@cross-deck/node 1.10.0 → 1.11.0

package/CHANGELOG.md

@@ -6,6 +6,37 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.11.0] — 2026-06-30
+
+**Added — block `reference` and `supportEmail` on the trust surface (still v2 preview).**
+`resolve()` and `gate()` now surface two fields on a block:
+
+- `reference` — a short, opaque, human-quotable support handle (the "Ray ID", `xxxx-xxxx`).
+  Show it on your suspended screen; Crossdeck stores the same string on the block event, so
+  support resolves a quoted reference to the exact block in the admin Caught feed.
+- `supportEmail` — the email you registered with Crossdeck at signup, so your suspended
+  screen's "Contact support" reaches the real operator by default instead of a placeholder.
+
+Both were typed on `ResolveResult` / `GateVerdict` but the client previously **dropped**
+them when building the result object — now passed through. Additive, non-breaking. Opaque +
+non-PII (never the score or rule logic).
+
+## [1.10.1] — 2026-06-30
+
+**Fixed — the blocking surface now works for the documented paths (still v2 preview).**
+
+- `resolve()` / `isBlocked()` now accept a **bare `userId`** — the server-trusted
+  recognition path the backend honours (rides the identity backbone, matches on the email
+  Crossdeck already holds). 1.10.0's guard rejected it and fail-opened *without calling the
+  API*, so a known-user block silently never fired.
+- **Added `gate({ email, ip })`** — the brand-new-signup door (`POST /v1/trust/gate`), the
+  only path that catches a farm Crossdeck has never seen. Fail-open by contract. New
+  `GateInput` / `GateVerdict` types.
+- README now documents the blocking surface (the three doors + the verify-locally pattern).
+
+Still `@experimental` — Crossdeck Trust ships with Crossdeck v2.
+
+
 ## [1.10.0] — 2026-06-30
 
 **Added — the blocking surface (Crossdeck Trust, v2 preview).** Blocking is

package/README.md

@@ -211,6 +211,51 @@ app.post("/crossdeck-webhook", express.raw({ type: "application/json" }), (req,
 
 For test fixtures that need to mint signed webhooks against the same scheme, `signWebhookPayload(payload, secret, timestampSec)` is exported.
 
+### Blocking (Crossdeck Trust) — <sup>v2 preview</sup>
+
+> **Preview — not GA.** The blocking surface launches **end-to-end with Crossdeck v2.**
+> The shape is stable and all methods are `@experimental`, so it's documented and usable
+> now (dogfooding / early access) — but it is **not** a launched feature yet, and this is
+> not a fourth shipped USP. Treat it as preview until the v2 launch.
+
+Blocking is **entitlements, inverted**: `getEntitlements()` asks *"can this user access Pro?"*; these ask *"should this user be here at all?"* — the **same identity backbone**, read for `blocked`. Every method is **fail-open by contract**: it never throws and never returns blocked on uncertainty, so a glitch can never lock out a real user.
+
+There are three doors. Pick by who's at it:
+
+```ts
+// 1. A user you ALREADY KNOW — a bare userId rides the backbone (no token, no setup).
+//    Crossdeck matches on the email it already holds. The common case.
+const { blocked, blockReason } = await crossdeck.resolve({ userId, ip: req.ip });
+if (blocked) { await signOut(); return showSuspended(blockReason); }
+// or just the boolean:  if (await crossdeck.isBlocked({ userId })) …
+
+// 2. A BRAND-NEW signup Crossdeck has never seen — block by the two strings you have
+//    at signup, their email + ip. Call it BEFORE you create the account.
+const gate = await crossdeck.gate({ email, ip: req.ip });
+if (gate.action === "block") return rejectSignup(gate.blockReason);
+
+// 3. A PUBLIC PAGE — "is the owner of this page blocked?" (no session token). Poll on a
+//    short TTL to invalidate your cache; the ip is the owner's CREATION ip.
+const owner = await crossdeck.getOwnerStatus({ userId: ownerId });
+if (owner.blocked) await takePageOffline(ownerId);
+```
+
+**Recommended server pattern (no issuer registration):** if your backend runs Firebase
+Admin, verify the ID token **locally** for the authoritative uid, then send that as a bare
+`userId` — you keep the cryptographic proof on your side and Crossdeck needs zero setup:
+
+```ts
+const { uid } = await getAuth().verifyIdToken(idToken);     // your Firebase Admin
+const { blocked } = await crossdeck.resolve({ userId: uid, ip: req.ip });
+```
+
+Send `userId` + `idToken` to Crossdeck instead only if you *can't* verify locally — that's
+the verified Tier-3 path, and the only one that needs a one-time auth-issuer registration.
+Setting *who* is blocked is a rule in your Crossdeck admin. Full integration guide
+(suspension pages, public-content takedown, the backfill sweep): `CROSSDECK_BLOCKING_DEVELOPER_GUIDE.md`.
+
+Types: `ResolveInput` / `ResolveResult`, `GateInput` / `GateVerdict`, `OwnerStatusInput` / `BlockVerdict`.
+
 ## Cross-cutting
 
 ### Read-cost cross-match (Buckets)

package/dist/auto-events/index.d.mts

@@ -1,4 +1,4 @@
-import { x as CrossdeckServer } from '../crossdeck-server-C4nWPQzH.mjs';
+import { x as CrossdeckServer } from '../crossdeck-server-DAQX_7rm.mjs';
 import 'node:events';
 
 /**

package/dist/auto-events/index.d.ts

@@ -1,4 +1,4 @@
-import { x as CrossdeckServer } from '../crossdeck-server-C4nWPQzH.js';
+import { x as CrossdeckServer } from '../crossdeck-server-DAQX_7rm.js';
 import 'node:events';
 
 /**

package/dist/{crossdeck-server-C4nWPQzH.d.mts → crossdeck-server-DAQX_7rm.d.mts}

@@ -183,8 +183,8 @@ declare const CrossdeckContracts: {
     readonly byId: (id: string) => Contract | undefined;
     readonly byPillar: (pillar: ContractPillar) => readonly Contract[];
     readonly withStatus: (status: ContractStatus) => readonly Contract[];
-    readonly sdkVersion: "1.10.0";
-    readonly bundledIn: "@cross-deck/node@1.10.0";
+    readonly sdkVersion: "1.11.0";
+    readonly bundledIn: "@cross-deck/node@1.11.0";
     /**
      * Resolve a failing test back to the contract it exercises.
      * Used by test-framework hooks to find the contract id of a
@@ -472,6 +472,18 @@ interface BlockVerdict {
     blockReason: string | null;
     /** The exact rule that fired: `"domain:spartan.net"` | `"ip:1.2.3.4"` | `"manual"` | null. */
     blockedKey: string | null;
+    /**
+     * Human-quotable support handle for this verdict (the "Ray ID"), formatted `xxxx-xxxx`.
+     * Show it on your suspended screen ("reference: blocklist:domain · a1f9-7c2e"); Crossdeck
+     * stores the same string on the block event, so support resolves it in the Caught feed.
+     */
+    reference?: string | null;
+    /**
+     * The recorded support contact (the project owner's signup email), present only when
+     * blocked — render it as the suspended screen's "Contact support" so appeals reach the
+     * real operator by default. Override with a dedicated address if you have one.
+     */
+    supportEmail?: string | null;
     /**
      * True when this is the fail-open default (Crossdeck unreachable / identity unresolved).
      * `blocked` is `false`; log it for observability, never treat it as a real "not blocked".
@@ -514,6 +526,45 @@ interface OwnerStatusInput {
     domain?: string;
     ip?: string;
 }
+/**
+ * Input for {@link CrossdeckServer.gate} — the brand-new-signup door. Pass the two strings
+ * you have at signup: `email` and `ip`. (Optional `domain`/`fingerprint` sharpen the score.)
+ *
+ * @experimental Preview — see {@link ResolveInput}.
+ */
+interface GateInput {
+    /** The signing-up user's email. Matched against email + domain blocklist rules. */
+    email?: string;
+    /** The signing-up request's IP. Matched against ip rules + datacenter/velocity signals. */
+    ip?: string;
+    /** Optional explicit domain (defaults to the email's domain). */
+    domain?: string;
+    /** Optional device fingerprint — sharpens the composite signup score. */
+    fingerprint?: string;
+}
+/**
+ * The signup-gate verdict from {@link CrossdeckServer.gate}. Fail-open: on any error these
+ * come back `{ action: "allow", allow: true, degraded: true }` — a glitch never rejects a
+ * real signup.
+ *
+ * @experimental Preview — see {@link ResolveInput}.
+ */
+interface GateVerdict {
+    /** `"allow"` | `"review"` | `"block"`. Reject the account only on `"block"`. */
+    action: "allow" | "review" | "block";
+    /** Convenience: `false` only when `action` is `"block"`. */
+    allow: boolean;
+    /** Why, when blocked: e.g. `"disposable_domain"` | `"blocklist:ip"` | `"blocklist:domain"`. */
+    blockReason: string | null;
+    /** The exact rule/key that fired, when blocked. */
+    blockedKey: string | null;
+    /** Human-quotable support handle (the "Ray ID"), formatted `xxxx-xxxx` — show it on the blocked screen. */
+    reference?: string | null;
+    /** Recorded support contact (project owner's signup email), present only on `block` — the blocked screen's "Contact support" default. */
+    supportEmail?: string | null;
+    /** True when this is the fail-open default (Crossdeck unreachable). `allow` is `true`. */
+    degraded?: boolean;
+}
 /**
  * Snapshot of one customer's last-known-good entitlements, as written
  * to / read from a durable `EntitlementStore`. Versioned for forward-
@@ -1566,6 +1617,19 @@ declare class CrossdeckServer extends EventEmitter {
      * @experimental Preview — see {@link resolve}.
      */
     getOwnerStatus(input: OwnerStatusInput, options?: RequestOptions): Promise<BlockVerdict>;
+    /**
+     * The brand-new-signup door (§3 of the Blocking developer guide). Block a user Crossdeck
+     * has **never seen** — at the instant they sign up — by the two strings you have then:
+     * their `email` and `ip`. There's no identity to ride yet, so {@link resolve} can't catch
+     * them; this matches `email` / domain / `ip` blocklist rules directly. Call it BEFORE you
+     * create the account; on `action: "block"`, reject the signup.
+     *
+     * **Fail-open by contract** — never throws, never blocks on uncertainty: any error →
+     * `{ action: "allow", allow: true, degraded: true }`, so a glitch can't reject a real signup.
+     *
+     * @experimental Preview — Crossdeck Trust ships with Crossdeck v2.
+     */
+    gate(input: GateInput, options?: RequestOptions): Promise<GateVerdict>;
     /**
      * Synchronous entitlement check. Returns `true` iff the customer
      * has the entitlement AND the cache entry is fresh (within
@@ -2045,4 +2109,4 @@ declare class CrossdeckServer extends EventEmitter {
     private normalizeIngestEvent;
 }
 
-export { type OwnerStatusInput as $, type AliasIdentityInput as A, type BlockVerdict as B, CROSSDECK_API_VERSION as C, DEFAULT_BASE_URL as D, DEFAULT_TIMEOUT_MS as E, type Diagnostics as F, type EntitlementCacheOptions as G, type EntitlementMutationResult as H, type EntitlementStore as I, type EntitlementsListResponse as J, type EntitlementsListener as K, type Environment as L, type ErrorCaptureConfig as M, type ErrorLevel as N, type EventProperties as O, type ForgetResult as P, type GrantDuration as Q, type GrantEntitlementInput as R, type GroupMembership as S, type HeartbeatResponse as T, type HttpRequestInfo as U, type HttpResponseInfo as V, type HttpRetriesConfig as W, type IdentifyOptions as X, type IdentityHints as Y, type IngestOptions as Z, type IngestResponse as _, type AliasResult as a, type PublicEntitlement as a0, type PurchaseResult as a1, type RequestOptions as a2, type ResolveInput as a3, type ResolveResult as a4, type RevokeEntitlementInput as a5, type RuntimeHost as a6, type RuntimeInfo as a7, type ServerEvent as a8, type StackFrame as a9, type StoredEntitlements as aa, type SyncPurchaseInput as ab, makeCrossdeckError as ac, type AuditDecision as b, type AuditEntry as c, type Breadcrumb as d, type BreadcrumbCategory as e, type BreadcrumbLevel as f, type CapturedError as g, type Contract as h, type ContractAppliesTo as i, type ContractFailureInput as j, type ContractPillar as k, type ContractStatus as l, type ContractTestRef as m, CrossdeckAuthenticationError as n, CrossdeckConfigurationError as o, CrossdeckContracts as p, CrossdeckError as q, type CrossdeckErrorPayload as r, type CrossdeckErrorType as s, CrossdeckInternalError as t, CrossdeckNetworkError as u, CrossdeckPermissionError as v, CrossdeckRateLimitError as w, CrossdeckServer as x, type CrossdeckServerOptions as y, CrossdeckValidationError as z };
+export { type IngestOptions as $, type AliasIdentityInput as A, type BlockVerdict as B, CROSSDECK_API_VERSION as C, DEFAULT_BASE_URL as D, DEFAULT_TIMEOUT_MS as E, type Diagnostics as F, type EntitlementCacheOptions as G, type EntitlementMutationResult as H, type EntitlementStore as I, type EntitlementsListResponse as J, type EntitlementsListener as K, type Environment as L, type ErrorCaptureConfig as M, type ErrorLevel as N, type EventProperties as O, type ForgetResult as P, type GateInput as Q, type GateVerdict as R, type GrantDuration as S, type GrantEntitlementInput as T, type GroupMembership as U, type HeartbeatResponse as V, type HttpRequestInfo as W, type HttpResponseInfo as X, type HttpRetriesConfig as Y, type IdentifyOptions as Z, type IdentityHints as _, type AliasResult as a, type IngestResponse as a0, type OwnerStatusInput as a1, type PublicEntitlement as a2, type PurchaseResult as a3, type RequestOptions as a4, type ResolveInput as a5, type ResolveResult as a6, type RevokeEntitlementInput as a7, type RuntimeHost as a8, type RuntimeInfo as a9, type ServerEvent as aa, type StackFrame as ab, type StoredEntitlements as ac, type SyncPurchaseInput as ad, makeCrossdeckError as ae, type AuditDecision as b, type AuditEntry as c, type Breadcrumb as d, type BreadcrumbCategory as e, type BreadcrumbLevel as f, type CapturedError as g, type Contract as h, type ContractAppliesTo as i, type ContractFailureInput as j, type ContractPillar as k, type ContractStatus as l, type ContractTestRef as m, CrossdeckAuthenticationError as n, CrossdeckConfigurationError as o, CrossdeckContracts as p, CrossdeckError as q, type CrossdeckErrorPayload as r, type CrossdeckErrorType as s, CrossdeckInternalError as t, CrossdeckNetworkError as u, CrossdeckPermissionError as v, CrossdeckRateLimitError as w, CrossdeckServer as x, type CrossdeckServerOptions as y, CrossdeckValidationError as z };

package/dist/{crossdeck-server-C4nWPQzH.d.ts → crossdeck-server-DAQX_7rm.d.ts}

@@ -183,8 +183,8 @@ declare const CrossdeckContracts: {
     readonly byId: (id: string) => Contract | undefined;
     readonly byPillar: (pillar: ContractPillar) => readonly Contract[];
     readonly withStatus: (status: ContractStatus) => readonly Contract[];
-    readonly sdkVersion: "1.10.0";
-    readonly bundledIn: "@cross-deck/node@1.10.0";
+    readonly sdkVersion: "1.11.0";
+    readonly bundledIn: "@cross-deck/node@1.11.0";
     /**
      * Resolve a failing test back to the contract it exercises.
      * Used by test-framework hooks to find the contract id of a
@@ -472,6 +472,18 @@ interface BlockVerdict {
     blockReason: string | null;
     /** The exact rule that fired: `"domain:spartan.net"` | `"ip:1.2.3.4"` | `"manual"` | null. */
     blockedKey: string | null;
+    /**
+     * Human-quotable support handle for this verdict (the "Ray ID"), formatted `xxxx-xxxx`.
+     * Show it on your suspended screen ("reference: blocklist:domain · a1f9-7c2e"); Crossdeck
+     * stores the same string on the block event, so support resolves it in the Caught feed.
+     */
+    reference?: string | null;
+    /**
+     * The recorded support contact (the project owner's signup email), present only when
+     * blocked — render it as the suspended screen's "Contact support" so appeals reach the
+     * real operator by default. Override with a dedicated address if you have one.
+     */
+    supportEmail?: string | null;
     /**
      * True when this is the fail-open default (Crossdeck unreachable / identity unresolved).
      * `blocked` is `false`; log it for observability, never treat it as a real "not blocked".
@@ -514,6 +526,45 @@ interface OwnerStatusInput {
     domain?: string;
     ip?: string;
 }
+/**
+ * Input for {@link CrossdeckServer.gate} — the brand-new-signup door. Pass the two strings
+ * you have at signup: `email` and `ip`. (Optional `domain`/`fingerprint` sharpen the score.)
+ *
+ * @experimental Preview — see {@link ResolveInput}.
+ */
+interface GateInput {
+    /** The signing-up user's email. Matched against email + domain blocklist rules. */
+    email?: string;
+    /** The signing-up request's IP. Matched against ip rules + datacenter/velocity signals. */
+    ip?: string;
+    /** Optional explicit domain (defaults to the email's domain). */
+    domain?: string;
+    /** Optional device fingerprint — sharpens the composite signup score. */
+    fingerprint?: string;
+}
+/**
+ * The signup-gate verdict from {@link CrossdeckServer.gate}. Fail-open: on any error these
+ * come back `{ action: "allow", allow: true, degraded: true }` — a glitch never rejects a
+ * real signup.
+ *
+ * @experimental Preview — see {@link ResolveInput}.
+ */
+interface GateVerdict {
+    /** `"allow"` | `"review"` | `"block"`. Reject the account only on `"block"`. */
+    action: "allow" | "review" | "block";
+    /** Convenience: `false` only when `action` is `"block"`. */
+    allow: boolean;
+    /** Why, when blocked: e.g. `"disposable_domain"` | `"blocklist:ip"` | `"blocklist:domain"`. */
+    blockReason: string | null;
+    /** The exact rule/key that fired, when blocked. */
+    blockedKey: string | null;
+    /** Human-quotable support handle (the "Ray ID"), formatted `xxxx-xxxx` — show it on the blocked screen. */
+    reference?: string | null;
+    /** Recorded support contact (project owner's signup email), present only on `block` — the blocked screen's "Contact support" default. */
+    supportEmail?: string | null;
+    /** True when this is the fail-open default (Crossdeck unreachable). `allow` is `true`. */
+    degraded?: boolean;
+}
 /**
  * Snapshot of one customer's last-known-good entitlements, as written
  * to / read from a durable `EntitlementStore`. Versioned for forward-
@@ -1566,6 +1617,19 @@ declare class CrossdeckServer extends EventEmitter {
      * @experimental Preview — see {@link resolve}.
      */
     getOwnerStatus(input: OwnerStatusInput, options?: RequestOptions): Promise<BlockVerdict>;
+    /**
+     * The brand-new-signup door (§3 of the Blocking developer guide). Block a user Crossdeck
+     * has **never seen** — at the instant they sign up — by the two strings you have then:
+     * their `email` and `ip`. There's no identity to ride yet, so {@link resolve} can't catch
+     * them; this matches `email` / domain / `ip` blocklist rules directly. Call it BEFORE you
+     * create the account; on `action: "block"`, reject the signup.
+     *
+     * **Fail-open by contract** — never throws, never blocks on uncertainty: any error →
+     * `{ action: "allow", allow: true, degraded: true }`, so a glitch can't reject a real signup.
+     *
+     * @experimental Preview — Crossdeck Trust ships with Crossdeck v2.
+     */
+    gate(input: GateInput, options?: RequestOptions): Promise<GateVerdict>;
     /**
      * Synchronous entitlement check. Returns `true` iff the customer
      * has the entitlement AND the cache entry is fresh (within
@@ -2045,4 +2109,4 @@ declare class CrossdeckServer extends EventEmitter {
     private normalizeIngestEvent;
 }
 
-export { type OwnerStatusInput as $, type AliasIdentityInput as A, type BlockVerdict as B, CROSSDECK_API_VERSION as C, DEFAULT_BASE_URL as D, DEFAULT_TIMEOUT_MS as E, type Diagnostics as F, type EntitlementCacheOptions as G, type EntitlementMutationResult as H, type EntitlementStore as I, type EntitlementsListResponse as J, type EntitlementsListener as K, type Environment as L, type ErrorCaptureConfig as M, type ErrorLevel as N, type EventProperties as O, type ForgetResult as P, type GrantDuration as Q, type GrantEntitlementInput as R, type GroupMembership as S, type HeartbeatResponse as T, type HttpRequestInfo as U, type HttpResponseInfo as V, type HttpRetriesConfig as W, type IdentifyOptions as X, type IdentityHints as Y, type IngestOptions as Z, type IngestResponse as _, type AliasResult as a, type PublicEntitlement as a0, type PurchaseResult as a1, type RequestOptions as a2, type ResolveInput as a3, type ResolveResult as a4, type RevokeEntitlementInput as a5, type RuntimeHost as a6, type RuntimeInfo as a7, type ServerEvent as a8, type StackFrame as a9, type StoredEntitlements as aa, type SyncPurchaseInput as ab, makeCrossdeckError as ac, type AuditDecision as b, type AuditEntry as c, type Breadcrumb as d, type BreadcrumbCategory as e, type BreadcrumbLevel as f, type CapturedError as g, type Contract as h, type ContractAppliesTo as i, type ContractFailureInput as j, type ContractPillar as k, type ContractStatus as l, type ContractTestRef as m, CrossdeckAuthenticationError as n, CrossdeckConfigurationError as o, CrossdeckContracts as p, CrossdeckError as q, type CrossdeckErrorPayload as r, type CrossdeckErrorType as s, CrossdeckInternalError as t, CrossdeckNetworkError as u, CrossdeckPermissionError as v, CrossdeckRateLimitError as w, CrossdeckServer as x, type CrossdeckServerOptions as y, CrossdeckValidationError as z };
+export { type IngestOptions as $, type AliasIdentityInput as A, type BlockVerdict as B, CROSSDECK_API_VERSION as C, DEFAULT_BASE_URL as D, DEFAULT_TIMEOUT_MS as E, type Diagnostics as F, type EntitlementCacheOptions as G, type EntitlementMutationResult as H, type EntitlementStore as I, type EntitlementsListResponse as J, type EntitlementsListener as K, type Environment as L, type ErrorCaptureConfig as M, type ErrorLevel as N, type EventProperties as O, type ForgetResult as P, type GateInput as Q, type GateVerdict as R, type GrantDuration as S, type GrantEntitlementInput as T, type GroupMembership as U, type HeartbeatResponse as V, type HttpRequestInfo as W, type HttpResponseInfo as X, type HttpRetriesConfig as Y, type IdentifyOptions as Z, type IdentityHints as _, type AliasResult as a, type IngestResponse as a0, type OwnerStatusInput as a1, type PublicEntitlement as a2, type PurchaseResult as a3, type RequestOptions as a4, type ResolveInput as a5, type ResolveResult as a6, type RevokeEntitlementInput as a7, type RuntimeHost as a8, type RuntimeInfo as a9, type ServerEvent as aa, type StackFrame as ab, type StoredEntitlements as ac, type SyncPurchaseInput as ad, makeCrossdeckError as ae, type AuditDecision as b, type AuditEntry as c, type Breadcrumb as d, type BreadcrumbCategory as e, type BreadcrumbLevel as f, type CapturedError as g, type Contract as h, type ContractAppliesTo as i, type ContractFailureInput as j, type ContractPillar as k, type ContractStatus as l, type ContractTestRef as m, CrossdeckAuthenticationError as n, CrossdeckConfigurationError as o, CrossdeckContracts as p, CrossdeckError as q, type CrossdeckErrorPayload as r, type CrossdeckErrorType as s, CrossdeckInternalError as t, CrossdeckNetworkError as u, CrossdeckPermissionError as v, CrossdeckRateLimitError as w, CrossdeckServer as x, type CrossdeckServerOptions as y, CrossdeckValidationError as z };

package/dist/index.cjs

@@ -387,7 +387,7 @@ function byteLength(s) {
 var https = __toESM(require("https"));
 
 // src/_version.ts
-var SDK_VERSION = "1.10.0";
+var SDK_VERSION = "1.11.0";
 var SDK_NAME = "@cross-deck/node";
 
 // src/_diagnostic-telemetry.ts
@@ -3185,10 +3185,10 @@ var CrossdeckServer = class extends import_node_events.EventEmitter {
       anonymousId: input?.anonymousId ?? null,
       identityError: null
     });
-    if (!input || !input.anonymousId && !(input.userId && input.idToken)) {
+    if (!input || !input.anonymousId && !input.userId) {
       this.debug.emit(
         "sdk.resolve_missing_identity",
-        "resolve() needs anonymousId OR (userId + idToken); returning fail-open blocked:false."
+        "resolve() needs an anonymousId or a userId; returning fail-open blocked:false."
       );
       return failOpen();
     }
@@ -3207,6 +3207,8 @@ var CrossdeckServer = class extends import_node_events.EventEmitter {
         blocked: raw.blocked === true,
         blockReason: raw.blockReason ?? null,
         blockedKey: raw.blockedKey ?? null,
+        reference: raw.reference ?? null,
+        supportEmail: raw.supportEmail ?? null,
         status: typeof raw.status === "string" ? raw.status : "active",
         entitlements: Array.isArray(raw.entitlements) ? raw.entitlements.filter((e) => typeof e === "string") : [],
         crossdeckCustomerId: raw.crossdeckCustomerId ?? raw.user?.id ?? null,
@@ -3273,6 +3275,62 @@ var CrossdeckServer = class extends import_node_events.EventEmitter {
       return { blocked: false, blockReason: null, blockedKey: null, degraded: true };
     }
   }
+  /**
+   * The brand-new-signup door (§3 of the Blocking developer guide). Block a user Crossdeck
+   * has **never seen** — at the instant they sign up — by the two strings you have then:
+   * their `email` and `ip`. There's no identity to ride yet, so {@link resolve} can't catch
+   * them; this matches `email` / domain / `ip` blocklist rules directly. Call it BEFORE you
+   * create the account; on `action: "block"`, reject the signup.
+   *
+   * **Fail-open by contract** — never throws, never blocks on uncertainty: any error →
+   * `{ action: "allow", allow: true, degraded: true }`, so a glitch can't reject a real signup.
+   *
+   * @experimental Preview — Crossdeck Trust ships with Crossdeck v2.
+   */
+  async gate(input, options) {
+    const failOpen = () => ({
+      action: "allow",
+      allow: true,
+      blockReason: null,
+      blockedKey: null,
+      degraded: true
+    });
+    if (!input || !input.email && !input.ip && !input.domain) {
+      this.debug.emit(
+        "sdk.gate_missing_input",
+        "gate() needs at least one of email / ip / domain; returning fail-open allow:true."
+      );
+      return failOpen();
+    }
+    try {
+      const raw = await this.http.request("POST", "/trust/gate", {
+        body: {
+          ...input.email ? { email: input.email } : {},
+          ...input.ip ? { ip: input.ip } : {},
+          ...input.domain ? { domain: input.domain } : {},
+          ...input.fingerprint ? { fingerprint: input.fingerprint } : {}
+        },
+        signal: options?.signal,
+        timeoutMs: options?.timeoutMs
+      });
+      const action = raw.action === "block" || raw.action === "review" ? raw.action : "allow";
+      return {
+        action,
+        allow: raw.allow !== false && action !== "block",
+        blockReason: raw.blockReason ?? null,
+        blockedKey: raw.blockedKey ?? null,
+        reference: raw.reference ?? null,
+        supportEmail: raw.supportEmail ?? null
+      };
+    } catch (err) {
+      this.debug.emit(
+        "sdk.gate_failed",
+        `gate() failed \u2014 fail-open allow:true. ${err instanceof Error ? err.message : String(err)}`,
+        { error: err instanceof Error ? err.message : String(err) }
+      );
+      return failOpen();
+    }
+  }
   /**
    * Synchronous entitlement check. Returns `true` iff the customer
    * has the entitlement AND the cache entry is fresh (within
@@ -4720,8 +4778,8 @@ function normaliseSecrets(input) {
 }
 
 // src/_contracts-bundled.ts
-var BUNDLED_IN = "@cross-deck/node@1.10.0";
-var SDK_VERSION2 = "1.10.0";
+var BUNDLED_IN = "@cross-deck/node@1.11.0";
+var SDK_VERSION2 = "1.11.0";
 var BUNDLED_CONTRACTS = Object.freeze([
   {
     "id": "contract-failed-payload-schema-lock",
@@ -4843,7 +4901,7 @@ var BUNDLED_CONTRACTS = Object.freeze([
       "legal/security/index.html#diagnostic",
       "legal/sdk-data/index.html#b-diagnostic"
     ],
-    "bundledIn": "@cross-deck/node@1.10.0"
+    "bundledIn": "@cross-deck/node@1.11.0"
   },
   {
     "id": "documentation-honesty",
@@ -4875,7 +4933,7 @@ var BUNDLED_CONTRACTS = Object.freeze([
     ],
     "registeredAt": "2026-05-26",
     "firstRegisteredIn": "bank-grade reconciliation v1.4.0 \u2014 phase 7.1",
-    "bundledIn": "@cross-deck/node@1.10.0"
+    "bundledIn": "@cross-deck/node@1.11.0"
   },
   {
     "id": "error-envelope-shape",
@@ -4914,7 +4972,7 @@ var BUNDLED_CONTRACTS = Object.freeze([
     ],
     "registeredAt": "2026-05-26",
     "firstRegisteredIn": "bank-grade reconciliation v1.4.0 \u2014 phase 8 (codifies existing contract)",
-    "bundledIn": "@cross-deck/node@1.10.0"
+    "bundledIn": "@cross-deck/node@1.11.0"
   },
   {
     "id": "flush-interval-parity",
@@ -4959,7 +5017,7 @@ var BUNDLED_CONTRACTS = Object.freeze([
     ],
     "registeredAt": "2026-05-26",
     "firstRegisteredIn": "bank-grade reconciliation v1.4.0 \u2014 phase 3.3",
-    "bundledIn": "@cross-deck/node@1.10.0"
+    "bundledIn": "@cross-deck/node@1.11.0"
   },
   {
     "id": "idempotency-key-deterministic",
@@ -5064,7 +5122,7 @@ var BUNDLED_CONTRACTS = Object.freeze([
     ],
     "registeredAt": "2026-05-26",
     "firstRegisteredIn": "bank-grade reconciliation v1.4.0 \u2014 phase 2.2.a + 2.2.b + 2.2.c",
-    "bundledIn": "@cross-deck/node@1.10.0"
+    "bundledIn": "@cross-deck/node@1.11.0"
   },
   {
     "id": "invalid-input-rejected-natively",
@@ -5120,7 +5178,7 @@ var BUNDLED_CONTRACTS = Object.freeze([
     ],
     "registeredAt": "2026-06-11",
     "firstRegisteredIn": "swift trap-on-input class fix \u2014 first machine-tested Swift release",
-    "bundledIn": "@cross-deck/node@1.10.0"
+    "bundledIn": "@cross-deck/node@1.11.0"
   },
   {
     "id": "node-pii-scrubber",
@@ -5159,7 +5217,7 @@ var BUNDLED_CONTRACTS = Object.freeze([
     ],
     "registeredAt": "2026-05-26",
     "firstRegisteredIn": "bank-grade reconciliation v1.4.0 \u2014 phase 3.1",
-    "bundledIn": "@cross-deck/node@1.10.0"
+    "bundledIn": "@cross-deck/node@1.11.0"
   },
   {
     "id": "node-shutdown-awaits-flush",
@@ -5192,7 +5250,7 @@ var BUNDLED_CONTRACTS = Object.freeze([
     ],
     "registeredAt": "2026-05-26",
     "firstRegisteredIn": "bank-grade reconciliation v1.4.0 \u2014 phase 5.4",
-    "bundledIn": "@cross-deck/node@1.10.0"
+    "bundledIn": "@cross-deck/node@1.11.0"
   },
   {
     "id": "sdk-error-codes-catalogue",
@@ -5237,7 +5295,7 @@ var BUNDLED_CONTRACTS = Object.freeze([
     ],
     "registeredAt": "2026-05-26",
     "firstRegisteredIn": "bank-grade reconciliation v1.4.0 \u2014 phase 6.2",
-    "bundledIn": "@cross-deck/node@1.10.0"
+    "bundledIn": "@cross-deck/node@1.11.0"
   },
   {
     "id": "sync-purchases-funnel-parity",
@@ -5270,7 +5328,7 @@ var BUNDLED_CONTRACTS = Object.freeze([
     ],
     "registeredAt": "2026-05-26",
     "firstRegisteredIn": "bank-grade reconciliation v1.4.0 \u2014 phase 3.5",
-    "bundledIn": "@cross-deck/node@1.10.0"
+    "bundledIn": "@cross-deck/node@1.11.0"
   },
   {
     "id": "verifier-timestamp-mandatory",
@@ -5324,7 +5382,7 @@ var BUNDLED_CONTRACTS = Object.freeze([
     ],
     "registeredAt": "2026-05-26",
     "firstRegisteredIn": "bank-grade reconciliation v1.4.0 \u2014 phase 7.2",
-    "bundledIn": "@cross-deck/node@1.10.0"
+    "bundledIn": "@cross-deck/node@1.11.0"
   }
 ]);