stderr("\nStopped watching.\n");
-			controller.abort();
-		};
-		process.once("SIGINT", stop);
-		try {
-			await runDev({
-				client: await clientFor(merged),
-				projectDir: process.cwd(),
-				io,
-				webUrl: env.COW_WEB_URL ?? "http://localhost:5273",
-				tail: opts.tail !== false,
-				signal: controller.signal
-			});
-		} finally {
-			controller.abort();
-			process.off("SIGINT", stop);
-		}
-	});
+function registerEnable(program, clientFor, env, io) {
+	register(program, clientFor, env, io, true);
+	register(program, clientFor, env, io, false);
 }
 
 //#endregion
@@ -11588,7 +11358,7 @@ function registerMcp(program, clientFor, env, io) {
 			...program.opts(),
 			...opts
 		});
-		if (resolveCredential(env, await readCredentials(env)).kind === "none") io.stderr("cow mcp: not logged in. Run `cow login`, or set COW_TOKEN or COW_DEPLOY_KEY.\n");
+		if (resolveCredential(env, await readCredentials(env)).kind === "none") io.stderr("cow mcp: not logged in. Run `cow login`, or set COW_TOKEN or COW_PIPELINE_KEY.\n");
 		await (await createMcpServer({ client })).connect(new StdioServerTransport());
 	});
 }
@@ -11596,7 +11366,7 @@ function registerMcp(program, clientFor, env, io) {
 //#endregion
 //#region src/commands/pull.ts
 /**
-* `cow pull` (spec: CLI): put a release's sources back on disk, so a fresh
+* `cow pull` (spec: CLI): put a push's sources back on disk, so a fresh
 * machine or an agent starts from what was actually pushed.
 *
 * It only ever writes the files the tarball carries: nothing is deleted, and
@@ -11605,8 +11375,6 @@ function registerMcp(program, clientFor, env, io) {
 * bury.
 */
 const execFileAsync = promisify(execFile);
-/** Releases read per page while looking for the newest that compiled. */
-const PAGE_SIZE = 50;
 /**
 * Uncommitted changes under `dir`, when it sits in a git working tree. A
 * directory that is not one (or a machine with no git) has nothing to lose
@@ -11638,41 +11406,30 @@ function noGitHere(error) {
 	return failure.code === "ENOENT" || String(failure.stderr ?? "").includes("not a git repository");
 }
 /**
-* The release to restore: the one named, the one an environment runs, else the
-* newest that compiled. Scoped to this directory's project, so a sibling
-* repo's release is never unpacked over this one's files.
-*/
-async function resolveRelease(client, releaseId, environment, project) {
-	if (releaseId) return (await client.request(contract.releases["releases.get"], { params: { id: releaseId } })).data;
-	if (environment) {
-		const current = (await client.request(contract.deployments["deployments.list"], { query: {
-			environment,
-			project,
-			limit: 1
-		} })).data[0];
-		if (!current) throw new Error(`Nothing has been deployed to ${environment}, so there is no release to restore. Name one with --release.`);
-		return (await client.request(contract.releases["releases.get"], { params: { id: current.releaseId } })).data;
-	}
-	let cursor;
-	do {
-		const page = await client.request(contract.releases["releases.list"], { query: {
-			limit: PAGE_SIZE,
-			cursor,
-			project
-		} });
-		const ready = page.data.find((release) => release.status === "ready");
-		if (ready) return ready;
-		cursor = page.meta?.nextCursor ?? void 0;
-	} while (cursor);
-	throw new Error("This organization has no release that compiled successfully. Run `cow push` first, or name one with --release.");
-}
-async function pullRelease({ client, projectDir, releaseId, environment, force }) {
-	const release = await resolveRelease(client, releaseId, environment, await configuredProject(projectDir));
+* The push to restore: the one named, else this project's newest. Scoped to
+* this directory's project, so a sibling repo's tree is never unpacked over
+* this one's files.
+*
+* The newest rather than the newest that compiled: a push stores the whole
+* tree and its source archive whatever its keys then compiled to, so it is
+* the last thing anyone pushed either way.
+*/
+async function resolvePush(client, pushId, project) {
+	if (pushId) return (await client.request(contract.pushes["pushes.get"], { params: { id: pushId } })).data;
+	const newest = (await client.request(contract.pushes["pushes.list"], { query: {
+		limit: 1,
+		project
+	} })).data[0];
+	if (!newest) throw new Error("This project has never been pushed, so there is nothing to restore. Run `cow push` first, or name a push with --push.");
+	return newest;
+}
+async function pullPush({ client, projectDir, pushId, force }) {
+	const push = await resolvePush(client, pushId, await configuredProject(projectDir));
 	if (!force) {
 		const dirty = await dirtyPaths(projectDir);
 		if (dirty.length > 0) throw new Error(`This working tree has uncommitted changes and \`cow pull\` would write over them:\n  ${dirty.join("\n  ")}\nCommit or stash them, or pass --force.`);
 	}
-	const tarball = await client.request(contract.releases["releases.source"], { params: { id: release.id } });
+	const tarball = await client.request(contract.pushes["pushes.source"], { params: { id: push.id } });
 	const files = [];
 	const unpack = extract({
 		cwd: projectDir,
@@ -11684,71 +11441,281 @@ async function pullRelease({ client, projectDir, releaseId, environment, force }
 		unpack.end(Buffer.from(tarball));
 	});
 	return {
-		release,
+		push,
 		files: files.sort()
 	};
 }
-function registerPull(program, clientFor, env, io) {
-	program.command("pull").description("restore the project's source files from a release into the current directory").option("--release <id>", "the release to restore (default: the latest ready one, or what --env runs)").option("--force", "extract even when the git working tree is dirty").action(async (opts) => {
+function registerPull(program, clientFor, io) {
+	program.command("pull").description("restore the project's source files from a push into the current directory").option("--push <id>", "the push to restore (default: the newest one)").option("--force", "extract even when the git working tree is dirty").action(async (opts) => {
 		const merged = {
 			...program.opts(),
 			...opts
 		};
-		const outcome = await pullRelease({
+		const outcome = await pullPush({
 			client: await clientFor(merged),
 			projectDir: process.cwd(),
-			releaseId: opts.release,
-			environment: merged.env === void 0 ? void 0 : environmentFor(env, merged),
+			pushId: opts.push,
 			force: opts.force === true
 		});
 		if (merged.json === true) {
 			emit({ data: outcome }, io, true);
 			return;
 		}
-		io.stdout(`${outcome.release.id} #${outcome.release.seq} restored, ${outcome.files.length} files:\n${outcome.files.map((file) => `  ${file}`).join("\n")}\n`);
+		io.stdout(`Push #${outcome.push.seq} restored, ${outcome.files.length} files:\n${outcome.files.map((file) => `  ${file}`).join("\n")}\n`);
 	});
 }
 
 //#endregion
-//#region src/commands/rollback.ts
-async function rollbackEnvironment({ client, environment, project }) {
-	const [current, previous] = (await client.request(contract.deployments["deployments.list"], { query: {
-		environment,
-		project,
-		limit: 2
-	} })).data;
-	if (!current) throw new Error(`Nothing has been deployed to ${environment} yet, so there is nothing to roll back.`);
-	if (!previous) throw new Error(`${environment} has only ever run ${current.releaseId} #${current.releaseSeq}, so there is nothing to roll back to.`);
-	if (previous.releaseId === current.releaseId) throw new Error(`${environment} has run ${current.releaseId} #${current.releaseSeq} for its last two deployments, so there is nothing to roll back to. Name an earlier release with \`cow deploy --release\`.`);
-	const { data } = await client.request(contract.deployments["deployments.create"], { body: { releaseId: previous.releaseId } });
+//#region src/commands/push.ts
+/**
+* This directory's project, created when the org has none by that name.
+* `cow init` usually got there first; a project pushed from a machine that
+* only ever cloned the repo has not, and creating it here is what makes that
+* clone work. The name is `cow.json`'s `project`.
+*/
+async function ensureProject(client, name) {
+	try {
+		return (await client.request(contract.project["project.get"], { query: { name } })).data;
+	} catch (error) {
+		if (!(error instanceof ApiError) || error.code !== "project_missing") throw error;
+	}
+	try {
+		return (await client.request(contract.project["project.create"], { body: { name } })).data;
+	} catch (error) {
+		const reason = error instanceof Error ? error.message : String(error);
+		throw new Error(`This organization has no project and one could not be created (${reason}). Run \`cow init\` first.`);
+	}
+}
+/** Does the org already hold these bytes? A 404 is the answer, not a failure. */
+async function held(client, digest) {
+	try {
+		await client.request(contract.artifacts["artifacts.head"], { params: { digest } });
+		return true;
+	} catch (error) {
+		if (error instanceof ApiError && error.status === 404) return false;
+		throw error;
+	}
+}
+/** Every artifact the manifest names, and the file `cow build` wrote it to. */
+function artifactFiles(projectDir, manifest) {
+	const out = join(projectDir, BUILD_DIR);
+	return [
+		...manifest.journeys.map((journey) => ({
+			digest: journey.bundle,
+			kind: "bundle",
+			file: join(out, "bundles", "journeys", `${journey.key}.js`)
+		})),
+		...manifest.templates.map((template) => ({
+			digest: template.bundle,
+			kind: "bundle",
+			file: join(out, "bundles", "emails", `${template.key}.js`)
+		})),
+		{
+			digest: manifest.source,
+			kind: "source",
+			file: join(out, "source.tgz")
+		}
+	];
+}
+async function pushProject({ client, projectDir }) {
+	const { manifest, config } = await buildProject(projectDir);
+	const project = await ensureProject(client, config.project);
+	if (project.orgId !== config.orgId) throw new Error(`cow.json is for ${config.orgId} but the credential belongs to ${project.orgId}. Log in to that organization, use its pipeline key, or select a config for it with --config or COW_CONFIG (for example cow.local.json).`);
+	const uploaded = [];
+	for (const artifact of artifactFiles(projectDir, manifest)) {
+		if (await held(client, artifact.digest)) continue;
+		await client.request(contract.artifacts["artifacts.put"], {
+			params: { digest: artifact.digest },
+			query: { kind: artifact.kind },
+			body: await readFile(artifact.file)
+		});
+		uploaded.push(artifact.digest);
+	}
 	return {
-		deployment: data,
-		from: current,
-		to: previous
+		push: (await client.request(contract.pushes["pushes.create"], { body: {
+			manifest: {
+				...manifest,
+				protocol: 2
+			},
+			project: project.name
+		} })).data,
+		uploaded
 	};
 }
-function rollbackSummary(outcome) {
-	const { deployment, from, to } = outcome;
-	const lines = [`${deployment.environment} rolled back from ${from.releaseId} #${from.releaseSeq} to ${to.releaseId} #${to.releaseSeq}.`];
-	for (const warning of deployment.warnings) lines.push(`Warning: ${warning}`);
-	return lines.join("\n");
+/**
+* The human report: what was stored, and one line per changed key with the
+* page that key now has on the dashboard. A key whose code did not change
+* gets no new version, so a push of an unchanged tree says exactly that.
+*/
+function pushSummary(outcome, webUrl) {
+	const { push } = outcome;
+	const uploaded = outcome.uploaded.length === 0 ? "nothing new to upload" : `${outcome.uploaded.length} artifact${outcome.uploaded.length === 1 ? "" : "s"} uploaded`;
+	const stored = `Push #${push.seq} stored (${uploaded}).`;
+	if (push.versions.length === 0) return `${stored} Nothing changed.`;
+	const width = Math.max(...push.versions.map((version) => version.key.length));
+	return [`${stored} Compiling ${push.versions.length} ${push.versions.length === 1 ? "key" : "keys"}:`, ...push.versions.map((version) => `  ${version.key.padEnd(width)}  ${webUrl}/${version.kind === "journey" ? "journeys" : "templates"}/${version.key}`)].join("\n");
 }
-function registerRollback(program, clientFor, env, io) {
-	program.command("rollback").description("redeploy the release the environment ran before its current one").action(async (opts) => {
+function registerPush(program, clientFor, env, io) {
+	program.command("push").description("build the project and upload it; the server compiles what changed").action(async (opts) => {
 		const merged = {
 			...program.opts(),
 			...opts
 		};
-		const outcome = await rollbackEnvironment({
+		const outcome = await pushProject({
 			client: await clientFor(merged),
-			environment: requireEnvironment(env, merged),
-			project: await configuredProject(process.cwd())
+			projectDir: process.cwd()
 		});
 		if (merged.json === true) {
-			emit({ data: outcome.deployment }, io, true);
+			emit({ data: outcome.push }, io, true);
+			return;
+		}
+		const webUrl = resolveWebUrl(env, (await readCowConfig(process.cwd()))?.webUrl);
+		io.stdout(`${pushSummary(outcome, webUrl)}\n`);
+	});
+}
+
+//#endregion
+//#region src/commands/status.ts
+/**
+* `cow status`: what the server holds for every key of this project, and how
+* far the tree in front of the developer has moved from it. Hand-written
+* rather than derived from `project.status`, because the drift is the half
+* of the answer no server read can know: it comes from building the project
+* here and comparing the bundle digests with the versions the server has.
+*/
+/** Largest first: the first unit the gap fills is the one that reads best. */
+const UNITS = [
+	["year", 31536e6],
+	["month", 2592e6],
+	["week", 6048e5],
+	["day", 864e5],
+	["hour", 36e5],
+	["minute", 6e4],
+	["second", 1e3]
+];
+const relative$1 = new Intl.RelativeTimeFormat("en", { numeric: "auto" });
+/** The gap between an instant and now, in words. */
+function ago(value, now) {
+	const gap = new Date(value).getTime() - now.getTime();
+	for (const [unit, ms] of UNITS) if (Math.abs(gap) >= ms) return relative$1.format(Math.round(gap / ms), unit);
+	return relative$1.format(0, "second");
+}
+function localKeys(manifest) {
+	return [...manifest.journeys.map((journey) => ({
+		kind: "journey",
+		key: journey.key,
+		bundle: journey.bundle
+	})), ...manifest.templates.map((template) => ({
+		kind: "template",
+		key: template.key,
+		bundle: template.bundle
+	}))];
+}
+/**
+* The version's short name. The bundle digest rather than the compiled
+* module's, because a version is one bundle (a push that carries a bundle
+* the org already holds creates no second version) and the bundle is there
+* from the moment the push lands, while the module digest arrives only when
+* the compile finishes.
+*/
+function shortDigest(bundle) {
+	return bundle.replace("sha256:", "").slice(0, 8);
+}
+function bundleOf(entry) {
+	const manifest = entry.latestVersion?.manifest;
+	return manifest ? manifest.bundle : null;
+}
+/** "version 3f2a1b9c, pushed 2 hours ago, still compiling" */
+function versionPhrase(entry, now) {
+	const version = entry.latestVersion;
+	if (!version) return "no version yet";
+	const state = version.status === "compiling" ? ", still compiling" : version.status === "failed" ? ", did not compile" : "";
+	const bundle = bundleOf(entry);
+	return `${bundle ? `version ${shortDigest(bundle)}` : "version"}, pushed ${ago(version.pushedAt, now)}${state}`;
+}
+function flagsPhrase(entry) {
+	if (!entry.enabled) return "";
+	const word = (on) => on ? "on" : "off";
+	return `${word(entry.enabled.development)} in development, ${word(entry.enabled.production)} in production`;
+}
+function livePhrase(entry) {
+	const running = (count, environment) => count === 0 ? [] : [`${count} running in ${environment}`];
+	return [...running(entry.liveExecutions.development, "development"), ...running(entry.liveExecutions.production, "production")].join(", ");
+}
+function pad(text, width) {
+	return text.padEnd(width);
+}
+/**
+* The whole report, as lines. Pure so a test can read it: everything it
+* needs is the server's answer, the local build, and the clock.
+*
+* A null manifest is a tree that did not build. What the server runs is
+* still the answer to most of the question, so the report keeps it and drops
+* only the comparison.
+*/
+function statusLines(status, manifest, now) {
+	const local = manifest ? localKeys(manifest) : [];
+	const journeys = status.keys.filter((entry) => entry.kind === "journey");
+	const templates = status.keys.filter((entry) => entry.kind === "template");
+	const lines = [`${status.project}: ${journeys.length} ${journeys.length === 1 ? "journey" : "journeys"}, ${templates.length} ${templates.length === 1 ? "template" : "templates"} on the server.`];
+	const width = Math.max(0, ...status.keys.map((entry) => entry.key.length));
+	const section = (title, entries) => {
+		if (entries.length === 0) return;
+		const flagWidth = Math.max(0, ...entries.map((entry) => flagsPhrase(entry).length));
+		lines.push("", title);
+		for (const entry of entries) {
+			const flags = flagsPhrase(entry);
+			const live = livePhrase(entry);
+			const rest = [
+				...flags === "" ? [] : [pad(flags, flagWidth)],
+				versionPhrase(entry, now),
+				...live === "" ? [] : [live]
+			];
+			lines.push(`  ${pad(entry.key, width)}  ${rest.join("   ")}`.trimEnd());
+		}
+	};
+	section("Journeys", journeys);
+	section("Templates", templates);
+	if (!manifest) {
+		lines.push("", "This tree did not build, so nothing here is compared with it. Run cow build to see why.");
+		return lines;
+	}
+	const changed = local.filter((entry) => {
+		const served = status.keys.find((one) => one.kind === entry.kind && one.key === entry.key);
+		return !served || bundleOf(served) !== entry.bundle;
+	});
+	const missing = status.keys.filter((entry) => !local.some((one) => one.kind === entry.kind && one.key === entry.key));
+	if (changed.length > 0) lines.push("", `Changed here since the last push: ${changed.map((entry) => entry.key).join(", ")}. Run cow push.`);
+	if (missing.length > 0) {
+		lines.push("", "On the server and not in this tree:");
+		for (const entry of missing) lines.push(`  ${entry.key}, a ${entry.kind}. Delete it with cow ${entry.kind}s delete ${entry.key}.`);
+	}
+	for (const environment of ["development", "production"]) {
+		const warnings = status.warnings[environment];
+		if (warnings.length === 0) continue;
+		lines.push("", `Names ${environment} does not define yet:`);
+		for (const warning of warnings) lines.push(`  ${warning}`);
+	}
+	return lines;
+}
+/** The project's status from the server, for this directory's `cow.json`. */
+async function readStatus(client, project) {
+	return (await client.request(contract.project["project.status"], { query: { name: project } })).data;
+}
+function registerStatus(program, clientFor, io) {
+	program.command("status").description("what this project's journeys and templates are doing, and what changed here since the last push").action(async (opts) => {
+		const merged = {
+			...program.opts(),
+			...opts
+		};
+		const config = await assertCowConfig(process.cwd());
+		const built = await buildProject(process.cwd()).catch(() => null);
+		const status = await readStatus(await clientFor(merged), config.project);
+		if (merged.json === true) {
+			emit({ data: status }, io, true);
 			return;
 		}
-		io.stdout(`${rollbackSummary(outcome)}\n`);
+		io.stdout(`${statusLines(status, built?.manifest ?? null, /* @__PURE__ */ new Date()).join("\n")}\n`);
 	});
 }
 
@@ -12007,9 +11974,8 @@ function registerTest(program, io) {
 //#region src/commands/index.ts
 /**
 * The environment a call acts on: the root `--env`, else `COW_ENVIRONMENT`,
-* else production. The client sets it as the selection header; the commands
-* that also need the value itself (a deployment list is filtered by a query
-* parameter, not by the header) read it from here, so the two can never
+* else production. The client sets it as the selection header; a command
+* that also needs the value itself reads it from here, so the two can never
 * disagree.
 */
 function environmentFor(env, opts) {
@@ -12017,11 +11983,11 @@ function environmentFor(env, opts) {
 	return flag.success ? flag.data : env.COW_ENVIRONMENT ?? "production";
 }
 /**
-* The same value, but only when the caller actually chose one. `cow deploy`
-* and `cow rollback` change what real users are running, and the default is
-* production: a bare `cow rollback` typed while thinking about development
-* would roll production back. A pipeline is unaffected, because
-* `COW_ENVIRONMENT` counts as having chosen.
+* The same value, but only when the caller actually chose one. `cow enable`
+* and `cow disable` change what real recipients get, and the default is
+* production: a bare `cow enable welcome` typed while thinking about
+* development would turn it on in production. A pipeline is unaffected,
+* because `COW_ENVIRONMENT` counts as having chosen.
 */
 function requireEnvironment(env, opts) {
 	if (opts.env === void 0 && env.COW_ENVIRONMENT === void 0) throw new Error(`Name the environment to act on: --env ${ENVIRONMENTS.join(" or --env ")}, or set COW_ENVIRONMENT.`);
@@ -12067,11 +12033,10 @@ function buildProgram(env, io) {
 	registerInit(program, env, io);
 	registerAdd(program, io);
 	registerBuild(program, io);
-	registerPush(program, clientFor, io);
-	registerPull(program, clientFor, env, io);
-	registerDeploy(program, clientFor, env, io);
-	registerDev(program, clientFor, env, io);
-	registerRollback(program, clientFor, env, io);
+	registerPush(program, clientFor, env, io);
+	registerStatus(program, clientFor, io);
+	registerEnable(program, clientFor, env, io);
+	registerPull(program, clientFor, io);
 	registerTest(program, io);
 	registerMcp(program, clientFor, env, io);
 	return program;
@@ -12089,8 +12054,8 @@ const envSchema = z.object({
 	COW_CREDENTIALS_PATH: z.string().min(1).optional(),
 	/** A session token passed explicitly instead of a cached `cow login`. */
 	COW_TOKEN: z.string().min(1).optional(),
-	/** An org deploy key for CI; when set it wins over the cached session (ticket 05 reads it). */
-	COW_DEPLOY_KEY: z.string().min(1).optional(),
+	/** An org pipeline key for CI; when set it wins over the cached session (ticket 05 reads it). */
+	COW_PIPELINE_KEY: z.string().min(1).optional(),
 	/** The environment admin calls select; `--env` overrides it, production is the default. */
 	COW_ENVIRONMENT: environmentSchema.optional(),
 	/**