noresponse 2.1.14 → 3.0.0

data/lib/no_response/models/shared/assessment.rb

@@ -4,23 +4,13 @@
 module NoResponse
   module Models
     module Shared
-      # One assessment of one account, as POST /v1/assessments, GET /v1/assessments/{assessment_id} and the assessment.updated webhook return it. status says whether it is final (complete), usable with a source still running (partial) or not yet usable (pending). risk and recommendation are present for complete and partial; assessment_url is present for pending. Keep the highest assessment_version.
+      # One assessment, as POST /v1/assessments, GET /v1/assessments/{assessment_id} and the assessment.updated webhook return it. account is the account's one current risk: its score, the decision for this assessment's flow, the reasons and the decision for each flow. detail holds this assessment's own facts. status says whether the assessment is final (complete), usable with a source still running (partial) or not yet usable (pending). While the account's first assessment is pending, account is absent; wait for the webhook or poll the assessment. Keep the highest detail.assessment_version.
       class Assessment
         extend T::Sig
         include Crystalline::MetadataFields
 
-        # Opaque, server-assigned assessment id: 'asm_' and a 26-character Crockford base32 ULID. Unique within the tenant; another tenant's assessment id answers 404.
-        field(
-          :assessment_id,
-          ::String,
-          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("assessment_id"), required: true}}
-        )
-        # Your own opaque identifier for the account being checked, scoped to your tenant. Use an id you mint, with no direct identifier (email, phone, name or national id) in it. '|' is accepted so an Auth0 user id such as 'auth0|64abc' passes unchanged; '@', '+', '$' and whitespace are refused by the pattern, as is an exact-shape JWT; a hex digest such as a SHA-256 is allowed, because hashing an internal id is a common pseudonymous scheme. A value such as '07700900123' or 'jane.doe.gmail.com' cannot be told apart from an opaque id. It travels in bodies, and in a URL only as the path segment of GET /v1/accounts/{account_id} and its /assessments. An assessment requested by a provider hook at pre_registration, which has no account yet, carries the server-issued account_id pre: followed by its assessment_id.
-        field(
-          :account_id,
-          ::String,
-          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("account_id"), required: true}}
-        )
+        # This assessment's id, equal to detail.assessment_id.
+        field :id, ::String, {'format_json': {'letter_case': ::NoResponse::Utils.field_name("id"), required: true}}
         # complete: final; nothing is still running. A lane that failed or missed its 10 s deadline stays listed in incomplete_sources, and confidence is lower. partial: a recommendation exists and at least one lane is still running or did not settle (see incomplete_sources). pending: nothing usable before the deadline; no recommendation yet, poll or wait for the webhook.
         field(
           :status,
@@ -33,210 +23,85 @@ module NoResponse
             }
           }
         )
-        # Ordinal confidence in the recommendation under the current policy: low, medium, high or unavailable.
+        # The customer event an assessment is made for: signup (a new account), login (a returning sign-in) or purchase (a payment or credit grant). The account's risk is reported with the decision for this flow.
         field(
-          :confidence,
-          Models::Shared::Confidence,
+          :flow,
+          Models::Shared::Flow,
           {
             'format_json': {
-              'letter_case': ::NoResponse::Utils.field_name("confidence"),
+              'letter_case': ::NoResponse::Utils.field_name("flow"),
               required: true,
-              'decoder': ::NoResponse::Utils.open_enum_from_string(Models::Shared::Confidence, false)
+              'decoder': ::NoResponse::Utils.open_enum_from_string(Models::Shared::Flow, false)
             }
           }
         )
-        # The lanes that did not settle, each listed once with a reason; lanes, not sources. In a detailed view a lane is listed exactly when one of its signals did not settle; a standard view carries no signals to match.
+        # How long the synchronous answer waits for sources. quick waits only for the fast sources, those that answer within 500 ms of ingress (or deadline_ms when lower); full waits for the whole budget, up to 3000 ms. Sources still running at the cut continue asynchronously and update the assessment either way.
         field(
-          :incomplete_sources,
-          Crystalline::Array.new(Models::Shared::IncompleteSource),
-          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("incomplete_sources"), required: true}}
-        )
-        # Version of the hand-authored heuristic weights that produced the recommendation, for example 'risk-2026-10.7'. A tenant threshold override adds a +t<N> suffix, e.g. 'risk-2026-10.7+t3'.
-        field(
-          :policy_version,
-          ::String,
-          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("policy_version"), required: true}}
-        )
-        # Monotonic revision of this assessment. 1 on the synchronous answer; each material change while the assessment is served (an async continuation settling a source, a change of recommendation, confidence or status) increments it. Expiry does not increment it: an expired assessment is gone, not revised, and the expiry webhook carries the last served version.
-        field(
-          :assessment_version,
-          ::Integer,
-          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("assessment_version"), required: true}}
-        )
-        # When the assessment was created. Fixed for the life of the assessment: every revision carries the same created_at.
-        field(
-          :created_at,
-          ::String,
-          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("created_at"), required: true}}
-        )
-
-        field(
-          :updated_at,
-          ::String,
-          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("updated_at"), required: true}}
-        )
-        # After this instant the assessment is no longer served: GET /v1/assessments/{assessment_id} answers 404 and it leaves the account history. It is created_at plus your retention period at creation (default and maximum 365 days) and is fixed per record: a later revision keeps it, and a new assessment for the same account starts its own clock. If you later shorten retention, the effective expiry becomes created_at plus the shorter of the two periods.
-        field(
-          :expires_at,
-          ::String,
-          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("expires_at"), required: true}}
-        )
-
-        field(
-          :timing,
-          Models::Shared::AssessmentTiming,
-          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("timing"), required: true}}
-        )
-        # Version of the body shape.
-        field(
-          :schema_version,
-          ::String,
-          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("schema_version"), required: true}}
-        )
-        # An optional provider correlation id, echoed back. It is not an idempotency key. Refuses an exact-shape JWT or a bare 40, 64 or 128 character hex digest; a UUID is accepted.
-        field(
-          :request_id,
-          Crystalline::Nilable.new(::String),
-          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("request_id")}}
-        )
-        # The recommended action: allow, step_up or review. Your application applies it.
-        field(
-          :recommendation,
-          Crystalline::Nilable.new(Models::Shared::Recommendation),
+          :depth,
+          Models::Shared::Depth,
           {
             'format_json': {
-              'letter_case': ::NoResponse::Utils.field_name("recommendation"),
-              'decoder': ::NoResponse::Utils.open_enum_from_string(Models::Shared::Recommendation, true)
+              'letter_case': ::NoResponse::Utils.field_name("depth"),
+              required: true,
+              'decoder': ::NoResponse::Utils.open_enum_from_string(Models::Shared::Depth, false)
             }
           }
         )
-        # The one risk decision for this event. score is 0 (safe) to 100 (risky): the sum of the weights of the reasons that fired, clamped to 0 to 100, from hand-set versioned weights. Every answer with a recommendation carries it, and the top-level recommendation equals risk.recommendation. It names no source or provider.
-        field(
-          :risk,
-          Crystalline::Nilable.new(Models::Shared::Risk),
-          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("risk")}}
-        )
-        # Detailed view only (response_mode=detailed, which needs the detailed scope): a standard answer omits signals[], and a detailed one always carries it, possibly empty. The body does not name its mode, so that rule is the serving gate's; the schema states the half it can: an answer with risk.details is a detailed view and carries signals[]. At most one signal per (type, source_id, identifier).
+        # One assessment's own facts: its score and recommendation, the signals behind them, the lanes still running and its timing. risk here is this assessment's own score; the account's current risk is the account member of the assessment. risk and recommendation are present for complete and partial; assessment_url is present for pending.
         field(
-          :signals,
-          Crystalline::Nilable.new(Crystalline::Array.new(Models::Shared::Signal)),
-          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("signals")}}
+          :detail,
+          Models::Shared::AssessmentDetail,
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("detail"), required: true}}
         )
-        # Labels the v0 policy as hand-authored and not statistically validated.
+        # Version of the body shape.
         field(
-          :policy_basis,
+          :schema_version,
           ::String,
-          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("policy_basis"), required: true}}
-        )
-        # Server-relative path of the authoritative assessment, GET /v1/assessments/{assessment_id}.
-        field(
-          :assessment_url,
-          Crystalline::Nilable.new(::String),
-          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("assessment_url")}}
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("schema_version"), required: true}}
         )
-        # The identity fields of the auth context the assessment was made with, echoed for the tenant's own correlation: the request's auth_context, or the one a hosted provider hook (POST /hooks/{integration_id}) built, with transport provider_hook and its hook_point. Present exactly when the request carried an auth_context, and the same on every revision of the assessment. Values are as the request or the hook sent them; tokens, timestamps, roles and scopes are not echoed, and the echo does not change the score.
+        # Body of the 200 answer to GET /v1/accounts/{account_id}: the one current risk of one of the calling tenant's accounts. It is the risk of the account's latest assessment that has a decision (status complete or partial), by created_at and then assessment_id, scored exactly as GET /v1/assessments/{assessment_id} scores that assessment. Its assessments are the account's history (GET /v1/accounts/{account_id}/assessments).
         field(
-          :auth_context,
-          Crystalline::Nilable.new(Models::Shared::AssessmentAuthContext),
-          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("auth_context")}}
+          :account,
+          Crystalline::Nilable.new(Models::Shared::Account),
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("account")}}
         )
 
         sig {
           params(
-            assessment_id: ::String,
-            account_id: ::String,
+            id: ::String,
             status: Models::Shared::Status,
-            confidence: Models::Shared::Confidence,
-            incomplete_sources: T::Array[Models::Shared::IncompleteSource],
-            policy_version: ::String,
-            assessment_version: ::Integer,
-            created_at: ::String,
-            updated_at: ::String,
-            expires_at: ::String,
-            timing: Models::Shared::AssessmentTiming,
+            flow: Models::Shared::Flow,
+            depth: Models::Shared::Depth,
+            detail: Models::Shared::AssessmentDetail,
             schema_version: ::String,
-            request_id: T.nilable(::String),
-            recommendation: T.nilable(Models::Shared::Recommendation),
-            risk: T.nilable(Models::Shared::Risk),
-            signals: T.nilable(T::Array[Models::Shared::Signal]),
-            policy_basis: ::String,
-            assessment_url: T.nilable(::String),
-            auth_context: T.nilable(Models::Shared::AssessmentAuthContext)
+            account: T.nilable(Models::Shared::Account)
           )
             .void
         }
-        def initialize(
-          assessment_id:,
-          account_id:,
-          status:,
-          confidence:,
-          incomplete_sources:,
-          policy_version:,
-          assessment_version:,
-          created_at:,
-          updated_at:,
-          expires_at:,
-          timing:,
-          schema_version: "1",
-          request_id: nil,
-          recommendation: nil,
-          risk: nil,
-          signals: nil,
-          policy_basis: "heuristic_unvalidated",
-          assessment_url: nil,
-          auth_context: nil
-        )
-          @assessment_id = assessment_id
-          @account_id = account_id
+        def initialize(id:, status:, flow:, depth:, detail:, schema_version: "1", account: nil)
+          @id = id
           @status = status
-          @confidence = confidence
-          @incomplete_sources = incomplete_sources
-          @policy_version = policy_version
-          @assessment_version = assessment_version
-          @created_at = created_at
-          @updated_at = updated_at
-          @expires_at = expires_at
-          @timing = timing
+          @flow = flow
+          @depth = depth
+          @detail = detail
           unless schema_version == "1"
             raise ArgumentError, "Invalid value for schema_version"
           end
 
           @schema_version = "1"
-          @request_id = request_id
-          @recommendation = recommendation
-          @risk = risk
-          @signals = signals
-          unless policy_basis == "heuristic_unvalidated"
-            raise ArgumentError, "Invalid value for policy_basis"
-          end
-
-          @policy_basis = "heuristic_unvalidated"
-          @assessment_url = assessment_url
-          @auth_context = auth_context
+          @account = account
         end
 
         sig { params(other: T.untyped).returns(T::Boolean) }
         def ==(other)
           return false unless other.is_a?(self.class)
-          return false unless @assessment_id == other.assessment_id
-          return false unless @account_id == other.account_id
+          return false unless @id == other.id
           return false unless @status == other.status
-          return false unless @confidence == other.confidence
-          return false unless @incomplete_sources == other.incomplete_sources
-          return false unless @policy_version == other.policy_version
-          return false unless @assessment_version == other.assessment_version
-          return false unless @created_at == other.created_at
-          return false unless @updated_at == other.updated_at
-          return false unless @expires_at == other.expires_at
-          return false unless @timing == other.timing
+          return false unless @flow == other.flow
+          return false unless @depth == other.depth
+          return false unless @detail == other.detail
           return false unless @schema_version == other.schema_version
-          return false unless @request_id == other.request_id
-          return false unless @recommendation == other.recommendation
-          return false unless @risk == other.risk
-          return false unless @signals == other.signals
-          return false unless @policy_basis == other.policy_basis
-          return false unless @assessment_url == other.assessment_url
-          return false unless @auth_context == other.auth_context
+          return false unless @account == other.account
           true
         end
       end

data/lib/no_response/models/shared/assessment.rbi

@@ -6,16 +6,10 @@ class NoResponse::Models::Shared::Assessment
 end
 
 class NoResponse::Models::Shared::Assessment
-  def assessment_id
+  def id
   end
 
-  def assessment_id=(str_)
-  end
-
-  def account_id
-  end
-
-  def account_id=(str_)
+  def id=(str_)
   end
 
   def status
@@ -24,52 +18,22 @@ class NoResponse::Models::Shared::Assessment
   def status=(str_)
   end
 
-  def confidence
-  end
-
-  def confidence=(str_)
-  end
-
-  def incomplete_sources
-  end
-
-  def incomplete_sources=(str_)
-  end
-
-  def policy_version
-  end
-
-  def policy_version=(str_)
-  end
-
-  def assessment_version
-  end
-
-  def assessment_version=(str_)
-  end
-
-  def created_at
-  end
-
-  def created_at=(str_)
-  end
-
-  def updated_at
+  def flow
   end
 
-  def updated_at=(str_)
+  def flow=(str_)
   end
 
-  def expires_at
+  def depth
   end
 
-  def expires_at=(str_)
+  def depth=(str_)
   end
 
-  def timing
+  def detail
   end
 
-  def timing=(str_)
+  def detail=(str_)
   end
 
   def schema_version
@@ -78,45 +42,9 @@ class NoResponse::Models::Shared::Assessment
   def schema_version=(str_)
   end
 
-  def request_id
-  end
-
-  def request_id=(str_)
-  end
-
-  def recommendation
-  end
-
-  def recommendation=(str_)
-  end
-
-  def risk
-  end
-
-  def risk=(str_)
-  end
-
-  def signals
-  end
-
-  def signals=(str_)
-  end
-
-  def policy_basis
-  end
-
-  def policy_basis=(str_)
-  end
-
-  def assessment_url
-  end
-
-  def assessment_url=(str_)
-  end
-
-  def auth_context
+  def account
   end
 
-  def auth_context=(str_)
+  def account=(str_)
   end
 end

data/lib/no_response/models/shared/assessmentdeletion.rb

@@ -0,0 +1,78 @@
+# typed: true
+# frozen_string_literal: true
+
+module NoResponse
+  module Models
+    module Shared
+      # Body of the 200 answer to DELETE /v1/assessments/{assessment_id}: one of the calling tenant's assessments was deleted, with its versions, evidence, outcomes and the identity-graph marks its outcomes set. Afterwards GET /v1/assessments/{assessment_id} answers 404 and the assessment leaves the account's history. The account is scored again from what remains: account.current_assessment_id names the assessment GET /v1/accounts/{account_id} now serves its risk from, and is absent when the account has no assessment with a decision left. Deleting an assessment that is already gone answers 404.
+      class AssessmentDeletion
+        extend T::Sig
+        include Crystalline::MetadataFields
+
+        # The assessment that was deleted.
+        field :id, ::String, {'format_json': {'letter_case': ::NoResponse::Utils.field_name("id"), required: true}}
+
+        field(
+          :account,
+          Models::Shared::AssessmentDeletionAccount,
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("account"), required: true}}
+        )
+        # When the deletion took effect.
+        field(
+          :deleted_at,
+          ::String,
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("deleted_at"), required: true}}
+        )
+        # Version of the body shape.
+        field(
+          :schema_version,
+          ::String,
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("schema_version"), required: true}}
+        )
+
+        field(
+          :deleted,
+          Crystalline::Boolean.new,
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("deleted"), required: true}}
+        )
+
+        sig {
+          params(
+            id: ::String,
+            account: Models::Shared::AssessmentDeletionAccount,
+            deleted_at: ::String,
+            schema_version: ::String,
+            deleted: T::Boolean
+          )
+            .void
+        }
+        def initialize(id:, account:, deleted_at:, schema_version: "1", deleted: true)
+          @id = id
+          @account = account
+          @deleted_at = deleted_at
+          unless schema_version == "1"
+            raise ArgumentError, "Invalid value for schema_version"
+          end
+
+          @schema_version = "1"
+          unless deleted == true
+            raise ArgumentError, "Invalid value for deleted"
+          end
+
+          @deleted = true
+        end
+
+        sig { params(other: T.untyped).returns(T::Boolean) }
+        def ==(other)
+          return false unless other.is_a?(self.class)
+          return false unless @id == other.id
+          return false unless @account == other.account
+          return false unless @deleted_at == other.deleted_at
+          return false unless @schema_version == other.schema_version
+          return false unless @deleted == other.deleted
+          true
+        end
+      end
+    end
+  end
+end

data/lib/no_response/models/shared/assessmentdeletion.rbi

@@ -0,0 +1,38 @@
+# typed: true
+# frozen_string_literal: true
+
+class NoResponse::Models::Shared::AssessmentDeletion
+  extend ::Crystalline::MetadataFields::ClassMethods
+end
+
+class NoResponse::Models::Shared::AssessmentDeletion
+  def id
+  end
+
+  def id=(str_)
+  end
+
+  def account
+  end
+
+  def account=(str_)
+  end
+
+  def deleted_at
+  end
+
+  def deleted_at=(str_)
+  end
+
+  def schema_version
+  end
+
+  def schema_version=(str_)
+  end
+
+  def deleted
+  end
+
+  def deleted=(str_)
+  end
+end

data/lib/no_response/models/shared/assessmentdeletionaccount.rb

@@ -0,0 +1,37 @@
+# typed: true
+# frozen_string_literal: true
+
+module NoResponse
+  module Models
+    module Shared
+
+      class AssessmentDeletionAccount
+        extend T::Sig
+        include Crystalline::MetadataFields
+
+        # The account_id of the deleted assessment.
+        field :id, ::String, {'format_json': {'letter_case': ::NoResponse::Utils.field_name("id"), required: true}}
+        # The assessment the account's current risk now comes from. Absent when the account has no assessment with a decision left, and GET /v1/accounts/{account_id} then answers 404.
+        field(
+          :current_assessment_id,
+          Crystalline::Nilable.new(::String),
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("current_assessment_id")}}
+        )
+
+        sig { params(id: ::String, current_assessment_id: T.nilable(::String)).void }
+        def initialize(id:, current_assessment_id: nil)
+          @id = id
+          @current_assessment_id = current_assessment_id
+        end
+
+        sig { params(other: T.untyped).returns(T::Boolean) }
+        def ==(other)
+          return false unless other.is_a?(self.class)
+          return false unless @id == other.id
+          return false unless @current_assessment_id == other.current_assessment_id
+          true
+        end
+      end
+    end
+  end
+end

data/lib/no_response/models/shared/assessmentdeletionaccount.rbi

@@ -0,0 +1,20 @@
+# typed: true
+# frozen_string_literal: true
+
+class NoResponse::Models::Shared::AssessmentDeletionAccount
+  extend ::Crystalline::MetadataFields::ClassMethods
+end
+
+class NoResponse::Models::Shared::AssessmentDeletionAccount
+  def id
+  end
+
+  def id=(str_)
+  end
+
+  def current_assessment_id
+  end
+
+  def current_assessment_id=(str_)
+  end
+end