@cowliss/cli 0.5.0 → 0.6.0

package/dist/index.js

@@ -38,24 +38,6 @@ const REQUEST_ID_HEADER = "X-Request-Id";
 */
 const CLERK_ORG_SUBJECT_PREFIX = "org_";
 /**
-* The two fixed environments every org has (spec: Environments). An app
-* belongs to one, so the environment of every write is the app's;
-* profiles, identifiers, events, memberships, journey instances,
-* deliveries, violations, quarantine, the address ledger, and idempotency
-* keys are per environment, while the catalog, sending domains, the
-* suppression mirror, billing, and journey code are shared. A third
-* environment is a one-line change here plus the mirrored db enum.
-*/
-const ENVIRONMENTS = ["development", "production"];
-/** What an admin call gets when it names no environment. */
-const DEFAULT_ENVIRONMENT = "production";
-/**
-* The request header admin endpoints read the environment from; absent
-* means production. Ingestion endpoints ignore it: the environment of a
-* write comes from the app.
-*/
-const ENVIRONMENT_HEADER = "X-Cow-Environment";
-/**
 * The header every Cowliss client names itself in, as
 * `<package>/<version>` (`@cowliss/cli/0.1.0`). The API logs it and reads
 * nothing from it: no behaviour depends on the value, so a caller that
@@ -74,16 +56,6 @@ const ENVIRONMENT_HEADER = "X-Cow-Environment";
 */
 const CLIENT_HEADER = "X-Cow-Client";
 /**
-* Event retention per environment, in days: both the default (what an org
-* gets without setting anything) and the cap (the API refuses more). There
-* is no "forever". Production keeps 18 months; development keeps 30 days,
-* because test traffic is disposable by definition.
-*/
-const EVENT_RETENTION_DAYS = {
-	production: 548,
-	development: 30
-};
-/**
 * The named identifiers a call may carry, a fixed enum grown by code (spec:
 * Identity). `anonymousId` is reserved only in that a profile whose
 * identifiers are all anonymous is labelled anonymous in the dashboard;
@@ -3084,21 +3056,6 @@ const abuseEvents = pgTable("abuse_events", {
 const selectAbuseEventSchema = createSelectSchema(abuseEvents);
 const insertAbuseEventSchema = createInsertSchema(abuseEvents);
 
-//#endregion
-//#region ../../packages/db/src/schema/environments.ts
-/**
-* The two fixed environments every org has. A partition inside the org, not
-* a resource: no table, no ids, no create surface. The environment of a
-* write comes from the app it names (apps carry one), and everything
-* downstream of a write (profiles, identifiers, events, memberships,
-* deliveries, runs, violations, quarantine, the address ledger) is stamped
-* with it.
-*
-* The literal list mirrors ENVIRONMENTS in packages/shared/constants; db
-* cannot import it without closing a package cycle (shared -> db).
-*/
-const environmentEnum = pgEnum("environment", ["development", "production"]);
-
 //#endregion
 //#region ../../packages/db/src/schema/timestamps.ts
 /**
@@ -3134,12 +3091,7 @@ const updatedAt = () => stamp("updated_at").notNull().defaultNow().$onUpdate(()
 /**
 * Apps: the registry of an org's apps/products, and the attribution unit.
 * Everything downstream (ingestion, via the source a payload names;
-* segments, journeys, destinations) validates appIds against this table.
-*
-* An app belongs to exactly one environment, chosen at creation and
-* immutable: the environment of every write is the environment of the
-* app behind the source the payload names, and nothing else carries it.
-* The dev and prod rows of one app are two rows with two names and two ids.
+* segments, journeys, webhooks) validates appIds against this table.
 *
 * The id is readable, `app_<slug>` derived from the name at creation, and
 * unique per org rather than globally: the primary key is (orgId, id), and
@@ -3162,7 +3114,6 @@ const appStatusEnum = pgEnum("app_status", ["active", "archived"]);
 const apps$1 = pgTable("apps", {
 	id: text("id").notNull(),
 	orgId: text("org_id").notNull(),
-	environment: environmentEnum("environment").notNull(),
 	name: text("name").notNull(),
 	status: appStatusEnum("status").notNull().default("active"),
 	createdAt: createdAt(),
@@ -3317,7 +3268,7 @@ const insertCatalogTraitSchema = createInsertSchema(catalogTraits);
 * in their `cow.json`. One read here returns the whole set, so nothing
 * downstream unions a table with a constant.
 *
-* Org-wide rather than per-project or per-environment: `profiles.consent` is
+* Org-wide rather than per-project: `profiles.consent` is
 * one jsonb map per profile, so an answer given under one project is the
 * same answer under the next, and two projects declaring one key must agree
 * on its label and default or the deploy is refused.
@@ -3367,8 +3318,16 @@ const deliveryChannelEnum = pgEnum("delivery_channel", ["email", "webhook"]);
 * nullable. The meter and the quota gate exclude it (packages/delivery's
 * repository), and every per-profile read excludes it by construction,
 * because it has no profile to be found under.
+*
+* `api` is a direct send through the Resend-compatible facade (ADR 0014):
+* no journey and no profile either, addressed to whatever the caller named,
+* and metered exactly like a journey's email.
 */
-const deliveryKindEnum = pgEnum("delivery_kind", ["journey", "test"]);
+const deliveryKindEnum = pgEnum("delivery_kind", [
+	"journey",
+	"test",
+	"api"
+]);
 /**
 * The delivery lifecycle, frozen with the API version.
 *
@@ -3400,7 +3359,6 @@ const deliveryStatusEnum = pgEnum("delivery_status", [
 	"skipped_quota",
 	"skipped_frequency_cap",
 	"skipped_consent",
-	"skipped_sender",
 	"skipped_domain",
 	"skipped_ssrf",
 	"would_send",
@@ -3410,34 +3368,47 @@ const deliveryStatusEnum = pgEnum("delivery_status", [
 	"would_skip_quota",
 	"would_skip_frequency_cap",
 	"would_skip_consent",
-	"would_skip_sender",
 	"would_skip_domain",
 	"would_skip_ssrf"
 ]);
 const deliveries$1 = pgTable("deliveries", {
 	id: text("id").primaryKey(),
 	orgId: text("org_id").notNull(),
-	/** The instance's environment, stamped from the workflow run input. */
-	environment: environmentEnum("environment").notNull(),
 	/**
 	* The recipient profile (`usr_`); a text column, since a delivery is a
 	* log row and outlives nothing but erasure. Null on a test send, which
-	* goes to the member who asked for it rather than to anyone's profile.
+	* goes to the member who asked for it rather than to anyone's profile,
+	* and on an api send, which names addresses and knows no profile.
 	*/
 	profileId: text("profile_id"),
-	/** The journey that sent this; null on a test send, which has none. */
+	/**
+	* The journey that sent this; null on a test send and on an api send,
+	* neither of which has one.
+	*/
 	journey: text("journey"),
 	kind: deliveryKindEnum("kind").notNull().default("journey"),
-	/** Email template name or webhook destination name. */
+	/**
+	* Email template name or webhook name. An api send that named no
+	* template says `email`: there is a message but no key to point at.
+	*/
 	step: text("step").notNull(),
 	channel: deliveryChannelEnum("channel").notNull(),
 	status: deliveryStatusEnum("status").notNull(),
 	dryRun: boolean("dry_run").notNull().default(false),
 	/**
-	* Recipient email address or destination URL. PII: the logger redacts
-	* this path, so it is stored here and nowhere else.
+	* Recipient email address or webhook URL. An api send to several
+	* addresses records the first `to`; the rest are in the payload. PII:
+	* the logger redacts this path, so it is stored here and nowhere else.
 	*/
 	recipient: text("recipient"),
+	/**
+	* What the send was made of, per kind: a journey or test email holds the
+	* template props (plus `rendered` on a dry run or a test), a webhook
+	* holds its body, and an `api` send holds the caller's envelope as they
+	* spelled it, `{ from, to, cc, bcc, reply_to, subject, headers,
+	* template, variables }`. Never the rendered bodies of a real send: SES
+	* has the message and the log does not keep a second copy.
+	*/
 	payload: jsonb("payload").$type().notNull().default({}),
 	/**
 	* The provider's message id (SES's MessageId), stored so a feedback
@@ -3470,7 +3441,7 @@ const deliveries$1 = pgTable("deliveries", {
 		precision: 3
 	})
 }, (table) => [
-	index("deliveries_org_id_environment_created_at_idx").on(table.orgId, table.environment, table.createdAt),
+	index("deliveries_org_id_created_at_idx").on(table.orgId, table.createdAt),
 	index("deliveries_org_id_profile_id_created_at_idx").on(table.orgId, table.profileId, table.createdAt),
 	uniqueIndex("deliveries_org_id_attempt_key_unique").on(table.orgId, table.attemptKey),
 	uniqueIndex("deliveries_provider_id_unique").on(table.providerId),
@@ -3479,62 +3450,14 @@ const deliveries$1 = pgTable("deliveries", {
 const selectDeliverySchema = createSelectSchema(deliveries$1);
 const insertDeliverySchema = createInsertSchema(deliveries$1);
 
-//#endregion
-//#region ../../packages/db/src/schema/destinations.ts
-/**
-* Destinations: named send targets (webhook URLs, sender identities) that
-* journeys reference by name. Mirrors the apps table conventions: ms
-* precision timestamps for cursor round-trips, one environment chosen at
-* creation and immutable, and name uniqueness per org AND environment, so
-* `crm` can point at the staging receiver in development and at the real one
-* in production. A journey step naming `webhook("crm")` resolves to the row
-* in the instance's environment; the same rule picks the sender identity, of
-* which an org has one per environment.
-*
-* WEBHOOK_PAYLOAD_VERSION (packages/shared) pins the webhook payload shape;
-* the column records the version each destination was created against.
-* signingSecret is the Standard Webhooks signing secret, generated at
-* creation and shown once — the API DTO omits it after the create response.
-*/
-const destinationTypeEnum = pgEnum("destination_type", ["webhook", "sender_identity"]);
-const destinations$1 = pgTable("destinations", {
-	id: text("id").primaryKey(),
-	orgId: text("org_id").notNull(),
-	environment: environmentEnum("environment").notNull(),
-	name: text("name").notNull(),
-	type: destinationTypeEnum("type").notNull(),
-	config: jsonb("config").$type().notNull(),
-	webhookPayloadVersion: integer("webhook_payload_version").notNull().default(1),
-	signingSecret: text("signing_secret"),
-	/**
-	* Auto-disable state, mirroring how receivers treat us: the webhook send
-	* activity bumps the counter once per failed delivery attempt (not once
-	* per Temporal retry) and stamps disabledAt at the threshold. A disabled
-	* destination records `skipped_disabled` until an admin clears it; a
-	* successful delivery resets the counter.
-	*/
-	consecutiveFailures: integer("consecutive_failures").notNull().default(0),
-	disabledAt: timestamp("disabled_at", {
-		withTimezone: true,
-		mode: "date",
-		precision: 3
-	}),
-	createdAt: createdAt(),
-	updatedAt: updatedAt()
-}, (table) => [index("destinations_org_id_idx").on(table.orgId), uniqueIndex("destinations_org_id_environment_name_unique").on(table.orgId, table.environment, table.name)]);
-const selectDestinationSchema = createSelectSchema(destinations$1);
-const insertDestinationSchema = createInsertSchema(destinations$1);
-
 //#endregion
 //#region ../../packages/db/src/schema/email-addresses.ts
 /**
 * The email address ledger (ticket 35): everything Cowliss knows about an
-* address, scoped to the org and environment and keyed by the address
-* rather than the profile. Verification is address-scoped by nature: a
-* profile that changes its email has not verified the new one, and an
-* address verified once stays verified when the same profile comes back to
-* it. Per environment because a verification proven against a development
-* profile says nothing about production.
+* address, scoped to the org and keyed by the address rather than the
+* profile. Verification is address-scoped by nature: a profile that changes
+* its email has not verified the new one, and an address verified once
+* stays verified when the same profile comes back to it.
 *
 * The profile keeps its canonical `email` trait as the address Cowliss sends
 * to, plus the system-maintained `emailVerifiedAt` / `emailVerifiedAddress`
@@ -3552,7 +3475,6 @@ const verificationMethodEnum = pgEnum("verification_method", [
 const emailAddresses = pgTable("email_addresses", {
 	id: text("id").primaryKey(),
 	orgId: text("org_id").notNull(),
-	environment: environmentEnum("environment").notNull(),
 	/** Stored lowercased and trimmed: the mailbox, not the way it was typed. */
 	address: text("address").notNull(),
 	/** Null until something verified the address. */
@@ -3564,45 +3486,10 @@ const emailAddresses = pgTable("email_addresses", {
 	verificationMethod: verificationMethodEnum("verification_method"),
 	createdAt: createdAt(),
 	updatedAt: updatedAt()
-}, (table) => [uniqueIndex("email_addresses_org_env_address_unique").on(table.orgId, table.environment, table.address)]);
+}, (table) => [uniqueIndex("email_addresses_org_address_unique").on(table.orgId, table.address)]);
 const selectEmailAddressSchema = createSelectSchema(emailAddresses);
 const insertEmailAddressSchema = createInsertSchema(emailAddresses);
 
-//#endregion
-//#region ../../packages/db/src/schema/environment-settings.ts
-/**
-* The ingestion policy for catalog governance. Single source of truth:
-* @cowliss/shared/governance derives INGESTION_POLICIES from
-* ingestionPolicyEnum.enumValues, so the enum and the settings contract
-* cannot drift.
-*/
-const ingestionPolicyEnum = pgEnum("ingestion_policy", ["permissive", "strict"]);
-/**
-* Per-environment settings, keyed by org and environment. "No row means
-* every default applies", the same convention as org_settings: a fresh org
-* is zero-config in both environments, and the write path never seeds rows
-* it does not own.
-*
-* `ingestionPolicy`: permissive accepts quarantined (unclassified) names and
-* observes them; strict routes them to the review queue instead of applying
-* them. Development can be strict while production stays lenient.
-*
-* `eventRetentionDays`: the ClickHouse TTL window for the environment's
-* events. Null means the environment's default (18 months in production,
-* 30 days in development, from packages/shared constants); there is no
-* "forever", and the API refuses a value above the environment's cap.
-*/
-const environmentSettings = pgTable("environment_settings", {
-	orgId: text("org_id").notNull(),
-	environment: environmentEnum("environment").notNull(),
-	ingestionPolicy: ingestionPolicyEnum("ingestion_policy").notNull().default("permissive"),
-	eventRetentionDays: integer("event_retention_days"),
-	createdAt: createdAt(),
-	updatedAt: updatedAt()
-}, (table) => [primaryKey({ columns: [table.orgId, table.environment] })]);
-const selectEnvironmentSettingsSchema = createSelectSchema(environmentSettings);
-const insertEnvironmentSettingsSchema = createInsertSchema(environmentSettings);
-
 //#endregion
 //#region ../../packages/db/src/schema/executions.ts
 const executionStatusEnum = pgEnum("execution_status", [
@@ -3615,7 +3502,6 @@ const executionStatusEnum = pgEnum("execution_status", [
 const executions$1 = pgTable("executions", {
 	id: text("id").primaryKey(),
 	orgId: text("org_id").notNull(),
-	environment: environmentEnum("environment").notNull(),
 	/** The journey's key, not a foreign key: derived journey rows come and go with pushes. */
 	journeyKey: text("journey_key").notNull(),
 	profileId: text("profile_id").notNull(),
@@ -3664,9 +3550,9 @@ const executions$1 = pgTable("executions", {
 		precision: 3
 	})
 }, (table) => [
-	index("executions_org_id_environment_version_id_status_idx").on(table.orgId, table.environment, table.versionId, table.status),
+	index("executions_org_id_version_id_status_idx").on(table.orgId, table.versionId, table.status),
 	uniqueIndex("executions_org_id_workflow_id_unique").on(table.orgId, table.workflowId),
-	index("executions_org_id_environment_started_at_idx").on(table.orgId, table.environment, table.startedAt)
+	index("executions_org_id_started_at_idx").on(table.orgId, table.startedAt)
 ]);
 const selectExecutionSchema = createSelectSchema(executions$1);
 const insertExecutionSchema = createInsertSchema(executions$1);
@@ -3725,7 +3611,7 @@ const idempotencyKeys = pgTable("idempotency_keys", {
 //#endregion
 //#region ../../packages/db/src/schema/profiles.ts
 /**
-* Profiles: one row per person per environment. Cowliss generates the id
+* Profiles: one row per person. Cowliss generates the id
 * (`usr_`) and that id is the person key everywhere: workflow ids,
 * ClickHouse rows, segment membership, deliveries, journey runs, erasure.
 * Callers never send it on the write path; they send named identifiers
@@ -3739,10 +3625,6 @@ const idempotencyKeys = pgTable("idempotency_keys", {
 * profile exists under at all. It is written by the identify path (a caller
 * passing `consent`), the consent editor, and the automatic revocations.
 *
-* `environment` is the app's, stamped at creation and never changed: a
-* person in development and a person in production are two rows even when
-* their identifiers match.
-*
 * `mergedInto` is the merge pointer (spec: Identity). Null on a live
 * profile; on a profile a merge folded away it names the survivor, whose
 * reads union its merged ids. The graph stays flat: a merge re-points rows
@@ -3756,7 +3638,6 @@ const idempotencyKeys = pgTable("idempotency_keys", {
 const profiles = pgTable("profiles", {
 	id: text("id").primaryKey(),
 	orgId: text("org_id").notNull(),
-	environment: environmentEnum("environment").notNull(),
 	appId: text("app_id").notNull(),
 	sourceId: text("source_id").notNull(),
 	traits: jsonb("traits").$type().notNull().default({}),
@@ -3768,7 +3649,7 @@ const profiles = pgTable("profiles", {
 	createdAt: createdAt(),
 	updatedAt: updatedAt()
 }, (table) => [
-	index("profiles_org_id_environment_idx").on(table.orgId, table.environment),
+	index("profiles_org_id_idx").on(table.orgId),
 	index("profiles_merged_into_idx").on(table.mergedInto),
 	foreignKey({
 		columns: [table.mergedInto],
@@ -3804,10 +3685,10 @@ const identifierKindEnum = pgEnum("identifier_kind", [
 ]);
 /**
 * The identifiers map: every named identifier a call has ever carried,
-* pointing at the profile it resolved to. Unique per (org, environment,
-* kind, value), which is what makes "a shared identifier means the same
-* person" enforceable at the row level: the same clerkId in development and
-* production is two people, and the same clerkId twice in production is one.
+* pointing at the profile it resolved to. Unique per (org, kind, value),
+* which is what makes "a shared identifier means the same person"
+* enforceable at the row level: the same clerkId twice in one organization
+* is one person.
 *
 * Rows follow their profile: erasure deletes the profile and these cascade,
 * and a merge re-points them at the survivor.
@@ -3815,12 +3696,11 @@ const identifierKindEnum = pgEnum("identifier_kind", [
 const identifiers = pgTable("identifiers", {
 	id: text("id").primaryKey(),
 	orgId: text("org_id").notNull(),
-	environment: environmentEnum("environment").notNull(),
 	kind: identifierKindEnum("kind").notNull(),
 	value: text("value").notNull(),
 	profileId: text("profile_id").notNull().references(() => profiles.id, { onDelete: "cascade" }),
 	createdAt: createdAt()
-}, (table) => [uniqueIndex("identifiers_org_env_kind_value_unique").on(table.orgId, table.environment, table.kind, table.value), index("identifiers_profile_id_idx").on(table.profileId)]);
+}, (table) => [uniqueIndex("identifiers_org_kind_value_unique").on(table.orgId, table.kind, table.value), index("identifiers_profile_id_idx").on(table.profileId)]);
 const selectIdentifierSchema = createSelectSchema(identifiers);
 const insertIdentifierSchema = createInsertSchema(identifiers);
 
@@ -3846,8 +3726,6 @@ const insertIdentifierSchema = createInsertSchema(identifiers);
 const journeyRuns = pgTable("journey_runs", {
 	id: text("id").primaryKey(),
 	orgId: text("org_id").notNull(),
-	/** The instance's environment; development instances never land here (they bill nothing). */
-	environment: environmentEnum("environment").notNull(),
 	/** The journey's name, not its registry id: the run is about the definition that ran. */
 	journey: text("journey").notNull(),
 	profileId: text("profile_id").notNull(),
@@ -3872,10 +3750,6 @@ const insertJourneyRunSchema = createInsertSchema(journeyRuns);
 * there is no id of its own: the key is the name the author gave the file,
 * and the (org, key) pair is the only identity a journey has.
 *
-* One row for both environments (ADR 0011): the journey's code is its
-* latest ready version, and what differs per environment is the enabled
-* flag alone. A trigger that should fire in both names both of an app's ids.
-*
 * A push only ever adds and updates: it owns the keys its manifest carries
 * and leaves every other row alone, because an org's journeys can come from
 * several projects and a developer may push a project holding only some of
@@ -3883,9 +3757,9 @@ const insertJourneyRunSchema = createInsertSchema(journeyRuns);
 * what makes a key another project owns a refused push rather than a silent
 * overwrite. Removing a journey is an explicit delete (ADR 0009).
 *
-* Whether a journey fires is one flag and one only: journey_states, per
-* environment, which outlives every push, so a push never turns anything on
-* or off. The author has no second gate of their own (ADR 0011).
+* Whether a journey fires is one flag and one only: `enabled`, which a
+* push never writes, so deploying code never turns anything on or off. The
+* author has no second gate of their own (ADR 0011).
 *
 * The descriptive columns are what its latest ready version reported, so a
 * failed compile leaves both the code and its description as they were.
@@ -3909,47 +3783,35 @@ const journeys$1 = pgTable("journeys", {
 	*/
 	purpose: text("purpose").notNull(),
 	spine: jsonb("spine").$type().notNull(),
+	/**
+	* The one gate on the journey: off until `cow enable` or a manager's
+	* toggle, and never touched by a push (ADR 0011, amended by ADR 0013).
+	*/
+	enabled: boolean("enabled").notNull().default(false),
 	createdAt: createdAt(),
 	updatedAt: updatedAt()
 }, (table) => [primaryKey({ columns: [table.orgId, table.key] })]);
 const selectJourneySchema = createSelectSchema(journeys$1);
 const insertJourneySchema = createInsertSchema(journeys$1);
-/**
-* Per-org, per-environment enable state for a journey key; the only
-* operator write on a journey, and the one gate on it. A row exists only
-* once someone turned the journey on or off in that environment: NO ROW
-* MEANS DISABLED (ADR 0011). A push writes none, so a key is off in both
-* environments until `cow enable` or a manager's toggle.
-*
-* Keyed by key rather than by a foreign key into `journeys` on purpose: the
-* flag outlives every push, so it survives a key that temporarily leaves a
-* project and comes back.
-*/
-const journeyStates = pgTable("journey_states", {
-	orgId: text("org_id").notNull(),
-	environment: environmentEnum("environment").notNull(),
-	key: text("key").notNull(),
-	enabled: boolean("enabled").notNull(),
-	createdAt: createdAt(),
-	updatedAt: updatedAt()
-}, (table) => [primaryKey({ columns: [
-	table.orgId,
-	table.environment,
-	table.key
-] })]);
 
 //#endregion
 //#region ../../packages/db/src/schema/org-settings.ts
 /**
-* Per-org settings: what is shared across both environments. A row exists
-* only once something has been set: no row means every default applies,
-* which readers fill in (same convention as journey_states). That keeps a
-* fresh org zero-config and keeps the write path from having to seed rows
-* it does not own.
+* The ingestion policy for catalog governance. Single source of truth:
+* @cowliss/shared/governance derives INGESTION_POLICIES from
+* ingestionPolicyEnum.enumValues, so the enum and the settings contract
+* cannot drift.
+*/
+const ingestionPolicyEnum = pgEnum("ingestion_policy", ["permissive", "strict"]);
+/**
+* Per-org settings. A row exists only once something has been set: no row
+* means every default applies, which readers fill in (same convention as
+* journey_states). That keeps a fresh org zero-config and keeps the write
+* path from having to seed rows it does not own.
 *
-* The per-environment settings (ingestion policy, event retention) live in
-* environment_settings; this row holds the org-wide facts: the sending
-* kill switch, the allowance override, and Clerk's cached profile.
+* Every value here is the organization's:
+* the ingestion policy, the event retention window, the sending kill
+* switch, the allowance override, and Clerk's cached profile.
 *
 * `slug` and `name` are the exception to "only what Cowliss owns": they are
 * Clerk's, cached here by the API's org-sync middleware because the worker
@@ -3967,6 +3829,21 @@ const orgSettings = pgTable("org_settings", {
 	slug: text("slug"),
 	name: text("name"),
 	/**
+	* Catalog governance: permissive accepts quarantined (unclassified) names
+	* and observes them; strict routes them to the review queue instead of
+	* applying them. One policy for the organization, applied to every write.
+	*/
+	ingestionPolicy: ingestionPolicyEnum("ingestion_policy").notNull().default("permissive"),
+	/**
+	* The ClickHouse TTL window for the org's events, in days. Null means the
+	* default (18 months, EVENT_RETENTION_DAYS.production in
+	* packages/shared); there is no "forever", and the API refuses a value
+	* above that cap. Development events are trimmed at the shorter
+	* development cap whatever this says: the rule is
+	* `effectiveRetentionDays` in packages/shared.
+	*/
+	eventRetentionDays: integer("event_retention_days"),
+	/**
 	* The operator-set monthly free allowance override, in micro-dollars,
 	* synced from the Clerk org's `publicMetadata.freeAllowanceMicros` by the
 	* same org-sync read that caches slug and name. Null (the default) means
@@ -4019,8 +3896,7 @@ const insertOrgSettingsSchema = createInsertSchema(orgSettings);
 /**
 * An org's cow project: the folder a developer runs `cow init` in, and the
 * thing pushes belong to. An org may hold several, one per repo, each with
-* its own release sequence, its own current release per environment, and its
-* own slice of the deployed journey rows. The name is how `cow.json` picks
+* its own release sequence and its own slice of the deployed journey rows. The name is how `cow.json` picks
 * one, so it is unique within the org.
 */
 const projects = pgTable("projects", {
@@ -4086,14 +3962,12 @@ const pushArtifacts = pgTable("push_artifacts", {
 //#endregion
 //#region ../../packages/db/src/schema/violations.ts
 /**
-* Violations: one row per (orgId, environment, kind, name) observed in
-* ingestion that the tracking plan catalog does not define. Observe and
-* flag, never reject: the payload is always written, the violation only
-* records the governance gap. The catalog is org-wide; the sightings are
-* per environment, so a name a dev box invented never shows up as a
-* production violation.
+* Violations: one row per (orgId, kind, name) observed in ingestion that
+* the tracking plan catalog does not define. Observe and flag, never
+* reject: the payload is always written, the violation only records the
+* governance gap.
 *
-* Uniqueness on (orgId, environment, kind, name) dedupes repeat sightings:
+* Uniqueness on (orgId, kind, name) dedupes repeat sightings:
 * an unknown event fired a thousand times is one open violation whose
 * lastSeenAt keeps bumping, not a thousand rows. The payload captures the first observed shape
 * (inferred property types for events, inferred type for traits) so resolve
@@ -4111,7 +3985,6 @@ const violationStatusEnum = pgEnum("violation_status", [
 const violations$1 = pgTable("violations", {
 	id: text("id").primaryKey(),
 	orgId: text("org_id").notNull(),
-	environment: environmentEnum("environment").notNull(),
 	kind: violationKindEnum("kind").notNull(),
 	name: text("name").notNull(),
 	payload: jsonb("payload").$type().notNull(),
@@ -4136,7 +4009,7 @@ const violations$1 = pgTable("violations", {
 		mode: "date",
 		precision: 3
 	})
-}, (table) => [index("violations_org_id_environment_idx").on(table.orgId, table.environment), uniqueIndex("violations_org_env_kind_name_unique").on(table.orgId, table.environment, table.kind, table.name)]);
+}, (table) => [index("violations_org_id_idx").on(table.orgId), uniqueIndex("violations_org_kind_name_unique").on(table.orgId, table.kind, table.name)]);
 const selectViolationSchema = createSelectSchema(violations$1);
 const insertViolationSchema = createInsertSchema(violations$1);
 
@@ -4145,7 +4018,6 @@ const insertViolationSchema = createInsertSchema(violations$1);
 const quarantineEntries = pgTable("quarantine_entries", {
 	id: text("id").primaryKey(),
 	orgId: text("org_id").notNull(),
-	environment: environmentEnum("environment").notNull(),
 	kind: violationKindEnum("kind").notNull(),
 	name: text("name").notNull(),
 	appId: text("app_id").notNull(),
@@ -4159,7 +4031,7 @@ const quarantineEntries = pgTable("quarantine_entries", {
 	}).notNull(),
 	createdAt: createdAt(),
 	updatedAt: updatedAt()
-}, (table) => [index("quarantine_entries_org_kind_name_idx").on(table.orgId, table.kind, table.name), index("quarantine_entries_org_env_created_idx").on(table.orgId, table.environment, table.createdAt)]);
+}, (table) => [index("quarantine_entries_org_kind_name_idx").on(table.orgId, table.kind, table.name), index("quarantine_entries_org_created_idx").on(table.orgId, table.createdAt)]);
 const selectQuarantineEntrySchema = createSelectSchema(quarantineEntries);
 const insertQuarantineEntrySchema = createInsertSchema(quarantineEntries);
 
@@ -4170,10 +4042,6 @@ const insertQuarantineEntrySchema = createInsertSchema(quarantineEntries);
 * never hand-maintained: the engine in packages/segments recomputes on every
 * write and materializes the result into segment_members.
 *
-* The definition is shared by the org's environments and declares which of
-* them it works on: `environments` defaults to both, and the recompute
-* evaluates a definition only for profiles in a declared environment.
-*
 * Timestamps use millisecond precision, same rationale as apps: JS Dates
 * carry ms only and cursor pagination compares createdAt for equality.
 */
@@ -4183,18 +4051,14 @@ const segments$1 = pgTable("segments", {
 	name: text("name").notNull(),
 	description: text("description"),
 	definition: jsonb("definition").$type().notNull(),
-	/** The environments this definition works on; the enum is the check. */
-	environments: environmentEnum("environments").array().notNull().default(["development", "production"]),
 	createdAt: createdAt(),
 	updatedAt: updatedAt()
 }, (table) => [index("segments_org_id_idx").on(table.orgId), uniqueIndex("segments_org_id_name_unique").on(table.orgId, table.name)]);
 /**
-* Materialized membership: one row per (segment, environment, profile)
-* currently in the segment. Deleting a segment drops its members with it,
-* and erasing a profile drops its memberships, so neither can leave orphaned
-* membership behind. A definition is shared by the environments it declares,
-* so the environment is part of the key: dropping an environment from a
-* definition drops that environment's rows and leaves the other's standing.
+* Materialized membership: one row per (segment, profile) currently in the
+* segment. Deleting a segment drops its members with it, and erasing a
+* profile drops its memberships, so neither can leave orphaned membership
+* behind.
 *
 * The (orgId, profileId) index is the recompute lookup: every write asks
 * "which of this org's segments does this profile currently belong to?"
@@ -4203,19 +4067,13 @@ const segments$1 = pgTable("segments", {
 const segmentMembers = pgTable("segment_members", {
 	segmentId: text("segment_id").notNull().references(() => segments$1.id, { onDelete: "cascade" }),
 	orgId: text("org_id").notNull(),
-	/** The member profile's environment; always the profile's own. */
-	environment: environmentEnum("environment").notNull(),
 	profileId: text("profile_id").notNull().references(() => profiles.id, { onDelete: "cascade" }),
 	enteredAt: timestamp("entered_at", {
 		withTimezone: true,
 		mode: "date",
 		precision: 3
 	}).notNull().defaultNow()
-}, (table) => [primaryKey({ columns: [
-	table.segmentId,
-	table.environment,
-	table.profileId
-] }), index("segment_members_org_id_profile_id_idx").on(table.orgId, table.profileId)]);
+}, (table) => [primaryKey({ columns: [table.segmentId, table.profileId] }), index("segment_members_org_id_profile_id_idx").on(table.orgId, table.profileId)]);
 const selectSegmentSchema = createSelectSchema(segments$1);
 const insertSegmentSchema = createInsertSchema(segments$1);
 
@@ -4287,14 +4145,14 @@ const insertSenderDomainSchema = createInsertSchema(senderDomains);
 * source is a way data reaches it, so "App A via Clerk" and "App A via the
 * SDK" land on the same app and therefore on the same profiles.
 *
-* Every app has exactly one source of kind `api`, the first-party SDK and
-* HTTP path, created with the app. It has an empty config and no credential,
-* and archiving it is the app's ingestion kill switch. Provider kinds sit
-* beside it.
+* Every app has one source of kind `api`, the first-party SDK and HTTP
+* path, created with the app. It has an empty config and no credential, and
+* archiving it is that app's ingestion kill switch. Provider kinds sit
+* beside it, singleton per app.
 *
 * `config` holds the per-kind source configuration and `signingSecret` the
 * credential of the one kind that has one today (Clerk's webhook signing
-* secret), stored write-only (the destinations show-once pattern: never on a
+* secret), stored write-only (the webhooks show-once pattern: never on a
 * DTO). `kind` is immutable after creation; the webhook route dispatches on
 * it. `lastReceivedAt` is stamped per accepted delivery so the dashboard can
 * tell a wired-up source from a silent one.
@@ -4529,20 +4387,44 @@ const selectWalletTopupSchema = createSelectSchema(walletTopups);
 const insertWalletTopupSchema = createInsertSchema(walletTopups);
 
 //#endregion
-//#region ../../packages/shared/src/environments.ts
+//#region ../../packages/db/src/schema/webhooks.ts
 /**
-* The environment on the wire: the source's `environment` field, the
-* `X-Cow-Environment` header admin calls select with, and the
-* `environment` column every per-environment DTO carries.
-*/
-const environmentSchema = z.enum(ENVIRONMENTS);
-/**
-* The environments a shared definition (a segment, a journey) declares it
-* works on: a non-empty list of distinct values. A definition declaring none
-* would be dead code with a row behind it, and a repeated value is a typo
-* rather than an intent, which is the rule `defineJourney` applies too.
+* Webhooks: named URLs that journeys POST to by name. A webhook is the
+* organization's: the name is unique per org, and a journey step naming
+* `webhook("crm")` resolves to the same row for every execution. A developer
+* who wants a local receiver creates a second webhook under another name.
+* Ms-precision timestamps, as everywhere, so a cursor round-trips.
+*
+* WEBHOOK_PAYLOAD_VERSION (packages/shared) pins the webhook payload shape;
+* the column records the version each webhook was created against.
+* signingSecret is the Standard Webhooks signing secret, generated at
+* creation and shown once — the API DTO omits it after the create response.
 */
-const environmentsSchema = z.array(environmentSchema).min(1, "at least one environment is required").refine((values) => new Set(values).size === values.length, { message: "environments must not repeat" });
+const webhooks$1 = pgTable("webhooks", {
+	id: text("id").primaryKey(),
+	orgId: text("org_id").notNull(),
+	name: text("name").notNull(),
+	config: jsonb("config").$type().notNull(),
+	webhookPayloadVersion: integer("webhook_payload_version").notNull().default(1),
+	signingSecret: text("signing_secret"),
+	/**
+	* Auto-disable state, mirroring how receivers treat us: the webhook send
+	* activity bumps the counter once per failed delivery attempt (not once
+	* per Temporal retry) and stamps disabledAt at the threshold. A disabled
+	* webhook records `skipped_disabled` until an admin clears it; a
+	* successful delivery resets the counter.
+	*/
+	consecutiveFailures: integer("consecutive_failures").notNull().default(0),
+	disabledAt: timestamp("disabled_at", {
+		withTimezone: true,
+		mode: "date",
+		precision: 3
+	}),
+	createdAt: createdAt(),
+	updatedAt: updatedAt()
+}, (table) => [index("webhooks_org_id_idx").on(table.orgId), uniqueIndex("webhooks_org_id_name_unique").on(table.orgId, table.name)]);
+const selectWebhookSchema = createSelectSchema(webhooks$1);
+const insertWebhookSchema = createInsertSchema(webhooks$1);
 
 //#endregion
 //#region ../../packages/shared/src/apps.ts
@@ -4553,10 +4435,10 @@ const environmentsSchema = z.array(environmentSchema).min(1, "at least one envir
 * JSON.stringify already emits it for Date values.
 *
 * An app is the attribution unit and nothing else: it carries no kind, no
-* config, and no credential. It belongs to one environment, chosen at
-* creation and immutable. The two extra fields are read-model facts about
-* its sources (see sources.ts), which is what the dashboard's list needs to
-* say whether an app has a pipe wired up without a request per card.
+* config and no credential (its sources carry those, see
+* sources.ts). The two extra fields are read-model facts about those
+* sources, which is what the dashboard's list needs to say whether an app
+* has a pipe wired up without a request per card.
 */
 const appSchema = selectAppSchema.extend({
 	createdAt: z.iso.datetime(),
@@ -4568,11 +4450,7 @@ const appSchema = selectAppSchema.extend({
 	lastReceivedAt: z.iso.datetime().nullable()
 });
 const nameSchema$2 = z.string().trim().min(1, "name is required").max(100, "name must be at most 100 characters");
-const createAppBodySchema = z.object({ data: z.object({
-	name: nameSchema$2,
-	/** Immutable after creation; production when omitted. */
-	environment: environmentSchema.default("production")
-}) });
+const createAppBodySchema = z.object({ data: z.object({ name: nameSchema$2 }) });
 const updateAppBodySchema = z.object({ data: z.object({
 	name: nameSchema$2.optional(),
 	status: z.literal("archived").optional()
@@ -4769,15 +4647,44 @@ const triggerSchema = z.union([z.strictObject({
 	appId: patternSchema.optional()
 }), z.strictObject({ segment: z.string().min(1) })]);
 /**
-* A destination's name: the token a journey addresses it by, in a
-* `send.webhook` call or a journey's `senderIdentity`.
-*
-* Defined here rather than beside the destinations contract, and imported
-* from here by it, because a journey manifest names one and the guest layer
-* is bundled into every tenant module: importing it the other way round
-* would pull the Drizzle destinations table into all of them.
+* The address half of a from-header: a local part, an `@`, and a dotted
+* domain. Deliberately narrower than RFC 5322 (no quoted local parts, no
+* address literals): every character it refuses would have to be quoted or
+* escaped to survive a header, and none of them belong in an address a
+* journey sends from.
+*/
+const FROM_ADDRESS = /^[^\s@<>",;]+@([^\s@<>",;.]+(?:\.[^\s@<>",;.]+)+)$/;
+/**
+* Parse a journey's or a send's `from`: `addr@domain`, or
+* `Name <addr@domain>` with the name optionally quoted. Null when it is
+* neither, which is what `cow build` refuses on and what the send-time
+* domain gate turns into a skip.
+*
+* One parser, and the send facade reuses it. A control character anywhere is
+* a refusal rather than something to strip: it survives quoting and would
+* inject a second header.
+*/
+function parseFromAddress(from) {
+	const text = from.trim();
+	if (/\p{Cc}/u.test(text)) return null;
+	const angled = /^(.*?)\s*<([^<>]*)>$/.exec(text);
+	const address = (angled?.[2] ?? text).trim();
+	const domain = FROM_ADDRESS.exec(address)?.[1];
+	if (!domain) return null;
+	const name = (angled?.[1] ?? "").trim().replace(/^"(.*)"$/s, "$1").replace(/\\(.)/g, "$1").trim();
+	return {
+		...name ? { name } : {},
+		address,
+		domain: domain.toLowerCase()
+	};
+}
+/**
+* The address a journey or one send leaves as: a string, not the name of a
+* configured row (ADR 0014). The domain is checked against the
+* organization's verified ones at push time and again at send time; the
+* shape is all that is checked here, because it is all a build can know.
 */
-const destinationNameSchema = z.string().trim().min(1, "name is required").max(100, "name must be at most 100 characters");
+const fromSchema = z.string().trim().max(200, "from must be at most 200 characters").refine((value) => parseFromAddress(value) !== null, { message: "from must be an address (\"billing@acme.com\") or a name and address (\"Billing <billing@acme.com>\")" });
 /** A content address: `sha256:` plus the lowercase hex digest. */
 const digestSchema = z.string().regex(/^sha256:[0-9a-f]{64}$/, "digest must be sha256:<64 hex>");
 /**
@@ -4813,13 +4720,6 @@ const SPINE_ENTRY_NAMES = [
 const spineEntrySchema = z.object({
 	name: z.enum(SPINE_ENTRY_NAMES),
 	detail: z.string().max(200).optional(),
-	/**
-	* The sender identity a `send.email` call named for itself, overriding
-	* the journey's own. Present only when the author wrote one on the call,
-	* which is what lets the deploy warning and the journey detail page name
-	* the override without re-reading the code.
-	*/
-	senderIdentity: z.string().max(100).optional(),
 	/** A `waitForEvent` timeout, as the author wrote it. */
 	timeout: z.string().max(50).optional(),
 	get steps() {
@@ -4831,10 +4731,10 @@ const spineEntrySchema = z.object({
 }).meta({ id: "JourneySpineEntry" });
 /**
 * One journey in a stored manifest. A plain (non-strict) object on purpose:
-* a manifest pushed before the author's rollout gate went away still carries
-* `environments`, and every stored manifest has to keep parsing for good
-* (ADR 0011). Zod strips the key, and the journey runs wherever the
-* per-environment enabled flag says it runs, which is the one gate there is.
+* a manifest pushed before the author's rollout gate went away still
+* carries keys that no longer exist, and every stored manifest has to keep
+* parsing for good (ADR 0011). Zod strips them, and the journey runs when
+* its `enabled` flag says so, which is the one gate there is.
 */
 const manifestJourneySchema = z.object({
 	key: journeyKeySchema,
@@ -4848,16 +4748,12 @@ const manifestJourneySchema = z.object({
 	*/
 	purpose: consentPurposeKeySchema,
 	/**
-	* The sender identity every `send.email` in this journey goes out as,
-	* unless the call names its own. A name, never a `dst_` id: an org has one
-	* row per environment, so an id would send in production and fail in
-	* development, which is the one thing a journey must not do.
-	*
-	* Optional here and required at `defineJourney`, exactly like `purposes`: a
-	* version pushed before the field existed carries none and its stored
-	* manifest still parses. The author's build is where the error is useful.
+	* The address every `send.email` in this journey goes out as, unless the
+	* call names its own. Optional everywhere: an omitted one is the
+	* organization's shared fallback address, which is what makes day-one
+	* sending zero-config (ADR 0014).
 	*/
-	senderIdentity: destinationNameSchema.optional(),
+	from: fromSchema.optional(),
 	spine: z.array(spineEntrySchema),
 	bundle: digestSchema
 });
@@ -4934,7 +4830,7 @@ const versionManifestSchema = z.union([manifestJourneySchema, manifestTemplateSc
 * further in the future than the clock-skew tolerance (the spec's "future
 * timestamps are rejected with 422" rule). Absent stays valid. Used by the
 * track and identify payload schemas; older-than-retention is a service
-* check (withinRetention) because the window is per environment.
+* check (withinRetention) because the window is the org's setting.
 */
 function notFutureTimestamp(value) {
 	if (value === void 0) return true;
@@ -5015,7 +4911,6 @@ const identifyBodySchema = z.object({ data: identifyDataSchema });
 const eventDtoSchema = z.object({
 	id: z.string(),
 	orgId: z.string(),
-	environment: environmentSchema,
 	/** The app the event is attributed to: derived from the source. */
 	appId: z.string(),
 	/** The pipe it arrived through: what the caller named on the wire. */
@@ -5052,11 +4947,10 @@ const trackDataSchema = trackFieldsSchema.refine((data) => notFutureTimestamp(da
 });
 const trackBodySchema = z.object({ data: trackDataSchema });
 /**
-* Environment-wide event feed query (GET /v1/events). Same opaque cursor as
+* The org-wide event feed query (GET /v1/events). Same opaque cursor as
 * every other list; the sort key is the event timestamp, newest first, so
 * the cursor's sortAt slot carries an event timestamp here. appId, sourceId
-* and event are exact-match filters, all optional. The environment comes
-* from the selection header, never from the query.
+* and event are exact-match filters, all optional.
 *
 * This is the one place a pipe id is a filter: unlike a stored segment
 * definition, a query param is read-time state, so a stale `?sourceId=` is a
@@ -5076,8 +4970,8 @@ const listEventsQuerySchema = paginationQuerySchema.extend({
 	profileId: z.string().trim().min(1).max(200).optional()
 });
 /**
-* Event stats (GET /v1/events/stats) for the selected environment, the
-* overview page's volume chart and per-app breakdown. `volume` is
+* Event stats (GET /v1/events/stats): the overview page's volume chart and
+* per-app breakdown. `volume` is
 * zero-filled per UTC day over the whole `days` window ending today, so the
 * chart gets a continuous time axis; `byApp` is sorted busiest-first with
 * app names joined in.
@@ -5097,8 +4991,8 @@ const eventStatsDtoSchema = z.object({
 	}))
 });
 /**
-* Per-name activity (GET /v1/events/stats/names) for the selected
-* environment: what the event catalog shows beside each entry. `count` is
+* Per-name activity (GET /v1/events/stats/names): what the event catalog
+* shows beside each entry. `count` is
 * windowed over `days`; `lastSeenAt` is not windowed and is null only for a
 * name that has never been seen, so "quiet for two months" reads as a zero
 * count next to a real date rather than as no history.
@@ -5124,7 +5018,7 @@ const eventNameStatsDtoSchema = z.object({
 * API in one request instead of thousands of round trips.
 *
 * A batch names one source for every item, `{ sourceId, items }`, so it
-* never spans apps and therefore never spans environments. Each item is one
+* never spans apps. Each item is one
 * flattened identify or track call tagged by `type`; the field schemas are
 * the single-call ones minus `sourceId`, so an item valid here is valid
 * there. Batch writes are QUIET in one sense: they skip raw-event journey
@@ -5427,8 +5321,11 @@ const listConsentPurposesQuerySchema = paginationQuerySchema;
 */
 const DELIVERY_CHANNELS = deliveryChannelEnum.enumValues;
 const DELIVERY_STATUSES = deliveryStatusEnum.enumValues;
+/** Why a send happened: a journey ran, a member tested, or a caller sent. */
+const DELIVERY_KINDS = deliveryKindEnum.enumValues;
 const deliveryStatusSchema = z.enum(DELIVERY_STATUSES);
 const deliveryChannelSchema = z.enum(DELIVERY_CHANNELS);
+const deliveryKindSchema = z.enum(DELIVERY_KINDS);
 /**
 * The SNS HTTPS envelope, common to every message SNS POSTs to the feedback
 * endpoint. `Message` is a JSON STRING (the SES event for a `Notification`,
@@ -5528,18 +5425,45 @@ const deliverySchema = selectDeliverySchema.omit({
 	settledAt: z.iso.datetime().nullable()
 });
 /**
-* The message a dry run or a development capture rendered, stored under
-* `payload.rendered` beside the template data. A real send carries no
-* rendering: SES got it, and the log does not keep a second copy.
+* The message a dry run rendered, stored under `payload.rendered` beside the
+* template data, so a developer can read what would have gone out. A real
+* send carries no rendering: SES got it, and the log does not keep a second
+* copy.
 */
 const renderedEmailSchema = z.object({
 	subject: z.string(),
 	html: z.string(),
-	text: z.string()
+	text: z.string(),
+	/**
+	* Where a reply would have gone, when the send named one. Absent on a
+	* test send and wherever none was named, which is replies going to the
+	* from-address.
+	*/
+	replyTo: z.email().optional()
 });
 /** One delivery with the payload the send rendered (GET /v1/deliveries/:id). */
 const deliveryDetailSchema = deliverySchema.extend({ payload: z.object({ rendered: renderedEmailSchema.optional() }).catchall(z.unknown()) });
 /**
+* The `payload` a delivery of kind `api` carries: the envelope the caller of
+* the send facade wrote, and never the bodies (ADR 0014). Every field is
+* optional because the caller named only some of them, and the row is read
+* back through this rather than cast, so a row written by an older shape
+* reads as a message with fields missing instead of one with a type nobody
+* checked.
+*/
+const apiDeliveryPayloadSchema = z.object({
+	from: z.string().optional(),
+	to: z.array(z.string()).optional(),
+	cc: z.array(z.string()).optional(),
+	bcc: z.array(z.string()).optional(),
+	reply_to: z.array(z.string()).optional(),
+	subject: z.string().optional(),
+	headers: z.record(z.string(), z.string()).optional(),
+	/** The template key that wrote the message, and the props it took. */
+	template: z.string().optional(),
+	variables: z.record(z.string(), z.unknown()).optional()
+});
+/**
 * List query for the deliveries log. Every filter is exact-match and
 * optional; combining them ANDs them.
 *
@@ -5553,113 +5477,29 @@ const listDeliveriesQuerySchema = paginationQuerySchema.extend({
 	direction: sortDirectionSchema.default("desc"),
 	status: deliveryStatusSchema.optional(),
 	journey: z.string().trim().min(1).max(200).optional(),
-	/** The template or destination this attempt was for; a template page's own log. */
+	/** The template or webhook this attempt was for; a template page's own log. */
 	step: z.string().trim().min(1).max(200).optional(),
 	channel: deliveryChannelSchema.optional(),
+	/** Why the send happened: a journey, a test send, or a direct API send. */
+	kind: deliveryKindSchema.optional(),
 	appId: z.string().trim().min(1).max(200).optional(),
 	/** One person's deliveries, merged ids included, same as the event feed. */
 	profileId: z.string().trim().min(1).max(200).optional(),
 	/**
 	* Only deliveries touched at or after this instant, by `updatedAt`: the
-	* cursor a tail (`cow dev`) polls with, so a captured send and its later
-	* feedback transition both arrive. Inclusive for the same reason as the
-	* execution filter, and paged the same way: `createdAt` still orders the
-	* page, this only narrows it.
+	* cursor a tail (`cow dev`) polls with, so a send and its later feedback
+	* transition both arrive. Inclusive for the same reason as the execution
+	* filter, and paged the same way: `createdAt` still orders the page, this
+	* only narrows it.
 	*/
 	since: z.iso.datetime().optional()
 });
 
-//#endregion
-//#region ../../packages/shared/src/destinations.ts
-/**
-* Destinations API contracts. Derived from the Drizzle table via drizzle-zod.
-* signingSecret is deliberately absent from the DTO: it is shown exactly
-* once, in the create response (destinationCreatedSchema). consecutiveFailures
-* is absent too: it is the auto-disable counter's internal state, and
-* disabledAt is the part the dashboard banner needs.
-*
-* A destination belongs to one environment, chosen at creation and
-* immutable like a source's, and names are unique per org and environment,
-* so the same name points at a different receiver in each.
-*/
-const destinationSchema = selectDestinationSchema.extend({
-	createdAt: z.iso.datetime(),
-	updatedAt: z.iso.datetime(),
-	disabledAt: z.iso.datetime().nullable()
-}).omit({
-	signingSecret: true,
-	consecutiveFailures: true
-});
-/** The two kinds of destination, from the table's own enum. */
-const destinationTypeSchema = destinationSchema.shape.type;
-const destinationCreatedSchema = destinationSchema.extend({ signingSecret: z.string().optional() });
-const webhookConfigSchema = z.object({ url: z.url("config.url must be a valid URL").refine((url) => {
-	try {
-		return ["http:", "https:"].includes(new URL(url).protocol);
-	} catch {
-		return false;
-	}
-}, { message: "config.url must use http or https" }) });
-/**
-* The address shape only. WHICH domain is allowed is not a static fact: it
-* is the shared fallback domain or one this org has verified, which needs a
-* database read, so the rule lives in the destinations service (write time)
-* and the send gate (send time) instead of here.
-*/
-const senderIdentityConfigSchema = z.object({
-	fromName: z.string().trim().min(1, "config.fromName is required").max(100).refine((name) => !/\p{Cc}/u.test(name), { message: "config.fromName must not contain control characters" }),
-	fromEmail: z.email("config.fromEmail must be a valid email address")
-});
-/**
-* The two destination shapes, named individually so the dashboard's create
-* and edit forms can resolve against exactly one of them. A form knows its
-* type before the user types anything, and zodResolver over a member is
-* what gives react-hook-form a non-union field path to register.
-*/
-const webhookDestinationInputSchema = z.object({
-	name: destinationNameSchema,
-	/** The environment this destination lives in; immutable after creation. */
-	environment: environmentSchema,
-	type: z.literal("webhook"),
-	config: webhookConfigSchema
-});
-const senderIdentityDestinationInputSchema = z.object({
-	name: destinationNameSchema,
-	/** The environment this destination lives in; immutable after creation. */
-	environment: environmentSchema,
-	type: z.literal("sender_identity"),
-	config: senderIdentityConfigSchema
-});
-const createDestinationBodySchema = z.object({ data: z.discriminatedUnion("type", [webhookDestinationInputSchema, senderIdentityDestinationInputSchema]) });
-/**
-* Destination update. `enabled` is the admin's half of the auto-disable
-* loop: the webhook send activity stamps `disabledAt` after enough
-* consecutive failures and every send after that records `skipped_disabled`,
-* so without a way to clear it the only exit would be deleting the
-* destination, which throws away the signing secret the receiver is
-* configured with. `enabled: true` clears the stamp and the failure counter;
-* `enabled: false` is the same switch operated by hand.
-*/
-const updateDestinationBodySchema = z.object({ data: z.object({
-	name: destinationNameSchema.optional(),
-	config: z.unknown().optional(),
-	enabled: z.boolean().optional()
-}).refine((data) => data.name !== void 0 || data.config !== void 0 || data.enabled !== void 0, { message: "at least one field (name, config, or enabled) is required" }) });
-/**
-* `q` is a substring search over the destination's name; `type` narrows to
-* one kind, because the webhooks page and the sender identities section on
-* the domains page each want one and the table holds both.
-*/
-const listDestinationsQuerySchema = paginationQuerySchema.extend({
-	q: searchQuerySchema,
-	type: destinationTypeSchema.optional()
-});
-
 //#endregion
 //#region ../../packages/shared/src/domains.ts
 /**
 * Sending-domain contracts. Derived from the Drizzle table so the row and
-* the DTO cannot drift, same as deliveries, destinations, and suppressions.
+* the DTO cannot drift, same as deliveries, webhooks, and suppressions.
 *
 * Verification itself is SES's; everything here describes the claim and the
 * mirrored answer.
@@ -5715,20 +5555,6 @@ const domainDnsSetupSchema = z.object({
 	provider: z.string().nullable()
 });
 
-//#endregion
-//#region ../../packages/shared/src/enabled.ts
-/**
-* The enable flag per environment; absent rows read as off (ADR 0011).
-*
-* Its own module because both `journeys.ts` and `pushes.ts` need it and
-* neither may import the other: a journey carries the flag, and so does the
-* project status a push is read back through.
-*/
-const journeyEnabledSchema = z.object({
-	development: z.boolean(),
-	production: z.boolean()
-});
-
 //#endregion
 //#region ../../packages/shared/src/patterns.ts
 /**
@@ -5856,8 +5682,8 @@ const properties = z.record(z.string(), z.unknown());
 * them. A name outside the union is rejected, never dispatched.
 *
 * Every `args` is strict, and that is the tenancy boundary made mechanical:
-* a module that returns an `orgId`, an `environment`, or any other field
-* beside the ones a capability takes fails the parse instead of having it
+* a module that returns an `orgId` or any other field beside the ones a
+* capability takes fails the parse instead of having it
 * quietly dropped. Tenant context comes from the workflow input, never from
 * guest output, and this is where saying so becomes checkable.
 */
@@ -5879,12 +5705,14 @@ const commandSchema = z.discriminatedUnion("name", [
 			template: journeyKeySchema,
 			props: properties,
 			/**
-			* Which sender identity this mail leaves as, by name. Required, and
-			* the guest SDK fills in the journey's own when the call does not name
-			* one, so the host has one resolution path and never has to read the
-			* manifest to find a sender.
+			* The address this mail leaves as. The guest SDK fills in the
+			* journey's own whenever the call does not name one, so the host has
+			* one resolution path and never reads the manifest to find it;
+			* absent on both is the organization's shared fallback address.
 			*/
-			senderIdentity: destinationNameSchema
+			from: fromSchema.optional(),
+			/** Where a reply to this one mail goes, instead of the from-address. */
+			replyTo: z.email().optional()
 		})
 	}),
 	z.object({
@@ -5965,7 +5793,7 @@ const executionLimitsSchema = z.object({
 	logLineBytes: z.number().int().positive()
 });
 const journeyStepInputSchema = z.object({
-	protocol: z.literal(2),
+	protocol: z.literal(3),
 	kind: z.literal("journey"),
 	key: journeyKeySchema,
 	event: guestEventSchema,
@@ -6005,7 +5833,7 @@ const journeyStepOutputSchema = z.discriminatedUnion("status", [
 	})
 ]);
 const templateRenderInputSchema = z.object({
-	protocol: z.literal(2),
+	protocol: z.literal(3),
 	kind: z.literal("template"),
 	key: journeyKeySchema,
 	props: properties
@@ -6024,7 +5852,7 @@ const manifestInputSchema = z.object({ kind: z.literal("manifest") });
 const manifestOutputSchema = z.discriminatedUnion("kind", [manifestJourneySchema.pick({
 	trigger: true,
 	purpose: true,
-	senderIdentity: true,
+	from: true,
 	tags: true
 }).extend({ kind: z.literal("journey") }), manifestTemplateSchema.pick({
 	sendClass: true,
@@ -6088,7 +5916,7 @@ const executionDetailSchema = executionSchema.extend({
 	logs: z.array(executionLogSchema)
 });
 const listExecutionsQuerySchema = paginationQuerySchema.extend({
-	/** A journey key; the environment comes from the selection header. */
+	/** A journey key. */
 	journey: z.string().trim().min(1).max(200).optional(),
 	/** One version's own runs, for the history rows on a journey. */
 	version: z.string().trim().min(1).max(200).optional(),
@@ -6104,12 +5932,15 @@ const listExecutionsQuerySchema = paginationQuerySchema.extend({
 	since: z.iso.datetime().optional()
 });
 /**
-* What to stop: every live execution of one journey in the selected
-* environment, or the ones still pinned to one version. Cancelling is
-* explicit and per environment (ADR 0011): disabling a journey stops new
-* entries and lets what is running finish, and this is the other verb.
+* What to stop: every live execution of one journey, or the ones still
+* pinned to one version. Cancelling is explicit (ADR 0011): disabling a
+* journey stops new entries and lets what is running finish, and this is
+* the other verb.
 */
-const cancelExecutionsBodySchema = z.object({ data: z.union([z.object({ journey: z.string().trim().min(1).max(200) }), z.object({ version: z.string().trim().min(1).max(200) })]) });
+const cancelExecutionsBodySchema = z.object({ data: z.object({
+	journey: z.string().trim().min(1).max(200).optional(),
+	version: z.string().trim().min(1).max(200).optional()
+}).refine((data) => data.journey === void 0 !== (data.version === void 0), { message: "name a journey or a version, not both" }) });
 /**
 * Cancelling is a request, not an edit: each execution stops when it reaches
 * its next step, so the answer is that the sweep is under way rather than a
@@ -6127,9 +5958,8 @@ const cancellingSchema = z.object({ cancelling: z.literal(true) });
 const projectNameSchema = z.string().trim().min(1).max(200);
 /**
 * `cow.json` (spec: Project layout): the org, and which of its projects this
-* directory is. The environment is always a flag, and auth never lives in
-* the project. Strict, so a typo'd key is a build error rather than a
-* silently ignored setting.
+* directory is. Auth never lives in the project. Strict, so a typo'd key
+* is a build error rather than a silently ignored setting.
 */
 const cowConfigSchema = z.strictObject({
 	$schema: z.url().optional(),
@@ -6238,7 +6068,7 @@ const createPushBodySchema = z.object({ data: z.object({
 	* is a live CLI talking to a live platform, so a mismatch here is a 422
 	* the developer fixes by updating `@cowliss/cli`, and nothing is stored.
 	*/
-	manifest: manifestSchema.safeExtend({ protocol: z.literal(2) }),
+	manifest: manifestSchema.safeExtend({ protocol: z.literal(3) }),
 	/** The `cow.json` project this push belongs to. */
 	project: projectNameSchema
 }) });
@@ -6270,13 +6100,10 @@ const projectStatusKeySchema = z.object({
 	* server holds. Null only for a journey whose versions are all pruned.
 	*/
 	latestVersion: versionSchema.nullable(),
-	/** The flag per environment; null on a template, which has none. */
-	enabled: journeyEnabledSchema.nullable(),
-	/** Executions still running or waiting, per environment. */
-	liveExecutions: z.object({
-		development: z.number().int(),
-		production: z.number().int()
-	})
+	/** The journey's one flag; null on a template, which has none. */
+	enabled: z.boolean().nullable(),
+	/** Executions still running or waiting. */
+	liveExecutions: z.number().int()
 });
 /**
 * Everything the server knows about one project's keys, in one read: the
@@ -6285,17 +6112,14 @@ const projectStatusKeySchema = z.object({
 * is my project doing" is useless split across cursors.
 *
 * `warnings` is what a deploy used to answer with (ADR 0011 retired the
-* deploy): a name a journey references that the environment does not define
-* yet. They never block, because a segment or a destination may be created
+* deploy): a name a journey references that the organization does not
+* define yet. They never block, because a segment or a webhook may be created
 * right after a push.
 */
 const projectStatusSchema = z.object({
 	project: projectNameSchema,
 	keys: z.array(projectStatusKeySchema),
-	warnings: z.object({
-		development: z.array(z.string()),
-		production: z.array(z.string())
-	})
+	warnings: z.array(z.string())
 });
 
 //#endregion
@@ -6307,11 +6131,7 @@ const projectStatusSchema = z.object({
 *
 * Derived from the Drizzle table via drizzle-zod so the wire DTO and the row
 * share one source of truth; the jsonb columns get explicit wire schemas
-* because the row types are opaque to drizzle-zod. `enabled` is not a
-* column: it is the journey_states value per environment, absent meaning
-* off, and both environments are reported whichever one the caller selected,
-* because "is this on in production?" is the question the list exists to
-* answer.
+* because the row types are opaque to drizzle-zod.
 */
 const journeyTriggerSchema = triggerSchema;
 /**
@@ -6324,7 +6144,7 @@ const journeySchema = selectJourneySchema.extend({
 	trigger: journeyTriggerSchema,
 	purpose: consentPurposeKeySchema,
 	spine: z.array(journeySpineEntrySchema),
-	enabled: journeyEnabledSchema,
+	enabled: z.boolean(),
 	/**
 	* The newest version of this key, whatever it compiled to, so a list can
 	* say "pushed 2 hours ago" and "compiling" without a second read. What the
@@ -6343,7 +6163,7 @@ const journeySchema = selectJourneySchema.extend({
 * Both are server-side, like every other list filter.
 */
 const listJourneysQuerySchema = paginationQuerySchema.extend({
-	/** On or off in the environment the call selected. */
+	/** On or off; the journey's one flag. */
 	enabled: z.enum(["true", "false"]).optional(),
 	q: z.string().trim().max(200, "q must be at most 200 characters").optional().transform((value) => value ? value : void 0),
 	tag: z.string().trim().max(50, "tag must be at most 50 characters").optional()
@@ -6372,29 +6192,6 @@ const journeyStatsSchema = z.object({
 	deliveries: z.object({ byStatus: z.record(deliveryStatusSchema, z.number().int()) })
 });
 /**
-* A delivery row as the per-user journey timeline reports it. Deliberately
-* narrow: the full delivery DTO and its list contract live with the
-* deliveries log, and this timeline needs only what happened, not the
-* recipient address or the rendered payload.
-*/
-const journeyDeliverySchema = selectDeliverySchema.pick({
-	id: true,
-	journey: true,
-	step: true,
-	channel: true,
-	status: true,
-	dryRun: true,
-	error: true
-}).extend({ createdAt: z.iso.datetime() });
-/** One journey on a user's timeline: the journey, their run, their sends. */
-const userJourneySchema = z.object({
-	journey: journeySchema,
-	/** Null when this user never entered the journey. */
-	execution: executionSchema.nullable(),
-	deliveries: z.array(journeyDeliverySchema)
-});
-const listUserJourneysQuerySchema = paginationQuerySchema;
-/**
 * Which journeys the flag acts on: the keys the caller named, or every
 * journey of one project. Exactly one of the two, because a call carrying
 * both would have to decide which it meant.
@@ -6444,7 +6241,7 @@ const sandboxFailureCodeSchema = z.enum(SANDBOX_FAILURE_CODES);
 * to be written by hand or by an agent, not generated.
 *
 * The schema lives here rather than in packages/journeys so the CLI can reject
-* a bad file before it boots a Temporal environment, and so the docs site can
+* a bad file before it boots a Temporal dev server, and so the docs site can
 * render the format from one source.
 */
 const journeyScenarioSchema = z.object({
@@ -6515,6 +6312,168 @@ const notificationPreferencesSchema = z.object({ purposes: z.array(notificationP
 */
 const updateNotificationPreferencesBodySchema = z.object({ data: z.object({ purposes: consentPatchSchema }) });
 
+//#endregion
+//#region ../../packages/shared/src/resend.ts
+/** Resend's own cap on one message's recipients, per list. */
+const RESEND_MAX_RECIPIENTS = 50;
+/** Resend's own cap on one batch. */
+const RESEND_MAX_BATCH = 100;
+/** Resend's own cap on a from-header, a subject, and a message's tags. */
+const RESEND_MAX_FROM = 200;
+const RESEND_MAX_SUBJECT = 1e3;
+const RESEND_MAX_TAGS = 50;
+/**
+* One recipient: a bare address or `Name <addr@domain>`, both of which SES
+* takes in a Destination. The same parser the journey path uses, so an
+* address the facade accepts is one a journey could have sent to.
+*/
+const recipientSchema = z.string().trim().max(320).refine((value) => parseFromAddress(value) !== null, { message: "Every recipient must be an address (\"ada@acme.com\") or a name and address (\"Ada <ada@acme.com>\")." });
+const recipientArraySchema = z.array(recipientSchema).min(1).max(50);
+/** Resend takes one address or a list wherever it takes recipients. */
+const recipientsSchema = z.union([recipientSchema, recipientArraySchema]);
+/**
+* Resend's wording for an absent required field. Three fields can be
+* missing: `to`, `subject`, and a body. Which answer each one gets is read
+* off the issue itself, never off this copy, so rewording any of them is
+* safe (see `isMissingField`).
+*/
+const MISSING = (field) => `Missing \`${field}\` field.`;
+/**
+* A field Cowliss does not serve. Declared rather than left to the strict
+* object's "unrecognized key" so the 422 names the field and says what to
+* do instead; the Resend SDK omits an unset one, so only a caller that
+* really passed it is refused.
+*
+* `any` and a refusing check rather than `never`, which the OpenAPI
+* generator has no rendering for.
+*/
+const unsupported = (message) => z.any().refine(() => false, { error: message }).optional();
+/**
+* Resend's template slot, pointing at a Cowliss template key (ADR 0014).
+* `variables` are the template's own props: they are checked by the
+* template, in the sandbox, the same way a test send's are, so anything
+* JSON can carry is accepted here and the template decides.
+*/
+const templateSlotSchema = z.strictObject({
+	id: journeyKeySchema,
+	variables: z.record(z.string(), z.unknown()).optional()
+});
+/** Send body: Resend's fields, minus the ones Cowliss does not serve. */
+const resendSendBodySchema = z.strictObject({
+	/**
+	* Optional here where Resend requires it: an omitted `from` is the
+	* organization's shared fallback address, which is what makes a first
+	* send work with no configuration at all.
+	*/
+	from: z.string().trim().max(200).refine((value) => parseFromAddress(value) !== null, { message: "The from address must be an address (\"billing@acme.com\") or a name and address (\"Billing <billing@acme.com>\")." }).optional(),
+	/**
+	* Required, and the absence is its own issue rather than the union's:
+	* `optional().nonoptional()` lets the value through to the union when
+	* there is one and answers for undefined itself, which is how
+	* `isMissingField` tells "you left it out" from "you sent the wrong
+	* thing" without reading the message.
+	*/
+	to: z.union([recipientSchema, recipientArraySchema]).optional().nonoptional({ error: MISSING("to") }),
+	/**
+	* Optional in the type and required in practice: a message either
+	* carries its own subject or names a template, which brings one. The
+	* refinement below says which of the two is missing.
+	*/
+	subject: z.string().trim().min(1).max(RESEND_MAX_SUBJECT).optional(),
+	html: z.string().optional(),
+	text: z.string().optional(),
+	cc: recipientsSchema.optional(),
+	bcc: recipientsSchema.optional(),
+	reply_to: recipientsSchema.optional(),
+	headers: z.record(z.string(), z.string()).optional(),
+	/** Accepted and dropped: Cowliss tags a delivery by its own fields. */
+	tags: z.array(z.object({
+		name: z.string(),
+		value: z.string()
+	})).max(50).optional(),
+	attachments: unsupported("Cowliss does not accept attachments. Link to the file from the message instead."),
+	scheduled_at: unsupported("Cowliss does not schedule sends. Send the message when it should arrive, or let a journey's wait step do the waiting."),
+	topic_id: unsupported("Cowliss does not take topics. Consent purposes are where it records what a person agreed to."),
+	template: templateSlotSchema.optional()
+}).superRefine((body, ctx) => {
+	const refuse = (path, message) => ctx.addIssue({
+		code: "custom",
+		path: [path],
+		message
+	});
+	const missing = (path, message) => ctx.addIssue({
+		code: "custom",
+		path: [path],
+		message,
+		params: { missing: true }
+	});
+	if (body.template) {
+		if (body.subject !== void 0) refuse("subject", "The subject comes from the template. Remove `subject`, or write the message yourself with `html` or `text`.");
+		for (const field of ["html", "text"]) if (body[field] !== void 0) refuse(field, `A template brings its own content. Remove \`${field}\`, or drop \`template\` and write the message yourself.`);
+		return;
+	}
+	if (body.subject === void 0) missing("subject", MISSING("subject"));
+	if (body.html === void 0 && body.text === void 0) missing("html", "Missing `html` or `text` field.");
+});
+/**
+* A batch: Resend posts the messages as a bare array, and answers with one
+* id per message in the order they were given. Every message is checked
+* before any of them is sent, so a batch with a mistake in it sends
+* nothing.
+*/
+const resendBatchBodySchema = z.array(resendSendBodySchema, { error: (issue) => Array.isArray(issue.input) ? void 0 : "Send a list of messages." }).min(1, "Send at least one message.").max(100, `A batch takes at most ${100} messages. Split the list and send it in parts.`);
+/** What a send answers: the delivery's id, and nothing else. */
+const resendSentSchema = z.object({ id: z.string() });
+/** What a batch answers: one id per message, in the order they were given. */
+const resendBatchSentSchema = z.object({ data: z.array(resendSentSchema) });
+/**
+* Where a message got to, in Resend's vocabulary. Cowliss emits five of
+* them: a gate skip and a failure are both `failed`, because to a caller
+* they are the same fact, the message did not go.
+*/
+const RESEND_LAST_EVENTS = [
+	"sent",
+	"delivered",
+	"bounced",
+	"complained",
+	"failed"
+];
+/**
+* Resend's email object. `html` and `text` are always null: Cowliss stores
+* no rendered bodies (ADR 0014), and the SDK does not need them to report
+* on a send.
+*/
+const resendEmailSchema = z.object({
+	object: z.literal("email"),
+	id: z.string(),
+	/** The provider's message id; null until the message reaches the provider. */
+	message_id: z.string().nullable(),
+	to: z.array(z.string()),
+	from: z.string(),
+	created_at: z.string(),
+	subject: z.string(),
+	html: z.null(),
+	text: z.null(),
+	bcc: z.array(z.string()),
+	cc: z.array(z.string()),
+	reply_to: z.array(z.string()),
+	last_event: z.enum(RESEND_LAST_EVENTS),
+	scheduled_at: z.null(),
+	tags: z.array(z.object({
+		name: z.string(),
+		value: z.string()
+	}))
+});
+/**
+* Resend's error body. `name` is the machine-readable one, which is what an
+* SDK caller branches on; the message is for the developer reading it.
+*/
+const resendErrorSchema = z.object({
+	statusCode: z.number(),
+	message: z.string(),
+	name: z.string()
+});
+
 //#endregion
 //#region ../../packages/shared/src/violations.ts
 /**
@@ -6625,9 +6584,8 @@ const listReviewQuerySchema = paginationQuerySchema.extend({
 * per-profile and profiles merge across apps, so there is nothing
 * app-shaped to filter on the trait side.
 *
-* A definition is shared by the environments it declares. `environments`
-* defaults to both, and an app id lives in exactly one environment, so a
-* definition that runs in both names both of an app's ids.
+* A definition and the membership it produces are both the
+* organization's.
 *
 * The object is strict: a definition holding the retired `sourceId` key
 * (which meant the app) fails loudly instead of parsing as an unfiltered
@@ -6697,7 +6655,6 @@ const segmentDefinitionSchema = z.strictObject({
 });
 const segmentSchema = selectSegmentSchema.extend({
 	definition: segmentDefinitionSchema,
-	environments: environmentsSchema,
 	createdAt: z.iso.datetime(),
 	updatedAt: z.iso.datetime()
 });
@@ -6733,41 +6690,33 @@ const descriptionSchema = z.string().trim().max(500, "description must be at mos
 const createSegmentBodySchema = z.object({ data: z.object({
 	name: nameSchema,
 	description: descriptionSchema.nullish(),
-	definition: segmentDefinitionSchema,
-	/** The environments the segment works on; both when omitted. */
-	environments: environmentsSchema.default([...ENVIRONMENTS])
+	definition: segmentDefinitionSchema
 }) });
 const updateSegmentBodySchema = z.object({ data: z.object({
 	name: nameSchema.optional(),
 	description: descriptionSchema.nullish(),
-	definition: segmentDefinitionSchema.optional(),
-	/** Changing this recomputes membership in the newly declared environments. */
-	environments: environmentsSchema.optional()
-}).refine((data) => data.name !== void 0 || data.description !== void 0 || data.definition !== void 0 || data.environments !== void 0, { message: "at least one field (name, description, definition or environments) is required" }) });
+	definition: segmentDefinitionSchema.optional()
+}).refine((data) => data.name !== void 0 || data.description !== void 0 || data.definition !== void 0, { message: "at least one field (name, description or definition) is required" }) });
 /** `q` is a substring search over the segment's name. */
 const listSegmentsQuerySchema = paginationQuerySchema.extend({ q: searchQuerySchema });
-const listSegmentMembersQuerySchema = paginationQuerySchema;
+const listSegmentMembersQuerySchema = paginationQuerySchema.extend({});
 
 //#endregion
 //#region ../../packages/shared/src/settings.ts
 /**
 * Settings contracts. The two operator-set values, ingestionPolicy (catalog
-* governance) and eventRetentionDays (the ClickHouse TTL window), are per
-* environment: `GET/PATCH /v1/settings/org` read and write the environment
-* the selection header names, and the DTO says which one it is describing.
-* The org's Clerk profile rides along read-only.
+* governance) and eventRetentionDays (the ClickHouse TTL window), are the
+* organization's, one each: `GET/PATCH /v1/settings/org` read and write
+* them. The org's Clerk profile rides along read-only.
 */
 const ingestionPolicySchema = z.enum(INGESTION_POLICIES);
 /**
-* The environment's event retention window in days. Never null: an unset
-* window is the environment's default, and there is no keep-forever. The
-* schema caps at the largest environment's cap; the service enforces the
-* selected environment's own (30 days in development) with a 422.
+* The org's event retention window in days. Never null: an unset window is
+* the default, and there is no keep-forever. Both default and cap are 18
+* months.
 */
-const eventRetentionDaysSchema = z.number().int().min(1).max(Math.max(...Object.values(EVENT_RETENTION_DAYS)));
+const eventRetentionDaysSchema = z.number().int().min(1).max(548);
 const orgSettingsDtoSchema = z.object({
-	/** The environment these values belong to (from the selection header). */
-	environment: environmentSchema,
 	ingestionPolicy: ingestionPolicySchema,
 	eventRetentionDays: eventRetentionDaysSchema,
 	/**
@@ -6781,9 +6730,8 @@ const orgSettingsDtoSchema = z.object({
 	name: z.string().nullable()
 });
 /**
-* Settings patch for the selected environment. Each field is
-* absent-means-no-change. At least one field must be present: an empty
-* patch is a no-op request, not a valid one.
+* Settings patch. Each field is absent-means-no-change. At least one field
+* must be present: an empty patch is a no-op request, not a valid one.
 */
 const updateOrgSettingsBodySchema = z.object({ data: z.object({
 	ingestionPolicy: ingestionPolicySchema.optional(),
@@ -6825,7 +6773,7 @@ const sourceSchema = selectSourceSchema.extend({
 */
 const SOURCE_KINDS = sourceKindEnum.enumValues;
 /**
-* The per-kind source config schemas, mirroring the destinations
+* The per-kind source config schemas, mirroring the webhooks
 * discriminated-union pattern. The `api` source has nothing to configure:
 * ingestion authenticates with the org-level API key, so the row carries no
 * credential of its own. A Clerk source carries only the webhook signing
@@ -6842,7 +6790,7 @@ const apiSourceConfigSchema = z.strictObject({}, { error: "an api source takes n
 const clerkSourceConfigSchema = z.object({ signingSecret: z.string().min(1, "config.signingSecret is required") });
 /**
 * The source shapes, named individually so the dashboard's create form can
-* resolve against exactly one of them (the destinations pattern: a form knows
+* resolve against exactly one of them (the webhooks pattern: a form knows
 * its kind before the user types anything, and zodResolver over a member is
 * what gives react-hook-form a non-union field path to register).
 *
@@ -6874,7 +6822,7 @@ const listSourcesQuerySchema = paginationQuerySchema;
 //#region ../../packages/shared/src/suppressions.ts
 /**
 * The suppression mirror's wire contracts. Derived from the Drizzle table so
-* the row and the DTO cannot drift, same as deliveries and destinations.
+* the row and the DTO cannot drift, same as deliveries and webhooks.
 */
 const SUPPRESSION_TYPES = suppressionTypeEnum.enumValues;
 const suppressionTypeSchema = z.enum(SUPPRESSION_TYPES);
@@ -6897,7 +6845,7 @@ const listSuppressionsQuerySchema = paginationQuerySchema.extend({ q: searchQuer
 //#region ../../packages/shared/src/templates.ts
 /**
 * Templates as the API reports them. A template has versions and nothing
-* else (ADR 0011): no row of its own, no environment, no flag. What is
+* else (ADR 0011): no row of its own, no flag. What is
 * reported here is one key, described by its newest version, plus the
 * journeys whose steps send it.
 *
@@ -6932,6 +6880,8 @@ const templateSchema = z.object({
 const listTemplatesQuerySchema = paginationQuerySchema.extend({ q: z.string().trim().max(200, "q must be at most 200 characters").optional().transform((value) => value ? value : void 0) });
 /** The props a preview or a test send renders the template with. */
 const renderTemplateBodySchema = z.object({ data: z.object({ props: z.record(z.string(), z.unknown()).default({}) }) });
+/** A test send is a delivery like any other, so it takes the same props. */
+const testSendTemplateBodySchema = z.object({ data: z.object({ props: z.record(z.string(), z.unknown()).default({}) }) });
 /** What the sandbox rendered: the message as it would go out. */
 const templatePreviewSchema = z.object({
 	subject: z.string(),
@@ -6945,9 +6895,8 @@ const templatePreviewSchema = z.object({
 //#region ../../packages/shared/src/users.ts
 /**
 * Users API contracts (dashboard). Profiles are addressed by their
-* Cowliss-generated id (`usr_`), within the environment the selection header
-* names: a profile from the other environment reads as not found. A
-* profile's event history is the event feed filtered to it
+* Cowliss-generated id (`usr_`). A profile's event history is the event
+* feed filtered to it
 * (GET /v1/events?profileId=), not an endpoint of its own.
 */
 /**
@@ -7039,6 +6988,62 @@ const userExportSchema = z.object({
 	quarantineEntries: z.array(quarantineEntrySchema)
 });
 
+//#endregion
+//#region ../../packages/shared/src/webhooks.ts
+/**
+* Webhooks API contracts. Derived from the Drizzle table via drizzle-zod.
+* signingSecret is deliberately absent from the DTO: it is shown exactly
+* once, in the create response (webhookCreatedSchema). consecutiveFailures
+* is absent too: it is the auto-disable counter's internal state, and
+* disabledAt is the part the dashboard banner needs.
+*
+* A webhook is the organization's: the name is unique per org, and every
+* execution posts to the same row.
+*/
+/**
+* A webhook's name: the token a journey addresses it by, in a `send.webhook`
+* call. The journey names a string and the server resolves it, so the two
+* ends only have to agree on the characters that fit in one.
+*/
+const webhookNameSchema = z.string().trim().min(1, "name is required").max(100, "name must be at most 100 characters");
+const webhookConfigSchema = z.object({ url: z.url("config.url must be a valid URL").refine((url) => {
+	try {
+		return ["http:", "https:"].includes(new URL(url).protocol);
+	} catch {
+		return false;
+	}
+}, { message: "config.url must use http or https" }) });
+const webhookSchema = selectWebhookSchema.extend({
+	config: webhookConfigSchema,
+	createdAt: z.iso.datetime(),
+	updatedAt: z.iso.datetime(),
+	disabledAt: z.iso.datetime().nullable()
+}).omit({
+	signingSecret: true,
+	consecutiveFailures: true
+});
+const webhookCreatedSchema = webhookSchema.extend({ signingSecret: z.string() });
+const createWebhookBodySchema = z.object({ data: z.object({
+	name: webhookNameSchema,
+	config: webhookConfigSchema
+}) });
+/**
+* Webhook update. `enabled` is the admin's half of the auto-disable loop:
+* the webhook send activity stamps `disabledAt` after enough consecutive
+* failures and every send after that records `skipped_disabled`, so without
+* a way to clear it the only exit would be deleting the webhook, which
+* throws away the signing secret the receiver is configured with.
+* `enabled: true` clears the stamp and the failure counter; `enabled: false`
+* is the same switch operated by hand.
+*/
+const updateWebhookBodySchema = z.object({ data: z.object({
+	name: webhookNameSchema.optional(),
+	config: webhookConfigSchema.optional(),
+	enabled: z.boolean().optional()
+}).refine((data) => data.name !== void 0 || data.config !== void 0 || data.enabled !== void 0, { message: "at least one field (name, config, or enabled) is required" }) });
+/** `q` is a substring search over the webhook's name. */
+const listWebhooksQuerySchema = paginationQuerySchema.extend({ q: searchQuerySchema });
+
 //#endregion
 //#region ../../packages/api-client/src/client.ts
 var ApiError = class extends Error {
@@ -7222,7 +7227,7 @@ function readCliPackage() {
 * are. Reading the code sees every branch, labelled with its condition.
 *
 * What it reads: `await api.*` calls (in source order, with the literal
-* template, destination, event, key, or duration when the author wrote one
+* template, webhook, event, key, or duration when the author wrote one
 * inline), `if`/`else`, `switch`, loops, `try`/`catch`, `return`, `throw`, and
 * `api.restart()`. Calls behind a helper function in another file, and a
 * `run` that is not an inline function on the `defineJourney` object, are
@@ -7433,12 +7438,9 @@ var Reader = class {
 				if (timeout) entry.timeout = timeout;
 				break;
 			}
-			case "send.email": {
+			case "send.email":
 				detail(this.property(first, "template"));
-				const sender = this.property(first, "senderIdentity");
-				if (sender) entry.senderIdentity = sender;
 				break;
-			}
 			case "send.webhook":
 				detail(this.property(first, "destination"));
 				break;
@@ -7999,7 +8001,7 @@ async function buildProject(projectDir) {
 			tags: report.tags,
 			trigger: report.trigger,
 			purpose: report.purpose,
-			senderIdentity: report.senderIdentity,
+			from: report.from,
 			spine: readSpine(await readFile(built.source.file, "utf8")),
 			bundle: built.digest
 		});
@@ -8025,7 +8027,7 @@ async function buildProject(projectDir) {
 	});
 	if (failure) throw new Error(failure);
 	const manifest = manifestSchema.parse({
-		protocol: 2,
+		protocol: 3,
 		sdk: (await readCliPackage()).version,
 		journeys: manifestJourneys,
 		templates: manifestTemplates,
@@ -9264,82 +9266,9 @@ all: z.literal("1").optional() }) },
 	}
 }));
 
-//#endregion
-//#region ../../packages/shared/src/contract/destinations.ts
-const params$9 = z.object({ id: z.string() });
-const destinations = defineModule(defineRoute({
-	method: "post",
-	path: "/v1/destinations",
-	operationId: "destinations.create",
-	tags: ["destinations"],
-	summary: "Create a destination",
-	security: SESSION_AUTH,
-	request: { body: jsonBody(createDestinationBodySchema) },
-	responses: {
-		201: envelope(destinationCreatedSchema, "The created destination; the only response carrying the signing secret"),
-		...sessionErrors,
-		...errors("validation_failed", "malformed_request")
-	}
-}), defineRoute({
-	method: "get",
-	path: "/v1/destinations",
-	operationId: "destinations.list",
-	tags: ["destinations"],
-	summary: "List destinations in the selected environment",
-	security: SESSION_AUTH,
-	request: { query: listDestinationsQuerySchema },
-	responses: {
-		200: list(destinationSchema),
-		...sessionErrors,
-		...errors("validation_failed")
-	}
-}), defineRoute({
-	method: "get",
-	path: "/v1/destinations/{id}",
-	operationId: "destinations.get",
-	tags: ["destinations"],
-	summary: "Fetch one destination",
-	security: SESSION_AUTH,
-	request: { params: params$9 },
-	responses: {
-		200: envelope(destinationSchema),
-		...sessionErrors,
-		...errors("not_found")
-	}
-}), defineRoute({
-	method: "patch",
-	path: "/v1/destinations/{id}",
-	operationId: "destinations.update",
-	tags: ["destinations"],
-	summary: "Update a destination",
-	security: SESSION_AUTH,
-	request: {
-		params: params$9,
-		body: jsonBody(updateDestinationBodySchema)
-	},
-	responses: {
-		200: envelope(destinationSchema),
-		...sessionErrors,
-		...errors("not_found", "validation_failed", "malformed_request")
-	}
-}), defineRoute({
-	method: "delete",
-	path: "/v1/destinations/{id}",
-	operationId: "destinations.delete",
-	tags: ["destinations"],
-	summary: "Delete a destination",
-	security: SESSION_AUTH,
-	request: { params: params$9 },
-	responses: {
-		200: envelope(deletedSchema),
-		...sessionErrors,
-		...errors("not_found")
-	}
-}));
-
 //#endregion
 //#region ../../packages/shared/src/contract/domains.ts
-const params$8 = z.object({ id: z.string() });
+const params$9 = z.object({ id: z.string() });
 const domains = defineModule(defineRoute({
 	method: "get",
 	path: "/v1/domains",
@@ -9360,7 +9289,7 @@ const domains = defineModule(defineRoute({
 	tags: ["domains"],
 	summary: "Fetch one sending domain",
 	security: SESSION_AUTH,
-	request: { params: params$8 },
+	request: { params: params$9 },
 	responses: {
 		200: envelope(senderDomainSchema),
 		...sessionErrors,
@@ -9388,7 +9317,7 @@ const domains = defineModule(defineRoute({
 	description: "The Domain Connect link for this domain's DNS provider, which shows the admin the records and asks them to confirm. `url` is null when the provider does not support it.",
 	security: SESSION_AUTH,
 	surfaces: HIDDEN_FROM_TOOLS,
-	request: { params: params$8 },
+	request: { params: params$9 },
 	responses: {
 		200: envelope(domainDnsSetupSchema),
 		...sessionErrors,
@@ -9401,7 +9330,7 @@ const domains = defineModule(defineRoute({
 	tags: ["domains"],
 	summary: "Re-check DNS now",
 	security: SESSION_AUTH,
-	request: { params: params$8 },
+	request: { params: params$9 },
 	responses: {
 		200: envelope(senderDomainSchema),
 		...sessionErrors,
@@ -9415,7 +9344,7 @@ const domains = defineModule(defineRoute({
 	summary: "Toggle click tracking",
 	security: SESSION_AUTH,
 	request: {
-		params: params$8,
+		params: params$9,
 		body: jsonBody(updateSenderDomainBodySchema)
 	},
 	responses: {
@@ -9430,7 +9359,7 @@ const domains = defineModule(defineRoute({
 	tags: ["domains"],
 	summary: "Give up a domain claim",
 	security: SESSION_AUTH,
-	request: { params: params$8 },
+	request: { params: params$9 },
 	responses: {
 		200: envelope(deletedSchema),
 		...sessionErrors,
@@ -9528,15 +9457,15 @@ const events = defineModule(defineRoute({
 
 //#endregion
 //#region ../../packages/shared/src/contract/executions.ts
-const params$7 = z.object({ id: z.string() });
+const params$8 = z.object({ id: z.string() });
 /**
 * Executions: one run of one journey for one profile. Replaces v1's journey
 * instances, which were read live from Temporal and so could only be listed
 * per journey; these are rows, so they filter by journey, version, status,
-* and profile in one place. The environment comes from the selection header.
+* and profile in one place.
 *
-* `cancel` is the only write: stopping is explicit and per environment
-* (ADR 0011), and each execution records `cancelled` when it reaches its
+* `cancel` is the only write: stopping is explicit (ADR 0011), and each
+* execution records `cancelled` when it reaches its
 * next step, so the answer is that the sweep started rather than a count.
 * A pipeline may push, enable, disable and READ executions; stopping runs
 * that are already carrying real people is a person's call, so cancel takes
@@ -9575,7 +9504,7 @@ const executions = defineModule(defineRoute({
 	tags: ["executions"],
 	summary: "Inspect one execution, with its logs",
 	security: PIPELINE_AUTH,
-	request: { params: params$7 },
+	request: { params: params$8 },
 	responses: {
 		200: envelope(executionDetailSchema),
 		...sessionErrors,
@@ -9688,16 +9617,11 @@ const ingestion = defineModule(defineRoute({
 * because the rows are derived from a push rather than created through the
 * API, and (org, key) is the only identity they have.
 *
-* `list` and `get` report the enabled flag of BOTH environments whichever
-* one the caller selected, because "is this on in production?" is the
-* question they exist to answer; `enable` and `disable` act on the selected
-* one, like every other environment-scoped write (docs/standards/api.md).
-*
 * `journeys.listInstances` and `journeys.getInstance` are gone: executions
 * are their own resource now (`executions.list` / `executions.get`), and
 * `journeys.dryRun` answers with the execution it started.
 */
-const params$6 = z.object({ key: z.string() });
+const params$7 = z.object({ key: z.string() });
 const journeys = defineModule(defineRoute({
 	method: "get",
 	path: "/v1/journeys",
@@ -9718,7 +9642,7 @@ const journeys = defineModule(defineRoute({
 	tags: ["journeys"],
 	summary: "Inspect one journey",
 	security: SESSION_AUTH,
-	request: { params: params$6 },
+	request: { params: params$7 },
 	responses: {
 		200: envelope(journeySchema),
 		...sessionErrors,
@@ -9731,7 +9655,7 @@ const journeys = defineModule(defineRoute({
 	tags: ["journeys"],
 	summary: "Journey operational stats",
 	security: SESSION_AUTH,
-	request: { params: params$6 },
+	request: { params: params$7 },
 	responses: {
 		200: envelope(journeyStatsSchema),
 		...sessionErrors,
@@ -9742,7 +9666,7 @@ const journeys = defineModule(defineRoute({
 	path: "/v1/journeys/enable",
 	operationId: "journeys.enable",
 	tags: ["journeys"],
-	summary: "Turn journeys on in the selected environment",
+	summary: "Turn journeys on",
 	security: PIPELINE_AUTH,
 	surfaces: { cli: false },
 	request: { body: jsonBody(setJourneysEnabledBodySchema) },
@@ -9756,7 +9680,7 @@ const journeys = defineModule(defineRoute({
 	path: "/v1/journeys/disable",
 	operationId: "journeys.disable",
 	tags: ["journeys"],
-	summary: "Turn journeys off in the selected environment",
+	summary: "Turn journeys off",
 	security: PIPELINE_AUTH,
 	surfaces: { cli: false },
 	request: { body: jsonBody(setJourneysEnabledBodySchema) },
@@ -9772,7 +9696,7 @@ const journeys = defineModule(defineRoute({
 	tags: ["journeys"],
 	summary: "Delete a journey",
 	security: SESSION_AUTH,
-	request: { params: params$6 },
+	request: { params: params$7 },
 	responses: {
 		200: envelope(deletedSchema),
 		...sessionErrors,
@@ -9786,7 +9710,7 @@ const journeys = defineModule(defineRoute({
 	summary: "Dry-run a journey against a real user",
 	security: SESSION_AUTH,
 	request: {
-		params: params$6,
+		params: params$7,
 		body: jsonBody(dryRunJourneyBodySchema)
 	},
 	responses: {
@@ -9800,9 +9724,9 @@ const journeys = defineModule(defineRoute({
 //#region ../../packages/shared/src/contract/me.ts
 /**
 * The signed-in developer's own settings. Session auth like the rest of the
-* dashboard API, but deliberately not org-scoped and indifferent to the
-* environment header: the subject is the caller's own platform-workspace
-* profile, taken from their session, never from the request.
+* dashboard API, but deliberately not org-scoped: the subject is the
+* caller's own platform-workspace profile, taken from their session, never
+* from the request.
 *
 * Hidden from the CLI and the MCP server. Both act with an org's key on that
 * org's data, and neither has a signed-in human whose mail preferences this
@@ -9899,7 +9823,7 @@ const project = defineModule(defineRoute({
 
 //#endregion
 //#region ../../packages/shared/src/contract/pushes.ts
-const params$5 = z.object({ id: z.string() });
+const params$6 = z.object({ id: z.string() });
 /**
 * Pushes: one `cow push` each, the whole project at one point in time. The
 * push stores the source archive and its compile creates a version of every
@@ -9944,7 +9868,7 @@ const pushes = defineModule(defineRoute({
 	tags: ["pushes"],
 	summary: "Inspect one push and what it compiled",
 	security: SESSION_AUTH,
-	request: { params: params$5 },
+	request: { params: params$6 },
 	responses: {
 		200: envelope(pushSchema),
 		...sessionErrors,
@@ -9958,7 +9882,7 @@ const pushes = defineModule(defineRoute({
 	summary: "Download the pushed source tarball",
 	security: SESSION_AUTH,
 	surfaces: HIDDEN_FROM_TOOLS,
-	request: { params: params$5 },
+	request: { params: params$6 },
 	responses: {
 		200: {
 			description: "The gzipped source tarball the push stored",
@@ -9969,6 +9893,98 @@ const pushes = defineModule(defineRoute({
 	}
 }));
 
+//#endregion
+//#region ../../packages/shared/src/contract/resend.ts
+/**
+* The Resend-compatible send facade (ADR 0014): a developer points
+* `RESEND_BASE_URL` at `/resend/{sourceId}` and keeps their code. The source
+* in the path names the app, because the Resend SDK carries no other field
+* and accepts no custom header; the bearer is the organization's ingestion
+* key.
+*
+* These routes are the one exception to the envelope standard: they answer
+* Resend's own shapes, and the API mounts them on a sub-app with its own
+* error handler. They stay in the contract so the API still registers no
+* route outside it, and they are hidden from the CLI, the MCP server and the
+* generated reference: a Cowliss surface has the `/v1` routes, and the guide
+* is the place the facade is documented.
+*/
+const FACADE_SURFACES = {
+	cli: false,
+	mcp: false,
+	docs: false
+};
+const sourceParam = z.object({ sourceId: z.string().openapi({ example: "src_2f9a8c1b" }) });
+/** Resend's error body, for the answers this facade gives. */
+const facadeError = (description) => ({
+	description,
+	content: { "application/json": { schema: resendErrorSchema } }
+});
+const facadeErrors = {
+	401: facadeError("missing_api_key | invalid_api_key"),
+	404: facadeError("not_found: unknown source, or unknown message"),
+	422: facadeError("validation_error | missing_required_field"),
+	429: facadeError("monthly_quota_exceeded | rate_limit_exceeded"),
+	500: facadeError("application_error")
+};
+const resend = defineModule(defineRoute({
+	method: "post",
+	path: "/resend/{sourceId}/emails",
+	operationId: "resend.send",
+	tags: ["resend"],
+	summary: "Send one email (Resend-compatible)",
+	security: API_KEY_AUTH,
+	surfaces: FACADE_SURFACES,
+	request: {
+		params: sourceParam,
+		body: jsonBody(resendSendBodySchema)
+	},
+	responses: {
+		201: {
+			description: "Accepted; the id is the delivery's",
+			content: { "application/json": { schema: resendSentSchema } }
+		},
+		403: facadeError("validation_error: the from-address sits on a domain this organization has not verified"),
+		...facadeErrors
+	}
+}), defineRoute({
+	method: "post",
+	path: "/resend/{sourceId}/emails/batch",
+	operationId: "resend.sendBatch",
+	tags: ["resend"],
+	summary: "Send up to 100 emails (Resend-compatible)",
+	security: API_KEY_AUTH,
+	surfaces: FACADE_SURFACES,
+	request: {
+		params: sourceParam,
+		body: jsonBody(resendBatchBodySchema)
+	},
+	responses: {
+		201: {
+			description: "Accepted; one id per message, in the order they were given",
+			content: { "application/json": { schema: resendBatchSentSchema } }
+		},
+		403: facadeError("validation_error: a from-address sits on a domain this organization has not verified"),
+		...facadeErrors
+	}
+}), defineRoute({
+	method: "get",
+	path: "/resend/{sourceId}/emails/{id}",
+	operationId: "resend.get",
+	tags: ["resend"],
+	summary: "Fetch one sent email (Resend-compatible)",
+	security: API_KEY_AUTH,
+	surfaces: FACADE_SURFACES,
+	request: { params: sourceParam.extend({ id: z.string().openapi({ example: "dlv_2f9a8c1b" }) }) },
+	responses: {
+		200: {
+			description: "The email object",
+			content: { "application/json": { schema: resendEmailSchema } }
+		},
+		...facadeErrors
+	}
+}));
+
 //#endregion
 //#region ../../packages/shared/src/contract/review.ts
 /**
@@ -9994,7 +10010,7 @@ const review = defineModule(defineRoute({
 
 //#endregion
 //#region ../../packages/shared/src/contract/segments.ts
-const params$4 = z.object({ id: z.string() });
+const params$5 = z.object({ id: z.string() });
 const writeErrors = errors("validation_failed", "malformed_request");
 /** `preview` precedes `get` so "preview" is never read as an id. */
 const segments = defineModule(defineRoute({
@@ -10044,7 +10060,7 @@ const segments = defineModule(defineRoute({
 	tags: ["segments"],
 	summary: "Fetch one segment with its member count",
 	security: SESSION_AUTH,
-	request: { params: params$4 },
+	request: { params: params$5 },
 	responses: {
 		200: envelope(segmentDetailSchema),
 		...sessionErrors,
@@ -10058,7 +10074,7 @@ const segments = defineModule(defineRoute({
 	summary: "Update a segment",
 	security: SESSION_AUTH,
 	request: {
-		params: params$4,
+		params: params$5,
 		body: jsonBody(updateSegmentBodySchema)
 	},
 	responses: {
@@ -10074,7 +10090,7 @@ const segments = defineModule(defineRoute({
 	tags: ["segments"],
 	summary: "Delete a segment",
 	security: SESSION_AUTH,
-	request: { params: params$4 },
+	request: { params: params$5 },
 	responses: {
 		200: envelope(deletedSchema),
 		...sessionErrors,
@@ -10088,7 +10104,7 @@ const segments = defineModule(defineRoute({
 	summary: "List a segment's members",
 	security: SESSION_AUTH,
 	request: {
-		params: params$4,
+		params: params$5,
 		query: listSegmentMembersQuerySchema
 	},
 	responses: {
@@ -10213,7 +10229,7 @@ const settings = defineModule(defineRoute({
 //#endregion
 //#region ../../packages/shared/src/contract/sources.ts
 const appParams = z.object({ appId: z.string() });
-const params$3 = z.object({ id: z.string() });
+const params$4 = z.object({ id: z.string() });
 /**
 * A source is one inbound pipe into an app. It is created and listed under
 * its parent app (the app is the attribution unit) and addressed by its own
@@ -10259,7 +10275,7 @@ const sources = defineModule(defineRoute({
 	tags: ["sources"],
 	summary: "Fetch one source",
 	security: SESSION_AUTH,
-	request: { params: params$3 },
+	request: { params: params$4 },
 	responses: {
 		200: envelope(sourceSchema),
 		...sessionErrors,
@@ -10273,7 +10289,7 @@ const sources = defineModule(defineRoute({
 	summary: "Set or rotate a source's config",
 	security: SESSION_AUTH,
 	request: {
-		params: params$3,
+		params: params$4,
 		body: jsonBody(updateSourceBodySchema)
 	},
 	responses: {
@@ -10288,7 +10304,7 @@ const sources = defineModule(defineRoute({
 	tags: ["sources"],
 	summary: "Archive a source",
 	security: SESSION_AUTH,
-	request: { params: params$3 },
+	request: { params: params$4 },
 	responses: {
 		200: envelope(sourceSchema, "The archived source"),
 		...sessionErrors,
@@ -10359,7 +10375,7 @@ const suppressions = defineModule(defineRoute({
 * organization's default sender: it reaches no recipient, so it passes no
 * consent gate, counts against nothing, and is logged as a test.
 */
-const params$2 = z.object({ key: z.string() });
+const params$3 = z.object({ key: z.string() });
 const templates = defineModule(defineRoute({
 	method: "get",
 	path: "/v1/templates",
@@ -10380,7 +10396,7 @@ const templates = defineModule(defineRoute({
 	tags: ["templates"],
 	summary: "Inspect one email template",
 	security: SESSION_AUTH,
-	request: { params: params$2 },
+	request: { params: params$3 },
 	responses: {
 		200: envelope(templateSchema),
 		...sessionErrors,
@@ -10394,7 +10410,7 @@ const templates = defineModule(defineRoute({
 	summary: "Render a template with the props you pass",
 	security: SESSION_AUTH,
 	request: {
-		params: params$2,
+		params: params$3,
 		body: jsonBody(renderTemplateBodySchema)
 	},
 	responses: {
@@ -10410,8 +10426,8 @@ const templates = defineModule(defineRoute({
 	summary: "Send a rendered template to your own address",
 	security: SESSION_AUTH,
 	request: {
-		params: params$2,
-		body: jsonBody(renderTemplateBodySchema)
+		params: params$3,
+		body: jsonBody(testSendTemplateBodySchema)
 	},
 	responses: {
 		201: envelope(deliverySchema, "The test send, as it was logged"),
@@ -10425,7 +10441,7 @@ const templates = defineModule(defineRoute({
 	tags: ["templates"],
 	summary: "Delete an email template",
 	security: SESSION_AUTH,
-	request: { params: params$2 },
+	request: { params: params$3 },
 	responses: {
 		200: envelope(deletedSchema),
 		...sessionErrors,
@@ -10435,7 +10451,7 @@ const templates = defineModule(defineRoute({
 
 //#endregion
 //#region ../../packages/shared/src/contract/users.ts
-const params$1 = z.object({ profileId: z.string() });
+const params$2 = z.object({ profileId: z.string() });
 /**
 * The answer a merged-away profile id gets (spec: Identity): 307 to the
 * same path with the survivor's id, so the method and body of a redirected
@@ -10446,9 +10462,8 @@ const mergedRedirect = { 307: {
 	headers: z.object({ Location: z.string().meta({ description: "The survivor's URL" }) })
 } };
 /**
-* Profiles by their Cowliss-generated id, within the environment the
-* selection header names. `find` precedes `{profileId}` so the literal path
-* wins.
+* Profiles by their Cowliss-generated id. `find` precedes `{profileId}` so
+* the literal path wins.
 */
 const users = defineModule(defineRoute({
 	method: "get",
@@ -10483,7 +10498,7 @@ const users = defineModule(defineRoute({
 	tags: ["users"],
 	summary: "Fetch one profile with its identifiers",
 	security: SESSION_AUTH,
-	request: { params: params$1 },
+	request: { params: params$2 },
 	responses: {
 		200: envelope(userDetailSchema),
 		...mergedRedirect,
@@ -10497,7 +10512,7 @@ const users = defineModule(defineRoute({
 	tags: ["users"],
 	summary: "Erase a user (GDPR)",
 	security: SESSION_AUTH,
-	request: { params: params$1 },
+	request: { params: params$2 },
 	responses: {
 		200: envelope(eraseUserResponseSchema),
 		...mergedRedirect,
@@ -10511,7 +10526,7 @@ const users = defineModule(defineRoute({
 	tags: ["users"],
 	summary: "Export everything held on a user (GDPR)",
 	security: SESSION_AUTH,
-	request: { params: params$1 },
+	request: { params: params$2 },
 	responses: {
 		200: envelope(userExportSchema),
 		...mergedRedirect,
@@ -10526,7 +10541,7 @@ const users = defineModule(defineRoute({
 	summary: "Update consent purposes",
 	security: SESSION_AUTH,
 	request: {
-		params: params$1,
+		params: params$2,
 		body: jsonBody(updateConsentBodySchema)
 	},
 	responses: {
@@ -10543,7 +10558,7 @@ const users = defineModule(defineRoute({
 	summary: "The segments a profile belongs to",
 	security: SESSION_AUTH,
 	request: {
-		params: params$1,
+		params: params$2,
 		query: listUserSegmentsQuerySchema
 	},
 	responses: {
@@ -10552,23 +10567,6 @@ const users = defineModule(defineRoute({
 		...sessionErrors,
 		...errors("not_found", "validation_failed")
 	}
-}), defineRoute({
-	method: "get",
-	path: "/v1/users/{profileId}/journeys",
-	operationId: "users.listJourneys",
-	tags: ["users"],
-	summary: "A profile's journey timeline",
-	security: SESSION_AUTH,
-	request: {
-		params: params$1,
-		query: listUserJourneysQuerySchema
-	},
-	responses: {
-		200: list(userJourneySchema),
-		...mergedRedirect,
-		...sessionErrors,
-		...errors("not_found", "validation_failed")
-	}
 }));
 
 //#endregion
@@ -10596,7 +10594,7 @@ const versions = defineModule(defineRoute({
 
 //#endregion
 //#region ../../packages/shared/src/contract/violations.ts
-const params = z.object({ id: z.string() });
+const params$1 = z.object({ id: z.string() });
 const violations = defineModule(defineRoute({
 	method: "get",
 	path: "/v1/violations/{id}",
@@ -10604,7 +10602,7 @@ const violations = defineModule(defineRoute({
 	tags: ["violations"],
 	summary: "Fetch one violation",
 	security: SESSION_AUTH,
-	request: { params },
+	request: { params: params$1 },
 	responses: {
 		200: envelope(violationSchema),
 		...sessionErrors,
@@ -10618,7 +10616,7 @@ const violations = defineModule(defineRoute({
 	summary: "Resolve a violation into the catalog",
 	security: SESSION_AUTH,
 	request: {
-		params,
+		params: params$1,
 		body: jsonBody(resolveViolationBodySchema)
 	},
 	responses: {
@@ -10633,7 +10631,7 @@ const violations = defineModule(defineRoute({
 	tags: ["violations"],
 	summary: "Dismiss a violation",
 	security: SESSION_AUTH,
-	request: { params },
+	request: { params: params$1 },
 	responses: {
 		200: envelope(violationSchema),
 		...sessionErrors,
@@ -10641,6 +10639,79 @@ const violations = defineModule(defineRoute({
 	}
 }));
 
+//#endregion
+//#region ../../packages/shared/src/contract/webhooks.ts
+const params = z.object({ id: z.string() });
+const webhooks = defineModule(defineRoute({
+	method: "post",
+	path: "/v1/webhooks",
+	operationId: "webhooks.create",
+	tags: ["webhooks"],
+	summary: "Create a webhook",
+	security: SESSION_AUTH,
+	request: { body: jsonBody(createWebhookBodySchema) },
+	responses: {
+		201: envelope(webhookCreatedSchema, "The created webhook; the only response carrying the signing secret"),
+		...sessionErrors,
+		...errors("validation_failed", "malformed_request", "conflict")
+	}
+}), defineRoute({
+	method: "get",
+	path: "/v1/webhooks",
+	operationId: "webhooks.list",
+	tags: ["webhooks"],
+	summary: "List webhooks",
+	security: SESSION_AUTH,
+	request: { query: listWebhooksQuerySchema },
+	responses: {
+		200: list(webhookSchema),
+		...sessionErrors,
+		...errors("validation_failed")
+	}
+}), defineRoute({
+	method: "get",
+	path: "/v1/webhooks/{id}",
+	operationId: "webhooks.get",
+	tags: ["webhooks"],
+	summary: "Fetch one webhook",
+	security: SESSION_AUTH,
+	request: { params },
+	responses: {
+		200: envelope(webhookSchema),
+		...sessionErrors,
+		...errors("not_found")
+	}
+}), defineRoute({
+	method: "patch",
+	path: "/v1/webhooks/{id}",
+	operationId: "webhooks.update",
+	tags: ["webhooks"],
+	summary: "Update a webhook",
+	security: SESSION_AUTH,
+	request: {
+		params,
+		body: jsonBody(updateWebhookBodySchema)
+	},
+	responses: {
+		200: envelope(webhookSchema),
+		...sessionErrors,
+		...errors("not_found", "validation_failed", "malformed_request", "conflict")
+	}
+}), defineRoute({
+	method: "delete",
+	path: "/v1/webhooks/{id}",
+	operationId: "webhooks.delete",
+	tags: ["webhooks"],
+	summary: "Delete a webhook",
+	security: SESSION_AUTH,
+	request: { params },
+	responses: {
+		200: envelope(deletedSchema),
+		...sessionErrors,
+		...errors("not_found")
+	}
+}));
+
 //#endregion
 //#region ../../packages/shared/src/contract/index.ts
 /**
@@ -10673,10 +10744,11 @@ const contract = {
 	executions,
 	journeys,
 	templates,
-	destinations,
+	webhooks,
 	domains,
 	deliveries,
 	emails,
+	resend,
 	suppressions,
 	settings,
 	billing
@@ -11048,15 +11120,10 @@ function registerContractCommands(program, run) {
 //#endregion
 //#region src/commands/enable.ts
 /**
-* `cow enable` and `cow disable`: the one gate on a journey, per
-* environment (ADR 0011). Hand-written rather than derived from
-* `journeys.enable`, because the commands are top-level names a developer
-* types, and because of the `--env` rule below; the route itself takes the
-* same set of keys they do.
-*
-* `--env` is never defaulted here (`requireEnvironment`): the default
-* environment is production, and a flag nobody typed must not put code in
-* front of real recipients.
+* `cow enable` and `cow disable`: the one gate on a journey (ADR 0011, ADR
+* 0013). Hand-written rather than derived from `journeys.enable`, because
+* the commands are top-level names a developer types; the route itself
+* takes the same set of keys they do.
 */
 /**
 * One call, whichever way the keys were named: the route takes the set, and
@@ -11068,33 +11135,32 @@ async function setEnabled(client, selector, enabled) {
 	const route = enabled ? contract.journeys["journeys.enable"] : contract.journeys["journeys.disable"];
 	return (await client.request(route, { body: selector })).data;
 }
-/** What the terminal says: one line per key, naming where it now stands. */
-function flipSummary(journeys, enabled, environment) {
+/** What the terminal says: one line per key, naming its new state. */
+function flipSummary(journeys, enabled) {
 	if (journeys.length === 0) return `This project has no journeys to turn ${enabled ? "on" : "off"}.`;
-	return journeys.map((journey) => `${journey.key} is ${enabled ? "on" : "off"} in ${environment}.`).join("\n");
+	return journeys.map((journey) => `${journey.key} is ${enabled ? "on" : "off"}.`).join("\n");
 }
-function register(program, clientFor, env, io, enabled) {
+function register(program, clientFor, io, enabled) {
 	const verb = enabled ? "enable" : "disable";
-	program.command(verb).description(`turn journeys ${enabled ? "on" : "off"} in one environment (many keys, or --all for this project's)`).argument("[keys...]", "journey keys").option("--all", "every journey of this project").action(async (keys, opts) => {
+	program.command(verb).description(`turn journeys ${enabled ? "on" : "off"} (many keys, or --all for this project's)`).argument("[keys...]", "journey keys").option("--all", "every journey of this project").action(async (keys, opts) => {
 		const merged = {
 			...program.opts(),
 			...opts
 		};
-		const environment = requireEnvironment(env, merged);
-		if (merged.all === true && keys.length > 0) throw new Error(`Name the journeys or pass --all, not both: cow ${verb} welcome --env ${environment}.`);
-		if (merged.all !== true && keys.length === 0) throw new Error(`Name at least one journey, or pass --all: cow ${verb} welcome --env ${environment}.`);
+		if (merged.all === true && keys.length > 0) throw new Error(`Name the journeys or pass --all, not both: cow ${verb} welcome.`);
+		if (merged.all !== true && keys.length === 0) throw new Error(`Name at least one journey, or pass --all: cow ${verb} welcome.`);
 		const selector = merged.all === true ? { project: (await assertCowConfig(process.cwd())).project } : { keys };
 		const updated = await setEnabled(await clientFor(merged), selector, enabled);
 		if (merged.json === true) {
 			emit({ data: updated }, io, true);
 			return;
 		}
-		io.stdout(`${flipSummary(updated, enabled, environment)}\n`);
+		io.stdout(`${flipSummary(updated, enabled)}\n`);
 	});
 }
-function registerEnable(program, clientFor, env, io) {
-	register(program, clientFor, env, io, true);
-	register(program, clientFor, env, io, false);
+function registerEnable(program, clientFor, io) {
+	register(program, clientFor, io, true);
+	register(program, clientFor, io, false);
 }
 
 //#endregion
@@ -11150,7 +11216,7 @@ async function packageJson(name) {
 * ponytail: plain fetch because `POST /v1/project` is not a contract route
 * yet; swap it for the typed client's `project.create` once ticket 04 lands.
 */
-async function createProject(apiUrl, token, environment, name) {
+async function createProject(apiUrl, token, name) {
 	if (!token) return {
 		project: "skipped",
 		reason: "not logged in"
@@ -11160,8 +11226,7 @@ async function createProject(apiUrl, token, environment, name) {
 			method: "POST",
 			headers: {
 				"content-type": "application/json",
-				authorization: `Bearer ${token}`,
-				[ENVIRONMENT_HEADER]: environment
+				authorization: `Bearer ${token}`
 			},
 			body: JSON.stringify({ data: { name } })
 		});
@@ -11220,7 +11285,7 @@ function registerInit(program, env, io) {
 		}
 		const example = typeof opts.example === "string" ? opts.example : void 0;
 		const files = [...Object.keys(contents), ...example ? await copyExample(example, dir, false) : []].sort();
-		const outcome = await createProject(resolveApiUrl(env, credentials, typeof merged.api === "string" ? merged.api : void 0), resolveCredential(env, credentials).token, (typeof merged.env === "string" ? merged.env : void 0) ?? env.COW_ENVIRONMENT ?? "production", name);
+		const outcome = await createProject(resolveApiUrl(env, credentials, typeof merged.api === "string" ? merged.api : void 0), resolveCredential(env, credentials).token, name);
 		emit({ data: {
 			dir,
 			orgId,
@@ -11535,7 +11600,7 @@ async function pushProject({ client, projectDir }) {
 		push: (await client.request(contract.pushes["pushes.create"], { body: {
 			manifest: {
 				...manifest,
-				protocol: 2
+				protocol: 3
 			},
 			project: project.name
 		} })).data,
@@ -11634,13 +11699,11 @@ function versionPhrase(entry, now) {
 	return `${bundle ? `version ${shortDigest(bundle)}` : "version"}, pushed ${ago(version.pushedAt, now)}${state}`;
 }
 function flagsPhrase(entry) {
-	if (!entry.enabled) return "";
-	const word = (on) => on ? "on" : "off";
-	return `${word(entry.enabled.development)} in development, ${word(entry.enabled.production)} in production`;
+	if (entry.enabled === null) return "";
+	return entry.enabled ? "on" : "off";
 }
 function livePhrase(entry) {
-	const running = (count, environment) => count === 0 ? [] : [`${count} running in ${environment}`];
-	return [...running(entry.liveExecutions.development, "development"), ...running(entry.liveExecutions.production, "production")].join(", ");
+	return entry.liveExecutions === 0 ? "" : `${entry.liveExecutions} running`;
 }
 function pad(text, width) {
 	return text.padEnd(width);
@@ -11690,11 +11753,9 @@ function statusLines(status, manifest, now) {
 		lines.push("", "On the server and not in this tree:");
 		for (const entry of missing) lines.push(`  ${entry.key}, a ${entry.kind}. Delete it with cow ${entry.kind}s delete ${entry.key}.`);
 	}
-	for (const environment of ["development", "production"]) {
-		const warnings = status.warnings[environment];
-		if (warnings.length === 0) continue;
-		lines.push("", `Names ${environment} does not define yet:`);
-		for (const warning of warnings) lines.push(`  ${warning}`);
+	if (status.warnings.length > 0) {
+		lines.push("", "Names this organization does not define yet:");
+		for (const warning of status.warnings) lines.push(`  ${warning}`);
 	}
 	return lines;
 }
@@ -11889,7 +11950,7 @@ async function runScenario(projectDir, key, scenario) {
 	let error;
 	for (;;) {
 		const output = await runGuest(module, {
-			protocol: 2,
+			protocol: 3,
 			kind: "journey",
 			key,
 			event: trigger,
@@ -11972,32 +12033,6 @@ function registerTest(program, io) {
 
 //#endregion
 //#region src/commands/index.ts
-/**
-* The environment a call acts on: the root `--env`, else `COW_ENVIRONMENT`,
-* else production. The client sets it as the selection header; a command
-* that also needs the value itself reads it from here, so the two can never
-* disagree.
-*/
-function environmentFor(env, opts) {
-	const flag = environmentSchema.safeParse(opts.env);
-	return flag.success ? flag.data : env.COW_ENVIRONMENT ?? "production";
-}
-/**
-* The same value, but only when the caller actually chose one. `cow enable`
-* and `cow disable` change what real recipients get, and the default is
-* production: a bare `cow enable welcome` typed while thinking about
-* development would turn it on in production. A pipeline is unaffected,
-* because `COW_ENVIRONMENT` counts as having chosen.
-*/
-function requireEnvironment(env, opts) {
-	if (opts.env === void 0 && env.COW_ENVIRONMENT === void 0) throw new Error(`Name the environment to act on: --env ${ENVIRONMENTS.join(" or --env ")}, or set COW_ENVIRONMENT.`);
-	return environmentFor(env, opts);
-}
-function parseEnvironment(value) {
-	const parsed = environmentSchema.safeParse(value);
-	if (!parsed.success) throw new InvalidArgumentError(`expected one of ${ENVIRONMENTS.join(", ")}`);
-	return parsed.data;
-}
 /** Every command prints the response envelope as JSON. */
 function emit(result, io, json) {
 	const compact = json === true || !io.isTTY;
@@ -12005,7 +12040,7 @@ function emit(result, io, json) {
 }
 function buildProgram(env, io) {
 	const program = new Command();
-	program.name("cow").description("Admin CLI for Cowliss: a thin client of the dashboard API").option("--api <url>", "API base URL (overrides env and saved config)").option("--env <environment>", `environment to act on: ${ENVIRONMENTS.join(" | ")} (overrides COW_ENVIRONMENT; default ${DEFAULT_ENVIRONMENT})`, parseEnvironment).option("--json", "force compact single-line JSON output").option("--config <file>", `project config to read instead of ${DEFAULT_CONFIG_FILE} (overrides COW_CONFIG)`);
+	program.name("cow").description("Admin CLI for Cowliss: a thin client of the dashboard API").option("--api <url>", "API base URL (overrides env and saved config)").option("--json", "force compact single-line JSON output").option("--config <file>", `project config to read instead of ${DEFAULT_CONFIG_FILE} (overrides COW_CONFIG)`);
 	program.hook("preAction", () => {
 		const flag = program.opts().config;
 		setConfigFile((typeof flag === "string" ? flag : void 0) ?? env.COW_CONFIG ?? "cow.json");
@@ -12015,10 +12050,7 @@ function buildProgram(env, io) {
 		return createClient({
 			baseUrl: resolveApiUrl(env, credentials, typeof opts.api === "string" ? opts.api : void 0, (await readCowConfig(process.cwd()))?.apiUrl),
 			auth: async () => resolveCredential(env, await readCredentials(env)).token,
-			headers: async () => ({
-				[ENVIRONMENT_HEADER]: environmentFor(env, opts),
-				[CLIENT_HEADER]: `@cowliss/cli/${(await readCliPackage()).version}`
-			})
+			headers: async () => ({ [CLIENT_HEADER]: `@cowliss/cli/${(await readCliPackage()).version}` })
 		});
 	};
 	const run = async (opts, fn) => {
@@ -12035,7 +12067,7 @@ function buildProgram(env, io) {
 	registerBuild(program, io);
 	registerPush(program, clientFor, env, io);
 	registerStatus(program, clientFor, io);
-	registerEnable(program, clientFor, env, io);
+	registerEnable(program, clientFor, io);
 	registerPull(program, clientFor, io);
 	registerTest(program, io);
 	registerMcp(program, clientFor, env, io);
@@ -12056,8 +12088,6 @@ const envSchema = z.object({
 	COW_TOKEN: z.string().min(1).optional(),
 	/** An org pipeline key for CI; when set it wins over the cached session (ticket 05 reads it). */
 	COW_PIPELINE_KEY: z.string().min(1).optional(),
-	/** The environment admin calls select; `--env` overrides it, production is the default. */
-	COW_ENVIRONMENT: environmentSchema.optional(),
 	/**
 	* The project config to read instead of `cow.json`, so one checkout can
 	* hold both the committed production config and a local override.