@cross-deck/web 1.11.2 → 1.13.0

package/dist/trust-C0RcpR5I.d.mts

@@ -0,0 +1,91 @@
+/**
+ * Crossdeck Trust — the human-proof panel, native to the SDK.
+ *
+ * This is the browser half of Crossdeck Trust wired THROUGH the SDK the customer
+ * already runs, not bolted on beside it. It renders the SAME cross-origin iframe
+ * served from trust.cross-deck.com — the un-restylable, browser-enforced brand
+ * panel — and hands the minted attestation back PROGRAMMATICALLY (a Promise + an
+ * `onToken` callback) instead of the hidden-field/DOM handshake the raw
+ * `embed.js` loader uses. The iframe is the bouncer; the SDK is the premium front
+ * door to it. You pass the token to your server, which verifies it at the gate
+ * (`crossdeck.trust.gate(...)` in @cross-deck/node, or a raw POST /v1/trust/gate).
+ *
+ * Non-negotiables baked in (Stripe / Cloudflare / bank grade):
+ *  - ISOLATED — every DOM / postMessage touch is wrapped; a stumble here can never
+ *    throw into the host app, the rest of the SDK, or the customer's signup form.
+ *  - FAIL-OPEN, never fail-allow — if the panel can't mint (adblocker, our outage,
+ *    offline, timeout), `ready` resolves with NO token. The signup proceeds; the
+ *    SERVER gate scores the ABSENCE. We never wave a tokenless request through, and
+ *    we never block the form because our panel had a bad day. Failing CLOSED would
+ *    hand an attacker a site-wide-outage weapon — so we never do.
+ *  - ORIGIN-LOCKED — we only trust messages from OUR panel origin AND from this
+ *    exact iframe's window. Nothing on the host page can forge a token.
+ *  - The token is minted INSIDE our origin; the host page (even an XSS on it) never
+ *    participates in the mint, it only receives the finished token.
+ */
+/** The origin that serves the branded, un-restylable Trust panel. */
+declare const TRUST_PANEL_ORIGIN = "https://trust.cross-deck.com";
+/** A minted human-proof attestation. Pass `token` to your gate call. */
+interface TrustToken {
+    /** The single-use, project-bound attestation to send to your server as `token`. */
+    token: string;
+    /** Epoch ms at which the token expires (mint fresh per signup attempt), or null. */
+    expiresAt: number | null;
+}
+/** Resolution of a panel that failed open — a token never minted. Not an error. */
+interface TrustUnavailable {
+    token: null;
+    expiresAt: null;
+    /** Why no token was minted (for your logs) — e.g. "timeout", "blocked", "offline". */
+    reason: string;
+}
+type TrustResult = TrustToken | TrustUnavailable;
+/** Lifecycle of a panel driven by a framework binding: pending → ready | unavailable. */
+type TrustTokenStatus = "pending" | "ready" | "unavailable";
+interface MountTrustPanelOptions {
+    /** The project's publishable key (cd_pub_…). The SDK client supplies this for you. */
+    publicKey: string;
+    /** Where to render the panel — an element or a selector resolved at mount time. */
+    target: HTMLElement | string;
+    /** Called once when a token is minted. Optional — you can await `ready` instead. */
+    onToken?: (t: TrustToken) => void;
+    /**
+     * Called if the panel could not mint (blocked, offline, timeout, our outage).
+     * INFORMATIONAL for your logs — NOT an error you must handle: `ready` still
+     * resolves and your signup proceeds. Fail-open is the contract.
+     */
+    onUnavailable?: (reason: string) => void;
+    /** Override the panel origin (tests / self-host). Defaults to production. */
+    origin?: string;
+    /** Max wait for a mint before failing open, in ms. Default 15000. */
+    timeoutMs?: number;
+}
+interface TrustPanelHandle {
+    /** The iframe we mounted — for layout/measurement only; never reach inside it. */
+    readonly frame: HTMLIFrameElement | null;
+    /**
+     * Resolves EXACTLY once: the token on success, or a {@link TrustUnavailable} if
+     * the panel failed open. NEVER rejects — a rejection would tempt callers to block
+     * the signup, which is precisely what fail-open forbids.
+     */
+    readonly ready: Promise<TrustResult>;
+    /** Tear down: remove the iframe + listeners. Idempotent. */
+    destroy(): void;
+}
+/**
+ * Options for `Crossdeck.trust.panel(...)` — the same as {@link MountTrustPanelOptions}
+ * but the SDK client injects `publicKey` from your `init()`, so you omit it.
+ */
+type TrustPanelInput = Omit<MountTrustPanelOptions, "publicKey">;
+/** The `Crossdeck.trust` namespace surfaced on the SDK client. */
+interface CrossdeckTrustNamespace {
+    /** Render the branded Trust panel and mint an attestation. See {@link mountTrustPanel}. */
+    panel(input: TrustPanelInput): TrustPanelHandle;
+}
+/**
+ * Mount the Crossdeck Trust panel and mint an attestation. Framework-agnostic and
+ * guaranteed not to throw — any construction failure resolves `ready` fail-open.
+ */
+declare function mountTrustPanel(opts: MountTrustPanelOptions): TrustPanelHandle;
+
+export { type CrossdeckTrustNamespace as C, type MountTrustPanelOptions as M, TRUST_PANEL_ORIGIN as T, type TrustPanelHandle as a, type TrustPanelInput as b, type TrustResult as c, type TrustToken as d, type TrustTokenStatus as e, type TrustUnavailable as f, mountTrustPanel as m };

package/dist/trust-C0RcpR5I.d.ts

@@ -0,0 +1,91 @@
+/**
+ * Crossdeck Trust — the human-proof panel, native to the SDK.
+ *
+ * This is the browser half of Crossdeck Trust wired THROUGH the SDK the customer
+ * already runs, not bolted on beside it. It renders the SAME cross-origin iframe
+ * served from trust.cross-deck.com — the un-restylable, browser-enforced brand
+ * panel — and hands the minted attestation back PROGRAMMATICALLY (a Promise + an
+ * `onToken` callback) instead of the hidden-field/DOM handshake the raw
+ * `embed.js` loader uses. The iframe is the bouncer; the SDK is the premium front
+ * door to it. You pass the token to your server, which verifies it at the gate
+ * (`crossdeck.trust.gate(...)` in @cross-deck/node, or a raw POST /v1/trust/gate).
+ *
+ * Non-negotiables baked in (Stripe / Cloudflare / bank grade):
+ *  - ISOLATED — every DOM / postMessage touch is wrapped; a stumble here can never
+ *    throw into the host app, the rest of the SDK, or the customer's signup form.
+ *  - FAIL-OPEN, never fail-allow — if the panel can't mint (adblocker, our outage,
+ *    offline, timeout), `ready` resolves with NO token. The signup proceeds; the
+ *    SERVER gate scores the ABSENCE. We never wave a tokenless request through, and
+ *    we never block the form because our panel had a bad day. Failing CLOSED would
+ *    hand an attacker a site-wide-outage weapon — so we never do.
+ *  - ORIGIN-LOCKED — we only trust messages from OUR panel origin AND from this
+ *    exact iframe's window. Nothing on the host page can forge a token.
+ *  - The token is minted INSIDE our origin; the host page (even an XSS on it) never
+ *    participates in the mint, it only receives the finished token.
+ */
+/** The origin that serves the branded, un-restylable Trust panel. */
+declare const TRUST_PANEL_ORIGIN = "https://trust.cross-deck.com";
+/** A minted human-proof attestation. Pass `token` to your gate call. */
+interface TrustToken {
+    /** The single-use, project-bound attestation to send to your server as `token`. */
+    token: string;
+    /** Epoch ms at which the token expires (mint fresh per signup attempt), or null. */
+    expiresAt: number | null;
+}
+/** Resolution of a panel that failed open — a token never minted. Not an error. */
+interface TrustUnavailable {
+    token: null;
+    expiresAt: null;
+    /** Why no token was minted (for your logs) — e.g. "timeout", "blocked", "offline". */
+    reason: string;
+}
+type TrustResult = TrustToken | TrustUnavailable;
+/** Lifecycle of a panel driven by a framework binding: pending → ready | unavailable. */
+type TrustTokenStatus = "pending" | "ready" | "unavailable";
+interface MountTrustPanelOptions {
+    /** The project's publishable key (cd_pub_…). The SDK client supplies this for you. */
+    publicKey: string;
+    /** Where to render the panel — an element or a selector resolved at mount time. */
+    target: HTMLElement | string;
+    /** Called once when a token is minted. Optional — you can await `ready` instead. */
+    onToken?: (t: TrustToken) => void;
+    /**
+     * Called if the panel could not mint (blocked, offline, timeout, our outage).
+     * INFORMATIONAL for your logs — NOT an error you must handle: `ready` still
+     * resolves and your signup proceeds. Fail-open is the contract.
+     */
+    onUnavailable?: (reason: string) => void;
+    /** Override the panel origin (tests / self-host). Defaults to production. */
+    origin?: string;
+    /** Max wait for a mint before failing open, in ms. Default 15000. */
+    timeoutMs?: number;
+}
+interface TrustPanelHandle {
+    /** The iframe we mounted — for layout/measurement only; never reach inside it. */
+    readonly frame: HTMLIFrameElement | null;
+    /**
+     * Resolves EXACTLY once: the token on success, or a {@link TrustUnavailable} if
+     * the panel failed open. NEVER rejects — a rejection would tempt callers to block
+     * the signup, which is precisely what fail-open forbids.
+     */
+    readonly ready: Promise<TrustResult>;
+    /** Tear down: remove the iframe + listeners. Idempotent. */
+    destroy(): void;
+}
+/**
+ * Options for `Crossdeck.trust.panel(...)` — the same as {@link MountTrustPanelOptions}
+ * but the SDK client injects `publicKey` from your `init()`, so you omit it.
+ */
+type TrustPanelInput = Omit<MountTrustPanelOptions, "publicKey">;
+/** The `Crossdeck.trust` namespace surfaced on the SDK client. */
+interface CrossdeckTrustNamespace {
+    /** Render the branded Trust panel and mint an attestation. See {@link mountTrustPanel}. */
+    panel(input: TrustPanelInput): TrustPanelHandle;
+}
+/**
+ * Mount the Crossdeck Trust panel and mint an attestation. Framework-agnostic and
+ * guaranteed not to throw — any construction failure resolves `ready` fail-open.
+ */
+declare function mountTrustPanel(opts: MountTrustPanelOptions): TrustPanelHandle;
+
+export { type CrossdeckTrustNamespace as C, type MountTrustPanelOptions as M, TRUST_PANEL_ORIGIN as T, type TrustPanelHandle as a, type TrustPanelInput as b, type TrustResult as c, type TrustToken as d, type TrustTokenStatus as e, type TrustUnavailable as f, mountTrustPanel as m };

package/dist/vue.cjs

@@ -21,7 +21,8 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var vue_exports = {};
 __export(vue_exports, {
   useEntitlement: () => useEntitlement,
-  useEntitlements: () => useEntitlements
+  useEntitlements: () => useEntitlements,
+  useTrustToken: () => useTrustToken
 });
 module.exports = __toCommonJS(vue_exports);
 var import_vue = require("vue");
@@ -97,7 +98,7 @@ function typeMapForStatus(status) {
 }
 
 // src/_version.ts
-var SDK_VERSION = "1.11.2";
+var SDK_VERSION = "1.13.0";
 var SDK_NAME = "@cross-deck/web";
 
 // src/http.ts
@@ -354,6 +355,125 @@ function randomChars(count) {
   return out.join("");
 }
 
+// src/trust.ts
+var TRUST_PANEL_ORIGIN = "https://trust.cross-deck.com";
+var MAX_WIDTH_PX = 360;
+var INITIAL_HEIGHT_PX = 132;
+var MIN_HEIGHT_PX = 96;
+var MAX_HEIGHT_PX = 220;
+var DEFAULT_TIMEOUT_MS2 = 15e3;
+function mountTrustPanel(opts) {
+  const origin = normalizeOrigin(opts.origin) || TRUST_PANEL_ORIGIN;
+  const timeoutMs = clampInt(opts.timeoutMs, DEFAULT_TIMEOUT_MS2, 1e3, 12e4);
+  let settled = false;
+  let onMessage = null;
+  let timer = null;
+  let frame = null;
+  let resolveReady;
+  const ready = new Promise((res) => {
+    resolveReady = res;
+  });
+  function settle(result, reason) {
+    if (settled) return;
+    settled = true;
+    if (timer) safe(() => clearTimeout(timer));
+    if (onMessage) safe(() => window.removeEventListener("message", onMessage));
+    if (result) {
+      safe(() => opts.onToken?.(result));
+      resolveReady(result);
+    } else {
+      const why = reason || "unavailable";
+      safe(() => opts.onUnavailable?.(why));
+      resolveReady({ token: null, expiresAt: null, reason: why });
+    }
+  }
+  try {
+    if (typeof window === "undefined" || typeof document === "undefined") {
+      queueMicrotask(() => settle(null, "no_dom"));
+      return makeHandle();
+    }
+    const host = resolveTarget(opts.target);
+    frame = createFrame(origin, opts.publicKey);
+    if (!host) {
+      queueMicrotask(() => settle(null, "no_mount_target"));
+      return makeHandle();
+    }
+    onMessage = (ev) => {
+      if (ev.origin !== origin) return;
+      if (!ev.data || !frame || ev.source !== frame.contentWindow) return;
+      const d = ev.data;
+      if (d.type === "cd-trust-size" && typeof d.height === "number") {
+        safe(() => {
+          if (frame) frame.style.height = clampInt(d.height, INITIAL_HEIGHT_PX, MIN_HEIGHT_PX, MAX_HEIGHT_PX) + "px";
+        });
+      } else if (d.type === "cd-trust-token" && typeof d.token === "string") {
+        settle({ token: d.token, expiresAt: typeof d.expMs === "number" ? d.expMs : null });
+      }
+    };
+    window.addEventListener("message", onMessage);
+    host.appendChild(frame);
+    timer = setTimeout(() => settle(null, "timeout"), timeoutMs);
+  } catch (err) {
+    queueMicrotask(() => settle(null, "mount_error:" + safeMessage(err)));
+  }
+  return makeHandle();
+  function makeHandle() {
+    return {
+      frame,
+      ready,
+      destroy() {
+        if (onMessage) safe(() => window.removeEventListener("message", onMessage));
+        if (timer) safe(() => clearTimeout(timer));
+        safe(() => frame?.parentNode?.removeChild(frame));
+        settle(null, "destroyed");
+      }
+    };
+  }
+}
+function createFrame(origin, publicKey) {
+  const frame = document.createElement("iframe");
+  frame.title = "Protected by Crossdeck Trust";
+  frame.setAttribute("aria-label", "Protected by Crossdeck Trust");
+  frame.setAttribute("scrolling", "no");
+  frame.setAttribute("allowtransparency", "true");
+  frame.style.cssText = "border:0;display:block;width:100%;max-width:" + MAX_WIDTH_PX + "px;height:" + INITIAL_HEIGHT_PX + "px;margin:0;background:transparent;color-scheme:light;";
+  frame.src = origin + "/panel?k=" + encodeURIComponent(publicKey || "");
+  return frame;
+}
+function resolveTarget(target) {
+  try {
+    if (typeof target === "string") return document.querySelector(target);
+    return target || null;
+  } catch {
+    return null;
+  }
+}
+function normalizeOrigin(o) {
+  if (!o || typeof o !== "string") return null;
+  try {
+    return new URL(o).origin;
+  } catch {
+    return null;
+  }
+}
+function clampInt(v, fallback, min, max) {
+  const n = typeof v === "number" && isFinite(v) ? v : fallback;
+  return Math.min(Math.max(n, min), max);
+}
+function safe(fn) {
+  try {
+    fn();
+  } catch {
+  }
+}
+function safeMessage(err) {
+  try {
+    return err instanceof Error ? err.message : String(err);
+  } catch {
+    return "unknown";
+  }
+}
+
 // src/hash.ts
 var K = new Uint32Array([
   1116352408,
@@ -1587,6 +1707,7 @@ var AutoTracker = class {
     this.pageviewId = null;
     this.storage = opts?.storage ?? null;
     this.sessionKey = opts?.storageKey ?? SESSION_STORAGE_KEY;
+    this.cookieStorage = opts?.cookieStorage ?? null;
   }
   install() {
     if (!isBrowserSafe()) return;
@@ -1738,9 +1859,74 @@ var AutoTracker = class {
       lastActivityAt: now,
       hiddenAt: null,
       endedSent: false,
-      acquisition: captureAcquisition()
+      acquisition: this.resolveAcquisition()
     };
   }
+  /**
+   * Session acquisition, with FIRST-TOUCH survival across sessions.
+   *
+   * WHY: `captureAcquisition()` reads the CURRENT page. That is correct for a
+   * fresh arrival, but a session boundary (30-min idle, or a return visit next
+   * week) starts a new session — and a visitor returning directly has no utm_*
+   * and no click id, so the acquisition that actually WON them was silently
+   * replaced with empty. Someone who arrives from LinkedIn on Monday, returns
+   * direct on Tuesday and signs up on Wednesday converted with no source at all.
+   *
+   * That is exactly the question the product exists to answer — "where did this
+   * PAYING CUSTOMER come from" — so origin has to outlive the session that
+   * captured it. We persist the first touch that carried a real signal and,
+   * whenever a later session arrives with nothing, fall back to it.
+   *
+   * Deliberately NOT last-touch-wins: a real new campaign click overwrites
+   * nothing, it simply records a newer touch for that session while the stored
+   * first touch stays put. Write-once by design.
+   */
+  resolveAcquisition() {
+    const current = captureAcquisition();
+    if (!this.storage && !this.cookieStorage) return current;
+    const key = `${this.sessionKey}_origin_first`;
+    const readFirstTouch = () => {
+      try {
+        const v = this.storage?.getItem(key);
+        if (v) return v;
+      } catch {
+      }
+      try {
+        return this.cookieStorage?.getItem(key) ?? null;
+      } catch {
+        return null;
+      }
+    };
+    const writeFirstTouch = (v) => {
+      try {
+        this.storage?.setItem(key, v);
+      } catch {
+      }
+      try {
+        this.cookieStorage?.setItem(key, v);
+      } catch {
+      }
+    };
+    const hasSignal = (a) => Boolean(a.utm_source || a.utm_medium || a.utm_campaign || a.utm_content || a.utm_term || a.gclid || a.fbclid || a.msclkid || a.ttclid || a.li_fat_id || a.twclid);
+    try {
+      if (hasSignal(current)) {
+        if (readFirstTouch() === null) writeFirstTouch(JSON.stringify(current));
+        return current;
+      }
+      const raw = readFirstTouch();
+      if (raw) {
+        const stored = JSON.parse(raw);
+        return {
+          ...EMPTY_ACQUISITION,
+          ...stored,
+          // Referrer always describes THIS visit, never the remembered one.
+          referrer: current.referrer
+        };
+      }
+    } catch {
+    }
+    return current;
+  }
   /**
    * Read the persisted session continuity record. Returns null on no
    * storage, no record, malformed JSON, or a record missing its required
@@ -4787,7 +4973,15 @@ var CrossdeckClient = class {
         // a visit survives full-page navigations (multi-page sites
         // re-install the SDK on every page) and honours the same consent
         // posture — MemoryStorage when identity persistence is off.
-        { storage: effectiveStorage, storageKey: opts.storagePrefix + "session" }
+        // cookieStorage is the SAME registrable-domain cookie identity uses.
+        // First-touch origin rides it so the campaign that won a visitor on the
+        // marketing site is still known when they land on the app subdomain —
+        // localStorage alone is per-origin and would lose it at exactly that hop.
+        {
+          storage: effectiveStorage,
+          storageKey: opts.storagePrefix + "session",
+          cookieStorage: cookieStore ?? void 0
+        }
       );
       this.state.autoTracker = tracker;
       tracker.install();
@@ -5742,6 +5936,30 @@ var CrossdeckClient = class {
   getAnonymousId() {
     return this.state ? this.state.identity.anonymousId : null;
   }
+  /**
+   * **Crossdeck Trust** — human-proof at your signup, native to the SDK.
+   *
+   * `Crossdeck.trust.panel({ target, onToken })` renders the branded, un-restylable
+   * Trust panel (the same cross-origin iframe on every install) and mints a
+   * single-use attestation. Hand the token to your server and verify it at the gate
+   * (`crossdeck.trust.gate(...)` in @cross-deck/node). The publishable key is taken
+   * from your `init()` — you don't pass it again.
+   *
+   * Fail-open by contract: if the panel can't mint (adblocker, offline, our outage),
+   * `ready` resolves with `{ token: null }` and your signup proceeds — the server
+   * scores the missing token. It never throws and never blocks your form.
+   *
+   * @example
+   * const { ready } = Crossdeck.trust.panel({ target: "#cd-trust" });
+   * const result = await ready;                 // { token, expiresAt } | { token: null }
+   * await createUser({ email, cdTrustToken: result.token });
+   */
+  get trust() {
+    const publicKey = this.state ? this.state.options.publicKey : "";
+    return {
+      panel: (input) => mountTrustPanel({ ...input, publicKey })
+    };
+  }
   // ---------- private helpers ----------
   requireStarted() {
     if (!this.state) {
@@ -5901,6 +6119,26 @@ function useEntitlements() {
   });
   return r;
 }
+function useTrustToken() {
+  const el = (0, import_vue.ref)(null);
+  const token = (0, import_vue.ref)(null);
+  const status = (0, import_vue.ref)("pending");
+  (0, import_vue.onMounted)(() => {
+    if (!el.value) return;
+    const handle = Crossdeck.trust.panel({
+      target: el.value,
+      onToken: (t) => {
+        token.value = t.token;
+        status.value = "ready";
+      },
+      onUnavailable: () => {
+        status.value = "unavailable";
+      }
+    });
+    (0, import_vue.onScopeDispose)(() => handle.destroy());
+  });
+  return { el, token, status };
+}
 function safeIsEntitled(key) {
   try {
     return Crossdeck.isEntitled(key);
@@ -5918,6 +6156,7 @@ function safeListKeys() {
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   useEntitlement,
-  useEntitlements
+  useEntitlements,
+  useTrustToken
 });
 //# sourceMappingURL=vue.cjs.map