@cosmicdrift/kumiko-samples 0.342.0 → 0.344.0

package/packages/bundled-features/src/billing-foundation/web/index.ts

@@ -13,11 +13,23 @@ export {
   type SubscriptionStatus,
   SubscriptionStatuses,
 } from "../constants.js";
+export {
+  CONSENT_LOCALES,
+  type ConsentLocale,
+  resolveConsentLocale,
+} from "../consumer-protection/consent-locale.js";
 export type {
   BillingPlanBenefit,
   BillingPlanCatalog,
   BillingPlansResult,
   BillingPlanView,
+  LegalLinkSet,
 } from "../types.js";
 export { BillingPlansPanel } from "./billing-plans-panel.js";
+export {
+  CheckoutConsentDialog,
+  type CheckoutConsentDialogProps,
+  type CheckoutConsentPayload,
+  CONSENT_TEXT_OUTDATED_CODE,
+} from "./checkout-consent-dialog.js";
 export { type BillingFoundationClientOptions, billingFoundationClient } from "./client-plugin.js";

package/packages/bundled-features/src/channel-discord/feature.ts

@@ -47,6 +47,7 @@ export function createChannelDiscordFeature(
     });
 
     const channel = createDiscordChannel(options, webhooks.keyFor);
+    r.translations({ keys: { "delivery.channel.discord": { en: "Discord" } } });
     r.useExtension(DELIVERY_CHANNEL_EXTENSION, "discord", {
       mode: channel.mode,
       send: channel.send,

package/packages/bundled-features/src/channel-email/feature.ts

@@ -16,6 +16,7 @@ export function createChannelEmailFeature(options: EmailChannelOptions): Feature
     });
     r.requires("delivery");
 
+    r.translations({ keys: { "delivery.channel.email": { en: "Email" } } });
     r.useExtension(DELIVERY_CHANNEL_EXTENSION, "email", {
       mode: channel.mode,
       resolve: channel.resolve,

package/packages/bundled-features/src/channel-in-app/feature.ts

@@ -24,6 +24,7 @@ export function createChannelInAppFeature(): FeatureDefinition {
     });
 
     // Register as delivery channel via extension system
+    r.translations({ keys: { "delivery.channel.inApp": { en: "In-app" } } });
     r.useExtension(DELIVERY_CHANNEL_EXTENSION, "inApp", {
       mode: inAppChannel.mode,
       resolve: inAppChannel.resolve,

package/packages/bundled-features/src/channel-push/feature.ts

@@ -16,6 +16,7 @@ export function createChannelPushFeature(options: PushChannelOptions): FeatureDe
     });
     r.requires("delivery");
 
+    r.translations({ keys: { "delivery.channel.push": { en: "Push" } } });
     r.useExtension(DELIVERY_CHANNEL_EXTENSION, "push", {
       mode: channel.mode,
       resolve: channel.resolve,

package/packages/bundled-features/src/channel-slack/feature.ts

@@ -41,6 +41,7 @@ export function createChannelSlackFeature(options: SlackChannelOptions = {}): Fe
     });
 
     const channel = createSlackChannel(options, webhooks.keyFor);
+    r.translations({ keys: { "delivery.channel.slack": { en: "Slack" } } });
     r.useExtension(DELIVERY_CHANNEL_EXTENSION, "slack", {
       mode: channel.mode,
       send: channel.send,

package/packages/bundled-features/src/channel-teams/changes.json

@@ -0,0 +1,8 @@
+[
+  {
+    "version": "0.343.0",
+    "type": "fix",
+    "title": "Teams no longer reports any 2xx as delivered",
+    "detail": "`channel-teams` no longer reports every 2xx answer as sent. A 200 with the body `1` (classic Office connector) is a confirmed send. A 202 (Power Automate / Workflows endpoints) means the message was accepted but not confirmed: the attempt is `sent` and `NotifyResult.deliveries[].confirmed` is `false`. Any other 2xx, including an empty 200 as a made-up URL returns, fails with `unexpected_response`.\n`NotifyDelivery.confirmed` and `ChannelResult.confirmed` are new and only ever `false`. `createChatWebhookChannel` takes an optional `classifyResponse`, which `postChatWebhook` calls for 2xx answers with a status and a lazy `readBodyPrefix()` (at most 64 bytes; the body is always cancelled afterwards). `ChatSendResult` success now carries `confirmed`. `confirmed` is returned for inline delivery only; jobs do not carry it yet."
+  }
+]

package/packages/bundled-features/src/channel-teams/feature.ts

@@ -45,6 +45,7 @@ export function createChannelTeamsFeature(options: TeamsChannelOptions = {}): Fe
     });
 
     const channel = createTeamsChannel(options, webhooks.keyFor);
+    r.translations({ keys: { "delivery.channel.teams": { en: "Microsoft Teams" } } });
     r.useExtension(DELIVERY_CHANNEL_EXTENSION, "teams", {
       mode: channel.mode,
       send: channel.send,

package/packages/bundled-features/src/channel-teams/teams-channel.ts

@@ -1,5 +1,7 @@
 import {
+  type ChatSendResult,
   type ChatWebhookChannelOptions,
+  type ChatWebhookResponse,
   createChatWebhookChannel,
   type DeliveryChannel,
 } from "../delivery/index.js";
@@ -40,6 +42,19 @@ export function buildTeamsAdaptiveCard(title: string, body: string | undefined):
   };
 }
 
+// Classic Office connectors answer 200 with the body "1". Workflow endpoints answer
+// 202 and never say whether the card reached the channel. Any other 2xx (an empty
+// 200 is what a made-up URL returns) is not a Teams success.
+export async function classifyTeamsResponse(
+  response: ChatWebhookResponse,
+): Promise<ChatSendResult> {
+  if (response.status === 202) return { ok: true, confirmed: false };
+  if (response.status === 200 && (await response.readBodyPrefix()).trim() === "1") {
+    return { ok: true, confirmed: true };
+  }
+  return { ok: false, code: "unexpected_response" };
+}
+
 export function createTeamsChannel(
   options: TeamsChannelOptions,
   keyFor: (connection: string) => string,
@@ -49,6 +64,7 @@ export function createTeamsChannel(
     featureName: "channel-teams",
     defaultAllowedHosts: TEAMS_DEFAULT_ALLOWED_HOSTS,
     keyFor,
+    classifyResponse: classifyTeamsResponse,
     buildBody: (message) => buildTeamsAdaptiveCard(message.title, message.body),
     options,
   });

package/packages/bundled-features/src/channel-telegram/feature.ts

@@ -33,6 +33,7 @@ export function createChannelTelegramFeature(
     });
 
     const channel = createTelegramChannel(options, botToken.name);
+    r.translations({ keys: { "delivery.channel.telegram": { en: "Telegram" } } });
     r.useExtension(DELIVERY_CHANNEL_EXTENSION, "telegram", {
       mode: channel.mode,
       send: channel.send,

package/packages/bundled-features/src/delivery/changes.json

@@ -1,4 +1,36 @@
 [
+  {
+    "version": "0.343.0",
+    "type": "improvement",
+    "title": "Delivery log marks sends the provider did not confirm",
+    "detail": "The delivery log now records when a provider accepted a send without confirming delivery (for example a Teams webhook answering 202). `store_delivery_attempts` gets a nullable boolean column `confirmed`: `false` means accepted but unconfirmed, `null` means confirmed or not applicable. The `deliveryAttempt` event carries `confirmed: false` on both the inline and the job path, `delivery:query:log` returns `confirmed` per row, and the status cell shows \"Sent (unconfirmed)\" for such rows.",
+    "migration": "New nullable column store_delivery_attempts.confirmed. Consumers generate the migration with the generator (kumiko-schema generate) and apply it; existing rows stay null."
+  },
+  {
+    "version": "0.343.0",
+    "type": "breaking",
+    "title": "Delivery errors are fixed codes instead of raw messages",
+    "detail": "Delivery stores and returns only fixed error codes, never raw error messages. `delivery_attempts.error`, the `deliveryAttempt` event, `NotifyResult.deliveries[].error` and the job failure now hold one of `DELIVERY_FAILURE_CODES` (`timeout`, `network_error`, `redirect_blocked`, `host_not_allowed`, `missing_credentials`, `invalid_address`, `unexpected_response`, `render_failed`, `send_failed`, `channel_error`), one of `DELIVERY_SKIP_REASONS`, or `http_<status>`. A throwing channel ends as `send_failed` or `render_failed`; a failure around resolve or dispatch ends as `channel_error`. The full error goes to the log with URLs and email addresses redacted. `redactUrls` and `redactErrorText` are new next to `redactEmailAddresses`, which moved out of the step dispatcher.\n`@cosmicdrift/kumiko-framework/engine` exports `DELIVERY_FAILURE_CODES`, `DELIVERY_SKIP_REASONS`, `isDeliveryErrorCode` and the types `DeliveryErrorCode`, `DeliveryFailureCode`, `DeliverySkipReason` and `ChatSendFailureCode`. `NotifyDelivery.error`, `ChannelResult.error` and `DeliveryLogEntry.error` are now `DeliveryErrorCode`. `delivery:query:log` returns `channel_error` for stored rows that still hold free text.",
+    "migration": "NotifyDelivery.error is now a DeliveryErrorCode. Code that matches on error text must match the code instead (for example send_failed). Custom channels must return a DeliveryErrorCode in ChannelResult.error. Existing attempt events keep their free text; reading them through delivery:query:log masks it as channel_error."
+  },
+  {
+    "version": "0.343.0",
+    "type": "improvement",
+    "title": "Delivery log shows time and error and translates its values",
+    "detail": "The delivery log screen shows the time and the error of each attempt and translates type, channel, status and error. Error codes map to `delivery.error.<code>` (`http_<status>` to `delivery.error.http` with a `status` parameter), statuses to `delivery.status.<status>`, channels to `delivery.channel.<name>`. Every bundled channel feature registers its own channel label. Notification types are shown through `<scope>.notification.<name>` for a type `<scope>:notify:<name>`; apps register those labels, and the short name is shown when none exists. English, German and Spanish texts are included for the bundled keys.\n`translateOrRaw` moved from the tenant web folder to `shared/web`; it is internal."
+  },
+  {
+    "version": "0.343.0",
+    "type": "improvement",
+    "title": "Delivery log shows the recipient name",
+    "detail": "`delivery:query:log` returns a `recipientLabel` per row and the delivery log screen shows it in the recipient column: the user's display name, else the decrypted address, else the recipient id. Names are resolved with one batched lookup per page, and only when the user feature is mounted. The new `resolveUserDisplayNames(db, userIds)` is exported from the user feature. The recipient column is not sortable."
+  },
+  {
+    "version": "0.343.0",
+    "type": "improvement",
+    "title": "createDeliveryTestContext matches production notify",
+    "detail": "`createDeliveryTestContext` now behaves like the production `ctx.notify`. It takes a `secrets` option for inline-delivered chat channels and passes the calling context's job dispatcher to `notify()` on every call. Queued channels now go through the delivery jobs when the stack has a job consumer (`jobs: { consumerLane: \"worker\" }`); call `stack.drainJobs()` before asserting on the result. With `jobs: {}` and no `consumerLane` the attempts stay queued and `drainJobs()` never finishes. Without `jobs` they still deliver inline.\nNew export `createDeliveryNotifyFactory(deliveryService, { deliverQueuedInline? })` builds this `NotifyFactory` for custom setups."
+  },
   {
     "version": "0.341.0",
     "type": "breaking",

package/packages/bundled-features/src/delivery/chat-webhook-channel.ts

@@ -1,6 +1,7 @@
 import { SYSTEM_USER_ID } from "@cosmicdrift/kumiko-types/identifiers";
 import {
   type ChatSendResult,
+  type ChatWebhookRequest,
   type ChatWebhookTarget,
   chatConnectionNameSchema,
   DEFAULT_CHAT_TIMEOUT_MS,
@@ -17,9 +18,10 @@ export type ChatWebhookChannelOptions = {
 };
 
 export function toChannelResult(address: string, result: ChatSendResult): ChannelResult {
-  return result.ok
+  if (!result.ok) return { status: "failed", error: result.code, address };
+  return result.confirmed
     ? { status: "sent", address }
-    : { status: "failed", error: result.code, address };
+    : { status: "sent", confirmed: false, address };
 }
 
 export function chatMessageText(message: ChannelMessage): string {
@@ -50,6 +52,8 @@ export type ChatWebhookChannelSpec = {
   // Resolves the secret key for a validated connection name.
   readonly keyFor: (connection: string) => string;
   readonly buildBody: (message: ChannelMessage) => unknown;
+  // Providers whose 2xx does not by itself mean "delivered" check the answer here.
+  readonly classifyResponse?: ChatWebhookRequest["classifyResponse"];
   readonly options: ChatWebhookChannelOptions;
 };
 
@@ -82,6 +86,7 @@ export function createChatWebhookChannel(spec: ChatWebhookChannelSpec): Delivery
         ...resolveChatWebhookTarget(spec, options),
         timeoutMs: options.timeoutMs ?? DEFAULT_CHAT_TIMEOUT_MS,
         body: spec.buildBody(message),
+        ...(spec.classifyResponse && { classifyResponse: spec.classifyResponse }),
       });
       return toChannelResult(address, result);
     },

package/packages/bundled-features/src/delivery/chat-webhook-sender.ts

@@ -1,22 +1,27 @@
+import type { ChatSendFailureCode } from "@cosmicdrift/kumiko-framework/engine";
 import { BlockedHostError, type EgressPolicy, egress } from "@cosmicdrift/kumiko-framework/http";
 import * as z from "zod";
 
 // Closed vocabulary: these codes (and nothing else) land in delivery_attempts.error.
 // Never err.message and never a provider response body — a fetch error can carry
 // the request URL, and the Telegram URL embeds the bot token.
-export type ChatSendFailureCode =
-  | `http_${number}`
-  | "timeout"
-  | "network_error"
-  | "redirect_blocked"
-  | "host_not_allowed"
-  | "missing_credentials"
-  | "invalid_address";
+export type { ChatSendFailureCode };
 
+// confirmed=false: the provider accepted the request but does not say whether the
+// message arrived (e.g. a 202 from a workflow endpoint).
 export type ChatSendResult =
-  | { readonly ok: true }
+  | { readonly ok: true; readonly confirmed: boolean }
   | { readonly ok: false; readonly code: ChatSendFailureCode };
 
+// What a classifier may look at on a 2xx answer. The body is never stored or logged.
+export type ChatWebhookResponse = {
+  readonly status: number;
+  // At most 64 bytes, UTF-8 decoded.
+  readBodyPrefix(): Promise<string>;
+};
+
+const MAX_BODY_PREFIX_BYTES = 64;
+
 export const DEFAULT_CHAT_TIMEOUT_MS = 10_000;
 
 // Tenant-chosen connection name (the route address for webhook channels). Also
@@ -41,6 +46,8 @@ export type ChatWebhookRequest = ChatWebhookTarget & {
   readonly body: unknown;
   // Test seam; production always uses the policy-bound egress().
   readonly send?: (url: string, init: RequestInit) => Promise<Response>;
+  // Called for 2xx answers only. Default: every 2xx is a confirmed send.
+  readonly classifyResponse?: (response: ChatWebhookResponse) => Promise<ChatSendResult>;
 };
 
 // https targets are provider endpoints on public hosts: egress "external" adds
@@ -129,15 +136,54 @@ export async function postChatWebhook(request: ChatWebhookRequest): Promise<Chat
     return { ok: false, code: classifyFailure(err) };
   }
 
-  // Free the connection; the body is never read or stored.
-  await response.body?.cancel().catch(() => undefined);
-
   const { status } = response;
-  if (status >= 300 && status < 400) return { ok: false, code: "redirect_blocked" };
-  if (status >= 200 && status < 300) return { ok: true };
+  if (status >= 300 && status < 400) {
+    await response.body?.cancel().catch(() => undefined);
+    return { ok: false, code: "redirect_blocked" };
+  }
+  if (status >= 200 && status < 300) return classifySuccess(request, response);
+  await response.body?.cancel().catch(() => undefined);
   return { ok: false, code: `http_${status}` };
 }
 
+// The body is cancelled afterwards in every case, even when the classifier throws,
+// so the connection is freed and a large body is never read to the end.
+async function classifySuccess(
+  request: ChatWebhookRequest,
+  response: Response,
+): Promise<ChatSendResult> {
+  let reader: ReadableStreamDefaultReader<Uint8Array> | undefined;
+  try {
+    if (!request.classifyResponse) return { ok: true, confirmed: true };
+    return await request.classifyResponse({
+      status: response.status,
+      async readBodyPrefix() {
+        reader ??= response.body?.getReader();
+        if (!reader) return "";
+        const chunks: Uint8Array[] = [];
+        let total = 0;
+        while (total < MAX_BODY_PREFIX_BYTES) {
+          const { done, value } = await reader.read();
+          if (done) break;
+          chunks.push(value);
+          total += value.length;
+        }
+        const joined = new Uint8Array(total);
+        let offset = 0;
+        for (const chunk of chunks) {
+          joined.set(chunk, offset);
+          offset += chunk.length;
+        }
+        return new TextDecoder().decode(joined.subarray(0, MAX_BODY_PREFIX_BYTES));
+      },
+    });
+  } catch (err) {
+    return { ok: false, code: classifyFailure(err) };
+  } finally {
+    await (reader ? reader.cancel() : response.body?.cancel())?.catch(() => undefined);
+  }
+}
+
 export function truncateChars(text: string, maxChars: number): string {
   const chars = Array.from(text);
   return chars.length <= maxChars ? text : chars.slice(0, maxChars).join("");

package/packages/bundled-features/src/delivery/constants.ts

@@ -8,10 +8,14 @@ export const DELIVERY_CHANNEL_EXTENSION = "deliveryChannel" as const;
 
 export {
   DELIVERY_ATTEMPT_EVENT,
+  DELIVERY_CHANNEL_CELL_COMPONENT,
+  DELIVERY_ERROR_CELL_COMPONENT,
   DELIVERY_FEATURE,
   DELIVERY_LOG_SCREEN_ID,
   DELIVERY_RESUBSCRIBE_PATH,
   DELIVERY_STATUS_CELL_COMPONENT,
+  DELIVERY_TIME_CELL_COMPONENT,
+  DELIVERY_TYPE_CELL_COMPONENT,
   DELIVERY_UNSUBSCRIBE_PATH,
   DeliveryErrors,
   DeliveryHandlers,

package/packages/bundled-features/src/delivery/delivery-service.ts

@@ -2,6 +2,7 @@ import type { SseBroker } from "@cosmicdrift/kumiko-framework/api";
 import type { DbConnection, DbRow } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemDbView, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
 import type {
+  DeliveryErrorCode,
   EscapeHatchAuditSink,
   NotifyDelivery,
   NotifyJobDispatcher,
@@ -10,12 +11,13 @@ import type {
   TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { createSystemUser } from "@cosmicdrift/kumiko-framework/engine";
-import type { Logger } from "@cosmicdrift/kumiko-framework/logging";
+import { createFallbackLogger, type Logger } from "@cosmicdrift/kumiko-framework/logging";
 import { createEscapeHatchReporter } from "@cosmicdrift/kumiko-framework/pipeline";
 import type { SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
 import { bridgeStub } from "@cosmicdrift/kumiko-framework/testing/handler-context";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
 import type { Redis } from "ioredis";
+import { redactErrorText } from "../shared/index.js";
 import { hashUnsubscribeAddress } from "./address-opt-out.js";
 import { appendAttemptEvent, logAttempt } from "./attempt-log.js";
 import { buildChannelContext } from "./channel-context.js";
@@ -25,12 +27,18 @@ import { selectNotificationPreferences } from "./db/queries/preferences.js";
 import {
   type ChannelContext,
   type ChannelMessage,
+  type ChannelResult,
   type DeliveryChannel,
   type DeliveryLogEntry,
   type DeliveryService,
   isDeliveryChannelPlugin,
+  type RenderedMessage,
 } from "./types.js";
 
+export function redactedMessageOf(err: unknown): string {
+  return redactErrorText(err instanceof Error ? err.message : String(err));
+}
+
 export type RateLimitConfig = {
   readonly redis: Redis;
   readonly maxPerHour: number; // per channel per tenant
@@ -99,6 +107,7 @@ export function createDeliveryService(options: DeliveryServiceOptions): Delivery
     log,
   } = options;
   const idemRedis = idempotencyRedis ?? rateLimit?.redis;
+  const logError = createFallbackLogger("delivery", log);
 
   // Rate limit check: atomic INCR + TTL + over-limit rollback via server-side
   // Lua. Runs single-threaded in Redis, so two parallel clients can't both
@@ -232,6 +241,7 @@ export function createDeliveryService(options: DeliveryServiceOptions): Delivery
       recipientId: entry.recipientId,
       status: entry.status,
       error: entry.error,
+      ...(entry.confirmed === false && { confirmed: entry.confirmed }),
       deliveryAttemptId,
     });
   }
@@ -244,6 +254,36 @@ export function createDeliveryService(options: DeliveryServiceOptions): Delivery
     recordDelivery(run, entry, attemptId);
   }
 
+  // The stored/returned error is only the code; the redacted message goes to the log.
+  async function logInlineFailure(
+    run: NotifyRun,
+    args: {
+      readonly channel: DeliveryChannel;
+      readonly address: string;
+      readonly tenantId: TenantId;
+      readonly recipientId: string | null;
+      readonly notificationType: string;
+      readonly priority: NotifyPriority;
+    },
+    code: DeliveryErrorCode,
+    err: unknown,
+  ): Promise<void> {
+    logError.error(`${args.channel.name} ${code}: ${redactedMessageOf(err)}`, {
+      notificationType: args.notificationType,
+      channel: args.channel.name,
+    });
+    await logDelivery(run, {
+      tenantId: args.tenantId,
+      notificationType: args.notificationType,
+      channel: args.channel.name,
+      recipientId: args.recipientId,
+      recipientAddress: args.address,
+      status: "failed",
+      error: code,
+      priority: args.priority,
+    });
+  }
+
   // Deliver one resolved (channel, address) pair. Inline channels (inApp) and
   // the no-job-runner fallback render + send synchronously and log the terminal
   // status. Queued channels (email/push) record a `queued` attempt up front and
@@ -305,8 +345,24 @@ export function createDeliveryService(options: DeliveryServiceOptions): Delivery
       recordDelivery(run, queuedEntry, deliveryAttemptId);
     } else {
       // Inline (inApp) or no-job-runner fallback: render + send synchronously.
-      const rendered = channel.render ? await channel.render(message, channelCtx) : undefined;
-      const result = await channel.send(address, message, channelCtx, rendered);
+      let rendered: RenderedMessage | undefined;
+      if (channel.render) {
+        try {
+          rendered = await channel.render(message, channelCtx);
+        } catch (err) {
+          await logInlineFailure(run, args, "render_failed", err);
+          // skip: logInlineFailure recorded and logged the failure
+          return;
+        }
+      }
+      let result: ChannelResult;
+      try {
+        result = await channel.send(address, message, channelCtx, rendered);
+      } catch (err) {
+        await logInlineFailure(run, args, "send_failed", err);
+        // skip: logInlineFailure recorded and logged the failure
+        return;
+      }
       await logDelivery(run, {
         tenantId,
         notificationType,
@@ -316,6 +372,7 @@ export function createDeliveryService(options: DeliveryServiceOptions): Delivery
         status: result.status,
         error: result.error ?? null,
         priority,
+        ...(result.confirmed === false && { confirmed: result.confirmed }),
       });
     }
   }
@@ -517,6 +574,10 @@ export function createDeliveryService(options: DeliveryServiceOptions): Delivery
           priority,
         });
       } catch (err) {
+        logError.error(`${channel.name} channel_error: ${redactedMessageOf(err)}`, {
+          notificationType,
+          channel: channel.name,
+        });
         await logDelivery(run, {
           tenantId,
           notificationType,
@@ -524,7 +585,7 @@ export function createDeliveryService(options: DeliveryServiceOptions): Delivery
           recipientId: userId,
           recipientAddress: null,
           status: "failed",
-          error: err instanceof Error ? err.message : String(err),
+          error: "channel_error",
           priority,
         });
       }
@@ -599,6 +660,10 @@ export function createDeliveryService(options: DeliveryServiceOptions): Delivery
           priority,
         });
       } catch (err) {
+        logError.error(`${channel.name} channel_error: ${redactedMessageOf(err)}`, {
+          notificationType,
+          channel: channel.name,
+        });
         await logDelivery(run, {
           tenantId,
           notificationType,
@@ -606,7 +671,7 @@ export function createDeliveryService(options: DeliveryServiceOptions): Delivery
           recipientId,
           recipientAddress: address,
           status: "failed",
-          error: err instanceof Error ? err.message : String(err),
+          error: "channel_error",
           priority,
         });
       }

package/packages/bundled-features/src/delivery/events.ts

@@ -3,6 +3,11 @@
 // delivery-service.ts (validates payloads before the low-level append()
 // — out-of-dispatcher writes otherwise skip schema enforcement).
 
+import {
+  DELIVERY_FAILURE_CODES,
+  DELIVERY_SKIP_REASONS,
+  HTTP_ERROR_CODE_PATTERN,
+} from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { DeliveryStatus } from "./constants.js";
 
@@ -17,8 +22,17 @@ export const deliveryAttemptSchema = z.object({
     DeliveryStatus.failed,
     DeliveryStatus.skipped,
   ]),
-  error: z.string().nullable(),
+  // Closed code set; z.custom would not serialize to JSON-Schema. Events written
+  // before the code vocabulary may hold free text, they are not re-validated on replay.
+  error: z
+    .union([
+      z.enum([...DELIVERY_FAILURE_CODES, ...DELIVERY_SKIP_REASONS]),
+      z.string().regex(HTTP_ERROR_CODE_PATTERN),
+    ])
+    .nullable(),
   priority: z.enum(["critical", "normal", "low"]),
+  // Provider accepted the request but does not confirm delivery (e.g. Teams 202).
+  confirmed: z.literal(false).optional(),
 });
 
 export type DeliveryAttemptPayload = z.infer<typeof deliveryAttemptSchema>;

package/packages/bundled-features/src/delivery/feature.ts

@@ -8,9 +8,13 @@ import {
 import type * as z from "zod";
 import {
   DELIVERY_ATTEMPT_EVENT,
+  DELIVERY_CHANNEL_CELL_COMPONENT,
   DELIVERY_CHANNEL_EXTENSION,
+  DELIVERY_ERROR_CELL_COMPONENT,
   DELIVERY_LOG_SCREEN_ID,
   DELIVERY_STATUS_CELL_COMPONENT,
+  DELIVERY_TIME_CELL_COMPONENT,
+  DELIVERY_TYPE_CELL_COMPONENT,
   DeliveryJobNames,
   DeliveryQueries,
 } from "./constants.js";
@@ -118,8 +122,14 @@ export function createDeliveryFeature(options?: DeliveryFeatureOptions): Feature
               status: p.status,
               error: p.error,
               priority: p.priority,
+              confirmed: p.confirmed ?? null,
+            },
+            {
+              status: p.status,
+              error: p.error,
+              recipientAddress: p.recipientAddress,
+              confirmed: p.confirmed ?? null,
             },
-            { status: p.status, error: p.error, recipientAddress: p.recipientAddress },
           );
         },
       },
@@ -168,20 +178,38 @@ export function createDeliveryFeature(options?: DeliveryFeatureOptions): Feature
       type: "projectionList",
       query: DeliveryQueries.log,
       columns: [
+        {
+          field: "createdAt",
+          label: i18nKey("delivery.log.col.createdAt"),
+          renderer: { react: { __component: DELIVERY_TIME_CELL_COMPONENT } },
+        },
         {
           field: "tenantId",
           label: i18nKey("delivery.log.col.tenantId"),
           refEntity: "tenant:tenant",
           refLabelField: "name",
         },
-        { field: "type", label: i18nKey("delivery.log.col.type") },
-        { field: "channel", label: i18nKey("delivery.log.col.channel") },
-        { field: "recipient", label: i18nKey("delivery.log.col.recipient") },
+        {
+          field: "type",
+          label: i18nKey("delivery.log.col.type"),
+          renderer: { react: { __component: DELIVERY_TYPE_CELL_COMPONENT } },
+        },
+        {
+          field: "channel",
+          label: i18nKey("delivery.log.col.channel"),
+          renderer: { react: { __component: DELIVERY_CHANNEL_CELL_COMPONENT } },
+        },
+        { field: "recipientLabel", label: i18nKey("delivery.log.col.recipient") },
         {
           field: "status",
           label: i18nKey("delivery.log.col.status"),
           renderer: { react: { __component: DELIVERY_STATUS_CELL_COMPONENT } },
         },
+        {
+          field: "error",
+          label: i18nKey("delivery.log.col.error"),
+          renderer: { react: { __component: DELIVERY_ERROR_CELL_COMPONENT } },
+        },
       ],
       // Cursor-based paging: deliveryAttemptsTable's id is an event-stream
       // aggregate id (not a sequential PK), so the "pages" default (offset +