Lock down outbound agent email to strictly approved recipient domain allowlists

import { SadaSend } from 'sadasend';

// Initialize with a restricted staging or internal agent key
// Key Policy in SadaSend Dashboard:
// - Allowed: "*@company.com", "*@partners.internal"
// - Blocked: All external public domains
const sadasend = new SadaSend(process.env.SADASEND_INTERNAL_AGENT_KEY!);

export async function forwardSummaryToTeam(teamMemberEmail: string, summary: string) {
  // Dispatches to team members succeed seamlessly
  // Dispatches to external unauthorized addresses fail at edge with HTTP 403
  return await sadasend.emails.send({
    from: 'ai-digest@company.com',
    to: teamMemberEmail,
    subject: 'Daily Executive Intelligence Summary',
    html: `<p>${summary}</p>`,
    tags: ['ai-agent', 'internal-digest']
  });
}