shipmail-cli 0.5.2 → 0.5.4

package/README.md

@@ -89,6 +89,8 @@ shipmail inbox thread 550e8400-e29b-41d4-a716-446655440000 thr_123
 shipmail inbox draft 550e8400-e29b-41d4-a716-446655440000 thr_123 --expected-version 7 --text "Thanks for the note"
 # Apply your approval policy; stale drafts fail with 409 without delivery.
 shipmail inbox send-draft 550e8400-e29b-41d4-a716-446655440000 thr_123 drf_123
+# Save a new message to Drafts for a human to review and send; this never sends
+shipmail inbox compose-draft 550e8400-e29b-41d4-a716-446655440000 --to user@example.com --subject "Kickoff" --text "Draft for review"
 shipmail inbox thread-attention 550e8400-e29b-41d4-a716-446655440000 thr_123 --done true --expected-version 8
 shipmail inbox reply-message 550e8400-e29b-41d4-a716-446655440000 eml_123 --to user@example.com --text "Thanks"
 shipmail inbox reply-thread 550e8400-e29b-41d4-a716-446655440000 thr_123 --to user@example.com --text "Following up"

package/dist/cli.js

@@ -15,10 +15,28 @@ import {
 } from "shipmail";
 
 // src/version.ts
-var VERSION = "0.5.2";
+var VERSION = "0.5.4";
 
 // src/cli.ts
 var DEFAULT_BASE_URL = "https://shipmail.to/api/v1";
+var ALLOWED_BASE_URL_HOSTS = ["shipmail.to"];
+var RAW_REQUEST_TIMEOUT_MS = 3e4;
+var NEWSLETTER_BLOCK_TYPES = [
+  "heading",
+  "paragraph",
+  "list",
+  "callout",
+  "button",
+  "image",
+  "video",
+  "columns",
+  "link_list",
+  "quote",
+  "divider",
+  "spacer",
+  "code",
+  "custom_html"
+];
 var WEBHOOK_EVENT_TYPE_SET = new Set(WEBHOOK_EVENT_TYPES);
 var CliUsageError = class extends Error {
   constructor(message) {
@@ -39,6 +57,7 @@ function parseCliArgs(argv) {
   const options = {};
   for (let i = 0; i < argv.length; i += 1) {
     const token = argv[i];
+    if (token === void 0) break;
     if (token === "--") {
       positional.push(...argv.slice(i + 1));
       break;
@@ -117,14 +136,35 @@ function getStringList(options, key) {
   if (isStringArray(value)) return value.flatMap(splitValues);
   return splitValues(value);
 }
-function normalizeBaseUrl(value) {
-  return (value ?? DEFAULT_BASE_URL).replace(/\/+$/, "");
+function validateBaseUrl(rawValue, allowInsecure) {
+  let parsed;
+  try {
+    parsed = new URL(rawValue);
+  } catch {
+    throw new CliUsageError(`Base URL is not a valid URL: ${rawValue}`);
+  }
+  const normalized = parsed.toString().replace(/\/+$/, "");
+  if (allowInsecure) return normalized;
+  if (parsed.protocol !== "https:") {
+    throw new CliUsageError(
+      "Base URL must use https. Set SHIPMAIL_ALLOW_INSECURE_BASE_URL=1 for development."
+    );
+  }
+  const host = parsed.hostname.toLowerCase();
+  if (!ALLOWED_BASE_URL_HOSTS.some((allowed) => host === allowed || host.endsWith(`.${allowed}`))) {
+    throw new CliUsageError(
+      `Base URL host "${host}" is not allowed. Set SHIPMAIL_ALLOW_INSECURE_BASE_URL=1 for development.`
+    );
+  }
+  return normalized;
 }
 function apiKey(parsed, env) {
   return getString(parsed.options, "api-key") ?? env["SHIPMAIL_API_KEY"];
 }
 function baseUrl(parsed, env) {
-  return normalizeBaseUrl(getString(parsed.options, "base-url") ?? env["SHIPMAIL_BASE_URL"]);
+  const raw = getString(parsed.options, "base-url") ?? env["SHIPMAIL_BASE_URL"];
+  if (!raw) return DEFAULT_BASE_URL;
+  return validateBaseUrl(raw, env["SHIPMAIL_ALLOW_INSECURE_BASE_URL"] === "1");
 }
 function organizationId(parsed, env) {
   return getString(parsed.options, "organization-id") ?? env["SHIPMAIL_ORGANIZATION_ID"];
@@ -164,6 +204,23 @@ async function readTextInput(value) {
   if (value.startsWith("@")) return readFile(value.slice(1), "utf8");
   return value;
 }
+function isJsonObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isNewsletterBlock(value) {
+  return isJsonObject(value) && typeof value["type"] === "string" && NEWSLETTER_BLOCK_TYPES.includes(value["type"]);
+}
+function isAutomationDefinition(value) {
+  if (!isJsonObject(value) || !isJsonObject(value["trigger"]) || !isJsonObject(value["scope"])) {
+    return false;
+  }
+  return typeof value["trigger"]["type"] === "string" && Array.isArray(value["conditions"]) && Array.isArray(value["actions"]) && (value["mode"] === "draft" || value["mode"] === "send") && Array.isArray(value["scope"]["mailbox_ids"]) && Array.isArray(value["scope"]["calendar_addresses"]);
+}
+function isMessageMetadata(value) {
+  return isJsonObject(value) && Object.values(value).every(
+    (item) => item === null || typeof item === "string" || typeof item === "number" || typeof item === "boolean"
+  );
+}
 async function readNewsletterBlocks(value) {
   const parsed = await readJsonInput(value);
   if (!Array.isArray(parsed)) {
@@ -172,6 +229,11 @@ async function readNewsletterBlocks(value) {
   if (parsed.length === 0) {
     throw new CliUsageError("--blocks must include at least one block.");
   }
+  if (!parsed.every(isNewsletterBlock)) {
+    throw new CliUsageError(
+      `Every --blocks item must be an object whose type is one of: ${NEWSLETTER_BLOCK_TYPES.join(", ")}.`
+    );
+  }
   return parsed;
 }
 function parseArchiveVisibility(options) {
@@ -188,8 +250,10 @@ function parseStylingMode(options) {
 }
 async function automationDefinition(value) {
   const parsed = await readJsonInput(value);
-  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
-    throw new CliUsageError("--definition must be a JSON automation definition object.");
+  if (!isAutomationDefinition(parsed)) {
+    throw new CliUsageError(
+      "--definition must be a JSON object with trigger, conditions, actions, mode (draft or send) and scope { mailbox_ids, calendar_addresses }."
+    );
   }
   return parsed;
 }
@@ -306,7 +370,8 @@ async function rawApiRequest(parsed, runOptions, method, path, body, authRequire
   const response = await (runOptions.fetch ?? fetch)(`${baseUrl(parsed, env)}${path}`, {
     method,
     headers,
-    body: requestBody
+    body: requestBody,
+    signal: AbortSignal.timeout(RAW_REQUEST_TIMEOUT_MS)
   });
   if (!response.ok) {
     const contentType = response.headers.get("content-type") ?? "";
@@ -385,6 +450,7 @@ Usage:
   shipmail inbox thread <mailbox-id> <thread-id>
   shipmail inbox thread-attention <mailbox-id> <thread-id> --done true --expected-version 3
   shipmail inbox draft <mailbox-id> <thread-id> --expected-version 3 (--text "Hello" | --html "<p>Hello</p>") [--reply-mode reply_all]
+  shipmail inbox compose-draft <mailbox-id> --to user@example.com [--cc ...] [--bcc ...] [--subject "Hi"] (--text "Hello" | --html "<p>Hello</p>") [--idempotency-key key]  (saves a new message to Drafts; never sends)
   shipmail inbox send-draft <mailbox-id> <thread-id> <draft-id>
   shipmail inbox reply-message <mailbox-id> <message-id> --to user@example.com (--text "Hello" | --html "<p>Hello</p>") [--track-reply true|false]
   shipmail inbox reply-thread <mailbox-id> <thread-id> --to user@example.com (--text "Hello" | --html "<p>Hello</p>") [--track-reply true|false]
@@ -491,7 +557,9 @@ Global options:
 
 Environment:
   SHIPMAIL_API_KEY      API key for authenticated commands.
-  SHIPMAIL_BASE_URL     Optional API base URL.
+  SHIPMAIL_BASE_URL     Optional API base URL. Must be https on shipmail.to.
+  SHIPMAIL_ALLOW_INSECURE_BASE_URL=1
+                        Permit a non-https or non-shipmail.to base URL (development only).
   SHIPMAIL_ORGANIZATION_ID  Optional delegated child organization ID.
 `;
 }
@@ -556,8 +624,10 @@ async function messageMetadata(options) {
   const raw = getString(options, "metadata");
   if (!raw) return void 0;
   const parsed = await readJsonInput(raw);
-  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-    throw new CliUsageError("--metadata must be a JSON object or @path/to/file.json.");
+  if (!isMessageMetadata(parsed)) {
+    throw new CliUsageError(
+      "--metadata must be a JSON object of string, number, boolean or null values, or @path/to/file.json."
+    );
   }
   return parsed;
 }
@@ -716,7 +786,8 @@ async function runMailboxes(client, parsed, out) {
       throw new CliUsageError("Missing --password, --password-file, or --generate-password.");
     }
     const password = passwordFile ? (await readFile(passwordFile, "utf8")).replace(/\r?\n$/, "") : passwordValue;
-    if (!generatePassword && !password) {
+    const credentials = generatePassword ? { generate_password: true } : password ? { password } : void 0;
+    if (!credentials) {
       throw new CliUsageError("Mailbox password must not be empty.");
     }
     writeJson(
@@ -724,7 +795,7 @@ async function runMailboxes(client, parsed, out) {
       await client.mailboxes.create({
         domain_id: getRequiredString(parsed.options, "domain-id"),
         address: getRequiredString(parsed.options, "address"),
-        ...generatePassword ? { generate_password: true } : { password },
+        ...credentials,
         ...displayName ? { display_name: displayName } : {}
       })
     );
@@ -886,12 +957,13 @@ async function runMailboxes(client, parsed, out) {
       }
       params = { mode: "keep" };
     } else if (mode === "fixed") {
-      if (destinationMailboxIds.length !== 1) {
+      const [destinationMailboxId] = destinationMailboxIds;
+      if (destinationMailboxIds.length !== 1 || destinationMailboxId === void 0) {
         throw new CliUsageError("--mode fixed requires exactly one --destination-mailbox-id.");
       }
       params = {
         mode: "fixed",
-        destination_mailbox_id: destinationMailboxIds[0],
+        destination_mailbox_id: destinationMailboxId,
         fallback_mailbox_id: getRequiredString(parsed.options, "fallback-mailbox-id")
       };
     } else if (mode === "round-robin") {
@@ -1069,6 +1141,33 @@ async function runInbox(client, parsed, out) {
     );
     return;
   }
+  if (subcommand === "compose-draft") {
+    const to = messageRecipients(parsed.options, "to");
+    const cc = messageRecipients(parsed.options, "cc");
+    const bcc = messageRecipients(parsed.options, "bcc");
+    const subject = getString(parsed.options, "subject");
+    const text = await readTextInput(getString(parsed.options, "text"));
+    const html = await readTextInput(getString(parsed.options, "html"));
+    const idempotencyKey = getString(parsed.options, "idempotency-key");
+    if (to.length === 0) throw new CliUsageError("Provide at least one --to recipient.");
+    if (!text && !html) throw new CliUsageError("Provide --text or --html.");
+    writeJson(
+      out,
+      await client.mailboxes.createInboxDraft(
+        requirePositional(parsed.positional, 2, "mailbox id"),
+        {
+          to,
+          ...cc.length > 0 ? { cc } : {},
+          ...bcc.length > 0 ? { bcc } : {},
+          ...subject !== void 0 ? { subject } : {},
+          ...text ? { text } : {},
+          ...html ? { html } : {}
+        },
+        idempotencyKey ? { idempotencyKey } : void 0
+      )
+    );
+    return;
+  }
   if (subcommand === "send-draft") {
     writeJson(
       out,
@@ -1187,10 +1286,10 @@ async function runMessages(client, parsed, out) {
   if (subcommand === "list") {
     const mailboxId = getString(parsed.options, "mailbox-id");
     const clientReference = getString(parsed.options, "client-reference");
-    if (!mailboxId && !clientReference) {
+    const filter = mailboxId ? { mailbox_id: mailboxId, ...clientReference ? { client_reference: clientReference } : {} } : clientReference ? { client_reference: clientReference } : void 0;
+    if (!filter) {
       throw new CliUsageError("Provide --mailbox-id or --client-reference.");
     }
-    const filter = mailboxId ? { mailbox_id: mailboxId, ...clientReference ? { client_reference: clientReference } : {} } : { client_reference: clientReference };
     writeJson(
       out,
       await client.messages.list({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shipmail-cli",
-  "version": "0.5.2",
+  "version": "0.5.4",
   "description": "Official CLI for the Shipmail API",
   "type": "module",
   "bin": {
@@ -41,7 +41,7 @@
     "access": "public"
   },
   "dependencies": {
-    "shipmail": "0.5.6"
+    "shipmail": "0.5.10"
   },
   "devDependencies": {
     "tsup": "^8.4.0",