requestshield 0.1.4 → 0.1.5

package/README.md

@@ -4,7 +4,7 @@ Customer-facing CLI for IntelliFend RequestShield. It allows customers to sign
 in, rotate application credentials, install the RequestShield Skill for Codex
 or Claude, and update an npm-installed CLI.
 
-Current package version: `0.1.4`.
+Current package version: `0.1.5`.
 
 ## Requirements
 
@@ -20,6 +20,11 @@ The management API defaults to `https://api.intellifend.ai`. Set
 ```console
 requestshield signin
 requestshield keys create [--yes]
+requestshield contract
+requestshield apps list [--json]
+requestshield apps get <app-key>
+requestshield challenge volume <app-key> [--from <time>] [--to <time>] [--granularity <value>]
+requestshield get billing <app-key>
 requestshield agent setup [--force]
 requestshield agent setup --codex [--force]
 requestshield agent setup --claude [--force]
@@ -57,6 +62,75 @@ the previous credentials and create a new `appKey` and `apiSecret`.
 
 Store the Secret Key in a backend secret manager immediately after creation.
 
+### Get the integration contract
+
+```console
+requestshield contract
+```
+
+Returns the current authoritative integration contract as JSON, including any
+additional SDK-version or CSP fields supplied by the API. The command requires a
+saved sign-in session and validates the core browser, backend, and release fields
+before printing the response.
+
+### List applications
+
+```console
+requestshield apps list
+```
+
+Lists the applications the signed-in user is allowed to access:
+
+```text
+APP KEY  NAME                STATUS
+app_123  Production Website  pending
+app_456  Staging Website     active
+```
+
+Use `--json` to print the stable `{ "data": [...], "nextCursor": null }`
+response shape. The CLI allowlists `appKey`, `name`, `status`, `createdAt`, and
+`updatedAt`; it never prints an API Secret returned accidentally by the service.
+
+### Get an application
+
+```console
+requestshield apps get app_123
+```
+
+Returns `app_key`, `name`, and the application's current status as JSON.
+Valid statuses are:
+
+- `ready` — the application key was just created and no traffic has been received.
+- `active` — the application is receiving traffic.
+- `deactivated` — the application has been deactivated.
+
+The requested App Key must exactly match the key in the API response.
+
+### Get challenge volume
+
+```console
+requestshield challenge volume app_123 \
+  --from 2026-08-01T00:00:00Z \
+  --to 2026-08-27T23:59:59Z \
+  --granularity day
+```
+
+Returns challenge/request volume as JSON. Times must be ISO-8601 timestamps, and
+`--from` cannot be later than `--to`. Granularity values such as `hour` and `day`
+are passed to the API, which owns the supported set.
+
+Challenge volume proves that traffic reached the platform; it does not prove
+that the protected backend rejects requests without a valid token.
+
+### Get billing information
+
+```console
+requestshield get billing app_123
+```
+
+Returns the selected application's current plan, billing cycle, charges, quota,
+and usage as JSON. The command is read-only and requires a saved sign-in session.
+
 ### Install the Agent Skill
 
 Let the CLI detect the installed coding agent:
@@ -95,8 +169,9 @@ Restart the selected agent or start a new task after installation.
 requestshield update check
 ```
 
-Checks the npm registry for the latest `requestshield` version. When a newer
-version exists, the CLI displays the current and latest versions and asks:
+Checks the npm registry for the latest `@intellifend/requestshield` version.
+When a newer version exists, the CLI displays the current and latest versions
+and asks:
 
 ```text
 Update to RequestShield <version>? (y/N):
@@ -105,7 +180,7 @@ Update to RequestShield <version>? (y/N):
 Entering `y` runs the equivalent of:
 
 ```console
-npm install --global requestshield@<latest-version>
+npm install --global @intellifend/requestshield@<latest-version>
 ```
 
 This command requires an interactive terminal, Node.js, and npm. It updates a
@@ -116,7 +191,7 @@ global npm installation; it does not replace a standalone Windows executable.
 Install globally:
 
 ```console
-npm install --global requestshield
+npm install --global @intellifend/requestshield
 requestshield --help
 requestshield --version
 ```
@@ -124,14 +199,14 @@ requestshield --version
 Run a specific version without installing globally:
 
 ```console
-npx --yes requestshield@0.1.4 --help
-npx --yes requestshield@0.1.4 signin
+npx --yes --package=@intellifend/requestshield@0.1.5 requestshield --help
+npx --yes --package=@intellifend/requestshield@0.1.5 requestshield signin
 ```
 
 To invoke the update command through npx, include the package name:
 
 ```console
-npx --yes requestshield@0.1.4 update check
+npx --yes --package=@intellifend/requestshield@0.1.5 requestshield update check
 ```
 
 Do not run `npx update check`; npm interprets `update` as the name of a different
@@ -160,7 +235,7 @@ The manual update test mocks the registry and install operation, so it does not
 publish a package or change the installed version:
 
 ```powershell
-$env:REQUESTSHIELD_MOCK_LATEST_VERSION = "0.1.5"
+$env:REQUESTSHIELD_MOCK_LATEST_VERSION = "0.1.6"
 npm run test:update-check:manual
 Remove-Item Env:REQUESTSHIELD_MOCK_LATEST_VERSION
 ```
@@ -195,7 +270,7 @@ published version, merge the latest team changes, then choose a new version in
 `package.json` before publishing.
 
 ```console
-npm view requestshield version
+npm view @intellifend/requestshield version
 npm run lint
 npm run typecheck
 npm test
@@ -206,9 +281,9 @@ npm publish --access public
 Verify the published package:
 
 ```console
-npm view requestshield version
-npm dist-tag ls requestshield
-npx --yes requestshield@0.1.4 --version
+npm view @intellifend/requestshield version
+npm dist-tag ls @intellifend/requestshield
+npx --yes --package=@intellifend/requestshield@0.1.5 requestshield --version
 ```
 
 ## Management API contract
@@ -239,6 +314,129 @@ metadata.
 `POST /v1/cli/keys/rotate` with Bearer authentication and an empty JSON body.
 The response contains `appKey` and the one-time `apiSecret`.
 
+### List applications
+
+`GET /v1/applications` with Bearer authentication and no request body. The API must
+scope results to the authenticated user.
+
+```json
+{
+  "data": [
+    {
+      "appKey": "pk_AAAAAAAAAAAAAAAAAAAAAAAA",
+      "name": "Checkout",
+      "status": "pending",
+      "createdAt": "2026-09-11T00:00:00.000Z",
+      "updatedAt": "2026-09-11T00:00:00.000Z"
+    }
+  ],
+  "nextCursor": null
+}
+```
+
+Every application requires `appKey`, `name`, `status`, `createdAt`, and `updatedAt`.
+`nextCursor` must be a non-empty string or `null`. An account with no applications
+returns `200` with an empty `data` array. A missing or rejected session returns
+`401`. The response must never contain an API Secret.
+
+### Get an application
+
+`GET /v1/applications/{appKey}` with Bearer authentication and no request body.
+The path segment is URL-encoded by the CLI.
+
+```json
+{
+  "ok": true,
+  "data": {
+    "app_key": "app_123",
+    "name": "Website",
+    "status": "active"
+  }
+}
+```
+
+`status` must be `ready`, `active`, or `deactivated`. The response App Key must
+match the requested key. The CLI rebuilds the output from these three fields so
+unexpected response fields cannot be printed.
+
+### Get challenge volume
+
+`GET /v1/applications/{appKey}/challenge-volume` with Bearer authentication and
+optional `from`, `to`, and `granularity` query parameters.
+
+```json
+{
+  "ok": true,
+  "data": {
+    "app_key": "app_123",
+    "from": "2026-08-01T00:00:00Z",
+    "to": "2026-08-27T23:59:59Z",
+    "granularity": "day",
+    "challenge_count": 125430
+  }
+}
+```
+
+The CLI requires a matching App Key, valid ordered timestamps, a non-empty
+granularity, and a non-negative safe-integer `challenge_count`. It rebuilds the
+output from these fields so unexpected API fields cannot be printed.
+
+### Get billing information
+
+`GET /v1/applications/{appKey}/billing` with Bearer authentication and no
+request body.
+
+```json
+{
+  "ok": true,
+  "data": {
+    "plan": {
+      "tier": "pro",
+      "current_cycle": [
+        "2026-07-07T07:07:07",
+        "2027-07-07T07:07:07"
+      ],
+      "billing": 1080,
+      "next_charge": "2027-07-07T07:07:07"
+    },
+    "usage": {
+      "monthly_quota": 100000,
+      "current_usage": 110000,
+      "overage_charge": 10
+    }
+  }
+}
+```
+
+The CLI validates all documented fields and rebuilds the nested result so
+unexpected response fields cannot be printed.
+
+### Get the integration contract
+
+`GET /v1/integration-contract` with Bearer authentication and no request body.
+
+```json
+{
+  "ok": true,
+  "data": {
+    "contract_version": "2026-08-27",
+    "browser": {
+      "script_url": "https://intellifend.ai/intellifend.js",
+      "token_header": "X-IntelliFend-Token",
+      "available_modes": ["manual"]
+    },
+    "backend": {
+      "supported_languages": ["java"],
+      "min_jdk": 17
+    },
+    "release_state": "released"
+  }
+}
+```
+
+The CLI requires these core fields and preserves additional authoritative
+contract fields returned by the API. Credential-shaped fields are rejected.
+
 ## Security notes
 
 - Never place an access token or Secret Key in URLs, command arguments, logs,

package/package.json

@@ -1,11 +1,14 @@
 {
   "name": "requestshield",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "description": "Customer CLI for IntelliFend RequestShield.",
   "type": "module",
   "bin": {
     "requestshield": "src/main.mjs"
   },
+  "publishConfig": {
+    "access": "public"
+  },
   "files": [
     "src/",
     "skills/",
@@ -14,18 +17,21 @@
   "engines": {
     "node": ">=22.13"
   },
+  "scripts": {
+    "build": "node scripts/check-package.mjs",
+    "lint": "node scripts/check-package.mjs",
+    "test": "node --test",
+    "test:update-check:manual": "node scripts/manual-update-check.mjs",
+    "typecheck": "tsc -p jsconfig.json --noEmit",
+    "prepack": "node scripts/package-skill.mjs stage",
+    "postpack": "node scripts/package-skill.mjs clean",
+    "prepublishOnly": "npm run lint && npm run typecheck && npm test"
+  },
   "devDependencies": {
     "@types/node": "26.1.1",
     "esbuild": "^0.28.1",
     "postject": "1.0.0-alpha.6",
     "typescript": "^6.0.3"
   },
-  "license": "UNLICENSED",
-  "scripts": {
-    "build": "node scripts/check-package.mjs",
-    "lint": "node scripts/check-package.mjs",
-    "test": "node --test",
-    "test:update-check:manual": "node scripts/manual-update-check.mjs",
-    "typecheck": "tsc -p jsconfig.json --noEmit"
-  }
-}
+  "license": "UNLICENSED"
+}