@cowliss/cli 0.4.0 → 0.6.0

package/README.md

@@ -26,7 +26,7 @@ cow whoami
 ```
 
 `cow login` opens the dashboard and caches a session token. In CI, set
-`COW_DEPLOY_KEY` to a deploy key instead.
+`COW_PIPELINE_KEY` to a pipeline key instead.
 
 ## Journeys and emails as code
 
@@ -45,7 +45,6 @@ import { defineJourney } from "@cowliss/cli/journeys";
 export default defineJourney({
   trigger: { event: "checkout_started" },
   purpose: "emailMarketing",
-  senderIdentity: "cowliss-default",
   run: async (event, api) => {
     const purchased = await api.waitForEvent("purchase_completed", {
       timeout: "24h",
@@ -70,16 +69,22 @@ cow test abandoned-checkout --scenario scenarios/cart.json
 # typecheck and bundle, no API call
 cow build
 
-# publish it and make it the environment's live code
-cow deploy --env development
+# upload the project; the server compiles it
+cow push
 
-# rebuild and redeploy on every save
-cow dev
+# what the server holds, and what is running
+cow status
+
+# turn it on
+cow enable abandoned-checkout
 ```
 
-Every push creates a numbered release. `cow deploy` makes one release an
-environment's current code, `cow rollback` puts the previous one back, and a
-run that has already started stays on the release it started on.
+A push creates a new version of every journey and template whose code
+changed, and changes no flag: `cow enable` and `cow disable` are the only
+things that put code in front of anyone. A journey runs its latest version
+that finished compiling, so a push that fails to compile leaves the previous
+one running, and a run that has already started stays on the version it
+started on. To undo, `git revert` and push again.
 
 ## Admin, and everything else
 

package/dist/guest/{driver-DaNdNhuF.js → driver-DBt5l1Z5.js}

@@ -1,4 +1,4 @@
-import { a as manifestOutputSchema, i as journeyStepOutputSchema, o as templateRenderOutputSchema, r as guestInputSchema, t as CapabilityError } from "./journeys-B_xg_GnL.js";
+import { a as manifestOutputSchema, i as journeyStepOutputSchema, o as templateRenderOutputSchema, r as guestInputSchema, t as CapabilityError } from "./journeys-BrcKEXz0.js";
 import { z } from "zod";
 import { createElement } from "react";
 import { renderToStaticMarkup } from "react-dom/server.browser";
@@ -124,7 +124,8 @@ function createApi(input, journey) {
 					args: {
 						template: args.template,
 						props: args.props,
-						senderIdentity: args.senderIdentity ?? journey.senderIdentity
+						from: args.from ?? journey.from,
+						replyTo: args.replyTo
 					}
 				}),
 				webhook: (args) => call({
@@ -5572,8 +5573,7 @@ function readManifest(module) {
 			kind: "journey",
 			trigger: journey.trigger,
 			purpose: journey.purpose,
-			senderIdentity: journey.senderIdentity,
-			environments: journey.environments,
+			from: journey.from,
 			tags: journey.tags
 		});
 	}

package/dist/guest/driver.d.ts

@@ -1,4 +1,4 @@
-import { a as ManifestOutput, i as JourneyStepOutput, o as TemplateRenderOutput } from "./index-DAGLEHDn.js";
+import { a as ManifestOutput, i as JourneyStepOutput, o as TemplateRenderOutput } from "./index-CXcCEcAg.js";
 //#region src/guest/driver.d.ts
 /**
  * The in-process driver: JSON in, JSON out (spec: Guest protocol). One

package/dist/guest/driver.js

@@ -1,3 +1,3 @@
-import { t as runGuest } from "./driver-DaNdNhuF.js";
+import { t as runGuest } from "./driver-DBt5l1Z5.js";
 
 export { runGuest };

package/dist/guest/emails.d.ts

@@ -1,6 +1,23 @@
-import { n as SendClass } from "./constants-B0wk-87t.js";
 import { z } from "zod";
 import { ReactElement } from "react";
+//#region ../../packages/shared/src/constants.d.ts
+/**
+ * The two classes of send, declared on the template rather than passed per
+ * call so the class cannot drift between two sends of the same message.
+ *
+ * Marketing is everything a journey sends on the org's behalf: it carries
+ * the RFC 8058 unsubscribe headers and runs the full gate list.
+ * Transactional is the developer's own operational mail (a receipt, an
+ * export-is-ready notice): it carries neither header and skips consent and
+ * the per-user frequency cap, because an unsubscribe link on an invoice is
+ * wrong and a receipt must not silently vanish for anyone who once left a
+ * newsletter. Suppression, the quota, the sending pause, and the from-domain
+ * check still apply to both: those bound cost and protect the shared SES
+ * account, and none of them are about what the recipient asked for.
+ */
+declare const SEND_CLASSES: readonly ["marketing", "transactional"];
+type SendClass = (typeof SEND_CLASSES)[number];
+//#endregion
 //#region src/guest/emails.d.ts
 /** A template's subject line, computed from the props it declares. */
 type Subject<Schema extends z.ZodType> = (props: z.infer<Schema>) => string;

package/dist/guest/{index-DAGLEHDn.d.ts → index-CXcCEcAg.d.ts}

@@ -34,7 +34,8 @@ declare const journeyStepOutputSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     args: z.ZodObject<{
       template: z.ZodString;
       props: z.ZodRecord<z.ZodString, z.ZodUnknown>;
-      senderIdentity: z.ZodString;
+      from: z.ZodOptional<z.ZodString>;
+      replyTo: z.ZodOptional<z.ZodEmail>;
     }, z.core.$strict>;
   }, z.core.$strip>, z.ZodObject<{
     name: z.ZodLiteral<"send.webhook">;
@@ -124,7 +125,8 @@ declare const journeyStepOutputSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
       args: z.ZodObject<{
         template: z.ZodString;
         props: z.ZodRecord<z.ZodString, z.ZodUnknown>;
-        senderIdentity: z.ZodString;
+        from: z.ZodOptional<z.ZodString>;
+        replyTo: z.ZodOptional<z.ZodEmail>;
       }, z.core.$strict>;
     }, z.core.$strip>, z.ZodObject<{
       name: z.ZodLiteral<"send.webhook">;
@@ -183,7 +185,8 @@ declare const journeyStepOutputSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
       args: z.ZodObject<{
         template: z.ZodString;
         props: z.ZodRecord<z.ZodString, z.ZodUnknown>;
-        senderIdentity: z.ZodString;
+        from: z.ZodOptional<z.ZodString>;
+        replyTo: z.ZodOptional<z.ZodEmail>;
       }, z.core.$strict>;
     }, z.core.$strip>, z.ZodObject<{
       name: z.ZodLiteral<"send.webhook">;
@@ -257,11 +260,7 @@ declare const manifestOutputSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     segment: z.ZodString;
   }, z.core.$strict>]>;
   purpose: z.ZodString;
-  senderIdentity: z.ZodOptional<z.ZodString>;
-  environments: z.ZodArray<z.ZodEnum<{
-    development: "development";
-    production: "production";
-  }>>;
+  from: z.ZodOptional<z.ZodString>;
   kind: z.ZodLiteral<"journey">;
 }, z.core.$strip>, z.ZodObject<{
   tags: z.ZodPipe<z.ZodDefault<z.ZodArray<z.ZodString>>, z.ZodTransform<string[], string[]>>;
@@ -282,7 +281,7 @@ type ManifestOutput = z.infer<typeof manifestOutputSchema>;
  * reuses it.
  *
  * Both members are strict, so a journey holding the retired `source` key
- * fails to compile a release instead of silently triggering on every app.
+ * fails to compile instead of silently triggering on every app.
  * There is deliberately no pipe filter: a trigger narrows by the app the
  * write is attributed to, the same token a segment definition names.
  */

package/dist/guest/{journeys-B_xg_GnL.js → journeys-BrcKEXz0.js}

@@ -9,16 +9,6 @@ const DOCS_URL = "https://docs.cowliss.com";
 */
 const CLERK_ORG_SUBJECT_PREFIX = "org_";
 /**
-* The two fixed environments every org has (spec: Environments). An app
-* belongs to one, so the environment of every write is the app's;
-* profiles, identifiers, events, memberships, journey instances,
-* deliveries, violations, quarantine, the address ledger, and idempotency
-* keys are per environment, while the catalog, sending domains, the
-* suppression mirror, billing, and journey code are shared. A third
-* environment is a one-line change here plus the mirrored db enum.
-*/
-const ENVIRONMENTS = ["development", "production"];
-/**
 * Fixed consent purposes for the prototype. Consent is a per-purpose map on
 * the profile, checked at send-step execution time.
 *
@@ -51,8 +41,8 @@ const EXECUTION_LIMITS = {
 	logLines: 100,
 	logLineBytes: 1024
 };
-/** Per release: manifest counts, bundle size, and the source tarball. */
-const RELEASE_LIMITS = {
+/** Per push: manifest counts, bundle size, and the source tarball. */
+const PUSH_LIMITS = {
 	journeys: 100,
 	templates: 200,
 	bundleBytes: 2097152,
@@ -66,29 +56,13 @@ const RELEASE_LIMITS = {
 const COW_CONFIG_SCHEMA_PATH = "/schemas/cow.json";
 const COW_CONFIG_SCHEMA_URL = `${DOCS_URL}${COW_CONFIG_SCHEMA_PATH}`;
 
-//#endregion
-//#region ../../packages/shared/src/environments.ts
-/**
-* The environment on the wire: the source's `environment` field, the
-* `X-Cow-Environment` header admin calls select with, and the
-* `environment` column every per-environment DTO carries.
-*/
-const environmentSchema = z.enum(ENVIRONMENTS);
-/**
-* The environments a shared definition (a segment, a journey) declares it
-* works on: a non-empty list of distinct values. A definition declaring none
-* would be dead code with a row behind it, and a repeated value is a typo
-* rather than an intent, which is the rule `defineJourney` applies too.
-*/
-const environmentsSchema = z.array(environmentSchema).min(1, "at least one environment is required").refine((values) => new Set(values).size === values.length, { message: "environments must not repeat" });
-
 //#endregion
 //#region ../../packages/shared/src/journeys-v2/manifest.ts
 /**
-* The release manifest (spec: Build; Push and compile): what `cow build`
+* The pushed manifest (spec: Build; Push and compile): what `cow build`
 * extracts from a project and `cow push` uploads with the bundles. The
-* server validates it with these schemas, compiles every bundle, and stores
-* the compiled form on the release row.
+* server validates it with these schemas, compiles every bundle whose key
+* changed, and stores that entry on the version it creates.
 */
 /**
 * A journey or template key: the file basename under `journeys/` or
@@ -168,7 +142,7 @@ const patternSchema = z.union([onePatternSchema, z.array(onePatternSchema).min(1
 * reuses it.
 *
 * Both members are strict, so a journey holding the retired `source` key
-* fails to compile a release instead of silently triggering on every app.
+* fails to compile instead of silently triggering on every app.
 * There is deliberately no pipe filter: a trigger narrows by the app the
 * write is attributed to, the same token a segment definition names.
 */
@@ -177,15 +151,44 @@ const triggerSchema = z.union([z.strictObject({
 	appId: patternSchema.optional()
 }), z.strictObject({ segment: z.string().min(1) })]);
 /**
-* A destination's name: the token a journey addresses it by, in a
-* `send.webhook` call or a journey's `senderIdentity`.
+* The address half of a from-header: a local part, an `@`, and a dotted
+* domain. Deliberately narrower than RFC 5322 (no quoted local parts, no
+* address literals): every character it refuses would have to be quoted or
+* escaped to survive a header, and none of them belong in an address a
+* journey sends from.
+*/
+const FROM_ADDRESS = /^[^\s@<>",;]+@([^\s@<>",;.]+(?:\.[^\s@<>",;.]+)+)$/;
+/**
+* Parse a journey's or a send's `from`: `addr@domain`, or
+* `Name <addr@domain>` with the name optionally quoted. Null when it is
+* neither, which is what `cow build` refuses on and what the send-time
+* domain gate turns into a skip.
 *
-* Defined here rather than beside the destinations contract, and imported
-* from here by it, because a journey manifest names one and the guest layer
-* is bundled into every tenant module: importing it the other way round
-* would pull the Drizzle destinations table into all of them.
+* One parser, and the send facade reuses it. A control character anywhere is
+* a refusal rather than something to strip: it survives quoting and would
+* inject a second header.
+*/
+function parseFromAddress(from) {
+	const text = from.trim();
+	if (/\p{Cc}/u.test(text)) return null;
+	const angled = /^(.*?)\s*<([^<>]*)>$/.exec(text);
+	const address = (angled?.[2] ?? text).trim();
+	const domain = FROM_ADDRESS.exec(address)?.[1];
+	if (!domain) return null;
+	const name = (angled?.[1] ?? "").trim().replace(/^"(.*)"$/s, "$1").replace(/\\(.)/g, "$1").trim();
+	return {
+		...name ? { name } : {},
+		address,
+		domain: domain.toLowerCase()
+	};
+}
+/**
+* The address a journey or one send leaves as: a string, not the name of a
+* configured row (ADR 0014). The domain is checked against the
+* organization's verified ones at push time and again at send time; the
+* shape is all that is checked here, because it is all a build can know.
 */
-const destinationNameSchema = z.string().trim().min(1, "name is required").max(100, "name must be at most 100 characters");
+const fromSchema = z.string().trim().max(200, "from must be at most 200 characters").refine((value) => parseFromAddress(value) !== null, { message: "from must be an address (\"billing@acme.com\") or a name and address (\"Billing <billing@acme.com>\")" });
 /** A content address: `sha256:` plus the lowercase hex digest. */
 const digestSchema = z.string().regex(/^sha256:[0-9a-f]{64}$/, "digest must be sha256:<64 hex>");
 /**
@@ -221,13 +224,6 @@ const SPINE_ENTRY_NAMES = [
 const spineEntrySchema = z.object({
 	name: z.enum(SPINE_ENTRY_NAMES),
 	detail: z.string().max(200).optional(),
-	/**
-	* The sender identity a `send.email` call named for itself, overriding
-	* the journey's own. Present only when the author wrote one on the call,
-	* which is what lets the deploy warning and the journey detail page name
-	* the override without re-reading the code.
-	*/
-	senderIdentity: z.string().max(100).optional(),
 	/** A `waitForEvent` timeout, as the author wrote it. */
 	timeout: z.string().max(50).optional(),
 	get steps() {
@@ -237,6 +233,13 @@ const spineEntrySchema = z.object({
 		return z.array(spineEntrySchema).optional();
 	}
 }).meta({ id: "JourneySpineEntry" });
+/**
+* One journey in a stored manifest. A plain (non-strict) object on purpose:
+* a manifest pushed before the author's rollout gate went away still
+* carries keys that no longer exist, and every stored manifest has to keep
+* parsing for good (ADR 0011). Zod strips them, and the journey runs when
+* its `enabled` flag says so, which is the one gate there is.
+*/
 const manifestJourneySchema = z.object({
 	key: journeyKeySchema,
 	/** The author's labels; the dashboard's only grouping. */
@@ -244,23 +247,17 @@ const manifestJourneySchema = z.object({
 	trigger: triggerSchema,
 	/**
 	* A fixed purpose or one the project declares. Checked against the org's
-	* declared set at deploy time, not here: a manifest is built and pushed
+	* declared set at push time, not here: a manifest is built and pushed
 	* without ever reaching the org whose rows say what exists.
 	*/
 	purpose: consentPurposeKeySchema,
 	/**
-	* The sender identity every `send.email` in this journey goes out as,
-	* unless the call names its own. A name, never a `dst_` id: an org has one
-	* row per environment, so an id would send in production and fail in
-	* development, which is the one thing a journey must not do.
-	*
-	* Optional here and required at `defineJourney`, exactly like `purposes`: a
-	* release pushed before the field existed carries none and its stored
-	* manifest still parses. The author's build is where the error is useful.
+	* The address every `send.email` in this journey goes out as, unless the
+	* call names its own. Optional everywhere: an omitted one is the
+	* organization's shared fallback address, which is what makes day-one
+	* sending zero-config (ADR 0014).
 	*/
-	senderIdentity: destinationNameSchema.optional(),
-	/** The author's rollout gate: the journey is active only in these. */
-	environments: environmentsSchema,
+	from: fromSchema.optional(),
 	spine: z.array(spineEntrySchema),
 	bundle: digestSchema
 });
@@ -292,27 +289,27 @@ function uniqueKeys(items, ctx, path) {
 }
 /**
 * What `cow build` writes to `.cow/build/manifest.json`, and the shape a
-* release row stores for good.
+* push row stores for good, entry by entry, on the versions it creates.
 *
 * `protocol` is any positive integer rather than the current constant on
-* purpose: a release is immutable and an execution stays pinned to the one it
-* started on, so the day the protocol is bumped every stored release must
-* still parse, or the runner, the deploy, and every API response the client
-* validates all break at once for any org with history. The literal lives at
-* push time only (`createReleaseBodySchema`), which is where a stale CLI is
-* the developer's own fixable problem, and deploy plus the runner refuse a
-* release built for another protocol with a message naming both numbers.
+* purpose: a version is immutable and an execution stays pinned to the one
+* it started on, so the day the protocol is bumped every stored push must
+* still parse, or the runner and every API response the client validates
+* break at once for any org with history. The literal lives at push time
+* only (`createPushBodySchema`), which is where a stale CLI is the
+* developer's own fixable problem, and the runner refuses a version built
+* for another protocol with a message naming both numbers.
 */
 const manifestSchema = z.object({
 	protocol: z.number().int().positive(),
 	/** The `@cowliss/cli` version the project was built with. */
 	sdk: z.string().min(1),
-	journeys: z.array(manifestJourneySchema).max(RELEASE_LIMITS.journeys),
-	templates: z.array(manifestTemplateSchema).max(RELEASE_LIMITS.templates),
+	journeys: z.array(manifestJourneySchema).max(PUSH_LIMITS.journeys),
+	templates: z.array(manifestTemplateSchema).max(PUSH_LIMITS.templates),
 	/**
 	* The consent purposes this project declares, copied from `cow.json`.
-	* Optional rather than defaulted: a release pushed before purposes
-	* existed carries none, and its stored manifest still parses.
+	* Optional rather than defaulted: a push made before purposes existed
+	* carries none, and its stored manifest still parses.
 	*/
 	purposes: purposesSchema.optional(),
 	/** Digest of the gzipped source tarball. */
@@ -323,27 +320,12 @@ const manifestSchema = z.object({
 	uniqueKeys(manifest.purposes ?? [], ctx, "purposes");
 });
 /**
-* The manifest as the release row stores it once compilation succeeded:
-* the pushed manifest plus the compiled module digest per key, and the
-* digest of the Javy engine plugin the toolchain that compiled them was
-* built from.
-*
-* Journeys and templates are keyed separately because they share a key
-* space: `welcome.ts` and `welcome.tsx` are one journey and the email it
-* sends in every example, and a flat map would let one overwrite the other.
-*
-* `plugin` is a toolchain record, not a linked artifact: modules are
-* statically linked, so the plugin bytes are inside each module. It says
-* which engine compiled the release, which is what a later bug report or a
-* reproducible rebuild needs.
-*/
-const compiledManifestSchema = manifestSchema.safeExtend({
-	modules: z.object({
-		journeys: z.record(journeyKeySchema, digestSchema),
-		templates: z.record(journeyKeySchema, digestSchema)
-	}),
-	plugin: digestSchema
-});
+* One entry of a stored manifest: what a version is a snapshot of. Journeys
+* and templates are kept apart because they share a key space (`welcome.ts`
+* and `welcome.tsx` are one journey and the email it sends in every
+* example), and the version's own `kind` says which of the two this is.
+*/
+const versionManifestSchema = z.union([manifestJourneySchema, manifestTemplateSchema]);
 
 //#endregion
 //#region ../../packages/shared/src/journeys-v2/config.ts
@@ -355,9 +337,8 @@ const compiledManifestSchema = manifestSchema.safeExtend({
 const projectNameSchema = z.string().trim().min(1).max(200);
 /**
 * `cow.json` (spec: Project layout): the org, and which of its projects this
-* directory is. The environment is always a flag, and auth never lives in
-* the project. Strict, so a typo'd key is a build error rather than a
-* silently ignored setting.
+* directory is. Auth never lives in the project. Strict, so a typo'd key
+* is a build error rather than a silently ignored setting.
 */
 const cowConfigSchema = z.strictObject({
 	$schema: z.url().optional(),
@@ -385,7 +366,7 @@ const cowConfigSchema = z.strictObject({
 	webUrl: z.url().optional()
 }).meta({
 	title: "cow.json",
-	description: "A cow project: the organization and the project it deploys to."
+	description: "A cow project: the organization and the project it pushes to."
 });
 
 //#endregion
@@ -412,8 +393,8 @@ const properties = z.record(z.string(), z.unknown());
 * them. A name outside the union is rejected, never dispatched.
 *
 * Every `args` is strict, and that is the tenancy boundary made mechanical:
-* a module that returns an `orgId`, an `environment`, or any other field
-* beside the ones a capability takes fails the parse instead of having it
+* a module that returns an `orgId` or any other field beside the ones a
+* capability takes fails the parse instead of having it
 * quietly dropped. Tenant context comes from the workflow input, never from
 * guest output, and this is where saying so becomes checkable.
 */
@@ -435,12 +416,14 @@ const commandSchema = z.discriminatedUnion("name", [
 			template: journeyKeySchema,
 			props: properties,
 			/**
-			* Which sender identity this mail leaves as, by name. Required, and
-			* the guest SDK fills in the journey's own when the call does not name
-			* one, so the host has one resolution path and never has to read the
-			* manifest to find a sender.
+			* The address this mail leaves as. The guest SDK fills in the
+			* journey's own whenever the call does not name one, so the host has
+			* one resolution path and never reads the manifest to find it;
+			* absent on both is the organization's shared fallback address.
 			*/
-			senderIdentity: destinationNameSchema
+			from: fromSchema.optional(),
+			/** Where a reply to this one mail goes, instead of the from-address. */
+			replyTo: z.email().optional()
 		})
 	}),
 	z.object({
@@ -521,7 +504,7 @@ const executionLimitsSchema = z.object({
 	logLineBytes: z.number().int().positive()
 });
 const journeyStepInputSchema = z.object({
-	protocol: z.literal(2),
+	protocol: z.literal(3),
 	kind: z.literal("journey"),
 	key: journeyKeySchema,
 	event: guestEventSchema,
@@ -561,7 +544,7 @@ const journeyStepOutputSchema = z.discriminatedUnion("status", [
 	})
 ]);
 const templateRenderInputSchema = z.object({
-	protocol: z.literal(2),
+	protocol: z.literal(3),
 	kind: z.literal("template"),
 	key: journeyKeySchema,
 	props: properties
@@ -580,8 +563,7 @@ const manifestInputSchema = z.object({ kind: z.literal("manifest") });
 const manifestOutputSchema = z.discriminatedUnion("kind", [manifestJourneySchema.pick({
 	trigger: true,
 	purpose: true,
-	senderIdentity: true,
-	environments: true,
+	from: true,
 	tags: true
 }).extend({ kind: z.literal("journey") }), manifestTemplateSchema.pick({
 	sendClass: true,
@@ -637,7 +619,7 @@ const sandboxFailureCodeSchema = z.enum(SANDBOX_FAILURE_CODES);
 * to be written by hand or by an agent, not generated.
 *
 * The schema lives here rather than in packages/journeys so the CLI can reject
-* a bad file before it boots a Temporal environment, and so the docs site can
+* a bad file before it boots a Temporal dev server, and so the docs site can
 * render the format from one source.
 */
 const journeyScenarioSchema = z.object({
@@ -679,7 +661,7 @@ const journeyScenarioSchema = z.object({
 //#endregion
 //#region src/guest/journeys.ts
 /**
-* A capability that failed host-side (an unknown destination, invalid
+* A capability that failed host-side (an unknown webhook, invalid
 * props, a profile that is not there). The failure is journaled, so a
 * journey that catches it takes the same branch on every replay.
 */
@@ -693,25 +675,29 @@ var CapabilityError = class extends Error {
 };
 /**
 * The config half of a journey, validated with the same schema the release
-* manifest is validated with, so a bad trigger or a malformed purpose key
-* fails at build time rather than at the first execution. Whether the org
-* declares that purpose is a question only the deploy can answer.
+* manifest is validated with, so a bad trigger, a malformed purpose key, or
+* a `from` that is not an address fails at build time rather than at the
+* first execution. Whether the org declares that purpose, and whether it may
+* send from that domain, are questions only the push can answer.
 */
 const journeyConfigSchema = manifestJourneySchema.pick({
 	trigger: true,
 	purpose: true,
-	senderIdentity: true,
-	environments: true,
+	from: true,
 	tags: true
-}).extend({ senderIdentity: destinationNameSchema });
-/** Author a journey. Throws at definition time on an invalid config. */
+});
+/**
+* Author a journey. Throws at definition time on an invalid config.
+*
+* There is no environment gate here: an organization has one data space, and
+* a journey runs wherever it is enabled and nowhere else (ADR 0011, ADR 0013).
+*/
 function defineJourney(input) {
 	return {
 		...journeyConfigSchema.parse({
 			trigger: input.trigger,
 			purpose: input.purpose,
-			senderIdentity: input.senderIdentity,
-			environments: input.environments ?? [...ENVIRONMENTS],
+			from: input.from,
 			tags: input.tags
 		}),
 		run: input.run

package/dist/guest/journeys.d.ts

@@ -1,12 +1,11 @@
-import { n as Duration, r as GuestEvent, t as Trigger } from "./index-DAGLEHDn.js";
-import { t as Environment } from "./constants-B0wk-87t.js";
+import { n as Duration, r as GuestEvent, t as Trigger } from "./index-CXcCEcAg.js";
 //#region src/guest/journeys.d.ts
 /** The event a journey runs for, or the one a `waitForEvent` resolved with. */
 type Event = GuestEvent;
 /**
  * A profile as the capability layer hands it back: the recipient of this
- * execution (`api.profile.get()`) or another profile in the same org and
- * environment (`api.profiles.get(id)`). A fresh read on every call.
+ * execution (`api.profile.get()`) or another profile in the same org
+ * (`api.profiles.get(id)`). A fresh read on every call.
  */
 type Profile = {
   /** The Cowliss-generated profile id (`usr_`). */
@@ -24,7 +23,7 @@ type EmailSendResult = {
   status: string;
 };
 /**
- * A capability that failed host-side (an unknown destination, invalid
+ * A capability that failed host-side (an unknown webhook, invalid
  * props, a profile that is not there). The failure is journaled, so a
  * journey that catches it takes the same branch on every replay.
  */
@@ -69,11 +68,16 @@ type Api = {
       template: Key;
       props: TemplateProps<Key>;
       /**
-       * Send this one mail from a different sender identity than the
-       * journey's own. A name the organization has configured, resolved in
-       * the environment the execution is running in.
+       * Send this one mail from a different address than the journey's own:
+       * `"billing@acme.com"` or `"Billing <billing@acme.com>"`. The domain
+       * must be one your organization has verified, or the send is skipped.
        */
-      senderIdentity?: string;
+      from?: string;
+      /**
+       * Where a reply to this one mail goes, instead of the from-address.
+       * Any address: nothing is sent from it.
+       */
+      replyTo?: string;
     }): Promise<EmailSendResult>;
     webhook(args: {
       destination: string;
@@ -123,27 +127,29 @@ type JourneyConfig = {
    */
   purpose: string;
   /**
-   * The sender identity every `api.send.email` in this journey goes out as:
-   * the name of one your organization has configured, or `cowliss-default`
-   * for the address Cowliss gives you with nothing to set up. A single send
+   * The address every `api.send.email` in this journey goes out as:
+   * `"billing@acme.com"` or `"Billing <billing@acme.com>"`. A single send
    * can override it.
    *
-   * Required, and named here rather than in a settings page, so the address
-   * a journey sends from is readable in the journey's own source. It is
-   * resolved per environment, which is why it is a name and not an id.
+   * Optional: leave it out and Cowliss sends from the address it gives your
+   * organization, with nothing to set up. Named here rather than in a
+   * settings page, so the address a journey sends from is readable in the
+   * journey's own source.
    */
-  senderIdentity: string;
-  /** The author's rollout gate; defaults to every environment. */
-  environments: Environment[];
+  from?: string;
   /** The author's labels; the dashboard's only grouping. Defaults to none. */
   tags: string[];
 };
 type Journey = JourneyConfig & {
   run: (event: Event, api: Api) => Promise<void>;
 };
-/** Author a journey. Throws at definition time on an invalid config. */
-declare function defineJourney(input: Omit<JourneyConfig, "environments" | "tags"> & {
-  environments?: Environment[];
+/**
+ * Author a journey. Throws at definition time on an invalid config.
+ *
+ * There is no environment gate here: an organization has one data space, and
+ * a journey runs wherever it is enabled and nowhere else (ADR 0011, ADR 0013).
+ */
+declare function defineJourney(input: Omit<JourneyConfig, "tags"> & {
   tags?: string[];
   run: (event: Event, api: Api) => Promise<void>;
 }): Journey;

package/dist/guest/journeys.js

@@ -1,3 +1,3 @@
-import { n as defineJourney, t as CapabilityError } from "./journeys-B_xg_GnL.js";
+import { n as defineJourney, t as CapabilityError } from "./journeys-BrcKEXz0.js";
 
 export { CapabilityError, defineJourney };

package/dist/guest/wasi.js

@@ -1,4 +1,4 @@
-import { t as runGuest } from "./driver-DaNdNhuF.js";
+import { t as runGuest } from "./driver-DBt5l1Z5.js";
 
 //#region src/guest/wasi.ts
 const STDIN = 0;