@cowliss/cli 0.5.0 → 0.6.0

package/README.md

@@ -45,7 +45,6 @@ import { defineJourney } from "@cowliss/cli/journeys";
 export default defineJourney({
   trigger: { event: "checkout_started" },
   purpose: "emailMarketing",
-  senderIdentity: "cowliss-default",
   run: async (event, api) => {
     const purchased = await api.waitForEvent("purchase_completed", {
       timeout: "24h",
@@ -73,11 +72,11 @@ cow build
 # upload the project; the server compiles it
 cow push
 
-# what the server holds, and what is on where
+# what the server holds, and what is running
 cow status
 
-# turn it on, per environment
-cow enable abandoned-checkout --env development
+# turn it on
+cow enable abandoned-checkout
 ```
 
 A push creates a new version of every journey and template whose code

package/dist/guest/{driver-14FnzM-h.js → driver-DBt5l1Z5.js}

@@ -1,4 +1,4 @@
-import { a as manifestOutputSchema, i as journeyStepOutputSchema, o as templateRenderOutputSchema, r as guestInputSchema, t as CapabilityError } from "./journeys-C8j8Sqvl.js";
+import { a as manifestOutputSchema, i as journeyStepOutputSchema, o as templateRenderOutputSchema, r as guestInputSchema, t as CapabilityError } from "./journeys-BrcKEXz0.js";
 import { z } from "zod";
 import { createElement } from "react";
 import { renderToStaticMarkup } from "react-dom/server.browser";
@@ -124,7 +124,8 @@ function createApi(input, journey) {
 					args: {
 						template: args.template,
 						props: args.props,
-						senderIdentity: args.senderIdentity ?? journey.senderIdentity
+						from: args.from ?? journey.from,
+						replyTo: args.replyTo
 					}
 				}),
 				webhook: (args) => call({
@@ -5572,7 +5573,7 @@ function readManifest(module) {
 			kind: "journey",
 			trigger: journey.trigger,
 			purpose: journey.purpose,
-			senderIdentity: journey.senderIdentity,
+			from: journey.from,
 			tags: journey.tags
 		});
 	}

package/dist/guest/driver.d.ts

@@ -1,4 +1,4 @@
-import { a as ManifestOutput, i as JourneyStepOutput, o as TemplateRenderOutput } from "./index-BDj02EsQ.js";
+import { a as ManifestOutput, i as JourneyStepOutput, o as TemplateRenderOutput } from "./index-CXcCEcAg.js";
 //#region src/guest/driver.d.ts
 /**
  * The in-process driver: JSON in, JSON out (spec: Guest protocol). One

package/dist/guest/driver.js

@@ -1,3 +1,3 @@
-import { t as runGuest } from "./driver-14FnzM-h.js";
+import { t as runGuest } from "./driver-DBt5l1Z5.js";
 
 export { runGuest };

package/dist/guest/{index-BDj02EsQ.d.ts → index-CXcCEcAg.d.ts}

@@ -34,7 +34,8 @@ declare const journeyStepOutputSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     args: z.ZodObject<{
       template: z.ZodString;
       props: z.ZodRecord<z.ZodString, z.ZodUnknown>;
-      senderIdentity: z.ZodString;
+      from: z.ZodOptional<z.ZodString>;
+      replyTo: z.ZodOptional<z.ZodEmail>;
     }, z.core.$strict>;
   }, z.core.$strip>, z.ZodObject<{
     name: z.ZodLiteral<"send.webhook">;
@@ -124,7 +125,8 @@ declare const journeyStepOutputSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
       args: z.ZodObject<{
         template: z.ZodString;
         props: z.ZodRecord<z.ZodString, z.ZodUnknown>;
-        senderIdentity: z.ZodString;
+        from: z.ZodOptional<z.ZodString>;
+        replyTo: z.ZodOptional<z.ZodEmail>;
       }, z.core.$strict>;
     }, z.core.$strip>, z.ZodObject<{
       name: z.ZodLiteral<"send.webhook">;
@@ -183,7 +185,8 @@ declare const journeyStepOutputSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
       args: z.ZodObject<{
         template: z.ZodString;
         props: z.ZodRecord<z.ZodString, z.ZodUnknown>;
-        senderIdentity: z.ZodString;
+        from: z.ZodOptional<z.ZodString>;
+        replyTo: z.ZodOptional<z.ZodEmail>;
       }, z.core.$strict>;
     }, z.core.$strip>, z.ZodObject<{
       name: z.ZodLiteral<"send.webhook">;
@@ -257,7 +260,7 @@ declare const manifestOutputSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     segment: z.ZodString;
   }, z.core.$strict>]>;
   purpose: z.ZodString;
-  senderIdentity: z.ZodOptional<z.ZodString>;
+  from: z.ZodOptional<z.ZodString>;
   kind: z.ZodLiteral<"journey">;
 }, z.core.$strip>, z.ZodObject<{
   tags: z.ZodPipe<z.ZodDefault<z.ZodArray<z.ZodString>>, z.ZodTransform<string[], string[]>>;

package/dist/guest/{journeys-C8j8Sqvl.js → journeys-BrcKEXz0.js}

@@ -151,15 +151,44 @@ const triggerSchema = z.union([z.strictObject({
 	appId: patternSchema.optional()
 }), z.strictObject({ segment: z.string().min(1) })]);
 /**
-* A destination's name: the token a journey addresses it by, in a
-* `send.webhook` call or a journey's `senderIdentity`.
+* The address half of a from-header: a local part, an `@`, and a dotted
+* domain. Deliberately narrower than RFC 5322 (no quoted local parts, no
+* address literals): every character it refuses would have to be quoted or
+* escaped to survive a header, and none of them belong in an address a
+* journey sends from.
+*/
+const FROM_ADDRESS = /^[^\s@<>",;]+@([^\s@<>",;.]+(?:\.[^\s@<>",;.]+)+)$/;
+/**
+* Parse a journey's or a send's `from`: `addr@domain`, or
+* `Name <addr@domain>` with the name optionally quoted. Null when it is
+* neither, which is what `cow build` refuses on and what the send-time
+* domain gate turns into a skip.
 *
-* Defined here rather than beside the destinations contract, and imported
-* from here by it, because a journey manifest names one and the guest layer
-* is bundled into every tenant module: importing it the other way round
-* would pull the Drizzle destinations table into all of them.
+* One parser, and the send facade reuses it. A control character anywhere is
+* a refusal rather than something to strip: it survives quoting and would
+* inject a second header.
+*/
+function parseFromAddress(from) {
+	const text = from.trim();
+	if (/\p{Cc}/u.test(text)) return null;
+	const angled = /^(.*?)\s*<([^<>]*)>$/.exec(text);
+	const address = (angled?.[2] ?? text).trim();
+	const domain = FROM_ADDRESS.exec(address)?.[1];
+	if (!domain) return null;
+	const name = (angled?.[1] ?? "").trim().replace(/^"(.*)"$/s, "$1").replace(/\\(.)/g, "$1").trim();
+	return {
+		...name ? { name } : {},
+		address,
+		domain: domain.toLowerCase()
+	};
+}
+/**
+* The address a journey or one send leaves as: a string, not the name of a
+* configured row (ADR 0014). The domain is checked against the
+* organization's verified ones at push time and again at send time; the
+* shape is all that is checked here, because it is all a build can know.
 */
-const destinationNameSchema = z.string().trim().min(1, "name is required").max(100, "name must be at most 100 characters");
+const fromSchema = z.string().trim().max(200, "from must be at most 200 characters").refine((value) => parseFromAddress(value) !== null, { message: "from must be an address (\"billing@acme.com\") or a name and address (\"Billing <billing@acme.com>\")" });
 /** A content address: `sha256:` plus the lowercase hex digest. */
 const digestSchema = z.string().regex(/^sha256:[0-9a-f]{64}$/, "digest must be sha256:<64 hex>");
 /**
@@ -195,13 +224,6 @@ const SPINE_ENTRY_NAMES = [
 const spineEntrySchema = z.object({
 	name: z.enum(SPINE_ENTRY_NAMES),
 	detail: z.string().max(200).optional(),
-	/**
-	* The sender identity a `send.email` call named for itself, overriding
-	* the journey's own. Present only when the author wrote one on the call,
-	* which is what lets the deploy warning and the journey detail page name
-	* the override without re-reading the code.
-	*/
-	senderIdentity: z.string().max(100).optional(),
 	/** A `waitForEvent` timeout, as the author wrote it. */
 	timeout: z.string().max(50).optional(),
 	get steps() {
@@ -213,10 +235,10 @@ const spineEntrySchema = z.object({
 }).meta({ id: "JourneySpineEntry" });
 /**
 * One journey in a stored manifest. A plain (non-strict) object on purpose:
-* a manifest pushed before the author's rollout gate went away still carries
-* `environments`, and every stored manifest has to keep parsing for good
-* (ADR 0011). Zod strips the key, and the journey runs wherever the
-* per-environment enabled flag says it runs, which is the one gate there is.
+* a manifest pushed before the author's rollout gate went away still
+* carries keys that no longer exist, and every stored manifest has to keep
+* parsing for good (ADR 0011). Zod strips them, and the journey runs when
+* its `enabled` flag says so, which is the one gate there is.
 */
 const manifestJourneySchema = z.object({
 	key: journeyKeySchema,
@@ -230,16 +252,12 @@ const manifestJourneySchema = z.object({
 	*/
 	purpose: consentPurposeKeySchema,
 	/**
-	* The sender identity every `send.email` in this journey goes out as,
-	* unless the call names its own. A name, never a `dst_` id: an org has one
-	* row per environment, so an id would send in production and fail in
-	* development, which is the one thing a journey must not do.
-	*
-	* Optional here and required at `defineJourney`, exactly like `purposes`: a
-	* version pushed before the field existed carries none and its stored
-	* manifest still parses. The author's build is where the error is useful.
+	* The address every `send.email` in this journey goes out as, unless the
+	* call names its own. Optional everywhere: an omitted one is the
+	* organization's shared fallback address, which is what makes day-one
+	* sending zero-config (ADR 0014).
 	*/
-	senderIdentity: destinationNameSchema.optional(),
+	from: fromSchema.optional(),
 	spine: z.array(spineEntrySchema),
 	bundle: digestSchema
 });
@@ -319,9 +337,8 @@ const versionManifestSchema = z.union([manifestJourneySchema, manifestTemplateSc
 const projectNameSchema = z.string().trim().min(1).max(200);
 /**
 * `cow.json` (spec: Project layout): the org, and which of its projects this
-* directory is. The environment is always a flag, and auth never lives in
-* the project. Strict, so a typo'd key is a build error rather than a
-* silently ignored setting.
+* directory is. Auth never lives in the project. Strict, so a typo'd key
+* is a build error rather than a silently ignored setting.
 */
 const cowConfigSchema = z.strictObject({
 	$schema: z.url().optional(),
@@ -376,8 +393,8 @@ const properties = z.record(z.string(), z.unknown());
 * them. A name outside the union is rejected, never dispatched.
 *
 * Every `args` is strict, and that is the tenancy boundary made mechanical:
-* a module that returns an `orgId`, an `environment`, or any other field
-* beside the ones a capability takes fails the parse instead of having it
+* a module that returns an `orgId` or any other field beside the ones a
+* capability takes fails the parse instead of having it
 * quietly dropped. Tenant context comes from the workflow input, never from
 * guest output, and this is where saying so becomes checkable.
 */
@@ -399,12 +416,14 @@ const commandSchema = z.discriminatedUnion("name", [
 			template: journeyKeySchema,
 			props: properties,
 			/**
-			* Which sender identity this mail leaves as, by name. Required, and
-			* the guest SDK fills in the journey's own when the call does not name
-			* one, so the host has one resolution path and never has to read the
-			* manifest to find a sender.
+			* The address this mail leaves as. The guest SDK fills in the
+			* journey's own whenever the call does not name one, so the host has
+			* one resolution path and never reads the manifest to find it;
+			* absent on both is the organization's shared fallback address.
 			*/
-			senderIdentity: destinationNameSchema
+			from: fromSchema.optional(),
+			/** Where a reply to this one mail goes, instead of the from-address. */
+			replyTo: z.email().optional()
 		})
 	}),
 	z.object({
@@ -485,7 +504,7 @@ const executionLimitsSchema = z.object({
 	logLineBytes: z.number().int().positive()
 });
 const journeyStepInputSchema = z.object({
-	protocol: z.literal(2),
+	protocol: z.literal(3),
 	kind: z.literal("journey"),
 	key: journeyKeySchema,
 	event: guestEventSchema,
@@ -525,7 +544,7 @@ const journeyStepOutputSchema = z.discriminatedUnion("status", [
 	})
 ]);
 const templateRenderInputSchema = z.object({
-	protocol: z.literal(2),
+	protocol: z.literal(3),
 	kind: z.literal("template"),
 	key: journeyKeySchema,
 	props: properties
@@ -544,7 +563,7 @@ const manifestInputSchema = z.object({ kind: z.literal("manifest") });
 const manifestOutputSchema = z.discriminatedUnion("kind", [manifestJourneySchema.pick({
 	trigger: true,
 	purpose: true,
-	senderIdentity: true,
+	from: true,
 	tags: true
 }).extend({ kind: z.literal("journey") }), manifestTemplateSchema.pick({
 	sendClass: true,
@@ -600,7 +619,7 @@ const sandboxFailureCodeSchema = z.enum(SANDBOX_FAILURE_CODES);
 * to be written by hand or by an agent, not generated.
 *
 * The schema lives here rather than in packages/journeys so the CLI can reject
-* a bad file before it boots a Temporal environment, and so the docs site can
+* a bad file before it boots a Temporal dev server, and so the docs site can
 * render the format from one source.
 */
 const journeyScenarioSchema = z.object({
@@ -642,7 +661,7 @@ const journeyScenarioSchema = z.object({
 //#endregion
 //#region src/guest/journeys.ts
 /**
-* A capability that failed host-side (an unknown destination, invalid
+* A capability that failed host-side (an unknown webhook, invalid
 * props, a profile that is not there). The failure is journaled, so a
 * journey that catches it takes the same branch on every replay.
 */
@@ -656,29 +675,29 @@ var CapabilityError = class extends Error {
 };
 /**
 * The config half of a journey, validated with the same schema the release
-* manifest is validated with, so a bad trigger or a malformed purpose key
-* fails at build time rather than at the first execution. Whether the org
-* declares that purpose is a question only the deploy can answer.
+* manifest is validated with, so a bad trigger, a malformed purpose key, or
+* a `from` that is not an address fails at build time rather than at the
+* first execution. Whether the org declares that purpose, and whether it may
+* send from that domain, are questions only the push can answer.
 */
 const journeyConfigSchema = manifestJourneySchema.pick({
 	trigger: true,
 	purpose: true,
-	senderIdentity: true,
+	from: true,
 	tags: true
-}).extend({ senderIdentity: destinationNameSchema });
+});
 /**
 * Author a journey. Throws at definition time on an invalid config.
 *
-* There is no environment gate here: a journey runs wherever it is enabled,
-* and nowhere else (ADR 0011). A source that still passes `environments` is
-* a typecheck error in `cow build`, which is where the author can fix it.
+* There is no environment gate here: an organization has one data space, and
+* a journey runs wherever it is enabled and nowhere else (ADR 0011, ADR 0013).
 */
 function defineJourney(input) {
 	return {
 		...journeyConfigSchema.parse({
 			trigger: input.trigger,
 			purpose: input.purpose,
-			senderIdentity: input.senderIdentity,
+			from: input.from,
 			tags: input.tags
 		}),
 		run: input.run

package/dist/guest/journeys.d.ts

@@ -1,11 +1,11 @@
-import { n as Duration, r as GuestEvent, t as Trigger } from "./index-BDj02EsQ.js";
+import { n as Duration, r as GuestEvent, t as Trigger } from "./index-CXcCEcAg.js";
 //#region src/guest/journeys.d.ts
 /** The event a journey runs for, or the one a `waitForEvent` resolved with. */
 type Event = GuestEvent;
 /**
  * A profile as the capability layer hands it back: the recipient of this
- * execution (`api.profile.get()`) or another profile in the same org and
- * environment (`api.profiles.get(id)`). A fresh read on every call.
+ * execution (`api.profile.get()`) or another profile in the same org
+ * (`api.profiles.get(id)`). A fresh read on every call.
  */
 type Profile = {
   /** The Cowliss-generated profile id (`usr_`). */
@@ -23,7 +23,7 @@ type EmailSendResult = {
   status: string;
 };
 /**
- * A capability that failed host-side (an unknown destination, invalid
+ * A capability that failed host-side (an unknown webhook, invalid
  * props, a profile that is not there). The failure is journaled, so a
  * journey that catches it takes the same branch on every replay.
  */
@@ -68,11 +68,16 @@ type Api = {
       template: Key;
       props: TemplateProps<Key>;
       /**
-       * Send this one mail from a different sender identity than the
-       * journey's own. A name the organization has configured, resolved in
-       * the environment the execution is running in.
+       * Send this one mail from a different address than the journey's own:
+       * `"billing@acme.com"` or `"Billing <billing@acme.com>"`. The domain
+       * must be one your organization has verified, or the send is skipped.
        */
-      senderIdentity?: string;
+      from?: string;
+      /**
+       * Where a reply to this one mail goes, instead of the from-address.
+       * Any address: nothing is sent from it.
+       */
+      replyTo?: string;
     }): Promise<EmailSendResult>;
     webhook(args: {
       destination: string;
@@ -122,16 +127,16 @@ type JourneyConfig = {
    */
   purpose: string;
   /**
-   * The sender identity every `api.send.email` in this journey goes out as:
-   * the name of one your organization has configured, or `cowliss-default`
-   * for the address Cowliss gives you with nothing to set up. A single send
+   * The address every `api.send.email` in this journey goes out as:
+   * `"billing@acme.com"` or `"Billing <billing@acme.com>"`. A single send
    * can override it.
    *
-   * Required, and named here rather than in a settings page, so the address
-   * a journey sends from is readable in the journey's own source. It is
-   * resolved per environment, which is why it is a name and not an id.
+   * Optional: leave it out and Cowliss sends from the address it gives your
+   * organization, with nothing to set up. Named here rather than in a
+   * settings page, so the address a journey sends from is readable in the
+   * journey's own source.
    */
-  senderIdentity: string;
+  from?: string;
   /** The author's labels; the dashboard's only grouping. Defaults to none. */
   tags: string[];
 };
@@ -141,9 +146,8 @@ type Journey = JourneyConfig & {
 /**
  * Author a journey. Throws at definition time on an invalid config.
  *
- * There is no environment gate here: a journey runs wherever it is enabled,
- * and nowhere else (ADR 0011). A source that still passes `environments` is
- * a typecheck error in `cow build`, which is where the author can fix it.
+ * There is no environment gate here: an organization has one data space, and
+ * a journey runs wherever it is enabled and nowhere else (ADR 0011, ADR 0013).
  */
 declare function defineJourney(input: Omit<JourneyConfig, "tags"> & {
   tags?: string[];

package/dist/guest/journeys.js

@@ -1,3 +1,3 @@
-import { n as defineJourney, t as CapabilityError } from "./journeys-C8j8Sqvl.js";
+import { n as defineJourney, t as CapabilityError } from "./journeys-BrcKEXz0.js";
 
 export { CapabilityError, defineJourney };

package/dist/guest/wasi.js

@@ -1,4 +1,4 @@
-import { t as runGuest } from "./driver-14FnzM-h.js";
+import { t as runGuest } from "./driver-DBt5l1Z5.js";
 
 //#region src/guest/wasi.ts
 const STDIN = 0;