requestshield 0.1.6 → 0.1.8

package/README.md

@@ -1,15 +1,16 @@
 # RequestShield CLI
 
 Customer-facing CLI for IntelliFend RequestShield. It allows customers to sign
-in, manage applications and their credentials, install the RequestShield Skill
+in, inspect public SDK integration metadata, manage applications and their credentials, install the RequestShield Skill
 for Codex or Claude, and update an npm-installed CLI.
 
-Current package version: `0.1.6`.
+Current package version: `0.1.5`.
 
 ## Requirements
 
 - Node.js 22.13 or newer.
-- A RequestShield customer management API.
+- A RequestShield customer management API for application/secret commands and a
+  public customer-docs host for `contract`.
 - npm for local development and publishing.
 
 The public npm package installs only `requestshield`, using production
@@ -31,58 +32,157 @@ runners, not packages fetched from the registry. From the parent
 and may search dependencies or the registry instead.
 
 Each runner reads its package-relative file directly with Node.js `parseEnv`.
-It does not load a `.env` from the current working directory or read OAuth/API
+It does not load a `.env` from the current working directory or read OAuth/API/docs
 settings from `process.env`. Shell variables cannot switch the selected profile
 or override its configuration. Missing STG/PROD values fail explicitly and never
 fall back to QAT.
 
 These files contain only public product settings: `OAUTH_ISSUER`,
-`OAUTH_CLIENT_ID`, `API_URL` and optional `OAUTH_AUTHORIZATION_ISSUER`. They must never contain
+`OAUTH_CLIENT_ID`, `API_URL`, `DOCS_URL` and optional `OAUTH_AUTHORIZATION_ISSUER`. They must never contain
 access tokens, refresh tokens, client secrets or application API secrets. Release
 maintainers must populate the production public settings before publishing a
 working production sign-in flow. The npm package includes only `.env.prod`;
 QAT/STG files and the private development package are excluded.
 
-## Implemented commands
+## Command reference
 
 Examples use the production command. From `requestshield-cli/`, substitute
 `npx --offline --prefix ./dev requestshield-qat` or `requestshield-stg` for local
 QAT/STG runs. Plain `npx requestshield-qat` requires `requestshield-cli/dev/`.
 
+General commands such as `login`, `logout` and `contract` run at the top level.
+Resource commands use groups with positional names and App Keys. All result
+commands support `--json`; help and version remain text. Group names alone show
+their help, and `requestshield app create --help` shows command-specific help
+without configuration, authentication or network access.
+The catalog contains 23 entrypoints: 19 implemented commands and four placeholders.
+
+| Command after `requestshield` | Availability | Purpose |
+| --- | --- | --- |
+| `--help`, `-h` | Implemented | Show all commands. |
+| `--version`, `-v` | Implemented | Show the CLI version. |
+| `login [--no-open]` | Implemented | Sign in through the browser. |
+| `logout` | Implemented | Delete the selected local session. |
+| `auth status` | Implemented | Inspect local session metadata. |
+| `app create <name>` | Implemented | Create an app and its initial secret. |
+| `app list` | Implemented | List applications. |
+| `app get <app-key>` | Implemented | Inspect application metadata. |
+| `app rename <app-key> <name>` | Implemented | Rename an application. |
+| `app enable <app-key>` | Implemented | Enable an application. |
+| `app disable <app-key>` | Implemented | Disable an application, retaining its secret. |
+| `secret rotate <app-key>` | Implemented | Replace the current secret. |
+| `secret reveal <app-key>` | Implemented | Retrieve the current secret. |
+| `secret revoke <app-key>` | Implemented | Revoke the current secret. |
+| `agent setup [--codex \| --claude] [--force]` | Implemented | Install agent guidance. |
+| `agent status [--codex \| --claude]` | Implemented | Inspect installed Skill files. |
+| `update check` | Implemented | Check for a newer CLI. |
+| `update apply [--yes]` | Implemented | Install an available update globally. |
+| `contract` | Implemented | Read the public SDK integration manifest. |
+| `service status` | [coming soon] | Service health. |
+| `secret status <app-key>` | [coming soon] | Secret-status metadata. |
+| `usage challenges <app-key>` | [coming soon] | Challenge usage. |
+| `billing get <app-key>` | [coming soon] | Application plan and billing. |
+
+`app list` accepts `--limit <1-100>`, `--cursor <cursor>` or `--all`.
+Create, rename, enable, disable, rotate and revoke accept
+`--idempotency-key <key>`. Disable, rotate, reveal and revoke accept `--yes`.
+The usage placeholder accepts `--from <time>`, `--to <time>` and
+`--granularity <hour|day>`.
+
+The four `[coming soon]` commands validate syntax, then return
+`COMMAND_UNAVAILABLE` with exit code `2` before configuration, authentication,
+network access or filesystem changes. They never produce sample success data.
+Secret status does not infer credentials from app status or retrieve a secret.
+`doctor` and `app get --watch` are not supported.
+
+### Migrating command names and output
+
+Legacy aliases are removed: `signin`, `signout`, `apps`, `keys`, `secrets`,
+`auth login/logout`, `server` and `get billing` are not executable commands.
+Use `login`, `logout`, `app` and `secret` with the spellings above. Create and
+rename take positional names; `--app-name` and `--name` are not supported.
+Use the top-level `contract` command; `contract get` is rejected without an alias.
+
+Human-readable output is the default. Add `--json` to scripts, including those
+that previously parsed detail or rename without it. JSON stdout contains one
+document; progress, prompts, idempotency keys, warnings and npm output use stderr.
+Existing auth-status JSON and app/list/detail/rename shapes are preserved;
+new result shapes use `{data: ...}` and errors use `{error: {code, message}}`.
+`--json` does not grant confirmation: provide `--yes` for commands requiring it.
+
+### Read the public integration contract
+
 ```console
-requestshield signin [--no-open]
-requestshield auth status [--json]
-requestshield signout
-requestshield keys create --app-name <name> [--idempotency-key <key>]
-requestshield keys rotate <app-key> [--idempotency-key <key>] [--yes]
-requestshield keys reveal <app-key> [--yes]
-requestshield keys revoke <app-key> [--idempotency-key <key>] [--yes]
-requestshield apps list [--json] [--limit <1-100>] [--cursor <cursor> | --all]
-requestshield apps get <app-key>
-requestshield apps rename <app-key> --name <name> [--idempotency-key <key>]
-requestshield apps enable <app-key> [--idempotency-key <key>]
-requestshield apps disable <app-key> [--idempotency-key <key>] [--yes]
-requestshield agent setup [--codex | --claude] [--force]
-requestshield update check
-requestshield --help
-requestshield --version
+requestshield contract
+requestshield contract --json
 ```
 
-`contract`, `challenge volume` and `get billing` return `COMMAND_UNAVAILABLE`
-before configuration, authentication or network access. Their Management API
-endpoints are not implemented. `server` and `credentials status` are also absent
-from the supported command surface.
+This read-only command fetches `/integration-contract.json` from the selected
+profile's public `DOCS_URL`. It works without login, saved-session access or
+Management API requests. Missing OAuth/API settings do not prevent this command
+when the documentation configuration is valid. It sends no authorization header
+or cookies and writes no local files.
+Use `requestshield contract --help` for its options.
+
+| Profile | Configured `DOCS_URL` |
+| --- | --- |
+| PROD | `https://docs.intellifend.ai` |
+| QAT | `https://docs-qat.intellifend.ai` |
+| STG | `https://docs-stg.intellifend.ai` |
+
+The docs build selects immutable SDK release metadata for each environment.
+The manifest has a `{data: ...}` envelope with `schemaVersion: 1`, a
+`contractVersion`, the selected `environment`, and these sections:
+
+- `services`: the challenge service URL.
+- `browser`: SDK version, versioned script URL, SHA-384 Subresource Integrity
+  (`integrity`), token header, supported modes and `cspAdditions` for
+  `script-src`, `connect-src` and `worker-src`. Merge those additions into the
+  application's policy; they are not a complete CSP.
+- `backend`: Java SDK version, minimum JDK, Maven repository, core coordinates
+  and Spring Boot 3 MVC starter coordinates.
+- `documentation`: links to Browser SDK installation, Java SDK installation,
+  and domains/CSP guidance.
+
+Human output shows the metadata; `--json` preserves the validated envelope in
+one stdout document. The CLI rejects unsupported schemas, mismatched environments
+and invalid or oversized content. Publishing the manifest is a separate docs
+release; its contents do not prove that linked artifacts or services are reachable.
+
+| Failure | Error code | Exit |
+| --- | --- | --- |
+| Manifest URL returns HTTP 404 | `CONTRACT_NOT_PUBLISHED` | `1` |
+| Network failure, timeout or another unsuccessful HTTP response | `CONTRACT_FETCH_FAILED` | `1` |
+| Invalid, oversized or incompatible manifest | `CONTRACT_INVALID` | `1` |
+| Missing or invalid documentation configuration | `CONTRACT_CONFIG_INVALID` | `2` |
+
+`DOCS_URL` must use HTTPS without credentials, a query or a fragment; HTTP is
+allowed only on loopback for local testing. The CLI does not substitute another
+profile or a built-in manifest after failure.
+
+### Get started
+
+```console
+requestshield login
+requestshield app list
+requestshield agent setup --codex
+```
+
+Use the App Key of an existing app from the list, or explicitly create an app
+with `requestshield app create "Checkout API"`. Store its initial secret in your
+backend secret manager. Install agent guidance with `--codex` or `--claude` as
+needed; app creation and Skill installation are separate commands.
 
 ### Sign in
 
 ```console
-requestshield signin
+requestshield login
 ```
 
 Opens the configured login portal in your browser using Authorization Code with
 S256 PKCE. Sign in, verify your email if needed, then approve the displayed
 permissions. The browser must run on the same machine as the CLI. Use
-`requestshield signin --no-open` to open the printed authorization URL yourself.
+`requestshield login --no-open` to open the printed authorization URL yourself.
 If automatic browser opening fails, the CLI also prints that URL.
 
 The CLI listens only on `127.0.0.1` at a dynamically allocated port and waits up
@@ -144,7 +244,7 @@ implemented.
 
 ```console
 requestshield auth status --json
-requestshield signout
+requestshield logout
 ```
 
 Status reads only the selected profile's saved session. It never refreshes,
@@ -160,15 +260,15 @@ revoke the provider grant, sign out the browser or remove another profile's sess
 ### Applications and credentials
 
 ```console
-requestshield keys create --app-name "Checkout"
-requestshield apps list --json --all
-requestshield apps get <app-key>
-requestshield apps rename <app-key> --name "Checkout API"
-requestshield apps disable <app-key>
-requestshield apps enable <app-key>
-requestshield keys rotate <app-key>
-requestshield keys reveal <app-key>
-requestshield keys revoke <app-key>
+requestshield app create "Checkout"
+requestshield app list --json --all
+requestshield app get <app-key>
+requestshield app rename <app-key> "Checkout API"
+requestshield app disable <app-key>
+requestshield app enable <app-key>
+requestshield secret rotate <app-key>
+requestshield secret reveal <app-key>
+requestshield secret revoke <app-key>
 ```
 
 Create makes a new application and initial secret. Rotate replaces the current
@@ -191,7 +291,7 @@ For an uncertain result, repeat the **identical command and arguments with the
 same key printed in the error**, within seven days of the original attempt.
 A new key starts a new operation. After seven days, inspect the application before
 acting. Create/rotate replay returns `apiSecret: null`; the CLI suggests explicit
-`keys reveal` and never reveals or rotates automatically.
+`secret reveal` and never reveals or rotates automatically.
 
 Enable, disable and revoke return HTTP `202` acceptance. Publication is
 asynchronous; acceptance and an `enabled` status do not prove global propagation.
@@ -202,8 +302,8 @@ List defaults to one page. `--limit` accepts 1–100; `--cursor` continues a pre
 page. `--all` traverses at most 100 pages and rejects repeated cursors or an
 unfinished traversal at that bound. It cannot be combined with `--cursor`.
 
-`apps list --json` returns `{ "data": [...], "nextCursor": null }` (or a cursor
-for an incomplete single-page listing). `apps get` and rename return
+`app list --json` returns `{ "data": [...], "nextCursor": null }` (or a cursor
+for an incomplete single-page listing). `app get --json` and rename with `--json` return
 `{ "data": { ... } }`. Application objects have exactly `appKey`, `name`,
 `status`, `createdAt` and `updatedAt`; unexpected fields and secrets are not printed.
 
@@ -253,15 +353,22 @@ packages use their bundled skill. Repository runners resolve the canonical
 `../skills/requestshield` using source-checkout markers; they do not depend on
 the working directory or require a staged packaging copy.
 
+`requestshield agent status` inspects both agents' Skill files. Select only one
+with `--codex` or `--claude`; add `--json` for automation. It reports `installed`,
+`missing` or `invalid`, without installing anything or asserting that the agent
+has loaded the Skill.
+
 ### Check for updates
 
 ```console
 requestshield update check
+requestshield update apply
+requestshield update apply --yes --json
 ```
 
-Checks the npm registry for the latest `requestshield` version.
-When a newer version exists, the CLI displays the current and latest versions
-and asks:
+`update check` checks the npm registry for the latest `@intellifend/requestshield`
+version and never prompts or installs. `update apply` checks the version and,
+when a newer version exists, asks before installing that exact version:
 
 ```text
 Install RequestShield <version> globally with npm? (y/N):
@@ -270,12 +377,13 @@ Install RequestShield <version> globally with npm? (y/N):
 Entering `y` runs the equivalent of:
 
 ```console
-npm install --global requestshield@<latest-version>
+npm install --global @intellifend/requestshield@<latest-version>
 ```
 
-This command requires an interactive terminal, Node.js, and npm. It updates a
+Use `--yes` to explicitly confirm in a script, including with `--json`.
+Applying an update requires Node.js and npm. It updates a
 global npm installation. Repository checkouts and pinned `npx` invocations are
-managed separately. QAT/STG `update check` prints local Git/source guidance and
+managed separately. QAT/STG `update check` and `update apply` print local Git/source guidance and
 returns without querying the registry, prompting or installing anything.
 
 ## Install with npm
@@ -283,7 +391,7 @@ returns without querying the registry, prompting or installing anything.
 Install globally:
 
 ```console
-npm install --global requestshield
+npm install --global @intellifend/requestshield
 requestshield --help
 requestshield --version
 ```
@@ -296,14 +404,14 @@ versions already published.
 Run a specific version without installing globally:
 
 ```console
-npx --yes --package=requestshield@0.1.6 requestshield --help
-npx --yes --package=requestshield@0.1.6 requestshield signin
+npx --yes --package=@intellifend/requestshield@0.1.5 requestshield --help
+npx --yes --package=@intellifend/requestshield@0.1.5 requestshield login
 ```
 
 To invoke the update command through npx, include the package name:
 
 ```console
-npx --yes --package=requestshield@0.1.6 requestshield update check
+npx --yes --package=@intellifend/requestshield@0.1.5 requestshield update check
 ```
 
 Do not run `npx update check`; npm interprets `update` as the name of a different
@@ -361,6 +469,7 @@ OAUTH_ISSUER=https://identity.example.com
 OAUTH_AUTHORIZATION_ISSUER=
 OAUTH_CLIENT_ID=public-client-id
 API_URL=https://management.example.com
+DOCS_URL=https://docs.example.com
 ```
 
 Do not put credentials in these files. Session storage remains private and
@@ -392,14 +501,14 @@ From the repository root:
 
 ```console
 cd requestshield-cli
-npx --offline --prefix ./dev requestshield-qat signin
-npx --offline --prefix ./dev requestshield-qat apps list --json
+npx --offline --prefix ./dev requestshield-qat login
+npx --offline --prefix ./dev requestshield-qat app list --json
 ```
 
 The prefix selects the local private package; do not omit it from this directory.
 Alternatively, from `requestshield-cli/`, run
-`npm run requestshield-qat -- signin` and
-`npm run requestshield-qat -- apps list --json`.
+`npm run requestshield-qat -- login` and
+`npm run requestshield-qat -- app list --json`.
 
 The private developer package and its runners are excluded from the public npm
 package. Old `REQUESTSHIELD_OAUTH_*`, `REQUESTSHIELD_API_URL` and
@@ -436,7 +545,7 @@ Source changes do not configure the provider or deploy the portal.
 See the [Stytch CLI guide](https://stytch.com/docs/connected-apps/guides/cli-agents)
 and [refresh contract](https://stytch.com/docs/api-reference/consumer/api/connected-apps/exchange-refresh-token).
 
-Acceptance requires a real browser sign-in, then `apps list --json` accepted by
+Acceptance requires a real browser sign-in, then `app list --json` accepted by
 QAT. Wait until the access token expires and repeat the command to verify refresh.
 An account with no apps should return an empty list; do not create an app just
 for this test. Local mock checks do not establish provider or deployed API acceptance.
@@ -454,7 +563,7 @@ The manual update test mocks the registry and install operation, so it does not
 publish a package or change the installed version:
 
 ```console
-npm run test:update-check:manual -- 0.1.6
+npm run test:update-check:manual -- 0.1.6 apply
 ```
 
 After entering `y`, the test prints `[MOCK] Would install ...`.
@@ -496,7 +605,7 @@ npm pack ./build --dry-run
 npm pack ./build --pack-destination ./build
 ```
 
-The latter writes `build/requestshield-<version>.tgz`. Archives are
+The latter writes `build/intellifend-requestshield-<version>.tgz`. Archives are
 generated artifacts, ignored by Git, and are not required in source control or
 before publishing. The package listing should contain `src/main.mjs`,
 `config/.env.prod` and the complete Skill, with no QAT/STG configuration or
@@ -534,7 +643,7 @@ root and publish from this source package. Store a `.tgz` as a CI artifact only
 when the release workflow needs a separately retained archive.
 
 ```console
-npm view requestshield version
+npm view @intellifend/requestshield version
 npm run check
 npm pack --dry-run
 npm publish --access public
@@ -543,9 +652,9 @@ npm publish --access public
 Verify the published package:
 
 ```console
-npm view requestshield version
-npm dist-tag ls requestshield
-npx --yes --package=requestshield@0.1.6 requestshield --version
+npm view @intellifend/requestshield version
+npm dist-tag ls @intellifend/requestshield
+npx --yes --package=@intellifend/requestshield@0.1.5 requestshield --version
 ```
 
 ## Management API contract
@@ -556,12 +665,12 @@ operations are covered by the CLI-to-router contract gate.
 
 | CLI command | Method and path |
 | --- | --- |
-| `keys create --app-name <name>` | `POST /v1/applications` with `{name}` |
-| `apps list` | `GET /v1/applications` with optional `limit` and `cursor` |
-| `apps get <app-key>` | `GET /v1/applications/{appKey}` |
-| `apps rename <app-key> --name <name>` | `PATCH /v1/applications/{appKey}` with `{name}` |
-| `apps enable` / `apps disable` | Bodyless `POST /v1/applications/{appKey}/enable` or `/disable` |
-| `keys rotate` / `keys revoke` / `keys reveal` | Bodyless `POST /v1/applications/{appKey}/secret/rotate`, `/revoke` or `/reveal` |
+| `app create <name>` | `POST /v1/applications` with `{name}` |
+| `app list` | `GET /v1/applications` with optional `limit` and `cursor` |
+| `app get <app-key>` | `GET /v1/applications/{appKey}` |
+| `app rename <app-key> <name>` | `PATCH /v1/applications/{appKey}` with `{name}` |
+| `app enable` / `app disable` | Bodyless `POST /v1/applications/{appKey}/enable` or `/disable` |
+| `secret rotate` / `secret revoke` / `secret reveal` | Bodyless `POST /v1/applications/{appKey}/secret/rotate`, `/revoke` or `/reveal` |
 
 Create and rotate return `{appKey,status,apiSecret}`; a matching replay has a
 null secret. Reveal returns `{apiSecret}` and is not replayed. Application detail

package/config/.env.prod

@@ -1,5 +1,6 @@
 # Public production settings shipped in the npm package. Never add secrets.
 API_URL=https://api.intellifend.ai
+DOCS_URL=https://docs.intellifend.ai
 # Fill in the production Connected App values before releasing sign-in.
 OAUTH_ISSUER=
 # Optional callback iss pin; blank uses OAUTH_ISSUER.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "requestshield",
-  "version": "0.1.6",
+  "version": "0.1.8",
   "description": "Customer CLI for IntelliFend RequestShield.",
   "type": "module",
   "bin": {

package/skills/requestshield/SKILL.md

@@ -32,11 +32,13 @@ requestshield auth status --json # local session metadata, no provider check
 
 
 If `requestshield --version` fails, explain that CLI account/app operations need
-an installed compatible version. Do not substitute invented HTTP calls. SDK URLs,
-headers, modes and backend requirements come from the customer documentation for
-the chosen SDK release; the integration-contract CLI command is unavailable.
+an installed compatible version. Do not substitute invented HTTP calls. Use
+`requestshield contract --json` for the selected environment's release manifest
+and follow its documentation links. This public read needs no login. It returns
+SDK URLs, integrity, modes, CSP additions and Java/Maven requirements; see
+`references/cli.md` for failure handling and output fields.
 
-If local status is `signed_out`, ask the user to complete `requestshield signin`
+If local status is `signed_out`, ask the user to complete `requestshield login`
 themselves. Never ask for credentials. `valid` is a local state only; an expired
 session may refresh during the next authenticated command.
 
@@ -50,16 +52,17 @@ single CLI call or a short answer. Match on what the user wants, not on exact wo
 
 | Intent | Sounds like | Do this |
 | --- | --- | --- |
-| **General info** | "what version", "is there a newer CLI", "am I up to date" | Use `requestshield --version`. For an explicitly requested update check, explain that production `update check` can offer a global npm installation; accept it only within the user’s requested scope. |
-| **Authentication** | "sign me in", or preflight `auth status` came back unauthenticated | Ask the user to run `requestshield signin` in their own terminal, and wait. It is interactive — never automate it, never run it for them, never ask for credentials. Re-run `auth status` once they confirm. |
+| **General info** | "what version", "is there a newer CLI", "am I up to date" | Use `requestshield --version`. Use `requestshield update check` for a read-only version check. Only `update apply` installs globally, with confirmation or `--yes`, when the user requests an update. |
+| **Integration contract** | "which SDK", "SDK URL", "integration manifest" | Run `requestshield contract --json` without login. Use the returned release metadata and documentation links; it reports no account or service-health information. |
+| **Authentication** | "sign me in", or preflight `auth status` came back unauthenticated | Ask the user to run `requestshield login` in their own terminal, and wait. It is interactive — never automate it, never run it for them, never ask for credentials. Re-run `auth status` once they confirm. |
 | **Key / secret management** | "create an app key", "I need an API Secret", "rotate the secret", "deactivate a key" | **Hand the command over; do not run it.** → "Key and secret management" below. |
 | **Install** | "add RequestShield", "protect /api/register" | `references/integration-planning.md` full flow → **Installing** → **Verifying** → **Negative test**. Do not reorder or skip a step. |
 | **Uninstall** | "remove it", "roll it back" | `references/integration-planning.md` (Detect existing integration only) → **Uninstalling**. |
 | **Verify / troubleshoot** | "is it set up right?", "why is it not blocking?", a reason code | `references/integration-planning.md` (Detect existing integration only) → **Verifying**. For a reason code, also read `references/troubleshooting.md`. |
-| **Challenge volume** | "how much traffic", "how many challenges" | Explain that the CLI analytics command is unavailable. Use existing authorized monitoring; do not infer volume from app status. |
-| **Billing** | "am I being charged", "what plan", "what are my limits" | Explain that billing is unavailable in this CLI; use the customer’s established billing/support channel. |
-| **Service health** | "is the service up", "is it degraded" | No service-health CLI command exists. Inspect authorized health/monitoring evidence without exposing credentials. |
-| **Agent setup** | "set this up for Codex too", "install the skill for Claude" | Run `requestshield agent setup` for auto-detection, or pass the requested agent: `--codex` or `--claude`. This installs agent guidance; it does not mint keys or edit customer application code. |
+| **Challenge volume** | "how much traffic", "how many challenges" | Explain that `usage challenges` is a [coming soon] placeholder. Use existing authorized monitoring; do not infer volume from app status. |
+| **Billing** | "am I being charged", "what plan", "what are my limits" | Explain that `billing get` is a [coming soon] placeholder; use the customer’s established billing/support channel. |
+| **Service health** | "is the service up", "is it degraded" | `service status` is a [coming soon] placeholder and returns no health data. Inspect authorized health/monitoring evidence without exposing credentials. |
+| **Agent setup** | "set this up for Codex too", "install the skill for Claude" | Run `requestshield agent setup` for auto-detection, or pass the requested agent: `--codex` or `--claude`. This installs agent guidance; `agent status` only inspects its files. Neither mints keys nor edits customer application code. |
 | **Anything else** | | Look the command up in `references/cli.md`. If it is not there, run `requestshield --help` rather than guessing at a flag. |
 
 Full CLI surface, output shapes, and which commands need auth: `references/cli.md`.
@@ -77,11 +80,11 @@ values never enter the agent's tool output or conversation. State-changing
 commands must match the user's requested application and action.
 
 ```console
-requestshield keys create --app-name <name>
-requestshield keys rotate <app-key>
-requestshield keys reveal <app-key>
-requestshield keys revoke <app-key>
-requestshield apps disable <app-key>
+requestshield app create <name>
+requestshield secret rotate <app-key>
+requestshield secret reveal <app-key>
+requestshield secret revoke <app-key>
+requestshield app disable <app-key>
 ```
 
 Create makes a new application. Rotate keeps the App Key and replaces its secret.
@@ -135,7 +138,7 @@ hand-off and warning are in **Key and secret management** above. Afterwards refe
 only as "the secret you just received".
 
 If a secret has already reached a repo, a log, an artifact, or this transcript, the fix
-is `requestshield keys rotate <app-key>`, run by the user.
+is `requestshield secret rotate <app-key>`, run by the user.
 
 ## Verifying
 
@@ -247,7 +250,7 @@ first:
    other source and header in place.
 5. Configuration keys and environment variable references.
 
-Application disable is a separate action: `requestshield apps disable <app-key>`.
+Application disable is a separate action: `requestshield app disable <app-key>`.
 Perform or hand it off only when the user requested that live-state change; removing
 integration code does not itself authorize revocation or disable.
 

package/skills/requestshield/assets/AGENTS.codex.md

@@ -44,7 +44,7 @@ Orientation:
 Five rules worth carrying without opening a file:
 
 - The **API Secret** never enters source control, logs, or a reply. It belongs in backend
-  runtime secret storage, and `requestshield keys rotate <app-key>` is the fix if it leaks. The
+  runtime secret storage, and `requestshield secret rotate <app-key>` is the fix if it leaks. The
   **App Key** is public and must be identical in browser and backend.
 - **Keep secret output out of tool transcripts.** Have the user run create, rotate
   and reveal in their own terminal, then have them
@@ -58,5 +58,7 @@ Five rules worth carrying without opening a file:
   non-empty string**; when it is empty, omit the header and let the backend apply its
   configured policy.
 
-Consult customer documentation for the chosen SDK release before changing the script
-URL, header name, released modes or backend baseline. The contract CLI is unavailable.
+Use `requestshield contract --json` and its documentation links before changing
+the script URL, matching integrity, header, modes or backend baseline. It is a public
+read with no login. Use the intended environment, merge CSP additions and preserve
+the selected release; report missing metadata instead of inventing values.

package/skills/requestshield/references/backend-java-core.md

@@ -13,9 +13,9 @@ is not Spring Boot 3 MVC, including a Spring Boot 3 app built on WebFlux, which
 Spring MVC. Also needed: the same App Key the browser uses, the backend-only API Secret,
 and a web framework that can extract the token carrier.
 
-Confirm the baseline and supported languages in the customer SDK documentation
-for the selected release. The CLI integration-contract command is unavailable. Do
-not promise an undocumented backend path; a browser-only install protects nothing.
+Use `requestshield contract --json` for the selected release's Java baseline,
+Maven coordinates and challenge URL, then follow its Java SDK documentation link.
+Do not promise an undocumented backend path; a browser-only install protects nothing.
 
 The browser mode does not decide this path. Either Seamless or Manual mode delivers the
 token, and the application extracts it and passes the value unchanged to `verify()`.

package/skills/requestshield/references/backend-spring-boot.md

@@ -13,9 +13,9 @@ writing anything — the detection recipes are in `integration-planning.md`, und
 -> Run the check**. Also needed: the same
 App Key the browser uses, and the backend-only API Secret.
 
-Confirm the baseline and supported languages in the customer SDK documentation
-for the selected release. The CLI integration-contract command is unavailable. Do
-not promise an undocumented backend path; a browser-only install protects nothing.
+Use `requestshield contract --json` for the selected release's Java baseline,
+Maven coordinates and challenge URL, then follow its Java SDK documentation link.
+Do not promise an undocumented backend path; a browser-only install protects nothing.
 
 The browser mode does not decide this path. Either Seamless or Manual mode delivers the
 token in `X-IntelliFend-Token`, and the starter reads that header without caring how it

package/skills/requestshield/references/browser-manual.md

@@ -24,7 +24,7 @@ Seamless interception:
 
 | Attribute | Required | Notes |
 | --- | --- | --- |
-| `src` | Yes | Use the customer Browser SDK installation documentation for the selected release; its mutable example is `https://static.intellifend.ai/intellifend.js`. The CLI contract command is unavailable. |
+| `src` | Yes | Use `browser.scriptUrl` and its matching `browser.integrity` from `requestshield contract --json`; follow the manifest's Browser SDK documentation link for the selected release. |
 | `data-app-key` | Yes | Public App Key. Must match the backend's configured key. |
 | `defer` | Recommended | Keeps HTML parsing unblocked. |