@myapihq/cli 2.5.1 → 2.6.1

package/dist/commands/container.js

@@ -27,6 +27,7 @@ export const SCHEMA = {
     port: 'number',
     env: 'string',
     tail: 'number',
+    scope: 'string',
     remove: 'boolean',
     source: 'string',
     image: 'string',
@@ -285,14 +286,29 @@ export async function deploy(id, image, flags) {
     info(`Scoped API key was rotated. New value (returned once — save it if you need it):`);
     info(`  ${result.scoped_api_key}`);
 }
-// logs prints the container's recent Cloud Run runtime logs, newest first.
+// logs prints the container's recent runtime logs, newest first. By default
+// this is the container's own stdout/stderr; --scope all adds the platform
+// audit records that share the stream.
 export async function logs(id, flags) {
     const config = requireConfig();
-    const orgId = requireOrg(flags, config, 'myapi container logs <id> [--tail <n>] [--org <id>]');
+    const orgId = requireOrg(flags, config, 'myapi container logs <id> [--tail <n>] [--scope all] [--org <id>]');
     if (!id)
-        error('Missing id.\nUsage: myapi container logs <id> [--tail <n>]');
+        error('Missing id.\nUsage: myapi container logs <id> [--tail <n>] [--scope all]');
     const tail = typeof flags.tail === 'number' ? flags.tail : undefined;
-    const entries = await sdkContainer.getContainerLogs(config.api_key, orgId, id, tail);
+    let scope;
+    if (flags.scope !== undefined) {
+        if (flags.scope !== 'container' && flags.scope !== 'all') {
+            error(`Invalid --scope "${flags.scope}". Use "container" (default) or "all".`);
+        }
+        scope = flags.scope;
+    }
+    // Audit records are multi-kilobyte JSON blobs on the same stream and share
+    // the tail budget, so at the default 100 they can push out every
+    // application line — which reads as "my container logged nothing".
+    if (scope === 'all' && tail === undefined) {
+        info('Note: --scope all includes platform audit records, which are large and share the --tail budget. Raise --tail if application lines are missing.');
+    }
+    const entries = await sdkContainer.getContainerLogs(config.api_key, orgId, id, tail, scope);
     if (flags.json) {
         printJson(entries);
         return;
@@ -382,10 +398,14 @@ Examples:
   myapi container deploy <id> --source ./context.tar.gz`,
     'list': 'myapi container list [--org <id>] [--json]',
     'get': 'myapi container get <id> [--org <id>] [--json]',
-    'logs': `myapi container logs <id> [--tail <n>] [--org <id>] [--json]
+    'logs': `myapi container logs <id> [--tail <n>] [--scope all] [--org <id>] [--json]
+
+Recent runtime logs, newest first. --tail caps the count (default 100,
+max 1000).
 
-Recent Cloud Run runtime logs, newest first. --tail caps the count
-(default 100, max 1000).`,
+By default this shows the container's own stdout/stderr. --scope all also
+returns platform audit records. They are multi-kilobyte JSON blobs on the
+same stream and share the --tail budget, so raise --tail when you use it.`,
     'domain': `myapi container domain <id> <domain> [--org <id>] [--json]
        myapi container domain <id> --remove [--org <id>]
 
@@ -413,7 +433,7 @@ Subcommands:
   domain <id> <domain> Bind a custom domain (--remove to unbind)
   get <id>             Inspect a container
   list                 List containers in your org
-  logs <id>            Show recent runtime logs (--tail <n>) — see build-logs for build failures
+  logs <id>            Show recent runtime logs (--tail <n>, --scope all) — see build-logs for build failures
 
 All commands accept --org <id> (or set default: myapi config set-org <id>).`);
         return;

package/dist/commands/crm/companies.js

@@ -3,6 +3,7 @@ import { crm } from '@myapihq/sdk';
 import { requireConfig } from '../../config.js';
 import { success, error, info, printTable, printJson } from '../../output.js';
 import { requireOrg, requireArg } from '../../helpers.js';
+import { rejectOffset, warnIfTruncated, countLine } from './pagination.js';
 export const EXPOSES = [
     'POST /crm/orgs/{org_id}/companies',
     'POST /crm/orgs/{org_id}/companies/promote',
@@ -35,7 +36,6 @@ function buildSearchFilter(flags) {
         domain: typeof flags.domain === 'string' ? flags.domain : undefined,
         include_deleted: flags['include-deleted'] === true || undefined,
         limit: typeof flags.limit === 'number' ? flags.limit : undefined,
-        offset: typeof flags.offset === 'number' ? flags.offset : undefined,
     };
 }
 function renderCompanies(res, flags) {
@@ -43,7 +43,8 @@ function renderCompanies(res, flags) {
         printJson(res);
         return;
     }
-    info(`${res.companies.length} of ${res.total} compan${res.total === 1 ? 'y' : 'ies'}`);
+    // NOT `N of res.total` — total is the page size, not the match count.
+    info(countLine(res.companies.length, 'company', 'companies'));
     printTable(res.companies.map(c => ({
         id: c.id,
         domain: c.domain ?? '',
@@ -57,17 +58,22 @@ function renderCompanies(res, flags) {
 async function search(flags) {
     const config = requireConfig();
     const orgId = requireOrg(flags, config, 'myapi crm companies search [filters...] [--org <id>]');
+    rejectOffset(flags, 'myapi crm companies search [filters...] [--limit N] [--org <id>]');
     const res = await crm.searchCompanies(config.api_key, orgId, buildSearchFilter(flags));
     renderCompanies(res, flags);
+    if (!flags.json)
+        warnIfTruncated(res.companies.length, flags);
 }
 async function list(flags) {
     const config = requireConfig();
     const orgId = requireOrg(flags, config, 'myapi crm companies list [--limit N] [--org <id>]');
+    rejectOffset(flags, 'myapi crm companies list [--limit N] [--org <id>]');
     const res = await crm.searchCompanies(config.api_key, orgId, {
         limit: typeof flags.limit === 'number' ? flags.limit : undefined,
-        offset: typeof flags.offset === 'number' ? flags.offset : undefined,
     });
     renderCompanies(res, flags);
+    if (!flags.json)
+        warnIfTruncated(res.companies.length, flags);
 }
 async function create(domainArg, flags) {
     const config = requireConfig();
@@ -142,9 +148,9 @@ async function promote(domain, flags) {
 }
 // ── Dispatcher ──────────────────────────────────────────────────────────
 const SUBCOMMAND_USAGE = {
-    list: 'myapi crm companies list [--limit N] [--offset N] [--org <id>] [--json]',
+    list: 'myapi crm companies list [--limit N] [--org <id>] [--json]',
     search: `myapi crm companies search [--stage <csv>] [--source <csv>] [--domain <d>]
-       [--include-deleted] [--limit N] [--offset N] [--org <id>] [--json]
+       [--include-deleted] [--limit N] [--org <id>] [--json]
 
   --stage   cold, warm, qualified, customer, churned
   --source  goldfox, email, pixel, webhook, manual`,

package/dist/commands/crm/contacts.js

@@ -3,6 +3,7 @@ import { crm } from '@myapihq/sdk';
 import { requireConfig } from '../../config.js';
 import { success, error, info, printTable, printJson } from '../../output.js';
 import { requireOrg, requireArg } from '../../helpers.js';
+import { rejectOffset, warnIfTruncated, countLine } from './pagination.js';
 export const EXPOSES = [
     'POST /crm/orgs/{org_id}/contacts',
     'POST /crm/orgs/{org_id}/contacts/promote',
@@ -41,7 +42,6 @@ function buildSearchFilter(flags) {
         max_last_engagement_days: typeof flags['max-last-engagement-days'] === 'number' ? flags['max-last-engagement-days'] : undefined,
         include_deleted: flags['include-deleted'] === true || undefined,
         limit: typeof flags.limit === 'number' ? flags.limit : undefined,
-        offset: typeof flags.offset === 'number' ? flags.offset : undefined,
     };
 }
 function renderContacts(res, flags) {
@@ -49,7 +49,8 @@ function renderContacts(res, flags) {
         printJson(res);
         return;
     }
-    info(`${res.contacts.length} of ${res.total} contact${res.total === 1 ? '' : 's'}`);
+    // NOT `N of res.total` — total is the page size, not the match count.
+    info(countLine(res.contacts.length, 'contact', 'contacts'));
     printTable(res.contacts.map(c => ({
         id: c.id,
         email: c.email ?? '',
@@ -64,18 +65,23 @@ function renderContacts(res, flags) {
 async function search(flags) {
     const config = requireConfig();
     const orgId = requireOrg(flags, config, 'myapi crm contacts search [filters...] [--org <id>]');
+    rejectOffset(flags, 'myapi crm contacts search [filters...] [--limit N] [--org <id>]');
     const res = await crm.searchContacts(config.api_key, orgId, buildSearchFilter(flags));
     renderContacts(res, flags);
+    if (!flags.json)
+        warnIfTruncated(res.contacts.length, flags);
 }
 // `list` is `search` with no filters — separate verb for discoverability.
 async function list(flags) {
     const config = requireConfig();
     const orgId = requireOrg(flags, config, 'myapi crm contacts list [--limit N] [--org <id>]');
+    rejectOffset(flags, 'myapi crm contacts list [--limit N] [--org <id>]');
     const res = await crm.searchContacts(config.api_key, orgId, {
         limit: typeof flags.limit === 'number' ? flags.limit : undefined,
-        offset: typeof flags.offset === 'number' ? flags.offset : undefined,
     });
     renderContacts(res, flags);
+    if (!flags.json)
+        warnIfTruncated(res.contacts.length, flags);
 }
 async function create(emailArg, flags) {
     const config = requireConfig();
@@ -177,10 +183,10 @@ async function events(id, flags) {
 }
 // ── Dispatcher ──────────────────────────────────────────────────────────
 const SUBCOMMAND_USAGE = {
-    list: 'myapi crm contacts list [--limit N] [--offset N] [--org <id>] [--json]',
+    list: 'myapi crm contacts list [--limit N] [--org <id>] [--json]',
     search: `myapi crm contacts search [--stage <csv>] [--source <csv>] [--email <e>]
        [--company-id <id>] [--min-last-engagement-days N] [--max-last-engagement-days N]
-       [--include-deleted] [--limit N] [--offset N] [--org <id>] [--json]
+       [--include-deleted] [--limit N] [--org <id>] [--json]
 
   --stage     cold, warm, qualified, customer, churned
   --source    goldfox, email, pixel, webhook, manual

package/dist/commands/crm/pagination.d.ts

@@ -0,0 +1,6 @@
+import { type Flags } from '../../helpers.js';
+import type { Exposes } from '../../exposes.js';
+export declare const EXPOSES: Exposes;
+export declare function rejectOffset(flags: Flags, usage: string): void;
+export declare function warnIfTruncated(returned: number, flags: Flags): void;
+export declare function countLine(returned: number, singular: string, plural: string): string;

package/dist/commands/crm/pagination.js

@@ -0,0 +1,60 @@
+// CRM search/list pagination — what the API actually does, verified against
+// production on 2026-07-27 (build c8b30009).
+//
+// Two facts, both discovered by lint-request-fields.js flagging that the SDK
+// sends an `offset` the OpenAPI schema does not declare:
+//
+//   1. `offset` is ACCEPTED AND IGNORED. Against an org with three contacts,
+//      {limit:1, offset:0}, {limit:1, offset:1} and {limit:1, offset:2} all
+//      return the same first contact. This holds for contacts and companies,
+//      on both the POST /search and GET /contacts paths. There is no cursor
+//      parameter either.
+//
+//   2. `total` is the SIZE OF THE PAGE, not the number of matches. With three
+//      contacts in the org: limit=1 → total=1, limit=2 → total=2, limit=3 →
+//      total=3, limit=10 → total=3.
+//
+// Together those make the result set silently lossy. An agent with 500
+// contacts running `--limit 100` receives 100 records and a `total` of 100,
+// and has no signal that 400 more exist. This is the worst shape a data bug
+// can take for an unattended caller: it looks like a complete answer.
+//
+// Filed upstream. Until it is fixed the CLI refuses `--offset` rather than
+// sending a parameter that does nothing, and never prints `total` as though
+// it were a match count.
+import { error, info } from '../../output.js';
+// A helper, not a command: it calls nothing. Declared empty rather than
+// exempted, so the coverage gate's "every module states its surface" rule
+// stays absolute.
+export const EXPOSES = [];
+// Server-side default page size when no --limit is given. The API applies
+// this; we only need it to know whether a result may have been truncated.
+const DEFAULT_LIMIT = 50;
+// Rejects --offset outright. Silently dropping it would reproduce the bug we
+// are protecting against, and passing it through means duplicate pages.
+export function rejectOffset(flags, usage) {
+    if (flags.offset === undefined)
+        return;
+    error('The CRM API accepts --offset and ignores it, so every page would return the same records.\n' +
+        'Verified against production: with --limit 1, offsets 0, 1 and 2 all return the first match.\n\n' +
+        'There is no cursor parameter either, so the CRM has no working pagination today.\n' +
+        'Raise --limit to fetch more in one call, and narrow the result set with filters\n' +
+        '(--stage, --source, --company-id, --email) rather than paging through it.\n\n' +
+        `Usage: ${usage}`);
+}
+// A page that came back exactly full is indistinguishable from a truncated
+// one, and `total` cannot tell them apart. Say so, rather than letting the
+// caller assume the answer is complete.
+export function warnIfTruncated(returned, flags) {
+    const limit = typeof flags.limit === 'number' ? flags.limit : DEFAULT_LIMIT;
+    if (returned < limit)
+        return;
+    info(`Note: exactly ${returned} record${returned === 1 ? '' : 's'} came back, which is the page limit. ` +
+        'There may be more, and the API reports no match count and offers no way to fetch the next page. ' +
+        'Raise --limit or add filters.');
+}
+// The API returns `total`, but it equals the page size, so rendering "N of
+// total" states something false. Callers use this instead.
+export function countLine(returned, singular, plural) {
+    return `${returned} ${returned === 1 ? singular : plural}`;
+}

package/dist/commands/crm/pagination.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/commands/crm/pagination.test.js

@@ -0,0 +1,73 @@
+// Regression cover for the CRM pagination guards.
+//
+// The bug being fenced off: the API accepts `offset`, ignores it, and reports
+// `total` as the page size — so an agent paging a contact list re-read page
+// one forever and had no signal that anything was missing. Verified against
+// production 2026-07-27. These tests assert the CLI never silently accepts
+// that flag again, and never claims a result is complete when it cannot know.
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { rejectOffset, warnIfTruncated, countLine } from './pagination.js';
+import * as output from '../../output.js';
+describe('rejectOffset', () => {
+    let errSpy;
+    beforeEach(() => {
+        // error() exits the process; make it throw so the test can catch it.
+        errSpy = vi.spyOn(output, 'error').mockImplementation(((msg) => {
+            throw new Error(msg);
+        }));
+    });
+    afterEach(() => errSpy.mockRestore());
+    it('passes through when --offset is absent', () => {
+        expect(() => rejectOffset({}, 'usage')).not.toThrow();
+    });
+    it('rejects --offset 0 — it is as broken as any other value', () => {
+        expect(() => rejectOffset({ offset: 0 }, 'usage')).toThrow(/ignores it/);
+    });
+    it('rejects a non-zero --offset', () => {
+        expect(() => rejectOffset({ offset: 25 }, 'usage')).toThrow(/ignores it/);
+    });
+    it('explains that no cursor exists either, so the user does not go looking', () => {
+        expect(() => rejectOffset({ offset: 1 }, 'usage')).toThrow(/no cursor parameter/);
+    });
+    it('includes the usage line so the error is actionable', () => {
+        expect(() => rejectOffset({ offset: 1 }, 'myapi crm contacts list [--limit N]'))
+            .toThrow(/myapi crm contacts list/);
+    });
+});
+describe('warnIfTruncated', () => {
+    let infoSpy;
+    beforeEach(() => { infoSpy = vi.spyOn(output, 'info').mockImplementation(() => { }); });
+    afterEach(() => infoSpy.mockRestore());
+    it('warns when the page came back exactly full', () => {
+        warnIfTruncated(10, { limit: 10 });
+        expect(infoSpy).toHaveBeenCalledWith(expect.stringContaining('page limit'));
+    });
+    it('stays quiet when the page came back short — that answer IS complete', () => {
+        warnIfTruncated(3, { limit: 10 });
+        expect(infoSpy).not.toHaveBeenCalled();
+    });
+    it('uses the server default of 50 when no --limit was given', () => {
+        warnIfTruncated(50, {});
+        expect(infoSpy).toHaveBeenCalledWith(expect.stringContaining('page limit'));
+    });
+    it('stays quiet below the default limit', () => {
+        warnIfTruncated(49, {});
+        expect(infoSpy).not.toHaveBeenCalled();
+    });
+    it('says a record, not "1 records"', () => {
+        warnIfTruncated(1, { limit: 1 });
+        expect(infoSpy).toHaveBeenCalledWith(expect.stringContaining('exactly 1 record came back'));
+    });
+});
+describe('countLine', () => {
+    // The point of this helper is what it does NOT print: `N of total`, where
+    // total is the page size, reads as "you have everything".
+    it('pluralizes', () => {
+        expect(countLine(1, 'contact', 'contacts')).toBe('1 contact');
+        expect(countLine(3, 'contact', 'contacts')).toBe('3 contacts');
+        expect(countLine(0, 'company', 'companies')).toBe('0 companies');
+    });
+    it('never mentions a total', () => {
+        expect(countLine(5, 'contact', 'contacts')).not.toMatch(/of/);
+    });
+});

package/dist/commands/doctor-findings.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/commands/doctor-findings.test.js

@@ -0,0 +1,100 @@
+// Regression cover for three doctor findings reported from a live production
+// org, where two of four warnings described healthy things as broken.
+//
+// The shared defect: the check reported a CONCLUSION ("customers may not be
+// able to reach this", "no email inbox configured") where it only had an
+// OBSERVATION ("it answered 401", "the platform's counter said zero"). Each
+// test below pins the observation and refuses the conclusion.
+import { describe, it, expect } from 'vitest';
+import { classifyReachability, _setupSection } from './doctor.js';
+const ENTITY = { slot: 'container', name: 'skout-engine-prod' };
+describe('classifyReachability', () => {
+    // The finding: two containers behind an auth boundary were reported as
+    // "customers may not be able to reach" them. Both were up. A 401 to an
+    // anonymous probe is the designed answer and proves liveness.
+    it('treats 401 as reachable, not as a warning', () => {
+        const v = classifyReachability({ status: 401 }, ENTITY);
+        expect(v.severity).toBe('ok');
+        expect(v.message).toMatch(/reachable, authentication required/);
+    });
+    it('treats 403 the same way', () => {
+        expect(classifyReachability({ status: 403 }, ENTITY).severity).toBe('ok');
+    });
+    it('never tells the user customers cannot reach a URL that answered', () => {
+        for (const status of [200, 301, 401, 403, 404, 418, 500, 503]) {
+            const v = classifyReachability({ status }, ENTITY);
+            expect(v.hint ?? '').not.toMatch(/may not be able to reach/);
+        }
+    });
+    // Only a probe that got no answer at all is unreachable. That is the one
+    // case where the old wording was right.
+    it('reports a network failure as unreachable, and says why', () => {
+        const v = classifyReachability({ status: null, error: 'ETIMEDOUT' }, ENTITY);
+        expect(v.severity).toBe('warn');
+        expect(v.message).toMatch(/unreachable/);
+        expect(v.hint).toBe('ETIMEDOUT');
+    });
+    it('falls back to a customer-facing hint when there is no error string', () => {
+        const v = classifyReachability({ status: null }, ENTITY);
+        expect(v.hint).toMatch(/nothing answered/);
+    });
+    // Still warns, but distinguishes "the host answered and served nothing"
+    // from "the host is down" — a different problem with a different fix.
+    it('warns on 404 while stating the host answered', () => {
+        const v = classifyReachability({ status: 404 }, ENTITY);
+        expect(v.severity).toBe('warn');
+        expect(v.message).toMatch(/reachable, but nothing is served/);
+    });
+    it('warns on 5xx as an application error, not an outage', () => {
+        const v = classifyReachability({ status: 503 }, ENTITY);
+        expect(v.severity).toBe('warn');
+        expect(v.message).toMatch(/the application is erroring/);
+        expect(v.hint).toMatch(/logs/);
+    });
+    it('handles an entity with no name without printing undefined', () => {
+        const v = classifyReachability({ status: null }, { slot: 'funnel' });
+        expect(v.hint ?? '').not.toMatch(/undefined/);
+    });
+});
+// ── setup gaps ──────────────────────────────────────────────────────────────
+function report(sections) {
+    return {
+        org_id: '11111111-1111-4111-8111-111111111111',
+        sections: sections.map(s => ({ name: '', summary: '', issues: [], ...s })),
+    };
+}
+const ZERO_EMAILS = report([{ name: 'emails', resource_count: 0, issues: [] }]);
+function setupMessages(r, ctx) {
+    return (_setupSection(r, ctx)?.issues ?? []).map(i => ({ message: i.message, hint: i.hint ?? '' }));
+}
+describe('setup gaps are confirmed before they become instructions', () => {
+    // The finding: the platform reported resource_count 0 for an org with two
+    // active mailboxes, one of which had received mail 14 hours earlier. The
+    // doctor turned that into "Create one with: myapi email mailbox create …".
+    it('does not tell you to create a mailbox when we counted some', () => {
+        const [issue] = setupMessages(ZERO_EMAILS, { mailboxCount: 2 });
+        expect(issue.message).toMatch(/but 2 are configured/);
+        expect(issue.hint).toMatch(/Do not create another/);
+        expect(issue.hint).not.toMatch(/mailbox create/);
+    });
+    it('still reports a real gap when our own count agrees', () => {
+        const [issue] = setupMessages(ZERO_EMAILS, { mailboxCount: 0 });
+        expect(issue.message).toBe('No email inbox configured');
+        expect(issue.hint).toMatch(/mailbox create/);
+    });
+    // A failed enumeration is not evidence of absence OR presence, so the
+    // backend's view stands rather than us inventing a disagreement.
+    it('defers to the platform when we could not count', () => {
+        const [issue] = setupMessages(ZERO_EMAILS, {});
+        expect(issue.message).toBe('No email inbox configured');
+    });
+    it('gets the singular right', () => {
+        const [issue] = setupMessages(ZERO_EMAILS, { mailboxCount: 1 });
+        expect(issue.message).toMatch(/but 1 is configured/);
+    });
+    it('applies the same rule to domains', () => {
+        const r = report([{ name: 'domains', resource_count: 0, issues: [] }]);
+        expect(setupMessages(r, { domainCount: 3 })[0].message).toMatch(/but 3 are configured/);
+        expect(setupMessages(r, { domainCount: 0 })[0].hint).toMatch(/domain register/);
+    });
+});

package/dist/commands/doctor.d.ts

@@ -14,6 +14,19 @@ export declare function _tallyTotals(sections: sdkHq.DoctorSection[]): DoctorTot
 export declare function sanitizeHint(hint: string | undefined): string | undefined;
 export interface SetupContext {
     mailingAddress?: string | null;
+    mailboxCount?: number;
+    domainCount?: number;
 }
 export declare function _setupSection(report: sdkHq.DoctorReport, ctx?: SetupContext): sdkHq.DoctorSection | null;
+export declare function classifyReachability(probe: {
+    status: number | null;
+    error?: string;
+}, entity: {
+    slot: string;
+    name?: string;
+}): {
+    severity: 'ok' | 'warn';
+    message: string;
+    hint?: string;
+};
 export declare function run(_subcommand: string | undefined, _args: string[], flags: Flags): Promise<void>;

package/dist/commands/doctor.js

@@ -17,7 +17,7 @@
 // interleave with the backend's findings.
 import { promises as dns } from 'node:dns';
 import { createHash } from 'node:crypto';
-import { hq as sdkHq, container as sdkContainer, funnel as sdkFunnel } from '@myapihq/sdk';
+import { hq as sdkHq, container as sdkContainer, funnel as sdkFunnel, domain as sdkDomain, email as sdkEmail } from '@myapihq/sdk';
 import { requireConfig } from '../config.js';
 import { info, error, printJson } from '../output.js';
 import { requireOrg } from '../helpers.js';
@@ -116,6 +116,32 @@ function isZeroState(section) {
         return section.resource_count === 0;
     return section.issues.length === 0;
 }
+// Emits the "you have not set this up" warning ONLY when our own count agrees
+// with the backend's. When we counted resources the backend says do not
+// exist, the disagreement replaces the advice — it is both true and more
+// useful, and it never sends anyone to recreate something that already
+// exists. When we did not count (`counted` undefined), the backend's view
+// stands, since a missing check is not evidence either way.
+function confirmedGap(o) {
+    if (typeof o.counted === 'number' && o.counted > 0) {
+        return {
+            id: localIssueId(`${o.idKey}_disagreement`, o.orgId),
+            severity: 'warn',
+            scope: o.scope,
+            category: 'setup',
+            message: `Platform reports no ${o.noun} for this org, but ${o.counted} ${o.counted === 1 ? 'is' : 'are'} configured`,
+            hint: `This is a reporting bug, not a setup gap — your ${o.noun}${o.counted === 1 ? '' : 'es'} ${o.counted === 1 ? 'is' : 'are'} fine. Do not create another.`,
+        };
+    }
+    return {
+        id: localIssueId(o.idKey, o.orgId),
+        severity: 'warn',
+        scope: o.scope,
+        category: 'setup',
+        message: o.absent,
+        hint: o.hint,
+    };
+}
 export function _setupSection(report, ctx = {}) {
     const byName = new Map();
     for (const s of report.sections)
@@ -123,25 +149,27 @@ export function _setupSection(report, ctx = {}) {
     const issues = [];
     const dom = byName.get('domains');
     if (dom && isZeroState(dom)) {
-        issues.push({
-            id: localIssueId('setup_no_domain', report.org_id),
-            severity: 'warn',
+        issues.push(confirmedGap({
+            orgId: report.org_id,
+            idKey: 'setup_no_domain',
             scope: 'setup/domain',
-            category: 'setup',
-            message: 'No domain registered for this org',
+            counted: ctx.domainCount,
+            noun: 'domain',
+            absent: 'No domain registered for this org',
             hint: 'Register one with: myapi domain register <domain> && myapi domain assign <domain>',
-        });
+        }));
     }
     const em = byName.get('emails');
     if (em && isZeroState(em)) {
-        issues.push({
-            id: localIssueId('setup_no_mailbox', report.org_id),
-            severity: 'warn',
+        issues.push(confirmedGap({
+            orgId: report.org_id,
+            idKey: 'setup_no_mailbox',
             scope: 'setup/email-inbox',
-            category: 'setup',
-            message: 'No email inbox configured',
+            counted: ctx.mailboxCount,
+            noun: 'email inbox',
+            absent: 'No email inbox configured',
             hint: 'Create one with: myapi email mailbox create <username>@<your-domain>',
-        });
+        }));
     }
     // Account-scoped (so use report.org_id only for the dedup id, not as
     // entity scope). Hard-gates every transactional `email send` —
@@ -253,17 +281,30 @@ async function httpProbeSection(apiKey, orgId) {
     }
     catch { /* augmentation is best-effort — skip the slot if enumeration fails */ }
     // Funnels: probe every published page URL.
+    //
+    // And probe the funnel's own subdomain when the page list comes back empty.
+    // A funnel serving a live site can report an empty inventory — verified
+    // 2026-07-28 on a funnel answering 200 with real content on both its
+    // subdomain and a bound custom domain while `GET .../pages` returned
+    // `{"pages":[]}`. Trusting that list meant the org's public landing page,
+    // the single most customer-visible URL it has, was silently dropped from
+    // the probe. A check that quietly narrows its own scope is worse than one
+    // that fails, so fall back rather than skip.
     try {
         const funnels = await sdkFunnel.listFunnels(apiKey, orgId);
         await Promise.all(funnels.map(async (f) => {
+            const name = f.name || f.id;
+            let pageUrls = [];
             try {
                 const pages = await sdkFunnel.listFunnelPages(apiKey, orgId, f.id);
-                for (const p of pages) {
-                    if (p.url)
-                        targets.push({ url: p.url, entity: { slot: 'funnel', id: f.id, name: f.name || f.id } });
-                }
+                pageUrls = pages.map(p => p.url).filter((u) => !!u);
+            }
+            catch { /* fall through to the subdomain */ }
+            if (pageUrls.length === 0 && f.subdomain_url)
+                pageUrls = [f.subdomain_url];
+            for (const url of pageUrls) {
+                targets.push({ url, entity: { slot: 'funnel', id: f.id, name } });
             }
-            catch { /* skip this funnel */ }
         }));
     }
     catch { /* skip the slot */ }
@@ -272,29 +313,84 @@ async function httpProbeSection(apiKey, orgId) {
     const issues = [];
     await Promise.all(targets.map(async ({ url, entity }) => {
         const probe = await fetchStatus(url);
-        // 2xx/3xx = reachable. 4xx, 5xx and network failures are all `warn`.
-        const ok = probe.status != null && probe.status < 400;
+        const verdict = classifyReachability(probe, entity);
         issues.push({
-            id: localIssueId(ok ? 'http_ok' : 'http_unreachable', `${entity.slot}/${entity.id}/${url}`),
-            severity: ok ? 'ok' : 'warn',
+            id: localIssueId(verdict.severity === 'ok' ? 'http_ok' : 'http_unreachable', `${entity.slot}/${entity.id}/${url}`),
+            severity: verdict.severity,
             scope: `local/${url}`,
             entity,
             category: 'network',
-            message: ok
-                ? `${url} responded ${probe.status}`
-                : `${url} ${probe.status != null ? `returned ${probe.status}` : 'is unreachable'}`,
-            hint: ok ? undefined : (probe.error || `customers may not be able to reach ${entity.slot} "${entity.name}"`),
+            message: `${url} ${verdict.message}`,
+            hint: verdict.hint,
         });
     }));
-    const warns = issues.filter(i => i.severity === 'warn').length;
+    // Only a probe that got NO response means unreachable. Everything else
+    // answered, so the summary must not call it unreachable — see
+    // classifyReachability.
+    const unreachable = issues.filter(i => i.severity === 'warn').length;
     return {
         name: 'reachability',
-        summary: warns
-            ? `${warns} of ${issues.length} URL${issues.length === 1 ? '' : 's'} unreachable`
+        summary: unreachable
+            ? `${unreachable} of ${issues.length} URL${issues.length === 1 ? '' : 's'} need attention`
             : `${issues.length} URL${issues.length === 1 ? '' : 's'} reachable`,
         issues,
     };
 }
+// What an HTTP status actually tells you about reachability.
+//
+// This check used to treat any status >= 400 as "unreachable" with the hint
+// "customers may not be able to reach <name>". A user ran it against a
+// healthy production org and got two such warnings, both for containers
+// behind an auth boundary that were answering 401 exactly as designed.
+//
+// The advice was backwards. A 401 is positive evidence: something answered,
+// and its auth boundary works. As they put it, if one of those URLs ever
+// answered 200 to an unauthenticated probe, THAT would be the emergency —
+// and the old check would have called it healthy.
+//
+// The cost of a false warning is not neutral. Two of them in one run teaches
+// the reader to skim past warnings, which is where the real ones live.
+//
+// So: reachability is about whether anything answered. Only a network
+// failure or timeout is unreachable. Statuses that answered but suggest a
+// problem are still reported — as what was observed, not as a conclusion
+// about customers.
+export function classifyReachability(probe, entity) {
+    const { status } = probe;
+    if (status == null) {
+        return {
+            severity: 'warn',
+            message: 'is unreachable',
+            hint: probe.error || `nothing answered — customers may not be able to reach ${entity.slot} "${entity.name ?? '(unnamed)'}"`,
+        };
+    }
+    // Answered and served.
+    if (status < 400)
+        return { severity: 'ok', message: `responded ${status}` };
+    // Answered and refused the anonymous probe. This is the designed behaviour
+    // of anything sitting behind auth, and it proves both liveness and that the
+    // boundary holds.
+    if (status === 401 || status === 403) {
+        return { severity: 'ok', message: `responded ${status} — reachable, authentication required` };
+    }
+    // Answered, but nothing is published at that path.
+    if (status === 404 || status === 410) {
+        return {
+            severity: 'warn',
+            message: `returned ${status} — reachable, but nothing is served at this URL`,
+            hint: `the host answers, so this is a routing or publish problem rather than an outage`,
+        };
+    }
+    if (status >= 500) {
+        return {
+            severity: 'warn',
+            message: `returned ${status} — reachable, but the application is erroring`,
+            hint: `check \`myapi ${entity.slot} logs\``,
+        };
+    }
+    // Any other 4xx: report the fact, draw no conclusion.
+    return { severity: 'warn', message: `returned ${status} — reachable` };
+}
 export async function run(_subcommand, _args, flags) {
     if (flags.help) {
         info(HELP);
@@ -330,7 +426,38 @@ export async function run(_subcommand, _args, flags) {
     catch {
         mailingAddress = undefined;
     }
-    const setup = _setupSection(report, { mailingAddress });
+    // Count mailboxes and domains ourselves before any "you have not set this
+    // up" advice goes out. Both are cheap list calls, and both are the
+    // difference between a true finding and an instruction to duplicate live
+    // infrastructure. `undefined` on failure means "not checked" — the backend
+    // view then stands, because a failed check is not evidence.
+    //
+    // Mailboxes are scoped per registered domain, so this walks the org's
+    // domains rather than asking for a bare list.
+    let mailboxCount;
+    let domainCount;
+    try {
+        // NOT filter:'all' — that is account-wide and spans every org, which
+        // would count another org's mailboxes against this one. The default
+        // filter is org-scoped, which is the only correct basis for a claim
+        // about "this org".
+        const domains = await sdkDomain.listDomains(apiKey, orgId);
+        domainCount = domains.length;
+        const perDomain = await Promise.all(domains.map(async (d) => {
+            try {
+                return (await sdkEmail.listMailboxes(apiKey, { domain: d.domain })).length;
+            }
+            catch {
+                return 0;
+            }
+        }));
+        mailboxCount = perDomain.reduce((a, b) => a + b, 0);
+    }
+    catch {
+        mailboxCount = undefined;
+        domainCount = undefined;
+    }
+    const setup = _setupSection(report, { mailingAddress, mailboxCount, domainCount });
     if (setup)
         report.sections.push(setup);
     const localSection = await dnsProbeSection(report);

package/dist/commands/pixel.js

@@ -86,7 +86,11 @@ export async function visits(flags) {
         to_url: v.to_url,
         ts: v.ts,
     })));
-    info(`Total: ${res.total} | Showing: ${res.limit} | Offset: ${res.offset}`);
+    // /visits returns only {visits, total} — it does NOT echo limit/offset the
+    // way /events and /interactions do, so this used to print
+    // "Showing: undefined | Offset: undefined". Report what the response
+    // actually carries.
+    info(`Total: ${res.total} | Showing: ${res.visits.length}`);
 }
 // Engagement events (open / click / page_visit / sent) — filterable by
 // campaign or by domain.

package/dist/exposes.test.js

@@ -13,6 +13,7 @@ const COMMAND_MODULES = [
     './commands/crm/index.js',
     './commands/crm/contacts.js',
     './commands/crm/companies.js',
+    './commands/crm/pagination.js',
     './commands/database.js',
     './commands/domain.js',
     './commands/email/index.js',

package/dist/sdk-container.test.js

@@ -124,6 +124,24 @@ describe('container.getContainerLogs', () => {
         fetchMock.mockResolvedValueOnce(ok([]));
         expect(await container.getContainerLogs(API_KEY, ORG_ID, C_ID)).toEqual([]);
     });
+    it('appends ?scope=all only for scope="all"', async () => {
+        fetchMock.mockResolvedValueOnce(ok([]));
+        await container.getContainerLogs(API_KEY, ORG_ID, C_ID, undefined, 'all');
+        expect(fetchMock.mock.calls[0][0]).toMatch(/\/logs\?scope=all$/);
+    });
+    // 'container' is the server default, so sending it explicitly would be
+    // noise — and an undeclared query param is the kind of thing that starts
+    // being validated later.
+    it('omits scope entirely for the default scope', async () => {
+        fetchMock.mockResolvedValueOnce(ok([]));
+        await container.getContainerLogs(API_KEY, ORG_ID, C_ID, undefined, 'container');
+        expect(fetchMock.mock.calls[0][0]).toMatch(/\/logs$/);
+    });
+    it('combines tail and scope', async () => {
+        fetchMock.mockResolvedValueOnce(ok([]));
+        await container.getContainerLogs(API_KEY, ORG_ID, C_ID, 500, 'all');
+        expect(fetchMock.mock.calls[0][0]).toMatch(/\/logs\?tail=500&scope=all$/);
+    });
 });
 describe('container.EXPOSES', () => {
     it('covers the 9 container endpoints', () => {

package/dist/sdk-envelope.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/sdk-envelope.test.js

@@ -0,0 +1,84 @@
+// Envelope tolerance in the SDK's response parser (packages/sdk/src/client.ts).
+//
+// Most of the platform answers {success, data, error, meta}. A few routes
+// answer 2xx with a bare object instead. Requiring `success` meant those
+// routes surfaced as a bare `unknown_error` while their data sat unread in the
+// response body — `pixel identity` and `pixel events` both shipped broken that
+// way, and the second was only found by calling it with real parameters.
+//
+// The rule these tests pin down: the HTTP STATUS decides success. When the
+// body carries no envelope, the body is the data. When it does carry one, the
+// envelope still wins, so a {success:false} 200 is still an error.
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { request, MyApiError } from '@myapihq/sdk';
+const API_KEY = 'myapi_test_abc';
+const URL = 'https://api.example.com/thing';
+let fetchMock;
+function res(body, status = 200) {
+    return new Response(typeof body === 'string' ? body : JSON.stringify(body), {
+        status,
+        headers: { 'content-type': 'application/json' },
+    });
+}
+beforeEach(() => {
+    fetchMock = vi.fn();
+    vi.stubGlobal('fetch', fetchMock);
+});
+afterEach(() => vi.unstubAllGlobals());
+describe('enveloped responses keep their existing behaviour', () => {
+    it('unwraps data', async () => {
+        fetchMock.mockResolvedValueOnce(res({ success: true, data: { id: 7 }, meta: {} }));
+        expect(await request('GET', URL, API_KEY)).toEqual({ id: 7 });
+    });
+    it('still throws on {success:false} even with a 200', async () => {
+        fetchMock.mockResolvedValueOnce(res({ success: false, error: { code: 'nope' } }));
+        await expect(request('GET', URL, API_KEY)).rejects.toThrow(MyApiError);
+    });
+    it('still throws on a non-2xx', async () => {
+        fetchMock.mockResolvedValueOnce(res({ success: false, error: { code: 'bad' } }, 400));
+        await expect(request('GET', URL, API_KEY)).rejects.toThrow(MyApiError);
+    });
+});
+describe('bare responses are treated as data', () => {
+    // The exact shape /pixel/orgs/{org}/events returns.
+    it('returns the whole body when there is no success key', async () => {
+        fetchMock.mockResolvedValueOnce(res({ events: [], limit: 1, offset: 0, total: 0 }));
+        expect(await request('GET', URL, API_KEY)).toEqual({ events: [], limit: 1, offset: 0, total: 0 });
+    });
+    it('does not mistake a bare body for a failure', async () => {
+        fetchMock.mockResolvedValueOnce(res({ pixel_id: 'abc', emails: [] }));
+        await expect(request('GET', URL, API_KEY)).resolves.toBeTruthy();
+    });
+    it('handles a bare array', async () => {
+        fetchMock.mockResolvedValueOnce(res([1, 2, 3]));
+        expect(await request('GET', URL, API_KEY)).toEqual([1, 2, 3]);
+    });
+    // A bare body on an ERROR status must still raise — the status is the
+    // authority, so tolerance must not swallow failures.
+    it('still throws when a bare body arrives with a non-2xx', async () => {
+        fetchMock.mockResolvedValueOnce(res({ message: 'nope' }, 500));
+        await expect(request('GET', URL, API_KEY)).rejects.toThrow(MyApiError);
+    });
+    // A field literally named `success` on a bare payload would be
+    // indistinguishable from an envelope. Documented as a known limit rather
+    // than silently mishandled: an un-enveloped body carrying success:false
+    // will be read as an error.
+    it('KNOWN LIMIT: a bare body with a success field is read as an envelope', async () => {
+        fetchMock.mockResolvedValueOnce(res({ success: false, name: 'a real record' }));
+        await expect(request('GET', URL, API_KEY)).rejects.toThrow(MyApiError);
+    });
+});
+describe('empty and edge bodies', () => {
+    it('204 stays null', async () => {
+        fetchMock.mockResolvedValueOnce(new Response(null, { status: 204 }));
+        expect(await request('DELETE', URL, API_KEY)).toBeNull();
+    });
+    it('an empty 200 body parses to an empty object, not an error', async () => {
+        fetchMock.mockResolvedValueOnce(new Response('', { status: 200, headers: { 'content-type': 'application/json' } }));
+        expect(await request('GET', URL, API_KEY)).toEqual({});
+    });
+    it('non-JSON still raises invalid_json_response', async () => {
+        fetchMock.mockResolvedValueOnce(new Response('<html>502</html>', { status: 200, headers: { 'content-type': 'text/html' } }));
+        await expect(request('GET', URL, API_KEY)).rejects.toThrow(/invalid_json_response/);
+    });
+});

package/dist/skills/my-container-api/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   Run containers on demand — long-running services, background workers, and scheduled jobs. The heavier-duty sibling of edge functions, for native deps and long execution.
 triggers: [container, cloud run, dynamic app, custom domain app, service, worker, scheduled job, deploy container, docker image]
-checksum: sha256-0bd2fdee306f944702faf18b0cbb5d976a2bdc39c1f940c037600b0c0f6a4691
+checksum: sha256-d25fff35df7bf67bebabb6cc228f322b108d8472035cbda70756d720b8db502d
 ---
 
 # MyContainerAPI
@@ -39,7 +39,7 @@ Get it right:
 | `myapi container deploy <id> <image-ref>` | Ship a pre-built image and go live (rotates the scoped key) |
 | `myapi container list` | List containers in your org |
 | `myapi container get <id>` | Inspect a container (status, URL, custom domain) |
-| `myapi container logs <id> [--tail <n>]` | Recent runtime logs, newest first |
+| `myapi container logs <id> [--tail <n>] [--scope all]` | Recent runtime logs, newest first (`--scope all` adds platform audit records) |
 | `myapi container domain <id> <domain>` | Bind a custom domain (`--remove` to unbind) |
 | `myapi container delete <id>` | Soft-delete and revoke its scoped API key |
 <!-- generated:end -->
@@ -67,10 +67,31 @@ myapi container domain <id> --remove
 ```
 <!-- llm:end -->
 
+## Runtime constraints
+
+These are properties of the platform, not of your code. Each one fails in a
+way that looks like an application bug.
+
+- **A `service` is stateless.** It scales to zero *and* up to `--max-instances`
+  (default 3). Each instance holds its own memory, so in-process state returns
+  wrong answers under concurrency instead of erroring. Put state in
+  `my-database-api`.
+- **`/healthz` never reaches your container** — the runtime intercepts it. Use
+  `/livez`, or any other path.
+- **Request bodies are capped at 32MB.**
+- **Any 5xx from your code is replaced by an edge HTML error page.** A JSON
+  error envelope will not reach the caller. Return a 4xx if the reason has to
+  survive.
+- **`--env`, `--cpu`, `--memory`, `--max-instances` and `--cron` are set at
+  `create` and cannot be changed by `deploy`.** Passing them to `deploy` does
+  nothing. Recreate the container to change them.
+
 ## Notes
 
 - The scoped API key is shown **once** at create, and again (rotated) on every deploy. Save it if your code needs it.
 - A `worker` is forced to ≥1 instance; a `service` scales to zero; only a `job` accepts `--cron`.
+- `logs --scope all` adds platform audit records. They are large JSON blobs on
+  the same stream and share the `--tail` budget, so raise `--tail` with it.
 - Custom domains need a deployed container **and** a MyAPI-registered parent domain — see `my-domain-api`.
 - Containers are for dynamic apps and native deps. For static sites use `my-funnel-api`; for edge functions use `my-function-api`.
 

package/dist/skills/my-crm-api/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   The canonical store of engaged contacts + companies for an org. Auto-ingests from inbound webhooks via a configurable dot-path. Fixed lifecycle_stage enum (cold | warm | qualified | customer | churned). Append-only event timeline with reserved kinds. Soft delete + restore. Promote-from-Goldfox closes the discovery → engagement loop.
 triggers: [crm, contact, company, lead, engagement, pipeline, lifecycle, qualified, customer, webhook ingest, promote]
-checksum: sha256-1e1e7a8c4674f7a109f5bb0b5e9f053e938d2ee36d56c6ce8a4276826f7d9609
+checksum: sha256-085cb990a292ba815d7c59a58fb25816d52bf33ad5019a7d90abf4123383a67c
 ---
 
 # MyCRMAPI
@@ -158,9 +158,14 @@ myapi crm contacts events <id> --kind webhook_received
 
 ## Notes
 
+- **No pagination. Do not build a paging loop.** The API ignores `offset`
+  (every page repeats page one), there is no cursor, and `total` is the page
+  size, not the match count. The CLI rejects `--offset` rather than lie. If
+  exactly `--limit` rows come back, assume more exist: raise `--limit` or
+  narrow with filters.
 - **Reserved event kinds — no custom events in v1.** If an agent needs custom state per contact, use `myapi database` keyed by contact id. The curated timeline stays the authoritative engagement record.
-- **Event payloads carry an `external_id`** — the backend's idempotency key, equal to the underlying action's natural id (`goldfox_person_id` for `promoted`, `delivery_id` for `webhook_received`). Read the semantic field; `external_id` is a backend-internal duplicate. A legacy `message_id` on old rows holds the same value — safe to ignore.
-- **Email + Pixel auto-ingest not yet wired**. Only `webhook_received` events fire today. Email and pixel ingest are coming — the CLI surface stays unchanged when they land.
-- **Free in v1.** Metered later if usage shows a need.
+- **`external_id` on an event payload** is the backend's idempotency key — a duplicate of the action's natural id (`goldfox_person_id`, `delivery_id`). Read the semantic field instead; legacy `message_id` rows hold the same value.
+- **Only `webhook_received` fires today.** Email and pixel auto-ingest are coming; the CLI surface will not change.
+- **Free in v1.** Metered later if usage warrants.
 
 Run `myapi crm --help` or `myapi crm <namespace> --help` for inline reference.

package/dist/skills/my-storage-api/SKILL.md

@@ -2,9 +2,9 @@
 name: my-storage-api
 version: 1.0.0
 description: >
-  Edge-hosted asset storage. Upload local files (.png/.jpg/.gif/.webp) directly, or have the server fetch from a public URL. Each asset gets a stable public CDN URL.
+  Edge-hosted asset storage. Upload a local file of any content type directly, or have the server fetch from a public URL. Each asset gets a stable public CDN URL.
 triggers: [storage, upload, ingest, asset, cdn, image hosting, file upload, get-url, download, public url]
-checksum: sha256-80f78e83d086ec5e312abbb2fc7c85a2c9a87043a94b7e4fccc13902d5455df1
+checksum: sha256-b55e3f0aa592330cadfdc2b87e730333300bfffb08866b3bc59cb0ce15d2f953
 ---
 
 # MyStorageAPI
@@ -15,7 +15,25 @@ Per-org asset storage with edge CDN delivery. Two ways in: direct upload (local
 <!-- llm:start -->
 Storage is the asset layer. Anything you upload or ingest is served from the edge under a permanent public URL — embed it in funnel pages, email templates, anywhere.
 
-`upload` accepts `.png`, `.jpg`, `.jpeg`, `.gif`, `.webp`, `.svg`, `.pdf`, `.mp4`, `.webm` from the local filesystem. For any other extension, host the file somewhere public and use `ingest` instead — the server fetches it for you.
+`upload` accepts **any content type** from the local filesystem. There is no
+extension allowlist — an unrecognized type is stored as an opaque blob and
+served back as it was sent. Pass `--content-type` when the extension does not
+imply the type you want.
+
+Size caps depend on the detected type, not on the extension:
+
+| Detected type | Cap |
+|---|---|
+| Images (`jpeg`, `png`, `gif`, `webp`, `svg`) | 10MB |
+| Video (`mp4`, `webm`) | 200MB |
+| PDF and everything else | 25MB |
+
+Use `upload` (multipart) to get the full per-type cap. A raw-body upload is
+capped at 10MB regardless of type and is refused above it with
+`FILE_TOO_LARGE`.
+
+Use `ingest` when the file is already at a public URL and you would rather the
+server fetch it than upload it yourself — not because `upload` refuses the type.
 
 Generated images from **myimageapi** automatically land here; they appear in `storage list` under their job id.
 
@@ -27,7 +45,7 @@ Use `get` for a round-trip metadata fetch. Use `get-url` when you just need the
 | Command | What it does |
 |---|---|
 | `myapi storage list` | List all stored assets |
-| `myapi storage upload <file>` | Direct multipart upload of a local file (image/svg/pdf/mp4/webm) |
+| `myapi storage upload <file>` | Direct multipart upload of a local file (any content type) |
 | `myapi storage ingest <url>` | Server fetches a public URL into storage |
 | `myapi storage get <asset_id>` | Round-trip the API for full metadata (`--json` or human block) |
 | `myapi storage get-url <asset_id>` | Pure local URL constructor — no API call, no auth |
@@ -59,8 +77,8 @@ myapi storage delete <asset_id>
 
 ## Upload vs Ingest
 
-- **`upload`** — file is on your machine. Multipart POST. Supported extensions: `.png`, `.jpg`, `.jpeg`, `.gif`, `.webp`, `.svg`, `.pdf`, `.mp4`, `.webm`.
-- **`ingest`** — file is at a public HTTP(S) URL. Server downloads and stores. Useful for migrating assets, pulling in third-party files you have rights to, or for extensions `upload` doesn't accept.
+- **`upload`** — file is on your machine. Multipart POST. Any content type. The CLI infers `Content-Type` from the extension for the common ones; for anything else pass `--content-type` or accept `application/octet-stream`.
+- **`ingest`** — file is at a public HTTP(S) URL. Server downloads and stores. Useful for migrating assets or pulling in third-party files you have rights to.
 
 Both produce identical asset records — `list` doesn't distinguish.
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@myapihq/cli",
   "license": "Apache-2.0",
-  "version": "2.5.1",
+  "version": "2.6.1",
   "description": "MyAPI command-line interface",
   "repository": {
     "type": "git",
@@ -34,12 +34,13 @@
     "lint:changelog": "node ../../scripts/lint-changelog.js",
     "lint:help-order": "node scripts/lint-help-order.js",
     "lint:exposes": "node scripts/lint-exposes.js",
+    "lint:request-fields": "node scripts/lint-request-fields.js",
     "lint:docs": "node scripts/lint-docs.js",
     "lint:skills": "node scripts/copy-skills.js && node scripts/lint-skills.js",
     "lint:skills:strict": "node scripts/copy-skills.js && node scripts/lint-skills.js --strict"
   },
   "dependencies": {
-    "@myapihq/sdk": "^2.5.1"
+    "@myapihq/sdk": "^2.6.1"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",