@arkyc/types 1.2.11 → 2.1.0

package/dist/access.d.mts

@@ -1,5 +1,4 @@
 import { Entity, Id, ProjectScoped } from "./common.mjs";
-
 //#region src/access.d.ts
 /**
  * A gated project capability. Extended access generalizes what used to be the
@@ -8,27 +7,27 @@ import { Entity, Id, ProjectScoped } from "./common.mjs";
  * runtime. New gated (and, later, paywalled) features are added here plus a row
  * in {@link ACCESS_CAPABILITIES}, not a new subsystem.
  */
-type AccessCapability = 'ai' | 'pii';
+export type AccessCapability = 'ai' | 'pii';
 /**
  * The lifecycle of a capability grant. `none` is synthetic (no row yet) and only
  * appears in API/UI responses; it is never persisted.
  */
-type AccessGrantStatus = 'none' | 'pending' | 'granted' | 'revoked';
+export type AccessGrantStatus = 'none' | 'pending' | 'granted' | 'revoked';
 /** Categories of personal data a project may request access to (PII capability). */
-type PiiCategory = 'identity' | 'address';
+export type PiiCategory = 'identity' | 'address';
 /** When a project needs the PII: before the session is decided, or only after. */
-type PiiTiming = 'before' | 'after';
+export type PiiTiming = 'before' | 'after';
 /**
  * Capability-specific request detail. Only meaningful for `pii`: what data the
  * project needs, when, and their justification for being able to protect it.
  */
-interface AccessGrantDetails {
+export interface AccessGrantDetails {
   categories?: PiiCategory[];
   timing?: PiiTiming;
   justification?: string | null;
 }
 /** A per-`(project, capability)` entitlement with a request/review lifecycle. */
-interface AccessGrant extends Entity, ProjectScoped {
+export interface AccessGrant extends Entity, ProjectScoped {
   capability: AccessCapability;
   status: AccessGrantStatus;
   details: AccessGrantDetails | null;
@@ -39,7 +38,7 @@ interface AccessGrant extends Entity, ProjectScoped {
   reviewed_at: string | null;
 }
 /** Registry metadata for one capability. */
-interface AccessCapabilityMeta {
+export interface AccessCapabilityMeta {
   key: AccessCapability;
   label: string;
   /** Whether projects can self-request it (vs admin-only grant). */
@@ -52,13 +51,13 @@ interface AccessCapabilityMeta {
  * Enforcement and UIs iterate this rather than hard-coding capability names.
  * (Room is left here for future `plan`/`billable` metadata behind a paywall.)
  */
-declare const ACCESS_CAPABILITIES: Record<AccessCapability, AccessCapabilityMeta>;
+export declare const ACCESS_CAPABILITIES: Record<AccessCapability, AccessCapabilityMeta>;
 /** All capability keys, in display order. */
-declare const ACCESS_CAPABILITY_KEYS: AccessCapability[];
+export declare const ACCESS_CAPABILITY_KEYS: AccessCapability[];
 /**
  * Identity fields extracted from the document (the `identity` PII category).
  */
-interface ExtractedIdentity {
+export interface ExtractedIdentity {
   first_name: string | null;
   last_name: string | null;
   full_name: string | null;
@@ -70,7 +69,7 @@ interface ExtractedIdentity {
 /**
  * Residential address fields (the `address` PII category).
  */
-interface ExtractedAddress {
+export interface ExtractedAddress {
   line1: string | null;
   line2: string | null;
   city: string | null;
@@ -86,10 +85,9 @@ interface ExtractedAddress {
  * (for `after` timing) only once the session is decided. Absent entirely when
  * the project has no granted PII entitlement.
  */
-interface ExtractedData {
+export interface ExtractedData {
   identity?: ExtractedIdentity;
   address?: ExtractedAddress;
 }
 //#endregion
-export { ACCESS_CAPABILITIES, ACCESS_CAPABILITY_KEYS, AccessCapability, AccessCapabilityMeta, AccessGrant, AccessGrantDetails, AccessGrantStatus, ExtractedAddress, ExtractedData, ExtractedIdentity, PiiCategory, PiiTiming };
 //# sourceMappingURL=access.d.mts.map

package/dist/access.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"access.d.mts","names":[],"sources":["../src/access.ts"],"mappings":";;;;;AASA;;;;AAA4B;KAAhB,gBAAA;;;;AAMiB;KAAjB,iBAAA;;KAGA,WAAA;;KAGA,SAAA;AAAZ;;;;AAAA,UAMiB,kBAAA;EACf,UAAA,GAAa,WAAA;EACb,MAAA,GAAS,SAAS;EAClB,aAAA;AAAA;;UAIe,WAAA,SAAoB,MAAA,EAAQ,aAAA;EAC3C,UAAA,EAAY,gBAAA;EACZ,MAAA,EAAQ,iBAAA;EACR,OAAA,EAAS,kBAAA;EACT,IAAA;EACA,YAAA,EAAc,EAAA;EACd,YAAA;EACA,WAAA,EAAa,EAAA;EACb,WAAA;AAAA;;UAIe,oBAAA;EACf,GAAA,EAAK,gBAAgB;EACrB,KAAA;EAdmC;EAgBnC,WAAA;EAhBwD;EAkBxD,eAAA;AAAA;;;;;;cAQW,mBAAA,EAAqB,MAAA,CAAO,gBAAA,EAAkB,oBAAA;;cAM9C,sBAAA,EAAwB,gBAAgB;;;;UAKpC,iBAAA;EACf,UAAA;EACA,SAAA;EACA,SAAA;EACA,aAAA;EACA,eAAA;EACA,WAAA;EACA,WAAA;AAAA;;;;UAMe,gBAAA;EACf,KAAA;EACA,KAAA;EACA,IAAA;EACA,MAAA;EACA,WAAA;EACA,OAAA;EACA,QAAA;EACA,SAAA;AAAA;;;;;;;UASe,aAAA;EACf,QAAA,GAAW,iBAAA;EACX,OAAA,GAAU,gBAAgB;AAAA"}
+{"version":3,"file":"access.d.mts","names":[],"sources":["../src/access.ts"],"mappings":";;;;;;;;;YASY;;;;;YAMA;;YAGA;;YAGA;;;;;iBAMK;EACf,aAAa;EACb,SAAS;EACT;;;iBAIe,oBAAoB,QAAQ;EAC3C,YAAY;EACZ,QAAQ;EACR,SAAS;EACT;EACA,cAAc;EACd;EACA,aAAa;EACb;;;iBAIe;EACf,KAAK;EACL;;EAEA;;EAEA;;;;;;;qBAQW,qBAAqB,OAAO,kBAAkB;;qBAM9C,wBAAwB;;;;iBAKpB;EACf;EACA;EACA;EACA;EACA;EACA;EACA;;;;;iBAMe;EACf;EACA;EACA;EACA;EACA;EACA;EACA;EACA;;;;;;;;iBASe;EACf,WAAW;EACX,UAAU"}

package/dist/audit.d.mts

@@ -1,13 +1,12 @@
 import { Id, IsoDateTime, Metadata } from "./common.mjs";
-
 //#region src/audit.d.ts
 /** Who performed an audited action. */
-type ActorType = 'user' | 'api_key' | 'system';
+export type ActorType = 'user' | 'api_key' | 'system';
 /**
  * An immutable audit log entry. Project scope is optional (some actions are
  * organization-level only). Audit rows are append-only and carry no `updated_at`.
  */
-interface AuditLog {
+export interface AuditLog {
   id: Id;
   organization_id: Id;
   project_id: Id | null;
@@ -23,5 +22,4 @@ interface AuditLog {
   created_at: IsoDateTime;
 }
 //#endregion
-export { ActorType, AuditLog };
 //# sourceMappingURL=audit.d.mts.map

package/dist/audit.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"audit.d.mts","names":[],"sources":["../src/audit.ts"],"mappings":";;;;KAGY,SAAA;AAAZ;;;;AAAA,UAMiB,QAAA;EACf,EAAA,EAAI,EAAA;EACJ,eAAA,EAAiB,EAAA;EACjB,UAAA,EAAY,EAAA;EACZ,QAAA,EAAU,EAAA;EACV,UAAA,EAAY,SAAA;EAFA;EAIZ,MAAA;EACA,WAAA;EACA,SAAA,EAAW,EAAA;EACX,QAAA,EAAU,QAAA;EACV,UAAA;EACA,UAAA;EACA,UAAA,EAAY,WAAA;AAAA"}
+{"version":3,"file":"audit.d.mts","names":[],"sources":["../src/audit.ts"],"mappings":";;;YAGY;;;;;iBAMK;EACf,IAAI;EACJ,iBAAiB;EACjB,YAAY;EACZ,UAAU;EACV,YAAY;;EAEZ;EACA;EACA,WAAW;EACX,UAAU;EACV;EACA;EACA,YAAY"}

package/dist/common.d.mts

@@ -7,30 +7,29 @@
  * `kyc_sess_…`, `organization_…`, `project_…`); timestamps are ISO-8601 strings.
  */
 /** A unique identifier (typically a prefixed, URL-safe string). */
-type Id = string;
+export type Id = string;
 /** An ISO-8601 date-time string, e.g. `2026-06-20T00:00:00.000Z`. */
-type IsoDateTime = string;
+export type IsoDateTime = string;
 /** An ISO-8601 date string (no time component), e.g. `1990-05-21`. */
-type IsoDate = string;
+export type IsoDate = string;
 /** Arbitrary, JSON-serialisable metadata attached to an entity. */
-type Metadata = Record<string, unknown>;
+export type Metadata = Record<string, unknown>;
 /** Columns shared by every persisted entity. */
-interface Timestamps {
+export interface Timestamps {
   created_at: IsoDateTime;
   updated_at: IsoDateTime;
 }
 /** A persisted entity: an `id` plus creation/update timestamps. */
-interface Entity extends Timestamps {
+export interface Entity extends Timestamps {
   id: Id;
 }
 /** Scoping columns present on every organization-owned entity. */
-interface OrganizationScoped {
+export interface OrganizationScoped {
   organization_id: Id;
 }
 /** Scoping columns present on every project-owned entity. */
-interface ProjectScoped extends OrganizationScoped {
+export interface ProjectScoped extends OrganizationScoped {
   project_id: Id;
 }
 //#endregion
-export { Entity, Id, IsoDate, IsoDateTime, Metadata, OrganizationScoped, ProjectScoped, Timestamps };
 //# sourceMappingURL=common.d.mts.map

package/dist/common.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"common.d.mts","names":[],"sources":["../src/common.ts"],"mappings":";;AASA;;;;AAAc;AAGd;;KAHY,EAAA;;KAGA,WAAA;AAGZ;AAAA,KAAY,OAAA;;KAGA,QAAA,GAAW,MAAM;AAHV;AAAA,UAMF,UAAA;EACf,UAAA,EAAY,WAAA;EACZ,UAAA,EAAY,WAAW;AAAA;AALI;AAAA,UASZ,MAAA,SAAe,UAAU;EACxC,EAAA,EAAI,EAAA;AAAA;;UAIW,kBAAA;EACf,eAAA,EAAiB,EAAE;AAAA;;UAIJ,aAAA,SAAsB,kBAAkB;EACvD,UAAA,EAAY,EAAA;AAAA"}
+{"version":3,"file":"common.d.mts","names":[],"sources":["../src/common.ts"],"mappings":";;;;;;;;;YASY;;YAGA;;YAGA;;YAGA,WAAW;;iBAGN;EACf,YAAY;EACZ,YAAY;;;iBAIG,eAAe;EAC9B,IAAI;;;iBAIW;EACf,iBAAiB;;;iBAIF,sBAAsB;EACrC,YAAY"}

package/dist/errors.d.mts

@@ -10,7 +10,6 @@
  * The typed clients surface this as `ArkycApiError.error` (`@arkyc/sdk`) and
  * `WidgetApiError.error` (`@arkyc/widget`).
  */
-type ApiErrorKey = 'missing_client_token' | 'invalid_client_token' | 'session_expired' | 'missing_api_key' | 'invalid_api_key' | 'invalid_workflow' | 'invalid_webhook';
+export type ApiErrorKey = 'missing_client_token' | 'invalid_client_token' | 'session_expired' | 'origin_not_allowed' | 'client_token_used' | 'handoff_disabled' | 'missing_api_key' | 'invalid_api_key' | 'invalid_workflow' | 'invalid_webhook';
 //#endregion
-export { ApiErrorKey };
 //# sourceMappingURL=errors.d.mts.map

package/dist/errors.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.mts","names":[],"sources":["../src/errors.ts"],"mappings":";;AAWA;;;;AAAuB;;;;;;KAAX,WAAA"}
+{"version":3,"file":"errors.d.mts","names":[],"sources":["../src/errors.ts"],"mappings":";;;;;;;;;;;;YAWY"}

package/dist/index.d.mts

@@ -1,12 +1,14 @@
 import { Entity, Id, IsoDate, IsoDateTime, Metadata, OrganizationScoped, ProjectScoped, Timestamps } from "./common.mjs";
 import { PublicUser, User } from "./user.mjs";
+import { DecisionReason, LivenessChallenge, LivenessMode, VerificationDecision, VerificationSession, VerificationStatus } from "./verification.mjs";
+import { DEFAULT_FACE_EMBEDDING_SETTINGS, DEFAULT_RISK_SIGNAL_POLICY, DEFAULT_SCREENING_CONFIG, DEFAULT_VELOCITY_SETTINGS, FaceEmbeddingSettings, REVIEW_ONLY_RISK_SIGNALS, RISK_SIGNAL_KEYS, RISK_SIGNAL_REASONS, RiskPolicyConfig, RiskSeverity, RiskSignal, RiskSignalKey, RiskSignalPolicy, ScreeningHit, ScreeningHitCategory, ScreeningOnHit, ScreeningStepConfig, SessionRiskSignal, VelocitySettings, WebhookRiskCheck } from "./risk.mjs";
 import { InvitationStatus, MembershipStatus, Organization, OrganizationInvitation, OrganizationMember, OrganizationSettings } from "./organization.mjs";
 import { AdminPermission, AdminPermissionGroup, AdminPermissionKey, AdminRoleSlug, AnyPermissionGroup, AnyPermissionKey, Permission, PermissionGroup, PermissionKey, Role, RolePermission, SystemRoleSlug, UserPermission } from "./rbac.mjs";
-import { CaptureModel, DEFAULT_GLOBAL_SETTINGS, GlobalSetting, GlobalSettings, RealtimeTransport } from "./settings.mjs";
-import { DecisionReason, LivenessChallenge, LivenessMode, VerificationDecision, VerificationSession, VerificationStatus } from "./verification.mjs";
-import { REALTIME_EVENT, RealtimeEventName, ReviewActionEvent, SessionTransitionEvent, parseRealtimeChannel, realtimeChannels } from "./realtime.mjs";
-import { ApiKey, ApiKeyWithSecret, Project, ProjectBranding, ProjectContext, ProjectEnvironment, ProjectHandoffSettings, ProjectMember, ProjectSettings, ProjectStatus, VerificationThresholds } from "./project.mjs";
-import { ADDRESS_METHODS, AVAILABLE_WORKFLOW_STEP_KEYS, AddressMethod, AddressOnFail, AddressStepConfig, DEFAULT_ADDRESS_CONFIG, DEFAULT_WORKFLOW_CONFIG, WORKFLOW_STEP_KEYS, Workflow, WorkflowConfig, WorkflowOptions, WorkflowStep, WorkflowStepKey, workflowAddressConfig, workflowEnabledSteps, workflowEnables, workflowRunsOcr } from "./workflow.mjs";
+import { CaptureModel, DEFAULT_GLOBAL_SETTINGS, GlobalSetting, GlobalSettings } from "./settings.mjs";
+import { REALTIME_EVENT, RealtimeEventName, ReviewActionEvent, SessionTransitionEvent, realtimeChannels } from "./realtime.mjs";
+import { DEFAULT_NOTIFICATION_PREFERENCES, NOTIFICATION_TYPE, NotificationPreferences, NotificationType, PushPlatform, UserNotification } from "./notifications.mjs";
+import { ApiKey, ApiKeyWithSecret, DEFAULT_VERIFICATION_THRESHOLDS, Project, ProjectBranding, ProjectContext, ProjectEnvironment, ProjectHandoffSettings, ProjectMember, ProjectSettings, ProjectStatus, VerificationThresholds } from "./project.mjs";
+import { ADDRESS_METHODS, AVAILABLE_WORKFLOW_STEP_KEYS, AddressMethod, AddressOnFail, AddressStepConfig, DEFAULT_ADDRESS_CONFIG, DEFAULT_WORKFLOW_CONFIG, WORKFLOW_STEP_KEYS, Workflow, WorkflowConfig, WorkflowOptions, WorkflowStep, WorkflowStepKey, workflowAddressConfig, workflowEnabledSteps, workflowEnables, workflowRunsOcr, workflowScreeningConfig } from "./workflow.mjs";
 import { AddressMethodResult, AddressResultData, AddressVerification, DocumentCapture, DocumentPortrait, DocumentType, FaceMatchCheck, FaceMatchResultData, LivenessCheck, LivenessResultData, OcrAuthenticity, OcrFields, OcrResult, OcrResultData, PostalAddress, SpoofSignals } from "./providers.mjs";
 import { Review, ReviewAction, ReviewNote } from "./review.mjs";
 import { WebhookChecks, WebhookDelivery, WebhookDeliveryStatus, WebhookEndpoint, WebhookEndpointStatus, WebhookEvent, WebhookEventName } from "./webhook.mjs";
@@ -15,4 +17,4 @@ import { ACCESS_CAPABILITIES, ACCESS_CAPABILITY_KEYS, AccessCapability, AccessCa
 import { CreateSessionParams, SdkOptions, SessionResource } from "./sdk.mjs";
 import { WidgetMode, WidgetOptions, WidgetResult, WidgetStep } from "./widget.mjs";
 import { ApiErrorKey } from "./errors.mjs";
-export { ACCESS_CAPABILITIES, ACCESS_CAPABILITY_KEYS, ADDRESS_METHODS, AVAILABLE_WORKFLOW_STEP_KEYS, AccessCapability, AccessCapabilityMeta, AccessGrant, AccessGrantDetails, AccessGrantStatus, ActorType, AddressMethod, AddressMethodResult, AddressOnFail, AddressResultData, AddressStepConfig, AddressVerification, AdminPermission, AdminPermissionGroup, AdminPermissionKey, AdminRoleSlug, AnyPermissionGroup, AnyPermissionKey, ApiErrorKey, ApiKey, ApiKeyWithSecret, AuditLog, CaptureModel, CreateSessionParams, DEFAULT_ADDRESS_CONFIG, DEFAULT_GLOBAL_SETTINGS, DEFAULT_WORKFLOW_CONFIG, DecisionReason, DocumentCapture, DocumentPortrait, DocumentType, Entity, ExtractedAddress, ExtractedData, ExtractedIdentity, FaceMatchCheck, FaceMatchResultData, GlobalSetting, GlobalSettings, Id, InvitationStatus, IsoDate, IsoDateTime, LivenessChallenge, LivenessCheck, LivenessMode, LivenessResultData, MembershipStatus, Metadata, OcrAuthenticity, OcrFields, OcrResult, OcrResultData, Organization, OrganizationInvitation, OrganizationMember, OrganizationScoped, OrganizationSettings, Permission, PermissionGroup, PermissionKey, PiiCategory, PiiTiming, PostalAddress, Project, ProjectBranding, ProjectContext, ProjectEnvironment, ProjectHandoffSettings, ProjectMember, ProjectScoped, ProjectSettings, ProjectStatus, PublicUser, REALTIME_EVENT, RealtimeEventName, RealtimeTransport, Review, ReviewAction, ReviewActionEvent, ReviewNote, Role, RolePermission, SdkOptions, SessionResource, SessionTransitionEvent, SpoofSignals, SystemRoleSlug, Timestamps, User, UserPermission, VerificationDecision, VerificationSession, VerificationStatus, VerificationThresholds, WORKFLOW_STEP_KEYS, WebhookChecks, WebhookDelivery, WebhookDeliveryStatus, WebhookEndpoint, WebhookEndpointStatus, WebhookEvent, WebhookEventName, WidgetMode, WidgetOptions, WidgetResult, WidgetStep, Workflow, WorkflowConfig, WorkflowOptions, WorkflowStep, WorkflowStepKey, parseRealtimeChannel, realtimeChannels, workflowAddressConfig, workflowEnabledSteps, workflowEnables, workflowRunsOcr };
+export { ACCESS_CAPABILITIES, ACCESS_CAPABILITY_KEYS, ADDRESS_METHODS, AVAILABLE_WORKFLOW_STEP_KEYS, AccessCapability, AccessCapabilityMeta, AccessGrant, AccessGrantDetails, AccessGrantStatus, ActorType, AddressMethod, AddressMethodResult, AddressOnFail, AddressResultData, AddressStepConfig, AddressVerification, AdminPermission, AdminPermissionGroup, AdminPermissionKey, AdminRoleSlug, AnyPermissionGroup, AnyPermissionKey, ApiErrorKey, ApiKey, ApiKeyWithSecret, AuditLog, CaptureModel, CreateSessionParams, DEFAULT_ADDRESS_CONFIG, DEFAULT_FACE_EMBEDDING_SETTINGS, DEFAULT_GLOBAL_SETTINGS, DEFAULT_NOTIFICATION_PREFERENCES, DEFAULT_RISK_SIGNAL_POLICY, DEFAULT_SCREENING_CONFIG, DEFAULT_VELOCITY_SETTINGS, DEFAULT_VERIFICATION_THRESHOLDS, DEFAULT_WORKFLOW_CONFIG, DecisionReason, DocumentCapture, DocumentPortrait, DocumentType, Entity, ExtractedAddress, ExtractedData, ExtractedIdentity, FaceEmbeddingSettings, FaceMatchCheck, FaceMatchResultData, GlobalSetting, GlobalSettings, Id, InvitationStatus, IsoDate, IsoDateTime, LivenessChallenge, LivenessCheck, LivenessMode, LivenessResultData, MembershipStatus, Metadata, NOTIFICATION_TYPE, NotificationPreferences, NotificationType, OcrAuthenticity, OcrFields, OcrResult, OcrResultData, Organization, OrganizationInvitation, OrganizationMember, OrganizationScoped, OrganizationSettings, Permission, PermissionGroup, PermissionKey, PiiCategory, PiiTiming, PostalAddress, Project, ProjectBranding, ProjectContext, ProjectEnvironment, ProjectHandoffSettings, ProjectMember, ProjectScoped, ProjectSettings, ProjectStatus, PublicUser, PushPlatform, REALTIME_EVENT, REVIEW_ONLY_RISK_SIGNALS, RISK_SIGNAL_KEYS, RISK_SIGNAL_REASONS, RealtimeEventName, Review, ReviewAction, ReviewActionEvent, ReviewNote, RiskPolicyConfig, RiskSeverity, RiskSignal, RiskSignalKey, RiskSignalPolicy, Role, RolePermission, ScreeningHit, ScreeningHitCategory, ScreeningOnHit, ScreeningStepConfig, SdkOptions, SessionResource, SessionRiskSignal, SessionTransitionEvent, SpoofSignals, SystemRoleSlug, Timestamps, User, UserNotification, UserPermission, VelocitySettings, VerificationDecision, VerificationSession, VerificationStatus, VerificationThresholds, WORKFLOW_STEP_KEYS, WebhookChecks, WebhookDelivery, WebhookDeliveryStatus, WebhookEndpoint, WebhookEndpointStatus, WebhookEvent, WebhookEventName, WebhookRiskCheck, WidgetMode, WidgetOptions, WidgetResult, WidgetStep, Workflow, WorkflowConfig, WorkflowOptions, WorkflowStep, WorkflowStepKey, realtimeChannels, workflowAddressConfig, workflowEnabledSteps, workflowEnables, workflowRunsOcr, workflowScreeningConfig };

package/dist/index.mjs

@@ -1,5 +1,8 @@
 import { DEFAULT_GLOBAL_SETTINGS } from "./settings.mjs";
-import { REALTIME_EVENT, parseRealtimeChannel, realtimeChannels } from "./realtime.mjs";
-import { ADDRESS_METHODS, AVAILABLE_WORKFLOW_STEP_KEYS, DEFAULT_ADDRESS_CONFIG, DEFAULT_WORKFLOW_CONFIG, WORKFLOW_STEP_KEYS, workflowAddressConfig, workflowEnabledSteps, workflowEnables, workflowRunsOcr } from "./workflow.mjs";
+import { REALTIME_EVENT, realtimeChannels } from "./realtime.mjs";
+import { DEFAULT_NOTIFICATION_PREFERENCES, NOTIFICATION_TYPE } from "./notifications.mjs";
+import { DEFAULT_VERIFICATION_THRESHOLDS } from "./project.mjs";
+import { DEFAULT_FACE_EMBEDDING_SETTINGS, DEFAULT_RISK_SIGNAL_POLICY, DEFAULT_SCREENING_CONFIG, DEFAULT_VELOCITY_SETTINGS, REVIEW_ONLY_RISK_SIGNALS, RISK_SIGNAL_KEYS, RISK_SIGNAL_REASONS } from "./risk.mjs";
+import { ADDRESS_METHODS, AVAILABLE_WORKFLOW_STEP_KEYS, DEFAULT_ADDRESS_CONFIG, DEFAULT_WORKFLOW_CONFIG, WORKFLOW_STEP_KEYS, workflowAddressConfig, workflowEnabledSteps, workflowEnables, workflowRunsOcr, workflowScreeningConfig } from "./workflow.mjs";
 import { ACCESS_CAPABILITIES, ACCESS_CAPABILITY_KEYS } from "./access.mjs";
-export { ACCESS_CAPABILITIES, ACCESS_CAPABILITY_KEYS, ADDRESS_METHODS, AVAILABLE_WORKFLOW_STEP_KEYS, DEFAULT_ADDRESS_CONFIG, DEFAULT_GLOBAL_SETTINGS, DEFAULT_WORKFLOW_CONFIG, REALTIME_EVENT, WORKFLOW_STEP_KEYS, parseRealtimeChannel, realtimeChannels, workflowAddressConfig, workflowEnabledSteps, workflowEnables, workflowRunsOcr };
+export { ACCESS_CAPABILITIES, ACCESS_CAPABILITY_KEYS, ADDRESS_METHODS, AVAILABLE_WORKFLOW_STEP_KEYS, DEFAULT_ADDRESS_CONFIG, DEFAULT_FACE_EMBEDDING_SETTINGS, DEFAULT_GLOBAL_SETTINGS, DEFAULT_NOTIFICATION_PREFERENCES, DEFAULT_RISK_SIGNAL_POLICY, DEFAULT_SCREENING_CONFIG, DEFAULT_VELOCITY_SETTINGS, DEFAULT_VERIFICATION_THRESHOLDS, DEFAULT_WORKFLOW_CONFIG, NOTIFICATION_TYPE, REALTIME_EVENT, REVIEW_ONLY_RISK_SIGNALS, RISK_SIGNAL_KEYS, RISK_SIGNAL_REASONS, WORKFLOW_STEP_KEYS, realtimeChannels, workflowAddressConfig, workflowEnabledSteps, workflowEnables, workflowRunsOcr, workflowScreeningConfig };

package/dist/notifications.d.mts

@@ -0,0 +1,41 @@
+import { Id } from "./common.mjs";
+//#region src/notifications.d.ts
+/** Kinds of in-app notification a user can receive. */
+export declare const NOTIFICATION_TYPE: {
+  /** A verification session was assigned to you for review. */
+  readonly reviewAssigned: "review.assigned";
+  /** A verification session in a project you review needs a manual decision. */
+  readonly sessionNeedsReview: "session.requires_review";
+  /** Someone else approved or rejected a session assigned to you. */
+  readonly reviewDecided: "review.decided";
+  /** A webhook endpoint you maintain exhausted its delivery retries. */
+  readonly webhookFailing: "webhook.failing";
+  /** You were invited to join an organization. */
+  readonly invitationReceived: "invitation.received";
+  /** Watchlist screening matched a session in a project you review. */
+  readonly screeningHit: "screening.hit";
+};
+export type NotificationType = (typeof NOTIFICATION_TYPE)[keyof typeof NOTIFICATION_TYPE];
+/** A user's notification delivery preferences. */
+export interface NotificationPreferences {
+  /** Also push notifications to the user's registered devices. */
+  push: boolean;
+}
+export declare const DEFAULT_NOTIFICATION_PREFERENCES: NotificationPreferences;
+/** Platforms a device push token can be registered for. */
+export type PushPlatform = 'ios' | 'android' | 'web';
+/** A stored in-app notification, as the API returns it. */
+export interface UserNotification {
+  id: Id;
+  type: NotificationType | string | null;
+  title: string;
+  description: string;
+  action_text: string | null;
+  /** A dashboard path, e.g. `/o/acme/sessions/<id>`. */
+  action_link: string | null;
+  meta: Record<string, unknown> | null;
+  read_at: string | null;
+  created_at: string;
+}
+//#endregion
+//# sourceMappingURL=notifications.d.mts.map

package/dist/notifications.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"notifications.d.mts","names":[],"sources":["../src/notifications.ts"],"mappings":";;;qBAGa;;;;;;;;;;;;;;YAeD,2BAA2B,gCAAgC;;iBAGtD;;EAEf;;qBAGW,kCAAkC;;YAKnC;;iBAGK;EACf,IAAI;EACJ,MAAM;EACN;EACA;EACA;;EAEA;EACA,MAAM;EACN;EACA"}

package/dist/notifications.mjs

@@ -0,0 +1,21 @@
+//#region src/notifications.ts
+/** Kinds of in-app notification a user can receive. */
+const NOTIFICATION_TYPE = {
+	/** A verification session was assigned to you for review. */
+	reviewAssigned: "review.assigned",
+	/** A verification session in a project you review needs a manual decision. */
+	sessionNeedsReview: "session.requires_review",
+	/** Someone else approved or rejected a session assigned to you. */
+	reviewDecided: "review.decided",
+	/** A webhook endpoint you maintain exhausted its delivery retries. */
+	webhookFailing: "webhook.failing",
+	/** You were invited to join an organization. */
+	invitationReceived: "invitation.received",
+	/** Watchlist screening matched a session in a project you review. */
+	screeningHit: "screening.hit"
+};
+const DEFAULT_NOTIFICATION_PREFERENCES = { push: true };
+//#endregion
+export { DEFAULT_NOTIFICATION_PREFERENCES, NOTIFICATION_TYPE };
+
+//# sourceMappingURL=notifications.mjs.map

package/dist/notifications.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"notifications.mjs","names":[],"sources":["../src/notifications.ts"],"sourcesContent":["import type { Id } from './common'\n\n/** Kinds of in-app notification a user can receive. */\nexport const NOTIFICATION_TYPE = {\n  /** A verification session was assigned to you for review. */\n  reviewAssigned: 'review.assigned',\n  /** A verification session in a project you review needs a manual decision. */\n  sessionNeedsReview: 'session.requires_review',\n  /** Someone else approved or rejected a session assigned to you. */\n  reviewDecided: 'review.decided',\n  /** A webhook endpoint you maintain exhausted its delivery retries. */\n  webhookFailing: 'webhook.failing',\n  /** You were invited to join an organization. */\n  invitationReceived: 'invitation.received',\n  /** Watchlist screening matched a session in a project you review. */\n  screeningHit: 'screening.hit',\n} as const\n\nexport type NotificationType = (typeof NOTIFICATION_TYPE)[keyof typeof NOTIFICATION_TYPE]\n\n/** A user's notification delivery preferences. */\nexport interface NotificationPreferences {\n  /** Also push notifications to the user's registered devices. */\n  push: boolean\n}\n\nexport const DEFAULT_NOTIFICATION_PREFERENCES: NotificationPreferences = {\n  push: true,\n}\n\n/** Platforms a device push token can be registered for. */\nexport type PushPlatform = 'ios' | 'android' | 'web'\n\n/** A stored in-app notification, as the API returns it. */\nexport interface UserNotification {\n  id: Id\n  type: NotificationType | string | null\n  title: string\n  description: string\n  action_text: string | null\n  /** A dashboard path, e.g. `/o/acme/sessions/<id>`. */\n  action_link: string | null\n  meta: Record<string, unknown> | null\n  read_at: string | null\n  created_at: string\n}\n"],"mappings":";;AAGA,MAAa,oBAAoB;;CAE/B,gBAAgB;;CAEhB,oBAAoB;;CAEpB,eAAe;;CAEf,gBAAgB;;CAEhB,oBAAoB;;CAEpB,cAAc;AAChB;AAUA,MAAa,mCAA4D,EACvE,MAAM,KACR"}

package/dist/organization.d.mts

@@ -1,34 +1,36 @@
 import { Entity, Id, IsoDateTime, Metadata, OrganizationScoped } from "./common.mjs";
-
+import { FaceEmbeddingSettings } from "./risk.mjs";
 //#region src/organization.d.ts
 /** Membership lifecycle states for organization/project members. */
-type MembershipStatus = 'active' | 'invited' | 'suspended';
+export type MembershipStatus = 'active' | 'invited' | 'suspended';
 /** Invitation lifecycle states. */
-type InvitationStatus = 'pending' | 'accepted' | 'expired' | 'revoked';
+export type InvitationStatus = 'pending' | 'accepted' | 'expired' | 'revoked';
 /**
  * An organization, business, or workspace using Arkyc. An organization owns projects,
  * members, roles, API keys, sessions, webhooks, and audit logs.
  */
-interface Organization extends Entity {
+export interface Organization extends Entity {
   name: string;
   slug: string;
   logo_url: string | null;
   settings: OrganizationSettings;
 }
 /** Organization-level configuration (free-form, with known optional keys). */
-interface OrganizationSettings extends Metadata {
+export interface OrganizationSettings extends Metadata {
   /** Days to retain verification media before cleanup (Phase 15). */
   retention_days?: number;
+  /** Store face embeddings to catch one face behind several identities. Off by default. */
+  face_embeddings?: Partial<FaceEmbeddingSettings>;
 }
 /** Links a {@link User} to a {@link Organization} with a role. */
-interface OrganizationMember extends Entity, OrganizationScoped {
+export interface OrganizationMember extends Entity, OrganizationScoped {
   user_id: Id;
   role_id: Id;
   status: MembershipStatus;
   joined_at: IsoDateTime | null;
 }
 /** A pending invitation to join an organization with a given role. */
-interface OrganizationInvitation extends Entity, OrganizationScoped {
+export interface OrganizationInvitation extends Entity, OrganizationScoped {
   email: string;
   role_id: Id;
   /** Hash of the single-use invitation token; the raw token is emailed once. */
@@ -37,5 +39,4 @@ interface OrganizationInvitation extends Entity, OrganizationScoped {
   accepted_at: IsoDateTime | null;
 }
 //#endregion
-export { InvitationStatus, MembershipStatus, Organization, OrganizationInvitation, OrganizationMember, OrganizationSettings };
 //# sourceMappingURL=organization.d.mts.map

package/dist/organization.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"organization.d.mts","names":[],"sources":["../src/organization.ts"],"mappings":";;;;KAGY,gBAAA;AAAZ;AAAA,KAGY,gBAAA;;;AAHgB;AAG5B;UAMiB,YAAA,SAAqB,MAAM;EAC1C,IAAA;EACA,IAAA;EACA,QAAA;EACA,QAAA,EAAU,oBAAA;AAAA;;UAIK,oBAAA,SAA6B,QAAQ;EARhB;EAUpC,cAAc;AAAA;;UAIC,kBAAA,SAA2B,MAAA,EAAQ,kBAAA;EAClD,OAAA,EAAS,EAAA;EACT,OAAA,EAAS,EAAA;EACT,MAAA,EAAQ,gBAAA;EACR,SAAA,EAAW,WAAA;AAAA;;UAII,sBAAA,SAA+B,MAAA,EAAQ,kBAAA;EACtD,KAAA;EACA,OAAA,EAAS,EAAA;EAVyB;EAYlC,UAAA;EACA,UAAA,EAAY,WAAA;EACZ,WAAA,EAAa,WAAA;AAAA"}
+{"version":3,"file":"organization.d.mts","names":[],"sources":["../src/organization.ts"],"mappings":";;;;YAIY;;YAGA;;;;;iBAMK,qBAAqB;EACpC;EACA;EACA;EACA,UAAU;;;iBAIK,6BAA6B;;EAE5C;;EAEA,kBAAkB,QAAQ;;;iBAIX,2BAA2B,QAAQ;EAClD,SAAS;EACT,SAAS;EACT,QAAQ;EACR,WAAW;;;iBAII,+BAA+B,QAAQ;EACtD;EACA,SAAS;;EAET;EACA,YAAY;EACZ,aAAa"}

package/dist/project.d.mts

@@ -1,17 +1,17 @@
 import { Entity, Id, IsoDateTime, Metadata, OrganizationScoped, ProjectScoped } from "./common.mjs";
+import { VelocitySettings } from "./risk.mjs";
 import { MembershipStatus } from "./organization.mjs";
 import { CaptureModel } from "./settings.mjs";
-
 //#region src/project.d.ts
 /** Deployment environment for a project. */
-type ProjectEnvironment = 'production' | 'staging' | 'development';
+export type ProjectEnvironment = 'production' | 'staging' | 'development';
 /** Project lifecycle status. */
-type ProjectStatus = 'active' | 'paused' | 'archived';
+export type ProjectStatus = 'active' | 'paused' | 'archived';
 /**
  * Per-project, configurable thresholds the decision engine compares scores
- * against. Defaults live in `@arkyc/core`; projects may override any subset.
+ * against. Projects may override any subset of {@link DEFAULT_VERIFICATION_THRESHOLDS}.
  */
-interface VerificationThresholds {
+export interface VerificationThresholds {
   documentQualityThreshold: number;
   ocrConfidenceThreshold: number;
   livenessThreshold: number;
@@ -19,9 +19,16 @@ interface VerificationThresholds {
   /** Minimum address-verification confidence before flagging for review. */
   addressThreshold: number;
 }
+/** Platform default verification thresholds. */
+export declare const DEFAULT_VERIFICATION_THRESHOLDS: VerificationThresholds;
 /** Visual branding applied to the widget for a project. */
-interface ProjectBranding {
+export interface ProjectBranding {
   logo_url?: string | null;
+  /**
+   * Storage object key of an uploaded logo. Server-side only: the API resolves
+   * it to a (signed, when the disk is private) `logo_url` in every response.
+   */
+  logo_key?: string | null;
   primary_color?: string;
   border_radius?: number;
   theme?: 'light' | 'dark';
@@ -38,7 +45,7 @@ interface ProjectBranding {
  * their phone by scanning a QR code.
  * The QR is shown first on desktop.
  */
-interface ProjectHandoffSettings {
+export interface ProjectHandoffSettings {
   /** Whether desktop users are offered the QR handoff to their phone. */
   enabled?: boolean;
   /**
@@ -48,7 +55,7 @@ interface ProjectHandoffSettings {
   allow_desktop?: boolean;
 }
 /** Project-level configuration. */
-interface ProjectSettings extends Metadata {
+export interface ProjectSettings extends Metadata {
   thresholds?: Partial<VerificationThresholds>;
   allowed_origins?: string[];
   /** Maximum verification attempts before a session is hard-failed. */
@@ -57,12 +64,14 @@ interface ProjectSettings extends Metadata {
   capture_model?: CaptureModel;
   /** Cross-device session handoff (QR). Off unless the project opts in. */
   handoff?: ProjectHandoffSettings;
+  /** Repeat-session limits per network address (`VELOCITY_EXCEEDED`). */
+  velocity?: Partial<VelocitySettings>;
 }
 /**
  * A specific application, environment, or product integration owned by a
  * organization. Sessions, API keys, and webhooks are scoped to a project.
  */
-interface Project extends Entity, OrganizationScoped {
+export interface Project extends Entity, OrganizationScoped {
   name: string;
   slug: string;
   environment: ProjectEnvironment;
@@ -72,7 +81,7 @@ interface Project extends Entity, OrganizationScoped {
   has_ai_grant?: boolean;
 }
 /** Links a user to a project with a role (narrower tha organization membership). */
-interface ProjectMember extends Entity, ProjectScoped {
+export interface ProjectMember extends Entity, ProjectScoped {
   user_id: Id;
   role_id: Id;
   status: MembershipStatus;
@@ -81,7 +90,7 @@ interface ProjectMember extends Entity, ProjectScoped {
  * A project API key. Only `key_prefix` is stored in clear; the secret is hashed
  * (`key_hash`) and shown to the integrator exactly once at creation.
  */
-interface ApiKey extends Entity, ProjectScoped {
+export interface ApiKey extends Entity, ProjectScoped {
   name: string;
   key_prefix: string;
   key_hash: string;
@@ -90,17 +99,16 @@ interface ApiKey extends Entity, ProjectScoped {
   revoked_at: IsoDateTime | null;
 }
 /** An API key plus its one-time-visible secret, returned only at creation. */
-interface ApiKeyWithSecret {
+export interface ApiKeyWithSecret {
   api_key: ApiKey;
   /** The full secret key, e.g. `sk_live_…`. Never persisted in clear. */
   secret: string;
 }
 /** Resolves the organization + project + (optionally) acting user for a request. */
-interface ProjectContext {
+export interface ProjectContext {
   organization_id: Id;
   project_id: Id;
   api_key_id?: Id;
 }
 //#endregion
-export { ApiKey, ApiKeyWithSecret, Project, ProjectBranding, ProjectContext, ProjectEnvironment, ProjectHandoffSettings, ProjectMember, ProjectSettings, ProjectStatus, VerificationThresholds };
 //# sourceMappingURL=project.d.mts.map

package/dist/project.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"project.d.mts","names":[],"sources":["../src/project.ts"],"mappings":";;;;;;KAMY,kBAAA;AAAZ;AAAA,KAGY,aAAA;;;AAHkB;AAG9B;UAMiB,sBAAA;EACf,wBAAA;EACA,sBAAA;EACA,iBAAA;EACA,kBAAA;EAJqC;EAMrC,gBAAA;AAAA;;UAIe,eAAA;EACf,QAAA;EACA,aAAA;EACA,aAAA;EACA,KAAA;EARgB;EAUhB,IAAA;EAN8B;;;;EAW9B,aAAA;AAAA;;;;;AAAa;UAQE,sBAAA;EAAsB;EAErC,OAAA;EAAA;AAKa;AAIf;;EAJE,aAAa;AAAA;;UAIE,eAAA,SAAwB,QAAA;EACvC,UAAA,GAAa,OAAA,CAAQ,sBAAA;EACrB,eAAA;EAF+C;EAI/C,WAAA;EAJuC;EAMvC,aAAA,GAAgB,YAAA;EALH;EAOb,OAAA,GAAU,sBAAA;AAAA;;;;;UAOK,OAAA,SAAgB,MAAA,EAAQ,kBAAA;EACvC,IAAA;EACA,IAAA;EACA,WAAA,EAAa,kBAAA;EACb,QAAA,EAAU,eAAA;EACV,QAAA,EAAU,eAAA;EACV,MAAA,EAAQ,aAAA;EACR,YAAA;AAAA;;UAIe,aAAA,SAAsB,MAAA,EAAQ,aAAA;EAC7C,OAAA,EAAS,EAAA;EACT,OAAA,EAAS,EAAA;EACT,MAAA,EAAQ,gBAAA;AAAA;;;;;UAOO,MAAA,SAAe,MAAA,EAAQ,aAAA;EACtC,IAAA;EACA,UAAA;EACA,QAAA;EACA,YAAA,EAAc,WAAA;EACd,UAAA,EAAY,WAAA;EACZ,UAAA,EAAY,WAAA;AAAA;;UAIG,gBAAA;EACf,OAAA,EAAS,MAAM;EArBc;EAuB7B,MAAA;AAAA;;UAIe,cAAA;EACf,eAAA,EAAiB,EAAA;EACjB,UAAA,EAAY,EAAA;EACZ,UAAA,GAAa,EAAA;AAAA"}
+{"version":3,"file":"project.d.mts","names":[],"sources":["../src/project.ts"],"mappings":";;;;;;YAOY;;YAGA;;;;;iBAMK;EACf;EACA;EACA;EACA;;EAEA;;;qBAIW,iCAAiC;;iBAS7B;EACf;;;;;EAKA;EACA;EACA;EACA;;EAEA;;;;;EAKA;;;;;;;iBAQe;;EAEf;;;;;EAKA;;;iBAIe,wBAAwB;EACvC,aAAa,QAAQ;EACrB;;EAEA;;EAEA,gBAAgB;;EAEhB,UAAU;;EAEV,WAAW,QAAQ;;;;;;iBAOJ,gBAAgB,QAAQ;EACvC;EACA;EACA,aAAa;EACb,UAAU;EACV,UAAU;EACV,QAAQ;EACR;;;iBAIe,sBAAsB,QAAQ;EAC7C,SAAS;EACT,SAAS;EACT,QAAQ;;;;;;iBAOO,eAAe,QAAQ;EACtC;EACA;EACA;EACA,cAAc;EACd,YAAY;EACZ,YAAY;;;iBAIG;EACf,SAAS;;EAET;;;iBAIe;EACf,iBAAiB;EACjB,YAAY;EACZ,aAAa"}

package/dist/project.mjs

@@ -0,0 +1,13 @@
+//#region src/project.ts
+/** Platform default verification thresholds. */
+const DEFAULT_VERIFICATION_THRESHOLDS = {
+	documentQualityThreshold: .75,
+	ocrConfidenceThreshold: .8,
+	livenessThreshold: .85,
+	faceMatchThreshold: .75,
+	addressThreshold: .6
+};
+//#endregion
+export { DEFAULT_VERIFICATION_THRESHOLDS };
+
+//# sourceMappingURL=project.mjs.map

package/dist/project.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"project.mjs","names":[],"sources":["../src/project.ts"],"sourcesContent":["import type { Entity, Id, IsoDateTime, Metadata, OrganizationScoped, ProjectScoped } from './common'\n\nimport type { VelocitySettings } from './risk'\nimport type { CaptureModel } from './settings'\nimport type { MembershipStatus } from './organization'\n\n/** Deployment environment for a project. */\nexport type ProjectEnvironment = 'production' | 'staging' | 'development'\n\n/** Project lifecycle status. */\nexport type ProjectStatus = 'active' | 'paused' | 'archived'\n\n/**\n * Per-project, configurable thresholds the decision engine compares scores\n * against. Projects may override any subset of {@link DEFAULT_VERIFICATION_THRESHOLDS}.\n */\nexport interface VerificationThresholds {\n  documentQualityThreshold: number\n  ocrConfidenceThreshold: number\n  livenessThreshold: number\n  faceMatchThreshold: number\n  /** Minimum address-verification confidence before flagging for review. */\n  addressThreshold: number\n}\n\n/** Platform default verification thresholds. */\nexport const DEFAULT_VERIFICATION_THRESHOLDS: VerificationThresholds = {\n  documentQualityThreshold: 0.75,\n  ocrConfidenceThreshold: 0.8,\n  livenessThreshold: 0.85,\n  faceMatchThreshold: 0.75,\n  addressThreshold: 0.6,\n}\n\n/** Visual branding applied to the widget for a project. */\nexport interface ProjectBranding {\n  logo_url?: string | null\n  /**\n   * Storage object key of an uploaded logo. Server-side only: the API resolves\n   * it to a (signed, when the disk is private) `logo_url` in every response.\n   */\n  logo_key?: string | null\n  primary_color?: string\n  border_radius?: number\n  theme?: 'light' | 'dark'\n  /** Display name (company/product) shown in the widget header. */\n  name?: string | null\n  /**\n   * Whether to show the project's name/logo in the widget header. Defaults to\n   * shown; set `false` for an unbranded (white-label) header.\n   */\n  show_branding?: boolean\n}\n\n/**\n * Cross-device handoff: a desktop user continues an in-progress verification on\n * their phone by scanning a QR code.\n * The QR is shown first on desktop.\n */\nexport interface ProjectHandoffSettings {\n  /** Whether desktop users are offered the QR handoff to their phone. */\n  enabled?: boolean\n  /**\n   * Whether a desktop user may instead continue on the desktop device. When\n   * `false`, a desktop user must scan to a phone (no \"continue here\"). Defaults true.\n   */\n  allow_desktop?: boolean\n}\n\n/** Project-level configuration. */\nexport interface ProjectSettings extends Metadata {\n  thresholds?: Partial<VerificationThresholds>\n  allowed_origins?: string[]\n  /** Maximum verification attempts before a session is hard-failed. */\n  max_retries?: number\n  /** Overrides the global capture model for this project (Phase 17). */\n  capture_model?: CaptureModel\n  /** Cross-device session handoff (QR). Off unless the project opts in. */\n  handoff?: ProjectHandoffSettings\n  /** Repeat-session limits per network address (`VELOCITY_EXCEEDED`). */\n  velocity?: Partial<VelocitySettings>\n}\n\n/**\n * A specific application, environment, or product integration owned by a\n * organization. Sessions, API keys, and webhooks are scoped to a project.\n */\nexport interface Project extends Entity, OrganizationScoped {\n  name: string\n  slug: string\n  environment: ProjectEnvironment\n  settings: ProjectSettings\n  branding: ProjectBranding\n  status: ProjectStatus\n  has_ai_grant?: boolean\n}\n\n/** Links a user to a project with a role (narrower tha organization membership). */\nexport interface ProjectMember extends Entity, ProjectScoped {\n  user_id: Id\n  role_id: Id\n  status: MembershipStatus\n}\n\n/**\n * A project API key. Only `key_prefix` is stored in clear; the secret is hashed\n * (`key_hash`) and shown to the integrator exactly once at creation.\n */\nexport interface ApiKey extends Entity, ProjectScoped {\n  name: string\n  key_prefix: string\n  key_hash: string\n  last_used_at: IsoDateTime | null\n  expires_at: IsoDateTime | null\n  revoked_at: IsoDateTime | null\n}\n\n/** An API key plus its one-time-visible secret, returned only at creation. */\nexport interface ApiKeyWithSecret {\n  api_key: ApiKey\n  /** The full secret key, e.g. `sk_live_…`. Never persisted in clear. */\n  secret: string\n}\n\n/** Resolves the organization + project + (optionally) acting user for a request. */\nexport interface ProjectContext {\n  organization_id: Id\n  project_id: Id\n  api_key_id?: Id\n}\n"],"mappings":";;AA0BA,MAAa,kCAA0D;CACrE,0BAA0B;CAC1B,wBAAwB;CACxB,mBAAmB;CACnB,oBAAoB;CACpB,kBAAkB;AACpB"}