noresponse 9.4.3 → 9.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fe33f5bf446bdd36a4ee4412902954c6e8f69bb203b473e98423876999d1a235
-  data.tar.gz: 34d006f020e0536900aa81902d4cf94618030dea8ddfe9842ce917a3c7eb99fa
+  metadata.gz: dee6db86ec0159a05801626c6a8a7817f091faaf8ac218d266fca90cabf120cb
+  data.tar.gz: '08b0d9a30de21089e9a8db966468cea17ff338d94bcad984e812030a37c57596'
 SHA512:
-  metadata.gz: d5f04b4449dee4dbae66ea755129e42001e798522193a8afd6979e36f449ce0427ac2a88ff97a2dbfaa3454906cf93e29c55ce62da51d6ca99441ca1a1c550d0
-  data.tar.gz: fa5837edbfd7e739acfe985e0fb7a58d2f8feb4be3b94e14aae7d66fe2bf67eee927e6ed978b1d80f658494e9d6386d34afa4e96d3644016fb70bbfd82d8d931
+  metadata.gz: 65cf361ea2a5de4661255601bb382ab2d2f5e140cd3fbd8db249573ac5afd68c46f4cfe43342720c92466102a6661c02e34a0922e0b9284c410330506297aaf5
+  data.tar.gz: 37595ccb0e4e33c794a04589f82baaaab47984cd74ab0e7ce50e3bbd696ece2c0d1ccc890a954fd8b5aa331ebe97bb819ac8bfa294ae1cf6c8238811b85e584b

data/lib/no_response/accounts.rb

@@ -4277,8 +4277,8 @@ module NoResponse
         .returns(Models::Operations::SearchAccountsResponse)
     }
     def search(request:, retries: nil, timeout_ms: nil, http_headers: nil)
-      # search - Search distinct accounts by email or account ID
-      # Search distinct accounts observed in retained assessments in this environment. Match an exact account_id or canonical email; an email matches any retained assessment belonging to the account. Set needs_action to select accounts with an open or in-progress retained review, or a current review/block decision without an effective retained outcome. This filter applies before pagination and counting, adds waiting_for reasons to each row and requires management scope as well as history or investigate access. The response contains one row per account with its newest retained assessment, current decision when available, per-account assessment count, and total distinct-account count. Send next_cursor with unchanged filters to continue. Totals are exact below 10000 and capped at 10000. Results are live across pages. Requires history access and identifier access for email. Read-only and safe to retry.
+      # search - Search distinct accounts by submitted identifier or account ID
+      # Search distinct accounts observed in retained assessments in this environment. identifier matches an exact, canonical or explicitly selected mailbox form of a submitted email, phone or customer-namespace username. It matches historical retained inputs and returns matched_identifier with the original value and matching assessment. Each row has its newest retained assessment, current account decision when available, retained assessment count, and total distinct-account count. identifier and legacy email are mutually exclusive; account_id and needs_action combine with either using AND. Set needs_action to select accounts with a retained open or in-progress review, or a current review/block account decision without an effective retained account outcome. This filter applies before counting and pagination and adds waiting_for reasons. Current decisions include account list overrides and shared-key scoring and preserve admission holds. Typed identifier search uses stable opaque account order; ordinary and legacy email searches retain newest-seen order. Results are live across pages; each page's items and total share a database snapshot, while current account risk is read separately. Cursors are expiring and bound to scope, operation and filters. Totals are exact below 10000 and capped at 10000. Requires history or investigate authority and identifier-read permission for identifier, identifier_expression or email filtering. needs_action additionally requires management scope. Source-discovered associations are not searched and equality is not verified ownership. identifier_expression combines submitted terms with bounded AND/OR, at most 8 raw terms and 3 group levels. Each node selects exactly one of term, and, or. Groups have 2 to 8 operands. Duplicate normalized terms are idempotent and still count toward the limit. identifier_expression, identifier and email are mutually exclusive. Expression results use matched_identifiers with original submitted witnesses and zero-based depth-first term_index. All satisfied unique terms are returned in first-occurrence order. Cursors bind scope, ordered structure, original values, matching modes and all other filters; changing only page limit is allowed. Required expression scope assessment evaluates the whole expression in one retained submission; scope account allows different retained submissions of the same account to satisfy different terms. Both use stable opaque account ordering and distinct-account counting before pagination.
       url, params = @sdk_configuration.get_server_details
       base_url = Utils.template_url(url, params)
       url = "#{base_url}/v1/accounts/search"

data/lib/no_response/assessments.rb

@@ -1841,7 +1841,7 @@ module NoResponse
     }
     def search(request:, retries: nil, timeout_ms: nil, http_headers: nil)
       # search - Search assessments across this environment
-      # Search retained assessments created in [from,to), over at most 366 days. Filters use each assessment decision, rather than the current account decision. Results can change between pages. Keep the assessment version to retrieve the exact decision later. Each item's detail.identifiers holds the identifiers its assessment was sent, exactly as received, and first_decision holds the decision of its first answer. email finds every assessment of the accounts that sent a mailbox, matched as lists match it. changed keeps the assessments a later revision changed. total counts every match, exactly up to 10000. This read does not require an idempotency key.
+      # Search retained assessments created in [from,to), at most 366 days. identifier directly matches that assessment's submitted email, phone or customer-namespace username using exact, canonical or explicitly selected email mailbox matching. matched_identifier explains the original value and match basis. Legacy email keeps its account-wide mailbox semantics and cannot be combined with identifier. Other filters combine using AND and describe assessment decisions, separate from current account decisions. Each item carries the original submitted identifiers and its first_decision when available. Newest-created order has an assessment-ID tie break. Results are live across pages; each page's total and items use one database snapshot. Totals are exact below 10000 and capped at 10000. Requires history or investigate authority and identifier-read permission for identifier, identifier_expression or email filters; detailed mode also requires detailed permission. No Idempotency-Key. identifier_expression combines submitted terms with bounded AND/OR, at most 8 raw terms and 3 group levels. Each node selects exactly one of term, and, or. Groups have 2 to 8 operands. Duplicate normalized terms are idempotent and still count toward the limit. identifier_expression, identifier and email are mutually exclusive. Expression results use matched_identifiers with original submitted witnesses and zero-based depth-first term_index. All satisfied unique terms are returned in first-occurrence order. Cursors bind scope, ordered structure, original values, matching modes and all other filters; changing only page limit is allowed. Expression scope must be assessment: each returned assessment itself satisfies the complete expression. Scope account is rejected with 400 invalid_request; use account search for historical combinations.
       url, params = @sdk_configuration.get_server_details
       base_url = Utils.template_url(url, params)
       url = "#{base_url}/v1/assessments/search"

data/lib/no_response/models/shared/accountdirectorypage.rb

@@ -4,7 +4,7 @@
 module NoResponse
   module Models
     module Shared
-      # Accounts observed in retained assessments, newest seen first, with each account once per page and across pages. Counts and keyset pagination are computed over distinct accounts in one database snapshot per page. Live data can change between pages.
+      # Distinct observed accounts with retained assessments. Typed identifier searches use stable opaque account order, independent of newly submitted assessments; ordinary and legacy email searches use newest-seen order. One repeatable-read database snapshot supplies each page's rows and totals. Pages do not share a snapshot: new matching accounts may appear on a later page or before the cursor and be missed until a fresh search; retention, erasure and changed membership can remove results. Current account decisions are read separately and may advance during a page. Cursors bind the workspace/environment, operation and filters, expire, and cannot cross scopes. Erasure and retention always take precedence over pagination.
       class AccountDirectoryPage
         extend T::Sig
         include Crystalline::MetadataFields

data/lib/no_response/models/shared/accountdirectorypageitem.rb

@@ -39,6 +39,18 @@ module NoResponse
           Crystalline::Nilable.new(Models::Shared::Account),
           {'format_json': {'letter_case': ::NoResponse::Utils.field_name("current")}}
         )
+        # Why this result matched a typed identifier search. value is the original value submitted in assessment_id. Provenance records a customer submission, not a source discovery or verified ownership. Equality is deterministic and has no inferred confidence score. An account result names its newest retained matching assessment, which can differ from latest.
+        field(
+          :matched_identifier,
+          Crystalline::Nilable.new(Models::Shared::IdentifierMatch),
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("matched_identifier")}}
+        )
+        # Present only for identifier_expression. All satisfied unique terms, ordered by term_index, with original submitted values and retained assessment witnesses. A duplicate normalized term appears once at its first raw leaf index. The legacy single identifier filter instead returns matched_identifier.
+        field(
+          :matched_identifiers,
+          Crystalline::Nilable.new(Crystalline::Array.new(Models::Shared::IdentifierTermMatch)),
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("matched_identifiers")}}
+        )
 
         sig {
           params(
@@ -46,16 +58,28 @@ module NoResponse
             latest: Models::Shared::AssessmentRevision,
             assessments: ::Integer,
             waiting_for: T.nilable(T::Array[Models::Shared::WaitingFor]),
-            current: T.nilable(Models::Shared::Account)
+            current: T.nilable(Models::Shared::Account),
+            matched_identifier: T.nilable(Models::Shared::IdentifierMatch),
+            matched_identifiers: T.nilable(T::Array[Models::Shared::IdentifierTermMatch])
           )
             .void
         }
-        def initialize(account_id:, latest:, assessments:, waiting_for: nil, current: nil)
+        def initialize(
+          account_id:,
+          latest:,
+          assessments:,
+          waiting_for: nil,
+          current: nil,
+          matched_identifier: nil,
+          matched_identifiers: nil
+        )
           @account_id = account_id
           @latest = latest
           @assessments = assessments
           @waiting_for = waiting_for
           @current = current
+          @matched_identifier = matched_identifier
+          @matched_identifiers = matched_identifiers
         end
 
         sig { params(other: T.untyped).returns(T::Boolean) }
@@ -66,6 +90,8 @@ module NoResponse
           return false unless @assessments == other.assessments
           return false unless @waiting_for == other.waiting_for
           return false unless @current == other.current
+          return false unless @matched_identifier == other.matched_identifier
+          return false unless @matched_identifiers == other.matched_identifiers
           true
         end
       end

data/lib/no_response/models/shared/accountdirectorypageitem.rbi

@@ -35,4 +35,16 @@ class NoResponse::Models::Shared::AccountDirectoryPageItem
 
   def current=(str_)
   end
+
+  def matched_identifier
+  end
+
+  def matched_identifier=(str_)
+  end
+
+  def matched_identifiers
+  end
+
+  def matched_identifiers=(str_)
+  end
 end

data/lib/no_response/models/shared/accountdirectorysearchrequest.rb

@@ -4,7 +4,7 @@
 module NoResponse
   module Models
     module Shared
-      # Bounded distinct-account search for a single authenticated workspace/environment. Email matches any retained admitted assessment of an account, using assessment search's canonical mailbox rules. No assessment history download is required.
+      # Bounded distinct-account search for one authenticated workspace/environment. identifier matches any retained admitted assessment of an account, including historical submitted values. email preserves the legacy canonical-mailbox filter. identifier and email cannot be combined. All other filters combine using AND. Typed identifier search uses stable opaque account order; ordinary and legacy email searches retain newest-seen ordering. Pages are live, not a cross-page snapshot. Requires history or investigate authority and identifier-read permission for identifier, identifier_expression or email filtering. identifier_expression explicitly chooses scope assessment (one whole matching submission) or account (terms may match different retained submissions of one account). At most 8 raw terms and 3 group levels. Mutually exclusive with identifier and email. Expression search uses the same stable opaque account order as typed identifier search.
       class AccountDirectorySearchRequest
         extend T::Sig
         include Crystalline::MetadataFields
@@ -21,12 +21,24 @@ module NoResponse
           Crystalline::Nilable.new(::String),
           {'format_json': {'letter_case': ::NoResponse::Utils.field_name("email")}}
         )
-        # Opaque, expiring cursor bound to this environment, operation and every filter. Keep the filters unchanged.
+        # Opaque, expiring cursor bound to workspace, environment, operation and all filters, including expression scope, ordered structure and original term values. Keep grouping, operand order, matching modes and values unchanged; an omitted match is equivalent to exact. The page limit may change.
         field(
           :cursor,
           Crystalline::Nilable.new(::String),
           {'format_json': {'letter_case': ::NoResponse::Utils.field_name("cursor")}}
         )
+        # One customer-submitted identifier. Defaults to exact comparison of the original submitted value. canonical uses the supported identifier normalisation without an ownership claim: email preserves local-part case, NFC-normalises it and lowercases the domain without removing dots or tags; phone uses international E.164 without extensions or an inferred region; username uses NFC and Unicode case folding within the customer namespace. mailbox is email-only and explicitly selects existing list rules: case-insensitive, remove +tag, and ignore local-part dots at gmail.com and googlemail.com; googlemail.com maps to gmail.com. Username requires namespace customer. Email and phone forbid namespace. Source-discovered identifiers and platform handles are not searched. Unsupported kinds, namespaces, modes and invalid values return 400. Search equality does not establish verified ownership or merge accounts.
+        field(
+          :identifier,
+          Crystalline::Nilable.new(Models::Shared::IdentifierSearch),
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("identifier")}}
+        )
+        # A bounded AND/OR expression over submitted identifiers. Required scope assessment means the entire expression must match one retained assessment. Scope account permits each term to match a different retained assessment of the same account and is accepted only by account search. Exactly one of term, and or or is allowed at every node. Groups contain 2 to 8 operands, with at most 3 nested group levels and 8 raw term occurrences over the entire expression. A root term is allowed. Duplicate terms with the same kind, match rule, namespace and normalized comparison are idempotent, but count toward the raw limit. Match rules default to exact and preserve the existing identifier contract. Only retained submitted identifiers can satisfy a term. Unknown fields, unsupported scopes and malformed or oversized expressions return 400 invalid_request.
+        field(
+          :identifier_expression,
+          Crystalline::Nilable.new(Models::Shared::IdentifierExpression),
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("identifier_expression")}}
+        )
         # Select accounts with a retained open or in-progress review, or a current review/block account decision with no retained effective account outcome. The server applies this filter before counting and pagination. Requires reviews.read as well as history.read for console members; API keys additionally require management.
         field(
           :needs_action,
@@ -45,15 +57,27 @@ module NoResponse
             account_id: T.nilable(::String),
             email: T.nilable(::String),
             cursor: T.nilable(::String),
+            identifier: T.nilable(Models::Shared::IdentifierSearch),
+            identifier_expression: T.nilable(Models::Shared::IdentifierExpression),
             needs_action: T.nilable(T::Boolean),
             limit: T.nilable(::Integer)
           )
             .void
         }
-        def initialize(account_id: nil, email: nil, cursor: nil, needs_action: false, limit: 25)
+        def initialize(
+          account_id: nil,
+          email: nil,
+          cursor: nil,
+          identifier: nil,
+          identifier_expression: nil,
+          needs_action: false,
+          limit: 25
+        )
           @account_id = account_id
           @email = email
           @cursor = cursor
+          @identifier = identifier
+          @identifier_expression = identifier_expression
           @needs_action = needs_action
           @limit = limit
         end
@@ -64,6 +88,8 @@ module NoResponse
           return false unless @account_id == other.account_id
           return false unless @email == other.email
           return false unless @cursor == other.cursor
+          return false unless @identifier == other.identifier
+          return false unless @identifier_expression == other.identifier_expression
           return false unless @needs_action == other.needs_action
           return false unless @limit == other.limit
           true

data/lib/no_response/models/shared/accountdirectorysearchrequest.rbi

@@ -24,6 +24,18 @@ class NoResponse::Models::Shared::AccountDirectorySearchRequest
   def cursor=(str_)
   end
 
+  def identifier
+  end
+
+  def identifier=(str_)
+  end
+
+  def identifier_expression
+  end
+
+  def identifier_expression=(str_)
+  end
+
   def needs_action
   end
 

data/lib/no_response/models/shared/assessmentsearchitem.rb

@@ -70,6 +70,18 @@ module NoResponse
             }
           }
         )
+        # Why this result matched a typed identifier search. value is the original value submitted in assessment_id. Provenance records a customer submission, not a source discovery or verified ownership. Equality is deterministic and has no inferred confidence score. An account result names its newest retained matching assessment, which can differ from latest.
+        field(
+          :matched_identifier,
+          Crystalline::Nilable.new(Models::Shared::IdentifierMatch),
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("matched_identifier")}}
+        )
+        # Present only for identifier_expression. All satisfied unique terms, ordered by term_index, with original submitted values and retained assessment witnesses. A duplicate normalized term appears once at its first raw leaf index. The legacy single identifier filter instead returns matched_identifier.
+        field(
+          :matched_identifiers,
+          Crystalline::Nilable.new(Crystalline::Array.new(Models::Shared::IdentifierTermMatch)),
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("matched_identifiers")}}
+        )
 
         sig {
           params(
@@ -79,11 +91,23 @@ module NoResponse
             depth: Models::Shared::Depth,
             detail: Models::Shared::AssessmentDetail,
             schema_version: ::String,
-            first_decision: T.nilable(Models::Shared::Decision)
+            first_decision: T.nilable(Models::Shared::Decision),
+            matched_identifier: T.nilable(Models::Shared::IdentifierMatch),
+            matched_identifiers: T.nilable(T::Array[Models::Shared::IdentifierTermMatch])
           )
             .void
         }
-        def initialize(id:, status:, flow:, depth:, detail:, schema_version: "1", first_decision: nil)
+        def initialize(
+          id:,
+          status:,
+          flow:,
+          depth:,
+          detail:,
+          schema_version: "1",
+          first_decision: nil,
+          matched_identifier: nil,
+          matched_identifiers: nil
+        )
           @id = id
           @status = status
           @flow = flow
@@ -95,6 +119,8 @@ module NoResponse
 
           @schema_version = "1"
           @first_decision = first_decision
+          @matched_identifier = matched_identifier
+          @matched_identifiers = matched_identifiers
         end
 
         sig { params(other: T.untyped).returns(T::Boolean) }
@@ -107,6 +133,8 @@ module NoResponse
           return false unless @detail == other.detail
           return false unless @schema_version == other.schema_version
           return false unless @first_decision == other.first_decision
+          return false unless @matched_identifier == other.matched_identifier
+          return false unless @matched_identifiers == other.matched_identifiers
           true
         end
       end

data/lib/no_response/models/shared/assessmentsearchitem.rbi

@@ -47,4 +47,16 @@ class NoResponse::Models::Shared::AssessmentSearchItem
 
   def first_decision=(str_)
   end
+
+  def matched_identifier
+  end
+
+  def matched_identifier=(str_)
+  end
+
+  def matched_identifiers
+  end
+
+  def matched_identifiers=(str_)
+  end
 end

data/lib/no_response/models/shared/assessmentsearchrequest.rb

@@ -4,7 +4,7 @@
 module NoResponse
   module Models
     module Shared
-      # Search retained assessments created in [from,to), over at most 366 days. Filters use each assessment decision, rather than the current account decision. Results can change between pages. Keep the assessment version to retrieve the exact decision later. This read does not require an idempotency key.
+      # Search retained assessments created in [from,to), at most 366 days. identifier matches the submitted value of each returned assessment directly. The legacy email filter keeps its account-wide mailbox semantics and cannot be combined with identifier. Other filters combine using AND and describe assessment decisions, separate from current account decisions. Results use newest-created order with an assessment-ID tie break and are live, not a snapshot across pages. Requires history or investigate authority; identifier, identifier_expression and email filtering also require identifier-read permission. Detailed response mode additionally requires detailed permission. No Idempotency-Key. identifier_expression requires scope assessment and matches the complete expression within each returned submission; account scope returns 400 invalid_request. At most 8 raw terms and 3 group levels. Mutually exclusive with identifier and email.
       class AssessmentSearchRequest
         extend T::Sig
         include Crystalline::MetadataFields
@@ -57,7 +57,7 @@ module NoResponse
             }
           }
         )
-        # Opaque, expiring cursor bound to this environment, operation and every filter. Keep the filters unchanged.
+        # Opaque, expiring cursor bound to workspace, environment, operation and all filters, including expression scope, ordered structure and original term values. Keep grouping, operand order, matching modes and values unchanged; an omitted match is equivalent to exact. The page limit may change.
         field(
           :cursor,
           Crystalline::Nilable.new(::String),
@@ -181,6 +181,18 @@ module NoResponse
           Crystalline::Nilable.new(Crystalline::Boolean.new),
           {'format_json': {'letter_case': ::NoResponse::Utils.field_name("changed")}}
         )
+        # One customer-submitted identifier. Defaults to exact comparison of the original submitted value. canonical uses the supported identifier normalisation without an ownership claim: email preserves local-part case, NFC-normalises it and lowercases the domain without removing dots or tags; phone uses international E.164 without extensions or an inferred region; username uses NFC and Unicode case folding within the customer namespace. mailbox is email-only and explicitly selects existing list rules: case-insensitive, remove +tag, and ignore local-part dots at gmail.com and googlemail.com; googlemail.com maps to gmail.com. Username requires namespace customer. Email and phone forbid namespace. Source-discovered identifiers and platform handles are not searched. Unsupported kinds, namespaces, modes and invalid values return 400. Search equality does not establish verified ownership or merge accounts.
+        field(
+          :identifier,
+          Crystalline::Nilable.new(Models::Shared::IdentifierSearch),
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("identifier")}}
+        )
+        # A bounded AND/OR expression over submitted identifiers. Required scope assessment means the entire expression must match one retained assessment. Scope account permits each term to match a different retained assessment of the same account and is accepted only by account search. Exactly one of term, and or or is allowed at every node. Groups contain 2 to 8 operands, with at most 3 nested group levels and 8 raw term occurrences over the entire expression. A root term is allowed. Duplicate terms with the same kind, match rule, namespace and normalized comparison are idempotent, but count toward the raw limit. Match rules default to exact and preserve the existing identifier contract. Only retained submitted identifiers can satisfy a term. Unknown fields, unsupported scopes and malformed or oversized expressions return 400 invalid_request.
+        field(
+          :identifier_expression,
+          Crystalline::Nilable.new(Models::Shared::IdentifierExpression),
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("identifier_expression")}}
+        )
 
         field(
           :limit,
@@ -211,6 +223,8 @@ module NoResponse
             score_max: T.nilable(::Integer),
             list_match: T.nilable(Models::Shared::ListMatch),
             changed: T.nilable(T::Boolean),
+            identifier: T.nilable(Models::Shared::IdentifierSearch),
+            identifier_expression: T.nilable(Models::Shared::IdentifierExpression),
             limit: T.nilable(::Integer)
           )
             .void
@@ -237,6 +251,8 @@ module NoResponse
           score_max: nil,
           list_match: nil,
           changed: nil,
+          identifier: nil,
+          identifier_expression: nil,
           limit: 20
         )
           @from = from
@@ -260,6 +276,8 @@ module NoResponse
           @score_max = score_max
           @list_match = list_match
           @changed = changed
+          @identifier = identifier
+          @identifier_expression = identifier_expression
           @limit = limit
         end
 
@@ -287,6 +305,8 @@ module NoResponse
           return false unless @score_max == other.score_max
           return false unless @list_match == other.list_match
           return false unless @changed == other.changed
+          return false unless @identifier == other.identifier
+          return false unless @identifier_expression == other.identifier_expression
           return false unless @limit == other.limit
           true
         end

data/lib/no_response/models/shared/assessmentsearchrequest.rbi

@@ -132,6 +132,18 @@ class NoResponse::Models::Shared::AssessmentSearchRequest
   def changed=(str_)
   end
 
+  def identifier
+  end
+
+  def identifier=(str_)
+  end
+
+  def identifier_expression
+  end
+
+  def identifier_expression=(str_)
+  end
+
   def limit
   end
 

data/lib/no_response/models/shared/identifierexpression.rb

@@ -0,0 +1,47 @@
+# typed: true
+# frozen_string_literal: true
+
+module NoResponse
+  module Models
+    module Shared
+      # A bounded AND/OR expression over submitted identifiers. Required scope assessment means the entire expression must match one retained assessment. Scope account permits each term to match a different retained assessment of the same account and is accepted only by account search. Exactly one of term, and or or is allowed at every node. Groups contain 2 to 8 operands, with at most 3 nested group levels and 8 raw term occurrences over the entire expression. A root term is allowed. Duplicate terms with the same kind, match rule, namespace and normalized comparison are idempotent, but count toward the raw limit. Match rules default to exact and preserve the existing identifier contract. Only retained submitted identifiers can satisfy a term. Unknown fields, unsupported scopes and malformed or oversized expressions return 400 invalid_request.
+      class IdentifierExpression
+        extend T::Sig
+        include Crystalline::MetadataFields
+
+        # assessment requires one submission to satisfy the complete expression. account permits witnesses across retained submissions of one account and is supported only by POST /v1/accounts/search. No default: select scope explicitly.
+        field(
+          :scope,
+          Models::Shared::ScopeEnum,
+          {
+            'format_json': {
+              'letter_case': ::NoResponse::Utils.field_name("scope"),
+              required: true,
+              'decoder': ::NoResponse::Utils.enum_from_string(Models::Shared::ScopeEnum, false)
+            }
+          }
+        )
+
+        field(
+          :expression,
+          Models::Shared::IdentifierExpressionNode,
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("expression"), required: true}}
+        )
+
+        sig { params(scope: Models::Shared::ScopeEnum, expression: Models::Shared::IdentifierExpressionNode).void }
+        def initialize(scope:, expression:)
+          @scope = scope
+          @expression = expression
+        end
+
+        sig { params(other: T.untyped).returns(T::Boolean) }
+        def ==(other)
+          return false unless other.is_a?(self.class)
+          return false unless @scope == other.scope
+          return false unless @expression == other.expression
+          true
+        end
+      end
+    end
+  end
+end

data/lib/no_response/models/shared/identifierexpression.rbi

@@ -0,0 +1,20 @@
+# typed: true
+# frozen_string_literal: true
+
+class NoResponse::Models::Shared::IdentifierExpression
+  extend ::Crystalline::MetadataFields::ClassMethods
+end
+
+class NoResponse::Models::Shared::IdentifierExpression
+  def scope
+  end
+
+  def scope=(str_)
+  end
+
+  def expression
+  end
+
+  def expression=(str_)
+  end
+end

data/lib/no_response/models/shared/identifierexpressionleaf.rb

@@ -0,0 +1,33 @@
+# typed: true
+# frozen_string_literal: true
+
+module NoResponse
+  module Models
+    module Shared
+
+      class IdentifierExpressionLeaf
+        extend T::Sig
+        include Crystalline::MetadataFields
+
+        # One customer-submitted identifier. Defaults to exact comparison of the original submitted value. canonical uses the supported identifier normalisation without an ownership claim: email preserves local-part case, NFC-normalises it and lowercases the domain without removing dots or tags; phone uses international E.164 without extensions or an inferred region; username uses NFC and Unicode case folding within the customer namespace. mailbox is email-only and explicitly selects existing list rules: case-insensitive, remove +tag, and ignore local-part dots at gmail.com and googlemail.com; googlemail.com maps to gmail.com. Username requires namespace customer. Email and phone forbid namespace. Source-discovered identifiers and platform handles are not searched. Unsupported kinds, namespaces, modes and invalid values return 400. Search equality does not establish verified ownership or merge accounts.
+        field(
+          :term,
+          Models::Shared::IdentifierSearch,
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("term"), required: true}}
+        )
+
+        sig { params(term: Models::Shared::IdentifierSearch).void }
+        def initialize(term:)
+          @term = term
+        end
+
+        sig { params(other: T.untyped).returns(T::Boolean) }
+        def ==(other)
+          return false unless other.is_a?(self.class)
+          return false unless @term == other.term
+          true
+        end
+      end
+    end
+  end
+end

data/lib/no_response/models/shared/identifierexpressionleaf.rbi

@@ -0,0 +1,14 @@
+# typed: true
+# frozen_string_literal: true
+
+class NoResponse::Models::Shared::IdentifierExpressionLeaf
+  extend ::Crystalline::MetadataFields::ClassMethods
+end
+
+class NoResponse::Models::Shared::IdentifierExpressionLeaf
+  def term
+  end
+
+  def term=(str_)
+  end
+end

data/lib/no_response/models/shared/identifierexpressionnode.rb

@@ -0,0 +1,56 @@
+# typed: true
+# frozen_string_literal: true
+
+module NoResponse
+  module Models
+    module Shared
+
+      class IdentifierExpressionNode
+        extend T::Sig
+        include Crystalline::MetadataFields
+
+        # One customer-submitted identifier. Defaults to exact comparison of the original submitted value. canonical uses the supported identifier normalisation without an ownership claim: email preserves local-part case, NFC-normalises it and lowercases the domain without removing dots or tags; phone uses international E.164 without extensions or an inferred region; username uses NFC and Unicode case folding within the customer namespace. mailbox is email-only and explicitly selects existing list rules: case-insensitive, remove +tag, and ignore local-part dots at gmail.com and googlemail.com; googlemail.com maps to gmail.com. Username requires namespace customer. Email and phone forbid namespace. Source-discovered identifiers and platform handles are not searched. Unsupported kinds, namespaces, modes and invalid values return 400. Search equality does not establish verified ownership or merge accounts.
+        field(
+          :term,
+          Crystalline::Nilable.new(Models::Shared::IdentifierSearch),
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("term")}}
+        )
+
+        field(
+          :and_,
+          Crystalline::Nilable.new(Crystalline::Array.new(Models::Shared::IdentifierExpressionNodeLevelTwo)),
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("and")}}
+        )
+
+        field(
+          :or_,
+          Crystalline::Nilable.new(Crystalline::Array.new(Models::Shared::IdentifierExpressionNodeLevelTwo)),
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("or")}}
+        )
+
+        sig {
+          params(
+            term: T.nilable(Models::Shared::IdentifierSearch),
+            and_: T.nilable(T::Array[Models::Shared::IdentifierExpressionNodeLevelTwo]),
+            or_: T.nilable(T::Array[Models::Shared::IdentifierExpressionNodeLevelTwo])
+          )
+            .void
+        }
+        def initialize(term: nil, and_: nil, or_: nil)
+          @term = term
+          @and_ = and_
+          @or_ = or_
+        end
+
+        sig { params(other: T.untyped).returns(T::Boolean) }
+        def ==(other)
+          return false unless other.is_a?(self.class)
+          return false unless @term == other.term
+          return false unless @and_ == other.and_
+          return false unless @or_ == other.or_
+          true
+        end
+      end
+    end
+  end
+end

data/lib/no_response/models/shared/identifierexpressionnode.rbi

@@ -0,0 +1,26 @@
+# typed: true
+# frozen_string_literal: true
+
+class NoResponse::Models::Shared::IdentifierExpressionNode
+  extend ::Crystalline::MetadataFields::ClassMethods
+end
+
+class NoResponse::Models::Shared::IdentifierExpressionNode
+  def term
+  end
+
+  def term=(str_)
+  end
+
+  def and_
+  end
+
+  def and_=(str_)
+  end
+
+  def or_
+  end
+
+  def or_=(str_)
+  end
+end