@cowliss/cli 0.2.0 → 0.4.0

package/README.md

@@ -45,6 +45,7 @@ import { defineJourney } from "@cowliss/cli/journeys";
 export default defineJourney({
   trigger: { event: "checkout_started" },
   purpose: "emailMarketing",
+  senderIdentity: "cowliss-default",
   run: async (event, api) => {
     const purchased = await api.waitForEvent("purchase_completed", {
       timeout: "24h",
@@ -52,7 +53,7 @@ export default defineJourney({
     if (purchased) {
       return;
     }
-    await api.email.send({
+    await api.send.email({
       template: "abandoned-checkout",
       props: { checkoutUrl: event.properties.checkoutUrl },
     });

package/dist/guest/{constants-OZrYz4I2.d.ts → constants-B0wk-87t.d.ts}

@@ -10,18 +10,6 @@
  */
 declare const ENVIRONMENTS: readonly ["development", "production"];
 type Environment = (typeof ENVIRONMENTS)[number];
-/**
- * Fixed consent purposes for the prototype. Consent is a per-purpose map on
- * the profile, checked at send-step execution time.
- *
- * The two names describe what the recipient agreed to, not the pipe it
- * arrives on: "emails I did not ask for individually" and "my data leaving
- * for somewhere else". Naming them after the channel (`email`, `webhook`)
- * said nothing a recipient could consent to, and transactional mail already
- * bypasses the email purpose, so it was only ever marketing consent.
- */
-declare const CONSENT_PURPOSES: readonly ["emailMarketing", "dataProcessing"];
-type ConsentPurpose = (typeof CONSENT_PURPOSES)[number];
 /**
  * The two classes of send, declared on the template rather than passed per
  * call so the class cannot drift between two sends of the same message.
@@ -39,4 +27,4 @@ type ConsentPurpose = (typeof CONSENT_PURPOSES)[number];
 declare const SEND_CLASSES: readonly ["marketing", "transactional"];
 type SendClass = (typeof SEND_CLASSES)[number];
 //#endregion
-export { Environment as n, SendClass as r, ConsentPurpose as t };
+export { SendClass as n, Environment as t };

package/dist/guest/{driver-D8cPyQgF.js → driver-DaNdNhuF.js}

@@ -1,4 +1,4 @@
-import { a as manifestOutputSchema, i as journeyStepOutputSchema, o as templateRenderOutputSchema, r as guestInputSchema, t as CapabilityError } from "./journeys-CR_wIAtP.js";
+import { a as manifestOutputSchema, i as journeyStepOutputSchema, o as templateRenderOutputSchema, r as guestInputSchema, t as CapabilityError } from "./journeys-B_xg_GnL.js";
 import { z } from "zod";
 import { createElement } from "react";
 import { renderToStaticMarkup } from "react-dom/server.browser";
@@ -78,7 +78,7 @@ function formatLogArg(value) {
 * The returned state is the driver's window into the run: the pending
 * call, the captured logs, and the clock the shims read.
 */
-function createApi(input) {
+function createApi(input, journey) {
 	let cursor = 0;
 	let markSuspended = () => {};
 	const state = {
@@ -118,17 +118,20 @@ function createApi(input) {
 					timeout: options.timeout
 				}
 			}),
-			email: { send: (args) => call({
-				name: "email.send",
-				args: {
-					template: args.template,
-					props: args.props
-				}
-			}) },
-			webhook: { send: (args) => call({
-				name: "webhook.send",
-				args
-			}) },
+			send: {
+				email: (args) => call({
+					name: "send.email",
+					args: {
+						template: args.template,
+						props: args.props,
+						senderIdentity: args.senderIdentity ?? journey.senderIdentity
+					}
+				}),
+				webhook: (args) => call({
+					name: "send.webhook",
+					args
+				})
+			},
 			traits: {
 				set: (key, value) => call({
 					name: "traits.set",
@@ -5569,6 +5572,7 @@ function readManifest(module) {
 			kind: "journey",
 			trigger: journey.trigger,
 			purpose: journey.purpose,
+			senderIdentity: journey.senderIdentity,
 			environments: journey.environments,
 			tags: journey.tags
 		});
@@ -5584,7 +5588,7 @@ function readManifest(module) {
 }
 async function runJourneyStep(module, input) {
 	const journey = asJourney(module);
-	const { api, state } = createApi(input);
+	const { api, state } = createApi(input, journey);
 	const restore = installShims({
 		clock: state.clock,
 		seed: input.seed

package/dist/guest/driver.d.ts

@@ -1,4 +1,4 @@
-import { a as ManifestOutput, i as JourneyStepOutput, o as TemplateRenderOutput } from "./index-heC1gFE_.js";
+import { a as ManifestOutput, i as JourneyStepOutput, o as TemplateRenderOutput } from "./index-DAGLEHDn.js";
 //#region src/guest/driver.d.ts
 /**
  * The in-process driver: JSON in, JSON out (spec: Guest protocol). One

package/dist/guest/driver.js

@@ -1,3 +1,3 @@
-import { t as runGuest } from "./driver-D8cPyQgF.js";
+import { t as runGuest } from "./driver-DaNdNhuF.js";
 
 export { runGuest };

package/dist/guest/emails.d.ts

@@ -1,4 +1,4 @@
-import { r as SendClass } from "./constants-OZrYz4I2.js";
+import { n as SendClass } from "./constants-B0wk-87t.js";
 import { z } from "zod";
 import { ReactElement } from "react";
 //#region src/guest/emails.d.ts

package/dist/guest/{index-heC1gFE_.d.ts → index-DAGLEHDn.d.ts}

@@ -30,13 +30,14 @@ declare const journeyStepOutputSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
       timeout: z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>;
     }, z.core.$strict>;
   }, z.core.$strip>, z.ZodObject<{
-    name: z.ZodLiteral<"email.send">;
+    name: z.ZodLiteral<"send.email">;
     args: z.ZodObject<{
       template: z.ZodString;
       props: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+      senderIdentity: z.ZodString;
     }, z.core.$strict>;
   }, z.core.$strip>, z.ZodObject<{
-    name: z.ZodLiteral<"webhook.send">;
+    name: z.ZodLiteral<"send.webhook">;
     args: z.ZodObject<{
       destination: z.ZodString;
       payload: z.ZodRecord<z.ZodString, z.ZodUnknown>;
@@ -119,13 +120,14 @@ declare const journeyStepOutputSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
         timeout: z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>;
       }, z.core.$strict>;
     }, z.core.$strip>, z.ZodObject<{
-      name: z.ZodLiteral<"email.send">;
+      name: z.ZodLiteral<"send.email">;
       args: z.ZodObject<{
         template: z.ZodString;
         props: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+        senderIdentity: z.ZodString;
       }, z.core.$strict>;
     }, z.core.$strip>, z.ZodObject<{
-      name: z.ZodLiteral<"webhook.send">;
+      name: z.ZodLiteral<"send.webhook">;
       args: z.ZodObject<{
         destination: z.ZodString;
         payload: z.ZodRecord<z.ZodString, z.ZodUnknown>;
@@ -177,13 +179,14 @@ declare const journeyStepOutputSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
         timeout: z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>;
       }, z.core.$strict>;
     }, z.core.$strip>, z.ZodObject<{
-      name: z.ZodLiteral<"email.send">;
+      name: z.ZodLiteral<"send.email">;
       args: z.ZodObject<{
         template: z.ZodString;
         props: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+        senderIdentity: z.ZodString;
       }, z.core.$strict>;
     }, z.core.$strip>, z.ZodObject<{
-      name: z.ZodLiteral<"webhook.send">;
+      name: z.ZodLiteral<"send.webhook">;
       args: z.ZodObject<{
         destination: z.ZodString;
         payload: z.ZodRecord<z.ZodString, z.ZodUnknown>;
@@ -253,10 +256,8 @@ declare const manifestOutputSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
   }, z.core.$strict>, z.ZodObject<{
     segment: z.ZodString;
   }, z.core.$strict>]>;
-  purpose: z.ZodEnum<{
-    dataProcessing: "dataProcessing";
-    emailMarketing: "emailMarketing";
-  }>;
+  purpose: z.ZodString;
+  senderIdentity: z.ZodOptional<z.ZodString>;
   environments: z.ZodArray<z.ZodEnum<{
     development: "development";
     production: "production";

package/dist/guest/{journeys-CR_wIAtP.js → journeys-B_xg_GnL.js}

@@ -66,36 +66,6 @@ const RELEASE_LIMITS = {
 const COW_CONFIG_SCHEMA_PATH = "/schemas/cow.json";
 const COW_CONFIG_SCHEMA_URL = `${DOCS_URL}${COW_CONFIG_SCHEMA_PATH}`;
 
-//#endregion
-//#region ../../packages/shared/src/journeys-v2/config.ts
-/**
-* A project's name: what `cow init` asked for, and what the `projects` row
-* stores. Lives here rather than beside the release DTOs because `cow.json`
-* is the file a developer types it into; `createProjectBodySchema` reuses it.
-*/
-const projectNameSchema = z.string().trim().min(1).max(200);
-/**
-* `cow.json` (spec: Project layout): the org, and which of its projects this
-* directory is. The environment is always a flag, and auth never lives in
-* the project. Strict, so a typo'd key is a build error rather than a
-* silently ignored setting.
-*/
-const cowConfigSchema = z.strictObject({
-	$schema: z.url().optional(),
-	orgId: z.string().startsWith(CLERK_ORG_SUBJECT_PREFIX, "orgId must be a Clerk org id"),
-	/**
-	* Which project of the org this directory pushes to. One org can hold
-	* several, one per repo, each with its own release sequence and its own
-	* slice of the deployed journeys, so every project says which it is.
-	*/
-	project: projectNameSchema,
-	/** Overrides the API the CLI talks to; the hosted product needs none. */
-	apiUrl: z.url().optional()
-}).meta({
-	title: "cow.json",
-	description: "A cow project: the organization and the project it deploys to."
-});
-
 //#endregion
 //#region ../../packages/shared/src/environments.ts
 /**
@@ -141,6 +111,50 @@ const journeyKeySchema = z.string().max(64).regex(JOURNEY_KEY_PATTERN, "key must
 */
 const tagsSchema = z.array(z.string().trim().min(1).max(50, "a tag must be at most 50 characters")).max(20, "a journey or template takes at most 20 tags").default([]).transform((tags) => [...new Set(tags)]);
 /**
+* A consent purpose key: camelCase, matching the fixed `emailMarketing` and
+* `dataProcessing`. Purposes are keys in the `consent` map a customer reads
+* on their own profile, which is why they are not the kebab-case of a
+* journey key.
+*/
+const CONSENT_PURPOSE_KEY_PATTERN = /^[a-z][a-zA-Z0-9]*$/;
+/**
+* One purpose key wherever a key is named rather than declared: a journey's
+* `purpose`, and the keys of the consent patch an identify carries. The set
+* a key is checked against is the org's declared rows, which no schema can
+* see, so validation here is the shape only; the deploy and the ingestion
+* write refuse a key the org has not declared.
+*/
+const consentPurposeKeySchema = z.string().max(50, "a purpose key must be at most 50 characters").regex(CONSENT_PURPOSE_KEY_PATTERN, "a consent purpose key must be camelCase (a letter first, then letters and digits)");
+/**
+* One purpose a project declares in `cow.json` (spec: Decisions). A declared
+* purpose is marketing-class and sits under the `emailMarketing` umbrella,
+* so `denied` is the only default it may carry: the purpose is absent on
+* every profile that already exists, and a granted default would answer for
+* all of them at once.
+*
+* The field stays required rather than disappearing, so every `cow.json` and
+* every stored manifest written before this still parses, and the column
+* behind it still holds `granted` for the seeded `dataProcessing` row: this
+* is a refusal at declaration time, not a narrower storage shape.
+*
+* The two fixed purposes cannot be declared. They are seeded for every org
+* and owned by no project, so a project redeclaring one would be renaming
+* the master switch every other project's journeys hang off.
+*/
+const declaredPurposeSchema = z.strictObject({
+	key: consentPurposeKeySchema.refine((key) => !CONSENT_PURPOSES.includes(key), `${CONSENT_PURPOSES.join(" and ")} are fixed purposes and cannot be declared`),
+	/** What the dashboard and the account modal render beside the switch. */
+	label: z.string().trim().min(1).max(50, "a purpose label must be at most 50 characters"),
+	/** What the purpose means for a profile whose map does not answer it. */
+	default: z.literal("denied", "a declared purpose's \"default\" must be \"denied\": nobody has answered it yet, and a granted default would opt every profile you already have into it")
+});
+/**
+* The purposes one project declares. Capped low the way tags are: a purpose
+* is a category a recipient reads on a preferences switch, not a taxonomy.
+* Absent means the project declares none, which is every project today.
+*/
+const purposesSchema = z.array(declaredPurposeSchema).max(20, "a project declares at most 20 consent purposes");
+/**
 * A matcher field: one pattern or a non-empty list of them, a list being a
 * disjunction. See `matchesPattern` in ../patterns for the dialect (`*`
 * only) and for why a pattern whose literal prefix is not `system.` never
@@ -162,14 +176,29 @@ const triggerSchema = z.union([z.strictObject({
 	event: patternSchema,
 	appId: patternSchema.optional()
 }), z.strictObject({ segment: z.string().min(1) })]);
+/**
+* A destination's name: the token a journey addresses it by, in a
+* `send.webhook` call or a journey's `senderIdentity`.
+*
+* Defined here rather than beside the destinations contract, and imported
+* from here by it, because a journey manifest names one and the guest layer
+* is bundled into every tenant module: importing it the other way round
+* would pull the Drizzle destinations table into all of them.
+*/
+const destinationNameSchema = z.string().trim().min(1, "name is required").max(100, "name must be at most 100 characters");
 /** A content address: `sha256:` plus the lowercase hex digest. */
 const digestSchema = z.string().regex(/^sha256:[0-9a-f]{64}$/, "digest must be sha256:<64 hex>");
-/** The names of the capability calls a journey may make. */
+/**
+* The names of the capability calls a journey may make. Grouped by verb and
+* then channel (`send.email`, not `email.send`), because the verb is the
+* thing a journey author is choosing between and the name should read the
+* way the code is written.
+*/
 const COMMAND_NAMES = [
 	"sleep",
 	"waitForEvent",
-	"email.send",
-	"webhook.send",
+	"send.email",
+	"send.webhook",
 	"traits.set",
 	"traits.unset",
 	"profile.get",
@@ -178,21 +207,58 @@ const COMMAND_NAMES = [
 	"restart"
 ];
 /**
-* One entry of the step spine `cow build` records by running `run` once
-* against a recording stub. Display only, never trusted: a journey's real
-* control flow is whatever its code does at runtime. `detail` names the
-* template, destination, event, or trait key when the call has one.
+* What a spine entry can be: every capability call, plus the control flow
+* `cow build` reads off the journey's source: an `if` (a condition, with
+* `steps` and `otherwise`), a `loop` (with `steps` as its body), and the `end`
+* of a path.
 */
+const SPINE_ENTRY_NAMES = [
+	...COMMAND_NAMES,
+	"if",
+	"loop",
+	"end"
+];
 const spineEntrySchema = z.object({
-	name: z.enum(COMMAND_NAMES),
-	detail: z.string().max(200).optional()
-});
+	name: z.enum(SPINE_ENTRY_NAMES),
+	detail: z.string().max(200).optional(),
+	/**
+	* The sender identity a `send.email` call named for itself, overriding
+	* the journey's own. Present only when the author wrote one on the call,
+	* which is what lets the deploy warning and the journey detail page name
+	* the override without re-reading the code.
+	*/
+	senderIdentity: z.string().max(100).optional(),
+	/** A `waitForEvent` timeout, as the author wrote it. */
+	timeout: z.string().max(50).optional(),
+	get steps() {
+		return z.array(spineEntrySchema).optional();
+	},
+	get otherwise() {
+		return z.array(spineEntrySchema).optional();
+	}
+}).meta({ id: "JourneySpineEntry" });
 const manifestJourneySchema = z.object({
 	key: journeyKeySchema,
 	/** The author's labels; the dashboard's only grouping. */
 	tags: tagsSchema,
 	trigger: triggerSchema,
-	purpose: z.enum(CONSENT_PURPOSES),
+	/**
+	* A fixed purpose or one the project declares. Checked against the org's
+	* declared set at deploy time, not here: a manifest is built and pushed
+	* without ever reaching the org whose rows say what exists.
+	*/
+	purpose: consentPurposeKeySchema,
+	/**
+	* The sender identity every `send.email` in this journey goes out as,
+	* unless the call names its own. A name, never a `dst_` id: an org has one
+	* row per environment, so an id would send in production and fail in
+	* development, which is the one thing a journey must not do.
+	*
+	* Optional here and required at `defineJourney`, exactly like `purposes`: a
+	* release pushed before the field existed carries none and its stored
+	* manifest still parses. The author's build is where the error is useful.
+	*/
+	senderIdentity: destinationNameSchema.optional(),
 	/** The author's rollout gate: the journey is active only in these. */
 	environments: environmentsSchema,
 	spine: z.array(spineEntrySchema),
@@ -224,18 +290,37 @@ function uniqueKeys(items, ctx, path) {
 		seen.add(item.key);
 	}
 }
-/** What `cow build` writes to `.cow/build/manifest.json` and `cow push` sends. */
+/**
+* What `cow build` writes to `.cow/build/manifest.json`, and the shape a
+* release row stores for good.
+*
+* `protocol` is any positive integer rather than the current constant on
+* purpose: a release is immutable and an execution stays pinned to the one it
+* started on, so the day the protocol is bumped every stored release must
+* still parse, or the runner, the deploy, and every API response the client
+* validates all break at once for any org with history. The literal lives at
+* push time only (`createReleaseBodySchema`), which is where a stale CLI is
+* the developer's own fixable problem, and deploy plus the runner refuse a
+* release built for another protocol with a message naming both numbers.
+*/
 const manifestSchema = z.object({
-	protocol: z.literal(1),
+	protocol: z.number().int().positive(),
 	/** The `@cowliss/cli` version the project was built with. */
 	sdk: z.string().min(1),
 	journeys: z.array(manifestJourneySchema).max(RELEASE_LIMITS.journeys),
 	templates: z.array(manifestTemplateSchema).max(RELEASE_LIMITS.templates),
+	/**
+	* The consent purposes this project declares, copied from `cow.json`.
+	* Optional rather than defaulted: a release pushed before purposes
+	* existed carries none, and its stored manifest still parses.
+	*/
+	purposes: purposesSchema.optional(),
 	/** Digest of the gzipped source tarball. */
 	source: digestSchema
 }).superRefine((manifest, ctx) => {
 	uniqueKeys(manifest.journeys, ctx, "journeys");
 	uniqueKeys(manifest.templates, ctx, "templates");
+	uniqueKeys(manifest.purposes ?? [], ctx, "purposes");
 });
 /**
 * The manifest as the release row stores it once compilation succeeded:
@@ -260,6 +345,49 @@ const compiledManifestSchema = manifestSchema.safeExtend({
 	plugin: digestSchema
 });
 
+//#endregion
+//#region ../../packages/shared/src/journeys-v2/config.ts
+/**
+* A project's name: what `cow init` asked for, and what the `projects` row
+* stores. Lives here rather than beside the release DTOs because `cow.json`
+* is the file a developer types it into; `createProjectBodySchema` reuses it.
+*/
+const projectNameSchema = z.string().trim().min(1).max(200);
+/**
+* `cow.json` (spec: Project layout): the org, and which of its projects this
+* directory is. The environment is always a flag, and auth never lives in
+* the project. Strict, so a typo'd key is a build error rather than a
+* silently ignored setting.
+*/
+const cowConfigSchema = z.strictObject({
+	$schema: z.url().optional(),
+	orgId: z.string().startsWith(CLERK_ORG_SUBJECT_PREFIX, "orgId must be a Clerk org id"),
+	/**
+	* Which project of the org this directory pushes to. One org can hold
+	* several, one per repo, each with its own release sequence and its own
+	* slice of the deployed journeys, so every project says which it is.
+	*/
+	project: projectNameSchema,
+	/**
+	* The consent purposes this project declares. They are org-wide, so two
+	* projects declaring one key must agree on its label and default or the
+	* deploy is refused; a deploy adds and updates them and never deletes
+	* one, because profiles hold answers against them.
+	*/
+	purposes: purposesSchema.optional(),
+	/** Overrides the API the CLI talks to; the hosted product needs none. */
+	apiUrl: z.url().optional(),
+	/**
+	* Overrides the dashboard `cow login` opens. Paired with `apiUrl`: a
+	* login against one Cowliss's dashboard yields a token the other's API
+	* rejects, so a config that names an API names its dashboard too.
+	*/
+	webUrl: z.url().optional()
+}).meta({
+	title: "cow.json",
+	description: "A cow project: the organization and the project it deploys to."
+});
+
 //#endregion
 //#region ../../packages/shared/src/journeys-v2/guest.ts
 /**
@@ -302,14 +430,21 @@ const commandSchema = z.discriminatedUnion("name", [
 		})
 	}),
 	z.object({
-		name: z.literal("email.send"),
+		name: z.literal("send.email"),
 		args: z.strictObject({
 			template: journeyKeySchema,
-			props: properties
+			props: properties,
+			/**
+			* Which sender identity this mail leaves as, by name. Required, and
+			* the guest SDK fills in the journey's own when the call does not name
+			* one, so the host has one resolution path and never has to read the
+			* manifest to find a sender.
+			*/
+			senderIdentity: destinationNameSchema
 		})
 	}),
 	z.object({
-		name: z.literal("webhook.send"),
+		name: z.literal("send.webhook"),
 		args: z.strictObject({
 			destination: z.string().min(1),
 			payload: properties
@@ -386,7 +521,7 @@ const executionLimitsSchema = z.object({
 	logLineBytes: z.number().int().positive()
 });
 const journeyStepInputSchema = z.object({
-	protocol: z.literal(1),
+	protocol: z.literal(2),
 	kind: z.literal("journey"),
 	key: journeyKeySchema,
 	event: guestEventSchema,
@@ -426,7 +561,7 @@ const journeyStepOutputSchema = z.discriminatedUnion("status", [
 	})
 ]);
 const templateRenderInputSchema = z.object({
-	protocol: z.literal(1),
+	protocol: z.literal(2),
 	kind: z.literal("template"),
 	key: journeyKeySchema,
 	props: properties
@@ -445,6 +580,7 @@ const manifestInputSchema = z.object({ kind: z.literal("manifest") });
 const manifestOutputSchema = z.discriminatedUnion("kind", [manifestJourneySchema.pick({
 	trigger: true,
 	purpose: true,
+	senderIdentity: true,
 	environments: true,
 	tags: true
 }).extend({ kind: z.literal("journey") }), manifestTemplateSchema.pick({
@@ -557,21 +693,24 @@ var CapabilityError = class extends Error {
 };
 /**
 * The config half of a journey, validated with the same schema the release
-* manifest is validated with, so a bad trigger or an unknown purpose fails
-* at build time rather than at the first execution.
+* manifest is validated with, so a bad trigger or a malformed purpose key
+* fails at build time rather than at the first execution. Whether the org
+* declares that purpose is a question only the deploy can answer.
 */
 const journeyConfigSchema = manifestJourneySchema.pick({
 	trigger: true,
 	purpose: true,
+	senderIdentity: true,
 	environments: true,
 	tags: true
-});
+}).extend({ senderIdentity: destinationNameSchema });
 /** Author a journey. Throws at definition time on an invalid config. */
 function defineJourney(input) {
 	return {
 		...journeyConfigSchema.parse({
 			trigger: input.trigger,
 			purpose: input.purpose,
+			senderIdentity: input.senderIdentity,
 			environments: input.environments ?? [...ENVIRONMENTS],
 			tags: input.tags
 		}),

package/dist/guest/journeys.d.ts

@@ -1,5 +1,5 @@
-import { n as Duration, r as GuestEvent, t as Trigger } from "./index-heC1gFE_.js";
-import { n as Environment, t as ConsentPurpose } from "./constants-OZrYz4I2.js";
+import { n as Duration, r as GuestEvent, t as Trigger } from "./index-DAGLEHDn.js";
+import { t as Environment } from "./constants-B0wk-87t.js";
 //#region src/guest/journeys.d.ts
 /** The event a journey runs for, or the one a `waitForEvent` resolved with. */
 type Event = GuestEvent;
@@ -13,12 +13,12 @@ type Profile = {
   id: string;
   traits: Record<string, unknown>;
   /** Consent state per purpose; the send gates read it host-side too. */
-  consent: Record<ConsentPurpose, boolean>;
+  consent: Record<string, boolean>;
   identifiers: Record<string, string>;
   /** Names of the segments the profile is currently in. */
   segments: string[];
 };
-/** What `api.email.send` resolves to once the host accepted the send. */
+/** What `api.send.email` resolves to once the host accepted the send. */
 type EmailSendResult = {
   deliveryId: string;
   status: string;
@@ -35,7 +35,7 @@ declare class CapabilityError extends Error {
 /**
  * The project's templates, keyed by template key. `cow build` writes the
  * real interface into `.cow/types.d.ts` and TypeScript merges it into this
- * one, which is what types `api.email.send`. Empty here on purpose: a
+ * one, which is what types `api.send.email`. Empty here on purpose: a
  * project that has not built yet still compiles, with string keys.
  */
 interface CowTemplates {}
@@ -60,14 +60,22 @@ type Api = {
   waitForEvent(pattern: string | string[], options: {
     timeout: Duration;
   }): Promise<Event | null>;
-  email: {
-    send<Key extends TemplateKey>(args: {
+  /**
+   * The two things a journey sends. Grouped by the verb rather than by the
+   * channel, because the verb is what an author is choosing between.
+   */
+  send: {
+    email<Key extends TemplateKey>(args: {
       template: Key;
       props: TemplateProps<Key>;
+      /**
+       * Send this one mail from a different sender identity than the
+       * journey's own. A name the organization has configured, resolved in
+       * the environment the execution is running in.
+       */
+      senderIdentity?: string;
     }): Promise<EmailSendResult>;
-  };
-  webhook: {
-    send(args: {
+    webhook(args: {
       destination: string;
       payload: Record<string, unknown>;
     }): Promise<void>;
@@ -108,7 +116,23 @@ type Api = {
  */
 type JourneyConfig = {
   trigger: Trigger;
-  purpose: ConsentPurpose;
+  /**
+   * A fixed purpose (`emailMarketing`, `dataProcessing`) or one this
+   * project declares in `cow.json`. The key's shape is checked here; that
+   * the org declares it is checked when the release is deployed.
+   */
+  purpose: string;
+  /**
+   * The sender identity every `api.send.email` in this journey goes out as:
+   * the name of one your organization has configured, or `cowliss-default`
+   * for the address Cowliss gives you with nothing to set up. A single send
+   * can override it.
+   *
+   * Required, and named here rather than in a settings page, so the address
+   * a journey sends from is readable in the journey's own source. It is
+   * resolved per environment, which is why it is a name and not an id.
+   */
+  senderIdentity: string;
   /** The author's rollout gate; defaults to every environment. */
   environments: Environment[];
   /** The author's labels; the dashboard's only grouping. Defaults to none. */

package/dist/guest/journeys.js

@@ -1,3 +1,3 @@
-import { n as defineJourney, t as CapabilityError } from "./journeys-CR_wIAtP.js";
+import { n as defineJourney, t as CapabilityError } from "./journeys-B_xg_GnL.js";
 
 export { CapabilityError, defineJourney };

package/dist/guest/wasi.js

@@ -1,4 +1,4 @@
-import { t as runGuest } from "./driver-D8cPyQgF.js";
+import { t as runGuest } from "./driver-DaNdNhuF.js";
 
 //#region src/guest/wasi.ts
 const STDIN = 0;