vesant-sdk 1.7.0-dev.b2c9ecf → 1.7.0-dev.b4284ca

package/dist/react.d.mts

@@ -1,9 +1,9 @@
-import { D as DeviceFingerprintRequest, G as GeolocationClient, i as CipherTextOptions, l as CipherTextResult, W as UseGeolocationOptions, X as UseGeolocationResult, Y as UseLocationCaptureOptions, Z as UseLocationCaptureResult, _ as UseLocationRequestsOptions, $ as UseLocationRequestsResult } from './client-BqPVh5jH.mjs';
-import { e as LoginVerificationResponse, L as LoginVerificationRequest, f as RegistrationVerificationResponse, R as RegistrationVerificationRequest, h as TransactionVerificationResponse, g as TransactionVerificationRequest, C as ComplianceClient } from './client-CHPEgasE.mjs';
+import { D as DeviceFingerprintRequest, G as GeolocationClient, i as CipherTextOptions, l as CipherTextResult, W as UseGeolocationOptions, X as UseGeolocationResult, Y as UseLocationCaptureOptions, Z as UseLocationCaptureResult, _ as UseLocationRequestsOptions, $ as UseLocationRequestsResult } from './client-CvWNRwwg.mjs';
+import { e as LoginVerificationResponse, L as LoginVerificationRequest, f as RegistrationVerificationResponse, R as RegistrationVerificationRequest, h as TransactionVerificationResponse, g as TransactionVerificationRequest, C as ComplianceClient } from './client-Dps40EtF.mjs';
 import { RiskProfileClient } from './risk-profile/index.mjs';
 import { C as CustomerProfile } from './types-BOFaMQxI.mjs';
 import { KycClient, CreateEventBasedFaceVerificationSessionRequest, CreateEventBasedFaceVerificationSessionResponse, EventBasedFaceVerificationCallback, UseKycAlertsOptions, UseKycAlertsResult, UseKycOverviewOptions, UseKycOverviewResult, UseKycPreferencesResult, UseKycRequestsOptions, UseKycRequestsResult, UseKycSubmissionOptions, UseKycSubmissionResult } from './kyc/index.mjs';
-import './client-6sSaxufk.mjs';
+import './client-q9fN8Hhf.mjs';
 import './types-CBQRNL-l.mjs';
 
 /**
@@ -21,6 +21,10 @@ declare function getBrowserInfo(): {
  * React Hooks for Vesant Geolocation SDK
  *
  * Provides convenient React hooks for using the geolocation service in Next.js applications.
+ *
+ * Scope: the web SDK collects GPS + IP only (no WiFi/cell positioning — no browser
+ * API exists). The client never asserts its own IP; the server derives it. GPS
+ * fixes are run through advisory in-browser integrity heuristics (see ./integrity).
  */
 
 /**

package/dist/react.d.ts

@@ -1,9 +1,9 @@
-import { D as DeviceFingerprintRequest, G as GeolocationClient, i as CipherTextOptions, l as CipherTextResult, W as UseGeolocationOptions, X as UseGeolocationResult, Y as UseLocationCaptureOptions, Z as UseLocationCaptureResult, _ as UseLocationRequestsOptions, $ as UseLocationRequestsResult } from './client-B32yBt1b.js';
-import { e as LoginVerificationResponse, L as LoginVerificationRequest, f as RegistrationVerificationResponse, R as RegistrationVerificationRequest, h as TransactionVerificationResponse, g as TransactionVerificationRequest, C as ComplianceClient } from './client-pKE_gii_.js';
+import { D as DeviceFingerprintRequest, G as GeolocationClient, i as CipherTextOptions, l as CipherTextResult, W as UseGeolocationOptions, X as UseGeolocationResult, Y as UseLocationCaptureOptions, Z as UseLocationCaptureResult, _ as UseLocationRequestsOptions, $ as UseLocationRequestsResult } from './client-0NOPDnT0.js';
+import { e as LoginVerificationResponse, L as LoginVerificationRequest, f as RegistrationVerificationResponse, R as RegistrationVerificationRequest, h as TransactionVerificationResponse, g as TransactionVerificationRequest, C as ComplianceClient } from './client-SMxqod4j.js';
 import { RiskProfileClient } from './risk-profile/index.js';
 import { C as CustomerProfile } from './types-UGyDl1fd.js';
 import { KycClient, CreateEventBasedFaceVerificationSessionRequest, CreateEventBasedFaceVerificationSessionResponse, EventBasedFaceVerificationCallback, UseKycAlertsOptions, UseKycAlertsResult, UseKycOverviewOptions, UseKycOverviewResult, UseKycPreferencesResult, UseKycRequestsOptions, UseKycRequestsResult, UseKycSubmissionOptions, UseKycSubmissionResult } from './kyc/index.js';
-import './client-6sSaxufk.js';
+import './client-q9fN8Hhf.js';
 import './types-CBQRNL-l.js';
 
 /**
@@ -21,6 +21,10 @@ declare function getBrowserInfo(): {
  * React Hooks for Vesant Geolocation SDK
  *
  * Provides convenient React hooks for using the geolocation service in Next.js applications.
+ *
+ * Scope: the web SDK collects GPS + IP only (no WiFi/cell positioning — no browser
+ * API exists). The client never asserts its own IP; the server derives it. GPS
+ * fixes are run through advisory in-browser integrity heuristics (see ./integrity).
  */
 
 /**

package/dist/react.js

@@ -93,6 +93,61 @@ function getBrowserInfo() {
   return { browser, browser_version: browserVersion, os, os_version: osVersion };
 }
 
+// src/geolocation/integrity.ts
+var isNil = (v) => v === null || v === void 0;
+function assessGpsIntegrity(input, opts = {}) {
+  const flags = [];
+  const now = opts.now ?? (() => Date.now());
+  const maxAgeMs = opts.maxAgeMs ?? 6e4;
+  const minAccuracy = opts.minAccuracyMeters ?? 1;
+  const { accuracy, altitude, altitudeAccuracy, heading, speed, timestamp } = input;
+  if (isNil(accuracy)) {
+    flags.push("accuracy_missing");
+  } else if (accuracy === 0) {
+    flags.push("accuracy_zero");
+  } else if (accuracy < minAccuracy) {
+    flags.push("accuracy_implausibly_small");
+  }
+  const hasMotion = !isNil(heading) || !isNil(speed);
+  if (hasMotion && (isNil(accuracy) || accuracy === 0)) {
+    flags.push("motion_without_accuracy");
+  }
+  if (!isNil(altitude) && isNil(altitudeAccuracy)) {
+    flags.push("altitude_without_accuracy");
+  }
+  if (timestamp !== void 0 && now() - timestamp > maxAgeMs) {
+    flags.push("stale_timestamp");
+  }
+  if (opts.permissionState === "denied" || opts.permissionState === "prompt") {
+    flags.push(`permission_${opts.permissionState}`);
+  }
+  return { suspicious: flags.length > 0, flags };
+}
+function gpsIntegrityInputFromPosition(position) {
+  const c = position.coords;
+  return {
+    latitude: c.latitude,
+    longitude: c.longitude,
+    accuracy: c.accuracy,
+    altitude: c.altitude,
+    altitudeAccuracy: c.altitudeAccuracy,
+    heading: c.heading,
+    speed: c.speed,
+    timestamp: position.timestamp
+  };
+}
+async function probeGeolocationPermission() {
+  try {
+    if (typeof navigator === "undefined" || !navigator.permissions?.query) {
+      return "unavailable";
+    }
+    const status = await navigator.permissions.query({ name: "geolocation" });
+    return status.state;
+  } catch {
+    return "unavailable";
+  }
+}
+
 // src/geolocation/ciphertext.ts
 var CIPHER_TEXT_EXPIRY_MINUTES = 5;
 async function computeHMAC(key, message) {
@@ -145,6 +200,7 @@ async function requestGPSLocation(timeout = 1e4, highAccuracy = true) {
   if (typeof navigator === "undefined" || !navigator.geolocation) {
     return null;
   }
+  const permissionState = await probeGeolocationPermission();
   return new Promise((resolve) => {
     navigator.geolocation.getCurrentPosition(
       (position) => {
@@ -161,6 +217,7 @@ async function requestGPSLocation(timeout = 1e4, highAccuracy = true) {
           resolve(null);
           return;
         }
+        const { flags } = assessGpsIntegrity(gpsIntegrityInputFromPosition(position), { permissionState });
         resolve({
           latitude,
           longitude,
@@ -169,7 +226,8 @@ async function requestGPSLocation(timeout = 1e4, highAccuracy = true) {
           altitude_accuracy: position.coords.altitudeAccuracy ?? void 0,
           heading: position.coords.heading ?? void 0,
           speed: position.coords.speed ?? void 0,
-          timestamp: position.timestamp
+          timestamp: position.timestamp,
+          integrity_flags: flags.length ? flags : void 0
         });
       },
       () => {
@@ -236,6 +294,9 @@ async function generateCipherText(options, config) {
     );
     if (location) {
       locationData = location;
+      if (location.integrity_flags?.length) {
+        warnings.push(`GPS integrity flags (advisory): ${location.integrity_flags.join(", ")}`);
+      }
     } else if (gpsRequiredByConfig) {
       throw new VesantError(
         `GPS location is required for ${options.reason} by tenant configuration, but GPS was not available or permission was denied`,
@@ -338,8 +399,6 @@ function useGeolocation(client, options = {}) {
     if (optionsRef.current.autoVerify) {
       const detectAndVerify = async () => {
         try {
-          const ipResponse = await fetch("https://api.ipify.org?format=json");
-          const { ip } = await ipResponse.json();
           let deviceFingerprint;
           if (optionsRef.current.includeDeviceFingerprint && typeof window !== "undefined") {
             const deviceId = generateDeviceId();
@@ -353,7 +412,6 @@ function useGeolocation(client, options = {}) {
             };
           }
           await verifyIP({
-            ip_address: ip,
             user_id: optionsRef.current.userId || "",
             event_type: optionsRef.current.eventType || "page_view",
             device_fingerprint: deviceFingerprint
@@ -667,6 +725,12 @@ function useLocationCapture(client, options) {
           if (accuracy !== null && accuracy !== void 0 && accuracy > 0) {
             capture.accuracy = accuracy;
           }
+          const { flags } = assessGpsIntegrity(gpsIntegrityInputFromPosition(position), {
+            permissionState: await probeGeolocationPermission()
+          });
+          if (flags.length) {
+            capture.integrity_flags = flags;
+          }
         }
       }
       if (gpsError) {