@cosmicdrift/kumiko-bundled-features 0.341.0 → 0.343.0

package/dist/auth-email-password/web/login-screen.js

@@ -113,12 +113,12 @@ export function LoginScreen({ title, subtitle, submitLabel, forgotPasswordHref,
     };
     const effectiveTitle = title ?? t("auth.login.title");
     const effectiveSubmit = submitLabel ?? t("auth.login.submit");
-    return (_jsx(AuthCard, { title: effectiveTitle, subtitle: subtitle, children: _jsxs("div", { className: "p-6 pt-0 flex flex-col gap-4", children: [_jsxs(Form, { onSubmit: onSubmit, children: [_jsx(Field, { id: "login-email", label: t("auth.login.email"), required: true, children: _jsx(Input, { kind: "email", id: "login-email", name: "login-email", value: email, onChange: setEmail, disabled: submitting, required: true, autoComplete: "email" }) }), _jsx(Field, { id: "login-password", label: t("auth.login.password"), required: true, children: _jsx(Input, { kind: "password", id: "login-password", name: "login-password", value: password, onChange: setPassword, disabled: submitting, required: true, autoComplete: "current-password" }) }), session.signedOutReason === "session-ended" && (_jsx(Banner, { variant: "info", children: t("auth.login.sessionEnded") })), resendStatus.kind === "success" ? (_jsx(Banner, { variant: "info", children: t("auth.login.resendSuccess") })) : error !== null ? (_jsx(Banner, { variant: "error", children: _jsxs("div", { className: "flex flex-col gap-1", children: [_jsx("span", { children: (() => {
-                                            const { key, params } = reasonToKey(error);
-                                            return t(key, params);
-                                        })() }), error.reason === "email_not_verified" &&
-                                        email.trim().length > 0 &&
-                                        email === failedLoginEmail && (_jsx("span", { className: "self-start", children: _jsx(Button, { variant: "link", onClick: () => void onResend(), disabled: resendStatus.kind === "sending", children: resendStatus.kind === "sending"
-                                                ? t("auth.login.submitting")
-                                                : t("auth.login.resendVerification") }) })), error.reason === "account_locked" && unlockAccountHref !== undefined && (_jsx("span", { className: "self-start", children: _jsx(Link, { href: unlockAccountHref, variant: "default", children: t("auth.login.unlockAccount") }) })), resendStatus.kind === "rateLimited" && (_jsx("span", { className: "text-xs", children: t("auth.login.resendRateLimited") })), resendStatus.kind === "error" && (_jsx("span", { className: "text-xs", children: t("auth.login.resendError") }))] }) })) : null, _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting ? t("auth.login.submitting") : effectiveSubmit })] }), forgotPasswordHref !== undefined && (_jsx(Link, { href: forgotPasswordHref, variant: "muted", className: "self-center", children: t("auth.login.forgotPassword") })), signupHref !== undefined && (_jsx(Link, { href: signupHref, variant: "muted", className: "self-center", children: t("auth.signup.title") })), legalLinks !== undefined && legalLinks.length > 0 && (_jsx("nav", { "data-testid": "login-legal-links", className: "flex items-center justify-center gap-3 pt-2 border-t border-border/50", children: legalLinks.map((link) => (_jsx(Link, { href: link.href, variant: "muted", className: "text-xs", children: link.label }, link.href))) }))] }) }));
+    return (_jsxs(AuthCard, { title: effectiveTitle, subtitle: subtitle, children: [_jsxs(Form, { onSubmit: onSubmit, children: [_jsx(Field, { id: "login-email", label: t("auth.login.email"), required: true, children: _jsx(Input, { kind: "email", id: "login-email", name: "login-email", value: email, onChange: setEmail, disabled: submitting, required: true, autoComplete: "email" }) }), _jsx(Field, { id: "login-password", label: t("auth.login.password"), required: true, children: _jsx(Input, { kind: "password", id: "login-password", name: "login-password", value: password, onChange: setPassword, disabled: submitting, required: true, autoComplete: "current-password" }) }), session.signedOutReason === "session-ended" && (_jsx(Banner, { variant: "info", children: t("auth.login.sessionEnded") })), resendStatus.kind === "success" ? (_jsx(Banner, { variant: "info", children: t("auth.login.resendSuccess") })) : error !== null ? (_jsx(Banner, { variant: "error", children: _jsxs("div", { className: "flex flex-col gap-1", children: [_jsx("span", { children: (() => {
+                                        const { key, params } = reasonToKey(error);
+                                        return t(key, params);
+                                    })() }), error.reason === "email_not_verified" &&
+                                    email.trim().length > 0 &&
+                                    email === failedLoginEmail && (_jsx("span", { className: "self-start", children: _jsx(Button, { variant: "link", onClick: () => void onResend(), disabled: resendStatus.kind === "sending", children: resendStatus.kind === "sending"
+                                            ? t("auth.login.submitting")
+                                            : t("auth.login.resendVerification") }) })), error.reason === "account_locked" && unlockAccountHref !== undefined && (_jsx("span", { className: "self-start", children: _jsx(Link, { href: unlockAccountHref, variant: "default", children: t("auth.login.unlockAccount") }) })), resendStatus.kind === "rateLimited" && (_jsx("span", { className: "text-xs", children: t("auth.login.resendRateLimited") })), resendStatus.kind === "error" && (_jsx("span", { className: "text-xs", children: t("auth.login.resendError") }))] }) })) : null, _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting ? t("auth.login.submitting") : effectiveSubmit })] }), forgotPasswordHref !== undefined && (_jsx(Link, { href: forgotPasswordHref, variant: "muted", className: "self-center", children: t("auth.login.forgotPassword") })), signupHref !== undefined && (_jsx(Link, { href: signupHref, variant: "muted", className: "self-center", children: t("auth.signup.title") })), legalLinks !== undefined && legalLinks.length > 0 && (_jsx("nav", { "data-testid": "login-legal-links", className: "flex items-center justify-center gap-3 pt-2 border-t border-border/50", children: legalLinks.map((link) => (_jsx(Link, { href: link.href, variant: "muted", className: "text-xs", children: link.label }, link.href))) }))] }));
 }

package/dist/auth-email-password/web/request-account-unlock-screen.js

@@ -1,4 +1,4 @@
-import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 // @runtime client
 // RequestAccountUnlockScreen — form with an email input. Submit triggers
 // /api/auth/request-account-unlock (silent-success, no account
@@ -54,5 +54,5 @@ export function RequestAccountUnlockScreen({ title, subtitle, loginHref = "/logi
         void doSubmit();
     };
     const effectiveTitle = title ?? t("auth.requestUnlock.title");
-    return (_jsx(AuthCard, { title: effectiveTitle, subtitle: subtitle, children: done ? (_jsxs("div", { className: "p-6 pt-0 flex flex-col gap-4", children: [_jsxs(Banner, { variant: "info", children: [_jsx("p", { className: "font-medium text-foreground", children: t("auth.requestUnlock.successTitle") }), _jsx("p", { className: "mt-1", children: t("auth.requestUnlock.successBody") })] }), _jsx(Link, { href: loginHref, variant: "muted", children: t("auth.requestUnlock.backToLogin") })] })) : (_jsxs("div", { className: "p-6 pt-0 flex flex-col gap-4", children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.requestUnlock.intro") }), _jsxs(Form, { onSubmit: onSubmit, children: [_jsx(Field, { id: "unlock-email", label: t("auth.requestUnlock.email"), required: true, children: _jsx(Input, { kind: "text", id: "unlock-email", name: "unlock-email", value: email, onChange: setEmail, disabled: submitting, required: true }) }), error !== null && _jsx(Banner, { variant: "error", children: error }), _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting ? t("auth.requestUnlock.submitting") : t("auth.requestUnlock.submit") })] }), _jsx(Link, { href: loginHref, variant: "muted", className: "self-center", children: t("auth.requestUnlock.backToLogin") })] })) }));
+    return (_jsx(AuthCard, { title: effectiveTitle, subtitle: subtitle, children: done ? (_jsxs(_Fragment, { children: [_jsxs(Banner, { variant: "info", children: [_jsx("p", { className: "font-medium text-foreground", children: t("auth.requestUnlock.successTitle") }), _jsx("p", { className: "mt-1", children: t("auth.requestUnlock.successBody") })] }), _jsx(Link, { href: loginHref, variant: "muted", children: t("auth.requestUnlock.backToLogin") })] })) : (_jsxs(_Fragment, { children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.requestUnlock.intro") }), _jsxs(Form, { onSubmit: onSubmit, children: [_jsx(Field, { id: "unlock-email", label: t("auth.requestUnlock.email"), required: true, children: _jsx(Input, { kind: "text", id: "unlock-email", name: "unlock-email", value: email, onChange: setEmail, disabled: submitting, required: true }) }), error !== null && _jsx(Banner, { variant: "error", children: error }), _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting ? t("auth.requestUnlock.submitting") : t("auth.requestUnlock.submit") })] }), _jsx(Link, { href: loginHref, variant: "muted", className: "self-center", children: t("auth.requestUnlock.backToLogin") })] })) }));
 }

package/dist/auth-email-password/web/reset-password-screen.js

@@ -1,4 +1,4 @@
-import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 // @runtime client
 // ResetPasswordScreen — liest `?token=...` aus der URL, zeigt Form mit
 // new + confirm-password. Submit triggert /api/auth/reset-password mit
@@ -62,7 +62,7 @@ export function ResetPasswordScreen({ title, token: tokenProp, loginHref = "/log
     // submitten würde nur den invalidResetToken-Error zeigen — das ist
     // verwirrend. Lieber upfront eine klare Message.
     if (token === "") {
-        return (_jsx(AuthCard, { title: effectiveTitle, children: _jsxs("div", { className: "p-6 pt-0 flex flex-col gap-4", children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.resetPassword.missingToken") }), _jsx(Link, { href: loginHref, variant: "muted", children: t("auth.resetPassword.goToLogin") })] }) }));
+        return (_jsxs(AuthCard, { title: effectiveTitle, children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.resetPassword.missingToken") }), _jsx(Link, { href: loginHref, variant: "muted", children: t("auth.resetPassword.goToLogin") })] }));
     }
-    return (_jsx(AuthCard, { title: effectiveTitle, children: done ? (_jsxs("div", { className: "p-6 pt-0 flex flex-col gap-4", children: [_jsxs(Banner, { variant: "info", children: [_jsx("p", { className: "font-medium text-foreground", children: t("auth.resetPassword.successTitle") }), _jsx("p", { className: "mt-1", children: t("auth.resetPassword.successBody") })] }), _jsx(Link, { href: loginHref, variant: "button", children: t("auth.resetPassword.goToLogin") })] })) : (_jsxs("div", { className: "p-6 pt-0 flex flex-col gap-4", children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.resetPassword.intro") }), _jsxs(Form, { onSubmit: onSubmit, children: [_jsx(Field, { id: "reset-new-password", label: t("auth.resetPassword.newPassword"), required: true, children: _jsx(Input, { kind: "password", id: "reset-new-password", name: "reset-new-password", value: newPassword, onChange: setNewPassword, disabled: submitting, required: true, autoComplete: "new-password" }) }), _jsx(Field, { id: "reset-confirm-password", label: t("auth.resetPassword.confirmPassword"), required: true, children: _jsx(Input, { kind: "password", id: "reset-confirm-password", name: "reset-confirm-password", value: confirmPassword, onChange: setConfirmPassword, disabled: submitting, required: true, autoComplete: "new-password" }) }), error !== null && _jsx(Banner, { variant: "error", children: error }), _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting ? t("auth.resetPassword.submitting") : t("auth.resetPassword.submit") })] })] })) }));
+    return (_jsx(AuthCard, { title: effectiveTitle, children: done ? (_jsxs(_Fragment, { children: [_jsxs(Banner, { variant: "info", children: [_jsx("p", { className: "font-medium text-foreground", children: t("auth.resetPassword.successTitle") }), _jsx("p", { className: "mt-1", children: t("auth.resetPassword.successBody") })] }), _jsx(Link, { href: loginHref, variant: "button", children: t("auth.resetPassword.goToLogin") })] })) : (_jsxs(_Fragment, { children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.resetPassword.intro") }), _jsxs(Form, { onSubmit: onSubmit, children: [_jsx(Field, { id: "reset-new-password", label: t("auth.resetPassword.newPassword"), required: true, children: _jsx(Input, { kind: "password", id: "reset-new-password", name: "reset-new-password", value: newPassword, onChange: setNewPassword, disabled: submitting, required: true, autoComplete: "new-password" }) }), _jsx(Field, { id: "reset-confirm-password", label: t("auth.resetPassword.confirmPassword"), required: true, children: _jsx(Input, { kind: "password", id: "reset-confirm-password", name: "reset-confirm-password", value: confirmPassword, onChange: setConfirmPassword, disabled: submitting, required: true, autoComplete: "new-password" }) }), error !== null && _jsx(Banner, { variant: "error", children: error }), _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting ? t("auth.resetPassword.submitting") : t("auth.resetPassword.submit") })] })] })) }));
 }

package/dist/auth-email-password/web/session-bootstrap-error.js

@@ -24,7 +24,7 @@ export function SessionBootstrapErrorScreen({ failure, onRetry, onSignOut, }) {
             .then(onRetry)
             .then(() => setRetrying(false));
     };
-    return (_jsx("div", { "data-testid": "session-bootstrap-error", "data-http-status": failure.httpStatus ?? "network", children: _jsx(AuthCard, { title: t("auth.sessionBootstrap.errorTitle"), children: _jsxs("div", { className: "flex flex-col gap-4 px-6 pb-4", children: [_jsx(Banner, { variant: "error", children: failure.httpStatus === 429
-                            ? t("auth.sessionBootstrap.rateLimitedBody")
-                            : t("auth.sessionBootstrap.errorBody") }), _jsx(Button, { variant: "primary", onClick: handleRetry, disabled: retrying, children: retrying ? t("auth.sessionBootstrap.retrying") : t("auth.sessionBootstrap.retry") }), onSignOut !== undefined && (_jsx(Button, { variant: "secondary", onClick: () => void onSignOut(), disabled: retrying, children: t("auth.sessionBootstrap.signOut") }))] }) }) }));
+    return (_jsx("div", { "data-testid": "session-bootstrap-error", "data-http-status": failure.httpStatus ?? "network", children: _jsxs(AuthCard, { title: t("auth.sessionBootstrap.errorTitle"), bodyClassName: "pb-4", children: [_jsx(Banner, { variant: "error", children: failure.httpStatus === 429
+                        ? t("auth.sessionBootstrap.rateLimitedBody")
+                        : t("auth.sessionBootstrap.errorBody") }), _jsx(Button, { variant: "primary", onClick: handleRetry, disabled: retrying, children: retrying ? t("auth.sessionBootstrap.retrying") : t("auth.sessionBootstrap.retry") }), onSignOut !== undefined && (_jsx(Button, { variant: "secondary", onClick: () => void onSignOut(), disabled: retrying, children: t("auth.sessionBootstrap.signOut") }))] }) }));
 }

package/dist/auth-email-password/web/signup-complete-screen.js

@@ -77,10 +77,10 @@ export function SignupCompleteScreen({ title, token: tokenProp, loggedInHref = "
     // Kein Token in der URL → klare Message statt Form ohne Token
     // (würde nur invalidSignupToken zeigen, verwirrend).
     if (token === "") {
-        return (_jsx(AuthCard, { title: effectiveTitle, children: _jsxs("div", { className: "p-6 pt-0 flex flex-col gap-4", children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.signupComplete.missingToken") }), _jsx(Link, { href: loginHref, variant: "muted", children: t("auth.signup.haveAccount") })] }) }));
+        return (_jsxs(AuthCard, { title: effectiveTitle, children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.signupComplete.missingToken") }), _jsx(Link, { href: loginHref, variant: "muted", children: t("auth.signup.haveAccount") })] }));
     }
     if (continueHref !== null) {
-        return (_jsx(AuthCard, { title: effectiveTitle, children: _jsxs("div", { className: "p-6 pt-0 flex flex-col gap-4", children: [_jsx("p", { className: "text-sm text-muted-foreground", role: "status", children: t("auth.signupComplete.activated") }), _jsx(Link, { href: continueHref, variant: "button", children: t("auth.signupComplete.continue") })] }) }));
+        return (_jsxs(AuthCard, { title: effectiveTitle, children: [_jsx("p", { className: "text-sm text-muted-foreground", role: "status", children: t("auth.signupComplete.activated") }), _jsx(Link, { href: continueHref, variant: "button", children: t("auth.signupComplete.continue") })] }));
     }
-    return (_jsx(AuthCard, { title: effectiveTitle, children: _jsxs("div", { className: "p-6 pt-0 flex flex-col gap-4", children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.signupComplete.intro") }), _jsxs(Form, { onSubmit: onSubmit, children: [_jsx(Field, { id: "signup-password", label: t("auth.signupComplete.password"), required: true, children: _jsx(Input, { kind: "password", id: "signup-password", name: "signup-password", value: password, onChange: setPassword, disabled: submitting, required: true, autoComplete: "new-password" }) }), _jsx(Field, { id: "signup-confirm-password", label: t("auth.signupComplete.confirmPassword"), required: true, children: _jsx(Input, { kind: "password", id: "signup-confirm-password", name: "signup-confirm-password", value: confirmPassword, onChange: setConfirmPassword, disabled: submitting, required: true, autoComplete: "new-password" }) }), error !== null && _jsx(Banner, { variant: "error", children: error }), _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting ? t("auth.signupComplete.submitting") : t("auth.signupComplete.submit") })] })] }) }));
+    return (_jsxs(AuthCard, { title: effectiveTitle, children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.signupComplete.intro") }), _jsxs(Form, { onSubmit: onSubmit, children: [_jsx(Field, { id: "signup-password", label: t("auth.signupComplete.password"), required: true, children: _jsx(Input, { kind: "password", id: "signup-password", name: "signup-password", value: password, onChange: setPassword, disabled: submitting, required: true, autoComplete: "new-password" }) }), _jsx(Field, { id: "signup-confirm-password", label: t("auth.signupComplete.confirmPassword"), required: true, children: _jsx(Input, { kind: "password", id: "signup-confirm-password", name: "signup-confirm-password", value: confirmPassword, onChange: setConfirmPassword, disabled: submitting, required: true, autoComplete: "new-password" }) }), error !== null && _jsx(Banner, { variant: "error", children: error }), _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting ? t("auth.signupComplete.submitting") : t("auth.signupComplete.submit") })] })] }));
 }

package/dist/auth-email-password/web/signup-screen.js

@@ -1,4 +1,4 @@
-import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 // @runtime client
 // SignupScreen — Magic-Link-Self-Signup, Step 1.
 //
@@ -67,5 +67,5 @@ export function SignupScreen({ title, subtitle, loginHref = "/login", }) {
         }
     };
     const effectiveTitle = title ?? t("auth.signup.title");
-    return (_jsx(AuthCard, { title: effectiveTitle, subtitle: subtitle, children: done ? (_jsxs("div", { className: "p-6 pt-0 flex flex-col gap-4", children: [_jsxs(Banner, { variant: "info", children: [_jsx("p", { className: "font-medium text-foreground", children: t("auth.signup.successTitle") }), _jsx("p", { className: "mt-1", children: t("auth.signup.successBody") })] }), _jsx(Button, { variant: "secondary", onClick: onResend, disabled: submitting, children: t("auth.signup.resend") }), _jsx(Link, { href: loginHref, variant: "muted", children: t("auth.signup.haveAccount") })] })) : (_jsxs("div", { className: "p-6 pt-0 flex flex-col gap-4", children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.signup.intro") }), _jsxs(Form, { onSubmit: onSubmit, children: [_jsx(Field, { id: "signup-email", label: t("auth.signup.email"), required: true, children: _jsx(Input, { kind: "email", id: "signup-email", name: "signup-email", value: email, onChange: setEmail, disabled: submitting, required: true, autoComplete: "email" }) }), error !== null && _jsx(Banner, { variant: "error", children: error }), _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting ? t("auth.signup.submitting") : t("auth.signup.submit") })] }), _jsx(Link, { href: loginHref, variant: "muted", className: "self-center", children: t("auth.signup.haveAccount") })] })) }));
+    return (_jsx(AuthCard, { title: effectiveTitle, subtitle: subtitle, children: done ? (_jsxs(_Fragment, { children: [_jsxs(Banner, { variant: "info", children: [_jsx("p", { className: "font-medium text-foreground", children: t("auth.signup.successTitle") }), _jsx("p", { className: "mt-1", children: t("auth.signup.successBody") })] }), _jsx(Button, { variant: "secondary", onClick: onResend, disabled: submitting, children: t("auth.signup.resend") }), _jsx(Link, { href: loginHref, variant: "muted", children: t("auth.signup.haveAccount") })] })) : (_jsxs(_Fragment, { children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.signup.intro") }), _jsxs(Form, { onSubmit: onSubmit, children: [_jsx(Field, { id: "signup-email", label: t("auth.signup.email"), required: true, children: _jsx(Input, { kind: "email", id: "signup-email", name: "signup-email", value: email, onChange: setEmail, disabled: submitting, required: true, autoComplete: "email" }) }), error !== null && _jsx(Banner, { variant: "error", children: error }), _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting ? t("auth.signup.submitting") : t("auth.signup.submit") })] }), _jsx(Link, { href: loginHref, variant: "muted", className: "self-center", children: t("auth.signup.haveAccount") })] })) }));
 }

package/dist/auth-email-password/web/verify-email-screen.js

@@ -33,14 +33,14 @@ export function VerifyEmailScreen({ title, token: tokenProp, loginHref = "/login
         })();
     }, [status, token]);
     if (status === "missing-token") {
-        return (_jsx(AuthCard, { title: title ?? t("auth.verifyEmail.errorTitle"), children: _jsxs("div", { className: "p-6 pt-0 flex flex-col gap-4", children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.verifyEmail.missingToken") }), _jsx(Link, { href: loginHref, variant: "muted", children: t("auth.verifyEmail.goToLogin") })] }) }));
+        return (_jsxs(AuthCard, { title: title ?? t("auth.verifyEmail.errorTitle"), children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.verifyEmail.missingToken") }), _jsx(Link, { href: loginHref, variant: "muted", children: t("auth.verifyEmail.goToLogin") })] }));
     }
     if (status === "verifying") {
         return (_jsx(AuthCard, { children: _jsx("div", { className: "p-6", children: _jsx("p", { className: "text-sm text-muted-foreground", role: "status", children: t("auth.verifyEmail.verifying") }) }) }));
     }
     if (status === "success") {
-        return (_jsx(AuthCard, { title: title ?? t("auth.verifyEmail.successTitle"), children: _jsxs("div", { className: "p-6 pt-0 flex flex-col gap-4", children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.verifyEmail.successBody") }), _jsx(Link, { href: loginHref, variant: "button", children: t("auth.verifyEmail.goToLogin") })] }) }));
+        return (_jsxs(AuthCard, { title: title ?? t("auth.verifyEmail.successTitle"), children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.verifyEmail.successBody") }), _jsx(Link, { href: loginHref, variant: "button", children: t("auth.verifyEmail.goToLogin") })] }));
     }
     // status === "error"
-    return (_jsx(AuthCard, { title: title ?? t("auth.verifyEmail.errorTitle"), children: _jsxs("div", { className: "p-6 pt-0 flex flex-col gap-4", children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.verifyEmail.errorBody") }), _jsx(Link, { href: loginHref, variant: "muted", children: t("auth.verifyEmail.goToLogin") })] }) }));
+    return (_jsxs(AuthCard, { title: title ?? t("auth.verifyEmail.errorTitle"), children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.verifyEmail.errorBody") }), _jsx(Link, { href: loginHref, variant: "muted", children: t("auth.verifyEmail.goToLogin") })] }));
 }

package/dist/auth-mfa/web/mfa-setup-preauth-screen.js

@@ -127,9 +127,9 @@ export function MfaSetupPreauthScreen({ preauthSetupToken, accountLabel, title,
         e?.preventDefault();
         void confirmSetup();
     };
-    return (_jsx(AuthCard, { title: title ?? t("auth.mfa.setup.title"), subtitle: subtitle ?? t("auth.mfa.setup.subtitle"), children: _jsxs("div", { className: "p-6 pt-0 flex flex-col gap-4", children: [error !== null ? (_jsx(Banner, { variant: "error", children: error === "too_many_attempts" && retryAfterSeconds !== null
-                        ? t("auth.mfa.errors.tooManyAttemptsWithSeconds", { seconds: retryAfterSeconds })
-                        : t(reasonToKey(error)) })) : null, !setup && (_jsx(Section, { testId: "mfa-setup-preauth-intro", actions: _jsx(Button, { variant: "primary", onClick: () => void startSetup(), loading: busy, disabled: busy, children: t("auth.mfa.setup.start") }), children: _jsx("span", { className: "text-sm text-muted-foreground", children: t("auth.mfa.setup.intro") }) })), setup && (_jsx(Form, { onSubmit: onSubmit, children: _jsxs(Section, { testId: "mfa-setup-preauth-setup", actions: _jsx(Button, { type: "submit", variant: "primary", loading: busy, disabled: busy || !acknowledged || code.length !== 6, children: t("auth.mfa.setup.confirm") }), children: [_jsxs("div", { className: "flex flex-col items-center gap-2 text-center", children: [_jsx("span", { className: "text-sm font-semibold", children: t("auth.mfa.enable.scanTitle") }), _jsx("div", { className: "h-40 w-40", 
-                                        // biome-ignore lint/security/noDangerouslySetInnerHtml: qrcode-generated SVG, no user input
-                                        dangerouslySetInnerHTML: { __html: setup.qrSvg } }), _jsx("span", { className: "text-xs text-muted-foreground", children: t("auth.mfa.enable.manualEntry") }), _jsx("code", { className: "inline-block break-all rounded bg-muted px-3 py-2 font-mono text-sm", children: setup.secretParam })] }), _jsxs("div", { className: "flex flex-col gap-2", children: [_jsx("span", { className: "text-sm font-semibold", children: t("auth.mfa.enable.recoveryTitle") }), _jsx("span", { className: "text-xs text-muted-foreground", children: t("auth.mfa.enable.recoveryHint") }), _jsx("code", { className: "block whitespace-pre-wrap break-all rounded bg-muted px-3 py-2 font-mono text-sm", children: setup.recoveryCodes.join("\n") }), _jsx(Field, { id: "mfa-setup-preauth-ack", label: t("auth.mfa.enable.acknowledge"), children: _jsx(Input, { kind: "boolean", id: "mfa-setup-preauth-ack", name: "mfa-setup-preauth-ack", value: acknowledged, onChange: setAcknowledged }) })] }), _jsx(Field, { id: "mfa-setup-preauth-code", label: t("auth.mfa.enable.code"), required: true, children: _jsx(Input, { kind: "text", id: "mfa-setup-preauth-code", name: "mfa-setup-preauth-code", value: code, onChange: setCode, disabled: busy || !acknowledged, autoComplete: "one-time-code" }) })] }) })), onCancel ? (_jsx("div", { className: "flex justify-center", children: _jsx(Button, { type: "button", variant: "secondary", onClick: onCancel, disabled: busy, children: t("auth.mfa.verify.backToLogin") }) })) : null] }) }));
+    return (_jsxs(AuthCard, { title: title ?? t("auth.mfa.setup.title"), subtitle: subtitle ?? t("auth.mfa.setup.subtitle"), children: [error !== null ? (_jsx(Banner, { variant: "error", children: error === "too_many_attempts" && retryAfterSeconds !== null
+                    ? t("auth.mfa.errors.tooManyAttemptsWithSeconds", { seconds: retryAfterSeconds })
+                    : t(reasonToKey(error)) })) : null, !setup && (_jsx(Section, { testId: "mfa-setup-preauth-intro", actions: _jsx(Button, { variant: "primary", onClick: () => void startSetup(), loading: busy, disabled: busy, children: t("auth.mfa.setup.start") }), children: _jsx("span", { className: "text-sm text-muted-foreground", children: t("auth.mfa.setup.intro") }) })), setup && (_jsx(Form, { onSubmit: onSubmit, children: _jsxs(Section, { testId: "mfa-setup-preauth-setup", actions: _jsx(Button, { type: "submit", variant: "primary", loading: busy, disabled: busy || !acknowledged || code.length !== 6, children: t("auth.mfa.setup.confirm") }), children: [_jsxs("div", { className: "flex flex-col items-center gap-2 text-center", children: [_jsx("span", { className: "text-sm font-semibold", children: t("auth.mfa.enable.scanTitle") }), _jsx("div", { className: "h-40 w-40", 
+                                    // biome-ignore lint/security/noDangerouslySetInnerHtml: qrcode-generated SVG, no user input
+                                    dangerouslySetInnerHTML: { __html: setup.qrSvg } }), _jsx("span", { className: "text-xs text-muted-foreground", children: t("auth.mfa.enable.manualEntry") }), _jsx("code", { className: "inline-block break-all rounded bg-muted px-3 py-2 font-mono text-sm", children: setup.secretParam })] }), _jsxs("div", { className: "flex flex-col gap-2", children: [_jsx("span", { className: "text-sm font-semibold", children: t("auth.mfa.enable.recoveryTitle") }), _jsx("span", { className: "text-xs text-muted-foreground", children: t("auth.mfa.enable.recoveryHint") }), _jsx("code", { className: "block whitespace-pre-wrap break-all rounded bg-muted px-3 py-2 font-mono text-sm", children: setup.recoveryCodes.join("\n") }), _jsx(Field, { id: "mfa-setup-preauth-ack", label: t("auth.mfa.enable.acknowledge"), children: _jsx(Input, { kind: "boolean", id: "mfa-setup-preauth-ack", name: "mfa-setup-preauth-ack", value: acknowledged, onChange: setAcknowledged }) })] }), _jsx(Field, { id: "mfa-setup-preauth-code", label: t("auth.mfa.enable.code"), required: true, children: _jsx(Input, { kind: "text", id: "mfa-setup-preauth-code", name: "mfa-setup-preauth-code", value: code, onChange: setCode, disabled: busy || !acknowledged, autoComplete: "one-time-code" }) })] }) })), onCancel ? (_jsx("div", { className: "flex justify-center", children: _jsx(Button, { type: "button", variant: "secondary", onClick: onCancel, disabled: busy, children: t("auth.mfa.verify.backToLogin") }) })) : null] }));
 }

package/dist/auth-mfa/web/mfa-verify-screen.js

@@ -52,7 +52,7 @@ export function MfaVerifyScreen({ challengeToken, title, subtitle, submitLabel,
         e?.preventDefault();
         void doSubmit();
     };
-    return (_jsx(AuthCard, { title: title ?? t("auth.mfa.verify.title"), subtitle: subtitle ?? t("auth.mfa.verify.subtitle"), children: _jsx("div", { className: "p-6 pt-0 flex flex-col gap-4", children: _jsxs(Form, { onSubmit: onSubmit, children: [_jsx(Field, { id: "mfa-verify-code", label: t("auth.mfa.verify.code"), required: true, children: _jsx(Input, { kind: "text", id: "mfa-verify-code", name: "mfa-verify-code", value: code, onChange: setCode, disabled: submitting, required: true, autoComplete: "one-time-code" }) }), error !== null ? _jsx(Banner, { variant: "error", children: t(reasonToKey(error)) }) : null, _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting
-                            ? t("auth.mfa.verify.submitting")
-                            : (submitLabel ?? t("auth.mfa.verify.submit")) }), onCancel ? (_jsx(Button, { type: "button", variant: "secondary", onClick: onCancel, disabled: submitting, children: t("auth.mfa.verify.backToLogin") })) : null] }) }) }));
+    return (_jsx(AuthCard, { title: title ?? t("auth.mfa.verify.title"), subtitle: subtitle ?? t("auth.mfa.verify.subtitle"), children: _jsxs(Form, { onSubmit: onSubmit, children: [_jsx(Field, { id: "mfa-verify-code", label: t("auth.mfa.verify.code"), required: true, children: _jsx(Input, { kind: "text", id: "mfa-verify-code", name: "mfa-verify-code", value: code, onChange: setCode, disabled: submitting, required: true, autoComplete: "one-time-code" }) }), error !== null ? _jsx(Banner, { variant: "error", children: t(reasonToKey(error)) }) : null, _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting
+                        ? t("auth.mfa.verify.submitting")
+                        : (submitLabel ?? t("auth.mfa.verify.submit")) }), onCancel ? (_jsx(Button, { type: "button", variant: "secondary", onClick: onCancel, disabled: submitting, children: t("auth.mfa.verify.backToLogin") })) : null] }) }));
 }

package/dist/channel-discord/feature.js

@@ -27,6 +27,7 @@ export function createChannelDiscordFeature(options = {}) {
             valueSchema: chatWebhookUrlSchema(webhookTarget),
         });
         const channel = createDiscordChannel(options, webhooks.keyFor);
+        r.translations({ keys: { "delivery.channel.discord": { en: "Discord" } } });
         r.useExtension(DELIVERY_CHANNEL_EXTENSION, "discord", {
             mode: channel.mode,
             send: channel.send,

package/dist/channel-email/email-channel.js

@@ -44,6 +44,7 @@ function emailEnvelopeFrom(data) {
     if (!data)
         return {};
     const from = typeof data["from"] === "string" ? data["from"] : undefined;
+    const fromName = typeof data["fromName"] === "string" ? data["fromName"] : undefined;
     const replyTo = typeof data["replyTo"] === "string" ? data["replyTo"] : undefined;
     const autoHeaders = listUnsubscribeHeaders(data);
     const explicitHeaders = stringHeaders(data["headers"]);
@@ -55,7 +56,12 @@ function emailEnvelopeFrom(data) {
     const headers = (!overridesUnsubscribe && autoHeaders) || explicitHeaders
         ? { ...(overridesUnsubscribe ? undefined : autoHeaders), ...explicitHeaders }
         : undefined;
-    return { ...(from && { from }), ...(replyTo && { replyTo }), ...(headers && { headers }) };
+    return {
+        ...(from && { from }),
+        ...(fromName && { fromName }),
+        ...(replyTo && { replyTo }),
+        ...(headers && { headers }),
+    };
 }
 export function createEmailChannel(options) {
     const { transport, renderer, resolveEmail } = options;

package/dist/channel-email/feature.js

@@ -11,6 +11,7 @@ export function createChannelEmailFeature(options) {
             recommended: false,
         });
         r.requires("delivery");
+        r.translations({ keys: { "delivery.channel.email": { en: "Email" } } });
         r.useExtension(DELIVERY_CHANNEL_EXTENSION, "email", {
             mode: channel.mode,
             resolve: channel.resolve,

package/dist/channel-email/pii-guard.js

@@ -9,15 +9,16 @@ const CIPHERTEXT_RE = /kumiko-pii:v\d+:[^"\s<>\\]*/g;
 // blob); ciphertext in subject/body fails loud in dev and is redacted+logged
 // in prod.
 export function guardEmailMessage(message) {
-    // Every envelope address, not just `to`: a ciphertext From or Reply-To is
+    // Every envelope address, not just `to`: a ciphertext From, From-Name or Reply-To is
     // the same garbage as a ciphertext recipient — refuse rather than mail it.
     for (const [label, address] of [
-        ["recipient", message.to],
-        ["from", message.from],
-        ["reply-to", message.replyTo],
+        ["recipient address", message.to],
+        ["from address", message.from],
+        ["from name", message.fromName],
+        ["reply-to address", message.replyTo],
     ]) {
         if (address?.includes(CIPHERTEXT_MARKER)) {
-            throw new Error(`[channel-email] refusing to send: ${label} address is a PII ciphertext ` +
+            throw new Error(`[channel-email] refusing to send: ${label} is a PII ciphertext ` +
                 `("${PII_CIPHERTEXT_PREFIX}…") — decrypt the stored value before mailing (decryptStoredPii).`);
         }
     }

package/dist/channel-email/smtp-transport.js

@@ -16,6 +16,27 @@
 // Volume-Apps muss der Caller eine eigene Implementation mit
 // dedizierter Queue (BullMQ + retry) drüberlegen.
 import { createTransport } from "nodemailer";
+import addressparser from "nodemailer/lib/addressparser";
+function isControlCharacter(char) {
+    const code = char.charCodeAt(0);
+    return code <= 0x1f || code === 0x7f;
+}
+// Control characters in a display name would let a caller inject headers.
+function sanitizedDisplayName(name) {
+    const cleaned = name
+        ?.split("")
+        .map((char) => (isControlCharacter(char) ? " " : char))
+        .join("")
+        .trim();
+    return cleaned === undefined || cleaned === "" ? undefined : cleaned;
+}
+function fromHeader(address, fromName) {
+    const name = sanitizedDisplayName(fromName);
+    if (name === undefined)
+        return address;
+    const [parsed] = addressparser(address, { flatten: true });
+    return parsed?.address ? { name, address: parsed.address } : address;
+}
 export function createSmtpTransport(options) {
     const transporter = createTransport({
         host: options.host,
@@ -29,7 +50,7 @@ export function createSmtpTransport(options) {
     return {
         async send(message) {
             await transporter.sendMail({
-                from: message.from ?? options.from,
+                from: fromHeader(message.from ?? options.from, message.fromName),
                 to: message.to,
                 subject: message.subject,
                 html: message.html,

package/dist/channel-email/types.d.ts

@@ -3,6 +3,7 @@ export type EmailMessage = {
     readonly subject: string;
     readonly html: string;
     readonly from?: string;
+    readonly fromName?: string;
     readonly replyTo?: string;
     readonly headers?: Readonly<Record<string, string>>;
 };

package/dist/channel-in-app/feature.js

@@ -19,6 +19,7 @@ export function createChannelInAppFeature() {
             reason: "read_side.in_app_messages",
         });
         // Register as delivery channel via extension system
+        r.translations({ keys: { "delivery.channel.inApp": { en: "In-app" } } });
         r.useExtension(DELIVERY_CHANNEL_EXTENSION, "inApp", {
             mode: inAppChannel.mode,
             resolve: inAppChannel.resolve,

package/dist/channel-push/feature.js

@@ -11,6 +11,7 @@ export function createChannelPushFeature(options) {
             recommended: false,
         });
         r.requires("delivery");
+        r.translations({ keys: { "delivery.channel.push": { en: "Push" } } });
         r.useExtension(DELIVERY_CHANNEL_EXTENSION, "push", {
             mode: channel.mode,
             resolve: channel.resolve,

package/dist/channel-slack/feature.js

@@ -24,6 +24,7 @@ export function createChannelSlackFeature(options = {}) {
             valueSchema: chatWebhookUrlSchema(webhookTarget),
         });
         const channel = createSlackChannel(options, webhooks.keyFor);
+        r.translations({ keys: { "delivery.channel.slack": { en: "Slack" } } });
         r.useExtension(DELIVERY_CHANNEL_EXTENSION, "slack", {
             mode: channel.mode,
             send: channel.send,

package/dist/channel-teams/feature.js

@@ -28,6 +28,7 @@ export function createChannelTeamsFeature(options = {}) {
             valueSchema: chatWebhookUrlSchema(webhookTarget),
         });
         const channel = createTeamsChannel(options, webhooks.keyFor);
+        r.translations({ keys: { "delivery.channel.teams": { en: "Microsoft Teams" } } });
         r.useExtension(DELIVERY_CHANNEL_EXTENSION, "teams", {
             mode: channel.mode,
             send: channel.send,

package/dist/channel-teams/teams-channel.d.ts

@@ -1,4 +1,4 @@
-import { type ChatWebhookChannelOptions, type DeliveryChannel } from "../delivery/index.js";
+import { type ChatSendResult, type ChatWebhookChannelOptions, type ChatWebhookResponse, type DeliveryChannel } from "../delivery/index.js";
 export type TeamsChannelOptions = ChatWebhookChannelOptions;
 export declare const TEAMS_SECRET_KEYS: {
     readonly webhookPrefix: "channel-teams:webhooks.";
@@ -6,4 +6,5 @@ export declare const TEAMS_SECRET_KEYS: {
 };
 export declare const TEAMS_DEFAULT_ALLOWED_HOSTS: readonly [".webhook.office.com", ".logic.azure.com", ".powerplatform.com"];
 export declare function buildTeamsAdaptiveCard(title: string, body: string | undefined): unknown;
+export declare function classifyTeamsResponse(response: ChatWebhookResponse): Promise<ChatSendResult>;
 export declare function createTeamsChannel(options: TeamsChannelOptions, keyFor: (connection: string) => string): DeliveryChannel;

package/dist/channel-teams/teams-channel.js

@@ -30,12 +30,24 @@ export function buildTeamsAdaptiveCard(title, body) {
         ],
     };
 }
+// Classic Office connectors answer 200 with the body "1". Workflow endpoints answer
+// 202 and never say whether the card reached the channel. Any other 2xx (an empty
+// 200 is what a made-up URL returns) is not a Teams success.
+export async function classifyTeamsResponse(response) {
+    if (response.status === 202)
+        return { ok: true, confirmed: false };
+    if (response.status === 200 && (await response.readBodyPrefix()).trim() === "1") {
+        return { ok: true, confirmed: true };
+    }
+    return { ok: false, code: "unexpected_response" };
+}
 export function createTeamsChannel(options, keyFor) {
     return createChatWebhookChannel({
         name: "teams",
         featureName: "channel-teams",
         defaultAllowedHosts: TEAMS_DEFAULT_ALLOWED_HOSTS,
         keyFor,
+        classifyResponse: classifyTeamsResponse,
         buildBody: (message) => buildTeamsAdaptiveCard(message.title, message.body),
         options,
     });

package/dist/channel-telegram/feature.js

@@ -22,6 +22,7 @@ export function createChannelTelegramFeature(options = {}) {
             valueSchema: z.string().refine(isTelegramBotToken, "invalid bot token"),
         });
         const channel = createTelegramChannel(options, botToken.name);
+        r.translations({ keys: { "delivery.channel.telegram": { en: "Telegram" } } });
         r.useExtension(DELIVERY_CHANNEL_EXTENSION, "telegram", {
             mode: channel.mode,
             send: channel.send,

package/dist/delivery/chat-webhook-channel.d.ts

@@ -1,4 +1,4 @@
-import { type ChatSendResult, type ChatWebhookTarget } from "./chat-webhook-sender.js";
+import { type ChatSendResult, type ChatWebhookRequest, type ChatWebhookTarget } from "./chat-webhook-sender.js";
 import type { ChannelMessage, ChannelResult, DeliveryChannel } from "./types.js";
 export type ChatWebhookChannelOptions = {
     readonly allowedHosts?: readonly string[];
@@ -18,6 +18,7 @@ export type ChatWebhookChannelSpec = {
     readonly requiredPathPrefix?: string;
     readonly keyFor: (connection: string) => string;
     readonly buildBody: (message: ChannelMessage) => unknown;
+    readonly classifyResponse?: ChatWebhookRequest["classifyResponse"];
     readonly options: ChatWebhookChannelOptions;
 };
 export declare function createChatWebhookChannel(spec: ChatWebhookChannelSpec): DeliveryChannel;

package/dist/delivery/chat-webhook-channel.js

@@ -1,9 +1,11 @@
 import { SYSTEM_USER_ID } from "@cosmicdrift/kumiko-types/identifiers";
 import { chatConnectionNameSchema, DEFAULT_CHAT_TIMEOUT_MS, postChatWebhook, } from "./chat-webhook-sender.js";
 export function toChannelResult(address, result) {
-    return result.ok
+    if (!result.ok)
+        return { status: "failed", error: result.code, address };
+    return result.confirmed
         ? { status: "sent", address }
-        : { status: "failed", error: result.code, address };
+        : { status: "sent", confirmed: false, address };
 }
 export function chatMessageText(message) {
     return message.body ? `${message.title}\n${message.body}` : message.title;
@@ -46,6 +48,7 @@ export function createChatWebhookChannel(spec) {
                 ...resolveChatWebhookTarget(spec, options),
                 timeoutMs: options.timeoutMs ?? DEFAULT_CHAT_TIMEOUT_MS,
                 body: spec.buildBody(message),
+                ...(spec.classifyResponse && { classifyResponse: spec.classifyResponse }),
             });
             return toChannelResult(address, result);
         },

package/dist/delivery/chat-webhook-sender.d.ts

@@ -1,11 +1,17 @@
+import type { ChatSendFailureCode } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-export type ChatSendFailureCode = `http_${number}` | "timeout" | "network_error" | "redirect_blocked" | "host_not_allowed" | "missing_credentials" | "invalid_address";
+export type { ChatSendFailureCode };
 export type ChatSendResult = {
     readonly ok: true;
+    readonly confirmed: boolean;
 } | {
     readonly ok: false;
     readonly code: ChatSendFailureCode;
 };
+export type ChatWebhookResponse = {
+    readonly status: number;
+    readBodyPrefix(): Promise<string>;
+};
 export declare const DEFAULT_CHAT_TIMEOUT_MS = 10000;
 export declare const chatConnectionNameSchema: z.ZodString;
 export type ChatWebhookTarget = {
@@ -18,6 +24,7 @@ export type ChatWebhookRequest = ChatWebhookTarget & {
     readonly timeoutMs: number;
     readonly body: unknown;
     readonly send?: (url: string, init: RequestInit) => Promise<Response>;
+    readonly classifyResponse?: (response: ChatWebhookResponse) => Promise<ChatSendResult>;
 };
 export declare function checkChatWebhookTarget(target: ChatWebhookTarget, url: string): URL | undefined;
 export declare function chatWebhookUrlSchema(target: ChatWebhookTarget): z.ZodType<string>;

package/dist/delivery/chat-webhook-sender.js

@@ -1,5 +1,6 @@
 import { BlockedHostError, egress } from "@cosmicdrift/kumiko-framework/http";
 import * as z from "zod";
+const MAX_BODY_PREFIX_BYTES = 64;
 export const DEFAULT_CHAT_TIMEOUT_MS = 10_000;
 // Tenant-chosen connection name (the route address for webhook channels). Also
 // the suffix the secrets write gate accepts under the channel's namespace, so
@@ -92,15 +93,55 @@ export async function postChatWebhook(request) {
     catch (err) {
         return { ok: false, code: classifyFailure(err) };
     }
-    // Free the connection; the body is never read or stored.
-    await response.body?.cancel().catch(() => undefined);
     const { status } = response;
-    if (status >= 300 && status < 400)
+    if (status >= 300 && status < 400) {
+        await response.body?.cancel().catch(() => undefined);
         return { ok: false, code: "redirect_blocked" };
+    }
     if (status >= 200 && status < 300)
-        return { ok: true };
+        return classifySuccess(request, response);
+    await response.body?.cancel().catch(() => undefined);
     return { ok: false, code: `http_${status}` };
 }
+// The body is cancelled afterwards in every case, even when the classifier throws,
+// so the connection is freed and a large body is never read to the end.
+async function classifySuccess(request, response) {
+    let reader;
+    try {
+        if (!request.classifyResponse)
+            return { ok: true, confirmed: true };
+        return await request.classifyResponse({
+            status: response.status,
+            async readBodyPrefix() {
+                reader ??= response.body?.getReader();
+                if (!reader)
+                    return "";
+                const chunks = [];
+                let total = 0;
+                while (total < MAX_BODY_PREFIX_BYTES) {
+                    const { done, value } = await reader.read();
+                    if (done)
+                        break;
+                    chunks.push(value);
+                    total += value.length;
+                }
+                const joined = new Uint8Array(total);
+                let offset = 0;
+                for (const chunk of chunks) {
+                    joined.set(chunk, offset);
+                    offset += chunk.length;
+                }
+                return new TextDecoder().decode(joined.subarray(0, MAX_BODY_PREFIX_BYTES));
+            },
+        });
+    }
+    catch (err) {
+        return { ok: false, code: classifyFailure(err) };
+    }
+    finally {
+        await (reader ? reader.cancel() : response.body?.cancel())?.catch(() => undefined);
+    }
+}
 export function truncateChars(text, maxChars) {
     const chars = Array.from(text);
     return chars.length <= maxChars ? text : chars.slice(0, maxChars).join("");

package/dist/delivery/constants.d.ts

@@ -1,6 +1,6 @@
 import type { NotifyPriority } from "@cosmicdrift/kumiko-framework/engine";
 export declare const DELIVERY_CHANNEL_EXTENSION: "deliveryChannel";
-export { DELIVERY_ATTEMPT_EVENT, DELIVERY_FEATURE, DELIVERY_LOG_SCREEN_ID, DELIVERY_RESUBSCRIBE_PATH, DELIVERY_STATUS_CELL_COMPONENT, DELIVERY_UNSUBSCRIBE_PATH, DeliveryErrors, DeliveryHandlers, DeliveryJobNames, DeliveryQueries, DeliveryStatus, type DeliveryStatusValue, } from "./public-names.js";
+export { DELIVERY_ATTEMPT_EVENT, DELIVERY_CHANNEL_CELL_COMPONENT, DELIVERY_ERROR_CELL_COMPONENT, DELIVERY_FEATURE, DELIVERY_LOG_SCREEN_ID, DELIVERY_RESUBSCRIBE_PATH, DELIVERY_STATUS_CELL_COMPONENT, DELIVERY_TIME_CELL_COMPONENT, DELIVERY_TYPE_CELL_COMPONENT, DELIVERY_UNSUBSCRIBE_PATH, DeliveryErrors, DeliveryHandlers, DeliveryJobNames, DeliveryQueries, DeliveryStatus, type DeliveryStatusValue, } from "./public-names.js";
 export declare const deliveryPriorityRank: Record<NotifyPriority, number>;
 export declare const DeliveryJobs: {
     readonly render: string;

package/dist/delivery/constants.js

@@ -3,7 +3,7 @@ import { DELIVERY_FEATURE, DeliveryJobNames } from "./public-names.js";
 // Extension-point name for delivery-channel plugins (channel-email,
 // channel-in-app, channel-push, ...).
 export const DELIVERY_CHANNEL_EXTENSION = "deliveryChannel";
-export { DELIVERY_ATTEMPT_EVENT, DELIVERY_FEATURE, DELIVERY_LOG_SCREEN_ID, DELIVERY_RESUBSCRIBE_PATH, DELIVERY_STATUS_CELL_COMPONENT, DELIVERY_UNSUBSCRIBE_PATH, DeliveryErrors, DeliveryHandlers, DeliveryJobNames, DeliveryQueries, DeliveryStatus, } from "./public-names.js";
+export { DELIVERY_ATTEMPT_EVENT, DELIVERY_CHANNEL_CELL_COMPONENT, DELIVERY_ERROR_CELL_COMPONENT, DELIVERY_FEATURE, DELIVERY_LOG_SCREEN_ID, DELIVERY_RESUBSCRIBE_PATH, DELIVERY_STATUS_CELL_COMPONENT, DELIVERY_TIME_CELL_COMPONENT, DELIVERY_TYPE_CELL_COMPONENT, DELIVERY_UNSUBSCRIBE_PATH, DeliveryErrors, DeliveryHandlers, DeliveryJobNames, DeliveryQueries, DeliveryStatus, } from "./public-names.js";
 // notify() priority → BullMQ job priority. Lower number = processed first; all
 // > 0 so prioritised delivery jobs never mix with BullMQ's "0 = unprioritised
 // FIFO" bucket. critical jobs jump ahead of normal/low in the worker queue.

package/dist/delivery/delivery-service.d.ts

@@ -1,10 +1,11 @@
 import type { SseBroker } from "@cosmicdrift/kumiko-framework/api";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import type { EscapeHatchAuditSink, NotifyJobDispatcher, Registry, TenantId } from "@cosmicdrift/kumiko-framework/engine";
-import type { Logger } from "@cosmicdrift/kumiko-framework/logging";
+import { type Logger } from "@cosmicdrift/kumiko-framework/logging";
 import type { SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
 import type { Redis } from "ioredis";
 import { type DeliveryChannel, type DeliveryService } from "./types.js";
+export declare function redactedMessageOf(err: unknown): string;
 export type RateLimitConfig = {
     readonly redis: Redis;
     readonly maxPerHour: number;