@myapihq/cli 2.5.0 → 2.6.0

package/dist/commands/container.js

@@ -27,6 +27,7 @@ export const SCHEMA = {
     port: 'number',
     env: 'string',
     tail: 'number',
+    scope: 'string',
     remove: 'boolean',
     source: 'string',
     image: 'string',
@@ -285,14 +286,29 @@ export async function deploy(id, image, flags) {
     info(`Scoped API key was rotated. New value (returned once — save it if you need it):`);
     info(`  ${result.scoped_api_key}`);
 }
-// logs prints the container's recent Cloud Run runtime logs, newest first.
+// logs prints the container's recent runtime logs, newest first. By default
+// this is the container's own stdout/stderr; --scope all adds the platform
+// audit records that share the stream.
 export async function logs(id, flags) {
     const config = requireConfig();
-    const orgId = requireOrg(flags, config, 'myapi container logs <id> [--tail <n>] [--org <id>]');
+    const orgId = requireOrg(flags, config, 'myapi container logs <id> [--tail <n>] [--scope all] [--org <id>]');
     if (!id)
-        error('Missing id.\nUsage: myapi container logs <id> [--tail <n>]');
+        error('Missing id.\nUsage: myapi container logs <id> [--tail <n>] [--scope all]');
     const tail = typeof flags.tail === 'number' ? flags.tail : undefined;
-    const entries = await sdkContainer.getContainerLogs(config.api_key, orgId, id, tail);
+    let scope;
+    if (flags.scope !== undefined) {
+        if (flags.scope !== 'container' && flags.scope !== 'all') {
+            error(`Invalid --scope "${flags.scope}". Use "container" (default) or "all".`);
+        }
+        scope = flags.scope;
+    }
+    // Audit records are multi-kilobyte JSON blobs on the same stream and share
+    // the tail budget, so at the default 100 they can push out every
+    // application line — which reads as "my container logged nothing".
+    if (scope === 'all' && tail === undefined) {
+        info('Note: --scope all includes platform audit records, which are large and share the --tail budget. Raise --tail if application lines are missing.');
+    }
+    const entries = await sdkContainer.getContainerLogs(config.api_key, orgId, id, tail, scope);
     if (flags.json) {
         printJson(entries);
         return;
@@ -336,12 +352,11 @@ export async function buildLogs(id, flags) {
     if (!id)
         error('Missing id.\nUsage: myapi container build-logs <id> [--tail N]');
     const tail = typeof flags.tail === 'number' ? flags.tail : undefined;
-    const res = await sdkContainer.buildLogs(config.api_key, orgId, id, tail);
+    const lines = await sdkContainer.buildLogs(config.api_key, orgId, id, tail);
     if (flags.json) {
-        printJson(res);
+        printJson(lines);
         return;
     }
-    const lines = res.logs ?? [];
     if (lines.length === 0) {
         info('No build logs yet — has this container been deployed with --source?');
         return;
@@ -383,10 +398,14 @@ Examples:
   myapi container deploy <id> --source ./context.tar.gz`,
     'list': 'myapi container list [--org <id>] [--json]',
     'get': 'myapi container get <id> [--org <id>] [--json]',
-    'logs': `myapi container logs <id> [--tail <n>] [--org <id>] [--json]
+    'logs': `myapi container logs <id> [--tail <n>] [--scope all] [--org <id>] [--json]
+
+Recent runtime logs, newest first. --tail caps the count (default 100,
+max 1000).
 
-Recent Cloud Run runtime logs, newest first. --tail caps the count
-(default 100, max 1000).`,
+By default this shows the container's own stdout/stderr. --scope all also
+returns platform audit records. They are multi-kilobyte JSON blobs on the
+same stream and share the --tail budget, so raise --tail when you use it.`,
     'domain': `myapi container domain <id> <domain> [--org <id>] [--json]
        myapi container domain <id> --remove [--org <id>]
 
@@ -414,7 +433,7 @@ Subcommands:
   domain <id> <domain> Bind a custom domain (--remove to unbind)
   get <id>             Inspect a container
   list                 List containers in your org
-  logs <id>            Show recent runtime logs (--tail <n>) — see build-logs for build failures
+  logs <id>            Show recent runtime logs (--tail <n>, --scope all) — see build-logs for build failures
 
 All commands accept --org <id> (or set default: myapi config set-org <id>).`);
         return;

package/dist/commands/crm/companies.js

@@ -3,6 +3,7 @@ import { crm } from '@myapihq/sdk';
 import { requireConfig } from '../../config.js';
 import { success, error, info, printTable, printJson } from '../../output.js';
 import { requireOrg, requireArg } from '../../helpers.js';
+import { rejectOffset, warnIfTruncated, countLine } from './pagination.js';
 export const EXPOSES = [
     'POST /crm/orgs/{org_id}/companies',
     'POST /crm/orgs/{org_id}/companies/promote',
@@ -35,7 +36,6 @@ function buildSearchFilter(flags) {
         domain: typeof flags.domain === 'string' ? flags.domain : undefined,
         include_deleted: flags['include-deleted'] === true || undefined,
         limit: typeof flags.limit === 'number' ? flags.limit : undefined,
-        offset: typeof flags.offset === 'number' ? flags.offset : undefined,
     };
 }
 function renderCompanies(res, flags) {
@@ -43,7 +43,8 @@ function renderCompanies(res, flags) {
         printJson(res);
         return;
     }
-    info(`${res.companies.length} of ${res.total} compan${res.total === 1 ? 'y' : 'ies'}`);
+    // NOT `N of res.total` — total is the page size, not the match count.
+    info(countLine(res.companies.length, 'company', 'companies'));
     printTable(res.companies.map(c => ({
         id: c.id,
         domain: c.domain ?? '',
@@ -57,17 +58,22 @@ function renderCompanies(res, flags) {
 async function search(flags) {
     const config = requireConfig();
     const orgId = requireOrg(flags, config, 'myapi crm companies search [filters...] [--org <id>]');
+    rejectOffset(flags, 'myapi crm companies search [filters...] [--limit N] [--org <id>]');
     const res = await crm.searchCompanies(config.api_key, orgId, buildSearchFilter(flags));
     renderCompanies(res, flags);
+    if (!flags.json)
+        warnIfTruncated(res.companies.length, flags);
 }
 async function list(flags) {
     const config = requireConfig();
     const orgId = requireOrg(flags, config, 'myapi crm companies list [--limit N] [--org <id>]');
+    rejectOffset(flags, 'myapi crm companies list [--limit N] [--org <id>]');
     const res = await crm.searchCompanies(config.api_key, orgId, {
         limit: typeof flags.limit === 'number' ? flags.limit : undefined,
-        offset: typeof flags.offset === 'number' ? flags.offset : undefined,
     });
     renderCompanies(res, flags);
+    if (!flags.json)
+        warnIfTruncated(res.companies.length, flags);
 }
 async function create(domainArg, flags) {
     const config = requireConfig();
@@ -142,9 +148,9 @@ async function promote(domain, flags) {
 }
 // ── Dispatcher ──────────────────────────────────────────────────────────
 const SUBCOMMAND_USAGE = {
-    list: 'myapi crm companies list [--limit N] [--offset N] [--org <id>] [--json]',
+    list: 'myapi crm companies list [--limit N] [--org <id>] [--json]',
     search: `myapi crm companies search [--stage <csv>] [--source <csv>] [--domain <d>]
-       [--include-deleted] [--limit N] [--offset N] [--org <id>] [--json]
+       [--include-deleted] [--limit N] [--org <id>] [--json]
 
   --stage   cold, warm, qualified, customer, churned
   --source  goldfox, email, pixel, webhook, manual`,

package/dist/commands/crm/contacts.js

@@ -3,6 +3,7 @@ import { crm } from '@myapihq/sdk';
 import { requireConfig } from '../../config.js';
 import { success, error, info, printTable, printJson } from '../../output.js';
 import { requireOrg, requireArg } from '../../helpers.js';
+import { rejectOffset, warnIfTruncated, countLine } from './pagination.js';
 export const EXPOSES = [
     'POST /crm/orgs/{org_id}/contacts',
     'POST /crm/orgs/{org_id}/contacts/promote',
@@ -41,7 +42,6 @@ function buildSearchFilter(flags) {
         max_last_engagement_days: typeof flags['max-last-engagement-days'] === 'number' ? flags['max-last-engagement-days'] : undefined,
         include_deleted: flags['include-deleted'] === true || undefined,
         limit: typeof flags.limit === 'number' ? flags.limit : undefined,
-        offset: typeof flags.offset === 'number' ? flags.offset : undefined,
     };
 }
 function renderContacts(res, flags) {
@@ -49,7 +49,8 @@ function renderContacts(res, flags) {
         printJson(res);
         return;
     }
-    info(`${res.contacts.length} of ${res.total} contact${res.total === 1 ? '' : 's'}`);
+    // NOT `N of res.total` — total is the page size, not the match count.
+    info(countLine(res.contacts.length, 'contact', 'contacts'));
     printTable(res.contacts.map(c => ({
         id: c.id,
         email: c.email ?? '',
@@ -64,18 +65,23 @@ function renderContacts(res, flags) {
 async function search(flags) {
     const config = requireConfig();
     const orgId = requireOrg(flags, config, 'myapi crm contacts search [filters...] [--org <id>]');
+    rejectOffset(flags, 'myapi crm contacts search [filters...] [--limit N] [--org <id>]');
     const res = await crm.searchContacts(config.api_key, orgId, buildSearchFilter(flags));
     renderContacts(res, flags);
+    if (!flags.json)
+        warnIfTruncated(res.contacts.length, flags);
 }
 // `list` is `search` with no filters — separate verb for discoverability.
 async function list(flags) {
     const config = requireConfig();
     const orgId = requireOrg(flags, config, 'myapi crm contacts list [--limit N] [--org <id>]');
+    rejectOffset(flags, 'myapi crm contacts list [--limit N] [--org <id>]');
     const res = await crm.searchContacts(config.api_key, orgId, {
         limit: typeof flags.limit === 'number' ? flags.limit : undefined,
-        offset: typeof flags.offset === 'number' ? flags.offset : undefined,
     });
     renderContacts(res, flags);
+    if (!flags.json)
+        warnIfTruncated(res.contacts.length, flags);
 }
 async function create(emailArg, flags) {
     const config = requireConfig();
@@ -177,10 +183,10 @@ async function events(id, flags) {
 }
 // ── Dispatcher ──────────────────────────────────────────────────────────
 const SUBCOMMAND_USAGE = {
-    list: 'myapi crm contacts list [--limit N] [--offset N] [--org <id>] [--json]',
+    list: 'myapi crm contacts list [--limit N] [--org <id>] [--json]',
     search: `myapi crm contacts search [--stage <csv>] [--source <csv>] [--email <e>]
        [--company-id <id>] [--min-last-engagement-days N] [--max-last-engagement-days N]
-       [--include-deleted] [--limit N] [--offset N] [--org <id>] [--json]
+       [--include-deleted] [--limit N] [--org <id>] [--json]
 
   --stage     cold, warm, qualified, customer, churned
   --source    goldfox, email, pixel, webhook, manual

package/dist/commands/crm/pagination.d.ts

@@ -0,0 +1,6 @@
+import { type Flags } from '../../helpers.js';
+import type { Exposes } from '../../exposes.js';
+export declare const EXPOSES: Exposes;
+export declare function rejectOffset(flags: Flags, usage: string): void;
+export declare function warnIfTruncated(returned: number, flags: Flags): void;
+export declare function countLine(returned: number, singular: string, plural: string): string;

package/dist/commands/crm/pagination.js

@@ -0,0 +1,60 @@
+// CRM search/list pagination — what the API actually does, verified against
+// production on 2026-07-27 (build c8b30009).
+//
+// Two facts, both discovered by lint-request-fields.js flagging that the SDK
+// sends an `offset` the OpenAPI schema does not declare:
+//
+//   1. `offset` is ACCEPTED AND IGNORED. Against an org with three contacts,
+//      {limit:1, offset:0}, {limit:1, offset:1} and {limit:1, offset:2} all
+//      return the same first contact. This holds for contacts and companies,
+//      on both the POST /search and GET /contacts paths. There is no cursor
+//      parameter either.
+//
+//   2. `total` is the SIZE OF THE PAGE, not the number of matches. With three
+//      contacts in the org: limit=1 → total=1, limit=2 → total=2, limit=3 →
+//      total=3, limit=10 → total=3.
+//
+// Together those make the result set silently lossy. An agent with 500
+// contacts running `--limit 100` receives 100 records and a `total` of 100,
+// and has no signal that 400 more exist. This is the worst shape a data bug
+// can take for an unattended caller: it looks like a complete answer.
+//
+// Filed upstream. Until it is fixed the CLI refuses `--offset` rather than
+// sending a parameter that does nothing, and never prints `total` as though
+// it were a match count.
+import { error, info } from '../../output.js';
+// A helper, not a command: it calls nothing. Declared empty rather than
+// exempted, so the coverage gate's "every module states its surface" rule
+// stays absolute.
+export const EXPOSES = [];
+// Server-side default page size when no --limit is given. The API applies
+// this; we only need it to know whether a result may have been truncated.
+const DEFAULT_LIMIT = 50;
+// Rejects --offset outright. Silently dropping it would reproduce the bug we
+// are protecting against, and passing it through means duplicate pages.
+export function rejectOffset(flags, usage) {
+    if (flags.offset === undefined)
+        return;
+    error('The CRM API accepts --offset and ignores it, so every page would return the same records.\n' +
+        'Verified against production: with --limit 1, offsets 0, 1 and 2 all return the first match.\n\n' +
+        'There is no cursor parameter either, so the CRM has no working pagination today.\n' +
+        'Raise --limit to fetch more in one call, and narrow the result set with filters\n' +
+        '(--stage, --source, --company-id, --email) rather than paging through it.\n\n' +
+        `Usage: ${usage}`);
+}
+// A page that came back exactly full is indistinguishable from a truncated
+// one, and `total` cannot tell them apart. Say so, rather than letting the
+// caller assume the answer is complete.
+export function warnIfTruncated(returned, flags) {
+    const limit = typeof flags.limit === 'number' ? flags.limit : DEFAULT_LIMIT;
+    if (returned < limit)
+        return;
+    info(`Note: exactly ${returned} record${returned === 1 ? '' : 's'} came back, which is the page limit. ` +
+        'There may be more, and the API reports no match count and offers no way to fetch the next page. ' +
+        'Raise --limit or add filters.');
+}
+// The API returns `total`, but it equals the page size, so rendering "N of
+// total" states something false. Callers use this instead.
+export function countLine(returned, singular, plural) {
+    return `${returned} ${returned === 1 ? singular : plural}`;
+}

package/dist/commands/crm/pagination.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/commands/crm/pagination.test.js

@@ -0,0 +1,73 @@
+// Regression cover for the CRM pagination guards.
+//
+// The bug being fenced off: the API accepts `offset`, ignores it, and reports
+// `total` as the page size — so an agent paging a contact list re-read page
+// one forever and had no signal that anything was missing. Verified against
+// production 2026-07-27. These tests assert the CLI never silently accepts
+// that flag again, and never claims a result is complete when it cannot know.
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { rejectOffset, warnIfTruncated, countLine } from './pagination.js';
+import * as output from '../../output.js';
+describe('rejectOffset', () => {
+    let errSpy;
+    beforeEach(() => {
+        // error() exits the process; make it throw so the test can catch it.
+        errSpy = vi.spyOn(output, 'error').mockImplementation(((msg) => {
+            throw new Error(msg);
+        }));
+    });
+    afterEach(() => errSpy.mockRestore());
+    it('passes through when --offset is absent', () => {
+        expect(() => rejectOffset({}, 'usage')).not.toThrow();
+    });
+    it('rejects --offset 0 — it is as broken as any other value', () => {
+        expect(() => rejectOffset({ offset: 0 }, 'usage')).toThrow(/ignores it/);
+    });
+    it('rejects a non-zero --offset', () => {
+        expect(() => rejectOffset({ offset: 25 }, 'usage')).toThrow(/ignores it/);
+    });
+    it('explains that no cursor exists either, so the user does not go looking', () => {
+        expect(() => rejectOffset({ offset: 1 }, 'usage')).toThrow(/no cursor parameter/);
+    });
+    it('includes the usage line so the error is actionable', () => {
+        expect(() => rejectOffset({ offset: 1 }, 'myapi crm contacts list [--limit N]'))
+            .toThrow(/myapi crm contacts list/);
+    });
+});
+describe('warnIfTruncated', () => {
+    let infoSpy;
+    beforeEach(() => { infoSpy = vi.spyOn(output, 'info').mockImplementation(() => { }); });
+    afterEach(() => infoSpy.mockRestore());
+    it('warns when the page came back exactly full', () => {
+        warnIfTruncated(10, { limit: 10 });
+        expect(infoSpy).toHaveBeenCalledWith(expect.stringContaining('page limit'));
+    });
+    it('stays quiet when the page came back short — that answer IS complete', () => {
+        warnIfTruncated(3, { limit: 10 });
+        expect(infoSpy).not.toHaveBeenCalled();
+    });
+    it('uses the server default of 50 when no --limit was given', () => {
+        warnIfTruncated(50, {});
+        expect(infoSpy).toHaveBeenCalledWith(expect.stringContaining('page limit'));
+    });
+    it('stays quiet below the default limit', () => {
+        warnIfTruncated(49, {});
+        expect(infoSpy).not.toHaveBeenCalled();
+    });
+    it('says a record, not "1 records"', () => {
+        warnIfTruncated(1, { limit: 1 });
+        expect(infoSpy).toHaveBeenCalledWith(expect.stringContaining('exactly 1 record came back'));
+    });
+});
+describe('countLine', () => {
+    // The point of this helper is what it does NOT print: `N of total`, where
+    // total is the page size, reads as "you have everything".
+    it('pluralizes', () => {
+        expect(countLine(1, 'contact', 'contacts')).toBe('1 contact');
+        expect(countLine(3, 'contact', 'contacts')).toBe('3 contacts');
+        expect(countLine(0, 'company', 'companies')).toBe('0 companies');
+    });
+    it('never mentions a total', () => {
+        expect(countLine(5, 'contact', 'contacts')).not.toMatch(/of/);
+    });
+});

package/dist/commands/pixel.js

@@ -4,6 +4,7 @@ import { success, error, printTable, info, printJson } from '../output.js';
 import { requireOrg } from '../helpers.js';
 export const SCHEMA = {
     'external-id': 'string',
+    email: 'string',
     org: 'string',
     website: 'string',
     'campaign-id': 'string',
@@ -85,7 +86,11 @@ export async function visits(flags) {
         to_url: v.to_url,
         ts: v.ts,
     })));
-    info(`Total: ${res.total} | Showing: ${res.limit} | Offset: ${res.offset}`);
+    // /visits returns only {visits, total} — it does NOT echo limit/offset the
+    // way /events and /interactions do, so this used to print
+    // "Showing: undefined | Offset: undefined". Report what the response
+    // actually carries.
+    info(`Total: ${res.total} | Showing: ${res.visits.length}`);
 }
 // Engagement events (open / click / page_visit / sent) — filterable by
 // campaign or by domain.

package/dist/exposes.test.js

@@ -13,6 +13,7 @@ const COMMAND_MODULES = [
     './commands/crm/index.js',
     './commands/crm/contacts.js',
     './commands/crm/companies.js',
+    './commands/crm/pagination.js',
     './commands/database.js',
     './commands/domain.js',
     './commands/email/index.js',

package/dist/sdk-container.test.js

@@ -124,6 +124,24 @@ describe('container.getContainerLogs', () => {
         fetchMock.mockResolvedValueOnce(ok([]));
         expect(await container.getContainerLogs(API_KEY, ORG_ID, C_ID)).toEqual([]);
     });
+    it('appends ?scope=all only for scope="all"', async () => {
+        fetchMock.mockResolvedValueOnce(ok([]));
+        await container.getContainerLogs(API_KEY, ORG_ID, C_ID, undefined, 'all');
+        expect(fetchMock.mock.calls[0][0]).toMatch(/\/logs\?scope=all$/);
+    });
+    // 'container' is the server default, so sending it explicitly would be
+    // noise — and an undeclared query param is the kind of thing that starts
+    // being validated later.
+    it('omits scope entirely for the default scope', async () => {
+        fetchMock.mockResolvedValueOnce(ok([]));
+        await container.getContainerLogs(API_KEY, ORG_ID, C_ID, undefined, 'container');
+        expect(fetchMock.mock.calls[0][0]).toMatch(/\/logs$/);
+    });
+    it('combines tail and scope', async () => {
+        fetchMock.mockResolvedValueOnce(ok([]));
+        await container.getContainerLogs(API_KEY, ORG_ID, C_ID, 500, 'all');
+        expect(fetchMock.mock.calls[0][0]).toMatch(/\/logs\?tail=500&scope=all$/);
+    });
 });
 describe('container.EXPOSES', () => {
     it('covers the 9 container endpoints', () => {

package/dist/sdk-envelope.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/sdk-envelope.test.js

@@ -0,0 +1,84 @@
+// Envelope tolerance in the SDK's response parser (packages/sdk/src/client.ts).
+//
+// Most of the platform answers {success, data, error, meta}. A few routes
+// answer 2xx with a bare object instead. Requiring `success` meant those
+// routes surfaced as a bare `unknown_error` while their data sat unread in the
+// response body — `pixel identity` and `pixel events` both shipped broken that
+// way, and the second was only found by calling it with real parameters.
+//
+// The rule these tests pin down: the HTTP STATUS decides success. When the
+// body carries no envelope, the body is the data. When it does carry one, the
+// envelope still wins, so a {success:false} 200 is still an error.
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { request, MyApiError } from '@myapihq/sdk';
+const API_KEY = 'myapi_test_abc';
+const URL = 'https://api.example.com/thing';
+let fetchMock;
+function res(body, status = 200) {
+    return new Response(typeof body === 'string' ? body : JSON.stringify(body), {
+        status,
+        headers: { 'content-type': 'application/json' },
+    });
+}
+beforeEach(() => {
+    fetchMock = vi.fn();
+    vi.stubGlobal('fetch', fetchMock);
+});
+afterEach(() => vi.unstubAllGlobals());
+describe('enveloped responses keep their existing behaviour', () => {
+    it('unwraps data', async () => {
+        fetchMock.mockResolvedValueOnce(res({ success: true, data: { id: 7 }, meta: {} }));
+        expect(await request('GET', URL, API_KEY)).toEqual({ id: 7 });
+    });
+    it('still throws on {success:false} even with a 200', async () => {
+        fetchMock.mockResolvedValueOnce(res({ success: false, error: { code: 'nope' } }));
+        await expect(request('GET', URL, API_KEY)).rejects.toThrow(MyApiError);
+    });
+    it('still throws on a non-2xx', async () => {
+        fetchMock.mockResolvedValueOnce(res({ success: false, error: { code: 'bad' } }, 400));
+        await expect(request('GET', URL, API_KEY)).rejects.toThrow(MyApiError);
+    });
+});
+describe('bare responses are treated as data', () => {
+    // The exact shape /pixel/orgs/{org}/events returns.
+    it('returns the whole body when there is no success key', async () => {
+        fetchMock.mockResolvedValueOnce(res({ events: [], limit: 1, offset: 0, total: 0 }));
+        expect(await request('GET', URL, API_KEY)).toEqual({ events: [], limit: 1, offset: 0, total: 0 });
+    });
+    it('does not mistake a bare body for a failure', async () => {
+        fetchMock.mockResolvedValueOnce(res({ pixel_id: 'abc', emails: [] }));
+        await expect(request('GET', URL, API_KEY)).resolves.toBeTruthy();
+    });
+    it('handles a bare array', async () => {
+        fetchMock.mockResolvedValueOnce(res([1, 2, 3]));
+        expect(await request('GET', URL, API_KEY)).toEqual([1, 2, 3]);
+    });
+    // A bare body on an ERROR status must still raise — the status is the
+    // authority, so tolerance must not swallow failures.
+    it('still throws when a bare body arrives with a non-2xx', async () => {
+        fetchMock.mockResolvedValueOnce(res({ message: 'nope' }, 500));
+        await expect(request('GET', URL, API_KEY)).rejects.toThrow(MyApiError);
+    });
+    // A field literally named `success` on a bare payload would be
+    // indistinguishable from an envelope. Documented as a known limit rather
+    // than silently mishandled: an un-enveloped body carrying success:false
+    // will be read as an error.
+    it('KNOWN LIMIT: a bare body with a success field is read as an envelope', async () => {
+        fetchMock.mockResolvedValueOnce(res({ success: false, name: 'a real record' }));
+        await expect(request('GET', URL, API_KEY)).rejects.toThrow(MyApiError);
+    });
+});
+describe('empty and edge bodies', () => {
+    it('204 stays null', async () => {
+        fetchMock.mockResolvedValueOnce(new Response(null, { status: 204 }));
+        expect(await request('DELETE', URL, API_KEY)).toBeNull();
+    });
+    it('an empty 200 body parses to an empty object, not an error', async () => {
+        fetchMock.mockResolvedValueOnce(new Response('', { status: 200, headers: { 'content-type': 'application/json' } }));
+        expect(await request('GET', URL, API_KEY)).toEqual({});
+    });
+    it('non-JSON still raises invalid_json_response', async () => {
+        fetchMock.mockResolvedValueOnce(new Response('<html>502</html>', { status: 200, headers: { 'content-type': 'text/html' } }));
+        await expect(request('GET', URL, API_KEY)).rejects.toThrow(/invalid_json_response/);
+    });
+});

package/dist/skills/my-container-api/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   Run containers on demand — long-running services, background workers, and scheduled jobs. The heavier-duty sibling of edge functions, for native deps and long execution.
 triggers: [container, cloud run, dynamic app, custom domain app, service, worker, scheduled job, deploy container, docker image]
-checksum: sha256-0bd2fdee306f944702faf18b0cbb5d976a2bdc39c1f940c037600b0c0f6a4691
+checksum: sha256-d25fff35df7bf67bebabb6cc228f322b108d8472035cbda70756d720b8db502d
 ---
 
 # MyContainerAPI
@@ -39,7 +39,7 @@ Get it right:
 | `myapi container deploy <id> <image-ref>` | Ship a pre-built image and go live (rotates the scoped key) |
 | `myapi container list` | List containers in your org |
 | `myapi container get <id>` | Inspect a container (status, URL, custom domain) |
-| `myapi container logs <id> [--tail <n>]` | Recent runtime logs, newest first |
+| `myapi container logs <id> [--tail <n>] [--scope all]` | Recent runtime logs, newest first (`--scope all` adds platform audit records) |
 | `myapi container domain <id> <domain>` | Bind a custom domain (`--remove` to unbind) |
 | `myapi container delete <id>` | Soft-delete and revoke its scoped API key |
 <!-- generated:end -->
@@ -67,10 +67,31 @@ myapi container domain <id> --remove
 ```
 <!-- llm:end -->
 
+## Runtime constraints
+
+These are properties of the platform, not of your code. Each one fails in a
+way that looks like an application bug.
+
+- **A `service` is stateless.** It scales to zero *and* up to `--max-instances`
+  (default 3). Each instance holds its own memory, so in-process state returns
+  wrong answers under concurrency instead of erroring. Put state in
+  `my-database-api`.
+- **`/healthz` never reaches your container** — the runtime intercepts it. Use
+  `/livez`, or any other path.
+- **Request bodies are capped at 32MB.**
+- **Any 5xx from your code is replaced by an edge HTML error page.** A JSON
+  error envelope will not reach the caller. Return a 4xx if the reason has to
+  survive.
+- **`--env`, `--cpu`, `--memory`, `--max-instances` and `--cron` are set at
+  `create` and cannot be changed by `deploy`.** Passing them to `deploy` does
+  nothing. Recreate the container to change them.
+
 ## Notes
 
 - The scoped API key is shown **once** at create, and again (rotated) on every deploy. Save it if your code needs it.
 - A `worker` is forced to ≥1 instance; a `service` scales to zero; only a `job` accepts `--cron`.
+- `logs --scope all` adds platform audit records. They are large JSON blobs on
+  the same stream and share the `--tail` budget, so raise `--tail` with it.
 - Custom domains need a deployed container **and** a MyAPI-registered parent domain — see `my-domain-api`.
 - Containers are for dynamic apps and native deps. For static sites use `my-funnel-api`; for edge functions use `my-function-api`.
 

package/dist/skills/my-crm-api/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   The canonical store of engaged contacts + companies for an org. Auto-ingests from inbound webhooks via a configurable dot-path. Fixed lifecycle_stage enum (cold | warm | qualified | customer | churned). Append-only event timeline with reserved kinds. Soft delete + restore. Promote-from-Goldfox closes the discovery → engagement loop.
 triggers: [crm, contact, company, lead, engagement, pipeline, lifecycle, qualified, customer, webhook ingest, promote]
-checksum: sha256-1e1e7a8c4674f7a109f5bb0b5e9f053e938d2ee36d56c6ce8a4276826f7d9609
+checksum: sha256-085cb990a292ba815d7c59a58fb25816d52bf33ad5019a7d90abf4123383a67c
 ---
 
 # MyCRMAPI
@@ -158,9 +158,14 @@ myapi crm contacts events <id> --kind webhook_received
 
 ## Notes
 
+- **No pagination. Do not build a paging loop.** The API ignores `offset`
+  (every page repeats page one), there is no cursor, and `total` is the page
+  size, not the match count. The CLI rejects `--offset` rather than lie. If
+  exactly `--limit` rows come back, assume more exist: raise `--limit` or
+  narrow with filters.
 - **Reserved event kinds — no custom events in v1.** If an agent needs custom state per contact, use `myapi database` keyed by contact id. The curated timeline stays the authoritative engagement record.
-- **Event payloads carry an `external_id`** — the backend's idempotency key, equal to the underlying action's natural id (`goldfox_person_id` for `promoted`, `delivery_id` for `webhook_received`). Read the semantic field; `external_id` is a backend-internal duplicate. A legacy `message_id` on old rows holds the same value — safe to ignore.
-- **Email + Pixel auto-ingest not yet wired**. Only `webhook_received` events fire today. Email and pixel ingest are coming — the CLI surface stays unchanged when they land.
-- **Free in v1.** Metered later if usage shows a need.
+- **`external_id` on an event payload** is the backend's idempotency key — a duplicate of the action's natural id (`goldfox_person_id`, `delivery_id`). Read the semantic field instead; legacy `message_id` rows hold the same value.
+- **Only `webhook_received` fires today.** Email and pixel auto-ingest are coming; the CLI surface will not change.
+- **Free in v1.** Metered later if usage warrants.
 
 Run `myapi crm --help` or `myapi crm <namespace> --help` for inline reference.

package/dist/skills/my-storage-api/SKILL.md

@@ -2,9 +2,9 @@
 name: my-storage-api
 version: 1.0.0
 description: >
-  Edge-hosted asset storage. Upload local files (.png/.jpg/.gif/.webp) directly, or have the server fetch from a public URL. Each asset gets a stable public CDN URL.
+  Edge-hosted asset storage. Upload a local file of any content type directly, or have the server fetch from a public URL. Each asset gets a stable public CDN URL.
 triggers: [storage, upload, ingest, asset, cdn, image hosting, file upload, get-url, download, public url]
-checksum: sha256-80f78e83d086ec5e312abbb2fc7c85a2c9a87043a94b7e4fccc13902d5455df1
+checksum: sha256-b55e3f0aa592330cadfdc2b87e730333300bfffb08866b3bc59cb0ce15d2f953
 ---
 
 # MyStorageAPI
@@ -15,7 +15,25 @@ Per-org asset storage with edge CDN delivery. Two ways in: direct upload (local
 <!-- llm:start -->
 Storage is the asset layer. Anything you upload or ingest is served from the edge under a permanent public URL — embed it in funnel pages, email templates, anywhere.
 
-`upload` accepts `.png`, `.jpg`, `.jpeg`, `.gif`, `.webp`, `.svg`, `.pdf`, `.mp4`, `.webm` from the local filesystem. For any other extension, host the file somewhere public and use `ingest` instead — the server fetches it for you.
+`upload` accepts **any content type** from the local filesystem. There is no
+extension allowlist — an unrecognized type is stored as an opaque blob and
+served back as it was sent. Pass `--content-type` when the extension does not
+imply the type you want.
+
+Size caps depend on the detected type, not on the extension:
+
+| Detected type | Cap |
+|---|---|
+| Images (`jpeg`, `png`, `gif`, `webp`, `svg`) | 10MB |
+| Video (`mp4`, `webm`) | 200MB |
+| PDF and everything else | 25MB |
+
+Use `upload` (multipart) to get the full per-type cap. A raw-body upload is
+capped at 10MB regardless of type and is refused above it with
+`FILE_TOO_LARGE`.
+
+Use `ingest` when the file is already at a public URL and you would rather the
+server fetch it than upload it yourself — not because `upload` refuses the type.
 
 Generated images from **myimageapi** automatically land here; they appear in `storage list` under their job id.
 
@@ -27,7 +45,7 @@ Use `get` for a round-trip metadata fetch. Use `get-url` when you just need the
 | Command | What it does |
 |---|---|
 | `myapi storage list` | List all stored assets |
-| `myapi storage upload <file>` | Direct multipart upload of a local file (image/svg/pdf/mp4/webm) |
+| `myapi storage upload <file>` | Direct multipart upload of a local file (any content type) |
 | `myapi storage ingest <url>` | Server fetches a public URL into storage |
 | `myapi storage get <asset_id>` | Round-trip the API for full metadata (`--json` or human block) |
 | `myapi storage get-url <asset_id>` | Pure local URL constructor — no API call, no auth |
@@ -59,8 +77,8 @@ myapi storage delete <asset_id>
 
 ## Upload vs Ingest
 
-- **`upload`** — file is on your machine. Multipart POST. Supported extensions: `.png`, `.jpg`, `.jpeg`, `.gif`, `.webp`, `.svg`, `.pdf`, `.mp4`, `.webm`.
-- **`ingest`** — file is at a public HTTP(S) URL. Server downloads and stores. Useful for migrating assets, pulling in third-party files you have rights to, or for extensions `upload` doesn't accept.
+- **`upload`** — file is on your machine. Multipart POST. Any content type. The CLI infers `Content-Type` from the extension for the common ones; for anything else pass `--content-type` or accept `application/octet-stream`.
+- **`ingest`** — file is at a public HTTP(S) URL. Server downloads and stores. Useful for migrating assets or pulling in third-party files you have rights to.
 
 Both produce identical asset records — `list` doesn't distinguish.
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@myapihq/cli",
   "license": "Apache-2.0",
-  "version": "2.5.0",
+  "version": "2.6.0",
   "description": "MyAPI command-line interface",
   "repository": {
     "type": "git",
@@ -34,12 +34,13 @@
     "lint:changelog": "node ../../scripts/lint-changelog.js",
     "lint:help-order": "node scripts/lint-help-order.js",
     "lint:exposes": "node scripts/lint-exposes.js",
+    "lint:request-fields": "node scripts/lint-request-fields.js",
     "lint:docs": "node scripts/lint-docs.js",
     "lint:skills": "node scripts/copy-skills.js && node scripts/lint-skills.js",
     "lint:skills:strict": "node scripts/copy-skills.js && node scripts/lint-skills.js --strict"
   },
   "dependencies": {
-    "@myapihq/sdk": "^2.5.0"
+    "@myapihq/sdk": "^2.6.0"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",