@cowliss/cli 0.6.0 → 0.8.0

package/dist/index.js

@@ -33,6 +33,34 @@ const DOCS_URL = "https://docs.cowliss.com";
 */
 const REQUEST_ID_HEADER = "X-Request-Id";
 /**
+* Stripe-style ID prefixes per resource type, so ids in logs, URLs, and
+* payloads are self-describing.
+*/
+const ID_PREFIXES = {
+	user: "usr_",
+	event: "evt_",
+	identifier: "idn_",
+	segment: "seg_",
+	/** The attribution unit: a readable `app_<slug>`, not a TypeID. */
+	app: "app_",
+	/** One inbound pipe into an app; a TypeID like everything else. */
+	source: "src_",
+	webhook: "whk_",
+	push: "psh_",
+	version: "ver_",
+	execution: "exe_",
+	delivery: "dlv_",
+	violation: "vio_",
+	quarantineEntry: "qtn_",
+	idempotencyKey: "idk_",
+	abuseEvent: "abu_",
+	suppression: "sup_",
+	senderDomain: "dom_",
+	journeyRun: "run_",
+	topup: "top_",
+	emailAddress: "eml_"
+};
+/**
 * Clerk ID prefix marking an organization-scoped subject. Ingestion API keys
 * must resolve to an org subject; user-scoped keys are rejected.
 */
@@ -82,30 +110,30 @@ const TOPUP_PRESETS_MICROS = [
 	2e8
 ];
 /**
-* Fixed consent purposes for the prototype. Consent is a per-purpose map on
-* the profile, checked at send-step execution time.
-*
-* The two names describe what the recipient agreed to, not the pipe it
-* arrives on: "emails I did not ask for individually" and "my data leaving
-* for somewhere else". Naming them after the channel (`email`, `webhook`)
-* said nothing a recipient could consent to, and transactional mail already
-* bypasses the email purpose, so it was only ever marketing consent.
-*/
-const CONSENT_PURPOSES = ["emailMarketing", "dataProcessing"];
-/**
 * The marketing purpose by name, since it is the one every gate, the
 * unsubscribe route, and the developer's own toggle all reach for.
 */
-const EMAIL_MARKETING = "emailMarketing";
+const MARKETING = "marketing";
+/**
+* A legal journey `purpose` that is not a consent purpose: the send gates
+* pass it unconditionally, no profile's map stores it and no editor renders
+* it. What protects the channel itself (suppression, the SES gates, the
+* quota) still applies.
+*/
+const TRANSACTIONAL = "transactional";
+/**
+* The purposes a project may not declare, which are the same two that sit
+* outside the `marketing` umbrella: `marketing` is the umbrella itself and
+* `transactional` is the case consent does not govern. Everything a project
+* declares is a marketing-mail category and so sits under it.
+*/
+const RESERVED_PURPOSES = [MARKETING, TRANSACTIONAL];
 /**
 * What a purpose means when the profile's map does not answer it, matching
-* the `profiles.consent` column default: marketing is asked for, everything
-* else about the data the developer already sends is granted.
+* the `profiles.consent` column default: marketing is asked for, never
+* assumed.
 */
-const CONSENT_PURPOSE_DEFAULTS = {
-	emailMarketing: false,
-	dataProcessing: true
-};
+const CONSENT_PURPOSE_DEFAULTS = { marketing: false };
 /**
 * The `defaults` argument `consentGranted` takes, built from an org's
 * purpose rows. Every surface that renders or gates a purpose reads those
@@ -3143,7 +3171,7 @@ const bytea = customType({ dataType: () => "bytea" });
 /**
 * What an artifact is: a journey or template bundle as `cow build` emitted
 * it, the wasm module the server compiled from it, or the gzipped source
-* tarball of the project the release was built from.
+* tarball of the repo the push was built from.
 */
 const artifactKindEnum = pgEnum("artifact_kind", [
 	"bundle",
@@ -3264,14 +3292,14 @@ const insertCatalogTraitSchema = createInsertSchema(catalogTraits);
 //#region ../../packages/db/src/schema/consent-purposes.ts
 /**
 * The consent purposes an org's profiles answer: the two fixed ones, seeded
-* the first time the set is read, plus whatever the org's projects declare
-* in their `cow.json`. One read here returns the whole set, so nothing
+* the first time the set is read, plus whatever the org's apps declare in
+* their `cow.json`. One read here returns the whole set, so nothing
 * downstream unions a table with a constant.
 *
-* Org-wide rather than per-project: `profiles.consent` is
-* one jsonb map per profile, so an answer given under one project is the
-* same answer under the next, and two projects declaring one key must agree
-* on its label and default or the deploy is refused.
+* Org-wide rather than per-app: `profiles.consent` is one jsonb map per
+* profile, so an answer given under one app is the same answer under the
+* next, and two apps declaring one key must agree on its label and default
+* or the deploy is refused.
 *
 * A deploy adds and updates rows and never deletes one (ADR 0009): profiles
 * already hold answers against a purpose, and deleting it would orphan them.
@@ -3289,14 +3317,18 @@ const consentPurposes = pgTable("consent_purposes", {
 	*/
 	defaultGranted: boolean("default_granted").notNull(),
 	/**
-	* The project whose `cow.json` declared it, and the one a disagreeing
-	* deploy is refused in the name of. Null for the two fixed purposes,
-	* which every org has and no project owns.
+	* The app whose `cow.json` declared it, and the one a disagreeing deploy
+	* is refused in the name of. Null for the two fixed purposes, which every
+	* org has and no app owns.
 	*/
-	projectId: text("project_id"),
+	appId: text("app_id"),
 	createdAt: createdAt(),
 	updatedAt: updatedAt()
-}, (table) => [primaryKey({ columns: [table.orgId, table.key] })]);
+}, (table) => [primaryKey({ columns: [table.orgId, table.key] }), foreignKey({
+	columns: [table.orgId, table.appId],
+	foreignColumns: [apps$1.orgId, apps$1.id],
+	name: "consent_purposes_app_fk"
+})]);
 
 //#endregion
 //#region ../../packages/db/src/schema/deliveries.ts
@@ -3341,6 +3373,10 @@ const deliveryKindEnum = pgEnum("delivery_kind", [
 *   `skipped_suppressed` is the recipient's address sitting in the
 *   suppression mirror, which SES would have bounced off its own
 *   suppression list anyway.
+*   `skipped_unknown_purpose` is the version naming a purpose the
+*   organization does not have, which is a broken manifest rather than a
+*   consent decision: the `error` column names the purpose, and the fix is
+*   another push (ADR 0017).
 * - `would_*` are dry-run outcomes: terminal, never reach SES, and
 *   excluded from feedback, quotas, and reconciliation.
 *
@@ -3357,6 +3393,7 @@ const deliveryStatusEnum = pgEnum("delivery_status", [
 	"skipped_paused",
 	"skipped_suppressed",
 	"skipped_quota",
+	"skipped_unknown_purpose",
 	"skipped_frequency_cap",
 	"skipped_consent",
 	"skipped_domain",
@@ -3366,6 +3403,7 @@ const deliveryStatusEnum = pgEnum("delivery_status", [
 	"would_skip_paused",
 	"would_skip_suppressed",
 	"would_skip_quota",
+	"would_skip_unknown_purpose",
 	"would_skip_frequency_cap",
 	"would_skip_consent",
 	"would_skip_domain",
@@ -3386,6 +3424,15 @@ const deliveries$1 = pgTable("deliveries", {
 	* neither of which has one.
 	*/
 	journey: text("journey"),
+	/**
+	* The journey execution (`exe_`) this send was made from, so an execution
+	* page can show what it sent. Null is a real state rather than a gap: a
+	* test send and an api send have no execution behind them, and rows
+	* written before this column existed have none to name. No foreign key,
+	* because executions are pruned on their own schedule and a delivery is a
+	* log row that outlives them.
+	*/
+	executionId: text("execution_id"),
 	kind: deliveryKindEnum("kind").notNull().default("journey"),
 	/**
 	* Email template name or webhook name. An api send that named no
@@ -3443,6 +3490,7 @@ const deliveries$1 = pgTable("deliveries", {
 }, (table) => [
 	index("deliveries_org_id_created_at_idx").on(table.orgId, table.createdAt),
 	index("deliveries_org_id_profile_id_created_at_idx").on(table.orgId, table.profileId, table.createdAt),
+	index("deliveries_org_id_execution_id_created_at_idx").on(table.orgId, table.executionId, table.createdAt),
 	uniqueIndex("deliveries_org_id_attempt_key_unique").on(table.orgId, table.attemptKey),
 	uniqueIndex("deliveries_provider_id_unique").on(table.providerId),
 	index("deliveries_status_sent_at_idx").on(table.status, table.sentAt)
@@ -3551,7 +3599,7 @@ const executions$1 = pgTable("executions", {
 	})
 }, (table) => [
 	index("executions_org_id_version_id_status_idx").on(table.orgId, table.versionId, table.status),
-	uniqueIndex("executions_org_id_workflow_id_unique").on(table.orgId, table.workflowId),
+	index("executions_org_id_workflow_id_status_idx").on(table.orgId, table.workflowId, table.status),
 	index("executions_org_id_started_at_idx").on(table.orgId, table.startedAt)
 ]);
 const selectExecutionSchema = createSelectSchema(executions$1);
@@ -3619,11 +3667,11 @@ const idempotencyKeys = pgTable("idempotency_keys", {
 * creating one when none is known.
 *
 * traits is the merged trait bag (RFC 7386 key-level merge on write).
-* consent is the fixed-purpose consent map from the spec. Marketing starts
-* denied and data processing granted: nobody is subscribed by the act of
-* being ingested, while the processing the product runs on is the basis the
-* profile exists under at all. It is written by the identify path (a caller
-* passing `consent`), the consent editor, and the automatic revocations.
+* consent is the per-purpose consent map. Marketing starts denied: nobody
+* is subscribed by the act of being ingested. `transactional` is absent by
+* design (ADR 0017): it is not a purpose anyone may withhold, so it is not
+* stored. The map is written by the identify path (a caller passing
+* `consent`), the consent editor, and the automatic revocations.
 *
 * `mergedInto` is the merge pointer (spec: Identity). Null on a live
 * profile; on a profile a merge folded away it names the survivor, whose
@@ -3641,10 +3689,7 @@ const profiles = pgTable("profiles", {
 	appId: text("app_id").notNull(),
 	sourceId: text("source_id").notNull(),
 	traits: jsonb("traits").$type().notNull().default({}),
-	consent: jsonb("consent").$type().notNull().default({
-		emailMarketing: false,
-		dataProcessing: true
-	}),
+	consent: jsonb("consent").$type().notNull().default({ marketing: false }),
 	mergedInto: text("merged_into"),
 	createdAt: createdAt(),
 	updatedAt: updatedAt()
@@ -3685,10 +3730,10 @@ const identifierKindEnum = pgEnum("identifier_kind", [
 ]);
 /**
 * The identifiers map: every named identifier a call has ever carried,
-* pointing at the profile it resolved to. Unique per (org, kind, value),
-* which is what makes "a shared identifier means the same person"
-* enforceable at the row level: the same clerkId twice in one organization
-* is one person.
+* pointing at the profile it resolved to. Unique per (org, app, kind, value),
+* which is what makes "a shared identifier means the same person" enforceable
+* at the row level, inside one app: the same clerkId twice in one app is one
+* person, and the same email on two apps is two people (ADR 0022).
 *
 * Rows follow their profile: erasure deletes the profile and these cascade,
 * and a merge re-points them at the survivor.
@@ -3696,11 +3741,21 @@ const identifierKindEnum = pgEnum("identifier_kind", [
 const identifiers = pgTable("identifiers", {
 	id: text("id").primaryKey(),
 	orgId: text("org_id").notNull(),
+	/** The app this identifier resolves in; always its profile's app. */
+	appId: text("app_id").notNull(),
 	kind: identifierKindEnum("kind").notNull(),
 	value: text("value").notNull(),
 	profileId: text("profile_id").notNull().references(() => profiles.id, { onDelete: "cascade" }),
 	createdAt: createdAt()
-}, (table) => [uniqueIndex("identifiers_org_kind_value_unique").on(table.orgId, table.kind, table.value), index("identifiers_profile_id_idx").on(table.profileId)]);
+}, (table) => [
+	uniqueIndex("identifiers_org_app_kind_value_unique").on(table.orgId, table.appId, table.kind, table.value),
+	index("identifiers_profile_id_idx").on(table.profileId),
+	foreignKey({
+		columns: [table.orgId, table.appId],
+		foreignColumns: [apps$1.orgId, apps$1.id],
+		name: "identifiers_app_fk"
+	})
+]);
 const selectIdentifierSchema = createSelectSchema(identifiers);
 const insertIdentifierSchema = createInsertSchema(identifiers);
 
@@ -3745,6 +3800,18 @@ const insertJourneyRunSchema = createInsertSchema(journeyRuns);
 //#endregion
 //#region ../../packages/db/src/schema/journeys.ts
 /**
+* The one operational state a manager sets (ADR 0018): `on` (recipients
+* enroll and executions run), `off` (nothing enrolls, executions in flight
+* finish) or `paused` (nothing enrolls, executions in flight hold before
+* their next step). Three values rather than two booleans: a second flag
+* beside the first would spell two combinations that mean nothing.
+*/
+const journeyStatusEnum = pgEnum("journey_status", [
+	"on",
+	"off",
+	"paused"
+]);
+/**
 * Derived journey rows: one per (org, key), upserted from the manifest a
 * push carried. Nothing here is authored through the API, which is why
 * there is no id of its own: the key is the name the author gave the file,
@@ -3752,14 +3819,15 @@ const insertJourneyRunSchema = createInsertSchema(journeyRuns);
 *
 * A push only ever adds and updates: it owns the keys its manifest carries
 * and leaves every other row alone, because an org's journeys can come from
-* several projects and a developer may push a project holding only some of
-* the files. `projectId` records which project put the row here, which is
-* what makes a key another project owns a refused push rather than a silent
-* overwrite. Removing a journey is an explicit delete (ADR 0009).
+* several apps and a developer may push a repo holding only some of the
+* files. `appId` records which app put the row here, which is what makes a
+* key another app owns a refused push rather than a silent overwrite
+* (ADR 0009, held by the app since ADR 0022). Removing a journey is an
+* explicit delete.
 *
-* Whether a journey fires is one flag and one only: `enabled`, which a
+* Whether a journey fires is one field and one only: `status`, which a
 * push never writes, so deploying code never turns anything on or off. The
-* author has no second gate of their own (ADR 0011).
+* author has no second gate of their own (ADR 0011, ADR 0018).
 *
 * The descriptive columns are what its latest ready version reported, so a
 * failed compile leaves both the code and its description as they were.
@@ -3769,28 +3837,38 @@ const insertJourneyRunSchema = createInsertSchema(journeyRuns);
 const journeys$1 = pgTable("journeys", {
 	orgId: text("org_id").notNull(),
 	key: text("key").notNull(),
-	/** The project whose push owns this key. */
-	projectId: text("project_id").notNull(),
+	/** The app whose push owns this key, and the only app it fires for. */
+	appId: text("app_id").notNull(),
 	/** The author's labels, from the manifest; the dashboard's only grouping. */
 	tags: text("tags").array().notNull().default(sql`'{}'::text[]`),
 	trigger: jsonb("trigger").$type().notNull(),
 	/**
 	* The consent purpose this journey's sends are gated on: one of the two
-	* fixed keys or one the project declares in `cow.json`. Text and not an
+	* fixed keys or one the app's repo declares in `cow.json`. Text and not an
 	* enum, because the set is the org's `consent_purposes` rows, which a
 	* deploy checks the key against; a database enum could only ever hold
 	* the fixed pair.
 	*/
 	purpose: text("purpose").notNull(),
+	/**
+	* The author's own sentence about what the journey does, from the
+	* manifest. Null when they wrote none.
+	*/
+	description: text("description"),
 	spine: jsonb("spine").$type().notNull(),
 	/**
 	* The one gate on the journey: off until `cow enable` or a manager's
-	* toggle, and never touched by a push (ADR 0011, amended by ADR 0013).
+	* control, and never touched by a push (ADR 0011, amended by ADR 0013
+	* and ADR 0018).
 	*/
-	enabled: boolean("enabled").notNull().default(false),
+	status: journeyStatusEnum("status").notNull().default("off"),
 	createdAt: createdAt(),
 	updatedAt: updatedAt()
-}, (table) => [primaryKey({ columns: [table.orgId, table.key] })]);
+}, (table) => [primaryKey({ columns: [table.orgId, table.key] }), foreignKey({
+	columns: [table.orgId, table.appId],
+	foreignColumns: [apps$1.orgId, apps$1.id],
+	name: "journeys_app_fk"
+})]);
 const selectJourneySchema = createSelectSchema(journeys$1);
 const insertJourneySchema = createInsertSchema(journeys$1);
 
@@ -3814,17 +3892,16 @@ const ingestionPolicyEnum = pgEnum("ingestion_policy", ["permissive", "strict"])
 * switch, the allowance override, and Clerk's cached profile.
 *
 * `slug` and `name` are the exception to "only what Cowliss owns": they are
-* Clerk's, cached here by the API's org-sync middleware because the worker
-* has no Clerk client and still has to build the shared fallback sender
-* `<org-slug>@<shared domain>` with the org's name as the from-name.
+* Clerk's, cached here by the API's org-sync middleware, and they are what a
+* template test-send composes its from-address out of (`orgFromAddress`).
 */
 const orgSettings = pgTable("org_settings", {
 	orgId: text("org_id").primaryKey(),
 	/**
 	* The Clerk org's slug and display name, synced by the API on request.
-	* Null until a member of the org has hit the dashboard API once; the
-	* shared fallback sender falls back to an orgId-derived local part and the
-	* tool name until then.
+	* Null until a member of the org has hit the dashboard API once, when
+	* `orgFromAddress` falls back to an orgId-derived local part and the tool
+	* name.
 	*/
 	slug: text("slug"),
 	name: text("name"),
@@ -3891,33 +3968,15 @@ const orgSettings = pgTable("org_settings", {
 const selectOrgSettingsSchema = createSelectSchema(orgSettings);
 const insertOrgSettingsSchema = createInsertSchema(orgSettings);
 
-//#endregion
-//#region ../../packages/db/src/schema/projects.ts
-/**
-* An org's cow project: the folder a developer runs `cow init` in, and the
-* thing pushes belong to. An org may hold several, one per repo, each with
-* its own release sequence and its own slice of the deployed journey rows. The name is how `cow.json` picks
-* one, so it is unique within the org.
-*/
-const projects = pgTable("projects", {
-	id: text("id").primaryKey(),
-	orgId: text("org_id").notNull(),
-	name: text("name").notNull(),
-	createdAt: createdAt(),
-	updatedAt: updatedAt()
-}, (table) => [uniqueIndex("projects_org_id_name_unique").on(table.orgId, table.name)]);
-const selectProjectSchema = createSelectSchema(projects);
-const insertProjectSchema = createInsertSchema(projects);
-
 //#endregion
 //#region ../../packages/db/src/schema/pushes.ts
 /**
-* One `cow push`: the whole project at one point in time. A push stores the
+* One `cow push`: the whole repo at one point in time. A push stores the
 * source archive and creates a version of every key whose bundle changed
 * (ADR 0011); it settles nothing and changes no flag, so it has no status
 * of its own. What is compiling is read off its versions.
 *
-* `seq` is the human handle and is per project, allocated inside the create
+* `seq` is the human handle and is per app, allocated inside the create
 * transaction; the unique index leads with the org id so it doubles as the
 * tenancy key.
 *
@@ -3928,7 +3987,8 @@ const insertProjectSchema = createInsertSchema(projects);
 const pushes$1 = pgTable("pushes", {
 	id: text("id").primaryKey(),
 	orgId: text("org_id").notNull(),
-	projectId: text("project_id").notNull().references(() => projects.id),
+	/** The app this push deployed; the push unit since ADR 0022. */
+	appId: text("app_id").notNull(),
 	seq: integer("seq").notNull(),
 	manifest: jsonb("manifest").$type().notNull(),
 	/** sha256 of the pushed manifest; the CLI compares it to skip a no-op push. */
@@ -3937,7 +3997,15 @@ const pushes$1 = pgTable("pushes", {
 	sourceDigest: text("source_digest").notNull(),
 	createdBy: text("created_by").notNull(),
 	createdAt: createdAt()
-}, (table) => [uniqueIndex("pushes_org_id_project_id_seq_unique").on(table.orgId, table.projectId, table.seq), index("pushes_org_id_created_at_idx").on(table.orgId, table.createdAt)]);
+}, (table) => [
+	uniqueIndex("pushes_org_id_app_id_seq_unique").on(table.orgId, table.appId, table.seq),
+	index("pushes_org_id_created_at_idx").on(table.orgId, table.createdAt),
+	foreignKey({
+		columns: [table.orgId, table.appId],
+		foreignColumns: [apps$1.orgId, apps$1.id],
+		name: "pushes_app_fk"
+	})
+]);
 const selectPushSchema = createSelectSchema(pushes$1);
 const insertPushSchema = createInsertSchema(pushes$1);
 /**
@@ -4038,9 +4106,20 @@ const insertQuarantineEntrySchema = createInsertSchema(quarantineEntries);
 //#endregion
 //#region ../../packages/db/src/schema/segments.ts
 /**
-* Segments: dashboard-managed audience definitions. Membership is computed,
-* never hand-maintained: the engine in packages/segments recomputes on every
-* write and materializes the result into segment_members.
+* Segments: membership rules over profiles. Membership is computed, never
+* hand-maintained: the engine in packages/segments recomputes on every write
+* and materializes the result into segment_members.
+*
+* A segment belongs to one app (ADR 0022) and sees only that app's profiles
+* and that app's events.
+*
+* A row is either standalone (built in the dashboard, `journey_key` null) or
+* owned by one journey whose trigger inlined its definition (ADR 0016). An
+* owned row is named after its journey's key, is written only by the push,
+* and goes when the journey does — which is what the composite foreign key
+* says: it points at `journeys(org_id, key)` and cascades. A null
+* `journey_key` satisfies it vacuously (MATCH SIMPLE), so standalone rows
+* are unconstrained.
 *
 * Timestamps use millisecond precision, same rationale as apps: JS Dates
 * carry ms only and cursor pagination compares createdAt for equality.
@@ -4048,12 +4127,29 @@ const insertQuarantineEntrySchema = createInsertSchema(quarantineEntries);
 const segments$1 = pgTable("segments", {
 	id: text("id").primaryKey(),
 	orgId: text("org_id").notNull(),
+	/** The one app this segment evaluates. */
+	appId: text("app_id").notNull(),
 	name: text("name").notNull(),
 	description: text("description"),
 	definition: jsonb("definition").$type().notNull(),
+	/** The journey that owns this row, or null for a standalone segment. */
+	journeyKey: text("journey_key"),
 	createdAt: createdAt(),
 	updatedAt: updatedAt()
-}, (table) => [index("segments_org_id_idx").on(table.orgId), uniqueIndex("segments_org_id_name_unique").on(table.orgId, table.name)]);
+}, (table) => [
+	index("segments_org_id_idx").on(table.orgId),
+	uniqueIndex("segments_org_id_name_unique").on(table.orgId, table.name),
+	foreignKey({
+		columns: [table.orgId, table.journeyKey],
+		foreignColumns: [journeys$1.orgId, journeys$1.key],
+		name: "segments_journey_fk"
+	}).onDelete("cascade"),
+	foreignKey({
+		columns: [table.orgId, table.appId],
+		foreignColumns: [apps$1.orgId, apps$1.id],
+		name: "segments_app_fk"
+	})
+]);
 /**
 * Materialized membership: one row per (segment, profile) currently in the
 * segment. Deleting a segment drops its members with it, and erasing a
@@ -4089,10 +4185,16 @@ const insertSegmentSchema = createInsertSchema(segments$1);
 * emits no domain events, so the mirror refreshes by pulling
 * `GetEmailIdentity` on a schedule and on the manual re-check button.
 *
-* The unique index on `domain` is GLOBAL, not per org: it is the
-* anti-squatting rule from the spec. Once one org claims a domain string, no
-* other org can claim it, and the cross-org parent/child guard (a query, not
-* a constraint) covers the subdomain half of the same rule.
+* A domain is claimed when it VERIFIES, not when it is added (ADR 0021).
+* Any number of orgs may hold the same unverified string; the partial unique
+* below is what makes at most one of them verified, and so the owner. The
+* cross-org parent/child guard (a query, not a constraint) refuses a claim
+* under or over a name another org already verified.
+*
+* SES keys ONE identity by the domain name, so its DKIM records, and the
+* SUCCESS it reports for them, are shared by every org holding the name.
+* They therefore prove that SOMEBODY controls the DNS, never which org, and
+* `challenge_token` is the part that is per org: the claim needs both.
 */
 /**
 * SES's identity status vocabulary, lower-cased like every other enum here.
@@ -4100,13 +4202,19 @@ const insertSegmentSchema = createInsertSchema(segments$1);
 * all report the same five words. `temporary_failure` is SES's retryable
 * state, which is neither verified nor a dead end, so it is kept distinct
 * from `failed`.
+*
+* `blocked` is the one value SES never says: the DNS checks out, but another
+* organization has already verified this name or a parent or child of it, so
+* the claim cannot be granted here (ADR 0021). It is a terminal-looking
+* state that clears itself, because every refresh re-asks the question.
 */
 const senderDomainStatusEnum = pgEnum("sender_domain_status", [
 	"not_started",
 	"pending",
 	"success",
 	"failed",
-	"temporary_failure"
+	"temporary_failure",
+	"blocked"
 ]);
 const senderDomains = pgTable("sender_domains", {
 	id: text("id").primaryKey(),
@@ -4120,12 +4228,25 @@ const senderDomains = pgTable("sender_domains", {
 	spfStatus: text("spf_status"),
 	/**
 	* The per-domain click-tracking toggle, Cowliss's own setting: the send
-	* picks SES's tracked configuration set when it is on. Off by default
-	* and always off for the shared fallback domain (which has no row here
-	* at all): one setting cannot serve every org sharing it.
+	* picks SES's tracked configuration set when it is on. Off by default:
+	* link rewriting is a thing an org opts into.
 	*/
 	clickTracking: boolean("click_tracking").notNull().default(false),
 	dnsRecords: jsonb("dns_records").$type().notNull().default([]),
+	/**
+	* This org's own proof of control, published as a TXT record under the
+	* domain. Random per row and never re-issued, so two orgs holding the
+	* same name publish different values and only the one that controls the
+	* DNS can publish its own. Verified once, at the moment the claim is
+	* granted; a live sender never loses its domain to one failed lookup.
+	*/
+	challengeToken: text("challenge_token").notNull().default(sql`replace(gen_random_uuid()::text, '-', '')`),
+	/** When this org's own TXT record was last seen. Null until it is. */
+	challengeVerifiedAt: timestamp("challenge_verified_at", {
+		withTimezone: true,
+		mode: "date",
+		precision: 3
+	}),
 	/** When the mirror last asked SES; drives the refresh sweep. */
 	lastCheckedAt: timestamp("last_checked_at", {
 		withTimezone: true,
@@ -4134,7 +4255,11 @@ const senderDomains = pgTable("sender_domains", {
 	}),
 	createdAt: createdAt(),
 	updatedAt: updatedAt()
-}, (table) => [uniqueIndex("sender_domains_domain_unique").on(table.domain), index("sender_domains_org_id_created_at_idx").on(table.orgId, table.createdAt)]);
+}, (table) => [
+	uniqueIndex("sender_domains_org_id_domain_unique").on(table.orgId, table.domain),
+	uniqueIndex("sender_domains_verified_domain_unique").on(table.domain).where(sql`${table.status} = 'success'`),
+	index("sender_domains_org_id_created_at_idx").on(table.orgId, table.createdAt)
+]);
 const selectSenderDomainSchema = createSelectSchema(senderDomains);
 const insertSenderDomainSchema = createInsertSchema(senderDomains);
 
@@ -4286,8 +4411,8 @@ const versions$1 = pgTable("versions", {
 	/** The file basename its author wrote; unique per org within a kind. */
 	key: text("key").notNull(),
 	kind: versionKindEnum("kind").notNull(),
-	/** The project that pushed this key; ADR 0009's ownership. */
-	projectId: text("project_id").notNull().references(() => projects.id),
+	/** The app that pushed this key; ADR 0009's ownership, ADR 0022's app. */
+	appId: text("app_id").notNull(),
 	/** The push that compiled this version's module. */
 	pushId: text("push_id").notNull().references(() => pushes$1.id),
 	moduleDigest: text("module_digest"),
@@ -4307,7 +4432,12 @@ const versions$1 = pgTable("versions", {
 }, (table) => [
 	uniqueIndex("versions_org_id_kind_key_module_digest_unique").on(table.orgId, table.kind, table.key, table.moduleDigest),
 	index("versions_org_id_kind_key_pushed_at_idx").on(table.orgId, table.kind, table.key, table.pushedAt),
-	index("versions_org_id_push_id_idx").on(table.orgId, table.pushId)
+	index("versions_org_id_push_id_idx").on(table.orgId, table.pushId),
+	foreignKey({
+		columns: [table.orgId, table.appId],
+		foreignColumns: [apps$1.orgId, apps$1.id],
+		name: "versions_app_fk"
+	})
 ]);
 const selectVersionSchema = createSelectSchema(versions$1);
 const insertVersionSchema = createInsertSchema(versions$1);
@@ -4490,8 +4620,6 @@ const ERROR_CODE_STATUS = {
 	journey_nondeterministic: 500,
 	push_invalid: 422,
 	version_not_ready: 409,
-	project_exists: 409,
-	project_missing: 404,
 	artifact_too_large: 413
 };
 /** First zod issue's message: enough signal for a 422 without a novel format. */
@@ -4545,6 +4673,21 @@ const identifierValueSchema = z.string().trim().min(1, "an identifier value is r
 * and a call names only the kinds it has.
 */
 const identifiersSchema = z.partialRecord(identifierKindSchema, identifierValueSchema).refine((value) => Object.keys(value).length > 0, { message: "identifiers must carry at least one entry" });
+/**
+* One identifier named as an object: how compliance addresses a person
+* when no `usr_` id is at hand (ADR 0022). A value two apps know is two
+* people, so the routes taking this act on every one of them.
+*
+* An object rather than the lookup route's `<kind>:<value>` string, because
+* the kind is then an enum at the boundary (a typo'd kind is a 422 for
+* free) and an address needs no escaping inside it. The value is
+* normalized by `normalizeIdentifierValue` where it is read, like every
+* other identifier.
+*/
+const identifierRefSchema = z.object({
+	kind: identifierKindSchema,
+	value: identifierValueSchema
+});
 /** One identifier as the profile DTOs carry it. */
 const identifierDtoSchema = z.object({
 	kind: identifierKindSchema,
@@ -4552,6 +4695,82 @@ const identifierDtoSchema = z.object({
 	createdAt: z.iso.datetime()
 });
 
+//#endregion
+//#region ../../packages/shared/src/segment-definition.ts
+/**
+* A segment definition: a flat list of predicates over traits and event
+* history, combined with `all` or `any`. Deliberately flat — nested predicate groups are YAGNI for the
+* prototype, and a flat list keeps the pure evaluator a fold.
+*
+* A definition names no app (ADR 0022): the segment row's own `app_id` is
+* the one app it evaluates, so the events and the profiles it reads are
+* that app's and there is nothing to filter by here.
+*
+* Apart from `./segments` because a journey's trigger carries a definition
+* and the trigger schema is bundled into the wasm guest, where an edge to
+* `@cowliss/db` (which `./segments` has, for the row schema) is a hard
+* bundler failure. Nothing here imports anything but zod.
+*
+* The object is strict: a definition holding the retired `sourceId` or
+* `appId` key (both of which meant the app) fails loudly instead of parsing
+* as an unfiltered definition that evaluates over every app. There is deliberately no pipe
+* filter here — filtering by source is a later feature, and accepting one
+* now would make a stale `sourceId` parse as a filter on a pipe that does
+* not exist and silently match nothing.
+*/
+const SEGMENT_TRAIT_OPS = [
+	"eq",
+	"neq",
+	"gt",
+	"gte",
+	"lt",
+	"lte",
+	"exists",
+	"notExists",
+	"contains"
+];
+/** Operators that read no comparison value: presence of the key is the test. */
+const VALUELESS_TRAIT_OPS = ["exists", "notExists"];
+const predicateNameSchema = z.string().trim().min(1, "predicate name is required").max(200);
+const segmentPredicateSchema = z.discriminatedUnion("kind", [z.object({
+	kind: z.literal("trait"),
+	name: predicateNameSchema,
+	op: z.enum(SEGMENT_TRAIT_OPS),
+	/**
+	* Compared against the stored trait, which is `unknown` because
+	* identify accepts arbitrary JSON. The evaluator coerces both sides
+	* before comparing, so authors here (CLI, MCP, dashboard) get the
+	* form-field-friendly reading rather than strict JSON equality:
+	* numeric-looking strings are compared as numbers for eq/neq and for
+	* ordering ("150" matches 150, and orders like it), and "true"/"false"
+	* are compared as booleans for eq/neq, trimmed and case-insensitively
+	* (" TRUE " reads as true). Coercion needs both sides to agree on a
+	* type: "0" never equals false. The numeric net is as wide as
+	* `Number()`, so "0x64", "0b11" and "1e2" read as numbers too, which
+	* matters most for opaque ids: "007" is authored as the number 7.
+	*
+	* contains reads three ways. Against an array trait it is membership
+	* under that same equality, so "true" matches `[true]` and "1" matches
+	* `[1, 2]`. Against a string trait it is a plain substring search with
+	* no coercion, since substrings only mean something between strings.
+	* Against anything else it never matches. Ordering never coerces
+	* booleans.
+	*/
+	value: z.unknown().optional()
+}), z.object({
+	kind: z.literal("event"),
+	name: predicateNameSchema,
+	op: z.enum(["performed", "notPerformed"]),
+	/** How many matching events the predicate counts as "performed". */
+	atLeast: z.number().int().min(1).default(1),
+	/** Rolling window, relative to evaluation time; absent means all history. */
+	withinDays: z.number().int().min(1).optional()
+})]).refine((predicate) => predicate.kind !== "trait" || VALUELESS_TRAIT_OPS.includes(predicate.op) || predicate.value !== void 0, { message: "value is required unless op is exists or notExists" });
+const segmentDefinitionSchema = z.strictObject({
+	match: z.enum(["all", "any"]).default("all"),
+	predicates: z.array(segmentPredicateSchema).min(1, "at least one predicate is required")
+});
+
 //#endregion
 //#region ../../packages/shared/src/journeys-v2/manifest.ts
 /**
@@ -4561,6 +4780,34 @@ const identifierDtoSchema = z.object({
 * changed, and stores that entry on the version it creates.
 */
 /**
+* A duration as journey code writes it: an ms-style string ("2d") or
+* milliseconds. It lives here rather than with the guest protocol because a
+* manifest carries one too (a journey's enrollment cooldown) and `./guest`
+* already imports this module, so the other direction would be a cycle.
+*/
+const durationSchema = z.union([z.string().min(1), z.number().int().nonnegative()]);
+const DURATION_PATTERN = /^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d|w)$/;
+const DURATION_UNIT_MS = {
+	ms: 1,
+	s: 1e3,
+	m: 6e4,
+	h: 36e5,
+	d: 864e5,
+	w: 6048e5
+};
+/**
+* A duration in milliseconds. The simulator's virtual clock and the runner's
+* timers both need it, and neither may pull in Temporal's `msToNumber` (one
+* runs in the CLI, the other inside workflow code).
+*/
+function parseDuration(duration) {
+	if (typeof duration === "number") return duration;
+	const match = DURATION_PATTERN.exec(duration.trim());
+	if (!match) throw new Error(`Duration ${JSON.stringify(duration)} is not a duration: use milliseconds or an ms-style string like "1h" or "2d".`);
+	const unit = DURATION_UNIT_MS[match[2]];
+	return Math.round(Number(match[1]) * unit);
+}
+/**
 * A journey or template key: the file basename under `journeys/` or
 * `emails/`, kebab-case and unique across the project. Becomes part of the
 * Temporal workflow id and travels in the journey chain, so it stays short.
@@ -4581,8 +4828,8 @@ const journeyKeySchema = z.string().max(64).regex(JOURNEY_KEY_PATTERN, "key must
 */
 const tagsSchema = z.array(z.string().trim().min(1).max(50, "a tag must be at most 50 characters")).max(20, "a journey or template takes at most 20 tags").default([]).transform((tags) => [...new Set(tags)]);
 /**
-* A consent purpose key: camelCase, matching the fixed `emailMarketing` and
-* `dataProcessing`. Purposes are keys in the `consent` map a customer reads
+* A consent purpose key: camelCase, matching the reserved `marketing` and
+* `transactional`. Purposes are keys in the `consent` map a customer reads
 * on their own profile, which is why they are not the kebab-case of a
 * journey key.
 */
@@ -4597,22 +4844,22 @@ const CONSENT_PURPOSE_KEY_PATTERN = /^[a-z][a-zA-Z0-9]*$/;
 const consentPurposeKeySchema = z.string().max(50, "a purpose key must be at most 50 characters").regex(CONSENT_PURPOSE_KEY_PATTERN, "a consent purpose key must be camelCase (a letter first, then letters and digits)");
 /**
 * One purpose a project declares in `cow.json` (spec: Decisions). A declared
-* purpose is marketing-class and sits under the `emailMarketing` umbrella,
-* so `denied` is the only default it may carry: the purpose is absent on
-* every profile that already exists, and a granted default would answer for
-* all of them at once.
+* purpose is marketing-class and sits under the `marketing` umbrella, so
+* `denied` is the only default it may carry: the purpose is absent on every
+* profile that already exists, and a granted default would answer for all of
+* them at once.
 *
 * The field stays required rather than disappearing, so every `cow.json` and
-* every stored manifest written before this still parses, and the column
-* behind it still holds `granted` for the seeded `dataProcessing` row: this
-* is a refusal at declaration time, not a narrower storage shape.
+* every stored manifest written before this still parses: this is a refusal
+* at declaration time, not a narrower storage shape.
 *
-* The two fixed purposes cannot be declared. They are seeded for every org
-* and owned by no project, so a project redeclaring one would be renaming
-* the master switch every other project's journeys hang off.
+* Neither reserved purpose can be declared: `marketing` is the master switch
+* every other project's journeys hang off, and `transactional` is not a
+* consent purpose at all, so declaring it would promise a switch that no
+* send ever reads.
 */
 const declaredPurposeSchema = z.strictObject({
-	key: consentPurposeKeySchema.refine((key) => !CONSENT_PURPOSES.includes(key), `${CONSENT_PURPOSES.join(" and ")} are fixed purposes and cannot be declared`),
+	key: consentPurposeKeySchema.refine((key) => !RESERVED_PURPOSES.includes(key), `${RESERVED_PURPOSES.join(" and ")} are reserved purposes and cannot be declared`),
 	/** What the dashboard and the account modal render beside the switch. */
 	label: z.string().trim().min(1).max(50, "a purpose label must be at most 50 characters"),
 	/** What the purpose means for a profile whose map does not answer it. */
@@ -4633,19 +4880,27 @@ const purposesSchema = z.array(declaredPurposeSchema).max(20, "a project declare
 const onePatternSchema = z.string().min(1).max(200, "a pattern must be at most 200 characters");
 const patternSchema = z.union([onePatternSchema, z.array(onePatternSchema).min(1).max(20, "a matcher takes at most 20 patterns")]);
 /**
-* What starts a journey: an event (optionally narrowed to an app id or a
-* list of them) or a segment entry. The registry DTO in `../journeys`
-* reuses it.
+* What starts a journey: an event, or entry into the segment the trigger
+* itself describes. The registry DTO in `../journeys` reuses it.
+*
+* No trigger names an app (ADR 0022): a repository is one app, the journey
+* row carries its `app_id`, and the runtime compares that with the event's.
+* An `appId` here would be a second way to say it, and the way to leak.
 *
-* Both members are strict, so a journey holding the retired `source` key
-* fails to compile instead of silently triggering on every app.
-* There is deliberately no pipe filter: a trigger narrows by the app the
-* write is attributed to, the same token a segment definition names.
+* A segment trigger carries the predicate list, not a name: the push
+* materializes one segment row per journey that inlines a definition, owned
+* by the journey and named after its key, so the segment exists because the
+* journey exists and there is no order to get wrong (ADR 0016). The
+* definition is data — validated here, carried on the version, never
+* compiled and never executed.
+*
+* Both members are strict, so a journey holding the retired `source` or
+* `appId` key, or the retired `{ segment: "name" }` form, fails to build
+* instead of silently triggering on every app or on nothing. There is
+* deliberately no pipe filter and no app filter: the journey's own app is
+* the only narrowing there is.
 */
-const triggerSchema = z.union([z.strictObject({
-	event: patternSchema,
-	appId: patternSchema.optional()
-}), z.strictObject({ segment: z.string().min(1) })]);
+const triggerSchema = z.union([z.strictObject({ event: patternSchema }), z.strictObject({ segment: segmentDefinitionSchema })]);
 /**
 * The address half of a from-header: a local part, an `@`, and a dotted
 * domain. Deliberately narrower than RFC 5322 (no quoted local parts, no
@@ -4748,10 +5003,35 @@ const manifestJourneySchema = z.object({
 	*/
 	purpose: consentPurposeKeySchema,
 	/**
+	* How often one recipient may enter. Enrollment derives from the purpose
+	* (ADR 0015), so the only thing an author writes is how long after a
+	* completed run the journey re-opens: absent means once, ever. Refused on
+	* a transactional journey, which enrolls on every trigger — see
+	* `manifestSchema` below, where the cross-field check lives (a refinement
+	* on this object would break the `.pick()` the guest SDK and the guest
+	* protocol both take of it).
+	*/
+	enrollment: z.strictObject({ cooldown: durationSchema.refine((value) => {
+		try {
+			parseDuration(value);
+			return true;
+		} catch {
+			return false;
+		}
+	}, "a cooldown must be milliseconds or an ms-style string like \"7d\"") }).optional(),
+	/**
+	* The author's own sentence about what this journey does, shown wherever
+	* the journey is read. Capped like a segment's description; absent when
+	* the author wrote none.
+	*/
+	description: z.string().trim().max(500, `description must be at most ${500} characters`).optional(),
+	/**
 	* The address every `send.email` in this journey goes out as, unless the
-	* call names its own. Optional everywhere: an omitted one is the
-	* organization's shared fallback address, which is what makes day-one
-	* sending zero-config (ADR 0014).
+	* call names its own. Required of the author (`defineJourney` types it so,
+	* and `cow build` refuses a journey without it), and still optional here:
+	* releases pushed before ADR 0014 was amended carry none, and this schema
+	* parses stored manifests as well as new ones. A push with no `from` is
+	* refused by the domain gate, which says what to do about it.
 	*/
 	from: fromSchema.optional(),
 	spine: z.array(spineEntrySchema),
@@ -4764,6 +5044,13 @@ const manifestTemplateSchema = z.object({
 	sendClass: z.enum(SEND_CLASSES),
 	/** True asks the host to mint a signed `verifyUrl` prop at send time. */
 	verifyLink: z.boolean(),
+	/**
+	* True asks the host to mint a signed `unsubscribeUrl` prop at send time,
+	* for the author's own footer link. Default false: a marketing send whose
+	* HTML carries no unsubscribe link at all still gets one, appended as a
+	* platform footer, so the link is never the author's to forget.
+	*/
+	unsubscribeLink: z.boolean().default(false),
 	/** JSON Schema of the template's `props`, converted by `cow build`. */
 	propsSchema: z.record(z.string(), z.unknown()),
 	bundle: digestSchema
@@ -4814,6 +5101,15 @@ const manifestSchema = z.object({
 	uniqueKeys(manifest.journeys, ctx, "journeys");
 	uniqueKeys(manifest.templates, ctx, "templates");
 	uniqueKeys(manifest.purposes ?? [], ctx, "purposes");
+	for (const [index, journey] of manifest.journeys.entries()) if (journey.enrollment && journey.purpose === "transactional") ctx.addIssue({
+		code: "custom",
+		message: `journey "${journey.key}": a transactional journey enrolls on every trigger, so it takes no enrollment cooldown`,
+		path: [
+			"journeys",
+			index,
+			"enrollment"
+		]
+	});
 });
 /**
 * One entry of a stored manifest: what a version is a snapshot of. Journeys
@@ -4877,7 +5173,7 @@ const traitBagSchema = z.custom((value) => value !== null && typeof value === "o
 * `identify` carries it too: the grant has to have a route in through
 * ingestion, or the only thing anyone can express is the revocation.
 */
-const consentPatchSchema = z.partialRecord(consentPurposeKeySchema.meta({ examples: [EMAIL_MARKETING] }), z.boolean()).refine((data) => Object.keys(data).length > 0, { message: "at least one consent purpose is required" });
+const consentPatchSchema = z.partialRecord(consentPurposeKeySchema.meta({ examples: [MARKETING] }), z.boolean()).refine((data) => Object.keys(data).length > 0, { message: "at least one consent purpose is required" });
 /**
 * The identify payload fields, shared between the single-call body schema
 * and the batch item schema (which drops `sourceId`: a batch names one
@@ -4900,6 +5196,74 @@ const identifyDataSchema = identifyFieldsSchema.refine((data) => notFutureTimest
 });
 const identifyBodySchema = z.object({ data: identifyDataSchema });
 
+//#endregion
+//#region ../../packages/shared/src/journeys-v2/config.ts
+/**
+* An app id as `cow.json` carries it: the readable `app_<slug>`
+* `appIdFromName` derives, which is the one id a developer types by hand.
+*
+* It lives here rather than beside the app DTOs in ../apps because that
+* module imports the Drizzle schema, which neither the wasmtime guest nor
+* the Temporal workflow isolate can carry, and because `cow.json` is the
+* file a developer types it into. Everything that names an app on the wire
+* reuses it.
+*/
+const appIdSchema = z.string().trim().max(200).regex(new RegExp(`^${ID_PREFIXES.app}[a-z0-9]+(-[a-z0-9]+)*$`), "an app id looks like \"app_website\"");
+/**
+* A source id: the one inbound pipe an ingestion or send call names. It
+* lives beside `appIdSchema` for the same two reasons — the sources module
+* imports the Drizzle schema, and both are ids that travel on the wire — and
+* it has the same shape, so a bare `src_` is refused here rather than at the
+* database.
+*
+* The prefixes above and here are interpolated raw; `journeys-v2.test.ts`
+* asserts they are plain `<word>_` literals, so none of them can quietly
+* change what these patterns match.
+*/
+const sourceIdSchema = z.string().trim().max(200).regex(new RegExp(`^${ID_PREFIXES.source}[a-z0-9_]+$`), "a source id looks like \"src_01j8x…\"");
+/**
+* A Clerk organization id, as `cow.json` spells it. Exported beside
+* `appIdSchema` because the push body carries the org the file names so the
+* server can refuse a push aimed at another one (ADR 0022).
+*/
+const orgIdSchema = z.string().trim().max(200).startsWith(CLERK_ORG_SUBJECT_PREFIX, "orgId must be a Clerk org id");
+/**
+* `cow.json` (spec: Project layout): the org, and which of its apps this
+* repository pushes to. Auth never lives in the file. Strict, so a typo'd
+* key is a build error rather than a silently ignored setting — which is
+* also what turns the retired `project` key into a refusal (`cow build`
+* says what to rename it to).
+*/
+const cowConfigSchema = z.strictObject({
+	$schema: z.url().optional(),
+	orgId: orgIdSchema,
+	/**
+	* Which app of the org this repository pushes to (ADR 0022). The app is
+	* the push unit: it owns the journey and template keys, and `cow
+	* status`, `cow enable --all` and `cow pull` all resolve against it. One
+	* repository is one app, so no journey file names one.
+	*/
+	appId: appIdSchema,
+	/**
+	* The consent purposes this repository declares. They are org-wide, so
+	* two apps declaring one key must agree on its label and default or the
+	* push is refused; a push adds and updates them and never deletes one,
+	* because profiles hold answers against them.
+	*/
+	purposes: purposesSchema.optional(),
+	/** Overrides the API the CLI talks to; the hosted product needs none. */
+	apiUrl: z.url().optional(),
+	/**
+	* Overrides the dashboard `cow login` opens. Paired with `apiUrl`: a
+	* login against one Cowliss's dashboard yields a token the other's API
+	* rejects, so a config that names an API names its dashboard too.
+	*/
+	webUrl: z.url().optional()
+}).meta({
+	title: "cow.json",
+	description: "A cow project: the organization and the app it pushes to."
+});
+
 //#endregion
 //#region ../../packages/shared/src/track.ts
 /**
@@ -4959,7 +5323,7 @@ const trackBodySchema = z.object({ data: trackDataSchema });
 */
 const listEventsQuerySchema = paginationQuerySchema.extend({
 	direction: sortDirectionSchema.default("desc"),
-	appId: z.string().trim().min(1).max(200).optional(),
+	appId: appIdSchema.optional(),
 	sourceId: z.string().trim().min(1).max(200).optional(),
 	event: z.string().trim().min(1).max(200).optional(),
 	/**
@@ -5482,10 +5846,16 @@ const listDeliveriesQuerySchema = paginationQuerySchema.extend({
 	channel: deliveryChannelSchema.optional(),
 	/** Why the send happened: a journey, a test send, or a direct API send. */
 	kind: deliveryKindSchema.optional(),
-	appId: z.string().trim().min(1).max(200).optional(),
+	appId: appIdSchema.optional(),
 	/** One person's deliveries, merged ids included, same as the event feed. */
 	profileId: z.string().trim().min(1).max(200).optional(),
 	/**
+	* What one journey execution sent. Exact, not approximated from journey
+	* and profile: a profile that enrolls twice has one execution per
+	* enrollment, and the older one must not show the newer one's sends.
+	*/
+	executionId: z.string().trim().min(1).max(200).optional(),
+	/**
 	* Only deliveries touched at or after this instant, by `updatedAt`: the
 	* cursor a tail (`cow dev`) polls with, so a send and its later feedback
 	* transition both arrive. Inclusive for the same reason as the execution
@@ -5523,6 +5893,7 @@ const dnsRecordSchema = z.object({
 /** One sending domain on the wire: dates become ISO 8601 strings. */
 const senderDomainSchema = selectSenderDomainSchema.extend({
 	dnsRecords: z.array(dnsRecordSchema),
+	challengeVerifiedAt: z.iso.datetime().nullable(),
 	lastCheckedAt: z.iso.datetime().nullable(),
 	createdAt: z.iso.datetime(),
 	updatedAt: z.iso.datetime()
@@ -5563,10 +5934,10 @@ const domainDnsSetupSchema = z.object({
 * braces, no dependency. A pattern field takes one pattern or a non-empty
 * list of them, and a list is a disjunction.
 *
-* It lives here rather than beside `appIdList` in ./apps because that module
-* imports the Drizzle schema, which neither the wasmtime guest nor the
-* Temporal workflow isolate can carry. This file imports one constant, so
-* both can.
+* It lives here rather than beside `appIdFromName` in ./apps because that
+* module imports the Drizzle schema, which neither the wasmtime guest nor
+* the Temporal workflow isolate can carry. This file imports one constant,
+* so both can.
 *
 * The system rule: a name under SYSTEM_EVENT_PREFIX matches only a pattern
 * whose *literal prefix* (the text before its first `*`) is itself under
@@ -5645,29 +6016,6 @@ function patternPlaceholder(pattern) {
 * a guest returns with these schemas before anything acts on it; the guest
 * SDK and the Node simulator produce and consume the same shapes.
 */
-/** A duration as journey code writes it: an ms-style string ("2d") or milliseconds. */
-const durationSchema = z.union([z.string().min(1), z.number().int().nonnegative()]);
-const DURATION_PATTERN = /^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d|w)$/;
-const DURATION_UNIT_MS = {
-	ms: 1,
-	s: 1e3,
-	m: 6e4,
-	h: 36e5,
-	d: 864e5,
-	w: 6048e5
-};
-/**
-* A duration in milliseconds. The simulator's virtual clock and the runner's
-* timers both need it, and neither may pull in Temporal's `msToNumber` (one
-* runs in the CLI, the other inside workflow code).
-*/
-function parseDuration(duration) {
-	if (typeof duration === "number") return duration;
-	const match = DURATION_PATTERN.exec(duration.trim());
-	if (!match) throw new Error(`Duration ${JSON.stringify(duration)} is not a duration: use milliseconds or an ms-style string like "1h" or "2d".`);
-	const unit = DURATION_UNIT_MS[match[2]];
-	return Math.round(Number(match[1]) * unit);
-}
 /** The event a journey runs for, or waits on: name, properties, and when. */
 const guestEventSchema = z.object({
 	name: z.string().min(1),
@@ -5707,8 +6055,9 @@ const commandSchema = z.discriminatedUnion("name", [
 			/**
 			* The address this mail leaves as. The guest SDK fills in the
 			* journey's own whenever the call does not name one, so the host has
-			* one resolution path and never reads the manifest to find it;
-			* absent on both is the organization's shared fallback address.
+			* one resolution path and never reads the manifest to find it. A
+			* journey must name one, so absent on both is a release pushed before
+			* that was true, and the `domain` gate refuses it.
 			*/
 			from: fromSchema.optional(),
 			/** Where a reply to this one mail goes, instead of the from-address. */
@@ -5852,11 +6201,14 @@ const manifestInputSchema = z.object({ kind: z.literal("manifest") });
 const manifestOutputSchema = z.discriminatedUnion("kind", [manifestJourneySchema.pick({
 	trigger: true,
 	purpose: true,
+	enrollment: true,
+	description: true,
 	from: true,
 	tags: true
 }).extend({ kind: z.literal("journey") }), manifestTemplateSchema.pick({
 	sendClass: true,
 	verifyLink: true,
+	unsubscribeLink: true,
 	propsSchema: true,
 	tags: true
 }).extend({ kind: z.literal("template") })]);
@@ -5923,6 +6275,13 @@ const listExecutionsQuerySchema = paginationQuerySchema.extend({
 	status: executionStatusSchema.optional(),
 	profileId: z.string().trim().min(1).max(200).optional(),
 	/**
+	* One app's runs. An execution carries no app of its own: it is a run of
+	* a journey, and the journey is what belongs to an app (ADR 0022), so the
+	* filter resolves through `journeys.app_id`. Omitted means every app, and
+	* an id the org does not have matches nobody.
+	*/
+	appId: appIdSchema.optional(),
+	/**
 	* Only executions touched at or after this instant, by `updatedAt`: what a
 	* tail (`cow dev`) asks for so it sees both new runs and status changes in
 	* one filter. Inclusive on purpose, because two rows can share a
@@ -5949,74 +6308,24 @@ const cancelExecutionsBodySchema = z.object({ data: z.object({
 const cancellingSchema = z.object({ cancelling: z.literal(true) });
 
 //#endregion
-//#region ../../packages/shared/src/journeys-v2/config.ts
+//#region ../../packages/shared/src/pushes.ts
 /**
-* A project's name: what `cow init` asked for, and what the `projects` row
-* stores. Lives here rather than beside the release DTOs because `cow.json`
-* is the file a developer types it into; `createProjectBodySchema` reuses it.
+* The push lifecycle's wire contracts (ADR 0011): the artifacts `cow push`
+* uploads, the push itself, and the versions its compile produces. The app
+* `cow.json` names is the push unit (ADR 0022).
+*
+* Row-derived through drizzle-zod where a row is what the wire carries, so
+* the DTO cannot drift from the column set; the jsonb manifest gets its
+* explicit shared schema, because the column type is opaque to drizzle-zod.
 */
-const projectNameSchema = z.string().trim().min(1).max(200);
+const artifactDigestParams = z.object({ digest: digestSchema });
 /**
-* `cow.json` (spec: Project layout): the org, and which of its projects this
-* directory is. Auth never lives in the project. Strict, so a typo'd key
-* is a build error rather than a silently ignored setting.
-*/
-const cowConfigSchema = z.strictObject({
-	$schema: z.url().optional(),
-	orgId: z.string().startsWith(CLERK_ORG_SUBJECT_PREFIX, "orgId must be a Clerk org id"),
-	/**
-	* Which project of the org this directory pushes to. One org can hold
-	* several, one per repo, each with its own release sequence and its own
-	* slice of the deployed journeys, so every project says which it is.
-	*/
-	project: projectNameSchema,
-	/**
-	* The consent purposes this project declares. They are org-wide, so two
-	* projects declaring one key must agree on its label and default or the
-	* deploy is refused; a deploy adds and updates them and never deletes
-	* one, because profiles hold answers against them.
-	*/
-	purposes: purposesSchema.optional(),
-	/** Overrides the API the CLI talks to; the hosted product needs none. */
-	apiUrl: z.url().optional(),
-	/**
-	* Overrides the dashboard `cow login` opens. Paired with `apiUrl`: a
-	* login against one Cowliss's dashboard yields a token the other's API
-	* rejects, so a config that names an API names its dashboard too.
-	*/
-	webUrl: z.url().optional()
-}).meta({
-	title: "cow.json",
-	description: "A cow project: the organization and the project it pushes to."
-});
-
-//#endregion
-//#region ../../packages/shared/src/pushes.ts
-/**
-* The push lifecycle's wire contracts (ADR 0011): the project a developer
-* runs `cow init` in, the artifacts `cow push` uploads, the push itself, and
-* the versions its compile produces.
-*
-* Row-derived through drizzle-zod where a row is what the wire carries, so
-* the DTO cannot drift from the column set; the jsonb manifest gets its
-* explicit shared schema, because the column type is opaque to drizzle-zod.
-*/
-const projectSchema = selectProjectSchema.extend({
-	createdAt: z.iso.datetime(),
-	updatedAt: z.iso.datetime()
-});
-/** `cow init` names the project after the folder it created. */
-const createProjectBodySchema = z.object({ data: z.object({ name: projectNameSchema }) });
-/** Which project to read: the one the caller's `cow.json` names. */
-const getProjectQuerySchema = z.object({ name: projectNameSchema });
-const artifactDigestParams = z.object({ digest: digestSchema });
-/**
-* Which kind of artifact the uploaded bytes are. Named by the client rather
-* than sniffed, because only the build knows whether a blob is a journey
-* bundle or the source tarball, and the value is metadata for the prune
-* sweep and the sandbox's cache rather than a trust boundary: what a module
-* is, is decided by the server-side compile step. `module` is absent on
-* purpose, since only that compile step ever writes one.
+* Which kind of artifact the uploaded bytes are. Named by the client rather
+* than sniffed, because only the build knows whether a blob is a journey
+* bundle or the source tarball, and the value is metadata for the prune
+* sweep and the sandbox's cache rather than a trust boundary: what a module
+* is, is decided by the server-side compile step. `module` is absent on
+* purpose, since only that compile step ever writes one.
 */
 const putArtifactQuerySchema = z.object({ kind: z.enum(["bundle", "source"]) });
 /**
@@ -6040,7 +6349,7 @@ const versionSummarySchema = selectVersionSchema.pick({
 	status: true,
 	moduleDigest: true,
 	pushId: true,
-	projectId: true,
+	appId: true,
 	error: true
 }).extend({ pushedAt: z.iso.datetime() });
 /**
@@ -6069,12 +6378,21 @@ const createPushBodySchema = z.object({ data: z.object({
 	* the developer fixes by updating `@cowliss/cli`, and nothing is stored.
 	*/
 	manifest: manifestSchema.safeExtend({ protocol: z.literal(3) }),
-	/** The `cow.json` project this push belongs to. */
-	project: projectNameSchema
+	/** The `cow.json` app this push belongs to (ADR 0022). */
+	appId: appIdSchema,
+	/**
+	* The `cow.json` organization. The credential already decides which org
+	* is written to, so this is not how the server finds the org: it is the
+	* developer saying which one they meant, and a disagreement is refused.
+	* Without it, a push aimed at production but run with local credentials
+	* lands silently whenever both orgs happen to hold an app of the same
+	* slug, which is exactly the shape `apps/platform-workspace` has.
+	*/
+	orgId: orgIdSchema
 }) });
 const listPushesQuerySchema = paginationQuerySchema.extend({ 
-/** One project's own pushes; absent lists the org's. */
-project: projectNameSchema.optional() });
+/** One app's own pushes; absent lists the org's. */
+appId: appIdSchema.optional() });
 /**
 * One key's version history, newest first. Both the key and the kind are
 * required: journeys and templates share a key space, so `welcome` alone
@@ -6085,13 +6403,13 @@ const listVersionsQuerySchema = paginationQuerySchema.extend({
 	kind: z.enum(["journey", "template"])
 });
 /**
-* One key of a project as `cow status` and the MCP `status` tool report it:
-* the code the server holds for it, whether it is on, and what is still
+* One key of an app as `cow status` and the MCP `status` tool report it:
+* the code the server holds for it, what state it is in, and what is still
 * running. Journeys and templates share the shape, because a developer asks
 * the same question of both; the two fields only a journey has are null on a
 * template.
 */
-const projectStatusKeySchema = z.object({
+const appStatusKeySchema = z.object({
 	kind: z.enum(["journey", "template"]),
 	key: z.string(),
 	/**
@@ -6100,34 +6418,107 @@ const projectStatusKeySchema = z.object({
 	* server holds. Null only for a journey whose versions are all pruned.
 	*/
 	latestVersion: versionSchema.nullable(),
-	/** The journey's one flag; null on a template, which has none. */
-	enabled: z.boolean().nullable(),
+	/**
+	* The journey's one state; null on a template, which has none. Built from
+	* the column here rather than imported from `journeys.ts`, which reads
+	* this module for its version summary.
+	*/
+	status: z.enum(journeyStatusEnum.enumValues).nullable(),
 	/** Executions still running or waiting. */
 	liveExecutions: z.number().int()
 });
 /**
-* Everything the server knows about one project's keys, in one read: the
-* whole project rather than a page of it, because a manifest holds at most
+* Everything the server knows about one app's keys, in one read: the whole
+* app rather than a page of it, because a manifest holds at most
 * `PUSH_LIMITS.journeys + PUSH_LIMITS.templates` keys and the answer to "what
-* is my project doing" is useless split across cursors.
+* is my app doing" is useless split across cursors.
 *
 * `warnings` is what a deploy used to answer with (ADR 0011 retired the
 * deploy): a name a journey references that the organization does not
 * define yet. They never block, because a segment or a webhook may be created
 * right after a push.
 */
-const projectStatusSchema = z.object({
-	project: projectNameSchema,
-	keys: z.array(projectStatusKeySchema),
+const appStatusSchema = z.object({
+	appId: appIdSchema,
+	keys: z.array(appStatusKeySchema),
 	warnings: z.array(z.string())
 });
 
+//#endregion
+//#region ../../packages/shared/src/segments.ts
+const segmentSchema = selectSegmentSchema.extend({
+	definition: segmentDefinitionSchema,
+	createdAt: z.iso.datetime(),
+	updatedAt: z.iso.datetime()
+});
+/** The detail view adds the materialized member count. */
+const segmentDetailSchema = segmentSchema.extend({ memberCount: z.number().int().min(0) });
+const segmentMemberSchema = z.object({
+	segmentId: z.string(),
+	orgId: z.string(),
+	profileId: z.string(),
+	enteredAt: z.iso.datetime()
+});
+/**
+* The builder's design-time sanity check: run one not-yet-persisted
+* definition over one app's existing profiles. The app is the same one the
+* segment would be created in (ADR 0022), so the count the builder shows is
+* the count saving it would produce. Members is a small sample of matching
+* profile ids, not the full member list: there is no segment row and no
+* membership entry, so there is no segmentId or enteredAt to report.
+*
+* The scan is bounded, so `memberCount` is the exact count for that app only
+* when `truncated` is false. When it is true the scan stopped at the cap,
+* and `memberCount` is the count over the first `scanned` profiles only.
+*/
+const previewSegmentBodySchema = z.object({ data: z.object({
+	appId: appIdSchema,
+	definition: segmentDefinitionSchema
+}) });
+const segmentPreviewSchema = z.object({
+	memberCount: z.number().int().min(0),
+	members: z.array(z.string()),
+	/** Profiles the preview actually evaluated. */
+	scanned: z.number().int().min(0),
+	/** True when the scan hit its cap, so memberCount is a floor. */
+	truncated: z.boolean()
+});
+const nameSchema = z.string().trim().min(1, "name is required").max(100, "name must be at most 100 characters");
+const descriptionSchema = z.string().trim().max(500, `description must be at most ${500} characters`);
+/**
+* A segment belongs to exactly one app (ADR 0022), named here and never
+* again: it evaluates that app's profiles and that app's events, and an
+* update cannot move it, because the members it already has belong to the
+* app it was built for.
+*/
+const createSegmentBodySchema = z.object({ data: z.object({
+	name: nameSchema,
+	appId: appIdSchema,
+	description: descriptionSchema.nullish(),
+	definition: segmentDefinitionSchema
+}) });
+const updateSegmentBodySchema = z.object({ data: z.object({
+	name: nameSchema.optional(),
+	description: descriptionSchema.nullish(),
+	definition: segmentDefinitionSchema.optional()
+}).refine((data) => data.name !== void 0 || data.description !== void 0 || data.definition !== void 0, { message: "at least one field (name, description or definition) is required" }) });
+/**
+* `q` is a substring search over the segment's name; `appId` narrows to one
+* app's segments, and omitted means every app. An id the org does not have
+* matches nobody rather than 404ing, like every other list filter.
+*/
+const listSegmentsQuerySchema = paginationQuerySchema.extend({
+	q: searchQuerySchema,
+	appId: appIdSchema.optional()
+});
+const listSegmentMembersQuerySchema = paginationQuerySchema.extend({});
+
 //#endregion
 //#region ../../packages/shared/src/journeys.ts
 /**
 * Journeys as the API reports them: the rows a push derives from its
 * manifest, one per (org, key). Nothing here is authored through the API, so
-* the only write is the enable flag.
+* the only write is the status.
 *
 * Derived from the Drizzle table via drizzle-zod so the wire DTO and the row
 * share one source of truth; the jsonb columns get explicit wire schemas
@@ -6140,11 +6531,19 @@ const journeyTriggerSchema = triggerSchema;
 * control flow is whatever its code does at run time.
 */
 const journeySpineEntrySchema = spineEntrySchema;
+/**
+* The one operational state a manager sets (ADR 0018). `on` lets recipients
+* enroll and executions run; `off` enrolls nobody and lets what is in flight
+* finish; `paused` enrolls nobody and holds what is in flight before its next
+* step. Turning a paused journey on resumes it.
+*/
+const JOURNEY_STATUSES = journeyStatusEnum.enumValues;
+const journeyStatusSchema = z.enum(JOURNEY_STATUSES);
 const journeySchema = selectJourneySchema.extend({
 	trigger: journeyTriggerSchema,
 	purpose: consentPurposeKeySchema,
 	spine: z.array(journeySpineEntrySchema),
-	enabled: z.boolean(),
+	status: journeyStatusSchema,
 	/**
 	* The newest version of this key, whatever it compiled to, so a list can
 	* say "pushed 2 hours ago" and "compiling" without a second read. What the
@@ -6157,14 +6556,29 @@ const journeySchema = selectJourneySchema.extend({
 	updatedAt: z.iso.datetime()
 });
 /**
+* One journey, with the segment it owns when its trigger inlines a
+* definition (ADR 0016): the same row and member count the segments API
+* reports, so the journey's page can show who is in its segment without a
+* second concept. Null for an event trigger.
+*
+* On the read of one journey only. A list would be one member count per row,
+* and a list already shows the trigger.
+*/
+const journeyDetailSchema = journeySchema.extend({ segment: segmentDetailSchema.nullable() });
+/**
 * Journey list query. `q` is a substring search over the key and the tags,
 * the two things an author names a journey by; `tag` is "has this tag",
 * exact and case-sensitive, so a badge in the table is the way into it.
 * Both are server-side, like every other list filter.
+*
+* `appId` narrows to one app's journeys (ADR 0022); omitted means every
+* app. An id the org does not have matches nobody, the same empty answer
+* `journeys.setStatus` gives it.
 */
 const listJourneysQuerySchema = paginationQuerySchema.extend({
-	/** On or off; the journey's one flag. */
-	enabled: z.enum(["true", "false"]).optional(),
+	/** On, off or paused; the journey's one state. */
+	status: journeyStatusSchema.optional(),
+	appId: appIdSchema.optional(),
 	q: z.string().trim().max(200, "q must be at most 200 characters").optional().transform((value) => value ? value : void 0),
 	tag: z.string().trim().max(50, "tag must be at most 50 characters").optional()
 });
@@ -6192,19 +6606,25 @@ const journeyStatsSchema = z.object({
 	deliveries: z.object({ byStatus: z.record(deliveryStatusSchema, z.number().int()) })
 });
 /**
-* Which journeys the flag acts on: the keys the caller named, or every
-* journey of one project. Exactly one of the two, because a call carrying
-* both would have to decide which it meant.
+* Which journeys the status acts on, and which state to put them in: the
+* keys the caller named, or every journey of one app. Exactly one of the
+* two selectors, because a call carrying both would have to decide which it
+* meant.
 *
 * A list rather than one key per call so every surface can do what `cow
-* enable` does: name several keys, or `--all` (which is `project`, resolved
-* server-side, so an agent turning a project on is one call too).
+* enable` does: name several keys, or `--all` (which is `appId`, resolved
+* server-side, so an agent turning an app on is one call too).
+*
+* One body for three states rather than a route per verb (ADR 0018): the
+* transitions differ in what they do to what is in flight, not in who may
+* ask or what they name.
 */
-const setJourneysEnabledBodySchema = z.object({ data: z.object({
+const setJourneysStatusBodySchema = z.object({ data: z.object({
 	keys: z.array(journeyKeySchema).min(1).max(PUSH_LIMITS.journeys).optional(),
-	/** Every journey of this project, by the name `cow.json` carries. */
-	project: projectNameSchema.optional()
-}).refine((data) => data.keys === void 0 !== (data.project === void 0), { message: "name keys or a project, not both" }) });
+	/** Every journey of this app, by the id `cow.json` carries. */
+	appId: appIdSchema.optional(),
+	status: journeyStatusSchema
+}).refine((data) => data.keys === void 0 !== (data.appId === void 0), { message: "name keys or an app, not both" }) });
 /**
 * Dry run: one real profile, the journey's latest ready version, and every
 * send gated into a `would_*` row instead of a message. The body is the v1
@@ -6212,6 +6632,106 @@ const setJourneysEnabledBodySchema = z.object({ data: z.object({
 * now and a v1 instance was a Temporal read.
 */
 const dryRunJourneyBodySchema = z.object({ data: z.object({ profileId: z.string().min(1) }) });
+/**
+* Enrollment (ADR 0015): what turning a journey on would do, or is doing,
+* to the people already in its audience.
+*
+* The same three numbers answer both questions, so they are one schema: a
+* preview walks the whole segment counting, and the running job counts the
+* same way as it goes. `scanned` is the segment's current membership,
+* `enrolled` the ones that entered (or in a preview would), and the skips
+* say why the rest did not.
+*/
+const enrollmentCountsSchema = z.object({
+	scanned: z.number().int(),
+	enrolled: z.number().int(),
+	skipped: z.object({
+		/** They have been through this journey, and it enrolls once. */
+		completed: z.number().int(),
+		/** They finished recently and the journey's cooldown has not elapsed. */
+		cooldown: z.number().int(),
+		/** They are in the journey right now. */
+		running: z.number().int()
+	})
+});
+/**
+* How each skip is said to a person, in the order the surfaces list them.
+* The confirm screen, the progress card and `cow enable` all report the same
+* three numbers, and the words for them live here so the three cannot drift:
+* `tile` names the count on its own, `reason` completes "N ...".
+*/
+const ENROLLMENT_SKIP_WORDS = {
+	completed: {
+		tile: "Already been through",
+		reason: "have already been through it"
+	},
+	cooldown: {
+		tile: "Too recently",
+		reason: "went through it too recently"
+	},
+	running: {
+		tile: "In it already",
+		reason: "are in it right now"
+	}
+};
+const enrollmentStatusSchema = enrollmentCountsSchema.extend({ 
+/**
+* `running` while the job works, `done` when it finished the segment,
+* `cancelled` when someone stopped it, `stopped` when the journey itself
+* stopped being on under it, `failed` when it could not finish. On any of
+* the three that end early the counts are what it reached, and the people
+* it already enrolled stay in the journey.
+*/
+state: z.enum([
+	"running",
+	"done",
+	"cancelled",
+	"stopped",
+	"failed"
+]) });
+/**
+* What a journey turned on says about the audience it now has waiting.
+*
+* It rides on the status response rather than being fetched separately so
+* that every surface that moves the control sees it: `cow enable` prints it,
+* and the MCP tool, which is planned from the contract and has no code of
+* its own, returns it. An agent that cannot start the enrollment can still
+* tell the person who can how many people it would reach and where to go.
+*
+* Null on a journey whose trigger is an event: there is no standing audience
+* to reach. `counts` is null when the numbers could not be worked out just
+* then; the journey is on either way, because a count nobody could read is
+* no reason to leave the switch off.
+*/
+const enrollmentOfferSchema = z.object({
+	counts: enrollmentCountsSchema.nullable(),
+	/** The journey's page, where the offer can be accepted. */
+	url: z.string()
+});
+/**
+* A journey as the status route answers, carrying that offer. Null on every
+* status but `on`: a journey turned off or held reaches nobody, so there is
+* no audience to offer.
+*/
+const journeyWithOfferSchema = journeySchema.extend({ enrollment: enrollmentOfferSchema.nullable() });
+/**
+* What holding a journey until a given day would end (ADR 0018). A wait
+* that comes due while the journey is held ends that person's run, so
+* before putting one on hold it is worth knowing how many runs that is.
+*
+* The day is the caller's, not a fixed horizon: "until tomorrow" and "until
+* next month" are different decisions, and the numbers behind them are what
+* tell them apart.
+*/
+const waitsDueQuerySchema = z.object({ 
+/** Count the waits that come due before this instant. */
+before: z.iso.datetime() });
+const waitsDueSchema = z.object({
+	/** Executions in flight whose next step comes due before then. */
+	due: z.number().int(),
+	/** Executions in flight altogether, due or not. */
+	inFlight: z.number().int()
+});
 
 //#endregion
 //#region ../../packages/shared/src/journeys-v2/sandbox.ts
@@ -6330,7 +6850,7 @@ const RESEND_MAX_TAGS = 50;
 const recipientSchema = z.string().trim().max(320).refine((value) => parseFromAddress(value) !== null, { message: "Every recipient must be an address (\"ada@acme.com\") or a name and address (\"Ada <ada@acme.com>\")." });
 const recipientArraySchema = z.array(recipientSchema).min(1).max(50);
 /** Resend takes one address or a list wherever it takes recipients. */
-const recipientsSchema = z.union([recipientSchema, recipientArraySchema]);
+const recipientsSchema$1 = z.union([recipientSchema, recipientArraySchema]);
 /**
 * Resend's wording for an absent required field. Three fields can be
 * missing: `to`, `subject`, and a body. Which answer each one gets is read
@@ -6361,11 +6881,11 @@ const templateSlotSchema = z.strictObject({
 /** Send body: Resend's fields, minus the ones Cowliss does not serve. */
 const resendSendBodySchema = z.strictObject({
 	/**
-	* Optional here where Resend requires it: an omitted `from` is the
-	* organization's shared fallback address, which is what makes a first
-	* send work with no configuration at all.
+	* Required, exactly as Resend requires it. There is no address to fall
+	* back to: a send leaves from a domain the organization verified, and
+	* nothing else. Missing is its own issue for the same reason `to`'s is.
 	*/
-	from: z.string().trim().max(200).refine((value) => parseFromAddress(value) !== null, { message: "The from address must be an address (\"billing@acme.com\") or a name and address (\"Billing <billing@acme.com>\")." }).optional(),
+	from: z.string().trim().max(200).refine((value) => parseFromAddress(value) !== null, { message: "The from address must be an address (\"billing@acme.com\") or a name and address (\"Billing <billing@acme.com>\")." }).optional().nonoptional({ error: MISSING("from") }),
 	/**
 	* Required, and the absence is its own issue rather than the union's:
 	* `optional().nonoptional()` lets the value through to the union when
@@ -6382,9 +6902,9 @@ const resendSendBodySchema = z.strictObject({
 	subject: z.string().trim().min(1).max(RESEND_MAX_SUBJECT).optional(),
 	html: z.string().optional(),
 	text: z.string().optional(),
-	cc: recipientsSchema.optional(),
-	bcc: recipientsSchema.optional(),
-	reply_to: recipientsSchema.optional(),
+	cc: recipientsSchema$1.optional(),
+	bcc: recipientsSchema$1.optional(),
+	reply_to: recipientsSchema$1.optional(),
 	headers: z.record(z.string(), z.string()).optional(),
 	/** Accepted and dropped: Cowliss tags a delivery by its own fields. */
 	tags: z.array(z.object({
@@ -6573,133 +7093,76 @@ const listReviewQuerySchema = paginationQuerySchema.extend({
 });
 
 //#endregion
-//#region ../../packages/shared/src/segments.ts
+//#region ../../packages/shared/src/send-email.ts
 /**
-* Segments API contracts. The definition is the interesting part: a flat
-* list of predicates over traits and event history, combined with `all` or
-* `any`. Deliberately flat — nested predicate groups are YAGNI for the
-* prototype, and a flat list keeps the pure evaluator a fold.
-*
-* `appId` scopes the EVENT side of a definition only. Traits are
-* per-profile and profiles merge across apps, so there is nothing
-* app-shaped to filter on the trait side.
+* `POST /v1/emails`: the first-party transactional send, the one a
+* `@cowliss/sdk` client calls. The Resend-compatible facade (ADR 0014) is
+* the same send in somebody else's wire format; this is ours, so it is
+* camelCase, enveloped, and answers with our error codes.
 *
-* A definition and the membership it produces are both the
-* organization's.
-*
-* The object is strict: a definition holding the retired `sourceId` key
-* (which meant the app) fails loudly instead of parsing as an unfiltered
-* definition that evaluates over every app. There is deliberately no pipe
-* filter here — filtering by source is a later feature, and accepting one
-* now would make a stale `sourceId` parse as a filter on a pipe that does
-* not exist and silently match nothing.
+* The limits are deliberately the same numbers as the facade's: two shapes
+* over one send path must not accept different messages.
 */
-const SEGMENT_TRAIT_OPS = [
-	"eq",
-	"neq",
-	"gt",
-	"gte",
-	"lt",
-	"lte",
-	"exists",
-	"notExists",
-	"contains"
-];
-/** Operators that read no comparison value: presence of the key is the test. */
-const VALUELESS_TRAIT_OPS = ["exists", "notExists"];
-const predicateNameSchema = z.string().trim().min(1, "predicate name is required").max(200);
-const segmentPredicateSchema = z.discriminatedUnion("kind", [z.object({
-	kind: z.literal("trait"),
-	name: predicateNameSchema,
-	op: z.enum(SEGMENT_TRAIT_OPS),
+const addressSchema = z.string().trim().max(320).refine((value) => parseFromAddress(value) !== null, { message: "An address is \"ada@acme.com\" or a name and address, \"Ada <ada@acme.com>\"." });
+/** One address or a list, wherever a message names recipients. */
+const recipientsSchema = z.union([addressSchema, z.array(addressSchema).min(1).max(50)]);
+/** A template this organization pushed, plus the props it declares. */
+const templateSchema$1 = z.strictObject({
+	key: journeyKeySchema,
+	props: z.record(z.string(), z.unknown()).optional()
+});
+const sendEmailDataSchema = z.strictObject({
 	/**
-	* Compared against the stored trait, which is `unknown` because
-	* identify accepts arbitrary JSON. The evaluator coerces both sides
-	* before comparing, so authors here (CLI, MCP, dashboard) get the
-	* form-field-friendly reading rather than strict JSON equality:
-	* numeric-looking strings are compared as numbers for eq/neq and for
-	* ordering ("150" matches 150, and orders like it), and "true"/"false"
-	* are compared as booleans for eq/neq, trimmed and case-insensitively
-	* (" TRUE " reads as true). Coercion needs both sides to agree on a
-	* type: "0" never equals false. The numeric net is as wide as
-	* `Number()`, so "0x64", "0b11" and "1e2" read as numbers too, which
-	* matters most for opaque ids: "007" is authored as the number 7.
-	*
-	* contains reads three ways. Against an array trait it is membership
-	* under that same equality, so "true" matches `[true]` and "1" matches
-	* `[1, 2]`. Against a string trait it is a plain substring search with
-	* no coercion, since substrings only mean something between strings.
-	* Against anything else it never matches. Ordering never coerces
-	* booleans.
+	* The pipe the message belongs to. A source id and only a source id: the
+	* Resend facade takes an app id in its base URL because the Resend SDK
+	* has nowhere else to put one, and nothing else on the wire does.
 	*/
-	value: z.unknown().optional()
-}), z.object({
-	kind: z.literal("event"),
-	name: predicateNameSchema,
-	op: z.enum(["performed", "notPerformed"]),
-	/** How many matching events the predicate counts as "performed". */
-	atLeast: z.number().int().min(1).default(1),
-	/** Rolling window, relative to evaluation time; absent means all history. */
-	withinDays: z.number().int().min(1).optional()
-})]).refine((predicate) => predicate.kind !== "trait" || VALUELESS_TRAIT_OPS.includes(predicate.op) || predicate.value !== void 0, { message: "value is required unless op is exists or notExists" });
-const appIdSchema = z.string().trim().min(1);
-const segmentDefinitionSchema = z.strictObject({
-	match: z.enum(["all", "any"]).default("all"),
+	sourceId: sourceIdSchema,
+	to: recipientsSchema,
+	cc: recipientsSchema.optional(),
+	bcc: recipientsSchema.optional(),
+	replyTo: recipientsSchema.optional(),
 	/**
-	* Optional app filter over the event side; null/absent spans apps.
-	* A list matches any of the named apps, which is how one definition
-	* names the development and the production id of the same app.
+	* An address on a domain this organization verified. There is no other.
+	* Shape is checked here, the same as the Resend body checks it, so an
+	* address that is not one is a 422 naming the field rather than a 403
+	* telling the caller to verify a domain they never named.
 	*/
-	appId: z.union([appIdSchema, z.array(appIdSchema).min(1)]).nullish(),
-	predicates: z.array(segmentPredicateSchema).min(1, "at least one predicate is required")
-});
-const segmentSchema = selectSegmentSchema.extend({
-	definition: segmentDefinitionSchema,
-	createdAt: z.iso.datetime(),
-	updatedAt: z.iso.datetime()
-});
-/** The detail view adds the materialized member count. */
-const segmentDetailSchema = segmentSchema.extend({ memberCount: z.number().int().min(0) });
-const segmentMemberSchema = z.object({
-	segmentId: z.string(),
-	orgId: z.string(),
-	profileId: z.string(),
-	enteredAt: z.iso.datetime()
-});
-/**
-* The builder's design-time sanity check: run one not-yet-persisted
-* definition over the org's existing profiles. Members is a small sample of
-* matching profile ids, not the full member list: there is no segment row
-* and no membership entry, so there is no segmentId or enteredAt to report.
-*
-* The scan is bounded, so `memberCount` is the exact org-wide count only
-* when `truncated` is false. When it is true the scan stopped at the cap,
-* and `memberCount` is the count over the first `scanned` profiles only.
-*/
-const previewSegmentBodySchema = z.object({ data: segmentDefinitionSchema });
-const segmentPreviewSchema = z.object({
-	memberCount: z.number().int().min(0),
-	members: z.array(z.string()),
-	/** Profiles the preview actually evaluated. */
-	scanned: z.number().int().min(0),
-	/** True when the scan hit its cap, so memberCount is a floor. */
-	truncated: z.boolean()
+	from: z.string().trim().max(200).refine((value) => parseFromAddress(value) !== null, { message: "The from address must be an address (\"billing@acme.com\") or a name and address (\"Billing <billing@acme.com>\")." }),
+	subject: z.string().max(RESEND_MAX_SUBJECT).optional(),
+	html: z.string().optional(),
+	text: z.string().optional(),
+	headers: z.record(z.string(), z.string()).optional(),
+	template: templateSchema$1.optional()
+}).superRefine((body, ctx) => {
+	const hasBody = body.html !== void 0 || body.text !== void 0;
+	if (body.template) {
+		for (const field of [
+			"subject",
+			"html",
+			"text"
+		]) if (body[field] !== void 0) ctx.addIssue({
+			code: "custom",
+			path: [field],
+			message: `A message names a template or writes its own body, not both. Drop \`${field}\`.`
+		});
+		return;
+	}
+	if (!hasBody) ctx.addIssue({
+		code: "custom",
+		path: ["html"],
+		message: "A message needs a template, or an html or text body."
+	});
+	if (body.subject === void 0) ctx.addIssue({
+		code: "custom",
+		path: ["subject"],
+		message: "A message that writes its own body needs a subject."
+	});
 });
-const nameSchema = z.string().trim().min(1, "name is required").max(100, "name must be at most 100 characters");
-const descriptionSchema = z.string().trim().max(500, "description must be at most 500 characters");
-const createSegmentBodySchema = z.object({ data: z.object({
-	name: nameSchema,
-	description: descriptionSchema.nullish(),
-	definition: segmentDefinitionSchema
-}) });
-const updateSegmentBodySchema = z.object({ data: z.object({
-	name: nameSchema.optional(),
-	description: descriptionSchema.nullish(),
-	definition: segmentDefinitionSchema.optional()
-}).refine((data) => data.name !== void 0 || data.description !== void 0 || data.definition !== void 0, { message: "at least one field (name, description or definition) is required" }) });
-/** `q` is a substring search over the segment's name. */
-const listSegmentsQuerySchema = paginationQuerySchema.extend({ q: searchQuerySchema });
-const listSegmentMembersQuerySchema = paginationQuerySchema.extend({});
+const sendEmailBodySchema = z.object({ data: sendEmailDataSchema });
+const sendEmailResultSchema = z.object({ 
+/** The delivery this send left behind: the row in Deliveries. */
+deliveryId: z.string() });
 
 //#endregion
 //#region ../../packages/shared/src/settings.ts
@@ -6722,9 +7185,9 @@ const orgSettingsDtoSchema = z.object({
 	/**
 	* Clerk's slug and display name for the org, cached by the API and
 	* READ-ONLY here: Clerk owns them, and the org profile is edited in
-	* Clerk's own UI. Exposed because they are the shared fallback sender the
-	* domains page shows (`<slug>@<shared domain>` as `<name>`). Null until a
-	* member has hit the dashboard API once.
+	* Clerk's own UI. Exposed because a template test-send composes its
+	* from-address out of them (`orgFromAddress`). Null until a member has hit
+	* the dashboard API once.
 	*/
 	slug: z.string().nullable(),
 	name: z.string().nullable()
@@ -6856,13 +7319,19 @@ const listSuppressionsQuerySchema = paginationQuerySchema.extend({ q: searchQuer
 */
 const templateSchema = z.object({
 	key: journeyKeySchema,
-	/** The project whose push owns this key (ADR 0009). */
-	projectId: z.string(),
+	/** The app whose push owns this key (ADR 0009, ADR 0022). */
+	appId: z.string(),
 	/** The author's labels; the dashboard's only grouping. */
 	tags: tagsSchema,
 	sendClass: z.enum(SEND_CLASSES),
 	/** True when the template asks for a signed `verifyUrl` prop at send time. */
 	verifyLink: z.boolean(),
+	/**
+	* True when the template asks for a signed `unsubscribeUrl` prop at send
+	* time. A marketing template without one (or without rendering the link)
+	* gets a platform footer with the link appended at send time instead.
+	*/
+	unsubscribeLink: z.boolean().default(false),
 	/** JSON Schema of the template's props, as `cow build` converted them. */
 	propsSchema: z.record(z.string(), z.unknown()),
 	/** The newest version of this key, whatever it compiled to. */
@@ -6912,6 +7381,20 @@ const userSegmentSchema = z.object({
 });
 const listUserSegmentsQuerySchema = paginationQuerySchema;
 /**
+* One journey the profile ran to completion
+* (GET /v1/users/:profileId/runs): which journey it was, when it finished,
+* and the execution it finished, which is null once that execution is no
+* longer kept. Paged on (completedAt, id) newest first, so the cursor's
+* sortAt slot carries the completion time.
+*/
+const userRunSchema = z.object({
+	id: z.string(),
+	journeyKey: z.string(),
+	completedAt: z.iso.datetime(),
+	executionId: z.string().nullable()
+});
+const listUserRunsQuerySchema = paginationQuerySchema;
+/**
 * Profile list query. `q` is a free-text substring search over the
 * profile's identifier values and the identity traits in
 * PROFILE_SEARCH_TRAITS; absent means no filter. An empty or
@@ -6923,10 +7406,17 @@ const listUserSegmentsQuerySchema = paginationQuerySchema;
 * as text (the jsonb value rendered with ->>), so "who is on the pro plan" is
 * one request. `traitValue` without `trait` is meaningless and is a 422: the
 * value names no key to look in.
+*
+* `appId` narrows to one app's profiles (ADR 0022); omitted means every app.
+* An id the org does not have simply matches nobody, like `segmentId`. `q`
+* still searches identifier values across the org, so an address two apps
+* know answers with one profile per app.
 */
 const listUsersQuerySchema = paginationQuerySchema.extend({
 	direction: sortDirectionSchema.default("asc"),
 	q: searchQuerySchema,
+	/** One app's profiles. An unknown id matches nobody, it is not a 404. */
+	appId: appIdSchema.optional(),
 	trait: z.string().trim().min(1).max(200).optional(),
 	traitValue: z.string().trim().min(1).max(500).optional(),
 	/** Members of one segment. An unknown id matches nobody, it is not a 404. */
@@ -6952,13 +7442,32 @@ const findUserQuerySchema = z.object({ identifier: z.string().trim().min(3, "ide
 const userDetailSchema = profileDtoSchema.extend({ mergedIds: z.array(z.string()) });
 const updateConsentBodySchema = z.object({ data: consentPatchSchema });
 /**
-* DELETE /v1/users/:profileId: what erasure did, so the dashboard action
-* can say "n journey instances terminated".
+* What erasure did, so the dashboard action can say "n journey instances
+* terminated". `profileIds` is the people that were erased: one id for
+* `DELETE /v1/users/:profileId`, one per app for an erasure by identifier
+* (ADR 0022). They are the survivor ids, the ones anyone could have
+* addressed; the merged-away ids that went with them are not listed,
+* because nothing ever showed them as a person.
 */
 const eraseUserResponseSchema = z.object({
-	profileId: z.string(),
+	profileIds: z.array(z.string()),
 	terminatedInstances: z.number().int().min(0)
 });
+/**
+* Erase everyone one identifier names (POST /v1/users/erase), across the
+* organization's apps. Same erasure as by id, addressed by
+* `{ kind, value }` because that is what a person asking to be forgotten
+* gives you; a value nobody in the org carries is a 404.
+*/
+const eraseUserByIdentifierBodySchema = z.object({ data: identifierRefSchema });
+/**
+* The same addressing for the export (POST /v1/users/export). A body rather
+* than a query string for the same reason erasure uses one: a query string
+* is part of the URL, and an access log, a proxy log and a browser history
+* all keep it, so an address must not travel there. The method reads
+* nothing but says where the identifier goes.
+*/
+const exportUserByIdentifierBodySchema = z.object({ data: identifierRefSchema });
 /** One address-ledger row on the export; dates are ISO 8601 strings. */
 const emailAddressSchema = selectEmailAddressSchema.extend({
 	verifiedAt: z.iso.datetime().nullable(),
@@ -6971,14 +7480,20 @@ const journeyRunDtoSchema = selectJourneyRunSchema.extend({
 	createdAt: z.iso.datetime()
 });
 /**
-* GET /v1/users/:profileId/export: the identity's whole data record in one
-* JSON document (GDPR portability). Each section reuses the wire DTO of
-* the store it came from, so the export cannot drift from what the
-* dashboard already shows.
+* The identity's whole data record in one JSON document (GDPR
+* portability). Each section reuses the wire DTO of the store it came
+* from, so the export cannot drift from what the dashboard already shows.
+*
+* `users` is who the document is about: one profile for
+* `GET /v1/users/:profileId/export`, one per app when the export is
+* addressed by identifier (ADR 0022). The other sections are the union over
+* all of them and over everything merged into them, because that is the
+* data the request asked for, and because a person's export is one file
+* whether they used one product or three.
 */
 const userExportSchema = z.object({
 	exportedAt: z.iso.datetime(),
-	user: userDetailSchema,
+	users: z.array(userDetailSchema),
 	events: z.array(eventDtoSchema),
 	journeys: z.array(journeyRunDtoSchema),
 	deliveries: z.array(deliverySchema),
@@ -7930,7 +8445,9 @@ async function assertCowConfig(projectDir) {
 	} catch {
 		throw new Error(name === "cow.json" ? `No ${name} in "${projectDir}". Run \`cow init\` to create a project.` : `No ${name} in "${projectDir}". That file was selected with --config or COW_CONFIG.`);
 	}
-	const parsed = cowConfigSchema.safeParse(JSON.parse(text));
+	const raw = JSON.parse(text);
+	if (typeof raw === "object" && raw !== null && "project" in raw) throw new Error(`${name} names a "project", which Cowliss no longer has: a repository pushes to one app. Rename that field to "appId" and give it the app's id, which looks like "app_website" and is on the app's page in the dashboard.`);
+	const parsed = cowConfigSchema.safeParse(raw);
 	if (!parsed.success) throw new Error(`${name} is invalid: ${parsed.error.issues.map((issue) => `${issue.path.join(".") || "(root)"}: ${issue.message}`).join("; ")}`);
 	return parsed.data;
 }
@@ -7943,14 +8460,14 @@ async function readCowConfig(projectDir) {
 	}
 }
 /**
-* Which project of the org this directory belongs to: the `project` in its
+* Which app of the org this directory pushes to: the `appId` in its
 * `cow.json`, or undefined when there is no `cow.json` here at all. The
-* undefined case is `cow pull` into an empty directory, which has no project
-* to scope by yet and reads the org's releases.
+* undefined case is `cow pull` into an empty directory, which has no app to
+* scope by yet and reads the org's pushes.
 */
-async function configuredProject(projectDir) {
+async function configuredApp(projectDir) {
 	try {
-		return (await assertCowConfig(projectDir)).project;
+		return (await assertCowConfig(projectDir)).appId;
 	} catch {
 		return;
 	}
@@ -7992,8 +8509,13 @@ async function buildProject(projectDir) {
 	const manifestJourneys = [];
 	const manifestTemplates = [];
 	for (const built of bundles) {
-		const { module, runGuest } = await loadNodeBundle(projectDir, built.source.key, built.source.kind);
-		const report = await runGuest(module, { kind: "manifest" });
+		let report;
+		try {
+			const { module, runGuest } = await loadNodeBundle(projectDir, built.source.key, built.source.kind);
+			report = await runGuest(module, { kind: "manifest" });
+		} catch (error) {
+			throw new Error(`${built.source.relPath}: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+		}
 		const isJourney = built.source.kind === "journeys";
 		if (report?.kind !== (isJourney ? "journey" : "template")) throw new Error(`${built.source.relPath} is not a ${isJourney ? "journey" : "template"}: a journey default-exports defineJourney({ ... }), a template exports a component and a zod \`props\` schema.`);
 		if (report.kind === "journey") manifestJourneys.push({
@@ -8001,6 +8523,8 @@ async function buildProject(projectDir) {
 			tags: report.tags,
 			trigger: report.trigger,
 			purpose: report.purpose,
+			enrollment: report.enrollment,
+			description: report.description,
 			from: report.from,
 			spine: readSpine(await readFile(built.source.file, "utf8")),
 			bundle: built.digest
@@ -8010,6 +8534,7 @@ async function buildProject(projectDir) {
 			tags: report.tags,
 			sendClass: report.sendClass,
 			verifyLink: report.verifyLink,
+			unsubscribeLink: report.unsubscribeLink,
 			propsSchema: report.propsSchema,
 			bundle: built.digest
 		});
@@ -8213,7 +8738,7 @@ async function copyExample(name, dir, force) {
 	return files;
 }
 function registerAdd(program, io) {
-	program.command("add").description("add gallery example code to a cow project").command("example <name>").description("copy an example's journeys, emails, and scenarios into this project (local: no API call)").option("--force", "overwrite files that already exist").action(async (name, opts) => {
+	program.command("add").description("add gallery example code to a cow repo").command("example <name>").description("copy an example's journeys, emails, and scenarios into this repo (local: no API call)").option("--force", "overwrite files that already exist").action(async (name, opts) => {
 		const dir = process.cwd();
 		await assertCowConfig(dir);
 		const files = await copyExample(name, dir, opts.force === true);
@@ -8242,10 +8767,13 @@ async function login(env, options) {
 	const claims = decodeSessionToken(token);
 	if (claims === null) throw new Error("Token is not a decodable JWT");
 	if (claims.userId === null) throw new Error("Token has no subject claim. Is it a Clerk session token?");
-	const credentials = { token };
-	if (options.apiFlag !== void 0) credentials.apiUrl = options.apiFlag;
+	const apiUrl = options.apiFlag ?? resolveApiUrl(env, null, void 0, (await readCowConfig(process.cwd()))?.apiUrl);
 	return {
-		credentialsPath: await writeCredentials(env, credentials),
+		credentialsPath: await writeCredentials(env, {
+			token,
+			apiUrl
+		}),
+		apiUrl,
 		userId: claims.userId,
 		orgId: claims.orgId,
 		role: claims.role,
@@ -8332,7 +8860,7 @@ function openBrowser(url) {
 //#region src/commands/auth.ts
 /** login/logout/whoami: session-token management, no contract route. */
 function registerAuth(program, env, io) {
-	program.command("login").description("authenticate via the dashboard browser flow (or --token) and cache the session token").option("--token <jwt>", "paste a Clerk session token instead of the browser flow").option("--web <url>", `dashboard URL; overrides COW_WEB_URL and webUrl in the project config (default ${DEFAULT_WEB_URL})`).option("--no-open", "do not open the browser; print the URL and wait (headless/agent use)").action(async (opts) => {
+	program.command("login").description("authenticate via the dashboard browser flow (or --token) and cache the session token").option("--token <jwt>", "paste a session token instead of the browser flow").option("--web <url>", `dashboard URL; overrides COW_WEB_URL and webUrl in cow.json (default ${DEFAULT_WEB_URL})`).option("--no-open", "do not open the browser; print the URL and wait (headless/agent use)").action(async (opts) => {
 		const outcome = await login(env, {
 			token: opts.token,
 			webUrl: opts.web,
@@ -8362,8 +8890,14 @@ function registerAuth(program, env, io) {
 		}
 		const claims = decodeSessionToken(credentials?.token ?? "");
 		if (!claims) throw new Error("Cached token is not decodable. Run `cow login` again.");
+		const projectApiUrl = (await readCowConfig(process.cwd()))?.apiUrl;
+		const apiUrl = resolveApiUrl(env, credentials, opts.api, projectApiUrl);
+		const mintedFor = credentials?.apiUrl;
 		emit({ data: {
 			credential: kind,
+			apiUrl,
+			mintedFor: mintedFor ?? null,
+			...mintedFor !== void 0 && mintedFor !== apiUrl ? { warning: `This token was minted for ${mintedFor}, but commands here talk to ${apiUrl}. Run \`cow login\` again from this directory.` } : {},
 			...claims
 		} }, io, opts.json);
 	});
@@ -8376,7 +8910,7 @@ function registerAuth(program, env, io) {
 * the current directory. Local only, no API call and no network.
 */
 function registerBuild(program, io) {
-	program.command("build").description("typecheck and bundle the project in the current directory, writing .cow/build (local: no API call)").action(async (opts) => {
+	program.command("build").description("typecheck and bundle the repo in the current directory, writing .cow/build (local: no API call)").action(async (opts) => {
 		emit({ data: await buildProject(process.cwd()) }, io, opts.json);
 	});
 }
@@ -8809,7 +9343,8 @@ function htmlResponse(description) {
 const params$11 = z.object({ id: z.string() });
 /**
 * An app is the attribution unit: what a developer names, what ingestion
-* stamps, and what segments and journey triggers filter on. Its inbound
+* stamps, and what a profile, a segment and a journey belong to (ADR 0022).
+* It is also the push unit, which is what `status` reports on. Its inbound
 * pipes live under /v1/apps/{appId}/sources, served by the sources module.
 */
 const apps = defineModule(defineRoute({
@@ -8867,6 +9402,23 @@ const apps = defineModule(defineRoute({
 		...sessionErrors,
 		...errors("not_found", "validation_failed", "malformed_request")
 	}
+}), defineRoute({
+	method: "get",
+	path: "/v1/apps/{id}/status",
+	operationId: "apps.status",
+	tags: ["apps"],
+	summary: "What an app's journeys and templates are doing",
+	security: PIPELINE_AUTH,
+	surfaces: {
+		cli: false,
+		mcpName: "status"
+	},
+	request: { params: params$11 },
+	responses: {
+		200: envelope(appStatusSchema),
+		...sessionErrors,
+		...errors("not_found", "validation_failed")
+	}
 }));
 
 //#endregion
@@ -9158,7 +9710,7 @@ const catalog = defineModule(defineRoute({
 //#region ../../packages/shared/src/contract/consent.ts
 /**
 * The consent purposes an organization's profiles answer: the two fixed ones
-* every org has, plus whatever its projects declare in their `cow.json`.
+* every org has, plus whatever its apps declare in their `cow.json`.
 *
 * Read-only, and deliberately so. Purposes are code, like journeys and
 * templates: a deploy upserts them and never deletes one, because profiles
@@ -9300,11 +9852,11 @@ const domains = defineModule(defineRoute({
 	path: "/v1/domains",
 	operationId: "domains.create",
 	tags: ["domains"],
-	summary: "Claim a sending domain",
+	summary: "Add a sending domain",
 	security: SESSION_AUTH,
 	request: { body: jsonBody(createSenderDomainBodySchema) },
 	responses: {
-		201: envelope(senderDomainSchema, "The claimed domain with the DNS records to publish"),
+		201: envelope(senderDomainSchema, "The domain with the DNS records to publish, which is what claims it"),
 		...sessionErrors,
 		...errors("conflict", "validation_failed", "malformed_request", "dependency_unavailable")
 	}
@@ -9357,7 +9909,7 @@ const domains = defineModule(defineRoute({
 	path: "/v1/domains/{id}",
 	operationId: "domains.delete",
 	tags: ["domains"],
-	summary: "Give up a domain claim",
+	summary: "Give up a sending domain",
 	security: SESSION_AUTH,
 	request: { params: params$9 },
 	responses: {
@@ -9369,8 +9921,31 @@ const domains = defineModule(defineRoute({
 
 //#endregion
 //#region ../../packages/shared/src/contract/emails.ts
-/** The public email-verification pages: the signed token is the authorization. */
+/**
+* The transactional send a developer's own code makes, plus the public
+* email-verification pages.
+*
+* `emails.send` is the first-party shape of the same send the Resend facade
+* serves (ADR 0014): one service, two wire formats, and this one answers in
+* the envelope with our error codes. It authenticates with an org API key
+* like the rest of the write path, which is why it is hidden from the CLI
+* and MCP surfaces: those hold a session.
+*/
 const emails = defineModule(defineRoute({
+	method: "post",
+	path: "/v1/emails",
+	operationId: "emails.send",
+	tags: ["emails"],
+	summary: "Send one transactional email",
+	security: API_KEY_AUTH,
+	surfaces: HIDDEN_FROM_TOOLS,
+	request: { body: jsonBody(sendEmailBodySchema) },
+	responses: {
+		201: envelope(sendEmailResultSchema, "Handed over; the delivery's id"),
+		...ingestionErrors,
+		...errors("forbidden", "not_found", "conflict")
+	}
+}), defineRoute({
 	method: "get",
 	path: "/v1/public/verify",
 	operationId: "emails.verifyPage",
@@ -9644,7 +10219,7 @@ const journeys = defineModule(defineRoute({
 	security: SESSION_AUTH,
 	request: { params: params$7 },
 	responses: {
-		200: envelope(journeySchema),
+		200: envelope(journeyDetailSchema),
 		...sessionErrors,
 		...errors("not_found")
 	}
@@ -9663,31 +10238,33 @@ const journeys = defineModule(defineRoute({
 	}
 }), defineRoute({
 	method: "post",
-	path: "/v1/journeys/enable",
-	operationId: "journeys.enable",
+	path: "/v1/journeys/status",
+	operationId: "journeys.setStatus",
 	tags: ["journeys"],
-	summary: "Turn journeys on",
+	summary: "Put journeys on, off or on hold",
 	security: PIPELINE_AUTH,
 	surfaces: { cli: false },
-	request: { body: jsonBody(setJourneysEnabledBodySchema) },
+	request: { body: jsonBody(setJourneysStatusBodySchema) },
 	responses: {
-		200: envelope(z.array(journeySchema), "The journeys as they now stand"),
+		200: envelope(z.array(journeyWithOfferSchema), "The journeys as they now stand, each with the members turning it on has waiting"),
 		...sessionErrors,
-		...errors("not_found", "project_missing", "validation_failed", "malformed_request")
+		...errors("not_found", "validation_failed", "malformed_request")
 	}
 }), defineRoute({
-	method: "post",
-	path: "/v1/journeys/disable",
-	operationId: "journeys.disable",
+	method: "get",
+	path: "/v1/journeys/{key}/waits",
+	operationId: "journeys.waitsDue",
 	tags: ["journeys"],
-	summary: "Turn journeys off",
-	security: PIPELINE_AUTH,
-	surfaces: { cli: false },
-	request: { body: jsonBody(setJourneysEnabledBodySchema) },
+	summary: "Count the executions a hold until a given day would end",
+	security: SESSION_AUTH,
+	request: {
+		params: params$7,
+		query: waitsDueQuerySchema
+	},
 	responses: {
-		200: envelope(z.array(journeySchema), "The journeys as they now stand"),
+		200: envelope(waitsDueSchema, "Executions in flight, and how many of them come due before that instant"),
 		...sessionErrors,
-		...errors("not_found", "project_missing", "validation_failed", "malformed_request")
+		...errors("not_found", "validation_failed")
 	}
 }), defineRoute({
 	method: "delete",
@@ -9702,6 +10279,59 @@ const journeys = defineModule(defineRoute({
 		...sessionErrors,
 		...errors("not_found")
 	}
+}), defineRoute({
+	method: "get",
+	path: "/v1/journeys/{key}/enrollment/preview",
+	operationId: "journeys.enrollmentPreview",
+	tags: ["journeys"],
+	summary: "Count who turning this journey on would reach",
+	security: SESSION_AUTH,
+	request: { params: params$7 },
+	responses: {
+		200: envelope(enrollmentCountsSchema, "What enrolling the journey's current members would do"),
+		...sessionErrors,
+		...errors("not_found", "dependency_unavailable")
+	}
+}), defineRoute({
+	method: "post",
+	path: "/v1/journeys/{key}/enrollment",
+	operationId: "journeys.startEnrollment",
+	tags: ["journeys"],
+	summary: "Enroll the journey's current members",
+	security: SESSION_AUTH,
+	surfaces: HIDDEN_FROM_TOOLS,
+	request: { params: params$7 },
+	responses: {
+		202: envelope(enrollmentStatusSchema, "The job, as it starts"),
+		...sessionErrors,
+		...errors("not_found")
+	}
+}), defineRoute({
+	method: "get",
+	path: "/v1/journeys/{key}/enrollment",
+	operationId: "journeys.enrollmentStatus",
+	tags: ["journeys"],
+	summary: "How far the journey's enrollment has got",
+	security: SESSION_AUTH,
+	request: { params: params$7 },
+	responses: {
+		200: envelope(enrollmentStatusSchema),
+		...sessionErrors,
+		...errors("not_found")
+	}
+}), defineRoute({
+	method: "post",
+	path: "/v1/journeys/{key}/enrollment/cancel",
+	operationId: "journeys.cancelEnrollment",
+	tags: ["journeys"],
+	summary: "Stop a running enrollment",
+	security: SESSION_AUTH,
+	request: { params: params$7 },
+	responses: {
+		200: envelope(enrollmentStatusSchema, "The job as it stood when the stop was asked for"),
+		...sessionErrors,
+		...errors("not_found")
+	}
 }), defineRoute({
 	method: "post",
 	path: "/v1/journeys/{key}/dry-run",
@@ -9769,63 +10399,11 @@ const me = defineModule(defineRoute({
 	}
 }));
 
-//#endregion
-//#region ../../packages/shared/src/contract/project.ts
-/**
-* The org's project. Singular in the path on purpose: a caller always means
-* one, the one its `cow.json` names, so the name is a query parameter and
-* there is no id to put in a URL. An org with a single project needs neither.
-*/
-const project = defineModule(defineRoute({
-	method: "get",
-	path: "/v1/project",
-	operationId: "project.get",
-	tags: ["project"],
-	summary: "Get one of the organization's projects",
-	security: PIPELINE_AUTH,
-	request: { query: getProjectQuerySchema },
-	responses: {
-		200: envelope(projectSchema),
-		...sessionErrors,
-		...errors("project_missing", "validation_failed", "malformed_request")
-	}
-}), defineRoute({
-	method: "get",
-	path: "/v1/project/status",
-	operationId: "project.status",
-	tags: ["project"],
-	summary: "What a project's journeys and templates are doing",
-	security: PIPELINE_AUTH,
-	surfaces: {
-		cli: false,
-		mcpName: "status"
-	},
-	request: { query: getProjectQuerySchema },
-	responses: {
-		200: envelope(projectStatusSchema),
-		...sessionErrors,
-		...errors("project_missing", "validation_failed", "malformed_request")
-	}
-}), defineRoute({
-	method: "post",
-	path: "/v1/project",
-	operationId: "project.create",
-	tags: ["project"],
-	summary: "Create a project in the organization",
-	security: PIPELINE_AUTH,
-	request: { body: jsonBody(createProjectBodySchema) },
-	responses: {
-		201: envelope(projectSchema, "The created project"),
-		...sessionErrors,
-		...errors("project_exists", "validation_failed", "malformed_request")
-	}
-}));
-
 //#endregion
 //#region ../../packages/shared/src/contract/pushes.ts
 const params$6 = z.object({ id: z.string() });
 /**
-* Pushes: one `cow push` each, the whole project at one point in time. The
+* Pushes: one `cow push` each, the whole app at one point in time. The
 * push stores the source archive and its compile creates a version of every
 * key whose module changed; it turns nothing on (ADR 0011).
 *
@@ -9839,14 +10417,14 @@ const pushes = defineModule(defineRoute({
 	path: "/v1/pushes",
 	operationId: "pushes.create",
 	tags: ["pushes"],
-	summary: "Push a built project",
+	summary: "Push a built app",
 	security: PIPELINE_AUTH,
 	surfaces: HIDDEN_FROM_TOOLS,
 	request: { body: jsonBody(createPushBodySchema) },
 	responses: {
 		201: envelope(pushSchema, "The stored push and the versions it is compiling"),
 		...sessionErrors,
-		...errors("project_missing", "push_invalid", "validation_failed", "malformed_request", "dependency_unavailable")
+		...errors("push_invalid", "validation_failed", "malformed_request", "dependency_unavailable")
 	}
 }), defineRoute({
 	method: "get",
@@ -9897,8 +10475,8 @@ const pushes = defineModule(defineRoute({
 //#region ../../packages/shared/src/contract/resend.ts
 /**
 * The Resend-compatible send facade (ADR 0014): a developer points
-* `RESEND_BASE_URL` at `/resend/{sourceId}` and keeps their code. The source
-* in the path names the app, because the Resend SDK carries no other field
+* `RESEND_BASE_URL` at `/resend/{appOrSourceId}` and keeps their code. The
+* path segment names the app, because the Resend SDK carries no other field
 * and accepts no custom header; the bearer is the organization's ingestion
 * key.
 *
@@ -9914,7 +10492,15 @@ const FACADE_SURFACES = {
 	mcp: false,
 	docs: false
 };
-const sourceParam = z.object({ sourceId: z.string().openapi({ example: "src_2f9a8c1b" }) });
+/**
+* The app the message belongs to: its own id, or the id of its one `api`
+* source, which is what every base URL held before app ids were accepted
+* here. Both resolve to that source, so attribution is the same either way.
+*/
+const targetParam = z.object({ appOrSourceId: z.union([appIdSchema, sourceIdSchema], { error: "Use an app id (\"app_website\") or the id of its API source." }).openapi({
+	example: "app_website",
+	description: "The app to send for, or the id of its API source. Both name the same pipe."
+}) });
 /** Resend's error body, for the answers this facade gives. */
 const facadeError = (description) => ({
 	description,
@@ -9922,21 +10508,21 @@ const facadeError = (description) => ({
 });
 const facadeErrors = {
 	401: facadeError("missing_api_key | invalid_api_key"),
-	404: facadeError("not_found: unknown source, or unknown message"),
+	404: facadeError("not_found: unknown app or source, or unknown message"),
 	422: facadeError("validation_error | missing_required_field"),
 	429: facadeError("monthly_quota_exceeded | rate_limit_exceeded"),
 	500: facadeError("application_error")
 };
 const resend = defineModule(defineRoute({
 	method: "post",
-	path: "/resend/{sourceId}/emails",
+	path: "/resend/{appOrSourceId}/emails",
 	operationId: "resend.send",
 	tags: ["resend"],
 	summary: "Send one email (Resend-compatible)",
 	security: API_KEY_AUTH,
 	surfaces: FACADE_SURFACES,
 	request: {
-		params: sourceParam,
+		params: targetParam,
 		body: jsonBody(resendSendBodySchema)
 	},
 	responses: {
@@ -9949,14 +10535,14 @@ const resend = defineModule(defineRoute({
 	}
 }), defineRoute({
 	method: "post",
-	path: "/resend/{sourceId}/emails/batch",
+	path: "/resend/{appOrSourceId}/emails/batch",
 	operationId: "resend.sendBatch",
 	tags: ["resend"],
 	summary: "Send up to 100 emails (Resend-compatible)",
 	security: API_KEY_AUTH,
 	surfaces: FACADE_SURFACES,
 	request: {
-		params: sourceParam,
+		params: targetParam,
 		body: jsonBody(resendBatchBodySchema)
 	},
 	responses: {
@@ -9969,13 +10555,13 @@ const resend = defineModule(defineRoute({
 	}
 }), defineRoute({
 	method: "get",
-	path: "/resend/{sourceId}/emails/{id}",
+	path: "/resend/{appOrSourceId}/emails/{id}",
 	operationId: "resend.get",
 	tags: ["resend"],
 	summary: "Fetch one sent email (Resend-compatible)",
 	security: API_KEY_AUTH,
 	surfaces: FACADE_SURFACES,
-	request: { params: sourceParam.extend({ id: z.string().openapi({ example: "dlv_2f9a8c1b" }) }) },
+	request: { params: targetParam.extend({ id: z.string().openapi({ example: "dlv_2f9a8c1b" }) }) },
 	responses: {
 		200: {
 			description: "The email object",
@@ -10080,7 +10666,7 @@ const segments = defineModule(defineRoute({
 	responses: {
 		200: envelope(segmentDetailSchema),
 		...sessionErrors,
-		...errors("not_found"),
+		...errors("not_found", "conflict"),
 		...writeErrors
 	}
 }), defineRoute({
@@ -10094,7 +10680,7 @@ const segments = defineModule(defineRoute({
 	responses: {
 		200: envelope(deletedSchema),
 		...sessionErrors,
-		...errors("not_found")
+		...errors("not_found", "conflict")
 	}
 }), defineRoute({
 	method: "get",
@@ -10462,8 +11048,18 @@ const mergedRedirect = { 307: {
 	headers: z.object({ Location: z.string().meta({ description: "The survivor's URL" }) })
 } };
 /**
-* Profiles by their Cowliss-generated id. `find` precedes `{profileId}` so
-* the literal path wins.
+* Profiles by their Cowliss-generated id. `find`, `export` and `erase`
+* precede `{profileId}` so the literal paths win.
+*
+* Compliance has two ways in (ADR 0022). A `usr_` id names one profile, and
+* erasure or export takes it with everything merged into it. A
+* `{ kind, value }` identifier names a person, which is one profile per app
+* that knows the value, and the same erasure or export runs over all of
+* them at once: the addressing differs, nothing below it does. An identifier
+* never travels in the URL, neither in the path nor in a query string,
+* because a GDPR request carries an address and a URL is logged whole. That
+* is why both identifier routes are a POST carrying a body, including the
+* export, which reads.
 */
 const users = defineModule(defineRoute({
 	method: "get",
@@ -10491,6 +11087,32 @@ const users = defineModule(defineRoute({
 		...sessionErrors,
 		...errors("not_found", "validation_failed")
 	}
+}), defineRoute({
+	method: "post",
+	path: "/v1/users/export",
+	operationId: "users.exportByIdentifier",
+	tags: ["users"],
+	summary: "Export everything held on the people one identifier names",
+	security: SESSION_AUTH,
+	request: { body: jsonBody(exportUserByIdentifierBodySchema) },
+	responses: {
+		200: envelope(userExportSchema),
+		...sessionErrors,
+		...errors("not_found", "validation_failed", "malformed_request")
+	}
+}), defineRoute({
+	method: "post",
+	path: "/v1/users/erase",
+	operationId: "users.eraseByIdentifier",
+	tags: ["users"],
+	summary: "Erase every person one identifier names (GDPR)",
+	security: SESSION_AUTH,
+	request: { body: jsonBody(eraseUserByIdentifierBodySchema) },
+	responses: {
+		200: envelope(eraseUserResponseSchema),
+		...sessionErrors,
+		...errors("not_found", "validation_failed", "malformed_request")
+	}
 }), defineRoute({
 	method: "get",
 	path: "/v1/users/{profileId}",
@@ -10567,6 +11189,23 @@ const users = defineModule(defineRoute({
 		...sessionErrors,
 		...errors("not_found", "validation_failed")
 	}
+}), defineRoute({
+	method: "get",
+	path: "/v1/users/{profileId}/runs",
+	operationId: "users.listRuns",
+	tags: ["users"],
+	summary: "The journeys a profile has completed",
+	security: SESSION_AUTH,
+	request: {
+		params: params$2,
+		query: listUserRunsQuerySchema
+	},
+	responses: {
+		200: list(userRunSchema),
+		...mergedRedirect,
+		...sessionErrors,
+		...errors("not_found", "validation_failed")
+	}
 }));
 
 //#endregion
@@ -10737,7 +11376,6 @@ const contract = {
 	violations,
 	review,
 	segments,
-	project,
 	artifacts,
 	pushes,
 	versions,
@@ -11120,47 +11758,84 @@ function registerContractCommands(program, run) {
 //#endregion
 //#region src/commands/enable.ts
 /**
-* `cow enable` and `cow disable`: the one gate on a journey (ADR 0011, ADR
-* 0013). Hand-written rather than derived from `journeys.enable`, because
-* the commands are top-level names a developer types; the route itself
-* takes the same set of keys they do.
+* `cow enable`, `cow disable` and `cow pause`: the one gate on a journey
+* (ADR 0011, ADR 0013, ADR 0018). Hand-written rather than derived from
+* `journeys.setStatus`, because the commands are top-level names a developer
+* types; the route itself takes the same set of keys they do.
+*
+* `cow enable` on a journey on hold is how it resumes: the server has one
+* transition to `on` and no second word for it.
 */
 /**
 * One call, whichever way the keys were named: the route takes the set, and
-* `--all` is the project name, resolved on the server against the rows it
+* `--all` is the app id, resolved on the server against the rows the app
 * owns (so it reaches a key whose file the tree lost). A key that is not
-* there refuses the whole call, and nothing flips.
-*/
-async function setEnabled(client, selector, enabled) {
-	const route = enabled ? contract.journeys["journeys.enable"] : contract.journeys["journeys.disable"];
-	return (await client.request(route, { body: selector })).data;
+* there refuses the whole call, and nothing changes.
+*/
+async function setStatus(client, selector, status) {
+	return (await client.request(contract.journeys["journeys.setStatus"], { body: {
+		...selector,
+		status
+	} })).data;
+}
+/**
+* Who is already standing in a journey that was just turned on, and where
+* to let them in (ADR 0015). Printed, never acted on: enrolling a cohort
+* spends real money and reaches real people, so it stays a person's click
+* in the dashboard and no command here starts one.
+*/
+function segmentLines(journey) {
+	const offer = journey.enrollment;
+	if (!offer) return [];
+	if (!offer.counts) return [`  Who is in its segment could not be counted just now: ${offer.url}`];
+	const { scanned, enrolled, skipped } = offer.counts;
+	if (scanned === 0) return ["  Nobody is in its segment yet."];
+	return [
+		`  ${scanned} in its segment now, ${enrolled} of them can enter it now.`,
+		...Object.entries(ENROLLMENT_SKIP_WORDS).map(([key, words]) => ({
+			value: skipped[key],
+			words
+		})).filter(({ value }) => value > 0).map(({ value, words }) => `  ${value} ${words.reason}.`),
+		...enrolled > 0 ? [`  To let those ${enrolled} in: ${offer.url}`] : []
+	];
 }
+/** How the terminal names each state. */
+const STATE_WORD = {
+	on: "on",
+	off: "off",
+	paused: "on hold"
+};
 /** What the terminal says: one line per key, naming its new state. */
-function flipSummary(journeys, enabled) {
-	if (journeys.length === 0) return `This project has no journeys to turn ${enabled ? "on" : "off"}.`;
-	return journeys.map((journey) => `${journey.key} is ${enabled ? "on" : "off"}.`).join("\n");
+function flipSummary(journeys, status) {
+	if (journeys.length === 0) return `This app has no journeys to put ${STATE_WORD[status]}.`;
+	return journeys.map((journey) => [`${journey.key} is ${STATE_WORD[status]}.`, ...segmentLines(journey)].join("\n")).join("\n");
 }
-function register(program, clientFor, io, enabled) {
-	const verb = enabled ? "enable" : "disable";
-	program.command(verb).description(`turn journeys ${enabled ? "on" : "off"} (many keys, or --all for this project's)`).argument("[keys...]", "journey keys").option("--all", "every journey of this project").action(async (keys, opts) => {
+const DESCRIPTIONS = {
+	on: "turn journeys on",
+	off: "turn journeys off",
+	paused: "hold journeys: nobody enters, and everyone part-way through waits"
+};
+function register(program, clientFor, io, verb, status) {
+	program.command(verb).description(`${DESCRIPTIONS[status]} (many keys, or --all for this app's)`).argument("[keys...]", "journey keys").option("--all", "every journey of this app").action(async (keys, opts) => {
 		const merged = {
 			...program.opts(),
 			...opts
 		};
 		if (merged.all === true && keys.length > 0) throw new Error(`Name the journeys or pass --all, not both: cow ${verb} welcome.`);
 		if (merged.all !== true && keys.length === 0) throw new Error(`Name at least one journey, or pass --all: cow ${verb} welcome.`);
-		const selector = merged.all === true ? { project: (await assertCowConfig(process.cwd())).project } : { keys };
-		const updated = await setEnabled(await clientFor(merged), selector, enabled);
+		const selector = merged.all === true ? { appId: (await assertCowConfig(process.cwd())).appId } : { keys };
+		const updated = await setStatus(await clientFor(merged), selector, status);
 		if (merged.json === true) {
 			emit({ data: updated }, io, true);
 			return;
 		}
-		io.stdout(`${flipSummary(updated, enabled)}\n`);
+		io.stdout(`${flipSummary(updated, status)}\n`);
 	});
 }
 function registerEnable(program, clientFor, io) {
-	register(program, clientFor, io, true);
-	register(program, clientFor, io, false);
+	register(program, clientFor, io, "enable", "on");
+	register(program, clientFor, io, "disable", "off");
+	register(program, clientFor, io, "pause", "paused");
 }
 
 //#endregion
@@ -11208,43 +11883,45 @@ async function packageJson(name) {
 		}
 	});
 }
+/** The org's active apps, or null when this machine cannot read them. */
+async function listApps(client) {
+	try {
+		return (await client.request(contract.apps["apps.list"], { query: {
+			status: "active",
+			limit: 100
+		} })).data.map((app) => app.id);
+	} catch {
+		return null;
+	}
+}
 /**
-* Create the org's project row. Best effort by design: with no credentials
-* there is nothing to authenticate with, and any other failure (offline, an
-* older API) leaves the row for `cow push` to create.
-*
-* ponytail: plain fetch because `POST /v1/project` is not a contract route
-* yet; swap it for the typed client's `project.create` once ticket 04 lands.
+* Pick the app this repository pushes to. One app is the answer; several
+* are a question; none is a refusal, because the answer is in the dashboard
+* and `cow init` is not allowed to invent one.
 */
-async function createProject(apiUrl, token, name) {
-	if (!token) return {
-		project: "skipped",
-		reason: "not logged in"
+async function chooseApp(client, webUrl, flag, org, io, skipPrompts) {
+	if (flag) return { appId: flag };
+	if (org.claimed !== null && org.claimed !== org.requested) return {
+		appId: "",
+		reason: `this machine is logged in to ${org.claimed}, not ${org.requested}`
 	};
-	try {
-		const response = await fetch(`${apiUrl}/v1/project`, {
-			method: "POST",
-			headers: {
-				"content-type": "application/json",
-				authorization: `Bearer ${token}`
-			},
-			body: JSON.stringify({ data: { name } })
-		});
-		if (response.status === 201) return { project: "created" };
-		if (response.status === 409) return { project: "exists" };
-		return {
-			project: "skipped",
-			reason: `POST /v1/project answered ${response.status}`
-		};
-	} catch (error) {
-		return {
-			project: "skipped",
-			reason: error instanceof Error ? error.message : String(error)
-		};
-	}
+	const apps = await listApps(client);
+	if (apps === null) return {
+		appId: "",
+		reason: "this machine could not read the org's apps"
+	};
+	if (apps.length === 0) throw new Error(`This organization has no app yet, and a repository pushes to one. Create one at ${webUrl}/apps, then run \`cow init\` again.`);
+	const only = apps[0];
+	if (apps.length === 1 && only) return { appId: only };
+	if (skipPrompts || !io.isTTY) return {
+		appId: "",
+		reason: `this organization has several apps (${apps.join(", ")}) and nothing said which`
+	};
+	io.stderr(`Apps in this organization:\n${apps.map((id) => `  ${id}`).join("\n")}\n`);
+	return { appId: await ask("App id", only ?? "", io, false) };
 }
-function registerInit(program, env, io) {
-	program.command("init").argument("[dir]", "directory to create the project in (default: here)").description("create a cow project: cow.json, journeys/, emails/, and the files to build them").option("--org <id>", "organization id (default: the logged-in org)").option("--yes", "accept the defaults instead of prompting").option("--example <name>", "start from a gallery example").action(async (dirArg, opts) => {
+function registerInit(program, clientFor, env, io) {
+	program.command("init").argument("[dir]", "directory to create the repo in (default: here)").description("create a cow repo: cow.json, journeys/, emails/, and the files to build them").option("--org <id>", "organization id (default: the logged-in org)").option("--app <id>", "app id this repository pushes to (default: ask, or the org's only one)").option("--yes", "accept the defaults instead of prompting").option("--example <name>", "start from a gallery example").action(async (dirArg, opts) => {
 		const merged = {
 			...program.opts(),
 			...opts
@@ -11252,17 +11929,27 @@ function registerInit(program, env, io) {
 		const skipPrompts = opts.yes === true;
 		const cwd = process.cwd();
 		const defaultName = basename(dirArg ? resolve(cwd, dirArg) : cwd);
-		const name = await ask("Project name", defaultName, io, skipPrompts);
+		const name = await ask("Repo name", defaultName, io, skipPrompts);
 		const dir = dirArg ? resolve(cwd, dirArg) : name === defaultName ? cwd : resolve(cwd, name);
 		if (existsSync(join(dir, "cow.json"))) throw new Error(`"${dir}" already holds a cow.json. Use \`cow add example\` to add code to it.`);
 		const credentials = await readCredentials(env);
 		const claimedOrg = credentials ? decodeSessionToken(credentials.token)?.orgId ?? null : null;
 		const orgId = typeof opts.org === "string" && opts.org !== "" ? opts.org : await ask("Organization id", claimedOrg ?? "", io, skipPrompts);
 		if (orgId === "") throw new Error("No organization id. Pass --org org_… or run `cow login` first.");
-		const config = cowConfigSchema.parse({
+		if (!orgIdSchema.safeParse(orgId).success) throw new Error(`"${orgId}" is not an organization id. They look like org_…; \`cow login\` writes the one you are signed in to.`);
+		const webUrl = resolveWebUrl(env);
+		const app = await chooseApp(await clientFor(merged), webUrl, typeof opts.app === "string" && opts.app !== "" ? opts.app : void 0, {
+			requested: orgId,
+			claimed: claimedOrg
+		}, io, skipPrompts);
+		const config = app.appId === "" ? {
+			$schema: COW_CONFIG_SCHEMA_URL,
+			orgId,
+			appId: ""
+		} : cowConfigSchema.parse({
 			$schema: COW_CONFIG_SCHEMA_URL,
 			orgId,
-			project: name
+			appId: app.appId
 		});
 		const contents = {
 			"cow.json": json(config),
@@ -11285,19 +11972,18 @@ function registerInit(program, env, io) {
 		}
 		const example = typeof opts.example === "string" ? opts.example : void 0;
 		const files = [...Object.keys(contents), ...example ? await copyExample(example, dir, false) : []].sort();
-		const outcome = await createProject(resolveApiUrl(env, credentials, typeof merged.api === "string" ? merged.api : void 0), resolveCredential(env, credentials).token, name);
 		emit({ data: {
 			dir,
 			orgId,
 			files,
-			...outcome
+			...app
 		} }, io, merged.json);
 		const here = relative(cwd, dir) || ".";
 		const scenario = files.find((file) => file.startsWith("scenarios/")) ?? "scenarios/abandoned-checkout.timeout.json";
-		const projectLine = outcome.project === "created" ? `Project created for ${orgId}` : outcome.project === "exists" ? `Project already exists for ${orgId}` : `Project not created (${outcome.reason}); cow push will create it.`;
+		const appLine = app.appId === "" ? `No app named yet (${app.reason}). Put its id in cow.json's "appId"; you will find it on the app's page at ${webUrl}/apps.` : `Pushes to ${app.appId}`;
 		io.stderr([
-			`Created a cow project in ${here}`,
-			projectLine,
+			`Created a cow repo in ${here}`,
+			appLine,
 			"",
 			"Next steps:",
 			`  cd ${here}`,
@@ -11471,25 +12157,25 @@ function noGitHere(error) {
 	return failure.code === "ENOENT" || String(failure.stderr ?? "").includes("not a git repository");
 }
 /**
-* The push to restore: the one named, else this project's newest. Scoped to
-* this directory's project, so a sibling repo's tree is never unpacked over
-* this one's files.
+* The push to restore: the one named, else this app's newest. Scoped to this
+* directory's app, so a sibling repo's tree is never unpacked over this
+* one's files.
 *
 * The newest rather than the newest that compiled: a push stores the whole
 * tree and its source archive whatever its keys then compiled to, so it is
 * the last thing anyone pushed either way.
 */
-async function resolvePush(client, pushId, project) {
+async function resolvePush(client, pushId, appId) {
 	if (pushId) return (await client.request(contract.pushes["pushes.get"], { params: { id: pushId } })).data;
 	const newest = (await client.request(contract.pushes["pushes.list"], { query: {
 		limit: 1,
-		project
+		appId
 	} })).data[0];
-	if (!newest) throw new Error("This project has never been pushed, so there is nothing to restore. Run `cow push` first, or name a push with --push.");
+	if (!newest) throw new Error("This app has never been pushed, so there is nothing to restore. Run `cow push` first, or name a push with --push.");
 	return newest;
 }
 async function pullPush({ client, projectDir, pushId, force }) {
-	const push = await resolvePush(client, pushId, await configuredProject(projectDir));
+	const push = await resolvePush(client, pushId, await configuredApp(projectDir));
 	if (!force) {
 		const dirty = await dirtyPaths(projectDir);
 		if (dirty.length > 0) throw new Error(`This working tree has uncommitted changes and \`cow pull\` would write over them:\n  ${dirty.join("\n  ")}\nCommit or stash them, or pass --force.`);
@@ -11511,7 +12197,7 @@ async function pullPush({ client, projectDir, pushId, force }) {
 	};
 }
 function registerPull(program, clientFor, io) {
-	program.command("pull").description("restore the project's source files from a push into the current directory").option("--push <id>", "the push to restore (default: the newest one)").option("--force", "extract even when the git working tree is dirty").action(async (opts) => {
+	program.command("pull").description("restore the repo's source files from a push into the current directory").option("--push <id>", "the push to restore (default: the newest one)").option("--force", "extract even when the git working tree is dirty").action(async (opts) => {
 		const merged = {
 			...program.opts(),
 			...opts
@@ -11532,25 +12218,6 @@ function registerPull(program, clientFor, io) {
 
 //#endregion
 //#region src/commands/push.ts
-/**
-* This directory's project, created when the org has none by that name.
-* `cow init` usually got there first; a project pushed from a machine that
-* only ever cloned the repo has not, and creating it here is what makes that
-* clone work. The name is `cow.json`'s `project`.
-*/
-async function ensureProject(client, name) {
-	try {
-		return (await client.request(contract.project["project.get"], { query: { name } })).data;
-	} catch (error) {
-		if (!(error instanceof ApiError) || error.code !== "project_missing") throw error;
-	}
-	try {
-		return (await client.request(contract.project["project.create"], { body: { name } })).data;
-	} catch (error) {
-		const reason = error instanceof Error ? error.message : String(error);
-		throw new Error(`This organization has no project and one could not be created (${reason}). Run \`cow init\` first.`);
-	}
-}
 /** Does the org already hold these bytes? A 404 is the answer, not a failure. */
 async function held(client, digest) {
 	try {
@@ -11584,8 +12251,6 @@ function artifactFiles(projectDir, manifest) {
 }
 async function pushProject({ client, projectDir }) {
 	const { manifest, config } = await buildProject(projectDir);
-	const project = await ensureProject(client, config.project);
-	if (project.orgId !== config.orgId) throw new Error(`cow.json is for ${config.orgId} but the credential belongs to ${project.orgId}. Log in to that organization, use its pipeline key, or select a config for it with --config or COW_CONFIG (for example cow.local.json).`);
 	const uploaded = [];
 	for (const artifact of artifactFiles(projectDir, manifest)) {
 		if (await held(client, artifact.digest)) continue;
@@ -11602,7 +12267,8 @@ async function pushProject({ client, projectDir }) {
 				...manifest,
 				protocol: 3
 			},
-			project: project.name
+			appId: config.appId,
+			orgId: config.orgId
 		} })).data,
 		uploaded
 	};
@@ -11618,10 +12284,10 @@ function pushSummary(outcome, webUrl) {
 	const stored = `Push #${push.seq} stored (${uploaded}).`;
 	if (push.versions.length === 0) return `${stored} Nothing changed.`;
 	const width = Math.max(...push.versions.map((version) => version.key.length));
-	return [`${stored} Compiling ${push.versions.length} ${push.versions.length === 1 ? "key" : "keys"}:`, ...push.versions.map((version) => `  ${version.key.padEnd(width)}  ${webUrl}/${version.kind === "journey" ? "journeys" : "templates"}/${version.key}`)].join("\n");
+	return [`${stored} Compiling ${push.versions.length} ${push.versions.length === 1 ? "key" : "keys"}:`, ...push.versions.map((version) => `  ${version.key.padEnd(width)}  ${webUrl}/${version.kind === "journey" ? "journeys" : "deliveries/templates"}/${version.key}`)].join("\n");
 }
 function registerPush(program, clientFor, env, io) {
-	program.command("push").description("build the project and upload it; the server compiles what changed").action(async (opts) => {
+	program.command("push").description("build this repository and upload it; the server compiles what changed").action(async (opts) => {
 		const merged = {
 			...program.opts(),
 			...opts
@@ -11642,10 +12308,10 @@ function registerPush(program, clientFor, env, io) {
 //#endregion
 //#region src/commands/status.ts
 /**
-* `cow status`: what the server holds for every key of this project, and how
-* far the tree in front of the developer has moved from it. Hand-written
-* rather than derived from `project.status`, because the drift is the half
-* of the answer no server read can know: it comes from building the project
+* `cow status`: what the server holds for every key of this app, and how far
+* the tree in front of the developer has moved from it. Hand-written rather
+* than derived from `apps.status`, because the drift is the half of the
+* answer no server read can know: it comes from building the repository
 * here and comparing the bundle digests with the versions the server has.
 */
 /** Largest first: the first unit the gap fills is the one that reads best. */
@@ -11699,8 +12365,7 @@ function versionPhrase(entry, now) {
 	return `${bundle ? `version ${shortDigest(bundle)}` : "version"}, pushed ${ago(version.pushedAt, now)}${state}`;
 }
 function flagsPhrase(entry) {
-	if (entry.enabled === null) return "";
-	return entry.enabled ? "on" : "off";
+	return entry.status === null ? "" : entry.status === "paused" ? "on hold" : entry.status;
 }
 function livePhrase(entry) {
 	return entry.liveExecutions === 0 ? "" : `${entry.liveExecutions} running`;
@@ -11720,7 +12385,7 @@ function statusLines(status, manifest, now) {
 	const local = manifest ? localKeys(manifest) : [];
 	const journeys = status.keys.filter((entry) => entry.kind === "journey");
 	const templates = status.keys.filter((entry) => entry.kind === "template");
-	const lines = [`${status.project}: ${journeys.length} ${journeys.length === 1 ? "journey" : "journeys"}, ${templates.length} ${templates.length === 1 ? "template" : "templates"} on the server.`];
+	const lines = [`${status.appId}: ${journeys.length} ${journeys.length === 1 ? "journey" : "journeys"}, ${templates.length} ${templates.length === 1 ? "template" : "templates"} on the server.`];
 	const width = Math.max(0, ...status.keys.map((entry) => entry.key.length));
 	const section = (title, entries) => {
 		if (entries.length === 0) return;
@@ -11759,19 +12424,19 @@ function statusLines(status, manifest, now) {
 	}
 	return lines;
 }
-/** The project's status from the server, for this directory's `cow.json`. */
-async function readStatus(client, project) {
-	return (await client.request(contract.project["project.status"], { query: { name: project } })).data;
+/** The app's status from the server, for this directory's `cow.json`. */
+async function readStatus(client, appId) {
+	return (await client.request(contract.apps["apps.status"], { params: { id: appId } })).data;
 }
 function registerStatus(program, clientFor, io) {
-	program.command("status").description("what this project's journeys and templates are doing, and what changed here since the last push").action(async (opts) => {
+	program.command("status").description("what this app's journeys and templates are doing, and what changed here since the last push").action(async (opts) => {
 		const merged = {
 			...program.opts(),
 			...opts
 		};
 		const config = await assertCowConfig(process.cwd());
 		const built = await buildProject(process.cwd()).catch(() => null);
-		const status = await readStatus(await clientFor(merged), config.project);
+		const status = await readStatus(await clientFor(merged), config.appId);
 		if (merged.json === true) {
 			emit({ data: status }, io, true);
 			return;
@@ -12040,7 +12705,7 @@ function emit(result, io, json) {
 }
 function buildProgram(env, io) {
 	const program = new Command();
-	program.name("cow").description("Admin CLI for Cowliss: a thin client of the dashboard API").option("--api <url>", "API base URL (overrides env and saved config)").option("--json", "force compact single-line JSON output").option("--config <file>", `project config to read instead of ${DEFAULT_CONFIG_FILE} (overrides COW_CONFIG)`);
+	program.name("cow").description("Admin CLI for Cowliss: a thin client of the dashboard API").option("--api <url>", "API base URL (overrides env and saved config)").option("--json", "force compact single-line JSON output").option("--config <file>", `config file to read instead of ${DEFAULT_CONFIG_FILE} (overrides COW_CONFIG)`);
 	program.hook("preAction", () => {
 		const flag = program.opts().config;
 		setConfigFile((typeof flag === "string" ? flag : void 0) ?? env.COW_CONFIG ?? "cow.json");
@@ -12062,7 +12727,7 @@ function buildProgram(env, io) {
 	};
 	registerContractCommands(program, run);
 	registerAuth(program, env, io);
-	registerInit(program, env, io);
+	registerInit(program, clientFor, env, io);
 	registerAdd(program, io);
 	registerBuild(program, io);
 	registerPush(program, clientFor, env, io);