@cross-deck/web 1.6.1 → 1.6.3

package/dist/index.cjs

@@ -99,7 +99,7 @@ function typeMapForStatus(status) {
 }
 
 // src/_version.ts
-var SDK_VERSION = "1.6.1";
+var SDK_VERSION = "1.6.3";
 var SDK_NAME = "@cross-deck/web";
 
 // src/http.ts
@@ -1524,6 +1524,13 @@ var AutoTracker = class {
   markActivity() {
     if (!this.session) return;
     const now = Date.now();
+    if (now - this.session.lastActivityAt >= SESSION_RESUME_THRESHOLD_MS) {
+      this.pageviewId = null;
+      this.session = this.startNewSession();
+      this.persistSession();
+      this.emitSessionStart();
+      return;
+    }
     this.session.lastActivityAt = now;
     if (now - this.lastPersistAt >= ACTIVITY_PERSIST_THROTTLE_MS) {
       this.persistSession();
@@ -1577,7 +1584,6 @@ var AutoTracker = class {
       } else if (doc2.visibilityState === "visible") {
         const idleFor = Date.now() - this.session.lastActivityAt;
         if (idleFor >= SESSION_RESUME_THRESHOLD_MS) {
-          this.emitSessionEnd();
           this.pageviewId = null;
           this.session = this.startNewSession();
           this.persistSession();
@@ -2639,6 +2645,210 @@ function sendDiagnosticTelemetry(payload) {
   }
 }
 
+// src/error-codes.ts
+var CROSSDECK_ERROR_CODES = Object.freeze([
+  // ----- Configuration -----
+  {
+    code: "invalid_public_key",
+    type: "configuration_error",
+    description: "The publishable key passed to Crossdeck.init() doesn't start with cd_pub_.",
+    resolution: "Copy the key from your Crossdeck dashboard \u2192 API keys page.",
+    retryable: false
+  },
+  {
+    code: "missing_app_id",
+    type: "configuration_error",
+    description: "Crossdeck.init() was called without an appId.",
+    resolution: "Add appId to your init options \u2014 find it in the dashboard's Apps page.",
+    retryable: false
+  },
+  {
+    code: "invalid_environment",
+    type: "configuration_error",
+    description: "Crossdeck.init() requires environment: 'production' | 'sandbox'.",
+    resolution: 'Pass the literal string "production" or "sandbox" \u2014 no other values are accepted.',
+    retryable: false
+  },
+  {
+    code: "environment_mismatch",
+    type: "configuration_error",
+    description: "The publishable key's env prefix doesn't match the declared environment option.",
+    resolution: "Either change `environment` to match the key prefix (cd_pub_test_ \u2194 sandbox, cd_pub_live_ \u2194 production), or swap the key for one minted in the right env.",
+    retryable: false
+  },
+  {
+    code: "not_initialized",
+    type: "configuration_error",
+    description: "An SDK method was called before Crossdeck.init().",
+    resolution: "Call Crossdeck.init({ appId, publicKey, environment }) once at app startup before any other method.",
+    retryable: false
+  },
+  // ----- Identify / track / purchase argument validation -----
+  {
+    code: "missing_user_id",
+    type: "invalid_request_error",
+    description: "identify() was called with an empty userId.",
+    resolution: "Pass a stable, non-empty user identifier from your auth layer \u2014 never a hardcoded placeholder.",
+    retryable: false
+  },
+  {
+    code: "missing_event_name",
+    type: "invalid_request_error",
+    description: "track() was called without an event name.",
+    resolution: "Pass a non-empty string as the first argument.",
+    retryable: false
+  },
+  {
+    code: "missing_group_type",
+    type: "invalid_request_error",
+    description: "group() was called without a group type.",
+    resolution: 'Pass a non-empty type (e.g. "org", "team") as the first argument.',
+    retryable: false
+  },
+  {
+    code: "missing_signed_transaction_info",
+    type: "invalid_request_error",
+    description: "syncPurchases() was called without StoreKit 2 signed transaction info.",
+    resolution: "Pass the JWS string from Transaction.currentEntitlements / Transaction.updates.",
+    retryable: false
+  },
+  // ----- Network / transport -----
+  {
+    code: "fetch_failed",
+    type: "network_error",
+    description: "The underlying fetch() call failed (typically a network outage or DNS issue).",
+    resolution: "Check the user's network. The SDK will retry automatically with exponential backoff.",
+    retryable: true
+  },
+  {
+    code: "request_timeout",
+    type: "network_error",
+    description: "A request was aborted after the configured timeoutMs (default 15s).",
+    resolution: "Check the user's connection. Increase timeoutMs in init options if the user is on a known-slow network.",
+    retryable: true
+  },
+  {
+    code: "invalid_json_response",
+    type: "internal_error",
+    description: "The server returned a 2xx with an unparseable body.",
+    resolution: "Likely a transient backend bug. Retry; if it persists, contact support with the requestId.",
+    retryable: true
+  },
+  // ----- Backend-emitted codes (v1.4.0 Phase 6.2 backfill) -----
+  // Mirror of backend/src/api/v1-errors.ts ApiErrorCode. A developer
+  // hitting any of these on the wire can look them up via
+  // getErrorCode(code) for a canonical remediation step instead of
+  // hunting through Slack history.
+  {
+    code: "missing_api_key",
+    type: "authentication_error",
+    description: "No Authorization header (or Crossdeck-Api-Key header) on the request.",
+    resolution: "Make sure Crossdeck.init({ publicKey }) was called with a cd_pub_\u2026 key before the request fired. Re-check your env-vars in CI / Docker if the key is empty at runtime.",
+    retryable: false
+  },
+  {
+    code: "invalid_api_key",
+    type: "authentication_error",
+    description: "The API key is malformed, unknown, or doesn't resolve to a project.",
+    resolution: "Copy the key from your Crossdeck dashboard \u2192 API keys. Confirm prefix is cd_pub_test_ / cd_pub_live_ for client SDKs and cd_sk_test_ / cd_sk_live_ for the Node server SDK.",
+    retryable: false
+  },
+  {
+    code: "key_revoked",
+    type: "authentication_error",
+    description: "The API key was revoked in the Crossdeck dashboard.",
+    resolution: "Mint a fresh key in the dashboard \u2192 API keys \u2192 Create new, swap it in, and redeploy. The revoked key cannot be reactivated.",
+    retryable: false
+  },
+  {
+    code: "identity_token_invalid",
+    type: "authentication_error",
+    description: "The Firebase / Apple / Google ID token supplied with the request didn't verify against the dashboard's configured signers.",
+    resolution: "Refresh the token client-side (Firebase auth.currentUser.getIdToken(true)) and retry. If the failure persists, confirm the signer is registered under dashboard \u2192 Authentication \u2192 Identity sources.",
+    retryable: true
+  },
+  {
+    code: "origin_not_allowed",
+    type: "permission_error",
+    description: "The Origin header isn't in the project's Allowed origins list.",
+    resolution: "Add the origin (e.g. https://app.example.com) under dashboard \u2192 Settings \u2192 Allowed origins. Wildcards like https://*.example.com are supported.",
+    retryable: false
+  },
+  {
+    code: "bundle_id_not_allowed",
+    type: "permission_error",
+    description: "The iOS bundle ID sent via X-Crossdeck-Bundle-Id isn't registered under this app's Apple identity lock.",
+    resolution: "Add the bundle ID under dashboard \u2192 Apps \u2192 <your app> \u2192 iOS bundle IDs.",
+    retryable: false
+  },
+  {
+    code: "package_name_not_allowed",
+    type: "permission_error",
+    description: "The Android package name sent via X-Crossdeck-Package-Name isn't registered under this app's Android identity lock.",
+    resolution: "Add the package name under dashboard \u2192 Apps \u2192 <your app> \u2192 Android package names.",
+    retryable: false
+  },
+  {
+    code: "env_mismatch",
+    type: "permission_error",
+    description: "The request env (inferred from key prefix) doesn't match the resolved app's configured env.",
+    resolution: "Use a cd_pub_live_ / cd_sk_live_ key with a production app, cd_pub_test_ / cd_sk_test_ with a sandbox app. The two cannot cross.",
+    retryable: false
+  },
+  {
+    code: "idempotency_key_in_use",
+    type: "invalid_request_error",
+    description: "An Idempotency-Key was reused for a request with a different body (Stripe-grade contract).",
+    resolution: "Generate a fresh key for a different transaction, or reuse the key only with the EXACT same body. The v1.4.0 SDKs derive keys deterministically from the body so this should never fire on SDK-managed calls.",
+    retryable: false
+  },
+  {
+    code: "rate_limited",
+    type: "rate_limit_error",
+    description: "Request rate exceeded the project's per-second cap.",
+    resolution: "Honour the Retry-After header \u2014 the SDK does this automatically on managed retries. If you're hitting it from a custom code path, throttle to <100 req/s/key.",
+    retryable: true
+  },
+  {
+    code: "internal_error",
+    type: "internal_error",
+    description: "Server-side issue. Safe to retry with backoff.",
+    resolution: "The SDK retries automatically. If your code paths through to this error, contact support with the requestId from the response envelope.",
+    retryable: true
+  },
+  {
+    code: "google_not_supported",
+    type: "invalid_request_error",
+    description: "POST /purchases/sync with rail=google is gated until the Play Developer API reconciliation worker ships.",
+    resolution: "Until v1.5+, Google Play purchases verify via Real-time Developer Notifications. The SDK auto-track path handles this transparently for Android consumers.",
+    retryable: false
+  },
+  {
+    code: "stripe_not_supported",
+    type: "invalid_request_error",
+    description: "POST /purchases/sync with rail=stripe is unsupported \u2014 Stripe Checkout's redirect flow uses platform webhooks instead.",
+    resolution: "Wire Stripe via the standard Checkout / Customer Portal flow; Crossdeck reconciles via the platform webhook automatically. No SDK call needed.",
+    retryable: false
+  },
+  {
+    code: "missing_required_param",
+    type: "invalid_request_error",
+    description: "A required field is absent from the request body.",
+    resolution: "Inspect the error.message \u2014 the missing field name is included verbatim. Refer to the SDK's TypeScript types for the canonical request shape.",
+    retryable: false
+  },
+  {
+    code: "invalid_param_value",
+    type: "invalid_request_error",
+    description: "A field is present but the value failed validation (wrong shape, wrong length, wrong enum value).",
+    resolution: "Read error.message for the specific field + reason. SDK-managed call sites should never emit this \u2014 file a bug if you do.",
+    retryable: false
+  }
+]);
+function getErrorCode(code) {
+  return CROSSDECK_ERROR_CODES.find((e) => e.code === code);
+}
+
 // src/_contract-verifiers.ts
 function buildVerifierContext(opts) {
   return {
@@ -3163,13 +3373,64 @@ var VERIFIER_CONTRACT_FAILED_PAYLOAD_SCHEMA_LOCK = {
     );
   }
 };
+var BACKEND_WIRE_CODES = Object.freeze([
+  "missing_api_key",
+  "invalid_api_key",
+  "key_revoked",
+  "identity_token_invalid",
+  "origin_not_allowed",
+  "bundle_id_not_allowed",
+  "package_name_not_allowed",
+  "env_mismatch",
+  "idempotency_key_in_use",
+  "rate_limited",
+  "internal_error",
+  "google_not_supported",
+  "stripe_not_supported",
+  "missing_required_param",
+  "invalid_param_value"
+]);
+var VERIFIER_SDK_ERROR_CODES_CATALOGUE = {
+  contractId: "sdk-error-codes-catalogue",
+  bootTest() {
+    const t0 = nowMs();
+    try {
+      const missing = [];
+      for (const code of BACKEND_WIRE_CODES) {
+        const entry = getErrorCode(code);
+        if (!entry || !entry.description || entry.description.trim().length === 0 || !entry.resolution || entry.resolution.trim().length === 0) {
+          missing.push(code);
+        }
+      }
+      if (missing.length > 0) {
+        return fail(
+          "sdk-error-codes-catalogue",
+          `catalogue missing description+resolution for backend code(s): ${missing.join(", ")}`,
+          nowMs() - t0
+        );
+      }
+      return pass(
+        "sdk-error-codes-catalogue",
+        `all ${BACKEND_WIRE_CODES.length} backend wire codes carry description + resolution`,
+        nowMs() - t0
+      );
+    } catch (err) {
+      return fail(
+        "sdk-error-codes-catalogue",
+        `boot test threw: ${err.message?.slice(0, 80) ?? "unknown error"}`,
+        nowMs() - t0
+      );
+    }
+  }
+};
 var STATIC_VERIFIERS = Object.freeze([
   VERIFIER_PER_USER_CACHE_ISOLATION,
   VERIFIER_IDEMPOTENCY_KEY_DETERMINISTIC,
   VERIFIER_ERROR_ENVELOPE_SHAPE,
   VERIFIER_FLUSH_INTERVAL_PARITY,
   VERIFIER_SUPER_PROPERTY_MERGE_PRECEDENCE,
-  VERIFIER_CONTRACT_FAILED_PAYLOAD_SCHEMA_LOCK
+  VERIFIER_CONTRACT_FAILED_PAYLOAD_SCHEMA_LOCK,
+  VERIFIER_SDK_ERROR_CODES_CATALOGUE
 ]);
 async function runBootSelfTest(verifiers, reporter, ctx) {
   if (ctx.disableContractAssertions) {
@@ -3682,7 +3943,7 @@ var ErrorTracker = class {
         }
         return response;
       } catch (err) {
-        if (this.opts.isConsented() && !url.includes("api.cross-deck.com")) {
+        if (this.opts.isConsented() && !url.includes("api.cross-deck.com") && !isClientNetworkNoise(url, err, w)) {
           this.captureHttp({
             url,
             method,
@@ -4081,6 +4342,19 @@ function isSelfRequest(requestUrl, selfHostname) {
     return false;
   }
 }
+function isClientNetworkNoise(requestUrl, err, w) {
+  if (err instanceof Error && err.name === "AbortError") return true;
+  const nav = w.navigator;
+  if (nav && nav.onLine === false) return true;
+  const pageHref = w.location?.href;
+  const pageOrigin = w.location?.origin;
+  if (!pageOrigin) return false;
+  try {
+    return new URL(requestUrl, pageHref ?? pageOrigin).origin === pageOrigin;
+  } catch {
+    return false;
+  }
+}
 
 // src/crossdeck.ts
 var CrossdeckClient = class {
@@ -5321,213 +5595,9 @@ function installUnloadFlush(onUnload) {
   };
 }
 
-// src/error-codes.ts
-var CROSSDECK_ERROR_CODES = Object.freeze([
-  // ----- Configuration -----
-  {
-    code: "invalid_public_key",
-    type: "configuration_error",
-    description: "The publishable key passed to Crossdeck.init() doesn't start with cd_pub_.",
-    resolution: "Copy the key from your Crossdeck dashboard \u2192 API keys page.",
-    retryable: false
-  },
-  {
-    code: "missing_app_id",
-    type: "configuration_error",
-    description: "Crossdeck.init() was called without an appId.",
-    resolution: "Add appId to your init options \u2014 find it in the dashboard's Apps page.",
-    retryable: false
-  },
-  {
-    code: "invalid_environment",
-    type: "configuration_error",
-    description: "Crossdeck.init() requires environment: 'production' | 'sandbox'.",
-    resolution: 'Pass the literal string "production" or "sandbox" \u2014 no other values are accepted.',
-    retryable: false
-  },
-  {
-    code: "environment_mismatch",
-    type: "configuration_error",
-    description: "The publishable key's env prefix doesn't match the declared environment option.",
-    resolution: "Either change `environment` to match the key prefix (cd_pub_test_ \u2194 sandbox, cd_pub_live_ \u2194 production), or swap the key for one minted in the right env.",
-    retryable: false
-  },
-  {
-    code: "not_initialized",
-    type: "configuration_error",
-    description: "An SDK method was called before Crossdeck.init().",
-    resolution: "Call Crossdeck.init({ appId, publicKey, environment }) once at app startup before any other method.",
-    retryable: false
-  },
-  // ----- Identify / track / purchase argument validation -----
-  {
-    code: "missing_user_id",
-    type: "invalid_request_error",
-    description: "identify() was called with an empty userId.",
-    resolution: "Pass a stable, non-empty user identifier from your auth layer \u2014 never a hardcoded placeholder.",
-    retryable: false
-  },
-  {
-    code: "missing_event_name",
-    type: "invalid_request_error",
-    description: "track() was called without an event name.",
-    resolution: "Pass a non-empty string as the first argument.",
-    retryable: false
-  },
-  {
-    code: "missing_group_type",
-    type: "invalid_request_error",
-    description: "group() was called without a group type.",
-    resolution: 'Pass a non-empty type (e.g. "org", "team") as the first argument.',
-    retryable: false
-  },
-  {
-    code: "missing_signed_transaction_info",
-    type: "invalid_request_error",
-    description: "syncPurchases() was called without StoreKit 2 signed transaction info.",
-    resolution: "Pass the JWS string from Transaction.currentEntitlements / Transaction.updates.",
-    retryable: false
-  },
-  // ----- Network / transport -----
-  {
-    code: "fetch_failed",
-    type: "network_error",
-    description: "The underlying fetch() call failed (typically a network outage or DNS issue).",
-    resolution: "Check the user's network. The SDK will retry automatically with exponential backoff.",
-    retryable: true
-  },
-  {
-    code: "request_timeout",
-    type: "network_error",
-    description: "A request was aborted after the configured timeoutMs (default 15s).",
-    resolution: "Check the user's connection. Increase timeoutMs in init options if the user is on a known-slow network.",
-    retryable: true
-  },
-  {
-    code: "invalid_json_response",
-    type: "internal_error",
-    description: "The server returned a 2xx with an unparseable body.",
-    resolution: "Likely a transient backend bug. Retry; if it persists, contact support with the requestId.",
-    retryable: true
-  },
-  // ----- Backend-emitted codes (v1.4.0 Phase 6.2 backfill) -----
-  // Mirror of backend/src/api/v1-errors.ts ApiErrorCode. A developer
-  // hitting any of these on the wire can look them up via
-  // getErrorCode(code) for a canonical remediation step instead of
-  // hunting through Slack history.
-  {
-    code: "missing_api_key",
-    type: "authentication_error",
-    description: "No Authorization header (or Crossdeck-Api-Key header) on the request.",
-    resolution: "Make sure Crossdeck.init({ publicKey }) was called with a cd_pub_\u2026 key before the request fired. Re-check your env-vars in CI / Docker if the key is empty at runtime.",
-    retryable: false
-  },
-  {
-    code: "invalid_api_key",
-    type: "authentication_error",
-    description: "The API key is malformed, unknown, or doesn't resolve to a project.",
-    resolution: "Copy the key from your Crossdeck dashboard \u2192 API keys. Confirm prefix is cd_pub_test_ / cd_pub_live_ for client SDKs and cd_sk_test_ / cd_sk_live_ for the Node server SDK.",
-    retryable: false
-  },
-  {
-    code: "key_revoked",
-    type: "authentication_error",
-    description: "The API key was revoked in the Crossdeck dashboard.",
-    resolution: "Mint a fresh key in the dashboard \u2192 API keys \u2192 Create new, swap it in, and redeploy. The revoked key cannot be reactivated.",
-    retryable: false
-  },
-  {
-    code: "identity_token_invalid",
-    type: "authentication_error",
-    description: "The Firebase / Apple / Google ID token supplied with the request didn't verify against the dashboard's configured signers.",
-    resolution: "Refresh the token client-side (Firebase auth.currentUser.getIdToken(true)) and retry. If the failure persists, confirm the signer is registered under dashboard \u2192 Authentication \u2192 Identity sources.",
-    retryable: true
-  },
-  {
-    code: "origin_not_allowed",
-    type: "permission_error",
-    description: "The Origin header isn't in the project's Allowed origins list.",
-    resolution: "Add the origin (e.g. https://app.example.com) under dashboard \u2192 Settings \u2192 Allowed origins. Wildcards like https://*.example.com are supported.",
-    retryable: false
-  },
-  {
-    code: "bundle_id_not_allowed",
-    type: "permission_error",
-    description: "The iOS bundle ID sent via X-Crossdeck-Bundle-Id isn't registered under this app's Apple identity lock.",
-    resolution: "Add the bundle ID under dashboard \u2192 Apps \u2192 <your app> \u2192 iOS bundle IDs.",
-    retryable: false
-  },
-  {
-    code: "package_name_not_allowed",
-    type: "permission_error",
-    description: "The Android package name sent via X-Crossdeck-Package-Name isn't registered under this app's Android identity lock.",
-    resolution: "Add the package name under dashboard \u2192 Apps \u2192 <your app> \u2192 Android package names.",
-    retryable: false
-  },
-  {
-    code: "env_mismatch",
-    type: "permission_error",
-    description: "The request env (inferred from key prefix) doesn't match the resolved app's configured env.",
-    resolution: "Use a cd_pub_live_ / cd_sk_live_ key with a production app, cd_pub_test_ / cd_sk_test_ with a sandbox app. The two cannot cross.",
-    retryable: false
-  },
-  {
-    code: "idempotency_key_in_use",
-    type: "invalid_request_error",
-    description: "An Idempotency-Key was reused for a request with a different body (Stripe-grade contract).",
-    resolution: "Generate a fresh key for a different transaction, or reuse the key only with the EXACT same body. The v1.4.0 SDKs derive keys deterministically from the body so this should never fire on SDK-managed calls.",
-    retryable: false
-  },
-  {
-    code: "rate_limited",
-    type: "rate_limit_error",
-    description: "Request rate exceeded the project's per-second cap.",
-    resolution: "Honour the Retry-After header \u2014 the SDK does this automatically on managed retries. If you're hitting it from a custom code path, throttle to <100 req/s/key.",
-    retryable: true
-  },
-  {
-    code: "internal_error",
-    type: "internal_error",
-    description: "Server-side issue. Safe to retry with backoff.",
-    resolution: "The SDK retries automatically. If your code paths through to this error, contact support with the requestId from the response envelope.",
-    retryable: true
-  },
-  {
-    code: "google_not_supported",
-    type: "invalid_request_error",
-    description: "POST /purchases/sync with rail=google is gated until the Play Developer API reconciliation worker ships.",
-    resolution: "Until v1.5+, Google Play purchases verify via Real-time Developer Notifications. The SDK auto-track path handles this transparently for Android consumers.",
-    retryable: false
-  },
-  {
-    code: "stripe_not_supported",
-    type: "invalid_request_error",
-    description: "POST /purchases/sync with rail=stripe is unsupported \u2014 Stripe Checkout's redirect flow uses platform webhooks instead.",
-    resolution: "Wire Stripe via the standard Checkout / Customer Portal flow; Crossdeck reconciles via the platform webhook automatically. No SDK call needed.",
-    retryable: false
-  },
-  {
-    code: "missing_required_param",
-    type: "invalid_request_error",
-    description: "A required field is absent from the request body.",
-    resolution: "Inspect the error.message \u2014 the missing field name is included verbatim. Refer to the SDK's TypeScript types for the canonical request shape.",
-    retryable: false
-  },
-  {
-    code: "invalid_param_value",
-    type: "invalid_request_error",
-    description: "A field is present but the value failed validation (wrong shape, wrong length, wrong enum value).",
-    resolution: "Read error.message for the specific field + reason. SDK-managed call sites should never emit this \u2014 file a bug if you do.",
-    retryable: false
-  }
-]);
-function getErrorCode(code) {
-  return CROSSDECK_ERROR_CODES.find((e) => e.code === code);
-}
-
 // src/_contracts-bundled.ts
-var BUNDLED_IN = "@cross-deck/web@1.6.1";
-var SDK_VERSION2 = "1.6.1";
+var BUNDLED_IN = "@cross-deck/web@1.6.3";
+var SDK_VERSION2 = "1.6.3";
 var BUNDLED_CONTRACTS = Object.freeze([
   {
     "id": "contract-failed-payload-schema-lock",
@@ -5649,7 +5719,8 @@ var BUNDLED_CONTRACTS = Object.freeze([
       "legal/security/index.html#diagnostic",
       "legal/sdk-data/index.html#b-diagnostic"
     ],
-    "bundledIn": "@cross-deck/web@1.6.1"
+    "bundledIn": "@cross-deck/web@1.6.3",
+    "runtimeVerified": true
   },
   {
     "id": "error-envelope-shape",
@@ -5688,7 +5759,8 @@ var BUNDLED_CONTRACTS = Object.freeze([
     ],
     "registeredAt": "2026-05-26",
     "firstRegisteredIn": "bank-grade reconciliation v1.4.0 \u2014 phase 8 (codifies existing contract)",
-    "bundledIn": "@cross-deck/web@1.6.1"
+    "bundledIn": "@cross-deck/web@1.6.3",
+    "runtimeVerified": true
   },
   {
     "id": "flush-interval-parity",
@@ -5733,7 +5805,8 @@ var BUNDLED_CONTRACTS = Object.freeze([
     ],
     "registeredAt": "2026-05-26",
     "firstRegisteredIn": "bank-grade reconciliation v1.4.0 \u2014 phase 3.3",
-    "bundledIn": "@cross-deck/web@1.6.1"
+    "bundledIn": "@cross-deck/web@1.6.3",
+    "runtimeVerified": true
   },
   {
     "id": "idempotency-key-deterministic",
@@ -5838,7 +5911,8 @@ var BUNDLED_CONTRACTS = Object.freeze([
     ],
     "registeredAt": "2026-05-26",
     "firstRegisteredIn": "bank-grade reconciliation v1.4.0 \u2014 phase 2.2.a + 2.2.b + 2.2.c",
-    "bundledIn": "@cross-deck/web@1.6.1"
+    "bundledIn": "@cross-deck/web@1.6.3",
+    "runtimeVerified": true
   },
   {
     "id": "init-reentry-drains-prior-queue",
@@ -5865,7 +5939,8 @@ var BUNDLED_CONTRACTS = Object.freeze([
     ],
     "registeredAt": "2026-05-26",
     "firstRegisteredIn": "bank-grade reconciliation v1.4.0 \u2014 phase 5.5",
-    "bundledIn": "@cross-deck/web@1.6.1"
+    "bundledIn": "@cross-deck/web@1.6.3",
+    "runtimeVerified": false
   },
   {
     "id": "per-user-cache-isolation",
@@ -5944,7 +6019,8 @@ var BUNDLED_CONTRACTS = Object.freeze([
     ],
     "registeredAt": "2026-05-26",
     "firstRegisteredIn": "bank-grade reconciliation v1.4.0 \u2014 phase 1.3 (web/RN) + dogfood-gap fix (swift + android)",
-    "bundledIn": "@cross-deck/web@1.6.1"
+    "bundledIn": "@cross-deck/web@1.6.3",
+    "runtimeVerified": true
   },
   {
     "id": "sdk-error-codes-catalogue",
@@ -5958,9 +6034,14 @@ var BUNDLED_CONTRACTS = Object.freeze([
     "codeRef": [
       "sdks/web/src/error-codes.ts",
       "sdks/node/src/error-codes.ts",
+      "sdks/web/src/_contract-verifiers.ts",
       "backend/src/api/v1-errors.ts"
     ],
     "testRef": [
+      {
+        "file": "sdks/web/tests/contract-verifiers.test.ts",
+        "name": "sdk-error-codes-catalogue covers every backend wire code with remediation"
+      },
       {
         "file": "sdks/web/tests/error-codes-backfill.test.ts",
         "name": "includes backend code"
@@ -5984,7 +6065,50 @@ var BUNDLED_CONTRACTS = Object.freeze([
     ],
     "registeredAt": "2026-05-26",
     "firstRegisteredIn": "bank-grade reconciliation v1.4.0 \u2014 phase 6.2",
-    "bundledIn": "@cross-deck/web@1.6.1"
+    "bundledIn": "@cross-deck/web@1.6.3",
+    "runtimeVerified": true
+  },
+  {
+    "id": "super-property-merge-precedence",
+    "pillar": "analytics",
+    "status": "enforced",
+    "claim": "Every Crossdeck SDK merges event properties with the precedence device < super < caller (caller-supplied values win over registered super-properties, which win over auto-attached device info). Pre-v1.4.0 Swift had it INVERTED (super < device < caller \u2014 device clobbered super), so a `register('plan', 'pro')` super-property was silently overridden by auto-attached device fields whenever keys collided. Cross-SDK funnel queries on super-property keys returned different answers per platform.",
+    "appliesTo": [
+      "web",
+      "swift"
+    ],
+    "codeRef": [
+      "sdks/web/src/super-properties.ts",
+      "sdks/web/src/_contract-verifiers.ts",
+      "sdks/swift/Sources/Crossdeck/EventPropertyMerge.swift",
+      "sdks/swift/Sources/Crossdeck/Crossdeck.swift"
+    ],
+    "testRef": [
+      {
+        "file": "sdks/web/tests/contract-verifiers.test.ts",
+        "name": "super-property-merge-precedence verifies caller > super > device"
+      },
+      {
+        "file": "sdks/swift/Tests/CrossdeckTests/EventPropertyMergeTests.swift",
+        "name": "test_super_overrides_device"
+      },
+      {
+        "file": "sdks/swift/Tests/CrossdeckTests/EventPropertyMergeTests.swift",
+        "name": "test_caller_overrides_super"
+      },
+      {
+        "file": "sdks/swift/Tests/CrossdeckTests/EventPropertyMergeTests.swift",
+        "name": "test_full_precedence_chain"
+      },
+      {
+        "file": "sdks/swift/Tests/CrossdeckTests/EventPropertyMergeTests.swift",
+        "name": "test_matchesWebNodeRNPrecedence"
+      }
+    ],
+    "registeredAt": "2026-05-26",
+    "firstRegisteredIn": "bank-grade reconciliation v1.4.0 \u2014 phase 3.2",
+    "bundledIn": "@cross-deck/web@1.6.3",
+    "runtimeVerified": true
   },
   {
     "id": "sync-purchases-funnel-parity",
@@ -6017,7 +6141,8 @@ var BUNDLED_CONTRACTS = Object.freeze([
     ],
     "registeredAt": "2026-05-26",
     "firstRegisteredIn": "bank-grade reconciliation v1.4.0 \u2014 phase 3.5",
-    "bundledIn": "@cross-deck/web@1.6.1"
+    "bundledIn": "@cross-deck/web@1.6.3",
+    "runtimeVerified": false
   }
 ]);