@cosmicdrift/kumiko-samples 0.356.0 → 0.358.0

package/packages/bundled-features/src/cap-counter/enforce-cap.ts

@@ -1,7 +1,12 @@
-import { createEntityExecutor, type HandlerContext } from "@cosmicdrift/kumiko-framework/engine";
+import { createEntityExecutor } from "@cosmicdrift/kumiko-framework/engine";
 import { KumikoError, reraiseAsKumikoError } from "@cosmicdrift/kumiko-framework/errors";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
-import { markCapSoftWarned, readRollingCapUsage } from "./book-cap-usage.js";
+import {
+  type CapCounterContext,
+  markCapSoftWarned,
+  readRollingCapUsage,
+  resolveCapCounterScope,
+} from "./book-cap-usage.js";
 import { capCounterEntity } from "./entity.js";
 
 const { table } = createEntityExecutor("cap-counter", capCounterEntity);
@@ -95,7 +100,7 @@ export function assertBelowHardCap(
  * level (e.g. uniqueness-index on apps.tenantId+slot-number).
  */
 export async function enforceCap(
-  ctx: HandlerContext,
+  ctx: CapCounterContext,
   options: {
     readonly capName: string;
     readonly periodStartIso: string;
@@ -106,9 +111,7 @@ export async function enforceCap(
     readonly amount?: number;
   },
 ): Promise<EnforceCapResult> {
-  if (!ctx.db) {
-    throw new Error("cap-counter.enforceCap: ctx.db missing — run inside a handler context");
-  }
+  const { user, readDb } = resolveCapCounterScope(ctx, false);
 
   const amount = options.amount ?? 1;
   if (!Number.isInteger(amount) || amount < 1) {
@@ -120,9 +123,9 @@ export async function enforceCap(
   const tolerance = CAP_TOLERANCES[options.profile];
   const softThreshold = options.limit * tolerance.soft;
 
-  const rows = await ctx.db.selectMany(
+  const rows = await readDb.selectMany(
     table,
-    { capName: options.capName, periodStart: options.periodStartIso },
+    { tenantId: user.tenantId, capName: options.capName, periodStart: options.periodStartIso },
     { limit: 1 },
   );
 
@@ -170,7 +173,7 @@ export async function enforceCap(
  * vorgezogen.
  */
 export async function enforceRollingCap(
-  ctx: HandlerContext,
+  ctx: CapCounterContext,
   options: {
     readonly capName: string;
     readonly windowDays: number;
@@ -178,20 +181,13 @@ export async function enforceRollingCap(
     readonly profile: CapToleranceProfileName;
   },
 ): Promise<EnforceCapResult> {
-  if (!ctx.db) {
-    throw new Error("cap-counter.enforceRollingCap: ctx.db missing — run inside a handler context");
-  }
-  if (!ctx.user?.tenantId) {
-    throw new Error(
-      "cap-counter.enforceRollingCap: ctx.user.tenantId missing — required to compute aggregate-id",
-    );
-  }
+  const { user, readDb } = resolveCapCounterScope(ctx, false);
 
   const tolerance = CAP_TOLERANCES[options.profile];
   const softThreshold = options.limit * tolerance.soft;
   const hardThreshold = options.limit * tolerance.hard;
 
-  const value = await readRollingCapUsage(ctx.db, ctx.user.tenantId, {
+  const value = await readRollingCapUsage(readDb, user.tenantId, {
     capName: options.capName,
     windowDays: options.windowDays,
   });
@@ -295,7 +291,7 @@ export type SoftHitNotifier = (info: {
  * Email-Notification).
  */
 export async function enforceCapAndMaybeNotify(
-  ctx: HandlerContext,
+  ctx: CapCounterContext,
   options: {
     readonly capName: string;
     readonly periodStartIso: string;
@@ -315,16 +311,11 @@ export async function enforceCapAndMaybeNotify(
   });
 
   if (result.state === "soft-hit" && result.crossed) {
-    if (!ctx.user?.tenantId) {
-      throw new Error(
-        "cap-counter.enforceCapAndMaybeNotify: ctx.user.tenantId missing — required for notification",
-      );
-    }
     await options.notify({
       capName: options.capName,
       value: result.value,
       limit: options.limit,
-      tenantId: ctx.user.tenantId,
+      tenantId: resolveCapCounterScope(ctx, false).user.tenantId,
     });
     // Flip the soft-warned flag so the same period doesn't re-notify.
     const marked = await markCapSoftWarned(ctx, {
@@ -349,7 +340,7 @@ export async function enforceCapAndMaybeNotify(
  * Tag/Stunde auf (Hourly-Cron statt pro Request).
  */
 export async function enforceRollingCapAndMaybeNotify(
-  ctx: HandlerContext,
+  ctx: CapCounterContext,
   options: {
     readonly capName: string;
     readonly windowDays: number;
@@ -366,16 +357,11 @@ export async function enforceRollingCapAndMaybeNotify(
   });
 
   if (result.state === "soft-hit") {
-    if (!ctx.user?.tenantId) {
-      throw new Error(
-        "cap-counter.enforceRollingCapAndMaybeNotify: ctx.user.tenantId missing — required for notification",
-      );
-    }
     await options.notify({
       capName: options.capName,
       value: result.value,
       limit: options.limit,
-      tenantId: ctx.user.tenantId,
+      tenantId: resolveCapCounterScope(ctx, false).user.tenantId,
     });
   }
 

package/packages/bundled-features/src/cap-counter/feature.ts

@@ -119,7 +119,13 @@ export const capCounterFeature = defineFeature(CAP_COUNTER_FEATURE, (r) => {
     id: CAP_COUNTER_LIST_SCREEN_ID,
     type: "entityList",
     entity: "cap-counter",
-    columns: ["tenantId", "capName", "value", "periodStart", "lastSoftWarnedAt"],
+    columns: [
+      "tenantId",
+      "capName",
+      "value",
+      "periodStart",
+      { field: "lastSoftWarnedAt", hideOnNarrow: true },
+    ],
     defaultSort: { field: "capName", dir: "asc" },
     // Search resolves against the caller's own tenant stream, so on this
     // cross-tenant operator list it would only ever hit the SystemAdmin's tenant.

package/packages/bundled-features/src/cap-counter/index.ts

@@ -9,6 +9,11 @@ export {
   type ReadRollingCapUsageOptions,
   readRollingCapUsage,
 } from "./book-cap-usage.js";
+export {
+  type CalendarCapUsageReservation,
+  type CalendarCapUsageReservationSpec,
+  reserveCalendarCapUsage,
+} from "./calendar-cap-usage-reservation.js";
 export {
   CAP_COUNTER_FEATURE,
   CAP_COUNTER_ROLLING_AGGREGATE_TYPE,

package/packages/bundled-features/src/cap-counter/with-cap-enforcement.ts

@@ -29,15 +29,11 @@ import type {
   WriteEvent,
   WriteHandlerDef,
 } from "@cosmicdrift/kumiko-framework/engine";
-import {
-  releaseExpiredCapReservations,
-  reserveCalendarCap,
-  reserveRollingCap,
-} from "./cap-reservation.js";
+import { reserveEnforcedCalendarCap } from "./calendar-cap-usage-reservation.js";
+import { releaseExpiredCapReservations, reserveRollingCap } from "./cap-reservation.js";
 import {
   assertBelowHardCap,
   type CapToleranceProfileName,
-  enforceCapAndMaybeNotify,
   enforceRollingCapAndMaybeNotify,
   type SoftHitNotifier,
 } from "./enforce-cap.js";
@@ -93,25 +89,7 @@ export function withCapEnforcement(
       handler.reserveBeforeTransaction,
       async (event, ctx) => {
         const cap = await capResolver(event, ctx);
-
-        await releaseExpiredCapReservations(ctx, cap.capName);
-        await enforceCapAndMaybeNotify(ctx, {
-          capName: cap.capName,
-          periodStartIso: cap.periodStartIso,
-          limit: cap.limit,
-          profile: cap.profile,
-          notify: cap.notify,
-          markSoftWarnedOutsideTransaction: true,
-          ...(cap.amount !== undefined && { amount: cap.amount }),
-        });
-
-        const amount = cap.amount ?? 1;
-        return reserveCalendarCap(ctx, {
-          capName: cap.capName,
-          amount,
-          periodStartIso: cap.periodStartIso,
-          guardCurrentValue: (currentValue) => assertBelowHardCap(currentValue + amount - 1, cap),
-        });
+        return reserveEnforcedCalendarCap(ctx, { ...cap, amount: cap.amount ?? 1 });
       },
     ),
   };

package/packages/bundled-features/src/cap-overview/screens.ts

@@ -31,10 +31,12 @@ export function createTenantCapListScreen(
       { field: "name", label: "cap-overview.list.col.name" },
       { field: "tier", label: "cap-overview.list.col.tier" },
       { field: "billing", label: "cap-overview.list.col.billing" },
-      ...listedCaps.map((cap) => ({
+      // Name is the title; tier, billing and the first cap fill the card's three meta rows.
+      ...listedCaps.map((cap, index) => ({
         field: capFieldName(cap.id),
         label: cap.label,
         renderer: { react: { __component: CAP_USAGE_CELL_COMPONENT } },
+        ...(index > 0 && { hideOnNarrow: true }),
       })),
     ],
     searchable: true,

package/packages/bundled-features/src/crypto-shredding/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.357.0",
+    "type": "improvement",
+    "title": "forget-subject shreds note bodies attached to the subject and notes that mention it",
+    "detail": "`forget-subject` on a user or record subject now also erases the per-note keys of every `note-entry` that hangs on the subject as host entity (entityId, plus entityType for record subjects) or @-mentions it, unless the host entity's retention strategy is anonymize/blockDelete. The automated Art. 17 delete hook reaches notes on the user as host too, and the export lists them. Before, `forget-subject(contact)` left the note bodies readable. Consumer tests that expect readable note bodies after `forget-subject` on a contact (e.g. solon contact-notes-forget) now see the erased sentinel. Forgetting only the author still leaves the bodies readable."
+  },
   {
     "version": "0.354.0",
     "type": "fix",

package/packages/bundled-features/src/crypto-shredding/handlers/forget-subject.write.ts

@@ -40,6 +40,7 @@ import { purgeSearchDocumentsForSubject } from "@cosmicdrift/kumiko-framework/se
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
 import * as z from "zod";
 import { resolveRetentionPolicyForTenant } from "../../data-retention/index.js";
+import { eraseNoteBodiesReachingSubject } from "../../notes-history-user-data/index.js";
 import { revokeAllPatTokensForUser } from "../../personal-access-tokens/index.js";
 import { USER_STATUS } from "../../user/index.js";
 import {
@@ -300,6 +301,7 @@ async function sweepDerivedSubjectData(
   subject: SubjectId,
   subjectKey: string,
   crossTenantRunner: DbRunner,
+  audit: { readonly requestId: string; readonly erasedBy: string },
 ): Promise<string | undefined> {
   try {
     await runInSavepointIfSupported(crossTenantRunner, async (crossTenantSubjectRunner) => {
@@ -318,6 +320,16 @@ async function sweepDerivedSubjectData(
           subject,
         );
       }
+
+      // Note bodies are keyed per note, so the subject's own key never reaches them.
+      if (ctx.registry.features.has("notes-history")) {
+        await eraseNoteBodiesReachingSubject({
+          db: crossTenantSubjectRunner,
+          subject,
+          erasedBy: audit.erasedBy,
+          requestId: audit.requestId,
+        });
+      }
     });
     return undefined;
   } catch (err) {
@@ -471,8 +483,9 @@ export const forgetSubjectWrite = defineWriteHandler({
     // but no event exists — a retry is a no-op erase plus the event. The
     // reverse order could leave an audit trail claiming a shred that never
     // happened.
+    const requestId = requestContext.get()?.requestId ?? "crypto-shredding:forget-subject";
     await kms.eraseKey(subject, {
-      requestId: requestContext.get()?.requestId ?? "crypto-shredding:forget-subject",
+      requestId,
       userId: event.user.id,
       eraseReason: event.payload.reason,
     });
@@ -482,6 +495,7 @@ export const forgetSubjectWrite = defineWriteHandler({
       subject,
       subjectKey,
       ctx.db.unsafeRaw(),
+      { requestId, erasedBy: event.user.id },
     );
 
     // User subject: close the login door. DEK-erase makes the passwordHash

package/packages/bundled-features/src/delivery/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.357.0",
+    "type": "improvement",
+    "title": "Delivery idempotencyKey is released when nothing was delivered",
+    "detail": "A retry of a failed notify() with the same idempotencyKey is no longer skipped as a duplicate. The key is deleted when no recipient got a `sent` or `queued` delivery, also when notify() throws; one successful recipient keeps it, even if notify() throws afterwards (a retry would re-send to them). For queued channels the send/render job deletes the key after its final failed attempt, not per retry. That reference is only attached when a `route` call has exactly one channel address; `to` calls (user lists) and multi-channel routes keep the key after queueing. The job payload gains an optional `idempotencyKey`, backward compatible. `createDeliveryTestContext` accepts `idempotencyRedis`."
+  },
   {
     "version": "0.354.0",
     "type": "breaking",

package/packages/bundled-features/src/delivery/chat-webhook-sender.ts

@@ -57,7 +57,7 @@ export type ChatWebhookRequest = ChatWebhookTarget & {
 function policyFor(request: ChatWebhookRequest, target: URL): EgressPolicy {
   return request.requireHttps
     ? { kind: "external" }
-    : { kind: "internal", allowHosts: [target.hostname] };
+    : { kind: "internal", allowOrigins: [target.origin] };
 }
 
 function hostMatches(hostname: string, allowedHost: string): boolean {

package/packages/bundled-features/src/delivery/constants.ts

@@ -26,6 +26,11 @@ export {
   type DeliveryStatusValue,
 } from "./public-names.js";
 
+// Single source for claim (delivery-service) and terminal-failure release (jobs).
+export function deliveryIdempotencyRedisKey(tenantId: string, key: string): string {
+  return `delivery:idem:${tenantId}:${key}`;
+}
+
 // notify() priority → BullMQ job priority. Lower number = processed first; all
 // > 0 so prioritised delivery jobs never mix with BullMQ's "0 = unprioritised
 // FIFO" bucket. critical jobs jump ahead of normal/low in the worker queue.

package/packages/bundled-features/src/delivery/delivery-service.ts

@@ -6,6 +6,7 @@ import type {
   EscapeHatchAuditSink,
   NotifyDelivery,
   NotifyJobDispatcher,
+  NotifyOptions,
   NotifyPriority,
   Registry,
   TenantId,
@@ -21,7 +22,12 @@ import { redactErrorText } from "../shared/index.js";
 import { hashUnsubscribeAddress } from "./address-opt-out.js";
 import { appendAttemptEvent, logAttempt } from "./attempt-log.js";
 import { buildChannelContext } from "./channel-context.js";
-import { DELIVERY_CHANNEL_EXTENSION, DeliveryJobs, deliveryPriorityRank } from "./constants.js";
+import {
+  DELIVERY_CHANNEL_EXTENSION,
+  DeliveryJobs,
+  deliveryIdempotencyRedisKey,
+  deliveryPriorityRank,
+} from "./constants.js";
 import {
   type AddressOptOutKey,
   addressOptOutKey,
@@ -171,11 +177,43 @@ export function createDeliveryService(options: DeliveryServiceOptions): Delivery
         "Delivery idempotencyKey requires options.idempotencyRedis (or rateLimit.redis) to be configured",
       );
     }
-    const k = `delivery:idem:${tenantId}:${key}`;
-    const res = await idemRedis.set(k, "1", "EX", ttlSec, "NX");
+    const res = await idemRedis.set(
+      deliveryIdempotencyRedisKey(tenantId, key),
+      "1",
+      "EX",
+      ttlSec,
+      "NX",
+    );
     return res === "OK";
   }
 
+  function isDeliveredOrQueued(delivery: NotifyDelivery): boolean {
+    return delivery.status === "sent" || delivery.status === "queued";
+  }
+
+  // A key that guarded nothing must not turn the caller's retry into a skipped duplicate.
+  // Partial success keeps it: a retry would re-send to those who got it.
+  async function releaseIdempotencyIfNothingDelivered(
+    tenantId: TenantId,
+    key: string | undefined,
+    run: NotifyRun,
+  ): Promise<void> {
+    // skip: no key claimed, or a recipient already got the notification
+    if (!key || run.deliveries.some(isDeliveredOrQueued)) return;
+    await idemRedis?.del(deliveryIdempotencyRedisKey(tenantId, key));
+  }
+
+  // Only a single-channel route lets the queued job free the key on terminal failure
+  // without risking a duplicate send on another channel.
+  function jobIdempotencyKeyFor(
+    idempotencyKey: string | undefined,
+    route: NotifyOptions["route"],
+  ): string | undefined {
+    if (!idempotencyKey || !route) return undefined;
+    const routedChannelCount = channels.filter((channel) => route[channel.name]).length;
+    return routedChannelCount === 1 ? idempotencyKey : undefined;
+  }
+
   async function resolveUserIdsForTenant(tenantId: TenantId): Promise<readonly string[]> {
     if (!tenantUserIdsQuery) {
       throw new Error("Tenant broadcast requires tenantUserIdsQuery in DeliveryServiceOptions");
@@ -233,6 +271,9 @@ export function createDeliveryService(options: DeliveryServiceOptions): Delivery
     readonly deliveries: NotifyDelivery[];
     readonly jobDispatcher: NotifyJobDispatcher | undefined;
     readonly locale: string | undefined;
+    // Set only when exactly one channel carries the call: the queued job may then free
+    // the key on terminal failure without risking a duplicate send on another channel.
+    readonly jobIdempotencyKey: string | undefined;
   };
 
   function recordDelivery(
@@ -343,6 +384,7 @@ export function createDeliveryService(options: DeliveryServiceOptions): Delivery
           deliveryAttemptId,
           priority,
           message,
+          ...(run.jobIdempotencyKey !== undefined && { idempotencyKey: run.jobIdempotencyKey }),
         },
         { priority: deliveryPriorityRank[priority] },
       );
@@ -745,14 +787,74 @@ export function createDeliveryService(options: DeliveryServiceOptions): Delivery
     }
   }
 
+  async function dispatchNotification(
+    notificationType: string,
+    options: NotifyOptions,
+    tenantId: TenantId,
+    priority: NotifyPriority,
+    run: NotifyRun,
+  ): Promise<void> {
+    const { to, route, data } = options;
+    if (route) {
+      await deliverDirect(
+        route,
+        notificationType,
+        data,
+        tenantId,
+        priority,
+        options.recipientId ?? null,
+        run,
+      );
+      // skip: explicit route is delivered directly, no recipient resolution needed
+      return;
+    }
+
+    if (to !== undefined) {
+      let userIds: readonly string[];
+
+      if (typeof to === "string") {
+        userIds = [to];
+      } else if ("tenant" in to) {
+        userIds = await resolveUserIdsForTenant(to.tenant);
+      } else {
+        userIds = to;
+      }
+
+      const prefetchedAddresses =
+        priority === "critical"
+          ? new Map<string, string | null>()
+          : await prefetchUserAddresses(userIds, tenantId, notificationType);
+      const suppressed = await loadSuppressedAddresses(
+        tenantId,
+        notificationType,
+        priority,
+        [...prefetchedAddresses.values()].filter((address): address is string => !!address),
+      );
+
+      for (const userId of userIds) {
+        await deliverToUser(
+          userId,
+          notificationType,
+          data,
+          tenantId,
+          priority,
+          run,
+          prefetchedAddresses,
+          suppressed,
+        );
+      }
+    }
+  }
+
   return {
     async notify(notificationType, options, _user, tenantId, jobDispatcher) {
-      const { to, route, data, idempotencyKey } = options;
+      const { route, idempotencyKey } = options;
       const priority: NotifyPriority = options.priority ?? "normal";
       const run: NotifyRun = {
         deliveries: [],
         jobDispatcher: options.immediate ? undefined : (jobDispatcher ?? jobRunner),
         locale: options.locale,
+        jobIdempotencyKey: jobIdempotencyKeyFor(idempotencyKey, route),
       };
 
       if (idempotencyKey) {
@@ -772,54 +874,20 @@ export function createDeliveryService(options: DeliveryServiceOptions): Delivery
         }
       }
 
-      if (route) {
-        await deliverDirect(
-          route,
-          notificationType,
-          data,
-          tenantId,
-          priority,
-          options.recipientId ?? null,
-          run,
-        );
-        return { deliveries: run.deliveries };
-      }
-
-      if (to !== undefined) {
-        let userIds: readonly string[];
-
-        if (typeof to === "string") {
-          userIds = [to];
-        } else if ("tenant" in to) {
-          userIds = await resolveUserIdsForTenant(to.tenant);
-        } else {
-          userIds = to;
-        }
-
-        const prefetchedAddresses =
-          priority === "critical"
-            ? new Map<string, string | null>()
-            : await prefetchUserAddresses(userIds, tenantId, notificationType);
-        const suppressed = await loadSuppressedAddresses(
-          tenantId,
-          notificationType,
-          priority,
-          [...prefetchedAddresses.values()].filter((address): address is string => !!address),
+      try {
+        await dispatchNotification(notificationType, options, tenantId, priority, run);
+      } catch (err) {
+        // A failing release must not replace the dispatch error the caller retries on.
+        await releaseIdempotencyIfNothingDelivered(tenantId, idempotencyKey, run).catch(
+          (releaseErr: unknown) => {
+            logError.warn(`idempotency key release failed: ${redactedMessageOf(releaseErr)}`, {
+              notificationType,
+            });
+          },
         );
-
-        for (const userId of userIds) {
-          await deliverToUser(
-            userId,
-            notificationType,
-            data,
-            tenantId,
-            priority,
-            run,
-            prefetchedAddresses,
-            suppressed,
-          );
-        }
+        throw err;
       }
+      await releaseIdempotencyIfNothingDelivered(tenantId, idempotencyKey, run);
       return { deliveries: run.deliveries };
     },
   };

package/packages/bundled-features/src/delivery/feature.ts

@@ -247,15 +247,21 @@ export function createDeliveryFeature(options?: DeliveryFeatureOptions): Feature
           label: i18nKey("delivery.log.col.channel"),
           renderer: { react: { __component: DELIVERY_CHANNEL_CELL_COMPONENT } },
         },
-        { field: "recipientLabel", label: i18nKey("delivery.log.col.recipient") },
+        {
+          field: "recipientLabel",
+          label: i18nKey("delivery.log.col.recipient"),
+          hideOnNarrow: true,
+        },
         {
           field: "status",
           label: i18nKey("delivery.log.col.status"),
+          hideOnNarrow: true,
           renderer: { react: { __component: DELIVERY_STATUS_CELL_COMPONENT } },
         },
         {
           field: "error",
           label: i18nKey("delivery.log.col.error"),
+          hideOnNarrow: true,
           renderer: { react: { __component: DELIVERY_ERROR_CELL_COMPONENT } },
         },
       ],

package/packages/bundled-features/src/delivery/jobs.ts

@@ -18,7 +18,7 @@ import type { JobRunner } from "@cosmicdrift/kumiko-framework/jobs";
 import * as z from "zod";
 import { appendAttemptEvent } from "./attempt-log.js";
 import { buildChannelContext } from "./channel-context.js";
-import { DeliveryJobs, deliveryPriorityRank } from "./constants.js";
+import { DeliveryJobs, deliveryIdempotencyRedisKey, deliveryPriorityRank } from "./constants.js";
 import { collectChannels, redactedMessageOf } from "./delivery-service.js";
 import type {
   ChannelMessage,
@@ -44,6 +44,7 @@ const renderJobPayloadSchema = z.object({
   deliveryAttemptId: z.string(),
   priority: z.enum(["critical", "normal", "low"]),
   message: channelMessageSchema,
+  idempotencyKey: z.string().optional(),
 });
 
 const sendJobPayloadSchema = renderJobPayloadSchema.extend({
@@ -110,6 +111,30 @@ function entryFor(
   };
 }
 
+// Only the final retry frees the key: earlier failures are retried by the runner and
+// must still dedup. Assumes ctx.redis is the handle the service claimed on; runProdApp
+// wires the same instance into both.
+async function releaseIdempotencyOnTerminalFailure(
+  ctx: JobContext,
+  p: RenderJobPayload,
+): Promise<void> {
+  // skip: nothing to release before the last attempt or without an idempotency key
+  if (!ctx.finalAttempt || !p.idempotencyKey) return;
+  if (!ctx.redis) {
+    ctx.log.warn("delivery: idempotency key not released, job context has no redis", {
+      notificationType: p.notificationType,
+    });
+    return;
+  }
+  try {
+    await ctx.redis.del(deliveryIdempotencyRedisKey(p.tenantId, p.idempotencyKey));
+  } catch (err) {
+    ctx.log.warn(`delivery: idempotency key release failed: ${redactedMessageOf(err)}`, {
+      notificationType: p.notificationType,
+    });
+  }
+}
+
 // The job runner stores err.message in the run row, and BullMQ keeps failedReason and
 // the stack trace in Redis in plain text, so the rethrown error carries only the code.
 // The redacted message goes to the log.
@@ -132,6 +157,7 @@ async function failAttempt(
     p.deliveryAttemptId,
     entryFor(p, "failed", code, p.address),
   );
+  await releaseIdempotencyOnTerminalFailure(ctx, p);
   throw new Error(code);
 }
 

package/packages/bundled-features/src/delivery/testing.ts

@@ -18,6 +18,7 @@ export type CreateDeliveryTestContextOptions = {
   readonly log?: Logger;
   readonly jobRunner?: JobRunner;
   readonly secrets?: SecretsContext;
+  readonly idempotencyRedis?: Redis;
 };
 
 /**