@cosmicdrift/kumiko-bundled-features 0.356.0 → 0.357.0

package/dist/auth-mfa/i18n.js

@@ -19,6 +19,7 @@ export const AUTH_MFA_FEATURE_I18N = {
     "mfa.enable.reveal.qr": { en: "Scan this QR code" },
     "mfa.enable.reveal.secret": { en: "Or enter this code manually" },
     "mfa.enable.reveal.recoveryCodes": { en: "Recovery codes" },
+    "mfa.enable.reveal.savedCodes": { en: "I have saved my recovery codes." },
     "mfa.enable.confirm.submit": { en: "Enable" },
     "mfa.enable.confirm.done": { en: "Two-factor authentication is now enabled." },
     "screen:auth-mfa-disable.title": { en: "Disable two-factor authentication" },

package/dist/auth-mfa/schema/user-mfa.d.ts

@@ -4,6 +4,7 @@ export declare const userMfaEntity: import("@cosmicdrift/kumiko-types/fields").E
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -26,6 +27,7 @@ export declare const userMfaEntity: import("@cosmicdrift/kumiko-types/fields").E
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -48,6 +50,7 @@ export declare const userMfaEntity: import("@cosmicdrift/kumiko-types/fields").E
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -102,6 +105,7 @@ export declare const userMfaTable: import("@cosmicdrift/kumiko-framework/db").En
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -124,6 +128,7 @@ export declare const userMfaTable: import("@cosmicdrift/kumiko-framework/db").En
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -146,6 +151,7 @@ export declare const userMfaTable: import("@cosmicdrift/kumiko-framework/db").En
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;

package/dist/auth-mfa/screens.js

@@ -23,6 +23,7 @@ export const mfaEnableScreen = {
     reveal: {
         title: i18nKey("mfa.enable.reveal.title"),
         warning: i18nKey("mfa.enable.reveal.warning"),
+        acknowledge: i18nKey("mfa.enable.reveal.savedCodes"),
         fields: [
             {
                 field: "otpauthUri",
@@ -47,7 +48,13 @@ export const mfaEnableScreen = {
     confirm: {
         handler: AuthMfaHandlers.enableConfirm,
         fields: {
-            code: { type: "text", required: true, minLength: 6, maxLength: 6 },
+            code: {
+                type: "text",
+                required: true,
+                minLength: 6,
+                maxLength: 6,
+                autoComplete: "one-time-code",
+            },
         },
         layout: { sections: [{ fields: ["code"] }] },
         carry: ["setupToken"],

package/dist/billing-foundation/entities.d.ts

@@ -4,6 +4,7 @@ export declare const subscriptionEntity: import("@cosmicdrift/kumiko-types/field
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -26,6 +27,7 @@ export declare const subscriptionEntity: import("@cosmicdrift/kumiko-types/field
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -48,6 +50,7 @@ export declare const subscriptionEntity: import("@cosmicdrift/kumiko-types/field
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -70,6 +73,7 @@ export declare const subscriptionEntity: import("@cosmicdrift/kumiko-types/field
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -92,6 +96,7 @@ export declare const subscriptionEntity: import("@cosmicdrift/kumiko-types/field
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -147,6 +152,7 @@ export declare const paymentEntity: import("@cosmicdrift/kumiko-types/fields").E
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -169,6 +175,7 @@ export declare const paymentEntity: import("@cosmicdrift/kumiko-types/fields").E
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -191,6 +198,7 @@ export declare const paymentEntity: import("@cosmicdrift/kumiko-types/fields").E
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;

package/dist/billing-foundation/projection.d.ts

@@ -4,6 +4,7 @@ export declare const subscriptionsProjectionTable: import("@cosmicdrift/kumiko-f
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -26,6 +27,7 @@ export declare const subscriptionsProjectionTable: import("@cosmicdrift/kumiko-f
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -48,6 +50,7 @@ export declare const subscriptionsProjectionTable: import("@cosmicdrift/kumiko-f
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -70,6 +73,7 @@ export declare const subscriptionsProjectionTable: import("@cosmicdrift/kumiko-f
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -92,6 +96,7 @@ export declare const subscriptionsProjectionTable: import("@cosmicdrift/kumiko-f
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -146,6 +151,7 @@ export declare const paymentsProjectionTable: import("@cosmicdrift/kumiko-framew
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -168,6 +174,7 @@ export declare const paymentsProjectionTable: import("@cosmicdrift/kumiko-framew
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -190,6 +197,7 @@ export declare const paymentsProjectionTable: import("@cosmicdrift/kumiko-framew
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;

package/dist/cap-counter/entity.d.ts

@@ -4,6 +4,7 @@ export declare const capCounterEntity: import("@cosmicdrift/kumiko-types/fields"
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;

package/dist/cap-counter/feature.js

@@ -94,7 +94,13 @@ export const capCounterFeature = defineFeature(CAP_COUNTER_FEATURE, (r) => {
         id: CAP_COUNTER_LIST_SCREEN_ID,
         type: "entityList",
         entity: "cap-counter",
-        columns: ["tenantId", "capName", "value", "periodStart", "lastSoftWarnedAt"],
+        columns: [
+            "tenantId",
+            "capName",
+            "value",
+            "periodStart",
+            { field: "lastSoftWarnedAt", hideOnNarrow: true },
+        ],
         defaultSort: { field: "capName", dir: "asc" },
         // Search resolves against the caller's own tenant stream, so on this
         // cross-tenant operator list it would only ever hit the SystemAdmin's tenant.

package/dist/cap-overview/screens.js

@@ -15,10 +15,12 @@ export function createTenantCapListScreen(caps, listCaps, tiers) {
             { field: "name", label: "cap-overview.list.col.name" },
             { field: "tier", label: "cap-overview.list.col.tier" },
             { field: "billing", label: "cap-overview.list.col.billing" },
-            ...listedCaps.map((cap) => ({
+            // Name is the title; tier, billing and the first cap fill the card's three meta rows.
+            ...listedCaps.map((cap, index) => ({
                 field: capFieldName(cap.id),
                 label: cap.label,
                 renderer: { react: { __component: CAP_USAGE_CELL_COMPONENT } },
+                ...(index > 0 && { hideOnNarrow: true }),
             })),
         ],
         searchable: true,

package/dist/config/table.d.ts

@@ -4,6 +4,7 @@ export declare const configValueEntity: import("@cosmicdrift/kumiko-types/fields
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -26,6 +27,7 @@ export declare const configValueEntity: import("@cosmicdrift/kumiko-types/fields
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -48,6 +50,7 @@ export declare const configValueEntity: import("@cosmicdrift/kumiko-types/fields
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -72,6 +75,7 @@ export declare const configValuesTable: import("@cosmicdrift/kumiko-framework/db
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -94,6 +98,7 @@ export declare const configValuesTable: import("@cosmicdrift/kumiko-framework/db
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -116,6 +121,7 @@ export declare const configValuesTable: import("@cosmicdrift/kumiko-framework/db
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;

package/dist/crypto-shredding/handlers/forget-subject.write.js

@@ -10,6 +10,7 @@ import { purgeSearchDocumentsForSubject } from "@cosmicdrift/kumiko-framework/se
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
 import * as z from "zod";
 import { resolveRetentionPolicyForTenant } from "../../data-retention/index.js";
+import { eraseNoteBodiesReachingSubject } from "../../notes-history-user-data/index.js";
 import { revokeAllPatTokensForUser } from "../../personal-access-tokens/index.js";
 import { USER_STATUS } from "../../user/index.js";
 import { denyIfTargetOutsideAdminTenant, isSystemAdminActor, updateUserLifecycle, } from "../../user-data-rights/index.js";
@@ -213,7 +214,7 @@ function sweepErrorLabel(err) {
 // The key is already erased when this runs, so a failing sweep must not skip the
 // audit event: the failure is returned as a label for the event instead of thrown.
 // The savepoint keeps a database error from aborting the handler transaction.
-async function sweepDerivedSubjectData(ctx, subject, subjectKey, crossTenantRunner) {
+async function sweepDerivedSubjectData(ctx, subject, subjectKey, crossTenantRunner, audit) {
     try {
         await runInSavepointIfSupported(crossTenantRunner, async (crossTenantSubjectRunner) => {
             // Blind-index sweep (#818): nulls bidx columns now so the deterministic
@@ -224,6 +225,16 @@ async function sweepDerivedSubjectData(ctx, subject, subjectKey, crossTenantRunn
             if (ctx.searchAdapter) {
                 await purgeSearchDocumentsForSubject(crossTenantSubjectRunner, ctx.registry.features, ctx.searchAdapter, subjectKey, subject);
             }
+            // Note bodies are keyed per note, so the subject's own key never reaches them.
+            if (ctx.registry.features.has("notes-history")) {
+                await eraseNoteBodiesReachingSubject({
+                    db: crossTenantSubjectRunner,
+                    registry: ctx.registry,
+                    subject,
+                    erasedBy: audit.erasedBy,
+                    requestId: audit.requestId,
+                });
+            }
         });
         return undefined;
     }
@@ -335,12 +346,13 @@ export const forgetSubjectWrite = defineWriteHandler({
         // but no event exists — a retry is a no-op erase plus the event. The
         // reverse order could leave an audit trail claiming a shred that never
         // happened.
+        const requestId = requestContext.get()?.requestId ?? "crypto-shredding:forget-subject";
         await kms.eraseKey(subject, {
-            requestId: requestContext.get()?.requestId ?? "crypto-shredding:forget-subject",
+            requestId,
             userId: event.user.id,
             eraseReason: event.payload.reason,
         });
-        const cleanupError = await sweepDerivedSubjectData(ctx, subject, subjectKey, ctx.db.unsafeRaw());
+        const cleanupError = await sweepDerivedSubjectData(ctx, subject, subjectKey, ctx.db.unsafeRaw(), { requestId, erasedBy: event.user.id });
         // User subject: close the login door. DEK-erase makes the passwordHash
         // ciphertext unreadable, but status + PATs are standalone credentials —
         // the PAT resolver only checks revokedAt/expiresAt, NOT user.status

package/dist/custom-fields/entity.d.ts

@@ -4,6 +4,7 @@ export declare const fieldDefinitionEntity: import("@cosmicdrift/kumiko-types/fi
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -26,6 +27,7 @@ export declare const fieldDefinitionEntity: import("@cosmicdrift/kumiko-types/fi
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -48,6 +50,7 @@ export declare const fieldDefinitionEntity: import("@cosmicdrift/kumiko-types/fi
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -95,6 +98,7 @@ export declare const fieldDefinitionEntity: import("@cosmicdrift/kumiko-types/fi
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;

package/dist/data-retention/schema/tenant-retention-override.d.ts

@@ -4,6 +4,7 @@ export declare const tenantRetentionOverrideEntity: import("@cosmicdrift/kumiko-
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -42,6 +43,7 @@ export declare const tenantRetentionOverrideEntity: import("@cosmicdrift/kumiko-
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -66,6 +68,7 @@ export declare const tenantRetentionOverrideTable: import("@cosmicdrift/kumiko-f
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -104,6 +107,7 @@ export declare const tenantRetentionOverrideTable: import("@cosmicdrift/kumiko-f
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;

package/dist/delivery/chat-webhook-sender.js

@@ -17,7 +17,7 @@ export const chatConnectionNameSchema = z
 function policyFor(request, target) {
     return request.requireHttps
         ? { kind: "external" }
-        : { kind: "internal", allowHosts: [target.hostname] };
+        : { kind: "internal", allowOrigins: [target.origin] };
 }
 function hostMatches(hostname, allowedHost) {
     const allowed = allowedHost.toLowerCase();

package/dist/delivery/constants.d.ts

@@ -1,6 +1,7 @@
 import type { NotifyPriority } from "@cosmicdrift/kumiko-framework/engine";
 export declare const DELIVERY_CHANNEL_EXTENSION: "deliveryChannel";
 export { DELIVERY_ATTEMPT_ADDRESS_ERASED_EVENT, DELIVERY_ATTEMPT_EVENT, DELIVERY_CHANNEL_CELL_COMPONENT, DELIVERY_ERROR_CELL_COMPONENT, DELIVERY_FEATURE, DELIVERY_LOG_SCREEN_ID, DELIVERY_RESUBSCRIBE_PATH, DELIVERY_STATUS_CELL_COMPONENT, DELIVERY_TIME_CELL_COMPONENT, DELIVERY_TYPE_CELL_COMPONENT, DELIVERY_UNSUBSCRIBE_PATH, DeliveryErrors, DeliveryHandlers, DeliveryJobNames, DeliveryQueries, DeliveryStatus, type DeliveryStatusValue, } from "./public-names.js";
+export declare function deliveryIdempotencyRedisKey(tenantId: string, key: string): string;
 export declare const deliveryPriorityRank: Record<NotifyPriority, number>;
 export declare const DeliveryJobs: {
     readonly render: string;

package/dist/delivery/constants.js

@@ -4,6 +4,10 @@ import { DELIVERY_FEATURE, DeliveryJobNames } from "./public-names.js";
 // channel-in-app, channel-push, ...).
 export const DELIVERY_CHANNEL_EXTENSION = "deliveryChannel";
 export { DELIVERY_ATTEMPT_ADDRESS_ERASED_EVENT, DELIVERY_ATTEMPT_EVENT, DELIVERY_CHANNEL_CELL_COMPONENT, DELIVERY_ERROR_CELL_COMPONENT, DELIVERY_FEATURE, DELIVERY_LOG_SCREEN_ID, DELIVERY_RESUBSCRIBE_PATH, DELIVERY_STATUS_CELL_COMPONENT, DELIVERY_TIME_CELL_COMPONENT, DELIVERY_TYPE_CELL_COMPONENT, DELIVERY_UNSUBSCRIBE_PATH, DeliveryErrors, DeliveryHandlers, DeliveryJobNames, DeliveryQueries, DeliveryStatus, } from "./public-names.js";
+// Single source for claim (delivery-service) and terminal-failure release (jobs).
+export function deliveryIdempotencyRedisKey(tenantId, key) {
+    return `delivery:idem:${tenantId}:${key}`;
+}
 // notify() priority → BullMQ job priority. Lower number = processed first; all
 // > 0 so prioritised delivery jobs never mix with BullMQ's "0 = unprioritised
 // FIFO" bucket. critical jobs jump ahead of normal/low in the worker queue.

package/dist/delivery/delivery-service.js

@@ -8,7 +8,7 @@ import { redactErrorText } from "../shared/index.js";
 import { hashUnsubscribeAddress } from "./address-opt-out.js";
 import { appendAttemptEvent, logAttempt } from "./attempt-log.js";
 import { buildChannelContext } from "./channel-context.js";
-import { DELIVERY_CHANNEL_EXTENSION, DeliveryJobs, deliveryPriorityRank } from "./constants.js";
+import { DELIVERY_CHANNEL_EXTENSION, DeliveryJobs, deliveryIdempotencyRedisKey, deliveryPriorityRank, } from "./constants.js";
 import { addressOptOutKey, selectOptedOutAddresses, } from "./db/queries/address-opt-outs.js";
 import { selectNotificationPreferences } from "./db/queries/preferences.js";
 import { isDeliveryChannelPlugin, } from "./types.js";
@@ -74,10 +74,28 @@ export function createDeliveryService(options) {
         if (!idemRedis) {
             throw new Error("Delivery idempotencyKey requires options.idempotencyRedis (or rateLimit.redis) to be configured");
         }
-        const k = `delivery:idem:${tenantId}:${key}`;
-        const res = await idemRedis.set(k, "1", "EX", ttlSec, "NX");
+        const res = await idemRedis.set(deliveryIdempotencyRedisKey(tenantId, key), "1", "EX", ttlSec, "NX");
         return res === "OK";
     }
+    function isDeliveredOrQueued(delivery) {
+        return delivery.status === "sent" || delivery.status === "queued";
+    }
+    // A key that guarded nothing must not turn the caller's retry into a skipped duplicate.
+    // Partial success keeps it: a retry would re-send to those who got it.
+    async function releaseIdempotencyIfNothingDelivered(tenantId, key, run) {
+        // skip: no key claimed, or a recipient already got the notification
+        if (!key || run.deliveries.some(isDeliveredOrQueued))
+            return;
+        await idemRedis?.del(deliveryIdempotencyRedisKey(tenantId, key));
+    }
+    // Only a single-channel route lets the queued job free the key on terminal failure
+    // without risking a duplicate send on another channel.
+    function jobIdempotencyKeyFor(idempotencyKey, route) {
+        if (!idempotencyKey || !route)
+            return undefined;
+        const routedChannelCount = channels.filter((channel) => route[channel.name]).length;
+        return routedChannelCount === 1 ? idempotencyKey : undefined;
+    }
     async function resolveUserIdsForTenant(tenantId) {
         if (!tenantUserIdsQuery) {
             throw new Error("Tenant broadcast requires tenantUserIdsQuery in DeliveryServiceOptions");
@@ -191,6 +209,7 @@ export function createDeliveryService(options) {
                 deliveryAttemptId,
                 priority,
                 message,
+                ...(run.jobIdempotencyKey !== undefined && { idempotencyKey: run.jobIdempotencyKey }),
             }, { priority: deliveryPriorityRank[priority] });
             recordDelivery(run, queuedEntry, deliveryAttemptId);
         }
@@ -517,14 +536,42 @@ export function createDeliveryService(options) {
             }
         }
     }
+    async function dispatchNotification(notificationType, options, tenantId, priority, run) {
+        const { to, route, data } = options;
+        if (route) {
+            await deliverDirect(route, notificationType, data, tenantId, priority, options.recipientId ?? null, run);
+            // skip: explicit route is delivered directly, no recipient resolution needed
+            return;
+        }
+        if (to !== undefined) {
+            let userIds;
+            if (typeof to === "string") {
+                userIds = [to];
+            }
+            else if ("tenant" in to) {
+                userIds = await resolveUserIdsForTenant(to.tenant);
+            }
+            else {
+                userIds = to;
+            }
+            const prefetchedAddresses = priority === "critical"
+                ? new Map()
+                : await prefetchUserAddresses(userIds, tenantId, notificationType);
+            const suppressed = await loadSuppressedAddresses(tenantId, notificationType, priority, [...prefetchedAddresses.values()].filter((address) => !!address));
+            for (const userId of userIds) {
+                await deliverToUser(userId, notificationType, data, tenantId, priority, run, prefetchedAddresses, suppressed);
+            }
+        }
+    }
     return {
         async notify(notificationType, options, _user, tenantId, jobDispatcher) {
-            const { to, route, data, idempotencyKey } = options;
+            const { route, idempotencyKey } = options;
             const priority = options.priority ?? "normal";
             const run = {
                 deliveries: [],
                 jobDispatcher: options.immediate ? undefined : (jobDispatcher ?? jobRunner),
                 locale: options.locale,
+                jobIdempotencyKey: jobIdempotencyKeyFor(idempotencyKey, route),
             };
             if (idempotencyKey) {
                 const first = await claimIdempotency(tenantId, idempotencyKey);
@@ -542,29 +589,19 @@ export function createDeliveryService(options) {
                     return { deliveries: run.deliveries };
                 }
             }
-            if (route) {
-                await deliverDirect(route, notificationType, data, tenantId, priority, options.recipientId ?? null, run);
-                return { deliveries: run.deliveries };
+            try {
+                await dispatchNotification(notificationType, options, tenantId, priority, run);
             }
-            if (to !== undefined) {
-                let userIds;
-                if (typeof to === "string") {
-                    userIds = [to];
-                }
-                else if ("tenant" in to) {
-                    userIds = await resolveUserIdsForTenant(to.tenant);
-                }
-                else {
-                    userIds = to;
-                }
-                const prefetchedAddresses = priority === "critical"
-                    ? new Map()
-                    : await prefetchUserAddresses(userIds, tenantId, notificationType);
-                const suppressed = await loadSuppressedAddresses(tenantId, notificationType, priority, [...prefetchedAddresses.values()].filter((address) => !!address));
-                for (const userId of userIds) {
-                    await deliverToUser(userId, notificationType, data, tenantId, priority, run, prefetchedAddresses, suppressed);
-                }
+            catch (err) {
+                // A failing release must not replace the dispatch error the caller retries on.
+                await releaseIdempotencyIfNothingDelivered(tenantId, idempotencyKey, run).catch((releaseErr) => {
+                    logError.warn(`idempotency key release failed: ${redactedMessageOf(releaseErr)}`, {
+                        notificationType,
+                    });
+                });
+                throw err;
             }
+            await releaseIdempotencyIfNothingDelivered(tenantId, idempotencyKey, run);
             return { deliveries: run.deliveries };
         },
     };

package/dist/delivery/feature.js

@@ -179,15 +179,21 @@ export function createDeliveryFeature(options) {
                     label: i18nKey("delivery.log.col.channel"),
                     renderer: { react: { __component: DELIVERY_CHANNEL_CELL_COMPONENT } },
                 },
-                { field: "recipientLabel", label: i18nKey("delivery.log.col.recipient") },
+                {
+                    field: "recipientLabel",
+                    label: i18nKey("delivery.log.col.recipient"),
+                    hideOnNarrow: true,
+                },
                 {
                     field: "status",
                     label: i18nKey("delivery.log.col.status"),
+                    hideOnNarrow: true,
                     renderer: { react: { __component: DELIVERY_STATUS_CELL_COMPONENT } },
                 },
                 {
                     field: "error",
                     label: i18nKey("delivery.log.col.error"),
+                    hideOnNarrow: true,
                     renderer: { react: { __component: DELIVERY_ERROR_CELL_COMPONENT } },
                 },
             ],

package/dist/delivery/jobs.js

@@ -8,7 +8,7 @@ import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { appendAttemptEvent } from "./attempt-log.js";
 import { buildChannelContext } from "./channel-context.js";
-import { DeliveryJobs, deliveryPriorityRank } from "./constants.js";
+import { DeliveryJobs, deliveryIdempotencyRedisKey, deliveryPriorityRank } from "./constants.js";
 import { collectChannels, redactedMessageOf } from "./delivery-service.js";
 const channelMessageSchema = z.object({
     notificationType: z.string(),
@@ -26,6 +26,7 @@ const renderJobPayloadSchema = z.object({
     deliveryAttemptId: z.string(),
     priority: z.enum(["critical", "normal", "low"]),
     message: channelMessageSchema,
+    idempotencyKey: z.string().optional(),
 });
 const sendJobPayloadSchema = renderJobPayloadSchema.extend({
     rendered: z
@@ -75,6 +76,28 @@ function entryFor(p, status, error, address, confirmed) {
         ...(confirmed === false && { confirmed }),
     };
 }
+// Only the final retry frees the key: earlier failures are retried by the runner and
+// must still dedup. Assumes ctx.redis is the handle the service claimed on; runProdApp
+// wires the same instance into both.
+async function releaseIdempotencyOnTerminalFailure(ctx, p) {
+    // skip: nothing to release before the last attempt or without an idempotency key
+    if (!ctx.finalAttempt || !p.idempotencyKey)
+        return;
+    if (!ctx.redis) {
+        ctx.log.warn("delivery: idempotency key not released, job context has no redis", {
+            notificationType: p.notificationType,
+        });
+        return;
+    }
+    try {
+        await ctx.redis.del(deliveryIdempotencyRedisKey(p.tenantId, p.idempotencyKey));
+    }
+    catch (err) {
+        ctx.log.warn(`delivery: idempotency key release failed: ${redactedMessageOf(err)}`, {
+            notificationType: p.notificationType,
+        });
+    }
+}
 // The job runner stores err.message in the run row, and BullMQ keeps failedReason and
 // the stack trace in Redis in plain text, so the rethrown error carries only the code.
 // The redacted message goes to the log.
@@ -85,6 +108,7 @@ async function failAttempt(ctx, db, registry, p, code, err) {
         channel: p.channelName,
     });
     await appendAttemptEvent(db, registry, p.deliveryAttemptId, entryFor(p, "failed", code, p.address));
+    await releaseIdempotencyOnTerminalFailure(ctx, p);
     throw new Error(code);
 }
 // Render the message and hand off to delivery.send. On failure: record the