@noresponse/mcp 0.12.1 → 0.13.1

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.13.1
+
+* `SDK.groups.getPerson()`:  `response` **Changed**
+
+## 0.13.0
+
+No changes detected.
+
 ## 0.12.1
 
 No changes detected.

package/README.md

@@ -16,7 +16,7 @@ The server uses the API key you give it and stores nothing. API key rotation and
 | `query_assessments` | Page through one account's unexpired assessments, newest first. | `POST /v1/assessments/query` |
 | `get_account` | Read an account's one current risk: the score, a decision (`allow`, `step_up`, `review`, `block`, or `held` while a held flow waits) for each flow, and the assessment it comes from. Needs the `history` scope. | `GET /v1/accounts/{account_id}` |
 | `list_account_assessments` | Page through one account's unexpired assessments, newest first, with the account id in the URL. Needs the `history` scope. | `GET /v1/accounts/{account_id}/assessments` |
-| `list_linked_accounts` | List the other accounts in this environment that submitted an email, phone or username this account submitted, with both submitted witnesses. Needs `history`, or `investigate` with `evidence`. | `GET /v1/accounts/{account_id}/linked_accounts` |
+| `list_linked_accounts` | List the other accounts in this environment that submitted an email, phone or username this account submitted, with both submitted witnesses. Needs `history`, or `investigate` with `evidence`. | `GET /v1/accounts/{account_id}/links` |
 | `list_changed_accounts` | List the accounts whose risk changed, oldest change first; pass `next_cursor` back as `changed_since` to poll, and `unenforced` true for only the accounts that need action. Needs the `history` scope. | `GET /v1/accounts` |
 | `record_enforcement` | Record what you did to an account in your identity provider for one flow at one `risk_version`, applied or failed. A repeat answers the stored record. Needs the `history` scope. | `POST /v1/accounts/{account_id}/enforcements` |
 | `delete_assessment` | Delete one assessment in the key's environment, with its evidence and outcomes, and score its account again. The answer names the assessment the account's risk now comes from. A repeat answers 404. Needs the `delete` scope; marked destructive. | `DELETE /v1/assessments/{assessment_id}` |

package/bin/mcp-server.js

@@ -48136,9 +48136,9 @@ var init_config = __esm(() => {
   SDK_METADATA = {
     language: "typescript",
     openapiDocVersion: "1",
-    sdkVersion: "0.12.1",
+    sdkVersion: "0.13.1",
     genVersion: "internal",
-    userAgent: "noresponse-sdk/mcp-typescript 0.12.1 internal 1 @noresponse/mcp"
+    userAgent: "noresponse-sdk/mcp-typescript 0.13.1 internal 1 @noresponse/mcp"
   };
 });
 
@@ -50454,7 +50454,7 @@ var init_account = __esm(() => {
     risk_version: int().describe("The version of the account's current risk. It increases every time the account's current risk or decisions_by_flow changes, and does not decrease. Of two copies of an account, the one with the higher risk_version is newer. account.risk_changed carries the risk_version that its change made."),
     schema_version: literal("1").default("1").optional().describe("Version of the body shape."),
     updated_at: string2().describe("updated_at of that assessment's latest revision.")
-  }).describe("Body of the 200 answer to GET /v1/accounts/{account_id}: the one current risk of one of the calling workspace's accounts. It is the risk of the account's latest assessment that has a decision (status complete or partial), by created_at and then assessment_id, scored exactly as GET /v1/assessments/{assessment_id} scores that assessment, plus the account's own reason shared_api_key when a key issued to the account was used from many IP addresses or countries (POST /v1/key_usage/batches). Its assessments are the account's history (GET /v1/accounts/{account_id}/assessments).");
+  }).describe("Body of the 200 answer to GET /v1/accounts/{account_id}: the one current risk of one of the calling workspace's accounts. It is the risk of the account's latest assessment that has a decision (status complete or partial), by created_at and then assessment_id, scored exactly as GET /v1/assessments/{assessment_id} scores that assessment, plus the account's own reason shared_api_key when a key issued to the account was used from many IP addresses or countries (POST /v1/keys/usage). Its assessments are the account's history (GET /v1/accounts/{account_id}/assessments).");
 });
 
 // src/models/hookpoint.ts
@@ -51373,7 +51373,7 @@ var init_assessmentdetail = __esm(() => {
   init_signal();
   init_status();
   AssessmentDetail$zodSchema = object({
-    account_id: string2().describe("Your own opaque identifier for the account being checked, scoped to your workspace. Use an id you mint, with no direct identifier (email, phone, name or national id) in it. '|' is accepted so an Auth0 user id such as 'auth0|64abc' passes unchanged; '@', '+', '$' and whitespace are refused by the pattern, as is an exact-shape JWT; a hex digest such as a SHA-256 is allowed, because hashing an internal id is a common pseudonymous scheme. A value such as '07700900123' or 'jane.doe.gmail.com' cannot be told apart from an opaque id. It travels in bodies, and in a URL only as the path segment of GET /v1/accounts/{account_id}, its /assessments and its /linked_accounts. An assessment requested by a provider hook at pre_registration, which has no account yet, carries the server-issued account_id pre: followed by its assessment_id."),
+    account_id: string2().describe("Your own opaque identifier for the account being checked, scoped to your workspace. Use an id you mint, with no direct identifier (email, phone, name or national id) in it. '|' is accepted so an Auth0 user id such as 'auth0|64abc' passes unchanged; '@', '+', '$' and whitespace are refused by the pattern, as is an exact-shape JWT; a hex digest such as a SHA-256 is allowed, because hashing an internal id is a common pseudonymous scheme. A value such as '07700900123' or 'jane.doe.gmail.com' cannot be told apart from an opaque id. It travels in bodies, and in a URL only as the path segment of GET /v1/accounts/{account_id}, its /assessments and its /links. An assessment requested by a provider hook at pre_registration, which has no account yet, carries the server-issued account_id pre: followed by its assessment_id."),
     assessment_id: string2().describe("Opaque, server-assigned assessment id: 'asm_' and a 26-character Crockford base32 ULID. Unique within the workspace; another workspace's assessment id answers 404."),
     assessment_url: string2().optional().describe("Server-relative path of the authoritative assessment, GET /v1/assessments/{assessment_id}."),
     assessment_version: int().describe("Monotonic revision of this assessment. 1 on the synchronous answer; each material change while the assessment is served (an async continuation settling a source, a change of recommendation, confidence or status) increments it. Expiry does not increment it: an expired assessment is gone, not revised, and the expiry webhook carries the last served version."),
@@ -51427,7 +51427,7 @@ var init_assessment = __esm(() => {
   init_flow();
   init_status();
   Assessment$zodSchema = object({
-    account: Account$zodSchema.optional().describe("Body of the 200 answer to GET /v1/accounts/{account_id}: the one current risk of one of the calling workspace's accounts. It is the risk of the account's latest assessment that has a decision (status complete or partial), by created_at and then assessment_id, scored exactly as GET /v1/assessments/{assessment_id} scores that assessment, plus the account's own reason shared_api_key when a key issued to the account was used from many IP addresses or countries (POST /v1/key_usage/batches). Its assessments are the account's history (GET /v1/accounts/{account_id}/assessments)."),
+    account: Account$zodSchema.optional().describe("Body of the 200 answer to GET /v1/accounts/{account_id}: the one current risk of one of the calling workspace's accounts. It is the risk of the account's latest assessment that has a decision (status complete or partial), by created_at and then assessment_id, scored exactly as GET /v1/assessments/{assessment_id} scores that assessment, plus the account's own reason shared_api_key when a key issued to the account was used from many IP addresses or countries (POST /v1/keys/usage). Its assessments are the account's history (GET /v1/accounts/{account_id}/assessments)."),
     depth: Depth$zodSchema.describe("How long the synchronous answer waits for sources. quick waits only for the fast sources, those that answer within 500 ms of ingress (or deadline_ms when lower); full waits for the whole budget, up to 3000 ms. Sources still running at the cut continue asynchronously and update the assessment either way."),
     detail: AssessmentDetail$zodSchema.describe("One assessment's own facts: its score and recommendation, the signals behind them, the lanes still running and its timing. risk here is this assessment's own score; the account's current risk is the account member of the assessment. risk and recommendation are present for complete and partial; assessment_url is present for pending."),
     flow: Flow$zodSchema.describe("The event an assessment is made for: account_creation (a user creates an account), login (a user returns to an existing account) or purchase (a payment or a credit grant). The account's risk is reported with the decision for this flow."),
@@ -52263,7 +52263,7 @@ var init_credentialassociation = __esm(() => {
   init_credentialassociationactor();
   init_credentialassociationretiredby();
   CredentialAssociation$zodSchema = object({
-    account_id: string2().describe("Your own opaque identifier for the account being checked, scoped to your workspace. Use an id you mint, with no direct identifier (email, phone, name or national id) in it. '|' is accepted so an Auth0 user id such as 'auth0|64abc' passes unchanged; '@', '+', '$' and whitespace are refused by the pattern, as is an exact-shape JWT; a hex digest such as a SHA-256 is allowed, because hashing an internal id is a common pseudonymous scheme. A value such as '07700900123' or 'jane.doe.gmail.com' cannot be told apart from an opaque id. It travels in bodies, and in a URL only as the path segment of GET /v1/accounts/{account_id}, its /assessments and its /linked_accounts. An assessment requested by a provider hook at pre_registration, which has no account yet, carries the server-issued account_id pre: followed by its assessment_id."),
+    account_id: string2().describe("Your own opaque identifier for the account being checked, scoped to your workspace. Use an id you mint, with no direct identifier (email, phone, name or national id) in it. '|' is accepted so an Auth0 user id such as 'auth0|64abc' passes unchanged; '@', '+', '$' and whitespace are refused by the pattern, as is an exact-shape JWT; a hex digest such as a SHA-256 is allowed, because hashing an internal id is a common pseudonymous scheme. A value such as '07700900123' or 'jane.doe.gmail.com' cannot be told apart from an opaque id. It travels in bodies, and in a URL only as the path segment of GET /v1/accounts/{account_id}, its /assessments and its /links. An assessment requested by a provider hook at pre_registration, which has no account yet, carries the server-issued account_id pre: followed by its assessment_id."),
     actor: CredentialAssociationActor$zodSchema,
     created_at: string2(),
     id: string2(),
@@ -52628,12 +52628,12 @@ var init_accountbinding = __esm(() => {
   init_zod();
   init_accountbindingactor();
   AccountBinding$zodSchema = object({
-    account_id: string2().describe("Your own opaque identifier for the account being checked, scoped to your workspace. Use an id you mint, with no direct identifier (email, phone, name or national id) in it. '|' is accepted so an Auth0 user id such as 'auth0|64abc' passes unchanged; '@', '+', '$' and whitespace are refused by the pattern, as is an exact-shape JWT; a hex digest such as a SHA-256 is allowed, because hashing an internal id is a common pseudonymous scheme. A value such as '07700900123' or 'jane.doe.gmail.com' cannot be told apart from an opaque id. It travels in bodies, and in a URL only as the path segment of GET /v1/accounts/{account_id}, its /assessments and its /linked_accounts. An assessment requested by a provider hook at pre_registration, which has no account yet, carries the server-issued account_id pre: followed by its assessment_id."),
+    account_id: string2().describe("Your own opaque identifier for the account being checked, scoped to your workspace. Use an id you mint, with no direct identifier (email, phone, name or national id) in it. '|' is accepted so an Auth0 user id such as 'auth0|64abc' passes unchanged; '@', '+', '$' and whitespace are refused by the pattern, as is an exact-shape JWT; a hex digest such as a SHA-256 is allowed, because hashing an internal id is a common pseudonymous scheme. A value such as '07700900123' or 'jane.doe.gmail.com' cannot be told apart from an opaque id. It travels in bodies, and in a URL only as the path segment of GET /v1/accounts/{account_id}, its /assessments and its /links. An assessment requested by a provider hook at pre_registration, which has no account yet, carries the server-issued account_id pre: followed by its assessment_id."),
     actor: AccountBindingActor$zodSchema,
     assessment_id: string2().describe("Opaque, server-assigned assessment id: 'asm_' and a 26-character Crockford base32 ULID. Unique within the workspace; another workspace's assessment id answers 404."),
     assessment_version: int().describe("Monotonic revision of this assessment. 1 on the synchronous answer; each material change while the assessment is served (an async continuation settling a source, a change of recommendation, confidence or status) increments it. Expiry does not increment it: an expired assessment is gone, not revised, and the expiry webhook carries the last served version."),
     created_at: string2(),
-    provisional_account_id: string2().describe("Your own opaque identifier for the account being checked, scoped to your workspace. Use an id you mint, with no direct identifier (email, phone, name or national id) in it. '|' is accepted so an Auth0 user id such as 'auth0|64abc' passes unchanged; '@', '+', '$' and whitespace are refused by the pattern, as is an exact-shape JWT; a hex digest such as a SHA-256 is allowed, because hashing an internal id is a common pseudonymous scheme. A value such as '07700900123' or 'jane.doe.gmail.com' cannot be told apart from an opaque id. It travels in bodies, and in a URL only as the path segment of GET /v1/accounts/{account_id}, its /assessments and its /linked_accounts. An assessment requested by a provider hook at pre_registration, which has no account yet, carries the server-issued account_id pre: followed by its assessment_id.")
+    provisional_account_id: string2().describe("Your own opaque identifier for the account being checked, scoped to your workspace. Use an id you mint, with no direct identifier (email, phone, name or national id) in it. '|' is accepted so an Auth0 user id such as 'auth0|64abc' passes unchanged; '@', '+', '$' and whitespace are refused by the pattern, as is an exact-shape JWT; a hex digest such as a SHA-256 is allowed, because hashing an internal id is a common pseudonymous scheme. A value such as '07700900123' or 'jane.doe.gmail.com' cannot be told apart from an opaque id. It travels in bodies, and in a URL only as the path segment of GET /v1/accounts/{account_id}, its /assessments and its /links. An assessment requested by a provider hook at pre_registration, which has no account yet, carries the server-issued account_id pre: followed by its assessment_id.")
   }).describe("Binding appends an assessment revision and preserves earlier versions. Continuations use the same assessment. Erasing either the provisional or canonical name erases the canonical account, including the bound assessment.");
 });
 
@@ -52643,7 +52643,7 @@ var init_accountdecisionsnapshot = __esm(() => {
   init_zod();
   init_account();
   AccountDecisionSnapshot$zodSchema = object({
-    account: Account$zodSchema.describe("Body of the 200 answer to GET /v1/accounts/{account_id}: the one current risk of one of the calling workspace's accounts. It is the risk of the account's latest assessment that has a decision (status complete or partial), by created_at and then assessment_id, scored exactly as GET /v1/assessments/{assessment_id} scores that assessment, plus the account's own reason shared_api_key when a key issued to the account was used from many IP addresses or countries (POST /v1/key_usage/batches). Its assessments are the account's history (GET /v1/accounts/{account_id}/assessments)."),
+    account: Account$zodSchema.describe("Body of the 200 answer to GET /v1/accounts/{account_id}: the one current risk of one of the calling workspace's accounts. It is the risk of the account's latest assessment that has a decision (status complete or partial), by created_at and then assessment_id, scored exactly as GET /v1/assessments/{assessment_id} scores that assessment, plus the account's own reason shared_api_key when a key issued to the account was used from many IP addresses or countries (POST /v1/keys/usage). Its assessments are the account's history (GET /v1/accounts/{account_id}/assessments)."),
     assessment_version: int().describe("Monotonic revision of this assessment. 1 on the synchronous answer; each material change while the assessment is served (an async continuation settling a source, a change of recommendation, confidence or status) increments it. Expiry does not increment it: an expired assessment is gone, not revised, and the expiry webhook carries the last served version."),
     changed_at: string2(),
     feedback_outcome_id: string2().optional().describe("Opaque, server-assigned id of one recorded outcome: 'out_' and a 26-character Crockford base32 ULID. Unique within the workspace."),
@@ -52697,7 +52697,7 @@ var init_accountoutcome = __esm(() => {
   init_accountoutcomeactor();
   init_outcome();
   AccountOutcome$zodSchema = object({
-    account_id: string2().describe("Your own opaque identifier for the account being checked, scoped to your workspace. Use an id you mint, with no direct identifier (email, phone, name or national id) in it. '|' is accepted so an Auth0 user id such as 'auth0|64abc' passes unchanged; '@', '+', '$' and whitespace are refused by the pattern, as is an exact-shape JWT; a hex digest such as a SHA-256 is allowed, because hashing an internal id is a common pseudonymous scheme. A value such as '07700900123' or 'jane.doe.gmail.com' cannot be told apart from an opaque id. It travels in bodies, and in a URL only as the path segment of GET /v1/accounts/{account_id}, its /assessments and its /linked_accounts. An assessment requested by a provider hook at pre_registration, which has no account yet, carries the server-issued account_id pre: followed by its assessment_id."),
+    account_id: string2().describe("Your own opaque identifier for the account being checked, scoped to your workspace. Use an id you mint, with no direct identifier (email, phone, name or national id) in it. '|' is accepted so an Auth0 user id such as 'auth0|64abc' passes unchanged; '@', '+', '$' and whitespace are refused by the pattern, as is an exact-shape JWT; a hex digest such as a SHA-256 is allowed, because hashing an internal id is a common pseudonymous scheme. A value such as '07700900123' or 'jane.doe.gmail.com' cannot be told apart from an opaque id. It travels in bodies, and in a URL only as the path segment of GET /v1/accounts/{account_id}, its /assessments and its /links. An assessment requested by a provider hook at pre_registration, which has no account yet, carries the server-issued account_id pre: followed by its assessment_id."),
     actor: AccountOutcomeActor$zodSchema,
     effective_outcome_id: string2().optional().describe("Opaque, server-assigned id of one recorded outcome: 'out_' and a 26-character Crockford base32 ULID. Unique within the workspace."),
     expires_at: string2(),
@@ -52826,7 +52826,7 @@ var init_decisionreceipt = __esm(() => {
   init_flow();
   init_status();
   DecisionReceipt$zodSchema = object({
-    account: Account$zodSchema.optional().describe("Body of the 200 answer to GET /v1/accounts/{account_id}: the one current risk of one of the calling workspace's accounts. It is the risk of the account's latest assessment that has a decision (status complete or partial), by created_at and then assessment_id, scored exactly as GET /v1/assessments/{assessment_id} scores that assessment, plus the account's own reason shared_api_key when a key issued to the account was used from many IP addresses or countries (POST /v1/key_usage/batches). Its assessments are the account's history (GET /v1/accounts/{account_id}/assessments)."),
+    account: Account$zodSchema.optional().describe("Body of the 200 answer to GET /v1/accounts/{account_id}: the one current risk of one of the calling workspace's accounts. It is the risk of the account's latest assessment that has a decision (status complete or partial), by created_at and then assessment_id, scored exactly as GET /v1/assessments/{assessment_id} scores that assessment, plus the account's own reason shared_api_key when a key issued to the account was used from many IP addresses or countries (POST /v1/keys/usage). Its assessments are the account's history (GET /v1/accounts/{account_id}/assessments)."),
     assessment_id: string2().describe("Opaque, server-assigned assessment id: 'asm_' and a 26-character Crockford base32 ULID. Unique within the workspace; another workspace's assessment id answers 404."),
     assessment_version: int().describe("Monotonic revision of this assessment. 1 on the synchronous answer; each material change while the assessment is served (an async continuation settling a source, a change of recommendation, confidence or status) increments it. Expiry does not increment it: an expired assessment is gone, not revised, and the expiry webhook carries the last served version."),
     flow: Flow$zodSchema.describe("The event an assessment is made for: account_creation (a user creates an account), login (a user returns to an existing account) or purchase (a payment or a credit grant). The account's risk is reported with the decision for this flow."),
@@ -52880,7 +52880,7 @@ var init_accountexport = __esm(() => {
     "investigator_reviews_require_review_export"
   ]);
   AccountExport$zodSchema = object({
-    account_id: string2().describe("Your own opaque identifier for the account being checked, scoped to your workspace. Use an id you mint, with no direct identifier (email, phone, name or national id) in it. '|' is accepted so an Auth0 user id such as 'auth0|64abc' passes unchanged; '@', '+', '$' and whitespace are refused by the pattern, as is an exact-shape JWT; a hex digest such as a SHA-256 is allowed, because hashing an internal id is a common pseudonymous scheme. A value such as '07700900123' or 'jane.doe.gmail.com' cannot be told apart from an opaque id. It travels in bodies, and in a URL only as the path segment of GET /v1/accounts/{account_id}, its /assessments and its /linked_accounts. An assessment requested by a provider hook at pre_registration, which has no account yet, carries the server-issued account_id pre: followed by its assessment_id."),
+    account_id: string2().describe("Your own opaque identifier for the account being checked, scoped to your workspace. Use an id you mint, with no direct identifier (email, phone, name or national id) in it. '|' is accepted so an Auth0 user id such as 'auth0|64abc' passes unchanged; '@', '+', '$' and whitespace are refused by the pattern, as is an exact-shape JWT; a hex digest such as a SHA-256 is allowed, because hashing an internal id is a common pseudonymous scheme. A value such as '07700900123' or 'jane.doe.gmail.com' cannot be told apart from an opaque id. It travels in bodies, and in a URL only as the path segment of GET /v1/accounts/{account_id}, its /assessments and its /links. An assessment requested by a provider hook at pre_registration, which has no account yet, carries the server-issued account_id pre: followed by its assessment_id."),
     assessment_outcomes: array(ExportAssessmentOutcome$zodSchema),
     assessments: array(AssessmentRevision$zodSchema),
     bindings: array(AccountBinding$zodSchema),
@@ -53223,7 +53223,7 @@ var init_assessmentlist = __esm(() => {
   init_zod();
   init_assessmentdetail();
   AssessmentList$zodSchema = object({
-    account_id: string2().describe("Your own opaque identifier for the account being checked, scoped to your workspace. Use an id you mint, with no direct identifier (email, phone, name or national id) in it. '|' is accepted so an Auth0 user id such as 'auth0|64abc' passes unchanged; '@', '+', '$' and whitespace are refused by the pattern, as is an exact-shape JWT; a hex digest such as a SHA-256 is allowed, because hashing an internal id is a common pseudonymous scheme. A value such as '07700900123' or 'jane.doe.gmail.com' cannot be told apart from an opaque id. It travels in bodies, and in a URL only as the path segment of GET /v1/accounts/{account_id}, its /assessments and its /linked_accounts. An assessment requested by a provider hook at pre_registration, which has no account yet, carries the server-issued account_id pre: followed by its assessment_id."),
+    account_id: string2().describe("Your own opaque identifier for the account being checked, scoped to your workspace. Use an id you mint, with no direct identifier (email, phone, name or national id) in it. '|' is accepted so an Auth0 user id such as 'auth0|64abc' passes unchanged; '@', '+', '$' and whitespace are refused by the pattern, as is an exact-shape JWT; a hex digest such as a SHA-256 is allowed, because hashing an internal id is a common pseudonymous scheme. A value such as '07700900123' or 'jane.doe.gmail.com' cannot be told apart from an opaque id. It travels in bodies, and in a URL only as the path segment of GET /v1/accounts/{account_id}, its /assessments and its /links. An assessment requested by a provider hook at pre_registration, which has no account yet, carries the server-issued account_id pre: followed by its assessment_id."),
     items: array(AssessmentDetail$zodSchema),
     next_cursor: string2().optional().describe("Opaque cursor for the next page, bound to your workspace and the account_id it was issued for. Pass it back unchanged in the next query; a tampered, foreign or expired cursor answers 400 invalid_cursor."),
     retention_days: int().default(365).describe("Your current retention period, so a consumer knows how far back history reaches. Every item expires no later than its created_at plus this many days."),
@@ -53574,7 +53574,7 @@ var init_credentialpage = __esm(() => {
   init_zod();
   init_credentialassociation();
   CredentialPage$zodSchema = object({
-    account_id: string2().describe("Your own opaque identifier for the account being checked, scoped to your workspace. Use an id you mint, with no direct identifier (email, phone, name or national id) in it. '|' is accepted so an Auth0 user id such as 'auth0|64abc' passes unchanged; '@', '+', '$' and whitespace are refused by the pattern, as is an exact-shape JWT; a hex digest such as a SHA-256 is allowed, because hashing an internal id is a common pseudonymous scheme. A value such as '07700900123' or 'jane.doe.gmail.com' cannot be told apart from an opaque id. It travels in bodies, and in a URL only as the path segment of GET /v1/accounts/{account_id}, its /assessments and its /linked_accounts. An assessment requested by a provider hook at pre_registration, which has no account yet, carries the server-issued account_id pre: followed by its assessment_id."),
+    account_id: string2().describe("Your own opaque identifier for the account being checked, scoped to your workspace. Use an id you mint, with no direct identifier (email, phone, name or national id) in it. '|' is accepted so an Auth0 user id such as 'auth0|64abc' passes unchanged; '@', '+', '$' and whitespace are refused by the pattern, as is an exact-shape JWT; a hex digest such as a SHA-256 is allowed, because hashing an internal id is a common pseudonymous scheme. A value such as '07700900123' or 'jane.doe.gmail.com' cannot be told apart from an opaque id. It travels in bodies, and in a URL only as the path segment of GET /v1/accounts/{account_id}, its /assessments and its /links. An assessment requested by a provider hook at pre_registration, which has no account yet, carries the server-issued account_id pre: followed by its assessment_id."),
     items: array(CredentialAssociation$zodSchema),
     next_cursor: string2().optional().describe("Opaque, expiring cursor bound to this environment, operation and every filter. Keep the filters unchanged.")
   }).describe("Retained credential associations, ordered by id. Page with the authenticated cursor. Associations are removed on account erasure.");
@@ -53750,7 +53750,7 @@ var init_accountdecisionlist = __esm(() => {
   init_zod();
   init_accountdecisionsnapshot();
   AccountDecisionList$zodSchema = object({
-    account_id: string2().describe("Your own opaque identifier for the account being checked, scoped to your workspace. Use an id you mint, with no direct identifier (email, phone, name or national id) in it. '|' is accepted so an Auth0 user id such as 'auth0|64abc' passes unchanged; '@', '+', '$' and whitespace are refused by the pattern, as is an exact-shape JWT; a hex digest such as a SHA-256 is allowed, because hashing an internal id is a common pseudonymous scheme. A value such as '07700900123' or 'jane.doe.gmail.com' cannot be told apart from an opaque id. It travels in bodies, and in a URL only as the path segment of GET /v1/accounts/{account_id}, its /assessments and its /linked_accounts. An assessment requested by a provider hook at pre_registration, which has no account yet, carries the server-issued account_id pre: followed by its assessment_id."),
+    account_id: string2().describe("Your own opaque identifier for the account being checked, scoped to your workspace. Use an id you mint, with no direct identifier (email, phone, name or national id) in it. '|' is accepted so an Auth0 user id such as 'auth0|64abc' passes unchanged; '@', '+', '$' and whitespace are refused by the pattern, as is an exact-shape JWT; a hex digest such as a SHA-256 is allowed, because hashing an internal id is a common pseudonymous scheme. A value such as '07700900123' or 'jane.doe.gmail.com' cannot be told apart from an opaque id. It travels in bodies, and in a URL only as the path segment of GET /v1/accounts/{account_id}, its /assessments and its /links. An assessment requested by a provider hook at pre_registration, which has no account yet, carries the server-issued account_id pre: followed by its assessment_id."),
     items: array(AccountDecisionSnapshot$zodSchema),
     next_cursor: string2().optional().describe("Opaque, expiring cursor bound to the workspace, environment, account and history kind. Absent at the end.")
   }).describe("Page through recorded account decisions.");
@@ -53926,7 +53926,7 @@ var init_accountenforcementlist = __esm(() => {
   init_zod();
   init_enforcement();
   AccountEnforcementList$zodSchema = object({
-    account_id: string2().describe("Your own opaque identifier for the account being checked, scoped to your workspace. Use an id you mint, with no direct identifier (email, phone, name or national id) in it. '|' is accepted so an Auth0 user id such as 'auth0|64abc' passes unchanged; '@', '+', '$' and whitespace are refused by the pattern, as is an exact-shape JWT; a hex digest such as a SHA-256 is allowed, because hashing an internal id is a common pseudonymous scheme. A value such as '07700900123' or 'jane.doe.gmail.com' cannot be told apart from an opaque id. It travels in bodies, and in a URL only as the path segment of GET /v1/accounts/{account_id}, its /assessments and its /linked_accounts. An assessment requested by a provider hook at pre_registration, which has no account yet, carries the server-issued account_id pre: followed by its assessment_id."),
+    account_id: string2().describe("Your own opaque identifier for the account being checked, scoped to your workspace. Use an id you mint, with no direct identifier (email, phone, name or national id) in it. '|' is accepted so an Auth0 user id such as 'auth0|64abc' passes unchanged; '@', '+', '$' and whitespace are refused by the pattern, as is an exact-shape JWT; a hex digest such as a SHA-256 is allowed, because hashing an internal id is a common pseudonymous scheme. A value such as '07700900123' or 'jane.doe.gmail.com' cannot be told apart from an opaque id. It travels in bodies, and in a URL only as the path segment of GET /v1/accounts/{account_id}, its /assessments and its /links. An assessment requested by a provider hook at pre_registration, which has no account yet, carries the server-issued account_id pre: followed by its assessment_id."),
     items: array(Enforcement$zodSchema),
     next_cursor: string2().optional().describe("Opaque, expiring cursor bound to the workspace, environment, account and history kind. Absent at the end.")
   }).describe("Page through account enforcements.");
@@ -54172,7 +54172,7 @@ var init_linkedaccount = __esm(() => {
   init_zod();
   init_sharedidentifier();
   LinkedAccount$zodSchema = object({
-    account_id: string2().describe("Your own opaque identifier for the account being checked, scoped to your workspace. Use an id you mint, with no direct identifier (email, phone, name or national id) in it. '|' is accepted so an Auth0 user id such as 'auth0|64abc' passes unchanged; '@', '+', '$' and whitespace are refused by the pattern, as is an exact-shape JWT; a hex digest such as a SHA-256 is allowed, because hashing an internal id is a common pseudonymous scheme. A value such as '07700900123' or 'jane.doe.gmail.com' cannot be told apart from an opaque id. It travels in bodies, and in a URL only as the path segment of GET /v1/accounts/{account_id}, its /assessments and its /linked_accounts. An assessment requested by a provider hook at pre_registration, which has no account yet, carries the server-issued account_id pre: followed by its assessment_id."),
+    account_id: string2().describe("Your own opaque identifier for the account being checked, scoped to your workspace. Use an id you mint, with no direct identifier (email, phone, name or national id) in it. '|' is accepted so an Auth0 user id such as 'auth0|64abc' passes unchanged; '@', '+', '$' and whitespace are refused by the pattern, as is an exact-shape JWT; a hex digest such as a SHA-256 is allowed, because hashing an internal id is a common pseudonymous scheme. A value such as '07700900123' or 'jane.doe.gmail.com' cannot be told apart from an opaque id. It travels in bodies, and in a URL only as the path segment of GET /v1/accounts/{account_id}, its /assessments and its /links. An assessment requested by a provider hook at pre_registration, which has no account yet, carries the server-issued account_id pre: followed by its assessment_id."),
     shared_identifiers: array(SharedIdentifier$zodSchema).describe("One entry per shared kind, in the order email, phone, username. Each entry uses the strictest basis that links the two accounts: exact, then canonical, then mailbox.")
   });
 });
@@ -54248,7 +54248,7 @@ async function $do11(client$, request, options) {
       charEncoding: "percent"
     })
   };
-  const path$ = pathToFunc("/v1/accounts/{account_id}/linked_accounts")(pathParams$);
+  const path$ = pathToFunc("/v1/accounts/{account_id}/links")(pathParams$);
   const query$ = encodeFormQuery({
     cursor: payload$.cursor,
     limit: payload$.limit
@@ -54362,7 +54362,7 @@ var init_accountoutcomepage = __esm(() => {
   init_zod();
   init_accountoutcome();
   AccountOutcomePage$zodSchema = object({
-    account_id: string2().describe("Your own opaque identifier for the account being checked, scoped to your workspace. Use an id you mint, with no direct identifier (email, phone, name or national id) in it. '|' is accepted so an Auth0 user id such as 'auth0|64abc' passes unchanged; '@', '+', '$' and whitespace are refused by the pattern, as is an exact-shape JWT; a hex digest such as a SHA-256 is allowed, because hashing an internal id is a common pseudonymous scheme. A value such as '07700900123' or 'jane.doe.gmail.com' cannot be told apart from an opaque id. It travels in bodies, and in a URL only as the path segment of GET /v1/accounts/{account_id}, its /assessments and its /linked_accounts. An assessment requested by a provider hook at pre_registration, which has no account yet, carries the server-issued account_id pre: followed by its assessment_id."),
+    account_id: string2().describe("Your own opaque identifier for the account being checked, scoped to your workspace. Use an id you mint, with no direct identifier (email, phone, name or national id) in it. '|' is accepted so an Auth0 user id such as 'auth0|64abc' passes unchanged; '@', '+', '$' and whitespace are refused by the pattern, as is an exact-shape JWT; a hex digest such as a SHA-256 is allowed, because hashing an internal id is a common pseudonymous scheme. A value such as '07700900123' or 'jane.doe.gmail.com' cannot be told apart from an opaque id. It travels in bodies, and in a URL only as the path segment of GET /v1/accounts/{account_id}, its /assessments and its /links. An assessment requested by a provider hook at pre_registration, which has no account yet, carries the server-issued account_id pre: followed by its assessment_id."),
     effective_outcome_id: string2().optional().describe("Opaque, server-assigned id of one recorded outcome: 'out_' and a 26-character Crockford base32 ULID. Unique within the workspace."),
     items: array(AccountOutcome$zodSchema),
     next_cursor: string2().optional().describe("Opaque, expiring cursor bound to this environment, operation and every filter. Keep the filters unchanged.")
@@ -55305,7 +55305,7 @@ var init_accountdirectorysearchrequest = __esm(() => {
   init_identifierexpression();
   init_identifiersearch();
   AccountDirectorySearchRequest$zodSchema = object({
-    account_id: string2().optional().describe("Your own opaque identifier for the account being checked, scoped to your workspace. Use an id you mint, with no direct identifier (email, phone, name or national id) in it. '|' is accepted so an Auth0 user id such as 'auth0|64abc' passes unchanged; '@', '+', '$' and whitespace are refused by the pattern, as is an exact-shape JWT; a hex digest such as a SHA-256 is allowed, because hashing an internal id is a common pseudonymous scheme. A value such as '07700900123' or 'jane.doe.gmail.com' cannot be told apart from an opaque id. It travels in bodies, and in a URL only as the path segment of GET /v1/accounts/{account_id}, its /assessments and its /linked_accounts. An assessment requested by a provider hook at pre_registration, which has no account yet, carries the server-issued account_id pre: followed by its assessment_id."),
+    account_id: string2().optional().describe("Your own opaque identifier for the account being checked, scoped to your workspace. Use an id you mint, with no direct identifier (email, phone, name or national id) in it. '|' is accepted so an Auth0 user id such as 'auth0|64abc' passes unchanged; '@', '+', '$' and whitespace are refused by the pattern, as is an exact-shape JWT; a hex digest such as a SHA-256 is allowed, because hashing an internal id is a common pseudonymous scheme. A value such as '07700900123' or 'jane.doe.gmail.com' cannot be told apart from an opaque id. It travels in bodies, and in a URL only as the path segment of GET /v1/accounts/{account_id}, its /assessments and its /links. An assessment requested by a provider hook at pre_registration, which has no account yet, carries the server-issued account_id pre: followed by its assessment_id."),
     cursor: string2().optional().describe("Opaque, expiring cursor bound to workspace, environment, operation and all filters, including expression scope, ordered structure and original term values. Keep grouping, operand order, matching modes and values unchanged; an omitted match is equivalent to exact. The page limit may change."),
     email: string2().optional().describe("Assessments of every account that one of its retained admitted assessments sent this mailbox as identifiers.email, matched as lists match an email entry: case-insensitive, a +tag removed and, at gmail.com and googlemail.com, the dots of the local part ignored. Only assessments stored since email list matching began carry the mailbox. An address that is not a valid mailbox is refused with 400."),
     email_domain: string2().optional().describe("Every account that one of its retained admitted assessments sent an email of this domain or its subdomains, matched as lists match an email_domain entry and with the same identifier-read permission as email. A value that is not a registrable domain is refused with 400. Mutually exclusive with email, identifier and identifier_expression."),
@@ -55671,7 +55671,7 @@ var AccountBindingRequest$zodSchema;
 var init_accountbindingrequest = __esm(() => {
   init_zod();
   AccountBindingRequest$zodSchema = object({
-    account_id: string2().describe("Your own opaque identifier for the account being checked, scoped to your workspace. Use an id you mint, with no direct identifier (email, phone, name or national id) in it. '|' is accepted so an Auth0 user id such as 'auth0|64abc' passes unchanged; '@', '+', '$' and whitespace are refused by the pattern, as is an exact-shape JWT; a hex digest such as a SHA-256 is allowed, because hashing an internal id is a common pseudonymous scheme. A value such as '07700900123' or 'jane.doe.gmail.com' cannot be told apart from an opaque id. It travels in bodies, and in a URL only as the path segment of GET /v1/accounts/{account_id}, its /assessments and its /linked_accounts. An assessment requested by a provider hook at pre_registration, which has no account yet, carries the server-issued account_id pre: followed by its assessment_id.")
+    account_id: string2().describe("Your own opaque identifier for the account being checked, scoped to your workspace. Use an id you mint, with no direct identifier (email, phone, name or national id) in it. '|' is accepted so an Auth0 user id such as 'auth0|64abc' passes unchanged; '@', '+', '$' and whitespace are refused by the pattern, as is an exact-shape JWT; a hex digest such as a SHA-256 is allowed, because hashing an internal id is a common pseudonymous scheme. A value such as '07700900123' or 'jane.doe.gmail.com' cannot be told apart from an opaque id. It travels in bodies, and in a URL only as the path segment of GET /v1/accounts/{account_id}, its /assessments and its /links. An assessment requested by a provider hook at pre_registration, which has no account yet, carries the server-issued account_id pre: followed by its assessment_id.")
   }).describe("One-time association to an opaque stable customer account. The assessment is its natural idempotency key. Repeating the same binding returns its first receipt; a conflicting target is refused. No arbitrary account merging.");
 });
 
@@ -55968,7 +55968,7 @@ var init_assessmentrequest = __esm(() => {
   init_flow();
   init_responsemode();
   AssessmentRequest$zodSchema = object({
-    account_id: string2().describe("Your own opaque identifier for the account being checked, scoped to your workspace. Use an id you mint, with no direct identifier (email, phone, name or national id) in it. '|' is accepted so an Auth0 user id such as 'auth0|64abc' passes unchanged; '@', '+', '$' and whitespace are refused by the pattern, as is an exact-shape JWT; a hex digest such as a SHA-256 is allowed, because hashing an internal id is a common pseudonymous scheme. A value such as '07700900123' or 'jane.doe.gmail.com' cannot be told apart from an opaque id. It travels in bodies, and in a URL only as the path segment of GET /v1/accounts/{account_id}, its /assessments and its /linked_accounts. An assessment requested by a provider hook at pre_registration, which has no account yet, carries the server-issued account_id pre: followed by its assessment_id."),
+    account_id: string2().describe("Your own opaque identifier for the account being checked, scoped to your workspace. Use an id you mint, with no direct identifier (email, phone, name or national id) in it. '|' is accepted so an Auth0 user id such as 'auth0|64abc' passes unchanged; '@', '+', '$' and whitespace are refused by the pattern, as is an exact-shape JWT; a hex digest such as a SHA-256 is allowed, because hashing an internal id is a common pseudonymous scheme. A value such as '07700900123' or 'jane.doe.gmail.com' cannot be told apart from an opaque id. It travels in bodies, and in a URL only as the path segment of GET /v1/accounts/{account_id}, its /assessments and its /links. An assessment requested by a provider hook at pre_registration, which has no account yet, carries the server-issued account_id pre: followed by its assessment_id."),
     auth_context: AuthContext$zodSchema.optional().describe("Normalised claims from a session your backend has already verified with WorkOS, Clerk, Auth0 or any OIDC provider. Pass the output of the SDK's auth adapters, not a raw token."),
     client_context: AssessmentRequestClientContext$zodSchema.optional().describe("Optional context observed by the client of the user. The server parses these hints into coarse features, leaves raw user_agent and opaque ids out of every answer, and weighs a mismatch with the other evidence."),
     deadline_ms: int().optional().describe("Optional tighter budget, 50 to 3000 ms, measured from the moment the request reaches NoResponse. Absent means the 3000 ms ceiling; a value above it is refused with 400 rather than clamped."),
@@ -56360,7 +56360,7 @@ var init_assessmentquery = __esm(() => {
   init_zod();
   init_responsemode();
   AssessmentQuery$zodSchema = object({
-    account_id: string2().describe("Your own opaque identifier for the account being checked, scoped to your workspace. Use an id you mint, with no direct identifier (email, phone, name or national id) in it. '|' is accepted so an Auth0 user id such as 'auth0|64abc' passes unchanged; '@', '+', '$' and whitespace are refused by the pattern, as is an exact-shape JWT; a hex digest such as a SHA-256 is allowed, because hashing an internal id is a common pseudonymous scheme. A value such as '07700900123' or 'jane.doe.gmail.com' cannot be told apart from an opaque id. It travels in bodies, and in a URL only as the path segment of GET /v1/accounts/{account_id}, its /assessments and its /linked_accounts. An assessment requested by a provider hook at pre_registration, which has no account yet, carries the server-issued account_id pre: followed by its assessment_id."),
+    account_id: string2().describe("Your own opaque identifier for the account being checked, scoped to your workspace. Use an id you mint, with no direct identifier (email, phone, name or national id) in it. '|' is accepted so an Auth0 user id such as 'auth0|64abc' passes unchanged; '@', '+', '$' and whitespace are refused by the pattern, as is an exact-shape JWT; a hex digest such as a SHA-256 is allowed, because hashing an internal id is a common pseudonymous scheme. A value such as '07700900123' or 'jane.doe.gmail.com' cannot be told apart from an opaque id. It travels in bodies, and in a URL only as the path segment of GET /v1/accounts/{account_id}, its /assessments and its /links. An assessment requested by a provider hook at pre_registration, which has no account yet, carries the server-issued account_id pre: followed by its assessment_id."),
     cursor: string2().optional().describe("next_cursor from the previous page, unchanged. Opaque, MAC'd and bound to the workspace and account_id."),
     limit: int().default(20),
     response_mode: ResponseMode$zodSchema.optional().describe("standard returns the consolidated risk response; detailed adds merged provider-neutral facts when the key has detailed scope. There is no raw mode.")
@@ -56867,7 +56867,7 @@ var init_assessmentsearchrequest = __esm(() => {
   init_responsemode();
   init_status();
   AssessmentSearchRequest$zodSchema = object({
-    account_id: string2().optional().describe("Your own opaque identifier for the account being checked, scoped to your workspace. Use an id you mint, with no direct identifier (email, phone, name or national id) in it. '|' is accepted so an Auth0 user id such as 'auth0|64abc' passes unchanged; '@', '+', '$' and whitespace are refused by the pattern, as is an exact-shape JWT; a hex digest such as a SHA-256 is allowed, because hashing an internal id is a common pseudonymous scheme. A value such as '07700900123' or 'jane.doe.gmail.com' cannot be told apart from an opaque id. It travels in bodies, and in a URL only as the path segment of GET /v1/accounts/{account_id}, its /assessments and its /linked_accounts. An assessment requested by a provider hook at pre_registration, which has no account yet, carries the server-issued account_id pre: followed by its assessment_id."),
+    account_id: string2().optional().describe("Your own opaque identifier for the account being checked, scoped to your workspace. Use an id you mint, with no direct identifier (email, phone, name or national id) in it. '|' is accepted so an Auth0 user id such as 'auth0|64abc' passes unchanged; '@', '+', '$' and whitespace are refused by the pattern, as is an exact-shape JWT; a hex digest such as a SHA-256 is allowed, because hashing an internal id is a common pseudonymous scheme. A value such as '07700900123' or 'jane.doe.gmail.com' cannot be told apart from an opaque id. It travels in bodies, and in a URL only as the path segment of GET /v1/accounts/{account_id}, its /assessments and its /links. An assessment requested by a provider hook at pre_registration, which has no account yet, carries the server-issued account_id pre: followed by its assessment_id."),
     asn: int().optional(),
     band: Band$zodSchema.optional(),
     changed: boolean2().optional().describe("true returns only assessments whose latest stored revision's decision differs from their first answer's decision (see decision); false only the others. An assessment whose first answer or latest revision has no decision yet is not changed. Cannot be combined with revision first."),
@@ -57131,7 +57131,7 @@ async function $do26(client$, request, options) {
       charEncoding: "percent"
     })
   };
-  const path$ = pathToFunc("/v1/workspaces/{workspace_id}/audit_streams/{environment}")(pathParams$);
+  const path$ = pathToFunc("/v1/workspaces/{workspace_id}/streams/{environment}")(pathParams$);
   const headers$ = new Headers(compactMap({
     "Content-Type": "application/json",
     Accept: options?.acceptHeaderOverride || "application/json;q=1, application/problem+json;q=0"
@@ -57318,7 +57318,7 @@ async function $do27(client$, request, options) {
       charEncoding: "percent"
     })
   };
-  const path$ = pathToFunc("/v1/workspaces/{workspace_id}/audit_settings/{environment}")(pathParams$);
+  const path$ = pathToFunc("/v1/workspaces/{workspace_id}/retention/{environment}")(pathParams$);
   const headers$ = new Headers(compactMap({
     Accept: options?.acceptHeaderOverride || "application/json;q=1, application/problem+json;q=0"
   }));
@@ -57530,7 +57530,7 @@ var init_auditeventlist = __esm(() => {
     items: array(AuditEvent$zodSchema),
     next_cursor: string2().optional().describe("Opaque cursor for the next page, MAC'd by the server and bound to the workspace it was issued for. Pass it back unchanged as cursor; a tampered, foreign or expired cursor answers 400 invalid_cursor."),
     workspace_id: string2().describe("The workspace id, which is also its live environment's workspace id; the test environment's is the same id with :test appended. A workspace created through the API is tnt_ and a 26-character ULID.")
-  }).describe("GET /v1/workspaces/{workspace_id}/audit_events: one page of the workspace's audit log, both environments, newest first. Events are kept for as long as the workspace exists and are deleted with it. next_cursor is present only when another page exists.");
+  }).describe("GET /v1/workspaces/{workspace_id}/audit: one page of the workspace's audit log, both environments, newest first. Events are kept for as long as the workspace exists and are deleted with it. next_cursor is present only when another page exists.");
 });
 
 // src/models/listauditeventsop.ts
@@ -57599,7 +57599,7 @@ async function $do28(client$, request, options) {
       charEncoding: "percent"
     })
   };
-  const path$ = pathToFunc("/v1/workspaces/{workspace_id}/audit_events")(pathParams$);
+  const path$ = pathToFunc("/v1/workspaces/{workspace_id}/audit")(pathParams$);
   const query$ = encodeFormQuery({
     action: payload$.action,
     actor: payload$.actor,
@@ -57775,7 +57775,7 @@ async function $do29(client$, request, options) {
       charEncoding: "percent"
     })
   };
-  const path$ = pathToFunc("/v1/workspaces/{workspace_id}/audit_streams/{environment}")(pathParams$);
+  const path$ = pathToFunc("/v1/workspaces/{workspace_id}/streams/{environment}")(pathParams$);
   const headers$ = new Headers(compactMap({
     Accept: options?.acceptHeaderOverride || "application/json;q=1, application/problem+json;q=0"
   }));
@@ -57943,7 +57943,7 @@ async function $do30(client$, request, options) {
       charEncoding: "percent"
     })
   };
-  const path$ = pathToFunc("/v1/workspaces/{workspace_id}/audit_streams/{environment}/{endpoint_id}")(pathParams$);
+  const path$ = pathToFunc("/v1/workspaces/{workspace_id}/streams/{environment}/{endpoint_id}")(pathParams$);
   const headers$ = new Headers(compactMap({
     Accept: options?.acceptHeaderOverride || "application/json;q=1, application/problem+json;q=0"
   }));
@@ -58122,7 +58122,7 @@ async function $do31(client$, request, options) {
       charEncoding: "percent"
     })
   };
-  const path$ = pathToFunc("/v1/workspaces/{workspace_id}/audit_streams/{environment}/{endpoint_id}/replay")(pathParams$);
+  const path$ = pathToFunc("/v1/workspaces/{workspace_id}/streams/{environment}/{endpoint_id}/replay")(pathParams$);
   const headers$ = new Headers(compactMap({
     "Content-Type": "application/json",
     Accept: options?.acceptHeaderOverride || "application/json;q=1, application/problem+json;q=0"
@@ -58286,7 +58286,7 @@ async function $do32(client$, request, options) {
       charEncoding: "percent"
     })
   };
-  const path$ = pathToFunc("/v1/workspaces/{workspace_id}/audit_settings/{environment}")(pathParams$);
+  const path$ = pathToFunc("/v1/workspaces/{workspace_id}/retention/{environment}")(pathParams$);
   const headers$ = new Headers(compactMap({
     "Content-Type": "application/json",
     Accept: options?.acceptHeaderOverride || "application/json;q=1, application/problem+json;q=0"
@@ -60170,7 +60170,7 @@ var init_customerexportrequest = __esm(() => {
   init_environment();
   init_responsemode();
   CustomerExportRequest$zodSchema = object({
-    account_id: string2().optional().describe("Your own opaque identifier for the account being checked, scoped to your workspace. Use an id you mint, with no direct identifier (email, phone, name or national id) in it. '|' is accepted so an Auth0 user id such as 'auth0|64abc' passes unchanged; '@', '+', '$' and whitespace are refused by the pattern, as is an exact-shape JWT; a hex digest such as a SHA-256 is allowed, because hashing an internal id is a common pseudonymous scheme. A value such as '07700900123' or 'jane.doe.gmail.com' cannot be told apart from an opaque id. It travels in bodies, and in a URL only as the path segment of GET /v1/accounts/{account_id}, its /assessments and its /linked_accounts. An assessment requested by a provider hook at pre_registration, which has no account yet, carries the server-issued account_id pre: followed by its assessment_id."),
+    account_id: string2().optional().describe("Your own opaque identifier for the account being checked, scoped to your workspace. Use an id you mint, with no direct identifier (email, phone, name or national id) in it. '|' is accepted so an Auth0 user id such as 'auth0|64abc' passes unchanged; '@', '+', '$' and whitespace are refused by the pattern, as is an exact-shape JWT; a hex digest such as a SHA-256 is allowed, because hashing an internal id is a common pseudonymous scheme. A value such as '07700900123' or 'jane.doe.gmail.com' cannot be told apart from an opaque id. It travels in bodies, and in a URL only as the path segment of GET /v1/accounts/{account_id}, its /assessments and its /links. An assessment requested by a provider hook at pre_registration, which has no account yet, carries the server-issued account_id pre: followed by its assessment_id."),
     environment: Environment$zodSchema,
     filter: CustomerExportRequestFilter$zodSchema.optional(),
     kind: CustomerExportRequestKind$zodSchema,
@@ -62359,6 +62359,58 @@ var init_screeningfinding = __esm(() => {
   }).describe("Something the analyser flagged. band is capped by the strongest match among the profiles of its evidence: possible at most moderate, probable at most high. capped_from is the band the analyser gave when the cap lowered it.");
 });
 
+// src/models/recordfield.ts
+var RecordField$zodSchema;
+var init_recordfield = __esm(() => {
+  init_zod();
+  RecordField$zodSchema = object({
+    field: string2().describe("The source's own name for the field. A nested value's name is dotted, and a list element's carries its index."),
+    kind: string2().optional().describe("What sort of value the field holds. Absent until the field's kind is known."),
+    original: string2().describe("The value as the source wrote it. A count is written in decimal and a time in RFC 3339."),
+    role: string2().optional().describe("Which common field it is, where many sources share it, such as handle, display_name, account_id, profile_link, picture, bio, website, linked_account (named by its network), account_status, joined, last_updated, organisation, location, followers, following or posts. Absent for a field only this source returns."),
+    value: string2().optional().describe("The cleaned value. Absent when it cannot be cleaned, or until the field's kind is known.")
+  }).describe("One value a source returned.");
+});
+
+// src/models/recordmatch.ts
+var RecordMatch$zodSchema;
+var init_recordmatch = __esm(() => {
+  init_zod();
+  RecordMatch$zodSchema = object({
+    by: string2().describe("The kind of searched value: email, phone, username, name, or handle for a profile read of a handle."),
+    field: string2().optional().describe("The field the searched value hit, when the record holds it.")
+  }).describe("One searched value that found the record.");
+});
+
+// src/models/recordsource.ts
+var RecordSource$zodSchema;
+var init_recordsource = __esm(() => {
+  init_zod();
+  RecordSource$zodSchema = object({
+    connector: string2().describe("The id of the connector that read the record."),
+    date: string2().optional().describe("When the source's data dates from, at the precision it is known."),
+    kind: string2().describe("The kind of source: platform for an account read off a live platform."),
+    site: string2().optional().describe("The host a person knows the source's site by."),
+    table: string2().optional().describe("The table a leaked row came from.")
+  }).describe("Where a record came from.");
+});
+
+// src/models/record.ts
+var RecordT$zodSchema;
+var init_record = __esm(() => {
+  init_zod();
+  init_recordfield();
+  init_recordmatch();
+  init_recordsource();
+  RecordT$zodSchema = object({
+    fields: array(RecordField$zodSchema).describe("Every field the source returned, in the order the source's connector lists them."),
+    id: string2().describe("Made from the source and the fields' names and original values, so the same answer found twice is one record with the same id."),
+    matched: array(RecordMatch$zodSchema).describe("Each kind of searched value that found the record."),
+    observed_at: string2().describe("When the source last gave this answer."),
+    source: RecordSource$zodSchema.describe("Where a record came from.")
+  }).describe("One answer from one source: where it came from, what found it and every field it holds.");
+});
+
 // src/models/screeninglookupcheckstatus.ts
 var ScreeningLookupCheckStatus$zodSchema;
 var init_screeninglookupcheckstatus = __esm(() => {
@@ -62394,6 +62446,7 @@ var init_screeninglookupcheck = __esm(() => {
 var ScreeningLookup$zodSchema;
 var init_screeninglookup = __esm(() => {
   init_zod();
+  init_record();
   init_riskdetails();
   init_risksummary();
   init_screeninglookupcheck();
@@ -62401,6 +62454,7 @@ var init_screeninglookup = __esm(() => {
     checks: array(ScreeningLookupCheck$zodSchema).describe("Each lane each identifier was looked up in, identifiers in the order email, phone, username and lanes in the order accounts, phone, breach, domain. Every lane the person's identifiers are looked up in is listed: one that no source answered, or that no source could be asked in, is not_covered. Empty when the person has no email, phone or handle to look up."),
     details: RiskDetails$zodSchema.optional().describe("Merged observations behind the summary, served only to a caller who may read evidence: no provider, source, origin, raw breach record or score."),
     looked_at: string2().describe("When the lookups ran."),
+    records: array(RecordT$zodSchema).optional().describe("What each source that found an account answered, whole: every field under the source's own names, each answer once. Served only to a caller who may read evidence, as details are."),
     summary: RiskSummary$zodSchema.optional().describe("A few typed facts per identifier: an assessment's risk.summary, and a screened person's lookup summary. Every fact is optional: absent means the evidence did not answer and makes no claim, while false or 0 is a definite answer.")
   }).describe("What the signup check's lookups found for a person: account presence for the email, phone and usernames (the person's handles), the phone lookup, the email domain's registration and the breach search. Context and coverage for the reviewer, not a finding: nothing here sets a band or a match state.");
 });
@@ -62520,6 +62574,7 @@ var init_screeningprofile = __esm(() => {
   init_zod();
   init_access();
   init_handleplatform();
+  init_record();
   init_screeningmatch();
   ScreeningProfile$zodSchema = object({
     access: Access$zodSchema.describe("public profiles were read; a private or locked one exists but could not be read."),
@@ -62537,6 +62592,7 @@ var init_screeningprofile = __esm(() => {
     period_from: string2().optional().describe("The oldest item read."),
     period_to: string2().optional().describe("The newest item read."),
     platform: HandlePlatform$zodSchema.describe("A platform a screening can cover. synthetic is the deterministic connector's own platform, for exercising the product end to end with no network."),
+    record: RecordT$zodSchema.optional().describe("One answer from one source: where it came from, what found it and every field it holds."),
     url: string2()
   }).describe("An account the screening matched to the person, how it was matched, and how much of it was read.");
 });
@@ -66040,7 +66096,7 @@ async function $do70(client$, request, options) {
       charEncoding: "percent"
     })
   };
-  const path$ = pathToFunc("/v1/workspaces/{workspace_id}/list_changes/{environment}/{change_id}")(pathParams$);
+  const path$ = pathToFunc("/v1/workspaces/{workspace_id}/changes/{environment}/{change_id}")(pathParams$);
   const headers$ = new Headers(compactMap({
     Accept: options?.acceptHeaderOverride || "application/json;q=1, application/problem+json;q=0"
   }));
@@ -68174,7 +68230,7 @@ var init_review = __esm(() => {
   init_resolution();
   init_reviewstatus();
   Review$zodSchema = object({
-    account_id: string2().describe("Your own opaque identifier for the account being checked, scoped to your workspace. Use an id you mint, with no direct identifier (email, phone, name or national id) in it. '|' is accepted so an Auth0 user id such as 'auth0|64abc' passes unchanged; '@', '+', '$' and whitespace are refused by the pattern, as is an exact-shape JWT; a hex digest such as a SHA-256 is allowed, because hashing an internal id is a common pseudonymous scheme. A value such as '07700900123' or 'jane.doe.gmail.com' cannot be told apart from an opaque id. It travels in bodies, and in a URL only as the path segment of GET /v1/accounts/{account_id}, its /assessments and its /linked_accounts. An assessment requested by a provider hook at pre_registration, which has no account yet, carries the server-issued account_id pre: followed by its assessment_id."),
+    account_id: string2().describe("Your own opaque identifier for the account being checked, scoped to your workspace. Use an id you mint, with no direct identifier (email, phone, name or national id) in it. '|' is accepted so an Auth0 user id such as 'auth0|64abc' passes unchanged; '@', '+', '$' and whitespace are refused by the pattern, as is an exact-shape JWT; a hex digest such as a SHA-256 is allowed, because hashing an internal id is a common pseudonymous scheme. A value such as '07700900123' or 'jane.doe.gmail.com' cannot be told apart from an opaque id. It travels in bodies, and in a URL only as the path segment of GET /v1/accounts/{account_id}, its /assessments and its /links. An assessment requested by a provider hook at pre_registration, which has no account yet, carries the server-issued account_id pre: followed by its assessment_id."),
     assignee: string2().optional(),
     assignee_principal_id: string2().optional().describe("Immutable workspace member ID. assignee is the historical display identity captured at assignment."),
     created_at: string2(),
@@ -68198,7 +68254,7 @@ var init_reviewcreaterequest = __esm(() => {
   init_zod();
   init_priority();
   ReviewCreateRequest$zodSchema = object({
-    account_id: string2().describe("Your own opaque identifier for the account being checked, scoped to your workspace. Use an id you mint, with no direct identifier (email, phone, name or national id) in it. '|' is accepted so an Auth0 user id such as 'auth0|64abc' passes unchanged; '@', '+', '$' and whitespace are refused by the pattern, as is an exact-shape JWT; a hex digest such as a SHA-256 is allowed, because hashing an internal id is a common pseudonymous scheme. A value such as '07700900123' or 'jane.doe.gmail.com' cannot be told apart from an opaque id. It travels in bodies, and in a URL only as the path segment of GET /v1/accounts/{account_id}, its /assessments and its /linked_accounts. An assessment requested by a provider hook at pre_registration, which has no account yet, carries the server-issued account_id pre: followed by its assessment_id."),
+    account_id: string2().describe("Your own opaque identifier for the account being checked, scoped to your workspace. Use an id you mint, with no direct identifier (email, phone, name or national id) in it. '|' is accepted so an Auth0 user id such as 'auth0|64abc' passes unchanged; '@', '+', '$' and whitespace are refused by the pattern, as is an exact-shape JWT; a hex digest such as a SHA-256 is allowed, because hashing an internal id is a common pseudonymous scheme. A value such as '07700900123' or 'jane.doe.gmail.com' cannot be told apart from an opaque id. It travels in bodies, and in a URL only as the path segment of GET /v1/accounts/{account_id}, its /assessments and its /links. An assessment requested by a provider hook at pre_registration, which has no account yet, carries the server-issued account_id pre: followed by its assessment_id."),
     assignee: string2().optional(),
     priority: Priority$zodSchema.optional()
   });
@@ -68478,7 +68534,7 @@ async function $do82(client$, request, options) {
       charEncoding: "percent"
     })
   };
-  const path$ = pathToFunc("/v1/workspaces/{workspace_id}/review_views/{environment}")(pathParams$);
+  const path$ = pathToFunc("/v1/workspaces/{workspace_id}/views/{environment}")(pathParams$);
   const headers$ = new Headers(compactMap({
     "Content-Type": "application/json",
     Accept: options?.acceptHeaderOverride || "application/json;q=1, application/problem+json;q=0"
@@ -68818,7 +68874,7 @@ async function $do84(client$, request, options) {
       charEncoding: "percent"
     })
   };
-  const path$ = pathToFunc("/v1/workspaces/{workspace_id}/review_views/{environment}/{view_id}")(pathParams$);
+  const path$ = pathToFunc("/v1/workspaces/{workspace_id}/views/{environment}/{view_id}")(pathParams$);
   const headers$ = new Headers(compactMap({
     "Content-Type": "application/json",
     Accept: "application/problem+json"
@@ -70089,7 +70145,7 @@ async function $do91(client$, request, options) {
       charEncoding: "percent"
     })
   };
-  const path$ = pathToFunc("/v1/workspaces/{workspace_id}/review_views/{environment}")(pathParams$);
+  const path$ = pathToFunc("/v1/workspaces/{workspace_id}/views/{environment}")(pathParams$);
   const headers$ = new Headers(compactMap({
     Accept: options?.acceptHeaderOverride || "application/json;q=1, application/problem+json;q=0"
   }));
@@ -70796,7 +70852,7 @@ async function $do95(client$, request, options) {
       charEncoding: "percent"
     })
   };
-  const path$ = pathToFunc("/v1/workspaces/{workspace_id}/review_views/{environment}/{view_id}")(pathParams$);
+  const path$ = pathToFunc("/v1/workspaces/{workspace_id}/views/{environment}/{view_id}")(pathParams$);
   const headers$ = new Headers(compactMap({
     "Content-Type": "application/json",
     Accept: options?.acceptHeaderOverride || "application/json;q=1, application/problem+json;q=0"
@@ -73415,7 +73471,7 @@ endpoint.verification sends a signed challenge now and answers whether the endpo
 function createMCPServer(deps) {
   const server = new McpServer({
     name: "NoResponse",
-    version: "0.12.1"
+    version: "0.13.1"
   });
   const getClient = deps.getSDK || (() => new NoResponseCore({
     security: deps.security,
@@ -82824,7 +82880,7 @@ var routes = buildRouteMap({
 var app = buildApplication(routes, {
   name: "mcp",
   versionInfo: {
-    currentVersion: "0.12.1"
+    currentVersion: "0.13.1"
   }
 });
 run(app, process3.argv.slice(2), buildContext(process3));
@@ -82832,5 +82888,5 @@ export {
   app
 };
 
-//# debugId=2B097BE19B8F0FBC64756E2164756E21
+//# debugId=4B22B4C2BCB237F064756E2164756E21
 //# sourceMappingURL=mcp-server.js.map