@cosmicdrift/kumiko-bundled-features 0.342.0 → 0.343.0

package/dist/audit/constants.d.ts

@@ -13,6 +13,10 @@ export declare const AuditQueries: {
 export declare const AUDIT_LOG_SCREEN_ID: "audit-log";
 /** Single-event detail screen, breadcrumb-linked to the audit-log list. */
 export declare const AUDIT_LOG_DETAIL_SCREEN_ID: "audit-log-detail";
-/** Config key (system scope) for how long `escapeHatchUse` audit events are kept. */
+/**
+ * Config key (system scope) for how long `escapeHatchUse` audit events are kept. Only a fallback
+ * for apps without compliance-profiles; with it mounted, the tenant profile's `auditLog.retention`
+ * applies (a tenant override can only lengthen it).
+ */
 export declare const ESCAPE_HATCH_RETENTION_DAYS_KEY: "audit:config:escape-hatch-retention-days";
 export declare const DEFAULT_ESCAPE_HATCH_RETENTION_DAYS = 90;

package/dist/audit/constants.js

@@ -18,6 +18,10 @@ export const AuditQueries = {
 export const AUDIT_LOG_SCREEN_ID = "audit-log";
 /** Single-event detail screen, breadcrumb-linked to the audit-log list. */
 export const AUDIT_LOG_DETAIL_SCREEN_ID = "audit-log-detail";
-/** Config key (system scope) for how long `escapeHatchUse` audit events are kept. */
+/**
+ * Config key (system scope) for how long `escapeHatchUse` audit events are kept. Only a fallback
+ * for apps without compliance-profiles; with it mounted, the tenant profile's `auditLog.retention`
+ * applies (a tenant override can only lengthen it).
+ */
 export const ESCAPE_HATCH_RETENTION_DAYS_KEY = "audit:config:escape-hatch-retention-days";
 export const DEFAULT_ESCAPE_HATCH_RETENTION_DAYS = 90;

package/dist/audit/escape-hatch-audit-sink.d.ts

@@ -7,6 +7,7 @@ export declare const escapeHatchUsedSchema: z.ZodObject<{
     handler: z.ZodString;
     kind: z.ZodEnum<{
         "acknowledge-cross-tenant": "acknowledge-cross-tenant";
+        "cross-tenant-read": "cross-tenant-read";
         "global-write": "global-write";
         "identity-switch": "identity-switch";
         "unsafe-all-tenants": "unsafe-all-tenants";

package/dist/audit/escape-hatch-audit-sink.js

@@ -11,6 +11,7 @@ const escapeHatchKinds = [
     "global-write",
     "identity-switch",
     "unsafe-all-tenants",
+    "cross-tenant-read",
 ];
 export const escapeHatchUsedSchema = z.object({
     handler: z.string(),

package/dist/audit/run-escape-hatch-retention.d.ts

@@ -1,10 +1,11 @@
 import type { DbConnection, DbRunner } from "@cosmicdrift/kumiko-framework/db";
 import { type ConfigResolver, type Registry } from "@cosmicdrift/kumiko-framework/engine";
-import { type PruneEventsResult } from "@cosmicdrift/kumiko-framework/pipeline";
 export declare function isDbConnection(runner: DbRunner): runner is DbConnection;
 export declare function runEscapeHatchRetention(args: {
     readonly db: DbRunner;
     readonly registry: Registry;
     readonly configResolver: ConfigResolver | undefined;
     readonly userId: string;
-}): Promise<PruneEventsResult>;
+}): Promise<{
+    readonly deletedCount: number;
+}>;

package/dist/audit/run-escape-hatch-retention.js

@@ -1,8 +1,13 @@
-import { SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { COMPLIANCE_PROFILES, subtractRetentionSpec, } from "@cosmicdrift/kumiko-framework/compliance";
+import { parseTenantId, SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
+import { eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import { pruneEvents } from "@cosmicdrift/kumiko-framework/pipeline";
+import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
+import { resolveProfileForTenant } from "../compliance-profiles/index.js";
 import { createConfigAccessor } from "../config/index.js";
 import { DEFAULT_ESCAPE_HATCH_RETENTION_DAYS, ESCAPE_HATCH_RETENTION_DAYS_KEY, } from "./constants.js";
-import { ESCAPE_HATCH_USE_AGGREGATE_TYPE } from "./escape-hatch-audit-sink.js";
+import { ESCAPE_HATCH_USE_AGGREGATE_TYPE, escapeHatchUsedSchema, } from "./escape-hatch-audit-sink.js";
 // pruneEvents opens its own transaction, so a runner that cannot begin one (a tx handle) is rejected instead of nested.
 export function isDbConnection(runner) {
     return "begin" in runner && typeof runner.begin === "function";
@@ -14,14 +19,73 @@ async function resolveRetentionDays(args) {
     const raw = await config(ESCAPE_HATCH_RETENTION_DAYS_KEY);
     return typeof raw === "number" && raw >= 1 ? raw : DEFAULT_ESCAPE_HATCH_RETENTION_DAYS;
 }
+// Soft dependency: audit must stay mountable without compliance-profiles, so we probe its entity.
+const COMPLIANCE_PROFILE_ENTITY = "tenant-compliance-profile";
+const PRUNE_CHUNK_SIZE = 1000;
+// Overrides may only lengthen retention: the earlier cutoff (same `now`) is the longer period.
+function earlierInstant(a, b) {
+    return Temporal.Instant.compare(a, b) <= 0 ? a : b;
+}
+async function resolveTenantCutoff(db, tenantId, now) {
+    const { profile } = await resolveProfileForTenant({ db, tenantId });
+    const effective = subtractRetentionSpec(now, profile.auditLog.retention);
+    const base = subtractRetentionSpec(now, COMPLIANCE_PROFILES[profile.key].auditLog.retention);
+    return earlierInstant(effective, base);
+}
+// A cross-tenant audit (e.g. identity-switch) lives under the actor's tenant but must also
+// satisfy the target tenant's retention. A malformed payload falls back to the storing tenant.
+function targetTenantOf(payload) {
+    const parsed = escapeHatchUsedSchema.safeParse(payload);
+    return parsed.success ? parseTenantId(parsed.data.targetTenantId) : null;
+}
+async function pruneByTenantProfiles(db) {
+    const rows = await selectMany(db, eventsTable, {
+        aggregateType: ESCAPE_HATCH_USE_AGGREGATE_TYPE,
+    });
+    const now = getTemporal().Now.instant();
+    const cutoffByTenant = new Map();
+    const cutoffOf = async (tenantId) => {
+        const cached = cutoffByTenant.get(tenantId);
+        if (cached)
+            return cached;
+        const cutoff = await resolveTenantCutoff(db, tenantId, now);
+        cutoffByTenant.set(tenantId, cutoff);
+        return cutoff;
+    };
+    const expiredAggregateIds = [];
+    for (const row of rows) {
+        const targetTenantId = targetTenantOf(row.payload);
+        const storeCutoff = await cutoffOf(row.tenantId);
+        const cutoff = targetTenantId
+            ? earlierInstant(storeCutoff, await cutoffOf(targetTenantId))
+            : storeCutoff;
+        if (Temporal.Instant.compare(row.createdAt, cutoff) < 0) {
+            expiredAggregateIds.push(row.aggregateId);
+        }
+    }
+    let deletedCount = 0;
+    for (let i = 0; i < expiredAggregateIds.length; i += PRUNE_CHUNK_SIZE) {
+        const result = await pruneEvents(db, {
+            aggregateTypes: [ESCAPE_HATCH_USE_AGGREGATE_TYPE],
+            aggregateIds: expiredAggregateIds.slice(i, i + PRUNE_CHUNK_SIZE),
+            olderThan: now,
+        });
+        deletedCount += result.deletedCount;
+    }
+    return deletedCount;
+}
 export async function runEscapeHatchRetention(args) {
     const { db } = args;
     if (!isDbConnection(db)) {
         throw new Error("audit escape-hatch retention: a transaction-free DbConnection is required");
     }
-    const olderThanDays = await resolveRetentionDays({ ...args, db });
-    return pruneEvents(db, {
-        aggregateTypes: [ESCAPE_HATCH_USE_AGGREGATE_TYPE],
-        olderThanDays,
-    });
+    if (!args.registry.getEntity(COMPLIANCE_PROFILE_ENTITY)) {
+        const olderThanDays = await resolveRetentionDays({ ...args, db });
+        const { deletedCount } = await pruneEvents(db, {
+            aggregateTypes: [ESCAPE_HATCH_USE_AGGREGATE_TYPE],
+            olderThanDays,
+        });
+        return { deletedCount };
+    }
+    return { deletedCount: await pruneByTenantProfiles(db) };
 }

package/dist/auth-email-password/email-templates.d.ts

@@ -6,6 +6,10 @@ export type RenderTokenContentArgs = {
     readonly locale?: AuthMailLocale;
     /** Optional app name for subject + intro. Default from auth.mail.appNameDefault. */
     readonly appName?: string;
+    /** ISO instant the token was issued; the validity duration is measured from it. Default: now. */
+    readonly issuedAt?: string;
+    /** IANA zone the expiry time is shown in. Default "UTC"; an invalid zone falls back to "UTC". */
+    readonly timeZone?: string;
 };
 export type RenderInviteEmailArgs = RenderTokenContentArgs & {
     readonly role: string;

package/dist/auth-email-password/email-templates.js

@@ -15,31 +15,31 @@ export const AUTH_MAIL_EN = {
     "auth.mail.reset.greeting": "Hi,",
     "auth.mail.reset.intro": "you requested a password reset for {app}. Click the link below to set a new password:",
     "auth.mail.reset.button": "Reset password",
-    "auth.mail.reset.expiry": "The link expires on {when}.",
+    "auth.mail.reset.expiry": "The link is valid for {duration} (until {when}).",
     "auth.mail.reset.ignore": "If you didn't request a reset, you can safely ignore this email — your password won't change.",
     "auth.mail.verify.subject": "{app} — Verify your email",
     "auth.mail.verify.greeting": "Welcome,",
     "auth.mail.verify.intro": "please verify your email address for {app} to activate your account:",
     "auth.mail.verify.button": "Verify email",
-    "auth.mail.verify.expiry": "The link expires on {when}.",
+    "auth.mail.verify.expiry": "The link is valid for {duration} (until {when}).",
     "auth.mail.verify.ignore": "If you didn't create this account, you can ignore this email.",
     "auth.mail.activation.subject": "{app} — Activate your account",
     "auth.mail.activation.greeting": "Welcome,",
     "auth.mail.activation.intro": "click the link below to activate your {app} account. The next step is choosing your password:",
     "auth.mail.activation.button": "Activate account",
-    "auth.mail.activation.expiry": "The link expires on {when}.",
+    "auth.mail.activation.expiry": "The link is valid for {duration} (until {when}).",
     "auth.mail.activation.ignore": "If you didn't sign up, you can ignore this email — no account is created until you open the link.",
     "auth.mail.invite.subject": "{app} — Workspace invitation",
     "auth.mail.invite.greeting": "Hi,",
     "auth.mail.invite.intro": "you've been invited to a {app} workspace as {role}. Click the link below to accept:",
     "auth.mail.invite.button": "Accept invitation",
-    "auth.mail.invite.expiry": "The link expires on {when}.",
+    "auth.mail.invite.expiry": "The link is valid for {duration} (until {when}).",
     "auth.mail.invite.ignore": "If you weren't expecting this invitation, you can ignore this email.",
     "auth.mail.unlock.subject": "{app} — Unlock your account",
     "auth.mail.unlock.greeting": "Hi,",
     "auth.mail.unlock.intro": "your {app} account was temporarily locked after several failed sign-in attempts. Click the link below to unlock it immediately:",
     "auth.mail.unlock.button": "Unlock account",
-    "auth.mail.unlock.expiry": "The link expires on {when}.",
+    "auth.mail.unlock.expiry": "The link is valid for {duration} (until {when}).",
     "auth.mail.unlock.ignore": "If you didn't trigger this lock, you can ignore this email — the lock expires on its own.",
 };
 registerMailTranslations("en", AUTH_MAIL_EN);
@@ -73,7 +73,7 @@ export function renderResetPasswordEmail(args) {
         intro: t(locale, "auth.mail.reset.intro", { app }),
         buttonLabel: t(locale, "auth.mail.reset.button"),
         buttonUrl: args.url,
-        expiry: t(locale, "auth.mail.reset.expiry", { when: formatExpiry(args.expiresAt) }),
+        expiry: t(locale, "auth.mail.reset.expiry", expiryParams(args, locale)),
         ignore: t(locale, "auth.mail.reset.ignore"),
     });
 }
@@ -87,7 +87,7 @@ export function renderUnlockAccountEmail(args) {
         intro: t(locale, "auth.mail.unlock.intro", { app }),
         buttonLabel: t(locale, "auth.mail.unlock.button"),
         buttonUrl: args.url,
-        expiry: t(locale, "auth.mail.unlock.expiry", { when: formatExpiry(args.expiresAt) }),
+        expiry: t(locale, "auth.mail.unlock.expiry", expiryParams(args, locale)),
         ignore: t(locale, "auth.mail.unlock.ignore"),
     });
 }
@@ -101,7 +101,7 @@ export function renderVerifyEmail(args) {
         intro: t(locale, "auth.mail.verify.intro", { app }),
         buttonLabel: t(locale, "auth.mail.verify.button"),
         buttonUrl: args.url,
-        expiry: t(locale, "auth.mail.verify.expiry", { when: formatExpiry(args.expiresAt) }),
+        expiry: t(locale, "auth.mail.verify.expiry", expiryParams(args, locale)),
         ignore: t(locale, "auth.mail.verify.ignore"),
     });
 }
@@ -115,7 +115,7 @@ export function renderActivationEmail(args) {
         intro: t(locale, "auth.mail.activation.intro", { app }),
         buttonLabel: t(locale, "auth.mail.activation.button"),
         buttonUrl: args.url,
-        expiry: t(locale, "auth.mail.activation.expiry", { when: formatExpiry(args.expiresAt) }),
+        expiry: t(locale, "auth.mail.activation.expiry", expiryParams(args, locale)),
         ignore: t(locale, "auth.mail.activation.ignore"),
     });
 }
@@ -129,19 +129,72 @@ export function renderInviteEmail(args) {
         intro: t(locale, "auth.mail.invite.intro", { app, role: args.role }),
         buttonLabel: t(locale, "auth.mail.invite.button"),
         buttonUrl: args.url,
-        expiry: t(locale, "auth.mail.invite.expiry", { when: formatExpiry(args.expiresAt) }),
+        expiry: t(locale, "auth.mail.invite.expiry", expiryParams(args, locale)),
         ignore: t(locale, "auth.mail.invite.ignore"),
     });
 }
-function formatExpiry(iso) {
+const MS_PER_MINUTE = 60_000;
+const MS_PER_HOUR = 60 * MS_PER_MINUTE;
+const MS_PER_DAY = 24 * MS_PER_HOUR;
+// Rounds to whole minutes first so a few ms between issuing and signing still
+// read as "1 day"; a larger unit is only used when it divides the span exactly.
+function durationParts(ms) {
+    const minutes = Math.max(1, Math.round(ms / MS_PER_MINUTE));
+    const minutesPerHour = MS_PER_HOUR / MS_PER_MINUTE;
+    const minutesPerDay = MS_PER_DAY / MS_PER_MINUTE;
+    if (minutes % minutesPerDay === 0)
+        return { amount: minutes / minutesPerDay, unit: "day" };
+    if (minutes % minutesPerHour === 0)
+        return { amount: minutes / minutesPerHour, unit: "hour" };
+    return { amount: minutes, unit: "minute" };
+}
+function formatDuration(ms, locale) {
+    const { amount, unit } = durationParts(ms);
+    const options = { style: "unit", unit, unitDisplay: "long" };
     try {
-        const z = Temporal.Instant.from(iso).toZonedDateTimeISO("UTC");
-        return `${z.year}-${pad2(z.month)}-${pad2(z.day)} ${pad2(z.hour)}:${pad2(z.minute)} UTC`;
+        return new Intl.NumberFormat(locale, options).format(amount);
     }
     catch {
-        return iso;
+        return new Intl.NumberFormat("en", options).format(amount);
     }
 }
-function pad2(n) {
-    return String(n).padStart(2, "0");
+// Intl rejects timeZoneName together with dateStyle/timeStyle, so the zone
+// abbreviation is read from a second formatter and appended.
+function formatWhen(expiresAt, locale, timeZone) {
+    const build = (tag, zone) => {
+        const at = expiresAt.epochMilliseconds;
+        const dateTime = new Intl.DateTimeFormat(tag, {
+            dateStyle: "medium",
+            timeStyle: "short",
+            timeZone: zone,
+        }).format(at);
+        const zoneName = new Intl.DateTimeFormat(tag, { timeZone: zone, timeZoneName: "short" })
+            .formatToParts(at)
+            .find((part) => part.type === "timeZoneName")?.value;
+        return zoneName ? `${dateTime} ${zoneName}` : dateTime;
+    };
+    try {
+        return build(locale, timeZone);
+    }
+    catch {
+        try {
+            return build(locale, "UTC");
+        }
+        catch {
+            return build("en", "UTC");
+        }
+    }
+}
+function expiryParams(args, locale) {
+    try {
+        const expiresAt = Temporal.Instant.from(args.expiresAt);
+        const issuedAt = args.issuedAt ? Temporal.Instant.from(args.issuedAt) : Temporal.Now.instant();
+        return {
+            duration: formatDuration(expiresAt.epochMilliseconds - issuedAt.epochMilliseconds, locale),
+            when: formatWhen(expiresAt, locale, args.timeZone ?? "UTC"),
+        };
+    }
+    catch {
+        return { duration: args.expiresAt, when: args.expiresAt };
+    }
 }

package/dist/auth-email-password/handlers/invite-create.write.js

@@ -67,7 +67,8 @@ async function issueInvitation(opts, ttlSeconds, request, inviter, ctx, refuseAc
     }
     const email = request.email.toLowerCase();
     const tenantId = inviter.tenantId;
-    const expiresAt = Temporal.Now.instant().add({ seconds: ttlSeconds });
+    const issuedAt = Temporal.Now.instant();
+    const expiresAt = issuedAt.add({ seconds: ttlSeconds });
     // The unique index allows one row per (tenantId, email). Whatever its
     // status, a re-invite resets it to pending with a fresh token.
     const existing = await ctx.db.fetchOne(tenantInvitationsTable, { tenantId, email });
@@ -126,6 +127,8 @@ async function issueInvitation(opts, ttlSeconds, request, inviter, ctx, refuseAc
         appUrl: opts.appUrl,
         token,
         expiresAt: expiresAt.toString(),
+        issuedAt: issuedAt.toString(),
+        timeZone: ctx.tz.user,
         ...(opts.appName !== undefined && { appName: opts.appName }),
         locale,
     });

package/dist/auth-email-password/handlers/signup-request.write.js

@@ -104,7 +104,8 @@ export function createSignupRequestHandler(opts) {
             // uses randomBytes from node:crypto, the same source as CSRF/
             // session tokens.
             const token = generateToken();
-            const expiresAt = Temporal.Now.instant().add({ seconds: ttlSeconds });
+            const issuedAt = Temporal.Now.instant();
+            const expiresAt = issuedAt.add({ seconds: ttlSeconds });
             const expiresAtIso = expiresAt.toString();
             await storeSignupToken(ctx.redis, { email, token, ttlSeconds });
             // A handover grant in this request re-verifies and replaces the prior
@@ -158,6 +159,8 @@ export function createSignupRequestHandler(opts) {
                 appUrl: opts.appUrl,
                 token,
                 expiresAt: expiresAtIso,
+                issuedAt: issuedAt.toString(),
+                timeZone: ctx.tz.user,
                 ...(opts.appName !== undefined && { appName: opts.appName }),
                 locale,
             });

package/dist/auth-email-password/handlers/token-request-handler.js

@@ -55,6 +55,7 @@ export function createTokenRequestHandler(spec, opts) {
                 return { isSuccess: true, data };
             }
             const { token, expiresAt } = spec.sign(user.id, ttl, opts.hmacSecret);
+            const issuedAt = expiresAt.subtract({ minutes: ttl }).toString();
             const locale = resolveHandlerMailLocale(ctx, opts.locale);
             await dispatchMagicLinkMail(ctx.notify, {
                 handlerName: spec.handlerName,
@@ -67,6 +68,8 @@ export function createTokenRequestHandler(spec, opts) {
                 appUrl: opts.appUrl,
                 token,
                 expiresAt: expiresAt.toString(),
+                issuedAt,
+                timeZone: ctx.tz.user,
                 ...(opts.appName !== undefined && { appName: opts.appName }),
                 locale,
             });

package/dist/auth-email-password/magic-link-mail.d.ts

@@ -12,6 +12,8 @@ export type MagicLinkMailParams = {
     readonly expiresAt: string;
     readonly appName?: string;
     readonly locale?: AuthMailLocale;
+    readonly issuedAt?: string;
+    readonly timeZone?: string;
 };
 export declare function resolveHandlerMailLocale(ctx: {
     readonly locale?: string;

package/dist/auth-email-password/magic-link-mail.js

@@ -40,6 +40,8 @@ export async function dispatchMagicLinkMail(notify, spec, params) {
         expiresAt: params.expiresAt,
         ...(params.locale !== undefined && { locale: params.locale }),
         ...(params.appName !== undefined && { appName: params.appName }),
+        ...(params.issuedAt !== undefined && { issuedAt: params.issuedAt }),
+        ...(params.timeZone !== undefined && { timeZone: params.timeZone }),
     });
     await notify(spec.notificationType, {
         route: { email: params.email },

package/dist/channel-discord/feature.js

@@ -27,6 +27,7 @@ export function createChannelDiscordFeature(options = {}) {
             valueSchema: chatWebhookUrlSchema(webhookTarget),
         });
         const channel = createDiscordChannel(options, webhooks.keyFor);
+        r.translations({ keys: { "delivery.channel.discord": { en: "Discord" } } });
         r.useExtension(DELIVERY_CHANNEL_EXTENSION, "discord", {
             mode: channel.mode,
             send: channel.send,

package/dist/channel-email/feature.js

@@ -11,6 +11,7 @@ export function createChannelEmailFeature(options) {
             recommended: false,
         });
         r.requires("delivery");
+        r.translations({ keys: { "delivery.channel.email": { en: "Email" } } });
         r.useExtension(DELIVERY_CHANNEL_EXTENSION, "email", {
             mode: channel.mode,
             resolve: channel.resolve,

package/dist/channel-in-app/feature.js

@@ -19,6 +19,7 @@ export function createChannelInAppFeature() {
             reason: "read_side.in_app_messages",
         });
         // Register as delivery channel via extension system
+        r.translations({ keys: { "delivery.channel.inApp": { en: "In-app" } } });
         r.useExtension(DELIVERY_CHANNEL_EXTENSION, "inApp", {
             mode: inAppChannel.mode,
             resolve: inAppChannel.resolve,

package/dist/channel-push/feature.js

@@ -11,6 +11,7 @@ export function createChannelPushFeature(options) {
             recommended: false,
         });
         r.requires("delivery");
+        r.translations({ keys: { "delivery.channel.push": { en: "Push" } } });
         r.useExtension(DELIVERY_CHANNEL_EXTENSION, "push", {
             mode: channel.mode,
             resolve: channel.resolve,

package/dist/channel-slack/feature.js

@@ -24,6 +24,7 @@ export function createChannelSlackFeature(options = {}) {
             valueSchema: chatWebhookUrlSchema(webhookTarget),
         });
         const channel = createSlackChannel(options, webhooks.keyFor);
+        r.translations({ keys: { "delivery.channel.slack": { en: "Slack" } } });
         r.useExtension(DELIVERY_CHANNEL_EXTENSION, "slack", {
             mode: channel.mode,
             send: channel.send,

package/dist/channel-teams/feature.js

@@ -28,6 +28,7 @@ export function createChannelTeamsFeature(options = {}) {
             valueSchema: chatWebhookUrlSchema(webhookTarget),
         });
         const channel = createTeamsChannel(options, webhooks.keyFor);
+        r.translations({ keys: { "delivery.channel.teams": { en: "Microsoft Teams" } } });
         r.useExtension(DELIVERY_CHANNEL_EXTENSION, "teams", {
             mode: channel.mode,
             send: channel.send,

package/dist/channel-teams/teams-channel.d.ts

@@ -1,4 +1,4 @@
-import { type ChatWebhookChannelOptions, type DeliveryChannel } from "../delivery/index.js";
+import { type ChatSendResult, type ChatWebhookChannelOptions, type ChatWebhookResponse, type DeliveryChannel } from "../delivery/index.js";
 export type TeamsChannelOptions = ChatWebhookChannelOptions;
 export declare const TEAMS_SECRET_KEYS: {
     readonly webhookPrefix: "channel-teams:webhooks.";
@@ -6,4 +6,5 @@ export declare const TEAMS_SECRET_KEYS: {
 };
 export declare const TEAMS_DEFAULT_ALLOWED_HOSTS: readonly [".webhook.office.com", ".logic.azure.com", ".powerplatform.com"];
 export declare function buildTeamsAdaptiveCard(title: string, body: string | undefined): unknown;
+export declare function classifyTeamsResponse(response: ChatWebhookResponse): Promise<ChatSendResult>;
 export declare function createTeamsChannel(options: TeamsChannelOptions, keyFor: (connection: string) => string): DeliveryChannel;

package/dist/channel-teams/teams-channel.js

@@ -30,12 +30,24 @@ export function buildTeamsAdaptiveCard(title, body) {
         ],
     };
 }
+// Classic Office connectors answer 200 with the body "1". Workflow endpoints answer
+// 202 and never say whether the card reached the channel. Any other 2xx (an empty
+// 200 is what a made-up URL returns) is not a Teams success.
+export async function classifyTeamsResponse(response) {
+    if (response.status === 202)
+        return { ok: true, confirmed: false };
+    if (response.status === 200 && (await response.readBodyPrefix()).trim() === "1") {
+        return { ok: true, confirmed: true };
+    }
+    return { ok: false, code: "unexpected_response" };
+}
 export function createTeamsChannel(options, keyFor) {
     return createChatWebhookChannel({
         name: "teams",
         featureName: "channel-teams",
         defaultAllowedHosts: TEAMS_DEFAULT_ALLOWED_HOSTS,
         keyFor,
+        classifyResponse: classifyTeamsResponse,
         buildBody: (message) => buildTeamsAdaptiveCard(message.title, message.body),
         options,
     });

package/dist/channel-telegram/feature.js

@@ -22,6 +22,7 @@ export function createChannelTelegramFeature(options = {}) {
             valueSchema: z.string().refine(isTelegramBotToken, "invalid bot token"),
         });
         const channel = createTelegramChannel(options, botToken.name);
+        r.translations({ keys: { "delivery.channel.telegram": { en: "Telegram" } } });
         r.useExtension(DELIVERY_CHANNEL_EXTENSION, "telegram", {
             mode: channel.mode,
             send: channel.send,

package/dist/delivery/chat-webhook-channel.d.ts

@@ -1,4 +1,4 @@
-import { type ChatSendResult, type ChatWebhookTarget } from "./chat-webhook-sender.js";
+import { type ChatSendResult, type ChatWebhookRequest, type ChatWebhookTarget } from "./chat-webhook-sender.js";
 import type { ChannelMessage, ChannelResult, DeliveryChannel } from "./types.js";
 export type ChatWebhookChannelOptions = {
     readonly allowedHosts?: readonly string[];
@@ -18,6 +18,7 @@ export type ChatWebhookChannelSpec = {
     readonly requiredPathPrefix?: string;
     readonly keyFor: (connection: string) => string;
     readonly buildBody: (message: ChannelMessage) => unknown;
+    readonly classifyResponse?: ChatWebhookRequest["classifyResponse"];
     readonly options: ChatWebhookChannelOptions;
 };
 export declare function createChatWebhookChannel(spec: ChatWebhookChannelSpec): DeliveryChannel;

package/dist/delivery/chat-webhook-channel.js

@@ -1,9 +1,11 @@
 import { SYSTEM_USER_ID } from "@cosmicdrift/kumiko-types/identifiers";
 import { chatConnectionNameSchema, DEFAULT_CHAT_TIMEOUT_MS, postChatWebhook, } from "./chat-webhook-sender.js";
 export function toChannelResult(address, result) {
-    return result.ok
+    if (!result.ok)
+        return { status: "failed", error: result.code, address };
+    return result.confirmed
         ? { status: "sent", address }
-        : { status: "failed", error: result.code, address };
+        : { status: "sent", confirmed: false, address };
 }
 export function chatMessageText(message) {
     return message.body ? `${message.title}\n${message.body}` : message.title;
@@ -46,6 +48,7 @@ export function createChatWebhookChannel(spec) {
                 ...resolveChatWebhookTarget(spec, options),
                 timeoutMs: options.timeoutMs ?? DEFAULT_CHAT_TIMEOUT_MS,
                 body: spec.buildBody(message),
+                ...(spec.classifyResponse && { classifyResponse: spec.classifyResponse }),
             });
             return toChannelResult(address, result);
         },

package/dist/delivery/chat-webhook-sender.d.ts

@@ -1,11 +1,17 @@
+import type { ChatSendFailureCode } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-export type ChatSendFailureCode = `http_${number}` | "timeout" | "network_error" | "redirect_blocked" | "host_not_allowed" | "missing_credentials" | "invalid_address";
+export type { ChatSendFailureCode };
 export type ChatSendResult = {
     readonly ok: true;
+    readonly confirmed: boolean;
 } | {
     readonly ok: false;
     readonly code: ChatSendFailureCode;
 };
+export type ChatWebhookResponse = {
+    readonly status: number;
+    readBodyPrefix(): Promise<string>;
+};
 export declare const DEFAULT_CHAT_TIMEOUT_MS = 10000;
 export declare const chatConnectionNameSchema: z.ZodString;
 export type ChatWebhookTarget = {
@@ -18,6 +24,7 @@ export type ChatWebhookRequest = ChatWebhookTarget & {
     readonly timeoutMs: number;
     readonly body: unknown;
     readonly send?: (url: string, init: RequestInit) => Promise<Response>;
+    readonly classifyResponse?: (response: ChatWebhookResponse) => Promise<ChatSendResult>;
 };
 export declare function checkChatWebhookTarget(target: ChatWebhookTarget, url: string): URL | undefined;
 export declare function chatWebhookUrlSchema(target: ChatWebhookTarget): z.ZodType<string>;

package/dist/delivery/chat-webhook-sender.js

@@ -1,5 +1,6 @@
 import { BlockedHostError, egress } from "@cosmicdrift/kumiko-framework/http";
 import * as z from "zod";
+const MAX_BODY_PREFIX_BYTES = 64;
 export const DEFAULT_CHAT_TIMEOUT_MS = 10_000;
 // Tenant-chosen connection name (the route address for webhook channels). Also
 // the suffix the secrets write gate accepts under the channel's namespace, so
@@ -92,15 +93,55 @@ export async function postChatWebhook(request) {
     catch (err) {
         return { ok: false, code: classifyFailure(err) };
     }
-    // Free the connection; the body is never read or stored.
-    await response.body?.cancel().catch(() => undefined);
     const { status } = response;
-    if (status >= 300 && status < 400)
+    if (status >= 300 && status < 400) {
+        await response.body?.cancel().catch(() => undefined);
         return { ok: false, code: "redirect_blocked" };
+    }
     if (status >= 200 && status < 300)
-        return { ok: true };
+        return classifySuccess(request, response);
+    await response.body?.cancel().catch(() => undefined);
     return { ok: false, code: `http_${status}` };
 }
+// The body is cancelled afterwards in every case, even when the classifier throws,
+// so the connection is freed and a large body is never read to the end.
+async function classifySuccess(request, response) {
+    let reader;
+    try {
+        if (!request.classifyResponse)
+            return { ok: true, confirmed: true };
+        return await request.classifyResponse({
+            status: response.status,
+            async readBodyPrefix() {
+                reader ??= response.body?.getReader();
+                if (!reader)
+                    return "";
+                const chunks = [];
+                let total = 0;
+                while (total < MAX_BODY_PREFIX_BYTES) {
+                    const { done, value } = await reader.read();
+                    if (done)
+                        break;
+                    chunks.push(value);
+                    total += value.length;
+                }
+                const joined = new Uint8Array(total);
+                let offset = 0;
+                for (const chunk of chunks) {
+                    joined.set(chunk, offset);
+                    offset += chunk.length;
+                }
+                return new TextDecoder().decode(joined.subarray(0, MAX_BODY_PREFIX_BYTES));
+            },
+        });
+    }
+    catch (err) {
+        return { ok: false, code: classifyFailure(err) };
+    }
+    finally {
+        await (reader ? reader.cancel() : response.body?.cancel())?.catch(() => undefined);
+    }
+}
 export function truncateChars(text, maxChars) {
     const chars = Array.from(text);
     return chars.length <= maxChars ? text : chars.slice(0, maxChars).join("");

package/dist/delivery/constants.d.ts

@@ -1,6 +1,6 @@
 import type { NotifyPriority } from "@cosmicdrift/kumiko-framework/engine";
 export declare const DELIVERY_CHANNEL_EXTENSION: "deliveryChannel";
-export { DELIVERY_ATTEMPT_EVENT, DELIVERY_FEATURE, DELIVERY_LOG_SCREEN_ID, DELIVERY_RESUBSCRIBE_PATH, DELIVERY_STATUS_CELL_COMPONENT, DELIVERY_UNSUBSCRIBE_PATH, DeliveryErrors, DeliveryHandlers, DeliveryJobNames, DeliveryQueries, DeliveryStatus, type DeliveryStatusValue, } from "./public-names.js";
+export { DELIVERY_ATTEMPT_EVENT, DELIVERY_CHANNEL_CELL_COMPONENT, DELIVERY_ERROR_CELL_COMPONENT, DELIVERY_FEATURE, DELIVERY_LOG_SCREEN_ID, DELIVERY_RESUBSCRIBE_PATH, DELIVERY_STATUS_CELL_COMPONENT, DELIVERY_TIME_CELL_COMPONENT, DELIVERY_TYPE_CELL_COMPONENT, DELIVERY_UNSUBSCRIBE_PATH, DeliveryErrors, DeliveryHandlers, DeliveryJobNames, DeliveryQueries, DeliveryStatus, type DeliveryStatusValue, } from "./public-names.js";
 export declare const deliveryPriorityRank: Record<NotifyPriority, number>;
 export declare const DeliveryJobs: {
     readonly render: string;