@cosmicdrift/kumiko-samples 0.355.0 → 0.357.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-samples",
-  "version": "0.355.0",
+  "version": "0.357.0",
   "description": "Source trees of the Kumiko sample recipes, sample apps and bundled features in repo layout, for tooling such as few-shot corpus builds.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",

package/packages/bundled-features/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.355.0",
+  "version": "0.357.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",

package/packages/bundled-features/src/auth-mfa/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.357.0",
+    "type": "improvement",
+    "title": "MFA enable asks to confirm saved recovery codes, code field autocompletes one-time codes",
+    "detail": "secretMint `reveal.acknowledge` (i18n key) renders a checkbox on the reveal card that must be ticked before the confirm step or the acknowledge button can be used; the tick never reaches the payload. Text fields accept an `autoComplete` token that reaches the input. The MFA enable screen uses both: a \"saved my recovery codes\" gate and `one-time-code` on the code field"
+  },
   {
     "version": "0.354.0",
     "type": "breaking",

package/packages/bundled-features/src/auth-mfa/i18n.ts

@@ -28,6 +28,7 @@ export const AUTH_MFA_FEATURE_I18N: Readonly<Record<string, LocalizedString>> =
   "mfa.enable.reveal.qr": { en: "Scan this QR code" },
   "mfa.enable.reveal.secret": { en: "Or enter this code manually" },
   "mfa.enable.reveal.recoveryCodes": { en: "Recovery codes" },
+  "mfa.enable.reveal.savedCodes": { en: "I have saved my recovery codes." },
 
   "mfa.enable.confirm.submit": { en: "Enable" },
   "mfa.enable.confirm.done": { en: "Two-factor authentication is now enabled." },

package/packages/bundled-features/src/auth-mfa/screens.ts

@@ -34,6 +34,7 @@ export const mfaEnableScreen: SecretMintScreenDefinition = {
   reveal: {
     title: i18nKey("mfa.enable.reveal.title"),
     warning: i18nKey("mfa.enable.reveal.warning"),
+    acknowledge: i18nKey("mfa.enable.reveal.savedCodes"),
     fields: [
       {
         field: "otpauthUri",
@@ -58,7 +59,13 @@ export const mfaEnableScreen: SecretMintScreenDefinition = {
   confirm: {
     handler: AuthMfaHandlers.enableConfirm,
     fields: {
-      code: { type: "text", required: true, minLength: 6, maxLength: 6 },
+      code: {
+        type: "text",
+        required: true,
+        minLength: 6,
+        maxLength: 6,
+        autoComplete: "one-time-code",
+      },
     },
     layout: { sections: [{ fields: ["code"] }] },
     carry: ["setupToken"],

package/packages/bundled-features/src/cap-counter/feature.ts

@@ -119,7 +119,13 @@ export const capCounterFeature = defineFeature(CAP_COUNTER_FEATURE, (r) => {
     id: CAP_COUNTER_LIST_SCREEN_ID,
     type: "entityList",
     entity: "cap-counter",
-    columns: ["tenantId", "capName", "value", "periodStart", "lastSoftWarnedAt"],
+    columns: [
+      "tenantId",
+      "capName",
+      "value",
+      "periodStart",
+      { field: "lastSoftWarnedAt", hideOnNarrow: true },
+    ],
     defaultSort: { field: "capName", dir: "asc" },
     // Search resolves against the caller's own tenant stream, so on this
     // cross-tenant operator list it would only ever hit the SystemAdmin's tenant.

package/packages/bundled-features/src/cap-overview/screens.ts

@@ -31,10 +31,12 @@ export function createTenantCapListScreen(
       { field: "name", label: "cap-overview.list.col.name" },
       { field: "tier", label: "cap-overview.list.col.tier" },
       { field: "billing", label: "cap-overview.list.col.billing" },
-      ...listedCaps.map((cap) => ({
+      // Name is the title; tier, billing and the first cap fill the card's three meta rows.
+      ...listedCaps.map((cap, index) => ({
         field: capFieldName(cap.id),
         label: cap.label,
         renderer: { react: { __component: CAP_USAGE_CELL_COMPONENT } },
+        ...(index > 0 && { hideOnNarrow: true }),
       })),
     ],
     searchable: true,

package/packages/bundled-features/src/compliance-profiles/handlers/set-profile.write.ts

@@ -11,6 +11,7 @@ import {
   writeFailure,
 } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
+import { requireForTenant } from "../../shared/index.js";
 import {
   tenantComplianceProfileEntity,
   tenantComplianceProfileTable,
@@ -26,24 +27,16 @@ const crud = createEventStoreExecutor(tenantComplianceProfileTable, tenantCompli
 // SELECTABLE_PROFILE_KEYS aus der framework/compliance-Liste.
 const profileKeySchema = z.enum(SELECTABLE_PROFILE_KEYS);
 
-// Tenant-Admin setzt Profile-Key + optional Override-JSON.
+// Upsert: the first call inserts, later calls update, so repeating the same values
+// is idempotent apart from the extra audit events.
 //
-// Upsert-Verhalten: erste Wahl insert, weitere update. Idempotent —
-// wer mit gleichen Werten zweimal aufruft, kriegt das gleiche Ergebnis
-// (modulo aktualisierte Audit-Events im Event-Store).
+// A SystemAdmin may target another tenant via `tenantIdOverride` (operator setup,
+// onboarding migrations); the dispatcher rejects the override for anyone else. The
+// executor then writes into the target tenant's stream via streamTenantId while
+// the operator stays the recorded actor.
 //
-// Cross-Tenant-Pfad: SystemAdmin kann via `tenantIdOverride` fuer einen
-// anderen Tenant schreiben (Plattform-Operator-Setup, Customer-
-// Onboarding-Migrationen). TenantAdmin's Override-Versuch → 403.
-// executorUser.tenantId muss = ziel-tenant sein damit der event-store-
-// Stream-Lookup nicht miss → version_conflict gibt (Memory:
-// feedback_event_store_tenant_consistency).
-//
-// Validation:
-//   - profileKey muss in SELECTABLE_PROFILE_KEYS sein (Zod-checked)
-//   - override (optional) muss valides JSON-Object sein
-//   - override Top-Level-Keys muessen in ALLOWED_OVERRIDE_KEYS sein
-//     — verhindert Tippfehler die deepMerge stillschweigend ignoriert
+// Override top-level keys are restricted to ALLOWED_OVERRIDE_KEYS because deepMerge
+// would silently ignore a typo.
 export const setProfileWrite = defineWriteHandler({
   name: "set-profile",
   schema: z.object({
@@ -57,9 +50,8 @@ export const setProfileWrite = defineWriteHandler({
   description:
     "Sets or replaces a tenant's compliance profile key plus an optional JSON override, for onboarding or a later region change; a system admin may target a different tenant through tenantIdOverride.",
   handler: async (event, ctx) => {
-    const tenantOverride = event.payload.tenantIdOverride;
-    const tenantId = (tenantOverride ?? event.user.tenantId) as TenantId; // @cast-boundary engine-payload
-    const executorUser = tenantOverride !== undefined ? { ...event.user, tenantId } : event.user;
+    const tenantId = (event.payload.tenantIdOverride ?? event.user.tenantId) as TenantId; // @cast-boundary engine-payload
+    const { db, streamTenantId } = requireForTenant(ctx, tenantId);
 
     // Override-Validation: muss parseables JSON-Object sein UND dem
     // ComplianceProfileOverride-Schema entsprechen (S1.9 Z3 — strict-Zod
@@ -89,7 +81,7 @@ export const setProfileWrite = defineWriteHandler({
     }
 
     // Upsert: existierenden Eintrag suchen
-    const existing = (await fetchOne(ctx.db, tenantComplianceProfileTable, {
+    const existing = (await fetchOne(db, tenantComplianceProfileTable, {
       tenantId: tenantId,
     })) as { id: string; version: number } | null; // @cast-boundary db-runner
 
@@ -103,8 +95,9 @@ export const setProfileWrite = defineWriteHandler({
             override: event.payload.override ?? null,
           },
         },
-        executorUser,
-        ctx.db,
+        event.user,
+        db,
+        { streamTenantId },
       );
       if (!result.isSuccess) return result;
       return {
@@ -119,8 +112,9 @@ export const setProfileWrite = defineWriteHandler({
         override: event.payload.override ?? null,
         tenantId,
       },
-      executorUser,
-      ctx.db,
+      event.user,
+      db,
+      { streamTenantId },
     );
     if (!result.isSuccess) return result;
     return {

package/packages/bundled-features/src/crypto-shredding/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.357.0",
+    "type": "improvement",
+    "title": "forget-subject shreds note bodies attached to the subject and notes that mention it",
+    "detail": "`forget-subject` on a user or record subject now also erases the per-note keys of every `note-entry` that hangs on the subject as host entity (entityId, plus entityType for record subjects) or @-mentions it, unless the host entity's retention strategy is anonymize/blockDelete. The automated Art. 17 delete hook reaches notes on the user as host too, and the export lists them. Before, `forget-subject(contact)` left the note bodies readable. Consumer tests that expect readable note bodies after `forget-subject` on a contact (e.g. solon contact-notes-forget) now see the erased sentinel. Forgetting only the author still leaves the bodies readable."
+  },
   {
     "version": "0.354.0",
     "type": "fix",

package/packages/bundled-features/src/crypto-shredding/handlers/forget-subject.write.ts

@@ -40,6 +40,7 @@ import { purgeSearchDocumentsForSubject } from "@cosmicdrift/kumiko-framework/se
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
 import * as z from "zod";
 import { resolveRetentionPolicyForTenant } from "../../data-retention/index.js";
+import { eraseNoteBodiesReachingSubject } from "../../notes-history-user-data/index.js";
 import { revokeAllPatTokensForUser } from "../../personal-access-tokens/index.js";
 import { USER_STATUS } from "../../user/index.js";
 import {
@@ -300,6 +301,7 @@ async function sweepDerivedSubjectData(
   subject: SubjectId,
   subjectKey: string,
   crossTenantRunner: DbRunner,
+  audit: { readonly requestId: string; readonly erasedBy: string },
 ): Promise<string | undefined> {
   try {
     await runInSavepointIfSupported(crossTenantRunner, async (crossTenantSubjectRunner) => {
@@ -318,6 +320,17 @@ async function sweepDerivedSubjectData(
           subject,
         );
       }
+
+      // Note bodies are keyed per note, so the subject's own key never reaches them.
+      if (ctx.registry.features.has("notes-history")) {
+        await eraseNoteBodiesReachingSubject({
+          db: crossTenantSubjectRunner,
+          registry: ctx.registry,
+          subject,
+          erasedBy: audit.erasedBy,
+          requestId: audit.requestId,
+        });
+      }
     });
     return undefined;
   } catch (err) {
@@ -471,8 +484,9 @@ export const forgetSubjectWrite = defineWriteHandler({
     // but no event exists — a retry is a no-op erase plus the event. The
     // reverse order could leave an audit trail claiming a shred that never
     // happened.
+    const requestId = requestContext.get()?.requestId ?? "crypto-shredding:forget-subject";
     await kms.eraseKey(subject, {
-      requestId: requestContext.get()?.requestId ?? "crypto-shredding:forget-subject",
+      requestId,
       userId: event.user.id,
       eraseReason: event.payload.reason,
     });
@@ -482,6 +496,7 @@ export const forgetSubjectWrite = defineWriteHandler({
       subject,
       subjectKey,
       ctx.db.unsafeRaw(),
+      { requestId, erasedBy: event.user.id },
     );
 
     // User subject: close the login door. DEK-erase makes the passwordHash

package/packages/bundled-features/src/custom-fields/handlers/define-system-field.write.ts

@@ -1,20 +1,15 @@
 import { SYSTEM_TENANT_ID, type WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
+import { requireForTenant } from "../../shared/index.js";
 import { fieldDefinitionAggregateId } from "../aggregate-id.js";
 import { defineOrResurrectFieldDefinition } from "../lib/define-or-resurrect.js";
 import { buildFieldDefinitionColumns } from "../lib/field-definition-row.js";
 import { type DefineFieldPayload, defineFieldPayloadSchema } from "../schemas.js";
 
-// define-system-field — SystemAdmin definiert eine system-weite Custom-Field-
-// Definition die für ALLE Tenants gilt. tenantId wird auf SYSTEM_TENANT_ID
-// gesetzt (NICHT vom Caller — SystemAdmin's event.user.tenantId würde sonst
-// auf den admin's eigenen platform-tenant zeigen).
-//
-// **Use-Case:** Vendor (cdgs) sagt "alle Hausverwaltungs-customers haben ab
-// heute ein `internalNumber`-Field". Tenant kann den Wert pro customer
-// setzen, aber die Definition nicht ändern oder löschen.
-//
-// **Same-scope-conflict** wie bei define-tenant-field via aggregate-version-
-// conflict (deterministische ID mit tenantId=SYSTEM_TENANT_ID).
+// A system-wide field definition applies to every tenant. tenantId is forced to
+// SYSTEM_TENANT_ID (never taken from the caller) and addressed via streamTenantId,
+// so the SystemAdmin stays the recorded actor. Tenants can set values for the field
+// but cannot change or delete the definition. A same-scope duplicate surfaces as an
+// aggregate version conflict, because the ID is derived from SYSTEM_TENANT_ID.
 export const defineSystemFieldHandler: WriteHandlerDef = {
   name: "define-system-field",
   schema: defineFieldPayloadSchema,
@@ -30,16 +25,14 @@ export const defineSystemFieldHandler: WriteHandlerDef = {
       payload.fieldKey,
     );
 
-    // Override event.user.tenantId to SYSTEM_TENANT_ID for the system-scope
-    // write. The framework's CrudExecutor writes the row with this tenantId
-    // — the row lives in the system-scope-stream.
-    const systemUser = { ...event.user, tenantId: SYSTEM_TENANT_ID };
+    const { db, streamTenantId } = requireForTenant(ctx, SYSTEM_TENANT_ID);
 
     return defineOrResurrectFieldDefinition(
       aggregateId,
       buildFieldDefinitionColumns(payload),
-      systemUser,
-      ctx.db,
+      event.user,
+      db,
+      streamTenantId,
     );
   },
 };

package/packages/bundled-features/src/custom-fields/handlers/delete-system-field.write.ts

@@ -1,4 +1,5 @@
 import { SYSTEM_TENANT_ID, type WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
+import { requireForTenant } from "../../shared/index.js";
 import { fieldDefinitionAggregateId } from "../aggregate-id.js";
 import { FIELD_DEFINITION_AGGREGATE_TYPE } from "../constants.js";
 import { fieldDefinitionExecutor } from "../executor.js";
@@ -26,8 +27,10 @@ export const deleteSystemFieldHandler: WriteHandlerDef = {
       payload.fieldKey,
     );
 
-    const systemUser = { ...event.user, tenantId: SYSTEM_TENANT_ID };
-    const result = await fieldDefinitionExecutor.delete({ id: aggregateId }, systemUser, ctx.db);
+    const { db, streamTenantId } = requireForTenant(ctx, SYSTEM_TENANT_ID);
+    const result = await fieldDefinitionExecutor.delete({ id: aggregateId }, event.user, db, {
+      streamTenantId,
+    });
 
     // Cascade-cleanup-Event — host-entity-MSPs entfernen orphan values aus
     // ihrer customFields jsonb. Im selben TX = atomic.

package/packages/bundled-features/src/custom-fields/lib/define-or-resurrect.ts

@@ -1,3 +1,4 @@
+import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { fieldDefinitionExecutor } from "../executor.js";
 import type { FieldDefinitionColumns } from "./field-definition-row.js";
 
@@ -27,13 +28,18 @@ export async function defineOrResurrectFieldDefinition(
   columns: FieldDefinitionColumns,
   user: DefineUser,
   db: DefineDb,
+  streamTenantId?: TenantId,
 ): Promise<WriteResult> {
   const active = await fieldDefinitionExecutor.detail({ id: aggregateId }, user, db);
   if (active) {
-    return fieldDefinitionExecutor.create({ id: aggregateId, ...columns }, user, db);
+    return fieldDefinitionExecutor.create({ id: aggregateId, ...columns }, user, db, {
+      streamTenantId,
+    });
   }
 
-  const restored = await fieldDefinitionExecutor.restore({ id: aggregateId }, user, db);
+  const restored = await fieldDefinitionExecutor.restore({ id: aggregateId }, user, db, {
+    streamTenantId,
+  });
   if (restored.isSuccess) {
     // restore() just un-deleted the row in this same tx; no concurrent writer
     // exists, so skip the optimistic-lock version match (we'd otherwise have to
@@ -43,10 +49,13 @@ export async function defineOrResurrectFieldDefinition(
     // readonly FieldDefinitionColumns isn't assignable to it.
     return fieldDefinitionExecutor.update({ id: aggregateId, changes: { ...columns } }, user, db, {
       skipOptimisticLock: true,
+      streamTenantId,
     });
   }
   if (restored.error.code === "not_found") {
-    return fieldDefinitionExecutor.create({ id: aggregateId, ...columns }, user, db);
+    return fieldDefinitionExecutor.create({ id: aggregateId, ...columns }, user, db, {
+      streamTenantId,
+    });
   }
   return restored;
 }

package/packages/bundled-features/src/delivery/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.357.0",
+    "type": "improvement",
+    "title": "Delivery idempotencyKey is released when nothing was delivered",
+    "detail": "A retry of a failed notify() with the same idempotencyKey is no longer skipped as a duplicate. The key is deleted when no recipient got a `sent` or `queued` delivery, also when notify() throws; one successful recipient keeps it, even if notify() throws afterwards (a retry would re-send to them). For queued channels the send/render job deletes the key after its final failed attempt, not per retry. That reference is only attached when a `route` call has exactly one channel address; `to` calls (user lists) and multi-channel routes keep the key after queueing. The job payload gains an optional `idempotencyKey`, backward compatible. `createDeliveryTestContext` accepts `idempotencyRedis`."
+  },
   {
     "version": "0.354.0",
     "type": "breaking",

package/packages/bundled-features/src/delivery/chat-webhook-sender.ts

@@ -57,7 +57,7 @@ export type ChatWebhookRequest = ChatWebhookTarget & {
 function policyFor(request: ChatWebhookRequest, target: URL): EgressPolicy {
   return request.requireHttps
     ? { kind: "external" }
-    : { kind: "internal", allowHosts: [target.hostname] };
+    : { kind: "internal", allowOrigins: [target.origin] };
 }
 
 function hostMatches(hostname: string, allowedHost: string): boolean {

package/packages/bundled-features/src/delivery/constants.ts

@@ -26,6 +26,11 @@ export {
   type DeliveryStatusValue,
 } from "./public-names.js";
 
+// Single source for claim (delivery-service) and terminal-failure release (jobs).
+export function deliveryIdempotencyRedisKey(tenantId: string, key: string): string {
+  return `delivery:idem:${tenantId}:${key}`;
+}
+
 // notify() priority → BullMQ job priority. Lower number = processed first; all
 // > 0 so prioritised delivery jobs never mix with BullMQ's "0 = unprioritised
 // FIFO" bucket. critical jobs jump ahead of normal/low in the worker queue.

package/packages/bundled-features/src/delivery/delivery-service.ts

@@ -6,6 +6,7 @@ import type {
   EscapeHatchAuditSink,
   NotifyDelivery,
   NotifyJobDispatcher,
+  NotifyOptions,
   NotifyPriority,
   Registry,
   TenantId,
@@ -21,7 +22,12 @@ import { redactErrorText } from "../shared/index.js";
 import { hashUnsubscribeAddress } from "./address-opt-out.js";
 import { appendAttemptEvent, logAttempt } from "./attempt-log.js";
 import { buildChannelContext } from "./channel-context.js";
-import { DELIVERY_CHANNEL_EXTENSION, DeliveryJobs, deliveryPriorityRank } from "./constants.js";
+import {
+  DELIVERY_CHANNEL_EXTENSION,
+  DeliveryJobs,
+  deliveryIdempotencyRedisKey,
+  deliveryPriorityRank,
+} from "./constants.js";
 import {
   type AddressOptOutKey,
   addressOptOutKey,
@@ -171,11 +177,43 @@ export function createDeliveryService(options: DeliveryServiceOptions): Delivery
         "Delivery idempotencyKey requires options.idempotencyRedis (or rateLimit.redis) to be configured",
       );
     }
-    const k = `delivery:idem:${tenantId}:${key}`;
-    const res = await idemRedis.set(k, "1", "EX", ttlSec, "NX");
+    const res = await idemRedis.set(
+      deliveryIdempotencyRedisKey(tenantId, key),
+      "1",
+      "EX",
+      ttlSec,
+      "NX",
+    );
     return res === "OK";
   }
 
+  function isDeliveredOrQueued(delivery: NotifyDelivery): boolean {
+    return delivery.status === "sent" || delivery.status === "queued";
+  }
+
+  // A key that guarded nothing must not turn the caller's retry into a skipped duplicate.
+  // Partial success keeps it: a retry would re-send to those who got it.
+  async function releaseIdempotencyIfNothingDelivered(
+    tenantId: TenantId,
+    key: string | undefined,
+    run: NotifyRun,
+  ): Promise<void> {
+    // skip: no key claimed, or a recipient already got the notification
+    if (!key || run.deliveries.some(isDeliveredOrQueued)) return;
+    await idemRedis?.del(deliveryIdempotencyRedisKey(tenantId, key));
+  }
+
+  // Only a single-channel route lets the queued job free the key on terminal failure
+  // without risking a duplicate send on another channel.
+  function jobIdempotencyKeyFor(
+    idempotencyKey: string | undefined,
+    route: NotifyOptions["route"],
+  ): string | undefined {
+    if (!idempotencyKey || !route) return undefined;
+    const routedChannelCount = channels.filter((channel) => route[channel.name]).length;
+    return routedChannelCount === 1 ? idempotencyKey : undefined;
+  }
+
   async function resolveUserIdsForTenant(tenantId: TenantId): Promise<readonly string[]> {
     if (!tenantUserIdsQuery) {
       throw new Error("Tenant broadcast requires tenantUserIdsQuery in DeliveryServiceOptions");
@@ -233,6 +271,9 @@ export function createDeliveryService(options: DeliveryServiceOptions): Delivery
     readonly deliveries: NotifyDelivery[];
     readonly jobDispatcher: NotifyJobDispatcher | undefined;
     readonly locale: string | undefined;
+    // Set only when exactly one channel carries the call: the queued job may then free
+    // the key on terminal failure without risking a duplicate send on another channel.
+    readonly jobIdempotencyKey: string | undefined;
   };
 
   function recordDelivery(
@@ -343,6 +384,7 @@ export function createDeliveryService(options: DeliveryServiceOptions): Delivery
           deliveryAttemptId,
           priority,
           message,
+          ...(run.jobIdempotencyKey !== undefined && { idempotencyKey: run.jobIdempotencyKey }),
         },
         { priority: deliveryPriorityRank[priority] },
       );
@@ -745,14 +787,74 @@ export function createDeliveryService(options: DeliveryServiceOptions): Delivery
     }
   }
 
+  async function dispatchNotification(
+    notificationType: string,
+    options: NotifyOptions,
+    tenantId: TenantId,
+    priority: NotifyPriority,
+    run: NotifyRun,
+  ): Promise<void> {
+    const { to, route, data } = options;
+    if (route) {
+      await deliverDirect(
+        route,
+        notificationType,
+        data,
+        tenantId,
+        priority,
+        options.recipientId ?? null,
+        run,
+      );
+      // skip: explicit route is delivered directly, no recipient resolution needed
+      return;
+    }
+
+    if (to !== undefined) {
+      let userIds: readonly string[];
+
+      if (typeof to === "string") {
+        userIds = [to];
+      } else if ("tenant" in to) {
+        userIds = await resolveUserIdsForTenant(to.tenant);
+      } else {
+        userIds = to;
+      }
+
+      const prefetchedAddresses =
+        priority === "critical"
+          ? new Map<string, string | null>()
+          : await prefetchUserAddresses(userIds, tenantId, notificationType);
+      const suppressed = await loadSuppressedAddresses(
+        tenantId,
+        notificationType,
+        priority,
+        [...prefetchedAddresses.values()].filter((address): address is string => !!address),
+      );
+
+      for (const userId of userIds) {
+        await deliverToUser(
+          userId,
+          notificationType,
+          data,
+          tenantId,
+          priority,
+          run,
+          prefetchedAddresses,
+          suppressed,
+        );
+      }
+    }
+  }
+
   return {
     async notify(notificationType, options, _user, tenantId, jobDispatcher) {
-      const { to, route, data, idempotencyKey } = options;
+      const { route, idempotencyKey } = options;
       const priority: NotifyPriority = options.priority ?? "normal";
       const run: NotifyRun = {
         deliveries: [],
         jobDispatcher: options.immediate ? undefined : (jobDispatcher ?? jobRunner),
         locale: options.locale,
+        jobIdempotencyKey: jobIdempotencyKeyFor(idempotencyKey, route),
       };
 
       if (idempotencyKey) {
@@ -772,54 +874,20 @@ export function createDeliveryService(options: DeliveryServiceOptions): Delivery
         }
       }
 
-      if (route) {
-        await deliverDirect(
-          route,
-          notificationType,
-          data,
-          tenantId,
-          priority,
-          options.recipientId ?? null,
-          run,
-        );
-        return { deliveries: run.deliveries };
-      }
-
-      if (to !== undefined) {
-        let userIds: readonly string[];
-
-        if (typeof to === "string") {
-          userIds = [to];
-        } else if ("tenant" in to) {
-          userIds = await resolveUserIdsForTenant(to.tenant);
-        } else {
-          userIds = to;
-        }
-
-        const prefetchedAddresses =
-          priority === "critical"
-            ? new Map<string, string | null>()
-            : await prefetchUserAddresses(userIds, tenantId, notificationType);
-        const suppressed = await loadSuppressedAddresses(
-          tenantId,
-          notificationType,
-          priority,
-          [...prefetchedAddresses.values()].filter((address): address is string => !!address),
+      try {
+        await dispatchNotification(notificationType, options, tenantId, priority, run);
+      } catch (err) {
+        // A failing release must not replace the dispatch error the caller retries on.
+        await releaseIdempotencyIfNothingDelivered(tenantId, idempotencyKey, run).catch(
+          (releaseErr: unknown) => {
+            logError.warn(`idempotency key release failed: ${redactedMessageOf(releaseErr)}`, {
+              notificationType,
+            });
+          },
         );
-
-        for (const userId of userIds) {
-          await deliverToUser(
-            userId,
-            notificationType,
-            data,
-            tenantId,
-            priority,
-            run,
-            prefetchedAddresses,
-            suppressed,
-          );
-        }
+        throw err;
       }
+      await releaseIdempotencyIfNothingDelivered(tenantId, idempotencyKey, run);
       return { deliveries: run.deliveries };
     },
   };

package/packages/bundled-features/src/delivery/feature.ts

@@ -247,15 +247,21 @@ export function createDeliveryFeature(options?: DeliveryFeatureOptions): Feature
           label: i18nKey("delivery.log.col.channel"),
           renderer: { react: { __component: DELIVERY_CHANNEL_CELL_COMPONENT } },
         },
-        { field: "recipientLabel", label: i18nKey("delivery.log.col.recipient") },
+        {
+          field: "recipientLabel",
+          label: i18nKey("delivery.log.col.recipient"),
+          hideOnNarrow: true,
+        },
         {
           field: "status",
           label: i18nKey("delivery.log.col.status"),
+          hideOnNarrow: true,
           renderer: { react: { __component: DELIVERY_STATUS_CELL_COMPONENT } },
         },
         {
           field: "error",
           label: i18nKey("delivery.log.col.error"),
+          hideOnNarrow: true,
           renderer: { react: { __component: DELIVERY_ERROR_CELL_COMPONENT } },
         },
       ],