@intellifend/requestshieldjs 2.0.0-qat.211 → 2.0.0-qat.220

package/README.md

@@ -47,6 +47,11 @@ IntelliFend supplies a different endpoint for your application, set it explicitl
 Pin the resolved version
 in your application's lockfile for reproducible installations.
 
+This SDK uses API v2 by default. Select API v1 with `apiVersion: "v1"` or
+`data-api-version="v1"` on the script tag. The version is
+separate from the service base URL; do not append `/v1` or `/v2` to
+`challengeUrl`. Both versions use the same app key and backend token transport.
+
 The ESM entry point exports `IntelliFend`, `IntelliFendError`, `VERSION`, and
 TypeScript types. It does not attach a global or initialize itself. Use it in
 browser applications with an ESM-capable toolchain.
@@ -135,15 +140,21 @@ await fetch("/api/register", {
 | Option | Required | Description |
 | --- | --- | --- |
 | `appKey` | Yes | Public app key supplied by IntelliFend. |
+| `apiVersion` | No | Challenge API version: `"v1"` or `"v2"`. Defaults to `"v2"`. |
 | `challengeUrl` | No | Absolute Challenge Server base URL. Defaults to `https://challenge.intellifend.ai`. It must use HTTP(S) and contain no credentials, query, or fragment. |
 | `fallbackChallengeUrl` | No | Approved absolute HTTPS secondary base URL, without credentials, query, or fragment. Omitted by default. An identical normalized primary URL adds no alternate endpoint. |
 | `timeoutMs` | No | Positive whole-flow time budget for create, solve, verify, and retries. Defaults to 5,000 ms. |
 | `protect` | No | Exact endpoint path or URL strings for Seamless mode. Omit or pass an empty list for Manual-only operation. |
-| `telemetry` | No | Enables the optional browser signal collection described below. Default `false`. |
+| `telemetry` | No | Enables the optional browser signal collection on API v2. Default `false`; collection stays disabled on v1. |
 
 `init()` validates synchronously and throws `IntelliFendError` with code `invalid_config` for invalid input. Reinitialization replaces the previous valid configuration; a failing reinitialization leaves that configuration in place. Unknown configuration keys are ignored.
 
-Script-tag integrations use the equivalent attributes `data-app-key`, `data-challenge-url`, `data-protect`, and `data-fallback-challenge-url`. `data-protect` must be a JSON array of strings. The collector accepts only the exact `data-telemetry="true"` and `data-telemetry="false"` values; invalid supplied values use the same sanitized `invalid_config` auto-init warning.
+Script-tag integrations use the equivalent attributes `data-app-key`, `data-api-version`, `data-challenge-url`, `data-protect`, and `data-fallback-challenge-url`. `data-api-version` accepts exactly `"v1"` or `"v2"`; omitting it selects v2. `data-protect` must be a JSON array of strings. The collector accepts only the exact `data-telemetry="true"` and `data-telemetry="false"` values; invalid supplied values use the same sanitized `invalid_config` auto-init warning.
+
+Each token flow retains its API version through create, solve, verify, retries,
+and endpoint fallback, including when the SDK is reinitialized during that flow.
+This SDK requires WebAssembly and the documented CSP permissions with either
+API version. Integrations pinned to Browser SDK 1.0.0 continue using API v1.
 
 ### Optional secondary domain
 
@@ -163,10 +174,11 @@ The SDK can retry eligible connection failures through the alternate service.
 All attempts share the configured token timeout, which defaults to 5,000 ms.
 Switching services does not restart that timeout. No cookies or browser storage
 are used. `getToken()` returns a token or `""` if acquisition fails.
+Both services use the selected API version; a v2 failure never retries through v1.
 
 ### Optional browser signal collection
 
-`telemetry: true` collects a bounded summary of browser
+On API v2, `telemetry: true` collects a bounded summary of browser
 interaction and timezone information in page memory for up to five minutes.
 This summary accompanies token requests and includes timezone information.
 

package/dist/checksums.json

@@ -1,18 +1,18 @@
 {
-  "version": "2.0.0-qat.211",
+  "version": "2.0.0-qat.220",
   "algorithm": "sha384",
   "bundles": [
     {
       "name": "intellifend",
       "path": "intellifend.js",
-      "version": "2.0.0-qat.211",
-      "integrity": "sha384-uSFJiosGxa7BN8DIl3XvpILMhGXyWGuf1bSdW3zszbJc2dnURhUbhPWxMOGxTeHi"
+      "version": "2.0.0-qat.220",
+      "integrity": "sha384-K09d6qmXACzSLNDagPbaJb3hTK2FNfFCH9dfcDwiTVT/eAHAbG8zwXRMIuY4frT2"
     },
     {
       "name": "intellifend-esm",
       "path": "intellifend.mjs",
-      "version": "2.0.0-qat.211",
-      "integrity": "sha384-dFwy9vbHXbjtmymion5tAnmawA+1kqXUMDLUsDqQjktg2fTpfS+Vj7WN7RLQ8QXA"
+      "version": "2.0.0-qat.220",
+      "integrity": "sha384-G0S0OzHiTI6gAtDt6Iu7hqf6VuSYL/wa3kOdHY+eStCm0W3X/5bXs5NpL867+BXi"
     }
   ]
 }

package/dist/index.d.ts

@@ -1,6 +1,9 @@
+export type ApiVersion = "v1" | "v2";
 export interface InitConfig {
     /** Public site key (`pk_...`). Required. */
     appKey: string;
+    /** Challenge API version. Defaults to v2; v1 preserves the legacy policy. */
+    apiVersion?: ApiVersion;
     /** Challenge Server HTTP(S) base URL. Defaults to https://challenge.intellifend.ai. */
     challengeUrl?: string;
     /** Optional HTTPS service base URL used when the preferred endpoint is unavailable. */