vesant-sdk 1.7.1-dev.ec505dc → 1.7.2-dev.5d70bb0

package/dist/index.d.ts

@@ -3,12 +3,12 @@ export { A as AuthCredential, B as BaseClient, a as BaseClientConfig, C as CGSCo
 import { a as PaginatedResponse } from './types-CBQRNL-l.js';
 export { A as APIResponse, B as BlockReason, C as CustomerStatus, E as EntityType, b as ErrorResponse, L as LocationCompliance, P as PaginationParams, c as Reason, d as Result, R as RiskLevel, S as SuccessResponse, T as Timestamp, U as UUID, V as VerificationEventType } from './types-CBQRNL-l.js';
 export { B as BaseWebhookEvent, C as ComplianceCheckFailedPayload, D as DecisionRecordedPayload, G as GeolocationBlockedPayload, a as GeolocationVerifiedPayload, I as InMemoryDedupStore, b as InMemoryDedupStoreOptions, K as KycStatusChangedPayload, L as LabelAppliedPayload, c as LocationRequestCompletedPayload, N as NotificationWebhookEvent, P as ProfileCreatedPayload, d as ProfileUpdatedPayload, R as RiskCategoryChangedPayload, e as RiskScoreChangedPayload, T as TaxReminderSentPayload, V as VerifyWebhookSignatureOptions, W as WebhookAnyHandler, f as WebhookDedupStore, g as WebhookEvent, h as WebhookEventHandler, i as WebhookEventType, j as WebhookHandler, k as WebhookHandlerConfig, l as WebhookMiddlewareOptions, m as WebhookNotification, n as createNextWebhookHandler, o as createWebhookMiddleware, v as verifyWebhookSignature } from './index-DSDgS09k.js';
-export { A as APIError, d as AlertFilters, e as AlertListResponse, f as AlertSeverity, g as AlertStatus, h as AlertType, C as CipherTextCustomerData, i as CipherTextOptions, j as CipherTextPayload, k as CipherTextReason, l as CipherTextResult, m as ComplianceCheckResponse, n as CreateGeofenceRuleRequest, o as CreateJurisdictionRequest, p as CreateLocationRequestRequest, q as DashboardMetrics, r as DecryptedCipherText, s as DeviceFingerprint, D as DeviceFingerprintRequest, t as DeviceSignalsEnvelope, u as DeviceTrustResult, v as GeoIPResult, w as GeofenceAction, x as GeofenceEvaluation, y as GeofenceRule, z as GeofenceRuleType, B as GeolocationAlert, G as GeolocationClient, E as GeolocationClientConfig, F as GeolocationConfigResponse, H as GeolocationRecord, J as JurisdictionConfig, I as LocationCaptureRequest, K as LocationCaptureResponse, a as LocationRequest, M as LocationRequestChannel, b as LocationRequestFilters, c as LocationRequestListResponse, N as LocationRequestResult, O as LocationRequestStatus, P as LocationShareInfo, L as LocationVerification, R as ResendLocationRequestRequest, U as UpdateDeviceTrustRequest, Q as UpdateGeofenceRuleRequest, S as UpdateJurisdictionRequest, T as UseAlertsOptions, W as UseAlertsResult, X as UseGeolocationOptions, Y as UseGeolocationResult, Z as UseLocationCaptureOptions, _ as UseLocationCaptureResult, $ as UseLocationRequestsOptions, a0 as UseLocationRequestsResult, a1 as ValidateCipherTextRequest, V as ValidateCipherTextResponse, a2 as VerifyIPRequest } from './client-C-u9lE8N.js';
+export { A as APIError, d as AlertFilters, e as AlertListResponse, f as AlertSeverity, g as AlertStatus, h as AlertType, C as CipherTextCustomerData, i as CipherTextOptions, j as CipherTextPayload, k as CipherTextReason, l as CipherTextResult, m as ComplianceCheckResponse, n as CreateGeofenceRuleRequest, o as CreateJurisdictionRequest, p as CreateLocationRequestRequest, q as DashboardMetrics, r as DecryptedCipherText, s as DeviceFingerprint, D as DeviceFingerprintRequest, t as DeviceSignalsEnvelope, u as DeviceTrustResult, v as GeoIPResult, w as GeofenceAction, x as GeofenceEvaluation, y as GeofenceRule, z as GeofenceRuleType, B as GeolocationAlert, G as GeolocationClient, E as GeolocationClientConfig, F as GeolocationConfigResponse, H as GeolocationRecord, J as JurisdictionConfig, I as LocationCaptureRequest, K as LocationCaptureResponse, a as LocationRequest, M as LocationRequestChannel, b as LocationRequestFilters, c as LocationRequestListResponse, N as LocationRequestResult, O as LocationRequestStatus, P as LocationShareInfo, L as LocationVerification, R as ResendLocationRequestRequest, S as SignalsNonce, U as UpdateDeviceTrustRequest, Q as UpdateGeofenceRuleRequest, T as UpdateJurisdictionRequest, W as UseAlertsOptions, X as UseAlertsResult, Y as UseGeolocationOptions, Z as UseGeolocationResult, _ as UseLocationCaptureOptions, $ as UseLocationCaptureResult, a0 as UseLocationRequestsOptions, a1 as UseLocationRequestsResult, a2 as ValidateCipherTextRequest, V as ValidateCipherTextResponse, a3 as VerifyIPRequest } from './client-fy3trF2K.js';
 export { GpsIntegrityInput, GpsIntegrityOptions, GpsIntegrityResult, assessGpsIntegrity, collectDeviceSignals, decodeCipherText, generateCipherText, gpsIntegrityInputFromPosition, isCipherTextExpired, probeGeolocationPermission } from './geolocation/index.js';
 export { RiskProfileClient } from './risk-profile/index.js';
 export { a as CreateCustomerProfileRequest, a as CreateProfileRequest, C as CustomerProfile, P as CustomerProfileFilters, b as CustomerProfileListResponse, E as EmploymentType, L as LegalForm, c as ProfileDetailsResponse, P as ProfileFilters, b as ProfileListResponse, R as RiskCategory, d as RiskConfiguration, e as RiskDashboardMetrics, f as RiskFactor, g as RiskFactorType, h as RiskHistory, S as ScreeningStatus, U as UpdateProfileRequest } from './types-UGyDl1fd.js';
 export { sdkReasons } from './compliance/index.js';
-export { C as ComplianceClient, a as ComplianceLocationRequestInput, b as ComplianceLocationRequestResult, c as CurrencyRates, D as DEFAULT_CURRENCY_RATES, E as EventVerificationRequest, d as EventVerificationResponse, L as LoginVerificationRequest, e as LoginVerificationResponse, R as RegistrationVerificationRequest, f as RegistrationVerificationResponse, T as TransactionRiskResult, g as TransactionVerificationRequest, h as TransactionVerificationResponse } from './client-BY4Quazn.js';
+export { C as ComplianceClient, a as ComplianceLocationRequestInput, b as ComplianceLocationRequestResult, c as CurrencyRates, D as DEFAULT_CURRENCY_RATES, E as EventVerificationRequest, d as EventVerificationResponse, L as LoginVerificationRequest, e as LoginVerificationResponse, R as RegistrationVerificationRequest, f as RegistrationVerificationResponse, T as TransactionRiskResult, g as TransactionVerificationRequest, h as TransactionVerificationResponse } from './client-B3DCAHlg.js';
 export { CheckKycStatusRequest, CheckKycStatusResponse, CreateEventBasedFaceVerificationSessionRequest, CreateEventBasedFaceVerificationSessionResponse, DocumentType, DocumentVerificationRequest, DocumentVerificationResponse, EventBasedFaceVerificationCallback, EventBasedFaceVerificationDeviceType, EventBasedFaceVerificationEvent, EventBasedFaceVerificationFrequencyTrigger, EventBasedFaceVerificationReactionResult, EventBasedFaceVerificationReactions, EventBasedFaceVerificationThresholdTrigger, EventBasedFaceVerificationTriggers, FaceProof, KYC_DECLINED_DESCRIPTIONS, KycAlert, KycAlertFilters, KycAlertListResponse, KycAlertStatus, KycAlertType, KycClient, KycClientConfig, KycCustomerData, KycCustomerProfile, KycDeclinedCode, KycHandoffSession, KycOverview, KycPagination, KycPreferences, KycRequest, KycRequestFilters, KycRequestListResponse, KycStatus, Name, Proof, ProofDownloadURL, ProofType, RequestAdditionalDocumentsRequest, RequestKycSubmitLinkRequest, RequestKycSubmitLinkResponse, SubmitEventBasedFaceVerificationSessionRequest, SubmittedDocument, SupportedDocumentType, UpdateKycAlertRequest, UpdateKycPreferencesRequest, UpdateKycStatusRequest, UseKycAlertsOptions, UseKycAlertsResult, UseKycOverviewOptions, UseKycOverviewResult, UseKycPreferencesResult, UseKycRequestsOptions, UseKycRequestsResult, UseKycSubmissionOptions, UseKycSubmissionResult } from './kyc/index.js';
 export { CTPFormStatus, CTPTINStatus, ComplianceStats, ComplianceStatsFilters, CustomerTaxProfileDocuments, CustomerTaxProfileRecord, CustomerType, DocumentRequestBreakdown, EmailSendingMethod, EnableWithholdingInput, EnableWithholdingResponse, GlobalTaxRule, ReRequestTaxFormInput, RemindersRunResult, TINCheckResult, TINStatusBreakdown, TaxClient, TaxClientConfig, TaxRuleApprovalStatus, TaxRuleVersion, TaxRules, TransactionAction, TreatyCountry, TreatyCountryListResponse, UpdateTaxRulesInput, WFormCountBreakdown, WFormStatusBreakdown } from './tax/index.js';
 
@@ -83,6 +83,6 @@ declare const noopLogger: Logger;
 /**
  * Single source of truth for the SDK version.
  */
-declare const SDK_VERSION = "1.7.1";
+declare const SDK_VERSION = "1.7.2";
 
 export { AuthenticationError, CGSError, CircuitBreakerOpenError, ComplianceBlockedError, ComplianceError, Logger, NetworkError, PaginatedResponse, RateLimitError, SDK_VERSION, ServiceUnavailableError, TimeoutError, ValidationError, VesantError, collectAll, createConsoleLogger, noopLogger, paginate };

package/dist/index.js

@@ -298,7 +298,7 @@ var noopLogger = {
 };
 
 // src/core/version.ts
-var SDK_VERSION = "1.7.1";
+var SDK_VERSION = "1.7.2";
 
 // src/shared/browser-utils.ts
 function generateUUID() {
@@ -1206,6 +1206,49 @@ var GeolocationClient = class extends BaseClient {
   async getGPSConfig(requestOptions) {
     return this.requestWithRetry("/api/v1/geo/config", void 0, void 0, void 0, requestOptions);
   }
+  /**
+   * Mint a short-lived, single-use device-signals nonce.
+   *
+   * The nonce is bound to the tenant, user, and event type and is consumed
+   * server-side during validation, so a captured device-signals envelope cannot
+   * be replayed. `validateCipherText` mints and attaches one automatically; call
+   * this directly only if you manage the nonce yourself.
+   *
+   * @param userId - User ID the nonce is bound to
+   * @param eventType - Event type the nonce is bound to (login, registration, ...)
+   * @returns The nonce and its expiry
+   */
+  async fetchSignalsNonce(userId, eventType, requestOptions) {
+    if (!userId?.trim()) {
+      throw new ValidationError("userId is required and must be a non-empty string", ["userId"]);
+    }
+    const request = { user_id: userId, event_type: eventType };
+    return this.request(
+      "/api/v1/geo/signals-token",
+      {
+        method: "POST",
+        body: JSON.stringify(request)
+      },
+      void 0,
+      requestOptions
+    );
+  }
+  /**
+   * Best-effort nonce mint for validation. Returns undefined if minting fails —
+   * the server is the sole authority and blocks when a nonce is required, so this
+   * never downgrades security on the client's say-so.
+   */
+  async resolveSignalsNonce(userId, eventType, requestOptions) {
+    try {
+      const { nonce } = await this.fetchSignalsNonce(userId, eventType, requestOptions);
+      return nonce;
+    } catch (err) {
+      this.logger.warn(
+        `Failed to mint device-signals nonce; proceeding without it: ${err instanceof Error ? err.message : String(err)}`
+      );
+      return void 0;
+    }
+  }
   // ============================================================================
   // CipherText Validation
   // ============================================================================
@@ -1257,12 +1300,14 @@ var GeolocationClient = class extends BaseClient {
     if (!userId?.trim()) {
       throw new ValidationError("userId is required and must be a non-empty string", ["userId"]);
     }
+    const nonce = await this.resolveSignalsNonce(userId, eventType, requestOptions);
     const request = {
       cipher_text: cipherText,
       user_id: userId,
       event_type: eventType,
       expected_ip: expectedIP,
-      customer_data: customerData
+      customer_data: customerData,
+      nonce
     };
     return this.requestWithRetry(
       "/api/v1/geo/validate-ciphertext",