@cross-deck/web 1.6.3 → 1.6.4

package/CHANGELOG.md

@@ -2,6 +2,27 @@
 
 All notable changes to `@cross-deck/web` will be documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.6.4] — 2026-06-01
+
+Patch — contract-integrity fixes. Two issues found by adversarial testing of
+the shipped contracts against real wire traffic. No public API change.
+
+**`super-property-merge-precedence` — registered super-properties now win over
+auto-collected fields, as the contract claims.** The merge had an inverted
+guard (`if (!(k in enriched))`) so a device-seeded key (`os`, `locale`,
+`timezone`, …) silently clobbered a value set via `register()`. Effective order
+is now **caller > super > auto-collected**; caller properties still win.
+
+**Three contracts were stamped `runtimeVerified: true` but only had a boot-time
+self-test (off by default in production) — now they run on real production
+hot-path hooks.** `flush-interval-parity` validates the live flush interval on
+every `track()`; `sdk-error-codes-catalogue` confirms each real wire error's
+code carries remediation on `onErrorParse`; `contract-failed-payload-schema-lock`
+schema-locks the actual outgoing telemetry on the emit path. The bundled-manifest
+generator now derives `runtimeVerified` from the presence of a hot-path hook
+(not merely a registered verifier), so the flag can no longer claim runtime
+enforcement a verifier doesn't deliver.
+
 ## [1.6.3] — 2026-06-01
 
 Patch — error-capture noise reduction. The fetch wrapper raised an

package/dist/contracts.json

@@ -1,9 +1,9 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "generatedAt": "2026-06-01T07:38:09.435Z",
+  "generatedAt": "2026-06-01T09:52:17.822Z",
   "sdk": "@cross-deck/web",
-  "sdkVersion": "1.6.3",
-  "bundledIn": "@cross-deck/web@1.6.3",
+  "sdkVersion": "1.6.4",
+  "bundledIn": "@cross-deck/web@1.6.4",
   "count": 9,
   "contracts": [
     {
@@ -126,7 +126,7 @@
         "legal/security/index.html#diagnostic",
         "legal/sdk-data/index.html#b-diagnostic"
       ],
-      "bundledIn": "@cross-deck/web@1.6.3"
+      "bundledIn": "@cross-deck/web@1.6.4"
     },
     {
       "id": "error-envelope-shape",
@@ -165,7 +165,7 @@
       ],
       "registeredAt": "2026-05-26",
       "firstRegisteredIn": "bank-grade reconciliation v1.4.0 — phase 8 (codifies existing contract)",
-      "bundledIn": "@cross-deck/web@1.6.3"
+      "bundledIn": "@cross-deck/web@1.6.4"
     },
     {
       "id": "flush-interval-parity",
@@ -210,7 +210,7 @@
       ],
       "registeredAt": "2026-05-26",
       "firstRegisteredIn": "bank-grade reconciliation v1.4.0 — phase 3.3",
-      "bundledIn": "@cross-deck/web@1.6.3"
+      "bundledIn": "@cross-deck/web@1.6.4"
     },
     {
       "id": "idempotency-key-deterministic",
@@ -315,7 +315,7 @@
       ],
       "registeredAt": "2026-05-26",
       "firstRegisteredIn": "bank-grade reconciliation v1.4.0 — phase 2.2.a + 2.2.b + 2.2.c",
-      "bundledIn": "@cross-deck/web@1.6.3"
+      "bundledIn": "@cross-deck/web@1.6.4"
     },
     {
       "id": "init-reentry-drains-prior-queue",
@@ -342,7 +342,7 @@
       ],
       "registeredAt": "2026-05-26",
       "firstRegisteredIn": "bank-grade reconciliation v1.4.0 — phase 5.5",
-      "bundledIn": "@cross-deck/web@1.6.3"
+      "bundledIn": "@cross-deck/web@1.6.4"
     },
     {
       "id": "per-user-cache-isolation",
@@ -421,7 +421,7 @@
       ],
       "registeredAt": "2026-05-26",
       "firstRegisteredIn": "bank-grade reconciliation v1.4.0 — phase 1.3 (web/RN) + dogfood-gap fix (swift + android)",
-      "bundledIn": "@cross-deck/web@1.6.3"
+      "bundledIn": "@cross-deck/web@1.6.4"
     },
     {
       "id": "sdk-error-codes-catalogue",
@@ -466,7 +466,7 @@
       ],
       "registeredAt": "2026-05-26",
       "firstRegisteredIn": "bank-grade reconciliation v1.4.0 — phase 6.2",
-      "bundledIn": "@cross-deck/web@1.6.3"
+      "bundledIn": "@cross-deck/web@1.6.4"
     },
     {
       "id": "super-property-merge-precedence",
@@ -507,7 +507,7 @@
       ],
       "registeredAt": "2026-05-26",
       "firstRegisteredIn": "bank-grade reconciliation v1.4.0 — phase 3.2",
-      "bundledIn": "@cross-deck/web@1.6.3"
+      "bundledIn": "@cross-deck/web@1.6.4"
     },
     {
       "id": "sync-purchases-funnel-parity",
@@ -540,7 +540,7 @@
       ],
       "registeredAt": "2026-05-26",
       "firstRegisteredIn": "bank-grade reconciliation v1.4.0 — phase 3.5",
-      "bundledIn": "@cross-deck/web@1.6.3"
+      "bundledIn": "@cross-deck/web@1.6.4"
     }
   ]
 }