@intellifend/requestshieldjs 2.0.0-qat.204 → 2.0.0-qat.219

package/README.md

@@ -2,6 +2,24 @@
 
 The RequestShield Browser SDK obtains single-use proof-of-work tokens and either attaches them automatically to configured Fetch and asynchronous XHR requests or returns them for application-controlled transport. The customer backend remains the authority that verifies a token and decides how to handle a missing token.
 
+## Choose integration modes
+
+Choose the frontend and backend modes independently:
+
+| Side | Seamless | Manual |
+| --- | --- | --- |
+| Frontend (Browser SDK) | Configure `protect`; the SDK obtains and attaches a token to matching Fetch and asynchronous XHR requests. | Call `getToken()` and attach the returned token in application code. |
+| Java backend | Use the Spring Boot 3 MVC starter and annotate the protected handler; the starter extracts the header, verifies the token and applies its enforcement policy. | Extract the token, call the Java core SDK's `verify(token)` and apply `VerificationResult` before the protected operation. |
+
+For a new integration, prefer Seamless on both sides when the browser transport
+is supported and the backend uses Spring Boot 3 MVC. Otherwise, prefer Manual
+on both sides. All four combinations are supported, so an existing combination
+or an explicit choice can be kept. Backend Seamless requires the token in
+`X-IntelliFend-Token`, including when the frontend uses Manual mode.
+
+`BLOCK` and `MONITOR` are Spring starter enforcement policies, separate from these
+integration modes. Choosing frontend Seamless does not enable backend protection.
+
 ## Install
 
 ### npm / ESM
@@ -29,6 +47,11 @@ IntelliFend supplies a different endpoint for your application, set it explicitl
 Pin the resolved version
 in your application's lockfile for reproducible installations.
 
+This SDK uses API v2 by default. Select API v1 with `apiVersion: "v1"` or
+`data-api-version="v1"` on the script tag. The version is
+separate from the service base URL; do not append `/v1` or `/v2` to
+`challengeUrl`. Both versions use the same app key and backend token transport.
+
 The ESM entry point exports `IntelliFend`, `IntelliFendError`, `VERSION`, and
 TypeScript types. It does not attach a global or initialize itself. Use it in
 browser applications with an ESM-capable toolchain.
@@ -117,15 +140,21 @@ await fetch("/api/register", {
 | Option | Required | Description |
 | --- | --- | --- |
 | `appKey` | Yes | Public app key supplied by IntelliFend. |
+| `apiVersion` | No | Challenge API version: `"v1"` or `"v2"`. Defaults to `"v2"`. |
 | `challengeUrl` | No | Absolute Challenge Server base URL. Defaults to `https://challenge.intellifend.ai`. It must use HTTP(S) and contain no credentials, query, or fragment. |
 | `fallbackChallengeUrl` | No | Approved absolute HTTPS secondary base URL, without credentials, query, or fragment. Omitted by default. An identical normalized primary URL adds no alternate endpoint. |
 | `timeoutMs` | No | Positive whole-flow time budget for create, solve, verify, and retries. Defaults to 5,000 ms. |
 | `protect` | No | Exact endpoint path or URL strings for Seamless mode. Omit or pass an empty list for Manual-only operation. |
-| `telemetry` | No | Enables the optional browser signal collection described below. Default `false`. |
+| `telemetry` | No | Enables the optional browser signal collection on API v2. Default `false`; collection stays disabled on v1. |
 
 `init()` validates synchronously and throws `IntelliFendError` with code `invalid_config` for invalid input. Reinitialization replaces the previous valid configuration; a failing reinitialization leaves that configuration in place. Unknown configuration keys are ignored.
 
-Script-tag integrations use the equivalent attributes `data-app-key`, `data-challenge-url`, `data-protect`, and `data-fallback-challenge-url`. `data-protect` must be a JSON array of strings. The collector accepts only the exact `data-telemetry="true"` and `data-telemetry="false"` values; invalid supplied values use the same sanitized `invalid_config` auto-init warning.
+Script-tag integrations use the equivalent attributes `data-app-key`, `data-api-version`, `data-challenge-url`, `data-protect`, and `data-fallback-challenge-url`. `data-api-version` accepts exactly `"v1"` or `"v2"`; omitting it selects v2. `data-protect` must be a JSON array of strings. The collector accepts only the exact `data-telemetry="true"` and `data-telemetry="false"` values; invalid supplied values use the same sanitized `invalid_config` auto-init warning.
+
+Each token flow retains its API version through create, solve, verify, retries,
+and endpoint fallback, including when the SDK is reinitialized during that flow.
+This SDK requires WebAssembly and the documented CSP permissions with either
+API version. Integrations pinned to Browser SDK 1.0.0 continue using API v1.
 
 ### Optional secondary domain
 
@@ -145,10 +174,11 @@ The SDK can retry eligible connection failures through the alternate service.
 All attempts share the configured token timeout, which defaults to 5,000 ms.
 Switching services does not restart that timeout. No cookies or browser storage
 are used. `getToken()` returns a token or `""` if acquisition fails.
+Both services use the selected API version; a v2 failure never retries through v1.
 
 ### Optional browser signal collection
 
-`telemetry: true` collects a bounded summary of browser
+On API v2, `telemetry: true` collects a bounded summary of browser
 interaction and timezone information in page memory for up to five minutes.
 This summary accompanies token requests and includes timezone information.
 
@@ -200,7 +230,11 @@ For a cross-origin protected application API, allow the `X-IntelliFend-Token` re
 
 ### Manual transport
 
-`X-IntelliFend-Token` is the recommended Manual-mode carrier. A dedicated request-body or form field is also valid when the backend extracts it before verification. Never place a token in a URL path, query string, or fragment because those locations are commonly logged and cached.
+`X-IntelliFend-Token` is the recommended carrier for frontend Manual mode and is
+required by backend Seamless. A dedicated request-body or form field is also
+valid with backend Manual, where application code extracts it before verification.
+Never place a token in a URL path, query string, or fragment because those
+locations are commonly logged and cached.
 
 ### Challenge Server proxies
 

package/dist/checksums.json

@@ -1,18 +1,18 @@
 {
-  "version": "2.0.0-qat.204",
+  "version": "2.0.0-qat.219",
   "algorithm": "sha384",
   "bundles": [
     {
       "name": "intellifend",
       "path": "intellifend.js",
-      "version": "2.0.0-qat.204",
-      "integrity": "sha384-EiSYGXAoIbbj/1cSFLfbnq9Kr9AuVRah2wcs27G6c/En4WaTzpvBs7wkvwQt5zPz"
+      "version": "2.0.0-qat.219",
+      "integrity": "sha384-VVNJr29GfJQ+cLKOyYVrTq4XZYzOOHe2V4XLuNonViFiN6YU1+orLXupWdvnHFVm"
     },
     {
       "name": "intellifend-esm",
       "path": "intellifend.mjs",
-      "version": "2.0.0-qat.204",
-      "integrity": "sha384-yyh4+YzCrfeKv/qw4ClpSQzcP6R5Kk2/C3WfrG9bMR1rzpFB4vZyiQNAhOgbuWxY"
+      "version": "2.0.0-qat.219",
+      "integrity": "sha384-nDFntCKrjZArukMLpKcNVXk0PV5wJGdMXfzW0x9GlsbRId6WjAopiWIATb6AKxX7"
     }
   ]
 }

package/dist/index.d.ts

@@ -1,6 +1,9 @@
+export type ApiVersion = "v1" | "v2";
 export interface InitConfig {
     /** Public site key (`pk_...`). Required. */
     appKey: string;
+    /** Challenge API version. Defaults to v2; v1 preserves the legacy policy. */
+    apiVersion?: ApiVersion;
     /** Challenge Server HTTP(S) base URL. Defaults to https://challenge.intellifend.ai. */
     challengeUrl?: string;
     /** Optional HTTPS service base URL used when the preferred endpoint is unavailable. */