@chatsystem/client 1.2.3 → 1.2.5

package/README.md

@@ -69,6 +69,18 @@ The value is scoped to that widget instance. Credentials, query strings,
 fragments, and non-local plain HTTP origins are rejected. Localhost HTTP remains
 available for development.
 
+### First-party server-boundary adapter
+
+`runtimeAdapter` is an advanced integration boundary for ChatSystem-owned
+embedded surfaces such as the shareable acquisition demo. It may replace only
+settings loading and text-prompt transport when that surface has its own
+admission or quota endpoint. The `App` remains the authority for settings
+hydration, messages, streaming, Markdown, suggestions, loading and scroll.
+
+Normal customer installations must omit this property and continue through the
+standard public installation endpoints. New presentation behavior belongs in
+the client itself; it must never be reimplemented in a host-specific adapter.
+
 ## Bundled JavaScript
 
 ```html
@@ -82,6 +94,32 @@ available for development.
 `data-displayMode` is optional and defaults to `launcher`. Set
 `data-displayMode="chatbox"` when embedding the chat directly in the page.
 
-The current bundled-script integration supports anonymous widgets. Delegated
-identity requires the React API until a programmatic script bootstrap is
-released; functions must not be serialized into `data-*` attributes.
+The declarative form remains the simplest anonymous integration. For Identity
+Delegation, load the same bundle without `data-appToken`, then use its
+programmatic browser API so the provider functions remain JavaScript values:
+
+```html
+<script src="https://chatsystem.s3.eu-west-3.amazonaws.com/index.js"></script>
+<script>
+  window.ChatSystem.mount({
+    appToken: "YOUR_TOKEN_ID",
+    displayMode: "launcher",
+    identityProvider: {
+      async getToken(request) {
+        const response = await fetch("/api/chatsystem/identity", {
+          credentials: "include",
+          cache: "no-store",
+        });
+        if (!response.ok) return null;
+        return (await response.json()).token ?? null;
+      },
+      subscribe(onIdentityChanged) {
+        return customerAuth.onAuthStateChanged(onIdentityChanged);
+      },
+    },
+  });
+</script>
+```
+
+This passes the provider to the same internal `App` and identity session used
+by the npm package. Do not place callbacks or secrets in `data-*` attributes.