fix: address review findings on attachment parsing edge cases

- reject stray ;key= tokens inside cid and filename values (type stays
  permissive for MIME parameters)
- stop silently ignoring an explicit empty --attachments-file value,
  including in the --template conflict check
- forward explicit empty --custom-return-path to the API
- mention camelCase aliases in the unsupported-field error

Author: felipefreitag

src/commands/domains/create.ts

@@ -71,7 +71,7 @@ export const createDomainCommand = new Command('create')
             ...(opts.trackingSubdomain && {
               trackingSubdomain: opts.trackingSubdomain,
             }),
-            ...(opts.customReturnPath && {
+            ...(opts.customReturnPath !== undefined && {
               customReturnPath: opts.customReturnPath,
             }),
             ...((opts.sending || opts.receiving) && {

src/commands/emails/send.ts

@@ -195,7 +195,10 @@ export const sendCommand = new Command('send')
       );
     }
 
-    if (hasTemplate && (opts.attachment || opts.attachmentsFile)) {
+    if (
+      hasTemplate &&
+      (opts.attachment || opts.attachmentsFile !== undefined)
+    ) {
       outputError(
         {
           message:
@@ -359,7 +362,7 @@ export const sendCommand = new Command('send')
       },
     );
 
-    if (opts.attachmentsFile) {
+    if (opts.attachmentsFile !== undefined) {
       const raw = readFile(opts.attachmentsFile, globalOpts);
       try {
         attachments = [...(attachments ?? []), ...parseAttachmentsJson(raw)];

src/lib/attachments.ts

@@ -44,6 +44,13 @@ export function parseAttachmentSpec(value: string): AttachmentSpec {
     if (!paramValue) {
       throw new Error(`Empty ";${key}=" in attachment "${value}".`);
     }
+    // MIME parameters like "type=text/plain;charset=utf-8" are legitimate,
+    // but a ";key=" inside a cid or filename value is a typo.
+    if (field !== 'contentType' && PARAM_LIKE.test(paramValue)) {
+      throw new Error(
+        `Unrecognized attachment parameter in "${value}". Supported: ;cid=, ;type=, ;filename= (use --attachments-file for paths containing ";key=").`,
+      );
+    }
     spec[field] = paramValue;
   }
   return spec;
@@ -83,7 +90,7 @@ export function parseAttachmentsJson(raw: string): Attachment[] {
       const key = FIELD_ALIASES[rawKey] ?? rawKey;
       if (!ALLOWED_FIELDS.has(key)) {
         throw new Error(
-          `Attachment at index ${i} has unsupported field "${rawKey}". Supported: content, filename, path, content_type, content_id.`,
+          `Attachment at index ${i} has unsupported field "${rawKey}". Supported: content, filename, path, content_type/contentType, content_id/contentId.`,
         );
       }
       if (key in attachment) {

tests/commands/domains/create.test.ts

@@ -130,6 +130,21 @@ describe('domains create command', () => {
     expect(args.customReturnPath).toBe('bounce');
   });
 
+  it('forwards an explicit empty --custom-return-path to the API', async () => {
+    spies = setupOutputSpies();
+
+    const { createDomainCommand } = await import(
+      '../../../src/commands/domains/create'
+    );
+    await createDomainCommand.parseAsync(
+      ['--name', 'example.com', '--custom-return-path', ''],
+      { from: 'user' },
+    );
+
+    const args = mockCreate.mock.calls[0][0] as Record<string, unknown>;
+    expect(args.customReturnPath).toBe('');
+  });
+
   it('omits customReturnPath when flag is absent', async () => {
     spies = setupOutputSpies();
 

tests/commands/emails/send.test.ts

@@ -1441,6 +1441,34 @@ describe('send command', () => {
     expect(output).toContain('template_attachment_conflict');
   });
 
+  it('does not silently ignore an empty --attachments-file value', async () => {
+    setNonInteractive();
+    errorSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
+    exitSpy = mockExitThrow();
+
+    const { sendCommand } = await import('../../../src/commands/emails/send');
+    await expectExit1(() =>
+      sendCommand.parseAsync(
+        [
+          '--from',
+          'a@test.com',
+          '--to',
+          'b@test.com',
+          '--subject',
+          'Test',
+          '--text',
+          'Hi',
+          '--attachments-file',
+          '',
+        ],
+        { from: 'user' },
+      ),
+    );
+
+    const output = errorSpy.mock.calls.map((c) => c[0]).join(' ');
+    expect(output).toContain('file_read_error');
+  });
+
   it('sends email with --react-email flag', async () => {
     spies = setupOutputSpies();
 

tests/lib/attachments.test.ts

@@ -55,6 +55,15 @@ describe('parseAttachmentSpec', () => {
     );
   });
 
+  it('rejects unrecognized ;key= params inside cid and filename values', () => {
+    expect(() => parseAttachmentSpec('./a.png;cid=logo;foo=bar')).toThrow(
+      /Unrecognized attachment parameter/,
+    );
+    expect(() => parseAttachmentSpec('./a.png;filename=a;foo=bar')).toThrow(
+      /Unrecognized attachment parameter/,
+    );
+  });
+
   it('rejects duplicate params', () => {
     expect(() => parseAttachmentSpec('./a.png;cid=a;cid=b')).toThrow(
       /Duplicate ";cid="/,