@myapihq/cli 2.31.5 → 2.31.7

package/dist/commands/domain.js

@@ -421,6 +421,10 @@ export async function updateSettings(domainArg, flags) {
         error('Nothing to update. Pass at least one of --security=<level>, --browser-check=<on|off>, --purge-cache.');
     }
     const res = await sdkDomain.updateDomainSettings(config.api_key, orgId, domain, payload);
+    if (flags.json) {
+        printJson(res);
+        return;
+    }
     success(`Updated settings for ${domain}!\n${JSON.stringify(res, null, 2)}`);
 }
 // ── DNS records sub-surface (`myapi domain records ...`) ────────────────────

package/dist/commands/email/mailbox.js

@@ -72,6 +72,10 @@ async function activateSending(flags) {
     if (!address)
         error('Missing required arguments.\nUsage: myapi email mailbox activate-sending --address <email>');
     const res = await sdkEmail.activateSending(config.api_key, address);
+    if (flags.json) {
+        printJson(res);
+        return;
+    }
     // A repaired account was broken a moment ago: it held a mailbox that reported
     // sending_enabled while the ACCOUNT had no credential behind it, so every send
     // failed with nothing in the mailbox or domain to explain why. Reporting that
@@ -85,12 +89,16 @@ async function activateSending(flags) {
     }
     success(`Sending activated: ${address} (${res.emails_quota_remaining} emails/day quota)`);
 }
-async function setForwarding(address, forwardTo, _flags) {
+async function setForwarding(address, forwardTo, flags) {
     const config = requireConfig();
     if (!address || !forwardTo) {
         error('Missing required arguments.\nUsage: myapi email mailbox set-forwarding <user@domain> <forward-to@domain>');
     }
     const res = await sdkEmail.setForwarding(config.api_key, address, forwardTo);
+    if (flags.json) {
+        printJson(res);
+        return;
+    }
     success(`Forwarding set: ${res.address} → ${res.forward_to}`);
     info('A copy of every incoming message is redirected; the original is kept in the mailbox.');
 }

package/dist/commands/email/message-textpart.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/commands/email/message-textpart.test.js

@@ -0,0 +1,64 @@
+// An html-only `email message send` arrived with an EMPTY text/plain part.
+//
+// The backend adds the multipart alternative but does not fill it (filed
+// 2026-08-23, still open backend-side). Found live by the deep probe's email
+// journey on its FIRST run with a real fixture, 2026-08-25 — the exact defect
+// the step was written for, invisible to everything that does not read a
+// delivered message. The CLI now derives the plain part from the HTML, so the
+// customer-facing defect is closed regardless of when the backend fills its
+// half.
+import { describe, it, expect, vi } from 'vitest';
+const sdk = vi.hoisted(() => ({
+    email: { sendEmail: vi.fn(async () => ({ message_id: 'm-1' })) },
+    MyApiError: class MyApiError extends Error {
+        code = '';
+        status = 0;
+    },
+    // retryFunds in utils.js wraps sends with the 402 auto-recharge loop.
+    withFundsRetry: (fn) => fn(),
+    isInsufficientFunds: () => false,
+    autoRechargeState: () => undefined,
+}));
+vi.mock('@myapihq/sdk', () => sdk);
+vi.mock('../../config.js', () => ({
+    requireConfig: () => ({ api_key: 'hq_live_test' }),
+    loadConfig: () => ({ api_key: 'hq_live_test' }),
+    CONFIG_DIR: '/tmp/nowhere',
+}));
+import { run, plainTextFromHtml } from './message.js';
+import { withSink } from '../../output.js';
+const SINK = { out: () => { }, err: () => { }, fail: (m) => { throw new Error(m); } };
+describe('html-only send carries a derived text part', () => {
+    it('fills text from the html when --body is absent', async () => {
+        await withSink(SINK, () => run('send', [], {
+            from: 'a@x.co', to: 'b@x.co', subject: 's',
+            html: '<h1>Hello</h1><p>Two &amp; two.</p>',
+        }));
+        const payload = sdk.email.sendEmail.mock.calls.at(-1)[1];
+        expect(payload.text).toBe('Hello\nTwo & two.');
+        expect(payload.html).toContain('<h1>');
+    });
+    it('never overwrites an explicit --body', async () => {
+        await withSink(SINK, () => run('send', [], {
+            from: 'a@x.co', to: 'b@x.co', subject: 's',
+            html: '<p>rich</p>', body: 'my own words',
+        }));
+        expect(sdk.email.sendEmail.mock.calls.at(-1)[1].text).toBe('my own words');
+    });
+    it('text-only send is untouched', async () => {
+        await withSink(SINK, () => run('send', [], {
+            from: 'a@x.co', to: 'b@x.co', subject: 's', body: 'plain',
+        }));
+        const payload = sdk.email.sendEmail.mock.calls.at(-1)[1];
+        expect(payload.text).toBe('plain');
+        expect(payload.html).toBeUndefined();
+    });
+});
+describe('plainTextFromHtml', () => {
+    it('turns block boundaries into line breaks and strips the rest', () => {
+        expect(plainTextFromHtml('<div>a</div><div>b<br>c</div>')).toBe('a\nb\nc');
+    });
+    it('unescapes the common entities', () => {
+        expect(plainTextFromHtml('<p>&lt;tag&gt; &quot;q&quot; &amp; more&nbsp;here</p>')).toBe('<tag> "q" & more here');
+    });
+});

package/dist/commands/email/message.d.ts

@@ -1,5 +1,6 @@
 import type { Flags } from '../../helpers.js';
 import type { Exposes } from '../../exposes.js';
 export declare const EXPOSES: Exposes;
+export declare function plainTextFromHtml(html: string): string;
 export declare const SUBCOMMAND_USAGE: Record<string, string>;
 export declare function run(sub: string | undefined, args: string[], flags: Flags): Promise<void>;

package/dist/commands/email/message.js

@@ -21,6 +21,21 @@ function summarizeMessage(m) {
         received_at: m.received_at,
     };
 }
+// Block-level tags become line breaks, everything else is stripped, entities
+// beyond the common five are left alone. Exported for the test.
+export function plainTextFromHtml(html) {
+    return html
+        .replace(/<\s*(br|\/p|\/div|\/h[1-6]|\/li|\/tr)[^>]*>/gi, '\n')
+        .replace(/<[^>]+>/g, '')
+        .replace(/&nbsp;/g, ' ')
+        .replace(/&amp;/g, '&')
+        .replace(/&lt;/g, '<')
+        .replace(/&gt;/g, '>')
+        .replace(/&quot;/g, '"')
+        .replace(/[ \t]+\n/g, '\n')
+        .replace(/\n{3,}/g, '\n\n')
+        .trim();
+}
 async function send(flags) {
     const config = requireConfig();
     // typeof check (not truthiness): a bare `--to` whose value got swallowed by
@@ -41,15 +56,29 @@ async function send(flags) {
             error('--template-vars must be valid JSON');
         }
     }
+    // An html-only send used to arrive with an EMPTY text/plain part: the
+    // backend adds the alternative but does not fill it (filed 2026-08-23,
+    // still open), so text-only clients and some spam filters saw a blank
+    // message. The API accepts `text`, so derive one instead of waiting.
+    // The stripper is deliberately crude — the plain part's job is to carry the
+    // words, not the layout.
+    const html = flags.html;
+    let text = flags.body;
+    if (html && !text)
+        text = plainTextFromHtml(html);
     const res = await retryFunds(() => sdkEmail.sendEmail(config.api_key, {
         from: flags.from,
         to: [flags.to],
         subject: flags.subject,
-        text: flags.body,
-        html: flags.html,
+        text,
+        html,
         template_id: flags['template-id'],
         template_vars: templateVars,
     }));
+    if (flags.json) {
+        printJson(res);
+        return;
+    }
     success(`Email sent! Message ID: ${res.message_id}`);
 }
 async function status(messageId, _flags) {

package/dist/commands/email/template.js

@@ -34,6 +34,10 @@ async function generate(nameArg, flags) {
         failedMessage: 'Template generation failed',
         timeoutMessage: 'Template generation timed out',
     });
+    if (flags.json) {
+        printJson(status);
+        return;
+    }
     success(`Template generated! ID: ${status.template_id}\nPreview: ${status.result?.preview_url}`);
 }
 async function list(flags) {
@@ -100,6 +104,10 @@ async function edit(id, flags) {
     if (!id || !flags.prompt)
         error('Missing required arguments.\nUsage: myapi email template edit <id> --prompt <str> [--org <id>]');
     const res = await sdkEmail.editTemplate(config.api_key, orgId, id, flags.prompt);
+    if (flags.json) {
+        printJson(res);
+        return;
+    }
     success(`Template ${res.template_id} edited\nPreview: ${res.preview_url}`);
 }
 async function sendTest(id, flags) {
@@ -108,6 +116,10 @@ async function sendTest(id, flags) {
     if (!id || !flags.to)
         error('Missing required arguments.\nUsage: myapi email template send-test <template_id> --to <email> [--org <id>]');
     const res = await sdkEmail.sendTestEmail(config.api_key, orgId, id, flags.to);
+    if (flags.json) {
+        printJson(res);
+        return;
+    }
     success(`Test sent! Message ID: ${res.message_id}`);
 }
 async function del(id, flags) {

package/dist/commands/fn-create-json.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/commands/fn-create-json.test.js

@@ -0,0 +1,49 @@
+// `fn create --json` printed the human text, JSON nowhere.
+//
+// The scoped API key is returned exactly ONCE, at create. A script running
+// under --json got the prose rendering instead of a parseable object, so the
+// one-shot key was lost to anything that was not a human reading a terminal —
+// the same ignored---json class as `storage upload` and `mailbox create`.
+// Found by examples/a-to-z/run.mjs on its first real run, 2026-08-25.
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+const sdk = vi.hoisted(() => ({
+    fn: { createFunction: vi.fn() },
+    MyApiError: class MyApiError extends Error {
+        code = '';
+        status = 0;
+    },
+}));
+vi.mock('@myapihq/sdk', () => sdk);
+vi.mock('../config.js', () => ({
+    requireConfig: () => ({ api_key: 'hq_live_test', default_org: 'o-1' }),
+    loadConfig: () => ({ api_key: 'hq_live_test', default_org: 'o-1' }),
+    CONFIG_DIR: '/tmp/nowhere',
+}));
+import { create } from './fn.js';
+import { withSink } from '../output.js';
+const RESULT = {
+    function: { id: 'fn-1', name: 'demo', trigger_type: 'http', invocation_url: null },
+    scoped_api_key: 'hq_live_once',
+    scoped_api_key_id: 'key-1',
+};
+describe('fn create honours --json', () => {
+    // stdout and stderr are separate contracts: JSON rides stdout, the
+    // org-context banner rides stderr. Mixing them here would re-create the
+    // parse bug this file exists to prevent.
+    const out = [];
+    const err = [];
+    const SINK = { out: (m) => out.push(m), err: (m) => err.push(m), fail: (m) => { throw new Error(m); } };
+    beforeEach(() => { out.length = 0; err.length = 0; sdk.fn.createFunction.mockResolvedValue(RESULT); });
+    it('emits the full result as parseable JSON, including the one-shot key', async () => {
+        await withSink(SINK, () => create('demo', { json: true, org: 'o-1' }));
+        const parsed = JSON.parse(out.join('\n'));
+        expect(parsed.scoped_api_key).toBe('hq_live_once');
+        expect(parsed.function.id).toBe('fn-1');
+    });
+    it('without --json, keeps the human rendering', async () => {
+        await withSink(SINK, () => create('demo', { org: 'o-1' }));
+        const text = [...out, ...err].join('\n');
+        expect(text).toContain('Function created: fn-1');
+        expect(() => JSON.parse(text)).toThrow();
+    });
+});

package/dist/commands/fn.js

@@ -94,6 +94,15 @@ export async function create(nameArg, flags) {
             payload.scopes = scopes;
     }
     const result = await sdkFn.createFunction(config.api_key, orgId, payload);
+    // --json must carry the whole result — including the scoped key, which is
+    // returned exactly once. A script that created a function under --json got
+    // the human text instead (found by examples/a-to-z/run.mjs, the same
+    // ignored---json class as storage upload and mailbox create), and the
+    // one-shot key was lost to anything that wasn't a human reading a terminal.
+    if (flags.json) {
+        printJson(result);
+        return;
+    }
     success(`Function created: ${result.function.id}`);
     info(`Name:            ${result.function.name}`);
     info(`Trigger:         ${result.function.trigger_type}${result.function.cron_schedule ? ` (${result.function.cron_schedule})` : ''}`);
@@ -288,6 +297,10 @@ export async function setEnv(id, name, value, flags) {
         if (Object.keys(env).length === 0)
             error('No secrets given. Usage: myapi fn env <id> --set KEY=VALUE');
         const result = await sdkFn.setFunctionEnvBulk(config.api_key, orgId, id, env);
+        if (flags.json) {
+            printJson(result);
+            return;
+        }
         success(`Set ${result.set} secret${result.set === 1 ? '' : 's'} on function ${id}`);
         info('Values are encrypted at rest and never stored or echoed by MyAPI.');
         return;

package/dist/commands/funnel.js

@@ -137,6 +137,10 @@ export async function create(flags) {
     if (name)
         validateFunnelName(name);
     const result = await sdkFunnel.createFunnel(config.api_key, orgId, name ? { name } : undefined);
+    if (flags.json) {
+        printJson(result);
+        return;
+    }
     success(`Funnel created! ID: ${result.funnel.id}`);
     if (result.funnel.name)
         info(`Name:    ${result.funnel.name}`);

package/dist/commands/git.js

@@ -104,6 +104,10 @@ export async function create(name, flags) {
     const repoName = name || flags.name;
     requireArg(repoName, 'name', 'myapi git create <name> [--default-branch <b>]');
     const res = await sdkGit.createRepo(config.api_key, orgId, repoName, flags['default-branch']);
+    if (flags.json) {
+        printJson(res);
+        return;
+    }
     success(`Repository created: ${res.name}`);
     info(`Default branch: ${res.default_branch}`);
 }
@@ -334,6 +338,10 @@ export async function merge(repo, flags) {
     if (!target || !source)
         error('Both --target <branch> and --source <branch> are required.\nUsage: myapi git merge <repo> --target <b> --source <b>\n(Merge is fast-forward only.)');
     const res = await sdkGit.merge(config.api_key, orgId, repo, target, source);
+    if (flags.json) {
+        printJson(res);
+        return;
+    }
     success(`Merged ${source} into ${target} → ${shortSha(res.sha)}`);
 }
 export async function repack(repo, flags) {

package/dist/commands/payments.js

@@ -60,6 +60,10 @@ export async function connect(flags) {
     if (!key.startsWith('sk_'))
         error('--stripe-key must be a Stripe secret key (starts with "sk_").');
     const res = await sdkPayments.connect(config.api_key, orgId, key);
+    if (flags.json) {
+        printJson(res);
+        return;
+    }
     success('Stripe connected.');
     info(`Tier:              ${res.tier}`);
     info(`Stripe account:    ${res.stripe_account_id}`);
@@ -174,6 +178,10 @@ export async function refund(id, flags) {
     if (!id)
         error('Missing charge id.\nUsage: myapi payments refund <charge_id>');
     const res = await sdkPayments.refundCharge(config.api_key, orgId, id);
+    if (flags.json) {
+        printJson(res);
+        return;
+    }
     success(`Charge ${res.id} refunded (status: ${res.status}).`);
 }
 // ── Dispatcher ───────────────────────────────────────────────────────────────

package/dist/commands/storage.js

@@ -85,6 +85,10 @@ async function ingest(url, flags) {
     const orgId = requireOrg(flags, config, 'myapi storage ingest <url> [--name <name>] [--org <id>]');
     requireArg(url, 'url', 'myapi storage ingest <url> [--name <name>] [--org <id>]');
     const res = await sdkStorage.ingestAsset(config.api_key, orgId, url, flags.name);
+    if (flags.json) {
+        printJson(res);
+        return;
+    }
     success(`Asset ingested! ID: ${res.asset_id}\nHosted URL: ${res.url}`);
 }
 async function upload(filePath, flags) {

package/dist/commands/workflow.js

@@ -216,6 +216,10 @@ export async function create(nameArg, flags) {
         trigger_config: { endpoint_id: endpointId },
         steps,
     });
+    if (flags.json) {
+        printJson(wf);
+        return;
+    }
     const shouldEnable = flags['no-enable'] !== true;
     if (shouldEnable) {
         await sdkWorkflow.enableWorkflow(config.api_key, orgId, wf.id);
@@ -253,6 +257,10 @@ export async function update(id, flags) {
         error('Nothing to update. Provide at least one of --name, --endpoint-id, --steps.');
     }
     const wf = await sdkWorkflow.updateWorkflow(config.api_key, orgId, id, payload);
+    if (flags.json) {
+        printJson(wf);
+        return;
+    }
     success(`Workflow ${wf.id} updated`);
 }
 export async function enable(id, flags) {

package/dist/errors.js

@@ -3,6 +3,9 @@ import { currentOrg } from './helpers.js';
 // index.ts) so it can be unit-tested without importing the CLI entrypoint,
 // which runs main() on import.
 export const ERROR_MESSAGES = {
+    // 402, but not about money: the mailbox exists and the wallet is fine —
+    // outbound sending was never switched on for this address.
+    SENDING_NOT_ACTIVATED: 'This address cannot send yet — sending was never activated (this is not a billing problem). Run: myapi email mailbox activate-sending --address <email>',
     DOMAIN_NOT_FOUND: 'Domain not found.',
     INVALID_DOMAIN: 'Invalid domain name.',
     ORG_NOT_FOUND: 'Organization not found.',

package/dist/errors.test.js

@@ -165,3 +165,16 @@ describe('5xx advice distinguishes a read from a write', () => {
         expect(friendlyError(err())).toContain('went through');
     });
 });
+// SENDING_NOT_ACTIVATED arrives as HTTP 402, and the 402 handler's fallback
+// assumed any unrecognized 402 was an empty wallet — so a user with $92 of
+// credits was told "Insufficient balance. Top up". Money pointed at a problem
+// money cannot fix. Found live by the deep probe's email journey, 2026-08-25.
+describe('402 that is not about money', () => {
+    it('SENDING_NOT_ACTIVATED names the activation command, not a top-up', () => {
+        const e = new MyApiError('SENDING_NOT_ACTIVATED', 402, 'Activate sending for this address via POST /email/sending/activate');
+        const msg = friendlyError(e);
+        expect(msg).toContain('activate-sending');
+        expect(msg).toContain('not a billing problem');
+        expect(msg).not.toContain('topup');
+    });
+});

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { error, info, success, banner, setResolvedContextSource } from './output.js';
 import { loadConfig } from './config.js';
-import { MyApiError, setUserAgent, hq } from '@myapihq/sdk';
+import { MyApiError, setUserAgent, hq, isInsufficientFunds } from '@myapihq/sdk';
 import { friendlyError } from './errors.js';
 import { currentOrg, adoptSoleOrg } from './helpers.js';
 import * as fs from 'fs';
@@ -412,8 +412,16 @@ async function main() {
                     // Anonymous accounts can't top up (no payment surface) — link to unlock.
                     else if (cfg?.is_anonymous)
                         error('Insufficient balance. Anonymous accounts have no free credit — link an email to unlock $5: myapi account link <email>');
-                    else
+                    else if (!err.code || isInsufficientFunds(err)) {
                         error('Insufficient balance. Top up: myapi billing topup <amount> — or keep it funded automatically: myapi billing auto-recharge set');
+                    }
+                    // A 402 whose code is NOT about money. SENDING_NOT_ACTIVATED arrives
+                    // as 402 and landed in the branch above, so a user with $92 of
+                    // credits was told to top up — money pointed at a problem money
+                    // cannot fix, the same shape as "Invalid API key → run setup" on the
+                    // wrong-host bug. Show what the platform actually said.
+                    else
+                        error(friendlyError(err));
                 }
             }
             else

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@myapihq/cli",
   "license": "Apache-2.0",
-  "version": "2.31.5",
+  "version": "2.31.7",
   "description": "MyAPI command-line interface",
   "repository": {
     "type": "git",
@@ -37,6 +37,7 @@
     "lint:query-params": "node scripts/lint-query-params.js",
     "lint:flag-lexicon": "node scripts/lint-flag-lexicon.js",
     "lint:verb-symmetry": "node scripts/lint-verb-symmetry.js",
+    "lint:json-parity": "node scripts/lint-json-parity.js",
     "lint:request-fields": "node scripts/lint-request-fields.js",
     "audit:doctor": "npm run build && node scripts/audit-doctor.js",
     "lint:docs": "node scripts/lint-docs.js",
@@ -49,7 +50,7 @@
     "lint:skills:strict": "node scripts/copy-skills.js && node scripts/lint-skills.js --strict"
   },
   "dependencies": {
-    "@myapihq/sdk": "^2.31.5"
+    "@myapihq/sdk": "^2.31.7"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",