feat: add credential serialization helpers

internal/secretstore/codec.go

@@ -0,0 +1,23 @@
+package secretstore
+
+import "encoding/json"
+
+func MarshalCredential(cred Credential) ([]byte, error) {
+	if err := cred.Validate(); err != nil {
+		return nil, err
+	}
+
+	return json.Marshal(cred)
+}
+
+func UnmarshalCredential(data []byte) (Credential, error) {
+	var cred Credential
+	if err := json.Unmarshal(data, &cred); err != nil {
+		return Credential{}, err
+	}
+	if err := cred.Validate(); err != nil {
+		return Credential{}, err
+	}
+
+	return cred, nil
+}

internal/secretstore/codec_test.go

@@ -0,0 +1,42 @@
+package secretstore
+
+import "testing"
+
+func TestMarshalCredentialRoundTrip(t *testing.T) {
+	input := Credential{
+		Host:     "imap.example.com",
+		Username: "alice",
+		Password: "secret",
+	}
+
+	data, err := MarshalCredential(input)
+	if err != nil {
+		t.Fatalf("MarshalCredential returned error: %v", err)
+	}
+
+	output, err := UnmarshalCredential(data)
+	if err != nil {
+		t.Fatalf("UnmarshalCredential returned error: %v", err)
+	}
+
+	if output != input {
+		t.Fatalf("round-trip mismatch: got %#v want %#v", output, input)
+	}
+}
+
+func TestMarshalCredentialRejectsInvalidCredential(t *testing.T) {
+	_, err := MarshalCredential(Credential{
+		Host:     "imap.example.com",
+		Username: "alice",
+	})
+	if err == nil {
+		t.Fatal("expected MarshalCredential to reject incomplete credential")
+	}
+}
+
+func TestUnmarshalCredentialRejectsInvalidCredential(t *testing.T) {
+	_, err := UnmarshalCredential([]byte(`{"host":"imap.example.com","username":"alice"}`))
+	if err == nil {
+		t.Fatal("expected UnmarshalCredential to reject incomplete credential")
+	}
+}