@cowliss/cli 0.7.0 → 0.9.0

package/dist/index.js

@@ -33,6 +33,34 @@ const DOCS_URL = "https://docs.cowliss.com";
 */
 const REQUEST_ID_HEADER = "X-Request-Id";
 /**
+* Stripe-style ID prefixes per resource type, so ids in logs, URLs, and
+* payloads are self-describing.
+*/
+const ID_PREFIXES = {
+	user: "usr_",
+	event: "evt_",
+	identifier: "idn_",
+	segment: "seg_",
+	/** The attribution unit: a readable `app_<slug>`, not a TypeID. */
+	app: "app_",
+	/** One inbound pipe into an app; a TypeID like everything else. */
+	source: "src_",
+	webhook: "whk_",
+	push: "psh_",
+	version: "ver_",
+	execution: "exe_",
+	delivery: "dlv_",
+	violation: "vio_",
+	quarantineEntry: "qtn_",
+	idempotencyKey: "idk_",
+	abuseEvent: "abu_",
+	suppression: "sup_",
+	senderDomain: "dom_",
+	journeyRun: "run_",
+	topup: "top_",
+	emailAddress: "eml_"
+};
+/**
 * Clerk ID prefix marking an organization-scoped subject. Ingestion API keys
 * must resolve to an org subject; user-scoped keys are rejected.
 */
@@ -3143,7 +3171,7 @@ const bytea = customType({ dataType: () => "bytea" });
 /**
 * What an artifact is: a journey or template bundle as `cow build` emitted
 * it, the wasm module the server compiled from it, or the gzipped source
-* tarball of the project the release was built from.
+* tarball of the repo the push was built from.
 */
 const artifactKindEnum = pgEnum("artifact_kind", [
 	"bundle",
@@ -3264,14 +3292,14 @@ const insertCatalogTraitSchema = createInsertSchema(catalogTraits);
 //#region ../../packages/db/src/schema/consent-purposes.ts
 /**
 * The consent purposes an org's profiles answer: the two fixed ones, seeded
-* the first time the set is read, plus whatever the org's projects declare
-* in their `cow.json`. One read here returns the whole set, so nothing
+* the first time the set is read, plus whatever the org's apps declare in
+* their `cow.json`. One read here returns the whole set, so nothing
 * downstream unions a table with a constant.
 *
-* Org-wide rather than per-project: `profiles.consent` is
-* one jsonb map per profile, so an answer given under one project is the
-* same answer under the next, and two projects declaring one key must agree
-* on its label and default or the deploy is refused.
+* Org-wide rather than per-app: `profiles.consent` is one jsonb map per
+* profile, so an answer given under one app is the same answer under the
+* next, and two apps declaring one key must agree on its label and default
+* or the deploy is refused.
 *
 * A deploy adds and updates rows and never deletes one (ADR 0009): profiles
 * already hold answers against a purpose, and deleting it would orphan them.
@@ -3289,14 +3317,18 @@ const consentPurposes = pgTable("consent_purposes", {
 	*/
 	defaultGranted: boolean("default_granted").notNull(),
 	/**
-	* The project whose `cow.json` declared it, and the one a disagreeing
-	* deploy is refused in the name of. Null for the two fixed purposes,
-	* which every org has and no project owns.
+	* The app whose `cow.json` declared it, and the one a disagreeing deploy
+	* is refused in the name of. Null for the two fixed purposes, which every
+	* org has and no app owns.
 	*/
-	projectId: text("project_id"),
+	appId: text("app_id"),
 	createdAt: createdAt(),
 	updatedAt: updatedAt()
-}, (table) => [primaryKey({ columns: [table.orgId, table.key] })]);
+}, (table) => [primaryKey({ columns: [table.orgId, table.key] }), foreignKey({
+	columns: [table.orgId, table.appId],
+	foreignColumns: [apps$1.orgId, apps$1.id],
+	name: "consent_purposes_app_fk"
+})]);
 
 //#endregion
 //#region ../../packages/db/src/schema/deliveries.ts
@@ -3392,6 +3424,15 @@ const deliveries$1 = pgTable("deliveries", {
 	* neither of which has one.
 	*/
 	journey: text("journey"),
+	/**
+	* The journey execution (`exe_`) this send was made from, so an execution
+	* page can show what it sent. Null is a real state rather than a gap: a
+	* test send and an api send have no execution behind them, and rows
+	* written before this column existed have none to name. No foreign key,
+	* because executions are pruned on their own schedule and a delivery is a
+	* log row that outlives them.
+	*/
+	executionId: text("execution_id"),
 	kind: deliveryKindEnum("kind").notNull().default("journey"),
 	/**
 	* Email template name or webhook name. An api send that named no
@@ -3449,6 +3490,7 @@ const deliveries$1 = pgTable("deliveries", {
 }, (table) => [
 	index("deliveries_org_id_created_at_idx").on(table.orgId, table.createdAt),
 	index("deliveries_org_id_profile_id_created_at_idx").on(table.orgId, table.profileId, table.createdAt),
+	index("deliveries_org_id_execution_id_created_at_idx").on(table.orgId, table.executionId, table.createdAt),
 	uniqueIndex("deliveries_org_id_attempt_key_unique").on(table.orgId, table.attemptKey),
 	uniqueIndex("deliveries_provider_id_unique").on(table.providerId),
 	index("deliveries_status_sent_at_idx").on(table.status, table.sentAt)
@@ -3688,10 +3730,10 @@ const identifierKindEnum = pgEnum("identifier_kind", [
 ]);
 /**
 * The identifiers map: every named identifier a call has ever carried,
-* pointing at the profile it resolved to. Unique per (org, kind, value),
-* which is what makes "a shared identifier means the same person"
-* enforceable at the row level: the same clerkId twice in one organization
-* is one person.
+* pointing at the profile it resolved to. Unique per (org, app, kind, value),
+* which is what makes "a shared identifier means the same person" enforceable
+* at the row level, inside one app: the same clerkId twice in one app is one
+* person, and the same email on two apps is two people (ADR 0022).
 *
 * Rows follow their profile: erasure deletes the profile and these cascade,
 * and a merge re-points them at the survivor.
@@ -3699,11 +3741,21 @@ const identifierKindEnum = pgEnum("identifier_kind", [
 const identifiers = pgTable("identifiers", {
 	id: text("id").primaryKey(),
 	orgId: text("org_id").notNull(),
+	/** The app this identifier resolves in; always its profile's app. */
+	appId: text("app_id").notNull(),
 	kind: identifierKindEnum("kind").notNull(),
 	value: text("value").notNull(),
 	profileId: text("profile_id").notNull().references(() => profiles.id, { onDelete: "cascade" }),
 	createdAt: createdAt()
-}, (table) => [uniqueIndex("identifiers_org_kind_value_unique").on(table.orgId, table.kind, table.value), index("identifiers_profile_id_idx").on(table.profileId)]);
+}, (table) => [
+	uniqueIndex("identifiers_org_app_kind_value_unique").on(table.orgId, table.appId, table.kind, table.value),
+	index("identifiers_profile_id_idx").on(table.profileId),
+	foreignKey({
+		columns: [table.orgId, table.appId],
+		foreignColumns: [apps$1.orgId, apps$1.id],
+		name: "identifiers_app_fk"
+	})
+]);
 const selectIdentifierSchema = createSelectSchema(identifiers);
 const insertIdentifierSchema = createInsertSchema(identifiers);
 
@@ -3767,10 +3819,11 @@ const journeyStatusEnum = pgEnum("journey_status", [
 *
 * A push only ever adds and updates: it owns the keys its manifest carries
 * and leaves every other row alone, because an org's journeys can come from
-* several projects and a developer may push a project holding only some of
-* the files. `projectId` records which project put the row here, which is
-* what makes a key another project owns a refused push rather than a silent
-* overwrite. Removing a journey is an explicit delete (ADR 0009).
+* several apps and a developer may push a repo holding only some of the
+* files. `appId` records which app put the row here, which is what makes a
+* key another app owns a refused push rather than a silent overwrite
+* (ADR 0009, held by the app since ADR 0022). Removing a journey is an
+* explicit delete.
 *
 * Whether a journey fires is one field and one only: `status`, which a
 * push never writes, so deploying code never turns anything on or off. The
@@ -3784,14 +3837,14 @@ const journeyStatusEnum = pgEnum("journey_status", [
 const journeys$1 = pgTable("journeys", {
 	orgId: text("org_id").notNull(),
 	key: text("key").notNull(),
-	/** The project whose push owns this key. */
-	projectId: text("project_id").notNull(),
+	/** The app whose push owns this key, and the only app it fires for. */
+	appId: text("app_id").notNull(),
 	/** The author's labels, from the manifest; the dashboard's only grouping. */
 	tags: text("tags").array().notNull().default(sql`'{}'::text[]`),
 	trigger: jsonb("trigger").$type().notNull(),
 	/**
 	* The consent purpose this journey's sends are gated on: one of the two
-	* fixed keys or one the project declares in `cow.json`. Text and not an
+	* fixed keys or one the app's repo declares in `cow.json`. Text and not an
 	* enum, because the set is the org's `consent_purposes` rows, which a
 	* deploy checks the key against; a database enum could only ever hold
 	* the fixed pair.
@@ -3811,7 +3864,11 @@ const journeys$1 = pgTable("journeys", {
 	status: journeyStatusEnum("status").notNull().default("off"),
 	createdAt: createdAt(),
 	updatedAt: updatedAt()
-}, (table) => [primaryKey({ columns: [table.orgId, table.key] })]);
+}, (table) => [primaryKey({ columns: [table.orgId, table.key] }), foreignKey({
+	columns: [table.orgId, table.appId],
+	foreignColumns: [apps$1.orgId, apps$1.id],
+	name: "journeys_app_fk"
+})]);
 const selectJourneySchema = createSelectSchema(journeys$1);
 const insertJourneySchema = createInsertSchema(journeys$1);
 
@@ -3911,33 +3968,15 @@ const orgSettings = pgTable("org_settings", {
 const selectOrgSettingsSchema = createSelectSchema(orgSettings);
 const insertOrgSettingsSchema = createInsertSchema(orgSettings);
 
-//#endregion
-//#region ../../packages/db/src/schema/projects.ts
-/**
-* An org's cow project: the folder a developer runs `cow init` in, and the
-* thing pushes belong to. An org may hold several, one per repo, each with
-* its own release sequence and its own slice of the deployed journey rows. The name is how `cow.json` picks
-* one, so it is unique within the org.
-*/
-const projects = pgTable("projects", {
-	id: text("id").primaryKey(),
-	orgId: text("org_id").notNull(),
-	name: text("name").notNull(),
-	createdAt: createdAt(),
-	updatedAt: updatedAt()
-}, (table) => [uniqueIndex("projects_org_id_name_unique").on(table.orgId, table.name)]);
-const selectProjectSchema = createSelectSchema(projects);
-const insertProjectSchema = createInsertSchema(projects);
-
 //#endregion
 //#region ../../packages/db/src/schema/pushes.ts
 /**
-* One `cow push`: the whole project at one point in time. A push stores the
+* One `cow push`: the whole repo at one point in time. A push stores the
 * source archive and creates a version of every key whose bundle changed
 * (ADR 0011); it settles nothing and changes no flag, so it has no status
 * of its own. What is compiling is read off its versions.
 *
-* `seq` is the human handle and is per project, allocated inside the create
+* `seq` is the human handle and is per app, allocated inside the create
 * transaction; the unique index leads with the org id so it doubles as the
 * tenancy key.
 *
@@ -3948,7 +3987,8 @@ const insertProjectSchema = createInsertSchema(projects);
 const pushes$1 = pgTable("pushes", {
 	id: text("id").primaryKey(),
 	orgId: text("org_id").notNull(),
-	projectId: text("project_id").notNull().references(() => projects.id),
+	/** The app this push deployed; the push unit since ADR 0022. */
+	appId: text("app_id").notNull(),
 	seq: integer("seq").notNull(),
 	manifest: jsonb("manifest").$type().notNull(),
 	/** sha256 of the pushed manifest; the CLI compares it to skip a no-op push. */
@@ -3957,7 +3997,15 @@ const pushes$1 = pgTable("pushes", {
 	sourceDigest: text("source_digest").notNull(),
 	createdBy: text("created_by").notNull(),
 	createdAt: createdAt()
-}, (table) => [uniqueIndex("pushes_org_id_project_id_seq_unique").on(table.orgId, table.projectId, table.seq), index("pushes_org_id_created_at_idx").on(table.orgId, table.createdAt)]);
+}, (table) => [
+	uniqueIndex("pushes_org_id_app_id_seq_unique").on(table.orgId, table.appId, table.seq),
+	index("pushes_org_id_created_at_idx").on(table.orgId, table.createdAt),
+	foreignKey({
+		columns: [table.orgId, table.appId],
+		foreignColumns: [apps$1.orgId, apps$1.id],
+		name: "pushes_app_fk"
+	})
+]);
 const selectPushSchema = createSelectSchema(pushes$1);
 const insertPushSchema = createInsertSchema(pushes$1);
 /**
@@ -4062,6 +4110,9 @@ const insertQuarantineEntrySchema = createInsertSchema(quarantineEntries);
 * hand-maintained: the engine in packages/segments recomputes on every write
 * and materializes the result into segment_members.
 *
+* A segment belongs to one app (ADR 0022) and sees only that app's profiles
+* and that app's events.
+*
 * A row is either standalone (built in the dashboard, `journey_key` null) or
 * owned by one journey whose trigger inlined its definition (ADR 0016). An
 * owned row is named after its journey's key, is written only by the push,
@@ -4076,6 +4127,8 @@ const insertQuarantineEntrySchema = createInsertSchema(quarantineEntries);
 const segments$1 = pgTable("segments", {
 	id: text("id").primaryKey(),
 	orgId: text("org_id").notNull(),
+	/** The one app this segment evaluates. */
+	appId: text("app_id").notNull(),
 	name: text("name").notNull(),
 	description: text("description"),
 	definition: jsonb("definition").$type().notNull(),
@@ -4090,7 +4143,12 @@ const segments$1 = pgTable("segments", {
 		columns: [table.orgId, table.journeyKey],
 		foreignColumns: [journeys$1.orgId, journeys$1.key],
 		name: "segments_journey_fk"
-	}).onDelete("cascade")
+	}).onDelete("cascade"),
+	foreignKey({
+		columns: [table.orgId, table.appId],
+		foreignColumns: [apps$1.orgId, apps$1.id],
+		name: "segments_app_fk"
+	})
 ]);
 /**
 * Materialized membership: one row per (segment, profile) currently in the
@@ -4353,8 +4411,8 @@ const versions$1 = pgTable("versions", {
 	/** The file basename its author wrote; unique per org within a kind. */
 	key: text("key").notNull(),
 	kind: versionKindEnum("kind").notNull(),
-	/** The project that pushed this key; ADR 0009's ownership. */
-	projectId: text("project_id").notNull().references(() => projects.id),
+	/** The app that pushed this key; ADR 0009's ownership, ADR 0022's app. */
+	appId: text("app_id").notNull(),
 	/** The push that compiled this version's module. */
 	pushId: text("push_id").notNull().references(() => pushes$1.id),
 	moduleDigest: text("module_digest"),
@@ -4374,7 +4432,12 @@ const versions$1 = pgTable("versions", {
 }, (table) => [
 	uniqueIndex("versions_org_id_kind_key_module_digest_unique").on(table.orgId, table.kind, table.key, table.moduleDigest),
 	index("versions_org_id_kind_key_pushed_at_idx").on(table.orgId, table.kind, table.key, table.pushedAt),
-	index("versions_org_id_push_id_idx").on(table.orgId, table.pushId)
+	index("versions_org_id_push_id_idx").on(table.orgId, table.pushId),
+	foreignKey({
+		columns: [table.orgId, table.appId],
+		foreignColumns: [apps$1.orgId, apps$1.id],
+		name: "versions_app_fk"
+	})
 ]);
 const selectVersionSchema = createSelectSchema(versions$1);
 const insertVersionSchema = createInsertSchema(versions$1);
@@ -4557,8 +4620,6 @@ const ERROR_CODE_STATUS = {
 	journey_nondeterministic: 500,
 	push_invalid: 422,
 	version_not_ready: 409,
-	project_exists: 409,
-	project_missing: 404,
 	artifact_too_large: 413
 };
 /** First zod issue's message: enough signal for a 422 without a novel format. */
@@ -4612,6 +4673,21 @@ const identifierValueSchema = z.string().trim().min(1, "an identifier value is r
 * and a call names only the kinds it has.
 */
 const identifiersSchema = z.partialRecord(identifierKindSchema, identifierValueSchema).refine((value) => Object.keys(value).length > 0, { message: "identifiers must carry at least one entry" });
+/**
+* One identifier named as an object: how compliance addresses a person
+* when no `usr_` id is at hand (ADR 0022). A value two apps know is two
+* people, so the routes taking this act on every one of them.
+*
+* An object rather than the lookup route's `<kind>:<value>` string, because
+* the kind is then an enum at the boundary (a typo'd kind is a 422 for
+* free) and an address needs no escaping inside it. The value is
+* normalized by `normalizeIdentifierValue` where it is read, like every
+* other identifier.
+*/
+const identifierRefSchema = z.object({
+	kind: identifierKindSchema,
+	value: identifierValueSchema
+});
 /** One identifier as the profile DTOs carry it. */
 const identifierDtoSchema = z.object({
 	kind: identifierKindSchema,
@@ -4626,21 +4702,18 @@ const identifierDtoSchema = z.object({
 * history, combined with `all` or `any`. Deliberately flat — nested predicate groups are YAGNI for the
 * prototype, and a flat list keeps the pure evaluator a fold.
 *
-* `appId` scopes the EVENT side of a definition only. Traits are
-* per-profile and profiles merge across apps, so there is nothing
-* app-shaped to filter on the trait side.
-*
-* A definition and the membership it produces are both the
-* organization's.
+* A definition names no app (ADR 0022): the segment row's own `app_id` is
+* the one app it evaluates, so the events and the profiles it reads are
+* that app's and there is nothing to filter by here.
 *
 * Apart from `./segments` because a journey's trigger carries a definition
 * and the trigger schema is bundled into the wasm guest, where an edge to
 * `@cowliss/db` (which `./segments` has, for the row schema) is a hard
 * bundler failure. Nothing here imports anything but zod.
 *
-* The object is strict: a definition holding the retired `sourceId` key
-* (which meant the app) fails loudly instead of parsing as an unfiltered
-* definition that evaluates over every app. There is deliberately no pipe
+* The object is strict: a definition holding the retired `sourceId` or
+* `appId` key (both of which meant the app) fails loudly instead of parsing
+* as an unfiltered definition that evaluates over every app. There is deliberately no pipe
 * filter here — filtering by source is a later feature, and accepting one
 * now would make a stale `sourceId` parse as a filter on a pipe that does
 * not exist and silently match nothing.
@@ -4693,15 +4766,8 @@ const segmentPredicateSchema = z.discriminatedUnion("kind", [z.object({
 	/** Rolling window, relative to evaluation time; absent means all history. */
 	withinDays: z.number().int().min(1).optional()
 })]).refine((predicate) => predicate.kind !== "trait" || VALUELESS_TRAIT_OPS.includes(predicate.op) || predicate.value !== void 0, { message: "value is required unless op is exists or notExists" });
-const appIdSchema = z.string().trim().min(1);
 const segmentDefinitionSchema = z.strictObject({
 	match: z.enum(["all", "any"]).default("all"),
-	/**
-	* Optional app filter over the event side; null/absent spans apps.
-	* A list matches any of the named apps, which is how one definition
-	* names the development and the production id of the same app.
-	*/
-	appId: z.union([appIdSchema, z.array(appIdSchema).min(1)]).nullish(),
 	predicates: z.array(segmentPredicateSchema).min(1, "at least one predicate is required")
 });
 
@@ -4814,9 +4880,12 @@ const purposesSchema = z.array(declaredPurposeSchema).max(20, "a project declare
 const onePatternSchema = z.string().min(1).max(200, "a pattern must be at most 200 characters");
 const patternSchema = z.union([onePatternSchema, z.array(onePatternSchema).min(1).max(20, "a matcher takes at most 20 patterns")]);
 /**
-* What starts a journey: an event (optionally narrowed to an app id or a
-* list of them), or entry into the segment the trigger itself describes.
-* The registry DTO in `../journeys` reuses it.
+* What starts a journey: an event, or entry into the segment the trigger
+* itself describes. The registry DTO in `../journeys` reuses it.
+*
+* No trigger names an app (ADR 0022): a repository is one app, the journey
+* row carries its `app_id`, and the runtime compares that with the event's.
+* An `appId` here would be a second way to say it, and the way to leak.
 *
 * A segment trigger carries the predicate list, not a name: the push
 * materializes one segment row per journey that inlines a definition, owned
@@ -4825,16 +4894,13 @@ const patternSchema = z.union([onePatternSchema, z.array(onePatternSchema).min(1
 * definition is data — validated here, carried on the version, never
 * compiled and never executed.
 *
-* Both members are strict, so a journey holding the retired `source` key, or
-* the retired `{ segment: "name" }` form, fails to build instead of silently
-* triggering on every app or on nothing. There is deliberately no pipe
-* filter: a trigger narrows by the app the write is attributed to, the same
-* token a segment definition names.
+* Both members are strict, so a journey holding the retired `source` or
+* `appId` key, or the retired `{ segment: "name" }` form, fails to build
+* instead of silently triggering on every app or on nothing. There is
+* deliberately no pipe filter and no app filter: the journey's own app is
+* the only narrowing there is.
 */
-const triggerSchema = z.union([z.strictObject({
-	event: patternSchema,
-	appId: patternSchema.optional()
-}), z.strictObject({ segment: segmentDefinitionSchema })]);
+const triggerSchema = z.union([z.strictObject({ event: patternSchema }), z.strictObject({ segment: segmentDefinitionSchema })]);
 /**
 * The address half of a from-header: a local part, an `@`, and a dotted
 * domain. Deliberately narrower than RFC 5322 (no quoted local parts, no
@@ -5130,6 +5196,74 @@ const identifyDataSchema = identifyFieldsSchema.refine((data) => notFutureTimest
 });
 const identifyBodySchema = z.object({ data: identifyDataSchema });
 
+//#endregion
+//#region ../../packages/shared/src/journeys-v2/config.ts
+/**
+* An app id as `cow.json` carries it: the readable `app_<slug>`
+* `appIdFromName` derives, which is the one id a developer types by hand.
+*
+* It lives here rather than beside the app DTOs in ../apps because that
+* module imports the Drizzle schema, which neither the wasmtime guest nor
+* the Temporal workflow isolate can carry, and because `cow.json` is the
+* file a developer types it into. Everything that names an app on the wire
+* reuses it.
+*/
+const appIdSchema = z.string().trim().max(200).regex(new RegExp(`^${ID_PREFIXES.app}[a-z0-9]+(-[a-z0-9]+)*$`), "an app id looks like \"app_website\"");
+/**
+* A source id: the one inbound pipe an ingestion or send call names. It
+* lives beside `appIdSchema` for the same two reasons — the sources module
+* imports the Drizzle schema, and both are ids that travel on the wire — and
+* it has the same shape, so a bare `src_` is refused here rather than at the
+* database.
+*
+* The prefixes above and here are interpolated raw; `journeys-v2.test.ts`
+* asserts they are plain `<word>_` literals, so none of them can quietly
+* change what these patterns match.
+*/
+const sourceIdSchema = z.string().trim().max(200).regex(new RegExp(`^${ID_PREFIXES.source}[a-z0-9_]+$`), "a source id looks like \"src_01j8x…\"");
+/**
+* A Clerk organization id, as `cow.json` spells it. Exported beside
+* `appIdSchema` because the push body carries the org the file names so the
+* server can refuse a push aimed at another one (ADR 0022).
+*/
+const orgIdSchema = z.string().trim().max(200).startsWith(CLERK_ORG_SUBJECT_PREFIX, "orgId must be a Clerk org id");
+/**
+* `cow.json` (spec: Project layout): the org, and which of its apps this
+* repository pushes to. Auth never lives in the file. Strict, so a typo'd
+* key is a build error rather than a silently ignored setting — which is
+* also what turns the retired `project` key into a refusal (`cow build`
+* says what to rename it to).
+*/
+const cowConfigSchema = z.strictObject({
+	$schema: z.url().optional(),
+	orgId: orgIdSchema,
+	/**
+	* Which app of the org this repository pushes to (ADR 0022). The app is
+	* the push unit: it owns the journey and template keys, and `cow
+	* status`, `cow enable --all` and `cow pull` all resolve against it. One
+	* repository is one app, so no journey file names one.
+	*/
+	appId: appIdSchema,
+	/**
+	* The consent purposes this repository declares. They are org-wide, so
+	* two apps declaring one key must agree on its label and default or the
+	* push is refused; a push adds and updates them and never deletes one,
+	* because profiles hold answers against them.
+	*/
+	purposes: purposesSchema.optional(),
+	/** Overrides the API the CLI talks to; the hosted product needs none. */
+	apiUrl: z.url().optional(),
+	/**
+	* Overrides the dashboard `cow login` opens. Paired with `apiUrl`: a
+	* login against one Cowliss's dashboard yields a token the other's API
+	* rejects, so a config that names an API names its dashboard too.
+	*/
+	webUrl: z.url().optional()
+}).meta({
+	title: "cow.json",
+	description: "A cow project: the organization and the app it pushes to."
+});
+
 //#endregion
 //#region ../../packages/shared/src/track.ts
 /**
@@ -5189,7 +5323,7 @@ const trackBodySchema = z.object({ data: trackDataSchema });
 */
 const listEventsQuerySchema = paginationQuerySchema.extend({
 	direction: sortDirectionSchema.default("desc"),
-	appId: z.string().trim().min(1).max(200).optional(),
+	appId: appIdSchema.optional(),
 	sourceId: z.string().trim().min(1).max(200).optional(),
 	event: z.string().trim().min(1).max(200).optional(),
 	/**
@@ -5712,10 +5846,16 @@ const listDeliveriesQuerySchema = paginationQuerySchema.extend({
 	channel: deliveryChannelSchema.optional(),
 	/** Why the send happened: a journey, a test send, or a direct API send. */
 	kind: deliveryKindSchema.optional(),
-	appId: z.string().trim().min(1).max(200).optional(),
+	appId: appIdSchema.optional(),
 	/** One person's deliveries, merged ids included, same as the event feed. */
 	profileId: z.string().trim().min(1).max(200).optional(),
 	/**
+	* What one journey execution sent. Exact, not approximated from journey
+	* and profile: a profile that enrolls twice has one execution per
+	* enrollment, and the older one must not show the newer one's sends.
+	*/
+	executionId: z.string().trim().min(1).max(200).optional(),
+	/**
 	* Only deliveries touched at or after this instant, by `updatedAt`: the
 	* cursor a tail (`cow dev`) polls with, so a send and its later feedback
 	* transition both arrive. Inclusive for the same reason as the execution
@@ -5794,10 +5934,10 @@ const domainDnsSetupSchema = z.object({
 * braces, no dependency. A pattern field takes one pattern or a non-empty
 * list of them, and a list is a disjunction.
 *
-* It lives here rather than beside `appIdList` in ./apps because that module
-* imports the Drizzle schema, which neither the wasmtime guest nor the
-* Temporal workflow isolate can carry. This file imports one constant, so
-* both can.
+* It lives here rather than beside `appIdFromName` in ./apps because that
+* module imports the Drizzle schema, which neither the wasmtime guest nor
+* the Temporal workflow isolate can carry. This file imports one constant,
+* so both can.
 *
 * The system rule: a name under SYSTEM_EVENT_PREFIX matches only a pattern
 * whose *literal prefix* (the text before its first `*`) is itself under
@@ -6135,6 +6275,13 @@ const listExecutionsQuerySchema = paginationQuerySchema.extend({
 	status: executionStatusSchema.optional(),
 	profileId: z.string().trim().min(1).max(200).optional(),
 	/**
+	* One app's runs. An execution carries no app of its own: it is a run of
+	* a journey, and the journey is what belongs to an app (ADR 0022), so the
+	* filter resolves through `journeys.app_id`. Omitted means every app, and
+	* an id the org does not have matches nobody.
+	*/
+	appId: appIdSchema.optional(),
+	/**
 	* Only executions touched at or after this instant, by `updatedAt`: what a
 	* tail (`cow dev`) asks for so it sees both new runs and status changes in
 	* one filter. Inclusive on purpose, because two rows can share a
@@ -6160,67 +6307,17 @@ const cancelExecutionsBodySchema = z.object({ data: z.object({
 */
 const cancellingSchema = z.object({ cancelling: z.literal(true) });
 
-//#endregion
-//#region ../../packages/shared/src/journeys-v2/config.ts
-/**
-* A project's name: what `cow init` asked for, and what the `projects` row
-* stores. Lives here rather than beside the release DTOs because `cow.json`
-* is the file a developer types it into; `createProjectBodySchema` reuses it.
-*/
-const projectNameSchema = z.string().trim().min(1).max(200);
-/**
-* `cow.json` (spec: Project layout): the org, and which of its projects this
-* directory is. Auth never lives in the project. Strict, so a typo'd key
-* is a build error rather than a silently ignored setting.
-*/
-const cowConfigSchema = z.strictObject({
-	$schema: z.url().optional(),
-	orgId: z.string().startsWith(CLERK_ORG_SUBJECT_PREFIX, "orgId must be a Clerk org id"),
-	/**
-	* Which project of the org this directory pushes to. One org can hold
-	* several, one per repo, each with its own release sequence and its own
-	* slice of the deployed journeys, so every project says which it is.
-	*/
-	project: projectNameSchema,
-	/**
-	* The consent purposes this project declares. They are org-wide, so two
-	* projects declaring one key must agree on its label and default or the
-	* deploy is refused; a deploy adds and updates them and never deletes
-	* one, because profiles hold answers against them.
-	*/
-	purposes: purposesSchema.optional(),
-	/** Overrides the API the CLI talks to; the hosted product needs none. */
-	apiUrl: z.url().optional(),
-	/**
-	* Overrides the dashboard `cow login` opens. Paired with `apiUrl`: a
-	* login against one Cowliss's dashboard yields a token the other's API
-	* rejects, so a config that names an API names its dashboard too.
-	*/
-	webUrl: z.url().optional()
-}).meta({
-	title: "cow.json",
-	description: "A cow project: the organization and the project it pushes to."
-});
-
 //#endregion
 //#region ../../packages/shared/src/pushes.ts
 /**
-* The push lifecycle's wire contracts (ADR 0011): the project a developer
-* runs `cow init` in, the artifacts `cow push` uploads, the push itself, and
-* the versions its compile produces.
+* The push lifecycle's wire contracts (ADR 0011): the artifacts `cow push`
+* uploads, the push itself, and the versions its compile produces. The app
+* `cow.json` names is the push unit (ADR 0022).
 *
 * Row-derived through drizzle-zod where a row is what the wire carries, so
 * the DTO cannot drift from the column set; the jsonb manifest gets its
 * explicit shared schema, because the column type is opaque to drizzle-zod.
 */
-const projectSchema = selectProjectSchema.extend({
-	createdAt: z.iso.datetime(),
-	updatedAt: z.iso.datetime()
-});
-/** `cow init` names the project after the folder it created. */
-const createProjectBodySchema = z.object({ data: z.object({ name: projectNameSchema }) });
-/** Which project to read: the one the caller's `cow.json` names. */
-const getProjectQuerySchema = z.object({ name: projectNameSchema });
 const artifactDigestParams = z.object({ digest: digestSchema });
 /**
 * Which kind of artifact the uploaded bytes are. Named by the client rather
@@ -6252,7 +6349,7 @@ const versionSummarySchema = selectVersionSchema.pick({
 	status: true,
 	moduleDigest: true,
 	pushId: true,
-	projectId: true,
+	appId: true,
 	error: true
 }).extend({ pushedAt: z.iso.datetime() });
 /**
@@ -6281,12 +6378,21 @@ const createPushBodySchema = z.object({ data: z.object({
 	* the developer fixes by updating `@cowliss/cli`, and nothing is stored.
 	*/
 	manifest: manifestSchema.safeExtend({ protocol: z.literal(3) }),
-	/** The `cow.json` project this push belongs to. */
-	project: projectNameSchema
+	/** The `cow.json` app this push belongs to (ADR 0022). */
+	appId: appIdSchema,
+	/**
+	* The `cow.json` organization. The credential already decides which org
+	* is written to, so this is not how the server finds the org: it is the
+	* developer saying which one they meant, and a disagreement is refused.
+	* Without it, a push aimed at production but run with local credentials
+	* lands silently whenever both orgs happen to hold an app of the same
+	* slug, which is exactly the shape `apps/platform-workspace` has.
+	*/
+	orgId: orgIdSchema
 }) });
 const listPushesQuerySchema = paginationQuerySchema.extend({ 
-/** One project's own pushes; absent lists the org's. */
-project: projectNameSchema.optional() });
+/** One app's own pushes; absent lists the org's. */
+appId: appIdSchema.optional() });
 /**
 * One key's version history, newest first. Both the key and the kind are
 * required: journeys and templates share a key space, so `welcome` alone
@@ -6297,13 +6403,13 @@ const listVersionsQuerySchema = paginationQuerySchema.extend({
 	kind: z.enum(["journey", "template"])
 });
 /**
-* One key of a project as `cow status` and the MCP `status` tool report it:
+* One key of an app as `cow status` and the MCP `status` tool report it:
 * the code the server holds for it, what state it is in, and what is still
 * running. Journeys and templates share the shape, because a developer asks
 * the same question of both; the two fields only a journey has are null on a
 * template.
 */
-const projectStatusKeySchema = z.object({
+const appStatusKeySchema = z.object({
 	kind: z.enum(["journey", "template"]),
 	key: z.string(),
 	/**
@@ -6322,19 +6428,19 @@ const projectStatusKeySchema = z.object({
 	liveExecutions: z.number().int()
 });
 /**
-* Everything the server knows about one project's keys, in one read: the
-* whole project rather than a page of it, because a manifest holds at most
+* Everything the server knows about one app's keys, in one read: the whole
+* app rather than a page of it, because a manifest holds at most
 * `PUSH_LIMITS.journeys + PUSH_LIMITS.templates` keys and the answer to "what
-* is my project doing" is useless split across cursors.
+* is my app doing" is useless split across cursors.
 *
 * `warnings` is what a deploy used to answer with (ADR 0011 retired the
 * deploy): a name a journey references that the organization does not
 * define yet. They never block, because a segment or a webhook may be created
 * right after a push.
 */
-const projectStatusSchema = z.object({
-	project: projectNameSchema,
-	keys: z.array(projectStatusKeySchema),
+const appStatusSchema = z.object({
+	appId: appIdSchema,
+	keys: z.array(appStatusKeySchema),
 	warnings: z.array(z.string())
 });
 
@@ -6355,15 +6461,20 @@ const segmentMemberSchema = z.object({
 });
 /**
 * The builder's design-time sanity check: run one not-yet-persisted
-* definition over the org's existing profiles. Members is a small sample of
-* matching profile ids, not the full member list: there is no segment row
-* and no membership entry, so there is no segmentId or enteredAt to report.
+* definition over one app's existing profiles. The app is the same one the
+* segment would be created in (ADR 0022), so the count the builder shows is
+* the count saving it would produce. Members is a small sample of matching
+* profile ids, not the full member list: there is no segment row and no
+* membership entry, so there is no segmentId or enteredAt to report.
 *
-* The scan is bounded, so `memberCount` is the exact org-wide count only
+* The scan is bounded, so `memberCount` is the exact count for that app only
 * when `truncated` is false. When it is true the scan stopped at the cap,
 * and `memberCount` is the count over the first `scanned` profiles only.
 */
-const previewSegmentBodySchema = z.object({ data: segmentDefinitionSchema });
+const previewSegmentBodySchema = z.object({ data: z.object({
+	appId: appIdSchema,
+	definition: segmentDefinitionSchema
+}) });
 const segmentPreviewSchema = z.object({
 	memberCount: z.number().int().min(0),
 	members: z.array(z.string()),
@@ -6374,8 +6485,15 @@ const segmentPreviewSchema = z.object({
 });
 const nameSchema = z.string().trim().min(1, "name is required").max(100, "name must be at most 100 characters");
 const descriptionSchema = z.string().trim().max(500, `description must be at most ${500} characters`);
+/**
+* A segment belongs to exactly one app (ADR 0022), named here and never
+* again: it evaluates that app's profiles and that app's events, and an
+* update cannot move it, because the members it already has belong to the
+* app it was built for.
+*/
 const createSegmentBodySchema = z.object({ data: z.object({
 	name: nameSchema,
+	appId: appIdSchema,
 	description: descriptionSchema.nullish(),
 	definition: segmentDefinitionSchema
 }) });
@@ -6384,8 +6502,15 @@ const updateSegmentBodySchema = z.object({ data: z.object({
 	description: descriptionSchema.nullish(),
 	definition: segmentDefinitionSchema.optional()
 }).refine((data) => data.name !== void 0 || data.description !== void 0 || data.definition !== void 0, { message: "at least one field (name, description or definition) is required" }) });
-/** `q` is a substring search over the segment's name. */
-const listSegmentsQuerySchema = paginationQuerySchema.extend({ q: searchQuerySchema });
+/**
+* `q` is a substring search over the segment's name; `appId` narrows to one
+* app's segments, and omitted means every app. An id the org does not have
+* matches nobody rather than 404ing, like every other list filter.
+*/
+const listSegmentsQuerySchema = paginationQuerySchema.extend({
+	q: searchQuerySchema,
+	appId: appIdSchema.optional()
+});
 const listSegmentMembersQuerySchema = paginationQuerySchema.extend({});
 
 //#endregion
@@ -6445,10 +6570,15 @@ const journeyDetailSchema = journeySchema.extend({ segment: segmentDetailSchema.
 * the two things an author names a journey by; `tag` is "has this tag",
 * exact and case-sensitive, so a badge in the table is the way into it.
 * Both are server-side, like every other list filter.
+*
+* `appId` narrows to one app's journeys (ADR 0022); omitted means every
+* app. An id the org does not have matches nobody, the same empty answer
+* `journeys.setStatus` gives it.
 */
 const listJourneysQuerySchema = paginationQuerySchema.extend({
 	/** On, off or paused; the journey's one state. */
 	status: journeyStatusSchema.optional(),
+	appId: appIdSchema.optional(),
 	q: z.string().trim().max(200, "q must be at most 200 characters").optional().transform((value) => value ? value : void 0),
 	tag: z.string().trim().max(50, "tag must be at most 50 characters").optional()
 });
@@ -6477,13 +6607,13 @@ const journeyStatsSchema = z.object({
 });
 /**
 * Which journeys the status acts on, and which state to put them in: the
-* keys the caller named, or every journey of one project. Exactly one of the
+* keys the caller named, or every journey of one app. Exactly one of the
 * two selectors, because a call carrying both would have to decide which it
 * meant.
 *
 * A list rather than one key per call so every surface can do what `cow
-* enable` does: name several keys, or `--all` (which is `project`, resolved
-* server-side, so an agent turning a project on is one call too).
+* enable` does: name several keys, or `--all` (which is `appId`, resolved
+* server-side, so an agent turning an app on is one call too).
 *
 * One body for three states rather than a route per verb (ADR 0018): the
 * transitions differ in what they do to what is in flight, not in who may
@@ -6491,10 +6621,10 @@ const journeyStatsSchema = z.object({
 */
 const setJourneysStatusBodySchema = z.object({ data: z.object({
 	keys: z.array(journeyKeySchema).min(1).max(PUSH_LIMITS.journeys).optional(),
-	/** Every journey of this project, by the name `cow.json` carries. */
-	project: projectNameSchema.optional(),
+	/** Every journey of this app, by the id `cow.json` carries. */
+	appId: appIdSchema.optional(),
 	status: journeyStatusSchema
-}).refine((data) => data.keys === void 0 !== (data.project === void 0), { message: "name keys or a project, not both" }) });
+}).refine((data) => data.keys === void 0 !== (data.appId === void 0), { message: "name keys or an app, not both" }) });
 /**
 * Dry run: one real profile, the journey's latest ready version, and every
 * send gated into a `would_*` row instead of a message. The body is the v1
@@ -6982,7 +7112,12 @@ const templateSchema$1 = z.strictObject({
 	props: z.record(z.string(), z.unknown()).optional()
 });
 const sendEmailDataSchema = z.strictObject({
-	sourceId: z.string(),
+	/**
+	* The pipe the message belongs to. A source id and only a source id: the
+	* Resend facade takes an app id in its base URL because the Resend SDK
+	* has nowhere else to put one, and nothing else on the wire does.
+	*/
+	sourceId: sourceIdSchema,
 	to: recipientsSchema,
 	cc: recipientsSchema.optional(),
 	bcc: recipientsSchema.optional(),
@@ -7184,8 +7319,8 @@ const listSuppressionsQuerySchema = paginationQuerySchema.extend({ q: searchQuer
 */
 const templateSchema = z.object({
 	key: journeyKeySchema,
-	/** The project whose push owns this key (ADR 0009). */
-	projectId: z.string(),
+	/** The app whose push owns this key (ADR 0009, ADR 0022). */
+	appId: z.string(),
 	/** The author's labels; the dashboard's only grouping. */
 	tags: tagsSchema,
 	sendClass: z.enum(SEND_CLASSES),
@@ -7271,10 +7406,17 @@ const listUserRunsQuerySchema = paginationQuerySchema;
 * as text (the jsonb value rendered with ->>), so "who is on the pro plan" is
 * one request. `traitValue` without `trait` is meaningless and is a 422: the
 * value names no key to look in.
+*
+* `appId` narrows to one app's profiles (ADR 0022); omitted means every app.
+* An id the org does not have simply matches nobody, like `segmentId`. `q`
+* still searches identifier values across the org, so an address two apps
+* know answers with one profile per app.
 */
 const listUsersQuerySchema = paginationQuerySchema.extend({
 	direction: sortDirectionSchema.default("asc"),
 	q: searchQuerySchema,
+	/** One app's profiles. An unknown id matches nobody, it is not a 404. */
+	appId: appIdSchema.optional(),
 	trait: z.string().trim().min(1).max(200).optional(),
 	traitValue: z.string().trim().min(1).max(500).optional(),
 	/** Members of one segment. An unknown id matches nobody, it is not a 404. */
@@ -7300,13 +7442,32 @@ const findUserQuerySchema = z.object({ identifier: z.string().trim().min(3, "ide
 const userDetailSchema = profileDtoSchema.extend({ mergedIds: z.array(z.string()) });
 const updateConsentBodySchema = z.object({ data: consentPatchSchema });
 /**
-* DELETE /v1/users/:profileId: what erasure did, so the dashboard action
-* can say "n journey instances terminated".
+* What erasure did, so the dashboard action can say "n journey instances
+* terminated". `profileIds` is the people that were erased: one id for
+* `DELETE /v1/users/:profileId`, one per app for an erasure by identifier
+* (ADR 0022). They are the survivor ids, the ones anyone could have
+* addressed; the merged-away ids that went with them are not listed,
+* because nothing ever showed them as a person.
 */
 const eraseUserResponseSchema = z.object({
-	profileId: z.string(),
+	profileIds: z.array(z.string()),
 	terminatedInstances: z.number().int().min(0)
 });
+/**
+* Erase everyone one identifier names (POST /v1/users/erase), across the
+* organization's apps. Same erasure as by id, addressed by
+* `{ kind, value }` because that is what a person asking to be forgotten
+* gives you; a value nobody in the org carries is a 404.
+*/
+const eraseUserByIdentifierBodySchema = z.object({ data: identifierRefSchema });
+/**
+* The same addressing for the export (POST /v1/users/export). A body rather
+* than a query string for the same reason erasure uses one: a query string
+* is part of the URL, and an access log, a proxy log and a browser history
+* all keep it, so an address must not travel there. The method reads
+* nothing but says where the identifier goes.
+*/
+const exportUserByIdentifierBodySchema = z.object({ data: identifierRefSchema });
 /** One address-ledger row on the export; dates are ISO 8601 strings. */
 const emailAddressSchema = selectEmailAddressSchema.extend({
 	verifiedAt: z.iso.datetime().nullable(),
@@ -7319,14 +7480,20 @@ const journeyRunDtoSchema = selectJourneyRunSchema.extend({
 	createdAt: z.iso.datetime()
 });
 /**
-* GET /v1/users/:profileId/export: the identity's whole data record in one
-* JSON document (GDPR portability). Each section reuses the wire DTO of
-* the store it came from, so the export cannot drift from what the
-* dashboard already shows.
+* The identity's whole data record in one JSON document (GDPR
+* portability). Each section reuses the wire DTO of the store it came
+* from, so the export cannot drift from what the dashboard already shows.
+*
+* `users` is who the document is about: one profile for
+* `GET /v1/users/:profileId/export`, one per app when the export is
+* addressed by identifier (ADR 0022). The other sections are the union over
+* all of them and over everything merged into them, because that is the
+* data the request asked for, and because a person's export is one file
+* whether they used one product or three.
 */
 const userExportSchema = z.object({
 	exportedAt: z.iso.datetime(),
-	user: userDetailSchema,
+	users: z.array(userDetailSchema),
 	events: z.array(eventDtoSchema),
 	journeys: z.array(journeyRunDtoSchema),
 	deliveries: z.array(deliverySchema),
@@ -7969,11 +8136,15 @@ const CONFIG_FILES = [
 * cannot be inlined). There is no `src/` fallback: a missing
 * build surfaces here as an unresolved import rather than as a second code
 * path whose only job is to hide it.
+*
+* `guest` and `guest-emails` are the two drivers and a bundle links exactly
+* one, picked by source kind (`DRIVER`).
 */
 const GUEST_ALIAS = {
 	"@cowliss/cli/journeys": guestFile("journeys"),
 	"@cowliss/cli/emails": guestFile("emails"),
 	"@cowliss/cli/guest": guestFile("guest"),
+	"@cowliss/cli/guest-emails": guestFile("guest-emails"),
 	"@cowliss/cli/guest-wasi": guestFile("guest-wasi"),
 	"@cowliss/cli/guest-prelude": guestFile("guest-prelude")
 };
@@ -8158,23 +8329,33 @@ async function bundle(projectDir, outFile, entry) {
 	};
 }
 /**
+* The driver a bundle links, one per kind. Only the template one imports
+* the renderer, so naming it from a journey entry is what used to put react
+* and react-dom in all 95 journey bundles (`guest/driver.ts`).
+*/
+const DRIVER = {
+	journeys: "@cowliss/cli/guest",
+	emails: "@cowliss/cli/guest-emails"
+};
+/**
 * The artifact the sandbox compiles: stdin in, stdout out, no exports. The
 * prelude is imported first on purpose: ESM evaluates in import order, and
 * its `MessageChannel` and `console` walls have to stand before react-dom
 * or tenant code initializes.
 */
-function wasiEntry(file) {
+function wasiEntry(file, kind) {
 	return `import "@cowliss/cli/guest-prelude";
 import * as module from ${JSON.stringify(file)};
 import { main } from "@cowliss/cli/guest-wasi";
-main(module);
+import { runGuest } from ${JSON.stringify(DRIVER[kind])};
+main(module, runGuest);
 `;
 }
 /** The local twin: the same graph, importable by Node for the manifest and `cow test`. */
-function nodeEntry(file) {
+function nodeEntry(file, kind) {
 	return `import * as module from ${JSON.stringify(file)};
 export { module };
-export { runGuest } from "@cowliss/cli/guest";
+export { runGuest } from ${JSON.stringify(DRIVER[kind])};
 `;
 }
 let messagePortsUnreffed = false;
@@ -8278,7 +8459,9 @@ async function assertCowConfig(projectDir) {
 	} catch {
 		throw new Error(name === "cow.json" ? `No ${name} in "${projectDir}". Run \`cow init\` to create a project.` : `No ${name} in "${projectDir}". That file was selected with --config or COW_CONFIG.`);
 	}
-	const parsed = cowConfigSchema.safeParse(JSON.parse(text));
+	const raw = JSON.parse(text);
+	if (typeof raw === "object" && raw !== null && "project" in raw) throw new Error(`${name} names a "project", which Cowliss no longer has: a repository pushes to one app. Rename that field to "appId" and give it the app's id, which looks like "app_website" and is on the app's page in the dashboard.`);
+	const parsed = cowConfigSchema.safeParse(raw);
 	if (!parsed.success) throw new Error(`${name} is invalid: ${parsed.error.issues.map((issue) => `${issue.path.join(".") || "(root)"}: ${issue.message}`).join("; ")}`);
 	return parsed.data;
 }
@@ -8291,14 +8474,14 @@ async function readCowConfig(projectDir) {
 	}
 }
 /**
-* Which project of the org this directory belongs to: the `project` in its
+* Which app of the org this directory pushes to: the `appId` in its
 * `cow.json`, or undefined when there is no `cow.json` here at all. The
-* undefined case is `cow pull` into an empty directory, which has no project
-* to scope by yet and reads the org's releases.
+* undefined case is `cow pull` into an empty directory, which has no app to
+* scope by yet and reads the org's pushes.
 */
-async function configuredProject(projectDir) {
+async function configuredApp(projectDir) {
 	try {
-		return (await assertCowConfig(projectDir)).project;
+		return (await assertCowConfig(projectDir)).appId;
 	} catch {
 		return;
 	}
@@ -8326,7 +8509,7 @@ async function buildProject(projectDir) {
 	const bundles = await Promise.all(files.map(async (source) => {
 		const nodeFile = join(outDir, "node", source.kind, `${source.key}.mjs`);
 		const wasiFile = join(outDir, "bundles", source.kind, `${source.key}.js`);
-		const [wasi, node] = await Promise.all([bundle(projectDir, wasiFile, wasiEntry(source.file)), bundle(projectDir, nodeFile, nodeEntry(source.file))]);
+		const [wasi, node] = await Promise.all([bundle(projectDir, wasiFile, wasiEntry(source.file, source.kind)), bundle(projectDir, nodeFile, nodeEntry(source.file, source.kind))]);
 		await writeFile(nodeFile, node.code);
 		await writeFile(`${nodeFile}.map`, node.map);
 		await writeFile(wasiFile, wasi.code);
@@ -8569,7 +8752,7 @@ async function copyExample(name, dir, force) {
 	return files;
 }
 function registerAdd(program, io) {
-	program.command("add").description("add gallery example code to a cow project").command("example <name>").description("copy an example's journeys, emails, and scenarios into this project (local: no API call)").option("--force", "overwrite files that already exist").action(async (name, opts) => {
+	program.command("add").description("add gallery example code to a cow repo").command("example <name>").description("copy an example's journeys, emails, and scenarios into this repo (local: no API call)").option("--force", "overwrite files that already exist").action(async (name, opts) => {
 		const dir = process.cwd();
 		await assertCowConfig(dir);
 		const files = await copyExample(name, dir, opts.force === true);
@@ -8598,10 +8781,13 @@ async function login(env, options) {
 	const claims = decodeSessionToken(token);
 	if (claims === null) throw new Error("Token is not a decodable JWT");
 	if (claims.userId === null) throw new Error("Token has no subject claim. Is it a Clerk session token?");
-	const credentials = { token };
-	if (options.apiFlag !== void 0) credentials.apiUrl = options.apiFlag;
+	const apiUrl = options.apiFlag ?? resolveApiUrl(env, null, void 0, (await readCowConfig(process.cwd()))?.apiUrl);
 	return {
-		credentialsPath: await writeCredentials(env, credentials),
+		credentialsPath: await writeCredentials(env, {
+			token,
+			apiUrl
+		}),
+		apiUrl,
 		userId: claims.userId,
 		orgId: claims.orgId,
 		role: claims.role,
@@ -8688,7 +8874,7 @@ function openBrowser(url) {
 //#region src/commands/auth.ts
 /** login/logout/whoami: session-token management, no contract route. */
 function registerAuth(program, env, io) {
-	program.command("login").description("authenticate via the dashboard browser flow (or --token) and cache the session token").option("--token <jwt>", "paste a session token instead of the browser flow").option("--web <url>", `dashboard URL; overrides COW_WEB_URL and webUrl in the project config (default ${DEFAULT_WEB_URL})`).option("--no-open", "do not open the browser; print the URL and wait (headless/agent use)").action(async (opts) => {
+	program.command("login").description("authenticate via the dashboard browser flow (or --token) and cache the session token").option("--token <jwt>", "paste a session token instead of the browser flow").option("--web <url>", `dashboard URL; overrides COW_WEB_URL and webUrl in cow.json (default ${DEFAULT_WEB_URL})`).option("--no-open", "do not open the browser; print the URL and wait (headless/agent use)").action(async (opts) => {
 		const outcome = await login(env, {
 			token: opts.token,
 			webUrl: opts.web,
@@ -8718,8 +8904,14 @@ function registerAuth(program, env, io) {
 		}
 		const claims = decodeSessionToken(credentials?.token ?? "");
 		if (!claims) throw new Error("Cached token is not decodable. Run `cow login` again.");
+		const projectApiUrl = (await readCowConfig(process.cwd()))?.apiUrl;
+		const apiUrl = resolveApiUrl(env, credentials, opts.api, projectApiUrl);
+		const mintedFor = credentials?.apiUrl;
 		emit({ data: {
 			credential: kind,
+			apiUrl,
+			mintedFor: mintedFor ?? null,
+			...mintedFor !== void 0 && mintedFor !== apiUrl ? { warning: `This token was minted for ${mintedFor}, but commands here talk to ${apiUrl}. Run \`cow login\` again from this directory.` } : {},
 			...claims
 		} }, io, opts.json);
 	});
@@ -8732,7 +8924,7 @@ function registerAuth(program, env, io) {
 * the current directory. Local only, no API call and no network.
 */
 function registerBuild(program, io) {
-	program.command("build").description("typecheck and bundle the project in the current directory, writing .cow/build (local: no API call)").action(async (opts) => {
+	program.command("build").description("typecheck and bundle the repo in the current directory, writing .cow/build (local: no API call)").action(async (opts) => {
 		emit({ data: await buildProject(process.cwd()) }, io, opts.json);
 	});
 }
@@ -9165,7 +9357,8 @@ function htmlResponse(description) {
 const params$11 = z.object({ id: z.string() });
 /**
 * An app is the attribution unit: what a developer names, what ingestion
-* stamps, and what segments and journey triggers filter on. Its inbound
+* stamps, and what a profile, a segment and a journey belong to (ADR 0022).
+* It is also the push unit, which is what `status` reports on. Its inbound
 * pipes live under /v1/apps/{appId}/sources, served by the sources module.
 */
 const apps = defineModule(defineRoute({
@@ -9223,6 +9416,23 @@ const apps = defineModule(defineRoute({
 		...sessionErrors,
 		...errors("not_found", "validation_failed", "malformed_request")
 	}
+}), defineRoute({
+	method: "get",
+	path: "/v1/apps/{id}/status",
+	operationId: "apps.status",
+	tags: ["apps"],
+	summary: "What an app's journeys and templates are doing",
+	security: PIPELINE_AUTH,
+	surfaces: {
+		cli: false,
+		mcpName: "status"
+	},
+	request: { params: params$11 },
+	responses: {
+		200: envelope(appStatusSchema),
+		...sessionErrors,
+		...errors("not_found", "validation_failed")
+	}
 }));
 
 //#endregion
@@ -9514,7 +9724,7 @@ const catalog = defineModule(defineRoute({
 //#region ../../packages/shared/src/contract/consent.ts
 /**
 * The consent purposes an organization's profiles answer: the two fixed ones
-* every org has, plus whatever its projects declare in their `cow.json`.
+* every org has, plus whatever its apps declare in their `cow.json`.
 *
 * Read-only, and deliberately so. Purposes are code, like journeys and
 * templates: a deploy upserts them and never deletes one, because profiles
@@ -10052,7 +10262,7 @@ const journeys = defineModule(defineRoute({
 	responses: {
 		200: envelope(z.array(journeyWithOfferSchema), "The journeys as they now stand, each with the members turning it on has waiting"),
 		...sessionErrors,
-		...errors("not_found", "project_missing", "validation_failed", "malformed_request")
+		...errors("not_found", "validation_failed", "malformed_request")
 	}
 }), defineRoute({
 	method: "get",
@@ -10203,63 +10413,11 @@ const me = defineModule(defineRoute({
 	}
 }));
 
-//#endregion
-//#region ../../packages/shared/src/contract/project.ts
-/**
-* The org's project. Singular in the path on purpose: a caller always means
-* one, the one its `cow.json` names, so the name is a query parameter and
-* there is no id to put in a URL. An org with a single project needs neither.
-*/
-const project = defineModule(defineRoute({
-	method: "get",
-	path: "/v1/project",
-	operationId: "project.get",
-	tags: ["project"],
-	summary: "Get one of the organization's projects",
-	security: PIPELINE_AUTH,
-	request: { query: getProjectQuerySchema },
-	responses: {
-		200: envelope(projectSchema),
-		...sessionErrors,
-		...errors("project_missing", "validation_failed", "malformed_request")
-	}
-}), defineRoute({
-	method: "get",
-	path: "/v1/project/status",
-	operationId: "project.status",
-	tags: ["project"],
-	summary: "What a project's journeys and templates are doing",
-	security: PIPELINE_AUTH,
-	surfaces: {
-		cli: false,
-		mcpName: "status"
-	},
-	request: { query: getProjectQuerySchema },
-	responses: {
-		200: envelope(projectStatusSchema),
-		...sessionErrors,
-		...errors("project_missing", "validation_failed", "malformed_request")
-	}
-}), defineRoute({
-	method: "post",
-	path: "/v1/project",
-	operationId: "project.create",
-	tags: ["project"],
-	summary: "Create a project in the organization",
-	security: PIPELINE_AUTH,
-	request: { body: jsonBody(createProjectBodySchema) },
-	responses: {
-		201: envelope(projectSchema, "The created project"),
-		...sessionErrors,
-		...errors("project_exists", "validation_failed", "malformed_request")
-	}
-}));
-
 //#endregion
 //#region ../../packages/shared/src/contract/pushes.ts
 const params$6 = z.object({ id: z.string() });
 /**
-* Pushes: one `cow push` each, the whole project at one point in time. The
+* Pushes: one `cow push` each, the whole app at one point in time. The
 * push stores the source archive and its compile creates a version of every
 * key whose module changed; it turns nothing on (ADR 0011).
 *
@@ -10273,14 +10431,14 @@ const pushes = defineModule(defineRoute({
 	path: "/v1/pushes",
 	operationId: "pushes.create",
 	tags: ["pushes"],
-	summary: "Push a built project",
+	summary: "Push a built app",
 	security: PIPELINE_AUTH,
 	surfaces: HIDDEN_FROM_TOOLS,
 	request: { body: jsonBody(createPushBodySchema) },
 	responses: {
 		201: envelope(pushSchema, "The stored push and the versions it is compiling"),
 		...sessionErrors,
-		...errors("project_missing", "push_invalid", "validation_failed", "malformed_request", "dependency_unavailable")
+		...errors("push_invalid", "validation_failed", "malformed_request", "dependency_unavailable")
 	}
 }), defineRoute({
 	method: "get",
@@ -10331,8 +10489,8 @@ const pushes = defineModule(defineRoute({
 //#region ../../packages/shared/src/contract/resend.ts
 /**
 * The Resend-compatible send facade (ADR 0014): a developer points
-* `RESEND_BASE_URL` at `/resend/{sourceId}` and keeps their code. The source
-* in the path names the app, because the Resend SDK carries no other field
+* `RESEND_BASE_URL` at `/resend/{appOrSourceId}` and keeps their code. The
+* path segment names the app, because the Resend SDK carries no other field
 * and accepts no custom header; the bearer is the organization's ingestion
 * key.
 *
@@ -10348,7 +10506,15 @@ const FACADE_SURFACES = {
 	mcp: false,
 	docs: false
 };
-const sourceParam = z.object({ sourceId: z.string().openapi({ example: "src_2f9a8c1b" }) });
+/**
+* The app the message belongs to: its own id, or the id of its one `api`
+* source, which is what every base URL held before app ids were accepted
+* here. Both resolve to that source, so attribution is the same either way.
+*/
+const targetParam = z.object({ appOrSourceId: z.union([appIdSchema, sourceIdSchema], { error: "Use an app id (\"app_website\") or the id of its API source." }).openapi({
+	example: "app_website",
+	description: "The app to send for, or the id of its API source. Both name the same pipe."
+}) });
 /** Resend's error body, for the answers this facade gives. */
 const facadeError = (description) => ({
 	description,
@@ -10356,21 +10522,21 @@ const facadeError = (description) => ({
 });
 const facadeErrors = {
 	401: facadeError("missing_api_key | invalid_api_key"),
-	404: facadeError("not_found: unknown source, or unknown message"),
+	404: facadeError("not_found: unknown app or source, or unknown message"),
 	422: facadeError("validation_error | missing_required_field"),
 	429: facadeError("monthly_quota_exceeded | rate_limit_exceeded"),
 	500: facadeError("application_error")
 };
 const resend = defineModule(defineRoute({
 	method: "post",
-	path: "/resend/{sourceId}/emails",
+	path: "/resend/{appOrSourceId}/emails",
 	operationId: "resend.send",
 	tags: ["resend"],
 	summary: "Send one email (Resend-compatible)",
 	security: API_KEY_AUTH,
 	surfaces: FACADE_SURFACES,
 	request: {
-		params: sourceParam,
+		params: targetParam,
 		body: jsonBody(resendSendBodySchema)
 	},
 	responses: {
@@ -10383,14 +10549,14 @@ const resend = defineModule(defineRoute({
 	}
 }), defineRoute({
 	method: "post",
-	path: "/resend/{sourceId}/emails/batch",
+	path: "/resend/{appOrSourceId}/emails/batch",
 	operationId: "resend.sendBatch",
 	tags: ["resend"],
 	summary: "Send up to 100 emails (Resend-compatible)",
 	security: API_KEY_AUTH,
 	surfaces: FACADE_SURFACES,
 	request: {
-		params: sourceParam,
+		params: targetParam,
 		body: jsonBody(resendBatchBodySchema)
 	},
 	responses: {
@@ -10403,13 +10569,13 @@ const resend = defineModule(defineRoute({
 	}
 }), defineRoute({
 	method: "get",
-	path: "/resend/{sourceId}/emails/{id}",
+	path: "/resend/{appOrSourceId}/emails/{id}",
 	operationId: "resend.get",
 	tags: ["resend"],
 	summary: "Fetch one sent email (Resend-compatible)",
 	security: API_KEY_AUTH,
 	surfaces: FACADE_SURFACES,
-	request: { params: sourceParam.extend({ id: z.string().openapi({ example: "dlv_2f9a8c1b" }) }) },
+	request: { params: targetParam.extend({ id: z.string().openapi({ example: "dlv_2f9a8c1b" }) }) },
 	responses: {
 		200: {
 			description: "The email object",
@@ -10896,8 +11062,18 @@ const mergedRedirect = { 307: {
 	headers: z.object({ Location: z.string().meta({ description: "The survivor's URL" }) })
 } };
 /**
-* Profiles by their Cowliss-generated id. `find` precedes `{profileId}` so
-* the literal path wins.
+* Profiles by their Cowliss-generated id. `find`, `export` and `erase`
+* precede `{profileId}` so the literal paths win.
+*
+* Compliance has two ways in (ADR 0022). A `usr_` id names one profile, and
+* erasure or export takes it with everything merged into it. A
+* `{ kind, value }` identifier names a person, which is one profile per app
+* that knows the value, and the same erasure or export runs over all of
+* them at once: the addressing differs, nothing below it does. An identifier
+* never travels in the URL, neither in the path nor in a query string,
+* because a GDPR request carries an address and a URL is logged whole. That
+* is why both identifier routes are a POST carrying a body, including the
+* export, which reads.
 */
 const users = defineModule(defineRoute({
 	method: "get",
@@ -10925,6 +11101,32 @@ const users = defineModule(defineRoute({
 		...sessionErrors,
 		...errors("not_found", "validation_failed")
 	}
+}), defineRoute({
+	method: "post",
+	path: "/v1/users/export",
+	operationId: "users.exportByIdentifier",
+	tags: ["users"],
+	summary: "Export everything held on the people one identifier names",
+	security: SESSION_AUTH,
+	request: { body: jsonBody(exportUserByIdentifierBodySchema) },
+	responses: {
+		200: envelope(userExportSchema),
+		...sessionErrors,
+		...errors("not_found", "validation_failed", "malformed_request")
+	}
+}), defineRoute({
+	method: "post",
+	path: "/v1/users/erase",
+	operationId: "users.eraseByIdentifier",
+	tags: ["users"],
+	summary: "Erase every person one identifier names (GDPR)",
+	security: SESSION_AUTH,
+	request: { body: jsonBody(eraseUserByIdentifierBodySchema) },
+	responses: {
+		200: envelope(eraseUserResponseSchema),
+		...sessionErrors,
+		...errors("not_found", "validation_failed", "malformed_request")
+	}
 }), defineRoute({
 	method: "get",
 	path: "/v1/users/{profileId}",
@@ -11188,7 +11390,6 @@ const contract = {
 	violations,
 	review,
 	segments,
-	project,
 	artifacts,
 	pushes,
 	versions,
@@ -11581,7 +11782,7 @@ function registerContractCommands(program, run) {
 */
 /**
 * One call, whichever way the keys were named: the route takes the set, and
-* `--all` is the project name, resolved on the server against the rows it
+* `--all` is the app id, resolved on the server against the rows the app
 * owns (so it reaches a key whose file the tree lost). A key that is not
 * there refuses the whole call, and nothing changes.
 */
@@ -11620,7 +11821,7 @@ const STATE_WORD = {
 };
 /** What the terminal says: one line per key, naming its new state. */
 function flipSummary(journeys, status) {
-	if (journeys.length === 0) return `This project has no journeys to put ${STATE_WORD[status]}.`;
+	if (journeys.length === 0) return `This app has no journeys to put ${STATE_WORD[status]}.`;
 	return journeys.map((journey) => [`${journey.key} is ${STATE_WORD[status]}.`, ...segmentLines(journey)].join("\n")).join("\n");
 }
 const DESCRIPTIONS = {
@@ -11629,14 +11830,14 @@ const DESCRIPTIONS = {
 	paused: "hold journeys: nobody enters, and everyone part-way through waits"
 };
 function register(program, clientFor, io, verb, status) {
-	program.command(verb).description(`${DESCRIPTIONS[status]} (many keys, or --all for this project's)`).argument("[keys...]", "journey keys").option("--all", "every journey of this project").action(async (keys, opts) => {
+	program.command(verb).description(`${DESCRIPTIONS[status]} (many keys, or --all for this app's)`).argument("[keys...]", "journey keys").option("--all", "every journey of this app").action(async (keys, opts) => {
 		const merged = {
 			...program.opts(),
 			...opts
 		};
 		if (merged.all === true && keys.length > 0) throw new Error(`Name the journeys or pass --all, not both: cow ${verb} welcome.`);
 		if (merged.all !== true && keys.length === 0) throw new Error(`Name at least one journey, or pass --all: cow ${verb} welcome.`);
-		const selector = merged.all === true ? { project: (await assertCowConfig(process.cwd())).project } : { keys };
+		const selector = merged.all === true ? { appId: (await assertCowConfig(process.cwd())).appId } : { keys };
 		const updated = await setStatus(await clientFor(merged), selector, status);
 		if (merged.json === true) {
 			emit({ data: updated }, io, true);
@@ -11696,43 +11897,45 @@ async function packageJson(name) {
 		}
 	});
 }
+/** The org's active apps, or null when this machine cannot read them. */
+async function listApps(client) {
+	try {
+		return (await client.request(contract.apps["apps.list"], { query: {
+			status: "active",
+			limit: 100
+		} })).data.map((app) => app.id);
+	} catch {
+		return null;
+	}
+}
 /**
-* Create the org's project row. Best effort by design: with no credentials
-* there is nothing to authenticate with, and any other failure (offline, an
-* older API) leaves the row for `cow push` to create.
-*
-* ponytail: plain fetch because `POST /v1/project` is not a contract route
-* yet; swap it for the typed client's `project.create` once ticket 04 lands.
+* Pick the app this repository pushes to. One app is the answer; several
+* are a question; none is a refusal, because the answer is in the dashboard
+* and `cow init` is not allowed to invent one.
 */
-async function createProject(apiUrl, token, name) {
-	if (!token) return {
-		project: "skipped",
-		reason: "not logged in"
+async function chooseApp(client, webUrl, flag, org, io, skipPrompts) {
+	if (flag) return { appId: flag };
+	if (org.claimed !== null && org.claimed !== org.requested) return {
+		appId: "",
+		reason: `this machine is logged in to ${org.claimed}, not ${org.requested}`
 	};
-	try {
-		const response = await fetch(`${apiUrl}/v1/project`, {
-			method: "POST",
-			headers: {
-				"content-type": "application/json",
-				authorization: `Bearer ${token}`
-			},
-			body: JSON.stringify({ data: { name } })
-		});
-		if (response.status === 201) return { project: "created" };
-		if (response.status === 409) return { project: "exists" };
-		return {
-			project: "skipped",
-			reason: `POST /v1/project answered ${response.status}`
-		};
-	} catch (error) {
-		return {
-			project: "skipped",
-			reason: error instanceof Error ? error.message : String(error)
-		};
-	}
+	const apps = await listApps(client);
+	if (apps === null) return {
+		appId: "",
+		reason: "this machine could not read the org's apps"
+	};
+	if (apps.length === 0) throw new Error(`This organization has no app yet, and a repository pushes to one. Create one at ${webUrl}/apps, then run \`cow init\` again.`);
+	const only = apps[0];
+	if (apps.length === 1 && only) return { appId: only };
+	if (skipPrompts || !io.isTTY) return {
+		appId: "",
+		reason: `this organization has several apps (${apps.join(", ")}) and nothing said which`
+	};
+	io.stderr(`Apps in this organization:\n${apps.map((id) => `  ${id}`).join("\n")}\n`);
+	return { appId: await ask("App id", only ?? "", io, false) };
 }
-function registerInit(program, env, io) {
-	program.command("init").argument("[dir]", "directory to create the project in (default: here)").description("create a cow project: cow.json, journeys/, emails/, and the files to build them").option("--org <id>", "organization id (default: the logged-in org)").option("--yes", "accept the defaults instead of prompting").option("--example <name>", "start from a gallery example").action(async (dirArg, opts) => {
+function registerInit(program, clientFor, env, io) {
+	program.command("init").argument("[dir]", "directory to create the repo in (default: here)").description("create a cow repo: cow.json, journeys/, emails/, and the files to build them").option("--org <id>", "organization id (default: the logged-in org)").option("--app <id>", "app id this repository pushes to (default: ask, or the org's only one)").option("--yes", "accept the defaults instead of prompting").option("--example <name>", "start from a gallery example").action(async (dirArg, opts) => {
 		const merged = {
 			...program.opts(),
 			...opts
@@ -11740,17 +11943,27 @@ function registerInit(program, env, io) {
 		const skipPrompts = opts.yes === true;
 		const cwd = process.cwd();
 		const defaultName = basename(dirArg ? resolve(cwd, dirArg) : cwd);
-		const name = await ask("Project name", defaultName, io, skipPrompts);
+		const name = await ask("Repo name", defaultName, io, skipPrompts);
 		const dir = dirArg ? resolve(cwd, dirArg) : name === defaultName ? cwd : resolve(cwd, name);
 		if (existsSync(join(dir, "cow.json"))) throw new Error(`"${dir}" already holds a cow.json. Use \`cow add example\` to add code to it.`);
 		const credentials = await readCredentials(env);
 		const claimedOrg = credentials ? decodeSessionToken(credentials.token)?.orgId ?? null : null;
 		const orgId = typeof opts.org === "string" && opts.org !== "" ? opts.org : await ask("Organization id", claimedOrg ?? "", io, skipPrompts);
 		if (orgId === "") throw new Error("No organization id. Pass --org org_… or run `cow login` first.");
-		const config = cowConfigSchema.parse({
+		if (!orgIdSchema.safeParse(orgId).success) throw new Error(`"${orgId}" is not an organization id. They look like org_…; \`cow login\` writes the one you are signed in to.`);
+		const webUrl = resolveWebUrl(env);
+		const app = await chooseApp(await clientFor(merged), webUrl, typeof opts.app === "string" && opts.app !== "" ? opts.app : void 0, {
+			requested: orgId,
+			claimed: claimedOrg
+		}, io, skipPrompts);
+		const config = app.appId === "" ? {
 			$schema: COW_CONFIG_SCHEMA_URL,
 			orgId,
-			project: name
+			appId: ""
+		} : cowConfigSchema.parse({
+			$schema: COW_CONFIG_SCHEMA_URL,
+			orgId,
+			appId: app.appId
 		});
 		const contents = {
 			"cow.json": json(config),
@@ -11773,19 +11986,18 @@ function registerInit(program, env, io) {
 		}
 		const example = typeof opts.example === "string" ? opts.example : void 0;
 		const files = [...Object.keys(contents), ...example ? await copyExample(example, dir, false) : []].sort();
-		const outcome = await createProject(resolveApiUrl(env, credentials, typeof merged.api === "string" ? merged.api : void 0), resolveCredential(env, credentials).token, name);
 		emit({ data: {
 			dir,
 			orgId,
 			files,
-			...outcome
+			...app
 		} }, io, merged.json);
 		const here = relative(cwd, dir) || ".";
 		const scenario = files.find((file) => file.startsWith("scenarios/")) ?? "scenarios/abandoned-checkout.timeout.json";
-		const projectLine = outcome.project === "created" ? `Project created for ${orgId}` : outcome.project === "exists" ? `Project already exists for ${orgId}` : `Project not created (${outcome.reason}); cow push will create it.`;
+		const appLine = app.appId === "" ? `No app named yet (${app.reason}). Put its id in cow.json's "appId"; you will find it on the app's page at ${webUrl}/apps.` : `Pushes to ${app.appId}`;
 		io.stderr([
-			`Created a cow project in ${here}`,
-			projectLine,
+			`Created a cow repo in ${here}`,
+			appLine,
 			"",
 			"Next steps:",
 			`  cd ${here}`,
@@ -11959,25 +12171,25 @@ function noGitHere(error) {
 	return failure.code === "ENOENT" || String(failure.stderr ?? "").includes("not a git repository");
 }
 /**
-* The push to restore: the one named, else this project's newest. Scoped to
-* this directory's project, so a sibling repo's tree is never unpacked over
-* this one's files.
+* The push to restore: the one named, else this app's newest. Scoped to this
+* directory's app, so a sibling repo's tree is never unpacked over this
+* one's files.
 *
 * The newest rather than the newest that compiled: a push stores the whole
 * tree and its source archive whatever its keys then compiled to, so it is
 * the last thing anyone pushed either way.
 */
-async function resolvePush(client, pushId, project) {
+async function resolvePush(client, pushId, appId) {
 	if (pushId) return (await client.request(contract.pushes["pushes.get"], { params: { id: pushId } })).data;
 	const newest = (await client.request(contract.pushes["pushes.list"], { query: {
 		limit: 1,
-		project
+		appId
 	} })).data[0];
-	if (!newest) throw new Error("This project has never been pushed, so there is nothing to restore. Run `cow push` first, or name a push with --push.");
+	if (!newest) throw new Error("This app has never been pushed, so there is nothing to restore. Run `cow push` first, or name a push with --push.");
 	return newest;
 }
 async function pullPush({ client, projectDir, pushId, force }) {
-	const push = await resolvePush(client, pushId, await configuredProject(projectDir));
+	const push = await resolvePush(client, pushId, await configuredApp(projectDir));
 	if (!force) {
 		const dirty = await dirtyPaths(projectDir);
 		if (dirty.length > 0) throw new Error(`This working tree has uncommitted changes and \`cow pull\` would write over them:\n  ${dirty.join("\n  ")}\nCommit or stash them, or pass --force.`);
@@ -11999,7 +12211,7 @@ async function pullPush({ client, projectDir, pushId, force }) {
 	};
 }
 function registerPull(program, clientFor, io) {
-	program.command("pull").description("restore the project's source files from a push into the current directory").option("--push <id>", "the push to restore (default: the newest one)").option("--force", "extract even when the git working tree is dirty").action(async (opts) => {
+	program.command("pull").description("restore the repo's source files from a push into the current directory").option("--push <id>", "the push to restore (default: the newest one)").option("--force", "extract even when the git working tree is dirty").action(async (opts) => {
 		const merged = {
 			...program.opts(),
 			...opts
@@ -12020,25 +12232,6 @@ function registerPull(program, clientFor, io) {
 
 //#endregion
 //#region src/commands/push.ts
-/**
-* This directory's project, created when the org has none by that name.
-* `cow init` usually got there first; a project pushed from a machine that
-* only ever cloned the repo has not, and creating it here is what makes that
-* clone work. The name is `cow.json`'s `project`.
-*/
-async function ensureProject(client, name) {
-	try {
-		return (await client.request(contract.project["project.get"], { query: { name } })).data;
-	} catch (error) {
-		if (!(error instanceof ApiError) || error.code !== "project_missing") throw error;
-	}
-	try {
-		return (await client.request(contract.project["project.create"], { body: { name } })).data;
-	} catch (error) {
-		const reason = error instanceof Error ? error.message : String(error);
-		throw new Error(`This organization has no project and one could not be created (${reason}). Run \`cow init\` first.`);
-	}
-}
 /** Does the org already hold these bytes? A 404 is the answer, not a failure. */
 async function held(client, digest) {
 	try {
@@ -12072,8 +12265,6 @@ function artifactFiles(projectDir, manifest) {
 }
 async function pushProject({ client, projectDir }) {
 	const { manifest, config } = await buildProject(projectDir);
-	const project = await ensureProject(client, config.project);
-	if (project.orgId !== config.orgId) throw new Error(`cow.json is for ${config.orgId} but the credential belongs to ${project.orgId}. Log in to that organization, use its pipeline key, or select a config for it with --config or COW_CONFIG (for example cow.local.json).`);
 	const uploaded = [];
 	for (const artifact of artifactFiles(projectDir, manifest)) {
 		if (await held(client, artifact.digest)) continue;
@@ -12090,7 +12281,8 @@ async function pushProject({ client, projectDir }) {
 				...manifest,
 				protocol: 3
 			},
-			project: project.name
+			appId: config.appId,
+			orgId: config.orgId
 		} })).data,
 		uploaded
 	};
@@ -12106,10 +12298,10 @@ function pushSummary(outcome, webUrl) {
 	const stored = `Push #${push.seq} stored (${uploaded}).`;
 	if (push.versions.length === 0) return `${stored} Nothing changed.`;
 	const width = Math.max(...push.versions.map((version) => version.key.length));
-	return [`${stored} Compiling ${push.versions.length} ${push.versions.length === 1 ? "key" : "keys"}:`, ...push.versions.map((version) => `  ${version.key.padEnd(width)}  ${webUrl}/${version.kind === "journey" ? "journeys" : "templates"}/${version.key}`)].join("\n");
+	return [`${stored} Compiling ${push.versions.length} ${push.versions.length === 1 ? "key" : "keys"}:`, ...push.versions.map((version) => `  ${version.key.padEnd(width)}  ${webUrl}/${version.kind === "journey" ? "journeys" : "deliveries/templates"}/${version.key}`)].join("\n");
 }
 function registerPush(program, clientFor, env, io) {
-	program.command("push").description("build the project and upload it; the server compiles what changed").action(async (opts) => {
+	program.command("push").description("build this repository and upload it; the server compiles what changed").action(async (opts) => {
 		const merged = {
 			...program.opts(),
 			...opts
@@ -12130,10 +12322,10 @@ function registerPush(program, clientFor, env, io) {
 //#endregion
 //#region src/commands/status.ts
 /**
-* `cow status`: what the server holds for every key of this project, and how
-* far the tree in front of the developer has moved from it. Hand-written
-* rather than derived from `project.status`, because the drift is the half
-* of the answer no server read can know: it comes from building the project
+* `cow status`: what the server holds for every key of this app, and how far
+* the tree in front of the developer has moved from it. Hand-written rather
+* than derived from `apps.status`, because the drift is the half of the
+* answer no server read can know: it comes from building the repository
 * here and comparing the bundle digests with the versions the server has.
 */
 /** Largest first: the first unit the gap fills is the one that reads best. */
@@ -12207,7 +12399,7 @@ function statusLines(status, manifest, now) {
 	const local = manifest ? localKeys(manifest) : [];
 	const journeys = status.keys.filter((entry) => entry.kind === "journey");
 	const templates = status.keys.filter((entry) => entry.kind === "template");
-	const lines = [`${status.project}: ${journeys.length} ${journeys.length === 1 ? "journey" : "journeys"}, ${templates.length} ${templates.length === 1 ? "template" : "templates"} on the server.`];
+	const lines = [`${status.appId}: ${journeys.length} ${journeys.length === 1 ? "journey" : "journeys"}, ${templates.length} ${templates.length === 1 ? "template" : "templates"} on the server.`];
 	const width = Math.max(0, ...status.keys.map((entry) => entry.key.length));
 	const section = (title, entries) => {
 		if (entries.length === 0) return;
@@ -12246,19 +12438,19 @@ function statusLines(status, manifest, now) {
 	}
 	return lines;
 }
-/** The project's status from the server, for this directory's `cow.json`. */
-async function readStatus(client, project) {
-	return (await client.request(contract.project["project.status"], { query: { name: project } })).data;
+/** The app's status from the server, for this directory's `cow.json`. */
+async function readStatus(client, appId) {
+	return (await client.request(contract.apps["apps.status"], { params: { id: appId } })).data;
 }
 function registerStatus(program, clientFor, io) {
-	program.command("status").description("what this project's journeys and templates are doing, and what changed here since the last push").action(async (opts) => {
+	program.command("status").description("what this app's journeys and templates are doing, and what changed here since the last push").action(async (opts) => {
 		const merged = {
 			...program.opts(),
 			...opts
 		};
 		const config = await assertCowConfig(process.cwd());
 		const built = await buildProject(process.cwd()).catch(() => null);
-		const status = await readStatus(await clientFor(merged), config.project);
+		const status = await readStatus(await clientFor(merged), config.appId);
 		if (merged.json === true) {
 			emit({ data: status }, io, true);
 			return;
@@ -12527,7 +12719,7 @@ function emit(result, io, json) {
 }
 function buildProgram(env, io) {
 	const program = new Command();
-	program.name("cow").description("Admin CLI for Cowliss: a thin client of the dashboard API").option("--api <url>", "API base URL (overrides env and saved config)").option("--json", "force compact single-line JSON output").option("--config <file>", `project config to read instead of ${DEFAULT_CONFIG_FILE} (overrides COW_CONFIG)`);
+	program.name("cow").description("Admin CLI for Cowliss: a thin client of the dashboard API").option("--api <url>", "API base URL (overrides env and saved config)").option("--json", "force compact single-line JSON output").option("--config <file>", `config file to read instead of ${DEFAULT_CONFIG_FILE} (overrides COW_CONFIG)`);
 	program.hook("preAction", () => {
 		const flag = program.opts().config;
 		setConfigFile((typeof flag === "string" ? flag : void 0) ?? env.COW_CONFIG ?? "cow.json");
@@ -12549,7 +12741,7 @@ function buildProgram(env, io) {
 	};
 	registerContractCommands(program, run);
 	registerAuth(program, env, io);
-	registerInit(program, env, io);
+	registerInit(program, clientFor, env, io);
 	registerAdd(program, io);
 	registerBuild(program, io);
 	registerPush(program, clientFor, env, io);