@dossier-wiki/os-sdk 1.3.1-staging.1.1 → 1.3.1-staging.3.1

package/README.md

@@ -54,7 +54,7 @@ The service composes resource namespaces — call them off the root client:
 | `os.channelEndpoints` | Read and manage POS terminal, page, API client, and other endpoint identities resolved during ingestion |
 | `os.individuals` | Individual customers + nested `identificationDocuments`, `faceImages` |
 | `os.entities` | Entity customers + nested `stakeholders` |
-| `os.customers` | Cross-cutting per-customer: `notes`, `files`, `screening`, `riskRating`, `riskAssessments`, `expectedActivity`, `devices`, `assignment` (assign / unassign / assignMany) |
+| `os.customers` | Cross-cutting per-customer: `notes`, `files`, `screening`, `kyc` (start, review, PDF report, evidence ZIP), `riskRating` (set an officer override / `clearOverride`), `riskAssessments` (list, submit a questionnaire, `evaluate` the risk matrix now), `expectedActivity`, `devices`, `assignment` (assign / unassign / assignMany) |
 | `os.teams` | Domain teams: list/get/create/update/archive/delete, plus `addMembers` / `removeMembers`. Teams carry catalogue-governed `team.tags`, and `list({ tags })` filters on them |
 | `os.accounts` | Per-customer accounts, including `freeze` / `unfreeze` |
 | `os.counterparties` | Counterparties + nested `riskAssessments`, `files` |
@@ -71,7 +71,7 @@ The service composes resource namespaces — call them off the root client:
 | `os.exchangeRates` | Push exchange rates |
 | `os.states` | Read and atomically set, increment, or decrement resource state; read immutable change history |
 | `os.alerts` | Raise alerts by hand (`create` — free-form, or against an optional custom alert type; org-scoped `externalRequestId` idempotency), read any alert (`get`), edit markdown `notes` (`updateNotes`), link records (`resources.list/add/remove`), plus `comments` and `attemptEvidence`. Needs the `alerts:read` / `alerts:write` API-key permissions |
-| `os.config` | `rules` (incl. `rules.backtest` — dry-run simulation over historical or synthetic transactions), `constants`, `states`, `alertWorkflows` (one per alert type — `SCREENING`, `RULE_TRIGGER`, `CUSTOM`: list/get/save), `assignmentPolicies` (read-only legacy archive), `products`, `currencies`, `eventDefinitions`, `customAlertTypes` (org-defined alert types with a typed-field schema), `webhooks`, `tagCatalogue`, `sync`, plus org-wide `reset` |
+| `os.config` | `rules` (incl. `rules.backtest` — dry-run simulation over historical or synthetic transactions), `constants`, `states`, `alertWorkflows` (one per alert type — `SCREENING`, `RULE_TRIGGER`, `CUSTOM`: list/get/save), `assignmentPolicies` (read-only legacy archive), `products`, `profileTemplates` (the template a customer is created against: profile fields, risk matrix, KYC workflows, creation-form setup), `currencies`, `eventDefinitions`, `customAlertTypes` (org-defined alert types with a typed-field schema), `webhooks`, `tagCatalogue`, `sync`, plus org-wide `reset` |
 | `os.setup` | Org setup status + initialization |
 | `os.settings` | Sync snapshots + drift |
 | `os.reports` | On-demand PDF reports: `alert`, `customerProfile`, `counterpartyProfile`, `resourceProfile` — each resolves to the PDF bytes (`Uint8Array`); needs the `report:read` grant |
@@ -381,10 +381,270 @@ Migration:
 - Use `status` for the initial customer lifecycle state. New records default to
   `ONBOARDING`; `monitoringStatus` and `riskRating` are not create inputs.
 
+## Profile templates & risk matrix
+
+A **Profile Template** is to a customer what a **Product** is to an account:
+the template it is created against. It declares the customer's typed
+**profile fields** (`fieldConfig`, the same `TypedFieldDefinition` shape as
+`Product.accountFieldConfig`), a **risk matrix** that computes the customer's
+risk rating from those fields, KYC workflow bindings, and the **creation
+setup** of the simple Add Individual / Add Entity forms. Templates live under
+`os.config.profileTemplates` and need `config:read` / `config:write`.
+
+```ts
+// 1. Define a template (once, or via Tenant Sync).
+await os.config.profileTemplates.create({
+    key: 'individual-standard',            // immutable; connectors use it instead of a UUID
+    name: 'Individual — standard onboarding',
+    partyType: 'INDIVIDUAL',
+    isDefault: true,                       // new individuals get it when no key is sent
+    fieldConfig: [
+        { key: 'pepStatus', displayName: 'PEP status', type: 'SINGLE_SELECT', required: false,
+          options: ['No PEP involvement', 'Former PEP', 'Domestic PEP'] },
+        { key: 'onboardingChannel', displayName: 'Onboarding channel', type: 'SINGLE_SELECT', required: false,
+          options: ['Face to face', 'Non face to face'] },
+    ],
+    riskMatrix: {
+        scale: [{ level: 'LOW', score: 1 }, { level: 'MEDIUM', score: 2 }, { level: 'HIGH', score: 3 }],
+        bands: [{ rating: 'LOW', below: 1.67 }, { rating: 'MEDIUM', below: 2.34 }, { rating: 'HIGH' }],
+        factors: [
+            { key: 'pepStatus', label: 'PEP status', weight: 0.6, field: 'pepStatus', levels: [
+                { option: 'No PEP involvement', level: 'LOW' },
+                { option: 'Former PEP', level: 'MEDIUM' },
+                { option: 'Domestic PEP', level: 'HIGH' },
+            ] },
+            { key: 'channel', label: 'Onboarding channel', weight: 0.4, field: 'onboardingChannel', levels: [
+                { option: 'Face to face', level: 'LOW' },
+                { option: 'Non face to face', level: 'HIGH' },
+            ] },
+        ],
+        escalations: [
+            { label: 'PEP involvement', minimumRating: 'HIGH',
+              when: { field: 'factor.pepStatus.level', operator: '=', value: 'HIGH' } },
+        ],
+        outcomes: [
+            { rating: 'LOW', requiredDueDiligence: 'SDD', reviewEveryMonths: 36 },
+            { rating: 'MEDIUM', requiredDueDiligence: 'CDD', reviewEveryMonths: 24 },
+            { rating: 'HIGH', requiredDueDiligence: 'EDD', reviewEveryMonths: 12 },
+        ],
+    },
+});
+
+// 2. Create a customer with profile fields (Tier A: validated against the template).
+const customer = await os.individuals.create({
+    externalId: 'USR-10044',
+    fullName: 'Nadia Perera',
+    profileTemplateKey: 'individual-standard', // optional here: it is the default
+    fields: [
+        { key: 'pepStatus', type: 'SINGLE_SELECT', value: 'No PEP involvement' },
+        { key: 'onboardingChannel', type: 'SINGLE_SELECT', value: 'Non face to face' },
+    ],
+});
+
+// 3. Read the rating. The matrix runs in the background (a few seconds after
+//    the last profile write, plus a daily sweep). `evaluate` runs it now.
+const assessment = await os.customers.riskAssessments.evaluate(customer.id);
+assessment.resultingRiskRating;   // 'MEDIUM'  (0.6 × 1 + 0.4 × 3 = 1.8)
+assessment.compositeScore;        // 1.8 — intermediate number, not the rating
+assessment.breakdown?.factors;    // input → criterion → level → score → weighted, per factor
+assessment.requiredDueDiligence;  // 'CDD'
+assessment.nextReviewAt;          // 'YYYY-MM-DD'
+
+const latest = await os.individuals.get(customer.id);
+latest.riskRating;                // 'MEDIUM'
+latest.riskRatingSource;          // 'MATRIX'
+latest.fields;                    // [{ key: 'pepStatus', type: 'SINGLE_SELECT', value: 'No PEP involvement' }, …]
+```
+
+How factors score: each factor has a **weight** (weights sum to 1) and turns
+one profile field into points, which the weight scales into the composite.
+Select fields give each option a level (`levels`), optionally with its own
+`score` — points per selection, overriding the level's scale score while the
+level still drives display and escalations. **Yes/no** (BOOLEAN) fields use
+the options `"true"` and `"false"`. **Number and money** fields use `ranges`
+(`{ min, max, level, score? }`, min inclusive, max exclusive, either end open,
+no overlaps; money compares in major units of the field's currency). A
+**multi-select** scores the selected option with the highest score. Anything
+else uses explicit `criteria` condition trees.
+
+```ts
+{ key: 'expectedMonthly', label: 'Expected monthly investment', weight: 0.1,
+  field: 'expectedMonthlyInvestment', ranges: [   // a MONETARY field
+    { max: 100_000, level: 'LOW' },
+    { min: 100_000, max: 1_000_000, level: 'MEDIUM' },
+    { min: 1_000_000, level: 'HIGH', score: 4 },  // own points instead of HIGH's scale score
+] }
+```
+
+How it behaves:
+
+- **Updates merge.** `individuals.update` / `entities.update` accept `fields`:
+  listed keys change, `{ key, type, value: null }` clears a field, unlisted
+  keys stay. Pass `profileTemplateKey` to switch template (same party type).
+  Each profile write re-scores the customer (bursts are coalesced), so a CRM
+  pushing its daily delta with `PATCH` gets a fresh rating within seconds.
+- **Officer overrides are sticky.** `customers.riskRating.update` sets
+  `riskRatingSource: 'MANUAL'`. Matrix runs still record their computed rating
+  (`customers.riskAssessments.list`, `method: 'MATRIX'`) but never overwrite a
+  MANUAL rating. `customers.riskRating.clearOverride(customerId)` hands the
+  rating back to the matrix and resolves to the latest matrix assessment.
+- **Assessments share one list.** `customers.riskAssessments.list` returns
+  questionnaires (`method: 'QUESTIONNAIRE'`) and matrix runs (`method:
+  'MATRIX'`, with `compositeScore`, `breakdown`, `profileTemplateVersion`,
+  `trigger`, `requiredDueDiligence`, `nextReviewAt`). A matrix run is written
+  only when its inputs or outcome change.
+- **Webhooks.** When the matrix changes a rating, `customer.risk_changed` is
+  delivered with `source: 'risk_matrix'`, `previousRating`, `newRating`,
+  `compositeScore`, `requiredDueDiligence` and `riskAssessmentId`.
+- **Templates are versioned.** Changing `fieldConfig`, `riskMatrix`,
+  `kycWorkflows` or the creation setup publishes a new version
+  (`profileTemplates.versions(id)`); `fieldConfig` / `riskMatrix` changes also
+  re-assess every customer on the template. `archive(id)` stops new customers
+  using it; existing customers keep it.
+- **Creation setup.** `individualCreation` (`INDIVIDUAL` templates) or
+  `entityCreation` (`ENTITY` templates) configures the simple Add Individual /
+  Add Entity form for the template: on/off and open-by-default, external-ID
+  strategy, presets (tags + assignees), and the document or registration
+  types offered. The other party type's field is always `null` on responses
+  and a 400 on writes. A template created without one copies the org's
+  current Simple Customer Creation preference; on `update`, a value fully
+  replaces the setup and `null` clears it (the org-wide preference then
+  applies). Read shape: `SimpleCustomerCreationPreferences` /
+  `SimpleEntityCreationPreferences`; write shape:
+  `UpdateSimpleCustomerCreationPreferencesInput` /
+  `UpdateSimpleEntityCreationPreferencesInput`.
+
+  ```ts
+  await os.config.profileTemplates.update(templateId, {
+      individualCreation: {
+          enabled: true,
+          openByDefault: true,
+          externalIdStrategy: 'DOCUMENT',
+          documentTypes: [{ label: 'NIC (Sri Lanka)', type: 'NATIONAL_ID', country: 'LKA' }],
+          presets: [{ label: 'General Insurance', tags: [{ label: 'General Insurance' }],
+                      assignedToUserIds: [], assignedToTeamIds: [giTeamId] }],
+          allowTags: false,
+          allowAssignment: false,
+      },
+  });
+  ```
+- Profile fields are **not** readable by rules. Promote a value to a
+  `$customer.*` constant if a rule needs it.
+
+### Derived inputs
+
+A factor can read a value the platform derives itself instead of a profile
+field, by setting `input` instead of `field` (`RiskMatrixDerivedInput`).
+Nobody has to push these as picklist answers, and they re-score on their own
+when the underlying data changes:
+
+| `input` | Value | Score it with |
+|---|---|---|
+| `customer.nationality` | ISO-3 codes: an individual's nationalities, an entity's country of incorporation | `levels` per code, or `criteria` against a `$global.*` country list |
+| `customer.productKeys` | Product keys (`syncKey`, else `externalId`) of the customer's accounts that are not closed | `levels` per product key |
+| `customer.expectedMonthlyVolume` | The expected activity profile's monthly volume | `ranges` |
+
+When a customer holds several values of a list input, the riskiest scores.
+
+```ts
+{ key: 'citizenship', label: 'Citizenship', weight: 0.05, input: 'customer.nationality', whenUnmatched: 'HIGH',
+  criteria: [
+    { label: 'FATF grey/black list', level: 'HIGH',
+      when: { field: 'customer.nationality', operator: 'IN', value: '$global.fatfGreyBlackCountries' } },
+    { label: 'Any other nationality', level: 'LOW',
+      when: { field: 'customer.nationality', operator: 'IS_NOT_EMPTY', value: '' } },
+  ] }
+```
+
+Updating the `$global.fatfGreyBlackCountries` constant re-scores everyone in
+the next daily sweep. Changes to the expected activity profile re-score at once;
+accounts opened or closed are picked up by the daily sweep.
+
+### Dry runs: preview and impact
+
+Score an unsaved matrix without saving it. The draft is validated exactly as a
+save would be (400 lists every problem), and both calls compare it with the
+template's saved matrix evaluated on the same inputs.
+
+```ts
+// One customer, draft next to the saved matrix
+const preview = await os.config.profileTemplates.previewRiskMatrix({
+    customerId, fieldConfig: draft.fieldConfig, riskMatrix: draft.riskMatrix,
+});
+preview.published?.finalRating; // 'HIGH'
+preview.draft.finalRating;      // 'MEDIUM'
+
+// Every live customer on the template
+const impact = await os.config.profileTemplates.riskMatrixImpact(templateId, {
+    fieldConfig: draft.fieldConfig, riskMatrix: draft.riskMatrix,
+});
+impact.changed;    // customers whose rating would move
+impact.movements;  // [{ from: 'LOW', to: 'MEDIUM', count: 312 }, ...]
+impact.customers;  // who moves, rises before falls, biggest change first (at most 100)
+```
+
+Customers with an officer override are counted in `overriddenChanged`; their
+rating would not move. Up to 5,000 customers are scored per call (`truncated`
+says when there were more).
+
+### KYC output mappings
+
+A template's KYC binding can write a verified session's answers back to the
+customer. Each mapping reads one session value and writes it to a profile field
+(`fields.<key>`) or a customer-level constant (`$customer.<name>`). Constants
+are the way to make a KYC answer readable by rules; profile fields never are.
+
+```ts
+await os.config.profileTemplates.update(templateId, {
+    kycWorkflows: [{
+        purpose: 'ONBOARDING',
+        providerConfigId,
+        workflowId: 'wf_onboarding',
+        mappings: [
+            { source: 'form.occupation', target: 'fields.occupation',
+              valueMap: [{ from: 'Software engineer', to: 'IT / Software Professional' }] },
+            { source: 'session.verified', target: 'fields.onboardingChannel',
+              valueMap: [{ from: 'true', to: 'Non Face to Face Clients' }], mode: 'OVERWRITE' },
+            { source: 'person.nationality', target: '$customer.kycNationalities' },
+        ],
+    }],
+});
+```
+
+- Mappings run once, when a session of that workflow becomes verified (the
+  provider approved it, or an officer approved it in the OS).
+- `FILL` (default) writes only an empty target; `OVERWRITE` replaces it.
+- A value the target cannot hold (e.g. an answer that is not one of the field's
+  options) is skipped; the rest still apply.
+- The save validates sources, targets, options and constants, and lists every
+  problem in one 400.
+- Constant writes carry the session id as their reason in the constant history.
+  Any change re-scores the customer.
+
+### Periodic reviews
+
+Every matrix run keeps the customer's `nextReviewAt` (on individual and
+entity responses) in line with the review cycle of the rating in force
+(`outcomes[].reviewEveryMonths`). The clock starts at the first rating. A rise
+to a rating with a shorter cycle brings the review forward; a fall leaves it
+where it is. When the date arrives, the daily sweep opens a Task labelled
+`periodic-review`, assigned to the customer's assignees, due on the review
+date and linked to the customer. Closing that Task (done or cancelled)
+restarts the clock from that day.
+
+### Override disagreement
+
+While an officer override is in force, the matrix keeps scoring. When its
+rating moves away from the override, the customer's assignees get a
+notification ("The risk matrix disagrees with an officer-set rating"). It is
+sent once per change, not on every run.
+
+Spec: [`docs/specs/profile-templates/README.md`](../../docs/specs/profile-templates/README.md).
+
 ## Tenant sync — config-as-code (BREAKING in v0.7.0)
 
 `os.config.sync` drives declarative tenant config (products, constants, event
-definitions, webhooks, rules, currencies, and tenant behaviour settings). You build a `SyncConfig` and the
+definitions, webhooks, rules, currencies, profile templates, and tenant behaviour settings). You build a `SyncConfig` and the
 **server** validates, diffs, and applies it — clients hold no diff/apply logic.
 This backs the `dossiers-sync` CLI.
 
@@ -447,12 +707,14 @@ const { tokens } = await os.config.tagCatalogue.palette(); // valid `color` valu
 > accepted. Product DTOs no longer carry `metadata` — use `otherProperties`
 > instead.
 
-Accounts, products, and event ingestion accept the platform's Typed Fields
+Accounts, products, customers, and event ingestion accept the platform's Typed Fields
 primitive — a typed key/value bag (`fields`) plus an untyped escape hatch
 (`otherProperties`). Collection fields are explicit: `LIST` is open-ended,
 while `SINGLE_SELECT` and `MULTI_SELECT` are constrained by the declared
-`options` on the parent schema (`Product.accountFieldConfig` or
-`EventDefinition.properties`). Legacy `SET` remains supported but is deprecated.
+`options` on the parent schema (`Product.accountFieldConfig`,
+`ProfileTemplate.fieldConfig` or `EventDefinition.properties`). Legacy `SET`
+remains supported but is deprecated. Customer `fields` are always Tier A — see
+[Profile templates & risk matrix](#profile-templates--risk-matrix).
 
 ```ts
 import type { TypedFieldValueInput } from '@dossier-wiki/os-sdk';

package/dist/service.d.ts

@@ -1,5 +1,5 @@
 import type { AlertWorkflowVersion, RestoreAlertWorkflowInput, AlertWorkflowExperienceSettings, SaveAlertWorkflowExperienceInput, AlertWorkflowSettings, SaveAlertWorkflowInput, WorkflowAlertType } from "./types.js";
-import type { AccountResponseDto, AddFaceImageDto, AlertResourceDto, AlertResourceRefDto, AlertResponseDto, CreateCustomAlertDto, CreateCustomAlertTypeDto, CustomAlertTypeResponseDto, UpdateAlertNotesDto, UpdateCustomAlertTypeDto, TagFieldKey, TagCatalogueEntry, TagGroup, TagGroupInput, UpdateTagGroupInput, RegroupReport, TagCatalogueEntryInput, UpdateTagCatalogueEntryInput, ApiKeyResponseDto, ArchiveIdentificationDocumentInput, BulkCurrencyStatusInput, BulkUpsertOtherInformationInput, CustomerOtherInformationEntry, BulkCurrencyStatusResponseDto, CommentResourceType, ConfirmUploadDto, ConfirmedMatchDto, ConstantResponseDto, ChangeResourceStateInput, CreateStateDefinitionInput, CounterpartyResponseDto, CreateAccountDto, CreateApiKeyDto, CreateConstantDto, CreateCounterpartyDto, CreateCurrencyInput, CreateEntityInput, CreateEventDefinitionDto, CreateIdentificationDocumentInput, CreateIndividualInput, CreateNoteDto, CreateProductDto, CreateRiskAssessmentDto, CreateCustomerRiskAssessmentDto, CreateRuleDto, CreateStakeholderDto, CreateWebhookDto, CurrencyResponseDto, CursorPaginationQuery, DeleteConstantQuery, DeleteIdentificationDocumentResponse, DeviceResponseDto, DeviceMergeResponseDto, MergeDeviceDto, DeviceSummaryDto, EntityResponseDto, EntityCreatedResponseDto, CreateCustomerOptions, EventDefinitionResponseDto, ExpectedActivityResponseDto, FileResponseDto, GetCustomerQuery, IdentificationDocument, IndividualResponseDto, IndividualCreatedResponseDto, IngestEventDto, IngestEventResponse, IngestTransactionAsyncResponse, IngestTransactionAttemptDto, IngestTransactionAttemptResponse, ListTransactionAttemptsInput, TransactionAttemptDto, TransactionAttemptPage, AlertAttemptEvidence, TenantBehaviorSettings, UpdateTenantBehaviorSettingsInput, IngestTransactionDto, IngestTransactionResponse, InitializeSetupDto, InvitationDetailsDto, LinkCounterpartyDto, MergeCounterpartiesDto, ListAccountsResponse, ListCounterpartiesResponse, ListCurrenciesQuery, ListEntitiesResponse, ListIdentificationDocumentsQuery, ListIndividualsResponse, NoteResponseDto, PatchTransactionStatusDto, TransactionResponseDto, PaymentInstrumentDto, CreatePaymentInstrumentDto, UpdatePaymentInstrumentDto, LinkPaymentInstrumentAccountDto, LinkPaymentInstrumentCustomerDto, PaymentInstrumentAccountRelationshipDto, PaymentInstrumentCustomerRelationshipDto, PlatformComment, PlatformConfirmUploadDto, PlatformConfirmUploadResponseDto, PlatformCreateCommentDto, PlatformRequestUploadUrlDto, PlatformUpdateCommentDto, PlatformUploadUrlResponseDto, ProductResponseDto, PushExchangeRatesDto, PushExchangeRatesResponseDto, RegisterDeviceDto, RequestUploadUrlDto, ResetConfigResponseDto, ResetMemberPasswordDto, RiskAssessmentResponseDto, CustomerRiskAssessmentResponseDto, RuleResponseDto, RuleVersionResponseDto, RuleAnalyticsResponseDto, ScreeningResultDto, ScreeningHistoryEntryDto, StartKycSessionResponseDto, KycSessionDto, ScreeningMatchResultDto, SimulateRulesDto, SimulationReportDto, SetupInitializeResponseDto, SetupStatusDto, StakeholderResponseDto, SyncSnapshotDto, SyncDriftDto, CreateSyncSnapshotInput, SyncKeyQuery, ListConstantsQuery, ResourceStateDto, ResourceStateHistoryDto, StateDefinitionDto, StateResourceType, SyncConfig, SyncValidationResult, SyncPlanResult, SyncApplyResult, SyncExportQuery, TokenResponseDto, TransitionIdentificationDocumentStatusInput, UploadUrlResponseDto, UpdateAccountDto, UpdateConstantDto, UpdateCounterpartyDto, UpdateCurrencyInput, UpdateDeviceTrustDto, UpdateEntityDto, UpdateEventDefinitionDto, UpdateExpectedActivityDto, UpdateFaceImageDto, UpdateIdentificationDocumentDto, UpdateIdentificationDocumentInput, UpdateIndividualDto, UpdateNoteDto, UpsertOtherInformationValueInput, UpdateProductDto, UpdateRiskRatingDto, UpdateCustomerStatusDto, UpdateCustomerStatusResponse, ArchiveCustomerDto, ArchiveCustomerResponse, UpdateRuleDto, UpdateStakeholderDto, UpdateWebhookDto, WebhookResponseDto, BulkCustomListImportResultDto, CreateCustomScreeningListInput, CustomListEntryDto, CustomListEntryInput, CustomListEntryListResponse, CustomScreeningListDto, CustomScreeningListListResponse, UpdateCustomListEntryInput, UpdateCustomScreeningListInput, AssignmentPolicyResponseDto, CreateAssignmentPolicyDto, UpdateAssignmentPolicyDto, ReorderAssignmentPoliciesDto, TeamRefDto, TeamDto, CreateTeamDto, UpdateTeamDto, TeamMemberIdsDto, CustomerAssignmentInput, BulkCustomerAssignmentInput, CustomerAssignmentResponse, BulkCustomerAssignmentResult, SessionDto, UpdateSessionDto, ChannelEndpointDto, UpdateChannelEndpointDto, Branch, BranchListResponse, CreateBranchInput, UpdateBranchInput, Employee, EmployeeListResponse, CreateEmployeeInput, UpdateEmployeeInput, CreateRiskSignalInput, ListRiskSignalsQuery, RiskSignal, RiskSignalListResponse, PartyRelationship, PartyRelationshipPartyType, PartyRelationshipType, CreatePartyRelationshipInput, CreatePartyRelationshipTypeInput } from './types.js';
+import type { AccountResponseDto, AddFaceImageDto, AlertResourceDto, AlertResourceRefDto, AlertResponseDto, CreateCustomAlertDto, CreateCustomAlertTypeDto, CustomAlertTypeResponseDto, UpdateAlertNotesDto, UpdateCustomAlertTypeDto, TagFieldKey, TagCatalogueEntry, TagGroup, TagGroupInput, UpdateTagGroupInput, RegroupReport, TagCatalogueEntryInput, UpdateTagCatalogueEntryInput, ApiKeyResponseDto, ArchiveIdentificationDocumentInput, BulkCurrencyStatusInput, BulkUpsertOtherInformationInput, CustomerOtherInformationEntry, BulkCurrencyStatusResponseDto, CommentResourceType, ConfirmUploadDto, ConfirmedMatchDto, ConstantResponseDto, ChangeResourceStateInput, CreateStateDefinitionInput, CounterpartyResponseDto, CreateAccountDto, CreateApiKeyDto, CreateConstantDto, CreateCounterpartyDto, CreateCurrencyInput, CreateEntityInput, CreateEventDefinitionDto, CreateIdentificationDocumentInput, CreateIndividualInput, CreateNoteDto, CreateProductDto, CreateRiskAssessmentDto, CreateCustomerRiskAssessmentDto, CreateRuleDto, CreateStakeholderDto, CreateWebhookDto, CurrencyResponseDto, CursorPaginationQuery, DeleteConstantQuery, DeleteIdentificationDocumentResponse, DeviceResponseDto, DeviceMergeResponseDto, MergeDeviceDto, DeviceSummaryDto, EntityResponseDto, EntityCreatedResponseDto, CreateCustomerOptions, EventDefinitionResponseDto, ExpectedActivityResponseDto, FileResponseDto, GetCustomerQuery, IdentificationDocument, IndividualResponseDto, IndividualCreatedResponseDto, IngestEventDto, IngestEventResponse, IngestTransactionAsyncResponse, IngestTransactionAttemptDto, IngestTransactionAttemptResponse, ListTransactionAttemptsInput, TransactionAttemptDto, TransactionAttemptPage, AlertAttemptEvidence, TenantBehaviorSettings, UpdateTenantBehaviorSettingsInput, IngestTransactionDto, IngestTransactionResponse, InitializeSetupDto, InvitationDetailsDto, LinkCounterpartyDto, MergeCounterpartiesDto, ListAccountsResponse, ListCounterpartiesResponse, ListCurrenciesQuery, ListEntitiesResponse, ListIdentificationDocumentsQuery, ListIndividualsResponse, NoteResponseDto, PatchTransactionStatusDto, TransactionResponseDto, PaymentInstrumentDto, CreatePaymentInstrumentDto, UpdatePaymentInstrumentDto, LinkPaymentInstrumentAccountDto, LinkPaymentInstrumentCustomerDto, PaymentInstrumentAccountRelationshipDto, PaymentInstrumentCustomerRelationshipDto, PlatformComment, PlatformConfirmUploadDto, PlatformConfirmUploadResponseDto, PlatformCreateCommentDto, PlatformRequestUploadUrlDto, PlatformUpdateCommentDto, PlatformUploadUrlResponseDto, ProductResponseDto, PushExchangeRatesDto, PushExchangeRatesResponseDto, RegisterDeviceDto, RequestUploadUrlDto, ResetConfigResponseDto, ResetMemberPasswordDto, RiskAssessmentResponseDto, CustomerRiskAssessmentResponseDto, RuleResponseDto, RuleVersionResponseDto, RuleAnalyticsResponseDto, ScreeningResultDto, ScreeningHistoryEntryDto, StartKycSessionInput, StartKycSessionResponseDto, ReviewKycSessionInput, KycSessionDto, ScreeningMatchResultDto, SimulateRulesDto, SimulationReportDto, SetupInitializeResponseDto, SetupStatusDto, StakeholderResponseDto, SyncSnapshotDto, SyncDriftDto, CreateSyncSnapshotInput, SyncKeyQuery, ListConstantsQuery, ResourceStateDto, ResourceStateHistoryDto, StateDefinitionDto, StateResourceType, SyncConfig, SyncValidationResult, SyncPlanResult, SyncApplyResult, SyncExportQuery, TokenResponseDto, TransitionIdentificationDocumentStatusInput, UploadUrlResponseDto, UpdateAccountDto, UpdateConstantDto, UpdateCounterpartyDto, UpdateCurrencyInput, UpdateDeviceTrustDto, UpdateEntityDto, UpdateEventDefinitionDto, UpdateExpectedActivityDto, UpdateFaceImageDto, UpdateIdentificationDocumentDto, UpdateIdentificationDocumentInput, UpdateIndividualDto, UpdateNoteDto, UpsertOtherInformationValueInput, UpdateProductDto, UpdateRiskRatingDto, UpdateRiskRatingResponseDto, ProfileTemplate, ProfileTemplateVersion, ListProfileTemplatesQuery, CreateProfileTemplateInput, UpdateProfileTemplateInput, PreviewRiskMatrixInput, RiskMatrixImpactInput, RiskMatrixPreview, RiskMatrixImpact, UpdateCustomerStatusDto, UpdateCustomerStatusResponse, ArchiveCustomerDto, ArchiveCustomerResponse, UpdateRuleDto, UpdateStakeholderDto, UpdateWebhookDto, WebhookResponseDto, BulkCustomListImportResultDto, CreateCustomScreeningListInput, CustomListEntryDto, CustomListEntryInput, CustomListEntryListResponse, CustomScreeningListDto, CustomScreeningListListResponse, UpdateCustomListEntryInput, UpdateCustomScreeningListInput, AssignmentPolicyResponseDto, CreateAssignmentPolicyDto, UpdateAssignmentPolicyDto, ReorderAssignmentPoliciesDto, TeamRefDto, TeamDto, CreateTeamDto, UpdateTeamDto, TeamMemberIdsDto, CustomerAssignmentInput, BulkCustomerAssignmentInput, CustomerAssignmentResponse, BulkCustomerAssignmentResult, SessionDto, UpdateSessionDto, ChannelEndpointDto, UpdateChannelEndpointDto, Branch, BranchListResponse, CreateBranchInput, UpdateBranchInput, Employee, EmployeeListResponse, CreateEmployeeInput, UpdateEmployeeInput, CreateRiskSignalInput, ListRiskSignalsQuery, RiskSignal, RiskSignalListResponse, PartyRelationship, PartyRelationshipPartyType, PartyRelationshipType, CreatePartyRelationshipInput, CreatePartyRelationshipTypeInput } from './types.js';
 export interface DossiersOSAPIServiceOptions {
     /** Base URL of the OS API host, e.g. `https://sandbox-os.dossiers.wiki`. The `/v1` prefix is added by the SDK. */
     baseUrl: string;
@@ -18,7 +18,7 @@ type RequestOptions = {
     query?: Record<string, unknown> | object;
 };
 type RequestFn = <T>(method: HttpMethod, path: string, opts?: RequestOptions) => Promise<T>;
-type BinaryRequestFn = (path: string) => Promise<Uint8Array>;
+type BinaryRequestFn = (path: string, accept?: string) => Promise<Uint8Array>;
 export declare class DossiersOSAPIService {
     private readonly apiKey;
     private readonly baseUrl;
@@ -54,7 +54,7 @@ export declare class DossiersOSAPIService {
     readonly partyRelationships: PartyRelationshipsResource;
     constructor(options: DossiersOSAPIServiceOptions);
     private request;
-    /** GET a binary body (PDF reports). Errors are parsed the same way as JSON requests. */
+    /** GET a binary body (PDF reports, ZIP bundles). Errors are parsed the same way as JSON requests. */
     private requestBinary;
 }
 export declare class PartyRelationshipsResource {
@@ -184,7 +184,7 @@ export declare class CustomersResource {
     readonly expectedActivity: CustomerExpectedActivityResource;
     readonly devices: CustomerDevicesResource;
     readonly assignment: CustomerAssignmentResource;
-    constructor(req: RequestFn);
+    constructor(req: RequestFn, getBinary: BinaryRequestFn);
     /**
      * `POST /v1/customers/{customerId}/archive` — archive a customer
      * (organization owner/admin only, irreversible). Frees the customer's
@@ -289,13 +289,18 @@ export declare class CustomerScreeningResource {
  */
 export declare class CustomerKycResource {
     private readonly req;
-    constructor(req: RequestFn);
+    private readonly getBinary;
+    constructor(req: RequestFn, getBinary: BinaryRequestFn);
     /**
-     * `POST /v1/customers/{customerId}/kyc/sessions` — start a KYC session with
-     * the organization's active provider. Hand the returned `sessionUrl` to the
-     * customer.
+     * `POST /v1/customers/{customerId}/kyc/sessions` — start a KYC session.
+     * Hand the returned `sessionUrl` to the customer.
+     *
+     * `input.providerConfigId` picks the KYC provider (required when the
+     * organization has several enabled — the API answers 400 otherwise);
+     * `input.workflowId` picks the provider workflow (defaults to the
+     * provider's configured default workflow, then the provider's own).
      */
-    start(customerId: string): Promise<StartKycSessionResponseDto>;
+    start(customerId: string, input?: StartKycSessionInput): Promise<StartKycSessionResponseDto>;
     /**
      * `GET /v1/customers/{customerId}/kyc/sessions` — list a customer's KYC
      * sessions, newest first.
@@ -307,8 +312,33 @@ export declare class CustomerKycResource {
      */
     refresh(customerId: string, sessionId: string): Promise<KycSessionDto>;
     /**
-     * `DELETE /v1/customers/{customerId}/kyc/sessions/{sessionId}` — cancel the
-     * session at the provider and remove the local record.
+     * `POST /v1/customers/{customerId}/kyc/sessions/{sessionId}/review` —
+     * approve or reject a finished session (status `IN_REVIEW`, `VERIFIED` or
+     * `FAILED`). The decision is the verdict of record; rejecting requires a
+     * `reason`. Needs the `customer:update` permission.
+     */
+    review(customerId: string, sessionId: string, input: ReviewKycSessionInput): Promise<KycSessionDto>;
+    /**
+     * `GET /v1/customers/{customerId}/kyc/sessions/{sessionId}/report` — the
+     * session as a PDF: summary, officer review, findings, each step's evidence
+     * (cropped document pages, faces, liveness frames, form answers), checks and
+     * claimed-vs-document comparison. Built from the record the OS holds, so it
+     * works after the provider has deleted its copy. Requires `report:read`;
+     * records a `report.generated` activity on the customer.
+     */
+    report(customerId: string, sessionId: string): Promise<Uint8Array>;
+    /**
+     * `GET /v1/customers/{customerId}/kyc/sessions/{sessionId}/evidence` — a ZIP
+     * with the PDF report (`report.pdf`), every archived evidence file at full
+     * resolution (`evidence/`, including liveness video) and the raw data
+     * (`data/verification.json`, `data/session.json`,
+     * `data/provider-session.json`). Requires `report:read`.
+     */
+    evidenceBundle(customerId: string, sessionId: string): Promise<Uint8Array>;
+    /**
+     * `DELETE /v1/customers/{customerId}/kyc/sessions/{sessionId}` — cancel a
+     * session that never finished and remove the local record. Finished
+     * sessions are kept as compliance records (the API answers 400).
      */
     delete(customerId: string, sessionId: string): Promise<{
         deletedId: string;
@@ -317,7 +347,21 @@ export declare class CustomerKycResource {
 export declare class CustomerRiskRatingResource {
     private readonly req;
     constructor(req: RequestFn);
-    update(customerId: string, input: UpdateRiskRatingDto): Promise<IndividualResponseDto | EntityResponseDto>;
+    /**
+     * `PUT /v1/customers/{customerId}/risk-rating` — set the rating by hand.
+     * It becomes a sticky officer override (`riskRatingSource: 'MANUAL'`): a
+     * Profile Template's risk matrix keeps recording its computed rating but
+     * never overwrites this one until `clearOverride` is called.
+     */
+    update(customerId: string, input: UpdateRiskRatingDto): Promise<UpdateRiskRatingResponseDto>;
+    /**
+     * `DELETE /v1/customers/{customerId}/risk-rating/override` — clear an
+     * officer override and hand the rating back to the risk matrix: the matrix
+     * runs now and its computed rating applies (`riskRatingSource: 'MATRIX'`).
+     * Resolves to the latest matrix assessment. 400 when the customer has no
+     * Profile Template with a risk matrix.
+     */
+    clearOverride(customerId: string): Promise<CustomerRiskAssessmentResponseDto>;
 }
 export declare class CustomerStatusResource {
     private readonly req;
@@ -333,6 +377,14 @@ export declare class CustomerRiskAssessmentsResource {
     constructor(req: RequestFn);
     list(customerId: string): Promise<CustomerRiskAssessmentResponseDto[]>;
     create(customerId: string, input: CreateCustomerRiskAssessmentDto): Promise<CustomerRiskAssessmentResponseDto>;
+    /**
+     * `POST /v1/customers/{customerId}/risk-assessments/evaluate` — run the
+     * customer's Profile Template risk matrix now (trigger `MANUAL`). Resolves
+     * to the latest matrix assessment (`method: 'MATRIX'`). The customer's
+     * rating changes unless an officer override is in force. 400 when the
+     * customer has no Profile Template with a risk matrix.
+     */
+    evaluate(customerId: string): Promise<CustomerRiskAssessmentResponseDto>;
 }
 export declare class CustomerExpectedActivityResource {
     private readonly req;
@@ -689,6 +741,7 @@ export declare class ConfigResource {
     readonly states: ConfigStatesResource;
     readonly assignmentPolicies: ConfigAssignmentPoliciesResource;
     readonly products: ConfigProductsResource;
+    readonly profileTemplates: ConfigProfileTemplatesResource;
     readonly currencies: ConfigCurrenciesResource;
     readonly eventDefinitions: ConfigEventDefinitionsResource;
     readonly customAlertTypes: ConfigCustomAlertTypesResource;
@@ -923,6 +976,55 @@ export declare class ConfigProductsResource {
     /** Unarchive (ARCHIVED → LIVE). */
     unarchive(id: string): Promise<LifecycleResult>;
 }
+/**
+ * Profile Templates — `/v1/config/profile-templates`. The template a customer
+ * is created against: typed profile fields, a risk matrix that computes the
+ * customer's risk rating, KYC workflow bindings, and the creation setup of
+ * the Add Individual / Add Entity forms (Customer → Profile Template
+ * parallels Account → Product). Requires `config:read` / `config:write`.
+ */
+export declare class ConfigProfileTemplatesResource {
+    private readonly req;
+    constructor(req: RequestFn);
+    /** Live templates (pass `includeArchived: true` for all), grouped by party type, default first. */
+    list(query?: ListProfileTemplatesQuery): Promise<ProfileTemplate[]>;
+    get(id: string): Promise<ProfileTemplate>;
+    /** Look a template up by its immutable `key`. 404 when no template has that key. */
+    getByKey(key: string): Promise<ProfileTemplate>;
+    /** Published versions, newest first. Every version is an immutable snapshot. */
+    versions(id: string): Promise<ProfileTemplateVersion[]>;
+    /**
+     * Create a template (version 1). 400 lists every validation problem at
+     * once (weights, unlevelled options, unknown fields or factors, duplicate
+     * workflow purposes); 409 when the `key` is taken.
+     */
+    create(input: CreateProfileTemplateInput): Promise<ProfileTemplate>;
+    /**
+     * Partial update. Changing `fieldConfig`, `riskMatrix`, `kycWorkflows` or
+     * the creation setup (`individualCreation` / `entityCreation`) publishes a
+     * new version; only `fieldConfig` / `riskMatrix` changes re-assess the
+     * template's customers.
+     */
+    update(id: string, input: UpdateProfileTemplateInput): Promise<ProfileTemplate>;
+    /**
+     * `DELETE /v1/config/profile-templates/{id}` — archive (there is no hard
+     * delete). Existing customers keep the template and keep being rated by
+     * its matrix; new customers cannot use it. Clears `isDefault`. Idempotent.
+     */
+    archive(id: string): Promise<ProfileTemplate>;
+    /**
+     * Score one customer under an unsaved risk matrix, next to its template's
+     * saved matrix on the same inputs. Nothing is saved. 400 lists every
+     * problem with the draft, as a save would.
+     */
+    previewRiskMatrix(input: PreviewRiskMatrixInput): Promise<RiskMatrixPreview>;
+    /**
+     * What saving an unsaved risk matrix would do to every live customer on
+     * the template: rating distribution before and after, movements, and the
+     * customers who move. Nothing is saved.
+     */
+    riskMatrixImpact(id: string, input: RiskMatrixImpactInput): Promise<RiskMatrixImpact>;
+}
 export declare class ConfigCurrenciesResource {
     private readonly req;
     constructor(req: RequestFn);