@cross-deck/web - npm Package Compare versions

Comparing version 1.13.3 to 1.13.5

dist/error-codes.json

 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "generatedAt": "2026-07-28T09:57:18.438Z",
+  "generatedAt": "2026-07-28T10:36:58.343Z",
   "sdk": "@cross-deck/web",
@@ -5,0 +5,0 @@ "codes": [

dist/index.d.mts

@@ -252,5 +252,5 @@ import { C as CrossdeckTrustNamespace } from './trust-akYVfmoN.mjs';
     /** Semver of the SDK release these contracts were bundled with. */
-    readonly sdkVersion: "1.13.3";
+    readonly sdkVersion: "1.13.5";
     /** Fully-qualified bundle identifier — e.g. `@cross-deck/web@1.4.2`. */
-    readonly bundledIn: "@cross-deck/web@1.13.3";
+    readonly bundledIn: "@cross-deck/web@1.13.5";
     /**
@@ -870,6 +870,30 @@ * Resolve a failing test back to the contract it exercises.
 }
+
 /**
- * Default singleton — most consumers want one SDK instance per app.
- * Creating extra instances is fine; just `new CrossdeckClient()`.
+ * The ONE Crossdeck singleton — shared across every entry point.
+ *
+ * Why this module exists (the biotree defect, CD-155): `@cross-deck/web` and
+ * `@cross-deck/web/react` build as SEPARATE bundles. Each one inlined
+ * `crossdeck.ts` — including a bare `export const Crossdeck = new
+ * CrossdeckClient()` — so the shipped package contained TWO singletons: one in
+ * `index.mjs`, a different object baked into `react.mjs`. A React app that did
+ * `Crossdeck.init()` / `identify()` / `getEntitlements()` on the core import
+ * warmed instance A, while `useEntitlement()` (react entry) read instance B,
+ * which was never initialised — so a paying customer read `false` forever. No
+ * error, no warning; a silent duplicate-singleton hazard. In source the import
+ * is single; the split is purely a bundling artefact.
+ *
+ * The fix that CANNOT regress: back the instance with the cross-realm global
+ * symbol registry. `Symbol.for(key)` returns the same symbol everywhere, so no
+ * matter how many times a bundler duplicates this module, every copy resolves
+ * to the SAME instance. This is the same guard PostHog, Segment, and
+ * LaunchDarkly use for their React bindings, for this exact reason.
  */
+
+/**
+ * The default singleton — most consumers want one SDK instance per app. Every
+ * entry point (`@cross-deck/web`, `@cross-deck/web/react`, `.../vue`) resolves
+ * to THIS object. Creating extra instances is still fine for advanced use:
+ * just `new CrossdeckClient()`.
+ */
 declare const Crossdeck: CrossdeckClient;
@@ -995,3 +1019,3 @@
  */
-declare const SDK_VERSION = "1.13.3";
+declare const SDK_VERSION = "1.13.5";
 declare const SDK_NAME = "@cross-deck/web";
@@ -998,0 +1022,0 @@

dist/index.d.ts

@@ -252,5 +252,5 @@ import { C as CrossdeckTrustNamespace } from './trust-akYVfmoN.js';
     /** Semver of the SDK release these contracts were bundled with. */
-    readonly sdkVersion: "1.13.3";
+    readonly sdkVersion: "1.13.5";
     /** Fully-qualified bundle identifier — e.g. `@cross-deck/web@1.4.2`. */
-    readonly bundledIn: "@cross-deck/web@1.13.3";
+    readonly bundledIn: "@cross-deck/web@1.13.5";
     /**
@@ -870,6 +870,30 @@ * Resolve a failing test back to the contract it exercises.
 }
+
 /**
- * Default singleton — most consumers want one SDK instance per app.
- * Creating extra instances is fine; just `new CrossdeckClient()`.
+ * The ONE Crossdeck singleton — shared across every entry point.
+ *
+ * Why this module exists (the biotree defect, CD-155): `@cross-deck/web` and
+ * `@cross-deck/web/react` build as SEPARATE bundles. Each one inlined
+ * `crossdeck.ts` — including a bare `export const Crossdeck = new
+ * CrossdeckClient()` — so the shipped package contained TWO singletons: one in
+ * `index.mjs`, a different object baked into `react.mjs`. A React app that did
+ * `Crossdeck.init()` / `identify()` / `getEntitlements()` on the core import
+ * warmed instance A, while `useEntitlement()` (react entry) read instance B,
+ * which was never initialised — so a paying customer read `false` forever. No
+ * error, no warning; a silent duplicate-singleton hazard. In source the import
+ * is single; the split is purely a bundling artefact.
+ *
+ * The fix that CANNOT regress: back the instance with the cross-realm global
+ * symbol registry. `Symbol.for(key)` returns the same symbol everywhere, so no
+ * matter how many times a bundler duplicates this module, every copy resolves
+ * to the SAME instance. This is the same guard PostHog, Segment, and
+ * LaunchDarkly use for their React bindings, for this exact reason.
  */
+
+/**
+ * The default singleton — most consumers want one SDK instance per app. Every
+ * entry point (`@cross-deck/web`, `@cross-deck/web/react`, `.../vue`) resolves
+ * to THIS object. Creating extra instances is still fine for advanced use:
+ * just `new CrossdeckClient()`.
+ */
 declare const Crossdeck: CrossdeckClient;
@@ -995,3 +1019,3 @@
  */
-declare const SDK_VERSION = "1.13.3";
+declare const SDK_VERSION = "1.13.5";
 declare const SDK_NAME = "@cross-deck/web";
@@ -998,0 +1022,0 @@

package.json

 {
   "name": "@cross-deck/web",
-  "version": "1.13.3",
+  "version": "1.13.5",
   "description": "Crossdeck SDK for browsers and Node.js — verified subscriptions, entitlements, and product telemetry in one client.",
@@ -5,0 +5,0 @@ "license": "MIT",

New alerts

AI-detected potential code anomaly

Supply chain risk

AI has identified unusual behaviors that may pose a security risk.

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Fixed alerts

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Improved metrics

Total package byte prevSize

5794465

0.59%

Lines of code

40883

0.2%

Worsened metrics

Number of low supply chain risk alerts

40

25%

No dependency changes