requestshield 1.0.0-stg.276 → 1.1.0-qat.284

package/README.md

@@ -224,14 +224,17 @@ and nullable `reason`. Reasons are `timeout`, `network_error`, `http_error` and
 your application integration.
 
 Usage requires sign-in and an owned App Key. It defaults to the last 24 hours;
-provide both `--from` and `--to` for a range within the last seven days. Use UTC
+provide both `--from` and `--to` for a range within the last 90 days. Use UTC
 times ending in `Z`, with seconds and optionally up to three fractional digits.
-The end must follow the start and cannot be in the future. Use recent dates.
+The end must follow the start and cannot be in the future. The range includes
+requests completed at the start and excludes requests completed at the end.
 
 Counts are approximate monitoring data, not billing totals. Data may be delayed
 or incomplete. Retries count separately; successful challenge verifications are
 attempts, not unique challenges. Zero means no recorded requests, not proof of no
-traffic. A failed query returns an error.
+traffic. A failed query returns an error. The report preserves your requested
+range and includes only available recorded activity, even if collection began
+after the start. The 90-day query window does not guarantee complete history.
 
 Usage reports cover API v2 requests only. API v1 activity is not included.
 If your browser and backend use different API versions, the report may show

package/config/.env.qat

@@ -0,0 +1,7 @@
+# Public QAT settings for the QAT npm release and source runner. Never add secrets.
+API_URL=https://management-api-qat.intellifend.ai
+CHALLENGE_URL=https://challenge-dev.intellifend.ai
+DOCS_URL=https://docs-qat.intellifend.ai
+OAUTH_ISSUER=https://incongruous-cherry-0283.customers.stytch.dev
+OAUTH_AUTHORIZATION_ISSUER=stytch.com/project-test-968146e2-6f34-4936-9d1c-a7e966813c70
+OAUTH_CLIENT_ID=connected-app-test-5ff62ca4-c0eb-48c3-84e5-06ae8f669998

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "requestshield",
-  "version": "1.0.0-stg.276",
+  "version": "1.1.0-qat.284",
   "description": "Customer CLI for IntelliFend RequestShield.",
   "type": "module",
   "bin": {
@@ -9,11 +9,11 @@
   "publishConfig": {
     "access": "public",
     "registry": "https://registry.npmjs.org/",
-    "tag": "stg"
+    "tag": "qat"
   },
   "files": [
     "src/",
-    "config/.env.stg",
+    "config/.env.qat",
     "skills/",
     "README.md"
   ],
@@ -22,6 +22,6 @@
   },
   "license": "UNLICENSED",
   "requestshield": {
-    "profile": "stg"
+    "profile": "qat"
   }
 }

package/skills/requestshield/references/cli.md

@@ -292,9 +292,11 @@ Before retrieving usage / request volume, complete the
 Uses the saved authenticated session and existing application-read permission.
 Requires an exact owned App Key, including disabled or revoked apps. Default:
 last 24 hours. Both optional UTC bounds must end in Z (seconds, optionally one to
-three fractional digits), with from before to, and fall within the last seven days
-according to the server's clock. No future end, buckets, 30-day history or account-wide
+three fractional digits), with from before to, and fall within the last 90 days
+according to the server's clock. No future end, buckets or account-wide
 view. `usage challenges` and `--granularity` are not supported.
+Counts use completion time, including the start and excluding the end. The report
+preserves requested bounds even when collection began later.
 
 The single JSON document is `{data: {appKey, from, to, approximate: true, operations}}`.
 Operations has three fixed keys: `challenge_create`, `challenge_verify` and
@@ -304,7 +306,8 @@ created, verification issued a token, or a token was consumed for the first time
 Replay is rejected. Retries count separately; verifies are not unique challenges.
 Requests without an identified app are excluded.
 
-These are approximate monitoring counts. Data may be delayed or incomplete. Zero means no recorded events,
+These are approximate monitoring counts over available recorded history in the
+requested range. Data may be delayed or incomplete. Zero means no recorded events,
 not proof of no traffic. Query failures return errors, never zeros. Do not infer
 billing, service health or backend enforcement from usage. Report unavailable-query
 errors without fabricating counts.

package/skills/requestshield/references/troubleshooting.md

@@ -106,8 +106,8 @@ backend connectivity and service health through established monitoring when it r
 Troubleshooting reads evidence the user already has; exercising the endpoint belongs to
 the explicit Test flow in `SKILL.md`. There, use browser network observations and
 existing safe backend metrics in an authorized environment. Do not record raw tokens or secrets. `requestshield usage <app-key>`
-provides approximate recent request totals, defaulting to 24 hours within seven-day
-retention. Missing or delayed logs can hide traffic; a zero count does not prove
+provides approximate recent request totals, defaulting to 24 hours within a 90-day
+query window over available history. Missing or delayed observations can hide traffic; a zero count does not prove
 enforcement or lack of traffic. Application status is not a traffic measurement. Report static correctness,
 observed requests and backend enforcement separately. Use the controlled negative
 test in `SKILL.md` to demonstrate enforcement.

package/src/command-registry.mjs

@@ -76,7 +76,7 @@ export const COMMAND_REGISTRY = [
   {id:"update-apply",order:20,path:["update","apply"],handler:"update-apply",requiresApiSession:false,availability:"implemented",arguments:[],flags:[yes,json],summary:"Check and install the available version into the global npm installation.",examples:["update apply","update apply --yes"],notes:["Requires confirmation unless --yes is supplied."]},
   {id:"contract",order:10,category:"developer",icon:"📖",navigationSummary:"View integration settings and SDK versions",path:["contract"],handler:"contract",requiresApiSession:false,availability:"implemented",arguments:[],flags:[json],summary:"Get the public integration contract and SDK versions.",examples:["contract","contract --json"],notes:["Reads public integration settings without signing in or accessing a saved session.","Returns published integration metadata; it does not install SDKs, modify project files or verify your application integration."]},
   {id:"service-status",order:10,path:["service","status"],handler:"service-status",requiresApiSession:false,availability:"implemented",arguments:[],flags:[json],summary:"Check Management API and Challenge Service availability.",examples:["service status","service status --json"],notes:["Checks both public /health endpoints without signing in or reading a saved session.","Each request has a five-second deadline. No retries or redirects are followed.","Test a protected request to verify your application integration.","Exits 0 when both checks pass, 1 when either check fails, or 2 for invalid configuration."]},
-  {id:"usage",order:30,category:"applications",navigationSummary:"Monitor recent application requests",path:["usage"],handler:"usage",requiresApiSession:true,availability:"implemented",arguments:[appKey],flags:[{name:"--from",kind:"value",value:"UTC-time",description:"Start of the time range; provide together with --to."},{name:"--to",kind:"value",value:"UTC-time",description:"End of the time range; provide together with --from."},json],summary:"Monitor recent request totals for an app.",examples:["usage pk_example","usage pk_example --json"],notes:["Defaults to the last 24 hours. Requested times must fall within the last seven days and end in Z, with at most three fractional digits.","Counts are approximate monitoring data; data can be delayed or incomplete. They are not billing totals. Usage reports cover API v2 requests only. API v1 activity is not included.","Retries count separately. Successful verifies are successful attempts, not unique challenges. Requests without an identified app are excluded."]},
+  {id:"usage",order:30,category:"applications",navigationSummary:"Monitor recent application requests",path:["usage"],handler:"usage",requiresApiSession:true,availability:"implemented",arguments:[appKey],flags:[{name:"--from",kind:"value",value:"UTC-time",description:"Start of the time range; provide together with --to."},{name:"--to",kind:"value",value:"UTC-time",description:"End of the time range; provide together with --from."},json],summary:"Monitor recent request totals for an app.",examples:["usage pk_example","usage pk_example --json"],notes:["Defaults to the last 24 hours. Requested times must fall within the last 90 days and end in Z, with at most three fractional digits.","Requests are counted by completion time, including the start and excluding the end. Only available recorded activity is included; the 90-day query window does not guarantee complete history.","Counts are approximate monitoring data; data can be delayed or incomplete. They are not billing totals. Usage reports cover API v2 requests only. API v1 activity is not included.","Retries count separately. Successful verifies are successful attempts, not unique challenges. Requests without an identified app are excluded."]},
   {id:"billing-get",order:10,path:["billing","get"],handler:"billing-get",requiresApiSession:true,availability:"implemented",arguments:[appKey],flags:[json],summary:"Show account billing for an owned App Key.",examples:["billing get pk_example","billing get pk_example --json"],notes:["Uses your saved session. All applications in your account share the plan, billing period, allowance and totals shown here.","Counts authenticated API v2 token verification requests, including rejected requests and retries. API v1 and service errors are excluded.","Usage, remaining quota and overage are approximate. Data may be delayed or incomplete; the usage cutoff is not a guarantee of complete reporting.","Estimated cost includes the period's base charge and usage reported so far, before taxes. It is not a final invoice.","Missing current-period data is shown as Unavailable (null in JSON), never as zero."]},
 ];
 

package/src/commands/usage.mjs

@@ -44,7 +44,7 @@ export async function showUsage(options, deps) {
 export function parseUsageResponse(body, options) {
   const data = responseObject(responseObject(body).data);
   const from = utcTimestamp(data.from), to = utcTimestamp(data.to);
-  if (data.appKey !== options.appKey || data.approximate !== true || from === undefined || to === undefined || from >= to || to - from > 7 * DAY_MS) throw invalidUsage();
+  if (data.appKey !== options.appKey || data.approximate !== true || from === undefined || to === undefined || from >= to || to - from > 90 * DAY_MS) throw invalidUsage();
   if (options.from !== undefined && (from !== utcTimestamp(options.from) || to !== utcTimestamp(options.to))) throw invalidUsage();
   if (options.from === undefined && to - from !== DAY_MS) throw invalidUsage();
   const operations = responseObject(data.operations);

package/src/usage-time.mjs

@@ -13,7 +13,7 @@ export function utcTimestamp(value) {
   return new Date(time).toISOString() === normalized ? time : undefined;
 }
 
-/** Validate syntax and ordering only; the server owns the current retention window.
+/** Validate syntax and ordering only; the server owns the current query window.
  * @param {{from?: string, to?: string}} options
  */
 export function validateUsageRange({from, to}) {

package/config/.env.stg

@@ -1,8 +0,0 @@
-# Public staging settings for the STG npm release and source runner. Never add secrets.
-API_URL=https://management-api-stg.intellifend.ai
-CHALLENGE_URL=https://challenge-stg.intellifend.ai
-DOCS_URL=https://docs-stg.intellifend.ai
-OAUTH_ISSUER=https://morning-laugh-3575.customers.stytch.dev
-# Stytch's authorization callback uses its project identifier.
-OAUTH_AUTHORIZATION_ISSUER=stytch.com/project-test-10433a17-5901-4521-9d77-593f21916a62
-OAUTH_CLIENT_ID=connected-app-test-9fed6a67-d783-4432-8a1d-2c9b8cbe6a07