@myapihq/cli 2.31.5 → 2.31.6

package/dist/commands/email/message-textpart.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/commands/email/message-textpart.test.js

@@ -0,0 +1,64 @@
+// An html-only `email message send` arrived with an EMPTY text/plain part.
+//
+// The backend adds the multipart alternative but does not fill it (filed
+// 2026-08-23, still open backend-side). Found live by the deep probe's email
+// journey on its FIRST run with a real fixture, 2026-08-25 — the exact defect
+// the step was written for, invisible to everything that does not read a
+// delivered message. The CLI now derives the plain part from the HTML, so the
+// customer-facing defect is closed regardless of when the backend fills its
+// half.
+import { describe, it, expect, vi } from 'vitest';
+const sdk = vi.hoisted(() => ({
+    email: { sendEmail: vi.fn(async () => ({ message_id: 'm-1' })) },
+    MyApiError: class MyApiError extends Error {
+        code = '';
+        status = 0;
+    },
+    // retryFunds in utils.js wraps sends with the 402 auto-recharge loop.
+    withFundsRetry: (fn) => fn(),
+    isInsufficientFunds: () => false,
+    autoRechargeState: () => undefined,
+}));
+vi.mock('@myapihq/sdk', () => sdk);
+vi.mock('../../config.js', () => ({
+    requireConfig: () => ({ api_key: 'hq_live_test' }),
+    loadConfig: () => ({ api_key: 'hq_live_test' }),
+    CONFIG_DIR: '/tmp/nowhere',
+}));
+import { run, plainTextFromHtml } from './message.js';
+import { withSink } from '../../output.js';
+const SINK = { out: () => { }, err: () => { }, fail: (m) => { throw new Error(m); } };
+describe('html-only send carries a derived text part', () => {
+    it('fills text from the html when --body is absent', async () => {
+        await withSink(SINK, () => run('send', [], {
+            from: 'a@x.co', to: 'b@x.co', subject: 's',
+            html: '<h1>Hello</h1><p>Two &amp; two.</p>',
+        }));
+        const payload = sdk.email.sendEmail.mock.calls.at(-1)[1];
+        expect(payload.text).toBe('Hello\nTwo & two.');
+        expect(payload.html).toContain('<h1>');
+    });
+    it('never overwrites an explicit --body', async () => {
+        await withSink(SINK, () => run('send', [], {
+            from: 'a@x.co', to: 'b@x.co', subject: 's',
+            html: '<p>rich</p>', body: 'my own words',
+        }));
+        expect(sdk.email.sendEmail.mock.calls.at(-1)[1].text).toBe('my own words');
+    });
+    it('text-only send is untouched', async () => {
+        await withSink(SINK, () => run('send', [], {
+            from: 'a@x.co', to: 'b@x.co', subject: 's', body: 'plain',
+        }));
+        const payload = sdk.email.sendEmail.mock.calls.at(-1)[1];
+        expect(payload.text).toBe('plain');
+        expect(payload.html).toBeUndefined();
+    });
+});
+describe('plainTextFromHtml', () => {
+    it('turns block boundaries into line breaks and strips the rest', () => {
+        expect(plainTextFromHtml('<div>a</div><div>b<br>c</div>')).toBe('a\nb\nc');
+    });
+    it('unescapes the common entities', () => {
+        expect(plainTextFromHtml('<p>&lt;tag&gt; &quot;q&quot; &amp; more&nbsp;here</p>')).toBe('<tag> "q" & more here');
+    });
+});

package/dist/commands/email/message.d.ts

@@ -1,5 +1,6 @@
 import type { Flags } from '../../helpers.js';
 import type { Exposes } from '../../exposes.js';
 export declare const EXPOSES: Exposes;
+export declare function plainTextFromHtml(html: string): string;
 export declare const SUBCOMMAND_USAGE: Record<string, string>;
 export declare function run(sub: string | undefined, args: string[], flags: Flags): Promise<void>;

package/dist/commands/email/message.js

@@ -21,6 +21,21 @@ function summarizeMessage(m) {
         received_at: m.received_at,
     };
 }
+// Block-level tags become line breaks, everything else is stripped, entities
+// beyond the common five are left alone. Exported for the test.
+export function plainTextFromHtml(html) {
+    return html
+        .replace(/<\s*(br|\/p|\/div|\/h[1-6]|\/li|\/tr)[^>]*>/gi, '\n')
+        .replace(/<[^>]+>/g, '')
+        .replace(/&nbsp;/g, ' ')
+        .replace(/&amp;/g, '&')
+        .replace(/&lt;/g, '<')
+        .replace(/&gt;/g, '>')
+        .replace(/&quot;/g, '"')
+        .replace(/[ \t]+\n/g, '\n')
+        .replace(/\n{3,}/g, '\n\n')
+        .trim();
+}
 async function send(flags) {
     const config = requireConfig();
     // typeof check (not truthiness): a bare `--to` whose value got swallowed by
@@ -41,12 +56,22 @@ async function send(flags) {
             error('--template-vars must be valid JSON');
         }
     }
+    // An html-only send used to arrive with an EMPTY text/plain part: the
+    // backend adds the alternative but does not fill it (filed 2026-08-23,
+    // still open), so text-only clients and some spam filters saw a blank
+    // message. The API accepts `text`, so derive one instead of waiting.
+    // The stripper is deliberately crude — the plain part's job is to carry the
+    // words, not the layout.
+    const html = flags.html;
+    let text = flags.body;
+    if (html && !text)
+        text = plainTextFromHtml(html);
     const res = await retryFunds(() => sdkEmail.sendEmail(config.api_key, {
         from: flags.from,
         to: [flags.to],
         subject: flags.subject,
-        text: flags.body,
-        html: flags.html,
+        text,
+        html,
         template_id: flags['template-id'],
         template_vars: templateVars,
     }));

package/dist/commands/fn-create-json.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/commands/fn-create-json.test.js

@@ -0,0 +1,49 @@
+// `fn create --json` printed the human text, JSON nowhere.
+//
+// The scoped API key is returned exactly ONCE, at create. A script running
+// under --json got the prose rendering instead of a parseable object, so the
+// one-shot key was lost to anything that was not a human reading a terminal —
+// the same ignored---json class as `storage upload` and `mailbox create`.
+// Found by examples/a-to-z/run.mjs on its first real run, 2026-08-25.
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+const sdk = vi.hoisted(() => ({
+    fn: { createFunction: vi.fn() },
+    MyApiError: class MyApiError extends Error {
+        code = '';
+        status = 0;
+    },
+}));
+vi.mock('@myapihq/sdk', () => sdk);
+vi.mock('../config.js', () => ({
+    requireConfig: () => ({ api_key: 'hq_live_test', default_org: 'o-1' }),
+    loadConfig: () => ({ api_key: 'hq_live_test', default_org: 'o-1' }),
+    CONFIG_DIR: '/tmp/nowhere',
+}));
+import { create } from './fn.js';
+import { withSink } from '../output.js';
+const RESULT = {
+    function: { id: 'fn-1', name: 'demo', trigger_type: 'http', invocation_url: null },
+    scoped_api_key: 'hq_live_once',
+    scoped_api_key_id: 'key-1',
+};
+describe('fn create honours --json', () => {
+    // stdout and stderr are separate contracts: JSON rides stdout, the
+    // org-context banner rides stderr. Mixing them here would re-create the
+    // parse bug this file exists to prevent.
+    const out = [];
+    const err = [];
+    const SINK = { out: (m) => out.push(m), err: (m) => err.push(m), fail: (m) => { throw new Error(m); } };
+    beforeEach(() => { out.length = 0; err.length = 0; sdk.fn.createFunction.mockResolvedValue(RESULT); });
+    it('emits the full result as parseable JSON, including the one-shot key', async () => {
+        await withSink(SINK, () => create('demo', { json: true, org: 'o-1' }));
+        const parsed = JSON.parse(out.join('\n'));
+        expect(parsed.scoped_api_key).toBe('hq_live_once');
+        expect(parsed.function.id).toBe('fn-1');
+    });
+    it('without --json, keeps the human rendering', async () => {
+        await withSink(SINK, () => create('demo', { org: 'o-1' }));
+        const text = [...out, ...err].join('\n');
+        expect(text).toContain('Function created: fn-1');
+        expect(() => JSON.parse(text)).toThrow();
+    });
+});

package/dist/commands/fn.js

@@ -94,6 +94,15 @@ export async function create(nameArg, flags) {
             payload.scopes = scopes;
     }
     const result = await sdkFn.createFunction(config.api_key, orgId, payload);
+    // --json must carry the whole result — including the scoped key, which is
+    // returned exactly once. A script that created a function under --json got
+    // the human text instead (found by examples/a-to-z/run.mjs, the same
+    // ignored---json class as storage upload and mailbox create), and the
+    // one-shot key was lost to anything that wasn't a human reading a terminal.
+    if (flags.json) {
+        printJson(result);
+        return;
+    }
     success(`Function created: ${result.function.id}`);
     info(`Name:            ${result.function.name}`);
     info(`Trigger:         ${result.function.trigger_type}${result.function.cron_schedule ? ` (${result.function.cron_schedule})` : ''}`);

package/dist/errors.js

@@ -3,6 +3,9 @@ import { currentOrg } from './helpers.js';
 // index.ts) so it can be unit-tested without importing the CLI entrypoint,
 // which runs main() on import.
 export const ERROR_MESSAGES = {
+    // 402, but not about money: the mailbox exists and the wallet is fine —
+    // outbound sending was never switched on for this address.
+    SENDING_NOT_ACTIVATED: 'This address cannot send yet — sending was never activated (this is not a billing problem). Run: myapi email mailbox activate-sending --address <email>',
     DOMAIN_NOT_FOUND: 'Domain not found.',
     INVALID_DOMAIN: 'Invalid domain name.',
     ORG_NOT_FOUND: 'Organization not found.',

package/dist/errors.test.js

@@ -165,3 +165,16 @@ describe('5xx advice distinguishes a read from a write', () => {
         expect(friendlyError(err())).toContain('went through');
     });
 });
+// SENDING_NOT_ACTIVATED arrives as HTTP 402, and the 402 handler's fallback
+// assumed any unrecognized 402 was an empty wallet — so a user with $92 of
+// credits was told "Insufficient balance. Top up". Money pointed at a problem
+// money cannot fix. Found live by the deep probe's email journey, 2026-08-25.
+describe('402 that is not about money', () => {
+    it('SENDING_NOT_ACTIVATED names the activation command, not a top-up', () => {
+        const e = new MyApiError('SENDING_NOT_ACTIVATED', 402, 'Activate sending for this address via POST /email/sending/activate');
+        const msg = friendlyError(e);
+        expect(msg).toContain('activate-sending');
+        expect(msg).toContain('not a billing problem');
+        expect(msg).not.toContain('topup');
+    });
+});

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { error, info, success, banner, setResolvedContextSource } from './output.js';
 import { loadConfig } from './config.js';
-import { MyApiError, setUserAgent, hq } from '@myapihq/sdk';
+import { MyApiError, setUserAgent, hq, isInsufficientFunds } from '@myapihq/sdk';
 import { friendlyError } from './errors.js';
 import { currentOrg, adoptSoleOrg } from './helpers.js';
 import * as fs from 'fs';
@@ -412,8 +412,16 @@ async function main() {
                     // Anonymous accounts can't top up (no payment surface) — link to unlock.
                     else if (cfg?.is_anonymous)
                         error('Insufficient balance. Anonymous accounts have no free credit — link an email to unlock $5: myapi account link <email>');
-                    else
+                    else if (!err.code || isInsufficientFunds(err)) {
                         error('Insufficient balance. Top up: myapi billing topup <amount> — or keep it funded automatically: myapi billing auto-recharge set');
+                    }
+                    // A 402 whose code is NOT about money. SENDING_NOT_ACTIVATED arrives
+                    // as 402 and landed in the branch above, so a user with $92 of
+                    // credits was told to top up — money pointed at a problem money
+                    // cannot fix, the same shape as "Invalid API key → run setup" on the
+                    // wrong-host bug. Show what the platform actually said.
+                    else
+                        error(friendlyError(err));
                 }
             }
             else

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@myapihq/cli",
   "license": "Apache-2.0",
-  "version": "2.31.5",
+  "version": "2.31.6",
   "description": "MyAPI command-line interface",
   "repository": {
     "type": "git",
@@ -49,7 +49,7 @@
     "lint:skills:strict": "node scripts/copy-skills.js && node scripts/lint-skills.js --strict"
   },
   "dependencies": {
-    "@myapihq/sdk": "^2.31.5"
+    "@myapihq/sdk": "^2.31.6"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",