@cowliss/cli 0.3.0 → 0.4.0

package/dist/index.js

@@ -13,6 +13,7 @@ import { promisify } from "node:util";
 import { MessagePort } from "node:worker_threads";
 import { build, formatMessagesSync } from "esbuild";
 import { create, extract } from "tar";
+import { parse } from "@babel/parser";
 import { existsSync, readFileSync } from "node:fs";
 import { createServer } from "node:http";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
@@ -121,6 +122,29 @@ const TOPUP_PRESETS_MICROS = [
 */
 const CONSENT_PURPOSES = ["emailMarketing", "dataProcessing"];
 /**
+* The marketing purpose by name, since it is the one every gate, the
+* unsubscribe route, and the developer's own toggle all reach for.
+*/
+const EMAIL_MARKETING = "emailMarketing";
+/**
+* What a purpose means when the profile's map does not answer it, matching
+* the `profiles.consent` column default: marketing is asked for, everything
+* else about the data the developer already sends is granted.
+*/
+const CONSENT_PURPOSE_DEFAULTS = {
+	emailMarketing: false,
+	dataProcessing: true
+};
+/**
+* The `defaults` argument `consentGranted` takes, built from an org's
+* purpose rows. Every surface that renders or gates a purpose reads those
+* rows and then needs this same map, so the reshaping lives here rather
+* than in each of them.
+*/
+function consentDefaultsOf(rows) {
+	return Object.fromEntries(rows.map((row) => [row.key, row.defaultGranted]));
+}
+/**
 * The two classes of send, declared on the template rather than passed per
 * call so the class cannot drift between two sends of the same message.
 *
@@ -261,9 +285,9 @@ const searchQuerySchema = z.string().trim().max(200, "q must be at most 200 char
 * key belongs to and which routes it may reach, never anything a client
 * sends or reads. So /v1/settings/deploy-keys reuses these schemas.
 */
-const nameSchema$4 = z.string().trim().min(1, "name is required").max(100, "name must be at most 100 characters");
+const nameSchema$3 = z.string().trim().min(1, "name is required").max(100, "name must be at most 100 characters");
 /** Body for POST /v1/settings/api-keys. */
-const createApiKeyBodySchema = z.object({ data: z.object({ name: nameSchema$4 }) });
+const createApiKeyBodySchema = z.object({ data: z.object({ name: nameSchema$3 }) });
 /**
 * Query for GET /v1/settings/api-keys. Cursor-paginated like every list
 * endpoint; the cursor is an opaque offset cursor (Clerk pages by
@@ -3295,6 +3319,44 @@ const insertCatalogEventSchema = createInsertSchema(catalogEvents);
 const selectCatalogTraitSchema = createSelectSchema(catalogTraits);
 const insertCatalogTraitSchema = createInsertSchema(catalogTraits);
 
+//#endregion
+//#region ../../packages/db/src/schema/consent-purposes.ts
+/**
+* The consent purposes an org's profiles answer: the two fixed ones, seeded
+* the first time the set is read, plus whatever the org's projects declare
+* in their `cow.json`. One read here returns the whole set, so nothing
+* downstream unions a table with a constant.
+*
+* Org-wide rather than per-project or per-environment: `profiles.consent` is
+* one jsonb map per profile, so an answer given under one project is the
+* same answer under the next, and two projects declaring one key must agree
+* on its label and default or the deploy is refused.
+*
+* A deploy adds and updates rows and never deletes one (ADR 0009): profiles
+* already hold answers against a purpose, and deleting it would orphan them.
+*/
+const consentPurposes = pgTable("consent_purposes", {
+	orgId: text("org_id").notNull(),
+	/** camelCase, and a key in every profile's `consent` map. */
+	key: text("key").notNull(),
+	/** What the dashboard renders beside the switch. */
+	label: text("label").notNull(),
+	/**
+	* What the purpose means for a profile whose map does not answer it. A
+	* declared purpose is marketing-class and denied by default: it is
+	* absent on every profile that already exists.
+	*/
+	defaultGranted: boolean("default_granted").notNull(),
+	/**
+	* The project whose `cow.json` declared it, and the one a disagreeing
+	* deploy is refused in the name of. Null for the two fixed purposes,
+	* which every org has and no project owns.
+	*/
+	projectId: text("project_id"),
+	createdAt: createdAt(),
+	updatedAt: updatedAt()
+}, (table) => [primaryKey({ columns: [table.orgId, table.key] })]);
+
 //#endregion
 //#region ../../packages/db/src/schema/deliveries.ts
 /**
@@ -3338,6 +3400,7 @@ const deliveryStatusEnum = pgEnum("delivery_status", [
 	"skipped_quota",
 	"skipped_frequency_cap",
 	"skipped_consent",
+	"skipped_sender",
 	"skipped_domain",
 	"skipped_ssrf",
 	"would_send",
@@ -3347,6 +3410,7 @@ const deliveryStatusEnum = pgEnum("delivery_status", [
 	"would_skip_quota",
 	"would_skip_frequency_cap",
 	"would_skip_consent",
+	"would_skip_sender",
 	"would_skip_domain",
 	"would_skip_ssrf"
 ]);
@@ -3664,9 +3728,11 @@ const idempotencyKeys = pgTable("idempotency_keys", {
 * creating one when none is known.
 *
 * traits is the merged trait bag (RFC 7386 key-level merge on write).
-* consent is the fixed-purpose consent map from the spec ({ emailMarketing,
-* dataProcessing }, both default true); writes never touch it except the
-* consent editor and the automatic revocations.
+* consent is the fixed-purpose consent map from the spec. Marketing starts
+* denied and data processing granted: nobody is subscribed by the act of
+* being ingested, while the processing the product runs on is the basis the
+* profile exists under at all. It is written by the identify path (a caller
+* passing `consent`), the consent editor, and the automatic revocations.
 *
 * `environment` is the app's, stamped at creation and never changed: a
 * person in development and a person in production are two rows even when
@@ -3690,7 +3756,7 @@ const profiles = pgTable("profiles", {
 	sourceId: text("source_id").notNull(),
 	traits: jsonb("traits").$type().notNull().default({}),
 	consent: jsonb("consent").$type().notNull().default({
-		emailMarketing: true,
+		emailMarketing: false,
 		dataProcessing: true
 	}),
 	mergedInto: text("merged_into"),
@@ -3796,12 +3862,6 @@ const insertJourneyRunSchema = createInsertSchema(journeyRuns);
 //#endregion
 //#region ../../packages/db/src/schema/journeys.ts
 /**
-* The fixed consent purposes from the spec (fixed enum for the prototype).
-* The literal list mirrors CONSENT_PURPOSES in packages/shared; db cannot
-* import it without closing a package cycle (shared -> db).
-*/
-const consentPurposeEnum = pgEnum("consent_purpose", ["emailMarketing", "dataProcessing"]);
-/**
 * Derived journey rows: one per (org, environment, key), upserted from the
 * manifest inside the deploy transaction. Nothing here is authored through
 * the API, which is why there is no id of its own: the key is the name the
@@ -3835,7 +3895,14 @@ const journeys$1 = pgTable("journeys", {
 	/** The author's labels, from the manifest; the dashboard's only grouping. */
 	tags: text("tags").array().notNull().default(sql`'{}'::text[]`),
 	trigger: jsonb("trigger").$type().notNull(),
-	purpose: consentPurposeEnum("purpose").notNull(),
+	/**
+	* The consent purpose this journey's sends are gated on: one of the two
+	* fixed keys or one the project declares in `cow.json`. Text and not an
+	* enum, because the set is the org's `consent_purposes` rows, which a
+	* deploy checks the key against; a database enum could only ever hold
+	* the fixed pair.
+	*/
+	purpose: text("purpose").notNull(),
 	/** The manifest's `environments` contains this environment. */
 	active: boolean("active").notNull(),
 	spine: jsonb("spine").$type().notNull(),
@@ -3929,6 +3996,19 @@ const orgSettings = pgTable("org_settings", {
 		mode: "date",
 		precision: 3
 	}),
+	/**
+	* When this org's SES tenant was created and fully associated. Null means
+	* it has none yet, and a send goes out untenanted; set means the send names
+	* the tenant, so SES meters that org's reputation on its own and keeps its
+	* suppressed addresses off every other org's list. The tenant's name is the
+	* org id. Written last by ensureOrgTenant, never before the associations:
+	* a tenant SES cannot send for must not look ready here.
+	*/
+	sesTenantAt: timestamp("ses_tenant_at", {
+		withTimezone: true,
+		mode: "date",
+		precision: 3
+	}),
 	createdAt: createdAt(),
 	updatedAt: updatedAt()
 });
@@ -4466,14 +4546,14 @@ const appSchema = selectAppSchema.extend({
 	/** The most recent accepted delivery across those sources. */
 	lastReceivedAt: z.iso.datetime().nullable()
 });
-const nameSchema$3 = z.string().trim().min(1, "name is required").max(100, "name must be at most 100 characters");
+const nameSchema$2 = z.string().trim().min(1, "name is required").max(100, "name must be at most 100 characters");
 const createAppBodySchema = z.object({ data: z.object({
-	name: nameSchema$3,
+	name: nameSchema$2,
 	/** Immutable after creation; production when omitted. */
 	environment: environmentSchema.default("production")
 }) });
 const updateAppBodySchema = z.object({ data: z.object({
-	name: nameSchema$3.optional(),
+	name: nameSchema$2.optional(),
 	status: z.literal("archived").optional()
 }).refine((data) => data.name !== void 0 || data.status !== void 0, { message: "at least one field (name or status) is required" }) });
 /** `q` is a substring search over the app's name; `status` narrows to one state. */
@@ -4574,6 +4654,269 @@ const identifierDtoSchema = z.object({
 	createdAt: z.iso.datetime()
 });
 
+//#endregion
+//#region ../../packages/shared/src/journeys-v2/manifest.ts
+/**
+* The release manifest (spec: Build; Push and compile): what `cow build`
+* extracts from a project and `cow push` uploads with the bundles. The
+* server validates it with these schemas, compiles every bundle, and stores
+* the compiled form on the release row.
+*/
+/**
+* A journey or template key: the file basename under `journeys/` or
+* `emails/`, kebab-case and unique across the project. Becomes part of the
+* Temporal workflow id and travels in the journey chain, so it stays short.
+*/
+const JOURNEY_KEY_PATTERN = /^[a-z0-9]+(-[a-z0-9]+)*$/;
+const journeyKeySchema = z.string().max(64).regex(JOURNEY_KEY_PATTERN, "key must be kebab-case (a-z, 0-9, hyphens)");
+/**
+* An author's labels on a journey or a template: how the dashboard groups
+* and filters them, and the only grouping there is. Case is kept as
+* written, each entry is trimmed and non-empty, the list is deduplicated,
+* and both ceilings are low on purpose: tags are a handful of words, not a
+* taxonomy. Absent means `[]`.
+*
+* The count is capped on the list as written, before the deduplication, so
+* a 21st entry is an error even when it is a repeat: that keeps `maxItems`
+* in the generated JSON Schema, and an author who wrote 21 tags wants to
+* hear about it.
+*/
+const tagsSchema = z.array(z.string().trim().min(1).max(50, "a tag must be at most 50 characters")).max(20, "a journey or template takes at most 20 tags").default([]).transform((tags) => [...new Set(tags)]);
+/**
+* A consent purpose key: camelCase, matching the fixed `emailMarketing` and
+* `dataProcessing`. Purposes are keys in the `consent` map a customer reads
+* on their own profile, which is why they are not the kebab-case of a
+* journey key.
+*/
+const CONSENT_PURPOSE_KEY_PATTERN = /^[a-z][a-zA-Z0-9]*$/;
+/**
+* One purpose key wherever a key is named rather than declared: a journey's
+* `purpose`, and the keys of the consent patch an identify carries. The set
+* a key is checked against is the org's declared rows, which no schema can
+* see, so validation here is the shape only; the deploy and the ingestion
+* write refuse a key the org has not declared.
+*/
+const consentPurposeKeySchema = z.string().max(50, "a purpose key must be at most 50 characters").regex(CONSENT_PURPOSE_KEY_PATTERN, "a consent purpose key must be camelCase (a letter first, then letters and digits)");
+/**
+* One purpose a project declares in `cow.json` (spec: Decisions). A declared
+* purpose is marketing-class and sits under the `emailMarketing` umbrella,
+* so `denied` is the only default it may carry: the purpose is absent on
+* every profile that already exists, and a granted default would answer for
+* all of them at once.
+*
+* The field stays required rather than disappearing, so every `cow.json` and
+* every stored manifest written before this still parses, and the column
+* behind it still holds `granted` for the seeded `dataProcessing` row: this
+* is a refusal at declaration time, not a narrower storage shape.
+*
+* The two fixed purposes cannot be declared. They are seeded for every org
+* and owned by no project, so a project redeclaring one would be renaming
+* the master switch every other project's journeys hang off.
+*/
+const declaredPurposeSchema = z.strictObject({
+	key: consentPurposeKeySchema.refine((key) => !CONSENT_PURPOSES.includes(key), `${CONSENT_PURPOSES.join(" and ")} are fixed purposes and cannot be declared`),
+	/** What the dashboard and the account modal render beside the switch. */
+	label: z.string().trim().min(1).max(50, "a purpose label must be at most 50 characters"),
+	/** What the purpose means for a profile whose map does not answer it. */
+	default: z.literal("denied", "a declared purpose's \"default\" must be \"denied\": nobody has answered it yet, and a granted default would opt every profile you already have into it")
+});
+/**
+* The purposes one project declares. Capped low the way tags are: a purpose
+* is a category a recipient reads on a preferences switch, not a taxonomy.
+* Absent means the project declares none, which is every project today.
+*/
+const purposesSchema = z.array(declaredPurposeSchema).max(20, "a project declares at most 20 consent purposes");
+/**
+* A matcher field: one pattern or a non-empty list of them, a list being a
+* disjunction. See `matchesPattern` in ../patterns for the dialect (`*`
+* only) and for why a pattern whose literal prefix is not `system.` never
+* reaches a system event.
+*/
+const onePatternSchema = z.string().min(1).max(200, "a pattern must be at most 200 characters");
+const patternSchema = z.union([onePatternSchema, z.array(onePatternSchema).min(1).max(20, "a matcher takes at most 20 patterns")]);
+/**
+* What starts a journey: an event (optionally narrowed to an app id or a
+* list of them) or a segment entry. The registry DTO in `../journeys`
+* reuses it.
+*
+* Both members are strict, so a journey holding the retired `source` key
+* fails to compile a release instead of silently triggering on every app.
+* There is deliberately no pipe filter: a trigger narrows by the app the
+* write is attributed to, the same token a segment definition names.
+*/
+const triggerSchema = z.union([z.strictObject({
+	event: patternSchema,
+	appId: patternSchema.optional()
+}), z.strictObject({ segment: z.string().min(1) })]);
+/**
+* A destination's name: the token a journey addresses it by, in a
+* `send.webhook` call or a journey's `senderIdentity`.
+*
+* Defined here rather than beside the destinations contract, and imported
+* from here by it, because a journey manifest names one and the guest layer
+* is bundled into every tenant module: importing it the other way round
+* would pull the Drizzle destinations table into all of them.
+*/
+const destinationNameSchema = z.string().trim().min(1, "name is required").max(100, "name must be at most 100 characters");
+/** A content address: `sha256:` plus the lowercase hex digest. */
+const digestSchema = z.string().regex(/^sha256:[0-9a-f]{64}$/, "digest must be sha256:<64 hex>");
+/**
+* The names of the capability calls a journey may make. Grouped by verb and
+* then channel (`send.email`, not `email.send`), because the verb is the
+* thing a journey author is choosing between and the name should read the
+* way the code is written.
+*/
+const COMMAND_NAMES = [
+	"sleep",
+	"waitForEvent",
+	"send.email",
+	"send.webhook",
+	"traits.set",
+	"traits.unset",
+	"profile.get",
+	"profiles.get",
+	"events.track",
+	"restart"
+];
+/**
+* What a spine entry can be: every capability call, plus the control flow
+* `cow build` reads off the journey's source: an `if` (a condition, with
+* `steps` and `otherwise`), a `loop` (with `steps` as its body), and the `end`
+* of a path.
+*/
+const SPINE_ENTRY_NAMES = [
+	...COMMAND_NAMES,
+	"if",
+	"loop",
+	"end"
+];
+const spineEntrySchema = z.object({
+	name: z.enum(SPINE_ENTRY_NAMES),
+	detail: z.string().max(200).optional(),
+	/**
+	* The sender identity a `send.email` call named for itself, overriding
+	* the journey's own. Present only when the author wrote one on the call,
+	* which is what lets the deploy warning and the journey detail page name
+	* the override without re-reading the code.
+	*/
+	senderIdentity: z.string().max(100).optional(),
+	/** A `waitForEvent` timeout, as the author wrote it. */
+	timeout: z.string().max(50).optional(),
+	get steps() {
+		return z.array(spineEntrySchema).optional();
+	},
+	get otherwise() {
+		return z.array(spineEntrySchema).optional();
+	}
+}).meta({ id: "JourneySpineEntry" });
+const manifestJourneySchema = z.object({
+	key: journeyKeySchema,
+	/** The author's labels; the dashboard's only grouping. */
+	tags: tagsSchema,
+	trigger: triggerSchema,
+	/**
+	* A fixed purpose or one the project declares. Checked against the org's
+	* declared set at deploy time, not here: a manifest is built and pushed
+	* without ever reaching the org whose rows say what exists.
+	*/
+	purpose: consentPurposeKeySchema,
+	/**
+	* The sender identity every `send.email` in this journey goes out as,
+	* unless the call names its own. A name, never a `dst_` id: an org has one
+	* row per environment, so an id would send in production and fail in
+	* development, which is the one thing a journey must not do.
+	*
+	* Optional here and required at `defineJourney`, exactly like `purposes`: a
+	* release pushed before the field existed carries none and its stored
+	* manifest still parses. The author's build is where the error is useful.
+	*/
+	senderIdentity: destinationNameSchema.optional(),
+	/** The author's rollout gate: the journey is active only in these. */
+	environments: environmentsSchema,
+	spine: z.array(spineEntrySchema),
+	bundle: digestSchema
+});
+const manifestTemplateSchema = z.object({
+	key: journeyKeySchema,
+	/** The author's labels; the dashboard's only grouping. */
+	tags: tagsSchema,
+	sendClass: z.enum(SEND_CLASSES),
+	/** True asks the host to mint a signed `verifyUrl` prop at send time. */
+	verifyLink: z.boolean(),
+	/** JSON Schema of the template's `props`, converted by `cow build`. */
+	propsSchema: z.record(z.string(), z.unknown()),
+	bundle: digestSchema
+});
+function uniqueKeys(items, ctx, path) {
+	const seen = /* @__PURE__ */ new Set();
+	for (const [index, item] of items.entries()) {
+		if (seen.has(item.key)) ctx.addIssue({
+			code: "custom",
+			message: `duplicate ${path} key "${item.key}"`,
+			path: [
+				path,
+				index,
+				"key"
+			]
+		});
+		seen.add(item.key);
+	}
+}
+/**
+* What `cow build` writes to `.cow/build/manifest.json`, and the shape a
+* release row stores for good.
+*
+* `protocol` is any positive integer rather than the current constant on
+* purpose: a release is immutable and an execution stays pinned to the one it
+* started on, so the day the protocol is bumped every stored release must
+* still parse, or the runner, the deploy, and every API response the client
+* validates all break at once for any org with history. The literal lives at
+* push time only (`createReleaseBodySchema`), which is where a stale CLI is
+* the developer's own fixable problem, and deploy plus the runner refuse a
+* release built for another protocol with a message naming both numbers.
+*/
+const manifestSchema = z.object({
+	protocol: z.number().int().positive(),
+	/** The `@cowliss/cli` version the project was built with. */
+	sdk: z.string().min(1),
+	journeys: z.array(manifestJourneySchema).max(RELEASE_LIMITS.journeys),
+	templates: z.array(manifestTemplateSchema).max(RELEASE_LIMITS.templates),
+	/**
+	* The consent purposes this project declares, copied from `cow.json`.
+	* Optional rather than defaulted: a release pushed before purposes
+	* existed carries none, and its stored manifest still parses.
+	*/
+	purposes: purposesSchema.optional(),
+	/** Digest of the gzipped source tarball. */
+	source: digestSchema
+}).superRefine((manifest, ctx) => {
+	uniqueKeys(manifest.journeys, ctx, "journeys");
+	uniqueKeys(manifest.templates, ctx, "templates");
+	uniqueKeys(manifest.purposes ?? [], ctx, "purposes");
+});
+/**
+* The manifest as the release row stores it once compilation succeeded:
+* the pushed manifest plus the compiled module digest per key, and the
+* digest of the Javy engine plugin the toolchain that compiled them was
+* built from.
+*
+* Journeys and templates are keyed separately because they share a key
+* space: `welcome.ts` and `welcome.tsx` are one journey and the email it
+* sends in every example, and a flat map would let one overwrite the other.
+*
+* `plugin` is a toolchain record, not a linked artifact: modules are
+* statically linked, so the plugin bytes are inside each module. It says
+* which engine compiled the release, which is what a later bug report or a
+* reproducible rebuild needs.
+*/
+const compiledManifestSchema = manifestSchema.safeExtend({
+	modules: z.object({
+		journeys: z.record(journeyKeySchema, digestSchema),
+		templates: z.record(journeyKeySchema, digestSchema)
+	}),
+	plugin: digestSchema
+});
+
 //#endregion
 //#region ../../packages/shared/src/timestamp.ts
 /**
@@ -4615,6 +4958,21 @@ const traitBagSchema = z.custom((value) => value !== null && typeof value === "o
 	additionalProperties: true
 });
 /**
+* A partial map over the org's consent purposes, applied as an RFC 7386
+* merge patch, so omitting a purpose leaves it as it was. At least one
+* purpose is required: an empty patch is a no-op request, not a valid one.
+*
+* The key schema is the shape only, because purposes are declared per org
+* and no schema can see which. It is still a trust boundary: a key that is
+* not a purpose key never reaches the jsonb map, and the ingestion write
+* refuses the ones this org has not declared.
+*
+* It lives here rather than beside the dashboard's consent editor because
+* `identify` carries it too: the grant has to have a route in through
+* ingestion, or the only thing anyone can express is the revocation.
+*/
+const consentPatchSchema = z.partialRecord(consentPurposeKeySchema.meta({ examples: [EMAIL_MARKETING] }), z.boolean()).refine((data) => Object.keys(data).length > 0, { message: "at least one consent purpose is required" });
+/**
 * The identify payload fields, shared between the single-call body schema
 * and the batch item schema (which drops `sourceId`: a batch names one
 * source for every item) so both wire shapes stay in sync.
@@ -4626,6 +4984,7 @@ const identifyFieldsSchema = z.object({
 	sourceId: z.string().min(1, "sourceId is required"),
 	identifiers: identifiersSchema,
 	traits: traitBagSchema.default({}),
+	consent: consentPatchSchema.optional(),
 	timestamp: z.iso.datetime().optional(),
 	messageId: z.string().optional()
 });
@@ -4945,7 +5304,7 @@ function propertyTypeLabel(type) {
 * in its trigger unless it is handed one.
 */
 const PROPERTY_TYPE_LABELS = Object.fromEntries(PROPERTY_TYPES.map((type) => [type, propertyTypeLabel(type)]));
-const nameSchema$2 = z.string().trim().min(1, "name is required").max(200, "name must be at most 200 characters");
+const nameSchema$1 = z.string().trim().min(1, "name is required").max(200, "name must be at most 200 characters");
 const propertiesSchema = z.record(z.string().min(1).max(200), propertyTypeSchema);
 const catalogEventSchema = selectCatalogEventSchema.extend({
 	properties: propertiesSchema,
@@ -4953,7 +5312,7 @@ const catalogEventSchema = selectCatalogEventSchema.extend({
 	updatedAt: z.iso.datetime()
 });
 const createCatalogEventBodySchema = z.object({ data: z.object({
-	name: nameSchema$2,
+	name: nameSchema$1,
 	properties: propertiesSchema.default({})
 }) });
 /**
@@ -4968,7 +5327,7 @@ const catalogTraitSchema = selectCatalogTraitSchema.extend({
 	updatedAt: z.iso.datetime()
 });
 const createCatalogTraitBodySchema = z.object({ data: z.object({
-	name: nameSchema$2,
+	name: nameSchema$1,
 	type: propertyTypeSchema
 }) });
 /**
@@ -5022,6 +5381,28 @@ const quarantineActionBodySchema = z.object({ data: z.object({
 	name: z.string().min(1)
 }) });
 
+//#endregion
+//#region ../../packages/shared/src/consent.ts
+/**
+* One consent purpose as an org holds it. Every surface that renders a
+* purpose reads these rows rather than a constant: a purpose a project
+* declared in `cow.json` exists only as a row, so a label kept anywhere else
+* would answer nothing for it.
+*/
+const consentPurposeSchema = z.object({
+	key: consentPurposeKeySchema,
+	/** What a switch is labelled with, from the project that declared it. */
+	label: z.string(),
+	/** What the purpose means for a profile whose map does not answer it. */
+	defaultGranted: z.boolean()
+});
+/**
+* Query for GET /v1/consent-purposes. Cursor-paginated like every list
+* endpoint, even though an org holds a handful: the page shape is the
+* convention, not an estimate of how many rows there are.
+*/
+const listConsentPurposesQuerySchema = paginationQuerySchema;
+
 //#endregion
 //#region ../../packages/shared/src/delivery.ts
 /**
@@ -5197,8 +5578,9 @@ const destinationSchema = selectDestinationSchema.extend({
 	signingSecret: true,
 	consecutiveFailures: true
 });
+/** The two kinds of destination, from the table's own enum. */
+const destinationTypeSchema = destinationSchema.shape.type;
 const destinationCreatedSchema = destinationSchema.extend({ signingSecret: z.string().optional() });
-const nameSchema$1 = z.string().trim().min(1, "name is required").max(100, "name must be at most 100 characters");
 const webhookConfigSchema = z.object({ url: z.url("config.url must be a valid URL").refine((url) => {
 	try {
 		return ["http:", "https:"].includes(new URL(url).protocol);
@@ -5223,14 +5605,14 @@ const senderIdentityConfigSchema = z.object({
 * what gives react-hook-form a non-union field path to register.
 */
 const webhookDestinationInputSchema = z.object({
-	name: nameSchema$1,
+	name: destinationNameSchema,
 	/** The environment this destination lives in; immutable after creation. */
 	environment: environmentSchema,
 	type: z.literal("webhook"),
 	config: webhookConfigSchema
 });
 const senderIdentityDestinationInputSchema = z.object({
-	name: nameSchema$1,
+	name: destinationNameSchema,
 	/** The environment this destination lives in; immutable after creation. */
 	environment: environmentSchema,
 	type: z.literal("sender_identity"),
@@ -5247,12 +5629,19 @@ const createDestinationBodySchema = z.object({ data: z.discriminatedUnion("type"
 * `enabled: false` is the same switch operated by hand.
 */
 const updateDestinationBodySchema = z.object({ data: z.object({
-	name: nameSchema$1.optional(),
+	name: destinationNameSchema.optional(),
 	config: z.unknown().optional(),
 	enabled: z.boolean().optional()
 }).refine((data) => data.name !== void 0 || data.config !== void 0 || data.enabled !== void 0, { message: "at least one field (name, config, or enabled) is required" }) });
-/** `q` is a substring search over the destination's name. */
-const listDestinationsQuerySchema = paginationQuerySchema.extend({ q: searchQuerySchema });
+/**
+* `q` is a substring search over the destination's name; `type` narrows to
+* one kind, because the webhooks page and the sender identities section on
+* the domains page each want one and the table holds both.
+*/
+const listDestinationsQuerySchema = paginationQuerySchema.extend({
+	q: searchQuerySchema,
+	type: destinationTypeSchema.optional()
+});
 
 //#endregion
 //#region ../../packages/shared/src/domains.ts
@@ -5397,176 +5786,28 @@ function patternPlaceholder(pattern) {
 }
 
 //#endregion
-//#region ../../packages/shared/src/journeys-v2/manifest.ts
+//#region ../../packages/shared/src/journeys-v2/guest.ts
 /**
-* The release manifest (spec: Build; Push and compile): what `cow build`
-* extracts from a project and `cow push` uploads with the bundles. The
-* server validates it with these schemas, compiles every bundle, and stores
-* the compiled form on the release row.
+* The guest protocol (spec: Guest protocol): the JSON a compiled module
+* reads on stdin and writes on stdout. The sandbox worker parses every byte
+* a guest returns with these schemas before anything acts on it; the guest
+* SDK and the Node simulator produce and consume the same shapes.
 */
+/** A duration as journey code writes it: an ms-style string ("2d") or milliseconds. */
+const durationSchema = z.union([z.string().min(1), z.number().int().nonnegative()]);
+const DURATION_PATTERN = /^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d|w)$/;
+const DURATION_UNIT_MS = {
+	ms: 1,
+	s: 1e3,
+	m: 6e4,
+	h: 36e5,
+	d: 864e5,
+	w: 6048e5
+};
 /**
-* A journey or template key: the file basename under `journeys/` or
-* `emails/`, kebab-case and unique across the project. Becomes part of the
-* Temporal workflow id and travels in the journey chain, so it stays short.
-*/
-const JOURNEY_KEY_PATTERN = /^[a-z0-9]+(-[a-z0-9]+)*$/;
-const journeyKeySchema = z.string().max(64).regex(JOURNEY_KEY_PATTERN, "key must be kebab-case (a-z, 0-9, hyphens)");
-/**
-* An author's labels on a journey or a template: how the dashboard groups
-* and filters them, and the only grouping there is. Case is kept as
-* written, each entry is trimmed and non-empty, the list is deduplicated,
-* and both ceilings are low on purpose: tags are a handful of words, not a
-* taxonomy. Absent means `[]`.
-*
-* The count is capped on the list as written, before the deduplication, so
-* a 21st entry is an error even when it is a repeat: that keeps `maxItems`
-* in the generated JSON Schema, and an author who wrote 21 tags wants to
-* hear about it.
-*/
-const tagsSchema = z.array(z.string().trim().min(1).max(50, "a tag must be at most 50 characters")).max(20, "a journey or template takes at most 20 tags").default([]).transform((tags) => [...new Set(tags)]);
-/**
-* A matcher field: one pattern or a non-empty list of them, a list being a
-* disjunction. See `matchesPattern` in ../patterns for the dialect (`*`
-* only) and for why a pattern whose literal prefix is not `system.` never
-* reaches a system event.
-*/
-const onePatternSchema = z.string().min(1).max(200, "a pattern must be at most 200 characters");
-const patternSchema = z.union([onePatternSchema, z.array(onePatternSchema).min(1).max(20, "a matcher takes at most 20 patterns")]);
-/**
-* What starts a journey: an event (optionally narrowed to an app id or a
-* list of them) or a segment entry. The registry DTO in `../journeys`
-* reuses it.
-*
-* Both members are strict, so a journey holding the retired `source` key
-* fails to compile a release instead of silently triggering on every app.
-* There is deliberately no pipe filter: a trigger narrows by the app the
-* write is attributed to, the same token a segment definition names.
-*/
-const triggerSchema = z.union([z.strictObject({
-	event: patternSchema,
-	appId: patternSchema.optional()
-}), z.strictObject({ segment: z.string().min(1) })]);
-/** A content address: `sha256:` plus the lowercase hex digest. */
-const digestSchema = z.string().regex(/^sha256:[0-9a-f]{64}$/, "digest must be sha256:<64 hex>");
-/** The names of the capability calls a journey may make. */
-const COMMAND_NAMES = [
-	"sleep",
-	"waitForEvent",
-	"email.send",
-	"webhook.send",
-	"traits.set",
-	"traits.unset",
-	"profile.get",
-	"profiles.get",
-	"events.track",
-	"restart"
-];
-/**
-* One entry of the step spine `cow build` records by running `run` once
-* against a recording stub. Display only, never trusted: a journey's real
-* control flow is whatever its code does at runtime. `detail` names the
-* template, destination, event, or trait key when the call has one.
-*/
-const spineEntrySchema = z.object({
-	name: z.enum(COMMAND_NAMES),
-	detail: z.string().max(200).optional()
-});
-const manifestJourneySchema = z.object({
-	key: journeyKeySchema,
-	/** The author's labels; the dashboard's only grouping. */
-	tags: tagsSchema,
-	trigger: triggerSchema,
-	purpose: z.enum(CONSENT_PURPOSES),
-	/** The author's rollout gate: the journey is active only in these. */
-	environments: environmentsSchema,
-	spine: z.array(spineEntrySchema),
-	bundle: digestSchema
-});
-const manifestTemplateSchema = z.object({
-	key: journeyKeySchema,
-	/** The author's labels; the dashboard's only grouping. */
-	tags: tagsSchema,
-	sendClass: z.enum(SEND_CLASSES),
-	/** True asks the host to mint a signed `verifyUrl` prop at send time. */
-	verifyLink: z.boolean(),
-	/** JSON Schema of the template's `props`, converted by `cow build`. */
-	propsSchema: z.record(z.string(), z.unknown()),
-	bundle: digestSchema
-});
-function uniqueKeys(items, ctx, path) {
-	const seen = /* @__PURE__ */ new Set();
-	for (const [index, item] of items.entries()) {
-		if (seen.has(item.key)) ctx.addIssue({
-			code: "custom",
-			message: `duplicate ${path} key "${item.key}"`,
-			path: [
-				path,
-				index,
-				"key"
-			]
-		});
-		seen.add(item.key);
-	}
-}
-/** What `cow build` writes to `.cow/build/manifest.json` and `cow push` sends. */
-const manifestSchema = z.object({
-	protocol: z.literal(1),
-	/** The `@cowliss/cli` version the project was built with. */
-	sdk: z.string().min(1),
-	journeys: z.array(manifestJourneySchema).max(RELEASE_LIMITS.journeys),
-	templates: z.array(manifestTemplateSchema).max(RELEASE_LIMITS.templates),
-	/** Digest of the gzipped source tarball. */
-	source: digestSchema
-}).superRefine((manifest, ctx) => {
-	uniqueKeys(manifest.journeys, ctx, "journeys");
-	uniqueKeys(manifest.templates, ctx, "templates");
-});
-/**
-* The manifest as the release row stores it once compilation succeeded:
-* the pushed manifest plus the compiled module digest per key, and the
-* digest of the Javy engine plugin the toolchain that compiled them was
-* built from.
-*
-* Journeys and templates are keyed separately because they share a key
-* space: `welcome.ts` and `welcome.tsx` are one journey and the email it
-* sends in every example, and a flat map would let one overwrite the other.
-*
-* `plugin` is a toolchain record, not a linked artifact: modules are
-* statically linked, so the plugin bytes are inside each module. It says
-* which engine compiled the release, which is what a later bug report or a
-* reproducible rebuild needs.
-*/
-const compiledManifestSchema = manifestSchema.safeExtend({
-	modules: z.object({
-		journeys: z.record(journeyKeySchema, digestSchema),
-		templates: z.record(journeyKeySchema, digestSchema)
-	}),
-	plugin: digestSchema
-});
-
-//#endregion
-//#region ../../packages/shared/src/journeys-v2/guest.ts
-/**
-* The guest protocol (spec: Guest protocol): the JSON a compiled module
-* reads on stdin and writes on stdout. The sandbox worker parses every byte
-* a guest returns with these schemas before anything acts on it; the guest
-* SDK and the Node simulator produce and consume the same shapes.
-*/
-/** A duration as journey code writes it: an ms-style string ("2d") or milliseconds. */
-const durationSchema = z.union([z.string().min(1), z.number().int().nonnegative()]);
-const DURATION_PATTERN = /^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d|w)$/;
-const DURATION_UNIT_MS = {
-	ms: 1,
-	s: 1e3,
-	m: 6e4,
-	h: 36e5,
-	d: 864e5,
-	w: 6048e5
-};
-/**
-* A duration in milliseconds. The simulator's virtual clock and the runner's
-* timers both need it, and neither may pull in Temporal's `msToNumber` (one
-* runs in the CLI, the other inside workflow code).
+* A duration in milliseconds. The simulator's virtual clock and the runner's
+* timers both need it, and neither may pull in Temporal's `msToNumber` (one
+* runs in the CLI, the other inside workflow code).
 */
 function parseDuration(duration) {
 	if (typeof duration === "number") return duration;
@@ -5607,14 +5848,21 @@ const commandSchema = z.discriminatedUnion("name", [
 		})
 	}),
 	z.object({
-		name: z.literal("email.send"),
+		name: z.literal("send.email"),
 		args: z.strictObject({
 			template: journeyKeySchema,
-			props: properties
+			props: properties,
+			/**
+			* Which sender identity this mail leaves as, by name. Required, and
+			* the guest SDK fills in the journey's own when the call does not name
+			* one, so the host has one resolution path and never has to read the
+			* manifest to find a sender.
+			*/
+			senderIdentity: destinationNameSchema
 		})
 	}),
 	z.object({
-		name: z.literal("webhook.send"),
+		name: z.literal("send.webhook"),
 		args: z.strictObject({
 			destination: z.string().min(1),
 			payload: properties
@@ -5691,7 +5939,7 @@ const executionLimitsSchema = z.object({
 	logLineBytes: z.number().int().positive()
 });
 const journeyStepInputSchema = z.object({
-	protocol: z.literal(1),
+	protocol: z.literal(2),
 	kind: z.literal("journey"),
 	key: journeyKeySchema,
 	event: guestEventSchema,
@@ -5731,7 +5979,7 @@ const journeyStepOutputSchema = z.discriminatedUnion("status", [
 	})
 ]);
 const templateRenderInputSchema = z.object({
-	protocol: z.literal(1),
+	protocol: z.literal(2),
 	kind: z.literal("template"),
 	key: journeyKeySchema,
 	props: properties
@@ -5750,6 +5998,7 @@ const manifestInputSchema = z.object({ kind: z.literal("manifest") });
 const manifestOutputSchema = z.discriminatedUnion("kind", [manifestJourneySchema.pick({
 	trigger: true,
 	purpose: true,
+	senderIdentity: true,
 	environments: true,
 	tags: true
 }).extend({ kind: z.literal("journey") }), manifestTemplateSchema.pick({
@@ -5845,14 +6094,14 @@ const listExecutionsQuerySchema = paginationQuerySchema.extend({
 */
 const journeyTriggerSchema = triggerSchema;
 /**
-* The step spine `cow build` recorded by running the journey once against a
-* recording stub. Display only, never trusted: a journey's real control flow
-* is whatever its code does at run time.
+* The step spine `cow build` read from the journey's source: its calls,
+* conditions, and loops. Display only, never trusted: a journey's real
+* control flow is whatever its code does at run time.
 */
 const journeySpineEntrySchema = spineEntrySchema;
 const journeySchema = selectJourneySchema.extend({
 	trigger: journeyTriggerSchema,
-	purpose: z.enum(CONSENT_PURPOSES),
+	purpose: consentPurposeKeySchema,
 	spine: z.array(journeySpineEntrySchema),
 	enabled: z.boolean(),
 	createdAt: z.iso.datetime(),
@@ -5952,6 +6201,13 @@ const cowConfigSchema = z.strictObject({
 	* slice of the deployed journeys, so every project says which it is.
 	*/
 	project: projectNameSchema,
+	/**
+	* The consent purposes this project declares. They are org-wide, so two
+	* projects declaring one key must agree on its label and default or the
+	* deploy is refused; a deploy adds and updates them and never deletes
+	* one, because profiles hold answers against them.
+	*/
+	purposes: purposesSchema.optional(),
 	/** Overrides the API the CLI talks to; the hosted product needs none. */
 	apiUrl: z.url().optional(),
 	/**
@@ -6032,6 +6288,38 @@ const journeyScenarioSchema = z.object({
 	}))
 });
 
+//#endregion
+//#region ../../packages/shared/src/me.ts
+/**
+* The signed-in developer's own record (/v1/me), as opposed to the profiles
+* their org holds. Cowliss's developers are profiles in the platform
+* workspace, so this is the one place a person answers for themselves rather
+* than an operator answering for someone else, and it is why the routes are
+* not org-scoped: the caller's own org has nothing to do with mail Cowliss
+* sends them.
+*/
+/**
+* One thing Cowliss may send, as this developer has answered it: a purpose
+* the platform workspace declares, plus their own answer to it.
+*/
+const notificationPurposeSchema = consentPurposeSchema.extend({ 
+/** Their answer, or the purpose's default where they have not given one. */
+granted: z.boolean() });
+/**
+* What Cowliss may send this developer beyond the operational mail every
+* account gets: the marketing purposes the platform workspace declares, each
+* with the label it declared and this developer's answer. A list rather than
+* a fixed flag, because Cowliss declares its purposes in a `cow.json` like
+* any other project and may add one without touching this route.
+*/
+const notificationPreferencesSchema = z.object({ purposes: z.array(notificationPurposeSchema) });
+/**
+* Changing them: a merge patch over the purposes above, so a request names
+* only what was just answered and leaves the rest alone. The same patch
+* shape `identify` takes, because that is where the write actually goes.
+*/
+const updateNotificationPreferencesBodySchema = z.object({ data: z.object({ purposes: consentPatchSchema }) });
+
 //#endregion
 //#region ../../packages/shared/src/releases.ts
 /**
@@ -6087,7 +6375,13 @@ const releaseSchema = selectReleaseSchema.extend({
 	compiledAt: z.iso.datetime().nullable()
 });
 const createReleaseBodySchema = z.object({ data: z.object({
-	manifest: manifestSchema,
+	/**
+	* The one place the protocol is pinned to the constant. The stored shape
+	* takes any positive integer, because a release outlives a bump; a push
+	* is a live CLI talking to a live platform, so a mismatch here is a 422
+	* the developer fixes by updating `@cowliss/cli`, and nothing is stored.
+	*/
+	manifest: manifestSchema.safeExtend({ protocol: z.literal(2) }),
 	/** The `cow.json` project this push belongs to. */
 	project: projectNameSchema
 }) });
@@ -6573,13 +6867,6 @@ const findUserQuerySchema = z.object({ identifier: z.string().trim().min(3, "ide
 * endpoint answers with: a merged-away id redirects to its survivor.
 */
 const userDetailSchema = profileDtoSchema.extend({ mergedIds: z.array(z.string()) });
-/**
-* Consent editor body (PATCH /v1/users/:profileId/consent): a partial map
-* over the fixed purposes, applied as a merge patch, so omitting a purpose
-* leaves it as it was. At least one purpose is required: an empty patch is
-* a no-op request, not a valid one.
-*/
-const consentPatchSchema = z.partialRecord(z.enum(CONSENT_PURPOSES), z.boolean()).refine((data) => Object.keys(data).length > 0, { message: `at least one consent purpose (${CONSENT_PURPOSES.join(", ")}) is required` });
 const updateConsentBodySchema = z.object({ data: consentPatchSchema });
 /**
 * DELETE /v1/users/:profileId: what erasure did, so the dashboard action
@@ -6819,6 +7106,374 @@ function readCliPackage() {
 	return cached;
 }
 
+//#endregion
+//#region src/build/spine.ts
+/**
+* The step spine, read off the source of `run` rather than recorded by
+* running it: a run against stub data follows one path and never sees an
+* `if` on a profile trait, which is the shape of half the journeys there
+* are. Reading the code sees every branch, labelled with its condition.
+*
+* What it reads: `await api.*` calls (in source order, with the literal
+* template, destination, event, key, or duration when the author wrote one
+* inline), `if`/`else`, `switch`, loops, `try`/`catch`, `return`, `throw`, and
+* `api.restart()`. Calls behind a helper function in another file, and a
+* `run` that is not an inline function on the `defineJourney` object, are
+* not followed: the spine is display only, and its ceiling is the source in
+* front of it. The typecheck that ran first is TypeScript's; syntax it accepts
+* and this parser does not yields an empty spine, never a failed build.
+*/
+function readSpine(source) {
+	let program;
+	try {
+		program = parse(source, {
+			sourceType: "module",
+			plugins: ["typescript"],
+			errorRecovery: true
+		}).program;
+	} catch {
+		return [];
+	}
+	const run = findRun(program);
+	if (!run) return [];
+	const api = run.params[1];
+	if (api?.type !== "Identifier") return [];
+	const reader = new Reader(source, api.name);
+	if (run.body.type !== "BlockStatement") return [...reader.calls(run.body), {
+		name: "end",
+		detail: "returned"
+	}];
+	const body = reader.block(run.body.body);
+	return body.ended ? body.entries : [...body.entries, {
+		name: "end",
+		detail: "returned"
+	}];
+}
+/** The `run` function on the object `export default defineJourney({...})` receives. */
+function findRun(program) {
+	for (const statement of program.body) {
+		if (statement.type !== "ExportDefaultDeclaration") continue;
+		let expr = statement.declaration;
+		while (expr.type === "TSAsExpression" || expr.type === "TSSatisfiesExpression" || expr.type === "ParenthesizedExpression") expr = expr.expression;
+		if (expr.type !== "CallExpression" || expr.arguments[0]?.type !== "ObjectExpression") return;
+		for (const prop of expr.arguments[0].properties) {
+			if (prop.type === "ObjectMethod" && keyName(prop.key) === "run") return prop;
+			if (prop.type === "ObjectProperty" && keyName(prop.key) === "run" && (prop.value.type === "ArrowFunctionExpression" || prop.value.type === "FunctionExpression")) return prop.value;
+		}
+	}
+}
+function keyName(key) {
+	if (key.type === "Identifier") return key.name;
+	if (key.type === "StringLiteral") return key.value;
+}
+var Reader = class {
+	source;
+	api;
+	/** Variables holding a `waitForEvent` result, by name, to the event waited for. */
+	waits = /* @__PURE__ */ new Map();
+	constructor(source, api) {
+		this.source = source;
+		this.api = api;
+	}
+	block(statements) {
+		const entries = [];
+		for (const statement of statements) {
+			const step = this.statement(statement);
+			entries.push(...step.entries);
+			if (step.ended) return {
+				entries,
+				ended: true
+			};
+		}
+		return {
+			entries,
+			ended: false
+		};
+	}
+	statement(node) {
+		switch (node.type) {
+			case "BlockStatement": return this.block(node.body);
+			case "IfStatement": {
+				const entries = this.calls(node.test);
+				const then = this.block([node.consequent]);
+				const otherwise = node.alternate ? this.block([node.alternate]) : void 0;
+				entries.push({
+					name: "if",
+					detail: this.condition(node.test),
+					steps: then.entries,
+					...otherwise ? { otherwise: otherwise.entries } : {}
+				});
+				return {
+					entries,
+					ended: then.ended && otherwise?.ended === true
+				};
+			}
+			case "SwitchStatement": {
+				const entries = this.calls(node.discriminant);
+				for (const kase of node.cases) {
+					const body = this.block(kase.consequent).entries;
+					if (kase.test) entries.push({
+						name: "if",
+						detail: `${this.describe(node.discriminant)} is ${this.describe(kase.test)}`,
+						steps: body
+					});
+					else entries.push(...body);
+				}
+				return {
+					entries,
+					ended: false
+				};
+			}
+			case "ForStatement":
+			case "ForOfStatement":
+			case "ForInStatement":
+			case "WhileStatement":
+			case "DoWhileStatement": return {
+				entries: [{
+					name: "loop",
+					detail: this.loopDetail(node),
+					steps: this.block([node.body]).entries
+				}],
+				ended: false
+			};
+			case "TryStatement": {
+				const entries = this.block(node.block.body).entries;
+				if (node.handler) entries.push({
+					name: "if",
+					detail: "that fails",
+					steps: this.block(node.handler.body.body).entries
+				});
+				if (node.finalizer) entries.push(...this.block(node.finalizer.body).entries);
+				return {
+					entries,
+					ended: false
+				};
+			}
+			case "ReturnStatement": {
+				const entries = node.argument ? this.calls(node.argument) : [];
+				if (entries.at(-1)?.name !== "restart") entries.push({
+					name: "end",
+					detail: "returned"
+				});
+				return {
+					entries,
+					ended: true
+				};
+			}
+			case "ThrowStatement": return {
+				entries: [...this.calls(node.argument), {
+					name: "end",
+					detail: "failed"
+				}],
+				ended: true
+			};
+			case "VariableDeclaration": {
+				const entries = [];
+				for (const declarator of node.declarations) if (declarator.init) {
+					entries.push(...this.calls(declarator.init));
+					const call = unwrap(declarator.init);
+					if (declarator.id.type === "Identifier" && call?.type === "CallExpression" && this.apiPath(call.callee) === "waitForEvent") this.waits.set(declarator.id.name, this.literalPattern(call.arguments[0]) ?? "the event");
+				}
+				return {
+					entries,
+					ended: false
+				};
+			}
+			default: {
+				const entries = this.calls(node);
+				return {
+					entries,
+					ended: entries.at(-1)?.name === "restart"
+				};
+			}
+		}
+	}
+	/** Every `api.*` call inside a node, in source order. */
+	calls(node) {
+		const entries = [];
+		const visit = (child) => {
+			if (child.type === "CallExpression") {
+				const path = this.apiPath(child.callee);
+				if (path && COMMAND_NAMES.includes(path)) {
+					for (const argument of child.arguments) visit(argument);
+					entries.push(this.call(path, child.arguments));
+					return;
+				}
+			}
+			if (child.type === "ArrowFunctionExpression" || child.type === "FunctionExpression") return;
+			for (const key of Object.keys(child)) {
+				if (key === "loc" || key === "leadingComments" || key === "trailingComments") continue;
+				const value = child[key];
+				for (const item of Array.isArray(value) ? value : [value]) if (isNode(item)) visit(item);
+			}
+		};
+		visit(node);
+		return entries;
+	}
+	call(name, args) {
+		const first = args[0];
+		const entry = { name };
+		const detail = (value) => {
+			if (value !== void 0) entry.detail = value;
+		};
+		switch (name) {
+			case "sleep":
+				detail(first ? this.literal(first) ?? this.text(first) : void 0);
+				break;
+			case "waitForEvent": {
+				detail(first ? this.literalPattern(first) ?? this.text(first) : void 0);
+				const timeout = this.property(args[1], "timeout");
+				if (timeout) entry.timeout = timeout;
+				break;
+			}
+			case "send.email": {
+				detail(this.property(first, "template"));
+				const sender = this.property(first, "senderIdentity");
+				if (sender) entry.senderIdentity = sender;
+				break;
+			}
+			case "send.webhook":
+				detail(this.property(first, "destination"));
+				break;
+			case "traits.set":
+			case "traits.unset":
+			case "events.track":
+			case "profiles.get": detail(first ? this.literal(first) ?? this.text(first) : void 0);
+		}
+		return entry;
+	}
+	/** `api.send.email` → "send.email"; anything not rooted at the api param → undefined. */
+	apiPath(callee) {
+		const parts = [];
+		let node = callee;
+		while (node.type === "MemberExpression" && !node.computed) {
+			if (node.property.type !== "Identifier") return;
+			parts.unshift(node.property.name);
+			node = node.object;
+		}
+		return node.type === "Identifier" && node.name === this.api && parts.length ? parts.join(".") : void 0;
+	}
+	text(node) {
+		return this.source.slice(node.start ?? 0, node.end ?? 0);
+	}
+	literal(node) {
+		switch (node.type) {
+			case "StringLiteral": return node.value;
+			case "NumericLiteral":
+			case "BooleanLiteral": return String(node.value);
+			case "TemplateLiteral": return node.expressions.length === 0 ? node.quasis.map((quasi) => quasi.value.cooked ?? "").join("") : void 0;
+			case "TSAsExpression":
+			case "TSSatisfiesExpression":
+			case "TSNonNullExpression": return this.literal(node.expression);
+			default: return;
+		}
+	}
+	/** A literal pattern, one or a list, the way the trigger label shows it. */
+	literalPattern(node) {
+		if (!node) return;
+		if (node.type === "ArrayExpression") {
+			const items = node.elements.map((item) => item ? this.literal(item) : void 0);
+			return items.every((item) => item !== void 0) ? patternLabel(items) : void 0;
+		}
+		return this.literal(node);
+	}
+	/** The literal value of `key` in an inline object argument. */
+	property(node, key) {
+		if (node?.type !== "ObjectExpression") return;
+		for (const prop of node.properties) if (prop.type === "ObjectProperty" && keyName(prop.key) === key) return this.literal(prop.value);
+	}
+	loopDetail(node) {
+		switch (node.type) {
+			case "ForStatement": return node.test ? `while ${this.condition(node.test)}` : "forever";
+			case "WhileStatement":
+			case "DoWhileStatement": return `while ${this.condition(node.test)}`;
+			default: return `for each of ${this.describe(node.right)}`;
+		}
+	}
+	/**
+	* A condition as a sentence: "the plan trait is \"pro\"", "org_activated
+	* arrives in time", "the orgActivated trait is not true". Whatever the
+	* rules do not know stays as the author wrote it.
+	*/
+	condition(node) {
+		switch (node.type) {
+			case "LogicalExpression": return `${this.condition(node.left)} ${node.operator === "&&" ? "and" : node.operator === "||" ? "or" : "or else"} ${this.condition(node.right)}`;
+			case "UnaryExpression":
+				if (node.operator === "!") return negate(this.condition(node.argument));
+				return this.text(node);
+			case "BinaryExpression": {
+				const { operator } = node;
+				const left = node.left;
+				if (operator === "===" || operator === "==" || operator === "!==" || operator === "!=") {
+					const positive = operator === "===" || operator === "==";
+					const right = this.rightHand(node.right);
+					const sentence = `${this.describe(left)} ${right}`;
+					return positive ? sentence : negate(sentence);
+				}
+				return `${this.describe(left)} ${operator} ${this.describe(node.right)}`;
+			}
+			case "ParenthesizedExpression": return this.condition(node.expression);
+			default: {
+				const wait = node.type === "Identifier" && this.waits.get(node.name);
+				if (wait) return `${wait} arrives in time`;
+				return `${this.describe(node)} is set`;
+			}
+		}
+	}
+	/** The predicate for a comparison's right side: "is true", "is missing", "is \"pro\"". */
+	rightHand(node) {
+		if (node.type === "NullLiteral") return "is missing";
+		if (node.type === "Identifier" && node.name === "undefined") return "is missing";
+		if (node.type === "StringLiteral") return `is "${node.value}"`;
+		if (node.type === "NumericLiteral" || node.type === "BooleanLiteral") return `is ${String(node.value)}`;
+		return `is ${this.describe(node)}`;
+	}
+	/** An operand as a noun phrase: "the plan trait", "the via property", "the event name". */
+	describe(node) {
+		if (node.type === "MemberExpression" && !node.computed && node.property.type === "Identifier") {
+			const object = node.object;
+			if (object.type === "MemberExpression" && !object.computed && object.property.type === "Identifier") {
+				if (object.property.name === "traits") return `the ${node.property.name} trait`;
+				if (object.property.name === "properties") return `the ${node.property.name} property`;
+			}
+			if (object.type === "Identifier" && node.property.name === "name" && object.name === "event") return "the event name";
+		}
+		if (node.type === "MemberExpression" && node.computed && node.object.type === "MemberExpression" && !node.object.computed && node.object.property.type === "Identifier") {
+			const key = this.literal(node.property);
+			if (key !== void 0 && node.object.property.name === "traits") return `the ${key} trait`;
+			if (key !== void 0 && node.object.property.name === "properties") return `the ${key} property`;
+		}
+		if (node.type === "Identifier") {
+			const wait = this.waits.get(node.name);
+			if (wait) return `the ${wait} event`;
+		}
+		const literal = this.literal(node);
+		return literal !== void 0 && node.type === "StringLiteral" ? `"${literal}"` : literal ?? this.text(node);
+	}
+};
+/** Each pair is a sentence and its negation; whichever side is present flips. */
+const NEGATIONS = [
+	[" arrives in time", " does not arrive in time"],
+	[" is missing", " is present"],
+	[" is set", " is not set"],
+	[" is ", " is not "]
+];
+function negate(sentence) {
+	for (const [positive, negative] of NEGATIONS) {
+		if (sentence.includes(negative)) return sentence.replace(negative, positive);
+		if (sentence.includes(positive)) return sentence.replace(positive, negative);
+	}
+	return `not ${sentence}`;
+}
+function unwrap(node) {
+	let current = node;
+	while (current.type === "AwaitExpression" || current.type === "TSAsExpression" || current.type === "TSNonNullExpression" || current.type === "ParenthesizedExpression") current = current.type === "AwaitExpression" ? current.argument : current.expression;
+	return current;
+}
+function isNode(value) {
+	return typeof value === "object" && value !== null && typeof value.type === "string";
+}
+
 //#endregion
 //#region src/build/index.ts
 /**
@@ -6843,11 +7498,6 @@ const CONFIG_FILES$1 = [
 	"tsconfig.json"
 ];
 /**
-* The spine is display only, so a loop that would record forever is cut
-* here rather than being allowed to grow the manifest.
-*/
-const SPINE_LIMIT = 200;
-/**
 * The guest SDK a bundle links against is always the CLI's own, whatever
 * the project has installed: the manifest records that version as `sdk`,
 * and the sandbox runs the driver from these files.
@@ -6923,7 +7573,7 @@ async function discover(projectDir, kind, extension) {
 }
 /**
 * Two files under the same directory tree cannot share a key: the key is
-* what a release, a workflow id, and `api.email.send` all address. A
+* what a release, a workflow id, and `api.send.email` all address. A
 * journey and a template may share one (they are separate namespaces, and
 * a journey that sends its own email usually does).
 */
@@ -6937,7 +7587,7 @@ function assertUniqueKeys(files) {
 }
 /**
 * `.cow/types.d.ts`: one `typeof import(...)` per template, merged into the
-* SDK's `CowTemplates`, which is what types `api.email.send`. Written before
+* SDK's `CowTemplates`, which is what types `api.send.email`. Written before
 * the typecheck, because the typecheck is what it exists for.
 */
 function templateTypes(templates) {
@@ -7106,93 +7756,29 @@ async function loadNodeBundle(projectDir, key, kind = "journeys") {
 		runGuest: loaded.runGuest
 	};
 }
-/** Stops the recording stub at `restart` and at the spine cap. */
-var SpineStop = class extends Error {};
 /**
-* A profile with nothing in it but the id and traits given: what the spine
-* stub's reads answer, and the base the simulator answers `profile.get` with.
-* The spec says a spine read returns an empty object; a bare `{}` ends most
-* recordings at the first `me.traits.x`, which is the first line of half the
-* journeys there are, so the shape is kept and the contents emptied. Consent
-* reads true so a gated send still shows up.
+* A profile with nothing in it but the id and traits given: the base the
+* simulator answers `profile.get` with.
+*
+* Consent covers the project's declared purposes as well as the two fixed
+* ones, each reading its own default, which is what a profile that answered
+* nothing gets in production, so a dry run and a real send agree.
 */
-function emptyProfile(id = "", traits = {}) {
+function emptyProfile(id = "", traits = {}, purposes = []) {
 	return {
 		id,
 		traits,
-		consent: Object.fromEntries(CONSENT_PURPOSES.map((purpose) => [purpose, true])),
+		consent: {
+			...CONSENT_PURPOSE_DEFAULTS,
+			...consentDefaultsOf(purposes.map((purpose) => ({
+				key: purpose.key,
+				defaultGranted: false
+			})))
+		},
 		identifiers: {},
 		segments: []
 	};
 }
-/**
-* The step spine: `run` once against a stub whose reads answer empty and
-* whose waits answer null, keeping what was recorded up to the first throw.
-*
-* ponytail: a journey that awaits a promise nothing settles (rather than an
-* api call) hangs the build here. The cap covers the loop that matters,
-* `for (;;) await api.sleep(...)`; a wall-clock guard is the upgrade if a
-* real project ever manages it.
-*/
-async function recordSpine(module, trigger) {
-	const spine = [];
-	const push = (name, detail) => {
-		if (spine.length >= SPINE_LIMIT) throw new SpineStop();
-		spine.push(detail === void 0 ? { name } : {
-			name,
-			detail
-		});
-	};
-	const api = {
-		sleep: async () => {
-			push("sleep");
-		},
-		waitForEvent: async (pattern) => {
-			push("waitForEvent", patternLabel(pattern));
-			return null;
-		},
-		email: { send: async (args) => {
-			push("email.send", String(args.template));
-			return {};
-		} },
-		webhook: { send: async (args) => {
-			push("webhook.send", args.destination);
-		} },
-		traits: {
-			set: async (key) => {
-				push("traits.set", key);
-			},
-			unset: async (key) => {
-				push("traits.unset", key);
-			}
-		},
-		profile: { get: async () => {
-			push("profile.get");
-			return emptyProfile();
-		} },
-		profiles: { get: async (id) => {
-			push("profiles.get", id);
-			return emptyProfile();
-		} },
-		events: { track: async (name) => {
-			push("events.track", name);
-		} },
-		log: () => {},
-		restart: async () => {
-			push("restart");
-			throw new SpineStop();
-		}
-	};
-	const journey = module.default;
-	try {
-		await journey.run({
-			name: "event" in trigger ? patternPlaceholder(trigger.event) : SYSTEM_EVENTS.segmentEntered,
-			properties: {},
-			timestamp: 0
-		}, api);
-	} catch {}
-	return spine;
-}
 /** The release limits (spec: Limits), naming the offending count or size. */
 function limitFailure(sizes) {
 	if (sizes.journeys > RELEASE_LIMITS.journeys) return `This project has ${sizes.journeys} journeys; a release carries at most ${RELEASE_LIMITS.journeys}.`;
@@ -7306,8 +7892,9 @@ async function buildProject(projectDir) {
 			tags: report.tags,
 			trigger: report.trigger,
 			purpose: report.purpose,
+			senderIdentity: report.senderIdentity,
 			environments: report.environments,
-			spine: await recordSpine(module, report.trigger),
+			spine: readSpine(await readFile(built.source.file, "utf8")),
 			bundle: built.digest
 		});
 		else manifestTemplates.push({
@@ -7332,10 +7919,11 @@ async function buildProject(projectDir) {
 	});
 	if (failure) throw new Error(failure);
 	const manifest = manifestSchema.parse({
-		protocol: 1,
+		protocol: 2,
 		sdk: (await readCliPackage()).version,
 		journeys: manifestJourneys,
 		templates: manifestTemplates,
+		purposes: config.purposes,
 		source: digestOf(await readFile(sourceFile))
 	});
 	await writeFile(join(outDir, "manifest.json"), `${JSON.stringify(manifest, null, 2)}\n`);
@@ -8443,6 +9031,31 @@ const catalog = defineModule(defineRoute({
 	}
 }));
 
+//#endregion
+//#region ../../packages/shared/src/contract/consent.ts
+/**
+* The consent purposes an organization's profiles answer: the two fixed ones
+* every org has, plus whatever its projects declare in their `cow.json`.
+*
+* Read-only, and deliberately so. Purposes are code, like journeys and
+* templates: a deploy upserts them and never deletes one, because profiles
+* already hold answers against them.
+*/
+const consent = defineModule(defineRoute({
+	method: "get",
+	path: "/v1/consent-purposes",
+	operationId: "consent.purposes.list",
+	tags: ["consent"],
+	summary: "List the consent purposes this organization declares",
+	security: SESSION_AUTH,
+	request: { query: listConsentPurposesQuerySchema },
+	responses: {
+		200: list(consentPurposeSchema),
+		...sessionErrors,
+		...errors("validation_failed")
+	}
+}));
+
 //#endregion
 //#region ../../packages/shared/src/contract/deliveries.ts
 /**
@@ -8502,7 +9115,16 @@ const deliveries = defineModule(defineRoute({
 	summary: "One-click unsubscribe (public)",
 	security: NO_AUTH,
 	surfaces: HIDDEN_FROM_TOOLS,
-	request: { query: tokenQuery },
+	request: { query: tokenQuery.extend({ 
+	/**
+	* The confirmation page's second button, "stop all marketing
+	* email": the same token, revoking the master purpose instead of
+	* the one the mail was sent under. A flag rather than a second
+	* route, because the claim already names the org and the profile.
+	* The List-Unsubscribe header never carries it, so a mail client's
+	* one-click POST stops one purpose, as RFC 8058 intends.
+	*/
+all: z.literal("1").optional() }) },
 	responses: {
 		200: htmlResponse("Confirmation page"),
 		400: { description: "Invalid or incomplete unsubscribe link" }
@@ -9057,6 +9679,55 @@ const journeys = defineModule(defineRoute({
 	}
 }));
 
+//#endregion
+//#region ../../packages/shared/src/contract/me.ts
+/**
+* The signed-in developer's own settings. Session auth like the rest of the
+* dashboard API, but deliberately not org-scoped and indifferent to the
+* environment header: the subject is the caller's own platform-workspace
+* profile, taken from their session, never from the request.
+*
+* Hidden from the CLI and the MCP server. Both act with an org's key on that
+* org's data, and neither has a signed-in human whose mail preferences this
+* could mean; an operator changing an end user's consent uses
+* `users.updateConsent`, which is the same decision made by someone else.
+*/
+const me = defineModule(defineRoute({
+	method: "get",
+	path: "/v1/me/notifications",
+	operationId: "me.notifications.get",
+	tags: ["me"],
+	summary: "What Cowliss may send you",
+	security: SESSION_AUTH,
+	surfaces: {
+		cli: false,
+		mcp: false,
+		docs: false
+	},
+	responses: {
+		200: envelope(notificationPreferencesSchema),
+		...sessionErrors
+	}
+}), defineRoute({
+	method: "patch",
+	path: "/v1/me/notifications",
+	operationId: "me.notifications.update",
+	tags: ["me"],
+	summary: "Change what Cowliss may send you",
+	security: SESSION_AUTH,
+	surfaces: {
+		cli: false,
+		mcp: false,
+		docs: false
+	},
+	request: { body: jsonBody(updateNotificationPreferencesBodySchema) },
+	responses: {
+		200: envelope(notificationPreferencesSchema),
+		...sessionErrors,
+		...errors("validation_failed", "malformed_request", "internal")
+	}
+}));
+
 //#endregion
 //#region ../../packages/shared/src/contract/project.ts
 /**
@@ -9752,6 +10423,8 @@ const contract = {
 	openapi,
 	ingestion,
 	users,
+	me,
+	consent,
 	events,
 	apps,
 	sources,
@@ -10280,7 +10953,10 @@ async function pushProject({ client, projectDir, force, sleep = (ms) => setTimeo
 	}
 	return {
 		release: await awaitCompile(client, (await client.request(contract.releases["releases.create"], { body: {
-			manifest,
+			manifest: {
+				...manifest,
+				protocol: 2
+			},
 			project: project.name
 		} })).data.id, sleep, progress),
 		uploaded
@@ -11121,7 +11797,7 @@ async function runScenario(projectDir, key, scenario) {
 	if (!journey) throw new Error(`Unknown journey "${key}". This project builds: ${manifest?.journeys.map((one) => one.key).join(", ") || "no journeys"}.`);
 	const wallStart = Date.now();
 	const { module, runGuest } = await loadNodeBundle(projectDir, key);
-	const profile = emptyProfile(scenario.user.id, { ...scenario.user.traits });
+	const profile = emptyProfile(scenario.user.id, { ...scenario.user.traits }, manifest?.purposes);
 	const scripted = scenario.events.map((one) => ({
 		...one,
 		atMs: SIM_START + parseDuration(one.at),
@@ -11170,7 +11846,7 @@ async function runScenario(projectDir, key, scenario) {
 					now
 				};
 			}
-			case "email.send":
+			case "send.email":
 				record("sendEmail", command.args);
 				sends += 1;
 				return {
@@ -11180,7 +11856,7 @@ async function runScenario(projectDir, key, scenario) {
 					}),
 					now: clock
 				};
-			case "webhook.send":
+			case "send.webhook":
 				record("sendWebhook", command.args);
 				return {
 					result: ok(null),
@@ -11246,7 +11922,7 @@ async function runScenario(projectDir, key, scenario) {
 	let error;
 	for (;;) {
 		const output = await runGuest(module, {
-			protocol: 1,
+			protocol: 2,
 			kind: "journey",
 			key,
 			event: trigger,