@cowliss/cli 0.5.0 → 0.7.0

package/dist/index.js

@@ -38,24 +38,6 @@ const REQUEST_ID_HEADER = "X-Request-Id";
 */
 const CLERK_ORG_SUBJECT_PREFIX = "org_";
 /**
-* The two fixed environments every org has (spec: Environments). An app
-* belongs to one, so the environment of every write is the app's;
-* profiles, identifiers, events, memberships, journey instances,
-* deliveries, violations, quarantine, the address ledger, and idempotency
-* keys are per environment, while the catalog, sending domains, the
-* suppression mirror, billing, and journey code are shared. A third
-* environment is a one-line change here plus the mirrored db enum.
-*/
-const ENVIRONMENTS = ["development", "production"];
-/** What an admin call gets when it names no environment. */
-const DEFAULT_ENVIRONMENT = "production";
-/**
-* The request header admin endpoints read the environment from; absent
-* means production. Ingestion endpoints ignore it: the environment of a
-* write comes from the app.
-*/
-const ENVIRONMENT_HEADER = "X-Cow-Environment";
-/**
 * The header every Cowliss client names itself in, as
 * `<package>/<version>` (`@cowliss/cli/0.1.0`). The API logs it and reads
 * nothing from it: no behaviour depends on the value, so a caller that
@@ -74,16 +56,6 @@ const ENVIRONMENT_HEADER = "X-Cow-Environment";
 */
 const CLIENT_HEADER = "X-Cow-Client";
 /**
-* Event retention per environment, in days: both the default (what an org
-* gets without setting anything) and the cap (the API refuses more). There
-* is no "forever". Production keeps 18 months; development keeps 30 days,
-* because test traffic is disposable by definition.
-*/
-const EVENT_RETENTION_DAYS = {
-	production: 548,
-	development: 30
-};
-/**
 * The named identifiers a call may carry, a fixed enum grown by code (spec:
 * Identity). `anonymousId` is reserved only in that a profile whose
 * identifiers are all anonymous is labelled anonymous in the dashboard;
@@ -110,30 +82,30 @@ const TOPUP_PRESETS_MICROS = [
 	2e8
 ];
 /**
-* Fixed consent purposes for the prototype. Consent is a per-purpose map on
-* the profile, checked at send-step execution time.
-*
-* The two names describe what the recipient agreed to, not the pipe it
-* arrives on: "emails I did not ask for individually" and "my data leaving
-* for somewhere else". Naming them after the channel (`email`, `webhook`)
-* said nothing a recipient could consent to, and transactional mail already
-* bypasses the email purpose, so it was only ever marketing consent.
-*/
-const CONSENT_PURPOSES = ["emailMarketing", "dataProcessing"];
-/**
 * The marketing purpose by name, since it is the one every gate, the
 * unsubscribe route, and the developer's own toggle all reach for.
 */
-const EMAIL_MARKETING = "emailMarketing";
+const MARKETING = "marketing";
+/**
+* A legal journey `purpose` that is not a consent purpose: the send gates
+* pass it unconditionally, no profile's map stores it and no editor renders
+* it. What protects the channel itself (suppression, the SES gates, the
+* quota) still applies.
+*/
+const TRANSACTIONAL = "transactional";
+/**
+* The purposes a project may not declare, which are the same two that sit
+* outside the `marketing` umbrella: `marketing` is the umbrella itself and
+* `transactional` is the case consent does not govern. Everything a project
+* declares is a marketing-mail category and so sits under it.
+*/
+const RESERVED_PURPOSES = [MARKETING, TRANSACTIONAL];
 /**
 * What a purpose means when the profile's map does not answer it, matching
-* the `profiles.consent` column default: marketing is asked for, everything
-* else about the data the developer already sends is granted.
+* the `profiles.consent` column default: marketing is asked for, never
+* assumed.
 */
-const CONSENT_PURPOSE_DEFAULTS = {
-	emailMarketing: false,
-	dataProcessing: true
-};
+const CONSENT_PURPOSE_DEFAULTS = { marketing: false };
 /**
 * The `defaults` argument `consentGranted` takes, built from an org's
 * purpose rows. Every surface that renders or gates a purpose reads those
@@ -3084,21 +3056,6 @@ const abuseEvents = pgTable("abuse_events", {
 const selectAbuseEventSchema = createSelectSchema(abuseEvents);
 const insertAbuseEventSchema = createInsertSchema(abuseEvents);
 
-//#endregion
-//#region ../../packages/db/src/schema/environments.ts
-/**
-* The two fixed environments every org has. A partition inside the org, not
-* a resource: no table, no ids, no create surface. The environment of a
-* write comes from the app it names (apps carry one), and everything
-* downstream of a write (profiles, identifiers, events, memberships,
-* deliveries, runs, violations, quarantine, the address ledger) is stamped
-* with it.
-*
-* The literal list mirrors ENVIRONMENTS in packages/shared/constants; db
-* cannot import it without closing a package cycle (shared -> db).
-*/
-const environmentEnum = pgEnum("environment", ["development", "production"]);
-
 //#endregion
 //#region ../../packages/db/src/schema/timestamps.ts
 /**
@@ -3134,12 +3091,7 @@ const updatedAt = () => stamp("updated_at").notNull().defaultNow().$onUpdate(()
 /**
 * Apps: the registry of an org's apps/products, and the attribution unit.
 * Everything downstream (ingestion, via the source a payload names;
-* segments, journeys, destinations) validates appIds against this table.
-*
-* An app belongs to exactly one environment, chosen at creation and
-* immutable: the environment of every write is the environment of the
-* app behind the source the payload names, and nothing else carries it.
-* The dev and prod rows of one app are two rows with two names and two ids.
+* segments, journeys, webhooks) validates appIds against this table.
 *
 * The id is readable, `app_<slug>` derived from the name at creation, and
 * unique per org rather than globally: the primary key is (orgId, id), and
@@ -3162,7 +3114,6 @@ const appStatusEnum = pgEnum("app_status", ["active", "archived"]);
 const apps$1 = pgTable("apps", {
 	id: text("id").notNull(),
 	orgId: text("org_id").notNull(),
-	environment: environmentEnum("environment").notNull(),
 	name: text("name").notNull(),
 	status: appStatusEnum("status").notNull().default("active"),
 	createdAt: createdAt(),
@@ -3317,7 +3268,7 @@ const insertCatalogTraitSchema = createInsertSchema(catalogTraits);
 * in their `cow.json`. One read here returns the whole set, so nothing
 * downstream unions a table with a constant.
 *
-* Org-wide rather than per-project or per-environment: `profiles.consent` is
+* Org-wide rather than per-project: `profiles.consent` is
 * one jsonb map per profile, so an answer given under one project is the
 * same answer under the next, and two projects declaring one key must agree
 * on its label and default or the deploy is refused.
@@ -3367,8 +3318,16 @@ const deliveryChannelEnum = pgEnum("delivery_channel", ["email", "webhook"]);
 * nullable. The meter and the quota gate exclude it (packages/delivery's
 * repository), and every per-profile read excludes it by construction,
 * because it has no profile to be found under.
+*
+* `api` is a direct send through the Resend-compatible facade (ADR 0014):
+* no journey and no profile either, addressed to whatever the caller named,
+* and metered exactly like a journey's email.
 */
-const deliveryKindEnum = pgEnum("delivery_kind", ["journey", "test"]);
+const deliveryKindEnum = pgEnum("delivery_kind", [
+	"journey",
+	"test",
+	"api"
+]);
 /**
 * The delivery lifecycle, frozen with the API version.
 *
@@ -3382,6 +3341,10 @@ const deliveryKindEnum = pgEnum("delivery_kind", ["journey", "test"]);
 *   `skipped_suppressed` is the recipient's address sitting in the
 *   suppression mirror, which SES would have bounced off its own
 *   suppression list anyway.
+*   `skipped_unknown_purpose` is the version naming a purpose the
+*   organization does not have, which is a broken manifest rather than a
+*   consent decision: the `error` column names the purpose, and the fix is
+*   another push (ADR 0017).
 * - `would_*` are dry-run outcomes: terminal, never reach SES, and
 *   excluded from feedback, quotas, and reconciliation.
 *
@@ -3398,9 +3361,9 @@ const deliveryStatusEnum = pgEnum("delivery_status", [
 	"skipped_paused",
 	"skipped_suppressed",
 	"skipped_quota",
+	"skipped_unknown_purpose",
 	"skipped_frequency_cap",
 	"skipped_consent",
-	"skipped_sender",
 	"skipped_domain",
 	"skipped_ssrf",
 	"would_send",
@@ -3408,36 +3371,50 @@ const deliveryStatusEnum = pgEnum("delivery_status", [
 	"would_skip_paused",
 	"would_skip_suppressed",
 	"would_skip_quota",
+	"would_skip_unknown_purpose",
 	"would_skip_frequency_cap",
 	"would_skip_consent",
-	"would_skip_sender",
 	"would_skip_domain",
 	"would_skip_ssrf"
 ]);
 const deliveries$1 = pgTable("deliveries", {
 	id: text("id").primaryKey(),
 	orgId: text("org_id").notNull(),
-	/** The instance's environment, stamped from the workflow run input. */
-	environment: environmentEnum("environment").notNull(),
 	/**
 	* The recipient profile (`usr_`); a text column, since a delivery is a
 	* log row and outlives nothing but erasure. Null on a test send, which
-	* goes to the member who asked for it rather than to anyone's profile.
+	* goes to the member who asked for it rather than to anyone's profile,
+	* and on an api send, which names addresses and knows no profile.
 	*/
 	profileId: text("profile_id"),
-	/** The journey that sent this; null on a test send, which has none. */
+	/**
+	* The journey that sent this; null on a test send and on an api send,
+	* neither of which has one.
+	*/
 	journey: text("journey"),
 	kind: deliveryKindEnum("kind").notNull().default("journey"),
-	/** Email template name or webhook destination name. */
+	/**
+	* Email template name or webhook name. An api send that named no
+	* template says `email`: there is a message but no key to point at.
+	*/
 	step: text("step").notNull(),
 	channel: deliveryChannelEnum("channel").notNull(),
 	status: deliveryStatusEnum("status").notNull(),
 	dryRun: boolean("dry_run").notNull().default(false),
 	/**
-	* Recipient email address or destination URL. PII: the logger redacts
-	* this path, so it is stored here and nowhere else.
+	* Recipient email address or webhook URL. An api send to several
+	* addresses records the first `to`; the rest are in the payload. PII:
+	* the logger redacts this path, so it is stored here and nowhere else.
 	*/
 	recipient: text("recipient"),
+	/**
+	* What the send was made of, per kind: a journey or test email holds the
+	* template props (plus `rendered` on a dry run or a test), a webhook
+	* holds its body, and an `api` send holds the caller's envelope as they
+	* spelled it, `{ from, to, cc, bcc, reply_to, subject, headers,
+	* template, variables }`. Never the rendered bodies of a real send: SES
+	* has the message and the log does not keep a second copy.
+	*/
 	payload: jsonb("payload").$type().notNull().default({}),
 	/**
 	* The provider's message id (SES's MessageId), stored so a feedback
@@ -3470,7 +3447,7 @@ const deliveries$1 = pgTable("deliveries", {
 		precision: 3
 	})
 }, (table) => [
-	index("deliveries_org_id_environment_created_at_idx").on(table.orgId, table.environment, table.createdAt),
+	index("deliveries_org_id_created_at_idx").on(table.orgId, table.createdAt),
 	index("deliveries_org_id_profile_id_created_at_idx").on(table.orgId, table.profileId, table.createdAt),
 	uniqueIndex("deliveries_org_id_attempt_key_unique").on(table.orgId, table.attemptKey),
 	uniqueIndex("deliveries_provider_id_unique").on(table.providerId),
@@ -3479,62 +3456,14 @@ const deliveries$1 = pgTable("deliveries", {
 const selectDeliverySchema = createSelectSchema(deliveries$1);
 const insertDeliverySchema = createInsertSchema(deliveries$1);
 
-//#endregion
-//#region ../../packages/db/src/schema/destinations.ts
-/**
-* Destinations: named send targets (webhook URLs, sender identities) that
-* journeys reference by name. Mirrors the apps table conventions: ms
-* precision timestamps for cursor round-trips, one environment chosen at
-* creation and immutable, and name uniqueness per org AND environment, so
-* `crm` can point at the staging receiver in development and at the real one
-* in production. A journey step naming `webhook("crm")` resolves to the row
-* in the instance's environment; the same rule picks the sender identity, of
-* which an org has one per environment.
-*
-* WEBHOOK_PAYLOAD_VERSION (packages/shared) pins the webhook payload shape;
-* the column records the version each destination was created against.
-* signingSecret is the Standard Webhooks signing secret, generated at
-* creation and shown once — the API DTO omits it after the create response.
-*/
-const destinationTypeEnum = pgEnum("destination_type", ["webhook", "sender_identity"]);
-const destinations$1 = pgTable("destinations", {
-	id: text("id").primaryKey(),
-	orgId: text("org_id").notNull(),
-	environment: environmentEnum("environment").notNull(),
-	name: text("name").notNull(),
-	type: destinationTypeEnum("type").notNull(),
-	config: jsonb("config").$type().notNull(),
-	webhookPayloadVersion: integer("webhook_payload_version").notNull().default(1),
-	signingSecret: text("signing_secret"),
-	/**
-	* Auto-disable state, mirroring how receivers treat us: the webhook send
-	* activity bumps the counter once per failed delivery attempt (not once
-	* per Temporal retry) and stamps disabledAt at the threshold. A disabled
-	* destination records `skipped_disabled` until an admin clears it; a
-	* successful delivery resets the counter.
-	*/
-	consecutiveFailures: integer("consecutive_failures").notNull().default(0),
-	disabledAt: timestamp("disabled_at", {
-		withTimezone: true,
-		mode: "date",
-		precision: 3
-	}),
-	createdAt: createdAt(),
-	updatedAt: updatedAt()
-}, (table) => [index("destinations_org_id_idx").on(table.orgId), uniqueIndex("destinations_org_id_environment_name_unique").on(table.orgId, table.environment, table.name)]);
-const selectDestinationSchema = createSelectSchema(destinations$1);
-const insertDestinationSchema = createInsertSchema(destinations$1);
-
 //#endregion
 //#region ../../packages/db/src/schema/email-addresses.ts
 /**
 * The email address ledger (ticket 35): everything Cowliss knows about an
-* address, scoped to the org and environment and keyed by the address
-* rather than the profile. Verification is address-scoped by nature: a
-* profile that changes its email has not verified the new one, and an
-* address verified once stays verified when the same profile comes back to
-* it. Per environment because a verification proven against a development
-* profile says nothing about production.
+* address, scoped to the org and keyed by the address rather than the
+* profile. Verification is address-scoped by nature: a profile that changes
+* its email has not verified the new one, and an address verified once
+* stays verified when the same profile comes back to it.
 *
 * The profile keeps its canonical `email` trait as the address Cowliss sends
 * to, plus the system-maintained `emailVerifiedAt` / `emailVerifiedAddress`
@@ -3552,7 +3481,6 @@ const verificationMethodEnum = pgEnum("verification_method", [
 const emailAddresses = pgTable("email_addresses", {
 	id: text("id").primaryKey(),
 	orgId: text("org_id").notNull(),
-	environment: environmentEnum("environment").notNull(),
 	/** Stored lowercased and trimmed: the mailbox, not the way it was typed. */
 	address: text("address").notNull(),
 	/** Null until something verified the address. */
@@ -3564,45 +3492,10 @@ const emailAddresses = pgTable("email_addresses", {
 	verificationMethod: verificationMethodEnum("verification_method"),
 	createdAt: createdAt(),
 	updatedAt: updatedAt()
-}, (table) => [uniqueIndex("email_addresses_org_env_address_unique").on(table.orgId, table.environment, table.address)]);
+}, (table) => [uniqueIndex("email_addresses_org_address_unique").on(table.orgId, table.address)]);
 const selectEmailAddressSchema = createSelectSchema(emailAddresses);
 const insertEmailAddressSchema = createInsertSchema(emailAddresses);
 
-//#endregion
-//#region ../../packages/db/src/schema/environment-settings.ts
-/**
-* The ingestion policy for catalog governance. Single source of truth:
-* @cowliss/shared/governance derives INGESTION_POLICIES from
-* ingestionPolicyEnum.enumValues, so the enum and the settings contract
-* cannot drift.
-*/
-const ingestionPolicyEnum = pgEnum("ingestion_policy", ["permissive", "strict"]);
-/**
-* Per-environment settings, keyed by org and environment. "No row means
-* every default applies", the same convention as org_settings: a fresh org
-* is zero-config in both environments, and the write path never seeds rows
-* it does not own.
-*
-* `ingestionPolicy`: permissive accepts quarantined (unclassified) names and
-* observes them; strict routes them to the review queue instead of applying
-* them. Development can be strict while production stays lenient.
-*
-* `eventRetentionDays`: the ClickHouse TTL window for the environment's
-* events. Null means the environment's default (18 months in production,
-* 30 days in development, from packages/shared constants); there is no
-* "forever", and the API refuses a value above the environment's cap.
-*/
-const environmentSettings = pgTable("environment_settings", {
-	orgId: text("org_id").notNull(),
-	environment: environmentEnum("environment").notNull(),
-	ingestionPolicy: ingestionPolicyEnum("ingestion_policy").notNull().default("permissive"),
-	eventRetentionDays: integer("event_retention_days"),
-	createdAt: createdAt(),
-	updatedAt: updatedAt()
-}, (table) => [primaryKey({ columns: [table.orgId, table.environment] })]);
-const selectEnvironmentSettingsSchema = createSelectSchema(environmentSettings);
-const insertEnvironmentSettingsSchema = createInsertSchema(environmentSettings);
-
 //#endregion
 //#region ../../packages/db/src/schema/executions.ts
 const executionStatusEnum = pgEnum("execution_status", [
@@ -3615,7 +3508,6 @@ const executionStatusEnum = pgEnum("execution_status", [
 const executions$1 = pgTable("executions", {
 	id: text("id").primaryKey(),
 	orgId: text("org_id").notNull(),
-	environment: environmentEnum("environment").notNull(),
 	/** The journey's key, not a foreign key: derived journey rows come and go with pushes. */
 	journeyKey: text("journey_key").notNull(),
 	profileId: text("profile_id").notNull(),
@@ -3664,9 +3556,9 @@ const executions$1 = pgTable("executions", {
 		precision: 3
 	})
 }, (table) => [
-	index("executions_org_id_environment_version_id_status_idx").on(table.orgId, table.environment, table.versionId, table.status),
-	uniqueIndex("executions_org_id_workflow_id_unique").on(table.orgId, table.workflowId),
-	index("executions_org_id_environment_started_at_idx").on(table.orgId, table.environment, table.startedAt)
+	index("executions_org_id_version_id_status_idx").on(table.orgId, table.versionId, table.status),
+	index("executions_org_id_workflow_id_status_idx").on(table.orgId, table.workflowId, table.status),
+	index("executions_org_id_started_at_idx").on(table.orgId, table.startedAt)
 ]);
 const selectExecutionSchema = createSelectSchema(executions$1);
 const insertExecutionSchema = createInsertSchema(executions$1);
@@ -3725,7 +3617,7 @@ const idempotencyKeys = pgTable("idempotency_keys", {
 //#endregion
 //#region ../../packages/db/src/schema/profiles.ts
 /**
-* Profiles: one row per person per environment. Cowliss generates the id
+* Profiles: one row per person. Cowliss generates the id
 * (`usr_`) and that id is the person key everywhere: workflow ids,
 * ClickHouse rows, segment membership, deliveries, journey runs, erasure.
 * Callers never send it on the write path; they send named identifiers
@@ -3733,15 +3625,11 @@ const idempotencyKeys = pgTable("idempotency_keys", {
 * creating one when none is known.
 *
 * traits is the merged trait bag (RFC 7386 key-level merge on write).
-* consent is the fixed-purpose consent map from the spec. Marketing starts
-* denied and data processing granted: nobody is subscribed by the act of
-* being ingested, while the processing the product runs on is the basis the
-* profile exists under at all. It is written by the identify path (a caller
-* passing `consent`), the consent editor, and the automatic revocations.
-*
-* `environment` is the app's, stamped at creation and never changed: a
-* person in development and a person in production are two rows even when
-* their identifiers match.
+* consent is the per-purpose consent map. Marketing starts denied: nobody
+* is subscribed by the act of being ingested. `transactional` is absent by
+* design (ADR 0017): it is not a purpose anyone may withhold, so it is not
+* stored. The map is written by the identify path (a caller passing
+* `consent`), the consent editor, and the automatic revocations.
 *
 * `mergedInto` is the merge pointer (spec: Identity). Null on a live
 * profile; on a profile a merge folded away it names the survivor, whose
@@ -3756,19 +3644,15 @@ const idempotencyKeys = pgTable("idempotency_keys", {
 const profiles = pgTable("profiles", {
 	id: text("id").primaryKey(),
 	orgId: text("org_id").notNull(),
-	environment: environmentEnum("environment").notNull(),
 	appId: text("app_id").notNull(),
 	sourceId: text("source_id").notNull(),
 	traits: jsonb("traits").$type().notNull().default({}),
-	consent: jsonb("consent").$type().notNull().default({
-		emailMarketing: false,
-		dataProcessing: true
-	}),
+	consent: jsonb("consent").$type().notNull().default({ marketing: false }),
 	mergedInto: text("merged_into"),
 	createdAt: createdAt(),
 	updatedAt: updatedAt()
 }, (table) => [
-	index("profiles_org_id_environment_idx").on(table.orgId, table.environment),
+	index("profiles_org_id_idx").on(table.orgId),
 	index("profiles_merged_into_idx").on(table.mergedInto),
 	foreignKey({
 		columns: [table.mergedInto],
@@ -3804,10 +3688,10 @@ const identifierKindEnum = pgEnum("identifier_kind", [
 ]);
 /**
 * The identifiers map: every named identifier a call has ever carried,
-* pointing at the profile it resolved to. Unique per (org, environment,
-* kind, value), which is what makes "a shared identifier means the same
-* person" enforceable at the row level: the same clerkId in development and
-* production is two people, and the same clerkId twice in production is one.
+* pointing at the profile it resolved to. Unique per (org, kind, value),
+* which is what makes "a shared identifier means the same person"
+* enforceable at the row level: the same clerkId twice in one organization
+* is one person.
 *
 * Rows follow their profile: erasure deletes the profile and these cascade,
 * and a merge re-points them at the survivor.
@@ -3815,12 +3699,11 @@ const identifierKindEnum = pgEnum("identifier_kind", [
 const identifiers = pgTable("identifiers", {
 	id: text("id").primaryKey(),
 	orgId: text("org_id").notNull(),
-	environment: environmentEnum("environment").notNull(),
 	kind: identifierKindEnum("kind").notNull(),
 	value: text("value").notNull(),
 	profileId: text("profile_id").notNull().references(() => profiles.id, { onDelete: "cascade" }),
 	createdAt: createdAt()
-}, (table) => [uniqueIndex("identifiers_org_env_kind_value_unique").on(table.orgId, table.environment, table.kind, table.value), index("identifiers_profile_id_idx").on(table.profileId)]);
+}, (table) => [uniqueIndex("identifiers_org_kind_value_unique").on(table.orgId, table.kind, table.value), index("identifiers_profile_id_idx").on(table.profileId)]);
 const selectIdentifierSchema = createSelectSchema(identifiers);
 const insertIdentifierSchema = createInsertSchema(identifiers);
 
@@ -3846,8 +3729,6 @@ const insertIdentifierSchema = createInsertSchema(identifiers);
 const journeyRuns = pgTable("journey_runs", {
 	id: text("id").primaryKey(),
 	orgId: text("org_id").notNull(),
-	/** The instance's environment; development instances never land here (they bill nothing). */
-	environment: environmentEnum("environment").notNull(),
 	/** The journey's name, not its registry id: the run is about the definition that ran. */
 	journey: text("journey").notNull(),
 	profileId: text("profile_id").notNull(),
@@ -3867,15 +3748,23 @@ const insertJourneyRunSchema = createInsertSchema(journeyRuns);
 //#endregion
 //#region ../../packages/db/src/schema/journeys.ts
 /**
+* The one operational state a manager sets (ADR 0018): `on` (recipients
+* enroll and executions run), `off` (nothing enrolls, executions in flight
+* finish) or `paused` (nothing enrolls, executions in flight hold before
+* their next step). Three values rather than two booleans: a second flag
+* beside the first would spell two combinations that mean nothing.
+*/
+const journeyStatusEnum = pgEnum("journey_status", [
+	"on",
+	"off",
+	"paused"
+]);
+/**
 * Derived journey rows: one per (org, key), upserted from the manifest a
 * push carried. Nothing here is authored through the API, which is why
 * there is no id of its own: the key is the name the author gave the file,
 * and the (org, key) pair is the only identity a journey has.
 *
-* One row for both environments (ADR 0011): the journey's code is its
-* latest ready version, and what differs per environment is the enabled
-* flag alone. A trigger that should fire in both names both of an app's ids.
-*
 * A push only ever adds and updates: it owns the keys its manifest carries
 * and leaves every other row alone, because an org's journeys can come from
 * several projects and a developer may push a project holding only some of
@@ -3883,9 +3772,9 @@ const insertJourneyRunSchema = createInsertSchema(journeyRuns);
 * what makes a key another project owns a refused push rather than a silent
 * overwrite. Removing a journey is an explicit delete (ADR 0009).
 *
-* Whether a journey fires is one flag and one only: journey_states, per
-* environment, which outlives every push, so a push never turns anything on
-* or off. The author has no second gate of their own (ADR 0011).
+* Whether a journey fires is one field and one only: `status`, which a
+* push never writes, so deploying code never turns anything on or off. The
+* author has no second gate of their own (ADR 0011, ADR 0018).
 *
 * The descriptive columns are what its latest ready version reported, so a
 * failed compile leaves both the code and its description as they were.
@@ -3908,65 +3797,73 @@ const journeys$1 = pgTable("journeys", {
 	* the fixed pair.
 	*/
 	purpose: text("purpose").notNull(),
+	/**
+	* The author's own sentence about what the journey does, from the
+	* manifest. Null when they wrote none.
+	*/
+	description: text("description"),
 	spine: jsonb("spine").$type().notNull(),
+	/**
+	* The one gate on the journey: off until `cow enable` or a manager's
+	* control, and never touched by a push (ADR 0011, amended by ADR 0013
+	* and ADR 0018).
+	*/
+	status: journeyStatusEnum("status").notNull().default("off"),
 	createdAt: createdAt(),
 	updatedAt: updatedAt()
 }, (table) => [primaryKey({ columns: [table.orgId, table.key] })]);
 const selectJourneySchema = createSelectSchema(journeys$1);
 const insertJourneySchema = createInsertSchema(journeys$1);
-/**
-* Per-org, per-environment enable state for a journey key; the only
-* operator write on a journey, and the one gate on it. A row exists only
-* once someone turned the journey on or off in that environment: NO ROW
-* MEANS DISABLED (ADR 0011). A push writes none, so a key is off in both
-* environments until `cow enable` or a manager's toggle.
-*
-* Keyed by key rather than by a foreign key into `journeys` on purpose: the
-* flag outlives every push, so it survives a key that temporarily leaves a
-* project and comes back.
-*/
-const journeyStates = pgTable("journey_states", {
-	orgId: text("org_id").notNull(),
-	environment: environmentEnum("environment").notNull(),
-	key: text("key").notNull(),
-	enabled: boolean("enabled").notNull(),
-	createdAt: createdAt(),
-	updatedAt: updatedAt()
-}, (table) => [primaryKey({ columns: [
-	table.orgId,
-	table.environment,
-	table.key
-] })]);
 
 //#endregion
 //#region ../../packages/db/src/schema/org-settings.ts
 /**
-* Per-org settings: what is shared across both environments. A row exists
-* only once something has been set: no row means every default applies,
-* which readers fill in (same convention as journey_states). That keeps a
-* fresh org zero-config and keeps the write path from having to seed rows
-* it does not own.
+* The ingestion policy for catalog governance. Single source of truth:
+* @cowliss/shared/governance derives INGESTION_POLICIES from
+* ingestionPolicyEnum.enumValues, so the enum and the settings contract
+* cannot drift.
+*/
+const ingestionPolicyEnum = pgEnum("ingestion_policy", ["permissive", "strict"]);
+/**
+* Per-org settings. A row exists only once something has been set: no row
+* means every default applies, which readers fill in (same convention as
+* journey_states). That keeps a fresh org zero-config and keeps the write
+* path from having to seed rows it does not own.
 *
-* The per-environment settings (ingestion policy, event retention) live in
-* environment_settings; this row holds the org-wide facts: the sending
-* kill switch, the allowance override, and Clerk's cached profile.
+* Every value here is the organization's:
+* the ingestion policy, the event retention window, the sending kill
+* switch, the allowance override, and Clerk's cached profile.
 *
 * `slug` and `name` are the exception to "only what Cowliss owns": they are
-* Clerk's, cached here by the API's org-sync middleware because the worker
-* has no Clerk client and still has to build the shared fallback sender
-* `<org-slug>@<shared domain>` with the org's name as the from-name.
+* Clerk's, cached here by the API's org-sync middleware, and they are what a
+* template test-send composes its from-address out of (`orgFromAddress`).
 */
 const orgSettings = pgTable("org_settings", {
 	orgId: text("org_id").primaryKey(),
 	/**
 	* The Clerk org's slug and display name, synced by the API on request.
-	* Null until a member of the org has hit the dashboard API once; the
-	* shared fallback sender falls back to an orgId-derived local part and the
-	* tool name until then.
+	* Null until a member of the org has hit the dashboard API once, when
+	* `orgFromAddress` falls back to an orgId-derived local part and the tool
+	* name.
 	*/
 	slug: text("slug"),
 	name: text("name"),
 	/**
+	* Catalog governance: permissive accepts quarantined (unclassified) names
+	* and observes them; strict routes them to the review queue instead of
+	* applying them. One policy for the organization, applied to every write.
+	*/
+	ingestionPolicy: ingestionPolicyEnum("ingestion_policy").notNull().default("permissive"),
+	/**
+	* The ClickHouse TTL window for the org's events, in days. Null means the
+	* default (18 months, EVENT_RETENTION_DAYS.production in
+	* packages/shared); there is no "forever", and the API refuses a value
+	* above that cap. Development events are trimmed at the shorter
+	* development cap whatever this says: the rule is
+	* `effectiveRetentionDays` in packages/shared.
+	*/
+	eventRetentionDays: integer("event_retention_days"),
+	/**
 	* The operator-set monthly free allowance override, in micro-dollars,
 	* synced from the Clerk org's `publicMetadata.freeAllowanceMicros` by the
 	* same org-sync read that caches slug and name. Null (the default) means
@@ -4019,8 +3916,7 @@ const insertOrgSettingsSchema = createInsertSchema(orgSettings);
 /**
 * An org's cow project: the folder a developer runs `cow init` in, and the
 * thing pushes belong to. An org may hold several, one per repo, each with
-* its own release sequence, its own current release per environment, and its
-* own slice of the deployed journey rows. The name is how `cow.json` picks
+* its own release sequence and its own slice of the deployed journey rows. The name is how `cow.json` picks
 * one, so it is unique within the org.
 */
 const projects = pgTable("projects", {
@@ -4086,14 +3982,12 @@ const pushArtifacts = pgTable("push_artifacts", {
 //#endregion
 //#region ../../packages/db/src/schema/violations.ts
 /**
-* Violations: one row per (orgId, environment, kind, name) observed in
-* ingestion that the tracking plan catalog does not define. Observe and
-* flag, never reject: the payload is always written, the violation only
-* records the governance gap. The catalog is org-wide; the sightings are
-* per environment, so a name a dev box invented never shows up as a
-* production violation.
+* Violations: one row per (orgId, kind, name) observed in ingestion that
+* the tracking plan catalog does not define. Observe and flag, never
+* reject: the payload is always written, the violation only records the
+* governance gap.
 *
-* Uniqueness on (orgId, environment, kind, name) dedupes repeat sightings:
+* Uniqueness on (orgId, kind, name) dedupes repeat sightings:
 * an unknown event fired a thousand times is one open violation whose
 * lastSeenAt keeps bumping, not a thousand rows. The payload captures the first observed shape
 * (inferred property types for events, inferred type for traits) so resolve
@@ -4111,7 +4005,6 @@ const violationStatusEnum = pgEnum("violation_status", [
 const violations$1 = pgTable("violations", {
 	id: text("id").primaryKey(),
 	orgId: text("org_id").notNull(),
-	environment: environmentEnum("environment").notNull(),
 	kind: violationKindEnum("kind").notNull(),
 	name: text("name").notNull(),
 	payload: jsonb("payload").$type().notNull(),
@@ -4136,7 +4029,7 @@ const violations$1 = pgTable("violations", {
 		mode: "date",
 		precision: 3
 	})
-}, (table) => [index("violations_org_id_environment_idx").on(table.orgId, table.environment), uniqueIndex("violations_org_env_kind_name_unique").on(table.orgId, table.environment, table.kind, table.name)]);
+}, (table) => [index("violations_org_id_idx").on(table.orgId), uniqueIndex("violations_org_kind_name_unique").on(table.orgId, table.kind, table.name)]);
 const selectViolationSchema = createSelectSchema(violations$1);
 const insertViolationSchema = createInsertSchema(violations$1);
 
@@ -4145,7 +4038,6 @@ const insertViolationSchema = createInsertSchema(violations$1);
 const quarantineEntries = pgTable("quarantine_entries", {
 	id: text("id").primaryKey(),
 	orgId: text("org_id").notNull(),
-	environment: environmentEnum("environment").notNull(),
 	kind: violationKindEnum("kind").notNull(),
 	name: text("name").notNull(),
 	appId: text("app_id").notNull(),
@@ -4159,20 +4051,24 @@ const quarantineEntries = pgTable("quarantine_entries", {
 	}).notNull(),
 	createdAt: createdAt(),
 	updatedAt: updatedAt()
-}, (table) => [index("quarantine_entries_org_kind_name_idx").on(table.orgId, table.kind, table.name), index("quarantine_entries_org_env_created_idx").on(table.orgId, table.environment, table.createdAt)]);
+}, (table) => [index("quarantine_entries_org_kind_name_idx").on(table.orgId, table.kind, table.name), index("quarantine_entries_org_created_idx").on(table.orgId, table.createdAt)]);
 const selectQuarantineEntrySchema = createSelectSchema(quarantineEntries);
 const insertQuarantineEntrySchema = createInsertSchema(quarantineEntries);
 
 //#endregion
 //#region ../../packages/db/src/schema/segments.ts
 /**
-* Segments: dashboard-managed audience definitions. Membership is computed,
-* never hand-maintained: the engine in packages/segments recomputes on every
-* write and materializes the result into segment_members.
+* Segments: membership rules over profiles. Membership is computed, never
+* hand-maintained: the engine in packages/segments recomputes on every write
+* and materializes the result into segment_members.
 *
-* The definition is shared by the org's environments and declares which of
-* them it works on: `environments` defaults to both, and the recompute
-* evaluates a definition only for profiles in a declared environment.
+* A row is either standalone (built in the dashboard, `journey_key` null) or
+* owned by one journey whose trigger inlined its definition (ADR 0016). An
+* owned row is named after its journey's key, is written only by the push,
+* and goes when the journey does — which is what the composite foreign key
+* says: it points at `journeys(org_id, key)` and cascades. A null
+* `journey_key` satisfies it vacuously (MATCH SIMPLE), so standalone rows
+* are unconstrained.
 *
 * Timestamps use millisecond precision, same rationale as apps: JS Dates
 * carry ms only and cursor pagination compares createdAt for equality.
@@ -4183,18 +4079,24 @@ const segments$1 = pgTable("segments", {
 	name: text("name").notNull(),
 	description: text("description"),
 	definition: jsonb("definition").$type().notNull(),
-	/** The environments this definition works on; the enum is the check. */
-	environments: environmentEnum("environments").array().notNull().default(["development", "production"]),
+	/** The journey that owns this row, or null for a standalone segment. */
+	journeyKey: text("journey_key"),
 	createdAt: createdAt(),
 	updatedAt: updatedAt()
-}, (table) => [index("segments_org_id_idx").on(table.orgId), uniqueIndex("segments_org_id_name_unique").on(table.orgId, table.name)]);
+}, (table) => [
+	index("segments_org_id_idx").on(table.orgId),
+	uniqueIndex("segments_org_id_name_unique").on(table.orgId, table.name),
+	foreignKey({
+		columns: [table.orgId, table.journeyKey],
+		foreignColumns: [journeys$1.orgId, journeys$1.key],
+		name: "segments_journey_fk"
+	}).onDelete("cascade")
+]);
 /**
-* Materialized membership: one row per (segment, environment, profile)
-* currently in the segment. Deleting a segment drops its members with it,
-* and erasing a profile drops its memberships, so neither can leave orphaned
-* membership behind. A definition is shared by the environments it declares,
-* so the environment is part of the key: dropping an environment from a
-* definition drops that environment's rows and leaves the other's standing.
+* Materialized membership: one row per (segment, profile) currently in the
+* segment. Deleting a segment drops its members with it, and erasing a
+* profile drops its memberships, so neither can leave orphaned membership
+* behind.
 *
 * The (orgId, profileId) index is the recompute lookup: every write asks
 * "which of this org's segments does this profile currently belong to?"
@@ -4203,19 +4105,13 @@ const segments$1 = pgTable("segments", {
 const segmentMembers = pgTable("segment_members", {
 	segmentId: text("segment_id").notNull().references(() => segments$1.id, { onDelete: "cascade" }),
 	orgId: text("org_id").notNull(),
-	/** The member profile's environment; always the profile's own. */
-	environment: environmentEnum("environment").notNull(),
 	profileId: text("profile_id").notNull().references(() => profiles.id, { onDelete: "cascade" }),
 	enteredAt: timestamp("entered_at", {
 		withTimezone: true,
 		mode: "date",
 		precision: 3
 	}).notNull().defaultNow()
-}, (table) => [primaryKey({ columns: [
-	table.segmentId,
-	table.environment,
-	table.profileId
-] }), index("segment_members_org_id_profile_id_idx").on(table.orgId, table.profileId)]);
+}, (table) => [primaryKey({ columns: [table.segmentId, table.profileId] }), index("segment_members_org_id_profile_id_idx").on(table.orgId, table.profileId)]);
 const selectSegmentSchema = createSelectSchema(segments$1);
 const insertSegmentSchema = createInsertSchema(segments$1);
 
@@ -4231,10 +4127,16 @@ const insertSegmentSchema = createInsertSchema(segments$1);
 * emits no domain events, so the mirror refreshes by pulling
 * `GetEmailIdentity` on a schedule and on the manual re-check button.
 *
-* The unique index on `domain` is GLOBAL, not per org: it is the
-* anti-squatting rule from the spec. Once one org claims a domain string, no
-* other org can claim it, and the cross-org parent/child guard (a query, not
-* a constraint) covers the subdomain half of the same rule.
+* A domain is claimed when it VERIFIES, not when it is added (ADR 0021).
+* Any number of orgs may hold the same unverified string; the partial unique
+* below is what makes at most one of them verified, and so the owner. The
+* cross-org parent/child guard (a query, not a constraint) refuses a claim
+* under or over a name another org already verified.
+*
+* SES keys ONE identity by the domain name, so its DKIM records, and the
+* SUCCESS it reports for them, are shared by every org holding the name.
+* They therefore prove that SOMEBODY controls the DNS, never which org, and
+* `challenge_token` is the part that is per org: the claim needs both.
 */
 /**
 * SES's identity status vocabulary, lower-cased like every other enum here.
@@ -4242,13 +4144,19 @@ const insertSegmentSchema = createInsertSchema(segments$1);
 * all report the same five words. `temporary_failure` is SES's retryable
 * state, which is neither verified nor a dead end, so it is kept distinct
 * from `failed`.
+*
+* `blocked` is the one value SES never says: the DNS checks out, but another
+* organization has already verified this name or a parent or child of it, so
+* the claim cannot be granted here (ADR 0021). It is a terminal-looking
+* state that clears itself, because every refresh re-asks the question.
 */
 const senderDomainStatusEnum = pgEnum("sender_domain_status", [
 	"not_started",
 	"pending",
 	"success",
 	"failed",
-	"temporary_failure"
+	"temporary_failure",
+	"blocked"
 ]);
 const senderDomains = pgTable("sender_domains", {
 	id: text("id").primaryKey(),
@@ -4262,12 +4170,25 @@ const senderDomains = pgTable("sender_domains", {
 	spfStatus: text("spf_status"),
 	/**
 	* The per-domain click-tracking toggle, Cowliss's own setting: the send
-	* picks SES's tracked configuration set when it is on. Off by default
-	* and always off for the shared fallback domain (which has no row here
-	* at all): one setting cannot serve every org sharing it.
+	* picks SES's tracked configuration set when it is on. Off by default:
+	* link rewriting is a thing an org opts into.
 	*/
 	clickTracking: boolean("click_tracking").notNull().default(false),
 	dnsRecords: jsonb("dns_records").$type().notNull().default([]),
+	/**
+	* This org's own proof of control, published as a TXT record under the
+	* domain. Random per row and never re-issued, so two orgs holding the
+	* same name publish different values and only the one that controls the
+	* DNS can publish its own. Verified once, at the moment the claim is
+	* granted; a live sender never loses its domain to one failed lookup.
+	*/
+	challengeToken: text("challenge_token").notNull().default(sql`replace(gen_random_uuid()::text, '-', '')`),
+	/** When this org's own TXT record was last seen. Null until it is. */
+	challengeVerifiedAt: timestamp("challenge_verified_at", {
+		withTimezone: true,
+		mode: "date",
+		precision: 3
+	}),
 	/** When the mirror last asked SES; drives the refresh sweep. */
 	lastCheckedAt: timestamp("last_checked_at", {
 		withTimezone: true,
@@ -4276,7 +4197,11 @@ const senderDomains = pgTable("sender_domains", {
 	}),
 	createdAt: createdAt(),
 	updatedAt: updatedAt()
-}, (table) => [uniqueIndex("sender_domains_domain_unique").on(table.domain), index("sender_domains_org_id_created_at_idx").on(table.orgId, table.createdAt)]);
+}, (table) => [
+	uniqueIndex("sender_domains_org_id_domain_unique").on(table.orgId, table.domain),
+	uniqueIndex("sender_domains_verified_domain_unique").on(table.domain).where(sql`${table.status} = 'success'`),
+	index("sender_domains_org_id_created_at_idx").on(table.orgId, table.createdAt)
+]);
 const selectSenderDomainSchema = createSelectSchema(senderDomains);
 const insertSenderDomainSchema = createInsertSchema(senderDomains);
 
@@ -4287,14 +4212,14 @@ const insertSenderDomainSchema = createInsertSchema(senderDomains);
 * source is a way data reaches it, so "App A via Clerk" and "App A via the
 * SDK" land on the same app and therefore on the same profiles.
 *
-* Every app has exactly one source of kind `api`, the first-party SDK and
-* HTTP path, created with the app. It has an empty config and no credential,
-* and archiving it is the app's ingestion kill switch. Provider kinds sit
-* beside it.
+* Every app has one source of kind `api`, the first-party SDK and HTTP
+* path, created with the app. It has an empty config and no credential, and
+* archiving it is that app's ingestion kill switch. Provider kinds sit
+* beside it, singleton per app.
 *
 * `config` holds the per-kind source configuration and `signingSecret` the
 * credential of the one kind that has one today (Clerk's webhook signing
-* secret), stored write-only (the destinations show-once pattern: never on a
+* secret), stored write-only (the webhooks show-once pattern: never on a
 * DTO). `kind` is immutable after creation; the webhook route dispatches on
 * it. `lastReceivedAt` is stamped per accepted delivery so the dashboard can
 * tell a wired-up source from a silent one.
@@ -4529,20 +4454,44 @@ const selectWalletTopupSchema = createSelectSchema(walletTopups);
 const insertWalletTopupSchema = createInsertSchema(walletTopups);
 
 //#endregion
-//#region ../../packages/shared/src/environments.ts
+//#region ../../packages/db/src/schema/webhooks.ts
 /**
-* The environment on the wire: the source's `environment` field, the
-* `X-Cow-Environment` header admin calls select with, and the
-* `environment` column every per-environment DTO carries.
-*/
-const environmentSchema = z.enum(ENVIRONMENTS);
-/**
-* The environments a shared definition (a segment, a journey) declares it
-* works on: a non-empty list of distinct values. A definition declaring none
-* would be dead code with a row behind it, and a repeated value is a typo
-* rather than an intent, which is the rule `defineJourney` applies too.
+* Webhooks: named URLs that journeys POST to by name. A webhook is the
+* organization's: the name is unique per org, and a journey step naming
+* `webhook("crm")` resolves to the same row for every execution. A developer
+* who wants a local receiver creates a second webhook under another name.
+* Ms-precision timestamps, as everywhere, so a cursor round-trips.
+*
+* WEBHOOK_PAYLOAD_VERSION (packages/shared) pins the webhook payload shape;
+* the column records the version each webhook was created against.
+* signingSecret is the Standard Webhooks signing secret, generated at
+* creation and shown once — the API DTO omits it after the create response.
 */
-const environmentsSchema = z.array(environmentSchema).min(1, "at least one environment is required").refine((values) => new Set(values).size === values.length, { message: "environments must not repeat" });
+const webhooks$1 = pgTable("webhooks", {
+	id: text("id").primaryKey(),
+	orgId: text("org_id").notNull(),
+	name: text("name").notNull(),
+	config: jsonb("config").$type().notNull(),
+	webhookPayloadVersion: integer("webhook_payload_version").notNull().default(1),
+	signingSecret: text("signing_secret"),
+	/**
+	* Auto-disable state, mirroring how receivers treat us: the webhook send
+	* activity bumps the counter once per failed delivery attempt (not once
+	* per Temporal retry) and stamps disabledAt at the threshold. A disabled
+	* webhook records `skipped_disabled` until an admin clears it; a
+	* successful delivery resets the counter.
+	*/
+	consecutiveFailures: integer("consecutive_failures").notNull().default(0),
+	disabledAt: timestamp("disabled_at", {
+		withTimezone: true,
+		mode: "date",
+		precision: 3
+	}),
+	createdAt: createdAt(),
+	updatedAt: updatedAt()
+}, (table) => [index("webhooks_org_id_idx").on(table.orgId), uniqueIndex("webhooks_org_id_name_unique").on(table.orgId, table.name)]);
+const selectWebhookSchema = createSelectSchema(webhooks$1);
+const insertWebhookSchema = createInsertSchema(webhooks$1);
 
 //#endregion
 //#region ../../packages/shared/src/apps.ts
@@ -4553,10 +4502,10 @@ const environmentsSchema = z.array(environmentSchema).min(1, "at least one envir
 * JSON.stringify already emits it for Date values.
 *
 * An app is the attribution unit and nothing else: it carries no kind, no
-* config, and no credential. It belongs to one environment, chosen at
-* creation and immutable. The two extra fields are read-model facts about
-* its sources (see sources.ts), which is what the dashboard's list needs to
-* say whether an app has a pipe wired up without a request per card.
+* config and no credential (its sources carry those, see
+* sources.ts). The two extra fields are read-model facts about those
+* sources, which is what the dashboard's list needs to say whether an app
+* has a pipe wired up without a request per card.
 */
 const appSchema = selectAppSchema.extend({
 	createdAt: z.iso.datetime(),
@@ -4568,11 +4517,7 @@ const appSchema = selectAppSchema.extend({
 	lastReceivedAt: z.iso.datetime().nullable()
 });
 const nameSchema$2 = z.string().trim().min(1, "name is required").max(100, "name must be at most 100 characters");
-const createAppBodySchema = z.object({ data: z.object({
-	name: nameSchema$2,
-	/** Immutable after creation; production when omitted. */
-	environment: environmentSchema.default("production")
-}) });
+const createAppBodySchema = z.object({ data: z.object({ name: nameSchema$2 }) });
 const updateAppBodySchema = z.object({ data: z.object({
 	name: nameSchema$2.optional(),
 	status: z.literal("archived").optional()
@@ -4674,6 +4619,92 @@ const identifierDtoSchema = z.object({
 	createdAt: z.iso.datetime()
 });
 
+//#endregion
+//#region ../../packages/shared/src/segment-definition.ts
+/**
+* A segment definition: a flat list of predicates over traits and event
+* history, combined with `all` or `any`. Deliberately flat — nested predicate groups are YAGNI for the
+* prototype, and a flat list keeps the pure evaluator a fold.
+*
+* `appId` scopes the EVENT side of a definition only. Traits are
+* per-profile and profiles merge across apps, so there is nothing
+* app-shaped to filter on the trait side.
+*
+* A definition and the membership it produces are both the
+* organization's.
+*
+* Apart from `./segments` because a journey's trigger carries a definition
+* and the trigger schema is bundled into the wasm guest, where an edge to
+* `@cowliss/db` (which `./segments` has, for the row schema) is a hard
+* bundler failure. Nothing here imports anything but zod.
+*
+* The object is strict: a definition holding the retired `sourceId` key
+* (which meant the app) fails loudly instead of parsing as an unfiltered
+* definition that evaluates over every app. There is deliberately no pipe
+* filter here — filtering by source is a later feature, and accepting one
+* now would make a stale `sourceId` parse as a filter on a pipe that does
+* not exist and silently match nothing.
+*/
+const SEGMENT_TRAIT_OPS = [
+	"eq",
+	"neq",
+	"gt",
+	"gte",
+	"lt",
+	"lte",
+	"exists",
+	"notExists",
+	"contains"
+];
+/** Operators that read no comparison value: presence of the key is the test. */
+const VALUELESS_TRAIT_OPS = ["exists", "notExists"];
+const predicateNameSchema = z.string().trim().min(1, "predicate name is required").max(200);
+const segmentPredicateSchema = z.discriminatedUnion("kind", [z.object({
+	kind: z.literal("trait"),
+	name: predicateNameSchema,
+	op: z.enum(SEGMENT_TRAIT_OPS),
+	/**
+	* Compared against the stored trait, which is `unknown` because
+	* identify accepts arbitrary JSON. The evaluator coerces both sides
+	* before comparing, so authors here (CLI, MCP, dashboard) get the
+	* form-field-friendly reading rather than strict JSON equality:
+	* numeric-looking strings are compared as numbers for eq/neq and for
+	* ordering ("150" matches 150, and orders like it), and "true"/"false"
+	* are compared as booleans for eq/neq, trimmed and case-insensitively
+	* (" TRUE " reads as true). Coercion needs both sides to agree on a
+	* type: "0" never equals false. The numeric net is as wide as
+	* `Number()`, so "0x64", "0b11" and "1e2" read as numbers too, which
+	* matters most for opaque ids: "007" is authored as the number 7.
+	*
+	* contains reads three ways. Against an array trait it is membership
+	* under that same equality, so "true" matches `[true]` and "1" matches
+	* `[1, 2]`. Against a string trait it is a plain substring search with
+	* no coercion, since substrings only mean something between strings.
+	* Against anything else it never matches. Ordering never coerces
+	* booleans.
+	*/
+	value: z.unknown().optional()
+}), z.object({
+	kind: z.literal("event"),
+	name: predicateNameSchema,
+	op: z.enum(["performed", "notPerformed"]),
+	/** How many matching events the predicate counts as "performed". */
+	atLeast: z.number().int().min(1).default(1),
+	/** Rolling window, relative to evaluation time; absent means all history. */
+	withinDays: z.number().int().min(1).optional()
+})]).refine((predicate) => predicate.kind !== "trait" || VALUELESS_TRAIT_OPS.includes(predicate.op) || predicate.value !== void 0, { message: "value is required unless op is exists or notExists" });
+const appIdSchema = z.string().trim().min(1);
+const segmentDefinitionSchema = z.strictObject({
+	match: z.enum(["all", "any"]).default("all"),
+	/**
+	* Optional app filter over the event side; null/absent spans apps.
+	* A list matches any of the named apps, which is how one definition
+	* names the development and the production id of the same app.
+	*/
+	appId: z.union([appIdSchema, z.array(appIdSchema).min(1)]).nullish(),
+	predicates: z.array(segmentPredicateSchema).min(1, "at least one predicate is required")
+});
+
 //#endregion
 //#region ../../packages/shared/src/journeys-v2/manifest.ts
 /**
@@ -4683,6 +4714,34 @@ const identifierDtoSchema = z.object({
 * changed, and stores that entry on the version it creates.
 */
 /**
+* A duration as journey code writes it: an ms-style string ("2d") or
+* milliseconds. It lives here rather than with the guest protocol because a
+* manifest carries one too (a journey's enrollment cooldown) and `./guest`
+* already imports this module, so the other direction would be a cycle.
+*/
+const durationSchema = z.union([z.string().min(1), z.number().int().nonnegative()]);
+const DURATION_PATTERN = /^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d|w)$/;
+const DURATION_UNIT_MS = {
+	ms: 1,
+	s: 1e3,
+	m: 6e4,
+	h: 36e5,
+	d: 864e5,
+	w: 6048e5
+};
+/**
+* A duration in milliseconds. The simulator's virtual clock and the runner's
+* timers both need it, and neither may pull in Temporal's `msToNumber` (one
+* runs in the CLI, the other inside workflow code).
+*/
+function parseDuration(duration) {
+	if (typeof duration === "number") return duration;
+	const match = DURATION_PATTERN.exec(duration.trim());
+	if (!match) throw new Error(`Duration ${JSON.stringify(duration)} is not a duration: use milliseconds or an ms-style string like "1h" or "2d".`);
+	const unit = DURATION_UNIT_MS[match[2]];
+	return Math.round(Number(match[1]) * unit);
+}
+/**
 * A journey or template key: the file basename under `journeys/` or
 * `emails/`, kebab-case and unique across the project. Becomes part of the
 * Temporal workflow id and travels in the journey chain, so it stays short.
@@ -4703,8 +4762,8 @@ const journeyKeySchema = z.string().max(64).regex(JOURNEY_KEY_PATTERN, "key must
 */
 const tagsSchema = z.array(z.string().trim().min(1).max(50, "a tag must be at most 50 characters")).max(20, "a journey or template takes at most 20 tags").default([]).transform((tags) => [...new Set(tags)]);
 /**
-* A consent purpose key: camelCase, matching the fixed `emailMarketing` and
-* `dataProcessing`. Purposes are keys in the `consent` map a customer reads
+* A consent purpose key: camelCase, matching the reserved `marketing` and
+* `transactional`. Purposes are keys in the `consent` map a customer reads
 * on their own profile, which is why they are not the kebab-case of a
 * journey key.
 */
@@ -4719,22 +4778,22 @@ const CONSENT_PURPOSE_KEY_PATTERN = /^[a-z][a-zA-Z0-9]*$/;
 const consentPurposeKeySchema = z.string().max(50, "a purpose key must be at most 50 characters").regex(CONSENT_PURPOSE_KEY_PATTERN, "a consent purpose key must be camelCase (a letter first, then letters and digits)");
 /**
 * One purpose a project declares in `cow.json` (spec: Decisions). A declared
-* purpose is marketing-class and sits under the `emailMarketing` umbrella,
-* so `denied` is the only default it may carry: the purpose is absent on
-* every profile that already exists, and a granted default would answer for
-* all of them at once.
+* purpose is marketing-class and sits under the `marketing` umbrella, so
+* `denied` is the only default it may carry: the purpose is absent on every
+* profile that already exists, and a granted default would answer for all of
+* them at once.
 *
 * The field stays required rather than disappearing, so every `cow.json` and
-* every stored manifest written before this still parses, and the column
-* behind it still holds `granted` for the seeded `dataProcessing` row: this
-* is a refusal at declaration time, not a narrower storage shape.
+* every stored manifest written before this still parses: this is a refusal
+* at declaration time, not a narrower storage shape.
 *
-* The two fixed purposes cannot be declared. They are seeded for every org
-* and owned by no project, so a project redeclaring one would be renaming
-* the master switch every other project's journeys hang off.
+* Neither reserved purpose can be declared: `marketing` is the master switch
+* every other project's journeys hang off, and `transactional` is not a
+* consent purpose at all, so declaring it would promise a switch that no
+* send ever reads.
 */
 const declaredPurposeSchema = z.strictObject({
-	key: consentPurposeKeySchema.refine((key) => !CONSENT_PURPOSES.includes(key), `${CONSENT_PURPOSES.join(" and ")} are fixed purposes and cannot be declared`),
+	key: consentPurposeKeySchema.refine((key) => !RESERVED_PURPOSES.includes(key), `${RESERVED_PURPOSES.join(" and ")} are reserved purposes and cannot be declared`),
 	/** What the dashboard and the account modal render beside the switch. */
 	label: z.string().trim().min(1).max(50, "a purpose label must be at most 50 characters"),
 	/** What the purpose means for a profile whose map does not answer it. */
@@ -4756,28 +4815,65 @@ const onePatternSchema = z.string().min(1).max(200, "a pattern must be at most 2
 const patternSchema = z.union([onePatternSchema, z.array(onePatternSchema).min(1).max(20, "a matcher takes at most 20 patterns")]);
 /**
 * What starts a journey: an event (optionally narrowed to an app id or a
-* list of them) or a segment entry. The registry DTO in `../journeys`
-* reuses it.
-*
-* Both members are strict, so a journey holding the retired `source` key
-* fails to compile instead of silently triggering on every app.
-* There is deliberately no pipe filter: a trigger narrows by the app the
-* write is attributed to, the same token a segment definition names.
+* list of them), or entry into the segment the trigger itself describes.
+* The registry DTO in `../journeys` reuses it.
+*
+* A segment trigger carries the predicate list, not a name: the push
+* materializes one segment row per journey that inlines a definition, owned
+* by the journey and named after its key, so the segment exists because the
+* journey exists and there is no order to get wrong (ADR 0016). The
+* definition is data — validated here, carried on the version, never
+* compiled and never executed.
+*
+* Both members are strict, so a journey holding the retired `source` key, or
+* the retired `{ segment: "name" }` form, fails to build instead of silently
+* triggering on every app or on nothing. There is deliberately no pipe
+* filter: a trigger narrows by the app the write is attributed to, the same
+* token a segment definition names.
 */
 const triggerSchema = z.union([z.strictObject({
 	event: patternSchema,
 	appId: patternSchema.optional()
-}), z.strictObject({ segment: z.string().min(1) })]);
+}), z.strictObject({ segment: segmentDefinitionSchema })]);
+/**
+* The address half of a from-header: a local part, an `@`, and a dotted
+* domain. Deliberately narrower than RFC 5322 (no quoted local parts, no
+* address literals): every character it refuses would have to be quoted or
+* escaped to survive a header, and none of them belong in an address a
+* journey sends from.
+*/
+const FROM_ADDRESS = /^[^\s@<>",;]+@([^\s@<>",;.]+(?:\.[^\s@<>",;.]+)+)$/;
+/**
+* Parse a journey's or a send's `from`: `addr@domain`, or
+* `Name <addr@domain>` with the name optionally quoted. Null when it is
+* neither, which is what `cow build` refuses on and what the send-time
+* domain gate turns into a skip.
+*
+* One parser, and the send facade reuses it. A control character anywhere is
+* a refusal rather than something to strip: it survives quoting and would
+* inject a second header.
+*/
+function parseFromAddress(from) {
+	const text = from.trim();
+	if (/\p{Cc}/u.test(text)) return null;
+	const angled = /^(.*?)\s*<([^<>]*)>$/.exec(text);
+	const address = (angled?.[2] ?? text).trim();
+	const domain = FROM_ADDRESS.exec(address)?.[1];
+	if (!domain) return null;
+	const name = (angled?.[1] ?? "").trim().replace(/^"(.*)"$/s, "$1").replace(/\\(.)/g, "$1").trim();
+	return {
+		...name ? { name } : {},
+		address,
+		domain: domain.toLowerCase()
+	};
+}
 /**
-* A destination's name: the token a journey addresses it by, in a
-* `send.webhook` call or a journey's `senderIdentity`.
-*
-* Defined here rather than beside the destinations contract, and imported
-* from here by it, because a journey manifest names one and the guest layer
-* is bundled into every tenant module: importing it the other way round
-* would pull the Drizzle destinations table into all of them.
+* The address a journey or one send leaves as: a string, not the name of a
+* configured row (ADR 0014). The domain is checked against the
+* organization's verified ones at push time and again at send time; the
+* shape is all that is checked here, because it is all a build can know.
 */
-const destinationNameSchema = z.string().trim().min(1, "name is required").max(100, "name must be at most 100 characters");
+const fromSchema = z.string().trim().max(200, "from must be at most 200 characters").refine((value) => parseFromAddress(value) !== null, { message: "from must be an address (\"billing@acme.com\") or a name and address (\"Billing <billing@acme.com>\")" });
 /** A content address: `sha256:` plus the lowercase hex digest. */
 const digestSchema = z.string().regex(/^sha256:[0-9a-f]{64}$/, "digest must be sha256:<64 hex>");
 /**
@@ -4813,13 +4909,6 @@ const SPINE_ENTRY_NAMES = [
 const spineEntrySchema = z.object({
 	name: z.enum(SPINE_ENTRY_NAMES),
 	detail: z.string().max(200).optional(),
-	/**
-	* The sender identity a `send.email` call named for itself, overriding
-	* the journey's own. Present only when the author wrote one on the call,
-	* which is what lets the deploy warning and the journey detail page name
-	* the override without re-reading the code.
-	*/
-	senderIdentity: z.string().max(100).optional(),
 	/** A `waitForEvent` timeout, as the author wrote it. */
 	timeout: z.string().max(50).optional(),
 	get steps() {
@@ -4831,10 +4920,10 @@ const spineEntrySchema = z.object({
 }).meta({ id: "JourneySpineEntry" });
 /**
 * One journey in a stored manifest. A plain (non-strict) object on purpose:
-* a manifest pushed before the author's rollout gate went away still carries
-* `environments`, and every stored manifest has to keep parsing for good
-* (ADR 0011). Zod strips the key, and the journey runs wherever the
-* per-environment enabled flag says it runs, which is the one gate there is.
+* a manifest pushed before the author's rollout gate went away still
+* carries keys that no longer exist, and every stored manifest has to keep
+* parsing for good (ADR 0011). Zod strips them, and the journey runs when
+* its `enabled` flag says so, which is the one gate there is.
 */
 const manifestJourneySchema = z.object({
 	key: journeyKeySchema,
@@ -4848,16 +4937,37 @@ const manifestJourneySchema = z.object({
 	*/
 	purpose: consentPurposeKeySchema,
 	/**
-	* The sender identity every `send.email` in this journey goes out as,
-	* unless the call names its own. A name, never a `dst_` id: an org has one
-	* row per environment, so an id would send in production and fail in
-	* development, which is the one thing a journey must not do.
-	*
-	* Optional here and required at `defineJourney`, exactly like `purposes`: a
-	* version pushed before the field existed carries none and its stored
-	* manifest still parses. The author's build is where the error is useful.
+	* How often one recipient may enter. Enrollment derives from the purpose
+	* (ADR 0015), so the only thing an author writes is how long after a
+	* completed run the journey re-opens: absent means once, ever. Refused on
+	* a transactional journey, which enrolls on every trigger — see
+	* `manifestSchema` below, where the cross-field check lives (a refinement
+	* on this object would break the `.pick()` the guest SDK and the guest
+	* protocol both take of it).
 	*/
-	senderIdentity: destinationNameSchema.optional(),
+	enrollment: z.strictObject({ cooldown: durationSchema.refine((value) => {
+		try {
+			parseDuration(value);
+			return true;
+		} catch {
+			return false;
+		}
+	}, "a cooldown must be milliseconds or an ms-style string like \"7d\"") }).optional(),
+	/**
+	* The author's own sentence about what this journey does, shown wherever
+	* the journey is read. Capped like a segment's description; absent when
+	* the author wrote none.
+	*/
+	description: z.string().trim().max(500, `description must be at most ${500} characters`).optional(),
+	/**
+	* The address every `send.email` in this journey goes out as, unless the
+	* call names its own. Required of the author (`defineJourney` types it so,
+	* and `cow build` refuses a journey without it), and still optional here:
+	* releases pushed before ADR 0014 was amended carry none, and this schema
+	* parses stored manifests as well as new ones. A push with no `from` is
+	* refused by the domain gate, which says what to do about it.
+	*/
+	from: fromSchema.optional(),
 	spine: z.array(spineEntrySchema),
 	bundle: digestSchema
 });
@@ -4868,6 +4978,13 @@ const manifestTemplateSchema = z.object({
 	sendClass: z.enum(SEND_CLASSES),
 	/** True asks the host to mint a signed `verifyUrl` prop at send time. */
 	verifyLink: z.boolean(),
+	/**
+	* True asks the host to mint a signed `unsubscribeUrl` prop at send time,
+	* for the author's own footer link. Default false: a marketing send whose
+	* HTML carries no unsubscribe link at all still gets one, appended as a
+	* platform footer, so the link is never the author's to forget.
+	*/
+	unsubscribeLink: z.boolean().default(false),
 	/** JSON Schema of the template's `props`, converted by `cow build`. */
 	propsSchema: z.record(z.string(), z.unknown()),
 	bundle: digestSchema
@@ -4918,6 +5035,15 @@ const manifestSchema = z.object({
 	uniqueKeys(manifest.journeys, ctx, "journeys");
 	uniqueKeys(manifest.templates, ctx, "templates");
 	uniqueKeys(manifest.purposes ?? [], ctx, "purposes");
+	for (const [index, journey] of manifest.journeys.entries()) if (journey.enrollment && journey.purpose === "transactional") ctx.addIssue({
+		code: "custom",
+		message: `journey "${journey.key}": a transactional journey enrolls on every trigger, so it takes no enrollment cooldown`,
+		path: [
+			"journeys",
+			index,
+			"enrollment"
+		]
+	});
 });
 /**
 * One entry of a stored manifest: what a version is a snapshot of. Journeys
@@ -4934,7 +5060,7 @@ const versionManifestSchema = z.union([manifestJourneySchema, manifestTemplateSc
 * further in the future than the clock-skew tolerance (the spec's "future
 * timestamps are rejected with 422" rule). Absent stays valid. Used by the
 * track and identify payload schemas; older-than-retention is a service
-* check (withinRetention) because the window is per environment.
+* check (withinRetention) because the window is the org's setting.
 */
 function notFutureTimestamp(value) {
 	if (value === void 0) return true;
@@ -4981,7 +5107,7 @@ const traitBagSchema = z.custom((value) => value !== null && typeof value === "o
 * `identify` carries it too: the grant has to have a route in through
 * ingestion, or the only thing anyone can express is the revocation.
 */
-const consentPatchSchema = z.partialRecord(consentPurposeKeySchema.meta({ examples: [EMAIL_MARKETING] }), z.boolean()).refine((data) => Object.keys(data).length > 0, { message: "at least one consent purpose is required" });
+const consentPatchSchema = z.partialRecord(consentPurposeKeySchema.meta({ examples: [MARKETING] }), z.boolean()).refine((data) => Object.keys(data).length > 0, { message: "at least one consent purpose is required" });
 /**
 * The identify payload fields, shared between the single-call body schema
 * and the batch item schema (which drops `sourceId`: a batch names one
@@ -5015,7 +5141,6 @@ const identifyBodySchema = z.object({ data: identifyDataSchema });
 const eventDtoSchema = z.object({
 	id: z.string(),
 	orgId: z.string(),
-	environment: environmentSchema,
 	/** The app the event is attributed to: derived from the source. */
 	appId: z.string(),
 	/** The pipe it arrived through: what the caller named on the wire. */
@@ -5052,11 +5177,10 @@ const trackDataSchema = trackFieldsSchema.refine((data) => notFutureTimestamp(da
 });
 const trackBodySchema = z.object({ data: trackDataSchema });
 /**
-* Environment-wide event feed query (GET /v1/events). Same opaque cursor as
+* The org-wide event feed query (GET /v1/events). Same opaque cursor as
 * every other list; the sort key is the event timestamp, newest first, so
 * the cursor's sortAt slot carries an event timestamp here. appId, sourceId
-* and event are exact-match filters, all optional. The environment comes
-* from the selection header, never from the query.
+* and event are exact-match filters, all optional.
 *
 * This is the one place a pipe id is a filter: unlike a stored segment
 * definition, a query param is read-time state, so a stale `?sourceId=` is a
@@ -5076,8 +5200,8 @@ const listEventsQuerySchema = paginationQuerySchema.extend({
 	profileId: z.string().trim().min(1).max(200).optional()
 });
 /**
-* Event stats (GET /v1/events/stats) for the selected environment, the
-* overview page's volume chart and per-app breakdown. `volume` is
+* Event stats (GET /v1/events/stats): the overview page's volume chart and
+* per-app breakdown. `volume` is
 * zero-filled per UTC day over the whole `days` window ending today, so the
 * chart gets a continuous time axis; `byApp` is sorted busiest-first with
 * app names joined in.
@@ -5097,8 +5221,8 @@ const eventStatsDtoSchema = z.object({
 	}))
 });
 /**
-* Per-name activity (GET /v1/events/stats/names) for the selected
-* environment: what the event catalog shows beside each entry. `count` is
+* Per-name activity (GET /v1/events/stats/names): what the event catalog
+* shows beside each entry. `count` is
 * windowed over `days`; `lastSeenAt` is not windowed and is null only for a
 * name that has never been seen, so "quiet for two months" reads as a zero
 * count next to a real date rather than as no history.
@@ -5124,7 +5248,7 @@ const eventNameStatsDtoSchema = z.object({
 * API in one request instead of thousands of round trips.
 *
 * A batch names one source for every item, `{ sourceId, items }`, so it
-* never spans apps and therefore never spans environments. Each item is one
+* never spans apps. Each item is one
 * flattened identify or track call tagged by `type`; the field schemas are
 * the single-call ones minus `sourceId`, so an item valid here is valid
 * there. Batch writes are QUIET in one sense: they skip raw-event journey
@@ -5427,8 +5551,11 @@ const listConsentPurposesQuerySchema = paginationQuerySchema;
 */
 const DELIVERY_CHANNELS = deliveryChannelEnum.enumValues;
 const DELIVERY_STATUSES = deliveryStatusEnum.enumValues;
+/** Why a send happened: a journey ran, a member tested, or a caller sent. */
+const DELIVERY_KINDS = deliveryKindEnum.enumValues;
 const deliveryStatusSchema = z.enum(DELIVERY_STATUSES);
 const deliveryChannelSchema = z.enum(DELIVERY_CHANNELS);
+const deliveryKindSchema = z.enum(DELIVERY_KINDS);
 /**
 * The SNS HTTPS envelope, common to every message SNS POSTs to the feedback
 * endpoint. `Message` is a JSON STRING (the SES event for a `Notification`,
@@ -5528,18 +5655,45 @@ const deliverySchema = selectDeliverySchema.omit({
 	settledAt: z.iso.datetime().nullable()
 });
 /**
-* The message a dry run or a development capture rendered, stored under
-* `payload.rendered` beside the template data. A real send carries no
-* rendering: SES got it, and the log does not keep a second copy.
+* The message a dry run rendered, stored under `payload.rendered` beside the
+* template data, so a developer can read what would have gone out. A real
+* send carries no rendering: SES got it, and the log does not keep a second
+* copy.
 */
 const renderedEmailSchema = z.object({
 	subject: z.string(),
 	html: z.string(),
-	text: z.string()
+	text: z.string(),
+	/**
+	* Where a reply would have gone, when the send named one. Absent on a
+	* test send and wherever none was named, which is replies going to the
+	* from-address.
+	*/
+	replyTo: z.email().optional()
 });
 /** One delivery with the payload the send rendered (GET /v1/deliveries/:id). */
 const deliveryDetailSchema = deliverySchema.extend({ payload: z.object({ rendered: renderedEmailSchema.optional() }).catchall(z.unknown()) });
 /**
+* The `payload` a delivery of kind `api` carries: the envelope the caller of
+* the send facade wrote, and never the bodies (ADR 0014). Every field is
+* optional because the caller named only some of them, and the row is read
+* back through this rather than cast, so a row written by an older shape
+* reads as a message with fields missing instead of one with a type nobody
+* checked.
+*/
+const apiDeliveryPayloadSchema = z.object({
+	from: z.string().optional(),
+	to: z.array(z.string()).optional(),
+	cc: z.array(z.string()).optional(),
+	bcc: z.array(z.string()).optional(),
+	reply_to: z.array(z.string()).optional(),
+	subject: z.string().optional(),
+	headers: z.record(z.string(), z.string()).optional(),
+	/** The template key that wrote the message, and the props it took. */
+	template: z.string().optional(),
+	variables: z.record(z.string(), z.unknown()).optional()
+});
+/**
 * List query for the deliveries log. Every filter is exact-match and
 * optional; combining them ANDs them.
 *
@@ -5553,113 +5707,29 @@ const listDeliveriesQuerySchema = paginationQuerySchema.extend({
 	direction: sortDirectionSchema.default("desc"),
 	status: deliveryStatusSchema.optional(),
 	journey: z.string().trim().min(1).max(200).optional(),
-	/** The template or destination this attempt was for; a template page's own log. */
+	/** The template or webhook this attempt was for; a template page's own log. */
 	step: z.string().trim().min(1).max(200).optional(),
 	channel: deliveryChannelSchema.optional(),
+	/** Why the send happened: a journey, a test send, or a direct API send. */
+	kind: deliveryKindSchema.optional(),
 	appId: z.string().trim().min(1).max(200).optional(),
 	/** One person's deliveries, merged ids included, same as the event feed. */
 	profileId: z.string().trim().min(1).max(200).optional(),
 	/**
 	* Only deliveries touched at or after this instant, by `updatedAt`: the
-	* cursor a tail (`cow dev`) polls with, so a captured send and its later
-	* feedback transition both arrive. Inclusive for the same reason as the
-	* execution filter, and paged the same way: `createdAt` still orders the
-	* page, this only narrows it.
+	* cursor a tail (`cow dev`) polls with, so a send and its later feedback
+	* transition both arrive. Inclusive for the same reason as the execution
+	* filter, and paged the same way: `createdAt` still orders the page, this
+	* only narrows it.
 	*/
 	since: z.iso.datetime().optional()
 });
 
-//#endregion
-//#region ../../packages/shared/src/destinations.ts
-/**
-* Destinations API contracts. Derived from the Drizzle table via drizzle-zod.
-* signingSecret is deliberately absent from the DTO: it is shown exactly
-* once, in the create response (destinationCreatedSchema). consecutiveFailures
-* is absent too: it is the auto-disable counter's internal state, and
-* disabledAt is the part the dashboard banner needs.
-*
-* A destination belongs to one environment, chosen at creation and
-* immutable like a source's, and names are unique per org and environment,
-* so the same name points at a different receiver in each.
-*/
-const destinationSchema = selectDestinationSchema.extend({
-	createdAt: z.iso.datetime(),
-	updatedAt: z.iso.datetime(),
-	disabledAt: z.iso.datetime().nullable()
-}).omit({
-	signingSecret: true,
-	consecutiveFailures: true
-});
-/** The two kinds of destination, from the table's own enum. */
-const destinationTypeSchema = destinationSchema.shape.type;
-const destinationCreatedSchema = destinationSchema.extend({ signingSecret: z.string().optional() });
-const webhookConfigSchema = z.object({ url: z.url("config.url must be a valid URL").refine((url) => {
-	try {
-		return ["http:", "https:"].includes(new URL(url).protocol);
-	} catch {
-		return false;
-	}
-}, { message: "config.url must use http or https" }) });
-/**
-* The address shape only. WHICH domain is allowed is not a static fact: it
-* is the shared fallback domain or one this org has verified, which needs a
-* database read, so the rule lives in the destinations service (write time)
-* and the send gate (send time) instead of here.
-*/
-const senderIdentityConfigSchema = z.object({
-	fromName: z.string().trim().min(1, "config.fromName is required").max(100).refine((name) => !/\p{Cc}/u.test(name), { message: "config.fromName must not contain control characters" }),
-	fromEmail: z.email("config.fromEmail must be a valid email address")
-});
-/**
-* The two destination shapes, named individually so the dashboard's create
-* and edit forms can resolve against exactly one of them. A form knows its
-* type before the user types anything, and zodResolver over a member is
-* what gives react-hook-form a non-union field path to register.
-*/
-const webhookDestinationInputSchema = z.object({
-	name: destinationNameSchema,
-	/** The environment this destination lives in; immutable after creation. */
-	environment: environmentSchema,
-	type: z.literal("webhook"),
-	config: webhookConfigSchema
-});
-const senderIdentityDestinationInputSchema = z.object({
-	name: destinationNameSchema,
-	/** The environment this destination lives in; immutable after creation. */
-	environment: environmentSchema,
-	type: z.literal("sender_identity"),
-	config: senderIdentityConfigSchema
-});
-const createDestinationBodySchema = z.object({ data: z.discriminatedUnion("type", [webhookDestinationInputSchema, senderIdentityDestinationInputSchema]) });
-/**
-* Destination update. `enabled` is the admin's half of the auto-disable
-* loop: the webhook send activity stamps `disabledAt` after enough
-* consecutive failures and every send after that records `skipped_disabled`,
-* so without a way to clear it the only exit would be deleting the
-* destination, which throws away the signing secret the receiver is
-* configured with. `enabled: true` clears the stamp and the failure counter;
-* `enabled: false` is the same switch operated by hand.
-*/
-const updateDestinationBodySchema = z.object({ data: z.object({
-	name: destinationNameSchema.optional(),
-	config: z.unknown().optional(),
-	enabled: z.boolean().optional()
-}).refine((data) => data.name !== void 0 || data.config !== void 0 || data.enabled !== void 0, { message: "at least one field (name, config, or enabled) is required" }) });
-/**
-* `q` is a substring search over the destination's name; `type` narrows to
-* one kind, because the webhooks page and the sender identities section on
-* the domains page each want one and the table holds both.
-*/
-const listDestinationsQuerySchema = paginationQuerySchema.extend({
-	q: searchQuerySchema,
-	type: destinationTypeSchema.optional()
-});
-
 //#endregion
 //#region ../../packages/shared/src/domains.ts
 /**
 * Sending-domain contracts. Derived from the Drizzle table so the row and
-* the DTO cannot drift, same as deliveries, destinations, and suppressions.
+* the DTO cannot drift, same as deliveries, webhooks, and suppressions.
 *
 * Verification itself is SES's; everything here describes the claim and the
 * mirrored answer.
@@ -5683,6 +5753,7 @@ const dnsRecordSchema = z.object({
 /** One sending domain on the wire: dates become ISO 8601 strings. */
 const senderDomainSchema = selectSenderDomainSchema.extend({
 	dnsRecords: z.array(dnsRecordSchema),
+	challengeVerifiedAt: z.iso.datetime().nullable(),
 	lastCheckedAt: z.iso.datetime().nullable(),
 	createdAt: z.iso.datetime(),
 	updatedAt: z.iso.datetime()
@@ -5715,20 +5786,6 @@ const domainDnsSetupSchema = z.object({
 	provider: z.string().nullable()
 });
 
-//#endregion
-//#region ../../packages/shared/src/enabled.ts
-/**
-* The enable flag per environment; absent rows read as off (ADR 0011).
-*
-* Its own module because both `journeys.ts` and `pushes.ts` need it and
-* neither may import the other: a journey carries the flag, and so does the
-* project status a push is read back through.
-*/
-const journeyEnabledSchema = z.object({
-	development: z.boolean(),
-	production: z.boolean()
-});
-
 //#endregion
 //#region ../../packages/shared/src/patterns.ts
 /**
@@ -5819,29 +5876,6 @@ function patternPlaceholder(pattern) {
 * a guest returns with these schemas before anything acts on it; the guest
 * SDK and the Node simulator produce and consume the same shapes.
 */
-/** A duration as journey code writes it: an ms-style string ("2d") or milliseconds. */
-const durationSchema = z.union([z.string().min(1), z.number().int().nonnegative()]);
-const DURATION_PATTERN = /^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d|w)$/;
-const DURATION_UNIT_MS = {
-	ms: 1,
-	s: 1e3,
-	m: 6e4,
-	h: 36e5,
-	d: 864e5,
-	w: 6048e5
-};
-/**
-* A duration in milliseconds. The simulator's virtual clock and the runner's
-* timers both need it, and neither may pull in Temporal's `msToNumber` (one
-* runs in the CLI, the other inside workflow code).
-*/
-function parseDuration(duration) {
-	if (typeof duration === "number") return duration;
-	const match = DURATION_PATTERN.exec(duration.trim());
-	if (!match) throw new Error(`Duration ${JSON.stringify(duration)} is not a duration: use milliseconds or an ms-style string like "1h" or "2d".`);
-	const unit = DURATION_UNIT_MS[match[2]];
-	return Math.round(Number(match[1]) * unit);
-}
 /** The event a journey runs for, or waits on: name, properties, and when. */
 const guestEventSchema = z.object({
 	name: z.string().min(1),
@@ -5856,8 +5890,8 @@ const properties = z.record(z.string(), z.unknown());
 * them. A name outside the union is rejected, never dispatched.
 *
 * Every `args` is strict, and that is the tenancy boundary made mechanical:
-* a module that returns an `orgId`, an `environment`, or any other field
-* beside the ones a capability takes fails the parse instead of having it
+* a module that returns an `orgId` or any other field beside the ones a
+* capability takes fails the parse instead of having it
 * quietly dropped. Tenant context comes from the workflow input, never from
 * guest output, and this is where saying so becomes checkable.
 */
@@ -5879,12 +5913,15 @@ const commandSchema = z.discriminatedUnion("name", [
 			template: journeyKeySchema,
 			props: properties,
 			/**
-			* Which sender identity this mail leaves as, by name. Required, and
-			* the guest SDK fills in the journey's own when the call does not name
-			* one, so the host has one resolution path and never has to read the
-			* manifest to find a sender.
+			* The address this mail leaves as. The guest SDK fills in the
+			* journey's own whenever the call does not name one, so the host has
+			* one resolution path and never reads the manifest to find it. A
+			* journey must name one, so absent on both is a release pushed before
+			* that was true, and the `domain` gate refuses it.
 			*/
-			senderIdentity: destinationNameSchema
+			from: fromSchema.optional(),
+			/** Where a reply to this one mail goes, instead of the from-address. */
+			replyTo: z.email().optional()
 		})
 	}),
 	z.object({
@@ -5965,7 +6002,7 @@ const executionLimitsSchema = z.object({
 	logLineBytes: z.number().int().positive()
 });
 const journeyStepInputSchema = z.object({
-	protocol: z.literal(2),
+	protocol: z.literal(3),
 	kind: z.literal("journey"),
 	key: journeyKeySchema,
 	event: guestEventSchema,
@@ -6005,7 +6042,7 @@ const journeyStepOutputSchema = z.discriminatedUnion("status", [
 	})
 ]);
 const templateRenderInputSchema = z.object({
-	protocol: z.literal(2),
+	protocol: z.literal(3),
 	kind: z.literal("template"),
 	key: journeyKeySchema,
 	props: properties
@@ -6024,11 +6061,14 @@ const manifestInputSchema = z.object({ kind: z.literal("manifest") });
 const manifestOutputSchema = z.discriminatedUnion("kind", [manifestJourneySchema.pick({
 	trigger: true,
 	purpose: true,
-	senderIdentity: true,
+	enrollment: true,
+	description: true,
+	from: true,
 	tags: true
 }).extend({ kind: z.literal("journey") }), manifestTemplateSchema.pick({
 	sendClass: true,
 	verifyLink: true,
+	unsubscribeLink: true,
 	propsSchema: true,
 	tags: true
 }).extend({ kind: z.literal("template") })]);
@@ -6088,7 +6128,7 @@ const executionDetailSchema = executionSchema.extend({
 	logs: z.array(executionLogSchema)
 });
 const listExecutionsQuerySchema = paginationQuerySchema.extend({
-	/** A journey key; the environment comes from the selection header. */
+	/** A journey key. */
 	journey: z.string().trim().min(1).max(200).optional(),
 	/** One version's own runs, for the history rows on a journey. */
 	version: z.string().trim().min(1).max(200).optional(),
@@ -6104,12 +6144,15 @@ const listExecutionsQuerySchema = paginationQuerySchema.extend({
 	since: z.iso.datetime().optional()
 });
 /**
-* What to stop: every live execution of one journey in the selected
-* environment, or the ones still pinned to one version. Cancelling is
-* explicit and per environment (ADR 0011): disabling a journey stops new
-* entries and lets what is running finish, and this is the other verb.
+* What to stop: every live execution of one journey, or the ones still
+* pinned to one version. Cancelling is explicit (ADR 0011): disabling a
+* journey stops new entries and lets what is running finish, and this is
+* the other verb.
 */
-const cancelExecutionsBodySchema = z.object({ data: z.union([z.object({ journey: z.string().trim().min(1).max(200) }), z.object({ version: z.string().trim().min(1).max(200) })]) });
+const cancelExecutionsBodySchema = z.object({ data: z.object({
+	journey: z.string().trim().min(1).max(200).optional(),
+	version: z.string().trim().min(1).max(200).optional()
+}).refine((data) => data.journey === void 0 !== (data.version === void 0), { message: "name a journey or a version, not both" }) });
 /**
 * Cancelling is a request, not an edit: each execution stops when it reaches
 * its next step, so the answer is that the sweep is under way rather than a
@@ -6127,9 +6170,8 @@ const cancellingSchema = z.object({ cancelling: z.literal(true) });
 const projectNameSchema = z.string().trim().min(1).max(200);
 /**
 * `cow.json` (spec: Project layout): the org, and which of its projects this
-* directory is. The environment is always a flag, and auth never lives in
-* the project. Strict, so a typo'd key is a build error rather than a
-* silently ignored setting.
+* directory is. Auth never lives in the project. Strict, so a typo'd key
+* is a build error rather than a silently ignored setting.
 */
 const cowConfigSchema = z.strictObject({
 	$schema: z.url().optional(),
@@ -6238,7 +6280,7 @@ const createPushBodySchema = z.object({ data: z.object({
 	* is a live CLI talking to a live platform, so a mismatch here is a 422
 	* the developer fixes by updating `@cowliss/cli`, and nothing is stored.
 	*/
-	manifest: manifestSchema.safeExtend({ protocol: z.literal(2) }),
+	manifest: manifestSchema.safeExtend({ protocol: z.literal(3) }),
 	/** The `cow.json` project this push belongs to. */
 	project: projectNameSchema
 }) });
@@ -6256,7 +6298,7 @@ const listVersionsQuerySchema = paginationQuerySchema.extend({
 });
 /**
 * One key of a project as `cow status` and the MCP `status` tool report it:
-* the code the server holds for it, whether it is on, and what is still
+* the code the server holds for it, what state it is in, and what is still
 * running. Journeys and templates share the shape, because a developer asks
 * the same question of both; the two fields only a journey has are null on a
 * template.
@@ -6270,13 +6312,14 @@ const projectStatusKeySchema = z.object({
 	* server holds. Null only for a journey whose versions are all pruned.
 	*/
 	latestVersion: versionSchema.nullable(),
-	/** The flag per environment; null on a template, which has none. */
-	enabled: journeyEnabledSchema.nullable(),
-	/** Executions still running or waiting, per environment. */
-	liveExecutions: z.object({
-		development: z.number().int(),
-		production: z.number().int()
-	})
+	/**
+	* The journey's one state; null on a template, which has none. Built from
+	* the column here rather than imported from `journeys.ts`, which reads
+	* this module for its version summary.
+	*/
+	status: z.enum(journeyStatusEnum.enumValues).nullable(),
+	/** Executions still running or waiting. */
+	liveExecutions: z.number().int()
 });
 /**
 * Everything the server knows about one project's keys, in one read: the
@@ -6285,33 +6328,76 @@ const projectStatusKeySchema = z.object({
 * is my project doing" is useless split across cursors.
 *
 * `warnings` is what a deploy used to answer with (ADR 0011 retired the
-* deploy): a name a journey references that the environment does not define
-* yet. They never block, because a segment or a destination may be created
+* deploy): a name a journey references that the organization does not
+* define yet. They never block, because a segment or a webhook may be created
 * right after a push.
 */
 const projectStatusSchema = z.object({
 	project: projectNameSchema,
 	keys: z.array(projectStatusKeySchema),
-	warnings: z.object({
-		development: z.array(z.string()),
-		production: z.array(z.string())
-	})
+	warnings: z.array(z.string())
+});
+
+//#endregion
+//#region ../../packages/shared/src/segments.ts
+const segmentSchema = selectSegmentSchema.extend({
+	definition: segmentDefinitionSchema,
+	createdAt: z.iso.datetime(),
+	updatedAt: z.iso.datetime()
+});
+/** The detail view adds the materialized member count. */
+const segmentDetailSchema = segmentSchema.extend({ memberCount: z.number().int().min(0) });
+const segmentMemberSchema = z.object({
+	segmentId: z.string(),
+	orgId: z.string(),
+	profileId: z.string(),
+	enteredAt: z.iso.datetime()
+});
+/**
+* The builder's design-time sanity check: run one not-yet-persisted
+* definition over the org's existing profiles. Members is a small sample of
+* matching profile ids, not the full member list: there is no segment row
+* and no membership entry, so there is no segmentId or enteredAt to report.
+*
+* The scan is bounded, so `memberCount` is the exact org-wide count only
+* when `truncated` is false. When it is true the scan stopped at the cap,
+* and `memberCount` is the count over the first `scanned` profiles only.
+*/
+const previewSegmentBodySchema = z.object({ data: segmentDefinitionSchema });
+const segmentPreviewSchema = z.object({
+	memberCount: z.number().int().min(0),
+	members: z.array(z.string()),
+	/** Profiles the preview actually evaluated. */
+	scanned: z.number().int().min(0),
+	/** True when the scan hit its cap, so memberCount is a floor. */
+	truncated: z.boolean()
 });
+const nameSchema = z.string().trim().min(1, "name is required").max(100, "name must be at most 100 characters");
+const descriptionSchema = z.string().trim().max(500, `description must be at most ${500} characters`);
+const createSegmentBodySchema = z.object({ data: z.object({
+	name: nameSchema,
+	description: descriptionSchema.nullish(),
+	definition: segmentDefinitionSchema
+}) });
+const updateSegmentBodySchema = z.object({ data: z.object({
+	name: nameSchema.optional(),
+	description: descriptionSchema.nullish(),
+	definition: segmentDefinitionSchema.optional()
+}).refine((data) => data.name !== void 0 || data.description !== void 0 || data.definition !== void 0, { message: "at least one field (name, description or definition) is required" }) });
+/** `q` is a substring search over the segment's name. */
+const listSegmentsQuerySchema = paginationQuerySchema.extend({ q: searchQuerySchema });
+const listSegmentMembersQuerySchema = paginationQuerySchema.extend({});
 
 //#endregion
 //#region ../../packages/shared/src/journeys.ts
 /**
 * Journeys as the API reports them: the rows a push derives from its
 * manifest, one per (org, key). Nothing here is authored through the API, so
-* the only write is the enable flag.
+* the only write is the status.
 *
 * Derived from the Drizzle table via drizzle-zod so the wire DTO and the row
 * share one source of truth; the jsonb columns get explicit wire schemas
-* because the row types are opaque to drizzle-zod. `enabled` is not a
-* column: it is the journey_states value per environment, absent meaning
-* off, and both environments are reported whichever one the caller selected,
-* because "is this on in production?" is the question the list exists to
-* answer.
+* because the row types are opaque to drizzle-zod.
 */
 const journeyTriggerSchema = triggerSchema;
 /**
@@ -6320,11 +6406,19 @@ const journeyTriggerSchema = triggerSchema;
 * control flow is whatever its code does at run time.
 */
 const journeySpineEntrySchema = spineEntrySchema;
+/**
+* The one operational state a manager sets (ADR 0018). `on` lets recipients
+* enroll and executions run; `off` enrolls nobody and lets what is in flight
+* finish; `paused` enrolls nobody and holds what is in flight before its next
+* step. Turning a paused journey on resumes it.
+*/
+const JOURNEY_STATUSES = journeyStatusEnum.enumValues;
+const journeyStatusSchema = z.enum(JOURNEY_STATUSES);
 const journeySchema = selectJourneySchema.extend({
 	trigger: journeyTriggerSchema,
 	purpose: consentPurposeKeySchema,
 	spine: z.array(journeySpineEntrySchema),
-	enabled: journeyEnabledSchema,
+	status: journeyStatusSchema,
 	/**
 	* The newest version of this key, whatever it compiled to, so a list can
 	* say "pushed 2 hours ago" and "compiling" without a second read. What the
@@ -6337,14 +6431,24 @@ const journeySchema = selectJourneySchema.extend({
 	updatedAt: z.iso.datetime()
 });
 /**
+* One journey, with the segment it owns when its trigger inlines a
+* definition (ADR 0016): the same row and member count the segments API
+* reports, so the journey's page can show who is in its segment without a
+* second concept. Null for an event trigger.
+*
+* On the read of one journey only. A list would be one member count per row,
+* and a list already shows the trigger.
+*/
+const journeyDetailSchema = journeySchema.extend({ segment: segmentDetailSchema.nullable() });
+/**
 * Journey list query. `q` is a substring search over the key and the tags,
 * the two things an author names a journey by; `tag` is "has this tag",
 * exact and case-sensitive, so a badge in the table is the way into it.
 * Both are server-side, like every other list filter.
 */
 const listJourneysQuerySchema = paginationQuerySchema.extend({
-	/** On or off in the environment the call selected. */
-	enabled: z.enum(["true", "false"]).optional(),
+	/** On, off or paused; the journey's one state. */
+	status: journeyStatusSchema.optional(),
 	q: z.string().trim().max(200, "q must be at most 200 characters").optional().transform((value) => value ? value : void 0),
 	tag: z.string().trim().max(50, "tag must be at most 50 characters").optional()
 });
@@ -6372,41 +6476,24 @@ const journeyStatsSchema = z.object({
 	deliveries: z.object({ byStatus: z.record(deliveryStatusSchema, z.number().int()) })
 });
 /**
-* A delivery row as the per-user journey timeline reports it. Deliberately
-* narrow: the full delivery DTO and its list contract live with the
-* deliveries log, and this timeline needs only what happened, not the
-* recipient address or the rendered payload.
-*/
-const journeyDeliverySchema = selectDeliverySchema.pick({
-	id: true,
-	journey: true,
-	step: true,
-	channel: true,
-	status: true,
-	dryRun: true,
-	error: true
-}).extend({ createdAt: z.iso.datetime() });
-/** One journey on a user's timeline: the journey, their run, their sends. */
-const userJourneySchema = z.object({
-	journey: journeySchema,
-	/** Null when this user never entered the journey. */
-	execution: executionSchema.nullable(),
-	deliveries: z.array(journeyDeliverySchema)
-});
-const listUserJourneysQuerySchema = paginationQuerySchema;
-/**
-* Which journeys the flag acts on: the keys the caller named, or every
-* journey of one project. Exactly one of the two, because a call carrying
-* both would have to decide which it meant.
+* Which journeys the status acts on, and which state to put them in: the
+* keys the caller named, or every journey of one project. Exactly one of the
+* two selectors, because a call carrying both would have to decide which it
+* meant.
 *
 * A list rather than one key per call so every surface can do what `cow
 * enable` does: name several keys, or `--all` (which is `project`, resolved
 * server-side, so an agent turning a project on is one call too).
+*
+* One body for three states rather than a route per verb (ADR 0018): the
+* transitions differ in what they do to what is in flight, not in who may
+* ask or what they name.
 */
-const setJourneysEnabledBodySchema = z.object({ data: z.object({
+const setJourneysStatusBodySchema = z.object({ data: z.object({
 	keys: z.array(journeyKeySchema).min(1).max(PUSH_LIMITS.journeys).optional(),
 	/** Every journey of this project, by the name `cow.json` carries. */
-	project: projectNameSchema.optional()
+	project: projectNameSchema.optional(),
+	status: journeyStatusSchema
 }).refine((data) => data.keys === void 0 !== (data.project === void 0), { message: "name keys or a project, not both" }) });
 /**
 * Dry run: one real profile, the journey's latest ready version, and every
@@ -6415,6 +6502,106 @@ const setJourneysEnabledBodySchema = z.object({ data: z.object({
 * now and a v1 instance was a Temporal read.
 */
 const dryRunJourneyBodySchema = z.object({ data: z.object({ profileId: z.string().min(1) }) });
+/**
+* Enrollment (ADR 0015): what turning a journey on would do, or is doing,
+* to the people already in its audience.
+*
+* The same three numbers answer both questions, so they are one schema: a
+* preview walks the whole segment counting, and the running job counts the
+* same way as it goes. `scanned` is the segment's current membership,
+* `enrolled` the ones that entered (or in a preview would), and the skips
+* say why the rest did not.
+*/
+const enrollmentCountsSchema = z.object({
+	scanned: z.number().int(),
+	enrolled: z.number().int(),
+	skipped: z.object({
+		/** They have been through this journey, and it enrolls once. */
+		completed: z.number().int(),
+		/** They finished recently and the journey's cooldown has not elapsed. */
+		cooldown: z.number().int(),
+		/** They are in the journey right now. */
+		running: z.number().int()
+	})
+});
+/**
+* How each skip is said to a person, in the order the surfaces list them.
+* The confirm screen, the progress card and `cow enable` all report the same
+* three numbers, and the words for them live here so the three cannot drift:
+* `tile` names the count on its own, `reason` completes "N ...".
+*/
+const ENROLLMENT_SKIP_WORDS = {
+	completed: {
+		tile: "Already been through",
+		reason: "have already been through it"
+	},
+	cooldown: {
+		tile: "Too recently",
+		reason: "went through it too recently"
+	},
+	running: {
+		tile: "In it already",
+		reason: "are in it right now"
+	}
+};
+const enrollmentStatusSchema = enrollmentCountsSchema.extend({ 
+/**
+* `running` while the job works, `done` when it finished the segment,
+* `cancelled` when someone stopped it, `stopped` when the journey itself
+* stopped being on under it, `failed` when it could not finish. On any of
+* the three that end early the counts are what it reached, and the people
+* it already enrolled stay in the journey.
+*/
+state: z.enum([
+	"running",
+	"done",
+	"cancelled",
+	"stopped",
+	"failed"
+]) });
+/**
+* What a journey turned on says about the audience it now has waiting.
+*
+* It rides on the status response rather than being fetched separately so
+* that every surface that moves the control sees it: `cow enable` prints it,
+* and the MCP tool, which is planned from the contract and has no code of
+* its own, returns it. An agent that cannot start the enrollment can still
+* tell the person who can how many people it would reach and where to go.
+*
+* Null on a journey whose trigger is an event: there is no standing audience
+* to reach. `counts` is null when the numbers could not be worked out just
+* then; the journey is on either way, because a count nobody could read is
+* no reason to leave the switch off.
+*/
+const enrollmentOfferSchema = z.object({
+	counts: enrollmentCountsSchema.nullable(),
+	/** The journey's page, where the offer can be accepted. */
+	url: z.string()
+});
+/**
+* A journey as the status route answers, carrying that offer. Null on every
+* status but `on`: a journey turned off or held reaches nobody, so there is
+* no audience to offer.
+*/
+const journeyWithOfferSchema = journeySchema.extend({ enrollment: enrollmentOfferSchema.nullable() });
+/**
+* What holding a journey until a given day would end (ADR 0018). A wait
+* that comes due while the journey is held ends that person's run, so
+* before putting one on hold it is worth knowing how many runs that is.
+*
+* The day is the caller's, not a fixed horizon: "until tomorrow" and "until
+* next month" are different decisions, and the numbers behind them are what
+* tell them apart.
+*/
+const waitsDueQuerySchema = z.object({ 
+/** Count the waits that come due before this instant. */
+before: z.iso.datetime() });
+const waitsDueSchema = z.object({
+	/** Executions in flight whose next step comes due before then. */
+	due: z.number().int(),
+	/** Executions in flight altogether, due or not. */
+	inFlight: z.number().int()
+});
 
 //#endregion
 //#region ../../packages/shared/src/journeys-v2/sandbox.ts
@@ -6444,7 +6631,7 @@ const sandboxFailureCodeSchema = z.enum(SANDBOX_FAILURE_CODES);
 * to be written by hand or by an agent, not generated.
 *
 * The schema lives here rather than in packages/journeys so the CLI can reject
-* a bad file before it boots a Temporal environment, and so the docs site can
+* a bad file before it boots a Temporal dev server, and so the docs site can
 * render the format from one source.
 */
 const journeyScenarioSchema = z.object({
@@ -6515,6 +6702,168 @@ const notificationPreferencesSchema = z.object({ purposes: z.array(notificationP
 */
 const updateNotificationPreferencesBodySchema = z.object({ data: z.object({ purposes: consentPatchSchema }) });
 
+//#endregion
+//#region ../../packages/shared/src/resend.ts
+/** Resend's own cap on one message's recipients, per list. */
+const RESEND_MAX_RECIPIENTS = 50;
+/** Resend's own cap on one batch. */
+const RESEND_MAX_BATCH = 100;
+/** Resend's own cap on a from-header, a subject, and a message's tags. */
+const RESEND_MAX_FROM = 200;
+const RESEND_MAX_SUBJECT = 1e3;
+const RESEND_MAX_TAGS = 50;
+/**
+* One recipient: a bare address or `Name <addr@domain>`, both of which SES
+* takes in a Destination. The same parser the journey path uses, so an
+* address the facade accepts is one a journey could have sent to.
+*/
+const recipientSchema = z.string().trim().max(320).refine((value) => parseFromAddress(value) !== null, { message: "Every recipient must be an address (\"ada@acme.com\") or a name and address (\"Ada <ada@acme.com>\")." });
+const recipientArraySchema = z.array(recipientSchema).min(1).max(50);
+/** Resend takes one address or a list wherever it takes recipients. */
+const recipientsSchema$1 = z.union([recipientSchema, recipientArraySchema]);
+/**
+* Resend's wording for an absent required field. Three fields can be
+* missing: `to`, `subject`, and a body. Which answer each one gets is read
+* off the issue itself, never off this copy, so rewording any of them is
+* safe (see `isMissingField`).
+*/
+const MISSING = (field) => `Missing \`${field}\` field.`;
+/**
+* A field Cowliss does not serve. Declared rather than left to the strict
+* object's "unrecognized key" so the 422 names the field and says what to
+* do instead; the Resend SDK omits an unset one, so only a caller that
+* really passed it is refused.
+*
+* `any` and a refusing check rather than `never`, which the OpenAPI
+* generator has no rendering for.
+*/
+const unsupported = (message) => z.any().refine(() => false, { error: message }).optional();
+/**
+* Resend's template slot, pointing at a Cowliss template key (ADR 0014).
+* `variables` are the template's own props: they are checked by the
+* template, in the sandbox, the same way a test send's are, so anything
+* JSON can carry is accepted here and the template decides.
+*/
+const templateSlotSchema = z.strictObject({
+	id: journeyKeySchema,
+	variables: z.record(z.string(), z.unknown()).optional()
+});
+/** Send body: Resend's fields, minus the ones Cowliss does not serve. */
+const resendSendBodySchema = z.strictObject({
+	/**
+	* Required, exactly as Resend requires it. There is no address to fall
+	* back to: a send leaves from a domain the organization verified, and
+	* nothing else. Missing is its own issue for the same reason `to`'s is.
+	*/
+	from: z.string().trim().max(200).refine((value) => parseFromAddress(value) !== null, { message: "The from address must be an address (\"billing@acme.com\") or a name and address (\"Billing <billing@acme.com>\")." }).optional().nonoptional({ error: MISSING("from") }),
+	/**
+	* Required, and the absence is its own issue rather than the union's:
+	* `optional().nonoptional()` lets the value through to the union when
+	* there is one and answers for undefined itself, which is how
+	* `isMissingField` tells "you left it out" from "you sent the wrong
+	* thing" without reading the message.
+	*/
+	to: z.union([recipientSchema, recipientArraySchema]).optional().nonoptional({ error: MISSING("to") }),
+	/**
+	* Optional in the type and required in practice: a message either
+	* carries its own subject or names a template, which brings one. The
+	* refinement below says which of the two is missing.
+	*/
+	subject: z.string().trim().min(1).max(RESEND_MAX_SUBJECT).optional(),
+	html: z.string().optional(),
+	text: z.string().optional(),
+	cc: recipientsSchema$1.optional(),
+	bcc: recipientsSchema$1.optional(),
+	reply_to: recipientsSchema$1.optional(),
+	headers: z.record(z.string(), z.string()).optional(),
+	/** Accepted and dropped: Cowliss tags a delivery by its own fields. */
+	tags: z.array(z.object({
+		name: z.string(),
+		value: z.string()
+	})).max(50).optional(),
+	attachments: unsupported("Cowliss does not accept attachments. Link to the file from the message instead."),
+	scheduled_at: unsupported("Cowliss does not schedule sends. Send the message when it should arrive, or let a journey's wait step do the waiting."),
+	topic_id: unsupported("Cowliss does not take topics. Consent purposes are where it records what a person agreed to."),
+	template: templateSlotSchema.optional()
+}).superRefine((body, ctx) => {
+	const refuse = (path, message) => ctx.addIssue({
+		code: "custom",
+		path: [path],
+		message
+	});
+	const missing = (path, message) => ctx.addIssue({
+		code: "custom",
+		path: [path],
+		message,
+		params: { missing: true }
+	});
+	if (body.template) {
+		if (body.subject !== void 0) refuse("subject", "The subject comes from the template. Remove `subject`, or write the message yourself with `html` or `text`.");
+		for (const field of ["html", "text"]) if (body[field] !== void 0) refuse(field, `A template brings its own content. Remove \`${field}\`, or drop \`template\` and write the message yourself.`);
+		return;
+	}
+	if (body.subject === void 0) missing("subject", MISSING("subject"));
+	if (body.html === void 0 && body.text === void 0) missing("html", "Missing `html` or `text` field.");
+});
+/**
+* A batch: Resend posts the messages as a bare array, and answers with one
+* id per message in the order they were given. Every message is checked
+* before any of them is sent, so a batch with a mistake in it sends
+* nothing.
+*/
+const resendBatchBodySchema = z.array(resendSendBodySchema, { error: (issue) => Array.isArray(issue.input) ? void 0 : "Send a list of messages." }).min(1, "Send at least one message.").max(100, `A batch takes at most ${100} messages. Split the list and send it in parts.`);
+/** What a send answers: the delivery's id, and nothing else. */
+const resendSentSchema = z.object({ id: z.string() });
+/** What a batch answers: one id per message, in the order they were given. */
+const resendBatchSentSchema = z.object({ data: z.array(resendSentSchema) });
+/**
+* Where a message got to, in Resend's vocabulary. Cowliss emits five of
+* them: a gate skip and a failure are both `failed`, because to a caller
+* they are the same fact, the message did not go.
+*/
+const RESEND_LAST_EVENTS = [
+	"sent",
+	"delivered",
+	"bounced",
+	"complained",
+	"failed"
+];
+/**
+* Resend's email object. `html` and `text` are always null: Cowliss stores
+* no rendered bodies (ADR 0014), and the SDK does not need them to report
+* on a send.
+*/
+const resendEmailSchema = z.object({
+	object: z.literal("email"),
+	id: z.string(),
+	/** The provider's message id; null until the message reaches the provider. */
+	message_id: z.string().nullable(),
+	to: z.array(z.string()),
+	from: z.string(),
+	created_at: z.string(),
+	subject: z.string(),
+	html: z.null(),
+	text: z.null(),
+	bcc: z.array(z.string()),
+	cc: z.array(z.string()),
+	reply_to: z.array(z.string()),
+	last_event: z.enum(RESEND_LAST_EVENTS),
+	scheduled_at: z.null(),
+	tags: z.array(z.object({
+		name: z.string(),
+		value: z.string()
+	}))
+});
+/**
+* Resend's error body. `name` is the machine-readable one, which is what an
+* SDK caller branches on; the message is for the developer reading it.
+*/
+const resendErrorSchema = z.object({
+	statusCode: z.number(),
+	message: z.string(),
+	name: z.string()
+});
+
 //#endregion
 //#region ../../packages/shared/src/violations.ts
 /**
@@ -6614,176 +6963,103 @@ const listReviewQuerySchema = paginationQuerySchema.extend({
 });
 
 //#endregion
-//#region ../../packages/shared/src/segments.ts
+//#region ../../packages/shared/src/send-email.ts
 /**
-* Segments API contracts. The definition is the interesting part: a flat
-* list of predicates over traits and event history, combined with `all` or
-* `any`. Deliberately flat — nested predicate groups are YAGNI for the
-* prototype, and a flat list keeps the pure evaluator a fold.
-*
-* `appId` scopes the EVENT side of a definition only. Traits are
-* per-profile and profiles merge across apps, so there is nothing
-* app-shaped to filter on the trait side.
-*
-* A definition is shared by the environments it declares. `environments`
-* defaults to both, and an app id lives in exactly one environment, so a
-* definition that runs in both names both of an app's ids.
+* `POST /v1/emails`: the first-party transactional send, the one a
+* `@cowliss/sdk` client calls. The Resend-compatible facade (ADR 0014) is
+* the same send in somebody else's wire format; this is ours, so it is
+* camelCase, enveloped, and answers with our error codes.
 *
-* The object is strict: a definition holding the retired `sourceId` key
-* (which meant the app) fails loudly instead of parsing as an unfiltered
-* definition that evaluates over every app. There is deliberately no pipe
-* filter here — filtering by source is a later feature, and accepting one
-* now would make a stale `sourceId` parse as a filter on a pipe that does
-* not exist and silently match nothing.
+* The limits are deliberately the same numbers as the facade's: two shapes
+* over one send path must not accept different messages.
 */
-const SEGMENT_TRAIT_OPS = [
-	"eq",
-	"neq",
-	"gt",
-	"gte",
-	"lt",
-	"lte",
-	"exists",
-	"notExists",
-	"contains"
-];
-/** Operators that read no comparison value: presence of the key is the test. */
-const VALUELESS_TRAIT_OPS = ["exists", "notExists"];
-const predicateNameSchema = z.string().trim().min(1, "predicate name is required").max(200);
-const segmentPredicateSchema = z.discriminatedUnion("kind", [z.object({
-	kind: z.literal("trait"),
-	name: predicateNameSchema,
-	op: z.enum(SEGMENT_TRAIT_OPS),
-	/**
-	* Compared against the stored trait, which is `unknown` because
-	* identify accepts arbitrary JSON. The evaluator coerces both sides
-	* before comparing, so authors here (CLI, MCP, dashboard) get the
-	* form-field-friendly reading rather than strict JSON equality:
-	* numeric-looking strings are compared as numbers for eq/neq and for
-	* ordering ("150" matches 150, and orders like it), and "true"/"false"
-	* are compared as booleans for eq/neq, trimmed and case-insensitively
-	* (" TRUE " reads as true). Coercion needs both sides to agree on a
-	* type: "0" never equals false. The numeric net is as wide as
-	* `Number()`, so "0x64", "0b11" and "1e2" read as numbers too, which
-	* matters most for opaque ids: "007" is authored as the number 7.
-	*
-	* contains reads three ways. Against an array trait it is membership
-	* under that same equality, so "true" matches `[true]` and "1" matches
-	* `[1, 2]`. Against a string trait it is a plain substring search with
-	* no coercion, since substrings only mean something between strings.
-	* Against anything else it never matches. Ordering never coerces
-	* booleans.
-	*/
-	value: z.unknown().optional()
-}), z.object({
-	kind: z.literal("event"),
-	name: predicateNameSchema,
-	op: z.enum(["performed", "notPerformed"]),
-	/** How many matching events the predicate counts as "performed". */
-	atLeast: z.number().int().min(1).default(1),
-	/** Rolling window, relative to evaluation time; absent means all history. */
-	withinDays: z.number().int().min(1).optional()
-})]).refine((predicate) => predicate.kind !== "trait" || VALUELESS_TRAIT_OPS.includes(predicate.op) || predicate.value !== void 0, { message: "value is required unless op is exists or notExists" });
-const appIdSchema = z.string().trim().min(1);
-const segmentDefinitionSchema = z.strictObject({
-	match: z.enum(["all", "any"]).default("all"),
+const addressSchema = z.string().trim().max(320).refine((value) => parseFromAddress(value) !== null, { message: "An address is \"ada@acme.com\" or a name and address, \"Ada <ada@acme.com>\"." });
+/** One address or a list, wherever a message names recipients. */
+const recipientsSchema = z.union([addressSchema, z.array(addressSchema).min(1).max(50)]);
+/** A template this organization pushed, plus the props it declares. */
+const templateSchema$1 = z.strictObject({
+	key: journeyKeySchema,
+	props: z.record(z.string(), z.unknown()).optional()
+});
+const sendEmailDataSchema = z.strictObject({
+	sourceId: z.string(),
+	to: recipientsSchema,
+	cc: recipientsSchema.optional(),
+	bcc: recipientsSchema.optional(),
+	replyTo: recipientsSchema.optional(),
 	/**
-	* Optional app filter over the event side; null/absent spans apps.
-	* A list matches any of the named apps, which is how one definition
-	* names the development and the production id of the same app.
+	* An address on a domain this organization verified. There is no other.
+	* Shape is checked here, the same as the Resend body checks it, so an
+	* address that is not one is a 422 naming the field rather than a 403
+	* telling the caller to verify a domain they never named.
 	*/
-	appId: z.union([appIdSchema, z.array(appIdSchema).min(1)]).nullish(),
-	predicates: z.array(segmentPredicateSchema).min(1, "at least one predicate is required")
-});
-const segmentSchema = selectSegmentSchema.extend({
-	definition: segmentDefinitionSchema,
-	environments: environmentsSchema,
-	createdAt: z.iso.datetime(),
-	updatedAt: z.iso.datetime()
-});
-/** The detail view adds the materialized member count. */
-const segmentDetailSchema = segmentSchema.extend({ memberCount: z.number().int().min(0) });
-const segmentMemberSchema = z.object({
-	segmentId: z.string(),
-	orgId: z.string(),
-	profileId: z.string(),
-	enteredAt: z.iso.datetime()
-});
-/**
-* The builder's design-time sanity check: run one not-yet-persisted
-* definition over the org's existing profiles. Members is a small sample of
-* matching profile ids, not the full member list: there is no segment row
-* and no membership entry, so there is no segmentId or enteredAt to report.
-*
-* The scan is bounded, so `memberCount` is the exact org-wide count only
-* when `truncated` is false. When it is true the scan stopped at the cap,
-* and `memberCount` is the count over the first `scanned` profiles only.
-*/
-const previewSegmentBodySchema = z.object({ data: segmentDefinitionSchema });
-const segmentPreviewSchema = z.object({
-	memberCount: z.number().int().min(0),
-	members: z.array(z.string()),
-	/** Profiles the preview actually evaluated. */
-	scanned: z.number().int().min(0),
-	/** True when the scan hit its cap, so memberCount is a floor. */
-	truncated: z.boolean()
+	from: z.string().trim().max(200).refine((value) => parseFromAddress(value) !== null, { message: "The from address must be an address (\"billing@acme.com\") or a name and address (\"Billing <billing@acme.com>\")." }),
+	subject: z.string().max(RESEND_MAX_SUBJECT).optional(),
+	html: z.string().optional(),
+	text: z.string().optional(),
+	headers: z.record(z.string(), z.string()).optional(),
+	template: templateSchema$1.optional()
+}).superRefine((body, ctx) => {
+	const hasBody = body.html !== void 0 || body.text !== void 0;
+	if (body.template) {
+		for (const field of [
+			"subject",
+			"html",
+			"text"
+		]) if (body[field] !== void 0) ctx.addIssue({
+			code: "custom",
+			path: [field],
+			message: `A message names a template or writes its own body, not both. Drop \`${field}\`.`
+		});
+		return;
+	}
+	if (!hasBody) ctx.addIssue({
+		code: "custom",
+		path: ["html"],
+		message: "A message needs a template, or an html or text body."
+	});
+	if (body.subject === void 0) ctx.addIssue({
+		code: "custom",
+		path: ["subject"],
+		message: "A message that writes its own body needs a subject."
+	});
 });
-const nameSchema = z.string().trim().min(1, "name is required").max(100, "name must be at most 100 characters");
-const descriptionSchema = z.string().trim().max(500, "description must be at most 500 characters");
-const createSegmentBodySchema = z.object({ data: z.object({
-	name: nameSchema,
-	description: descriptionSchema.nullish(),
-	definition: segmentDefinitionSchema,
-	/** The environments the segment works on; both when omitted. */
-	environments: environmentsSchema.default([...ENVIRONMENTS])
-}) });
-const updateSegmentBodySchema = z.object({ data: z.object({
-	name: nameSchema.optional(),
-	description: descriptionSchema.nullish(),
-	definition: segmentDefinitionSchema.optional(),
-	/** Changing this recomputes membership in the newly declared environments. */
-	environments: environmentsSchema.optional()
-}).refine((data) => data.name !== void 0 || data.description !== void 0 || data.definition !== void 0 || data.environments !== void 0, { message: "at least one field (name, description, definition or environments) is required" }) });
-/** `q` is a substring search over the segment's name. */
-const listSegmentsQuerySchema = paginationQuerySchema.extend({ q: searchQuerySchema });
-const listSegmentMembersQuerySchema = paginationQuerySchema;
+const sendEmailBodySchema = z.object({ data: sendEmailDataSchema });
+const sendEmailResultSchema = z.object({ 
+/** The delivery this send left behind: the row in Deliveries. */
+deliveryId: z.string() });
 
 //#endregion
 //#region ../../packages/shared/src/settings.ts
 /**
 * Settings contracts. The two operator-set values, ingestionPolicy (catalog
-* governance) and eventRetentionDays (the ClickHouse TTL window), are per
-* environment: `GET/PATCH /v1/settings/org` read and write the environment
-* the selection header names, and the DTO says which one it is describing.
-* The org's Clerk profile rides along read-only.
+* governance) and eventRetentionDays (the ClickHouse TTL window), are the
+* organization's, one each: `GET/PATCH /v1/settings/org` read and write
+* them. The org's Clerk profile rides along read-only.
 */
 const ingestionPolicySchema = z.enum(INGESTION_POLICIES);
 /**
-* The environment's event retention window in days. Never null: an unset
-* window is the environment's default, and there is no keep-forever. The
-* schema caps at the largest environment's cap; the service enforces the
-* selected environment's own (30 days in development) with a 422.
+* The org's event retention window in days. Never null: an unset window is
+* the default, and there is no keep-forever. Both default and cap are 18
+* months.
 */
-const eventRetentionDaysSchema = z.number().int().min(1).max(Math.max(...Object.values(EVENT_RETENTION_DAYS)));
+const eventRetentionDaysSchema = z.number().int().min(1).max(548);
 const orgSettingsDtoSchema = z.object({
-	/** The environment these values belong to (from the selection header). */
-	environment: environmentSchema,
 	ingestionPolicy: ingestionPolicySchema,
 	eventRetentionDays: eventRetentionDaysSchema,
 	/**
 	* Clerk's slug and display name for the org, cached by the API and
 	* READ-ONLY here: Clerk owns them, and the org profile is edited in
-	* Clerk's own UI. Exposed because they are the shared fallback sender the
-	* domains page shows (`<slug>@<shared domain>` as `<name>`). Null until a
-	* member has hit the dashboard API once.
+	* Clerk's own UI. Exposed because a template test-send composes its
+	* from-address out of them (`orgFromAddress`). Null until a member has hit
+	* the dashboard API once.
 	*/
 	slug: z.string().nullable(),
 	name: z.string().nullable()
 });
 /**
-* Settings patch for the selected environment. Each field is
-* absent-means-no-change. At least one field must be present: an empty
-* patch is a no-op request, not a valid one.
+* Settings patch. Each field is absent-means-no-change. At least one field
+* must be present: an empty patch is a no-op request, not a valid one.
 */
 const updateOrgSettingsBodySchema = z.object({ data: z.object({
 	ingestionPolicy: ingestionPolicySchema.optional(),
@@ -6825,7 +7101,7 @@ const sourceSchema = selectSourceSchema.extend({
 */
 const SOURCE_KINDS = sourceKindEnum.enumValues;
 /**
-* The per-kind source config schemas, mirroring the destinations
+* The per-kind source config schemas, mirroring the webhooks
 * discriminated-union pattern. The `api` source has nothing to configure:
 * ingestion authenticates with the org-level API key, so the row carries no
 * credential of its own. A Clerk source carries only the webhook signing
@@ -6842,7 +7118,7 @@ const apiSourceConfigSchema = z.strictObject({}, { error: "an api source takes n
 const clerkSourceConfigSchema = z.object({ signingSecret: z.string().min(1, "config.signingSecret is required") });
 /**
 * The source shapes, named individually so the dashboard's create form can
-* resolve against exactly one of them (the destinations pattern: a form knows
+* resolve against exactly one of them (the webhooks pattern: a form knows
 * its kind before the user types anything, and zodResolver over a member is
 * what gives react-hook-form a non-union field path to register).
 *
@@ -6874,7 +7150,7 @@ const listSourcesQuerySchema = paginationQuerySchema;
 //#region ../../packages/shared/src/suppressions.ts
 /**
 * The suppression mirror's wire contracts. Derived from the Drizzle table so
-* the row and the DTO cannot drift, same as deliveries and destinations.
+* the row and the DTO cannot drift, same as deliveries and webhooks.
 */
 const SUPPRESSION_TYPES = suppressionTypeEnum.enumValues;
 const suppressionTypeSchema = z.enum(SUPPRESSION_TYPES);
@@ -6897,7 +7173,7 @@ const listSuppressionsQuerySchema = paginationQuerySchema.extend({ q: searchQuer
 //#region ../../packages/shared/src/templates.ts
 /**
 * Templates as the API reports them. A template has versions and nothing
-* else (ADR 0011): no row of its own, no environment, no flag. What is
+* else (ADR 0011): no row of its own, no flag. What is
 * reported here is one key, described by its newest version, plus the
 * journeys whose steps send it.
 *
@@ -6915,6 +7191,12 @@ const templateSchema = z.object({
 	sendClass: z.enum(SEND_CLASSES),
 	/** True when the template asks for a signed `verifyUrl` prop at send time. */
 	verifyLink: z.boolean(),
+	/**
+	* True when the template asks for a signed `unsubscribeUrl` prop at send
+	* time. A marketing template without one (or without rendering the link)
+	* gets a platform footer with the link appended at send time instead.
+	*/
+	unsubscribeLink: z.boolean().default(false),
 	/** JSON Schema of the template's props, as `cow build` converted them. */
 	propsSchema: z.record(z.string(), z.unknown()),
 	/** The newest version of this key, whatever it compiled to. */
@@ -6932,6 +7214,8 @@ const templateSchema = z.object({
 const listTemplatesQuerySchema = paginationQuerySchema.extend({ q: z.string().trim().max(200, "q must be at most 200 characters").optional().transform((value) => value ? value : void 0) });
 /** The props a preview or a test send renders the template with. */
 const renderTemplateBodySchema = z.object({ data: z.object({ props: z.record(z.string(), z.unknown()).default({}) }) });
+/** A test send is a delivery like any other, so it takes the same props. */
+const testSendTemplateBodySchema = z.object({ data: z.object({ props: z.record(z.string(), z.unknown()).default({}) }) });
 /** What the sandbox rendered: the message as it would go out. */
 const templatePreviewSchema = z.object({
 	subject: z.string(),
@@ -6945,9 +7229,8 @@ const templatePreviewSchema = z.object({
 //#region ../../packages/shared/src/users.ts
 /**
 * Users API contracts (dashboard). Profiles are addressed by their
-* Cowliss-generated id (`usr_`), within the environment the selection header
-* names: a profile from the other environment reads as not found. A
-* profile's event history is the event feed filtered to it
+* Cowliss-generated id (`usr_`). A profile's event history is the event
+* feed filtered to it
 * (GET /v1/events?profileId=), not an endpoint of its own.
 */
 /**
@@ -6963,6 +7246,20 @@ const userSegmentSchema = z.object({
 });
 const listUserSegmentsQuerySchema = paginationQuerySchema;
 /**
+* One journey the profile ran to completion
+* (GET /v1/users/:profileId/runs): which journey it was, when it finished,
+* and the execution it finished, which is null once that execution is no
+* longer kept. Paged on (completedAt, id) newest first, so the cursor's
+* sortAt slot carries the completion time.
+*/
+const userRunSchema = z.object({
+	id: z.string(),
+	journeyKey: z.string(),
+	completedAt: z.iso.datetime(),
+	executionId: z.string().nullable()
+});
+const listUserRunsQuerySchema = paginationQuerySchema;
+/**
 * Profile list query. `q` is a free-text substring search over the
 * profile's identifier values and the identity traits in
 * PROFILE_SEARCH_TRAITS; absent means no filter. An empty or
@@ -7039,6 +7336,62 @@ const userExportSchema = z.object({
 	quarantineEntries: z.array(quarantineEntrySchema)
 });
 
+//#endregion
+//#region ../../packages/shared/src/webhooks.ts
+/**
+* Webhooks API contracts. Derived from the Drizzle table via drizzle-zod.
+* signingSecret is deliberately absent from the DTO: it is shown exactly
+* once, in the create response (webhookCreatedSchema). consecutiveFailures
+* is absent too: it is the auto-disable counter's internal state, and
+* disabledAt is the part the dashboard banner needs.
+*
+* A webhook is the organization's: the name is unique per org, and every
+* execution posts to the same row.
+*/
+/**
+* A webhook's name: the token a journey addresses it by, in a `send.webhook`
+* call. The journey names a string and the server resolves it, so the two
+* ends only have to agree on the characters that fit in one.
+*/
+const webhookNameSchema = z.string().trim().min(1, "name is required").max(100, "name must be at most 100 characters");
+const webhookConfigSchema = z.object({ url: z.url("config.url must be a valid URL").refine((url) => {
+	try {
+		return ["http:", "https:"].includes(new URL(url).protocol);
+	} catch {
+		return false;
+	}
+}, { message: "config.url must use http or https" }) });
+const webhookSchema = selectWebhookSchema.extend({
+	config: webhookConfigSchema,
+	createdAt: z.iso.datetime(),
+	updatedAt: z.iso.datetime(),
+	disabledAt: z.iso.datetime().nullable()
+}).omit({
+	signingSecret: true,
+	consecutiveFailures: true
+});
+const webhookCreatedSchema = webhookSchema.extend({ signingSecret: z.string() });
+const createWebhookBodySchema = z.object({ data: z.object({
+	name: webhookNameSchema,
+	config: webhookConfigSchema
+}) });
+/**
+* Webhook update. `enabled` is the admin's half of the auto-disable loop:
+* the webhook send activity stamps `disabledAt` after enough consecutive
+* failures and every send after that records `skipped_disabled`, so without
+* a way to clear it the only exit would be deleting the webhook, which
+* throws away the signing secret the receiver is configured with.
+* `enabled: true` clears the stamp and the failure counter; `enabled: false`
+* is the same switch operated by hand.
+*/
+const updateWebhookBodySchema = z.object({ data: z.object({
+	name: webhookNameSchema.optional(),
+	config: webhookConfigSchema.optional(),
+	enabled: z.boolean().optional()
+}).refine((data) => data.name !== void 0 || data.config !== void 0 || data.enabled !== void 0, { message: "at least one field (name, config, or enabled) is required" }) });
+/** `q` is a substring search over the webhook's name. */
+const listWebhooksQuerySchema = paginationQuerySchema.extend({ q: searchQuerySchema });
+
 //#endregion
 //#region ../../packages/api-client/src/client.ts
 var ApiError = class extends Error {
@@ -7222,7 +7575,7 @@ function readCliPackage() {
 * are. Reading the code sees every branch, labelled with its condition.
 *
 * What it reads: `await api.*` calls (in source order, with the literal
-* template, destination, event, key, or duration when the author wrote one
+* template, webhook, event, key, or duration when the author wrote one
 * inline), `if`/`else`, `switch`, loops, `try`/`catch`, `return`, `throw`, and
 * `api.restart()`. Calls behind a helper function in another file, and a
 * `run` that is not an inline function on the `defineJourney` object, are
@@ -7433,12 +7786,9 @@ var Reader = class {
 				if (timeout) entry.timeout = timeout;
 				break;
 			}
-			case "send.email": {
+			case "send.email":
 				detail(this.property(first, "template"));
-				const sender = this.property(first, "senderIdentity");
-				if (sender) entry.senderIdentity = sender;
 				break;
-			}
 			case "send.webhook":
 				detail(this.property(first, "destination"));
 				break;
@@ -7990,8 +8340,13 @@ async function buildProject(projectDir) {
 	const manifestJourneys = [];
 	const manifestTemplates = [];
 	for (const built of bundles) {
-		const { module, runGuest } = await loadNodeBundle(projectDir, built.source.key, built.source.kind);
-		const report = await runGuest(module, { kind: "manifest" });
+		let report;
+		try {
+			const { module, runGuest } = await loadNodeBundle(projectDir, built.source.key, built.source.kind);
+			report = await runGuest(module, { kind: "manifest" });
+		} catch (error) {
+			throw new Error(`${built.source.relPath}: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+		}
 		const isJourney = built.source.kind === "journeys";
 		if (report?.kind !== (isJourney ? "journey" : "template")) throw new Error(`${built.source.relPath} is not a ${isJourney ? "journey" : "template"}: a journey default-exports defineJourney({ ... }), a template exports a component and a zod \`props\` schema.`);
 		if (report.kind === "journey") manifestJourneys.push({
@@ -7999,7 +8354,9 @@ async function buildProject(projectDir) {
 			tags: report.tags,
 			trigger: report.trigger,
 			purpose: report.purpose,
-			senderIdentity: report.senderIdentity,
+			enrollment: report.enrollment,
+			description: report.description,
+			from: report.from,
 			spine: readSpine(await readFile(built.source.file, "utf8")),
 			bundle: built.digest
 		});
@@ -8008,6 +8365,7 @@ async function buildProject(projectDir) {
 			tags: report.tags,
 			sendClass: report.sendClass,
 			verifyLink: report.verifyLink,
+			unsubscribeLink: report.unsubscribeLink,
 			propsSchema: report.propsSchema,
 			bundle: built.digest
 		});
@@ -8025,7 +8383,7 @@ async function buildProject(projectDir) {
 	});
 	if (failure) throw new Error(failure);
 	const manifest = manifestSchema.parse({
-		protocol: 2,
+		protocol: 3,
 		sdk: (await readCliPackage()).version,
 		journeys: manifestJourneys,
 		templates: manifestTemplates,
@@ -8330,7 +8688,7 @@ function openBrowser(url) {
 //#region src/commands/auth.ts
 /** login/logout/whoami: session-token management, no contract route. */
 function registerAuth(program, env, io) {
-	program.command("login").description("authenticate via the dashboard browser flow (or --token) and cache the session token").option("--token <jwt>", "paste a Clerk session token instead of the browser flow").option("--web <url>", `dashboard URL; overrides COW_WEB_URL and webUrl in the project config (default ${DEFAULT_WEB_URL})`).option("--no-open", "do not open the browser; print the URL and wait (headless/agent use)").action(async (opts) => {
+	program.command("login").description("authenticate via the dashboard browser flow (or --token) and cache the session token").option("--token <jwt>", "paste a session token instead of the browser flow").option("--web <url>", `dashboard URL; overrides COW_WEB_URL and webUrl in the project config (default ${DEFAULT_WEB_URL})`).option("--no-open", "do not open the browser; print the URL and wait (headless/agent use)").action(async (opts) => {
 		const outcome = await login(env, {
 			token: opts.token,
 			webUrl: opts.web,
@@ -9240,106 +9598,33 @@ const deliveries = defineModule(defineRoute({
 	* The confirmation page's second button, "stop all marketing
 	* email": the same token, revoking the master purpose instead of
 	* the one the mail was sent under. A flag rather than a second
-	* route, because the claim already names the org and the profile.
-	* The List-Unsubscribe header never carries it, so a mail client's
-	* one-click POST stops one purpose, as RFC 8058 intends.
-	*/
-all: z.literal("1").optional() }) },
-	responses: {
-		200: htmlResponse("Confirmation page"),
-		400: { description: "Invalid or incomplete unsubscribe link" }
-	}
-}), defineRoute({
-	method: "get",
-	path: "/v1/unsubscribe",
-	operationId: "deliveries.unsubscribePage",
-	tags: ["deliveries"],
-	summary: "Unsubscribe confirmation page (public)",
-	security: NO_AUTH,
-	surfaces: HIDDEN_FROM_TOOLS,
-	request: { query: tokenQuery },
-	responses: {
-		200: htmlResponse("The page offering the unsubscribe"),
-		400: { description: "Invalid or incomplete unsubscribe link" }
-	}
-}));
-
-//#endregion
-//#region ../../packages/shared/src/contract/destinations.ts
-const params$9 = z.object({ id: z.string() });
-const destinations = defineModule(defineRoute({
-	method: "post",
-	path: "/v1/destinations",
-	operationId: "destinations.create",
-	tags: ["destinations"],
-	summary: "Create a destination",
-	security: SESSION_AUTH,
-	request: { body: jsonBody(createDestinationBodySchema) },
-	responses: {
-		201: envelope(destinationCreatedSchema, "The created destination; the only response carrying the signing secret"),
-		...sessionErrors,
-		...errors("validation_failed", "malformed_request")
-	}
-}), defineRoute({
-	method: "get",
-	path: "/v1/destinations",
-	operationId: "destinations.list",
-	tags: ["destinations"],
-	summary: "List destinations in the selected environment",
-	security: SESSION_AUTH,
-	request: { query: listDestinationsQuerySchema },
+	* route, because the claim already names the org and the profile.
+	* The List-Unsubscribe header never carries it, so a mail client's
+	* one-click POST stops one purpose, as RFC 8058 intends.
+	*/
+all: z.literal("1").optional() }) },
 	responses: {
-		200: list(destinationSchema),
-		...sessionErrors,
-		...errors("validation_failed")
+		200: htmlResponse("Confirmation page"),
+		400: { description: "Invalid or incomplete unsubscribe link" }
 	}
 }), defineRoute({
 	method: "get",
-	path: "/v1/destinations/{id}",
-	operationId: "destinations.get",
-	tags: ["destinations"],
-	summary: "Fetch one destination",
-	security: SESSION_AUTH,
-	request: { params: params$9 },
-	responses: {
-		200: envelope(destinationSchema),
-		...sessionErrors,
-		...errors("not_found")
-	}
-}), defineRoute({
-	method: "patch",
-	path: "/v1/destinations/{id}",
-	operationId: "destinations.update",
-	tags: ["destinations"],
-	summary: "Update a destination",
-	security: SESSION_AUTH,
-	request: {
-		params: params$9,
-		body: jsonBody(updateDestinationBodySchema)
-	},
-	responses: {
-		200: envelope(destinationSchema),
-		...sessionErrors,
-		...errors("not_found", "validation_failed", "malformed_request")
-	}
-}), defineRoute({
-	method: "delete",
-	path: "/v1/destinations/{id}",
-	operationId: "destinations.delete",
-	tags: ["destinations"],
-	summary: "Delete a destination",
-	security: SESSION_AUTH,
-	request: { params: params$9 },
+	path: "/v1/unsubscribe",
+	operationId: "deliveries.unsubscribePage",
+	tags: ["deliveries"],
+	summary: "Unsubscribe confirmation page (public)",
+	security: NO_AUTH,
+	surfaces: HIDDEN_FROM_TOOLS,
+	request: { query: tokenQuery },
 	responses: {
-		200: envelope(deletedSchema),
-		...sessionErrors,
-		...errors("not_found")
+		200: htmlResponse("The page offering the unsubscribe"),
+		400: { description: "Invalid or incomplete unsubscribe link" }
 	}
 }));
 
 //#endregion
 //#region ../../packages/shared/src/contract/domains.ts
-const params$8 = z.object({ id: z.string() });
+const params$9 = z.object({ id: z.string() });
 const domains = defineModule(defineRoute({
 	method: "get",
 	path: "/v1/domains",
@@ -9360,7 +9645,7 @@ const domains = defineModule(defineRoute({
 	tags: ["domains"],
 	summary: "Fetch one sending domain",
 	security: SESSION_AUTH,
-	request: { params: params$8 },
+	request: { params: params$9 },
 	responses: {
 		200: envelope(senderDomainSchema),
 		...sessionErrors,
@@ -9371,11 +9656,11 @@ const domains = defineModule(defineRoute({
 	path: "/v1/domains",
 	operationId: "domains.create",
 	tags: ["domains"],
-	summary: "Claim a sending domain",
+	summary: "Add a sending domain",
 	security: SESSION_AUTH,
 	request: { body: jsonBody(createSenderDomainBodySchema) },
 	responses: {
-		201: envelope(senderDomainSchema, "The claimed domain with the DNS records to publish"),
+		201: envelope(senderDomainSchema, "The domain with the DNS records to publish, which is what claims it"),
 		...sessionErrors,
 		...errors("conflict", "validation_failed", "malformed_request", "dependency_unavailable")
 	}
@@ -9388,7 +9673,7 @@ const domains = defineModule(defineRoute({
 	description: "The Domain Connect link for this domain's DNS provider, which shows the admin the records and asks them to confirm. `url` is null when the provider does not support it.",
 	security: SESSION_AUTH,
 	surfaces: HIDDEN_FROM_TOOLS,
-	request: { params: params$8 },
+	request: { params: params$9 },
 	responses: {
 		200: envelope(domainDnsSetupSchema),
 		...sessionErrors,
@@ -9401,7 +9686,7 @@ const domains = defineModule(defineRoute({
 	tags: ["domains"],
 	summary: "Re-check DNS now",
 	security: SESSION_AUTH,
-	request: { params: params$8 },
+	request: { params: params$9 },
 	responses: {
 		200: envelope(senderDomainSchema),
 		...sessionErrors,
@@ -9415,7 +9700,7 @@ const domains = defineModule(defineRoute({
 	summary: "Toggle click tracking",
 	security: SESSION_AUTH,
 	request: {
-		params: params$8,
+		params: params$9,
 		body: jsonBody(updateSenderDomainBodySchema)
 	},
 	responses: {
@@ -9428,9 +9713,9 @@ const domains = defineModule(defineRoute({
 	path: "/v1/domains/{id}",
 	operationId: "domains.delete",
 	tags: ["domains"],
-	summary: "Give up a domain claim",
+	summary: "Give up a sending domain",
 	security: SESSION_AUTH,
-	request: { params: params$8 },
+	request: { params: params$9 },
 	responses: {
 		200: envelope(deletedSchema),
 		...sessionErrors,
@@ -9440,8 +9725,31 @@ const domains = defineModule(defineRoute({
 
 //#endregion
 //#region ../../packages/shared/src/contract/emails.ts
-/** The public email-verification pages: the signed token is the authorization. */
+/**
+* The transactional send a developer's own code makes, plus the public
+* email-verification pages.
+*
+* `emails.send` is the first-party shape of the same send the Resend facade
+* serves (ADR 0014): one service, two wire formats, and this one answers in
+* the envelope with our error codes. It authenticates with an org API key
+* like the rest of the write path, which is why it is hidden from the CLI
+* and MCP surfaces: those hold a session.
+*/
 const emails = defineModule(defineRoute({
+	method: "post",
+	path: "/v1/emails",
+	operationId: "emails.send",
+	tags: ["emails"],
+	summary: "Send one transactional email",
+	security: API_KEY_AUTH,
+	surfaces: HIDDEN_FROM_TOOLS,
+	request: { body: jsonBody(sendEmailBodySchema) },
+	responses: {
+		201: envelope(sendEmailResultSchema, "Handed over; the delivery's id"),
+		...ingestionErrors,
+		...errors("forbidden", "not_found", "conflict")
+	}
+}), defineRoute({
 	method: "get",
 	path: "/v1/public/verify",
 	operationId: "emails.verifyPage",
@@ -9528,15 +9836,15 @@ const events = defineModule(defineRoute({
 
 //#endregion
 //#region ../../packages/shared/src/contract/executions.ts
-const params$7 = z.object({ id: z.string() });
+const params$8 = z.object({ id: z.string() });
 /**
 * Executions: one run of one journey for one profile. Replaces v1's journey
 * instances, which were read live from Temporal and so could only be listed
 * per journey; these are rows, so they filter by journey, version, status,
-* and profile in one place. The environment comes from the selection header.
+* and profile in one place.
 *
-* `cancel` is the only write: stopping is explicit and per environment
-* (ADR 0011), and each execution records `cancelled` when it reaches its
+* `cancel` is the only write: stopping is explicit (ADR 0011), and each
+* execution records `cancelled` when it reaches its
 * next step, so the answer is that the sweep started rather than a count.
 * A pipeline may push, enable, disable and READ executions; stopping runs
 * that are already carrying real people is a person's call, so cancel takes
@@ -9575,7 +9883,7 @@ const executions = defineModule(defineRoute({
 	tags: ["executions"],
 	summary: "Inspect one execution, with its logs",
 	security: PIPELINE_AUTH,
-	request: { params: params$7 },
+	request: { params: params$8 },
 	responses: {
 		200: envelope(executionDetailSchema),
 		...sessionErrors,
@@ -9688,16 +9996,11 @@ const ingestion = defineModule(defineRoute({
 * because the rows are derived from a push rather than created through the
 * API, and (org, key) is the only identity they have.
 *
-* `list` and `get` report the enabled flag of BOTH environments whichever
-* one the caller selected, because "is this on in production?" is the
-* question they exist to answer; `enable` and `disable` act on the selected
-* one, like every other environment-scoped write (docs/standards/api.md).
-*
 * `journeys.listInstances` and `journeys.getInstance` are gone: executions
 * are their own resource now (`executions.list` / `executions.get`), and
 * `journeys.dryRun` answers with the execution it started.
 */
-const params$6 = z.object({ key: z.string() });
+const params$7 = z.object({ key: z.string() });
 const journeys = defineModule(defineRoute({
 	method: "get",
 	path: "/v1/journeys",
@@ -9718,9 +10021,9 @@ const journeys = defineModule(defineRoute({
 	tags: ["journeys"],
 	summary: "Inspect one journey",
 	security: SESSION_AUTH,
-	request: { params: params$6 },
+	request: { params: params$7 },
 	responses: {
-		200: envelope(journeySchema),
+		200: envelope(journeyDetailSchema),
 		...sessionErrors,
 		...errors("not_found")
 	}
@@ -9731,7 +10034,7 @@ const journeys = defineModule(defineRoute({
 	tags: ["journeys"],
 	summary: "Journey operational stats",
 	security: SESSION_AUTH,
-	request: { params: params$6 },
+	request: { params: params$7 },
 	responses: {
 		200: envelope(journeyStatsSchema),
 		...sessionErrors,
@@ -9739,31 +10042,33 @@ const journeys = defineModule(defineRoute({
 	}
 }), defineRoute({
 	method: "post",
-	path: "/v1/journeys/enable",
-	operationId: "journeys.enable",
+	path: "/v1/journeys/status",
+	operationId: "journeys.setStatus",
 	tags: ["journeys"],
-	summary: "Turn journeys on in the selected environment",
+	summary: "Put journeys on, off or on hold",
 	security: PIPELINE_AUTH,
 	surfaces: { cli: false },
-	request: { body: jsonBody(setJourneysEnabledBodySchema) },
+	request: { body: jsonBody(setJourneysStatusBodySchema) },
 	responses: {
-		200: envelope(z.array(journeySchema), "The journeys as they now stand"),
+		200: envelope(z.array(journeyWithOfferSchema), "The journeys as they now stand, each with the members turning it on has waiting"),
 		...sessionErrors,
 		...errors("not_found", "project_missing", "validation_failed", "malformed_request")
 	}
 }), defineRoute({
-	method: "post",
-	path: "/v1/journeys/disable",
-	operationId: "journeys.disable",
+	method: "get",
+	path: "/v1/journeys/{key}/waits",
+	operationId: "journeys.waitsDue",
 	tags: ["journeys"],
-	summary: "Turn journeys off in the selected environment",
-	security: PIPELINE_AUTH,
-	surfaces: { cli: false },
-	request: { body: jsonBody(setJourneysEnabledBodySchema) },
+	summary: "Count the executions a hold until a given day would end",
+	security: SESSION_AUTH,
+	request: {
+		params: params$7,
+		query: waitsDueQuerySchema
+	},
 	responses: {
-		200: envelope(z.array(journeySchema), "The journeys as they now stand"),
+		200: envelope(waitsDueSchema, "Executions in flight, and how many of them come due before that instant"),
 		...sessionErrors,
-		...errors("not_found", "project_missing", "validation_failed", "malformed_request")
+		...errors("not_found", "validation_failed")
 	}
 }), defineRoute({
 	method: "delete",
@@ -9772,12 +10077,65 @@ const journeys = defineModule(defineRoute({
 	tags: ["journeys"],
 	summary: "Delete a journey",
 	security: SESSION_AUTH,
-	request: { params: params$6 },
+	request: { params: params$7 },
 	responses: {
 		200: envelope(deletedSchema),
 		...sessionErrors,
 		...errors("not_found")
 	}
+}), defineRoute({
+	method: "get",
+	path: "/v1/journeys/{key}/enrollment/preview",
+	operationId: "journeys.enrollmentPreview",
+	tags: ["journeys"],
+	summary: "Count who turning this journey on would reach",
+	security: SESSION_AUTH,
+	request: { params: params$7 },
+	responses: {
+		200: envelope(enrollmentCountsSchema, "What enrolling the journey's current members would do"),
+		...sessionErrors,
+		...errors("not_found", "dependency_unavailable")
+	}
+}), defineRoute({
+	method: "post",
+	path: "/v1/journeys/{key}/enrollment",
+	operationId: "journeys.startEnrollment",
+	tags: ["journeys"],
+	summary: "Enroll the journey's current members",
+	security: SESSION_AUTH,
+	surfaces: HIDDEN_FROM_TOOLS,
+	request: { params: params$7 },
+	responses: {
+		202: envelope(enrollmentStatusSchema, "The job, as it starts"),
+		...sessionErrors,
+		...errors("not_found")
+	}
+}), defineRoute({
+	method: "get",
+	path: "/v1/journeys/{key}/enrollment",
+	operationId: "journeys.enrollmentStatus",
+	tags: ["journeys"],
+	summary: "How far the journey's enrollment has got",
+	security: SESSION_AUTH,
+	request: { params: params$7 },
+	responses: {
+		200: envelope(enrollmentStatusSchema),
+		...sessionErrors,
+		...errors("not_found")
+	}
+}), defineRoute({
+	method: "post",
+	path: "/v1/journeys/{key}/enrollment/cancel",
+	operationId: "journeys.cancelEnrollment",
+	tags: ["journeys"],
+	summary: "Stop a running enrollment",
+	security: SESSION_AUTH,
+	request: { params: params$7 },
+	responses: {
+		200: envelope(enrollmentStatusSchema, "The job as it stood when the stop was asked for"),
+		...sessionErrors,
+		...errors("not_found")
+	}
 }), defineRoute({
 	method: "post",
 	path: "/v1/journeys/{key}/dry-run",
@@ -9786,7 +10144,7 @@ const journeys = defineModule(defineRoute({
 	summary: "Dry-run a journey against a real user",
 	security: SESSION_AUTH,
 	request: {
-		params: params$6,
+		params: params$7,
 		body: jsonBody(dryRunJourneyBodySchema)
 	},
 	responses: {
@@ -9800,9 +10158,9 @@ const journeys = defineModule(defineRoute({
 //#region ../../packages/shared/src/contract/me.ts
 /**
 * The signed-in developer's own settings. Session auth like the rest of the
-* dashboard API, but deliberately not org-scoped and indifferent to the
-* environment header: the subject is the caller's own platform-workspace
-* profile, taken from their session, never from the request.
+* dashboard API, but deliberately not org-scoped: the subject is the
+* caller's own platform-workspace profile, taken from their session, never
+* from the request.
 *
 * Hidden from the CLI and the MCP server. Both act with an org's key on that
 * org's data, and neither has a signed-in human whose mail preferences this
@@ -9899,7 +10257,7 @@ const project = defineModule(defineRoute({
 
 //#endregion
 //#region ../../packages/shared/src/contract/pushes.ts
-const params$5 = z.object({ id: z.string() });
+const params$6 = z.object({ id: z.string() });
 /**
 * Pushes: one `cow push` each, the whole project at one point in time. The
 * push stores the source archive and its compile creates a version of every
@@ -9944,7 +10302,7 @@ const pushes = defineModule(defineRoute({
 	tags: ["pushes"],
 	summary: "Inspect one push and what it compiled",
 	security: SESSION_AUTH,
-	request: { params: params$5 },
+	request: { params: params$6 },
 	responses: {
 		200: envelope(pushSchema),
 		...sessionErrors,
@@ -9958,7 +10316,7 @@ const pushes = defineModule(defineRoute({
 	summary: "Download the pushed source tarball",
 	security: SESSION_AUTH,
 	surfaces: HIDDEN_FROM_TOOLS,
-	request: { params: params$5 },
+	request: { params: params$6 },
 	responses: {
 		200: {
 			description: "The gzipped source tarball the push stored",
@@ -9969,6 +10327,98 @@ const pushes = defineModule(defineRoute({
 	}
 }));
 
+//#endregion
+//#region ../../packages/shared/src/contract/resend.ts
+/**
+* The Resend-compatible send facade (ADR 0014): a developer points
+* `RESEND_BASE_URL` at `/resend/{sourceId}` and keeps their code. The source
+* in the path names the app, because the Resend SDK carries no other field
+* and accepts no custom header; the bearer is the organization's ingestion
+* key.
+*
+* These routes are the one exception to the envelope standard: they answer
+* Resend's own shapes, and the API mounts them on a sub-app with its own
+* error handler. They stay in the contract so the API still registers no
+* route outside it, and they are hidden from the CLI, the MCP server and the
+* generated reference: a Cowliss surface has the `/v1` routes, and the guide
+* is the place the facade is documented.
+*/
+const FACADE_SURFACES = {
+	cli: false,
+	mcp: false,
+	docs: false
+};
+const sourceParam = z.object({ sourceId: z.string().openapi({ example: "src_2f9a8c1b" }) });
+/** Resend's error body, for the answers this facade gives. */
+const facadeError = (description) => ({
+	description,
+	content: { "application/json": { schema: resendErrorSchema } }
+});
+const facadeErrors = {
+	401: facadeError("missing_api_key | invalid_api_key"),
+	404: facadeError("not_found: unknown source, or unknown message"),
+	422: facadeError("validation_error | missing_required_field"),
+	429: facadeError("monthly_quota_exceeded | rate_limit_exceeded"),
+	500: facadeError("application_error")
+};
+const resend = defineModule(defineRoute({
+	method: "post",
+	path: "/resend/{sourceId}/emails",
+	operationId: "resend.send",
+	tags: ["resend"],
+	summary: "Send one email (Resend-compatible)",
+	security: API_KEY_AUTH,
+	surfaces: FACADE_SURFACES,
+	request: {
+		params: sourceParam,
+		body: jsonBody(resendSendBodySchema)
+	},
+	responses: {
+		201: {
+			description: "Accepted; the id is the delivery's",
+			content: { "application/json": { schema: resendSentSchema } }
+		},
+		403: facadeError("validation_error: the from-address sits on a domain this organization has not verified"),
+		...facadeErrors
+	}
+}), defineRoute({
+	method: "post",
+	path: "/resend/{sourceId}/emails/batch",
+	operationId: "resend.sendBatch",
+	tags: ["resend"],
+	summary: "Send up to 100 emails (Resend-compatible)",
+	security: API_KEY_AUTH,
+	surfaces: FACADE_SURFACES,
+	request: {
+		params: sourceParam,
+		body: jsonBody(resendBatchBodySchema)
+	},
+	responses: {
+		201: {
+			description: "Accepted; one id per message, in the order they were given",
+			content: { "application/json": { schema: resendBatchSentSchema } }
+		},
+		403: facadeError("validation_error: a from-address sits on a domain this organization has not verified"),
+		...facadeErrors
+	}
+}), defineRoute({
+	method: "get",
+	path: "/resend/{sourceId}/emails/{id}",
+	operationId: "resend.get",
+	tags: ["resend"],
+	summary: "Fetch one sent email (Resend-compatible)",
+	security: API_KEY_AUTH,
+	surfaces: FACADE_SURFACES,
+	request: { params: sourceParam.extend({ id: z.string().openapi({ example: "dlv_2f9a8c1b" }) }) },
+	responses: {
+		200: {
+			description: "The email object",
+			content: { "application/json": { schema: resendEmailSchema } }
+		},
+		...facadeErrors
+	}
+}));
+
 //#endregion
 //#region ../../packages/shared/src/contract/review.ts
 /**
@@ -9994,7 +10444,7 @@ const review = defineModule(defineRoute({
 
 //#endregion
 //#region ../../packages/shared/src/contract/segments.ts
-const params$4 = z.object({ id: z.string() });
+const params$5 = z.object({ id: z.string() });
 const writeErrors = errors("validation_failed", "malformed_request");
 /** `preview` precedes `get` so "preview" is never read as an id. */
 const segments = defineModule(defineRoute({
@@ -10044,7 +10494,7 @@ const segments = defineModule(defineRoute({
 	tags: ["segments"],
 	summary: "Fetch one segment with its member count",
 	security: SESSION_AUTH,
-	request: { params: params$4 },
+	request: { params: params$5 },
 	responses: {
 		200: envelope(segmentDetailSchema),
 		...sessionErrors,
@@ -10058,13 +10508,13 @@ const segments = defineModule(defineRoute({
 	summary: "Update a segment",
 	security: SESSION_AUTH,
 	request: {
-		params: params$4,
+		params: params$5,
 		body: jsonBody(updateSegmentBodySchema)
 	},
 	responses: {
 		200: envelope(segmentDetailSchema),
 		...sessionErrors,
-		...errors("not_found"),
+		...errors("not_found", "conflict"),
 		...writeErrors
 	}
 }), defineRoute({
@@ -10074,11 +10524,11 @@ const segments = defineModule(defineRoute({
 	tags: ["segments"],
 	summary: "Delete a segment",
 	security: SESSION_AUTH,
-	request: { params: params$4 },
+	request: { params: params$5 },
 	responses: {
 		200: envelope(deletedSchema),
 		...sessionErrors,
-		...errors("not_found")
+		...errors("not_found", "conflict")
 	}
 }), defineRoute({
 	method: "get",
@@ -10088,7 +10538,7 @@ const segments = defineModule(defineRoute({
 	summary: "List a segment's members",
 	security: SESSION_AUTH,
 	request: {
-		params: params$4,
+		params: params$5,
 		query: listSegmentMembersQuerySchema
 	},
 	responses: {
@@ -10213,7 +10663,7 @@ const settings = defineModule(defineRoute({
 //#endregion
 //#region ../../packages/shared/src/contract/sources.ts
 const appParams = z.object({ appId: z.string() });
-const params$3 = z.object({ id: z.string() });
+const params$4 = z.object({ id: z.string() });
 /**
 * A source is one inbound pipe into an app. It is created and listed under
 * its parent app (the app is the attribution unit) and addressed by its own
@@ -10259,7 +10709,7 @@ const sources = defineModule(defineRoute({
 	tags: ["sources"],
 	summary: "Fetch one source",
 	security: SESSION_AUTH,
-	request: { params: params$3 },
+	request: { params: params$4 },
 	responses: {
 		200: envelope(sourceSchema),
 		...sessionErrors,
@@ -10273,7 +10723,7 @@ const sources = defineModule(defineRoute({
 	summary: "Set or rotate a source's config",
 	security: SESSION_AUTH,
 	request: {
-		params: params$3,
+		params: params$4,
 		body: jsonBody(updateSourceBodySchema)
 	},
 	responses: {
@@ -10288,7 +10738,7 @@ const sources = defineModule(defineRoute({
 	tags: ["sources"],
 	summary: "Archive a source",
 	security: SESSION_AUTH,
-	request: { params: params$3 },
+	request: { params: params$4 },
 	responses: {
 		200: envelope(sourceSchema, "The archived source"),
 		...sessionErrors,
@@ -10359,7 +10809,7 @@ const suppressions = defineModule(defineRoute({
 * organization's default sender: it reaches no recipient, so it passes no
 * consent gate, counts against nothing, and is logged as a test.
 */
-const params$2 = z.object({ key: z.string() });
+const params$3 = z.object({ key: z.string() });
 const templates = defineModule(defineRoute({
 	method: "get",
 	path: "/v1/templates",
@@ -10380,7 +10830,7 @@ const templates = defineModule(defineRoute({
 	tags: ["templates"],
 	summary: "Inspect one email template",
 	security: SESSION_AUTH,
-	request: { params: params$2 },
+	request: { params: params$3 },
 	responses: {
 		200: envelope(templateSchema),
 		...sessionErrors,
@@ -10394,7 +10844,7 @@ const templates = defineModule(defineRoute({
 	summary: "Render a template with the props you pass",
 	security: SESSION_AUTH,
 	request: {
-		params: params$2,
+		params: params$3,
 		body: jsonBody(renderTemplateBodySchema)
 	},
 	responses: {
@@ -10410,8 +10860,8 @@ const templates = defineModule(defineRoute({
 	summary: "Send a rendered template to your own address",
 	security: SESSION_AUTH,
 	request: {
-		params: params$2,
-		body: jsonBody(renderTemplateBodySchema)
+		params: params$3,
+		body: jsonBody(testSendTemplateBodySchema)
 	},
 	responses: {
 		201: envelope(deliverySchema, "The test send, as it was logged"),
@@ -10425,7 +10875,7 @@ const templates = defineModule(defineRoute({
 	tags: ["templates"],
 	summary: "Delete an email template",
 	security: SESSION_AUTH,
-	request: { params: params$2 },
+	request: { params: params$3 },
 	responses: {
 		200: envelope(deletedSchema),
 		...sessionErrors,
@@ -10435,7 +10885,7 @@ const templates = defineModule(defineRoute({
 
 //#endregion
 //#region ../../packages/shared/src/contract/users.ts
-const params$1 = z.object({ profileId: z.string() });
+const params$2 = z.object({ profileId: z.string() });
 /**
 * The answer a merged-away profile id gets (spec: Identity): 307 to the
 * same path with the survivor's id, so the method and body of a redirected
@@ -10446,9 +10896,8 @@ const mergedRedirect = { 307: {
 	headers: z.object({ Location: z.string().meta({ description: "The survivor's URL" }) })
 } };
 /**
-* Profiles by their Cowliss-generated id, within the environment the
-* selection header names. `find` precedes `{profileId}` so the literal path
-* wins.
+* Profiles by their Cowliss-generated id. `find` precedes `{profileId}` so
+* the literal path wins.
 */
 const users = defineModule(defineRoute({
 	method: "get",
@@ -10483,7 +10932,7 @@ const users = defineModule(defineRoute({
 	tags: ["users"],
 	summary: "Fetch one profile with its identifiers",
 	security: SESSION_AUTH,
-	request: { params: params$1 },
+	request: { params: params$2 },
 	responses: {
 		200: envelope(userDetailSchema),
 		...mergedRedirect,
@@ -10497,7 +10946,7 @@ const users = defineModule(defineRoute({
 	tags: ["users"],
 	summary: "Erase a user (GDPR)",
 	security: SESSION_AUTH,
-	request: { params: params$1 },
+	request: { params: params$2 },
 	responses: {
 		200: envelope(eraseUserResponseSchema),
 		...mergedRedirect,
@@ -10511,7 +10960,7 @@ const users = defineModule(defineRoute({
 	tags: ["users"],
 	summary: "Export everything held on a user (GDPR)",
 	security: SESSION_AUTH,
-	request: { params: params$1 },
+	request: { params: params$2 },
 	responses: {
 		200: envelope(userExportSchema),
 		...mergedRedirect,
@@ -10526,7 +10975,7 @@ const users = defineModule(defineRoute({
 	summary: "Update consent purposes",
 	security: SESSION_AUTH,
 	request: {
-		params: params$1,
+		params: params$2,
 		body: jsonBody(updateConsentBodySchema)
 	},
 	responses: {
@@ -10543,7 +10992,7 @@ const users = defineModule(defineRoute({
 	summary: "The segments a profile belongs to",
 	security: SESSION_AUTH,
 	request: {
-		params: params$1,
+		params: params$2,
 		query: listUserSegmentsQuerySchema
 	},
 	responses: {
@@ -10554,17 +11003,17 @@ const users = defineModule(defineRoute({
 	}
 }), defineRoute({
 	method: "get",
-	path: "/v1/users/{profileId}/journeys",
-	operationId: "users.listJourneys",
+	path: "/v1/users/{profileId}/runs",
+	operationId: "users.listRuns",
 	tags: ["users"],
-	summary: "A profile's journey timeline",
+	summary: "The journeys a profile has completed",
 	security: SESSION_AUTH,
 	request: {
-		params: params$1,
-		query: listUserJourneysQuerySchema
+		params: params$2,
+		query: listUserRunsQuerySchema
 	},
 	responses: {
-		200: list(userJourneySchema),
+		200: list(userRunSchema),
 		...mergedRedirect,
 		...sessionErrors,
 		...errors("not_found", "validation_failed")
@@ -10596,7 +11045,7 @@ const versions = defineModule(defineRoute({
 
 //#endregion
 //#region ../../packages/shared/src/contract/violations.ts
-const params = z.object({ id: z.string() });
+const params$1 = z.object({ id: z.string() });
 const violations = defineModule(defineRoute({
 	method: "get",
 	path: "/v1/violations/{id}",
@@ -10604,7 +11053,7 @@ const violations = defineModule(defineRoute({
 	tags: ["violations"],
 	summary: "Fetch one violation",
 	security: SESSION_AUTH,
-	request: { params },
+	request: { params: params$1 },
 	responses: {
 		200: envelope(violationSchema),
 		...sessionErrors,
@@ -10618,7 +11067,7 @@ const violations = defineModule(defineRoute({
 	summary: "Resolve a violation into the catalog",
 	security: SESSION_AUTH,
 	request: {
-		params,
+		params: params$1,
 		body: jsonBody(resolveViolationBodySchema)
 	},
 	responses: {
@@ -10633,7 +11082,7 @@ const violations = defineModule(defineRoute({
 	tags: ["violations"],
 	summary: "Dismiss a violation",
 	security: SESSION_AUTH,
-	request: { params },
+	request: { params: params$1 },
 	responses: {
 		200: envelope(violationSchema),
 		...sessionErrors,
@@ -10641,6 +11090,79 @@ const violations = defineModule(defineRoute({
 	}
 }));
 
+//#endregion
+//#region ../../packages/shared/src/contract/webhooks.ts
+const params = z.object({ id: z.string() });
+const webhooks = defineModule(defineRoute({
+	method: "post",
+	path: "/v1/webhooks",
+	operationId: "webhooks.create",
+	tags: ["webhooks"],
+	summary: "Create a webhook",
+	security: SESSION_AUTH,
+	request: { body: jsonBody(createWebhookBodySchema) },
+	responses: {
+		201: envelope(webhookCreatedSchema, "The created webhook; the only response carrying the signing secret"),
+		...sessionErrors,
+		...errors("validation_failed", "malformed_request", "conflict")
+	}
+}), defineRoute({
+	method: "get",
+	path: "/v1/webhooks",
+	operationId: "webhooks.list",
+	tags: ["webhooks"],
+	summary: "List webhooks",
+	security: SESSION_AUTH,
+	request: { query: listWebhooksQuerySchema },
+	responses: {
+		200: list(webhookSchema),
+		...sessionErrors,
+		...errors("validation_failed")
+	}
+}), defineRoute({
+	method: "get",
+	path: "/v1/webhooks/{id}",
+	operationId: "webhooks.get",
+	tags: ["webhooks"],
+	summary: "Fetch one webhook",
+	security: SESSION_AUTH,
+	request: { params },
+	responses: {
+		200: envelope(webhookSchema),
+		...sessionErrors,
+		...errors("not_found")
+	}
+}), defineRoute({
+	method: "patch",
+	path: "/v1/webhooks/{id}",
+	operationId: "webhooks.update",
+	tags: ["webhooks"],
+	summary: "Update a webhook",
+	security: SESSION_AUTH,
+	request: {
+		params,
+		body: jsonBody(updateWebhookBodySchema)
+	},
+	responses: {
+		200: envelope(webhookSchema),
+		...sessionErrors,
+		...errors("not_found", "validation_failed", "malformed_request", "conflict")
+	}
+}), defineRoute({
+	method: "delete",
+	path: "/v1/webhooks/{id}",
+	operationId: "webhooks.delete",
+	tags: ["webhooks"],
+	summary: "Delete a webhook",
+	security: SESSION_AUTH,
+	request: { params },
+	responses: {
+		200: envelope(deletedSchema),
+		...sessionErrors,
+		...errors("not_found")
+	}
+}));
+
 //#endregion
 //#region ../../packages/shared/src/contract/index.ts
 /**
@@ -10673,10 +11195,11 @@ const contract = {
 	executions,
 	journeys,
 	templates,
-	destinations,
+	webhooks,
 	domains,
 	deliveries,
 	emails,
+	resend,
 	suppressions,
 	settings,
 	billing
@@ -11048,53 +11571,84 @@ function registerContractCommands(program, run) {
 //#endregion
 //#region src/commands/enable.ts
 /**
-* `cow enable` and `cow disable`: the one gate on a journey, per
-* environment (ADR 0011). Hand-written rather than derived from
-* `journeys.enable`, because the commands are top-level names a developer
-* types, and because of the `--env` rule below; the route itself takes the
-* same set of keys they do.
+* `cow enable`, `cow disable` and `cow pause`: the one gate on a journey
+* (ADR 0011, ADR 0013, ADR 0018). Hand-written rather than derived from
+* `journeys.setStatus`, because the commands are top-level names a developer
+* types; the route itself takes the same set of keys they do.
 *
-* `--env` is never defaulted here (`requireEnvironment`): the default
-* environment is production, and a flag nobody typed must not put code in
-* front of real recipients.
+* `cow enable` on a journey on hold is how it resumes: the server has one
+* transition to `on` and no second word for it.
 */
 /**
 * One call, whichever way the keys were named: the route takes the set, and
 * `--all` is the project name, resolved on the server against the rows it
 * owns (so it reaches a key whose file the tree lost). A key that is not
-* there refuses the whole call, and nothing flips.
-*/
-async function setEnabled(client, selector, enabled) {
-	const route = enabled ? contract.journeys["journeys.enable"] : contract.journeys["journeys.disable"];
-	return (await client.request(route, { body: selector })).data;
+* there refuses the whole call, and nothing changes.
+*/
+async function setStatus(client, selector, status) {
+	return (await client.request(contract.journeys["journeys.setStatus"], { body: {
+		...selector,
+		status
+	} })).data;
+}
+/**
+* Who is already standing in a journey that was just turned on, and where
+* to let them in (ADR 0015). Printed, never acted on: enrolling a cohort
+* spends real money and reaches real people, so it stays a person's click
+* in the dashboard and no command here starts one.
+*/
+function segmentLines(journey) {
+	const offer = journey.enrollment;
+	if (!offer) return [];
+	if (!offer.counts) return [`  Who is in its segment could not be counted just now: ${offer.url}`];
+	const { scanned, enrolled, skipped } = offer.counts;
+	if (scanned === 0) return ["  Nobody is in its segment yet."];
+	return [
+		`  ${scanned} in its segment now, ${enrolled} of them can enter it now.`,
+		...Object.entries(ENROLLMENT_SKIP_WORDS).map(([key, words]) => ({
+			value: skipped[key],
+			words
+		})).filter(({ value }) => value > 0).map(({ value, words }) => `  ${value} ${words.reason}.`),
+		...enrolled > 0 ? [`  To let those ${enrolled} in: ${offer.url}`] : []
+	];
 }
-/** What the terminal says: one line per key, naming where it now stands. */
-function flipSummary(journeys, enabled, environment) {
-	if (journeys.length === 0) return `This project has no journeys to turn ${enabled ? "on" : "off"}.`;
-	return journeys.map((journey) => `${journey.key} is ${enabled ? "on" : "off"} in ${environment}.`).join("\n");
+/** How the terminal names each state. */
+const STATE_WORD = {
+	on: "on",
+	off: "off",
+	paused: "on hold"
+};
+/** What the terminal says: one line per key, naming its new state. */
+function flipSummary(journeys, status) {
+	if (journeys.length === 0) return `This project has no journeys to put ${STATE_WORD[status]}.`;
+	return journeys.map((journey) => [`${journey.key} is ${STATE_WORD[status]}.`, ...segmentLines(journey)].join("\n")).join("\n");
 }
-function register(program, clientFor, env, io, enabled) {
-	const verb = enabled ? "enable" : "disable";
-	program.command(verb).description(`turn journeys ${enabled ? "on" : "off"} in one environment (many keys, or --all for this project's)`).argument("[keys...]", "journey keys").option("--all", "every journey of this project").action(async (keys, opts) => {
+const DESCRIPTIONS = {
+	on: "turn journeys on",
+	off: "turn journeys off",
+	paused: "hold journeys: nobody enters, and everyone part-way through waits"
+};
+function register(program, clientFor, io, verb, status) {
+	program.command(verb).description(`${DESCRIPTIONS[status]} (many keys, or --all for this project's)`).argument("[keys...]", "journey keys").option("--all", "every journey of this project").action(async (keys, opts) => {
 		const merged = {
 			...program.opts(),
 			...opts
 		};
-		const environment = requireEnvironment(env, merged);
-		if (merged.all === true && keys.length > 0) throw new Error(`Name the journeys or pass --all, not both: cow ${verb} welcome --env ${environment}.`);
-		if (merged.all !== true && keys.length === 0) throw new Error(`Name at least one journey, or pass --all: cow ${verb} welcome --env ${environment}.`);
+		if (merged.all === true && keys.length > 0) throw new Error(`Name the journeys or pass --all, not both: cow ${verb} welcome.`);
+		if (merged.all !== true && keys.length === 0) throw new Error(`Name at least one journey, or pass --all: cow ${verb} welcome.`);
 		const selector = merged.all === true ? { project: (await assertCowConfig(process.cwd())).project } : { keys };
-		const updated = await setEnabled(await clientFor(merged), selector, enabled);
+		const updated = await setStatus(await clientFor(merged), selector, status);
 		if (merged.json === true) {
 			emit({ data: updated }, io, true);
 			return;
 		}
-		io.stdout(`${flipSummary(updated, enabled, environment)}\n`);
+		io.stdout(`${flipSummary(updated, status)}\n`);
 	});
 }
-function registerEnable(program, clientFor, env, io) {
-	register(program, clientFor, env, io, true);
-	register(program, clientFor, env, io, false);
+function registerEnable(program, clientFor, io) {
+	register(program, clientFor, io, "enable", "on");
+	register(program, clientFor, io, "disable", "off");
+	register(program, clientFor, io, "pause", "paused");
 }
 
 //#endregion
@@ -11150,7 +11704,7 @@ async function packageJson(name) {
 * ponytail: plain fetch because `POST /v1/project` is not a contract route
 * yet; swap it for the typed client's `project.create` once ticket 04 lands.
 */
-async function createProject(apiUrl, token, environment, name) {
+async function createProject(apiUrl, token, name) {
 	if (!token) return {
 		project: "skipped",
 		reason: "not logged in"
@@ -11160,8 +11714,7 @@ async function createProject(apiUrl, token, environment, name) {
 			method: "POST",
 			headers: {
 				"content-type": "application/json",
-				authorization: `Bearer ${token}`,
-				[ENVIRONMENT_HEADER]: environment
+				authorization: `Bearer ${token}`
 			},
 			body: JSON.stringify({ data: { name } })
 		});
@@ -11220,7 +11773,7 @@ function registerInit(program, env, io) {
 		}
 		const example = typeof opts.example === "string" ? opts.example : void 0;
 		const files = [...Object.keys(contents), ...example ? await copyExample(example, dir, false) : []].sort();
-		const outcome = await createProject(resolveApiUrl(env, credentials, typeof merged.api === "string" ? merged.api : void 0), resolveCredential(env, credentials).token, (typeof merged.env === "string" ? merged.env : void 0) ?? env.COW_ENVIRONMENT ?? "production", name);
+		const outcome = await createProject(resolveApiUrl(env, credentials, typeof merged.api === "string" ? merged.api : void 0), resolveCredential(env, credentials).token, name);
 		emit({ data: {
 			dir,
 			orgId,
@@ -11535,7 +12088,7 @@ async function pushProject({ client, projectDir }) {
 		push: (await client.request(contract.pushes["pushes.create"], { body: {
 			manifest: {
 				...manifest,
-				protocol: 2
+				protocol: 3
 			},
 			project: project.name
 		} })).data,
@@ -11634,13 +12187,10 @@ function versionPhrase(entry, now) {
 	return `${bundle ? `version ${shortDigest(bundle)}` : "version"}, pushed ${ago(version.pushedAt, now)}${state}`;
 }
 function flagsPhrase(entry) {
-	if (!entry.enabled) return "";
-	const word = (on) => on ? "on" : "off";
-	return `${word(entry.enabled.development)} in development, ${word(entry.enabled.production)} in production`;
+	return entry.status === null ? "" : entry.status === "paused" ? "on hold" : entry.status;
 }
 function livePhrase(entry) {
-	const running = (count, environment) => count === 0 ? [] : [`${count} running in ${environment}`];
-	return [...running(entry.liveExecutions.development, "development"), ...running(entry.liveExecutions.production, "production")].join(", ");
+	return entry.liveExecutions === 0 ? "" : `${entry.liveExecutions} running`;
 }
 function pad(text, width) {
 	return text.padEnd(width);
@@ -11690,11 +12240,9 @@ function statusLines(status, manifest, now) {
 		lines.push("", "On the server and not in this tree:");
 		for (const entry of missing) lines.push(`  ${entry.key}, a ${entry.kind}. Delete it with cow ${entry.kind}s delete ${entry.key}.`);
 	}
-	for (const environment of ["development", "production"]) {
-		const warnings = status.warnings[environment];
-		if (warnings.length === 0) continue;
-		lines.push("", `Names ${environment} does not define yet:`);
-		for (const warning of warnings) lines.push(`  ${warning}`);
+	if (status.warnings.length > 0) {
+		lines.push("", "Names this organization does not define yet:");
+		for (const warning of status.warnings) lines.push(`  ${warning}`);
 	}
 	return lines;
 }
@@ -11889,7 +12437,7 @@ async function runScenario(projectDir, key, scenario) {
 	let error;
 	for (;;) {
 		const output = await runGuest(module, {
-			protocol: 2,
+			protocol: 3,
 			kind: "journey",
 			key,
 			event: trigger,
@@ -11972,32 +12520,6 @@ function registerTest(program, io) {
 
 //#endregion
 //#region src/commands/index.ts
-/**
-* The environment a call acts on: the root `--env`, else `COW_ENVIRONMENT`,
-* else production. The client sets it as the selection header; a command
-* that also needs the value itself reads it from here, so the two can never
-* disagree.
-*/
-function environmentFor(env, opts) {
-	const flag = environmentSchema.safeParse(opts.env);
-	return flag.success ? flag.data : env.COW_ENVIRONMENT ?? "production";
-}
-/**
-* The same value, but only when the caller actually chose one. `cow enable`
-* and `cow disable` change what real recipients get, and the default is
-* production: a bare `cow enable welcome` typed while thinking about
-* development would turn it on in production. A pipeline is unaffected,
-* because `COW_ENVIRONMENT` counts as having chosen.
-*/
-function requireEnvironment(env, opts) {
-	if (opts.env === void 0 && env.COW_ENVIRONMENT === void 0) throw new Error(`Name the environment to act on: --env ${ENVIRONMENTS.join(" or --env ")}, or set COW_ENVIRONMENT.`);
-	return environmentFor(env, opts);
-}
-function parseEnvironment(value) {
-	const parsed = environmentSchema.safeParse(value);
-	if (!parsed.success) throw new InvalidArgumentError(`expected one of ${ENVIRONMENTS.join(", ")}`);
-	return parsed.data;
-}
 /** Every command prints the response envelope as JSON. */
 function emit(result, io, json) {
 	const compact = json === true || !io.isTTY;
@@ -12005,7 +12527,7 @@ function emit(result, io, json) {
 }
 function buildProgram(env, io) {
 	const program = new Command();
-	program.name("cow").description("Admin CLI for Cowliss: a thin client of the dashboard API").option("--api <url>", "API base URL (overrides env and saved config)").option("--env <environment>", `environment to act on: ${ENVIRONMENTS.join(" | ")} (overrides COW_ENVIRONMENT; default ${DEFAULT_ENVIRONMENT})`, parseEnvironment).option("--json", "force compact single-line JSON output").option("--config <file>", `project config to read instead of ${DEFAULT_CONFIG_FILE} (overrides COW_CONFIG)`);
+	program.name("cow").description("Admin CLI for Cowliss: a thin client of the dashboard API").option("--api <url>", "API base URL (overrides env and saved config)").option("--json", "force compact single-line JSON output").option("--config <file>", `project config to read instead of ${DEFAULT_CONFIG_FILE} (overrides COW_CONFIG)`);
 	program.hook("preAction", () => {
 		const flag = program.opts().config;
 		setConfigFile((typeof flag === "string" ? flag : void 0) ?? env.COW_CONFIG ?? "cow.json");
@@ -12015,10 +12537,7 @@ function buildProgram(env, io) {
 		return createClient({
 			baseUrl: resolveApiUrl(env, credentials, typeof opts.api === "string" ? opts.api : void 0, (await readCowConfig(process.cwd()))?.apiUrl),
 			auth: async () => resolveCredential(env, await readCredentials(env)).token,
-			headers: async () => ({
-				[ENVIRONMENT_HEADER]: environmentFor(env, opts),
-				[CLIENT_HEADER]: `@cowliss/cli/${(await readCliPackage()).version}`
-			})
+			headers: async () => ({ [CLIENT_HEADER]: `@cowliss/cli/${(await readCliPackage()).version}` })
 		});
 	};
 	const run = async (opts, fn) => {
@@ -12035,7 +12554,7 @@ function buildProgram(env, io) {
 	registerBuild(program, io);
 	registerPush(program, clientFor, env, io);
 	registerStatus(program, clientFor, io);
-	registerEnable(program, clientFor, env, io);
+	registerEnable(program, clientFor, io);
 	registerPull(program, clientFor, io);
 	registerTest(program, io);
 	registerMcp(program, clientFor, env, io);
@@ -12056,8 +12575,6 @@ const envSchema = z.object({
 	COW_TOKEN: z.string().min(1).optional(),
 	/** An org pipeline key for CI; when set it wins over the cached session (ticket 05 reads it). */
 	COW_PIPELINE_KEY: z.string().min(1).optional(),
-	/** The environment admin calls select; `--env` overrides it, production is the default. */
-	COW_ENVIRONMENT: environmentSchema.optional(),
 	/**
 	* The project config to read instead of `cow.json`, so one checkout can
 	* hold both the committed production config and a local override.