shipmail-cli 0.5.3 → 0.6.0

package/README.md

@@ -14,7 +14,7 @@ Most commands require an API key. Create one in the Shipmail dashboard and expor
 export SHIPMAIL_API_KEY="sm_live_..."
 ```
 
-You can also pass `--api-key` to any command. Use `SHIPMAIL_BASE_URL` or `--base-url` when targeting a non-production API. Approved partners can set `SHIPMAIL_ORGANIZATION_ID` or pass `--organization-id` for delegated infrastructure calls.
+You can also pass `--api-key` to any command. Use `SHIPMAIL_BASE_URL` or `--base-url` when targeting a non-production API.
 
 ## Common Commands
 
@@ -125,14 +125,6 @@ shipmail webhooks create \
   --events message.received,message.bounced
 shipmail webhooks deliveries whk_123 --status failed
 shipmail webhooks replay-delivery whk_123 dlv_123 --idempotency-key replay-123
-
-# Partner beta lifecycle and delegated infrastructure
-shipmail partner organizations create --name "Operator" --external-reference operator_123 --owner-email owner@example.com --mailbox-limit 3 --data-classification internal_test
-shipmail partner usage
-shipmail partner credential-grants list
-shipmail partner credential-grants consume grant_123 --name "Embedded webmail"
-shipmail domains list --organization-id 00000000-0000-4000-8000-000000000123
-shipmail mailboxes create --organization-id 00000000-0000-4000-8000-000000000123 --domain-id dom_123 --address support --generate-password
 ```
 
 Paragraph, quote, callout, list-item, and column bodies in `--blocks` accept bare text or
@@ -174,9 +166,6 @@ Use repeatable `--header "Name: value"` flags for request headers. Use `--output
 - `newsletter-domains list`
 - `newsletters create|update|preview|preflight|test-send|schedule|cancel|resume`
 - `newsletter-assets list|upload|register-url`
-- `partner organizations list|create|get|update|invite|suspend|resume|offboard`
-- `partner credential-grants list|consume`
-- `partner usage`
 
 Configure a publisher-owned Atom self URL and the number of recent issues:
 

package/dist/cli.js

@@ -15,10 +15,28 @@ import {
 } from "shipmail";
 
 // src/version.ts
-var VERSION = "0.5.3";
+var VERSION = "0.6.0";
 
 // src/cli.ts
 var DEFAULT_BASE_URL = "https://shipmail.to/api/v1";
+var ALLOWED_BASE_URL_HOSTS = ["shipmail.to"];
+var RAW_REQUEST_TIMEOUT_MS = 3e4;
+var NEWSLETTER_BLOCK_TYPES = [
+  "heading",
+  "paragraph",
+  "list",
+  "callout",
+  "button",
+  "image",
+  "video",
+  "columns",
+  "link_list",
+  "quote",
+  "divider",
+  "spacer",
+  "code",
+  "custom_html"
+];
 var WEBHOOK_EVENT_TYPE_SET = new Set(WEBHOOK_EVENT_TYPES);
 var CliUsageError = class extends Error {
   constructor(message) {
@@ -39,6 +57,7 @@ function parseCliArgs(argv) {
   const options = {};
   for (let i = 0; i < argv.length; i += 1) {
     const token = argv[i];
+    if (token === void 0) break;
     if (token === "--") {
       positional.push(...argv.slice(i + 1));
       break;
@@ -117,17 +136,35 @@ function getStringList(options, key) {
   if (isStringArray(value)) return value.flatMap(splitValues);
   return splitValues(value);
 }
-function normalizeBaseUrl(value) {
-  return (value ?? DEFAULT_BASE_URL).replace(/\/+$/, "");
+function validateBaseUrl(rawValue, allowInsecure) {
+  let parsed;
+  try {
+    parsed = new URL(rawValue);
+  } catch {
+    throw new CliUsageError(`Base URL is not a valid URL: ${rawValue}`);
+  }
+  const normalized = parsed.toString().replace(/\/+$/, "");
+  if (allowInsecure) return normalized;
+  if (parsed.protocol !== "https:") {
+    throw new CliUsageError(
+      "Base URL must use https. Set SHIPMAIL_ALLOW_INSECURE_BASE_URL=1 for development."
+    );
+  }
+  const host = parsed.hostname.toLowerCase();
+  if (!ALLOWED_BASE_URL_HOSTS.some((allowed) => host === allowed || host.endsWith(`.${allowed}`))) {
+    throw new CliUsageError(
+      `Base URL host "${host}" is not allowed. Set SHIPMAIL_ALLOW_INSECURE_BASE_URL=1 for development.`
+    );
+  }
+  return normalized;
 }
 function apiKey(parsed, env) {
   return getString(parsed.options, "api-key") ?? env["SHIPMAIL_API_KEY"];
 }
 function baseUrl(parsed, env) {
-  return normalizeBaseUrl(getString(parsed.options, "base-url") ?? env["SHIPMAIL_BASE_URL"]);
-}
-function organizationId(parsed, env) {
-  return getString(parsed.options, "organization-id") ?? env["SHIPMAIL_ORGANIZATION_ID"];
+  const raw = getString(parsed.options, "base-url") ?? env["SHIPMAIL_BASE_URL"];
+  if (!raw) return DEFAULT_BASE_URL;
+  return validateBaseUrl(raw, env["SHIPMAIL_ALLOW_INSECURE_BASE_URL"] === "1");
 }
 function requireApiKey(parsed, env) {
   const key = apiKey(parsed, env);
@@ -141,7 +178,6 @@ function createClient(parsed, options) {
   const config = {
     apiKey: requireApiKey(parsed, env),
     baseUrl: baseUrl(parsed, env),
-    organizationId: organizationId(parsed, env),
     ...options.fetch ? { fetch: options.fetch } : {}
   };
   return new ShipmailClient(config);
@@ -164,6 +200,23 @@ async function readTextInput(value) {
   if (value.startsWith("@")) return readFile(value.slice(1), "utf8");
   return value;
 }
+function isJsonObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isNewsletterBlock(value) {
+  return isJsonObject(value) && typeof value["type"] === "string" && NEWSLETTER_BLOCK_TYPES.includes(value["type"]);
+}
+function isAutomationDefinition(value) {
+  if (!isJsonObject(value) || !isJsonObject(value["trigger"]) || !isJsonObject(value["scope"])) {
+    return false;
+  }
+  return typeof value["trigger"]["type"] === "string" && Array.isArray(value["conditions"]) && Array.isArray(value["actions"]) && (value["mode"] === "draft" || value["mode"] === "send") && Array.isArray(value["scope"]["mailbox_ids"]) && Array.isArray(value["scope"]["calendar_addresses"]);
+}
+function isMessageMetadata(value) {
+  return isJsonObject(value) && Object.values(value).every(
+    (item) => item === null || typeof item === "string" || typeof item === "number" || typeof item === "boolean"
+  );
+}
 async function readNewsletterBlocks(value) {
   const parsed = await readJsonInput(value);
   if (!Array.isArray(parsed)) {
@@ -172,6 +225,11 @@ async function readNewsletterBlocks(value) {
   if (parsed.length === 0) {
     throw new CliUsageError("--blocks must include at least one block.");
   }
+  if (!parsed.every(isNewsletterBlock)) {
+    throw new CliUsageError(
+      `Every --blocks item must be an object whose type is one of: ${NEWSLETTER_BLOCK_TYPES.join(", ")}.`
+    );
+  }
   return parsed;
 }
 function parseArchiveVisibility(options) {
@@ -188,8 +246,10 @@ function parseStylingMode(options) {
 }
 async function automationDefinition(value) {
   const parsed = await readJsonInput(value);
-  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
-    throw new CliUsageError("--definition must be a JSON automation definition object.");
+  if (!isAutomationDefinition(parsed)) {
+    throw new CliUsageError(
+      "--definition must be a JSON object with trigger, conditions, actions, mode (draft or send) and scope { mailbox_ids, calendar_addresses }."
+    );
   }
   return parsed;
 }
@@ -294,10 +354,6 @@ async function rawApiRequest(parsed, runOptions, method, path, body, authRequire
     const key = apiKey(parsed, env);
     if (key) headers["Authorization"] = `Bearer ${key}`;
   }
-  const targetOrganizationId = organizationId(parsed, env);
-  if (targetOrganizationId) {
-    headers["X-Shipmail-Organization-Id"] = targetOrganizationId;
-  }
   let requestBody;
   if (body !== void 0) {
     headers["Content-Type"] = "application/json";
@@ -306,7 +362,8 @@ async function rawApiRequest(parsed, runOptions, method, path, body, authRequire
   const response = await (runOptions.fetch ?? fetch)(`${baseUrl(parsed, env)}${path}`, {
     method,
     headers,
-    body: requestBody
+    body: requestBody,
+    signal: AbortSignal.timeout(RAW_REQUEST_TIMEOUT_MS)
   });
   if (!response.ok) {
     const contentType = response.headers.get("content-type") ?? "";
@@ -455,17 +512,6 @@ Usage:
   shipmail booking-pages get <id>
   shipmail booking-pages update <id> [--name "..."] [--conferencing-provider zoom|google_meet|none] [--active false]
   shipmail booking-pages delete <id>
-  shipmail partner organizations list
-  shipmail partner organizations create --name "Operator" --external-reference op_123 --owner-email owner@example.com [--mailbox-limit 3] [--data-classification internal_test|customer]
-  shipmail partner organizations get <id>
-  shipmail partner organizations update <id> [--name "Operator"] [--mailbox-limit 5]
-  shipmail partner organizations invite <id> [--owner-email owner@example.com]
-  shipmail partner organizations suspend <id>
-  shipmail partner organizations resume <id>
-  shipmail partner organizations offboard <id>
-  shipmail partner credential-grants list
-  shipmail partner credential-grants consume <grant-id> [--name "Marketstead webmail"] [--expires-at 2026-10-01T00:00:00Z] [--allowed-cidr 203.0.113.0/24]
-  shipmail partner usage
 
 Booking page conferencing:
   --conferencing-provider <zoom|google_meet>  Create a meeting for every booking.
@@ -487,13 +533,13 @@ Newsletter feeds:
 Global options:
   --api-key <key>       API key. Defaults to SHIPMAIL_API_KEY.
   --base-url <url>      API base URL. Defaults to SHIPMAIL_BASE_URL or ${DEFAULT_BASE_URL}.
-  --organization-id     Delegated child organization for supported infrastructure commands.
   --header "K: V"       Extra header for the generic api command. Repeatable.
 
 Environment:
   SHIPMAIL_API_KEY      API key for authenticated commands.
-  SHIPMAIL_BASE_URL     Optional API base URL.
-  SHIPMAIL_ORGANIZATION_ID  Optional delegated child organization ID.
+  SHIPMAIL_BASE_URL     Optional API base URL. Must be https on shipmail.to.
+  SHIPMAIL_ALLOW_INSECURE_BASE_URL=1
+                        Permit a non-https or non-shipmail.to base URL (development only).
 `;
 }
 function requirePositional(positional, index, label) {
@@ -557,8 +603,10 @@ async function messageMetadata(options) {
   const raw = getString(options, "metadata");
   if (!raw) return void 0;
   const parsed = await readJsonInput(raw);
-  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-    throw new CliUsageError("--metadata must be a JSON object or @path/to/file.json.");
+  if (!isMessageMetadata(parsed)) {
+    throw new CliUsageError(
+      "--metadata must be a JSON object of string, number, boolean or null values, or @path/to/file.json."
+    );
   }
   return parsed;
 }
@@ -717,7 +765,8 @@ async function runMailboxes(client, parsed, out) {
       throw new CliUsageError("Missing --password, --password-file, or --generate-password.");
     }
     const password = passwordFile ? (await readFile(passwordFile, "utf8")).replace(/\r?\n$/, "") : passwordValue;
-    if (!generatePassword && !password) {
+    const credentials = generatePassword ? { generate_password: true } : password ? { password } : void 0;
+    if (!credentials) {
       throw new CliUsageError("Mailbox password must not be empty.");
     }
     writeJson(
@@ -725,7 +774,7 @@ async function runMailboxes(client, parsed, out) {
       await client.mailboxes.create({
         domain_id: getRequiredString(parsed.options, "domain-id"),
         address: getRequiredString(parsed.options, "address"),
-        ...generatePassword ? { generate_password: true } : { password },
+        ...credentials,
         ...displayName ? { display_name: displayName } : {}
       })
     );
@@ -887,12 +936,13 @@ async function runMailboxes(client, parsed, out) {
       }
       params = { mode: "keep" };
     } else if (mode === "fixed") {
-      if (destinationMailboxIds.length !== 1) {
+      const [destinationMailboxId] = destinationMailboxIds;
+      if (destinationMailboxIds.length !== 1 || destinationMailboxId === void 0) {
         throw new CliUsageError("--mode fixed requires exactly one --destination-mailbox-id.");
       }
       params = {
         mode: "fixed",
-        destination_mailbox_id: destinationMailboxIds[0],
+        destination_mailbox_id: destinationMailboxId,
         fallback_mailbox_id: getRequiredString(parsed.options, "fallback-mailbox-id")
       };
     } else if (mode === "round-robin") {
@@ -1215,10 +1265,10 @@ async function runMessages(client, parsed, out) {
   if (subcommand === "list") {
     const mailboxId = getString(parsed.options, "mailbox-id");
     const clientReference = getString(parsed.options, "client-reference");
-    if (!mailboxId && !clientReference) {
+    const filter = mailboxId ? { mailbox_id: mailboxId, ...clientReference ? { client_reference: clientReference } : {} } : clientReference ? { client_reference: clientReference } : void 0;
+    if (!filter) {
       throw new CliUsageError("Provide --mailbox-id or --client-reference.");
     }
-    const filter = mailboxId ? { mailbox_id: mailboxId, ...clientReference ? { client_reference: clientReference } : {} } : { client_reference: clientReference };
     writeJson(
       out,
       await client.messages.list({
@@ -2129,96 +2179,6 @@ async function runAutomations(client, parsed, out) {
   }
   throw new CliUsageError("Unknown automations command.");
 }
-async function runPartner(client, parsed, out) {
-  const group = parsed.positional[1];
-  if (group === "usage") {
-    writeJson(out, await client.partner.usage());
-    return;
-  }
-  if (group === "credential-grants") {
-    const command2 = requirePositional(parsed.positional, 2, "credential grant command");
-    if (command2 === "list") {
-      writeJson(out, await client.partner.listMailboxCredentialGrants());
-      return;
-    }
-    if (command2 !== "consume")
-      throw new CliUsageError("Unknown partner credential-grants command.");
-    const grantId = requirePositional(parsed.positional, 3, "credential grant id");
-    const name = getString(parsed.options, "name");
-    const expiresAt = getString(parsed.options, "expires-at");
-    const allowedCidrs = getStringList(parsed.options, "allowed-cidr");
-    writeJson(
-      out,
-      await client.partner.consumeMailboxCredentialGrant(grantId, {
-        ...name ? { name } : {},
-        ...expiresAt ? { expires_at: expiresAt } : {},
-        ...allowedCidrs.length > 0 ? { allowed_cidrs: allowedCidrs } : {}
-      })
-    );
-    return;
-  }
-  if (group !== "organizations") throw new CliUsageError("Unknown partner command.");
-  const command = parsed.positional[2];
-  if (command === "list") {
-    writeJson(out, await client.partner.listOrganizations());
-    return;
-  }
-  if (command === "create") {
-    const classification = getString(parsed.options, "data-classification") ?? "customer";
-    if (classification !== "internal_test" && classification !== "customer") {
-      throw new CliUsageError("--data-classification must be internal_test or customer.");
-    }
-    const params = {
-      name: getRequiredString(parsed.options, "name"),
-      external_reference: getRequiredString(parsed.options, "external-reference"),
-      owner_email: getRequiredString(parsed.options, "owner-email"),
-      mailbox_limit: getNumber(parsed.options, "mailbox-limit") ?? 3,
-      data_classification: classification
-    };
-    writeJson(out, await client.partner.createOrganization(params));
-    return;
-  }
-  const id = requirePositional(parsed.positional, 3, "partner organization id");
-  if (command === "get") {
-    writeJson(out, await client.partner.getOrganization(id));
-    return;
-  }
-  if (command === "update") {
-    const name = getString(parsed.options, "name");
-    const mailboxLimit = getNumber(parsed.options, "mailbox-limit");
-    if (name === void 0 && mailboxLimit === void 0) {
-      throw new CliUsageError("Provide --name or --mailbox-limit.");
-    }
-    const params = {
-      ...name !== void 0 ? { name } : {},
-      ...mailboxLimit !== void 0 ? { mailbox_limit: mailboxLimit } : {}
-    };
-    writeJson(out, await client.partner.updateOrganization(id, params));
-    return;
-  }
-  if (command === "invite") {
-    writeJson(
-      out,
-      await client.partner.resendOwnershipInvitation(id, {
-        owner_email: getString(parsed.options, "owner-email")
-      })
-    );
-    return;
-  }
-  if (command === "suspend") {
-    writeJson(out, await client.partner.suspendOrganization(id));
-    return;
-  }
-  if (command === "resume") {
-    writeJson(out, await client.partner.resumeOrganization(id));
-    return;
-  }
-  if (command === "offboard") {
-    writeJson(out, await client.partner.offboardOrganization(id));
-    return;
-  }
-  throw new CliUsageError("Unknown partner organizations command.");
-}
 function writeError(err, errOut) {
   if (err instanceof CliUsageError) {
     errOut.write(`Error: ${err.message}
@@ -2304,7 +2264,6 @@ async function runCli(argv, options = {}) {
     else if (command === "audiences") await runAudiences(client, parsed, out);
     else if (command === "calendar") await runCalendar(client, parsed, out);
     else if (command === "booking-pages") await runBookingPages(client, parsed, out);
-    else if (command === "partner") await runPartner(client, parsed, out);
     else throw new CliUsageError(`Unknown command: ${command}.`);
     return 0;
   } catch (err) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shipmail-cli",
-  "version": "0.5.3",
+  "version": "0.6.0",
   "description": "Official CLI for the Shipmail API",
   "type": "module",
   "bin": {
@@ -41,7 +41,7 @@
     "access": "public"
   },
   "dependencies": {
-    "shipmail": "0.5.8"
+    "shipmail": "0.6.0"
   },
   "devDependencies": {
     "tsup": "^8.4.0",