@cross-deck/node 1.12.1 → 1.13.0

package/CHANGELOG.md

@@ -6,6 +6,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.13.0] — 2026-07-26
+
+- **Crossdeck Trust — the gate now carries the browser's human-proof token.** `GateInput` gains an optional `token`: pass the attestation minted by the Crossdeck Trust panel in the browser (`Crossdeck.trust.panel(...)` / `<CrossdeckTrust>` in `@cross-deck/web`) and `gate()` forwards it as `challengeToken` to `/v1/trust/gate`, completing the SDK-native round trip. A real browser carries one; a server-to-server bot has none — that absence is scored, and in strict mode (`requireHumanProof`) a tokenless + suspicious attempt is the confident block. Optional and fail-open: omitting it never blocks on its own, and `gate()` remains fail-open by contract (a glitch returns `{ action: "allow", degraded: true }`, never a throw or a false block).
+
 ## [1.12.1] — 2026-07-23
 
 - **Reliability telemetry re-pointed to the live project.** The internal `crossdeck.contract_failed` self-check channel used a retired reliability-workspace key that had begun returning `401 invalid_api_key`, silently dropping failures; it now targets the live "Crossdeck Health Check" project. Internal SDK-health only — never touches your dashboard or your app. (No API changes; the anonymous-`reset()` hardening in the other SDKs does not apply — the Node SDK has no persistent device identity to churn.)

package/dist/auto-events/index.d.mts

@@ -1,4 +1,4 @@
-import { x as CrossdeckServer } from '../crossdeck-server-CuTGwrwx.mjs';
+import { x as CrossdeckServer } from '../crossdeck-server-CjnIok-o.mjs';
 import 'node:events';
 
 /**

package/dist/auto-events/index.d.ts

@@ -1,4 +1,4 @@
-import { x as CrossdeckServer } from '../crossdeck-server-CuTGwrwx.js';
+import { x as CrossdeckServer } from '../crossdeck-server-CjnIok-o.js';
 import 'node:events';
 
 /**

package/dist/{crossdeck-server-CuTGwrwx.d.mts → crossdeck-server-CjnIok-o.d.mts}

@@ -549,6 +549,15 @@ interface GateInput {
     domain?: string;
     /** Optional device fingerprint — sharpens the composite signup score. */
     fingerprint?: string;
+    /**
+     * The human-proof attestation minted by the Crossdeck Trust panel in the browser
+     * (`Crossdeck.trust.panel(...)` / `<CrossdeckTrust>` in @cross-deck/web). Forward
+     * whatever the client delivered. A real browser carries one; a server-to-server
+     * bot has none — that absence is scored, and in strict mode (`requireHumanProof`)
+     * a tokenless + suspicious attempt is the confident block. Optional and fail-open:
+     * omitting it never blocks on its own.
+     */
+    token?: string;
 }
 /**
  * The signup-gate verdict from {@link CrossdeckServer.gate}. Fail-open: on any error these

package/dist/{crossdeck-server-CuTGwrwx.d.ts → crossdeck-server-CjnIok-o.d.ts}

@@ -549,6 +549,15 @@ interface GateInput {
     domain?: string;
     /** Optional device fingerprint — sharpens the composite signup score. */
     fingerprint?: string;
+    /**
+     * The human-proof attestation minted by the Crossdeck Trust panel in the browser
+     * (`Crossdeck.trust.panel(...)` / `<CrossdeckTrust>` in @cross-deck/web). Forward
+     * whatever the client delivered. A real browser carries one; a server-to-server
+     * bot has none — that absence is scored, and in strict mode (`requireHumanProof`)
+     * a tokenless + suspicious attempt is the confident block. Optional and fail-open:
+     * omitting it never blocks on its own.
+     */
+    token?: string;
 }
 /**
  * The signup-gate verdict from {@link CrossdeckServer.gate}. Fail-open: on any error these

package/dist/index.cjs

@@ -387,7 +387,7 @@ function byteLength(s) {
 var https = __toESM(require("https"));
 
 // src/_version.ts
-var SDK_VERSION = "1.12.1";
+var SDK_VERSION = "1.13.0";
 var SDK_NAME = "@cross-deck/node";
 
 // src/_diagnostic-telemetry.ts
@@ -3309,7 +3309,11 @@ var CrossdeckServer = class extends import_node_events.EventEmitter {
           ...input.email ? { email: input.email } : {},
           ...input.ip ? { ip: input.ip } : {},
           ...input.domain ? { domain: input.domain } : {},
-          ...input.fingerprint ? { fingerprint: input.fingerprint } : {}
+          ...input.fingerprint ? { fingerprint: input.fingerprint } : {},
+          // The human-proof attestation from the Crossdeck Trust browser panel.
+          // Verified server-side at the gate; its absence is scored, never a hard
+          // block on its own (fail-open). Only sent when the client supplied one.
+          ...input.token ? { challengeToken: input.token } : {}
         },
         signal: options?.signal,
         timeoutMs: options?.timeoutMs