vesant-sdk 1.7.2 → 1.8.0-dev.0a33430

package/dist/{index-DSDgS09k.d.ts → index-BosFSGan.d.ts}

@@ -1,4 +1,4 @@
-import { U as UUID, T as Timestamp, R as RiskLevel } from './types-CBQRNL-l.js';
+import { R as RiskLevel, T as Timestamp, U as UUID } from './types-CBQRNL-l.js';
 
 /**
  * Pluggable dedup store for webhook replay protection.
@@ -189,6 +189,61 @@ type WebhookEventHandler<T extends WebhookEventType = WebhookEventType> = (event
     event_type: T;
 }>) => void | Promise<void>;
 type WebhookAnyHandler = (event: WebhookEvent) => void | Promise<void>;
+/** Watchlist category an AML screening matched. */
+type AmlCallbackCategory = 'sanction' | 'pep' | 'adverse_media' | 'fraud' | 'terrorism' | 'narcotics' | 'financial_crime' | 'warning' | 'fitness_probity' | 'previous_client' | 'unknown' | (string & Record<string, never>);
+interface AmlBlockCallbackData {
+    /** Your customer identifier — the one the screening ran against. */
+    customer_id: string;
+    /** Screened full name. Omitted when the screening had no full name. */
+    customer_name?: string;
+    /**
+     * Derived from the number of matches against your tenant's risk thresholds —
+     * not from the category. A sanction match is not automatically `high`.
+     */
+    risk_level: RiskLevel;
+    /** The category that matched. `previous_client` is a match on your internal watchlist only. */
+    category: AmlCallbackCategory;
+    /** Total matches, including internal watchlist matches. */
+    hits_count: number;
+    /** Name of the AML alert rule that decided the block. */
+    applied_rule?: string;
+    /** ISO 8601 UTC time the screening ran. */
+    screened_at?: Timestamp;
+}
+/**
+ * Body POSTed to the webhook URL in your AML screening settings when a
+ * screening matches a watchlist and the governing alert rule carries the
+ * `block` reaction. Signed with `X-Webhook-Signature: sha256=<hex>`
+ * (HMAC-SHA256 of the raw body).
+ *
+ * Sent only for blocks — nothing is delivered for a clear screening or for a
+ * rule that only alerts. Screenings that run without a request from you (after
+ * an accepted KYC, or after a name or date-of-birth change) are reported only
+ * through this webhook.
+ */
+interface AmlBlockCallbackEvent {
+    /** Always `"aml"` — dispatch on this. */
+    event: 'aml';
+    /** The screening reference you supplied, or a generated identifier for automatic screenings. */
+    reference: string;
+    /** The screening record ID — unique per screening, so dedup on it. */
+    resource_id: string;
+    /** Always `"blocked"`. */
+    status: 'blocked';
+    /** Always `true`. */
+    block: true;
+    /**
+     * Human-readable reason for display and audit. Wording is not stable — branch
+     * on `data.category` and `data.risk_level` instead.
+     */
+    block_reason: string;
+    data: AmlBlockCallbackData;
+}
+/**
+ * Type guard for the AML block webhook. Narrows an already signature-verified,
+ * parsed payload to {@link AmlBlockCallbackEvent}.
+ */
+declare function isAmlBlockCallbackEvent(value: unknown): value is AmlBlockCallbackEvent;
 
 /**
  * Webhook event handler with signature verification and typed dispatch.
@@ -261,4 +316,4 @@ declare function createWebhookMiddleware(options: WebhookMiddlewareOptions): (re
  */
 declare function createNextWebhookHandler(options: WebhookMiddlewareOptions): (request: Request) => Promise<Response>;
 
-export { type BaseWebhookEvent as B, type ComplianceCheckFailedPayload as C, type DecisionRecordedPayload as D, type GeolocationBlockedPayload as G, InMemoryDedupStore as I, type KycStatusChangedPayload as K, type LabelAppliedPayload as L, type NotificationWebhookEvent as N, type ProfileCreatedPayload as P, type RiskCategoryChangedPayload as R, type TaxReminderSentPayload as T, type VerifyWebhookSignatureOptions as V, type WebhookAnyHandler as W, type GeolocationVerifiedPayload as a, type InMemoryDedupStoreOptions as b, type LocationRequestCompletedPayload as c, type ProfileUpdatedPayload as d, type RiskScoreChangedPayload as e, type WebhookDedupStore as f, type WebhookEvent as g, type WebhookEventHandler as h, type WebhookEventType as i, WebhookHandler as j, type WebhookHandlerConfig as k, type WebhookMiddlewareOptions as l, type WebhookNotification as m, createNextWebhookHandler as n, createWebhookMiddleware as o, verifyWebhookSignature as v };
+export { type AmlBlockCallbackData as A, type BaseWebhookEvent as B, type ComplianceCheckFailedPayload as C, type DecisionRecordedPayload as D, type GeolocationBlockedPayload as G, InMemoryDedupStore as I, type KycStatusChangedPayload as K, type LabelAppliedPayload as L, type NotificationWebhookEvent as N, type ProfileCreatedPayload as P, type RiskCategoryChangedPayload as R, type TaxReminderSentPayload as T, type VerifyWebhookSignatureOptions as V, type WebhookAnyHandler as W, type AmlBlockCallbackEvent as a, type AmlCallbackCategory as b, type GeolocationVerifiedPayload as c, type InMemoryDedupStoreOptions as d, type LocationRequestCompletedPayload as e, type ProfileUpdatedPayload as f, type RiskScoreChangedPayload as g, type WebhookDedupStore as h, type WebhookEvent as i, type WebhookEventHandler as j, type WebhookEventType as k, WebhookHandler as l, type WebhookHandlerConfig as m, type WebhookMiddlewareOptions as n, type WebhookNotification as o, createNextWebhookHandler as p, createWebhookMiddleware as q, isAmlBlockCallbackEvent as r, verifyWebhookSignature as v };

package/dist/{index-C3zUKydT.d.mts → index-C49a7fg2.d.mts}

@@ -1,4 +1,4 @@
-import { U as UUID, T as Timestamp, R as RiskLevel } from './types-CBQRNL-l.mjs';
+import { R as RiskLevel, T as Timestamp, U as UUID } from './types-CBQRNL-l.mjs';
 
 /**
  * Pluggable dedup store for webhook replay protection.
@@ -189,6 +189,61 @@ type WebhookEventHandler<T extends WebhookEventType = WebhookEventType> = (event
     event_type: T;
 }>) => void | Promise<void>;
 type WebhookAnyHandler = (event: WebhookEvent) => void | Promise<void>;
+/** Watchlist category an AML screening matched. */
+type AmlCallbackCategory = 'sanction' | 'pep' | 'adverse_media' | 'fraud' | 'terrorism' | 'narcotics' | 'financial_crime' | 'warning' | 'fitness_probity' | 'previous_client' | 'unknown' | (string & Record<string, never>);
+interface AmlBlockCallbackData {
+    /** Your customer identifier — the one the screening ran against. */
+    customer_id: string;
+    /** Screened full name. Omitted when the screening had no full name. */
+    customer_name?: string;
+    /**
+     * Derived from the number of matches against your tenant's risk thresholds —
+     * not from the category. A sanction match is not automatically `high`.
+     */
+    risk_level: RiskLevel;
+    /** The category that matched. `previous_client` is a match on your internal watchlist only. */
+    category: AmlCallbackCategory;
+    /** Total matches, including internal watchlist matches. */
+    hits_count: number;
+    /** Name of the AML alert rule that decided the block. */
+    applied_rule?: string;
+    /** ISO 8601 UTC time the screening ran. */
+    screened_at?: Timestamp;
+}
+/**
+ * Body POSTed to the webhook URL in your AML screening settings when a
+ * screening matches a watchlist and the governing alert rule carries the
+ * `block` reaction. Signed with `X-Webhook-Signature: sha256=<hex>`
+ * (HMAC-SHA256 of the raw body).
+ *
+ * Sent only for blocks — nothing is delivered for a clear screening or for a
+ * rule that only alerts. Screenings that run without a request from you (after
+ * an accepted KYC, or after a name or date-of-birth change) are reported only
+ * through this webhook.
+ */
+interface AmlBlockCallbackEvent {
+    /** Always `"aml"` — dispatch on this. */
+    event: 'aml';
+    /** The screening reference you supplied, or a generated identifier for automatic screenings. */
+    reference: string;
+    /** The screening record ID — unique per screening, so dedup on it. */
+    resource_id: string;
+    /** Always `"blocked"`. */
+    status: 'blocked';
+    /** Always `true`. */
+    block: true;
+    /**
+     * Human-readable reason for display and audit. Wording is not stable — branch
+     * on `data.category` and `data.risk_level` instead.
+     */
+    block_reason: string;
+    data: AmlBlockCallbackData;
+}
+/**
+ * Type guard for the AML block webhook. Narrows an already signature-verified,
+ * parsed payload to {@link AmlBlockCallbackEvent}.
+ */
+declare function isAmlBlockCallbackEvent(value: unknown): value is AmlBlockCallbackEvent;
 
 /**
  * Webhook event handler with signature verification and typed dispatch.
@@ -261,4 +316,4 @@ declare function createWebhookMiddleware(options: WebhookMiddlewareOptions): (re
  */
 declare function createNextWebhookHandler(options: WebhookMiddlewareOptions): (request: Request) => Promise<Response>;
 
-export { type BaseWebhookEvent as B, type ComplianceCheckFailedPayload as C, type DecisionRecordedPayload as D, type GeolocationBlockedPayload as G, InMemoryDedupStore as I, type KycStatusChangedPayload as K, type LabelAppliedPayload as L, type NotificationWebhookEvent as N, type ProfileCreatedPayload as P, type RiskCategoryChangedPayload as R, type TaxReminderSentPayload as T, type VerifyWebhookSignatureOptions as V, type WebhookAnyHandler as W, type GeolocationVerifiedPayload as a, type InMemoryDedupStoreOptions as b, type LocationRequestCompletedPayload as c, type ProfileUpdatedPayload as d, type RiskScoreChangedPayload as e, type WebhookDedupStore as f, type WebhookEvent as g, type WebhookEventHandler as h, type WebhookEventType as i, WebhookHandler as j, type WebhookHandlerConfig as k, type WebhookMiddlewareOptions as l, type WebhookNotification as m, createNextWebhookHandler as n, createWebhookMiddleware as o, verifyWebhookSignature as v };
+export { type AmlBlockCallbackData as A, type BaseWebhookEvent as B, type ComplianceCheckFailedPayload as C, type DecisionRecordedPayload as D, type GeolocationBlockedPayload as G, InMemoryDedupStore as I, type KycStatusChangedPayload as K, type LabelAppliedPayload as L, type NotificationWebhookEvent as N, type ProfileCreatedPayload as P, type RiskCategoryChangedPayload as R, type TaxReminderSentPayload as T, type VerifyWebhookSignatureOptions as V, type WebhookAnyHandler as W, type AmlBlockCallbackEvent as a, type AmlCallbackCategory as b, type GeolocationVerifiedPayload as c, type InMemoryDedupStoreOptions as d, type LocationRequestCompletedPayload as e, type ProfileUpdatedPayload as f, type RiskScoreChangedPayload as g, type WebhookDedupStore as h, type WebhookEvent as i, type WebhookEventHandler as j, type WebhookEventType as k, WebhookHandler as l, type WebhookHandlerConfig as m, type WebhookMiddlewareOptions as n, type WebhookNotification as o, createNextWebhookHandler as p, createWebhookMiddleware as q, isAmlBlockCallbackEvent as r, verifyWebhookSignature as v };

package/dist/index.d.mts

@@ -2,14 +2,14 @@ import { L as Logger } from './client-q9fN8Hhf.mjs';
 export { A as AuthCredential, B as BaseClient, a as BaseClientConfig, C as CGSConfig, b as CircuitBreaker, c as CircuitBreakerConfig, d as CircuitBreakerState, e as CircuitBreakerStatus, f as RateLimitStatus, g as RateLimitTracker, h as RefreshingTokenProvider, i as RefreshingTokenProviderOptions, j as RequestInterceptor, R as RequestOptions, k as RequiredBaseClientConfig, l as RequiredCGSConfig, m as RequiredVesantConfig, S as StaticApiKeyProvider, T as TokenProvider, n as TokenProviderContext, V as VesantConfig } from './client-q9fN8Hhf.mjs';
 import { a as PaginatedResponse } from './types-CBQRNL-l.mjs';
 export { A as APIResponse, B as BlockReason, C as CustomerStatus, E as EntityType, b as ErrorResponse, L as LocationCompliance, P as PaginationParams, c as Reason, d as Result, R as RiskLevel, S as SuccessResponse, T as Timestamp, U as UUID, V as VerificationEventType } from './types-CBQRNL-l.mjs';
-export { B as BaseWebhookEvent, C as ComplianceCheckFailedPayload, D as DecisionRecordedPayload, G as GeolocationBlockedPayload, a as GeolocationVerifiedPayload, I as InMemoryDedupStore, b as InMemoryDedupStoreOptions, K as KycStatusChangedPayload, L as LabelAppliedPayload, c as LocationRequestCompletedPayload, N as NotificationWebhookEvent, P as ProfileCreatedPayload, d as ProfileUpdatedPayload, R as RiskCategoryChangedPayload, e as RiskScoreChangedPayload, T as TaxReminderSentPayload, V as VerifyWebhookSignatureOptions, W as WebhookAnyHandler, f as WebhookDedupStore, g as WebhookEvent, h as WebhookEventHandler, i as WebhookEventType, j as WebhookHandler, k as WebhookHandlerConfig, l as WebhookMiddlewareOptions, m as WebhookNotification, n as createNextWebhookHandler, o as createWebhookMiddleware, v as verifyWebhookSignature } from './index-C3zUKydT.mjs';
-export { A as APIError, d as AlertFilters, e as AlertListResponse, f as AlertSeverity, g as AlertStatus, h as AlertType, C as CipherTextCustomerData, i as CipherTextOptions, j as CipherTextPayload, k as CipherTextReason, l as CipherTextResult, m as ComplianceCheckResponse, n as CreateGeofenceRuleRequest, o as CreateJurisdictionRequest, p as CreateLocationRequestRequest, q as DashboardMetrics, r as DecryptedCipherText, s as DeviceFingerprint, D as DeviceFingerprintRequest, t as DeviceSignalsEnvelope, u as DeviceTrustResult, v as GeoIPResult, w as GeofenceAction, x as GeofenceEvaluation, y as GeofenceRule, z as GeofenceRuleType, B as GeolocationAlert, G as GeolocationClient, E as GeolocationClientConfig, F as GeolocationConfigResponse, H as GeolocationRecord, J as JurisdictionConfig, I as LocationCaptureRequest, K as LocationCaptureResponse, a as LocationRequest, M as LocationRequestChannel, b as LocationRequestFilters, c as LocationRequestListResponse, N as LocationRequestResult, O as LocationRequestStatus, P as LocationShareInfo, L as LocationVerification, R as ResendLocationRequestRequest, S as SignalsNonce, U as UpdateDeviceTrustRequest, Q as UpdateGeofenceRuleRequest, T as UpdateJurisdictionRequest, W as UseAlertsOptions, X as UseAlertsResult, Y as UseGeolocationOptions, Z as UseGeolocationResult, _ as UseLocationCaptureOptions, $ as UseLocationCaptureResult, a0 as UseLocationRequestsOptions, a1 as UseLocationRequestsResult, a2 as ValidateCipherTextRequest, V as ValidateCipherTextResponse, a3 as VerifyIPRequest } from './client-BwXMQA2a.mjs';
+export { A as AmlBlockCallbackData, a as AmlBlockCallbackEvent, b as AmlCallbackCategory, B as BaseWebhookEvent, C as ComplianceCheckFailedPayload, D as DecisionRecordedPayload, G as GeolocationBlockedPayload, c as GeolocationVerifiedPayload, I as InMemoryDedupStore, d as InMemoryDedupStoreOptions, K as KycStatusChangedPayload, L as LabelAppliedPayload, e as LocationRequestCompletedPayload, N as NotificationWebhookEvent, P as ProfileCreatedPayload, f as ProfileUpdatedPayload, R as RiskCategoryChangedPayload, g as RiskScoreChangedPayload, T as TaxReminderSentPayload, V as VerifyWebhookSignatureOptions, W as WebhookAnyHandler, h as WebhookDedupStore, i as WebhookEvent, j as WebhookEventHandler, k as WebhookEventType, l as WebhookHandler, m as WebhookHandlerConfig, n as WebhookMiddlewareOptions, o as WebhookNotification, p as createNextWebhookHandler, q as createWebhookMiddleware, r as isAmlBlockCallbackEvent, v as verifyWebhookSignature } from './index-C49a7fg2.mjs';
+export { A as APIError, d as AlertFilters, e as AlertListResponse, f as AlertSeverity, g as AlertStatus, h as AlertType, C as CipherTextCustomerData, i as CipherTextOptions, j as CipherTextPayload, k as CipherTextReason, l as CipherTextResult, m as ComplianceCheckResponse, n as CreateGeofenceRuleRequest, o as CreateJurisdictionRequest, p as CreateLocationRequestRequest, q as DashboardMetrics, r as DecryptedCipherText, s as DeviceFingerprint, D as DeviceFingerprintRequest, t as DeviceSignalsEnvelope, u as DeviceTrustResult, v as GeoIPResult, w as GeofenceAction, x as GeofenceEvaluation, y as GeofenceRule, z as GeofenceRuleType, B as GeolocationAlert, G as GeolocationClient, E as GeolocationClientConfig, F as GeolocationConfigResponse, H as GeolocationRecord, J as JurisdictionConfig, I as LocationCaptureRequest, K as LocationCaptureResponse, a as LocationRequest, M as LocationRequestChannel, b as LocationRequestFilters, c as LocationRequestListResponse, N as LocationRequestResult, O as LocationRequestStatus, P as LocationShareInfo, L as LocationVerification, R as ResendLocationRequestRequest, S as SignalsNonce, U as UpdateDeviceTrustRequest, Q as UpdateGeofenceRuleRequest, T as UpdateJurisdictionRequest, W as UseAlertsOptions, X as UseAlertsResult, Y as UseGeolocationOptions, Z as UseGeolocationResult, _ as UseLocationCaptureOptions, $ as UseLocationCaptureResult, a0 as UseLocationRequestsOptions, a1 as UseLocationRequestsResult, a2 as ValidateCipherTextRequest, V as ValidateCipherTextResponse, a3 as VerifyIPRequest } from './client-XDEhh9VN.mjs';
 export { GpsIntegrityInput, GpsIntegrityOptions, GpsIntegrityResult, assessGpsIntegrity, collectDeviceSignals, decodeCipherText, generateCipherText, gpsIntegrityInputFromPosition, isCipherTextExpired, probeGeolocationPermission } from './geolocation/index.mjs';
 export { RiskProfileClient } from './risk-profile/index.mjs';
-export { a as CreateCustomerProfileRequest, a as CreateProfileRequest, C as CustomerProfile, P as CustomerProfileFilters, b as CustomerProfileListResponse, E as EmploymentType, L as LegalForm, c as ProfileDetailsResponse, P as ProfileFilters, b as ProfileListResponse, R as RiskCategory, d as RiskConfiguration, e as RiskDashboardMetrics, f as RiskFactor, g as RiskFactorType, h as RiskHistory, S as ScreeningStatus, U as UpdateProfileRequest } from './types-BOFaMQxI.mjs';
+export { a as CreateCustomerProfileRequest, a as CreateProfileRequest, C as CustomerProfile, P as CustomerProfileFilters, b as CustomerProfileListResponse, E as EmploymentType, L as LegalForm, c as ProfileDetailsResponse, P as ProfileFilters, b as ProfileListResponse, d as ProfileUpdateHeldResponse, R as RiskCategory, e as RiskConfiguration, f as RiskDashboardMetrics, g as RiskFactor, h as RiskFactorType, i as RiskHistory, S as ScreeningStatus, U as UpdateProfileRequest, j as UpdateProfileResult, k as isProfileUpdateHeld } from './types-DfbnIaW_.mjs';
 export { sdkReasons } from './compliance/index.mjs';
-export { C as ComplianceClient, a as ComplianceLocationRequestInput, b as ComplianceLocationRequestResult, c as CurrencyRates, D as DEFAULT_CURRENCY_RATES, E as EventVerificationRequest, d as EventVerificationResponse, L as LoginVerificationRequest, e as LoginVerificationResponse, R as RegistrationVerificationRequest, f as RegistrationVerificationResponse, T as TransactionRiskResult, g as TransactionVerificationRequest, h as TransactionVerificationResponse } from './client-D23KhWeh.mjs';
-export { CheckKycStatusRequest, CheckKycStatusResponse, CreateEventBasedFaceVerificationSessionRequest, CreateEventBasedFaceVerificationSessionResponse, DocumentType, DocumentVerificationRequest, DocumentVerificationResponse, EventBasedFaceVerificationCallback, EventBasedFaceVerificationDeviceType, EventBasedFaceVerificationEvent, EventBasedFaceVerificationFrequencyTrigger, EventBasedFaceVerificationReactionResult, EventBasedFaceVerificationReactions, EventBasedFaceVerificationThresholdTrigger, EventBasedFaceVerificationTriggers, FaceProof, KYC_DECLINED_DESCRIPTIONS, KycAlert, KycAlertFilters, KycAlertListResponse, KycAlertStatus, KycAlertType, KycClient, KycClientConfig, KycCustomerData, KycCustomerProfile, KycDeclinedCode, KycDisclosureConsent, KycDocumentExpiredCallbackEvent, KycHandoffSession, KycOtherReason, KycOverview, KycPagination, KycPreferences, KycRequest, KycRequestFilters, KycRequestListResponse, KycRequestReason, KycRequestReasonCode, KycSkipOptions, KycStatus, KycTriggerEvent, KycVerificationTriggers, Name, Proof, ProofDownloadURL, ProofType, RequestAdditionalDocumentsRequest, RequestKycSubmitLinkRequest, RequestKycSubmitLinkResponse, SubmitEventBasedFaceVerificationSessionRequest, SubmittedDocument, SupportedAddressDocumentType, SupportedDocumentType, UpdateKycAlertRequest, UpdateKycPreferencesRequest, UpdateKycStatusRequest, UseKycAlertsOptions, UseKycAlertsResult, UseKycOverviewOptions, UseKycOverviewResult, UseKycPreferencesResult, UseKycRequestsOptions, UseKycRequestsResult, UseKycSubmissionOptions, UseKycSubmissionResult, isKycDocumentExpiredCallbackEvent } from './kyc/index.mjs';
+export { C as ComplianceClient, a as ComplianceLocationRequestInput, b as ComplianceLocationRequestResult, c as CurrencyRates, D as DEFAULT_CURRENCY_RATES, E as EventVerificationRequest, d as EventVerificationResponse, L as LoginVerificationRequest, e as LoginVerificationResponse, R as RegistrationVerificationRequest, f as RegistrationVerificationResponse, T as TransactionRiskResult, g as TransactionVerificationRequest, h as TransactionVerificationResponse } from './client-CJI8VO1i.mjs';
+export { AccountSensitiveActionTrigger, CheckKycStatusRequest, CheckKycStatusResponse, CreateEventBasedFaceVerificationSessionRequest, CreateEventBasedFaceVerificationSessionResponse, DocumentType, DocumentVerificationRequest, DocumentVerificationResponse, EventBasedFaceVerificationCallback, EventBasedFaceVerificationDeviceType, EventBasedFaceVerificationEvent, EventBasedFaceVerificationFrequencyTrigger, EventBasedFaceVerificationReactionResult, EventBasedFaceVerificationReactions, EventBasedFaceVerificationThresholdTrigger, EventBasedFaceVerificationTriggers, FaceProof, KYC_DECLINED_DESCRIPTIONS, KycAlert, KycAlertFilters, KycAlertListResponse, KycAlertStatus, KycAlertType, KycCallbackReactions, KycClient, KycClientConfig, KycCustomerData, KycCustomerProfile, KycDeclinedCode, KycDisclosureConsent, KycDocumentExpiredCallbackEvent, KycHandoffSession, KycOtherReason, KycOverview, KycPagination, KycPreferences, KycRequest, KycRequestFilters, KycRequestListResponse, KycRequestReason, KycRequestReasonCode, KycSkipOptions, KycStatus, KycTriggerEvent, KycVerificationTriggers, Name, ProfileChangeCallbackEvent, ProfileChangeField, ProfileChangeStatus, Proof, ProofDownloadURL, ProofType, RequestAdditionalDocumentsRequest, RequestKycSubmitLinkRequest, RequestKycSubmitLinkResponse, SubmitEventBasedFaceVerificationSessionRequest, SubmittedDocument, SupportedAddressDocumentType, SupportedDocumentType, UpdateKycAlertRequest, UpdateKycPreferencesRequest, UpdateKycStatusRequest, UseKycAlertsOptions, UseKycAlertsResult, UseKycOverviewOptions, UseKycOverviewResult, UseKycPreferencesResult, UseKycRequestsOptions, UseKycRequestsResult, UseKycSubmissionOptions, UseKycSubmissionResult, isKycDocumentExpiredCallbackEvent, isProfileChangeCallbackEvent } from './kyc/index.mjs';
 export { CTPFormStatus, CTPTINStatus, ComplianceStats, ComplianceStatsFilters, CustomerTaxProfileDocuments, CustomerTaxProfileRecord, CustomerType, DocumentRequestBreakdown, EmailSendingMethod, EnableWithholdingInput, EnableWithholdingResponse, GlobalTaxRule, ReRequestTaxFormInput, RemindersRunResult, TINCheckResult, TINStatusBreakdown, TaxClient, TaxClientConfig, TaxRuleApprovalStatus, TaxRuleVersion, TaxRules, TransactionAction, TreatyCountry, TreatyCountryListResponse, UpdateTaxRulesInput, WFormCountBreakdown, WFormStatusBreakdown } from './tax/index.mjs';
 
 /**
@@ -83,6 +83,6 @@ declare const noopLogger: Logger;
 /**
  * Single source of truth for the SDK version.
  */
-declare const SDK_VERSION = "1.7.2";
+declare const SDK_VERSION = "1.8.0";
 
 export { AuthenticationError, CGSError, CircuitBreakerOpenError, ComplianceBlockedError, ComplianceError, Logger, NetworkError, PaginatedResponse, RateLimitError, SDK_VERSION, ServiceUnavailableError, TimeoutError, ValidationError, VesantError, collectAll, createConsoleLogger, noopLogger, paginate };

package/dist/index.d.ts

@@ -2,14 +2,14 @@ import { L as Logger } from './client-q9fN8Hhf.js';
 export { A as AuthCredential, B as BaseClient, a as BaseClientConfig, C as CGSConfig, b as CircuitBreaker, c as CircuitBreakerConfig, d as CircuitBreakerState, e as CircuitBreakerStatus, f as RateLimitStatus, g as RateLimitTracker, h as RefreshingTokenProvider, i as RefreshingTokenProviderOptions, j as RequestInterceptor, R as RequestOptions, k as RequiredBaseClientConfig, l as RequiredCGSConfig, m as RequiredVesantConfig, S as StaticApiKeyProvider, T as TokenProvider, n as TokenProviderContext, V as VesantConfig } from './client-q9fN8Hhf.js';
 import { a as PaginatedResponse } from './types-CBQRNL-l.js';
 export { A as APIResponse, B as BlockReason, C as CustomerStatus, E as EntityType, b as ErrorResponse, L as LocationCompliance, P as PaginationParams, c as Reason, d as Result, R as RiskLevel, S as SuccessResponse, T as Timestamp, U as UUID, V as VerificationEventType } from './types-CBQRNL-l.js';
-export { B as BaseWebhookEvent, C as ComplianceCheckFailedPayload, D as DecisionRecordedPayload, G as GeolocationBlockedPayload, a as GeolocationVerifiedPayload, I as InMemoryDedupStore, b as InMemoryDedupStoreOptions, K as KycStatusChangedPayload, L as LabelAppliedPayload, c as LocationRequestCompletedPayload, N as NotificationWebhookEvent, P as ProfileCreatedPayload, d as ProfileUpdatedPayload, R as RiskCategoryChangedPayload, e as RiskScoreChangedPayload, T as TaxReminderSentPayload, V as VerifyWebhookSignatureOptions, W as WebhookAnyHandler, f as WebhookDedupStore, g as WebhookEvent, h as WebhookEventHandler, i as WebhookEventType, j as WebhookHandler, k as WebhookHandlerConfig, l as WebhookMiddlewareOptions, m as WebhookNotification, n as createNextWebhookHandler, o as createWebhookMiddleware, v as verifyWebhookSignature } from './index-DSDgS09k.js';
-export { A as APIError, d as AlertFilters, e as AlertListResponse, f as AlertSeverity, g as AlertStatus, h as AlertType, C as CipherTextCustomerData, i as CipherTextOptions, j as CipherTextPayload, k as CipherTextReason, l as CipherTextResult, m as ComplianceCheckResponse, n as CreateGeofenceRuleRequest, o as CreateJurisdictionRequest, p as CreateLocationRequestRequest, q as DashboardMetrics, r as DecryptedCipherText, s as DeviceFingerprint, D as DeviceFingerprintRequest, t as DeviceSignalsEnvelope, u as DeviceTrustResult, v as GeoIPResult, w as GeofenceAction, x as GeofenceEvaluation, y as GeofenceRule, z as GeofenceRuleType, B as GeolocationAlert, G as GeolocationClient, E as GeolocationClientConfig, F as GeolocationConfigResponse, H as GeolocationRecord, J as JurisdictionConfig, I as LocationCaptureRequest, K as LocationCaptureResponse, a as LocationRequest, M as LocationRequestChannel, b as LocationRequestFilters, c as LocationRequestListResponse, N as LocationRequestResult, O as LocationRequestStatus, P as LocationShareInfo, L as LocationVerification, R as ResendLocationRequestRequest, S as SignalsNonce, U as UpdateDeviceTrustRequest, Q as UpdateGeofenceRuleRequest, T as UpdateJurisdictionRequest, W as UseAlertsOptions, X as UseAlertsResult, Y as UseGeolocationOptions, Z as UseGeolocationResult, _ as UseLocationCaptureOptions, $ as UseLocationCaptureResult, a0 as UseLocationRequestsOptions, a1 as UseLocationRequestsResult, a2 as ValidateCipherTextRequest, V as ValidateCipherTextResponse, a3 as VerifyIPRequest } from './client-fy3trF2K.js';
+export { A as AmlBlockCallbackData, a as AmlBlockCallbackEvent, b as AmlCallbackCategory, B as BaseWebhookEvent, C as ComplianceCheckFailedPayload, D as DecisionRecordedPayload, G as GeolocationBlockedPayload, c as GeolocationVerifiedPayload, I as InMemoryDedupStore, d as InMemoryDedupStoreOptions, K as KycStatusChangedPayload, L as LabelAppliedPayload, e as LocationRequestCompletedPayload, N as NotificationWebhookEvent, P as ProfileCreatedPayload, f as ProfileUpdatedPayload, R as RiskCategoryChangedPayload, g as RiskScoreChangedPayload, T as TaxReminderSentPayload, V as VerifyWebhookSignatureOptions, W as WebhookAnyHandler, h as WebhookDedupStore, i as WebhookEvent, j as WebhookEventHandler, k as WebhookEventType, l as WebhookHandler, m as WebhookHandlerConfig, n as WebhookMiddlewareOptions, o as WebhookNotification, p as createNextWebhookHandler, q as createWebhookMiddleware, r as isAmlBlockCallbackEvent, v as verifyWebhookSignature } from './index-BosFSGan.js';
+export { A as APIError, d as AlertFilters, e as AlertListResponse, f as AlertSeverity, g as AlertStatus, h as AlertType, C as CipherTextCustomerData, i as CipherTextOptions, j as CipherTextPayload, k as CipherTextReason, l as CipherTextResult, m as ComplianceCheckResponse, n as CreateGeofenceRuleRequest, o as CreateJurisdictionRequest, p as CreateLocationRequestRequest, q as DashboardMetrics, r as DecryptedCipherText, s as DeviceFingerprint, D as DeviceFingerprintRequest, t as DeviceSignalsEnvelope, u as DeviceTrustResult, v as GeoIPResult, w as GeofenceAction, x as GeofenceEvaluation, y as GeofenceRule, z as GeofenceRuleType, B as GeolocationAlert, G as GeolocationClient, E as GeolocationClientConfig, F as GeolocationConfigResponse, H as GeolocationRecord, J as JurisdictionConfig, I as LocationCaptureRequest, K as LocationCaptureResponse, a as LocationRequest, M as LocationRequestChannel, b as LocationRequestFilters, c as LocationRequestListResponse, N as LocationRequestResult, O as LocationRequestStatus, P as LocationShareInfo, L as LocationVerification, R as ResendLocationRequestRequest, S as SignalsNonce, U as UpdateDeviceTrustRequest, Q as UpdateGeofenceRuleRequest, T as UpdateJurisdictionRequest, W as UseAlertsOptions, X as UseAlertsResult, Y as UseGeolocationOptions, Z as UseGeolocationResult, _ as UseLocationCaptureOptions, $ as UseLocationCaptureResult, a0 as UseLocationRequestsOptions, a1 as UseLocationRequestsResult, a2 as ValidateCipherTextRequest, V as ValidateCipherTextResponse, a3 as VerifyIPRequest } from './client-BaUekQT8.js';
 export { GpsIntegrityInput, GpsIntegrityOptions, GpsIntegrityResult, assessGpsIntegrity, collectDeviceSignals, decodeCipherText, generateCipherText, gpsIntegrityInputFromPosition, isCipherTextExpired, probeGeolocationPermission } from './geolocation/index.js';
 export { RiskProfileClient } from './risk-profile/index.js';
-export { a as CreateCustomerProfileRequest, a as CreateProfileRequest, C as CustomerProfile, P as CustomerProfileFilters, b as CustomerProfileListResponse, E as EmploymentType, L as LegalForm, c as ProfileDetailsResponse, P as ProfileFilters, b as ProfileListResponse, R as RiskCategory, d as RiskConfiguration, e as RiskDashboardMetrics, f as RiskFactor, g as RiskFactorType, h as RiskHistory, S as ScreeningStatus, U as UpdateProfileRequest } from './types-UGyDl1fd.js';
+export { a as CreateCustomerProfileRequest, a as CreateProfileRequest, C as CustomerProfile, P as CustomerProfileFilters, b as CustomerProfileListResponse, E as EmploymentType, L as LegalForm, c as ProfileDetailsResponse, P as ProfileFilters, b as ProfileListResponse, d as ProfileUpdateHeldResponse, R as RiskCategory, e as RiskConfiguration, f as RiskDashboardMetrics, g as RiskFactor, h as RiskFactorType, i as RiskHistory, S as ScreeningStatus, U as UpdateProfileRequest, j as UpdateProfileResult, k as isProfileUpdateHeld } from './types-1kI4SsKB.js';
 export { sdkReasons } from './compliance/index.js';
-export { C as ComplianceClient, a as ComplianceLocationRequestInput, b as ComplianceLocationRequestResult, c as CurrencyRates, D as DEFAULT_CURRENCY_RATES, E as EventVerificationRequest, d as EventVerificationResponse, L as LoginVerificationRequest, e as LoginVerificationResponse, R as RegistrationVerificationRequest, f as RegistrationVerificationResponse, T as TransactionRiskResult, g as TransactionVerificationRequest, h as TransactionVerificationResponse } from './client-B3DCAHlg.js';
-export { CheckKycStatusRequest, CheckKycStatusResponse, CreateEventBasedFaceVerificationSessionRequest, CreateEventBasedFaceVerificationSessionResponse, DocumentType, DocumentVerificationRequest, DocumentVerificationResponse, EventBasedFaceVerificationCallback, EventBasedFaceVerificationDeviceType, EventBasedFaceVerificationEvent, EventBasedFaceVerificationFrequencyTrigger, EventBasedFaceVerificationReactionResult, EventBasedFaceVerificationReactions, EventBasedFaceVerificationThresholdTrigger, EventBasedFaceVerificationTriggers, FaceProof, KYC_DECLINED_DESCRIPTIONS, KycAlert, KycAlertFilters, KycAlertListResponse, KycAlertStatus, KycAlertType, KycClient, KycClientConfig, KycCustomerData, KycCustomerProfile, KycDeclinedCode, KycDisclosureConsent, KycDocumentExpiredCallbackEvent, KycHandoffSession, KycOtherReason, KycOverview, KycPagination, KycPreferences, KycRequest, KycRequestFilters, KycRequestListResponse, KycRequestReason, KycRequestReasonCode, KycSkipOptions, KycStatus, KycTriggerEvent, KycVerificationTriggers, Name, Proof, ProofDownloadURL, ProofType, RequestAdditionalDocumentsRequest, RequestKycSubmitLinkRequest, RequestKycSubmitLinkResponse, SubmitEventBasedFaceVerificationSessionRequest, SubmittedDocument, SupportedAddressDocumentType, SupportedDocumentType, UpdateKycAlertRequest, UpdateKycPreferencesRequest, UpdateKycStatusRequest, UseKycAlertsOptions, UseKycAlertsResult, UseKycOverviewOptions, UseKycOverviewResult, UseKycPreferencesResult, UseKycRequestsOptions, UseKycRequestsResult, UseKycSubmissionOptions, UseKycSubmissionResult, isKycDocumentExpiredCallbackEvent } from './kyc/index.js';
+export { C as ComplianceClient, a as ComplianceLocationRequestInput, b as ComplianceLocationRequestResult, c as CurrencyRates, D as DEFAULT_CURRENCY_RATES, E as EventVerificationRequest, d as EventVerificationResponse, L as LoginVerificationRequest, e as LoginVerificationResponse, R as RegistrationVerificationRequest, f as RegistrationVerificationResponse, T as TransactionRiskResult, g as TransactionVerificationRequest, h as TransactionVerificationResponse } from './client-4oLoc31v.js';
+export { AccountSensitiveActionTrigger, CheckKycStatusRequest, CheckKycStatusResponse, CreateEventBasedFaceVerificationSessionRequest, CreateEventBasedFaceVerificationSessionResponse, DocumentType, DocumentVerificationRequest, DocumentVerificationResponse, EventBasedFaceVerificationCallback, EventBasedFaceVerificationDeviceType, EventBasedFaceVerificationEvent, EventBasedFaceVerificationFrequencyTrigger, EventBasedFaceVerificationReactionResult, EventBasedFaceVerificationReactions, EventBasedFaceVerificationThresholdTrigger, EventBasedFaceVerificationTriggers, FaceProof, KYC_DECLINED_DESCRIPTIONS, KycAlert, KycAlertFilters, KycAlertListResponse, KycAlertStatus, KycAlertType, KycCallbackReactions, KycClient, KycClientConfig, KycCustomerData, KycCustomerProfile, KycDeclinedCode, KycDisclosureConsent, KycDocumentExpiredCallbackEvent, KycHandoffSession, KycOtherReason, KycOverview, KycPagination, KycPreferences, KycRequest, KycRequestFilters, KycRequestListResponse, KycRequestReason, KycRequestReasonCode, KycSkipOptions, KycStatus, KycTriggerEvent, KycVerificationTriggers, Name, ProfileChangeCallbackEvent, ProfileChangeField, ProfileChangeStatus, Proof, ProofDownloadURL, ProofType, RequestAdditionalDocumentsRequest, RequestKycSubmitLinkRequest, RequestKycSubmitLinkResponse, SubmitEventBasedFaceVerificationSessionRequest, SubmittedDocument, SupportedAddressDocumentType, SupportedDocumentType, UpdateKycAlertRequest, UpdateKycPreferencesRequest, UpdateKycStatusRequest, UseKycAlertsOptions, UseKycAlertsResult, UseKycOverviewOptions, UseKycOverviewResult, UseKycPreferencesResult, UseKycRequestsOptions, UseKycRequestsResult, UseKycSubmissionOptions, UseKycSubmissionResult, isKycDocumentExpiredCallbackEvent, isProfileChangeCallbackEvent } from './kyc/index.js';
 export { CTPFormStatus, CTPTINStatus, ComplianceStats, ComplianceStatsFilters, CustomerTaxProfileDocuments, CustomerTaxProfileRecord, CustomerType, DocumentRequestBreakdown, EmailSendingMethod, EnableWithholdingInput, EnableWithholdingResponse, GlobalTaxRule, ReRequestTaxFormInput, RemindersRunResult, TINCheckResult, TINStatusBreakdown, TaxClient, TaxClientConfig, TaxRuleApprovalStatus, TaxRuleVersion, TaxRules, TransactionAction, TreatyCountry, TreatyCountryListResponse, UpdateTaxRulesInput, WFormCountBreakdown, WFormStatusBreakdown } from './tax/index.js';
 
 /**
@@ -83,6 +83,6 @@ declare const noopLogger: Logger;
 /**
  * Single source of truth for the SDK version.
  */
-declare const SDK_VERSION = "1.7.2";
+declare const SDK_VERSION = "1.8.0";
 
 export { AuthenticationError, CGSError, CircuitBreakerOpenError, ComplianceBlockedError, ComplianceError, Logger, NetworkError, PaginatedResponse, RateLimitError, SDK_VERSION, ServiceUnavailableError, TimeoutError, ValidationError, VesantError, collectAll, createConsoleLogger, noopLogger, paginate };

package/dist/index.js

@@ -298,7 +298,7 @@ var noopLogger = {
 };
 
 // src/core/version.ts
-var SDK_VERSION = "1.7.2";
+var SDK_VERSION = "1.8.0";
 
 // src/shared/browser-utils.ts
 function generateUUID() {
@@ -1104,6 +1104,7 @@ function isCipherTextExpired(cipherText) {
 }
 
 // src/geolocation/client.ts
+var DEFAULT_GPS_CONFIG_TTL_MS = 5 * 60 * 1e3;
 var GeolocationClient = class extends BaseClient {
   constructor(config) {
     const baseConfig = {
@@ -1119,6 +1120,8 @@ var GeolocationClient = class extends BaseClient {
       environment: config.environment
     };
     super(baseConfig);
+    this.gpsConfigCache = null;
+    this.gpsConfigTtlMs = config.gpsConfigTtlMs ?? DEFAULT_GPS_CONFIG_TTL_MS;
   }
   // ============================================================================
   // IP Verification & Compliance
@@ -1204,7 +1207,42 @@ var GeolocationClient = class extends BaseClient {
    * ```
    */
   async getGPSConfig(requestOptions) {
-    return this.requestWithRetry("/api/v1/geo/config", void 0, void 0, void 0, requestOptions);
+    const cached = this.gpsConfigCache;
+    if (cached && cached.expiresAt > Date.now()) {
+      return cached.value;
+    }
+    return this.refreshGPSConfig(requestOptions);
+  }
+  /**
+   * Re-read the tenant's GPS requirement configuration, ignoring any copy held
+   * from an earlier read.
+   *
+   * These requirements are edited in the compliance console while your
+   * application is running. `getGPSConfig` reuses a fetched copy for a short
+   * period so a long-lived session does not call the API on every event; call
+   * this when you need a change to take effect immediately — for example right
+   * after an administrator saves new settings.
+   *
+   * @returns The current GPS requirement config per event type
+   *
+   * @example
+   * ```typescript
+   * const config = await client.refreshGPSConfig();
+   * if (config.require_gps.login) {
+   *   // GPS is now required for login
+   * }
+   * ```
+   */
+  async refreshGPSConfig(requestOptions) {
+    const value = await this.requestWithRetry(
+      "/api/v1/geo/config",
+      void 0,
+      void 0,
+      void 0,
+      requestOptions
+    );
+    this.gpsConfigCache = { value, expiresAt: Date.now() + this.gpsConfigTtlMs };
+    return value;
   }
   /**
    * Mint a short-lived, single-use device-signals nonce.
@@ -1621,17 +1659,27 @@ var RiskProfileClient = class extends BaseClient {
   /**
    * Update customer profile
    *
+   * Omitted fields keep their stored values. When the tenant has the
+   * **On Account Sensitive Action** KYC trigger enabled and the update changes
+   * the customer's name, date of birth or residential address, Vesant applies
+   * the other fields, holds the sensitive ones and answers `202` with a
+   * {@link ProfileUpdateHeldResponse} instead of the profile. Narrow with
+   * {@link isProfileUpdateHeld}, then request a `profile_change` submit link.
+   *
    * @param profileId - Profile UUID
    * @param updates - Fields to update
-   * @returns Updated customer profile
+   * @returns Updated customer profile, or the held change
    *
    * @example
    * ```typescript
-   * const updated = await client.updateProfile(profileId, {
+   * const result = await client.updateProfile(profileId, {
    *   location: 'New York, USA',
    *   location_compliance: 'compliant',
    *   last_recorded_activity: new Date().toISOString()
    * });
+   * if (isProfileUpdateHeld(result)) {
+   *   // name / DOB / address held: start KYC with trigger_event 'profile_change'
+   * }
    * ```
    */
   async updateProfile(profileId, updates, requestOptions) {
@@ -1671,6 +1719,11 @@ var RiskProfileClient = class extends BaseClient {
   }
 };
 
+// src/risk-profile/types.ts
+function isProfileUpdateHeld(result) {
+  return typeof result === "object" && result !== null && result.status === "kyc_required" && result.kyc_required === true;
+}
+
 // src/compliance/block-reasons.ts
 var sdkReasons = {
   // Jurisdiction
@@ -2201,11 +2254,12 @@ var ComplianceClient = class {
       if (profileResult) {
         profile = profileResult;
         if (!isBlocked && this.shouldUpdateProfile(profile, geoVerification.location.city)) {
-          profile = await this.riskClient.updateProfile(profile.id, {
+          const updated = await this.riskClient.updateProfile(profile.id, {
             last_recorded_activity: (/* @__PURE__ */ new Date()).toISOString(),
             location: `${geoVerification.location.city}, ${geoVerification.location.country}`,
             location_compliance: geoVerification.is_compliant ? "compliant" : "non-compliant"
           }, requestOptions);
+          profile = isProfileUpdateHeld(updated) ? updated.profile : updated;
         }
       } else {
         if (this.config.autoCreateProfiles && this.config.debug) {
@@ -3151,19 +3205,26 @@ var KycClient = class extends BaseClient {
     }, void 0, requestOptions);
   }
   /**
-   * Get a KYC request by ID
+   * Get a KYC record by ID
+   *
+   * Works with your tenant API key. Each entry in `proofs` carries a
+   * short-lived `link` for downloading that document, and `reference` holds
+   * your own customer reference (the `forward_reference`).
    *
-   * @param id - KYC request ID
-   * @returns KYC request details including proofs and alerts
+   * @param id - KYC record ID (the `kyc_id` returned by `requestKycSubmitLink`)
+   * @returns KYC record including proofs (with download links) and alerts
    *
    * @example
    * ```typescript
    * const kyc = await client.getKycRequest("550e8400-e29b-41d4-a716-446655440000");
    * console.log(`Status: ${kyc.status}, ID Verified: ${kyc.id_verified}`);
+   * kyc.proofs?.forEach(proof => console.log(`${proof.type}: ${proof.link}`));
    * ```
    */
   async getKycRequest(id) {
-    return this.request(`/api/v1/kyc/requests/${id}`);
+    return this.request(`/api/v1/kyc/${encodeURIComponent(id)}`, {
+      headers: this.getUserHeaders()
+    });
   }
   /**
    * List KYC requests with filters and pagination
@@ -3180,6 +3241,10 @@ var KycClient = class extends BaseClient {
    * );
    * console.log(`Found ${requests.total} pending requests`);
    * ```
+   *
+   * @remarks Console session only. This endpoint accepts a Vesant console
+   * (dashboard login) token, not a tenant API key; called with an API key it
+   * fails with `AuthenticationError` or a permission error.
    */
   async listKycRequests(filters, pagination) {
     const params = {};
@@ -3217,6 +3282,10 @@ var KycClient = class extends BaseClient {
    *   reason: "Document expired"
    * });
    * ```
+   *
+   * @remarks Console session only. This endpoint accepts a Vesant console
+   * (dashboard login) token, not a tenant API key; called with an API key it
+   * fails with `AuthenticationError` or a permission error.
    */
   async updateKycStatus(request) {
     await this.request("/api/v1/kyc/status", {
@@ -3253,22 +3322,24 @@ var KycClient = class extends BaseClient {
   /**
    * Get downloadable URLs for KYC proofs/documents
    *
-   * @param kycId - KYC request ID
-   * @returns Array of proof download URLs with expiration
+   * Derived from the `proofs` of `getKycRequest`: the platform attaches a
+   * short-lived download link to every proof on the KYC record, so no
+   * separate endpoint is needed. Proofs without a link are omitted.
+   *
+   * @param kycId - KYC record ID
+   * @returns Array of proof download URLs
    *
    * @example
    * ```typescript
    * const proofs = await client.getProofDownloadURLs("550e8400-e29b-41d4-a716-446655440000");
    * proofs.forEach(proof => {
-   *   console.log(`${proof.type}: ${proof.url} (expires: ${proof.expires_at})`);
+   *   console.log(`${proof.type}: ${proof.url}`);
    * });
    * ```
    */
   async getProofDownloadURLs(kycId) {
-    return this.request(
-      `/api/v1/kyc/proofs/${kycId}`,
-      { headers: this.getUserHeaders() }
-    );
+    const kyc = await this.getKycRequest(kycId);
+    return (kyc.proofs ?? []).filter((proof) => typeof proof.link === "string" && proof.link !== "").map((proof) => ({ id: proof.id, type: proof.type, url: proof.link }));
   }
   // ============================================================================
   // KYC Overview & Statistics
@@ -3289,6 +3360,10 @@ var KycClient = class extends BaseClient {
    * console.log(`Total: ${overview.total}, Pending: ${overview.pending}`);
    * console.log(`Approved: ${overview.approved}, Rejected: ${overview.rejected}`);
    * ```
+   *
+   * @remarks Console session only. This endpoint accepts a Vesant console
+   * (dashboard login) token, not a tenant API key; called with an API key it
+   * fails with `AuthenticationError` or a permission error.
    */
   async getOverview(fromDate, toDate) {
     const params = {};
@@ -3306,6 +3381,10 @@ var KycClient = class extends BaseClient {
    *
    * @param alertId - Alert ID
    * @returns Alert details
+   *
+   * @remarks Console session only. This endpoint accepts a Vesant console
+   * (dashboard login) token, not a tenant API key; called with an API key it
+   * fails with `AuthenticationError` or a permission error.
    */
   async getAlert(alertId) {
     return this.request(`/api/v1/kyc/alerts/${alertId}`);
@@ -3329,6 +3408,10 @@ var KycClient = class extends BaseClient {
    * );
    * console.log(`Found ${alerts.total} alerts`);
    * ```
+   *
+   * @remarks Console session only. This endpoint accepts a Vesant console
+   * (dashboard login) token, not a tenant API key; called with an API key it
+   * fails with `AuthenticationError` or a permission error.
    */
   async listAlerts(filters, pagination) {
     const params = {};
@@ -3375,6 +3458,10 @@ var KycClient = class extends BaseClient {
    *   reason: "Requires senior review - suspicious documents"
    * });
    * ```
+   *
+   * @remarks Console session only. This endpoint accepts a Vesant console
+   * (dashboard login) token, not a tenant API key; called with an API key it
+   * fails with `AuthenticationError` or a permission error.
    */
   async updateAlert(alertId, update) {
     await this.request(`/api/v1/kyc/alerts/${alertId}`, {
@@ -3397,6 +3484,10 @@ var KycClient = class extends BaseClient {
    * console.log(`Face verification required: ${prefs.is_face_verification_required}`);
    * console.log(`Required documents: ${prefs.required_document_count}`);
    * ```
+   *
+   * @remarks Console session only. This endpoint accepts a Vesant console
+   * (dashboard login) token, not a tenant API key; called with an API key it
+   * fails with `AuthenticationError` or a permission error.
    */
   async getPreferences() {
     return this.request("/api/v1/kyc/preferences");
@@ -3570,6 +3661,9 @@ var KYC_DECLINED_DESCRIPTIONS = {
 function isKycDocumentExpiredCallbackEvent(value) {
   return typeof value === "object" && value !== null && value.event === "kyc_document_expired";
 }
+function isProfileChangeCallbackEvent(value) {
+  return typeof value === "object" && value !== null && value.event === "profile_change";
+}
 
 // src/tax/client.ts
 var TaxClient = class extends BaseClient {
@@ -3859,6 +3953,11 @@ function buildHandler(options) {
   return handler;
 }
 
+// src/webhooks/types.ts
+function isAmlBlockCallbackEvent(value) {
+  return typeof value === "object" && value !== null && value.event === "aml" && value.block === true;
+}
+
 exports.AuthenticationError = AuthenticationError;
 exports.BaseClient = BaseClient;
 exports.CGSError = CGSError;
@@ -3894,8 +3993,11 @@ exports.createWebhookMiddleware = createWebhookMiddleware;
 exports.decodeCipherText = decodeCipherText;
 exports.generateCipherText = generateCipherText;
 exports.gpsIntegrityInputFromPosition = gpsIntegrityInputFromPosition;
+exports.isAmlBlockCallbackEvent = isAmlBlockCallbackEvent;
 exports.isCipherTextExpired = isCipherTextExpired;
 exports.isKycDocumentExpiredCallbackEvent = isKycDocumentExpiredCallbackEvent;
+exports.isProfileChangeCallbackEvent = isProfileChangeCallbackEvent;
+exports.isProfileUpdateHeld = isProfileUpdateHeld;
 exports.noopLogger = noopLogger;
 exports.paginate = paginate;
 exports.probeGeolocationPermission = probeGeolocationPermission;