pqcheck 0.7.6 → 0.7.7

package/README.md

@@ -185,7 +185,7 @@ curl -s "https://www.quantapact.com/api/scan?domain=stripe.com" | jq '.grade, .s
 
 Full API reference at [quantapact.com/api](https://quantapact.com/api).
 
-**Rate limit:** ~60 requests/minute per IP. No API key required. Returns HTTP 429 if exceeded — back off and retry.
+**Rate limits:** 300 scans per hour per IP, 20 `--fresh` (force-refresh) scans per hour per IP. No API key required. Returns HTTP 429 if exceeded — back off and retry, or [let us know via the feedback form](https://quantapact.com/feedback) if you need higher limits (we're prioritizing the API tier based on real demand).
 
 ## Methodology
 

package/bin/pqcheck.js

@@ -7,7 +7,7 @@
 // =============================================================================
 
 const API_BASE = process.env.PQCHECK_API_BASE || "https://quantapact.com";
-const VERSION = "0.7.6";
+const VERSION = "0.7.7";
 
 const ANSI = {
   reset:   "\x1b[0m",
@@ -107,20 +107,31 @@ async function main() {
     return; // runWatch handles its own exit; in practice it runs until killed.
   }
 
+  // --fresh: bypass server cache, force a fresh scan. Useful when verifying
+  // a cert/key change you just deployed. Subject to a 20/hr per-IP cap on
+  // the server side.
+  const fresh = args.includes("--fresh") || args.includes("--force");
+
   // One-shot scan(s)
   let worstExit = 0;
   for (const domain of domains) {
-    const exit = await runOneScan({ domain, format, quiet, threshold, webhookUrl, multi: domains.length > 1 });
+    const exit = await runOneScan({ domain, format, quiet, threshold, webhookUrl, multi: domains.length > 1, fresh });
     if (exit > worstExit) worstExit = exit;
   }
   process.exit(worstExit);
 }
 
-async function runOneScan({ domain, format, quiet, threshold, webhookUrl, multi }) {
-  if (!quiet && format === "text") process.stderr.write(color("dim", `Scanning ${domain} ...`));
+async function runOneScan({ domain, format, quiet, threshold, webhookUrl, multi, fresh }) {
+  if (!quiet && format === "text") process.stderr.write(color("dim", `Scanning ${domain}${fresh ? " (forcing fresh)" : ""} ...`));
   let report;
   try {
-    const resp = await fetch(`${API_BASE}/api/scan?domain=${encodeURIComponent(domain)}`, {
+    // --fresh appends ?force=1 to bypass the smart-cache. Use when verifying
+    // a cert/key change you just deployed — otherwise scans hit the 1h SWR
+    // cache and return up-to-1h-old data. Subject to a 20/hr per-IP cap on
+    // the server side; if exceeded, the server silently downgrades to a
+    // cached scan and returns that instead of erroring.
+    const qs = fresh ? `?domain=${encodeURIComponent(domain)}&force=1` : `?domain=${encodeURIComponent(domain)}`;
+    const resp = await fetch(`${API_BASE}/api/scan${qs}`, {
       method: "GET",
       headers: { accept: "application/json", "user-agent": `pqcheck-cli/${VERSION} (scan)` },
     });
@@ -129,6 +140,12 @@ async function runOneScan({ domain, format, quiet, threshold, webhookUrl, multi
       const errBody = await safeJSON(resp);
       console.error(color("red", `error scanning ${domain}: ${resp.status} ${errBody?.error || resp.statusText}`));
       if (errBody?.detail) console.error(color("dim", errBody.detail));
+      // Surface the 429 upsell hint if present — tells users how to ask for
+      // higher limits via the feedback form. Same demand signal we capture
+      // on the homepage.
+      if (resp.status === 429 && errBody?.need_more?.feedback_url) {
+        console.error(color("dim", `${errBody.need_more.message} → ${errBody.need_more.feedback_url}`));
+      }
       return 1;
     }
     report = await resp.json();
@@ -547,6 +564,7 @@ ${color("bold", "Common flags:")}
   -q, --quiet                      Print only the numeric score
   --watch [seconds]                Poll every N seconds (default 300) and report changes
   --webhook <url>                  POST scan results to a URL (one-shot or each watch tick)
+  --fresh                          Bypass server cache, force a fresh scan (subject to 20/hr per-IP cap)
 
 ${color("bold", "Subcommand-specific:")}
   pqcheck deps:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pqcheck",
-  "version": "0.7.6",
+  "version": "0.7.7",
   "description": "Decryption Blast Radius scanner — find out how much of your data unlocks when quantum decryption arrives.",
   "keywords": [
     "post-quantum",