Remove nonexistent telemetry quota bonus claim

[karlwaldman]

Summary

• remove the nonexistent telemetry/app URL quota-bonus claim from authored and generated customer surfaces
• add a sentence-bounded, relationship-aware storefront guard for telemetry/app-metadata entitlement claims without rejecting request-context attribution
• release the correction as 1.2.5

Red / green

Red first:

• authored and packed .d.ts telemetry-bonus fixtures, including the exact released spellings, failed before the guard
• Telemetry sends extra application metadata with API requests. failed against the first matcher and now remains an explicit allowed attribution-only regression

Green on replacement exact head 381eedf13e4997a545ba110709f67264e647e1eb (tree 652273d19eab420d17d94e006c2dcb028fc7c6cd):

• focused storefront + release readiness: 2 files, 16 tests
• full npm test: 34 files, 499 passed, 1 skipped
• npm run build
• npm run storefront:check: 36 public surfaces
• npm run snippets:check: 6 fixtures + 4 manifest tests
• npm run lint
• npm run check:secrets
• npx tsc --noEmit
• npm audit --audit-level=low: 0 vulnerabilities
• npm run smoke:package: clean packed ESM/CJS production keyless smoke

Exact replacement local candidate oilpriceapi-1.2.5.tgz:

• entries: 103
• size: 103112 bytes; unpacked: 668913 bytes
• SHA1: 961fdb334f2aa639dceb88cefddebc895f706d9e
• integrity: sha512-3po0h0aCbyUIrBq5OhEIfxgXTkjiSJDS94SepTw6+4QBtSXsaoBHyID2RnHRw74cf7D7ugIllr0VcKDq9HpHxw==
• recursive packed claim scan: green

The earlier 945423af candidate and its local tarball hashes are superseded.

Release

Merge through protected main, then publish immutable v1.2.5 only through the existing reviewed OIDC workflow. Public npm integrity/provenance and clean ESM/CJS authenticated + keyless smokes remain release gates.

[coderabbitai]

📝 Walkthrough

Walkthrough

The package now rejects telemetry or application-metadata quota-reward claims, updates related wording to usage attribution, and releases version 1.2.5 with matching metadata and tests.

Changes

Telemetry claim validation and release update

Layer / File(s)	Summary
Telemetry quota-claim validation scripts/validate-storefront-claims.mjs, tests/storefront-claims.test.ts	The validator rejects telemetry quota-reward claims in authored source and packed declarations. Tests cover multiple phrasings and allow attribution-only metadata.
Usage-attribution wording src/types.ts, src/client.ts	Public documentation and comments describe app metadata as usage attribution and remove request-limit bonus wording.
Version 1.2.5 release metadata package.json, src/version.ts, tests/release-readiness.test.ts, CHANGELOG.md	Package metadata, SDK version, release-readiness expectations, and the changelog now use version 1.2.5.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• OilpriceAPI/oilpriceapi-node#63: Updates related release metadata and release-readiness validation files.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the pull request's primary change: removing the nonexistent telemetry quota bonus claim.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/remove-telemetry-bonus-claim

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@scripts/validate-storefront-claims.mjs`:
- Around line 29-32: The quota-reward pattern in the storefront claims validator
must distinguish quota entitlements from attribution-only metadata in request
context. Update the regex near “telemetry quota reward” so the reward term is
associated with the quota entitlement rather than merely the metadata payload;
preserve detection of genuine extra API quota claims. In
tests/storefront-claims.test.ts lines 123-145, add the request-context
attribution fixture and assert validatePackage(root) returns [].

In `@src/types.ts`:
- Line 54: Update the appName documentation in the relevant interface in
src/types.ts to describe it as being used for usage attribution, matching the
corresponding header descriptions in src/client.ts. Remove the conflicting “for
telemetry” wording while preserving the existing optional application URL
description.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 01d9b45b-a8d6-470a-869f-b734357e802b

📥 Commits

Reviewing files that changed from the base of the PR and between 317bc02 and 945423a.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (8)

• CHANGELOG.md
• package.json
• scripts/validate-storefront-claims.mjs
• src/client.ts
• src/types.ts
• src/version.ts
• tests/release-readiness.test.ts
• tests/storefront-claims.test.ts