vesant-sdk 1.7.0 → 1.7.1-dev.0520b46

package/dist/{client-B0qhE2kr.d.mts → client-5q4whhGu.d.mts}

@@ -1,6 +1,6 @@
-import { D as DeviceFingerprintRequest, L as LocationVerification, V as ValidateCipherTextResponse, a as LocationRequest, G as GeolocationClient, b as LocationRequestFilters, c as LocationRequestListResponse } from './client-DrjgZoH_.mjs';
+import { D as DeviceFingerprintRequest, L as LocationVerification, V as ValidateCipherTextResponse, a as LocationRequest, G as GeolocationClient, b as LocationRequestFilters, c as LocationRequestListResponse } from './client-XDEhh9VN.mjs';
 import { RiskProfileClient } from './risk-profile/index.mjs';
-import { V as VesantConfig, R as RequestOptions } from './client-BolQlL5e.mjs';
+import { V as VesantConfig, R as RequestOptions } from './client-q9fN8Hhf.mjs';
 import { C as CustomerProfile } from './types-BOFaMQxI.mjs';
 import { E as EntityType, B as BlockReason, P as PaginationParams } from './types-CBQRNL-l.mjs';
 

package/dist/{client-DF7hlMEz.d.ts → client-BaUekQT8.d.ts}

@@ -1,4 +1,4 @@
-import { L as Logger, B as BaseClient, R as RequestOptions } from './client-BolQlL5e.js';
+import { L as Logger, B as BaseClient, R as RequestOptions } from './client-q9fN8Hhf.js';
 import { B as BlockReason, P as PaginationParams } from './types-CBQRNL-l.js';
 
 interface DeviceFingerprintRequest {
@@ -47,6 +47,8 @@ interface CipherTextPayload {
         heading?: number;
         speed?: number;
         timestamp: number;
+        /** Advisory client-side GPS integrity flags; the server weighs these as risk factors. */
+        integrity_flags?: string[];
     };
     /** Network information */
     network?: {
@@ -74,9 +76,12 @@ type CipherTextReason = 'registration' | 'login' | 'transaction' | 'interval_che
 interface CipherTextOptions {
     /** Reason for collection (required) */
     reason: CipherTextReason;
-    /** Public signing key (pk_) for HMAC signing (produces v02 signed cipherText) */
+    /**
+     * @deprecated No longer used and ignored; envelope validation is handled by the
+     * server. This field will be removed in a future release.
+     */
     signingKey?: string;
-    /** @deprecated Use signingKey instead. API key for HMAC signing (backward compat) */
+    /** @deprecated No longer used and ignored; see signingKey. */
     apiKey?: string;
     /** Request GPS location (default: false) */
     requestLocation?: boolean;
@@ -106,6 +111,11 @@ interface CipherTextResult {
     /** Expiry time for the cipherText */
     expiresAt: string;
 }
+/**
+ * Honest name for CipherTextResult: a base64 JSON device-signals envelope
+ * (not encryption). Prefer this name; `CipherTextResult` remains as an alias.
+ */
+type DeviceSignalsEnvelope = CipherTextResult;
 /**
  * Decrypted cipherText data (returned by server after validation)
  */
@@ -164,6 +174,21 @@ interface ValidateCipherTextRequest {
      * has complete customer information (name, email, etc.)
      */
     customer_data?: CipherTextCustomerData;
+    /**
+     * Single-use device-signals nonce from {@link SignalsNonce}. Bound to the
+     * tenant, user, and event; consumed server-side so the submission can't be
+     * replayed. Attached automatically by the client.
+     */
+    nonce?: string;
+}
+/**
+ * A short-lived, single-use device-signals nonce minted by the server. Bind a
+ * device-signals submission to a specific tenant, user, and event type so a
+ * captured envelope can't be replayed. Integrity is enforced server-side.
+ */
+interface SignalsNonce {
+    nonce: string;
+    expires_at: string;
 }
 /**
  * Response from cipherText validation
@@ -227,7 +252,11 @@ interface ValidateCipherTextResponse {
     };
 }
 interface VerifyIPRequest {
-    ip_address: string;
+    /**
+     * Optional. Omit to let the server derive the connecting IP — the SDK never
+     * asserts the client IP (spoofable, and the server extracts it authoritatively).
+     */
+    ip_address?: string;
     user_id: string;
     event_type: string;
     device_fingerprint?: DeviceFingerprintRequest;
@@ -483,7 +512,9 @@ interface GeolocationConfigResponse {
     };
     /** When true, GPS-verified location overrides anonymizer-based blocking */
     trust_gps_over_anonymizer: boolean;
-    /** Public signing key (pk_) for client-side HMAC signing */
+    /**
+     * @deprecated No longer used by the SDK and ignored if present.
+     */
     signing_key?: string;
 }
 interface GeolocationClientConfig {
@@ -503,6 +534,15 @@ interface GeolocationClientConfig {
     logger?: Logger;
     /** Environment mode - 'sandbox' uses isolated sandbox data */
     environment?: 'production' | 'sandbox';
+    /**
+     * How long a fetched GPS requirement config is reused before it is read again,
+     * in milliseconds (default: 300000, i.e. 5 minutes).
+     *
+     * These requirements are edited in the compliance console while your
+     * application is running, so a lower value makes changes take effect sooner at
+     * the cost of more requests. Use `refreshGPSConfig()` to re-read immediately.
+     */
+    gpsConfigTtlMs?: number;
 }
 interface UseGeolocationOptions {
     /** Auto-detect and verify user's IP on mount */
@@ -624,16 +664,6 @@ interface ResendLocationRequestRequest {
     email?: string;
     phone?: string;
 }
-interface WiFiNetwork {
-    /** MAC address (BSSID) */
-    macAddress: string;
-    /** Signal strength in dBm (negative number) */
-    signalStrength?: number;
-    /** WiFi channel */
-    channel?: number;
-    /** Network name (optional) */
-    ssid?: string;
-}
 interface LocationCaptureRequest {
     /** GPS latitude (if available) */
     latitude?: number;
@@ -641,8 +671,8 @@ interface LocationCaptureRequest {
     longitude?: number;
     /** GPS accuracy in meters */
     accuracy?: number;
-    /** WiFi networks for positioning (if GPS not available) */
-    wifi_networks?: WiFiNetwork[];
+    /** Advisory client-side GPS integrity flags; the server weighs these as risk factors. */
+    integrity_flags?: string[];
     /** User agent string */
     user_agent?: string;
     /** Device metadata */
@@ -662,6 +692,10 @@ interface LocationShareInfo {
     status: string;
     is_expired: boolean;
     is_completed: boolean;
+    /**
+     * Server-only hint. The web SDK cannot enumerate WiFi networks (no browser API
+     * for BSSIDs); this flag is informational and never satisfied client-side.
+     */
     requires_wifi: boolean;
 }
 interface LocationCaptureResponse {
@@ -730,8 +764,6 @@ interface UseLocationCaptureOptions {
     autoFetch?: boolean;
     /** Auto-request GPS permission on mount */
     autoRequestGPS?: boolean;
-    /** Collect WiFi data as fallback (requires explicit permission) */
-    collectWiFi?: boolean;
 }
 interface UseLocationCaptureResult {
     /** Location share info */
@@ -763,18 +795,9 @@ interface UseLocationCaptureResult {
  * Extends BaseClient for consistent retry logic, timeout handling, and error management.
  */
 
-/**
- * GeolocationClient extends BaseClient for:
- * - Consistent retry logic with exponential backoff
- * - Unified error handling (VesantError, NetworkError, TimeoutError, etc.)
- * - Automatic timeout management
- * - Debug logging
- *
- * All geolocation verification calls use requestWithRetry() to handle
- * transient failures gracefully.
- */
 declare class GeolocationClient extends BaseClient {
-    private cachedSigningKey?;
+    private readonly gpsConfigTtlMs;
+    private gpsConfigCache;
     constructor(config: GeolocationClientConfig);
     /**
      * Verify an IP address and check compliance
@@ -836,14 +859,45 @@ declare class GeolocationClient extends BaseClient {
      */
     getGPSConfig(requestOptions?: RequestOptions): Promise<GeolocationConfigResponse>;
     /**
-     * Fetch the signing key from the dedicated authenticated endpoint.
+     * Re-read the tenant's GPS requirement configuration, ignoring any copy held
+     * from an earlier read.
+     *
+     * These requirements are edited in the compliance console while your
+     * application is running. `getGPSConfig` reuses a fetched copy for a short
+     * period so a long-lived session does not call the API on every event; call
+     * this when you need a change to take effect immediately — for example right
+     * after an administrator saves new settings.
+     *
+     * @returns The current GPS requirement config per event type
+     *
+     * @example
+     * ```typescript
+     * const config = await client.refreshGPSConfig();
+     * if (config.require_gps.login) {
+     *   // GPS is now required for login
+     * }
+     * ```
+     */
+    refreshGPSConfig(requestOptions?: RequestOptions): Promise<GeolocationConfigResponse>;
+    /**
+     * Mint a short-lived, single-use device-signals nonce.
      *
-     * Falls back to getGPSConfig() for backward compatibility with older servers
-     * that don't expose `/api/v1/geo/signing-key`.
+     * The nonce is bound to the tenant, user, and event type and is consumed
+     * server-side during validation, so a captured device-signals envelope cannot
+     * be replayed. `validateCipherText` mints and attaches one automatically; call
+     * this directly only if you manage the nonce yourself.
      *
-     * @returns The signing key string, or undefined if unavailable
+     * @param userId - User ID the nonce is bound to
+     * @param eventType - Event type the nonce is bound to (login, registration, ...)
+     * @returns The nonce and its expiry
+     */
+    fetchSignalsNonce(userId: string, eventType: CipherTextReason, requestOptions?: RequestOptions): Promise<SignalsNonce>;
+    /**
+     * Best-effort nonce mint for validation. Returns undefined if minting fails —
+     * the server is the sole authority and blocks when a nonce is required, so this
+     * never downgrades security on the client's say-so.
      */
-    fetchSigningKey(requestOptions?: RequestOptions): Promise<string | undefined>;
+    private resolveSignalsNonce;
     /**
      * Validate a cipherText generated by the frontend SDK
      *
@@ -995,40 +1049,30 @@ declare class GeolocationClient extends BaseClient {
      *
      * @example
      * ```typescript
-     * // Using GPS (preferred)
+     * // GPS (the web SDK is GPS + IP only; the server handles the IP fallback)
      * const result = await client.captureLocation(token, {
      *   latitude: 37.7749,
      *   longitude: -122.4194,
      *   accuracy: 10
      * });
-     *
-     * // Using WiFi positioning (fallback)
-     * const result = await client.captureLocation(token, {
-     *   wifi_networks: [
-     *     { macAddress: "00:11:22:33:44:55", signalStrength: -50 },
-     *     { macAddress: "AA:BB:CC:DD:EE:FF", signalStrength: -70 }
-     *   ]
-     * });
      * ```
      */
     captureLocation(token: string, capture: LocationCaptureRequest, requestOptions?: RequestOptions): Promise<LocationCaptureResponse>;
     /**
-     * Generate a signed cipherText containing device and location data.
-     *
-     * Automatically passes the client's API key for HMAC signing (v02 format).
-     * If no API key is configured, falls back to unsigned v01 format.
+     * Generate a device-signals envelope containing device and location data,
+     * validated by the server.
      *
-     * @param options - Options for cipherText generation
+     * @param options - Options for envelope generation
      * @param gpsConfig - Optional GPS config (from getGPSConfig)
-     * @returns CipherText result with the signed string
+     * @returns The device-signals envelope result
      *
      * @example
      * ```typescript
      * const result = await client.generateCipherText({ reason: 'login' });
-     * console.log(result.cipherText); // v02 signed cipherText
+     * console.log(result.cipherText); // device-signals envelope
      * ```
      */
     generateCipherText(options: Omit<CipherTextOptions, 'apiKey' | 'signingKey'>, gpsConfig?: GeolocationConfigResponse): Promise<CipherTextResult>;
 }
 
-export { type UseLocationRequestsResult as $, type APIError as A, type GeolocationClientConfig as B, type CipherTextCustomerData as C, type DeviceFingerprintRequest as D, type GeolocationConfigResponse as E, type GeolocationRecord as F, GeolocationClient as G, type LocationCaptureRequest as H, type LocationCaptureResponse as I, type JurisdictionConfig as J, type LocationRequestChannel as K, type LocationVerification as L, type LocationRequestResult as M, type LocationRequestStatus as N, type LocationShareInfo as O, type UpdateGeofenceRuleRequest as P, type UpdateJurisdictionRequest as Q, type ResendLocationRequestRequest as R, type UseAlertsOptions as S, type UseAlertsResult as T, type UpdateDeviceTrustRequest as U, type ValidateCipherTextResponse as V, type UseGeolocationOptions as W, type UseGeolocationResult as X, type UseLocationCaptureOptions as Y, type UseLocationCaptureResult as Z, type UseLocationRequestsOptions as _, type LocationRequest as a, type ValidateCipherTextRequest as a0, type VerifyIPRequest as a1, type WiFiNetwork as a2, type LocationRequestFilters as b, type LocationRequestListResponse as c, type AlertFilters as d, type AlertListResponse as e, type AlertSeverity as f, type AlertStatus as g, type AlertType as h, type CipherTextOptions as i, type CipherTextPayload as j, type CipherTextReason as k, type CipherTextResult as l, type ComplianceCheckResponse as m, type CreateGeofenceRuleRequest as n, type CreateJurisdictionRequest as o, type CreateLocationRequestRequest as p, type DashboardMetrics as q, type DecryptedCipherText as r, type DeviceFingerprint as s, type DeviceTrustResult as t, type GeoIPResult as u, type GeofenceAction as v, type GeofenceEvaluation as w, type GeofenceRule as x, type GeofenceRuleType as y, type GeolocationAlert as z };
+export { type UseLocationCaptureResult as $, type APIError as A, type GeolocationAlert as B, type CipherTextCustomerData as C, type DeviceFingerprintRequest as D, type GeolocationClientConfig as E, type GeolocationConfigResponse as F, GeolocationClient as G, type GeolocationRecord as H, type LocationCaptureRequest as I, type JurisdictionConfig as J, type LocationCaptureResponse as K, type LocationVerification as L, type LocationRequestChannel as M, type LocationRequestResult as N, type LocationRequestStatus as O, type LocationShareInfo as P, type UpdateGeofenceRuleRequest as Q, type ResendLocationRequestRequest as R, type SignalsNonce as S, type UpdateJurisdictionRequest as T, type UpdateDeviceTrustRequest as U, type ValidateCipherTextResponse as V, type UseAlertsOptions as W, type UseAlertsResult as X, type UseGeolocationOptions as Y, type UseGeolocationResult as Z, type UseLocationCaptureOptions as _, type LocationRequest as a, type UseLocationRequestsOptions as a0, type UseLocationRequestsResult as a1, type ValidateCipherTextRequest as a2, type VerifyIPRequest as a3, type LocationRequestFilters as b, type LocationRequestListResponse as c, type AlertFilters as d, type AlertListResponse as e, type AlertSeverity as f, type AlertStatus as g, type AlertType as h, type CipherTextOptions as i, type CipherTextPayload as j, type CipherTextReason as k, type CipherTextResult as l, type ComplianceCheckResponse as m, type CreateGeofenceRuleRequest as n, type CreateJurisdictionRequest as o, type CreateLocationRequestRequest as p, type DashboardMetrics as q, type DecryptedCipherText as r, type DeviceFingerprint as s, type DeviceSignalsEnvelope as t, type DeviceTrustResult as u, type GeoIPResult as v, type GeofenceAction as w, type GeofenceEvaluation as x, type GeofenceRule as y, type GeofenceRuleType as z };

package/dist/{client-DtH2RLuy.d.ts → client-DUHC-68_.d.ts}

@@ -1,6 +1,6 @@
-import { D as DeviceFingerprintRequest, L as LocationVerification, V as ValidateCipherTextResponse, a as LocationRequest, G as GeolocationClient, b as LocationRequestFilters, c as LocationRequestListResponse } from './client-DF7hlMEz.js';
+import { D as DeviceFingerprintRequest, L as LocationVerification, V as ValidateCipherTextResponse, a as LocationRequest, G as GeolocationClient, b as LocationRequestFilters, c as LocationRequestListResponse } from './client-BaUekQT8.js';
 import { RiskProfileClient } from './risk-profile/index.js';
-import { V as VesantConfig, R as RequestOptions } from './client-BolQlL5e.js';
+import { V as VesantConfig, R as RequestOptions } from './client-q9fN8Hhf.js';
 import { C as CustomerProfile } from './types-UGyDl1fd.js';
 import { E as EntityType, B as BlockReason, P as PaginationParams } from './types-CBQRNL-l.js';
 

package/dist/{client-DrjgZoH_.d.mts → client-XDEhh9VN.d.mts}

@@ -1,4 +1,4 @@
-import { L as Logger, B as BaseClient, R as RequestOptions } from './client-BolQlL5e.mjs';
+import { L as Logger, B as BaseClient, R as RequestOptions } from './client-q9fN8Hhf.mjs';
 import { B as BlockReason, P as PaginationParams } from './types-CBQRNL-l.mjs';
 
 interface DeviceFingerprintRequest {
@@ -47,6 +47,8 @@ interface CipherTextPayload {
         heading?: number;
         speed?: number;
         timestamp: number;
+        /** Advisory client-side GPS integrity flags; the server weighs these as risk factors. */
+        integrity_flags?: string[];
     };
     /** Network information */
     network?: {
@@ -74,9 +76,12 @@ type CipherTextReason = 'registration' | 'login' | 'transaction' | 'interval_che
 interface CipherTextOptions {
     /** Reason for collection (required) */
     reason: CipherTextReason;
-    /** Public signing key (pk_) for HMAC signing (produces v02 signed cipherText) */
+    /**
+     * @deprecated No longer used and ignored; envelope validation is handled by the
+     * server. This field will be removed in a future release.
+     */
     signingKey?: string;
-    /** @deprecated Use signingKey instead. API key for HMAC signing (backward compat) */
+    /** @deprecated No longer used and ignored; see signingKey. */
     apiKey?: string;
     /** Request GPS location (default: false) */
     requestLocation?: boolean;
@@ -106,6 +111,11 @@ interface CipherTextResult {
     /** Expiry time for the cipherText */
     expiresAt: string;
 }
+/**
+ * Honest name for CipherTextResult: a base64 JSON device-signals envelope
+ * (not encryption). Prefer this name; `CipherTextResult` remains as an alias.
+ */
+type DeviceSignalsEnvelope = CipherTextResult;
 /**
  * Decrypted cipherText data (returned by server after validation)
  */
@@ -164,6 +174,21 @@ interface ValidateCipherTextRequest {
      * has complete customer information (name, email, etc.)
      */
     customer_data?: CipherTextCustomerData;
+    /**
+     * Single-use device-signals nonce from {@link SignalsNonce}. Bound to the
+     * tenant, user, and event; consumed server-side so the submission can't be
+     * replayed. Attached automatically by the client.
+     */
+    nonce?: string;
+}
+/**
+ * A short-lived, single-use device-signals nonce minted by the server. Bind a
+ * device-signals submission to a specific tenant, user, and event type so a
+ * captured envelope can't be replayed. Integrity is enforced server-side.
+ */
+interface SignalsNonce {
+    nonce: string;
+    expires_at: string;
 }
 /**
  * Response from cipherText validation
@@ -227,7 +252,11 @@ interface ValidateCipherTextResponse {
     };
 }
 interface VerifyIPRequest {
-    ip_address: string;
+    /**
+     * Optional. Omit to let the server derive the connecting IP — the SDK never
+     * asserts the client IP (spoofable, and the server extracts it authoritatively).
+     */
+    ip_address?: string;
     user_id: string;
     event_type: string;
     device_fingerprint?: DeviceFingerprintRequest;
@@ -483,7 +512,9 @@ interface GeolocationConfigResponse {
     };
     /** When true, GPS-verified location overrides anonymizer-based blocking */
     trust_gps_over_anonymizer: boolean;
-    /** Public signing key (pk_) for client-side HMAC signing */
+    /**
+     * @deprecated No longer used by the SDK and ignored if present.
+     */
     signing_key?: string;
 }
 interface GeolocationClientConfig {
@@ -503,6 +534,15 @@ interface GeolocationClientConfig {
     logger?: Logger;
     /** Environment mode - 'sandbox' uses isolated sandbox data */
     environment?: 'production' | 'sandbox';
+    /**
+     * How long a fetched GPS requirement config is reused before it is read again,
+     * in milliseconds (default: 300000, i.e. 5 minutes).
+     *
+     * These requirements are edited in the compliance console while your
+     * application is running, so a lower value makes changes take effect sooner at
+     * the cost of more requests. Use `refreshGPSConfig()` to re-read immediately.
+     */
+    gpsConfigTtlMs?: number;
 }
 interface UseGeolocationOptions {
     /** Auto-detect and verify user's IP on mount */
@@ -624,16 +664,6 @@ interface ResendLocationRequestRequest {
     email?: string;
     phone?: string;
 }
-interface WiFiNetwork {
-    /** MAC address (BSSID) */
-    macAddress: string;
-    /** Signal strength in dBm (negative number) */
-    signalStrength?: number;
-    /** WiFi channel */
-    channel?: number;
-    /** Network name (optional) */
-    ssid?: string;
-}
 interface LocationCaptureRequest {
     /** GPS latitude (if available) */
     latitude?: number;
@@ -641,8 +671,8 @@ interface LocationCaptureRequest {
     longitude?: number;
     /** GPS accuracy in meters */
     accuracy?: number;
-    /** WiFi networks for positioning (if GPS not available) */
-    wifi_networks?: WiFiNetwork[];
+    /** Advisory client-side GPS integrity flags; the server weighs these as risk factors. */
+    integrity_flags?: string[];
     /** User agent string */
     user_agent?: string;
     /** Device metadata */
@@ -662,6 +692,10 @@ interface LocationShareInfo {
     status: string;
     is_expired: boolean;
     is_completed: boolean;
+    /**
+     * Server-only hint. The web SDK cannot enumerate WiFi networks (no browser API
+     * for BSSIDs); this flag is informational and never satisfied client-side.
+     */
     requires_wifi: boolean;
 }
 interface LocationCaptureResponse {
@@ -730,8 +764,6 @@ interface UseLocationCaptureOptions {
     autoFetch?: boolean;
     /** Auto-request GPS permission on mount */
     autoRequestGPS?: boolean;
-    /** Collect WiFi data as fallback (requires explicit permission) */
-    collectWiFi?: boolean;
 }
 interface UseLocationCaptureResult {
     /** Location share info */
@@ -763,18 +795,9 @@ interface UseLocationCaptureResult {
  * Extends BaseClient for consistent retry logic, timeout handling, and error management.
  */
 
-/**
- * GeolocationClient extends BaseClient for:
- * - Consistent retry logic with exponential backoff
- * - Unified error handling (VesantError, NetworkError, TimeoutError, etc.)
- * - Automatic timeout management
- * - Debug logging
- *
- * All geolocation verification calls use requestWithRetry() to handle
- * transient failures gracefully.
- */
 declare class GeolocationClient extends BaseClient {
-    private cachedSigningKey?;
+    private readonly gpsConfigTtlMs;
+    private gpsConfigCache;
     constructor(config: GeolocationClientConfig);
     /**
      * Verify an IP address and check compliance
@@ -836,14 +859,45 @@ declare class GeolocationClient extends BaseClient {
      */
     getGPSConfig(requestOptions?: RequestOptions): Promise<GeolocationConfigResponse>;
     /**
-     * Fetch the signing key from the dedicated authenticated endpoint.
+     * Re-read the tenant's GPS requirement configuration, ignoring any copy held
+     * from an earlier read.
+     *
+     * These requirements are edited in the compliance console while your
+     * application is running. `getGPSConfig` reuses a fetched copy for a short
+     * period so a long-lived session does not call the API on every event; call
+     * this when you need a change to take effect immediately — for example right
+     * after an administrator saves new settings.
+     *
+     * @returns The current GPS requirement config per event type
+     *
+     * @example
+     * ```typescript
+     * const config = await client.refreshGPSConfig();
+     * if (config.require_gps.login) {
+     *   // GPS is now required for login
+     * }
+     * ```
+     */
+    refreshGPSConfig(requestOptions?: RequestOptions): Promise<GeolocationConfigResponse>;
+    /**
+     * Mint a short-lived, single-use device-signals nonce.
      *
-     * Falls back to getGPSConfig() for backward compatibility with older servers
-     * that don't expose `/api/v1/geo/signing-key`.
+     * The nonce is bound to the tenant, user, and event type and is consumed
+     * server-side during validation, so a captured device-signals envelope cannot
+     * be replayed. `validateCipherText` mints and attaches one automatically; call
+     * this directly only if you manage the nonce yourself.
      *
-     * @returns The signing key string, or undefined if unavailable
+     * @param userId - User ID the nonce is bound to
+     * @param eventType - Event type the nonce is bound to (login, registration, ...)
+     * @returns The nonce and its expiry
+     */
+    fetchSignalsNonce(userId: string, eventType: CipherTextReason, requestOptions?: RequestOptions): Promise<SignalsNonce>;
+    /**
+     * Best-effort nonce mint for validation. Returns undefined if minting fails —
+     * the server is the sole authority and blocks when a nonce is required, so this
+     * never downgrades security on the client's say-so.
      */
-    fetchSigningKey(requestOptions?: RequestOptions): Promise<string | undefined>;
+    private resolveSignalsNonce;
     /**
      * Validate a cipherText generated by the frontend SDK
      *
@@ -995,40 +1049,30 @@ declare class GeolocationClient extends BaseClient {
      *
      * @example
      * ```typescript
-     * // Using GPS (preferred)
+     * // GPS (the web SDK is GPS + IP only; the server handles the IP fallback)
      * const result = await client.captureLocation(token, {
      *   latitude: 37.7749,
      *   longitude: -122.4194,
      *   accuracy: 10
      * });
-     *
-     * // Using WiFi positioning (fallback)
-     * const result = await client.captureLocation(token, {
-     *   wifi_networks: [
-     *     { macAddress: "00:11:22:33:44:55", signalStrength: -50 },
-     *     { macAddress: "AA:BB:CC:DD:EE:FF", signalStrength: -70 }
-     *   ]
-     * });
      * ```
      */
     captureLocation(token: string, capture: LocationCaptureRequest, requestOptions?: RequestOptions): Promise<LocationCaptureResponse>;
     /**
-     * Generate a signed cipherText containing device and location data.
-     *
-     * Automatically passes the client's API key for HMAC signing (v02 format).
-     * If no API key is configured, falls back to unsigned v01 format.
+     * Generate a device-signals envelope containing device and location data,
+     * validated by the server.
      *
-     * @param options - Options for cipherText generation
+     * @param options - Options for envelope generation
      * @param gpsConfig - Optional GPS config (from getGPSConfig)
-     * @returns CipherText result with the signed string
+     * @returns The device-signals envelope result
      *
      * @example
      * ```typescript
      * const result = await client.generateCipherText({ reason: 'login' });
-     * console.log(result.cipherText); // v02 signed cipherText
+     * console.log(result.cipherText); // device-signals envelope
      * ```
      */
     generateCipherText(options: Omit<CipherTextOptions, 'apiKey' | 'signingKey'>, gpsConfig?: GeolocationConfigResponse): Promise<CipherTextResult>;
 }
 
-export { type UseLocationRequestsResult as $, type APIError as A, type GeolocationClientConfig as B, type CipherTextCustomerData as C, type DeviceFingerprintRequest as D, type GeolocationConfigResponse as E, type GeolocationRecord as F, GeolocationClient as G, type LocationCaptureRequest as H, type LocationCaptureResponse as I, type JurisdictionConfig as J, type LocationRequestChannel as K, type LocationVerification as L, type LocationRequestResult as M, type LocationRequestStatus as N, type LocationShareInfo as O, type UpdateGeofenceRuleRequest as P, type UpdateJurisdictionRequest as Q, type ResendLocationRequestRequest as R, type UseAlertsOptions as S, type UseAlertsResult as T, type UpdateDeviceTrustRequest as U, type ValidateCipherTextResponse as V, type UseGeolocationOptions as W, type UseGeolocationResult as X, type UseLocationCaptureOptions as Y, type UseLocationCaptureResult as Z, type UseLocationRequestsOptions as _, type LocationRequest as a, type ValidateCipherTextRequest as a0, type VerifyIPRequest as a1, type WiFiNetwork as a2, type LocationRequestFilters as b, type LocationRequestListResponse as c, type AlertFilters as d, type AlertListResponse as e, type AlertSeverity as f, type AlertStatus as g, type AlertType as h, type CipherTextOptions as i, type CipherTextPayload as j, type CipherTextReason as k, type CipherTextResult as l, type ComplianceCheckResponse as m, type CreateGeofenceRuleRequest as n, type CreateJurisdictionRequest as o, type CreateLocationRequestRequest as p, type DashboardMetrics as q, type DecryptedCipherText as r, type DeviceFingerprint as s, type DeviceTrustResult as t, type GeoIPResult as u, type GeofenceAction as v, type GeofenceEvaluation as w, type GeofenceRule as x, type GeofenceRuleType as y, type GeolocationAlert as z };
+export { type UseLocationCaptureResult as $, type APIError as A, type GeolocationAlert as B, type CipherTextCustomerData as C, type DeviceFingerprintRequest as D, type GeolocationClientConfig as E, type GeolocationConfigResponse as F, GeolocationClient as G, type GeolocationRecord as H, type LocationCaptureRequest as I, type JurisdictionConfig as J, type LocationCaptureResponse as K, type LocationVerification as L, type LocationRequestChannel as M, type LocationRequestResult as N, type LocationRequestStatus as O, type LocationShareInfo as P, type UpdateGeofenceRuleRequest as Q, type ResendLocationRequestRequest as R, type SignalsNonce as S, type UpdateJurisdictionRequest as T, type UpdateDeviceTrustRequest as U, type ValidateCipherTextResponse as V, type UseAlertsOptions as W, type UseAlertsResult as X, type UseGeolocationOptions as Y, type UseGeolocationResult as Z, type UseLocationCaptureOptions as _, type LocationRequest as a, type UseLocationRequestsOptions as a0, type UseLocationRequestsResult as a1, type ValidateCipherTextRequest as a2, type VerifyIPRequest as a3, type LocationRequestFilters as b, type LocationRequestListResponse as c, type AlertFilters as d, type AlertListResponse as e, type AlertSeverity as f, type AlertStatus as g, type AlertType as h, type CipherTextOptions as i, type CipherTextPayload as j, type CipherTextReason as k, type CipherTextResult as l, type ComplianceCheckResponse as m, type CreateGeofenceRuleRequest as n, type CreateJurisdictionRequest as o, type CreateLocationRequestRequest as p, type DashboardMetrics as q, type DecryptedCipherText as r, type DeviceFingerprint as s, type DeviceSignalsEnvelope as t, type DeviceTrustResult as u, type GeoIPResult as v, type GeofenceAction as w, type GeofenceEvaluation as x, type GeofenceRule as y, type GeofenceRuleType as z };