* feat(invoices): per-recipient email delivery outcomes
Resend delivery webhooks identify affected addresses in data.to, so one
message with CC recipients can carry independent To/CC outcomes instead
of masking the failing address into the aggregate reason text.
- new apply_invoice_delivery_provider_event RPC merges each reported
recipient onto its immutable To/CC position with the same rank and
timestamp ordering as the aggregate status (retry and out-of-order safe)
- recipient map is PII-free: keyed to:N / cc:N, BCC and unmatched
recipients are never represented, and the map is cleared on PII redaction
- delivery summaries, API route and MCP tool expose the sanitized map;
the route re-sanitizes as defense in depth
- UI shows a per-recipient status list under the aggregate outcome
The prod ops check in issue #1350 (webhook registered in Resend and
RESEND_DELIVERY_WEBHOOK_SECRET set in Vercel) cannot be verified from the
repo and remains a follow-up.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test(invoices): commit provider event before cross-context read
The BCC-leak test applied the event inside the rollback-scoped service
role helper and then asserted through a separate member context, so the
applied status was rolled back before the read. Use the committing
runAsServiceRole helper for the apply, matching how the summary read is
performed in its own context.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Mattsson
cd7d7f52b9