@cross-deck/node 1.9.1 → 1.10.1

package/CHANGELOG.md

@@ -6,6 +6,45 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.10.1] — 2026-06-30
+
+**Fixed — the blocking surface now works for the documented paths (still v2 preview).**
+
+- `resolve()` / `isBlocked()` now accept a **bare `userId`** — the server-trusted
+  recognition path the backend honours (rides the identity backbone, matches on the email
+  Crossdeck already holds). 1.10.0's guard rejected it and fail-opened *without calling the
+  API*, so a known-user block silently never fired.
+- **Added `gate({ email, ip })`** — the brand-new-signup door (`POST /v1/trust/gate`), the
+  only path that catches a farm Crossdeck has never seen. Fail-open by contract. New
+  `GateInput` / `GateVerdict` types.
+- README now documents the blocking surface (the three doors + the verify-locally pattern).
+
+Still `@experimental` — Crossdeck Trust ships with Crossdeck v2.
+
+
+## [1.10.0] — 2026-06-30
+
+**Added — the blocking surface (Crossdeck Trust, v2 preview).** Blocking is
+"entitlements, inverted": `getEntitlements()` answers *can they access Pro?*; the new
+methods answer *should they be here at all?* — the same `/v1/resolve` plumbing, read for
+`blocked`. Additive and non-breaking.
+
+- **`resolve(input)`** → `ResolveResult` — the block verdict plus identity/entitlement
+  context in one call. **Fail-open by contract:** never throws for the verdict and never
+  returns `blocked: true` on uncertainty; any error → `{ blocked: false, degraded: true }`,
+  so a glitch can never lock out a real user (the mirror of entitlements, which fail
+  closed). Forward the end-user's `ip` (server-to-server callers otherwise expose only
+  their own server IP, so ip-rules can't match) and the verified identity
+  (`userId` + `idToken`) so domain/email rules can match.
+- **`isBlocked(input)`** → `boolean` — convenience over `resolve()`; same fail-open.
+- **`getOwnerStatus(input)`** → `BlockVerdict` — the public-page path: *"is the owner of
+  this page blocked?"*, no session token, for cache invalidation on link-in-bio / content
+  platforms (Pattern B).
+
+New exported types: `ResolveInput`, `ResolveResult`, `BlockVerdict`, `OwnerStatusInput`.
+All marked `@experimental` — Crossdeck Trust ships with Crossdeck v2; the shape is stable,
+the surface is not yet GA.
+
 ## [1.9.1] — 2026-06-30
 
 **Docs — knowledge-backbone governance release.** No runtime API change. This

package/README.md

@@ -211,6 +211,51 @@ app.post("/crossdeck-webhook", express.raw({ type: "application/json" }), (req,
 
 For test fixtures that need to mint signed webhooks against the same scheme, `signWebhookPayload(payload, secret, timestampSec)` is exported.
 
+### Blocking (Crossdeck Trust) — <sup>v2 preview</sup>
+
+> **Preview — not GA.** The blocking surface launches **end-to-end with Crossdeck v2.**
+> The shape is stable and all methods are `@experimental`, so it's documented and usable
+> now (dogfooding / early access) — but it is **not** a launched feature yet, and this is
+> not a fourth shipped USP. Treat it as preview until the v2 launch.
+
+Blocking is **entitlements, inverted**: `getEntitlements()` asks *"can this user access Pro?"*; these ask *"should this user be here at all?"* — the **same identity backbone**, read for `blocked`. Every method is **fail-open by contract**: it never throws and never returns blocked on uncertainty, so a glitch can never lock out a real user.
+
+There are three doors. Pick by who's at it:
+
+```ts
+// 1. A user you ALREADY KNOW — a bare userId rides the backbone (no token, no setup).
+//    Crossdeck matches on the email it already holds. The common case.
+const { blocked, blockReason } = await crossdeck.resolve({ userId, ip: req.ip });
+if (blocked) { await signOut(); return showSuspended(blockReason); }
+// or just the boolean:  if (await crossdeck.isBlocked({ userId })) …
+
+// 2. A BRAND-NEW signup Crossdeck has never seen — block by the two strings you have
+//    at signup, their email + ip. Call it BEFORE you create the account.
+const gate = await crossdeck.gate({ email, ip: req.ip });
+if (gate.action === "block") return rejectSignup(gate.blockReason);
+
+// 3. A PUBLIC PAGE — "is the owner of this page blocked?" (no session token). Poll on a
+//    short TTL to invalidate your cache; the ip is the owner's CREATION ip.
+const owner = await crossdeck.getOwnerStatus({ userId: ownerId });
+if (owner.blocked) await takePageOffline(ownerId);
+```
+
+**Recommended server pattern (no issuer registration):** if your backend runs Firebase
+Admin, verify the ID token **locally** for the authoritative uid, then send that as a bare
+`userId` — you keep the cryptographic proof on your side and Crossdeck needs zero setup:
+
+```ts
+const { uid } = await getAuth().verifyIdToken(idToken);     // your Firebase Admin
+const { blocked } = await crossdeck.resolve({ userId: uid, ip: req.ip });
+```
+
+Send `userId` + `idToken` to Crossdeck instead only if you *can't* verify locally — that's
+the verified Tier-3 path, and the only one that needs a one-time auth-issuer registration.
+Setting *who* is blocked is a rule in your Crossdeck admin. Full integration guide
+(suspension pages, public-content takedown, the backfill sweep): `CROSSDECK_BLOCKING_DEVELOPER_GUIDE.md`.
+
+Types: `ResolveInput` / `ResolveResult`, `GateInput` / `GateVerdict`, `OwnerStatusInput` / `BlockVerdict`.
+
 ## Cross-cutting
 
 ### Read-cost cross-match (Buckets)
@@ -614,8 +659,8 @@ CrossdeckContracts.byId("idempotency-key-deterministic");
 CrossdeckContracts.byPillar("revenue");
 CrossdeckContracts.withStatus("proposed");
 CrossdeckContracts.findByTestName("rail namespacing prevents cross-rail collisions");
-CrossdeckContracts.sdkVersion;        // "1.9.0"
-CrossdeckContracts.bundledIn;         // "@cross-deck/node@1.9.0"
+CrossdeckContracts.sdkVersion;        // "1.10.0"
+CrossdeckContracts.bundledIn;         // "@cross-deck/node@1.10.0"
 ```
 
 The `Contract` type is exported alongside; the binary-stability promise is documented in [`contracts/README.md`](https://github.com/VistaApps-za/crossdeck/blob/main/contracts/README.md).

package/dist/auto-events/index.d.mts

@@ -1,4 +1,4 @@
-import { w as CrossdeckServer } from '../crossdeck-server-Q3CYJC4Z.mjs';
+import { x as CrossdeckServer } from '../crossdeck-server-BpBVFC4O.mjs';
 import 'node:events';
 
 /**

package/dist/auto-events/index.d.ts

@@ -1,4 +1,4 @@
-import { w as CrossdeckServer } from '../crossdeck-server-Q3CYJC4Z.js';
+import { x as CrossdeckServer } from '../crossdeck-server-BpBVFC4O.js';
 import 'node:events';
 
 /**

package/dist/{crossdeck-server-Q3CYJC4Z.d.mts → crossdeck-server-BpBVFC4O.d.mts}

@@ -183,8 +183,8 @@ declare const CrossdeckContracts: {
     readonly byId: (id: string) => Contract | undefined;
     readonly byPillar: (pillar: ContractPillar) => readonly Contract[];
     readonly withStatus: (status: ContractStatus) => readonly Contract[];
-    readonly sdkVersion: "1.8.2";
-    readonly bundledIn: "@cross-deck/node@1.8.2";
+    readonly sdkVersion: "1.10.1";
+    readonly bundledIn: "@cross-deck/node@1.10.1";
     /**
      * Resolve a failing test back to the contract it exercises.
      * Used by test-framework hooks to find the contract id of a
@@ -438,6 +438,117 @@ interface EntitlementsListResponse {
     crossdeckCustomerId: string;
     env: Environment;
 }
+/**
+ * Identity for {@link CrossdeckServer.resolve} / {@link CrossdeckServer.isBlocked}.
+ * Send the END USER's identity, not your server's.
+ *
+ * @experimental Preview — Crossdeck Trust ships with Crossdeck v2. Shape is stable; the
+ * surface is not yet GA.
+ */
+interface ResolveInput {
+    /** Your signed-in user id. */
+    userId?: string;
+    /** A SIGNED proof of that user (e.g. their Firebase ID token). Required alongside `userId` for the verified path. */
+    idToken?: string;
+    /** Anonymous device id (the Web SDK's `getAnonymousId()`). Folds a pre-login device. */
+    anonymousId?: string;
+    /**
+     * The END USER's IP. Forward it — you call resolve server-to-server, so without it
+     * Crossdeck sees YOUR server's IP and an ip-rule can't match the visitor.
+     */
+    ip?: string;
+}
+/**
+ * The block verdict. Fail-open: on any error these come back `{ blocked: false }`,
+ * never an exception — a glitch can never lock out a real user (the mirror of
+ * entitlements, which fail closed).
+ *
+ * @experimental Preview — see {@link ResolveInput}.
+ */
+interface BlockVerdict {
+    /** True ONLY when Crossdeck holds an explicit block on this identity. */
+    blocked: boolean;
+    /** Why, when blocked: e.g. `"blocklist:domain"` | `"blocklist:ip"` | `"blocked"`. */
+    blockReason: string | null;
+    /** The exact rule that fired: `"domain:spartan.net"` | `"ip:1.2.3.4"` | `"manual"` | null. */
+    blockedKey: string | null;
+    /**
+     * True when this is the fail-open default (Crossdeck unreachable / identity unresolved).
+     * `blocked` is `false`; log it for observability, never treat it as a real "not blocked".
+     */
+    degraded?: boolean;
+}
+/**
+ * The full {@link CrossdeckServer.resolve} result — the block verdict plus the identity /
+ * entitlement context, so one call answers "should they be here?" and "what can they
+ * access?" together.
+ *
+ * @experimental Preview — see {@link ResolveInput}.
+ */
+interface ResolveResult extends BlockVerdict {
+    /** `"active"` | `"anonymous"` | … the resolved identity status. */
+    status: string;
+    /** Active entitlement keys for this identity (e.g. `["pro"]`). */
+    entitlements: string[];
+    /** The canonical Crossdeck customer id, when resolved. */
+    crossdeckCustomerId: string | null;
+    /** The anonymous id Crossdeck resolved / assigned. */
+    anonymousId: string | null;
+    /**
+     * Set when a verified identity was sent but couldn't be checked (e.g. the auth issuer
+     * isn't registered). If you sent `userId`+`idToken` and `status` is `"anonymous"`, read this.
+     */
+    identityError: {
+        reason: string;
+    } | null;
+}
+/**
+ * Owner identifiers for {@link CrossdeckServer.getOwnerStatus} — the public-page path.
+ * Pass any subset; for a page-offline check the `ip` is the owner's CREATION ip.
+ *
+ * @experimental Preview — see {@link ResolveInput}.
+ */
+interface OwnerStatusInput {
+    userId?: string;
+    email?: string;
+    domain?: string;
+    ip?: string;
+}
+/**
+ * Input for {@link CrossdeckServer.gate} — the brand-new-signup door. Pass the two strings
+ * you have at signup: `email` and `ip`. (Optional `domain`/`fingerprint` sharpen the score.)
+ *
+ * @experimental Preview — see {@link ResolveInput}.
+ */
+interface GateInput {
+    /** The signing-up user's email. Matched against email + domain blocklist rules. */
+    email?: string;
+    /** The signing-up request's IP. Matched against ip rules + datacenter/velocity signals. */
+    ip?: string;
+    /** Optional explicit domain (defaults to the email's domain). */
+    domain?: string;
+    /** Optional device fingerprint — sharpens the composite signup score. */
+    fingerprint?: string;
+}
+/**
+ * The signup-gate verdict from {@link CrossdeckServer.gate}. Fail-open: on any error these
+ * come back `{ action: "allow", allow: true, degraded: true }` — a glitch never rejects a
+ * real signup.
+ *
+ * @experimental Preview — see {@link ResolveInput}.
+ */
+interface GateVerdict {
+    /** `"allow"` | `"review"` | `"block"`. Reject the account only on `"block"`. */
+    action: "allow" | "review" | "block";
+    /** Convenience: `false` only when `action` is `"block"`. */
+    allow: boolean;
+    /** Why, when blocked: e.g. `"disposable_domain"` | `"blocklist:ip"` | `"blocklist:domain"`. */
+    blockReason: string | null;
+    /** The exact rule/key that fired, when blocked. */
+    blockedKey: string | null;
+    /** True when this is the fail-open default (Crossdeck unreachable). `allow` is `true`. */
+    degraded?: boolean;
+}
 /**
  * Snapshot of one customer's last-known-good entitlements, as written
  * to / read from a durable `EntitlementStore`. Versioned for forward-
@@ -1456,6 +1567,53 @@ declare class CrossdeckServer extends EventEmitter {
      */
     getEntitlements(hints: IdentityHints, options?: RequestOptions): Promise<EntitlementsListResponse>;
     getCustomerEntitlements(customerId: string, options?: RequestOptions): Promise<EntitlementsListResponse>;
+    /**
+     * Resolve a user's BLOCK verdict (plus identity / entitlement context) — the same
+     * `/v1/resolve` you'd call for entitlements, read for `blocked`. Wire it into signup
+     * and every visit; on `blocked`, sign the user out (and, for public content, take
+     * their pages offline — see the Blocking developer guide, Pattern B).
+     *
+     * **Fail-open is the contract.** This never throws for the block decision and never
+     * returns `blocked: true` on uncertainty. Any error — Crossdeck unreachable, timeout,
+     * unresolved identity — yields `{ blocked: false, degraded: true }`, so a glitch can
+     * never lock out a real user.
+     *
+     * Forward the END USER's `ip` (you call this server-to-server, so otherwise Crossdeck
+     * sees your server's IP and an ip-rule can't match the visitor), and the verified
+     * identity (`userId` + `idToken`) so a `domain`/`email` rule can match the email.
+     *
+     * @experimental Preview — Crossdeck Trust ships with Crossdeck v2. Stable shape, not yet GA.
+     */
+    resolve(input: ResolveInput, options?: RequestOptions): Promise<ResolveResult>;
+    /**
+     * Convenience over {@link resolve}: just the boolean. Fail-open (false on any error).
+     *
+     * @experimental Preview — see {@link resolve}.
+     */
+    isBlocked(input: ResolveInput, options?: RequestOptions): Promise<boolean>;
+    /**
+     * The OWNER's block verdict for the public-page path (Pattern B / §5b of the Blocking
+     * developer guide) — "is the owner of this page blocked?", no session token required.
+     * Pass the owner's recorded identifiers (`userId`/`email`/`domain`/`ip`; the `ip` is
+     * their CREATION ip, not a live visitor's). Poll on a short TTL to invalidate your
+     * public-page cache. Fail-open — any error → `{ blocked: false, degraded: true }`.
+     *
+     * @experimental Preview — see {@link resolve}.
+     */
+    getOwnerStatus(input: OwnerStatusInput, options?: RequestOptions): Promise<BlockVerdict>;
+    /**
+     * The brand-new-signup door (§3 of the Blocking developer guide). Block a user Crossdeck
+     * has **never seen** — at the instant they sign up — by the two strings you have then:
+     * their `email` and `ip`. There's no identity to ride yet, so {@link resolve} can't catch
+     * them; this matches `email` / domain / `ip` blocklist rules directly. Call it BEFORE you
+     * create the account; on `action: "block"`, reject the signup.
+     *
+     * **Fail-open by contract** — never throws, never blocks on uncertainty: any error →
+     * `{ action: "allow", allow: true, degraded: true }`, so a glitch can't reject a real signup.
+     *
+     * @experimental Preview — Crossdeck Trust ships with Crossdeck v2.
+     */
+    gate(input: GateInput, options?: RequestOptions): Promise<GateVerdict>;
     /**
      * Synchronous entitlement check. Returns `true` iff the customer
      * has the entitlement AND the cache entry is fresh (within
@@ -1935,4 +2093,4 @@ declare class CrossdeckServer extends EventEmitter {
     private normalizeIngestEvent;
 }
 
-export { type PurchaseResult as $, type AliasIdentityInput as A, type Breadcrumb as B, CROSSDECK_API_VERSION as C, DEFAULT_BASE_URL as D, type Diagnostics as E, type EntitlementCacheOptions as F, type EntitlementMutationResult as G, type EntitlementStore as H, type EntitlementsListResponse as I, type EntitlementsListener as J, type Environment as K, type ErrorCaptureConfig as L, type ErrorLevel as M, type EventProperties as N, type ForgetResult as O, type GrantDuration as P, type GrantEntitlementInput as Q, type GroupMembership as R, type HeartbeatResponse as S, type HttpRequestInfo as T, type HttpResponseInfo as U, type HttpRetriesConfig as V, type IdentifyOptions as W, type IdentityHints as X, type IngestOptions as Y, type IngestResponse as Z, type PublicEntitlement as _, type AliasResult as a, type RequestOptions as a0, type RevokeEntitlementInput as a1, type RuntimeHost as a2, type RuntimeInfo as a3, type ServerEvent as a4, type StackFrame as a5, type StoredEntitlements as a6, type SyncPurchaseInput as a7, makeCrossdeckError as a8, type AuditDecision as b, type AuditEntry as c, type BreadcrumbCategory as d, type BreadcrumbLevel as e, type CapturedError as f, type Contract as g, type ContractAppliesTo as h, type ContractFailureInput as i, type ContractPillar as j, type ContractStatus as k, type ContractTestRef as l, CrossdeckAuthenticationError as m, CrossdeckConfigurationError as n, CrossdeckContracts as o, CrossdeckError as p, type CrossdeckErrorPayload as q, type CrossdeckErrorType as r, CrossdeckInternalError as s, CrossdeckNetworkError as t, CrossdeckPermissionError as u, CrossdeckRateLimitError as v, CrossdeckServer as w, type CrossdeckServerOptions as x, CrossdeckValidationError as y, DEFAULT_TIMEOUT_MS as z };
+export { type IngestOptions as $, type AliasIdentityInput as A, type BlockVerdict as B, CROSSDECK_API_VERSION as C, DEFAULT_BASE_URL as D, DEFAULT_TIMEOUT_MS as E, type Diagnostics as F, type EntitlementCacheOptions as G, type EntitlementMutationResult as H, type EntitlementStore as I, type EntitlementsListResponse as J, type EntitlementsListener as K, type Environment as L, type ErrorCaptureConfig as M, type ErrorLevel as N, type EventProperties as O, type ForgetResult as P, type GateInput as Q, type GateVerdict as R, type GrantDuration as S, type GrantEntitlementInput as T, type GroupMembership as U, type HeartbeatResponse as V, type HttpRequestInfo as W, type HttpResponseInfo as X, type HttpRetriesConfig as Y, type IdentifyOptions as Z, type IdentityHints as _, type AliasResult as a, type IngestResponse as a0, type OwnerStatusInput as a1, type PublicEntitlement as a2, type PurchaseResult as a3, type RequestOptions as a4, type ResolveInput as a5, type ResolveResult as a6, type RevokeEntitlementInput as a7, type RuntimeHost as a8, type RuntimeInfo as a9, type ServerEvent as aa, type StackFrame as ab, type StoredEntitlements as ac, type SyncPurchaseInput as ad, makeCrossdeckError as ae, type AuditDecision as b, type AuditEntry as c, type Breadcrumb as d, type BreadcrumbCategory as e, type BreadcrumbLevel as f, type CapturedError as g, type Contract as h, type ContractAppliesTo as i, type ContractFailureInput as j, type ContractPillar as k, type ContractStatus as l, type ContractTestRef as m, CrossdeckAuthenticationError as n, CrossdeckConfigurationError as o, CrossdeckContracts as p, CrossdeckError as q, type CrossdeckErrorPayload as r, type CrossdeckErrorType as s, CrossdeckInternalError as t, CrossdeckNetworkError as u, CrossdeckPermissionError as v, CrossdeckRateLimitError as w, CrossdeckServer as x, type CrossdeckServerOptions as y, CrossdeckValidationError as z };

package/dist/{crossdeck-server-Q3CYJC4Z.d.ts → crossdeck-server-BpBVFC4O.d.ts}

@@ -183,8 +183,8 @@ declare const CrossdeckContracts: {
     readonly byId: (id: string) => Contract | undefined;
     readonly byPillar: (pillar: ContractPillar) => readonly Contract[];
     readonly withStatus: (status: ContractStatus) => readonly Contract[];
-    readonly sdkVersion: "1.8.2";
-    readonly bundledIn: "@cross-deck/node@1.8.2";
+    readonly sdkVersion: "1.10.1";
+    readonly bundledIn: "@cross-deck/node@1.10.1";
     /**
      * Resolve a failing test back to the contract it exercises.
      * Used by test-framework hooks to find the contract id of a
@@ -438,6 +438,117 @@ interface EntitlementsListResponse {
     crossdeckCustomerId: string;
     env: Environment;
 }
+/**
+ * Identity for {@link CrossdeckServer.resolve} / {@link CrossdeckServer.isBlocked}.
+ * Send the END USER's identity, not your server's.
+ *
+ * @experimental Preview — Crossdeck Trust ships with Crossdeck v2. Shape is stable; the
+ * surface is not yet GA.
+ */
+interface ResolveInput {
+    /** Your signed-in user id. */
+    userId?: string;
+    /** A SIGNED proof of that user (e.g. their Firebase ID token). Required alongside `userId` for the verified path. */
+    idToken?: string;
+    /** Anonymous device id (the Web SDK's `getAnonymousId()`). Folds a pre-login device. */
+    anonymousId?: string;
+    /**
+     * The END USER's IP. Forward it — you call resolve server-to-server, so without it
+     * Crossdeck sees YOUR server's IP and an ip-rule can't match the visitor.
+     */
+    ip?: string;
+}
+/**
+ * The block verdict. Fail-open: on any error these come back `{ blocked: false }`,
+ * never an exception — a glitch can never lock out a real user (the mirror of
+ * entitlements, which fail closed).
+ *
+ * @experimental Preview — see {@link ResolveInput}.
+ */
+interface BlockVerdict {
+    /** True ONLY when Crossdeck holds an explicit block on this identity. */
+    blocked: boolean;
+    /** Why, when blocked: e.g. `"blocklist:domain"` | `"blocklist:ip"` | `"blocked"`. */
+    blockReason: string | null;
+    /** The exact rule that fired: `"domain:spartan.net"` | `"ip:1.2.3.4"` | `"manual"` | null. */
+    blockedKey: string | null;
+    /**
+     * True when this is the fail-open default (Crossdeck unreachable / identity unresolved).
+     * `blocked` is `false`; log it for observability, never treat it as a real "not blocked".
+     */
+    degraded?: boolean;
+}
+/**
+ * The full {@link CrossdeckServer.resolve} result — the block verdict plus the identity /
+ * entitlement context, so one call answers "should they be here?" and "what can they
+ * access?" together.
+ *
+ * @experimental Preview — see {@link ResolveInput}.
+ */
+interface ResolveResult extends BlockVerdict {
+    /** `"active"` | `"anonymous"` | … the resolved identity status. */
+    status: string;
+    /** Active entitlement keys for this identity (e.g. `["pro"]`). */
+    entitlements: string[];
+    /** The canonical Crossdeck customer id, when resolved. */
+    crossdeckCustomerId: string | null;
+    /** The anonymous id Crossdeck resolved / assigned. */
+    anonymousId: string | null;
+    /**
+     * Set when a verified identity was sent but couldn't be checked (e.g. the auth issuer
+     * isn't registered). If you sent `userId`+`idToken` and `status` is `"anonymous"`, read this.
+     */
+    identityError: {
+        reason: string;
+    } | null;
+}
+/**
+ * Owner identifiers for {@link CrossdeckServer.getOwnerStatus} — the public-page path.
+ * Pass any subset; for a page-offline check the `ip` is the owner's CREATION ip.
+ *
+ * @experimental Preview — see {@link ResolveInput}.
+ */
+interface OwnerStatusInput {
+    userId?: string;
+    email?: string;
+    domain?: string;
+    ip?: string;
+}
+/**
+ * Input for {@link CrossdeckServer.gate} — the brand-new-signup door. Pass the two strings
+ * you have at signup: `email` and `ip`. (Optional `domain`/`fingerprint` sharpen the score.)
+ *
+ * @experimental Preview — see {@link ResolveInput}.
+ */
+interface GateInput {
+    /** The signing-up user's email. Matched against email + domain blocklist rules. */
+    email?: string;
+    /** The signing-up request's IP. Matched against ip rules + datacenter/velocity signals. */
+    ip?: string;
+    /** Optional explicit domain (defaults to the email's domain). */
+    domain?: string;
+    /** Optional device fingerprint — sharpens the composite signup score. */
+    fingerprint?: string;
+}
+/**
+ * The signup-gate verdict from {@link CrossdeckServer.gate}. Fail-open: on any error these
+ * come back `{ action: "allow", allow: true, degraded: true }` — a glitch never rejects a
+ * real signup.
+ *
+ * @experimental Preview — see {@link ResolveInput}.
+ */
+interface GateVerdict {
+    /** `"allow"` | `"review"` | `"block"`. Reject the account only on `"block"`. */
+    action: "allow" | "review" | "block";
+    /** Convenience: `false` only when `action` is `"block"`. */
+    allow: boolean;
+    /** Why, when blocked: e.g. `"disposable_domain"` | `"blocklist:ip"` | `"blocklist:domain"`. */
+    blockReason: string | null;
+    /** The exact rule/key that fired, when blocked. */
+    blockedKey: string | null;
+    /** True when this is the fail-open default (Crossdeck unreachable). `allow` is `true`. */
+    degraded?: boolean;
+}
 /**
  * Snapshot of one customer's last-known-good entitlements, as written
  * to / read from a durable `EntitlementStore`. Versioned for forward-
@@ -1456,6 +1567,53 @@ declare class CrossdeckServer extends EventEmitter {
      */
     getEntitlements(hints: IdentityHints, options?: RequestOptions): Promise<EntitlementsListResponse>;
     getCustomerEntitlements(customerId: string, options?: RequestOptions): Promise<EntitlementsListResponse>;
+    /**
+     * Resolve a user's BLOCK verdict (plus identity / entitlement context) — the same
+     * `/v1/resolve` you'd call for entitlements, read for `blocked`. Wire it into signup
+     * and every visit; on `blocked`, sign the user out (and, for public content, take
+     * their pages offline — see the Blocking developer guide, Pattern B).
+     *
+     * **Fail-open is the contract.** This never throws for the block decision and never
+     * returns `blocked: true` on uncertainty. Any error — Crossdeck unreachable, timeout,
+     * unresolved identity — yields `{ blocked: false, degraded: true }`, so a glitch can
+     * never lock out a real user.
+     *
+     * Forward the END USER's `ip` (you call this server-to-server, so otherwise Crossdeck
+     * sees your server's IP and an ip-rule can't match the visitor), and the verified
+     * identity (`userId` + `idToken`) so a `domain`/`email` rule can match the email.
+     *
+     * @experimental Preview — Crossdeck Trust ships with Crossdeck v2. Stable shape, not yet GA.
+     */
+    resolve(input: ResolveInput, options?: RequestOptions): Promise<ResolveResult>;
+    /**
+     * Convenience over {@link resolve}: just the boolean. Fail-open (false on any error).
+     *
+     * @experimental Preview — see {@link resolve}.
+     */
+    isBlocked(input: ResolveInput, options?: RequestOptions): Promise<boolean>;
+    /**
+     * The OWNER's block verdict for the public-page path (Pattern B / §5b of the Blocking
+     * developer guide) — "is the owner of this page blocked?", no session token required.
+     * Pass the owner's recorded identifiers (`userId`/`email`/`domain`/`ip`; the `ip` is
+     * their CREATION ip, not a live visitor's). Poll on a short TTL to invalidate your
+     * public-page cache. Fail-open — any error → `{ blocked: false, degraded: true }`.
+     *
+     * @experimental Preview — see {@link resolve}.
+     */
+    getOwnerStatus(input: OwnerStatusInput, options?: RequestOptions): Promise<BlockVerdict>;
+    /**
+     * The brand-new-signup door (§3 of the Blocking developer guide). Block a user Crossdeck
+     * has **never seen** — at the instant they sign up — by the two strings you have then:
+     * their `email` and `ip`. There's no identity to ride yet, so {@link resolve} can't catch
+     * them; this matches `email` / domain / `ip` blocklist rules directly. Call it BEFORE you
+     * create the account; on `action: "block"`, reject the signup.
+     *
+     * **Fail-open by contract** — never throws, never blocks on uncertainty: any error →
+     * `{ action: "allow", allow: true, degraded: true }`, so a glitch can't reject a real signup.
+     *
+     * @experimental Preview — Crossdeck Trust ships with Crossdeck v2.
+     */
+    gate(input: GateInput, options?: RequestOptions): Promise<GateVerdict>;
     /**
      * Synchronous entitlement check. Returns `true` iff the customer
      * has the entitlement AND the cache entry is fresh (within
@@ -1935,4 +2093,4 @@ declare class CrossdeckServer extends EventEmitter {
     private normalizeIngestEvent;
 }
 
-export { type PurchaseResult as $, type AliasIdentityInput as A, type Breadcrumb as B, CROSSDECK_API_VERSION as C, DEFAULT_BASE_URL as D, type Diagnostics as E, type EntitlementCacheOptions as F, type EntitlementMutationResult as G, type EntitlementStore as H, type EntitlementsListResponse as I, type EntitlementsListener as J, type Environment as K, type ErrorCaptureConfig as L, type ErrorLevel as M, type EventProperties as N, type ForgetResult as O, type GrantDuration as P, type GrantEntitlementInput as Q, type GroupMembership as R, type HeartbeatResponse as S, type HttpRequestInfo as T, type HttpResponseInfo as U, type HttpRetriesConfig as V, type IdentifyOptions as W, type IdentityHints as X, type IngestOptions as Y, type IngestResponse as Z, type PublicEntitlement as _, type AliasResult as a, type RequestOptions as a0, type RevokeEntitlementInput as a1, type RuntimeHost as a2, type RuntimeInfo as a3, type ServerEvent as a4, type StackFrame as a5, type StoredEntitlements as a6, type SyncPurchaseInput as a7, makeCrossdeckError as a8, type AuditDecision as b, type AuditEntry as c, type BreadcrumbCategory as d, type BreadcrumbLevel as e, type CapturedError as f, type Contract as g, type ContractAppliesTo as h, type ContractFailureInput as i, type ContractPillar as j, type ContractStatus as k, type ContractTestRef as l, CrossdeckAuthenticationError as m, CrossdeckConfigurationError as n, CrossdeckContracts as o, CrossdeckError as p, type CrossdeckErrorPayload as q, type CrossdeckErrorType as r, CrossdeckInternalError as s, CrossdeckNetworkError as t, CrossdeckPermissionError as u, CrossdeckRateLimitError as v, CrossdeckServer as w, type CrossdeckServerOptions as x, CrossdeckValidationError as y, DEFAULT_TIMEOUT_MS as z };
+export { type IngestOptions as $, type AliasIdentityInput as A, type BlockVerdict as B, CROSSDECK_API_VERSION as C, DEFAULT_BASE_URL as D, DEFAULT_TIMEOUT_MS as E, type Diagnostics as F, type EntitlementCacheOptions as G, type EntitlementMutationResult as H, type EntitlementStore as I, type EntitlementsListResponse as J, type EntitlementsListener as K, type Environment as L, type ErrorCaptureConfig as M, type ErrorLevel as N, type EventProperties as O, type ForgetResult as P, type GateInput as Q, type GateVerdict as R, type GrantDuration as S, type GrantEntitlementInput as T, type GroupMembership as U, type HeartbeatResponse as V, type HttpRequestInfo as W, type HttpResponseInfo as X, type HttpRetriesConfig as Y, type IdentifyOptions as Z, type IdentityHints as _, type AliasResult as a, type IngestResponse as a0, type OwnerStatusInput as a1, type PublicEntitlement as a2, type PurchaseResult as a3, type RequestOptions as a4, type ResolveInput as a5, type ResolveResult as a6, type RevokeEntitlementInput as a7, type RuntimeHost as a8, type RuntimeInfo as a9, type ServerEvent as aa, type StackFrame as ab, type StoredEntitlements as ac, type SyncPurchaseInput as ad, makeCrossdeckError as ae, type AuditDecision as b, type AuditEntry as c, type Breadcrumb as d, type BreadcrumbCategory as e, type BreadcrumbLevel as f, type CapturedError as g, type Contract as h, type ContractAppliesTo as i, type ContractFailureInput as j, type ContractPillar as k, type ContractStatus as l, type ContractTestRef as m, CrossdeckAuthenticationError as n, CrossdeckConfigurationError as o, CrossdeckContracts as p, CrossdeckError as q, type CrossdeckErrorPayload as r, type CrossdeckErrorType as s, CrossdeckInternalError as t, CrossdeckNetworkError as u, CrossdeckPermissionError as v, CrossdeckRateLimitError as w, CrossdeckServer as x, type CrossdeckServerOptions as y, CrossdeckValidationError as z };