@sanvika/geolocation 0.3.1 → 0.5.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sanvika/geolocation",
-  "version": "0.3.1",
+  "version": "0.5.0",
   "description": "Sanvika ecosystem geolocation SDK — fully centralized via geolocation.sanvikaproduction.com. IP lookup, reverse/forward geocoding, Places autocomplete + details, Maps JS loader. Zero Google API keys in consumer projects.",
   "type": "module",
   "main": "./src/index.js",
@@ -17,7 +17,13 @@
   "dependencies": {
     "@sanvika/logger": ">=0.2"
   },
-  "keywords": ["sanvika", "geolocation", "ip", "location", "india"],
+  "keywords": [
+    "sanvika",
+    "geolocation",
+    "ip",
+    "location",
+    "india"
+  ],
   "author": "Sanvika Production",
   "license": "UNLICENSED",
   "repository": {
@@ -27,4 +33,4 @@
   "publishConfig": {
     "access": "public"
   }
-}
+}

package/src/client/index.js

@@ -4,11 +4,11 @@
 //
 // Env vars (read from process.env in Next.js / similar):
 //   NEXT_PUBLIC_GEOLOCATION_URL=https://geolocation.sanvikaproduction.com
-//   NEXT_PUBLIC_GEOLOCATION_CLIENT_ID=fapk
+//   NEXT_PUBLIC_PROJECT_NAME=<slug>     (universal, Phase 2 — ecosystem rule §21)
+//   (fallback) NEXT_PUBLIC_GEOLOCATION_CLIENT_ID
 //
 // Consumer projects NO LONGER need proxy routes for geolocation.
 // All calls go directly to geolocation.sanvikaproduction.com via public clientId auth.
-// Only getUserLocation / updateUserLocation still need FAPK routes (they use SA SSO auth).
 
 import { createLogger } from "@sanvika/logger";
 import { setWithTTL, getWithTTL, TTL } from "./localStorageTTL.js";
@@ -21,7 +21,11 @@ function _geoUrl() {
 }
 
 function _clientId() {
-  return (typeof process !== "undefined" && process.env?.NEXT_PUBLIC_GEOLOCATION_CLIENT_ID) || "";
+  // Phase 2 universal first, then legacy fallback (Next.js requires static access)
+  if (typeof process === "undefined" || !process.env) return "";
+  return process.env.NEXT_PUBLIC_PROJECT_NAME
+      || process.env.NEXT_PUBLIC_GEOLOCATION_CLIENT_ID
+      || "";
 }
 
 async function _servicePost(path, body) {

package/src/server/serviceClient.js

@@ -1,6 +1,10 @@
 // packages/sanvika-geolocation-sdk/src/server/serviceClient.js
 // HTTP client for geolocation.sanvikaproduction.com — used by all server-side helpers.
-// Env vars: GEOLOCATION_URL, GEOLOCATION_CLIENT_SECRET (or pass to constructor).
+// Universal S2S Auth Pattern (ecosystem rule §21):
+//   PROJECT_NAME                  — clientId
+//   SANVIKA_SERVICE_KEY           — Tier 1 trust
+//   GEOLOCATION_URL (or GEO_URL)  — service endpoint
+//   GEOLOCATION_CLIENT_SECRET     — (optional, Tier 2 fallback for 3rd-party)
 
 const DEFAULT_TIMEOUT_MS = 6000;
 
@@ -14,15 +18,21 @@ function readEnv(key) {
 
 export class GeolocationServiceClient {
   #url;
+  #clientId;
+  #serviceKey;
   #secret;
 
-  constructor({ url, secret } = {}) {
-    const finalUrl = url || readEnv("GEOLOCATION_URL");
-    const finalSecret = secret || readEnv("GEOLOCATION_CLIENT_SECRET");
-    if (!finalUrl || !finalSecret) {
-      throw new Error("@sanvika/geolocation/server: GEOLOCATION_URL and GEOLOCATION_CLIENT_SECRET are required");
+  constructor({ url, clientId, serviceKey, secret } = {}) {
+    const finalUrl = url || readEnv("GEOLOCATION_URL") || readEnv("GEO_URL");
+    const finalClientId = clientId || readEnv("PROJECT_NAME") || readEnv("GEOLOCATION_CLIENT_ID");
+    const finalServiceKey = serviceKey || readEnv("SANVIKA_SERVICE_KEY") || "";
+    const finalSecret = secret || readEnv("GEOLOCATION_CLIENT_SECRET") || "";  // Tier 2 fallback (optional)
+    if (!finalUrl || !finalClientId) {
+      throw new Error("@sanvika/geolocation/server: GEOLOCATION_URL and PROJECT_NAME are required");
     }
     this.#url = finalUrl.replace(/\/$/, "");
+    this.#clientId = finalClientId;
+    this.#serviceKey = finalServiceKey;
     this.#secret = finalSecret;
   }
 
@@ -35,7 +45,11 @@ export class GeolocationServiceClient {
     const qs = query ? "?" + new URLSearchParams(query).toString() : "";
     const init = {
       method,
-      headers: { "x-client-secret": this.#secret },
+      headers: {
+        "x-client-id": this.#clientId,
+        "x-service-key": this.#serviceKey,
+        "x-client-secret": this.#secret,
+      },
       signal: controller.signal,
     };
     if (body !== undefined) {