vesant-sdk 1.7.1-dev.ec505dc → 1.7.1-dev.fe54858

package/dist/index.mjs

@@ -1204,6 +1204,49 @@ var GeolocationClient = class extends BaseClient {
   async getGPSConfig(requestOptions) {
     return this.requestWithRetry("/api/v1/geo/config", void 0, void 0, void 0, requestOptions);
   }
+  /**
+   * Mint a short-lived, single-use device-signals nonce.
+   *
+   * The nonce is bound to the tenant, user, and event type and is consumed
+   * server-side during validation, so a captured device-signals envelope cannot
+   * be replayed. `validateCipherText` mints and attaches one automatically; call
+   * this directly only if you manage the nonce yourself.
+   *
+   * @param userId - User ID the nonce is bound to
+   * @param eventType - Event type the nonce is bound to (login, registration, ...)
+   * @returns The nonce and its expiry
+   */
+  async fetchSignalsNonce(userId, eventType, requestOptions) {
+    if (!userId?.trim()) {
+      throw new ValidationError("userId is required and must be a non-empty string", ["userId"]);
+    }
+    const request = { user_id: userId, event_type: eventType };
+    return this.request(
+      "/api/v1/geo/signals-token",
+      {
+        method: "POST",
+        body: JSON.stringify(request)
+      },
+      void 0,
+      requestOptions
+    );
+  }
+  /**
+   * Best-effort nonce mint for validation. Returns undefined if minting fails —
+   * the server is the sole authority and blocks when a nonce is required, so this
+   * never downgrades security on the client's say-so.
+   */
+  async resolveSignalsNonce(userId, eventType, requestOptions) {
+    try {
+      const { nonce } = await this.fetchSignalsNonce(userId, eventType, requestOptions);
+      return nonce;
+    } catch (err) {
+      this.logger.warn(
+        `Failed to mint device-signals nonce; proceeding without it: ${err instanceof Error ? err.message : String(err)}`
+      );
+      return void 0;
+    }
+  }
   // ============================================================================
   // CipherText Validation
   // ============================================================================
@@ -1255,12 +1298,14 @@ var GeolocationClient = class extends BaseClient {
     if (!userId?.trim()) {
       throw new ValidationError("userId is required and must be a non-empty string", ["userId"]);
     }
+    const nonce = await this.resolveSignalsNonce(userId, eventType, requestOptions);
     const request = {
       cipher_text: cipherText,
       user_id: userId,
       event_type: eventType,
       expected_ip: expectedIP,
-      customer_data: customerData
+      customer_data: customerData,
+      nonce
     };
     return this.requestWithRetry(
       "/api/v1/geo/validate-ciphertext",
@@ -3479,6 +3524,9 @@ var KYC_DECLINED_DESCRIPTIONS = {
   KYC_PROVIDER_REJECTED: "Identity verification was rejected by the verification provider",
   KYC_DECLINED: "Identity verification was declined"
 };
+function isKycDocumentExpiredCallbackEvent(value) {
+  return typeof value === "object" && value !== null && value.event === "kyc_document_expired";
+}
 
 // src/tax/client.ts
 var TaxClient = class extends BaseClient {
@@ -3768,6 +3816,6 @@ function buildHandler(options) {
   return handler;
 }
 
-export { AuthenticationError, BaseClient, CGSError, CircuitBreaker, CircuitBreakerOpenError, ComplianceBlockedError, ComplianceClient, ComplianceError, DEFAULT_CURRENCY_RATES, GeolocationClient, InMemoryDedupStore, KYC_DECLINED_DESCRIPTIONS, KycClient, NetworkError, RateLimitError, RateLimitTracker, RefreshingTokenProvider, RiskProfileClient, SDK_VERSION, ServiceUnavailableError, StaticApiKeyProvider, TaxClient, TimeoutError, ValidationError, VesantError, WebhookHandler, assessGpsIntegrity, collectAll, collectDeviceSignals, createConsoleLogger, createNextWebhookHandler, createWebhookMiddleware, decodeCipherText, generateCipherText, gpsIntegrityInputFromPosition, isCipherTextExpired, noopLogger, paginate, probeGeolocationPermission, sdkReasons, verifyWebhookSignature };
+export { AuthenticationError, BaseClient, CGSError, CircuitBreaker, CircuitBreakerOpenError, ComplianceBlockedError, ComplianceClient, ComplianceError, DEFAULT_CURRENCY_RATES, GeolocationClient, InMemoryDedupStore, KYC_DECLINED_DESCRIPTIONS, KycClient, NetworkError, RateLimitError, RateLimitTracker, RefreshingTokenProvider, RiskProfileClient, SDK_VERSION, ServiceUnavailableError, StaticApiKeyProvider, TaxClient, TimeoutError, ValidationError, VesantError, WebhookHandler, assessGpsIntegrity, collectAll, collectDeviceSignals, createConsoleLogger, createNextWebhookHandler, createWebhookMiddleware, decodeCipherText, generateCipherText, gpsIntegrityInputFromPosition, isCipherTextExpired, isKycDocumentExpiredCallbackEvent, noopLogger, paginate, probeGeolocationPermission, sdkReasons, verifyWebhookSignature };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map