@cosmicdrift/kumiko-bundled-features 0.356.0 → 0.358.0

package/dist/cap-counter/enforce-cap.d.ts

@@ -1,6 +1,6 @@
-import { type HandlerContext } from "@cosmicdrift/kumiko-framework/engine";
 import { KumikoError } from "@cosmicdrift/kumiko-framework/errors";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
+import { type CapCounterContext } from "./book-cap-usage.js";
 /**
  * Cap-Toleranz-Profile — pro Cap-Typ asymmetrisch. Quelle: Memory
  * `project_pricing_byok_caps` §3 + `docs/plans/marketing/produkt/
@@ -79,7 +79,7 @@ export declare function assertBelowHardCap(valueSeenByLastUnit: number, cap: {
  * (apps-count) need stricter serialization at the create-handler
  * level (e.g. uniqueness-index on apps.tenantId+slot-number).
  */
-export declare function enforceCap(ctx: HandlerContext, options: {
+export declare function enforceCap(ctx: CapCounterContext, options: {
     readonly capName: string;
     readonly periodStartIso: string;
     readonly limit: number;
@@ -110,7 +110,7 @@ export declare function enforceCap(ctx: HandlerContext, options: {
  * Projection mit pre-aggregierten daily-buckets. Heute nicht
  * vorgezogen.
  */
-export declare function enforceRollingCap(ctx: HandlerContext, options: {
+export declare function enforceRollingCap(ctx: CapCounterContext, options: {
     readonly capName: string;
     readonly windowDays: number;
     readonly limit: number;
@@ -162,7 +162,7 @@ export type SoftHitNotifier = (info: {
  * verzweigen (z.B. UI-Toast bei soft-hit zusätzlich zur
  * Email-Notification).
  */
-export declare function enforceCapAndMaybeNotify(ctx: HandlerContext, options: {
+export declare function enforceCapAndMaybeNotify(ctx: CapCounterContext, options: {
     readonly capName: string;
     readonly periodStartIso: string;
     readonly limit: number;
@@ -181,7 +181,7 @@ export declare function enforceCapAndMaybeNotify(ctx: HandlerContext, options: {
  * oder er ruft `enforceRollingCapAndMaybeNotify` nur einmal pro
  * Tag/Stunde auf (Hourly-Cron statt pro Request).
  */
-export declare function enforceRollingCapAndMaybeNotify(ctx: HandlerContext, options: {
+export declare function enforceRollingCapAndMaybeNotify(ctx: CapCounterContext, options: {
     readonly capName: string;
     readonly windowDays: number;
     readonly limit: number;

package/dist/cap-counter/enforce-cap.js

@@ -1,7 +1,7 @@
 import { createEntityExecutor } from "@cosmicdrift/kumiko-framework/engine";
 import { KumikoError, reraiseAsKumikoError } from "@cosmicdrift/kumiko-framework/errors";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
-import { markCapSoftWarned, readRollingCapUsage } from "./book-cap-usage.js";
+import { markCapSoftWarned, readRollingCapUsage, resolveCapCounterScope, } from "./book-cap-usage.js";
 import { capCounterEntity } from "./entity.js";
 const { table } = createEntityExecutor("cap-counter", capCounterEntity);
 export const CAP_TOLERANCES = {
@@ -45,16 +45,14 @@ export function assertBelowHardCap(valueSeenByLastUnit, cap) {
  * level (e.g. uniqueness-index on apps.tenantId+slot-number).
  */
 export async function enforceCap(ctx, options) {
-    if (!ctx.db) {
-        throw new Error("cap-counter.enforceCap: ctx.db missing — run inside a handler context");
-    }
+    const { user, readDb } = resolveCapCounterScope(ctx, false);
     const amount = options.amount ?? 1;
     if (!Number.isInteger(amount) || amount < 1) {
         throw new Error(`cap-counter.enforceCap: amount must be a positive integer, got ${options.amount}`);
     }
     const tolerance = CAP_TOLERANCES[options.profile];
     const softThreshold = options.limit * tolerance.soft;
-    const rows = await ctx.db.selectMany(table, { capName: options.capName, periodStart: options.periodStartIso }, { limit: 1 });
+    const rows = await readDb.selectMany(table, { tenantId: user.tenantId, capName: options.capName, periodStart: options.periodStartIso }, { limit: 1 });
     const row = rows[0];
     const storedValue = row ? row["value"] : 0; // @cast-boundary db-row
     // The last of `amount` units sees this value before its own increment.
@@ -94,16 +92,11 @@ export async function enforceCap(ctx, options) {
  * vorgezogen.
  */
 export async function enforceRollingCap(ctx, options) {
-    if (!ctx.db) {
-        throw new Error("cap-counter.enforceRollingCap: ctx.db missing — run inside a handler context");
-    }
-    if (!ctx.user?.tenantId) {
-        throw new Error("cap-counter.enforceRollingCap: ctx.user.tenantId missing — required to compute aggregate-id");
-    }
+    const { user, readDb } = resolveCapCounterScope(ctx, false);
     const tolerance = CAP_TOLERANCES[options.profile];
     const softThreshold = options.limit * tolerance.soft;
     const hardThreshold = options.limit * tolerance.hard;
-    const value = await readRollingCapUsage(ctx.db, ctx.user.tenantId, {
+    const value = await readRollingCapUsage(readDb, user.tenantId, {
         capName: options.capName,
         windowDays: options.windowDays,
     });
@@ -184,14 +177,11 @@ export async function enforceCapAndMaybeNotify(ctx, options) {
         ...(options.amount !== undefined && { amount: options.amount }),
     });
     if (result.state === "soft-hit" && result.crossed) {
-        if (!ctx.user?.tenantId) {
-            throw new Error("cap-counter.enforceCapAndMaybeNotify: ctx.user.tenantId missing — required for notification");
-        }
         await options.notify({
             capName: options.capName,
             value: result.value,
             limit: options.limit,
-            tenantId: ctx.user.tenantId,
+            tenantId: resolveCapCounterScope(ctx, false).user.tenantId,
         });
         // Flip the soft-warned flag so the same period doesn't re-notify.
         const marked = await markCapSoftWarned(ctx, {
@@ -222,14 +212,11 @@ export async function enforceRollingCapAndMaybeNotify(ctx, options) {
         profile: options.profile,
     });
     if (result.state === "soft-hit") {
-        if (!ctx.user?.tenantId) {
-            throw new Error("cap-counter.enforceRollingCapAndMaybeNotify: ctx.user.tenantId missing — required for notification");
-        }
         await options.notify({
             capName: options.capName,
             value: result.value,
             limit: options.limit,
-            tenantId: ctx.user.tenantId,
+            tenantId: resolveCapCounterScope(ctx, false).user.tenantId,
         });
     }
     return result;

package/dist/cap-counter/entity.d.ts

@@ -4,6 +4,7 @@ export declare const capCounterEntity: import("@cosmicdrift/kumiko-types/fields"
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;

package/dist/cap-counter/feature.js

@@ -94,7 +94,13 @@ export const capCounterFeature = defineFeature(CAP_COUNTER_FEATURE, (r) => {
         id: CAP_COUNTER_LIST_SCREEN_ID,
         type: "entityList",
         entity: "cap-counter",
-        columns: ["tenantId", "capName", "value", "periodStart", "lastSoftWarnedAt"],
+        columns: [
+            "tenantId",
+            "capName",
+            "value",
+            "periodStart",
+            { field: "lastSoftWarnedAt", hideOnNarrow: true },
+        ],
         defaultSort: { field: "capName", dir: "asc" },
         // Search resolves against the caller's own tenant stream, so on this
         // cross-tenant operator list it would only ever hit the SystemAdmin's tenant.

package/dist/cap-counter/index.d.ts

@@ -1,5 +1,6 @@
 export { capCounterAggregateId, rollingCapAggregateId } from "./aggregate-id.js";
 export { type BookCapUsageOptions, bookCapUsage, type MarkCapSoftWarnedOptions, markCapSoftWarned, type ReadRollingCapUsageOptions, readRollingCapUsage, } from "./book-cap-usage.js";
+export { type CalendarCapUsageReservation, type CalendarCapUsageReservationSpec, reserveCalendarCapUsage, } from "./calendar-cap-usage-reservation.js";
 export { CAP_COUNTER_FEATURE, CAP_COUNTER_ROLLING_AGGREGATE_TYPE, CapCounterHandlers, CapCounterQueries, ROLLING_INCREMENTED_EVENT_QN, ROLLING_INCREMENTED_EVENT_SHORT, ROLLING_RELEASED_EVENT_QN, ROLLING_RELEASED_EVENT_SHORT, } from "./constants.js";
 export { CAP_TOLERANCES, CapExceededError, type CapToleranceProfile, type CapToleranceProfileName, currentCalendarMonthStartIso, type EnforceCapResult, enforceCap, enforceCapAndMaybeNotify, enforceRollingCap, enforceRollingCapAndMaybeNotify, enforceStockCap, type SoftHitNotifier, type StockCapResult, } from "./enforce-cap.js";
 export { capCounterEntity } from "./entity.js";

package/dist/cap-counter/index.js

@@ -1,6 +1,7 @@
 // Public API of the cap-counter bundled-feature.
 export { capCounterAggregateId, rollingCapAggregateId } from "./aggregate-id.js";
 export { bookCapUsage, markCapSoftWarned, readRollingCapUsage, } from "./book-cap-usage.js";
+export { reserveCalendarCapUsage, } from "./calendar-cap-usage-reservation.js";
 export { CAP_COUNTER_FEATURE, CAP_COUNTER_ROLLING_AGGREGATE_TYPE, CapCounterHandlers, CapCounterQueries, ROLLING_INCREMENTED_EVENT_QN, ROLLING_INCREMENTED_EVENT_SHORT, ROLLING_RELEASED_EVENT_QN, ROLLING_RELEASED_EVENT_SHORT, } from "./constants.js";
 export { CAP_TOLERANCES, CapExceededError, currentCalendarMonthStartIso, enforceCap, enforceCapAndMaybeNotify, enforceRollingCap, enforceRollingCapAndMaybeNotify, enforceStockCap, } from "./enforce-cap.js";
 export { capCounterEntity } from "./entity.js";

package/dist/cap-counter/with-cap-enforcement.js

@@ -23,8 +23,9 @@
 //
 // No automatic markSoftWarned here — that's inside enforceCapAndMaybeNotify
 // (enforce-cap.ts).
-import { releaseExpiredCapReservations, reserveCalendarCap, reserveRollingCap, } from "./cap-reservation.js";
-import { assertBelowHardCap, enforceCapAndMaybeNotify, enforceRollingCapAndMaybeNotify, } from "./enforce-cap.js";
+import { reserveEnforcedCalendarCap } from "./calendar-cap-usage-reservation.js";
+import { releaseExpiredCapReservations, reserveRollingCap } from "./cap-reservation.js";
+import { assertBelowHardCap, enforceRollingCapAndMaybeNotify, } from "./enforce-cap.js";
 import { chainReservations } from "./reservation-chain.js";
 /**
  * Wrap a write-handler with calendar-period cap-enforcement.
@@ -41,23 +42,7 @@ export function withCapEnforcement(handler, capResolver) {
         ...handler,
         reserveBeforeTransaction: chainReservations(handler.reserveBeforeTransaction, async (event, ctx) => {
             const cap = await capResolver(event, ctx);
-            await releaseExpiredCapReservations(ctx, cap.capName);
-            await enforceCapAndMaybeNotify(ctx, {
-                capName: cap.capName,
-                periodStartIso: cap.periodStartIso,
-                limit: cap.limit,
-                profile: cap.profile,
-                notify: cap.notify,
-                markSoftWarnedOutsideTransaction: true,
-                ...(cap.amount !== undefined && { amount: cap.amount }),
-            });
-            const amount = cap.amount ?? 1;
-            return reserveCalendarCap(ctx, {
-                capName: cap.capName,
-                amount,
-                periodStartIso: cap.periodStartIso,
-                guardCurrentValue: (currentValue) => assertBelowHardCap(currentValue + amount - 1, cap),
-            });
+            return reserveEnforcedCalendarCap(ctx, { ...cap, amount: cap.amount ?? 1 });
         }),
     };
 }

package/dist/cap-overview/screens.js

@@ -15,10 +15,12 @@ export function createTenantCapListScreen(caps, listCaps, tiers) {
             { field: "name", label: "cap-overview.list.col.name" },
             { field: "tier", label: "cap-overview.list.col.tier" },
             { field: "billing", label: "cap-overview.list.col.billing" },
-            ...listedCaps.map((cap) => ({
+            // Name is the title; tier, billing and the first cap fill the card's three meta rows.
+            ...listedCaps.map((cap, index) => ({
                 field: capFieldName(cap.id),
                 label: cap.label,
                 renderer: { react: { __component: CAP_USAGE_CELL_COMPONENT } },
+                ...(index > 0 && { hideOnNarrow: true }),
             })),
         ],
         searchable: true,

package/dist/config/table.d.ts

@@ -4,6 +4,7 @@ export declare const configValueEntity: import("@cosmicdrift/kumiko-types/fields
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -26,6 +27,7 @@ export declare const configValueEntity: import("@cosmicdrift/kumiko-types/fields
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -48,6 +50,7 @@ export declare const configValueEntity: import("@cosmicdrift/kumiko-types/fields
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -72,6 +75,7 @@ export declare const configValuesTable: import("@cosmicdrift/kumiko-framework/db
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -94,6 +98,7 @@ export declare const configValuesTable: import("@cosmicdrift/kumiko-framework/db
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -116,6 +121,7 @@ export declare const configValuesTable: import("@cosmicdrift/kumiko-framework/db
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;

package/dist/crypto-shredding/handlers/forget-subject.write.js

@@ -10,6 +10,7 @@ import { purgeSearchDocumentsForSubject } from "@cosmicdrift/kumiko-framework/se
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
 import * as z from "zod";
 import { resolveRetentionPolicyForTenant } from "../../data-retention/index.js";
+import { eraseNoteBodiesReachingSubject } from "../../notes-history-user-data/index.js";
 import { revokeAllPatTokensForUser } from "../../personal-access-tokens/index.js";
 import { USER_STATUS } from "../../user/index.js";
 import { denyIfTargetOutsideAdminTenant, isSystemAdminActor, updateUserLifecycle, } from "../../user-data-rights/index.js";
@@ -213,7 +214,7 @@ function sweepErrorLabel(err) {
 // The key is already erased when this runs, so a failing sweep must not skip the
 // audit event: the failure is returned as a label for the event instead of thrown.
 // The savepoint keeps a database error from aborting the handler transaction.
-async function sweepDerivedSubjectData(ctx, subject, subjectKey, crossTenantRunner) {
+async function sweepDerivedSubjectData(ctx, subject, subjectKey, crossTenantRunner, audit) {
     try {
         await runInSavepointIfSupported(crossTenantRunner, async (crossTenantSubjectRunner) => {
             // Blind-index sweep (#818): nulls bidx columns now so the deterministic
@@ -224,6 +225,15 @@ async function sweepDerivedSubjectData(ctx, subject, subjectKey, crossTenantRunn
             if (ctx.searchAdapter) {
                 await purgeSearchDocumentsForSubject(crossTenantSubjectRunner, ctx.registry.features, ctx.searchAdapter, subjectKey, subject);
             }
+            // Note bodies are keyed per note, so the subject's own key never reaches them.
+            if (ctx.registry.features.has("notes-history")) {
+                await eraseNoteBodiesReachingSubject({
+                    db: crossTenantSubjectRunner,
+                    subject,
+                    erasedBy: audit.erasedBy,
+                    requestId: audit.requestId,
+                });
+            }
         });
         return undefined;
     }
@@ -335,12 +345,13 @@ export const forgetSubjectWrite = defineWriteHandler({
         // but no event exists — a retry is a no-op erase plus the event. The
         // reverse order could leave an audit trail claiming a shred that never
         // happened.
+        const requestId = requestContext.get()?.requestId ?? "crypto-shredding:forget-subject";
         await kms.eraseKey(subject, {
-            requestId: requestContext.get()?.requestId ?? "crypto-shredding:forget-subject",
+            requestId,
             userId: event.user.id,
             eraseReason: event.payload.reason,
         });
-        const cleanupError = await sweepDerivedSubjectData(ctx, subject, subjectKey, ctx.db.unsafeRaw());
+        const cleanupError = await sweepDerivedSubjectData(ctx, subject, subjectKey, ctx.db.unsafeRaw(), { requestId, erasedBy: event.user.id });
         // User subject: close the login door. DEK-erase makes the passwordHash
         // ciphertext unreadable, but status + PATs are standalone credentials —
         // the PAT resolver only checks revokedAt/expiresAt, NOT user.status

package/dist/custom-fields/entity.d.ts

@@ -4,6 +4,7 @@ export declare const fieldDefinitionEntity: import("@cosmicdrift/kumiko-types/fi
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -26,6 +27,7 @@ export declare const fieldDefinitionEntity: import("@cosmicdrift/kumiko-types/fi
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -48,6 +50,7 @@ export declare const fieldDefinitionEntity: import("@cosmicdrift/kumiko-types/fi
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -95,6 +98,7 @@ export declare const fieldDefinitionEntity: import("@cosmicdrift/kumiko-types/fi
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;

package/dist/data-retention/schema/tenant-retention-override.d.ts

@@ -4,6 +4,7 @@ export declare const tenantRetentionOverrideEntity: import("@cosmicdrift/kumiko-
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -42,6 +43,7 @@ export declare const tenantRetentionOverrideEntity: import("@cosmicdrift/kumiko-
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -66,6 +68,7 @@ export declare const tenantRetentionOverrideTable: import("@cosmicdrift/kumiko-f
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -104,6 +107,7 @@ export declare const tenantRetentionOverrideTable: import("@cosmicdrift/kumiko-f
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;

package/dist/delivery/chat-webhook-sender.js

@@ -17,7 +17,7 @@ export const chatConnectionNameSchema = z
 function policyFor(request, target) {
     return request.requireHttps
         ? { kind: "external" }
-        : { kind: "internal", allowHosts: [target.hostname] };
+        : { kind: "internal", allowOrigins: [target.origin] };
 }
 function hostMatches(hostname, allowedHost) {
     const allowed = allowedHost.toLowerCase();

package/dist/delivery/constants.d.ts

@@ -1,6 +1,7 @@
 import type { NotifyPriority } from "@cosmicdrift/kumiko-framework/engine";
 export declare const DELIVERY_CHANNEL_EXTENSION: "deliveryChannel";
 export { DELIVERY_ATTEMPT_ADDRESS_ERASED_EVENT, DELIVERY_ATTEMPT_EVENT, DELIVERY_CHANNEL_CELL_COMPONENT, DELIVERY_ERROR_CELL_COMPONENT, DELIVERY_FEATURE, DELIVERY_LOG_SCREEN_ID, DELIVERY_RESUBSCRIBE_PATH, DELIVERY_STATUS_CELL_COMPONENT, DELIVERY_TIME_CELL_COMPONENT, DELIVERY_TYPE_CELL_COMPONENT, DELIVERY_UNSUBSCRIBE_PATH, DeliveryErrors, DeliveryHandlers, DeliveryJobNames, DeliveryQueries, DeliveryStatus, type DeliveryStatusValue, } from "./public-names.js";
+export declare function deliveryIdempotencyRedisKey(tenantId: string, key: string): string;
 export declare const deliveryPriorityRank: Record<NotifyPriority, number>;
 export declare const DeliveryJobs: {
     readonly render: string;

package/dist/delivery/constants.js

@@ -4,6 +4,10 @@ import { DELIVERY_FEATURE, DeliveryJobNames } from "./public-names.js";
 // channel-in-app, channel-push, ...).
 export const DELIVERY_CHANNEL_EXTENSION = "deliveryChannel";
 export { DELIVERY_ATTEMPT_ADDRESS_ERASED_EVENT, DELIVERY_ATTEMPT_EVENT, DELIVERY_CHANNEL_CELL_COMPONENT, DELIVERY_ERROR_CELL_COMPONENT, DELIVERY_FEATURE, DELIVERY_LOG_SCREEN_ID, DELIVERY_RESUBSCRIBE_PATH, DELIVERY_STATUS_CELL_COMPONENT, DELIVERY_TIME_CELL_COMPONENT, DELIVERY_TYPE_CELL_COMPONENT, DELIVERY_UNSUBSCRIBE_PATH, DeliveryErrors, DeliveryHandlers, DeliveryJobNames, DeliveryQueries, DeliveryStatus, } from "./public-names.js";
+// Single source for claim (delivery-service) and terminal-failure release (jobs).
+export function deliveryIdempotencyRedisKey(tenantId, key) {
+    return `delivery:idem:${tenantId}:${key}`;
+}
 // notify() priority → BullMQ job priority. Lower number = processed first; all
 // > 0 so prioritised delivery jobs never mix with BullMQ's "0 = unprioritised
 // FIFO" bucket. critical jobs jump ahead of normal/low in the worker queue.

package/dist/delivery/delivery-service.js

@@ -8,7 +8,7 @@ import { redactErrorText } from "../shared/index.js";
 import { hashUnsubscribeAddress } from "./address-opt-out.js";
 import { appendAttemptEvent, logAttempt } from "./attempt-log.js";
 import { buildChannelContext } from "./channel-context.js";
-import { DELIVERY_CHANNEL_EXTENSION, DeliveryJobs, deliveryPriorityRank } from "./constants.js";
+import { DELIVERY_CHANNEL_EXTENSION, DeliveryJobs, deliveryIdempotencyRedisKey, deliveryPriorityRank, } from "./constants.js";
 import { addressOptOutKey, selectOptedOutAddresses, } from "./db/queries/address-opt-outs.js";
 import { selectNotificationPreferences } from "./db/queries/preferences.js";
 import { isDeliveryChannelPlugin, } from "./types.js";
@@ -74,10 +74,28 @@ export function createDeliveryService(options) {
         if (!idemRedis) {
             throw new Error("Delivery idempotencyKey requires options.idempotencyRedis (or rateLimit.redis) to be configured");
         }
-        const k = `delivery:idem:${tenantId}:${key}`;
-        const res = await idemRedis.set(k, "1", "EX", ttlSec, "NX");
+        const res = await idemRedis.set(deliveryIdempotencyRedisKey(tenantId, key), "1", "EX", ttlSec, "NX");
         return res === "OK";
     }
+    function isDeliveredOrQueued(delivery) {
+        return delivery.status === "sent" || delivery.status === "queued";
+    }
+    // A key that guarded nothing must not turn the caller's retry into a skipped duplicate.
+    // Partial success keeps it: a retry would re-send to those who got it.
+    async function releaseIdempotencyIfNothingDelivered(tenantId, key, run) {
+        // skip: no key claimed, or a recipient already got the notification
+        if (!key || run.deliveries.some(isDeliveredOrQueued))
+            return;
+        await idemRedis?.del(deliveryIdempotencyRedisKey(tenantId, key));
+    }
+    // Only a single-channel route lets the queued job free the key on terminal failure
+    // without risking a duplicate send on another channel.
+    function jobIdempotencyKeyFor(idempotencyKey, route) {
+        if (!idempotencyKey || !route)
+            return undefined;
+        const routedChannelCount = channels.filter((channel) => route[channel.name]).length;
+        return routedChannelCount === 1 ? idempotencyKey : undefined;
+    }
     async function resolveUserIdsForTenant(tenantId) {
         if (!tenantUserIdsQuery) {
             throw new Error("Tenant broadcast requires tenantUserIdsQuery in DeliveryServiceOptions");
@@ -191,6 +209,7 @@ export function createDeliveryService(options) {
                 deliveryAttemptId,
                 priority,
                 message,
+                ...(run.jobIdempotencyKey !== undefined && { idempotencyKey: run.jobIdempotencyKey }),
             }, { priority: deliveryPriorityRank[priority] });
             recordDelivery(run, queuedEntry, deliveryAttemptId);
         }
@@ -517,14 +536,42 @@ export function createDeliveryService(options) {
             }
         }
     }
+    async function dispatchNotification(notificationType, options, tenantId, priority, run) {
+        const { to, route, data } = options;
+        if (route) {
+            await deliverDirect(route, notificationType, data, tenantId, priority, options.recipientId ?? null, run);
+            // skip: explicit route is delivered directly, no recipient resolution needed
+            return;
+        }
+        if (to !== undefined) {
+            let userIds;
+            if (typeof to === "string") {
+                userIds = [to];
+            }
+            else if ("tenant" in to) {
+                userIds = await resolveUserIdsForTenant(to.tenant);
+            }
+            else {
+                userIds = to;
+            }
+            const prefetchedAddresses = priority === "critical"
+                ? new Map()
+                : await prefetchUserAddresses(userIds, tenantId, notificationType);
+            const suppressed = await loadSuppressedAddresses(tenantId, notificationType, priority, [...prefetchedAddresses.values()].filter((address) => !!address));
+            for (const userId of userIds) {
+                await deliverToUser(userId, notificationType, data, tenantId, priority, run, prefetchedAddresses, suppressed);
+            }
+        }
+    }
     return {
         async notify(notificationType, options, _user, tenantId, jobDispatcher) {
-            const { to, route, data, idempotencyKey } = options;
+            const { route, idempotencyKey } = options;
             const priority = options.priority ?? "normal";
             const run = {
                 deliveries: [],
                 jobDispatcher: options.immediate ? undefined : (jobDispatcher ?? jobRunner),
                 locale: options.locale,
+                jobIdempotencyKey: jobIdempotencyKeyFor(idempotencyKey, route),
             };
             if (idempotencyKey) {
                 const first = await claimIdempotency(tenantId, idempotencyKey);
@@ -542,29 +589,19 @@ export function createDeliveryService(options) {
                     return { deliveries: run.deliveries };
                 }
             }
-            if (route) {
-                await deliverDirect(route, notificationType, data, tenantId, priority, options.recipientId ?? null, run);
-                return { deliveries: run.deliveries };
+            try {
+                await dispatchNotification(notificationType, options, tenantId, priority, run);
             }
-            if (to !== undefined) {
-                let userIds;
-                if (typeof to === "string") {
-                    userIds = [to];
-                }
-                else if ("tenant" in to) {
-                    userIds = await resolveUserIdsForTenant(to.tenant);
-                }
-                else {
-                    userIds = to;
-                }
-                const prefetchedAddresses = priority === "critical"
-                    ? new Map()
-                    : await prefetchUserAddresses(userIds, tenantId, notificationType);
-                const suppressed = await loadSuppressedAddresses(tenantId, notificationType, priority, [...prefetchedAddresses.values()].filter((address) => !!address));
-                for (const userId of userIds) {
-                    await deliverToUser(userId, notificationType, data, tenantId, priority, run, prefetchedAddresses, suppressed);
-                }
+            catch (err) {
+                // A failing release must not replace the dispatch error the caller retries on.
+                await releaseIdempotencyIfNothingDelivered(tenantId, idempotencyKey, run).catch((releaseErr) => {
+                    logError.warn(`idempotency key release failed: ${redactedMessageOf(releaseErr)}`, {
+                        notificationType,
+                    });
+                });
+                throw err;
             }
+            await releaseIdempotencyIfNothingDelivered(tenantId, idempotencyKey, run);
             return { deliveries: run.deliveries };
         },
     };

package/dist/delivery/feature.js

@@ -179,15 +179,21 @@ export function createDeliveryFeature(options) {
                     label: i18nKey("delivery.log.col.channel"),
                     renderer: { react: { __component: DELIVERY_CHANNEL_CELL_COMPONENT } },
                 },
-                { field: "recipientLabel", label: i18nKey("delivery.log.col.recipient") },
+                {
+                    field: "recipientLabel",
+                    label: i18nKey("delivery.log.col.recipient"),
+                    hideOnNarrow: true,
+                },
                 {
                     field: "status",
                     label: i18nKey("delivery.log.col.status"),
+                    hideOnNarrow: true,
                     renderer: { react: { __component: DELIVERY_STATUS_CELL_COMPONENT } },
                 },
                 {
                     field: "error",
                     label: i18nKey("delivery.log.col.error"),
+                    hideOnNarrow: true,
                     renderer: { react: { __component: DELIVERY_ERROR_CELL_COMPONENT } },
                 },
             ],

package/dist/delivery/jobs.js

@@ -8,7 +8,7 @@ import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { appendAttemptEvent } from "./attempt-log.js";
 import { buildChannelContext } from "./channel-context.js";
-import { DeliveryJobs, deliveryPriorityRank } from "./constants.js";
+import { DeliveryJobs, deliveryIdempotencyRedisKey, deliveryPriorityRank } from "./constants.js";
 import { collectChannels, redactedMessageOf } from "./delivery-service.js";
 const channelMessageSchema = z.object({
     notificationType: z.string(),
@@ -26,6 +26,7 @@ const renderJobPayloadSchema = z.object({
     deliveryAttemptId: z.string(),
     priority: z.enum(["critical", "normal", "low"]),
     message: channelMessageSchema,
+    idempotencyKey: z.string().optional(),
 });
 const sendJobPayloadSchema = renderJobPayloadSchema.extend({
     rendered: z
@@ -75,6 +76,28 @@ function entryFor(p, status, error, address, confirmed) {
         ...(confirmed === false && { confirmed }),
     };
 }
+// Only the final retry frees the key: earlier failures are retried by the runner and
+// must still dedup. Assumes ctx.redis is the handle the service claimed on; runProdApp
+// wires the same instance into both.
+async function releaseIdempotencyOnTerminalFailure(ctx, p) {
+    // skip: nothing to release before the last attempt or without an idempotency key
+    if (!ctx.finalAttempt || !p.idempotencyKey)
+        return;
+    if (!ctx.redis) {
+        ctx.log.warn("delivery: idempotency key not released, job context has no redis", {
+            notificationType: p.notificationType,
+        });
+        return;
+    }
+    try {
+        await ctx.redis.del(deliveryIdempotencyRedisKey(p.tenantId, p.idempotencyKey));
+    }
+    catch (err) {
+        ctx.log.warn(`delivery: idempotency key release failed: ${redactedMessageOf(err)}`, {
+            notificationType: p.notificationType,
+        });
+    }
+}
 // The job runner stores err.message in the run row, and BullMQ keeps failedReason and
 // the stack trace in Redis in plain text, so the rethrown error carries only the code.
 // The redacted message goes to the log.
@@ -85,6 +108,7 @@ async function failAttempt(ctx, db, registry, p, code, err) {
         channel: p.channelName,
     });
     await appendAttemptEvent(db, registry, p.deliveryAttemptId, entryFor(p, "failed", code, p.address));
+    await releaseIdempotencyOnTerminalFailure(ctx, p);
     throw new Error(code);
 }
 // Render the message and hand off to delivery.send. On failure: record the