@cross-deck/node 1.9.1 → 1.10.0

package/CHANGELOG.md

@@ -6,6 +6,29 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.10.0] — 2026-06-30
+
+**Added — the blocking surface (Crossdeck Trust, v2 preview).** Blocking is
+"entitlements, inverted": `getEntitlements()` answers *can they access Pro?*; the new
+methods answer *should they be here at all?* — the same `/v1/resolve` plumbing, read for
+`blocked`. Additive and non-breaking.
+
+- **`resolve(input)`** → `ResolveResult` — the block verdict plus identity/entitlement
+  context in one call. **Fail-open by contract:** never throws for the verdict and never
+  returns `blocked: true` on uncertainty; any error → `{ blocked: false, degraded: true }`,
+  so a glitch can never lock out a real user (the mirror of entitlements, which fail
+  closed). Forward the end-user's `ip` (server-to-server callers otherwise expose only
+  their own server IP, so ip-rules can't match) and the verified identity
+  (`userId` + `idToken`) so domain/email rules can match.
+- **`isBlocked(input)`** → `boolean` — convenience over `resolve()`; same fail-open.
+- **`getOwnerStatus(input)`** → `BlockVerdict` — the public-page path: *"is the owner of
+  this page blocked?"*, no session token, for cache invalidation on link-in-bio / content
+  platforms (Pattern B).
+
+New exported types: `ResolveInput`, `ResolveResult`, `BlockVerdict`, `OwnerStatusInput`.
+All marked `@experimental` — Crossdeck Trust ships with Crossdeck v2; the shape is stable,
+the surface is not yet GA.
+
 ## [1.9.1] — 2026-06-30
 
 **Docs — knowledge-backbone governance release.** No runtime API change. This

package/README.md

@@ -614,8 +614,8 @@ CrossdeckContracts.byId("idempotency-key-deterministic");
 CrossdeckContracts.byPillar("revenue");
 CrossdeckContracts.withStatus("proposed");
 CrossdeckContracts.findByTestName("rail namespacing prevents cross-rail collisions");
-CrossdeckContracts.sdkVersion;        // "1.9.0"
-CrossdeckContracts.bundledIn;         // "@cross-deck/node@1.9.0"
+CrossdeckContracts.sdkVersion;        // "1.10.0"
+CrossdeckContracts.bundledIn;         // "@cross-deck/node@1.10.0"
 ```
 
 The `Contract` type is exported alongside; the binary-stability promise is documented in [`contracts/README.md`](https://github.com/VistaApps-za/crossdeck/blob/main/contracts/README.md).

package/dist/auto-events/index.d.mts

@@ -1,4 +1,4 @@
-import { w as CrossdeckServer } from '../crossdeck-server-Q3CYJC4Z.mjs';
+import { x as CrossdeckServer } from '../crossdeck-server-C4nWPQzH.mjs';
 import 'node:events';
 
 /**

package/dist/auto-events/index.d.ts

@@ -1,4 +1,4 @@
-import { w as CrossdeckServer } from '../crossdeck-server-Q3CYJC4Z.js';
+import { x as CrossdeckServer } from '../crossdeck-server-C4nWPQzH.js';
 import 'node:events';
 
 /**

package/dist/{crossdeck-server-Q3CYJC4Z.d.mts → crossdeck-server-C4nWPQzH.d.mts}

@@ -183,8 +183,8 @@ declare const CrossdeckContracts: {
     readonly byId: (id: string) => Contract | undefined;
     readonly byPillar: (pillar: ContractPillar) => readonly Contract[];
     readonly withStatus: (status: ContractStatus) => readonly Contract[];
-    readonly sdkVersion: "1.8.2";
-    readonly bundledIn: "@cross-deck/node@1.8.2";
+    readonly sdkVersion: "1.10.0";
+    readonly bundledIn: "@cross-deck/node@1.10.0";
     /**
      * Resolve a failing test back to the contract it exercises.
      * Used by test-framework hooks to find the contract id of a
@@ -438,6 +438,82 @@ interface EntitlementsListResponse {
     crossdeckCustomerId: string;
     env: Environment;
 }
+/**
+ * Identity for {@link CrossdeckServer.resolve} / {@link CrossdeckServer.isBlocked}.
+ * Send the END USER's identity, not your server's.
+ *
+ * @experimental Preview — Crossdeck Trust ships with Crossdeck v2. Shape is stable; the
+ * surface is not yet GA.
+ */
+interface ResolveInput {
+    /** Your signed-in user id. */
+    userId?: string;
+    /** A SIGNED proof of that user (e.g. their Firebase ID token). Required alongside `userId` for the verified path. */
+    idToken?: string;
+    /** Anonymous device id (the Web SDK's `getAnonymousId()`). Folds a pre-login device. */
+    anonymousId?: string;
+    /**
+     * The END USER's IP. Forward it — you call resolve server-to-server, so without it
+     * Crossdeck sees YOUR server's IP and an ip-rule can't match the visitor.
+     */
+    ip?: string;
+}
+/**
+ * The block verdict. Fail-open: on any error these come back `{ blocked: false }`,
+ * never an exception — a glitch can never lock out a real user (the mirror of
+ * entitlements, which fail closed).
+ *
+ * @experimental Preview — see {@link ResolveInput}.
+ */
+interface BlockVerdict {
+    /** True ONLY when Crossdeck holds an explicit block on this identity. */
+    blocked: boolean;
+    /** Why, when blocked: e.g. `"blocklist:domain"` | `"blocklist:ip"` | `"blocked"`. */
+    blockReason: string | null;
+    /** The exact rule that fired: `"domain:spartan.net"` | `"ip:1.2.3.4"` | `"manual"` | null. */
+    blockedKey: string | null;
+    /**
+     * True when this is the fail-open default (Crossdeck unreachable / identity unresolved).
+     * `blocked` is `false`; log it for observability, never treat it as a real "not blocked".
+     */
+    degraded?: boolean;
+}
+/**
+ * The full {@link CrossdeckServer.resolve} result — the block verdict plus the identity /
+ * entitlement context, so one call answers "should they be here?" and "what can they
+ * access?" together.
+ *
+ * @experimental Preview — see {@link ResolveInput}.
+ */
+interface ResolveResult extends BlockVerdict {
+    /** `"active"` | `"anonymous"` | … the resolved identity status. */
+    status: string;
+    /** Active entitlement keys for this identity (e.g. `["pro"]`). */
+    entitlements: string[];
+    /** The canonical Crossdeck customer id, when resolved. */
+    crossdeckCustomerId: string | null;
+    /** The anonymous id Crossdeck resolved / assigned. */
+    anonymousId: string | null;
+    /**
+     * Set when a verified identity was sent but couldn't be checked (e.g. the auth issuer
+     * isn't registered). If you sent `userId`+`idToken` and `status` is `"anonymous"`, read this.
+     */
+    identityError: {
+        reason: string;
+    } | null;
+}
+/**
+ * Owner identifiers for {@link CrossdeckServer.getOwnerStatus} — the public-page path.
+ * Pass any subset; for a page-offline check the `ip` is the owner's CREATION ip.
+ *
+ * @experimental Preview — see {@link ResolveInput}.
+ */
+interface OwnerStatusInput {
+    userId?: string;
+    email?: string;
+    domain?: string;
+    ip?: string;
+}
 /**
  * Snapshot of one customer's last-known-good entitlements, as written
  * to / read from a durable `EntitlementStore`. Versioned for forward-
@@ -1456,6 +1532,40 @@ declare class CrossdeckServer extends EventEmitter {
      */
     getEntitlements(hints: IdentityHints, options?: RequestOptions): Promise<EntitlementsListResponse>;
     getCustomerEntitlements(customerId: string, options?: RequestOptions): Promise<EntitlementsListResponse>;
+    /**
+     * Resolve a user's BLOCK verdict (plus identity / entitlement context) — the same
+     * `/v1/resolve` you'd call for entitlements, read for `blocked`. Wire it into signup
+     * and every visit; on `blocked`, sign the user out (and, for public content, take
+     * their pages offline — see the Blocking developer guide, Pattern B).
+     *
+     * **Fail-open is the contract.** This never throws for the block decision and never
+     * returns `blocked: true` on uncertainty. Any error — Crossdeck unreachable, timeout,
+     * unresolved identity — yields `{ blocked: false, degraded: true }`, so a glitch can
+     * never lock out a real user.
+     *
+     * Forward the END USER's `ip` (you call this server-to-server, so otherwise Crossdeck
+     * sees your server's IP and an ip-rule can't match the visitor), and the verified
+     * identity (`userId` + `idToken`) so a `domain`/`email` rule can match the email.
+     *
+     * @experimental Preview — Crossdeck Trust ships with Crossdeck v2. Stable shape, not yet GA.
+     */
+    resolve(input: ResolveInput, options?: RequestOptions): Promise<ResolveResult>;
+    /**
+     * Convenience over {@link resolve}: just the boolean. Fail-open (false on any error).
+     *
+     * @experimental Preview — see {@link resolve}.
+     */
+    isBlocked(input: ResolveInput, options?: RequestOptions): Promise<boolean>;
+    /**
+     * The OWNER's block verdict for the public-page path (Pattern B / §5b of the Blocking
+     * developer guide) — "is the owner of this page blocked?", no session token required.
+     * Pass the owner's recorded identifiers (`userId`/`email`/`domain`/`ip`; the `ip` is
+     * their CREATION ip, not a live visitor's). Poll on a short TTL to invalidate your
+     * public-page cache. Fail-open — any error → `{ blocked: false, degraded: true }`.
+     *
+     * @experimental Preview — see {@link resolve}.
+     */
+    getOwnerStatus(input: OwnerStatusInput, options?: RequestOptions): Promise<BlockVerdict>;
     /**
      * Synchronous entitlement check. Returns `true` iff the customer
      * has the entitlement AND the cache entry is fresh (within
@@ -1935,4 +2045,4 @@ declare class CrossdeckServer extends EventEmitter {
     private normalizeIngestEvent;
 }
 
-export { type PurchaseResult as $, type AliasIdentityInput as A, type Breadcrumb as B, CROSSDECK_API_VERSION as C, DEFAULT_BASE_URL as D, type Diagnostics as E, type EntitlementCacheOptions as F, type EntitlementMutationResult as G, type EntitlementStore as H, type EntitlementsListResponse as I, type EntitlementsListener as J, type Environment as K, type ErrorCaptureConfig as L, type ErrorLevel as M, type EventProperties as N, type ForgetResult as O, type GrantDuration as P, type GrantEntitlementInput as Q, type GroupMembership as R, type HeartbeatResponse as S, type HttpRequestInfo as T, type HttpResponseInfo as U, type HttpRetriesConfig as V, type IdentifyOptions as W, type IdentityHints as X, type IngestOptions as Y, type IngestResponse as Z, type PublicEntitlement as _, type AliasResult as a, type RequestOptions as a0, type RevokeEntitlementInput as a1, type RuntimeHost as a2, type RuntimeInfo as a3, type ServerEvent as a4, type StackFrame as a5, type StoredEntitlements as a6, type SyncPurchaseInput as a7, makeCrossdeckError as a8, type AuditDecision as b, type AuditEntry as c, type BreadcrumbCategory as d, type BreadcrumbLevel as e, type CapturedError as f, type Contract as g, type ContractAppliesTo as h, type ContractFailureInput as i, type ContractPillar as j, type ContractStatus as k, type ContractTestRef as l, CrossdeckAuthenticationError as m, CrossdeckConfigurationError as n, CrossdeckContracts as o, CrossdeckError as p, type CrossdeckErrorPayload as q, type CrossdeckErrorType as r, CrossdeckInternalError as s, CrossdeckNetworkError as t, CrossdeckPermissionError as u, CrossdeckRateLimitError as v, CrossdeckServer as w, type CrossdeckServerOptions as x, CrossdeckValidationError as y, DEFAULT_TIMEOUT_MS as z };
+export { type OwnerStatusInput as $, type AliasIdentityInput as A, type BlockVerdict as B, CROSSDECK_API_VERSION as C, DEFAULT_BASE_URL as D, DEFAULT_TIMEOUT_MS as E, type Diagnostics as F, type EntitlementCacheOptions as G, type EntitlementMutationResult as H, type EntitlementStore as I, type EntitlementsListResponse as J, type EntitlementsListener as K, type Environment as L, type ErrorCaptureConfig as M, type ErrorLevel as N, type EventProperties as O, type ForgetResult as P, type GrantDuration as Q, type GrantEntitlementInput as R, type GroupMembership as S, type HeartbeatResponse as T, type HttpRequestInfo as U, type HttpResponseInfo as V, type HttpRetriesConfig as W, type IdentifyOptions as X, type IdentityHints as Y, type IngestOptions as Z, type IngestResponse as _, type AliasResult as a, type PublicEntitlement as a0, type PurchaseResult as a1, type RequestOptions as a2, type ResolveInput as a3, type ResolveResult as a4, type RevokeEntitlementInput as a5, type RuntimeHost as a6, type RuntimeInfo as a7, type ServerEvent as a8, type StackFrame as a9, type StoredEntitlements as aa, type SyncPurchaseInput as ab, makeCrossdeckError as ac, type AuditDecision as b, type AuditEntry as c, type Breadcrumb as d, type BreadcrumbCategory as e, type BreadcrumbLevel as f, type CapturedError as g, type Contract as h, type ContractAppliesTo as i, type ContractFailureInput as j, type ContractPillar as k, type ContractStatus as l, type ContractTestRef as m, CrossdeckAuthenticationError as n, CrossdeckConfigurationError as o, CrossdeckContracts as p, CrossdeckError as q, type CrossdeckErrorPayload as r, type CrossdeckErrorType as s, CrossdeckInternalError as t, CrossdeckNetworkError as u, CrossdeckPermissionError as v, CrossdeckRateLimitError as w, CrossdeckServer as x, type CrossdeckServerOptions as y, CrossdeckValidationError as z };

package/dist/{crossdeck-server-Q3CYJC4Z.d.ts → crossdeck-server-C4nWPQzH.d.ts}

@@ -183,8 +183,8 @@ declare const CrossdeckContracts: {
     readonly byId: (id: string) => Contract | undefined;
     readonly byPillar: (pillar: ContractPillar) => readonly Contract[];
     readonly withStatus: (status: ContractStatus) => readonly Contract[];
-    readonly sdkVersion: "1.8.2";
-    readonly bundledIn: "@cross-deck/node@1.8.2";
+    readonly sdkVersion: "1.10.0";
+    readonly bundledIn: "@cross-deck/node@1.10.0";
     /**
      * Resolve a failing test back to the contract it exercises.
      * Used by test-framework hooks to find the contract id of a
@@ -438,6 +438,82 @@ interface EntitlementsListResponse {
     crossdeckCustomerId: string;
     env: Environment;
 }
+/**
+ * Identity for {@link CrossdeckServer.resolve} / {@link CrossdeckServer.isBlocked}.
+ * Send the END USER's identity, not your server's.
+ *
+ * @experimental Preview — Crossdeck Trust ships with Crossdeck v2. Shape is stable; the
+ * surface is not yet GA.
+ */
+interface ResolveInput {
+    /** Your signed-in user id. */
+    userId?: string;
+    /** A SIGNED proof of that user (e.g. their Firebase ID token). Required alongside `userId` for the verified path. */
+    idToken?: string;
+    /** Anonymous device id (the Web SDK's `getAnonymousId()`). Folds a pre-login device. */
+    anonymousId?: string;
+    /**
+     * The END USER's IP. Forward it — you call resolve server-to-server, so without it
+     * Crossdeck sees YOUR server's IP and an ip-rule can't match the visitor.
+     */
+    ip?: string;
+}
+/**
+ * The block verdict. Fail-open: on any error these come back `{ blocked: false }`,
+ * never an exception — a glitch can never lock out a real user (the mirror of
+ * entitlements, which fail closed).
+ *
+ * @experimental Preview — see {@link ResolveInput}.
+ */
+interface BlockVerdict {
+    /** True ONLY when Crossdeck holds an explicit block on this identity. */
+    blocked: boolean;
+    /** Why, when blocked: e.g. `"blocklist:domain"` | `"blocklist:ip"` | `"blocked"`. */
+    blockReason: string | null;
+    /** The exact rule that fired: `"domain:spartan.net"` | `"ip:1.2.3.4"` | `"manual"` | null. */
+    blockedKey: string | null;
+    /**
+     * True when this is the fail-open default (Crossdeck unreachable / identity unresolved).
+     * `blocked` is `false`; log it for observability, never treat it as a real "not blocked".
+     */
+    degraded?: boolean;
+}
+/**
+ * The full {@link CrossdeckServer.resolve} result — the block verdict plus the identity /
+ * entitlement context, so one call answers "should they be here?" and "what can they
+ * access?" together.
+ *
+ * @experimental Preview — see {@link ResolveInput}.
+ */
+interface ResolveResult extends BlockVerdict {
+    /** `"active"` | `"anonymous"` | … the resolved identity status. */
+    status: string;
+    /** Active entitlement keys for this identity (e.g. `["pro"]`). */
+    entitlements: string[];
+    /** The canonical Crossdeck customer id, when resolved. */
+    crossdeckCustomerId: string | null;
+    /** The anonymous id Crossdeck resolved / assigned. */
+    anonymousId: string | null;
+    /**
+     * Set when a verified identity was sent but couldn't be checked (e.g. the auth issuer
+     * isn't registered). If you sent `userId`+`idToken` and `status` is `"anonymous"`, read this.
+     */
+    identityError: {
+        reason: string;
+    } | null;
+}
+/**
+ * Owner identifiers for {@link CrossdeckServer.getOwnerStatus} — the public-page path.
+ * Pass any subset; for a page-offline check the `ip` is the owner's CREATION ip.
+ *
+ * @experimental Preview — see {@link ResolveInput}.
+ */
+interface OwnerStatusInput {
+    userId?: string;
+    email?: string;
+    domain?: string;
+    ip?: string;
+}
 /**
  * Snapshot of one customer's last-known-good entitlements, as written
  * to / read from a durable `EntitlementStore`. Versioned for forward-
@@ -1456,6 +1532,40 @@ declare class CrossdeckServer extends EventEmitter {
      */
     getEntitlements(hints: IdentityHints, options?: RequestOptions): Promise<EntitlementsListResponse>;
     getCustomerEntitlements(customerId: string, options?: RequestOptions): Promise<EntitlementsListResponse>;
+    /**
+     * Resolve a user's BLOCK verdict (plus identity / entitlement context) — the same
+     * `/v1/resolve` you'd call for entitlements, read for `blocked`. Wire it into signup
+     * and every visit; on `blocked`, sign the user out (and, for public content, take
+     * their pages offline — see the Blocking developer guide, Pattern B).
+     *
+     * **Fail-open is the contract.** This never throws for the block decision and never
+     * returns `blocked: true` on uncertainty. Any error — Crossdeck unreachable, timeout,
+     * unresolved identity — yields `{ blocked: false, degraded: true }`, so a glitch can
+     * never lock out a real user.
+     *
+     * Forward the END USER's `ip` (you call this server-to-server, so otherwise Crossdeck
+     * sees your server's IP and an ip-rule can't match the visitor), and the verified
+     * identity (`userId` + `idToken`) so a `domain`/`email` rule can match the email.
+     *
+     * @experimental Preview — Crossdeck Trust ships with Crossdeck v2. Stable shape, not yet GA.
+     */
+    resolve(input: ResolveInput, options?: RequestOptions): Promise<ResolveResult>;
+    /**
+     * Convenience over {@link resolve}: just the boolean. Fail-open (false on any error).
+     *
+     * @experimental Preview — see {@link resolve}.
+     */
+    isBlocked(input: ResolveInput, options?: RequestOptions): Promise<boolean>;
+    /**
+     * The OWNER's block verdict for the public-page path (Pattern B / §5b of the Blocking
+     * developer guide) — "is the owner of this page blocked?", no session token required.
+     * Pass the owner's recorded identifiers (`userId`/`email`/`domain`/`ip`; the `ip` is
+     * their CREATION ip, not a live visitor's). Poll on a short TTL to invalidate your
+     * public-page cache. Fail-open — any error → `{ blocked: false, degraded: true }`.
+     *
+     * @experimental Preview — see {@link resolve}.
+     */
+    getOwnerStatus(input: OwnerStatusInput, options?: RequestOptions): Promise<BlockVerdict>;
     /**
      * Synchronous entitlement check. Returns `true` iff the customer
      * has the entitlement AND the cache entry is fresh (within
@@ -1935,4 +2045,4 @@ declare class CrossdeckServer extends EventEmitter {
     private normalizeIngestEvent;
 }
 
-export { type PurchaseResult as $, type AliasIdentityInput as A, type Breadcrumb as B, CROSSDECK_API_VERSION as C, DEFAULT_BASE_URL as D, type Diagnostics as E, type EntitlementCacheOptions as F, type EntitlementMutationResult as G, type EntitlementStore as H, type EntitlementsListResponse as I, type EntitlementsListener as J, type Environment as K, type ErrorCaptureConfig as L, type ErrorLevel as M, type EventProperties as N, type ForgetResult as O, type GrantDuration as P, type GrantEntitlementInput as Q, type GroupMembership as R, type HeartbeatResponse as S, type HttpRequestInfo as T, type HttpResponseInfo as U, type HttpRetriesConfig as V, type IdentifyOptions as W, type IdentityHints as X, type IngestOptions as Y, type IngestResponse as Z, type PublicEntitlement as _, type AliasResult as a, type RequestOptions as a0, type RevokeEntitlementInput as a1, type RuntimeHost as a2, type RuntimeInfo as a3, type ServerEvent as a4, type StackFrame as a5, type StoredEntitlements as a6, type SyncPurchaseInput as a7, makeCrossdeckError as a8, type AuditDecision as b, type AuditEntry as c, type BreadcrumbCategory as d, type BreadcrumbLevel as e, type CapturedError as f, type Contract as g, type ContractAppliesTo as h, type ContractFailureInput as i, type ContractPillar as j, type ContractStatus as k, type ContractTestRef as l, CrossdeckAuthenticationError as m, CrossdeckConfigurationError as n, CrossdeckContracts as o, CrossdeckError as p, type CrossdeckErrorPayload as q, type CrossdeckErrorType as r, CrossdeckInternalError as s, CrossdeckNetworkError as t, CrossdeckPermissionError as u, CrossdeckRateLimitError as v, CrossdeckServer as w, type CrossdeckServerOptions as x, CrossdeckValidationError as y, DEFAULT_TIMEOUT_MS as z };
+export { type OwnerStatusInput as $, type AliasIdentityInput as A, type BlockVerdict as B, CROSSDECK_API_VERSION as C, DEFAULT_BASE_URL as D, DEFAULT_TIMEOUT_MS as E, type Diagnostics as F, type EntitlementCacheOptions as G, type EntitlementMutationResult as H, type EntitlementStore as I, type EntitlementsListResponse as J, type EntitlementsListener as K, type Environment as L, type ErrorCaptureConfig as M, type ErrorLevel as N, type EventProperties as O, type ForgetResult as P, type GrantDuration as Q, type GrantEntitlementInput as R, type GroupMembership as S, type HeartbeatResponse as T, type HttpRequestInfo as U, type HttpResponseInfo as V, type HttpRetriesConfig as W, type IdentifyOptions as X, type IdentityHints as Y, type IngestOptions as Z, type IngestResponse as _, type AliasResult as a, type PublicEntitlement as a0, type PurchaseResult as a1, type RequestOptions as a2, type ResolveInput as a3, type ResolveResult as a4, type RevokeEntitlementInput as a5, type RuntimeHost as a6, type RuntimeInfo as a7, type ServerEvent as a8, type StackFrame as a9, type StoredEntitlements as aa, type SyncPurchaseInput as ab, makeCrossdeckError as ac, type AuditDecision as b, type AuditEntry as c, type Breadcrumb as d, type BreadcrumbCategory as e, type BreadcrumbLevel as f, type CapturedError as g, type Contract as h, type ContractAppliesTo as i, type ContractFailureInput as j, type ContractPillar as k, type ContractStatus as l, type ContractTestRef as m, CrossdeckAuthenticationError as n, CrossdeckConfigurationError as o, CrossdeckContracts as p, CrossdeckError as q, type CrossdeckErrorPayload as r, type CrossdeckErrorType as s, CrossdeckInternalError as t, CrossdeckNetworkError as u, CrossdeckPermissionError as v, CrossdeckRateLimitError as w, CrossdeckServer as x, type CrossdeckServerOptions as y, CrossdeckValidationError as z };

package/dist/index.cjs

@@ -387,7 +387,7 @@ function byteLength(s) {
 var https = __toESM(require("https"));
 
 // src/_version.ts
-var SDK_VERSION = "1.9.1";
+var SDK_VERSION = "1.10.0";
 var SDK_NAME = "@cross-deck/node";
 
 // src/_diagnostic-telemetry.ts
@@ -3149,6 +3149,130 @@ var CrossdeckServer = class extends import_node_events.EventEmitter {
     this.populateEntitlementCache({ customerId }, response);
     return response;
   }
+  // ── Blocking — "entitlements, inverted" (Crossdeck Trust, v2 preview) ───────
+  //
+  // getEntitlements() answers "can they access Pro?"; resolve() answers "should
+  // they be here at all?". Same call, opposite question. Both read Crossdeck live.
+  // The safety inversion: entitlements fail CLOSED (protect revenue); blocking
+  // fails OPEN (protect real users) — these methods NEVER throw for the verdict
+  // and NEVER return blocked:true on uncertainty.
+  /**
+   * Resolve a user's BLOCK verdict (plus identity / entitlement context) — the same
+   * `/v1/resolve` you'd call for entitlements, read for `blocked`. Wire it into signup
+   * and every visit; on `blocked`, sign the user out (and, for public content, take
+   * their pages offline — see the Blocking developer guide, Pattern B).
+   *
+   * **Fail-open is the contract.** This never throws for the block decision and never
+   * returns `blocked: true` on uncertainty. Any error — Crossdeck unreachable, timeout,
+   * unresolved identity — yields `{ blocked: false, degraded: true }`, so a glitch can
+   * never lock out a real user.
+   *
+   * Forward the END USER's `ip` (you call this server-to-server, so otherwise Crossdeck
+   * sees your server's IP and an ip-rule can't match the visitor), and the verified
+   * identity (`userId` + `idToken`) so a `domain`/`email` rule can match the email.
+   *
+   * @experimental Preview — Crossdeck Trust ships with Crossdeck v2. Stable shape, not yet GA.
+   */
+  async resolve(input, options) {
+    const failOpen = () => ({
+      blocked: false,
+      blockReason: null,
+      blockedKey: null,
+      degraded: true,
+      status: "anonymous",
+      entitlements: [],
+      crossdeckCustomerId: null,
+      anonymousId: input?.anonymousId ?? null,
+      identityError: null
+    });
+    if (!input || !input.anonymousId && !(input.userId && input.idToken)) {
+      this.debug.emit(
+        "sdk.resolve_missing_identity",
+        "resolve() needs anonymousId OR (userId + idToken); returning fail-open blocked:false."
+      );
+      return failOpen();
+    }
+    try {
+      const raw = await this.http.request("POST", "/resolve", {
+        body: {
+          ...input.userId ? { userId: input.userId } : {},
+          ...input.idToken ? { idToken: input.idToken } : {},
+          ...input.anonymousId ? { anonymousId: input.anonymousId } : {},
+          ...input.ip ? { ip: input.ip } : {}
+        },
+        signal: options?.signal,
+        timeoutMs: options?.timeoutMs
+      });
+      return {
+        blocked: raw.blocked === true,
+        blockReason: raw.blockReason ?? null,
+        blockedKey: raw.blockedKey ?? null,
+        status: typeof raw.status === "string" ? raw.status : "active",
+        entitlements: Array.isArray(raw.entitlements) ? raw.entitlements.filter((e) => typeof e === "string") : [],
+        crossdeckCustomerId: raw.crossdeckCustomerId ?? raw.user?.id ?? null,
+        anonymousId: raw.anonymousId ?? input.anonymousId ?? null,
+        identityError: raw.identityError ?? null
+      };
+    } catch (err) {
+      this.debug.emit(
+        "sdk.resolve_failed",
+        `resolve() failed \u2014 fail-open blocked:false. ${err instanceof Error ? err.message : String(err)}`,
+        { error: err instanceof Error ? err.message : String(err) }
+      );
+      return failOpen();
+    }
+  }
+  /**
+   * Convenience over {@link resolve}: just the boolean. Fail-open (false on any error).
+   *
+   * @experimental Preview — see {@link resolve}.
+   */
+  async isBlocked(input, options) {
+    return (await this.resolve(input, options)).blocked;
+  }
+  /**
+   * The OWNER's block verdict for the public-page path (Pattern B / §5b of the Blocking
+   * developer guide) — "is the owner of this page blocked?", no session token required.
+   * Pass the owner's recorded identifiers (`userId`/`email`/`domain`/`ip`; the `ip` is
+   * their CREATION ip, not a live visitor's). Poll on a short TTL to invalidate your
+   * public-page cache. Fail-open — any error → `{ blocked: false, degraded: true }`.
+   *
+   * @experimental Preview — see {@link resolve}.
+   */
+  async getOwnerStatus(input, options) {
+    const query = {
+      userId: input?.userId || void 0,
+      email: input?.email || void 0,
+      domain: input?.domain || void 0,
+      ip: input?.ip || void 0
+    };
+    if (!query.userId && !query.email && !query.domain && !query.ip) {
+      this.debug.emit(
+        "sdk.owner_status_missing_identity",
+        "getOwnerStatus() needs at least one of userId/email/domain/ip; returning fail-open blocked:false."
+      );
+      return { blocked: false, blockReason: null, blockedKey: null, degraded: true };
+    }
+    try {
+      const raw = await this.http.request("GET", "/trust/status", {
+        query,
+        signal: options?.signal,
+        timeoutMs: options?.timeoutMs
+      });
+      return {
+        blocked: raw.blocked === true,
+        blockReason: raw.blockReason ?? null,
+        blockedKey: raw.blockedKey ?? null
+      };
+    } catch (err) {
+      this.debug.emit(
+        "sdk.owner_status_failed",
+        `getOwnerStatus() failed \u2014 fail-open blocked:false. ${err instanceof Error ? err.message : String(err)}`,
+        { error: err instanceof Error ? err.message : String(err) }
+      );
+      return { blocked: false, blockReason: null, blockedKey: null, degraded: true };
+    }
+  }
   /**
    * Synchronous entitlement check. Returns `true` iff the customer
    * has the entitlement AND the cache entry is fresh (within
@@ -4596,8 +4720,8 @@ function normaliseSecrets(input) {
 }
 
 // src/_contracts-bundled.ts
-var BUNDLED_IN = "@cross-deck/node@1.8.2";
-var SDK_VERSION2 = "1.8.2";
+var BUNDLED_IN = "@cross-deck/node@1.10.0";
+var SDK_VERSION2 = "1.10.0";
 var BUNDLED_CONTRACTS = Object.freeze([
   {
     "id": "contract-failed-payload-schema-lock",
@@ -4719,7 +4843,7 @@ var BUNDLED_CONTRACTS = Object.freeze([
       "legal/security/index.html#diagnostic",
       "legal/sdk-data/index.html#b-diagnostic"
     ],
-    "bundledIn": "@cross-deck/node@1.8.2"
+    "bundledIn": "@cross-deck/node@1.10.0"
   },
   {
     "id": "documentation-honesty",
@@ -4751,7 +4875,7 @@ var BUNDLED_CONTRACTS = Object.freeze([
     ],
     "registeredAt": "2026-05-26",
     "firstRegisteredIn": "bank-grade reconciliation v1.4.0 \u2014 phase 7.1",
-    "bundledIn": "@cross-deck/node@1.8.2"
+    "bundledIn": "@cross-deck/node@1.10.0"
   },
   {
     "id": "error-envelope-shape",
@@ -4790,7 +4914,7 @@ var BUNDLED_CONTRACTS = Object.freeze([
     ],
     "registeredAt": "2026-05-26",
     "firstRegisteredIn": "bank-grade reconciliation v1.4.0 \u2014 phase 8 (codifies existing contract)",
-    "bundledIn": "@cross-deck/node@1.8.2"
+    "bundledIn": "@cross-deck/node@1.10.0"
   },
   {
     "id": "flush-interval-parity",
@@ -4835,7 +4959,7 @@ var BUNDLED_CONTRACTS = Object.freeze([
     ],
     "registeredAt": "2026-05-26",
     "firstRegisteredIn": "bank-grade reconciliation v1.4.0 \u2014 phase 3.3",
-    "bundledIn": "@cross-deck/node@1.8.2"
+    "bundledIn": "@cross-deck/node@1.10.0"
   },
   {
     "id": "idempotency-key-deterministic",
@@ -4940,7 +5064,7 @@ var BUNDLED_CONTRACTS = Object.freeze([
     ],
     "registeredAt": "2026-05-26",
     "firstRegisteredIn": "bank-grade reconciliation v1.4.0 \u2014 phase 2.2.a + 2.2.b + 2.2.c",
-    "bundledIn": "@cross-deck/node@1.8.2"
+    "bundledIn": "@cross-deck/node@1.10.0"
   },
   {
     "id": "invalid-input-rejected-natively",
@@ -4996,7 +5120,7 @@ var BUNDLED_CONTRACTS = Object.freeze([
     ],
     "registeredAt": "2026-06-11",
     "firstRegisteredIn": "swift trap-on-input class fix \u2014 first machine-tested Swift release",
-    "bundledIn": "@cross-deck/node@1.8.2"
+    "bundledIn": "@cross-deck/node@1.10.0"
   },
   {
     "id": "node-pii-scrubber",
@@ -5035,7 +5159,7 @@ var BUNDLED_CONTRACTS = Object.freeze([
     ],
     "registeredAt": "2026-05-26",
     "firstRegisteredIn": "bank-grade reconciliation v1.4.0 \u2014 phase 3.1",
-    "bundledIn": "@cross-deck/node@1.8.2"
+    "bundledIn": "@cross-deck/node@1.10.0"
   },
   {
     "id": "node-shutdown-awaits-flush",
@@ -5068,7 +5192,7 @@ var BUNDLED_CONTRACTS = Object.freeze([
     ],
     "registeredAt": "2026-05-26",
     "firstRegisteredIn": "bank-grade reconciliation v1.4.0 \u2014 phase 5.4",
-    "bundledIn": "@cross-deck/node@1.8.2"
+    "bundledIn": "@cross-deck/node@1.10.0"
   },
   {
     "id": "sdk-error-codes-catalogue",
@@ -5113,7 +5237,7 @@ var BUNDLED_CONTRACTS = Object.freeze([
     ],
     "registeredAt": "2026-05-26",
     "firstRegisteredIn": "bank-grade reconciliation v1.4.0 \u2014 phase 6.2",
-    "bundledIn": "@cross-deck/node@1.8.2"
+    "bundledIn": "@cross-deck/node@1.10.0"
   },
   {
     "id": "sync-purchases-funnel-parity",
@@ -5146,7 +5270,7 @@ var BUNDLED_CONTRACTS = Object.freeze([
     ],
     "registeredAt": "2026-05-26",
     "firstRegisteredIn": "bank-grade reconciliation v1.4.0 \u2014 phase 3.5",
-    "bundledIn": "@cross-deck/node@1.8.2"
+    "bundledIn": "@cross-deck/node@1.10.0"
   },
   {
     "id": "verifier-timestamp-mandatory",
@@ -5200,7 +5324,7 @@ var BUNDLED_CONTRACTS = Object.freeze([
     ],
     "registeredAt": "2026-05-26",
     "firstRegisteredIn": "bank-grade reconciliation v1.4.0 \u2014 phase 7.2",
-    "bundledIn": "@cross-deck/node@1.8.2"
+    "bundledIn": "@cross-deck/node@1.10.0"
   }
 ]);