shipmail-cli 0.5.3 → 0.5.4

package/dist/cli.js

@@ -15,10 +15,28 @@ import {
 } from "shipmail";
 
 // src/version.ts
-var VERSION = "0.5.3";
+var VERSION = "0.5.4";
 
 // src/cli.ts
 var DEFAULT_BASE_URL = "https://shipmail.to/api/v1";
+var ALLOWED_BASE_URL_HOSTS = ["shipmail.to"];
+var RAW_REQUEST_TIMEOUT_MS = 3e4;
+var NEWSLETTER_BLOCK_TYPES = [
+  "heading",
+  "paragraph",
+  "list",
+  "callout",
+  "button",
+  "image",
+  "video",
+  "columns",
+  "link_list",
+  "quote",
+  "divider",
+  "spacer",
+  "code",
+  "custom_html"
+];
 var WEBHOOK_EVENT_TYPE_SET = new Set(WEBHOOK_EVENT_TYPES);
 var CliUsageError = class extends Error {
   constructor(message) {
@@ -39,6 +57,7 @@ function parseCliArgs(argv) {
   const options = {};
   for (let i = 0; i < argv.length; i += 1) {
     const token = argv[i];
+    if (token === void 0) break;
     if (token === "--") {
       positional.push(...argv.slice(i + 1));
       break;
@@ -117,14 +136,35 @@ function getStringList(options, key) {
   if (isStringArray(value)) return value.flatMap(splitValues);
   return splitValues(value);
 }
-function normalizeBaseUrl(value) {
-  return (value ?? DEFAULT_BASE_URL).replace(/\/+$/, "");
+function validateBaseUrl(rawValue, allowInsecure) {
+  let parsed;
+  try {
+    parsed = new URL(rawValue);
+  } catch {
+    throw new CliUsageError(`Base URL is not a valid URL: ${rawValue}`);
+  }
+  const normalized = parsed.toString().replace(/\/+$/, "");
+  if (allowInsecure) return normalized;
+  if (parsed.protocol !== "https:") {
+    throw new CliUsageError(
+      "Base URL must use https. Set SHIPMAIL_ALLOW_INSECURE_BASE_URL=1 for development."
+    );
+  }
+  const host = parsed.hostname.toLowerCase();
+  if (!ALLOWED_BASE_URL_HOSTS.some((allowed) => host === allowed || host.endsWith(`.${allowed}`))) {
+    throw new CliUsageError(
+      `Base URL host "${host}" is not allowed. Set SHIPMAIL_ALLOW_INSECURE_BASE_URL=1 for development.`
+    );
+  }
+  return normalized;
 }
 function apiKey(parsed, env) {
   return getString(parsed.options, "api-key") ?? env["SHIPMAIL_API_KEY"];
 }
 function baseUrl(parsed, env) {
-  return normalizeBaseUrl(getString(parsed.options, "base-url") ?? env["SHIPMAIL_BASE_URL"]);
+  const raw = getString(parsed.options, "base-url") ?? env["SHIPMAIL_BASE_URL"];
+  if (!raw) return DEFAULT_BASE_URL;
+  return validateBaseUrl(raw, env["SHIPMAIL_ALLOW_INSECURE_BASE_URL"] === "1");
 }
 function organizationId(parsed, env) {
   return getString(parsed.options, "organization-id") ?? env["SHIPMAIL_ORGANIZATION_ID"];
@@ -164,6 +204,23 @@ async function readTextInput(value) {
   if (value.startsWith("@")) return readFile(value.slice(1), "utf8");
   return value;
 }
+function isJsonObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isNewsletterBlock(value) {
+  return isJsonObject(value) && typeof value["type"] === "string" && NEWSLETTER_BLOCK_TYPES.includes(value["type"]);
+}
+function isAutomationDefinition(value) {
+  if (!isJsonObject(value) || !isJsonObject(value["trigger"]) || !isJsonObject(value["scope"])) {
+    return false;
+  }
+  return typeof value["trigger"]["type"] === "string" && Array.isArray(value["conditions"]) && Array.isArray(value["actions"]) && (value["mode"] === "draft" || value["mode"] === "send") && Array.isArray(value["scope"]["mailbox_ids"]) && Array.isArray(value["scope"]["calendar_addresses"]);
+}
+function isMessageMetadata(value) {
+  return isJsonObject(value) && Object.values(value).every(
+    (item) => item === null || typeof item === "string" || typeof item === "number" || typeof item === "boolean"
+  );
+}
 async function readNewsletterBlocks(value) {
   const parsed = await readJsonInput(value);
   if (!Array.isArray(parsed)) {
@@ -172,6 +229,11 @@ async function readNewsletterBlocks(value) {
   if (parsed.length === 0) {
     throw new CliUsageError("--blocks must include at least one block.");
   }
+  if (!parsed.every(isNewsletterBlock)) {
+    throw new CliUsageError(
+      `Every --blocks item must be an object whose type is one of: ${NEWSLETTER_BLOCK_TYPES.join(", ")}.`
+    );
+  }
   return parsed;
 }
 function parseArchiveVisibility(options) {
@@ -188,8 +250,10 @@ function parseStylingMode(options) {
 }
 async function automationDefinition(value) {
   const parsed = await readJsonInput(value);
-  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
-    throw new CliUsageError("--definition must be a JSON automation definition object.");
+  if (!isAutomationDefinition(parsed)) {
+    throw new CliUsageError(
+      "--definition must be a JSON object with trigger, conditions, actions, mode (draft or send) and scope { mailbox_ids, calendar_addresses }."
+    );
   }
   return parsed;
 }
@@ -306,7 +370,8 @@ async function rawApiRequest(parsed, runOptions, method, path, body, authRequire
   const response = await (runOptions.fetch ?? fetch)(`${baseUrl(parsed, env)}${path}`, {
     method,
     headers,
-    body: requestBody
+    body: requestBody,
+    signal: AbortSignal.timeout(RAW_REQUEST_TIMEOUT_MS)
   });
   if (!response.ok) {
     const contentType = response.headers.get("content-type") ?? "";
@@ -492,7 +557,9 @@ Global options:
 
 Environment:
   SHIPMAIL_API_KEY      API key for authenticated commands.
-  SHIPMAIL_BASE_URL     Optional API base URL.
+  SHIPMAIL_BASE_URL     Optional API base URL. Must be https on shipmail.to.
+  SHIPMAIL_ALLOW_INSECURE_BASE_URL=1
+                        Permit a non-https or non-shipmail.to base URL (development only).
   SHIPMAIL_ORGANIZATION_ID  Optional delegated child organization ID.
 `;
 }
@@ -557,8 +624,10 @@ async function messageMetadata(options) {
   const raw = getString(options, "metadata");
   if (!raw) return void 0;
   const parsed = await readJsonInput(raw);
-  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-    throw new CliUsageError("--metadata must be a JSON object or @path/to/file.json.");
+  if (!isMessageMetadata(parsed)) {
+    throw new CliUsageError(
+      "--metadata must be a JSON object of string, number, boolean or null values, or @path/to/file.json."
+    );
   }
   return parsed;
 }
@@ -717,7 +786,8 @@ async function runMailboxes(client, parsed, out) {
       throw new CliUsageError("Missing --password, --password-file, or --generate-password.");
     }
     const password = passwordFile ? (await readFile(passwordFile, "utf8")).replace(/\r?\n$/, "") : passwordValue;
-    if (!generatePassword && !password) {
+    const credentials = generatePassword ? { generate_password: true } : password ? { password } : void 0;
+    if (!credentials) {
       throw new CliUsageError("Mailbox password must not be empty.");
     }
     writeJson(
@@ -725,7 +795,7 @@ async function runMailboxes(client, parsed, out) {
       await client.mailboxes.create({
         domain_id: getRequiredString(parsed.options, "domain-id"),
         address: getRequiredString(parsed.options, "address"),
-        ...generatePassword ? { generate_password: true } : { password },
+        ...credentials,
         ...displayName ? { display_name: displayName } : {}
       })
     );
@@ -887,12 +957,13 @@ async function runMailboxes(client, parsed, out) {
       }
       params = { mode: "keep" };
     } else if (mode === "fixed") {
-      if (destinationMailboxIds.length !== 1) {
+      const [destinationMailboxId] = destinationMailboxIds;
+      if (destinationMailboxIds.length !== 1 || destinationMailboxId === void 0) {
         throw new CliUsageError("--mode fixed requires exactly one --destination-mailbox-id.");
       }
       params = {
         mode: "fixed",
-        destination_mailbox_id: destinationMailboxIds[0],
+        destination_mailbox_id: destinationMailboxId,
         fallback_mailbox_id: getRequiredString(parsed.options, "fallback-mailbox-id")
       };
     } else if (mode === "round-robin") {
@@ -1215,10 +1286,10 @@ async function runMessages(client, parsed, out) {
   if (subcommand === "list") {
     const mailboxId = getString(parsed.options, "mailbox-id");
     const clientReference = getString(parsed.options, "client-reference");
-    if (!mailboxId && !clientReference) {
+    const filter = mailboxId ? { mailbox_id: mailboxId, ...clientReference ? { client_reference: clientReference } : {} } : clientReference ? { client_reference: clientReference } : void 0;
+    if (!filter) {
       throw new CliUsageError("Provide --mailbox-id or --client-reference.");
     }
-    const filter = mailboxId ? { mailbox_id: mailboxId, ...clientReference ? { client_reference: clientReference } : {} } : { client_reference: clientReference };
     writeJson(
       out,
       await client.messages.list({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shipmail-cli",
-  "version": "0.5.3",
+  "version": "0.5.4",
   "description": "Official CLI for the Shipmail API",
   "type": "module",
   "bin": {
@@ -41,7 +41,7 @@
     "access": "public"
   },
   "dependencies": {
-    "shipmail": "0.5.8"
+    "shipmail": "0.5.10"
   },
   "devDependencies": {
     "tsup": "^8.4.0",