@cowliss/cli 0.6.0 → 0.7.0

package/README.md

@@ -44,7 +44,7 @@ import { defineJourney } from "@cowliss/cli/journeys";
 
 export default defineJourney({
   trigger: { event: "checkout_started" },
-  purpose: "emailMarketing",
+  purpose: "marketing",
   run: async (event, api) => {
     const purchased = await api.waitForEvent("purchase_completed", {
       timeout: "24h",

package/dist/guest/{driver-DBt5l1Z5.js → driver-C1bsCjZT.js}

@@ -1,4 +1,4 @@
-import { a as manifestOutputSchema, i as journeyStepOutputSchema, o as templateRenderOutputSchema, r as guestInputSchema, t as CapabilityError } from "./journeys-BrcKEXz0.js";
+import { a as manifestOutputSchema, i as journeyStepOutputSchema, o as templateRenderOutputSchema, r as guestInputSchema, t as CapabilityError } from "./journeys-Dpsp225V.js";
 import { z } from "zod";
 import { createElement } from "react";
 import { renderToStaticMarkup } from "react-dom/server.browser";
@@ -5573,6 +5573,8 @@ function readManifest(module) {
 			kind: "journey",
 			trigger: journey.trigger,
 			purpose: journey.purpose,
+			enrollment: journey.enrollment,
+			description: journey.description,
 			from: journey.from,
 			tags: journey.tags
 		});
@@ -5583,6 +5585,7 @@ function readManifest(module) {
 		tags: template.tags,
 		sendClass: template.sendClass ?? "marketing",
 		verifyLink: template.verifyLink ?? false,
+		unsubscribeLink: template.unsubscribeLink ?? false,
 		propsSchema: z.toJSONSchema(template.props, { target: "draft-2020-12" })
 	});
 }

package/dist/guest/driver.d.ts

@@ -1,4 +1,4 @@
-import { a as ManifestOutput, i as JourneyStepOutput, o as TemplateRenderOutput } from "./index-CXcCEcAg.js";
+import { a as JourneyStepOutput, o as ManifestOutput, s as TemplateRenderOutput } from "./index-3PMqJKmc.js";
 //#region src/guest/driver.d.ts
 /**
  * The in-process driver: JSON in, JSON out (spec: Guest protocol). One

package/dist/guest/driver.js

@@ -1,3 +1,3 @@
-import { t as runGuest } from "./driver-DBt5l1Z5.js";
+import { t as runGuest } from "./driver-C1bsCjZT.js";
 
 export { runGuest };

package/dist/guest/emails.d.ts

@@ -36,6 +36,12 @@ type Template<Schema extends z.ZodType = z.ZodType> = {
   tags?: string[];
   /** True asks the host to mint a signed `verifyUrl` prop at send time. */
   verifyLink?: boolean;
+  /**
+   * True asks the host to mint a signed `unsubscribeUrl` prop at send time,
+   * for the author's own footer link. Leave it off and a marketing template
+   * still gets a platform footer with the link appended at send time.
+   */
+  unsubscribeLink?: boolean;
 };
 //#endregion
 export { type SendClass, Subject, Template };

package/dist/guest/{index-CXcCEcAg.d.ts → index-3PMqJKmc.d.ts}

@@ -6,9 +6,6 @@ import { z } from "zod";
  * a guest returns with these schemas before anything acts on it; the guest
  * SDK and the Node simulator produce and consume the same shapes.
  */
-/** A duration as journey code writes it: an ms-style string ("2d") or milliseconds. */
-declare const durationSchema: z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>;
-type Duration = z.infer<typeof durationSchema>;
 /** The event a journey runs for, or waits on: name, properties, and when. */
 declare const guestEventSchema: z.ZodObject<{
   name: z.ZodString;
@@ -257,9 +254,44 @@ declare const manifestOutputSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     event: z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>;
     appId: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
   }, z.core.$strict>, z.ZodObject<{
-    segment: z.ZodString;
+    segment: z.ZodObject<{
+      match: z.ZodDefault<z.ZodEnum<{
+        all: "all";
+        any: "any";
+      }>>;
+      appId: z.ZodOptional<z.ZodNullable<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>>;
+      predicates: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"trait">;
+        name: z.ZodString;
+        op: z.ZodEnum<{
+          contains: "contains";
+          eq: "eq";
+          exists: "exists";
+          gt: "gt";
+          gte: "gte";
+          lt: "lt";
+          lte: "lte";
+          neq: "neq";
+          notExists: "notExists";
+        }>;
+        value: z.ZodOptional<z.ZodUnknown>;
+      }, z.core.$strip>, z.ZodObject<{
+        kind: z.ZodLiteral<"event">;
+        name: z.ZodString;
+        op: z.ZodEnum<{
+          notPerformed: "notPerformed";
+          performed: "performed";
+        }>;
+        atLeast: z.ZodDefault<z.ZodNumber>;
+        withinDays: z.ZodOptional<z.ZodNumber>;
+      }, z.core.$strip>], "kind">>;
+    }, z.core.$strict>;
   }, z.core.$strict>]>;
   purpose: z.ZodString;
+  enrollment: z.ZodOptional<z.ZodObject<{
+    cooldown: z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>;
+  }, z.core.$strict>>;
+  description: z.ZodOptional<z.ZodString>;
   from: z.ZodOptional<z.ZodString>;
   kind: z.ZodLiteral<"journey">;
 }, z.core.$strip>, z.ZodObject<{
@@ -269,28 +301,88 @@ declare const manifestOutputSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     transactional: "transactional";
   }>;
   verifyLink: z.ZodBoolean;
+  unsubscribeLink: z.ZodDefault<z.ZodBoolean>;
   propsSchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
   kind: z.ZodLiteral<"template">;
 }, z.core.$strip>], "kind">;
 type ManifestOutput = z.infer<typeof manifestOutputSchema>;
 //#endregion
 //#region ../../packages/shared/src/journeys-v2/manifest.d.ts
+/**
+ * The pushed manifest (spec: Build; Push and compile): what `cow build`
+ * extracts from a project and `cow push` uploads with the bundles. The
+ * server validates it with these schemas, compiles every bundle whose key
+ * changed, and stores that entry on the version it creates.
+ */
+/**
+ * A duration as journey code writes it: an ms-style string ("2d") or
+ * milliseconds. It lives here rather than with the guest protocol because a
+ * manifest carries one too (a journey's enrollment cooldown) and `./guest`
+ * already imports this module, so the other direction would be a cycle.
+ */
+declare const durationSchema: z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>;
+type Duration = z.infer<typeof durationSchema>;
 /**
  * What starts a journey: an event (optionally narrowed to an app id or a
- * list of them) or a segment entry. The registry DTO in `../journeys`
- * reuses it.
+ * list of them), or entry into the segment the trigger itself describes.
+ * The registry DTO in `../journeys` reuses it.
+ *
+ * A segment trigger carries the predicate list, not a name: the push
+ * materializes one segment row per journey that inlines a definition, owned
+ * by the journey and named after its key, so the segment exists because the
+ * journey exists and there is no order to get wrong (ADR 0016). The
+ * definition is data — validated here, carried on the version, never
+ * compiled and never executed.
  *
- * Both members are strict, so a journey holding the retired `source` key
- * fails to compile instead of silently triggering on every app.
- * There is deliberately no pipe filter: a trigger narrows by the app the
- * write is attributed to, the same token a segment definition names.
+ * Both members are strict, so a journey holding the retired `source` key, or
+ * the retired `{ segment: "name" }` form, fails to build instead of silently
+ * triggering on every app or on nothing. There is deliberately no pipe
+ * filter: a trigger narrows by the app the write is attributed to, the same
+ * token a segment definition names.
  */
 declare const triggerSchema: z.ZodUnion<readonly [z.ZodObject<{
   event: z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>;
   appId: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
 }, z.core.$strict>, z.ZodObject<{
-  segment: z.ZodString;
+  segment: z.ZodObject<{
+    match: z.ZodDefault<z.ZodEnum<{
+      all: "all";
+      any: "any";
+    }>>;
+    appId: z.ZodOptional<z.ZodNullable<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>>;
+    predicates: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+      kind: z.ZodLiteral<"trait">;
+      name: z.ZodString;
+      op: z.ZodEnum<{
+        contains: "contains";
+        eq: "eq";
+        exists: "exists";
+        gt: "gt";
+        gte: "gte";
+        lt: "lt";
+        lte: "lte";
+        neq: "neq";
+        notExists: "notExists";
+      }>;
+      value: z.ZodOptional<z.ZodUnknown>;
+    }, z.core.$strip>, z.ZodObject<{
+      kind: z.ZodLiteral<"event">;
+      name: z.ZodString;
+      op: z.ZodEnum<{
+        notPerformed: "notPerformed";
+        performed: "performed";
+      }>;
+      atLeast: z.ZodDefault<z.ZodNumber>;
+      withinDays: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>], "kind">>;
+  }, z.core.$strict>;
 }, z.core.$strict>]>;
 type Trigger = z.infer<typeof triggerSchema>;
+/**
+ * A trigger as an author writes it, before zod fills in a predicate's
+ * `match` and `atLeast` defaults. `defineJourney` takes this shape;
+ * everything downstream reads the parsed `Trigger`.
+ */
+type TriggerInput = z.input<typeof triggerSchema>;
 //#endregion
-export { ManifestOutput as a, JourneyStepOutput as i, Duration as n, TemplateRenderOutput as o, GuestEvent as r, Trigger as t };
+export { JourneyStepOutput as a, GuestEvent as i, Trigger as n, ManifestOutput as o, TriggerInput as r, TemplateRenderOutput as s, Duration as t };

package/dist/guest/{journeys-BrcKEXz0.js → journeys-Dpsp225V.js}

@@ -9,16 +9,24 @@ const DOCS_URL = "https://docs.cowliss.com";
 */
 const CLERK_ORG_SUBJECT_PREFIX = "org_";
 /**
-* Fixed consent purposes for the prototype. Consent is a per-purpose map on
-* the profile, checked at send-step execution time.
-*
-* The two names describe what the recipient agreed to, not the pipe it
-* arrives on: "emails I did not ask for individually" and "my data leaving
-* for somewhere else". Naming them after the channel (`email`, `webhook`)
-* said nothing a recipient could consent to, and transactional mail already
-* bypasses the email purpose, so it was only ever marketing consent.
+* The marketing purpose by name, since it is the one every gate, the
+* unsubscribe route, and the developer's own toggle all reach for.
+*/
+const MARKETING = "marketing";
+/**
+* A legal journey `purpose` that is not a consent purpose: the send gates
+* pass it unconditionally, no profile's map stores it and no editor renders
+* it. What protects the channel itself (suppression, the SES gates, the
+* quota) still applies.
+*/
+const TRANSACTIONAL = "transactional";
+/**
+* The purposes a project may not declare, which are the same two that sit
+* outside the `marketing` umbrella: `marketing` is the umbrella itself and
+* `transactional` is the case consent does not govern. Everything a project
+* declares is a marketing-mail category and so sits under it.
 */
-const CONSENT_PURPOSES = ["emailMarketing", "dataProcessing"];
+const RESERVED_PURPOSES = [MARKETING, TRANSACTIONAL];
 /**
 * The two classes of send, declared on the template rather than passed per
 * call so the class cannot drift between two sends of the same message.
@@ -56,6 +64,92 @@ const PUSH_LIMITS = {
 const COW_CONFIG_SCHEMA_PATH = "/schemas/cow.json";
 const COW_CONFIG_SCHEMA_URL = `${DOCS_URL}${COW_CONFIG_SCHEMA_PATH}`;
 
+//#endregion
+//#region ../../packages/shared/src/segment-definition.ts
+/**
+* A segment definition: a flat list of predicates over traits and event
+* history, combined with `all` or `any`. Deliberately flat — nested predicate groups are YAGNI for the
+* prototype, and a flat list keeps the pure evaluator a fold.
+*
+* `appId` scopes the EVENT side of a definition only. Traits are
+* per-profile and profiles merge across apps, so there is nothing
+* app-shaped to filter on the trait side.
+*
+* A definition and the membership it produces are both the
+* organization's.
+*
+* Apart from `./segments` because a journey's trigger carries a definition
+* and the trigger schema is bundled into the wasm guest, where an edge to
+* `@cowliss/db` (which `./segments` has, for the row schema) is a hard
+* bundler failure. Nothing here imports anything but zod.
+*
+* The object is strict: a definition holding the retired `sourceId` key
+* (which meant the app) fails loudly instead of parsing as an unfiltered
+* definition that evaluates over every app. There is deliberately no pipe
+* filter here — filtering by source is a later feature, and accepting one
+* now would make a stale `sourceId` parse as a filter on a pipe that does
+* not exist and silently match nothing.
+*/
+const SEGMENT_TRAIT_OPS = [
+	"eq",
+	"neq",
+	"gt",
+	"gte",
+	"lt",
+	"lte",
+	"exists",
+	"notExists",
+	"contains"
+];
+/** Operators that read no comparison value: presence of the key is the test. */
+const VALUELESS_TRAIT_OPS = ["exists", "notExists"];
+const predicateNameSchema = z.string().trim().min(1, "predicate name is required").max(200);
+const segmentPredicateSchema = z.discriminatedUnion("kind", [z.object({
+	kind: z.literal("trait"),
+	name: predicateNameSchema,
+	op: z.enum(SEGMENT_TRAIT_OPS),
+	/**
+	* Compared against the stored trait, which is `unknown` because
+	* identify accepts arbitrary JSON. The evaluator coerces both sides
+	* before comparing, so authors here (CLI, MCP, dashboard) get the
+	* form-field-friendly reading rather than strict JSON equality:
+	* numeric-looking strings are compared as numbers for eq/neq and for
+	* ordering ("150" matches 150, and orders like it), and "true"/"false"
+	* are compared as booleans for eq/neq, trimmed and case-insensitively
+	* (" TRUE " reads as true). Coercion needs both sides to agree on a
+	* type: "0" never equals false. The numeric net is as wide as
+	* `Number()`, so "0x64", "0b11" and "1e2" read as numbers too, which
+	* matters most for opaque ids: "007" is authored as the number 7.
+	*
+	* contains reads three ways. Against an array trait it is membership
+	* under that same equality, so "true" matches `[true]` and "1" matches
+	* `[1, 2]`. Against a string trait it is a plain substring search with
+	* no coercion, since substrings only mean something between strings.
+	* Against anything else it never matches. Ordering never coerces
+	* booleans.
+	*/
+	value: z.unknown().optional()
+}), z.object({
+	kind: z.literal("event"),
+	name: predicateNameSchema,
+	op: z.enum(["performed", "notPerformed"]),
+	/** How many matching events the predicate counts as "performed". */
+	atLeast: z.number().int().min(1).default(1),
+	/** Rolling window, relative to evaluation time; absent means all history. */
+	withinDays: z.number().int().min(1).optional()
+})]).refine((predicate) => predicate.kind !== "trait" || VALUELESS_TRAIT_OPS.includes(predicate.op) || predicate.value !== void 0, { message: "value is required unless op is exists or notExists" });
+const appIdSchema = z.string().trim().min(1);
+const segmentDefinitionSchema = z.strictObject({
+	match: z.enum(["all", "any"]).default("all"),
+	/**
+	* Optional app filter over the event side; null/absent spans apps.
+	* A list matches any of the named apps, which is how one definition
+	* names the development and the production id of the same app.
+	*/
+	appId: z.union([appIdSchema, z.array(appIdSchema).min(1)]).nullish(),
+	predicates: z.array(segmentPredicateSchema).min(1, "at least one predicate is required")
+});
+
 //#endregion
 //#region ../../packages/shared/src/journeys-v2/manifest.ts
 /**
@@ -65,6 +159,34 @@ const COW_CONFIG_SCHEMA_URL = `${DOCS_URL}${COW_CONFIG_SCHEMA_PATH}`;
 * changed, and stores that entry on the version it creates.
 */
 /**
+* A duration as journey code writes it: an ms-style string ("2d") or
+* milliseconds. It lives here rather than with the guest protocol because a
+* manifest carries one too (a journey's enrollment cooldown) and `./guest`
+* already imports this module, so the other direction would be a cycle.
+*/
+const durationSchema = z.union([z.string().min(1), z.number().int().nonnegative()]);
+const DURATION_PATTERN = /^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d|w)$/;
+const DURATION_UNIT_MS = {
+	ms: 1,
+	s: 1e3,
+	m: 6e4,
+	h: 36e5,
+	d: 864e5,
+	w: 6048e5
+};
+/**
+* A duration in milliseconds. The simulator's virtual clock and the runner's
+* timers both need it, and neither may pull in Temporal's `msToNumber` (one
+* runs in the CLI, the other inside workflow code).
+*/
+function parseDuration(duration) {
+	if (typeof duration === "number") return duration;
+	const match = DURATION_PATTERN.exec(duration.trim());
+	if (!match) throw new Error(`Duration ${JSON.stringify(duration)} is not a duration: use milliseconds or an ms-style string like "1h" or "2d".`);
+	const unit = DURATION_UNIT_MS[match[2]];
+	return Math.round(Number(match[1]) * unit);
+}
+/**
 * A journey or template key: the file basename under `journeys/` or
 * `emails/`, kebab-case and unique across the project. Becomes part of the
 * Temporal workflow id and travels in the journey chain, so it stays short.
@@ -85,8 +207,8 @@ const journeyKeySchema = z.string().max(64).regex(JOURNEY_KEY_PATTERN, "key must
 */
 const tagsSchema = z.array(z.string().trim().min(1).max(50, "a tag must be at most 50 characters")).max(20, "a journey or template takes at most 20 tags").default([]).transform((tags) => [...new Set(tags)]);
 /**
-* A consent purpose key: camelCase, matching the fixed `emailMarketing` and
-* `dataProcessing`. Purposes are keys in the `consent` map a customer reads
+* A consent purpose key: camelCase, matching the reserved `marketing` and
+* `transactional`. Purposes are keys in the `consent` map a customer reads
 * on their own profile, which is why they are not the kebab-case of a
 * journey key.
 */
@@ -101,22 +223,22 @@ const CONSENT_PURPOSE_KEY_PATTERN = /^[a-z][a-zA-Z0-9]*$/;
 const consentPurposeKeySchema = z.string().max(50, "a purpose key must be at most 50 characters").regex(CONSENT_PURPOSE_KEY_PATTERN, "a consent purpose key must be camelCase (a letter first, then letters and digits)");
 /**
 * One purpose a project declares in `cow.json` (spec: Decisions). A declared
-* purpose is marketing-class and sits under the `emailMarketing` umbrella,
-* so `denied` is the only default it may carry: the purpose is absent on
-* every profile that already exists, and a granted default would answer for
-* all of them at once.
+* purpose is marketing-class and sits under the `marketing` umbrella, so
+* `denied` is the only default it may carry: the purpose is absent on every
+* profile that already exists, and a granted default would answer for all of
+* them at once.
 *
 * The field stays required rather than disappearing, so every `cow.json` and
-* every stored manifest written before this still parses, and the column
-* behind it still holds `granted` for the seeded `dataProcessing` row: this
-* is a refusal at declaration time, not a narrower storage shape.
+* every stored manifest written before this still parses: this is a refusal
+* at declaration time, not a narrower storage shape.
 *
-* The two fixed purposes cannot be declared. They are seeded for every org
-* and owned by no project, so a project redeclaring one would be renaming
-* the master switch every other project's journeys hang off.
+* Neither reserved purpose can be declared: `marketing` is the master switch
+* every other project's journeys hang off, and `transactional` is not a
+* consent purpose at all, so declaring it would promise a switch that no
+* send ever reads.
 */
 const declaredPurposeSchema = z.strictObject({
-	key: consentPurposeKeySchema.refine((key) => !CONSENT_PURPOSES.includes(key), `${CONSENT_PURPOSES.join(" and ")} are fixed purposes and cannot be declared`),
+	key: consentPurposeKeySchema.refine((key) => !RESERVED_PURPOSES.includes(key), `${RESERVED_PURPOSES.join(" and ")} are reserved purposes and cannot be declared`),
 	/** What the dashboard and the account modal render beside the switch. */
 	label: z.string().trim().min(1).max(50, "a purpose label must be at most 50 characters"),
 	/** What the purpose means for a profile whose map does not answer it. */
@@ -138,18 +260,26 @@ const onePatternSchema = z.string().min(1).max(200, "a pattern must be at most 2
 const patternSchema = z.union([onePatternSchema, z.array(onePatternSchema).min(1).max(20, "a matcher takes at most 20 patterns")]);
 /**
 * What starts a journey: an event (optionally narrowed to an app id or a
-* list of them) or a segment entry. The registry DTO in `../journeys`
-* reuses it.
+* list of them), or entry into the segment the trigger itself describes.
+* The registry DTO in `../journeys` reuses it.
+*
+* A segment trigger carries the predicate list, not a name: the push
+* materializes one segment row per journey that inlines a definition, owned
+* by the journey and named after its key, so the segment exists because the
+* journey exists and there is no order to get wrong (ADR 0016). The
+* definition is data — validated here, carried on the version, never
+* compiled and never executed.
 *
-* Both members are strict, so a journey holding the retired `source` key
-* fails to compile instead of silently triggering on every app.
-* There is deliberately no pipe filter: a trigger narrows by the app the
-* write is attributed to, the same token a segment definition names.
+* Both members are strict, so a journey holding the retired `source` key, or
+* the retired `{ segment: "name" }` form, fails to build instead of silently
+* triggering on every app or on nothing. There is deliberately no pipe
+* filter: a trigger narrows by the app the write is attributed to, the same
+* token a segment definition names.
 */
 const triggerSchema = z.union([z.strictObject({
 	event: patternSchema,
 	appId: patternSchema.optional()
-}), z.strictObject({ segment: z.string().min(1) })]);
+}), z.strictObject({ segment: segmentDefinitionSchema })]);
 /**
 * The address half of a from-header: a local part, an `@`, and a dotted
 * domain. Deliberately narrower than RFC 5322 (no quoted local parts, no
@@ -252,10 +382,35 @@ const manifestJourneySchema = z.object({
 	*/
 	purpose: consentPurposeKeySchema,
 	/**
+	* How often one recipient may enter. Enrollment derives from the purpose
+	* (ADR 0015), so the only thing an author writes is how long after a
+	* completed run the journey re-opens: absent means once, ever. Refused on
+	* a transactional journey, which enrolls on every trigger — see
+	* `manifestSchema` below, where the cross-field check lives (a refinement
+	* on this object would break the `.pick()` the guest SDK and the guest
+	* protocol both take of it).
+	*/
+	enrollment: z.strictObject({ cooldown: durationSchema.refine((value) => {
+		try {
+			parseDuration(value);
+			return true;
+		} catch {
+			return false;
+		}
+	}, "a cooldown must be milliseconds or an ms-style string like \"7d\"") }).optional(),
+	/**
+	* The author's own sentence about what this journey does, shown wherever
+	* the journey is read. Capped like a segment's description; absent when
+	* the author wrote none.
+	*/
+	description: z.string().trim().max(500, `description must be at most ${500} characters`).optional(),
+	/**
 	* The address every `send.email` in this journey goes out as, unless the
-	* call names its own. Optional everywhere: an omitted one is the
-	* organization's shared fallback address, which is what makes day-one
-	* sending zero-config (ADR 0014).
+	* call names its own. Required of the author (`defineJourney` types it so,
+	* and `cow build` refuses a journey without it), and still optional here:
+	* releases pushed before ADR 0014 was amended carry none, and this schema
+	* parses stored manifests as well as new ones. A push with no `from` is
+	* refused by the domain gate, which says what to do about it.
 	*/
 	from: fromSchema.optional(),
 	spine: z.array(spineEntrySchema),
@@ -268,6 +423,13 @@ const manifestTemplateSchema = z.object({
 	sendClass: z.enum(SEND_CLASSES),
 	/** True asks the host to mint a signed `verifyUrl` prop at send time. */
 	verifyLink: z.boolean(),
+	/**
+	* True asks the host to mint a signed `unsubscribeUrl` prop at send time,
+	* for the author's own footer link. Default false: a marketing send whose
+	* HTML carries no unsubscribe link at all still gets one, appended as a
+	* platform footer, so the link is never the author's to forget.
+	*/
+	unsubscribeLink: z.boolean().default(false),
 	/** JSON Schema of the template's `props`, converted by `cow build`. */
 	propsSchema: z.record(z.string(), z.unknown()),
 	bundle: digestSchema
@@ -318,6 +480,15 @@ const manifestSchema = z.object({
 	uniqueKeys(manifest.journeys, ctx, "journeys");
 	uniqueKeys(manifest.templates, ctx, "templates");
 	uniqueKeys(manifest.purposes ?? [], ctx, "purposes");
+	for (const [index, journey] of manifest.journeys.entries()) if (journey.enrollment && journey.purpose === "transactional") ctx.addIssue({
+		code: "custom",
+		message: `journey "${journey.key}": a transactional journey enrolls on every trigger, so it takes no enrollment cooldown`,
+		path: [
+			"journeys",
+			index,
+			"enrollment"
+		]
+	});
 });
 /**
 * One entry of a stored manifest: what a version is a snapshot of. Journeys
@@ -377,8 +548,6 @@ const cowConfigSchema = z.strictObject({
 * a guest returns with these schemas before anything acts on it; the guest
 * SDK and the Node simulator produce and consume the same shapes.
 */
-/** A duration as journey code writes it: an ms-style string ("2d") or milliseconds. */
-const durationSchema = z.union([z.string().min(1), z.number().int().nonnegative()]);
 /** The event a journey runs for, or waits on: name, properties, and when. */
 const guestEventSchema = z.object({
 	name: z.string().min(1),
@@ -418,8 +587,9 @@ const commandSchema = z.discriminatedUnion("name", [
 			/**
 			* The address this mail leaves as. The guest SDK fills in the
 			* journey's own whenever the call does not name one, so the host has
-			* one resolution path and never reads the manifest to find it;
-			* absent on both is the organization's shared fallback address.
+			* one resolution path and never reads the manifest to find it. A
+			* journey must name one, so absent on both is a release pushed before
+			* that was true, and the `domain` gate refuses it.
 			*/
 			from: fromSchema.optional(),
 			/** Where a reply to this one mail goes, instead of the from-address. */
@@ -563,11 +733,14 @@ const manifestInputSchema = z.object({ kind: z.literal("manifest") });
 const manifestOutputSchema = z.discriminatedUnion("kind", [manifestJourneySchema.pick({
 	trigger: true,
 	purpose: true,
+	enrollment: true,
+	description: true,
 	from: true,
 	tags: true
 }).extend({ kind: z.literal("journey") }), manifestTemplateSchema.pick({
 	sendClass: true,
 	verifyLink: true,
+	unsubscribeLink: true,
 	propsSchema: true,
 	tags: true
 }).extend({ kind: z.literal("template") })]);
@@ -683,6 +856,8 @@ var CapabilityError = class extends Error {
 const journeyConfigSchema = manifestJourneySchema.pick({
 	trigger: true,
 	purpose: true,
+	enrollment: true,
+	description: true,
 	from: true,
 	tags: true
 });
@@ -690,16 +865,21 @@ const journeyConfigSchema = manifestJourneySchema.pick({
 * Author a journey. Throws at definition time on an invalid config.
 *
 * There is no environment gate here: an organization has one data space, and
-* a journey runs wherever it is enabled and nowhere else (ADR 0011, ADR 0013).
+* a journey runs wherever it is on and nowhere else (ADR 0011, ADR 0013).
 */
 function defineJourney(input) {
+	const config = journeyConfigSchema.parse({
+		trigger: input.trigger,
+		purpose: input.purpose,
+		enrollment: input.enrollment,
+		description: input.description,
+		from: input.from,
+		tags: input.tags
+	});
+	if (config.from === void 0) throw new Error("defineJourney needs a \"from\": the address this journey sends as, on a domain your organization verified. Add and verify it on the Domains page (Settings, Domains). For example from: \"Billing <billing@your-domain.com>\".");
 	return {
-		...journeyConfigSchema.parse({
-			trigger: input.trigger,
-			purpose: input.purpose,
-			from: input.from,
-			tags: input.tags
-		}),
+		...config,
+		from: config.from,
 		run: input.run
 	};
 }