feat: centralize mail credential and sandbox policy

packages/mail/test/mail.test.ts

@@ -1,5 +1,11 @@
 import { expect, test } from "bun:test";
-import { defineMail, defineMailTemplate, sealedMailDriver } from "../src/index.ts";
+import {
+  defineMail,
+  defineMailTemplate,
+  defineSealedMailCredentials,
+  mailSandboxDecision,
+  sealedMailDriver,
+} from "../src/index.ts";
 
 test("mail templates render and sandbox blocks accidental recipients", async () => {
   const sent: unknown[] = [];
@@ -17,6 +23,26 @@ test("mail templates render and sandbox blocks accidental recipients", async ()
   await expect(mail.send({ to: "real@example.com", subject: "no" })).rejects.toThrow("SANDBOX");
 });
 
+test("mail owns fail-closed sandbox decisions and sealed credential setup", async () => {
+  expect(
+    mailSandboxDecision({ enabled: 1, allowlist: '["Test@Example.com"]' }, "test@example.com"),
+  ).toEqual({ allowed: true });
+  expect(
+    mailSandboxDecision({ enabled: true, allowlist: "not-json" }, "x@example.com").allowed,
+  ).toBe(false);
+  const previous = process.env.TEST_MAIL_ENCRYPTION_KEY;
+  process.env.TEST_MAIL_ENCRYPTION_KEY = btoa(String.fromCharCode(...new Uint8Array(32).fill(7)));
+  try {
+    const credentials = defineSealedMailCredentials({ env: "TEST_MAIL_ENCRYPTION_KEY" });
+    const sealed = await credentials.seal("smtp-secret");
+    expect(sealed).not.toContain("smtp-secret");
+    expect(await credentials.open(sealed)).toBe("smtp-secret");
+  } finally {
+    if (previous === undefined) delete process.env.TEST_MAIL_ENCRYPTION_KEY;
+    else process.env.TEST_MAIL_ENCRYPTION_KEY = previous;
+  }
+});
+
 test("sealed drivers decrypt lazily once and delegate send/test", async () => {
   let opens = 0;
   const sent: string[] = [];