backend-manager 5.2.12 → 5.2.13

package/CHANGELOG.md

@@ -14,6 +14,23 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 - `Fixed` for any bug fixes.
 - `Security` in case of vulnerabilities.
 
+# [5.2.13] - 2026-05-28
+
+### Removed
+
+- **Dropped the `marketing-webhooks` Firestore idempotency ledger.** The marketing-webhook dispatcher (`src/manager/routes/marketing/webhook/post.js`) no longer reads/writes `marketing-webhooks/{eventId}` docs for dedup. Both handler side effects — writing `consent.marketing.status = 'revoked'` and the cross-provider `mailer.remove()` — are naturally idempotent, so a provider retry or duplicate parent fan-out re-runs to the same end state with no extra side effects. (This is the key difference from `payments-webhooks`, where dedup is load-bearing because payment side effects are NOT idempotent.) Events with no `eventId` are now processed instead of skipped, since dedup is no longer required. Removed `marketing-webhooks` from the test runner's pre-test cleanup list (`src/test/test-accounts.js`). Consumers with an existing `marketing-webhooks` collection can safely delete it — nothing reads or writes it anymore.
+
+### Fixed
+
+- **`libraries/infer-contact.js`: guard the optional `assistant` arg.** All log/error calls now use `assistant?.` so `inferContact(email)` works without an assistant. Previously threw a `TypeError` when `BACKEND_MANAGER_OPENAI_API_KEY` was unset and no assistant was passed.
+- **`libraries/email/marketing/index.js`: gate `Marketing.remove()` behind test mode.** `remove()` now short-circuits with `if (assistant.isTesting() && !process.env.TEST_EXTENDED_MODE) return {}`, matching `add()` and `sync()`. Closes a gap where auth `onDelete` (fired ~44× at test startup during user cleanup) could hit the live SendGrid/Beehiiv remove APIs during a normal test run. The gate lives at the library SSOT so every caller (onDelete, webhook processors, contact-delete route) inherits it.
+
+### Changed
+
+- **Dependency bumps**: `@anthropic-ai/claude-agent-sdk` ^0.3.152 → ^0.3.153, `stripe` ^22.1.1 → ^22.2.0.
+- **`templates/_.env`**: consolidate OpenAI/Anthropic keys under an "AI" section and add `CLAUDE_CODE_OAUTH_TOKEN`.
+- **Marketing webhook tests** (`test/routes/marketing/webhook.js`): renamed `*-duplicate-event-skipped` → `*-reprocessed-idempotently` (assert re-delivery reprocesses and the user stays revoked); `sendgrid-event-without-eventId-*` now asserts the event is processed; beehiiv idempotency variant skips when no publication is configured. Updated `docs/consent.md` and `docs/testing.md` to describe the no-ledger design.
+
 # [5.2.12] - 2026-05-27
 
 ### Changed

package/docs/consent.md

@@ -121,9 +121,9 @@ POST /backend-manager/marketing/webhook?provider=beehiiv&key=<BACKEND_MANAGER_WE
 The dispatcher loads `processors/{provider}.js`, parses the event(s), and for each event:
 
 1. Checks `isSupported(eventType)` — filters out non-revoke events like `delivered` / `open`.
-2. Idempotency lookup in `marketing-webhooks/{eventId}` — skips if already processed.
-3. Calls `handleEvent({ Manager, assistant, parsed })` on the processor.
-4. Marks the idempotency doc `status: 'completed'` (or `'failed'` with error details).
+2. Calls `handleEvent({ Manager, assistant, parsed })` on the processor.
+
+There is **no idempotency ledger**. Both handler side effects — writing `consent.marketing.status = 'revoked'` and calling `mailer.remove()` — are idempotent, so a provider retry (or a duplicate fan-out from the parent) re-runs to the same end state with no extra side effects. This is the key difference from `payments-webhooks`, where dedup is load-bearing because payment side effects are not idempotent.
 
 Each processor's `handleEvent` does the same shape of work:
 
@@ -159,7 +159,7 @@ The parent forwarder:
 2. Reads the `brands` collection from the parent's own Firestore.
 3. For each brand: derives the child API URL by inserting `api.` into the brand's URL (`https://somiibo.com` → `https://api.somiibo.com/backend-manager/marketing/webhook?provider=X&key=Y`).
 4. POSTs the raw provider body to every child in parallel via `Promise.allSettled`.
-5. Returns 200 even if some children fail — child idempotency makes provider retries safe.
+5. Returns 200 even if some children fail — idempotent child handlers make provider retries (and re-fans) safe.
 
 ### Why fan-out instead of central processing
 
@@ -167,7 +167,7 @@ Each brand has its own Firebase project, so its `users` collection is separate.
 
 - **Correct per-brand updates** — only brands where the user actually has an account update their user docs.
 - **Failure isolation** — one child being down doesn't block updates on the others.
-- **Local idempotency** — each child tracks `marketing-webhooks/{eventId}` in its own Firestore.
+- **Idempotent handlers** — re-processing the same event (provider retry or re-fan) produces the same end state, so no dedup ledger is needed.
 - **No new schema** — no need for the parent to maintain a brand → publication map; each child filters on its own.
 
 ### Why self IS in the fan-out

package/docs/testing.md

@@ -19,7 +19,7 @@ What the runner wipes pre-test (in [src/test/test-accounts.js](../src/test/test-
 
 1. **`meta/stats`** doc ensured (required for on-create batch writes).
 2. **`users/_test-*`** Firebase Auth users + Firestore docs (delete).
-3. **Mixed Firestore collections** — `payments-orders`, `payments-webhooks`, `payments-intents`, `payments-disputes`, `marketing-webhooks`. Two-pass cleanup per collection:
+3. **Mixed Firestore collections** — `payments-orders`, `payments-webhooks`, `payments-intents`, `payments-disputes`. Two-pass cleanup per collection:
    - Pass 1 — owner-keyed: `where('owner', 'in', [...testUids])` (batched at 30 uids per `in` query).
    - Pass 2 — id-keyed: any doc whose ID starts with `_test-` (catches ownerless test docs like dispute alerts and raw test webhooks).
 4. **Test-only Firestore collections** — `_test`, `_test_query` — wiped in full.
@@ -52,6 +52,8 @@ The rule: **never put cleanup at the END of a test file or suite for the purpose
 
 Several routes/handlers skip external API calls (SendGrid, Beehiiv, Stripe webhooks, dispute handlers, marketing libraries) when `process.env.TEST_EXTENDED_MODE` is unset, so unit tests don't fire real emails or webhook side effects. Set the flag to opt **in** to those side effects for a full end-to-end run.
 
+The marketing library gates at the SSOT level: `Marketing.add()`, `Marketing.sync()`, and `Marketing.remove()` each short-circuit with `if (assistant.isTesting() && !process.env.TEST_EXTENDED_MODE) return {}` before touching any provider. Callers (auth `onDelete`, webhook processors, contact-delete route) inherit the gate for free — do NOT rely on a per-caller guard for provider safety; add the gate to the library method itself when introducing a new provider-touching method.
+
 **Live sync — no env coordination across terminals.** The flag flows automatically from the test command to the running emulator via a small shared state file at `<projectRoot>/.temp/test-mode.json`. The test command writes the file pre-flight; the emulator's function workers watch it via `fs.watch` and mutate their own `process.env.TEST_EXTENDED_MODE` in place. Effect: you only need to set the flag on **the test command**. The emulator follows.
 
 ```bash

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "backend-manager",
-  "version": "5.2.12",
+  "version": "5.2.13",
   "description": "Quick tools for developing Firebase functions",
   "main": "src/manager/index.js",
   "bin": {
@@ -49,7 +49,7 @@
     }
   },
   "dependencies": {
-    "@anthropic-ai/claude-agent-sdk": "^0.3.152",
+    "@anthropic-ai/claude-agent-sdk": "^0.3.153",
     "@anthropic-ai/sdk": "^0.99.0",
     "@firebase/rules-unit-testing": "^5.0.1",
     "@google-cloud/firestore": "^7.11.6",
@@ -86,7 +86,7 @@
     "pushid": "^1.0.0",
     "sanitize-html": "^2.17.4",
     "sharp": "^0.34.5",
-    "stripe": "^22.1.1",
+    "stripe": "^22.2.0",
     "uid-generator": "^2.0.0",
     "uuid": "^14.0.0",
     "wonderful-fetch": "^2.0.5",

package/src/manager/libraries/email/data/disposable-domains.json

@@ -120,6 +120,7 @@
   "24mail.top",
   "25u.com",
   "2anom.com",
+  "2bd.net",
   "2chmail.net",
   "2ether.net",
   "2fdgdfgdfgdf.tk",
@@ -335,6 +336,7 @@
   "air2token.com",
   "airmailbox.website",
   "airsworld.net",
+  "aisubpro.click",
   "aiworldx.com",
   "aixnv.com",
   "ajaxapp.net",
@@ -1183,6 +1185,7 @@
   "dim-coin.com",
   "dimalk.com",
   "dingbone.com",
+  "dino.icu",
   "diolang.com",
   "directmail24.net",
   "dis.hopto.org",
@@ -2054,6 +2057,7 @@
   "gowikitv.com",
   "grandmamail.com",
   "grandmasmail.com",
+  "graphicenda.site",
   "grassdev.com",
   "gravityengine.cc",
   "great-host.in",
@@ -2709,6 +2713,7 @@
   "laste.ml",
   "lastmail.co",
   "lastmail.com",
+  "launders.money",
   "lawlita.com",
   "laxex.ru",
   "laxex.store",
@@ -2757,11 +2762,13 @@
   "link2mail.net",
   "linkedintuts2016.pw",
   "linkmail.info",
+  "linkpc.net",
   "linlshe.com",
   "linshiyou.com",
   "linshiyouxiang.net",
   "linuxmail.so",
   "liocbrco.com",
+  "liopsacac.shop",
   "lista.cc",
   "litedrop.com",
   "liveradio.tk",
@@ -3418,6 +3425,7 @@
   "newfilm24.ru",
   "newideasfornewpeople.info",
   "newmail.top",
+  "newmano.store",
   "newyork.io.vn",
   "next.ovh",
   "nextmail.info",
@@ -3498,6 +3506,7 @@
   "nospam4.us",
   "nospamfor.us",
   "nospamthanks.info",
+  "nosubcriber.shop",
   "notboxletters.com",
   "nothingtoseehere.ca",
   "notif.me",
@@ -3697,6 +3706,7 @@
   "payspun.com",
   "pazard.com",
   "pazuric.com",
+  "pbhak.dev",
   "pckage.com",
   "pdf-cutter.com",
   "pe.hu",
@@ -3957,6 +3967,7 @@
   "rapidefr.fr.nf",
   "rapt.be",
   "raqid.com",
+  "ravavo.bond",
   "rawr.foo",
   "rax.la",
   "raxtest.com",
@@ -5114,6 +5125,7 @@
   "vuket.org",
   "vulca.sbs",
   "vusra.com",
+  "vutrugay.org",
   "vvatxiy.com",
   "vwhins.com",
   "vxsolar.com",
@@ -5243,6 +5255,7 @@
   "womp-wo.mp",
   "woofidog.fr.nf",
   "woopros.com",
+  "work.gd",
   "workingtall.com",
   "worldlylife.store",
   "worldspace.link",

package/src/manager/libraries/email/marketing/index.js

@@ -230,6 +230,11 @@ Marketing.prototype.remove = async function (email) {
     return {};
   }
 
+  if (assistant.isTesting() && !process.env.TEST_EXTENDED_MODE) {
+    assistant.log('Marketing.remove(): Skipping providers (testing mode)');
+    return {};
+  }
+
   assistant.log('Marketing.remove():', { email });
 
   const results = {};

package/src/manager/libraries/infer-contact.js

@@ -26,9 +26,9 @@ async function inferContact(email, assistant) {
     if (aiResult) {
       return aiResult;
     }
-    assistant.log(`inferContact: AI returned null for ${email} — falling back to empty result`);
+    assistant?.log(`inferContact: AI returned null for ${email} — falling back to empty result`);
   } else {
-    assistant.log(`inferContact: BACKEND_MANAGER_OPENAI_API_KEY not set — skipping AI inference for ${email}`);
+    assistant?.log(`inferContact: BACKEND_MANAGER_OPENAI_API_KEY not set — skipping AI inference for ${email}`);
   }
 
   return { firstName: '', lastName: '', company: '', confidence: 0, method: 'none' };
@@ -68,14 +68,14 @@ async function inferContactWithAI(email, assistant) {
         method: 'ai',
       };
       if (!inferred.firstName && !inferred.lastName && !inferred.company) {
-        assistant.log(`inferContactWithAI: AI parsed response had ALL fields empty for ${email}. Raw:`, parsed);
+        assistant?.log(`inferContactWithAI: AI parsed response had ALL fields empty for ${email}. Raw:`, parsed);
       }
       return inferred;
     }
 
-    assistant.log(`inferContactWithAI: AI response missing firstName for ${email}. Raw result:`, result);
+    assistant?.log(`inferContactWithAI: AI response missing firstName for ${email}. Raw result:`, result);
   } catch (e) {
-    assistant.error('inferContactWithAI: Failed:', e);
+    assistant?.error('inferContactWithAI: Failed:', e);
   }
 
   return null;

package/src/manager/routes/marketing/webhook/post.js

@@ -6,7 +6,7 @@
  *   2. Optionally rejects mismatched brand via ?brand= filter
  *   3. Loads the matching processor module from ./processors/{provider}.js
  *   4. Parses the webhook payload into one or more normalized events
- *   5. For each event: idempotency check via marketing-webhooks/{eventId}, then dispatch
+ *   5. For each supported event: dispatch to the processor's handler
  *   6. Returns 200 immediately so the provider doesn't retry
  *
  * Each processor module defines:
@@ -14,15 +14,13 @@
  *   - isSupported(type)   — returns true if this event should be processed
  *   - handleEvent(ctx)    — does the work for one event (user doc + cross-provider sync)
  *
- * Mirrors the existing payments-webhook pattern. Processes events inline rather than
- * via a Firestore trigger — marketing webhooks are lower volume and lighter work than
- * payments, so the extra async layer isn't justified.
+ * No idempotency ledger: every supported handler (revoke consent + cross-provider
+ * remove) is naturally idempotent — re-processing a provider retry produces the same
+ * end state with no extra side effects, so duplicate suppression buys nothing.
  */
 const path = require('path');
-const powertools = require('node-powertools');
 
-module.exports = async ({ assistant, Manager, libraries }) => {
-  const { admin } = libraries;
+module.exports = async ({ assistant, Manager }) => {
   const query = assistant.request.query;
 
   const provider = query.provider;
@@ -78,7 +76,7 @@ module.exports = async ({ assistant, Manager, libraries }) => {
   // Use Promise.allSettled so we return success only after all events have been
   // attempted.
   const results = await Promise.allSettled(
-    events.map((event) => processOneEvent({ Manager, assistant, admin, provider, event, processorModule }))
+    events.map((event) => processOneEvent({ Manager, assistant, provider, event, processorModule }))
   );
 
   let processed = 0;
@@ -100,81 +98,23 @@ module.exports = async ({ assistant, Manager, libraries }) => {
 };
 
 /**
- * Process a single event end-to-end: idempotency check, support check, dispatch to handler.
+ * Process a single event: support check, then dispatch to the processor's handler.
+ * Handlers are idempotent, so provider retries re-run safely with no dedup ledger.
  * Returns { processed: bool, skipped?: string, error?: any }.
  */
-async function processOneEvent({ Manager, assistant, admin, provider, event, processorModule }) {
-  const { eventId, eventType } = event;
-
-  // No eventId means we can't dedupe — skip rather than risk double-processing
-  if (!eventId) {
-    assistant.log(`marketing webhook: ${provider} event missing eventId (type=${eventType}), skipping`);
-    return { processed: false, skipped: 'missing-event-id' };
-  }
+async function processOneEvent({ Manager, assistant, provider, event, processorModule }) {
+  const { eventType } = event;
 
   // Filter by supported event types
   if (processorModule.isSupported && !processorModule.isSupported(eventType)) {
     return { processed: false, skipped: 'unsupported-event-type' };
   }
 
-  // Idempotency: skip if we've already processed this event
-  const idempotencyRef = admin.firestore().doc(`marketing-webhooks/${eventId}`);
-  const existingDoc = await idempotencyRef.get();
-
-  if (existingDoc.exists) {
-    const existingStatus = existingDoc.data()?.status;
-    if (existingStatus !== 'failed') {
-      assistant.log(`marketing webhook: ${provider} duplicate event ${eventId} (status=${existingStatus}), skipping`);
-      return { processed: false, skipped: 'duplicate' };
-    }
-    assistant.log(`marketing webhook: ${provider} retrying previously failed event ${eventId}`);
-  }
-
-  // Build the audit doc
-  const now = powertools.timestamp(new Date(), { output: 'string' });
-  const nowUNIX = powertools.timestamp(now, { output: 'unix' });
-
-  // Write 'pending' state before dispatching so concurrent deliveries see the lock
-  await idempotencyRef.set({
-    id: eventId,
-    provider,
-    status: 'pending',
-    raw: event.raw || null,
-    event: {
-      type: eventType,
-      email: event.email || null,
-      timestamp: event.timestamp || null,
-    },
-    error: null,
-    metadata: {
-      created: { timestamp: now, timestampUNIX: nowUNIX },
-      completed: { timestamp: null, timestampUNIX: null },
-    },
-  });
-
-  // Dispatch to the processor's event handler
-  let handlerResult;
   try {
-    handlerResult = await processorModule.handleEvent({ Manager, assistant, parsed: event });
-
-    // Mark completed
-    await idempotencyRef.set({
-      status: 'completed',
-      result: handlerResult || null,
-      metadata: {
-        completed: { timestamp: powertools.timestamp(new Date(), { output: 'string' }), timestampUNIX: powertools.timestamp(new Date(), { output: 'unix' }) },
-      },
-    }, { merge: true });
-
+    await processorModule.handleEvent({ Manager, assistant, parsed: event });
     return { processed: true };
   } catch (e) {
-    assistant.error(`marketing webhook: handler failed for ${provider} event ${eventId}:`, e);
-
-    await idempotencyRef.set({
-      status: 'failed',
-      error: { message: e.message || String(e), stack: e.stack || null },
-    }, { merge: true }).catch(() => {});
-
+    assistant.error(`marketing webhook: handler failed for ${provider} event ${event.eventId} (${eventType}):`, e);
     return { processed: false, error: e };
   }
 }

package/src/manager/routes/marketing/webhook/processors/beehiiv.js

@@ -19,7 +19,8 @@
  *   - getPublicationId() reads from config.marketing.beehiiv.publicationId
  *     or fuzzy-matches by brand name against the Beehiiv API.
  *
- * Idempotency is enforced by the dispatcher via marketing-webhooks/{eventId} doc.
+ * No idempotency ledger — the revoke + cross-provider remove are idempotent, so a
+ * provider retry re-runs safely with the same end state.
  */
 
 const REVOKE_EVENT_TYPES = new Set([
@@ -85,7 +86,7 @@ function isSupported(eventType) {
 }
 
 /**
- * Process a single parsed event. Called by the dispatcher AFTER idempotency check passes.
+ * Process a single parsed event. Called by the dispatcher for each supported event.
  * Returns a result object summarizing what happened.
  */
 async function handleEvent({ Manager, assistant, parsed }) {

package/src/manager/routes/marketing/webhook/processors/sendgrid.js

@@ -19,7 +19,8 @@
  * GROUPS.marketing (25928) is account-global across all brands, an unsub from group 25928
  * legitimately removes the user from marketing across the entire SendGrid account.
  *
- * Idempotency is enforced by the dispatcher via marketing-webhooks/{eventId} doc.
+ * No idempotency ledger — the revoke + cross-provider remove are idempotent, so a
+ * provider retry re-runs safely with the same end state.
  */
 
 const REVOKE_EVENT_TYPES = new Set([
@@ -61,7 +62,7 @@ function parseWebhook(req) {
   }
 
   return events.map((event) => {
-    // sg_event_id is SendGrid's per-event unique ID, used for idempotency.
+    // sg_event_id is SendGrid's per-event unique ID, retained for log context.
     // smtp-id is another stable identifier we fall back to.
     const eventId = event.sg_event_id || event['smtp-id'] || event.smtpId || null;
     const eventType = event.event;
@@ -88,7 +89,7 @@ function isSupported(eventType) {
 }
 
 /**
- * Process a single parsed event. Called by the dispatcher AFTER idempotency check passes.
+ * Process a single parsed event. Called by the dispatcher for each supported event.
  *
  * Returns a result object summarizing what happened (for logging/response).
  */

package/src/test/test-accounts.js

@@ -694,7 +694,7 @@ async function deleteTestUsers(admin) {
   // identified solely by an `_test-` doc id prefix (id-keyed). All must be wiped
   // at the start of every run so a test that died mid-execution leaves no
   // ghosts. New collections that participate in tests MUST be added here too.
-  const testDataCollections = ['payments-orders', 'payments-webhooks', 'payments-intents', 'payments-disputes', 'marketing-webhooks'];
+  const testDataCollections = ['payments-orders', 'payments-webhooks', 'payments-intents', 'payments-disputes'];
   // Collections that exist solely for tests — wipe in full. All docs in these
   // collections come from tests, so a single recursive delete handles cleanup.
   const testOnlyCollections = ['_test', '_test_query'];

package/templates/_.env

@@ -9,11 +9,10 @@ BACKEND_MANAGER_ANTHROPIC_API_KEY=""
 # GitHub
 GITHUB_TOKEN=""
 
-# OpenAI
+# AI
 OPENAI_API_KEY=""
-
-# Anthropic
 ANTHROPIC_API_KEY=""
+CLAUDE_CODE_OAUTH_TOKEN=""
 
 # Payment Processors
 PAYPAL_CLIENT_SECRET=""

package/test/routes/marketing/webhook.js

@@ -8,7 +8,7 @@
  *   - Auth via ?key= query param
  *   - Provider validation
  *   - Brand filter (ignore mismatched brand)
- *   - Idempotency via marketing-webhooks/{eventId} doc
+ *   - Idempotent re-delivery (handlers re-run safely; no dedup ledger)
  *
  * SendGrid processor tests:
  *   - Various event types (group_unsubscribe, unsubscribe, spamreport, bounce, dropped)
@@ -120,12 +120,6 @@ module.exports = {
         assert.equal(userDoc?.consent?.marketing?.status, 'revoked', 'marketing.status should be revoked');
         assert.equal(userDoc?.consent?.marketing?.revokedAt?.source, 'sendgrid', 'revokedAt.source should be sendgrid');
         assert.equal(userDoc?.consent?.marketing?.revokedAt?.timestampUNIX, eventTimestamp, 'revokedAt.timestampUNIX should match event timestamp');
-
-        // Idempotency doc should exist with status=completed
-        const webhookDoc = await firestore.get(`marketing-webhooks/${eventId}`);
-        assert.ok(webhookDoc, 'Idempotency doc should exist');
-        assert.equal(webhookDoc?.status, 'completed', 'Idempotency doc should be marked completed');
-        assert.equal(webhookDoc?.provider, 'sendgrid', 'Idempotency doc should record provider');
       },
     },
 
@@ -244,9 +238,9 @@ module.exports = {
           [sgEvent({ id: eventId, type: 'group_unsubscribe', email: '_test.never-existed@example.com' })]
         );
 
-        // Dispatcher still processes the event (idempotency doc written, handler runs and returns
-        // handled:false). From the dispatcher's POV this counts as 'processed=1' since the handler
-        // didn't throw. The handler's internal "user-not-found" branch is silent by design.
+        // Dispatcher still runs the handler (which returns handled:false). From the
+        // dispatcher's POV this counts as 'processed=1' since the handler didn't throw.
+        // The handler's internal "user-not-found" branch is silent by design.
         assert.isSuccess(response, 'Should accept unknown-email gracefully');
         assert.propertyEquals(response, 'data.failed', 0, 'No failures for unknown email');
       },
@@ -277,28 +271,19 @@ module.exports = {
         assert.propertyEquals(response, 'data.processed', 2, '2 supported events should be processed');
         assert.propertyEquals(response, 'data.skipped', 1, '1 unsupported event should be skipped');
 
-        // Each processed event gets its own idempotency doc
-        const doc1 = await firestore.get(`marketing-webhooks/${e1}`);
-        const doc3 = await firestore.get(`marketing-webhooks/${e3}`);
-        assert.ok(doc1 && doc1.status === 'completed', 'First event idempotency doc completed');
-        assert.ok(doc3 && doc3.status === 'completed', 'Third event idempotency doc completed');
-
-        // The skipped event should NOT have an idempotency doc (we filter by isSupported before writing)
-        const doc2 = await firestore.get(`marketing-webhooks/${e2}`);
-        assert.ok(!doc2, 'Unsupported event should NOT have an idempotency doc');
-
         // User doc should be revoked
         const userDoc = await firestore.get(`users/${uid}`);
         assert.equal(userDoc?.consent?.marketing?.status, 'revoked');
       },
     },
 
-    // ─── Idempotency ───
+    // ─── Idempotent re-delivery (no dedup ledger) ───
 
     {
-      name: 'sendgrid-duplicate-event-skipped',
+      name: 'sendgrid-duplicate-event-reprocessed-idempotently',
       auth: 'none',
       async run({ http, firestore, assert, accounts }) {
+        const uid = accounts.basic.uid;
         const email = accounts.basic.email;
         const eventId = sgEventId('duplicate');
 
@@ -310,27 +295,27 @@ module.exports = {
         assert.isSuccess(response1);
         assert.propertyEquals(response1, 'data.processed', 1, 'First delivery should process');
 
-        // Second delivery — same eventId
+        // Second delivery — same eventId. With no dedup ledger the handler runs
+        // again, but the revoke is idempotent so the end state is unchanged.
         const response2 = await http.as('none').post(
           `marketing/webhook?provider=sendgrid&key=${process.env.BACKEND_MANAGER_WEBHOOK_KEY}`,
           [sgEvent({ id: eventId, type: 'group_unsubscribe', email })]
         );
         assert.isSuccess(response2);
-        assert.propertyEquals(response2, 'data.processed', 0, 'Duplicate should NOT reprocess');
-        assert.propertyEquals(response2, 'data.skipped', 1, 'Duplicate should be skipped');
+        assert.propertyEquals(response2, 'data.processed', 1, 'Re-delivery reprocesses (idempotent), not skipped');
 
-        // Idempotency doc should still be there and completed
-        const webhookDoc = await firestore.get(`marketing-webhooks/${eventId}`);
-        assert.equal(webhookDoc?.status, 'completed');
+        const userDoc = await firestore.get(`users/${uid}`);
+        assert.equal(userDoc?.consent?.marketing?.status, 'revoked', 'User remains revoked after re-delivery');
       },
     },
 
-    // ─── Missing event ID ───
+    // ─── Missing event ID — still processed (no dedup requirement) ───
 
     {
-      name: 'sendgrid-event-without-eventId-skipped',
+      name: 'sendgrid-event-without-eventId-processed',
       auth: 'none',
-      async run({ http, assert, accounts }) {
+      async run({ http, firestore, assert, accounts }) {
+        const uid = accounts.basic.uid;
         const email = accounts.basic.email;
 
         const response = await http.as('none').post(
@@ -339,8 +324,10 @@ module.exports = {
         );
 
         assert.isSuccess(response, 'Should accept the request');
-        assert.propertyEquals(response, 'data.processed', 0, 'Event without eventId cannot be deduped, so it is skipped');
-        assert.propertyEquals(response, 'data.skipped', 1, 'Event should be skipped');
+        assert.propertyEquals(response, 'data.processed', 1, 'Event without eventId is still processed (no dedup needed)');
+
+        const userDoc = await firestore.get(`users/${uid}`);
+        assert.equal(userDoc?.consent?.marketing?.status, 'revoked', 'User should be revoked');
       },
     },
 
@@ -351,14 +338,16 @@ module.exports = {
     {
       name: 'beehiiv-subscription-unsubscribed-writes-consent',
       auth: 'none',
-      async run({ http, firestore, assert, accounts, config }) {
+      async run({ http, firestore, assert, accounts, config, skip }) {
         const uid = accounts.basic.uid;
         const email = accounts.basic.email;
         const eventId = `_test-bh-unsub-${Date.now()}`;
         const eventISO = new Date().toISOString();
         const publicationId = config.marketing?.beehiiv?.publicationId;
 
-        assert.ok(publicationId, 'Test brand must have a Beehiiv publication ID configured');
+        if (!publicationId) {
+          return skip('No Beehiiv publication ID configured for this brand');
+        }
 
         const response = await http.as('none').post(
           `marketing/webhook?provider=beehiiv&key=${process.env.BACKEND_MANAGER_WEBHOOK_KEY}`,
@@ -378,12 +367,6 @@ module.exports = {
         assert.equal(userDoc?.consent?.marketing?.status, 'revoked', 'marketing.status should be revoked');
         assert.equal(userDoc?.consent?.marketing?.revokedAt?.source, 'beehiiv', 'revokedAt.source should be beehiiv');
         assert.ok(userDoc?.consent?.marketing?.revokedAt?.timestamp, 'revokedAt.timestamp should be set');
-
-        // Idempotency doc should exist
-        const webhookDoc = await firestore.get(`marketing-webhooks/${eventId}`);
-        assert.ok(webhookDoc, 'Idempotency doc should exist');
-        assert.equal(webhookDoc?.status, 'completed');
-        assert.equal(webhookDoc?.provider, 'beehiiv');
       },
     },
 
@@ -472,8 +455,8 @@ module.exports = {
         );
 
         // The dispatcher counts this as 'processed' from its POV (the handler
-        // ran without error and the idempotency doc was written), but the
-        // handler returned { handled: false, reason: 'publication-mismatch' }.
+        // ran without error), but the handler returned
+        // { handled: false, reason: 'publication-mismatch' }.
         // What matters: the user doc should NOT have been mutated.
         assert.isSuccess(response, 'Pub-mismatch event should be accepted gracefully');
 
@@ -542,13 +525,18 @@ module.exports = {
     },
 
     {
-      name: 'beehiiv-duplicate-event-skipped',
+      name: 'beehiiv-duplicate-event-reprocessed-idempotently',
       auth: 'none',
-      async run({ http, firestore, assert, accounts, config }) {
+      async run({ http, firestore, assert, accounts, config, skip }) {
+        const uid = accounts.basic.uid;
         const email = accounts.basic.email;
         const publicationId = config.marketing?.beehiiv?.publicationId;
         const eventId = `_test-bh-dup-${Date.now()}`;
 
+        if (!publicationId) {
+          return skip('No Beehiiv publication ID configured for this brand');
+        }
+
         const payload = {
           id: eventId,
           event: 'subscription.unsubscribed',
@@ -565,17 +553,17 @@ module.exports = {
         assert.isSuccess(r1);
         assert.propertyEquals(r1, 'data.processed', 1, 'First delivery should process');
 
-        // Second delivery — same id
+        // Second delivery — same id. No dedup ledger, so it reprocesses; the
+        // revoke is idempotent so the end state is unchanged.
         const r2 = await http.as('none').post(
           `marketing/webhook?provider=beehiiv&key=${process.env.BACKEND_MANAGER_WEBHOOK_KEY}`,
           payload
         );
         assert.isSuccess(r2);
-        assert.propertyEquals(r2, 'data.processed', 0, 'Duplicate should NOT reprocess');
-        assert.propertyEquals(r2, 'data.skipped', 1, 'Duplicate should be skipped');
+        assert.propertyEquals(r2, 'data.processed', 1, 'Re-delivery reprocesses (idempotent), not skipped');
 
-        const webhookDoc = await firestore.get(`marketing-webhooks/${eventId}`);
-        assert.equal(webhookDoc?.status, 'completed');
+        const userDoc = await firestore.get(`users/${uid}`);
+        assert.equal(userDoc?.consent?.marketing?.status, 'revoked', 'User remains revoked after re-delivery');
       },
     },
   ],