@noresponse/mcp 0.10.4 → 0.11.1

package/CHANGELOG.md

@@ -1,5 +1,116 @@
 # Changelog
 
+## 0.11.1
+
+* `SDK.assessments.create()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.assessments.get()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.assessments.delete()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.assessments.recordOutcome()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.assessments.query()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.assessments.aggregate()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.assessments.search()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.assessments.retrieveVersion()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.assessments.bindAccount()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.accounts.listChanged()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.accounts.get()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.accounts.delete()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.accounts.listAssessments()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.accounts.listEnforcements()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.accounts.recordEnforcement()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.accounts.listOutcomes()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.accounts.recordOutcome()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.accounts.retrieveDecision()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.accounts.listCredentials()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.accounts.associateCredential()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.accounts.retireCredential()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.accounts.export()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.accounts.listDecisions()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.accounts.search()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.keyUsage.record()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.keys.rotate()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.keys.list()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.keys.create()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.keys.revoke()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.integrations.list()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.integrations.create()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.integrations.delete()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.integrations.rotate()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.webhookEndpoints.list()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.webhookEndpoints.create()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.webhookEndpoints.delete()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.webhookEndpoints.rotateSigningKey()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.webhookEndpoints.sendTestEvent()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.webhookEndpoints.listDeliveries()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.webhookEndpoints.replayDelivery()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.webhookEndpoints.aggregate()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.members.list()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.members.remove()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.members.update()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.audit.list()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.audit.getRetention()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.audit.updateRetention()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.audit.listStreams()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.audit.configureStream()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.audit.removeStream()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.audit.replayStream()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.usage.get()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.invites.list()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.invites.create()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.invites.revoke()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.invites.resend()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.settings.get()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.settings.update()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.settings.listHistory()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.settings.restore()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.settings.preview()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.requests.list()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.requests.aggregate()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.lists.list()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.lists.create()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.lists.delete()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.lists.preview()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.lists.change()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.lists.getChange()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.reviews.list()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.reviews.create()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.reviews.get()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.reviews.update()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.reviews.resolve()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.reviews.listComments()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.reviews.comment()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.reviews.listResolutions()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.reviews.listViews()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.reviews.createView()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.reviews.deleteView()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.reviews.updateView()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.reviews.export()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.reviews.listSubjects()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.reviews.addSubject()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.reviews.deleteSubject()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.erasures.get()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.exports.list()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.exports.create()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.exports.get()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.exports.cancel()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.exports.retry()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.exports.downloadChunk()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.evaluations.list()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.evaluations.create()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.evaluations.get()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.evaluations.getResult()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.evaluations.cancel()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.evaluations.publish()`:  `response.code` **Changed** (Breaking ⚠️)
+* `SDK.operations.summarize()`:  `response.code` **Changed** (Breaking ⚠️)
+
+## 0.11.0
+
+* `SDK.assessments.search()`: 
+  *  `request.identifier_expression` **Added**
+  *  `response.items[].matched_identifiers` **Added**
+* `SDK.accounts.search()`: 
+  *  `request.identifier_expression` **Added**
+  *  `response.items[].matched_identifiers` **Added**
+
 ## 0.10.4
 
 * `SDK.assessments.search()`: 

package/README.md

@@ -87,3 +87,21 @@ Each [release](https://github.com/noresponsehq/mcp/releases) attaches `norespons
 ## Licence
 
 Apache-2.0. See [LICENSE](LICENSE).
+
+
+## Combine submitted identifiers
+
+Search accounts and assessments with explicit AND/OR combinations of submitted
+email, phone and customer-namespace username terms. Use `IdentifierExpression`
+and its required `scope`: `assessment` requires one submission to satisfy the
+whole expression; `account` can combine different retained submissions of the
+same account and is accepted only by account search. Pass the wire shape under `request.identifier_expression` to `search_accounts` or `search_assessments`.
+
+Expressions have at most eight raw terms and three group levels. The original
+exact, canonical and explicit mailbox matching rules still apply to each term.
+Expression results contain indexed `IdentifierTermMatch` records with the
+original submitted value and originating assessment, separate from current
+account risk. Single-identifier and legacy email filters retain their behavior.
+
+See the [combined-search contract and examples](https://docs.noresponse.org/reference/investigation#combine-submitted-identifiers)
+for the expression shape, scope differences, permissions and pagination.

package/bin/mcp-server.js

@@ -48136,9 +48136,9 @@ var init_config = __esm(() => {
   SDK_METADATA = {
     language: "typescript",
     openapiDocVersion: "1",
-    sdkVersion: "0.10.4",
+    sdkVersion: "0.11.1",
     genVersion: "internal",
-    userAgent: "noresponse-sdk/mcp-typescript 0.10.4 internal 1 @noresponse/mcp"
+    userAgent: "noresponse-sdk/mcp-typescript 0.11.1 internal 1 @noresponse/mcp"
   };
 });
 
@@ -51493,7 +51493,10 @@ var init_permissiondeniederrorcode = __esm(() => {
   init_zod();
   PermissionDeniedErrorCode$zodSchema = _enum([
     "workspace_forbidden",
-    "role_forbidden"
+    "role_forbidden",
+    "email_unverified",
+    "onboarding_in_review",
+    "onboarding_refused"
   ]).describe("Machine codes an HTTP 403 answer can carry.");
 });
 
@@ -54894,19 +54897,92 @@ var init_identifiersearch = __esm(() => {
   }).describe("One customer-submitted identifier. Defaults to exact comparison of the original submitted value. canonical uses the supported identifier normalisation without an ownership claim: email preserves local-part case, NFC-normalises it and lowercases the domain without removing dots or tags; phone uses international E.164 without extensions or an inferred region; username uses NFC and Unicode case folding within the customer namespace. mailbox is email-only and explicitly selects existing list rules: case-insensitive, remove +tag, and ignore local-part dots at gmail.com and googlemail.com; googlemail.com maps to gmail.com. Username requires namespace customer. Email and phone forbid namespace. Source-discovered identifiers and platform handles are not searched. Unsupported kinds, namespaces, modes and invalid values return 400. Search equality does not establish verified ownership or merge accounts.");
 });
 
+// src/models/identifierexpressionleaf.ts
+var IdentifierExpressionLeaf$zodSchema;
+var init_identifierexpressionleaf = __esm(() => {
+  init_zod();
+  init_identifiersearch();
+  IdentifierExpressionLeaf$zodSchema = object({
+    term: IdentifierSearch$zodSchema.describe("One customer-submitted identifier. Defaults to exact comparison of the original submitted value. canonical uses the supported identifier normalisation without an ownership claim: email preserves local-part case, NFC-normalises it and lowercases the domain without removing dots or tags; phone uses international E.164 without extensions or an inferred region; username uses NFC and Unicode case folding within the customer namespace. mailbox is email-only and explicitly selects existing list rules: case-insensitive, remove +tag, and ignore local-part dots at gmail.com and googlemail.com; googlemail.com maps to gmail.com. Username requires namespace customer. Email and phone forbid namespace. Source-discovered identifiers and platform handles are not searched. Unsupported kinds, namespaces, modes and invalid values return 400. Search equality does not establish verified ownership or merge accounts.")
+  });
+});
+
+// src/models/identifierexpressionnodelevelone.ts
+var IdentifierExpressionNodeLevelOne$zodSchema;
+var init_identifierexpressionnodelevelone = __esm(() => {
+  init_zod();
+  init_identifierexpressionleaf();
+  init_identifiersearch();
+  IdentifierExpressionNodeLevelOne$zodSchema = object({
+    and: array(IdentifierExpressionLeaf$zodSchema).optional(),
+    or: array(IdentifierExpressionLeaf$zodSchema).optional(),
+    term: IdentifierSearch$zodSchema.optional().describe("One customer-submitted identifier. Defaults to exact comparison of the original submitted value. canonical uses the supported identifier normalisation without an ownership claim: email preserves local-part case, NFC-normalises it and lowercases the domain without removing dots or tags; phone uses international E.164 without extensions or an inferred region; username uses NFC and Unicode case folding within the customer namespace. mailbox is email-only and explicitly selects existing list rules: case-insensitive, remove +tag, and ignore local-part dots at gmail.com and googlemail.com; googlemail.com maps to gmail.com. Username requires namespace customer. Email and phone forbid namespace. Source-discovered identifiers and platform handles are not searched. Unsupported kinds, namespaces, modes and invalid values return 400. Search equality does not establish verified ownership or merge accounts.")
+  });
+});
+
+// src/models/identifierexpressionnodeleveltwo.ts
+var IdentifierExpressionNodeLevelTwo$zodSchema;
+var init_identifierexpressionnodeleveltwo = __esm(() => {
+  init_zod();
+  init_identifierexpressionnodelevelone();
+  init_identifiersearch();
+  IdentifierExpressionNodeLevelTwo$zodSchema = object({
+    and: array(IdentifierExpressionNodeLevelOne$zodSchema).optional(),
+    or: array(IdentifierExpressionNodeLevelOne$zodSchema).optional(),
+    term: IdentifierSearch$zodSchema.optional().describe("One customer-submitted identifier. Defaults to exact comparison of the original submitted value. canonical uses the supported identifier normalisation without an ownership claim: email preserves local-part case, NFC-normalises it and lowercases the domain without removing dots or tags; phone uses international E.164 without extensions or an inferred region; username uses NFC and Unicode case folding within the customer namespace. mailbox is email-only and explicitly selects existing list rules: case-insensitive, remove +tag, and ignore local-part dots at gmail.com and googlemail.com; googlemail.com maps to gmail.com. Username requires namespace customer. Email and phone forbid namespace. Source-discovered identifiers and platform handles are not searched. Unsupported kinds, namespaces, modes and invalid values return 400. Search equality does not establish verified ownership or merge accounts.")
+  });
+});
+
+// src/models/identifierexpressionnode.ts
+var IdentifierExpressionNode$zodSchema;
+var init_identifierexpressionnode = __esm(() => {
+  init_zod();
+  init_identifierexpressionnodeleveltwo();
+  init_identifiersearch();
+  IdentifierExpressionNode$zodSchema = object({
+    and: array(IdentifierExpressionNodeLevelTwo$zodSchema).optional(),
+    or: array(IdentifierExpressionNodeLevelTwo$zodSchema).optional(),
+    term: IdentifierSearch$zodSchema.optional().describe("One customer-submitted identifier. Defaults to exact comparison of the original submitted value. canonical uses the supported identifier normalisation without an ownership claim: email preserves local-part case, NFC-normalises it and lowercases the domain without removing dots or tags; phone uses international E.164 without extensions or an inferred region; username uses NFC and Unicode case folding within the customer namespace. mailbox is email-only and explicitly selects existing list rules: case-insensitive, remove +tag, and ignore local-part dots at gmail.com and googlemail.com; googlemail.com maps to gmail.com. Username requires namespace customer. Email and phone forbid namespace. Source-discovered identifiers and platform handles are not searched. Unsupported kinds, namespaces, modes and invalid values return 400. Search equality does not establish verified ownership or merge accounts.")
+  });
+});
+
+// src/models/scopeenum.ts
+var ScopeEnum$zodSchema;
+var init_scopeenum = __esm(() => {
+  init_zod();
+  ScopeEnum$zodSchema = _enum([
+    "assessment",
+    "account"
+  ]).describe("assessment requires one submission to satisfy the complete expression. account permits witnesses across retained submissions of one account and is supported only by POST /v1/accounts/search. No default: select scope explicitly.");
+});
+
+// src/models/identifierexpression.ts
+var IdentifierExpression$zodSchema;
+var init_identifierexpression = __esm(() => {
+  init_zod();
+  init_identifierexpressionnode();
+  init_scopeenum();
+  IdentifierExpression$zodSchema = object({
+    expression: IdentifierExpressionNode$zodSchema,
+    scope: ScopeEnum$zodSchema.describe("assessment requires one submission to satisfy the complete expression. account permits witnesses across retained submissions of one account and is supported only by POST /v1/accounts/search. No default: select scope explicitly.")
+  }).describe("A bounded AND/OR expression over submitted identifiers. Required scope assessment means the entire expression must match one retained assessment. Scope account permits each term to match a different retained assessment of the same account and is accepted only by account search. Exactly one of term, and or or is allowed at every node. Groups contain 2 to 8 operands, with at most 3 nested group levels and 8 raw term occurrences over the entire expression. A root term is allowed. Duplicate terms with the same kind, match rule, namespace and normalized comparison are idempotent, but count toward the raw limit. Match rules default to exact and preserve the existing identifier contract. Only retained submitted identifiers can satisfy a term. Unknown fields, unsupported scopes and malformed or oversized expressions return 400 invalid_request.");
+});
+
 // src/models/accountdirectorysearchrequest.ts
 var AccountDirectorySearchRequest$zodSchema;
 var init_accountdirectorysearchrequest = __esm(() => {
   init_zod();
+  init_identifierexpression();
   init_identifiersearch();
   AccountDirectorySearchRequest$zodSchema = object({
     account_id: string2().optional().describe("Your own opaque identifier for the account being checked, scoped to your workspace. Use an id you mint, with no direct identifier (email, phone, name or national id) in it. '|' is accepted so an Auth0 user id such as 'auth0|64abc' passes unchanged; '@', '+', '$' and whitespace are refused by the pattern, as is an exact-shape JWT; a hex digest such as a SHA-256 is allowed, because hashing an internal id is a common pseudonymous scheme. A value such as '07700900123' or 'jane.doe.gmail.com' cannot be told apart from an opaque id. It travels in bodies, and in a URL only as the path segment of GET /v1/accounts/{account_id} and its /assessments. An assessment requested by a provider hook at pre_registration, which has no account yet, carries the server-issued account_id pre: followed by its assessment_id."),
-    cursor: string2().optional().describe("Opaque, expiring cursor bound to this environment, operation and every filter. Keep the filters unchanged."),
+    cursor: string2().optional().describe("Opaque, expiring cursor bound to workspace, environment, operation and all filters, including expression scope, ordered structure and original term values. Keep grouping, operand order, matching modes and values unchanged; an omitted match is equivalent to exact. The page limit may change."),
     email: string2().optional().describe("Assessments of every account that one of its retained admitted assessments sent this mailbox as identifiers.email, matched as lists match an email entry: case-insensitive, a +tag removed and, at gmail.com and googlemail.com, the dots of the local part ignored. Only assessments stored since email list matching began carry the mailbox. An address that is not a valid mailbox is refused with 400."),
     identifier: IdentifierSearch$zodSchema.optional().describe("One customer-submitted identifier. Defaults to exact comparison of the original submitted value. canonical uses the supported identifier normalisation without an ownership claim: email preserves local-part case, NFC-normalises it and lowercases the domain without removing dots or tags; phone uses international E.164 without extensions or an inferred region; username uses NFC and Unicode case folding within the customer namespace. mailbox is email-only and explicitly selects existing list rules: case-insensitive, remove +tag, and ignore local-part dots at gmail.com and googlemail.com; googlemail.com maps to gmail.com. Username requires namespace customer. Email and phone forbid namespace. Source-discovered identifiers and platform handles are not searched. Unsupported kinds, namespaces, modes and invalid values return 400. Search equality does not establish verified ownership or merge accounts."),
+    identifier_expression: IdentifierExpression$zodSchema.optional().describe("A bounded AND/OR expression over submitted identifiers. Required scope assessment means the entire expression must match one retained assessment. Scope account permits each term to match a different retained assessment of the same account and is accepted only by account search. Exactly one of term, and or or is allowed at every node. Groups contain 2 to 8 operands, with at most 3 nested group levels and 8 raw term occurrences over the entire expression. A root term is allowed. Duplicate terms with the same kind, match rule, namespace and normalized comparison are idempotent, but count toward the raw limit. Match rules default to exact and preserve the existing identifier contract. Only retained submitted identifiers can satisfy a term. Unknown fields, unsupported scopes and malformed or oversized expressions return 400 invalid_request."),
     limit: int().default(25),
     needs_action: boolean2().default(false).describe("Select accounts with a retained open or in-progress review, or a current review/block account decision with no retained effective account outcome. The server applies this filter before counting and pagination. Requires reviews.read as well as history.read for console members; API keys additionally require management.")
-  }).describe("Bounded distinct-account search for one authenticated workspace/environment. identifier matches any retained admitted assessment of an account, including historical submitted values. email preserves the legacy canonical-mailbox filter. identifier and email cannot be combined. All other filters combine using AND. Typed identifier search uses stable opaque account order; ordinary and legacy email searches retain newest-seen ordering. Pages are live, not a cross-page snapshot. Requires history or investigate authority and identifier-read permission for identifier or email filtering.");
+  }).describe("Bounded distinct-account search for one authenticated workspace/environment. identifier matches any retained admitted assessment of an account, including historical submitted values. email preserves the legacy canonical-mailbox filter. identifier and email cannot be combined. All other filters combine using AND. Typed identifier search uses stable opaque account order; ordinary and legacy email searches retain newest-seen ordering. Pages are live, not a cross-page snapshot. Requires history or investigate authority and identifier-read permission for identifier, identifier_expression or email filtering. identifier_expression explicitly chooses scope assessment (one whole matching submission) or account (terms may match different retained submissions of one account). At most 8 raw terms and 3 group levels. Mutually exclusive with identifier and email. Expression search uses the same stable opaque account order as typed identifier search.");
 });
 
 // src/funcs/accountsSearch.ts
@@ -55002,7 +55078,7 @@ var init_accountsSearch2 = __esm(() => {
     name: "search_accounts",
     description: `Search distinct accounts by submitted identifier or account ID
 
-Search distinct accounts observed in retained assessments in this environment. identifier matches an exact, canonical or explicitly selected mailbox form of a submitted email, phone or customer-namespace username. It matches historical retained inputs and returns matched_identifier with the original value and matching assessment. Each row has its newest retained assessment, current account decision when available, retained assessment count, and total distinct-account count. identifier and legacy email are mutually exclusive; account_id and needs_action combine with either using AND. Set needs_action to select accounts with a retained open or in-progress review, or a current review/block account decision without an effective retained account outcome. This filter applies before counting and pagination and adds waiting_for reasons. Current decisions include account list overrides and shared-key scoring and preserve admission holds. Typed identifier search uses stable opaque account order; ordinary and legacy email searches retain newest-seen order. Results are live across pages; each page's items and total share a database snapshot, while current account risk is read separately. Cursors are expiring and bound to scope, operation and filters. Totals are exact below 10000 and capped at 10000. Requires history or investigate authority and identifier-read permission for identifier or email filtering. needs_action additionally requires management scope. Source-discovered associations are not searched and equality is not verified ownership.`,
+Search distinct accounts observed in retained assessments in this environment. identifier matches an exact, canonical or explicitly selected mailbox form of a submitted email, phone or customer-namespace username. It matches historical retained inputs and returns matched_identifier with the original value and matching assessment. Each row has its newest retained assessment, current account decision when available, retained assessment count, and total distinct-account count. identifier and legacy email are mutually exclusive; account_id and needs_action combine with either using AND. Set needs_action to select accounts with a retained open or in-progress review, or a current review/block account decision without an effective retained account outcome. This filter applies before counting and pagination and adds waiting_for reasons. Current decisions include account list overrides and shared-key scoring and preserve admission holds. Typed identifier search uses stable opaque account order; ordinary and legacy email searches retain newest-seen order. Results are live across pages; each page's items and total share a database snapshot, while current account risk is read separately. Cursors are expiring and bound to scope, operation and filters. Totals are exact below 10000 and capped at 10000. Requires history or investigate authority and identifier-read permission for identifier, identifier_expression or email filtering. needs_action additionally requires management scope. Source-discovered associations are not searched and equality is not verified ownership. identifier_expression combines submitted terms with bounded AND/OR, at most 8 raw terms and 3 group levels. Each node selects exactly one of term, and, or. Groups have 2 to 8 operands. Duplicate normalized terms are idempotent and still count toward the limit. identifier_expression, identifier and email are mutually exclusive. Expression results use matched_identifiers with original submitted witnesses and zero-based depth-first term_index. All satisfied unique terms are returned in first-occurrence order. Cursors bind scope, ordered structure, original values, matching modes and all other filters; changing only page limit is allowed. Required expression scope assessment evaluates the whole expression in one retained submission; scope account allows different retained submissions of the same account to satisfy different terms. Both use stable opaque account ordering and distinct-account counting before pagination.`,
     annotations: {
       title: "Search retained accounts by identifier",
       destructiveHint: false,
@@ -56439,6 +56515,7 @@ var init_assessmentsearchrequest = __esm(() => {
   init_band();
   init_decision();
   init_flow();
+  init_identifierexpression();
   init_identifiersearch();
   init_impact();
   init_lane();
@@ -56453,12 +56530,13 @@ var init_assessmentsearchrequest = __esm(() => {
     band: Band$zodSchema.optional(),
     changed: boolean2().optional().describe("true returns only assessments whose latest stored revision's decision differs from their first answer's decision (see decision); false only the others. An assessment whose first answer or latest revision has no decision yet is not changed. Cannot be combined with revision first."),
     country: string2().optional(),
-    cursor: string2().optional().describe("Opaque, expiring cursor bound to this environment, operation and every filter. Keep the filters unchanged."),
+    cursor: string2().optional().describe("Opaque, expiring cursor bound to workspace, environment, operation and all filters, including expression scope, ordered structure and original term values. Keep grouping, operand order, matching modes and values unchanged; an omitted match is equivalent to exact. The page limit may change."),
     decision: Decision$zodSchema.optional().describe("An assessment's own decision: block when its stored risk.block is true, otherwise its recommendation. It is not the account's decision or held-admission state."),
     email: string2().optional().describe("Assessments of every account that one of its retained admitted assessments sent this mailbox as identifiers.email, matched as lists match an email entry: case-insensitive, a +tag removed and, at gmail.com and googlemail.com, the dots of the local part ignored. Only assessments stored since email list matching began carry the mailbox. An address that is not a valid mailbox is refused with 400."),
     flow: Flow$zodSchema.optional().describe("The event an assessment is made for: account_creation (a user creates an account), login (a user returns to an existing account) or purchase (a payment or a credit grant). The account's risk is reported with the decision for this flow."),
     from: string2(),
     identifier: IdentifierSearch$zodSchema.optional().describe("One customer-submitted identifier. Defaults to exact comparison of the original submitted value. canonical uses the supported identifier normalisation without an ownership claim: email preserves local-part case, NFC-normalises it and lowercases the domain without removing dots or tags; phone uses international E.164 without extensions or an inferred region; username uses NFC and Unicode case folding within the customer namespace. mailbox is email-only and explicitly selects existing list rules: case-insensitive, remove +tag, and ignore local-part dots at gmail.com and googlemail.com; googlemail.com maps to gmail.com. Username requires namespace customer. Email and phone forbid namespace. Source-discovered identifiers and platform handles are not searched. Unsupported kinds, namespaces, modes and invalid values return 400. Search equality does not establish verified ownership or merge accounts."),
+    identifier_expression: IdentifierExpression$zodSchema.optional().describe("A bounded AND/OR expression over submitted identifiers. Required scope assessment means the entire expression must match one retained assessment. Scope account permits each term to match a different retained assessment of the same account and is accepted only by account search. Exactly one of term, and or or is allowed at every node. Groups contain 2 to 8 operands, with at most 3 nested group levels and 8 raw term occurrences over the entire expression. A root term is allowed. Duplicate terms with the same kind, match rule, namespace and normalized comparison are idempotent, but count toward the raw limit. Match rules default to exact and preserve the existing identifier contract. Only retained submitted identifiers can satisfy a term. Unknown fields, unsupported scopes and malformed or oversized expressions return 400 invalid_request."),
     impact: Impact$zodSchema.optional().describe("The selected reason's served impact band. Requires reason."),
     lane: Lane$zodSchema.optional().describe("An evidence lane: accounts (account presence for email and username), phone, breach, domain (the email domain's registration) and ip."),
     limit: int().default(20),
@@ -56471,7 +56549,7 @@ var init_assessmentsearchrequest = __esm(() => {
     score_min: int().optional().describe("Inclusive lower score bound. Pending answers without a score do not match."),
     status: Status$zodSchema.optional().describe("Processing state, separate from evidence coverage. complete: final; nothing is still running, but unsupported, failed or unanswered lanes remain in incomplete_sources. partial: a recommendation exists and evidence is incomplete; assessment_url identifies continuing work when present. pending: no recommendation yet; poll or wait for the webhook. Finished processing does not mean all sources answered."),
     to: string2()
-  }).describe("Search retained assessments created in [from,to), at most 366 days. identifier matches the submitted value of each returned assessment directly. The legacy email filter keeps its account-wide mailbox semantics and cannot be combined with identifier. Other filters combine using AND and describe assessment decisions, separate from current account decisions. Results use newest-created order with an assessment-ID tie break and are live, not a snapshot across pages. Requires history or investigate authority; identifier/email filtering also requires identifier-read permission. Detailed response mode additionally requires detailed permission. No Idempotency-Key.");
+  }).describe("Search retained assessments created in [from,to), at most 366 days. identifier matches the submitted value of each returned assessment directly. The legacy email filter keeps its account-wide mailbox semantics and cannot be combined with identifier. Other filters combine using AND and describe assessment decisions, separate from current account decisions. Results use newest-created order with an assessment-ID tie break and are live, not a snapshot across pages. Requires history or investigate authority; identifier, identifier_expression and email filtering also require identifier-read permission. Detailed response mode additionally requires detailed permission. No Idempotency-Key. identifier_expression requires scope assessment and matches the complete expression within each returned submission; account scope returns 400 invalid_request. At most 8 raw terms and 3 group levels. Mutually exclusive with identifier and email.");
 });
 
 // src/funcs/assessmentsSearch.ts
@@ -56567,7 +56645,7 @@ var init_assessmentsSearch2 = __esm(() => {
     name: "search_assessments",
     description: `Search assessments across this environment
 
-Search retained assessments created in [from,to), at most 366 days. identifier directly matches that assessment's submitted email, phone or customer-namespace username using exact, canonical or explicitly selected email mailbox matching. matched_identifier explains the original value and match basis. Legacy email keeps its account-wide mailbox semantics and cannot be combined with identifier. Other filters combine using AND and describe assessment decisions, separate from current account decisions. Each item carries the original submitted identifiers and its first_decision when available. Newest-created order has an assessment-ID tie break. Results are live across pages; each page's total and items use one database snapshot. Totals are exact below 10000 and capped at 10000. Requires history or investigate authority and identifier-read permission for identifier/email filters; detailed mode also requires detailed permission. No Idempotency-Key.`,
+Search retained assessments created in [from,to), at most 366 days. identifier directly matches that assessment's submitted email, phone or customer-namespace username using exact, canonical or explicitly selected email mailbox matching. matched_identifier explains the original value and match basis. Legacy email keeps its account-wide mailbox semantics and cannot be combined with identifier. Other filters combine using AND and describe assessment decisions, separate from current account decisions. Each item carries the original submitted identifiers and its first_decision when available. Newest-created order has an assessment-ID tie break. Results are live across pages; each page's total and items use one database snapshot. Totals are exact below 10000 and capped at 10000. Requires history or investigate authority and identifier-read permission for identifier, identifier_expression or email filters; detailed mode also requires detailed permission. No Idempotency-Key. identifier_expression combines submitted terms with bounded AND/OR, at most 8 raw terms and 3 group levels. Each node selects exactly one of term, and, or. Groups have 2 to 8 operands. Duplicate normalized terms are idempotent and still count toward the limit. identifier_expression, identifier and email are mutually exclusive. Expression results use matched_identifiers with original submitted witnesses and zero-based depth-first term_index. All satisfied unique terms are returned in first-occurrence order. Cursors bind scope, ordered structure, original values, matching modes and all other filters; changing only page limit is allowed. Expression scope must be assessment: each returned assessment itself satisfies the complete expression. Scope account is rejected with 400 invalid_request; use account search for historical combinations.`,
     annotations: {
       title: "Search assessments in this environment",
       destructiveHint: false,
@@ -69744,7 +69822,7 @@ endpoint.verification sends a signed challenge now and answers whether the endpo
 function createMCPServer(deps) {
   const server = new McpServer({
     name: "NoResponse",
-    version: "0.10.4"
+    version: "0.11.1"
   });
   const getClient = deps.getSDK || (() => new NoResponseCore({
     security: deps.security,
@@ -70010,7 +70088,7 @@ Count this environment's assessments created in [from,to) by UTC hour, or by day
       name: "search_assessments",
       description: `Search assessments across this environment
 
-Search retained assessments created in [from,to), at most 366 days. identifier directly matches that assessment's submitted email, phone or customer-namespace username using exact, canonical or explicitly selected email mailbox matching. matched_identifier explains the original value and match basis. Legacy email keeps its account-wide mailbox semantics and cannot be combined with identifier. Other filters combine using AND and describe assessment decisions, separate from current account decisions. Each item carries the original submitted identifiers and its first_decision when available. Newest-created order has an assessment-ID tie break. Results are live across pages; each page's total and items use one database snapshot. Totals are exact below 10000 and capped at 10000. Requires history or investigate authority and identifier-read permission for identifier/email filters; detailed mode also requires detailed permission. No Idempotency-Key.`
+Search retained assessments created in [from,to), at most 366 days. identifier directly matches that assessment's submitted email, phone or customer-namespace username using exact, canonical or explicitly selected email mailbox matching. matched_identifier explains the original value and match basis. Legacy email keeps its account-wide mailbox semantics and cannot be combined with identifier. Other filters combine using AND and describe assessment decisions, separate from current account decisions. Each item carries the original submitted identifiers and its first_decision when available. Newest-created order has an assessment-ID tie break. Results are live across pages; each page's total and items use one database snapshot. Totals are exact below 10000 and capped at 10000. Requires history or investigate authority and identifier-read permission for identifier, identifier_expression or email filters; detailed mode also requires detailed permission. No Idempotency-Key. identifier_expression combines submitted terms with bounded AND/OR, at most 8 raw terms and 3 group levels. Each node selects exactly one of term, and, or. Groups have 2 to 8 operands. Duplicate normalized terms are idempotent and still count toward the limit. identifier_expression, identifier and email are mutually exclusive. Expression results use matched_identifiers with original submitted witnesses and zero-based depth-first term_index. All satisfied unique terms are returned in first-occurrence order. Cursors bind scope, ordered structure, original values, matching modes and all other filters; changing only page limit is allowed. Expression scope must be assessment: each returned assessment itself satisfies the complete expression. Scope account is rejected with 400 invalid_request; use account search for historical combinations.`
     },
     {
       name: "get_assessment_version",
@@ -70112,7 +70190,7 @@ List retained immutable risk decisions for one account with an authenticated cur
       name: "search_accounts",
       description: `Search distinct accounts by submitted identifier or account ID
 
-Search distinct accounts observed in retained assessments in this environment. identifier matches an exact, canonical or explicitly selected mailbox form of a submitted email, phone or customer-namespace username. It matches historical retained inputs and returns matched_identifier with the original value and matching assessment. Each row has its newest retained assessment, current account decision when available, retained assessment count, and total distinct-account count. identifier and legacy email are mutually exclusive; account_id and needs_action combine with either using AND. Set needs_action to select accounts with a retained open or in-progress review, or a current review/block account decision without an effective retained account outcome. This filter applies before counting and pagination and adds waiting_for reasons. Current decisions include account list overrides and shared-key scoring and preserve admission holds. Typed identifier search uses stable opaque account order; ordinary and legacy email searches retain newest-seen order. Results are live across pages; each page's items and total share a database snapshot, while current account risk is read separately. Cursors are expiring and bound to scope, operation and filters. Totals are exact below 10000 and capped at 10000. Requires history or investigate authority and identifier-read permission for identifier or email filtering. needs_action additionally requires management scope. Source-discovered associations are not searched and equality is not verified ownership.`
+Search distinct accounts observed in retained assessments in this environment. identifier matches an exact, canonical or explicitly selected mailbox form of a submitted email, phone or customer-namespace username. It matches historical retained inputs and returns matched_identifier with the original value and matching assessment. Each row has its newest retained assessment, current account decision when available, retained assessment count, and total distinct-account count. identifier and legacy email are mutually exclusive; account_id and needs_action combine with either using AND. Set needs_action to select accounts with a retained open or in-progress review, or a current review/block account decision without an effective retained account outcome. This filter applies before counting and pagination and adds waiting_for reasons. Current decisions include account list overrides and shared-key scoring and preserve admission holds. Typed identifier search uses stable opaque account order; ordinary and legacy email searches retain newest-seen order. Results are live across pages; each page's items and total share a database snapshot, while current account risk is read separately. Cursors are expiring and bound to scope, operation and filters. Totals are exact below 10000 and capped at 10000. Requires history or investigate authority and identifier-read permission for identifier, identifier_expression or email filtering. needs_action additionally requires management scope. Source-discovered associations are not searched and equality is not verified ownership. identifier_expression combines submitted terms with bounded AND/OR, at most 8 raw terms and 3 group levels. Each node selects exactly one of term, and, or. Groups have 2 to 8 operands. Duplicate normalized terms are idempotent and still count toward the limit. identifier_expression, identifier and email are mutually exclusive. Expression results use matched_identifiers with original submitted witnesses and zero-based depth-first term_index. All satisfied unique terms are returned in first-occurrence order. Cursors bind scope, ordered structure, original values, matching modes and all other filters; changing only page limit is allowed. Required expression scope assessment evaluates the whole expression in one retained submission; scope account allows different retained submissions of the same account to satisfy different terms. Both use stable opaque account ordering and distinct-account counting before pagination.`
     },
     {
       name: "list_keys",
@@ -79033,7 +79111,7 @@ var routes = buildRouteMap({
 var app = buildApplication(routes, {
   name: "mcp",
   versionInfo: {
-    currentVersion: "0.10.4"
+    currentVersion: "0.11.1"
   }
 });
 run(app, process3.argv.slice(2), buildContext(process3));
@@ -79041,5 +79119,5 @@ export {
   app
 };
 
-//# debugId=5019228518CA43EA64756E2164756E21
+//# debugId=13945951AFF63AF964756E2164756E21
 //# sourceMappingURL=mcp-server.js.map