shipmail-cli 0.6.4 → 0.6.5

package/README.md

@@ -40,6 +40,7 @@ shipmail status
 # Create a domain, retrieve records, and verify DNS
 shipmail domains create example.com
 shipmail domains dns-records dom_123
+shipmail domains health dom_123
 shipmail domains verify dom_123
 
 # Create a mailbox
@@ -100,11 +101,17 @@ shipmail mailboxes sandbox-inbound mbx_123 --from customer@example.com --subject
 shipmail inbox list 550e8400-e29b-41d4-a716-446655440000 --folder-role inbox --after 2025-07-20T00:00:00Z --limit 25
 shipmail inbox list 550e8400-e29b-41d4-a716-446655440000 --from billing@vendor.example --subject invoice --has-attachment
 shipmail inbox message 550e8400-e29b-41d4-a716-446655440000 eml_123
+# Enable API-agent hold with a mailbox-management credential.
+shipmail mailboxes update 550e8400-e29b-41d4-a716-446655440000 --agent-security-hold true
+# Use a separate securityReview credential to inspect and release the exact snapshot.
+SHIPMAIL_API_KEY=sm_live_review_... shipmail inbox message 550e8400-e29b-41d4-a716-446655440000 eml_123
+SHIPMAIL_API_KEY=sm_live_review_... shipmail inbox security-review 550e8400-e29b-41d4-a716-446655440000 eml_123 --reason "Reviewed against the customer request" --expected-content-sha256 0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef
 shipmail inbox threads 550e8400-e29b-41d4-a716-446655440000 --attention-state needs_reply --after 2025-07-20T00:00:00Z --limit 50
 shipmail inbox thread 550e8400-e29b-41d4-a716-446655440000 thr_123
 shipmail inbox draft 550e8400-e29b-41d4-a716-446655440000 thr_123 --expected-version 7 --text "Thanks for the note"
-# Apply your approval policy; stale drafts fail with 409 without delivery.
-shipmail inbox send-draft 550e8400-e29b-41d4-a716-446655440000 thr_123 drf_123
+# Read and approve content_sha256; later edits and stale drafts fail with 409 without delivery.
+shipmail inbox get-draft 550e8400-e29b-41d4-a716-446655440000 thr_123 drf_123
+shipmail inbox send-draft 550e8400-e29b-41d4-a716-446655440000 thr_123 drf_123 --expected-content-sha256 0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef
 # Save a new message to Drafts for a human to review and send; this never sends
 shipmail inbox compose-draft 550e8400-e29b-41d4-a716-446655440000 --to user@example.com --subject "Kickoff" --text "Draft for review"
 shipmail inbox thread-attention 550e8400-e29b-41d4-a716-446655440000 thr_123 --done true --expected-version 8
@@ -125,6 +132,8 @@ shipmail newsletters create \
   --subject "What shipped in July" \
   --blocks @blocks.json
 shipmail newsletters update nws_123 --subject "Updated subject"
+# Or write the body in Markdown; Shipmail converts it to blocks
+shipmail newsletters update nws_123 --markdown @issue.md
 # A concurrent update exits with conflict (409); fetch the latest newsletter before retrying.
 shipmail newsletters preview nws_123
 shipmail newsletters test-send nws_123 --recipient-email owner@example.com
@@ -135,6 +144,11 @@ shipmail newsletter-assets upload ./hero.png --content-type image/png
 shipmail newsletter-assets upload ./demo.mp4 --content-type video/mp4 --thumbnail ./demo-poster.jpg
 shipmail newsletter-assets register-url https://cdn.shipmail.to/newsletter-images/org_123/hero.png
 
+# Welcome new readers with a sequence of emails
+shipmail audiences welcome add-step aud_123 --subject "Welcome" --markdown @welcome.md
+shipmail audiences welcome add-step aud_123 --subject "Our best posts" --markdown @day-3.md --wait-minutes 4320
+shipmail audiences welcome enable aud_123
+
 # Manage webhooks
 shipmail webhooks create \
   --url https://example.com/shipmail/webhook \
@@ -151,6 +165,11 @@ Paragraph, quote, callout, list-item, and column bodies in `--blocks` accept bar
 sanitized inline HTML. Use `<p>` and `<br>` for line breaks. Shipmail keeps `a`, `b`, `br`,
 `code`, `em`, `i`, `p`, `s`, `span`, `strong`, and `u`, with safe attributes and URLs.
 
+`--markdown` (text, or `@file` to read a file) is an alternative to `--blocks` and `--body-html`.
+Shipmail converts headings, paragraphs, lists, quotes, code, images, links, dividers and tables
+to blocks. A callout starts with a line `:::callout` (optionally `info`, `warning` or `success`,
+then a title) and ends with a line `:::`.
+
 `newsletter-assets upload` uses a five-minute direct storage PUT, then calls the single-use
 completion URL. Video uploads require a JPEG poster through `--thumbnail`. `newsletter-assets list`
 includes current newsletter media storage usage and a `pagination.next_cursor` value in the JSON
@@ -171,17 +190,18 @@ Use repeatable `--header "Name: value"` flags for request headers. Use `--output
 - `status`
 - `api <METHOD> <PATH>`
 - `domains list|search|create|get|verify|delete`
-- `mailboxes list|create|get|suspend|resume|forwarding|forwarding-add|forwarding-remove|app-passwords|folders|identities|stage-attachment|prepare-attachment-upload`
+- `mailboxes list|create|get|update|suspend|resume|forwarding|forwarding-add|forwarding-remove|app-passwords|folders|identities|stage-attachment|prepare-attachment-upload`
 - `members list|get`
-- `inbox list|message|threads|thread|thread-state|draft|send-draft|reply-message|reply-thread|update|move`
+- `inbox list|message|security-review|threads|thread|thread-state|draft|send-draft|reply-message|reply-thread|update|move`
 - `reply-scans create|status|results`
 - `messages send|list|analytics|get|reply` (test keys also support `--sandbox-outcome`)
 - `scheduled-messages list|get|update|cancel`
 - `mailboxes sandbox-inbound`
 - `webhooks list|create|update|test|deliveries|replay-delivery`
-- `suppressions list|remove`
+- `suppressions add|list|remove`
 - `audiences list|create|get|update|delete`
 - `audiences feed get|update|rotate|revoke`
+- `audiences welcome get|enable|disable|add-step|update-step|remove-step`
 - `audiences subscribers add|list|get|by-email|update|unsubscribe|resubscribe|remove`
 - `newsletter-sender-identities list`
 - `newsletter-domains list`
@@ -192,7 +212,7 @@ Member output uses the roles `owner`, `admin`, and `member`. Its `mailbox_access
 `selected`; `mailbox_ids` is empty for `all`, while selected IDs may be limited to mailboxes the
 API key can reach.
 
-Configure a publisher-owned Atom self URL and the number of recent issues:
+Configure a publisher-owned Atom self URL and the number of recent newsletters:
 
 ```bash
 shipmail audiences feed update aud_123 \

package/dist/cli.js

@@ -7,6 +7,7 @@ import { readFile as readFile2, writeFile as writeFile2 } from "fs/promises";
 import { env as processEnv, exit, stderr, stdout } from "process";
 import { fileURLToPath } from "url";
 import {
+  BOOKING_LINK_STATUSES,
   CONFERENCING_PROVIDER_IDS,
   ReconciliationRequiredError,
   ShipmailClient,
@@ -649,7 +650,7 @@ async function login(options) {
 }
 
 // src/version.ts
-var VERSION = "0.6.4";
+var VERSION = "0.6.5";
 
 // src/cli.ts
 var DEFAULT_BASE_URL = "https://shipmail.to/api/v1";
@@ -989,12 +990,27 @@ async function readNewsletterBlocks(value) {
   }
   return parsed;
 }
+async function readNewsletterMarkdown(options) {
+  const input = getString(options, "markdown");
+  if (input === void 0) return void 0;
+  const markdown = await readTextInput(input);
+  if (getString(options, "blocks") !== void 0 || getString(options, "body-html") !== void 0) {
+    throw new CliUsageError("Use only one of --blocks, --body-html, or --markdown.");
+  }
+  return markdown;
+}
 function parseArchiveVisibility(options) {
   const value = getString(options, "archive-visibility");
   if (value === void 0) return void 0;
   if (value === "private" || value === "public") return value;
   throw new CliUsageError("--archive-visibility must be private or public.");
 }
+function parsePublishTarget(options) {
+  const value = getString(options, "publish-target");
+  if (value === void 0) return void 0;
+  if (value === "email_and_website" || value === "email" || value === "website") return value;
+  throw new CliUsageError("--publish-target must be email_and_website, email or website.");
+}
 function parseStylingMode(options) {
   const value = getString(options, "styling-mode");
   if (value === void 0) return void 0;
@@ -1027,16 +1043,21 @@ async function newsletterCreateParams(options) {
   const blocks = blocksInput ? await readNewsletterBlocks(blocksInput) : void 0;
   const body_html = bodyHtmlInput ? await readTextInput(bodyHtmlInput) : void 0;
   const body_text = bodyTextInput ? await readTextInput(bodyTextInput) : void 0;
-  if (!blocks?.length && !body_html?.trim() && !body_text?.trim()) {
-    throw new CliUsageError("Provide at least one of --blocks, --body-html, or --body-text.");
+  const content_markdown = await readNewsletterMarkdown(options);
+  if (!blocks?.length && !body_html?.trim() && !body_text?.trim() && !content_markdown?.trim()) {
+    throw new CliUsageError(
+      "Provide at least one of --blocks, --body-html, --body-text, or --markdown."
+    );
   }
   const send_window_hours = getNumber(options, "send-window-hours");
   const archive_visibility = parseArchiveVisibility(options);
+  const publish_target = parsePublishTarget(options);
   const feed_entry_url = getString(options, "feed-entry-url");
   const styling_mode = parseStylingMode(options);
   const track_engagement = getBoolean(options, "track-engagement");
   const add_utm_tags = getBoolean(options, "add-utm-tags");
   const preview_text = getString(options, "preview-text");
+  const subjectTest = subjectTestParams(options);
   return {
     audience_id,
     sender_identity_id,
@@ -1044,14 +1065,32 @@ async function newsletterCreateParams(options) {
     subject,
     ...preview_text !== void 0 ? { preview_text } : {},
     ...blocks ? { blocks } : {},
+    ...content_markdown !== void 0 ? { content_markdown } : {},
     ...body_html !== void 0 ? { body_html } : {},
     ...body_text !== void 0 ? { body_text } : {},
     ...send_window_hours !== void 0 ? { send_window_hours } : {},
     ...archive_visibility !== void 0 ? { archive_visibility } : {},
+    ...publish_target !== void 0 ? { publish_target } : {},
     ...feed_entry_url !== void 0 ? { feed_entry_url } : {},
     ...styling_mode !== void 0 ? { styling_mode } : {},
     ...track_engagement !== void 0 ? { track_engagement } : {},
-    ...add_utm_tags !== void 0 ? { add_utm_tags } : {}
+    ...add_utm_tags !== void 0 ? { add_utm_tags } : {},
+    ...subjectTest
+  };
+}
+function subjectTestParams(options) {
+  const subject_b = getString(options, "subject-b");
+  const clear = getBoolean(options, "clear-subject-b") === true;
+  if (subject_b !== void 0 && clear) {
+    throw new CliUsageError("Use either --subject-b or --clear-subject-b.");
+  }
+  const subject_test_percent = getNumber(options, "subject-test-percent");
+  const subject_test_hours = getNumber(options, "subject-test-hours");
+  return {
+    ...subject_b !== void 0 ? { subject_b } : {},
+    ...clear ? { subject_b: null } : {},
+    ...subject_test_percent !== void 0 ? { subject_test_percent } : {},
+    ...subject_test_hours !== void 0 ? { subject_test_hours } : {}
   };
 }
 async function newsletterUpdateParams(options) {
@@ -1062,6 +1101,7 @@ async function newsletterUpdateParams(options) {
   const preview_text = getString(options, "preview-text");
   const send_window_hours = getNumber(options, "send-window-hours");
   const archive_visibility = parseArchiveVisibility(options);
+  const publish_target = parsePublishTarget(options);
   const feed_entry_url = getString(options, "feed-entry-url");
   const styling_mode = parseStylingMode(options);
   const track_engagement = getBoolean(options, "track-engagement");
@@ -1072,6 +1112,7 @@ async function newsletterUpdateParams(options) {
   const blocks = blocksInput ? await readNewsletterBlocks(blocksInput) : void 0;
   const body_html = bodyHtmlInput ? await readTextInput(bodyHtmlInput) : void 0;
   const body_text = bodyTextInput ? await readTextInput(bodyTextInput) : void 0;
+  const content_markdown = await readNewsletterMarkdown(options);
   const params = {
     ...audience_id ? { audience_id } : {},
     ...sender_identity_id ? { sender_identity_id } : {},
@@ -1079,14 +1120,17 @@ async function newsletterUpdateParams(options) {
     ...subject ? { subject } : {},
     ...preview_text !== void 0 ? { preview_text } : {},
     ...blocks ? { blocks } : {},
+    ...content_markdown !== void 0 ? { content_markdown } : {},
     ...body_html !== void 0 ? { body_html } : {},
     ...body_text !== void 0 ? { body_text } : {},
     ...send_window_hours !== void 0 ? { send_window_hours } : {},
     ...archive_visibility !== void 0 ? { archive_visibility } : {},
+    ...publish_target !== void 0 ? { publish_target } : {},
     ...feed_entry_url !== void 0 ? { feed_entry_url } : {},
     ...styling_mode !== void 0 ? { styling_mode } : {},
     ...track_engagement !== void 0 ? { track_engagement } : {},
-    ...add_utm_tags !== void 0 ? { add_utm_tags } : {}
+    ...add_utm_tags !== void 0 ? { add_utm_tags } : {},
+    ...subjectTestParams(options)
   };
   if (Object.keys(params).length === 0) {
     throw new CliUsageError("Provide at least one field to update.");
@@ -1179,11 +1223,13 @@ Usage:
   shipmail domains create <name>
   shipmail domains get <id>
   shipmail domains dns-records <id>
+  shipmail domains health <id> [--json]
   shipmail domains verify <id>
   shipmail domains delete <id>
   shipmail mailboxes list [--domain-id dom] [--limit 25] [--cursor cur]
   shipmail mailboxes create --domain-id dom --address hello (--password value | --password-file path | --generate-password) [--display-name "Hello"]
   shipmail mailboxes get <id>
+  shipmail mailboxes update <id> [--display-name "Ops"] [--agent-security-hold true|false]
   shipmail mailboxes suspend <id>
   shipmail mailboxes resume <id>
   shipmail mailboxes export <id>
@@ -1208,12 +1254,17 @@ Usage:
   shipmail members get <id>
   shipmail inbox list <mailbox-id> [--folder-role inbox] [--search text] [--from text] [--to text] [--subject text] [--has-attachment [true|false]] [--after ISO] [--before ISO] [--limit 25] [--cursor cur]
   shipmail inbox message <mailbox-id> <message-id>
+  shipmail inbox security-review <mailbox-id> <message-id> --reason "Reviewed" --expected-content-sha256 HASH
   shipmail inbox threads <mailbox-id> [--attention-state needs_reply] [--after ISO] [--before ISO] [--limit 25] [--cursor cur]
   shipmail inbox thread <mailbox-id> <thread-id>
   shipmail inbox thread-attention <mailbox-id> <thread-id> --done true --expected-version 3
   shipmail inbox draft <mailbox-id> <thread-id> --expected-version 3 (--text "Hello" | --html "<p>Hello</p>") [--reply-mode reply_all]
   shipmail inbox compose-draft <mailbox-id> --to user@example.com [--cc ...] [--bcc ...] [--subject "Hi"] (--text "Hello" | --html "<p>Hello</p>") [--idempotency-key key]  (saves a new message to Drafts; never sends)
-  shipmail inbox send-draft <mailbox-id> <thread-id> <draft-id>
+  shipmail inbox drafts <mailbox-id> <thread-id>
+  shipmail inbox get-draft <mailbox-id> <thread-id> <draft-id>
+  shipmail inbox update-draft <mailbox-id> <thread-id> <draft-id> (--text "Hello" | --html "<p>Hello</p>")  (the new body replaces the old one)
+  shipmail inbox delete-draft <mailbox-id> <thread-id> <draft-id>
+  shipmail inbox send-draft <mailbox-id> <thread-id> <draft-id> [--expected-content-sha256 hash]
   shipmail inbox reply-message <mailbox-id> <message-id> --to user@example.com (--text "Hello" | --html "<p>Hello</p>") [--track-reply true|false]
   shipmail inbox reply-thread <mailbox-id> <thread-id> --to user@example.com (--text "Hello" | --html "<p>Hello</p>") [--track-reply true|false]
   shipmail inbox update <mailbox-id> <message-id> [--read true] [--starred false]
@@ -1234,20 +1285,22 @@ Usage:
   shipmail webhooks create --url https://example.com/hook --events message.received,message.bounced [--authorization "Bearer key"] [--standard-webhooks-secret whsec_...] [--include-reply-text] [--authenticated-senders-only] [--allowed-sender jane@customer.com --allowed-sender customer.com]
   shipmail webhooks update <webhook-id> [--url https://example.com/hook] [--events message.received] [--description text] [--active true|false] [--authorization "Bearer key" | --clear-authorization] [--standard-webhooks-secret whsec_... | --clear-standard-webhooks-secret] [--include-reply-text true|false] [--authenticated-senders-only true|false] [--allowed-sender customer.com ... | --clear-allowed-senders]
   shipmail webhooks replay-delivery <webhook-id> <delivery-id> [--idempotency-key key]
-  shipmail suppressions list
+  shipmail suppressions add <email> [--scope all|marketing]
+  shipmail suppressions list [--scope all|marketing] [--limit 25] [--cursor cur]
   shipmail suppressions remove <email>
   shipmail newsletters create \\
     --audience-id aud_123 \\
     --sender-identity-id nwsid_456 \\
     --name "July changelog" \\
     --subject "What shipped in July" \\
-    --blocks @blocks.json \\
-    [--feed-entry-url https://example.com/post] [--styling-mode styled|plain] [--track-engagement true|false] [--add-utm-tags true|false]
-  shipmail newsletters update nws_789 --subject "Updated subject" --blocks @blocks-v2.json [--feed-entry-url https://example.com/post] [--styling-mode styled|plain] [--track-engagement true|false] [--add-utm-tags true|false]
+    --blocks @blocks.json | --markdown @issue.md \\
+    [--feed-entry-url https://example.com/post] [--styling-mode styled|plain] [--track-engagement true|false] [--add-utm-tags true|false] [--publish-target email_and_website|email|website]
+  shipmail newsletters update nws_789 --subject "Updated subject" [--blocks @blocks-v2.json | --markdown @issue.md] [--feed-entry-url https://example.com/post] [--styling-mode styled|plain] [--track-engagement true|false] [--add-utm-tags true|false] [--subject-b "Second subject" | --clear-subject-b] [--subject-test-percent 1..25] [--subject-test-hours 1..72]
   shipmail newsletters preview <id>
   shipmail newsletters preflight <id>
   shipmail newsletters test-send <id> --recipient-email owner@example.com
-  shipmail newsletters schedule <id> --scheduled-at 2026-08-01T09:00:00.000Z
+  shipmail newsletters schedule <id> --scheduled-at 2026-08-01T09:00:00.000Z [--limit 500]
+  shipmail newsletters send-more <id> [--count 1000]
   shipmail newsletters cancel <id>
   shipmail newsletters resume <id>
   shipmail newsletter-assets list [--kind image|video] [--q text] [--limit 25] [--cursor cur]
@@ -1258,12 +1311,17 @@ Usage:
   shipmail audiences list [--limit 25] [--cursor cur]
   shipmail audiences create <name> --consent-source "Signup form" [--description "..."]
   shipmail audiences get <id>
-  shipmail audiences update <id> [--name "..."] [--description "..."]
+  shipmail audiences update <id> [--name "..."] [--description "..."] [--cleanup true|false] [--cleanup-ignored-issues 2..100] [--cleanup-inactive-days 30..3650]
   shipmail audiences delete <id>
   shipmail audiences feed get <audience-id>
   shipmail audiences feed update <audience-id> [--enabled true|false] [--title "..."] [--subtitle "..."] [--site-url https://...] [--canonical-url https://...] [--author-name "..."] [--icon-url https://...] [--entry-limit 10..100] [--idempotency-key key]
   shipmail audiences feed rotate <audience-id> [--idempotency-key key]
   shipmail audiences feed revoke <audience-id> [--idempotency-key key]
+  shipmail audiences welcome get <audience-id>
+  shipmail audiences welcome enable|disable <audience-id> [--idempotency-key key]
+  shipmail audiences welcome add-step <audience-id> --subject "Welcome" (--markdown @welcome.md | --blocks @blocks.json) [--wait-minutes 0] [--preview-text "..."] [--sender-identity-id nwsid_456]
+  shipmail audiences welcome update-step <audience-id> <step-id> [--subject "..."] [--markdown @welcome.md | --blocks @blocks.json] [--wait-minutes 1440]
+  shipmail audiences welcome remove-step <audience-id> <step-id>
   shipmail audiences subscribers add <audience-id> <email> [--name "Jane"] [--consent-source "..."]
   shipmail audiences subscribers list <audience-id> [--status subscribed] [--email jane@x.com] [--limit 25]
   shipmail audiences subscribers get <audience-id> <subscriber-id>
@@ -1283,11 +1341,27 @@ Usage:
   shipmail booking-pages get <id>
   shipmail booking-pages update <id> [--name "..."] [--conferencing-provider zoom|google_meet|none] [--active false]
   shipmail booking-pages delete <id>
+  shipmail booking-links list [--status open|booked|expired|revoked] [--limit 25] [--cursor cur]
+  shipmail booking-links create --name "Call with Sam" --mailbox hello@example.com --duration-minutes 30 --timezone Europe/Lisbon --range 2026-11-02T09:00:00Z/2026-11-02T12:00:00Z [--range ...] [--source-page bkp_...] [--max-bookings 1|unlimited] [--expires-at 2026-11-10T00:00:00Z]
+  shipmail booking-links get <id>
+  shipmail booking-links update <id> [--name "..."] [--range start/end|none] [--max-bookings n|unlimited] [--expires-at iso|none] [--source-page id|none]
+  shipmail booking-links revoke <id>
 
 Booking page conferencing:
   --conferencing-provider <zoom|google_meet>  Create a meeting for every booking.
   --conferencing-provider none                Stop creating meeting links on update.
 
+One-off booking links:
+  --range <start>/<end>          A time the link offers, as two ISO instants. Repeat it, or
+                                 separate ranges with commas. Without ranges, --source-page
+                                 offers that booking page's weekly hours.
+  --range none                   On update, drop the ranges and offer the source page's hours.
+  --max-bookings <n|unlimited>   The link stops after this many bookings. Defaults to 1.
+  --expires-at <iso|none>        The link stops taking bookings at this time.
+  --source-page <id|none>        The booking page to copy weekly hours from.
+  Revoking a link stops it at once and cannot be undone. Other flags: --description,
+  --buffer-minutes, --minimum-notice-minutes, --conferencing-provider, --mailbox.
+
 Conversation IDs:
   <thread-id> accepts a conversation ID (thd_...) or the mail-server thread ID. Store the
   conversation_id every response carries. thread_id is deprecated and unchanged.
@@ -1299,15 +1373,30 @@ Member access output:
 Newsletter styling:
   --styling-mode <styled|plain>  styled applies Shipmail's email theme. plain sends your HTML without injected styles, width, or centering, so the reader's email client styles it.
 
+Newsletter publish target:
+  --publish-target <email_and_website|email|website>  Where the newsletter goes. email_and_website (default) sends it, and its archive visibility decides whether it also appears on the website and feed. email never appears on the web. website is published on the audience's newsletter website and feed at the scheduled time without any email; the website must be on.
+
 Newsletter tracking:
-  --track-engagement <true|false>  Track opens and clicks for this issue. Off by default. Changes only while the issue is a draft or scheduled for later.
-  --add-utm-tags <true|false>  Add utm_source, utm_medium and utm_campaign to the issue's links in the email and the feed. Off by default. Changes only while the issue is a draft or scheduled for later.
+  --track-engagement <true|false>  Track opens and clicks for this newsletter. Off by default. Changes only while the newsletter is a draft or scheduled for later.
+  --add-utm-tags <true|false>  Add utm_source, utm_medium and utm_campaign to the newsletter's links in the email and the feed. Off by default. Changes only while the newsletter is a draft or scheduled for later.
+
+Newsletter subject test:
+  --subject-b <text>  Test a second subject. Each subject goes to --subject-test-percent of the subscribers (default 10); after --subject-test-hours (default 4) the one with more human clicks goes to the rest. Needs --track-engagement true.
+  --clear-subject-b   Remove the second subject.
+
+Engaged first:
+  --limit <n>  On schedule, send only to the n most engaged subscribers. Send the rest with send-more, which takes --count or sends to everyone left.
+
+List cleanup:
+  --cleanup <true|false>  A cold subscriber gets one last-chance email instead of a newsletter, and becomes dormant if they do not click keep within 14 days.
+  --cleanup-ignored-issues <n>  Tracked newsletters ignored in a row before a subscriber is cold (2 to 100, default 6).
+  --cleanup-inactive-days <n>  Days without a sign of life before a subscriber is cold (30 to 3650, default 180).
 
 Newsletter block prose:
   Paragraph, quote, callout, list-item, and column bodies accept bare text or sanitized inline HTML. Use <p> and <br> for line breaks.
 
 Newsletter feeds:
-  --feed-entry-url <url>  Link this issue's Atom feed title to an http(s) URL instead of its Shipmail archive.
+  --feed-entry-url <url>  Link this newsletter's Atom feed title to an http(s) URL instead of its Shipmail archive.
 
 Sign-in:
   Run shipmail login once to sign in through the browser instead of using an API key.
@@ -1557,6 +1646,44 @@ async function replyToMessageParams(options) {
     } : {}
   };
 }
+var DOMAIN_HEALTH_PROVIDER_LABELS = {
+  google: "Gmail",
+  microsoft: "Outlook",
+  yahoo: "Yahoo",
+  apple: "iCloud",
+  other: "Other"
+};
+function formatRecipients(count) {
+  return `${count} ${count === 1 ? "recipient" : "recipients"}`;
+}
+function formatDeliveryRate(rate) {
+  return rate === null ? "no results yet" : `${rate}% delivered`;
+}
+function writeDomainHealth(out, health) {
+  const { dns, blocklist, delivery } = health;
+  const checks = [
+    ["MX", dns.mx],
+    ["SPF", dns.spf],
+    ["DKIM", dns.dkim],
+    ["DMARC", dns.dmarc]
+  ];
+  const lines = [
+    `${health.domain} (${health.domain_id})`,
+    "",
+    `DNS (checked ${dns.last_checked_at ?? "never"})`,
+    ...checks.map(([name, ok]) => `  ${name.padEnd(6)}${ok ? "pass" : "fail"}`),
+    "",
+    `Spamhaus DBL: ${blocklist.listed ? `listed since ${blocklist.listed_since ?? "unknown"}` : "not listed"}`,
+    "",
+    `Delivery, last 30 days: ${formatDeliveryRate(delivery.delivery_rate)}`,
+    `  ${formatRecipients(delivery.recipients)}: ${delivery.delivered} delivered, ${delivery.bounced} bounced, ${delivery.deferred} deferred, ${delivery.complained} complained`,
+    ...delivery.providers.map(
+      (p) => `  ${DOMAIN_HEALTH_PROVIDER_LABELS[p.provider].padEnd(8)}${formatDeliveryRate(p.delivery_rate)}, ${formatRecipients(p.recipients)}, ${p.bounced} bounced, ${p.deferred} deferred, ${p.complained} complained`
+    )
+  ];
+  out.write(`${lines.join("\n")}
+`);
+}
 async function runDomains(client, parsed, out) {
   const subcommand = parsed.positional[1];
   if (subcommand === "list") {
@@ -1594,6 +1721,14 @@ async function runDomains(client, parsed, out) {
     );
     return;
   }
+  if (subcommand === "health") {
+    const health = await client.domains.getHealth(
+      requirePositional(parsed.positional, 2, "domain id")
+    );
+    if (getBoolean(parsed.options, "json") === true) writeJson(out, health);
+    else writeDomainHealth(out, health);
+    return;
+  }
   if (subcommand === "verify") {
     writeJson(
       out,
@@ -1658,6 +1793,21 @@ async function runMailboxes(client, parsed, out) {
     );
     return;
   }
+  if (subcommand === "update") {
+    const displayName = getString(parsed.options, "display-name");
+    const agentSecurityHold = getBoolean(parsed.options, "agent-security-hold");
+    if (displayName === void 0 && agentSecurityHold === void 0) {
+      throw new CliUsageError("Provide --display-name or --agent-security-hold.");
+    }
+    writeJson(
+      out,
+      await client.mailboxes.update(requirePositional(parsed.positional, 2, "mailbox id"), {
+        ...displayName !== void 0 ? { display_name: displayName } : {},
+        ...agentSecurityHold !== void 0 ? { agent_security_hold: agentSecurityHold } : {}
+      })
+    );
+    return;
+  }
   if (subcommand === "suspend") {
     writeJson(
       out,
@@ -1925,6 +2075,21 @@ async function runInbox(client, parsed, out) {
     );
     return;
   }
+  if (subcommand === "security-review") {
+    writeJson(
+      out,
+      await client.mailboxes.releaseInboxMessageSecurity(
+        requirePositional(parsed.positional, 2, "mailbox id"),
+        requirePositional(parsed.positional, 3, "message id"),
+        {
+          decision: "release",
+          reason: getRequiredString(parsed.options, "reason"),
+          expected_content_sha256: getRequiredString(parsed.options, "expected-content-sha256")
+        }
+      )
+    );
+    return;
+  }
   if (subcommand === "threads") {
     const attentionState = getString(parsed.options, "attention-state");
     const sortBy = getString(parsed.options, "sort-by");
@@ -2019,13 +2184,64 @@ async function runInbox(client, parsed, out) {
     );
     return;
   }
+  if (subcommand === "drafts") {
+    writeJson(
+      out,
+      await client.mailboxes.listInboxReplyDrafts(
+        requirePositional(parsed.positional, 2, "mailbox id"),
+        requirePositional(parsed.positional, 3, "thread id")
+      )
+    );
+    return;
+  }
+  if (subcommand === "get-draft") {
+    writeJson(
+      out,
+      await client.mailboxes.getInboxReplyDraft(
+        requirePositional(parsed.positional, 2, "mailbox id"),
+        requirePositional(parsed.positional, 3, "thread id"),
+        requirePositional(parsed.positional, 4, "draft id")
+      )
+    );
+    return;
+  }
+  if (subcommand === "update-draft") {
+    const text = await readTextInput(getString(parsed.options, "text"));
+    const html = await readTextInput(getString(parsed.options, "html"));
+    if (!text && !html) throw new CliUsageError("Provide --text or --html.");
+    writeJson(
+      out,
+      await client.mailboxes.updateInboxReplyDraft(
+        requirePositional(parsed.positional, 2, "mailbox id"),
+        requirePositional(parsed.positional, 3, "thread id"),
+        requirePositional(parsed.positional, 4, "draft id"),
+        {
+          ...text ? { text } : {},
+          ...html ? { html } : {}
+        }
+      )
+    );
+    return;
+  }
+  if (subcommand === "delete-draft") {
+    const draftId = requirePositional(parsed.positional, 4, "draft id");
+    await client.mailboxes.deleteInboxReplyDraft(
+      requirePositional(parsed.positional, 2, "mailbox id"),
+      requirePositional(parsed.positional, 3, "thread id"),
+      draftId
+    );
+    writeJson(out, { ok: true, id: draftId });
+    return;
+  }
   if (subcommand === "send-draft") {
+    const expectedContentSha256 = getString(parsed.options, "expected-content-sha256");
     writeJson(
       out,
       await client.mailboxes.sendInboxReplyDraft(
         requirePositional(parsed.positional, 2, "mailbox id"),
         requirePositional(parsed.positional, 3, "thread id"),
-        requirePositional(parsed.positional, 4, "draft id")
+        requirePositional(parsed.positional, 4, "draft id"),
+        expectedContentSha256 ? { expectedContentSha256 } : void 0
       )
     );
     return;
@@ -2320,14 +2536,27 @@ async function runMembers(client, parsed, out) {
   }
   throw new CliUsageError("Unknown members command.");
 }
+var SUPPRESSION_SCOPES = ["all", "marketing"];
 async function runSuppressions(client, parsed, out) {
   const subcommand = parsed.positional[1];
+  if (subcommand === "add") {
+    const scope = getEnum(parsed.options, "scope", SUPPRESSION_SCOPES);
+    writeJson(
+      out,
+      await client.suppressions.create({
+        email: requirePositional(parsed.positional, 2, "email"),
+        ...scope ? { scope } : {}
+      })
+    );
+    return;
+  }
   if (subcommand === "list") {
     writeJson(
       out,
       await client.suppressions.list({
         cursor: getString(parsed.options, "cursor"),
-        limit: getNumber(parsed.options, "limit")
+        limit: getNumber(parsed.options, "limit"),
+        scope: getEnum(parsed.options, "scope", SUPPRESSION_SCOPES)
       })
     );
     return;
@@ -2347,7 +2576,8 @@ var SUBSCRIBER_STATUS_VALUES = [
   "bounced",
   "complained",
   "suppressed",
-  "transactional_only"
+  "transactional_only",
+  "dormant"
 ];
 function subscriberListParams(options) {
   const email = getString(options, "email");
@@ -2504,6 +2734,89 @@ async function runAudienceFeed(client, parsed, out) {
   }
   throw new CliUsageError("Unknown audiences feed command.");
 }
+async function welcomeStepParams(options) {
+  const subject = getString(options, "subject");
+  const previewText = getString(options, "preview-text");
+  const waitMinutes = getNumber(options, "wait-minutes");
+  const senderIdentityId = getString(options, "sender-identity-id");
+  const stylingMode = parseStylingMode(options);
+  const trackEngagement = getBoolean(options, "track-engagement");
+  const addUtmTags = getBoolean(options, "add-utm-tags");
+  const blocksInput = getString(options, "blocks");
+  const blocks = blocksInput ? await readNewsletterBlocks(blocksInput) : void 0;
+  const contentMarkdown = await readNewsletterMarkdown(options);
+  if (waitMinutes !== void 0 && (!Number.isInteger(waitMinutes) || waitMinutes < 0)) {
+    throw new CliUsageError("--wait-minutes must be a whole number of minutes, 0 or more.");
+  }
+  return {
+    ...subject !== void 0 ? { subject } : {},
+    ...previewText !== void 0 ? { preview_text: previewText } : {},
+    ...blocks ? { blocks } : {},
+    ...contentMarkdown !== void 0 ? { content_markdown: contentMarkdown } : {},
+    ...waitMinutes !== void 0 ? { wait_minutes: waitMinutes } : {},
+    ...senderIdentityId !== void 0 ? { sender_identity_id: senderIdentityId } : {},
+    ...stylingMode !== void 0 ? { styling_mode: stylingMode } : {},
+    ...trackEngagement !== void 0 ? { track_engagement: trackEngagement } : {},
+    ...addUtmTags !== void 0 ? { add_utm_tags: addUtmTags } : {}
+  };
+}
+async function runAudienceWelcome(client, parsed, out) {
+  const action = parsed.positional[2];
+  const audienceId = requirePositional(parsed.positional, 3, "audience id");
+  if (action === "get") {
+    writeJson(out, await client.audiences.welcomeSequence.get(audienceId));
+    return;
+  }
+  const idempotencyKey = getString(parsed.options, "idempotency-key");
+  const methodOptions = idempotencyKey ? { idempotencyKey } : void 0;
+  if (action === "enable" || action === "disable") {
+    writeJson(
+      out,
+      await client.audiences.welcomeSequence.update(
+        audienceId,
+        { enabled: action === "enable" },
+        methodOptions
+      )
+    );
+    return;
+  }
+  if (action === "add-step") {
+    const params = await welcomeStepParams(parsed.options);
+    if (!params.subject) throw new CliUsageError("--subject is required.");
+    if (!params.blocks?.length && !params.content_markdown?.trim()) {
+      throw new CliUsageError("Provide --blocks or --markdown.");
+    }
+    writeJson(
+      out,
+      await client.audiences.welcomeSequence.createStep(
+        audienceId,
+        { ...params, subject: params.subject },
+        methodOptions
+      )
+    );
+    return;
+  }
+  const stepId = requirePositional(parsed.positional, 4, "step id");
+  if (action === "update-step") {
+    const params = await welcomeStepParams(parsed.options);
+    if (Object.keys(params).length === 0) {
+      throw new CliUsageError("Provide at least one field to update.");
+    }
+    writeJson(
+      out,
+      await client.audiences.welcomeSequence.updateStep(audienceId, stepId, params, methodOptions)
+    );
+    return;
+  }
+  if (action === "remove-step") {
+    writeJson(
+      out,
+      await client.audiences.welcomeSequence.deleteStep(audienceId, stepId, methodOptions)
+    );
+    return;
+  }
+  throw new CliUsageError("Unknown audiences welcome command.");
+}
 async function runAudiences(client, parsed, out) {
   const subcommand = parsed.positional[1];
   if (subcommand === "subscribers") {
@@ -2514,6 +2827,10 @@ async function runAudiences(client, parsed, out) {
     await runAudienceFeed(client, parsed, out);
     return;
   }
+  if (subcommand === "welcome") {
+    await runAudienceWelcome(client, parsed, out);
+    return;
+  }
   if (subcommand === "list") {
     writeJson(
       out,
@@ -2547,11 +2864,17 @@ async function runAudiences(client, parsed, out) {
     const id = requirePositional(parsed.positional, 2, "audience id");
     const name = getString(parsed.options, "name");
     const description = getString(parsed.options, "description");
+    const cleanup_enabled = getBoolean(parsed.options, "cleanup");
+    const cleanup_ignored_issues = getNumber(parsed.options, "cleanup-ignored-issues");
+    const cleanup_inactive_days = getNumber(parsed.options, "cleanup-inactive-days");
     writeJson(
       out,
       await client.audiences.update(id, {
         ...name ? { name } : {},
-        ...description ? { description } : {}
+        ...description ? { description } : {},
+        ...cleanup_enabled !== void 0 ? { cleanup_enabled } : {},
+        ...cleanup_ignored_issues !== void 0 ? { cleanup_ignored_issues } : {},
+        ...cleanup_inactive_days !== void 0 ? { cleanup_inactive_days } : {}
       })
     );
     return;
@@ -2630,14 +2953,27 @@ async function runNewsletters(client, parsed, out) {
     return;
   }
   if (subcommand === "schedule") {
+    const limit = getNumber(parsed.options, "limit");
     writeJson(
       out,
       await client.newsletters.schedule(requirePositional(parsed.positional, 2, "newsletter id"), {
-        scheduled_at: getRequiredString(parsed.options, "scheduled-at")
+        scheduled_at: getRequiredString(parsed.options, "scheduled-at"),
+        ...limit !== void 0 ? { limit } : {}
       })
     );
     return;
   }
+  if (subcommand === "send-more") {
+    const count = getNumber(parsed.options, "count");
+    writeJson(
+      out,
+      await client.newsletters.sendToMore(
+        requirePositional(parsed.positional, 2, "newsletter id"),
+        count !== void 0 ? { count } : {}
+      )
+    );
+    return;
+  }
   if (subcommand === "cancel") {
     writeJson(
       out,
@@ -2957,6 +3293,93 @@ async function runCalendar(client, parsed, out) {
   }
   throw new CliUsageError("Unknown calendar command.");
 }
+function parseBookingLinkRanges(options) {
+  const values = getStringList(options, "range");
+  if (values.length === 0) return void 0;
+  if (values.length === 1 && values[0] === "none") return null;
+  return values.map((value) => {
+    const [start, end, extra] = value.split("/");
+    if (!start || !end || extra !== void 0) {
+      throw new CliUsageError("--range must be <start>/<end>, two ISO 8601 instants.");
+    }
+    return { start, end };
+  });
+}
+function getMaxBookings(options) {
+  if (getString(options, "max-bookings") === "unlimited") return null;
+  return getNumber(options, "max-bookings");
+}
+function getNullableString(options, key) {
+  const value = getString(options, key);
+  return value === "none" ? null : value;
+}
+async function runBookingLinks(client, parsed, out) {
+  const subcommand = parsed.positional[1];
+  const options = parsed.options;
+  if (subcommand === "list") {
+    writeJson(
+      out,
+      await client.bookingLinks.list({
+        cursor: getString(options, "cursor"),
+        limit: getNumber(options, "limit"),
+        status: getEnum(options, "status", BOOKING_LINK_STATUSES)
+      })
+    );
+    return;
+  }
+  if (subcommand === "create") {
+    const ranges = parseBookingLinkRanges(options);
+    if (ranges === null) throw new CliUsageError("--range none only applies to update.");
+    const params = {
+      name: getRequiredString(options, "name"),
+      mailbox: getRequiredString(options, "mailbox"),
+      duration_minutes: requireNumber(options, "duration-minutes"),
+      timezone: getRequiredString(options, "timezone"),
+      offered_ranges: ranges,
+      source_page_id: getString(options, "source-page"),
+      description: getString(options, "description"),
+      buffer_minutes: getNumber(options, "buffer-minutes"),
+      minimum_notice_minutes: getNumber(options, "minimum-notice-minutes"),
+      conferencing_provider: getConferencingProvider(options),
+      max_bookings: getMaxBookings(options),
+      expires_at: getString(options, "expires-at")
+    };
+    writeJson(out, await client.bookingLinks.create(params));
+    return;
+  }
+  if (subcommand === "get") {
+    writeJson(
+      out,
+      await client.bookingLinks.get(requirePositional(parsed.positional, 2, "booking link id"))
+    );
+    return;
+  }
+  if (subcommand === "update") {
+    const id = requirePositional(parsed.positional, 2, "booking link id");
+    const params = {
+      name: getString(options, "name"),
+      mailbox: getString(options, "mailbox"),
+      duration_minutes: getNumber(options, "duration-minutes"),
+      timezone: getString(options, "timezone"),
+      offered_ranges: parseBookingLinkRanges(options),
+      source_page_id: getNullableString(options, "source-page"),
+      description: getString(options, "description"),
+      buffer_minutes: getNumber(options, "buffer-minutes"),
+      minimum_notice_minutes: getNumber(options, "minimum-notice-minutes"),
+      conferencing_provider: getConferencingProvider(options),
+      max_bookings: getMaxBookings(options),
+      expires_at: getNullableString(options, "expires-at")
+    };
+    writeJson(out, await client.bookingLinks.update(id, params));
+    return;
+  }
+  if (subcommand === "revoke") {
+    const id = requirePositional(parsed.positional, 2, "booking link id");
+    writeJson(out, await client.bookingLinks.revoke(id));
+    return;
+  }
+  throw new CliUsageError("Unknown booking-links command.");
+}
 async function runBookingPages(client, parsed, out) {
   const subcommand = parsed.positional[1];
   const options = parsed.options;
@@ -3097,6 +3520,11 @@ ${JSON.stringify(err.body, null, 2)}
     if (shipmailError.actionUrl) {
       const reason = shipmailError.reason ? ` (${shipmailError.reason})` : "";
       errOut.write(`Ask the organization owner to open${reason}: ${shipmailError.actionUrl}
+`);
+    }
+    if (shipmailError.limit) {
+      const { resource, used, limit, scope } = shipmailError.limit;
+      errOut.write(`Limit: ${resource} ${used} of ${limit} (${scope})
 `);
     }
     return;
@@ -3181,6 +3609,7 @@ async function runCli(argv, options = {}) {
     else if (command === "audiences") await runAudiences(client, parsed, out);
     else if (command === "calendar") await runCalendar(client, parsed, out);
     else if (command === "booking-pages") await runBookingPages(client, parsed, out);
+    else if (command === "booking-links") await runBookingLinks(client, parsed, out);
     else throw new CliUsageError(`Unknown command: ${command}.`);
     return 0;
   } catch (err) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shipmail-cli",
-  "version": "0.6.4",
+  "version": "0.6.5",
   "description": "Official CLI for the Shipmail API",
   "type": "module",
   "bin": {
@@ -41,7 +41,7 @@
     "access": "public"
   },
   "dependencies": {
-    "shipmail": "0.6.5",
+    "shipmail": "0.6.6",
     "zod": "^4.6.5"
   },
   "devDependencies": {