vesant-sdk 1.7.1-dev.ec505dc → 1.7.1-next.4e2ab61

package/dist/{client-BY4Quazn.d.ts → client-B3DCAHlg.d.ts}

@@ -1,4 +1,4 @@
-import { D as DeviceFingerprintRequest, L as LocationVerification, V as ValidateCipherTextResponse, a as LocationRequest, G as GeolocationClient, b as LocationRequestFilters, c as LocationRequestListResponse } from './client-C-u9lE8N.js';
+import { D as DeviceFingerprintRequest, L as LocationVerification, V as ValidateCipherTextResponse, a as LocationRequest, G as GeolocationClient, b as LocationRequestFilters, c as LocationRequestListResponse } from './client-fy3trF2K.js';
 import { RiskProfileClient } from './risk-profile/index.js';
 import { V as VesantConfig, R as RequestOptions } from './client-q9fN8Hhf.js';
 import { C as CustomerProfile } from './types-UGyDl1fd.js';

package/dist/{client-Yxat9wAO.d.mts → client-BwXMQA2a.d.mts}

@@ -174,6 +174,21 @@ interface ValidateCipherTextRequest {
      * has complete customer information (name, email, etc.)
      */
     customer_data?: CipherTextCustomerData;
+    /**
+     * Single-use device-signals nonce from {@link SignalsNonce}. Bound to the
+     * tenant, user, and event; consumed server-side so the submission can't be
+     * replayed. Attached automatically by the client.
+     */
+    nonce?: string;
+}
+/**
+ * A short-lived, single-use device-signals nonce minted by the server. Bind a
+ * device-signals submission to a specific tenant, user, and event type so a
+ * captured envelope can't be replayed. Integrity is enforced server-side.
+ */
+interface SignalsNonce {
+    nonce: string;
+    expires_at: string;
 }
 /**
  * Response from cipherText validation
@@ -842,6 +857,25 @@ declare class GeolocationClient extends BaseClient {
      * ```
      */
     getGPSConfig(requestOptions?: RequestOptions): Promise<GeolocationConfigResponse>;
+    /**
+     * Mint a short-lived, single-use device-signals nonce.
+     *
+     * The nonce is bound to the tenant, user, and event type and is consumed
+     * server-side during validation, so a captured device-signals envelope cannot
+     * be replayed. `validateCipherText` mints and attaches one automatically; call
+     * this directly only if you manage the nonce yourself.
+     *
+     * @param userId - User ID the nonce is bound to
+     * @param eventType - Event type the nonce is bound to (login, registration, ...)
+     * @returns The nonce and its expiry
+     */
+    fetchSignalsNonce(userId: string, eventType: CipherTextReason, requestOptions?: RequestOptions): Promise<SignalsNonce>;
+    /**
+     * Best-effort nonce mint for validation. Returns undefined if minting fails —
+     * the server is the sole authority and blocks when a nonce is required, so this
+     * never downgrades security on the client's say-so.
+     */
+    private resolveSignalsNonce;
     /**
      * Validate a cipherText generated by the frontend SDK
      *
@@ -1019,4 +1053,4 @@ declare class GeolocationClient extends BaseClient {
     generateCipherText(options: Omit<CipherTextOptions, 'apiKey' | 'signingKey'>, gpsConfig?: GeolocationConfigResponse): Promise<CipherTextResult>;
 }
 
-export { type UseLocationRequestsOptions as $, type APIError as A, type GeolocationAlert as B, type CipherTextCustomerData as C, type DeviceFingerprintRequest as D, type GeolocationClientConfig as E, type GeolocationConfigResponse as F, GeolocationClient as G, type GeolocationRecord as H, type LocationCaptureRequest as I, type JurisdictionConfig as J, type LocationCaptureResponse as K, type LocationVerification as L, type LocationRequestChannel as M, type LocationRequestResult as N, type LocationRequestStatus as O, type LocationShareInfo as P, type UpdateGeofenceRuleRequest as Q, type ResendLocationRequestRequest as R, type UpdateJurisdictionRequest as S, type UseAlertsOptions as T, type UpdateDeviceTrustRequest as U, type ValidateCipherTextResponse as V, type UseAlertsResult as W, type UseGeolocationOptions as X, type UseGeolocationResult as Y, type UseLocationCaptureOptions as Z, type UseLocationCaptureResult as _, type LocationRequest as a, type UseLocationRequestsResult as a0, type ValidateCipherTextRequest as a1, type VerifyIPRequest as a2, type LocationRequestFilters as b, type LocationRequestListResponse as c, type AlertFilters as d, type AlertListResponse as e, type AlertSeverity as f, type AlertStatus as g, type AlertType as h, type CipherTextOptions as i, type CipherTextPayload as j, type CipherTextReason as k, type CipherTextResult as l, type ComplianceCheckResponse as m, type CreateGeofenceRuleRequest as n, type CreateJurisdictionRequest as o, type CreateLocationRequestRequest as p, type DashboardMetrics as q, type DecryptedCipherText as r, type DeviceFingerprint as s, type DeviceSignalsEnvelope as t, type DeviceTrustResult as u, type GeoIPResult as v, type GeofenceAction as w, type GeofenceEvaluation as x, type GeofenceRule as y, type GeofenceRuleType as z };
+export { type UseLocationCaptureResult as $, type APIError as A, type GeolocationAlert as B, type CipherTextCustomerData as C, type DeviceFingerprintRequest as D, type GeolocationClientConfig as E, type GeolocationConfigResponse as F, GeolocationClient as G, type GeolocationRecord as H, type LocationCaptureRequest as I, type JurisdictionConfig as J, type LocationCaptureResponse as K, type LocationVerification as L, type LocationRequestChannel as M, type LocationRequestResult as N, type LocationRequestStatus as O, type LocationShareInfo as P, type UpdateGeofenceRuleRequest as Q, type ResendLocationRequestRequest as R, type SignalsNonce as S, type UpdateJurisdictionRequest as T, type UpdateDeviceTrustRequest as U, type ValidateCipherTextResponse as V, type UseAlertsOptions as W, type UseAlertsResult as X, type UseGeolocationOptions as Y, type UseGeolocationResult as Z, type UseLocationCaptureOptions as _, type LocationRequest as a, type UseLocationRequestsOptions as a0, type UseLocationRequestsResult as a1, type ValidateCipherTextRequest as a2, type VerifyIPRequest as a3, type LocationRequestFilters as b, type LocationRequestListResponse as c, type AlertFilters as d, type AlertListResponse as e, type AlertSeverity as f, type AlertStatus as g, type AlertType as h, type CipherTextOptions as i, type CipherTextPayload as j, type CipherTextReason as k, type CipherTextResult as l, type ComplianceCheckResponse as m, type CreateGeofenceRuleRequest as n, type CreateJurisdictionRequest as o, type CreateLocationRequestRequest as p, type DashboardMetrics as q, type DecryptedCipherText as r, type DeviceFingerprint as s, type DeviceSignalsEnvelope as t, type DeviceTrustResult as u, type GeoIPResult as v, type GeofenceAction as w, type GeofenceEvaluation as x, type GeofenceRule as y, type GeofenceRuleType as z };

package/dist/{client-CX1jcLNZ.d.mts → client-D23KhWeh.d.mts}

@@ -1,4 +1,4 @@
-import { D as DeviceFingerprintRequest, L as LocationVerification, V as ValidateCipherTextResponse, a as LocationRequest, G as GeolocationClient, b as LocationRequestFilters, c as LocationRequestListResponse } from './client-Yxat9wAO.mjs';
+import { D as DeviceFingerprintRequest, L as LocationVerification, V as ValidateCipherTextResponse, a as LocationRequest, G as GeolocationClient, b as LocationRequestFilters, c as LocationRequestListResponse } from './client-BwXMQA2a.mjs';
 import { RiskProfileClient } from './risk-profile/index.mjs';
 import { V as VesantConfig, R as RequestOptions } from './client-q9fN8Hhf.mjs';
 import { C as CustomerProfile } from './types-BOFaMQxI.mjs';

package/dist/{client-C-u9lE8N.d.ts → client-fy3trF2K.d.ts}

@@ -174,6 +174,21 @@ interface ValidateCipherTextRequest {
      * has complete customer information (name, email, etc.)
      */
     customer_data?: CipherTextCustomerData;
+    /**
+     * Single-use device-signals nonce from {@link SignalsNonce}. Bound to the
+     * tenant, user, and event; consumed server-side so the submission can't be
+     * replayed. Attached automatically by the client.
+     */
+    nonce?: string;
+}
+/**
+ * A short-lived, single-use device-signals nonce minted by the server. Bind a
+ * device-signals submission to a specific tenant, user, and event type so a
+ * captured envelope can't be replayed. Integrity is enforced server-side.
+ */
+interface SignalsNonce {
+    nonce: string;
+    expires_at: string;
 }
 /**
  * Response from cipherText validation
@@ -842,6 +857,25 @@ declare class GeolocationClient extends BaseClient {
      * ```
      */
     getGPSConfig(requestOptions?: RequestOptions): Promise<GeolocationConfigResponse>;
+    /**
+     * Mint a short-lived, single-use device-signals nonce.
+     *
+     * The nonce is bound to the tenant, user, and event type and is consumed
+     * server-side during validation, so a captured device-signals envelope cannot
+     * be replayed. `validateCipherText` mints and attaches one automatically; call
+     * this directly only if you manage the nonce yourself.
+     *
+     * @param userId - User ID the nonce is bound to
+     * @param eventType - Event type the nonce is bound to (login, registration, ...)
+     * @returns The nonce and its expiry
+     */
+    fetchSignalsNonce(userId: string, eventType: CipherTextReason, requestOptions?: RequestOptions): Promise<SignalsNonce>;
+    /**
+     * Best-effort nonce mint for validation. Returns undefined if minting fails —
+     * the server is the sole authority and blocks when a nonce is required, so this
+     * never downgrades security on the client's say-so.
+     */
+    private resolveSignalsNonce;
     /**
      * Validate a cipherText generated by the frontend SDK
      *
@@ -1019,4 +1053,4 @@ declare class GeolocationClient extends BaseClient {
     generateCipherText(options: Omit<CipherTextOptions, 'apiKey' | 'signingKey'>, gpsConfig?: GeolocationConfigResponse): Promise<CipherTextResult>;
 }
 
-export { type UseLocationRequestsOptions as $, type APIError as A, type GeolocationAlert as B, type CipherTextCustomerData as C, type DeviceFingerprintRequest as D, type GeolocationClientConfig as E, type GeolocationConfigResponse as F, GeolocationClient as G, type GeolocationRecord as H, type LocationCaptureRequest as I, type JurisdictionConfig as J, type LocationCaptureResponse as K, type LocationVerification as L, type LocationRequestChannel as M, type LocationRequestResult as N, type LocationRequestStatus as O, type LocationShareInfo as P, type UpdateGeofenceRuleRequest as Q, type ResendLocationRequestRequest as R, type UpdateJurisdictionRequest as S, type UseAlertsOptions as T, type UpdateDeviceTrustRequest as U, type ValidateCipherTextResponse as V, type UseAlertsResult as W, type UseGeolocationOptions as X, type UseGeolocationResult as Y, type UseLocationCaptureOptions as Z, type UseLocationCaptureResult as _, type LocationRequest as a, type UseLocationRequestsResult as a0, type ValidateCipherTextRequest as a1, type VerifyIPRequest as a2, type LocationRequestFilters as b, type LocationRequestListResponse as c, type AlertFilters as d, type AlertListResponse as e, type AlertSeverity as f, type AlertStatus as g, type AlertType as h, type CipherTextOptions as i, type CipherTextPayload as j, type CipherTextReason as k, type CipherTextResult as l, type ComplianceCheckResponse as m, type CreateGeofenceRuleRequest as n, type CreateJurisdictionRequest as o, type CreateLocationRequestRequest as p, type DashboardMetrics as q, type DecryptedCipherText as r, type DeviceFingerprint as s, type DeviceSignalsEnvelope as t, type DeviceTrustResult as u, type GeoIPResult as v, type GeofenceAction as w, type GeofenceEvaluation as x, type GeofenceRule as y, type GeofenceRuleType as z };
+export { type UseLocationCaptureResult as $, type APIError as A, type GeolocationAlert as B, type CipherTextCustomerData as C, type DeviceFingerprintRequest as D, type GeolocationClientConfig as E, type GeolocationConfigResponse as F, GeolocationClient as G, type GeolocationRecord as H, type LocationCaptureRequest as I, type JurisdictionConfig as J, type LocationCaptureResponse as K, type LocationVerification as L, type LocationRequestChannel as M, type LocationRequestResult as N, type LocationRequestStatus as O, type LocationShareInfo as P, type UpdateGeofenceRuleRequest as Q, type ResendLocationRequestRequest as R, type SignalsNonce as S, type UpdateJurisdictionRequest as T, type UpdateDeviceTrustRequest as U, type ValidateCipherTextResponse as V, type UseAlertsOptions as W, type UseAlertsResult as X, type UseGeolocationOptions as Y, type UseGeolocationResult as Z, type UseLocationCaptureOptions as _, type LocationRequest as a, type UseLocationRequestsOptions as a0, type UseLocationRequestsResult as a1, type ValidateCipherTextRequest as a2, type VerifyIPRequest as a3, type LocationRequestFilters as b, type LocationRequestListResponse as c, type AlertFilters as d, type AlertListResponse as e, type AlertSeverity as f, type AlertStatus as g, type AlertType as h, type CipherTextOptions as i, type CipherTextPayload as j, type CipherTextReason as k, type CipherTextResult as l, type ComplianceCheckResponse as m, type CreateGeofenceRuleRequest as n, type CreateJurisdictionRequest as o, type CreateLocationRequestRequest as p, type DashboardMetrics as q, type DecryptedCipherText as r, type DeviceFingerprint as s, type DeviceSignalsEnvelope as t, type DeviceTrustResult as u, type GeoIPResult as v, type GeofenceAction as w, type GeofenceEvaluation as x, type GeofenceRule as y, type GeofenceRuleType as z };

package/dist/compliance/index.d.mts

@@ -1,6 +1,6 @@
 import { B as BlockReason } from '../types-CBQRNL-l.mjs';
-export { C as ComplianceClient, a as ComplianceLocationRequestInput, b as ComplianceLocationRequestResult, c as CurrencyRates, D as DEFAULT_CURRENCY_RATES, E as EventVerificationRequest, d as EventVerificationResponse, L as LoginVerificationRequest, e as LoginVerificationResponse, R as RegistrationVerificationRequest, f as RegistrationVerificationResponse, T as TransactionRiskResult, g as TransactionVerificationRequest, h as TransactionVerificationResponse } from '../client-CX1jcLNZ.mjs';
-export { p as CreateLocationRequestRequest, I as LocationCaptureRequest, K as LocationCaptureResponse, a as LocationRequest, M as LocationRequestChannel, b as LocationRequestFilters, c as LocationRequestListResponse, N as LocationRequestResult, O as LocationRequestStatus, P as LocationShareInfo, R as ResendLocationRequestRequest } from '../client-Yxat9wAO.mjs';
+export { C as ComplianceClient, a as ComplianceLocationRequestInput, b as ComplianceLocationRequestResult, c as CurrencyRates, D as DEFAULT_CURRENCY_RATES, E as EventVerificationRequest, d as EventVerificationResponse, L as LoginVerificationRequest, e as LoginVerificationResponse, R as RegistrationVerificationRequest, f as RegistrationVerificationResponse, T as TransactionRiskResult, g as TransactionVerificationRequest, h as TransactionVerificationResponse } from '../client-D23KhWeh.mjs';
+export { p as CreateLocationRequestRequest, I as LocationCaptureRequest, K as LocationCaptureResponse, a as LocationRequest, M as LocationRequestChannel, b as LocationRequestFilters, c as LocationRequestListResponse, N as LocationRequestResult, O as LocationRequestStatus, P as LocationShareInfo, R as ResendLocationRequestRequest } from '../client-BwXMQA2a.mjs';
 import '../risk-profile/index.mjs';
 import '../client-q9fN8Hhf.mjs';
 import '../types-BOFaMQxI.mjs';

package/dist/compliance/index.d.ts

@@ -1,6 +1,6 @@
 import { B as BlockReason } from '../types-CBQRNL-l.js';
-export { C as ComplianceClient, a as ComplianceLocationRequestInput, b as ComplianceLocationRequestResult, c as CurrencyRates, D as DEFAULT_CURRENCY_RATES, E as EventVerificationRequest, d as EventVerificationResponse, L as LoginVerificationRequest, e as LoginVerificationResponse, R as RegistrationVerificationRequest, f as RegistrationVerificationResponse, T as TransactionRiskResult, g as TransactionVerificationRequest, h as TransactionVerificationResponse } from '../client-BY4Quazn.js';
-export { p as CreateLocationRequestRequest, I as LocationCaptureRequest, K as LocationCaptureResponse, a as LocationRequest, M as LocationRequestChannel, b as LocationRequestFilters, c as LocationRequestListResponse, N as LocationRequestResult, O as LocationRequestStatus, P as LocationShareInfo, R as ResendLocationRequestRequest } from '../client-C-u9lE8N.js';
+export { C as ComplianceClient, a as ComplianceLocationRequestInput, b as ComplianceLocationRequestResult, c as CurrencyRates, D as DEFAULT_CURRENCY_RATES, E as EventVerificationRequest, d as EventVerificationResponse, L as LoginVerificationRequest, e as LoginVerificationResponse, R as RegistrationVerificationRequest, f as RegistrationVerificationResponse, T as TransactionRiskResult, g as TransactionVerificationRequest, h as TransactionVerificationResponse } from '../client-B3DCAHlg.js';
+export { p as CreateLocationRequestRequest, I as LocationCaptureRequest, K as LocationCaptureResponse, a as LocationRequest, M as LocationRequestChannel, b as LocationRequestFilters, c as LocationRequestListResponse, N as LocationRequestResult, O as LocationRequestStatus, P as LocationShareInfo, R as ResendLocationRequestRequest } from '../client-fy3trF2K.js';
 import '../risk-profile/index.js';
 import '../client-q9fN8Hhf.js';
 import '../types-UGyDl1fd.js';

package/dist/compliance/index.js

@@ -1071,6 +1071,49 @@ var GeolocationClient = class extends BaseClient {
   async getGPSConfig(requestOptions) {
     return this.requestWithRetry("/api/v1/geo/config", void 0, void 0, void 0, requestOptions);
   }
+  /**
+   * Mint a short-lived, single-use device-signals nonce.
+   *
+   * The nonce is bound to the tenant, user, and event type and is consumed
+   * server-side during validation, so a captured device-signals envelope cannot
+   * be replayed. `validateCipherText` mints and attaches one automatically; call
+   * this directly only if you manage the nonce yourself.
+   *
+   * @param userId - User ID the nonce is bound to
+   * @param eventType - Event type the nonce is bound to (login, registration, ...)
+   * @returns The nonce and its expiry
+   */
+  async fetchSignalsNonce(userId, eventType, requestOptions) {
+    if (!userId?.trim()) {
+      throw new ValidationError("userId is required and must be a non-empty string", ["userId"]);
+    }
+    const request = { user_id: userId, event_type: eventType };
+    return this.request(
+      "/api/v1/geo/signals-token",
+      {
+        method: "POST",
+        body: JSON.stringify(request)
+      },
+      void 0,
+      requestOptions
+    );
+  }
+  /**
+   * Best-effort nonce mint for validation. Returns undefined if minting fails —
+   * the server is the sole authority and blocks when a nonce is required, so this
+   * never downgrades security on the client's say-so.
+   */
+  async resolveSignalsNonce(userId, eventType, requestOptions) {
+    try {
+      const { nonce } = await this.fetchSignalsNonce(userId, eventType, requestOptions);
+      return nonce;
+    } catch (err) {
+      this.logger.warn(
+        `Failed to mint device-signals nonce; proceeding without it: ${err instanceof Error ? err.message : String(err)}`
+      );
+      return void 0;
+    }
+  }
   // ============================================================================
   // CipherText Validation
   // ============================================================================
@@ -1122,12 +1165,14 @@ var GeolocationClient = class extends BaseClient {
     if (!userId?.trim()) {
       throw new ValidationError("userId is required and must be a non-empty string", ["userId"]);
     }
+    const nonce = await this.resolveSignalsNonce(userId, eventType, requestOptions);
     const request = {
       cipher_text: cipherText,
       user_id: userId,
       event_type: eventType,
       expected_ip: expectedIP,
-      customer_data: customerData
+      customer_data: customerData,
+      nonce
     };
     return this.requestWithRetry(
       "/api/v1/geo/validate-ciphertext",