@cross-deck/web 1.12.1 → 1.13.0

package/dist/index.d.mts

@@ -1,3 +1,5 @@
+import { C as CrossdeckTrustNamespace } from './trust-C0RcpR5I.mjs';
+export { M as MountTrustPanelOptions, T as TRUST_PANEL_ORIGIN, a as TrustPanelHandle, b as TrustPanelInput, c as TrustResult, d as TrustToken, e as TrustTokenStatus, f as TrustUnavailable, m as mountTrustPanel } from './trust-C0RcpR5I.mjs';
 import { P as PublicEntitlement, C as CrossdeckOptions, I as IdentifyOptions, A as AliasResult, G as GroupTraits, E as EventProperties, a as PurchaseResult, H as HeartbeatResponse, D as Diagnostics, K as KeyValueStorage } from './types-iqtsOTGy.mjs';
 export { b as AuditRail, c as AutoTrackOptions, d as EntitlementsListResponse, e as Environment, f as Platform } from './types-iqtsOTGy.mjs';
 
@@ -821,6 +823,25 @@ declare class CrossdeckClient {
      * user is authenticated.
      */
     getAnonymousId(): string | null;
+    /**
+     * **Crossdeck Trust** — human-proof at your signup, native to the SDK.
+     *
+     * `Crossdeck.trust.panel({ target, onToken })` renders the branded, un-restylable
+     * Trust panel (the same cross-origin iframe on every install) and mints a
+     * single-use attestation. Hand the token to your server and verify it at the gate
+     * (`crossdeck.trust.gate(...)` in @cross-deck/node). The publishable key is taken
+     * from your `init()` — you don't pass it again.
+     *
+     * Fail-open by contract: if the panel can't mint (adblocker, offline, our outage),
+     * `ready` resolves with `{ token: null }` and your signup proceeds — the server
+     * scores the missing token. It never throws and never blocks your form.
+     *
+     * @example
+     * const { ready } = Crossdeck.trust.panel({ target: "#cd-trust" });
+     * const result = await ready;                 // { token, expiresAt } | { token: null }
+     * await createUser({ email, cdTrustToken: result.token });
+     */
+    get trust(): CrossdeckTrustNamespace;
     private requireStarted;
     /**
      * Build the identity query for /v1/entitlements. Priority:
@@ -969,7 +990,7 @@ declare class MemoryStorage implements KeyValueStorage {
  *
  * Do NOT edit by hand — `node scripts/sync-sdk-versions.mjs`.
  */
-declare const SDK_VERSION = "1.12.1";
+declare const SDK_VERSION = "1.13.0";
 declare const SDK_NAME = "@cross-deck/web";
 
 /**
@@ -1053,4 +1074,4 @@ interface DeviceInfo {
     appVersion?: string;
 }
 
-export { AliasResult, type Breadcrumb, type BreadcrumbCategory, type BreadcrumbLevel, CROSSDECK_ERROR_CODES, type CapturedError, type ConsentState, type Contract, type ContractAppliesTo, type ContractFailureInput, type ContractPillar, type ContractStatus, type ContractTestRef, Crossdeck, CrossdeckClient, CrossdeckContracts, CrossdeckError, type CrossdeckErrorPayload, type CrossdeckErrorType, CrossdeckOptions, DEFAULT_BASE_URL, type DeviceInfo, Diagnostics, type ErrorCodeEntry, type ErrorLevel, EventProperties, GroupTraits, HeartbeatResponse, IdentifyOptions, KeyValueStorage, MemoryStorage, PublicEntitlement, PurchaseResult, SDK_NAME, SDK_VERSION, type StackFrame, getErrorCode };
+export { AliasResult, type Breadcrumb, type BreadcrumbCategory, type BreadcrumbLevel, CROSSDECK_ERROR_CODES, type CapturedError, type ConsentState, type Contract, type ContractAppliesTo, type ContractFailureInput, type ContractPillar, type ContractStatus, type ContractTestRef, Crossdeck, CrossdeckClient, CrossdeckContracts, CrossdeckError, type CrossdeckErrorPayload, type CrossdeckErrorType, CrossdeckOptions, CrossdeckTrustNamespace, DEFAULT_BASE_URL, type DeviceInfo, Diagnostics, type ErrorCodeEntry, type ErrorLevel, EventProperties, GroupTraits, HeartbeatResponse, IdentifyOptions, KeyValueStorage, MemoryStorage, PublicEntitlement, PurchaseResult, SDK_NAME, SDK_VERSION, type StackFrame, getErrorCode };

package/dist/index.d.ts

@@ -1,3 +1,5 @@
+import { C as CrossdeckTrustNamespace } from './trust-C0RcpR5I.js';
+export { M as MountTrustPanelOptions, T as TRUST_PANEL_ORIGIN, a as TrustPanelHandle, b as TrustPanelInput, c as TrustResult, d as TrustToken, e as TrustTokenStatus, f as TrustUnavailable, m as mountTrustPanel } from './trust-C0RcpR5I.js';
 import { P as PublicEntitlement, C as CrossdeckOptions, I as IdentifyOptions, A as AliasResult, G as GroupTraits, E as EventProperties, a as PurchaseResult, H as HeartbeatResponse, D as Diagnostics, K as KeyValueStorage } from './types-iqtsOTGy.js';
 export { b as AuditRail, c as AutoTrackOptions, d as EntitlementsListResponse, e as Environment, f as Platform } from './types-iqtsOTGy.js';
 
@@ -821,6 +823,25 @@ declare class CrossdeckClient {
      * user is authenticated.
      */
     getAnonymousId(): string | null;
+    /**
+     * **Crossdeck Trust** — human-proof at your signup, native to the SDK.
+     *
+     * `Crossdeck.trust.panel({ target, onToken })` renders the branded, un-restylable
+     * Trust panel (the same cross-origin iframe on every install) and mints a
+     * single-use attestation. Hand the token to your server and verify it at the gate
+     * (`crossdeck.trust.gate(...)` in @cross-deck/node). The publishable key is taken
+     * from your `init()` — you don't pass it again.
+     *
+     * Fail-open by contract: if the panel can't mint (adblocker, offline, our outage),
+     * `ready` resolves with `{ token: null }` and your signup proceeds — the server
+     * scores the missing token. It never throws and never blocks your form.
+     *
+     * @example
+     * const { ready } = Crossdeck.trust.panel({ target: "#cd-trust" });
+     * const result = await ready;                 // { token, expiresAt } | { token: null }
+     * await createUser({ email, cdTrustToken: result.token });
+     */
+    get trust(): CrossdeckTrustNamespace;
     private requireStarted;
     /**
      * Build the identity query for /v1/entitlements. Priority:
@@ -969,7 +990,7 @@ declare class MemoryStorage implements KeyValueStorage {
  *
  * Do NOT edit by hand — `node scripts/sync-sdk-versions.mjs`.
  */
-declare const SDK_VERSION = "1.12.1";
+declare const SDK_VERSION = "1.13.0";
 declare const SDK_NAME = "@cross-deck/web";
 
 /**
@@ -1053,4 +1074,4 @@ interface DeviceInfo {
     appVersion?: string;
 }
 
-export { AliasResult, type Breadcrumb, type BreadcrumbCategory, type BreadcrumbLevel, CROSSDECK_ERROR_CODES, type CapturedError, type ConsentState, type Contract, type ContractAppliesTo, type ContractFailureInput, type ContractPillar, type ContractStatus, type ContractTestRef, Crossdeck, CrossdeckClient, CrossdeckContracts, CrossdeckError, type CrossdeckErrorPayload, type CrossdeckErrorType, CrossdeckOptions, DEFAULT_BASE_URL, type DeviceInfo, Diagnostics, type ErrorCodeEntry, type ErrorLevel, EventProperties, GroupTraits, HeartbeatResponse, IdentifyOptions, KeyValueStorage, MemoryStorage, PublicEntitlement, PurchaseResult, SDK_NAME, SDK_VERSION, type StackFrame, getErrorCode };
+export { AliasResult, type Breadcrumb, type BreadcrumbCategory, type BreadcrumbLevel, CROSSDECK_ERROR_CODES, type CapturedError, type ConsentState, type Contract, type ContractAppliesTo, type ContractFailureInput, type ContractPillar, type ContractStatus, type ContractTestRef, Crossdeck, CrossdeckClient, CrossdeckContracts, CrossdeckError, type CrossdeckErrorPayload, type CrossdeckErrorType, CrossdeckOptions, CrossdeckTrustNamespace, DEFAULT_BASE_URL, type DeviceInfo, Diagnostics, type ErrorCodeEntry, type ErrorLevel, EventProperties, GroupTraits, HeartbeatResponse, IdentifyOptions, KeyValueStorage, MemoryStorage, PublicEntitlement, PurchaseResult, SDK_NAME, SDK_VERSION, type StackFrame, getErrorCode };

package/dist/index.mjs

@@ -69,7 +69,7 @@ function typeMapForStatus(status) {
 }
 
 // src/_version.ts
-var SDK_VERSION = "1.12.1";
+var SDK_VERSION = "1.13.0";
 var SDK_NAME = "@cross-deck/web";
 
 // src/http.ts
@@ -326,6 +326,125 @@ function randomChars(count) {
   return out.join("");
 }
 
+// src/trust.ts
+var TRUST_PANEL_ORIGIN = "https://trust.cross-deck.com";
+var MAX_WIDTH_PX = 360;
+var INITIAL_HEIGHT_PX = 132;
+var MIN_HEIGHT_PX = 96;
+var MAX_HEIGHT_PX = 220;
+var DEFAULT_TIMEOUT_MS2 = 15e3;
+function mountTrustPanel(opts) {
+  const origin = normalizeOrigin(opts.origin) || TRUST_PANEL_ORIGIN;
+  const timeoutMs = clampInt(opts.timeoutMs, DEFAULT_TIMEOUT_MS2, 1e3, 12e4);
+  let settled = false;
+  let onMessage = null;
+  let timer = null;
+  let frame = null;
+  let resolveReady;
+  const ready = new Promise((res) => {
+    resolveReady = res;
+  });
+  function settle(result, reason) {
+    if (settled) return;
+    settled = true;
+    if (timer) safe(() => clearTimeout(timer));
+    if (onMessage) safe(() => window.removeEventListener("message", onMessage));
+    if (result) {
+      safe(() => opts.onToken?.(result));
+      resolveReady(result);
+    } else {
+      const why = reason || "unavailable";
+      safe(() => opts.onUnavailable?.(why));
+      resolveReady({ token: null, expiresAt: null, reason: why });
+    }
+  }
+  try {
+    if (typeof window === "undefined" || typeof document === "undefined") {
+      queueMicrotask(() => settle(null, "no_dom"));
+      return makeHandle();
+    }
+    const host = resolveTarget(opts.target);
+    frame = createFrame(origin, opts.publicKey);
+    if (!host) {
+      queueMicrotask(() => settle(null, "no_mount_target"));
+      return makeHandle();
+    }
+    onMessage = (ev) => {
+      if (ev.origin !== origin) return;
+      if (!ev.data || !frame || ev.source !== frame.contentWindow) return;
+      const d = ev.data;
+      if (d.type === "cd-trust-size" && typeof d.height === "number") {
+        safe(() => {
+          if (frame) frame.style.height = clampInt(d.height, INITIAL_HEIGHT_PX, MIN_HEIGHT_PX, MAX_HEIGHT_PX) + "px";
+        });
+      } else if (d.type === "cd-trust-token" && typeof d.token === "string") {
+        settle({ token: d.token, expiresAt: typeof d.expMs === "number" ? d.expMs : null });
+      }
+    };
+    window.addEventListener("message", onMessage);
+    host.appendChild(frame);
+    timer = setTimeout(() => settle(null, "timeout"), timeoutMs);
+  } catch (err) {
+    queueMicrotask(() => settle(null, "mount_error:" + safeMessage(err)));
+  }
+  return makeHandle();
+  function makeHandle() {
+    return {
+      frame,
+      ready,
+      destroy() {
+        if (onMessage) safe(() => window.removeEventListener("message", onMessage));
+        if (timer) safe(() => clearTimeout(timer));
+        safe(() => frame?.parentNode?.removeChild(frame));
+        settle(null, "destroyed");
+      }
+    };
+  }
+}
+function createFrame(origin, publicKey) {
+  const frame = document.createElement("iframe");
+  frame.title = "Protected by Crossdeck Trust";
+  frame.setAttribute("aria-label", "Protected by Crossdeck Trust");
+  frame.setAttribute("scrolling", "no");
+  frame.setAttribute("allowtransparency", "true");
+  frame.style.cssText = "border:0;display:block;width:100%;max-width:" + MAX_WIDTH_PX + "px;height:" + INITIAL_HEIGHT_PX + "px;margin:0;background:transparent;color-scheme:light;";
+  frame.src = origin + "/panel?k=" + encodeURIComponent(publicKey || "");
+  return frame;
+}
+function resolveTarget(target) {
+  try {
+    if (typeof target === "string") return document.querySelector(target);
+    return target || null;
+  } catch {
+    return null;
+  }
+}
+function normalizeOrigin(o) {
+  if (!o || typeof o !== "string") return null;
+  try {
+    return new URL(o).origin;
+  } catch {
+    return null;
+  }
+}
+function clampInt(v, fallback, min, max) {
+  const n = typeof v === "number" && isFinite(v) ? v : fallback;
+  return Math.min(Math.max(n, min), max);
+}
+function safe(fn) {
+  try {
+    fn();
+  } catch {
+  }
+}
+function safeMessage(err) {
+  try {
+    return err instanceof Error ? err.message : String(err);
+  } catch {
+    return "unknown";
+  }
+}
+
 // src/hash.ts
 var K = new Uint32Array([
   1116352408,
@@ -5788,6 +5907,30 @@ var CrossdeckClient = class {
   getAnonymousId() {
     return this.state ? this.state.identity.anonymousId : null;
   }
+  /**
+   * **Crossdeck Trust** — human-proof at your signup, native to the SDK.
+   *
+   * `Crossdeck.trust.panel({ target, onToken })` renders the branded, un-restylable
+   * Trust panel (the same cross-origin iframe on every install) and mints a
+   * single-use attestation. Hand the token to your server and verify it at the gate
+   * (`crossdeck.trust.gate(...)` in @cross-deck/node). The publishable key is taken
+   * from your `init()` — you don't pass it again.
+   *
+   * Fail-open by contract: if the panel can't mint (adblocker, offline, our outage),
+   * `ready` resolves with `{ token: null }` and your signup proceeds — the server
+   * scores the missing token. It never throws and never blocks your form.
+   *
+   * @example
+   * const { ready } = Crossdeck.trust.panel({ target: "#cd-trust" });
+   * const result = await ready;                 // { token, expiresAt } | { token: null }
+   * await createUser({ email, cdTrustToken: result.token });
+   */
+  get trust() {
+    const publicKey = this.state ? this.state.options.publicKey : "";
+    return {
+      panel: (input) => mountTrustPanel({ ...input, publicKey })
+    };
+  }
   // ---------- private helpers ----------
   requireStarted() {
     if (!this.state) {
@@ -6579,6 +6722,8 @@ export {
   MemoryStorage,
   SDK_NAME,
   SDK_VERSION,
-  getErrorCode
+  TRUST_PANEL_ORIGIN,
+  getErrorCode,
+  mountTrustPanel
 };
 //# sourceMappingURL=index.mjs.map