@cosmicdrift/kumiko-samples 0.364.0 → 0.365.0

package/packages/bundled-features/src/channel-email/changes.json

@@ -1,4 +1,22 @@
 [
+  {
+    "version": "0.365.0",
+    "type": "fix",
+    "title": "SMTP display names drop address-like characters, inline images get matching extensions",
+    "detail": "Control characters, angle brackets and at signs in a From display name are replaced by spaces so it cannot smuggle a second address; inline image file names derive their extension from the shared image format list."
+  },
+  {
+    "version": "0.365.0",
+    "type": "fix",
+    "title": "List-Unsubscribe accepts an app-owned unsubscribe URL",
+    "detail": "When unsubscribeUrl in the mail data points to an http(s) URL outside the framework unsubscribe route, the email channel sets List-Unsubscribe to that URL without the one-click List-Unsubscribe-Post header, because the framework cannot vouch for a foreign endpoint accepting POST. Other schemes set no header."
+  },
+  {
+    "version": "0.365.0",
+    "type": "fix",
+    "title": "A mail whose file attachment is missing fails at once instead of retrying",
+    "detail": "A missing or foreign-tenant file ref ends the delivery attempt as failed (send_failed) without a retry. The send job no longer throws, so the idempotency key is released and the caller can resend. A template test mail whose template file is missing now answers not_sent instead of channel_error."
+  },
   {
     "version": "0.363.0",
     "type": "breaking",

package/packages/bundled-features/src/channel-email/email-channel.ts

@@ -1,5 +1,6 @@
 import { PII_ERASED_SENTINEL } from "@cosmicdrift/kumiko-framework/crypto";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import * as z from "zod";
 import {
   type AttachmentOrigin,
@@ -15,7 +16,7 @@ import {
   type RenderedMessage,
   renderedPdfAttachmentRefSchema,
 } from "../delivery/index.js";
-import { decryptStoredPii } from "../shared/index.js";
+import { decryptStoredPii, extensionForResourceContentType } from "../shared/index.js";
 import { guardEmailMessage } from "./pii-guard.js";
 import type { EmailAttachment, EmailTransport } from "./types.js";
 
@@ -39,7 +40,8 @@ const UNSUBSCRIBE_HEADER_NAMES: ReadonlySet<string> = new Set([
   "list-unsubscribe-post",
 ]);
 
-// Only the framework's own unsubscribe route can honor a one-click POST.
+// Only the framework's own unsubscribe route can honor a one-click POST; an app's
+// own unsubscribe page still gets the plain List-Unsubscribe link (RFC 2369).
 function listUnsubscribeHeaders(
   data: Readonly<Record<string, unknown>> | undefined,
 ): Readonly<Record<string, string>> | undefined {
@@ -52,7 +54,9 @@ function listUnsubscribeHeaders(
     return undefined;
   }
   if (url.protocol !== "https:" && url.protocol !== "http:") return undefined;
-  if (url.pathname !== DELIVERY_UNSUBSCRIBE_PATH) return undefined;
+  if (url.pathname !== DELIVERY_UNSUBSCRIBE_PATH) {
+    return { "List-Unsubscribe": `<${url.toString()}>` };
+  }
   return {
     "List-Unsubscribe": `<${url.toString()}>`,
     "List-Unsubscribe-Post": DELIVERY_UNSUBSCRIBE_ONE_CLICK_HEADER_VALUE,
@@ -110,20 +114,22 @@ export function fileAttachmentsFrom(
     );
 }
 
-const INLINE_EXTENSION_BY_CONTENT_TYPE: Readonly<Record<string, string>> = {
-  "image/png": "png",
-  "image/jpeg": "jpg",
-  "image/gif": "gif",
-  "image/webp": "webp",
-};
-
 type AttachmentSource = { readonly ref: EmailAttachmentRef; readonly origin: AttachmentOrigin };
 
+function inlineFileName(cid: string, contentType: string): string {
+  const extension = extensionForResourceContentType(contentType);
+  return extension === undefined ? cid : `${cid}.${extension}`;
+}
+
+type ResolvedAttachments =
+  | { readonly kind: "resolved"; readonly attachments: readonly EmailAttachment[] }
+  | { readonly kind: "missing-file"; readonly fileRefId: string };
+
 async function resolveAttachments(
   sources: readonly AttachmentSource[],
   ctx: ChannelContext,
-): Promise<readonly EmailAttachment[]> {
-  if (sources.length === 0) return [];
+): Promise<ResolvedAttachments> {
+  if (sources.length === 0) return { kind: "resolved", attachments: [] };
   if (ctx.readAttachment === undefined) {
     throw new Error(
       "email channel: the message has attachments but the channel context cannot read files",
@@ -148,17 +154,13 @@ async function resolveAttachments(
     if (found === null) {
       // A missing inline image only degrades the look; a missing file is content the recipient expects.
       if (ref.kind === "inline") continue;
-      throw new Error(`email channel: attachment file ${ref.fileRefId} was not found`);
+      return { kind: "missing-file", fileRefId: ref.fileRefId };
     }
     const fileName =
-      ref.kind === "file"
-        ? ref.fileName
-        : INLINE_EXTENSION_BY_CONTENT_TYPE[found.contentType]
-          ? `${ref.cid}.${INLINE_EXTENSION_BY_CONTENT_TYPE[found.contentType]}`
-          : ref.cid;
+      ref.kind === "file" ? ref.fileName : inlineFileName(ref.cid, found.contentType);
     resolved.push({ ...ref, fileName, content: found.content, contentType: found.contentType });
   }
-  return resolved;
+  return { kind: "resolved", attachments: resolved };
 }
 
 export type EmailChannelOptions = {
@@ -232,7 +234,7 @@ export function createEmailChannel(options: EmailChannelOptions): DeliveryChanne
         ...(replyTo && { replyTo }),
         ...emailEnvelopeFrom(message.data),
       };
-      const resolvedAttachments = await resolveAttachments(
+      const resolution = await resolveAttachments(
         [
           ...(attachments ?? []).map((ref): AttachmentSource => ({ ref, origin: "template" })),
           ...fileAttachmentsFrom(message.data, message.locale).map(
@@ -241,6 +243,14 @@ export function createEmailChannel(options: EmailChannelOptions): DeliveryChanne
         ],
         ctx,
       );
+      if (resolution.kind === "missing-file") {
+        // A missing file is permanent, a retry cannot bring it back.
+        createFallbackLogger("delivery").warn("mail attachment file not found, send failed", {
+          fileRefId: resolution.fileRefId,
+        });
+        return { status: "failed", error: "send_failed", address };
+      }
+      const resolvedAttachments = resolution.attachments;
       await transport.send(
         guardEmailMessage({
           to: address,

package/packages/bundled-features/src/channel-email/smtp-transport.ts

@@ -54,11 +54,17 @@ function isControlCharacter(char: string): boolean {
   return code <= 0x1f || code === 0x7f;
 }
 
+// Mail clients often show only the display name: an embedded address ("<", ">", "@") would
+// pass for a foreign sender on the platform's own SPF/DKIM-signed domain.
+function isUnsafeDisplayNameCharacter(char: string): boolean {
+  return isControlCharacter(char) || char === "<" || char === ">" || char === "@";
+}
+
 // Control characters in a display name would let a caller inject headers.
 function sanitizedDisplayName(name: string | undefined): string | undefined {
   const cleaned = name
     ?.split("")
-    .map((char) => (isControlCharacter(char) ? " " : char))
+    .map((char) => (isUnsafeDisplayNameCharacter(char) ? " " : char))
     .join("")
     .trim();
   return cleaned === undefined || cleaned === "" ? undefined : cleaned;

package/packages/bundled-features/src/channel-slack/slack-channel.ts

@@ -7,9 +7,11 @@ import {
 
 export type SlackChannelOptions = ChatWebhookChannelOptions;
 
+const SLACK_WEBHOOK_PREFIX = "channel-slack:webhooks.";
+
 export const SLACK_SECRET_KEYS = {
-  webhookPrefix: "channel-slack:webhooks.",
-  webhookKeyFor: (connection: string) => `channel-slack:webhooks.${connection}`,
+  webhookPrefix: SLACK_WEBHOOK_PREFIX,
+  webhookKeyFor: (connection: string) => `${SLACK_WEBHOOK_PREFIX}${connection}`,
 } as const;
 
 export const SLACK_DEFAULT_ALLOWED_HOSTS = ["hooks.slack.com"] as const;

package/packages/bundled-features/src/channel-teams/teams-channel.ts

@@ -8,9 +8,11 @@ import {
 
 export type TeamsChannelOptions = ChatWebhookChannelOptions;
 
+const TEAMS_WEBHOOK_PREFIX = "channel-teams:webhooks.";
+
 export const TEAMS_SECRET_KEYS = {
-  webhookPrefix: "channel-teams:webhooks.",
-  webhookKeyFor: (connection: string) => `channel-teams:webhooks.${connection}`,
+  webhookPrefix: TEAMS_WEBHOOK_PREFIX,
+  webhookKeyFor: (connection: string) => `${TEAMS_WEBHOOK_PREFIX}${connection}`,
 } as const;
 
 export const TEAMS_DEFAULT_ALLOWED_HOSTS = [

package/packages/bundled-features/src/crypto-shredding/handlers/forget-subject.write.ts

@@ -21,6 +21,7 @@ import {
   recordRowExistsInTenant,
   recordRowOwningTenantId,
   subjectRowExistsInTenant,
+  WritePurposes,
 } from "@cosmicdrift/kumiko-framework/db";
 import {
   defineWriteHandler,
@@ -360,7 +361,12 @@ async function closeUserLoginDoor(
   if (!userRow) return;
 
   const closeDoor = async (runner: DbRunner): Promise<void> => {
-    await updateUserLifecycle(runner, userId, { status: USER_STATUS.Deleted });
+    await updateUserLifecycle(
+      runner,
+      userId,
+      { status: USER_STATUS.Deleted },
+      { writePurpose: WritePurposes.erasure },
+    );
     if (ctx.registry.features.has("personal-access-tokens")) {
       await revokeAllPatTokensForUser(runner, userId);
     }

package/packages/bundled-features/src/custom-fields/db/queries/retention.ts

@@ -1,5 +1,5 @@
 import { asRawClient, unsafeReadRetrying } from "@cosmicdrift/kumiko-framework/bun-db";
-import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
+import { type DbRunner, toPostgresArrayLiteral } from "@cosmicdrift/kumiko-framework/db";
 
 export async function selectHostRowsWithCustomFields(
   db: DbRunner,
@@ -38,6 +38,6 @@ export async function applyRetentionRemovals(
        ELSE custom_fields
      END
      WHERE id = $3`,
-    [deleteKeys, anonymizeKeys, rowId],
+    [toPostgresArrayLiteral(deleteKeys), toPostgresArrayLiteral(anonymizeKeys), rowId],
   );
 }

package/packages/bundled-features/src/data-retention/run-retention-cleanup.ts

@@ -57,7 +57,7 @@ import {
   type WhereObject,
   WritePurposes,
 } from "@cosmicdrift/kumiko-framework/db";
-import { deleteStoredFileAndDerivatives } from "@cosmicdrift/kumiko-framework/derivatives";
+import { deleteFileRefBytes } from "@cosmicdrift/kumiko-framework/derivatives";
 import {
   createSystemUser,
   type EntityDefinition,
@@ -386,11 +386,11 @@ async function isFileRefSharedByOtherRow(
 // not abort the whole tenant run.
 async function deleteFileFailingClosed(
   key: string,
-  store: Parameters<typeof deleteStoredFileAndDerivatives>[1],
+  files: FileContext,
   logContext: string,
 ): Promise<readonly string[]> {
   try {
-    return await deleteStoredFileAndDerivatives(key, store, "data-retention:hardDelete");
+    return await deleteFileRefBytes(files, { storageKey: key }, "data-retention:hardDelete");
   } catch (err) {
     // biome-ignore lint/suspicious/noConsole: operator-visibility for storage-cleanup failures
     console.warn(
@@ -477,7 +477,6 @@ async function purgeHardDeleteRowWithFiles(args: {
     return false;
   }
   const files = args.files;
-  const store = { list: files.list, delete: (key: string) => files.ref(key).delete() };
 
   let anyFailed = false;
   for (const fileRef of toDelete) {
@@ -485,7 +484,7 @@ async function purgeHardDeleteRowWithFiles(args: {
     if (typeof key !== "string" || key.length === 0) continue;
     const failedKeys = await deleteFileFailingClosed(
       key,
-      store,
+      files,
       `tenant=${args.tenantId} entity=${args.entityName} row=${rowId}`,
     );
     if (failedKeys.length > 0) {

package/packages/bundled-features/src/delivery/attachment-ref.ts

@@ -55,14 +55,31 @@ export const fileAttachmentRefSchema = z
   })
   .strict();
 
+// BigInt values and cycles make JSON.stringify throw; that must surface as a validation issue,
+// not a raw TypeError that a retrying job hits again on the same data.
+function isJsonSerializable(value: unknown): boolean {
+  try {
+    JSON.stringify(value);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function jsonByteLength(value: unknown): number {
+  return new TextEncoder().encode(JSON.stringify(value)).byteLength;
+}
+
 export const renderedPdfAttachmentRefSchema = z
   .object({
     kind: z.literal("rendered-pdf"),
     templateSlug: templateSlugSchema,
     variables: z
       .record(z.string(), z.unknown())
+      .refine(isJsonSerializable, { message: "variables must be JSON-serializable" })
       .refine(
-        (value) => Buffer.byteLength(JSON.stringify(value)) <= MAX_RENDERED_PDF_VARIABLES_BYTES,
+        (value) =>
+          !isJsonSerializable(value) || jsonByteLength(value) <= MAX_RENDERED_PDF_VARIABLES_BYTES,
         {
           message: `variables must not exceed ${MAX_RENDERED_PDF_VARIABLES_BYTES} bytes as JSON`,
         },

package/packages/bundled-features/src/delivery/changes.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.365.0",
+    "type": "fix",
+    "title": "Rendered-PDF attachment variables must be JSON-serializable",
+    "detail": "BigInt values or cycles in rendered-pdf variables now fail validation instead of throwing a TypeError that a retrying job hits again."
+  },
+  {
+    "version": "0.365.0",
+    "type": "fix",
+    "title": "Delivery checks opt-outs for addresses resolved on the retry path and logs idempotency release failures",
+    "detail": "The kill switch, preference and rate-limit result per recipient channel is computed once in the prefetch and reused when delivering; the rate limit now runs before the address is resolved. When the prefetch resolve failed and the address is resolved again, the suppression list is reloaded for exactly that address, so an unsubscribed address no longer receives the mail. A failing idempotency-key release is logged and swallowed instead of masking the delivery outcome."
+  },
   {
     "version": "0.364.0",
     "type": "fix",

package/packages/bundled-features/src/delivery/delivery-service.ts

@@ -205,14 +205,23 @@ export function createDeliveryService(options: DeliveryServiceOptions): Delivery
 
   // A key that guarded nothing must not turn the caller's retry into a skipped duplicate.
   // Partial success keeps it: a retry would re-send to those who got it.
+  // A failing release is logged and swallowed: it must neither replace the dispatch error the
+  // caller retries on nor fail a notify() that already dispatched.
   async function releaseIdempotencyIfNothingDelivered(
     tenantId: TenantId,
     key: string | undefined,
     run: NotifyRun,
+    notificationType: string,
   ): Promise<void> {
     // skip: no key claimed, or a recipient already got the notification
     if (!key || run.deliveries.some(isDeliveredOrQueued)) return;
-    await idemRedis?.del(deliveryIdempotencyRedisKey(tenantId, key));
+    try {
+      await idemRedis?.del(deliveryIdempotencyRedisKey(tenantId, key));
+    } catch (releaseErr) {
+      logError.warn(`idempotency key release failed: ${redactedMessageOf(releaseErr)}`, {
+        notificationType,
+      });
+    }
   }
 
   // Only a single-channel route lets the queued job free the key on terminal failure
@@ -508,29 +517,53 @@ export function createDeliveryService(options: DeliveryServiceOptions): Delivery
 
   const recipientChannelKey = (userId: string, channelName: string) => `${userId}|${channelName}`;
 
-  async function isChannelDeliverable(
+  type ChannelGate = "open" | "channel_disabled" | "preference_disabled" | "rate_limited";
+  type PrefetchedRecipients = {
+    readonly addresses: ReadonlyMap<string, string | null>;
+    readonly gates: ReadonlyMap<string, ChannelGate>;
+  };
+
+  // Kill switch, then the user's preference, then the rate limit — the order deliverToUser reports
+  // skips in. The rate limit consumes a token, so each recipient/channel pair is evaluated once.
+  async function evaluateChannelGate(
     run: NotifyRun,
     userId: string,
     tenantId: TenantId,
     notificationType: string,
     channelName: string,
-  ): Promise<boolean> {
-    if (isChannelKilled && (await isChannelKilled(tenantId, channelName))) return false;
-    return isChannelEnabled(run, userId, tenantId, notificationType, channelName);
+    priority: NotifyPriority,
+  ): Promise<ChannelGate> {
+    if (isChannelKilled && (await isChannelKilled(tenantId, channelName))) {
+      return "channel_disabled";
+    }
+    // Critical priority skips the preference check
+    if (
+      priority !== "critical" &&
+      !(await isChannelEnabled(run, userId, tenantId, notificationType, channelName))
+    ) {
+      return "preference_disabled";
+    }
+    if (rateLimit && !(await checkRateLimit(rateLimit, tenantId, channelName))) {
+      return "rate_limited";
+    }
+    return "open";
   }
 
   // Resolves every user's channel addresses up front so the opt-out lookup can
-  // cover them all at once. A resolve that throws stays out of the map: the
-  // delivery loop resolves it again and reports channel_error as before.
-  // Channels the kill switch or the user's preferences disable are never resolved
-  // here: resolve may have side effects and deliverToUser skips those channels.
-  async function prefetchUserAddresses(
+  // cover them all at once. A resolve that throws stays out of the address map:
+  // the delivery loop resolves it again and reports channel_error as before.
+  // Channels that are gated (kill switch, preferences, rate limit) are never resolved
+  // here: resolve may have side effects and deliverToUser skips those channels. The
+  // gate verdict is kept so deliverToUser does not query it a second time.
+  async function prefetchRecipients(
     run: NotifyRun,
     userIds: readonly string[],
     tenantId: TenantId,
     notificationType: string,
-  ): Promise<Map<string, string | null>> {
+    priority: NotifyPriority,
+  ): Promise<PrefetchedRecipients> {
     const addresses = new Map<string, string | null>();
+    const gates = new Map<string, ChannelGate>();
     const channelCtx = buildChannelContext(
       run.db,
       registry,
@@ -543,22 +576,25 @@ export function createDeliveryService(options: DeliveryServiceOptions): Delivery
     for (const userId of userIds) {
       for (const channel of channels) {
         if (!channel.resolve) continue;
+        const key = recipientChannelKey(userId, channel.name);
         try {
-          if (
-            !(await isChannelDeliverable(run, userId, tenantId, notificationType, channel.name))
-          ) {
-            continue;
-          }
-          addresses.set(
-            recipientChannelKey(userId, channel.name),
-            await channel.resolve(userId, channelCtx),
+          const gate = await evaluateChannelGate(
+            run,
+            userId,
+            tenantId,
+            notificationType,
+            channel.name,
+            priority,
           );
+          gates.set(key, gate);
+          if (gate !== "open") continue;
+          addresses.set(key, await channel.resolve(userId, channelCtx));
         } catch {
           // skip: re-resolved (and logged) by deliverToUser
         }
       }
     }
-    return addresses;
+    return { addresses, gates };
   }
 
   // Check if user has disabled this notification+channel combo.
@@ -605,7 +641,7 @@ export function createDeliveryService(options: DeliveryServiceOptions): Delivery
     tenantId: TenantId,
     priority: NotifyPriority,
     run: NotifyRun,
-    prefetchedAddresses: ReadonlyMap<string, string | null>,
+    prefetched: PrefetchedRecipients,
     suppressed: ReadonlySet<AddressOptOutKey>,
   ): Promise<void> {
     const channelCtx = buildChannelContext(
@@ -624,70 +660,35 @@ export function createDeliveryService(options: DeliveryServiceOptions): Delivery
 
       const message = buildMessage(notificationType, data, channel.name, run.locale);
 
-      // Kill switch: tenant admin disabled this channel entirely
-      if (isChannelKilled) {
-        const killed = await isChannelKilled(tenantId, channel.name);
-        if (killed) {
-          await logDelivery(run, {
-            tenantId,
-            notificationType,
-            channel: channel.name,
-            recipientId: userId,
-            recipientAddress: null,
-            status: "skipped",
-            error: "channel_disabled",
-            priority,
-          });
-          continue;
-        }
-      }
-
-      // Check preferences (critical priority skips preference check)
-      if (priority !== "critical") {
-        const enabled = await isChannelEnabled(
+      const prefetchKey = recipientChannelKey(userId, channel.name);
+      const gate =
+        prefetched.gates.get(prefetchKey) ??
+        (await evaluateChannelGate(
           run,
           userId,
           tenantId,
           notificationType,
           channel.name,
-        );
-        if (!enabled) {
-          await logDelivery(run, {
-            tenantId,
-            notificationType,
-            channel: channel.name,
-            recipientId: userId,
-            recipientAddress: null,
-            status: "skipped",
-            error: "preference_disabled",
-            priority,
-          });
-          continue;
-        }
-      }
-
-      // Rate limiting
-      if (rateLimit) {
-        const allowed = await checkRateLimit(rateLimit, tenantId, channel.name);
-        if (!allowed) {
-          await logDelivery(run, {
-            tenantId,
-            notificationType,
-            channel: channel.name,
-            recipientId: userId,
-            recipientAddress: null,
-            status: "skipped",
-            error: "rate_limited",
-            priority,
-          });
-          continue;
-        }
+          priority,
+        ));
+      if (gate !== "open") {
+        await logDelivery(run, {
+          tenantId,
+          notificationType,
+          channel: channel.name,
+          recipientId: userId,
+          recipientAddress: null,
+          status: "skipped",
+          error: gate,
+          priority,
+        });
+        continue;
       }
 
       try {
-        const prefetchKey = recipientChannelKey(userId, channel.name);
-        const address = prefetchedAddresses.has(prefetchKey)
-          ? prefetchedAddresses.get(prefetchKey)
+        const wasPrefetched = prefetched.addresses.has(prefetchKey);
+        const address = wasPrefetched
+          ? prefetched.addresses.get(prefetchKey)
           : await channel.resolve(userId, channelCtx);
         if (!address) {
           await logDelivery(run, {
@@ -703,7 +704,14 @@ export function createDeliveryService(options: DeliveryServiceOptions): Delivery
           continue;
         }
 
-        if (priority !== "critical" && isAddressSuppressed(suppressed, address, channel.name)) {
+        // A fallback resolve yields an address the batched opt-out lookup never covered.
+        const suppressedForAddress = wasPrefetched
+          ? suppressed
+          : await loadSuppressedAddresses(run, tenantId, notificationType, priority, [address]);
+        if (
+          priority !== "critical" &&
+          isAddressSuppressed(suppressedForAddress, address, channel.name)
+        ) {
           await logDelivery(run, {
             tenantId,
             notificationType,
@@ -878,16 +886,16 @@ export function createDeliveryService(options: DeliveryServiceOptions): Delivery
         userIds = to;
       }
 
-      const prefetchedAddresses =
+      const prefetched: PrefetchedRecipients =
         priority === "critical"
-          ? new Map<string, string | null>()
-          : await prefetchUserAddresses(run, userIds, tenantId, notificationType);
+          ? { addresses: new Map(), gates: new Map() }
+          : await prefetchRecipients(run, userIds, tenantId, notificationType, priority);
       const suppressed = await loadSuppressedAddresses(
         run,
         tenantId,
         notificationType,
         priority,
-        [...prefetchedAddresses.values()].filter((address): address is string => !!address),
+        [...prefetched.addresses.values()].filter((address): address is string => !!address),
       );
 
       for (const userId of userIds) {
@@ -898,7 +906,7 @@ export function createDeliveryService(options: DeliveryServiceOptions): Delivery
           tenantId,
           priority,
           run,
-          prefetchedAddresses,
+          prefetched,
           suppressed,
         );
       }
@@ -955,17 +963,10 @@ export function createDeliveryService(options: DeliveryServiceOptions): Delivery
       try {
         await dispatchNotification(notificationType, options, tenantId, priority, run);
       } catch (err) {
-        // A failing release must not replace the dispatch error the caller retries on.
-        await releaseIdempotencyIfNothingDelivered(tenantId, idempotencyKey, run).catch(
-          (releaseErr: unknown) => {
-            logError.warn(`idempotency key release failed: ${redactedMessageOf(releaseErr)}`, {
-              notificationType,
-            });
-          },
-        );
+        await releaseIdempotencyIfNothingDelivered(tenantId, idempotencyKey, run, notificationType);
         throw err;
       }
-      await releaseIdempotencyIfNothingDelivered(tenantId, idempotencyKey, run);
+      await releaseIdempotencyIfNothingDelivered(tenantId, idempotencyKey, run, notificationType);
       return dispatched(run);
     },
   };

package/packages/bundled-features/src/document-ingest-foundation/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.365.0",
+    "type": "fix",
+    "title": "Ingest events: correlate by event type and payload.fileRefId",
+    "detail": "New documentIngest events live on their own stream while older ones stay on the fileRef stream (aggregateId = fileRefId). Consumers must not correlate by aggregateId or the fileRef stream version."
+  },
   {
     "version": "0.362.0",
     "type": "fix",

package/packages/bundled-features/src/feature-toggles/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.365.0",
+    "type": "fix",
+    "title": "Overlapping toggle refreshes no longer drop a flip, and the runtime can reuse the server cache-sync bus",
+    "detail": "initialize() and refresh() now run one snapshot load at a time, so a flip applied while a second load is in flight is kept instead of being overwritten by older rows. createFeatureToggleRuntime takes an optional fourth cacheSyncBus argument; with it no second bus (and no extra Redis connections) is created and close() leaves the shared bus open.",
+    "migration": "Pass the server's cache-sync bus as the fourth argument of createFeatureToggleRuntime to avoid the additional Redis publisher and subscriber connections of the default bus; without it the runtime still builds and closes its own bus."
+  },
   {
     "version": "0.336.0",
     "type": "fix",