@cosmicdrift/kumiko-samples 0.342.0 → 0.344.0

package/packages/bundled-features/src/delivery/handlers/log.query.ts

@@ -1,15 +1,25 @@
 import { selectMany, type WhereObject } from "@cosmicdrift/kumiko-framework/bun-db";
-import { decodeKeysetCursor, encodeKeysetCursor } from "@cosmicdrift/kumiko-framework/db";
+import {
+  decodeKeysetCursor,
+  encodeKeysetCursor,
+  type TenantDb,
+} from "@cosmicdrift/kumiko-framework/db";
 import {
   access,
+  type DeliveryErrorCode,
   definePagedQueryHandler,
+  isDeliveryErrorCode,
+  isUuid,
   MAX_LIST_LIMIT,
   type NotifyPriority,
+  type Registry,
+  SYSTEM_USER_ID,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { Temporal } from "temporal-polyfill";
 import * as z from "zod";
 import { decryptStoredPii } from "../../shared/index.js";
+import { resolveUserDisplayNames, USER_FEATURE } from "../../user/index.js";
 import type { DeliveryStatusValue } from "../constants.js";
 import { deliveryAttemptsTable } from "../tables.js";
 
@@ -21,17 +31,25 @@ type DeliveryLogRow = {
   recipientId: string | null;
   recipientAddress: string | null;
   status: DeliveryStatusValue;
+  // Legacy rows may hold free text; the handler masks those on the way out.
   error: string | null;
   priority: NotifyPriority;
+  confirmed: boolean | null;
   createdAt: Temporal.Instant;
 };
 
+function toClientError(stored: string | null): DeliveryErrorCode | null {
+  if (stored === null) return null;
+  return isDeliveryErrorCode(stored) ? stored : "channel_error";
+}
+
 // Sort whitelist keyed by the DISPLAY field the client actually sends: the
 // declarative projectionList renderer marks every listed column uniformly
 // sortable and a header click sends `sort=<screen.columns[].field>`, not the
 // DB column name (see projection-list-shim.ts synthesizeProjectionEntity).
-// "recipient" is deliberately absent — it's PII decrypted per-row in
-// application code, so there is no column to ORDER BY in SQL for it.
+// "recipient" is deliberately absent — it's PII (name or decrypted address)
+// resolved in application code, so there is no column to ORDER BY in SQL for it.
+// A click on such a header sends an unlisted sort value and falls back to createdAt.
 const DELIVERY_LOG_SORT_COLUMNS = {
   createdAt: "createdAt",
   tenantId: "tenantId",
@@ -67,6 +85,48 @@ function decodeSortCursor(column: DeliveryLogSortColumn, cursor: string): Decode
   return { sortValue, lastId: decoded.sortValue === undefined ? undefined : decoded.id };
 }
 
+// One batched name lookup for the whole page. Only when the user feature is
+// mounted: delivery does not require it, and a direct-address send has no user.
+async function loadDisplayNames(
+  db: TenantDb,
+  registry: Registry,
+  rows: readonly DeliveryLogRow[],
+): Promise<ReadonlyMap<string, string>> {
+  const recipientIds = [
+    ...new Set(
+      rows
+        .map((row) => row.recipientId)
+        .filter((id): id is string => id !== null && id !== SYSTEM_USER_ID && isUuid(id)),
+    ),
+  ];
+  if (recipientIds.length === 0 || registry.getFeature(USER_FEATURE) === undefined)
+    return new Map();
+  return resolveUserDisplayNames(db, recipientIds);
+}
+
+// recipientLabel: display name, else the decrypted address, else the id.
+async function toClientRow(row: DeliveryLogRow, displayNames: ReadonlyMap<string, string>) {
+  const address =
+    row.recipientAddress !== null
+      ? await decryptStoredPii(row.recipientAddress, "recipientAddress", "delivery-log")
+      : null;
+  const name = row.recipientId !== null ? displayNames.get(row.recipientId) : undefined;
+  return {
+    id: row.id,
+    tenantId: row.tenantId,
+    recipientId: row.recipientId,
+    type: row.notificationType,
+    channel: row.channel,
+    recipient: address,
+    recipientLabel: name ?? address ?? row.recipientId,
+    status: row.status,
+    error: toClientError(row.error),
+    priority: row.priority,
+    confirmed: row.confirmed,
+    createdAt: row.createdAt,
+  };
+}
+
 export const logQuery = definePagedQueryHandler({
   name: "log",
   schema: z.object({
@@ -153,24 +213,9 @@ export const logQuery = definePagedQueryHandler({
     // here, not in the client: a projectionList screen has no entity to
     // derive a field-mapping from, so the row shape the query returns is the
     // shape the declarative columns read directly.
+    const displayNames = await loadDisplayNames(db, ctx.registry, rows);
     return {
-      rows: await Promise.all(
-        rows.map(async (row) => ({
-          id: row.id,
-          tenantId: row.tenantId,
-          recipientId: row.recipientId,
-          type: row.notificationType,
-          channel: row.channel,
-          recipient:
-            row.recipientAddress !== null
-              ? await decryptStoredPii(row.recipientAddress, "recipientAddress", "delivery-log")
-              : row.recipientAddress,
-          status: row.status,
-          error: row.error,
-          priority: row.priority,
-          createdAt: row.createdAt,
-        })),
-      ),
+      rows: await Promise.all(rows.map((row) => toClientRow(row, displayNames))),
       nextCursor,
     };
   },

package/packages/bundled-features/src/delivery/i18n.ts

@@ -1,11 +1,66 @@
+import {
+  DELIVERY_FAILURE_CODES,
+  DELIVERY_SKIP_REASONS,
+  type DeliveryFailureCode,
+  type DeliverySkipReason,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { DeliveryStatus, type DeliveryStatusValue } from "./public-names.js";
+
 type LocalizedString = { readonly en: string };
 
+// Typed over the code vocabularies, so a new code without a label fails to compile.
+const ERROR_LABELS = {
+  timeout: "Timed out",
+  network_error: "Network error",
+  redirect_blocked: "Redirect blocked",
+  host_not_allowed: "Host not allowed",
+  missing_credentials: "Missing credentials",
+  invalid_address: "Invalid address",
+  unexpected_response: "Unexpected provider response",
+  render_failed: "Rendering failed",
+  send_failed: "Sending failed",
+  channel_error: "Channel error",
+  channel_disabled: "Channel disabled",
+  preference_disabled: "Disabled in preferences",
+  rate_limited: "Rate limited",
+  no_address: "No address",
+  unsubscribed: "Unsubscribed",
+  duplicate_idempotency_key: "Duplicate request",
+} as const satisfies Record<DeliveryFailureCode | DeliverySkipReason, string>;
+
+const STATUS_LABELS = {
+  queued: "Queued",
+  sent: "Sent",
+  failed: "Failed",
+  skipped: "Skipped",
+} as const satisfies Record<DeliveryStatusValue, string>;
+
+function labelKeys(
+  prefix: string,
+  codes: readonly string[],
+  labels: Readonly<Record<string, string>>,
+): Record<string, LocalizedString> {
+  return Object.fromEntries(
+    codes.map((code) => [`${prefix}.${code}`, { en: labels[code] ?? code }]),
+  );
+}
+
 export const DELIVERY_I18N: Readonly<Record<string, LocalizedString>> = {
   "screen:delivery-log.title": { en: "Delivery log" },
   "delivery:nav.deliveryLog": { en: "Delivery" },
+  "delivery.log.col.createdAt": { en: "Time" },
   "delivery.log.col.tenantId": { en: "Tenant" },
   "delivery.log.col.type": { en: "Type" },
   "delivery.log.col.channel": { en: "Channel" },
   "delivery.log.col.recipient": { en: "Recipient" },
   "delivery.log.col.status": { en: "Status" },
+  "delivery.log.col.error": { en: "Error" },
+  ...labelKeys("delivery.status", Object.values(DeliveryStatus), STATUS_LABELS),
+  ...labelKeys(
+    "delivery.error",
+    [...DELIVERY_FAILURE_CODES, ...DELIVERY_SKIP_REASONS],
+    ERROR_LABELS,
+  ),
+  "delivery.status.sentUnconfirmed": { en: "Sent (unconfirmed)" },
+  "delivery.error.http": { en: "HTTP {status}" },
 };

package/packages/bundled-features/src/delivery/index.ts

@@ -10,6 +10,7 @@ export {
   type ChatSendFailureCode,
   type ChatSendResult,
   type ChatWebhookRequest,
+  type ChatWebhookResponse,
   type ChatWebhookTarget,
   chatConnectionNameSchema,
   chatWebhookUrlSchema,
@@ -38,6 +39,7 @@ export {
   type RateLimitConfig,
 } from "./delivery-service.js";
 export { createDeliveryFeature, type DeliveryFeatureOptions } from "./feature.js";
+export { createDeliveryNotifyFactory } from "./notify-factory.js";
 export {
   deliveryAttemptsTable,
   notificationAddressOptOutEntity,

package/packages/bundled-features/src/delivery/jobs.ts

@@ -7,6 +7,7 @@
 
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import type {
+  DeliveryErrorCode,
   JobContext,
   JobHandlerFn,
   Registry,
@@ -18,7 +19,7 @@ import * as z from "zod";
 import { appendAttemptEvent } from "./attempt-log.js";
 import { buildChannelContext } from "./channel-context.js";
 import { DeliveryJobs, deliveryPriorityRank } from "./constants.js";
-import { collectChannels } from "./delivery-service.js";
+import { collectChannels, redactedMessageOf } from "./delivery-service.js";
 import type {
   ChannelMessage,
   DeliveryChannel,
@@ -90,8 +91,9 @@ function toMessage(p: RenderJobPayload): ChannelMessage {
 function entryFor(
   p: RenderJobPayload,
   status: DeliveryLogEntry["status"],
-  error: string | null,
+  error: DeliveryErrorCode | null,
   address: string | null,
+  confirmed?: false,
 ): DeliveryLogEntry {
   return {
     tenantId: p.tenantId as TenantId, // @cast-boundary engine-payload — job payload string is the stream tenant
@@ -102,11 +104,33 @@ function entryFor(
     status,
     error,
     priority: p.priority,
+    ...(confirmed === false && { confirmed }),
   };
 }
 
-function messageOf(err: unknown): string {
-  return err instanceof Error ? err.message : String(err);
+// The job runner stores err.message in the run row, and BullMQ keeps failedReason and
+// the stack trace in Redis in plain text, so the rethrown error carries only the code.
+// The redacted message goes to the log.
+async function failAttempt(
+  ctx: JobContext,
+  db: DbConnection,
+  registry: Registry,
+  p: RenderJobPayload,
+  code: DeliveryErrorCode,
+  err: unknown,
+): Promise<never> {
+  const message = redactedMessageOf(err);
+  ctx.log.error(`delivery.${p.channelName} ${code}: ${message}`, {
+    notificationType: p.notificationType,
+    channel: p.channelName,
+  });
+  await appendAttemptEvent(
+    db,
+    registry,
+    p.deliveryAttemptId,
+    entryFor(p, "failed", code, p.address),
+  );
+  throw new Error(code);
 }
 
 // Render the message and hand off to delivery.send. On failure: record the
@@ -119,11 +143,16 @@ export const deliveryRenderJob: JobHandlerFn = async (payload, ctx) => {
   const channel = resolveChannel(registry, p.channelName);
   const channelCtx = buildChannelContext(db, registry, undefined, tenantId, ctx.secrets);
 
+  let rendered: RenderedMessage;
   try {
     if (!channel.render) {
       throw new Error(`delivery.render: channel "${p.channelName}" has no render step`);
     }
-    const rendered: RenderedMessage = await channel.render(toMessage(p), channelCtx);
+    rendered = await channel.render(toMessage(p), channelCtx);
+  } catch (err) {
+    return failAttempt(ctx, db, registry, p, "render_failed", err);
+  }
+  try {
     const jobRunner = ctx["jobRunner"] as JobRunner; // @cast-boundary dynamic-key — dispatch lives on the concrete runner
     await jobRunner.dispatch(
       DeliveryJobs.send,
@@ -131,13 +160,7 @@ export const deliveryRenderJob: JobHandlerFn = async (payload, ctx) => {
       { priority: deliveryPriorityRank[p.priority] },
     );
   } catch (err) {
-    await appendAttemptEvent(
-      db,
-      registry,
-      p.deliveryAttemptId,
-      entryFor(p, "failed", `render: ${messageOf(err)}`, p.address),
-    );
-    throw err;
+    return failAttempt(ctx, db, registry, p, "channel_error", err);
   }
 };
 
@@ -157,15 +180,15 @@ export const deliverySendJob: JobHandlerFn = async (payload, ctx) => {
       db,
       registry,
       p.deliveryAttemptId,
-      entryFor(p, result.status, result.error ?? null, result.address ?? p.address),
+      entryFor(
+        p,
+        result.status,
+        result.error ?? null,
+        result.address ?? p.address,
+        result.confirmed,
+      ),
     );
   } catch (err) {
-    await appendAttemptEvent(
-      db,
-      registry,
-      p.deliveryAttemptId,
-      entryFor(p, "failed", `send: ${messageOf(err)}`, p.address),
-    );
-    throw err;
+    return failAttempt(ctx, db, registry, p, "send_failed", err);
   }
 };

package/packages/bundled-features/src/delivery/notify-factory.ts

@@ -0,0 +1,19 @@
+import type { NotifyFactory } from "@cosmicdrift/kumiko-framework/engine";
+import type { DeliveryService } from "./types.js";
+
+// The same binding runProdApp wires into the app context: the calling context's
+// job dispatcher is handed to notify() per call, so queued channels go through
+// the delivery jobs. deliverQueuedInline drops the dispatcher and sends inline.
+export function createDeliveryNotifyFactory(
+  deliveryService: Pick<DeliveryService, "notify">,
+  options: { readonly deliverQueuedInline?: boolean } = {},
+): NotifyFactory {
+  return (user, tenantId, jobDispatcher) => (notificationType, notifyOptions) =>
+    deliveryService.notify(
+      notificationType,
+      notifyOptions,
+      user,
+      tenantId,
+      options.deliverQueuedInline === true ? undefined : jobDispatcher,
+    );
+}

package/packages/bundled-features/src/delivery/public-names.ts

@@ -33,6 +33,10 @@ export const DELIVERY_LOG_SCREEN_ID = "delivery-log" as const;
 // column — see `screen.columns[].renderer.react.__component` in feature.ts
 // and `deliveryClient()`'s `columnRenderers` map.
 export const DELIVERY_STATUS_CELL_COMPONENT = "DeliveryStatusCell" as const;
+export const DELIVERY_TYPE_CELL_COMPONENT = "DeliveryTypeCell" as const;
+export const DELIVERY_CHANNEL_CELL_COMPONENT = "DeliveryChannelCell" as const;
+export const DELIVERY_TIME_CELL_COMPONENT = "DeliveryTimeCell" as const;
+export const DELIVERY_ERROR_CELL_COMPONENT = "DeliveryErrorCell" as const;
 
 export const DeliveryErrors = {
   noRecipient: "delivery_no_recipient",

package/packages/bundled-features/src/delivery/tables.ts

@@ -43,6 +43,8 @@ export const deliveryAttemptsTable = pgTable(
     recipientAddress: text("recipient_address"),
     status: text("status").notNull().$type<"queued" | "sent" | "failed" | "skipped">(),
     error: text("error"),
+    // false = provider accepted but did not confirm; null = confirmed or not applicable.
+    confirmed: boolean("confirmed"),
     // Default covers rows that predate the column; new rows always carry the
     // notify() priority from the event payload.
     priority: text("priority").notNull().default("normal").$type<"critical" | "normal" | "low">(),
@@ -71,6 +73,7 @@ export const deliveryAttemptsTableMeta: EntityTableMeta = defineUnmanagedTable({
     { name: "recipient_address", pgType: "text", notNull: false },
     { name: "status", pgType: "text", notNull: true },
     { name: "error", pgType: "text", notNull: false },
+    { name: "confirmed", pgType: "boolean", notNull: false },
     { name: "priority", pgType: "text", notNull: true, defaultSql: "'normal'" },
     { name: "created_at", pgType: "timestamptz", notNull: true, defaultSql: "now()" },
   ],

package/packages/bundled-features/src/delivery/testing.ts

@@ -1,15 +1,13 @@
 import type { SseBroker } from "@cosmicdrift/kumiko-framework/api";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
-import type {
-  EscapeHatchAuditSink,
-  Registry,
-  TenantId,
-} from "@cosmicdrift/kumiko-framework/engine";
+import type { EscapeHatchAuditSink, Registry } from "@cosmicdrift/kumiko-framework/engine";
 import type { JobRunner } from "@cosmicdrift/kumiko-framework/jobs";
 import type { Logger } from "@cosmicdrift/kumiko-framework/logging";
+import type { SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
 import type { Redis } from "ioredis";
 import type { KillSwitchResolver, RateLimitConfig } from "./delivery-service.js";
 import { collectChannels, createDeliveryService } from "./delivery-service.js";
+import { createDeliveryNotifyFactory } from "./notify-factory.js";
 import type { DeliveryService } from "./types.js";
 
 export type CreateDeliveryTestContextOptions = {
@@ -19,6 +17,7 @@ export type CreateDeliveryTestContextOptions = {
   readonly escapeHatchAuditSink?: EscapeHatchAuditSink;
   readonly log?: Logger;
   readonly jobRunner?: JobRunner;
+  readonly secrets?: SecretsContext;
 };
 
 /**
@@ -47,9 +46,6 @@ export function createDeliveryTestContext(
 
   return {
     deliveryService, // exposed so tests can inspect/call directly if needed
-    _notifyFactory:
-      (user: { id: number; tenantId: TenantId }, tenantId: TenantId) =>
-      (notificationType: string, notifyOptions: Record<string, unknown>) =>
-        deliveryService.notify(notificationType, notifyOptions as never, user as never, tenantId), // @cast-boundary engine-bridge
+    _notifyFactory: createDeliveryNotifyFactory(deliveryService),
   };
 }

package/packages/bundled-features/src/delivery/types.ts

@@ -1,6 +1,7 @@
 import type { SseBroker } from "@cosmicdrift/kumiko-framework/api";
 import type { TenantDb } from "@cosmicdrift/kumiko-framework/db";
 import type {
+  DeliveryErrorCode,
   NotifyDeliveryStatus,
   NotifyJobDispatcher,
   NotifyOptions,
@@ -35,7 +36,9 @@ export type ChannelMessage = {
 
 export type ChannelResult = {
   readonly status: "sent" | "failed" | "skipped";
-  readonly error?: string;
+  readonly error?: DeliveryErrorCode;
+  // Only ever set to false: the provider accepted the message but did not confirm delivery.
+  readonly confirmed?: false;
   readonly address?: string;
 };
 
@@ -91,8 +94,9 @@ export type DeliveryLogEntry = {
   readonly recipientId: string | null;
   readonly recipientAddress: string | null;
   readonly status: NotifyDeliveryStatus;
-  readonly error: string | null;
+  readonly error: DeliveryErrorCode | null;
   readonly priority: NotifyPriority;
+  readonly confirmed?: false;
 };
 
 // --- Delivery Service ---

package/packages/bundled-features/src/delivery/web/client-plugin.tsx

@@ -1,8 +1,19 @@
 // @runtime client
 import type { TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
 import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer-web";
-import { DELIVERY_FEATURE, DELIVERY_STATUS_CELL_COMPONENT } from "../public-names.js";
+import {
+  DELIVERY_CHANNEL_CELL_COMPONENT,
+  DELIVERY_ERROR_CELL_COMPONENT,
+  DELIVERY_FEATURE,
+  DELIVERY_STATUS_CELL_COMPONENT,
+  DELIVERY_TIME_CELL_COMPONENT,
+  DELIVERY_TYPE_CELL_COMPONENT,
+} from "../public-names.js";
+import { DeliveryChannelCell } from "./delivery-channel-cell.js";
+import { DeliveryErrorCell } from "./delivery-error-cell.js";
 import { DeliveryStatusCell } from "./delivery-status-cell.js";
+import { DeliveryTimeCell } from "./delivery-time-cell.js";
+import { DeliveryTypeCell } from "./delivery-type-cell.js";
 
 export type DeliveryClientOptions = {
   readonly translations?: TranslationsByLocale;
@@ -13,6 +24,10 @@ export function deliveryClient(options?: DeliveryClientOptions): ClientFeatureDe
     name: DELIVERY_FEATURE,
     columnRenderers: {
       [DELIVERY_STATUS_CELL_COMPONENT]: DeliveryStatusCell,
+      [DELIVERY_TYPE_CELL_COMPONENT]: DeliveryTypeCell,
+      [DELIVERY_CHANNEL_CELL_COMPONENT]: DeliveryChannelCell,
+      [DELIVERY_TIME_CELL_COMPONENT]: DeliveryTimeCell,
+      [DELIVERY_ERROR_CELL_COMPONENT]: DeliveryErrorCell,
     },
     ...(options?.translations !== undefined && { translations: options.translations }),
   };

package/packages/bundled-features/src/delivery/web/delivery-channel-cell.tsx

@@ -0,0 +1,13 @@
+// @runtime client
+// Channel column: the label comes from `delivery.channel.<name>`, registered by each
+// channel feature; unknown channels show their raw name.
+
+import { type ColumnRendererProps, useTranslation } from "@cosmicdrift/kumiko-renderer";
+import type { ReactNode } from "react";
+import { translateOrRaw } from "../../shared/web/translate-or-raw.js";
+
+export function DeliveryChannelCell({ row }: ColumnRendererProps): ReactNode {
+  const t = useTranslation();
+  const channel = typeof row["channel"] === "string" ? row["channel"] : "";
+  return translateOrRaw(t, `delivery.channel.${channel}`, channel);
+}

package/packages/bundled-features/src/delivery/web/delivery-error-cell.tsx

@@ -0,0 +1,17 @@
+// @runtime client
+// Error column. The log only carries fixed codes (`DeliveryErrorCode`); `http_<status>`
+// takes the status as a parameter, anything unknown shows as the raw value.
+
+import { type ColumnRendererProps, useTranslation } from "@cosmicdrift/kumiko-renderer";
+import { HTTP_ERROR_CODE_PATTERN } from "@cosmicdrift/kumiko-types/handlers";
+import type { ReactNode } from "react";
+import { translateOrRaw } from "../../shared/web/translate-or-raw.js";
+
+export function DeliveryErrorCell({ row }: ColumnRendererProps): ReactNode {
+  const t = useTranslation();
+  const error = row["error"];
+  if (typeof error !== "string" || error === "") return null;
+  const http = HTTP_ERROR_CODE_PATTERN.exec(error);
+  if (http) return t("delivery.error.http", { status: http[1] });
+  return translateOrRaw(t, `delivery.error.${error}`, error);
+}

package/packages/bundled-features/src/delivery/web/delivery-status-cell.tsx

@@ -4,9 +4,10 @@
 // in feature.ts). The list frame itself is the generic declarative
 // projectionList renderer — only this one cell stays TSX.
 
-import type { ColumnRendererProps } from "@cosmicdrift/kumiko-renderer";
+import { type ColumnRendererProps, useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { StatusBadge, type StatusTone } from "@cosmicdrift/kumiko-renderer-web";
 import type { ReactNode } from "react";
+import { translateOrRaw } from "../../shared/web/translate-or-raw.js";
 import { DeliveryStatus } from "../public-names.js";
 
 const STATUS_TONE: Readonly<Record<string, StatusTone>> = {
@@ -17,10 +18,16 @@ const STATUS_TONE: Readonly<Record<string, StatusTone>> = {
 };
 
 export function DeliveryStatusCell({ row }: ColumnRendererProps): ReactNode {
+  const t = useTranslation();
   const status = typeof row["status"] === "string" ? row["status"] : "";
+  const unconfirmed = status === DeliveryStatus.sent && row["confirmed"] === false;
+  const labelKey = unconfirmed ? "delivery.status.sentUnconfirmed" : `delivery.status.${status}`;
   return (
-    <StatusBadge tone={STATUS_TONE[status] ?? "muted"} testId="delivery-status-cell">
-      {status}
+    <StatusBadge
+      tone={unconfirmed ? "muted" : (STATUS_TONE[status] ?? "muted")}
+      testId="delivery-status-cell"
+    >
+      {translateOrRaw(t, labelKey, status)}
     </StatusBadge>
   );
 }

package/packages/bundled-features/src/delivery/web/delivery-time-cell.tsx

@@ -0,0 +1,8 @@
+// @runtime client
+import { type ColumnRendererProps, formatWhen } from "@cosmicdrift/kumiko-renderer";
+import type { ReactNode } from "react";
+
+export function DeliveryTimeCell({ row }: ColumnRendererProps): ReactNode {
+  const createdAt = row["createdAt"];
+  return typeof createdAt === "string" ? formatWhen(createdAt) : "";
+}

package/packages/bundled-features/src/delivery/web/delivery-type-cell.tsx

@@ -0,0 +1,20 @@
+// @runtime client
+// Notification type column. Types are QNs like `<scope>:notify:<name>`; the
+// translation key is `<scope>.notification.<name>`, registered by the app that
+// owns the notification (bundled features register none). Falls back to the short
+// name, or to the raw value for any other format.
+
+import { type ColumnRendererProps, useTranslation } from "@cosmicdrift/kumiko-renderer";
+import type { ReactNode } from "react";
+import { translateOrRaw } from "../../shared/web/translate-or-raw.js";
+
+const NOTIFICATION_QN_PATTERN = /^([^:]+):notify:(.+)$/;
+
+export function DeliveryTypeCell({ row }: ColumnRendererProps): ReactNode {
+  const t = useTranslation();
+  const type = typeof row["type"] === "string" ? row["type"] : "";
+  const match = NOTIFICATION_QN_PATTERN.exec(type);
+  if (!match) return type;
+  const [, scope, name] = match;
+  return translateOrRaw(t, `${scope}.notification.${name}`, name ?? type);
+}

package/packages/bundled-features/src/jobs/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.343.0",
+    "type": "improvement",
+    "title": "ctx.crossTenantReads for read-only cross-tenant job reads",
+    "detail": "Jobs whose `escapeHatch` grants `unsafeRaw` get `ctx.crossTenantReads` with `selectMany`, `fetchOne` and `count` across all tenants, read-only. Each call is reported as the new escape-hatch kind `cross-tenant-read`; system crons audit it once per process and the metric `kumiko_escape_hatch_uses_total` counts every call. `EscapeHatchKind` and the `escape-hatch-used` audit schema gain `cross-tenant-read`.\n`tenant-lifecycle:job:run-tenant-destruction` checks through `ctx.crossTenantReads` whether a tenant is due and only then calls `ctx.db.unsafeRaw()`, so idle minutes no longer write an `unsafe-raw` audit event."
+  },
   {
     "version": "0.336.0",
     "type": "improvement",

package/packages/bundled-features/src/legal-pages/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.344.0",
+    "type": "improvement",
+    "title": "Optional title heading on legal pages",
+    "detail": "`LegalPageRoute` has an optional `titleHeading` flag. When `true`, the page body starts with an `<h1>` holding the escaped page title. The default (`false`) leaves the body unchanged."
+  },
   {
     "version": "0.335.0",
     "type": "fix",

package/packages/bundled-features/src/legal-pages/constants.ts

@@ -10,6 +10,8 @@ export type LegalPageRoute = {
   readonly slug: string;
   readonly lang: string;
   readonly titleFallback: string;
+  /** Prepend the page title as `<h1>` to the rendered body. Default false. */
+  readonly titleHeading?: boolean;
 };
 
 // Shape of one boot-check-required block — the type behind

package/packages/bundled-features/src/legal-pages/feature.ts

@@ -4,6 +4,7 @@ import {
   type FeatureDefinition,
   SYSTEM_TENANT_ID,
 } from "@cosmicdrift/kumiko-framework/engine";
+import { escapeHtml } from "@cosmicdrift/kumiko-headless";
 import {
   cachedSecurePageResponse,
   type PublicPageWrapLayout,
@@ -87,7 +88,7 @@ export type LegalPagesOptions = {
 
 export function createLegalPagesFeature(opts: LegalPagesOptions = {}): FeatureDefinition {
   const wrapLayout = opts.wrapLayout ?? wrapInLayout;
-  const routes = opts.routes ?? LEGAL_ROUTES;
+  const routes: readonly LegalPageRoute[] = opts.routes ?? LEGAL_ROUTES;
   const requiredBlocks = opts.requiredBlocks ?? LEGAL_REQUIRED_BLOCKS;
   validateRoutes(routes);
   if (opts.routes !== undefined && opts.routes.length > 0 && opts.requiredBlocks === undefined) {
@@ -172,9 +173,13 @@ export function createLegalPagesFeature(opts: LegalPagesOptions = {}): FeatureDe
             });
           }
 
+          const title = data.title || route.titleFallback;
+          const renderedBody = renderMarkdownToHtml(data.content);
           const html = wrapLayout({
-            title: data.title || route.titleFallback,
-            bodyHtml: renderMarkdownToHtml(data.content),
+            title,
+            bodyHtml: route.titleHeading
+              ? `<h1>${escapeHtml(title)}</h1>${renderedBody}`
+              : renderedBody,
             lang: route.lang,
             slug: route.slug,
           });

package/packages/bundled-features/src/renderer-simple/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.344.0",
+    "type": "improvement",
+    "title": "Heading and Markdown sections in the simple mail renderer",
+    "detail": "`createSimpleRenderer` accepts two more section kinds: `{ heading: string }` (rendered as an escaped `<h2>`) and `{ markdown: string }` (rendered with the hardened Markdown renderer; raw HTML is escaped and unsafe link targets are replaced by `#`). Existing section kinds render as before."
+  },
   {
     "version": "0.341.0",
     "type": "improvement",