@cross-deck/node 1.12.1 → 1.14.0

package/CHANGELOG.md

@@ -6,6 +6,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.14.0] — 2026-07-27
+
+- **`campaignLink()` — stamp an outbound email link so its click binds to the recipient's identity on landing.** You know the recipient's email at send time; pass it with the link's destination and Crossdeck returns the same URL carrying a one-time arrival ticket (`cd_ref`). Put the returned URL in the email (Resend, HubSpot, your own SMTP — any tool). When the recipient clicks and lands on a page running `@cross-deck/web`, the SDK reads the ticket automatically (v1.10.0+) and binds that session to the person, so the post-click journey joins their identity. Server-side only — it mints an identity bind, so it requires a secret key. Degrades honestly: without the web SDK on the landing page the deep session stitch softens, but the server-side email funnel still lands by identity. Wraps `POST /v1/campaign/email-link`.
+
+## [1.13.0] — 2026-07-26
+
+- **Crossdeck Trust — the gate now carries the browser's human-proof token.** `GateInput` gains an optional `token`: pass the attestation minted by the Crossdeck Trust panel in the browser (`Crossdeck.trust.panel(...)` / `<CrossdeckTrust>` in `@cross-deck/web`) and `gate()` forwards it as `challengeToken` to `/v1/trust/gate`, completing the SDK-native round trip. A real browser carries one; a server-to-server bot has none — that absence is scored, and in strict mode (`requireHumanProof`) a tokenless + suspicious attempt is the confident block. Optional and fail-open: omitting it never blocks on its own, and `gate()` remains fail-open by contract (a glitch returns `{ action: "allow", degraded: true }`, never a throw or a false block).
+
 ## [1.12.1] — 2026-07-23
 
 - **Reliability telemetry re-pointed to the live project.** The internal `crossdeck.contract_failed` self-check channel used a retired reliability-workspace key that had begun returning `401 invalid_api_key`, silently dropping failures; it now targets the live "Crossdeck Health Check" project. Internal SDK-health only — never touches your dashboard or your app. (No API changes; the anonymous-`reset()` hardening in the other SDKs does not apply — the Node SDK has no persistent device identity to churn.)

package/dist/auto-events/index.d.mts

@@ -1,4 +1,4 @@
-import { x as CrossdeckServer } from '../crossdeck-server-CuTGwrwx.mjs';
+import { z as CrossdeckServer } from '../crossdeck-server-NL1p6hlR.mjs';
 import 'node:events';
 
 /**

package/dist/auto-events/index.d.ts

@@ -1,4 +1,4 @@
-import { x as CrossdeckServer } from '../crossdeck-server-CuTGwrwx.js';
+import { z as CrossdeckServer } from '../crossdeck-server-NL1p6hlR.js';
 import 'node:events';
 
 /**

package/dist/{crossdeck-server-CuTGwrwx.d.mts → crossdeck-server-NL1p6hlR.d.mts}

@@ -549,6 +549,15 @@ interface GateInput {
     domain?: string;
     /** Optional device fingerprint — sharpens the composite signup score. */
     fingerprint?: string;
+    /**
+     * The human-proof attestation minted by the Crossdeck Trust panel in the browser
+     * (`Crossdeck.trust.panel(...)` / `<CrossdeckTrust>` in @cross-deck/web). Forward
+     * whatever the client delivered. A real browser carries one; a server-to-server
+     * bot has none — that absence is scored, and in strict mode (`requireHumanProof`)
+     * a tokenless + suspicious attempt is the confident block. Optional and fail-open:
+     * omitting it never blocks on its own.
+     */
+    token?: string;
 }
 /**
  * The signup-gate verdict from {@link CrossdeckServer.gate}. Fail-open: on any error these
@@ -645,6 +654,25 @@ interface AliasResult {
     mergePending: boolean;
     env: Environment;
 }
+/** Input to `campaignLink` — stamp an outbound email link with an identity-bind ticket. */
+interface CampaignLinkInput {
+    /** The recipient's email address. The person is resolved from it once, at stamp time.
+     *  Rides the request body only — never a URL/query (it is PII). */
+    email: string;
+    /** The absolute http(s) destination the recipient should land on. */
+    url: string;
+    /** Optional provenance for later enrichment (e.g. "resend", "hubspot"). Never required. */
+    rail?: string;
+}
+/** Result of `campaignLink` — the same destination with the arrival ticket appended. */
+interface CampaignLinkResult {
+    object: "campaign_link";
+    /** The stamped URL to put in the email. Carries only an opaque `cd_ref` ticket. */
+    url: string;
+    /** How long the ticket stays live (a campaign's useful life). */
+    expiresInDays: number;
+    env: Environment;
+}
 interface IngestResponse {
     object: "list";
     received: number;
@@ -1569,6 +1597,21 @@ declare class CrossdeckServer extends EventEmitter {
     identify(userId: string, anonymousId: string, options?: IdentifyOptions & RequestOptions): Promise<AliasResult>;
     aliasIdentity(input: AliasIdentityInput, options?: RequestOptions): Promise<AliasResult>;
     forget(hints: IdentityHints, options?: RequestOptions): Promise<ForgetResult>;
+    /**
+     * Stamp an outbound email link so its click binds to the recipient on landing.
+     *
+     * You know the recipient's email at send time; pass it with the link's destination
+     * and Crossdeck returns the same URL carrying a one-time arrival ticket (`cd_ref`).
+     * Put the returned URL in the email. When the recipient clicks and lands on a page
+     * running `@cross-deck/web`, the SDK reads the ticket automatically and binds that
+     * session to the person — the post-click journey then joins their identity.
+     *
+     * Rail-agnostic: works for Resend, HubSpot, your own SMTP, anything. Server-side
+     * only (it mints an identity bind, so a secret key is required). If the landing page
+     * has no Crossdeck web SDK, the deep session stitch softens but the server-side
+     * email funnel (via the rail adapter) still lands by identity.
+     */
+    campaignLink(input: CampaignLinkInput, options?: RequestOptions): Promise<CampaignLinkResult>;
     /**
      * Fetch a customer's entitlements from Crossdeck and warm the cache.
      *
@@ -2119,4 +2162,4 @@ declare class CrossdeckServer extends EventEmitter {
     private normalizeIngestEvent;
 }
 
-export { type IngestOptions as $, type AliasIdentityInput as A, type BlockVerdict as B, CROSSDECK_API_VERSION as C, DEFAULT_BASE_URL as D, DEFAULT_TIMEOUT_MS as E, type Diagnostics as F, type EntitlementCacheOptions as G, type EntitlementMutationResult as H, type EntitlementStore as I, type EntitlementsListResponse as J, type EntitlementsListener as K, type Environment as L, type ErrorCaptureConfig as M, type ErrorLevel as N, type EventProperties as O, type ForgetResult as P, type GateInput as Q, type GateVerdict as R, type GrantDuration as S, type GrantEntitlementInput as T, type GroupMembership as U, type HeartbeatResponse as V, type HttpRequestInfo as W, type HttpResponseInfo as X, type HttpRetriesConfig as Y, type IdentifyOptions as Z, type IdentityHints as _, type AliasResult as a, type IngestResponse as a0, type OwnerStatusInput as a1, type PublicEntitlement as a2, type PurchaseResult as a3, type RequestOptions as a4, type ResolveInput as a5, type ResolveResult as a6, type RevokeEntitlementInput as a7, type RuntimeHost as a8, type RuntimeInfo as a9, type ServerEvent as aa, type StackFrame as ab, type StoredEntitlements as ac, type SyncPurchaseInput as ad, makeCrossdeckError as ae, type AuditDecision as b, type AuditEntry as c, type Breadcrumb as d, type BreadcrumbCategory as e, type BreadcrumbLevel as f, type CapturedError as g, type Contract as h, type ContractAppliesTo as i, type ContractFailureInput as j, type ContractPillar as k, type ContractStatus as l, type ContractTestRef as m, CrossdeckAuthenticationError as n, CrossdeckConfigurationError as o, CrossdeckContracts as p, CrossdeckError as q, type CrossdeckErrorPayload as r, type CrossdeckErrorType as s, CrossdeckInternalError as t, CrossdeckNetworkError as u, CrossdeckPermissionError as v, CrossdeckRateLimitError as w, CrossdeckServer as x, type CrossdeckServerOptions as y, CrossdeckValidationError as z };
+export { type IdentifyOptions as $, type AliasIdentityInput as A, type BlockVerdict as B, CROSSDECK_API_VERSION as C, type CrossdeckServerOptions as D, CrossdeckValidationError as E, DEFAULT_BASE_URL as F, DEFAULT_TIMEOUT_MS as G, type Diagnostics as H, type EntitlementCacheOptions as I, type EntitlementMutationResult as J, type EntitlementStore as K, type EntitlementsListResponse as L, type EntitlementsListener as M, type Environment as N, type ErrorCaptureConfig as O, type ErrorLevel as P, type EventProperties as Q, type ForgetResult as R, type GateInput as S, type GateVerdict as T, type GrantDuration as U, type GrantEntitlementInput as V, type GroupMembership as W, type HeartbeatResponse as X, type HttpRequestInfo as Y, type HttpResponseInfo as Z, type HttpRetriesConfig as _, type AliasResult as a, type IdentityHints as a0, type IngestOptions as a1, type IngestResponse as a2, type OwnerStatusInput as a3, type PublicEntitlement as a4, type PurchaseResult as a5, type RequestOptions as a6, type ResolveInput as a7, type ResolveResult as a8, type RevokeEntitlementInput as a9, type RuntimeHost as aa, type RuntimeInfo as ab, type ServerEvent as ac, type StackFrame as ad, type StoredEntitlements as ae, type SyncPurchaseInput as af, makeCrossdeckError as ag, type AuditDecision as b, type AuditEntry as c, type Breadcrumb as d, type BreadcrumbCategory as e, type BreadcrumbLevel as f, type CampaignLinkInput as g, type CampaignLinkResult as h, type CapturedError as i, type Contract as j, type ContractAppliesTo as k, type ContractFailureInput as l, type ContractPillar as m, type ContractStatus as n, type ContractTestRef as o, CrossdeckAuthenticationError as p, CrossdeckConfigurationError as q, CrossdeckContracts as r, CrossdeckError as s, type CrossdeckErrorPayload as t, type CrossdeckErrorType as u, CrossdeckInternalError as v, CrossdeckNetworkError as w, CrossdeckPermissionError as x, CrossdeckRateLimitError as y, CrossdeckServer as z };

package/dist/{crossdeck-server-CuTGwrwx.d.ts → crossdeck-server-NL1p6hlR.d.ts}

@@ -549,6 +549,15 @@ interface GateInput {
     domain?: string;
     /** Optional device fingerprint — sharpens the composite signup score. */
     fingerprint?: string;
+    /**
+     * The human-proof attestation minted by the Crossdeck Trust panel in the browser
+     * (`Crossdeck.trust.panel(...)` / `<CrossdeckTrust>` in @cross-deck/web). Forward
+     * whatever the client delivered. A real browser carries one; a server-to-server
+     * bot has none — that absence is scored, and in strict mode (`requireHumanProof`)
+     * a tokenless + suspicious attempt is the confident block. Optional and fail-open:
+     * omitting it never blocks on its own.
+     */
+    token?: string;
 }
 /**
  * The signup-gate verdict from {@link CrossdeckServer.gate}. Fail-open: on any error these
@@ -645,6 +654,25 @@ interface AliasResult {
     mergePending: boolean;
     env: Environment;
 }
+/** Input to `campaignLink` — stamp an outbound email link with an identity-bind ticket. */
+interface CampaignLinkInput {
+    /** The recipient's email address. The person is resolved from it once, at stamp time.
+     *  Rides the request body only — never a URL/query (it is PII). */
+    email: string;
+    /** The absolute http(s) destination the recipient should land on. */
+    url: string;
+    /** Optional provenance for later enrichment (e.g. "resend", "hubspot"). Never required. */
+    rail?: string;
+}
+/** Result of `campaignLink` — the same destination with the arrival ticket appended. */
+interface CampaignLinkResult {
+    object: "campaign_link";
+    /** The stamped URL to put in the email. Carries only an opaque `cd_ref` ticket. */
+    url: string;
+    /** How long the ticket stays live (a campaign's useful life). */
+    expiresInDays: number;
+    env: Environment;
+}
 interface IngestResponse {
     object: "list";
     received: number;
@@ -1569,6 +1597,21 @@ declare class CrossdeckServer extends EventEmitter {
     identify(userId: string, anonymousId: string, options?: IdentifyOptions & RequestOptions): Promise<AliasResult>;
     aliasIdentity(input: AliasIdentityInput, options?: RequestOptions): Promise<AliasResult>;
     forget(hints: IdentityHints, options?: RequestOptions): Promise<ForgetResult>;
+    /**
+     * Stamp an outbound email link so its click binds to the recipient on landing.
+     *
+     * You know the recipient's email at send time; pass it with the link's destination
+     * and Crossdeck returns the same URL carrying a one-time arrival ticket (`cd_ref`).
+     * Put the returned URL in the email. When the recipient clicks and lands on a page
+     * running `@cross-deck/web`, the SDK reads the ticket automatically and binds that
+     * session to the person — the post-click journey then joins their identity.
+     *
+     * Rail-agnostic: works for Resend, HubSpot, your own SMTP, anything. Server-side
+     * only (it mints an identity bind, so a secret key is required). If the landing page
+     * has no Crossdeck web SDK, the deep session stitch softens but the server-side
+     * email funnel (via the rail adapter) still lands by identity.
+     */
+    campaignLink(input: CampaignLinkInput, options?: RequestOptions): Promise<CampaignLinkResult>;
     /**
      * Fetch a customer's entitlements from Crossdeck and warm the cache.
      *
@@ -2119,4 +2162,4 @@ declare class CrossdeckServer extends EventEmitter {
     private normalizeIngestEvent;
 }
 
-export { type IngestOptions as $, type AliasIdentityInput as A, type BlockVerdict as B, CROSSDECK_API_VERSION as C, DEFAULT_BASE_URL as D, DEFAULT_TIMEOUT_MS as E, type Diagnostics as F, type EntitlementCacheOptions as G, type EntitlementMutationResult as H, type EntitlementStore as I, type EntitlementsListResponse as J, type EntitlementsListener as K, type Environment as L, type ErrorCaptureConfig as M, type ErrorLevel as N, type EventProperties as O, type ForgetResult as P, type GateInput as Q, type GateVerdict as R, type GrantDuration as S, type GrantEntitlementInput as T, type GroupMembership as U, type HeartbeatResponse as V, type HttpRequestInfo as W, type HttpResponseInfo as X, type HttpRetriesConfig as Y, type IdentifyOptions as Z, type IdentityHints as _, type AliasResult as a, type IngestResponse as a0, type OwnerStatusInput as a1, type PublicEntitlement as a2, type PurchaseResult as a3, type RequestOptions as a4, type ResolveInput as a5, type ResolveResult as a6, type RevokeEntitlementInput as a7, type RuntimeHost as a8, type RuntimeInfo as a9, type ServerEvent as aa, type StackFrame as ab, type StoredEntitlements as ac, type SyncPurchaseInput as ad, makeCrossdeckError as ae, type AuditDecision as b, type AuditEntry as c, type Breadcrumb as d, type BreadcrumbCategory as e, type BreadcrumbLevel as f, type CapturedError as g, type Contract as h, type ContractAppliesTo as i, type ContractFailureInput as j, type ContractPillar as k, type ContractStatus as l, type ContractTestRef as m, CrossdeckAuthenticationError as n, CrossdeckConfigurationError as o, CrossdeckContracts as p, CrossdeckError as q, type CrossdeckErrorPayload as r, type CrossdeckErrorType as s, CrossdeckInternalError as t, CrossdeckNetworkError as u, CrossdeckPermissionError as v, CrossdeckRateLimitError as w, CrossdeckServer as x, type CrossdeckServerOptions as y, CrossdeckValidationError as z };
+export { type IdentifyOptions as $, type AliasIdentityInput as A, type BlockVerdict as B, CROSSDECK_API_VERSION as C, type CrossdeckServerOptions as D, CrossdeckValidationError as E, DEFAULT_BASE_URL as F, DEFAULT_TIMEOUT_MS as G, type Diagnostics as H, type EntitlementCacheOptions as I, type EntitlementMutationResult as J, type EntitlementStore as K, type EntitlementsListResponse as L, type EntitlementsListener as M, type Environment as N, type ErrorCaptureConfig as O, type ErrorLevel as P, type EventProperties as Q, type ForgetResult as R, type GateInput as S, type GateVerdict as T, type GrantDuration as U, type GrantEntitlementInput as V, type GroupMembership as W, type HeartbeatResponse as X, type HttpRequestInfo as Y, type HttpResponseInfo as Z, type HttpRetriesConfig as _, type AliasResult as a, type IdentityHints as a0, type IngestOptions as a1, type IngestResponse as a2, type OwnerStatusInput as a3, type PublicEntitlement as a4, type PurchaseResult as a5, type RequestOptions as a6, type ResolveInput as a7, type ResolveResult as a8, type RevokeEntitlementInput as a9, type RuntimeHost as aa, type RuntimeInfo as ab, type ServerEvent as ac, type StackFrame as ad, type StoredEntitlements as ae, type SyncPurchaseInput as af, makeCrossdeckError as ag, type AuditDecision as b, type AuditEntry as c, type Breadcrumb as d, type BreadcrumbCategory as e, type BreadcrumbLevel as f, type CampaignLinkInput as g, type CampaignLinkResult as h, type CapturedError as i, type Contract as j, type ContractAppliesTo as k, type ContractFailureInput as l, type ContractPillar as m, type ContractStatus as n, type ContractTestRef as o, CrossdeckAuthenticationError as p, CrossdeckConfigurationError as q, CrossdeckContracts as r, CrossdeckError as s, type CrossdeckErrorPayload as t, type CrossdeckErrorType as u, CrossdeckInternalError as v, CrossdeckNetworkError as w, CrossdeckPermissionError as x, CrossdeckRateLimitError as y, CrossdeckServer as z };

package/dist/index.cjs

@@ -387,7 +387,7 @@ function byteLength(s) {
 var https = __toESM(require("https"));
 
 // src/_version.ts
-var SDK_VERSION = "1.12.1";
+var SDK_VERSION = "1.14.0";
 var SDK_NAME = "@cross-deck/node";
 
 // src/_diagnostic-telemetry.ts
@@ -3048,6 +3048,43 @@ var CrossdeckServer = class extends import_node_events.EventEmitter {
       timeoutMs: options?.timeoutMs
     });
   }
+  /**
+   * Stamp an outbound email link so its click binds to the recipient on landing.
+   *
+   * You know the recipient's email at send time; pass it with the link's destination
+   * and Crossdeck returns the same URL carrying a one-time arrival ticket (`cd_ref`).
+   * Put the returned URL in the email. When the recipient clicks and lands on a page
+   * running `@cross-deck/web`, the SDK reads the ticket automatically and binds that
+   * session to the person — the post-click journey then joins their identity.
+   *
+   * Rail-agnostic: works for Resend, HubSpot, your own SMTP, anything. Server-side
+   * only (it mints an identity bind, so a secret key is required). If the landing page
+   * has no Crossdeck web SDK, the deep session stitch softens but the server-side
+   * email funnel (via the rail adapter) still lands by identity.
+   */
+  async campaignLink(input, options) {
+    if (!input.email) {
+      throw new CrossdeckError({
+        type: "invalid_request_error",
+        code: "missing_email",
+        message: "campaignLink requires the recipient's email."
+      });
+    }
+    if (!input.url) {
+      throw new CrossdeckError({
+        type: "invalid_request_error",
+        code: "missing_url",
+        message: "campaignLink requires the link's destination url."
+      });
+    }
+    const body = { email: input.email, url: input.url };
+    if (input.rail) body.rail = input.rail;
+    return this.http.request("POST", "/campaign/email-link", {
+      body,
+      signal: options?.signal,
+      timeoutMs: options?.timeoutMs
+    });
+  }
   // ============================================================
   // Entitlements — direct HTTP + TTL cache (v1.0.0+)
   //
@@ -3309,7 +3346,11 @@ var CrossdeckServer = class extends import_node_events.EventEmitter {
           ...input.email ? { email: input.email } : {},
           ...input.ip ? { ip: input.ip } : {},
           ...input.domain ? { domain: input.domain } : {},
-          ...input.fingerprint ? { fingerprint: input.fingerprint } : {}
+          ...input.fingerprint ? { fingerprint: input.fingerprint } : {},
+          // The human-proof attestation from the Crossdeck Trust browser panel.
+          // Verified server-side at the gate; its absence is scored, never a hard
+          // block on its own (fail-open). Only sent when the client supplied one.
+          ...input.token ? { challengeToken: input.token } : {}
         },
         signal: options?.signal,
         timeoutMs: options?.timeoutMs