@cowliss/cli 0.6.0 → 0.7.0

package/dist/index.js

@@ -82,30 +82,30 @@ const TOPUP_PRESETS_MICROS = [
 	2e8
 ];
 /**
-* Fixed consent purposes for the prototype. Consent is a per-purpose map on
-* the profile, checked at send-step execution time.
-*
-* The two names describe what the recipient agreed to, not the pipe it
-* arrives on: "emails I did not ask for individually" and "my data leaving
-* for somewhere else". Naming them after the channel (`email`, `webhook`)
-* said nothing a recipient could consent to, and transactional mail already
-* bypasses the email purpose, so it was only ever marketing consent.
-*/
-const CONSENT_PURPOSES = ["emailMarketing", "dataProcessing"];
-/**
 * The marketing purpose by name, since it is the one every gate, the
 * unsubscribe route, and the developer's own toggle all reach for.
 */
-const EMAIL_MARKETING = "emailMarketing";
+const MARKETING = "marketing";
+/**
+* A legal journey `purpose` that is not a consent purpose: the send gates
+* pass it unconditionally, no profile's map stores it and no editor renders
+* it. What protects the channel itself (suppression, the SES gates, the
+* quota) still applies.
+*/
+const TRANSACTIONAL = "transactional";
+/**
+* The purposes a project may not declare, which are the same two that sit
+* outside the `marketing` umbrella: `marketing` is the umbrella itself and
+* `transactional` is the case consent does not govern. Everything a project
+* declares is a marketing-mail category and so sits under it.
+*/
+const RESERVED_PURPOSES = [MARKETING, TRANSACTIONAL];
 /**
 * What a purpose means when the profile's map does not answer it, matching
-* the `profiles.consent` column default: marketing is asked for, everything
-* else about the data the developer already sends is granted.
+* the `profiles.consent` column default: marketing is asked for, never
+* assumed.
 */
-const CONSENT_PURPOSE_DEFAULTS = {
-	emailMarketing: false,
-	dataProcessing: true
-};
+const CONSENT_PURPOSE_DEFAULTS = { marketing: false };
 /**
 * The `defaults` argument `consentGranted` takes, built from an org's
 * purpose rows. Every surface that renders or gates a purpose reads those
@@ -3341,6 +3341,10 @@ const deliveryKindEnum = pgEnum("delivery_kind", [
 *   `skipped_suppressed` is the recipient's address sitting in the
 *   suppression mirror, which SES would have bounced off its own
 *   suppression list anyway.
+*   `skipped_unknown_purpose` is the version naming a purpose the
+*   organization does not have, which is a broken manifest rather than a
+*   consent decision: the `error` column names the purpose, and the fix is
+*   another push (ADR 0017).
 * - `would_*` are dry-run outcomes: terminal, never reach SES, and
 *   excluded from feedback, quotas, and reconciliation.
 *
@@ -3357,6 +3361,7 @@ const deliveryStatusEnum = pgEnum("delivery_status", [
 	"skipped_paused",
 	"skipped_suppressed",
 	"skipped_quota",
+	"skipped_unknown_purpose",
 	"skipped_frequency_cap",
 	"skipped_consent",
 	"skipped_domain",
@@ -3366,6 +3371,7 @@ const deliveryStatusEnum = pgEnum("delivery_status", [
 	"would_skip_paused",
 	"would_skip_suppressed",
 	"would_skip_quota",
+	"would_skip_unknown_purpose",
 	"would_skip_frequency_cap",
 	"would_skip_consent",
 	"would_skip_domain",
@@ -3551,7 +3557,7 @@ const executions$1 = pgTable("executions", {
 	})
 }, (table) => [
 	index("executions_org_id_version_id_status_idx").on(table.orgId, table.versionId, table.status),
-	uniqueIndex("executions_org_id_workflow_id_unique").on(table.orgId, table.workflowId),
+	index("executions_org_id_workflow_id_status_idx").on(table.orgId, table.workflowId, table.status),
 	index("executions_org_id_started_at_idx").on(table.orgId, table.startedAt)
 ]);
 const selectExecutionSchema = createSelectSchema(executions$1);
@@ -3619,11 +3625,11 @@ const idempotencyKeys = pgTable("idempotency_keys", {
 * creating one when none is known.
 *
 * traits is the merged trait bag (RFC 7386 key-level merge on write).
-* consent is the fixed-purpose consent map from the spec. Marketing starts
-* denied and data processing granted: nobody is subscribed by the act of
-* being ingested, while the processing the product runs on is the basis the
-* profile exists under at all. It is written by the identify path (a caller
-* passing `consent`), the consent editor, and the automatic revocations.
+* consent is the per-purpose consent map. Marketing starts denied: nobody
+* is subscribed by the act of being ingested. `transactional` is absent by
+* design (ADR 0017): it is not a purpose anyone may withhold, so it is not
+* stored. The map is written by the identify path (a caller passing
+* `consent`), the consent editor, and the automatic revocations.
 *
 * `mergedInto` is the merge pointer (spec: Identity). Null on a live
 * profile; on a profile a merge folded away it names the survivor, whose
@@ -3641,10 +3647,7 @@ const profiles = pgTable("profiles", {
 	appId: text("app_id").notNull(),
 	sourceId: text("source_id").notNull(),
 	traits: jsonb("traits").$type().notNull().default({}),
-	consent: jsonb("consent").$type().notNull().default({
-		emailMarketing: false,
-		dataProcessing: true
-	}),
+	consent: jsonb("consent").$type().notNull().default({ marketing: false }),
 	mergedInto: text("merged_into"),
 	createdAt: createdAt(),
 	updatedAt: updatedAt()
@@ -3745,6 +3748,18 @@ const insertJourneyRunSchema = createInsertSchema(journeyRuns);
 //#endregion
 //#region ../../packages/db/src/schema/journeys.ts
 /**
+* The one operational state a manager sets (ADR 0018): `on` (recipients
+* enroll and executions run), `off` (nothing enrolls, executions in flight
+* finish) or `paused` (nothing enrolls, executions in flight hold before
+* their next step). Three values rather than two booleans: a second flag
+* beside the first would spell two combinations that mean nothing.
+*/
+const journeyStatusEnum = pgEnum("journey_status", [
+	"on",
+	"off",
+	"paused"
+]);
+/**
 * Derived journey rows: one per (org, key), upserted from the manifest a
 * push carried. Nothing here is authored through the API, which is why
 * there is no id of its own: the key is the name the author gave the file,
@@ -3757,9 +3772,9 @@ const insertJourneyRunSchema = createInsertSchema(journeyRuns);
 * what makes a key another project owns a refused push rather than a silent
 * overwrite. Removing a journey is an explicit delete (ADR 0009).
 *
-* Whether a journey fires is one flag and one only: `enabled`, which a
+* Whether a journey fires is one field and one only: `status`, which a
 * push never writes, so deploying code never turns anything on or off. The
-* author has no second gate of their own (ADR 0011).
+* author has no second gate of their own (ADR 0011, ADR 0018).
 *
 * The descriptive columns are what its latest ready version reported, so a
 * failed compile leaves both the code and its description as they were.
@@ -3782,12 +3797,18 @@ const journeys$1 = pgTable("journeys", {
 	* the fixed pair.
 	*/
 	purpose: text("purpose").notNull(),
+	/**
+	* The author's own sentence about what the journey does, from the
+	* manifest. Null when they wrote none.
+	*/
+	description: text("description"),
 	spine: jsonb("spine").$type().notNull(),
 	/**
 	* The one gate on the journey: off until `cow enable` or a manager's
-	* toggle, and never touched by a push (ADR 0011, amended by ADR 0013).
+	* control, and never touched by a push (ADR 0011, amended by ADR 0013
+	* and ADR 0018).
 	*/
-	enabled: boolean("enabled").notNull().default(false),
+	status: journeyStatusEnum("status").notNull().default("off"),
 	createdAt: createdAt(),
 	updatedAt: updatedAt()
 }, (table) => [primaryKey({ columns: [table.orgId, table.key] })]);
@@ -3814,17 +3835,16 @@ const ingestionPolicyEnum = pgEnum("ingestion_policy", ["permissive", "strict"])
 * switch, the allowance override, and Clerk's cached profile.
 *
 * `slug` and `name` are the exception to "only what Cowliss owns": they are
-* Clerk's, cached here by the API's org-sync middleware because the worker
-* has no Clerk client and still has to build the shared fallback sender
-* `<org-slug>@<shared domain>` with the org's name as the from-name.
+* Clerk's, cached here by the API's org-sync middleware, and they are what a
+* template test-send composes its from-address out of (`orgFromAddress`).
 */
 const orgSettings = pgTable("org_settings", {
 	orgId: text("org_id").primaryKey(),
 	/**
 	* The Clerk org's slug and display name, synced by the API on request.
-	* Null until a member of the org has hit the dashboard API once; the
-	* shared fallback sender falls back to an orgId-derived local part and the
-	* tool name until then.
+	* Null until a member of the org has hit the dashboard API once, when
+	* `orgFromAddress` falls back to an orgId-derived local part and the tool
+	* name.
 	*/
 	slug: text("slug"),
 	name: text("name"),
@@ -4038,9 +4058,17 @@ const insertQuarantineEntrySchema = createInsertSchema(quarantineEntries);
 //#endregion
 //#region ../../packages/db/src/schema/segments.ts
 /**
-* Segments: dashboard-managed audience definitions. Membership is computed,
-* never hand-maintained: the engine in packages/segments recomputes on every
-* write and materializes the result into segment_members.
+* Segments: membership rules over profiles. Membership is computed, never
+* hand-maintained: the engine in packages/segments recomputes on every write
+* and materializes the result into segment_members.
+*
+* A row is either standalone (built in the dashboard, `journey_key` null) or
+* owned by one journey whose trigger inlined its definition (ADR 0016). An
+* owned row is named after its journey's key, is written only by the push,
+* and goes when the journey does — which is what the composite foreign key
+* says: it points at `journeys(org_id, key)` and cascades. A null
+* `journey_key` satisfies it vacuously (MATCH SIMPLE), so standalone rows
+* are unconstrained.
 *
 * Timestamps use millisecond precision, same rationale as apps: JS Dates
 * carry ms only and cursor pagination compares createdAt for equality.
@@ -4051,9 +4079,19 @@ const segments$1 = pgTable("segments", {
 	name: text("name").notNull(),
 	description: text("description"),
 	definition: jsonb("definition").$type().notNull(),
+	/** The journey that owns this row, or null for a standalone segment. */
+	journeyKey: text("journey_key"),
 	createdAt: createdAt(),
 	updatedAt: updatedAt()
-}, (table) => [index("segments_org_id_idx").on(table.orgId), uniqueIndex("segments_org_id_name_unique").on(table.orgId, table.name)]);
+}, (table) => [
+	index("segments_org_id_idx").on(table.orgId),
+	uniqueIndex("segments_org_id_name_unique").on(table.orgId, table.name),
+	foreignKey({
+		columns: [table.orgId, table.journeyKey],
+		foreignColumns: [journeys$1.orgId, journeys$1.key],
+		name: "segments_journey_fk"
+	}).onDelete("cascade")
+]);
 /**
 * Materialized membership: one row per (segment, profile) currently in the
 * segment. Deleting a segment drops its members with it, and erasing a
@@ -4089,10 +4127,16 @@ const insertSegmentSchema = createInsertSchema(segments$1);
 * emits no domain events, so the mirror refreshes by pulling
 * `GetEmailIdentity` on a schedule and on the manual re-check button.
 *
-* The unique index on `domain` is GLOBAL, not per org: it is the
-* anti-squatting rule from the spec. Once one org claims a domain string, no
-* other org can claim it, and the cross-org parent/child guard (a query, not
-* a constraint) covers the subdomain half of the same rule.
+* A domain is claimed when it VERIFIES, not when it is added (ADR 0021).
+* Any number of orgs may hold the same unverified string; the partial unique
+* below is what makes at most one of them verified, and so the owner. The
+* cross-org parent/child guard (a query, not a constraint) refuses a claim
+* under or over a name another org already verified.
+*
+* SES keys ONE identity by the domain name, so its DKIM records, and the
+* SUCCESS it reports for them, are shared by every org holding the name.
+* They therefore prove that SOMEBODY controls the DNS, never which org, and
+* `challenge_token` is the part that is per org: the claim needs both.
 */
 /**
 * SES's identity status vocabulary, lower-cased like every other enum here.
@@ -4100,13 +4144,19 @@ const insertSegmentSchema = createInsertSchema(segments$1);
 * all report the same five words. `temporary_failure` is SES's retryable
 * state, which is neither verified nor a dead end, so it is kept distinct
 * from `failed`.
+*
+* `blocked` is the one value SES never says: the DNS checks out, but another
+* organization has already verified this name or a parent or child of it, so
+* the claim cannot be granted here (ADR 0021). It is a terminal-looking
+* state that clears itself, because every refresh re-asks the question.
 */
 const senderDomainStatusEnum = pgEnum("sender_domain_status", [
 	"not_started",
 	"pending",
 	"success",
 	"failed",
-	"temporary_failure"
+	"temporary_failure",
+	"blocked"
 ]);
 const senderDomains = pgTable("sender_domains", {
 	id: text("id").primaryKey(),
@@ -4120,12 +4170,25 @@ const senderDomains = pgTable("sender_domains", {
 	spfStatus: text("spf_status"),
 	/**
 	* The per-domain click-tracking toggle, Cowliss's own setting: the send
-	* picks SES's tracked configuration set when it is on. Off by default
-	* and always off for the shared fallback domain (which has no row here
-	* at all): one setting cannot serve every org sharing it.
+	* picks SES's tracked configuration set when it is on. Off by default:
+	* link rewriting is a thing an org opts into.
 	*/
 	clickTracking: boolean("click_tracking").notNull().default(false),
 	dnsRecords: jsonb("dns_records").$type().notNull().default([]),
+	/**
+	* This org's own proof of control, published as a TXT record under the
+	* domain. Random per row and never re-issued, so two orgs holding the
+	* same name publish different values and only the one that controls the
+	* DNS can publish its own. Verified once, at the moment the claim is
+	* granted; a live sender never loses its domain to one failed lookup.
+	*/
+	challengeToken: text("challenge_token").notNull().default(sql`replace(gen_random_uuid()::text, '-', '')`),
+	/** When this org's own TXT record was last seen. Null until it is. */
+	challengeVerifiedAt: timestamp("challenge_verified_at", {
+		withTimezone: true,
+		mode: "date",
+		precision: 3
+	}),
 	/** When the mirror last asked SES; drives the refresh sweep. */
 	lastCheckedAt: timestamp("last_checked_at", {
 		withTimezone: true,
@@ -4134,7 +4197,11 @@ const senderDomains = pgTable("sender_domains", {
 	}),
 	createdAt: createdAt(),
 	updatedAt: updatedAt()
-}, (table) => [uniqueIndex("sender_domains_domain_unique").on(table.domain), index("sender_domains_org_id_created_at_idx").on(table.orgId, table.createdAt)]);
+}, (table) => [
+	uniqueIndex("sender_domains_org_id_domain_unique").on(table.orgId, table.domain),
+	uniqueIndex("sender_domains_verified_domain_unique").on(table.domain).where(sql`${table.status} = 'success'`),
+	index("sender_domains_org_id_created_at_idx").on(table.orgId, table.createdAt)
+]);
 const selectSenderDomainSchema = createSelectSchema(senderDomains);
 const insertSenderDomainSchema = createInsertSchema(senderDomains);
 
@@ -4552,6 +4619,92 @@ const identifierDtoSchema = z.object({
 	createdAt: z.iso.datetime()
 });
 
+//#endregion
+//#region ../../packages/shared/src/segment-definition.ts
+/**
+* A segment definition: a flat list of predicates over traits and event
+* history, combined with `all` or `any`. Deliberately flat — nested predicate groups are YAGNI for the
+* prototype, and a flat list keeps the pure evaluator a fold.
+*
+* `appId` scopes the EVENT side of a definition only. Traits are
+* per-profile and profiles merge across apps, so there is nothing
+* app-shaped to filter on the trait side.
+*
+* A definition and the membership it produces are both the
+* organization's.
+*
+* Apart from `./segments` because a journey's trigger carries a definition
+* and the trigger schema is bundled into the wasm guest, where an edge to
+* `@cowliss/db` (which `./segments` has, for the row schema) is a hard
+* bundler failure. Nothing here imports anything but zod.
+*
+* The object is strict: a definition holding the retired `sourceId` key
+* (which meant the app) fails loudly instead of parsing as an unfiltered
+* definition that evaluates over every app. There is deliberately no pipe
+* filter here — filtering by source is a later feature, and accepting one
+* now would make a stale `sourceId` parse as a filter on a pipe that does
+* not exist and silently match nothing.
+*/
+const SEGMENT_TRAIT_OPS = [
+	"eq",
+	"neq",
+	"gt",
+	"gte",
+	"lt",
+	"lte",
+	"exists",
+	"notExists",
+	"contains"
+];
+/** Operators that read no comparison value: presence of the key is the test. */
+const VALUELESS_TRAIT_OPS = ["exists", "notExists"];
+const predicateNameSchema = z.string().trim().min(1, "predicate name is required").max(200);
+const segmentPredicateSchema = z.discriminatedUnion("kind", [z.object({
+	kind: z.literal("trait"),
+	name: predicateNameSchema,
+	op: z.enum(SEGMENT_TRAIT_OPS),
+	/**
+	* Compared against the stored trait, which is `unknown` because
+	* identify accepts arbitrary JSON. The evaluator coerces both sides
+	* before comparing, so authors here (CLI, MCP, dashboard) get the
+	* form-field-friendly reading rather than strict JSON equality:
+	* numeric-looking strings are compared as numbers for eq/neq and for
+	* ordering ("150" matches 150, and orders like it), and "true"/"false"
+	* are compared as booleans for eq/neq, trimmed and case-insensitively
+	* (" TRUE " reads as true). Coercion needs both sides to agree on a
+	* type: "0" never equals false. The numeric net is as wide as
+	* `Number()`, so "0x64", "0b11" and "1e2" read as numbers too, which
+	* matters most for opaque ids: "007" is authored as the number 7.
+	*
+	* contains reads three ways. Against an array trait it is membership
+	* under that same equality, so "true" matches `[true]` and "1" matches
+	* `[1, 2]`. Against a string trait it is a plain substring search with
+	* no coercion, since substrings only mean something between strings.
+	* Against anything else it never matches. Ordering never coerces
+	* booleans.
+	*/
+	value: z.unknown().optional()
+}), z.object({
+	kind: z.literal("event"),
+	name: predicateNameSchema,
+	op: z.enum(["performed", "notPerformed"]),
+	/** How many matching events the predicate counts as "performed". */
+	atLeast: z.number().int().min(1).default(1),
+	/** Rolling window, relative to evaluation time; absent means all history. */
+	withinDays: z.number().int().min(1).optional()
+})]).refine((predicate) => predicate.kind !== "trait" || VALUELESS_TRAIT_OPS.includes(predicate.op) || predicate.value !== void 0, { message: "value is required unless op is exists or notExists" });
+const appIdSchema = z.string().trim().min(1);
+const segmentDefinitionSchema = z.strictObject({
+	match: z.enum(["all", "any"]).default("all"),
+	/**
+	* Optional app filter over the event side; null/absent spans apps.
+	* A list matches any of the named apps, which is how one definition
+	* names the development and the production id of the same app.
+	*/
+	appId: z.union([appIdSchema, z.array(appIdSchema).min(1)]).nullish(),
+	predicates: z.array(segmentPredicateSchema).min(1, "at least one predicate is required")
+});
+
 //#endregion
 //#region ../../packages/shared/src/journeys-v2/manifest.ts
 /**
@@ -4561,6 +4714,34 @@ const identifierDtoSchema = z.object({
 * changed, and stores that entry on the version it creates.
 */
 /**
+* A duration as journey code writes it: an ms-style string ("2d") or
+* milliseconds. It lives here rather than with the guest protocol because a
+* manifest carries one too (a journey's enrollment cooldown) and `./guest`
+* already imports this module, so the other direction would be a cycle.
+*/
+const durationSchema = z.union([z.string().min(1), z.number().int().nonnegative()]);
+const DURATION_PATTERN = /^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d|w)$/;
+const DURATION_UNIT_MS = {
+	ms: 1,
+	s: 1e3,
+	m: 6e4,
+	h: 36e5,
+	d: 864e5,
+	w: 6048e5
+};
+/**
+* A duration in milliseconds. The simulator's virtual clock and the runner's
+* timers both need it, and neither may pull in Temporal's `msToNumber` (one
+* runs in the CLI, the other inside workflow code).
+*/
+function parseDuration(duration) {
+	if (typeof duration === "number") return duration;
+	const match = DURATION_PATTERN.exec(duration.trim());
+	if (!match) throw new Error(`Duration ${JSON.stringify(duration)} is not a duration: use milliseconds or an ms-style string like "1h" or "2d".`);
+	const unit = DURATION_UNIT_MS[match[2]];
+	return Math.round(Number(match[1]) * unit);
+}
+/**
 * A journey or template key: the file basename under `journeys/` or
 * `emails/`, kebab-case and unique across the project. Becomes part of the
 * Temporal workflow id and travels in the journey chain, so it stays short.
@@ -4581,8 +4762,8 @@ const journeyKeySchema = z.string().max(64).regex(JOURNEY_KEY_PATTERN, "key must
 */
 const tagsSchema = z.array(z.string().trim().min(1).max(50, "a tag must be at most 50 characters")).max(20, "a journey or template takes at most 20 tags").default([]).transform((tags) => [...new Set(tags)]);
 /**
-* A consent purpose key: camelCase, matching the fixed `emailMarketing` and
-* `dataProcessing`. Purposes are keys in the `consent` map a customer reads
+* A consent purpose key: camelCase, matching the reserved `marketing` and
+* `transactional`. Purposes are keys in the `consent` map a customer reads
 * on their own profile, which is why they are not the kebab-case of a
 * journey key.
 */
@@ -4597,22 +4778,22 @@ const CONSENT_PURPOSE_KEY_PATTERN = /^[a-z][a-zA-Z0-9]*$/;
 const consentPurposeKeySchema = z.string().max(50, "a purpose key must be at most 50 characters").regex(CONSENT_PURPOSE_KEY_PATTERN, "a consent purpose key must be camelCase (a letter first, then letters and digits)");
 /**
 * One purpose a project declares in `cow.json` (spec: Decisions). A declared
-* purpose is marketing-class and sits under the `emailMarketing` umbrella,
-* so `denied` is the only default it may carry: the purpose is absent on
-* every profile that already exists, and a granted default would answer for
-* all of them at once.
+* purpose is marketing-class and sits under the `marketing` umbrella, so
+* `denied` is the only default it may carry: the purpose is absent on every
+* profile that already exists, and a granted default would answer for all of
+* them at once.
 *
 * The field stays required rather than disappearing, so every `cow.json` and
-* every stored manifest written before this still parses, and the column
-* behind it still holds `granted` for the seeded `dataProcessing` row: this
-* is a refusal at declaration time, not a narrower storage shape.
+* every stored manifest written before this still parses: this is a refusal
+* at declaration time, not a narrower storage shape.
 *
-* The two fixed purposes cannot be declared. They are seeded for every org
-* and owned by no project, so a project redeclaring one would be renaming
-* the master switch every other project's journeys hang off.
+* Neither reserved purpose can be declared: `marketing` is the master switch
+* every other project's journeys hang off, and `transactional` is not a
+* consent purpose at all, so declaring it would promise a switch that no
+* send ever reads.
 */
 const declaredPurposeSchema = z.strictObject({
-	key: consentPurposeKeySchema.refine((key) => !CONSENT_PURPOSES.includes(key), `${CONSENT_PURPOSES.join(" and ")} are fixed purposes and cannot be declared`),
+	key: consentPurposeKeySchema.refine((key) => !RESERVED_PURPOSES.includes(key), `${RESERVED_PURPOSES.join(" and ")} are reserved purposes and cannot be declared`),
 	/** What the dashboard and the account modal render beside the switch. */
 	label: z.string().trim().min(1).max(50, "a purpose label must be at most 50 characters"),
 	/** What the purpose means for a profile whose map does not answer it. */
@@ -4634,18 +4815,26 @@ const onePatternSchema = z.string().min(1).max(200, "a pattern must be at most 2
 const patternSchema = z.union([onePatternSchema, z.array(onePatternSchema).min(1).max(20, "a matcher takes at most 20 patterns")]);
 /**
 * What starts a journey: an event (optionally narrowed to an app id or a
-* list of them) or a segment entry. The registry DTO in `../journeys`
-* reuses it.
-*
-* Both members are strict, so a journey holding the retired `source` key
-* fails to compile instead of silently triggering on every app.
-* There is deliberately no pipe filter: a trigger narrows by the app the
-* write is attributed to, the same token a segment definition names.
+* list of them), or entry into the segment the trigger itself describes.
+* The registry DTO in `../journeys` reuses it.
+*
+* A segment trigger carries the predicate list, not a name: the push
+* materializes one segment row per journey that inlines a definition, owned
+* by the journey and named after its key, so the segment exists because the
+* journey exists and there is no order to get wrong (ADR 0016). The
+* definition is data — validated here, carried on the version, never
+* compiled and never executed.
+*
+* Both members are strict, so a journey holding the retired `source` key, or
+* the retired `{ segment: "name" }` form, fails to build instead of silently
+* triggering on every app or on nothing. There is deliberately no pipe
+* filter: a trigger narrows by the app the write is attributed to, the same
+* token a segment definition names.
 */
 const triggerSchema = z.union([z.strictObject({
 	event: patternSchema,
 	appId: patternSchema.optional()
-}), z.strictObject({ segment: z.string().min(1) })]);
+}), z.strictObject({ segment: segmentDefinitionSchema })]);
 /**
 * The address half of a from-header: a local part, an `@`, and a dotted
 * domain. Deliberately narrower than RFC 5322 (no quoted local parts, no
@@ -4748,10 +4937,35 @@ const manifestJourneySchema = z.object({
 	*/
 	purpose: consentPurposeKeySchema,
 	/**
+	* How often one recipient may enter. Enrollment derives from the purpose
+	* (ADR 0015), so the only thing an author writes is how long after a
+	* completed run the journey re-opens: absent means once, ever. Refused on
+	* a transactional journey, which enrolls on every trigger — see
+	* `manifestSchema` below, where the cross-field check lives (a refinement
+	* on this object would break the `.pick()` the guest SDK and the guest
+	* protocol both take of it).
+	*/
+	enrollment: z.strictObject({ cooldown: durationSchema.refine((value) => {
+		try {
+			parseDuration(value);
+			return true;
+		} catch {
+			return false;
+		}
+	}, "a cooldown must be milliseconds or an ms-style string like \"7d\"") }).optional(),
+	/**
+	* The author's own sentence about what this journey does, shown wherever
+	* the journey is read. Capped like a segment's description; absent when
+	* the author wrote none.
+	*/
+	description: z.string().trim().max(500, `description must be at most ${500} characters`).optional(),
+	/**
 	* The address every `send.email` in this journey goes out as, unless the
-	* call names its own. Optional everywhere: an omitted one is the
-	* organization's shared fallback address, which is what makes day-one
-	* sending zero-config (ADR 0014).
+	* call names its own. Required of the author (`defineJourney` types it so,
+	* and `cow build` refuses a journey without it), and still optional here:
+	* releases pushed before ADR 0014 was amended carry none, and this schema
+	* parses stored manifests as well as new ones. A push with no `from` is
+	* refused by the domain gate, which says what to do about it.
 	*/
 	from: fromSchema.optional(),
 	spine: z.array(spineEntrySchema),
@@ -4764,6 +4978,13 @@ const manifestTemplateSchema = z.object({
 	sendClass: z.enum(SEND_CLASSES),
 	/** True asks the host to mint a signed `verifyUrl` prop at send time. */
 	verifyLink: z.boolean(),
+	/**
+	* True asks the host to mint a signed `unsubscribeUrl` prop at send time,
+	* for the author's own footer link. Default false: a marketing send whose
+	* HTML carries no unsubscribe link at all still gets one, appended as a
+	* platform footer, so the link is never the author's to forget.
+	*/
+	unsubscribeLink: z.boolean().default(false),
 	/** JSON Schema of the template's `props`, converted by `cow build`. */
 	propsSchema: z.record(z.string(), z.unknown()),
 	bundle: digestSchema
@@ -4814,6 +5035,15 @@ const manifestSchema = z.object({
 	uniqueKeys(manifest.journeys, ctx, "journeys");
 	uniqueKeys(manifest.templates, ctx, "templates");
 	uniqueKeys(manifest.purposes ?? [], ctx, "purposes");
+	for (const [index, journey] of manifest.journeys.entries()) if (journey.enrollment && journey.purpose === "transactional") ctx.addIssue({
+		code: "custom",
+		message: `journey "${journey.key}": a transactional journey enrolls on every trigger, so it takes no enrollment cooldown`,
+		path: [
+			"journeys",
+			index,
+			"enrollment"
+		]
+	});
 });
 /**
 * One entry of a stored manifest: what a version is a snapshot of. Journeys
@@ -4877,7 +5107,7 @@ const traitBagSchema = z.custom((value) => value !== null && typeof value === "o
 * `identify` carries it too: the grant has to have a route in through
 * ingestion, or the only thing anyone can express is the revocation.
 */
-const consentPatchSchema = z.partialRecord(consentPurposeKeySchema.meta({ examples: [EMAIL_MARKETING] }), z.boolean()).refine((data) => Object.keys(data).length > 0, { message: "at least one consent purpose is required" });
+const consentPatchSchema = z.partialRecord(consentPurposeKeySchema.meta({ examples: [MARKETING] }), z.boolean()).refine((data) => Object.keys(data).length > 0, { message: "at least one consent purpose is required" });
 /**
 * The identify payload fields, shared between the single-call body schema
 * and the batch item schema (which drops `sourceId`: a batch names one
@@ -5523,6 +5753,7 @@ const dnsRecordSchema = z.object({
 /** One sending domain on the wire: dates become ISO 8601 strings. */
 const senderDomainSchema = selectSenderDomainSchema.extend({
 	dnsRecords: z.array(dnsRecordSchema),
+	challengeVerifiedAt: z.iso.datetime().nullable(),
 	lastCheckedAt: z.iso.datetime().nullable(),
 	createdAt: z.iso.datetime(),
 	updatedAt: z.iso.datetime()
@@ -5645,29 +5876,6 @@ function patternPlaceholder(pattern) {
 * a guest returns with these schemas before anything acts on it; the guest
 * SDK and the Node simulator produce and consume the same shapes.
 */
-/** A duration as journey code writes it: an ms-style string ("2d") or milliseconds. */
-const durationSchema = z.union([z.string().min(1), z.number().int().nonnegative()]);
-const DURATION_PATTERN = /^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d|w)$/;
-const DURATION_UNIT_MS = {
-	ms: 1,
-	s: 1e3,
-	m: 6e4,
-	h: 36e5,
-	d: 864e5,
-	w: 6048e5
-};
-/**
-* A duration in milliseconds. The simulator's virtual clock and the runner's
-* timers both need it, and neither may pull in Temporal's `msToNumber` (one
-* runs in the CLI, the other inside workflow code).
-*/
-function parseDuration(duration) {
-	if (typeof duration === "number") return duration;
-	const match = DURATION_PATTERN.exec(duration.trim());
-	if (!match) throw new Error(`Duration ${JSON.stringify(duration)} is not a duration: use milliseconds or an ms-style string like "1h" or "2d".`);
-	const unit = DURATION_UNIT_MS[match[2]];
-	return Math.round(Number(match[1]) * unit);
-}
 /** The event a journey runs for, or waits on: name, properties, and when. */
 const guestEventSchema = z.object({
 	name: z.string().min(1),
@@ -5707,8 +5915,9 @@ const commandSchema = z.discriminatedUnion("name", [
 			/**
 			* The address this mail leaves as. The guest SDK fills in the
 			* journey's own whenever the call does not name one, so the host has
-			* one resolution path and never reads the manifest to find it;
-			* absent on both is the organization's shared fallback address.
+			* one resolution path and never reads the manifest to find it. A
+			* journey must name one, so absent on both is a release pushed before
+			* that was true, and the `domain` gate refuses it.
 			*/
 			from: fromSchema.optional(),
 			/** Where a reply to this one mail goes, instead of the from-address. */
@@ -5852,11 +6061,14 @@ const manifestInputSchema = z.object({ kind: z.literal("manifest") });
 const manifestOutputSchema = z.discriminatedUnion("kind", [manifestJourneySchema.pick({
 	trigger: true,
 	purpose: true,
+	enrollment: true,
+	description: true,
 	from: true,
 	tags: true
 }).extend({ kind: z.literal("journey") }), manifestTemplateSchema.pick({
 	sendClass: true,
 	verifyLink: true,
+	unsubscribeLink: true,
 	propsSchema: true,
 	tags: true
 }).extend({ kind: z.literal("template") })]);
@@ -6086,7 +6298,7 @@ const listVersionsQuerySchema = paginationQuerySchema.extend({
 });
 /**
 * One key of a project as `cow status` and the MCP `status` tool report it:
-* the code the server holds for it, whether it is on, and what is still
+* the code the server holds for it, what state it is in, and what is still
 * running. Journeys and templates share the shape, because a developer asks
 * the same question of both; the two fields only a journey has are null on a
 * template.
@@ -6100,8 +6312,12 @@ const projectStatusKeySchema = z.object({
 	* server holds. Null only for a journey whose versions are all pruned.
 	*/
 	latestVersion: versionSchema.nullable(),
-	/** The journey's one flag; null on a template, which has none. */
-	enabled: z.boolean().nullable(),
+	/**
+	* The journey's one state; null on a template, which has none. Built from
+	* the column here rather than imported from `journeys.ts`, which reads
+	* this module for its version summary.
+	*/
+	status: z.enum(journeyStatusEnum.enumValues).nullable(),
 	/** Executions still running or waiting. */
 	liveExecutions: z.number().int()
 });
@@ -6122,12 +6338,62 @@ const projectStatusSchema = z.object({
 	warnings: z.array(z.string())
 });
 
+//#endregion
+//#region ../../packages/shared/src/segments.ts
+const segmentSchema = selectSegmentSchema.extend({
+	definition: segmentDefinitionSchema,
+	createdAt: z.iso.datetime(),
+	updatedAt: z.iso.datetime()
+});
+/** The detail view adds the materialized member count. */
+const segmentDetailSchema = segmentSchema.extend({ memberCount: z.number().int().min(0) });
+const segmentMemberSchema = z.object({
+	segmentId: z.string(),
+	orgId: z.string(),
+	profileId: z.string(),
+	enteredAt: z.iso.datetime()
+});
+/**
+* The builder's design-time sanity check: run one not-yet-persisted
+* definition over the org's existing profiles. Members is a small sample of
+* matching profile ids, not the full member list: there is no segment row
+* and no membership entry, so there is no segmentId or enteredAt to report.
+*
+* The scan is bounded, so `memberCount` is the exact org-wide count only
+* when `truncated` is false. When it is true the scan stopped at the cap,
+* and `memberCount` is the count over the first `scanned` profiles only.
+*/
+const previewSegmentBodySchema = z.object({ data: segmentDefinitionSchema });
+const segmentPreviewSchema = z.object({
+	memberCount: z.number().int().min(0),
+	members: z.array(z.string()),
+	/** Profiles the preview actually evaluated. */
+	scanned: z.number().int().min(0),
+	/** True when the scan hit its cap, so memberCount is a floor. */
+	truncated: z.boolean()
+});
+const nameSchema = z.string().trim().min(1, "name is required").max(100, "name must be at most 100 characters");
+const descriptionSchema = z.string().trim().max(500, `description must be at most ${500} characters`);
+const createSegmentBodySchema = z.object({ data: z.object({
+	name: nameSchema,
+	description: descriptionSchema.nullish(),
+	definition: segmentDefinitionSchema
+}) });
+const updateSegmentBodySchema = z.object({ data: z.object({
+	name: nameSchema.optional(),
+	description: descriptionSchema.nullish(),
+	definition: segmentDefinitionSchema.optional()
+}).refine((data) => data.name !== void 0 || data.description !== void 0 || data.definition !== void 0, { message: "at least one field (name, description or definition) is required" }) });
+/** `q` is a substring search over the segment's name. */
+const listSegmentsQuerySchema = paginationQuerySchema.extend({ q: searchQuerySchema });
+const listSegmentMembersQuerySchema = paginationQuerySchema.extend({});
+
 //#endregion
 //#region ../../packages/shared/src/journeys.ts
 /**
 * Journeys as the API reports them: the rows a push derives from its
 * manifest, one per (org, key). Nothing here is authored through the API, so
-* the only write is the enable flag.
+* the only write is the status.
 *
 * Derived from the Drizzle table via drizzle-zod so the wire DTO and the row
 * share one source of truth; the jsonb columns get explicit wire schemas
@@ -6140,11 +6406,19 @@ const journeyTriggerSchema = triggerSchema;
 * control flow is whatever its code does at run time.
 */
 const journeySpineEntrySchema = spineEntrySchema;
+/**
+* The one operational state a manager sets (ADR 0018). `on` lets recipients
+* enroll and executions run; `off` enrolls nobody and lets what is in flight
+* finish; `paused` enrolls nobody and holds what is in flight before its next
+* step. Turning a paused journey on resumes it.
+*/
+const JOURNEY_STATUSES = journeyStatusEnum.enumValues;
+const journeyStatusSchema = z.enum(JOURNEY_STATUSES);
 const journeySchema = selectJourneySchema.extend({
 	trigger: journeyTriggerSchema,
 	purpose: consentPurposeKeySchema,
 	spine: z.array(journeySpineEntrySchema),
-	enabled: z.boolean(),
+	status: journeyStatusSchema,
 	/**
 	* The newest version of this key, whatever it compiled to, so a list can
 	* say "pushed 2 hours ago" and "compiling" without a second read. What the
@@ -6157,14 +6431,24 @@ const journeySchema = selectJourneySchema.extend({
 	updatedAt: z.iso.datetime()
 });
 /**
+* One journey, with the segment it owns when its trigger inlines a
+* definition (ADR 0016): the same row and member count the segments API
+* reports, so the journey's page can show who is in its segment without a
+* second concept. Null for an event trigger.
+*
+* On the read of one journey only. A list would be one member count per row,
+* and a list already shows the trigger.
+*/
+const journeyDetailSchema = journeySchema.extend({ segment: segmentDetailSchema.nullable() });
+/**
 * Journey list query. `q` is a substring search over the key and the tags,
 * the two things an author names a journey by; `tag` is "has this tag",
 * exact and case-sensitive, so a badge in the table is the way into it.
 * Both are server-side, like every other list filter.
 */
 const listJourneysQuerySchema = paginationQuerySchema.extend({
-	/** On or off; the journey's one flag. */
-	enabled: z.enum(["true", "false"]).optional(),
+	/** On, off or paused; the journey's one state. */
+	status: journeyStatusSchema.optional(),
 	q: z.string().trim().max(200, "q must be at most 200 characters").optional().transform((value) => value ? value : void 0),
 	tag: z.string().trim().max(50, "tag must be at most 50 characters").optional()
 });
@@ -6192,18 +6476,24 @@ const journeyStatsSchema = z.object({
 	deliveries: z.object({ byStatus: z.record(deliveryStatusSchema, z.number().int()) })
 });
 /**
-* Which journeys the flag acts on: the keys the caller named, or every
-* journey of one project. Exactly one of the two, because a call carrying
-* both would have to decide which it meant.
+* Which journeys the status acts on, and which state to put them in: the
+* keys the caller named, or every journey of one project. Exactly one of the
+* two selectors, because a call carrying both would have to decide which it
+* meant.
 *
 * A list rather than one key per call so every surface can do what `cow
 * enable` does: name several keys, or `--all` (which is `project`, resolved
 * server-side, so an agent turning a project on is one call too).
+*
+* One body for three states rather than a route per verb (ADR 0018): the
+* transitions differ in what they do to what is in flight, not in who may
+* ask or what they name.
 */
-const setJourneysEnabledBodySchema = z.object({ data: z.object({
+const setJourneysStatusBodySchema = z.object({ data: z.object({
 	keys: z.array(journeyKeySchema).min(1).max(PUSH_LIMITS.journeys).optional(),
 	/** Every journey of this project, by the name `cow.json` carries. */
-	project: projectNameSchema.optional()
+	project: projectNameSchema.optional(),
+	status: journeyStatusSchema
 }).refine((data) => data.keys === void 0 !== (data.project === void 0), { message: "name keys or a project, not both" }) });
 /**
 * Dry run: one real profile, the journey's latest ready version, and every
@@ -6212,6 +6502,106 @@ const setJourneysEnabledBodySchema = z.object({ data: z.object({
 * now and a v1 instance was a Temporal read.
 */
 const dryRunJourneyBodySchema = z.object({ data: z.object({ profileId: z.string().min(1) }) });
+/**
+* Enrollment (ADR 0015): what turning a journey on would do, or is doing,
+* to the people already in its audience.
+*
+* The same three numbers answer both questions, so they are one schema: a
+* preview walks the whole segment counting, and the running job counts the
+* same way as it goes. `scanned` is the segment's current membership,
+* `enrolled` the ones that entered (or in a preview would), and the skips
+* say why the rest did not.
+*/
+const enrollmentCountsSchema = z.object({
+	scanned: z.number().int(),
+	enrolled: z.number().int(),
+	skipped: z.object({
+		/** They have been through this journey, and it enrolls once. */
+		completed: z.number().int(),
+		/** They finished recently and the journey's cooldown has not elapsed. */
+		cooldown: z.number().int(),
+		/** They are in the journey right now. */
+		running: z.number().int()
+	})
+});
+/**
+* How each skip is said to a person, in the order the surfaces list them.
+* The confirm screen, the progress card and `cow enable` all report the same
+* three numbers, and the words for them live here so the three cannot drift:
+* `tile` names the count on its own, `reason` completes "N ...".
+*/
+const ENROLLMENT_SKIP_WORDS = {
+	completed: {
+		tile: "Already been through",
+		reason: "have already been through it"
+	},
+	cooldown: {
+		tile: "Too recently",
+		reason: "went through it too recently"
+	},
+	running: {
+		tile: "In it already",
+		reason: "are in it right now"
+	}
+};
+const enrollmentStatusSchema = enrollmentCountsSchema.extend({ 
+/**
+* `running` while the job works, `done` when it finished the segment,
+* `cancelled` when someone stopped it, `stopped` when the journey itself
+* stopped being on under it, `failed` when it could not finish. On any of
+* the three that end early the counts are what it reached, and the people
+* it already enrolled stay in the journey.
+*/
+state: z.enum([
+	"running",
+	"done",
+	"cancelled",
+	"stopped",
+	"failed"
+]) });
+/**
+* What a journey turned on says about the audience it now has waiting.
+*
+* It rides on the status response rather than being fetched separately so
+* that every surface that moves the control sees it: `cow enable` prints it,
+* and the MCP tool, which is planned from the contract and has no code of
+* its own, returns it. An agent that cannot start the enrollment can still
+* tell the person who can how many people it would reach and where to go.
+*
+* Null on a journey whose trigger is an event: there is no standing audience
+* to reach. `counts` is null when the numbers could not be worked out just
+* then; the journey is on either way, because a count nobody could read is
+* no reason to leave the switch off.
+*/
+const enrollmentOfferSchema = z.object({
+	counts: enrollmentCountsSchema.nullable(),
+	/** The journey's page, where the offer can be accepted. */
+	url: z.string()
+});
+/**
+* A journey as the status route answers, carrying that offer. Null on every
+* status but `on`: a journey turned off or held reaches nobody, so there is
+* no audience to offer.
+*/
+const journeyWithOfferSchema = journeySchema.extend({ enrollment: enrollmentOfferSchema.nullable() });
+/**
+* What holding a journey until a given day would end (ADR 0018). A wait
+* that comes due while the journey is held ends that person's run, so
+* before putting one on hold it is worth knowing how many runs that is.
+*
+* The day is the caller's, not a fixed horizon: "until tomorrow" and "until
+* next month" are different decisions, and the numbers behind them are what
+* tell them apart.
+*/
+const waitsDueQuerySchema = z.object({ 
+/** Count the waits that come due before this instant. */
+before: z.iso.datetime() });
+const waitsDueSchema = z.object({
+	/** Executions in flight whose next step comes due before then. */
+	due: z.number().int(),
+	/** Executions in flight altogether, due or not. */
+	inFlight: z.number().int()
+});
 
 //#endregion
 //#region ../../packages/shared/src/journeys-v2/sandbox.ts
@@ -6330,7 +6720,7 @@ const RESEND_MAX_TAGS = 50;
 const recipientSchema = z.string().trim().max(320).refine((value) => parseFromAddress(value) !== null, { message: "Every recipient must be an address (\"ada@acme.com\") or a name and address (\"Ada <ada@acme.com>\")." });
 const recipientArraySchema = z.array(recipientSchema).min(1).max(50);
 /** Resend takes one address or a list wherever it takes recipients. */
-const recipientsSchema = z.union([recipientSchema, recipientArraySchema]);
+const recipientsSchema$1 = z.union([recipientSchema, recipientArraySchema]);
 /**
 * Resend's wording for an absent required field. Three fields can be
 * missing: `to`, `subject`, and a body. Which answer each one gets is read
@@ -6361,11 +6751,11 @@ const templateSlotSchema = z.strictObject({
 /** Send body: Resend's fields, minus the ones Cowliss does not serve. */
 const resendSendBodySchema = z.strictObject({
 	/**
-	* Optional here where Resend requires it: an omitted `from` is the
-	* organization's shared fallback address, which is what makes a first
-	* send work with no configuration at all.
+	* Required, exactly as Resend requires it. There is no address to fall
+	* back to: a send leaves from a domain the organization verified, and
+	* nothing else. Missing is its own issue for the same reason `to`'s is.
 	*/
-	from: z.string().trim().max(200).refine((value) => parseFromAddress(value) !== null, { message: "The from address must be an address (\"billing@acme.com\") or a name and address (\"Billing <billing@acme.com>\")." }).optional(),
+	from: z.string().trim().max(200).refine((value) => parseFromAddress(value) !== null, { message: "The from address must be an address (\"billing@acme.com\") or a name and address (\"Billing <billing@acme.com>\")." }).optional().nonoptional({ error: MISSING("from") }),
 	/**
 	* Required, and the absence is its own issue rather than the union's:
 	* `optional().nonoptional()` lets the value through to the union when
@@ -6382,9 +6772,9 @@ const resendSendBodySchema = z.strictObject({
 	subject: z.string().trim().min(1).max(RESEND_MAX_SUBJECT).optional(),
 	html: z.string().optional(),
 	text: z.string().optional(),
-	cc: recipientsSchema.optional(),
-	bcc: recipientsSchema.optional(),
-	reply_to: recipientsSchema.optional(),
+	cc: recipientsSchema$1.optional(),
+	bcc: recipientsSchema$1.optional(),
+	reply_to: recipientsSchema$1.optional(),
 	headers: z.record(z.string(), z.string()).optional(),
 	/** Accepted and dropped: Cowliss tags a delivery by its own fields. */
 	tags: z.array(z.object({
@@ -6573,133 +6963,71 @@ const listReviewQuerySchema = paginationQuerySchema.extend({
 });
 
 //#endregion
-//#region ../../packages/shared/src/segments.ts
+//#region ../../packages/shared/src/send-email.ts
 /**
-* Segments API contracts. The definition is the interesting part: a flat
-* list of predicates over traits and event history, combined with `all` or
-* `any`. Deliberately flat — nested predicate groups are YAGNI for the
-* prototype, and a flat list keeps the pure evaluator a fold.
-*
-* `appId` scopes the EVENT side of a definition only. Traits are
-* per-profile and profiles merge across apps, so there is nothing
-* app-shaped to filter on the trait side.
-*
-* A definition and the membership it produces are both the
-* organization's.
+* `POST /v1/emails`: the first-party transactional send, the one a
+* `@cowliss/sdk` client calls. The Resend-compatible facade (ADR 0014) is
+* the same send in somebody else's wire format; this is ours, so it is
+* camelCase, enveloped, and answers with our error codes.
 *
-* The object is strict: a definition holding the retired `sourceId` key
-* (which meant the app) fails loudly instead of parsing as an unfiltered
-* definition that evaluates over every app. There is deliberately no pipe
-* filter here — filtering by source is a later feature, and accepting one
-* now would make a stale `sourceId` parse as a filter on a pipe that does
-* not exist and silently match nothing.
+* The limits are deliberately the same numbers as the facade's: two shapes
+* over one send path must not accept different messages.
 */
-const SEGMENT_TRAIT_OPS = [
-	"eq",
-	"neq",
-	"gt",
-	"gte",
-	"lt",
-	"lte",
-	"exists",
-	"notExists",
-	"contains"
-];
-/** Operators that read no comparison value: presence of the key is the test. */
-const VALUELESS_TRAIT_OPS = ["exists", "notExists"];
-const predicateNameSchema = z.string().trim().min(1, "predicate name is required").max(200);
-const segmentPredicateSchema = z.discriminatedUnion("kind", [z.object({
-	kind: z.literal("trait"),
-	name: predicateNameSchema,
-	op: z.enum(SEGMENT_TRAIT_OPS),
-	/**
-	* Compared against the stored trait, which is `unknown` because
-	* identify accepts arbitrary JSON. The evaluator coerces both sides
-	* before comparing, so authors here (CLI, MCP, dashboard) get the
-	* form-field-friendly reading rather than strict JSON equality:
-	* numeric-looking strings are compared as numbers for eq/neq and for
-	* ordering ("150" matches 150, and orders like it), and "true"/"false"
-	* are compared as booleans for eq/neq, trimmed and case-insensitively
-	* (" TRUE " reads as true). Coercion needs both sides to agree on a
-	* type: "0" never equals false. The numeric net is as wide as
-	* `Number()`, so "0x64", "0b11" and "1e2" read as numbers too, which
-	* matters most for opaque ids: "007" is authored as the number 7.
-	*
-	* contains reads three ways. Against an array trait it is membership
-	* under that same equality, so "true" matches `[true]` and "1" matches
-	* `[1, 2]`. Against a string trait it is a plain substring search with
-	* no coercion, since substrings only mean something between strings.
-	* Against anything else it never matches. Ordering never coerces
-	* booleans.
-	*/
-	value: z.unknown().optional()
-}), z.object({
-	kind: z.literal("event"),
-	name: predicateNameSchema,
-	op: z.enum(["performed", "notPerformed"]),
-	/** How many matching events the predicate counts as "performed". */
-	atLeast: z.number().int().min(1).default(1),
-	/** Rolling window, relative to evaluation time; absent means all history. */
-	withinDays: z.number().int().min(1).optional()
-})]).refine((predicate) => predicate.kind !== "trait" || VALUELESS_TRAIT_OPS.includes(predicate.op) || predicate.value !== void 0, { message: "value is required unless op is exists or notExists" });
-const appIdSchema = z.string().trim().min(1);
-const segmentDefinitionSchema = z.strictObject({
-	match: z.enum(["all", "any"]).default("all"),
+const addressSchema = z.string().trim().max(320).refine((value) => parseFromAddress(value) !== null, { message: "An address is \"ada@acme.com\" or a name and address, \"Ada <ada@acme.com>\"." });
+/** One address or a list, wherever a message names recipients. */
+const recipientsSchema = z.union([addressSchema, z.array(addressSchema).min(1).max(50)]);
+/** A template this organization pushed, plus the props it declares. */
+const templateSchema$1 = z.strictObject({
+	key: journeyKeySchema,
+	props: z.record(z.string(), z.unknown()).optional()
+});
+const sendEmailDataSchema = z.strictObject({
+	sourceId: z.string(),
+	to: recipientsSchema,
+	cc: recipientsSchema.optional(),
+	bcc: recipientsSchema.optional(),
+	replyTo: recipientsSchema.optional(),
 	/**
-	* Optional app filter over the event side; null/absent spans apps.
-	* A list matches any of the named apps, which is how one definition
-	* names the development and the production id of the same app.
+	* An address on a domain this organization verified. There is no other.
+	* Shape is checked here, the same as the Resend body checks it, so an
+	* address that is not one is a 422 naming the field rather than a 403
+	* telling the caller to verify a domain they never named.
 	*/
-	appId: z.union([appIdSchema, z.array(appIdSchema).min(1)]).nullish(),
-	predicates: z.array(segmentPredicateSchema).min(1, "at least one predicate is required")
-});
-const segmentSchema = selectSegmentSchema.extend({
-	definition: segmentDefinitionSchema,
-	createdAt: z.iso.datetime(),
-	updatedAt: z.iso.datetime()
-});
-/** The detail view adds the materialized member count. */
-const segmentDetailSchema = segmentSchema.extend({ memberCount: z.number().int().min(0) });
-const segmentMemberSchema = z.object({
-	segmentId: z.string(),
-	orgId: z.string(),
-	profileId: z.string(),
-	enteredAt: z.iso.datetime()
-});
-/**
-* The builder's design-time sanity check: run one not-yet-persisted
-* definition over the org's existing profiles. Members is a small sample of
-* matching profile ids, not the full member list: there is no segment row
-* and no membership entry, so there is no segmentId or enteredAt to report.
-*
-* The scan is bounded, so `memberCount` is the exact org-wide count only
-* when `truncated` is false. When it is true the scan stopped at the cap,
-* and `memberCount` is the count over the first `scanned` profiles only.
-*/
-const previewSegmentBodySchema = z.object({ data: segmentDefinitionSchema });
-const segmentPreviewSchema = z.object({
-	memberCount: z.number().int().min(0),
-	members: z.array(z.string()),
-	/** Profiles the preview actually evaluated. */
-	scanned: z.number().int().min(0),
-	/** True when the scan hit its cap, so memberCount is a floor. */
-	truncated: z.boolean()
+	from: z.string().trim().max(200).refine((value) => parseFromAddress(value) !== null, { message: "The from address must be an address (\"billing@acme.com\") or a name and address (\"Billing <billing@acme.com>\")." }),
+	subject: z.string().max(RESEND_MAX_SUBJECT).optional(),
+	html: z.string().optional(),
+	text: z.string().optional(),
+	headers: z.record(z.string(), z.string()).optional(),
+	template: templateSchema$1.optional()
+}).superRefine((body, ctx) => {
+	const hasBody = body.html !== void 0 || body.text !== void 0;
+	if (body.template) {
+		for (const field of [
+			"subject",
+			"html",
+			"text"
+		]) if (body[field] !== void 0) ctx.addIssue({
+			code: "custom",
+			path: [field],
+			message: `A message names a template or writes its own body, not both. Drop \`${field}\`.`
+		});
+		return;
+	}
+	if (!hasBody) ctx.addIssue({
+		code: "custom",
+		path: ["html"],
+		message: "A message needs a template, or an html or text body."
+	});
+	if (body.subject === void 0) ctx.addIssue({
+		code: "custom",
+		path: ["subject"],
+		message: "A message that writes its own body needs a subject."
+	});
 });
-const nameSchema = z.string().trim().min(1, "name is required").max(100, "name must be at most 100 characters");
-const descriptionSchema = z.string().trim().max(500, "description must be at most 500 characters");
-const createSegmentBodySchema = z.object({ data: z.object({
-	name: nameSchema,
-	description: descriptionSchema.nullish(),
-	definition: segmentDefinitionSchema
-}) });
-const updateSegmentBodySchema = z.object({ data: z.object({
-	name: nameSchema.optional(),
-	description: descriptionSchema.nullish(),
-	definition: segmentDefinitionSchema.optional()
-}).refine((data) => data.name !== void 0 || data.description !== void 0 || data.definition !== void 0, { message: "at least one field (name, description or definition) is required" }) });
-/** `q` is a substring search over the segment's name. */
-const listSegmentsQuerySchema = paginationQuerySchema.extend({ q: searchQuerySchema });
-const listSegmentMembersQuerySchema = paginationQuerySchema.extend({});
+const sendEmailBodySchema = z.object({ data: sendEmailDataSchema });
+const sendEmailResultSchema = z.object({ 
+/** The delivery this send left behind: the row in Deliveries. */
+deliveryId: z.string() });
 
 //#endregion
 //#region ../../packages/shared/src/settings.ts
@@ -6722,9 +7050,9 @@ const orgSettingsDtoSchema = z.object({
 	/**
 	* Clerk's slug and display name for the org, cached by the API and
 	* READ-ONLY here: Clerk owns them, and the org profile is edited in
-	* Clerk's own UI. Exposed because they are the shared fallback sender the
-	* domains page shows (`<slug>@<shared domain>` as `<name>`). Null until a
-	* member has hit the dashboard API once.
+	* Clerk's own UI. Exposed because a template test-send composes its
+	* from-address out of them (`orgFromAddress`). Null until a member has hit
+	* the dashboard API once.
 	*/
 	slug: z.string().nullable(),
 	name: z.string().nullable()
@@ -6863,6 +7191,12 @@ const templateSchema = z.object({
 	sendClass: z.enum(SEND_CLASSES),
 	/** True when the template asks for a signed `verifyUrl` prop at send time. */
 	verifyLink: z.boolean(),
+	/**
+	* True when the template asks for a signed `unsubscribeUrl` prop at send
+	* time. A marketing template without one (or without rendering the link)
+	* gets a platform footer with the link appended at send time instead.
+	*/
+	unsubscribeLink: z.boolean().default(false),
 	/** JSON Schema of the template's props, as `cow build` converted them. */
 	propsSchema: z.record(z.string(), z.unknown()),
 	/** The newest version of this key, whatever it compiled to. */
@@ -6912,6 +7246,20 @@ const userSegmentSchema = z.object({
 });
 const listUserSegmentsQuerySchema = paginationQuerySchema;
 /**
+* One journey the profile ran to completion
+* (GET /v1/users/:profileId/runs): which journey it was, when it finished,
+* and the execution it finished, which is null once that execution is no
+* longer kept. Paged on (completedAt, id) newest first, so the cursor's
+* sortAt slot carries the completion time.
+*/
+const userRunSchema = z.object({
+	id: z.string(),
+	journeyKey: z.string(),
+	completedAt: z.iso.datetime(),
+	executionId: z.string().nullable()
+});
+const listUserRunsQuerySchema = paginationQuerySchema;
+/**
 * Profile list query. `q` is a free-text substring search over the
 * profile's identifier values and the identity traits in
 * PROFILE_SEARCH_TRAITS; absent means no filter. An empty or
@@ -7992,8 +8340,13 @@ async function buildProject(projectDir) {
 	const manifestJourneys = [];
 	const manifestTemplates = [];
 	for (const built of bundles) {
-		const { module, runGuest } = await loadNodeBundle(projectDir, built.source.key, built.source.kind);
-		const report = await runGuest(module, { kind: "manifest" });
+		let report;
+		try {
+			const { module, runGuest } = await loadNodeBundle(projectDir, built.source.key, built.source.kind);
+			report = await runGuest(module, { kind: "manifest" });
+		} catch (error) {
+			throw new Error(`${built.source.relPath}: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+		}
 		const isJourney = built.source.kind === "journeys";
 		if (report?.kind !== (isJourney ? "journey" : "template")) throw new Error(`${built.source.relPath} is not a ${isJourney ? "journey" : "template"}: a journey default-exports defineJourney({ ... }), a template exports a component and a zod \`props\` schema.`);
 		if (report.kind === "journey") manifestJourneys.push({
@@ -8001,6 +8354,8 @@ async function buildProject(projectDir) {
 			tags: report.tags,
 			trigger: report.trigger,
 			purpose: report.purpose,
+			enrollment: report.enrollment,
+			description: report.description,
 			from: report.from,
 			spine: readSpine(await readFile(built.source.file, "utf8")),
 			bundle: built.digest
@@ -8010,6 +8365,7 @@ async function buildProject(projectDir) {
 			tags: report.tags,
 			sendClass: report.sendClass,
 			verifyLink: report.verifyLink,
+			unsubscribeLink: report.unsubscribeLink,
 			propsSchema: report.propsSchema,
 			bundle: built.digest
 		});
@@ -8332,7 +8688,7 @@ function openBrowser(url) {
 //#region src/commands/auth.ts
 /** login/logout/whoami: session-token management, no contract route. */
 function registerAuth(program, env, io) {
-	program.command("login").description("authenticate via the dashboard browser flow (or --token) and cache the session token").option("--token <jwt>", "paste a Clerk session token instead of the browser flow").option("--web <url>", `dashboard URL; overrides COW_WEB_URL and webUrl in the project config (default ${DEFAULT_WEB_URL})`).option("--no-open", "do not open the browser; print the URL and wait (headless/agent use)").action(async (opts) => {
+	program.command("login").description("authenticate via the dashboard browser flow (or --token) and cache the session token").option("--token <jwt>", "paste a session token instead of the browser flow").option("--web <url>", `dashboard URL; overrides COW_WEB_URL and webUrl in the project config (default ${DEFAULT_WEB_URL})`).option("--no-open", "do not open the browser; print the URL and wait (headless/agent use)").action(async (opts) => {
 		const outcome = await login(env, {
 			token: opts.token,
 			webUrl: opts.web,
@@ -9300,11 +9656,11 @@ const domains = defineModule(defineRoute({
 	path: "/v1/domains",
 	operationId: "domains.create",
 	tags: ["domains"],
-	summary: "Claim a sending domain",
+	summary: "Add a sending domain",
 	security: SESSION_AUTH,
 	request: { body: jsonBody(createSenderDomainBodySchema) },
 	responses: {
-		201: envelope(senderDomainSchema, "The claimed domain with the DNS records to publish"),
+		201: envelope(senderDomainSchema, "The domain with the DNS records to publish, which is what claims it"),
 		...sessionErrors,
 		...errors("conflict", "validation_failed", "malformed_request", "dependency_unavailable")
 	}
@@ -9357,7 +9713,7 @@ const domains = defineModule(defineRoute({
 	path: "/v1/domains/{id}",
 	operationId: "domains.delete",
 	tags: ["domains"],
-	summary: "Give up a domain claim",
+	summary: "Give up a sending domain",
 	security: SESSION_AUTH,
 	request: { params: params$9 },
 	responses: {
@@ -9369,8 +9725,31 @@ const domains = defineModule(defineRoute({
 
 //#endregion
 //#region ../../packages/shared/src/contract/emails.ts
-/** The public email-verification pages: the signed token is the authorization. */
+/**
+* The transactional send a developer's own code makes, plus the public
+* email-verification pages.
+*
+* `emails.send` is the first-party shape of the same send the Resend facade
+* serves (ADR 0014): one service, two wire formats, and this one answers in
+* the envelope with our error codes. It authenticates with an org API key
+* like the rest of the write path, which is why it is hidden from the CLI
+* and MCP surfaces: those hold a session.
+*/
 const emails = defineModule(defineRoute({
+	method: "post",
+	path: "/v1/emails",
+	operationId: "emails.send",
+	tags: ["emails"],
+	summary: "Send one transactional email",
+	security: API_KEY_AUTH,
+	surfaces: HIDDEN_FROM_TOOLS,
+	request: { body: jsonBody(sendEmailBodySchema) },
+	responses: {
+		201: envelope(sendEmailResultSchema, "Handed over; the delivery's id"),
+		...ingestionErrors,
+		...errors("forbidden", "not_found", "conflict")
+	}
+}), defineRoute({
 	method: "get",
 	path: "/v1/public/verify",
 	operationId: "emails.verifyPage",
@@ -9644,7 +10023,7 @@ const journeys = defineModule(defineRoute({
 	security: SESSION_AUTH,
 	request: { params: params$7 },
 	responses: {
-		200: envelope(journeySchema),
+		200: envelope(journeyDetailSchema),
 		...sessionErrors,
 		...errors("not_found")
 	}
@@ -9663,31 +10042,33 @@ const journeys = defineModule(defineRoute({
 	}
 }), defineRoute({
 	method: "post",
-	path: "/v1/journeys/enable",
-	operationId: "journeys.enable",
+	path: "/v1/journeys/status",
+	operationId: "journeys.setStatus",
 	tags: ["journeys"],
-	summary: "Turn journeys on",
+	summary: "Put journeys on, off or on hold",
 	security: PIPELINE_AUTH,
 	surfaces: { cli: false },
-	request: { body: jsonBody(setJourneysEnabledBodySchema) },
+	request: { body: jsonBody(setJourneysStatusBodySchema) },
 	responses: {
-		200: envelope(z.array(journeySchema), "The journeys as they now stand"),
+		200: envelope(z.array(journeyWithOfferSchema), "The journeys as they now stand, each with the members turning it on has waiting"),
 		...sessionErrors,
 		...errors("not_found", "project_missing", "validation_failed", "malformed_request")
 	}
 }), defineRoute({
-	method: "post",
-	path: "/v1/journeys/disable",
-	operationId: "journeys.disable",
+	method: "get",
+	path: "/v1/journeys/{key}/waits",
+	operationId: "journeys.waitsDue",
 	tags: ["journeys"],
-	summary: "Turn journeys off",
-	security: PIPELINE_AUTH,
-	surfaces: { cli: false },
-	request: { body: jsonBody(setJourneysEnabledBodySchema) },
+	summary: "Count the executions a hold until a given day would end",
+	security: SESSION_AUTH,
+	request: {
+		params: params$7,
+		query: waitsDueQuerySchema
+	},
 	responses: {
-		200: envelope(z.array(journeySchema), "The journeys as they now stand"),
+		200: envelope(waitsDueSchema, "Executions in flight, and how many of them come due before that instant"),
 		...sessionErrors,
-		...errors("not_found", "project_missing", "validation_failed", "malformed_request")
+		...errors("not_found", "validation_failed")
 	}
 }), defineRoute({
 	method: "delete",
@@ -9702,6 +10083,59 @@ const journeys = defineModule(defineRoute({
 		...sessionErrors,
 		...errors("not_found")
 	}
+}), defineRoute({
+	method: "get",
+	path: "/v1/journeys/{key}/enrollment/preview",
+	operationId: "journeys.enrollmentPreview",
+	tags: ["journeys"],
+	summary: "Count who turning this journey on would reach",
+	security: SESSION_AUTH,
+	request: { params: params$7 },
+	responses: {
+		200: envelope(enrollmentCountsSchema, "What enrolling the journey's current members would do"),
+		...sessionErrors,
+		...errors("not_found", "dependency_unavailable")
+	}
+}), defineRoute({
+	method: "post",
+	path: "/v1/journeys/{key}/enrollment",
+	operationId: "journeys.startEnrollment",
+	tags: ["journeys"],
+	summary: "Enroll the journey's current members",
+	security: SESSION_AUTH,
+	surfaces: HIDDEN_FROM_TOOLS,
+	request: { params: params$7 },
+	responses: {
+		202: envelope(enrollmentStatusSchema, "The job, as it starts"),
+		...sessionErrors,
+		...errors("not_found")
+	}
+}), defineRoute({
+	method: "get",
+	path: "/v1/journeys/{key}/enrollment",
+	operationId: "journeys.enrollmentStatus",
+	tags: ["journeys"],
+	summary: "How far the journey's enrollment has got",
+	security: SESSION_AUTH,
+	request: { params: params$7 },
+	responses: {
+		200: envelope(enrollmentStatusSchema),
+		...sessionErrors,
+		...errors("not_found")
+	}
+}), defineRoute({
+	method: "post",
+	path: "/v1/journeys/{key}/enrollment/cancel",
+	operationId: "journeys.cancelEnrollment",
+	tags: ["journeys"],
+	summary: "Stop a running enrollment",
+	security: SESSION_AUTH,
+	request: { params: params$7 },
+	responses: {
+		200: envelope(enrollmentStatusSchema, "The job as it stood when the stop was asked for"),
+		...sessionErrors,
+		...errors("not_found")
+	}
 }), defineRoute({
 	method: "post",
 	path: "/v1/journeys/{key}/dry-run",
@@ -10080,7 +10514,7 @@ const segments = defineModule(defineRoute({
 	responses: {
 		200: envelope(segmentDetailSchema),
 		...sessionErrors,
-		...errors("not_found"),
+		...errors("not_found", "conflict"),
 		...writeErrors
 	}
 }), defineRoute({
@@ -10094,7 +10528,7 @@ const segments = defineModule(defineRoute({
 	responses: {
 		200: envelope(deletedSchema),
 		...sessionErrors,
-		...errors("not_found")
+		...errors("not_found", "conflict")
 	}
 }), defineRoute({
 	method: "get",
@@ -10567,6 +11001,23 @@ const users = defineModule(defineRoute({
 		...sessionErrors,
 		...errors("not_found", "validation_failed")
 	}
+}), defineRoute({
+	method: "get",
+	path: "/v1/users/{profileId}/runs",
+	operationId: "users.listRuns",
+	tags: ["users"],
+	summary: "The journeys a profile has completed",
+	security: SESSION_AUTH,
+	request: {
+		params: params$2,
+		query: listUserRunsQuerySchema
+	},
+	responses: {
+		200: list(userRunSchema),
+		...mergedRedirect,
+		...sessionErrors,
+		...errors("not_found", "validation_failed")
+	}
 }));
 
 //#endregion
@@ -11120,29 +11571,65 @@ function registerContractCommands(program, run) {
 //#endregion
 //#region src/commands/enable.ts
 /**
-* `cow enable` and `cow disable`: the one gate on a journey (ADR 0011, ADR
-* 0013). Hand-written rather than derived from `journeys.enable`, because
-* the commands are top-level names a developer types; the route itself
-* takes the same set of keys they do.
+* `cow enable`, `cow disable` and `cow pause`: the one gate on a journey
+* (ADR 0011, ADR 0013, ADR 0018). Hand-written rather than derived from
+* `journeys.setStatus`, because the commands are top-level names a developer
+* types; the route itself takes the same set of keys they do.
+*
+* `cow enable` on a journey on hold is how it resumes: the server has one
+* transition to `on` and no second word for it.
 */
 /**
 * One call, whichever way the keys were named: the route takes the set, and
 * `--all` is the project name, resolved on the server against the rows it
 * owns (so it reaches a key whose file the tree lost). A key that is not
-* there refuses the whole call, and nothing flips.
-*/
-async function setEnabled(client, selector, enabled) {
-	const route = enabled ? contract.journeys["journeys.enable"] : contract.journeys["journeys.disable"];
-	return (await client.request(route, { body: selector })).data;
+* there refuses the whole call, and nothing changes.
+*/
+async function setStatus(client, selector, status) {
+	return (await client.request(contract.journeys["journeys.setStatus"], { body: {
+		...selector,
+		status
+	} })).data;
+}
+/**
+* Who is already standing in a journey that was just turned on, and where
+* to let them in (ADR 0015). Printed, never acted on: enrolling a cohort
+* spends real money and reaches real people, so it stays a person's click
+* in the dashboard and no command here starts one.
+*/
+function segmentLines(journey) {
+	const offer = journey.enrollment;
+	if (!offer) return [];
+	if (!offer.counts) return [`  Who is in its segment could not be counted just now: ${offer.url}`];
+	const { scanned, enrolled, skipped } = offer.counts;
+	if (scanned === 0) return ["  Nobody is in its segment yet."];
+	return [
+		`  ${scanned} in its segment now, ${enrolled} of them can enter it now.`,
+		...Object.entries(ENROLLMENT_SKIP_WORDS).map(([key, words]) => ({
+			value: skipped[key],
+			words
+		})).filter(({ value }) => value > 0).map(({ value, words }) => `  ${value} ${words.reason}.`),
+		...enrolled > 0 ? [`  To let those ${enrolled} in: ${offer.url}`] : []
+	];
 }
+/** How the terminal names each state. */
+const STATE_WORD = {
+	on: "on",
+	off: "off",
+	paused: "on hold"
+};
 /** What the terminal says: one line per key, naming its new state. */
-function flipSummary(journeys, enabled) {
-	if (journeys.length === 0) return `This project has no journeys to turn ${enabled ? "on" : "off"}.`;
-	return journeys.map((journey) => `${journey.key} is ${enabled ? "on" : "off"}.`).join("\n");
+function flipSummary(journeys, status) {
+	if (journeys.length === 0) return `This project has no journeys to put ${STATE_WORD[status]}.`;
+	return journeys.map((journey) => [`${journey.key} is ${STATE_WORD[status]}.`, ...segmentLines(journey)].join("\n")).join("\n");
 }
-function register(program, clientFor, io, enabled) {
-	const verb = enabled ? "enable" : "disable";
-	program.command(verb).description(`turn journeys ${enabled ? "on" : "off"} (many keys, or --all for this project's)`).argument("[keys...]", "journey keys").option("--all", "every journey of this project").action(async (keys, opts) => {
+const DESCRIPTIONS = {
+	on: "turn journeys on",
+	off: "turn journeys off",
+	paused: "hold journeys: nobody enters, and everyone part-way through waits"
+};
+function register(program, clientFor, io, verb, status) {
+	program.command(verb).description(`${DESCRIPTIONS[status]} (many keys, or --all for this project's)`).argument("[keys...]", "journey keys").option("--all", "every journey of this project").action(async (keys, opts) => {
 		const merged = {
 			...program.opts(),
 			...opts
@@ -11150,17 +11637,18 @@ function register(program, clientFor, io, enabled) {
 		if (merged.all === true && keys.length > 0) throw new Error(`Name the journeys or pass --all, not both: cow ${verb} welcome.`);
 		if (merged.all !== true && keys.length === 0) throw new Error(`Name at least one journey, or pass --all: cow ${verb} welcome.`);
 		const selector = merged.all === true ? { project: (await assertCowConfig(process.cwd())).project } : { keys };
-		const updated = await setEnabled(await clientFor(merged), selector, enabled);
+		const updated = await setStatus(await clientFor(merged), selector, status);
 		if (merged.json === true) {
 			emit({ data: updated }, io, true);
 			return;
 		}
-		io.stdout(`${flipSummary(updated, enabled)}\n`);
+		io.stdout(`${flipSummary(updated, status)}\n`);
 	});
 }
 function registerEnable(program, clientFor, io) {
-	register(program, clientFor, io, true);
-	register(program, clientFor, io, false);
+	register(program, clientFor, io, "enable", "on");
+	register(program, clientFor, io, "disable", "off");
+	register(program, clientFor, io, "pause", "paused");
 }
 
 //#endregion
@@ -11699,8 +12187,7 @@ function versionPhrase(entry, now) {
 	return `${bundle ? `version ${shortDigest(bundle)}` : "version"}, pushed ${ago(version.pushedAt, now)}${state}`;
 }
 function flagsPhrase(entry) {
-	if (entry.enabled === null) return "";
-	return entry.enabled ? "on" : "off";
+	return entry.status === null ? "" : entry.status === "paused" ? "on hold" : entry.status;
 }
 function livePhrase(entry) {
 	return entry.liveExecutions === 0 ? "" : `${entry.liveExecutions} running`;