vesant-sdk 1.7.0 → 1.7.1-dev.027ea84

package/dist/react.d.mts

@@ -1,9 +1,9 @@
-import { D as DeviceFingerprintRequest, G as GeolocationClient, i as CipherTextOptions, l as CipherTextResult, W as UseGeolocationOptions, X as UseGeolocationResult, Y as UseLocationCaptureOptions, Z as UseLocationCaptureResult, _ as UseLocationRequestsOptions, $ as UseLocationRequestsResult } from './client-DrjgZoH_.mjs';
-import { e as LoginVerificationResponse, L as LoginVerificationRequest, f as RegistrationVerificationResponse, R as RegistrationVerificationRequest, h as TransactionVerificationResponse, g as TransactionVerificationRequest, C as ComplianceClient } from './client-B0qhE2kr.mjs';
+import { D as DeviceFingerprintRequest, G as GeolocationClient, i as CipherTextOptions, l as CipherTextResult, Y as UseGeolocationOptions, Z as UseGeolocationResult, _ as UseLocationCaptureOptions, $ as UseLocationCaptureResult, a0 as UseLocationRequestsOptions, a1 as UseLocationRequestsResult } from './client-BwXMQA2a.mjs';
+import { e as LoginVerificationResponse, L as LoginVerificationRequest, f as RegistrationVerificationResponse, R as RegistrationVerificationRequest, h as TransactionVerificationResponse, g as TransactionVerificationRequest, C as ComplianceClient } from './client-D23KhWeh.mjs';
 import { RiskProfileClient } from './risk-profile/index.mjs';
 import { C as CustomerProfile } from './types-BOFaMQxI.mjs';
 import { KycClient, CreateEventBasedFaceVerificationSessionRequest, CreateEventBasedFaceVerificationSessionResponse, EventBasedFaceVerificationCallback, UseKycAlertsOptions, UseKycAlertsResult, UseKycOverviewOptions, UseKycOverviewResult, UseKycPreferencesResult, UseKycRequestsOptions, UseKycRequestsResult, UseKycSubmissionOptions, UseKycSubmissionResult } from './kyc/index.mjs';
-import './client-BolQlL5e.mjs';
+import './client-q9fN8Hhf.mjs';
 import './types-CBQRNL-l.mjs';
 
 /**
@@ -21,6 +21,10 @@ declare function getBrowserInfo(): {
  * React Hooks for Vesant Geolocation SDK
  *
  * Provides convenient React hooks for using the geolocation service in Next.js applications.
+ *
+ * Scope: the web SDK collects GPS + IP only (no WiFi/cell positioning — no browser
+ * API exists). The client never asserts its own IP; the server derives it. GPS
+ * fixes are run through advisory in-browser integrity heuristics (see ./integrity).
  */
 
 /**

package/dist/react.d.ts

@@ -1,9 +1,9 @@
-import { D as DeviceFingerprintRequest, G as GeolocationClient, i as CipherTextOptions, l as CipherTextResult, W as UseGeolocationOptions, X as UseGeolocationResult, Y as UseLocationCaptureOptions, Z as UseLocationCaptureResult, _ as UseLocationRequestsOptions, $ as UseLocationRequestsResult } from './client-DF7hlMEz.js';
-import { e as LoginVerificationResponse, L as LoginVerificationRequest, f as RegistrationVerificationResponse, R as RegistrationVerificationRequest, h as TransactionVerificationResponse, g as TransactionVerificationRequest, C as ComplianceClient } from './client-DtH2RLuy.js';
+import { D as DeviceFingerprintRequest, G as GeolocationClient, i as CipherTextOptions, l as CipherTextResult, Y as UseGeolocationOptions, Z as UseGeolocationResult, _ as UseLocationCaptureOptions, $ as UseLocationCaptureResult, a0 as UseLocationRequestsOptions, a1 as UseLocationRequestsResult } from './client-fy3trF2K.js';
+import { e as LoginVerificationResponse, L as LoginVerificationRequest, f as RegistrationVerificationResponse, R as RegistrationVerificationRequest, h as TransactionVerificationResponse, g as TransactionVerificationRequest, C as ComplianceClient } from './client-B3DCAHlg.js';
 import { RiskProfileClient } from './risk-profile/index.js';
 import { C as CustomerProfile } from './types-UGyDl1fd.js';
 import { KycClient, CreateEventBasedFaceVerificationSessionRequest, CreateEventBasedFaceVerificationSessionResponse, EventBasedFaceVerificationCallback, UseKycAlertsOptions, UseKycAlertsResult, UseKycOverviewOptions, UseKycOverviewResult, UseKycPreferencesResult, UseKycRequestsOptions, UseKycRequestsResult, UseKycSubmissionOptions, UseKycSubmissionResult } from './kyc/index.js';
-import './client-BolQlL5e.js';
+import './client-q9fN8Hhf.js';
 import './types-CBQRNL-l.js';
 
 /**
@@ -21,6 +21,10 @@ declare function getBrowserInfo(): {
  * React Hooks for Vesant Geolocation SDK
  *
  * Provides convenient React hooks for using the geolocation service in Next.js applications.
+ *
+ * Scope: the web SDK collects GPS + IP only (no WiFi/cell positioning — no browser
+ * API exists). The client never asserts its own IP; the server derives it. GPS
+ * fixes are run through advisory in-browser integrity heuristics (see ./integrity).
  */
 
 /**

package/dist/react.js

@@ -10,7 +10,7 @@ var React__default = /*#__PURE__*/_interopDefault(React);
 // src/geolocation/hooks.ts
 
 // src/core/version.ts
-var SDK_VERSION = "1.7.0";
+var SDK_VERSION = "1.7.1";
 
 // src/core/errors.ts
 var VesantError = class _VesantError extends Error {
@@ -93,27 +93,63 @@ function getBrowserInfo() {
   return { browser, browser_version: browserVersion, os, os_version: osVersion };
 }
 
-// src/geolocation/ciphertext.ts
-var CIPHER_TEXT_EXPIRY_MINUTES = 5;
-async function computeHMAC(key, message) {
-  if (typeof globalThis.crypto !== "undefined" && globalThis.crypto.subtle) {
-    const encoder = new TextEncoder();
-    const keyData = encoder.encode(key);
-    const msgData = encoder.encode(message);
-    const cryptoKey = await globalThis.crypto.subtle.importKey(
-      "raw",
-      keyData,
-      { name: "HMAC", hash: "SHA-256" },
-      false,
-      ["sign"]
-    );
-    const signature = await globalThis.crypto.subtle.sign("HMAC", cryptoKey, msgData);
-    const bytes = new Uint8Array(signature);
-    return Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
+// src/geolocation/integrity.ts
+var isNil = (v) => v === null || v === void 0;
+function assessGpsIntegrity(input, opts = {}) {
+  const flags = [];
+  const now = opts.now ?? (() => Date.now());
+  const maxAgeMs = opts.maxAgeMs ?? 6e4;
+  const minAccuracy = opts.minAccuracyMeters ?? 1;
+  const { accuracy, altitude, altitudeAccuracy, heading, speed, timestamp } = input;
+  if (isNil(accuracy)) {
+    flags.push("accuracy_missing");
+  } else if (accuracy === 0) {
+    flags.push("accuracy_zero");
+  } else if (accuracy < minAccuracy) {
+    flags.push("accuracy_implausibly_small");
+  }
+  const hasMotion = !isNil(heading) || !isNil(speed);
+  if (hasMotion && (isNil(accuracy) || accuracy === 0)) {
+    flags.push("motion_without_accuracy");
+  }
+  if (!isNil(altitude) && isNil(altitudeAccuracy)) {
+    flags.push("altitude_without_accuracy");
+  }
+  if (timestamp !== void 0 && now() - timestamp > maxAgeMs) {
+    flags.push("stale_timestamp");
+  }
+  if (opts.permissionState === "denied" || opts.permissionState === "prompt") {
+    flags.push(`permission_${opts.permissionState}`);
+  }
+  return { suspicious: flags.length > 0, flags };
+}
+function gpsIntegrityInputFromPosition(position) {
+  const c = position.coords;
+  return {
+    latitude: c.latitude,
+    longitude: c.longitude,
+    accuracy: c.accuracy,
+    altitude: c.altitude,
+    altitudeAccuracy: c.altitudeAccuracy,
+    heading: c.heading,
+    speed: c.speed,
+    timestamp: position.timestamp
+  };
+}
+async function probeGeolocationPermission() {
+  try {
+    if (typeof navigator === "undefined" || !navigator.permissions?.query) {
+      return "unavailable";
+    }
+    const status = await navigator.permissions.query({ name: "geolocation" });
+    return status.state;
+  } catch {
+    return "unavailable";
   }
-  const { createHmac } = await import('crypto');
-  return createHmac("sha256", key).update(message).digest("hex");
 }
+
+// src/geolocation/ciphertext.ts
+var CIPHER_TEXT_EXPIRY_MINUTES = 5;
 function getWebGLInfo() {
   if (typeof document === "undefined") return null;
   try {
@@ -145,6 +181,7 @@ async function requestGPSLocation(timeout = 1e4, highAccuracy = true) {
   if (typeof navigator === "undefined" || !navigator.geolocation) {
     return null;
   }
+  const permissionState = await probeGeolocationPermission();
   return new Promise((resolve) => {
     navigator.geolocation.getCurrentPosition(
       (position) => {
@@ -161,6 +198,7 @@ async function requestGPSLocation(timeout = 1e4, highAccuracy = true) {
           resolve(null);
           return;
         }
+        const { flags } = assessGpsIntegrity(gpsIntegrityInputFromPosition(position), { permissionState });
         resolve({
           latitude,
           longitude,
@@ -169,7 +207,8 @@ async function requestGPSLocation(timeout = 1e4, highAccuracy = true) {
           altitude_accuracy: position.coords.altitudeAccuracy ?? void 0,
           heading: position.coords.heading ?? void 0,
           speed: position.coords.speed ?? void 0,
-          timestamp: position.timestamp
+          timestamp: position.timestamp,
+          integrity_flags: flags.length ? flags : void 0
         });
       },
       () => {
@@ -236,6 +275,9 @@ async function generateCipherText(options, config) {
     );
     if (location) {
       locationData = location;
+      if (location.integrity_flags?.length) {
+        warnings.push(`GPS integrity flags (advisory): ${location.integrity_flags.join(", ")}`);
+      }
     } else if (gpsRequiredByConfig) {
       throw new VesantError(
         `GPS location is required for ${options.reason} by tenant configuration, but GPS was not available or permission was denied`,
@@ -265,15 +307,7 @@ async function generateCipherText(options, config) {
   };
   const encoded = encodePayload(payload);
   const timestamp = now.getTime().toString(36);
-  let cipherText;
-  const hmacKey = options.signingKey || options.apiKey;
-  if (hmacKey) {
-    const message = `02.${timestamp}.${encoded}`;
-    const hmac = await computeHMAC(hmacKey, message);
-    cipherText = `${message}.${hmac}`;
-  } else {
-    cipherText = `01.${timestamp}.${encoded}`;
-  }
+  const cipherText = `01.${timestamp}.${encoded}`;
   return {
     cipherText,
     locationCaptured: !!locationData,
@@ -338,8 +372,6 @@ function useGeolocation(client, options = {}) {
     if (optionsRef.current.autoVerify) {
       const detectAndVerify = async () => {
         try {
-          const ipResponse = await fetch("https://api.ipify.org?format=json");
-          const { ip } = await ipResponse.json();
           let deviceFingerprint;
           if (optionsRef.current.includeDeviceFingerprint && typeof window !== "undefined") {
             const deviceId = generateDeviceId();
@@ -353,7 +385,6 @@ function useGeolocation(client, options = {}) {
             };
           }
           await verifyIP({
-            ip_address: ip,
             user_id: optionsRef.current.userId || "",
             event_type: optionsRef.current.eventType || "page_view",
             device_fingerprint: deviceFingerprint
@@ -667,6 +698,12 @@ function useLocationCapture(client, options) {
           if (accuracy !== null && accuracy !== void 0 && accuracy > 0) {
             capture.accuracy = accuracy;
           }
+          const { flags } = assessGpsIntegrity(gpsIntegrityInputFromPosition(position), {
+            permissionState: await probeGeolocationPermission()
+          });
+          if (flags.length) {
+            capture.integrity_flags = flags;
+          }
         }
       }
       if (gpsError) {
@@ -2095,6 +2132,7 @@ function isValidFileSize(file, maxSizeBytes = 10 * 1024 * 1024) {
 }
 function formatKycStatus(status) {
   const statusMap = {
+    awaiting_kyc: "Awaiting KYC",
     pending: "Pending Review",
     accepted: "Approved",
     declined: "Rejected",
@@ -2105,6 +2143,8 @@ function formatKycStatus(status) {
 }
 function getStatusColor(status) {
   const colorMap = {
+    awaiting_kyc: "#94a3b8",
+    // slate — not started
     pending: "#f59e0b",
     // amber
     accepted: "#10b981",