@intellifend/requestshieldjs 2.0.0-qat.277 → 2.0.0-qat.280

package/README.md

@@ -142,39 +142,23 @@ await fetch("/api/register", {
 | `appKey` | Yes | Public app key supplied by IntelliFend. |
 | `apiVersion` | No | Challenge API version: `"v1"` or `"v2"`. Defaults to `"v2"`. |
 | `challengeUrl` | No | Absolute Challenge Server base URL. Defaults to `https://challenge.intellifend.ai`. It must use HTTP(S) and contain no credentials, query, or fragment. |
-| `fallbackChallengeUrl` | No | Approved absolute HTTPS secondary base URL, without credentials, query, or fragment. Omitted by default. An identical normalized primary URL adds no alternate endpoint. |
 | `timeoutMs` | No | Positive whole-flow time budget for create, solve, verify, and retries. Defaults to 5,000 ms. |
 | `protect` | No | Endpoint paths or URLs for Seamless mode, optionally containing named path parameters as described below. Omit or pass an empty list for Manual-only operation. |
 | `telemetry` | No | Enables the optional browser signal collection on API v2. Default `false`; collection stays disabled on v1. |
 
 `init()` validates synchronously and throws `IntelliFendError` with code `invalid_config` for invalid input. Reinitialization replaces the previous valid configuration; a failing reinitialization leaves that configuration in place. Unknown configuration keys are ignored.
 
-Script-tag integrations use the equivalent attributes `data-app-key`, `data-api-version`, `data-challenge-url`, `data-protect`, and `data-fallback-challenge-url`. `data-api-version` accepts exactly `"v1"` or `"v2"`; omitting it selects v2. `data-protect` must be a JSON array of strings. The collector accepts only the exact `data-telemetry="true"` and `data-telemetry="false"` values; invalid supplied values use the same sanitized `invalid_config` auto-init warning.
+Script-tag integrations use the equivalent attributes `data-app-key`, `data-api-version`, `data-challenge-url`, and `data-protect`. `data-api-version` accepts exactly `"v1"` or `"v2"`; omitting it selects v2. `data-protect` must be a JSON array of strings. The collector accepts only the exact `data-telemetry="true"` and `data-telemetry="false"` values; invalid supplied values use the same sanitized `invalid_config` auto-init warning.
 
-Each token flow retains its API version through create, solve, verify, retries,
-and endpoint fallback, including when the SDK is reinitialized during that flow.
+Each token flow retains its API version through create, solve, verify, and retries,
+including when the SDK is reinitialized during that flow.
 This SDK requires WebAssembly and the documented CSP permissions with either
 API version. Integrations pinned to Browser SDK 1.0.0 continue using API v1.
 
-### Optional secondary domain
-
-Use the primary and fallback URLs supplied for your application:
-
-```javascript
-IntelliFend.init({
-  appKey: "YOUR_APP_KEY",
-  challengeUrl: "https://challenge.example.com",
-  fallbackChallengeUrl: "https://challenge-alt.example.com",
-});
-```
-
-URLs are normalized for surrounding whitespace and trailing slashes while retaining path prefixes. No secondary hostname is inferred automatically. A missing or identical fallback preserves the existing single-endpoint behavior.
-
-The SDK can retry eligible connection failures through the alternate service.
-All attempts share the configured token timeout, which defaults to 5,000 ms.
-Switching services does not restart that timeout. No cookies or browser storage
-are used. `getToken()` returns a token or `""` if acquisition fails.
-Both services use the selected API version; a v2 failure never retries through v1.
+Custom service URLs are normalized for surrounding whitespace and trailing
+slashes while retaining path prefixes. All attempts share the configured token
+timeout, which defaults to 5,000 ms. `getToken()` returns a token or `""` if
+acquisition fails.
 
 ### Optional browser signal collection
 
@@ -293,10 +277,14 @@ A Challenge Server proxy must forward binary request and response bodies unchang
 
 For 2.0, pages with Content Security Policy need `'wasm-unsafe-eval'` in
 `script-src` alongside the approved script origin, `connect-src` permission for
-both configured Challenge Server origins, and `worker-src blob:` for the
+the service origins, and `worker-src blob:` for the
 proof-of-work Web Worker. Keep JavaScript evaluation blocked; broad
-`'unsafe-eval'` is unnecessary. Configure the secondary URL as HTTPS directly;
-an HTTP redirect is insufficient on an HTTPS page.
+`'unsafe-eval'` is unnecessary. For the standard service, allow these connections
+alongside the application's other required sources:
+
+```http
+connect-src 'self' https://challenge.intellifend.ai https://challenge.intellifend.org;
+```
 
 ### Subresource Integrity
 

package/dist/checksums.json

@@ -1,18 +1,18 @@
 {
-  "version": "2.0.0-qat.277",
+  "version": "2.0.0-qat.280",
   "algorithm": "sha384",
   "bundles": [
     {
       "name": "intellifend",
       "path": "intellifend.js",
-      "version": "2.0.0-qat.277",
-      "integrity": "sha384-AxCgKguRaykSwNswIdRWx0r5fp+om789WdYx//8cjsCtabqg9DCAELXASTDdd4KX"
+      "version": "2.0.0-qat.280",
+      "integrity": "sha384-HeMko4HtBvnIJ0p3JjIbcdH7//zwztMa0OJq8eY4cTwaSrS3pS5eb+cBHYF8aICe"
     },
     {
       "name": "intellifend-esm",
       "path": "intellifend.mjs",
-      "version": "2.0.0-qat.277",
-      "integrity": "sha384-Oy8udIs5wEcXzBFfEXSvCI4CIR2yNyGQ+zT9GwlpYTEA9HsFqzQv/0PbQ8VROr5Q"
+      "version": "2.0.0-qat.280",
+      "integrity": "sha384-18NqyCXD5myIKdBwEADd2mBcIhKJzP7C+PI6vjdRV/BbaVN18GsVljaj8TXOf91/"
     }
   ]
 }