@cowliss/cli 0.5.0 → 0.7.0

package/dist/guest/{journeys-C8j8Sqvl.js → journeys-Dpsp225V.js}

@@ -9,16 +9,24 @@ const DOCS_URL = "https://docs.cowliss.com";
 */
 const CLERK_ORG_SUBJECT_PREFIX = "org_";
 /**
-* Fixed consent purposes for the prototype. Consent is a per-purpose map on
-* the profile, checked at send-step execution time.
-*
-* The two names describe what the recipient agreed to, not the pipe it
-* arrives on: "emails I did not ask for individually" and "my data leaving
-* for somewhere else". Naming them after the channel (`email`, `webhook`)
-* said nothing a recipient could consent to, and transactional mail already
-* bypasses the email purpose, so it was only ever marketing consent.
+* The marketing purpose by name, since it is the one every gate, the
+* unsubscribe route, and the developer's own toggle all reach for.
+*/
+const MARKETING = "marketing";
+/**
+* A legal journey `purpose` that is not a consent purpose: the send gates
+* pass it unconditionally, no profile's map stores it and no editor renders
+* it. What protects the channel itself (suppression, the SES gates, the
+* quota) still applies.
 */
-const CONSENT_PURPOSES = ["emailMarketing", "dataProcessing"];
+const TRANSACTIONAL = "transactional";
+/**
+* The purposes a project may not declare, which are the same two that sit
+* outside the `marketing` umbrella: `marketing` is the umbrella itself and
+* `transactional` is the case consent does not govern. Everything a project
+* declares is a marketing-mail category and so sits under it.
+*/
+const RESERVED_PURPOSES = [MARKETING, TRANSACTIONAL];
 /**
 * The two classes of send, declared on the template rather than passed per
 * call so the class cannot drift between two sends of the same message.
@@ -56,6 +64,92 @@ const PUSH_LIMITS = {
 const COW_CONFIG_SCHEMA_PATH = "/schemas/cow.json";
 const COW_CONFIG_SCHEMA_URL = `${DOCS_URL}${COW_CONFIG_SCHEMA_PATH}`;
 
+//#endregion
+//#region ../../packages/shared/src/segment-definition.ts
+/**
+* A segment definition: a flat list of predicates over traits and event
+* history, combined with `all` or `any`. Deliberately flat — nested predicate groups are YAGNI for the
+* prototype, and a flat list keeps the pure evaluator a fold.
+*
+* `appId` scopes the EVENT side of a definition only. Traits are
+* per-profile and profiles merge across apps, so there is nothing
+* app-shaped to filter on the trait side.
+*
+* A definition and the membership it produces are both the
+* organization's.
+*
+* Apart from `./segments` because a journey's trigger carries a definition
+* and the trigger schema is bundled into the wasm guest, where an edge to
+* `@cowliss/db` (which `./segments` has, for the row schema) is a hard
+* bundler failure. Nothing here imports anything but zod.
+*
+* The object is strict: a definition holding the retired `sourceId` key
+* (which meant the app) fails loudly instead of parsing as an unfiltered
+* definition that evaluates over every app. There is deliberately no pipe
+* filter here — filtering by source is a later feature, and accepting one
+* now would make a stale `sourceId` parse as a filter on a pipe that does
+* not exist and silently match nothing.
+*/
+const SEGMENT_TRAIT_OPS = [
+	"eq",
+	"neq",
+	"gt",
+	"gte",
+	"lt",
+	"lte",
+	"exists",
+	"notExists",
+	"contains"
+];
+/** Operators that read no comparison value: presence of the key is the test. */
+const VALUELESS_TRAIT_OPS = ["exists", "notExists"];
+const predicateNameSchema = z.string().trim().min(1, "predicate name is required").max(200);
+const segmentPredicateSchema = z.discriminatedUnion("kind", [z.object({
+	kind: z.literal("trait"),
+	name: predicateNameSchema,
+	op: z.enum(SEGMENT_TRAIT_OPS),
+	/**
+	* Compared against the stored trait, which is `unknown` because
+	* identify accepts arbitrary JSON. The evaluator coerces both sides
+	* before comparing, so authors here (CLI, MCP, dashboard) get the
+	* form-field-friendly reading rather than strict JSON equality:
+	* numeric-looking strings are compared as numbers for eq/neq and for
+	* ordering ("150" matches 150, and orders like it), and "true"/"false"
+	* are compared as booleans for eq/neq, trimmed and case-insensitively
+	* (" TRUE " reads as true). Coercion needs both sides to agree on a
+	* type: "0" never equals false. The numeric net is as wide as
+	* `Number()`, so "0x64", "0b11" and "1e2" read as numbers too, which
+	* matters most for opaque ids: "007" is authored as the number 7.
+	*
+	* contains reads three ways. Against an array trait it is membership
+	* under that same equality, so "true" matches `[true]` and "1" matches
+	* `[1, 2]`. Against a string trait it is a plain substring search with
+	* no coercion, since substrings only mean something between strings.
+	* Against anything else it never matches. Ordering never coerces
+	* booleans.
+	*/
+	value: z.unknown().optional()
+}), z.object({
+	kind: z.literal("event"),
+	name: predicateNameSchema,
+	op: z.enum(["performed", "notPerformed"]),
+	/** How many matching events the predicate counts as "performed". */
+	atLeast: z.number().int().min(1).default(1),
+	/** Rolling window, relative to evaluation time; absent means all history. */
+	withinDays: z.number().int().min(1).optional()
+})]).refine((predicate) => predicate.kind !== "trait" || VALUELESS_TRAIT_OPS.includes(predicate.op) || predicate.value !== void 0, { message: "value is required unless op is exists or notExists" });
+const appIdSchema = z.string().trim().min(1);
+const segmentDefinitionSchema = z.strictObject({
+	match: z.enum(["all", "any"]).default("all"),
+	/**
+	* Optional app filter over the event side; null/absent spans apps.
+	* A list matches any of the named apps, which is how one definition
+	* names the development and the production id of the same app.
+	*/
+	appId: z.union([appIdSchema, z.array(appIdSchema).min(1)]).nullish(),
+	predicates: z.array(segmentPredicateSchema).min(1, "at least one predicate is required")
+});
+
 //#endregion
 //#region ../../packages/shared/src/journeys-v2/manifest.ts
 /**
@@ -65,6 +159,34 @@ const COW_CONFIG_SCHEMA_URL = `${DOCS_URL}${COW_CONFIG_SCHEMA_PATH}`;
 * changed, and stores that entry on the version it creates.
 */
 /**
+* A duration as journey code writes it: an ms-style string ("2d") or
+* milliseconds. It lives here rather than with the guest protocol because a
+* manifest carries one too (a journey's enrollment cooldown) and `./guest`
+* already imports this module, so the other direction would be a cycle.
+*/
+const durationSchema = z.union([z.string().min(1), z.number().int().nonnegative()]);
+const DURATION_PATTERN = /^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d|w)$/;
+const DURATION_UNIT_MS = {
+	ms: 1,
+	s: 1e3,
+	m: 6e4,
+	h: 36e5,
+	d: 864e5,
+	w: 6048e5
+};
+/**
+* A duration in milliseconds. The simulator's virtual clock and the runner's
+* timers both need it, and neither may pull in Temporal's `msToNumber` (one
+* runs in the CLI, the other inside workflow code).
+*/
+function parseDuration(duration) {
+	if (typeof duration === "number") return duration;
+	const match = DURATION_PATTERN.exec(duration.trim());
+	if (!match) throw new Error(`Duration ${JSON.stringify(duration)} is not a duration: use milliseconds or an ms-style string like "1h" or "2d".`);
+	const unit = DURATION_UNIT_MS[match[2]];
+	return Math.round(Number(match[1]) * unit);
+}
+/**
 * A journey or template key: the file basename under `journeys/` or
 * `emails/`, kebab-case and unique across the project. Becomes part of the
 * Temporal workflow id and travels in the journey chain, so it stays short.
@@ -85,8 +207,8 @@ const journeyKeySchema = z.string().max(64).regex(JOURNEY_KEY_PATTERN, "key must
 */
 const tagsSchema = z.array(z.string().trim().min(1).max(50, "a tag must be at most 50 characters")).max(20, "a journey or template takes at most 20 tags").default([]).transform((tags) => [...new Set(tags)]);
 /**
-* A consent purpose key: camelCase, matching the fixed `emailMarketing` and
-* `dataProcessing`. Purposes are keys in the `consent` map a customer reads
+* A consent purpose key: camelCase, matching the reserved `marketing` and
+* `transactional`. Purposes are keys in the `consent` map a customer reads
 * on their own profile, which is why they are not the kebab-case of a
 * journey key.
 */
@@ -101,22 +223,22 @@ const CONSENT_PURPOSE_KEY_PATTERN = /^[a-z][a-zA-Z0-9]*$/;
 const consentPurposeKeySchema = z.string().max(50, "a purpose key must be at most 50 characters").regex(CONSENT_PURPOSE_KEY_PATTERN, "a consent purpose key must be camelCase (a letter first, then letters and digits)");
 /**
 * One purpose a project declares in `cow.json` (spec: Decisions). A declared
-* purpose is marketing-class and sits under the `emailMarketing` umbrella,
-* so `denied` is the only default it may carry: the purpose is absent on
-* every profile that already exists, and a granted default would answer for
-* all of them at once.
+* purpose is marketing-class and sits under the `marketing` umbrella, so
+* `denied` is the only default it may carry: the purpose is absent on every
+* profile that already exists, and a granted default would answer for all of
+* them at once.
 *
 * The field stays required rather than disappearing, so every `cow.json` and
-* every stored manifest written before this still parses, and the column
-* behind it still holds `granted` for the seeded `dataProcessing` row: this
-* is a refusal at declaration time, not a narrower storage shape.
+* every stored manifest written before this still parses: this is a refusal
+* at declaration time, not a narrower storage shape.
 *
-* The two fixed purposes cannot be declared. They are seeded for every org
-* and owned by no project, so a project redeclaring one would be renaming
-* the master switch every other project's journeys hang off.
+* Neither reserved purpose can be declared: `marketing` is the master switch
+* every other project's journeys hang off, and `transactional` is not a
+* consent purpose at all, so declaring it would promise a switch that no
+* send ever reads.
 */
 const declaredPurposeSchema = z.strictObject({
-	key: consentPurposeKeySchema.refine((key) => !CONSENT_PURPOSES.includes(key), `${CONSENT_PURPOSES.join(" and ")} are fixed purposes and cannot be declared`),
+	key: consentPurposeKeySchema.refine((key) => !RESERVED_PURPOSES.includes(key), `${RESERVED_PURPOSES.join(" and ")} are reserved purposes and cannot be declared`),
 	/** What the dashboard and the account modal render beside the switch. */
 	label: z.string().trim().min(1).max(50, "a purpose label must be at most 50 characters"),
 	/** What the purpose means for a profile whose map does not answer it. */
@@ -138,28 +260,65 @@ const onePatternSchema = z.string().min(1).max(200, "a pattern must be at most 2
 const patternSchema = z.union([onePatternSchema, z.array(onePatternSchema).min(1).max(20, "a matcher takes at most 20 patterns")]);
 /**
 * What starts a journey: an event (optionally narrowed to an app id or a
-* list of them) or a segment entry. The registry DTO in `../journeys`
-* reuses it.
+* list of them), or entry into the segment the trigger itself describes.
+* The registry DTO in `../journeys` reuses it.
+*
+* A segment trigger carries the predicate list, not a name: the push
+* materializes one segment row per journey that inlines a definition, owned
+* by the journey and named after its key, so the segment exists because the
+* journey exists and there is no order to get wrong (ADR 0016). The
+* definition is data — validated here, carried on the version, never
+* compiled and never executed.
 *
-* Both members are strict, so a journey holding the retired `source` key
-* fails to compile instead of silently triggering on every app.
-* There is deliberately no pipe filter: a trigger narrows by the app the
-* write is attributed to, the same token a segment definition names.
+* Both members are strict, so a journey holding the retired `source` key, or
+* the retired `{ segment: "name" }` form, fails to build instead of silently
+* triggering on every app or on nothing. There is deliberately no pipe
+* filter: a trigger narrows by the app the write is attributed to, the same
+* token a segment definition names.
 */
 const triggerSchema = z.union([z.strictObject({
 	event: patternSchema,
 	appId: patternSchema.optional()
-}), z.strictObject({ segment: z.string().min(1) })]);
+}), z.strictObject({ segment: segmentDefinitionSchema })]);
+/**
+* The address half of a from-header: a local part, an `@`, and a dotted
+* domain. Deliberately narrower than RFC 5322 (no quoted local parts, no
+* address literals): every character it refuses would have to be quoted or
+* escaped to survive a header, and none of them belong in an address a
+* journey sends from.
+*/
+const FROM_ADDRESS = /^[^\s@<>",;]+@([^\s@<>",;.]+(?:\.[^\s@<>",;.]+)+)$/;
 /**
-* A destination's name: the token a journey addresses it by, in a
-* `send.webhook` call or a journey's `senderIdentity`.
+* Parse a journey's or a send's `from`: `addr@domain`, or
+* `Name <addr@domain>` with the name optionally quoted. Null when it is
+* neither, which is what `cow build` refuses on and what the send-time
+* domain gate turns into a skip.
 *
-* Defined here rather than beside the destinations contract, and imported
-* from here by it, because a journey manifest names one and the guest layer
-* is bundled into every tenant module: importing it the other way round
-* would pull the Drizzle destinations table into all of them.
+* One parser, and the send facade reuses it. A control character anywhere is
+* a refusal rather than something to strip: it survives quoting and would
+* inject a second header.
+*/
+function parseFromAddress(from) {
+	const text = from.trim();
+	if (/\p{Cc}/u.test(text)) return null;
+	const angled = /^(.*?)\s*<([^<>]*)>$/.exec(text);
+	const address = (angled?.[2] ?? text).trim();
+	const domain = FROM_ADDRESS.exec(address)?.[1];
+	if (!domain) return null;
+	const name = (angled?.[1] ?? "").trim().replace(/^"(.*)"$/s, "$1").replace(/\\(.)/g, "$1").trim();
+	return {
+		...name ? { name } : {},
+		address,
+		domain: domain.toLowerCase()
+	};
+}
+/**
+* The address a journey or one send leaves as: a string, not the name of a
+* configured row (ADR 0014). The domain is checked against the
+* organization's verified ones at push time and again at send time; the
+* shape is all that is checked here, because it is all a build can know.
 */
-const destinationNameSchema = z.string().trim().min(1, "name is required").max(100, "name must be at most 100 characters");
+const fromSchema = z.string().trim().max(200, "from must be at most 200 characters").refine((value) => parseFromAddress(value) !== null, { message: "from must be an address (\"billing@acme.com\") or a name and address (\"Billing <billing@acme.com>\")" });
 /** A content address: `sha256:` plus the lowercase hex digest. */
 const digestSchema = z.string().regex(/^sha256:[0-9a-f]{64}$/, "digest must be sha256:<64 hex>");
 /**
@@ -195,13 +354,6 @@ const SPINE_ENTRY_NAMES = [
 const spineEntrySchema = z.object({
 	name: z.enum(SPINE_ENTRY_NAMES),
 	detail: z.string().max(200).optional(),
-	/**
-	* The sender identity a `send.email` call named for itself, overriding
-	* the journey's own. Present only when the author wrote one on the call,
-	* which is what lets the deploy warning and the journey detail page name
-	* the override without re-reading the code.
-	*/
-	senderIdentity: z.string().max(100).optional(),
 	/** A `waitForEvent` timeout, as the author wrote it. */
 	timeout: z.string().max(50).optional(),
 	get steps() {
@@ -213,10 +365,10 @@ const spineEntrySchema = z.object({
 }).meta({ id: "JourneySpineEntry" });
 /**
 * One journey in a stored manifest. A plain (non-strict) object on purpose:
-* a manifest pushed before the author's rollout gate went away still carries
-* `environments`, and every stored manifest has to keep parsing for good
-* (ADR 0011). Zod strips the key, and the journey runs wherever the
-* per-environment enabled flag says it runs, which is the one gate there is.
+* a manifest pushed before the author's rollout gate went away still
+* carries keys that no longer exist, and every stored manifest has to keep
+* parsing for good (ADR 0011). Zod strips them, and the journey runs when
+* its `enabled` flag says so, which is the one gate there is.
 */
 const manifestJourneySchema = z.object({
 	key: journeyKeySchema,
@@ -230,16 +382,37 @@ const manifestJourneySchema = z.object({
 	*/
 	purpose: consentPurposeKeySchema,
 	/**
-	* The sender identity every `send.email` in this journey goes out as,
-	* unless the call names its own. A name, never a `dst_` id: an org has one
-	* row per environment, so an id would send in production and fail in
-	* development, which is the one thing a journey must not do.
-	*
-	* Optional here and required at `defineJourney`, exactly like `purposes`: a
-	* version pushed before the field existed carries none and its stored
-	* manifest still parses. The author's build is where the error is useful.
+	* How often one recipient may enter. Enrollment derives from the purpose
+	* (ADR 0015), so the only thing an author writes is how long after a
+	* completed run the journey re-opens: absent means once, ever. Refused on
+	* a transactional journey, which enrolls on every trigger — see
+	* `manifestSchema` below, where the cross-field check lives (a refinement
+	* on this object would break the `.pick()` the guest SDK and the guest
+	* protocol both take of it).
+	*/
+	enrollment: z.strictObject({ cooldown: durationSchema.refine((value) => {
+		try {
+			parseDuration(value);
+			return true;
+		} catch {
+			return false;
+		}
+	}, "a cooldown must be milliseconds or an ms-style string like \"7d\"") }).optional(),
+	/**
+	* The author's own sentence about what this journey does, shown wherever
+	* the journey is read. Capped like a segment's description; absent when
+	* the author wrote none.
+	*/
+	description: z.string().trim().max(500, `description must be at most ${500} characters`).optional(),
+	/**
+	* The address every `send.email` in this journey goes out as, unless the
+	* call names its own. Required of the author (`defineJourney` types it so,
+	* and `cow build` refuses a journey without it), and still optional here:
+	* releases pushed before ADR 0014 was amended carry none, and this schema
+	* parses stored manifests as well as new ones. A push with no `from` is
+	* refused by the domain gate, which says what to do about it.
 	*/
-	senderIdentity: destinationNameSchema.optional(),
+	from: fromSchema.optional(),
 	spine: z.array(spineEntrySchema),
 	bundle: digestSchema
 });
@@ -250,6 +423,13 @@ const manifestTemplateSchema = z.object({
 	sendClass: z.enum(SEND_CLASSES),
 	/** True asks the host to mint a signed `verifyUrl` prop at send time. */
 	verifyLink: z.boolean(),
+	/**
+	* True asks the host to mint a signed `unsubscribeUrl` prop at send time,
+	* for the author's own footer link. Default false: a marketing send whose
+	* HTML carries no unsubscribe link at all still gets one, appended as a
+	* platform footer, so the link is never the author's to forget.
+	*/
+	unsubscribeLink: z.boolean().default(false),
 	/** JSON Schema of the template's `props`, converted by `cow build`. */
 	propsSchema: z.record(z.string(), z.unknown()),
 	bundle: digestSchema
@@ -300,6 +480,15 @@ const manifestSchema = z.object({
 	uniqueKeys(manifest.journeys, ctx, "journeys");
 	uniqueKeys(manifest.templates, ctx, "templates");
 	uniqueKeys(manifest.purposes ?? [], ctx, "purposes");
+	for (const [index, journey] of manifest.journeys.entries()) if (journey.enrollment && journey.purpose === "transactional") ctx.addIssue({
+		code: "custom",
+		message: `journey "${journey.key}": a transactional journey enrolls on every trigger, so it takes no enrollment cooldown`,
+		path: [
+			"journeys",
+			index,
+			"enrollment"
+		]
+	});
 });
 /**
 * One entry of a stored manifest: what a version is a snapshot of. Journeys
@@ -319,9 +508,8 @@ const versionManifestSchema = z.union([manifestJourneySchema, manifestTemplateSc
 const projectNameSchema = z.string().trim().min(1).max(200);
 /**
 * `cow.json` (spec: Project layout): the org, and which of its projects this
-* directory is. The environment is always a flag, and auth never lives in
-* the project. Strict, so a typo'd key is a build error rather than a
-* silently ignored setting.
+* directory is. Auth never lives in the project. Strict, so a typo'd key
+* is a build error rather than a silently ignored setting.
 */
 const cowConfigSchema = z.strictObject({
 	$schema: z.url().optional(),
@@ -360,8 +548,6 @@ const cowConfigSchema = z.strictObject({
 * a guest returns with these schemas before anything acts on it; the guest
 * SDK and the Node simulator produce and consume the same shapes.
 */
-/** A duration as journey code writes it: an ms-style string ("2d") or milliseconds. */
-const durationSchema = z.union([z.string().min(1), z.number().int().nonnegative()]);
 /** The event a journey runs for, or waits on: name, properties, and when. */
 const guestEventSchema = z.object({
 	name: z.string().min(1),
@@ -376,8 +562,8 @@ const properties = z.record(z.string(), z.unknown());
 * them. A name outside the union is rejected, never dispatched.
 *
 * Every `args` is strict, and that is the tenancy boundary made mechanical:
-* a module that returns an `orgId`, an `environment`, or any other field
-* beside the ones a capability takes fails the parse instead of having it
+* a module that returns an `orgId` or any other field beside the ones a
+* capability takes fails the parse instead of having it
 * quietly dropped. Tenant context comes from the workflow input, never from
 * guest output, and this is where saying so becomes checkable.
 */
@@ -399,12 +585,15 @@ const commandSchema = z.discriminatedUnion("name", [
 			template: journeyKeySchema,
 			props: properties,
 			/**
-			* Which sender identity this mail leaves as, by name. Required, and
-			* the guest SDK fills in the journey's own when the call does not name
-			* one, so the host has one resolution path and never has to read the
-			* manifest to find a sender.
+			* The address this mail leaves as. The guest SDK fills in the
+			* journey's own whenever the call does not name one, so the host has
+			* one resolution path and never reads the manifest to find it. A
+			* journey must name one, so absent on both is a release pushed before
+			* that was true, and the `domain` gate refuses it.
 			*/
-			senderIdentity: destinationNameSchema
+			from: fromSchema.optional(),
+			/** Where a reply to this one mail goes, instead of the from-address. */
+			replyTo: z.email().optional()
 		})
 	}),
 	z.object({
@@ -485,7 +674,7 @@ const executionLimitsSchema = z.object({
 	logLineBytes: z.number().int().positive()
 });
 const journeyStepInputSchema = z.object({
-	protocol: z.literal(2),
+	protocol: z.literal(3),
 	kind: z.literal("journey"),
 	key: journeyKeySchema,
 	event: guestEventSchema,
@@ -525,7 +714,7 @@ const journeyStepOutputSchema = z.discriminatedUnion("status", [
 	})
 ]);
 const templateRenderInputSchema = z.object({
-	protocol: z.literal(2),
+	protocol: z.literal(3),
 	kind: z.literal("template"),
 	key: journeyKeySchema,
 	props: properties
@@ -544,11 +733,14 @@ const manifestInputSchema = z.object({ kind: z.literal("manifest") });
 const manifestOutputSchema = z.discriminatedUnion("kind", [manifestJourneySchema.pick({
 	trigger: true,
 	purpose: true,
-	senderIdentity: true,
+	enrollment: true,
+	description: true,
+	from: true,
 	tags: true
 }).extend({ kind: z.literal("journey") }), manifestTemplateSchema.pick({
 	sendClass: true,
 	verifyLink: true,
+	unsubscribeLink: true,
 	propsSchema: true,
 	tags: true
 }).extend({ kind: z.literal("template") })]);
@@ -600,7 +792,7 @@ const sandboxFailureCodeSchema = z.enum(SANDBOX_FAILURE_CODES);
 * to be written by hand or by an agent, not generated.
 *
 * The schema lives here rather than in packages/journeys so the CLI can reject
-* a bad file before it boots a Temporal environment, and so the docs site can
+* a bad file before it boots a Temporal dev server, and so the docs site can
 * render the format from one source.
 */
 const journeyScenarioSchema = z.object({
@@ -642,7 +834,7 @@ const journeyScenarioSchema = z.object({
 //#endregion
 //#region src/guest/journeys.ts
 /**
-* A capability that failed host-side (an unknown destination, invalid
+* A capability that failed host-side (an unknown webhook, invalid
 * props, a profile that is not there). The failure is journaled, so a
 * journey that catches it takes the same branch on every replay.
 */
@@ -656,31 +848,38 @@ var CapabilityError = class extends Error {
 };
 /**
 * The config half of a journey, validated with the same schema the release
-* manifest is validated with, so a bad trigger or a malformed purpose key
-* fails at build time rather than at the first execution. Whether the org
-* declares that purpose is a question only the deploy can answer.
+* manifest is validated with, so a bad trigger, a malformed purpose key, or
+* a `from` that is not an address fails at build time rather than at the
+* first execution. Whether the org declares that purpose, and whether it may
+* send from that domain, are questions only the push can answer.
 */
 const journeyConfigSchema = manifestJourneySchema.pick({
 	trigger: true,
 	purpose: true,
-	senderIdentity: true,
+	enrollment: true,
+	description: true,
+	from: true,
 	tags: true
-}).extend({ senderIdentity: destinationNameSchema });
+});
 /**
 * Author a journey. Throws at definition time on an invalid config.
 *
-* There is no environment gate here: a journey runs wherever it is enabled,
-* and nowhere else (ADR 0011). A source that still passes `environments` is
-* a typecheck error in `cow build`, which is where the author can fix it.
+* There is no environment gate here: an organization has one data space, and
+* a journey runs wherever it is on and nowhere else (ADR 0011, ADR 0013).
 */
 function defineJourney(input) {
+	const config = journeyConfigSchema.parse({
+		trigger: input.trigger,
+		purpose: input.purpose,
+		enrollment: input.enrollment,
+		description: input.description,
+		from: input.from,
+		tags: input.tags
+	});
+	if (config.from === void 0) throw new Error("defineJourney needs a \"from\": the address this journey sends as, on a domain your organization verified. Add and verify it on the Domains page (Settings, Domains). For example from: \"Billing <billing@your-domain.com>\".");
 	return {
-		...journeyConfigSchema.parse({
-			trigger: input.trigger,
-			purpose: input.purpose,
-			senderIdentity: input.senderIdentity,
-			tags: input.tags
-		}),
+		...config,
+		from: config.from,
 		run: input.run
 	};
 }